Summary:

NtCallbackReturn(>) 1 NtUserGetImeInfoEx(>) 1 NtUserGetObjectInformation(>) 4 NtDeviceIoControlFile(>) 16
NtCreateProcessEx(>) 1 NtUserOpenWindowStation(>) 1 NtUserMessageCall(>) 4 NtCreateEvent(>) 17
NtCreateSemaphore(>) 1 NtUserSetCursor(>) 1 NtUserRemoveProp(>) 4 NtRequestWaitReplyPort(>) 18
NtCreateThread(>) 1 NtUserSetProp(>) 1 NtDuplicateObject(>) 5 NtWaitForSingleObject(>) 18
NtGdiCreateBitmap(>) 1 NtUserSetWindowLong(>) 1 NtGdiGetStockObject(>) 5 NtUserCallOneParam(>) 20
NtGdiCreatePatternBrushInternal(>) 1 NtUserUpdateInputContext(>) 1 NtReadFile(>) 5 NtQuerySection(>) 21
NtGdiGetTextCharsetInfo(>) 1 NtAccessCheck(>) 2 NtSetInformationFile(>) 5 NtQueryDirectoryFile(>) 24
NtGdiGetTextFaceW(>) 1 NtConnectPort(>) 2 NtWriteVirtualMemory(>) 5 NtCreateFile(>) 26
NtGdiGetTextMetricsW(>) 1 NtCreateIoCompletion(>) 2 NtUserGetProcessWindowStation(>) 6 NtOpenSection(>) 27
NtGdiGetWidthTable(>) 1 NtDuplicateToken(>) 2 NtFsControlFile(>) 7 NtQueryDebugFilterState(>) 29
NtGdiInit(>) 1 NtGdiCreateSolidBrush(>) 2 NtQueryInformationFile(>) 7 NtOpenProcessTokenEx(>) 36
NtGdiQueryFontAssocInfo(>) 1 NtNotifyChangeKey(>) 2 NtUserBuildHwndList(>) 7 NtOpenThreadTokenEx(>) 36
NtGdiSelectBitmap(>) 1 NtQueryInformationJobObject(>) 2 NtUserGetDC(>) 7 NtQueryVirtualMemory(>) 39
NtLockVirtualMemory(>) 1 NtQueryPerformanceCounter(>) 2 NtWaitForMultipleObjects(>) 7 NtQueryInformationToken(>) 47
NtOpenEvent(>) 1 NtTerminateProcess(>) 2 NtEnumerateKey(>) 8 NtSetInformationProcess(>) 49
NtOpenKeyedEvent(>) 1 NtUserCloseWindowStation(>) 2 NtOpenProcessToken(>) 8 NtQueryDefaultLocale(>) 60
NtOpenMutant(>) 1 NtUserPostThreadMessage(>) 2 NtOpenThreadToken(>) 8 NtQueryInformationProcess(>) 64
NtQueryInstallUILanguage(>) 1 NtUserSetWindowFNID(>) 2 NtQueryDefaultUILanguage(>) 8 NtUnmapViewOfSection(>) 64
NtQueryObject(>) 1 NtUserSetWindowsHookEx(>) 2 NtSetValueKey(>) 8 NtCreateSection(>) 69
NtQuerySystemTime(>) 1 NtUserUnhookWindowsHookEx(>) 2 NtUserSystemParametersInfo(>) 8 NtOpenFile(>) 70
NtRegisterThreadTerminatePort(>) 1 NtGdiHfontCreate(>) 3 NtUserCallNoParam(>) 9 NtAllocateVirtualMemory(>) 77
NtResumeThread(>) 1 NtOpenDirectoryObject(>) 3 NtCreateMutant(>) 10 NtQuerySystemInformation(>) 78
NtSecureConnectPort(>) 1 NtOpenSymbolicLinkObject(>) 3 NtCreateKey(>) 11 NtMapViewOfSection(>) 88
NtTestAlert(>) 1 NtQuerySymbolicLinkObject(>) 3 NtFreeVirtualMemory(>) 11 NtQueryAttributesFile(>) 99
NtUserBuildNameList(>) 1 NtReadVirtualMemory(>) 3 NtUserFindExistingCursorIcon(>) 11 NtFlushInstructionCache(>) 121
NtUserCallHwndParam(>) 1 NtSetEvent(>) 3 NtWriteFile(>) 11 NtUserValidateHandleSecure(>) 163
NtUserCloseDesktop(>) 1 NtSetInformationObject(>) 3 NtReleaseMutant(>) 12 NtUserQueryWindow(>) 188
NtUserCreateWindowEx(>) 1 NtUserGetThreadDesktop(>) 3 NtUserGetWindowDC(>) 12 NtOpenKey(>) 222
NtUserGetAtomName(>) 1 NtUserOpenDesktop(>) 3 NtUserRegisterWindowMessage(>) 13 NtProtectVirtualMemory(>) 243
NtUserGetClassName(>) 1 NtGdiCreateCompatibleDC(>) 4 NtContinue(>) 15 NtQueryValueKey(>) 243
NtUserGetForegroundWindow(>) 1 NtGdiDeleteObjectApp(>) 4 NtSetInformationThread(>) 15 NtClose(>) 384
NtUserGetGUIThreadInfo(>) 1 NtQueryVolumeInformationFile(>) 4 NtUserRegisterClassExWOW(>) 15

Trace:

00001 2020 NtOpenFile (0x80100000, {24, 0, 0x240, 0, 0, (0x80100000, {24, 0, 0x240, 0, 0, "\SystemRoot\Prefetch\PACKED.EXE-09ED06A1.pf"}, 0, 32, ... ) }, 0, 32, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 00002 2020 NtOpenKey (0x80000000, {24, 0, 0x40, 0, 0, (0x80000000, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\packed.exe"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 00003 2020 NtOpenKeyedEvent (0x2000000, {24, 0, 0x0, 0, 0, (0x2000000, {24, 0, 0x0, 0, 0, "\KernelObjects\CritSecOutOfMemoryEvent"}, ... 4, ) }, ... 4, ) == 0x0 00004 2020 NtQuerySystemInformation (Basic, 44, ... {Unknown=0,MaximumIncrement=156250,PhysicalPageSize=0x1000,NumberOfPhysicalPages=0xff7c,LowestPhysicalPage=0x1,HighestPhysicalPage=0xffff,AllocationGranularity=0x10000,LowestUserAddress=0x10000,HighestUserAddress=0x7ffeffff,ActiveProcessors=1,NumberProcessors=1,}, 0x0, ) == 0x0 00005 2020 NtAllocateVirtualMemory (-1, 0, 0, 1048576, 8192, 4, ... 1310720, 1048576, ) == 0x0 00006 2020 NtAllocateVirtualMemory (-1, 1310720, 0, 4096, 4096, 4, ... 1310720, 4096, ) == 0x0 00007 2020 NtAllocateVirtualMemory (-1, 1314816, 0, 8192, 4096, 4, ... 1314816, 8192, ) == 0x0 00008 2020 NtQuerySystemInformation (Basic, 44, ... {Unknown=0,MaximumIncrement=156250,PhysicalPageSize=0x1000,NumberOfPhysicalPages=0xff7c,LowestPhysicalPage=0x1,HighestPhysicalPage=0xffff,AllocationGranularity=0x10000,LowestUserAddress=0x10000,HighestUserAddress=0x7ffeffff,ActiveProcessors=1,NumberProcessors=1,}, 0x0, ) == 0x0 00009 2020 NtAllocateVirtualMemory (-1, 0, 0, 65536, 8192, 4, ... 2359296, 65536, ) == 0x0 00010 2020 NtAllocateVirtualMemory (-1, 2359296, 0, 24576, 4096, 4, ... 2359296, 24576, ) == 0x0 00011 2020 NtOpenDirectoryObject (0x3, {24, 0, 0x40, 0, 0, (0x3, {24, 0, 0x40, 0, 0, "\KnownDlls"}, ... 8, ) }, ... 8, ) == 0x0 00012 2020 NtOpenSymbolicLinkObject (0x1, {24, 8, 0x40, 0, 0, (0x1, {24, 8, 0x40, 0, 0, "KnownDllPath"}, ... 12, ) }, ... 12, ) == 0x0 00013 2020 NtQuerySymbolicLinkObject (12, ... (12, ... "C:\WINDOWS\system32", 0x0, ) , 0x0, ) == 0x0 00014 2020 NtClose (12, ... ) == 0x0 00015 2020 NtOpenFile (0x100020, {24, 0, 0x42, 0, 0, (0x100020, {24, 0, 0x42, 0, 0, "\??\C:\scripts\"}, 3, 33, ... 12, {status=0x0, info=1}, ) }, 3, 33, ... 12, {status=0x0, info=1}, ) == 0x0 00016 2020 NtQueryVolumeInformationFile (12, 1243852, 8, Device, ... {status=0x0, info=8}, ) == 0x0 00017 2020 NtQueryAttributesFile ({24, 0, 0x40, 0, 0, ({24, 0, 0x40, 0, 0, "\??\u:\work\packed.exe.Local"}, 1243804, ... ) }, 1243804, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 00018 2020 NtOpenSection (0xe, {24, 8, 0x40, 0, 0, (0xe, {24, 8, 0x40, 0, 0, "kernel32.dll"}, ... 16, ) }, ... 16, ) == 0x0 00019 2020 NtMapViewOfSection (16, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x7c800000), 0x0, 1003520, ) == 0x0 00020 2020 NtClose (16, ... ) == 0x0 00021 2020 NtProtectVirtualMemory (-1, (0x7c801000), 1568, 4, ... (0x7c801000), 4096, 32, ) == 0x0 00022 2020 NtProtectVirtualMemory (-1, (0x7c801000), 4096, 32, ... (0x7c801000), 4096, 4, ) == 0x0 00023 2020 NtFlushInstructionCache (-1, 2088767488, 1568, ... ) == 0x0 00024 2020 NtQueryInformationProcess (-1, 36, 4, ... {process info, class 36, size 4}, 0x0, ) == 0x0 00025 2020 NtQuerySystemInformation (RangeStart, 4, ... {system info, class 50, size 4}, 0x0, ) == 0x0 00026 2020 NtQuerySystemInformation (Basic, 44, ... {Unknown=0,MaximumIncrement=156250,PhysicalPageSize=0x1000,NumberOfPhysicalPages=0xff7c,LowestPhysicalPage=0x1,HighestPhysicalPage=0xffff,AllocationGranularity=0x10000,LowestUserAddress=0x10000,HighestUserAddress=0x7ffeffff,ActiveProcessors=1,NumberProcessors=1,}, 0x0, ) == 0x0 00027 2020 NtCreateSection (0xf001f, 0x0, {65536, 0}, 4, 67108864, 0, ... 16, ) == 0x0 00028 2020 NtSecureConnectPort ( ("\Windows\ApiPort", {0, 2, 1, 1}, {24, 16, 0, 65536, 0, 0}, 1319736, {12, 0, 0}, 1241944, 44, ... 24, {24, 16, 0, 65536, 2424832, 19267584}, {0, 0, 0}, 200, 44, ) , {0, 2, 1, 1}, {24, 16, 0, 65536, 0, 0}, 1319736, {12, 0, 0}, 1241944, 44, ... 24, {24, 16, 0, 65536, 2424832, 19267584}, {0, 0, 0}, 200, 44, ) == 0x0 00029 2020 NtClose (16, ... ) == 0x0 00030 2020 NtQueryObject (24, Handle, 2, ... {Inherit=0,ProtectFromClose=0,}, -1, ) == 0x0 00031 2020 NtSetInformationObject (24, Handle, {Inherit=0,ProtectFromClose=1,}, 256, ... ) == 0x0 00032 2020 NtQuerySystemInformation (Basic, 44, ... {Unknown=0,MaximumIncrement=156250,PhysicalPageSize=0x1000,NumberOfPhysicalPages=0xff7c,LowestPhysicalPage=0x1,HighestPhysicalPage=0xffff,AllocationGranularity=0x10000,LowestUserAddress=0x10000,HighestUserAddress=0x7ffeffff,ActiveProcessors=1,NumberProcessors=1,}, 0x0, ) == 0x0 00033 2020 NtQueryVirtualMemory (-1, 0x250000, Basic, 28, ... {BaseAddress=0x250000,AllocationBase=0x250000,AllocationProtect=0x4,RegionSize=0x10000,State=0x2000,Protect=0x0,Type=0x40000,}, 0x0, ) == 0x0 00034 2020 NtAllocateVirtualMemory (-1, 2424832, 0, 4096, 4096, 4, ... 2424832, 4096, ) == 0x0 00035 2020 NtRequestWaitReplyPort (24, {28, 56, new_msg, 0, 1242260, 1242460, 2089900544, 1242184} (24, {28, 56, new_msg, 0, 1242260, 1242460, 2089900544, 1242184} "\210\6&\1\0\0\0\0eZ\221|\0\0\0\0\1\0\0\0\234\6&\1\4\0\0\0" ... {28, 56, reply, 0, 868, 2020, 75550, 0} "P\14\27\0\0\0\0\0\0\0\0\0\0\0\0\0\1\0\0\0\234\6&\1\4\0\0\0" ) ... {28, 56, reply, 0, 868, 2020, 75550, 0} (24, {28, 56, new_msg, 0, 1242260, 1242460, 2089900544, 1242184} "\210\6&\1\0\0\0\0eZ\221|\0\0\0\0\1\0\0\0\234\6&\1\4\0\0\0" ... {28, 56, reply, 0, 868, 2020, 75550, 0} "P\14\27\0\0\0\0\0\0\0\0\0\0\0\0\0\1\0\0\0\234\6&\1\4\0\0\0" ) ) == 0x0 00036 2020 NtRegisterThreadTerminatePort (24, ... ) == 0x0 00037 2020 NtAllocateVirtualMemory (-1, 1232896, 0, 4096, 4096, 260, ... 1232896, 4096, ) == 0x0 00038 2020 NtOpenKey (0x20019, {24, 0, 0x40, 0, 0, (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\System\CurrentControlSet\Control\Terminal Server"}, ... 16, ) }, ... 16, ) == 0x0 00039 2020 NtQueryValueKey (16, (16, "TSAppCompat", Partial, 548, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) , Partial, 548, ... TitleIdx=0, Type=4, Data= (16, "TSAppCompat", Partial, 548, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) }, 16, ) == 0x0 00040 2020 NtClose (16, ... ) == 0x0 00041 2020 NtOpenSection (0x4, {24, 0, 0x40, 0, 0, (0x4, {24, 0, 0x40, 0, 0, "\NLS\NlsSectionUnicode"}, ... 16, ) }, ... 16, ) == 0x0 00042 2020 NtMapViewOfSection (16, -1, (0x0), 0, 0, 0x0, 0, 2, 0, 2, ... (0x260000), 0x0, 90112, ) == 0x0 00043 2020 NtClose (16, ... ) == 0x0 00044 2020 NtQueryDefaultLocale (0, 2089305000, ... ) == 0x0 00045 2020 NtOpenSection (0x4, {24, 0, 0x40, 0, 0, (0x4, {24, 0, 0x40, 0, 0, "\NLS\NlsSectionLocale"}, ... 16, ) }, ... 16, ) == 0x0 00046 2020 NtMapViewOfSection (16, -1, (0x0), 0, 0, 0x0, 0, 2, 0, 2, ... (0x280000), 0x0, 249856, ) == 0x0 00047 2020 NtClose (16, ... ) == 0x0 00048 2020 NtOpenSection (0x5, {24, 0, 0x40, 0, 0, (0x5, {24, 0, 0x40, 0, 0, "\NLS\NlsSectionSortkey"}, ... 16, ) }, ... 16, ) == 0x0 00049 2020 NtMapViewOfSection (16, -1, (0x0), 0, 0, 0x0, 0, 2, 0, 2, ... (0x2c0000), 0x0, 266240, ) == 0x0 00050 2020 NtQuerySection (16, Basic, 16, ... {BaseAddress=0x0,Attributes=0x800000,Size={0x40004, 0x0},}, 0x0, ) == 0x0 00051 2020 NtClose (16, ... ) == 0x0 00052 2020 NtOpenSection (0x4, {24, 0, 0x40, 0, 0, (0x4, {24, 0, 0x40, 0, 0, "\NLS\NlsSectionSortTbls"}, ... 16, ) }, ... 16, ) == 0x0 00053 2020 NtMapViewOfSection (16, -1, (0x0), 0, 0, 0x0, 0, 2, 0, 2, ... (0x310000), 0x0, 24576, ) == 0x0 00054 2020 NtClose (16, ... ) == 0x0 00055 2020 NtQueryVirtualMemory (-1, 0x7ffd2000, Basic, 28, ... {BaseAddress=0x7ffd2000,AllocationBase=0x7ffb0000,AllocationProtect=0x2,RegionSize=0x2000,State=0x1000,Protect=0x2,Type=0x40000,}, 0x0, ) == 0x0 00056 2020 NtOpenSection (0x4, {24, 0, 0x40, 0, 0, (0x4, {24, 0, 0x40, 0, 0, "\NLS\NlsSectionSortkey00000409"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 00057 2020 NtOpenSection (0x4, {24, 0, 0x40, 0, 0, (0x4, {24, 0, 0x40, 0, 0, "\NLS\NlsSectionSortkey00000409"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 00058 2020 NtAllocateVirtualMemory (-1, 2428928, 0, 8192, 4096, 4, ... 2428928, 8192, ) == 0x0 00059 2020 NtRequestWaitReplyPort (24, {24, 52, new_msg, 0, 7012468, 7929957, 3145776, 3145776} (24, {24, 52, new_msg, 0, 7012468, 7929957, 3145776, 3145776} "\210\6&\1\36\0\1\0\0\0\0\0\377\377\377\377\234\6&\1p\30\0\0" ... {24, 52, reply, 0, 868, 2020, 75571, 0} "\10P\30\0\36\0\1\0\0\0\0\0\377\377\377\377\234\6&\1p\30\0\0" ) ... {24, 52, reply, 0, 868, 2020, 75571, 0} (24, {24, 52, new_msg, 0, 7012468, 7929957, 3145776, 3145776} "\210\6&\1\36\0\1\0\0\0\0\0\377\377\377\377\234\6&\1p\30\0\0" ... {24, 52, reply, 0, 868, 2020, 75571, 0} "\10P\30\0\36\0\1\0\0\0\0\0\377\377\377\377\234\6&\1p\30\0\0" ) ) == 0x0 00060 2020 NtRequestWaitReplyPort (24, {28, 56, new_msg, 0, 2089305760, 2090321376, 0, 0} (24, {28, 56, new_msg, 0, 2089305760, 2090321376, 0, 0} "\210\6&\1\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\234\6&\18\6\0\0" ... {28, 56, reply, 0, 868, 2020, 75572, 0} "\250\202\26\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\234\6&\18\6\0\0" ) ... {28, 56, reply, 0, 868, 2020, 75572, 0} (24, {28, 56, new_msg, 0, 2089305760, 2090321376, 0, 0} "\210\6&\1\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\234\6&\18\6\0\0" ... {28, 56, reply, 0, 868, 2020, 75572, 0} "\250\202\26\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\234\6&\18\6\0\0" ) ) == 0x0 00061 2020 NtProtectVirtualMemory (-1, (0x46b000), 151552, 4, ... (0x46b000), 151552, 128, ) == 0x0 00062 2020 NtProtectVirtualMemory (-1, (0x46b000), 151552, 128, ... (0x46b000), 151552, 4, ) == 0x0 00063 2020 NtFlushInstructionCache (-1, 4632576, 151552, ... ) == 0x0 00064 2020 NtOpenSection (0xe, {24, 8, 0x40, 0, 0, (0xe, {24, 8, 0x40, 0, 0, "ws2_32.dll"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 00065 2020 NtAllocateVirtualMemory (-1, 1323008, 0, 4096, 4096, 4, ... 1323008, 4096, ) == 0x0 00066 2020 NtQueryAttributesFile ({24, 0, 0x40, 0, 0, ({24, 0, 0x40, 0, 0, "\??\u:\work\ws2_32.dll"}, 1242572, ... ) }, 1242572, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 00067 2020 NtFsControlFile (12, 0, 0x0, 0x0, 0x90028, 0x0, 0, 0, ... {status=0x0, info=0}, 0x0, ) == 0x0 00068 2020 NtQueryAttributesFile ({24, 0, 0x40, 0, 0, ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\ws2_32.dll"}, 1242572, ... ) }, 1242572, ... ) == 0x0 00069 2020 NtOpenFile (0x100020, {24, 0, 0x40, 0, 0, (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\ws2_32.dll"}, 5, 96, ... 16, {status=0x0, info=1}, ) }, 5, 96, ... 16, {status=0x0, info=1}, ) == 0x0 00070 2020 NtCreateSection (0xf, 0x0, 0x0, 16, 16777216, 16, ... 28, ) == 0x0 00071 2020 NtQuerySection (28, Image, 48, ... {section info, class 1, size 48}, 0x0, ) == 0x0 00072 2020 NtOpenProcessToken (-1, 0x8, ... 32, ) == 0x0 00073 2020 NtQueryInformationToken (32, User, 136, ... {token info, class 1, size 36}, 36, ) == 0x0 00074 2020 NtOpenKey (0x3, {24, 0, 0x40, 0, 0, (0x3, {24, 0, 0x40, 0, 0, "\Registry\MACHINE\System\CurrentControlSet\Control\SafeBoot\Option"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 00075 2020 NtOpenKey (0x1, {24, 0, 0x40, 0, 0, (0x1, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers"}, ... 36, ) }, ... 36, ) == 0x0 00076 2020 NtQueryValueKey (36, (36, "TransparentEnabled", Partial, 80, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) , Partial, 80, ... TitleIdx=0, Type=4, Data= (36, "TransparentEnabled", Partial, 80, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) }, 16, ) == 0x0 00077 2020 NtClose (36, ... ) == 0x0 00078 2020 NtOpenThreadTokenEx (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN 00079 2020 NtOpenProcessTokenEx (-1, 0x20008, 512, ... 36, ) == 0x0 00080 2020 NtQueryInformationToken (36, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0 00081 2020 NtClose (36, ... ) == 0x0 00082 2020 NtOpenKey (0x1, {24, 0, 0x40, 0, 0, (0x1, {24, 0, 0x40, 0, 0, "\REGISTRY\USER\S-1-5-21-1292428093-1383384898-725345543-1003\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 00083 2020 NtClose (32, ... ) == 0x0 00084 2020 NtClose (16, ... ) == 0x0 00085 2020 NtMapViewOfSection (28, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x71ab0000), 0x0, 94208, ) == 0x0 00086 2020 NtClose (28, ... ) == 0x0 00087 2020 NtOpenSection (0xe, {24, 8, 0x40, 0, 0, (0xe, {24, 8, 0x40, 0, 0, "msvcrt.dll"}, ... 28, ) }, ... 28, ) == 0x0 00088 2020 NtMapViewOfSection (28, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x77c10000), 0x0, 360448, ) == 0x0 00089 2020 NtClose (28, ... ) == 0x0 00090 2020 NtProtectVirtualMemory (-1, (0x77c11000), 632, 4, ... (0x77c11000), 4096, 32, ) == 0x0 00091 2020 NtProtectVirtualMemory (-1, (0x77c11000), 4096, 32, ... (0x77c11000), 4096, 4, ) == 0x0 00092 2020 NtFlushInstructionCache (-1, 2009141248, 632, ... ) == 0x0 00093 2020 NtProtectVirtualMemory (-1, (0x71ab1000), 468, 4, ... (0x71ab1000), 4096, 32, ) == 0x0 00094 2020 NtProtectVirtualMemory (-1, (0x71ab1000), 4096, 32, ... (0x71ab1000), 4096, 4, ) == 0x0 00095 2020 NtFlushInstructionCache (-1, 1907036160, 468, ... ) == 0x0 00096 2020 NtOpenSection (0xe, {24, 8, 0x40, 0, 0, (0xe, {24, 8, 0x40, 0, 0, "WS2HELP.dll"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 00097 2020 NtQueryAttributesFile ({24, 0, 0x40, 0, 0, ({24, 0, 0x40, 0, 0, "\??\u:\work\WS2HELP.dll"}, 1241756, ... ) }, 1241756, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 00098 2020 NtQueryAttributesFile ({24, 0, 0x40, 0, 0, ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\WS2HELP.dll"}, 1241756, ... ) }, 1241756, ... ) == 0x0 00099 2020 NtOpenFile (0x100020, {24, 0, 0x40, 0, 0, (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\WS2HELP.dll"}, 5, 96, ... 28, {status=0x0, info=1}, ) }, 5, 96, ... 28, {status=0x0, info=1}, ) == 0x0 00100 2020 NtCreateSection (0xf, 0x0, 0x0, 16, 16777216, 28, ... 16, ) == 0x0 00101 2020 NtQuerySection (16, Image, 48, ... {section info, class 1, size 48}, 0x0, ) == 0x0 00102 2020 NtClose (28, ... ) == 0x0 00103 2020 NtMapViewOfSection (16, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x71aa0000), 0x0, 32768, ) == 0x0 00104 2020 NtClose (16, ... ) == 0x0 00105 2020 NtOpenSection (0xe, {24, 8, 0x40, 0, 0, (0xe, {24, 8, 0x40, 0, 0, "ADVAPI32.dll"}, ... 16, ) }, ... 16, ) == 0x0 00106 2020 NtMapViewOfSection (16, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x77dd0000), 0x0, 634880, ) == 0x0 00107 2020 NtClose (16, ... ) == 0x0 00108 2020 NtProtectVirtualMemory (-1, (0x77dd1000), 1700, 4, ... (0x77dd1000), 4096, 32, ) == 0x0 00109 2020 NtProtectVirtualMemory (-1, (0x77dd1000), 4096, 32, ... (0x77dd1000), 4096, 4, ) == 0x0 00110 2020 NtFlushInstructionCache (-1, 2010976256, 1700, ... ) == 0x0 00111 2020 NtOpenSection (0xe, {24, 8, 0x40, 0, 0, (0xe, {24, 8, 0x40, 0, 0, "RPCRT4.dll"}, ... 16, ) }, ... 16, ) == 0x0 00112 2020 NtMapViewOfSection (16, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x77e70000), 0x0, 593920, ) == 0x0 00113 2020 NtClose (16, ... ) == 0x0 00114 2020 NtProtectVirtualMemory (-1, (0x77e71000), 868, 4, ... (0x77e71000), 4096, 32, ) == 0x0 00115 2020 NtProtectVirtualMemory (-1, (0x77e71000), 4096, 32, ... (0x77e71000), 4096, 4, ) == 0x0 00116 2020 NtFlushInstructionCache (-1, 2011631616, 868, ... ) == 0x0 00117 2020 NtProtectVirtualMemory (-1, (0x77e71000), 868, 4, ... (0x77e71000), 4096, 32, ) == 0x0 00118 2020 NtProtectVirtualMemory (-1, (0x77e71000), 4096, 32, ... (0x77e71000), 4096, 4, ) == 0x0 00119 2020 NtFlushInstructionCache (-1, 2011631616, 868, ... ) == 0x0 00120 2020 NtProtectVirtualMemory (-1, (0x77e71000), 868, 4, ... (0x77e71000), 4096, 32, ) == 0x0 00121 2020 NtProtectVirtualMemory (-1, (0x77e71000), 4096, 32, ... (0x77e71000), 4096, 4, ) == 0x0 00122 2020 NtFlushInstructionCache (-1, 2011631616, 868, ... ) == 0x0 00123 2020 NtProtectVirtualMemory (-1, (0x77dd1000), 1700, 4, ... (0x77dd1000), 4096, 32, ) == 0x0 00124 2020 NtProtectVirtualMemory (-1, (0x77dd1000), 4096, 32, ... (0x77dd1000), 4096, 4, ) == 0x0 00125 2020 NtFlushInstructionCache (-1, 2010976256, 1700, ... ) == 0x0 00126 2020 NtProtectVirtualMemory (-1, (0x71aa1000), 352, 4, ... (0x71aa1000), 4096, 32, ) == 0x0 00127 2020 NtProtectVirtualMemory (-1, (0x71aa1000), 4096, 32, ... (0x71aa1000), 4096, 4, ) == 0x0 00128 2020 NtFlushInstructionCache (-1, 1906970624, 352, ... ) == 0x0 00129 2020 NtProtectVirtualMemory (-1, (0x71ab1000), 468, 4, ... (0x71ab1000), 4096, 32, ) == 0x0 00130 2020 NtProtectVirtualMemory (-1, (0x71ab1000), 4096, 32, ... (0x71ab1000), 4096, 4, ) == 0x0 00131 2020 NtFlushInstructionCache (-1, 1907036160, 468, ... ) == 0x0 00132 2020 NtProtectVirtualMemory (-1, (0x46b000), 151552, 4, ... (0x46b000), 151552, 64, ) == 0x0 00133 2020 NtProtectVirtualMemory (-1, (0x46b000), 151552, 64, ... (0x46b000), 151552, 4, ) == 0x0 00134 2020 NtFlushInstructionCache (-1, 4632576, 151552, ... ) == 0x0 00135 2020 NtOpenSection (0xe, {24, 8, 0x40, 0, 0, (0xe, {24, 8, 0x40, 0, 0, "oleaut32.dll"}, ... 16, ) }, ... 16, ) == 0x0 00136 2020 NtMapViewOfSection (16, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x77120000), 0x0, 569344, ) == 0x0 00137 2020 NtClose (16, ... ) == 0x0 00138 2020 NtProtectVirtualMemory (-1, (0x77121000), 1272, 4, ... (0x77121000), 4096, 32, ) == 0x0 00139 2020 NtProtectVirtualMemory (-1, (0x77121000), 4096, 32, ... (0x77121000), 4096, 4, ) == 0x0 00140 2020 NtFlushInstructionCache (-1, 1997672448, 1272, ... ) == 0x0 00141 2020 NtOpenSection (0xe, {24, 8, 0x40, 0, 0, (0xe, {24, 8, 0x40, 0, 0, "GDI32.dll"}, ... 16, ) }, ... 16, ) == 0x0 00142 2020 NtMapViewOfSection (16, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x77f10000), 0x0, 290816, ) == 0x0 00143 2020 NtClose (16, ... ) == 0x0 00144 2020 NtProtectVirtualMemory (-1, (0x77f11000), 508, 4, ... (0x77f11000), 4096, 32, ) == 0x0 00145 2020 NtProtectVirtualMemory (-1, (0x77f11000), 4096, 32, ... (0x77f11000), 4096, 4, ) == 0x0 00146 2020 NtFlushInstructionCache (-1, 2012286976, 508, ... ) == 0x0 00147 2020 NtProtectVirtualMemory (-1, (0x77f11000), 508, 4, ... (0x77f11000), 4096, 32, ) == 0x0 00148 2020 NtProtectVirtualMemory (-1, (0x77f11000), 4096, 32, ... (0x77f11000), 4096, 4, ) == 0x0 00149 2020 NtFlushInstructionCache (-1, 2012286976, 508, ... ) == 0x0 00150 2020 NtOpenSection (0xe, {24, 8, 0x40, 0, 0, (0xe, {24, 8, 0x40, 0, 0, "USER32.dll"}, ... 16, ) }, ... 16, ) == 0x0 00151 2020 NtMapViewOfSection (16, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x7e410000), 0x0, 589824, ) == 0x0 00152 2020 NtClose (16, ... ) == 0x0 00153 2020 NtProtectVirtualMemory (-1, (0x7e411000), 1252, 4, ... (0x7e411000), 4096, 32, ) == 0x0 00154 2020 NtProtectVirtualMemory (-1, (0x7e411000), 4096, 32, ... (0x7e411000), 4096, 4, ) == 0x0 00155 2020 NtFlushInstructionCache (-1, 2118193152, 1252, ... ) == 0x0 00156 2020 NtProtectVirtualMemory (-1, (0x7e411000), 1252, 4, ... (0x7e411000), 4096, 32, ) == 0x0 00157 2020 NtProtectVirtualMemory (-1, (0x7e411000), 4096, 32, ... (0x7e411000), 4096, 4, ) == 0x0 00158 2020 NtFlushInstructionCache (-1, 2118193152, 1252, ... ) == 0x0 00159 2020 NtProtectVirtualMemory (-1, (0x7e411000), 1252, 4, ... (0x7e411000), 4096, 32, ) == 0x0 00160 2020 NtProtectVirtualMemory (-1, (0x7e411000), 4096, 32, ... (0x7e411000), 4096, 4, ) == 0x0 00161 2020 NtFlushInstructionCache (-1, 2118193152, 1252, ... ) == 0x0 00162 2020 NtProtectVirtualMemory (-1, (0x77f11000), 508, 4, ... (0x77f11000), 4096, 32, ) == 0x0 00163 2020 NtProtectVirtualMemory (-1, (0x77f11000), 4096, 32, ... (0x77f11000), 4096, 4, ) == 0x0 00164 2020 NtFlushInstructionCache (-1, 2012286976, 508, ... ) == 0x0 00165 2020 NtProtectVirtualMemory (-1, (0x77121000), 1272, 4, ... (0x77121000), 4096, 32, ) == 0x0 00166 2020 NtProtectVirtualMemory (-1, (0x77121000), 4096, 32, ... (0x77121000), 4096, 4, ) == 0x0 00167 2020 NtFlushInstructionCache (-1, 1997672448, 1272, ... ) == 0x0 00168 2020 NtProtectVirtualMemory (-1, (0x77121000), 1272, 4, ... (0x77121000), 4096, 32, ) == 0x0 00169 2020 NtProtectVirtualMemory (-1, (0x77121000), 4096, 32, ... (0x77121000), 4096, 4, ) == 0x0 00170 2020 NtFlushInstructionCache (-1, 1997672448, 1272, ... ) == 0x0 00171 2020 NtProtectVirtualMemory (-1, (0x77121000), 1272, 4, ... (0x77121000), 4096, 32, ) == 0x0 00172 2020 NtProtectVirtualMemory (-1, (0x77121000), 4096, 32, ... (0x77121000), 4096, 4, ) == 0x0 00173 2020 NtFlushInstructionCache (-1, 1997672448, 1272, ... ) == 0x0 00174 2020 NtOpenSection (0xe, {24, 8, 0x40, 0, 0, (0xe, {24, 8, 0x40, 0, 0, "ole32.dll"}, ... 16, ) }, ... 16, ) == 0x0 00175 2020 NtMapViewOfSection (16, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x774e0000), 0x0, 1298432, ) == 0x0 00176 2020 NtClose (16, ... ) == 0x0 00177 2020 NtProtectVirtualMemory (-1, (0x774e1000), 2352, 4, ... (0x774e1000), 4096, 32, ) == 0x0 00178 2020 NtProtectVirtualMemory (-1, (0x774e1000), 4096, 32, ... (0x774e1000), 4096, 4, ) == 0x0 00179 2020 NtFlushInstructionCache (-1, 2001604608, 2352, ... ) == 0x0 00180 2020 NtProtectVirtualMemory (-1, (0x774e1000), 2352, 4, ... (0x774e1000), 4096, 32, ) == 0x0 00181 2020 NtProtectVirtualMemory (-1, (0x774e1000), 4096, 32, ... (0x774e1000), 4096, 4, ) == 0x0 00182 2020 NtFlushInstructionCache (-1, 2001604608, 2352, ... ) == 0x0 00183 2020 NtProtectVirtualMemory (-1, (0x774e1000), 2352, 4, ... (0x774e1000), 4096, 32, ) == 0x0 00184 2020 NtProtectVirtualMemory (-1, (0x774e1000), 4096, 32, ... (0x774e1000), 4096, 4, ) == 0x0 00185 2020 NtFlushInstructionCache (-1, 2001604608, 2352, ... ) == 0x0 00186 2020 NtProtectVirtualMemory (-1, (0x774e1000), 2352, 4, ... (0x774e1000), 4096, 32, ) == 0x0 00187 2020 NtProtectVirtualMemory (-1, (0x774e1000), 4096, 32, ... (0x774e1000), 4096, 4, ) == 0x0 00188 2020 NtFlushInstructionCache (-1, 2001604608, 2352, ... ) == 0x0 00189 2020 NtProtectVirtualMemory (-1, (0x774e1000), 2352, 4, ... (0x774e1000), 4096, 32, ) == 0x0 00190 2020 NtProtectVirtualMemory (-1, (0x774e1000), 4096, 32, ... (0x774e1000), 4096, 4, ) == 0x0 00191 2020 NtFlushInstructionCache (-1, 2001604608, 2352, ... ) == 0x0 00192 2020 NtProtectVirtualMemory (-1, (0x774e1000), 2352, 4, ... (0x774e1000), 4096, 32, ) == 0x0 00193 2020 NtProtectVirtualMemory (-1, (0x774e1000), 4096, 32, ... (0x774e1000), 4096, 4, ) == 0x0 00194 2020 NtFlushInstructionCache (-1, 2001604608, 2352, ... ) == 0x0 00195 2020 NtProtectVirtualMemory (-1, (0x774e1000), 2352, 4, ... (0x774e1000), 4096, 32, ) == 0x0 00196 2020 NtProtectVirtualMemory (-1, (0x774e1000), 4096, 32, ... (0x774e1000), 4096, 4, ) == 0x0 00197 2020 NtFlushInstructionCache (-1, 2001604608, 2352, ... ) == 0x0 00198 2020 NtProtectVirtualMemory (-1, (0x77121000), 1272, 4, ... (0x77121000), 4096, 32, ) == 0x0 00199 2020 NtProtectVirtualMemory (-1, (0x77121000), 4096, 32, ... (0x77121000), 4096, 4, ) == 0x0 00200 2020 NtFlushInstructionCache (-1, 1997672448, 1272, ... ) == 0x0 00201 2020 NtProtectVirtualMemory (-1, (0x77121000), 1272, 4, ... (0x77121000), 4096, 32, ) == 0x0 00202 2020 NtProtectVirtualMemory (-1, (0x77121000), 4096, 32, ... (0x77121000), 4096, 4, ) == 0x0 00203 2020 NtFlushInstructionCache (-1, 1997672448, 1272, ... ) == 0x0 00204 2020 NtProtectVirtualMemory (-1, (0x77121000), 1272, 4, ... (0x77121000), 4096, 32, ) == 0x0 00205 2020 NtProtectVirtualMemory (-1, (0x77121000), 4096, 32, ... (0x77121000), 4096, 4, ) == 0x0 00206 2020 NtFlushInstructionCache (-1, 1997672448, 1272, ... ) == 0x0 00207 2020 NtProtectVirtualMemory (-1, (0x46b000), 151552, 4, ... (0x46b000), 151552, 64, ) == 0x0 00208 2020 NtProtectVirtualMemory (-1, (0x46b000), 151552, 64, ... (0x46b000), 151552, 4, ) == 0x0 00209 2020 NtFlushInstructionCache (-1, 4632576, 151552, ... ) == 0x0 00210 2020 NtProtectVirtualMemory (-1, (0x46b000), 151552, 4, ... (0x46b000), 151552, 64, ) == 0x0 00211 2020 NtProtectVirtualMemory (-1, (0x46b000), 151552, 64, ... (0x46b000), 151552, 4, ) == 0x0 00212 2020 NtFlushInstructionCache (-1, 4632576, 151552, ... ) == 0x0 00213 2020 NtQueryInformationProcess (-1, 37, 48, ... {process info, class 37, size 48}, 0x0, ) == 0x0 00214 2020 NtOpenFile (0x100001, {24, 0, 0x40, 0, 0, (0x100001, {24, 0, 0x40, 0, 0, "\??\u:\work\packed.exe"}, 5, 96, ... 16, {status=0x0, info=1}, ) }, 5, 96, ... 16, {status=0x0, info=1}, ) == 0x0 00215 2020 NtReadFile (16, 0, 0, 0, 4, {265212, 0}, 0, ... {status=0x0, info=4}, (16, 0, 0, 0, 4, {265212, 0}, 0, ... {status=0x0, info=4}, "\0\0\0\0", ) , ) == 0x0 00216 2020 NtReadFile (16, 0, 0, 0, 8, {265204, 0}, 0, ... {status=0x0, info=8}, (16, 0, 0, 0, 8, {265204, 0}, 0, ... {status=0x0, info=8}, "\0\0\0\0\0\0\0\0", ) , ) == 0x0 00217 2020 NtReadFile (16, 0, 0, 0, 4, {0, 0}, 0, ... {status=0x0, info=4}, (16, 0, 0, 0, 4, {0, 0}, 0, ... {status=0x0, info=4}, "MZ\220\0", ) , ) == 0x0 00218 2020 NtClose (16, ... ) == 0x0 00219 2020 NtSetInformationProcess (-1, 34, {process info, class 34, size 4}, 4, ... ) == 0x0 00220 2020 NtOpenProcessToken (-1, 0x8, ... 16, ) == 0x0 00221 2020 NtQueryInformationToken (16, Statistics, 56, ... {token info, class 10, size 56}, 56, ) == 0x0 00222 2020 NtClose (16, ... ) == 0x0 00223 2020 NtOpenKey (0x20019, {24, 0, 0x40, 0, 0, (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\System\CurrentControlSet\Control\Terminal Server"}, ... 16, ) }, ... 16, ) == 0x0 00224 2020 NtQueryValueKey (16, (16, "TSAppCompat", Partial, 548, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) , Partial, 548, ... TitleIdx=0, Type=4, Data= (16, "TSAppCompat", Partial, 548, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) }, 16, ) == 0x0 00225 2020 NtClose (16, ... ) == 0x0 00226 2020 NtOpenKey (0x80000000, {24, 0, 0x40, 0, 0, (0x80000000, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msvcrt.dll"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 00227 2020 NtQuerySystemInformation (Basic, 44, ... {Unknown=0,MaximumIncrement=156250,PhysicalPageSize=0x1000,NumberOfPhysicalPages=0xff7c,LowestPhysicalPage=0x1,HighestPhysicalPage=0xffff,AllocationGranularity=0x10000,LowestUserAddress=0x10000,HighestUserAddress=0x7ffeffff,ActiveProcessors=1,NumberProcessors=1,}, 0x0, ) == 0x0 00228 2020 NtAllocateVirtualMemory (-1, 0, 0, 65536, 8192, 4, ... 3276800, 65536, ) == 0x0 00229 2020 NtAllocateVirtualMemory (-1, 3276800, 0, 4096, 4096, 4, ... 3276800, 4096, ) == 0x0 00230 2020 NtAllocateVirtualMemory (-1, 3280896, 0, 8192, 4096, 4, ... 3280896, 8192, ) == 0x0 00231 2020 NtAllocateVirtualMemory (-1, 3289088, 0, 4096, 4096, 4, ... 3289088, 4096, ) == 0x0 00232 2020 NtOpenSection (0x4, {24, 0, 0x40, 0, 0, (0x4, {24, 0, 0x40, 0, 0, "\NLS\NlsSectionCType"}, ... 16, ) }, ... 16, ) == 0x0 00233 2020 NtMapViewOfSection (16, -1, (0x0), 0, 0, 0x0, 0, 2, 0, 2, ... (0x330000), 0x0, 12288, ) == 0x0 00234 2020 NtClose (16, ... ) == 0x0 00235 2020 NtAllocateVirtualMemory (-1, 3293184, 0, 4096, 4096, 4, ... 3293184, 4096, ) == 0x0 00236 2020 NtQueryVirtualMemory (-1, 0x77c2807c, Basic, 28, ... {BaseAddress=0x77c28000,AllocationBase=0x77c10000,AllocationProtect=0x80,RegionSize=0x35000,State=0x1000,Protect=0x20,Type=0x1000000,}, 28, ) == 0x0 00237 2020 NtQueryInformationProcess (-1, 36, 4, ... {process info, class 36, size 4}, 0x0, ) == 0x0 00238 2020 NtQueryInformationProcess (-1, 36, 4, ... {process info, class 36, size 4}, 0x0, ) == 0x0 00239 2020 NtQueryVirtualMemory (-1, 0x0, Basic, 28, ... {BaseAddress=0x0,AllocationBase=0x0,AllocationProtect=0x0,RegionSize=0x10000,State=0x10000,Protect=0x1,Type=0x0,}, 28, ) == 0x0 00240 2020 NtOpenKey (0x80000000, {24, 0, 0x40, 0, 0, (0x80000000, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RPCRT4.dll"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 00241 2020 NtOpenKey (0x80000000, {24, 0, 0x40, 0, 0, (0x80000000, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ADVAPI32.dll"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 00242 2020 NtOpenKey (0x20019, {24, 0, 0x40, 0, 0, (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\System\CurrentControlSet\Control\Terminal Server"}, ... 16, ) }, ... 16, ) == 0x0 00243 2020 NtQueryValueKey (16, (16, "TSAppCompat", Partial, 548, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) , Partial, 548, ... TitleIdx=0, Type=4, Data= (16, "TSAppCompat", Partial, 548, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) }, 16, ) == 0x0 00244 2020 NtQueryValueKey (16, (16, "TSUserEnabled", Partial, 548, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) , Partial, 548, ... TitleIdx=0, Type=4, Data= (16, "TSUserEnabled", Partial, 548, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) }, 16, ) == 0x0 00245 2020 NtClose (16, ... ) == 0x0 00246 2020 NtOpenKey (0x20019, {24, 0, 0x40, 0, 0, (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon"}, ... 16, ) }, ... 16, ) == 0x0 00247 2020 NtQueryValueKey (16, (16, "LeakTrack", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 00248 2020 NtClose (16, ... ) == 0x0 00249 2020 NtOpenKey (0x2000000, {24, 0, 0x40, 0, 0, (0x2000000, {24, 0, 0x40, 0, 0, "\REGISTRY\MACHINE"}, ... 16, ) }, ... 16, ) == 0x0 00250 2020 NtSetInformationObject (16, Handle, {Inherit=0,ProtectFromClose=1,}, 2011431168, ... ) == 0x0 00251 2020 NtOpenKey (0x20019, {24, 16, 0x40, 0, 0, (0x20019, {24, 16, 0x40, 0, 0, "Software\Microsoft\Windows NT\CurrentVersion\Diagnostics"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 00252 2020 NtOpenKey (0x80000000, {24, 0, 0x40, 0, 0, (0x80000000, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\WS2HELP.dll"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 00253 2020 NtOpenKey (0x80000000, {24, 0, 0x40, 0, 0, (0x80000000, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ws2_32.dll"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 00254 2020 NtQuerySystemInformation (Basic, 44, ... {Unknown=0,MaximumIncrement=156250,PhysicalPageSize=0x1000,NumberOfPhysicalPages=0xff7c,LowestPhysicalPage=0x1,HighestPhysicalPage=0xffff,AllocationGranularity=0x10000,LowestUserAddress=0x10000,HighestUserAddress=0x7ffeffff,ActiveProcessors=1,NumberProcessors=1,}, 0x0, ) == 0x0 00255 2020 NtQuerySystemInformation (Processor, 12, ... {system info, class 1, size 12}, 0x0, ) == 0x0 00256 2020 NtOpenKey (0x80000000, {24, 0, 0x40, 0, 0, (0x80000000, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\USER32.dll"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 00257 2020 NtQuerySystemInformation (Basic, 44, ... {Unknown=0,MaximumIncrement=156250,PhysicalPageSize=0x1000,NumberOfPhysicalPages=0xff7c,LowestPhysicalPage=0x1,HighestPhysicalPage=0xffff,AllocationGranularity=0x10000,LowestUserAddress=0x10000,HighestUserAddress=0x7ffeffff,ActiveProcessors=1,NumberProcessors=1,}, 0x0, ) == 0x0 00258 2020 NtRequestWaitReplyPort (24, {28, 56, new_msg, 0, 256, 1243092, 256, 1242836} (24, {28, 56, new_msg, 0, 256, 1243092, 256, 1242836} "\210\6&\1\0\0\0\0\0\0\0\0\1\0\0\0\3\0\0\0\234\6&\1$\1\0\0" ... {28, 56, reply, 0, 868, 2020, 75642, 0} "\320G\26\0\0\0\0\0\0\0\0\0\1\0\0\0\3\0\0\0\234\6&\1$\1\0\0" ) ... {28, 56, reply, 0, 868, 2020, 75642, 0} (24, {28, 56, new_msg, 0, 256, 1243092, 256, 1242836} "\210\6&\1\0\0\0\0\0\0\0\0\1\0\0\0\3\0\0\0\234\6&\1$\1\0\0" ... {28, 56, reply, 0, 868, 2020, 75642, 0} "\320G\26\0\0\0\0\0\0\0\0\0\1\0\0\0\3\0\0\0\234\6&\1$\1\0\0" ) ) == 0x0 00259 2020 NtOpenKey (0x1, {24, 0, 0x40, 0, 0, (0x1, {24, 0, 0x40, 0, 0, "\Registry\MACHINE\System\CurrentControlSet\Control\Session Manager"}, ... 28, ) }, ... 28, ) == 0x0 00260 2020 NtQueryValueKey (28, (28, "SafeDllSearchMode", Partial, 16, ... ) , Partial, 16, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 00261 2020 NtClose (28, ... ) == 0x0 00262 2020 NtAllocateVirtualMemory (-1, 1327104, 0, 4096, 4096, 4, ... 1327104, 4096, ) == 0x0 00263 2020 NtQueryAttributesFile ({24, 0, 0x40, 0, 0, ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\IMM32.DLL"}, 1239420, ... ) }, 1239420, ... ) == 0x0 00264 2020 NtOpenFile (0x100020, {24, 0, 0x40, 0, 0, (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\IMM32.DLL"}, 5, 96, ... 28, {status=0x0, info=1}, ) }, 5, 96, ... 28, {status=0x0, info=1}, ) == 0x0 00265 2020 NtCreateSection (0xe, 0x0, 0x0, 16, 134217728, 28, ... 32, ) == 0x0 00266 2020 NtClose (28, ... ) == 0x0 00267 2020 NtMapViewOfSection (32, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 16, ... (0x340000), 0x0, 110592, ) == 0x0 00268 2020 NtClose (32, ... ) == 0x0 00269 2020 NtUnmapViewOfSection (-1, 0x340000, ... ) == 0x0 00270 2020 NtQueryAttributesFile ({24, 0, 0x40, 0, 0, ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\IMM32.DLL"}, 1239328, ... ) }, 1239328, ... ) == 0x0 00271 2020 NtOpenFile (0x100020, {24, 0, 0x40, 0, 0, (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\IMM32.DLL"}, 5, 96, ... 32, {status=0x0, info=1}, ) }, 5, 96, ... 32, {status=0x0, info=1}, ) == 0x0 00272 2020 NtCreateSection (0xe, 0x0, 0x0, 16, 134217728, 32, ... 28, ) == 0x0 00273 2020 NtClose (32, ... ) == 0x0 00274 2020 NtMapViewOfSection (28, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 16, ... (0x340000), 0x0, 110592, ) == 0x0 00275 2020 NtClose (28, ... ) == 0x0 00276 2020 NtUnmapViewOfSection (-1, 0x340000, ... ) == 0x0 00277 2020 NtQueryAttributesFile ({24, 0, 0x40, 0, 0, ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\IMM32.DLL"}, 1239636, ... ) }, 1239636, ... ) == 0x0 00278 2020 NtOpenFile (0x100020, {24, 0, 0x40, 0, 0, (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\IMM32.DLL"}, 5, 96, ... 28, {status=0x0, info=1}, ) }, 5, 96, ... 28, {status=0x0, info=1}, ) == 0x0 00279 2020 NtCreateSection (0xf, 0x0, 0x0, 16, 16777216, 28, ... 32, ) == 0x0 00280 2020 NtQuerySection (32, Image, 48, ... {section info, class 1, size 48}, 0x0, ) == 0x0 00281 2020 NtClose (28, ... ) == 0x0 00282 2020 NtMapViewOfSection (32, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x76390000), 0x0, 118784, ) == 0x0 00283 2020 NtClose (32, ... ) == 0x0 00284 2020 NtProtectVirtualMemory (-1, (0x76391000), 696, 4, ... (0x76391000), 4096, 32, ) == 0x0 00285 2020 NtProtectVirtualMemory (-1, (0x76391000), 4096, 32, ... (0x76391000), 4096, 4, ) == 0x0 00286 2020 NtFlushInstructionCache (-1, 1983451136, 696, ... ) == 0x0 00287 2020 NtProtectVirtualMemory (-1, (0x76391000), 696, 4, ... (0x76391000), 4096, 32, ) == 0x0 00288 2020 NtProtectVirtualMemory (-1, (0x76391000), 4096, 32, ... (0x76391000), 4096, 4, ) == 0x0 00289 2020 NtFlushInstructionCache (-1, 1983451136, 696, ... ) == 0x0 00290 2020 NtProtectVirtualMemory (-1, (0x76391000), 696, 4, ... (0x76391000), 4096, 32, ) == 0x0 00291 2020 NtProtectVirtualMemory (-1, (0x76391000), 4096, 32, ... (0x76391000), 4096, 4, ) == 0x0 00292 2020 NtFlushInstructionCache (-1, 1983451136, 696, ... ) == 0x0 00293 2020 NtOpenKey (0x80000000, {24, 0, 0x40, 0, 0, (0x80000000, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\IMM32.DLL"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 00294 2020 NtQuerySystemInformation (Basic, 44, ... {Unknown=0,MaximumIncrement=156250,PhysicalPageSize=0x1000,NumberOfPhysicalPages=0xff7c,LowestPhysicalPage=0x1,HighestPhysicalPage=0xffff,AllocationGranularity=0x10000,LowestUserAddress=0x10000,HighestUserAddress=0x7ffeffff,ActiveProcessors=1,NumberProcessors=1,}, 0x0, ) == 0x0 00295 2020 NtAllocateVirtualMemory (-1, 1228800, 0, 4096, 4096, 260, ... 1228800, 4096, ) == 0x0 00296 2020 NtQueryAttributesFile ({24, 0, 0x40, 0, 0, ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\IMM32.DLL"}, 1236552, ... ) }, 1236552, ... ) == 0x0 00297 2020 NtOpenKey (0x80000000, {24, 0, 0x40, 0, 0, (0x80000000, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ntdll.dll"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 00298 2020 NtOpenKey (0x80000000, {24, 0, 0x40, 0, 0, (0x80000000, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kernel32.dll"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 00299 2020 NtOpenKey (0x80000000, {24, 0, 0x40, 0, 0, (0x80000000, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\GDI32.dll"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 00300 2020 NtOpenKey (0x80000000, {24, 0, 0x40, 0, 0, (0x80000000, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ole32.dll"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 00301 2020 NtOpenKey (0x80000000, {24, 0, 0x40, 0, 0, (0x80000000, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\oleaut32.dll"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 00302 2020 NtQueryAttributesFile ({24, 0, 0x40, 0, 0, ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\IMM32.DLL"}, 1239956, ... ) }, 1239956, ... ) == 0x0 00303 2020 NtOpenKey (0x20019, {24, 0, 0x40, 0, 0, (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\System\CurrentControlSet\Control\Error Message Instrument\"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 00304 2020 NtOpenKey (0x20019, {24, 0, 0x40, 0, 0, (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\GRE_Initialize"}, ... 32, ) }, ... 32, ) == 0x0 00305 2020 NtQueryValueKey (32, (32, "DisableMetaFiles", Partial, 20, ... ) , Partial, 20, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 00306 2020 NtClose (32, ... ) == 0x0 00307 2020 NtMapViewOfSection (-2147482576, -1, (0x0), 0, 0, 0x0, 0, 2, 0, 2, ... (0x570000), 0x0, 1060864, ) == 0x0 00308 2020 NtClose (-2147482576, ... ) == 0x0 00309 2020 NtCreateEvent (0x1f0003, 0x0, 1, 0, ... 32, ) == 0x0 00310 2020 NtOpenThreadTokenEx (-2, 0x8, 1, 512, ... ) == STATUS_NO_TOKEN 00311 2020 NtOpenProcessTokenEx (-1, 0x8, 512, ... -2147482576, ) == 0x0 00312 2020 NtQueryInformationToken (-2147482576, Statistics, 0, ... ) == STATUS_BUFFER_TOO_SMALL 00313 2020 NtQueryInformationToken (-2147482576, Statistics, 56, ... {token info, class 10, size 56}, 56, ) == 0x0 00314 2020 NtClose (-2147482576, ... ) == 0x0 00315 2020 NtAllocateVirtualMemory (-1, 0, 0, 32, 4096, 4, ... 3407872, 4096, ) == 0x0 00316 2020 NtFreeVirtualMemory (-1, (0x340000), 4096, 32768, ... (0x340000), 4096, ) == 0x0 00317 2020 NtDuplicateObject (-1, 28, -1, 0x0, 0, 2, ... 40, ) == 0x0 00318 2020 NtOpenKey (0x20019, {24, 0, 0x240, 0, 0, (0x20019, {24, 0, 0x240, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Compatibility32"}, ... -2147482576, ) }, ... -2147482576, ) == 0x0 00319 2020 NtQueryValueKey (-2147482576, (-2147482576, "packed", Partial, 172, ... ) , Partial, 172, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 00320 2020 NtClose (-2147482576, ... ) == 0x0 00321 2020 NtOpenKey (0x20019, {24, 0, 0x240, 0, 0, (0x20019, {24, 0, 0x240, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\IME Compatibility"}, ... -2147482576, ) }, ... -2147482576, ) == 0x0 00322 2020 NtQueryValueKey (-2147482576, (-2147482576, "packed", Partial, 172, ... ) , Partial, 172, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 00323 2020 NtClose (-2147482576, ... ) == 0x0 00324 2020 NtQueryDefaultLocale (0, -142005940, ... ) == 0x0 00325 2020 NtGdiQueryFontAssocInfo (0, ... ) == 0x0 00326 2020 NtUserCallNoParam (24, ... ) == 0x0 00327 2020 NtGdiCreateCompatibleDC (0, ... 00328 2020 NtAllocateVirtualMemory (-1, 0, 0, 4096, 12288, 4, ... 3407872, 4096, ) == 0x0 00327 2020 NtGdiCreateCompatibleDC ... ) == 0xb3010623 00329 2020 NtGdiGetStockObject (0, ... ) == 0x1900010 00330 2020 NtGdiGetStockObject (4, ... ) == 0x1900011 00331 2020 NtGdiCreateBitmap (8, 8, 1, 1, 2118200212, ... ) == 0x9f0504fb 00332 2020 NtGdiCreateSolidBrush (0, 0, ... 00333 2020 NtAllocateVirtualMemory (-1, 0, 0, 4096, 12288, 4, ... 3473408, 4096, ) == 0x0 00332 2020 NtGdiCreateSolidBrush ... ) == 0x8210062f 00334 2020 NtGdiGetStockObject (13, ... ) == 0x18a0021 00335 2020 NtGdiCreateCompatibleDC (0, ... ) == 0x5f01056a 00336 2020 NtGdiSelectBitmap (1593902442, -1627060997, ... ) == 0x185000f 00337 2020 NtUserGetThreadDesktop (2020, 0, ... ) == 0x24 00338 2020 NtOpenKey (0x20019, {24, 0, 0x40, 0, 0, (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Windows"}, ... 44, ) }, ... 44, ) == 0x0 00339 2020 NtQueryValueKey (44, (44, "AppInit_DLLs", Partial, 64, ... TitleIdx=0, Type=1, Data="\0\0"}, 14, ) , Partial, 64, ... TitleIdx=0, Type=1, Data= (44, "AppInit_DLLs", Partial, 64, ... TitleIdx=0, Type=1, Data="\0\0"}, 14, ) }, 14, ) == 0x0 00340 2020 NtClose (44, ... ) == 0x0 00341 2020 NtUserFindExistingCursorIcon (1241132, 1241148, 1241196, ... ) == 0x10011 00342 2020 NtUserRegisterClassExWOW (1241144, 1241212, 1241228, 1241244, 673, 128, 0, ... ) == 0x819fc017 00343 2020 NtUserFindExistingCursorIcon (1241132, 1241148, 1241196, ... ) == 0x10011 00344 2020 NtUserRegisterClassExWOW (1241144, 1241212, 1241228, 1241244, 674, 128, 0, ... ) == 0x819fc01c 00345 2020 NtUserFindExistingCursorIcon (1241132, 1241148, 1241196, ... ) == 0x10011 00346 2020 NtUserRegisterClassExWOW (1241144, 1241212, 1241228, 1241244, 675, 128, 0, ... ) == 0x819fc01e 00347 2020 NtUserFindExistingCursorIcon (1241132, 1241148, 1241196, ... ) == 0x10011 00348 2020 NtUserRegisterClassExWOW (1241144, 1241212, 1241228, 1241244, 676, 128, 0, ... ) == 0x819f8002 00349 2020 NtUserFindExistingCursorIcon (1241132, 1241148, 1241196, ... ) == 0x10013 00350 2020 NtUserRegisterClassExWOW (1241144, 1241212, 1241228, 1241244, 677, 128, 0, ... ) == 0x819fc018 00351 2020 NtUserFindExistingCursorIcon (1241132, 1241148, 1241196, ... ) == 0x10011 00352 2020 NtUserRegisterClassExWOW (1241144, 1241212, 1241228, 1241244, 678, 128, 0, ... ) == 0x819fc01a 00353 2020 NtUserFindExistingCursorIcon (1241132, 1241148, 1241196, ... ) == 0x10011 00354 2020 NtUserRegisterClassExWOW (1241144, 1241212, 1241228, 1241244, 679, 128, 0, ... ) == 0x819fc01d 00355 2020 NtUserFindExistingCursorIcon (1241132, 1241148, 1241196, ... ) == 0x10011 00356 2020 NtUserRegisterClassExWOW (1241144, 1241212, 1241228, 1241244, 681, 128, 0, ... ) == 0x819fc026 00357 2020 NtUserFindExistingCursorIcon (1241132, 1241148, 1241196, ... ) == 0x10011 00358 2020 NtUserRegisterClassExWOW (1241144, 1241212, 1241228, 1241244, 680, 128, 0, ... ) == 0x819fc019 00359 2020 NtUserRegisterClassExWOW (1241096, 1241164, 1241180, 1241196, 0, 128, 0, ... ) == 0x819fc020 00360 2020 NtUserRegisterClassExWOW (1241352, 1241448, 1241432, 1241420, 0, 130, 0, ... ) == 0x819fc022 00361 2020 NtUserRegisterClassExWOW (1241096, 1241164, 1241180, 1241196, 0, 128, 0, ... ) == 0x819fc023 00362 2020 NtUserRegisterClassExWOW (1241352, 1241448, 1241432, 1241420, 0, 130, 0, ... ) == 0x819fc024 00363 2020 NtUserRegisterClassExWOW (1241096, 1241164, 1241180, 1241196, 0, 128, 0, ... ) == 0x819fc025 00364 2020 NtCallbackReturn (0, 0, 0, ... 