Summary:


NtCallbackReturn(>) 
 1 
NtConnectPort(>) 
 2 
NtUserGetProcessWindowStation(>) 
 5 
NtQueryDefaultLocale(>) 
 21 

NtContinue(>) 
 1 
NtCreateIoCompletion(>) 
 2 
NtUserSetProp(>) 
 5 
NtSetInformationProcess(>) 
 21 

NtCreateProcessEx(>) 
 1 
NtFsControlFile(>) 
 2 
NtWriteVirtualMemory(>) 
 5 
NtCreateFile(>) 
 22 

NtCreateThread(>) 
 1 
NtGdiCreateSolidBrush(>) 
 2 
NtGdiDeleteObjectApp(>) 
 6 
NtProtectVirtualMemory(>) 
 23 

NtDuplicateToken(>) 
 1 
NtGdiHfontCreate(>) 
 2 
NtOpenProcessToken(>) 
 6 
NtReleaseMutant(>) 
 24 

NtGdiCreateBitmap(>) 
 1 
NtOpenDirectoryObject(>) 
 2 
NtUserBuildHwndList(>) 
 6 
NtSetValueKey(>) 
 24 

NtGdiCreateHalftonePalette(>) 
 1 
NtOpenSymbolicLinkObject(>) 
 2 
NtUserCreateWindowEx(>) 
 6 
NtEnumerateKey(>) 
 25 

NtGdiCreatePaletteInternal(>) 
 1 
NtQueryInstallUILanguage(>) 
 2 
NtUserDestroyWindow(>) 
 6 
NtQueryInformationFile(>) 
 27 

NtGdiCreatePatternBrushInternal(>) 
 1 
NtQuerySymbolicLinkObject(>) 
 2 
NtAddAtom(>) 
 7 
NtCreateEvent(>) 
 28 

NtGdiDoPalette(>) 
 1 
NtTerminateProcess(>) 
 2 
NtCreateMutant(>) 
 7 
NtQueryDebugFilterState(>) 
 37 

NtGdiInit(>) 
 1 
NtUserCloseDesktop(>) 
 2 
NtOpenMutant(>) 
 9 
NtQueryInformationProcess(>) 
 38 

NtGdiQueryFontAssocInfo(>) 
 1 
NtUserGetObjectInformation(>) 
 2 
NtOpenThreadToken(>) 
 9 
NtWaitForSingleObject(>) 
 41 

NtGdiSelectBitmap(>) 
 1 
NtUserKillTimer(>) 
 2 
NtUserCallNoParam(>) 
 10 
NtUnmapViewOfSection(>) 
 43 

NtOpenKeyedEvent(>) 
 1 
NtUserPostMessage(>) 
 2 
NtUserGetWindowDC(>) 
 10 
NtOpenSection(>) 
 44 

NtQueryEvent(>) 
 1 
NtUserWaitForInputIdle(>) 
 2 
NtUserMessageCall(>) 
 10 
NtCreateSection(>) 
 45 

NtQueryInformationJobObject(>) 
 1 
NtWaitForMultipleObjects(>) 
 2 
NtUserRemoveProp(>) 
 10 
NtUserUnregisterClass(>) 
 46 

NtQueryObject(>) 
 1 
NtEnumerateValueKey(>) 
 3 
NtFlushInstructionCache(>) 
 11 
NtUserFindExistingCursorIcon(>) 
 51 

NtQuerySystemTime(>) 
 1 
NtOpenEvent(>) 
 3 
NtUserSystemParametersInfo(>) 
 11 
NtUserRegisterClassExWOW(>) 
 66 

NtRegisterThreadTerminatePort(>) 
 1 
NtReadVirtualMemory(>) 
 3 
NtUserRegisterWindowMessage(>) 
 12 
NtAllocateVirtualMemory(>) 
 67 

NtResumeThread(>) 
 1 
NtUserOpenDesktop(>) 
 3 
NtFreeVirtualMemory(>) 
 14 
NtMapViewOfSection(>) 
 68 

NtSecureConnectPort(>) 
 1 
NtUserPeekMessage(>) 
 3 
NtQueryVolumeInformationFile(>) 
 14 
NtOpenFile(>) 
 81 

NtTestAlert(>) 
 1 
NtDuplicateObject(>) 
 4 
NtReleaseSemaphore(>) 
 14 
NtQuerySystemInformation(>) 
 87 

NtUserBuildNameList(>) 
 1 
NtGdiCreateCompatibleDC(>) 
 4 
NtSetInformationThread(>) 
 15 
NtQueryAttributesFile(>) 
 92 

NtUserDestroyMenu(>) 
 1 
NtSetEvent(>) 
 4 
NtUserCallOneParam(>) 
 15 
NtUserGetClassInfo(>) 
 93 

NtUserGetAtomName(>) 
 1 
NtUserSetWindowLong(>) 
 4 
NtDeviceIoControlFile(>) 
 16 
NtOpenProcessTokenEx(>) 
 142 

NtUserGetDC(>) 
 1 
NtUserThunkedMenuItemInfo(>) 
 4 
NtNotifyChangeKey(>) 
 16 
NtOpenThreadTokenEx(>) 
 142 

NtUserGetForegroundWindow(>) 
 1 
NtCreateSemaphore(>) 
 5 
NtQueryDirectoryFile(>) 
 16 
NtQueryInformationToken(>) 
 149 

NtUserGetGUIThreadInfo(>) 
 1 
NtDeleteAtom(>) 
 5 
NtQuerySection(>) 
 16 
NtQueryKey(>) 
 149 

NtUserGetThreadDesktop(>) 
 1 
NtGdiGetStockObject(>) 
 5 
NtSetInformationFile(>) 
 16 
NtUserQueryWindow(>) 
 168 

NtUserSetMenuDefaultItem(>) 
 1 
NtOpenProcess(>) 
 5 
NtFindAtom(>) 
 17 
NtQueryValueKey(>) 
 351 

NtWriteFile(>) 
 1 
NtQueryVirtualMemory(>) 
 5 
NtRequestWaitReplyPort(>) 
 17 
NtOpenKey(>) 
 562 

NtAccessCheck(>) 
 2 
NtReadFile(>) 
 5 
NtCreateKey(>) 
 20 
NtClose(>) 
 609 

NtClearEvent(>) 
 2 
NtSetInformationObject(>) 
 5 
NtQueryDefaultUILanguage(>) 
 20 