00365 2020 NtGdiInit (... ) == 0x1 00366 2020 NtGdiGetStockObject (18, ... ) == 0x290001c 00367 2020 NtGdiGetStockObject (19, ... ) == 0x1b00019 00368 2020 NtAllocateVirtualMemory (-1, 1331200, 0, 4096, 4096, 4, ... 1331200, 4096, ) == 0x0 00369 2020 NtOpenFile (0x100001, {24, 0, 0x40, 0, 0, (0x100001, {24, 0, 0x40, 0, 0, "\Device\KsecDD"}, 7, 16, ... 44, {status=0x0, info=0}, ) }, 7, 16, ... 44, {status=0x0, info=0}, ) == 0x0 00370 2020 NtDeviceIoControlFile (44, 0, 0x0, 0x0, 0x390008, (44, 0, 0x0, 0x0, 0x390008, ")\355\330\240\0\226sG\223I\301$\352\330V\350\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0", 256, 256, ... , 256, 256, ... 00371 2020 NtQuerySystemInformation (TimeOfDay, 48, ... {system info, class 3, size 48}, 48, ) == 0x0 00372 2020 NtQuerySystemInformation (ProcessorTimes, 48, ... {system info, class 8, size 48}, 48, ) == 0x0 00373 2020 NtQuerySystemInformation (Performance, 312, ... {system info, class 2, size 312}, 312, ) == 0x0 00374 2020 NtQuerySystemInformation (Exception, 16, ... {system info, class 33, size 16}, 16, ) == 0x0 00375 2020 NtQuerySystemInformation (Lookaside, 32, ... {system info, class 45, size 32}, 32, ) == 0x0 00376 2020 NtQuerySystemInformation (ProcessorStatistics, 3016, ... {system info, class 23, size 0}, 0, ) == 0x0 00377 2020 NtQuerySystemInformation (ProcessesAndThreads, 3008, ... ) == STATUS_INFO_LENGTH_MISMATCH 00378 2020 NtCreateKey (0x2, {24, 0, 0x240, 0, 0, (0x2, {24, 0, 0x240, 0, 0, "\Registry\Machine\SOFTWARE\Microsoft\Cryptography\RNG"}, 0, 0x0, 0, ... -2147482576, 2, ) }, 0, 0x0, 0, ... -2147482576, 2, ) == 0x0 00379 2020 NtSetValueKey (-2147482576, (-2147482576, "Seed", 0, 3, "\246\3537 \231\236\201\277\334\u\314k\243H\303\277\3133\343mfvl\22\301\362a\1(Q\200:\352+\372C\20\246\17R\324\\264'\325w\342R<^\216RXR\265\327hWBmdX\347\240%\323#o\333m\377\203*\266L\276\223\321\270", 80, ... ) , 0, 3, (-2147482576, "Seed", 0, 3, "\246\3537 \231\236\201\277\334\u\314k\243H\303\277\3133\343mfvl\22\301\362a\1(Q\200:\352+\372C\20\246\17R\324\\264'\325w\342R<^\216RXR\265\327hWBmdX\347\240%\323#o\333m\377\203*\266L\276\223\321\270", 80, ... ) , 80, ... ) == 0x0 00380 2020 NtClose (-2147482576, ... ) == 0x0 00370 2020 NtDeviceIoControlFile ... {status=0x0, info=256}, ... {status=0x0, info=256}, "GS\22`&\366`~\235\350\31\25\304\14L\230*\231\200U\240\2262\305\zjx\351\200+\352\22\11\301.\242(\330\177\15\357\222.D: \374\204\362\250\256\262\351\367~/\313\224\2\201wX\15\315\352}\361\341\346fH \371\234\327M\362\27\345q\356O\236$#\236A\374\17\345\257V\307I\275\2313F\360\263\253c\217\212]\13(\325\1mlw\303\324maD\373\23\315\16\11\244J\262de\211YlH\260\322\344W\351\\12\255\222\253\263\377\316s\210\223\333G\312\177\213q\327\235\325\217\12\251\373\2627\236\377t\311NVR\327\347\210\2465\253l-R\322\223>:=\355p\305\345\244\3404fK\211\22733\222\311\314Z%S\275@o\316 \327\335\15\331\351N\313\317\17\263\3104\243n\355\205\273;,\352\11o0\224\214\205\270 \5c\301\244\327\316\31c\262\375\251\2\355$\205\2420\376\257\255", ) , ) == 0x0 00381 2020 NtQuerySystemInformation (Basic, 44, ... {Unknown=0,MaximumIncrement=156250,PhysicalPageSize=0x1000,NumberOfPhysicalPages=0xff7c,LowestPhysicalPage=0x1,HighestPhysicalPage=0xffff,AllocationGranularity=0x10000,LowestUserAddress=0x10000,HighestUserAddress=0x7ffeffff,ActiveProcessors=1,NumberProcessors=1,}, 0x0, ) == 0x0 00382 2020 NtQuerySystemInformation (Processor, 12, ... {system info, class 1, size 12}, 0x0, ) == 0x0 00383 2020 NtOpenKey (0x20019, {24, 16, 0x40, 0, 0, (0x20019, {24, 16, 0x40, 0, 0, "SYSTEM\CurrentControlSet\Control\Session Manager"}, ... 48, ) }, ... 48, ) == 0x0 00384 2020 NtQueryValueKey (48, (48, "CriticalSectionTimeout", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\215'\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (48, "CriticalSectionTimeout", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\215'\0"}, 16, ) }, 16, ) == 0x0 00385 2020 NtClose (48, ... ) == 0x0 00386 2020 NtOpenKey (0x20019, {24, 16, 0x40, 0, 0, (0x20019, {24, 16, 0x40, 0, 0, "Software\Microsoft\Ole"}, ... 48, ) }, ... 48, ) == 0x0 00387 2020 NtQueryValueKey (48, (48, "RWLockResourceTimeOut", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 00388 2020 NtClose (48, ... ) == 0x0 00389 2020 NtQuerySystemInformation (Basic, 44, ... {Unknown=0,MaximumIncrement=156250,PhysicalPageSize=0x1000,NumberOfPhysicalPages=0xff7c,LowestPhysicalPage=0x1,HighestPhysicalPage=0xffff,AllocationGranularity=0x10000,LowestUserAddress=0x10000,HighestUserAddress=0x7ffeffff,ActiveProcessors=1,NumberProcessors=1,}, 0x0, ) == 0x0 00390 2020 NtQuerySystemInformation (Processor, 12, ... {system info, class 1, size 12}, 0x0, ) == 0x0 00391 2020 NtQuerySystemInformation (Basic, 44, ... {Unknown=0,MaximumIncrement=156250,PhysicalPageSize=0x1000,NumberOfPhysicalPages=0xff7c,LowestPhysicalPage=0x1,HighestPhysicalPage=0xffff,AllocationGranularity=0x10000,LowestUserAddress=0x10000,HighestUserAddress=0x7ffeffff,ActiveProcessors=1,NumberProcessors=1,}, 0x0, ) == 0x0 00392 2020 NtQuerySystemInformation (Processor, 12, ... {system info, class 1, size 12}, 0x0, ) == 0x0 00393 2020 NtOpenKey (0x20019, {24, 0, 0x40, 0, 0, (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Classes\Interface"}, ... 48, ) }, ... 48, ) == 0x0 00394 2020 NtQueryValueKey (48, (48, "InterfaceHelperDisableAll", Full, 0, ... ) , Full, 0, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 00395 2020 NtQueryValueKey (48, (48, "InterfaceHelperDisableAllForOle32", Full, 0, ... ) , Full, 0, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 00396 2020 NtQueryValueKey (48, (48, "InterfaceHelperDisableTypeLib", Full, 0, ... ) , Full, 0, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 00397 2020 NtClose (48, ... ) == 0x0 00398 2020 NtOpenKey (0x20019, {24, 0, 0x40, 0, 0, (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Classes\Interface\{00020400-0000-0000-C000-000000000046}"}, ... 48, ) }, ... 48, ) == 0x0 00399 2020 NtQueryValueKey (48, (48, "InterfaceHelperDisableAll", Full, 0, ... ) , Full, 0, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 00400 2020 NtQueryValueKey (48, (48, "InterfaceHelperDisableAllForOle32", Full, 0, ... ) , Full, 0, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 00401 2020 NtClose (48, ... ) == 0x0 00402 2020 NtOpenDirectoryObject (0x2000f, {24, 0, 0x40, 0, 0, (0x2000f, {24, 0, 0x40, 0, 0, "\BaseNamedObjects"}, ... 48, ) }, ... 48, ) == 0x0 00403 2020 NtOpenEvent (0x1f0003, {24, 48, 0x0, 0, 0, (0x1f0003, {24, 48, 0x0, 0, 0, "HookSwitchHookEnabledEvent"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 00404 2020 NtUserRegisterWindowMessage ( ("{FB8F0821-0164-101B-84ED-08002B2EC713}", ... ) , ... ) == 0xc077 00405 2020 NtOpenKey (0x1, {24, 16, 0x40, 0, 0, (0x1, {24, 16, 0x40, 0, 0, "SOFTWARE\Microsoft\OLEAUT"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 00406 2020 NtOpenKey (0x9, {24, 16, 0x40, 0, 0, (0x9, {24, 16, 0x40, 0, 0, "SOFTWARE\Microsoft\OLEAUT\UserEra"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 00407 2020 NtOpenKey (0x1, {24, 16, 0x40, 0, 0, (0x1, {24, 16, 0x40, 0, 0, "SOFTWARE\Microsoft\OLEAUT"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 00408 2020 NtTestAlert (... ) == 0x0 00409 2020 NtContinue (1244464, 1, ... 00410 2020 NtSetInformationThread (-2, Win32StartAddress(LpcReceivedMessageId), {StartAddress(LpcReceivedMsgId)=0x401000,}, 4, ... ) == 0x0 00411 2020 NtAllocateVirtualMemory (-1, 0, 0, 278528, 4096, 64, ... 3538944, 278528, ) == 0x0 00412 2020 NtAllocateVirtualMemory (-1, 0, 0, 278528, 4096, 64, ... 3866624, 278528, ) == 0x0 00413 2020 NtFreeVirtualMemory (-1, (0x360000), 0, 32768, ... (0x360000), 278528, ) == 0x0 00414 2020 NtAllocateVirtualMemory (-1, 0, 0, 1350, 4096, 4, ... 3538944, 4096, ) == 0x0 00415 2020 NtFreeVirtualMemory (-1, (0x360000), 0, 32768, ... (0x360000), 4096, ) == 0x0 00416 2020 NtAllocateVirtualMemory (-1, 0, 0, 208384, 4096, 4, ... 3538944, 208896, ) == 0x0 00417 2020 NtFreeVirtualMemory (-1, (0x360000), 0, 32768, ... (0x360000), 208896, ) == 0x0 00418 2020 NtAllocateVirtualMemory (-1, 0, 0, 2560, 4096, 4, ... 3538944, 4096, ) == 0x0 00419 2020 NtFreeVirtualMemory (-1, (0x360000), 0, 32768, ... (0x360000), 4096, ) == 0x0 00420 2020 NtAllocateVirtualMemory (-1, 0, 0, 4096, 4096, 4, ... 3538944, 4096, ) == 0x0 00421 2020 NtFreeVirtualMemory (-1, (0x360000), 0, 32768, ... (0x360000), 4096, ) == 0x0 00422 2020 NtAllocateVirtualMemory (-1, 0, 0, 10752, 4096, 4, ... 3538944, 12288, ) == 0x0 00423 2020 NtFreeVirtualMemory (-1, (0x360000), 0, 32768, ... (0x360000), 12288, ) == 0x0 00424 2020 NtOpenSection (0xe, {24, 8, 0x40, 0, 0, (0xe, {24, 8, 0x40, 0, 0, "version.dll"}, ... 52, ) }, ... 52, ) == 0x0 00425 2020 NtMapViewOfSection (52, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x77c00000), 0x0, 32768, ) == 0x0 00426 2020 NtClose (52, ... ) == 0x0 00427 2020 NtProtectVirtualMemory (-1, (0x77c01000), 304, 4, ... (0x77c01000), 4096, 32, ) == 0x0 00428 2020 NtProtectVirtualMemory (-1, (0x77c01000), 4096, 32, ... (0x77c01000), 4096, 4, ) == 0x0 00429 2020 NtFlushInstructionCache (-1, 2009075712, 304, ... ) == 0x0 00430 2020 NtOpenKey (0x80000000, {24, 0, 0x40, 0, 0, (0x80000000, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\version.dll"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 00431 2020 NtOpenSection (0xe, {24, 8, 0x40, 0, 0, (0xe, {24, 8, 0x40, 0, 0, "wsock32.dll"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 00432 2020 NtQueryAttributesFile ({24, 0, 0x40, 0, 0, ({24, 0, 0x40, 0, 0, "\??\u:\work\wsock32.dll"}, 1242940, ... ) }, 1242940, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 00433 2020 NtQueryAttributesFile ({24, 0, 0x40, 0, 0, ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\wsock32.dll"}, 1242940, ... ) }, 1242940, ... ) == 0x0 00434 2020 NtOpenFile (0x100020, {24, 0, 0x40, 0, 0, (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\wsock32.dll"}, 5, 96, ... 52, {status=0x0, info=1}, ) }, 5, 96, ... 52, {status=0x0, info=1}, ) == 0x0 00435 2020 NtCreateSection (0xf, 0x0, 0x0, 16, 16777216, 52, ... 56, ) == 0x0 00436 2020 NtQuerySection (56, Image, 48, ... {section info, class 1, size 48}, 0x0, ) == 0x0 00437 2020 NtClose (52, ... ) == 0x0 00438 2020 NtMapViewOfSection (56, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x71ad0000), 0x0, 36864, ) == 0x0 00439 2020 NtClose (56, ... ) == 0x0 00440 2020 NtProtectVirtualMemory (-1, (0x71ad1000), 52, 4, ... (0x71ad1000), 4096, 32, ) == 0x0 00441 2020 NtProtectVirtualMemory (-1, (0x71ad1000), 4096, 32, ... (0x71ad1000), 4096, 4, ) == 0x0 00442 2020 NtFlushInstructionCache (-1, 1907167232, 52, ... ) == 0x0 00443 2020 NtOpenKey (0x80000000, {24, 0, 0x40, 0, 0, (0x80000000, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wsock32.dll"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 00444 2020 NtQueryPerformanceCounter (... {1136101494, 16}, {3579545, 0}, ) == 0x0 00445 2020 NtOpenThreadTokenEx (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN 00446 2020 NtOpenProcessTokenEx (-1, 0x20008, 512, ... 56, ) == 0x0 00447 2020 NtQueryInformationToken (56, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0 00448 2020 NtClose (56, ... ) == 0x0 00449 2020 NtOpenKey (0x2000000, {24, 0, 0x640, 0, 0, (0x2000000, {24, 0, 0x640, 0, 0, "\REGISTRY\USER\S-1-5-21-1292428093-1383384898-725345543-1003"}, ... 56, ) }, ... 56, ) == 0x0 00450 2020 NtSetInformationObject (56, Handle, {Inherit=0,ProtectFromClose=1,}, 1179904, ... ) == 0x0 00451 2020 NtOpenKey (0xf003f, {24, 56, 0x40, 0, 0, (0xf003f, {24, 56, 0x40, 0, 0, "Software\Borland\Locales"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 00452 2020 NtOpenKey (0xf003f, {24, 56, 0x40, 0, 0, (0xf003f, {24, 56, 0x40, 0, 0, "Software\Borland\Delphi\Locales"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 00453 2020 NtOpenProcessToken (-1, 0x8, ... 52, ) == 0x0 00454 2020 NtQueryInformationToken (52, Statistics, 56, ... {token info, class 10, size 56}, 56, ) == 0x0 00455 2020 NtClose (52, ... ) == 0x0 00456 2020 NtUserCallOneParam (0, 41, ... ) == 0x4 00457 2020 NtAllocateVirtualMemory (-1, 1335296, 0, 4096, 4096, 4, ... 1335296, 4096, ) == 0x0 00458 2020 NtAllocateVirtualMemory (-1, 0, 0, 1048576, 8192, 1, ... 9961472, 1048576, ) == 0x0 00459 2020 NtAllocateVirtualMemory (-1, 1339392, 0, 4096, 4096, 4, ... 1339392, 4096, ) == 0x0 00460 2020 NtAllocateVirtualMemory (-1, 9961472, 0, 16384, 4096, 4, ... 9961472, 16384, ) == 0x0 00461 2020 NtUserCallNoParam (29, ... 00462 2020 NtQueryAttributesFile ({24, 0, 0x40, 0, 0, ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\uxtheme.dll"}, 1242224, ... ) }, 1242224, ... ) == 0x0 00463 2020 NtOpenFile (0x100020, {24, 0, 0x40, 0, 0, (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\uxtheme.dll"}, 5, 96, ... 52, {status=0x0, info=1}, ) }, 5, 96, ... 52, {status=0x0, info=1}, ) == 0x0 00464 2020 NtCreateSection (0xe, 0x0, 0x0, 16, 134217728, 52, ... 60, ) == 0x0 00465 2020 NtClose (52, ... ) == 0x0 00466 2020 NtMapViewOfSection (60, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 16, ... (0x360000), 0x0, 221184, ) == 0x0 00467 2020 NtClose (60, ... ) == 0x0 00468 2020 NtUnmapViewOfSection (-1, 0x360000, ... ) == 0x0 00469 2020 NtQueryAttributesFile ({24, 0, 0x40, 0, 0, ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\uxtheme.dll"}, 1242532, ... ) }, 1242532, ... ) == 0x0 00470 2020 NtOpenFile (0x100020, {24, 0, 0x40, 0, 0, (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\uxtheme.dll"}, 5, 96, ... 60, {status=0x0, info=1}, ) }, 5, 96, ... 60, {status=0x0, info=1}, ) == 0x0 00471 2020 NtCreateSection (0xf, 0x0, 0x0, 16, 16777216, 60, ... 52, ) == 0x0 00472 2020 NtQuerySection (52, Image, 48, ... {section info, class 1, size 48}, 0x0, ) == 0x0 00473 2020 NtClose (60, ... ) == 0x0 00474 2020 NtMapViewOfSection (52, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x5ad70000), 0x0, 229376, ) == 0x0 00475 2020 NtClose (52, ... ) == 0x0 00476 2020 NtProtectVirtualMemory (-1, (0x5ad71000), 1300, 4, ... (0x5ad71000), 4096, 32, ) == 0x0 00477 2020 NtProtectVirtualMemory (-1, (0x5ad71000), 4096, 32, ... (0x5ad71000), 4096, 4, ) == 0x0 00478 2020 NtFlushInstructionCache (-1, 1524043776, 1300, ... ) == 0x0 00479 2020 NtProtectVirtualMemory (-1, (0x5ad71000), 1300, 4, ... (0x5ad71000), 4096, 32, ) == 0x0 00480 2020 NtProtectVirtualMemory (-1, (0x5ad71000), 4096, 32, ... (0x5ad71000), 4096, 4, ) == 0x0 00481 2020 NtFlushInstructionCache (-1, 1524043776, 1300, ... ) == 0x0 00482 2020 NtProtectVirtualMemory (-1, (0x5ad71000), 1300, 4, ... (0x5ad71000), 4096, 32, ) == 0x0 00483 2020 NtProtectVirtualMemory (-1, (0x5ad71000), 4096, 32, ... (0x5ad71000), 4096, 4, ) == 0x0 00484 2020 NtFlushInstructionCache (-1, 1524043776, 1300, ... ) == 0x0 00485 2020 NtProtectVirtualMemory (-1, (0x5ad71000), 1300, 4, ... (0x5ad71000), 4096, 32, ) == 0x0 00486 2020 NtProtectVirtualMemory (-1, (0x5ad71000), 4096, 32, ... (0x5ad71000), 4096, 4, ) == 0x0 00487 2020 NtFlushInstructionCache (-1, 1524043776, 1300, ... ) == 0x0 00488 2020 NtOpenKey (0x80000000, {24, 0, 0x40, 0, 0, (0x80000000, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\uxtheme.dll"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 00489 2020 NtUserGetWindowDC (0, ... ) == 0x1010052 00490 2020 NtUserCallOneParam (16842834, 57, ... ) == 0x1 00491 2020 NtOpenThreadTokenEx (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN 00492 2020 NtOpenProcessTokenEx (-1, 0x20008, 512, ... 52, ) == 0x0 00493 2020 NtQueryInformationToken (52, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0 00494 2020 NtClose (52, ... ) == 0x0 00495 2020 NtOpenKey (0x2001f, {24, 0, 0x640, 0, 0, (0x2001f, {24, 0, 0x640, 0, 0, "\REGISTRY\USER\S-1-5-21-1292428093-1383384898-725345543-1003"}, ... 52, ) }, ... 52, ) == 0x0 00496 2020 NtOpenKey (0x1, {24, 52, 0x40, 0, 0, (0x1, {24, 52, 0x40, 0, 0, "Software\Microsoft\Windows\CurrentVersion\ThemeManager"}, ... 60, ) }, ... 60, ) == 0x0 00497 2020 NtQueryValueKey (60, (60, "Compositing", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 00498 2020 NtClose (60, ... ) == 0x0 00499 2020 NtClose (52, ... ) == 0x0 00500 2020 NtOpenThreadTokenEx (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN 00501 2020 NtOpenProcessTokenEx (-1, 0x20008, 512, ... 52, ) == 0x0 00502 2020 NtQueryInformationToken (52, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0 00503 2020 NtClose (52, ... ) == 0x0 00504 2020 NtOpenKey (0x20019, {24, 0, 0x640, 0, 0, (0x20019, {24, 0, 0x640, 0, 0, "\REGISTRY\USER\S-1-5-21-1292428093-1383384898-725345543-1003"}, ... 52, ) }, ... 52, ) == 0x0 00505 2020 NtOpenKey (0x1, {24, 52, 0x40, 0, 0, (0x1, {24, 52, 0x40, 0, 0, "Control Panel\Desktop"}, ... 60, ) }, ... 60, ) == 0x0 00506 2020 NtQueryValueKey (60, (60, "LameButtonText", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 00507 2020 NtClose (60, ... ) == 0x0 00508 2020 NtClose (52, ... ) == 0x0 00509 2020 NtUserGetProcessWindowStation (... ) == 0x1c 00510 2020 NtUserGetObjectInformation (28, 2, 1244320, 64, 1244316, ... ) == 0x1 00511 2020 NtUserGetGUIThreadInfo (2020, 1244340, ... ) == 0x1 00512 2020 NtConnectPort ( ("\ThemeApiPort", {12, 2, 1, 1}, 0x0, 0x0, 1244184, 64, ... 52, 0x0, 0x0, 0x0, 64, ) , {12, 2, 1, 1}, 0x0, 0x0, 1244184, 64, ... 52, 0x0, 0x0, 0x0, 64, ) == 0x0 00513 2020 NtRequestWaitReplyPort (52, {32, 56, new_msg, 0, 0, 0, 0, 0} (52, {32, 56, new_msg, 0, 0, 0, 0, 0} "\4\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0" ... {32, 56, reply, 0, 868, 2020, 75644, 0} "\0\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0" ) ... {32, 56, reply, 0, 868, 2020, 75644, 0} (52, {32, 56, new_msg, 0, 0, 0, 0, 0} "\4\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0" ... {32, 56, reply, 0, 868, 2020, 75644, 0} "\0\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0" ) ) == 0x0 00514 2020 NtRequestWaitReplyPort (52, {32, 56, new_msg, 0, 0, 0, 0, 0} (52, {32, 56, new_msg, 0, 0, 0, 0, 0} "\355\3\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0" ... {32, 56, reply, 0, 868, 2020, 75645, 0} "\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0" ) ... {32, 56, reply, 0, 868, 2020, 75645, 0} (52, {32, 56, new_msg, 0, 0, 0, 0, 0} "\355\3\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0" ... {32, 56, reply, 0, 868, 2020, 75645, 0} "\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0" ) ) == 0x0 00515 2020 NtUserCallNoParam (29, ... 00516 2020 NtQueryAttributesFile ({24, 0, 0x40, 0, 0, ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\uxtheme.dll"}, 1241580, ... ) }, 1241580, ... ) == 0x0 00515 2020 NtUserCallNoParam ... ) == 0x0 00517 2020 NtUserSystemParametersInfo (41, 0, 1524240760, 0, ... ) == 0x1 00518 2020 NtGdiHfontCreate (1243708, 356, 0, 0, 1333048, ... ) == 0x4f0a0635 00519 2020 NtGdiHfontCreate (1243708, 356, 0, 0, 1333040, ... ) == 0x6b0a04bc 00520 2020 NtRequestWaitReplyPort (52, {32, 56, new_msg, 0, 0, 0, 0, 0} (52, {32, 56, new_msg, 0, 0, 0, 0, 0} "\7\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0" ... {32, 56, reply, 0, 868, 2020, 75646, 0} "\0\0\0\0\0\0\0\0<\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0" ) ... {32, 56, reply, 0, 868, 2020, 75646, 0} (52, {32, 56, new_msg, 0, 0, 0, 0, 0} "\7\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0" ... {32, 56, reply, 0, 868, 2020, 75646, 0} "\0\0\0\0\0\0\0\0<\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0" ) ) == 0x0 00521 2020 NtMapViewOfSection (60, -1, (0x0), 0, 0, {0, 0}, 0, 1, 0, 2, ... (0x360000), {0, 0}, 327680, ) == 0x0 00522 2020 NtUserGetWindowDC (0, ... ) == 0x1010052 00523 2020 NtUserCallOneParam (16842834, 57, ... ) == 0x1 00524 2020 NtUserGetWindowDC (0, ... ) == 0x1010052 00525 2020 NtUserCallOneParam (16842834, 57, ... ) == 0x1 00526 2020 NtUserGetWindowDC (0, ... ) == 0x1010052 00527 2020 NtUserCallOneParam (16842834, 57, ... ) == 0x1 00528 2020 NtUserGetWindowDC (0, ... ) == 0x1010052 00529 2020 NtUserCallOneParam (16842834, 57, ... ) == 0x1 00530 2020 NtUserGetWindowDC (0, ... ) == 0x1010052 00531 2020 NtUserCallOneParam (16842834, 57, ... ) == 0x1 00532 2020 NtUserGetWindowDC (0, ... ) == 0x1010052 00533 2020 NtUserCallOneParam (16842834, 57, ... ) == 0x1 00534 2020 NtUserGetWindowDC (0, ... ) == 0x1010052 00535 2020 NtUserCallOneParam (16842834, 57, ... ) == 0x1 00536 2020 NtUserGetWindowDC (0, ... ) == 0x1010052 00537 2020 NtUserCallOneParam (16842834, 57, ... ) == 0x1 00538 2020 NtUserGetWindowDC (0, ... ) == 0x1010052 00539 2020 NtGdiCreatePatternBrushInternal (59048383, 0, 0, ... ) == 0x9c1004ac 00540 2020 NtUserCallOneParam (16842834, 57, ... ) == 0x1 00541 2020 NtUserCallNoParam (29, ... 00542 2020 NtQueryAttributesFile ({24, 0, 0x40, 0, 0, ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\uxtheme.dll"}, 1241020, ... ) }, 1241020, ... ) == 0x0 00541 2020 NtUserCallNoParam ... ) == 0x0 00543 2020 NtUserCallNoParam (29, ... 00544 2020 NtQueryAttributesFile ({24, 0, 0x40, 0, 0, ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\uxtheme.dll"}, 1241016, ... ) }, 1241016, ... ) == 0x0 00543 2020 NtUserCallNoParam ... ) == 0x0 00461 2020 NtUserCallNoParam ... ) == 0x1 00545 2020 NtOpenKey (0x2000000, {24, 16, 0x40, 0, 0, (0x2000000, {24, 16, 0x40, 0, 0, "System\CurrentControlSet\Services\WinSock2\Parameters"}, ... 64, ) }, ... 64, ) == 0x0 00546 2020 NtQueryValueKey (64, (64, "WinSock_Registry_Version", Partial, 144, ... TitleIdx=0, Type=1, Data="2\0.\00\0\0\0"}, 20, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (64, "WinSock_Registry_Version", Partial, 144, ... TitleIdx=0, Type=1, Data="2\0.\00\0\0\0"}, 20, ) }, 20, ) == 0x0 00547 2020 NtQueryValueKey (64, (64, "WinSock_Registry_Version", Partial, 144, ... TitleIdx=0, Type=1, Data="2\0.\00\0\0\0"}, 20, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (64, "WinSock_Registry_Version", Partial, 144, ... TitleIdx=0, Type=1, Data="2\0.\00\0\0\0"}, 20, ) }, 20, ) == 0x0 00548 2020 NtCreateEvent (0x1f0003, 0x0, 0, 0, ... 68, ) == 0x0 00549 2020 NtOpenKey (0x2000000, {24, 64, 0x40, 0, 0, (0x2000000, {24, 64, 0x40, 0, 0, "Protocol_Catalog9"}, ... 72, ) }, ... 72, ) == 0x0 00550 2020 NtQueryValueKey (72, (72, "Serial_Access_Num", Partial, 144, ... TitleIdx=0, Type=4, Data="\15\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (72, "Serial_Access_Num", Partial, 144, ... TitleIdx=0, Type=4, Data="\15\0\0\0"}, 16, ) }, 16, ) == 0x0 00551 2020 NtNotifyChangeKey (72, 68, 0, 0, 2011455960, 1, 0, 0, 0, 1, ... ) == 0x103 00552 2020 NtQueryValueKey (72, (72, "Serial_Access_Num", Partial, 144, ... TitleIdx=0, Type=4, Data="\15\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (72, "Serial_Access_Num", Partial, 144, ... TitleIdx=0, Type=4, Data="\15\0\0\0"}, 16, ) }, 16, ) == 0x0 00553 2020 NtOpenKey (0x2000000, {24, 72, 0x40, 0, 0, (0x2000000, {24, 72, 0x40, 0, 0, "0000000D"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 00554 2020 NtQueryValueKey (72, (72, "Next_Catalog_Entry_ID", Partial, 144, ... TitleIdx=0, Type=4, Data="#\4\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (72, "Next_Catalog_Entry_ID", Partial, 144, ... TitleIdx=0, Type=4, Data="#\4\0\0"}, 16, ) }, 16, ) == 0x0 00555 2020 NtQueryValueKey (72, (72, "Num_Catalog_Entries", Partial, 144, ... TitleIdx=0, Type=4, Data="\26\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (72, "Num_Catalog_Entries", Partial, 144, ... TitleIdx=0, Type=4, Data="\26\0\0\0"}, 16, ) }, 16, ) == 0x0 00556 2020 NtOpenKey (0x2000000, {24, 72, 0x40, 0, 0, (0x2000000, {24, 72, 0x40, 0, 0, "Catalog_Entries"}, ... 76, ) }, ... 76, ) == 0x0 00557 2020 NtOpenKey (0x20019, {24, 76, 0x40, 0, 0, (0x20019, {24, 76, 0x40, 0, 0, "000000000001"}, ... 80, ) }, ... 80, ) == 0x0 00558 2020 NtQueryValueKey (80, (80, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW 00559 2020 NtQueryValueKey (80, (80, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW 00560 2020 NtAllocateVirtualMemory (-1, 1343488, 0, 4096, 4096, 4, ... 1343488, 4096, ) == 0x0 00561 2020 NtQueryValueKey (80, (80, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5f\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\10\0\0\0\240\32\17\347\213\253\317\21\214\243\0\200_H\241\222\351\3\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\2\0\0\0\20\0\0\0\20\0\0\0\1\0\0\0\6\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0T\0c\0p\0i\0p\0 \0[\0T\0C\0P\0/\0I\0P\0]\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\204\3\0\02\2\0\0d\3\0\0\344\7\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0P\0\0\02\2\0\0d\3\0\0\344\7\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\03\2\0\0d\3\0\0\344\7\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0L\0\0\0L\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\310r\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\00\02\03\2\0\0d\3\0\0\344\7\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0P\0\0\0\24\0\0\0\24\0\0\0\0@\375\177\211e@\0\0\2\0\0\4\0\0\0\0\0\0\08\275D\0\12D@\0:n@\0\2\0\0\0\240\16\210\0@\15\210\0\24\0\0\0\0\0\0\0\0@\375\177\6\0\0\0\4=\233\367\224\377\22\0\1\0\0\0\340\377\22\0d\222@\0\30\321@\0\0\0\0\0\360\377\22\0\327o\201|\24\0\0\0\0\0\0\0\0@\375\177\375?T\200\310\377\22\0\270\245j\201\377\377\377\377\250\232\203|\340o\201|\0\0\0\0\0\0\0\0\0\0\0\0\206m@\0\0\0\0\0Actx \0\0\0\1\0\0\0\230$\0\0\304\0\0\0\0\0\0\0 \0\0\0\0\0\0\0\24\0\0\0"}, 900, ) , Partial, 900, ... TitleIdx=0, Type=3, Data= (80, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5f\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\10\0\0\0\240\32\17\347\213\253\317\21\214\243\0\200_H\241\222\351\3\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\2\0\0\0\20\0\0\0\20\0\0\0\1\0\0\0\6\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0T\0c\0p\0i\0p\0 \0[\0T\0C\0P\0/\0I\0P\0]\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\204\3\0\02\2\0\0d\3\0\0\344\7\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0P\0\0\02\2\0\0d\3\0\0\344\7\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\03\2\0\0d\3\0\0\344\7\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0L\0\0\0L\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\310r\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\00\02\03\2\0\0d\3\0\0\344\7\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0P\0\0\0\24\0\0\0\24\0\0\0\0@\375\177\211e@\0\0\2\0\0\4\0\0\0\0\0\0\08\275D\0\12D@\0:n@\0\2\0\0\0\240\16\210\0@\15\210\0\24\0\0\0\0\0\0\0\0@\375\177\6\0\0\0\4=\233\367\224\377\22\0\1\0\0\0\340\377\22\0d\222@\0\30\321@\0\0\0\0\0\360\377\22\0\327o\201|\24\0\0\0\0\0\0\0\0@\375\177\375?T\200\310\377\22\0\270\245j\201\377\377\377\377\250\232\203|\340o\201|\0\0\0\0\0\0\0\0\0\0\0\0\206m@\0\0\0\0\0Actx \0\0\0\1\0\0\0\230$\0\0\304\0\0\0\0\0\0\0 \0\0\0\0\0\0\0\24\0\0\0"}, 900, ) }, 900, ) == 0x0 00562 2020 NtClose (80, ... ) == 0x0 00563 2020 NtOpenKey (0x20019, {24, 76, 0x40, 0, 0, (0x20019, {24, 76, 0x40, 0, 0, "000000000002"}, ... 80, ) }, ... 80, ) == 0x0 00564 2020 NtQueryValueKey (80, (80, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW 00565 2020 NtQueryValueKey (80, (80, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW 00566 2020 NtQueryValueKey (80, (80, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\11\6\2\0\0\0\0\0\0\0\0\0\0\0\0\0\10\0\0\0\240\32\17\347\213\253\317\21\214\243\0\200_H\241\222\352\3\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\2\0\0\0\20\0\0\0\20\0\0\0\2\0\0\0\21\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\273\377\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0T\0c\0p\0i\0p\0 \0[\0U\0D\0P\0/\0I\0P\0]\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\204\3\0\07\2\0\0d\3\0\0\344\7\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0P\0\0\07\2\0\0d\3\0\0\344\7\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\08\2\0\0d\3\0\0\344\7\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0L\0\0\0L\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\310r\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\00\03\08\2\0\0d\3\0\0\344\7\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0P\0\0\09\2\0\0d\3\0\0\344\7\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0P\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\09\2\0\0d\3\0\0\344\7\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0:\2\0\0d\3\0\0\344\7\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0P\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) , Partial, 900, ... TitleIdx=0, Type=3, Data= (80, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\11\6\2\0\0\0\0\0\0\0\0\0\0\0\0\0\10\0\0\0\240\32\17\347\213\253\317\21\214\243\0\200_H\241\222\352\3\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\2\0\0\0\20\0\0\0\20\0\0\0\2\0\0\0\21\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\273\377\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0T\0c\0p\0i\0p\0 \0[\0U\0D\0P\0/\0I\0P\0]\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\204\3\0\07\2\0\0d\3\0\0\344\7\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0P\0\0\07\2\0\0d\3\0\0\344\7\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\08\2\0\0d\3\0\0\344\7\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0L\0\0\0L\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\310r\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\00\03\08\2\0\0d\3\0\0\344\7\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0P\0\0\09\2\0\0d\3\0\0\344\7\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0P\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\09\2\0\0d\3\0\0\344\7\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0:\2\0\0d\3\0\0\344\7\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0P\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) \0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\09\2\0\0d\3\0\0\344\7\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0:\2\0\0d\3\0\0\344\7\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0P\0\0\0\0\0\0\0 (80, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\11\6\2\0\0\0\0\0\0\0\0\0\0\0\0\0\10\0\0\0\240\32\17\347\213\253\317\21\214\243\0\200_H\241\222\352\3\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\2\0\0\0\20\0\0\0\20\0\0\0\2\0\0\0\21\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\273\377\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0T\0c\0p\0i\0p\0 \0[\0U\0D\0P\0/\0I\0P\0]\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\204\3\0\07\2\0\0d\3\0\0\344\7\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0P\0\0\07\2\0\0d\3\0\0\344\7\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\08\2\0\0d\3\0\0\344\7\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0L\0\0\0L\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\310r\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\00\03\08\2\0\0d\3\0\0\344\7\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0P\0\0\09\2\0\0d\3\0\0\344\7\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0P\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\09\2\0\0d\3\0\0\344\7\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0:\2\0\0d\3\0\0\344\7\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0P\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) }, 900, ) == 0x0 00567 2020 NtClose (80, ... ) == 0x0 00568 2020 NtOpenKey (0x20019, {24, 76, 0x40, 0, 0, (0x20019, {24, 76, 0x40, 0, 0, "000000000003"}, ... 80, ) }, ... 80, ) == 0x0 00569 2020 NtQueryValueKey (80, (80, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW 00570 2020 NtQueryValueKey (80, (80, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW 00571 2020 NtQueryValueKey (80, (80, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\11\6\2\0\0\0\0\0\0\0\0\0\0\0\0\0\14\0\0\0\240\32\17\347\213\253\317\21\214\243\0\200_H\241\222\353\3\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\2\0\0\0\20\0\0\0\20\0\0\0\3\0\0\0\0\0\0\0\377\0\0\0\0\0\0\0\0\0\0\0\273\377\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0T\0c\0p\0i\0p\0 \0[\0R\0A\0W\0/\0I\0P\0]\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\204\3\0\0<\2\0\0d\3\0\0\344\7\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0P\0\0\0<\2\0\0d\3\0\0\344\7\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0=\2\0\0d\3\0\0\344\7\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0L\0\0\0L\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\310r\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\00\04\0=\2\0\0d\3\0\0\344\7\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0P\0\0\0>\2\0\0d\3\0\0\344\7\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0P\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0>\2\0\0d\3\0\0\344\7\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0?\2\0\0d\3\0\0\344\7\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0P\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) , Partial, 900, ... TitleIdx=0, Type=3, Data= (80, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\11\6\2\0\0\0\0\0\0\0\0\0\0\0\0\0\14\0\0\0\240\32\17\347\213\253\317\21\214\243\0\200_H\241\222\353\3\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\2\0\0\0\20\0\0\0\20\0\0\0\3\0\0\0\0\0\0\0\377\0\0\0\0\0\0\0\0\0\0\0\273\377\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0T\0c\0p\0i\0p\0 \0[\0R\0A\0W\0/\0I\0P\0]\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\204\3\0\0<\2\0\0d\3\0\0\344\7\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0P\0\0\0<\2\0\0d\3\0\0\344\7\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0=\2\0\0d\3\0\0\344\7\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0L\0\0\0L\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\310r\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\00\04\0=\2\0\0d\3\0\0\344\7\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0P\0\0\0>\2\0\0d\3\0\0\344\7\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0P\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0>\2\0\0d\3\0\0\344\7\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0?\2\0\0d\3\0\0\344\7\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0P\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) \0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0>\2\0\0d\3\0\0\344\7\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0?\2\0\0d\3\0\0\344\7\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0P\0\0\0\0\0\0\0 (80, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\11\6\2\0\0\0\0\0\0\0\0\0\0\0\0\0\14\0\0\0\240\32\17\347\213\253\317\21\214\243\0\200_H\241\222\353\3\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\2\0\0\0\20\0\0\0\20\0\0\0\3\0\0\0\0\0\0\0\377\0\0\0\0\0\0\0\0\0\0\0\273\377\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0T\0c\0p\0i\0p\0 \0[\0R\0A\0W\0/\0I\0P\0]\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\204\3\0\0<\2\0\0d\3\0\0\344\7\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0P\0\0\0<\2\0\0d\3\0\0\344\7\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0=\2\0\0d\3\0\0\344\7\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0L\0\0\0L\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\310r\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\00\04\0=\2\0\0d\3\0\0\344\7\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0P\0\0\0>\2\0\0d\3\0\0\344\7\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0P\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0>\2\0\0d\3\0\0\344\7\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0?\2\0\0d\3\0\0\344\7\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0P\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) }, 900, ) == 0x0 00572 2020 NtClose (80, ... ) == 0x0 00573 2020 NtOpenKey (0x20019, {24, 76, 0x40, 0, 0, (0x20019, {24, 76, 0x40, 0, 0, "000000000004"}, ... 80, ) }, ... 80, ) == 0x0 00574 2020 NtQueryValueKey (80, (80, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW 00575 2020 NtQueryValueKey (80, (80, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW 00576 2020 NtQueryValueKey (80, (80, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\rsvpsp.dll\0\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\11&\2\0\0\0\0\0\0\0\0\0\0\0\0\0\10\0\0\0\340\251`\235z3\320\21\275\210\0\0\300\202\346\232\354\3\0\0\1\0\0\0\204\370\272\2|\370\272\2\210\371\272\2\4\244`u\\12\0\0\240<_u\260\371\272\2\6\0\0\0\2\0\0\0\20\0\0\0\20\0\0\0\2\0\0\0\21\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\273\377\0\0\0\0\0\0R\0S\0V\0P\0 \0U\0D\0P\0 \0S\0e\0r\0v\0i\0c\0e\0 \0P\0r\0o\0v\0i\0d\0e\0r\0\0\0\1\0\0\0\344\373\272\2\1\0\0\0\330\273\356\0\0\0\0\0=\373\220|\200\371\272\2\0\0\0\0\0\371\272\2l\373\220|q\373\220|\0\0\0\0\200\371\272\2=\373\220|\334\370\272\2\0\0\0\0\204\3\0\0A\2\0\0d\3\0\0\344\7\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0P\0\0\0A\2\0\0d\3\0\0\344\7\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0B\2\0\0d\3\0\0\344\7\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0L\0\0\0L\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\310r\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\00\05\0B\2\0\0d\3\0\0\344\7\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0P\0\0\0C\2\0\0d\3\0\0\344\7\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0P\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0C\2\0\0d\3\0\0\344\7\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0D\2\0\0d\3\0\0\344\7\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0P\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) , Partial, 900, ... TitleIdx=0, Type=3, Data= (80, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\rsvpsp.dll\0\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\11&\2\0\0\0\0\0\0\0\0\0\0\0\0\0\10\0\0\0\340\251`\235z3\320\21\275\210\0\0\300\202\346\232\354\3\0\0\1\0\0\0\204\370\272\2|\370\272\2\210\371\272\2\4\244`u\\12\0\0\240<_u\260\371\272\2\6\0\0\0\2\0\0\0\20\0\0\0\20\0\0\0\2\0\0\0\21\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\273\377\0\0\0\0\0\0R\0S\0V\0P\0 \0U\0D\0P\0 \0S\0e\0r\0v\0i\0c\0e\0 \0P\0r\0o\0v\0i\0d\0e\0r\0\0\0\1\0\0\0\344\373\272\2\1\0\0\0\330\273\356\0\0\0\0\0=\373\220|\200\371\272\2\0\0\0\0\0\371\272\2l\373\220|q\373\220|\0\0\0\0\200\371\272\2=\373\220|\334\370\272\2\0\0\0\0\204\3\0\0A\2\0\0d\3\0\0\344\7\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0P\0\0\0A\2\0\0d\3\0\0\344\7\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0B\2\0\0d\3\0\0\344\7\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0L\0\0\0L\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\310r\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\00\05\0B\2\0\0d\3\0\0\344\7\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0P\0\0\0C\2\0\0d\3\0\0\344\7\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0P\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0C\2\0\0d\3\0\0\344\7\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0D\2\0\0d\3\0\0\344\7\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0P\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) \0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0C\2\0\0d\3\0\0\344\7\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0D\2\0\0d\3\0\0\344\7\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0P\0\0\0\0\0\0\0 (80, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\rsvpsp.dll\0\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\11&\2\0\0\0\0\0\0\0\0\0\0\0\0\0\10\0\0\0\340\251`\235z3\320\21\275\210\0\0\300\202\346\232\354\3\0\0\1\0\0\0\204\370\272\2|\370\272\2\210\371\272\2\4\244`u\\12\0\0\240<_u\260\371\272\2\6\0\0\0\2\0\0\0\20\0\0\0\20\0\0\0\2\0\0\0\21\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\273\377\0\0\0\0\0\0R\0S\0V\0P\0 \0U\0D\0P\0 \0S\0e\0r\0v\0i\0c\0e\0 \0P\0r\0o\0v\0i\0d\0e\0r\0\0\0\1\0\0\0\344\373\272\2\1\0\0\0\330\273\356\0\0\0\0\0=\373\220|\200\371\272\2\0\0\0\0\0\371\272\2l\373\220|q\373\220|\0\0\0\0\200\371\272\2=\373\220|\334\370\272\2\0\0\0\0\204\3\0\0A\2\0\0d\3\0\0\344\7\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0P\0\0\0A\2\0\0d\3\0\0\344\7\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0B\2\0\0d\3\0\0\344\7\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0L\0\0\0L\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\310r\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\00\05\0B\2\0\0d\3\0\0\344\7\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0P\0\0\0C\2\0\0d\3\0\0\344\7\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0P\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0C\2\0\0d\3\0\0\344\7\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0D\2\0\0d\3\0\0\344\7\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0P\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) }, 900, ) == 0x0 00577 2020 NtClose (80, ... ) == 0x0 00578 2020 NtOpenKey (0x20019, {24, 76, 0x40, 0, 0, (0x20019, {24, 76, 0x40, 0, 0, "000000000005"}, ... 80, ) }, ... 80, ) == 0x0 00579 2020 NtQueryValueKey (80, (80, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW 00580 2020 NtQueryValueKey (80, (80, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW 00581 2020 NtAllocateVirtualMemory (-1, 1347584, 0, 4096, 4096, 4, ... 1347584, 4096, ) == 0x0 00582 2020 NtQueryValueKey (80, (80, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\rsvpsp.dll\0\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5f \2\0\0\0\0\0\0\0\0\0\0\0\0\0\10\0\0\0\340\251`\235z3\320\21\275\210\0\0\300\202\346\232\355\3\0\0\1\0\0\0\210\1\34\0\0\0\34\0\10\0\0\0\0\0\0\0\214\373\272\2\\15\221|\0\0\34\0\6\0\0\0\2\0\0\0\20\0\0\0\20\0\0\0\1\0\0\0\6\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0R\0S\0V\0P\0 \0T\0C\0P\0 \0S\0e\0r\0v\0i\0c\0e\0 \0P\0r\0o\0v\0i\0d\0e\0r\0\0\0\210\1\34\0\0\0\0\0\20\0\0\0P\373\272\2\270Ddu\0\0\0\0(\275\356\0|\373\272\2\364\373\272\2\0\0\34\0\10\0\0\0\0\0\0\0(\374\272\2\\15\221|\0\0\34\0\0\0\0\0\204\3\0\0G\2\0\0d\3\0\0\344\7\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0P\0\0\0G\2\0\0d\3\0\0\344\7\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0H\2\0\0d\3\0\0\344\7\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0L\0\0\0L\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\310r\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\00\06\0H\2\0\0d\3\0\0\344\7\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0P\0\0\0I\2\0\0d\3\0\0\344\7\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0P\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0I\2\0\0d\3\0\0\344\7\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0J\2\0\0d\3\0\0\344\7\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0P\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) , Partial, 900, ... TitleIdx=0, Type=3, Data= (80, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\rsvpsp.dll\0\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5f \2\0\0\0\0\0\0\0\0\0\0\0\0\0\10\0\0\0\340\251`\235z3\320\21\275\210\0\0\300\202\346\232\355\3\0\0\1\0\0\0\210\1\34\0\0\0\34\0\10\0\0\0\0\0\0\0\214\373\272\2\\15\221|\0\0\34\0\6\0\0\0\2\0\0\0\20\0\0\0\20\0\0\0\1\0\0\0\6\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0R\0S\0V\0P\0 \0T\0C\0P\0 \0S\0e\0r\0v\0i\0c\0e\0 \0P\0r\0o\0v\0i\0d\0e\0r\0\0\0\210\1\34\0\0\0\0\0\20\0\0\0P\373\272\2\270Ddu\0\0\0\0(\275\356\0|\373\272\2\364\373\272\2\0\0\34\0\10\0\0\0\0\0\0\0(\374\272\2\\15\221|\0\0\34\0\0\0\0\0\204\3\0\0G\2\0\0d\3\0\0\344\7\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0P\0\0\0G\2\0\0d\3\0\0\344\7\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0H\2\0\0d\3\0\0\344\7\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0L\0\0\0L\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\310r\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\00\06\0H\2\0\0d\3\0\0\344\7\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0P\0\0\0I\2\0\0d\3\0\0\344\7\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0P\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0I\2\0\0d\3\0\0\344\7\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0J\2\0\0d\3\0\0\344\7\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0P\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) \0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0I\2\0\0d\3\0\0\344\7\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0J\2\0\0d\3\0\0\344\7\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0P\0\0\0\0\0\0\0 (80, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\rsvpsp.dll\0\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5f \2\0\0\0\0\0\0\0\0\0\0\0\0\0\10\0\0\0\340\251`\235z3\320\21\275\210\0\0\300\202\346\232\355\3\0\0\1\0\0\0\210\1\34\0\0\0\34\0\10\0\0\0\0\0\0\0\214\373\272\2\\15\221|\0\0\34\0\6\0\0\0\2\0\0\0\20\0\0\0\20\0\0\0\1\0\0\0\6\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0R\0S\0V\0P\0 \0T\0C\0P\0 \0S\0e\0r\0v\0i\0c\0e\0 \0P\0r\0o\0v\0i\0d\0e\0r\0\0\0\210\1\34\0\0\0\0\0\20\0\0\0P\373\272\2\270Ddu\0\0\0\0(\275\356\0|\373\272\2\364\373\272\2\0\0\34\0\10\0\0\0\0\0\0\0(\374\272\2\\15\221|\0\0\34\0\0\0\0\0\204\3\0\0G\2\0\0d\3\0\0\344\7\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0P\0\0\0G\2\0\0d\3\0\0\344\7\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0H\2\0\0d\3\0\0\344\7\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0L\0\0\0L\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\310r\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\00\06\0H\2\0\0d\3\0\0\344\7\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0P\0\0\0I\2\0\0d\3\0\0\344\7\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0P\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0I\2\0\0d\3\0\0\344\7\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0J\2\0\0d\3\0\0\344\7\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0P\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) }, 900, ) == 0x0 00583 2020 NtClose (80, ... ) == 0x0 00584 2020 NtOpenKey (0x20019, {24, 76, 0x40, 0, 0, (0x20019, {24, 76, 0x40, 0, 0, "000000000006"}, ... 80, ) }, ... 80, ) == 0x0 00585 2020 NtQueryValueKey (80, (80, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW 00586 2020 NtQueryValueKey (80, (80, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW 00587 2020 NtQueryValueKey (80, (80, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5&\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\10\0\0\0d\200\304\237\230r\344C\267\275\30\37 \211y*\374\3\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0 \0\0\0\36\0\0\0\36\0\0\0\1\0\0\0\3\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0R\0f\0C\0o\0m\0m\0 \0[\0B\0l\0u\0e\0t\0o\0o\0t\0h\0]\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\204\3\0\0L\2\0\0d\3\0\0\344\7\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0P\0\0\0L\2\0\0d\3\0\0\344\7\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0M\2\0\0d\3\0\0\344\7\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0L\0\0\0L\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\310r\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\00\07\0M\2\0\0d\3\0\0\344\7\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0P\0\0\0N\2\0\0d\3\0\0\344\7\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0P\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0N\2\0\0d\3\0\0\344\7\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0O\2\0\0d\3\0\0\344\7\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0P\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) , Partial, 900, ... TitleIdx=0, Type=3, Data= (80, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5&\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\10\0\0\0d\200\304\237\230r\344C\267\275\30\37 \211y*\374\3\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0 \0\0\0\36\0\0\0\36\0\0\0\1\0\0\0\3\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0R\0f\0C\0o\0m\0m\0 \0[\0B\0l\0u\0e\0t\0o\0o\0t\0h\0]\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\204\3\0\0L\2\0\0d\3\0\0\344\7\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0P\0\0\0L\2\0\0d\3\0\0\344\7\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0M\2\0\0d\3\0\0\344\7\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0L\0\0\0L\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\310r\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\00\07\0M\2\0\0d\3\0\0\344\7\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0P\0\0\0N\2\0\0d\3\0\0\344\7\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0P\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0N\2\0\0d\3\0\0\344\7\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0O\2\0\0d\3\0\0\344\7\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0P\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) \0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0N\2\0\0d\3\0\0\344\7\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0O\2\0\0d\3\0\0\344\7\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0P\0\0\0\0\0\0\0 (80, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5&\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\10\0\0\0d\200\304\237\230r\344C\267\275\30\37 \211y*\374\3\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0 \0\0\0\36\0\0\0\36\0\0\0\1\0\0\0\3\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0R\0f\0C\0o\0m\0m\0 \0[\0B\0l\0u\0e\0t\0o\0o\0t\0h\0]\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\204\3\0\0L\2\0\0d\3\0\0\344\7\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0P\0\0\0L\2\0\0d\3\0\0\344\7\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0M\2\0\0d\3\0\0\344\7\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0L\0\0\0L\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\310r\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\00\07\0M\2\0\0d\3\0\0\344\7\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0P\0\0\0N\2\0\0d\3\0\0\344\7\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0P\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0N\2\0\0d\3\0\0\344\7\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0O\2\0\0d\3\0\0\344\7\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0P\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) }, 900, ) == 0x0 00588 2020 NtClose (80, ... ) == 0x0 00589 2020 NtOpenKey (0x20019, {24, 76, 0x40, 0, 0, (0x20019, {24, 76, 0x40, 0, 0, "000000000007"}, ... 80, ) }, ... 80, ) == 0x0 00590 2020 NtQueryValueKey (80, (80, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW 00591 2020 NtQueryValueKey (80, (80, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW 00592 2020 NtQueryValueKey (80, (80, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\16\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\23\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\5\0\0\0\373\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\0F\0C\0C\00\03\0A\04\01\0-\08\0C\0C\0C\0-\04\09\01\09\0-\0A\0\0\0\0\0\204\3\0\0Q\2\0\0d\3\0\0\344\7\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0P\0\0\0Q\2\0\0d\3\0\0\344\7\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0R\2\0\0d\3\0\0\344\7\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0L\0\0\0L\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\310r\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\00\08\0R\2\0\0d\3\0\0\344\7\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0P\0\0\0S\2\0\0d\3\0\0\344\7\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0P\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0S\2\0\0d\3\0\0\344\7\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0T\2\0\0d\3\0\0\344\7\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0P\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) , Partial, 900, ... TitleIdx=0, Type=3, Data= (80, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\16\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\23\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\5\0\0\0\373\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\0F\0C\0C\00\03\0A\04\01\0-\08\0C\0C\0C\0-\04\09\01\09\0-\0A\0\0\0\0\0\204\3\0\0Q\2\0\0d\3\0\0\344\7\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0P\0\0\0Q\2\0\0d\3\0\0\344\7\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0R\2\0\0d\3\0\0\344\7\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0L\0\0\0L\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\310r\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\00\08\0R\2\0\0d\3\0\0\344\7\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0P\0\0\0S\2\0\0d\3\0\0\344\7\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0P\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0S\2\0\0d\3\0\0\344\7\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0T\2\0\0d\3\0\0\344\7\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0P\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) \0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0S\2\0\0d\3\0\0\344\7\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0T\2\0\0d\3\0\0\344\7\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0P\0\0\0\0\0\0\0 (80, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\16\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\23\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\5\0\0\0\373\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\0F\0C\0C\00\03\0A\04\01\0-\08\0C\0C\0C\0-\04\09\01\09\0-\0A\0\0\0\0\0\204\3\0\0Q\2\0\0d\3\0\0\344\7\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0P\0\0\0Q\2\0\0d\3\0\0\344\7\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0R\2\0\0d\3\0\0\344\7\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0L\0\0\0L\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\310r\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\00\08\0R\2\0\0d\3\0\0\344\7\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0P\0\0\0S\2\0\0d\3\0\0\344\7\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0P\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0S\2\0\0d\3\0\0\344\7\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0T\2\0\0d\3\0\0\344\7\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0P\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) }, 900, ) == 0x0 00593 2020 NtClose (80, ... ) == 0x0 00594 2020 NtOpenKey (0x20019, {24, 76, 0x40, 0, 0, (0x20019, {24, 76, 0x40, 0, 0, "000000000008"}, ... 80, ) }, ... 80, ) == 0x0 00595 2020 NtQueryValueKey (80, (80, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW 00596 2020 NtQueryValueKey (80, (80, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW 00597 2020 NtQueryValueKey (80, (80, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\11\2\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\24\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\2\0\0\0\373\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\0F\0C\0C\00\03\0A\04\01\0-\08\0C\0C\0C\0-\04\09\01\09\0-\0A\0\0\0\0\0\204\3\0\0V\2\0\0d\3\0\0\344\7\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0P\0\0\0V\2\0\0d\3\0\0\344\7\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0W\2\0\0d\3\0\0\344\7\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0L\0\0\0L\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\310r\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\00\09\0W\2\0\0d\3\0\0\344\7\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0P\0\0\0X\2\0\0d\3\0\0\344\7\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0P\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0X\2\0\0d\3\0\0\344\7\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0Y\2\0\0d\3\0\0\344\7\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0P\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) , Partial, 900, ... TitleIdx=0, Type=3, Data= (80, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\11\2\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\24\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\2\0\0\0\373\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\0F\0C\0C\00\03\0A\04\01\0-\08\0C\0C\0C\0-\04\09\01\09\0-\0A\0\0\0\0\0\204\3\0\0V\2\0\0d\3\0\0\344\7\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0P\0\0\0V\2\0\0d\3\0\0\344\7\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0W\2\0\0d\3\0\0\344\7\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0L\0\0\0L\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\310r\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\00\09\0W\2\0\0d\3\0\0\344\7\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0P\0\0\0X\2\0\0d\3\0\0\344\7\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0P\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0X\2\0\0d\3\0\0\344\7\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0Y\2\0\0d\3\0\0\344\7\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0P\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) \0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0X\2\0\0d\3\0\0\344\7\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0Y\2\0\0d\3\0\0\344\7\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0P\0\0\0\0\0\0\0 (80, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\11\2\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\24\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\2\0\0\0\373\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\0F\0C\0C\00\03\0A\04\01\0-\08\0C\0C\0C\0-\04\09\01\09\0-\0A\0\0\0\0\0\204\3\0\0V\2\0\0d\3\0\0\344\7\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0P\0\0\0V\2\0\0d\3\0\0\344\7\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0W\2\0\0d\3\0\0\344\7\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0L\0\0\0L\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\310r\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\00\09\0W\2\0\0d\3\0\0\344\7\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0P\0\0\0X\2\0\0d\3\0\0\344\7\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0P\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0X\2\0\0d\3\0\0\344\7\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0Y\2\0\0d\3\0\0\344\7\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0P\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) }, 900, ) == 0x0 00598 2020 NtClose (80, ... ) == 0x0 00599 2020 NtOpenKey (0x20019, {24, 76, 0x40, 0, 0, (0x20019, {24, 76, 0x40, 0, 0, "000000000009"}, ... 80, ) }, ... 80, ) == 0x0 00600 2020 NtQueryValueKey (80, (80, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW 00601 2020 NtQueryValueKey (80, (80, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW 00602 2020 NtQueryValueKey (80, (80, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\16\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\25\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\5\0\0\0\374\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\0A\0E\07\04\02\01\0B\05\0-\07\03\02\0D\0-\04\05\06\07\0-\0A\0\0\0\0\0\204\3\0\0[\2\0\0d\3\0\0\344\7\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0P\0\0\0[\2\0\0d\3\0\0\344\7\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\\2\0\0d\3\0\0\344\7\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0L\0\0\0L\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\310r\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\01\00\0\\2\0\0d\3\0\0\344\7\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0P\0\0\0]\2\0\0d\3\0\0\344\7\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0P\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0]\2\0\0d\3\0\0\344\7\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0^\2\0\0d\3\0\0\344\7\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0P\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) , Partial, 900, ... TitleIdx=0, Type=3, Data= (80, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\16\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\25\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\5\0\0\0\374\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\0A\0E\07\04\02\01\0B\05\0-\07\03\02\0D\0-\04\05\06\07\0-\0A\0\0\0\0\0\204\3\0\0[\2\0\0d\3\0\0\344\7\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0P\0\0\0[\2\0\0d\3\0\0\344\7\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\\2\0\0d\3\0\0\344\7\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0L\0\0\0L\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\310r\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\01\00\0\\2\0\0d\3\0\0\344\7\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0P\0\0\0]\2\0\0d\3\0\0\344\7\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0P\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0]\2\0\0d\3\0\0\344\7\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0^\2\0\0d\3\0\0\344\7\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0P\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) \0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0]\2\0\0d\3\0\0\344\7\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0^\2\0\0d\3\0\0\344\7\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0P\0\0\0\0\0\0\0 (80, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\16\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\25\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\5\0\0\0\374\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\0A\0E\07\04\02\01\0B\05\0-\07\03\02\0D\0-\04\05\06\07\0-\0A\0\0\0\0\0\204\3\0\0[\2\0\0d\3\0\0\344\7\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0P\0\0\0[\2\0\0d\3\0\0\344\7\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\\2\0\0d\3\0\0\344\7\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0L\0\0\0L\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\310r\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\01\00\0\\2\0\0d\3\0\0\344\7\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0P\0\0\0]\2\0\0d\3\0\0\344\7\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0P\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0]\2\0\0d\3\0\0\344\7\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0^\2\0\0d\3\0\0\344\7\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0P\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) }, 900, ) == 0x0 00603 2020 NtClose (80, ... ) == 0x0 00604 2020 NtOpenKey (0x20019, {24, 76, 0x40, 0, 0, (0x20019, {24, 76, 0x40, 0, 0, "000000000010"}, ... 80, ) }, ... 80, ) == 0x0 00605 2020 NtQueryValueKey (80, (80, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW 00606 2020 NtQueryValueKey (80, (80, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW 00607 2020 NtAllocateVirtualMemory (-1, 1351680, 0, 4096, 4096, 4, ... 1351680, 4096, ) == 0x0 00608 2020 NtQueryValueKey (80, (80, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\11\2\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\26\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\2\0\0\0\374\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\0A\0E\07\04\02\01\0B\05\0-\07\03\02\0D\0-\04\05\06\07\0-\0A\0\0\0\0\0\204\3\0\0a\2\0\0d\3\0\0\344\7\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0P\0\0\0a\2\0\0d\3\0\0\344\7\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0b\2\0\0d\3\0\0\344\7\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0L\0\0\0L\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\310r\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\01\01\0b\2\0\0d\3\0\0\344\7\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0P\0\0\0c\2\0\0d\3\0\0\344\7\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0P\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0c\2\0\0d\3\0\0\344\7\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0d\2\0\0d\3\0\0\344\7\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0P\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) , Partial, 900, ... TitleIdx=0, Type=3, Data= (80, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\11\2\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\26\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\2\0\0\0\374\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\0A\0E\07\04\02\01\0B\05\0-\07\03\02\0D\0-\04\05\06\07\0-\0A\0\0\0\0\0\204\3\0\0a\2\0\0d\3\0\0\344\7\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0P\0\0\0a\2\0\0d\3\0\0\344\7\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0b\2\0\0d\3\0\0\344\7\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0L\0\0\0L\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\310r\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\01\01\0b\2\0\0d\3\0\0\344\7\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0P\0\0\0c\2\0\0d\3\0\0\344\7\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0P\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0c\2\0\0d\3\0\0\344\7\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0d\2\0\0d\3\0\0\344\7\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0P\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) \0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0c\2\0\0d\3\0\0\344\7\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0d\2\0\0d\3\0\0\344\7\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0P\0\0\0\0\0\0\0 (80, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\11\2\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\26\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\2\0\0\0\374\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\0A\0E\07\04\02\01\0B\05\0-\07\03\02\0D\0-\04\05\06\07\0-\0A\0\0\0\0\0\204\3\0\0a\2\0\0d\3\0\0\344\7\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0P\0\0\0a\2\0\0d\3\0\0\344\7\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0b\2\0\0d\3\0\0\344\7\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0L\0\0\0L\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\310r\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\01\01\0b\2\0\0d\3\0\0\344\7\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0P\0\0\0c\2\0\0d\3\0\0\344\7\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0P\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0c\2\0\0d\3\0\0\344\7\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0d\2\0\0d\3\0\0\344\7\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0P\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) }, 900, ) == 0x0 00609 2020 NtClose (80, ... ) == 0x0 00610 2020 NtOpenKey (0x20019, {24, 76, 0x40, 0, 0, (0x20019, {24, 76, 0x40, 0, 0, "000000000011"}, ... 80, ) }, ... 80, ) == 0x0 00611 2020 NtQueryValueKey (80, (80, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW 00612 2020 NtQueryValueKey (80, (80, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW 00613 2020 NtQueryValueKey (80, (80, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\16\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\27\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\5\0\0\0\375\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\09\07\0C\02\0D\09\0F\04\0-\06\09\05\04\0-\04\0E\0B\03\0-\08\0\0\0\0\0\204\3\0\0f\2\0\0d\3\0\0\344\7\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0P\0\0\0f\2\0\0d\3\0\0\344\7\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0g\2\0\0d\3\0\0\344\7\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0L\0\0\0L\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\310r\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\01\02\0g\2\0\0d\3\0\0\344\7\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0P\0\0\0h\2\0\0d\3\0\0\344\7\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0P\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0h\2\0\0d\3\0\0\344\7\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0i\2\0\0d\3\0\0\344\7\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0P\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) , Partial, 900, ... TitleIdx=0, Type=3, Data= (80, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\16\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\27\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\5\0\0\0\375\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\09\07\0C\02\0D\09\0F\04\0-\06\09\05\04\0-\04\0E\0B\03\0-\08\0\0\0\0\0\204\3\0\0f\2\0\0d\3\0\0\344\7\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0P\0\0\0f\2\0\0d\3\0\0\344\7\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0g\2\0\0d\3\0\0\344\7\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0L\0\0\0L\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\310r\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\01\02\0g\2\0\0d\3\0\0\344\7\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0P\0\0\0h\2\0\0d\3\0\0\344\7\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0P\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0h\2\0\0d\3\0\0\344\7\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0i\2\0\0d\3\0\0\344\7\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0P\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) \0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0h\2\0\0d\3\0\0\344\7\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0i\2\0\0d\3\0\0\344\7\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0P\0\0\0\0\0\0\0 (80, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\16\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\27\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\5\0\0\0\375\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\09\07\0C\02\0D\09\0F\04\0-\06\09\05\04\0-\04\0E\0B\03\0-\08\0\0\0\0\0\204\3\0\0f\2\0\0d\3\0\0\344\7\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0P\0\0\0f\2\0\0d\3\0\0\344\7\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0g\2\0\0d\3\0\0\344\7\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0L\0\0\0L\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\310r\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\01\02\0g\2\0\0d\3\0\0\344\7\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0P\0\0\0h\2\0\0d\3\0\0\344\7\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0P\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0h\2\0\0d\3\0\0\344\7\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0i\2\0\0d\3\0\0\344\7\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0P\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) }, 900, ) == 0x0 00614 2020 NtClose (80, ... ) == 0x0 00615 2020 NtOpenKey (0x20019, {24, 76, 0x40, 0, 0, (0x20019, {24, 76, 0x40, 0, 0, "000000000012"}, ... 80, ) }, ... 80, ) == 0x0 00616 2020 NtQueryValueKey (80, (80, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW 00617 2020 NtQueryValueKey (80, (80, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW 00618 2020 NtQueryValueKey (80, (80, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\11\2\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\30\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\2\0\0\0\375\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\09\07\0C\02\0D\09\0F\04\0-\06\09\05\04\0-\04\0E\0B\03\0-\08\0\0\0\0\0\204\3\0\0k\2\0\0d\3\0\0\344\7\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0P\0\0\0k\2\0\0d\3\0\0\344\7\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0l\2\0\0d\3\0\0\344\7\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0L\0\0\0L\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\310r\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\01\03\0l\2\0\0d\3\0\0\344\7\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0P\0\0\0m\2\0\0d\3\0\0\344\7\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0P\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0m\2\0\0d\3\0\0\344\7\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0n\2\0\0d\3\0\0\344\7\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0P\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) , Partial, 900, ... TitleIdx=0, Type=3, Data= (80, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\11\2\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\30\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\2\0\0\0\375\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\09\07\0C\02\0D\09\0F\04\0-\06\09\05\04\0-\04\0E\0B\03\0-\08\0\0\0\0\0\204\3\0\0k\2\0\0d\3\0\0\344\7\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0P\0\0\0k\2\0\0d\3\0\0\344\7\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0l\2\0\0d\3\0\0\344\7\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0L\0\0\0L\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\310r\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\01\03\0l\2\0\0d\3\0\0\344\7\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0P\0\0\0m\2\0\0d\3\0\0\344\7\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0P\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0m\2\0\0d\3\0\0\344\7\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0n\2\0\0d\3\0\0\344\7\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0P\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) \0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0m\2\0\0d\3\0\0\344\7\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0n\2\0\0d\3\0\0\344\7\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0P\0\0\0\0\0\0\0 (80, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\11\2\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\30\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\2\0\0\0\375\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\09\07\0C\02\0D\09\0F\04\0-\06\09\05\04\0-\04\0E\0B\03\0-\08\0\0\0\0\0\204\3\0\0k\2\0\0d\3\0\0\344\7\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0P\0\0\0k\2\0\0d\3\0\0\344\7\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0l\2\0\0d\3\0\0\344\7\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0L\0\0\0L\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\310r\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\01\03\0l\2\0\0d\3\0\0\344\7\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0P\0\0\0m\2\0\0d\3\0\0\344\7\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0P\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0m\2\0\0d\3\0\0\344\7\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0n\2\0\0d\3\0\0\344\7\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0P\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) }, 900, ) == 0x0 00619 2020 NtClose (80, ... ) == 0x0 00620 2020 NtOpenKey (0x20019, {24, 76, 0x40, 0, 0, (0x20019, {24, 76, 0x40, 0, 0, "000000000013"}, ... 80, ) }, ... 80, ) == 0x0 00621 2020 NtQueryValueKey (80, (80, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW 00622 2020 NtQueryValueKey (80, (80, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW 00623 2020 NtQueryValueKey (80, (80, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\16\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\10\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\31\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\5\0\0\0\0\0\0\200\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\00\0D\04\03\00\0A\06\0F\0-\00\04\01\00\0-\04\0A\06\08\0-\09\0\0\0\0\0\204\3\0\0p\2\0\0d\3\0\0\344\7\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0P\0\0\0p\2\0\0d\3\0\0\344\7\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0q\2\0\0d\3\0\0\344\7\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0L\0\0\0L\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\310r\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\01\04\0q\2\0\0d\3\0\0\344\7\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0P\0\0\0r\2\0\0d\3\0\0\344\7\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0P\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0r\2\0\0d\3\0\0\344\7\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0s\2\0\0d\3\0\0\344\7\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0P\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) , Partial, 900, ... TitleIdx=0, Type=3, Data= (80, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\16\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\10\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\31\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\5\0\0\0\0\0\0\200\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\00\0D\04\03\00\0A\06\0F\0-\00\04\01\00\0-\04\0A\06\08\0-\09\0\0\0\0\0\204\3\0\0p\2\0\0d\3\0\0\344\7\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0P\0\0\0p\2\0\0d\3\0\0\344\7\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0q\2\0\0d\3\0\0\344\7\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0L\0\0\0L\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\310r\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\01\04\0q\2\0\0d\3\0\0\344\7\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0P\0\0\0r\2\0\0d\3\0\0\344\7\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0P\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0r\2\0\0d\3\0\0\344\7\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0s\2\0\0d\3\0\0\344\7\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0P\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) \0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0r\2\0\0d\3\0\0\344\7\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0s\2\0\0d\3\0\0\344\7\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0P\0\0\0\0\0\0\0 (80, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\16\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\10\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\31\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\5\0\0\0\0\0\0\200\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\00\0D\04\03\00\0A\06\0F\0-\00\04\01\00\0-\04\0A\06\08\0-\09\0\0\0\0\0\204\3\0\0p\2\0\0d\3\0\0\344\7\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0P\0\0\0p\2\0\0d\3\0\0\344\7\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0q\2\0\0d\3\0\0\344\7\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0L\0\0\0L\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\310r\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\01\04\0q\2\0\0d\3\0\0\344\7\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0P\0\0\0r\2\0\0d\3\0\0\344\7\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0P\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0r\2\0\0d\3\0\0\344\7\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0s\2\0\0d\3\0\0\344\7\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0P\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) }, 900, ) == 0x0 00624 2020 NtClose (80, ... ) == 0x0 00625 2020 NtOpenKey (0x20019, {24, 76, 0x40, 0, 0, (0x20019, {24, 76, 0x40, 0, 0, "000000000014"}, ... 80, ) }, ... 80, ) == 0x0 00626 2020 NtQueryValueKey (80, (80, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW 00627 2020 NtQueryValueKey (80, (80, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW 00628 2020 NtAllocateVirtualMemory (-1, 1355776, 0, 4096, 4096, 4, ... 1355776, 4096, ) == 0x0 00629 2020 NtQueryValueKey (80, (80, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\11\2\2\0\0\0\0\0\0\0\0\0\0\0\0\0\10\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\32\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\2\0\0\0\0\0\0\200\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\00\0D\04\03\00\0A\06\0F\0-\00\04\01\00\0-\04\0A\06\08\0-\09\0\0\0\0\0\204\3\0\0v\2\0\0d\3\0\0\344\7\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0P\0\0\0v\2\0\0d\3\0\0\344\7\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0w\2\0\0d\3\0\0\344\7\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0L\0\0\0L\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\310r\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\01\05\0w\2\0\0d\3\0\0\344\7\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0P\0\0\0x\2\0\0d\3\0\0\344\7\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0P\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0x\2\0\0d\3\0\0\344\7\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0y\2\0\0d\3\0\0\344\7\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0P\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) , Partial, 900, ... TitleIdx=0, Type=3, Data= (80, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\11\2\2\0\0\0\0\0\0\0\0\0\0\0\0\0\10\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\32\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\2\0\0\0\0\0\0\200\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\00\0D\04\03\00\0A\06\0F\0-\00\04\01\00\0-\04\0A\06\08\0-\09\0\0\0\0\0\204\3\0\0v\2\0\0d\3\0\0\344\7\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0P\0\0\0v\2\0\0d\3\0\0\344\7\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0w\2\0\0d\3\0\0\344\7\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0L\0\0\0L\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\310r\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\01\05\0w\2\0\0d\3\0\0\344\7\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0P\0\0\0x\2\0\0d\3\0\0\344\7\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0P\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0x\2\0\0d\3\0\0\344\7\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0y\2\0\0d\3\0\0\344\7\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0P\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) \0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0x\2\0\0d\3\0\0\344\7\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0y\2\0\0d\3\0\0\344\7\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0P\0\0\0\0\0\0\0 (80, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\11\2\2\0\0\0\0\0\0\0\0\0\0\0\0\0\10\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\32\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\2\0\0\0\0\0\0\200\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\00\0D\04\03\00\0A\06\0F\0-\00\04\01\00\0-\04\0A\06\08\0-\09\0\0\0\0\0\204\3\0\0v\2\0\0d\3\0\0\344\7\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0P\0\0\0v\2\0\0d\3\0\0\344\7\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0w\2\0\0d\3\0\0\344\7\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0L\0\0\0L\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\310r\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\01\05\0w\2\0\0d\3\0\0\344\7\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0P\0\0\0x\2\0\0d\3\0\0\344\7\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0P\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0x\2\0\0d\3\0\0\344\7\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0y\2\0\0d\3\0\0\344\7\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0P\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) }, 900, ) == 0x0 00630 2020 NtClose (80, ... ) == 0x0 00631 2020 NtOpenKey (0x20019, {24, 76, 0x40, 0, 0, (0x20019, {24, 76, 0x40, 0, 0, "000000000015"}, ... 80, ) }, ... 80, ) == 0x0 00632 2020 NtQueryValueKey (80, (80, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW 00633 2020 NtQueryValueKey (80, (80, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW 00634 2020 NtQueryValueKey (80, (80, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\16\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\33\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\5\0\0\0\377\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\08\0A\0D\04\0D\08\00\06\0-\00\08\01\0B\0-\04\04\04\06\0-\0A\0\0\0\0\0\204\3\0\0{\2\0\0d\3\0\0\344\7\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0P\0\0\0{\2\0\0d\3\0\0\344\7\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0|\2\0\0d\3\0\0\344\7\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0L\0\0\0L\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\310r\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\01\06\0|\2\0\0d\3\0\0\344\7\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0P\0\0\0}\2\0\0d\3\0\0\344\7\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0P\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0}\2\0\0d\3\0\0\344\7\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0~\2\0\0d\3\0\0\344\7\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0P\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) , Partial, 900, ... TitleIdx=0, Type=3, Data= (80, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\16\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\33\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\5\0\0\0\377\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\08\0A\0D\04\0D\08\00\06\0-\00\08\01\0B\0-\04\04\04\06\0-\0A\0\0\0\0\0\204\3\0\0{\2\0\0d\3\0\0\344\7\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0P\0\0\0{\2\0\0d\3\0\0\344\7\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0|\2\0\0d\3\0\0\344\7\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0L\0\0\0L\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\310r\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\01\06\0|\2\0\0d\3\0\0\344\7\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0P\0\0\0}\2\0\0d\3\0\0\344\7\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0P\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0}\2\0\0d\3\0\0\344\7\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0~\2\0\0d\3\0\0\344\7\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0P\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) \0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0}\2\0\0d\3\0\0\344\7\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0~\2\0\0d\3\0\0\344\7\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0P\0\0\0\0\0\0\0 (80, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\16\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\33\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\5\0\0\0\377\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\08\0A\0D\04\0D\08\00\06\0-\00\08\01\0B\0-\04\04\04\06\0-\0A\0\0\0\0\0\204\3\0\0{\2\0\0d\3\0\0\344\7\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0P\0\0\0{\2\0\0d\3\0\0\344\7\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0|\2\0\0d\3\0\0\344\7\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0L\0\0\0L\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\310r\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\01\06\0|\2\0\0d\3\0\0\344\7\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0P\0\0\0}\2\0\0d\3\0\0\344\7\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0P\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0}\2\0\0d\3\0\0\344\7\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0~\2\0\0d\3\0\0\344\7\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0P\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) }, 900, ) == 0x0 00635 2020 NtClose (80, ... ) == 0x0 00636 2020 NtOpenKey (0x20019, {24, 76, 0x40, 0, 0, (0x20019, {24, 76, 0x40, 0, 0, "000000000016"}, ... 80, ) }, ... 80, ) == 0x0 00637 2020 NtQueryValueKey (80, (80, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW 00638 2020 NtQueryValueKey (80, (80, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW 00639 2020 NtQueryValueKey (80, (80, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\11\2\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\34\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\2\0\0\0\377\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\08\0A\0D\04\0D\08\00\06\0-\00\08\01\0B\0-\04\04\04\06\0-\0A\0\0\0\0\0\204\3\0\0\200\2\0\0d\3\0\0\344\7\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0P\0\0\0\200\2\0\0d\3\0\0\344\7\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\201\2\0\0d\3\0\0\344\7\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0L\0\0\0L\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\310r\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\01\07\0\201\2\0\0d\3\0\0\344\7\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0P\0\0\0\202\2\0\0d\3\0\0\344\7\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0P\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\202\2\0\0d\3\0\0\344\7\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\203\2\0\0d\3\0\0\344\7\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0P\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) , Partial, 900, ... TitleIdx=0, Type=3, Data= (80, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\11\2\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\34\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\2\0\0\0\377\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\08\0A\0D\04\0D\08\00\06\0-\00\08\01\0B\0-\04\04\04\06\0-\0A\0\0\0\0\0\204\3\0\0\200\2\0\0d\3\0\0\344\7\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0P\0\0\0\200\2\0\0d\3\0\0\344\7\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\201\2\0\0d\3\0\0\344\7\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0L\0\0\0L\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\310r\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\01\07\0\201\2\0\0d\3\0\0\344\7\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0P\0\0\0\202\2\0\0d\3\0\0\344\7\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0P\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\202\2\0\0d\3\0\0\344\7\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\203\2\0\0d\3\0\0\344\7\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0P\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) \0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\202\2\0\0d\3\0\0\344\7\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\203\2\0\0d\3\0\0\344\7\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0P\0\0\0\0\0\0\0 (80, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\11\2\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\34\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\2\0\0\0\377\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\08\0A\0D\04\0D\08\00\06\0-\00\08\01\0B\0-\04\04\04\06\0-\0A\0\0\0\0\0\204\3\0\0\200\2\0\0d\3\0\0\344\7\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0P\0\0\0\200\2\0\0d\3\0\0\344\7\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\201\2\0\0d\3\0\0\344\7\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0L\0\0\0L\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\310r\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\01\07\0\201\2\0\0d\3\0\0\344\7\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0P\0\0\0\202\2\0\0d\3\0\0\344\7\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0P\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\202\2\0\0d\3\0\0\344\7\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\203\2\0\0d\3\0\0\344\7\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0P\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) }, 900, ) == 0x0 00640 2020 NtClose (80, ... ) == 0x0 00641 2020 NtOpenKey (0x20019, {24, 76, 0x40, 0, 0, (0x20019, {24, 76, 0x40, 0, 0, "000000000017"}, ... 