Trace:
 00001   428   NtOpenKey  (0x80000000, {24, 0, 0x40, 0, 0,  (0x80000000, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\packed.exe"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00002   428   NtOpenKeyedEvent  (0x2000000, {24, 0, 0x0, 0, 0,  (0x2000000, {24, 0, 0x0, 0, 0, "\KernelObjects\CritSecOutOfMemoryEvent"}, ... 4, ) }, ... 4, ) == 0x0
 00003   428   NtQuerySystemInformation  (Basic, 44, ... {Unknown=0,MaximumIncrement=156250,PhysicalPageSize=0x1000,NumberOfPhysicalPages=0xff7c,LowestPhysicalPage=0x1,HighestPhysicalPage=0xffff,AllocationGranularity=0x10000,LowestUserAddress=0x10000,HighestUserAddress=0x7ffeffff,ActiveProcessors=1,NumberProcessors=1,}, 0x0, ) == 0x0
 00004   428   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ... 1310720, 1048576, ) == 0x0
 00005   428   NtAllocateVirtualMemory  (-1, 1310720, 0, 4096, 4096, 4, ... 1310720, 4096, ) == 0x0
 00006   428   NtAllocateVirtualMemory  (-1, 1314816, 0, 8192, 4096, 4, ... 1314816, 8192, ) == 0x0
 00007   428   NtQuerySystemInformation  (Basic, 44, ... {Unknown=0,MaximumIncrement=156250,PhysicalPageSize=0x1000,NumberOfPhysicalPages=0xff7c,LowestPhysicalPage=0x1,HighestPhysicalPage=0xffff,AllocationGranularity=0x10000,LowestUserAddress=0x10000,HighestUserAddress=0x7ffeffff,ActiveProcessors=1,NumberProcessors=1,}, 0x0, ) == 0x0
 00008   428   NtAllocateVirtualMemory  (-1, 0, 0, 65536, 8192, 4, ... 2359296, 65536, ) == 0x0
 00009   428   NtAllocateVirtualMemory  (-1, 2359296, 0, 24576, 4096, 4, ... 2359296, 24576, ) == 0x0
 00010   428   NtOpenDirectoryObject  (0x3, {24, 0, 0x40, 0, 0,  (0x3, {24, 0, 0x40, 0, 0, "\KnownDlls"}, ... 8, ) }, ... 8, ) == 0x0
 00011   428   NtOpenSymbolicLinkObject  (0x1, {24, 8, 0x40, 0, 0,  (0x1, {24, 8, 0x40, 0, 0, "KnownDllPath"}, ... 12, ) }, ... 12, ) == 0x0
 00012   428   NtQuerySymbolicLinkObject  (12, ...  (12, ... "C:\WINDOWS\system32", 0x0, ) , 0x0, ) == 0x0
 00013   428   NtClose  (12, ... ) == 0x0
 00014   428   NtOpenFile  (0x100020, {24, 0, 0x42, 0, 0,  (0x100020, {24, 0, 0x42, 0, 0, "\??\U:\startupscripts\"}, 3, 33, ... 12, {status=0x0, info=1}, ) }, 3, 33, ... 12, {status=0x0, info=1}, ) == 0x0
 00015   428   NtQueryVolumeInformationFile  (12, 1243848, 8, Device, ... {status=0x0, info=8}, ) == 0x0
 00016   428   NtFsControlFile  (12, 0, 0x0, 0x0, 0x90028, 0x0, 0, 0, ... ) == STATUS_INVALID_PARAMETER
 00017   428   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\u:\work\packed.exe.Local"}, 1243832, ... ) }, 1243832, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00018   428   NtOpenSection  (0xe, {24, 8, 0x40, 0, 0,  (0xe, {24, 8, 0x40, 0, 0, "kernel32.dll"}, ... 16, ) }, ... 16, ) == 0x0
 00019   428   NtMapViewOfSection  (16, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x77e60000), 0x0, 937984, ) == 0x0
 00020   428   NtClose  (16, ... ) == 0x0
 00021   428   NtQuerySystemInformation  (RangeStart, 4, ... {system info, class 50, size 4}, 0x0, ) == 0x0
 00022   428   NtQuerySystemInformation  (Basic, 44, ... {Unknown=0,MaximumIncrement=156250,PhysicalPageSize=0x1000,NumberOfPhysicalPages=0xff7c,LowestPhysicalPage=0x1,HighestPhysicalPage=0xffff,AllocationGranularity=0x10000,LowestUserAddress=0x10000,HighestUserAddress=0x7ffeffff,ActiveProcessors=1,NumberProcessors=1,}, 0x0, ) == 0x0
 00023   428   NtCreateSection  (0xf001f, 0x0, {65536, 0}, 4, 67108864, 0, ... 16, ) == 0x0
 00024   428   NtSecureConnectPort  ( ("\Windows\ApiPort", {0, 2, 1, 1}, {24, 16, 0, 65536, 0, 0}, 1319736, {12, 0, 0}, 1242016, 44, ... 24, {24, 16, 0, 65536, 2424832, 18415616}, {0, 0, 0}, 200, 44, ) , {0, 2, 1, 1}, {24, 16, 0, 65536, 0, 0}, 1319736, {12, 0, 0}, 1242016, 44, ... 24, {24, 16, 0, 65536, 2424832, 18415616}, {0, 0, 0}, 200, 44, ) == 0x0
 00025   428   NtClose  (16, ... ) == 0x0
 00026   428   NtQueryObject  (24, Handle, 2, ... {Inherit=0,ProtectFromClose=0,}, -1, ) == 0x0
 00027   428   NtSetInformationObject  (24, Handle, {Inherit=0,ProtectFromClose=1,}, 256, ... ) == 0x0
 00028   428   NtQuerySystemInformation  (Basic, 44, ... {Unknown=0,MaximumIncrement=156250,PhysicalPageSize=0x1000,NumberOfPhysicalPages=0xff7c,LowestPhysicalPage=0x1,HighestPhysicalPage=0xffff,AllocationGranularity=0x10000,LowestUserAddress=0x10000,HighestUserAddress=0x7ffeffff,ActiveProcessors=1,NumberProcessors=1,}, 0x0, ) == 0x0
 00029   428   NtQueryVirtualMemory  (-1, 0x250000, Basic, 28, ... {BaseAddress=0x250000,AllocationBase=0x250000,AllocationProtect=0x4,RegionSize=0x10000,State=0x2000,Protect=0x0,Type=0x40000,}, 0x0, ) == 0x0
 00030   428   NtAllocateVirtualMemory  (-1, 2424832, 0, 4096, 4096, 4, ... 2424832, 4096, ) == 0x0
 00031   428   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 0, 0, 0, 0}  (24, {28, 56, new_msg, 0, 0, 0, 0, 0} "\210\6\31\1\0\0\0\0\0\0\0\0\0\0\0\0\1\0\0\0\234\6\31\1\4\0\0\0" ... {28, 56, reply, 0, 420, 428, 1433, 0} "\3508\27\0\0\0\0\0\0\0\0\0\0\0\0\0\1\0\0\0\234\6\31\1\4\0\0\0" )  ... {28, 56, reply, 0, 420, 428, 1433, 0}  (24, {28, 56, new_msg, 0, 0, 0, 0, 0} "\210\6\31\1\0\0\0\0\0\0\0\0\0\0\0\0\1\0\0\0\234\6\31\1\4\0\0\0" ... {28, 56, reply, 0, 420, 428, 1433, 0} "\3508\27\0\0\0\0\0\0\0\0\0\0\0\0\0\1\0\0\0\234\6\31\1\4\0\0\0" )  ) == 0x0
 00032   428   NtRegisterThreadTerminatePort  (24, ... ) == 0x0
 00033   428   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\System\CurrentControlSet\Control\Terminal Server"}, ... 16, ) }, ... 16, ) == 0x0
 00034   428   NtQueryValueKey  (16,  (16, "TSAppCompat", Partial, 548, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) , Partial, 548, ... TitleIdx=0, Type=4, Data= (16, "TSAppCompat", Partial, 548, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) }, 16, ) == 0x0
 00035   428   NtClose  (16, ... ) == 0x0
 00036   428   NtOpenMutant  (0x1, {24, 0, 0x40, 0, 0,  (0x1, {24, 0, 0x40, 0, 0, "\NlsCacheMutant"}, ... 16, ) }, ... 16, ) == 0x0
 00037   428   NtOpenSection  (0x4, {24, 0, 0x40, 0, 0,  (0x4, {24, 0, 0x40, 0, 0, "\NLS\NlsSectionUnicode"}, ... 28, ) }, ... 28, ) == 0x0
 00038   428   NtMapViewOfSection  (28, -1, (0x0), 0, 0, 0x0, 0, 2, 0, 2, ... (0x260000), 0x0, 90112, ) == 0x0
 00039   428   NtClose  (28, ... ) == 0x0
 00040   428   NtQueryDefaultLocale  (0, 2012046252, ... ) == 0x0
 00041   428   NtOpenSection  (0x4, {24, 0, 0x40, 0, 0,  (0x4, {24, 0, 0x40, 0, 0, "\NLS\NlsSectionLocale"}, ... 28, ) }, ... 28, ) == 0x0
 00042   428   NtMapViewOfSection  (28, -1, (0x0), 0, 0, 0x0, 0, 2, 0, 2, ... (0x280000), 0x0, 212992, ) == 0x0
 00043   428   NtClose  (28, ... ) == 0x0
 00044   428   NtOpenSection  (0x5, {24, 0, 0x40, 0, 0,  (0x5, {24, 0, 0x40, 0, 0, "\NLS\NlsSectionSortkey"}, ... 28, ) }, ... 28, ) == 0x0
 00045   428   NtMapViewOfSection  (28, -1, (0x0), 0, 0, 0x0, 0, 2, 0, 2, ... (0x2c0000), 0x0, 266240, ) == 0x0
 00046   428   NtQuerySection  (28, Basic, 16, ... {BaseAddress=0x0,Attributes=0x800000,Size={0x40004, 0x0},}, 0x0, ) == 0x0
 00047   428   NtClose  (28, ... ) == 0x0
 00048   428   NtOpenSection  (0x4, {24, 0, 0x40, 0, 0,  (0x4, {24, 0, 0x40, 0, 0, "\NLS\NlsSectionSortTbls"}, ... 28, ) }, ... 28, ) == 0x0
 00049   428   NtMapViewOfSection  (28, -1, (0x0), 0, 0, 0x0, 0, 2, 0, 2, ... (0x310000), 0x0, 24576, ) == 0x0
 00050   428   NtClose  (28, ... ) == 0x0
 00051   428   NtQueryVirtualMemory  (-1, 0x7ffd2000, Basic, 28, ... {BaseAddress=0x7ffd2000,AllocationBase=0x7ffb0000,AllocationProtect=0x2,RegionSize=0x2000,State=0x1000,Protect=0x2,Type=0x40000,}, 0x0, ) == 0x0
 00052   428   NtOpenSection  (0x4, {24, 0, 0x40, 0, 0,  (0x4, {24, 0, 0x40, 0, 0, "\NLS\NlsSectionSortkey00000409"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00053   428   NtOpenSection  (0x4, {24, 0, 0x40, 0, 0,  (0x4, {24, 0, 0x40, 0, 0, "\NLS\NlsSectionSortkey00000409"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00054   428   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 2012558373, 2012047104, 2013025280, 0}  (24, {28, 56, new_msg, 0, 2012558373, 2012047104, 2013025280, 0} "\210\6\31\1\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\234\6\31\18\6\0\0" ... {28, 56, reply, 0, 420, 428, 1434, 0} "(\261\26\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\234\6\31\18\6\0\0" )  ... {28, 56, reply, 0, 420, 428, 1434, 0}  (24, {28, 56, new_msg, 0, 2012558373, 2012047104, 2013025280, 0} "\210\6\31\1\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\234\6\31\18\6\0\0" ... {28, 56, reply, 0, 420, 428, 1434, 0} "(\261\26\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\234\6\31\18\6\0\0" )  ) == 0x0
 00055   428   NtProtectVirtualMemory  (-1, (0x40b000), 8192, 4, ... (0x40b000), 8192, 8, ) == 0x0
 00056   428   NtProtectVirtualMemory  (-1, (0x40b000), 8192, 8, ... (0x40b000), 8192, 4, ) == 0x0
 00057   428   NtFlushInstructionCache  (-1, 4239360, 8192, ... ) == 0x0
 00058   428   NtOpenSection  (0xe, {24, 8, 0x40, 0, 0,  (0xe, {24, 8, 0x40, 0, 0, "user32.dll"}, ... 28, ) }, ... 28, ) == 0x0
 00059   428   NtMapViewOfSection  (28, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x77d40000), 0x0, 577536, ) == 0x0
 00060   428   NtClose  (28, ... ) == 0x0
 00061   428   NtOpenSection  (0xe, {24, 8, 0x40, 0, 0,  (0xe, {24, 8, 0x40, 0, 0, "GDI32.dll"}, ... 28, ) }, ... 28, ) == 0x0
 00062   428   NtMapViewOfSection  (28, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x77c70000), 0x0, 262144, ) == 0x0
 00063   428   NtClose  (28, ... ) == 0x0
 00064   428   NtOpenSection  (0xe, {24, 8, 0x40, 0, 0,  (0xe, {24, 8, 0x40, 0, 0, "ADVAPI32.dll"}, ... 28, ) }, ... 28, ) == 0x0
 00065   428   NtMapViewOfSection  (28, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x77dd0000), 0x0, 569344, ) == 0x0
 00066   428   NtClose  (28, ... ) == 0x0
 00067   428   NtOpenSection  (0xe, {24, 8, 0x40, 0, 0,  (0xe, {24, 8, 0x40, 0, 0, "RPCRT4.dll"}, ... 28, ) }, ... 28, ) == 0x0
 00068   428   NtMapViewOfSection  (28, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x77cc0000), 0x0, 479232, ) == 0x0
 00069   428   NtClose  (28, ... ) == 0x0
 00070   428   NtProtectVirtualMemory  (-1, (0x40b000), 8192, 4, ... (0x40b000), 8192, 4, ) == 0x0
 00071   428   NtProtectVirtualMemory  (-1, (0x40b000), 8192, 4, ... (0x40b000), 8192, 4, ) == 0x0
 00072   428   NtFlushInstructionCache  (-1, 4239360, 8192, ... ) == 0x0
 00073   428   NtProtectVirtualMemory  (-1, (0x40b000), 8192, 4, ... (0x40b000), 8192, 4, ) == 0x0
 00074   428   NtProtectVirtualMemory  (-1, (0x40b000), 8192, 4, ... (0x40b000), 8192, 4, ) == 0x0
 00075   428   NtFlushInstructionCache  (-1, 4239360, 8192, ... ) == 0x0
 00076   428   NtOpenSection  (0xe, {24, 8, 0x40, 0, 0,  (0xe, {24, 8, 0x40, 0, 0, "shell32.dll"}, ... 28, ) }, ... 28, ) == 0x0
 00077   428   NtMapViewOfSection  (28, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x773d0000), 0x0, 8339456, ) == 0x0
 00078   428   NtClose  (28, ... ) == 0x0
 00079   428   NtOpenSection  (0xe, {24, 8, 0x40, 0, 0,  (0xe, {24, 8, 0x40, 0, 0, "msvcrt.dll"}, ... 28, ) }, ... 28, ) == 0x0
 00080   428   NtMapViewOfSection  (28, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x77c10000), 0x0, 339968, ) == 0x0
 00081   428   NtClose  (28, ... ) == 0x0
 00082   428   NtOpenSection  (0xe, {24, 8, 0x40, 0, 0,  (0xe, {24, 8, 0x40, 0, 0, "SHLWAPI.dll"}, ... 28, ) }, ... 28, ) == 0x0
 00083   428   NtMapViewOfSection  (28, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x772d0000), 0x0, 405504, ) == 0x0
 00084   428   NtClose  (28, ... ) == 0x0
 00085   428   NtProtectVirtualMemory  (-1, (0x40b000), 8192, 4, ... (0x40b000), 8192, 4, ) == 0x0
 00086   428   NtProtectVirtualMemory  (-1, (0x40b000), 8192, 4, ... (0x40b000), 8192, 4, ) == 0x0
 00087   428   NtFlushInstructionCache  (-1, 4239360, 8192, ... ) == 0x0
 00088   428   NtOpenProcessToken  (-1, 0x8, ... 28, ) == 0x0
 00089   428   NtQueryInformationToken  (28, Statistics, 56, ... {token info, class 10, size 56}, 56, ) == 0x0
 00090   428   NtClose  (28, ... ) == 0x0
 00091   428   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\System\CurrentControlSet\Control\Terminal Server"}, ... 28, ) }, ... 28, ) == 0x0
 00092   428   NtQueryValueKey  (28,  (28, "TSAppCompat", Partial, 548, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) , Partial, 548, ... TitleIdx=0, Type=4, Data= (28, "TSAppCompat", Partial, 548, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) }, 16, ) == 0x0
 00093   428   NtClose  (28, ... ) == 0x0
 00094   428   NtAllocateVirtualMemory  (-1, 1323008, 0, 4096, 4096, 4, ... 1323008, 4096, ) == 0x0
 00095   428   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\System\CurrentControlSet\Control\Terminal Server"}, ... 28, ) }, ... 28, ) == 0x0
 00096   428   NtQueryValueKey  (28,  (28, "TSAppCompat", Partial, 548, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) , Partial, 548, ... TitleIdx=0, Type=4, Data= (28, "TSAppCompat", Partial, 548, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) }, 16, ) == 0x0
 00097   428   NtQueryValueKey  (28,  (28, "TSUserEnabled", Partial, 548, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) , Partial, 548, ... TitleIdx=0, Type=4, Data= (28, "TSUserEnabled", Partial, 548, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) }, 16, ) == 0x0
 00098   428   NtClose  (28, ... ) == 0x0
 00099   428   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon"}, ... 28, ) }, ... 28, ) == 0x0
 00100   428   NtQueryValueKey  (28,  (28, "LeakTrack", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00101   428   NtClose  (28, ... ) == 0x0
 00102   428   NtOpenKey  (0x2000000, {24, 0, 0x40, 0, 0,  (0x2000000, {24, 0, 0x40, 0, 0, "\REGISTRY\MACHINE"}, ... 28, ) }, ... 28, ) == 0x0
 00103   428   NtSetInformationObject  (28, Handle, {Inherit=0,ProtectFromClose=1,}, 2011365632, ... ) == 0x0
 00104   428   NtOpenKey  (0x20019, {24, 28, 0x40, 0, 0,  (0x20019, {24, 28, 0x40, 0, 0, "Software\Microsoft\Windows NT\CurrentVersion\Diagnostics"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00105   428   NtQuerySystemInformation  (Basic, 44, ... {Unknown=0,MaximumIncrement=156250,PhysicalPageSize=0x1000,NumberOfPhysicalPages=0xff7c,LowestPhysicalPage=0x1,HighestPhysicalPage=0xffff,AllocationGranularity=0x10000,LowestUserAddress=0x10000,HighestUserAddress=0x7ffeffff,ActiveProcessors=1,NumberProcessors=1,}, 0x0, ) == 0x0
 00106   428   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1246456, 1, 24, 2012568566}  (24, {28, 56, new_msg, 0, 1246456, 1, 24, 2012568566} "\210\6\31\1\0\0\0\0\314\4\23\0Ck\314\235\3\0\0\0\234\6\31\1$\1\0\0" ... {28, 56, reply, 0, 420, 428, 1437, 0} "XQ\26\0\0\0\0\0\0\0\0\0Ck\314\235\3\0\0\0\234\6\31\1$\1\0\0" )  ... {28, 56, reply, 0, 420, 428, 1437, 0}  (24, {28, 56, new_msg, 0, 1246456, 1, 24, 2012568566} "\210\6\31\1\0\0\0\0\314\4\23\0Ck\314\235\3\0\0\0\234\6\31\1$\1\0\0" ... {28, 56, reply, 0, 420, 428, 1437, 0} "XQ\26\0\0\0\0\0\0\0\0\0Ck\314\235\3\0\0\0\234\6\31\1$\1\0\0" )  ) == 0x0
 00107   428   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\System\CurrentControlSet\Control\Error Message Instrument\"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00108   428   NtMapViewOfSection  (32, -1, (0x0), 0, 0, 0x0, 0, 2, 0, 2, ... (0x410000), 0x0, 1060864, ) == 0x0
 00109   428   NtCreateEvent  (0x1f0003, 0x0, 1, 0, ... 36, ) == 0x0
 00110   428   NtOpenThreadTokenEx  (-2, 0x8, 1, 512, ... ) == STATUS_NO_TOKEN
 00111   428   NtOpenProcessTokenEx  (-1, 0x8, 512, ... -2147482208, ) == 0x0
 00112   428   NtQueryInformationToken  (-2147482208, Statistics, 0, ... ) == STATUS_BUFFER_TOO_SMALL
 00113   428   NtQueryInformationToken  (-2147482208, Statistics, 56, ... {token info, class 10, size 56}, 56, ) == 0x0
 00114   428   NtClose  (-2147482208, ... ) == 0x0
 00115   428   NtAllocateVirtualMemory  (-1, 0, 0, 32, 4096, 4, ... 4128768, 4096, ) == 0x0
 00116   428   NtFreeVirtualMemory  (-1, (0x3f0000), 4096, 32768, ... (0x3f0000), 4096, ) == 0x0
 00117   428   NtDuplicateObject  (-1, 40, -1, 0x0, 0, 2, ... 48, ) == 0x0
 00118   428   NtOpenKey  (0x20019, {24, 0, 0x240, 0, 0,  (0x20019, {24, 0, 0x240, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Compatibility32"}, ... -2147482208, ) }, ... -2147482208, ) == 0x0
 00119   428   NtQueryValueKey  (-2147482208,  (-2147482208, "packed", Partial, 172, ... ) , Partial, 172, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00120   428   NtClose  (-2147482208, ... ) == 0x0
 00121   428   NtOpenKey  (0x20019, {24, 0, 0x240, 0, 0,  (0x20019, {24, 0, 0x240, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\IME Compatibility"}, ... -2147482208, ) }, ... -2147482208, ) == 0x0
 00122   428   NtQueryValueKey  (-2147482208,  (-2147482208, "packed", Partial, 172, ... ) , Partial, 172, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00123   428   NtClose  (-2147482208, ... ) == 0x0
 00124   428   NtQueryDefaultLocale  (0, -132412916, ... ) == 0x0
 00125   428   NtGdiQueryFontAssocInfo  (0, ... ) == 0x0
 00126   428   NtUserCallNoParam  (24, ... ) == 0x0
 00127   428   NtGdiCreateCompatibleDC  (0, ...
 00128   428   NtAllocateVirtualMemory  (-1, 0, 0, 4096, 12288, 4, ... 4128768, 4096, ) == 0x0
 00127   428   NtGdiCreateCompatibleDC  ... ) == 0x5010414
 00129   428   NtGdiGetStockObject  (0, ... ) == 0x1900010
 00130   428   NtGdiGetStockObject  (4, ... ) == 0x1900011
 00131   428   NtGdiCreateBitmap  (8, 8, 1, 1, 2010393708, ... ) == 0x2050417
 00132   428   NtGdiCreateSolidBrush  (0, 0, ...
 00133   428   NtAllocateVirtualMemory  (-1, 0, 0, 4096, 12288, 4, ... 8519680, 4096, ) == 0x0
 00132   428   NtGdiCreateSolidBrush  ... ) == 0x1100418
 00134   428   NtGdiGetStockObject  (13, ... ) == 0x18a0021
 00135   428   NtGdiCreateCompatibleDC  (0, ... ) == 0x1010419
 00136   428   NtGdiSelectBitmap  (16843801, 33883159, ... ) == 0x185000f
 00137   428   NtUserGetThreadDesktop  (428, 0, ... ) == 0x2c
 00138   428   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Windows"}, ... 52, ) }, ... 52, ) == 0x0
 00139   428   NtQueryValueKey  (52,  (52, "AppInit_DLLs", Partial, 64, ... TitleIdx=0, Type=1, Data="\0\0"}, 14, ) , Partial, 64, ... TitleIdx=0, Type=1, Data= (52, "AppInit_DLLs", Partial, 64, ... TitleIdx=0, Type=1, Data="\0\0"}, 14, ) }, 14, ) == 0x0
 00140   428   NtClose  (52, ... ) == 0x0
 00141   428   NtUserFindExistingCursorIcon  (1241204, 1241220, 1241788, ... ) == 0x10011
 00142   428   NtUserRegisterClassExWOW  (1241724, 1241804, 1241788, 1241820, 673, 128, 0, ... ) == 0x810ec017
 00143   428   NtUserFindExistingCursorIcon  (1241204, 1241220, 1241788, ... ) == 0x10011
 00144   428   NtUserRegisterClassExWOW  (1241724, 1241804, 1241788, 1241820, 674, 128, 0, ... ) == 0x810ec01c
 00145   428   NtUserFindExistingCursorIcon  (1241204, 1241220, 1241788, ... ) == 0x10011
 00146   428   NtUserRegisterClassExWOW  (1241724, 1241804, 1241788, 1241820, 675, 128, 0, ... ) == 0x810ec01e
 00147   428   NtUserFindExistingCursorIcon  (1241204, 1241220, 1241788, ... ) == 0x10011
 00148   428   NtUserRegisterClassExWOW  (1241724, 1241804, 1241788, 1241820, 676, 128, 0, ... ) == 0x810e8002
 00149   428   NtUserFindExistingCursorIcon  (1241204, 1241220, 1241788, ... ) == 0x10013
 00150   428   NtUserRegisterClassExWOW  (1241724, 1241804, 1241788, 1241820, 677, 128, 0, ... ) == 0x810ec018
 00151   428   NtUserFindExistingCursorIcon  (1241204, 1241220, 1241788, ... ) == 0x10011
 00152   428   NtUserRegisterClassExWOW  (1241724, 1241804, 1241788, 1241820, 678, 128, 0, ... ) == 0x810ec01a
 00153   428   NtUserFindExistingCursorIcon  (1241204, 1241220, 1241788, ... ) == 0x10011
 00154   428   NtUserRegisterClassExWOW  (1241724, 1241804, 1241788, 1241820, 679, 128, 0, ... ) == 0x810ec01d
 00155   428   NtUserFindExistingCursorIcon  (1241204, 1241220, 1241788, ... ) == 0x10011
 00156   428   NtUserRegisterClassExWOW  (1241724, 1241804, 1241788, 1241820, 681, 128, 0, ... ) == 0x810ec026
 00157   428   NtUserFindExistingCursorIcon  (1241204, 1241220, 1241788, ... ) == 0x10011
 00158   428   NtUserRegisterClassExWOW  (1241724, 1241804, 1241788, 1241820, 680, 128, 0, ... ) == 0x810ec019
 00159   428   NtUserRegisterClassExWOW  (1241676, 1241756, 1241740, 1241772, 0, 128, 0, ...
 00160   428   NtAllocateVirtualMemory  (-1, 5468160, 0, 4096, 4096, 32, ... 5468160, 4096, ) == 0x0
 00159   428   NtUserRegisterClassExWOW  ... ) == 0x810ec020
 00161   428   NtUserRegisterClassExWOW  (1241676, 1241752, 1241768, 1241740, 0, 130, 0, ... ) == 0x810ec022
 00162   428   NtUserRegisterClassExWOW  (1241676, 1241756, 1241740, 1241772, 0, 128, 0, ... ) == 0x810ec023
 00163   428   NtUserRegisterClassExWOW  (1241676, 1241752, 1241768, 1241740, 0, 130, 0, ... ) == 0x810ec024
 00164   428   NtUserRegisterClassExWOW  (1241676, 1241756, 1241740, 1241772, 0, 128, 0, ... ) == 0x810ec025
 00165   428   NtCallbackReturn  (0, 0, 0, ...
 00166   428   NtGdiInit  (... ) == 0x1
 00167   428   NtGdiGetStockObject  (18, ... ) == 0x290001c
 00168   428   NtGdiGetStockObject  (19, ... ) == 0x1b00019
 00169   428   NtQuerySystemInformation  (Basic, 44, ... {Unknown=0,MaximumIncrement=156250,PhysicalPageSize=0x1000,NumberOfPhysicalPages=0xff7c,LowestPhysicalPage=0x1,HighestPhysicalPage=0xffff,AllocationGranularity=0x10000,LowestUserAddress=0x10000,HighestUserAddress=0x7ffeffff,ActiveProcessors=1,NumberProcessors=1,}, 0x0, ) == 0x0
 00170   428   NtAllocateVirtualMemory  (-1, 0, 0, 65536, 8192, 4, ... 8585216, 65536, ) == 0x0
 00171   428   NtAllocateVirtualMemory  (-1, 8585216, 0, 4096, 4096, 4, ... 8585216, 4096, ) == 0x0
 00172   428   NtAllocateVirtualMemory  (-1, 8589312, 0, 8192, 4096, 4, ... 8589312, 8192, ) == 0x0
 00173   428   NtOpenSection  (0x4, {24, 0, 0x40, 0, 0,  (0x4, {24, 0, 0x40, 0, 0, "\NLS\NlsSectionCType"}, ... 52, ) }, ... 52, ) == 0x0
 00174   428   NtMapViewOfSection  (52, -1, (0x0), 0, 0, 0x0, 0, 2, 0, 2, ... (0x840000), 0x0, 12288, ) == 0x0
 00175   428   NtClose  (52, ... ) == 0x0
 00176   428   NtAllocateVirtualMemory  (-1, 8597504, 0, 4096, 4096, 4, ... 8597504, 4096, ) == 0x0
 00177   428   NtOpenKey  (0x2000000, {24, 28, 0x40, 0, 0,  (0x2000000, {24, 28, 0x40, 0, 0, "Software\Microsoft\Windows\CurrentVersion\Explorer\Performance"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00178   428   NtOpenKey  (0x1, {24, 28, 0x40, 0, 0,  (0x1, {24, 28, 0x40, 0, 0, "SYSTEM\Setup"}, ... 52, ) }, ... 52, ) == 0x0
 00179   428   NtQueryValueKey  (52,  (52, "SystemSetupInProgress", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (52, "SystemSetupInProgress", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) }, 16, ) == 0x0
 00180   428   NtClose  (52, ... ) == 0x0
 00181   428   NtQueryDefaultUILanguage  (1241756, ...
 00182   428   NtOpenThreadTokenEx  (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN
 00183   428   NtOpenProcessTokenEx  (-1, 0x20008, 512, ... -2147482208, ) == 0x0
 00184   428   NtQueryInformationToken  (-2147482208, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0
 00185   428   NtClose  (-2147482208, ... ) == 0x0
 00186   428   NtOpenKey  (0x2000000, {24, 0, 0x640, 0, 0,  (0x2000000, {24, 0, 0x640, 0, 0, "\REGISTRY\USER\S-1-5-21-1078081533-484763869-839522115-1003"}, ... -2147482208, ) }, ... -2147482208, ) == 0x0
 00187   428   NtOpenKey  (0x80000000, {24, 0, 0x240, 0, 0,  (0x80000000, {24, 0, 0x240, 0, 0, "\Registry\Machine\System\CurrentControlSet\Control\Nls\MUILanguages"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00188   428   NtOpenKey  (0x80000000, {24, -2147482208, 0x640, 0, 0,  (0x80000000, {24, -2147482208, 0x640, 0, 0, "Control Panel\Desktop"}, ... -2147482204, ) }, ... -2147482204, ) == 0x0
 00189   428   NtQueryValueKey  (-2147482204,  (-2147482204, "MultiUILanguageId", Partial, 256, ... ) , Partial, 256, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00190   428   NtClose  (-2147482204, ... ) == 0x0
 00191   428   NtClose  (-2147482208, ... ) == 0x0
 00181   428   NtQueryDefaultUILanguage  ... ) == 0x0
 00192   428   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\System\CurrentControlSet\Control\Nls\MUILanguages"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00193   428   NtQueryInstallUILanguage  (2012047340, ... ) == 0x0
 00194   428   NtOpenFile  (0x1200a9, {24, 0, 0x40, 0, 0,  (0x1200a9, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\shell32.dll"}, 1, 96, ... 52, {status=0x0, info=1}, ) }, 1, 96, ... 52, {status=0x0, info=1}, ) == 0x0
 00195   428   NtCreateSection  (0x4, 0x0, 0x0, 2, 134217728, 52, ... 56, ) == 0x0
 00196   428   NtMapViewOfSection  (56, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 2, ... (0x850000), 0x0, 8323072, ) == 0x0
 00197   428   NtOpenFile  (0x1200a9, {24, 0, 0x40, 0, 0,  (0x1200a9, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\shell32.dll.124.Manifest"}, 1, 96, ... ) }, 1, 96, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00198   428   NtQueryDefaultUILanguage  (2013024600, ...
 00199   428   NtOpenThreadTokenEx  (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN
 00200   428   NtOpenProcessTokenEx  (-1, 0x20008, 512, ... -2147482204, ) == 0x0
 00201   428   NtQueryInformationToken  (-2147482204, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0
 00202   428   NtClose  (-2147482204, ... ) == 0x0
 00203   428   NtOpenKey  (0x2000000, {24, 0, 0x640, 0, 0,  (0x2000000, {24, 0, 0x640, 0, 0, "\REGISTRY\USER\S-1-5-21-1078081533-484763869-839522115-1003"}, ... -2147482204, ) }, ... -2147482204, ) == 0x0
 00204   428   NtOpenKey  (0x80000000, {24, 0, 0x240, 0, 0,  (0x80000000, {24, 0, 0x240, 0, 0, "\Registry\Machine\System\CurrentControlSet\Control\Nls\MUILanguages"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00205   428   NtOpenKey  (0x80000000, {24, -2147482204, 0x640, 0, 0,  (0x80000000, {24, -2147482204, 0x640, 0, 0, "Control Panel\Desktop"}, ... -2147482200, ) }, ... -2147482200, ) == 0x0
 00206   428   NtQueryValueKey  (-2147482200,  (-2147482200, "MultiUILanguageId", Partial, 256, ... ) , Partial, 256, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00207   428   NtClose  (-2147482200, ... ) == 0x0
 00208   428   NtClose  (-2147482204, ... ) == 0x0
 00198   428   NtQueryDefaultUILanguage  ... ) == 0x0
 00209   428   NtQueryInstallUILanguage  (2013024602, ... ) == 0x0
 00210   428   NtQueryDefaultLocale  (1, 1239792, ... ) == 0x0
 00211   428   NtOpenFile  (0x1200a9, {24, 0, 0x40, 0, 0,  (0x1200a9, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\shell32.dll.124.Config"}, 1, 96, ... ) }, 1, 96, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00212   428   NtRequestWaitReplyPort  (24, {128, 156, new_msg, 0, 1240648, 1, 96, 0}  (24, {128, 156, new_msg, 0, 1240648, 1, 96, 0} "\210\6\31\1\33\0\1\0\0\0\0\0\1\361\22\0\1\0\0\0\0\0\11\4\1\1\1\0>\0@\0\250\6\31\14\0\0\0\377\377\377\377\0\0\0\0\20\311\274\0\0\0\0\0\236\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0(\0,\0\350\6\31\1\0\0\0\0\0\0\0\0H\365\22\0\0\0\0\0" ... {128, 156, reply, 0, 420, 428, 1444, 0} "\210\347\26\0\33\0\1\0\0\0\0\0\1\361\22\0\1\0\0\0\0\0\11\4\1\1\1\0>\0@\0\250\6\31\14\0\0\0\377\377\377\377\0\0\0\0\20\311\274\0\0\0\0\0\236\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0(\0,\0\350\6\31\1\0\0\0\0\0\0\0\0H\365\22\0\0\0\0\0" )  ... {128, 156, reply, 0, 420, 428, 1444, 0}  (24, {128, 156, new_msg, 0, 1240648, 1, 96, 0} "\210\6\31\1\33\0\1\0\0\0\0\0\1\361\22\0\1\0\0\0\0\0\11\4\1\1\1\0>\0@\0\250\6\31\14\0\0\0\377\377\377\377\0\0\0\0\20\311\274\0\0\0\0\0\236\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0(\0,\0\350\6\31\1\0\0\0\0\0\0\0\0H\365\22\0\0\0\0\0" ... {128, 156, reply, 0, 420, 428, 1444, 0} "\210\347\26\0\33\0\1\0\0\0\0\0\1\361\22\0\1\0\0\0\0\0\11\4\1\1\1\0>\0@\0\250\6\31\14\0\0\0\377\377\377\377\0\0\0\0\20\311\274\0\0\0\0\0\236\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0(\0,\0\350\6\31\1\0\0\0\0\0\0\0\0H\365\22\0\0\0\0\0" )  ) == 0x0
 00213   428   NtClose  (52, ... ) == 0x0
 00214   428   NtClose  (56, ... ) == 0x0
 00215   428   NtUnmapViewOfSection  (-1, 0x850000, ... ) == 0x0
 00216   428   NtUnmapViewOfSection  (-1, 0x12f548, ... ) == STATUS_NOT_MAPPED_VIEW
 00217   428   NtQueryDebugFilterState  (53, 2, ... ) == 0x0
 00218   428   NtAllocateVirtualMemory  (-1, 1327104, 0, 4096, 4096, 4, ... 1327104, 4096, ) == 0x0
 00219   428   NtOpenKey  (0x1, {24, 0, 0x40, 0, 0,  (0x1, {24, 0, 0x40, 0, 0, "\Registry\MACHINE\System\CurrentControlSet\Control\Session Manager"}, ... 56, ) }, ... 56, ) == 0x0
 00220   428   NtQueryValueKey  (56,  (56, "SafeDllSearchMode", Partial, 16, ... ) , Partial, 16, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00221   428   NtClose  (56, ... ) == 0x0
 00222   428   NtOpenKey  (0x8, {24, 0, 0x40, 0, 0,  (0x8, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows\CurrentVersion\SideBySide\AssemblyStorageRoots"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00223   428   NtQueryDebugFilterState  (53, 2, ... ) == 0x0
 00224   428   NtQueryDebugFilterState  (53, 2, ... ) == 0x0
 00225   428   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\u:\work\packed.exe.Local\"}, 1238876, ... ) }, 1238876, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00226   428   NtQueryDebugFilterState  (53, 2, ... ) == 0x0
 00227   428   NtQueryDebugFilterState  (53, 2, ... ) == 0x0
 00228   428   NtQueryDebugFilterState  (53, 2, ... ) == 0x0
 00229   428   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.0.0_x-ww_1382d70a"}, 1239468, ... ) }, 1239468, ... ) == 0x0
 00230   428   NtOpenFile  (0x100020, {24, 0, 0x40, 0, 0,  (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.0.0_x-ww_1382d70a"}, 3, 33, ... 56, {status=0x0, info=1}, ) }, 3, 33, ... 56, {status=0x0, info=1}, ) == 0x0
 00231   428   NtQueryDebugFilterState  (53, 2, ... ) == 0x0
 00232   428   NtOpenFile  (0x100020, {24, 0, 0x40, 0, 0,  (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.0.0_x-ww_1382d70a\comctl32.dll"}, 5, 96, ... 52, {status=0x0, info=1}, ) }, 5, 96, ... 52, {status=0x0, info=1}, ) == 0x0
 00233   428   NtCreateSection  (0xe, 0x0, 0x0, 16, 134217728, 52, ... 60, ) == 0x0
 00234   428   NtClose  (52, ... ) == 0x0
 00235   428   NtMapViewOfSection  (60, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 16, ... (0x850000), 0x0, 921600, ) == 0x0
 00236   428   NtClose  (60, ... ) == 0x0
 00237   428   NtUnmapViewOfSection  (-1, 0x850000, ... ) == 0x0
 00238   428   NtOpenFile  (0x100020, {24, 0, 0x40, 0, 0,  (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.0.0_x-ww_1382d70a\comctl32.dll"}, 5, 96, ... 60, {status=0x0, info=1}, ) }, 5, 96, ... 60, {status=0x0, info=1}, ) == 0x0
 00239   428   NtCreateSection  (0xf, 0x0, 0x0, 16, 16777216, 60, ... 52, ) == 0x0
 00240   428   NtQuerySection  (52, Image, 48, ... {section info, class 1, size 48}, 0x0, ) == 0x0
 00241   428   NtOpenProcessToken  (-1, 0x8, ... 64, ) == 0x0
 00242   428   NtQueryInformationToken  (64, User, 136, ... {token info, class 1, size 36}, 36, ) == 0x0
 00243   428   NtOpenKey  (0x3, {24, 0, 0x40, 0, 0,  (0x3, {24, 0, 0x40, 0, 0, "\Registry\MACHINE\System\CurrentControlSet\Control\SafeBoot\Option"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00244   428   NtOpenKey  (0x1, {24, 0, 0x40, 0, 0,  (0x1, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers"}, ... 68, ) }, ... 68, ) == 0x0
 00245   428   NtQueryValueKey  (68,  (68, "TransparentEnabled", Partial, 80, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) , Partial, 80, ... TitleIdx=0, Type=4, Data= (68, "TransparentEnabled", Partial, 80, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) }, 16, ) == 0x0
 00246   428   NtClose  (68, ... ) == 0x0
 00247   428   NtOpenThreadTokenEx  (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN
 00248   428   NtOpenProcessTokenEx  (-1, 0x20008, 512, ... 68, ) == 0x0
 00249   428   NtQueryInformationToken  (68, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0
 00250   428   NtClose  (68, ... ) == 0x0
 00251   428   NtOpenKey  (0x1, {24, 0, 0x40, 0, 0,  (0x1, {24, 0, 0x40, 0, 0, "\REGISTRY\USER\S-1-5-21-1078081533-484763869-839522115-1003\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00252   428   NtClose  (64, ... ) == 0x0
 00253   428   NtClose  (60, ... ) == 0x0
 00254   428   NtMapViewOfSection  (52, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x71950000), 0x0, 933888, ) == 0x0
 00255   428   NtClose  (52, ... ) == 0x0
 00256   428   NtProtectVirtualMemory  (-1, (0x71951000), 1952, 4, ... (0x71951000), 4096, 32, ) == 0x0
 00257   428   NtProtectVirtualMemory  (-1, (0x71951000), 4096, 32, ... (0x71951000), 4096, 4, ) == 0x0
 00258   428   NtFlushInstructionCache  (-1, 1905594368, 1952, ... ) == 0x0
 00259   428   NtProtectVirtualMemory  (-1, (0x71951000), 1952, 4, ... (0x71951000), 4096, 32, ) == 0x0
 00260   428   NtProtectVirtualMemory  (-1, (0x71951000), 4096, 32, ... (0x71951000), 4096, 4, ) == 0x0
 00261   428   NtFlushInstructionCache  (-1, 1905594368, 1952, ... ) == 0x0
 00262   428   NtProtectVirtualMemory  (-1, (0x71951000), 1952, 4, ... (0x71951000), 4096, 32, ) == 0x0
 00263   428   NtProtectVirtualMemory  (-1, (0x71951000), 4096, 32, ... (0x71951000), 4096, 4, ) == 0x0
 00264   428   NtFlushInstructionCache  (-1, 1905594368, 1952, ... ) == 0x0
 00265   428   NtProtectVirtualMemory  (-1, (0x71951000), 1952, 4, ... (0x71951000), 4096, 32, ) == 0x0
 00266   428   NtProtectVirtualMemory  (-1, (0x71951000), 4096, 32, ... (0x71951000), 4096, 4, ) == 0x0
 00267   428   NtFlushInstructionCache  (-1, 1905594368, 1952, ... ) == 0x0
 00268   428   NtProtectVirtualMemory  (-1, (0x71951000), 1952, 4, ... (0x71951000), 4096, 32, ) == 0x0
 00269   428   NtProtectVirtualMemory  (-1, (0x71951000), 4096, 32, ... (0x71951000), 4096, 4, ) == 0x0
 00270   428   NtFlushInstructionCache  (-1, 1905594368, 1952, ... ) == 0x0
 00271   428   NtProtectVirtualMemory  (-1, (0x71951000), 1952, 4, ... (0x71951000), 4096, 32, ) == 0x0
 00272   428   NtProtectVirtualMemory  (-1, (0x71951000), 4096, 32, ... (0x71951000), 4096, 4, ) == 0x0
 00273   428   NtFlushInstructionCache  (-1, 1905594368, 1952, ... ) == 0x0
 00274   428   NtProtectVirtualMemory  (-1, (0x71951000), 1952, 4, ... (0x71951000), 4096, 32, ) == 0x0
 00275   428   NtProtectVirtualMemory  (-1, (0x71951000), 4096, 32, ... (0x71951000), 4096, 4, ) == 0x0
 00276   428   NtFlushInstructionCache  (-1, 1905594368, 1952, ... ) == 0x0
 00277   428   NtAddAtom  ( ("T\0h\0e\0m\0e\0P\0r\0o\0p\0S\0c\0r\0o\0l\0l\0B\0a\0r\0C\0t\0l\0", 42, 1240652, ... ) , 42, 1240652, ... ) == 0x0
 00278   428   NtQueryDefaultUILanguage  (1239368, ...
 00279   428   NtOpenThreadTokenEx  (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN
 00280   428   NtOpenProcessTokenEx  (-1, 0x20008, 512, ... -2147482204, ) == 0x0
 00281   428   NtQueryInformationToken  (-2147482204, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0
 00282   428   NtClose  (-2147482204, ... ) == 0x0
 00283   428   NtOpenKey  (0x2000000, {24, 0, 0x640, 0, 0,  (0x2000000, {24, 0, 0x640, 0, 0, "\REGISTRY\USER\S-1-5-21-1078081533-484763869-839522115-1003"}, ... -2147482204, ) }, ... -2147482204, ) == 0x0
 00284   428   NtOpenKey  (0x80000000, {24, 0, 0x240, 0, 0,  (0x80000000, {24, 0, 0x240, 0, 0, "\Registry\Machine\System\CurrentControlSet\Control\Nls\MUILanguages"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00285   428   NtOpenKey  (0x80000000, {24, -2147482204, 0x640, 0, 0,  (0x80000000, {24, -2147482204, 0x640, 0, 0, "Control Panel\Desktop"}, ... -2147482208, ) }, ... -2147482208, ) == 0x0
 00286   428   NtQueryValueKey  (-2147482208,  (-2147482208, "MultiUILanguageId", Partial, 256, ... ) , Partial, 256, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00287   428   NtClose  (-2147482208, ... ) == 0x0
 00288   428   NtClose  (-2147482204, ... ) == 0x0
 00278   428   NtQueryDefaultUILanguage  ... ) == 0x0
 00289   428   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\System\CurrentControlSet\Control\Nls\MUILanguages"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00290   428   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\WindowsShell.Manifest"}, 1238220, ... ) }, 1238220, ... ) == 0x0
 00291   428   NtOpenFile  (0x100020, {24, 0, 0x40, 0, 0,  (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\WindowsShell.Manifest"}, 5, 96, ... 52, {status=0x0, info=1}, ) }, 5, 96, ... 52, {status=0x0, info=1}, ) == 0x0
 00292   428   NtCreateSection  (0xe, 0x0, 0x0, 16, 134217728, 52, ... 60, ) == 0x0
 00293   428   NtClose  (52, ... ) == 0x0
 00294   428   NtMapViewOfSection  (60, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 16, ... (0x850000), 0x0, 4096, ) == 0x0
 00295   428   NtClose  (60, ... ) == 0x0
 00296   428   NtUnmapViewOfSection  (-1, 0x850000, ... ) == 0x0
 00297   428   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\WindowsShell.Manifest"}, 1237860, ... ) }, 1237860, ... ) == 0x0
 00298   428   NtCreateFile  (0x80100080, {24, 0, 0x40, 0, 1238560,  (0x80100080, {24, 0, 0x40, 0, 1238560, "\??\C:\WINDOWS\WindowsShell.Manifest"}, 0x0, 0, 5, 1, 96, 0, 0, ... 60, {status=0x0, info=1}, ) }, 0x0, 0, 5, 1, 96, 0, 0, ... 60, {status=0x0, info=1}, ) == 0x0
 00299   428   NtCreateSection  (0xf0005, 0x0, 0x0, 2, 134217728, 60, ... 52, ) == 0x0
 00300   428   NtClose  (60, ... ) == 0x0
 00301   428   NtMapViewOfSection  (52, -1, (0x0), 0, 0, {0, 0}, 0, 1, 0, 2, ... (0x850000), {0, 0}, 4096, ) == 0x0
 00302   428   NtClose  (52, ... ) == 0x0
 00303   428   NtUnmapViewOfSection  (-1, 0x850000, ... ) == 0x0
 00304   428   NtOpenFile  (0x1200a9, {24, 0, 0x40, 0, 0,  (0x1200a9, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\WindowsShell.Manifest"}, 1, 96, ... 52, {status=0x0, info=1}, ) }, 1, 96, ... 52, {status=0x0, info=1}, ) == 0x0
 00305   428   NtCreateSection  (0x4, 0x0, 0x0, 2, 134217728, 52, ... 60, ) == 0x0
 00306   428   NtMapViewOfSection  (60, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 2, ... (0x850000), 0x0, 4096, ) == 0x0
 00307   428   NtQueryInformationFile  (52, 1238180, 56, NetworkOpen, ... {status=0x0, info=56}, ) == 0x0
 00308   428   NtOpenFile  (0x1200a9, {24, 0, 0x40, 0, 0,  (0x1200a9, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\WindowsShell.Config"}, 1, 96, ... ) }, 1, 96, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00309   428   NtRequestWaitReplyPort  (24, {128, 156, new_msg, 0, 1238260, 1, 96, 0}  (24, {128, 156, new_msg, 0, 1238260, 1, 96, 0} "\210\6\31\1\33\0\1\0\240\315Z\371\2209\307\1\1\0\0\0\0\0\11\4\1\1\3\0@\0D\0\250\6\31\14\0\0\0<\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\355\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\26\0\30\0\354\6\31\1\0\0\0\0\0\0\0\0\364\353\22\0\0\0\0\0" ... {128, 156, reply, 0, 420, 428, 1445, 0} "h\334\26\0\33\0\1\0\0\0\0\0\2209\307\1\1\0\0\0\0\0\11\4\1\1\3\0@\0D\0\250\6\31\14\0\0\0<\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\355\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\26\0\30\0\354\6\31\1\0\0\0\0\0\0\0\0\364\353\22\0\0\0\0\0" )  ... {128, 156, reply, 0, 420, 428, 1445, 0}  (24, {128, 156, new_msg, 0, 1238260, 1, 96, 0} "\210\6\31\1\33\0\1\0\240\315Z\371\2209\307\1\1\0\0\0\0\0\11\4\1\1\3\0@\0D\0\250\6\31\14\0\0\0<\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\355\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\26\0\30\0\354\6\31\1\0\0\0\0\0\0\0\0\364\353\22\0\0\0\0\0" ... {128, 156, reply, 0, 420, 428, 1445, 0} "h\334\26\0\33\0\1\0\0\0\0\0\2209\307\1\1\0\0\0\0\0\11\4\1\1\3\0@\0D\0\250\6\31\14\0\0\0<\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\355\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\26\0\30\0\354\6\31\1\0\0\0\0\0\0\0\0\364\353\22\0\0\0\0\0" )  ) == 0x0
 00310   428   NtClose  (52, ... ) == 0x0
 00311   428   NtClose  (60, ... ) == 0x0
 00312   428   NtUnmapViewOfSection  (-1, 0x850000, ... ) == 0x0
 00313   428   NtUnmapViewOfSection  (-1, 0x12ebf4, ... ) == STATUS_NOT_MAPPED_VIEW
 00314   428   NtQueryDebugFilterState  (53, 2, ... ) == 0x0
 00315   428   NtUserRegisterWindowMessage  ( ("ShellGetDragImage", ... ) , ... ) == 0xc03a
 00316   428   NtUserSystemParametersInfo  (104, 0, 1906151468, 0, ... ) == 0x1
 00317   428   NtUserGetDC  (0, ... ) == 0x1010053
 00318   428   NtUserCallOneParam  (16842835, 56, ... ) == 0x1
 00319   428   NtUserSystemParametersInfo  (38, 4, 1906153440, 0, ... ) == 0x1
 00320   428   NtUserSystemParametersInfo  (66, 12, 1240672, 0, ... ) == 0x1
 00321   428   NtOpenProcessToken  (-1, 0x8, ... 60, ) == 0x0
 00322   428   NtAccessCheck  (1329232, 60, 0x1, 1240076, 1240020, 56, 1240104, ... ) == STATUS_NO_IMPERSONATION_TOKEN
 00323   428   NtClose  (60, ... ) == 0x0
 00324   428   NtOpenThreadTokenEx  (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN
 00325   428   NtOpenProcessTokenEx  (-1, 0x20008, 512, ... 60, ) == 0x0
 00326   428   NtQueryInformationToken  (60, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0
 00327   428   NtClose  (60, ... ) == 0x0
 00328   428   NtOpenKey  (0x2000000, {24, 0, 0x640, 0, 0,  (0x2000000, {24, 0, 0x640, 0, 0, "\REGISTRY\USER\S-1-5-21-1078081533-484763869-839522115-1003"}, ... 60, ) }, ... 60, ) == 0x0
 00329   428   NtSetInformationObject  (60, Handle, {Inherit=0,ProtectFromClose=1,}, 1179904, ... ) == 0x0
 00330   428   NtOpenKey  (0x20019, {24, 60, 0x40, 0, 0,  (0x20019, {24, 60, 0x40, 0, 0, "Control Panel\Desktop"}, ... 52, ) }, ... 52, ) == 0x0
 00331   428   NtQueryValueKey  (52,  (52, "SmoothScroll", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00332   428   NtClose  (52, ... ) == 0x0
 00333   428   NtUserSystemParametersInfo  (41, 500, 1240172, 0, ... ) == 0x1
 00334   428   NtOpenKey  (0x1, {24, 60, 0x40, 0, 0,  (0x1, {24, 60, 0x40, 0, 0, "software\Microsoft\Windows\CurrentVersion\Explorer\Advanced"}, ... 52, ) }, ... 52, ) == 0x0
 00335   428   NtQueryValueKey  (52,  (52, "EnableBalloonTips", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00336   428   NtOpenKey  (0x1, {24, 28, 0x40, 0, 0,  (0x1, {24, 28, 0x40, 0, 0, "software\Microsoft\Windows\CurrentVersion\Explorer\Advanced"}, ... 64, ) }, ... 64, ) == 0x0
 00337   428   NtQueryValueKey  (64,  (64, "EnableBalloonTips", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00338   428   NtClose  (64, ... ) == 0x0
 00339   428   NtClose  (52, ... ) == 0x0
 00340   428   NtUserSystemParametersInfo  (102, 0, 1906153328, 0, ... ) == 0x1
 00341   428   NtUserSystemParametersInfo  (4130, 0, 1240696, 0, ... ) == 0x1
 00342   428   NtOpenKey  (0x1, {24, 28, 0x40, 0, 0,  (0x1, {24, 28, 0x40, 0, 0, "Software\Microsoft\Windows NT\CurrentVersion\LanguagePack"}, ... 52, ) }, ... 52, ) == 0x0
 00343   428   NtEnumerateValueKey  (52, 0, Full, 220, ... ) == STATUS_NO_MORE_ENTRIES
 00344   428   NtClose  (52, ... ) == 0x0
 00345   428   NtUserFindExistingCursorIcon  (1239980, 1239996, 1240564, ... ) == 0x10011
 00346   428   NtUserRegisterClassExWOW  (1240432, 1240512, 1240496, 1240528, 0, 384, 0, ... ) == 0x810ec03b
 00347   428   NtUserRegisterClassExWOW  (1240432, 1240512, 1240496, 1240528, 0, 384, 0, ... ) == 0x810ec03d
 00348   428   NtUserFindExistingCursorIcon  (1239976, 1239992, 1240560, ... ) == 0x10011
 00349   428   NtUserRegisterClassExWOW  (1240428, 1240508, 1240492, 1240524, 0, 384, 0, ... ) == 0x810ec03f
 00350   428   NtUserFindExistingCursorIcon  (1239980, 1239996, 1240564, ... ) == 0x10011
 00351   428   NtUserRegisterClassExWOW  (1240432, 1240512, 1240496, 1240528, 0, 384, 0, ... ) == 0x810ec041
 00352   428   NtUserFindExistingCursorIcon  (1239980, 1239996, 1240564, ... ) == 0x10011
 00353   428   NtUserRegisterClassExWOW  (1240432, 1240512, 1240496, 1240528, 0, 384, 0, ... ) == 0x810ec043
 00354   428   NtUserRegisterClassExWOW  (1240432, 1240512, 1240496, 1240528, 0, 384, 0, ... ) == 0x810ec045
 00355   428   NtUserFindExistingCursorIcon  (1239980, 1239996, 1240564, ... ) == 0x10011
 00356   428   NtUserRegisterClassExWOW  (1240432, 1240512, 1240496, 1240528, 0, 384, 0, ... ) == 0x810ec047
 00357   428   NtUserFindExistingCursorIcon  (1239976, 1239992, 1240560, ... ) == 0x10011
 00358   428   NtUserRegisterClassExWOW  (1240428, 1240508, 1240492, 1240524, 0, 384, 0, ... ) == 0x810ec049
 00359   428   NtUserGetClassInfo  (1905590272, 1240592, 1240544, 1240620, 0, ... ) == 0xc049
 00360   428   NtUserFindExistingCursorIcon  (1239980, 1239996, 1240564, ... ) == 0x10011
 00361   428   NtUserRegisterClassExWOW  (1240432, 1240512, 1240496, 1240528, 0, 384, 0, ... ) == 0x810ec04b
 00362   428   NtUserFindExistingCursorIcon  (1239980, 1239996, 1240564, ... ) == 0x10011
 00363   428   NtUserRegisterClassExWOW  (1240432, 1240512, 1240496, 1240528, 0, 384, 0, ... ) == 0x810ec04d
 00364   428   NtUserFindExistingCursorIcon  (1239980, 1239996, 1240564, ... ) == 0x10011
 00365   428   NtUserRegisterClassExWOW  (1240432, 1240512, 1240496, 1240528, 0, 384, 0, ... ) == 0x810ec04f
 00366   428   NtUserRegisterClassExWOW  (1240432, 1240512, 1240496, 1240528, 0, 384, 0, ... ) == 0x810ec051
 00367   428   NtUserFindExistingCursorIcon  (1239980, 1239996, 1240564, ... ) == 0x10011
 00368   428   NtUserRegisterClassExWOW  (1240432, 1240512, 1240496, 1240528, 0, 384, 0, ... ) == 0x810ec053
 00369   428   NtUserFindExistingCursorIcon  (1239976, 1239992, 1240560, ... ) == 0x10011
 00370   428   NtUserRegisterClassExWOW  (1240428, 1240508, 1240492, 1240524, 0, 384, 0, ... ) == 0x810ec055
 00371   428   NtUserRegisterClassExWOW  (1240428, 1240508, 1240492, 1240524, 0, 384, 0, ... ) == 0x810ec057
 00372   428   NtUserFindExistingCursorIcon  (1239980, 1239996, 1240564, ... ) == 0x10011
 00373   428   NtUserRegisterClassExWOW  (1240432, 1240512, 1240496, 1240528, 0, 384, 0, ... ) == 0x810ec059
 00374   428   NtUserFindExistingCursorIcon  (1239980, 1239996, 1240564, ... ) == 0x10013
 00375   428   NtUserRegisterClassExWOW  (1240432, 1240512, 1240496, 1240528, 0, 384, 0, ... ) == 0x810ec05b
 00376   428   NtUserFindExistingCursorIcon  (1239980, 1239996, 1240564, ... ) == 0x10011
 00377   428   NtUserRegisterClassExWOW  (1240432, 1240512, 1240496, 1240528, 0, 384, 0, ... ) == 0x810ec05d
 00378   428   NtUserFindExistingCursorIcon  (1239980, 1239996, 1240564, ... ) == 0x10011
 00379   428   NtUserRegisterClassExWOW  (1240432, 1240512, 1240496, 1240528, 0, 384, 0, ... ) == 0x810ec05f
 00380   428   NtUserFindExistingCursorIcon  (1239976, 1239992, 1240560, ... ) == 0x10011
 00381   428   NtUserRegisterClassExWOW  (1240428, 1240508, 1240492, 1240524, 0, 384, 0, ... ) == 0x810ec017
 00382   428   NtUserFindExistingCursorIcon  (1239976, 1239992, 1240560, ... ) == 0x10011
 00383   428   NtUserRegisterClassExWOW  (1240428, 1240508, 1240492, 1240524, 0, 384, 0, ... ) == 0x810ec019
 00384   428   NtUserFindExistingCursorIcon  (1239976, 1239992, 1240560, ... ) == 0x10013
 00385   428   NtUserRegisterClassExWOW  (1240428, 1240508, 1240492, 1240524, 0, 384, 0, ... ) == 0x810ec018
 00386   428   NtUserFindExistingCursorIcon  (1239980, 1239996, 1240564, ... ) == 0x10011
 00387   428   NtUserRegisterClassExWOW  (1240432, 1240512, 1240496, 1240528, 0, 384, 0, ... ) == 0x810ec01a
 00388   428   NtUserFindExistingCursorIcon  (1239976, 1239992, 1240560, ... ) == 0x10011
 00389   428   NtUserRegisterClassExWOW  (1240428, 1240508, 1240492, 1240524, 0, 384, 0, ... ) == 0x810ec01c
 00390   428   NtUserFindExistingCursorIcon  (1239980, 1239996, 1240564, ... ) == 0x10011
 00391   428   NtUserRegisterClassExWOW  (1240432, 1240512, 1240496, 1240528, 0, 384, 0, ...
 00392   428   NtAllocateVirtualMemory  (-1, 5472256, 0, 4096, 4096, 32, ... 5472256, 4096, ) == 0x0
 00391   428   NtUserRegisterClassExWOW  ... ) == 0x810ec01e
 00393   428   NtUserFindExistingCursorIcon  (1239976, 1239992, 1240560, ... ) == 0x10011
 00394   428   NtUserRegisterClassExWOW  (1240488, 1240568, 1240552, 1240584, 0, 384, 0, ... ) == 0x810ec01b
 00395   428   NtUserFindExistingCursorIcon  (1239972, 1239988, 1240556, ... ) == 0x10011
 00396   428   NtUserRegisterClassExWOW  (1240484, 1240564, 1240548, 1240580, 0, 384, 0, ... ) == 0x810ec068
 00397   428   NtUserFindExistingCursorIcon  (1239980, 1239996, 1240564, ... ) == 0x10011
 00398   428   NtUserRegisterClassExWOW  (1240432, 1240512, 1240496, 1240528, 0, 384, 0, ... ) == 0x810ec06a
 00399   428   NtOpenSection  (0xe, {24, 8, 0x40, 0, 0,  (0xe, {24, 8, 0x40, 0, 0, "comctl32.dll"}, ... 52, ) }, ... 52, ) == 0x0
 00400   428   NtMapViewOfSection  (52, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x77340000), 0x0, 569344, ) == 0x0
 00401   428   NtClose  (52, ... ) == 0x0
 00402   428   NtOpenProcess  (0x400, {24, 0, 0x0, 0, 0, 0x0}, {420, 0}, ... 52, ) == 0x0
 00403   428   NtQueryInformationProcess  (52, Session, 4, ... {SessionId=0,}, 0x0, ) == 0x0
 00404   428   NtClose  (52, ... ) == 0x0
 00405   428   NtUserRegisterWindowMessage  ( ("ShellGetDragImage", ... ) , ... ) == 0xc03a
 00406   428   NtUserSystemParametersInfo  (104, 0, 2000318720, 0, ... ) == 0x1
 00407   428   NtUserSystemParametersInfo  (38, 4, 2000318708, 0, ... ) == 0x1
 00408   428   NtOpenKey  (0x20019, {24, 60, 0x40, 0, 0,  (0x20019, {24, 60, 0x40, 0, 0, "Control Panel\Desktop"}, ... 52, ) }, ... 52, ) == 0x0
 00409   428   NtQueryValueKey  (52,  (52, "SmoothScroll", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00410   428   NtClose  (52, ... ) == 0x0
 00411   428   NtUserSystemParametersInfo  (41, 500, 1241332, 0, ... ) == 0x1
 00412   428   NtUserSystemParametersInfo  (102, 0, 2000318732, 0, ... ) == 0x1
 00413   428   NtUserGetClassInfo  (1999896576, 1241740, 1241692, 1241768, 0, ... ) == 0x0
 00414   428   NtUserFindExistingCursorIcon  (1241124, 1241140, 1241708, ... ) == 0x10011
 00415   428   NtUserRegisterClassExWOW  (1241576, 1241656, 1241640, 1241672, 0, 384, 0, ... ) == 0x810ec03b
 00416   428   NtUserGetClassInfo  (1999896576, 1241740, 1241692, 1241768, 0, ... ) == 0x0
 00417   428   NtUserRegisterClassExWOW  (1241576, 1241656, 1241640, 1241672, 0, 384, 0, ... ) == 0x810ec03d
 00418   428   NtUserGetClassInfo  (1999896576, 1241740, 1241692, 1241768, 0, ... ) == 0x0
 00419   428   NtUserFindExistingCursorIcon  (1241124, 1241140, 1241708, ... ) == 0x10011
 00420   428   NtUserRegisterClassExWOW  (1241576, 1241656, 1241640, 1241672, 0, 384, 0, ... ) == 0x810ec03f
 00421   428   NtUserGetClassInfo  (1999896576, 1241740, 1241692, 1241768, 0, ... ) == 0x0
 00422   428   NtUserFindExistingCursorIcon  (1241124, 1241140, 1241708, ... ) == 0x10011
 00423   428   NtUserRegisterClassExWOW  (1241576, 1241656, 1241640, 1241672, 0, 384, 0, ... ) == 0x810ec041
 00424   428   NtUserGetClassInfo  (1999896576, 1241740, 1241692, 1241768, 0, ... ) == 0x0
 00425   428   NtUserFindExistingCursorIcon  (1241124, 1241140, 1241708, ... ) == 0x10011
 00426   428   NtUserRegisterClassExWOW  (1241576, 1241656, 1241640, 1241672, 0, 384, 0, ... ) == 0x810ec043
 00427   428   NtUserGetClassInfo  (1999896576, 1241740, 1241692, 1241768, 0, ... ) == 0x0
 00428   428   NtUserRegisterClassExWOW  (1241576, 1241656, 1241640, 1241672, 0, 384, 0, ... ) == 0x810ec045
 00429   428   NtUserGetClassInfo  (1999896576, 1241740, 1241692, 1241768, 0, ... ) == 0x0
 00430   428   NtUserFindExistingCursorIcon  (1241124, 1241140, 1241708, ... ) == 0x10011
 00431   428   NtUserRegisterClassExWOW  (1241576, 1241656, 1241640, 1241672, 0, 384, 0, ... ) == 0x810ec047
 00432   428   NtUserGetClassInfo  (1999896576, 1241740, 1241692, 1241768, 0, ... ) == 0x0
 00433   428   NtUserFindExistingCursorIcon  (1241120, 1241136, 1241704, ... ) == 0x10011
 00434   428   NtUserRegisterClassExWOW  (1241572, 1241652, 1241636, 1241668, 0, 384, 0, ... ) == 0x810ec049
 00435   428   NtUserGetClassInfo  (1999896576, 1241740, 1241692, 1241768, 0, ... ) == 0x0
 00436   428   NtUserFindExistingCursorIcon  (1241124, 1241140, 1241708, ... ) == 0x10011
 00437   428   NtUserRegisterClassExWOW  (1241576, 1241656, 1241640, 1241672, 0, 384, 0, ... ) == 0x810ec04b
 00438   428   NtUserGetClassInfo  (1999896576, 1241740, 1241692, 1241768, 0, ... ) == 0x0
 00439   428   NtUserFindExistingCursorIcon  (1241124, 1241140, 1241708, ... ) == 0x10011
 00440   428   NtUserRegisterClassExWOW  (1241576, 1241656, 1241640, 1241672, 0, 384, 0, ... ) == 0x810ec04d
 00441   428   NtUserGetClassInfo  (1999896576, 1241740, 1241692, 1241768, 0, ... ) == 0x0
 00442   428   NtUserFindExistingCursorIcon  (1241124, 1241140, 1241708, ... ) == 0x10011
 00443   428   NtUserRegisterClassExWOW  (1241576, 1241656, 1241640, 1241672, 0, 384, 0, ... ) == 0x810ec04f
 00444   428   NtUserGetClassInfo  (1999896576, 1241744, 1241696, 1241772, 0, ... ) == 0x0
 00445   428   NtUserRegisterClassExWOW  (1241580, 1241660, 1241644, 1241676, 0, 384, 0, ... ) == 0x810ec051
 00446   428   NtUserGetClassInfo  (1999896576, 1241740, 1241692, 1241768, 0, ... ) == 0x0
 00447   428   NtUserFindExistingCursorIcon  (1241124, 1241140, 1241708, ... ) == 0x10011
 00448   428   NtUserRegisterClassExWOW  (1241576, 1241656, 1241640, 1241672, 0, 384, 0, ... ) == 0x810ec053
 00449   428   NtUserGetClassInfo  (1999896576, 1241740, 1241692, 1241768, 0, ... ) == 0x0
 00450   428   NtUserFindExistingCursorIcon  (1241124, 1241140, 1241708, ... ) == 0x10011
 00451   428   NtUserRegisterClassExWOW  (1241576, 1241656, 1241640, 1241672, 0, 384, 0, ... ) == 0x810ec055
 00452   428   NtUserRegisterClassExWOW  (1241576, 1241656, 1241640, 1241672, 0, 384, 0, ... ) == 0x810ec057
 00453   428   NtUserGetClassInfo  (1999896576, 1241740, 1241692, 1241768, 0, ... ) == 0x0
 00454   428   NtUserFindExistingCursorIcon  (1241124, 1241140, 1241708, ... ) == 0x10011
 00455   428   NtUserRegisterClassExWOW  (1241576, 1241656, 1241640, 1241672, 0, 384, 0, ... ) == 0x810ec059
 00456   428   NtUserGetClassInfo  (1999896576, 1241740, 1241692, 1241768, 0, ... ) == 0x0
 00457   428   NtUserFindExistingCursorIcon  (1241124, 1241140, 1241708, ... ) == 0x10013
 00458   428   NtUserRegisterClassExWOW  (1241576, 1241656, 1241640, 1241672, 0, 384, 0, ... ) == 0x810ec05b
 00459   428   NtUserGetClassInfo  (1999896576, 1241740, 1241692, 1241768, 0, ... ) == 0x0
 00460   428   NtUserFindExistingCursorIcon  (1241124, 1241140, 1241708, ... ) == 0x10011
 00461   428   NtUserRegisterClassExWOW  (1241576, 1241656, 1241640, 1241672, 0, 384, 0, ... ) == 0x810ec05d
 00462   428   NtUserGetClassInfo  (1999896576, 1241740, 1241692, 1241768, 0, ... ) == 0x0
 00463   428   NtUserFindExistingCursorIcon  (1241124, 1241140, 1241708, ... ) == 0x10011
 00464   428   NtUserRegisterClassExWOW  (1241576, 1241656, 1241640, 1241672, 0, 384, 0, ... ) == 0x810ec05f
 00465   428   NtUserGetClassInfo  (1999896576, 1243492, 1243444, 1243520, 0, ... ) == 0xc03b
 00466   428   NtUserGetClassInfo  (1999896576, 1243492, 1243444, 1243520, 0, ... ) == 0xc03d
 00467   428   NtUserGetClassInfo  (1999896576, 1243492, 1243444, 1243520, 0, ... ) == 0xc03f
 00468   428   NtUserGetClassInfo  (1999896576, 1243492, 1243444, 1243520, 0, ... ) == 0xc041
 00469   428   NtUserGetClassInfo  (1999896576, 1243492, 1243444, 1243520, 0, ... ) == 0xc043
 00470   428   NtUserGetClassInfo  (1999896576, 1243492, 1243444, 1243520, 0, ... ) == 0xc045
 00471   428   NtUserGetClassInfo  (1999896576, 1243492, 1243444, 1243520, 0, ... ) == 0xc047
 00472   428   NtUserGetClassInfo  (1999896576, 1243492, 1243444, 1243520, 0, ... ) == 0xc049
 00473   428   NtUserGetClassInfo  (1999896576, 1243492, 1243444, 1243520, 0, ... ) == 0xc04b
 00474   428   NtUserGetClassInfo  (1999896576, 1243492, 1243444, 1243520, 0, ... ) == 0xc04d
 00475   428   NtUserGetClassInfo  (1999896576, 1243492, 1243444, 1243520, 0, ... ) == 0xc04f
 00476   428   NtUserGetClassInfo  (1999896576, 1243496, 1243448, 1243524, 0, ... ) == 0xc051
 00477   428   NtUserGetClassInfo  (1999896576, 1243492, 1243444, 1243520, 0, ... ) == 0xc053
 00478   428   NtUserGetClassInfo  (1999896576, 1243492, 1243444, 1243520, 0, ... ) == 0xc055
 00479   428   NtUserGetClassInfo  (1999896576, 1243492, 1243444, 1243520, 0, ... ) == 0xc059
 00480   428   NtUserGetClassInfo  (1999896576, 1243492, 1243444, 1243520, 0, ... ) == 0xc05b
 00481   428   NtUserGetClassInfo  (1999896576, 1243492, 1243444, 1243520, 0, ... ) == 0xc05d
 00482   428   NtUserGetClassInfo  (1999896576, 1243492, 1243444, 1243520, 0, ... ) == 0xc05f
 00483   428   NtTestAlert  (... ) == 0x0
 00484   428   NtContinue  (1244464, 1, ...
 00485   428   NtSetInformationThread  (-2, Win32StartAddress(LpcReceivedMessageId), {StartAddress(LpcReceivedMsgId)=0x40b001,}, 4, ... ) == 0x0
 00486   428   NtAllocateVirtualMemory  (-1, 0, 0, 6144, 4096, 4, ... 8716288, 8192, ) == 0x0
 00487   428   NtAllocateVirtualMemory  (-1, 0, 0, 9998, 4096, 4, ... 8847360, 12288, ) == 0x0
 00488   428   NtFreeVirtualMemory  (-1, (0x870000), 0, 32768, ... (0x870000), 12288, ) == 0x0
 00489   428   NtAllocateVirtualMemory  (-1, 0, 0, 782, 4096, 4, ... 8847360, 4096, ) == 0x0
 00490   428   NtFreeVirtualMemory  (-1, (0x870000), 0, 32768, ... (0x870000), 4096, ) == 0x0
 00491   428   NtAllocateVirtualMemory  (-1, 0, 0, 1294, 4096, 4, ... 8847360, 4096, ) == 0x0
 00492   428   NtFreeVirtualMemory  (-1, (0x870000), 0, 32768, ... (0x870000), 4096, ) == 0x0
 00493   428   NtAllocateVirtualMemory  (-1, 0, 0, 606, 4096, 4, ... 8847360, 4096, ) == 0x0
 00494   428   NtFreeVirtualMemory  (-1, (0x870000), 0, 32768, ... (0x870000), 4096, ) == 0x0
 00495   428   NtFreeVirtualMemory  (-1, (0x850000), 0, 32768, ... (0x850000), 8192, ) == 0x0
 00496   428   NtUserCallOneParam  (0, 40, ... ) == 0x4
 00497   428   NtOpenKey  (0x9, {24, 28, 0x40, 0, 0,  (0x9, {24, 28, 0x40, 0, 0, "SOFTWARE\Microsoft\Windows\CurrentVersion\ShellCompatibility\Applications\packed.exe"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00498   428   NtOpenSection  (0xe, {24, 8, 0x40, 0, 0,  (0xe, {24, 8, 0x40, 0, 0, "ole32.dll"}, ... 52, ) }, ... 52, ) == 0x0
 00499   428   NtMapViewOfSection  (52, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x771b0000), 0x0, 1155072, ) == 0x0
 00500   428   NtClose  (52, ... ) == 0x0
 00501   428   NtQuerySystemInformation  (Basic, 44, ... {Unknown=0,MaximumIncrement=156250,PhysicalPageSize=0x1000,NumberOfPhysicalPages=0xff7c,LowestPhysicalPage=0x1,HighestPhysicalPage=0xffff,AllocationGranularity=0x10000,LowestUserAddress=0x10000,HighestUserAddress=0x7ffeffff,ActiveProcessors=1,NumberProcessors=1,}, 0x0, ) == 0x0
 00502   428   NtQuerySystemInformation  (Processor, 12, ... {system info, class 1, size 12}, 0x0, ) == 0x0
 00503   428   NtOpenKey  (0x20019, {24, 28, 0x40, 0, 0,  (0x20019, {24, 28, 0x40, 0, 0, "SYSTEM\CurrentControlSet\Control\Session Manager"}, ... 52, ) }, ... 52, ) == 0x0
 00504   428   NtQueryValueKey  (52,  (52, "CriticalSectionTimeout", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\215'\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (52, "CriticalSectionTimeout", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\215'\0"}, 16, ) }, 16, ) == 0x0
 00505   428   NtClose  (52, ... ) == 0x0
 00506   428   NtQuerySystemInformation  (Basic, 44, ... {Unknown=0,MaximumIncrement=156250,PhysicalPageSize=0x1000,NumberOfPhysicalPages=0xff7c,LowestPhysicalPage=0x1,HighestPhysicalPage=0xffff,AllocationGranularity=0x10000,LowestUserAddress=0x10000,HighestUserAddress=0x7ffeffff,ActiveProcessors=1,NumberProcessors=1,}, 0x0, ) == 0x0
 00507   428   NtQuerySystemInformation  (Processor, 12, ... {system info, class 1, size 12}, 0x0, ) == 0x0
 00508   428   NtQuerySystemInformation  (Basic, 44, ... {Unknown=0,MaximumIncrement=156250,PhysicalPageSize=0x1000,NumberOfPhysicalPages=0xff7c,LowestPhysicalPage=0x1,HighestPhysicalPage=0xffff,AllocationGranularity=0x10000,LowestUserAddress=0x10000,HighestUserAddress=0x7ffeffff,ActiveProcessors=1,NumberProcessors=1,}, 0x0, ) == 0x0
 00509   428   NtQuerySystemInformation  (Processor, 12, ... {system info, class 1, size 12}, 0x0, ) == 0x0
 00510   428   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Classes\Interface"}, ... 52, ) }, ... 52, ) == 0x0
 00511   428   NtQueryValueKey  (52,  (52, "InterfaceHelperDisableAll", Full, 0, ... ) , Full, 0, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00512   428   NtQueryValueKey  (52,  (52, "InterfaceHelperDisableAllForOle32", Full, 0, ... ) , Full, 0, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00513   428   NtQueryValueKey  (52,  (52, "InterfaceHelperDisableTypeLib", Full, 0, ... ) , Full, 0, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00514   428   NtClose  (52, ... ) == 0x0
 00515   428   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Classes\Interface\{00020400-0000-0000-C000-000000000046}"}, ... 52, ) }, ... 52, ) == 0x0
 00516   428   NtQueryValueKey  (52,  (52, "InterfaceHelperDisableAll", Full, 0, ... ) , Full, 0, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00517   428   NtQueryValueKey  (52,  (52, "InterfaceHelperDisableAllForOle32", Full, 0, ... ) , Full, 0, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00518   428   NtClose  (52, ... ) == 0x0
 00519   428   NtOpenDirectoryObject  (0x2000f, {24, 0, 0x40, 0, 0,  (0x2000f, {24, 0, 0x40, 0, 0, "\BaseNamedObjects"}, ... 52, ) }, ... 52, ) == 0x0
 00520   428   NtOpenEvent  (0x1f0003, {24, 52, 0x0, 0, 0,  (0x1f0003, {24, 52, 0x0, 0, 0, "HookSwitchHookEnabledEvent"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00521   428   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\rpcss.dll"}, 1238320, ... ) }, 1238320, ... ) == 0x0
 00522   428   NtOpenFile  (0x100020, {24, 0, 0x40, 0, 0,  (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\rpcss.dll"}, 5, 96, ... 64, {status=0x0, info=1}, ) }, 5, 96, ... 64, {status=0x0, info=1}, ) == 0x0
 00523   428   NtCreateSection  (0xe, 0x0, 0x0, 16, 134217728, 64, ... 68, ) == 0x0
 00524   428   NtClose  (64, ... ) == 0x0
 00525   428   NtMapViewOfSection  (68, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 16, ... (0x870000), 0x0, 262144, ) == 0x0
 00526   428   NtClose  (68, ... ) == 0x0
 00527   428   NtUnmapViewOfSection  (-1, 0x870000, ... ) == 0x0
 00528   428   NtAllocateVirtualMemory  (-1, 1331200, 0, 4096, 4096, 4, ... 1331200, 4096, ) == 0x0
 00529   428   NtQuerySystemInformation  (Basic, 44, ... {Unknown=0,MaximumIncrement=156250,PhysicalPageSize=0x1000,NumberOfPhysicalPages=0xff7c,LowestPhysicalPage=0x1,HighestPhysicalPage=0xffff,AllocationGranularity=0x10000,LowestUserAddress=0x10000,HighestUserAddress=0x7ffeffff,ActiveProcessors=1,NumberProcessors=1,}, 0x0, ) == 0x0
 00530   428   NtQuerySystemInformation  (Basic, 44, ... {Unknown=0,MaximumIncrement=156250,PhysicalPageSize=0x1000,NumberOfPhysicalPages=0xff7c,LowestPhysicalPage=0x1,HighestPhysicalPage=0xffff,AllocationGranularity=0x10000,LowestUserAddress=0x10000,HighestUserAddress=0x7ffeffff,ActiveProcessors=1,NumberProcessors=1,}, 0x0, ) == 0x0
 00531   428   NtQuerySystemInformation  (Basic, 44, ... {Unknown=0,MaximumIncrement=156250,PhysicalPageSize=0x1000,NumberOfPhysicalPages=0xff7c,LowestPhysicalPage=0x1,HighestPhysicalPage=0xffff,AllocationGranularity=0x10000,LowestUserAddress=0x10000,HighestUserAddress=0x7ffeffff,ActiveProcessors=1,NumberProcessors=1,}, 0x0, ) == 0x0
 00532   428   NtOpenFile  (0x100001, {24, 0, 0x40, 0, 0,  (0x100001, {24, 0, 0x40, 0, 0, "\Device\KsecDD"}, 7, 16, ... 68, {status=0x0, info=0}, ) }, 7, 16, ... 68, {status=0x0, info=0}, ) == 0x0
 00533   428   NtDeviceIoControlFile  (68, 0, 0x0, 0x0, 0x390008,  (68, 0, 0x0, 0x0, 0x390008, "p\206\203x\233\276f\360\225\336*nri\205`\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0", 256, 256, ... , 256, 256, ...
 00534   428   NtQuerySystemInformation  (TimeOfDay, 48, ... {system info, class 3, size 48}, 48, ) == 0x0
 00535   428   NtQuerySystemInformation  (ProcessorTimes, 48, ... {system info, class 8, size 48}, 48, ) == 0x0
 00536   428   NtQuerySystemInformation  (Performance, 312, ... {system info, class 2, size 312}, 312, ) == 0x0
 00537   428   NtQuerySystemInformation  (Exception, 16, ... {system info, class 33, size 16}, 16, ) == 0x0
 00538   428   NtQuerySystemInformation  (Lookaside, 32, ... {system info, class 45, size 32}, 32, ) == 0x0
 00539   428   NtQuerySystemInformation  (ProcessorStatistics, 3016, ... {system info, class 23, size 0}, 0, ) == 0x0
 00540   428   NtQuerySystemInformation  (ProcessesAndThreads, 3008, ... ) == STATUS_INFO_LENGTH_MISMATCH
 00541   428   NtCreateKey  (0x2, {24, 0, 0x240, 0, 0,  (0x2, {24, 0, 0x240, 0, 0, "\Registry\Machine\SOFTWARE\Microsoft\Cryptography\RNG"}, 0, 0x0, 0, ... -2147482204, 2, ) }, 0, 0x0, 0, ... -2147482204, 2, ) == 0x0
 00542   428   NtSetValueKey  (-2147482204,  (-2147482204, "Seed", 0, 3, "\377\322\277\224\21\275\4F9\363(\270\275P\223\3\37J\336\236\177]B\275\2\232\320Y'}G\205\15)\375\306E\30\317K40\302*{!\257\337\214\216\323\177\6H\242\352\210al\355\27b[WU\33\214\254Y\32)h\10\365\376\363\220\211\260q", 80, ... ) , 0, 3,  (-2147482204, "Seed", 0, 3, "\377\322\277\224\21\275\4F9\363(\270\275P\223\3\37J\336\236\177]B\275\2\232\320Y'}G\205\15)\375\306E\30\317K40\302*{!\257\337\214\216\323\177\6H\242\352\210al\355\27b[WU\33\214\254Y\32)h\10\365\376\363\220\211\260q", 80, ... ) , 80, ... ) == 0x0
 00543   428   NtClose  (-2147482204, ... ) == 0x0
 00533   428   NtDeviceIoControlFile  ... {status=0x0, info=256},  ... {status=0x0, info=256}, "\336\12\254\256\35\225\2471,\376{\256Ug\351\250\37\376F\210\307\307\336{F\343\352\343\361\267\27\230\210c\323\302\3476A(\337t|\354\35T\323\12\264\366.\4_`\273V\324\343:&\352#\363H\221N\267\344'r\16\353vV\330F\305\270%L\2141\371X\202}\356\264\266zN\246\310P\3\375\205}PO\343Q\4e\3653\313\204\3553\5\377t\350\1j=j\204\231e>\204[$p\3375\32\273\27020\2\365/5G\214C\1vh\337A)\364\264\312\346\355\222\247V\375\336\20\247\300+\373\316\204\340Ra6\267\17&\305\342\361S\10\260\227\7<\355\16sH\363%\17T\361\246b\246\0\0\1DrH5\224\30\24\346"\303D\242\16\2751\27g\204v\206\302\317]\317R\344\22\270\230\35\256\305oaDi1\7\202\23UL\30\177a\246\326K\275$\257\364\213\363\14\231N\266\235^\7\331", ) \303D\242\16\2751\27g\204v\206\302\317]\317R\344\22\270\230\35\256\305oaDi1\7\202\23UL\30\177a\246\326K\275$\257\364\213\363\14\231N\266\235^\7\331", ) == 0x0
 00544   428   NtAllocateVirtualMemory  (-1, 1335296, 0, 16384, 4096, 4, ... 1335296, 16384, ) == 0x0
 00545   428   NtUserRegisterClassExWOW  (1240404, 1240484, 1240468, 1240500, 0, 384, 0, ... ) == 0x810ec038
 00546   428   NtUserGetAtomName  (49208, 1239168, ... ) == 0x15
 00547   428   NtUserCreateWindowEx  (0, 49208, 49208,  (0, 49208, 49208, "OleMainThreadWndName", -2013265920, -2147483648, -2147483648, -2147483648, -2147483648, -3, 0, 1998258176, 0, 1073742848, 0, ... , -2013265920, -2147483648, -2147483648, -2147483648, -2147483648, -3, 0, 1998258176, 0, 1073742848, 0, ...
 00548   428   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\uxtheme.dll"}, 1236692, ... ) }, 1236692, ... ) == 0x0
 00549   428   NtOpenFile  (0x100020, {24, 0, 0x40, 0, 0,  (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\uxtheme.dll"}, 5, 96, ... 64, {status=0x0, info=1}, ) }, 5, 96, ... 64, {status=0x0, info=1}, ) == 0x0
 00550   428   NtCreateSection  (0xe, 0x0, 0x0, 16, 134217728, 64, ... 72, ) == 0x0
 00551   428   NtClose  (64, ... ) == 0x0
 00552   428   NtMapViewOfSection  (72, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 16, ... (0x870000), 0x0, 204800, ) == 0x0
 00553   428   NtClose  (72, ... ) == 0x0
 00554   428   NtUnmapViewOfSection  (-1, 0x870000, ... ) == 0x0
 00555   428   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\uxtheme.dll"}, 1237008, ... ) }, 1237008, ... ) == 0x0
 00556   428   NtOpenFile  (0x100020, {24, 0, 0x40, 0, 0,  (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\uxtheme.dll"}, 5, 96, ... 72, {status=0x0, info=1}, ) }, 5, 96, ... 72, {status=0x0, info=1}, ) == 0x0
 00557   428   NtCreateSection  (0xf, 0x0, 0x0, 16, 16777216, 72, ... 64, ) == 0x0
 00558   428   NtQuerySection  (64, Image, 48, ... {section info, class 1, size 48}, 0x0, ) == 0x0
 00559   428   NtClose  (72, ... ) == 0x0
 00560   428   NtMapViewOfSection  (64, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x5ad70000), 0x0, 212992, ) == 0x0
 00561   428   NtClose  (64, ... ) == 0x0
 00562   428   NtUserGetWindowDC  (0, ... ) == 0x1010050
 00563   428   NtUserCallOneParam  (16842832, 56, ... ) == 0x1
 00564   428   NtOpenThreadTokenEx  (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN
 00565   428   NtOpenProcessTokenEx  (-1, 0x20008, 512, ... 64, ) == 0x0
 00566   428   NtQueryInformationToken  (64, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0
 00567   428   NtClose  (64, ... ) == 0x0
 00568   428   NtOpenKey  (0x2001f, {24, 0, 0x640, 0, 0,  (0x2001f, {24, 0, 0x640, 0, 0, "\REGISTRY\USER\S-1-5-21-1078081533-484763869-839522115-1003"}, ... 64, ) }, ... 64, ) == 0x0
 00569   428   NtOpenKey  (0x1, {24, 64, 0x40, 0, 0,  (0x1, {24, 64, 0x40, 0, 0, "Software\Microsoft\Windows\CurrentVersion\ThemeManager"}, ... 72, ) }, ... 72, ) == 0x0
 00570   428   NtQueryValueKey  (72,  (72, "Compositing", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00571   428   NtClose  (72, ... ) == 0x0
 00572   428   NtClose  (64, ... ) == 0x0
 00573   428   NtOpenThreadTokenEx  (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN
 00574   428   NtOpenProcessTokenEx  (-1, 0x20008, 512, ... 64, ) == 0x0
 00575   428   NtQueryInformationToken  (64, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0
 00576   428   NtClose  (64, ... ) == 0x0
 00577   428   NtOpenKey  (0x20019, {24, 0, 0x640, 0, 0,  (0x20019, {24, 0, 0x640, 0, 0, "\REGISTRY\USER\S-1-5-21-1078081533-484763869-839522115-1003"}, ... 64, ) }, ... 64, ) == 0x0
 00578   428   NtOpenKey  (0x1, {24, 64, 0x40, 0, 0,  (0x1, {24, 64, 0x40, 0, 0, "Control Panel\Desktop"}, ... 72, ) }, ... 72, ) == 0x0
 00579   428   NtQueryValueKey  (72,  (72, "LameButtonText", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00580   428   NtClose  (72, ... ) == 0x0
 00581   428   NtClose  (64, ... ) == 0x0
 00582   428   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\u:\work\UxTheme.dll"}, 1236508, ... ) }, 1236508, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00583   428   NtQueryAttributesFile  ({24, 12, 0x40, 0, 0,  ({24, 12, 0x40, 0, 0, "UxTheme.dll"}, 1236508, ... ) }, 1236508, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00584   428   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\System32\UxTheme.dll"}, 1236508, ... ) }, 1236508, ... ) == 0x0
 00585   428   NtUserGetProcessWindowStation  (... ) == 0x28
 00586   428   NtUserGetObjectInformation  (40, 2, 0, 0, 1238804, ... ) == 0x0
 00587   428   NtUserGetObjectInformation  (40, 2, 1350240, 16, 1238804, ... ) == 0x1
 00588   428   NtUserGetGUIThreadInfo  (428, 1238760, ... ) == 0x1
 00589   428   NtConnectPort  ( ("\ThemeApiPort", {12, 2, 1, 1}, 0x0, 0x0, 1238580, 64, ... 64, 0x0, 0x0, 0x0, 64, ) , {12, 2, 1, 1}, 0x0, 0x0, 1238580, 64, ... 64, 0x0, 0x0, 0x0, 64, ) == 0x0
 00590   428   NtRequestWaitReplyPort  (64, {32, 56, new_msg, 0, 0, 0, 0, 0}  (64, {32, 56, new_msg, 0, 0, 0, 0, 0} "\4\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0" ... {32, 56, reply, 0, 420, 428, 1447, 0} "\0\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0" )  ... {32, 56, reply, 0, 420, 428, 1447, 0}  (64, {32, 56, new_msg, 0, 0, 0, 0, 0} "\4\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0" ... {32, 56, reply, 0, 420, 428, 1447, 0} "\0\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0" )  ) == 0x0
 00591   428   NtRequestWaitReplyPort  (64, {32, 56, new_msg, 0, 0, 0, 0, 0}  (64, {32, 56, new_msg, 0, 0, 0, 0, 0} "\355\3\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0" ... {32, 56, reply, 0, 420, 428, 1448, 0} "\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0" )  ... {32, 56, reply, 0, 420, 428, 1448, 0}  (64, {32, 56, new_msg, 0, 0, 0, 0, 0} "\355\3\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0" ... {32, 56, reply, 0, 420, 428, 1448, 0} "\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0" )  ) == 0x0
 00592   428   NtUserCallNoParam  (29, ...
 00593   428   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\uxtheme.dll"}, 1236052, ... ) }, 1236052, ... ) == 0x0
 00592   428   NtUserCallNoParam  ... ) == 0x0
 00594   428   NtUserSystemParametersInfo  (41, 0, 1524225160, 0, ... ) == 0x1
 00595   428   NtGdiHfontCreate  (1238132, 356, 0, 0, 1329304, ... ) == 0x10a041c
 00596   428   NtGdiHfontCreate  (1238132, 356, 0, 0, 1329296, ... ) == 0x10a041d
 00597   428   NtRequestWaitReplyPort  (64, {32, 56, new_msg, 0, 0, 0, 0, 0}  (64, {32, 56, new_msg, 0, 0, 0, 0, 0} "\7\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0" ... {32, 56, reply, 0, 420, 428, 1449, 0} "\0\0\0\0\0\0\0\0H\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0" )  ... {32, 56, reply, 0, 420, 428, 1449, 0}  (64, {32, 56, new_msg, 0, 0, 0, 0, 0} "\7\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0" ... {32, 56, reply, 0, 420, 428, 1449, 0} "\0\0\0\0\0\0\0\0H\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0" )  ) == 0x0
 00598   428   NtMapViewOfSection  (72, -1, (0x0), 0, 0, {0, 0}, 0, 1, 0, 2, ... (0x870000), {0, 0}, 331776, ) == 0x0
 00599   428   NtUserGetWindowDC  (0, ... ) == 0x1010050
 00600   428   NtUserCallOneParam  (16842832, 56, ... ) == 0x1
 00601   428   NtUserGetWindowDC  (0, ... ) == 0x1010050
 00602   428   NtUserCallOneParam  (16842832, 56, ... ) == 0x1
 00603   428   NtUserGetWindowDC  (0, ... ) == 0x1010050
 00604   428   NtUserCallOneParam  (16842832, 56, ... ) == 0x1
 00605   428   NtUserGetWindowDC  (0, ... ) == 0x1010050
 00606   428   NtUserCallOneParam  (16842832, 56, ... ) == 0x1
 00607   428   NtUserGetWindowDC  (0, ... ) == 0x1010050
 00608   428   NtUserCallOneParam  (16842832, 56, ... ) == 0x1
 00609   428   NtUserGetWindowDC  (0, ... ) == 0x1010050
 00610   428   NtUserCallOneParam  (16842832, 56, ... ) == 0x1
 00611   428   NtUserGetWindowDC  (0, ... ) == 0x1010050
 00612   428   NtUserCallOneParam  (16842832, 56, ... ) == 0x1
 00613   428   NtUserGetWindowDC  (0, ... ) == 0x1010050
 00614   428   NtUserCallOneParam  (16842832, 56, ... ) == 0x1
 00615   428   NtUserGetWindowDC  (0, ... ) == 0x1010050
 00616   428   NtGdiCreatePatternBrushInternal  (59048369, 0, 0, ... ) == 0x110041f
 00617   428   NtUserCallOneParam  (16842832, 56, ... ) == 0x1
 00618   428   NtUserCallNoParam  (29, ...
 00619   428   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\uxtheme.dll"}, 1235496, ... ) }, 1235496, ... ) == 0x0
 00618   428   NtUserCallNoParam  ... ) == 0x0
 00620   428   NtUserCallNoParam  (29, ...
 00621   428   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\uxtheme.dll"}, 1235492, ... ) }, 1235492, ... ) == 0x0
 00620   428   NtUserCallNoParam  ... ) == 0x0
 00622   428   NtUserMessageCall  (0x100c6, WM_NCCREATE, 0x0, 0x12e82c, 0, 670, 0, ... ) == 0x1
 00623   428   NtUserMessageCall  (0x100c6, WM_NCCALCSIZE, 0x0, 0x12e854, 0, 670, 0, ... ) == 0x0
 00624   428   NtUserSetProp  (65734, 43288, -1, ... ) == 0x1
 00547   428   NtUserCreateWindowEx  ... ) == 0x100c6
 00625   428   NtDeviceIoControlFile  (68, 0, 0x0, 0x0, 0x390008,  (68, 0, 0x0, 0x0, 0x390008, "p\206\203x\233\276f3B\360\30\200\177N\361\262m\344\352\265\277\177\263\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0", 256, 256, ... , 256, 256, ...
 00626   428   NtQuerySystemInformation  (TimeOfDay, 48, ... {system info, class 3, size 48}, 48, ) == 0x0
 00627   428   NtQuerySystemInformation  (ProcessorTimes, 48, ... {system info, class 8, size 48}, 48, ) == 0x0
 00628   428   NtQuerySystemInformation  (Performance, 312, ... {system info, class 2, size 312}, 312, ) == 0x0
 00629   428   NtQuerySystemInformation  (Exception, 16, ... {system info, class 33, size 16}, 16, ) == 0x0
 00630   428   NtQuerySystemInformation  (Lookaside, 32, ... {system info, class 45, size 32}, 32, ) == 0x0
 00631   428   NtQuerySystemInformation  (ProcessorStatistics, 3016, ... {system info, class 23, size 0}, 0, ) == 0x0
 00632   428   NtQuerySystemInformation  (ProcessesAndThreads, 3008, ... ) == STATUS_INFO_LENGTH_MISMATCH
 00633   428   NtCreateKey  (0x2, {24, 0, 0x240, 0, 0,  (0x2, {24, 0, 0x240, 0, 0, "\Registry\Machine\SOFTWARE\Microsoft\Cryptography\RNG"}, 0, 0x0, 0, ... -2147482204, 2, ) }, 0, 0x0, 0, ... -2147482204, 2, ) == 0x0
 00634   428   NtSetValueKey  (-2147482204,  (-2147482204, "Seed", 0, 3, "\15[\304\362|\340K\214O\221:S)nb\242\325\201{Ls\364x]\342^\326\256B\11:\352|S3N\311\346\212N\24n\362\32\271\362\310\270\266\374\336\11n\275*\327\227\350*\13;\313Ob\340\225\353\211P\3332\310@\371E\250\216\365\6\7", 80, ... ) , 0, 3,  (-2147482204, "Seed", 0, 3, "\15[\304\362|\340K\214O\221:S)nb\242\325\201{Ls\364x]\342^\326\256B\11:\352|S3N\311\346\212N\24n\362\32\271\362\310\270\266\374\336\11n\275*\327\227\350*\13;\313Ob\340\225\353\211P\3332\310@\371E\250\216\365\6\7", 80, ... ) , 80, ... ) == 0x0
 00635   428   NtClose  (-2147482204, ... ) == 0x0
 00625   428   NtDeviceIoControlFile  ... {status=0x0, info=256},  ... {status=0x0, info=256}, ">\26\201g\2707\121\367\225_\344\34\204\5P?G\24\336\205RO\230wZt~e_\2008\207\138\301\366\354\216\356%\215\200F\311G\22250\22/\352\247\33s\247\367\7E\26\15\0"\354\346CB\336[ag\233\324\327i_\226\33\27\7)b\367\363\332\301V'\215\202PH\277\223\273'\325\317\7\3257k\376t@\3200{\210\361\256\21\3560\21Q\311X1-\350<\34N[\23?\226\14("\17\330;9"\246.\260x\213\327\356[\245\360\336X\370"Q\336o5\27>\243@-\0*Jn-\214\356\37C\13p\236\247}\271\306\264:\304\231\2659\10\263iA\227\324RpX\224\334\371\365jmP\341\220{\232\256\232\363\3128\276\254\257\345\31\365\217M\1\244\357\362\333\276\22\7;F\274K(j\2224\33;\372\23e\331$\25^\224s4\7QR\242\274\325\2151\26\0\21 a", ) \354\346CB\336[ag\233\324\327i_\226\33\27\7)b\367\363\332\301V'\215\202PH\277\223\273'\325\317\7\3257k\376t@\3200{\210\361\256\21\3560\21Q\311X1-\350<\34N[\23?\226\14( ... {status=0x0, info=256}, ">\26\201g\2707\121\367\225_\344\34\204\5P?G\24\336\205RO\230wZt~e_\2008\207\138\301\366\354\216\356%\215\200F\311G\22250\22/\352\247\33s\247\367\7E\26\15\0"\354\346CB\336[ag\233\324\327i_\226\33\27\7)b\367\363\332\301V'\215\202PH\277\223\273'\325\317\7\3257k\376t@\3200{\210\361\256\21\3560\21Q\311X1-\350<\34N[\23?\226\14("\17\330;9"\246.\260x\213\327\356[\245\360\336X\370"Q\336o5\27>\243@-\0*Jn-\214\356\37C\13p\236\247}\271\306\264:\304\231\2659\10\263iA\227\324RpX\224\334\371\365jmP\341\220{\232\256\232\363\3128\276\254\257\345\31\365\217M\1\244\357\362\333\276\22\7;F\274K(j\2224\33;\372\23e\331$\25^\224s4\7QR\242\274\325\2151\26\0\21 a", ) \246.\260x\213\327\356[\245\360\336X\370 ... {status=0x0, info=256}, ">\26\201g\2707\121\367\225_\344\34\204\5P?G\24\336\205RO\230wZt~e_\2008\207\138\301\366\354\216\356%\215\200F\311G\22250\22/\352\247\33s\247\367\7E\26\15\0"\354\346CB\336[ag\233\324\327i_\226\33\27\7)b\367\363\332\301V'\215\202PH\277\223\273'\325\317\7\3257k\376t@\3200{\210\361\256\21\3560\21Q\311X1-\350<\34N[\23?\226\14("\17\330;9"\246.\260x\213\327\356[\245\360\336X\370"Q\336o5\27>\243@-\0*Jn-\214\356\37C\13p\236\247}\271\306\264:\304\231\2659\10\263iA\227\324RpX\224\334\371\365jmP\341\220{\232\256\232\363\3128\276\254\257\345\31\365\217M\1\244\357\362\333\276\22\7;F\274K(j\2224\33;\372\23e\331$\25^\224s4\7QR\242\274\325\2151\26\0\21 a", ) , ) == 0x0
 00636   428   NtDeviceIoControlFile  (68, 0, 0x0, 0x0, 0x390008,  (68, 0, 0x0, 0x0, 0x390008, "p\206\203x\233\276f3B\360\30\200\177N2eC\326\4\270\230\13am\344\352\265\277\177\263\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0", 256, 256, ... , 256, 256, ...
 00637   428   NtQuerySystemInformation  (TimeOfDay, 48, ... {system info, class 3, size 48}, 48, ) == 0x0
 00638   428   NtQuerySystemInformation  (ProcessorTimes, 48, ... {system info, class 8, size 48}, 48, ) == 0x0
 00639   428   NtQuerySystemInformation  (Performance, 312, ... {system info, class 2, size 312}, 312, ) == 0x0
 00640   428   NtQuerySystemInformation  (Exception, 16, ... {system info, class 33, size 16}, 16, ) == 0x0
 00641   428   NtQuerySystemInformation  (Lookaside, 32, ... {system info, class 45, size 32}, 32, ) == 0x0
 00642   428   NtQuerySystemInformation  (ProcessorStatistics, 3016, ... {system info, class 23, size 0}, 0, ) == 0x0
 00643   428   NtQuerySystemInformation  (ProcessesAndThreads, 3008, ... ) == STATUS_INFO_LENGTH_MISMATCH
 00644   428   NtCreateKey  (0x2, {24, 0, 0x240, 0, 0,  (0x2, {24, 0, 0x240, 0, 0, "\Registry\Machine\SOFTWARE\Microsoft\Cryptography\RNG"}, 0, 0x0, 0, ... -2147482204, 2, ) }, 0, 0x0, 0, ... -2147482204, 2, ) == 0x0
 00645   428   NtSetValueKey  (-2147482204,  (-2147482204, "Seed", 0, 3, "\235\270\334DL\355q\10z\1Nk8\232\345'/L\324\216$:i\271\\3350d\341v3\331\274\352\333\231ud\302!\245\246\250a\334\6\204q\\200\327q\343Ax\265\2\245(!\325\30\361_\375\317\15\312\206k\377\216s\307\205\7\352\355\237\346", 80, ... ) , 0, 3,  (-2147482204, "Seed", 0, 3, "\235\270\334DL\355q\10z\1Nk8\232\345'/L\324\216$:i\271\\3350d\341v3\331\274\352\333\231ud\302!\245\246\250a\334\6\204q\\200\327q\343Ax\265\2\245(!\325\30\361_\375\317\15\312\206k\377\216s\307\205\7\352\355\237\346", 80, ... ) , 80, ... ) == 0x0
 00646   428   NtClose  (-2147482204, ... ) == 0x0
 00636   428   NtDeviceIoControlFile  ... {status=0x0, info=256},  ... {status=0x0, info=256}, "\7\230m\355\10L\341\230\333\231\0Zq\22*\0P\12\276-\267\226\234\233\234G\242\236\251"\14\320\202AC\313\3V\274\254\370i\206\254\271\313.\215\11\364\262\241\215\222\343\307u'\25\3r\370\36.\36\227|\233\277\5\341^=\267\33\313\353\365\375\301b\337\7I\215\1\230&|#h{[\227\26\312(h\325\23\34@\26-{\306\334`\20x\351!\352%\317\301\312\222tw\374vxxP\245\226\331\252\304\201\200'\1\362\330\326T\241\362^(\16\16\213@u9\301\343\225pb\16t^\30\254\21j\255\263\270\231\177\300\37^1\31\202\20\373a\201x8\216\24\246S\340\332w\35@v~\212\366uz*a\353\360\202\372\335+B}x\210\334\210\210Xw\352\246\36\260&\246\363\211\235\225\32\306\317M\246\365\214p\311\16\305\225\13", ) \14\320\202AC\313\3V\274\254\370i\206\254\271\313.\215\11\364\262\241\215\222\343\307u'\25\3r\370\36.\36\227|\233\277\5\341^=\267\33\313\353\365\375\301b\337\7I343\310\347\32,\20\272\251_\214\216\376R\355\213Q4\6\223\270>\215\1\230&|#h{[\227\26\312(h\325\23\34@\26-{\306\334`\20x\351!\352%\317\301\312\222tw\374vxxP\245\226\331\252\304\201\200'\1\362\330\326T\241\362^(\16\16\213@u9\301\343\225pb\16t^\30\254\21j\255\263\270\231\177\300\37^1\31\202\20\373a\201x8\216\24\246S\340\332w\35@v~\212\366uz*a\353\360\202\372\335+B}x\210\334\210\210Xw\352\246\36\260&\246\363\211\235\225\32\306\317M\246\365\214p\311\16\305\225\13", ) == 0x0
 00647   428   NtDeviceIoControlFile  (68, 0, 0x0, 0x0, 0x390008,  (68, 0, 0x0, 0x0, 0x390008, "p\206\203x\233\276f3B\360\30\200\177N2eC\326\4\270\230\310\266C\326\4\270\230\13am\344\352\265\277\177\263\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0", 256, 256, ... , 256, 256, ...
 00648   428   NtQuerySystemInformation  (TimeOfDay, 48, ... {system info, class 3, size 48}, 48, ) == 0x0
 00649   428   NtQuerySystemInformation  (ProcessorTimes, 48, ... {system info, class 8, size 48}, 48, ) == 0x0
 00650   428   NtQuerySystemInformation  (Performance, 312, ... {system info, class 2, size 312}, 312, ) == 0x0
 00651   428   NtQuerySystemInformation  (Exception, 16, ... {system info, class 33, size 16}, 16, ) == 0x0
 00652   428   NtQuerySystemInformation  (Lookaside, 32, ... {system info, class 45, size 32}, 32, ) == 0x0
 00653   428   NtQuerySystemInformation  (ProcessorStatistics, 3016, ... {system info, class 23, size 0}, 0, ) == 0x0
 00654   428   NtQuerySystemInformation  (ProcessesAndThreads, 3008, ... ) == STATUS_INFO_LENGTH_MISMATCH
 00655   428   NtCreateKey  (0x2, {24, 0, 0x240, 0, 0,  (0x2, {24, 0, 0x240, 0, 0, "\Registry\Machine\SOFTWARE\Microsoft\Cryptography\RNG"}, 0, 0x0, 0, ... -2147482204, 2, ) }, 0, 0x0, 0, ... -2147482204, 2, ) == 0x0
 00656   428   NtSetValueKey  (-2147482204,  (-2147482204, "Seed", 0, 3, "\345~Or\274\13\313\230cy\346K\262DL\321~\324\326\5`\25Ghn\2728\330T\237\27f\371\361\3\276\247\206\2103SI\261\305#\324x\263\207\36*\365\27\375\25\225,-\220\321\14y\336yY?\362\235{\223\214@ \26\347^Wt\243\355", 80, ... ) , 0, 3,  (-2147482204, "Seed", 0, 3, "\345~Or\274\13\313\230cy\346K\262DL\321~\324\326\5`\25Ghn\2728\330T\237\27f\371\361\3\276\247\206\2103SI\261\305#\324x\263\207\36*\365\27\375\25\225,-\220\321\14y\336yY?\362\235{\223\214@ \26\347^Wt\243\355", 80, ... ) , 80, ... ) == 0x0
 00657   428   NtClose  (-2147482204, ... ) == 0x0