80, ) }, ... 80, ) == 0x0 00642 2020 NtQueryValueKey (80, (80, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW 00643 2020 NtQueryValueKey (80, (80, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW 00644 2020 NtQueryValueKey (80, (80, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\16\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\35\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\5\0\0\0\376\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\0E\05\05\09\0B\00\0C\01\0-\0F\0A\04\06\0-\04\06\04\0D\0-\0B\0\0\0\0\0\204\3\0\0\205\2\0\0d\3\0\0\344\7\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0P\0\0\0\205\2\0\0d\3\0\0\344\7\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\206\2\0\0d\3\0\0\344\7\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0L\0\0\0L\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\310r\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\01\08\0\206\2\0\0d\3\0\0\344\7\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0P\0\0\0\207\2\0\0d\3\0\0\344\7\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0P\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\207\2\0\0d\3\0\0\344\7\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\210\2\0\0d\3\0\0\344\7\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0P\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) , Partial, 900, ... TitleIdx=0, Type=3, Data= (80, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\16\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\35\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\5\0\0\0\376\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\0E\05\05\09\0B\00\0C\01\0-\0F\0A\04\06\0-\04\06\04\0D\0-\0B\0\0\0\0\0\204\3\0\0\205\2\0\0d\3\0\0\344\7\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0P\0\0\0\205\2\0\0d\3\0\0\344\7\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\206\2\0\0d\3\0\0\344\7\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0L\0\0\0L\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\310r\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\01\08\0\206\2\0\0d\3\0\0\344\7\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0P\0\0\0\207\2\0\0d\3\0\0\344\7\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0P\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\207\2\0\0d\3\0\0\344\7\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\210\2\0\0d\3\0\0\344\7\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0P\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) \0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\207\2\0\0d\3\0\0\344\7\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\210\2\0\0d\3\0\0\344\7\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0P\0\0\0\0\0\0\0 (80, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\16\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\35\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\5\0\0\0\376\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\0E\05\05\09\0B\00\0C\01\0-\0F\0A\04\06\0-\04\06\04\0D\0-\0B\0\0\0\0\0\204\3\0\0\205\2\0\0d\3\0\0\344\7\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0P\0\0\0\205\2\0\0d\3\0\0\344\7\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\206\2\0\0d\3\0\0\344\7\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0L\0\0\0L\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\310r\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\01\08\0\206\2\0\0d\3\0\0\344\7\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0P\0\0\0\207\2\0\0d\3\0\0\344\7\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0P\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\207\2\0\0d\3\0\0\344\7\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\210\2\0\0d\3\0\0\344\7\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0P\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) }, 900, ) == 0x0 00645 2020 NtClose (80, ... ) == 0x0 00646 2020 NtOpenKey (0x20019, {24, 76, 0x40, 0, 0, (0x20019, {24, 76, 0x40, 0, 0, "000000000018"}, ... 80, ) }, ... 80, ) == 0x0 00647 2020 NtQueryValueKey (80, (80, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW 00648 2020 NtQueryValueKey (80, (80, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW 00649 2020 NtQueryValueKey (80, (80, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\11\2\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\36\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\2\0\0\0\376\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\0E\05\05\09\0B\00\0C\01\0-\0F\0A\04\06\0-\04\06\04\0D\0-\0B\0\0\0\0\0\204\3\0\0\212\2\0\0d\3\0\0\344\7\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0P\0\0\0\212\2\0\0d\3\0\0\344\7\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\213\2\0\0d\3\0\0\344\7\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0L\0\0\0L\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\310r\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\01\09\0\213\2\0\0d\3\0\0\344\7\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0P\0\0\0\214\2\0\0d\3\0\0\344\7\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0P\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\214\2\0\0d\3\0\0\344\7\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\215\2\0\0d\3\0\0\344\7\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0P\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) , Partial, 900, ... TitleIdx=0, Type=3, Data= (80, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\11\2\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\36\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\2\0\0\0\376\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\0E\05\05\09\0B\00\0C\01\0-\0F\0A\04\06\0-\04\06\04\0D\0-\0B\0\0\0\0\0\204\3\0\0\212\2\0\0d\3\0\0\344\7\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0P\0\0\0\212\2\0\0d\3\0\0\344\7\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\213\2\0\0d\3\0\0\344\7\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0L\0\0\0L\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\310r\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\01\09\0\213\2\0\0d\3\0\0\344\7\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0P\0\0\0\214\2\0\0d\3\0\0\344\7\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0P\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\214\2\0\0d\3\0\0\344\7\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\215\2\0\0d\3\0\0\344\7\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0P\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) \0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\214\2\0\0d\3\0\0\344\7\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\215\2\0\0d\3\0\0\344\7\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0P\0\0\0\0\0\0\0 (80, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\11\2\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\36\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\2\0\0\0\376\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\0E\05\05\09\0B\00\0C\01\0-\0F\0A\04\06\0-\04\06\04\0D\0-\0B\0\0\0\0\0\204\3\0\0\212\2\0\0d\3\0\0\344\7\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0P\0\0\0\212\2\0\0d\3\0\0\344\7\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\213\2\0\0d\3\0\0\344\7\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0L\0\0\0L\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\310r\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\01\09\0\213\2\0\0d\3\0\0\344\7\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0P\0\0\0\214\2\0\0d\3\0\0\344\7\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0P\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\214\2\0\0d\3\0\0\344\7\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\215\2\0\0d\3\0\0\344\7\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0P\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) }, 900, ) == 0x0 00650 2020 NtClose (80, ... ) == 0x0 00651 2020 NtOpenKey (0x20019, {24, 76, 0x40, 0, 0, (0x20019, {24, 76, 0x40, 0, 0, "000000000019"}, ... 80, ) }, ... 80, ) == 0x0 00652 2020 NtQueryValueKey (80, (80, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW 00653 2020 NtQueryValueKey (80, (80, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW 00654 2020 NtAllocateVirtualMemory (-1, 1359872, 0, 4096, 4096, 4, ... 1359872, 4096, ) == 0x0 00655 2020 NtQueryValueKey (80, (80, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\16\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\37\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\5\0\0\0\372\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\0C\0D\03\0C\06\04\0B\08\0-\0D\0B\07\06\0-\04\04\0C\08\0-\09\0\0\0\0\0\204\3\0\0\220\2\0\0d\3\0\0\344\7\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0P\0\0\0\220\2\0\0d\3\0\0\344\7\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\221\2\0\0d\3\0\0\344\7\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0L\0\0\0L\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\310r\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\02\00\0\221\2\0\0d\3\0\0\344\7\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0P\0\0\0\222\2\0\0d\3\0\0\344\7\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0P\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\222\2\0\0d\3\0\0\344\7\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\223\2\0\0d\3\0\0\344\7\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0P\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) , Partial, 900, ... TitleIdx=0, Type=3, Data= (80, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\16\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\37\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\5\0\0\0\372\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\0C\0D\03\0C\06\04\0B\08\0-\0D\0B\07\06\0-\04\04\0C\08\0-\09\0\0\0\0\0\204\3\0\0\220\2\0\0d\3\0\0\344\7\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0P\0\0\0\220\2\0\0d\3\0\0\344\7\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\221\2\0\0d\3\0\0\344\7\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0L\0\0\0L\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\310r\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\02\00\0\221\2\0\0d\3\0\0\344\7\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0P\0\0\0\222\2\0\0d\3\0\0\344\7\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0P\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\222\2\0\0d\3\0\0\344\7\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\223\2\0\0d\3\0\0\344\7\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0P\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) \0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\222\2\0\0d\3\0\0\344\7\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\223\2\0\0d\3\0\0\344\7\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0P\0\0\0\0\0\0\0 (80, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\16\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\37\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\5\0\0\0\372\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\0C\0D\03\0C\06\04\0B\08\0-\0D\0B\07\06\0-\04\04\0C\08\0-\09\0\0\0\0\0\204\3\0\0\220\2\0\0d\3\0\0\344\7\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0P\0\0\0\220\2\0\0d\3\0\0\344\7\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\221\2\0\0d\3\0\0\344\7\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0L\0\0\0L\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\310r\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\02\00\0\221\2\0\0d\3\0\0\344\7\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0P\0\0\0\222\2\0\0d\3\0\0\344\7\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0P\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\222\2\0\0d\3\0\0\344\7\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\223\2\0\0d\3\0\0\344\7\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0P\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) }, 900, ) == 0x0 00656 2020 NtClose (80, ... ) == 0x0 00657 2020 NtOpenKey (0x20019, {24, 76, 0x40, 0, 0, (0x20019, {24, 76, 0x40, 0, 0, "000000000020"}, ... 80, ) }, ... 80, ) == 0x0 00658 2020 NtQueryValueKey (80, (80, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW 00659 2020 NtQueryValueKey (80, (80, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW 00660 2020 NtQueryValueKey (80, (80, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\11\2\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222 \4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\2\0\0\0\372\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\0C\0D\03\0C\06\04\0B\08\0-\0D\0B\07\06\0-\04\04\0C\08\0-\09\0\0\0\0\0\204\3\0\0\225\2\0\0d\3\0\0\344\7\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0P\0\0\0\225\2\0\0d\3\0\0\344\7\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\226\2\0\0d\3\0\0\344\7\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0L\0\0\0L\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\310r\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\02\01\0\226\2\0\0d\3\0\0\344\7\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0P\0\0\0\227\2\0\0d\3\0\0\344\7\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0P\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\227\2\0\0d\3\0\0\344\7\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\230\2\0\0d\3\0\0\344\7\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0P\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) , Partial, 900, ... TitleIdx=0, Type=3, Data= (80, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\11\2\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222 \4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\2\0\0\0\372\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\0C\0D\03\0C\06\04\0B\08\0-\0D\0B\07\06\0-\04\04\0C\08\0-\09\0\0\0\0\0\204\3\0\0\225\2\0\0d\3\0\0\344\7\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0P\0\0\0\225\2\0\0d\3\0\0\344\7\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\226\2\0\0d\3\0\0\344\7\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0L\0\0\0L\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\310r\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\02\01\0\226\2\0\0d\3\0\0\344\7\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0P\0\0\0\227\2\0\0d\3\0\0\344\7\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0P\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\227\2\0\0d\3\0\0\344\7\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\230\2\0\0d\3\0\0\344\7\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0P\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) \0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\227\2\0\0d\3\0\0\344\7\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\230\2\0\0d\3\0\0\344\7\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0P\0\0\0\0\0\0\0 (80, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\11\2\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222 \4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\2\0\0\0\372\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\0C\0D\03\0C\06\04\0B\08\0-\0D\0B\07\06\0-\04\04\0C\08\0-\09\0\0\0\0\0\204\3\0\0\225\2\0\0d\3\0\0\344\7\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0P\0\0\0\225\2\0\0d\3\0\0\344\7\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\226\2\0\0d\3\0\0\344\7\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0L\0\0\0L\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\310r\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\02\01\0\226\2\0\0d\3\0\0\344\7\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0P\0\0\0\227\2\0\0d\3\0\0\344\7\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0P\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\227\2\0\0d\3\0\0\344\7\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\230\2\0\0d\3\0\0\344\7\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0P\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) }, 900, ) == 0x0 00661 2020 NtClose (80, ... ) == 0x0 00662 2020 NtOpenKey (0x20019, {24, 76, 0x40, 0, 0, (0x20019, {24, 76, 0x40, 0, 0, "000000000021"}, ... 80, ) }, ... 80, ) == 0x0 00663 2020 NtQueryValueKey (80, (80, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW 00664 2020 NtQueryValueKey (80, (80, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW 00665 2020 NtQueryValueKey (80, (80, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\16\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222!\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\5\0\0\0\371\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\02\01\0B\08\0E\09\0D\05\0-\03\0F\0C\03\0-\04\0F\09\0D\0-\08\0\0\0\0\0\204\3\0\0\232\2\0\0d\3\0\0\344\7\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0P\0\0\0\232\2\0\0d\3\0\0\344\7\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\233\2\0\0d\3\0\0\344\7\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0L\0\0\0L\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\310r\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\02\02\0\233\2\0\0d\3\0\0\344\7\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0P\0\0\0\234\2\0\0d\3\0\0\344\7\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0P\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\234\2\0\0d\3\0\0\344\7\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\235\2\0\0d\3\0\0\344\7\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0P\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) , Partial, 900, ... TitleIdx=0, Type=3, Data= (80, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\16\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222!\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\5\0\0\0\371\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\02\01\0B\08\0E\09\0D\05\0-\03\0F\0C\03\0-\04\0F\09\0D\0-\08\0\0\0\0\0\204\3\0\0\232\2\0\0d\3\0\0\344\7\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0P\0\0\0\232\2\0\0d\3\0\0\344\7\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\233\2\0\0d\3\0\0\344\7\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0L\0\0\0L\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\310r\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\02\02\0\233\2\0\0d\3\0\0\344\7\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0P\0\0\0\234\2\0\0d\3\0\0\344\7\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0P\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\234\2\0\0d\3\0\0\344\7\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\235\2\0\0d\3\0\0\344\7\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0P\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) \0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\234\2\0\0d\3\0\0\344\7\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\235\2\0\0d\3\0\0\344\7\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0P\0\0\0\0\0\0\0 (80, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\16\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222!\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\5\0\0\0\371\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\02\01\0B\08\0E\09\0D\05\0-\03\0F\0C\03\0-\04\0F\09\0D\0-\08\0\0\0\0\0\204\3\0\0\232\2\0\0d\3\0\0\344\7\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0P\0\0\0\232\2\0\0d\3\0\0\344\7\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\233\2\0\0d\3\0\0\344\7\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0L\0\0\0L\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\310r\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\02\02\0\233\2\0\0d\3\0\0\344\7\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0P\0\0\0\234\2\0\0d\3\0\0\344\7\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0P\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\234\2\0\0d\3\0\0\344\7\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\235\2\0\0d\3\0\0\344\7\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0P\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) }, 900, ) == 0x0 00666 2020 NtClose (80, ... ) == 0x0 00667 2020 NtOpenKey (0x20019, {24, 76, 0x40, 0, 0, (0x20019, {24, 76, 0x40, 0, 0, "000000000022"}, ... 80, ) }, ... 80, ) == 0x0 00668 2020 NtQueryValueKey (80, (80, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW 00669 2020 NtQueryValueKey (80, (80, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW 00670 2020 NtQueryValueKey (80, (80, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\11\2\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222"\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\2\0\0\0\371\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\02\01\0B\08\0E\09\0D\05\0-\03\0F\0C\03\0-\04\0F\09\0D\0-\08\0\0\0\0\0\204\3\0\0\237\2\0\0d\3\0\0\344\7\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0P\0\0\0\237\2\0\0d\3\0\0\344\7\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\240\2\0\0d\3\0\0\344\7\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0L\0\0\0\240\2\0\0d\3\0\0\344\7\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\241\2\0\0d\3\0\0\344\7\0\0\305\0\0\0\0\0\1\0\0\0\0\0\24\0\0\0D\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\241\2\0\0d\3\0\0\344\7\0\0\305\0\0\0\1\0\1\0\2\1\0\0\0\0\0\0\242\2\0\0d\3\0\0\344\7\0\0\25\0\0\0\0\0\1\0\0\0\0\0\24\0\0\0\3\0\37\0\377\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\242\2\0\0d\3\0\0\344\7\0\0\25\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0L\0\0\0\243\2\0\0d\3\0\0\344\7\0\0Q\0\0\0\0\0\1\0\0\0\0\0T\0\0\0\0\0\0\2\0\0\0\0\30\0\0\0@\0\0\0t\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0$\0&\0\230r\24\0\0\0\0\0N\0a\0m\0e\0S\0p\0a\0c\0e\0_\0C\0a\0t\0a\0l\0o\0g\05\0"}, 900, ) , Partial, 900, ... TitleIdx=0, Type=3, Data= (80, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\11\2\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222"\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\2\0\0\0\371\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\02\01\0B\08\0E\09\0D\05\0-\03\0F\0C\03\0-\04\0F\09\0D\0-\08\0\0\0\0\0\204\3\0\0\237\2\0\0d\3\0\0\344\7\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0P\0\0\0\237\2\0\0d\3\0\0\344\7\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\240\2\0\0d\3\0\0\344\7\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0L\0\0\0\240\2\0\0d\3\0\0\344\7\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\241\2\0\0d\3\0\0\344\7\0\0\305\0\0\0\0\0\1\0\0\0\0\0\24\0\0\0D\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\241\2\0\0d\3\0\0\344\7\0\0\305\0\0\0\1\0\1\0\2\1\0\0\0\0\0\0\242\2\0\0d\3\0\0\344\7\0\0\25\0\0\0\0\0\1\0\0\0\0\0\24\0\0\0\3\0\37\0\377\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\242\2\0\0d\3\0\0\344\7\0\0\25\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0L\0\0\0\243\2\0\0d\3\0\0\344\7\0\0Q\0\0\0\0\0\1\0\0\0\0\0T\0\0\0\0\0\0\2\0\0\0\0\30\0\0\0@\0\0\0t\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0$\0&\0\230r\24\0\0\0\0\0N\0a\0m\0e\0S\0p\0a\0c\0e\0_\0C\0a\0t\0a\0l\0o\0g\05\0"}, 900, ) \4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\2\0\0\0\371\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\02\01\0B\08\0E\09\0D\05\0-\03\0F\0C\03\0-\04\0F\09\0D\0-\08\0\0\0\0\0\204\3\0\0\237\2\0\0d\3\0\0\344\7\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0P\0\0\0\237\2\0\0d\3\0\0\344\7\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\240\2\0\0d\3\0\0\344\7\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0L\0\0\0\240\2\0\0d\3\0\0\344\7\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\241\2\0\0d\3\0\0\344\7\0\0\305\0\0\0\0\0\1\0\0\0\0\0\24\0\0\0D\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\241\2\0\0d\3\0\0\344\7\0\0\305\0\0\0\1\0\1\0\2\1\0\0\0\0\0\0\242\2\0\0d\3\0\0\344\7\0\0\25\0\0\0\0\0\1\0\0\0\0\0\24\0\0\0\3\0\37\0\377\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\242\2\0\0d\3\0\0\344\7\0\0\25\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0L\0\0\0\243\2\0\0d\3\0\0\344\7\0\0Q\0\0\0\0\0\1\0\0\0\0\0T\0\0\0\0\0\0\2\0\0\0\0\30\0\0\0@\0\0\0t\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0$\0&\0\230r\24\0\0\0\0\0N\0a\0m\0e\0S\0p\0a\0c\0e\0_\0C\0a\0t\0a\0l\0o\0g\05\0"}, 900, ) == 0x0 00671 2020 NtClose (80, ... ) == 0x0 00672 2020 NtClose (76, ... ) == 0x0 00673 2020 NtWaitForSingleObject (68, 0, {0, 0}, ... ) == 0x102 00674 2020 NtCreateEvent (0x1f0003, 0x0, 0, 0, ... 76, ) == 0x0 00675 2020 NtOpenKey (0x2000000, {24, 64, 0x40, 0, 0, (0x2000000, {24, 64, 0x40, 0, 0, "NameSpace_Catalog5"}, ... 80, ) }, ... 80, ) == 0x0 00676 2020 NtQueryValueKey (80, (80, "Serial_Access_Num", Partial, 144, ... TitleIdx=0, Type=4, Data="\5\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (80, "Serial_Access_Num", Partial, 144, ... TitleIdx=0, Type=4, Data="\5\0\0\0"}, 16, ) }, 16, ) == 0x0 00677 2020 NtNotifyChangeKey (80, 76, 0, 0, 2011455960, 1, 0, 0, 0, 1, ... ) == 0x103 00678 2020 NtQueryValueKey (80, (80, "Serial_Access_Num", Partial, 144, ... TitleIdx=0, Type=4, Data="\5\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (80, "Serial_Access_Num", Partial, 144, ... TitleIdx=0, Type=4, Data="\5\0\0\0"}, 16, ) }, 16, ) == 0x0 00679 2020 NtOpenKey (0x2000000, {24, 80, 0x40, 0, 0, (0x2000000, {24, 80, 0x40, 0, 0, "00000005"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 00680 2020 NtQueryValueKey (80, (80, "Num_Catalog_Entries", Partial, 144, ... TitleIdx=0, Type=4, Data="\4\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (80, "Num_Catalog_Entries", Partial, 144, ... TitleIdx=0, Type=4, Data="\4\0\0\0"}, 16, ) }, 16, ) == 0x0 00681 2020 NtOpenKey (0x2000000, {24, 80, 0x40, 0, 0, (0x2000000, {24, 80, 0x40, 0, 0, "Catalog_Entries"}, ... 84, ) }, ... 84, ) == 0x0 00682 2020 NtOpenKey (0x20019, {24, 84, 0x40, 0, 0, (0x20019, {24, 84, 0x40, 0, 0, "000000000001"}, ... 88, ) }, ... 88, ) == 0x0 00683 2020 NtQueryValueKey (88, (88, "LibraryPath", Partial, 144, ... TitleIdx=0, Type=1, Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0m\0s\0w\0s\0o\0c\0k\0.\0d\0l\0l\0\0\0"}, 80, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (88, "LibraryPath", Partial, 144, ... TitleIdx=0, Type=1, Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0m\0s\0w\0s\0o\0c\0k\0.\0d\0l\0l\0\0\0"}, 80, ) }, 80, ) == 0x0 00684 2020 NtQueryValueKey (88, (88, "LibraryPath", Partial, 144, ... TitleIdx=0, Type=1, Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0m\0s\0w\0s\0o\0c\0k\0.\0d\0l\0l\0\0\0"}, 80, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (88, "LibraryPath", Partial, 144, ... TitleIdx=0, Type=1, Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0m\0s\0w\0s\0o\0c\0k\0.\0d\0l\0l\0\0\0"}, 80, ) }, 80, ) == 0x0 00685 2020 NtQueryValueKey (88, (88, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="T\0c\0p\0i\0p\0\0\0"}, 24, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (88, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="T\0c\0p\0i\0p\0\0\0"}, 24, ) }, 24, ) == 0x0 00686 2020 NtQueryValueKey (88, (88, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="T\0c\0p\0i\0p\0\0\0"}, 24, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (88, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="T\0c\0p\0i\0p\0\0\0"}, 24, ) }, 24, ) == 0x0 00687 2020 NtQueryValueKey (88, (88, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="T\0c\0p\0i\0p\0\0\0"}, 24, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (88, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="T\0c\0p\0i\0p\0\0\0"}, 24, ) }, 24, ) == 0x0 00688 2020 NtQueryValueKey (88, (88, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="T\0c\0p\0i\0p\0\0\0"}, 24, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (88, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="T\0c\0p\0i\0p\0\0\0"}, 24, ) }, 24, ) == 0x0 00689 2020 NtQueryValueKey (88, (88, "ProviderId", Partial, 144, ... TitleIdx=0, Type=3, Data="@\235\5"\236~\317\21\256Z\0\252\0\247\21+"}, 28, ) , Partial, 144, ... TitleIdx=0, Type=3, Data= (88, "ProviderId", Partial, 144, ... TitleIdx=0, Type=3, Data="@\235\5"\236~\317\21\256Z\0\252\0\247\21+"}, 28, ) \236~\317\21\256Z\0\252\0\247\21+"}, 28, ) == 0x0 00690 2020 NtQueryValueKey (88, (88, "AddressFamily", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 00691 2020 NtQueryValueKey (88, (88, "SupportedNameSpace", Partial, 144, ... TitleIdx=0, Type=4, Data="\14\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (88, "SupportedNameSpace", Partial, 144, ... TitleIdx=0, Type=4, Data="\14\0\0\0"}, 16, ) }, 16, ) == 0x0 00692 2020 NtQueryValueKey (88, (88, "Enabled", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (88, "Enabled", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) }, 16, ) == 0x0 00693 2020 NtQueryValueKey (88, (88, "Version", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (88, "Version", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) }, 16, ) == 0x0 00694 2020 NtQueryValueKey (88, (88, "StoresServiceClassInfo", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (88, "StoresServiceClassInfo", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) }, 16, ) == 0x0 00695 2020 NtClose (88, ... ) == 0x0 00696 2020 NtOpenKey (0x20019, {24, 84, 0x40, 0, 0, (0x20019, {24, 84, 0x40, 0, 0, "000000000002"}, ... 88, ) }, ... 88, ) == 0x0 00697 2020 NtQueryValueKey (88, (88, "LibraryPath", Partial, 144, ... TitleIdx=0, Type=1, Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0w\0i\0n\0r\0n\0r\0.\0d\0l\0l\0\0\0"}, 78, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (88, "LibraryPath", Partial, 144, ... TitleIdx=0, Type=1, Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0w\0i\0n\0r\0n\0r\0.\0d\0l\0l\0\0\0"}, 78, ) }, 78, ) == 0x0 00698 2020 NtQueryValueKey (88, (88, "LibraryPath", Partial, 144, ... TitleIdx=0, Type=1, Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0w\0i\0n\0r\0n\0r\0.\0d\0l\0l\0\0\0"}, 78, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (88, "LibraryPath", Partial, 144, ... TitleIdx=0, Type=1, Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0w\0i\0n\0r\0n\0r\0.\0d\0l\0l\0\0\0"}, 78, ) }, 78, ) == 0x0 00699 2020 NtQueryValueKey (88, (88, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="N\0T\0D\0S\0\0\0"}, 22, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (88, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="N\0T\0D\0S\0\0\0"}, 22, ) }, 22, ) == 0x0 00700 2020 NtQueryValueKey (88, (88, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="N\0T\0D\0S\0\0\0"}, 22, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (88, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="N\0T\0D\0S\0\0\0"}, 22, ) }, 22, ) == 0x0 00701 2020 NtQueryValueKey (88, (88, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="N\0T\0D\0S\0\0\0"}, 22, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (88, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="N\0T\0D\0S\0\0\0"}, 22, ) }, 22, ) == 0x0 00702 2020 NtQueryValueKey (88, (88, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="N\0T\0D\0S\0\0\0"}, 22, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (88, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="N\0T\0D\0S\0\0\0"}, 22, ) }, 22, ) == 0x0 00703 2020 NtQueryValueKey (88, (88, "ProviderId", Partial, 144, ... TitleIdx=0, Type=3, Data="\3567&;\200\345\317\21\245U\0\300O\330\324\254"}, 28, ) , Partial, 144, ... TitleIdx=0, Type=3, Data= (88, "ProviderId", Partial, 144, ... TitleIdx=0, Type=3, Data="\3567&;\200\345\317\21\245U\0\300O\330\324\254"}, 28, ) }, 28, ) == 0x0 00704 2020 NtQueryValueKey (88, (88, "AddressFamily", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 00705 2020 NtQueryValueKey (88, (88, "SupportedNameSpace", Partial, 144, ... TitleIdx=0, Type=4, Data=" \0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (88, "SupportedNameSpace", Partial, 144, ... TitleIdx=0, Type=4, Data=" \0\0\0"}, 16, ) }, 16, ) == 0x0 00706 2020 NtQueryValueKey (88, (88, "Enabled", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (88, "Enabled", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) }, 16, ) == 0x0 00707 2020 NtQueryValueKey (88, (88, "Version", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (88, "Version", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) }, 16, ) == 0x0 00708 2020 NtQueryValueKey (88, (88, "StoresServiceClassInfo", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (88, "StoresServiceClassInfo", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) }, 16, ) == 0x0 00709 2020 NtClose (88, ... ) == 0x0 00710 2020 NtAllocateVirtualMemory (-1, 1363968, 0, 4096, 4096, 4, ... 1363968, 4096, ) == 0x0 00711 2020 NtOpenKey (0x20019, {24, 84, 0x40, 0, 0, (0x20019, {24, 84, 0x40, 0, 0, "000000000003"}, ... 88, ) }, ... 88, ) == 0x0 00712 2020 NtQueryValueKey (88, (88, "LibraryPath", Partial, 144, ... TitleIdx=0, Type=1, Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0m\0s\0w\0s\0o\0c\0k\0.\0d\0l\0l\0\0\0"}, 80, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (88, "LibraryPath", Partial, 144, ... TitleIdx=0, Type=1, Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0m\0s\0w\0s\0o\0c\0k\0.\0d\0l\0l\0\0\0"}, 80, ) }, 80, ) == 0x0 00713 2020 NtQueryValueKey (88, (88, "LibraryPath", Partial, 144, ... TitleIdx=0, Type=1, Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0m\0s\0w\0s\0o\0c\0k\0.\0d\0l\0l\0\0\0"}, 80, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (88, "LibraryPath", Partial, 144, ... TitleIdx=0, Type=1, Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0m\0s\0w\0s\0o\0c\0k\0.\0d\0l\0l\0\0\0"}, 80, ) }, 80, ) == 0x0 00714 2020 NtQueryValueKey (88, (88, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="N\0e\0t\0w\0o\0r\0k\0 \0L\0o\0c\0a\0t\0i\0o\0n\0 \0A\0w\0a\0r\0e\0n\0e\0s\0s\0 \0(\0N\0L\0A\0)\0 \0N\0a\0m\0e\0s\0p\0a\0c\0e\0\0\0"}, 98, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (88, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="N\0e\0t\0w\0o\0r\0k\0 \0L\0o\0c\0a\0t\0i\0o\0n\0 \0A\0w\0a\0r\0e\0n\0e\0s\0s\0 \0(\0N\0L\0A\0)\0 \0N\0a\0m\0e\0s\0p\0a\0c\0e\0\0\0"}, 98, ) }, 98, ) == 0x0 00715 2020 NtQueryValueKey (88, (88, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="N\0e\0t\0w\0o\0r\0k\0 \0L\0o\0c\0a\0t\0i\0o\0n\0 \0A\0w\0a\0r\0e\0n\0e\0s\0s\0 \0(\0N\0L\0A\0)\0 \0N\0a\0m\0e\0s\0p\0a\0c\0e\0\0\0"}, 98, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (88, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="N\0e\0t\0w\0o\0r\0k\0 \0L\0o\0c\0a\0t\0i\0o\0n\0 \0A\0w\0a\0r\0e\0n\0e\0s\0s\0 \0(\0N\0L\0A\0)\0 \0N\0a\0m\0e\0s\0p\0a\0c\0e\0\0\0"}, 98, ) }, 98, ) == 0x0 00716 2020 NtQueryValueKey (88, (88, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="N\0e\0t\0w\0o\0r\0k\0 \0L\0o\0c\0a\0t\0i\0o\0n\0 \0A\0w\0a\0r\0e\0n\0e\0s\0s\0 \0(\0N\0L\0A\0)\0 \0N\0a\0m\0e\0s\0p\0a\0c\0e\0\0\0"}, 98, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (88, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="N\0e\0t\0w\0o\0r\0k\0 \0L\0o\0c\0a\0t\0i\0o\0n\0 \0A\0w\0a\0r\0e\0n\0e\0s\0s\0 \0(\0N\0L\0A\0)\0 \0N\0a\0m\0e\0s\0p\0a\0c\0e\0\0\0"}, 98, ) }, 98, ) == 0x0 00717 2020 NtQueryValueKey (88, (88, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="N\0e\0t\0w\0o\0r\0k\0 \0L\0o\0c\0a\0t\0i\0o\0n\0 \0A\0w\0a\0r\0e\0n\0e\0s\0s\0 \0(\0N\0L\0A\0)\0 \0N\0a\0m\0e\0s\0p\0a\0c\0e\0\0\0"}, 98, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (88, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="N\0e\0t\0w\0o\0r\0k\0 \0L\0o\0c\0a\0t\0i\0o\0n\0 \0A\0w\0a\0r\0e\0n\0e\0s\0s\0 \0(\0N\0L\0A\0)\0 \0N\0a\0m\0e\0s\0p\0a\0c\0e\0\0\0"}, 98, ) }, 98, ) == 0x0 00718 2020 NtQueryValueKey (88, (88, "ProviderId", Partial, 144, ... TitleIdx=0, Type=3, Data=":$Bf\250;\246J\272\245.\13\327\37\335\203"}, 28, ) , Partial, 144, ... TitleIdx=0, Type=3, Data= (88, "ProviderId", Partial, 144, ... TitleIdx=0, Type=3, Data=":$Bf\250;\246J\272\245.\13\327\37\335\203"}, 28, ) }, 28, ) == 0x0 00719 2020 NtQueryValueKey (88, (88, "AddressFamily", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 00720 2020 NtQueryValueKey (88, (88, "SupportedNameSpace", Partial, 144, ... TitleIdx=0, Type=4, Data="\17\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (88, "SupportedNameSpace", Partial, 144, ... TitleIdx=0, Type=4, Data="\17\0\0\0"}, 16, ) }, 16, ) == 0x0 00721 2020 NtQueryValueKey (88, (88, "Enabled", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (88, "Enabled", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) }, 16, ) == 0x0 00722 2020 NtQueryValueKey (88, (88, "Version", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (88, "Version", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) }, 16, ) == 0x0 00723 2020 NtQueryValueKey (88, (88, "StoresServiceClassInfo", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (88, "StoresServiceClassInfo", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) }, 16, ) == 0x0 00724 2020 NtClose (88, ... ) == 0x0 00725 2020 NtOpenKey (0x20019, {24, 84, 0x40, 0, 0, (0x20019, {24, 84, 0x40, 0, 0, "000000000004"}, ... 88, ) }, ... 88, ) == 0x0 00726 2020 NtQueryValueKey (88, (88, "LibraryPath", Partial, 144, ... TitleIdx=0, Type=1, Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0s\0y\0s\0t\0e\0m\03\02\0\\0w\0s\0h\0b\0t\0h\0.\0d\0l\0l\0\0\0"}, 78, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (88, "LibraryPath", Partial, 144, ... TitleIdx=0, Type=1, Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0s\0y\0s\0t\0e\0m\03\02\0\\0w\0s\0h\0b\0t\0h\0.\0d\0l\0l\0\0\0"}, 78, ) }, 78, ) == 0x0 00727 2020 NtQueryValueKey (88, (88, "LibraryPath", Partial, 144, ... TitleIdx=0, Type=1, Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0s\0y\0s\0t\0e\0m\03\02\0\\0w\0s\0h\0b\0t\0h\0.\0d\0l\0l\0\0\0"}, 78, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (88, "LibraryPath", Partial, 144, ... TitleIdx=0, Type=1, Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0s\0y\0s\0t\0e\0m\03\02\0\\0w\0s\0h\0b\0t\0h\0.\0d\0l\0l\0\0\0"}, 78, ) }, 78, ) == 0x0 00728 2020 NtQueryValueKey (88, (88, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="B\0l\0u\0e\0t\0o\0o\0t\0h\0 \0N\0a\0m\0e\0s\0p\0a\0c\0e\0\0\0"}, 52, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (88, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="B\0l\0u\0e\0t\0o\0o\0t\0h\0 \0N\0a\0m\0e\0s\0p\0a\0c\0e\0\0\0"}, 52, ) }, 52, ) == 0x0 00729 2020 NtQueryValueKey (88, (88, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="B\0l\0u\0e\0t\0o\0o\0t\0h\0 \0N\0a\0m\0e\0s\0p\0a\0c\0e\0\0\0"}, 52, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (88, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="B\0l\0u\0e\0t\0o\0o\0t\0h\0 \0N\0a\0m\0e\0s\0p\0a\0c\0e\0\0\0"}, 52, ) }, 52, ) == 0x0 00730 2020 NtQueryValueKey (88, (88, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="B\0l\0u\0e\0t\0o\0o\0t\0h\0 \0N\0a\0m\0e\0s\0p\0a\0c\0e\0\0\0"}, 52, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (88, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="B\0l\0u\0e\0t\0o\0o\0t\0h\0 \0N\0a\0m\0e\0s\0p\0a\0c\0e\0\0\0"}, 52, ) }, 52, ) == 0x0 00731 2020 NtQueryValueKey (88, (88, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="B\0l\0u\0e\0t\0o\0o\0t\0h\0 \0N\0a\0m\0e\0s\0p\0a\0c\0e\0\0\0"}, 52, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (88, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="B\0l\0u\0e\0t\0o\0o\0t\0h\0 \0N\0a\0m\0e\0s\0p\0a\0c\0e\0\0\0"}, 52, ) }, 52, ) == 0x0 00732 2020 NtQueryValueKey (88, (88, "ProviderId", Partial, 144, ... TitleIdx=0, Type=3, Data="\340c\252\6`}\377A\257\262>\346\322\3319-"}, 28, ) , Partial, 144, ... TitleIdx=0, Type=3, Data= (88, "ProviderId", Partial, 144, ... TitleIdx=0, Type=3, Data="\340c\252\6`}\377A\257\262>\346\322\3319-"}, 28, ) }, 28, ) == 0x0 00733 2020 NtQueryValueKey (88, (88, "AddressFamily", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 00734 2020 NtQueryValueKey (88, (88, "SupportedNameSpace", Partial, 144, ... TitleIdx=0, Type=4, Data="\20\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (88, "SupportedNameSpace", Partial, 144, ... TitleIdx=0, Type=4, Data="\20\0\0\0"}, 16, ) }, 16, ) == 0x0 00735 2020 NtQueryValueKey (88, (88, "Enabled", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (88, "Enabled", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) }, 16, ) == 0x0 00736 2020 NtQueryValueKey (88, (88, "Version", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (88, "Version", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) }, 16, ) == 0x0 00737 2020 NtQueryValueKey (88, (88, "StoresServiceClassInfo", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (88, "StoresServiceClassInfo", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) }, 16, ) == 0x0 00738 2020 NtClose (88, ... ) == 0x0 00739 2020 NtClose (84, ... ) == 0x0 00740 2020 NtWaitForSingleObject (76, 0, {0, 0}, ... ) == 0x102 00741 2020 NtClose (64, ... ) == 0x0 00742 2020 NtQuerySystemInformation (Basic, 44, ... {Unknown=0,MaximumIncrement=156250,PhysicalPageSize=0x1000,NumberOfPhysicalPages=0xff7c,LowestPhysicalPage=0x1,HighestPhysicalPage=0xffff,AllocationGranularity=0x10000,LowestUserAddress=0x10000,HighestUserAddress=0x7ffeffff,ActiveProcessors=1,NumberProcessors=1,}, 0x0, ) == 0x0 00743 2020 NtQuerySystemInformation (Processor, 12, ... {system info, class 1, size 12}, 0x0, ) == 0x0 00744 2020 NtOpenKey (0x1, {24, 16, 0x40, 0, 0, (0x1, {24, 16, 0x40, 0, 0, "System\CurrentControlSet\Services\Winsock2\Parameters"}, ... 64, ) }, ... 64, ) == 0x0 00745 2020 NtQueryValueKey (64, (64, "Ws2_32NumHandleBuckets", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 00746 2020 NtClose (64, ... ) == 0x0 00747 2020 NtDuplicateObject (-1, -2, -1, 0x0, 0, 2, ... 64, ) == 0x0 00748 2020 NtAllocateVirtualMemory (-1, 9977856, 0, 81920, 4096, 4, ... 9977856, 81920, ) == 0x0 00749 2020 NtLockVirtualMemory (-1, (0x980440), 65536, 1, ... (0x980000), 69632, ) == 0x0 00750 2020 NtCreateEvent (0x1f0003, 0x0, 0, -1, ... 84, ) == 0x0 00751 2020 NtQueryVirtualMemory (-1, 0x3df666, Basic, 28, ... {BaseAddress=0x3df000,AllocationBase=0x3b0000,AllocationProtect=0x40,RegionSize=0x15000,State=0x1000,Protect=0x40,Type=0x20000,}, 28, ) == 0x0 00752 2020 NtContinue (1244328, 0, ... 00753 2020 NtFreeVirtualMemory (-1, (0x994000), 16384, 16384, ... (0x994000), 16384, ) == 0x0 00754 2020 NtQueryVirtualMemory (-1, 0x3deb09, Basic, 28, ... {BaseAddress=0x3de000,AllocationBase=0x3b0000,AllocationProtect=0x40,RegionSize=0x16000,State=0x1000,Protect=0x40,Type=0x20000,}, 28, ) == 0x0 00755 2020 NtContinue (1244016, 0, ... 00756 2020 NtAllocateVirtualMemory (-1, 10043392, 0, 32768, 4096, 4, ... 10043392, 32768, ) == 0x0 00757 2020 NtAllocateVirtualMemory (-1, 0, 0, 29, 4096, 64, ... 11010048, 4096, ) == 0x0 00758 2020 NtAllocateVirtualMemory (-1, 0, 0, 21, 4096, 64, ... 11075584, 4096, ) == 0x0 00759 2020 NtAllocateVirtualMemory (-1, 0, 0, 37, 4096, 64, ... 11141120, 4096, ) == 0x0 00760 2020 NtAllocateVirtualMemory (-1, 0, 0, 22, 4096, 64, ... 11206656, 4096, ) == 0x0 00761 2020 NtAllocateVirtualMemory (-1, 0, 0, 22, 4096, 64, ... 11272192, 4096, ) == 0x0 00762 2020 NtAllocateVirtualMemory (-1, 0, 0, 34, 4096, 64, ... 11337728, 4096, ) == 0x0 00763 2020 NtAllocateVirtualMemory (-1, 0, 0, 30, 4096, 64, ... 11403264, 4096, ) == 0x0 00764 2020 NtAllocateVirtualMemory (-1, 0, 0, 23, 4096, 64, ... 11468800, 4096, ) == 0x0 00765 2020 NtAllocateVirtualMemory (-1, 0, 0, 23, 4096, 64, ... 11534336, 4096, ) == 0x0 00766 2020 NtAllocateVirtualMemory (-1, 0, 0, 21, 4096, 64, ... 