 00647   428   NtDeviceIoControlFile  ... {status=0x0, info=256},  ... {status=0x0, info=256}, "\336\375-2\271\357\14)V!\355\194RJ\346\351\222\15\264\3647q\242p\3I=)K\317D\214\1\22E\213/r%DV\37\233P~O\355\207\300\240\273\261C\265(\325\336\214M\377\262V\2415\325\305\271\207\354\266\35x\177IO|\226\0\324\364Y\371\322X\337n\36\370F=\20Br\374%\0\372\356\1 ;\261\367r\304\350>00\354\177\31\313\3365HO\350(L\2222\257\240T\232\343x\327\340i\366\203\307\31S\356\247\234^8\370?\207\334X\244\360\270;\340\16\20.\227\370\22U\23|zkx\256)\340\\4[\227\332\343,\32G\17\235\6\250\36\316\5\3775\340\220\300\20'\350r\276\210VM\364\13\357;\237\365\363n\261\335.\235;\300\356hJ\200\361[\214\202\225\20^\223\237\336:\2423\303\222W!,\321\31V\206\5%u\269\207"\2\304\j\34\2\17^V\230\13\253", ) \2\304\j\34\2\17^V\230\13\253", ) == 0x0
 00658   428   NtDeviceIoControlFile  (68, 0, 0x0, 0x0, 0x390008,  (68, 0, 0x0, 0x0, 0x390008, "p\206\203x\233\276f3B\360\30\200\177N2eC\326\4\270\230\310\266C\326\4\270\230\310\266C\326\4\270\230\13am\344\352\265\277\177\263\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0", 256, 256, ... , 256, 256, ...
 00659   428   NtQuerySystemInformation  (TimeOfDay, 48, ... {system info, class 3, size 48}, 48, ) == 0x0
 00660   428   NtQuerySystemInformation  (ProcessorTimes, 48, ... {system info, class 8, size 48}, 48, ) == 0x0
 00661   428   NtQuerySystemInformation  (Performance, 312, ... {system info, class 2, size 312}, 312, ) == 0x0
 00662   428   NtQuerySystemInformation  (Exception, 16, ... {system info, class 33, size 16}, 16, ) == 0x0
 00663   428   NtQuerySystemInformation  (Lookaside, 32, ... {system info, class 45, size 32}, 32, ) == 0x0
 00664   428   NtQuerySystemInformation  (ProcessorStatistics, 3016, ... {system info, class 23, size 0}, 0, ) == 0x0
 00665   428   NtQuerySystemInformation  (ProcessesAndThreads, 3008, ... ) == STATUS_INFO_LENGTH_MISMATCH
 00666   428   NtCreateKey  (0x2, {24, 0, 0x240, 0, 0,  (0x2, {24, 0, 0x240, 0, 0, "\Registry\Machine\SOFTWARE\Microsoft\Cryptography\RNG"}, 0, 0x0, 0, ... -2147482204, 2, ) }, 0, 0x0, 0, ... -2147482204, 2, ) == 0x0
 00667   428   NtSetValueKey  (-2147482204,  (-2147482204, "Seed", 0, 3, "\222t\302\255\7\234l!\277u\237\14\10\317\204\322d\323\262\274i\212e\211P\17\321J\37\376\363\300hm\304+\202A\237\206@}\323c\364.\217\24\240]\312\332\36]\330\301\244\210\210\0q\20\254I\374\34\36\305Fi\375\305\34\357\242O\355\305\3\245", 80, ... ) , 0, 3,  (-2147482204, "Seed", 0, 3, "\222t\302\255\7\234l!\277u\237\14\10\317\204\322d\323\262\274i\212e\211P\17\321J\37\376\363\300hm\304+\202A\237\206@}\323c\364.\217\24\240]\312\332\36]\330\301\244\210\210\0q\20\254I\374\34\36\305Fi\375\305\34\357\242O\355\305\3\245", 80, ... ) , 80, ... ) == 0x0
 00668   428   NtClose  (-2147482204, ... ) == 0x0
 00658   428   NtDeviceIoControlFile  ... {status=0x0, info=256},  ... {status=0x0, info=256}, "\241>\23\26$\260\220\4,\226{xT\6\26+Ed\306\25\33\234\250\257\235\236\267GM\372\2\15\350b\247\265\257-\275\336\226\226\227\15b\255\4\205]:\325\227\7\241\365\3Z\246\10m\17\236}\3<\256'U\3040\21PG\324\233\177\363\25f\324\10\353\336\242\11&\200\277\236\344\210QV\276\267$U\25\242F\337y\4\3653\210\204\364\305\6\35\250\3618\366<\314\257\21\16 \265KO\241\215\342F\343\334\352\267g\27\317\21)\346\36\336~\361w\341T\363\221\307\210\350\237N}i\304\301\37\212X.p\273\330\12\355\272\327(\0\247<@\332\372\37\345X\356\360\34Dz\334\16\355\351\224:<\345\237-\227\255\24\357R\0\26\232\300#\306G\276\12\221\350\36\0\317[\31\306\22\353\267\32\230\33\336Si&@\17Q\212\306\353;\23018\307n\255\23b\27\22u\335\201\205;8n}\343\215o\361\203", ) , ) == 0x0
 00669   428   NtDeviceIoControlFile  (68, 0, 0x0, 0x0, 0x390008,  (68, 0, 0x0, 0x0, 0x390008, "p\206\203x\233\276f3B\360\30\200\177N2eC\326\4\270\230\310\266C\326\4\270\230\310\266C\326\4\270\230\310\266C\326\4\270\230\13am\344\352\265\277\177\263\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0", 256, 256, ... , 256, 256, ...
 00670   428   NtQuerySystemInformation  (TimeOfDay, 48, ... {system info, class 3, size 48}, 48, ) == 0x0
 00671   428   NtQuerySystemInformation  (ProcessorTimes, 48, ... {system info, class 8, size 48}, 48, ) == 0x0
 00672   428   NtQuerySystemInformation  (Performance, 312, ... {system info, class 2, size 312}, 312, ) == 0x0
 00673   428   NtQuerySystemInformation  (Exception, 16, ... {system info, class 33, size 16}, 16, ) == 0x0
 00674   428   NtQuerySystemInformation  (Lookaside, 32, ... {system info, class 45, size 32}, 32, ) == 0x0
 00675   428   NtQuerySystemInformation  (ProcessorStatistics, 3016, ... {system info, class 23, size 0}, 0, ) == 0x0
 00676   428   NtQuerySystemInformation  (ProcessesAndThreads, 3008, ... ) == STATUS_INFO_LENGTH_MISMATCH
 00677   428   NtCreateKey  (0x2, {24, 0, 0x240, 0, 0,  (0x2, {24, 0, 0x240, 0, 0, "\Registry\Machine\SOFTWARE\Microsoft\Cryptography\RNG"}, 0, 0x0, 0, ... -2147482204, 2, ) }, 0, 0x0, 0, ... -2147482204, 2, ) == 0x0
 00678   428   NtSetValueKey  (-2147482204,  (-2147482204, "Seed", 0, 3, "\17\234=\31j\275\32\343\316(\3438\373\346\300/F\221<\236\211\32\322\16\377\213\314\251\314\252m\227\337\314\371D\36\30xx\31\305\320%\376\345\271\12\{\340\364\211$\220\270\362p\367\265\305C1\366h\205\16{\371\344\306M\34a\12\235\242Q\265b", 80, ... ) , 0, 3,  (-2147482204, "Seed", 0, 3, "\17\234=\31j\275\32\343\316(\3438\373\346\300/F\221<\236\211\32\322\16\377\213\314\251\314\252m\227\337\314\371D\36\30xx\31\305\320%\376\345\271\12\{\340\364\211$\220\270\362p\367\265\305C1\366h\205\16{\371\344\306M\34a\12\235\242Q\265b", 80, ... ) , 80, ... ) == 0x0
 00679   428   NtClose  (-2147482204, ... ) == 0x0
 00669   428   NtDeviceIoControlFile  ... {status=0x0, info=256},  ... {status=0x0, info=256}, "3\370p\2223\221'\265\242H\344\343s\239\300\3352\250\223\321\271sm\12}Y\223\314Cn\263*\210\36\250\322\253u\261"\235\25408Q\36\342"\302\231\214`\34\1\321A\267\340"\262\3\357\334\264\357;Z\240\30dh\211;\217\350\14}F\213a\202bB\345{\36\2118\354\367\253\320\232z$\337f\4e\24\304G\246\267v\205\365OO\300W\202U\312k\346s\256\7gu#<\221%,\347;k\230\202\347g0\354\362Z\341B\205\307\201\344n8\225\270\277\223a\226\27\24\346<\207\247\222\245b\310\363\10\276\314]~\247\254\374\0\365Nl\234rR\374\322\301\200/\0\206(\301\7[-=S\225\217\355\264\22[w\325\263\32+\300k\213'\221\311\34\366\1\203\6\324\231(\275\317\0\252\]\323D]\34Z\240X\311RJ4\11\232|\345\365\\306\3213\334\277Q{\247%\236W\266\33Dq", ) \235\25408Q\36\342 ... {status=0x0, info=256}, "3\370p\2223\221'\265\242H\344\343s\239\300\3352\250\223\321\271sm\12}Y\223\314Cn\263*\210\36\250\322\253u\261"\235\25408Q\36\342"\302\231\214`\34\1\321A\267\340"\262\3\357\334\264\357;Z\240\30dh\211;\217\350\14}F\213a\202bB\345{\36\2118\354\367\253\320\232z$\337f\4e\24\304G\246\267v\205\365OO\300W\202U\312k\346s\256\7gu#<\221%,\347;k\230\202\347g0\354\362Z\341B\205\307\201\344n8\225\270\277\223a\226\27\24\346<\207\247\222\245b\310\363\10\276\314]~\247\254\374\0\365Nl\234rR\374\322\301\200/\0\206(\301\7[-=S\225\217\355\264\22[w\325\263\32+\300k\213'\221\311\34\366\1\203\6\324\231(\275\317\0\252\]\323D]\34Z\240X\311RJ4\11\232|\345\365\\306\3213\334\277Q{\247%\236W\266\33Dq", ) \262\3\357\334\264\357;Z\240\30dh\211;\217\350\14}F\213a\202bB\345{\36\2118\354\367\253\320\232z$\337f\4e\24\304G\246\267v\205\365OO\300W\202U\312k\346s\256\7gu#<\221%,\347;k\230\202\347g0\354\362Z\341B\205\307\201\344n8\225\270\277\223a\226\27\24\346<\207\247\222\245b\310\363\10\276\314]~\247\254\374\0\365Nl\234rR\374\322\301\200/\0\206(\301\7[-=S\225\217\355\264\22[w\325\263\32+\300k\213'\221\311\34\366\1\203\6\324\231(\275\317\0\252\]\323D]\34Z\240X\311RJ4\11\232|\345\365\\306\3213\334\277Q{\247%\236W\266\33Dq", ) == 0x0
 00680   428   NtDeviceIoControlFile  (68, 0, 0x0, 0x0, 0x390008,  (68, 0, 0x0, 0x0, 0x390008, "p\206\203x\233\276f3B\360\30\200\177N2eC\326\4\270\230\310\266C\326\4\270\230\310\266C\326\4\270\230\310\266C\326\4\270\230\310\266C\326\4\270\230\13am\344\352\265\277\177\263\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0", 256, 256, ... , 256, 256, ...
 00681   428   NtQuerySystemInformation  (TimeOfDay, 48, ... {system info, class 3, size 48}, 48, ) == 0x0
 00682   428   NtQuerySystemInformation  (ProcessorTimes, 48, ... {system info, class 8, size 48}, 48, ) == 0x0
 00683   428   NtQuerySystemInformation  (Performance, 312, ... {system info, class 2, size 312}, 312, ) == 0x0
 00684   428   NtQuerySystemInformation  (Exception, 16, ... {system info, class 33, size 16}, 16, ) == 0x0
 00685   428   NtQuerySystemInformation  (Lookaside, 32, ... {system info, class 45, size 32}, 32, ) == 0x0
 00686   428   NtQuerySystemInformation  (ProcessorStatistics, 3016, ... {system info, class 23, size 0}, 0, ) == 0x0
 00687   428   NtQuerySystemInformation  (ProcessesAndThreads, 3008, ... ) == STATUS_INFO_LENGTH_MISMATCH
 00688   428   NtCreateKey  (0x2, {24, 0, 0x240, 0, 0,  (0x2, {24, 0, 0x240, 0, 0, "\Registry\Machine\SOFTWARE\Microsoft\Cryptography\RNG"}, 0, 0x0, 0, ... -2147482204, 2, ) }, 0, 0x0, 0, ... -2147482204, 2, ) == 0x0
 00689   428   NtSetValueKey  (-2147482204,  (-2147482204, "Seed", 0, 3, "\10]%}Y\314\335bn\270\234I\340E\252\327{A\37\203\24\367A\210\346\11\324\326\211\2\337B\271<;c\321\376\15 \31\324\236\304\315\366P\265\332|\265Sxit\365\233\0\334\273\302\373\272\373\306\204(''\316\364\217\37\241e\1\251}\11", 80, ... ) , 0, 3,  (-2147482204, "Seed", 0, 3, "\10]%}Y\314\335bn\270\234I\340E\252\327{A\37\203\24\367A\210\346\11\324\326\211\2\337B\271<;c\321\376\15 \31\324\236\304\315\366P\265\332|\265Sxit\365\233\0\334\273\302\373\272\373\306\204(''\316\364\217\37\241e\1\251}\11", 80, ... ) , 80, ... ) == 0x0
 00690   428   NtClose  (-2147482204, ... ) == 0x0
 00680   428   NtDeviceIoControlFile  ... {status=0x0, info=256},  ... {status=0x0, info=256}, "\337}\234[\30\25\347\271V\331>\0\305\372\33\371\252g\354\36-\34\2678L\310\265\234\234p\17\3223H\267Uu\33}\12\25}\336\221\200\235\315%p,\336\257\260\213\25\345\234\333p\34A\^\320\375\214\26\310U5S\225\3525F\0\26\235\222\232)\203\236Z\204\273iN=\244\313?_G\275\241\205\6T\244\364\304\3\343\13F\370\24\271\337i\366%\276r\314LM\206\273\254=\16p\12\222{\232\331\3333\25\256\34\364\366P\242QyF\321\362C#M\302\1\232\16\204\271\1a\260\205\222\204\363\360z\30`\274\3156\34\213\203\347R1\317\374\10J\251\274\215PN\212\352\342+\272\253\330\357XE\371\354\230b\375\356\13\205x\26d\222\304Z;\325\335\254#w%-\6\276K~@0\240\213H\36g\303\367\363\332\11$w\26\343\351\335\214!i\252T\224\325v\271,\236\255\330'\344\227T\202", ) , ) == 0x0
 00691   428   NtDeviceIoControlFile  (68, 0, 0x0, 0x0, 0x390008,  (68, 0, 0x0, 0x0, 0x390008, "p\206\203x\233\276f3B\360\30\200\177N2eC\326\4\270\230\310\266C\326\4\270\230\310\266C\326\4\270\230\310\266C\326\4\270\230\310\266C\326\4\270\230\310\266C\326\4\270\230\13am\344\352\265\277\177\263\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0", 256, 256, ... , 256, 256, ...
 00692   428   NtQuerySystemInformation  (TimeOfDay, 48, ... {system info, class 3, size 48}, 48, ) == 0x0
 00693   428   NtQuerySystemInformation  (ProcessorTimes, 48, ... {system info, class 8, size 48}, 48, ) == 0x0
 00694   428   NtQuerySystemInformation  (Performance, 312, ... {system info, class 2, size 312}, 312, ) == 0x0
 00695   428   NtQuerySystemInformation  (Exception, 16, ... {system info, class 33, size 16}, 16, ) == 0x0
 00696   428   NtQuerySystemInformation  (Lookaside, 32, ... {system info, class 45, size 32}, 32, ) == 0x0
 00697   428   NtQuerySystemInformation  (ProcessorStatistics, 3016, ... {system info, class 23, size 0}, 0, ) == 0x0
 00698   428   NtQuerySystemInformation  (ProcessesAndThreads, 3008, ... ) == STATUS_INFO_LENGTH_MISMATCH
 00699   428   NtCreateKey  (0x2, {24, 0, 0x240, 0, 0,  (0x2, {24, 0, 0x240, 0, 0, "\Registry\Machine\SOFTWARE\Microsoft\Cryptography\RNG"}, 0, 0x0, 0, ... -2147482204, 2, ) }, 0, 0x0, 0, ... -2147482204, 2, ) == 0x0
 00700   428   NtSetValueKey  (-2147482204,  (-2147482204, "Seed", 0, 3, "$\17n}\2259k\324\\206\14\332\251\340sZ\271B\242\23\221\331F\267Fb2,v$U\22\2129\10\1+fu6e@\323\26f=\261\251U5..xOj\260\276\371\4\246,\24bF\232*\362\351\16\267\2476\266\366}\341\223\340Hg", 80, ... ) , 0, 3,  (-2147482204, "Seed", 0, 3, "$\17n}\2259k\324\\206\14\332\251\340sZ\271B\242\23\221\331F\267Fb2,v$U\22\2129\10\1+fu6e@\323\26f=\261\251U5..xOj\260\276\371\4\246,\24bF\232*\362\351\16\267\2476\266\366}\341\223\340Hg", 80, ... ) , 80, ... ) == 0x0
 00701   428   NtClose  (-2147482204, ... ) == 0x0
 00691   428   NtDeviceIoControlFile  ... {status=0x0, info=256},  ... {status=0x0, info=256}, "\360\\17v\311B\234\4[\277\20!\30\335I\333Ua^\217\346\2\217v\357(\217\365!\353\326\227\317\336\364\375K(\26\364\320d\317\202\266\314Y\217n\356\233\355|\213\301\307?7\363\323{\231k_\4&S\246\35H\277\351\6\3130\252\356\35\246/\232B\366\302\346\244\12\267>\215\17\244oQ;\3273=x\354\330a\202\3225\311\245N\304\311\227P\24\31\311``uA\261\306t\226I\264\325\241t\26\307\26\216\250V\36\231\236\355P\240"\210G\213\332\377\341\221\22>SQ`\<\317\353\317NI\360\305\363\327\213\255'\251\211\366\31\12\7\24\274\267\351d\350e\227\241\357S\270\252\226\246\275\215\32<\374\312\352&j\6 E\202\0\273\357\312\257\321\337\213\217\12l\312z\3|\233\221\250\307"v\207\363\274\273\363J\2578\351%6\26\361\245@\347<\201\201\225\364\0\270\220\276]C.s7\211\217a", ) \210G\213\332\377\341\221\22>SQ`\<\317\353\317NI\360\305\363\327\213\255'\251\211\366\31\12\7\24\274\267\351d\350e\227\241\357S\270\252\226\246\275\215\32<\374\312\352&j\6 E\202\0\273\357\312\257\321\337\213\217\12l\312z\3|\233\221\250\307 ... {status=0x0, info=256}, "\360\\17v\311B\234\4[\277\20!\30\335I\333Ua^\217\346\2\217v\357(\217\365!\353\326\227\317\336\364\375K(\26\364\320d\317\202\266\314Y\217n\356\233\355|\213\301\307?7\363\323{\231k_\4&S\246\35H\277\351\6\3130\252\356\35\246/\232B\366\302\346\244\12\267>\215\17\244oQ;\3273=x\354\330a\202\3225\311\245N\304\311\227P\24\31\311``uA\261\306t\226I\264\325\241t\26\307\26\216\250V\36\231\236\355P\240"\210G\213\332\377\341\221\22>SQ`\<\317\353\317NI\360\305\363\327\213\255'\251\211\366\31\12\7\24\274\267\351d\350e\227\241\357S\270\252\226\246\275\215\32<\374\312\352&j\6 E\202\0\273\357\312\257\321\337\213\217\12l\312z\3|\233\221\250\307"v\207\363\274\273\363J\2578\351%6\26\361\245@\347<\201\201\225\364\0\270\220\276]C.s7\211\217a", ) , ) == 0x0
 00702   428   NtOpenKey  (0x1, {24, 60, 0x40, 0, 0,  (0x1, {24, 60, 0x40, 0, 0, "Software\Microsoft\Windows\CurrentVersion\Explorer"}, ... 76, ) }, ... 76, ) == 0x0
 00703   428   NtQueryValueKey  (76,  (76, "MaximizeApps", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00704   428   NtOpenKey  (0x1, {24, 28, 0x40, 0, 0,  (0x1, {24, 28, 0x40, 0, 0, "Software\Microsoft\Windows\CurrentVersion\Explorer"}, ... 80, ) }, ... 80, ) == 0x0
 00705   428   NtQueryValueKey  (80,  (80, "MaximizeApps", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00706   428   NtClose  (80, ... ) == 0x0
 00707   428   NtClose  (76, ... ) == 0x0
 00708   428   NtAllocateVirtualMemory  (-1, 1351680, 0, 24576, 4096, 4, ... 1351680, 24576, ) == 0x0
 00709   428   NtOpenSection  (0xe, {24, 8, 0x40, 0, 0,  (0xe, {24, 8, 0x40, 0, 0, "netapi32.dll"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00710   428   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\u:\work\netapi32.dll"}, 1238564, ... ) }, 1238564, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00711   428   NtQueryAttributesFile  ({24, 12, 0x40, 0, 0,  ({24, 12, 0x40, 0, 0, "netapi32.dll"}, 1238564, ... ) }, 1238564, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00712   428   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\System32\netapi32.dll"}, 1238564, ... ) }, 1238564, ... ) == 0x0
 00713   428   NtOpenFile  (0x100020, {24, 0, 0x40, 0, 0,  (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\System32\netapi32.dll"}, 5, 96, ... 76, {status=0x0, info=1}, ) }, 5, 96, ... 76, {status=0x0, info=1}, ) == 0x0
 00714   428   NtCreateSection  (0xf, 0x0, 0x0, 16, 16777216, 76, ... 80, ) == 0x0
 00715   428   NtQuerySection  (80, Image, 48, ... {section info, class 1, size 48}, 0x0, ) == 0x0
 00716   428   NtClose  (76, ... ) == 0x0
 00717   428   NtMapViewOfSection  (80, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x71c20000), 0x0, 323584, ) == 0x0
 00718   428   NtClose  (80, ... ) == 0x0
 00719   428   NtQuerySystemInformation  (Basic, 44, ... {Unknown=0,MaximumIncrement=156250,PhysicalPageSize=0x1000,NumberOfPhysicalPages=0xff7c,LowestPhysicalPage=0x1,HighestPhysicalPage=0xffff,AllocationGranularity=0x10000,LowestUserAddress=0x10000,HighestUserAddress=0x7ffeffff,ActiveProcessors=1,NumberProcessors=1,}, 0x0, ) == 0x0
 00720   428   NtOpenKey  (0x20019, {24, 28, 0x40, 0, 0,  (0x20019, {24, 28, 0x40, 0, 0, "Software\Microsoft\Rpc\PagedBuffers"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00721   428   NtOpenKey  (0x20019, {24, 28, 0x40, 0, 0,  (0x20019, {24, 28, 0x40, 0, 0, "Software\Microsoft\Rpc"}, ... 80, ) }, ... 80, ) == 0x0
 00722   428   NtQueryValueKey  (80,  (80, "MaxRpcSize", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00723   428   NtClose  (80, ... ) == 0x0
 00724   428   NtOpenKey  (0x20019, {24, 28, 0x40, 0, 0,  (0x20019, {24, 28, 0x40, 0, 0, "Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\packed.exe\RpcThreadPoolThrottle"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00725   428   NtCreateEvent  (0x1f0003, 0x0, 1, 0, ... 80, ) == 0x0
 00726   428   NtCreateEvent  (0x1f0003, 0x0, 1, 0, ... 76, ) == 0x0
 00727   428   NtAllocateVirtualMemory  (-1, 1376256, 0, 4096, 4096, 4, ... 1376256, 4096, ) == 0x0
 00728   428   NtQuerySystemTime  (... {1521868650, 29869975}, ) == 0x0
 00729   428   NtCreateEvent  (0x1f0003, 0x0, 0, 0, ... 84, ) == 0x0
 00730   428   NtOpenKey  (0x20019, {24, 28, 0x40, 0, 0,  (0x20019, {24, 28, 0x40, 0, 0, "Software\Policies\Microsoft\Windows NT\Rpc"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00731   428   NtQuerySystemInformation  (Performance, 312, ... {system info, class 2, size 312}, 0x0, ) == 0x0
 00732   428   NtQueryInformationProcess  (-1, QuotaLimits, 32, ... {process info, class 1, size 32}, 0x0, ) == 0x0
 00733   428   NtQueryInformationProcess  (-1, VmCounters, 44, ... {process info, class 3, size 44}, 0x0, ) == 0x0
 00734   428   NtCreateEvent  (0x1f0003, 0x0, 0, 0, ... 88, ) == 0x0
 00735   428   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ... 92, ) == 0x0
 00736   428   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\System\CurrentControlSet\Control\ComputerName"}, ... 96, ) }, ... 96, ) == 0x0
 00737   428   NtOpenKey  (0x20019, {24, 96, 0x40, 0, 0,  (0x20019, {24, 96, 0x40, 0, 0, "ActiveComputerName"}, ... 100, ) }, ... 100, ) == 0x0
 00738   428   NtQueryValueKey  (100,  (100, "ComputerName", Full, 108, ... TitleIdx=0, Type=1, Name="ComputerName", Data="M\0Y\0W\0O\0R\0L\0D\0\0\0"}, 60, ) , Full, 108, ... TitleIdx=0, Type=1, Name= (100, "ComputerName", Full, 108, ... TitleIdx=0, Type=1, Name="ComputerName", Data="M\0Y\0W\0O\0R\0L\0D\0\0\0"}, 60, ) , Data= (100, "ComputerName", Full, 108, ... TitleIdx=0, Type=1, Name="ComputerName", Data="M\0Y\0W\0O\0R\0L\0D\0\0\0"}, 60, ) }, 60, ) == 0x0
 00739   428   NtClose  (100, ... ) == 0x0
 00740   428   NtClose  (96, ... ) == 0x0
 00741   428   NtCreateIoCompletion  (0x1f0003, 0x0, 0, ... 96, ) == 0x0
 00742   428   NtCreateIoCompletion  (0x1f0003, 0x0, -1, ... 100, ) == 0x0
 00743   428   NtDuplicateObject  (-1, 96, -1, 0x0, 0, 2, ... 104, ) == 0x0
 00744   428   NtOpenThreadToken  (-2, 0xc, 1, ... ) == STATUS_NO_TOKEN
 00745   428   NtCreateEvent  (0x1f0003, 0x0, 1, 0, ... 108, ) == 0x0
 00746   428   NtOpenThreadToken  (-2, 0xc, 1, ... ) == STATUS_NO_TOKEN
 00747   428   NtSetInformationThread  (-2, ImpersonationToken, {ImpToken=0,}, 4, ... ) == 0x0
 00748   428   NtAllocateVirtualMemory  (-1, 1380352, 0, 4096, 4096, 4, ... 1380352, 4096, ) == 0x0
 00749   428   NtCreateFile  (0xc0100080, {24, 0, 0x40, 0, 1238932,  (0xc0100080, {24, 0, 0x40, 0, 1238932, "\??\PIPE\wkssvc"}, 0x0, 0, 3, 1, 4194368, 0, 0, ... 112, {status=0x0, info=1}, ) }, 0x0, 0, 3, 1, 4194368, 0, 0, ... 112, {status=0x0, info=1}, ) == 0x0
 00750   428   NtSetInformationFile  (112, 1238988, 8, Pipe, ... {status=0x0, info=0}, ) == 0x0
 00751   428   NtSetInformationFile  (112, 1238980, 8, Completion, ... {status=0x0, info=0}, ) == 0x0
 00752   428   NtSetInformationThread  (-2, ImpersonationToken, {ImpToken=0,}, 4, ... ) == 0x0
 00753   428   NtWriteFile  (112, 89, 0, 0,  (112, 89, 0, 0, "\5\0\13\3\20\0\0\0H\0\0\0\1\0\0\0\270\20\270\20\0\0\0\0\1\0\0\0\0\0\1\0\230\320\377k\22\241\206\2303F\303\370~4Z\1\0\0\0\4]\210\212\353\34\311\21\237\350\10\0+\20H`\2\0\0\0", 72, {0, 0}, 0, ... {status=0x0, info=72}, ) , 72, {0, 0}, 0, ... {status=0x0, info=72}, ) == 0x0
 00754   428   NtReadFile  (112, 89, 0, 0, 1024, {0, 0}, 0, ... {status=0x0, info=68},  (112, 89, 0, 0, 1024, {0, 0}, 0, ... {status=0x0, info=68}, "\5\0\14\3\20\0\0\0D\0\0\0\1\0\0\0\270\20\270\20\207\37\0\0\15\0\PIPE\wkssvc\0\0\1\0\0\0\0\0\0\0\4]\210\212\353\34\311\21\237\350\10\0+\20H`\2\0\0\0", ) , ) == 0x0
 00755   428   NtFsControlFile  (112, 89, 0x0, 0x0, 0x11c017,  (112, 89, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0 \0\0\0\1\0\0\0\10\0\0\0\0\0\24\0\0\0\0\0\0\0\0\0", 32, 1024, ... {status=0x103, info=68}, "\5\0\14\3\20\0\0\0D\0\0\0\1\0\0\0\270\20\270\20\207\37\0\0\15\0\PIPE\wkssvc\0\0\1\0\0\0\0\0\0\0\4]\210\212\353\34\311\21\237\350\10\0+\20H`\2\0\0\0", ) , 32, 1024, ... {status=0x103, info=68},  (112, 89, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0 \0\0\0\1\0\0\0\10\0\0\0\0\0\24\0\0\0\0\0\0\0\0\0", 32, 1024, ... {status=0x103, info=68}, "\5\0\14\3\20\0\0\0D\0\0\0\1\0\0\0\270\20\270\20\207\37\0\0\15\0\PIPE\wkssvc\0\0\1\0\0\0\0\0\0\0\4]\210\212\353\34\311\21\237\350\10\0+\20H`\2\0\0\0", ) , ) == 0x103
 00756   428   NtClose  (108, ... ) == 0x0
 00757   428   NtClose  (112, ... ) == 0x0
 00758   428   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\U:\startupscripts"}, 1238976, ... ) }, 1238976, ... ) == 0x0
 00759   428   NtCreateSemaphore  (0x1f0003, {24, 52, 0x80, 1382696, 0,  (0x1f0003, {24, 52, 0x80, 1382696, 0, "shell.{A48F1A32-A340-11D1-BC6B-00A0C90312E1}"}, 0, 2147483647, ... 112, ) }, 0, 2147483647, ... 112, ) == STATUS_OBJECT_NAME_EXISTS
 00760   428   NtReleaseSemaphore  (112, 1, ... 0, ) == 0x0
 00761   428   NtWaitForSingleObject  (112, 0, {0, 0}, ... ) == 0x0
 00762   428   NtOpenKey  (0x1, {24, 28, 0x40, 0, 0,  (0x1, {24, 28, 0x40, 0, 0, "Software\Microsoft\Windows\CurrentVersion\Policies\Explorer"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00763   428   NtOpenKey  (0x1, {24, 60, 0x40, 0, 0,  (0x1, {24, 60, 0x40, 0, 0, "Software\Microsoft\Windows\CurrentVersion\Policies\Explorer"}, ... 108, ) }, ... 108, ) == 0x0
 00764   428   NtQueryValueKey  (108,  (108, "NoNetHood", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00765   428   NtClose  (108, ... ) == 0x0
 00766   428   NtReleaseSemaphore  (112, 1, ... 0, ) == 0x0
 00767   428   NtWaitForSingleObject  (112, 0, {0, 0}, ... ) == 0x0
 00768   428   NtOpenKey  (0x1, {24, 28, 0x40, 0, 0,  (0x1, {24, 28, 0x40, 0, 0, "Software\Microsoft\Windows\CurrentVersion\Policies\Explorer"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00769   428   NtOpenKey  (0x1, {24, 60, 0x40, 0, 0,  (0x1, {24, 60, 0x40, 0, 0, "Software\Microsoft\Windows\CurrentVersion\Policies\Explorer"}, ... 108, ) }, ... 108, ) == 0x0
 00770   428   NtQueryValueKey  (108,  (108, "NoPropertiesMyComputer", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00771   428   NtClose  (108, ... ) == 0x0
 00772   428   NtReleaseSemaphore  (112, 1, ... 0, ) == 0x0
 00773   428   NtWaitForSingleObject  (112, 0, {0, 0}, ... ) == 0x0
 00774   428   NtOpenKey  (0x1, {24, 28, 0x40, 0, 0,  (0x1, {24, 28, 0x40, 0, 0, "Software\Microsoft\Windows\CurrentVersion\Policies\Explorer"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00775   428   NtOpenKey  (0x1, {24, 60, 0x40, 0, 0,  (0x1, {24, 60, 0x40, 0, 0, "Software\Microsoft\Windows\CurrentVersion\Policies\Explorer"}, ... 108, ) }, ... 108, ) == 0x0
 00776   428   NtQueryValueKey  (108,  (108, "NoInternetIcon", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00777   428   NtClose  (108, ... ) == 0x0
 00778   428   NtReleaseSemaphore  (112, 1, ... 0, ) == 0x0
 00779   428   NtWaitForSingleObject  (112, 0, {0, 0}, ... ) == 0x0
 00780   428   NtOpenKey  (0x1, {24, 28, 0x40, 0, 0,  (0x1, {24, 28, 0x40, 0, 0, "Software\Microsoft\Windows\CurrentVersion\Policies\Explorer"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00781   428   NtOpenKey  (0x1, {24, 60, 0x40, 0, 0,  (0x1, {24, 60, 0x40, 0, 0, "Software\Microsoft\Windows\CurrentVersion\Policies\Explorer"}, ... 108, ) }, ... 108, ) == 0x0
 00782   428   NtQueryValueKey  (108,  (108, "NoCommonGroups", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00783   428   NtClose  (108, ... ) == 0x0
 00784   428   NtOpenKey  (0x20019, {24, 28, 0x40, 0, 0,  (0x20019, {24, 28, 0x40, 0, 0, "Software\Microsoft\Windows\CurrentVersion\Explorer\Desktop\NameSpace"}, ... 108, ) }, ... 108, ) == 0x0
 00785   428   NtEnumerateKey  (108, 0, Basic, 288, ... {LastWrite={0x5aa70706,0x1c73999}, TitleIdx=0, Name= (108, 0, Basic, 288, ... {LastWrite={0x5aa70706,0x1c73999}, TitleIdx=0, Name="{1f4de370-d627-11d1-ba4f-00a0c91eedba}"}, 92, ) }, 92, ) == 0x0
 00786   428   NtOpenKey  (0x20019, {24, 108, 0x40, 0, 0,  (0x20019, {24, 108, 0x40, 0, 0, "{1f4de370-d627-11d1-ba4f-00a0c91eedba}"}, ... 116, ) }, ... 116, ) == 0x0
 00787   428   NtQueryValueKey  (116,  (116, "SuppressionPolicy", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00788   428   NtClose  (116, ... ) == 0x0
 00789   428   NtEnumerateKey  (108, 1, Basic, 288, ... {LastWrite={0x5aa4a4ac,0x1c73999}, TitleIdx=0, Name= (108, 1, Basic, 288, ... {LastWrite={0x5aa4a4ac,0x1c73999}, TitleIdx=0, Name="{450D8FBA-AD25-11D0-98A8-0800361B1103}"}, 92, ) }, 92, ) == 0x0
 00790   428   NtOpenKey  (0x20019, {24, 108, 0x40, 0, 0,  (0x20019, {24, 108, 0x40, 0, 0, "{450D8FBA-AD25-11D0-98A8-0800361B1103}"}, ... 116, ) }, ... 116, ) == 0x0
 00791   428   NtQueryValueKey  (116,  (116, "SuppressionPolicy", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00792   428   NtClose  (116, ... ) == 0x0
 00793   428   NtEnumerateKey  (108, 2, Basic, 288, ... {LastWrite={0x98c5c536,0x1c738c7}, TitleIdx=0, Name= (108, 2, Basic, 288, ... {LastWrite={0x98c5c536,0x1c738c7}, TitleIdx=0, Name="{645FF040-5081-101B-9F08-00AA002F954E}"}, 92, ) }, 92, ) == 0x0
 00794   428   NtOpenKey  (0x20019, {24, 108, 0x40, 0, 0,  (0x20019, {24, 108, 0x40, 0, 0, "{645FF040-5081-101B-9F08-00AA002F954E}"}, ... 116, ) }, ... 116, ) == 0x0
 00795   428   NtQueryValueKey  (116,  (116, "SuppressionPolicy", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00796   428   NtClose  (116, ... ) == 0x0
 00797   428   NtEnumerateKey  (108, 3, Basic, 288, ... {LastWrite={0x5aa70706,0x1c73999}, TitleIdx=0, Name= (108, 3, Basic, 288, ... {LastWrite={0x5aa70706,0x1c73999}, TitleIdx=0, Name="{e17d4fc0-5564-11d1-83f2-00a0c90dc849}"}, 92, ) }, 92, ) == 0x0
 00798   428   NtOpenKey  (0x20019, {24, 108, 0x40, 0, 0,  (0x20019, {24, 108, 0x40, 0, 0, "{e17d4fc0-5564-11d1-83f2-00a0c90dc849}"}, ... 116, ) }, ... 116, ) == 0x0
 00799   428   NtQueryValueKey  (116,  (116, "SuppressionPolicy", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00800   428   NtClose  (116, ... ) == 0x0
 00801   428   NtEnumerateKey  (108, 4, Basic, 288, ... ) == STATUS_NO_MORE_ENTRIES
 00802   428   NtClose  (108, ... ) == 0x0
 00803   428   NtOpenKey  (0x20019, {24, 60, 0x40, 0, 0,  (0x20019, {24, 60, 0x40, 0, 0, "Software\Microsoft\Windows\CurrentVersion\Explorer\Desktop\NameSpace"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00804   428   NtOpenProcessToken  (-1, 0x8, ... 108, ) == 0x0
 00805   428   NtQueryInformationToken  (108, Statistics, 56, ... {token info, class 10, size 56}, 56, ) == 0x0
 00806   428   NtClose  (108, ... ) == 0x0
 00807   428   NtOpenThreadToken  (-2, 0xc, 1, ... ) == STATUS_NO_TOKEN
 00808   428   NtCreateKey  (0x2000000, {24, 60, 0x40, 0, 0,  (0x2000000, {24, 60, 0x40, 0, 0, "Software\Microsoft\Windows\CurrentVersion\Explorer"}, 0, 0x0, 0, ... 108, 2, ) }, 0, 0x0, 0, ... 108, 2, ) == 0x0
 00809   428   NtOpenKey  (0x2000000, {24, 108, 0x40, 0, 0, ""}, ... 116, ) == 0x0
 00810   428   NtCreateKey  (0x20019, {24, 116, 0x40, 0, 0,  (0x20019, {24, 116, 0x40, 0, 0, "SessionInfo\0000000000008fe4"}, 0, 0x0, 1, ... 120, 2, ) }, 0, 0x0, 1, ... 120, 2, ) == 0x0
 00811   428   NtClose  (116, ... ) == 0x0
 00812   428   NtOpenKey  (0x20019, {24, 120, 0x40, 0, 0,  (0x20019, {24, 120, 0x40, 0, 0, "Desktop\NameSpace"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00813   428   NtClose  (120, ... ) == 0x0
 00814   428   NtOpenThreadTokenEx  (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN
 00815   428   NtOpenProcessTokenEx  (-1, 0x20008, 512, ... 120, ) == 0x0
 00816   428   NtQueryInformationToken  (120, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0
 00817   428   NtClose  (120, ... ) == 0x0
 00818   428   NtOpenKey  (0x2000000, {24, 0, 0x40, 0, 0,  (0x2000000, {24, 0, 0x40, 0, 0, "\REGISTRY\USER\S-1-5-21-1078081533-484763869-839522115-1003_Classes"}, ... 120, ) }, ... 120, ) == 0x0
 00819   428   NtSetInformationObject  (122, Handle, {Inherit=0,ProtectFromClose=1,}, 1179904, ... ) == 0x0
 00820   428   NtQueryKey  (122, Name, 384, ... {Name= (122, Name, 384, ... {Name="\REGISTRY\USER\S-1-5-21-1078081533-484763869-839522115-1003_CLASSES9"}, 138, ) }, 138, ) == 0x0
 00821   428   NtOpenKey  (0x2000000, {24, 122, 0x40, 0, 0,  (0x2000000, {24, 122, 0x40, 0, 0, "CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\ShellFolder"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00822   428   NtOpenKey  (0x2000000, {24, 0, 0x40, 0, 0,  (0x2000000, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Classes\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\ShellFolder"}, ... 116, ) }, ... 116, ) == 0x0
 00823   428   NtQueryKey  (118, Name, 392, ... {Name= (118, Name, 392, ... {Name="\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\ShellFolderB"}, 186, ) }, 186, ) == 0x0
 00824   428   NtAllocateVirtualMemory  (-1, 1384448, 0, 4096, 4096, 4, ... 1384448, 4096, ) == 0x0
 00825   428   NtOpenThreadTokenEx  (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN
 00826   428   NtOpenProcessTokenEx  (-1, 0x20008, 512, ... 124, ) == 0x0
 00827   428   NtQueryInformationToken  (124, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0
 00828   428   NtClose  (124, ... ) == 0x0
 00829   428   NtOpenKey  (0x2000000, {24, 0, 0x40, 0, 0,  (0x2000000, {24, 0, 0x40, 0, 0, "\REGISTRY\USER\S-1-5-21-1078081533-484763869-839522115-1003_Classes\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\ShellFolder"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00830   428   NtQueryValueKey  (118,  (118, "WantsParseDisplayName", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00831   428   NtClose  (118, ... ) == 0x0
 00832   428   NtQueryKey  (122, Name, 384, ... {Name= (122, Name, 384, ... {Name="\REGISTRY\USER\S-1-5-21-1078081533-484763869-839522115-1003_CLASSES9"}, 138, ) }, 138, ) == 0x0
 00833   428   NtOpenKey  (0x2000000, {24, 122, 0x40, 0, 0,  (0x2000000, {24, 122, 0x40, 0, 0, "CLSID\{208D2C60-3AEA-1069-A2D7-08002B30309D}\ShellFolder"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00834   428   NtOpenKey  (0x2000000, {24, 0, 0x40, 0, 0,  (0x2000000, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Classes\CLSID\{208D2C60-3AEA-1069-A2D7-08002B30309D}\ShellFolder"}, ... 116, ) }, ... 116, ) == 0x0
 00835   428   NtQueryKey  (118, Name, 392, ... {Name= (118, Name, 392, ... {Name="\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{208D2C60-3AEA-1069-A2D7-08002B30309D}\ShellFolderB"}, 186, ) }, 186, ) == 0x0
 00836   428   NtOpenThreadTokenEx  (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN
 00837   428   NtOpenProcessTokenEx  (-1, 0x20008, 512, ... 124, ) == 0x0
 00838   428   NtQueryInformationToken  (124, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0
 00839   428   NtClose  (124, ... ) == 0x0
 00840   428   NtOpenKey  (0x2000000, {24, 0, 0x40, 0, 0,  (0x2000000, {24, 0, 0x40, 0, 0, "\REGISTRY\USER\S-1-5-21-1078081533-484763869-839522115-1003_Classes\CLSID\{208D2C60-3AEA-1069-A2D7-08002B30309D}\ShellFolder"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00841   428   NtQueryValueKey  (118,  (118, "WantsParseDisplayName", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00842   428   NtClose  (118, ... ) == 0x0
 00843   428   NtQueryKey  (122, Name, 384, ... {Name= (122, Name, 384, ... {Name="\REGISTRY\USER\S-1-5-21-1078081533-484763869-839522115-1003_CLASSES9"}, 138, ) }, 138, ) == 0x0
 00844   428   NtOpenKey  (0x2000000, {24, 122, 0x40, 0, 0,  (0x2000000, {24, 122, 0x40, 0, 0, "CLSID\{871C5380-42A0-1069-A2EA-08002B30309D}\ShellFolder"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00845   428   NtOpenKey  (0x2000000, {24, 0, 0x40, 0, 0,  (0x2000000, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Classes\CLSID\{871C5380-42A0-1069-A2EA-08002B30309D}\ShellFolder"}, ... 116, ) }, ... 116, ) == 0x0
 00846   428   NtQueryKey  (118, Name, 392, ... {Name= (118, Name, 392, ... {Name="\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{871C5380-42A0-1069-A2EA-08002B30309D}\ShellFolderB"}, 186, ) }, 186, ) == 0x0
 00847   428   NtOpenThreadTokenEx  (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN
 00848   428   NtOpenProcessTokenEx  (-1, 0x20008, 512, ... 124, ) == 0x0
 00849   428   NtQueryInformationToken  (124, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0
 00850   428   NtClose  (124, ... ) == 0x0
 00851   428   NtOpenKey  (0x2000000, {24, 0, 0x40, 0, 0,  (0x2000000, {24, 0, 0x40, 0, 0, "\REGISTRY\USER\S-1-5-21-1078081533-484763869-839522115-1003_Classes\CLSID\{871C5380-42A0-1069-A2EA-08002B30309D}\ShellFolder"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00852   428   NtQueryValueKey  (118,  (118, "WantsParseDisplayName", Partial, 144, ... TitleIdx=0, Type=1, Data="\0\0"}, 14, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (118, "WantsParseDisplayName", Partial, 144, ... TitleIdx=0, Type=1, Data="\0\0"}, 14, ) }, 14, ) == 0x0
 00853   428   NtClose  (118, ... ) == 0x0
 00854   428   NtOpenKey  (0x1, {24, 28, 0x40, 0, 0,  (0x1, {24, 28, 0x40, 0, 0, "SOFTWARE\Microsoft\Windows\CurrentVersion\ShellCompatibility\Objects\{871C5380-42A0-1069-A2EA-08002B30309D}"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00855   428   NtQueryKey  (122, Name, 384, ... {Name= (122, Name, 384, ... {Name="\REGISTRY\USER\S-1-5-21-1078081533-484763869-839522115-1003_CLASSESC"}, 138, ) }, 138, ) == 0x0
 00856   428   NtOpenKey  (0x1, {24, 122, 0x40, 0, 0,  (0x1, {24, 122, 0x40, 0, 0, "CLSID\{871C5380-42A0-1069-A2EA-08002B30309D}\InProcServer32"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00857   428   NtOpenKey  (0x1, {24, 0, 0x40, 0, 0,  (0x1, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Classes\CLSID\{871C5380-42A0-1069-A2EA-08002B30309D}\InProcServer32"}, ... 116, ) }, ... 116, ) == 0x0
 00858   428   NtQueryKey  (118, Name, 392, ... {Name= (118, Name, 392, ... {Name="\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{871C5380-42A0-1069-A2EA-08002B30309D}\InProcServer32"}, 192, ) }, 192, ) == 0x0
 00859   428   NtOpenThreadTokenEx  (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN
 00860   428   NtOpenProcessTokenEx  (-1, 0x20008, 512, ... 124, ) == 0x0
 00861   428   NtQueryInformationToken  (124, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0
 00862   428   NtClose  (124, ... ) == 0x0
 00863   428   NtOpenKey  (0x2000000, {24, 0, 0x40, 0, 0,  (0x2000000, {24, 0, 0x40, 0, 0, "\REGISTRY\USER\S-1-5-21-1078081533-484763869-839522115-1003_Classes\CLSID\{871C5380-42A0-1069-A2EA-08002B30309D}\InProcServer32"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00864   428   NtQueryValueKey  (118, 0x0, Partial, 144, ... TitleIdx=0, Type=2, Data= (118, 0x0, Partial, 144, ... TitleIdx=0, Type=2, Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0s\0h\0d\0o\0c\0v\0w\0.\0d\0l\0l\0\0\0"}, 80, ) }, 80, ) == 0x0
 00865   428   NtQueryKey  (118, Name, 392, ... {Name= (118, Name, 392, ... {Name="\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{871C5380-42A0-1069-A2EA-08002B30309D}\InProcServer32"}, 192, ) }, 192, ) == 0x0
 00866   428   NtOpenThreadTokenEx  (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN
 00867   428   NtOpenProcessTokenEx  (-1, 0x20008, 512, ... 124, ) == 0x0
 00868   428   NtQueryInformationToken  (124, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0
 00869   428   NtClose  (124, ... ) == 0x0
 00870   428   NtOpenKey  (0x2000000, {24, 0, 0x40, 0, 0,  (0x2000000, {24, 0, 0x40, 0, 0, "\REGISTRY\USER\S-1-5-21-1078081533-484763869-839522115-1003_Classes\CLSID\{871C5380-42A0-1069-A2EA-08002B30309D}\InProcServer32"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00871   428   NtQueryValueKey  (118,  (118, "LoadWithoutCOM", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00872   428   NtClose  (118, ... ) == 0x0
 00873   428   NtReleaseSemaphore  (112, 1, ... 0, ) == 0x0
 00874   428   NtWaitForSingleObject  (112, 0, {0, 0}, ... ) == 0x0
 00875   428   NtOpenKey  (0x1, {24, 28, 0x40, 0, 0,  (0x1, {24, 28, 0x40, 0, 0, "Software\Microsoft\Windows\CurrentVersion\Policies\Explorer"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00876   428   NtOpenKey  (0x1, {24, 60, 0x40, 0, 0,  (0x1, {24, 60, 0x40, 0, 0, "Software\Microsoft\Windows\CurrentVersion\Policies\Explorer"}, ... 116, ) }, ... 116, ) == 0x0
 00877   428   NtQueryValueKey  (116,  (116, "EnforceShellExtensionSecurity", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00878   428   NtClose  (116, ... ) == 0x0
 00879   428   NtOpenSection  (0xe, {24, 8, 0x40, 0, 0,  (0xe, {24, 8, 0x40, 0, 0, "appHelp.dll"}, ... 116, ) }, ... 116, ) == 0x0
 00880   428   NtMapViewOfSection  (116, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x75f40000), 0x0, 118784, ) == 0x0
 00881   428   NtClose  (116, ... ) == 0x0
 00882   428   NtOpenKey  (0x1, {24, 0, 0x40, 0, 0,  (0x1, {24, 0, 0x40, 0, 0, "\Registry\MACHINE\System\CurrentControlSet\Control\Session Manager\AppCompatibility"}, ... 116, ) }, ... 116, ) == 0x0
 00883   428   NtQueryValueKey  (116,  (116, "DisableAppCompat", Partial, 20, ... ) , Partial, 20, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00884   428   NtClose  (116, ... ) == 0x0
 00885   428   NtOpenKey  (0x80000000, {24, 0, 0x40, 0, 0,  (0x80000000, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Classes\CLSID\{871c5380-42a0-1069-a2ea-08002b30309d}\InProcServer32"}, ... 116, ) }, ... 116, ) == 0x0
 00886   428   NtQueryValueKey  (116, " (116, "", Full, 520, ... TitleIdx=0, Type=2, Name="", Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0s\0h\0d\0o\0c\0v\0w\0.\0d\0l\0l\0\0\0"}, 88, )  (116, "", Full, 520, ... TitleIdx=0, Type=2, Name="", Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0s\0h\0d\0o\0c\0v\0w\0.\0d\0l\0l\0\0\0"}, 88, ) %\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0s\0h\0d\0o\0c\0v\0w\0.\0d\0l\0l\0\0\0"}, 88, ) == 0x0
 00887   428   NtClose  (116, ... ) == 0x0
 00888   428   NtCreateFile  (0x80100080, {24, 0, 0x40, 0, 0,  (0x80100080, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\System32\shdocvw.dll"}, 0x0, 128, 1, 1, 96, 0, 0, ... 116, {status=0x0, info=1}, ) }, 0x0, 128, 1, 1, 96, 0, 0, ... 116, {status=0x0, info=1}, ) == 0x0
 00889   428   NtQueryVolumeInformationFile  (116, 1239116, 8, Device, ... {status=0x0, info=8}, ) == 0x0
 00890   428   NtOpenMutant  (0x120001, {24, 52, 0x0, 0, 0,  (0x120001, {24, 52, 0x0, 0, 0, "ShimCacheMutex"}, ... 124, ) }, ... 124, ) == 0x0
 00891   428   NtWaitForSingleObject  (124, 0, {-1000000, -1}, ... ) == 0x0
 00892   428   NtOpenSection  (0x2, {24, 52, 0x0, 0, 0,  (0x2, {24, 52, 0x0, 0, 0, "ShimSharedMemory"}, ... 128, ) }, ... 128, ) == 0x0
 00893   428   NtMapViewOfSection  (128, -1, (0x0), 0, 0, {0, 0}, 0, 1, 0, 4, ... (0x850000), {0, 0}, 57344, ) == 0x0
 00894   428   NtReleaseMutant  (124, ... 0x0, ) == 0x0
 00895   428   NtCreateFile  (0x80100080, {24, 0, 0x40, 0, 0,  (0x80100080, {24, 0, 0x40, 0, 0, "\SystemRoot\AppPatch\sysmain.sdb"}, 0x0, 128, 1, 1, 96, 0, 0, ... 132, {status=0x0, info=1}, ) }, 0x0, 128, 1, 1, 96, 0, 0, ... 132, {status=0x0, info=1}, ) == 0x0
 00896   428   NtQueryInformationFile  (132, 1238532, 24, Standard, ... {status=0x0, info=24}, ) == 0x0
 00897   428   NtCreateSection  (0x4, 0x0, 0x0, 2, 134217728, 132, ... 136, ) == 0x0
 00898   428   NtMapViewOfSection  (136, -1, (0x0), 0, 0, 0x0, 0, 2, 0, 2, ... (0x8d0000), 0x0, 1028096, ) == 0x0
 00899   428   NtQueryInformationFile  (132, 1238628, 24, Standard, ... {status=0x0, info=24}, ) == 0x0
 00900   428   NtCreateFile  (0x80100080, {24, 0, 0x40, 0, 0,  (0x80100080, {24, 0, 0x40, 0, 0, "\SystemRoot\AppPatch\systest.sdb"}, 0x0, 128, 1, 1, 96, 0, 0, ... ) }, 0x0, 128, 1, 1, 96, 0, 0, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00901   428   NtQuerySystemInformation  (Processor, 12, ... {system info, class 1, size 12}, 0x0, ) == 0x0
 00902   428   NtQueryInformationProcess  (-1, Wow64, 4, ... {process info, class 26, size 4}, 0x0, ) == 0x0
 00903   428   NtAllocateVirtualMemory  (-1, 1388544, 0, 4096, 4096, 4, ... 1388544, 4096, ) == 0x0
 00904   428   NtOpenFile  (0x100001, {24, 0, 0x40, 0, 0,  (0x100001, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\System32\"}, 3, 16417, ... 140, {status=0x0, info=1}, ) }, 3, 16417, ... 140, {status=0x0, info=1}, ) == 0x0
 00905   428   NtQueryDirectoryFile  (140, 0, 0, 0, 1236076, 616, BothDirectory, 1,  (140, 0, 0, 0, 1236076, 616, BothDirectory, 1, "shdocvw.dll", 0, ... {status=0x0, info=116}, ) , 0, ... {status=0x0, info=116}, ) == 0x0
 00906   428   NtClose  (140, ... ) == 0x0
 00907   428   NtQueryInformationProcess  (-1, DefaultHardErrorMode, 4, ... {process info, class 12, size 4}, 0x0, ) == 0x0
 00908   428   NtSetInformationProcess  (-1, DefaultHardErrorMode, {process info, class 12, size 4}, 4, ... ) == 0x0
 00909   428   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\System32\shdocvw.dll"}, 1235464, ... ) }, 1235464, ... ) == 0x0
 00910   428   NtOpenFile  (0x100001, {24, 0, 0x40, 0, 0,  (0x100001, {24, 0, 0x40, 0, 0, "\??\C:\"}, 3, 16417, ... 140, {status=0x0, info=1}, ) }, 3, 16417, ... 140, {status=0x0, info=1}, ) == 0x0
 00911   428   NtQueryDirectoryFile  (140, 0, 0, 0, 1234824, 616, BothDirectory, 1,  (140, 0, 0, 0, 1234824, 616, BothDirectory, 1, "WINDOWS", 0, ... {status=0x0, info=108}, ) , 0, ... {status=0x0, info=108}, ) == 0x0
 00912   428   NtClose  (140, ... ) == 0x0
 00913   428   NtOpenFile  (0x100001, {24, 0, 0x40, 0, 0,  (0x100001, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\"}, 3, 16417, ... 140, {status=0x0, info=1}, ) }, 3, 16417, ... 140, {status=0x0, info=1}, ) == 0x0
 00914   428   NtQueryDirectoryFile  (140, 0, 0, 0, 1234824, 616, BothDirectory, 1,  (140, 0, 0, 0, 1234824, 616, BothDirectory, 1, "System32", 0, ... {status=0x0, info=110}, ) , 0, ... {status=0x0, info=110}, ) == 0x0
 00915   428   NtClose  (140, ... ) == 0x0
 00916   428   NtOpenFile  (0x100001, {24, 0, 0x40, 0, 0,  (0x100001, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\System32\"}, 3, 16417, ... 140, {status=0x0, info=1}, ) }, 3, 16417, ... 140, {status=0x0, info=1}, ) == 0x0
 00917   428   NtQueryDirectoryFile  (140, 0, 0, 0, 1234824, 616, BothDirectory, 1,  (140, 0, 0, 0, 1234824, 616, BothDirectory, 1, "shdocvw.dll", 0, ... {status=0x0, info=116}, ) , 0, ... {status=0x0, info=116}, ) == 0x0
 00918   428   NtClose  (140, ... ) == 0x0
 00919   428   NtQueryInformationProcess  (-1, DefaultHardErrorMode, 4, ... {process info, class 12, size 4}, 0x0, ) == 0x0
 00920   428   NtSetInformationProcess  (-1, DefaultHardErrorMode, {process info, class 12, size 4}, 4, ... ) == 0x0
 00921   428   NtQueryInformationProcess  (-1, DeviceMap, 36, ... {process info, class 23, size 36}, 0x0, ) == 0x0
 00922   428   NtOpenThreadTokenEx  (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN
 00923   428   NtOpenProcessTokenEx  (-1, 0x20008, 512, ... 140, ) == 0x0
 00924   428   NtQueryInformationToken  (140, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0
 00925   428   NtClose  (140, ... ) == 0x0
 00926   428   NtOpenKey  (0x80000100, {24, 0, 0x40, 0, 0,  (0x80000100, {24, 0, 0x40, 0, 0, "\REGISTRY\USER\S-1-5-21-1078081533-484763869-839522115-1003\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Layers"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00927   428   NtOpenKey  (0x80000100, {24, 0, 0x40, 0, 0,  (0x80000100, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Custom\shdocvw.dll"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00928   428   NtWaitForSingleObject  (124, 0, {-1000000, -1}, ... ) == 0x0
 00929   428   NtQueryVolumeInformationFile  (116, 1239120, 8, Device, ... {status=0x0, info=8}, ) == 0x0
 00930   428   NtQueryInformationFile  (116, 1239100, 40, Basic, ... {status=0x0, info=40}, ) == 0x0
 00931   428   NtQueryInformationFile  (116, 1239140, 24, Standard, ... {status=0x0, info=24}, ) == 0x0
 00932   428   NtReleaseMutant  (124, ... 0x0, ) == 0x0
 00933   428   NtUnmapViewOfSection  (-1, 0x8d0000, ... ) == 0x0
 00934   428   NtClose  (136, ... ) == 0x0
 00935   428   NtClose  (132, ... ) == 0x0
 00936   428   NtClose  (116, ... ) == 0x0
 00937   428   NtOpenKey  (0x20019, {24, 28, 0x40, 0, 0,  (0x20019, {24, 28, 0x40, 0, 0, "Software\Microsoft\COM3"}, ... 116, ) }, ... 116, ) == 0x0
 00938   428   NtQueryValueKey  (116,  (116, "Com+Enabled", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (116, "Com+Enabled", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) }, 16, ) == 0x0
 00939   428   NtClose  (116, ... ) == 0x0
 00940   428   NtOpenSection  (0xe, {24, 8, 0x40, 0, 0,  (0xe, {24, 8, 0x40, 0, 0, "CLBCATQ.DLL"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00941   428   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\u:\work\CLBCATQ.DLL"}, 1236868, ... ) }, 1236868, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00942   428   NtQueryAttributesFile  ({24, 12, 0x40, 0, 0,  ({24, 12, 0x40, 0, 0, "CLBCATQ.DLL"}, 1236868, ... ) }, 1236868, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00943   428   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\System32\CLBCATQ.DLL"}, 1236868, ... ) }, 1236868, ... ) == 0x0
 00944   428   NtOpenFile  (0x100020, {24, 0, 0x40, 0, 0,  (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\System32\CLBCATQ.DLL"}, 5, 96, ... 116, {status=0x0, info=1}, ) }, 5, 96, ... 116, {status=0x0, info=1}, ) == 0x0
 00945   428   NtCreateSection  (0xf, 0x0, 0x0, 16, 16777216, 116, ... 132, ) == 0x0
 00946   428   NtQuerySection  (132, Image, 48, ... {section info, class 1, size 48}, 0x0, ) == 0x0
 00947   428   NtClose  (116, ... ) == 0x0
 00948   428   NtMapViewOfSection  (132, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x76fd0000), 0x0, 491520, ) == 0x0
 00949   428   NtClose  (132, ... ) == 0x0
 00950   428   NtOpenSection  (0xe, {24, 8, 0x40, 0, 0,  (0xe, {24, 8, 0x40, 0, 0, "OLEAUT32.dll"}, ... 132, ) }, ... 132, ) == 0x0
 00951   428   NtMapViewOfSection  (132, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x77120000), 0x0, 569344, ) == 0x0
 00952   428   NtClose  (132, ... ) == 0x0
 00953   428   NtOpenSection  (0xe, {24, 8, 0x40, 0, 0,  (0xe, {24, 8, 0x40, 0, 0, "COMRes.dll"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00954   428   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\u:\work\COMRes.dll"}, 1236064, ... ) }, 1236064, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00955   428   NtQueryAttributesFile  ({24, 12, 0x40, 0, 0,  ({24, 12, 0x40, 0, 0, "COMRes.dll"}, 1236064, ... ) }, 1236064, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00956   428   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\System32\COMRes.dll"}, 1236064, ... ) }, 1236064, ... ) == 0x0
 00957   428   NtOpenFile  (0x100020, {24, 0, 0x40, 0, 0,  (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\System32\COMRes.dll"}, 5, 96, ... 132, {status=0x0, info=1}, ) }, 5, 96, ... 132, {status=0x0, info=1}, ) == 0x0
 00958   428   NtCreateSection  (0xf, 0x0, 0x0, 16, 16777216, 132, ... 116, ) == 0x0
 00959   428   NtQuerySection  (116, Image, 48, ... {section info, class 1, size 48}, 0x0, ) == 0x0
 00960   428   NtClose  (132, ... ) == 0x0
 00961   428   NtMapViewOfSection  (116, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x77050000), 0x0, 806912, ) == 0x0
 00962   428   NtClose  (116, ... ) == 0x0
 00963   428   NtOpenSection  (0xe, {24, 8, 0x40, 0, 0,  (0xe, {24, 8, 0x40, 0, 0, "VERSION.dll"}, ... 116, ) }, ... 116, ) == 0x0
 00964   428   NtMapViewOfSection  (116, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x77c00000), 0x0, 28672, ) == 0x0
 00965   428   NtClose  (116, ... ) == 0x0
 00966   428   NtUserRegisterWindowMessage  ( ("{FB8F0821-0164-101B-84ED-08002B2EC713}", ... ) , ... ) == 0xc07b
 00967   428   NtOpenKey  (0x1, {24, 28, 0x40, 0, 0,  (0x1, {24, 28, 0x40, 0, 0, "SOFTWARE\Microsoft\OLEAUT"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00968   428   NtOpenKey  (0x9, {24, 28, 0x40, 0, 0,  (0x9, {24, 28, 0x40, 0, 0, "SOFTWARE\Microsoft\OLEAUT\UserEra"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00969   428   NtOpenKey  (0x1, {24, 28, 0x40, 0, 0,  (0x1, {24, 28, 0x40, 0, 0, "SOFTWARE\Microsoft\OLEAUT"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00970   428   NtOpenKey  (0xf003f, {24, 28, 0x40, 0, 0,  (0xf003f, {24, 28, 0x40, 0, 0, "Software\Microsoft\COM3\Debug"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00971   428   NtOpenKey  (0x20019, {24, 28, 0x40, 0, 0,  (0x20019, {24, 28, 0x40, 0, 0, "Software\Microsoft\COM3\Debug"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00972   428   NtOpenKey  (0x20019, {24, 28, 0x40, 0, 0,  (0x20019, {24, 28, 0x40, 0, 0, "SOFTWARE\Microsoft\OLE"}, ... 116, ) }, ... 116, ) == 0x0
 00973   428   NtQueryValueKey  (116,  (116, "MinimumFreeMemPercentageToCreateProcess", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00974   428   NtQueryValueKey  (116,  (116, "MinimumFreeMemPercentageToCreateObject", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00975   428   NtClose  (116, ... ) == 0x0
 00976   428   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\Registration"}, 1236896, ... ) }, 1236896, ... ) == 0x0
 00977   428   NtOpenSection  (0x4, {24, 52, 0x2, 0, 0,  (0x4, {24, 52, 0x2, 0, 0, "Global\ComPlusCOMRegTable"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00978   428   NtQueryInformationProcess  (-1, Wow64, 4, ... {process info, class 26, size 4}, 0x0, ) == 0x0
 00979   428   NtOpenKey  (0x20019, {24, 28, 0x40, 0, 0,  (0x20019, {24, 28, 0x40, 0, 0, "Software\Microsoft\COM3"}, ... 116, ) }, ... 116, ) == 0x0
 00980   428   NtQueryValueKey  (116,  (116, "Com+Enabled", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (116, "Com+Enabled", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) }, 16, ) == 0x0
 00981   428   NtClose  (116, ... ) == 0x0
 00982   428   NtOpenKey  (0x2000000, {24, 28, 0x40, 0, 0,  (0x2000000, {24, 28, 0x40, 0, 0, "Software\Classes"}, ... 116, ) }, ... 116, ) == 0x0
 00983   428   NtCreateEvent  (0x1f0003, 0x0, 0, 0, ... 132, ) == 0x0
 00984   428   NtNotifyChangeKey  (116, 132, 0, 0, 2011390432, 5, 1, 0, 0, 1, ... ) == 0x103
 00985   428   NtOpenKey  (0x2000000, {24, 28, 0x40, 0, 0,  (0x2000000, {24, 28, 0x40, 0, 0, "Software\Microsoft\COM3"}, ... 136, ) }, ... 136, ) == 0x0
 00986   428   NtCreateEvent  (0x1f0003, 0x0, 0, 0, ... 140, ) == 0x0
 00987   428   NtNotifyChangeKey  (136, 140, 0, 0, 2011390432, 5, 1, 0, 0, 1, ... ) == 0x103
 00988   428   NtCreateEvent  (0x1f0003, 0x0, 0, 0, ... 144, ) == 0x0
 00989   428   NtOpenKey  (0x2000000, {24, 0, 0x40, 0, 0,  (0x2000000, {24, 0, 0x40, 0, 0, "\REGISTRY\USER"}, ... 148, ) }, ... 148, ) == 0x0
 00990   428   NtSetInformationObject  (148, Handle, {Inherit=0,ProtectFromClose=1,}, 2011365632, ... ) == 0x0
 00991   428   NtNotifyChangeKey  (148, 144, 0, 0, 2011390432, 5, 1, 0, 0, 1, ... ) == 0x103
 00992   428   NtOpenKey  (0x2000000, {24, 28, 0x40, 0, 0,  (0x2000000, {24, 28, 0x40, 0, 0, "Software\Classes"}, ... 152, ) }, ... 152, ) == 0x0
 00993   428   NtCreateEvent  (0x1f0003, 0x0, 0, 0, ... 156, ) == 0x0
 00994   428   NtNotifyChangeKey  (152, 156, 0, 0, 2011390432, 5, 1, 0, 0, 1, ... ) == 0x103
 00995   428   NtCreateEvent  (0x1f0003, 0x0, 0, 0, ... 160, ) == 0x0
 00996   428   NtNotifyChangeKey  (148, 160, 0, 0, 2011390432, 5, 1, 0, 0, 1, ... ) == 0x103
 00997   428   NtOpenKey  (0x2000000, {24, 28, 0x40, 0, 0,  (0x2000000, {24, 28, 0x40, 0, 0, "Software\Microsoft\COM3"}, ... 164, ) }, ... 164, ) == 0x0
 00998   428   NtCreateEvent  (0x1f0003, 0x0, 0, 0, ... 168, ) == 0x0
 00999   428   NtNotifyChangeKey  (164, 168, 0, 0, 2011390432, 5, 1, 0, 0, 1, ... ) == 0x103
 01000   428   NtOpenKey  (0x2000000, {24, 28, 0x40, 0, 0,  (0x2000000, {24, 28, 0x40, 0, 0, "Software\Microsoft\COM3"}, ... 172, ) }, ... 172, ) == 0x0
 01001   428   NtCreateEvent  (0x1f0003, 0x0, 0, 0, ... 176, ) == 0x0
 01002   428   NtNotifyChangeKey  (172, 176, 0, 0, 2011390432, 5, 1, 0, 0, 1, ... ) == 0x103
 01003   428   NtOpenKey  (0x2000000, {24, 28, 0x40, 0, 0,  (0x2000000, {24, 28, 0x40, 0, 0, "Software\Classes\CLSID"}, ... 180, ) }, ... 180, ) == 0x0
 01004   428   NtCreateEvent  (0x1f0003, 0x0, 0, 0, ... 184, ) == 0x0
 01005   428   NtNotifyChangeKey  (180, 184, 0, 0, 2011390432, 5, 1, 0, 0, 1, ... ) == 0x103
 01006   428   NtOpenKey  (0x2000000, {24, 28, 0x40, 0, 0,  (0x2000000, {24, 28, 0x40, 0, 0, "Software\Classes"}, ... 188, ) }, ... 188, ) == 0x0
 01007   428   NtCreateEvent  (0x1f0003, 0x0, 0, 0, ... 192, ) == 0x0
 01008   428   NtNotifyChangeKey  (188, 192, 0, 0, 2011390432, 5, 1, 0, 0, 1, ... ) == 0x103
 01009   428   NtOpenKey  (0x2000000, {24, 28, 0x40, 0, 0,  (0x2000000, {24, 28, 0x40, 0, 0, "Software\Microsoft\COM3"}, ... 196, ) }, ... 196, ) == 0x0
 01010   428   NtCreateEvent  (0x1f0003, 0x0, 0, 0, ... 200, ) == 0x0
 01011   428   NtNotifyChangeKey  (196, 200, 0, 0, 2011390432, 5, 1, 0, 0, 1, ... ) == 0x103
 01012   428   NtCreateEvent  (0x1f0003, 0x0, 0, 0, ... 204, ) == 0x0
 01013   428   NtNotifyChangeKey  (148, 204, 0, 0, 2011390432, 5, 1, 0, 0, 1, ... ) == 0x103
 01014   428   NtOpenKey  (0x2000000, {24, 28, 0x40, 0, 0,  (0x2000000, {24, 28, 0x40, 0, 0, "Software\Microsoft\COM3"}, ... 208, ) }, ... 208, ) == 0x0
 01015   428   NtCreateEvent  (0x1f0003, 0x0, 0, 0, ... 212, ) == 0x0
 01016   428   NtNotifyChangeKey  (208, 212, 0, 0, 2011390432, 5, 1, 0, 0, 1, ... ) == 0x103
 01017   428   NtOpenKey  (0x2000000, {24, 28, 0x40, 0, 0,  (0x2000000, {24, 28, 0x40, 0, 0, "Software\Microsoft\COM3"}, ... 216, ) }, ... 216, ) == 0x0
 01018   428   NtCreateEvent  (0x1f0003, 0x0, 0, 0, ... 220, ) == 0x0
 01019   428   NtNotifyChangeKey  (216, 220, 0, 0, 2011390432, 5, 1, 0, 0, 1, ... ) == 0x103
 01020   428   NtOpenKey  (0x2000000, {24, 28, 0x40, 0, 0,  (0x2000000, {24, 28, 0x40, 0, 0, "Software\Classes\CLSID"}, ... 224, ) }, ... 224, ) == 0x0
 01021   428   NtCreateEvent  (0x1f0003, 0x0, 0, 0, ... 228, ) == 0x0
 01022   428   NtNotifyChangeKey  (224, 228, 0, 0, 2011390432, 5, 1, 0, 0, 1, ... ) == 0x103
 01023   428   NtOpenSection  (0x4, {24, 52, 0x2, 0, 0,  (0x4, {24, 52, 0x2, 0, 0, "Global\ComPlusCOMRegTable"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01024   428   NtOpenKey  (0x20019, {24, 28, 0x40, 0, 0,  (0x20019, {24, 28, 0x40, 0, 0, "Software\Microsoft\COM3"}, ... 232, ) }, ... 232, ) == 0x0
 01025   428   NtQueryValueKey  (232,  (232, "REGDBVersion", Partial, 144, ... TitleIdx=0, Type=3, Data="\7\0\0\0\0\0\0\0"}, 20, ) , Partial, 144, ... TitleIdx=0, Type=3, Data= (232, "REGDBVersion", Partial, 144, ... TitleIdx=0, Type=3, Data="\7\0\0\0\0\0\0\0"}, 20, ) }, 20, ) == 0x0
 01026   428   NtClose  (232, ... ) == 0x0
 01027   428   NtAllocateVirtualMemory  (-1, 1392640, 0, 4096, 4096, 4, ... 1392640, 4096, ) == 0x0
 01028   428   NtAllocateVirtualMemory  (-1, 8601600, 0, 4096, 4096, 4, ... 8601600, 4096, ) == 0x0
 01029   428   NtQuerySystemInformation  (Basic, 44, ... {Unknown=0,MaximumIncrement=156250,PhysicalPageSize=0x1000,NumberOfPhysicalPages=0xff7c,LowestPhysicalPage=0x1,HighestPhysicalPage=0xffff,AllocationGranularity=0x10000,LowestUserAddress=0x10000,HighestUserAddress=0x7ffeffff,ActiveProcessors=1,NumberProcessors=1,}, 0x0, ) == 0x0
 01030   428   NtQuerySystemInformation  (Processor, 12, ... {system info, class 1, size 12}, 0x0, ) == 0x0
 01031   428   NtOpenSection  (0x4, {24, 52, 0x0, 0, 0,  (0x4, {24, 52, 0x0, 0, 0, "__R_000000000007_SMem__"}, ... 232, ) }, ... 232, ) == 0x0
 01032   428   NtMapViewOfSection  (232, -1, (0x0), 0, 0, {0, 0}, 0, 1, 0, 2, ... (0x8d0000), {0, 0}, 24576, ) == 0x0
 01033   428   NtAllocateVirtualMemory  (-1, 8605696, 0, 8192, 4096, 4, ... 8605696, 8192, ) == 0x0
 01034   428   NtOpenSection  (0x4, {24, 52, 0x2, 0, 0,  (0x4, {24, 52, 0x2, 0, 0, "Global\ComPlusCOMRegTable"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01035   428   NtOpenKey  (0x20019, {24, 28, 0x40, 0, 0,  (0x20019, {24, 28, 0x40, 0, 0, "Software\Microsoft\COM3"}, ... 236, ) }, ... 236, ) == 0x0
 01036   428   NtQueryValueKey  (236,  (236, "REGDBVersion", Partial, 144, ... TitleIdx=0, Type=3, Data="\7\0\0\0\0\0\0\0"}, 20, ) , Partial, 144, ... TitleIdx=0, Type=3, Data= (236, "REGDBVersion", Partial, 144, ... TitleIdx=0, Type=3, Data="\7\0\0\0\0\0\0\0"}, 20, ) }, 20, ) == 0x0
 01037   428   NtClose  (236, ... ) == 0x0
 01038   428   NtQuerySystemInformation  (Basic, 44, ... {Unknown=0,MaximumIncrement=156250,PhysicalPageSize=0x1000,NumberOfPhysicalPages=0xff7c,LowestPhysicalPage=0x1,HighestPhysicalPage=0xffff,AllocationGranularity=0x10000,LowestUserAddress=0x10000,HighestUserAddress=0x7ffeffff,ActiveProcessors=1,NumberProcessors=1,}, 0x0, ) == 0x0
 01039   428   NtQuerySystemInformation  (Processor, 12, ... {system info, class 1, size 12}, 0x0, ) == 0x0
 01040   428   NtAllocateVirtualMemory  (-1, 0, 0, 65536, 8192, 1, ... 9306112, 65536, ) == 0x0
 01041   428   NtAllocateVirtualMemory  (-1, 9306112, 0, 4096, 4096, 4, ... 9306112, 4096, ) == 0x0
 01042   428   NtQueryKey  (122, Name, 384, ... {Name= (122, Name, 384, ... {Name="\REGISTRY\USER\S-1-5-21-1078081533-484763869-839522115-1003_CLASSES\"}, 138, ) }, 138, ) == 0x0
 01043   428   NtOpenKey  (0x20019, {24, 122, 0x40, 0, 0,  (0x20019, {24, 122, 0x40, 0, 0, "CLSID\{871C5380-42A0-1069-A2EA-08002B30309D}"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01044   428   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Classes\CLSID\{871C5380-42A0-1069-A2EA-08002B30309D}"}, ... 236, ) }, ... 236, ) == 0x0
 01045   428   NtQueryKey  (238, Name, 384, ... {Name= (238, Name, 384, ... {Name="\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{871C5380-42A0-1069-A2EA-08002B30309D}9"}, 162, ) }, 162, ) == 0x0
 01046   428   NtOpenThreadTokenEx  (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN
 01047   428   NtOpenProcessTokenEx  (-1, 0x20008, 512, ... 240, ) == 0x0
 01048   428   NtQueryInformationToken  (240, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0
 01049   428   NtClose  (240, ... ) == 0x0
 01050   428   NtOpenKey  (0x1, {24, 0, 0x40, 0, 0,  (0x1, {24, 0, 0x40, 0, 0, "\REGISTRY\USER\S-1-5-21-1078081533-484763869-839522115-1003_Classes\CLSID\{871C5380-42A0-1069-A2EA-08002B30309D}\TreatAs"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01051   428   NtOpenKey  (0x1, {24, 238, 0x40, 0, 0,  (0x1, {24, 238, 0x40, 0, 0, "TreatAs"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01052   428   NtClose  (238, ... ) == 0x0
 01053   428   NtQueryKey  (122, Name, 384, ... {Name= (122, Name, 384, ... {Name="\REGISTRY\USER\S-1-5-21-1078081533-484763869-839522115-1003_CLASSES9"}, 138, ) }, 138, ) == 0x0
 01054   428   NtOpenKey  (0x20019, {24, 122, 0x40, 0, 0,  (0x20019, {24, 122, 0x40, 0, 0, "CLSID\{871C5380-42A0-1069-A2EA-08002B30309D}"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01055   428   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Classes\CLSID\{871C5380-42A0-1069-A2EA-08002B30309D}"}, ... 236, ) }, ... 236, ) == 0x0
 01056   428   NtQueryKey  (238, Name, 384, ... {Name= (238, Name, 384, ... {Name="\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{871C5380-42A0-1069-A2EA-08002B30309D}9"}, 162, ) }, 162, ) == 0x0
 01057   428   NtOpenThreadTokenEx  (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN
 01058   428   NtOpenProcessTokenEx  (-1, 0x20008, 512, ... 240, ) == 0x0
 01059   428   NtQueryInformationToken  (240, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0
 01060   428   NtClose  (240, ... ) == 0x0
 01061   428   NtOpenKey  (0x2000000, {24, 0, 0x40, 0, 0,  (0x2000000, {24, 0, 0x40, 0, 0, "\REGISTRY\USER\S-1-5-21-1078081533-484763869-839522115-1003_Classes\CLSID\{871C5380-42A0-1069-A2EA-08002B30309D}\InprocServer32"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01062   428   NtOpenKey  (0x2000000, {24, 238, 0x40, 0, 0,  (0x2000000, {24, 238, 0x40, 0, 0, "InprocServer32"}, ... 240, ) }, ... 240, ) == 0x0
 01063   428   NtQueryKey  (242, Name, 392, ... {Name= (242, Name, 392, ... {Name="\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{871C5380-42A0-1069-A2EA-08002B30309D}\InProcServer32"}, 192, ) }, 192, ) == 0x0
 01064   428   NtOpenThreadTokenEx  (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN
 01065   428   NtOpenProcessTokenEx  (-1, 0x20008, 512, ... 244, ) == 0x0
 01066   428   NtQueryInformationToken  (244, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0
 01067   428   NtClose  (244, ... ) == 0x0
 01068   428   NtOpenKey  (0x2000000, {24, 0, 0x40, 0, 0,  (0x2000000, {24, 0, 0x40, 0, 0, "\REGISTRY\USER\S-1-5-21-1078081533-484763869-839522115-1003_Classes\CLSID\{871C5380-42A0-1069-A2EA-08002B30309D}\InProcServer32"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01069   428   NtQueryValueKey  (242,  (242, "InprocServer32", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01070   428   NtClose  (242, ... ) == 0x0
 01071   428   NtQueryKey  (238, Name, 384, ... {Name= (238, Name, 384, ... {Name="\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{871C5380-42A0-1069-A2EA-08002B30309D}_"}, 162, ) }, 162, ) == 0x0
 01072   428   NtOpenThreadTokenEx  (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN
 01073   428   NtOpenProcessTokenEx  (-1, 0x20008, 512, ... 240, ) == 0x0
 01074   428   NtQueryInformationToken  (240, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0
 01075   428   NtClose  (240, ... ) == 0x0
 01076   428   NtOpenKey  (0x2000000, {24, 0, 0x40, 0, 0,  (0x2000000, {24, 0, 0x40, 0, 0, "\REGISTRY\USER\S-1-5-21-1078081533-484763869-839522115-1003_Classes\CLSID\{871C5380-42A0-1069-A2EA-08002B30309D}\InprocServerX86"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01077   428   NtOpenKey  (0x2000000, {24, 238, 0x40, 0, 0,  (0x2000000, {24, 238, 0x40, 0, 0, "InprocServerX86"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01078   428   NtQueryKey  (238, Name, 384, ... {Name= (238, Name, 384, ... {Name="\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{871C5380-42A0-1069-A2EA-08002B30309D}_"}, 162, ) }, 162, ) == 0x0
 01079   428   NtOpenThreadTokenEx  (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN
 01080   428   NtOpenProcessTokenEx  (-1, 0x20008, 512, ... 240, ) == 0x0
 01081   428   NtQueryInformationToken  (240, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0
 01082   428   NtClose  (240, ... ) == 0x0
 01083   428   NtOpenKey  (0x2000000, {24, 0, 0x40, 0, 0,  (0x2000000, {24, 0, 0x40, 0, 0, "\REGISTRY\USER\S-1-5-21-1078081533-484763869-839522115-1003_Classes\CLSID\{871C5380-42A0-1069-A2EA-08002B30309D}\LocalServer32"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01084   428   NtOpenKey  (0x2000000, {24, 238, 0x40, 0, 0,  (0x2000000, {24, 238, 0x40, 0, 0, "LocalServer32"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01085   428   NtQueryKey  (238, Name, 384, ... {Name= (238, Name, 384, ... {Name="\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{871C5380-42A0-1069-A2EA-08002B30309D}_"}, 162, ) }, 162, ) == 0x0
 01086   428   NtOpenThreadTokenEx  (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN
 01087   428   NtOpenProcessTokenEx  (-1, 0x20008, 512, ... 240, ) == 0x0
 01088   428   NtQueryInformationToken  (240, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0
 01089   428   NtClose  (240, ... ) == 0x0
 01090   428   NtOpenKey  (0x2000000, {24, 0, 0x40, 0, 0,  (0x2000000, {24, 0, 0x40, 0, 0, "\REGISTRY\USER\S-1-5-21-1078081533-484763869-839522115-1003_Classes\CLSID\{871C5380-42A0-1069-A2EA-08002B30309D}\InprocServer32"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01091   428   NtOpenKey  (0x2000000, {24, 238, 0x40, 0, 0,  (0x2000000, {24, 238, 0x40, 0, 0, "InprocServer32"}, ... 240, ) }, ... 240, ) == 0x0
 01092   428   NtQueryKey  (242, Name, 392, ... {Name= (242, Name, 392, ... {Name="\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{871C5380-42A0-1069-A2EA-08002B30309D}\InProcServer32"}, 192, ) }, 192, ) == 0x0
 01093   428   NtOpenThreadTokenEx  (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN
 01094   428   NtOpenProcessTokenEx  (-1, 0x20008, 512, ... 244, ) == 0x0
 01095   428   NtQueryInformationToken  (244, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0
 01096   428   NtClose  (244, ... ) == 0x0
 01097   428   NtOpenKey  (0x2000000, {24, 0, 0x40, 0, 0,  (0x2000000, {24, 0, 0x40, 0, 0, "\REGISTRY\USER\S-1-5-21-1078081533-484763869-839522115-1003_Classes\CLSID\{871C5380-42A0-1069-A2EA-08002B30309D}\InProcServer32"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01098   428   NtQueryValueKey  (242, 0x0, Partial, 144, ... TitleIdx=0, Type=2, Data= (242, 0x0, Partial, 144, ... TitleIdx=0, Type=2, Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0s\0h\0d\0o\0c\0v\0w\0.\0d\0l\0l\0\0\0"}, 80, ) }, 80, ) == 0x0
 01099   428   NtClose  (242, ... ) == 0x0
 01100   428   NtAllocateVirtualMemory  (-1, 1396736, 0, 4096, 4096, 4, ... 1396736, 4096, ) == 0x0
 01101   428   NtQueryKey  (238, Name, 384, ... {Name= (238, Name, 384, ... {Name="\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{871C5380-42A0-1069-A2EA-08002B30309D}_"}, 162, ) }, 162, ) == 0x0
 01102   428   NtOpenThreadTokenEx  (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN
 01103   428   NtOpenProcessTokenEx  (-1, 0x20008, 512, ... 240, ) == 0x0
 01104   428   NtQueryInformationToken  (240, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0
 01105   428   NtClose  (240, ... ) == 0x0
 01106   428   NtOpenKey  (0x2000000, {24, 0, 0x40, 0, 0,  (0x2000000, {24, 0, 0x40, 0, 0, "\REGISTRY\USER\S-1-5-21-1078081533-484763869-839522115-1003_Classes\CLSID\{871C5380-42A0-1069-A2EA-08002B30309D}\InprocHandler32"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01107   428   NtOpenKey  (0x2000000, {24, 238, 0x40, 0, 0,  (0x2000000, {24, 238, 0x40, 0, 0, "InprocHandler32"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01108   428   NtQueryKey  (238, Name, 384, ... {Name= (238, Name, 384, ... {Name="\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{871C5380-42A0-1069-A2EA-08002B30309D}_"}, 162, ) }, 162, ) == 0x0
 01109   428   NtOpenThreadTokenEx  (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN
 01110   428   NtOpenProcessTokenEx  (-1, 0x20008, 512, ... 240, ) == 0x0
 01111   428   NtQueryInformationToken  (240, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0
 01112   428   NtClose  (240, ... ) == 0x0
 01113   428   NtOpenKey  (0x2000000, {24, 0, 0x40, 0, 0,  (0x2000000, {24, 0, 0x40, 0, 0, "\REGISTRY\USER\S-1-5-21-1078081533-484763869-839522115-1003_Classes\CLSID\{871C5380-42A0-1069-A2EA-08002B30309D}\InprocHandlerX86"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01114   428   NtOpenKey  (0x2000000, {24, 238, 0x40, 0, 0,  (0x2000000, {24, 238, 0x40, 0, 0, "InprocHandlerX86"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01115   428   NtQueryKey  (238, Name, 384, ... {Name= (238, Name, 384, ... {Name="\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{871C5380-42A0-1069-A2EA-08002B30309D}_"}, 162, ) }, 162, ) == 0x0
 01116   428   NtOpenThreadTokenEx  (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN
 01117   428   NtOpenProcessTokenEx  (-1, 0x20008, 512, ... 240, ) == 0x0
 01118   428   NtQueryInformationToken  (240, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0
 01119   428   NtClose  (240, ... ) == 0x0
 01120   428   NtOpenKey  (0x2000000, {24, 0, 0x40, 0, 0,  (0x2000000, {24, 0, 0x40, 0, 0, "\REGISTRY\USER\S-1-5-21-1078081533-484763869-839522115-1003_Classes\CLSID\{871C5380-42A0-1069-A2EA-08002B30309D}\LocalServer32"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01121   428   NtOpenKey  (0x2000000, {24, 238, 0x40, 0, 0,  (0x2000000, {24, 238, 0x40, 0, 0, "LocalServer32"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01122   428   NtQueryKey  (238, Name, 384, ... {Name= (238, Name, 384, ... {Name="\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{871C5380-42A0-1069-A2EA-08002B30309D}_"}, 162, ) }, 162, ) == 0x0
 01123   428   NtOpenThreadTokenEx  (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN
 01124   428   NtOpenProcessTokenEx  (-1, 0x20008, 512, ... 240, ) == 0x0
 01125   428   NtQueryInformationToken  (240, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0
 01126   428   NtClose  (240, ... ) == 0x0
 01127   428   NtOpenKey  (0x2000000, {24, 0, 0x40, 0, 0,  (0x2000000, {24, 0, 0x40, 0, 0, "\REGISTRY\USER\S-1-5-21-1078081533-484763869-839522115-1003_Classes\CLSID\{871C5380-42A0-1069-A2EA-08002B30309D}\LocalServer"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01128   428   NtOpenKey  (0x2000000, {24, 238, 0x40, 0, 0,  (0x2000000, {24, 238, 0x40, 0, 0, "LocalServer"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01129   428   NtQueryKey  (122, Name, 384, ... {Name= (122, Name, 384, ... {Name="\REGISTRY\USER\S-1-5-21-1078081533-484763869-839522115-1003_CLASSES9"}, 138, ) }, 138, ) == 0x0
 01130   428   NtOpenKey  (0x20019, {24, 122, 0x40, 0, 0,  (0x20019, {24, 122, 0x40, 0, 0, "CLSID\{871C5380-42A0-1069-A2EA-08002B30309D}"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01131   428   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Classes\CLSID\{871C5380-42A0-1069-A2EA-08002B30309D}"}, ... 240, ) }, ... 240, ) == 0x0
 01132   428   NtQueryKey  (242, Name, 392, ... {Name= (242, Name, 392, ... {Name="\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{871C5380-42A0-1069-A2EA-08002B30309D}9"}, 162, ) }, 162, ) == 0x0
 01133   428   NtOpenThreadTokenEx  (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN
 01134   428   NtOpenProcessTokenEx  (-1, 0x20008, 512, ... 244, ) == 0x0
 01135   428   NtQueryInformationToken  (244, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0
 01136   428   NtClose  (244, ... ) == 0x0
 01137   428   NtOpenKey  (0x2000000, {24, 0, 0x40, 0, 0,  (0x2000000, {24, 0, 0x40, 0, 0, "\REGISTRY\USER\S-1-5-21-1078081533-484763869-839522115-1003_Classes\CLSID\{871C5380-42A0-1069-A2EA-08002B30309D}"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01138   428   NtQueryValueKey  (242,  (242, "AppID", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01139   428   NtClose  (242, ... ) == 0x0
 01140   428   NtClose  (238, ... ) == 0x0
 01141   428   NtOpenProcess  (0x400, {24, 0, 0x0, 0, 0, 0x0}, {420, 0}, ... 236, ) == 0x0
 01142   428   NtQueryInformationProcess  (236, Session, 4, ... {SessionId=0,}, 0x0, ) == 0x0
 01143   428   NtClose  (236, ... ) == 0x0
 01144   428   NtQueryKey  (122, Name, 384, ... {Name= (122, Name, 384, ... {Name="\REGISTRY\USER\S-1-5-21-1078081533-484763869-839522115-1003_CLASSES9"}, 138, ) }, 138, ) == 0x0
 01145   428   NtOpenKey  (0x20019, {24, 122, 0x40, 0, 0,  (0x20019, {24, 122, 0x40, 0, 0, "CLSID\{871C5380-42A0-1069-A2EA-08002B30309D}"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01146   428   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Classes\CLSID\{871C5380-42A0-1069-A2EA-08002B30309D}"}, ... 236, ) }, ... 236, ) == 0x0
 01147   428   NtClose  (238, ... ) == 0x0
 01148   428   NtQueryKey  (122, Name, 384, ... {Name= (122, Name, 384, ... {Name="\REGISTRY\USER\S-1-5-21-1078081533-484763869-839522115-1003_CLASSES3"}, 138, ) }, 138, ) == 0x0
 01149   428   NtOpenKey  (0x20019, {24, 122, 0x40, 0, 0,  (0x20019, {24, 122, 0x40, 0, 0, "CLSID\{871C5380-42A0-1069-A2EA-08002B30309D}"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01150   428   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Classes\CLSID\{871C5380-42A0-1069-A2EA-08002B30309D}"}, ... 236, ) }, ... 236, ) == 0x0
 01151   428   NtQueryKey  (238, Name, 384, ... {Name= (238, Name, 384, ... {Name="\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{871C5380-42A0-1069-A2EA-08002B30309D}9"}, 162, ) }, 162, ) == 0x0
 01152   428   NtOpenThreadTokenEx  (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN
 01153   428   NtOpenProcessTokenEx  (-1, 0x20008, 512, ... 240, ) == 0x0
 01154   428   NtQueryInformationToken  (240, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0
 01155   428   NtClose  (240, ... ) == 0x0
 01156   428   NtOpenKey  (0x2000000, {24, 0, 0x40, 0, 0,  (0x2000000, {24, 0, 0x40, 0, 0, "\REGISTRY\USER\S-1-5-21-1078081533-484763869-839522115-1003_Classes\CLSID\{871C5380-42A0-1069-A2EA-08002B30309D}\InprocServer32"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01157   428   NtOpenKey  (0x2000000, {24, 238, 0x40, 0, 0,  (0x2000000, {24, 238, 0x40, 0, 0, "InprocServer32"}, ... 240, ) }, ... 240, ) == 0x0
 01158   428   NtQueryKey  (242, Name, 392, ... {Name= (242, Name, 392, ... {Name="\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{871C5380-42A0-1069-A2EA-08002B30309D}\InProcServer32"}, 192, ) }, 192, ) == 0x0
 01159   428   NtOpenThreadTokenEx  (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN
 01160   428   NtOpenProcessTokenEx  (-1, 0x20008, 512, ... 244, ) == 0x0
 01161   428   NtQueryInformationToken  (244, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0
 01162   428   NtClose  (244, ... ) == 0x0
 01163   428   NtOpenKey  (0x2000000, {24, 0, 0x40, 0, 0,  (0x2000000, {24, 0, 0x40, 0, 0, "\REGISTRY\USER\S-1-5-21-1078081533-484763869-839522115-1003_Classes\CLSID\{871C5380-42A0-1069-A2EA-08002B30309D}\InProcServer32"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01164   428   NtQueryValueKey  (242,  (242, "ThreadingModel", Partial, 144, ... TitleIdx=0, Type=1, Data="A\0p\0a\0r\0t\0m\0e\0n\0t\0\0\0"}, 32, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (242, "ThreadingModel", Partial, 144, ... TitleIdx=0, Type=1, Data="A\0p\0a\0r\0t\0m\0e\0n\0t\0\0\0"}, 32, ) }, 32, ) == 0x0
 01165   428   NtClose  (242, ... ) == 0x0
 01166   428   NtClose  (238, ... ) == 0x0
 01167   428   NtAllocateVirtualMemory  (-1, 1400832, 0, 8192, 4096, 4, ... 1400832, 8192, ) == 0x0
 01168   428   NtQueryKey  (122, Name, 384, ... {Name= (122, Name, 384, ... {Name="\REGISTRY\USER\S-1-5-21-1078081533-484763869-839522115-1003_CLASSES9"}, 138, ) }, 138, ) == 0x0
 01169   428   NtOpenKey  (0x20019, {24, 122, 0x40, 0, 0,  (0x20019, {24, 122, 0x40, 0, 0, "CLSID\{871C5380-42A0-1069-A2EA-08002B30309D}"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01170   428   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Classes\CLSID\{871C5380-42A0-1069-A2EA-08002B30309D}"}, ... 236, ) }, ... 236, ) == 0x0
 01171   428   NtQueryKey  (238, Name, 384, ... {Name= (238, Name, 384, ... {Name="\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{871C5380-42A0-1069-A2EA-08002B30309D}9"}, 162, ) }, 162, ) == 0x0
 01172   428   NtOpenThreadTokenEx  (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN
 01173   428   NtOpenProcessTokenEx  (-1, 0x20008, 512, ... 240, ) == 0x0
 01174   428   NtQueryInformationToken  (240, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0
 01175   428   NtClose  (240, ... ) == 0x0
 01176   428   NtOpenKey  (0x1, {24, 0, 0x40, 0, 0,  (0x1, {24, 0, 0x40, 0, 0, "\REGISTRY\USER\S-1-5-21-1078081533-484763869-839522115-1003_Classes\CLSID\{871C5380-42A0-1069-A2EA-08002B30309D}\TreatAs"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01177   428   NtOpenKey  (0x1, {24, 238, 0x40, 0, 0,  (0x1, {24, 238, 0x40, 0, 0, "TreatAs"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01178   428   NtClose  (238, ... ) == 0x0
 01179   428   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\System32\shdocvw.dll"}, 1233288, ... ) }, 1233288, ... ) == 0x0
 01180   428   NtOpenFile  (0x100020, {24, 0, 0x40, 0, 0,  (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\System32\shdocvw.dll"}, 5, 96, ... 236, {status=0x0, info=1}, ) }, 5, 96, ... 236, {status=0x0, info=1}, ) == 0x0
 01181   428   NtCreateSection  (0xe, 0x0, 0x0, 16, 134217728, 236, ... 240, ) == 0x0
 01182   428   NtClose  (236, ... ) == 0x0
 01183   428   NtMapViewOfSection  (240, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 16, ... (0x8f0000), 0x0, 1339392, ) == 0x0
 01184   428   NtClose  (240, ... ) == 0x0
 01185   428   NtUnmapViewOfSection  (-1, 0x8f0000, ... ) == 0x0
 01186   428   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\System32\shdocvw.dll"}, 1233604, ... ) }, 1233604, ... ) == 0x0
 01187   428   NtOpenFile  (0x100020, {24, 0, 0x40, 0, 0,  (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\System32\shdocvw.dll"}, 5, 96, ... 240, {status=0x0, info=1}, ) }, 5, 96, ... 240, {status=0x0, info=1}, ) == 0x0
 01188   428   NtCreateSection  (0xf, 0x0, 0x0, 16, 16777216, 240, ... 236, ) == 0x0
 01189   428   NtQuerySection  (236, Image, 48, ... {section info, class 1, size 48}, 0x0, ) == 0x0
 01190   428   NtClose  (240, ... ) == 0x0
 01191   428   NtMapViewOfSection  (236, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x769c0000), 0x0, 1347584, ) == 0x0
 01192   428   NtClose  (236, ... ) == 0x0
 01193   428   NtQueryDefaultUILanguage  (1231968, ...
 01194   428   NtOpenThreadTokenEx  (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN
 01195   428   NtOpenProcessTokenEx  (-1, 0x20008, 512, ... -2147482204, ) == 0x0
 01196   428   NtQueryInformationToken  (-2147482204, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0
 01197   428   NtClose  (-2147482204, ... ) == 0x0
 01198   428   NtOpenKey  (0x2000000, {24, 0, 0x640, 0, 0,  (0x2000000, {24, 0, 0x640, 0, 0, "\REGISTRY\USER\S-1-5-21-1078081533-484763869-839522115-1003"}, ... -2147482204, ) }, ... -2147482204, ) == 0x0
 01199   428   NtOpenKey  (0x80000000, {24, 0, 0x240, 0, 0,  (0x80000000, {24, 0, 0x240, 0, 0, "\Registry\Machine\System\CurrentControlSet\Control\Nls\MUILanguages"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01200   428   NtOpenKey  (0x80000000, {24, -2147482204, 0x640, 0, 0,  (0x80000000, {24, -2147482204, 0x640, 0, 0, "Control Panel\Desktop"}, ... -2147482208, ) }, ... -2147482208, ) == 0x0
 01201   428   NtQueryValueKey  (-2147482208,  (-2147482208, "MultiUILanguageId", Partial, 256, ... ) , Partial, 256, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01202   428   NtClose  (-2147482208, ... ) == 0x0
 01203   428   NtClose  (-2147482204, ... ) == 0x0
 01193   428   NtQueryDefaultUILanguage  ... ) == 0x0
 01204   428   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\System\CurrentControlSet\Control\Nls\MUILanguages"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01205   428   NtOpenFile  (0x1200a9, {24, 0, 0x40, 0, 0,  (0x1200a9, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\System32\shdocvw.dll"}, 1, 96, ... 236, {status=0x0, info=1}, ) }, 1, 96, ... 236, {status=0x0, info=1}, ) == 0x0
 01206   428   NtCreateSection  (0x4, 0x0, 0x0, 2, 134217728, 236, ... 240, ) == 0x0
 01207   428   NtMapViewOfSection  (240, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 2, ... (0x8f0000), 0x0, 1339392, ) == 0x0
 01208   428   NtOpenFile  (0x1200a9, {24, 0, 0x40, 0, 0,  (0x1200a9, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\System32\shdocvw.dll.123.Manifest"}, 1, 96, ... ) }, 1, 96, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01209   428   NtAllocateVirtualMemory  (-1, 1220608, 0, 4096, 4096, 260, ... 1220608, 4096, ) == 0x0
 01210   428   NtQueryDefaultLocale  (1, 1230004, ... ) == 0x0
 01211   428   NtOpenFile  (0x1200a9, {24, 0, 0x40, 0, 0,  (0x1200a9, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\System32\shdocvw.dll.123.Config"}, 1, 96, ... ) }, 1, 96, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01212   428   NtRequestWaitReplyPort  (24, {128, 156, new_msg, 0, 1230860, 1, 96, 0}  (24, {128, 156, new_msg, 0, 1230860, 1, 96, 0} "\210\6\31\1\33\0\1\0\0\0\0\0\1\313\22\0\1\0\0\0\0\0\11\4\1\1\1\0>\0@\0\250\6\31\1\354\0\0\0\377\377\377\377\0\0\0\0\10\340\232\0\0\0\0\0\236\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0(\0,\0\350\6\31\1\0\0\0\0\0\0\0\0\14\317\22\0\0\0\0\0" ... {128, 156, reply, 0, 420, 428, 1454, 0} " S\26\0\33\0\1\0\0\0\0\0\1\313\22\0\1\0\0\0\0\0\11\4\1\1\1\0>\0@\0\250\6\31\1\354\0\0\0\377\377\377\377\0\0\0\0\10\340\232\0\0\0\0\0\236\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0(\0,\0\350\6\31\1\0\0\0\0\0\0\0\0\14\317\22\0\0\0\0\0" )  ... {128, 156, reply, 0, 420, 428, 1454, 0}  (24, {128, 156, new_msg, 0, 1230860, 1, 96, 0} "\210\6\31\1\33\0\1\0\0\0\0\0\1\313\22\0\1\0\0\0\0\0\11\4\1\1\1\0>\0@\0\250\6\31\1\354\0\0\0\377\377\377\377\0\0\0\0\10\340\232\0\0\0\0\0\236\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0(\0,\0\350\6\31\1\0\0\0\0\0\0\0\0\14\317\22\0\0\0\0\0" ... {128, 156, reply, 0, 420, 428, 1454, 0} " S\26\0\33\0\1\0\0\0\0\0\1\313\22\0\1\0\0\0\0\0\11\4\1\1\1\0>\0@\0\250\6\31\1\354\0\0\0\377\377\377\377\0\0\0\0\10\340\232\0\0\0\0\0\236\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0(\0,\0\350\6\31\1\0\0\0\0\0\0\0\0\14\317\22\0\0\0\0\0" )  ) == 0x0
 01213   428   NtClose  (236, ... ) == 0x0
 01214   428   NtClose  (240, ... ) == 0x0
 01215   428   NtUnmapViewOfSection  (-1, 0x8f0000, ... ) == 0x0
 01216   428   NtUnmapViewOfSection  (-1, 0x12cf0c, ... ) == STATUS_NOT_MAPPED_VIEW
 01217   428   NtQueryDebugFilterState  (53, 2, ... ) == 0x0
 01218   428   NtOpenKey  (0x8, {24, 0, 0x40, 0, 0,  (0x8, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows\CurrentVersion\SideBySide\AssemblyStorageRoots"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01219   428   NtQueryDebugFilterState  (53, 2, ... ) == 0x0
 01220   428   NtQueryDebugFilterState  (53, 2, ... ) == 0x0
 01221   428   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\u:\work\packed.exe.Local\"}, 1228544, ... ) }, 1228544, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01222   428   NtQueryDebugFilterState  (53, 2, ... ) == 0x0
 01223   428   NtQueryDebugFilterState  (53, 2, ... ) == 0x0
 01224   428   NtQueryDebugFilterState  (53, 2, ... ) == 0x0
 01225   428   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.0.0_x-ww_1382d70a"}, 1229136, ... ) }, 1229136, ... ) == 0x0
 01226   428   NtOpenFile  (0x100020, {24, 0, 0x40, 0, 0,  (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.0.0_x-ww_1382d70a"}, 3, 33, ... 240, {status=0x0, info=1}, ) }, 3, 33, ... 240, {status=0x0, info=1}, ) == 0x0
 01227   428   NtQueryDebugFilterState  (53, 2, ... ) == 0x0
 01228   428   NtUserFindExistingCursorIcon  (1233088, 1233104, 1233672, ... ) == 0x10011
 01229   428   NtUserRegisterClassExWOW  (1233540, 1233620, 1233604, 1233636, 0, 384, 0, ... ) == 0x810e0000
 01230   428   NtUserGetClassInfo  (1905590272, 1233704, 1233656, 1233732, 0, ... ) == 0xc05f
 01231   428   NtGdiCreateHalftonePalette  (0, ... ) == 0x208041a
 01232   428   NtGdiDoPalette  (34079770, 0, 256, 1232796, 2, 0, ... ) == 0x100
 01233   428   NtGdiDeleteObjectApp  (34079770, ... ) == 0x1
 01234   428   NtGdiCreateCompatibleDC  (0, ... ) == 0x301041a
 01235   428   NtGdiCreatePaletteInternal  (1232792, 256, ... ) == 0x1080420
 01236   428   NtGdiDeleteObjectApp  (50398234, ... ) == 0x1
 01237   428   NtQueryKey  (122, Name, 384, ... {Name= (122, Name, 384, ... {Name="\REGISTRY\USER\S-1-5-21-1078081533-484763869-839522115-1003_CLASSESn"}, 138, ) }, 138, ) == 0x0
 01238   428   NtOpenKey  (0x1, {24, 122, 0x40, 0, 0,  (0x1, {24, 122, 0x40, 0, 0, "Interface\{EAB22AC1-30C1-11CF-A7EB-0000C05BAE0B}\Typelib"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01239   428   NtOpenKey  (0x1, {24, 0, 0x40, 0, 0,  (0x1, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Classes\Interface\{EAB22AC1-30C1-11CF-A7EB-0000C05BAE0B}\Typelib"}, ... 236, ) }, ... 236, ) == 0x0
 01240   428   NtQueryKey  (238, Name, 392, ... {Name= (238, Name, 392, ... {Name="\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{EAB22AC1-30C1-11CF-A7EB-0000C05BAE0B}\TypeLib0"}, 186, ) }, 186, ) == 0x0
 01241   428   NtOpenThreadTokenEx  (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN
 01242   428   NtOpenProcessTokenEx  (-1, 0x20008, 512, ... 244, ) == 0x0
 01243   428   NtQueryInformationToken  (244, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0
 01244   428   NtClose  (244, ... ) == 0x0
 01245   428   NtOpenKey  (0x2000000, {24, 0, 0x40, 0, 0,  (0x2000000, {24, 0, 0x40, 0, 0, "\REGISTRY\USER\S-1-5-21-1078081533-484763869-839522115-1003_Classes\Interface\{EAB22AC1-30C1-11CF-A7EB-0000C05BAE0B}\TypeLib"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01246   428   NtQueryValueKey  (238, 0x0, Partial, 144, ... TitleIdx=0, Type=1, Data= (238, 0x0, Partial, 144, ... TitleIdx=0, Type=1, Data="{\0E\0A\0B\02\02\0A\0C\00\0-\03\00\0C\01\0-\01\01\0C\0F\0-\0A\07\0E\0B\0-\00\00\00\00\0C\00\05\0B\0A\0E\00\0B\0}\0\0\0"}, 90, ) }, 90, ) == 0x0
 01247   428   NtClose  (238, ... ) == 0x0
 01248   428   NtQueryKey  (122, Name, 384, ... {Name= (122, Name, 384, ... {Name="\REGISTRY\USER\S-1-5-21-1078081533-484763869-839522115-1003_CLASSES9"}, 138, ) }, 138, ) == 0x0
 01249   428   NtOpenKey  (0x1, {24, 122, 0x40, 0, 0,  (0x1, {24, 122, 0x40, 0, 0, "Interface\{b722bccb-4e68-101b-a2bc-00aa00404770}\ProxyStubClsid32"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01250   428   NtOpenKey  (0x1, {24, 0, 0x40, 0, 0,  (0x1, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Classes\Interface\{b722bccb-4e68-101b-a2bc-00aa00404770}\ProxyStubClsid32"}, ... 236, ) }, ... 236, ) == 0x0
 01251   428   NtQueryKey  (238, Name, 392, ... {Name= (238, Name, 392, ... {Name="\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{B722BCCB-4E68-101B-A2BC-00AA00404770}\ProxyStubClsid32"}, 204, ) }, 204, ) == 0x0
 01252   428   NtOpenThreadTokenEx  (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN
 01253   428   NtOpenProcessTokenEx  (-1, 0x20008, 512, ... 244, ) == 0x0
 01254   428   NtQueryInformationToken  (244, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0
 01255   428   NtClose  (244, ... ) == 0x0
 01256   428   NtOpenKey  (0x2000000, {24, 0, 0x40, 0, 0,  (0x2000000, {24, 0, 0x40, 0, 0, "\REGISTRY\USER\S-1-5-21-1078081533-484763869-839522115-1003_Classes\Interface\{B722BCCB-4E68-101B-A2BC-00AA00404770}\ProxyStubClsid32"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01257   428   NtQueryValueKey  (238, 0x0, Partial, 144, ... TitleIdx=0, Type=1, Data= (238, 0x0, Partial, 144, ... TitleIdx=0, Type=1, Data="{\0B\08\0D\0A\06\03\01\00\0-\0E\01\09\0B\0-\01\01\0D\00\0-\09\03\03\0C\0-\00\00\0A\00\0C\09\00\0D\0C\0A\0A\09\0}\0\0\0"}, 90, ) }, 90, ) == 0x0
 01258   428   NtClose  (238, ... ) == 0x0
 01259   428   NtQueryKey  (122, Name, 384, ... {Name= (122, Name, 384, ... {Name="\REGISTRY\USER\S-1-5-21-1078081533-484763869-839522115-1003_CLASSES9"}, 138, ) }, 138, ) == 0x0
 01260   428   NtOpenKey  (0x1, {24, 122, 0x40, 0, 0,  (0x1, {24, 122, 0x40, 0, 0, "Interface\{79eac9c4-baf9-11ce-8c82-00aa004ba90b}\ProxyStubClsid32"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01261   428   NtOpenKey  (0x1, {24, 0, 0x40, 0, 0,  (0x1, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Classes\Interface\{79eac9c4-baf9-11ce-8c82-00aa004ba90b}\ProxyStubClsid32"}, ... 236, ) }, ... 236, ) == 0x0
 01262   428   NtQueryKey  (238, Name, 392, ... {Name= (238, Name, 392, ... {Name="\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{79EAC9C4-BAF9-11CE-8C82-00AA004BA90B}\ProxyStubClsid32"}, 204, ) }, 204, ) == 0x0
 01263   428   NtOpenThreadTokenEx  (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN
 01264   428   NtOpenProcessTokenEx  (-1, 0x20008, 512, ... 244, ) == 0x0
 01265   428   NtQueryInformationToken  (244, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0
 01266   428   NtClose  (244, ... ) == 0x0
 01267   428   NtOpenKey  (0x2000000, {24, 0, 0x40, 0, 0,  (0x2000000, {24, 0, 0x40, 0, 0, "\REGISTRY\USER\S-1-5-21-1078081533-484763869-839522115-1003_Classes\Interface\{79EAC9C4-BAF9-11CE-8C82-00AA004BA90B}\ProxyStubClsid32"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01268   428   NtQueryValueKey  (238, 0x0, Partial, 144, ... TitleIdx=0, Type=1, Data= (238, 0x0, Partial, 144, ... TitleIdx=0, Type=1, Data="{\0B\08\0D\0A\06\03\01\00\0-\0E\01\09\0B\0-\01\01\0D\00\0-\09\03\03\0C\0-\00\00\0A\00\0C\09\00\0D\0C\0A\0A\09\0}\0\0\0"}, 90, ) }, 90, ) == 0x0
 01269   428   NtClose  (238, ... ) == 0x0
 01270   428   NtQueryKey  (122, Name, 384, ... {Name= (122, Name, 384, ... {Name="\REGISTRY\USER\S-1-5-21-1078081533-484763869-839522115-1003_CLASSES9"}, 138, ) }, 138, ) == 0x0
 01271   428   NtOpenKey  (0x1, {24, 122, 0x40, 0, 0,  (0x1, {24, 122, 0x40, 0, 0, "Interface\{000214E6-0000-0000-C000-000000000046}\ProxyStubClsid32"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01272   428   NtOpenKey  (0x1, {24, 0, 0x40, 0, 0,  (0x1, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Classes\Interface\{000214E6-0000-0000-C000-000000000046}\ProxyStubClsid32"}, ... 236, ) }, ... 236, ) == 0x0
 01273   428   NtQueryKey  (238, Name, 392, ... {Name= (238, Name, 392, ... {Name="\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{000214E6-0000-0000-C000-000000000046}\ProxyStubClsid32"}, 204, ) }, 204, ) == 0x0
 01274   428   NtOpenThreadTokenEx  (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN
 01275   428   NtOpenProcessTokenEx  (-1, 0x20008, 512, ... 244, ) == 0x0
 01276   428   NtQueryInformationToken  (244, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0
 01277   428   NtClose  (244, ... ) == 0x0
 01278   428   NtOpenKey  (0x2000000, {24, 0, 0x40, 0, 0,  (0x2000000, {24, 0, 0x40, 0, 0, "\REGISTRY\USER\S-1-5-21-1078081533-484763869-839522115-1003_Classes\Interface\{000214E6-0000-0000-C000-000000000046}\ProxyStubClsid32"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01279   428   NtQueryValueKey  (238, 0x0, Partial, 144, ... TitleIdx=0, Type=1, Data= (238, 0x0, Partial, 144, ... TitleIdx=0, Type=1, Data="{\0b\0f\05\00\0b\06\08\0e\0-\02\09\0b\08\0-\04\03\08\06\0-\0a\0e\09\0c\0-\09\07\03\04\0d\05\01\01\07\0c\0d\05\0}\0\0\0"}, 90, ) }, 90, ) == 0x0
 01280   428   NtClose  (238, ... ) == 0x0
 01281   428   NtQueryKey  (122, Name, 384, ... {Name= (122, Name, 384, ... {Name="\REGISTRY\USER\S-1-5-21-1078081533-484763869-839522115-1003_CLASSES9"}, 138, ) }, 138, ) == 0x0
 01282   428   NtOpenKey  (0x1, {24, 122, 0x40, 0, 0,  (0x1, {24, 122, 0x40, 0, 0, "Interface\{93F2F68C-1D1B-11D3-A30E-00C04F79ABD1}\ProxyStubClsid32"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01283   428   NtOpenKey  (0x1, {24, 0, 0x40, 0, 0,  (0x1, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Classes\Interface\{93F2F68C-1D1B-11D3-A30E-00C04F79ABD1}\ProxyStubClsid32"}, ... 236, ) }, ... 236, ) == 0x0
 01284   428   NtQueryKey  (238, Name, 392, ... {Name= (238, Name, 392, ... {Name="\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{93F2F68C-1D1B-11D3-A30E-00C04F79ABD1}\ProxyStubClsid32"}, 204, ) }, 204, ) == 0x0
 01285   428   NtOpenThreadTokenEx  (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN
 01286   428   NtOpenProcessTokenEx  (-1, 0x20008, 512, ... 244, ) == 0x0
 01287   428   NtQueryInformationToken  (244, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0
 01288   428   NtClose  (244, ... ) == 0x0
 01289   428   NtOpenKey  (0x2000000, {24, 0, 0x40, 0, 0,  (0x2000000, {24, 0, 0x40, 0, 0, "\REGISTRY\USER\S-1-5-21-1078081533-484763869-839522115-1003_Classes\Interface\{93F2F68C-1D1B-11D3-A30E-00C04F79ABD1}\ProxyStubClsid32"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01290   428   NtQueryValueKey  (238, 0x0, Partial, 144, ... TitleIdx=0, Type=1, Data= (238, 0x0, Partial, 144, ... TitleIdx=0, Type=1, Data="{\0b\0f\05\00\0b\06\08\0e\0-\02\09\0b\08\0-\04\03\08\06\0-\0a\0e\09\0c\0-\09\07\03\04\0d\05\01\01\07\0c\0d\05\0}\0\0\0"}, 90, ) }, 90, ) == 0x0
 01291   428   NtClose  (238, ... ) == 0x0
 01292   428   NtOpenKey  (0x1, {24, 28, 0x40, 0, 0,  (0x1, {24, 28, 0x40, 0, 0, "SOFTWARE\Microsoft\Windows\CurrentVersion\ShellCompatibility\Objects\{871C5380-42A0-1069-A2EA-08002B30309D}"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01293   428   NtQueryKey  (122, Name, 384, ... {Name= (122, Name, 384, ... {Name="\REGISTRY\USER\S-1-5-21-1078081533-484763869-839522115-1003_CLASSES"}, 138, ) }, 138, ) == 0x0
 01294   428   NtOpenKey  (0x1, {24, 122, 0x40, 0, 0,  (0x1, {24, 122, 0x40, 0, 0, "http"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01295   428   NtOpenKey  (0x1, {24, 0, 0x40, 0, 0,  (0x1, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Classes\http"}, ... 236, ) }, ... 236, ) == 0x0
 01296   428   NtQueryKey  (238, Name, 392, ... {Name= (238, Name, 392, ... {Name="\REGISTRY\MACHINE\SOFTWARE\Classes\httpo"}, 82, ) }, 82, ) == 0x0
 01297   428   NtOpenThreadTokenEx  (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN
 01298   428   NtOpenProcessTokenEx  (-1, 0x20008, 512, ... 244, ) == 0x0
 01299   428   NtQueryInformationToken  (244, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0
 01300   428   NtClose  (244, ... ) == 0x0
 01301   428   NtOpenKey  (0x2000000, {24, 0, 0x40, 0, 0,  (0x2000000, {24, 0, 0x40, 0, 0, "\REGISTRY\USER\S-1-5-21-1078081533-484763869-839522115-1003_Classes\http"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01302   428   NtQueryValueKey  (238,  (238, "ShellFolder", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01303   428   NtClose  (238, ... ) == 0x0
 01304   428   NtOpenKey  (0x2000000, {24, 28, 0x40, 0, 0,  (0x2000000, {24, 28, 0x40, 0, 0, "Software\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks"}, ... 236, ) }, ... 236, ) == 0x0
 01305   428   NtEnumerateValueKey  (236, 0, Full, 220, ... TitleIdx=0, Type=1, Name= (236, 0, Full, 220, ... TitleIdx=0, Type=1, Name="{AEB6717E-7E19-11d0-97EE-00C04FD91972}", Data="\0\0"}, 98, ) , Data= (236, 0, Full, 220, ... TitleIdx=0, Type=1, Name="{AEB6717E-7E19-11d0-97EE-00C04FD91972}", Data="\0\0"}, 98, ) }, 98, ) == 0x0
 01306   428   NtQueryKey  (122, Name, 384, ... {Name= (122, Name, 384, ... {Name="\REGISTRY\USER\S-1-5-21-1078081533-484763869-839522115-1003_CLASSESr"}, 138, ) }, 138, ) == 0x0
 01307   428   NtOpenKey  (0x1, {24, 122, 0x40, 0, 0,  (0x1, {24, 122, 0x40, 0, 0, "CLSID\{AEB6717E-7E19-11D0-97EE-00C04FD91972}\InProcServer32"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01308   428   NtOpenKey  (0x1, {24, 0, 0x40, 0, 0,  (0x1, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Classes\CLSID\{AEB6717E-7E19-11D0-97EE-00C04FD91972}\InProcServer32"}, ... 244, ) }, ... 244, ) == 0x0
 01309   428   NtQueryKey  (246, Name, 392, ... {Name= (246, Name, 392, ... {Name="\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{AEB6717E-7E19-11d0-97EE-00C04FD91972}\InProcServer32"}, 192, ) }, 192, ) == 0x0
 01310   428   NtOpenThreadTokenEx  (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN
 01311   428   NtOpenProcessTokenEx  (-1, 0x20008, 512, ... 248, ) == 0x0
 01312   428   NtQueryInformationToken  (248, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0
 01313   428   NtClose  (248, ... ) == 0x0
 01314   428   NtOpenKey  (0x2000000, {24, 0, 0x40, 0, 0,  (0x2000000, {24, 0, 0x40, 0, 0, "\REGISTRY\USER\S-1-5-21-1078081533-484763869-839522115-1003_Classes\CLSID\{AEB6717E-7E19-11d0-97EE-00C04FD91972}\InProcServer32"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01315   428   NtQueryValueKey  (246, 0x0, Partial, 144, ... TitleIdx=0, Type=1, Data= (246, 0x0, Partial, 144, ... TitleIdx=0, Type=1, Data="s\0h\0e\0l\0l\03\02\0.\0d\0l\0l\0\0\0"}, 36, ) }, 36, ) == 0x0
 01316   428   NtQueryKey  (246, Name, 392, ... {Name= (246, Name, 392, ... {Name="\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{AEB6717E-7E19-11d0-97EE-00C04FD91972}\InProcServer32"}, 192, ) }, 192, ) == 0x0
 01317   428   NtOpenThreadTokenEx  (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN
 01318   428   NtOpenProcessTokenEx  (-1, 0x20008, 512, ... 248, ) == 0x0
 01319   428   NtQueryInformationToken  (248, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0
 01320   428   NtClose  (248, ... ) == 0x0
 01321   428   NtOpenKey  (0x2000000, {24, 0, 0x40, 0, 0,  (0x2000000, {24, 0, 0x40, 0, 0, "\REGISTRY\USER\S-1-5-21-1078081533-484763869-839522115-1003_Classes\CLSID\{AEB6717E-7E19-11d0-97EE-00C04FD91972}\InProcServer32"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01322   428   NtQueryValueKey  (246,  (246, "LoadWithoutCOM", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01323   428   NtClose  (246, ... ) == 0x0
 01324   428   NtEnumerateValueKey  (236, 1, Full, 220, ... ) == STATUS_NO_MORE_ENTRIES
 01325   428   NtClose  (236, ... ) == 0x0
 01326   428   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers"}, ... 236, ) }, ... 236, ) == 0x0
 01327   428   NtQueryValueKey  (236,  (236, "TransparentEnabled", Full, 524, ... TitleIdx=0, Type=4, Name="TransparentEnabled", Data="\1\0\0\0"}, 60, ) , Full, 524, ... TitleIdx=0, Type=4, Name= (236, "TransparentEnabled", Full, 524, ... TitleIdx=0, Type=4, Name="TransparentEnabled", Data="\1\0\0\0"}, 60, ) , Data= (236, "TransparentEnabled", Full, 524, ... TitleIdx=0, Type=4, Name="TransparentEnabled", Data="\1\0\0\0"}, 60, ) }, 60, ) == 0x0
 01328   428   NtClose  (236, ... ) == 0x0
 01329   428   NtQueryInformationProcess  (-1, DefaultHardErrorMode, 4, ... {process info, class 12, size 4}, 0x0, ) == 0x0
 01330   428   NtSetInformationProcess  (-1, DefaultHardErrorMode, {process info, class 12, size 4}, 4, ... ) == 0x0
 01331   428   NtQueryAttributesFile  ({24, 12, 0x40, 0, 0,  ({24, 12, 0x40, 0, 0, "http:\www.whyusefirefox.com"}, 1239276, ... ) }, 1239276, ... ) == STATUS_OBJECT_PATH_SYNTAX_BAD
 01332   428   NtQueryInformationProcess  (-1, DefaultHardErrorMode, 4, ... {process info, class 12, size 4}, 0x0, ) == 0x0
 01333   428   NtSetInformationProcess  (-1, DefaultHardErrorMode, {process info, class 12, size 4}, 4, ... ) == 0x0
 01334   428   NtOpenKey  (0x1, {24, 28, 0x40, 0, 0,  (0x1, {24, 28, 0x40, 0, 0, "SOFTWARE\Microsoft\Windows\CurrentVersion\ShellCompatibility\Objects\{871C5380-42A0-1069-A2EA-08002B30309D}"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01335   428   NtQueryKey  (122, Name, 384, ... {Name= (122, Name, 384, ... {Name="\REGISTRY\USER\S-1-5-21-1078081533-484763869-839522115-1003_CLASSESC"}, 138, ) }, 138, ) == 0x0
 01336   428   NtOpenKey  (0x1, {24, 122, 0x40, 0, 0,  (0x1, {24, 122, 0x40, 0, 0, "CLSID\{871C5380-42A0-1069-A2EA-08002B30309D}\InProcServer32"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01337   428   NtOpenKey  (0x1, {24, 0, 0x40, 0, 0,  (0x1, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Classes\CLSID\{871C5380-42A0-1069-A2EA-08002B30309D}\InProcServer32"}, ... 236, ) }, ... 236, ) == 0x0
 01338   428   NtQueryKey  (238, Name, 392, ... {Name= (238, Name, 392, ... {Name="\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{871C5380-42A0-1069-A2EA-08002B30309D}\InProcServer32"}, 192, ) }, 192, ) == 0x0
 01339   428   NtOpenThreadTokenEx  (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN
 01340   428   NtOpenProcessTokenEx  (-1, 0x20008, 512, ... 244, ) == 0x0
 01341   428   NtQueryInformationToken  (244, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0
 01342   428   NtClose  (244, ... ) == 0x0
 01343   428   NtOpenKey  (0x2000000, {24, 0, 0x40, 0, 0,  (0x2000000, {24, 0, 0x40, 0, 0, "\REGISTRY\USER\S-1-5-21-1078081533-484763869-839522115-1003_Classes\CLSID\{871C5380-42A0-1069-A2EA-08002B30309D}\InProcServer32"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01344   428   NtQueryValueKey  (238, 0x0, Partial, 144, ... TitleIdx=0, Type=2, Data= (238, 0x0, Partial, 144, ... TitleIdx=0, Type=2, Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0s\0h\0d\0o\0c\0v\0w\0.\0d\0l\0l\0\0\0"}, 80, ) }, 80, ) == 0x0
 01345   428   NtQueryKey  (238, Name, 392, ... {Name= (238, Name, 392, ... {Name="\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{871C5380-42A0-1069-A2EA-08002B30309D}\InProcServer32"}, 192, ) }, 192, ) == 0x0
 01346   428   NtOpenThreadTokenEx  (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN
 01347   428   NtOpenProcessTokenEx  (-1, 0x20008, 512, ... 244, ) == 0x0
 01348   428   NtQueryInformationToken  (244, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0
 01349   428   NtClose  (244, ... ) == 0x0
 01350   428   NtOpenKey  (0x2000000, {24, 0, 0x40, 0, 0,  (0x2000000, {24, 0, 0x40, 0, 0, "\REGISTRY\USER\S-1-5-21-1078081533-484763869-839522115-1003_Classes\CLSID\{871C5380-42A0-1069-A2EA-08002B30309D}\InProcServer32"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01351   428   NtQueryValueKey  (238,  (238, "LoadWithoutCOM", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01352   428   NtClose  (238, ... ) == 0x0
 01353   428   NtReleaseSemaphore  (112, 1, ... 0, ) == 0x0
 01354   428   NtWaitForSingleObject  (112, 0, {0, 0}, ... ) == 0x0
 01355   428   NtOpenKey  (0x80000000, {24, 0, 0x40, 0, 0,  (0x80000000, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Classes\CLSID\{871c5380-42a0-1069-a2ea-08002b30309d}\InProcServer32"}, ... 236, ) }, ... 236, ) == 0x0
 01356   428   NtQueryValueKey  (236, " (236, "", Full, 520, ... TitleIdx=0, Type=2, Name="", Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0s\0h\0d\0o\0c\0v\0w\0.\0d\0l\0l\0\0\0"}, 88, )  (236, "", Full, 520, ... TitleIdx=0, Type=2, Name="", Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0s\0h\0d\0o\0c\0v\0w\0.\0d\0l\0l\0\0\0"}, 88, ) %\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0s\0h\0d\0o\0c\0v\0w\0.\0d\0l\0l\0\0\0"}, 88, ) == 0x0
 01357   428   NtClose  (236, ... ) == 0x0
 01358   428   NtOpenKey  (0x1, {24, 28, 0x40, 0, 0,  (0x1, {24, 28, 0x40, 0, 0, "SOFTWARE\Microsoft\Windows\CurrentVersion\ShellCompatibility\Objects\{871C5380-42A0-1069-A2EA-08002B30309D}"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01359   428   NtAllocateVirtualMemory  (-1, 1409024, 0, 4096, 4096, 4, ... 1409024, 4096, ) == 0x0
 01360   428   NtUserRegisterWindowMessage  ( ("UniformResourceLocator", ... ) , ... ) == 0xc0ab
 01361   428   NtUserRegisterWindowMessage  ( ("UniformResourceLocatorW", ... ) , ... ) == 0xc0cc
 01362   428   NtUserRegisterWindowMessage  ( ("FileGroupDescriptor", ... ) , ... ) == 0xc0a1
 01363   428   NtUserRegisterWindowMessage  ( ("FileContents", ... ) , ... ) == 0xc0a0
 01364   428   NtUserRegisterWindowMessage  ( ("Preferred DropEffect", ... ) , ... ) == 0xc0a7
 01365   428   NtUserRegisterWindowMessage  ( ("Performed DropEffect", ... ) , ... ) == 0xc0a8
 01366   428   NtUserRegisterWindowMessage  ( ("TargetCLSID", ... ) , ... ) == 0xc0ae
 01367   428   NtUserRegisterWindowMessage  ( ("Shell IDList Array", ... ) , ... ) == 0xc073
 01368   428   NtUserRegisterWindowMessage  ( ("FileGroupDescriptorW", ... ) , ... ) == 0xc0a2
 01369   428   NtAllocateVirtualMemory  (-1, 1413120, 0, 12288, 4096, 4, ... 1413120, 12288, ) == 0x0
 01370   428   NtUserCallNoParam  (1, ... ) == 0x3004d
 01371   428   NtOpenKey  (0x1, {24, 28, 0x40, 0, 0,  (0x1, {24, 28, 0x40, 0, 0, "Software\Microsoft\Internet Explorer\International"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01372   428   NtQueryDefaultUILanguage  (1239128, ...
 01373   428   NtOpenThreadTokenEx  (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN
 01374   428   NtOpenProcessTokenEx  (-1, 0x20008, 512, ... -2147482204, ) == 0x0
 01375   428   NtQueryInformationToken  (-2147482204, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0
 01376   428   NtClose  (-2147482204, ... ) == 0x0
 01377   428   NtOpenKey  (0x2000000, {24, 0, 0x640, 0, 0,  (0x2000000, {24, 0, 0x640, 0, 0, "\REGISTRY\USER\S-1-5-21-1078081533-484763869-839522115-1003"}, ... -2147482204, ) }, ... -2147482204, ) == 0x0
 01378   428   NtOpenKey  (0x80000000, {24, 0, 0x240, 0, 0,  (0x80000000, {24, 0, 0x240, 0, 0, "\Registry\Machine\System\CurrentControlSet\Control\Nls\MUILanguages"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01379   428   NtOpenKey  (0x80000000, {24, -2147482204, 0x640, 0, 0,  (0x80000000, {24, -2147482204, 0x640, 0, 0, "Control Panel\Desktop"}, ... -2147482208, ) }, ... -2147482208, ) == 0x0
 01380   428   NtQueryValueKey  (-2147482208,  (-2147482208, "MultiUILanguageId", Partial, 256, ... ) , Partial, 256, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01381   428   NtClose  (-2147482208, ... ) == 0x0
 01382   428   NtClose  (-2147482204, ... ) == 0x0
 01372   428   NtQueryDefaultUILanguage  ... ) == 0x0
 01383   428   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\System\CurrentControlSet\Control\Nls\MUILanguages"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01384   428   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\System32\shdoclc.dll"}, 1236320, ... ) }, 1236320, ... ) == 0x0
 01385   428   NtOpenFile  (0x100020, {24, 0, 0x40, 0, 0,  (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\System32\shdoclc.dll"}, 5, 96, ... 236, {status=0x0, info=1}, ) }, 5, 96, ... 236, {status=0x0, info=1}, ) == 0x0
 01386   428   NtCreateSection  (0xe, 0x0, 0x0, 16, 134217728, 236, ... 244, ) == 0x0
 01387   428   NtClose  (236, ... ) == 0x0
 01388   428   NtMapViewOfSection  (244, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 16, ... (0x8f0000), 0x0, 548864, ) == 0x0
 01389   428   NtClose  (244, ... ) == 0x0
 01390   428   NtUnmapViewOfSection  (-1, 0x8f0000, ... ) == 0x0
 01391   428   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\System32\shdoclc.dll"}, 1236636, ... ) }, 1236636, ... ) == 0x0
 01392   428   NtOpenFile  (0x100020, {24, 0, 0x40, 0, 0,  (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\System32\shdoclc.dll"}, 5, 96, ... 244, {status=0x0, info=1}, ) }, 5, 96, ... 244, {status=0x0, info=1}, ) == 0x0
 01393   428   NtCreateSection  (0xf, 0x0, 0x0, 16, 16777216, 244, ... 236, ) == 0x0
 01394   428   NtQuerySection  (236, Image, 48, ... {section info, class 1, size 48}, 0x0, ) == 0x0
 01395   428   NtClose  (244, ... ) == 0x0
 01396   428   NtMapViewOfSection  (236, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x76170000), 0x0, 557056, ) == 0x0
 01397   428   NtClose  (236, ... ) == 0x0
 01398   428   NtQueryDefaultLocale  (1, 1239936, ... ) == 0x0
 01399   428   NtUnmapViewOfSection  (-1, 0x76170000, ... ) == 0x0
 01400   428   NtUserThunkedMenuItemInfo  (196685, 0, 1024, 1, 1239992, 1240040, ...
 01401   428   NtAllocateVirtualMemory  (-1, 5476352, 0, 4096, 4096, 32, ... 5476352, 4096, ) == 0x0
 01400   428   NtUserThunkedMenuItemInfo  ... ) == 0x1
 01402   428   NtUserSetMenuDefaultItem  (196685, 0, 1024, ... ) == 0x1
 01403   428   NtOpenKey  (0x80000000, {24, 0, 0x40, 0, 0,  (0x80000000, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Classes\CLSID\{abbe31d0-6dae-11d0-beca-00c04fd940be}\InProcServer32"}, ... 236, ) }, ... 236, ) == 0x0
 01404   428   NtQueryValueKey  (236, " (236, "", Full, 520, ... TitleIdx=0, Type=2, Name="", Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0w\0e\0b\0c\0h\0e\0c\0k\0.\0d\0l\0l\0\0\0"}, 90, )  (236, "", Full, 520, ... TitleIdx=0, Type=2, Name="", Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0w\0e\0b\0c\0h\0e\0c\0k\0.\0d\0l\0l\0\0\0"}, 90, ) %\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0w\0e\0b\0c\0h\0e\0c\0k\0.\0d\0l\0l\0\0\0"}, 90, ) == 0x0
 01405   428   NtClose  (236, ... ) == 0x0
 01406   428   NtCreateFile  (0x80100080, {24, 0, 0x40, 0, 0,  (0x80100080, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\System32\webcheck.dll"}, 0x0, 128, 1, 1, 96, 0, 0, ... 236, {status=0x0, info=1}, ) }, 0x0, 128, 1, 1, 96, 0, 0, ... 236, {status=0x0, info=1}, ) == 0x0
 01407   428   NtQueryVolumeInformationFile  (236, 1240032, 8, Device, ... {status=0x0, info=8}, ) == 0x0
 01408   428   NtWaitForSingleObject  (124, 0, {-1000000, -1}, ... ) == 0x0
 01409   428   NtReleaseMutant  (124, ... 0x0, ) == 0x0
 01410   428   NtCreateFile  (0x80100080, {24, 0, 0x40, 0, 0,  (0x80100080, {24, 0, 0x40, 0, 0, "\SystemRoot\AppPatch\sysmain.sdb"}, 0x0, 128, 1, 1, 96, 0, 0, ... 244, {status=0x0, info=1}, ) }, 0x0, 128, 1, 1, 96, 0, 0, ... 244, {status=0x0, info=1}, ) == 0x0
 01411   428   NtQueryInformationFile  (244, 1239448, 24, Standard, ... {status=0x0, info=24}, ) == 0x0
 01412   428   NtCreateSection  (0x4, 0x0, 0x0, 2, 134217728, 244, ... 248, ) == 0x0
 01413   428   NtMapViewOfSection  (248, -1, (0x0), 0, 0, 0x0, 0, 2, 0, 2, ... (0x8f0000), 0x0, 1028096, ) == 0x0
 01414   428   NtQueryInformationFile  (244, 1239544, 24, Standard, ... {status=0x0, info=24}, ) == 0x0
 01415   428   NtCreateFile  (0x80100080, {24, 0, 0x40, 0, 0,  (0x80100080, {24, 0, 0x40, 0, 0, "\SystemRoot\AppPatch\systest.sdb"}, 0x0, 128, 1, 1, 96, 0, 0, ... ) }, 0x0, 128, 1, 1, 96, 0, 0, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01416   428   NtOpenFile  (0x100001, {24, 0, 0x40, 0, 0,  (0x100001, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\System32\"}, 3, 16417, ... 252, {status=0x0, info=1}, ) }, 3, 16417, ... 252, {status=0x0, info=1}, ) == 0x0
 01417   428   NtQueryDirectoryFile  (252, 0, 0, 0, 1236992, 616, BothDirectory, 1,  (252, 0, 0, 0, 1236992, 616, BothDirectory, 1, "webcheck.dll", 0, ... {status=0x0, info=118}, ) , 0, ... {status=0x0, info=118}, ) == 0x0
 01418   428   NtClose  (252, ... ) == 0x0
 01419   428   NtQueryInformationProcess  (-1, DefaultHardErrorMode, 4, ... {process info, class 12, size 4}, 0x0, ) == 0x0
 01420   428   NtSetInformationProcess  (-1, DefaultHardErrorMode, {process info, class 12, size 4}, 4, ... ) == 0x0
 01421   428   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\System32\webcheck.dll"}, 1236380, ... ) }, 1236380, ... ) == 0x0
 01422   428   NtOpenFile  (0x100001, {24, 0, 0x40, 0, 0,  (0x100001, {24, 0, 0x40, 0, 0, "\??\C:\"}, 3, 16417, ... 252, {status=0x0, info=1}, ) }, 3, 16417, ... 252, {status=0x0, info=1}, ) == 0x0
 01423   428   NtQueryDirectoryFile  (252, 0, 0, 0, 1235740, 616, BothDirectory, 1,  (252, 0, 0, 0, 1235740, 616, BothDirectory, 1, "WINDOWS", 0, ... {status=0x0, info=108}, ) , 0, ... {status=0x0, info=108}, ) == 0x0
 01424   428   NtClose  (252, ... ) == 0x0
 01425   428   NtOpenFile  (0x100001, {24, 0, 0x40, 0, 0,  (0x100001, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\"}, 3, 16417, ... 252, {status=0x0, info=1}, ) }, 3, 16417, ... 252, {status=0x0, info=1}, ) == 0x0
 01426   428   NtQueryDirectoryFile  (252, 0, 0, 0, 1235740, 616, BothDirectory, 1,  (252, 0, 0, 0, 1235740, 616, BothDirectory, 1, "System32", 0, ... {status=0x0, info=110}, ) , 0, ... {status=0x0, info=110}, ) == 0x0
 01427   428   NtClose  (252, ... ) == 0x0
 01428   428   NtOpenFile  (0x100001, {24, 0, 0x40, 0, 0,  (0x100001, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\System32\"}, 3, 16417, ... 252, {status=0x0, info=1}, ) }, 3, 16417, ... 252, {status=0x0, info=1}, ) == 0x0
 01429   428   NtQueryDirectoryFile  (252, 0, 0, 0, 1235740, 616, BothDirectory, 1,  (252, 0, 0, 0, 1235740, 616, BothDirectory, 1, "webcheck.dll", 0, ... {status=0x0, info=118}, ) , 0, ... {status=0x0, info=118}, ) == 0x0
 01430   428   NtClose  (252, ... ) == 0x0
 01431   428   NtQueryInformationProcess  (-1, DefaultHardErrorMode, 4, ... {process info, class 12, size 4}, 0x0, ) == 0x0
 01432   428   NtSetInformationProcess  (-1, DefaultHardErrorMode, {process info, class 12, size 4}, 4, ... ) == 0x0
 01433   428   NtQueryInformationProcess  (-1, DeviceMap, 36, ... {process info, class 23, size 36}, 0x0, ) == 0x0
 01434   428   NtOpenThreadTokenEx  (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN
 01435   428   NtOpenProcessTokenEx  (-1, 0x20008, 512, ... 252, ) == 0x0
 01436   428   NtQueryInformationToken  (252, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0
 01437   428   NtClose  (252, ... ) == 0x0
 01438   428   NtOpenKey  (0x80000100, {24, 0, 0x40, 0, 0,  (0x80000100, {24, 0, 0x40, 0, 0, "\REGISTRY\USER\S-1-5-21-1078081533-484763869-839522115-1003\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Layers"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01439   428   NtOpenKey  (0x80000100, {24, 0, 0x40, 0, 0,  (0x80000100, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Custom\webcheck.dll"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01440   428   NtWaitForSingleObject  (124, 0, {-1000000, -1}, ... ) == 0x0
 01441   428   NtQueryVolumeInformationFile  (236, 1240036, 8, Device, ... {status=0x0, info=8}, ) == 0x0
 01442   428   NtQueryInformationFile  (236, 1240016, 40, Basic, ... {status=0x0, info=40}, ) == 0x0
 01443   428   NtQueryInformationFile  (236, 1240056, 24, Standard, ... {status=0x0, info=24}, ) == 0x0
 01444   428   NtReleaseMutant  (124, ... 0x0, ) == 0x0
 01445   428   NtUnmapViewOfSection  (-1, 0x8f0000, ... ) == 0x0
 01446   428   NtClose  (248, ... ) == 0x0
 01447   428   NtClose  (244, ... ) == 0x0
 01448   428   NtClose  (236, ... ) == 0x0
 01449   428   NtOpenSection  (0x4, {24, 52, 0x2, 0, 0,  (0x4, {24, 52, 0x2, 0, 0, "Global\ComPlusCOMRegTable"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01450   428   NtOpenKey  (0x20019, {24, 28, 0x40, 0, 0,  (0x20019, {24, 28, 0x40, 0, 0, "Software\Microsoft\COM3"}, ... 236, ) }, ... 236, ) == 0x0
 01451   428   NtQueryValueKey  (236,  (236, "REGDBVersion", Partial, 144, ... TitleIdx=0, Type=3, Data="\7\0\0\0\0\0\0\0"}, 20, ) , Partial, 144, ... TitleIdx=0, Type=3, Data= (236, "REGDBVersion", Partial, 144, ... TitleIdx=0, Type=3, Data="\7\0\0\0\0\0\0\0"}, 20, ) }, 20, ) == 0x0
 01452   428   NtClose  (236, ... ) == 0x0
 01453   428   NtOpenSection  (0x4, {24, 52, 0x2, 0, 0,  (0x4, {24, 52, 0x2, 0, 0, "Global\ComPlusCOMRegTable"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01454   428   NtOpenKey  (0x20019, {24, 28, 0x40, 0, 0,  (0x20019, {24, 28, 0x40, 0, 0, "Software\Microsoft\COM3"}, ... 236, ) }, ... 236, ) == 0x0
 01455   428   NtQueryValueKey  (236,  (236, "REGDBVersion", Partial, 144, ... TitleIdx=0, Type=3, Data="\7\0\0\0\0\0\0\0"}, 20, ) , Partial, 144, ... TitleIdx=0, Type=3, Data= (236, "REGDBVersion", Partial, 144, ... TitleIdx=0, Type=3, Data="\7\0\0\0\0\0\0\0"}, 20, ) }, 20, ) == 0x0
 01456   428   NtClose  (236, ... ) == 0x0
 01457   428   NtQueryKey  (122, Name, 384, ... {Name= (122, Name, 384, ... {Name="\REGISTRY\USER\S-1-5-21-1078081533-484763869-839522115-1003_CLASSES\"}, 138, ) }, 138, ) == 0x0
 01458   428   NtOpenKey  (0x20019, {24, 122, 0x40, 0, 0,  (0x20019, {24, 122, 0x40, 0, 0, "CLSID\{ABBE31D0-6DAE-11D0-BECA-00C04FD940BE}"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01459   428   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Classes\CLSID\{ABBE31D0-6DAE-11D0-BECA-00C04FD940BE}"}, ... 236, ) }, ... 236, ) == 0x0
 01460   428   NtQueryKey  (238, Name, 384, ... {Name= (238, Name, 384, ... {Name="\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{ABBE31D0-6DAE-11D0-BECA-00C04FD940BE}0"}, 162, ) }, 162, ) == 0x0
 01461   428   NtOpenThreadTokenEx  (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN
 01462   428   NtOpenProcessTokenEx  (-1, 0x20008, 512, ... 244, ) == 0x0
 01463   428   NtQueryInformationToken  (244, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0
 01464   428   NtClose  (244, ... ) == 0x0
 01465   428   NtOpenKey  (0x1, {24, 0, 0x40, 0, 0,  (0x1, {24, 0, 0x40, 0, 0, "\REGISTRY\USER\S-1-5-21-1078081533-484763869-839522115-1003_Classes\CLSID\{ABBE31D0-6DAE-11D0-BECA-00C04FD940BE}\TreatAs"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01466   428   NtOpenKey  (0x1, {24, 238, 0x40, 0, 0,  (0x1, {24, 238, 0x40, 0, 0, "TreatAs"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01467   428   NtClose  (238, ... ) == 0x0
 01468   428   NtQueryKey  (122, Name, 384, ... {Name= (122, Name, 384, ... {Name="\REGISTRY\USER\S-1-5-21-1078081533-484763869-839522115-1003_CLASSES9"}, 138, ) }, 138, ) == 0x0
 01469   428   NtOpenKey  (0x20019, {24, 122, 0x40, 0, 0,  (0x20019, {24, 122, 0x40, 0, 0, "CLSID\{ABBE31D0-6DAE-11D0-BECA-00C04FD940BE}"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01470   428   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Classes\CLSID\{ABBE31D0-6DAE-11D0-BECA-00C04FD940BE}"}, ... 236, ) }, ... 236, ) == 0x0
 01471   428   NtQueryKey  (238, Name, 384, ... {Name= (238, Name, 384, ... {Name="\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{ABBE31D0-6DAE-11D0-BECA-00C04FD940BE}0"}, 162, ) }, 162, ) == 0x0
 01472   428   NtOpenThreadTokenEx  (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN
 01473   428   NtOpenProcessTokenEx  (-1, 0x20008, 512, ... 244, ) == 0x0
 01474   428   NtQueryInformationToken  (244, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0
 01475   428   NtClose  (244, ... ) == 0x0
 01476   428   NtOpenKey  (0x2000000, {24, 0, 0x40, 0, 0,  (0x2000000, {24, 0, 0x40, 0, 0, "\REGISTRY\USER\S-1-5-21-1078081533-484763869-839522115-1003_Classes\CLSID\{ABBE31D0-6DAE-11D0-BECA-00C04FD940BE}\InprocServer32"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01477   428   NtOpenKey  (0x2000000, {24, 238, 0x40, 0, 0,  (0x2000000, {24, 238, 0x40, 0, 0, "InprocServer32"}, ... 244, ) }, ... 244, ) == 0x0
 01478   428   NtQueryKey  (246, Name, 392, ... {Name= (246, Name, 392, ... {Name="\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{ABBE31D0-6DAE-11D0-BECA-00C04FD940BE}\InProcServer32"}, 192, ) }, 192, ) == 0x0
 01479   428   NtOpenThreadTokenEx  (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN
 01480   428   NtOpenProcessTokenEx  (-1, 0x20008, 512, ... 248, ) == 0x0
 01481   428   NtQueryInformationToken  (248, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0
 01482   428   NtClose  (248, ... ) == 0x0
 01483   428   NtOpenKey  (0x2000000, {24, 0, 0x40, 0, 0,  (0x2000000, {24, 0, 0x40, 0, 0, "\REGISTRY\USER\S-1-5-21-1078081533-484763869-839522115-1003_Classes\CLSID\{ABBE31D0-6DAE-11D0-BECA-00C04FD940BE}\InProcServer32"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01484   428   NtQueryValueKey  (246,  (246, "InprocServer32", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01485   428   NtClose  (246, ... ) == 0x0
 01486   428   NtQueryKey  (238, Name, 384, ... {Name= (238, Name, 384, ... {Name="\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{ABBE31D0-6DAE-11D0-BECA-00C04FD940BE}_"}, 162, ) }, 162, ) == 0x0
 01487   428   NtOpenThreadTokenEx  (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN
 01488   428   NtOpenProcessTokenEx  (-1, 0x20008, 512, ... 244, ) == 0x0
 01489   428   NtQueryInformationToken  (244, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0
 01490   428   NtClose  (244, ... ) == 0x0
 01491   428   NtOpenKey  (0x2000000, {24, 0, 0x40, 0, 0,  (0x2000000, {24, 0, 0x40, 0, 0, "\REGISTRY\USER\S-1-5-21-1078081533-484763869-839522115-1003_Classes\CLSID\{ABBE31D0-6DAE-11D0-BECA-00C04FD940BE}\InprocServerX86"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01492   428   NtOpenKey  (0x2000000, {24, 238, 0x40, 0, 0,  (0x2000000, {24, 238, 0x40, 0, 0, "InprocServerX86"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01493   428   NtQueryKey  (238, Name, 384, ... {Name= (238, Name, 384, ... {Name="\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{ABBE31D0-6DAE-11D0-BECA-00C04FD940BE}_"}, 162, ) }, 162, ) == 0x0
 01494   428   NtOpenThreadTokenEx  (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN
 01495   428   NtOpenProcessTokenEx  (-1, 0x20008, 512, ... 244, ) == 0x0
 01496   428   NtQueryInformationToken  (244, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0
 01497   428   NtClose  (244, ... ) == 0x0
 01498   428   NtOpenKey  (0x2000000, {24, 0, 0x40, 0, 0,  (0x2000000, {24, 0, 0x40, 0, 0, "\REGISTRY\USER\S-1-5-21-1078081533-484763869-839522115-1003_Classes\CLSID\{ABBE31D0-6DAE-11D0-BECA-00C04FD940BE}\LocalServer32"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01499   428   NtOpenKey  (0x2000000, {24, 238, 0x40, 0, 0,  (0x2000000, {24, 238, 0x40, 0, 0, "LocalServer32"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01500   428   NtQueryKey  (238, Name, 384, ... {Name= (238, Name, 384, ... {Name="\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{ABBE31D0-6DAE-11D0-BECA-00C04FD940BE}_"}, 162, ) }, 162, ) == 0x0
 01501   428   NtOpenThreadTokenEx  (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN
 01502   428   NtOpenProcessTokenEx  (-1, 0x20008, 512, ... 244, ) == 0x0
 01503   428   NtQueryInformationToken  (244, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0
 01504   428   NtClose  (244, ... ) == 0x0
 01505   428   NtOpenKey  (0x2000000, {24, 0, 0x40, 0, 0,  (0x2000000, {24, 0, 0x40, 0, 0, "\REGISTRY\USER\S-1-5-21-1078081533-484763869-839522115-1003_Classes\CLSID\{ABBE31D0-6DAE-11D0-BECA-00C04FD940BE}\InprocServer32"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01506   428   NtOpenKey  (0x2000000, {24, 238, 0x40, 0, 0,  (0x2000000, {24, 238, 0x40, 0, 0, "InprocServer32"}, ... 244, ) }, ... 244, ) == 0x0
 01507   428   NtQueryKey  (246, Name, 392, ... {Name= (246, Name, 392, ... {Name="\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{ABBE31D0-6DAE-11D0-BECA-00C04FD940BE}\InProcServer32"}, 192, ) }, 192, ) == 0x0
 01508   428   NtOpenThreadTokenEx  (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN
 01509   428   NtOpenProcessTokenEx  (-1, 0x20008, 512, ... 248, ) == 0x0
 01510   428   NtQueryInformationToken  (248, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0
 01511   428   NtClose  (248, ... ) == 0x0
 01512   428   NtOpenKey  (0x2000000, {24, 0, 0x40, 0, 0,  (0x2000000, {24, 0, 0x40, 0, 0, "\REGISTRY\USER\S-1-5-21-1078081533-484763869-839522115-1003_Classes\CLSID\{ABBE31D0-6DAE-11D0-BECA-00C04FD940BE}\InProcServer32"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01513   428   NtQueryValueKey  (246, 0x0, Partial, 144, ... TitleIdx=0, Type=2, Data= (246, 0x0, Partial, 144, ... TitleIdx=0, Type=2, Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0w\0e\0b\0c\0h\0e\0c\0k\0.\0d\0l\0l\0\0\0"}, 82, ) }, 82, ) == 0x0
 01514   428   NtClose  (246, ... ) == 0x0
 01515   428   NtQueryKey  (238, Name, 384, ... {Name= (238, Name, 384, ... {Name="\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{ABBE31D0-6DAE-11D0-BECA-00C04FD940BE}_"}, 162, ) }, 162, ) == 0x0
 01516   428   NtOpenThreadTokenEx  (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN
 01517   428   NtOpenProcessTokenEx  (-1, 0x20008, 512, ... 244, ) == 0x0
 01518   428   NtQueryInformationToken  (244, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0
 01519   428   NtClose  (244, ... ) == 0x0
 01520   428   NtOpenKey  (0x2000000, {24, 0, 0x40, 0, 0,  (0x2000000, {24, 0, 0x40, 0, 0, "\REGISTRY\USER\S-1-5-21-1078081533-484763869-839522115-1003_Classes\CLSID\{ABBE31D0-6DAE-11D0-BECA-00C04FD940BE}\InprocHandler32"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01521   428   NtOpenKey  (0x2000000, {24, 238, 0x40, 0, 0,  (0x2000000, {24, 238, 0x40, 0, 0, "InprocHandler32"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01522   428   NtQueryKey  (238, Name, 384, ... {Name= (238, Name, 384, ... {Name="\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{ABBE31D0-6DAE-11D0-BECA-00C04FD940BE}_"}, 162, ) }, 162, ) == 0x0
 01523   428   NtOpenThreadTokenEx  (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN
 01524   428   NtOpenProcessTokenEx  (-1, 0x20008, 512, ... 244, ) == 0x0
 01525   428   NtQueryInformationToken  (244, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0
 01526   428   NtClose  (244, ... ) == 0x0
 01527   428   NtOpenKey  (0x2000000, {24, 0, 0x40, 0, 0,  (0x2000000, {24, 0, 0x40, 0, 0, "\REGISTRY\USER\S-1-5-21-1078081533-484763869-839522115-1003_Classes\CLSID\{ABBE31D0-6DAE-11D0-BECA-00C04FD940BE}\InprocHandlerX86"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01528   428   NtOpenKey  (0x2000000, {24, 238, 0x40, 0, 0,  (0x2000000, {24, 238, 0x40, 0, 0, "InprocHandlerX86"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01529   428   NtQueryKey  (238, Name, 384, ... {Name= (238, Name, 384, ... {Name="\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{ABBE31D0-6DAE-11D0-BECA-00C04FD940BE}_"}, 162, ) }, 162, ) == 0x0
 01530   428   NtOpenThreadTokenEx  (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN
 01531   428   NtOpenProcessTokenEx  (-1, 0x20008, 512, ... 244, ) == 0x0
 01532   428   NtQueryInformationToken  (244, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0
 01533   428   NtClose  (244, ... ) == 0x0
 01534   428   NtOpenKey  (0x2000000, {24, 0, 0x40, 0, 0,  (0x2000000, {24, 0, 0x40, 0, 0, "\REGISTRY\USER\S-1-5-21-1078081533-484763869-839522115-1003_Classes\CLSID\{ABBE31D0-6DAE-11D0-BECA-00C04FD940BE}\LocalServer32"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01535   428   NtOpenKey  (0x2000000, {24, 238, 0x40, 0, 0,  (0x2000000, {24, 238, 0x40, 0, 0, "LocalServer32"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01536   428   NtQueryKey  (238, Name, 384, ... {Name= (238, Name, 384, ... {Name="\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{ABBE31D0-6DAE-11D0-BECA-00C04FD940BE}_"}, 162, ) }, 162, ) == 0x0
 01537   428   NtOpenThreadTokenEx  (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN
 01538   428   NtOpenProcessTokenEx  (-1, 0x20008, 512, ... 244, ) == 0x0
 01539   428   NtQueryInformationToken  (244, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0
 01540   428   NtClose  (244, ... ) == 0x0
 01541   428   NtOpenKey  (0x2000000, {24, 0, 0x40, 0, 0,  (0x2000000, {24, 0, 0x40, 0, 0, "\REGISTRY\USER\S-1-5-21-1078081533-484763869-839522115-1003_Classes\CLSID\{ABBE31D0-6DAE-11D0-BECA-00C04FD940BE}\LocalServer"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01542   428   NtOpenKey  (0x2000000, {24, 238, 0x40, 0, 0,  (0x2000000, {24, 238, 0x40, 0, 0, "LocalServer"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01543   428   NtQueryKey  (122, Name, 384, ... {Name= (122, Name, 384, ... {Name="\REGISTRY\USER\S-1-5-21-1078081533-484763869-839522115-1003_CLASSES9"}, 138, ) }, 138, ) == 0x0
 01544   428   NtOpenKey  (0x20019, {24, 122, 0x40, 0, 0,  (0x20019, {24, 122, 0x40, 0, 0, "CLSID\{ABBE31D0-6DAE-11D0-BECA-00C04FD940BE}"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01545   428   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Classes\CLSID\{ABBE31D0-6DAE-11D0-BECA-00C04FD940BE}"}, ... 244, ) }, ... 244, ) == 0x0
 01546   428   NtQueryKey  (246, Name, 392, ... {Name= (246, Name, 392, ... {Name="\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{ABBE31D0-6DAE-11D0-BECA-00C04FD940BE}0"}, 162, ) }, 162, ) == 0x0
 01547   428   NtOpenThreadTokenEx  (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN
 01548   428   NtOpenProcessTokenEx  (-1, 0x20008, 512, ... 248, ) == 0x0
 01549   428   NtQueryInformationToken  (248, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0
 01550   428   NtClose  (248, ... ) == 0x0
 01551   428   NtOpenKey  (0x2000000, {24, 0, 0x40, 0, 0,  (0x2000000, {24, 0, 0x40, 0, 0, "\REGISTRY\USER\S-1-5-21-1078081533-484763869-839522115-1003_Classes\CLSID\{ABBE31D0-6DAE-11D0-BECA-00C04FD940BE}"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01552   428   NtQueryValueKey  (246,  (246, "AppID", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01553   428   NtClose  (246, ... ) == 0x0
 01554   428   NtClose  (238, ... ) == 0x0
 01555   428   NtOpenProcess  (0x400, {24, 0, 0x0, 0, 0, 0x0}, {420, 0}, ... 236, ) == 0x0
 01556   428   NtQueryInformationProcess  (236, Session, 4, ... {SessionId=0,}, 0x0, ) == 0x0
 01557   428   NtClose  (236, ... ) == 0x0
 01558   428   NtQueryKey  (122, Name, 384, ... {Name= (122, Name, 384, ... {Name="\REGISTRY\USER\S-1-5-21-1078081533-484763869-839522115-1003_CLASSES9"}, 138, ) }, 138, ) == 0x0
 01559   428   NtOpenKey  (0x20019, {24, 122, 0x40, 0, 0,  (0x20019, {24, 122, 0x40, 0, 0, "CLSID\{ABBE31D0-6DAE-11D0-BECA-00C04FD940BE}"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01560   428   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Classes\CLSID\{ABBE31D0-6DAE-11D0-BECA-00C04FD940BE}"}, ... 236, ) }, ... 236, ) == 0x0
 01561   428   NtQueryKey  (238, Name, 384, ... {Name= (238, Name, 384, ... {Name="\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{ABBE31D0-6DAE-11D0-BECA-00C04FD940BE}0"}, 162, ) }, 162, ) == 0x0
 01562   428   NtOpenThreadTokenEx  (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN
 01563   428   NtOpenProcessTokenEx  (-1, 0x20008, 512, ... 244, ) == 0x0
 01564   428   NtQueryInformationToken  (244, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0
 01565   428   NtClose  (244, ... ) == 0x0
 01566   428   NtOpenKey  (0x2000000, {24, 0, 0x40, 0, 0,  (0x2000000, {24, 0, 0x40, 0, 0, "\REGISTRY\USER\S-1-5-21-1078081533-484763869-839522115-1003_Classes\CLSID\{ABBE31D0-6DAE-11D0-BECA-00C04FD940BE}\InprocServer32"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01567   428   NtOpenKey  (0x2000000, {24, 238, 0x40, 0, 0,  (0x2000000, {24, 238, 0x40, 0, 0, "InprocServer32"}, ... 244, ) }, ... 244, ) == 0x0
 01568   428   NtQueryKey  (246, Name, 392, ... {Name= (246, Name, 392, ... {Name="\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{ABBE31D0-6DAE-11D0-BECA-00C04FD940BE}\InProcServer32"}, 192, ) }, 192, ) == 0x0
 01569   428   NtOpenThreadTokenEx  (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN
 01570   428   NtOpenProcessTokenEx  (-1, 0x20008, 512, ... 248, ) == 0x0
 01571   428   NtQueryInformationToken  (248, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0
 01572   428   NtClose  (248, ... ) == 0x0
 01573   428   NtOpenKey  (0x2000000, {24, 0, 0x40, 0, 0,  (0x2000000, {24, 0, 0x40, 0, 0, "\REGISTRY\USER\S-1-5-21-1078081533-484763869-839522115-1003_Classes\CLSID\{ABBE31D0-6DAE-11D0-BECA-00C04FD940BE}\InProcServer32"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01574   428   NtQueryValueKey  (246,  (246, "ThreadingModel", Partial, 144, ... TitleIdx=0, Type=1, Data="A\0p\0a\0r\0t\0m\0e\0n\0t\0\0\0"}, 32, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (246, "ThreadingModel", Partial, 144, ... TitleIdx=0, Type=1, Data="A\0p\0a\0r\0t\0m\0e\0n\0t\0\0\0"}, 32, ) }, 32, ) == 0x0
 01575   428   NtClose  (246, ... ) == 0x0
 01576   428   NtClose  (238, ... ) == 0x0
 01577   428   NtQueryKey  (122, Name, 384, ... {Name= (122, Name, 384, ... {Name="\REGISTRY\USER\S-1-5-21-1078081533-484763869-839522115-1003_CLASSES9"}, 138, ) }, 138, ) == 0x0
 01578   428   NtOpenKey  (0x20019, {24, 122, 0x40, 0, 0,  (0x20019, {24, 122, 0x40, 0, 0, "CLSID\{ABBE31D0-6DAE-11D0-BECA-00C04FD940BE}"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01579   428   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Classes\CLSID\{ABBE31D0-6DAE-11D0-BECA-00C04FD940BE}"}, ... 236, ) }, ... 236, ) == 0x0
 01580   428   NtQueryKey  (238, Name, 384, ... {Name= (238, Name, 384, ... {Name="\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{ABBE31D0-6DAE-11D0-BECA-00C04FD940BE}0"}, 162, ) }, 162, ) == 0x0
 01581   428   NtOpenThreadTokenEx  (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN
 01582   428   NtOpenProcessTokenEx  (-1, 0x20008, 512, ... 244, ) == 0x0
 01583   428   NtQueryInformationToken  (244, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0
 01584   428   NtClose  (244, ... ) == 0x0
 01585   428   NtOpenKey  (0x1, {24, 0, 0x40, 0, 0,  (0x1, {24, 0, 0x40, 0, 0, "\REGISTRY\USER\S-1-5-21-1078081533-484763869-839522115-1003_Classes\CLSID\{ABBE31D0-6DAE-11D0-BECA-00C04FD940BE}\TreatAs"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01586   428   NtOpenKey  (0x1, {24, 238, 0x40, 0, 0,  (0x1, {24, 238, 0x40, 0, 0, "TreatAs"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01587   428   NtClose  (238, ... ) == 0x0
 01588   428   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\System32\webcheck.dll"}, 1234204, ... ) }, 1234204, ... ) == 0x0
 01589   428   NtOpenFile  (0x100020, {24, 0, 0x40, 0, 0,  (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\System32\webcheck.dll"}, 5, 96, ... 236, {status=0x0, info=1}, ) }, 5, 96, ... 236, {status=0x0, info=1}, ) == 0x0
 01590   428   NtCreateSection  (0xe, 0x0, 0x0, 16, 134217728, 236, ... 244, ) == 0x0
 01591   428   NtClose  (236, ... ) == 0x0
 01592   428   NtMapViewOfSection  (244, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 16, ... (0x8f0000), 0x0, 262144, ) == 0x0
 01593   428   NtClose  (244, ... ) == 0x0
 01594   428   NtUnmapViewOfSection  (-1, 0x8f0000, ... ) == 0x0
 01595   428   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\System32\webcheck.dll"}, 1234520, ... ) }, 1234520, ... ) == 0x0
 01596   428   NtOpenFile  (0x100020, {24, 0, 0x40, 0, 0,  (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\System32\webcheck.dll"}, 5, 96, ... 244, {status=0x0, info=1}, ) }, 5, 96, ... 244, {status=0x0, info=1}, ) == 0x0
 01597   428   NtCreateSection  (0xf, 0x0, 0x0, 16, 16777216, 244, ... 236, ) == 0x0
 01598   428   NtQuerySection  (236, Image, 48, ... {section info, class 1, size 48}, 0x0, ) == 0x0
 01599   428   NtClose  (244, ... ) == 0x0
 01600   428   NtMapViewOfSection  (236, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x74b30000), 0x0, 266240, ) == 0x0
 01601   428   NtClose  (236, ... ) == 0x0
 01602   428   NtQueryDefaultUILanguage  (1232736, ...
 01603   428   NtOpenThreadTokenEx  (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN
 01604   428   NtOpenProcessTokenEx  (-1, 0x20008, 512, ... -2147482204, ) == 0x0
 01605   428   NtQueryInformationToken  (-2147482204, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0
 01606   428   NtClose  (-2147482204, ... ) == 0x0
 01607   428   NtOpenKey  (0x2000000, {24, 0, 0x640, 0, 0,  (0x2000000, {24, 0, 0x640, 0, 0, "\REGISTRY\USER\S-1-5-21-1078081533-484763869-839522115-1003"}, ... -2147482204, ) }, ... -2147482204, ) == 0x0
 01608   428   NtOpenKey  (0x80000000, {24, 0, 0x240, 0, 0,  (0x80000000, {24, 0, 0x240, 0, 0, "\Registry\Machine\System\CurrentControlSet\Control\Nls\MUILanguages"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01609   428   NtOpenKey  (0x80000000, {24, -2147482204, 0x640, 0, 0,  (0x80000000, {24, -2147482204, 0x640, 0, 0, "Control Panel\Desktop"}, ... -2147482208, ) }, ... -2147482208, ) == 0x0
 01610   428   NtQueryValueKey  (-2147482208,  (-2147482208, "MultiUILanguageId", Partial, 256, ... ) , Partial, 256, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01611   428   NtClose  (-2147482208, ... ) == 0x0
 01612   428   NtClose  (-2147482204, ... ) == 0x0
 01602   428   NtQueryDefaultUILanguage  ... ) == 0x0
 01613   428   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\System\CurrentControlSet\Control\Nls\MUILanguages"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01614   428   NtOpenFile  (0x1200a9, {24, 0, 0x40, 0, 0,  (0x1200a9, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\System32\webcheck.dll"}, 1, 96, ... 236, {status=0x0, info=1}, ) }, 1, 96, ... 236, {status=0x0, info=1}, ) == 0x0
 01615   428   NtCreateSection  (0x4, 0x0, 0x0, 2, 134217728, 236, ... 244, ) == 0x0
 01616   428   NtMapViewOfSection  (244, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 2, ... (0x8f0000), 0x0, 262144, ) == 0x0
 01617   428   NtOpenFile  (0x1200a9, {24, 0, 0x40, 0, 0,  (0x1200a9, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\System32\webcheck.dll.123.Manifest"}, 1, 96, ... ) }, 1, 96, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01618   428   NtQueryDefaultLocale  (1, 1230772, ... ) == 0x0
 01619   428   NtOpenFile  (0x1200a9, {24, 0, 0x40, 0, 0,  (0x1200a9, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\System32\webcheck.dll.123.Config"}, 1, 96, ... ) }, 1, 96, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01620   428   NtRequestWaitReplyPort  (24, {128, 156, new_msg, 0, 1231628, 1, 96, 0}  (24, {128, 156, new_msg, 0, 1231628, 1, 96, 0} "\210\6\31\1\33\0\1\0\0\0\0\0\1\316\22\0\1\0\0\0\0\0\11\4\1\1\1\0@\0D\0\250\6\31\1\354\0\0\0\377\377\377\377\0\0\0\08\213\221\0\0\0\0\0\266\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0(\0,\0\354\6\31\1\0\0\0\0\0\0\0\0\14\322\22\0\0\0\0\0" ... {128, 156, reply, 0, 420, 428, 1455, 0} " S\26\0\33\0\1\0\0\0\0\0\1\316\22\0\1\0\0\0\0\0\11\4\1\1\1\0@\0D\0\250\6\31\1\354\0\0\0\377\377\377\377\0\0\0\08\213\221\0\0\0\0\0\266\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0(\0,\0\354\6\31\1\0\0\0\0\0\0\0\0\14\322\22\0\0\0\0\0" )  ... {128, 156, reply, 0, 420, 428, 1455, 0}  (24, {128, 156, new_msg, 0, 1231628, 1, 96, 0} "\210\6\31\1\33\0\1\0\0\0\0\0\1\316\22\0\1\0\0\0\0\0\11\4\1\1\1\0@\0D\0\250\6\31\1\354\0\0\0\377\377\377\377\0\0\0\08\213\221\0\0\0\0\0\266\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0(\0,\0\354\6\31\1\0\0\0\0\0\0\0\0\14\322\22\0\0\0\0\0" ... {128, 156, reply, 0, 420, 428, 1455, 0} " S\26\0\33\0\1\0\0\0\0\0\1\316\22\0\1\0\0\0\0\0\11\4\1\1\1\0@\0D\0\250\6\31\1\354\0\0\0\377\377\377\377\0\0\0\08\213\221\0\0\0\0\0\266\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0(\0,\0\354\6\31\1\0\0\0\0\0\0\0\0\14\322\22\0\0\0\0\0" )  ) == 0x0
 01621   428   NtClose  (236, ... ) == 0x0
 01622   428   NtClose  (244, ... ) == 0x0
 01623   428   NtUnmapViewOfSection  (-1, 0x8f0000, ... ) == 0x0
 01624   428   NtUnmapViewOfSection  (-1, 0x12d20c, ... ) == STATUS_NOT_MAPPED_VIEW
 01625   428   NtQueryDebugFilterState  (53, 2, ... ) == 0x0
 01626   428   NtOpenKey  (0x8, {24, 0, 0x40, 0, 0,  (0x8, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows\CurrentVersion\SideBySide\AssemblyStorageRoots"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01627   428   NtQueryDebugFilterState  (53, 2, ... ) == 0x0
 01628   428   NtQueryDebugFilterState  (53, 2, ... ) == 0x0
 01629   428   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\u:\work\packed.exe.Local\"}, 1229312, ... ) }, 1229312, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01630   428   NtQueryDebugFilterState  (53, 2, ... ) == 0x0
 01631   428   NtQueryDebugFilterState  (53, 2, ... ) == 0x0
 01632   428   NtQueryDebugFilterState  (53, 2, ... ) == 0x0
 01633   428   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.0.0_x-ww_1382d70a"}, 1229904, ... ) }, 1229904, ... ) == 0x0
 01634   428   NtOpenFile  (0x100020, {24, 0, 0x40, 0, 0,  (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.0.0_x-ww_1382d70a"}, 3, 33, ... 244, {status=0x0, info=1}, ) }, 3, 33, ... 244, {status=0x0, info=1}, ) == 0x0
 01635   428   NtQueryDebugFilterState  (53, 2, ... ) == 0x0
 01636   428   NtQueryKey  (122, Name, 384, ... {Name= (122, Name, 384, ... {Name="\REGISTRY\USER\S-1-5-21-1078081533-484763869-839522115-1003_CLASSES"}, 138, ) }, 138, ) == 0x0
 01637   428   NtOpenKey  (0x1, {24, 122, 0x40, 0, 0,  (0x1, {24, 122, 0x40, 0, 0, "CLSID\{FBF23B40-E3F0-101B-8488-00AA003E56F8}\InProcServer32"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01638   428   NtOpenKey  (0x1, {24, 0, 0x40, 0, 0,  (0x1, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Classes\CLSID\{FBF23B40-E3F0-101B-8488-00AA003E56F8}\InProcServer32"}, ... 236, ) }, ... 236, ) == 0x0
 01639   428   NtQueryKey  (238, Name, 392, ... {Name= (238, Name, 392, ... {Name="\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{FBF23B40-E3F0-101B-8488-00AA003E56F8}\InProcServer32"}, 192, ) }, 192, ) == 0x0
 01640   428   NtOpenThreadTokenEx  (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN
 01641   428   NtOpenProcessTokenEx  (-1, 0x20008, 512, ... 248, ) == 0x0
 01642   428   NtQueryInformationToken  (248, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0
 01643   428   NtClose  (248, ... ) == 0x0
 01644   428   NtOpenKey  (0x2000000, {24, 0, 0x40, 0, 0,  (0x2000000, {24, 0, 0x40, 0, 0, "\REGISTRY\USER\S-1-5-21-1078081533-484763869-839522115-1003_Classes\CLSID\{FBF23B40-E3F0-101B-8488-00AA003E56F8}\InProcServer32"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01645   428   NtQueryValueKey  (238, 0x0, Partial, 144, ... TitleIdx=0, Type=1, Data= (238, 0x0, Partial, 144, ... TitleIdx=0, Type=1, Data="s\0h\0d\0o\0c\0v\0w\0.\0d\0l\0l\0\0\0"}, 36, ) }, 36, ) == 0x0
 01646   428   NtQueryKey  (238, Name, 392, ... {Name= (238, Name, 392, ... {Name="\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{FBF23B40-E3F0-101B-8488-00AA003E56F8}\InProcServer32"}, 192, ) }, 192, ) == 0x0
 01647   428   NtOpenThreadTokenEx  (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN
 01648   428   NtOpenProcessTokenEx  (-1, 0x20008, 512, ... 248, ) == 0x0
 01649   428   NtQueryInformationToken  (248, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0
 01650   428   NtClose  (248, ... ) == 0x0
 01651   428   NtOpenKey  (0x2000000, {24, 0, 0x40, 0, 0,  (0x2000000, {24, 0, 0x40, 0, 0, "\REGISTRY\USER\S-1-5-21-1078081533-484763869-839522115-1003_Classes\CLSID\{FBF23B40-E3F0-101B-8488-00AA003E56F8}\InProcServer32"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01652   428   NtQueryValueKey  (238,  (238, "LoadWithoutCOM", Partial, 144, ... TitleIdx=0, Type=1, Data="\0\0"}, 14, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (238, "LoadWithoutCOM", Partial, 144, ... TitleIdx=0, Type=1, Data="\0\0"}, 14, ) }, 14, ) == 0x0
 01653   428   NtClose  (238, ... ) == 0x0
 01654   428   NtOpenKey  (0x80000000, {24, 0, 0x40, 0, 0,  (0x80000000, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Classes\CLSID\{fbf23b40-e3f0-101b-8488-00aa003e56f8}\InProcServer32"}, ... 236, ) }, ... 236, ) == 0x0
 01655   428   NtQueryValueKey  (236, " (236, "", Full, 520, ... TitleIdx=0, Type=1, Name="", Data="s\0h\0d\0o\0c\0v\0w\0.\0d\0l\0l\0\0\0"}, 44, )  (236, "", Full, 520, ... TitleIdx=0, Type=1, Name="", Data="s\0h\0d\0o\0c\0v\0w\0.\0d\0l\0l\0\0\0"}, 44, ) s\0h\0d\0o\0c\0v\0w\0.\0d\0l\0l\0\0\0"}, 44, ) == 0x0
 01656   428   NtClose  (236, ... ) == 0x0
 01657   428   NtOpenSection  (0x4, {24, 52, 0x2, 0, 0,  (0x4, {24, 52, 0x2, 0, 0, "Global\ComPlusCOMRegTable"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01658   428   NtOpenKey  (0x20019, {24, 28, 0x40, 0, 0,  (0x20019, {24, 28, 0x40, 0, 0, "Software\Microsoft\COM3"}, ... 236, ) }, ... 236, ) == 0x0
 01659   428   NtQueryValueKey  (236,  (236, "REGDBVersion", Partial, 144, ... TitleIdx=0, Type=3, Data="\7\0\0\0\0\0\0\0"}, 20, ) , Partial, 144, ... TitleIdx=0, Type=3, Data= (236, "REGDBVersion", Partial, 144, ... TitleIdx=0, Type=3, Data="\7\0\0\0\0\0\0\0"}, 20, ) }, 20, ) == 0x0
 01660   428   NtClose  (236, ... ) == 0x0
 01661   428   NtOpenSection  (0x4, {24, 52, 0x2, 0, 0,  (0x4, {24, 52, 0x2, 0, 0, "Global\ComPlusCOMRegTable"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01662   428   NtOpenKey  (0x20019, {24, 28, 0x40, 0, 0,  (0x20019, {24, 28, 0x40, 0, 0, "Software\Microsoft\COM3"}, ... 236, ) }, ... 236, ) == 0x0
 01663   428   NtQueryValueKey  (236,  (236, "REGDBVersion", Partial, 144, ... TitleIdx=0, Type=3, Data="\7\0\0\0\0\0\0\0"}, 20, ) , Partial, 144, ... TitleIdx=0, Type=3, Data= (236, "REGDBVersion", Partial, 144, ... TitleIdx=0, Type=3, Data="\7\0\0\0\0\0\0\0"}, 20, ) }, 20, ) == 0x0
 01664   428   NtClose  (236, ... ) == 0x0
 01665   428   NtQueryKey  (122, Name, 384, ... {Name= (122, Name, 384, ... {Name="\REGISTRY\USER\S-1-5-21-1078081533-484763869-839522115-1003_CLASSESb"}, 138, ) }, 138, ) == 0x0
 01666   428   NtOpenKey  (0x20019, {24, 122, 0x40, 0, 0,  (0x20019, {24, 122, 0x40, 0, 0, "CLSID\{FBF23B40-E3F0-101B-8488-00AA003E56F8}"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01667   428   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Classes\CLSID\{FBF23B40-E3F0-101B-8488-00AA003E56F8}"}, ... 236, ) }, ... 236, ) == 0x0
 01668   428   NtQueryKey  (238, Name, 384, ... {Name= (238, Name, 384, ... {Name="\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{FBF23B40-E3F0-101B-8488-00AA003E56F8}B"}, 162, ) }, 162, ) == 0x0
 01669   428   NtOpenThreadTokenEx  (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN
 01670   428   NtOpenProcessTokenEx  (-1, 0x20008, 512, ... 248, ) == 0x0
 01671   428   NtQueryInformationToken  (248, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0
 01672   428   NtClose  (248, ... ) == 0x0
 01673   428   NtOpenKey  (0x1, {24, 0, 0x40, 0, 0,  (0x1, {24, 0, 0x40, 0, 0, "\REGISTRY\USER\S-1-5-21-1078081533-484763869-839522115-1003_Classes\CLSID\{FBF23B40-E3F0-101B-8488-00AA003E56F8}\TreatAs"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01674   428   NtOpenKey  (0x1, {24, 238, 0x40, 0, 0,  (0x1, {24, 238, 0x40, 0, 0, "TreatAs"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01675   428   NtClose  (238, ... ) == 0x0
 01676   428   NtQueryKey  (122, Name, 384, ... {Name= (122, Name, 384, ... {Name="\REGISTRY\USER\S-1-5-21-1078081533-484763869-839522115-1003_CLASSES9"}, 138, ) }, 138, ) == 0x0
 01677   428   NtOpenKey  (0x20019, {24, 122, 0x40, 0, 0,  (0x20019, {24, 122, 0x40, 0, 0, "CLSID\{FBF23B40-E3F0-101B-8488-00AA003E56F8}"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01678   428   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Classes\CLSID\{FBF23B40-E3F0-101B-8488-00AA003E56F8}"}, ... 236, ) }, ... 236, ) == 0x0
 01679   428   NtQueryKey  (238, Name, 384, ... {Name= (238, Name, 384, ... {Name="\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{FBF23B40-E3F0-101B-8488-00AA003E56F8}B"}, 162, ) }, 162, ) == 0x0
 01680   428   NtOpenThreadTokenEx  (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN
 01681   428   NtOpenProcessTokenEx  (-1, 0x20008, 512, ... 248, ) == 0x0
 01682   428   NtQueryInformationToken  (248, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0
 01683   428   NtClose  (248, ... ) == 0x0
 01684   428   NtOpenKey  (0x2000000, {24, 0, 0x40, 0, 0,  (0x2000000, {24, 0, 0x40, 0, 0, "\REGISTRY\USER\S-1-5-21-1078081533-484763869-839522115-1003_Classes\CLSID\{FBF23B40-E3F0-101B-8488-00AA003E56F8}\InprocServer32"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01685   428   NtOpenKey  (0x2000000, {24, 238, 0x40, 0, 0,  (0x2000000, {24, 238, 0x40, 0, 0, "InprocServer32"}, ... 248, ) }, ... 248, ) == 0x0
 01686   428   NtQueryKey  (250, Name, 392, ... {Name= (250, Name, 392, ... {Name="\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{FBF23B40-E3F0-101B-8488-00AA003E56F8}\InProcServer32"}, 192, ) }, 192, ) == 0x0
 01687   428   NtOpenThreadTokenEx  (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN
 01688   428   NtOpenProcessTokenEx  (-1, 0x20008, 512, ... 252, ) == 0x0
 01689   428   NtQueryInformationToken  (252, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0
 01690   428   NtClose  (252, ... ) == 0x0
 01691   428   NtOpenKey  (0x2000000, {24, 0, 0x40, 0, 0,  (0x2000000, {24, 0, 0x40, 0, 0, "\REGISTRY\USER\S-1-5-21-1078081533-484763869-839522115-1003_Classes\CLSID\{FBF23B40-E3F0-101B-8488-00AA003E56F8}\InProcServer32"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01692   428   NtQueryValueKey  (250,  (250, "InprocServer32", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01693   428   NtClose  (250, ... ) == 0x0
 01694   428   NtQueryKey  (238, Name, 384, ... {Name= (238, Name, 384, ... {Name="\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{FBF23B40-E3F0-101B-8488-00AA003E56F8}_"}, 162, ) }, 162, ) == 0x0
 01695   428   NtOpenThreadTokenEx  (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN
 01696   428   NtOpenProcessTokenEx  (-1, 0x20008, 512, ... 248, ) == 0x0
 01697   428   NtQueryInformationToken  (248, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0
 01698   428   NtClose  (248, ... ) == 0x0
 01699   428   NtOpenKey  (0x2000000, {24, 0, 0x40, 0, 0,  (0x2000000, {24, 0, 0x40, 0, 0, "\REGISTRY\USER\S-1-5-21-1078081533-484763869-839522115-1003_Classes\CLSID\{FBF23B40-E3F0-101B-8488-00AA003E56F8}\InprocServerX86"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01700   428   NtOpenKey  (0x2000000, {24, 238, 0x40, 0, 0,  (0x2000000, {24, 238, 0x40, 0, 0, "InprocServerX86"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01701   428   NtQueryKey  (238, Name, 384, ... {Name= (238, Name, 384, ... {Name="\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{FBF23B40-E3F0-101B-8488-00AA003E56F8}_"}, 162, ) }, 162, ) == 0x0
 01702   428   NtOpenThreadTokenEx  (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN
 01703   428   NtOpenProcessTokenEx  (-1, 0x20008, 512, ... 248, ) == 0x0
 01704   428   NtQueryInformationToken  (248, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0
 01705   428   NtClose  (248, ... ) == 0x0
 01706   428   NtOpenKey  (0x2000000, {24, 0, 0x40, 0, 0,  (0x2000000, {24, 0, 0x40, 0, 0, "\REGISTRY\USER\S-1-5-21-1078081533-484763869-839522115-1003_Classes\CLSID\{FBF23B40-E3F0-101B-8488-00AA003E56F8}\LocalServer32"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01707   428   NtOpenKey  (0x2000000, {24, 238, 0x40, 0, 0,  (0x2000000, {24, 238, 0x40, 0, 0, "LocalServer32"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01708   428   NtQueryKey  (238, Name, 384, ... {Name= (238, Name, 384, ... {Name="\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{FBF23B40-E3F0-101B-8488-00AA003E56F8}_"}, 162, ) }, 162, ) == 0x0
 01709   428   NtOpenThreadTokenEx  (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN
 01710   428   NtOpenProcessTokenEx  (-1, 0x20008, 512, ... 248, ) == 0x0
 01711   428   NtQueryInformationToken  (248, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0
 01712   428   NtClose  (248, ... ) == 0x0
 01713   428   NtOpenKey  (0x2000000, {24, 0, 0x40, 0, 0,  (0x2000000, {24, 0, 0x40, 0, 0, "\REGISTRY\USER\S-1-5-21-1078081533-484763869-839522115-1003_Classes\CLSID\{FBF23B40-E3F0-101B-8488-00AA003E56F8}\InprocServer32"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01714   428   NtOpenKey  (0x2000000, {24, 238, 0x40, 0, 0,  (0x2000000, {24, 238, 0x40, 0, 0, "InprocServer32"}, ... 248, ) }, ... 248, ) == 0x0
 01715   428   NtQueryKey  (250, Name, 392, ... {Name= (250, Name, 392, ... {Name="\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{FBF23B40-E3F0-101B-8488-00AA003E56F8}\InProcServer32"}, 192, ) }, 192, ) == 0x0
 01716   428   NtOpenThreadTokenEx  (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN
 01717   428   NtOpenProcessTokenEx  (-1, 0x20008, 512, ... 252, ) == 0x0
 01718   428   NtQueryInformationToken  (252, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0
 01719   428   NtClose  (252, ... ) == 0x0
 01720   428   NtOpenKey  (0x2000000, {24, 0, 0x40, 0, 0,  (0x2000000, {24, 0, 0x40, 0, 0, "\REGISTRY\USER\S-1-5-21-1078081533-484763869-839522115-1003_Classes\CLSID\{FBF23B40-E3F0-101B-8488-00AA003E56F8}\InProcServer32"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01721   428   NtQueryValueKey  (250, 0x0, Partial, 144, ... TitleIdx=0, Type=1, Data= (250, 0x0, Partial, 144, ... TitleIdx=0, Type=1, Data="s\0h\0d\0o\0c\0v\0w\0.\0d\0l\0l\0\0\0"}, 36, ) }, 36, ) == 0x0
 01722   428   NtClose  (250, ... ) == 0x0
 01723   428   NtQueryKey  (238, Name, 384, ... {Name= (238, Name, 384, ... {Name="\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{FBF23B40-E3F0-101B-8488-00AA003E56F8}_"}, 162, ) }, 162, ) == 0x0
 01724   428   NtOpenThreadTokenEx  (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN
 01725   428   NtOpenProcessTokenEx  (-1, 0x20008, 512, ... 248, ) == 0x0
 01726   428   NtQueryInformationToken  (248, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0
 01727   428   NtClose  (248, ... ) == 0x0
 01728   428   NtOpenKey  (0x2000000, {24, 0, 0x40, 0, 0,  (0x2000000, {24, 0, 0x40, 0, 0, "\REGISTRY\USER\S-1-5-21-1078081533-484763869-839522115-1003_Classes\CLSID\{FBF23B40-E3F0-101B-8488-00AA003E56F8}\InprocHandler32"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01729   428   NtOpenKey  (0x2000000, {24, 238, 0x40, 0, 0,  (0x2000000, {24, 238, 0x40, 0, 0, "InprocHandler32"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01730   428   NtQueryKey  (238, Name, 384, ... {Name= (238, Name, 384, ... {Name="\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{FBF23B40-E3F0-101B-8488-00AA003E56F8}_"}, 162, ) }, 162, ) == 0x0
 01731   428   NtOpenThreadTokenEx  (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN
 01732   428   NtOpenProcessTokenEx  (-1, 0x20008, 512, ... 248, ) == 0x0
 01733   428   NtQueryInformationToken  (248, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0
 01734   428   NtClose  (248, ... ) == 0x0
 01735   428   NtOpenKey  (0x2000000, {24, 0, 0x40, 0, 0,  (0x2000000, {24, 0, 0x40, 0, 0, "\REGISTRY\USER\S-1-5-21-1078081533-484763869-839522115-1003_Classes\CLSID\{FBF23B40-E3F0-101B-8488-00AA003E56F8}\InprocHandlerX86"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01736   428   NtOpenKey  (0x2000000, {24, 238, 0x40, 0, 0,  (0x2000000, {24, 238, 0x40, 0, 0, "InprocHandlerX86"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01737   428   NtQueryKey  (238, Name, 384, ... {Name= (238, Name, 384, ... {Name="\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{FBF23B40-E3F0-101B-8488-00AA003E56F8}_"}, 162, ) }, 162, ) == 0x0
 01738   428   NtOpenThreadTokenEx  (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN
 01739   428   NtOpenProcessTokenEx  (-1, 0x20008, 512, ... 248, ) == 0x0
 01740   428   NtQueryInformationToken  (248, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0
 01741   428   NtClose  (248, ... ) == 0x0
 01742   428   NtOpenKey  (0x2000000, {24, 0, 0x40, 0, 0,  (0x2000000, {24, 0, 0x40, 0, 0, "\REGISTRY\USER\S-1-5-21-1078081533-484763869-839522115-1003_Classes\CLSID\{FBF23B40-E3F0-101B-8488-00AA003E56F8}\LocalServer32"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01743   428   NtOpenKey  (0x2000000, {24, 238, 0x40, 0, 0,  (0x2000000, {24, 238, 0x40, 0, 0, "LocalServer32"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01744   428   NtQueryKey  (238, Name, 384, ... {Name= (238, Name, 384, ... {Name="\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{FBF23B40-E3F0-101B-8488-00AA003E56F8}_"}, 162, ) }, 162, ) == 0x0
 01745   428   NtOpenThreadTokenEx  (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN
 01746   428   NtOpenProcessTokenEx  (-1, 0x20008, 512, ... 248, ) == 0x0
 01747   428   NtQueryInformationToken  (248, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0
 01748   428   NtClose  (248, ... ) == 0x0
 01749   428   NtOpenKey  (0x2000000, {24, 0, 0x40, 0, 0,  (0x2000000, {24, 0, 0x40, 0, 0, "\REGISTRY\USER\S-1-5-21-1078081533-484763869-839522115-1003_Classes\CLSID\{FBF23B40-E3F0-101B-8488-00AA003E56F8}\LocalServer"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01750   428   NtOpenKey  (0x2000000, {24, 238, 0x40, 0, 0,  (0x2000000, {24, 238, 0x40, 0, 0, "LocalServer"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01751   428   NtQueryKey  (122, Name, 384, ... {Name= (122, Name, 384, ... {Name="\REGISTRY\USER\S-1-5-21-1078081533-484763869-839522115-1003_CLASSES9"}, 138, ) }, 138, ) == 0x0
 01752   428   NtOpenKey  (0x20019, {24, 122, 0x40, 0, 0,  (0x20019, {24, 122, 0x40, 0, 0, "CLSID\{FBF23B40-E3F0-101B-8488-00AA003E56F8}"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01753   428   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Classes\CLSID\{FBF23B40-E3F0-101B-8488-00AA003E56F8}"}, ... 248, ) }, ... 248, ) == 0x0
 01754   428   NtQueryKey  (250, Name, 392, ... {Name= (250, Name, 392, ... {Name="\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{FBF23B40-E3F0-101B-8488-00AA003E56F8}B"}, 162, ) }, 162, ) == 0x0
 01755   428   NtOpenThreadTokenEx  (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN
 01756   428   NtOpenProcessTokenEx  (-1, 0x20008, 512, ... 252, ) == 0x0
 01757   428   NtQueryInformationToken  (252, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0
 01758   428   NtClose  (252, ... ) == 0x0
 01759   428   NtOpenKey  (0x2000000, {24, 0, 0x40, 0, 0,  (0x2000000, {24, 0, 0x40, 0, 0, "\REGISTRY\USER\S-1-5-21-1078081533-484763869-839522115-1003_Classes\CLSID\{FBF23B40-E3F0-101B-8488-00AA003E56F8}"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01760   428   NtQueryValueKey  (250,  (250, "AppID", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01761   428   NtClose  (250, ... ) == 0x0
 01762   428   NtClose  (238, ... ) == 0x0
 01763   428   NtOpenProcess  (0x400, {24, 0, 0x0, 0, 0, 0x0}, {420, 0}, ... 236, ) == 0x0
 01764   428   NtQueryInformationProcess  (236, Session, 4, ... {SessionId=0,}, 0x0, ) == 0x0
 01765   428   NtClose  (236, ... ) == 0x0
 01766   428   NtQueryKey  (122, Name, 384, ... {Name= (122, Name, 384, ... {Name="\REGISTRY\USER\S-1-5-21-1078081533-484763869-839522115-1003_CLASSES9"}, 138, ) }, 138, ) == 0x0
 01767   428   NtOpenKey  (0x20019, {24, 122, 0x40, 0, 0,  (0x20019, {24, 122, 0x40, 0, 0, "CLSID\{FBF23B40-E3F0-101B-8488-00AA003E56F8}"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01768   428   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Classes\CLSID\{FBF23B40-E3F0-101B-8488-00AA003E56F8}"}, ... 236, ) }, ... 236, ) == 0x0
 01769   428   NtQueryKey  (238, Name, 384, ... {Name= (238, Name, 384, ... {Name="\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{FBF23B40-E3F0-101B-8488-00AA003E56F8}B"}, 162, ) }, 162, ) == 0x0
 01770   428   NtOpenThreadTokenEx  (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN
 01771   428   NtOpenProcessTokenEx  (-1, 0x20008, 512, ... 248, ) == 0x0
 01772   428   NtQueryInformationToken  (248, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0
 01773   428   NtClose  (248, ... ) == 0x0
 01774   428   NtOpenKey  (0x2000000, {24, 0, 0x40, 0, 0,  (0x2000000, {24, 0, 0x40, 0, 0, "\REGISTRY\USER\S-1-5-21-1078081533-484763869-839522115-1003_Classes\CLSID\{FBF23B40-E3F0-101B-8488-00AA003E56F8}\InprocServer32"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01775   428   NtOpenKey  (0x2000000, {24, 238, 0x40, 0, 0,  (0x2000000, {24, 238, 0x40, 0, 0, "InprocServer32"}, ... 248, ) }, ... 248, ) == 0x0
 01776   428   NtQueryKey  (250, Name, 392, ... {Name= (250, Name, 392, ... {Name="\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{FBF23B40-E3F0-101B-8488-00AA003E56F8}\InProcServer32"}, 192, ) }, 192, ) == 0x0
 01777   428   NtOpenThreadTokenEx  (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN
 01778   428   NtOpenProcessTokenEx  (-1, 0x20008, 512, ... 252, ) == 0x0
 01779   428   NtQueryInformationToken  (252, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0
 01780   428   NtClose  (252, ... ) == 0x0
 01781   428   NtOpenKey  (0x2000000, {24, 0, 0x40, 0, 0,  (0x2000000, {24, 0, 0x40, 0, 0, "\REGISTRY\USER\S-1-5-21-1078081533-484763869-839522115-1003_Classes\CLSID\{FBF23B40-E3F0-101B-8488-00AA003E56F8}\InProcServer32"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01782   428   NtQueryValueKey  (250,  (250, "ThreadingModel", Partial, 144, ... TitleIdx=0, Type=1, Data="A\0p\0a\0r\0t\0m\0e\0n\0t\0\0\0"}, 32, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (250, "ThreadingModel", Partial, 144, ... TitleIdx=0, Type=1, Data="A\0p\0a\0r\0t\0m\0e\0n\0t\0\0\0"}, 32, ) }, 32, ) == 0x0
 01783   428   NtClose  (250, ... ) == 0x0
 01784   428   NtClose  (238, ... ) == 0x0
 01785   428   NtQueryKey  (122, Name, 384, ... {Name= (122, Name, 384, ... {Name="\REGISTRY\USER\S-1-5-21-1078081533-484763869-839522115-1003_CLASSES9"}, 138, ) }, 138, ) == 0x0
 01786   428   NtOpenKey  (0x20019, {24, 122, 0x40, 0, 0,  (0x20019, {24, 122, 0x40, 0, 0, "CLSID\{FBF23B40-E3F0-101B-8488-00AA003E56F8}"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01787   428   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Classes\CLSID\{FBF23B40-E3F0-101B-8488-00AA003E56F8}"}, ... 236, ) }, ... 236, ) == 0x0
 01788   428   NtQueryKey  (238, Name, 384, ... {Name= (238, Name, 384, ... {Name="\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{FBF23B40-E3F0-101B-8488-00AA003E56F8}B"}, 162, ) }, 162, ) == 0x0
 01789   428   NtOpenThreadTokenEx  (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN
 01790   428   NtOpenProcessTokenEx  (-1, 0x20008, 512, ... 248, ) == 0x0
 01791   428   NtQueryInformationToken  (248, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0
 01792   428   NtClose  (248, ... ) == 0x0
 01793   428   NtOpenKey  (0x1, {24, 0, 0x40, 0, 0,  (0x1, {24, 0, 0x40, 0, 0, "\REGISTRY\USER\S-1-5-21-1078081533-484763869-839522115-1003_Classes\CLSID\{FBF23B40-E3F0-101B-8488-00AA003E56F8}\TreatAs"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01794   428   NtOpenKey  (0x1, {24, 238, 0x40, 0, 0,  (0x1, {24, 238, 0x40, 0, 0, "TreatAs"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01795   428   NtClose  (238, ... ) == 0x0
 01796   428   NtOpenKey  (0x1, {24, 28, 0x40, 0, 0,  (0x1, {24, 28, 0x40, 0, 0, "SOFTWARE\Microsoft\Windows\CurrentVersion\ShellCompatibility\Objects\{FBF23B40-E3F0-101B-8488-00AA003E56F8}"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01797   428   NtAllocateVirtualMemory  (-1, 1425408, 0, 12288, 4096, 4, ... 1425408, 12288, ) == 0x0
 01798   428   NtAllocateVirtualMemory  (-1, 1216512, 0, 4096, 4096, 260, ... 1216512, 4096, ) == 0x0
 01799   428   NtAllocateVirtualMemory  (-1, 1212416, 0, 4096, 4096, 260, ... 1212416, 4096, ) == 0x0
 01800   428   NtOpenSection  (0xe, {24, 8, 0x40, 0, 0,  (0xe, {24, 8, 0x40, 0, 0, "Secur32.dll"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01801   428   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\u:\work\Secur32.dll"}, 1218276, ... ) }, 1218276, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01802   428   NtQueryAttributesFile  ({24, 12, 0x40, 0, 0,  ({24, 12, 0x40, 0, 0, "Secur32.dll"}, 1218276, ... ) }, 1218276, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01803   428   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\System32\Secur32.dll"}, 1218276, ... ) }, 1218276, ... ) == 0x0
 01804   428   NtOpenFile  (0x100020, {24, 0, 0x40, 0, 0,  (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\System32\Secur32.dll"}, 5, 96, ... 236, {status=0x0, info=1}, ) }, 5, 96, ... 236, {status=0x0, info=1}, ) == 0x0
 01805   428   NtCreateSection  (0xf, 0x0, 0x0, 16, 16777216, 236, ... 248, ) == 0x0
 01806   428   NtQuerySection  (248, Image, 48, ... {section info, class 1, size 48}, 0x0, ) == 0x0
 01807   428   NtClose  (236, ... ) == 0x0
 01808   428   NtMapViewOfSection  (248, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x76f90000), 0x0, 65536, ) == 0x0
 01809   428   NtClose  (248, ... ) == 0x0
 01810   428   NtCreateSemaphore  (0x100003, 0x0, 0, 2147483647, ... 248, ) == 0x0
 01811   428   NtCreateSemaphore  (0x100003, 0x0, 0, 2147483647, ... 236, ) == 0x0
 01812   428   NtOpenEvent  (0x1, {24, 0, 0x40, 0, 0,  (0x1, {24, 0, 0x40, 0, 0, "\SECURITY\LSA_AUTHENTICATION_INITIALIZED"}, ... 252, ) }, ... 252, ) == 0x0
 01813   428   NtQueryEvent  (252, Basic, 8, ... {EventType=0,SignalState=1,}, 0x0, ) == 0x0
 01814   428   NtClose  (252, ... ) == 0x0
 01815   428   NtConnectPort  ( ("\LsaAuthenticationPort", {12, 2, 1, 0}, 0x0, 0x0, 1219808, 140, ... 252, 0x0, 0x0, 256, 140, ) , {12, 2, 1, 0}, 0x0, 0x0, 1219808, 140, ... 252, 0x0, 0x0, 256, 140, ) == 0x0
 01816   428   NtRequestWaitReplyPort  (252, {28, 52, new_msg, 0, 0, 0, 0, 0}  (252, {28, 52, new_msg, 0, 0, 0, 0, 0} "\37\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\1\0\0\340\2\10[\247v" ... {176, 200, reply, 0, 420, 428, 1457, 0} "\37\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\1\0\20\0\2\1\220\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0S\0R\0I\0-\0u\0s\0e\0r\0" )  ... {176, 200, reply, 0, 420, 428, 1457, 0}  (252, {28, 52, new_msg, 0, 0, 0, 0, 0} "\37\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\1\0\0\340\2\10[\247v" ... {176, 200, reply, 0, 420, 428, 1457, 0} "\37\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\1\0\20\0\2\1\220\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0S\0R\0I\0-\0u\0s\0e\0r\0" )  ) == 0x0
 01817   428   NtAllocateVirtualMemory  (-1, 1208320, 0, 4096, 4096, 260, ... 1208320, 4096, ) == 0x0
 01818   428   NtOpenSection  (0xe, {24, 8, 0x40, 0, 0,  (0xe, {24, 8, 0x40, 0, 0, "WININET.dll"}, ... 256, ) }, ... 256, ) == 0x0
 01819   428   NtMapViewOfSection  (256, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x76200000), 0x0, 618496, ) == 0x0
 01820   428   NtClose  (256, ... ) == 0x0
 01821   428   NtOpenSection  (0xe, {24, 8, 0x40, 0, 0,  (0xe, {24, 8, 0x40, 0, 0, "CRYPT32.dll"}, ... 256, ) }, ... 256, ) == 0x0
 01822   428   NtMapViewOfSection  (256, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x762c0000), 0x0, 565248, ) == 0x0
 01823   428   NtClose  (256, ... ) == 0x0
 01824   428   NtOpenSection  (0xe, {24, 8, 0x40, 0, 0,  (0xe, {24, 8, 0x40, 0, 0, "MSASN1.dll"}, ... 256, ) }, ... 256, ) == 0x0
 01825   428   NtMapViewOfSection  (256, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x762a0000), 0x0, 61440, ) == 0x0
 01826   428   NtClose  (256, ... ) == 0x0
 01827   428   NtOpenKey  (0x20019, {24, 28, 0x40, 0, 0,  (0x20019, {24, 28, 0x40, 0, 0, "SYSTEM\CurrentControlSet\Services\crypt32\Performance"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01828   428   NtCreateEvent  (0x1f0003, {24, 52, 0x80, 1216836, 0,  (0x1f0003, {24, 52, 0x80, 1216836, 0, "Global\crypt32LogoffEvent"}, 0, 0, ... ) }, 0, 0, ... ) == STATUS_ACCESS_DENIED
 01829   428   NtOpenEvent  (0x100000, {24, 52, 0x0, 0, 0,  (0x100000, {24, 52, 0x0, 0, 0, "Global\crypt32LogoffEvent"}, ... 256, ) }, ... 256, ) == 0x0
 01830   428   NtAllocateVirtualMemory  (-1, 1437696, 0, 4096, 4096, 4, ... 1437696, 4096, ) == 0x0
 01831   428   NtAllocateVirtualMemory  (-1, 1441792, 0, 8192, 4096, 4, ... 1441792, 8192, ) == 0x0
 01832   428   NtCreateKey  (0xf003f, {24, 60, 0x40, 0, 0,  (0xf003f, {24, 60, 0x40, 0, 0, "SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\P3P\History"}, 0, 0x0, 0, ... 260, 2, ) }, 0, 0x0, 0, ... 260, 2, ) == 0x0
 01833   428   NtQueryDefaultUILanguage  (1215072, ...
 01834   428   NtOpenThreadTokenEx  (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN
 01835   428   NtOpenProcessTokenEx  (-1, 0x20008, 512, ... -2147482204, ) == 0x0
 01836   428   NtQueryInformationToken  (-2147482204, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0
 01837   428   NtClose  (-2147482204, ... ) == 0x0
 01838   428   NtOpenKey  (0x2000000, {24, 0, 0x640, 0, 0,  (0x2000000, {24, 0, 0x640, 0, 0, "\REGISTRY\USER\S-1-5-21-1078081533-484763869-839522115-1003"}, ... -2147482204, ) }, ... -2147482204, ) == 0x0
 01839   428   NtOpenKey  (0x80000000, {24, 0, 0x240, 0, 0,  (0x80000000, {24, 0, 0x240, 0, 0, "\Registry\Machine\System\CurrentControlSet\Control\Nls\MUILanguages"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01840   428   NtOpenKey  (0x80000000, {24, -2147482204, 0x640, 0, 0,  (0x80000000, {24, -2147482204, 0x640, 0, 0, "Control Panel\Desktop"}, ... -2147482208, ) }, ... -2147482208, ) == 0x0
 01841   428   NtQueryValueKey  (-2147482208,  (-2147482208, "MultiUILanguageId", Partial, 256, ... ) , Partial, 256, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01842   428   NtClose  (-2147482208, ... ) == 0x0
 01843   428   NtClose  (-2147482204, ... ) == 0x0
 01833   428   NtQueryDefaultUILanguage  ... ) == 0x0
 01844   428   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\System\CurrentControlSet\Control\Nls\MUILanguages"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01845   428   NtOpenFile  (0x1200a9, {24, 0, 0x40, 0, 0,  (0x1200a9, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\WININET.dll"}, 1, 96, ... 264, {status=0x0, info=1}, ) }, 1, 96, ... 264, {status=0x0, info=1}, ) == 0x0
 01846   428   NtCreateSection  (0x4, 0x0, 0x0, 2, 134217728, 264, ... 268, ) == 0x0
 01847   428   NtMapViewOfSection  (268, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 2, ... (0x940000), 0x0, 593920, ) == 0x0
 01848   428   NtOpenFile  (0x1200a9, {24, 0, 0x40, 0, 0,  (0x1200a9, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\WININET.dll.123.Manifest"}, 1, 96, ... ) }, 1, 96, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01849   428   NtAllocateVirtualMemory  (-1, 1204224, 0, 4096, 4096, 260, ... 1204224, 4096, ) == 0x0