11599872, 4096, ) == 0x0 00767 2020 NtAllocateVirtualMemory (-1, 0, 0, 41, 4096, 64, ... 11665408, 4096, ) == 0x0 00768 2020 NtAllocateVirtualMemory (-1, 0, 0, 34, 4096, 64, ... 11730944, 4096, ) == 0x0 00769 2020 NtAllocateVirtualMemory (-1, 0, 0, 31, 4096, 64, ... 11796480, 4096, ) == 0x0 00770 2020 NtAllocateVirtualMemory (-1, 0, 0, 17, 4096, 64, ... 11862016, 4096, ) == 0x0 00771 2020 NtAllocateVirtualMemory (-1, 0, 0, 17, 4096, 64, ... 11927552, 4096, ) == 0x0 00772 2020 NtAllocateVirtualMemory (-1, 0, 0, 26, 4096, 64, ... 11993088, 4096, ) == 0x0 00773 2020 NtAllocateVirtualMemory (-1, 0, 0, 318, 4096, 64, ... 12058624, 4096, ) == 0x0 00774 2020 NtQueryVirtualMemory (-1, 0x3ded53, Basic, 28, ... {BaseAddress=0x3de000,AllocationBase=0x3b0000,AllocationProtect=0x40,RegionSize=0x16000,State=0x1000,Protect=0x40,Type=0x20000,}, 28, ) == 0x0 00775 2020 NtContinue (1244016, 0, ... 00776 2020 NtFreeVirtualMemory (-1, (0x994000), 32768, 16384, ... (0x994000), 32768, ) == 0x0 00777 2020 NtQueryVirtualMemory (-1, 0x3df23a, Basic, 28, ... {BaseAddress=0x3df000,AllocationBase=0x3b0000,AllocationProtect=0x40,RegionSize=0x15000,State=0x1000,Protect=0x40,Type=0x20000,}, 28, ) == 0x0 00778 2020 NtContinue (1244016, 0, ... 00779 2020 NtAllocateVirtualMemory (-1, 10043392, 0, 32768, 4096, 4, ... 10043392, 32768, ) == 0x0 00780 2020 NtQueryVirtualMemory (-1, 0x3c4409, Basic, 28, ... {BaseAddress=0x3c4000,AllocationBase=0x3b0000,AllocationProtect=0x40,RegionSize=0x30000,State=0x1000,Protect=0x40,Type=0x20000,}, 28, ) == 0x0 00781 2020 NtQueryVirtualMemory (-1, 0x3df60e, Basic, 28, ... {BaseAddress=0x3df000,AllocationBase=0x3b0000,AllocationProtect=0x40,RegionSize=0x15000,State=0x1000,Protect=0x40,Type=0x20000,}, 28, ) == 0x0 00782 2020 NtQueryVirtualMemory (-1, 0x3df854, Basic, 28, ... {BaseAddress=0x3df000,AllocationBase=0x3b0000,AllocationProtect=0x40,RegionSize=0x15000,State=0x1000,Protect=0x40,Type=0x20000,}, 28, ) == 0x0 00783 2020 NtContinue (1242888, 0, ... 00784 2020 NtUserFindExistingCursorIcon (1242844, 1242860, 1242908, ... ) == 0x10015 00785 2020 NtUserSetCursor (65557, ... ) == 0x10015 00786 2020 NtGdiCreateCompatibleDC (0, ... ) == 0x970105d4 00787 2020 NtGdiGetTextCharsetInfo (-1761540652, 0, 0, ... ) == 0x0 00788 2020 NtGdiHfontCreate (1242600, 356, 0, 0, 1333032, ... ) == 0x650a05a2 00789 2020 NtGdiGetTextMetricsW (-1761540652, 1242916, 68, ... ) == 0x1 00790 2020 NtGdiGetTextFaceW (-1761540652, 32, 1243224, 1, ... ) == 0xe 00791 2020 NtAllocateVirtualMemory (-1, 1368064, 0, 4096, 4096, 4, ... 1368064, 4096, ) == 0x0 00792 2020 NtGdiGetWidthTable (-1761540652, 52, 1367776, 308, 1368392, 1367144, 1367160, ... ) == 0x1 00793 2020 NtGdiDeleteObjectApp (-1761540652, ... ) == 0x1 00794 2020 NtUserGetForegroundWindow (... ) == 0x1000a4 00795 2020 NtUserQueryWindow (1048740, 0, ... ) == 0x6c8 00796 2020 NtUserQueryWindow (1048740, 1, ... ) == 0x380 00797 2020 NtUserGetAtomName (32770, 1242104, ... ) == 0x6 00798 2020 NtUserCreateWindowEx (-2147417855, 32770, 32770, (-2147417855, 32770, 32770, " ", 13240516, 284, 271, 456, 195, 0, 0, 0, 0, 1073742848, 0, ... , 13240516, 284, 271, 456, 195, 0, 0, 0, 0, 1073742848, 0, ... 00799 2020 NtQueryAttributesFile ({24, 0, 0x40, 0, 0, ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\MSCTF.dll"}, 1239580, ... ) }, 1239580, ... ) == 0x0 00800 2020 NtOpenFile (0x100020, {24, 0, 0x40, 0, 0, (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\MSCTF.dll"}, 5, 96, ... 88, {status=0x0, info=1}, ) }, 5, 96, ... 88, {status=0x0, info=1}, ) == 0x0 00801 2020 NtCreateSection (0xe, 0x0, 0x0, 16, 134217728, 88, ... 92, ) == 0x0 00802 2020 NtClose (88, ... ) == 0x0 00803 2020 NtMapViewOfSection (92, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 16, ... (0xb90000), 0x0, 294912, ) == 0x0 00804 2020 NtClose (92, ... ) == 0x0 00805 2020 NtUnmapViewOfSection (-1, 0xb90000, ... ) == 0x0 00806 2020 NtQueryAttributesFile ({24, 0, 0x40, 0, 0, ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\MSCTF.dll"}, 1239888, ... ) }, 1239888, ... ) == 0x0 00807 2020 NtOpenFile (0x100020, {24, 0, 0x40, 0, 0, (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\MSCTF.dll"}, 5, 96, ... 92, {status=0x0, info=1}, ) }, 5, 96, ... 92, {status=0x0, info=1}, ) == 0x0 00808 2020 NtCreateSection (0xf, 0x0, 0x0, 16, 16777216, 92, ... 88, ) == 0x0 00809 2020 NtQuerySection (88, Image, 48, ... {section info, class 1, size 48}, 0x0, ) == 0x0 00810 2020 NtClose (92, ... ) == 0x0 00811 2020 NtMapViewOfSection (88, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x74720000), 0x0, 307200, ) == 0x0 00812 2020 NtClose (88, ... ) == 0x0 00813 2020 NtProtectVirtualMemory (-1, (0x74721000), 928, 4, ... (0x74721000), 4096, 32, ) == 0x0 00814 2020 NtProtectVirtualMemory (-1, (0x74721000), 4096, 32, ... (0x74721000), 4096, 4, ) == 0x0 00815 2020 NtFlushInstructionCache (-1, 1953632256, 928, ... ) == 0x0 00816 2020 NtProtectVirtualMemory (-1, (0x74721000), 928, 4, ... (0x74721000), 4096, 32, ) == 0x0 00817 2020 NtProtectVirtualMemory (-1, (0x74721000), 4096, 32, ... (0x74721000), 4096, 4, ) == 0x0 00818 2020 NtFlushInstructionCache (-1, 1953632256, 928, ... ) == 0x0 00819 2020 NtProtectVirtualMemory (-1, (0x74721000), 928, 4, ... (0x74721000), 4096, 32, ) == 0x0 00820 2020 NtProtectVirtualMemory (-1, (0x74721000), 4096, 32, ... (0x74721000), 4096, 4, ) == 0x0 00821 2020 NtFlushInstructionCache (-1, 1953632256, 928, ... ) == 0x0 00822 2020 NtProtectVirtualMemory (-1, (0x74721000), 928, 4, ... (0x74721000), 4096, 32, ) == 0x0 00823 2020 NtProtectVirtualMemory (-1, (0x74721000), 4096, 32, ... (0x74721000), 4096, 4, ) == 0x0 00824 2020 NtFlushInstructionCache (-1, 1953632256, 928, ... ) == 0x0 00825 2020 NtOpenKey (0x80000000, {24, 0, 0x40, 0, 0, (0x80000000, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MSCTF.dll"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 00826 2020 NtQueryAttributesFile ({24, 0, 0x40, 0, 0, ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\ntdll.dll"}, 1237244, ... ) }, 1237244, ... ) == 0x0 00827 2020 NtQueryInformationProcess (-1, Wow64, 4, ... {process info, class 26, size 4}, 0x0, ) == 0x0 00828 2020 NtUserCallOneParam (0, 40, ... ) == 0x4090409 00829 2020 NtUserRegisterWindowMessage ( ("MSUIM.Msg.Private", ... ) , ... ) == 0xc0a1 00830 2020 NtUserRegisterWindowMessage ( ("MSUIM.Msg.SetFocus", ... ) , ... ) == 0xc0a2 00831 2020 NtUserRegisterWindowMessage ( ("MSUIM.Msg.ThreadTerminate", ... ) , ... ) == 0xc0a3 00832 2020 NtUserRegisterWindowMessage ( ("MSUIM.Msg.ThreadItemChange", ... ) , ... ) == 0xc0a4 00833 2020 NtUserRegisterWindowMessage ( ("MSUIM.Msg.LangBarModal", ... ) , ... ) == 0xc0a5 00834 2020 NtUserRegisterWindowMessage ( ("MSUIM.Msg.RpcSendReceive", ... ) , ... ) == 0xc0a6 00835 2020 NtUserRegisterWindowMessage ( ("MSUIM.Msg.ThreadMarshal", ... ) , ... ) == 0xc0a7 00836 2020 NtUserRegisterWindowMessage ( ("MSUIM.Msg.CheckThreadInputIdel", ... ) , ... ) == 0xc0a8 00837 2020 NtUserRegisterWindowMessage ( ("MSUIM.Msg.StubCleanUp", ... ) , ... ) == 0xc0a9 00838 2020 NtUserRegisterWindowMessage ( ("MSUIM.Msg.ShowFloating", ... ) , ... ) == 0xc0aa 00839 2020 NtUserRegisterWindowMessage ( ("MSUIM.Msg.LBUpdate", ... ) , ... ) == 0xc0ab 00840 2020 NtUserRegisterWindowMessage ( ("MSUIM.Msg.MuiMgrDirtyUpdate", ... ) , ... ) == 0xc0ac 00841 2020 NtQueryAttributesFile ({24, 0, 0x40, 0, 0, ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\imm32.dll"}, 1237252, ... ) }, 1237252, ... ) == 0x0 00842 2020 NtRequestWaitReplyPort (24, {24, 52, new_msg, 0, 3998, 1239644, 0, 0} (24, {24, 52, new_msg, 0, 3998, 1239644, 0, 0} "\0\0\0\0\5\4\3\0\0\0\0\0\1\0\0\0\344\7\0\0\0\0\0\0" ... {24, 52, reply, 0, 868, 2020, 75652, 0} "\0\0\0\0\5\4\3\0\0\0\0\0\1\0\0\0\344\7\0\0\0\0\0\0" ) ... {24, 52, reply, 0, 868, 2020, 75652, 0} (24, {24, 52, new_msg, 0, 3998, 1239644, 0, 0} "\0\0\0\0\5\4\3\0\0\0\0\0\1\0\0\0\344\7\0\0\0\0\0\0" ... {24, 52, reply, 0, 868, 2020, 75652, 0} "\0\0\0\0\5\4\3\0\0\0\0\0\1\0\0\0\344\7\0\0\0\0\0\0" ) ) == 0x0 00843 2020 NtUserGetThreadDesktop (2020, 0, ... ) == 0x24 00844 2020 NtUserGetObjectInformation (36, 2, 1318544, 520, 1239552, ... ) == 0x1 00845 2020 NtOpenProcessToken (-1, 0x8, ... 88, ) == 0x0 00846 2020 NtQueryInformationToken (88, User, 0, ... ) == STATUS_BUFFER_TOO_SMALL 00847 2020 NtQueryInformationToken (88, User, 36, ... {token info, class 1, size 36}, 36, ) == 0x0 00848 2020 NtClose (88, ... ) == 0x0 00849 2020 NtCreateSection (0xf0007, {24, 48, 0x80, 0, 0, (0xf0007, {24, 48, 0x80, 0, 0, "CiceroSharedMemDefaultS-1-5-21-1292428093-1383384898-725345543-1003"}, {3240, 0}, 4, 134217728, 0, ... 88, ) }, {3240, 0}, 4, 134217728, 0, ... 88, ) == STATUS_OBJECT_NAME_EXISTS 00850 2020 NtMapViewOfSection (88, -1, (0x0), 0, 0, {0, 0}, 0, 1, 0, 4, ... (0xb90000), {0, 0}, 4096, ) == 0x0 00851 2020 NtOpenKey (0x20019, {24, 16, 0x40, 0, 0, (0x20019, {24, 16, 0x40, 0, 0, "SOFTWARE\Microsoft\CTF\Compatibility\packed.exe"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 00852 2020 NtOpenKey (0x20019, {24, 16, 0x40, 0, 0, (0x20019, {24, 16, 0x40, 0, 0, "SOFTWARE\Microsoft\CTF\SystemShared\"}, ... 92, ) }, ... 92, ) == 0x0 00853 2020 NtQueryValueKey (92, (92, "CUAS", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (92, "CUAS", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) }, 16, ) == 0x0 00854 2020 NtClose (92, ... ) == 0x0 00855 2020 NtUserFindExistingCursorIcon (1239084, 1239100, 1239148, ... ) == 0x10011 00856 2020 NtUserRegisterClassExWOW (1239356, 1239452, 1239436, 1239424, 0, 386, 0, ... ) == 0x819fc0ad 00857 2020 NtCreateMutant (0x1f0001, {24, 48, 0x80, 0, 0, (0x1f0001, {24, 48, 0x80, 0, 0, "CTF.LBES.MutexDefaultS-1-5-21-1292428093-1383384898-725345543-1003"}, 0, ... 92, ) }, 0, ... 92, ) == STATUS_OBJECT_NAME_EXISTS 00858 2020 NtCreateMutant (0x1f0001, {24, 48, 0x80, 0, 0, (0x1f0001, {24, 48, 0x80, 0, 0, "CTF.Compart.MutexDefaultS-1-5-21-1292428093-1383384898-725345543-1003"}, 0, ... 96, ) }, 0, ... 96, ) == STATUS_OBJECT_NAME_EXISTS 00859 2020 NtCreateMutant (0x1f0001, {24, 48, 0x80, 0, 0, (0x1f0001, {24, 48, 0x80, 0, 0, "CTF.Asm.MutexDefaultS-1-5-21-1292428093-1383384898-725345543-1003"}, 0, ... 100, ) }, 0, ... 100, ) == STATUS_OBJECT_NAME_EXISTS 00860 2020 NtCreateMutant (0x1f0001, {24, 48, 0x80, 0, 0, (0x1f0001, {24, 48, 0x80, 0, 0, "CTF.Layouts.MutexDefaultS-1-5-21-1292428093-1383384898-725345543-1003"}, 0, ... 104, ) }, 0, ... 104, ) == STATUS_OBJECT_NAME_EXISTS 00861 2020 NtCreateMutant (0x1f0001, {24, 48, 0x80, 0, 0, (0x1f0001, {24, 48, 0x80, 0, 0, "CTF.TMD.MutexDefaultS-1-5-21-1292428093-1383384898-725345543-1003"}, 0, ... 108, ) }, 0, ... 108, ) == STATUS_OBJECT_NAME_EXISTS 00862 2020 NtOpenKey (0x20019, {24, 56, 0x40, 0, 0, (0x20019, {24, 56, 0x40, 0, 0, "Keyboard Layout\Toggle"}, ... 112, ) }, ... 112, ) == 0x0 00863 2020 NtQueryValueKey (112, (112, "Language Hotkey", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 00864 2020 NtQueryValueKey (112, (112, "Hotkey", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 00865 2020 NtQueryValueKey (112, (112, "Layout Hotkey", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 00866 2020 NtClose (112, ... ) == 0x0 00867 2020 NtQueryAttributesFile ({24, 0, 0x40, 0, 0, ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\KERNEL32.dll"}, 1237072, ... ) }, 1237072, ... ) == 0x0 00868 2020 NtQueryDefaultUILanguage (1239632, ... 00869 2020 NtOpenThreadTokenEx (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN 00870 2020 NtOpenProcessTokenEx (-1, 0x20008, 512, ... -2147482576, ) == 0x0 00871 2020 NtQueryInformationToken (-2147482576, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0 00872 2020 NtClose (-2147482576, ... ) == 0x0 00873 2020 NtOpenKey (0x2000000, {24, 0, 0x640, 0, 0, (0x2000000, {24, 0, 0x640, 0, 0, "\REGISTRY\USER\S-1-5-21-1292428093-1383384898-725345543-1003"}, ... -2147482576, ) }, ... -2147482576, ) == 0x0 00874 2020 NtOpenKey (0x80000000, {24, -2147482576, 0x240, 0, 0, (0x80000000, {24, -2147482576, 0x240, 0, 0, "Software\Policies\Microsoft\Control Panel\Desktop"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 00875 2020 NtOpenKey (0x80000000, {24, -2147482576, 0x640, 0, 0, (0x80000000, {24, -2147482576, 0x640, 0, 0, "Control Panel\Desktop"}, ... -2147482648, ) }, ... -2147482648, ) == 0x0 00876 2020 NtQueryValueKey (-2147482648, (-2147482648, "MultiUILanguageId", Partial, 256, ... ) , Partial, 256, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 00877 2020 NtClose (-2147482648, ... ) == 0x0 00878 2020 NtClose (-2147482576, ... ) == 0x0 00868 2020 NtQueryDefaultUILanguage ... ) == 0x0 00879 2020 NtOpenKey (0x20019, {24, 16, 0x40, 0, 0, (0x20019, {24, 16, 0x40, 0, 0, "SOFTWARE\Microsoft\CTF\"}, ... 112, ) }, ... 112, ) == 0x0 00880 2020 NtQueryValueKey (112, (112, "EnableAnchorContext", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 00881 2020 NtClose (112, ... ) == 0x0 00882 2020 NtCreateMutant (0x1f0001, {24, 48, 0x80, 0, 0, (0x1f0001, {24, 48, 0x80, 0, 0, "CTF.TimListCache.FMPDefaultS-1-5-21-1292428093-1383384898-725345543-1003MUTEX.DefaultS-1-5-21-1292428093-1383384898-725345543-1003"}, 0, ... 112, ) }, 0, ... 112, ) == STATUS_OBJECT_NAME_EXISTS 00883 2020 NtOpenSection (0xf001f, {24, 48, 0x0, 0, 0, (0xf001f, {24, 48, 0x0, 0, 0, "CTF.TimListCache.FMPDefaultS-1-5-21-1292428093-1383384898-725345543-1003SFM.DefaultS-1-5-21-1292428093-1383384898-725345543-1003"}, ... 116, ) }, ... 116, ) == 0x0 00884 2020 NtMapViewOfSection (116, -1, (0x0), 0, 0, {0, 0}, 0, 1, 0, 4, ... (0xba0000), {0, 0}, 262144, ) == 0x0 00885 2020 NtWaitForSingleObject (112, 0, {-50000000, -1}, ... ) == 0x0 00886 2020 NtReleaseMutant (112, ... 0x0, ) == 0x0 00887 2020 NtWaitForSingleObject (112, 0, {-50000000, -1}, ... ) == 0x0 00888 2020 NtReleaseMutant (112, ... 0x0, ) == 0x0 00889 2020 NtWaitForSingleObject (112, 0, {-50000000, -1}, ... ) == 0x0 00890 2020 NtReleaseMutant (112, ... 0x0, ) == 0x0 00891 2020 NtUserSetWindowsHookEx (1953628160, 1241116, 2020, 2, 1953694283, 2, ... ) == 0x3d01ab 00892 2020 NtUserSetWindowsHookEx (1953628160, 1241116, 2020, 7, 1953693577, 2, ... ) == 0x5b021b 00893 2020 NtUserSetWindowFNID (393528, 676, ... ) == 0x1 00894 2020 NtUserCallHwndParam (393528, 1369820, 79, ... ) == 0x14e6dc 00895 2020 NtUserMessageCall (0x60138, WM_NCCREATE, 0x0, 0x12f39c, 0, 670, 1, ... ) == 0x1 00896 2020 NtUserSetWindowFNID (393526, 681, ... ) == 0x1 00897 2020 NtUserSetWindowLong (393526, 0, 1368704, 0, ... ) == 0x0 00898 2020 NtOpenKey (0x2000000, {24, 16, 0x40, 0, 0, (0x2000000, {24, 16, 0x40, 0, 0, "Software\Microsoft\Windows NT\CurrentVersion\IMM"}, ... 120, ) }, ... 120, ) == 0x0 00899 2020 NtQueryValueKey (120, (120, "Ime File", Partial, 144, ... TitleIdx=0, Type=1, Data="m\0s\0c\0t\0f\0i\0m\0e\0.\0i\0m\0e\0\0\0"}, 38, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (120, "Ime File", Partial, 144, ... TitleIdx=0, Type=1, Data="m\0s\0c\0t\0f\0i\0m\0e\0.\0i\0m\0e\0\0\0"}, 38, ) }, 38, ) == 0x0 00900 2020 NtClose (120, ... ) == 0x0 00901 2020 NtQueryInformationProcess (-1, DefaultHardErrorMode, 4, ... {process info, class 12, size 4}, 0x0, ) == 0x0 00902 2020 NtSetInformationProcess (-1, DefaultHardErrorMode, {process info, class 12, size 4}, 4, ... ) == 0x0 00903 2020 NtQueryAttributesFile ({24, 0, 0x40, 0, 0, ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\msctfime.ime"}, 1238372, ... ) }, 1238372, ... ) == 0x0 00904 2020 NtOpenFile (0x100020, {24, 0, 0x40, 0, 0, (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\msctfime.ime"}, 5, 96, ... 120, {status=0x0, info=1}, ) }, 5, 96, ... 120, {status=0x0, info=1}, ) == 0x0 00905 2020 NtCreateSection (0xe, 0x0, 0x0, 16, 134217728, 120, ... 124, ) == 0x0 00906 2020 NtClose (120, ... ) == 0x0 00907 2020 NtMapViewOfSection (124, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 16, ... (0xbe0000), 0x0, 180224, ) == 0x0 00908 2020 NtClose (124, ... ) == 0x0 00909 2020 NtUnmapViewOfSection (-1, 0xbe0000, ... ) == 0x0 00910 2020 NtQueryAttributesFile ({24, 0, 0x40, 0, 0, ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\msctfime.ime"}, 1237968, ... ) }, 1237968, ... ) == 0x0 00911 2020 NtCreateFile (0x80100080, {24, 0, 0x40, 0, 1238712, (0x80100080, {24, 0, 0x40, 0, 1238712, "\??\C:\WINDOWS\system32\msctfime.ime"}, 0x0, 0, 5, 1, 96, 0, 0, ... 124, {status=0x0, info=1}, ) }, 0x0, 0, 5, 1, 96, 0, 0, ... 124, {status=0x0, info=1}, ) == 0x0 00912 2020 NtCreateSection (0xf0005, 0x0, 0x0, 2, 134217728, 124, ... 120, ) == 0x0 00913 2020 NtClose (124, ... ) == 0x0 00914 2020 NtMapViewOfSection (120, -1, (0x0), 0, 0, {0, 0}, 0, 1, 0, 2, ... (0xbe0000), {0, 0}, 180224, ) == 0x0 00915 2020 NtClose (120, ... ) == 0x0 00916 2020 NtQueryDefaultUILanguage (2090319928, ... 00917 2020 NtOpenThreadTokenEx (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN 00918 2020 NtOpenProcessTokenEx (-1, 0x20008, 512, ... -2147482576, ) == 0x0 00919 2020 NtQueryInformationToken (-2147482576, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0 00920 2020 NtClose (-2147482576, ... ) == 0x0 00921 2020 NtOpenKey (0x2000000, {24, 0, 0x640, 0, 0, (0x2000000, {24, 0, 0x640, 0, 0, "\REGISTRY\USER\S-1-5-21-1292428093-1383384898-725345543-1003"}, ... -2147482576, ) }, ... -2147482576, ) == 0x0 00922 2020 NtOpenKey (0x80000000, {24, -2147482576, 0x240, 0, 0, (0x80000000, {24, -2147482576, 0x240, 0, 0, "Software\Policies\Microsoft\Control Panel\Desktop"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 00923 2020 NtOpenKey (0x80000000, {24, -2147482576, 0x640, 0, 0, (0x80000000, {24, -2147482576, 0x640, 0, 0, "Control Panel\Desktop"}, ... -2147482648, ) }, ... -2147482648, ) == 0x0 00924 2020 NtQueryValueKey (-2147482648, (-2147482648, "MultiUILanguageId", Partial, 256, ... ) , Partial, 256, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 00925 2020 NtClose (-2147482648, ... ) == 0x0 00926 2020 NtClose (-2147482576, ... ) == 0x0 00916 2020 NtQueryDefaultUILanguage ... ) == 0x0 00927 2020 NtQueryInstallUILanguage (2090319930, ... ) == 0x0 00928 2020 NtQueryInformationProcess (-1, DefaultHardErrorMode, 4, ... {process info, class 12, size 4}, 0x0, ) == 0x0 00929 2020 NtSetInformationProcess (-1, DefaultHardErrorMode, {process info, class 12, size 4}, 4, ... ) == 0x0 00930 2020 NtQueryDefaultLocale (1, 1239332, ... ) == 0x0 00931 2020 NtQueryVirtualMemory (-1, 0xbe0000, Basic, 28, ... {BaseAddress=0xbe0000,AllocationBase=0xbe0000,AllocationProtect=0x2,RegionSize=0x2c000,State=0x1000,Protect=0x2,Type=0x40000,}, 0x0, ) == 0x0 00932 2020 NtQueryVirtualMemory (-1, 0xbe0000, Basic, 28, ... {BaseAddress=0xbe0000,AllocationBase=0xbe0000,AllocationProtect=0x2,RegionSize=0x2c000,State=0x1000,Protect=0x2,Type=0x40000,}, 0x0, ) == 0x0 00933 2020 NtUnmapViewOfSection (-1, 0xbe0000, ... ) == 0x0 00934 2020 NtQueryInformationProcess (-1, DefaultHardErrorMode, 4, ... {process info, class 12, size 4}, 0x0, ) == 0x0 00935 2020 NtSetInformationProcess (-1, DefaultHardErrorMode, {process info, class 12, size 4}, 4, ... ) == 0x0 00936 2020 NtQueryAttributesFile ({24, 0, 0x40, 0, 0, ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\msctfime.ime"}, 1238364, ... ) }, 1238364, ... ) == 0x0 00937 2020 NtOpenFile (0x100020, {24, 0, 0x40, 0, 0, (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\msctfime.ime"}, 5, 96, ... 120, {status=0x0, info=1}, ) }, 5, 96, ... 120, {status=0x0, info=1}, ) == 0x0 00938 2020 NtCreateSection (0xe, 0x0, 0x0, 16, 134217728, 120, ... 124, ) == 0x0 00939 2020 NtClose (120, ... ) == 0x0 00940 2020 NtMapViewOfSection (124, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 16, ... (0xbe0000), 0x0, 180224, ) == 0x0 00941 2020 NtClose (124, ... ) == 0x0 00942 2020 NtUnmapViewOfSection (-1, 0xbe0000, ... ) == 0x0 00943 2020 NtQueryAttributesFile ({24, 0, 0x40, 0, 0, ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\msctfime.ime"}, 1237960, ... ) }, 1237960, ... ) == 0x0 00944 2020 NtCreateFile (0x80100080, {24, 0, 0x40, 0, 1238704, (0x80100080, {24, 0, 0x40, 0, 1238704, "\??\C:\WINDOWS\system32\msctfime.ime"}, 0x0, 0, 5, 1, 96, 0, 0, ... 124, {status=0x0, info=1}, ) }, 0x0, 0, 5, 1, 96, 0, 0, ... 124, {status=0x0, info=1}, ) == 0x0 00945 2020 NtCreateSection (0xf0005, 0x0, 0x0, 2, 134217728, 124, ... 120, ) == 0x0 00946 2020 NtClose (124, ... ) == 0x0 00947 2020 NtMapViewOfSection (120, -1, (0x0), 0, 0, {0, 0}, 0, 1, 0, 2, ... (0xbe0000), {0, 0}, 180224, ) == 0x0 00948 2020 NtClose (120, ... ) == 0x0 00949 2020 NtQueryInformationProcess (-1, DefaultHardErrorMode, 4, ... {process info, class 12, size 4}, 0x0, ) == 0x0 00950 2020 NtSetInformationProcess (-1, DefaultHardErrorMode, {process info, class 12, size 4}, 4, ... ) == 0x0 00951 2020 NtQueryDefaultLocale (1, 1239324, ... ) == 0x0 00952 2020 NtQueryVirtualMemory (-1, 0xbe0000, Basic, 28, ... {BaseAddress=0xbe0000,AllocationBase=0xbe0000,AllocationProtect=0x2,RegionSize=0x2c000,State=0x1000,Protect=0x2,Type=0x40000,}, 0x0, ) == 0x0 00953 2020 NtUnmapViewOfSection (-1, 0xbe0000, ... ) == 0x0 00954 2020 NtOpenMutant (0x120001, {24, 48, 0x0, 0, 0, (0x120001, {24, 48, 0x0, 0, 0, "ShimCacheMutex"}, ... 120, ) }, ... 120, ) == 0x0 00955 2020 NtWaitForSingleObject (120, 0, {-1000000, -1}, ... ) == 0x0 00956 2020 NtOpenSection (0x2, {24, 48, 0x0, 0, 0, (0x2, {24, 48, 0x0, 0, 0, "ShimSharedMemory"}, ... 124, ) }, ... 124, ) == 0x0 00957 2020 NtMapViewOfSection (124, -1, (0x0), 0, 0, {0, 0}, 0, 1, 0, 4, ... (0xbe0000), {0, 0}, 57344, ) == 0x0 00958 2020 NtOpenThreadTokenEx (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN 00959 2020 NtOpenProcessTokenEx (-1, 0x20008, 512, ... 128, ) == 0x0 00960 2020 NtQueryInformationToken (128, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0 00961 2020 NtClose (128, ... ) == 0x0 00962 2020 NtOpenKey (0x20019, {24, 0, 0x40, 0, 0, (0x20019, {24, 0, 0x40, 0, 0, "\REGISTRY\USER\S-1-5-21-1292428093-1383384898-725345543-1003\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Layers"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 00963 2020 NtReleaseMutant (120, ... 0x0, ) == 0x0 00964 2020 NtQueryAttributesFile ({24, 0, 0x40, 0, 0, ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\msctfime.ime"}, 1238344, ... ) }, 1238344, ... ) == 0x0 00965 2020 NtOpenFile (0x100020, {24, 0, 0x40, 0, 0, (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\msctfime.ime"}, 5, 96, ... 128, {status=0x0, info=1}, ) }, 5, 96, ... 128, {status=0x0, info=1}, ) == 0x0 00966 2020 NtCreateSection (0xe, 0x0, 0x0, 16, 134217728, 128, ... 132, ) == 0x0 00967 2020 NtClose (128, ... ) == 0x0 00968 2020 NtMapViewOfSection (132, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 16, ... (0xbf0000), 0x0, 180224, ) == 0x0 00969 2020 NtClose (132, ... ) == 0x0 00970 2020 NtUnmapViewOfSection (-1, 0xbf0000, ... ) == 0x0 00971 2020 NtQueryAttributesFile ({24, 0, 0x40, 0, 0, ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\msctfime.ime"}, 1238652, ... ) }, 1238652, ... ) == 0x0 00972 2020 NtOpenFile (0x100020, {24, 0, 0x40, 0, 0, (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\msctfime.ime"}, 5, 96, ... 132, {status=0x0, info=1}, ) }, 5, 96, ... 132, {status=0x0, info=1}, ) == 0x0 00973 2020 NtCreateSection (0xf, 0x0, 0x0, 16, 16777216, 132, ... 128, ) == 0x0 00974 2020 NtQuerySection (128, Image, 48, ... {section info, class 1, size 48}, 0x0, ) == 0x0 00975 2020 NtClose (132, ... ) == 0x0 00976 2020 NtMapViewOfSection (128, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x755c0000), 0x0, 188416, ) == 0x0 00977 2020 NtClose (128, ... ) == 0x0 00978 2020 NtProtectVirtualMemory (-1, (0x755c1000), 860, 4, ... (0x755c1000), 4096, 32, ) == 0x0 00979 2020 NtProtectVirtualMemory (-1, (0x755c1000), 4096, 32, ... (0x755c1000), 4096, 4, ) == 0x0 00980 2020 NtFlushInstructionCache (-1, 1968967680, 860, ... ) == 0x0 00981 2020 NtProtectVirtualMemory (-1, (0x755c1000), 860, 4, ... (0x755c1000), 4096, 32, ) == 0x0 00982 2020 NtProtectVirtualMemory (-1, (0x755c1000), 4096, 32, ... (0x755c1000), 4096, 4, ) == 0x0 00983 2020 NtFlushInstructionCache (-1, 1968967680, 860, ... ) == 0x0 00984 2020 NtProtectVirtualMemory (-1, (0x755c1000), 860, 4, ... (0x755c1000), 4096, 32, ) == 0x0 00985 2020 NtProtectVirtualMemory (-1, (0x755c1000), 4096, 32, ... (0x755c1000), 4096, 4, ) == 0x0 00986 2020 NtFlushInstructionCache (-1, 1968967680, 860, ... ) == 0x0 00987 2020 NtProtectVirtualMemory (-1, (0x755c1000), 860, 4, ... (0x755c1000), 4096, 32, ) == 0x0 00988 2020 NtProtectVirtualMemory (-1, (0x755c1000), 4096, 32, ... (0x755c1000), 4096, 4, ) == 0x0 00989 2020 NtFlushInstructionCache (-1, 1968967680, 860, ... ) == 0x0 00990 2020 NtProtectVirtualMemory (-1, (0x755c1000), 860, 4, ... (0x755c1000), 4096, 32, ) == 0x0 00991 2020 NtProtectVirtualMemory (-1, (0x755c1000), 4096, 32, ... (0x755c1000), 4096, 4, ) == 0x0 00992 2020 NtFlushInstructionCache (-1, 1968967680, 860, ... ) == 0x0 00993 2020 NtProtectVirtualMemory (-1, (0x755c1000), 860, 4, ... (0x755c1000), 4096, 32, ) == 0x0 00994 2020 NtProtectVirtualMemory (-1, (0x755c1000), 4096, 32, ... (0x755c1000), 4096, 4, ) == 0x0 00995 2020 NtFlushInstructionCache (-1, 1968967680, 860, ... ) == 0x0 00996 2020 NtOpenKey (0x80000000, {24, 0, 0x40, 0, 0, (0x80000000, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msctfime.ime"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 00997 2020 NtUserGetDC (0, ... ) == 0x1010054 00998 2020 NtUserSystemParametersInfo (66, 12, 1238840, 0, ... ) == 0x1 00999 2020 NtUserCallOneParam (16842836, 57, ... ) == 0x1 01000 2020 NtQueryVirtualMemory (-1, 0x7c91ca50, Basic, 28, ... {BaseAddress=0x7c91c000,AllocationBase=0x7c900000,AllocationProtect=0x80,RegionSize=0x60000,State=0x1000,Protect=0x20,Type=0x1000000,}, 28, ) == 0x0 01001 2020 NtQueryVirtualMemory (-1, 0x7c9163a8, Basic, 28, ... {BaseAddress=0x7c916000,AllocationBase=0x7c900000,AllocationProtect=0x80,RegionSize=0x66000,State=0x1000,Protect=0x20,Type=0x1000000,}, 28, ) == 0x0 01002 2020 NtQueryDebugFilterState (87, 3, ... ) == 0x0 01003 2020 NtQueryDebugFilterState (87, 3, ... ) == 0x0 01004 2020 NtContinue (1237044, 0, ... 01005 2020 NtQueryDebugFilterState (87, 3, ... ) == 0x0 01006 2020 NtUnmapViewOfSection (-1, 0x755c0000, ... ) == 0x0 01007 2020 NtQueryDebugFilterState (87, 3, ... ) == 0x0 01008 2020 NtUserMessageCall (0x60136, WM_NCCREATE, 0x0, 0x12f388, 0, 670, 0, ... ) == 0x1 01009 2020 NtOpenKey (0x2000000, {24, 16, 0x40, 0, 0, (0x2000000, {24, 16, 0x40, 0, 0, "Software\Microsoft\Windows NT\CurrentVersion\IMM"}, ... 128, ) }, ... 128, ) == 0x0 01010 2020 NtQueryValueKey (128, (128, "Ime File", Partial, 144, ... TitleIdx=0, Type=1, Data="m\0s\0c\0t\0f\0i\0m\0e\0.\0i\0m\0e\0\0\0"}, 38, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (128, "Ime File", Partial, 144, ... TitleIdx=0, Type=1, Data="m\0s\0c\0t\0f\0i\0m\0e\0.\0i\0m\0e\0\0\0"}, 38, ) }, 38, ) == 0x0 01011 2020 NtClose (128, ... ) == 0x0 01012 2020 NtQueryInformationProcess (-1, DefaultHardErrorMode, 4, ... {process info, class 12, size 4}, 0x0, ) == 0x0 01013 2020 NtSetInformationProcess (-1, DefaultHardErrorMode, {process info, class 12, size 4}, 4, ... ) == 0x0 01014 2020 NtQueryAttributesFile ({24, 0, 0x40, 0, 0, ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\msctfime.ime"}, 1238468, ... ) }, 1238468, ... ) == 0x0 01015 2020 NtOpenFile (0x100020, {24, 0, 0x40, 0, 0, (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\msctfime.ime"}, 5, 96, ... 128, {status=0x0, info=1}, ) }, 5, 96, ... 128, {status=0x0, info=1}, ) == 0x0 01016 2020 NtCreateSection (0xe, 0x0, 0x0, 16, 134217728, 128, ... 132, ) == 0x0 01017 2020 NtClose (128, ... ) == 0x0 01018 2020 NtMapViewOfSection (132, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 16, ... (0xbf0000), 0x0, 180224, ) == 0x0 01019 2020 NtClose (132, ... ) == 0x0 01020 2020 NtUnmapViewOfSection (-1, 0xbf0000, ... ) == 0x0 01021 2020 NtQueryAttributesFile ({24, 0, 0x40, 0, 0, ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\msctfime.ime"}, 1238064, ... ) }, 1238064, ... ) == 0x0 01022 2020 NtCreateFile (0x80100080, {24, 0, 0x40, 0, 1238808, (0x80100080, {24, 0, 0x40, 0, 1238808, "\??\C:\WINDOWS\system32\msctfime.ime"}, 0x0, 0, 5, 1, 96, 0, 0, ... 132, {status=0x0, info=1}, ) }, 0x0, 0, 5, 1, 96, 0, 0, ... 132, {status=0x0, info=1}, ) == 0x0 01023 2020 NtCreateSection (0xf0005, 0x0, 0x0, 2, 134217728, 132, ... 128, ) == 0x0 01024 2020 NtClose (132, ... ) == 0x0 01025 2020 NtMapViewOfSection (128, -1, (0x0), 0, 0, {0, 0}, 0, 1, 0, 2, ... (0xbf0000), {0, 0}, 180224, ) == 0x0 01026 2020 NtClose (128, ... ) == 0x0 01027 2020 NtQueryInformationProcess (-1, DefaultHardErrorMode, 4, ... {process info, class 12, size 4}, 0x0, ) == 0x0 01028 2020 NtSetInformationProcess (-1, DefaultHardErrorMode, {process info, class 12, size 4}, 4, ... ) == 0x0 01029 2020 NtQueryDefaultLocale (1, 1239428, ... ) == 0x0 01030 2020 NtQueryVirtualMemory (-1, 0xbf0000, Basic, 28, ... {BaseAddress=0xbf0000,AllocationBase=0xbf0000,AllocationProtect=0x2,RegionSize=0x2c000,State=0x1000,Protect=0x2,Type=0x40000,}, 0x0, ) == 0x0 01031 2020 NtQueryVirtualMemory (-1, 0xbf0000, Basic, 28, ... {BaseAddress=0xbf0000,AllocationBase=0xbf0000,AllocationProtect=0x2,RegionSize=0x2c000,State=0x1000,Protect=0x2,Type=0x40000,}, 0x0, ) == 0x0 01032 2020 NtUnmapViewOfSection (-1, 0xbf0000, ... ) == 0x0 01033 2020 NtAllocateVirtualMemory (-1, 1372160, 0, 4096, 4096, 4, ... 1372160, 4096, ) == 0x0 01034 2020 NtQueryInformationProcess (-1, DefaultHardErrorMode, 4, ... {process info, class 12, size 4}, 0x0, ) == 0x0 01035 2020 NtSetInformationProcess (-1, DefaultHardErrorMode, {process info, class 12, size 4}, 4, ... ) == 0x0 01036 2020 NtQueryAttributesFile ({24, 0, 0x40, 0, 0, ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\msctfime.ime"}, 1238460, ... ) }, 1238460, ... ) == 0x0 01037 2020 NtOpenFile (0x100020, {24, 0, 0x40, 0, 0, (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\msctfime.ime"}, 5, 96, ... 128, {status=0x0, info=1}, ) }, 5, 96, ... 128, {status=0x0, info=1}, ) == 0x0 01038 2020 NtCreateSection (0xe, 0x0, 0x0, 16, 134217728, 128, ... 132, ) == 0x0 01039 2020 NtClose (128, ... ) == 0x0 01040 2020 NtMapViewOfSection (132, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 16, ... (0xbf0000), 0x0, 180224, ) == 0x0 01041 2020 NtClose (132, ... ) == 0x0 01042 2020 NtUnmapViewOfSection (-1, 0xbf0000, ... ) == 0x0 01043 2020 NtQueryAttributesFile ({24, 0, 0x40, 0, 0, ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\msctfime.ime"}, 1238056, ... ) }, 1238056, ... ) == 0x0 01044 2020 NtCreateFile (0x80100080, {24, 0, 0x40, 0, 1238800, (0x80100080, {24, 0, 0x40, 0, 1238800, "\??\C:\WINDOWS\system32\msctfime.ime"}, 0x0, 0, 5, 1, 96, 0, 0, ... 132, {status=0x0, info=1}, ) }, 0x0, 0, 5, 1, 96, 0, 0, ... 132, {status=0x0, info=1}, ) == 0x0 01045 2020 NtCreateSection (0xf0005, 0x0, 0x0, 2, 134217728, 132, ... 128, ) == 0x0 01046 2020 NtClose (132, ... ) == 0x0 01047 2020 NtMapViewOfSection (128, -1, (0x0), 0, 0, {0, 0}, 0, 1, 0, 2, ... (0xbf0000), {0, 0}, 180224, ) == 0x0 01048 2020 NtClose (128, ... ) == 0x0 01049 2020 NtQueryInformationProcess (-1, DefaultHardErrorMode, 4, ... {process info, class 12, size 4}, 0x0, ) == 0x0 01050 2020 NtSetInformationProcess (-1, DefaultHardErrorMode, {process info, class 12, size 4}, 4, ... ) == 0x0 01051 2020 NtQueryDefaultLocale (1, 1239420, ... ) == 0x0 01052 2020 NtQueryVirtualMemory (-1, 0xbf0000, Basic, 28, ... {BaseAddress=0xbf0000,AllocationBase=0xbf0000,AllocationProtect=0x2,RegionSize=0x2c000,State=0x1000,Protect=0x2,Type=0x40000,}, 0x0, ) == 0x0 01053 2020 NtUnmapViewOfSection (-1, 0xbf0000, ... ) == 0x0 01054 2020 NtWaitForSingleObject (120, 0, {-1000000, -1}, ... ) == 0x0 01055 2020 NtOpenThreadTokenEx (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN 01056 2020 NtOpenProcessTokenEx (-1, 0x20008, 512, ... 128, ) == 0x0 01057 2020 NtQueryInformationToken (128, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0 01058 2020 NtClose (128, ... ) == 0x0 01059 2020 NtOpenKey (0x20019, {24, 0, 0x40, 0, 0, (0x20019, {24, 0, 0x40, 0, 0, "\REGISTRY\USER\S-1-5-21-1292428093-1383384898-725345543-1003\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Layers"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 01060 2020 NtReleaseMutant (120, ... 0x0, ) == 0x0 01061 2020 NtQueryAttributesFile ({24, 0, 0x40, 0, 0, ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\msctfime.ime"}, 1238440, ... ) }, 1238440, ... ) == 0x0 01062 2020 NtOpenFile (0x100020, {24, 0, 0x40, 0, 0, (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\msctfime.ime"}, 5, 96, ... 128, {status=0x0, info=1}, ) }, 5, 96, ... 128, {status=0x0, info=1}, ) == 0x0 01063 2020 NtCreateSection (0xe, 0x0, 0x0, 16, 134217728, 128, ... 132, ) == 0x0 01064 2020 NtClose (128, ... ) == 0x0 01065 2020 NtMapViewOfSection (132, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 16, ... (0xbf0000), 0x0, 180224, ) == 0x0 01066 2020 NtClose (132, ... ) == 0x0 01067 2020 NtUnmapViewOfSection (-1, 0xbf0000, ... ) == 0x0 01068 2020 NtQueryAttributesFile ({24, 0, 0x40, 0, 0, ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\msctfime.ime"}, 1238748, ... ) }, 1238748, ... ) == 0x0 01069 2020 NtOpenFile (0x100020, {24, 0, 0x40, 0, 0, (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\msctfime.ime"}, 5, 96, ... 132, {status=0x0, info=1}, ) }, 5, 96, ... 132, {status=0x0, info=1}, ) == 0x0 01070 2020 NtCreateSection (0xf, 0x0, 0x0, 16, 16777216, 132, ... 128, ) == 0x0 01071 2020 NtQuerySection (128, Image, 48, ... {section info, class 1, size 48}, 0x0, ) == 0x0 01072 2020 NtClose (132, ... ) == 0x0 01073 2020 NtMapViewOfSection (128, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x755c0000), 0x0, 188416, ) == 0x0 01074 2020 NtClose (128, ... ) == 0x0 01075 2020 NtProtectVirtualMemory (-1, (0x755c1000), 860, 4, ... (0x755c1000), 4096, 32, ) == 0x0 01076 2020 NtProtectVirtualMemory (-1, (0x755c1000), 4096, 32, ... (0x755c1000), 4096, 4, ) == 0x0 01077 2020 NtFlushInstructionCache (-1, 1968967680, 860, ... ) == 0x0 01078 2020 NtProtectVirtualMemory (-1, (0x755c1000), 860, 4, ... (0x755c1000), 4096, 32, ) == 0x0 01079 2020 NtProtectVirtualMemory (-1, (0x755c1000), 4096, 32, ... (0x755c1000), 4096, 4, ) == 0x0 01080 2020 NtFlushInstructionCache (-1, 1968967680, 860, ... ) == 0x0 01081 2020 NtProtectVirtualMemory (-1, (0x755c1000), 860, 4, ... (0x755c1000), 4096, 32, ) == 0x0 01082 2020 NtProtectVirtualMemory (-1, (0x755c1000), 4096, 32, ... (0x755c1000), 4096, 4, ) == 0x0 01083 2020 NtFlushInstructionCache (-1, 1968967680, 860, ... ) == 0x0 01084 2020 NtProtectVirtualMemory (-1, (0x755c1000), 860, 4, ... (0x755c1000), 4096, 32, ) == 0x0 01085 2020 NtProtectVirtualMemory (-1, (0x755c1000), 4096, 32, ... (0x755c1000), 4096, 4, ) == 0x0 01086 2020 NtFlushInstructionCache (-1, 1968967680, 860, ... ) == 0x0 01087 2020 NtProtectVirtualMemory (-1, (0x755c1000), 860, 4, ... (0x755c1000), 4096, 32, ) == 0x0 01088 2020 NtProtectVirtualMemory (-1, (0x755c1000), 4096, 32, ... (0x755c1000), 4096, 4, ) == 0x0 01089 2020 NtFlushInstructionCache (-1, 1968967680, 860, ... ) == 0x0 01090 2020 NtProtectVirtualMemory (-1, (0x755c1000), 860, 4, ... (0x755c1000), 4096, 32, ) == 0x0 01091 2020 NtProtectVirtualMemory (-1, (0x755c1000), 4096, 32, ... (0x755c1000), 4096, 4, ) == 0x0 01092 2020 NtFlushInstructionCache (-1, 1968967680, 860, ... ) == 0x0 01093 2020 NtOpenKey (0x80000000, {24, 0, 0x40, 0, 0, (0x80000000, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msctfime.ime"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 01094 2020 NtUserGetDC (0, ... ) == 0x1010054 01095 2020 NtUserSystemParametersInfo (66, 12, 1238936, 0, ... ) == 0x1 01096 2020 NtUserCallOneParam (16842836, 57, ... ) == 0x1 01097 2020 NtQueryDebugFilterState (87, 3, ... ) == 0x0 01098 2020 NtQueryDebugFilterState (87, 3, ... ) == 0x0 01099 2020 NtContinue (1237140, 0, ... 01100 2020 NtQueryDebugFilterState (87, 3, ... ) == 0x0 01101 2020 NtUnmapViewOfSection (-1, 0x755c0000, ... ) == 0x0 01102 2020 NtQueryDebugFilterState (87, 3, ... ) == 0x0 01103 2020 NtUserMessageCall (0x60136, WM_NCCALCSIZE, 0x0, 0x12f3cc, 0, 670, 0, ... ) == 0x0 01104 2020 NtUserSetProp (393526, 43288, -1, ... ) == 0x1 01105 2020 NtOpenKey (0x2000000, {24, 16, 0x40, 0, 0, (0x2000000, {24, 16, 0x40, 0, 0, "Software\Microsoft\Windows NT\CurrentVersion\IMM"}, ... 128, ) }, ... 128, ) == 0x0 01106 2020 NtQueryValueKey (128, (128, "Ime File", Partial, 144, ... TitleIdx=0, Type=1, Data="m\0s\0c\0t\0f\0i\0m\0e\0.\0i\0m\0e\0\0\0"}, 38, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (128, "Ime File", Partial, 144, ... TitleIdx=0, Type=1, Data="m\0s\0c\0t\0f\0i\0m\0e\0.\0i\0m\0e\0\0\0"}, 38, ) }, 38, ) == 0x0 01107 2020 NtClose (128, ... ) == 0x0 01108 2020 NtQueryInformationProcess (-1, DefaultHardErrorMode, 4, ... {process info, class 12, size 4}, 0x0, ) == 0x0 01109 2020 NtSetInformationProcess (-1, DefaultHardErrorMode, {process info, class 12, size 4}, 4, ... ) == 0x0 01110 2020 NtQueryAttributesFile ({24, 0, 0x40, 0, 0, ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\msctfime.ime"}, 1238372, ... ) }, 1238372, ... ) == 0x0 01111 2020 NtOpenFile (0x100020, {24, 0, 0x40, 0, 0, (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\msctfime.ime"}, 5, 96, ... 128, {status=0x0, info=1}, ) }, 5, 96, ... 128, {status=0x0, info=1}, ) == 0x0 01112 2020 NtCreateSection (0xe, 0x0, 0x0, 16, 134217728, 128, ... 132, ) == 0x0 01113 2020 NtClose (128, ... ) == 0x0 01114 2020 NtMapViewOfSection (132, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 16, ... (0xbf0000), 0x0, 180224, ) == 0x0 01115 2020 NtClose (132, ... ) == 0x0 01116 2020 NtUnmapViewOfSection (-1, 0xbf0000, ... ) == 0x0 01117 2020 NtQueryAttributesFile ({24, 0, 0x40, 0, 0, ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\msctfime.ime"}, 1237968, ... ) }, 1237968, ... ) == 0x0 01118 2020 NtCreateFile (0x80100080, {24, 0, 0x40, 0, 1238712, (0x80100080, {24, 0, 0x40, 0, 1238712, "\??\C:\WINDOWS\system32\msctfime.ime"}, 0x0, 0, 5, 1, 96, 0, 0, ... 132, {status=0x0, info=1}, ) }, 0x0, 0, 5, 1, 96, 0, 0, ... 132, {status=0x0, info=1}, ) == 0x0 01119 2020 NtCreateSection (0xf0005, 0x0, 0x0, 2, 134217728, 132, ... 128, ) == 0x0 01120 2020 NtClose (132, ... ) == 0x0 01121 2020 NtMapViewOfSection (128, -1, (0x0), 0, 0, {0, 0}, 0, 1, 0, 2, ... (0xbf0000), {0, 0}, 180224, ) == 0x0 01122 2020 NtClose (128, ... ) == 0x0 01123 2020 NtQueryInformationProcess (-1, DefaultHardErrorMode, 4, ... {process info, class 12, size 4}, 0x0, ) == 0x0 01124 2020 NtSetInformationProcess (-1, DefaultHardErrorMode, {process info, class 12, size 4}, 4, ... ) == 0x0 01125 2020 NtQueryDefaultLocale (1, 1239332, ... ) == 0x0 01126 2020 NtQueryVirtualMemory (-1, 0xbf0000, Basic, 28, ... {BaseAddress=0xbf0000,AllocationBase=0xbf0000,AllocationProtect=0x2,RegionSize=0x2c000,State=0x1000,Protect=0x2,Type=0x40000,}, 0x0, ) == 0x0 01127 2020 NtQueryVirtualMemory (-1, 0xbf0000, Basic, 28, ... {BaseAddress=0xbf0000,AllocationBase=0xbf0000,AllocationProtect=0x2,RegionSize=0x2c000,State=0x1000,Protect=0x2,Type=0x40000,}, 0x0, ) == 0x0 01128 2020 NtUnmapViewOfSection (-1, 0xbf0000, ... ) == 0x0 01129 2020 NtQueryInformationProcess (-1, DefaultHardErrorMode, 4, ... {process info, class 12, size 4}, 0x0, ) == 0x0 01130 2020 NtSetInformationProcess (-1, DefaultHardErrorMode, {process info, class 12, size 4}, 4, ... ) == 0x0 01131 2020 NtQueryAttributesFile ({24, 0, 0x40, 0, 0, ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\msctfime.ime"}, 1238364, ... ) }, 1238364, ... ) == 0x0 01132 2020 NtOpenFile (0x100020, {24, 0, 0x40, 0, 0, (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\msctfime.ime"}, 5, 96, ... 128, {status=0x0, info=1}, ) }, 5, 96, ... 128, {status=0x0, info=1}, ) == 0x0 01133 2020 NtCreateSection (0xe, 0x0, 0x0, 16, 134217728, 128, ... 132, ) == 0x0 01134 2020 NtClose (128, ... ) == 0x0 01135 2020 NtMapViewOfSection (132, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 16, ... (0xbf0000), 0x0, 180224, ) == 0x0 01136 2020 NtClose (132, ... ) == 0x0 01137 2020 NtUnmapViewOfSection (-1, 0xbf0000, ... ) == 0x0 01138 2020 NtQueryAttributesFile ({24, 0, 0x40, 0, 0, ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\msctfime.ime"}, 1237960, ... ) }, 1237960, ... ) == 0x0 01139 2020 NtCreateFile (0x80100080, {24, 0, 0x40, 0, 1238704, (0x80100080, {24, 0, 0x40, 0, 1238704, "\??\C:\WINDOWS\system32\msctfime.ime"}, 0x0, 0, 5, 1, 96, 0, 0, ... 132, {status=0x0, info=1}, ) }, 0x0, 0, 5, 1, 96, 0, 0, ... 132, {status=0x0, info=1}, ) == 0x0 01140 2020 NtCreateSection (0xf0005, 0x0, 0x0, 2, 134217728, 132, ... 128, ) == 0x0 01141 2020 NtClose (132, ... ) == 0x0 01142 2020 NtMapViewOfSection (128, -1, (0x0), 0, 0, {0, 0}, 0, 1, 0, 2, ... (0xbf0000), {0, 0}, 180224, ) == 0x0 01143 2020 NtClose (128, ... ) == 0x0 01144 2020 NtQueryInformationProcess (-1, DefaultHardErrorMode, 4, ... {process info, class 12, size 4}, 0x0, ) == 0x0 01145 2020 NtSetInformationProcess (-1, DefaultHardErrorMode, {process info, class 12, size 4}, 4, ... ) == 0x0 01146 2020 NtQueryDefaultLocale (1, 1239324, ... ) == 0x0 01147 2020 NtQueryVirtualMemory (-1, 0xbf0000, Basic, 28, ... {BaseAddress=0xbf0000,AllocationBase=0xbf0000,AllocationProtect=0x2,RegionSize=0x2c000,State=0x1000,Protect=0x2,Type=0x40000,}, 0x0, ) == 0x0 01148 2020 NtUnmapViewOfSection (-1, 0xbf0000, ... ) == 0x0 01149 2020 NtWaitForSingleObject (120, 0, {-1000000, -1}, ... ) == 0x0 01150 2020 NtOpenThreadTokenEx (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN 01151 2020 NtOpenProcessTokenEx (-1, 0x20008, 512, ... 128, ) == 0x0 01152 2020 NtQueryInformationToken (128, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0 01153 2020 NtClose (128, ... ) == 0x0 01154 2020 NtOpenKey (0x20019, {24, 0, 0x40, 0, 0, (0x20019, {24, 0, 0x40, 0, 0, "\REGISTRY\USER\S-1-5-21-1292428093-1383384898-725345543-1003\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Layers"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 01155 2020 NtReleaseMutant (120, ... 0x0, ) == 0x0 01156 2020 NtQueryAttributesFile ({24, 0, 0x40, 0, 0, ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\msctfime.ime"}, 1238344, ... ) }, 1238344, ... ) == 0x0 01157 2020 NtOpenFile (0x100020, {24, 0, 0x40, 0, 0, (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\msctfime.ime"}, 5, 96, ... 128, {status=0x0, info=1}, ) }, 5, 96, ... 128, {status=0x0, info=1}, ) == 0x0 01158 2020 NtCreateSection (0xe, 0x0, 0x0, 16, 134217728, 128, ... 132, ) == 0x0 01159 2020 NtClose (128, ... ) == 0x0 01160 2020 NtMapViewOfSection (132, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 16, ... (0xbf0000), 0x0, 180224, ) == 0x0 01161 2020 NtClose (132, ... ) == 0x0 01162 2020 NtUnmapViewOfSection (-1, 0xbf0000, ... ) == 0x0 01163 2020 NtQueryAttributesFile ({24, 0, 0x40, 0, 0, ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\msctfime.ime"}, 1238652, ... ) }, 1238652, ... ) == 0x0 01164 2020 NtOpenFile (0x100020, {24, 0, 0x40, 0, 0, (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\msctfime.ime"}, 5, 96, ... 132, {status=0x0, info=1}, ) }, 5, 96, ... 132, {status=0x0, info=1}, ) == 0x0 01165 2020 NtCreateSection (0xf, 0x0, 0x0, 16, 16777216, 132, ... 128, ) == 0x0 01166 2020 NtQuerySection (128, Image, 48, ... {section info, class 1, size 48}, 0x0, ) == 0x0 01167 2020 NtClose (132, ... ) == 0x0 01168 2020 NtMapViewOfSection (128, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x755c0000), 0x0, 188416, ) == 0x0 01169 2020 NtClose (128, ... ) == 0x0 01170 2020 NtProtectVirtualMemory (-1, (0x755c1000), 860, 4, ... (0x755c1000), 4096, 32, ) == 0x0 01171 2020 NtProtectVirtualMemory (-1, (0x755c1000), 4096, 32, ... (0x755c1000), 4096, 4, ) == 0x0 01172 2020 NtFlushInstructionCache (-1, 1968967680, 860, ... ) == 0x0 01173 2020 NtProtectVirtualMemory (-1, (0x755c1000), 860, 4, ... (0x755c1000), 4096, 32, ) == 0x0 01174 2020 NtProtectVirtualMemory (-1, (0x755c1000), 4096, 32, ... (0x755c1000), 4096, 4, ) == 0x0 01175 2020 NtFlushInstructionCache (-1, 1968967680, 860, ... ) == 0x0 01176 2020 NtProtectVirtualMemory (-1, (0x755c1000), 860, 4, ... (0x755c1000), 4096, 32, ) == 0x0 01177 2020 NtProtectVirtualMemory (-1, (0x755c1000), 4096, 32, ... (0x755c1000), 4096, 4, ) == 0x0 01178 2020 NtFlushInstructionCache (-1, 1968967680, 860, ... ) == 0x0 01179 2020 NtProtectVirtualMemory (-1, (0x755c1000), 860, 4, ... (0x755c1000), 4096, 32, ) == 0x0 01180 2020 NtProtectVirtualMemory (-1, (0x755c1000), 4096, 32, ... (0x755c1000), 4096, 4, ) == 0x0 01181 2020 NtFlushInstructionCache (-1, 1968967680, 860, ... ) == 0x0 01182 2020 NtProtectVirtualMemory (-1, (0x755c1000), 860, 4, ... (0x755c1000), 4096, 32, ) == 0x0 01183 2020 NtProtectVirtualMemory (-1, (0x755c1000), 4096, 32, ... (0x755c1000), 4096, 4, ) == 0x0 01184 2020 NtFlushInstructionCache (-1, 1968967680, 860, ... ) == 0x0 01185 2020 NtProtectVirtualMemory (-1, (0x755c1000), 860, 4, ... (0x755c1000), 4096, 32, ) == 0x0 01186 2020 NtProtectVirtualMemory (-1, (0x755c1000), 4096, 32, ... (0x755c1000), 4096, 4, ) == 0x0 01187 2020 NtFlushInstructionCache (-1, 1968967680, 860, ... ) == 0x0 01188 2020 NtOpenKey (0x80000000, {24, 0, 0x40, 0, 0, (0x80000000, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msctfime.ime"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 01189 2020 NtUserGetDC (0, ... ) == 0x1010054 01190 2020 NtUserSystemParametersInfo (66, 12, 1238840, 0, ... ) == 0x1 01191 2020 NtUserCallOneParam (16842836, 57, ... ) == 0x1 01192 2020 NtQueryDebugFilterState (87, 3, ... ) == 0x0 01193 2020 NtQueryDebugFilterState (87, 3, ... ) == 0x0 01194 2020 NtContinue (1237044, 0, ... 