 01850   428   NtQueryDefaultLocale  (1, 1213108, ... ) == 0x0
 01851   428   NtOpenFile  (0x1200a9, {24, 0, 0x40, 0, 0,  (0x1200a9, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\WININET.dll.123.Config"}, 1, 96, ... ) }, 1, 96, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01852   428   NtRequestWaitReplyPort  (24, {128, 156, new_msg, 0, 1213964, 1, 96, 0}  (24, {128, 156, new_msg, 0, 1213964, 1, 96, 0} "\210\6\31\1\33\0\1\0\0\0\0\0\1\211\22\0\1\0\0\0\0\0\11\4\1\1\1\0>\0@\0\250\6\31\1\10\1\0\0\377\377\377\377\0\0\0\0P\275\233\0\0\0\0\0\312\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0(\0,\0\350\6\31\1\0\0\0\0\0\0\0\0\14\215\22\0\0\0\0\0" ... {128, 156, reply, 0, 420, 428, 1458, 0} " S\26\0\33\0\1\0\0\0\0\0\1\211\22\0\1\0\0\0\0\0\11\4\1\1\1\0>\0@\0\250\6\31\1\10\1\0\0\377\377\377\377\0\0\0\0P\275\233\0\0\0\0\0\312\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0(\0,\0\350\6\31\1\0\0\0\0\0\0\0\0\14\215\22\0\0\0\0\0" )  ... {128, 156, reply, 0, 420, 428, 1458, 0}  (24, {128, 156, new_msg, 0, 1213964, 1, 96, 0} "\210\6\31\1\33\0\1\0\0\0\0\0\1\211\22\0\1\0\0\0\0\0\11\4\1\1\1\0>\0@\0\250\6\31\1\10\1\0\0\377\377\377\377\0\0\0\0P\275\233\0\0\0\0\0\312\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0(\0,\0\350\6\31\1\0\0\0\0\0\0\0\0\14\215\22\0\0\0\0\0" ... {128, 156, reply, 0, 420, 428, 1458, 0} " S\26\0\33\0\1\0\0\0\0\0\1\211\22\0\1\0\0\0\0\0\11\4\1\1\1\0>\0@\0\250\6\31\1\10\1\0\0\377\377\377\377\0\0\0\0P\275\233\0\0\0\0\0\312\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0(\0,\0\350\6\31\1\0\0\0\0\0\0\0\0\14\215\22\0\0\0\0\0" )  ) == 0x0
 01853   428   NtClose  (264, ... ) == 0x0
 01854   428   NtClose  (268, ... ) == 0x0
 01855   428   NtUnmapViewOfSection  (-1, 0x940000, ... ) == 0x0
 01856   428   NtUnmapViewOfSection  (-1, 0x128d0c, ... ) == STATUS_NOT_MAPPED_VIEW
 01857   428   NtQueryDebugFilterState  (53, 2, ... ) == 0x0
 01858   428   NtOpenKey  (0x8, {24, 0, 0x40, 0, 0,  (0x8, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows\CurrentVersion\SideBySide\AssemblyStorageRoots"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01859   428   NtQueryDebugFilterState  (53, 2, ... ) == 0x0
 01860   428   NtQueryDebugFilterState  (53, 2, ... ) == 0x0
 01861   428   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\u:\work\packed.exe.Local\"}, 1211648, ... ) }, 1211648, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01862   428   NtQueryDebugFilterState  (53, 2, ... ) == 0x0
 01863   428   NtQueryDebugFilterState  (53, 2, ... ) == 0x0
 01864   428   NtQueryDebugFilterState  (53, 2, ... ) == 0x0
 01865   428   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.0.0_x-ww_1382d70a"}, 1212240, ... ) }, 1212240, ... ) == 0x0
 01866   428   NtOpenFile  (0x100020, {24, 0, 0x40, 0, 0,  (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.0.0_x-ww_1382d70a"}, 3, 33, ... 268, {status=0x0, info=1}, ) }, 3, 33, ... 268, {status=0x0, info=1}, ) == 0x0
 01867   428   NtQueryDebugFilterState  (53, 2, ... ) == 0x0
 01868   428   NtCreateKey  (0x2001f, {24, 60, 0x40, 0, 0,  (0x2001f, {24, 60, 0x40, 0, 0, "SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings"}, 0, 0x0, 0, ... 264, 2, ) }, 0, 0x0, 0, ... 264, 2, ) == 0x0
 01869   428   NtRequestWaitReplyPort  (252, {28, 52, new_msg, 0, 0, 0, 0, 0}  (252, {28, 52, new_msg, 0, 0, 0, 0, 0} "\37\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\1\0\13\30\10\2\220\36\24\0" ... {176, 200, reply, 0, 420, 428, 1459, 0} "\37\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\1\0\20\0\10\2\220\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0S\0R\0I\0-\0u\0s\0e\0r\0" )  ... {176, 200, reply, 0, 420, 428, 1459, 0}  (252, {28, 52, new_msg, 0, 0, 0, 0, 0} "\37\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\1\0\13\30\10\2\220\36\24\0" ... {176, 200, reply, 0, 420, 428, 1459, 0} "\37\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\1\0\20\0\10\2\220\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0S\0R\0I\0-\0u\0s\0e\0r\0" )  ) == 0x0
 01870   428   NtQueryValueKey  (264,  (264, "SyncMode5", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01871   428   NtOpenKey  (0xf, {24, 28, 0x40, 0, 0,  (0xf, {24, 28, 0x40, 0, 0, "Software\Microsoft\Windows\CurrentVersion\Internet Settings\Cache"}, ... 272, ) }, ... 272, ) == 0x0
 01872   428   NtQueryValueKey  (272,  (272, "FixupKey", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01873   428   NtClose  (272, ... ) == 0x0
 01874   428   NtOpenKey  (0xf, {24, 28, 0x40, 0, 0,  (0xf, {24, 28, 0x40, 0, 0, "Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache"}, ... 272, ) }, ... 272, ) == 0x0
 01875   428   NtQueryValueKey  (272,  (272, "SessionStartTimeDefaultDeltaSecs", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01876   428   NtClose  (272, ... ) == 0x0
 01877   428   NtOpenKey  (0xf, {24, 28, 0x40, 0, 0,  (0xf, {24, 28, 0x40, 0, 0, "Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache"}, ... 272, ) }, ... 272, ) == 0x0
 01878   428   NtOpenKey  (0x20019, {24, 28, 0x40, 0, 0,  (0x20019, {24, 28, 0x40, 0, 0, "System\Setup"}, ... 276, ) }, ... 276, ) == 0x0
 01879   428   NtQueryValueKey  (276,  (276, "SystemSetupInProgress", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (276, "SystemSetupInProgress", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) }, 16, ) == 0x0
 01880   428   NtClose  (276, ... ) == 0x0
 01881   428   NtOpenKey  (0xf, {24, 60, 0x40, 0, 0,  (0xf, {24, 60, 0x40, 0, 0, "Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders"}, ... 276, ) }, ... 276, ) == 0x0
 01882   428   NtOpenKey  (0xf, {24, 60, 0x40, 0, 0,  (0xf, {24, 60, 0x40, 0, 0, "Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache"}, ... 280, ) }, ... 280, ) == 0x0
 01883   428   NtOpenKey  (0xf, {24, 60, 0x40, 0, 0,  (0xf, {24, 60, 0x40, 0, 0, "Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders"}, ... 284, ) }, ... 284, ) == 0x0
 01884   428   NtOpenKey  (0xf, {24, 60, 0x40, 0, 0,  (0xf, {24, 60, 0x40, 0, 0, "Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache"}, ... 288, ) }, ... 288, ) == 0x0
 01885   428   NtQueryValueKey  (288,  (288, "Signature", Partial, 144, ... TitleIdx=0, Type=1, Data="C\0l\0i\0e\0n\0t\0 \0U\0r\0l\0C\0a\0c\0h\0e\0 \0M\0M\0F\0 \0V\0e\0r\0 \05\0.\02\0\0\0"}, 68, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (288, "Signature", Partial, 144, ... TitleIdx=0, Type=1, Data="C\0l\0i\0e\0n\0t\0 \0U\0r\0l\0C\0a\0c\0h\0e\0 \0M\0M\0F\0 \0V\0e\0r\0 \05\0.\02\0\0\0"}, 68, ) }, 68, ) == 0x0
 01886   428   NtQueryValueKey  (288,  (288, "Signature", Partial, 144, ... TitleIdx=0, Type=1, Data="C\0l\0i\0e\0n\0t\0 \0U\0r\0l\0C\0a\0c\0h\0e\0 \0M\0M\0F\0 \0V\0e\0r\0 \05\0.\02\0\0\0"}, 68, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (288, "Signature", Partial, 144, ... TitleIdx=0, Type=1, Data="C\0l\0i\0e\0n\0t\0 \0U\0r\0l\0C\0a\0c\0h\0e\0 \0M\0M\0F\0 \0V\0e\0r\0 \05\0.\02\0\0\0"}, 68, ) }, 68, ) == 0x0
 01887   428   NtClose  (288, ... ) == 0x0
 01888   428   NtOpenKey  (0xf, {24, 60, 0x40, 0, 0,  (0xf, {24, 60, 0x40, 0, 0, "Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders"}, ... 288, ) }, ... 288, ) == 0x0
 01889   428   NtQueryValueKey  (288,  (288, "Cache", Partial, 144, ... TitleIdx=0, Type=2, Data="%\0U\0S\0E\0R\0P\0R\0O\0F\0I\0L\0E\0%\0\\0L\0o\0c\0a\0l\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0T\0e\0m\0p\0o\0r\0a\0r\0y\0 \0I\0n\0t\0e\0r\0n\0e\0t\0 \0F\0i\0l\0e\0s\0\0\0"}, 120, ) , Partial, 144, ... TitleIdx=0, Type=2, Data= (288, "Cache", Partial, 144, ... TitleIdx=0, Type=2, Data="%\0U\0S\0E\0R\0P\0R\0O\0F\0I\0L\0E\0%\0\\0L\0o\0c\0a\0l\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0T\0e\0m\0p\0o\0r\0a\0r\0y\0 \0I\0n\0t\0e\0r\0n\0e\0t\0 \0F\0i\0l\0e\0s\0\0\0"}, 120, ) }, 120, ) == 0x0
 01890   428   NtQueryValueKey  (288,  (288, "Cache", Partial, 144, ... TitleIdx=0, Type=2, Data="%\0U\0S\0E\0R\0P\0R\0O\0F\0I\0L\0E\0%\0\\0L\0o\0c\0a\0l\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0T\0e\0m\0p\0o\0r\0a\0r\0y\0 \0I\0n\0t\0e\0r\0n\0e\0t\0 \0F\0i\0l\0e\0s\0\0\0"}, 120, ) , Partial, 144, ... TitleIdx=0, Type=2, Data= (288, "Cache", Partial, 144, ... TitleIdx=0, Type=2, Data="%\0U\0S\0E\0R\0P\0R\0O\0F\0I\0L\0E\0%\0\\0L\0o\0c\0a\0l\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0T\0e\0m\0p\0o\0r\0a\0r\0y\0 \0I\0n\0t\0e\0r\0n\0e\0t\0 \0F\0i\0l\0e\0s\0\0\0"}, 120, ) }, 120, ) == 0x0
 01891   428   NtQueryValueKey  (288,  (288, "Cookies", Partial, 144, ... TitleIdx=0, Type=2, Data="%\0U\0S\0E\0R\0P\0R\0O\0F\0I\0L\0E\0%\0\\0C\0o\0o\0k\0i\0e\0s\0\0\0"}, 56, ) , Partial, 144, ... TitleIdx=0, Type=2, Data= (288, "Cookies", Partial, 144, ... TitleIdx=0, Type=2, Data="%\0U\0S\0E\0R\0P\0R\0O\0F\0I\0L\0E\0%\0\\0C\0o\0o\0k\0i\0e\0s\0\0\0"}, 56, ) }, 56, ) == 0x0
 01892   428   NtQueryValueKey  (288,  (288, "Cookies", Partial, 144, ... TitleIdx=0, Type=2, Data="%\0U\0S\0E\0R\0P\0R\0O\0F\0I\0L\0E\0%\0\\0C\0o\0o\0k\0i\0e\0s\0\0\0"}, 56, ) , Partial, 144, ... TitleIdx=0, Type=2, Data= (288, "Cookies", Partial, 144, ... TitleIdx=0, Type=2, Data="%\0U\0S\0E\0R\0P\0R\0O\0F\0I\0L\0E\0%\0\\0C\0o\0o\0k\0i\0e\0s\0\0\0"}, 56, ) }, 56, ) == 0x0
 01893   428   NtQueryValueKey  (288,  (288, "History", Partial, 144, ... TitleIdx=0, Type=2, Data="%\0U\0S\0E\0R\0P\0R\0O\0F\0I\0L\0E\0%\0\\0L\0o\0c\0a\0l\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0H\0i\0s\0t\0o\0r\0y\0\0\0"}, 86, ) , Partial, 144, ... TitleIdx=0, Type=2, Data= (288, "History", Partial, 144, ... TitleIdx=0, Type=2, Data="%\0U\0S\0E\0R\0P\0R\0O\0F\0I\0L\0E\0%\0\\0L\0o\0c\0a\0l\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0H\0i\0s\0t\0o\0r\0y\0\0\0"}, 86, ) }, 86, ) == 0x0
 01894   428   NtQueryValueKey  (288,  (288, "History", Partial, 144, ... TitleIdx=0, Type=2, Data="%\0U\0S\0E\0R\0P\0R\0O\0F\0I\0L\0E\0%\0\\0L\0o\0c\0a\0l\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0H\0i\0s\0t\0o\0r\0y\0\0\0"}, 86, ) , Partial, 144, ... TitleIdx=0, Type=2, Data= (288, "History", Partial, 144, ... TitleIdx=0, Type=2, Data="%\0U\0S\0E\0R\0P\0R\0O\0F\0I\0L\0E\0%\0\\0L\0o\0c\0a\0l\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0H\0i\0s\0t\0o\0r\0y\0\0\0"}, 86, ) }, 86, ) == 0x0
 01895   428   NtClose  (288, ... ) == 0x0
 01896   428   NtOpenKey  (0xf, {24, 280, 0x40, 0, 0,  (0xf, {24, 280, 0x40, 0, 0, "Content"}, ... 288, ) }, ... 288, ) == 0x0
 01897   428   NtQueryValueKey  (288,  (288, "PerUserItem", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (288, "PerUserItem", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) }, 16, ) == 0x0
 01898   428   NtClose  (288, ... ) == 0x0
 01899   428   NtOpenKey  (0xf, {24, 280, 0x40, 0, 0,  (0xf, {24, 280, 0x40, 0, 0, "Content"}, ... 288, ) }, ... 288, ) == 0x0
 01900   428   NtOpenThreadToken  (-2, 0xc, 1, ... ) == STATUS_NO_TOKEN
 01901   428   NtCreateSemaphore  (0x1f0003, {24, 52, 0x80, 1382696, 0,  (0x1f0003, {24, 52, 0x80, 1382696, 0, "shell.{210A4BA0-3AEA-1069-A2D9-08002B30309D}"}, 0, 2147483647, ... 292, ) }, 0, 2147483647, ... 292, ) == STATUS_OBJECT_NAME_EXISTS
 01902   428   NtReleaseSemaphore  (292, 1, ... 0, ) == 0x0
 01903   428   NtWaitForSingleObject  (292, 0, {0, 0}, ... ) == 0x0
 01904   428   NtCreateKey  (0x2000000, {24, 60, 0x40, 0, 0,  (0x2000000, {24, 60, 0x40, 0, 0, "Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders"}, 0, 0x0, 0, ... 296, 2, ) }, 0, 0x0, 0, ... 296, 2, ) == 0x0
 01905   428   NtQueryValueKey  (296,  (296, "Cache", Partial, 144, ... TitleIdx=0, Type=2, Data="%\0U\0S\0E\0R\0P\0R\0O\0F\0I\0L\0E\0%\0\\0L\0o\0c\0a\0l\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0T\0e\0m\0p\0o\0r\0a\0r\0y\0 \0I\0n\0t\0e\0r\0n\0e\0t\0 \0F\0i\0l\0e\0s\0\0\0"}, 120, ) , Partial, 144, ... TitleIdx=0, Type=2, Data= (296, "Cache", Partial, 144, ... TitleIdx=0, Type=2, Data="%\0U\0S\0E\0R\0P\0R\0O\0F\0I\0L\0E\0%\0\\0L\0o\0c\0a\0l\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0T\0e\0m\0p\0o\0r\0a\0r\0y\0 \0I\0n\0t\0e\0r\0n\0e\0t\0 \0F\0i\0l\0e\0s\0\0\0"}, 120, ) }, 120, ) == 0x0
 01906   428   NtClose  (296, ... ) == 0x0
 01907   428   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\Documents and Settings\SRI-user\Local Settings\Temporary Internet Files"}, 1215344, ... ) }, 1215344, ... ) == 0x0
 01908   428   NtCreateKey  (0x2000000, {24, 60, 0x40, 0, 0,  (0x2000000, {24, 60, 0x40, 0, 0, "Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders"}, 0, 0x0, 0, ... 296, 2, ) }, 0, 0x0, 0, ... 296, 2, ) == 0x0
 01909   428   NtSetValueKey  (296,  (296, "Cache", 0, 1, "C\0:\0\\0D\0o\0c\0u\0m\0e\0n\0t\0s\0 \0a\0n\0d\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0S\0R\0I\0-\0u\0s\0e\0r\0\\0L\0o\0c\0a\0l\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0T\0e\0m\0p\0o\0r\0a\0r\0y\0 \0I\0n\0t\0e\0r\0n\0e\0t\0 \0F\0i\0l\0e\0s\0\0\0", 150, ... ) , 0, 1,  (296, "Cache", 0, 1, "C\0:\0\\0D\0o\0c\0u\0m\0e\0n\0t\0s\0 \0a\0n\0d\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0S\0R\0I\0-\0u\0s\0e\0r\0\\0L\0o\0c\0a\0l\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0T\0e\0m\0p\0o\0r\0a\0r\0y\0 \0I\0n\0t\0e\0r\0n\0e\0t\0 \0F\0i\0l\0e\0s\0\0\0", 150, ... ) , 150, ... ) == 0x0
 01910   428   NtClose  (296, ... ) == 0x0
 01911   428   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\Documents and Settings\SRI-user\Local Settings\Temporary Internet Files"}, 1216676, ... ) }, 1216676, ... ) == 0x0
 01912   428   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\Documents and Settings\SRI-user\Local Settings\Temporary Internet Files"}, 1216408, ... ) }, 1216408, ... ) == 0x0
 01913   428   NtOpenFile  (0x100100, {24, 0, 0x40, 0, 0,  (0x100100, {24, 0, 0x40, 0, 0, "\??\C:\Documents and Settings\SRI-user\Local Settings\Temporary Internet Files"}, 7, 2113568, ... 296, {status=0x0, info=1}, ) }, 7, 2113568, ... 296, {status=0x0, info=1}, ) == 0x0
 01914   428   NtSetInformationFile  (296, 1216384, 40, Basic, ... {status=0x0, info=0}, ) == 0x0
 01915   428   NtClose  (296, ... ) == 0x0
 01916   428   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\Documents and Settings\SRI-user\Local Settings\Temporary Internet Files\desktop.ini"}, 1216408, ... ) }, 1216408, ... ) == 0x0
 01917   428   NtQueryValueKey  (288,  (288, "CachePrefix", Partial, 144, ... TitleIdx=0, Type=1, Data="\0\0"}, 14, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (288, "CachePrefix", Partial, 144, ... TitleIdx=0, Type=1, Data="\0\0"}, 14, ) }, 14, ) == 0x0
 01918   428   NtQueryValueKey  (288,  (288, "CachePrefix", Partial, 144, ... TitleIdx=0, Type=1, Data="\0\0"}, 14, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (288, "CachePrefix", Partial, 144, ... TitleIdx=0, Type=1, Data="\0\0"}, 14, ) }, 14, ) == 0x0
 01919   428   NtQueryValueKey  (288,  (288, "CacheLimit", Partial, 144, ... TitleIdx=0, Type=4, Data="\251~\1\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (288, "CacheLimit", Partial, 144, ... TitleIdx=0, Type=4, Data="\251~\1\0"}, 16, ) }, 16, ) == 0x0
 01920   428   NtOpenKey  (0xf, {24, 28, 0x40, 0, 0,  (0xf, {24, 28, 0x40, 0, 0, "Software\Microsoft\Windows\CurrentVersion\Internet Settings\Cache"}, ... 296, ) }, ... 296, ) == 0x0
 01921   428   NtOpenKey  (0xf, {24, 296, 0x40, 0, 0,  (0xf, {24, 296, 0x40, 0, 0, "Paths"}, ... 300, ) }, ... 300, ) == 0x0
 01922   428   NtOpenKey  (0xf, {24, 300, 0x40, 0, 0,  (0xf, {24, 300, 0x40, 0, 0, "Path1"}, ... 304, ) }, ... 304, ) == 0x0
 01923   428   NtOpenKey  (0xf, {24, 300, 0x40, 0, 0,  (0xf, {24, 300, 0x40, 0, 0, "Path2"}, ... 308, ) }, ... 308, ) == 0x0
 01924   428   NtOpenKey  (0xf, {24, 300, 0x40, 0, 0,  (0xf, {24, 300, 0x40, 0, 0, "Path3"}, ... 312, ) }, ... 312, ) == 0x0
 01925   428   NtOpenKey  (0xf, {24, 300, 0x40, 0, 0,  (0xf, {24, 300, 0x40, 0, 0, "Path4"}, ... 316, ) }, ... 316, ) == 0x0
 01926   428   NtOpenKey  (0xf, {24, 296, 0x40, 0, 0,  (0xf, {24, 296, 0x40, 0, 0, "Special Paths"}, ... 320, ) }, ... 320, ) == 0x0
 01927   428   NtSetValueKey  (300,  (300, "Directory", 0, 1, "C\0:\0\\0D\0o\0c\0u\0m\0e\0n\0t\0s\0 \0a\0n\0d\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0S\0R\0I\0-\0u\0s\0e\0r\0\\0L\0o\0c\0a\0l\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0T\0e\0m\0p\0o\0r\0a\0r\0y\0 \0I\0n\0t\0e\0r\0n\0e\0t\0 \0F\0i\0l\0e\0s\0\\0C\0o\0n\0t\0e\0n\0t\0.\0I\0E\05\0\0\0", 174, ... ) , 0, 1,  (300, "Directory", 0, 1, "C\0:\0\\0D\0o\0c\0u\0m\0e\0n\0t\0s\0 \0a\0n\0d\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0S\0R\0I\0-\0u\0s\0e\0r\0\\0L\0o\0c\0a\0l\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0T\0e\0m\0p\0o\0r\0a\0r\0y\0 \0I\0n\0t\0e\0r\0n\0e\0t\0 \0F\0i\0l\0e\0s\0\\0C\0o\0n\0t\0e\0n\0t\0.\0I\0E\05\0\0\0", 174, ... ) , 174, ... ) == 0x0
 01928   428   NtSetValueKey  (300,  (300, "Paths", 0, 4, "\4\0\0\0", 4, ... ) , 0, 4,  (300, "Paths", 0, 4, "\4\0\0\0", 4, ... ) , 4, ... ) == 0x0
 01929   428   NtSetValueKey  (304,  (304, "CachePath", 0, 1, "C\0:\0\\0D\0o\0c\0u\0m\0e\0n\0t\0s\0 \0a\0n\0d\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0S\0R\0I\0-\0u\0s\0e\0r\0\\0L\0o\0c\0a\0l\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0T\0e\0m\0p\0o\0r\0a\0r\0y\0 \0I\0n\0t\0e\0r\0n\0e\0t\0 \0F\0i\0l\0e\0s\0\\0C\0o\0n\0t\0e\0n\0t\0.\0I\0E\05\0\\0C\0a\0c\0h\0e\01\0\0\0", 188, ... ) , 0, 1,  (304, "CachePath", 0, 1, "C\0:\0\\0D\0o\0c\0u\0m\0e\0n\0t\0s\0 \0a\0n\0d\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0S\0R\0I\0-\0u\0s\0e\0r\0\\0L\0o\0c\0a\0l\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0T\0e\0m\0p\0o\0r\0a\0r\0y\0 \0I\0n\0t\0e\0r\0n\0e\0t\0 \0F\0i\0l\0e\0s\0\\0C\0o\0n\0t\0e\0n\0t\0.\0I\0E\05\0\\0C\0a\0c\0h\0e\01\0\0\0", 188, ... ) , 188, ... ) == 0x0
 01930   428   NtSetValueKey  (308,  (308, "CachePath", 0, 1, "C\0:\0\\0D\0o\0c\0u\0m\0e\0n\0t\0s\0 \0a\0n\0d\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0S\0R\0I\0-\0u\0s\0e\0r\0\\0L\0o\0c\0a\0l\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0T\0e\0m\0p\0o\0r\0a\0r\0y\0 \0I\0n\0t\0e\0r\0n\0e\0t\0 \0F\0i\0l\0e\0s\0\\0C\0o\0n\0t\0e\0n\0t\0.\0I\0E\05\0\\0C\0a\0c\0h\0e\02\0\0\0", 188, ... ) , 0, 1,  (308, "CachePath", 0, 1, "C\0:\0\\0D\0o\0c\0u\0m\0e\0n\0t\0s\0 \0a\0n\0d\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0S\0R\0I\0-\0u\0s\0e\0r\0\\0L\0o\0c\0a\0l\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0T\0e\0m\0p\0o\0r\0a\0r\0y\0 \0I\0n\0t\0e\0r\0n\0e\0t\0 \0F\0i\0l\0e\0s\0\\0C\0o\0n\0t\0e\0n\0t\0.\0I\0E\05\0\\0C\0a\0c\0h\0e\02\0\0\0", 188, ... ) , 188, ... ) == 0x0
 01931   428   NtSetValueKey  (312,  (312, "CachePath", 0, 1, "C\0:\0\\0D\0o\0c\0u\0m\0e\0n\0t\0s\0 \0a\0n\0d\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0S\0R\0I\0-\0u\0s\0e\0r\0\\0L\0o\0c\0a\0l\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0T\0e\0m\0p\0o\0r\0a\0r\0y\0 \0I\0n\0t\0e\0r\0n\0e\0t\0 \0F\0i\0l\0e\0s\0\\0C\0o\0n\0t\0e\0n\0t\0.\0I\0E\05\0\\0C\0a\0c\0h\0e\03\0\0\0", 188, ... ) , 0, 1,  (312, "CachePath", 0, 1, "C\0:\0\\0D\0o\0c\0u\0m\0e\0n\0t\0s\0 \0a\0n\0d\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0S\0R\0I\0-\0u\0s\0e\0r\0\\0L\0o\0c\0a\0l\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0T\0e\0m\0p\0o\0r\0a\0r\0y\0 \0I\0n\0t\0e\0r\0n\0e\0t\0 \0F\0i\0l\0e\0s\0\\0C\0o\0n\0t\0e\0n\0t\0.\0I\0E\05\0\\0C\0a\0c\0h\0e\03\0\0\0", 188, ... ) , 188, ... ) == 0x0
 01932   428   NtSetValueKey  (316,  (316, "CachePath", 0, 1, "C\0:\0\\0D\0o\0c\0u\0m\0e\0n\0t\0s\0 \0a\0n\0d\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0S\0R\0I\0-\0u\0s\0e\0r\0\\0L\0o\0c\0a\0l\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0T\0e\0m\0p\0o\0r\0a\0r\0y\0 \0I\0n\0t\0e\0r\0n\0e\0t\0 \0F\0i\0l\0e\0s\0\\0C\0o\0n\0t\0e\0n\0t\0.\0I\0E\05\0\\0C\0a\0c\0h\0e\04\0\0\0", 188, ... ) , 0, 1,  (316, "CachePath", 0, 1, "C\0:\0\\0D\0o\0c\0u\0m\0e\0n\0t\0s\0 \0a\0n\0d\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0S\0R\0I\0-\0u\0s\0e\0r\0\\0L\0o\0c\0a\0l\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0T\0e\0m\0p\0o\0r\0a\0r\0y\0 \0I\0n\0t\0e\0r\0n\0e\0t\0 \0F\0i\0l\0e\0s\0\\0C\0o\0n\0t\0e\0n\0t\0.\0I\0E\05\0\\0C\0a\0c\0h\0e\04\0\0\0", 188, ... ) , 188, ... ) == 0x0
 01933   428   NtSetValueKey  (304,  (304, "CacheLimit", 0, 4, "\252_\0\0", 4, ... ) , 0, 4,  (304, "CacheLimit", 0, 4, "\252_\0\0", 4, ... ) , 4, ... ) == 0x0
 01934   428   NtSetValueKey  (308,  (308, "CacheLimit", 0, 4, "\252_\0\0", 4, ... ) , 0, 4,  (308, "CacheLimit", 0, 4, "\252_\0\0", 4, ... ) , 4, ... ) == 0x0
 01935   428   NtSetValueKey  (312,  (312, "CacheLimit", 0, 4, "\252_\0\0", 4, ... ) , 0, 4,  (312, "CacheLimit", 0, 4, "\252_\0\0", 4, ... ) , 4, ... ) == 0x0
 01936   428   NtSetValueKey  (316,  (316, "CacheLimit", 0, 4, "\252_\0\0", 4, ... ) , 0, 4,  (316, "CacheLimit", 0, 4, "\252_\0\0", 4, ... ) , 4, ... ) == 0x0
 01937   428   NtClose  (316, ... ) == 0x0
 01938   428   NtClose  (312, ... ) == 0x0
 01939   428   NtClose  (308, ... ) == 0x0
 01940   428   NtClose  (304, ... ) == 0x0
 01941   428   NtClose  (300, ... ) == 0x0
 01942   428   NtClose  (320, ... ) == 0x0
 01943   428   NtClose  (296, ... ) == 0x0
 01944   428   NtOpenKey  (0xf, {24, 280, 0x40, 0, 0,  (0xf, {24, 280, 0x40, 0, 0, "Cookies"}, ... 296, ) }, ... 296, ) == 0x0
 01945   428   NtQueryValueKey  (296,  (296, "PerUserItem", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (296, "PerUserItem", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) }, 16, ) == 0x0
 01946   428   NtClose  (296, ... ) == 0x0
 01947   428   NtClose  (288, ... ) == 0x0
 01948   428   NtOpenKey  (0xf, {24, 280, 0x40, 0, 0,  (0xf, {24, 280, 0x40, 0, 0, "Cookies"}, ... 288, ) }, ... 288, ) == 0x0
 01949   428   NtOpenThreadToken  (-2, 0xc, 1, ... ) == STATUS_NO_TOKEN
 01950   428   NtReleaseSemaphore  (292, 1, ... 0, ) == 0x0
 01951   428   NtWaitForSingleObject  (292, 0, {0, 0}, ... ) == 0x0
 01952   428   NtCreateKey  (0x2000000, {24, 60, 0x40, 0, 0,  (0x2000000, {24, 60, 0x40, 0, 0, "Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders"}, 0, 0x0, 0, ... 296, 2, ) }, 0, 0x0, 0, ... 296, 2, ) == 0x0
 01953   428   NtQueryValueKey  (296,  (296, "Cookies", Partial, 144, ... TitleIdx=0, Type=2, Data="%\0U\0S\0E\0R\0P\0R\0O\0F\0I\0L\0E\0%\0\\0C\0o\0o\0k\0i\0e\0s\0\0\0"}, 56, ) , Partial, 144, ... TitleIdx=0, Type=2, Data= (296, "Cookies", Partial, 144, ... TitleIdx=0, Type=2, Data="%\0U\0S\0E\0R\0P\0R\0O\0F\0I\0L\0E\0%\0\\0C\0o\0o\0k\0i\0e\0s\0\0\0"}, 56, ) }, 56, ) == 0x0
 01954   428   NtClose  (296, ... ) == 0x0
 01955   428   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\Documents and Settings\SRI-user\Cookies"}, 1215344, ... ) }, 1215344, ... ) == 0x0
 01956   428   NtCreateKey  (0x2000000, {24, 60, 0x40, 0, 0,  (0x2000000, {24, 60, 0x40, 0, 0, "Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders"}, 0, 0x0, 0, ... 296, 2, ) }, 0, 0x0, 0, ... 296, 2, ) == 0x0
 01957   428   NtSetValueKey  (296,  (296, "Cookies", 0, 1, "C\0:\0\\0D\0o\0c\0u\0m\0e\0n\0t\0s\0 \0a\0n\0d\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0S\0R\0I\0-\0u\0s\0e\0r\0\\0C\0o\0o\0k\0i\0e\0s\0\0\0", 86, ... ) , 0, 1,  (296, "Cookies", 0, 1, "C\0:\0\\0D\0o\0c\0u\0m\0e\0n\0t\0s\0 \0a\0n\0d\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0S\0R\0I\0-\0u\0s\0e\0r\0\\0C\0o\0o\0k\0i\0e\0s\0\0\0", 86, ... ) , 86, ... ) == 0x0
 01958   428   NtClose  (296, ... ) == 0x0
 01959   428   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\Documents and Settings\SRI-user\Cookies"}, 1216676, ... ) }, 1216676, ... ) == 0x0
 01960   428   NtQueryValueKey  (288,  (288, "CachePrefix", Partial, 144, ... TitleIdx=0, Type=1, Data="C\0o\0o\0k\0i\0e\0:\0\0\0"}, 28, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (288, "CachePrefix", Partial, 144, ... TitleIdx=0, Type=1, Data="C\0o\0o\0k\0i\0e\0:\0\0\0"}, 28, ) }, 28, ) == 0x0
 01961   428   NtQueryValueKey  (288,  (288, "CachePrefix", Partial, 144, ... TitleIdx=0, Type=1, Data="C\0o\0o\0k\0i\0e\0:\0\0\0"}, 28, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (288, "CachePrefix", Partial, 144, ... TitleIdx=0, Type=1, Data="C\0o\0o\0k\0i\0e\0:\0\0\0"}, 28, ) }, 28, ) == 0x0
 01962   428   NtQueryValueKey  (288,  (288, "CacheLimit", Partial, 144, ... TitleIdx=0, Type=4, Data="\0 \0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (288, "CacheLimit", Partial, 144, ... TitleIdx=0, Type=4, Data="\0 \0\0"}, 16, ) }, 16, ) == 0x0
 01963   428   NtOpenKey  (0xf, {24, 280, 0x40, 0, 0,  (0xf, {24, 280, 0x40, 0, 0, "History"}, ... 296, ) }, ... 296, ) == 0x0
 01964   428   NtQueryValueKey  (296,  (296, "PerUserItem", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (296, "PerUserItem", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) }, 16, ) == 0x0
 01965   428   NtClose  (296, ... ) == 0x0
 01966   428   NtClose  (288, ... ) == 0x0
 01967   428   NtOpenKey  (0xf, {24, 280, 0x40, 0, 0,  (0xf, {24, 280, 0x40, 0, 0, "History"}, ... 288, ) }, ... 288, ) == 0x0
 01968   428   NtOpenThreadToken  (-2, 0xc, 1, ... ) == STATUS_NO_TOKEN
 01969   428   NtReleaseSemaphore  (292, 1, ... 0, ) == 0x0
 01970   428   NtWaitForSingleObject  (292, 0, {0, 0}, ... ) == 0x0
 01971   428   NtCreateKey  (0x2000000, {24, 60, 0x40, 0, 0,  (0x2000000, {24, 60, 0x40, 0, 0, "Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders"}, 0, 0x0, 0, ... 296, 2, ) }, 0, 0x0, 0, ... 296, 2, ) == 0x0
 01972   428   NtQueryValueKey  (296,  (296, "History", Partial, 144, ... TitleIdx=0, Type=2, Data="%\0U\0S\0E\0R\0P\0R\0O\0F\0I\0L\0E\0%\0\\0L\0o\0c\0a\0l\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0H\0i\0s\0t\0o\0r\0y\0\0\0"}, 86, ) , Partial, 144, ... TitleIdx=0, Type=2, Data= (296, "History", Partial, 144, ... TitleIdx=0, Type=2, Data="%\0U\0S\0E\0R\0P\0R\0O\0F\0I\0L\0E\0%\0\\0L\0o\0c\0a\0l\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0H\0i\0s\0t\0o\0r\0y\0\0\0"}, 86, ) }, 86, ) == 0x0
 01973   428   NtClose  (296, ... ) == 0x0
 01974   428   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\Documents and Settings\SRI-user\Local Settings\History"}, 1215344, ... ) }, 1215344, ... ) == 0x0
 01975   428   NtCreateKey  (0x2000000, {24, 60, 0x40, 0, 0,  (0x2000000, {24, 60, 0x40, 0, 0, "Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders"}, 0, 0x0, 0, ... 296, 2, ) }, 0, 0x0, 0, ... 296, 2, ) == 0x0
 01976   428   NtSetValueKey  (296,  (296, "History", 0, 1, "C\0:\0\\0D\0o\0c\0u\0m\0e\0n\0t\0s\0 \0a\0n\0d\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0S\0R\0I\0-\0u\0s\0e\0r\0\\0L\0o\0c\0a\0l\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0H\0i\0s\0t\0o\0r\0y\0\0\0", 116, ... ) , 0, 1,  (296, "History", 0, 1, "C\0:\0\\0D\0o\0c\0u\0m\0e\0n\0t\0s\0 \0a\0n\0d\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0S\0R\0I\0-\0u\0s\0e\0r\0\\0L\0o\0c\0a\0l\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0H\0i\0s\0t\0o\0r\0y\0\0\0", 116, ... ) , 116, ... ) == 0x0
 01977   428   NtClose  (296, ... ) == 0x0
 01978   428   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\Documents and Settings\SRI-user\Local Settings\History"}, 1216676, ... ) }, 1216676, ... ) == 0x0
 01979   428   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\Documents and Settings\SRI-user\Local Settings\History"}, 1216408, ... ) }, 1216408, ... ) == 0x0
 01980   428   NtOpenFile  (0x100100, {24, 0, 0x40, 0, 0,  (0x100100, {24, 0, 0x40, 0, 0, "\??\C:\Documents and Settings\SRI-user\Local Settings\History"}, 7, 2113568, ... 296, {status=0x0, info=1}, ) }, 7, 2113568, ... 296, {status=0x0, info=1}, ) == 0x0
 01981   428   NtSetInformationFile  (296, 1216384, 40, Basic, ... {status=0x0, info=0}, ) == 0x0
 01982   428   NtClose  (296, ... ) == 0x0
 01983   428   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\Documents and Settings\SRI-user\Local Settings\History\desktop.ini"}, 1216408, ... ) }, 1216408, ... ) == 0x0
 01984   428   NtQueryValueKey  (288,  (288, "CachePrefix", Partial, 144, ... TitleIdx=0, Type=1, Data="V\0i\0s\0i\0t\0e\0d\0:\0\0\0"}, 30, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (288, "CachePrefix", Partial, 144, ... TitleIdx=0, Type=1, Data="V\0i\0s\0i\0t\0e\0d\0:\0\0\0"}, 30, ) }, 30, ) == 0x0
 01985   428   NtQueryValueKey  (288,  (288, "CachePrefix", Partial, 144, ... TitleIdx=0, Type=1, Data="V\0i\0s\0i\0t\0e\0d\0:\0\0\0"}, 30, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (288, "CachePrefix", Partial, 144, ... TitleIdx=0, Type=1, Data="V\0i\0s\0i\0t\0e\0d\0:\0\0\0"}, 30, ) }, 30, ) == 0x0
 01986   428   NtQueryValueKey  (288,  (288, "CacheLimit", Partial, 144, ... TitleIdx=0, Type=4, Data="\0 \0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (288, "CacheLimit", Partial, 144, ... TitleIdx=0, Type=4, Data="\0 \0\0"}, 16, ) }, 16, ) == 0x0
 01987   428   NtClose  (288, ... ) == 0x0
 01988   428   NtClose  (284, ... ) == 0x0
 01989   428   NtClose  (276, ... ) == 0x0
 01990   428   NtClose  (280, ... ) == 0x0
 01991   428   NtClose  (272, ... ) == 0x0
 01992   428   NtOpenMutant  (0x100000, {24, 52, 0x0, 0, 0,  (0x100000, {24, 52, 0x0, 0, 0, "_!MSFTHISTORY!_"}, ... 272, ) }, ... 272, ) == 0x0
 01993   428   NtOpenMutant  (0x100000, {24, 52, 0x0, 0, 0,  (0x100000, {24, 52, 0x0, 0, 0, "c:!documents and settings!sri-user!local settings!temporary internet files!content.ie5!"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01994   428   NtCreateMutant  (0x1f0001, {24, 52, 0x80, 1382696, 0,  (0x1f0001, {24, 52, 0x80, 1382696, 0, "c:!documents and settings!sri-user!local settings!temporary internet files!content.ie5!"}, 0, ... 280, ) }, 0, ... 280, ) == 0x0
 01995   428   NtWaitForSingleObject  (280, 0, 0x0, ... ) == 0x0
 01996   428   NtOpenFile  (0x100001, {24, 0, 0x40, 0, 0,  (0x100001, {24, 0, 0x40, 0, 0, "\??\C:\Documents and Settings\SRI-user\Local Settings\Temporary Internet Files\Content.IE5\"}, 3, 8388641, ... 276, {status=0x0, info=1}, ) }, 3, 8388641, ... 276, {status=0x0, info=1}, ) == 0x0
 01997   428   NtQueryVolumeInformationFile  (276, 1217928, 24, Size, ... {status=0x0, info=24}, ) == 0x0
 01998   428   NtClose  (276, ... ) == 0x0
 01999   428   NtOpenFile  (0x100001, {24, 0, 0x40, 0, 0,  (0x100001, {24, 0, 0x40, 0, 0, "\??\C:\"}, 3, 8388641, ... 276, {status=0x0, info=1}, ) }, 3, 8388641, ... 276, {status=0x0, info=1}, ) == 0x0
 02000   428   NtQueryVolumeInformationFile  (276, 1217952, 24, Size, ... {status=0x0, info=24}, ) == 0x0
 02001   428   NtClose  (276, ... ) == 0x0
 02002   428   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\Documents and Settings\SRI-user\Local Settings\Temporary Internet Files\Content.IE5\"}, 1218280, ... ) }, 1218280, ... ) == 0x0
 02003   428   NtOpenFile  (0x100100, {24, 0, 0x40, 0, 0,  (0x100100, {24, 0, 0x40, 0, 0, "\??\C:\Documents and Settings\SRI-user\Local Settings\Temporary Internet Files\Content.IE5\"}, 7, 2113568, ... 276, {status=0x0, info=1}, ) }, 7, 2113568, ... 276, {status=0x0, info=1}, ) == 0x0
 02004   428   NtSetInformationFile  (276, 1218256, 40, Basic, ... {status=0x0, info=0}, ) == 0x0
 02005   428   NtClose  (276, ... ) == 0x0
 02006   428   NtCreateFile  (0xc0100080, {24, 0, 0x40, 1382696, 1218272,  (0xc0100080, {24, 0, 0x40, 1382696, 1218272, "\??\C:\Documents and Settings\SRI-user\Local Settings\Temporary Internet Files\Content.IE5\index.dat"}, 0x0, 0, 3, 3, 2144, 0, 0, ... 276, {status=0x0, info=1}, ) }, 0x0, 0, 3, 3, 2144, 0, 0, ... 276, {status=0x0, info=1}, ) == 0x0
 02007   428   NtSetInformationFile  (276, 1218324, 40, Basic, ... {status=0x0, info=0}, ) == 0x0
 02008   428   NtQueryInformationFile  (276, 1218324, 24, Standard, ... {status=0x0, info=24}, ) == 0x0
 02009   428   NtClose  (276, ... ) == 0x0
 02010   428   NtCreateFile  (0xc0100080, {24, 0, 0x40, 1382696, 1218256,  (0xc0100080, {24, 0, 0x40, 1382696, 1218256, "\??\C:\Documents and Settings\SRI-user\Local Settings\Temporary Internet Files\Content.IE5\index.dat"}, 0x0, 0, 3, 3, 2144, 0, 0, ... 276, {status=0x0, info=1}, ) }, 0x0, 0, 3, 3, 2144, 0, 0, ... 276, {status=0x0, info=1}, ) == 0x0
 02011   428   NtOpenSection  (0x2, {24, 52, 0x0, 0, 0,  (0x2, {24, 52, 0x0, 0, 0, "C:_Documents and Settings_SRI-user_Local Settings_Temporary Internet Files_Content.IE5_index.dat_32768"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02012   428   NtCreateSection  (0xf0007, {24, 52, 0x80, 1382696, 0,  (0xf0007, {24, 52, 0x80, 1382696, 0, "C:_Documents and Settings_SRI-user_Local Settings_Temporary Internet Files_Content.IE5_index.dat_32768"}, 0x0, 4, 134217728, 276, ... 284, ) }, 0x0, 4, 134217728, 276, ... 284, ) == 0x0
 02013   428   NtMapViewOfSection  (284, -1, (0x0), 0, 0, {0, 0}, 0, 1, 0, 4, ... (0x900000), {0, 0}, 32768, ) == 0x0
 02014   428   NtWaitForSingleObject  (280, 0, 0x0, ... ) == 0x0
 02015   428   NtQueryInformationFile  (276, 1218288, 24, Standard, ... {status=0x0, info=24}, ) == 0x0
 02016   428   NtReleaseMutant  (280, ... 0x0, ) == 0x0
 02017   428   NtReleaseMutant  (280, ... 0x0, ) == 0x0
 02018   428   NtOpenMutant  (0x100000, {24, 52, 0x0, 0, 0,  (0x100000, {24, 52, 0x0, 0, 0, "c:!documents and settings!sri-user!cookies!"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02019   428   NtCreateMutant  (0x1f0001, {24, 52, 0x80, 1382696, 0,  (0x1f0001, {24, 52, 0x80, 1382696, 0, "c:!documents and settings!sri-user!cookies!"}, 0, ... 288, ) }, 0, ... 288, ) == 0x0
 02020   428   NtWaitForSingleObject  (288, 0, 0x0, ... ) == 0x0
 02021   428   NtOpenFile  (0x100001, {24, 0, 0x40, 0, 0,  (0x100001, {24, 0, 0x40, 0, 0, "\??\C:\Documents and Settings\SRI-user\Cookies\"}, 3, 8388641, ... 296, {status=0x0, info=1}, ) }, 3, 8388641, ... 296, {status=0x0, info=1}, ) == 0x0
 02022   428   NtQueryVolumeInformationFile  (296, 1217928, 24, Size, ... {status=0x0, info=24}, ) == 0x0
 02023   428   NtClose  (296, ... ) == 0x0
 02024   428   NtOpenFile  (0x100001, {24, 0, 0x40, 0, 0,  (0x100001, {24, 0, 0x40, 0, 0, "\??\C:\"}, 3, 8388641, ... 296, {status=0x0, info=1}, ) }, 3, 8388641, ... 296, {status=0x0, info=1}, ) == 0x0
 02025   428   NtQueryVolumeInformationFile  (296, 1217952, 24, Size, ... {status=0x0, info=24}, ) == 0x0
 02026   428   NtClose  (296, ... ) == 0x0
 02027   428   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\Documents and Settings\SRI-user\Cookies\"}, 1218280, ... ) }, 1218280, ... ) == 0x0
 02028   428   NtOpenFile  (0x100100, {24, 0, 0x40, 0, 0,  (0x100100, {24, 0, 0x40, 0, 0, "\??\C:\Documents and Settings\SRI-user\Cookies\"}, 7, 2113568, ... 296, {status=0x0, info=1}, ) }, 7, 2113568, ... 296, {status=0x0, info=1}, ) == 0x0
 02029   428   NtSetInformationFile  (296, 1218256, 40, Basic, ... {status=0x0, info=0}, ) == 0x0
 02030   428   NtClose  (296, ... ) == 0x0
 02031   428   NtCreateFile  (0xc0100080, {24, 0, 0x40, 1382696, 1218272,  (0xc0100080, {24, 0, 0x40, 1382696, 1218272, "\??\C:\Documents and Settings\SRI-user\Cookies\index.dat"}, 0x0, 0, 3, 3, 2144, 0, 0, ... 296, {status=0x0, info=1}, ) }, 0x0, 0, 3, 3, 2144, 0, 0, ... 296, {status=0x0, info=1}, ) == 0x0
 02032   428   NtSetInformationFile  (296, 1218324, 40, Basic, ... {status=0x0, info=0}, ) == 0x0
 02033   428   NtQueryInformationFile  (296, 1218324, 24, Standard, ... {status=0x0, info=24}, ) == 0x0
 02034   428   NtClose  (296, ... ) == 0x0
 02035   428   NtCreateFile  (0xc0100080, {24, 0, 0x40, 1382696, 1218256,  (0xc0100080, {24, 0, 0x40, 1382696, 1218256, "\??\C:\Documents and Settings\SRI-user\Cookies\index.dat"}, 0x0, 0, 3, 3, 2144, 0, 0, ... 296, {status=0x0, info=1}, ) }, 0x0, 0, 3, 3, 2144, 0, 0, ... 296, {status=0x0, info=1}, ) == 0x0
 02036   428   NtOpenSection  (0x2, {24, 52, 0x0, 0, 0,  (0x2, {24, 52, 0x0, 0, 0, "C:_Documents and Settings_SRI-user_Cookies_index.dat_16384"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02037   428   NtCreateSection  (0xf0007, {24, 52, 0x80, 1382696, 0,  (0xf0007, {24, 52, 0x80, 1382696, 0, "C:_Documents and Settings_SRI-user_Cookies_index.dat_16384"}, 0x0, 4, 134217728, 296, ... 320, ) }, 0x0, 4, 134217728, 296, ... 320, ) == 0x0
 02038   428   NtMapViewOfSection  (320, -1, (0x0), 0, 0, {0, 0}, 0, 1, 0, 4, ... (0x910000), {0, 0}, 16384, ) == 0x0
 02039   428   NtReleaseMutant  (288, ... 0x0, ) == 0x0
 02040   428   NtOpenMutant  (0x100000, {24, 52, 0x0, 0, 0,  (0x100000, {24, 52, 0x0, 0, 0, "c:!documents and settings!sri-user!local settings!history!history.ie5!"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02041   428   NtCreateMutant  (0x1f0001, {24, 52, 0x80, 1382696, 0,  (0x1f0001, {24, 52, 0x80, 1382696, 0, "c:!documents and settings!sri-user!local settings!history!history.ie5!"}, 0, ... 300, ) }, 0, ... 300, ) == 0x0
 02042   428   NtWaitForSingleObject  (300, 0, 0x0, ... ) == 0x0
 02043   428   NtOpenFile  (0x100001, {24, 0, 0x40, 0, 0,  (0x100001, {24, 0, 0x40, 0, 0, "\??\C:\Documents and Settings\SRI-user\Local Settings\History\History.IE5\"}, 3, 8388641, ... 304, {status=0x0, info=1}, ) }, 3, 8388641, ... 304, {status=0x0, info=1}, ) == 0x0
 02044   428   NtQueryVolumeInformationFile  (304, 1217928, 24, Size, ... {status=0x0, info=24}, ) == 0x0
 02045   428   NtClose  (304, ... ) == 0x0
 02046   428   NtOpenFile  (0x100001, {24, 0, 0x40, 0, 0,  (0x100001, {24, 0, 0x40, 0, 0, "\??\C:\"}, 3, 8388641, ... 304, {status=0x0, info=1}, ) }, 3, 8388641, ... 304, {status=0x0, info=1}, ) == 0x0
 02047   428   NtQueryVolumeInformationFile  (304, 1217952, 24, Size, ... {status=0x0, info=24}, ) == 0x0
 02048   428   NtClose  (304, ... ) == 0x0
 02049   428   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\Documents and Settings\SRI-user\Local Settings\History\History.IE5\"}, 1218280, ... ) }, 1218280, ... ) == 0x0
 02050   428   NtOpenFile  (0x100100, {24, 0, 0x40, 0, 0,  (0x100100, {24, 0, 0x40, 0, 0, "\??\C:\Documents and Settings\SRI-user\Local Settings\History\History.IE5\"}, 7, 2113568, ... 304, {status=0x0, info=1}, ) }, 7, 2113568, ... 304, {status=0x0, info=1}, ) == 0x0
 02051   428   NtSetInformationFile  (304, 1218256, 40, Basic, ... {status=0x0, info=0}, ) == 0x0
 02052   428   NtClose  (304, ... ) == 0x0
 02053   428   NtCreateFile  (0xc0100080, {24, 0, 0x40, 1382696, 1218272,  (0xc0100080, {24, 0, 0x40, 1382696, 1218272, "\??\C:\Documents and Settings\SRI-user\Local Settings\History\History.IE5\index.dat"}, 0x0, 0, 3, 3, 2144, 0, 0, ... 304, {status=0x0, info=1}, ) }, 0x0, 0, 3, 3, 2144, 0, 0, ... 304, {status=0x0, info=1}, ) == 0x0
 02054   428   NtSetInformationFile  (304, 1218324, 40, Basic, ... {status=0x0, info=0}, ) == 0x0
 02055   428   NtQueryInformationFile  (304, 1218324, 24, Standard, ... {status=0x0, info=24}, ) == 0x0
 02056   428   NtClose  (304, ... ) == 0x0
 02057   428   NtCreateFile  (0xc0100080, {24, 0, 0x40, 1382696, 1218256,  (0xc0100080, {24, 0, 0x40, 1382696, 1218256, "\??\C:\Documents and Settings\SRI-user\Local Settings\History\History.IE5\index.dat"}, 0x0, 0, 3, 3, 2144, 0, 0, ... 304, {status=0x0, info=1}, ) }, 0x0, 0, 3, 3, 2144, 0, 0, ... 304, {status=0x0, info=1}, ) == 0x0
 02058   428   NtOpenSection  (0x2, {24, 52, 0x0, 0, 0,  (0x2, {24, 52, 0x0, 0, 0, "C:_Documents and Settings_SRI-user_Local Settings_History_History.IE5_index.dat_32768"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02059   428   NtCreateSection  (0xf0007, {24, 52, 0x80, 1382696, 0,  (0xf0007, {24, 52, 0x80, 1382696, 0, "C:_Documents and Settings_SRI-user_Local Settings_History_History.IE5_index.dat_32768"}, 0x0, 4, 134217728, 304, ... 308, ) }, 0x0, 4, 134217728, 304, ... 308, ) == 0x0
 02060   428   NtMapViewOfSection  (308, -1, (0x0), 0, 0, {0, 0}, 0, 1, 0, 4, ... (0x920000), {0, 0}, 32768, ) == 0x0
 02061   428   NtReleaseMutant  (300, ... 0x0, ) == 0x0
 02062   428   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\Documents and Settings\SRI-user\Local Settings\Temporary Internet Files\Content.IE5\"}, 1218336, ... ) }, 1218336, ... ) == 0x0
 02063   428   NtOpenFile  (0x100100, {24, 0, 0x40, 0, 0,  (0x100100, {24, 0, 0x40, 0, 0, "\??\C:\Documents and Settings\SRI-user\Local Settings\Temporary Internet Files\Content.IE5\"}, 7, 2113568, ... 312, {status=0x0, info=1}, ) }, 7, 2113568, ... 312, {status=0x0, info=1}, ) == 0x0
 02064   428   NtSetInformationFile  (312, 1218312, 40, Basic, ... {status=0x0, info=0}, ) == 0x0
 02065   428   NtClose  (312, ... ) == 0x0
 02066   428   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\Documents and Settings\SRI-user\Local Settings\Temporary Internet Files\Content.IE5\desktop.ini"}, 1218336, ... ) }, 1218336, ... ) == 0x0
 02067   428   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\Documents and Settings\SRI-user\Local Settings\History\History.IE5\"}, 1218336, ... ) }, 1218336, ... ) == 0x0
 02068   428   NtOpenFile  (0x100100, {24, 0, 0x40, 0, 0,  (0x100100, {24, 0, 0x40, 0, 0, "\??\C:\Documents and Settings\SRI-user\Local Settings\History\History.IE5\"}, 7, 2113568, ... 312, {status=0x0, info=1}, ) }, 7, 2113568, ... 312, {status=0x0, info=1}, ) == 0x0
 02069   428   NtSetInformationFile  (312, 1218312, 40, Basic, ... {status=0x0, info=0}, ) == 0x0
 02070   428   NtClose  (312, ... ) == 0x0
 02071   428   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\Documents and Settings\SRI-user\Local Settings\History\History.IE5\desktop.ini"}, 1218336, ... ) }, 1218336, ... ) == 0x0
 02072   428   NtWaitForSingleObject  (280, 0, 0x0, ... ) == 0x0
 02073   428   NtQueryInformationFile  (276, 1216720, 24, Standard, ... {status=0x0, info=24}, ) == 0x0
 02074   428   NtReleaseMutant  (280, ... 0x0, ) == 0x0
 02075   428   NtOpenKey  (0xf, {24, 60, 0x40, 0, 0,  (0xf, {24, 60, 0x40, 0, 0, "Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache"}, ... 312, ) }, ... 312, ) == 0x0
 02076   428   NtOpenKey  (0xf, {24, 312, 0x40, 0, 0,  (0xf, {24, 312, 0x40, 0, 0, "Extensible Cache"}, ... 316, ) }, ... 316, ) == 0x0
 02077   428   NtClose  (312, ... ) == 0x0
 02078   428   NtWaitForSingleObject  (272, 0, {-600000000, -1}, ... ) == 0x0
 02079   428   NtEnumerateKey  (316, 0, Basic, 288, ... {LastWrite={0x89210de2,0x1c79d95}, TitleIdx=0, Name= (316, 0, Basic, 288, ... {LastWrite={0x89210de2,0x1c79d95}, TitleIdx=0, Name="MSHist012007051420070521"}, 64, ) }, 64, ) == 0x0
 02080   428   NtOpenKey  (0xf, {24, 316, 0x40, 0, 0,  (0xf, {24, 316, 0x40, 0, 0, "MSHist012007051420070521"}, ... 312, ) }, ... 312, ) == 0x0
 02081   428   NtQueryValueKey  (312,  (312, "CacheRepair", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (312, "CacheRepair", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) }, 16, ) == 0x0
 02082   428   NtQueryValueKey  (312,  (312, "CachePath", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 02083   428   NtQueryValueKey  (312,  (312, "CachePath", Partial, 162, ... TitleIdx=0, Type=2, Data="%\0U\0S\0E\0R\0P\0R\0O\0F\0I\0L\0E\0%\0\\0L\0o\0c\0a\0l\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0H\0i\0s\0t\0o\0r\0y\0\\0H\0i\0s\0t\0o\0r\0y\0.\0I\0E\05\0\\0M\0S\0H\0i\0s\0t\00\01\02\00\00\07\00\05\01\04\02\00\00\07\00\05\02\01\0\\0\0\0"}, 162, ) , Partial, 162, ... TitleIdx=0, Type=2, Data= (312, "CachePath", Partial, 162, ... TitleIdx=0, Type=2, Data="%\0U\0S\0E\0R\0P\0R\0O\0F\0I\0L\0E\0%\0\\0L\0o\0c\0a\0l\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0H\0i\0s\0t\0o\0r\0y\0\\0H\0i\0s\0t\0o\0r\0y\0.\0I\0E\05\0\\0M\0S\0H\0i\0s\0t\00\01\02\00\00\07\00\05\01\04\02\00\00\07\00\05\02\01\0\\0\0\0"}, 162, ) }, 162, ) == 0x0
 02084   428   NtQueryValueKey  (312,  (312, "CachePath", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 02085   428   NtQueryValueKey  (312,  (312, "CachePath", Partial, 162, ... TitleIdx=0, Type=2, Data="%\0U\0S\0E\0R\0P\0R\0O\0F\0I\0L\0E\0%\0\\0L\0o\0c\0a\0l\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0H\0i\0s\0t\0o\0r\0y\0\\0H\0i\0s\0t\0o\0r\0y\0.\0I\0E\05\0\\0M\0S\0H\0i\0s\0t\00\01\02\00\00\07\00\05\01\04\02\00\00\07\00\05\02\01\0\\0\0\0"}, 162, ) , Partial, 162, ... TitleIdx=0, Type=2, Data= (312, "CachePath", Partial, 162, ... TitleIdx=0, Type=2, Data="%\0U\0S\0E\0R\0P\0R\0O\0F\0I\0L\0E\0%\0\\0L\0o\0c\0a\0l\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0H\0i\0s\0t\0o\0r\0y\0\\0H\0i\0s\0t\0o\0r\0y\0.\0I\0E\05\0\\0M\0S\0H\0i\0s\0t\00\01\02\00\00\07\00\05\01\04\02\00\00\07\00\05\02\01\0\\0\0\0"}, 162, ) }, 162, ) == 0x0
 02086   428   NtQueryValueKey  (312,  (312, "CachePrefix", Partial, 144, ... TitleIdx=0, Type=1, Data=":\02\00\00\07\00\05\01\04\02\00\00\07\00\05\02\01\0:\0 \0\0\0"}, 52, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (312, "CachePrefix", Partial, 144, ... TitleIdx=0, Type=1, Data=":\02\00\00\07\00\05\01\04\02\00\00\07\00\05\02\01\0:\0 \0\0\0"}, 52, ) }, 52, ) == 0x0
 02087   428   NtQueryValueKey  (312,  (312, "CachePrefix", Partial, 144, ... TitleIdx=0, Type=1, Data=":\02\00\00\07\00\05\01\04\02\00\00\07\00\05\02\01\0:\0 \0\0\0"}, 52, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (312, "CachePrefix", Partial, 144, ... TitleIdx=0, Type=1, Data=":\02\00\00\07\00\05\01\04\02\00\00\07\00\05\02\01\0:\0 \0\0\0"}, 52, ) }, 52, ) == 0x0
 02088   428   NtQueryValueKey  (312,  (312, "CacheLimit", Partial, 144, ... TitleIdx=0, Type=4, Data="\0 \0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (312, "CacheLimit", Partial, 144, ... TitleIdx=0, Type=4, Data="\0 \0\0"}, 16, ) }, 16, ) == 0x0
 02089   428   NtQueryValueKey  (312,  (312, "CacheOptions", Partial, 144, ... TitleIdx=0, Type=4, Data="\13\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (312, "CacheOptions", Partial, 144, ... TitleIdx=0, Type=4, Data="\13\0\0\0"}, 16, ) }, 16, ) == 0x0
 02090   428   NtClose  (312, ... ) == 0x0
 02091   428   NtEnumerateKey  (316, 1, Basic, 288, ... {LastWrite={0xfe4bb184,0x1c7a3a9}, TitleIdx=0, Name= (316, 1, Basic, 288, ... {LastWrite={0xfe4bb184,0x1c7a3a9}, TitleIdx=0, Name="MSHist012007052120070528"}, 64, ) }, 64, ) == 0x0
 02092   428   NtOpenKey  (0xf, {24, 316, 0x40, 0, 0,  (0xf, {24, 316, 0x40, 0, 0, "MSHist012007052120070528"}, ... 312, ) }, ... 312, ) == 0x0
 02093   428   NtQueryValueKey  (312,  (312, "CacheRepair", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (312, "CacheRepair", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) }, 16, ) == 0x0
 02094   428   NtQueryValueKey  (312,  (312, "CachePath", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 02095   428   NtQueryValueKey  (312,  (312, "CachePath", Partial, 162, ... TitleIdx=0, Type=2, Data="%\0U\0S\0E\0R\0P\0R\0O\0F\0I\0L\0E\0%\0\\0L\0o\0c\0a\0l\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0H\0i\0s\0t\0o\0r\0y\0\\0H\0i\0s\0t\0o\0r\0y\0.\0I\0E\05\0\\0M\0S\0H\0i\0s\0t\00\01\02\00\00\07\00\05\02\01\02\00\00\07\00\05\02\08\0\\0\0\0"}, 162, ) , Partial, 162, ... TitleIdx=0, Type=2, Data= (312, "CachePath", Partial, 162, ... TitleIdx=0, Type=2, Data="%\0U\0S\0E\0R\0P\0R\0O\0F\0I\0L\0E\0%\0\\0L\0o\0c\0a\0l\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0H\0i\0s\0t\0o\0r\0y\0\\0H\0i\0s\0t\0o\0r\0y\0.\0I\0E\05\0\\0M\0S\0H\0i\0s\0t\00\01\02\00\00\07\00\05\02\01\02\00\00\07\00\05\02\08\0\\0\0\0"}, 162, ) }, 162, ) == 0x0
 02096   428   NtQueryValueKey  (312,  (312, "CachePath", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 02097   428   NtQueryValueKey  (312,  (312, "CachePath", Partial, 162, ... TitleIdx=0, Type=2, Data="%\0U\0S\0E\0R\0P\0R\0O\0F\0I\0L\0E\0%\0\\0L\0o\0c\0a\0l\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0H\0i\0s\0t\0o\0r\0y\0\\0H\0i\0s\0t\0o\0r\0y\0.\0I\0E\05\0\\0M\0S\0H\0i\0s\0t\00\01\02\00\00\07\00\05\02\01\02\00\00\07\00\05\02\08\0\\0\0\0"}, 162, ) , Partial, 162, ... TitleIdx=0, Type=2, Data= (312, "CachePath", Partial, 162, ... TitleIdx=0, Type=2, Data="%\0U\0S\0E\0R\0P\0R\0O\0F\0I\0L\0E\0%\0\\0L\0o\0c\0a\0l\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0H\0i\0s\0t\0o\0r\0y\0\\0H\0i\0s\0t\0o\0r\0y\0.\0I\0E\05\0\\0M\0S\0H\0i\0s\0t\00\01\02\00\00\07\00\05\02\01\02\00\00\07\00\05\02\08\0\\0\0\0"}, 162, ) }, 162, ) == 0x0
 02098   428   NtQueryValueKey  (312,  (312, "CachePrefix", Partial, 144, ... TitleIdx=0, Type=1, Data=":\02\00\00\07\00\05\02\01\02\00\00\07\00\05\02\08\0:\0 \0\0\0"}, 52, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (312, "CachePrefix", Partial, 144, ... TitleIdx=0, Type=1, Data=":\02\00\00\07\00\05\02\01\02\00\00\07\00\05\02\08\0:\0 \0\0\0"}, 52, ) }, 52, ) == 0x0
 02099   428   NtQueryValueKey  (312,  (312, "CachePrefix", Partial, 144, ... TitleIdx=0, Type=1, Data=":\02\00\00\07\00\05\02\01\02\00\00\07\00\05\02\08\0:\0 \0\0\0"}, 52, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (312, "CachePrefix", Partial, 144, ... TitleIdx=0, Type=1, Data=":\02\00\00\07\00\05\02\01\02\00\00\07\00\05\02\08\0:\0 \0\0\0"}, 52, ) }, 52, ) == 0x0
 02100   428   NtQueryValueKey  (312,  (312, "CacheLimit", Partial, 144, ... TitleIdx=0, Type=4, Data="\0 \0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (312, "CacheLimit", Partial, 144, ... TitleIdx=0, Type=4, Data="\0 \0\0"}, 16, ) }, 16, ) == 0x0
 02101   428   NtQueryValueKey  (312,  (312, "CacheOptions", Partial, 144, ... TitleIdx=0, Type=4, Data="\13\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (312, "CacheOptions", Partial, 144, ... TitleIdx=0, Type=4, Data="\13\0\0\0"}, 16, ) }, 16, ) == 0x0
 02102   428   NtClose  (312, ... ) == 0x0
 02103   428   NtEnumerateKey  (316, 2, Basic, 288, ... {LastWrite={0xfe4e13de,0x1c7a3a9}, TitleIdx=0, Name= (316, 2, Basic, 288, ... {LastWrite={0xfe4e13de,0x1c7a3a9}, TitleIdx=0, Name="MSHist012007053120070601"}, 64, ) }, 64, ) == 0x0
 02104   428   NtOpenKey  (0xf, {24, 316, 0x40, 0, 0,  (0xf, {24, 316, 0x40, 0, 0, "MSHist012007053120070601"}, ... 312, ) }, ... 312, ) == 0x0
 02105   428   NtQueryValueKey  (312,  (312, "CacheRepair", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (312, "CacheRepair", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) }, 16, ) == 0x0
 02106   428   NtQueryValueKey  (312,  (312, "CachePath", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 02107   428   NtQueryValueKey  (312,  (312, "CachePath", Partial, 162, ... TitleIdx=0, Type=2, Data="%\0U\0S\0E\0R\0P\0R\0O\0F\0I\0L\0E\0%\0\\0L\0o\0c\0a\0l\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0H\0i\0s\0t\0o\0r\0y\0\\0H\0i\0s\0t\0o\0r\0y\0.\0I\0E\05\0\\0M\0S\0H\0i\0s\0t\00\01\02\00\00\07\00\05\03\01\02\00\00\07\00\06\00\01\0\\0\0\0"}, 162, ) , Partial, 162, ... TitleIdx=0, Type=2, Data= (312, "CachePath", Partial, 162, ... TitleIdx=0, Type=2, Data="%\0U\0S\0E\0R\0P\0R\0O\0F\0I\0L\0E\0%\0\\0L\0o\0c\0a\0l\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0H\0i\0s\0t\0o\0r\0y\0\\0H\0i\0s\0t\0o\0r\0y\0.\0I\0E\05\0\\0M\0S\0H\0i\0s\0t\00\01\02\00\00\07\00\05\03\01\02\00\00\07\00\06\00\01\0\\0\0\0"}, 162, ) }, 162, ) == 0x0
 02108   428   NtQueryValueKey  (312,  (312, "CachePath", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 02109   428   NtQueryValueKey  (312,  (312, "CachePath", Partial, 162, ... TitleIdx=0, Type=2, Data="%\0U\0S\0E\0R\0P\0R\0O\0F\0I\0L\0E\0%\0\\0L\0o\0c\0a\0l\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0H\0i\0s\0t\0o\0r\0y\0\\0H\0i\0s\0t\0o\0r\0y\0.\0I\0E\05\0\\0M\0S\0H\0i\0s\0t\00\01\02\00\00\07\00\05\03\01\02\00\00\07\00\06\00\01\0\\0\0\0"}, 162, ) , Partial, 162, ... TitleIdx=0, Type=2, Data= (312, "CachePath", Partial, 162, ... TitleIdx=0, Type=2, Data="%\0U\0S\0E\0R\0P\0R\0O\0F\0I\0L\0E\0%\0\\0L\0o\0c\0a\0l\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0H\0i\0s\0t\0o\0r\0y\0\\0H\0i\0s\0t\0o\0r\0y\0.\0I\0E\05\0\\0M\0S\0H\0i\0s\0t\00\01\02\00\00\07\00\05\03\01\02\00\00\07\00\06\00\01\0\\0\0\0"}, 162, ) }, 162, ) == 0x0
 02110   428   NtQueryValueKey  (312,  (312, "CachePrefix", Partial, 144, ... TitleIdx=0, Type=1, Data=":\02\00\00\07\00\05\03\01\02\00\00\07\00\06\00\01\0:\0 \0\0\0"}, 52, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (312, "CachePrefix", Partial, 144, ... TitleIdx=0, Type=1, Data=":\02\00\00\07\00\05\03\01\02\00\00\07\00\06\00\01\0:\0 \0\0\0"}, 52, ) }, 52, ) == 0x0
 02111   428   NtQueryValueKey  (312,  (312, "CachePrefix", Partial, 144, ... TitleIdx=0, Type=1, Data=":\02\00\00\07\00\05\03\01\02\00\00\07\00\06\00\01\0:\0 \0\0\0"}, 52, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (312, "CachePrefix", Partial, 144, ... TitleIdx=0, Type=1, Data=":\02\00\00\07\00\05\03\01\02\00\00\07\00\06\00\01\0:\0 \0\0\0"}, 52, ) }, 52, ) == 0x0
 02112   428   NtQueryValueKey  (312,  (312, "CacheLimit", Partial, 144, ... TitleIdx=0, Type=4, Data="\0 \0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (312, "CacheLimit", Partial, 144, ... TitleIdx=0, Type=4, Data="\0 \0\0"}, 16, ) }, 16, ) == 0x0
 02113   428   NtQueryValueKey  (312,  (312, "CacheOptions", Partial, 144, ... TitleIdx=0, Type=4, Data="\13\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (312, "CacheOptions", Partial, 144, ... TitleIdx=0, Type=4, Data="\13\0\0\0"}, 16, ) }, 16, ) == 0x0
 02114   428   NtClose  (312, ... ) == 0x0
 02115   428   NtEnumerateKey  (316, 3, Basic, 288, ... ) == STATUS_NO_MORE_ENTRIES
 02116   428   NtReleaseMutant  (272, ... 0x0, ) == 0x0
 02117   428   NtClose  (316, ... ) == 0x0
 02118   428   NtWaitForSingleObject  (280, 0, 0x0, ... ) == 0x0
 02119   428   NtQueryInformationFile  (276, 1218648, 24, Standard, ... {status=0x0, info=24}, ) == 0x0
 02120   428   NtReleaseMutant  (280, ... 0x0, ) == 0x0
 02121   428   NtWaitForSingleObject  (280, 0, 0x0, ... ) == 0x0
 02122   428   NtQueryInformationFile  (276, 1216676, 24, Standard, ... {status=0x0, info=24}, ) == 0x0
 02123   428   NtReleaseMutant  (280, ... 0x0, ) == 0x0
 02124   428   NtWaitForSingleObject  (300, 0, 0x0, ... ) == 0x0
 02125   428   NtQueryInformationFile  (304, 1218616, 24, Standard, ... {status=0x0, info=24}, ) == 0x0
 02126   428   NtReleaseMutant  (300, ... 0x0, ) == 0x0
 02127   428   NtCreateKey  (0x2001f, {24, 60, 0x40, 0, 0,  (0x2001f, {24, 60, 0x40, 0, 0, "Software\Microsoft\Windows\CurrentVersion\Webcheck\Store.1"}, 0, 0x0, 0, ... 316, 2, ) }, 0, 0x0, 0, ... 316, 2, ) == 0x0
 02128   428   NtQueryKey  (316, 4, 176, ... {key info, class 4, size 40}, 40, ) == 0x0
 02129   428   NtEnumerateKey  (316, 0, Basic, 288, ... {LastWrite={0x904d790a,0x1c7399c}, TitleIdx=0, Name= (316, 0, Basic, 288, ... {LastWrite={0x904d790a,0x1c7399c}, TitleIdx=0, Name="{904B16B0-399C-01C7-0000-0000AA9DDD4A}"}, 92, ) }, 92, ) == 0x0
 02130   428   NtOpenKey  (0x2001f, {24, 60, 0x40, 0, 0,  (0x2001f, {24, 60, 0x40, 0, 0, "Software\Microsoft\Windows\CurrentVersion\Webcheck\Store.1\{904B16B0-399C-01C7-0000-0000AA9DDD4A}"}, ... 312, ) }, ... 312, ) == 0x0
 02131   428   NtQueryValueKey  (312,  (312, "~SubsInfo", Partial, 144, ... TitleIdx=0, Type=3, Data=",\0\0\0\20\4\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\240^\26\10F\351\317\21\234\207\0\252\0Q'\355"}, 56, ) , Partial, 144, ... TitleIdx=0, Type=3, Data= (312, "~SubsInfo", Partial, 144, ... TitleIdx=0, Type=3, Data=",\0\0\0\20\4\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\240^\26\10F\351\317\21\234\207\0\252\0Q'\355"}, 56, ) }, 56, ) == 0x0
 02132   428   NtClose  (312, ... ) == 0x0
 02133   428   NtOpenKey  (0x20019, {24, 60, 0x40, 0, 0,  (0x20019, {24, 60, 0x40, 0, 0, "Software\Microsoft\Windows\CurrentVersion\Webcheck\Store.1\{904B16B0-399C-01C7-0000-0000AA9DDD4A}"}, ... 312, ) }, ... 312, ) == 0x0
 02134   428   NtQueryValueKey  (312,  (312, "~SubsInfo", Partial, 144, ... TitleIdx=0, Type=3, Data=",\0\0\0\20\4\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\240^\26\10F\351\317\21\234\207\0\252\0Q'\355"}, 56, ) , Partial, 144, ... TitleIdx=0, Type=3, Data= (312, "~SubsInfo", Partial, 144, ... TitleIdx=0, Type=3, Data=",\0\0\0\20\4\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\240^\26\10F\351\317\21\234\207\0\252\0Q'\355"}, 56, ) }, 56, ) == 0x0
 02135   428   NtClose  (312, ... ) == 0x0
 02136   428   NtClose  (316, ... ) == 0x0
 02137   428   NtOpenKey  (0x2001f, {24, 60, 0x40, 0, 0,  (0x2001f, {24, 60, 0x40, 0, 0, "Software\Microsoft\Windows\CurrentVersion\Webcheck\Store.1\{904B16B0-399C-01C7-0000-0000AA9DDD4A}"}, ... 316, ) }, ... 316, ) == 0x0
 02138   428   NtQueryValueKey  (316,  (316, "~SubsInfo", Partial, 144, ... TitleIdx=0, Type=3, Data=",\0\0\0\20\4\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\240^\26\10F\351\317\21\234\207\0\252\0Q'\355"}, 56, ) , Partial, 144, ... TitleIdx=0, Type=3, Data= (316, "~SubsInfo", Partial, 144, ... TitleIdx=0, Type=3, Data=",\0\0\0\20\4\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\240^\26\10F\351\317\21\234\207\0\252\0Q'\355"}, 56, ) }, 56, ) == 0x0
 02139   428   NtClose  (316, ... ) == 0x0
 02140   428   NtOpenKey  (0x20019, {24, 60, 0x40, 0, 0,  (0x20019, {24, 60, 0x40, 0, 0, "Software\Microsoft\Windows\CurrentVersion\Webcheck\Store.1\{904B16B0-399C-01C7-0000-0000AA9DDD4A}"}, ... 316, ) }, ... 316, ) == 0x0
 02141   428   NtQueryValueKey  (316,  (316, "URL", Partial, 144, ... TitleIdx=0, Type=3, Data="MOCK\10\0K\220\2349\307\1\@\11\0\252\235\335J\26\0\0\0A\0b\0o\0u\0t\0:\0H\0o\0m\0e\0\0\0"}, 58, ) , Partial, 144, ... TitleIdx=0, Type=3, Data= (316, "URL", Partial, 144, ... TitleIdx=0, Type=3, Data="MOCK\10\0K\220\2349\307\1\@\11\0\252\235\335J\26\0\0\0A\0b\0o\0u\0t\0:\0H\0o\0m\0e\0\0\0"}, 58, ) }, 58, ) == 0x0
 02142   428   NtQueryValueKey  (316,  (316, "URL", Partial, 144, ... TitleIdx=0, Type=3, Data="MOCK\10\0K\220\2349\307\1\@\11\0\252\235\335J\26\0\0\0A\0b\0o\0u\0t\0:\0H\0o\0m\0e\0\0\0"}, 58, ) , Partial, 144, ... TitleIdx=0, Type=3, Data= (316, "URL", Partial, 144, ... TitleIdx=0, Type=3, Data="MOCK\10\0K\220\2349\307\1\@\11\0\252\235\335J\26\0\0\0A\0b\0o\0u\0t\0:\0H\0o\0m\0e\0\0\0"}, 58, ) }, 58, ) == 0x0
 02143   428   NtClose  (316, ... ) == 0x0
 02144   428   NtOpenKey  (0x80000000, {24, 0, 0x40, 0, 0,  (0x80000000, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Classes\CLSID\{7b8a2d94-0ac9-11d1-896c-00c04fb6bfc4}\InProcServer32"}, ... 316, ) }, ... 316, ) == 0x0
 02145   428   NtQueryValueKey  (316, " (316, "", Full, 520, ... TitleIdx=0, Type=1, Name="", Data="C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0s\0y\0s\0t\0e\0m\03\02\0\\0u\0r\0l\0m\0o\0n\0.\0d\0l\0l\0\0\0"}, 82, )  (316, "", Full, 520, ... TitleIdx=0, Type=1, Name="", Data="C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0s\0y\0s\0t\0e\0m\03\02\0\\0u\0r\0l\0m\0o\0n\0.\0d\0l\0l\0\0\0"}, 82, ) C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0s\0y\0s\0t\0e\0m\03\02\0\\0u\0r\0l\0m\0o\0n\0.\0d\0l\0l\0\0\0"}, 82, ) == 0x0
 02146   428   NtClose  (316, ... ) == 0x0
 02147   428   NtCreateFile  (0x80100080, {24, 0, 0x40, 0, 0,  (0x80100080, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\urlmon.dll"}, 0x0, 128, 1, 1, 96, 0, 0, ... 316, {status=0x0, info=1}, ) }, 0x0, 128, 1, 1, 96, 0, 0, ... 316, {status=0x0, info=1}, ) == 0x0
 02148   428   NtQueryVolumeInformationFile  (316, 1239996, 8, Device, ... {status=0x0, info=8}, ) == 0x0
 02149   428   NtWaitForSingleObject  (124, 0, {-1000000, -1}, ... ) == 0x0
 02150   428   NtReleaseMutant  (124, ... 0x0, ) == 0x0
 02151   428   NtCreateFile  (0x80100080, {24, 0, 0x40, 0, 0,  (0x80100080, {24, 0, 0x40, 0, 0, "\SystemRoot\AppPatch\sysmain.sdb"}, 0x0, 128, 1, 1, 96, 0, 0, ... 312, {status=0x0, info=1}, ) }, 0x0, 128, 1, 1, 96, 0, 0, ... 312, {status=0x0, info=1}, ) == 0x0
 02152   428   NtQueryInformationFile  (312, 1239412, 24, Standard, ... {status=0x0, info=24}, ) == 0x0
 02153   428   NtCreateSection  (0x4, 0x0, 0x0, 2, 134217728, 312, ... 324, ) == 0x0
 02154   428   NtMapViewOfSection  (324, -1, (0x0), 0, 0, 0x0, 0, 2, 0, 2, ... (0x940000), 0x0, 1028096, ) == 0x0
 02155   428   NtQueryInformationFile  (312, 1239508, 24, Standard, ... {status=0x0, info=24}, ) == 0x0
 02156   428   NtCreateFile  (0x80100080, {24, 0, 0x40, 0, 0,  (0x80100080, {24, 0, 0x40, 0, 0, "\SystemRoot\AppPatch\systest.sdb"}, 0x0, 128, 1, 1, 96, 0, 0, ... ) }, 0x0, 128, 1, 1, 96, 0, 0, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02157   428   NtOpenFile  (0x100001, {24, 0, 0x40, 0, 0,  (0x100001, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\"}, 3, 16417, ... 328, {status=0x0, info=1}, ) }, 3, 16417, ... 328, {status=0x0, info=1}, ) == 0x0
 02158   428   NtQueryDirectoryFile  (328, 0, 0, 0, 1236956, 616, BothDirectory, 1,  (328, 0, 0, 0, 1236956, 616, BothDirectory, 1, "urlmon.dll", 0, ... {status=0x0, info=114}, ) , 0, ... {status=0x0, info=114}, ) == 0x0
 02159   428   NtClose  (328, ... ) == 0x0
 02160   428   NtQueryInformationProcess  (-1, DefaultHardErrorMode, 4, ... {process info, class 12, size 4}, 0x0, ) == 0x0
 02161   428   NtSetInformationProcess  (-1, DefaultHardErrorMode, {process info, class 12, size 4}, 4, ... ) == 0x0
 02162   428   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\urlmon.dll"}, 1236344, ... ) }, 1236344, ... ) == 0x0
 02163   428   NtOpenFile  (0x100001, {24, 0, 0x40, 0, 0,  (0x100001, {24, 0, 0x40, 0, 0, "\??\C:\"}, 3, 16417, ... 328, {status=0x0, info=1}, ) }, 3, 16417, ... 328, {status=0x0, info=1}, ) == 0x0
 02164   428   NtQueryDirectoryFile  (328, 0, 0, 0, 1235704, 616, BothDirectory, 1,  (328, 0, 0, 0, 1235704, 616, BothDirectory, 1, "WINDOWS", 0, ... {status=0x0, info=108}, ) , 0, ... {status=0x0, info=108}, ) == 0x0
 02165   428   NtClose  (328, ... ) == 0x0
 02166   428   NtOpenFile  (0x100001, {24, 0, 0x40, 0, 0,  (0x100001, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\"}, 3, 16417, ... 328, {status=0x0, info=1}, ) }, 3, 16417, ... 328, {status=0x0, info=1}, ) == 0x0
 02167   428   NtQueryDirectoryFile  (328, 0, 0, 0, 1235704, 616, BothDirectory, 1,  (328, 0, 0, 0, 1235704, 616, BothDirectory, 1, "system32", 0, ... {status=0x0, info=110}, ) , 0, ... {status=0x0, info=110}, ) == 0x0
 02168   428   NtClose  (328, ... ) == 0x0
 02169   428   NtOpenFile  (0x100001, {24, 0, 0x40, 0, 0,  (0x100001, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\"}, 3, 16417, ... 328, {status=0x0, info=1}, ) }, 3, 16417, ... 328, {status=0x0, info=1}, ) == 0x0
 02170   428   NtQueryDirectoryFile  (328, 0, 0, 0, 1235704, 616, BothDirectory, 1,  (328, 0, 0, 0, 1235704, 616, BothDirectory, 1, "urlmon.dll", 0, ... {status=0x0, info=114}, ) , 0, ... {status=0x0, info=114}, ) == 0x0
 02171   428   NtClose  (328, ... ) == 0x0
 02172   428   NtQueryInformationProcess  (-1, DefaultHardErrorMode, 4, ... {process info, class 12, size 4}, 0x0, ) == 0x0
 02173   428   NtSetInformationProcess  (-1, DefaultHardErrorMode, {process info, class 12, size 4}, 4, ... ) == 0x0
 02174   428   NtQueryInformationProcess  (-1, DeviceMap, 36, ... {process info, class 23, size 36}, 0x0, ) == 0x0
 02175   428   NtOpenThreadTokenEx  (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN
 02176   428   NtOpenProcessTokenEx  (-1, 0x20008, 512, ... 328, ) == 0x0
 02177   428   NtQueryInformationToken  (328, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0
 02178   428   NtClose  (328, ... ) == 0x0
 02179   428   NtOpenKey  (0x80000100, {24, 0, 0x40, 0, 0,  (0x80000100, {24, 0, 0x40, 0, 0, "\REGISTRY\USER\S-1-5-21-1078081533-484763869-839522115-1003\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Layers"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02180   428   NtOpenKey  (0x80000100, {24, 0, 0x40, 0, 0,  (0x80000100, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Custom\urlmon.dll"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02181   428   NtWaitForSingleObject  (124, 0, {-1000000, -1}, ... ) == 0x0
 02182   428   NtQueryVolumeInformationFile  (316, 1240000, 8, Device, ... {status=0x0, info=8}, ) == 0x0
 02183   428   NtQueryInformationFile  (316, 1239980, 40, Basic, ... {status=0x0, info=40}, ) == 0x0
 02184   428   NtQueryInformationFile  (316, 1240020, 24, Standard, ... {status=0x0, info=24}, ) == 0x0
 02185   428   NtReleaseMutant  (124, ... 0x0, ) == 0x0
 02186   428   NtUnmapViewOfSection  (-1, 0x940000, ... ) == 0x0
 02187   428   NtClose  (324, ... ) == 0x0
 02188   428   NtClose  (312, ... ) == 0x0
 02189   428   NtClose  (316, ... ) == 0x0
 02190   428   NtOpenSection  (0x4, {24, 52, 0x2, 0, 0,  (0x4, {24, 52, 0x2, 0, 0, "Global\ComPlusCOMRegTable"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02191   428   NtOpenKey  (0x20019, {24, 28, 0x40, 0, 0,  (0x20019, {24, 28, 0x40, 0, 0, "Software\Microsoft\COM3"}, ... 316, ) }, ... 316, ) == 0x0
 02192   428   NtQueryValueKey  (316,  (316, "REGDBVersion", Partial, 144, ... TitleIdx=0, Type=3, Data="\7\0\0\0\0\0\0\0"}, 20, ) , Partial, 144, ... TitleIdx=0, Type=3, Data= (316, "REGDBVersion", Partial, 144, ... TitleIdx=0, Type=3, Data="\7\0\0\0\0\0\0\0"}, 20, ) }, 20, ) == 0x0
 02193   428   NtClose  (316, ... ) == 0x0
 02194   428   NtOpenSection  (0x4, {24, 52, 0x2, 0, 0,  (0x4, {24, 52, 0x2, 0, 0, "Global\ComPlusCOMRegTable"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02195   428   NtOpenKey  (0x20019, {24, 28, 0x40, 0, 0,  (0x20019, {24, 28, 0x40, 0, 0, "Software\Microsoft\COM3"}, ... 316, ) }, ... 316, ) == 0x0
 02196   428   NtQueryValueKey  (316,  (316, "REGDBVersion", Partial, 144, ... TitleIdx=0, Type=3, Data="\7\0\0\0\0\0\0\0"}, 20, ) , Partial, 144, ... TitleIdx=0, Type=3, Data= (316, "REGDBVersion", Partial, 144, ... TitleIdx=0, Type=3, Data="\7\0\0\0\0\0\0\0"}, 20, ) }, 20, ) == 0x0
 02197   428   NtClose  (316, ... ) == 0x0
 02198   428   NtQueryKey  (122, Name, 384, ... {Name= (122, Name, 384, ... {Name="\REGISTRY\USER\S-1-5-21-1078081533-484763869-839522115-1003_CLASSES\"}, 138, ) }, 138, ) == 0x0
 02199   428   NtOpenKey  (0x20019, {24, 122, 0x40, 0, 0,  (0x20019, {24, 122, 0x40, 0, 0, "CLSID\{7B8A2D94-0AC9-11D1-896C-00C04FB6BFC4}"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02200   428   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Classes\CLSID\{7B8A2D94-0AC9-11D1-896C-00C04FB6BFC4}"}, ... 316, ) }, ... 316, ) == 0x0
 02201   428   NtQueryKey  (318, Name, 384, ... {Name= (318, Name, 384, ... {Name="\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{7b8a2d94-0ac9-11d1-896c-00c04Fb6bfc4}1"}, 162, ) }, 162, ) == 0x0
 02202   428   NtOpenThreadTokenEx  (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN
 02203   428   NtOpenProcessTokenEx  (-1, 0x20008, 512, ... 312, ) == 0x0
 02204   428   NtQueryInformationToken  (312, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0
 02205   428   NtClose  (312, ... ) == 0x0
 02206   428   NtOpenKey  (0x1, {24, 0, 0x40, 0, 0,  (0x1, {24, 0, 0x40, 0, 0, "\REGISTRY\USER\S-1-5-21-1078081533-484763869-839522115-1003_Classes\CLSID\{7b8a2d94-0ac9-11d1-896c-00c04Fb6bfc4}\TreatAs"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02207   428   NtOpenKey  (0x1, {24, 318, 0x40, 0, 0,  (0x1, {24, 318, 0x40, 0, 0, "TreatAs"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02208   428   NtClose  (318, ... ) == 0x0
 02209   428   NtQueryKey  (122, Name, 384, ... {Name= (122, Name, 384, ... {Name="\REGISTRY\USER\S-1-5-21-1078081533-484763869-839522115-1003_CLASSES9"}, 138, ) }, 138, ) == 0x0
 02210   428   NtOpenKey  (0x20019, {24, 122, 0x40, 0, 0,  (0x20019, {24, 122, 0x40, 0, 0, "CLSID\{7B8A2D94-0AC9-11D1-896C-00C04FB6BFC4}"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02211   428   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Classes\CLSID\{7B8A2D94-0AC9-11D1-896C-00C04FB6BFC4}"}, ... 316, ) }, ... 316, ) == 0x0
 02212   428   NtQueryKey  (318, Name, 384, ... {Name= (318, Name, 384, ... {Name="\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{7b8a2d94-0ac9-11d1-896c-00c04Fb6bfc4}1"}, 162, ) }, 162, ) == 0x0
 02213   428   NtOpenThreadTokenEx  (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN
 02214   428   NtOpenProcessTokenEx  (-1, 0x20008, 512, ... 312, ) == 0x0
 02215   428   NtQueryInformationToken  (312, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0
 02216   428   NtClose  (312, ... ) == 0x0
 02217   428   NtOpenKey  (0x2000000, {24, 0, 0x40, 0, 0,  (0x2000000, {24, 0, 0x40, 0, 0, "\REGISTRY\USER\S-1-5-21-1078081533-484763869-839522115-1003_Classes\CLSID\{7b8a2d94-0ac9-11d1-896c-00c04Fb6bfc4}\InprocServer32"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02218   428   NtOpenKey  (0x2000000, {24, 318, 0x40, 0, 0,  (0x2000000, {24, 318, 0x40, 0, 0, "InprocServer32"}, ... 312, ) }, ... 312, ) == 0x0
 02219   428   NtQueryKey  (314, Name, 392, ... {Name= (314, Name, 392, ... {Name="\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{7b8a2d94-0ac9-11d1-896c-00c04Fb6bfc4}\InprocServer32"}, 192, ) }, 192, ) == 0x0
 02220   428   NtOpenThreadTokenEx  (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN
 02221   428   NtOpenProcessTokenEx  (-1, 0x20008, 512, ... 324, ) == 0x0
 02222   428   NtQueryInformationToken  (324, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0
 02223   428   NtClose  (324, ... ) == 0x0
 02224   428   NtOpenKey  (0x2000000, {24, 0, 0x40, 0, 0,  (0x2000000, {24, 0, 0x40, 0, 0, "\REGISTRY\USER\S-1-5-21-1078081533-484763869-839522115-1003_Classes\CLSID\{7b8a2d94-0ac9-11d1-896c-00c04Fb6bfc4}\InprocServer32"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02225   428   NtQueryValueKey  (314,  (314, "InprocServer32", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02226   428   NtClose  (314, ... ) == 0x0
 02227   428   NtQueryKey  (318, Name, 384, ... {Name= (318, Name, 384, ... {Name="\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{7b8a2d94-0ac9-11d1-896c-00c04Fb6bfc4}_"}, 162, ) }, 162, ) == 0x0
 02228   428   NtOpenThreadTokenEx  (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN
 02229   428   NtOpenProcessTokenEx  (-1, 0x20008, 512, ... 312, ) == 0x0
 02230   428   NtQueryInformationToken  (312, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0
 02231   428   NtClose  (312, ... ) == 0x0
 02232   428   NtOpenKey  (0x2000000, {24, 0, 0x40, 0, 0,  (0x2000000, {24, 0, 0x40, 0, 0, "\REGISTRY\USER\S-1-5-21-1078081533-484763869-839522115-1003_Classes\CLSID\{7b8a2d94-0ac9-11d1-896c-00c04Fb6bfc4}\InprocServerX86"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02233   428   NtOpenKey  (0x2000000, {24, 318, 0x40, 0, 0,  (0x2000000, {24, 318, 0x40, 0, 0, "InprocServerX86"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02234   428   NtQueryKey  (318, Name, 384, ... {Name= (318, Name, 384, ... {Name="\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{7b8a2d94-0ac9-11d1-896c-00c04Fb6bfc4}_"}, 162, ) }, 162, ) == 0x0
 02235   428   NtOpenThreadTokenEx  (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN
 02236   428   NtOpenProcessTokenEx  (-1, 0x20008, 512, ... 312, ) == 0x0
 02237   428   NtQueryInformationToken  (312, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0
 02238   428   NtClose  (312, ... ) == 0x0
 02239   428   NtOpenKey  (0x2000000, {24, 0, 0x40, 0, 0,  (0x2000000, {24, 0, 0x40, 0, 0, "\REGISTRY\USER\S-1-5-21-1078081533-484763869-839522115-1003_Classes\CLSID\{7b8a2d94-0ac9-11d1-896c-00c04Fb6bfc4}\LocalServer32"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02240   428   NtOpenKey  (0x2000000, {24, 318, 0x40, 0, 0,  (0x2000000, {24, 318, 0x40, 0, 0, "LocalServer32"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02241   428   NtQueryKey  (318, Name, 384, ... {Name= (318, Name, 384, ... {Name="\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{7b8a2d94-0ac9-11d1-896c-00c04Fb6bfc4}_"}, 162, ) }, 162, ) == 0x0
 02242   428   NtOpenThreadTokenEx  (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN
 02243   428   NtOpenProcessTokenEx  (-1, 0x20008, 512, ... 312, ) == 0x0
 02244   428   NtQueryInformationToken  (312, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0
 02245   428   NtClose  (312, ... ) == 0x0
 02246   428   NtOpenKey  (0x2000000, {24, 0, 0x40, 0, 0,  (0x2000000, {24, 0, 0x40, 0, 0, "\REGISTRY\USER\S-1-5-21-1078081533-484763869-839522115-1003_Classes\CLSID\{7b8a2d94-0ac9-11d1-896c-00c04Fb6bfc4}\InprocServer32"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02247   428   NtOpenKey  (0x2000000, {24, 318, 0x40, 0, 0,  (0x2000000, {24, 318, 0x40, 0, 0, "InprocServer32"}, ... 312, ) }, ... 312, ) == 0x0
 02248   428   NtQueryKey  (314, Name, 392, ... {Name= (314, Name, 392, ... {Name="\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{7b8a2d94-0ac9-11d1-896c-00c04Fb6bfc4}\InprocServer32"}, 192, ) }, 192, ) == 0x0
 02249   428   NtOpenThreadTokenEx  (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN
 02250   428   NtOpenProcessTokenEx  (-1, 0x20008, 512, ... 324, ) == 0x0
 02251   428   NtQueryInformationToken  (324, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0
 02252   428   NtClose  (324, ... ) == 0x0
 02253   428   NtOpenKey  (0x2000000, {24, 0, 0x40, 0, 0,  (0x2000000, {24, 0, 0x40, 0, 0, "\REGISTRY\USER\S-1-5-21-1078081533-484763869-839522115-1003_Classes\CLSID\{7b8a2d94-0ac9-11d1-896c-00c04Fb6bfc4}\InprocServer32"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02254   428   NtQueryValueKey  (314, 0x0, Partial, 144, ... TitleIdx=0, Type=1, Data= (314, 0x0, Partial, 144, ... TitleIdx=0, Type=1, Data="C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0s\0y\0s\0t\0e\0m\03\02\0\\0u\0r\0l\0m\0o\0n\0.\0d\0l\0l\0\0\0"}, 74, ) }, 74, ) == 0x0
 02255   428   NtClose  (314, ... ) == 0x0
 02256   428   NtQueryKey  (318, Name, 384, ... {Name= (318, Name, 384, ... {Name="\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{7b8a2d94-0ac9-11d1-896c-00c04Fb6bfc4}_"}, 162, ) }, 162, ) == 0x0
 02257   428   NtOpenThreadTokenEx  (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN
 02258   428   NtOpenProcessTokenEx  (-1, 0x20008, 512, ... 312, ) == 0x0
 02259   428   NtQueryInformationToken  (312, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0
 02260   428   NtClose  (312, ... ) == 0x0
 02261   428   NtOpenKey  (0x2000000, {24, 0, 0x40, 0, 0,  (0x2000000, {24, 0, 0x40, 0, 0, "\REGISTRY\USER\S-1-5-21-1078081533-484763869-839522115-1003_Classes\CLSID\{7b8a2d94-0ac9-11d1-896c-00c04Fb6bfc4}\InprocHandler32"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02262   428   NtOpenKey  (0x2000000, {24, 318, 0x40, 0, 0,  (0x2000000, {24, 318, 0x40, 0, 0, "InprocHandler32"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02263   428   NtQueryKey  (318, Name, 384, ... {Name= (318, Name, 384, ... {Name="\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{7b8a2d94-0ac9-11d1-896c-00c04Fb6bfc4}_"}, 162, ) }, 162, ) == 0x0
 02264   428   NtOpenThreadTokenEx  (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN
 02265   428   NtOpenProcessTokenEx  (-1, 0x20008, 512, ... 312, ) == 0x0
 02266   428   NtQueryInformationToken  (312, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0
 02267   428   NtClose  (312, ... ) == 0x0
 02268   428   NtOpenKey  (0x2000000, {24, 0, 0x40, 0, 0,  (0x2000000, {24, 0, 0x40, 0, 0, "\REGISTRY\USER\S-1-5-21-1078081533-484763869-839522115-1003_Classes\CLSID\{7b8a2d94-0ac9-11d1-896c-00c04Fb6bfc4}\InprocHandlerX86"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02269   428   NtOpenKey  (0x2000000, {24, 318, 0x40, 0, 0,  (0x2000000, {24, 318, 0x40, 0, 0, "InprocHandlerX86"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02270   428   NtQueryKey  (318, Name, 384, ... {Name= (318, Name, 384, ... {Name="\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{7b8a2d94-0ac9-11d1-896c-00c04Fb6bfc4}_"}, 162, ) }, 162, ) == 0x0
 02271   428   NtOpenThreadTokenEx  (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN
 02272   428   NtOpenProcessTokenEx  (-1, 0x20008, 512, ... 312, ) == 0x0
 02273   428   NtQueryInformationToken  (312, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0
 02274   428   NtClose  (312, ... ) == 0x0
 02275   428   NtOpenKey  (0x2000000, {24, 0, 0x40, 0, 0,  (0x2000000, {24, 0, 0x40, 0, 0, "\REGISTRY\USER\S-1-5-21-1078081533-484763869-839522115-1003_Classes\CLSID\{7b8a2d94-0ac9-11d1-896c-00c04Fb6bfc4}\LocalServer32"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02276   428   NtOpenKey  (0x2000000, {24, 318, 0x40, 0, 0,  (0x2000000, {24, 318, 0x40, 0, 0, "LocalServer32"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02277   428   NtQueryKey  (318, Name, 384, ... {Name= (318, Name, 384, ... {Name="\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{7b8a2d94-0ac9-11d1-896c-00c04Fb6bfc4}_"}, 162, ) }, 162, ) == 0x0
 02278   428   NtOpenThreadTokenEx  (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN
 02279   428   NtOpenProcessTokenEx  (-1, 0x20008, 512, ... 312, ) == 0x0
 02280   428   NtQueryInformationToken  (312, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0
 02281   428   NtClose  (312, ... ) == 0x0
 02282   428   NtOpenKey  (0x2000000, {24, 0, 0x40, 0, 0,  (0x2000000, {24, 0, 0x40, 0, 0, "\REGISTRY\USER\S-1-5-21-1078081533-484763869-839522115-1003_Classes\CLSID\{7b8a2d94-0ac9-11d1-896c-00c04Fb6bfc4}\LocalServer"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02283   428   NtOpenKey  (0x2000000, {24, 318, 0x40, 0, 0,  (0x2000000, {24, 318, 0x40, 0, 0, "LocalServer"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02284   428   NtQueryKey  (122, Name, 384, ... {Name= (122, Name, 384, ... {Name="\REGISTRY\USER\S-1-5-21-1078081533-484763869-839522115-1003_CLASSES9"}, 138, ) }, 138, ) == 0x0
 02285   428   NtOpenKey  (0x20019, {24, 122, 0x40, 0, 0,  (0x20019, {24, 122, 0x40, 0, 0, "CLSID\{7B8A2D94-0AC9-11D1-896C-00C04FB6BFC4}"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02286   428   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Classes\CLSID\{7B8A2D94-0AC9-11D1-896C-00C04FB6BFC4}"}, ... 312, ) }, ... 312, ) == 0x0
 02287   428   NtQueryKey  (314, Name, 392, ... {Name= (314, Name, 392, ... {Name="\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{7b8a2d94-0ac9-11d1-896c-00c04Fb6bfc4}1"}, 162, ) }, 162, ) == 0x0
 02288   428   NtOpenThreadTokenEx  (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN
 02289   428   NtOpenProcessTokenEx  (-1, 0x20008, 512, ... 324, ) == 0x0
 02290   428   NtQueryInformationToken  (324, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0
 02291   428   NtClose  (324, ... ) == 0x0
 02292   428   NtOpenKey  (0x2000000, {24, 0, 0x40, 0, 0,  (0x2000000, {24, 0, 0x40, 0, 0, "\REGISTRY\USER\S-1-5-21-1078081533-484763869-839522115-1003_Classes\CLSID\{7b8a2d94-0ac9-11d1-896c-00c04Fb6bfc4}"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02293   428   NtQueryValueKey  (314,  (314, "AppID", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02294   428   NtClose  (314, ... ) == 0x0
 02295   428   NtClose  (318, ... ) == 0x0
 02296   428   NtOpenProcess  (0x400, {24, 0, 0x0, 0, 0, 0x0}, {420, 0}, ... 316, ) == 0x0
 02297   428   NtQueryInformationProcess  (316, Session, 4, ... {SessionId=0,}, 0x0, ) == 0x0
 02298   428   NtClose  (316, ... ) == 0x0
 02299   428   NtQueryKey  (122, Name, 384, ... {Name= (122, Name, 384, ... {Name="\REGISTRY\USER\S-1-5-21-1078081533-484763869-839522115-1003_CLASSES9"}, 138, ) }, 138, ) == 0x0
 02300   428   NtOpenKey  (0x20019, {24, 122, 0x40, 0, 0,  (0x20019, {24, 122, 0x40, 0, 0, "CLSID\{7B8A2D94-0AC9-11D1-896C-00C04FB6BFC4}"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02301   428   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Classes\CLSID\{7B8A2D94-0AC9-11D1-896C-00C04FB6BFC4}"}, ... 316, ) }, ... 316, ) == 0x0
 02302   428   NtQueryKey  (318, Name, 384, ... {Name= (318, Name, 384, ... {Name="\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{7b8a2d94-0ac9-11d1-896c-00c04Fb6bfc4}1"}, 162, ) }, 162, ) == 0x0
 02303   428   NtOpenThreadTokenEx  (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN
 02304   428   NtOpenProcessTokenEx  (-1, 0x20008, 512, ... 312, ) == 0x0
 02305   428   NtQueryInformationToken  (312, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0
 02306   428   NtClose  (312, ... ) == 0x0
 02307   428   NtOpenKey  (0x2000000, {24, 0, 0x40, 0, 0,  (0x2000000, {24, 0, 0x40, 0, 0, "\REGISTRY\USER\S-1-5-21-1078081533-484763869-839522115-1003_Classes\CLSID\{7b8a2d94-0ac9-11d1-896c-00c04Fb6bfc4}\InprocServer32"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02308   428   NtOpenKey  (0x2000000, {24, 318, 0x40, 0, 0,  (0x2000000, {24, 318, 0x40, 0, 0, "InprocServer32"}, ... 312, ) }, ... 312, ) == 0x0
 02309   428   NtQueryKey  (314, Name, 392, ... {Name= (314, Name, 392, ... {Name="\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{7b8a2d94-0ac9-11d1-896c-00c04Fb6bfc4}\InprocServer32"}, 192, ) }, 192, ) == 0x0
 02310   428   NtOpenThreadTokenEx  (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN
 02311   428   NtOpenProcessTokenEx  (-1, 0x20008, 512, ... 324, ) == 0x0
 02312   428   NtQueryInformationToken  (324, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0
 02313   428   NtClose  (324, ... ) == 0x0
 02314   428   NtOpenKey  (0x2000000, {24, 0, 0x40, 0, 0,  (0x2000000, {24, 0, 0x40, 0, 0, "\REGISTRY\USER\S-1-5-21-1078081533-484763869-839522115-1003_Classes\CLSID\{7b8a2d94-0ac9-11d1-896c-00c04Fb6bfc4}\InprocServer32"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02315   428   NtQueryValueKey  (314,  (314, "ThreadingModel", Partial, 144, ... TitleIdx=0, Type=1, Data="B\0o\0t\0h\0\0\0"}, 22, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (314, "ThreadingModel", Partial, 144, ... TitleIdx=0, Type=1, Data="B\0o\0t\0h\0\0\0"}, 22, ) }, 22, ) == 0x0
 02316   428   NtClose  (314, ... ) == 0x0
 02317   428   NtClose  (318, ... ) == 0x0
 02318   428   NtQueryKey  (122, Name, 384, ... {Name= (122, Name, 384, ... {Name="\REGISTRY\USER\S-1-5-21-1078081533-484763869-839522115-1003_CLASSES9"}, 138, ) }, 138, ) == 0x0
 02319   428   NtOpenKey  (0x20019, {24, 122, 0x40, 0, 0,  (0x20019, {24, 122, 0x40, 0, 0, "CLSID\{7B8A2D94-0AC9-11D1-896C-00C04FB6BFC4}"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02320   428   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Classes\CLSID\{7B8A2D94-0AC9-11D1-896C-00C04FB6BFC4}"}, ... 316, ) }, ... 316, ) == 0x0
 02321   428   NtQueryKey  (318, Name, 384, ... {Name= (318, Name, 384, ... {Name="\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{7b8a2d94-0ac9-11d1-896c-00c04Fb6bfc4}1"}, 162, ) }, 162, ) == 0x0
 02322   428   NtOpenThreadTokenEx  (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN
 02323   428   NtOpenProcessTokenEx  (-1, 0x20008, 512, ... 312, ) == 0x0
 02324   428   NtQueryInformationToken  (312, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0
 02325   428   NtClose  (312, ... ) == 0x0
 02326   428   NtOpenKey  (0x1, {24, 0, 0x40, 0, 0,  (0x1, {24, 0, 0x40, 0, 0, "\REGISTRY\USER\S-1-5-21-1078081533-484763869-839522115-1003_Classes\CLSID\{7b8a2d94-0ac9-11d1-896c-00c04Fb6bfc4}\TreatAs"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02327   428   NtOpenKey  (0x1, {24, 318, 0x40, 0, 0,  (0x1, {24, 318, 0x40, 0, 0, "TreatAs"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02328   428   NtClose  (318, ... ) == 0x0
 02329   428   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\urlmon.dll"}, 1234168, ... ) }, 1234168, ... ) == 0x0
 02330   428   NtOpenFile  (0x100020, {24, 0, 0x40, 0, 0,  (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\urlmon.dll"}, 5, 96, ... 316, {status=0x0, info=1}, ) }, 5, 96, ... 316, {status=0x0, info=1}, ) == 0x0
 02331   428   NtCreateSection  (0xe, 0x0, 0x0, 16, 134217728, 316, ... 312, ) == 0x0
 02332   428   NtClose  (316, ... ) == 0x0
 02333   428   NtMapViewOfSection  (312, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 16, ... (0x940000), 0x0, 454656, ) == 0x0
 02334   428   NtClose  (312, ... ) == 0x0
 02335   428   NtUnmapViewOfSection  (-1, 0x940000, ... ) == 0x0
 02336   428   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\urlmon.dll"}, 1234484, ... ) }, 1234484, ... ) == 0x0
 02337   428   NtOpenFile  (0x100020, {24, 0, 0x40, 0, 0,  (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\urlmon.dll"}, 5, 96, ... 312, {status=0x0, info=1}, ) }, 5, 96, ... 312, {status=0x0, info=1}, ) == 0x0
 02338   428   NtCreateSection  (0xf, 0x0, 0x0, 16, 16777216, 312, ... 316, ) == 0x0
 02339   428   NtQuerySection  (316, Image, 48, ... {section info, class 1, size 48}, 0x0, ) == 0x0
 02340   428   NtClose  (312, ... ) == 0x0
 02341   428   NtMapViewOfSection  (316, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x760f0000), 0x0, 491520, ) == 0x0
 02342   428   NtClose  (316, ... ) == 0x0
 02343   428   NtQuerySystemInformation  (Basic, 44, ... {Unknown=0,MaximumIncrement=156250,PhysicalPageSize=0x1000,NumberOfPhysicalPages=0xff7c,LowestPhysicalPage=0x1,HighestPhysicalPage=0xffff,AllocationGranularity=0x10000,LowestUserAddress=0x10000,HighestUserAddress=0x7ffeffff,ActiveProcessors=1,NumberProcessors=1,}, 0x0, ) == 0x0
 02344   428   NtAllocateVirtualMemory  (-1, 0, 0, 65536, 8192, 4, ... 9699328, 65536, ) == 0x0
 02345   428   NtAllocateVirtualMemory  (-1, 9699328, 0, 4096, 4096, 4, ... 9699328, 4096, ) == 0x0
 02346   428   NtAllocateVirtualMemory  (-1, 9703424, 0, 8192, 4096, 4, ... 9703424, 8192, ) == 0x0
 02347   428   NtCreateMutant  (0x1f0001, {24, 52, 0x80, 0, 0,  (0x1f0001, {24, 52, 0x80, 0, 0, "ZonesCounterMutex"}, 0, ... 316, ) }, 0, ... 316, ) == 0x0
 02348   428   NtCreateMutant  (0x1f0001, {24, 52, 0x80, 0, 0,  (0x1f0001, {24, 52, 0x80, 0, 0, "ZonesCacheCounterMutex"}, 0, ... 312, ) }, 0, ... 312, ) == 0x0
 02349   428   NtQueryDefaultUILanguage  (1232692, ...
 02350   428   NtOpenThreadTokenEx  (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN
 02351   428   NtOpenProcessTokenEx  (-1, 0x20008, 512, ... -2147482204, ) == 0x0
 02352   428   NtQueryInformationToken  (-2147482204, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0
 02353   428   NtClose  (-2147482204, ... ) == 0x0
 02354   428   NtOpenKey  (0x2000000, {24, 0, 0x640, 0, 0,  (0x2000000, {24, 0, 0x640, 0, 0, "\REGISTRY\USER\S-1-5-21-1078081533-484763869-839522115-1003"}, ... -2147482204, ) }, ... -2147482204, ) == 0x0
 02355   428   NtOpenKey  (0x80000000, {24, 0, 0x240, 0, 0,  (0x80000000, {24, 0, 0x240, 0, 0, "\Registry\Machine\System\CurrentControlSet\Control\Nls\MUILanguages"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02356   428   NtOpenKey  (0x80000000, {24, -2147482204, 0x640, 0, 0,  (0x80000000, {24, -2147482204, 0x640, 0, 0, "Control Panel\Desktop"}, ... -2147482208, ) }, ... -2147482208, ) == 0x0
 02357   428   NtQueryValueKey  (-2147482208,  (-2147482208, "MultiUILanguageId", Partial, 256, ... ) , Partial, 256, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02358   428   NtClose  (-2147482208, ... ) == 0x0
 02359   428   NtClose  (-2147482204, ... ) == 0x0
 02349   428   NtQueryDefaultUILanguage  ... ) == 0x0
 02360   428   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\System\CurrentControlSet\Control\Nls\MUILanguages"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02361   428   NtOpenFile  (0x1200a9, {24, 0, 0x40, 0, 0,  (0x1200a9, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\urlmon.dll"}, 1, 96, ... 324, {status=0x0, info=1}, ) }, 1, 96, ... 324, {status=0x0, info=1}, ) == 0x0
 02362   428   NtCreateSection  (0x4, 0x0, 0x0, 2, 134217728, 324, ... 328, ) == 0x0
 02363   428   NtMapViewOfSection  (328, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 2, ... (0x950000), 0x0, 454656, ) == 0x0
 02364   428   NtOpenFile  (0x1200a9, {24, 0, 0x40, 0, 0,  (0x1200a9, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\urlmon.dll.123.Manifest"}, 1, 96, ... ) }, 1, 96, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02365   428   NtQueryDefaultLocale  (1, 1230728, ... ) == 0x0
 02366   428   NtOpenFile  (0x1200a9, {24, 0, 0x40, 0, 0,  (0x1200a9, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\urlmon.dll.123.Config"}, 1, 96, ... ) }, 1, 96, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02367   428   NtRequestWaitReplyPort  (24, {128, 156, new_msg, 0, 1231584, 1, 96, 0}  (24, {128, 156, new_msg, 0, 1231584, 1, 96, 0} "\210\6\31\1\33\0\1\0\0\0\0\0\1\316\22\0\1\0\0\0\0\0\11\4\1\1\1\0<\0@\0\250\6\31\1D\1\0\0\377\377\377\377\0\0\0\0\240\302\232\0\0\0\0\0\303\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0(\0,\0\350\6\31\1\0\0\0\0\0\0\0\0\340\321\22\0\0\0\0\0" ... {128, 156, reply, 0, 420, 428, 1460, 0} " S\26\0\33\0\1\0\0\0\0\0\1\316\22\0\1\0\0\0\0\0\11\4\1\1\1\0<\0@\0\250\6\31\1D\1\0\0\377\377\377\377\0\0\0\0\240\302\232\0\0\0\0\0\303\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0(\0,\0\350\6\31\1\0\0\0\0\0\0\0\0\340\321\22\0\0\0\0\0" )  ... {128, 156, reply, 0, 420, 428, 1460, 0}  (24, {128, 156, new_msg, 0, 1231584, 1, 96, 0} "\210\6\31\1\33\0\1\0\0\0\0\0\1\316\22\0\1\0\0\0\0\0\11\4\1\1\1\0<\0@\0\250\6\31\1D\1\0\0\377\377\377\377\0\0\0\0\240\302\232\0\0\0\0\0\303\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0(\0,\0\350\6\31\1\0\0\0\0\0\0\0\0\340\321\22\0\0\0\0\0" ... {128, 156, reply, 0, 420, 428, 1460, 0} " S\26\0\33\0\1\0\0\0\0\0\1\316\22\0\1\0\0\0\0\0\11\4\1\1\1\0<\0@\0\250\6\31\1D\1\0\0\377\377\377\377\0\0\0\0\240\302\232\0\0\0\0\0\303\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0(\0,\0\350\6\31\1\0\0\0\0\0\0\0\0\340\321\22\0\0\0\0\0" )  ) == 0x0
 02368   428   NtClose  (324, ... ) == 0x0
 02369   428   NtClose  (328, ... ) == 0x0
 02370   428   NtUnmapViewOfSection  (-1, 0x950000, ... ) == 0x0
 02371   428   NtUnmapViewOfSection  (-1, 0x12d1e0, ... ) == STATUS_NOT_MAPPED_VIEW
 02372   428   NtQueryDebugFilterState  (53, 2, ... ) == 0x0
 02373   428   NtOpenKey  (0x8, {24, 0, 0x40, 0, 0,  (0x8, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows\CurrentVersion\SideBySide\AssemblyStorageRoots"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02374   428   NtQueryDebugFilterState  (53, 2, ... ) == 0x0
 02375   428   NtQueryDebugFilterState  (53, 2, ... ) == 0x0
 02376   428   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\u:\work\packed.exe.Local\"}, 1229268, ... ) }, 1229268, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02377   428   NtQueryDebugFilterState  (53, 2, ... ) == 0x0
 02378   428   NtQueryDebugFilterState  (53, 2, ... ) == 0x0
 02379   428   NtQueryDebugFilterState  (53, 2, ... ) == 0x0
 02380   428   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.0.0_x-ww_1382d70a"}, 1229860, ... ) }, 1229860, ... ) == 0x0
 02381   428   NtOpenFile  (0x100020, {24, 0, 0x40, 0, 0,  (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.0.0_x-ww_1382d70a"}, 3, 33, ... 328, {status=0x0, info=1}, ) }, 3, 33, ... 328, {status=0x0, info=1}, ) == 0x0
 02382   428   NtQueryDebugFilterState  (53, 2, ... ) == 0x0
 02383   428   NtQuerySystemInformation  (Basic, 44, ... {Unknown=0,MaximumIncrement=156250,PhysicalPageSize=0x1000,NumberOfPhysicalPages=0xff7c,LowestPhysicalPage=0x1,HighestPhysicalPage=0xffff,AllocationGranularity=0x10000,LowestUserAddress=0x10000,HighestUserAddress=0x7ffeffff,ActiveProcessors=1,NumberProcessors=1,}, 0x0, ) == 0x0
 02384   428   NtQuerySystemInformation  (Processor, 12, ... {system info, class 1, size 12}, 0x0, ) == 0x0
 02385   428   NtOpenKey  (0x1, {24, 28, 0x40, 0, 0,  (0x1, {24, 28, 0x40, 0, 0, "Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02386   428   NtQueryKey  (122, Name, 384, ... {Name= (122, Name, 384, ... {Name="\REGISTRY\USER\S-1-5-21-1078081533-484763869-839522115-1003_CLASSESi"}, 138, ) }, 138, ) == 0x0
 02387   428   NtOpenKey  (0x2000000, {24, 122, 0x40, 0, 0,  (0x2000000, {24, 122, 0x40, 0, 0, "PROTOCOLS\Name-Space Handler\"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02388   428   NtOpenKey  (0x2000000, {24, 0, 0x40, 0, 0,  (0x2000000, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Classes\PROTOCOLS\Name-Space Handler"}, ... 324, ) }, ... 324, ) == 0x0
 02389   428   NtQueryKey  (326, Name, 392, ... {Name= (326, Name, 392, ... {Name="\REGISTRY\MACHINE\SOFTWARE\Classes\PROTOCOLS\Name-Space HandlerS"}, 130, ) }, 130, ) == 0x0
 02390   428   NtOpenThreadTokenEx  (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN
 02391   428   NtOpenProcessTokenEx  (-1, 0x20008, 512, ... 332, ) == 0x0
 02392   428   NtQueryInformationToken  (332, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0
 02393   428   NtClose  (332, ... ) == 0x0
 02394   428   NtOpenKey  (0x2000000, {24, 0, 0x40, 0, 0,  (0x2000000, {24, 0, 0x40, 0, 0, "\REGISTRY\USER\S-1-5-21-1078081533-484763869-839522115-1003_Classes\PROTOCOLS\Name-Space Handler"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02395   428   NtEnumerateKey  (326, 0, Node, 288, ... {LastWrite={0x5d796f8c,0x1c73999}, TitleIdx=0, Name= (326, 0, Node, 288, ... {LastWrite={0x5d796f8c,0x1c73999}, TitleIdx=0, Name="mk", Class=""}, 28, ) , Class=""}, 28, ) == 0x0
 02396   428   NtEnumerateKey  (326, 1, Node, 288, ... ) == STATUS_NO_MORE_ENTRIES
 02397   428   NtClose  (326, ... ) == 0x0
 02398   428   NtOpenKey  (0x1, {24, 60, 0x40, 0, 0,  (0x1, {24, 60, 0x40, 0, 0, "SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02399   428   NtOpenKey  (0x1, {24, 60, 0x40, 0, 0,  (0x1, {24, 60, 0x40, 0, 0, "SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02400   428   NtOpenKey  (0x20019, {24, 60, 0x40, 0, 0,  (0x20019, {24, 60, 0x40, 0, 0, "Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\"}, ... 324, ) }, ... 324, ) == 0x0
 02401   428   NtOpenKey  (0x20019, {24, 324, 0x40, 0, 0,  (0x20019, {24, 324, 0x40, 0, 0, "Ranges\"}, ... 332, ) }, ... 332, ) == 0x0
 02402   428   NtQueryKey  (332, 4, 176, ... {key info, class 4, size 40}, 40, ) == 0x0
 02403   428   NtClose  (332, ... ) == 0x0
 02404   428   NtRequestWaitReplyPort  (252, {28, 52, new_msg, 0, 0, 0, 0, 0}  (252, {28, 52, new_msg, 0, 0, 0, 0, 0} "\37\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\1\0\13\30\10\2\220\36\24\0" ... {176, 200, reply, 0, 420, 428, 1461, 0} "\37\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\1\0\20\0\10\2\220\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0S\0R\0I\0-\0u\0s\0e\0r\0" )  ... {176, 200, reply, 0, 420, 428, 1461, 0}  (252, {28, 52, new_msg, 0, 0, 0, 0, 0} "\37\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\1\0\13\30\10\2\220\36\24\0" ... {176, 200, reply, 0, 420, 428, 1461, 0} "\37\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\1\0\20\0\10\2\220\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0S\0R\0I\0-\0u\0s\0e\0r\0" )  ) == 0x0
 02405   428   NtCreateSection  (0xf0007, {24, 52, 0x80, 0, 0,  (0xf0007, {24, 52, 0x80, 0, 0, "UrlZonesSM_SRI-user"}, {8, 0}, 4, 134217728, 0, ... 332, ) }, {8, 0}, 4, 134217728, 0, ... 332, ) == 0x0
 02406   428   NtMapViewOfSection  (332, -1, (0x0), 0, 0, {0, 0}, 0, 1, 0, 4, ... (0x950000), {0, 0}, 4096, ) == 0x0
 02407   428   NtOpenKey  (0x20019, {24, 28, 0x40, 0, 0,  (0x20019, {24, 28, 0x40, 0, 0, "System\Setup"}, ... 336, ) }, ... 336, ) == 0x0
 02408   428   NtQueryValueKey  (336,  (336, "SystemSetupInProgress", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (336, "SystemSetupInProgress", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) }, 16, ) == 0x0
 02409   428   NtClose  (336, ... ) == 0x0
 02410   428   NtOpenKey  (0x20019, {24, 60, 0x40, 0, 0,  (0x20019, {24, 60, 0x40, 0, 0, "Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\"}, ... 336, ) }, ... 336, ) == 0x0
 02411   428   NtOpenKey  (0x20019, {24, 336, 0x40, 0, 0,  (0x20019, {24, 336, 0x40, 0, 0, "0"}, ... 340, ) }, ... 340, ) == 0x0
 02412   428   NtClose  (340, ... ) == 0x0
 02413   428   NtOpenKey  (0x20019, {24, 336, 0x40, 0, 0,  (0x20019, {24, 336, 0x40, 0, 0, "1"}, ... 340, ) }, ... 340, ) == 0x0
 02414   428   NtClose  (340, ... ) == 0x0
 02415   428   NtOpenKey  (0x20019, {24, 336, 0x40, 0, 0,  (0x20019, {24, 336, 0x40, 0, 0, "2"}, ... 340, ) }, ... 340, ) == 0x0
 02416   428   NtClose  (340, ... ) == 0x0
 02417   428   NtOpenKey  (0x20019, {24, 336, 0x40, 0, 0,  (0x20019, {24, 336, 0x40, 0, 0, "3"}, ... 340, ) }, ... 340, ) == 0x0
 02418   428   NtClose  (340, ... ) == 0x0
 02419   428   NtOpenKey  (0x20019, {24, 336, 0x40, 0, 0,  (0x20019, {24, 336, 0x40, 0, 0, "4"}, ... 340, ) }, ... 340, ) == 0x0
 02420   428   NtClose  (340, ... ) == 0x0
 02421   428   NtClose  (336, ... ) == 0x0
 02422   428   NtOpenKey  (0x20019, {24, 60, 0x40, 0, 0,  (0x20019, {24, 60, 0x40, 0, 0, "Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\"}, ... 336, ) }, ... 336, ) == 0x0
 02423   428   NtEnumerateKey  (336, 0, Basic, 288, ... {LastWrite={0x8db90da8,0x1c7399c}, TitleIdx=0, Name= (336, 0, Basic, 288, ... {LastWrite={0x8db90da8,0x1c7399c}, TitleIdx=0, Name="0"}, 18, ) }, 18, ) == 0x0
 02424   428   NtOpenKey  (0x20019, {24, 60, 0x40, 0, 0,  (0x20019, {24, 60, 0x40, 0, 0, "Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0"}, ... 340, ) }, ... 340, ) == 0x0
 02425   428   NtQueryValueKey  (340,  (340, "Flags", Partial, 144, ... TitleIdx=0, Type=4, Data="!\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (340, "Flags", Partial, 144, ... TitleIdx=0, Type=4, Data="!\0\0\0"}, 16, ) }, 16, ) == 0x0
 02426   428   NtClose  (340, ... ) == 0x0
 02427   428   NtEnumerateKey  (336, 1, Basic, 288, ... {LastWrite={0x8f7e0c74,0x1c7399c}, TitleIdx=0, Name= (336, 1, Basic, 288, ... {LastWrite={0x8f7e0c74,0x1c7399c}, TitleIdx=0, Name="1"}, 18, ) }, 18, ) == 0x0
 02428   428   NtOpenKey  (0x20019, {24, 60, 0x40, 0, 0,  (0x20019, {24, 60, 0x40, 0, 0, "Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1"}, ... 340, ) }, ... 340, ) == 0x0
 02429   428   NtQueryValueKey  (340,  (340, "Flags", Partial, 144, ... TitleIdx=0, Type=4, Data="\333\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (340, "Flags", Partial, 144, ... TitleIdx=0, Type=4, Data="\333\0\0\0"}, 16, ) }, 16, ) == 0x0
 02430   428   NtWaitForSingleObject  (316, 0, 0x0, ... ) == 0x0
 02431   428   NtReleaseMutant  (316, ... 0x0, ) == 0x0
 02432   428   NtOpenKey  (0x2001f, {24, 60, 0x40, 0, 0,  (0x2001f, {24, 60, 0x40, 0, 0, "Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\"}, ... 344, ) }, ... 344, ) == 0x0
 02433   428   NtSetValueKey  (344,  (344, "ProxyBypass", 0, 4, "\1\0\0\0", 4, ... ) , 0, 4,  (344, "ProxyBypass", 0, 4, "\1\0\0\0", 4, ... ) , 4, ... ) == 0x0
 02434   428   NtSetValueKey  (344,  (344, "IntranetName", 0, 4, "\1\0\0\0", 4, ... ) , 0, 4,  (344, "IntranetName", 0, 4, "\1\0\0\0", 4, ... ) , 4, ... ) == 0x0
 02435   428   NtSetValueKey  (344,  (344, "UNCAsIntranet", 0, 4, "\1\0\0\0", 4, ... ) , 0, 4,  (344, "UNCAsIntranet", 0, 4, "\1\0\0\0", 4, ... ) , 4, ... ) == 0x0
 02436   428   NtClose  (344, ... ) == 0x0
 02437   428   NtClose  (340, ... ) == 0x0
 02438   428   NtEnumerateKey  (336, 2, Basic, 288, ... {LastWrite={0x8f7e0c74,0x1c7399c}, TitleIdx=0, Name= (336, 2, Basic, 288, ... {LastWrite={0x8f7e0c74,0x1c7399c}, TitleIdx=0, Name="2I"}, 18, ) }, 18, ) == 0x0
 02439   428   NtOpenKey  (0x20019, {24, 60, 0x40, 0, 0,  (0x20019, {24, 60, 0x40, 0, 0, "Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2"}, ... 340, ) }, ... 340, ) == 0x0
 02440   428   NtQueryValueKey  (340,  (340, "Flags", Partial, 144, ... TitleIdx=0, Type=4, Data="G\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (340, "Flags", Partial, 144, ... TitleIdx=0, Type=4, Data="G\0\0\0"}, 16, ) }, 16, ) == 0x0
 02441   428   NtClose  (340, ... ) == 0x0
 02442   428   NtEnumerateKey  (336, 3, Basic, 288, ... {LastWrite={0x8f7e0c74,0x1c7399c}, TitleIdx=0, Name= (336, 3, Basic, 288, ... {LastWrite={0x8f7e0c74,0x1c7399c}, TitleIdx=0, Name="3"}, 18, ) }, 18, ) == 0x0
 02443   428   NtOpenKey  (0x20019, {24, 60, 0x40, 0, 0,  (0x20019, {24, 60, 0x40, 0, 0, "Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3"}, ... 340, ) }, ... 340, ) == 0x0
 02444   428   NtQueryValueKey  (340,  (340, "Flags", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (340, "Flags", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) }, 16, ) == 0x0
 02445   428   NtClose  (340, ... ) == 0x0
 02446   428   NtEnumerateKey  (336, 4, Basic, 288, ... {LastWrite={0x8f7e0c74,0x1c7399c}, TitleIdx=0, Name= (336, 4, Basic, 288, ... {LastWrite={0x8f7e0c74,0x1c7399c}, TitleIdx=0, Name="4"}, 18, ) }, 18, ) == 0x0
 02447   428   NtOpenKey  (0x20019, {24, 60, 0x40, 0, 0,  (0x20019, {24, 60, 0x40, 0, 0, "Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4"}, ... 340, ) }, ... 340, ) == 0x0
 02448   428   NtQueryValueKey  (340,  (340, "Flags", Partial, 144, ... TitleIdx=0, Type=4, Data="\3\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (340, "Flags", Partial, 144, ... TitleIdx=0, Type=4, Data="\3\0\0\0"}, 16, ) }, 16, ) == 0x0
 02449   428   NtClose  (340, ... ) == 0x0
 02450   428   NtEnumerateKey  (336, 5, Basic, 288, ... ) == STATUS_NO_MORE_ENTRIES
 02451   428   NtClose  (336, ... ) == 0x0
 02452   428   NtWaitForSingleObject  (316, 0, 0x0, ... ) == 0x0
 02453   428   NtReleaseMutant  (316, ... 0x0, ) == 0x0
 02454   428   NtOpenKey  (0x20019, {24, 324, 0x40, 0, 0,  (0x20019, {24, 324, 0x40, 0, 0, "Domains\whyusefirefox.com"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02455   428   NtOpenKey  (0x20019, {24, 28, 0x40, 0, 0,  (0x20019, {24, 28, 0x40, 0, 0, "Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\whyusefirefox.com"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02456   428   NtQueryValueKey  (324,  (324, "IntranetName", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (324, "IntranetName", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) }, 16, ) == 0x0
 02457   428   NtQueryValueKey  (324,  (324, "ProxyBypass", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (324, "ProxyBypass", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) }, 16, ) == 0x0
 02458   428   NtQueryValueKey  (264,  (264, "FromCacheTimeout", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02459   428   NtQueryValueKey  (264,  (264, "SecureProtocols", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02460   428   NtQueryValueKey  (264,  (264, "CertificateRevocation", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02461   428   NtQueryValueKey  (264,  (264, "DisableKeepAlive", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02462   428   NtQueryValueKey  (264,  (264, "DisablePassport", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02463   428   NtQueryValueKey  (264,  (264, "CacheMode", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02464   428   NtQueryValueKey  (264,  (264, "EnableHttp1_1", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (264, "EnableHttp1_1", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) }, 16, ) == 0x0
 02465   428   NtQueryValueKey  (264,  (264, "ProxyHttp1.1", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02466   428   NtQueryValueKey  (264,  (264, "EnableNegotiate", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (264, "EnableNegotiate", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) }, 16, ) == 0x0
 02467   428   NtWaitForSingleObject  (280, 0, 0x0, ... ) == 0x0
 02468   428   NtQueryInformationFile  (276, 1238292, 24, Standard, ... {status=0x0, info=24}, ) == 0x0
 02469   428   NtReleaseMutant  (280, ... 0x0, ) == 0x0
 02470   428   NtOpenKey  (0x1, {24, 60, 0x40, 0, 0,  (0x1, {24, 60, 0x40, 0, 0, "SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02471   428   NtOpenKey  (0x1, {24, 60, 0x40, 0, 0,  (0x1, {24, 60, 0x40, 0, 0, "SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02472   428   NtOpenKey  (0x1, {24, 60, 0x40, 0, 0,  (0x1, {24, 60, 0x40, 0, 0, "SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02473   428   NtOpenKey  (0x1, {24, 60, 0x40, 0, 0,  (0x1, {24, 60, 0x40, 0, 0, "SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02474   428   NtOpenKey  (0x1, {24, 60, 0x40, 0, 0,  (0x1, {24, 60, 0x40, 0, 0, "SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02475   428   NtOpenKey  (0x1, {24, 28, 0x40, 0, 0,  (0x1, {24, 28, 0x40, 0, 0, "SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings"}, ... 336, ) }, ... 336, ) == 0x0
 02476   428   NtQueryValueKey  (336,  (336, "DisableWorkerThreadHibernation", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02477   428   NtClose  (336, ... ) == 0x0
 02478   428   NtQueryValueKey  (264,  (264, "DisableWorkerThreadHibernation", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02479   428   NtQueryValueKey  (264,  (264, "DisableReadRange", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02480   428   NtQueryValueKey  (264,  (264, "SocketSendBufferLength", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02481   428   NtQueryValueKey  (264,  (264, "SocketReceiveBufferLength", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02482   428   NtQueryValueKey  (264,  (264, "KeepAliveTimeout", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02483   428   NtQueryValueKey  (264,  (264, "MaxHttpRedirects", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02484   428   NtQueryValueKey  (264,  (264, "MaxConnectionsPerServer", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02485   428   NtQueryValueKey  (264,  (264, "MaxConnectionsPer1_0Server", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02486   428   NtQueryValueKey  (264,  (264, "ServerInfoTimeout", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02487   428   NtQueryValueKey  (264,  (264, "ReceiveTimeOut", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02488   428   NtQueryValueKey  (264,  (264, "DisableNTLMPreAuth", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02489   428   NtQueryValueKey  (264,  (264, "ScavengeCacheLowerBound", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02490   428   NtOpenKey  (0x1, {24, 60, 0x40, 0, 0,  (0x1, {24, 60, 0x40, 0, 0, "SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache"}, ... 336, ) }, ... 336, ) == 0x0
 02491   428   NtQueryValueKey  (336,  (336, "ScavengeCacheFileLifeTime", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02492   428   NtClose  (336, ... ) == 0x0
 02493   428   NtQueryValueKey  (264,  (264, "HttpDefaultExpiryTimeSecs", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02494   428   NtQueryValueKey  (264,  (264, "FtpDefaultExpiryTimeSecs", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02495   428   NtQueryValueKey  (264,  (264, "GopherDefaultExpiryTimeSecs", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02496   428   NtQueryValueKey  (264,  (264, "DisableCachingOfSSLPages", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02497   428   NtQueryValueKey  (264,  (264, "PerUserCookies", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02498   428   NtQueryValueKey  (264,  (264, "LeashLegacyCookies", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02499   428   NtQueryValueKey  (264,  (264, "DisableNT4RasCheck", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02500   428   NtQueryValueKey  (264,  (264, "DialupUseLanSettings", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02501   428   NtQueryValueKey  (264,  (264, "SendExtraCRLF", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02502   428   NtOpenKey  (0x1, {24, 28, 0x40, 0, 0,  (0x1, {24, 28, 0x40, 0, 0, "SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings"}, ... 336, ) }, ... 336, ) == 0x0
 02503   428   NtQueryValueKey  (336,  (336, "DontUseDNSLoadBalancing", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02504   428   NtClose  (336, ... ) == 0x0
 02505   428   NtQueryValueKey  (264,  (264, "DontUseDNSLoadBalancing", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02506   428   NtQueryValueKey  (264,  (264, "NonBlockingClient32", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02507   428   NtQueryValueKey  (264,  (264, "MimeExclusionListForCache", Partial, 144, ... TitleIdx=0, Type=1, Data="m\0u\0l\0t\0i\0p\0a\0r\0t\0/\0m\0i\0x\0e\0d\0 \0m\0u\0l\0t\0i\0p\0a\0r\0t\0/\0x\0-\0m\0i\0x\0e\0d\0-\0r\0e\0p\0l\0a\0c\0e\0 \0m\0u\0l\0t\0i\0p\0a\0r\0t\0/\0x\0-\0b\0y\0t\0e\0r\0a\0n\0g\0e\0s\0 \0\0\0"}, 144, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (264, "MimeExclusionListForCache", Partial, 144, ... TitleIdx=0, Type=1, Data="m\0u\0l\0t\0i\0p\0a\0r\0t\0/\0m\0i\0x\0e\0d\0 \0m\0u\0l\0t\0i\0p\0a\0r\0t\0/\0x\0-\0m\0i\0x\0e\0d\0-\0r\0e\0p\0l\0a\0c\0e\0 \0m\0u\0l\0t\0i\0p\0a\0r\0t\0/\0x\0-\0b\0y\0t\0e\0r\0a\0n\0g\0e\0s\0 \0\0\0"}, 144, ) }, 144, ) == 0x0
 02508   428   NtQueryValueKey  (264,  (264, "MimeExclusionListForCache", Partial, 144, ... TitleIdx=0, Type=1, Data="m\0u\0l\0t\0i\0p\0a\0r\0t\0/\0m\0i\0x\0e\0d\0 \0m\0u\0l\0t\0i\0p\0a\0r\0t\0/\0x\0-\0m\0i\0x\0e\0d\0-\0r\0e\0p\0l\0a\0c\0e\0 \0m\0u\0l\0t\0i\0p\0a\0r\0t\0/\0x\0-\0b\0y\0t\0e\0r\0a\0n\0g\0e\0s\0 \0\0\0"}, 144, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (264, "MimeExclusionListForCache", Partial, 144, ... TitleIdx=0, Type=1, Data="m\0u\0l\0t\0i\0p\0a\0r\0t\0/\0m\0i\0x\0e\0d\0 \0m\0u\0l\0t\0i\0p\0a\0r\0t\0/\0x\0-\0m\0i\0x\0e\0d\0-\0r\0e\0p\0l\0a\0c\0e\0 \0m\0u\0l\0t\0i\0p\0a\0r\0t\0/\0x\0-\0b\0y\0t\0e\0r\0a\0n\0g\0e\0s\0 \0\0\0"}, 144, ) }, 144, ) == 0x0
 02509   428   NtQueryValueKey  (264,  (264, "MimeExclusionListForCache", Partial, 144, ... TitleIdx=0, Type=1, Data="m\0u\0l\0t\0i\0p\0a\0r\0t\0/\0m\0i\0x\0e\0d\0 \0m\0u\0l\0t\0i\0p\0a\0r\0t\0/\0x\0-\0m\0i\0x\0e\0d\0-\0r\0e\0p\0l\0a\0c\0e\0 \0m\0u\0l\0t\0i\0p\0a\0r\0t\0/\0x\0-\0b\0y\0t\0e\0r\0a\0n\0g\0e\0s\0 \0\0\0"}, 144, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (264, "MimeExclusionListForCache", Partial, 144, ... TitleIdx=0, Type=1, Data="m\0u\0l\0t\0i\0p\0a\0r\0t\0/\0m\0i\0x\0e\0d\0 \0m\0u\0l\0t\0i\0p\0a\0r\0t\0/\0x\0-\0m\0i\0x\0e\0d\0-\0r\0e\0p\0l\0a\0c\0e\0 \0m\0u\0l\0t\0i\0p\0a\0r\0t\0/\0x\0-\0b\0y\0t\0e\0r\0a\0n\0g\0e\0s\0 \0\0\0"}, 144, ) }, 144, ) == 0x0
 02510   428   NtQueryValueKey  (264,  (264, "MimeExclusionListForCache", Partial, 144, ... TitleIdx=0, Type=1, Data="m\0u\0l\0t\0i\0p\0a\0r\0t\0/\0m\0i\0x\0e\0d\0 \0m\0u\0l\0t\0i\0p\0a\0r\0t\0/\0x\0-\0m\0i\0x\0e\0d\0-\0r\0e\0p\0l\0a\0c\0e\0 \0m\0u\0l\0t\0i\0p\0a\0r\0t\0/\0x\0-\0b\0y\0t\0e\0r\0a\0n\0g\0e\0s\0 \0\0\0"}, 144, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (264, "MimeExclusionListForCache", Partial, 144, ... TitleIdx=0, Type=1, Data="m\0u\0l\0t\0i\0p\0a\0r\0t\0/\0m\0i\0x\0e\0d\0 \0m\0u\0l\0t\0i\0p\0a\0r\0t\0/\0x\0-\0m\0i\0x\0e\0d\0-\0r\0e\0p\0l\0a\0c\0e\0 \0m\0u\0l\0t\0i\0p\0a\0r\0t\0/\0x\0-\0b\0y\0t\0e\0r\0a\0n\0g\0e\0s\0 \0\0\0"}, 144, ) }, 144, ) == 0x0
 02511   428   NtQueryValueKey  (264,  (264, "HeaderExclusionListForCache", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02512   428   NtQueryValueKey  (264,  (264, "DnsCacheEnabled", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02513   428   NtQueryValueKey  (264,  (264, "DnsCacheEntries", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02514   428   NtQueryValueKey  (264,  (264, "DnsCacheTimeout", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02515   428   NtQueryValueKey  (264,  (264, "WarnOnPost", Partial, 144, ... TitleIdx=0, Type=3, Data="\1\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=3, Data= (264, "WarnOnPost", Partial, 144, ... TitleIdx=0, Type=3, Data="\1\0\0\0"}, 16, ) }, 16, ) == 0x0
 02516   428   NtQueryValueKey  (264,  (264, "WarnAlwaysOnPost", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02517   428   NtQueryValueKey  (264,  (264, "WarnOnZoneCrossing", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02518   428   NtQueryValueKey  (264,  (264, "WarnOnBadCertSending", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02519   428   NtQueryValueKey  (264,  (264, "WarnOnBadCertRecving", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02520   428   NtQueryValueKey  (264,  (264, "WarnOnPostRedirect", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02521   428   NtQueryValueKey  (264,  (264, "AlwaysDrainOnRedirect", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02522   428   NtOpenMutant  (0x100000, {24, 52, 0x0, 0, 0,  (0x100000, {24, 52, 0x0, 0, 0, "WininetStartupMutex"}, ... 336, ) }, ... 336, ) == 0x0
 02523   428   NtCreateEvent  (0x1f0003, 0x0, 1, 1, ... 340, ) == 0x0
 02524   428   NtQueryValueKey  (264,  (264, "GlobalUserOffline", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02525   428   NtWaitForSingleObject  (280, 0, 0x0, ... ) == 0x0
 02526   428   NtQueryInformationFile  (276, 1238268, 24, Standard, ... {status=0x0, info=24}, ) == 0x0
 02527   428   NtReleaseMutant  (280, ... 0x0, ) == 0x0
 02528   428   NtOpenMutant  (0x100000, {24, 52, 0x0, 0, 0,  (0x100000, {24, 52, 0x0, 0, 0, "WininetConnectionMutex"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02529   428   NtCreateMutant  (0x1f0001, {24, 52, 0x80, 1382696, 0,  (0x1f0001, {24, 52, 0x80, 1382696, 0, "WininetConnectionMutex"}, 0, ... 344, ) }, 0, ... 344, ) == 0x0
 02530   428   NtCreateMutant  (0x1f0001, 0x0, 0, ... 348, ) == 0x0
 02531   428   NtOpenMutant  (0x100000, {24, 52, 0x0, 0, 0,  (0x100000, {24, 52, 0x0, 0, 0, "WininetProxyRegistryMutex"}, ... 352, ) }, ... 352, ) == 0x0
 02532   428   NtQueryValueKey  (264,  (264, "EnableAutodial", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (264, "EnableAutodial", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) }, 16, ) == 0x0
 02533   428   NtQueryValueKey  (264,  (264, "NoNetAutodial", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (264, "NoNetAutodial", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) }, 16, ) == 0x0
 02534   428   NtOpenKey  (0x1, {24, 28, 0x40, 0, 0,  (0x1, {24, 28, 0x40, 0, 0, "SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings"}, ... 356, ) }, ... 356, ) == 0x0
 02535   428   NtQueryValueKey  (356,  (356, "UrlEncoding", Partial, 144, ... TitleIdx=0, Type=1, Data="0\0x\00\00\00\00\00\00\00\00\0\0\0"}, 34, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (356, "UrlEncoding", Partial, 144, ... TitleIdx=0, Type=1, Data="0\0x\00\00\00\00\00\00\00\00\0\0\0"}, 34, ) }, 34, ) == 0x0
 02536   428   NtQueryValueKey  (356,  (356, "UrlEncoding", Partial, 144, ... TitleIdx=0, Type=1, Data="0\0x\00\00\00\00\00\00\00\00\0\0\0"}, 34, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (356, "UrlEncoding", Partial, 144, ... TitleIdx=0, Type=1, Data="0\0x\00\00\00\00\00\00\00\00\0\0\0"}, 34, ) }, 34, ) == 0x0
 02537   428   NtClose  (356, ... ) == 0x0
 02538   428   NtOpenSection  (0xe, {24, 8, 0x40, 0, 0,  (0xe, {24, 8, 0x40, 0, 0, "wsock32.dll"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02539   428   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\u:\work\wsock32.dll"}, 1236240, ... ) }, 1236240, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02540   428   NtQueryAttributesFile  ({24, 12, 0x40, 0, 0,  ({24, 12, 0x40, 0, 0, "wsock32.dll"}, 1236240, ... ) }, 1236240, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02541   428   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\System32\wsock32.dll"}, 1236240, ... ) }, 1236240, ... ) == 0x0
 02542   428   NtOpenFile  (0x100020, {24, 0, 0x40, 0, 0,  (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\System32\wsock32.dll"}, 5, 96, ... 356, {status=0x0, info=1}, ) }, 5, 96, ... 356, {status=0x0, info=1}, ) == 0x0
 02543   428   NtCreateSection  (0xf, 0x0, 0x0, 16, 16777216, 356, ... 360, ) == 0x0
 02544   428   NtQuerySection  (360, Image, 48, ... {section info, class 1, size 48}, 0x0, ) == 0x0
 02545   428   NtClose  (356, ... ) == 0x0
 02546   428   NtMapViewOfSection  (360, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x71ad0000), 0x0, 32768, ) == 0x0
 02547   428   NtClose  (360, ... ) == 0x0
 02548   428   NtOpenSection  (0xe, {24, 8, 0x40, 0, 0,  (0xe, {24, 8, 0x40, 0, 0, "WS2_32.dll"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02549   428   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\u:\work\WS2_32.dll"}, 1235436, ... ) }, 1235436, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02550   428   NtQueryAttributesFile  ({24, 12, 0x40, 0, 0,  ({24, 12, 0x40, 0, 0, "WS2_32.dll"}, 1235436, ... ) }, 1235436, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02551   428   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\System32\WS2_32.dll"}, 1235436, ... ) }, 1235436, ... ) == 0x0
 02552   428   NtOpenFile  (0x100020, {24, 0, 0x40, 0, 0,  (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\System32\WS2_32.dll"}, 5, 96, ... 360, {status=0x0, info=1}, ) }, 5, 96, ... 360, {status=0x0, info=1}, ) == 0x0
 02553   428   NtCreateSection  (0xf, 0x0, 0x0, 16, 16777216, 360, ... 356, ) == 0x0
 02554   428   NtQuerySection  (356, Image, 48, ... {section info, class 1, size 48}, 0x0, ) == 0x0
 02555   428   NtClose  (360, ... ) == 0x0
 02556   428   NtMapViewOfSection  (356, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x71ab0000), 0x0, 86016, ) == 0x0
 02557   428   NtClose  (356, ... ) == 0x0
 02558   428   NtOpenSection  (0xe, {24, 8, 0x40, 0, 0,  (0xe, {24, 8, 0x40, 0, 0, "WS2HELP.dll"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02559   428   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\u:\work\WS2HELP.dll"}, 1234632, ... ) }, 1234632, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02560   428   NtQueryAttributesFile  ({24, 12, 0x40, 0, 0,  ({24, 12, 0x40, 0, 0, "WS2HELP.dll"}, 1234632, ... ) }, 1234632, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02561   428   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\System32\WS2HELP.dll"}, 1234632, ... ) }, 1234632, ... ) == 0x0
 02562   428   NtOpenFile  (0x100020, {24, 0, 0x40, 0, 0,  (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\System32\WS2HELP.dll"}, 5, 96, ... 356, {status=0x0, info=1}, ) }, 5, 96, ... 356, {status=0x0, info=1}, ) == 0x0
 02563   428   NtCreateSection  (0xf, 0x0, 0x0, 16, 16777216, 356, ... 360, ) == 0x0
 02564   428   NtQuerySection  (360, Image, 48, ... {section info, class 1, size 48}, 0x0, ) == 0x0
 02565   428   NtClose  (356, ... ) == 0x0
 02566   428   NtMapViewOfSection  (360, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x71aa0000), 0x0, 32768, ) == 0x0
 02567   428   NtClose  (360, ... ) == 0x0
 02568   428   NtQuerySystemInformation  (Basic, 44, ... {Unknown=0,MaximumIncrement=156250,PhysicalPageSize=0x1000,NumberOfPhysicalPages=0xff7c,LowestPhysicalPage=0x1,HighestPhysicalPage=0xffff,AllocationGranularity=0x10000,LowestUserAddress=0x10000,HighestUserAddress=0x7ffeffff,ActiveProcessors=1,NumberProcessors=1,}, 0x0, ) == 0x0
 02569   428   NtQuerySystemInformation  (Processor, 12, ... {system info, class 1, size 12}, 0x0, ) == 0x0
 02570   428   NtOpenKey  (0x2000000, {24, 28, 0x40, 0, 0,  (0x2000000, {24, 28, 0x40, 0, 0, "System\CurrentControlSet\Services\WinSock2\Parameters"}, ... 360, ) }, ... 360, ) == 0x0
 02571   428   NtQueryValueKey  (360,  (360, "WinSock_Registry_Version", Partial, 144, ... TitleIdx=0, Type=1, Data="2\0.\00\0\0\0"}, 20, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (360, "WinSock_Registry_Version", Partial, 144, ... TitleIdx=0, Type=1, Data="2\0.\00\0\0\0"}, 20, ) }, 20, ) == 0x0
 02572   428   NtQueryValueKey  (360,  (360, "WinSock_Registry_Version", Partial, 144, ... TitleIdx=0, Type=1, Data="2\0.\00\0\0\0"}, 20, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (360, "WinSock_Registry_Version", Partial, 144, ... TitleIdx=0, Type=1, Data="2\0.\00\0\0\0"}, 20, ) }, 20, ) == 0x0
 02573   428   NtCreateEvent  (0x1f0003, 0x0, 0, 0, ... 356, ) == 0x0
 02574   428   NtOpenKey  (0x2000000, {24, 360, 0x40, 0, 0,  (0x2000000, {24, 360, 0x40, 0, 0, "Protocol_Catalog9"}, ... 364, ) }, ... 364, ) == 0x0
 02575   428   NtQueryValueKey  (364,  (364, "Serial_Access_Num", Partial, 144, ... TitleIdx=0, Type=4, Data="\31\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (364, "Serial_Access_Num", Partial, 144, ... TitleIdx=0, Type=4, Data="\31\0\0\0"}, 16, ) }, 16, ) == 0x0
 02576   428   NtNotifyChangeKey  (364, 356, 0, 0, 2011390432, 1, 0, 0, 0, 1, ... ) == 0x103
 02577   428   NtQueryValueKey  (364,  (364, "Serial_Access_Num", Partial, 144, ... TitleIdx=0, Type=4, Data="\31\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (364, "Serial_Access_Num", Partial, 144, ... TitleIdx=0, Type=4, Data="\31\0\0\0"}, 16, ) }, 16, ) == 0x0
 02578   428   NtOpenKey  (0x2000000, {24, 364, 0x40, 0, 0,  (0x2000000, {24, 364, 0x40, 0, 0, "00000019"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02579   428   NtQueryValueKey  (364,  (364, "Next_Catalog_Entry_ID", Partial, 144, ... TitleIdx=0, Type=4, Data="\376\3\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (364, "Next_Catalog_Entry_ID", Partial, 144, ... TitleIdx=0, Type=4, Data="\376\3\0\0"}, 16, ) }, 16, ) == 0x0
 02580   428   NtQueryValueKey  (364,  (364, "Num_Catalog_Entries", Partial, 144, ... TitleIdx=0, Type=4, Data="\13\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (364, "Num_Catalog_Entries", Partial, 144, ... TitleIdx=0, Type=4, Data="\13\0\0\0"}, 16, ) }, 16, ) == 0x0
 02581   428   NtOpenKey  (0x2000000, {24, 364, 0x40, 0, 0,  (0x2000000, {24, 364, 0x40, 0, 0, "Catalog_Entries"}, ... 368, ) }, ... 368, ) == 0x0
 02582   428   NtOpenKey  (0x20019, {24, 368, 0x40, 0, 0,  (0x20019, {24, 368, 0x40, 0, 0, "000000000001"}, ... 372, ) }, ... 372, ) == 0x0
 02583   428   NtQueryValueKey  (372,  (372, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 02584   428   NtAllocateVirtualMemory  (-1, 1449984, 0, 4096, 4096, 4, ... 1449984, 4096, ) == 0x0
 02585   428   NtQueryValueKey  (372,  (372, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 02586   428   NtQueryValueKey  (372,  (372, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0gram\FSLSP.DLL\0\00\0\0\0\10\0\2\0\10\0\4\1\10\0h\220\354\28\220\354\2\2\0\12\0\4\1\12\00\00\0\0\0\10\0\2\0\14\0\4\1\10\0\210\220\354\2X\220\354\2\2\0\16\0\4\1\12\00\00\0\0\0\10\0\2\0\20\0\4\1\10\0\250\220\354\2x\220\354\2\2\0\22\0\4\1\12\00\00\0\0\0\10\0\2\0\24\0\4\1\10\0\310\220\354\2\230\220\354\2\2\0\26\0\4\1\12\00\00\0\0\0\10\0\2\0\30\0\4\1\10\0\0\0\0\0\270\220\354\2\2\0\32\0\4\1\10\0H\0K\0R\0\0\0\3\0\34\0\4\1\10\0\360\222\354\2\0\0\0\0\0\221\354\2\16\0\0\0<\0\37\0\4\0\10\0X\3\10\0X\3\10\0\4\0\2\0f\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\10\0\0\0\240\32\17\347\213\253\317\21\214\243\0\200_H\241\222\351\3\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\2\0\0\0\20\0\0\0\20\0\0\0\1\0\0\0\6\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0T\0c\0p\0i\0p\0 \0[\0T\0C\0P\0/\0I\0P\0]\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\204\3\0\0\33\12\0\0\244\1\0\0\254\1\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0t\1\0\0\33\12\0\0\244\1\0\0\254\1\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\34\12\0\0\244\1\0\0\254\1\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0p\1\0\0\340\343\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\220\222\25\0\0\0\0\00\00\00\00\00\00\00\00\00\00\00\02\0\34\12\0\0\244\1\0\0\254\1\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0t\1\0\0\35\12\0\0\244\1\0\0\254\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0t\1\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\25\0\2\0\0\0\220\0\0\0\35\12\0\0\244\1\0\0\254\1\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\36\12\0\0\244\1\0\0\254\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0t\1\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) , Partial, 900, ... TitleIdx=0, Type=3, Data= (372, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0gram\FSLSP.DLL\0\00\0\0\0\10\0\2\0\10\0\4\1\10\0h\220\354\28\220\354\2\2\0\12\0\4\1\12\00\00\0\0\0\10\0\2\0\14\0\4\1\10\0\210\220\354\2X\220\354\2\2\0\16\0\4\1\12\00\00\0\0\0\10\0\2\0\20\0\4\1\10\0\250\220\354\2x\220\354\2\2\0\22\0\4\1\12\00\00\0\0\0\10\0\2\0\24\0\4\1\10\0\310\220\354\2\230\220\354\2\2\0\26\0\4\1\12\00\00\0\0\0\10\0\2\0\30\0\4\1\10\0\0\0\0\0\270\220\354\2\2\0\32\0\4\1\10\0H\0K\0R\0\0\0\3\0\34\0\4\1\10\0\360\222\354\2\0\0\0\0\0\221\354\2\16\0\0\0<\0\37\0\4\0\10\0X\3\10\0X\3\10\0\4\0\2\0f\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\10\0\0\0\240\32\17\347\213\253\317\21\214\243\0\200_H\241\222\351\3\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\2\0\0\0\20\0\0\0\20\0\0\0\1\0\0\0\6\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0T\0c\0p\0i\0p\0 \0[\0T\0C\0P\0/\0I\0P\0]\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\204\3\0\0\33\12\0\0\244\1\0\0\254\1\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0t\1\0\0\33\12\0\0\244\1\0\0\254\1\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\34\12\0\0\244\1\0\0\254\1\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0p\1\0\0\340\343\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\220\222\25\0\0\0\0\00\00\00\00\00\00\00\00\00\00\00\02\0\34\12\0\0\244\1\0\0\254\1\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0t\1\0\0\35\12\0\0\244\1\0\0\254\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0t\1\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\25\0\2\0\0\0\220\0\0\0\35\12\0\0\244\1\0\0\254\1\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\36\12\0\0\244\1\0\0\254\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0t\1\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) \0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\25\0\2\0\0\0\220\0\0\0\35\12\0\0\244\1\0\0\254\1\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\36\12\0\0\244\1\0\0\254\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0t\1\0\0\0\0\0\0 (372, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0gram\FSLSP.DLL\0\00\0\0\0\10\0\2\0\10\0\4\1\10\0h\220\354\28\220\354\2\2\0\12\0\4\1\12\00\00\0\0\0\10\0\2\0\14\0\4\1\10\0\210\220\354\2X\220\354\2\2\0\16\0\4\1\12\00\00\0\0\0\10\0\2\0\20\0\4\1\10\0\250\220\354\2x\220\354\2\2\0\22\0\4\1\12\00\00\0\0\0\10\0\2\0\24\0\4\1\10\0\310\220\354\2\230\220\354\2\2\0\26\0\4\1\12\00\00\0\0\0\10\0\2\0\30\0\4\1\10\0\0\0\0\0\270\220\354\2\2\0\32\0\4\1\10\0H\0K\0R\0\0\0\3\0\34\0\4\1\10\0\360\222\354\2\0\0\0\0\0\221\354\2\16\0\0\0<\0\37\0\4\0\10\0X\3\10\0X\3\10\0\4\0\2\0f\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\10\0\0\0\240\32\17\347\213\253\317\21\214\243\0\200_H\241\222\351\3\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\2\0\0\0\20\0\0\0\20\0\0\0\1\0\0\0\6\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0T\0c\0p\0i\0p\0 \0[\0T\0C\0P\0/\0I\0P\0]\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\204\3\0\0\33\12\0\0\244\1\0\0\254\1\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0t\1\0\0\33\12\0\0\244\1\0\0\254\1\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\34\12\0\0\244\1\0\0\254\1\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0p\1\0\0\340\343\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\220\222\25\0\0\0\0\00\00\00\00\00\00\00\00\00\00\00\02\0\34\12\0\0\244\1\0\0\254\1\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0t\1\0\0\35\12\0\0\244\1\0\0\254\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0t\1\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\25\0\2\0\0\0\220\0\0\0\35\12\0\0\244\1\0\0\254\1\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\36\12\0\0\244\1\0\0\254\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0t\1\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) }, 900, ) == 0x0
 02587   428   NtClose  (372, ... ) == 0x0
 02588   428   NtOpenKey  (0x20019, {24, 368, 0x40, 0, 0,  (0x20019, {24, 368, 0x40, 0, 0, "000000000002"}, ... 372, ) }, ... 372, ) == 0x0
 02589   428   NtQueryValueKey  (372,  (372, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 02590   428   NtQueryValueKey  (372,  (372, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 02591   428   NtQueryValueKey  (372,  (372, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0gram\FSLSP.DLL\0\00\0\0\0\10\0\2\0\10\0\4\1\10\0h\220\354\28\220\354\2\2\0\12\0\4\1\12\00\00\0\0\0\10\0\2\0\14\0\4\1\10\0\210\220\354\2X\220\354\2\2\0\16\0\4\1\12\00\00\0\0\0\10\0\2\0\20\0\4\1\10\0\250\220\354\2x\220\354\2\2\0\22\0\4\1\12\00\00\0\0\0\10\0\2\0\24\0\4\1\10\0\310\220\354\2\230\220\354\2\2\0\26\0\4\1\12\00\00\0\0\0\10\0\2\0\30\0\4\1\10\0\0\0\0\0\270\220\354\2\2\0\32\0\4\1\10\0H\0K\0R\0\0\0\3\0\34\0\4\1\10\0\360\222\354\2\0\0\0\0\0\221\354\2\16\0\0\0<\0\37\0\4\0\10\0X\3\10\0X\3\10\0\4\0\2\0\11\6\2\0\0\0\0\0\0\0\0\0\0\0\0\0\10\0\0\0\240\32\17\347\213\253\317\21\214\243\0\200_H\241\222\352\3\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\2\0\0\0\20\0\0\0\20\0\0\0\2\0\0\0\21\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\273\377\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0T\0c\0p\0i\0p\0 \0[\0U\0D\0P\0/\0I\0P\0]\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\204\3\0\0 \12\0\0\244\1\0\0\254\1\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0t\1\0\0 \12\0\0\244\1\0\0\254\1\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0!\12\0\0\244\1\0\0\254\1\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0p\1\0\0\340\343\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\220\222\25\0\0\0\0\00\00\00\00\00\00\00\00\00\00\00\03\0!\12\0\0\244\1\0\0\254\1\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0t\1\0\0"\12\0\0\244\1\0\0\254\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0t\1\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\25\0\2\0\0\0\220\0\0\0"\12\0\0\244\1\0\0\254\1\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0#\12\0\0\244\1\0\0\254\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0t\1\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) , Partial, 900, ... TitleIdx=0, Type=3, Data= (372, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0gram\FSLSP.DLL\0\00\0\0\0\10\0\2\0\10\0\4\1\10\0h\220\354\28\220\354\2\2\0\12\0\4\1\12\00\00\0\0\0\10\0\2\0\14\0\4\1\10\0\210\220\354\2X\220\354\2\2\0\16\0\4\1\12\00\00\0\0\0\10\0\2\0\20\0\4\1\10\0\250\220\354\2x\220\354\2\2\0\22\0\4\1\12\00\00\0\0\0\10\0\2\0\24\0\4\1\10\0\310\220\354\2\230\220\354\2\2\0\26\0\4\1\12\00\00\0\0\0\10\0\2\0\30\0\4\1\10\0\0\0\0\0\270\220\354\2\2\0\32\0\4\1\10\0H\0K\0R\0\0\0\3\0\34\0\4\1\10\0\360\222\354\2\0\0\0\0\0\221\354\2\16\0\0\0<\0\37\0\4\0\10\0X\3\10\0X\3\10\0\4\0\2\0\11\6\2\0\0\0\0\0\0\0\0\0\0\0\0\0\10\0\0\0\240\32\17\347\213\253\317\21\214\243\0\200_H\241\222\352\3\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\2\0\0\0\20\0\0\0\20\0\0\0\2\0\0\0\21\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\273\377\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0T\0c\0p\0i\0p\0 \0[\0U\0D\0P\0/\0I\0P\0]\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\204\3\0\0 \12\0\0\244\1\0\0\254\1\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0t\1\0\0 \12\0\0\244\1\0\0\254\1\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0!\12\0\0\244\1\0\0\254\1\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0p\1\0\0\340\343\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\220\222\25\0\0\0\0\00\00\00\00\00\00\00\00\00\00\00\03\0!\12\0\0\244\1\0\0\254\1\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0t\1\0\0"\12\0\0\244\1\0\0\254\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0t\1\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\25\0\2\0\0\0\220\0\0\0"\12\0\0\244\1\0\0\254\1\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0#\12\0\0\244\1\0\0\254\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0t\1\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) \12\0\0\244\1\0\0\254\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0t\1\0\0\0\0\0\0 (372, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0gram\FSLSP.DLL\0\00\0\0\0\10\0\2\0\10\0\4\1\10\0h\220\354\28\220\354\2\2\0\12\0\4\1\12\00\00\0\0\0\10\0\2\0\14\0\4\1\10\0\210\220\354\2X\220\354\2\2\0\16\0\4\1\12\00\00\0\0\0\10\0\2\0\20\0\4\1\10\0\250\220\354\2x\220\354\2\2\0\22\0\4\1\12\00\00\0\0\0\10\0\2\0\24\0\4\1\10\0\310\220\354\2\230\220\354\2\2\0\26\0\4\1\12\00\00\0\0\0\10\0\2\0\30\0\4\1\10\0\0\0\0\0\270\220\354\2\2\0\32\0\4\1\10\0H\0K\0R\0\0\0\3\0\34\0\4\1\10\0\360\222\354\2\0\0\0\0\0\221\354\2\16\0\0\0<\0\37\0\4\0\10\0X\3\10\0X\3\10\0\4\0\2\0\11\6\2\0\0\0\0\0\0\0\0\0\0\0\0\0\10\0\0\0\240\32\17\347\213\253\317\21\214\243\0\200_H\241\222\352\3\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\2\0\0\0\20\0\0\0\20\0\0\0\2\0\0\0\21\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\273\377\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0T\0c\0p\0i\0p\0 \0[\0U\0D\0P\0/\0I\0P\0]\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\204\3\0\0 \12\0\0\244\1\0\0\254\1\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0t\1\0\0 \12\0\0\244\1\0\0\254\1\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0!\12\0\0\244\1\0\0\254\1\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0p\1\0\0\340\343\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\220\222\25\0\0\0\0\00\00\00\00\00\00\00\00\00\00\00\03\0!\12\0\0\244\1\0\0\254\1\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0t\1\0\0"\12\0\0\244\1\0\0\254\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0t\1\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\25\0\2\0\0\0\220\0\0\0"\12\0\0\244\1\0\0\254\1\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0#\12\0\0\244\1\0\0\254\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0t\1\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) \12\0\0\244\1\0\0\254\1\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0#\12\0\0\244\1\0\0\254\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0t\1\0\0\0\0\0\0 (372, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0gram\FSLSP.DLL\0\00\0\0\0\10\0\2\0\10\0\4\1\10\0h\220\354\28\220\354\2\2\0\12\0\4\1\12\00\00\0\0\0\10\0\2\0\14\0\4\1\10\0\210\220\354\2X\220\354\2\2\0\16\0\4\1\12\00\00\0\0\0\10\0\2\0\20\0\4\1\10\0\250\220\354\2x\220\354\2\2\0\22\0\4\1\12\00\00\0\0\0\10\0\2\0\24\0\4\1\10\0\310\220\354\2\230\220\354\2\2\0\26\0\4\1\12\00\00\0\0\0\10\0\2\0\30\0\4\1\10\0\0\0\0\0\270\220\354\2\2\0\32\0\4\1\10\0H\0K\0R\0\0\0\3\0\34\0\4\1\10\0\360\222\354\2\0\0\0\0\0\221\354\2\16\0\0\0<\0\37\0\4\0\10\0X\3\10\0X\3\10\0\4\0\2\0\11\6\2\0\0\0\0\0\0\0\0\0\0\0\0\0\10\0\0\0\240\32\17\347\213\253\317\21\214\243\0\200_H\241\222\352\3\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\2\0\0\0\20\0\0\0\20\0\0\0\2\0\0\0\21\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\273\377\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0T\0c\0p\0i\0p\0 \0[\0U\0D\0P\0/\0I\0P\0]\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\204\3\0\0 \12\0\0\244\1\0\0\254\1\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0t\1\0\0 \12\0\0\244\1\0\0\254\1\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0!\12\0\0\244\1\0\0\254\1\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0p\1\0\0\340\343\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\220\222\25\0\0\0\0\00\00\00\00\00\00\00\00\00\00\00\03\0!\12\0\0\244\1\0\0\254\1\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0t\1\0\0"\12\0\0\244\1\0\0\254\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0t\1\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\25\0\2\0\0\0\220\0\0\0"\12\0\0\244\1\0\0\254\1\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0#\12\0\0\244\1\0\0\254\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0t\1\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) }, 900, ) == 0x0
 02592   428   NtClose  (372, ... ) == 0x0
 02593   428   NtOpenKey  (0x20019, {24, 368, 0x40, 0, 0,  (0x20019, {24, 368, 0x40, 0, 0, "000000000003"}, ... 372, ) }, ... 372, ) == 0x0
 02594   428   NtQueryValueKey  (372,  (372, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 02595   428   NtQueryValueKey  (372,  (372, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 02596   428   NtQueryValueKey  (372,  (372, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0gram\FSLSP.DLL\0\00\0\0\0\10\0\2\0\10\0\4\1\10\0h\220\354\28\220\354\2\2\0\12\0\4\1\12\00\00\0\0\0\10\0\2\0\14\0\4\1\10\0\210\220\354\2X\220\354\2\2\0\16\0\4\1\12\00\00\0\0\0\10\0\2\0\20\0\4\1\10\0\250\220\354\2x\220\354\2\2\0\22\0\4\1\12\00\00\0\0\0\10\0\2\0\24\0\4\1\10\0\310\220\354\2\230\220\354\2\2\0\26\0\4\1\12\00\00\0\0\0\10\0\2\0\30\0\4\1\10\0\0\0\0\0\270\220\354\2\2\0\32\0\4\1\10\0H\0K\0R\0\0\0\3\0\34\0\4\1\10\0\360\222\354\2\0\0\0\0\0\221\354\2\16\0\0\0<\0\37\0\4\0\10\0X\3\10\0X\3\10\0\4\0\2\0\11\6\2\0\0\0\0\0\0\0\0\0\0\0\0\0\14\0\0\0\240\32\17\347\213\253\317\21\214\243\0\200_H\241\222\353\3\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\2\0\0\0\20\0\0\0\20\0\0\0\3\0\0\0\0\0\0\0\377\0\0\0\0\0\0\0\0\0\0\0\273\377\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0T\0c\0p\0i\0p\0 \0[\0R\0A\0W\0/\0I\0P\0]\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\204\3\0\0%\12\0\0\244\1\0\0\254\1\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0t\1\0\0%\12\0\0\244\1\0\0\254\1\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0&\12\0\0\244\1\0\0\254\1\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0p\1\0\0\340\343\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\220\222\25\0\0\0\0\00\00\00\00\00\00\00\00\00\00\00\04\0&\12\0\0\244\1\0\0\254\1\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0t\1\0\0'\12\0\0\244\1\0\0\254\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0t\1\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\25\0\2\0\0\0\220\0\0\0'\12\0\0\244\1\0\0\254\1\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0(\12\0\0\244\1\0\0\254\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0t\1\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) , Partial, 900, ... TitleIdx=0, Type=3, Data= (372, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0gram\FSLSP.DLL\0\00\0\0\0\10\0\2\0\10\0\4\1\10\0h\220\354\28\220\354\2\2\0\12\0\4\1\12\00\00\0\0\0\10\0\2\0\14\0\4\1\10\0\210\220\354\2X\220\354\2\2\0\16\0\4\1\12\00\00\0\0\0\10\0\2\0\20\0\4\1\10\0\250\220\354\2x\220\354\2\2\0\22\0\4\1\12\00\00\0\0\0\10\0\2\0\24\0\4\1\10\0\310\220\354\2\230\220\354\2\2\0\26\0\4\1\12\00\00\0\0\0\10\0\2\0\30\0\4\1\10\0\0\0\0\0\270\220\354\2\2\0\32\0\4\1\10\0H\0K\0R\0\0\0\3\0\34\0\4\1\10\0\360\222\354\2\0\0\0\0\0\221\354\2\16\0\0\0<\0\37\0\4\0\10\0X\3\10\0X\3\10\0\4\0\2\0\11\6\2\0\0\0\0\0\0\0\0\0\0\0\0\0\14\0\0\0\240\32\17\347\213\253\317\21\214\243\0\200_H\241\222\353\3\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\2\0\0\0\20\0\0\0\20\0\0\0\3\0\0\0\0\0\0\0\377\0\0\0\0\0\0\0\0\0\0\0\273\377\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0T\0c\0p\0i\0p\0 \0[\0R\0A\0W\0/\0I\0P\0]\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\204\3\0\0%\12\0\0\244\1\0\0\254\1\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0t\1\0\0%\12\0\0\244\1\0\0\254\1\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0&\12\0\0\244\1\0\0\254\1\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0p\1\0\0\340\343\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\220\222\25\0\0\0\0\00\00\00\00\00\00\00\00\00\00\00\04\0&\12\0\0\244\1\0\0\254\1\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0t\1\0\0'\12\0\0\244\1\0\0\254\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0t\1\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\25\0\2\0\0\0\220\0\0\0'\12\0\0\244\1\0\0\254\1\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0(\12\0\0\244\1\0\0\254\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0t\1\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) \0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\25\0\2\0\0\0\220\0\0\0'\12\0\0\244\1\0\0\254\1\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0(\12\0\0\244\1\0\0\254\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0t\1\0\0\0\0\0\0 (372, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0gram\FSLSP.DLL\0\00\0\0\0\10\0\2\0\10\0\4\1\10\0h\220\354\28\220\354\2\2\0\12\0\4\1\12\00\00\0\0\0\10\0\2\0\14\0\4\1\10\0\210\220\354\2X\220\354\2\2\0\16\0\4\1\12\00\00\0\0\0\10\0\2\0\20\0\4\1\10\0\250\220\354\2x\220\354\2\2\0\22\0\4\1\12\00\00\0\0\0\10\0\2\0\24\0\4\1\10\0\310\220\354\2\230\220\354\2\2\0\26\0\4\1\12\00\00\0\0\0\10\0\2\0\30\0\4\1\10\0\0\0\0\0\270\220\354\2\2\0\32\0\4\1\10\0H\0K\0R\0\0\0\3\0\34\0\4\1\10\0\360\222\354\2\0\0\0\0\0\221\354\2\16\0\0\0<\0\37\0\4\0\10\0X\3\10\0X\3\10\0\4\0\2\0\11\6\2\0\0\0\0\0\0\0\0\0\0\0\0\0\14\0\0\0\240\32\17\347\213\253\317\21\214\243\0\200_H\241\222\353\3\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\2\0\0\0\20\0\0\0\20\0\0\0\3\0\0\0\0\0\0\0\377\0\0\0\0\0\0\0\0\0\0\0\273\377\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0T\0c\0p\0i\0p\0 \0[\0R\0A\0W\0/\0I\0P\0]\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\204\3\0\0%\12\0\0\244\1\0\0\254\1\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0t\1\0\0%\12\0\0\244\1\0\0\254\1\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0&\12\0\0\244\1\0\0\254\1\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0p\1\0\0\340\343\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\220\222\25\0\0\0\0\00\00\00\00\00\00\00\00\00\00\00\04\0&\12\0\0\244\1\0\0\254\1\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0t\1\0\0'\12\0\0\244\1\0\0\254\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0t\1\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\25\0\2\0\0\0\220\0\0\0'\12\0\0\244\1\0\0\254\1\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0(\12\0\0\244\1\0\0\254\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0t\1\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) }, 900, ) == 0x0
 02597   428   NtClose  (372, ... ) == 0x0
 02598   428   NtOpenKey  (0x20019, {24, 368, 0x40, 0, 0,  (0x20019, {24, 368, 0x40, 0, 0, "000000000004"}, ... 372, ) }, ... 372, ) == 0x0
 02599   428   NtQueryValueKey  (372,  (372, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 02600   428   NtQueryValueKey  (372,  (372, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 02601   428   NtAllocateVirtualMemory  (-1, 1454080, 0, 4096, 4096, 4, ... 1454080, 4096, ) == 0x0
 02602   428   NtQueryValueKey  (372,  (372, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\rsvpsp.dll\0\0gram\FSLSP.DLL\0\00\0\0\0\10\0\2\0\10\0\4\1\10\0h\220\354\28\220\354\2\2\0\12\0\4\1\12\00\00\0\0\0\10\0\2\0\14\0\4\1\10\0\210\220\354\2X\220\354\2\2\0\16\0\4\1\12\00\00\0\0\0\10\0\2\0\20\0\4\1\10\0\250\220\354\2x\220\354\2\2\0\22\0\4\1\12\00\00\0\0\0\10\0\2\0\24\0\4\1\10\0\310\220\354\2\230\220\354\2\2\0\26\0\4\1\12\00\00\0\0\0\10\0\2\0\30\0\4\1\10\0\0\0\0\0\270\220\354\2\2\0\32\0\4\1\10\0H\0K\0R\0\0\0\3\0\34\0\4\1\10\0\360\222\354\2\0\0\0\0\0\221\354\2\16\0\0\0<\0\37\0\4\0\10\0X\3\10\0X\3\10\0\4\0\2\0\11&\2\0\0\0\0\0\0\0\0\0\0\0\0\0\10\0\0\0\340\251`\235z3\320\21\275\210\0\0\300\202\346\232\354\3\0\0\1\0\0\0\310\371\252\1\26\0\30\0\10<_u\0\0\0\0|\370\252\1\27\207`u\0\0\0\0\6\0\0\0\2\0\0\0\20\0\0\0\20\0\0\0\2\0\0\0\21\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\273\377\0\0\0\0\0\0R\0S\0V\0P\0 \0U\0D\0P\0 \0S\0e\0r\0v\0i\0c\0e\0 \0P\0r\0o\0v\0i\0d\0e\0r\0\0\0\30\371\252\1\17.\365w\13\30\365w\1\0\0\0\0\374\252\1\4\0\0\0\0\0\0\0\0\0\0\0\1\0\0\0\17.\365w\0\0\0\0\250\371\252\1 \22\365wO\22\365wT\22\365w\0\0\0\0\204\3\0\0+\12\0\0\244\1\0\0\254\1\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0t\1\0\0+\12\0\0\244\1\0\0\254\1\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0,\12\0\0\244\1\0\0\254\1\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0p\1\0\0\340\343\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\220\222\25\0\0\0\0\00\00\00\00\00\00\00\00\00\00\00\05\0,\12\0\0\244\1\0\0\254\1\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0t\1\0\0-\12\0\0\244\1\0\0\254\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0t\1\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\25\0\2\0\0\0\220\0\0\0-\12\0\0\244\1\0\0\254\1\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0.\12\0\0\244\1\0\0\254\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0t\1\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) , Partial, 900, ... TitleIdx=0, Type=3, Data= (372, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\rsvpsp.dll\0\0gram\FSLSP.DLL\0\00\0\0\0\10\0\2\0\10\0\4\1\10\0h\220\354\28\220\354\2\2\0\12\0\4\1\12\00\00\0\0\0\10\0\2\0\14\0\4\1\10\0\210\220\354\2X\220\354\2\2\0\16\0\4\1\12\00\00\0\0\0\10\0\2\0\20\0\4\1\10\0\250\220\354\2x\220\354\2\2\0\22\0\4\1\12\00\00\0\0\0\10\0\2\0\24\0\4\1\10\0\310\220\354\2\230\220\354\2\2\0\26\0\4\1\12\00\00\0\0\0\10\0\2\0\30\0\4\1\10\0\0\0\0\0\270\220\354\2\2\0\32\0\4\1\10\0H\0K\0R\0\0\0\3\0\34\0\4\1\10\0\360\222\354\2\0\0\0\0\0\221\354\2\16\0\0\0<\0\37\0\4\0\10\0X\3\10\0X\3\10\0\4\0\2\0\11&\2\0\0\0\0\0\0\0\0\0\0\0\0\0\10\0\0\0\340\251`\235z3\320\21\275\210\0\0\300\202\346\232\354\3\0\0\1\0\0\0\310\371\252\1\26\0\30\0\10<_u\0\0\0\0|\370\252\1\27\207`u\0\0\0\0\6\0\0\0\2\0\0\0\20\0\0\0\20\0\0\0\2\0\0\0\21\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\273\377\0\0\0\0\0\0R\0S\0V\0P\0 \0U\0D\0P\0 \0S\0e\0r\0v\0i\0c\0e\0 \0P\0r\0o\0v\0i\0d\0e\0r\0\0\0\30\371\252\1\17.\365w\13\30\365w\1\0\0\0\0\374\252\1\4\0\0\0\0\0\0\0\0\0\0\0\1\0\0\0\17.\365w\0\0\0\0\250\371\252\1 \22\365wO\22\365wT\22\365w\0\0\0\0\204\3\0\0+\12\0\0\244\1\0\0\254\1\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0t\1\0\0+\12\0\0\244\1\0\0\254\1\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0,\12\0\0\244\1\0\0\254\1\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0p\1\0\0\340\343\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\220\222\25\0\0\0\0\00\00\00\00\00\00\00\00\00\00\00\05\0,\12\0\0\244\1\0\0\254\1\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0t\1\0\0-\12\0\0\244\1\0\0\254\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0t\1\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\25\0\2\0\0\0\220\0\0\0-\12\0\0\244\1\0\0\254\1\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0.\12\0\0\244\1\0\0\254\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0t\1\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) \0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\25\0\2\0\0\0\220\0\0\0-\12\0\0\244\1\0\0\254\1\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0.\12\0\0\244\1\0\0\254\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0t\1\0\0\0\0\0\0 (372, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\rsvpsp.dll\0\0gram\FSLSP.DLL\0\00\0\0\0\10\0\2\0\10\0\4\1\10\0h\220\354\28\220\354\2\2\0\12\0\4\1\12\00\00\0\0\0\10\0\2\0\14\0\4\1\10\0\210\220\354\2X\220\354\2\2\0\16\0\4\1\12\00\00\0\0\0\10\0\2\0\20\0\4\1\10\0\250\220\354\2x\220\354\2\2\0\22\0\4\1\12\00\00\0\0\0\10\0\2\0\24\0\4\1\10\0\310\220\354\2\230\220\354\2\2\0\26\0\4\1\12\00\00\0\0\0\10\0\2\0\30\0\4\1\10\0\0\0\0\0\270\220\354\2\2\0\32\0\4\1\10\0H\0K\0R\0\0\0\3\0\34\0\4\1\10\0\360\222\354\2\0\0\0\0\0\221\354\2\16\0\0\0<\0\37\0\4\0\10\0X\3\10\0X\3\10\0\4\0\2\0\11&\2\0\0\0\0\0\0\0\0\0\0\0\0\0\10\0\0\0\340\251`\235z3\320\21\275\210\0\0\300\202\346\232\354\3\0\0\1\0\0\0\310\371\252\1\26\0\30\0\10<_u\0\0\0\0|\370\252\1\27\207`u\0\0\0\0\6\0\0\0\2\0\0\0\20\0\0\0\20\0\0\0\2\0\0\0\21\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\273\377\0\0\0\0\0\0R\0S\0V\0P\0 \0U\0D\0P\0 \0S\0e\0r\0v\0i\0c\0e\0 \0P\0r\0o\0v\0i\0d\0e\0r\0\0\0\30\371\252\1\17.\365w\13\30\365w\1\0\0\0\0\374\252\1\4\0\0\0\0\0\0\0\0\0\0\0\1\0\0\0\17.\365w\0\0\0\0\250\371\252\1 \22\365wO\22\365wT\22\365w\0\0\0\0\204\3\0\0+\12\0\0\244\1\0\0\254\1\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0t\1\0\0+\12\0\0\244\1\0\0\254\1\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0,\12\0\0\244\1\0\0\254\1\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0p\1\0\0\340\343\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\220\222\25\0\0\0\0\00\00\00\00\00\00\00\00\00\00\00\05\0,\12\0\0\244\1\0\0\254\1\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0t\1\0\0-\12\0\0\244\1\0\0\254\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0t\1\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\25\0\2\0\0\0\220\0\0\0-\12\0\0\244\1\0\0\254\1\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0.\12\0\0\244\1\0\0\254\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0t\1\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) }, 900, ) == 0x0
 02603   428   NtClose  (372, ... ) == 0x0
 02604   428   NtOpenKey  (0x20019, {24, 368, 0x40, 0, 0,  (0x20019, {24, 368, 0x40, 0, 0, "000000000005"}, ... 372, ) }, ... 372, ) == 0x0
 02605   428   NtQueryValueKey  (372,  (372, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 02606   428   NtQueryValueKey  (372,  (372, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 02607   428   NtQueryValueKey  (372,  (372, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\rsvpsp.dll\0\0gram\FSLSP.DLL\0\00\0\0\0\10\0\2\0\10\0\4\1\10\0h\220\354\28\220\354\2\2\0\12\0\4\1\12\00\00\0\0\0\10\0\2\0\14\0\4\1\10\0\210\220\354\2X\220\354\2\2\0\16\0\4\1\12\00\00\0\0\0\10\0\2\0\20\0\4\1\10\0\250\220\354\2x\220\354\2\2\0\22\0\4\1\12\00\00\0\0\0\10\0\2\0\24\0\4\1\10\0\310\220\354\2\230\220\354\2\2\0\26\0\4\1\12\00\00\0\0\0\10\0\2\0\30\0\4\1\10\0\0\0\0\0\270\220\354\2\2\0\32\0\4\1\10\0H\0K\0R\0\0\0\3\0\34\0\4\1\10\0\360\222\354\2\0\0\0\0\0\221\354\2\16\0\0\0<\0\37\0\4\0\10\0X\3\10\0X\3\10\0\4\0\2\0f \2\0\0\0\0\0\0\0\0\0\0\0\0\0\10\0\0\0\340\251`\235z3\320\21\275\210\0\0\300\202\346\232\355\3\0\0\1\0\0\0\17.\365w\13\30\365w\0\0\0\0\4+Y\1\2\0\0\0\1\0\0\0\17.\365w\6\0\0\0\2\0\0\0\20\0\0\0\20\0\0\0\1\0\0\0\6\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0R\0S\0V\0P\0 \0T\0C\0P\0 \0S\0e\0r\0v\0i\0c\0e\0 \0P\0r\0o\0v\0i\0d\0e\0r\0\0\0\0\0\0\0\362_du\3`du\240\1\10\0\250\5N\1 \0\0\0\0\0\0\0\240\1\10\0\310\5N\1H\344\301\0\0\0\0\0\0\0\0\0\0\0\245\0\0\0\10\0@\5N\1\0\0\0\0\204\3\0\00\12\0\0\244\1\0\0\254\1\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0t\1\0\00\12\0\0\244\1\0\0\254\1\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\01\12\0\0\244\1\0\0\254\1\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0p\1\0\0\340\343\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\220\222\25\0\0\0\0\00\00\00\00\00\00\00\00\00\00\00\06\01\12\0\0\244\1\0\0\254\1\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0t\1\0\02\12\0\0\244\1\0\0\254\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0t\1\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\25\0\2\0\0\0\220\0\0\02\12\0\0\244\1\0\0\254\1\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\03\12\0\0\244\1\0\0\254\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0t\1\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) , Partial, 900, ... TitleIdx=0, Type=3, Data= (372, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\rsvpsp.dll\0\0gram\FSLSP.DLL\0\00\0\0\0\10\0\2\0\10\0\4\1\10\0h\220\354\28\220\354\2\2\0\12\0\4\1\12\00\00\0\0\0\10\0\2\0\14\0\4\1\10\0\210\220\354\2X\220\354\2\2\0\16\0\4\1\12\00\00\0\0\0\10\0\2\0\20\0\4\1\10\0\250\220\354\2x\220\354\2\2\0\22\0\4\1\12\00\00\0\0\0\10\0\2\0\24\0\4\1\10\0\310\220\354\2\230\220\354\2\2\0\26\0\4\1\12\00\00\0\0\0\10\0\2\0\30\0\4\1\10\0\0\0\0\0\270\220\354\2\2\0\32\0\4\1\10\0H\0K\0R\0\0\0\3\0\34\0\4\1\10\0\360\222\354\2\0\0\0\0\0\221\354\2\16\0\0\0<\0\37\0\4\0\10\0X\3\10\0X\3\10\0\4\0\2\0f \2\0\0\0\0\0\0\0\0\0\0\0\0\0\10\0\0\0\340\251`\235z3\320\21\275\210\0\0\300\202\346\232\355\3\0\0\1\0\0\0\17.\365w\13\30\365w\0\0\0\0\4+Y\1\2\0\0\0\1\0\0\0\17.\365w\6\0\0\0\2\0\0\0\20\0\0\0\20\0\0\0\1\0\0\0\6\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0R\0S\0V\0P\0 \0T\0C\0P\0 \0S\0e\0r\0v\0i\0c\0e\0 \0P\0r\0o\0v\0i\0d\0e\0r\0\0\0\0\0\0\0\362_du\3`du\240\1\10\0\250\5N\1 \0\0\0\0\0\0\0\240\1\10\0\310\5N\1H\344\301\0\0\0\0\0\0\0\0\0\0\0\245\0\0\0\10\0@\5N\1\0\0\0\0\204\3\0\00\12\0\0\244\1\0\0\254\1\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0t\1\0\00\12\0\0\244\1\0\0\254\1\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\01\12\0\0\244\1\0\0\254\1\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0p\1\0\0\340\343\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\220\222\25\0\0\0\0\00\00\00\00\00\00\00\00\00\00\00\06\01\12\0\0\244\1\0\0\254\1\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0t\1\0\02\12\0\0\244\1\0\0\254\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0t\1\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\25\0\2\0\0\0\220\0\0\02\12\0\0\244\1\0\0\254\1\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\03\12\0\0\244\1\0\0\254\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0t\1\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) \0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\25\0\2\0\0\0\220\0\0\02\12\0\0\244\1\0\0\254\1\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\03\12\0\0\244\1\0\0\254\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0t\1\0\0\0\0\0\0 (372, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\rsvpsp.dll\0\0gram\FSLSP.DLL\0\00\0\0\0\10\0\2\0\10\0\4\1\10\0h\220\354\28\220\354\2\2\0\12\0\4\1\12\00\00\0\0\0\10\0\2\0\14\0\4\1\10\0\210\220\354\2X\220\354\2\2\0\16\0\4\1\12\00\00\0\0\0\10\0\2\0\20\0\4\1\10\0\250\220\354\2x\220\354\2\2\0\22\0\4\1\12\00\00\0\0\0\10\0\2\0\24\0\4\1\10\0\310\220\354\2\230\220\354\2\2\0\26\0\4\1\12\00\00\0\0\0\10\0\2\0\30\0\4\1\10\0\0\0\0\0\270\220\354\2\2\0\32\0\4\1\10\0H\0K\0R\0\0\0\3\0\34\0\4\1\10\0\360\222\354\2\0\0\0\0\0\221\354\2\16\0\0\0<\0\37\0\4\0\10\0X\3\10\0X\3\10\0\4\0\2\0f \2\0\0\0\0\0\0\0\0\0\0\0\0\0\10\0\0\0\340\251`\235z3\320\21\275\210\0\0\300\202\346\232\355\3\0\0\1\0\0\0\17.\365w\13\30\365w\0\0\0\0\4+Y\1\2\0\0\0\1\0\0\0\17.\365w\6\0\0\0\2\0\0\0\20\0\0\0\20\0\0\0\1\0\0\0\6\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0R\0S\0V\0P\0 \0T\0C\0P\0 \0S\0e\0r\0v\0i\0c\0e\0 \0P\0r\0o\0v\0i\0d\0e\0r\0\0\0\0\0\0\0\362_du\3`du\240\1\10\0\250\5N\1 \0\0\0\0\0\0\0\240\1\10\0\310\5N\1H\344\301\0\0\0\0\0\0\0\0\0\0\0\245\0\0\0\10\0@\5N\1\0\0\0\0\204\3\0\00\12\0\0\244\1\0\0\254\1\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0t\1\0\00\12\0\0\244\1\0\0\254\1\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\01\12\0\0\244\1\0\0\254\1\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0p\1\0\0\340\343\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\220\222\25\0\0\0\0\00\00\00\00\00\00\00\00\00\00\00\06\01\12\0\0\244\1\0\0\254\1\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0t\1\0\02\12\0\0\244\1\0\0\254\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0t\1\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\25\0\2\0\0\0\220\0\0\02\12\0\0\244\1\0\0\254\1\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\03\12\0\0\244\1\0\0\254\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0t\1\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) }, 900, ) == 0x0
 02608   428   NtClose  (372, ... ) == 0x0
 02609   428   NtOpenKey  (0x20019, {24, 368, 0x40, 0, 0,  (0x20019, {24, 368, 0x40, 0, 0, "000000000006"}, ... 372, ) }, ... 372, ) == 0x0
 02610   428   NtQueryValueKey  (372,  (372, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 02611   428   NtQueryValueKey  (372,  (372, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 02612   428   NtQueryValueKey  (372,  (372, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0gram\FSLSP.DLL\0\00\0\0\0\10\0\2\0\10\0\4\1\10\0h\220\354\28\220\354\2\2\0\12\0\4\1\12\00\00\0\0\0\10\0\2\0\14\0\4\1\10\0\210\220\354\2X\220\354\2\2\0\16\0\4\1\12\00\00\0\0\0\10\0\2\0\20\0\4\1\10\0\250\220\354\2x\220\354\2\2\0\22\0\4\1\12\00\00\0\0\0\10\0\2\0\24\0\4\1\10\0\310\220\354\2\230\220\354\2\2\0\26\0\4\1\12\00\00\0\0\0\10\0\2\0\30\0\4\1\10\0\0\0\0\0\270\220\354\2\2\0\32\0\4\1\10\0H\0K\0R\0\0\0\3\0\34\0\4\1\10\0\360\222\354\2\0\0\0\0\0\221\354\2\16\0\0\0<\0\37\0\4\0\10\0X\3\10\0X\3\10\0\4\0\2\0\16\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\10\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\356\3\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\5\0\0\0\0\0\0\200\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\04\0F\0E\05\07\0D\07\0B\0-\00\03\0A\05\0-\04\08\0B\02\0-\08\0\0\0\0\0\204\3\0\05\12\0\0\244\1\0\0\254\1\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0t\1\0\05\12\0\0\244\1\0\0\254\1\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\06\12\0\0\244\1\0\0\254\1\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0p\1\0\0\340\343\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\220\222\25\0\0\0\0\00\00\00\00\00\00\00\00\00\00\00\07\06\12\0\0\244\1\0\0\254\1\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0t\1\0\07\12\0\0\244\1\0\0\254\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0t\1\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\25\0\2\0\0\0\220\0\0\07\12\0\0\244\1\0\0\254\1\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\08\12\0\0\244\1\0\0\254\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0t\1\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) , Partial, 900, ... TitleIdx=0, Type=3, Data= (372, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0gram\FSLSP.DLL\0\00\0\0\0\10\0\2\0\10\0\4\1\10\0h\220\354\28\220\354\2\2\0\12\0\4\1\12\00\00\0\0\0\10\0\2\0\14\0\4\1\10\0\210\220\354\2X\220\354\2\2\0\16\0\4\1\12\00\00\0\0\0\10\0\2\0\20\0\4\1\10\0\250\220\354\2x\220\354\2\2\0\22\0\4\1\12\00\00\0\0\0\10\0\2\0\24\0\4\1\10\0\310\220\354\2\230\220\354\2\2\0\26\0\4\1\12\00\00\0\0\0\10\0\2\0\30\0\4\1\10\0\0\0\0\0\270\220\354\2\2\0\32\0\4\1\10\0H\0K\0R\0\0\0\3\0\34\0\4\1\10\0\360\222\354\2\0\0\0\0\0\221\354\2\16\0\0\0<\0\37\0\4\0\10\0X\3\10\0X\3\10\0\4\0\2\0\16\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\10\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\356\3\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\5\0\0\0\0\0\0\200\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\04\0F\0E\05\07\0D\07\0B\0-\00\03\0A\05\0-\04\08\0B\02\0-\08\0\0\0\0\0\204\3\0\05\12\0\0\244\1\0\0\254\1\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0t\1\0\05\12\0\0\244\1\0\0\254\1\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\06\12\0\0\244\1\0\0\254\1\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0p\1\0\0\340\343\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\220\222\25\0\0\0\0\00\00\00\00\00\00\00\00\00\00\00\07\06\12\0\0\244\1\0\0\254\1\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0t\1\0\07\12\0\0\244\1\0\0\254\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0t\1\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\25\0\2\0\0\0\220\0\0\07\12\0\0\244\1\0\0\254\1\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\08\12\0\0\244\1\0\0\254\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0t\1\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) \0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\25\0\2\0\0\0\220\0\0\07\12\0\0\244\1\0\0\254\1\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\08\12\0\0\244\1\0\0\254\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0t\1\0\0\0\0\0\0 (372, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0gram\FSLSP.DLL\0\00\0\0\0\10\0\2\0\10\0\4\1\10\0h\220\354\28\220\354\2\2\0\12\0\4\1\12\00\00\0\0\0\10\0\2\0\14\0\4\1\10\0\210\220\354\2X\220\354\2\2\0\16\0\4\1\12\00\00\0\0\0\10\0\2\0\20\0\4\1\10\0\250\220\354\2x\220\354\2\2\0\22\0\4\1\12\00\00\0\0\0\10\0\2\0\24\0\4\1\10\0\310\220\354\2\230\220\354\2\2\0\26\0\4\1\12\00\00\0\0\0\10\0\2\0\30\0\4\1\10\0\0\0\0\0\270\220\354\2\2\0\32\0\4\1\10\0H\0K\0R\0\0\0\3\0\34\0\4\1\10\0\360\222\354\2\0\0\0\0\0\221\354\2\16\0\0\0<\0\37\0\4\0\10\0X\3\10\0X\3\10\0\4\0\2\0\16\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\10\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\356\3\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\5\0\0\0\0\0\0\200\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\04\0F\0E\05\07\0D\07\0B\0-\00\03\0A\05\0-\04\08\0B\02\0-\08\0\0\0\0\0\204\3\0\05\12\0\0\244\1\0\0\254\1\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0t\1\0\05\12\0\0\244\1\0\0\254\1\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\06\12\0\0\244\1\0\0\254\1\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0p\1\0\0\340\343\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\220\222\25\0\0\0\0\00\00\00\00\00\00\00\00\00\00\00\07\06\12\0\0\244\1\0\0\254\1\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0t\1\0\07\12\0\0\244\1\0\0\254\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0t\1\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\25\0\2\0\0\0\220\0\0\07\12\0\0\244\1\0\0\254\1\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\08\12\0\0\244\1\0\0\254\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0t\1\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) }, 900, ) == 0x0
 02613   428   NtClose  (372, ... ) == 0x0
 02614   428   NtOpenKey  (0x20019, {24, 368, 0x40, 0, 0,  (0x20019, {24, 368, 0x40, 0, 0, "000000000007"}, ... 372, ) }, ... 372, ) == 0x0
 02615   428   NtQueryValueKey  (372,  (372, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 02616   428   NtQueryValueKey  (372,  (372, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 02617   428   NtQueryValueKey  (372,  (372, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0gram\FSLSP.DLL\0\00\0\0\0\10\0\2\0\10\0\4\1\10\0h\220\354\28\220\354\2\2\0\12\0\4\1\12\00\00\0\0\0\10\0\2\0\14\0\4\1\10\0\210\220\354\2X\220\354\2\2\0\16\0\4\1\12\00\00\0\0\0\10\0\2\0\20\0\4\1\10\0\250\220\354\2x\220\354\2\2\0\22\0\4\1\12\00\00\0\0\0\10\0\2\0\24\0\4\1\10\0\310\220\354\2\230\220\354\2\2\0\26\0\4\1\12\00\00\0\0\0\10\0\2\0\30\0\4\1\10\0\0\0\0\0\270\220\354\2\2\0\32\0\4\1\10\0H\0K\0R\0\0\0\3\0\34\0\4\1\10\0\360\222\354\2\0\0\0\0\0\221\354\2\16\0\0\0<\0\37\0\4\0\10\0X\3\10\0X\3\10\0\4\0\2\0\11\2\2\0\0\0\0\0\0\0\0\0\0\0\0\0\10\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\357\3\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\2\0\0\0\0\0\0\200\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\04\0F\0E\05\07\0D\07\0B\0-\00\03\0A\05\0-\04\08\0B\02\0-\08\0\0\0\0\0\204\3\0\0:\12\0\0\244\1\0\0\254\1\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0t\1\0\0:\12\0\0\244\1\0\0\254\1\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0;\12\0\0\244\1\0\0\254\1\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0p\1\0\0\340\343\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\220\222\25\0\0\0\0\00\00\00\00\00\00\00\00\00\00\00\08\0;\12\0\0\244\1\0\0\254\1\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0t\1\0\0<\12\0\0\244\1\0\0\254\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0t\1\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\25\0\2\0\0\0\220\0\0\0<\12\0\0\244\1\0\0\254\1\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0=\12\0\0\244\1\0\0\254\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0t\1\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) , Partial, 900, ... TitleIdx=0, Type=3, Data= (372, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0gram\FSLSP.DLL\0\00\0\0\0\10\0\2\0\10\0\4\1\10\0h\220\354\28\220\354\2\2\0\12\0\4\1\12\00\00\0\0\0\10\0\2\0\14\0\4\1\10\0\210\220\354\2X\220\354\2\2\0\16\0\4\1\12\00\00\0\0\0\10\0\2\0\20\0\4\1\10\0\250\220\354\2x\220\354\2\2\0\22\0\4\1\12\00\00\0\0\0\10\0\2\0\24\0\4\1\10\0\310\220\354\2\230\220\354\2\2\0\26\0\4\1\12\00\00\0\0\0\10\0\2\0\30\0\4\1\10\0\0\0\0\0\270\220\354\2\2\0\32\0\4\1\10\0H\0K\0R\0\0\0\3\0\34\0\4\1\10\0\360\222\354\2\0\0\0\0\0\221\354\2\16\0\0\0<\0\37\0\4\0\10\0X\3\10\0X\3\10\0\4\0\2\0\11\2\2\0\0\0\0\0\0\0\0\0\0\0\0\0\10\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\357\3\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\2\0\0\0\0\0\0\200\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\04\0F\0E\05\07\0D\07\0B\0-\00\03\0A\05\0-\04\08\0B\02\0-\08\0\0\0\0\0\204\3\0\0:\12\0\0\244\1\0\0\254\1\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0t\1\0\0:\12\0\0\244\1\0\0\254\1\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0;\12\0\0\244\1\0\0\254\1\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0p\1\0\0\340\343\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\220\222\25\0\0\0\0\00\00\00\00\00\00\00\00\00\00\00\08\0;\12\0\0\244\1\0\0\254\1\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0t\1\0\0<\12\0\0\244\1\0\0\254\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0t\1\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\25\0\2\0\0\0\220\0\0\0<\12\0\0\244\1\0\0\254\1\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0=\12\0\0\244\1\0\0\254\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0t\1\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) \0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\25\0\2\0\0\0\220\0\0\0<\12\0\0\244\1\0\0\254\1\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0=\12\0\0\244\1\0\0\254\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0t\1\0\0\0\0\0\0 (372, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0gram\FSLSP.DLL\0\00\0\0\0\10\0\2\0\10\0\4\1\10\0h\220\354\28\220\354\2\2\0\12\0\4\1\12\00\00\0\0\0\10\0\2\0\14\0\4\1\10\0\210\220\354\2X\220\354\2\2\0\16\0\4\1\12\00\00\0\0\0\10\0\2\0\20\0\4\1\10\0\250\220\354\2x\220\354\2\2\0\22\0\4\1\12\00\00\0\0\0\10\0\2\0\24\0\4\1\10\0\310\220\354\2\230\220\354\2\2\0\26\0\4\1\12\00\00\0\0\0\10\0\2\0\30\0\4\1\10\0\0\0\0\0\270\220\354\2\2\0\32\0\4\1\10\0H\0K\0R\0\0\0\3\0\34\0\4\1\10\0\360\222\354\2\0\0\0\0\0\221\354\2\16\0\0\0<\0\37\0\4\0\10\0X\3\10\0X\3\10\0\4\0\2\0\11\2\2\0\0\0\0\0\0\0\0\0\0\0\0\0\10\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\357\3\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\2\0\0\0\0\0\0\200\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\04\0F\0E\05\07\0D\07\0B\0-\00\03\0A\05\0-\04\08\0B\02\0-\08\0\0\0\0\0\204\3\0\0:\12\0\0\244\1\0\0\254\1\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0t\1\0\0:\12\0\0\244\1\0\0\254\1\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0;\12\0\0\244\1\0\0\254\1\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0p\1\0\0\340\343\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\220\222\25\0\0\0\0\00\00\00\00\00\00\00\00\00\00\00\08\0;\12\0\0\244\1\0\0\254\1\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0t\1\0\0<\12\0\0\244\1\0\0\254\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0t\1\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\25\0\2\0\0\0\220\0\0\0<\12\0\0\244\1\0\0\254\1\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0=\12\0\0\244\1\0\0\254\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0t\1\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) }, 900, ) == 0x0
 02618   428   NtClose  (372, ... ) == 0x0
 02619   428   NtOpenKey  (0x20019, {24, 368, 0x40, 0, 0,  (0x20019, {24, 368, 0x40, 0, 0, "000000000008"}, ... 372, ) }, ... 372, ) == 0x0
 02620   428   NtQueryValueKey  (372,  (372, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 02621   428   NtQueryValueKey  (372,  (372, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 02622   428   NtQueryValueKey  (372,  (372, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0gram\FSLSP.DLL\0\00\0\0\0\10\0\2\0\10\0\4\1\10\0h\220\354\28\220\354\2\2\0\12\0\4\1\12\00\00\0\0\0\10\0\2\0\14\0\4\1\10\0\210\220\354\2X\220\354\2\2\0\16\0\4\1\12\00\00\0\0\0\10\0\2\0\20\0\4\1\10\0\250\220\354\2x\220\354\2\2\0\22\0\4\1\12\00\00\0\0\0\10\0\2\0\24\0\4\1\10\0\310\220\354\2\230\220\354\2\2\0\26\0\4\1\12\00\00\0\0\0\10\0\2\0\30\0\4\1\10\0\0\0\0\0\270\220\354\2\2\0\32\0\4\1\10\0H\0K\0R\0\0\0\3\0\34\0\4\1\10\0\360\222\354\2\0\0\0\0\0\221\354\2\16\0\0\0<\0\37\0\4\0\10\0X\3\10\0X\3\10\0\4\0\2\0\16\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\360\3\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\5\0\0\0\377\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\0A\0B\0E\07\0E\00\06\0F\0-\06\02\00\0F\0-\04\0E\0A\0A\0-\0A\0\0\0\0\0\204\3\0\0?\12\0\0\244\1\0\0\254\1\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0t\1\0\0?\12\0\0\244\1\0\0\254\1\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0@\12\0\0\244\1\0\0\254\1\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0p\1\0\0\340\343\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\220\222\25\0\0\0\0\00\00\00\00\00\00\00\00\00\00\00\09\0@\12\0\0\244\1\0\0\254\1\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0t\1\0\0A\12\0\0\244\1\0\0\254\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0t\1\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\25\0\2\0\0\0\220\0\0\0A\12\0\0\244\1\0\0\254\1\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0B\12\0\0\244\1\0\0\254\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0t\1\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) , Partial, 900, ... TitleIdx=0, Type=3, Data= (372, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0gram\FSLSP.DLL\0\00\0\0\0\10\0\2\0\10\0\4\1\10\0h\220\354\28\220\354\2\2\0\12\0\4\1\12\00\00\0\0\0\10\0\2\0\14\0\4\1\10\0\210\220\354\2X\220\354\2\2\0\16\0\4\1\12\00\00\0\0\0\10\0\2\0\20\0\4\1\10\0\250\220\354\2x\220\354\2\2\0\22\0\4\1\12\00\00\0\0\0\10\0\2\0\24\0\4\1\10\0\310\220\354\2\230\220\354\2\2\0\26\0\4\1\12\00\00\0\0\0\10\0\2\0\30\0\4\1\10\0\0\0\0\0\270\220\354\2\2\0\32\0\4\1\10\0H\0K\0R\0\0\0\3\0\34\0\4\1\10\0\360\222\354\2\0\0\0\0\0\221\354\2\16\0\0\0<\0\37\0\4\0\10\0X\3\10\0X\3\10\0\4\0\2\0\16\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\360\3\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\5\0\0\0\377\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\0A\0B\0E\07\0E\00\06\0F\0-\06\02\00\0F\0-\04\0E\0A\0A\0-\0A\0\0\0\0\0\204\3\0\0?\12\0\0\244\1\0\0\254\1\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0t\1\0\0?\12\0\0\244\1\0\0\254\1\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0@\12\0\0\244\1\0\0\254\1\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0p\1\0\0\340\343\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\220\222\25\0\0\0\0\00\00\00\00\00\00\00\00\00\00\00\09\0@\12\0\0\244\1\0\0\254\1\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0t\1\0\0A\12\0\0\244\1\0\0\254\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0t\1\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\25\0\2\0\0\0\220\0\0\0A\12\0\0\244\1\0\0\254\1\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0B\12\0\0\244\1\0\0\254\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0t\1\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) \0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\25\0\2\0\0\0\220\0\0\0A\12\0\0\244\1\0\0\254\1\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0B\12\0\0\244\1\0\0\254\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0t\1\0\0\0\0\0\0 (372, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0gram\FSLSP.DLL\0\00\0\0\0\10\0\2\0\10\0\4\1\10\0h\220\354\28\220\354\2\2\0\12\0\4\1\12\00\00\0\0\0\10\0\2\0\14\0\4\1\10\0\210\220\354\2X\220\354\2\2\0\16\0\4\1\12\00\00\0\0\0\10\0\2\0\20\0\4\1\10\0\250\220\354\2x\220\354\2\2\0\22\0\4\1\12\00\00\0\0\0\10\0\2\0\24\0\4\1\10\0\310\220\354\2\230\220\354\2\2\0\26\0\4\1\12\00\00\0\0\0\10\0\2\0\30\0\4\1\10\0\0\0\0\0\270\220\354\2\2\0\32\0\4\1\10\0H\0K\0R\0\0\0\3\0\34\0\4\1\10\0\360\222\354\2\0\0\0\0\0\221\354\2\16\0\0\0<\0\37\0\4\0\10\0X\3\10\0X\3\10\0\4\0\2\0\16\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\360\3\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\5\0\0\0\377\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\0A\0B\0E\07\0E\00\06\0F\0-\06\02\00\0F\0-\04\0E\0A\0A\0-\0A\0\0\0\0\0\204\3\0\0?\12\0\0\244\1\0\0\254\1\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0t\1\0\0?\12\0\0\244\1\0\0\254\1\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0@\12\0\0\244\1\0\0\254\1\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0p\1\0\0\340\343\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\220\222\25\0\0\0\0\00\00\00\00\00\00\00\00\00\00\00\09\0@\12\0\0\244\1\0\0\254\1\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0t\1\0\0A\12\0\0\244\1\0\0\254\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0t\1\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\25\0\2\0\0\0\220\0\0\0A\12\0\0\244\1\0\0\254\1\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0B\12\0\0\244\1\0\0\254\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0t\1\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) }, 900, ) == 0x0