01195 2020 NtQueryDebugFilterState (87, 3, ... ) == 0x0 01196 2020 NtUnmapViewOfSection (-1, 0x755c0000, ... ) == 0x0 01197 2020 NtQueryDebugFilterState (87, 3, ... ) == 0x0 01198 2020 NtUserValidateHandleSecure (393528, ... ) == 0x1 01199 2020 NtUserValidateHandleSecure (15794495, ... ) == 0x1 01200 2020 NtUserValidateHandleSecure (15794495, ... ) == 0x1 01201 2020 NtUserUpdateInputContext (15794495, 1, 393526, ... ) == 0x1 01202 2020 NtOpenKey (0x2000000, {24, 16, 0x40, 0, 0, (0x2000000, {24, 16, 0x40, 0, 0, "Software\Microsoft\Windows NT\CurrentVersion\IMM"}, ... 128, ) }, ... 128, ) == 0x0 01203 2020 NtQueryValueKey (128, (128, "Ime File", Partial, 144, ... TitleIdx=0, Type=1, Data="m\0s\0c\0t\0f\0i\0m\0e\0.\0i\0m\0e\0\0\0"}, 38, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (128, "Ime File", Partial, 144, ... TitleIdx=0, Type=1, Data="m\0s\0c\0t\0f\0i\0m\0e\0.\0i\0m\0e\0\0\0"}, 38, ) }, 38, ) == 0x0 01204 2020 NtClose (128, ... ) == 0x0 01205 2020 NtQueryInformationProcess (-1, DefaultHardErrorMode, 4, ... {process info, class 12, size 4}, 0x0, ) == 0x0 01206 2020 NtSetInformationProcess (-1, DefaultHardErrorMode, {process info, class 12, size 4}, 4, ... ) == 0x0 01207 2020 NtQueryAttributesFile ({24, 0, 0x40, 0, 0, ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\msctfime.ime"}, 1238480, ... ) }, 1238480, ... ) == 0x0 01208 2020 NtOpenFile (0x100020, {24, 0, 0x40, 0, 0, (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\msctfime.ime"}, 5, 96, ... 128, {status=0x0, info=1}, ) }, 5, 96, ... 128, {status=0x0, info=1}, ) == 0x0 01209 2020 NtCreateSection (0xe, 0x0, 0x0, 16, 134217728, 128, ... 132, ) == 0x0 01210 2020 NtClose (128, ... ) == 0x0 01211 2020 NtMapViewOfSection (132, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 16, ... (0xbf0000), 0x0, 180224, ) == 0x0 01212 2020 NtClose (132, ... ) == 0x0 01213 2020 NtUnmapViewOfSection (-1, 0xbf0000, ... ) == 0x0 01214 2020 NtQueryAttributesFile ({24, 0, 0x40, 0, 0, ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\msctfime.ime"}, 1238076, ... ) }, 1238076, ... ) == 0x0 01215 2020 NtCreateFile (0x80100080, {24, 0, 0x40, 0, 1238820, (0x80100080, {24, 0, 0x40, 0, 1238820, "\??\C:\WINDOWS\system32\msctfime.ime"}, 0x0, 0, 5, 1, 96, 0, 0, ... 132, {status=0x0, info=1}, ) }, 0x0, 0, 5, 1, 96, 0, 0, ... 132, {status=0x0, info=1}, ) == 0x0 01216 2020 NtCreateSection (0xf0005, 0x0, 0x0, 2, 134217728, 132, ... 128, ) == 0x0 01217 2020 NtClose (132, ... ) == 0x0 01218 2020 NtMapViewOfSection (128, -1, (0x0), 0, 0, {0, 0}, 0, 1, 0, 2, ... (0xbf0000), {0, 0}, 180224, ) == 0x0 01219 2020 NtClose (128, ... ) == 0x0 01220 2020 NtQueryInformationProcess (-1, DefaultHardErrorMode, 4, ... {process info, class 12, size 4}, 0x0, ) == 0x0 01221 2020 NtSetInformationProcess (-1, DefaultHardErrorMode, {process info, class 12, size 4}, 4, ... ) == 0x0 01222 2020 NtQueryDefaultLocale (1, 1239440, ... ) == 0x0 01223 2020 NtQueryVirtualMemory (-1, 0xbf0000, Basic, 28, ... {BaseAddress=0xbf0000,AllocationBase=0xbf0000,AllocationProtect=0x2,RegionSize=0x2c000,State=0x1000,Protect=0x2,Type=0x40000,}, 0x0, ) == 0x0 01224 2020 NtQueryVirtualMemory (-1, 0xbf0000, Basic, 28, ... {BaseAddress=0xbf0000,AllocationBase=0xbf0000,AllocationProtect=0x2,RegionSize=0x2c000,State=0x1000,Protect=0x2,Type=0x40000,}, 0x0, ) == 0x0 01225 2020 NtUnmapViewOfSection (-1, 0xbf0000, ... ) == 0x0 01226 2020 NtQueryInformationProcess (-1, DefaultHardErrorMode, 4, ... {process info, class 12, size 4}, 0x0, ) == 0x0 01227 2020 NtSetInformationProcess (-1, DefaultHardErrorMode, {process info, class 12, size 4}, 4, ... ) == 0x0 01228 2020 NtQueryAttributesFile ({24, 0, 0x40, 0, 0, ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\msctfime.ime"}, 1238472, ... ) }, 1238472, ... ) == 0x0 01229 2020 NtOpenFile (0x100020, {24, 0, 0x40, 0, 0, (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\msctfime.ime"}, 5, 96, ... 128, {status=0x0, info=1}, ) }, 5, 96, ... 128, {status=0x0, info=1}, ) == 0x0 01230 2020 NtCreateSection (0xe, 0x0, 0x0, 16, 134217728, 128, ... 132, ) == 0x0 01231 2020 NtClose (128, ... ) == 0x0 01232 2020 NtMapViewOfSection (132, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 16, ... (0xbf0000), 0x0, 180224, ) == 0x0 01233 2020 NtClose (132, ... ) == 0x0 01234 2020 NtUnmapViewOfSection (-1, 0xbf0000, ... ) == 0x0 01235 2020 NtQueryAttributesFile ({24, 0, 0x40, 0, 0, ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\msctfime.ime"}, 1238068, ... ) }, 1238068, ... ) == 0x0 01236 2020 NtCreateFile (0x80100080, {24, 0, 0x40, 0, 1238812, (0x80100080, {24, 0, 0x40, 0, 1238812, "\??\C:\WINDOWS\system32\msctfime.ime"}, 0x0, 0, 5, 1, 96, 0, 0, ... 132, {status=0x0, info=1}, ) }, 0x0, 0, 5, 1, 96, 0, 0, ... 132, {status=0x0, info=1}, ) == 0x0 01237 2020 NtCreateSection (0xf0005, 0x0, 0x0, 2, 134217728, 132, ... 128, ) == 0x0 01238 2020 NtClose (132, ... ) == 0x0 01239 2020 NtMapViewOfSection (128, -1, (0x0), 0, 0, {0, 0}, 0, 1, 0, 2, ... (0xbf0000), {0, 0}, 180224, ) == 0x0 01240 2020 NtClose (128, ... ) == 0x0 01241 2020 NtQueryInformationProcess (-1, DefaultHardErrorMode, 4, ... {process info, class 12, size 4}, 0x0, ) == 0x0 01242 2020 NtSetInformationProcess (-1, DefaultHardErrorMode, {process info, class 12, size 4}, 4, ... ) == 0x0 01243 2020 NtQueryDefaultLocale (1, 1239432, ... ) == 0x0 01244 2020 NtQueryVirtualMemory (-1, 0xbf0000, Basic, 28, ... {BaseAddress=0xbf0000,AllocationBase=0xbf0000,AllocationProtect=0x2,RegionSize=0x2c000,State=0x1000,Protect=0x2,Type=0x40000,}, 0x0, ) == 0x0 01245 2020 NtUnmapViewOfSection (-1, 0xbf0000, ... ) == 0x0 01246 2020 NtWaitForSingleObject (120, 0, {-1000000, -1}, ... ) == 0x0 01247 2020 NtOpenThreadTokenEx (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN 01248 2020 NtOpenProcessTokenEx (-1, 0x20008, 512, ... 128, ) == 0x0 01249 2020 NtQueryInformationToken (128, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0 01250 2020 NtClose (128, ... ) == 0x0 01251 2020 NtOpenKey (0x20019, {24, 0, 0x40, 0, 0, (0x20019, {24, 0, 0x40, 0, 0, "\REGISTRY\USER\S-1-5-21-1292428093-1383384898-725345543-1003\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Layers"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 01252 2020 NtReleaseMutant (120, ... 0x0, ) == 0x0 01253 2020 NtQueryAttributesFile ({24, 0, 0x40, 0, 0, ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\msctfime.ime"}, 1238452, ... ) }, 1238452, ... ) == 0x0 01254 2020 NtOpenFile (0x100020, {24, 0, 0x40, 0, 0, (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\msctfime.ime"}, 5, 96, ... 128, {status=0x0, info=1}, ) }, 5, 96, ... 128, {status=0x0, info=1}, ) == 0x0 01255 2020 NtCreateSection (0xe, 0x0, 0x0, 16, 134217728, 128, ... 132, ) == 0x0 01256 2020 NtClose (128, ... ) == 0x0 01257 2020 NtMapViewOfSection (132, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 16, ... (0xbf0000), 0x0, 180224, ) == 0x0 01258 2020 NtClose (132, ... ) == 0x0 01259 2020 NtUnmapViewOfSection (-1, 0xbf0000, ... ) == 0x0 01260 2020 NtQueryAttributesFile ({24, 0, 0x40, 0, 0, ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\msctfime.ime"}, 1238760, ... ) }, 1238760, ... ) == 0x0 01261 2020 NtOpenFile (0x100020, {24, 0, 0x40, 0, 0, (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\msctfime.ime"}, 5, 96, ... 132, {status=0x0, info=1}, ) }, 5, 96, ... 132, {status=0x0, info=1}, ) == 0x0 01262 2020 NtCreateSection (0xf, 0x0, 0x0, 16, 16777216, 132, ... 128, ) == 0x0 01263 2020 NtQuerySection (128, Image, 48, ... {section info, class 1, size 48}, 0x0, ) == 0x0 01264 2020 NtClose (132, ... ) == 0x0 01265 2020 NtMapViewOfSection (128, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x755c0000), 0x0, 188416, ) == 0x0 01266 2020 NtClose (128, ... ) == 0x0 01267 2020 NtProtectVirtualMemory (-1, (0x755c1000), 860, 4, ... (0x755c1000), 4096, 32, ) == 0x0 01268 2020 NtProtectVirtualMemory (-1, (0x755c1000), 4096, 32, ... (0x755c1000), 4096, 4, ) == 0x0 01269 2020 NtFlushInstructionCache (-1, 1968967680, 860, ... ) == 0x0 01270 2020 NtProtectVirtualMemory (-1, (0x755c1000), 860, 4, ... (0x755c1000), 4096, 32, ) == 0x0 01271 2020 NtProtectVirtualMemory (-1, (0x755c1000), 4096, 32, ... (0x755c1000), 4096, 4, ) == 0x0 01272 2020 NtFlushInstructionCache (-1, 1968967680, 860, ... ) == 0x0 01273 2020 NtProtectVirtualMemory (-1, (0x755c1000), 860, 4, ... (0x755c1000), 4096, 32, ) == 0x0 01274 2020 NtProtectVirtualMemory (-1, (0x755c1000), 4096, 32, ... (0x755c1000), 4096, 4, ) == 0x0 01275 2020 NtFlushInstructionCache (-1, 1968967680, 860, ... ) == 0x0 01276 2020 NtProtectVirtualMemory (-1, (0x755c1000), 860, 4, ... (0x755c1000), 4096, 32, ) == 0x0 01277 2020 NtProtectVirtualMemory (-1, (0x755c1000), 4096, 32, ... (0x755c1000), 4096, 4, ) == 0x0 01278 2020 NtFlushInstructionCache (-1, 1968967680, 860, ... ) == 0x0 01279 2020 NtProtectVirtualMemory (-1, (0x755c1000), 860, 4, ... (0x755c1000), 4096, 32, ) == 0x0 01280 2020 NtProtectVirtualMemory (-1, (0x755c1000), 4096, 32, ... (0x755c1000), 4096, 4, ) == 0x0 01281 2020 NtFlushInstructionCache (-1, 1968967680, 860, ... ) == 0x0 01282 2020 NtProtectVirtualMemory (-1, (0x755c1000), 860, 4, ... (0x755c1000), 4096, 32, ) == 0x0 01283 2020 NtProtectVirtualMemory (-1, (0x755c1000), 4096, 32, ... (0x755c1000), 4096, 4, ) == 0x0 01284 2020 NtFlushInstructionCache (-1, 1968967680, 860, ... ) == 0x0 01285 2020 NtOpenKey (0x80000000, {24, 0, 0x40, 0, 0, (0x80000000, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msctfime.ime"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 01286 2020 NtUserGetDC (0, ... ) == 0x1010054 01287 2020 NtUserSystemParametersInfo (66, 12, 1238948, 0, ... ) == 0x1 01288 2020 NtUserCallOneParam (16842836, 57, ... ) == 0x1 01289 2020 NtQueryDebugFilterState (87, 3, ... ) == 0x0 01290 2020 NtQueryDebugFilterState (87, 3, ... ) == 0x0 01291 2020 NtContinue (1237152, 0, ... 01292 2020 NtQueryDebugFilterState (87, 3, ... ) == 0x0 01293 2020 NtUnmapViewOfSection (-1, 0x755c0000, ... ) == 0x0 01294 2020 NtQueryDebugFilterState (87, 3, ... ) == 0x0 01295 2020 NtOpenKey (0x2000000, {24, 16, 0x40, 0, 0, (0x2000000, {24, 16, 0x40, 0, 0, "Software\Microsoft\Windows NT\CurrentVersion\IMM"}, ... 128, ) }, ... 128, ) == 0x0 01296 2020 NtQueryValueKey (128, (128, "Ime File", Partial, 144, ... TitleIdx=0, Type=1, Data="m\0s\0c\0t\0f\0i\0m\0e\0.\0i\0m\0e\0\0\0"}, 38, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (128, "Ime File", Partial, 144, ... TitleIdx=0, Type=1, Data="m\0s\0c\0t\0f\0i\0m\0e\0.\0i\0m\0e\0\0\0"}, 38, ) }, 38, ) == 0x0 01297 2020 NtClose (128, ... ) == 0x0 01298 2020 NtQueryInformationProcess (-1, DefaultHardErrorMode, 4, ... {process info, class 12, size 4}, 0x0, ) == 0x0 01299 2020 NtSetInformationProcess (-1, DefaultHardErrorMode, {process info, class 12, size 4}, 4, ... ) == 0x0 01300 2020 NtQueryAttributesFile ({24, 0, 0x40, 0, 0, ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\msctfime.ime"}, 1238480, ... ) }, 1238480, ... ) == 0x0 01301 2020 NtOpenFile (0x100020, {24, 0, 0x40, 0, 0, (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\msctfime.ime"}, 5, 96, ... 128, {status=0x0, info=1}, ) }, 5, 96, ... 128, {status=0x0, info=1}, ) == 0x0 01302 2020 NtCreateSection (0xe, 0x0, 0x0, 16, 134217728, 128, ... 132, ) == 0x0 01303 2020 NtClose (128, ... ) == 0x0 01304 2020 NtMapViewOfSection (132, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 16, ... (0xbf0000), 0x0, 180224, ) == 0x0 01305 2020 NtClose (132, ... ) == 0x0 01306 2020 NtUnmapViewOfSection (-1, 0xbf0000, ... ) == 0x0 01307 2020 NtQueryAttributesFile ({24, 0, 0x40, 0, 0, ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\msctfime.ime"}, 1238076, ... ) }, 1238076, ... ) == 0x0 01308 2020 NtCreateFile (0x80100080, {24, 0, 0x40, 0, 1238820, (0x80100080, {24, 0, 0x40, 0, 1238820, "\??\C:\WINDOWS\system32\msctfime.ime"}, 0x0, 0, 5, 1, 96, 0, 0, ... 132, {status=0x0, info=1}, ) }, 0x0, 0, 5, 1, 96, 0, 0, ... 132, {status=0x0, info=1}, ) == 0x0 01309 2020 NtCreateSection (0xf0005, 0x0, 0x0, 2, 134217728, 132, ... 128, ) == 0x0 01310 2020 NtClose (132, ... ) == 0x0 01311 2020 NtMapViewOfSection (128, -1, (0x0), 0, 0, {0, 0}, 0, 1, 0, 2, ... (0xbf0000), {0, 0}, 180224, ) == 0x0 01312 2020 NtClose (128, ... ) == 0x0 01313 2020 NtQueryInformationProcess (-1, DefaultHardErrorMode, 4, ... {process info, class 12, size 4}, 0x0, ) == 0x0 01314 2020 NtSetInformationProcess (-1, DefaultHardErrorMode, {process info, class 12, size 4}, 4, ... ) == 0x0 01315 2020 NtQueryDefaultLocale (1, 1239440, ... ) == 0x0 01316 2020 NtQueryVirtualMemory (-1, 0xbf0000, Basic, 28, ... {BaseAddress=0xbf0000,AllocationBase=0xbf0000,AllocationProtect=0x2,RegionSize=0x2c000,State=0x1000,Protect=0x2,Type=0x40000,}, 0x0, ) == 0x0 01317 2020 NtQueryVirtualMemory (-1, 0xbf0000, Basic, 28, ... {BaseAddress=0xbf0000,AllocationBase=0xbf0000,AllocationProtect=0x2,RegionSize=0x2c000,State=0x1000,Protect=0x2,Type=0x40000,}, 0x0, ) == 0x0 01318 2020 NtUnmapViewOfSection (-1, 0xbf0000, ... ) == 0x0 01319 2020 NtQueryInformationProcess (-1, DefaultHardErrorMode, 4, ... {process info, class 12, size 4}, 0x0, ) == 0x0 01320 2020 NtSetInformationProcess (-1, DefaultHardErrorMode, {process info, class 12, size 4}, 4, ... ) == 0x0 01321 2020 NtQueryAttributesFile ({24, 0, 0x40, 0, 0, ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\msctfime.ime"}, 1238472, ... ) }, 1238472, ... ) == 0x0 01322 2020 NtOpenFile (0x100020, {24, 0, 0x40, 0, 0, (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\msctfime.ime"}, 5, 96, ... 128, {status=0x0, info=1}, ) }, 5, 96, ... 128, {status=0x0, info=1}, ) == 0x0 01323 2020 NtCreateSection (0xe, 0x0, 0x0, 16, 134217728, 128, ... 132, ) == 0x0 01324 2020 NtClose (128, ... ) == 0x0 01325 2020 NtMapViewOfSection (132, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 16, ... (0xbf0000), 0x0, 180224, ) == 0x0 01326 2020 NtClose (132, ... ) == 0x0 01327 2020 NtUnmapViewOfSection (-1, 0xbf0000, ... ) == 0x0 01328 2020 NtQueryAttributesFile ({24, 0, 0x40, 0, 0, ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\msctfime.ime"}, 1238068, ... ) }, 1238068, ... ) == 0x0 01329 2020 NtCreateFile (0x80100080, {24, 0, 0x40, 0, 1238812, (0x80100080, {24, 0, 0x40, 0, 1238812, "\??\C:\WINDOWS\system32\msctfime.ime"}, 0x0, 0, 5, 1, 96, 0, 0, ... 132, {status=0x0, info=1}, ) }, 0x0, 0, 5, 1, 96, 0, 0, ... 132, {status=0x0, info=1}, ) == 0x0 01330 2020 NtCreateSection (0xf0005, 0x0, 0x0, 2, 134217728, 132, ... 128, ) == 0x0 01331 2020 NtClose (132, ... ) == 0x0 01332 2020 NtMapViewOfSection (128, -1, (0x0), 0, 0, {0, 0}, 0, 1, 0, 2, ... (0xbf0000), {0, 0}, 180224, ) == 0x0 01333 2020 NtClose (128, ... ) == 0x0 01334 2020 NtQueryInformationProcess (-1, DefaultHardErrorMode, 4, ... {process info, class 12, size 4}, 0x0, ) == 0x0 01335 2020 NtSetInformationProcess (-1, DefaultHardErrorMode, {process info, class 12, size 4}, 4, ... ) == 0x0 01336 2020 NtQueryDefaultLocale (1, 1239432, ... ) == 0x0 01337 2020 NtQueryVirtualMemory (-1, 0xbf0000, Basic, 28, ... {BaseAddress=0xbf0000,AllocationBase=0xbf0000,AllocationProtect=0x2,RegionSize=0x2c000,State=0x1000,Protect=0x2,Type=0x40000,}, 0x0, ) == 0x0 01338 2020 NtUnmapViewOfSection (-1, 0xbf0000, ... ) == 0x0 01339 2020 NtWaitForSingleObject (120, 0, {-1000000, -1}, ... ) == 0x0 01340 2020 NtOpenThreadTokenEx (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN 01341 2020 NtOpenProcessTokenEx (-1, 0x20008, 512, ... 128, ) == 0x0 01342 2020 NtQueryInformationToken (128, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0 01343 2020 NtClose (128, ... ) == 0x0 01344 2020 NtOpenKey (0x20019, {24, 0, 0x40, 0, 0, (0x20019, {24, 0, 0x40, 0, 0, "\REGISTRY\USER\S-1-5-21-1292428093-1383384898-725345543-1003\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Layers"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 01345 2020 NtReleaseMutant (120, ... 0x0, ) == 0x0 01346 2020 NtQueryAttributesFile ({24, 0, 0x40, 0, 0, ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\msctfime.ime"}, 1238452, ... ) }, 1238452, ... ) == 0x0 01347 2020 NtOpenFile (0x100020, {24, 0, 0x40, 0, 0, (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\msctfime.ime"}, 5, 96, ... 128, {status=0x0, info=1}, ) }, 5, 96, ... 128, {status=0x0, info=1}, ) == 0x0 01348 2020 NtCreateSection (0xe, 0x0, 0x0, 16, 134217728, 128, ... 132, ) == 0x0 01349 2020 NtClose (128, ... ) == 0x0 01350 2020 NtMapViewOfSection (132, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 16, ... (0xbf0000), 0x0, 180224, ) == 0x0 01351 2020 NtClose (132, ... ) == 0x0 01352 2020 NtUnmapViewOfSection (-1, 0xbf0000, ... ) == 0x0 01353 2020 NtQueryAttributesFile ({24, 0, 0x40, 0, 0, ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\msctfime.ime"}, 1238760, ... ) }, 1238760, ... ) == 0x0 01354 2020 NtOpenFile (0x100020, {24, 0, 0x40, 0, 0, (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\msctfime.ime"}, 5, 96, ... 132, {status=0x0, info=1}, ) }, 5, 96, ... 132, {status=0x0, info=1}, ) == 0x0 01355 2020 NtCreateSection (0xf, 0x0, 0x0, 16, 16777216, 132, ... 128, ) == 0x0 01356 2020 NtQuerySection (128, Image, 48, ... {section info, class 1, size 48}, 0x0, ) == 0x0 01357 2020 NtClose (132, ... ) == 0x0 01358 2020 NtMapViewOfSection (128, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x755c0000), 0x0, 188416, ) == 0x0 01359 2020 NtClose (128, ... ) == 0x0 01360 2020 NtProtectVirtualMemory (-1, (0x755c1000), 860, 4, ... (0x755c1000), 4096, 32, ) == 0x0 01361 2020 NtProtectVirtualMemory (-1, (0x755c1000), 4096, 32, ... (0x755c1000), 4096, 4, ) == 0x0 01362 2020 NtFlushInstructionCache (-1, 1968967680, 860, ... ) == 0x0 01363 2020 NtProtectVirtualMemory (-1, (0x755c1000), 860, 4, ... (0x755c1000), 4096, 32, ) == 0x0 01364 2020 NtProtectVirtualMemory (-1, (0x755c1000), 4096, 32, ... (0x755c1000), 4096, 4, ) == 0x0 01365 2020 NtFlushInstructionCache (-1, 1968967680, 860, ... ) == 0x0 01366 2020 NtProtectVirtualMemory (-1, (0x755c1000), 860, 4, ... (0x755c1000), 4096, 32, ) == 0x0 01367 2020 NtProtectVirtualMemory (-1, (0x755c1000), 4096, 32, ... (0x755c1000), 4096, 4, ) == 0x0 01368 2020 NtFlushInstructionCache (-1, 1968967680, 860, ... ) == 0x0 01369 2020 NtProtectVirtualMemory (-1, (0x755c1000), 860, 4, ... (0x755c1000), 4096, 32, ) == 0x0 01370 2020 NtProtectVirtualMemory (-1, (0x755c1000), 4096, 32, ... (0x755c1000), 4096, 4, ) == 0x0 01371 2020 NtFlushInstructionCache (-1, 1968967680, 860, ... ) == 0x0 01372 2020 NtProtectVirtualMemory (-1, (0x755c1000), 860, 4, ... (0x755c1000), 4096, 32, ) == 0x0 01373 2020 NtProtectVirtualMemory (-1, (0x755c1000), 4096, 32, ... (0x755c1000), 4096, 4, ) == 0x0 01374 2020 NtFlushInstructionCache (-1, 1968967680, 860, ... ) == 0x0 01375 2020 NtProtectVirtualMemory (-1, (0x755c1000), 860, 4, ... (0x755c1000), 4096, 32, ) == 0x0 01376 2020 NtProtectVirtualMemory (-1, (0x755c1000), 4096, 32, ... (0x755c1000), 4096, 4, ) == 0x0 01377 2020 NtFlushInstructionCache (-1, 1968967680, 860, ... ) == 0x0 01378 2020 NtOpenKey (0x80000000, {24, 0, 0x40, 0, 0, (0x80000000, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msctfime.ime"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 01379 2020 NtUserGetDC (0, ... ) == 0x1010054 01380 2020 NtUserSystemParametersInfo (66, 12, 1238948, 0, ... ) == 0x1 01381 2020 NtUserCallOneParam (16842836, 57, ... ) == 0x1 01382 2020 NtQueryDebugFilterState (87, 3, ... ) == 0x0 01383 2020 NtQueryDebugFilterState (87, 3, ... ) == 0x0 01384 2020 NtContinue (1237152, 0, ... 01385 2020 NtQueryDebugFilterState (87, 3, ... ) == 0x0 01386 2020 NtUnmapViewOfSection (-1, 0x755c0000, ... ) == 0x0 01387 2020 NtQueryDebugFilterState (87, 3, ... ) == 0x0 01388 2020 NtOpenKey (0x2000000, {24, 16, 0x40, 0, 0, (0x2000000, {24, 16, 0x40, 0, 0, "Software\Microsoft\Windows NT\CurrentVersion\IMM"}, ... 128, ) }, ... 128, ) == 0x0 01389 2020 NtQueryValueKey (128, (128, "Ime File", Partial, 144, ... TitleIdx=0, Type=1, Data="m\0s\0c\0t\0f\0i\0m\0e\0.\0i\0m\0e\0\0\0"}, 38, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (128, "Ime File", Partial, 144, ... TitleIdx=0, Type=1, Data="m\0s\0c\0t\0f\0i\0m\0e\0.\0i\0m\0e\0\0\0"}, 38, ) }, 38, ) == 0x0 01390 2020 NtClose (128, ... ) == 0x0 01391 2020 NtQueryInformationProcess (-1, DefaultHardErrorMode, 4, ... {process info, class 12, size 4}, 0x0, ) == 0x0 01392 2020 NtSetInformationProcess (-1, DefaultHardErrorMode, {process info, class 12, size 4}, 4, ... ) == 0x0 01393 2020 NtQueryAttributesFile ({24, 0, 0x40, 0, 0, ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\msctfime.ime"}, 1238480, ... ) }, 1238480, ... ) == 0x0 01394 2020 NtOpenFile (0x100020, {24, 0, 0x40, 0, 0, (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\msctfime.ime"}, 5, 96, ... 128, {status=0x0, info=1}, ) }, 5, 96, ... 128, {status=0x0, info=1}, ) == 0x0 01395 2020 NtCreateSection (0xe, 0x0, 0x0, 16, 134217728, 128, ... 132, ) == 0x0 01396 2020 NtClose (128, ... ) == 0x0 01397 2020 NtMapViewOfSection (132, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 16, ... (0xbf0000), 0x0, 180224, ) == 0x0 01398 2020 NtClose (132, ... ) == 0x0 01399 2020 NtUnmapViewOfSection (-1, 0xbf0000, ... ) == 0x0 01400 2020 NtQueryAttributesFile ({24, 0, 0x40, 0, 0, ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\msctfime.ime"}, 1238076, ... ) }, 1238076, ... ) == 0x0 01401 2020 NtCreateFile (0x80100080, {24, 0, 0x40, 0, 1238820, (0x80100080, {24, 0, 0x40, 0, 1238820, "\??\C:\WINDOWS\system32\msctfime.ime"}, 0x0, 0, 5, 1, 96, 0, 0, ... 132, {status=0x0, info=1}, ) }, 0x0, 0, 5, 1, 96, 0, 0, ... 132, {status=0x0, info=1}, ) == 0x0 01402 2020 NtCreateSection (0xf0005, 0x0, 0x0, 2, 134217728, 132, ... 128, ) == 0x0 01403 2020 NtClose (132, ... ) == 0x0 01404 2020 NtMapViewOfSection (128, -1, (0x0), 0, 0, {0, 0}, 0, 1, 0, 2, ... (0xbf0000), {0, 0}, 180224, ) == 0x0 01405 2020 NtClose (128, ... ) == 0x0 01406 2020 NtQueryInformationProcess (-1, DefaultHardErrorMode, 4, ... {process info, class 12, size 4}, 0x0, ) == 0x0 01407 2020 NtSetInformationProcess (-1, DefaultHardErrorMode, {process info, class 12, size 4}, 4, ... ) == 0x0 01408 2020 NtQueryDefaultLocale (1, 1239440, ... ) == 0x0 01409 2020 NtQueryVirtualMemory (-1, 0xbf0000, Basic, 28, ... {BaseAddress=0xbf0000,AllocationBase=0xbf0000,AllocationProtect=0x2,RegionSize=0x2c000,State=0x1000,Protect=0x2,Type=0x40000,}, 0x0, ) == 0x0 01410 2020 NtQueryVirtualMemory (-1, 0xbf0000, Basic, 28, ... {BaseAddress=0xbf0000,AllocationBase=0xbf0000,AllocationProtect=0x2,RegionSize=0x2c000,State=0x1000,Protect=0x2,Type=0x40000,}, 0x0, ) == 0x0 01411 2020 NtUnmapViewOfSection (-1, 0xbf0000, ... ) == 0x0 01412 2020 NtAllocateVirtualMemory (-1, 1376256, 0, 4096, 4096, 4, ... 1376256, 4096, ) == 0x0 01413 2020 NtQueryInformationProcess (-1, DefaultHardErrorMode, 4, ... {process info, class 12, size 4}, 0x0, ) == 0x0 01414 2020 NtSetInformationProcess (-1, DefaultHardErrorMode, {process info, class 12, size 4}, 4, ... ) == 0x0 01415 2020 NtQueryAttributesFile ({24, 0, 0x40, 0, 0, ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\msctfime.ime"}, 1238472, ... ) }, 1238472, ... ) == 0x0 01416 2020 NtOpenFile (0x100020, {24, 0, 0x40, 0, 0, (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\msctfime.ime"}, 5, 96, ... 128, {status=0x0, info=1}, ) }, 5, 96, ... 128, {status=0x0, info=1}, ) == 0x0 01417 2020 NtCreateSection (0xe, 0x0, 0x0, 16, 134217728, 128, ... 132, ) == 0x0 01418 2020 NtClose (128, ... ) == 0x0 01419 2020 NtMapViewOfSection (132, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 16, ... (0xbf0000), 0x0, 180224, ) == 0x0 01420 2020 NtClose (132, ... ) == 0x0 01421 2020 NtUnmapViewOfSection (-1, 0xbf0000, ... ) == 0x0 01422 2020 NtQueryAttributesFile ({24, 0, 0x40, 0, 0, ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\msctfime.ime"}, 1238068, ... ) }, 1238068, ... ) == 0x0 01423 2020 NtCreateFile (0x80100080, {24, 0, 0x40, 0, 1238812, (0x80100080, {24, 0, 0x40, 0, 1238812, "\??\C:\WINDOWS\system32\msctfime.ime"}, 0x0, 0, 5, 1, 96, 0, 0, ... 132, {status=0x0, info=1}, ) }, 0x0, 0, 5, 1, 96, 0, 0, ... 132, {status=0x0, info=1}, ) == 0x0 01424 2020 NtCreateSection (0xf0005, 0x0, 0x0, 2, 134217728, 132, ... 128, ) == 0x0 01425 2020 NtClose (132, ... ) == 0x0 01426 2020 NtMapViewOfSection (128, -1, (0x0), 0, 0, {0, 0}, 0, 1, 0, 2, ... (0xbf0000), {0, 0}, 180224, ) == 0x0 01427 2020 NtClose (128, ... ) == 0x0 01428 2020 NtQueryInformationProcess (-1, DefaultHardErrorMode, 4, ... {process info, class 12, size 4}, 0x0, ) == 0x0 01429 2020 NtSetInformationProcess (-1, DefaultHardErrorMode, {process info, class 12, size 4}, 4, ... ) == 0x0 01430 2020 NtQueryDefaultLocale (1, 1239432, ... ) == 0x0 01431 2020 NtQueryVirtualMemory (-1, 0xbf0000, Basic, 28, ... {BaseAddress=0xbf0000,AllocationBase=0xbf0000,AllocationProtect=0x2,RegionSize=0x2c000,State=0x1000,Protect=0x2,Type=0x40000,}, 0x0, ) == 0x0 01432 2020 NtUnmapViewOfSection (-1, 0xbf0000, ... ) == 0x0 01433 2020 NtWaitForSingleObject (120, 0, {-1000000, -1}, ... ) == 0x0 01434 2020 NtOpenThreadTokenEx (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN 01435 2020 NtOpenProcessTokenEx (-1, 0x20008, 512, ... 128, ) == 0x0 01436 2020 NtQueryInformationToken (128, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0 01437 2020 NtClose (128, ... ) == 0x0 01438 2020 NtOpenKey (0x20019, {24, 0, 0x40, 0, 0, (0x20019, {24, 0, 0x40, 0, 0, "\REGISTRY\USER\S-1-5-21-1292428093-1383384898-725345543-1003\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Layers"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 01439 2020 NtReleaseMutant (120, ... 0x0, ) == 0x0 01440 2020 NtQueryAttributesFile ({24, 0, 0x40, 0, 0, ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\msctfime.ime"}, 1238452, ... ) }, 1238452, ... ) == 0x0 01441 2020 NtOpenFile (0x100020, {24, 0, 0x40, 0, 0, (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\msctfime.ime"}, 5, 96, ... 128, {status=0x0, info=1}, ) }, 5, 96, ... 128, {status=0x0, info=1}, ) == 0x0 01442 2020 NtCreateSection (0xe, 0x0, 0x0, 16, 134217728, 128, ... 132, ) == 0x0 01443 2020 NtClose (128, ... ) == 0x0 01444 2020 NtMapViewOfSection (132, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 16, ... (0xbf0000), 0x0, 180224, ) == 0x0 01445 2020 NtClose (132, ... ) == 0x0 01446 2020 NtUnmapViewOfSection (-1, 0xbf0000, ... ) == 0x0 01447 2020 NtQueryAttributesFile ({24, 0, 0x40, 0, 0, ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\msctfime.ime"}, 1238760, ... ) }, 1238760, ... ) == 0x0 01448 2020 NtOpenFile (0x100020, {24, 0, 0x40, 0, 0, (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\msctfime.ime"}, 5, 96, ... 132, {status=0x0, info=1}, ) }, 5, 96, ... 132, {status=0x0, info=1}, ) == 0x0 01449 2020 NtCreateSection (0xf, 0x0, 0x0, 16, 16777216, 132, ... 128, ) == 0x0 01450 2020 NtQuerySection (128, Image, 48, ... {section info, class 1, size 48}, 0x0, ) == 0x0 01451 2020 NtClose (132, ... ) == 0x0 01452 2020 NtMapViewOfSection (128, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x755c0000), 0x0, 188416, ) == 0x0 01453 2020 NtClose (128, ... ) == 0x0 01454 2020 NtProtectVirtualMemory (-1, (0x755c1000), 860, 4, ... (0x755c1000), 4096, 32, ) == 0x0 01455 2020 NtProtectVirtualMemory (-1, (0x755c1000), 4096, 32, ... (0x755c1000), 4096, 4, ) == 0x0 01456 2020 NtFlushInstructionCache (-1, 1968967680, 860, ... ) == 0x0 01457 2020 NtProtectVirtualMemory (-1, (0x755c1000), 860, 4, ... (0x755c1000), 4096, 32, ) == 0x0 01458 2020 NtProtectVirtualMemory (-1, (0x755c1000), 4096, 32, ... (0x755c1000), 4096, 4, ) == 0x0 01459 2020 NtFlushInstructionCache (-1, 1968967680, 860, ... ) == 0x0 01460 2020 NtProtectVirtualMemory (-1, (0x755c1000), 860, 4, ... (0x755c1000), 4096, 32, ) == 0x0 01461 2020 NtProtectVirtualMemory (-1, (0x755c1000), 4096, 32, ... (0x755c1000), 4096, 4, ) == 0x0 01462 2020 NtFlushInstructionCache (-1, 1968967680, 860, ... ) == 0x0 01463 2020 NtProtectVirtualMemory (-1, (0x755c1000), 860, 4, ... (0x755c1000), 4096, 32, ) == 0x0 01464 2020 NtProtectVirtualMemory (-1, (0x755c1000), 4096, 32, ... (0x755c1000), 4096, 4, ) == 0x0 01465 2020 NtFlushInstructionCache (-1, 1968967680, 860, ... ) == 0x0 01466 2020 NtProtectVirtualMemory (-1, (0x755c1000), 860, 4, ... (0x755c1000), 4096, 32, ) == 0x0 01467 2020 NtProtectVirtualMemory (-1, (0x755c1000), 4096, 32, ... (0x755c1000), 4096, 4, ) == 0x0 01468 2020 NtFlushInstructionCache (-1, 1968967680, 860, ... ) == 0x0 01469 2020 NtProtectVirtualMemory (-1, (0x755c1000), 860, 4, ... (0x755c1000), 4096, 32, ) == 0x0 01470 2020 NtProtectVirtualMemory (-1, (0x755c1000), 4096, 32, ... (0x755c1000), 4096, 4, ) == 0x0 01471 2020 NtFlushInstructionCache (-1, 1968967680, 860, ... ) == 0x0 01472 2020 NtOpenKey (0x80000000, {24, 0, 0x40, 0, 0, (0x80000000, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msctfime.ime"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 01473 2020 NtUserGetDC (0, ... ) == 0x1010054 01474 2020 NtUserSystemParametersInfo (66, 12, 1238948, 0, ... ) == 0x1 01475 2020 NtUserCallOneParam (16842836, 57, ... ) == 0x1 01476 2020 NtQueryDebugFilterState (87, 3, ... ) == 0x0 01477 2020 NtQueryDebugFilterState (87, 3, ... ) == 0x0 01478 2020 NtContinue (1237152, 0, ... 01479 2020 NtQueryDebugFilterState (87, 3, ... ) == 0x0 01480 2020 NtUnmapViewOfSection (-1, 0x755c0000, ... ) == 0x0 01481 2020 NtQueryDebugFilterState (87, 3, ... ) == 0x0 01482 2020 NtOpenKey (0x2000000, {24, 56, 0x40, 0, 0, (0x2000000, {24, 56, 0x40, 0, 0, "SOFTWARE\Microsoft\CTF"}, ... 128, ) }, ... 128, ) == 0x0 01483 2020 NtQueryValueKey (128, (128, "Disable Thread Input Manager", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 01484 2020 NtClose (128, ... ) == 0x0 01485 2020 NtOpenThreadToken (-2, 0x8, 0, ... ) == STATUS_NO_TOKEN 01486 2020 NtOpenProcessToken (-1, 0xa, ... 128, ) == 0x0 01487 2020 NtDuplicateToken (128, 0xc, {24, 0, 0x0, 0, 1240836, 0x0}, 0, 2, ... 132, ) == 0x0 01488 2020 NtClose (128, ... ) == 0x0 01489 2020 NtAccessCheck (1375016, 132, 0x1, 1240912, 1240964, 56, 1240944, ... (0x1), ) == 0x0 01490 2020 NtClose (132, ... ) == 0x0 01491 2020 NtOpenKey (0x2000000, {24, 16, 0x40, 0, 0, (0x2000000, {24, 16, 0x40, 0, 0, "Software\Microsoft\CTF\SystemShared"}, ... 132, ) }, ... 132, ) == 0x0 01492 2020 NtQueryValueKey (132, (132, "CUAS", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (132, "CUAS", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) }, 16, ) == 0x0 01493 2020 NtClose (132, ... ) == 0x0 01494 2020 NtUserGetImeInfoEx (1240728, 0, ... ) == 0x1 01495 2020 NtWaitForSingleObject (120, 0, {-1000000, -1}, ... ) == 0x0 01496 2020 NtOpenThreadTokenEx (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN 01497 2020 NtOpenProcessTokenEx (-1, 0x20008, 512, ... 132, ) == 0x0 01498 2020 NtQueryInformationToken (132, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0 01499 2020 NtClose (132, ... ) == 0x0 01500 2020 NtOpenKey (0x20019, {24, 0, 0x40, 0, 0, (0x20019, {24, 0, 0x40, 0, 0, "\REGISTRY\USER\S-1-5-21-1292428093-1383384898-725345543-1003\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Layers"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 01501 2020 NtReleaseMutant (120, ... 0x0, ) == 0x0 01502 2020 NtQueryAttributesFile ({24, 0, 0x40, 0, 0, ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\msctfime.ime"}, 1237760, ... ) }, 1237760, ... ) == 0x0 01503 2020 NtOpenFile (0x100020, {24, 0, 0x40, 0, 0, (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\msctfime.ime"}, 5, 96, ... 132, {status=0x0, info=1}, ) }, 5, 96, ... 132, {status=0x0, info=1}, ) == 0x0 01504 2020 NtCreateSection (0xe, 0x0, 0x0, 16, 134217728, 132, ... 128, ) == 0x0 01505 2020 NtClose (132, ... ) == 0x0 01506 2020 NtMapViewOfSection (128, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 16, ... (0xbf0000), 0x0, 180224, ) == 0x0 01507 2020 NtClose (128, ... ) == 0x0 01508 2020 NtUnmapViewOfSection (-1, 0xbf0000, ... ) == 0x0 01509 2020 NtQueryAttributesFile ({24, 0, 0x40, 0, 0, ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\msctfime.ime"}, 1238068, ... ) }, 1238068, ... ) == 0x0 01510 2020 NtOpenFile (0x100020, {24, 0, 0x40, 0, 0, (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\msctfime.ime"}, 5, 96, ... 128, {status=0x0, info=1}, ) }, 5, 96, ... 128, {status=0x0, info=1}, ) == 0x0 01511 2020 NtCreateSection (0xf, 0x0, 0x0, 16, 16777216, 128, ... 132, ) == 0x0 01512 2020 NtQuerySection (132, Image, 48, ... {section info, class 1, size 48}, 0x0, ) == 0x0 01513 2020 NtClose (128, ... ) == 0x0 01514 2020 NtMapViewOfSection (132, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x755c0000), 0x0, 188416, ) == 0x0 01515 2020 NtClose (132, ... ) == 0x0 01516 2020 NtProtectVirtualMemory (-1, (0x755c1000), 860, 4, ... (0x755c1000), 4096, 32, ) == 0x0 01517 2020 NtProtectVirtualMemory (-1, (0x755c1000), 4096, 32, ... (0x755c1000), 4096, 4, ) == 0x0 01518 2020 NtFlushInstructionCache (-1, 1968967680, 860, ... ) == 0x0 01519 2020 NtProtectVirtualMemory (-1, (0x755c1000), 860, 4, ... (0x755c1000), 4096, 32, ) == 0x0 01520 2020 NtProtectVirtualMemory (-1, (0x755c1000), 4096, 32, ... (0x755c1000), 4096, 4, ) == 0x0 01521 2020 NtFlushInstructionCache (-1, 1968967680, 860, ... ) == 0x0 01522 2020 NtProtectVirtualMemory (-1, (0x755c1000), 860, 4, ... (0x755c1000), 4096, 32, ) == 0x0 01523 2020 NtProtectVirtualMemory (-1, (0x755c1000), 4096, 32, ... (0x755c1000), 4096, 4, ) == 0x0 01524 2020 NtFlushInstructionCache (-1, 1968967680, 860, ... ) == 0x0 01525 2020 NtProtectVirtualMemory (-1, (0x755c1000), 860, 4, ... (0x755c1000), 4096, 32, ) == 0x0 01526 2020 NtProtectVirtualMemory (-1, (0x755c1000), 4096, 32, ... (0x755c1000), 4096, 4, ) == 0x0 01527 2020 NtFlushInstructionCache (-1, 1968967680, 860, ... ) == 0x0 01528 2020 NtProtectVirtualMemory (-1, (0x755c1000), 860, 4, ... (0x755c1000), 4096, 32, ) == 0x0 01529 2020 NtProtectVirtualMemory (-1, (0x755c1000), 4096, 32, ... (0x755c1000), 4096, 4, ) == 0x0 01530 2020 NtFlushInstructionCache (-1, 1968967680, 860, ... ) == 0x0 01531 2020 NtProtectVirtualMemory (-1, (0x755c1000), 860, 4, ... (0x755c1000), 4096, 32, ) == 0x0 01532 2020 NtProtectVirtualMemory (-1, (0x755c1000), 4096, 32, ... (0x755c1000), 4096, 4, ) == 0x0 01533 2020 NtFlushInstructionCache (-1, 1968967680, 860, ... ) == 0x0 01534 2020 NtOpenKey (0x80000000, {24, 0, 0x40, 0, 0, (0x80000000, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msctfime.ime"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 01535 2020 NtUserGetDC (0, ... ) == 0x1010054 01536 2020 NtUserSystemParametersInfo (66, 12, 1238256, 0, ... ) == 0x1 01537 2020 NtUserCallOneParam (16842836, 57, ... ) == 0x1 01538 2020 NtQueryDebugFilterState (87, 3, ... ) == 0x0 01539 2020 NtQueryDebugFilterState (87, 3, ... ) == 0x0 01540 2020 NtContinue (1236460, 0, ... 01541 2020 NtQueryDebugFilterState (87, 3, ... ) == 0x0 01542 2020 NtUnmapViewOfSection (-1, 0x755c0000, ... ) == 0x0 01543 2020 NtQueryDebugFilterState (87, 3, ... ) == 0x0 01544 2020 NtUserMessageCall (0x60138, WM_NCCALCSIZE, 0x0, 0x12f3cc, 0, 670, 1, ... ) == 0x0 01545 2020 NtUserGetClassName (393528, 0, 1241236, ... ) == 0x6 01546 2020 NtUserRemoveProp (393528, 43282, ... ) == 0x0 01547 2020 NtRequestWaitReplyPort (24, {24, 52, new_msg, 0, 262144, 6881357, 7471203, 7536751} (24, {24, 52, new_msg, 0, 262144, 6881357, 7471203, 7536751} "\0\0\0\0\5\4\3\0T\0e\0x\0t\0\344\7\0\0\34\357\22\0" ... {24, 52, reply, 0, 868, 2020, 75653, 0} "\0\0\0\0\5\4\3\0\0\0\0\0x\0t\0\344\7\0\0\0\0\0\0" ) ... {24, 52, reply, 0, 868, 2020, 75653, 0} (24, {24, 52, new_msg, 0, 262144, 6881357, 7471203, 7536751} "\0\0\0\0\5\4\3\0T\0e\0x\0t\0\344\7\0\0\34\357\22\0" ... {24, 52, reply, 0, 868, 2020, 75653, 0} "\0\0\0\0\5\4\3\0\0\0\0\0x\0t\0\344\7\0\0\0\0\0\0" ) ) == 0x0 01548 2020 NtUserGetThreadDesktop (2020, 0, ... ) == 0x24 01549 2020 NtUserGetObjectInformation (36, 2, 1240920, 520, 0, ... ) == 0x1 01550 2020 NtGdiDeleteObjectApp (-1676671828, ... ) == 0x1 01551 2020 NtUserGetWindowDC (0, ... ) == 0x1010052 01552 2020 NtUserCallOneParam (16842834, 57, ... ) == 0x1 01553 2020 NtUserGetWindowDC (0, ... ) == 0x1010052 01554 2020 NtQueryVirtualMemory (-1, 0x7e418830, Basic, 28, ... {BaseAddress=0x7e418000,AllocationBase=0x7e410000,AllocationProtect=0x80,RegionSize=0x58000,State=0x1000,Protect=0x20,Type=0x1000000,}, 28, ) == 0x0 01555 2020 NtQueryVirtualMemory (-1, 0x3b2fcf, Basic, 28, ... {BaseAddress=0x3b2000,AllocationBase=0x3b0000,AllocationProtect=0x40,RegionSize=0x42000,State=0x1000,Protect=0x40,Type=0x20000,}, 28, ) == 0x0 01556 2020 NtQueryVirtualMemory (-1, 0x7c816fe0, Basic, 28, ... {BaseAddress=0x7c816000,AllocationBase=0x7c800000,AllocationProtect=0x80,RegionSize=0x6e000,State=0x1000,Protect=0x20,Type=0x1000000,}, 28, ) == 0x0 01557 2020 NtQueryInformationProcess (-1, DebugPort, 4, ... {process info, class 7, size 4}, 0x0, ) == 0x0 01558 2020 NtQueryInformationProcess (-1, 36, 4, ... {process info, class 36, size 4}, 0x0, ) == 0x0 01559 2020 NtQueryVirtualMemory (-1, 0x77c2807c, Basic, 28, ... {BaseAddress=0x77c28000,AllocationBase=0x77c10000,AllocationProtect=0x80,RegionSize=0x35000,State=0x1000,Protect=0x20,Type=0x1000000,}, 28, ) == 0x0 01560 2020 NtQueryInformationProcess (-1, DefaultHardErrorMode, 4, ... {process info, class 12, size 4}, 0x0, ) == 0x0 01561 2020 NtQueryInformationJobObject (0, BasicLimit, 48, ... ) == STATUS_ACCESS_DENIED 01562 2020 NtOpenKey (0x1, {24, 0, 0x40, 0, 0, (0x1, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\AeDebug"}, ... 132, ) }, ... 132, ) == 0x0 01563 2020 NtQueryValueKey (132, (132, "Auto", Partial, 526, ... TitleIdx=0, Type=1, Data="0\0\0\0"}, 16, ) , Partial, 526, ... TitleIdx=0, Type=1, Data= (132, "Auto", Partial, 526, ... TitleIdx=0, Type=1, Data="0\0\0\0"}, 16, ) }, 16, ) == 0x0 01564 2020 NtQueryValueKey (132, (132, "Debugger", Partial, 526, ... TitleIdx=0, Type=1, Data=""\0C\0:\0\\0P\0r\0o\0g\0r\0a\0m\0 \0F\0i\0l\0e\0s\0\\0M\0i\0c\0r\0o\0s\0o\0f\0t\0 \0V\0i\0s\0u\0a\0l\0 \0S\0t\0u\0d\0i\0o\0\\0C\0o\0m\0m\0o\0n\0\\0M\0S\0D\0e\0v\09\08\0\\0B\0i\0n\0\\0m\0s\0d\0e\0v\0.\0e\0x\0e\0"\0 \0-\0p\0 \0%\0l\0d\0 \0-\0e\0 \0%\0l\0d\0\0\0"}, 184, ) , Partial, 526, ... TitleIdx=0, Type=1, Data=" (132, "Debugger", Partial, 526, ... TitleIdx=0, Type=1, Data=""\0C\0:\0\\0P\0r\0o\0g\0r\0a\0m\0 \0F\0i\0l\0e\0s\0\\0M\0i\0c\0r\0o\0s\0o\0f\0t\0 \0V\0i\0s\0u\0a\0l\0 \0S\0t\0u\0d\0i\0o\0\\0C\0o\0m\0m\0o\0n\0\\0M\0S\0D\0e\0v\09\08\0\\0B\0i\0n\0\\0m\0s\0d\0e\0v\0.\0e\0x\0e\0"\0 \0-\0p\0 \0%\0l\0d\0 \0-\0e\0 \0%\0l\0d\0\0\0"}, 184, ) \0 \0-\0p\0 \0%\0l\0d\0 \0-\0e\0 \0%\0l\0d\0\0\0"}, 184, ) == 0x0 01565 2020 NtClose (132, ... ) == 0x0 01566 2020 NtQueryAttributesFile ({24, 0, 0x40, 0, 0, ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\faultrep.dll"}, 1236420, ... ) }, 1236420, ... ) == 0x0 01567 2020 NtOpenFile (0x100020, {24, 0, 0x40, 0, 0, (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\faultrep.dll"}, 5, 96, ... 132, {status=0x0, info=1}, ) }, 5, 96, ... 132, {status=0x0, info=1}, ) == 0x0 01568 2020 NtCreateSection (0xe, 0x0, 0x0, 16, 134217728, 132, ... 128, ) == 0x0 01569 2020 NtClose (132, ... ) == 0x0 01570 2020 NtMapViewOfSection (128, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 16, ... (0xbf0000), 0x0, 81920, ) == 0x0 01571 2020 NtClose (128, ... ) == 0x0 01572 2020 NtUnmapViewOfSection (-1, 0xbf0000, ... ) == 0x0 01573 2020 NtQueryAttributesFile ({24, 0, 0x40, 0, 0, ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\faultrep.dll"}, 1236728, ... ) }, 1236728, ... ) == 0x0 01574 2020 NtOpenFile (0x100020, {24, 0, 0x40, 0, 0, (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\faultrep.dll"}, 5, 96, ... 128, {status=0x0, info=1}, ) }, 5, 96, ... 128, {status=0x0, info=1}, ) == 0x0 01575 2020 NtCreateSection (0xf, 0x0, 0x0, 16, 16777216, 128, ... 132, ) == 0x0 01576 2020 NtQuerySection (132, Image, 48, ... {section info, class 1, size 48}, 0x0, ) == 0x0 01577 2020 NtClose (128, ... ) == 0x0 01578 2020 NtMapViewOfSection (132, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x69450000), 0x0, 90112, ) == 0x0 01579 2020 NtClose (132, ... ) == 0x0 01580 2020 NtOpenSection (0xe, {24, 8, 0x40, 0, 0, (0xe, {24, 8, 0x40, 0, 0, "USERENV.dll"}, ... 132, ) }, ... 132, ) == 0x0 01581 2020 NtMapViewOfSection (132, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x769c0000), 0x0, 733184, ) == 0x0 01582 2020 NtClose (132, ... ) == 0x0 01583 2020 NtProtectVirtualMemory (-1, (0x769c1000), 1244, 4, ... (0x769c1000), 4096, 32, ) == 0x0 01584 2020 NtProtectVirtualMemory (-1, (0x769c1000), 4096, 32, ... (0x769c1000), 4096, 4, ) == 0x0 01585 2020 NtFlushInstructionCache (-1, 1989939200, 1244, ... ) == 0x0 01586 2020 NtProtectVirtualMemory (-1, (0x769c1000), 1244, 4, ... (0x769c1000), 4096, 32, ) == 0x0 01587 2020 NtProtectVirtualMemory (-1, (0x769c1000), 4096, 32, ... (0x769c1000), 4096, 4, ) == 0x0 01588 2020 NtFlushInstructionCache (-1, 1989939200, 1244, ... ) == 0x0 01589 2020 NtProtectVirtualMemory (-1, (0x769c1000), 1244, 4, ... (0x769c1000), 4096, 32, ) == 0x0 01590 2020 NtProtectVirtualMemory (-1, (0x769c1000), 4096, 32, ... (0x769c1000), 4096, 4, ) == 0x0 01591 2020 NtFlushInstructionCache (-1, 1989939200, 1244, ... ) == 0x0 01592 2020 NtProtectVirtualMemory (-1, (0x769c1000), 1244, 4, ... (0x769c1000), 4096, 32, ) == 0x0 01593 2020 NtProtectVirtualMemory (-1, (0x769c1000), 4096, 32, ... (0x769c1000), 4096, 4, ) == 0x0 01594 2020 NtFlushInstructionCache (-1, 1989939200, 1244, ... ) == 0x0 01595 2020 NtOpenSection (0xe, {24, 8, 0x40, 0, 0, (0xe, {24, 8, 0x40, 0, 0, "WINSTA.dll"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 01596 2020 NtQueryAttributesFile ({24, 0, 0x40, 0, 0, ({24, 0, 0x40, 0, 0, "\??\u:\work\WINSTA.dll"}, 1235904, ... ) }, 1235904, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 01597 2020 NtQueryAttributesFile ({24, 0, 0x40, 0, 0, ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\WINSTA.dll"}, 1235904, ... ) }, 1235904, ... ) == 0x0 01598 2020 NtOpenFile (0x100020, {24, 0, 0x40, 0, 0, (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\WINSTA.dll"}, 5, 96, ... 132, {status=0x0, info=1}, ) }, 5, 96, ... 132, {status=0x0, info=1}, ) == 0x0 01599 2020 NtCreateSection (0xf, 0x0, 0x0, 16, 16777216, 132, ... 128, ) == 0x0 01600 2020 NtQuerySection (128, Image, 48, ... {section info, class 1, size 48}, 0x0, ) == 0x0 01601 2020 NtClose (132, ... ) == 0x0 01602 2020 NtMapViewOfSection (128, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x76360000), 0x0, 65536, ) == 0x0 01603 2020 NtClose (128, ... ) == 0x0 01604 2020 NtProtectVirtualMemory (-1, (0x76361000), 212, 4, ... (0x76361000), 4096, 32, ) == 0x0 01605 2020 NtProtectVirtualMemory (-1, (0x76361000), 4096, 32, ... (0x76361000), 4096, 4, ) == 0x0 01606 2020 NtFlushInstructionCache (-1, 1983254528, 212, ... ) == 0x0 01607 2020 NtProtectVirtualMemory (-1, (0x76361000), 212, 4, ... (0x76361000), 4096, 32, ) == 0x0 01608 2020 NtProtectVirtualMemory (-1, (0x76361000), 4096, 32, ... (0x76361000), 4096, 4, ) == 0x0 01609 2020 NtFlushInstructionCache (-1, 1983254528, 212, ... ) == 0x0 01610 2020 NtOpenSection (0xe, {24, 8, 0x40, 0, 0, (0xe, {24, 8, 0x40, 0, 0, "NETAPI32.dll"}, ... 128, ) }, ... 128, ) == 0x0 01611 2020 NtMapViewOfSection (128, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x5b860000), 0x0, 344064, ) == 0x0 01612 2020 NtClose (128, ... ) == 0x0 01613 2020 NtProtectVirtualMemory (-1, (0x5b861000), 1168, 4, ... (0x5b861000), 4096, 32, ) == 0x0 01614 2020 NtProtectVirtualMemory (-1, (0x5b861000), 4096, 32, ... (0x5b861000), 4096, 4, ) == 0x0 01615 2020 NtFlushInstructionCache (-1, 1535512576, 1168, ... ) == 0x0 01616 2020 NtProtectVirtualMemory (-1, (0x5b861000), 1168, 4, ... (0x5b861000), 4096, 32, ) == 0x0 01617 2020 NtProtectVirtualMemory (-1, (0x5b861000), 4096, 32, ... (0x5b861000), 4096, 4, ) == 0x0 01618 2020 NtFlushInstructionCache (-1, 1535512576, 1168, ... ) == 0x0 01619 2020 NtProtectVirtualMemory (-1, (0x5b861000), 1168, 4, ... (0x5b861000), 4096, 32, ) == 0x0 01620 2020 NtProtectVirtualMemory (-1, (0x5b861000), 4096, 32, ... (0x5b861000), 4096, 4, ) == 0x0 01621 2020 NtFlushInstructionCache (-1, 1535512576, 1168, ... ) == 0x0 01622 2020 NtProtectVirtualMemory (-1, (0x5b861000), 1168, 4, ... (0x5b861000), 4096, 32, ) == 0x0 01623 2020 NtProtectVirtualMemory (-1, (0x5b861000), 4096, 32, ... (0x5b861000), 4096, 4, ) == 0x0 01624 2020 NtFlushInstructionCache (-1, 1535512576, 1168, ... ) == 0x0 01625 2020 NtProtectVirtualMemory (-1, (0x5b861000), 1168, 4, ... (0x5b861000), 4096, 32, ) == 0x0 01626 2020 NtProtectVirtualMemory (-1, (0x5b861000), 4096, 32, ... (0x5b861000), 4096, 4, ) == 0x0 01627 2020 NtFlushInstructionCache (-1, 1535512576, 1168, ... ) == 0x0 01628 2020 NtProtectVirtualMemory (-1, (0x76361000), 212, 4, ... (0x76361000), 4096, 32, ) == 0x0 01629 2020 NtProtectVirtualMemory (-1, (0x76361000), 4096, 32, ... (0x76361000), 4096, 4, ) == 0x0 01630 2020 NtFlushInstructionCache (-1, 1983254528, 212, ... ) == 0x0 01631 2020 NtProtectVirtualMemory (-1, (0x76361000), 212, 4, ... (0x76361000), 4096, 32, ) == 0x0 01632 2020 NtProtectVirtualMemory (-1, (0x76361000), 4096, 32, ... (0x76361000), 4096, 4, ) == 0x0 01633 2020 NtFlushInstructionCache (-1, 1983254528, 212, ... ) == 0x0 01634 2020 NtOpenSection (0xe, {24, 8, 0x40, 0, 0, (0xe, {24, 8, 0x40, 0, 0, "WTSAPI32.dll"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 01635 2020 NtQueryAttributesFile ({24, 0, 0x40, 0, 0, ({24, 0, 0x40, 0, 0, "\??\u:\work\WTSAPI32.dll"}, 1235904, ... ) }, 1235904, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 01636 2020 NtQueryAttributesFile ({24, 0, 0x40, 0, 0, ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\WTSAPI32.dll"}, 1235904, ... ) }, 1235904, ... ) == 0x0 01637 2020 NtOpenFile (0x100020, {24, 0, 0x40, 0, 0, (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\WTSAPI32.dll"}, 5, 96, ... 128, {status=0x0, info=1}, ) }, 5, 96, ... 128, {status=0x0, info=1}, ) == 0x0 01638 2020 NtCreateSection (0xf, 0x0, 0x0, 16, 16777216, 128, ... 132, ) == 0x0 01639 2020 NtQuerySection (132, Image, 48, ... {section info, class 1, size 48}, 0x0, ) == 0x0 01640 2020 NtClose (128, ... ) == 0x0 01641 2020 NtMapViewOfSection (132, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x76f50000), 0x0, 32768, ) == 0x0 01642 2020 NtClose (132, ... ) == 0x0 01643 2020 NtProtectVirtualMemory (-1, (0x76f51000), 332, 4, ... (0x76f51000), 4096, 32, ) == 0x0 01644 2020 NtProtectVirtualMemory (-1, (0x76f51000), 4096, 32, ... (0x76f51000), 4096, 4, ) == 0x0 01645 2020 NtFlushInstructionCache (-1, 1995771904, 332, ... ) == 0x0 01646 2020 NtProtectVirtualMemory (-1, (0x76f51000), 332, 4, ... (0x76f51000), 4096, 32, ) == 0x0 01647 2020 NtProtectVirtualMemory (-1, (0x76f51000), 4096, 32, ... (0x76f51000), 4096, 4, ) == 0x0 01648 2020 NtFlushInstructionCache (-1, 1995771904, 332, ... ) == 0x0 01649 2020 NtProtectVirtualMemory (-1, (0x76f51000), 332, 4, ... (0x76f51000), 4096, 32, ) == 0x0 01650 2020 NtProtectVirtualMemory (-1, (0x76f51000), 4096, 32, ... (0x76f51000), 4096, 4, ) == 0x0 01651 2020 NtFlushInstructionCache (-1, 1995771904, 332, ... ) == 0x0 01652 2020 NtProtectVirtualMemory (-1, (0x76f51000), 332, 4, ... (0x76f51000), 4096, 32, ) == 0x0 01653 2020 NtProtectVirtualMemory (-1, (0x76f51000), 4096, 32, ... (0x76f51000), 4096, 4, ) == 0x0 01654 2020 NtFlushInstructionCache (-1, 1995771904, 332, ... ) == 0x0 01655 2020 NtOpenSection (0xe, {24, 8, 0x40, 0, 0, (0xe, {24, 8, 0x40, 0, 0, "SETUPAPI.dll"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 01656 2020 NtQueryAttributesFile ({24, 0, 0x40, 0, 0, ({24, 0, 0x40, 0, 0, "\??\u:\work\SETUPAPI.dll"}, 1235904, ... ) }, 1235904, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 01657 2020 NtQueryAttributesFile ({24, 0, 0x40, 0, 0, ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\SETUPAPI.dll"}, 1235904, ... ) }, 1235904, ... ) == 0x0 01658 2020 NtOpenFile (0x100020, {24, 0, 0x40, 0, 0, (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\SETUPAPI.dll"}, 5, 96, ... 132, {status=0x0, info=1}, ) }, 5, 96, ... 132, {status=0x0, info=1}, ) == 0x0 01659 2020 NtCreateSection (0xf, 0x0, 0x0, 16, 16777216, 132, ... 128, ) == 0x0 01660 2020 NtQuerySection (128, Image, 48, ... {section info, class 1, size 48}, 0x0, ) == 0x0 01661 2020 NtClose (132, ... ) == 0x0 01662 2020 NtMapViewOfSection (128, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x77920000), 0x0, 995328, ) == 0x0 01663 2020 NtClose (128, ... ) == 0x0 01664 2020 NtProtectVirtualMemory (-1, (0x77921000), 1368, 4, ... (0x77921000), 4096, 32, ) == 0x0 01665 2020 NtProtectVirtualMemory (-1, (0x77921000), 4096, 32, ... (0x77921000), 4096, 4, ) == 0x0 01666 2020 NtFlushInstructionCache (-1, 2006061056, 1368, ... ) == 0x0 01667 2020 NtProtectVirtualMemory (-1, (0x77921000), 1368, 4, ... (0x77921000), 4096, 32, ) == 0x0 01668 2020 NtProtectVirtualMemory (-1, (0x77921000), 4096, 32, ... (0x77921000), 4096, 4, ) == 0x0 01669 2020 NtFlushInstructionCache (-1, 2006061056, 1368, ... ) == 0x0 01670 2020 NtProtectVirtualMemory (-1, (0x77921000), 1368, 4, ... (0x77921000), 4096, 32, ) == 0x0 01671 2020 NtProtectVirtualMemory (-1, (0x77921000), 4096, 32, ... (0x77921000), 4096, 4, ) == 0x0 01672 2020 NtFlushInstructionCache (-1, 2006061056, 1368, ... ) == 0x0 01673 2020 NtProtectVirtualMemory (-1, (0x77921000), 1368, 4, ... (0x77921000), 4096, 32, ) == 0x0 01674 2020 NtProtectVirtualMemory (-1, (0x77921000), 4096, 32, ... (0x77921000), 4096, 4, ) == 0x0 01675 2020 NtFlushInstructionCache (-1, 2006061056, 1368, ... ) == 0x0 01676 2020 NtProtectVirtualMemory (-1, (0x77921000), 1368, 4, ... (0x77921000), 4096, 32, ) == 0x0 01677 2020 NtProtectVirtualMemory (-1, (0x77921000), 4096, 32, ... (0x77921000), 4096, 4, ) == 0x0 01678 2020 NtFlushInstructionCache (-1, 2006061056, 1368, ... ) == 0x0 01679 2020 NtOpenSection (0xe, {24, 8, 0x40, 0, 0, (0xe, {24, 8, 0x40, 0, 0, "SHLWAPI.dll"}, ... 128, ) }, ... 128, ) == 0x0 01680 2020 NtMapViewOfSection (128, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x77f60000), 0x0, 483328, ) == 0x0 01681 2020 NtClose (128, ... ) == 0x0 01682 2020 NtProtectVirtualMemory (-1, (0x77f61000), 2076, 4, ... (0x77f61000), 4096, 32, ) == 0x0 01683 2020 NtProtectVirtualMemory (-1, (0x77f61000), 4096, 32, ... (0x77f61000), 4096, 4, ) == 0x0 01684 2020 NtFlushInstructionCache (-1, 2012614656, 2076, ... ) == 0x0 01685 2020 NtProtectVirtualMemory (-1, (0x77f61000), 2076, 4, ... (0x77f61000), 4096, 32, ) == 0x0 01686 2020 NtProtectVirtualMemory (-1, (0x77f61000), 4096, 32, ... (0x77f61000), 4096, 4, ) == 0x0 01687 2020 NtFlushInstructionCache (-1, 2012614656, 2076, ... ) == 0x0 01688 2020 NtProtectVirtualMemory (-1, (0x77f61000), 2076, 4, ... (0x77f61000), 4096, 32, ) == 0x0 01689 2020 NtProtectVirtualMemory (-1, (0x77f61000), 4096, 32, ... (0x77f61000), 4096, 4, ) == 0x0 01690 2020 NtFlushInstructionCache (-1, 2012614656, 2076, ... ) == 0x0 01691 2020 NtProtectVirtualMemory (-1, (0x77f61000), 2076, 4, ... (0x77f61000), 4096, 32, ) == 0x0 01692 2020 NtProtectVirtualMemory (-1, (0x77f61000), 4096, 32, ... (0x77f61000), 4096, 4, ) == 0x0 01693 2020 NtFlushInstructionCache (-1, 2012614656, 2076, ... ) == 0x0 01694 2020 NtProtectVirtualMemory (-1, (0x77f61000), 2076, 4, ... (0x77f61000), 4096, 32, ) == 0x0 01695 2020 NtProtectVirtualMemory (-1, (0x77f61000), 4096, 32, ... (0x77f61000), 4096, 4, ) == 0x0 01696 2020 NtFlushInstructionCache (-1, 2012614656, 2076, ... ) == 0x0 01697 2020 NtProtectVirtualMemory (-1, (0x69451000), 736, 4, ... (0x69451000), 4096, 32, ) == 0x0 01698 2020 NtProtectVirtualMemory (-1, (0x69451000), 4096, 32, ... (0x69451000), 4096, 4, ) == 0x0 01699 2020 NtFlushInstructionCache (-1, 1766133760, 736, ... ) == 0x0 01700 2020 NtProtectVirtualMemory (-1, (0x69451000), 736, 4, ... (0x69451000), 4096, 32, ) == 0x0 01701 2020 NtProtectVirtualMemory (-1, (0x69451000), 4096, 32, ... (0x69451000), 4096, 4, ) == 0x0 01702 2020 NtFlushInstructionCache (-1, 1766133760, 736, ... ) == 0x0 01703 2020 NtProtectVirtualMemory (-1, (0x69451000), 736, 4, ... (0x69451000), 4096, 32, ) == 0x0 01704 2020 NtProtectVirtualMemory (-1, (0x69451000), 4096, 32, ... (0x69451000), 4096, 4, ) == 0x0 01705 2020 NtFlushInstructionCache (-1, 1766133760, 736, ... ) == 0x0 01706 2020 NtOpenKey (0x80000000, {24, 0, 0x40, 0, 0, (0x80000000, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\USERENV.dll"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 01707 2020 NtOpenKey (0x2000000, {24, 16, 0x40, 0, 0, (0x2000000, {24, 16, 0x40, 0, 0, "Software\Microsoft\Windows NT\CurrentVersion\winlogon"}, ... 128, ) }, ... 128, ) == 0x0 01708 2020 NtQueryValueKey (128, (128, "UserEnvDebugLevel", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 01709 2020 NtClose (128, ... ) == 0x0 01710 2020 NtOpenKey (0x2000000, {24, 16, 0x40, 0, 0, (0x2000000, {24, 16, 0x40, 0, 0, "Software\Microsoft\Windows NT\CurrentVersion\winlogon"}, ... 128, ) }, ... 128, ) == 0x0 01711 2020 NtQueryValueKey (128, (128, "ChkAccDebugLevel", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 01712 2020 NtClose (128, ... ) == 0x0 01713 2020 NtOpenKey (0x20019, {24, 16, 0x40, 0, 0, (0x20019, {24, 16, 0x40, 0, 0, "System\CurrentControlSet\Control\ProductOptions"}, ... 128, ) }, ... 128, ) == 0x0 01714 2020 NtQueryValueKey (128, (128, "ProductType", Partial, 144, ... TitleIdx=0, Type=1, Data="W\0i\0n\0N\0T\0\0\0"}, 24, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (128, "ProductType", Partial, 144, ... TitleIdx=0, Type=1, Data="W\0i\0n\0N\0T\0\0\0"}, 24, ) }, 24, ) == 0x0 01715 2020 NtClose (128, ... ) == 0x0 01716 2020 NtCreateEvent (0x1f0003, {24, 48, 0x80, 1234496, 0, (0x1f0003, {24, 48, 0x80, 1234496, 0, "Global\userenv: User Profile setup event"}, 0, 1, ... 128, ) }, 0, 1, ... 128, ) == STATUS_OBJECT_NAME_EXISTS 01717 2020 NtAllocateVirtualMemory (-1, 1224704, 0, 4096, 4096, 260, ... 1224704, 4096, ) == 0x0 01718 2020 NtQueryDefaultLocale (1, 1234248, ... ) == 0x0 01719 2020 NtQueryDefaultLocale (1, 1234248, ... ) == 0x0 01720 2020 NtQueryDefaultLocale (1, 1234248, ... ) == 0x0 01721 2020 NtQueryDefaultLocale (1, 1234248, ... ) == 0x0 01722 2020 NtQueryDefaultLocale (1, 1234248, ... ) == 0x0 01723 2020 NtQueryDefaultLocale (1, 1234248, ... ) == 0x0 01724 2020 NtQueryDefaultLocale (1, 1234248, ... ) == 0x0 01725 2020 NtQueryDefaultLocale (1, 1234248, ... ) == 0x0 01726 2020 NtQueryDefaultLocale (1, 1234248, ... ) == 0x0 01727 2020 NtQueryDefaultLocale (1, 1234248, ... ) == 0x0 01728 2020 NtQueryDefaultLocale (1, 1234248, ... ) == 0x0 01729 2020 NtQueryDefaultLocale (1, 1234248, ... ) == 0x0 01730 2020 NtQueryDefaultLocale (1, 1234248, ... ) == 0x0 01731 2020 NtQueryDefaultLocale (1, 1234248, ... ) == 0x0 01732 2020 NtQueryDefaultLocale (1, 1234248, ... ) == 0x0 01733 2020 NtQueryDefaultLocale (1, 1234248, ... ) == 0x0 01734 2020 NtQueryDefaultLocale (1, 1234248, ... ) == 0x0 01735 2020 NtQueryDefaultLocale (1, 1234248, ... ) == 0x0 01736 2020 NtQueryDefaultLocale (1, 1234248, ... ) == 0x0 01737 2020 NtQueryDefaultLocale (1, 1234248, ... ) == 0x0 01738 2020 NtQueryDefaultLocale (1, 1234248, ... ) == 0x0 01739 2020 NtQueryDefaultLocale (1, 1234248, ... ) == 0x0 01740 2020 NtQueryDefaultLocale (1, 1234248, ... ) == 0x0 01741 2020 NtQueryDefaultLocale (1, 1234248, ... ) == 0x0 01742 2020 NtQueryDefaultLocale (1, 1234248, ... ) == 0x0 01743 2020 NtQueryDefaultLocale (1, 1234248, ... ) == 0x0 01744 2020 NtOpenThreadTokenEx (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN 01745 2020 NtOpenProcessTokenEx (-1, 0x20008, 512, ... 132, ) == 0x0 01746 2020 NtQueryInformationToken (132, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0 01747 2020 NtClose (132, ... ) == 0x0 01748 2020 NtOpenKey (0x20019, {24, 0, 0x640, 0, 0, (0x20019, {24, 0, 0x640, 0, 0, "\REGISTRY\USER\S-1-5-21-1292428093-1383384898-725345543-1003"}, ... 132, ) }, ... 132, ) == 0x0 01749 2020 NtOpenKey (0x20019, {24, 132, 0x40, 0, 0, (0x20019, {24, 132, 0x40, 0, 0, "Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders"}, ... 136, ) }, ... 136, ) == 0x0 01750 2020 NtQueryValueKey (136, (136, "Personal", Partial, 144, ... TitleIdx=0, Type=2, Data="%\0U\0S\0E\0R\0P\0R\0O\0F\0I\0L\0E\0%\0\\0M\0y\0 \0D\0o\0c\0u\0m\0e\0n\0t\0s\0\0\0"}, 66, ) , Partial, 144, ... TitleIdx=0, Type=2, Data= (136, "Personal", Partial, 144, ... TitleIdx=0, Type=2, Data="%\0U\0S\0E\0R\0P\0R\0O\0F\0I\0L\0E\0%\0\\0M\0y\0 \0D\0o\0c\0u\0m\0e\0n\0t\0s\0\0\0"}, 66, ) }, 66, ) == 0x0 01751 2020 NtQueryDefaultLocale (1, 1234248, ... ) == 0x0 01752 2020 NtQueryValueKey (136, (136, "Local Settings", Partial, 144, ... TitleIdx=0, Type=2, Data="%\0U\0S\0E\0R\0P\0R\0O\0F\0I\0L\0E\0%\0\\0L\0o\0c\0a\0l\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\0\0"}, 70, ) , Partial, 144, ... TitleIdx=0, Type=2, Data= (136, "Local Settings", Partial, 144, ... TitleIdx=0, Type=2, Data="%\0U\0S\0E\0R\0P\0R\0O\0F\0I\0L\0E\0%\0\\0L\0o\0c\0a\0l\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\0\0"}, 70, ) }, 70, ) == 0x0 01753 2020 NtQueryDefaultLocale (1, 1234248, ... ) == 0x0 01754 2020 NtQueryDefaultLocale (1, 1234248, ... ) == 0x0 01755 2020 NtQueryDefaultLocale (1, 1234248, ... ) == 0x0 01756 2020 NtQueryDefaultLocale (1, 1234248, ... ) == 0x0 01757 2020 NtClose (136, ... ) == 0x0 01758 2020 NtClose (132, ... ) == 0x0 01759 2020 NtAllocateVirtualMemory (-1, 3297280, 0, 4096, 4096, 4, ... 3297280, 4096, ) == 0x0 01760 2020 NtOpenKey (0x2000000, {24, 16, 0x40, 0, 0, (0x2000000, {24, 16, 0x40, 0, 0, "Software\Microsoft\Windows NT\CurrentVersion\winlogon"}, ... 132, ) }, ... 132, ) == 0x0 01761 2020 NtQueryValueKey (132, (132, "RsopDebugLevel", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 01762 2020 NtClose (132, ... ) == 0x0 01763 2020 NtOpenKey (0x2000000, {24, 16, 0x40, 0, 0, (0x2000000, {24, 16, 0x40, 0, 0, "Software\Microsoft\Windows NT\CurrentVersion\winlogon"}, ... 132, ) }, ... 132, ) == 0x0 01764 2020 NtQueryValueKey (132, (132, "UserEnvDebugLevel", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 01765 2020 NtQueryValueKey (132, (132, "RsopLogging", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 01766 2020 NtClose (132, ... ) == 0x0 01767 2020 NtOpenKey (0x2000000, {24, 16, 0x40, 0, 0, (0x2000000, {24, 16, 0x40, 0, 0, "Software\Policies\Microsoft\Windows\System"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 01768 2020 NtOpenKey (0x2000000, {24, 16, 0x40, 0, 0, (0x2000000, {24, 16, 0x40, 0, 0, "Software\Microsoft\Windows NT\CurrentVersion\winlogon"}, ... 132, ) }, ... 132, ) == 0x0 01769 2020 NtQueryValueKey (132, (132, "UserEnvDebugLevel", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 01770 2020 NtClose (132, ... ) == 0x0 01771 2020 NtOpenKey (0x2000000, {24, 16, 0x40, 0, 0, (0x2000000, {24, 16, 0x40, 0, 0, "Software\Policies\Microsoft\Windows\System"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 01772 2020 NtOpenKey (0x80000000, {24, 0, 0x40, 0, 0, (0x80000000, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\NETAPI32.dll"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 01773 2020 NtOpenKey (0x80000000, {24, 0, 0x40, 0, 0, (0x80000000, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\WINSTA.dll"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 01774 2020 NtOpenKey (0x80000000, {24, 0, 0x40, 0, 0, (0x80000000, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\WTSAPI32.dll"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 01775 2020 NtQueryPerformanceCounter (... {1136304910, 16}, {3579545, 0}, ) == 0x0 01776 2020 NtOpenKey (0x80000000, {24, 0, 0x40, 0, 0, (0x80000000, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SETUPAPI.dll"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 01777 2020 NtQueryDefaultLocale (1, 1236624, ... ) == 0x0 01778 2020 NtQueryInformationProcess (-1, Wow64, 4, ... {process info, class 26, size 4}, 0x0, ) == 0x0 01779 2020 NtOpenKey (0x20019, {24, 16, 0x40, 0, 0, (0x20019, {24, 16, 0x40, 0, 0, "System\Setup"}, ... 132, ) }, ... 132, ) == 0x0 01780 2020 NtQueryValueKey (132, (132, "SystemSetupInProgress", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (132, "SystemSetupInProgress", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) }, 16, ) == 0x0 01781 2020 NtClose (132, ... ) == 0x0 01782 2020 NtUserGetProcessWindowStation (... ) == 0x1c 01783 2020 NtUserGetObjectInformation (28, 1, 1236220, 12, 1236232, ... ) == 0x1 01784 2020 NtOpenKey (0xf003f, {24, 16, 0x40, 0, 0, (0xf003f, {24, 16, 0x40, 0, 0, "SYSTEM\CurrentControlSet\Control\MiniNT"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 01785 2020 NtOpenKey (0x20019, {24, 16, 0x40, 0, 0, (0x20019, {24, 16, 0x40, 0, 0, "System\WPA\PnP"}, ... 132, ) }, ... 132, ) == 0x0 01786 2020 NtQueryValueKey (132, (132, "seed", Partial, 144, ... TitleIdx=0, Type=4, Data="\240d\351\211"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (132, "seed", Partial, 144, ... TitleIdx=0, Type=4, Data="\240d\351\211"}, 16, ) }, 16, ) == 0x0 01787 2020 NtClose (132, ... ) == 0x0 01788 2020 NtOpenKey (0x20019, {24, 16, 0x40, 0, 0, (0x20019, {24, 16, 0x40, 0, 0, "SYSTEM\Setup"}, ... 132, ) }, ... 132, ) == 0x0 01789 2020 NtQueryValueKey (132, (132, "OsLoaderPath", Partial, 144, ... TitleIdx=0, Type=1, Data="\\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (132, "OsLoaderPath", Partial, 144, ... TitleIdx=0, Type=1, Data="\\0\0\0"}, 16, ) }, 16, ) == 0x0 01790 2020 NtQueryValueKey (132, (132, "OsLoaderPath", Partial, 144, ... TitleIdx=0, Type=1, Data="\\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (132, "OsLoaderPath", Partial, 144, ... TitleIdx=0, Type=1, Data="\\0\0\0"}, 16, ) }, 16, ) == 0x0 01791 2020 NtClose (132, ... ) == 0x0 01792 2020 NtOpenKey (0x20019, {24, 16, 0x40, 0, 0, (0x20019, {24, 16, 0x40, 0, 0, "SYSTEM\Setup"}, ... 132, ) }, ... 132, ) == 0x0 01793 2020 NtQueryValueKey (132, (132, "SystemPartition", Partial, 144, ... TitleIdx=0, Type=1, Data="\\0D\0e\0v\0i\0c\0e\0\\0H\0a\0r\0d\0d\0i\0s\0k\0V\0o\0l\0u\0m\0e\01\0\0\0"}, 60, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (132, "SystemPartition", Partial, 144, ... TitleIdx=0, Type=1, Data="\\0D\0e\0v\0i\0c\0e\0\\0H\0a\0r\0d\0d\0i\0s\0k\0V\0o\0l\0u\0m\0e\01\0\0\0"}, 60, ) }, 60, ) == 0x0 01794 2020 NtQueryValueKey (132, (132, "SystemPartition", Partial, 144, ... TitleIdx=0, Type=1, Data="\\0D\0e\0v\0i\0c\0e\0\\0H\0a\0r\0d\0d\0i\0s\0k\0V\0o\0l\0u\0m\0e\01\0\0\0"}, 60, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (132, "SystemPartition", Partial, 144, ... TitleIdx=0, Type=1, Data="\\0D\0e\0v\0i\0c\0e\0\\0H\0a\0r\0d\0d\0i\0s\0k\0V\0o\0l\0u\0m\0e\01\0\0\0"}, 60, ) }, 60, ) == 0x0 01795 2020 NtClose (132, ... ) == 0x0 01796 2020 NtOpenKey (0x20019, {24, 16, 0x40, 0, 0, (0x20019, {24, 16, 0x40, 0, 0, "Software\Microsoft\Windows\CurrentVersion\Setup"}, ... 132, ) }, ... 132, ) == 0x0 01797 2020 NtQueryValueKey (132, (132, "SourcePath", Partial, 144, ... TitleIdx=0, Type=1, Data="D\0:\0\\0\0\0"}, 20, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (132, "SourcePath", Partial, 144, ... TitleIdx=0, Type=1, Data="D\0:\0\\0\0\0"}, 20, ) }, 20, ) == 0x0 01798 2020 NtQueryValueKey (132, (132, "SourcePath", Partial, 144, ... TitleIdx=0, Type=1, Data="D\0:\0\\0\0\0"}, 20, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (132, "SourcePath", Partial, 144, ... TitleIdx=0, Type=1, Data="D\0:\0\\0\0\0"}, 20, ) }, 20, ) == 0x0 01799 2020 NtClose (132, ... ) == 0x0 01800 2020 NtOpenKey (0x20019, {24, 16, 0x40, 0, 0, (0x20019, {24, 16, 0x40, 0, 0, "Software\Microsoft\Windows\CurrentVersion\Setup"}, ... 132, ) }, ... 132, ) == 0x0 01801 2020 NtQueryValueKey (132, (132, "ServicePackSourcePath", Partial, 144, ... TitleIdx=0, Type=1, Data="D\0:\0\\0\0\0"}, 20, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (132, "ServicePackSourcePath", Partial, 144, ... TitleIdx=0, Type=1, Data="D\0:\0\\0\0\0"}, 20, ) }, 20, ) == 0x0 01802 2020 NtQueryValueKey (132, (132, "ServicePackSourcePath", Partial, 144, ... TitleIdx=0, Type=1, Data="D\0:\0\\0\0\0"}, 20, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (132, "ServicePackSourcePath", Partial, 144, ... TitleIdx=0, Type=1, Data="D\0:\0\\0\0\0"}, 20, ) }, 20, ) == 0x0 01803 2020 NtClose (132, ... ) == 0x0 01804 2020 NtOpenKey (0x20019, {24, 16, 0x40, 0, 0, (0x20019, {24, 16, 0x40, 0, 0, "Software\Microsoft\Windows\CurrentVersion\Setup"}, ... 132, ) }, ... 132, ) == 0x0 01805 2020 NtQueryValueKey (132, (132, "ServicePackCachePath", Partial, 144, ... TitleIdx=0, Type=1, Data="c\0:\0\\0w\0i\0n\0d\0o\0w\0s\0\\0S\0e\0r\0v\0i\0c\0e\0P\0a\0c\0k\0F\0i\0l\0e\0s\0\\0S\0e\0r\0v\0i\0c\0e\0P\0a\0c\0k\0C\0a\0c\0h\0e\0\0\0"}, 102, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (132, "ServicePackCachePath", Partial, 144, ... TitleIdx=0, Type=1, Data="c\0:\0\\0w\0i\0n\0d\0o\0w\0s\0\\0S\0e\0r\0v\0i\0c\0e\0P\0a\0c\0k\0F\0i\0l\0e\0s\0\\0S\0e\0r\0v\0i\0c\0e\0P\0a\0c\0k\0C\0a\0c\0h\0e\0\0\0"}, 102, ) }, 102, ) == 0x0 01806 2020 NtQueryValueKey (132, (132, "ServicePackCachePath", Partial, 144, ... TitleIdx=0, Type=1, Data="c\0:\0\\0w\0i\0n\0d\0o\0w\0s\0\\0S\0e\0r\0v\0i\0c\0e\0P\0a\0c\0k\0F\0i\0l\0e\0s\0\\0S\0e\0r\0v\0i\0c\0e\0P\0a\0c\0k\0C\0a\0c\0h\0e\0\0\0"}, 102, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (132, "ServicePackCachePath", Partial, 144, ... TitleIdx=0, Type=1, Data="c\0:\0\\0w\0i\0n\0d\0o\0w\0s\0\\0S\0e\0r\0v\0i\0c\0e\0P\0a\0c\0k\0F\0i\0l\0e\0s\0\\0S\0e\0r\0v\0i\0c\0e\0P\0a\0c\0k\0C\0a\0c\0h\0e\0\0\0"}, 102, ) }, 102, ) == 0x0 01807 2020 NtClose (132, ... ) == 0x0 01808 2020 NtOpenKey (0x20019, {24, 16, 0x40, 0, 0, (0x20019, {24, 16, 0x40, 0, 0, "Software\Microsoft\Windows\CurrentVersion\Setup"}, ... 132, ) }, ... 132, ) == 0x0 01809 2020 NtQueryValueKey (132, (132, "DriverCachePath", Partial, 144, ... TitleIdx=0, Type=2, Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0D\0r\0i\0v\0e\0r\0 \0C\0a\0c\0h\0e\0\0\0"}, 64, ) , Partial, 144, ... TitleIdx=0, Type=2, Data= (132, "DriverCachePath", Partial, 144, ... TitleIdx=0, Type=2, Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0D\0r\0i\0v\0e\0r\0 \0C\0a\0c\0h\0e\0\0\0"}, 64, ) }, 64, ) == 0x0 01810 2020 NtQueryValueKey (132, (132, "DriverCachePath", Partial, 144, ... TitleIdx=0, Type=2, Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0D\0r\0i\0v\0e\0r\0 \0C\0a\0c\0h\0e\0\0\0"}, 64, ) , Partial, 144, ... TitleIdx=0, Type=2, Data= (132, "DriverCachePath", Partial, 144, ... TitleIdx=0, Type=2, Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0D\0r\0i\0v\0e\0r\0 \0C\0a\0c\0h\0e\0\0\0"}, 64, ) }, 64, ) == 0x0 01811 2020 NtClose (132, ... ) == 0x0 01812 2020 NtOpenKey (0x20019, {24, 16, 0x40, 0, 0, (0x20019, {24, 16, 0x40, 0, 0, "Software\Microsoft\Windows\CurrentVersion"}, ... 132, ) }, ... 132, ) == 0x0 01813 2020 NtQueryValueKey (132, (132, "DevicePath", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW 01814 2020 NtQueryValueKey (132, (132, "DevicePath", Partial, 346, ... TitleIdx=0, Type=2, Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0i\0n\0f\0;\0%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0d\0e\0l\0l\0\\0a\0a\0c\0;\0%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0d\0e\0l\0l\0\\0a\0a\0r\0i\0c\0h\0;\0%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0d\0e\0l\0l\0\\0c\0e\0r\0c\0s\0r\06\0;\0%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0d\0e\0l\0l\0\\0a\03\02\00\0r\0a\0i\0d\0;\0%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0d\0e\0l\0l\0\\0i\0a\0s\0t\0o\0r\0;\0%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0d\0e\0l\0l\0\\0n\0v\0r\0a\0i\0d\0\0\0"}, 346, ) , Partial, 346, ... TitleIdx=0, Type=2, Data= (132, "DevicePath", Partial, 346, ... TitleIdx=0, Type=2, Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0i\0n\0f\0;\0%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0d\0e\0l\0l\0\\0a\0a\0c\0;\0%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0d\0e\0l\0l\0\\0a\0a\0r\0i\0c\0h\0;\0%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0d\0e\0l\0l\0\\0c\0e\0r\0c\0s\0r\06\0;\0%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0d\0e\0l\0l\0\\0a\03\02\00\0r\0a\0i\0d\0;\0%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0d\0e\0l\0l\0\\0i\0a\0s\0t\0o\0r\0;\0%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0d\0e\0l\0l\0\\0n\0v\0r\0a\0i\0d\0\0\0"}, 346, ) }, 346, ) == 0x0 01815 2020 NtAllocateVirtualMemory (-1, 1380352, 0, 4096, 4096, 4, ... 1380352, 4096, ) == 0x0 01816 2020 NtClose (132, ... ) == 0x0 01817 2020 NtCreateEvent (0x1f0003, 0x0, 0, 0, ... 132, ) == 0x0 01818 2020 NtCreateMutant (0x1f0001, 0x0, 0, ... 136, ) == 0x0 01819 2020 NtCreateEvent (0x1f0003, 0x0, 0, 0, ... 140, ) == 0x0 01820 2020 NtCreateMutant (0x1f0001, 0x0, 0, ... 144, ) == 0x0 01821 2020 NtCreateEvent (0x1f0003, 0x0, 0, 0, ... 148, ) == 0x0 01822 2020 NtCreateMutant (0x1f0001, 0x0, 0, ... 152, ) == 0x0 01823 2020 NtOpenKey (0x1, {24, 16, 0x40, 0, 0, (0x1, {24, 16, 0x40, 0, 0, "Software\Microsoft\Windows\CurrentVersion\Setup"}, ... 156, ) }, ... 156, ) == 0x0 01824 2020 NtQueryValueKey (156, (156, "LogLevel", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (156, "LogLevel", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) }, 16, ) == 0x0 01825 2020 NtQueryValueKey (156, (156, "LogLevel", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (156, "LogLevel", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) }, 16, ) == 0x0 01826 2020 NtQueryValueKey (156, (156, "LogPath", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 01827 2020 NtOpenKey (0x1, {24, 156, 0x40, 0, 0, (0x1, {24, 156, 0x40, 0, 0, "AppLogLevels"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 01828 2020 NtClose (156, ... ) == 0x0 01829 2020 NtQueryAttributesFile ({24, 0, 0x40, 0, 0, ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\"}, 1236136, ... ) }, 1236136, ... ) == 0x0 01830 2020 NtOpenKey (0x20019, {24, 0, 0x40, 0, 0, (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\System\CurrentControlSet\Control\ComputerName\ActiveComputerName"}, ... 156, ) }, ... 156, ) == 0x0 01831 2020 NtQueryValueKey (156, (156, "ComputerName", Full, 128, ... TitleIdx=0, Type=1, Name="ComputerName", Data="V\0I\0R\0T\0U\0A\0L\0\0\0"}, 60, ) , Full, 128, ... TitleIdx=0, Type=1, Name= (156, "ComputerName", Full, 128, ... TitleIdx=0, Type=1, Name="ComputerName", Data="V\0I\0R\0T\0U\0A\0L\0\0\0"}, 60, ) , Data= (156, "ComputerName", Full, 128, ... TitleIdx=0, Type=1, Name="ComputerName", Data="V\0I\0R\0T\0U\0A\0L\0\0\0"}, 60, ) }, 60, ) == 0x0 01832 2020 NtClose (156, ... ) == 0x0 01833 2020 NtOpenKey (0x20019, {24, 0, 0x40, 0, 0, (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\System\CurrentControlSet\Services\Tcpip\Parameters"}, ... 156, ) }, ... 156, ) == 0x0 01834 2020 NtQueryValueKey (156, (156, "Hostname", Full, 128, ... TitleIdx=0, Type=1, Name="Hostname", Data="v\0i\0r\0t\0u\0a\0l\0\0\0"}, 52, ) , Full, 128, ... TitleIdx=0, Type=1, Name= (156, "Hostname", Full, 128, ... TitleIdx=0, Type=1, Name="Hostname", Data="v\0i\0r\0t\0u\0a\0l\0\0\0"}, 52, ) , Data= (156, "Hostname", Full, 128, ... TitleIdx=0, Type=1, Name="Hostname", Data="v\0i\0r\0t\0u\0a\0l\0\0\0"}, 52, ) }, 52, ) == 0x0 01835 2020 NtClose (156, ... ) == 0x0 01836 2020 NtOpenKey (0x20019, {24, 0, 0x40, 0, 0, (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Policies\Microsoft\System\DNSclient"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 01837 2020 NtOpenKey (0x20019, {24, 0, 0x40, 0, 0, (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\System\CurrentControlSet\Services\Tcpip\Parameters"}, ... 156, ) }, ... 156, ) == 0x0 01838 2020 NtQueryValueKey (156, (156, "Domain", Full, 128, ... TitleIdx=0, Type=1, Name="Domain", Data="\0\0"}, 34, ) , Full, 128, ... TitleIdx=0, Type=1, Name= (156, "Domain", Full, 128, ... TitleIdx=0, Type=1, Name="Domain", Data="\0\0"}, 34, ) , Data= (156, "Domain", Full, 128, ... TitleIdx=0, Type=1, Name="Domain", Data="\0\0"}, 34, ) }, 34, ) == 0x0 01839 2020 NtClose (156, ... ) == 0x0 01840 2020 NtOpenKey (0x80000000, {24, 0, 0x40, 0, 0, (0x80000000, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SHLWAPI.dll"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 01841 2020 NtOpenKey (0x2000000, {24, 16, 0x40, 0, 0, (0x2000000, {24, 16, 0x40, 0, 0, "Software\Microsoft\Windows\CurrentVersion\Explorer\Performance"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 01842 2020 NtCreateSemaphore (0x1f0003, {24, 48, 0x80, 1378072, 0, (0x1f0003, {24, 48, 0x80, 1378072, 0, "shell.{A48F1A32-A340-11D1-BC6B-00A0C90312E1}"}, 0, 2147483647, ... 156, ) }, 0, 2147483647, ... 156, ) == STATUS_OBJECT_NAME_EXISTS 01843 2020 NtOpenKey (0x80000000, {24, 0, 0x40, 0, 0, (0x80000000, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\faultrep.dll"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 01844 2020 NtOpenKey (0x20119, {24, 16, 0x40, 0, 0, (0x20119, {24, 16, 0x40, 0, 0, "Software\Policies\Microsoft\PCHealth\ErrorReporting"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 01845 2020 NtCreateKey (0x20119, {24, 16, 0x40, 0, 0, (0x20119, {24, 16, 0x40, 0, 0, "Software\Microsoft\PCHealth\ErrorReporting"}, 0, 0x0, 0, ... 160, 2, ) }, 0, 0x0, 0, ... 160, 2, ) == 0x0 01846 2020 NtOpenKey (0x10000, {24, 160, 0x40, 0, 0, (0x10000, {24, 160, 0x40, 0, 0, "DW"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 01847 2020 NtQueryValueKey (160, (160, "DoReport", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (160, "DoReport", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) }, 16, ) == 0x0 01848 2020 NtQueryValueKey (160, (160, "ShowUI", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (160, "ShowUI", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) }, 16, ) == 0x0 01849 2020 NtQueryValueKey (160, (160, "AllOrNone", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (160, "AllOrNone", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) }, 16, ) == 0x0 01850 2020 NtQueryValueKey (160, (160, "IncludeMicrosoftApps", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (160, "IncludeMicrosoftApps", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) }, 16, ) == 0x0 01851 2020 NtQueryValueKey (160, (160, "IncludeWindowsApps", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (160, "IncludeWindowsApps", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) }, 16, ) == 0x0 01852 2020 NtQueryValueKey (160, (160, "DoTextLog", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 01853 2020 NtQueryValueKey (160, (160, "IncludeKernelFaults", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (160, "IncludeKernelFaults", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) }, 16, ) == 0x0 01854 2020 NtQueryValueKey (160, (160, "IncludeShutdownErrs", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 01855 2020 NtQueryValueKey (160, (160, "NumberOfFaultPipes", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 01856 2020 NtQueryValueKey (160, (160, "NumberOfHangPipes", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 01857 2020 NtQueryValueKey (160, (160, "MaxUserQueueSize", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 01858 2020 NtQueryValueKey (160, (160, "ForceQueueMode", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 01859 2020 NtCreateKey (0x20119, {24, 160, 0x40, 0, 0, (0x20119, {24, 160, 0x40, 0, 0, "ExclusionList"}, 0, 0x0, 0, ... 164, 2, ) }, 0, 0x0, 0, ... 164, 2, ) == 0x0 01860 2020 NtCreateKey (0x20119, {24, 160, 0x40, 0, 0, (0x20119, {24, 160, 0x40, 0, 0, "InclusionList"}, 0, 0x0, 0, ... 168, 2, ) }, 0, 0x0, 0, ... 168, 2, ) == 0x0 01861 2020 NtClose (160, ... ) == 0x0 01862 2020 NtOpenKey (0x20019, {24, 16, 0x40, 0, 0, (0x20019, {24, 16, 0x40, 0, 0, "System\Setup"}, ... 160, ) }, ... 160, ) == 0x0 01863 2020 NtQueryValueKey (160, (160, "SystemSetupInProgress", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (160, "SystemSetupInProgress", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) }, 16, ) == 0x0 01864 2020 NtClose (160, ... ) == 0x0 01865 2020 NtQueryInformationProcess (-1, DefaultHardErrorMode, 4, ... {process info, class 12, size 4}, 0x0, ) == 0x0 01866 2020 NtSetInformationProcess (-1, DefaultHardErrorMode, {process info, class 12, size 4}, 4, ... ) == 0x0 01867 2020 NtQueryAttributesFile ({24, 0, 0x40, 0, 0, ({24, 0, 0x40, 0, 0, "\??\u:\work\packed.exe"}, 1233664, ... ) }, 1233664, ... ) == 0x0 01868 2020 NtOpenFile (0x100001, {24, 0, 0x40, 0, 0, (0x100001, {24, 0, 0x40, 0, 0, "\??\u:\"}, 3, 16417, ... 160, {status=0x0, info=1}, ) }, 3, 16417, ... 160, {status=0x0, info=1}, ) == 0x0 01869 2020 NtQueryDirectoryFile (160, 0, 0, 0, 1233092, 616, BothDirectory, 1, (160, 0, 0, 0, 1233092, 616, BothDirectory, 1, "work", 0, ... {status=0x0, info=108}, ) , 0, ... {status=0x0, info=108}, ) == 0x0 01870 2020 NtClose (160, ... ) == 0x0 01871 2020 NtOpenFile (0x100001, {24, 0, 0x40, 0, 0, (0x100001, {24, 0, 0x40, 0, 0, "\??\u:\work\"}, 3, 16417, ... 160, {status=0x0, info=1}, ) }, 3, 16417, ... 160, {status=0x0, info=1}, ) == 0x0 01872 2020 NtQueryDirectoryFile (160, 0, 0, 0, 1233092, 616, BothDirectory, 1, (160, 0, 0, 0, 1233092, 616, BothDirectory, 1, "packed.exe", 0, ... {status=0x0, info=116}, ) , 0, ... {status=0x0, info=116}, ) == 0x0 01873 2020 NtClose (160, ... ) == 0x0 01874 2020 NtQueryInformationProcess (-1, DefaultHardErrorMode, 4, ... {process info, class 12, size 4}, 0x0, ) == 0x0 01875 2020 NtSetInformationProcess (-1, DefaultHardErrorMode, {process info, class 12, size 4}, 4, ... ) == 0x0 01876 2020 NtQueryInformationProcess (-1, DefaultHardErrorMode, 4, ... {process info, class 12, size 4}, 0x0, ) == 0x0 01877 2020 NtSetInformationProcess (-1, DefaultHardErrorMode, {process info, class 12, size 4}, 4, ... ) == 0x0 01878 2020 NtQueryAttributesFile ({24, 0, 0x40, 0, 0, ({24, 0, 0x40, 0, 0, "\??\u:\work\packed.exe"}, 1232312, ... ) }, 1232312, ... ) == 0x0 01879 2020 NtQueryAttributesFile ({24, 0, 0x40, 0, 0, ({24, 0, 0x40, 0, 0, "\??\u:\work\packed.exe"}, 1231084, ... ) }, 1231084, ... ) == 0x0 01880 2020 NtQueryInformationProcess (-1, DefaultHardErrorMode, 4, ... {process info, class 12, size 4}, 0x0, ) == 0x0 01881 2020 NtSetInformationProcess (-1, DefaultHardErrorMode, {process info, class 12, size 4}, 4, ... ) == 0x0 01882 2020 NtQueryValueKey (164, (164, "packed.exe", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 01883 2020 NtOpenThreadToken (-2, 0x2000c, 1, ... ) == STATUS_NO_TOKEN 01884 2020 NtSetInformationThread (-2, ImpersonationToken, {ImpToken=0,}, 4, ... ) == 0x0 01885 2020 NtQuerySystemInformation (Basic, 44, ... {Unknown=0,MaximumIncrement=156250,PhysicalPageSize=0x1000,NumberOfPhysicalPages=0xff7c,LowestPhysicalPage=0x1,HighestPhysicalPage=0xffff,AllocationGranularity=0x10000,LowestUserAddress=0x10000,HighestUserAddress=0x7ffeffff,ActiveProcessors=1,NumberProcessors=1,}, 0x0, ) == 0x0 01886 2020 NtOpenKey (0x20019, {24, 16, 0x40, 0, 0, (0x20019, {24, 16, 0x40, 0, 0, "Software\Microsoft\Rpc\PagedBuffers"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 01887 2020 NtOpenKey (0x20019, {24, 16, 0x40, 0, 0, (0x20019, {24, 16, 0x40, 0, 0, "Software\Microsoft\Rpc"}, ... 160, ) }, ... 160, ) == 0x0 01888 2020 NtQueryValueKey (160, (160, "MaxRpcSize", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 01889 2020 NtClose (160, ... ) == 0x0 01890 2020 NtOpenKey (0x20019, {24, 16, 0x40, 0, 0, (0x20019, {24, 16, 0x40, 0, 0, "Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\packed.exe\RpcThreadPoolThrottle"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 01891 2020 NtCreateEvent (0x1f0003, 0x0, 1, 0, ... 160, ) == 0x0 01892 2020 NtCreateEvent (0x1f0003, 0x0, 1, 0, ... 172, ) == 0x0 01893 2020 NtQuerySystemTime (... {-8164258, 29921847}, ) == 0x0 01894 2020 NtCreateEvent (0x1f0003, 0x0, 0, 0, ... 176, ) == 0x0 01895 2020 NtOpenKey (0x20019, {24, 16, 0x40, 0, 0, (0x20019, {24, 16, 0x40, 0, 0, "Software\Policies\Microsoft\Windows NT\Rpc"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 01896 2020 NtQuerySystemInformation (Performance, 312, ... {system info, class 2, size 312}, 0x0, ) == 0x0 01897 2020 NtQueryInformationProcess (-1, QuotaLimits, 32, ... {process info, class 1, size 32}, 0x0, ) == 0x0 01898 2020 NtQueryInformationProcess (-1, VmCounters, 44, ... {process info, class 3, size 44}, 0x0, ) == 0x0 01899 2020 NtCreateEvent (0x1f0003, 0x0, 0, 0, ... 180, ) == 0x0 01900 2020 NtDuplicateObject (-1, -2, -1, 0x0, 0, 2, ... 184, ) == 0x0 01901 2020 NtAllocateVirtualMemory (-1, 1384448, 0, 4096, 4096, 4, ... 1384448, 4096, ) == 0x0 01902 2020 NtDeviceIoControlFile (44, 0, 0x0, 0x0, 0x390008, (44, 0, 0x0, 0x0, 0x390008, ")\355\330\240\0\226s\377\214\216H\331\202\250z\332\263\177`\204*]@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0", 256, 256, ... , 256, 256, ... 01903 2020 NtQuerySystemInformation (TimeOfDay, 48, ... {system info, class 3, size 48}, 48, ) == 0x0 01904 2020 NtQuerySystemInformation (ProcessorTimes, 48, ... {system info, class 8, size 48}, 48, ) == 0x0 01905 2020 NtQuerySystemInformation (Performance, 312, ... {system info, class 2, size 312}, 312, ) == 0x0 01906 2020 NtQuerySystemInformation (Exception, 16, ... {system info, class 33, size 16}, 16, ) == 0x0 01907 2020 NtQuerySystemInformation (Lookaside, 32, ... {system info, class 45, size 32}, 32, ) == 0x0 01908 2020 NtQuerySystemInformation (ProcessorStatistics, 3016, ... {system info, class 23, size 0}, 0, ) == 0x0 01909 2020 NtQuerySystemInformation (ProcessesAndThreads, 3008, ... ) == STATUS_INFO_LENGTH_MISMATCH 01910 2020 NtCreateKey (0x2, {24, 0, 0x240, 0, 0, (0x2, {24, 0, 0x240, 0, 0, "\Registry\Machine\SOFTWARE\Microsoft\Cryptography\RNG"}, 0, 0x0, 0, ... -2147482576, 2, ) }, 0, 0x0, 0, ... -2147482576, 2, ) == 0x0 01911 2020 NtSetValueKey (-2147482576, (-2147482576, "Seed", 0, 3, "\24b }5p;\352\202B\377\326CD\337\317\320G\334lk\226}\346A\307\371\256\376&D\15\3\334S:&\24^w\2012\222\264\261\206\0\14\6z\242\273\2549\1\321\35Y\23\250\311\374D\15\36\302K_o\326ny\235\226\212\247\301\276aT", 80, ... ) , 0, 3, (-2147482576, "Seed", 0, 3, "\24b }5p;\352\202B\377\326CD\337\317\320G\334lk\226}\346A\307\371\256\376&D\15\3\334S:&\24^w\2012\222\264\261\206\0\14\6z\242\273\2549\1\321\35Y\23\250\311\374D\15\36\302K_o\326ny\235\226\212\247\301\276aT", 80, ... ) , 80, ... ) == 0x0 01912 2020 NtClose (-2147482576, ... ) == 0x0 01902 2020 NtDeviceIoControlFile ... {status=0x0, info=256}, ... {status=0x0, info=256}, "\17@q'.\312\207l\267\253\262\23\337\340E\312\321\320\205}\352\277\37\337\350+\303\374\30\240\363\255B<\6\12\314\234\334\307v0\360\350\303\336)\244\311\316\346\2\233r\365\357B\304>\373\17O\5\6\352\222\304\203\217\26\335\310@\336\263\216oz,\356\357\3039VM\20\3\324e"\22`\265F\351\34\265\355\367DKF_\364\212\342\205AL\266\313\271\274\27\332q\16\350u\305\276 [\203\30\26\265\266]\221F1\2\11\7e\312\266\232\206\332\11X\251\270.\204F\232=\343\231\340\371v\335g\240\350+R\317\1R\377\272\341p\342\244\314\356\236IG\215y\350-B>\306\363B\242\16\340Q\276h\245-\316\265\2\32\342V+\241\316\203%e\234\3717elw\305\16\2\337R\307\26\22\10\244\35&wxM&\237o\276\346\304T'\2215\203\10\230\212\231\345\36|\36\15\241@\306$Y\231\224\266w\360\267", ) \22`\265F\351\34\265\355\367DKF_\364\212\342\205AL\266\313\271\274\27\332q\16\350u\305\276 [\203\30\26\265\266]\221F1\2\11\7e\312\266\232\206\332\11X\251\270.\204F\232=\343\231\340\371v\335g\240\350+R\317\1R\377\272\341p\342\244\314\356\236IG\215y\350-B>\306\363B\242\16\340Q\276h\245-\316\265\2\32\342V+\241\316\203%e\234\3717elw\305\16\2\337R\307\26\22\10\244\35&wxM&\237o\276\346\304T'\2215\203\10\230\212\231\345\36|\36\15\241@\306$Y\231\224\266w\360\267", ) == 0x0 01913 2020 NtDeviceIoControlFile (44, 0, 0x0, 0x0, 0x390008, (44, 0, 0x0, 0x0, 0x390008, ")\355\330\240\0\226s\377\214\216H\331\202\250\302\305t\366\235\354Zqr\263\177`\204*]@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0", 256, 256, ... , 256, 256, ... 01914 2020 NtQuerySystemInformation (TimeOfDay, 48, ... {system info, class 3, size 48}, 48, ) == 0x0 01915 2020 NtQuerySystemInformation (ProcessorTimes, 48, ... {system info, class 8, size 48}, 48, ) == 0x0 01916 2020 NtQuerySystemInformation (Performance, 312, ... {system info, class 2, size 312}, 312, ) == 0x0 01917 2020 NtQuerySystemInformation (Exception, 16, ... {system info, class 33, size 16}, 16, ) == 0x0 01918 2020 NtQuerySystemInformation (Lookaside, 32, ... {system info, class 45, size 32}, 32, ) == 0x0 01919 2020 NtQuerySystemInformation (ProcessorStatistics, 3016, ... {system info, class 23, size 0}, 0, ) == 0x0 01920 2020 NtQuerySystemInformation (ProcessesAndThreads, 3008, ... ) == STATUS_INFO_LENGTH_MISMATCH 01921 2020 NtCreateKey (0x2, {24, 0, 0x240, 0, 0, (0x2, {24, 0, 0x240, 0, 0, "\Registry\Machine\SOFTWARE\Microsoft\Cryptography\RNG"}, 0, 0x0, 0, ... -2147482576, 2, ) }, 0, 0x0, 0, ... -2147482576, 2, ) == 0x0 01922 2020 NtSetValueKey (-2147482576, (-2147482576, "Seed", 0, 3, "\350\206\25\362E\20\327\327x\203\274xb\306n\7\267Hp\374\222W\352\274\2772]d\371\361\354";\0\213jw\201&\260'\266\23<\340\254\327\224s\324E\21\316\370Z,u\362\227Up\320{\267\254\235\241\4\332\337W[\226x\206\337\31\367\215", 80, ... ) , 0, 3, (-2147482576, "Seed", 0, 3, "\350\206\25\362E\20\327\327x\203\274xb\306n\7\267Hp\374\222W\352\274\2772]d\371\361\354";\0\213jw\201&\260'\266\23<\340\254\327\224s\324E\21\316\370Z,u\362\227Up\320{\267\254\235\241\4\332\337W[\226x\206\337\31\367\215", 80, ... ) ;\0\213jw\201&\260'\266\23<\340\254\327\224s\324E\21\316\370Z,u\362\227Up\320{\267\254\235\241\4\332\337W[\226x\206\337\31\367\215", 80, ... ) == 0x0 01923 2020 NtClose (-2147482576, ... ) == 0x0 01913 2020 NtDeviceIoControlFile ... {status=0x0, info=256}, ... {status=0x0, info=256}, "o\345\301Q\210H\326z\303{r\375\1\221\255\263\356\21\226A\272\140\272\323E\37\243\335\336\231RV$\202\3c\316\366\363~\240\1776\320\33w\337\337\274f\247\206\375V\12Gp\325\22\7<\3166\17\27-\7`5\236\3174LS\335\314\337#K\227\360\372y\37\313\357h\3205\213r\221\2131\340.\251\200w\34#C\316\322$\270\14\207\227\275"\376K\3\345\14\271\236\10o38jw\276\313ts\264\334\251h\375\323\335|d\254\273\310\347\32\24?S\272?M\315V\343\211\325\10\370\3559\13R\321\363\317\274\340H\37K\211\0\205\262\271\220\304\327\301\7}\315\221rZu\251\3755\215\310\1~9a\12;\2\221\12\2\276\324\321\20\263\330\320\25\344\31\375\245J\11\305W\330\35\254\345\221\313W$\353i\221\252\2548<\321\335\216S\265\331\3\364\216\31\374jDD\355\214"\20\377\326;\347$B6\3", ) \376K\3\345\14\271\236\10o38jw\276\313ts\264\334\251h\375\323\335|d\254\273\310\347\32\24?S\272?M\315V\343\211\325\10\370\3559\13R\321\363\317\274\340H\37K\211\0\205\262\271\220\304\327\301\7}\315\221rZu\251\3755\215\310\1~9a\12;\2\221\12\2\276\324\321\20\263\330\320\25\344\31\375\245J\11\305W\330\35\254\345\221\313W$\353i\221\252\2548<\321\335\216S\265\331\3\364\216\31\374jDD\355\214 ... {status=0x0, info=256}, "o\345\301Q\210H\326z\303{r\375\1\221\255\263\356\21\226A\272\140\272\323E\37\243\335\336\231RV$\202\3c\316\366\363~\240\1776\320\33w\337\337\274f\247\206\375V\12Gp\325\22\7<\3166\17\27-\7`5\236\3174LS\335\314\337#K\227\360\372y\37\313\357h\3205\213r\221\2131\340.\251\200w\34#C\316\322$\270\14\207\227\275"\376K\3\345\14\271\236\10o38jw\276\313ts\264\334\251h\375\323\335|d\254\273\310\347\32\24?S\272?M\315V\343\211\325\10\370\3559\13R\321\363\317\274\340H\37K\211\0\205\262\271\220\304\327\301\7}\315\221rZu\251\3755\215\310\1~9a\12;\2\221\12\2\276\324\321\20\263\330\320\25\344\31\375\245J\11\305W\330\35\254\345\221\313W$\353i\221\252\2548<\321\335\216S\265\331\3\364\216\31\374jDD\355\214"\20\377\326;\347$B6\3", ) , ) == 0x0 01924 2020 NtDeviceIoControlFile (44, 0, 0x0, 0x0, 0x390008, (44, 0, 0x0, 0x0, 0x390008, ")\355\330\240\0\226s\377\214\216H\331\202\250\302\305t\366\235\354Z\311mt\366\235\354Zqr\263\177`\204*]@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0", 256, 256, ... , 256, 256, ... 01925 2020 NtQuerySystemInformation (TimeOfDay, 48, ... {system info, class 3, size 48}, 48, ) == 0x0 01926 2020 NtQuerySystemInformation (ProcessorTimes, 48, ... {system info, class 8, size 48}, 48, ) == 0x0 01927 2020 NtQuerySystemInformation (Performance, 312, ... {system info, class 2, size 312}, 312, ) == 0x0 01928 2020 NtQuerySystemInformation (Exception, 16, ... {system info, class 33, size 16}, 16, ) == 0x0 01929 2020 NtQuerySystemInformation (Lookaside, 32, ... {system info, class 45, size 32}, 32, ) == 0x0 01930 2020 NtQuerySystemInformation (ProcessorStatistics, 3016, ... {system info, class 23, size 0}, 0, ) == 0x0 01931 2020 NtQuerySystemInformation (ProcessesAndThreads, 3008, ... ) == STATUS_INFO_LENGTH_MISMATCH 01932 2020 NtCreateKey (0x2, {24, 0, 0x240, 0, 0, (0x2, {24, 0, 0x240, 0, 0, "\Registry\Machine\SOFTWARE\Microsoft\Cryptography\RNG"}, 0, 0x0, 0, ... -2147482576, 2, ) }, 0, 0x0, 0, ... -2147482576, 2, ) == 0x0 01933 2020 NtSetValueKey (-2147482576, (-2147482576, "Seed", 0, 3, "\5\244\21E\332\330\267\331\247m&\216s\16\10\340y\366ov\261$\301\271\225A\244\335\307#\3070\346\7`\17\22`\31\20^\246\242U\214<\371~\240\202\236\252\336\252\201\356m5c\227\36\237\211+N\275t\23\14\354\345\320\305Q\271\7N\\323Y", 80, ... ) , 0, 3, (-2147482576, "Seed", 0, 3, "\5\244\21E\332\330\267\331\247m&\216s\16\10\340y\366ov\261$\301\271\225A\244\335\307#\3070\346\7`\17\22`\31\20^\246\242U\214<\371~\240\202\236\252\336\252\201\356m5c\227\36\237\211+N\275t\23\14\354\345\320\305Q\271\7N\\323Y", 80, ... ) , 80, ... ) == 0x0 01934 2020 NtClose (-2147482576, ... ) == 0x0 01924 2020 NtDeviceIoControlFile ... {status=0x0, info=256}, ... {status=0x0, info=256}, "-\314%\201\306\266\363u\312\357o\315C\363\12\317b\250s\336\370\264\314\215=B\342a\215\354\334v\355\351y\16\324@\310ELIKM\350\6\302\17\304Z\375\275x\252m#\11\262jF+wn>\274\204\32\262?