 02623   428   NtClose  (372, ... ) == 0x0
 02624   428   NtOpenKey  (0x20019, {24, 368, 0x40, 0, 0,  (0x20019, {24, 368, 0x40, 0, 0, "000000000009"}, ... 372, ) }, ... 372, ) == 0x0
 02625   428   NtQueryValueKey  (372,  (372, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 02626   428   NtQueryValueKey  (372,  (372, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 02627   428   NtAllocateVirtualMemory  (-1, 1458176, 0, 4096, 4096, 4, ... 1458176, 4096, ) == 0x0
 02628   428   NtQueryValueKey  (372,  (372, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0gram\FSLSP.DLL\0\00\0\0\0\10\0\2\0\10\0\4\1\10\0h\220\354\28\220\354\2\2\0\12\0\4\1\12\00\00\0\0\0\10\0\2\0\14\0\4\1\10\0\210\220\354\2X\220\354\2\2\0\16\0\4\1\12\00\00\0\0\0\10\0\2\0\20\0\4\1\10\0\250\220\354\2x\220\354\2\2\0\22\0\4\1\12\00\00\0\0\0\10\0\2\0\24\0\4\1\10\0\310\220\354\2\230\220\354\2\2\0\26\0\4\1\12\00\00\0\0\0\10\0\2\0\30\0\4\1\10\0\0\0\0\0\270\220\354\2\2\0\32\0\4\1\10\0H\0K\0R\0\0\0\3\0\34\0\4\1\10\0\360\222\354\2\0\0\0\0\0\221\354\2\16\0\0\0<\0\37\0\4\0\10\0X\3\10\0X\3\10\0\4\0\2\0\11\2\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\361\3\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\2\0\0\0\377\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\0A\0B\0E\07\0E\00\06\0F\0-\06\02\00\0F\0-\04\0E\0A\0A\0-\0A\0\0\0\0\0\204\3\0\0E\12\0\0\244\1\0\0\254\1\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0t\1\0\0E\12\0\0\244\1\0\0\254\1\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0F\12\0\0\244\1\0\0\254\1\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0p\1\0\0\340\343\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\220\222\25\0\0\0\0\00\00\00\00\00\00\00\00\00\00\01\00\0F\12\0\0\244\1\0\0\254\1\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0t\1\0\0G\12\0\0\244\1\0\0\254\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0t\1\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\25\0\2\0\0\0\220\0\0\0G\12\0\0\244\1\0\0\254\1\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0H\12\0\0\244\1\0\0\254\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0t\1\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) , Partial, 900, ... TitleIdx=0, Type=3, Data= (372, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0gram\FSLSP.DLL\0\00\0\0\0\10\0\2\0\10\0\4\1\10\0h\220\354\28\220\354\2\2\0\12\0\4\1\12\00\00\0\0\0\10\0\2\0\14\0\4\1\10\0\210\220\354\2X\220\354\2\2\0\16\0\4\1\12\00\00\0\0\0\10\0\2\0\20\0\4\1\10\0\250\220\354\2x\220\354\2\2\0\22\0\4\1\12\00\00\0\0\0\10\0\2\0\24\0\4\1\10\0\310\220\354\2\230\220\354\2\2\0\26\0\4\1\12\00\00\0\0\0\10\0\2\0\30\0\4\1\10\0\0\0\0\0\270\220\354\2\2\0\32\0\4\1\10\0H\0K\0R\0\0\0\3\0\34\0\4\1\10\0\360\222\354\2\0\0\0\0\0\221\354\2\16\0\0\0<\0\37\0\4\0\10\0X\3\10\0X\3\10\0\4\0\2\0\11\2\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\361\3\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\2\0\0\0\377\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\0A\0B\0E\07\0E\00\06\0F\0-\06\02\00\0F\0-\04\0E\0A\0A\0-\0A\0\0\0\0\0\204\3\0\0E\12\0\0\244\1\0\0\254\1\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0t\1\0\0E\12\0\0\244\1\0\0\254\1\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0F\12\0\0\244\1\0\0\254\1\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0p\1\0\0\340\343\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\220\222\25\0\0\0\0\00\00\00\00\00\00\00\00\00\00\01\00\0F\12\0\0\244\1\0\0\254\1\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0t\1\0\0G\12\0\0\244\1\0\0\254\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0t\1\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\25\0\2\0\0\0\220\0\0\0G\12\0\0\244\1\0\0\254\1\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0H\12\0\0\244\1\0\0\254\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0t\1\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) \0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\25\0\2\0\0\0\220\0\0\0G\12\0\0\244\1\0\0\254\1\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0H\12\0\0\244\1\0\0\254\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0t\1\0\0\0\0\0\0 (372, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0gram\FSLSP.DLL\0\00\0\0\0\10\0\2\0\10\0\4\1\10\0h\220\354\28\220\354\2\2\0\12\0\4\1\12\00\00\0\0\0\10\0\2\0\14\0\4\1\10\0\210\220\354\2X\220\354\2\2\0\16\0\4\1\12\00\00\0\0\0\10\0\2\0\20\0\4\1\10\0\250\220\354\2x\220\354\2\2\0\22\0\4\1\12\00\00\0\0\0\10\0\2\0\24\0\4\1\10\0\310\220\354\2\230\220\354\2\2\0\26\0\4\1\12\00\00\0\0\0\10\0\2\0\30\0\4\1\10\0\0\0\0\0\270\220\354\2\2\0\32\0\4\1\10\0H\0K\0R\0\0\0\3\0\34\0\4\1\10\0\360\222\354\2\0\0\0\0\0\221\354\2\16\0\0\0<\0\37\0\4\0\10\0X\3\10\0X\3\10\0\4\0\2\0\11\2\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\361\3\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\2\0\0\0\377\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\0A\0B\0E\07\0E\00\06\0F\0-\06\02\00\0F\0-\04\0E\0A\0A\0-\0A\0\0\0\0\0\204\3\0\0E\12\0\0\244\1\0\0\254\1\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0t\1\0\0E\12\0\0\244\1\0\0\254\1\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0F\12\0\0\244\1\0\0\254\1\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0p\1\0\0\340\343\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\220\222\25\0\0\0\0\00\00\00\00\00\00\00\00\00\00\01\00\0F\12\0\0\244\1\0\0\254\1\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0t\1\0\0G\12\0\0\244\1\0\0\254\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0t\1\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\25\0\2\0\0\0\220\0\0\0G\12\0\0\244\1\0\0\254\1\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0H\12\0\0\244\1\0\0\254\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0t\1\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) }, 900, ) == 0x0
 02629   428   NtClose  (372, ... ) == 0x0
 02630   428   NtOpenKey  (0x20019, {24, 368, 0x40, 0, 0,  (0x20019, {24, 368, 0x40, 0, 0, "000000000010"}, ... 372, ) }, ... 372, ) == 0x0
 02631   428   NtQueryValueKey  (372,  (372, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 02632   428   NtQueryValueKey  (372,  (372, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 02633   428   NtQueryValueKey  (372,  (372, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0gram\FSLSP.DLL\0\00\0\0\0\10\0\2\0\10\0\4\1\10\0h\220\354\28\220\354\2\2\0\12\0\4\1\12\00\00\0\0\0\10\0\2\0\14\0\4\1\10\0\210\220\354\2X\220\354\2\2\0\16\0\4\1\12\00\00\0\0\0\10\0\2\0\20\0\4\1\10\0\250\220\354\2x\220\354\2\2\0\22\0\4\1\12\00\00\0\0\0\10\0\2\0\24\0\4\1\10\0\310\220\354\2\230\220\354\2\2\0\26\0\4\1\12\00\00\0\0\0\10\0\2\0\30\0\4\1\10\0\0\0\0\0\270\220\354\2\2\0\32\0\4\1\10\0H\0K\0R\0\0\0\3\0\34\0\4\1\10\0\360\222\354\2\0\0\0\0\0\221\354\2\16\0\0\0<\0\37\0\4\0\10\0X\3\10\0X\3\10\0\4\0\2\0\16\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\362\3\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\5\0\0\0\376\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\0D\01\09\0D\0F\08\08\02\0-\0A\09\0C\0B\0-\04\01\04\04\0-\08\0\0\0\0\0\204\3\0\0J\12\0\0\244\1\0\0\254\1\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0t\1\0\0J\12\0\0\244\1\0\0\254\1\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0K\12\0\0\244\1\0\0\254\1\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0p\1\0\0\340\343\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\220\222\25\0\0\0\0\00\00\00\00\00\00\00\00\00\00\01\01\0K\12\0\0\244\1\0\0\254\1\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0t\1\0\0L\12\0\0\244\1\0\0\254\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0t\1\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\25\0\2\0\0\0\220\0\0\0L\12\0\0\244\1\0\0\254\1\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0M\12\0\0\244\1\0\0\254\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0t\1\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) , Partial, 900, ... TitleIdx=0, Type=3, Data= (372, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0gram\FSLSP.DLL\0\00\0\0\0\10\0\2\0\10\0\4\1\10\0h\220\354\28\220\354\2\2\0\12\0\4\1\12\00\00\0\0\0\10\0\2\0\14\0\4\1\10\0\210\220\354\2X\220\354\2\2\0\16\0\4\1\12\00\00\0\0\0\10\0\2\0\20\0\4\1\10\0\250\220\354\2x\220\354\2\2\0\22\0\4\1\12\00\00\0\0\0\10\0\2\0\24\0\4\1\10\0\310\220\354\2\230\220\354\2\2\0\26\0\4\1\12\00\00\0\0\0\10\0\2\0\30\0\4\1\10\0\0\0\0\0\270\220\354\2\2\0\32\0\4\1\10\0H\0K\0R\0\0\0\3\0\34\0\4\1\10\0\360\222\354\2\0\0\0\0\0\221\354\2\16\0\0\0<\0\37\0\4\0\10\0X\3\10\0X\3\10\0\4\0\2\0\16\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\362\3\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\5\0\0\0\376\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\0D\01\09\0D\0F\08\08\02\0-\0A\09\0C\0B\0-\04\01\04\04\0-\08\0\0\0\0\0\204\3\0\0J\12\0\0\244\1\0\0\254\1\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0t\1\0\0J\12\0\0\244\1\0\0\254\1\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0K\12\0\0\244\1\0\0\254\1\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0p\1\0\0\340\343\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\220\222\25\0\0\0\0\00\00\00\00\00\00\00\00\00\00\01\01\0K\12\0\0\244\1\0\0\254\1\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0t\1\0\0L\12\0\0\244\1\0\0\254\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0t\1\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\25\0\2\0\0\0\220\0\0\0L\12\0\0\244\1\0\0\254\1\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0M\12\0\0\244\1\0\0\254\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0t\1\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) \0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\25\0\2\0\0\0\220\0\0\0L\12\0\0\244\1\0\0\254\1\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0M\12\0\0\244\1\0\0\254\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0t\1\0\0\0\0\0\0 (372, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0gram\FSLSP.DLL\0\00\0\0\0\10\0\2\0\10\0\4\1\10\0h\220\354\28\220\354\2\2\0\12\0\4\1\12\00\00\0\0\0\10\0\2\0\14\0\4\1\10\0\210\220\354\2X\220\354\2\2\0\16\0\4\1\12\00\00\0\0\0\10\0\2\0\20\0\4\1\10\0\250\220\354\2x\220\354\2\2\0\22\0\4\1\12\00\00\0\0\0\10\0\2\0\24\0\4\1\10\0\310\220\354\2\230\220\354\2\2\0\26\0\4\1\12\00\00\0\0\0\10\0\2\0\30\0\4\1\10\0\0\0\0\0\270\220\354\2\2\0\32\0\4\1\10\0H\0K\0R\0\0\0\3\0\34\0\4\1\10\0\360\222\354\2\0\0\0\0\0\221\354\2\16\0\0\0<\0\37\0\4\0\10\0X\3\10\0X\3\10\0\4\0\2\0\16\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\362\3\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\5\0\0\0\376\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\0D\01\09\0D\0F\08\08\02\0-\0A\09\0C\0B\0-\04\01\04\04\0-\08\0\0\0\0\0\204\3\0\0J\12\0\0\244\1\0\0\254\1\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0t\1\0\0J\12\0\0\244\1\0\0\254\1\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0K\12\0\0\244\1\0\0\254\1\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0p\1\0\0\340\343\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\220\222\25\0\0\0\0\00\00\00\00\00\00\00\00\00\00\01\01\0K\12\0\0\244\1\0\0\254\1\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0t\1\0\0L\12\0\0\244\1\0\0\254\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0t\1\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\25\0\2\0\0\0\220\0\0\0L\12\0\0\244\1\0\0\254\1\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0M\12\0\0\244\1\0\0\254\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0t\1\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) }, 900, ) == 0x0
 02634   428   NtClose  (372, ... ) == 0x0
 02635   428   NtOpenKey  (0x20019, {24, 368, 0x40, 0, 0,  (0x20019, {24, 368, 0x40, 0, 0, "000000000011"}, ... 372, ) }, ... 372, ) == 0x0
 02636   428   NtQueryValueKey  (372,  (372, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 02637   428   NtQueryValueKey  (372,  (372, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 02638   428   NtQueryValueKey  (372,  (372, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0gram\FSLSP.DLL\0\00\0\0\0\10\0\2\0\10\0\4\1\10\0h\220\354\28\220\354\2\2\0\12\0\4\1\12\00\00\0\0\0\10\0\2\0\14\0\4\1\10\0\210\220\354\2X\220\354\2\2\0\16\0\4\1\12\00\00\0\0\0\10\0\2\0\20\0\4\1\10\0\250\220\354\2x\220\354\2\2\0\22\0\4\1\12\00\00\0\0\0\10\0\2\0\24\0\4\1\10\0\310\220\354\2\230\220\354\2\2\0\26\0\4\1\12\00\00\0\0\0\10\0\2\0\30\0\4\1\10\0\0\0\0\0\270\220\354\2\2\0\32\0\4\1\10\0H\0K\0R\0\0\0\3\0\34\0\4\1\10\0\360\222\354\2\0\0\0\0\0\221\354\2\16\0\0\0<\0\37\0\4\0\10\0X\3\10\0X\3\10\0\4\0\2\0\11\2\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\363\3\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\2\0\0\0\376\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\0D\01\09\0D\0F\08\08\02\0-\0A\09\0C\0B\0-\04\01\04\04\0-\08\0\0\0\0\0\204\3\0\0O\12\0\0\244\1\0\0\254\1\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0t\1\0\0O\12\0\0\244\1\0\0\254\1\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0P\12\0\0\244\1\0\0\254\1\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0p\1\0\0P\12\0\0\244\1\0\0\254\1\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0Q\12\0\0\244\1\0\0\254\1\0\0\305\0\0\0\0\0\1\0\0\0\0\0\24\0\0\0d\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0Q\12\0\0\244\1\0\0\254\1\0\0\305\0\0\0\1\0\1\0\2\1\0\0\0\0\0\0R\12\0\0\244\1\0\0\254\1\0\0\25\0\0\0\0\0\1\0\0\0\0\0\24\0\0\0\3\0\37\0\377\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0R\12\0\0\244\1\0\0\254\1\0\0\25\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0p\1\0\0S\12\0\0\244\1\0\0\254\1\0\0Q\0\0\0\0\0\1\0\0\0\0\0T\0\0\0\0\0\0\2\0\0\0\0\30\0\0\0h\1\0\0\374\343\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0$\0&\0`\222\25\0\0\0\0\0N\0a\0m\0e\0S\0p\0a\0c\0e\0_\0C\0a\0t\0a\0l\0o\0g\05\0"}, 900, ) , Partial, 900, ... TitleIdx=0, Type=3, Data= (372, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0gram\FSLSP.DLL\0\00\0\0\0\10\0\2\0\10\0\4\1\10\0h\220\354\28\220\354\2\2\0\12\0\4\1\12\00\00\0\0\0\10\0\2\0\14\0\4\1\10\0\210\220\354\2X\220\354\2\2\0\16\0\4\1\12\00\00\0\0\0\10\0\2\0\20\0\4\1\10\0\250\220\354\2x\220\354\2\2\0\22\0\4\1\12\00\00\0\0\0\10\0\2\0\24\0\4\1\10\0\310\220\354\2\230\220\354\2\2\0\26\0\4\1\12\00\00\0\0\0\10\0\2\0\30\0\4\1\10\0\0\0\0\0\270\220\354\2\2\0\32\0\4\1\10\0H\0K\0R\0\0\0\3\0\34\0\4\1\10\0\360\222\354\2\0\0\0\0\0\221\354\2\16\0\0\0<\0\37\0\4\0\10\0X\3\10\0X\3\10\0\4\0\2\0\11\2\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\363\3\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\2\0\0\0\376\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\0D\01\09\0D\0F\08\08\02\0-\0A\09\0C\0B\0-\04\01\04\04\0-\08\0\0\0\0\0\204\3\0\0O\12\0\0\244\1\0\0\254\1\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0t\1\0\0O\12\0\0\244\1\0\0\254\1\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0P\12\0\0\244\1\0\0\254\1\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0p\1\0\0P\12\0\0\244\1\0\0\254\1\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0Q\12\0\0\244\1\0\0\254\1\0\0\305\0\0\0\0\0\1\0\0\0\0\0\24\0\0\0d\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0Q\12\0\0\244\1\0\0\254\1\0\0\305\0\0\0\1\0\1\0\2\1\0\0\0\0\0\0R\12\0\0\244\1\0\0\254\1\0\0\25\0\0\0\0\0\1\0\0\0\0\0\24\0\0\0\3\0\37\0\377\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0R\12\0\0\244\1\0\0\254\1\0\0\25\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0p\1\0\0S\12\0\0\244\1\0\0\254\1\0\0Q\0\0\0\0\0\1\0\0\0\0\0T\0\0\0\0\0\0\2\0\0\0\0\30\0\0\0h\1\0\0\374\343\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0$\0&\0`\222\25\0\0\0\0\0N\0a\0m\0e\0S\0p\0a\0c\0e\0_\0C\0a\0t\0a\0l\0o\0g\05\0"}, 900, ) }, 900, ) == 0x0
 02639   428   NtClose  (372, ... ) == 0x0
 02640   428   NtClose  (368, ... ) == 0x0
 02641   428   NtWaitForSingleObject  (356, 0, {0, 0}, ... ) == 0x102
 02642   428   NtCreateEvent  (0x1f0003, 0x0, 0, 0, ... 368, ) == 0x0
 02643   428   NtOpenKey  (0x2000000, {24, 360, 0x40, 0, 0,  (0x2000000, {24, 360, 0x40, 0, 0, "NameSpace_Catalog5"}, ... 372, ) }, ... 372, ) == 0x0
 02644   428   NtQueryValueKey  (372,  (372, "Serial_Access_Num", Partial, 144, ... TitleIdx=0, Type=4, Data="\4\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (372, "Serial_Access_Num", Partial, 144, ... TitleIdx=0, Type=4, Data="\4\0\0\0"}, 16, ) }, 16, ) == 0x0
 02645   428   NtNotifyChangeKey  (372, 368, 0, 0, 2011390432, 1, 0, 0, 0, 1, ... ) == 0x103
 02646   428   NtQueryValueKey  (372,  (372, "Serial_Access_Num", Partial, 144, ... TitleIdx=0, Type=4, Data="\4\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (372, "Serial_Access_Num", Partial, 144, ... TitleIdx=0, Type=4, Data="\4\0\0\0"}, 16, ) }, 16, ) == 0x0
 02647   428   NtOpenKey  (0x2000000, {24, 372, 0x40, 0, 0,  (0x2000000, {24, 372, 0x40, 0, 0, "00000004"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02648   428   NtQueryValueKey  (372,  (372, "Num_Catalog_Entries", Partial, 144, ... TitleIdx=0, Type=4, Data="\3\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (372, "Num_Catalog_Entries", Partial, 144, ... TitleIdx=0, Type=4, Data="\3\0\0\0"}, 16, ) }, 16, ) == 0x0
 02649   428   NtOpenKey  (0x2000000, {24, 372, 0x40, 0, 0,  (0x2000000, {24, 372, 0x40, 0, 0, "Catalog_Entries"}, ... 376, ) }, ... 376, ) == 0x0
 02650   428   NtOpenKey  (0x20019, {24, 376, 0x40, 0, 0,  (0x20019, {24, 376, 0x40, 0, 0, "000000000001"}, ... 380, ) }, ... 380, ) == 0x0
 02651   428   NtQueryValueKey  (380,  (380, "LibraryPath", Partial, 144, ... TitleIdx=0, Type=1, Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0m\0s\0w\0s\0o\0c\0k\0.\0d\0l\0l\0\0\0"}, 80, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (380, "LibraryPath", Partial, 144, ... TitleIdx=0, Type=1, Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0m\0s\0w\0s\0o\0c\0k\0.\0d\0l\0l\0\0\0"}, 80, ) }, 80, ) == 0x0
 02652   428   NtQueryValueKey  (380,  (380, "LibraryPath", Partial, 144, ... TitleIdx=0, Type=1, Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0m\0s\0w\0s\0o\0c\0k\0.\0d\0l\0l\0\0\0"}, 80, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (380, "LibraryPath", Partial, 144, ... TitleIdx=0, Type=1, Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0m\0s\0w\0s\0o\0c\0k\0.\0d\0l\0l\0\0\0"}, 80, ) }, 80, ) == 0x0
 02653   428   NtQueryValueKey  (380,  (380, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="T\0c\0p\0i\0p\0\0\0"}, 24, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (380, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="T\0c\0p\0i\0p\0\0\0"}, 24, ) }, 24, ) == 0x0
 02654   428   NtQueryValueKey  (380,  (380, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="T\0c\0p\0i\0p\0\0\0"}, 24, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (380, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="T\0c\0p\0i\0p\0\0\0"}, 24, ) }, 24, ) == 0x0
 02655   428   NtQueryValueKey  (380,  (380, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="T\0c\0p\0i\0p\0\0\0"}, 24, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (380, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="T\0c\0p\0i\0p\0\0\0"}, 24, ) }, 24, ) == 0x0
 02656   428   NtQueryValueKey  (380,  (380, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="T\0c\0p\0i\0p\0\0\0"}, 24, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (380, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="T\0c\0p\0i\0p\0\0\0"}, 24, ) }, 24, ) == 0x0
 02657   428   NtQueryValueKey  (380,  (380, "ProviderId", Partial, 144, ... TitleIdx=0, Type=3, Data="@\235\5"\236~\317\21\256Z\0\252\0\247\21+"}, 28, ) , Partial, 144, ... TitleIdx=0, Type=3, Data= (380, "ProviderId", Partial, 144, ... TitleIdx=0, Type=3, Data="@\235\5"\236~\317\21\256Z\0\252\0\247\21+"}, 28, ) \236~\317\21\256Z\0\252\0\247\21+"}, 28, ) == 0x0
 02658   428   NtQueryValueKey  (380,  (380, "AddressFamily", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02659   428   NtQueryValueKey  (380,  (380, "SupportedNameSpace", Partial, 144, ... TitleIdx=0, Type=4, Data="\14\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (380, "SupportedNameSpace", Partial, 144, ... TitleIdx=0, Type=4, Data="\14\0\0\0"}, 16, ) }, 16, ) == 0x0
 02660   428   NtQueryValueKey  (380,  (380, "Enabled", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (380, "Enabled", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) }, 16, ) == 0x0
 02661   428   NtQueryValueKey  (380,  (380, "Version", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (380, "Version", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) }, 16, ) == 0x0
 02662   428   NtQueryValueKey  (380,  (380, "StoresServiceClassInfo", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (380, "StoresServiceClassInfo", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) }, 16, ) == 0x0
 02663   428   NtClose  (380, ... ) == 0x0
 02664   428   NtOpenKey  (0x20019, {24, 376, 0x40, 0, 0,  (0x20019, {24, 376, 0x40, 0, 0, "000000000002"}, ... 380, ) }, ... 380, ) == 0x0
 02665   428   NtQueryValueKey  (380,  (380, "LibraryPath", Partial, 144, ... TitleIdx=0, Type=1, Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0w\0i\0n\0r\0n\0r\0.\0d\0l\0l\0\0\0"}, 78, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (380, "LibraryPath", Partial, 144, ... TitleIdx=0, Type=1, Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0w\0i\0n\0r\0n\0r\0.\0d\0l\0l\0\0\0"}, 78, ) }, 78, ) == 0x0
 02666   428   NtQueryValueKey  (380,  (380, "LibraryPath", Partial, 144, ... TitleIdx=0, Type=1, Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0w\0i\0n\0r\0n\0r\0.\0d\0l\0l\0\0\0"}, 78, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (380, "LibraryPath", Partial, 144, ... TitleIdx=0, Type=1, Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0w\0i\0n\0r\0n\0r\0.\0d\0l\0l\0\0\0"}, 78, ) }, 78, ) == 0x0
 02667   428   NtQueryValueKey  (380,  (380, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="N\0T\0D\0S\0\0\0"}, 22, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (380, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="N\0T\0D\0S\0\0\0"}, 22, ) }, 22, ) == 0x0
 02668   428   NtQueryValueKey  (380,  (380, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="N\0T\0D\0S\0\0\0"}, 22, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (380, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="N\0T\0D\0S\0\0\0"}, 22, ) }, 22, ) == 0x0
 02669   428   NtQueryValueKey  (380,  (380, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="N\0T\0D\0S\0\0\0"}, 22, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (380, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="N\0T\0D\0S\0\0\0"}, 22, ) }, 22, ) == 0x0
 02670   428   NtQueryValueKey  (380,  (380, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="N\0T\0D\0S\0\0\0"}, 22, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (380, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="N\0T\0D\0S\0\0\0"}, 22, ) }, 22, ) == 0x0
 02671   428   NtQueryValueKey  (380,  (380, "ProviderId", Partial, 144, ... TitleIdx=0, Type=3, Data="\3567&;\200\345\317\21\245U\0\300O\330\324\254"}, 28, ) , Partial, 144, ... TitleIdx=0, Type=3, Data= (380, "ProviderId", Partial, 144, ... TitleIdx=0, Type=3, Data="\3567&;\200\345\317\21\245U\0\300O\330\324\254"}, 28, ) }, 28, ) == 0x0
 02672   428   NtQueryValueKey  (380,  (380, "AddressFamily", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02673   428   NtQueryValueKey  (380,  (380, "SupportedNameSpace", Partial, 144, ... TitleIdx=0, Type=4, Data=" \0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (380, "SupportedNameSpace", Partial, 144, ... TitleIdx=0, Type=4, Data=" \0\0\0"}, 16, ) }, 16, ) == 0x0
 02674   428   NtQueryValueKey  (380,  (380, "Enabled", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (380, "Enabled", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) }, 16, ) == 0x0
 02675   428   NtQueryValueKey  (380,  (380, "Version", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (380, "Version", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) }, 16, ) == 0x0
 02676   428   NtQueryValueKey  (380,  (380, "StoresServiceClassInfo", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (380, "StoresServiceClassInfo", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) }, 16, ) == 0x0
 02677   428   NtClose  (380, ... ) == 0x0
 02678   428   NtAllocateVirtualMemory  (-1, 1462272, 0, 4096, 4096, 4, ... 1462272, 4096, ) == 0x0
 02679   428   NtOpenKey  (0x20019, {24, 376, 0x40, 0, 0,  (0x20019, {24, 376, 0x40, 0, 0, "000000000003"}, ... 380, ) }, ... 380, ) == 0x0
 02680   428   NtQueryValueKey  (380,  (380, "LibraryPath", Partial, 144, ... TitleIdx=0, Type=1, Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0m\0s\0w\0s\0o\0c\0k\0.\0d\0l\0l\0\0\0"}, 80, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (380, "LibraryPath", Partial, 144, ... TitleIdx=0, Type=1, Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0m\0s\0w\0s\0o\0c\0k\0.\0d\0l\0l\0\0\0"}, 80, ) }, 80, ) == 0x0
 02681   428   NtQueryValueKey  (380,  (380, "LibraryPath", Partial, 144, ... TitleIdx=0, Type=1, Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0m\0s\0w\0s\0o\0c\0k\0.\0d\0l\0l\0\0\0"}, 80, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (380, "LibraryPath", Partial, 144, ... TitleIdx=0, Type=1, Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0m\0s\0w\0s\0o\0c\0k\0.\0d\0l\0l\0\0\0"}, 80, ) }, 80, ) == 0x0
 02682   428   NtQueryValueKey  (380,  (380, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="N\0e\0t\0w\0o\0r\0k\0 \0L\0o\0c\0a\0t\0i\0o\0n\0 \0A\0w\0a\0r\0e\0n\0e\0s\0s\0 \0(\0N\0L\0A\0)\0 \0N\0a\0m\0e\0s\0p\0a\0c\0e\0\0\0"}, 98, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (380, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="N\0e\0t\0w\0o\0r\0k\0 \0L\0o\0c\0a\0t\0i\0o\0n\0 \0A\0w\0a\0r\0e\0n\0e\0s\0s\0 \0(\0N\0L\0A\0)\0 \0N\0a\0m\0e\0s\0p\0a\0c\0e\0\0\0"}, 98, ) }, 98, ) == 0x0
 02683   428   NtQueryValueKey  (380,  (380, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="N\0e\0t\0w\0o\0r\0k\0 \0L\0o\0c\0a\0t\0i\0o\0n\0 \0A\0w\0a\0r\0e\0n\0e\0s\0s\0 \0(\0N\0L\0A\0)\0 \0N\0a\0m\0e\0s\0p\0a\0c\0e\0\0\0"}, 98, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (380, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="N\0e\0t\0w\0o\0r\0k\0 \0L\0o\0c\0a\0t\0i\0o\0n\0 \0A\0w\0a\0r\0e\0n\0e\0s\0s\0 \0(\0N\0L\0A\0)\0 \0N\0a\0m\0e\0s\0p\0a\0c\0e\0\0\0"}, 98, ) }, 98, ) == 0x0
 02684   428   NtQueryValueKey  (380,  (380, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="N\0e\0t\0w\0o\0r\0k\0 \0L\0o\0c\0a\0t\0i\0o\0n\0 \0A\0w\0a\0r\0e\0n\0e\0s\0s\0 \0(\0N\0L\0A\0)\0 \0N\0a\0m\0e\0s\0p\0a\0c\0e\0\0\0"}, 98, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (380, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="N\0e\0t\0w\0o\0r\0k\0 \0L\0o\0c\0a\0t\0i\0o\0n\0 \0A\0w\0a\0r\0e\0n\0e\0s\0s\0 \0(\0N\0L\0A\0)\0 \0N\0a\0m\0e\0s\0p\0a\0c\0e\0\0\0"}, 98, ) }, 98, ) == 0x0
 02685   428   NtQueryValueKey  (380,  (380, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="N\0e\0t\0w\0o\0r\0k\0 \0L\0o\0c\0a\0t\0i\0o\0n\0 \0A\0w\0a\0r\0e\0n\0e\0s\0s\0 \0(\0N\0L\0A\0)\0 \0N\0a\0m\0e\0s\0p\0a\0c\0e\0\0\0"}, 98, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (380, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="N\0e\0t\0w\0o\0r\0k\0 \0L\0o\0c\0a\0t\0i\0o\0n\0 \0A\0w\0a\0r\0e\0n\0e\0s\0s\0 \0(\0N\0L\0A\0)\0 \0N\0a\0m\0e\0s\0p\0a\0c\0e\0\0\0"}, 98, ) }, 98, ) == 0x0
 02686   428   NtQueryValueKey  (380,  (380, "ProviderId", Partial, 144, ... TitleIdx=0, Type=3, Data=":$Bf\250;\246J\272\245.\13\327\37\335\203"}, 28, ) , Partial, 144, ... TitleIdx=0, Type=3, Data= (380, "ProviderId", Partial, 144, ... TitleIdx=0, Type=3, Data=":$Bf\250;\246J\272\245.\13\327\37\335\203"}, 28, ) }, 28, ) == 0x0
 02687   428   NtQueryValueKey  (380,  (380, "AddressFamily", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02688   428   NtQueryValueKey  (380,  (380, "SupportedNameSpace", Partial, 144, ... TitleIdx=0, Type=4, Data="\17\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (380, "SupportedNameSpace", Partial, 144, ... TitleIdx=0, Type=4, Data="\17\0\0\0"}, 16, ) }, 16, ) == 0x0
 02689   428   NtQueryValueKey  (380,  (380, "Enabled", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (380, "Enabled", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) }, 16, ) == 0x0
 02690   428   NtQueryValueKey  (380,  (380, "Version", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (380, "Version", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) }, 16, ) == 0x0
 02691   428   NtQueryValueKey  (380,  (380, "StoresServiceClassInfo", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (380, "StoresServiceClassInfo", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) }, 16, ) == 0x0
 02692   428   NtClose  (380, ... ) == 0x0
 02693   428   NtClose  (376, ... ) == 0x0
 02694   428   NtWaitForSingleObject  (368, 0, {0, 0}, ... ) == 0x102
 02695   428   NtClose  (360, ... ) == 0x0
 02696   428   NtQuerySystemInformation  (Basic, 44, ... {Unknown=0,MaximumIncrement=156250,PhysicalPageSize=0x1000,NumberOfPhysicalPages=0xff7c,LowestPhysicalPage=0x1,HighestPhysicalPage=0xffff,AllocationGranularity=0x10000,LowestUserAddress=0x10000,HighestUserAddress=0x7ffeffff,ActiveProcessors=1,NumberProcessors=1,}, 0x0, ) == 0x0
 02697   428   NtQuerySystemInformation  (Processor, 12, ... {system info, class 1, size 12}, 0x0, ) == 0x0
 02698   428   NtOpenKey  (0x1, {24, 28, 0x40, 0, 0,  (0x1, {24, 28, 0x40, 0, 0, "System\CurrentControlSet\Services\Winsock2\Parameters"}, ... 360, ) }, ... 360, ) == 0x0
 02699   428   NtQueryValueKey  (360,  (360, "Ws2_32NumHandleBuckets", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02700   428   NtClose  (360, ... ) == 0x0
 02701   428   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ... 360, ) == 0x0
 02702   428   NtClearEvent  (340, ... ) == 0x0
 02703   428   NtSetEvent  (340, ... 0x0, ) == 0x0
 02704   428   NtOpenKey  (0x20019, {24, 324, 0x40, 0, 0,  (0x20019, {24, 324, 0x40, 0, 0, "ProtocolDefaults\"}, ... 376, ) }, ... 376, ) == 0x0
 02705   428   NtQueryValueKey  (376,  (376, "http", Partial, 144, ... TitleIdx=0, Type=4, Data="\3\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (376, "http", Partial, 144, ... TitleIdx=0, Type=4, Data="\3\0\0\0"}, 16, ) }, 16, ) == 0x0
 02706   428   NtClose  (376, ... ) == 0x0
 02707   428   NtWaitForSingleObject  (316, 0, 0x0, ... ) == 0x0
 02708   428   NtReleaseMutant  (316, ... 0x0, ) == 0x0
 02709   428   NtWaitForSingleObject  (316, 0, 0x0, ... ) == 0x0
 02710   428   NtReleaseMutant  (316, ... 0x0, ) == 0x0
 02711   428   NtWaitForSingleObject  (312, 0, 0x0, ... ) == 0x0
 02712   428   NtReleaseMutant  (312, ... 0x0, ) == 0x0
 02713   428   NtOpenKey  (0x20019, {24, 60, 0x40, 0, 0,  (0x20019, {24, 60, 0x40, 0, 0, "Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3"}, ... 376, ) }, ... 376, ) == 0x0
 02714   428   NtQueryValueKey  (376,  (376, "1D03", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02715   428   NtOpenKey  (0x20019, {24, 28, 0x40, 0, 0,  (0x20019, {24, 28, 0x40, 0, 0, "Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3"}, ... 380, ) }, ... 380, ) == 0x0
 02716   428   NtQueryValueKey  (380,  (380, "1D03", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02717   428   NtClose  (380, ... ) == 0x0
 02718   428   NtClose  (376, ... ) == 0x0
 02719   428   NtClose  (324, ... ) == 0x0
 02720   428   NtCreateSemaphore  (0x1f0003, {24, 52, 0x80, 1382696, 0,  (0x1f0003, {24, 52, 0x80, 1382696, 0, "shell.{A48F1A32-A340-11D1-BC6B-00A0C90312E1}"}, 0, 2147483647, ... 324, ) }, 0, 2147483647, ... 324, ) == STATUS_OBJECT_NAME_EXISTS
 02721   428   NtReleaseSemaphore  (324, 1, ... 0, ) == 0x0
 02722   428   NtWaitForSingleObject  (324, 0, {0, 0}, ... ) == 0x0
 02723   428   NtOpenKey  (0x1, {24, 28, 0x40, 0, 0,  (0x1, {24, 28, 0x40, 0, 0, "Software\Policies\Microsoft\Internet Explorer\Infodelivery\Restrictions"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02724   428   NtOpenKey  (0x1, {24, 60, 0x40, 0, 0,  (0x1, {24, 60, 0x40, 0, 0, "Software\Policies\Microsoft\Internet Explorer\Infodelivery\Restrictions"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02725   428   NtOpenKey  (0x20019, {24, 28, 0x40, 0, 0,  (0x20019, {24, 28, 0x40, 0, 0, "Software\Microsoft\Active Setup\ClsidFeature"}, ... 376, ) }, ... 376, ) == 0x0
 02726   428   NtQueryValueKey  (376,  (376, "{ABBE31D0-6DAE-11D0-BECA-00C04FD940BE}", Partial, 144, ... TitleIdx=0, Type=1, Data="{\03\0a\0f\03\06\02\03\00\0-\0a\02\06\09\0-\01\01\0d\01\0-\0b\05\0b\0f\0-\00\00\00\00\0f\08\00\05\01\05\01\05\0}\0!\06\0,\00\0,\02\06\00\00\0,\00\00\00\00\0\0\0"}, 118, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (376, "{ABBE31D0-6DAE-11D0-BECA-00C04FD940BE}", Partial, 144, ... TitleIdx=0, Type=1, Data="{\03\0a\0f\03\06\02\03\00\0-\0a\02\06\09\0-\01\01\0d\01\0-\0b\05\0b\0f\0-\00\00\00\00\0f\08\00\05\01\05\01\05\0}\0!\06\0,\00\0,\02\06\00\00\0,\00\00\00\00\0\0\0"}, 118, ) }, 118, ) == 0x0
 02727   428   NtQueryValueKey  (376,  (376, "{ABBE31D0-6DAE-11D0-BECA-00C04FD940BE}", Partial, 144, ... TitleIdx=0, Type=1, Data="{\03\0a\0f\03\06\02\03\00\0-\0a\02\06\09\0-\01\01\0d\01\0-\0b\05\0b\0f\0-\00\00\00\00\0f\08\00\05\01\05\01\05\0}\0!\06\0,\00\0,\02\06\00\00\0,\00\00\00\00\0\0\0"}, 118, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (376, "{ABBE31D0-6DAE-11D0-BECA-00C04FD940BE}", Partial, 144, ... TitleIdx=0, Type=1, Data="{\03\0a\0f\03\06\02\03\00\0-\0a\02\06\09\0-\01\01\0d\01\0-\0b\05\0b\0f\0-\00\00\00\00\0f\08\00\05\01\05\01\05\0}\0!\06\0,\00\0,\02\06\00\00\0,\00\00\00\00\0\0\0"}, 118, ) }, 118, ) == 0x0
 02728   428   NtClose  (376, ... ) == 0x0
 02729   428   NtOpenKey  (0x20019, {24, 28, 0x40, 0, 0,  (0x20019, {24, 28, 0x40, 0, 0, "Software\Microsoft\Active Setup\FeatureComponentID"}, ... 376, ) }, ... 376, ) == 0x0
 02730   428   NtQueryValueKey  (376,  (376, "{3af36230-a269-11d1-b5bf-0000f8051515}", Partial, 144, ... TitleIdx=0, Type=1, Data="M\0O\0B\0I\0L\0E\0P\0K\0_\0N\0T\0x\08\06\0\0\0"}, 42, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (376, "{3af36230-a269-11d1-b5bf-0000f8051515}", Partial, 144, ... TitleIdx=0, Type=1, Data="M\0O\0B\0I\0L\0E\0P\0K\0_\0N\0T\0x\08\06\0\0\0"}, 42, ) }, 42, ) == 0x0
 02731   428   NtQueryValueKey  (376,  (376, "{3af36230-a269-11d1-b5bf-0000f8051515}", Partial, 144, ... TitleIdx=0, Type=1, Data="M\0O\0B\0I\0L\0E\0P\0K\0_\0N\0T\0x\08\06\0\0\0"}, 42, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (376, "{3af36230-a269-11d1-b5bf-0000f8051515}", Partial, 144, ... TitleIdx=0, Type=1, Data="M\0O\0B\0I\0L\0E\0P\0K\0_\0N\0T\0x\08\06\0\0\0"}, 42, ) }, 42, ) == 0x0
 02732   428   NtClose  (376, ... ) == 0x0
 02733   428   NtOpenKey  (0x20019, {24, 28, 0x40, 0, 0,  (0x20019, {24, 28, 0x40, 0, 0, "Software\Microsoft\Active Setup\Installed Components\{3af36230-a269-11d1-b5bf-0000f8051515}"}, ... 376, ) }, ... 376, ) == 0x0
 02734   428   NtQueryValueKey  (376,  (376, "IsInstalled", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (376, "IsInstalled", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) }, 16, ) == 0x0
 02735   428   NtQueryValueKey  (376,  (376, "Version", Partial, 144, ... TitleIdx=0, Type=1, Data="6\0,\00\0,\02\06\00\00\0,\00\00\00\00\0\0\0"}, 40, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (376, "Version", Partial, 144, ... TitleIdx=0, Type=1, Data="6\0,\00\0,\02\06\00\00\0,\00\00\00\00\0\0\0"}, 40, ) }, 40, ) == 0x0
 02736   428   NtQueryValueKey  (376,  (376, "Version", Partial, 144, ... TitleIdx=0, Type=1, Data="6\0,\00\0,\02\06\00\00\0,\00\00\00\00\0\0\0"}, 40, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (376, "Version", Partial, 144, ... TitleIdx=0, Type=1, Data="6\0,\00\0,\02\06\00\00\0,\00\00\00\00\0\0\0"}, 40, ) }, 40, ) == 0x0
 02737   428   NtQueryValueKey  (376,  (376, "KeyFileName", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02738   428   NtClose  (376, ... ) == 0x0
 02739   428   NtUserThunkedMenuItemInfo  (196685, 1, 1024, 1, 1239684, 0, ... ) == 0x1
 02740   428   NtQueryDefaultUILanguage  (1239128, ...
 02741   428   NtOpenThreadTokenEx  (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN
 02742   428   NtOpenProcessTokenEx  (-1, 0x20008, 512, ... -2147482204, ) == 0x0
 02743   428   NtQueryInformationToken  (-2147482204, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0
 02744   428   NtClose  (-2147482204, ... ) == 0x0
 02745   428   NtOpenKey  (0x2000000, {24, 0, 0x640, 0, 0,  (0x2000000, {24, 0, 0x640, 0, 0, "\REGISTRY\USER\S-1-5-21-1078081533-484763869-839522115-1003"}, ... -2147482204, ) }, ... -2147482204, ) == 0x0
 02746   428   NtOpenKey  (0x80000000, {24, 0, 0x240, 0, 0,  (0x80000000, {24, 0, 0x240, 0, 0, "\Registry\Machine\System\CurrentControlSet\Control\Nls\MUILanguages"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02747   428   NtOpenKey  (0x80000000, {24, -2147482204, 0x640, 0, 0,  (0x80000000, {24, -2147482204, 0x640, 0, 0, "Control Panel\Desktop"}, ... -2147482208, ) }, ... -2147482208, ) == 0x0
 02748   428   NtQueryValueKey  (-2147482208,  (-2147482208, "MultiUILanguageId", Partial, 256, ... ) , Partial, 256, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02749   428   NtClose  (-2147482208, ... ) == 0x0
 02750   428   NtClose  (-2147482204, ... ) == 0x0
 02740   428   NtQueryDefaultUILanguage  ... ) == 0x0
 02751   428   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\System\CurrentControlSet\Control\Nls\MUILanguages"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02752   428   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\System32\shdoclc.dll"}, 1236320, ... ) }, 1236320, ... ) == 0x0
 02753   428   NtOpenFile  (0x100020, {24, 0, 0x40, 0, 0,  (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\System32\shdoclc.dll"}, 5, 96, ... 376, {status=0x0, info=1}, ) }, 5, 96, ... 376, {status=0x0, info=1}, ) == 0x0
 02754   428   NtCreateSection  (0xe, 0x0, 0x0, 16, 134217728, 376, ... 380, ) == 0x0
 02755   428   NtClose  (376, ... ) == 0x0
 02756   428   NtMapViewOfSection  (380, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 16, ... (0xa50000), 0x0, 548864, ) == 0x0
 02757   428   NtClose  (380, ... ) == 0x0
 02758   428   NtUnmapViewOfSection  (-1, 0xa50000, ... ) == 0x0
 02759   428   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\System32\shdoclc.dll"}, 1236636, ... ) }, 1236636, ... ) == 0x0
 02760   428   NtOpenFile  (0x100020, {24, 0, 0x40, 0, 0,  (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\System32\shdoclc.dll"}, 5, 96, ... 380, {status=0x0, info=1}, ) }, 5, 96, ... 380, {status=0x0, info=1}, ) == 0x0
 02761   428   NtCreateSection  (0xf, 0x0, 0x0, 16, 16777216, 380, ... 376, ) == 0x0
 02762   428   NtQuerySection  (376, Image, 48, ... {section info, class 1, size 48}, 0x0, ) == 0x0
 02763   428   NtClose  (380, ... ) == 0x0
 02764   428   NtMapViewOfSection  (376, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x76170000), 0x0, 557056, ) == 0x0
 02765   428   NtClose  (376, ... ) == 0x0
 02766   428   NtQueryDefaultLocale  (1, 1239936, ... ) == 0x0
 02767   428   NtUnmapViewOfSection  (-1, 0x76170000, ... ) == 0x0
 02768   428   NtUserThunkedMenuItemInfo  (196685, 2, 1024, 1, 1239992, 1240040, ... ) == 0x1
 02769   428   NtAllocateVirtualMemory  (-1, 1466368, 0, 8192, 4096, 4, ... 1466368, 8192, ) == 0x0
 02770   428   NtQueryKey  (122, Name, 384, ... {Name= (122, Name, 384, ... {Name="\REGISTRY\USER\S-1-5-21-1078081533-484763869-839522115-1003_CLASSESr"}, 138, ) }, 138, ) == 0x0
 02771   428   NtOpenKey  (0x1, {24, 122, 0x40, 0, 0,  (0x1, {24, 122, 0x40, 0, 0, "http"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02772   428   NtOpenKey  (0x1, {24, 0, 0x40, 0, 0,  (0x1, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Classes\http"}, ... 376, ) }, ... 376, ) == 0x0
 02773   428   NtQueryKey  (378, Name, 392, ... {Name= (378, Name, 392, ... {Name="\REGISTRY\MACHINE\SOFTWARE\Classes\httpo"}, 82, ) }, 82, ) == 0x0
 02774   428   NtOpenThreadTokenEx  (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN
 02775   428   NtOpenProcessTokenEx  (-1, 0x20008, 512, ... 380, ) == 0x0
 02776   428   NtQueryInformationToken  (380, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0
 02777   428   NtClose  (380, ... ) == 0x0
 02778   428   NtOpenKey  (0x2000000, {24, 0, 0x40, 0, 0,  (0x2000000, {24, 0, 0x40, 0, 0, "\REGISTRY\USER\S-1-5-21-1078081533-484763869-839522115-1003_Classes\http"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02779   428   NtQueryValueKey  (378,  (378, "URL Protocol", Partial, 144, ... TitleIdx=0, Type=1, Data="\0\0"}, 14, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (378, "URL Protocol", Partial, 144, ... TitleIdx=0, Type=1, Data="\0\0"}, 14, ) }, 14, ) == 0x0
 02780   428   NtClose  (378, ... ) == 0x0
 02781   428   NtQueryKey  (122, Name, 384, ... {Name= (122, Name, 384, ... {Name="\REGISTRY\USER\S-1-5-21-1078081533-484763869-839522115-1003_CLASSES9"}, 138, ) }, 138, ) == 0x0
 02782   428   NtOpenKey  (0x1, {24, 122, 0x40, 0, 0,  (0x1, {24, 122, 0x40, 0, 0, "http\shell"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02783   428   NtOpenKey  (0x1, {24, 0, 0x40, 0, 0,  (0x1, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Classes\http\shell"}, ... 376, ) }, ... 376, ) == 0x0
 02784   428   NtQueryKey  (378, Name, 392, ... {Name= (378, Name, 392, ... {Name="\REGISTRY\MACHINE\SOFTWARE\Classes\http\shelle"}, 94, ) }, 94, ) == 0x0
 02785   428   NtOpenThreadTokenEx  (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN
 02786   428   NtOpenProcessTokenEx  (-1, 0x20008, 512, ... 380, ) == 0x0
 02787   428   NtQueryInformationToken  (380, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0
 02788   428   NtClose  (380, ... ) == 0x0
 02789   428   NtOpenKey  (0x2000000, {24, 0, 0x40, 0, 0,  (0x2000000, {24, 0, 0x40, 0, 0, "\REGISTRY\USER\S-1-5-21-1078081533-484763869-839522115-1003_Classes\http\shell"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02790   428   NtQueryValueKey  (378, 0x0, Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02791   428   NtClose  (378, ... ) == 0x0
 02792   428   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\rpcss.dll"}, 1232044, ... ) }, 1232044, ... ) == 0x0
 02793   428   NtOpenFile  (0x100020, {24, 0, 0x40, 0, 0,  (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\rpcss.dll"}, 5, 96, ... 376, {status=0x0, info=1}, ) }, 5, 96, ... 376, {status=0x0, info=1}, ) == 0x0
 02794   428   NtCreateSection  (0xe, 0x0, 0x0, 16, 134217728, 376, ... 380, ) == 0x0
 02795   428   NtClose  (376, ... ) == 0x0
 02796   428   NtMapViewOfSection  (380, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 16, ... (0x960000), 0x0, 262144, ) == 0x0
 02797   428   NtClose  (380, ... ) == 0x0
 02798   428   NtUnmapViewOfSection  (-1, 0x960000, ... ) == 0x0
 02799   428   NtOpenKey  (0x1, {24, 60, 0x40, 0, 0,  (0x1, {24, 60, 0x40, 0, 0, "Software\Microsoft\Windows\CurrentVersion\Explorer"}, ... 380, ) }, ... 380, ) == 0x0
 02800   428   NtQueryValueKey  (380,  (380, "MaximizeApps", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02801   428   NtOpenKey  (0x1, {24, 28, 0x40, 0, 0,  (0x1, {24, 28, 0x40, 0, 0, "Software\Microsoft\Windows\CurrentVersion\Explorer"}, ... 376, ) }, ... 376, ) == 0x0
 02802   428   NtQueryValueKey  (376,  (376, "MaximizeApps", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02803   428   NtClose  (376, ... ) == 0x0
 02804   428   NtClose  (380, ... ) == 0x0
 02805   428   NtAllocateVirtualMemory  (-1, 1474560, 0, 24576, 4096, 4, ... 1474560, 24576, ) == 0x0
 02806   428   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\U:\startupscripts"}, 1232700, ... ) }, 1232700, ... ) == 0x0
 02807   428   NtOpenKey  (0x20019, {24, 28, 0x40, 0, 0,  (0x20019, {24, 28, 0x40, 0, 0, "Software\Microsoft\Windows\CurrentVersion\Explorer\Desktop\NameSpace"}, ... 380, ) }, ... 380, ) == 0x0
 02808   428   NtEnumerateKey  (380, 0, Basic, 288, ... {LastWrite={0x5aa70706,0x1c73999}, TitleIdx=0, Name= (380, 0, Basic, 288, ... {LastWrite={0x5aa70706,0x1c73999}, TitleIdx=0, Name="{1f4de370-d627-11d1-ba4f-00a0c91eedba}"}, 92, ) }, 92, ) == 0x0
 02809   428   NtOpenKey  (0x20019, {24, 380, 0x40, 0, 0,  (0x20019, {24, 380, 0x40, 0, 0, "{1f4de370-d627-11d1-ba4f-00a0c91eedba}"}, ... 376, ) }, ... 376, ) == 0x0
 02810   428   NtQueryValueKey  (376,  (376, "SuppressionPolicy", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02811   428   NtClose  (376, ... ) == 0x0
 02812   428   NtEnumerateKey  (380, 1, Basic, 288, ... {LastWrite={0x5aa4a4ac,0x1c73999}, TitleIdx=0, Name= (380, 1, Basic, 288, ... {LastWrite={0x5aa4a4ac,0x1c73999}, TitleIdx=0, Name="{450D8FBA-AD25-11D0-98A8-0800361B1103}"}, 92, ) }, 92, ) == 0x0
 02813   428   NtOpenKey  (0x20019, {24, 380, 0x40, 0, 0,  (0x20019, {24, 380, 0x40, 0, 0, "{450D8FBA-AD25-11D0-98A8-0800361B1103}"}, ... 376, ) }, ... 376, ) == 0x0
 02814   428   NtQueryValueKey  (376,  (376, "SuppressionPolicy", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02815   428   NtClose  (376, ... ) == 0x0
 02816   428   NtEnumerateKey  (380, 2, Basic, 288, ... {LastWrite={0x98c5c536,0x1c738c7}, TitleIdx=0, Name= (380, 2, Basic, 288, ... {LastWrite={0x98c5c536,0x1c738c7}, TitleIdx=0, Name="{645FF040-5081-101B-9F08-00AA002F954E}"}, 92, ) }, 92, ) == 0x0
 02817   428   NtOpenKey  (0x20019, {24, 380, 0x40, 0, 0,  (0x20019, {24, 380, 0x40, 0, 0, "{645FF040-5081-101B-9F08-00AA002F954E}"}, ... 376, ) }, ... 376, ) == 0x0
 02818   428   NtQueryValueKey  (376,  (376, "SuppressionPolicy", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02819   428   NtClose  (376, ... ) == 0x0
 02820   428   NtEnumerateKey  (380, 3, Basic, 288, ... {LastWrite={0x5aa70706,0x1c73999}, TitleIdx=0, Name= (380, 3, Basic, 288, ... {LastWrite={0x5aa70706,0x1c73999}, TitleIdx=0, Name="{e17d4fc0-5564-11d1-83f2-00a0c90dc849}"}, 92, ) }, 92, ) == 0x0
 02821   428   NtOpenKey  (0x20019, {24, 380, 0x40, 0, 0,  (0x20019, {24, 380, 0x40, 0, 0, "{e17d4fc0-5564-11d1-83f2-00a0c90dc849}"}, ... 376, ) }, ... 376, ) == 0x0
 02822   428   NtQueryValueKey  (376,  (376, "SuppressionPolicy", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02823   428   NtClose  (376, ... ) == 0x0
 02824   428   NtEnumerateKey  (380, 4, Basic, 288, ... ) == STATUS_NO_MORE_ENTRIES
 02825   428   NtClose  (380, ... ) == 0x0
 02826   428   NtOpenKey  (0x20019, {24, 60, 0x40, 0, 0,  (0x20019, {24, 60, 0x40, 0, 0, "Software\Microsoft\Windows\CurrentVersion\Explorer\Desktop\NameSpace"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02827   428   NtOpenThreadToken  (-2, 0xc, 1, ... ) == STATUS_NO_TOKEN
 02828   428   NtOpenKey  (0x2000000, {24, 108, 0x40, 0, 0, ""}, ... 380, ) == 0x0
 02829   428   NtCreateKey  (0x20019, {24, 380, 0x40, 0, 0,  (0x20019, {24, 380, 0x40, 0, 0, "SessionInfo\0000000000008fe4"}, 0, 0x0, 1, ... 376, 2, ) }, 0, 0x0, 1, ... 376, 2, ) == 0x0
 02830   428   NtClose  (380, ... ) == 0x0
 02831   428   NtOpenKey  (0x20019, {24, 376, 0x40, 0, 0,  (0x20019, {24, 376, 0x40, 0, 0, "Desktop\NameSpace"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02832   428   NtClose  (376, ... ) == 0x0
 02833   428   NtQueryKey  (122, Name, 384, ... {Name= (122, Name, 384, ... {Name="\REGISTRY\USER\S-1-5-21-1078081533-484763869-839522115-1003_CLASSESr"}, 138, ) }, 138, ) == 0x0
 02834   428   NtOpenKey  (0x2000000, {24, 122, 0x40, 0, 0,  (0x2000000, {24, 122, 0x40, 0, 0, "CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\ShellFolder"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02835   428   NtOpenKey  (0x2000000, {24, 0, 0x40, 0, 0,  (0x2000000, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Classes\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\ShellFolder"}, ... 376, ) }, ... 376, ) == 0x0
 02836   428   NtQueryKey  (378, Name, 392, ... {Name= (378, Name, 392, ... {Name="\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\ShellFolderB"}, 186, ) }, 186, ) == 0x0
 02837   428   NtOpenThreadTokenEx  (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN
 02838   428   NtOpenProcessTokenEx  (-1, 0x20008, 512, ... 380, ) == 0x0
 02839   428   NtQueryInformationToken  (380, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0
 02840   428   NtClose  (380, ... ) == 0x0
 02841   428   NtOpenKey  (0x2000000, {24, 0, 0x40, 0, 0,  (0x2000000, {24, 0, 0x40, 0, 0, "\REGISTRY\USER\S-1-5-21-1078081533-484763869-839522115-1003_Classes\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\ShellFolder"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02842   428   NtQueryValueKey  (378,  (378, "WantsParseDisplayName", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02843   428   NtClose  (378, ... ) == 0x0
 02844   428   NtQueryKey  (122, Name, 384, ... {Name= (122, Name, 384, ... {Name="\REGISTRY\USER\S-1-5-21-1078081533-484763869-839522115-1003_CLASSES9"}, 138, ) }, 138, ) == 0x0
 02845   428   NtOpenKey  (0x2000000, {24, 122, 0x40, 0, 0,  (0x2000000, {24, 122, 0x40, 0, 0, "CLSID\{208D2C60-3AEA-1069-A2D7-08002B30309D}\ShellFolder"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02846   428   NtOpenKey  (0x2000000, {24, 0, 0x40, 0, 0,  (0x2000000, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Classes\CLSID\{208D2C60-3AEA-1069-A2D7-08002B30309D}\ShellFolder"}, ... 376, ) }, ... 376, ) == 0x0
 02847   428   NtQueryKey  (378, Name, 392, ... {Name= (378, Name, 392, ... {Name="\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{208D2C60-3AEA-1069-A2D7-08002B30309D}\ShellFolderB"}, 186, ) }, 186, ) == 0x0
 02848   428   NtOpenThreadTokenEx  (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN
 02849   428   NtOpenProcessTokenEx  (-1, 0x20008, 512, ... 380, ) == 0x0
 02850   428   NtQueryInformationToken  (380, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0
 02851   428   NtClose  (380, ... ) == 0x0
 02852   428   NtOpenKey  (0x2000000, {24, 0, 0x40, 0, 0,  (0x2000000, {24, 0, 0x40, 0, 0, "\REGISTRY\USER\S-1-5-21-1078081533-484763869-839522115-1003_Classes\CLSID\{208D2C60-3AEA-1069-A2D7-08002B30309D}\ShellFolder"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02853   428   NtQueryValueKey  (378,  (378, "WantsParseDisplayName", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02854   428   NtClose  (378, ... ) == 0x0
 02855   428   NtQueryKey  (122, Name, 384, ... {Name= (122, Name, 384, ... {Name="\REGISTRY\USER\S-1-5-21-1078081533-484763869-839522115-1003_CLASSES9"}, 138, ) }, 138, ) == 0x0
 02856   428   NtOpenKey  (0x2000000, {24, 122, 0x40, 0, 0,  (0x2000000, {24, 122, 0x40, 0, 0, "CLSID\{871C5380-42A0-1069-A2EA-08002B30309D}\ShellFolder"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02857   428   NtOpenKey  (0x2000000, {24, 0, 0x40, 0, 0,  (0x2000000, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Classes\CLSID\{871C5380-42A0-1069-A2EA-08002B30309D}\ShellFolder"}, ... 376, ) }, ... 376, ) == 0x0
 02858   428   NtQueryKey  (378, Name, 392, ... {Name= (378, Name, 392, ... {Name="\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{871C5380-42A0-1069-A2EA-08002B30309D}\ShellFolderB"}, 186, ) }, 186, ) == 0x0
 02859   428   NtOpenThreadTokenEx  (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN
 02860   428   NtOpenProcessTokenEx  (-1, 0x20008, 512, ... 380, ) == 0x0
 02861   428   NtQueryInformationToken  (380, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0
 02862   428   NtClose  (380, ... ) == 0x0
 02863   428   NtOpenKey  (0x2000000, {24, 0, 0x40, 0, 0,  (0x2000000, {24, 0, 0x40, 0, 0, "\REGISTRY\USER\S-1-5-21-1078081533-484763869-839522115-1003_Classes\CLSID\{871C5380-42A0-1069-A2EA-08002B30309D}\ShellFolder"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02864   428   NtQueryValueKey  (378,  (378, "WantsParseDisplayName", Partial, 144, ... TitleIdx=0, Type=1, Data="\0\0"}, 14, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (378, "WantsParseDisplayName", Partial, 144, ... TitleIdx=0, Type=1, Data="\0\0"}, 14, ) }, 14, ) == 0x0
 02865   428   NtClose  (378, ... ) == 0x0
 02866   428   NtOpenKey  (0x1, {24, 28, 0x40, 0, 0,  (0x1, {24, 28, 0x40, 0, 0, "SOFTWARE\Microsoft\Windows\CurrentVersion\ShellCompatibility\Objects\{871C5380-42A0-1069-A2EA-08002B30309D}"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02867   428   NtQueryKey  (122, Name, 384, ... {Name= (122, Name, 384, ... {Name="\REGISTRY\USER\S-1-5-21-1078081533-484763869-839522115-1003_CLASSESC"}, 138, ) }, 138, ) == 0x0
 02868   428   NtOpenKey  (0x1, {24, 122, 0x40, 0, 0,  (0x1, {24, 122, 0x40, 0, 0, "CLSID\{871C5380-42A0-1069-A2EA-08002B30309D}\InProcServer32"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02869   428   NtOpenKey  (0x1, {24, 0, 0x40, 0, 0,  (0x1, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Classes\CLSID\{871C5380-42A0-1069-A2EA-08002B30309D}\InProcServer32"}, ... 376, ) }, ... 376, ) == 0x0
 02870   428   NtQueryKey  (378, Name, 392, ... {Name= (378, Name, 392, ... {Name="\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{871C5380-42A0-1069-A2EA-08002B30309D}\InProcServer32"}, 192, ) }, 192, ) == 0x0
 02871   428   NtOpenThreadTokenEx  (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN
 02872   428   NtOpenProcessTokenEx  (-1, 0x20008, 512, ... 380, ) == 0x0
 02873   428   NtQueryInformationToken  (380, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0
 02874   428   NtClose  (380, ... ) == 0x0
 02875   428   NtOpenKey  (0x2000000, {24, 0, 0x40, 0, 0,  (0x2000000, {24, 0, 0x40, 0, 0, "\REGISTRY\USER\S-1-5-21-1078081533-484763869-839522115-1003_Classes\CLSID\{871C5380-42A0-1069-A2EA-08002B30309D}\InProcServer32"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02876   428   NtQueryValueKey  (378, 0x0, Partial, 144, ... TitleIdx=0, Type=2, Data= (378, 0x0, Partial, 144, ... TitleIdx=0, Type=2, Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0s\0h\0d\0o\0c\0v\0w\0.\0d\0l\0l\0\0\0"}, 80, ) }, 80, ) == 0x0
 02877   428   NtQueryKey  (378, Name, 392, ... {Name= (378, Name, 392, ... {Name="\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{871C5380-42A0-1069-A2EA-08002B30309D}\InProcServer32"}, 192, ) }, 192, ) == 0x0
 02878   428   NtOpenThreadTokenEx  (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN
 02879   428   NtOpenProcessTokenEx  (-1, 0x20008, 512, ... 380, ) == 0x0
 02880   428   NtQueryInformationToken  (380, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0
 02881   428   NtClose  (380, ... ) == 0x0
 02882   428   NtOpenKey  (0x2000000, {24, 0, 0x40, 0, 0,  (0x2000000, {24, 0, 0x40, 0, 0, "\REGISTRY\USER\S-1-5-21-1078081533-484763869-839522115-1003_Classes\CLSID\{871C5380-42A0-1069-A2EA-08002B30309D}\InProcServer32"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02883   428   NtQueryValueKey  (378,  (378, "LoadWithoutCOM", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02884   428   NtClose  (378, ... ) == 0x0
 02885   428   NtReleaseSemaphore  (112, 1, ... 0, ) == 0x0
 02886   428   NtWaitForSingleObject  (112, 0, {0, 0}, ... ) == 0x0
 02887   428   NtOpenKey  (0x80000000, {24, 0, 0x40, 0, 0,  (0x80000000, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Classes\CLSID\{871c5380-42a0-1069-a2ea-08002b30309d}\InProcServer32"}, ... 376, ) }, ... 376, ) == 0x0
 02888   428   NtQueryValueKey  (376, " (376, "", Full, 520, ... TitleIdx=0, Type=2, Name="", Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0s\0h\0d\0o\0c\0v\0w\0.\0d\0l\0l\0\0\0"}, 88, )  (376, "", Full, 520, ... TitleIdx=0, Type=2, Name="", Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0s\0h\0d\0o\0c\0v\0w\0.\0d\0l\0l\0\0\0"}, 88, ) %\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0s\0h\0d\0o\0c\0v\0w\0.\0d\0l\0l\0\0\0"}, 88, ) == 0x0
 02889   428   NtClose  (376, ... ) == 0x0
 02890   428   NtOpenKey  (0x1, {24, 28, 0x40, 0, 0,  (0x1, {24, 28, 0x40, 0, 0, "SOFTWARE\Microsoft\Windows\CurrentVersion\ShellCompatibility\Objects\{871C5380-42A0-1069-A2EA-08002B30309D}"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02891   428   NtQueryKey  (122, Name, 384, ... {Name= (122, Name, 384, ... {Name="\REGISTRY\USER\S-1-5-21-1078081533-484763869-839522115-1003_CLASSESC"}, 138, ) }, 138, ) == 0x0
 02892   428   NtOpenKey  (0x1, {24, 122, 0x40, 0, 0,  (0x1, {24, 122, 0x40, 0, 0, "http"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02893   428   NtOpenKey  (0x1, {24, 0, 0x40, 0, 0,  (0x1, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Classes\http"}, ... 376, ) }, ... 376, ) == 0x0
 02894   428   NtQueryKey  (378, Name, 392, ... {Name= (378, Name, 392, ... {Name="\REGISTRY\MACHINE\SOFTWARE\Classes\httpo"}, 82, ) }, 82, ) == 0x0
 02895   428   NtOpenThreadTokenEx  (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN
 02896   428   NtOpenProcessTokenEx  (-1, 0x20008, 512, ... 380, ) == 0x0
 02897   428   NtQueryInformationToken  (380, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0
 02898   428   NtClose  (380, ... ) == 0x0
 02899   428   NtOpenKey  (0x2000000, {24, 0, 0x40, 0, 0,  (0x2000000, {24, 0, 0x40, 0, 0, "\REGISTRY\USER\S-1-5-21-1078081533-484763869-839522115-1003_Classes\http"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02900   428   NtQueryValueKey  (378,  (378, "ShellFolder", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02901   428   NtClose  (378, ... ) == 0x0
 02902   428   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers"}, ... 376, ) }, ... 376, ) == 0x0
 02903   428   NtQueryValueKey  (376,  (376, "TransparentEnabled", Full, 524, ... TitleIdx=0, Type=4, Name="TransparentEnabled", Data="\1\0\0\0"}, 60, ) , Full, 524, ... TitleIdx=0, Type=4, Name= (376, "TransparentEnabled", Full, 524, ... TitleIdx=0, Type=4, Name="TransparentEnabled", Data="\1\0\0\0"}, 60, ) , Data= (376, "TransparentEnabled", Full, 524, ... TitleIdx=0, Type=4, Name="TransparentEnabled", Data="\1\0\0\0"}, 60, ) }, 60, ) == 0x0
 02904   428   NtClose  (376, ... ) == 0x0
 02905   428   NtQueryInformationProcess  (-1, DefaultHardErrorMode, 4, ... {process info, class 12, size 4}, 0x0, ) == 0x0
 02906   428   NtSetInformationProcess  (-1, DefaultHardErrorMode, {process info, class 12, size 4}, 4, ... ) == 0x0
 02907   428   NtQueryAttributesFile  ({24, 12, 0x40, 0, 0,  ({24, 12, 0x40, 0, 0, "http:\www.whyusefirefox.com\"}, 1233000, ... ) }, 1233000, ... ) == STATUS_OBJECT_PATH_SYNTAX_BAD
 02908   428   NtQueryInformationProcess  (-1, DefaultHardErrorMode, 4, ... {process info, class 12, size 4}, 0x0, ) == 0x0
 02909   428   NtSetInformationProcess  (-1, DefaultHardErrorMode, {process info, class 12, size 4}, 4, ... ) == 0x0
 02910   428   NtQueryKey  (122, Name, 384, ... {Name= (122, Name, 384, ... {Name="\REGISTRY\USER\S-1-5-21-1078081533-484763869-839522115-1003_CLASSESi"}, 138, ) }, 138, ) == 0x0
 02911   428   NtOpenKey  (0x2000000, {24, 122, 0x40, 0, 0,  (0x2000000, {24, 122, 0x40, 0, 0, "http"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02912   428   NtOpenKey  (0x2000000, {24, 0, 0x40, 0, 0,  (0x2000000, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Classes\http"}, ... 376, ) }, ... 376, ) == 0x0
 02913   428   NtQueryKey  (378, Name, 384, ... {Name= (378, Name, 384, ... {Name="\REGISTRY\MACHINE\SOFTWARE\Classes\httpo"}, 82, ) }, 82, ) == 0x0
 02914   428   NtOpenThreadTokenEx  (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN
 02915   428   NtOpenProcessTokenEx  (-1, 0x20008, 512, ... 380, ) == 0x0
 02916   428   NtQueryInformationToken  (380, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0
 02917   428   NtClose  (380, ... ) == 0x0
 02918   428   NtOpenKey  (0x1, {24, 0, 0x40, 0, 0,  (0x1, {24, 0, 0x40, 0, 0, "\REGISTRY\USER\S-1-5-21-1078081533-484763869-839522115-1003_Classes\http\CurVer"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02919   428   NtOpenKey  (0x1, {24, 378, 0x40, 0, 0,  (0x1, {24, 378, 0x40, 0, 0, "CurVer"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02920   428   NtQueryKey  (378, Name, 384, ... {Name= (378, Name, 384, ... {Name="\REGISTRY\MACHINE\SOFTWARE\Classes\http5"}, 82, ) }, 82, ) == 0x0
 02921   428   NtOpenThreadTokenEx  (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN
 02922   428   NtOpenProcessTokenEx  (-1, 0x20008, 512, ... 380, ) == 0x0
 02923   428   NtQueryInformationToken  (380, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0
 02924   428   NtClose  (380, ... ) == 0x0
 02925   428   NtOpenKey  (0x2000000, {24, 0, 0x40, 0, 0,  (0x2000000, {24, 0, 0x40, 0, 0, "\REGISTRY\USER\S-1-5-21-1078081533-484763869-839522115-1003_Classes\http"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02926   428   NtOpenKey  (0x2000000, {24, 378, 0x40, 0, 0, ""}, ... 380, ) == 0x0
 02927   428   NtClose  (378, ... ) == 0x0
 02928   428   NtOpenKey  (0x2000000, {24, 60, 0x40, 0, 0,  (0x2000000, {24, 60, 0x40, 0, 0, "Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\RestrictRun"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02929   428   NtQueryKey  (382, Name, 384, ... {Name= (382, Name, 384, ... {Name="\REGISTRY\MACHINE\SOFTWARE\Classes\httpW"}, 82, ) }, 82, ) == 0x0
 02930   428   NtOpenThreadTokenEx  (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN
 02931   428   NtOpenProcessTokenEx  (-1, 0x20008, 512, ... 376, ) == 0x0
 02932   428   NtQueryInformationToken  (376, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0
 02933   428   NtClose  (376, ... ) == 0x0
 02934   428   NtOpenKey  (0x2000000, {24, 0, 0x40, 0, 0,  (0x2000000, {24, 0, 0x40, 0, 0, "\REGISTRY\USER\S-1-5-21-1078081533-484763869-839522115-1003_Classes\http\shell\open"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02935   428   NtOpenKey  (0x2000000, {24, 382, 0x40, 0, 0,  (0x2000000, {24, 382, 0x40, 0, 0, "shell\open"}, ... 376, ) }, ... 376, ) == 0x0
 02936   428   NtQueryKey  (378, Name, 384, ... {Name= (378, Name, 384, ... {Name="\REGISTRY\MACHINE\SOFTWARE\Classes\http\shell\open"}, 104, ) }, 104, ) == 0x0
 02937   428   NtOpenThreadTokenEx  (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN
 02938   428   NtOpenProcessTokenEx  (-1, 0x20008, 512, ... 384, ) == 0x0
 02939   428   NtQueryInformationToken  (384, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0
 02940   428   NtClose  (384, ... ) == 0x0
 02941   428   NtOpenKey  (0x1, {24, 0, 0x40, 0, 0,  (0x1, {24, 0, 0x40, 0, 0, "\REGISTRY\USER\S-1-5-21-1078081533-484763869-839522115-1003_Classes\http\shell\open\command"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02942   428   NtOpenKey  (0x1, {24, 378, 0x40, 0, 0,  (0x1, {24, 378, 0x40, 0, 0, "command"}, ... 384, ) }, ... 384, ) == 0x0
 02943   428   NtQueryKey  (386, Name, 392, ... {Name= (386, Name, 392, ... {Name="\REGISTRY\MACHINE\SOFTWARE\Classes\http\shell\open\command"}, 120, ) }, 120, ) == 0x0
 02944   428   NtOpenThreadTokenEx  (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN
 02945   428   NtOpenProcessTokenEx  (-1, 0x20008, 512, ... 388, ) == 0x0
 02946   428   NtQueryInformationToken  (388, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0
 02947   428   NtClose  (388, ... ) == 0x0
 02948   428   NtOpenKey  (0x2000000, {24, 0, 0x40, 0, 0,  (0x2000000, {24, 0, 0x40, 0, 0, "\REGISTRY\USER\S-1-5-21-1078081533-484763869-839522115-1003_Classes\http\shell\open\command"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02949   428   NtQueryValueKey  (386,  (386, "command", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02950   428   NtClose  (386, ... ) == 0x0
 02951   428   NtQueryKey  (378, Name, 384, ... {Name= (378, Name, 384, ... {Name="\REGISTRY\MACHINE\SOFTWARE\Classes\http\shell\open"}, 104, ) }, 104, ) == 0x0
 02952   428   NtOpenThreadTokenEx  (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN
 02953   428   NtOpenProcessTokenEx  (-1, 0x20008, 512, ... 384, ) == 0x0
 02954   428   NtQueryInformationToken  (384, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0
 02955   428   NtClose  (384, ... ) == 0x0
 02956   428   NtOpenKey  (0x1, {24, 0, 0x40, 0, 0,  (0x1, {24, 0, 0x40, 0, 0, "\REGISTRY\USER\S-1-5-21-1078081533-484763869-839522115-1003_Classes\http\shell\open\command"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02957   428   NtOpenKey  (0x1, {24, 378, 0x40, 0, 0,  (0x1, {24, 378, 0x40, 0, 0, "command"}, ... 384, ) }, ... 384, ) == 0x0
 02958   428   NtQueryKey  (386, Name, 392, ... {Name= (386, Name, 392, ... {Name="\REGISTRY\MACHINE\SOFTWARE\Classes\http\shell\open\command"}, 120, ) }, 120, ) == 0x0
 02959   428   NtOpenThreadTokenEx  (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN
 02960   428   NtOpenProcessTokenEx  (-1, 0x20008, 512, ... 388, ) == 0x0
 02961   428   NtQueryInformationToken  (388, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0
 02962   428   NtClose  (388, ... ) == 0x0
 02963   428   NtOpenKey  (0x2000000, {24, 0, 0x40, 0, 0,  (0x2000000, {24, 0, 0x40, 0, 0, "\REGISTRY\USER\S-1-5-21-1078081533-484763869-839522115-1003_Classes\http\shell\open\command"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02964   428   NtQueryValueKey  (386, 0x0, Partial, 144, ... TitleIdx=0, Type=1, Data=" (386, 0x0, Partial, 144, ... TitleIdx=0, Type=1, Data=""\0C\0:\0\\0P\0r\0o\0g\0r\0a\0m\0 \0F\0i\0l\0e\0s\0\\0I\0n\0t\0e\0r\0n\0e\0t\0 \0E\0x\0p\0l\0o\0r\0e\0r\0\\0i\0e\0x\0p\0l\0o\0r\0e\0.\0e\0x\0e\0"\0 \0-\0n\0o\0h\0o\0m\0e\0\0\0"}, 128, ) \0 \0-\0n\0o\0h\0o\0m\0e\0\0\0"}, 128, ) == 0x0
 02965   428   NtClose  (386, ... ) == 0x0
 02966   428   NtQueryKey  (378, Name, 384, ... {Name= (378, Name, 384, ... {Name="\REGISTRY\MACHINE\SOFTWARE\Classes\http\shell\open"}, 104, ) }, 104, ) == 0x0
 02967   428   NtOpenThreadTokenEx  (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN
 02968   428   NtOpenProcessTokenEx  (-1, 0x20008, 512, ... 384, ) == 0x0
 02969   428   NtQueryInformationToken  (384, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0
 02970   428   NtClose  (384, ... ) == 0x0
 02971   428   NtOpenKey  (0x1, {24, 0, 0x40, 0, 0,  (0x1, {24, 0, 0x40, 0, 0, "\REGISTRY\USER\S-1-5-21-1078081533-484763869-839522115-1003_Classes\http\shell\open\ddeexec"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02972   428   NtOpenKey  (0x1, {24, 378, 0x40, 0, 0,  (0x1, {24, 378, 0x40, 0, 0, "ddeexec"}, ... 384, ) }, ... 384, ) == 0x0
 02973   428   NtQueryKey  (386, Name, 392, ... {Name= (386, Name, 392, ... {Name="\REGISTRY\MACHINE\SOFTWARE\Classes\http\shell\open\ddeexec"}, 120, ) }, 120, ) == 0x0
 02974   428   NtOpenThreadTokenEx  (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN
 02975   428   NtOpenProcessTokenEx  (-1, 0x20008, 512, ... 388, ) == 0x0
 02976   428   NtQueryInformationToken  (388, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0
 02977   428   NtClose  (388, ... ) == 0x0
 02978   428   NtOpenKey  (0x2000000, {24, 0, 0x40, 0, 0,  (0x2000000, {24, 0, 0x40, 0, 0, "\REGISTRY\USER\S-1-5-21-1078081533-484763869-839522115-1003_Classes\http\shell\open\ddeexec"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02979   428   NtQueryValueKey  (386, 0x0, Partial, 144, ... TitleIdx=0, Type=1, Data=" (386, 0x0, Partial, 144, ... TitleIdx=0, Type=1, Data=""\0%\01\0"\0,\0,\0-\01\0,\00\0,\0,\0,\0,\0\0\0"}, 42, ) \0,\0,\0-\01\0,\00\0,\0,\0,\0,\0\0\0"}, 42, ) == 0x0
 02980   428   NtClose  (386, ... ) == 0x0
 02981   428   NtQueryKey  (378, Name, 384, ... {Name= (378, Name, 384, ... {Name="\REGISTRY\MACHINE\SOFTWARE\Classes\http\shell\open"}, 104, ) }, 104, ) == 0x0
 02982   428   NtOpenThreadTokenEx  (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN
 02983   428   NtOpenProcessTokenEx  (-1, 0x20008, 512, ... 384, ) == 0x0
 02984   428   NtQueryInformationToken  (384, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0
 02985   428   NtClose  (384, ... ) == 0x0
 02986   428   NtOpenKey  (0x1, {24, 0, 0x40, 0, 0,  (0x1, {24, 0, 0x40, 0, 0, "\REGISTRY\USER\S-1-5-21-1078081533-484763869-839522115-1003_Classes\http\shell\open\ddeexec"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02987   428   NtOpenKey  (0x1, {24, 378, 0x40, 0, 0,  (0x1, {24, 378, 0x40, 0, 0, "ddeexec"}, ... 384, ) }, ... 384, ) == 0x0
 02988   428   NtQueryKey  (386, Name, 392, ... {Name= (386, Name, 392, ... {Name="\REGISTRY\MACHINE\SOFTWARE\Classes\http\shell\open\ddeexec"}, 120, ) }, 120, ) == 0x0
 02989   428   NtOpenThreadTokenEx  (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN
 02990   428   NtOpenProcessTokenEx  (-1, 0x20008, 512, ... 388, ) == 0x0
 02991   428   NtQueryInformationToken  (388, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0
 02992   428   NtClose  (388, ... ) == 0x0
 02993   428   NtOpenKey  (0x2000000, {24, 0, 0x40, 0, 0,  (0x2000000, {24, 0, 0x40, 0, 0, "\REGISTRY\USER\S-1-5-21-1078081533-484763869-839522115-1003_Classes\http\shell\open\ddeexec"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02994   428   NtQueryValueKey  (386,  (386, "NoActivateHandler", Partial, 144, ... TitleIdx=0, Type=1, Data="\0\0"}, 14, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (386, "NoActivateHandler", Partial, 144, ... TitleIdx=0, Type=1, Data="\0\0"}, 14, ) }, 14, ) == 0x0
 02995   428   NtClose  (386, ... ) == 0x0
 02996   428   NtQueryKey  (378, Name, 384, ... {Name= (378, Name, 384, ... {Name="\REGISTRY\MACHINE\SOFTWARE\Classes\http\shell\open"}, 104, ) }, 104, ) == 0x0
 02997   428   NtOpenThreadTokenEx  (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN
 02998   428   NtOpenProcessTokenEx  (-1, 0x20008, 512, ... 384, ) == 0x0
 02999   428   NtQueryInformationToken  (384, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0
 03000   428   NtClose  (384, ... ) == 0x0
 03001   428   NtOpenKey  (0x1, {24, 0, 0x40, 0, 0,  (0x1, {24, 0, 0x40, 0, 0, "\REGISTRY\USER\S-1-5-21-1078081533-484763869-839522115-1003_Classes\http\shell\open\ddeexec\application"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 03002   428   NtOpenKey  (0x1, {24, 378, 0x40, 0, 0,  (0x1, {24, 378, 0x40, 0, 0, "ddeexec\application"}, ... 384, ) }, ... 384, ) == 0x0
 03003   428   NtQueryKey  (386, Name, 392, ... {Name= (386, Name, 392, ... {Name="\REGISTRY\MACHINE\SOFTWARE\Classes\http\shell\open\ddeexec\Application"}, 144, ) }, 144, ) == 0x0
 03004   428   NtOpenThreadTokenEx  (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN
 03005   428   NtOpenProcessTokenEx  (-1, 0x20008, 512, ... 388, ) == 0x0
 03006   428   NtQueryInformationToken  (388, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0
 03007   428   NtClose  (388, ... ) == 0x0
 03008   428   NtOpenKey  (0x2000000, {24, 0, 0x40, 0, 0,  (0x2000000, {24, 0, 0x40, 0, 0, "\REGISTRY\USER\S-1-5-21-1078081533-484763869-839522115-1003_Classes\http\shell\open\ddeexec\Application"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 03009   428   NtQueryValueKey  (386, 0x0, Partial, 144, ... TitleIdx=0, Type=1, Data= (386, 0x0, Partial, 144, ... TitleIdx=0, Type=1, Data="I\0E\0x\0p\0l\0o\0r\0e\0\0\0"}, 30, ) }, 30, ) == 0x0
 03010   428   NtClose  (386, ... ) == 0x0
 03011   428   NtAddAtom  ( ("I\0E\0x\0p\0l\0o\0r\0e\0", 16, 1234304, ... ) , 16, 1234304, ... ) == 0x0
 03012   428   NtQueryKey  (378, Name, 384, ... {Name= (378, Name, 384, ... {Name="\REGISTRY\MACHINE\SOFTWARE\Classes\http\shell\open"}, 104, ) }, 104, ) == 0x0
 03013   428   NtOpenThreadTokenEx  (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN
 03014   428   NtOpenProcessTokenEx  (-1, 0x20008, 512, ... 384, ) == 0x0
 03015   428   NtQueryInformationToken  (384, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0
 03016   428   NtClose  (384, ... ) == 0x0
 03017   428   NtOpenKey  (0x1, {24, 0, 0x40, 0, 0,  (0x1, {24, 0, 0x40, 0, 0, "\REGISTRY\USER\S-1-5-21-1078081533-484763869-839522115-1003_Classes\http\shell\open\ddeexec\topic"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 03018   428   NtOpenKey  (0x1, {24, 378, 0x40, 0, 0,  (0x1, {24, 378, 0x40, 0, 0, "ddeexec\topic"}, ... 384, ) }, ... 384, ) == 0x0
 03019   428   NtQueryKey  (386, Name, 392, ... {Name= (386, Name, 392, ... {Name="\REGISTRY\MACHINE\SOFTWARE\Classes\http\shell\open\ddeexec\Topic"}, 132, ) }, 132, ) == 0x0
 03020   428   NtOpenThreadTokenEx  (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN
 03021   428   NtOpenProcessTokenEx  (-1, 0x20008, 512, ... 388, ) == 0x0
 03022   428   NtQueryInformationToken  (388, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0
 03023   428   NtClose  (388, ... ) == 0x0
 03024   428   NtOpenKey  (0x2000000, {24, 0, 0x40, 0, 0,  (0x2000000, {24, 0, 0x40, 0, 0, "\REGISTRY\USER\S-1-5-21-1078081533-484763869-839522115-1003_Classes\http\shell\open\ddeexec\Topic"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 03025   428   NtQueryValueKey  (386, 0x0, Partial, 144, ... TitleIdx=0, Type=1, Data= (386, 0x0, Partial, 144, ... TitleIdx=0, Type=1, Data="W\0W\0W\0_\0O\0p\0e\0n\0U\0R\0L\0\0\0"}, 36, ) }, 36, ) == 0x0
 03026   428   NtClose  (386, ... ) == 0x0
 03027   428   NtAddAtom  ( ("W\0W\0W\0_\0O\0p\0e\0n\0U\0R\0L\0", 22, 1234304, ... ) , 22, 1234304, ... ) == 0x0
 03028   428   NtAllocateVirtualMemory  (-1, 1499136, 0, 36864, 4096, 4, ... 1499136, 36864, ) == 0x0
 03029   428   NtAllocateVirtualMemory  (-1, 0, 0, 524280, 8192, 4, ... 10813440, 524288, ) == 0x0
 03030   428   NtAllocateVirtualMemory  (-1, 10813440, 0, 4096, 4096, 4, ... 10813440, 4096, ) == 0x0
 03031   428   NtCreateEvent  (0x1f0003, 0x0, 1, 0, ... 384, ) == 0x0
 03032   428   NtUserFindExistingCursorIcon  (1233592, 1233608, 1234176, ... ) == 0x10011
 03033   428   NtQueryDefaultUILanguage  (1234144, ...
 03034   428   NtOpenThreadTokenEx  (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN
 03035   428   NtOpenProcessTokenEx  (-1, 0x20008, 512, ... -2147482204, ) == 0x0
 03036   428   NtQueryInformationToken  (-2147482204, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0
 03037   428   NtClose  (-2147482204, ... ) == 0x0
 03038   428   NtOpenKey  (0x2000000, {24, 0, 0x640, 0, 0,  (0x2000000, {24, 0, 0x640, 0, 0, "\REGISTRY\USER\S-1-5-21-1078081533-484763869-839522115-1003"}, ... -2147482204, ) }, ... -2147482204, ) == 0x0
 03039   428   NtOpenKey  (0x80000000, {24, 0, 0x240, 0, 0,  (0x80000000, {24, 0, 0x240, 0, 0, "\Registry\Machine\System\CurrentControlSet\Control\Nls\MUILanguages"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 03040   428   NtOpenKey  (0x80000000, {24, -2147482204, 0x640, 0, 0,  (0x80000000, {24, -2147482204, 0x640, 0, 0, "Control Panel\Desktop"}, ... -2147482208, ) }, ... -2147482208, ) == 0x0
 03041   428   NtQueryValueKey  (-2147482208,  (-2147482208, "MultiUILanguageId", Partial, 256, ... ) , Partial, 256, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 03042   428   NtClose  (-2147482208, ... ) == 0x0
 03043   428   NtClose  (-2147482204, ... ) == 0x0
 03033   428   NtQueryDefaultUILanguage  ... ) == 0x0
 03044   428   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\System\CurrentControlSet\Control\Nls\MUILanguages"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 03045   428   NtUserGetClassInfo  (1999437824, 1233600, 1233552, 1233628, 0, ... ) == 0x0
 03046   428   NtUserRegisterClassExWOW  (1232872, 1232952, 1232936, 1232968, 0, 384, 0, ... ) == 0x810ec091
 03047   428   NtUserCreateWindowEx  (0, 1234088, 1233900, 0x0, 0, 0, 0, 0, 0, 0, 0, 1999437824, 0, 1073742848, 0, ...
 03048   428   NtUserMessageCall  (0x200b4, WM_NCCREATE, 0x0, 0x12cf24, 0, 670, 0, ... ) == 0x1
 03049   428   NtUserMessageCall  (0x200b4, WM_NCCALCSIZE, 0x0, 0x12cf4c, 0, 670, 0, ... ) == 0x0
 03047   428   NtUserCreateWindowEx  ... ) == 0x200b4
 03050   428   NtUserSetWindowLong  (131252, 0, 0, 1, ... ) == 0x0
 03051   428   NtUserSetWindowLong  (131252, -4, 2000888781, 0, ... ) == 0x77d45a4d
 03052   428   NtQuerySystemInformation  (Performance, 312, ... {system info, class 2, size 312}, 0x0, ) == 0x0
 03053   428   NtQueryInformationProcess  (-1, QuotaLimits, 32, ... {process info, class 1, size 32}, 0x0, ) == 0x0
 03054   428   NtQueryInformationProcess  (-1, VmCounters, 44, ... {process info, class 3, size 44}, 0x0, ) == 0x0
 03055   428   NtUserMessageCall  (0x10014, 0x3e0, 0x200b4, 0xc01cc01d, 1234220, 689, 0, ...
 03056   428   NtFindAtom  ( ("d\0d\0e\0c\0o\0n\0v\0", 14, 1233772, ... ) , 14, 1233772, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 03055   428   NtUserMessageCall  ... ) == 0x0
 03057   428   NtFindAtom  ( ("d\0d\0e\0c\0o\0n\0v\0", 14, 1234240, ... ) , 14, 1234240, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 03058   428   NtUserDestroyWindow  (131252, ...
 03059   428   NtFindAtom  ( ("d\0d\0e\0c\0o\0n\0v\0", 14, 1233916, ... ) , 14, 1233916, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 03060   428   NtUserKillTimer  (131252, 21845, ... ) == 0x0
 03061   428   NtFindAtom  ( ("d\0d\0e\0e\0v\0e\0n\0t\0", 16, 1233904, ... ) , 16, 1233904, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 03062   428   NtFindAtom  ( ("d\0d\0e\0c\0o\0n\0v\0", 14, 1233908, ... ) , 14, 1233908, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 03063   428   NtUserRemoveProp  (131252, 43282, ... ) == 0x0
 03064   428   NtUserRemoveProp  (131252, 43287, ... ) == 0x0
 03058   428   NtUserDestroyWindow  ... ) == 0x1
 03065   428   NtClose  (384, ... ) == 0x0
 03066   428   NtQueryKey  (378, Name, 384, ... {Name= (378, Name, 384, ... {Name="\REGISTRY\MACHINE\SOFTWARE\Classes\http\shell\open"}, 104, ) }, 104, ) == 0x0
 03067   428   NtOpenThreadTokenEx  (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN
 03068   428   NtOpenProcessTokenEx  (-1, 0x20008, 512, ... 384, ) == 0x0
 03069   428   NtQueryInformationToken  (384, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0
 03070   428   NtClose  (384, ... ) == 0x0
 03071   428   NtOpenKey  (0x1, {24, 0, 0x40, 0, 0,  (0x1, {24, 0, 0x40, 0, 0, "\REGISTRY\USER\S-1-5-21-1078081533-484763869-839522115-1003_Classes\http\shell\open\ddeexec\ifexec"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 03072   428   NtOpenKey  (0x1, {24, 378, 0x40, 0, 0,  (0x1, {24, 378, 0x40, 0, 0, "ddeexec\ifexec"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 03073   428   NtUserGetForegroundWindow  (... ) == 0x20064
 03074   428   NtQueryKey  (378, Name, 384, ... {Name= (378, Name, 384, ... {Name="\REGISTRY\MACHINE\SOFTWARE\Classes\http\shell\open"}, 104, ) }, 104, ) == 0x0
 03075   428   NtOpenThreadTokenEx  (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN
 03076   428   NtOpenProcessTokenEx  (-1, 0x20008, 512, ... 384, ) == 0x0
 03077   428   NtQueryInformationToken  (384, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0
 03078   428   NtClose  (384, ... ) == 0x0
 03079   428   NtOpenKey  (0x1, {24, 0, 0x40, 0, 0,  (0x1, {24, 0, 0x40, 0, 0, "\REGISTRY\USER\S-1-5-21-1078081533-484763869-839522115-1003_Classes\http\shell\open\command"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 03080   428   NtOpenKey  (0x1, {24, 378, 0x40, 0, 0,  (0x1, {24, 378, 0x40, 0, 0, "command"}, ... 384, ) }, ... 384, ) == 0x0
 03081   428   NtQueryKey  (386, Name, 392, ... {Name= (386, Name, 392, ... {Name="\REGISTRY\MACHINE\SOFTWARE\Classes\http\shell\open\command"}, 120, ) }, 120, ) == 0x0
 03082   428   NtOpenThreadTokenEx  (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN
 03083   428   NtOpenProcessTokenEx  (-1, 0x20008, 512, ... 388, ) == 0x0
 03084   428   NtQueryInformationToken  (388, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0
 03085   428   NtClose  (388, ... ) == 0x0
 03086   428   NtOpenKey  (0x2000000, {24, 0, 0x40, 0, 0,  (0x2000000, {24, 0, 0x40, 0, 0, "\REGISTRY\USER\S-1-5-21-1078081533-484763869-839522115-1003_Classes\http\shell\open\command"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 03087   428   NtQueryValueKey  (386, 0x0, Partial, 144, ... TitleIdx=0, Type=1, Data=" (386, 0x0, Partial, 144, ... TitleIdx=0, Type=1, Data=""\0C\0:\0\\0P\0r\0o\0g\0r\0a\0m\0 \0F\0i\0l\0e\0s\0\\0I\0n\0t\0e\0r\0n\0e\0t\0 \0E\0x\0p\0l\0o\0r\0e\0r\0\\0i\0e\0x\0p\0l\0o\0r\0e\0.\0e\0x\0e\0"\0 \0-\0n\0o\0h\0o\0m\0e\0\0\0"}, 128, ) \0 \0-\0n\0o\0h\0o\0m\0e\0\0\0"}, 128, ) == 0x0
 03088   428   NtClose  (386, ... ) == 0x0
 03089   428   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\Program Files\Internet Explorer\iexplore.exe"}, 1232940, ... ) }, 1232940, ... ) == 0x0
 03090   428   NtReleaseSemaphore  (112, 1, ... 0, ) == 0x0
 03091   428   NtWaitForSingleObject  (112, 0, {0, 0}, ... ) == 0x0
 03092   428   NtOpenKey  (0x1, {24, 28, 0x40, 0, 0,  (0x1, {24, 28, 0x40, 0, 0, "Software\Microsoft\Windows\CurrentVersion\Policies\Explorer"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 03093   428   NtOpenKey  (0x1, {24, 60, 0x40, 0, 0,  (0x1, {24, 60, 0x40, 0, 0, "Software\Microsoft\Windows\CurrentVersion\Policies\Explorer"}, ... 384, ) }, ... 384, ) == 0x0
 03094   428   NtQueryValueKey  (384,  (384, "RestrictRun", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 03095   428   NtClose  (384, ... ) == 0x0
 03096   428   NtReleaseSemaphore  (112, 1, ... 0, ) == 0x0
 03097   428   NtWaitForSingleObject  (112, 0, {0, 0}, ... ) == 0x0
 03098   428   NtOpenKey  (0x1, {24, 28, 0x40, 0, 0,  (0x1, {24, 28, 0x40, 0, 0, "Software\Microsoft\Windows\CurrentVersion\Policies\Explorer"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 03099   428   NtOpenKey  (0x1, {24, 60, 0x40, 0, 0,  (0x1, {24, 60, 0x40, 0, 0, "Software\Microsoft\Windows\CurrentVersion\Policies\Explorer"}, ... 384, ) }, ... 384, ) == 0x0
 03100   428   NtQueryValueKey  (384,  (384, "DisallowRun", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 03101   428   NtClose  (384, ... ) == 0x0
 03102   428   NtOpenKey  (0x2000000, {24, 28, 0x40, 0, 0,  (0x2000000, {24, 28, 0x40, 0, 0, "System\CurrentControlSet\Control\Session Manager\AppCompatibility\iexplore.exe"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 03103   428   NtCreateFile  (0x80100180, {24, 0, 0x40, 0, 1233460,  (0x80100180, {24, 0, 0x40, 0, 1233460, "\??\C:\Program Files\Internet Explorer\iexplore.exe"}, 0x0, 0, 3, 1, 96, 0, 0, ... 384, {status=0x0, info=1}, ) }, 0x0, 0, 3, 1, 96, 0, 0, ... 384, {status=0x0, info=1}, ) == 0x0
 03104   428   NtQueryInformationFile  (384, 1233476, 40, Basic, ... {status=0x0, info=40}, ) == 0x0
 03105   428   NtSetInformationFile  (384, 1233476, 40, Basic, ... {status=0x0, info=0}, ) == 0x0
 03106   428   NtReadFile  (384, 0, 0, 0, 64, 0x0, 0, ... {status=0x0, info=64},  (384, 0, 0, 0, 64, 0x0, 0, ... {status=0x0, info=64}, "MZ\220\0\3\0\0\0\4\0\0\0\377\377\0\0\270\0\0\0\0\0\0\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\360\0\0\0", ) , ) == 0x0
 03107   428   NtSetInformationFile  (384, 1233516, 8, Position, ... {status=0x0, info=0}, ) == 0x0
 03108   428   NtReadFile  (384, 0, 0, 0, 64, 0x0, 0, ... {status=0x0, info=64},  (384, 0, 0, 0, 64, 0x0, 0, ... {status=0x0, info=64}, "PE\0\0L\1\3\0L\203};\0\0\0\0\0\0\0\0\340\0\17\1\13\1\7\0\0\26\0\0\0J\1\0\0\0\0\0\346\36\0\0\0\20\0\0\00\0\0\0\0@\0\0\20\0\0\0\2\0\0", ) , ) == 0x0
 03109   428   NtSetInformationFile  (384, 1233516, 8, Position, ... {status=0x0, info=0}, ) == 0x0
 03110   428   NtReadFile  (384, 0, 0, 0, 4, 0x0, 0, ... {status=0x0, info=4},  (384, 0, 0, 0, 4, 0x0, 0, ... {status=0x0, info=4}, "\4\0\0\0", ) , ) == 0x0
 03111   428   NtSetInformationFile  (384, 1233516, 8, Position, ... {status=0x0, info=0}, ) == 0x0
 03112   428   NtReadFile  (384, 0, 0, 0, 4, 0x0, 0, ... {status=0x0, info=4},  (384, 0, 0, 0, 4, 0x0, 0, ... {status=0x0, info=4}, "\2\0\0\200", ) , ) == 0x0
 03113   428   NtClose  (384, ... ) == 0x0
 03114   428   NtOpenKey  (0x2000000, {24, 28, 0x40, 0, 0,  (0x2000000, {24, 28, 0x40, 0, 0, "System\CurrentControlSet\Control\Session Manager\CheckBadApps400"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 03115   428   NtOpenKey  (0x1, {24, 28, 0x40, 0, 0,  (0x1, {24, 28, 0x40, 0, 0, "Software\Microsoft\Windows\CurrentVersion\App Paths\iexplore.exe"}, ... 384, ) }, ... 384, ) == 0x0
 03116   428   NtQueryValueKey  (384,  (384, "PATH", Partial, 144, ... TitleIdx=0, Type=1, Data="C\0:\0\\0P\0r\0o\0g\0r\0a\0m\0 \0F\0i\0l\0e\0s\0\\0I\0n\0t\0e\0r\0n\0e\0t\0 \0E\0x\0p\0l\0o\0r\0e\0r\0;\0\0\0"}, 84, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (384, "PATH", Partial, 144, ... TitleIdx=0, Type=1, Data="C\0:\0\\0P\0r\0o\0g\0r\0a\0m\0 \0F\0i\0l\0e\0s\0\\0I\0n\0t\0e\0r\0n\0e\0t\0 \0E\0x\0p\0l\0o\0r\0e\0r\0;\0\0\0"}, 84, ) }, 84, ) == 0x0
 03117   428   NtClose  (384, ... ) == 0x0
 03118   428   NtReleaseSemaphore  (112, 1, ... 0, ) == 0x0
 03119   428   NtWaitForSingleObject  (112, 0, {0, 0}, ... ) == 0x0
 03120   428   NtOpenKey  (0x1, {24, 28, 0x40, 0, 0,  (0x1, {24, 28, 0x40, 0, 0, "Software\Microsoft\Windows\CurrentVersion\Policies\Explorer"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 03121   428   NtOpenKey  (0x1, {24, 60, 0x40, 0, 0,  (0x1, {24, 60, 0x40, 0, 0, "Software\Microsoft\Windows\CurrentVersion\Policies\Explorer"}, ... 384, ) }, ... 384, ) == 0x0
 03122   428   NtQueryValueKey  (384,  (384, "NoRunasInstallPrompt", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 03123   428   NtClose  (384, ... ) == 0x0
 03124   428   NtOpenKey  (0x1, {24, 28, 0x40, 0, 0,  (0x1, {24, 28, 0x40, 0, 0, "Software\Microsoft\Windows\CurrentVersion\App Paths\iexplore.exe"}, ... 384, ) }, ... 384, ) == 0x0
 03125   428   NtQueryValueKey  (384,  (384, "RunAsOnNonAdminInstall", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 03126   428   NtClose  (384, ... ) == 0x0
 03127   428   NtQueryInformationJobObject  (0, BasicUIRestrictions, 4, ... ) == STATUS_ACCESS_DENIED
 03128   428   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\Program Files\Internet Explorer\iexplore.exe"}, 1228300, ... ) }, 1228300, ... ) == 0x0
 03129   428   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\Program Files\Internet Explorer\iexplore.exe"}, 1228992, ... ) }, 1228992, ... ) == 0x0
 03130   428   NtOpenFile  (0x1000a1, {24, 0, 0x40, 0, 0,  (0x1000a1, {24, 0, 0x40, 0, 0, "\??\C:\Program Files\Internet Explorer\iexplore.exe"}, 5, 96, ... 384, {status=0x0, info=1}, ) }, 5, 96, ... 384, {status=0x0, info=1}, ) == 0x0
 03131   428   NtCreateSection  (0xf001f, 0x0, 0x0, 16, 16777216, 384, ... 388, ) == 0x0
 03132   428   NtOpenKey  (0x1, {24, 0, 0x40, 0, 0,  (0x1, {24, 0, 0x40, 0, 0, "\Registry\MACHINE\System\CurrentControlSet\Control\Session Manager\AppCertDlls"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 03133   428   NtOpenKey  (0x1, {24, 0, 0x40, 0, 0,  (0x1, {24, 0, 0x40, 0, 0, "\Registry\MACHINE\System\CurrentControlSet\Control\Session Manager\AppCompatibility"}, ... 392, ) }, ... 392, ) == 0x0
 03134   428   NtQueryValueKey  (392,  (392, "DisableAppCompat", Partial, 20, ... ) , Partial, 20, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 03135   428   NtClose  (392, ... ) == 0x0
 03136   428   NtQueryVolumeInformationFile  (384, 1228300, 8, Device, ... {status=0x0, info=8}, ) == 0x0
 03137   428   NtWaitForSingleObject  (124, 0, {-1000000, -1}, ... ) == 0x0
 03138   428   NtReleaseMutant  (124, ... 0x0, ) == 0x0
 03139   428   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\Apphelp.dll"}, 1226284, ... ) }, 1226284, ... ) == 0x0
 03140   428   NtCreateFile  (0x80100080, {24, 0, 0x40, 0, 0,  (0x80100080, {24, 0, 0x40, 0, 0, "\SystemRoot\AppPatch\sysmain.sdb"}, 0x0, 128, 1, 1, 96, 0, 0, ... 392, {status=0x0, info=1}, ) }, 0x0, 128, 1, 1, 96, 0, 0, ... 392, {status=0x0, info=1}, ) == 0x0
 03141   428   NtQueryInformationFile  (392, 1226888, 24, Standard, ... {status=0x0, info=24}, ) == 0x0
 03142   428   NtCreateSection  (0x4, 0x0, 0x0, 2, 134217728, 392, ... 396, ) == 0x0
 03143   428   NtMapViewOfSection  (396, -1, (0x0), 0, 0, 0x0, 0, 2, 0, 2, ... (0xad0000), 0x0, 1028096, ) == 0x0
 03144   428   NtQueryInformationFile  (392, 1226984, 24, Standard, ... {status=0x0, info=24}, ) == 0x0
 03145   428   NtCreateFile  (0x80100080, {24, 0, 0x40, 0, 0,  (0x80100080, {24, 0, 0x40, 0, 0, "\SystemRoot\AppPatch\systest.sdb"}, 0x0, 128, 1, 1, 96, 0, 0, ... ) }, 0x0, 128, 1, 1, 96, 0, 0, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 03146   428   NtOpenFile  (0x100001, {24, 0, 0x40, 0, 0,  (0x100001, {24, 0, 0x40, 0, 0, "\??\C:\Program Files\Internet Explorer\"}, 3, 16417, ... 400, {status=0x0, info=1}, ) }, 3, 16417, ... 400, {status=0x0, info=1}, ) == 0x0
 03147   428   NtQueryDirectoryFile  (400, 0, 0, 0, 1224548, 616, BothDirectory, 1,  (400, 0, 0, 0, 1224548, 616, BothDirectory, 1, "iexplore.exe", 0, ... {status=0x0, info=118}, ) , 0, ... {status=0x0, info=118}, ) == 0x0
 03148   428   NtClose  (400, ... ) == 0x0
 03149   428   NtQueryInformationProcess  (-1, DefaultHardErrorMode, 4, ... {process info, class 12, size 4}, 0x0, ) == 0x0
 03150   428   NtSetInformationProcess  (-1, DefaultHardErrorMode, {process info, class 12, size 4}, 4, ... ) == 0x0
 03151   428   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\Program Files\Internet Explorer\iexplore.exe"}, 1223936, ... ) }, 1223936, ... ) == 0x0
 03152   428   NtOpenFile  (0x100001, {24, 0, 0x40, 0, 0,  (0x100001, {24, 0, 0x40, 0, 0, "\??\C:\Program Files\Internet Explorer\"}, 3, 16417, ... 400, {status=0x0, info=1}, ) }, 3, 16417, ... 400, {status=0x0, info=1}, ) == 0x0
 03153   428   NtQueryDirectoryFile  (400, 0, 0, 0, 1223296, 616, BothDirectory, 1,  (400, 0, 0, 0, 1223296, 616, BothDirectory, 1, "iexplore.exe", 0, ... {status=0x0, info=118}, ) , 0, ... {status=0x0, info=118}, ) == 0x0
 03154   428   NtClose  (400, ... ) == 0x0
 03155   428   NtQueryInformationProcess  (-1, DefaultHardErrorMode, 4, ... {process info, class 12, size 4}, 0x0, ) == 0x0
 03156   428   NtSetInformationProcess  (-1, DefaultHardErrorMode, {process info, class 12, size 4}, 4, ... ) == 0x0
 03157   428   NtQueryInformationProcess  (-1, DeviceMap, 36, ... {process info, class 23, size 36}, 0x0, ) == 0x0
 03158   428   NtOpenThreadTokenEx  (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN
 03159   428   NtOpenProcessTokenEx  (-1, 0x20008, 512, ... 400, ) == 0x0
 03160   428   NtQueryInformationToken  (400, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0
 03161   428   NtClose  (400, ... ) == 0x0
 03162   428   NtOpenKey  (0x80000100, {24, 0, 0x40, 0, 0,  (0x80000100, {24, 0, 0x40, 0, 0, "\REGISTRY\USER\S-1-5-21-1078081533-484763869-839522115-1003\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Layers"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 03163   428   NtOpenKey  (0x80000100, {24, 0, 0x40, 0, 0,  (0x80000100, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Custom\IEXPLORE.EXE"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 03164   428   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\Program Files\Internet Explorer\IEXPLORE.EXE"}, 1225808, ... ) }, 1225808, ... ) == 0x0
 03165   428   NtQueryInformationProcess  (-1, DefaultHardErrorMode, 4, ... {process info, class 12, size 4}, 0x0, ) == 0x0
 03166   428   NtSetInformationProcess  (-1, DefaultHardErrorMode, {process info, class 12, size 4}, 4, ... ) == 0x0
 03167   428   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\Program Files\Internet Explorer\IEXPLORE.EXE"}, 1224724, ... ) }, 1224724, ... ) == 0x0
 03168   428   NtOpenFile  (0x100020, {24, 0, 0x40, 0, 0,  (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\Program Files\Internet Explorer\IEXPLORE.EXE"}, 5, 96, ... 400, {status=0x0, info=1}, ) }, 5, 96, ... 400, {status=0x0, info=1}, ) == 0x0
 03169   428   NtCreateSection  (0xe, 0x0, 0x0, 16, 134217728, 400, ... 404, ) == 0x0
 03170   428   NtClose  (400, ... ) == 0x0
 03171   428   NtMapViewOfSection  (404, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 16, ... (0x960000), 0x0, 94208, ) == 0x0
 03172   428   NtClose  (404, ... ) == 0x0
 03173   428   NtUnmapViewOfSection  (-1, 0x960000, ... ) == 0x0
 03174   428   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\Program Files\Internet Explorer\IEXPLORE.EXE"}, 1224364, ... ) }, 1224364, ... ) == 0x0
 03175   428   NtCreateFile  (0x80100080, {24, 0, 0x40, 0, 1225064,  (0x80100080, {24, 0, 0x40, 0, 1225064, "\??\C:\Program Files\Internet Explorer\IEXPLORE.EXE"}, 0x0, 0, 5, 1, 96, 0, 0, ... 404, {status=0x0, info=1}, ) }, 0x0, 0, 5, 1, 96, 0, 0, ... 404, {status=0x0, info=1}, ) == 0x0
 03176   428   NtCreateSection  (0xf0005, 0x0, 0x0, 2, 134217728, 404, ... 400, ) == 0x0
 03177   428   NtClose  (404, ... ) == 0x0
 03178   428   NtMapViewOfSection  (400, -1, (0x0), 0, 0, {0, 0}, 0, 1, 0, 2, ... (0x960000), {0, 0}, 94208, ) == 0x0
 03179   428   NtClose  (400, ... ) == 0x0
 03180   428   NtQueryInformationProcess  (-1, DefaultHardErrorMode, 4, ... {process info, class 12, size 4}, 0x0, ) == 0x0
 03181   428   NtSetInformationProcess  (-1, DefaultHardErrorMode, {process info, class 12, size 4}, 4, ... ) == 0x0
 03182   428   NtQueryDefaultLocale  (1, 1225588, ... ) == 0x0
 03183   428   NtQueryVirtualMemory  (-1, 0x960000, Basic, 28, ... {BaseAddress=0x960000,AllocationBase=0x960000,AllocationProtect=0x2,RegionSize=0x17000,State=0x1000,Protect=0x2,Type=0x40000,}, 0x0, ) == 0x0
 03184   428   NtQueryVirtualMemory  (-1, 0x960000, Basic, 28, ... {BaseAddress=0x960000,AllocationBase=0x960000,AllocationProtect=0x2,RegionSize=0x17000,State=0x1000,Protect=0x2,Type=0x40000,}, 0x0, ) == 0x0
 03185   428   NtUnmapViewOfSection  (-1, 0x960000, ... ) == 0x0
 03186   428   NtQueryInformationProcess  (-1, DefaultHardErrorMode, 4, ... {process info, class 12, size 4}, 0x0, ) == 0x0
 03187   428   NtSetInformationProcess  (-1, DefaultHardErrorMode, {process info, class 12, size 4}, 4, ... ) == 0x0
 03188   428   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\Program Files\Internet Explorer\IEXPLORE.EXE"}, 1224716, ... ) }, 1224716, ... ) == 0x0
 03189   428   NtOpenFile  (0x100020, {24, 0, 0x40, 0, 0,  (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\Program Files\Internet Explorer\IEXPLORE.EXE"}, 5, 96, ... 400, {status=0x0, info=1}, ) }, 5, 96, ... 400, {status=0x0, info=1}, ) == 0x0
 03190   428   NtCreateSection  (0xe, 0x0, 0x0, 16, 134217728, 400, ... 404, ) == 0x0
 03191   428   NtClose  (400, ... ) == 0x0
 03192   428   NtMapViewOfSection  (404, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 16, ... (0x960000), 0x0, 94208, ) == 0x0
 03193   428   NtClose  (404, ... ) == 0x0
 03194   428   NtUnmapViewOfSection  (-1, 0x960000, ... ) == 0x0
 03195   428   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\Program Files\Internet Explorer\IEXPLORE.EXE"}, 1224356, ... ) }, 1224356, ... ) == 0x0
 03196   428   NtCreateFile  (0x80100080, {24, 0, 0x40, 0, 1225056,  (0x80100080, {24, 0, 0x40, 0, 1225056, "\??\C:\Program Files\Internet Explorer\IEXPLORE.EXE"}, 0x0, 0, 5, 1, 96, 0, 0, ... 404, {status=0x0, info=1}, ) }, 0x0, 0, 5, 1, 96, 0, 0, ... 404, {status=0x0, info=1}, ) == 0x0
 03197   428   NtCreateSection  (0xf0005, 0x0, 0x0, 2, 134217728, 404, ... 400, ) == 0x0
 03198   428   NtClose  (404, ... ) == 0x0
 03199   428   NtMapViewOfSection  (400, -1, (0x0), 0, 0, {0, 0}, 0, 1, 0, 2, ... (0x960000), {0, 0}, 94208, ) == 0x0
 03200   428   NtClose  (400, ... ) == 0x0
 03201   428   NtQueryInformationProcess  (-1, DefaultHardErrorMode, 4, ... {process info, class 12, size 4}, 0x0, ) == 0x0
 03202   428   NtSetInformationProcess  (-1, DefaultHardErrorMode, {process info, class 12, size 4}, 4, ... ) == 0x0
 03203   428   NtQueryDefaultLocale  (1, 1225580, ... ) == 0x0
 03204   428   NtQueryVirtualMemory  (-1, 0x960000, Basic, 28, ... {BaseAddress=0x960000,AllocationBase=0x960000,AllocationProtect=0x2,RegionSize=0x17000,State=0x1000,Protect=0x2,Type=0x40000,}, 0x0, ) == 0x0
 03205   428   NtUnmapViewOfSection  (-1, 0x960000, ... ) == 0x0
 03206   428   NtOpenKey  (0x80000100, {24, 0, 0x40, 0, 0,  (0x80000100, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 03207   428   NtOpenThreadTokenEx  (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN
 03208   428   NtOpenProcessTokenEx  (-1, 0x20008, 512, ... 400, ) == 0x0
 03209   428   NtQueryInformationToken  (400, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0
 03210   428   NtClose  (400, ... ) == 0x0
 03211   428   NtOpenKey  (0x80000100, {24, 0, 0x40, 0, 0,  (0x80000100, {24, 0, 0x40, 0, 0, "\REGISTRY\USER\S-1-5-21-1078081533-484763869-839522115-1003\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 03212   428   NtQueryInformationProcess  (-1, DefaultHardErrorMode, 4, ... {process info, class 12, size 4}, 0x0, ) == 0x0
 03213   428   NtSetInformationProcess  (-1, DefaultHardErrorMode, {process info, class 12, size 4}, 4, ... ) == 0x0
 03214   428   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\Program Files\Internet Explorer\iexplore.exe"}, 1226216, ... ) }, 1226216, ... ) == 0x0
 03215   428   NtOpenFile  (0x100001, {24, 0, 0x40, 0, 0,  (0x100001, {24, 0, 0x40, 0, 0, "\??\C:\Program Files\Internet Explorer\"}, 3, 16417, ... 400, {status=0x0, info=1}, ) }, 3, 16417, ... 400, {status=0x0, info=1}, ) == 0x0
 03216   428   NtQueryDirectoryFile  (400, 0, 0, 0, 1225576, 616, BothDirectory, 1,  (400, 0, 0, 0, 1225576, 616, BothDirectory, 1, "iexplore.exe", 0, ... {status=0x0, info=118}, ) , 0, ... {status=0x0, info=118}, ) == 0x0
 03217   428   NtClose  (400, ... ) == 0x0
 03218   428   NtQueryInformationProcess  (-1, DefaultHardErrorMode, 4, ... {process info, class 12, size 4}, 0x0, ) == 0x0
 03219   428   NtSetInformationProcess  (-1, DefaultHardErrorMode, {process info, class 12, size 4}, 4, ... ) == 0x0
 03220   428   NtWaitForSingleObject  (124, 0, {-1000000, -1}, ... ) == 0x0
 03221   428   NtReleaseMutant  (124, ... 0x0, ) == 0x0
 03222   428   NtUnmapViewOfSection  (-1, 0xad0000, ... ) == 0x0
 03223   428   NtClose  (396, ... ) == 0x0
 03224   428   NtClose  (392, ... ) == 0x0
 03225   428   NtQuerySection  (388, Image, 48, ... {section info, class 1, size 48}, 0x0, ) == 0x0
 03226   428   NtOpenKey  (0x80000000, {24, 0, 0x40, 0, 0,  (0x80000000, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\iexplore.exe"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 03227   428   NtOpenThreadToken  (-2, 0x2000000, 1, ... ) == STATUS_NO_TOKEN
 03228   428   NtOpenProcessToken  (-1, 0xa, ... 392, ) == 0x0
 03229   428   NtQueryInformationToken  (392, User, 136, ... {token info, class 1, size 36}, 36, ) == 0x0
 03230   428   NtOpenKey  (0x3, {24, 0, 0x40, 0, 0,  (0x3, {24, 0, 0x40, 0, 0, "\Registry\MACHINE\System\CurrentControlSet\Control\SafeBoot\Option"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 03231   428   NtOpenKey  (0x1, {24, 0, 0x40, 0, 0,  (0x1, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers"}, ... 396, ) }, ... 396, ) == 0x0
 03232   428   NtQueryValueKey  (396,  (396, "TransparentEnabled", Partial, 80, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) , Partial, 80, ... TitleIdx=0, Type=4, Data= (396, "TransparentEnabled", Partial, 80, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) }, 16, ) == 0x0
 03233   428   NtQueryValueKey  (396,  (396, "AuthenticodeEnabled", Partial, 80, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) , Partial, 80, ... TitleIdx=0, Type=4, Data= (396, "AuthenticodeEnabled", Partial, 80, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) }, 16, ) == 0x0
 03234   428   NtClose  (396, ... ) == 0x0
 03235   428   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers"}, ... 396, ) }, ... 396, ) == 0x0
 03236   428   NtQueryValueKey  (396,  (396, "ExecutableTypes", Partial, 0, ... ) , Partial, 0, ... ) == STATUS_BUFFER_TOO_SMALL
 03237   428   NtQueryValueKey  (396,  (396, "ExecutableTypes", Partial, 260, ... TitleIdx=0, Type=7, Data="A\0D\0E\0\0\0A\0D\0P\0\0\0B\0A\0S\0\0\0B\0A\0T\0\0\0C\0H\0M\0\0\0C\0M\0D\0\0\0C\0O\0M\0\0\0C\0P\0L\0\0\0C\0R\0T\0\0\0E\0X\0E\0\0\0H\0L\0P\0\0\0H\0T\0A\0\0\0I\0N\0F\0\0\0I\0N\0S\0\0\0I\0S\0P\0\0\0L\0N\0K\0\0\0M\0D\0B\0\0\0M\0D\0E\0\0\0M\0S\0C\0\0\0M\0S\0I\0\0\0M\0S\0P\0\0\0M\0S\0T\0\0\0O\0C\0X\0\0\0P\0C\0D\0\0\0P\0I\0F\0\0\0R\0E\0G\0\0\0S\0C\0R\0\0\0S\0H\0S\0\0\0U\0R\0L\0\0\0V\0B\0\0\0W\0S\0C\0\0\0\0\0"}, 260, ) , Partial, 260, ... TitleIdx=0, Type=7, Data= (396, "ExecutableTypes", Partial, 260, ... TitleIdx=0, Type=7, Data="A\0D\0E\0\0\0A\0D\0P\0\0\0B\0A\0S\0\0\0B\0A\0T\0\0\0C\0H\0M\0\0\0C\0M\0D\0\0\0C\0O\0M\0\0\0C\0P\0L\0\0\0C\0R\0T\0\0\0E\0X\0E\0\0\0H\0L\0P\0\0\0H\0T\0A\0\0\0I\0N\0F\0\0\0I\0N\0S\0\0\0I\0S\0P\0\0\0L\0N\0K\0\0\0M\0D\0B\0\0\0M\0D\0E\0\0\0M\0S\0C\0\0\0M\0S\0I\0\0\0M\0S\0P\0\0\0M\0S\0T\0\0\0O\0C\0X\0\0\0P\0C\0D\0\0\0P\0I\0F\0\0\0R\0E\0G\0\0\0S\0C\0R\0\0\0S\0H\0S\0\0\0U\0R\0L\0\0\0V\0B\0\0\0W\0S\0C\0\0\0\0\0"}, 260, ) }, 260, ) == 0x0
 03238   428   NtClose  (396, ... ) == 0x0
 03239   428   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Policies\Microsoft\Windows\Safer\LevelObjects"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 03240   428   NtOpenKey  (0x1, {24, 0, 0x40, 0, 0,  (0x1, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers"}, ... 396, ) }, ... 396, ) == 0x0
 03241   428   NtQueryValueKey  (396,  (396, "Levels", Partial, 536, ... ) , Partial, 536, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 03242   428   NtClose  (396, ... ) == 0x0
 03243   428   NtQueryDefaultLocale  (1, 1227672, ... ) == 0x0
 03244   428   NtQueryDefaultLocale  (1, 1227672, ... ) == 0x0
 03245   428   NtQueryDefaultLocale  (1, 1227672, ... ) == 0x0
 03246   428   NtQueryDefaultLocale  (1, 1227672, ... ) == 0x0
 03247   428   NtQueryDefaultLocale  (1, 1227672, ... ) == 0x0
 03248   428   NtQueryDefaultLocale  (1, 1227672, ... ) == 0x0
 03249   428   NtQueryDefaultLocale  (1, 1227672, ... ) == 0x0
 03250   428   NtQueryDefaultLocale  (1, 1227672, ... ) == 0x0
 03251   428   NtQueryDefaultLocale  (1, 1227672, ... ) == 0x0
 03252   428   NtQueryDefaultLocale  (1, 1227672, ... ) == 0x0
 03253   428   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\0\Paths"}, ... 396, ) }, ... 396, ) == 0x0
 03254   428   NtEnumerateKey  (396, 0, Basic, 280, ... {LastWrite={0x6f7a111e,0x1c73999}, TitleIdx=0, Name= (396, 0, Basic, 280, ... {LastWrite={0x6f7a111e,0x1c73999}, TitleIdx=0, Name="{dda3f824-d8cb-441b-834d-be2efd2c1a33}"}, 92, ) }, 92, ) == 0x0
 03255   428   NtOpenKey  (0x20019, {24, 396, 0x40, 0, 0,  (0x20019, {24, 396, 0x40, 0, 0, "{dda3f824-d8cb-441b-834d-be2efd2c1a33}"}, ... 400, ) }, ... 400, ) == 0x0
 03256   428   NtQueryValueKey  (400,  (400, "ItemData", Partial, 280, ... TitleIdx=0, Type=2, Data="%\0H\0K\0E\0Y\0_\0C\0U\0R\0R\0E\0N\0T\0_\0U\0S\0E\0R\0\\0S\0o\0f\0t\0w\0a\0r\0e\0\\0M\0i\0c\0r\0o\0s\0o\0f\0t\0\\0W\0i\0n\0d\0o\0w\0s\0\\0C\0u\0r\0r\0e\0n\0t\0V\0e\0r\0s\0i\0o\0n\0\\0E\0x\0p\0l\0o\0r\0e\0r\0\\0S\0h\0e\0l\0l\0 \0F\0o\0l\0d\0e\0r\0s\0\\0C\0a\0c\0h\0e\0%\0O\0L\0K\0*\0\0\0"}, 202, ) , Partial, 280, ... TitleIdx=0, Type=2, Data= (400, "ItemData", Partial, 280, ... TitleIdx=0, Type=2, Data="%\0H\0K\0E\0Y\0_\0C\0U\0R\0R\0E\0N\0T\0_\0U\0S\0E\0R\0\\0S\0o\0f\0t\0w\0a\0r\0e\0\\0M\0i\0c\0r\0o\0s\0o\0f\0t\0\\0W\0i\0n\0d\0o\0w\0s\0\\0C\0u\0r\0r\0e\0n\0t\0V\0e\0r\0s\0i\0o\0n\0\\0E\0x\0p\0l\0o\0r\0e\0r\0\\0S\0h\0e\0l\0l\0 \0F\0o\0l\0d\0e\0r\0s\0\\0C\0a\0c\0h\0e\0%\0O\0L\0K\0*\0\0\0"}, 202, ) }, 202, ) == 0x0
 03257   428   NtQueryValueKey  (400,  (400, "SaferFlags", Partial, 280, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) , Partial, 280, ... TitleIdx=0, Type=4, Data= (400, "SaferFlags", Partial, 280, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) }, 16, ) == 0x0
 03258   428   NtClose  (400, ... ) == 0x0
 03259   428   NtEnumerateKey  (396, 1, Basic, 280, ... ) == STATUS_NO_MORE_ENTRIES
 03260   428   NtClose  (396, ... ) == 0x0
 03261   428   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\0\Hashes"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 03262   428   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\0\UrlZones"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 03263   428   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\4096\Paths"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 03264   428   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\4096\Hashes"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 03265   428   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\4096\UrlZones"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 03266   428   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\65536\Paths"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 03267   428   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\65536\Hashes"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 03268   428   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\65536\UrlZones"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 03269   428   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\131072\Paths"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 03270   428   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\131072\Hashes"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 03271   428   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\131072\UrlZones"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 03272   428   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\262144\Paths"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 03273   428   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\262144\Hashes"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 03274   428   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\262144\UrlZones"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 03275   428   NtOpenThreadTokenEx  (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN
 03276   428   NtOpenProcessTokenEx  (-1, 0x20008, 512, ... 396, ) == 0x0
 03277   428   NtQueryInformationToken  (396, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0
 03278   428   NtClose  (396, ... ) == 0x0
 03279   428   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\REGISTRY\USER\S-1-5-21-1078081533-484763869-839522115-1003\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\0\Paths"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 03280   428   NtOpenThreadTokenEx  (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN
 03281   428   NtOpenProcessTokenEx  (-1, 0x20008, 512, ... 396, ) == 0x0
 03282   428   NtQueryInformationToken  (396, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0
 03283   428   NtClose  (396, ... ) == 0x0
 03284   428   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\REGISTRY\USER\S-1-5-21-1078081533-484763869-839522115-1003\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\0\Hashes"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 03285   428   NtOpenThreadTokenEx  (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN
 03286   428   NtOpenProcessTokenEx  (-1, 0x20008, 512, ... 396, ) == 0x0
 03287   428   NtQueryInformationToken  (396, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0
 03288   428   NtClose  (396, ... ) == 0x0
 03289   428   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\REGISTRY\USER\S-1-5-21-1078081533-484763869-839522115-1003\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\0\UrlZones"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 03290   428   NtOpenThreadTokenEx  (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN
 03291   428   NtOpenProcessTokenEx  (-1, 0x20008, 512, ... 396, ) == 0x0
 03292   428   NtQueryInformationToken  (396, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0
 03293   428   NtClose  (396, ... ) == 0x0
 03294   428   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\REGISTRY\USER\S-1-5-21-1078081533-484763869-839522115-1003\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\4096\Paths"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 03295   428   NtOpenThreadTokenEx  (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN
 03296   428   NtOpenProcessTokenEx  (-1, 0x20008, 512, ... 396, ) == 0x0
 03297   428   NtQueryInformationToken  (396, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0
 03298   428   NtClose  (396, ... ) == 0x0
 03299   428   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\REGISTRY\USER\S-1-5-21-1078081533-484763869-839522115-1003\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\4096\Hashes"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 03300   428   NtOpenThreadTokenEx  (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN
 03301   428   NtOpenProcessTokenEx  (-1, 0x20008, 512, ... 396, ) == 0x0
 03302   428   NtQueryInformationToken  (396, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0
 03303   428   NtClose  (396, ... ) == 0x0
 03304   428   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\REGISTRY\USER\S-1-5-21-1078081533-484763869-839522115-1003\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\4096\UrlZones"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 03305   428   NtOpenThreadTokenEx  (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN
 03306   428   NtOpenProcessTokenEx  (-1, 0x20008, 512, ... 396, ) == 0x0
 03307   428   NtQueryInformationToken  (396, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0
 03308   428   NtClose  (396, ... ) == 0x0
 03309   428   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\REGISTRY\USER\S-1-5-21-1078081533-484763869-839522115-1003\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\65536\Paths"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 03310   428   NtOpenThreadTokenEx  (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN
 03311   428   NtOpenProcessTokenEx  (-1, 0x20008, 512, ... 396, ) == 0x0
 03312   428   NtQueryInformationToken  (396, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0
 03313   428   NtClose  (396, ... ) == 0x0
 03314   428   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\REGISTRY\USER\S-1-5-21-1078081533-484763869-839522115-1003\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\65536\Hashes"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 03315   428   NtOpenThreadTokenEx  (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN
 03316   428   NtOpenProcessTokenEx  (-1, 0x20008, 512, ... 396, ) == 0x0
 03317   428   NtQueryInformationToken  (396, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0
 03318   428   NtClose  (396, ... ) == 0x0
 03319   428   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\REGISTRY\USER\S-1-5-21-1078081533-484763869-839522115-1003\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\65536\UrlZones"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 03320   428   NtOpenThreadTokenEx  (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN
 03321   428   NtOpenProcessTokenEx  (-1, 0x20008, 512, ... 396, ) == 0x0
 03322   428   NtQueryInformationToken  (396, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0
 03323   428   NtClose  (396, ... ) == 0x0
 03324   428   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\REGISTRY\USER\S-1-5-21-1078081533-484763869-839522115-1003\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\131072\Paths"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 03325   428   NtOpenThreadTokenEx  (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN
 03326   428   NtOpenProcessTokenEx  (-1, 0x20008, 512, ... 396, ) == 0x0
 03327   428   NtQueryInformationToken  (396, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0
 03328   428   NtClose  (396, ... ) == 0x0
 03329   428   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\REGISTRY\USER\S-1-5-21-1078081533-484763869-839522115-1003\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\131072\Hashes"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 03330   428   NtOpenThreadTokenEx  (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN
 03331   428   NtOpenProcessTokenEx  (-1, 0x20008, 512, ... 396, ) == 0x0
 03332   428   NtQueryInformationToken  (396, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0
 03333   428   NtClose  (396, ... ) == 0x0
 03334   428   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\REGISTRY\USER\S-1-5-21-1078081533-484763869-839522115-1003\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\131072\UrlZones"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 03335   428   NtOpenThreadTokenEx  (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN
 03336   428   NtOpenProcessTokenEx  (-1, 0x20008, 512, ... 396, ) == 0x0
 03337   428   NtQueryInformationToken  (396, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0
 03338   428   NtClose  (396, ... ) == 0x0
 03339   428   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\REGISTRY\USER\S-1-5-21-1078081533-484763869-839522115-1003\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\262144\Paths"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 03340   428   NtOpenThreadTokenEx  (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN
 03341   428   NtOpenProcessTokenEx  (-1, 0x20008, 512, ... 396, ) == 0x0
 03342   428   NtQueryInformationToken  (396, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0
 03343   428   NtClose  (396, ... ) == 0x0
 03344   428   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\REGISTRY\USER\S-1-5-21-1078081533-484763869-839522115-1003\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\262144\Hashes"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 03345   428   NtOpenThreadTokenEx  (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN
 03346   428   NtOpenProcessTokenEx  (-1, 0x20008, 512, ... 396, ) == 0x0
 03347   428   NtQueryInformationToken  (396, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0
 03348   428   NtClose  (396, ... ) == 0x0
 03349   428   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\REGISTRY\USER\S-1-5-21-1078081533-484763869-839522115-1003\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\262144\UrlZones"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 03350   428   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers"}, ... 396, ) }, ... 396, ) == 0x0
 03351   428   NtQueryValueKey  (396,  (396, "DefaultLevel", Full, 524, ... TitleIdx=0, Type=4, Name="DefaultLevel", Data="\0\0\4\0"}, 48, ) , Full, 524, ... TitleIdx=0, Type=4, Name= (396, "DefaultLevel", Full, 524, ... TitleIdx=0, Type=4, Name="DefaultLevel", Data="\0\0\4\0"}, 48, ) , Data= (396, "DefaultLevel", Full, 524, ... TitleIdx=0, Type=4, Name="DefaultLevel", Data="\0\0\4\0"}, 48, ) }, 48, ) == 0x0
 03352   428   NtClose  (396, ... ) == 0x0
 03353   428   NtOpenThreadTokenEx  (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN
 03354   428   NtOpenProcessTokenEx  (-1, 0x20008, 512, ... 396, ) == 0x0
 03355   428   NtQueryInformationToken  (396, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0
 03356   428   NtClose  (396, ... ) == 0x0
 03357   428   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\REGISTRY\USER\S-1-5-21-1078081533-484763869-839522115-1003\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 03358   428   NtOpenThreadToken  (-2, 0x8, 0, ... ) == STATUS_NO_TOKEN
 03359   428   NtOpenProcessToken  (-1, 0xa, ... 396, ) == 0x0
 03360   428   NtDuplicateToken  (396, 0xc, {24, 0, 0x0, 0, 1228192, 0x0}, 0, 2, ... 400, ) == 0x0
 03361   428   NtClose  (396, ... ) == 0x0
 03362   428   NtAccessCheck  (1535352, 400, 0x1, 1228320, 1228264, 56, 1228348, ... (0x1), ) == 0x0
 03363   428   NtClose  (400, ... ) == 0x0
 03364   428   NtOpenKey  (0x1, {24, 0, 0x40, 0, 0,  (0x1, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers"}, ... 400, ) }, ... 400, ) == 0x0
 03365   428   NtQueryValueKey  (400,  (400, "PolicyScope", Partial, 80, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) , Partial, 80, ... TitleIdx=0, Type=4, Data= (400, "PolicyScope", Partial, 80, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) }, 16, ) == 0x0
 03366   428   NtClose  (400, ... ) == 0x0
 03367   428   NtOpenSymbolicLinkObject  (0x1, {24, 0, 0x40, 0, 0,  (0x1, {24, 0, 0x40, 0, 0, "\??\C:"}, ... 400, ) }, ... 400, ) == 0x0
 03368   428   NtQuerySymbolicLinkObject  (400, ...  (400, ... "\Device\HarddiskVolume1", 48, ) , 48, ) == 0x0
 03369   428   NtClose  (400, ... ) == 0x0
 03370   428   NtQueryInformationFile  (384, 1226652, 528, Name, ... {status=0x0, info=94}, ) == 0x0
 03371   428   NtQueryInformationProcess  (-1, DefaultHardErrorMode, 4, ... {process info, class 12, size 4}, 0x0, ) == 0x0
 03372   428   NtSetInformationProcess  (-1, DefaultHardErrorMode, {process info, class 12, size 4}, 4, ... ) == 0x0
 03373   428   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\Program Files\Internet Explorer\iexplore.exe"}, 1225332, ... ) }, 1225332, ... ) == 0x0
 03374   428   NtOpenFile  (0x100001, {24, 0, 0x40, 0, 0,  (0x100001, {24, 0, 0x40, 0, 0, "\??\C:\Program Files\Internet Explorer\"}, 3, 16417, ... 400, {status=0x0, info=1}, ) }, 3, 16417, ... 400, {status=0x0, info=1}, ) == 0x0
 03375   428   NtQueryDirectoryFile  (400, 0, 0, 0, 1224692, 616, BothDirectory, 1,  (400, 0, 0, 0, 1224692, 616, BothDirectory, 1, "iexplore.exe", 0, ... {status=0x0, info=118}, ) , 0, ... {status=0x0, info=118}, ) == 0x0
 03376   428   NtClose  (400, ... ) == 0x0
 03377   428   NtQueryInformationProcess  (-1, DefaultHardErrorMode, 4, ... {process info, class 12, size 4}, 0x0, ) == 0x0
 03378   428   NtSetInformationProcess  (-1, DefaultHardErrorMode, {process info, class 12, size 4}, 4, ... ) == 0x0
 03379   428   NtOpenThreadTokenEx  (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN
 03380   428   NtOpenProcessTokenEx  (-1, 0x20008, 512, ... 400, ) == 0x0
 03381   428   NtQueryInformationToken  (400, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0
 03382   428   NtClose  (400, ... ) == 0x0
 03383   428   NtOpenKey  (0x20019, {24, 0, 0x640, 0, 0,  (0x20019, {24, 0, 0x640, 0, 0, "\REGISTRY\USER\S-1-5-21-1078081533-484763869-839522115-1003"}, ... 400, ) }, ... 400, ) == 0x0
 03384   428   NtOpenKey  (0x20019, {24, 400, 0x40, 0, 0,  (0x20019, {24, 400, 0x40, 0, 0, "Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders"}, ... 396, ) }, ... 396, ) == 0x0
 03385   428   NtClose  (400, ... ) == 0x0
 03386   428   NtQueryValueKey  (396,  (396, "Cache", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 03387   428   NtQueryValueKey  (396,  (396, "Cache", Partial, 162, ... TitleIdx=0, Type=1, Data="C\0:\0\\0D\0o\0c\0u\0m\0e\0n\0t\0s\0 \0a\0n\0d\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0S\0R\0I\0-\0u\0s\0e\0r\0\\0L\0o\0c\0a\0l\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0T\0e\0m\0p\0o\0r\0a\0r\0y\0 \0I\0n\0t\0e\0r\0n\0e\0t\0 \0F\0i\0l\0e\0s\0\0\0"}, 162, ) , Partial, 162, ... TitleIdx=0, Type=1, Data= (396, "Cache", Partial, 162, ... TitleIdx=0, Type=1, Data="C\0:\0\\0D\0o\0c\0u\0m\0e\0n\0t\0s\0 \0a\0n\0d\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0S\0R\0I\0-\0u\0s\0e\0r\0\\0L\0o\0c\0a\0l\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0T\0e\0m\0p\0o\0r\0a\0r\0y\0 \0I\0n\0t\0e\0r\0n\0e\0t\0 \0F\0i\0l\0e\0s\0\0\0"}, 162, ) }, 162, ) == 0x0
 03388   428   NtClose  (396, ... ) == 0x0
 03389   428   NtAllocateVirtualMemory  (-1, 0, 0, 4096, 8192, 4, ... 9830400, 4096, ) == 0x0
 03390   428   NtAllocateVirtualMemory  (-1, 9830400, 0, 4096, 4096, 4, ... 9830400, 4096, ) == 0x0
 03391   428   NtOpenKey  (0x1, {24, 0, 0x40, 0, 0,  (0x1, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers"}, ... 396, ) }, ... 396, ) == 0x0
 03392   428   NtQueryValueKey  (396,  (396, "LogFileName", Partial, 536, ... ) , Partial, 536, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 03393   428   NtClose  (396, ... ) == 0x0
 03394   428   NtOpenKey  (0x3, {24, 0, 0x40, 0, 0,  (0x3, {24, 0, 0x40, 0, 0, "\Registry\MACHINE\System\CurrentControlSet\Control\SafeBoot\Option"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 03395   428   NtQueryInformationToken  (392, User, 128, ... {token info, class 1, size 36}, 36, ) == 0x0
 03396   428   NtQueryInformationToken  (392, 15, 4, ... {token info, class 15, size 4}, 4, ) == 0x0
 03397   428   NtClose  (392, ... ) == 0x0
 03398   428   NtCreateProcessEx  (1230928, 2035711, 0, -1, 0, 388, 0, 0, 0, ... ) == 0x0
 03399   428   NtSetInformationProcess  (392, DefaultHardErrorMode, {process info, class 12, size 4}, 4, ... ) == 0x0
 03400   428   NtQueryInformationProcess  (392, Basic, 24, ... {ExitStatus=0x103,PebBaseAddress=0x7ffdf000,AffinityMask=0x1,BasePriority=8,Pid=380,ParentPid=420,}, 0x0, ) == 0x0
 03401   428   NtReadVirtualMemory  (392, 0x7ffdf008, 4, ...  (392, 0x7ffdf008, 4, ... "\0\0@\0", 0x0, ) , 0x0, ) == 0x0
 03402   428   NtOpenFile  (0x1200a9, {24, 0, 0x40, 0, 0,  (0x1200a9, {24, 0, 0x40, 0, 0, "\??\C:\Program Files\Internet Explorer\iexplore.exe.Manifest"}, 1, 96, ... ) }, 1, 96, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 03403   428   NtReadVirtualMemory  (392, 0x400000, 4096, ...  (392, 0x400000, 4096, ... "MZ\220\0\3\0\0\0\4\0\0\0\377\377\0\0\270\0\0\0\0\0\0\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\360\0\0\0\16\37\272\16\0\264\11\315!\270\1L\315!This program cannot be run in DOS mode.\15\15\12$\0\0\0\0\0\0\0\322C:\374\226"T\257\226"T\257\226"T\257l\1\24\257\227"T\257\226"U\257\322"T\257l\1M\257\233"T\257\1\1\21\257\227"T\257L\1H\257\227"T\257L\1I\257\227"T\257l\1k\257\227"T\257l\1i\257\227"T\257Rich\226"T\257\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0PE\0\0L\1\3\0L\203};\0\0\0\0\0\0\0\0\340\0\17\1\13\1\7\0\0\26\0\0\0J\1\0\0\0\0\0\346\36\0\0\0\20\0\0\00\0\0\0\0@\0\0\20\0\0\0\2\0\0\5\0\1\0\5\0\1\0\4\0\0\0\0\0\0\0\0\220\1\0\0\4\0\0VT\2\0\2\0\0\200\0\0\20\0\0\20\0\0\0\0\20\0\0\20\0\0\0\0\0\0\20\0\0\0\240%\0\0K\0\0\0\354\37\0\0x\0\0\0\0@\0\0HG\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0 \21\0\0\34\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0`\2\0\0l\0\0\0\0\20\0\0\30\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0.text\0\0\0\353\25\0\0", 4096, ) T\257\226 (392, 0x400000, 4096, ... "MZ\220\0\3\0\0\0\4\0\0\0\377\377\0\0\270\0\0\0\0\0\0\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\360\0\0\0\16\37\272\16\0\264\11\315!\270\1L\315!This program cannot be run in DOS mode.\15\15\12$\0\0\0\0\0\0\0\322C:\374\226"T\257\226"T\257\226"T\257l\1\24\257\227"T\257\226"U\257\322"T\257l\1M\257\233"T\257\1\1\21\257\227"T\257L\1H\257\227"T\257L\1I\257\227"T\257l\1k\257\227"T\257l\1i\257\227"T\257Rich\226"T\257\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0PE\0\0L\1\3\0L\203};\0\0\0\0\0\0\0\0\340\0\17\1\13\1\7\0\0\26\0\0\0J\1\0\0\0\0\0\346\36\0\0\0\20\0\0\00\0\0\0\0@\0\0\20\0\0\0\2\0\0\5\0\1\0\5\0\1\0\4\0\0\0\0\0\0\0\0\220\1\0\0\4\0\0VT\2\0\2\0\0\200\0\0\20\0\0\20\0\0\0\0\20\0\0\20\0\0\0\0\0\0\20\0\0\0\240%\0\0K\0\0\0\354\37\0\0x\0\0\0\0@\0\0HG\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0 \21\0\0\34\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0`\2\0\0l\0\0\0\0\20\0\0\30\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0.text\0\0\0\353\25\0\0", 4096, ) T\257l\1\24\257\227 (392, 0x400000, 4096, ... "MZ\220\0\3\0\0\0\4\0\0\0\377\377\0\0\270\0\0\0\0\0\0\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\360\0\0\0\16\37\272\16\0\264\11\315!\270\1L\315!This program cannot be run in DOS mode.\15\15\12$\0\0\0\0\0\0\0\322C:\374\226"T\257\226"T\257\226"T\257l\1\24\257\227"T\257\226"U\257\322"T\257l\1M\257\233"T\257\1\1\21\257\227"T\257L\1H\257\227"T\257L\1I\257\227"T\257l\1k\257\227"T\257l\1i\257\227"T\257Rich\226"T\257\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0PE\0\0L\1\3\0L\203};\0\0\0\0\0\0\0\0\340\0\17\1\13\1\7\0\0\26\0\0\0J\1\0\0\0\0\0\346\36\0\0\0\20\0\0\00\0\0\0\0@\0\0\20\0\0\0\2\0\0\5\0\1\0\5\0\1\0\4\0\0\0\0\0\0\0\0\220\1\0\0\4\0\0VT\2\0\2\0\0\200\0\0\20\0\0\20\0\0\0\0\20\0\0\20\0\0\0\0\0\0\20\0\0\0\240%\0\0K\0\0\0\354\37\0\0x\0\0\0\0@\0\0HG\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0 \21\0\0\34\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0`\2\0\0l\0\0\0\0\20\0\0\30\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0.text\0\0\0\353\25\0\0", 4096, ) U\257\322 (392, 0x400000, 4096, ... "MZ\220\0\3\0\0\0\4\0\0\0\377\377\0\0\270\0\0\0\0\0\0\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\360\0\0\0\16\37\272\16\0\264\11\315!\270\1L\315!This program cannot be run in DOS mode.\15\15\12$\0\0\0\0\0\0\0\322C:\374\226"T\257\226"T\257\226"T\257l\1\24\257\227"T\257\226"U\257\322"T\257l\1M\257\233"T\257\1\1\21\257\227"T\257L\1H\257\227"T\257L\1I\257\227"T\257l\1k\257\227"T\257l\1i\257\227"T\257Rich\226"T\257\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0PE\0\0L\1\3\0L\203};\0\0\0\0\0\0\0\0\340\0\17\1\13\1\7\0\0\26\0\0\0J\1\0\0\0\0\0\346\36\0\0\0\20\0\0\00\0\0\0\0@\0\0\20\0\0\0\2\0\0\5\0\1\0\5\0\1\0\4\0\0\0\0\0\0\0\0\220\1\0\0\4\0\0VT\2\0\2\0\0\200\0\0\20\0\0\20\0\0\0\0\20\0\0\20\0\0\0\0\0\0\20\0\0\0\240%\0\0K\0\0\0\354\37\0\0x\0\0\0\0@\0\0HG\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0 \21\0\0\34\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0`\2\0\0l\0\0\0\0\20\0\0\30\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0.text\0\0\0\353\25\0\0", 4096, ) T\257\1\1\21\257\227 (392, 0x400000, 4096, ... "MZ\220\0\3\0\0\0\4\0\0\0\377\377\0\0\270\0\0\0\0\0\0\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\360\0\0\0\16\37\272\16\0\264\11\315!\270\1L\315!This program cannot be run in DOS mode.\15\15\12$\0\0\0\0\0\0\0\322C:\374\226"T\257\226"T\257\226"T\257l\1\24\257\227"T\257\226"U\257\322"T\257l\1M\257\233"T\257\1\1\21\257\227"T\257L\1H\257\227"T\257L\1I\257\227"T\257l\1k\257\227"T\257l\1i\257\227"T\257Rich\226"T\257\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0PE\0\0L\1\3\0L\203};\0\0\0\0\0\0\0\0\340\0\17\1\13\1\7\0\0\26\0\0\0J\1\0\0\0\0\0\346\36\0\0\0\20\0\0\00\0\0\0\0@\0\0\20\0\0\0\2\0\0\5\0\1\0\5\0\1\0\4\0\0\0\0\0\0\0\0\220\1\0\0\4\0\0VT\2\0\2\0\0\200\0\0\20\0\0\20\0\0\0\0\20\0\0\20\0\0\0\0\0\0\20\0\0\0\240%\0\0K\0\0\0\354\37\0\0x\0\0\0\0@\0\0HG\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0 \21\0\0\34\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0`\2\0\0l\0\0\0\0\20\0\0\30\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0.text\0\0\0\353\25\0\0", 4096, ) T\257L\1I\257\227 (392, 0x400000, 4096, ... "MZ\220\0\3\0\0\0\4\0\0\0\377\377\0\0\270\0\0\0\0\0\0\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\360\0\0\0\16\37\272\16\0\264\11\315!\270\1L\315!This program cannot be run in DOS mode.\15\15\12$\0\0\0\0\0\0\0\322C:\374\226"T\257\226"T\257\226"T\257l\1\24\257\227"T\257\226"U\257\322"T\257l\1M\257\233"T\257\1\1\21\257\227"T\257L\1H\257\227"T\257L\1I\257\227"T\257l\1k\257\227"T\257l\1i\257\227"T\257Rich\226"T\257\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0PE\0\0L\1\3\0L\203};\0\0\0\0\0\0\0\0\340\0\17\1\13\1\7\0\0\26\0\0\0J\1\0\0\0\0\0\346\36\0\0\0\20\0\0\00\0\0\0\0@\0\0\20\0\0\0\2\0\0\5\0\1\0\5\0\1\0\4\0\0\0\0\0\0\0\0\220\1\0\0\4\0\0VT\2\0\2\0\0\200\0\0\20\0\0\20\0\0\0\0\20\0\0\20\0\0\0\0\0\0\20\0\0\0\240%\0\0K\0\0\0\354\37\0\0x\0\0\0\0@\0\0HG\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0 \21\0\0\34\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0`\2\0\0l\0\0\0\0\20\0\0\30\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0.text\0\0\0\353\25\0\0", 4096, ) T\257l\1i\257\227 (392, 0x400000, 4096, ... "MZ\220\0\3\0\0\0\4\0\0\0\377\377\0\0\270\0\0\0\0\0\0\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\360\0\0\0\16\37\272\16\0\264\11\315!\270\1L\315!This program cannot be run in DOS mode.\15\15\12$\0\0\0\0\0\0\0\322C:\374\226"T\257\226"T\257\226"T\257l\1\24\257\227"T\257\226"U\257\322"T\257l\1M\257\233"T\257\1\1\21\257\227"T\257L\1H\257\227"T\257L\1I\257\227"T\257l\1k\257\227"T\257l\1i\257\227"T\257Rich\226"T\257\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0PE\0\0L\1\3\0L\203};\0\0\0\0\0\0\0\0\340\0\17\1\13\1\7\0\0\26\0\0\0J\1\0\0\0\0\0\346\36\0\0\0\20\0\0\00\0\0\0\0@\0\0\20\0\0\0\2\0\0\5\0\1\0\5\0\1\0\4\0\0\0\0\0\0\0\0\220\1\0\0\4\0\0VT\2\0\2\0\0\200\0\0\20\0\0\20\0\0\0\0\20\0\0\20\0\0\0\0\0\0\20\0\0\0\240%\0\0K\0\0\0\354\37\0\0x\0\0\0\0@\0\0HG\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0 \21\0\0\34\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0`\2\0\0l\0\0\0\0\20\0\0\30\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0.text\0\0\0\353\25\0\0", 4096, ) T\257\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0PE\0\0L\1\3\0L\203};\0\0\0\0\0\0\0\0\340\0\17\1\13\1\7\0\0\26\0\0\0J\1\0\0\0\0\0\346\36\0\0\0\20\0\0\00\0\0\0\0@\0\0\20\0\0\0\2\0\0\5\0\1\0\5\0\1\0\4\0\0\0\0\0\0\0\0\220\1\0\0\4\0\0VT\2\0\2\0\0\200\0\0\20\0\0\20\0\0\0\0\20\0\0\20\0\0\0\0\0\0\20\0\0\0\240%\0\0K\0\0\0\354\37\0\0x\0\0\0\0@\0\0HG\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0 \21\0\0\34\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0`\2\0\0l\0\0\0\0\20\0\0\30\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0.text\0\0\0\353\25\0\0", 4096, ) == 0x0
 03404   428   NtReadVirtualMemory  (392, 0x404000, 256, ...  (392, 0x404000, 256, ... "\0\0\0\0\0\0\0\0\0\0\0\0\0\0\4\0\3\0\0\00\0\0\200\6\0\0\0\370\1\0\200\16\0\0\0\20\2\0\200\20\0\0\0\330\2\0\200\0\0\0\0\0\0\0\0\0\0\0\0\0\07\0\1\0\0\0\360\2\0\200\2\0\0\0\10\3\0\200\3\0\0\0 \3\0\200\4\0\0\08\3\0\200\5\0\0\0P\3\0\200\6\0\0\0h\3\0\200\7\0\0\0\200\3\0\200\10\0\0\0\230\3\0\200\11\0\0\0\260\3\0\200\12\0\0\0\310\3\0\200\13\0\0\0\340\3\0\200\14\0\0\0\370\3\0\200\15\0\0\0\20\4\0\200\16\0\0\0(\4\0\200\17\0\0\0@\4\0\200\20\0\0\0X\4\0\200\21\0\0\0p\4\0\200\22\0\0\0\210\4\0\200\23\0\0\0\240\4\0\200\24\0\0\0\270\4\0\200\25\0\0\0\320\4\0\200\26\0\0\0\350\4\0\200\27\0\0\0\0\5\0\200\30\0\0\0\30\5\0\200", 256, ) , 256, ) == 0x0
 03405   428   NtQueryDebugFilterState  (53, 2, ... ) == 0x0
 03406   428   NtQueryInformationProcess  (392, Basic, 24, ... {ExitStatus=0x103,PebBaseAddress=0x7ffdf000,AffinityMask=0x1,BasePriority=8,Pid=380,ParentPid=420,}, 0x0, ) == 0x0
 03407   428   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\U:\startupscripts"}, 1228992, ... ) }, 1228992, ... ) == 0x0
 03408   428   NtAllocateVirtualMemory  (-1, 0, 0, 1876, 4096, 4, ... 9895936, 4096, ) == 0x0
 03409   428   NtAllocateVirtualMemory  (392, 0, 0, 1982, 4096, 4, ... 65536, 4096, ) == 0x0
 03410   428   NtWriteVirtualMemory  (392, 0x10000,  (392, 0x10000, "=\0:\0:\0=\0:\0:\0\\0\0\0=\0C\0:\0=\0C\0:\0\\0p\0o\0l\0y\0u\0n\0p\0a\0c\0k\0\0\0=\0E\0x\0i\0t\0C\0o\0d\0e\0=\00\00\00\00\00\00\00\02\0\0\0=\0U\0:\0=\0U\0:\0\\0s\0t\0a\0r\0t\0u\0p\0s\0c\0r\0i\0p\0t\0s\0\0\0A\0L\0L\0U\0S\0E\0R\0S\0P\0R\0O\0F\0I\0L\0E\0=\0C\0:\0\\0D\0o\0c\0u\0m\0e\0n\0t\0s\0 \0a\0n\0d\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0A\0l\0l\0 \0U\0s\0e\0r\0s\0\0\0A\0P\0P\0D\0A\0T\0A\0=\0C\0:\0\\0D\0o\0c\0u\0m\0e\0n\0t\0s\0 \0a\0n\0d\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0S\0R\0I\0-\0u\0s\0e\0r\0\\0A\0p\0p\0l\0i\0c\0a\0t\0i\0o\0n\0 \0D\0a\0t\0a\0\0\0C\0L\0I\0E\0N\0T\0N\0A\0M\0E\0=\0C\0o\0n\0s\0o\0l\0e\0\0\0C\0o\0m\0m\0o\0n\0P\0r\0o\0g\0r\0a\0m\0F\0i\0l\0e\0s\0=\0C\0:\0\\0P\0r\0o\0g\0r\0a\0m\0 \0F\0i\0l\0e\0s\0\\0C\0o\0m\0m\0o\0n\0 \0F\0i\0l\0e\0s\0\0\0C\0O\0M\0", 1982, ... 0x0, ) , 1982, ... 0x0, ) == 0x0
 03411   428   NtAllocateVirtualMemory  (392, 0, 0, 1876, 4096, 4, ... 131072, 4096, ) == 0x0
 03412   428   NtWriteVirtualMemory  (392, 0x20000,  (392, 0x20000, "\0\20\0\0T\7\0\0\0\0\0\0\0\0\0\0\376\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"\0\10\2\220\2\0\0\0\0\0\0b\1d\1\230\4\0\0^\0`\0\374\5\0\0r\0t\0\\6\0\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\1\0\0\0\1\0\0\0^\0`\0\320\6\0\0\36\0 \00\7\0\0\0\0\2\0P\7\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0", 1876, ... 0x0, ) \0\10\2\220\2\0\0\0\0\0\0b\1d\1\230\4\0\0^\0`\0\374\5\0\0r\0t\0\\6\0\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\1\0\0\0\1\0\0\0^\0`\0\320\6\0\0\36\0 \00\7\0\0\0\0\2\0P\7\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0", 1876, ... 0x0, ) == 0x0
 03413   428   NtWriteVirtualMemory  (392, 0x7ffdf010,  (392, 0x7ffdf010, "\0\0\2\0", 4, ... 0x0, ) , 4, ... 0x0, ) == 0x0
 03414   428   NtAllocateVirtualMemory  (392, 0, 0, 148, 4096, 4, ... 196608, 4096, ) == 0x0
 03415   428   NtWriteVirtualMemory  (392, 0x30000,  (392, 0x30000, "S\0h\0i\0m\0E\0n\0g\0.\0d\0l\0l\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\224\0\0\0\253\355\15\254\344\254\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0", 148, ... 0x0, ) , 148, ... 0x0, ) == 0x0
 03416   428   NtWriteVirtualMemory  (392, 0x7ffdf1e8,  (392, 0x7ffdf1e8, "\0\0\3\0", 4, ... 0x0, ) , 4, ... 0x0, ) == 0x0
 03417   428   NtFreeVirtualMemory  (-1, (0x970000), 0, 32768, ... (0x970000), 4096, ) == 0x0
 03418   428   NtAllocateVirtualMemory  (392, 0, 0, 1048576, 8192, 4, ... 262144, 1048576, ) == 0x0
 03419   428   NtAllocateVirtualMemory  (392, 1302528, 0, 8192, 4096, 4, ... 1302528, 8192, ) == 0x0
 03420   428   NtProtectVirtualMemory  (392, (0x13e000), 4096, 260, ... (0x13e000), 4096, 4, ) == 0x0
 03421   428   NtCreateThread  (0x1f03ff, 0x0, 392, 1229192, 1229912, 1, ... 396, {380, 568}, ) == 0x0
 03422   428   NtRequestWaitReplyPort  (24, {168, 196, new_msg, 0, 0, 1231024, 0, 0}  (24, {168, 196, new_msg, 0, 0, 1231024, 0, 0} "\0\0\0\0\0\0\1\0\24\0\0\0\1\0\0\0\213\1\0\0\214\1\0\0|\1\0\08\2\0\0\0\0\0\0\0\0\0\0\20\4\0\4\0\0\0\0\0\0\0\0<\313\22\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\360\375\177\0\0\0\0\0\0\0\0\0\0\0\0" ... {168, 196, reply, 0, 420, 428, 1522, 0} "\0\0\0\0\0\0\1\0\0\0\0\0\1\0\0\0\210\1\0\0\214\1\0\0|\1\0\08\2\0\0\0\0\0\0\0\0\0\0\20\4\0\4\0\0\0\0\0\0\0\0<\313\22\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\360\375\177\0\0\0\0\0\0\0\0\0\0\0\0" )  ... {168, 196, reply, 0, 420, 428, 1522, 0}  (24, {168, 196, new_msg, 0, 0, 1231024, 0, 0} "\0\0\0\0\0\0\1\0\24\0\0\0\1\0\0\0\213\1\0\0\214\1\0\0|\1\0\08\2\0\0\0\0\0\0\0\0\0\0\20\4\0\4\0\0\0\0\0\0\0\0<\313\22\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\360\375\177\0\0\0\0\0\0\0\0\0\0\0\0" ... {168, 196, reply, 0, 420, 428, 1522, 0} "\0\0\0\0\0\0\1\0\0\0\0\0\1\0\0\0\210\1\0\0\214\1\0\0|\1\0\08\2\0\0\0\0\0\0\0\0\0\0\20\4\0\4\0\0\0\0\0\0\0\0<\313\22\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\360\375\177\0\0\0\0\0\0\0\0\0\0\0\0" )  ) == 0x0
 03423   428   NtResumeThread  (396, ... 1, ) == 0x0
 03424   428   NtClose  (384, ... ) == 0x0
 03425   428   NtClose  (388, ... ) == 0x0
 03426   428   NtQueryInformationProcess  (392, Basic, 24, ... {ExitStatus=0x103,PebBaseAddress=0x7ffdf000,AffinityMask=0x1,BasePriority=8,Pid=380,ParentPid=420,}, 0x0, ) == 0x0
 03427   428   NtUserWaitForInputIdle  (380, 60000, 0, ...
 03428   428   NtCreateEvent  (0x1f0003, 0x0, 0, 0, ... 388, ) == 0x0
 03429   428   NtClose  (388, ... ) == 0x0
 03427   428   NtUserWaitForInputIdle  ... ) == 0x0
 03430   428   NtCreateEvent  (0x1f0003, 0x0, 1, 0, ... 388, ) == 0x0
 03431   428   NtUserFindExistingCursorIcon  (1233572, 1233588, 1234156, ... ) == 0x10011
 03432   428   NtUserGetClassInfo  (1999437824, 1233580, 1233532, 1233608, 0, ... ) == 0xc091
 03433   428   NtUserCreateWindowEx  (0, 1234068, 1233880, 0x0, 0, 0, 0, 0, 0, 0, 0, 1999437824, 0, 1073742848, 0, ...
 03434   428   NtUserMessageCall  (0x100f8, WM_NCCREATE, 0x0, 0x12cf10, 0, 670, 0, ... ) == 0x1
 03435   428   NtUserMessageCall  (0x100f8, WM_NCCALCSIZE, 0x0, 0x12cf38, 0, 670, 0, ... ) == 0x0
 03433   428   NtUserCreateWindowEx  ... ) == 0x100f8
 03436   428   NtUserSetWindowLong  (65784, 0, 0, 1, ... ) == 0x0
 03437   428   NtUserSetWindowLong  (65784, -4, 2000888781, 0, ... ) == 0x77d45a4d
 03438   428   NtUserMessageCall  (0x10014, 0x3e0, 0x100f8, 0xc01cc01d, 1234200, 689, 0, ...
 03439   428   NtFindAtom  ( ("d\0d\0e\0c\0o\0n\0v\0", 14, 1233752, ... ) , 14, 1233752, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 03440   428   NtFindAtom  ( ("d\0d\0e\0c\0o\0n\0v\0", 14, 1233752, ... ) , 14, 1233752, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 03441   428   NtAddAtom  ( ("d\0d\0e\0c\0o\0n\0v\0", 14, 1233736, ... ) , 14, 1233736, ... ) == 0x0
 03442   428   NtUserSetProp  (65784, 114727, 65788, ... ) == 0x1
 03438   428   NtUserMessageCall  ... ) == 0x0
 03443   428   NtFindAtom  ( ("d\0d\0e\0c\0o\0n\0v\0", 14, 1234220, ... ) , 14, 1234220, ... ) == 0x0
 03444   428   NtUserQueryWindow  (65788, 0, ... ) == 0x17c
 03445   428   NtUserQueryWindow  (65788, 1, ... ) == 0x238
 03446   428   NtUserCallOneParam  (380, 32, ... ) == 0x1
 03447   428   NtUserPostMessage  (65788, 1000, 65784, 10813444, ... ) == 0x1
 03448   428   NtUserQueryWindow  (65788, 0, ... ) == 0x17c
 03449   428   NtUserQueryWindow  (65788, 1, ... ) == 0x238
 03450   428   NtAddAtom  ( ("d\0d\0e\0e\0v\0e\0n\0t\0", 16, 1234180, ... ) , 16, 1234180, ... ) == 0x0
 03451   428   NtUserSetProp  (65784, 114728, 388, ... ) == 0x1
 03452   428   NtUserPeekMessage  (0, 0, 0, 1, ... {0x100f8, WM_USER+0xbcbb, 0x0, 0x0, 0x7a02, {512, 384}}, ) == 0x1
 03453   428   NtFindAtom  ( ("d\0d\0e\0c\0o\0n\0v\0", 14, 1233836, ... ) , 14, 1233836, ... ) == 0x0
 03454   428   NtUserCallOneParam  (1279, 38, ... ) == 0x24
 03455   428   NtWaitForMultipleObjects  (2, (388, 36, ), 1, 0, 0x0, ... ) == 0x1
 03456   428   NtUserCallNoParam  (3, ... ) == 0xbc646638
 03457   428   NtUserPeekMessage  (0, 0, 0, 1, ... {0x100f8, 0x3e4, 0x100fc, 0x176a98, 0x7a31, {512, 384}}, ) == 0x1
 03458   428   NtFindAtom  ( ("d\0d\0e\0c\0o\0n\0v\0", 14, 1233836, ... ) , 14, 1233836, ... ) == 0x0
 03459   428   NtUserDestroyWindow  (65784, ...
 03460   428   NtFindAtom  ( ("d\0d\0e\0c\0o\0n\0v\0", 14, 1233492, ... ) , 14, 1233492, ... ) == 0x0
 03461   428   NtUserKillTimer  (65784, 21845, ... ) == 0x0
 03462   428   NtAddAtom  ( ("d\0d\0e\0c\0o\0n\0v\0", 14, 1233476, ... ) , 14, 1233476, ... ) == 0x0
 03463   428   NtUserSetProp  (65784, 114727, 1, ... ) == 0x1
 03464   428   NtUserPostMessage  (65788, 993, 65784, 0, ... ) == 0x1
 03465   428   NtCreateEvent  (0x1f0003, 0x0, 1, 0, ... 384, ) == 0x0
 03466   428   NtAddAtom  ( ("T\0e\0r\0m\0E\0v\0e\0n\0t\0", 18, 1233412, ... ) , 18, 1233412, ... ) == 0x0
 03467   428   NtUserSetProp  (65784, 114729, 384, ... ) == 0x1
 03468   428   NtUserPeekMessage  (0, 992, 1000, 1, ... {0x100f8, 0x3e1, 0x100fc, 0x0, 0x7a40, {512, 384}}, ) == 0x1
 03469   428   NtFindAtom  ( ("d\0d\0e\0c\0o\0n\0v\0", 14, 1233140, ... ) , 14, 1233140, ... ) == 0x0
 03470   428   NtFindAtom  ( ("T\0e\0r\0m\0E\0v\0e\0n\0t\0", 18, 1233140, ... ) , 18, 1233140, ... ) == 0x0
 03471   428   NtSetEvent  (384, ... 0x0, ) == 0x0
 03472   428   NtClose  (384, ... ) == 0x0
 03473   428   NtFindAtom  ( ("T\0e\0r\0m\0E\0v\0e\0n\0t\0", 18, 1233428, ... ) , 18, 1233428, ... ) == 0x0
 03474   428   NtUserRemoveProp  (65784, 114729, ... ) == 0x180
 03475   428   NtDeleteAtom  (49193, ... ) == 0x0
 03476   428   NtFindAtom  ( ("d\0d\0e\0c\0o\0n\0v\0", 14, 1233480, ... ) , 14, 1233480, ... ) == 0x0
 03477   428   NtUserRemoveProp  (65784, 114727, ... ) == 0x1
 03478   428   NtDeleteAtom  (49191, ... ) == 0x0
 03479   428   NtFindAtom  ( ("d\0d\0e\0e\0v\0e\0n\0t\0", 16, 1233480, ... ) , 16, 1233480, ... ) == 0x0
 03480   428   NtUserRemoveProp  (65784, 114728, ... ) == 0x184
 03481   428   NtDeleteAtom  (49192, ... ) == 0x0
 03482   428   NtSetEvent  (388, ... 0x0, ) == 0x0
 03483   428   NtFindAtom  ( ("d\0d\0e\0c\0o\0n\0v\0", 14, 1233484, ... ) , 14, 1233484, ... ) == 0x0
 03484   428   NtUserRemoveProp  (65784, 43282, ... ) == 0x0
 03485   428   NtUserRemoveProp  (65784, 43287, ... ) == 0x0
 03459   428   NtUserDestroyWindow  ... ) == 0x1
 03486   428   NtUserCallOneParam  (1279, 38, ... ) == 0x24
 03487   428   NtWaitForMultipleObjects  (2, (388, 36, ), 1, 0, 0x0, ... ) == 0x0
 03488   428   NtUserCallNoParam  (3, ... ) == 0xbc646638
 03489   428   NtClose  (388, ... ) == 0x0
 03490   428   NtDeleteAtom  (49180, ... ) == 0x0
 03491   428   NtDeleteAtom  (49181, ... ) == 0x0
 03492   428   NtClose  (378, ... ) == 0x0
 03493   428   NtClose  (382, ... ) == 0x0
 03494   428   NtClose  (392, ... ) == 0x0
 03495   428   NtClose  (396, ... ) == 0x0
 03496   428   NtUserDestroyMenu  (196685, ... ) == 0x1
 03497   428   NtFreeVirtualMemory  (-1, (0x14a000), 20480, 16384, ... (0x14a000), 20480, ) == 0x0
 03498   428   NtUnmapViewOfSection  (-1, 0x930000, ... ) == 0x0
 03499   428   NtClose  (244, ... ) == 0x0
 03500   428   NtUnmapViewOfSection  (-1, 0x74b30000, ... ) == 0x0
 03501   428   NtGdiDeleteObjectApp  (17302560, ... ) == 0x1
 03502   428   NtUserGetClassInfo  (1989935104, 1239424, 1239376, 1239452, 0, ... ) == 0x0
 03503   428   NtUserGetClassInfo  (1989935104, 1239424, 1239376, 1239452, 0, ... ) == 0x0
 03504   428   NtUserGetClassInfo  (1989935104, 1239424, 1239376, 1239452, 0, ... ) == 0x0
 03505   428   NtUserGetClassInfo  (1989935104, 1239424, 1239376, 1239452, 0, ... ) == 0x0
 03506   428   NtUserGetClassInfo  (1989935104, 1239424, 1239376, 1239452, 0, ... ) == 0x0
 03507   428   NtUserGetClassInfo  (1989935104, 1239424, 1239376, 1239452, 0, ... ) == 0x0
 03508   428   NtUserGetClassInfo  (1989935104, 1239424, 1239376, 1239452, 0, ... ) == 0x0
 03509   428   NtUserGetClassInfo  (1989935104, 1239424, 1239376, 1239452, 0, ... ) == 0x0
 03510   428   NtUnmapViewOfSection  (-1, 0xa40000, ... ) == 0x0
 03511   428   NtClose  (240, ... ) == 0x0
 03512   428   NtUnmapViewOfSection  (-1, 0x769c0000, ... ) == 0x0
 03513   428   NtUserDestroyWindow  (65734, ...
 03514   428   NtUserRemoveProp  (65734, 43288, ... ) == 0xffffffff
 03515   428   NtUserRemoveProp  (65734, 43282, ... ) == 0x0
 03516   428   NtUserRemoveProp  (65734, 43287, ... ) == 0x0
 03513   428   NtUserDestroyWindow  ... ) == 0x1
 03517   428   NtUserUnregisterClass  (1240648, 1998258176, 1240636, ... ) == 0x1
 03518   428   NtFreeVirtualMemory  (-1, (0x146000), 12288, 16384, ... (0x146000), 12288, ) == 0x0
 03519   428   NtClose  (144, ... ) == 0x0
 03520   428   NtClose  (136, ... ) == 0x0
 03521   428   NtClose  (140, ... ) == 0x0
 03522   428   NtClose  (116, ... ) == 0x0
 03523   428   NtClose  (132, ... ) == 0x0
 03524   428   NtClose  (164, ... ) == 0x0
 03525   428   NtClose  (168, ... ) == 0x0
 03526   428   NtClose  (160, ... ) == 0x0
 03527   428   NtClose  (152, ... ) == 0x0
 03528   428   NtClose  (156, ... ) == 0x0
 03529   428   NtClose  (180, ... ) == 0x0
 03530   428   NtClose  (184, ... ) == 0x0
 03531   428   NtClose  (172, ... ) == 0x0
 03532   428   NtClose  (176, ... ) == 0x0
 03533   428   NtClose  (204, ... ) == 0x0
 03534   428   NtClose  (196, ... ) == 0x0
 03535   428   NtClose  (200, ... ) == 0x0
 03536   428   NtClose  (188, ... ) == 0x0
 03537   428   NtClose  (192, ... ) == 0x0
 03538   428   NtClose  (208, ... ) == 0x0
 03539   428   NtClose  (212, ... ) == 0x0
 03540   428   NtClose  (224, ... ) == 0x0
 03541   428   NtClose  (228, ... ) == 0x0
 03542   428   NtClose  (216, ... ) == 0x0
 03543   428   NtClose  (220, ... ) == 0x0
 03544   428   NtTerminateProcess  (0, 0, ... ) == 0x0
 03545   428   NtUnmapViewOfSection  (-1, 0x950000, ... ) == 0x0
 03546   428   NtClose  (332, ... ) == 0x0
 03547   428   NtSetInformationThread  (-2, ZeroTlsCell, {ZeroTlsCell=0xe,}, 4, ... ) == 0x0
 03548   428   NtUnmapViewOfSection  (-1, 0x9c0000, ... ) == 0x0
 03549   428   NtClose  (328, ... ) == 0x0
 03550   428   NtClose  (312, ... ) == 0x0
 03551   428   NtClose  (316, ... ) == 0x0
 03552   428   NtSetInformationThread  (-2, ZeroTlsCell, {ZeroTlsCell=0xd,}, 4, ... ) == 0x0
 03553   428   NtFreeVirtualMemory  (-1, (0x940000), 0, 32768, ... (0x940000), 65536, ) == 0x0
 03554   428   NtClose  (264, ... ) == 0x0
 03555   428   NtUnmapViewOfSection  (-1, 0x8f0000, ... ) == 0x0
 03556   428   NtClose  (268, ... ) == 0x0
 03557   428   NtClose  (260, ... ) == 0x0
 03558   428   NtWaitForSingleObject  (340, 0, 0x0, ... ) == 0x0
 03559   428   NtClearEvent  (340, ... ) == 0x0
 03560   428   NtSetEvent  (340, ... 0x0, ) == 0x0
 03561   428   NtClose  (340, ... ) == 0x0
 03562   428   NtSetInformationThread  (-2, ZeroTlsCell, {ZeroTlsCell=0x9,}, 4, ... ) == 0x0
 03563   428   NtSetInformationThread  (-2, ZeroTlsCell, {ZeroTlsCell=0xa,}, 4, ... ) == 0x0
 03564   428   NtClose  (248, ... ) == 0x0
 03565   428   NtClose  (236, ... ) == 0x0
 03566   428   NtClose  (252, ... ) == 0x0
 03567   428   NtUnmapViewOfSection  (-1, 0x8d0000, ... ) == 0x0
 03568   428   NtClose  (232, ... ) == 0x0
 03569   428   NtFreeVirtualMemory  (-1, (0x8e0000), 4096, 16384, ... (0x8e0000), 4096, ) == 0x0
 03570   428   NtFreeVirtualMemory  (-1, (0x8e0000), 0, 32768, ... (0x8e0000), 65536, ) == 0x0
 03571   428   NtSetInformationThread  (-2, ZeroTlsCell, {ZeroTlsCell=0x8,}, 4, ... ) == 0x0
 03572   428   NtSetInformationThread  (-2, ZeroTlsCell, {ZeroTlsCell=0x7,}, 4, ... ) == 0x0
 03573   428   NtSetInformationThread  (-2, ZeroTlsCell, {ZeroTlsCell=0x6,}, 4, ... ) == 0x0
 03574   428   NtUnmapViewOfSection  (-1, 0x870000, ... ) == 0x0
 03575   428   NtClose  (72, ... ) == 0x0
 03576   428   NtGdiDeleteObjectApp  (17826847, ... ) == 0x1
 03577   428   NtUserGetProcessWindowStation  (... ) == 0x28
 03578   428   NtUserBuildNameList  (40, 256, 1330656, 1244504, ... ) == 0x0
 03579   428   NtUserGetProcessWindowStation  (... ) == 0x28
 03580   428   NtUserOpenDesktop  ({24, 40, 0x40, 0, 0,  ({24, 40, 0x40, 0, 0, "Default"}, 1, 0x41, ... ) }, 1, 0x41, ... ) == 0x48
 03581   428   NtUserBuildHwndList  (72, 0, 0, 0, 64, ... (0x100e6, 0x100d6, 0x100ac, 0x100aa, 0x100a8, 0x20060, 0x100a2, 0x10082, 0x10076, 0x1006a, 0x30040, 0x10068, 0x10066, 0x30032, 0x1009a, 0x1008e, 0x1007e, 0x10026, 0x100c8, 0x100fa, 0x100ec, 0x100e0, 0x100cc, 0x100ca, 0x100c2, 0x100c0, 0x100be, 0x100bc, 0x100ba, 0x100b8, 0x100b2, 0x100b0, 0x20064, 0x100ae, 0x20062, 0x1006e, 0x50044, 0x40048, 0x50042, 0x10080, 0x10078, 0x1, ), 42, ) == 0x0
 03582   428   NtUserQueryWindow  (65766, 0, ... ) == 0x17c
 03583   428   NtUserQueryWindow  (65766, 1, ... ) == 0x238
 03584   428   NtUserBuildHwndList  (0, 65766, 1, 0, 64, ... (0x100ee, 0x100f0, 0x100e8, 0x100ea, 0x1, ), 5, ) == 0x0
 03585   428   NtUserQueryWindow  (65774, 0, ... ) == 0x17c
 03586   428   NtUserQueryWindow  (65774, 1, ... ) == 0x238
 03587   428   NtUserQueryWindow  (65776, 0, ... ) == 0x17c
 03588   428   NtUserQueryWindow  (65776, 1, ... ) == 0x238
 03589   428   NtUserQueryWindow  (65768, 0, ... ) == 0x17c
 03590   428   NtUserQueryWindow  (65768, 1, ... ) == 0x238
 03591   428   NtUserQueryWindow  (65770, 0, ... ) == 0x17c
 03592   428   NtUserQueryWindow  (65770, 1, ... ) == 0x238
 03593   428   NtUserQueryWindow  (65750, 0, ... ) == 0x17c
 03594   428   NtUserQueryWindow  (65750, 1, ... ) == 0x238
 03595   428   NtUserQueryWindow  (65708, 0, ... ) == 0xcc
 03596   428   NtUserQueryWindow  (65708, 1, ... ) == 0xd0
 03597   428   NtUserQueryWindow  (65706, 0, ... ) == 0xcc
 03598   428   NtUserQueryWindow  (65706, 1, ... ) == 0xd0
 03599   428   NtUserQueryWindow  (65704, 0, ... ) == 0xcc
 03600   428   NtUserQueryWindow  (65704, 1, ... ) == 0xd0
 03601   428   NtUserQueryWindow  (131168, 0, ... ) == 0xcc
 03602   428   NtUserQueryWindow  (131168, 1, ... ) == 0xd0
 03603   428   NtUserQueryWindow  (65698, 0, ... ) == 0x7c4
 03604   428   NtUserQueryWindow  (65698, 1, ... ) == 0x7d4
 03605   428   NtUserQueryWindow  (65666, 0, ... ) == 0x7c4
 03606   428   NtUserQueryWindow  (65666, 1, ... ) == 0x7d4
 03607   428   NtUserBuildHwndList  (0, 65666, 1, 0, 64, ... (0x10084, 0x10088, 0x1008a, 0x1008c, 0x10090, 0x10092, 0x10094, 0x10096, 0x10098, 0x1009c, 0x1009e, 0x100a0, 0x1, ), 13, ) == 0x0
 03608   428   NtUserQueryWindow  (65668, 0, ... ) == 0x7c4
 03609   428   NtUserQueryWindow  (65668, 1, ... ) == 0x7d4
 03610   428   NtUserQueryWindow  (65672, 0, ... ) == 0x7c4
 03611   428   NtUserQueryWindow  (65672, 1, ... ) == 0x7d4
 03612   428   NtUserQueryWindow  (65674, 0, ... ) == 0x7c4
 03613   428   NtUserQueryWindow  (65674, 1, ... ) == 0x7d4
 03614   428   NtUserQueryWindow  (65676, 0, ... ) == 0x7c4
 03615   428   NtUserQueryWindow  (65676, 1, ... ) == 0x7d4
 03616   428   NtUserQueryWindow  (65680, 0, ... ) == 0x7c4
 03617   428   NtUserQueryWindow  (65680, 1, ... ) == 0x7d4
 03618   428   NtUserQueryWindow  (65682, 0, ... ) == 0x7c4
 03619   428   NtUserQueryWindow  (65682, 1, ... ) == 0x7d4
 03620   428   NtUserQueryWindow  (65684, 0, ... ) == 0x7c4
 03621   428   NtUserQueryWindow  (65684, 1, ... ) == 0x7d4
 03622   428   NtUserQueryWindow  (65686, 0, ... ) == 0x7c4
 03623   428   NtUserQueryWindow  (65686, 1, ... ) == 0x7d4
 03624   428   NtUserQueryWindow  (65688, 0, ... ) == 0x7c4
 03625   428   NtUserQueryWindow  (65688, 1, ... ) == 0x7d4
 03626   428   NtUserQueryWindow  (65692, 0, ... ) == 0x7c4
 03627   428   NtUserQueryWindow  (65692, 1, ... ) == 0x7d4
 03628   428   NtUserQueryWindow  (65694, 0, ... ) == 0x7c4
 03629   428   NtUserQueryWindow  (65694, 1, ... ) == 0x7d4
 03630   428   NtUserQueryWindow  (65696, 0, ... ) == 0x7c4
 03631   428   NtUserQueryWindow  (65696, 1, ... ) == 0x7d4
 03632   428   NtUserQueryWindow  (65654, 0, ... ) == 0x7c4
 03633   428   NtUserQueryWindow  (65654, 1, ... ) == 0x7d4
 03634   428   NtUserQueryWindow  (65642, 0, ... ) == 0x7c4
 03635   428   NtUserQueryWindow  (65642, 1, ... ) == 0x7d4
 03636   428   NtUserQueryWindow  (196672, 0, ... ) == 0x7c4
 03637   428   NtUserQueryWindow  (196672, 1, ... ) == 0x7d4
 03638   428   NtUserQueryWindow  (65640, 0, ... ) == 0x7c4
 03639   428   NtUserQueryWindow  (65640, 1, ... ) == 0x7d4
 03640   428   NtUserQueryWindow  (65638, 0, ... ) == 0x7c4
 03641   428   NtUserQueryWindow  (65638, 1, ... ) == 0x7d4
 03642   428   NtUserQueryWindow  (196658, 0, ... ) == 0x7c4
 03643   428   NtUserQueryWindow  (196658, 1, ... ) == 0x7d4
 03644   428   NtUserBuildHwndList  (0, 196658, 1, 0, 64, ... (0x30036, 0x30034, 0x30038, 0x3003a, 0x3003c, 0x3003e, 0x1006c, 0x10070, 0x10074, 0x1, ), 10, ) == 0x0
 03645   428   NtUserQueryWindow  (196662, 0, ... ) == 0x7c4
 03646   428   NtUserQueryWindow  (196662, 1, ... ) == 0x7d4
 03647   428   NtUserQueryWindow  (196660, 0, ... ) == 0x7c4
 03648   428   NtUserQueryWindow  (196660, 1, ... ) == 0x7d4
 03649   428   NtUserQueryWindow  (196664, 0, ... ) == 0x7c4
 03650   428   NtUserQueryWindow  (196664, 1, ... ) == 0x7d4
 03651   428   NtUserQueryWindow  (196666, 0, ... ) == 0x7c4
 03652   428   NtUserQueryWindow  (196666, 1, ... ) == 0x7d4
 03653   428   NtUserQueryWindow  (196668, 0, ... ) == 0x7c4
 03654   428   NtUserQueryWindow  (196668, 1, ... ) == 0x7d4
 03655   428   NtUserQueryWindow  (196670, 0, ... ) == 0x7c4
 03656   428   NtUserQueryWindow  (196670, 1, ... ) == 0x7d4
 03657   428   NtUserQueryWindow  (65644, 0, ... ) == 0x7c4
 03658   428   NtUserQueryWindow  (65644, 1, ... ) == 0x7d4
 03659   428   NtUserQueryWindow  (65648, 0, ... ) == 0x7c4
 03660   428   NtUserQueryWindow  (65648, 1, ... ) == 0x7d4
 03661   428   NtUserQueryWindow  (65652, 0, ... ) == 0x7c4
 03662   428   NtUserQueryWindow  (65652, 1, ... ) == 0x7d4
 03663   428   NtUserQueryWindow  (65690, 0, ... ) == 0x7c4
 03664   428   NtUserQueryWindow  (65690, 1, ... ) == 0x7d4
 03665   428   NtUserQueryWindow  (65678, 0, ... ) == 0x7c4
 03666   428   NtUserQueryWindow  (65678, 1, ... ) == 0x7d4
 03667   428   NtUserQueryWindow  (65662, 0, ... ) == 0x7c4
 03668   428   NtUserQueryWindow  (65662, 1, ... ) == 0x7c8
 03669   428   NtUserQueryWindow  (65574, 0, ... ) == 0x268
 03670   428   NtUserQueryWindow  (65574, 1, ... ) == 0x2c4
 03671   428   NtUserQueryWindow  (65736, 0, ... ) == 0x17c
 03672   428   NtUserQueryWindow  (65736, 1, ... ) == 0x238
 03673   428   NtUserBuildHwndList  (0, 65736, 1, 0, 64, ... (0x100d0, 0x100d2, 0x100f2, 0x100dc, 0x100e4, 0x100de, 0x100e2, 0x100da, 0x100d8, 0x100d4, 0x100f4, 0x100f6, 0x10100, 0x100fe, 0x1, ), 15, ) == 0x0
 03674   428   NtUserQueryWindow  (65744, 0, ... ) == 0x17c
 03675   428   NtUserQueryWindow  (65744, 1, ... ) == 0x238
 03676   428   NtUserQueryWindow  (65746, 0, ... ) == 0x17c
 03677   428   NtUserQueryWindow  (65746, 1, ... ) == 0x238
 03678   428   NtUserQueryWindow  (65778, 0, ... ) == 0x17c
 03679   428   NtUserQueryWindow  (65778, 1, ... ) == 0x238
 03680   428   NtUserQueryWindow  (65756, 0, ... ) == 0x17c
 03681   428   NtUserQueryWindow  (65756, 1, ... ) == 0x238
 03682   428   NtUserQueryWindow  (65764, 0, ... ) == 0x17c
 03683   428   NtUserQueryWindow  (65764, 1, ... ) == 0x238
 03684   428   NtUserQueryWindow  (65758, 0, ... ) == 0x17c
 03685   428   NtUserQueryWindow  (65758, 1, ... ) == 0x238
 03686   428   NtUserQueryWindow  (65762, 0, ... ) == 0x17c
 03687   428   NtUserQueryWindow  (65762, 1, ... ) == 0x238
 03688   428   NtUserQueryWindow  (65754, 0, ... ) == 0x17c
 03689   428   NtUserQueryWindow  (65754, 1, ... ) == 0x238
 03690   428   NtUserQueryWindow  (65752, 0, ... ) == 0x17c
 03691   428   NtUserQueryWindow  (65752, 1, ... ) == 0x238
 03692   428   NtUserQueryWindow  (65748, 0, ... ) == 0x17c
 03693   428   NtUserQueryWindow  (65748, 1, ... ) == 0x238
 03694   428   NtUserQueryWindow  (65780, 0, ... ) == 0x17c
 03695   428   NtUserQueryWindow  (65780, 1, ... ) == 0x238
 03696   428   NtUserQueryWindow  (65782, 0, ... ) == 0x17c
 03697   428   NtUserQueryWindow  (65782, 1, ... ) == 0x238
 03698   428   NtUserQueryWindow  (65792, 0, ... ) == 0x17c
 03699   428   NtUserQueryWindow  (65792, 1, ... ) == 0x238
 03700   428   NtUserQueryWindow  (65790, 0, ... ) == 0x17c
 03701   428   NtUserQueryWindow  (65790, 1, ... ) == 0x238
 03702   428   NtUserQueryWindow  (65786, 0, ... ) == 0x17c
 03703   428   NtUserQueryWindow  (65786, 1, ... ) == 0x238
 03704   428   NtUserQueryWindow  (65772, 0, ... ) == 0x17c
 03705   428   NtUserQueryWindow  (65772, 1, ... ) == 0x238
 03706   428   NtUserQueryWindow  (65760, 0, ... ) == 0x17c
 03707   428   NtUserQueryWindow  (65760, 1, ... ) == 0x238
 03708   428   NtUserQueryWindow  (65740, 0, ... ) == 0x17c
 03709   428   NtUserQueryWindow  (65740, 1, ... ) == 0x238
 03710   428   NtUserQueryWindow  (65738, 0, ... ) == 0x17c
 03711   428   NtUserQueryWindow  (65738, 1, ... ) == 0x238
 03712   428   NtUserQueryWindow  (65730, 0, ... ) == 0xd4
 03713   428   NtUserQueryWindow  (65730, 1, ... ) == 0xd8
 03714   428   NtUserQueryWindow  (65728, 0, ... ) == 0xd4
 03715   428   NtUserQueryWindow  (65728, 1, ... ) == 0xd8
 03716   428   NtUserQueryWindow  (65726, 0, ... ) == 0xd4
 03717   428   NtUserQueryWindow  (65726, 1, ... ) == 0xd8
 03718   428   NtUserQueryWindow  (65724, 0, ... ) == 0xd4
 03719   428   NtUserQueryWindow  (65724, 1, ... ) == 0xd8
 03720   428   NtUserQueryWindow  (65722, 0, ... ) == 0xd4
 03721   428   NtUserQueryWindow  (65722, 1, ... ) == 0xd8
 03722   428   NtUserQueryWindow  (65720, 0, ... ) == 0xd4
 03723   428   NtUserQueryWindow  (65720, 1, ... ) == 0xd8
 03724   428   NtUserQueryWindow  (65714, 0, ... ) == 0xd4
 03725   428   NtUserQueryWindow  (65714, 1, ... ) == 0xd8
 03726   428   NtUserQueryWindow  (65712, 0, ... ) == 0xd4
 03727   428   NtUserQueryWindow  (65712, 1, ... ) == 0xd8
 03728   428   NtUserQueryWindow  (131172, 0, ... ) == 0xe0
 03729   428   NtUserQueryWindow  (131172, 1, ... ) == 0xa0
 03730   428   NtUserQueryWindow  (65710, 0, ... ) == 0xcc
 03731   428   NtUserQueryWindow  (65710, 1, ... ) == 0xd0
 03732   428   NtUserQueryWindow  (131170, 0, ... ) == 0xc4
 03733   428   NtUserQueryWindow  (131170, 1, ... ) == 0xc8
 03734   428   NtUserQueryWindow  (65646, 0, ... ) == 0x7c4
 03735   428   NtUserQueryWindow  (65646, 1, ... ) == 0x7f0
 03736   428   NtUserQueryWindow  (327748, 0, ... ) == 0x7c4
 03737   428   NtUserQueryWindow  (327748, 1, ... ) == 0x7c8
 03738   428   NtUserQueryWindow  (262216, 0, ... ) == 0x7c4
 03739   428   NtUserQueryWindow  (262216, 1, ... ) == 0x7c8
 03740   428   NtUserQueryWindow  (327746, 0, ... ) == 0x7c4
 03741   428   NtUserQueryWindow  (327746, 1, ... ) == 0x7c8
 03742   428   NtUserQueryWindow  (65664, 0, ... ) == 0x7c4
 03743   428   NtUserQueryWindow  (65664, 1, ... ) == 0x7c8
 03744   428   NtUserQueryWindow  (65656, 0, ... ) == 0x7c4
 03745   428   NtUserQueryWindow  (65656, 1, ... ) == 0x7c8
 03746   428   NtUserBuildHwndList  (0, 65656, 1, 0, 64, ... (0x1007a, 0x1007c, 0x1, ), 3, ) == 0x0
 03747   428   NtUserQueryWindow  (65658, 0, ... ) == 0x7c4
 03748   428   NtUserQueryWindow  (65658, 1, ... ) == 0x7c8
 03749   428   NtUserQueryWindow  (65660, 0, ... ) == 0x7c4
 03750   428   NtUserQueryWindow  (65660, 1, ... ) == 0x7c8
 03751   428   NtUserCloseDesktop  (72, ...
 03752   428   NtClose  (72, ... ) == 0x0
 03751   428   NtUserCloseDesktop  ... ) == 0x1
 03753   428   NtUserGetProcessWindowStation  (... ) == 0x28
 03754   428   NtUserOpenDesktop  ({24, 40, 0x40, 0, 0,  ({24, 40, 0x40, 0, 0, "Disconnect"}, 1, 0x41, ... ) }, 1, 0x41, ... ) == 0x0
 03755   428   NtUserGetProcessWindowStation  (... ) == 0x28
 03756   428   NtUserOpenDesktop  ({24, 40, 0x40, 0, 0,  ({24, 40, 0x40, 0, 0, "Winlogon"}, 1, 0x41, ... ) }, 1, 0x41, ... ) == 0x0
 03757   428   NtGdiDeleteObjectApp  (17433628, ... ) == 0x1
 03758   428   NtGdiDeleteObjectApp  (17433629, ... ) == 0x1
 03759   428   NtClose  (64, ... ) == 0x0
 03760   428   NtSetInformationThread  (-2, ZeroTlsCell, {ZeroTlsCell=0x5,}, 4, ... ) == 0x0
 03761   428   NtUserGetClassInfo  (1999896576, 1244552, 1244504, 1244580, 0, ... ) == 0xc03b
 03762   428   NtUserUnregisterClass  (1244556, 1999896576, 1244544, ... ) == 0x1
 03763   428   NtUserGetClassInfo  (1999896576, 1244552, 1244504, 1244580, 0, ... ) == 0xc03d
 03764   428   NtUserUnregisterClass  (1244556, 1999896576, 1244544, ... ) == 0x1
 03765   428   NtUserGetClassInfo  (1999896576, 1244552, 1244504, 1244580, 0, ... ) == 0xc03f
 03766   428   NtUserUnregisterClass  (1244556, 1999896576, 1244544, ... ) == 0x1
 03767   428   NtUserGetClassInfo  (1999896576, 1244552, 1244504, 1244580, 0, ... ) == 0xc041
 03768   428   NtUserUnregisterClass  (1244556, 1999896576, 1244544, ... ) == 0x1
 03769   428   NtUserGetClassInfo  (1999896576, 1244552, 1244504, 1244580, 0, ... ) == 0xc043
 03770   428   NtUserUnregisterClass  (1244556, 1999896576, 1244544, ... ) == 0x1
 03771   428   NtUserGetClassInfo  (1999896576, 1244552, 1244504, 1244580, 0, ... ) == 0xc045
 03772   428   NtUserUnregisterClass  (1244556, 1999896576, 1244544, ... ) == 0x1
 03773   428   NtUserGetClassInfo  (1999896576, 1244552, 1244504, 1244580, 0, ... ) == 0xc047
 03774   428   NtUserUnregisterClass  (1244556, 1999896576, 1244544, ... ) == 0x1
 03775   428   NtUserGetClassInfo  (1999896576, 1244552, 1244504, 1244580, 0, ... ) == 0xc049
 03776   428   NtUserUnregisterClass  (1244556, 1999896576, 1244544, ... ) == 0x1
 03777   428   NtUserGetClassInfo  (1999896576, 1244552, 1244504, 1244580, 0, ... ) == 0xc04b
 03778   428   NtUserUnregisterClass  (1244556, 1999896576, 1244544, ... ) == 0x1
 03779   428   NtUserGetClassInfo  (1999896576, 1244552, 1244504, 1244580, 0, ... ) == 0xc04d
 03780   428   NtUserUnregisterClass  (1244556, 1999896576, 1244544, ... ) == 0x1
 03781   428   NtUserGetClassInfo  (1999896576, 1244552, 1244504, 1244580, 0, ... ) == 0xc04f
 03782   428   NtUserUnregisterClass  (1244556, 1999896576, 1244544, ... ) == 0x1
 03783   428   NtUserGetClassInfo  (1999896576, 1244552, 1244504, 1244580, 0, ... ) == 0xc051
 03784   428   NtUserUnregisterClass  (1244556, 1999896576, 1244544, ... ) == 0x1
 03785   428   NtUserGetClassInfo  (1999896576, 1244552, 1244504, 1244580, 0, ... ) == 0xc053
 03786   428   NtUserUnregisterClass  (1244556, 1999896576, 1244544, ... ) == 0x1
 03787   428   NtUserGetClassInfo  (1999896576, 1244552, 1244504, 1244580, 0, ... ) == 0xc057
 03788   428   NtUserUnregisterClass  (1244556, 1999896576, 1244544, ... ) == 0x1
 03789   428   NtUserGetClassInfo  (1999896576, 1244552, 1244504, 1244580, 0, ... ) == 0xc059
 03790   428   NtUserUnregisterClass  (1244556, 1999896576, 1244544, ... ) == 0x1
 03791   428   NtUserGetClassInfo  (1999896576, 1244552, 1244504, 1244580, 0, ... ) == 0xc05b
 03792   428   NtUserUnregisterClass  (1244556, 1999896576, 1244544, ... ) == 0x1
 03793   428   NtUserGetClassInfo  (1999896576, 1244552, 1244504, 1244580, 0, ... ) == 0xc05d
 03794   428   NtUserUnregisterClass  (1244556, 1999896576, 1244544, ... ) == 0x1
 03795   428   NtUserGetClassInfo  (1999896576, 1244552, 1244504, 1244580, 0, ... ) == 0xc05f
 03796   428   NtUserUnregisterClass  (1244556, 1999896576, 1244544, ... ) == 0x1
 03797   428   NtUserGetClassInfo  (1905590272, 1244552, 1244504, 1244580, 0, ... ) == 0xc03b
 03798   428   NtUserUnregisterClass  (1244556, 1905590272, 1244544, ... ) == 0x1
 03799   428   NtUserGetClassInfo  (1905590272, 1244552, 1244504, 1244580, 0, ... ) == 0xc03d
 03800   428   NtUserUnregisterClass  (1244556, 1905590272, 1244544, ... ) == 0x1
 03801   428   NtUserGetClassInfo  (1905590272, 1244552, 1244504, 1244580, 0, ... ) == 0xc03f
 03802   428   NtUserUnregisterClass  (1244556, 1905590272, 1244544, ... ) == 0x1
 03803   428   NtUserGetClassInfo  (1905590272, 1244552, 1244504, 1244580, 0, ... ) == 0xc041
 03804   428   NtUserUnregisterClass  (1244556, 1905590272, 1244544, ... ) == 0x1
 03805   428   NtUserGetClassInfo  (1905590272, 1244552, 1244504, 1244580, 0, ... ) == 0xc043
 03806   428   NtUserUnregisterClass  (1244556, 1905590272, 1244544, ... ) == 0x1
 03807   428   NtUserGetClassInfo  (1905590272, 1244552, 1244504, 1244580, 0, ... ) == 0xc045
 03808   428   NtUserUnregisterClass  (1244556, 1905590272, 1244544, ... ) == 0x1
 03809   428   NtUserGetClassInfo  (1905590272, 1244552, 1244504, 1244580, 0, ... ) == 0xc047
 03810   428   NtUserUnregisterClass  (1244556, 1905590272, 1244544, ... ) == 0x1
 03811   428   NtUserGetClassInfo  (1905590272, 1244552, 1244504, 1244580, 0, ... ) == 0xc049
 03812   428   NtUserUnregisterClass  (1244556, 1905590272, 1244544, ... ) == 0x1
 03813   428   NtUserGetClassInfo  (1905590272, 1244552, 1244504, 1244580, 0, ... ) == 0xc04b
 03814   428   NtUserUnregisterClass  (1244556, 1905590272, 1244544, ... ) == 0x1
 03815   428   NtUserGetClassInfo  (1905590272, 1244552, 1244504, 1244580, 0, ... ) == 0xc04d
 03816   428   NtUserUnregisterClass  (1244556, 1905590272, 1244544, ... ) == 0x1
 03817   428   NtUserGetClassInfo  (1905590272, 1244552, 1244504, 1244580, 0, ... ) == 0xc04f
 03818   428   NtUserUnregisterClass  (1244556, 1905590272, 1244544, ... ) == 0x1
 03819   428   NtUserGetClassInfo  (1905590272, 1244552, 1244504, 1244580, 0, ... ) == 0xc051
 03820   428   NtUserUnregisterClass  (1244556, 1905590272, 1244544, ... ) == 0x1
 03821   428   NtUserGetClassInfo  (1905590272, 1244552, 1244504, 1244580, 0, ... ) == 0xc053
 03822   428   NtUserUnregisterClass  (1244556, 1905590272, 1244544, ... ) == 0x1
 03823   428   NtUserGetClassInfo  (1905590272, 1244552, 1244504, 1244580, 0, ... ) == 0xc057
 03824   428   NtUserUnregisterClass  (1244556, 1905590272, 1244544, ... ) == 0x1
 03825   428   NtUserGetClassInfo  (1905590272, 1244552, 1244504, 1244580, 0, ... ) == 0xc059
 03826   428   NtUserUnregisterClass  (1244556, 1905590272, 1244544, ... ) == 0x1
 03827   428   NtUserGetClassInfo  (1905590272, 1244552, 1244504, 1244580, 0, ... ) == 0xc05b
 03828   428   NtUserUnregisterClass  (1244556, 1905590272, 1244544, ... ) == 0x1
 03829   428   NtUserGetClassInfo  (1905590272, 1244552, 1244504, 1244580, 0, ... ) == 0xc05d
 03830   428   NtUserUnregisterClass  (1244556, 1905590272, 1244544, ... ) == 0x1
 03831   428   NtUserGetClassInfo  (1905590272, 1244552, 1244504, 1244580, 0, ... ) == 0xc05f
 03832   428   NtUserUnregisterClass  (1244556, 1905590272, 1244544, ... ) == 0x1
 03833   428   NtUserGetClassInfo  (1905590272, 1244552, 1244504, 1244580, 0, ... ) == 0xc017
 03834   428   NtUserUnregisterClass  (1244556, 1905590272, 1244544, ... ) == 0x1
 03835   428   NtUserGetClassInfo  (1905590272, 1244552, 1244504, 1244580, 0, ... ) == 0xc019
 03836   428   NtUserUnregisterClass  (1244556, 1905590272, 1244544, ... ) == 0x1
 03837   428   NtUserGetClassInfo  (1905590272, 1244552, 1244504, 1244580, 0, ... ) == 0xc018
 03838   428   NtUserUnregisterClass  (1244556, 1905590272, 1244544, ... ) == 0x1
 03839   428   NtUserGetClassInfo  (1905590272, 1244552, 1244504, 1244580, 0, ... ) == 0xc01a
 03840   428   NtUserUnregisterClass  (1244556, 1905590272, 1244544, ... ) == 0x1
 03841   428   NtUserGetClassInfo  (1905590272, 1244552, 1244504, 1244580, 0, ... ) == 0xc01c
 03842   428   NtUserUnregisterClass  (1244556, 1905590272, 1244544, ... ) == 0x1
 03843   428   NtUserGetClassInfo  (1905590272, 1244552, 1244504, 1244580, 0, ... ) == 0xc01e
 03844   428   NtUserUnregisterClass  (1244556, 1905590272, 1244544, ... ) == 0x1
 03845   428   NtUserGetClassInfo  (1905590272, 1244552, 1244504, 1244580, 0, ... ) == 0xc01b
 03846   428   NtUserUnregisterClass  (1244556, 1905590272, 1244544, ... ) == 0x1
 03847   428   NtUserGetClassInfo  (1905590272, 1244552, 1244504, 1244580, 0, ... ) == 0xc068
 03848   428   NtUserUnregisterClass  (1244556, 1905590272, 1244544, ... ) == 0x1
 03849   428   NtUserGetClassInfo  (1905590272, 1244552, 1244504, 1244580, 0, ... ) == 0xc06a
 03850   428   NtUserUnregisterClass  (1244556, 1905590272, 1244544, ... ) == 0x1
 03851   428   NtUnmapViewOfSection  (-1, 0x860000, ... ) == 0x0
 03852   428   NtSetInformationThread  (-2, ZeroTlsCell, {ZeroTlsCell=0x4,}, 4, ... ) == 0x0
 03853   428   NtClose  (292, ... ) == 0x0
 03854   428   NtClose  (112, ... ) == 0x0
 03855   428   NtSetInformationThread  (-2, ZeroTlsCell, {ZeroTlsCell=0x1,}, 4, ... ) == 0x0
 03856   428   NtSetInformationThread  (-2, ZeroTlsCell, {ZeroTlsCell=0x2,}, 4, ... ) == 0x0
 03857   428   NtSetInformationThread  (-2, ZeroTlsCell, {ZeroTlsCell=0x3,}, 4, ... ) == 0x0
 03858   428   NtClose  (108, ... ) == 0x0
 03859   428   NtClose  (68, ... ) == 0x0
 03860   428   NtFreeVirtualMemory  (-1, (0x16e000), 28672, 16384, ... (0x16e000), 28672, ) == 0x0
 03861   428   NtFreeVirtualMemory  (-1, (0x960000), 4096, 32768, ... (0x960000), 4096, ) == 0x0
 03862   428   NtRequestWaitReplyPort  (24, {20, 48, new_msg, 0, 2147348480, 512, 2002532981, 1550545519}  (24, {20, 48, new_msg, 0, 2147348480, 512, 2002532981, 1550545519} "\0\0\0\0\3\0\1\0xe\0\0\377\377\0\0\0\0\0\0" ... {20, 48, reply, 0, 420, 428, 1622, 0} "\0\0\0\0\3\0\1\0\0\0\0\0\377\377\0\0\0\0\0\0" )  ... {20, 48, reply, 0, 420, 428, 1622, 0}  (24, {20, 48, new_msg, 0, 2147348480, 512, 2002532981, 1550545519} "\0\0\0\0\3\0\1\0xe\0\0\377\377\0\0\0\0\0\0" ... {20, 48, reply, 0, 420, 428, 1622, 0} "\0\0\0\0\3\0\1\0\0\0\0\0\377\377\0\0\0\0\0\0" )  ) == 0x0
 03863   428   NtTerminateProcess  (-1, 0, ...
 03864   428   NtClose  (44, ... ) == 0x0