\242\302\225\22\221d;A\177z\373\344hP\310 \251\230\252N\10\302[\3629\21Sw\371\335\352\326\350\316\237\2142\232\316\14\352R\214\236\344s\312\306P:\356n\260c\2)\354\35\325\226\36\322\312d\254\233(\362\247\217\17\224\261K\373\366\330\276\300\244\373\24\262\271\355qO#|\350\314m\345:\335g\332\225L\370=\224\377\311\337Rb\247\232-m+\343\207\205\205\350\333\256\202\275\353\231\270\22q\2\220\17\200\213\212\223\206\337=\312O\357\7\375c%\337\35[\316\7R\347\221\32@\243\177\264h2\213\243\32*5\226~k\375\335\265Sa\204\4)\376\220\221{\327\322\\211,\212\2333_", ) , ) == 0x0 01935 2020 NtDeviceIoControlFile (44, 0, 0x0, 0x0, 0x390008, (44, 0, 0x0, 0x0, 0x390008, ")\355\330\240\0\226s\377\214\216H\331\202\250\302\305t\366\235\354Z\311mt\366\235\354Z\311mt\366\235\354Zqr\263\177`\204*]@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0", 256, 256, ... , 256, 256, ... 01936 2020 NtQuerySystemInformation (TimeOfDay, 48, ... {system info, class 3, size 48}, 48, ) == 0x0 01937 2020 NtQuerySystemInformation (ProcessorTimes, 48, ... {system info, class 8, size 48}, 48, ) == 0x0 01938 2020 NtQuerySystemInformation (Performance, 312, ... {system info, class 2, size 312}, 312, ) == 0x0 01939 2020 NtQuerySystemInformation (Exception, 16, ... {system info, class 33, size 16}, 16, ) == 0x0 01940 2020 NtQuerySystemInformation (Lookaside, 32, ... {system info, class 45, size 32}, 32, ) == 0x0 01941 2020 NtQuerySystemInformation (ProcessorStatistics, 3016, ... {system info, class 23, size 0}, 0, ) == 0x0 01942 2020 NtQuerySystemInformation (ProcessesAndThreads, 3008, ... ) == STATUS_INFO_LENGTH_MISMATCH 01943 2020 NtCreateKey (0x2, {24, 0, 0x240, 0, 0, (0x2, {24, 0, 0x240, 0, 0, "\Registry\Machine\SOFTWARE\Microsoft\Cryptography\RNG"}, 0, 0x0, 0, ... -2147482576, 2, ) }, 0, 0x0, 0, ... -2147482576, 2, ) == 0x0 01944 2020 NtSetValueKey (-2147482576, (-2147482576, "Seed", 0, 3, "\302Z_3eE\275\227\360\2715\14=\220\200\342*\223\355\363\7\224\367b9\313>m\217!\352\237xo\326\232\245\343\305,\216OK\377\253\203\13\357\341\232\6\370\274\36055[[8A\203\374\304\257\327\221\233\253\5\20*\344W\0\204\312\15\240?\341", 80, ... ) , 0, 3, (-2147482576, "Seed", 0, 3, "\302Z_3eE\275\227\360\2715\14=\220\200\342*\223\355\363\7\224\367b9\313>m\217!\352\237xo\326\232\245\343\305,\216OK\377\253\203\13\357\341\232\6\370\274\36055[[8A\203\374\304\257\327\221\233\253\5\20*\344W\0\204\312\15\240?\341", 80, ... ) , 80, ... ) == 0x0 01945 2020 NtClose (-2147482576, ... ) == 0x0 01935 2020 NtDeviceIoControlFile ... {status=0x0, info=256}, ... {status=0x0, info=256}, "\300W\245\321\315\2055G\211j\255Vu=`6\336\252\367\375\274\300\327\30N:\277n\6\25\200\54/R\235(9\26<\211qj\354\217?\331Rv\237\271\217\352%C\21, ) , ) == 0x0 01946 2020 NtDeviceIoControlFile (44, 0, 0x0, 0x0, 0x390008, (44, 0, 0x0, 0x0, 0x390008, ")\355\330\240\0\226s\377\214\216H\331\202\250\302\305t\366\235\354Z\311mt\366\235\354Z\311mt\366\235\354Z\311mt\366\235\354Zqr\263\177`\204*]@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0", 256, 256, ... , 256, 256, ... 01947 2020 NtQuerySystemInformation (TimeOfDay, 48, ... {system info, class 3, size 48}, 48, ) == 0x0 01948 2020 NtQuerySystemInformation (ProcessorTimes, 48, ... {system info, class 8, size 48}, 48, ) == 0x0 01949 2020 NtQuerySystemInformation (Performance, 312, ... {system info, class 2, size 312}, 312, ) == 0x0 01950 2020 NtQuerySystemInformation (Exception, 16, ... {system info, class 33, size 16}, 16, ) == 0x0 01951 2020 NtQuerySystemInformation (Lookaside, 32, ... {system info, class 45, size 32}, 32, ) == 0x0 01952 2020 NtQuerySystemInformation (ProcessorStatistics, 3016, ... {system info, class 23, size 0}, 0, ) == 0x0 01953 2020 NtQuerySystemInformation (ProcessesAndThreads, 3008, ... ) == STATUS_INFO_LENGTH_MISMATCH 01954 2020 NtCreateKey (0x2, {24, 0, 0x240, 0, 0, (0x2, {24, 0, 0x240, 0, 0, "\Registry\Machine\SOFTWARE\Microsoft\Cryptography\RNG"}, 0, 0x0, 0, ... -2147482576, 2, ) }, 0, 0x0, 0, ... -2147482576, 2, ) == 0x0 01955 2020 NtSetValueKey (-2147482576, (-2147482576, "Seed", 0, 3, "E\376\262\346G\230\255L\217\266!\221\371\252\324F7\270J7\334\5\255\3x=\307u\234\26\233L\227\365\305p=\263`\272\215\351\177\224\323\10\236\303QP\365\346\13#N\260\321\340\17\350dq\31*U\32DSU\364\375\274\340\355?N\321L\35\352", 80, ... ) , 0, 3, (-2147482576, "Seed", 0, 3, "E\376\262\346G\230\255L\217\266!\221\371\252\324F7\270J7\334\5\255\3x=\307u\234\26\233L\227\365\305p=\263`\272\215\351\177\224\323\10\236\303QP\365\346\13#N\260\321\340\17\350dq\31*U\32DSU\364\375\274\340\355?N\321L\35\352", 80, ... ) , 80, ... ) == 0x0 01956 2020 NtClose (-2147482576, ... ) == 0x0 01946 2020 NtDeviceIoControlFile ... {status=0x0, info=256}, ... {status=0x0, info=256}, "\11\203C\361Q\365\23\325\310\234\365r\257\336\326\304\222\270\246l\22V\350\4\300SQ8A\357\314\264L\245\336\\15{H\272\200\304t\350}\225\344*$ucP,y\207C\11n\355\305\264\314\311@\242\23T(\1\32\127\32P\321O21X\314\261\320V\6\37\332\271\262;\317Zz\26o\230\270\256z\14\216\206\341\351+\202\265![\371\363\226\207z\334\32t\244\24v\23\315^\355k\305\214o;\3\215\212\247\243\300\177\307\325\21\2626w\331\276\15\317-l\Lt\366\324p\357)\223d\217g\36\0\373\14\332u<#\322\337\\14\334\363\34\21\324c\316\312\310\354Q\2779\251~\346\10\3664v\14\254h\7\301\231\341\246S\5\24\377\22\245\0>\331h3BV2\311\200\214\340\217\270\222\276\11\274\16\31\267\261m\336\262\12\27\373\207-Uh\304\311\375\307\337\353\314\332\250\223\273\330\30\374\363\13'z\264", ) , ) == 0x0 01957 2020 NtDeviceIoControlFile (44, 0, 0x0, 0x0, 0x390008, (44, 0, 0x0, 0x0, 0x390008, ")\355\330\240\0\226s\377\214\216H\331\202\250\302\305t\366\235\354Z\311mt\366\235\354Z\311mt\366\235\354Z\311mt\366\235\354Z\311mt\366\235\354Zqr\263\177`\204*]@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0", 256, 256, ... , 256, 256, ... 01958 2020 NtQuerySystemInformation (TimeOfDay, 48, ... {system info, class 3, size 48}, 48, ) == 0x0 01959 2020 NtQuerySystemInformation (ProcessorTimes, 48, ... {system info, class 8, size 48}, 48, ) == 0x0 01960 2020 NtQuerySystemInformation (Performance, 312, ... {system info, class 2, size 312}, 312, ) == 0x0 01961 2020 NtQuerySystemInformation (Exception, 16, ... {system info, class 33, size 16}, 16, ) == 0x0 01962 2020 NtQuerySystemInformation (Lookaside, 32, ... {system info, class 45, size 32}, 32, ) == 0x0 01963 2020 NtQuerySystemInformation (ProcessorStatistics, 3016, ... {system info, class 23, size 0}, 0, ) == 0x0 01964 2020 NtQuerySystemInformation (ProcessesAndThreads, 3008, ... ) == STATUS_INFO_LENGTH_MISMATCH 01965 2020 NtCreateKey (0x2, {24, 0, 0x240, 0, 0, (0x2, {24, 0, 0x240, 0, 0, "\Registry\Machine\SOFTWARE\Microsoft\Cryptography\RNG"}, 0, 0x0, 0, ... -2147482576, 2, ) }, 0, 0x0, 0, ... -2147482576, 2, ) == 0x0 01966 2020 NtSetValueKey (-2147482576, (-2147482576, "Seed", 0, 3, "\303\243\313\31\37\343B\355\214+\370[s\336\253 T\35\336&\16Z0SZNLJ\316|\203\220\232'\374V^jG\237\324\227\68\360\263\2\326#\6\35I\355\254\365L\200;\327\30\272,DN\277Di^\301w\27]\224\33\15\203x\31\1\223", 80, ... ) , 0, 3, (-2147482576, "Seed", 0, 3, "\303\243\313\31\37\343B\355\214+\370[s\336\253 T\35\336&\16Z0SZNLJ\316|\203\220\232'\374V^jG\237\324\227\68\360\263\2\326#\6\35I\355\254\365L\200;\327\30\272,DN\277Di^\301w\27]\224\33\15\203x\31\1\223", 80, ... ) , 80, ... ) == 0x0 01967 2020 NtClose (-2147482576, ... ) == 0x0 01957 2020 NtDeviceIoControlFile ... {status=0x0, info=256}, ... {status=0x0, info=256}, "\305\35nwd\275\23\327\214)[!7\370$_g\4\252\322Y0\335\201\177\236\5\36\365f\307\241\365\21\251,\275e\216\350\376\203\354X\202\272\353Y9\336\5\3756\0Z\235[t\365\211\330<\342\376\245*i6[\274\271/~\307M\357\215\27\14\357\26\221s\367/a\370\361\375\2502R]\371\202\246\331\225\362u\34\215\20\37\327\251\14\336\325\246\242\210\20\16\27\35/\270\217\361\16\324[\272\34\236\230\256\375\36\357\300}\207f\315\313 %\335zH\7\22z\323ft\303\6;\356\222\266\4\327\321\246\244C\03@\340\371`\3\231\35"\2217y\374\1p\266\231\330`\177_*\0\331?\10\202\244\242#\236t\352\370\267)\246\352d\365\235\326kW\205UK\7\235d4\306M\4\262\306M}\234Z@\223\271\212\377YA+\236\257U\255\15f\375\0\224\32\277\2000/a\24677\372\212\340B\37=f\266\326", ) \2217y\374\1p\266\231\330`\177_*\0\331?\10\202\244\242#\236t\352\370\267)\246\352d\365\235\326kW\205UK\7\235d4\306M\4\262\306M}\234Z@\223\271\212\377YA+\236\257U\255\15f\375\0\224\32\277\2000/a\24677\372\212\340B\37=f\266\326", ) == 0x0 01968 2020 NtDeviceIoControlFile (44, 0, 0x0, 0x0, 0x390008, (44, 0, 0x0, 0x0, 0x390008, ")\355\330\240\0\226s\377\214\216H\331\202\250\302\305t\366\235\354Z\311mt\366\235\354Z\311mt\366\235\354Z\311mt\366\235\354Z\311mt\366\235\354Z\311mt\366\235\354Zqr\263\177`\204*]@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0", 256, 256, ... , 256, 256, ... 01969 2020 NtQuerySystemInformation (TimeOfDay, 48, ... {system info, class 3, size 48}, 48, ) == 0x0 01970 2020 NtQuerySystemInformation (ProcessorTimes, 48, ... {system info, class 8, size 48}, 48, ) == 0x0 01971 2020 NtQuerySystemInformation (Performance, 312, ... {system info, class 2, size 312}, 312, ) == 0x0 01972 2020 NtQuerySystemInformation (Exception, 16, ... {system info, class 33, size 16}, 16, ) == 0x0 01973 2020 NtQuerySystemInformation (Lookaside, 32, ... {system info, class 45, size 32}, 32, ) == 0x0 01974 2020 NtQuerySystemInformation (ProcessorStatistics, 3016, ... {system info, class 23, size 0}, 0, ) == 0x0 01975 2020 NtQuerySystemInformation (ProcessesAndThreads, 3008, ... ) == STATUS_INFO_LENGTH_MISMATCH 01976 2020 NtCreateKey (0x2, {24, 0, 0x240, 0, 0, (0x2, {24, 0, 0x240, 0, 0, "\Registry\Machine\SOFTWARE\Microsoft\Cryptography\RNG"}, 0, 0x0, 0, ... -2147482576, 2, ) }, 0, 0x0, 0, ... -2147482576, 2, ) == 0x0 01977 2020 NtSetValueKey (-2147482576, (-2147482576, "Seed", 0, 3, "M\251\366\304$0c\306\366o\37\342\12\374\336\365\312\377zJ0#\314H\346~\267\2243\227\275\266\267\203E=\267\333\263GkspJ\260\321\0\234U\263\333\212\331*\337\372\355\177\304E\273\303\16\334\377\221\206\314f}\311\227\227\350\375\20$\344q\11", 80, ... ) , 0, 3, (-2147482576, "Seed", 0, 3, "M\251\366\304$0c\306\366o\37\342\12\374\336\365\312\377zJ0#\314H\346~\267\2243\227\275\266\267\203E=\267\333\263GkspJ\260\321\0\234U\263\333\212\331*\337\372\355\177\304E\273\303\16\334\377\221\206\314f}\311\227\227\350\375\20$\344q\11", 80, ... ) , 80, ... ) == 0x0 01978 2020 NtClose (-2147482576, ... ) == 0x0 01968 2020 NtDeviceIoControlFile ... {status=0x0, info=256}, ... {status=0x0, info=256}, "p\3610\302\241u\311\2673\332N\27l\262\15\360\344\224m;\373\363\265\355>PA\35Ef`\321\11V\\225{y\222\5\324\35\237Fh\246\344\20\232\354\335\253\35\343\367x\30\311\15gn\350\310\10*0\373\22574r\357\242\235\340\354`\322\300\331\34\365\12\316\0\26\213\362[\257\33\262w-\201\6T\224\302\277\315\3005\34=\31\317\252j\212\342\3617t!3\31\355*\37\35\235\255\3623\303\275\332\212\315\356\21\377`\267\20\326\327\204\273\356\312cmCiC\263\225\346 \350\316{\355\26\347\260v\235\300\365\15\341\273\260y\244\321\363)1\232l\362\350\223|5\340)\217o_\200\203\243\36\23D\273\326\10\374\20kr\300R\347\253~\350@AQ\372\333\371>\240;\351\252\361\246_\202\357\317\347\233>Q\354S\2569\361\204\322\367A2z\357\213\354\216*a\273\252|O\270\175R\321\322\300\325\266@\356", ) , ) == 0x0 01979 2020 NtCreateEvent (0x1f0003, 0x0, 1, 0, ... 188, ) == 0x0 01980 2020 NtConnectPort ( ("\RPC Control\IcaApi", {12, 2, 1, 0}, 0x0, 0x0, 1231456, 188, ... 192, 0x0, 0x0, 0x0, 188, ) , {12, 2, 1, 0}, 0x0, 0x0, 1231456, 188, ... 192, 0x0, 0x0, 0x0, 188, ) == 0x0 01981 2020 NtRequestWaitReplyPort (192, {200, 224, new_msg, 0, 2621478, 1385184, 12, 2} (192, {200, 224, new_msg, 0, 2621478, 1385184, 12, 2} "\0\0\24\0\10\0\0\0\274\0\0\0`\247\244\\261\353\317\21\206\21\0\240$T \355\1\0\0\0\1\0\0\0\0\0\2\0\4\0\0\002\24\0\270"\25\0\10\0\0\0\5\0\0\0x\1\24\0\0\0\0\0\0\0\25\0\2\0\0\04\21\131\271\255\231z\260"\25\0h\1\24\0\12\0\0\0\0\0\0\0\260"\25\0(\0\0\0\270"\25\0\3667\3231x\1\24\0(\0\0\0\204l\0\0\0\0\24\0\274\310\22\0\252\1\0\0\0\0\0\0\20X\24\0\360\6\221|\377\377\377\377P\0\0\0\346\31\0|\0\0\24\0\340\310\22\0\372\31\221|t\320\22\0\30\356\220|\0\0\0\0\0\0\0\0\0\0\0\0\351\201\347w" ... {200, 224, reply, 0, 868, 2020, 75655, 0} "\7\0\24\0\10\0\0\0\274\0\0\0`\247\244\\261\353\317\21\206\21\0\240$T \355\1\0\0\0\1\0\0\0\0\0\0\0\4\0\0\002\24\0\377\377\377\377\10\0\0\0\5\0\0\0x\1\24\0\0\0\0\0\0\0\25\0\2\0\0\04\21\131\271\255\231z\260"\25\0h\1\24\0\12\0\0\0\0\0\0\0\260"\25\0(\0\0\0\270"\25\0\3667\3231x\1\24\0(\0\0\0\204l\0\0\0\0\24\0\274\310\22\0\252\1\0\0\0\0\0\0\20X\24\0\360\6\221|\377\377\377\377P\0\0\0\346\31\0|\0\0\24\0\340\310\22\0\372\31\221|t\320\22\0\30\356\220|\0\0\0\0\0\0\0\0\0\0\0\0\351\201\347w" ) \25\0\10\0\0\0\5\0\0\0x\1\24\0\0\0\0\0\0\0\25\0\2\0\0\04\21\131\271\255\231z\260 (192, {200, 224, new_msg, 0, 2621478, 1385184, 12, 2} "\0\0\24\0\10\0\0\0\274\0\0\0`\247\244\\261\353\317\21\206\21\0\240$T \355\1\0\0\0\1\0\0\0\0\0\2\0\4\0\0\002\24\0\270"\25\0\10\0\0\0\5\0\0\0x\1\24\0\0\0\0\0\0\0\25\0\2\0\0\04\21\131\271\255\231z\260"\25\0h\1\24\0\12\0\0\0\0\0\0\0\260"\25\0(\0\0\0\270"\25\0\3667\3231x\1\24\0(\0\0\0\204l\0\0\0\0\24\0\274\310\22\0\252\1\0\0\0\0\0\0\20X\24\0\360\6\221|\377\377\377\377P\0\0\0\346\31\0|\0\0\24\0\340\310\22\0\372\31\221|t\320\22\0\30\356\220|\0\0\0\0\0\0\0\0\0\0\0\0\351\201\347w" ... {200, 224, reply, 0, 868, 2020, 75655, 0} "\7\0\24\0\10\0\0\0\274\0\0\0`\247\244\\261\353\317\21\206\21\0\240$T \355\1\0\0\0\1\0\0\0\0\0\0\0\4\0\0\002\24\0\377\377\377\377\10\0\0\0\5\0\0\0x\1\24\0\0\0\0\0\0\0\25\0\2\0\0\04\21\131\271\255\231z\260"\25\0h\1\24\0\12\0\0\0\0\0\0\0\260"\25\0(\0\0\0\270"\25\0\3667\3231x\1\24\0(\0\0\0\204l\0\0\0\0\24\0\274\310\22\0\252\1\0\0\0\0\0\0\20X\24\0\360\6\221|\377\377\377\377P\0\0\0\346\31\0|\0\0\24\0\340\310\22\0\372\31\221|t\320\22\0\30\356\220|\0\0\0\0\0\0\0\0\0\0\0\0\351\201\347w" ) \25\0(\0\0\0\270 (192, {200, 224, new_msg, 0, 2621478, 1385184, 12, 2} "\0\0\24\0\10\0\0\0\274\0\0\0`\247\244\\261\353\317\21\206\21\0\240$T \355\1\0\0\0\1\0\0\0\0\0\2\0\4\0\0\002\24\0\270"\25\0\10\0\0\0\5\0\0\0x\1\24\0\0\0\0\0\0\0\25\0\2\0\0\04\21\131\271\255\231z\260"\25\0h\1\24\0\12\0\0\0\0\0\0\0\260"\25\0(\0\0\0\270"\25\0\3667\3231x\1\24\0(\0\0\0\204l\0\0\0\0\24\0\274\310\22\0\252\1\0\0\0\0\0\0\20X\24\0\360\6\221|\377\377\377\377P\0\0\0\346\31\0|\0\0\24\0\340\310\22\0\372\31\221|t\320\22\0\30\356\220|\0\0\0\0\0\0\0\0\0\0\0\0\351\201\347w" ... {200, 224, reply, 0, 868, 2020, 75655, 0} "\7\0\24\0\10\0\0\0\274\0\0\0`\247\244\\261\353\317\21\206\21\0\240$T \355\1\0\0\0\1\0\0\0\0\0\0\0\4\0\0\002\24\0\377\377\377\377\10\0\0\0\5\0\0\0x\1\24\0\0\0\0\0\0\0\25\0\2\0\0\04\21\131\271\255\231z\260"\25\0h\1\24\0\12\0\0\0\0\0\0\0\260"\25\0(\0\0\0\270"\25\0\3667\3231x\1\24\0(\0\0\0\204l\0\0\0\0\24\0\274\310\22\0\252\1\0\0\0\0\0\0\20X\24\0\360\6\221|\377\377\377\377P\0\0\0\346\31\0|\0\0\24\0\340\310\22\0\372\31\221|t\320\22\0\30\356\220|\0\0\0\0\0\0\0\0\0\0\0\0\351\201\347w" ) ... {200, 224, reply, 0, 868, 2020, 75655, 0} (192, {200, 224, new_msg, 0, 2621478, 1385184, 12, 2} "\0\0\24\0\10\0\0\0\274\0\0\0`\247\244\\261\353\317\21\206\21\0\240$T \355\1\0\0\0\1\0\0\0\0\0\2\0\4\0\0\002\24\0\270"\25\0\10\0\0\0\5\0\0\0x\1\24\0\0\0\0\0\0\0\25\0\2\0\0\04\21\131\271\255\231z\260"\25\0h\1\24\0\12\0\0\0\0\0\0\0\260"\25\0(\0\0\0\270"\25\0\3667\3231x\1\24\0(\0\0\0\204l\0\0\0\0\24\0\274\310\22\0\252\1\0\0\0\0\0\0\20X\24\0\360\6\221|\377\377\377\377P\0\0\0\346\31\0|\0\0\24\0\340\310\22\0\372\31\221|t\320\22\0\30\356\220|\0\0\0\0\0\0\0\0\0\0\0\0\351\201\347w" ... {200, 224, reply, 0, 868, 2020, 75655, 0} "\7\0\24\0\10\0\0\0\274\0\0\0`\247\244\\261\353\317\21\206\21\0\240$T \355\1\0\0\0\1\0\0\0\0\0\0\0\4\0\0\002\24\0\377\377\377\377\10\0\0\0\5\0\0\0x\1\24\0\0\0\0\0\0\0\25\0\2\0\0\04\21\131\271\255\231z\260"\25\0h\1\24\0\12\0\0\0\0\0\0\0\260"\25\0(\0\0\0\270"\25\0\3667\3231x\1\24\0(\0\0\0\204l\0\0\0\0\24\0\274\310\22\0\252\1\0\0\0\0\0\0\20X\24\0\360\6\221|\377\377\377\377P\0\0\0\346\31\0|\0\0\24\0\340\310\22\0\372\31\221|t\320\22\0\30\356\220|\0\0\0\0\0\0\0\0\0\0\0\0\351\201\347w" ) \25\0h\1\24\0\12\0\0\0\0\0\0\0\260 (192, {200, 224, new_msg, 0, 2621478, 1385184, 12, 2} "\0\0\24\0\10\0\0\0\274\0\0\0`\247\244\\261\353\317\21\206\21\0\240$T \355\1\0\0\0\1\0\0\0\0\0\2\0\4\0\0\002\24\0\270"\25\0\10\0\0\0\5\0\0\0x\1\24\0\0\0\0\0\0\0\25\0\2\0\0\04\21\131\271\255\231z\260"\25\0h\1\24\0\12\0\0\0\0\0\0\0\260"\25\0(\0\0\0\270"\25\0\3667\3231x\1\24\0(\0\0\0\204l\0\0\0\0\24\0\274\310\22\0\252\1\0\0\0\0\0\0\20X\24\0\360\6\221|\377\377\377\377P\0\0\0\346\31\0|\0\0\24\0\340\310\22\0\372\31\221|t\320\22\0\30\356\220|\0\0\0\0\0\0\0\0\0\0\0\0\351\201\347w" ... {200, 224, reply, 0, 868, 2020, 75655, 0} "\7\0\24\0\10\0\0\0\274\0\0\0`\247\244\\261\353\317\21\206\21\0\240$T \355\1\0\0\0\1\0\0\0\0\0\0\0\4\0\0\002\24\0\377\377\377\377\10\0\0\0\5\0\0\0x\1\24\0\0\0\0\0\0\0\25\0\2\0\0\04\21\131\271\255\231z\260"\25\0h\1\24\0\12\0\0\0\0\0\0\0\260"\25\0(\0\0\0\270"\25\0\3667\3231x\1\24\0(\0\0\0\204l\0\0\0\0\24\0\274\310\22\0\252\1\0\0\0\0\0\0\20X\24\0\360\6\221|\377\377\377\377P\0\0\0\346\31\0|\0\0\24\0\340\310\22\0\372\31\221|t\320\22\0\30\356\220|\0\0\0\0\0\0\0\0\0\0\0\0\351\201\347w" ) \25\0\3667\3231x\1\24\0(\0\0\0\204l\0\0\0\0\24\0\274\310\22\0\252\1\0\0\0\0\0\0\20X\24\0\360\6\221|\377\377\377\377P\0\0\0\346\31\0|\0\0\24\0\340\310\22\0\372\31\221|t\320\22\0\30\356\220|\0\0\0\0\0\0\0\0\0\0\0\0\351\201\347w" ) == 0x0 01982 2020 NtRequestWaitReplyPort (192, {32, 56, new_msg, 0, 0, 0, 0, 0} (192, {32, 56, new_msg, 0, 0, 0, 0, 0} "\1\0\0\0A\3\0\0`\247\244\\261\353\317\21\206\21\0\240$T \355\377\377\377\377\0\0\0\0" ... {124, 148, reply, 0, 868, 2020, 75656, 0} "\2\31\221|\1\0\221|\200\300\227|p\31\221|\250$\12\0\330\0\0\0d\365\11\0\0\300\372\177\0\0\0\0\0\0\0\0\262 #\244\235\324.B\233\211j\376]\25\300\227\1\0\0\0\1\0\0\0\4\0\0\0\1\365\11\0\1\0\0\0d\365\11\0\0\0\0\0\0\0\0\0\1\0\0\0\10\376\257\0\0\0\0\0\334\377\257\0\30\356\220|p\5\221|\377\377\377\377m\5\221|\344f\347w" ) ... {124, 148, reply, 0, 868, 2020, 75656, 0} (192, {32, 56, new_msg, 0, 0, 0, 0, 0} "\1\0\0\0A\3\0\0`\247\244\\261\353\317\21\206\21\0\240$T \355\377\377\377\377\0\0\0\0" ... {124, 148, reply, 0, 868, 2020, 75656, 0} "\2\31\221|\1\0\221|\200\300\227|p\31\221|\250$\12\0\330\0\0\0d\365\11\0\0\300\372\177\0\0\0\0\0\0\0\0\262 #\244\235\324.B\233\211j\376]\25\300\227\1\0\0\0\1\0\0\0\4\0\0\0\1\365\11\0\1\0\0\0d\365\11\0\0\0\0\0\0\0\0\0\1\0\0\0\10\376\257\0\0\0\0\0\334\377\257\0\30\356\220|p\5\221|\377\377\377\377m\5\221|\344f\347w" ) ) == 0x0 01983 2020 NtRequestWaitReplyPort (192, {44, 68, new_msg, 56, 868, 2020, 75656, 0} (192, {44, 68, new_msg, 56, 868, 2020, 75656, 0} "\1\31\0\0B\2\5\0\200\300\227|p\31\221|\250$\12\0\330\0\0\0\377\377\377\377\0\300\372\177\1\0\0\0`%\25\0\10\5\0\0" ... {40, 64, reply, 0, 868, 2020, 75657, 0} "\2\0\0\0\4\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\14\5\0\0\300\364\15\0" ) ... {40, 64, reply, 0, 868, 2020, 75657, 0} (192, {44, 68, new_msg, 56, 868, 2020, 75656, 0} "\1\31\0\0B\2\5\0\200\300\227|p\31\221|\250$\12\0\330\0\0\0\377\377\377\377\0\300\372\177\1\0\0\0`%\25\0\10\5\0\0" ... {40, 64, reply, 0, 868, 2020, 75657, 0} "\2\0\0\0\4\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\14\5\0\0\300\364\15\0" ) ) == 0x0 01984 2020 NtRequestWaitReplyPort (192, {64, 88, new_msg, 56, 1385544, 1232032, 1385816, 0} (192, {64, 88, new_msg, 56, 1385544, 1232032, 1385816, 0} "\10\0\0\0@\0\1\1U\1\0\0\230\313\22\0`%\25\0\264\320\22\0\30\356\220|p\5\221|\1\0\0\0`%\25\0\14\5\0\0\14\5\0\0\300\364\15\0\0\0\0\0\0\0\0\0\273f\347w" ... {64, 88, reply, 56, 868, 2020, 75658, 0} "\10\0\0\0@\0\1\1U\1\0\0\230\313\22\0`%\25\0\264\320\22\0\30\356\220|p\5\221|\1\0\0\0`%\25\0\14\5\0\0\14\5\0\0\300\364\15\0\0\0\0\0\0\0\0\0\273f\347w" ) ... {64, 88, reply, 56, 868, 2020, 75658, 0} (192, {64, 88, new_msg, 56, 1385544, 1232032, 1385816, 0} "\10\0\0\0@\0\1\1U\1\0\0\230\313\22\0`%\25\0\264\320\22\0\30\356\220|p\5\221|\1\0\0\0`%\25\0\14\5\0\0\14\5\0\0\300\364\15\0\0\0\0\0\0\0\0\0\273f\347w" ... {64, 88, reply, 56, 868, 2020, 75658, 0} "\10\0\0\0@\0\1\1U\1\0\0\230\313\22\0`%\25\0\264\320\22\0\30\356\220|p\5\221|\1\0\0\0`%\25\0\14\5\0\0\14\5\0\0\300\364\15\0\0\0\0\0\0\0\0\0\273f\347w" ) ) == 0x0 01985 2020 NtRequestWaitReplyPort (192, {44, 68, new_msg, 56, 868, 2020, 75657, 0} (192, {44, 68, new_msg, 56, 868, 2020, 75657, 0} "\1\0\0\0B\2\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\377\377\377\377\0\0\0\0\1\0\0\00*\25\0\10\5\0\0" ... {40, 64, reply, 0, 868, 2020, 75659, 0} "\2\0\0\0\4\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\14\5\0\0\300\364\15\0" ) ... {40, 64, reply, 0, 868, 2020, 75659, 0} (192, {44, 68, new_msg, 56, 868, 2020, 75657, 0} "\1\0\0\0B\2\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\377\377\377\377\0\0\0\0\1\0\0\00*\25\0\10\5\0\0" ... {40, 64, reply, 0, 868, 2020, 75659, 0} "\2\0\0\0\4\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\14\5\0\0\300\364\15\0" ) ) == 0x0 01986 2020 NtRequestWaitReplyPort (192, {64, 88, new_msg, 56, 1385544, 1232032, 1387048, 0} (192, {64, 88, new_msg, 56, 1385544, 1232032, 1387048, 0} "\10\0\0\0@\0\1\1\273\0\0\0\230\313\22\00*\25\0\264\320\22\0\30\356\220|p\5\221|\1\0\0\00*\25\0\14\5\0\0\14\5\0\0\300\364\15\0\0\0\0\0\0\0\0\0\273f\347w" ... {64, 88, reply, 56, 868, 2020, 75660, 0} "\10\0\0\0@\0\1\1\273\0\0\0\230\313\22\00*\25\0\264\320\22\0\30\356\220|p\5\221|\1\0\0\00*\25\0\14\5\0\0\14\5\0\0\300\364\15\0\0\0\0\0\0\0\0\0\273f\347w" ) ... {64, 88, reply, 56, 868, 2020, 75660, 0} (192, {64, 88, new_msg, 56, 1385544, 1232032, 1387048, 0} "\10\0\0\0@\0\1\1\273\0\0\0\230\313\22\00*\25\0\264\320\22\0\30\356\220|p\5\221|\1\0\0\00*\25\0\14\5\0\0\14\5\0\0\300\364\15\0\0\0\0\0\0\0\0\0\273f\347w" ... {64, 88, reply, 56, 868, 2020, 75660, 0} "\10\0\0\0@\0\1\1\273\0\0\0\230\313\22\00*\25\0\264\320\22\0\30\356\220|p\5\221|\1\0\0\00*\25\0\14\5\0\0\14\5\0\0\300\364\15\0\0\0\0\0\0\0\0\0\273f\347w" ) ) == 0x0 01987 2020 NtOpenKey (0x20019, {24, 0, 0x40, 0, 0, (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\System\CurrentControlSet\Control\ComputerName"}, ... 196, ) }, ... 196, ) == 0x0 01988 2020 NtOpenKey (0x20019, {24, 196, 0x40, 0, 0, (0x20019, {24, 196, 0x40, 0, 0, "ActiveComputerName"}, ... 200, ) }, ... 200, ) == 0x0 01989 2020 NtQueryValueKey (200, (200, "ComputerName", Full, 108, ... TitleIdx=0, Type=1, Name="ComputerName", Data="V\0I\0R\0T\0U\0A\0L\0\0\0"}, 60, ) , Full, 108, ... TitleIdx=0, Type=1, Name= (200, "ComputerName", Full, 108, ... TitleIdx=0, Type=1, Name="ComputerName", Data="V\0I\0R\0T\0U\0A\0L\0\0\0"}, 60, ) , Data= (200, "ComputerName", Full, 108, ... TitleIdx=0, Type=1, Name="ComputerName", Data="V\0I\0R\0T\0U\0A\0L\0\0\0"}, 60, ) }, 60, ) == 0x0 01990 2020 NtClose (200, ... ) == 0x0 01991 2020 NtClose (196, ... ) == 0x0 01992 2020 NtCreateIoCompletion (0x1f0003, 0x0, 0, ... 196, ) == 0x0 01993 2020 NtCreateIoCompletion (0x1f0003, 0x0, -1, ... 200, ) == 0x0 01994 2020 NtDuplicateObject (-1, 196, -1, 0x0, 0, 2, ... 204, ) == 0x0 01995 2020 NtOpenThreadToken (-2, 0xc, 1, ... ) == STATUS_NO_TOKEN 01996 2020 NtCreateEvent (0x1f0003, 0x0, 1, 0, ... 208, ) == 0x0 01997 2020 NtOpenThreadToken (-2, 0xc, 1, ... ) == STATUS_NO_TOKEN 01998 2020 NtSetInformationThread (-2, ImpersonationToken, {ImpToken=0,}, 4, ... ) == 0x0 01999 2020 NtCreateFile (0xc0100080, {24, 0, 0x40, 0, 1231492, (0xc0100080, {24, 0, 0x40, 0, 1231492, "\??\PIPE\lsarpc"}, 0x0, 0, 3, 1, 64, 0, 0, ... 212, {status=0x0, info=1}, ) }, 0x0, 0, 3, 1, 64, 0, 0, ... 212, {status=0x0, info=1}, ) == 0x0 02000 2020 NtSetInformationFile (212, 1231548, 8, Pipe, ... {status=0x0, info=0}, ) == 0x0 02001 2020 NtSetInformationFile (212, 1231536, 8, Completion, ... {status=0x0, info=0}, ) == 0x0 02002 2020 NtSetInformationThread (-2, ImpersonationToken, {ImpToken=0,}, 4, ... ) == 0x0 02003 2020 NtWriteFile (212, 181, 0, 0, (212, 181, 0, 0, "\5\0\13\3\20\0\0\0H\0\0\0\1\0\0\0\270\20\270\20\0\0\0\0\1\0\0\0\0\0\1\0xW4\224\22\315\253\357\0\1#Eg\211\253\0\0\0\0\4]\210\212\353\34\311\21\237\350\10\0+\20H`\2\0\0\0", 72, {0, 0}, 0, ... {status=0x0, info=72}, ) , 72, {0, 0}, 0, ... {status=0x0, info=72}, ) == 0x0 02004 2020 NtReadFile (212, 181, 0, 0, 1024, {0, 0}, 0, ... {status=0x0, info=68}, (212, 181, 0, 0, 1024, {0, 0}, 0, ... {status=0x0, info=68}, "\5\0\14\3\20\0\0\0D\0\0\0\1\0\0\0\270\20\270\20Z+\0\0\14\0\PIPE\lsass\0\0\0\1\0\0\0\0\0\0\0\4]\210\212\353\34\311\21\237\350\10\0+\20H`\2\0\0\0", ) , ) == 0x0 02005 2020 NtFsControlFile (212, 181, 0x0, 0x0, 0x11c017, (212, 181, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0@\0\0\0\1\0\0\0(\0\0\0\0\0,\0\0\0\0\0\30\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0L\321\22\0\14\0\0\0\2\0\1\0\0\10\0\0", 64, 1024, ... {status=0x103, info=68}, "\5\0\14\3\20\0\0\0D\0\0\0\1\0\0\0\270\20\270\20Z+\0\0\14\0\PIPE\lsass\0\0\0\1\0\0\0\0\0\0\0\4]\210\212\353\34\311\21\237\350\10\0+\20H`\2\0\0\0", ) , 64, 1024, ... {status=0x103, info=68}, (212, 181, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0@\0\0\0\1\0\0\0(\0\0\0\0\0,\0\0\0\0\0\30\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0L\321\22\0\14\0\0\0\2\0\1\0\0\10\0\0", 64, 1024, ... {status=0x103, info=68}, "\5\0\14\3\20\0\0\0D\0\0\0\1\0\0\0\270\20\270\20Z+\0\0\14\0\PIPE\lsass\0\0\0\1\0\0\0\0\0\0\0\4]\210\212\353\34\311\21\237\350\10\0+\20H`\2\0\0\0", ) , ) == 0x103 02006 2020 NtAllocateVirtualMemory (-1, 1388544, 0, 4096, 4096, 4, ... 1388544, 4096, ) == 0x0 02007 2020 NtFsControlFile (212, 181, 0x0, 0x0, 0x11c017, (212, 181, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0\214\0\0\0\2\0\0\0t\0\0\0\0\0D\0\0\0\0\0\271-\231\203\263W H\215\326\234y\326mpK\1\0\0\0\1\0\0\0,\0.\0\0\324\22\0\27\0\0\0\0\0\0\0\26\0\0\0V\0I\0R\0T\0U\0A\0L\0\\0M\0a\0r\0t\0i\0m\0 \0C\0a\0r\0b\0o\0n\0e\0\0\0\0\0\0\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0", 140, 1024, ... {status=0x103, info=48}, "\5\0\2\3\20\0\0\00\0\0\0\1\0\0\0\30\0\0\0\0\0\0\0\0\0\0\0\271-\231\203\263W H\215\326\234y\326mpK\0\0\0\0", ) , 140, 1024, ... {status=0x103, info=48}, (212, 181, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0\214\0\0\0\2\0\0\0t\0\0\0\0\0D\0\0\0\0\0\271-\231\203\263W H\215\326\234y\326mpK\1\0\0\0\1\0\0\0,\0.\0\0\324\22\0\27\0\0\0\0\0\0\0\26\0\0\0V\0I\0R\0T\0U\0A\0L\0\\0M\0a\0r\0t\0i\0m\0 \0C\0a\0r\0b\0o\0n\0e\0\0\0\0\0\0\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0", 140, 1024, ... {status=0x103, info=48}, "\5\0\2\3\20\0\0\00\0\0\0\1\0\0\0\30\0\0\0\0\0\0\0\0\0\0\0\271-\231\203\263W H\215\326\234y\326mpK\0\0\0\0", ) , ) == 0x103 02008 2020 NtFsControlFile (212, 181, 0x0, 0x0, 0x11c017, (212, 181, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0,\0\0\0\3\0\0\0\24\0\0\0\0\0\0\0\0\0\0\0\271-\231\203\263W H\215\326\234y\326mpK", 44, 1024, ... {status=0x103, info=180}, "\5\0\2\3\20\0\0\0\264\0\0\0\2\0\0\0\234\0\0\0\0\0\0\0\3400\25\0\1\0\0\0\3540\25\0 \0\0\0\1\0\0\0\16\0\20\0\3700\25\0\101\25\0\10\0\0\0\0\0\0\0\7\0\0\0V\0I\0R\0T\0U\0A\0L\0O\0\4\0\0\0\1\4\0\0\0\0\0\5\25\0\0\0=\343\10MB\307tR\7\345;+\1\0\0\0H1\25\0\1\0\0\0\1\0\0\0X1\25\0\0\0\0\0\0\0\0\0\5\0\0\0\1\5\0\0\0\0\0\5\25\0\0\0=\343\10MB\307tR\7\345;+\353\3\0\0\1\0\0\0\0\0\0\0", ) , 44, 1024, ... {status=0x103, info=180}, (212, 181, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0,\0\0\0\3\0\0\0\24\0\0\0\0\0\0\0\0\0\0\0\271-\231\203\263W H\215\326\234y\326mpK", 44, 1024, ... {status=0x103, info=180}, "\5\0\2\3\20\0\0\0\264\0\0\0\2\0\0\0\234\0\0\0\0\0\0\0\3400\25\0\1\0\0\0\3540\25\0 \0\0\0\1\0\0\0\16\0\20\0\3700\25\0\101\25\0\10\0\0\0\0\0\0\0\7\0\0\0V\0I\0R\0T\0U\0A\0L\0O\0\4\0\0\0\1\4\0\0\0\0\0\5\25\0\0\0=\343\10MB\307tR\7\345;+\1\0\0\0H1\25\0\1\0\0\0\1\0\0\0X1\25\0\0\0\0\0\0\0\0\0\5\0\0\0\1\5\0\0\0\0\0\5\25\0\0\0=\343\10MB\307tR\7\345;+\353\3\0\0\1\0\0\0\0\0\0\0", ) , ) == 0x103 02009 2020 NtClose (208, ... ) == 0x0 02010 2020 NtClose (212, ... ) == 0x0 02011 2020 NtOpenThreadToken (-2, 0xc, 1, ... ) == STATUS_NO_TOKEN 02012 2020 NtCreateEvent (0x1f0003, 0x0, 1, 0, ... 212, ) == 0x0 02013 2020 NtOpenThreadToken (-2, 0xc, 1, ... ) == STATUS_NO_TOKEN 02014 2020 NtSetInformationThread (-2, ImpersonationToken, {ImpToken=0,}, 4, ... ) == 0x0 02015 2020 NtCreateFile (0xc0100080, {24, 0, 0x40, 0, 1231464, (0xc0100080, {24, 0, 0x40, 0, 1231464, "\??\PIPE\lsarpc"}, 0x0, 0, 3, 1, 64, 0, 0, ... 208, {status=0x0, info=1}, ) }, 0x0, 0, 3, 1, 64, 0, 0, ... 208, {status=0x0, info=1}, ) == 0x0 02016 2020 NtSetInformationFile (208, 1231520, 8, Pipe, ... {status=0x0, info=0}, ) == 0x0 02017 2020 NtSetInformationFile (208, 1231508, 8, Completion, ... {status=0x0, info=0}, ) == 0x0 02018 2020 NtSetInformationThread (-2, ImpersonationToken, {ImpToken=0,}, 4, ... ) == 0x0 02019 2020 NtWriteFile (208, 181, 0, 0, (208, 181, 0, 0, "\5\0\13\3\20\0\0\0H\0\0\0\1\0\0\0\270\20\270\20\0\0\0\0\1\0\0\0\0\0\1\0xW4\224\22\315\253\357\0\1#Eg\211\253\0\0\0\0\4]\210\212\353\34\311\21\237\350\10\0+\20H`\2\0\0\0", 72, {0, 0}, 0, ... {status=0x0, info=72}, ) , 72, {0, 0}, 0, ... {status=0x0, info=72}, ) == 0x0 02020 2020 NtReadFile (208, 181, 0, 0, 1024, {0, 0}, 0, ... {status=0x0, info=68}, (208, 181, 0, 0, 1024, {0, 0}, 0, ... {status=0x0, info=68}, "\5\0\14\3\20\0\0\0D\0\0\0\1\0\0\0\270\20\270\20[+\0\0\14\0\PIPE\lsass\0\0\0\1\0\0\0\0\0\0\0\4]\210\212\353\34\311\21\237\350\10\0+\20H`\2\0\0\0", ) , ) == 0x0 02021 2020 NtFsControlFile (208, 181, 0x0, 0x0, 0x11c017, (208, 181, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0@\0\0\0\1\0\0\0(\0\0\0\0\0,\0\0\0\0\0\30\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\321\22\0\14\0\0\0\2\0\1\0\0\10\0\0", 64, 1024, ... {status=0x103, info=68}, "\5\0\14\3\20\0\0\0D\0\0\0\1\0\0\0\270\20\270\20[+\0\0\14\0\PIPE\lsass\0\0\0\1\0\0\0\0\0\0\0\4]\210\212\353\34\311\21\237\350\10\0+\20H`\2\0\0\0", ) , 64, 1024, ... {status=0x103, info=68}, (208, 181, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0@\0\0\0\1\0\0\0(\0\0\0\0\0,\0\0\0\0\0\30\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\321\22\0\14\0\0\0\2\0\1\0\0\10\0\0", 64, 1024, ... {status=0x103, info=68}, "\5\0\14\3\20\0\0\0D\0\0\0\1\0\0\0\270\20\270\20[+\0\0\14\0\PIPE\lsass\0\0\0\1\0\0\0\0\0\0\0\4]\210\212\353\34\311\21\237\350\10\0+\20H`\2\0\0\0", ) , ) == 0x103 02022 2020 NtFsControlFile (208, 181, 0x0, 0x0, 0x11c017, (208, 181, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0\214\0\0\0\2\0\0\0t\0\0\0\0\0D\0\0\0\0\0,\21\20<\306NMM\271c\312\13aGf\31\1\0\0\0\1\0\0\0,\0.\0\0\324\22\0\27\0\0\0\0\0\0\0\26\0\0\0V\0I\0R\0T\0U\0A\0L\0\\0M\0a\0r\0t\0i\0m\0 \0C\0a\0r\0b\0o\0n\0e\0\0\0\0\0\0\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0", 140, 1024, ... {status=0x103, info=48}, "\5\0\2\3\20\0\0\00\0\0\0\1\0\0\0\30\0\0\0\0\0\0\0\0\0\0\0,\21\20<\306NMM\271c\312\13aGf\31\0\0\0\0", ) , 140, 1024, ... {status=0x103, info=48}, (208, 181, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0\214\0\0\0\2\0\0\0t\0\0\0\0\0D\0\0\0\0\0,\21\20<\306NMM\271c\312\13aGf\31\1\0\0\0\1\0\0\0,\0.\0\0\324\22\0\27\0\0\0\0\0\0\0\26\0\0\0V\0I\0R\0T\0U\0A\0L\0\\0M\0a\0r\0t\0i\0m\0 \0C\0a\0r\0b\0o\0n\0e\0\0\0\0\0\0\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0", 140, 1024, ... {status=0x103, info=48}, "\5\0\2\3\20\0\0\00\0\0\0\1\0\0\0\30\0\0\0\0\0\0\0\0\0\0\0,\21\20<\306NMM\271c\312\13aGf\31\0\0\0\0", ) , ) == 0x103 02023 2020 NtFsControlFile (208, 181, 0x0, 0x0, 0x11c017, (208, 181, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0,\0\0\0\3\0\0\0\24\0\0\0\0\0\0\0\0\0\0\0,\21\20<\306NMM\271c\312\13aGf\31", 44, 1024, ... {status=0x103, info=180}, "\5\0\2\3\20\0\0\0\264\0\0\0\2\0\0\0\234\0\0\0\0\0\0\0\3400\25\0\1\0\0\0\3540\25\0 \0\0\0\1\0\0\0\16\0\20\0\3700\25\0\101\25\0\10\0\0\0\0\0\0\0\7\0\0\0V\0I\0R\0T\0U\0A\0L\0O\0\4\0\0\0\1\4\0\0\0\0\0\5\25\0\0\0=\343\10MB\307tR\7\345;+\1\0\0\0H1\25\0\1\0\0\0\1\0\0\0X1\25\0\0\0\0\0\0\0\0\0\5\0\0\0\1\5\0\0\0\0\0\5\25\0\0\0=\343\10MB\307tR\7\345;+\353\3\0\0\1\0\0\0\0\0\0\0", ) , 44, 1024, ... {status=0x103, info=180}, (208, 181, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0,\0\0\0\3\0\0\0\24\0\0\0\0\0\0\0\0\0\0\0,\21\20<\306NMM\271c\312\13aGf\31", 44, 1024, ... {status=0x103, info=180}, "\5\0\2\3\20\0\0\0\264\0\0\0\2\0\0\0\234\0\0\0\0\0\0\0\3400\25\0\1\0\0\0\3540\25\0 \0\0\0\1\0\0\0\16\0\20\0\3700\25\0\101\25\0\10\0\0\0\0\0\0\0\7\0\0\0V\0I\0R\0T\0U\0A\0L\0O\0\4\0\0\0\1\4\0\0\0\0\0\5\25\0\0\0=\343\10MB\307tR\7\345;+\1\0\0\0H1\25\0\1\0\0\0\1\0\0\0X1\25\0\0\0\0\0\0\0\0\0\5\0\0\0\1\5\0\0\0\0\0\5\25\0\0\0=\343\10MB\307tR\7\345;+\353\3\0\0\1\0\0\0\0\0\0\0", ) , ) == 0x103 02024 2020 NtClose (212, ... ) == 0x0 02025 2020 NtClose (208, ... ) == 0x0 02026 2020 NtOpenProcessToken (-1, 0x20008, ... 208, ) == 0x0 02027 2020 NtQueryInformationToken (208, User, 0, ... ) == STATUS_BUFFER_TOO_SMALL 02028 2020 NtQueryInformationToken (208, User, 36, ... {token info, class 1, size 36}, 36, ) == 0x0 02029 2020 NtOpenDirectoryObject (0x2, {24, 0, 0x40, 0, 0, (0x2, {24, 0, 0x40, 0, 0, "\Windows\WindowStations"}, ... 212, ) }, ... 212, ) == 0x0 02030 2020 NtUserOpenWindowStation ({24, 212, 0x40, 0, 0, ({24, 212, 0x40, 0, 0, "winsta0"}, 0x37f, ... ) }, 0x37f, ... ) == 0xd8 02031 2020 NtClose (212, ... ) == 0x0 02032 2020 NtUserCloseWindowStation (216, ... 02033 2020 NtClose (216, ... ) == 0x0 02032 2020 NtUserCloseWindowStation ... ) == 0x1 02034 2020 NtClose (208, ... ) == 0x0 02035 2020 NtCreateEvent (0x1f0003, {24, 0, 0x2, 0, 0, 0x0}, 1, 0, ... 208, ) == 0x0 02036 2020 NtCreateEvent (0x1f0003, {24, 0, 0x2, 0, 0, 0x0}, 1, 0, ... 216, ) == 0x0 02037 2020 NtCreateMutant (0x1f0001, {24, 0, 0x2, 0, 0, 0x0}, 0, ... 212, ) == 0x0 02038 2020 NtDuplicateObject (-1, -1, -1, 0x1f0fff, 2, 0, ... 220, ) == 0x0 02039 2020 NtCreateSection (0xf0007, {24, 0, 0x2, 0, 0, 0x0}, {7248, 0}, 4, 134217728, 0, ... 224, ) == 0x0 02040 2020 NtMapViewOfSection (224, -1, (0x0), 0, 0, {0, 0}, 0, 1, 0, 4, ... (0xbf0000), {0, 0}, 8192, ) == 0x0 02041 2020 NtQueryDefaultUILanguage (1232156, ... 02042 2020 NtOpenThreadTokenEx (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN 02043 2020 NtOpenProcessTokenEx (-1, 0x20008, 512, ... -2147482576, ) == 0x0 02044 2020 NtQueryInformationToken (-2147482576, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0 02045 2020 NtClose (-2147482576, ... ) == 0x0 02046 2020 NtOpenKey (0x2000000, {24, 0, 0x640, 0, 0, (0x2000000, {24, 0, 0x640, 0, 0, "\REGISTRY\USER\S-1-5-21-1292428093-1383384898-725345543-1003"}, ... -2147482576, ) }, ... -2147482576, ) == 0x0 02047 2020 NtOpenKey (0x80000000, {24, -2147482576, 0x240, 0, 0, (0x80000000, {24, -2147482576, 0x240, 0, 0, "Software\Policies\Microsoft\Control Panel\Desktop"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 02048 2020 NtOpenKey (0x80000000, {24, -2147482576, 0x640, 0, 0, (0x80000000, {24, -2147482576, 0x640, 0, 0, "Control Panel\Desktop"}, ... -2147482648, ) }, ... -2147482648, ) == 0x0 02049 2020 NtQueryValueKey (-2147482648, (-2147482648, "MultiUILanguageId", Partial, 256, ... ) , Partial, 256, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 02050 2020 NtClose (-2147482648, ... ) == 0x0 02051 2020 NtClose (-2147482576, ... ) == 0x0 02041 2020 NtQueryDefaultUILanguage ... ) == 0x0 02052 2020 NtQueryInformationProcess (-1, DefaultHardErrorMode, 4, ... {process info, class 12, size 4}, 0x0, ) == 0x0 02053 2020 NtSetInformationProcess (-1, DefaultHardErrorMode, {process info, class 12, size 4}, 4, ... ) == 0x0 02054 2020 NtQueryAttributesFile ({24, 0, 0x40, 0, 0, ({24, 0, 0x40, 0, 0, "\??\u:\work\packed.exe"}, 1230400, ... ) }, 1230400, ... ) == 0x0 02055 2020 NtAllocateVirtualMemory (-1, 1220608, 0, 4096, 4096, 260, ... 1220608, 4096, ) == 0x0 02056 2020 NtQueryAttributesFile ({24, 0, 0x40, 0, 0, ({24, 0, 0x40, 0, 0, "\??\u:\work\packed.exe"}, 1229172, ... ) }, 1229172, ... ) == 0x0 02057 2020 NtQueryInformationProcess (-1, DefaultHardErrorMode, 4, ... {process info, class 12, size 4}, 0x0, ) == 0x0 02058 2020 NtSetInformationProcess (-1, DefaultHardErrorMode, {process info, class 12, size 4}, 4, ... ) == 0x0 02059 2020 NtCreateFile (0x10100080, {24, 0, 0x40, 0, 1231508, (0x10100080, {24, 0, 0x40, 0, 1231508, "\??\C:\DOCUME~1\MARTIM~1\LOCALS~1\Temp\ca43_appcompat.txt"}, 0x0, 128, 0, 2, 96, 0, 0, ... }, 0x0, 128, 0, 2, 96, 0, 0, ... 02060 2020 NtQueryDirectoryFile (-2147482576, 0, 0, 0, -519598080, 4096, Names, 1, (-2147482576, 0, 0, 0, -519598080, 4096, Names, 1, "DOCUME~1", 1, ... {status=0x0, info=56}, ) , 1, ... {status=0x0, info=56}, ) == 0x0 02061 2020 NtClose (-2147482576, ... ) == 0x0 02062 2020 NtQueryDirectoryFile (-2147482576, 0, 0, 0, -519598080, 4096, Names, 1, (-2147482576, 0, 0, 0, -519598080, 4096, Names, 1, "MARTIM~1", 1, ... {status=0x0, info=40}, ) , 1, ... {status=0x0, info=40}, ) == 0x0 02063 2020 NtClose (-2147482576, ... ) == 0x0 02064 2020 NtQueryDirectoryFile (-2147482576, 0, 0, 0, -519598080, 4096, Names, 1, (-2147482576, 0, 0, 0, -519598080, 4096, Names, 1, "LOCALS~1", 1, ... {status=0x0, info=40}, ) , 1, ... {status=0x0, info=40}, ) == 0x0 02065 2020 NtClose (-2147482576, ... ) == 0x0 02059 2020 NtCreateFile ... 228, {status=0x0, info=2}, ) == 0x0 02066 2020 NtClose (228, ... ) == 0x0 02067 2020 NtClose (-1, ... ) == STATUS_INVALID_HANDLE 02068 2020 NtQueryInformationProcess (-1, DeviceMap, 36, ... {process info, class 23, size 36}, 0x0, ) == 0x0 02069 2020 NtOpenFile (0x100080, {24, 0, 0x40, 0, 0, (0x100080, {24, 0, 0x40, 0, 0, "\??\u:"}, 3, 96, ... 228, {status=0x0, info=1}, ) }, 3, 96, ... 228, {status=0x0, info=1}, ) == 0x0 02070 2020 NtOpenSymbolicLinkObject (0x1, {24, 0, 0x40, 0, 0, (0x1, {24, 0, 0x40, 0, 0, "\??\u:"}, ... 232, ) }, ... 232, ) == 0x0 02071 2020 NtQuerySymbolicLinkObject (232, ... (232, ... "\Device\WinDfs\U:0000000000009f43", 66, ) , 66, ) == 0x0 02072 2020 NtClose (232, ... ) == 0x0 02073 2020 NtQueryVolumeInformationFile (228, 1230724, 8, Device, ... {status=0x0, info=8}, ) == 0x0 02074 2020 NtClose (228, ... ) == 0x0 02075 2020 NtQueryAttributesFile ({24, 0, 0x40, 0, 0, ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\apphelp.dll"}, 1229520, ... ) }, 1229520, ... ) == 0x0 02076 2020 NtOpenFile (0x100020, {24, 0, 0x40, 0, 0, (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\apphelp.dll"}, 5, 96, ... 228, {status=0x0, info=1}, ) }, 5, 96, ... 228, {status=0x0, info=1}, ) == 0x0 02077 2020 NtCreateSection (0xe, 0x0, 0x0, 16, 134217728, 228, ... 232, ) == 0x0 02078 2020 NtClose (228, ... ) == 0x0 02079 2020 NtMapViewOfSection (232, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 16, ... (0xc00000), 0x0, 126976, ) == 0x0 02080 2020 NtClose (232, ... ) == 0x0 02081 2020 NtUnmapViewOfSection (-1, 0xc00000, ... ) == 0x0 02082 2020 NtQueryAttributesFile ({24, 0, 0x40, 0, 0, ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\apphelp.dll"}, 1229828, ... ) }, 1229828, ... ) == 0x0 02083 2020 NtOpenFile (0x100020, {24, 0, 0x40, 0, 0, (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\apphelp.dll"}, 5, 96, ... 232, {status=0x0, info=1}, ) }, 5, 96, ... 232, {status=0x0, info=1}, ) == 0x0 02084 2020 NtCreateSection (0xf, 0x0, 0x0, 16, 16777216, 232, ... 228, ) == 0x0 02085 2020 NtQuerySection (228, Image, 48, ... {section info, class 1, size 48}, 0x0, ) == 0x0 02086 2020 NtClose (232, ... ) == 0x0 02087 2020 NtMapViewOfSection (228, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x77b40000), 0x0, 139264, ) == 0x0 02088 2020 NtClose (228, ... ) == 0x0 02089 2020 NtProtectVirtualMemory (-1, (0x77b41000), 524, 4, ... (0x77b41000), 4096, 32, ) == 0x0 02090 2020 NtProtectVirtualMemory (-1, (0x77b41000), 4096, 32, ... (0x77b41000), 4096, 4, ) == 0x0 02091 2020 NtFlushInstructionCache (-1, 2008289280, 524, ... ) == 0x0 02092 2020 NtOpenKey (0x80000000, {24, 0, 0x40, 0, 0, (0x80000000, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\apphelp.dll"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 02093 2020 NtAllocateVirtualMemory (-1, 1392640, 0, 12288, 4096, 4, ... 1392640, 12288, ) == 0x0 02094 2020 NtQueryAttributesFile ({24, 0, 0x40, 0, 0, ({24, 0, 0x40, 0, 0, "\??\u:\work\packed.exe"}, 1231216, ... ) }, 1231216, ... ) == 0x0 02095 2020 NtCreateFile (0x40100080, {24, 0, 0x40, 0, 1231224, (0x40100080, {24, 0, 0x40, 0, 1231224, "\??\C:\DOCUME~1\MARTIM~1\LOCALS~1\Temp\ca43_appcompat.txt"}, 0x0, 128, 0, 5, 96, 0, 0, ... }, 0x0, 128, 0, 5, 96, 0, 0, ... 02096 2020 NtClose (-2147482576, ... ) == 0x0 02097 2020 NtQueryDirectoryFile (-2147482576, 0, 0, 0, -519598080, 4096, Names, 1, (-2147482576, 0, 0, 0, -519598080, 4096, Names, 1, "DOCUME~1", 1, ... {status=0x0, info=56}, ) , 1, ... {status=0x0, info=56}, ) == 0x0 02098 2020 NtClose (-2147482576, ... ) == 0x0 02099 2020 NtQueryDirectoryFile (-2147482576, 0, 0, 0, -519598080, 4096, Names, 1, (-2147482576, 0, 0, 0, -519598080, 4096, Names, 1, "MARTIM~1", 1, ... {status=0x0, info=40}, ) , 1, ... {status=0x0, info=40}, ) == 0x0 02100 2020 NtClose (-2147482576, ... ) == 0x0 02101 2020 NtQueryDirectoryFile (-2147482576, 0, 0, 0, -519598080, 4096, Names, 1, (-2147482576, 0, 0, 0, -519598080, 4096, Names, 1, "LOCALS~1", 1, ... {status=0x0, info=40}, ) , 1, ... {status=0x0, info=40}, ) == 0x0 02102 2020 NtClose (-2147482576, ... ) == 0x0 02095 2020 NtCreateFile ... 228, {status=0x0, info=3}, ) == 0x0 02103 2020 NtAllocateVirtualMemory (-1, 1404928, 0, 12288, 4096, 4, ... 1404928, 12288, ) == 0x0 02104 2020 NtOpenFile (0x100001, {24, 0, 0x40, 0, 0, (0x100001, {24, 0, 0x40, 0, 0, "\??\u:\work\"}, 3, 16417, ... 232, {status=0x0, info=1}, ) }, 3, 16417, ... 232, {status=0x0, info=1}, ) == 0x0 02105 2020 NtQueryDirectoryFile (232, 0, 0, 0, 1229928, 616, BothDirectory, 1, (232, 0, 0, 0, 1229928, 616, BothDirectory, 1, "packed.exe", 0, ... {status=0x0, info=120}, ) , 0, ... {status=0x0, info=120}, ) == 0x0 02106 2020 NtWriteFile (228, 0, 0, 0, (228, 0, 0, 0, "\377\376", 2, 0x0, 0, ... {status=0x0, info=2}, ) , 2, 0x0, 0, ... {status=0x0, info=2}, ) == 0x0 02107 2020 NtWriteFile (228, 0, 0, 0, (228, 0, 0, 0, "<\0?\0x\0m\0l\0 \0v\0e\0r\0s\0i\0o\0n\0=\0"\01\0.\00\0"\0 \0e\0n\0c\0o\0d\0i\0n\0g\0=\0"\0U\0T\0F\0-\01\06\0"\0?\0>\0\15\0\12\0<\0D\0A\0T\0A\0B\0A\0S\0E\0>\0\15\0\12\0", 106, 0x0, 0, ... {status=0x0, info=106}, ) \01\0.\00\0 (228, 0, 0, 0, "<\0?\0x\0m\0l\0 \0v\0e\0r\0s\0i\0o\0n\0=\0"\01\0.\00\0"\0 \0e\0n\0c\0o\0d\0i\0n\0g\0=\0"\0U\0T\0F\0-\01\06\0"\0?\0>\0\15\0\12\0<\0D\0A\0T\0A\0B\0A\0S\0E\0>\0\15\0\12\0", 106, 0x0, 0, ... {status=0x0, info=106}, ) \0U\0T\0F\0-\01\06\0 (228, 0, 0, 0, "<\0?\0x\0m\0l\0 \0v\0e\0r\0s\0i\0o\0n\0=\0"\01\0.\00\0"\0 \0e\0n\0c\0o\0d\0i\0n\0g\0=\0"\0U\0T\0F\0-\01\06\0"\0?\0>\0\15\0\12\0<\0D\0A\0T\0A\0B\0A\0S\0E\0>\0\15\0\12\0", 106, 0x0, 0, ... {status=0x0, info=106}, ) , 106, 0x0, 0, ... {status=0x0, info=106}, ) == 0x0 02108 2020 NtWriteFile (228, 0, 0, 0, (228, 0, 0, 0, "<\0E\0X\0E\0 \0N\0A\0M\0E\0=\0"\0p\0a\0c\0k\0e\0d\0.\0e\0x\0e\0"\0 \0F\0I\0L\0T\0E\0R\0=\0"\0G\0R\0A\0B\0M\0I\0_\0F\0I\0L\0T\0E\0R\0_\0T\0H\0I\0S\0F\0I\0L\0E\0O\0N\0L\0Y\0"\0>\0\15\0\12\0", 122, 0x0, 0, ... {status=0x0, info=122}, ) \0p\0a\0c\0k\0e\0d\0.\0e\0x\0e\0 (228, 0, 0, 0, "<\0E\0X\0E\0 \0N\0A\0M\0E\0=\0"\0p\0a\0c\0k\0e\0d\0.\0e\0x\0e\0"\0 \0F\0I\0L\0T\0E\0R\0=\0"\0G\0R\0A\0B\0M\0I\0_\0F\0I\0L\0T\0E\0R\0_\0T\0H\0I\0S\0F\0I\0L\0E\0O\0N\0L\0Y\0"\0>\0\15\0\12\0", 122, 0x0, 0, ... {status=0x0, info=122}, ) \0G\0R\0A\0B\0M\0I\0_\0F\0I\0L\0T\0E\0R\0_\0T\0H\0I\0S\0F\0I\0L\0E\0O\0N\0L\0Y\0 (228, 0, 0, 0, "<\0E\0X\0E\0 \0N\0A\0M\0E\0=\0"\0p\0a\0c\0k\0e\0d\0.\0e\0x\0e\0"\0 \0F\0I\0L\0T\0E\0R\0=\0"\0G\0R\0A\0B\0M\0I\0_\0F\0I\0L\0T\0E\0R\0_\0T\0H\0I\0S\0F\0I\0L\0E\0O\0N\0L\0Y\0"\0>\0\15\0\12\0", 122, 0x0, 0, ... {status=0x0, info=122}, ) , 122, 0x0, 0, ... {status=0x0, info=122}, ) == 0x0 02109 2020 NtQueryAttributesFile ({24, 0, 0x40, 0, 0, ({24, 0, 0x40, 0, 0, "\??\u:\work\packed.exe"}, 1230308, ... ) }, 1230308, ... ) == 0x0 02110 2020 NtOpenFile (0x100001, {24, 0, 0x40, 0, 0, (0x100001, {24, 0, 0x40, 0, 0, "\??\u:\work"}, 3, 16417, ... 236, {status=0x0, info=1}, ) }, 3, 16417, ... 236, {status=0x0, info=1}, ) == 0x0 02111 2020 NtQueryDirectoryFile (236, 0, 0, 0, 1229920, 592, Directory, 1, (236, 0, 0, 0, 1229920, 592, Directory, 1, "packed.exe", 0, ... {status=0x0, info=84}, ) , 0, ... {status=0x0, info=84}, ) == 0x0 02112 2020 NtClose (236, ... ) == 0x0 02113 2020 NtQueryInformationProcess (-1, DefaultHardErrorMode, 4, ... {process info, class 12, size 4}, 0x0, ) == 0x0 02114 2020 NtSetInformationProcess (-1, DefaultHardErrorMode, {process info, class 12, size 4}, 4, ... ) == 0x0 02115 2020 NtQueryAttributesFile ({24, 0, 0x40, 0, 0, ({24, 0, 0x40, 0, 0, "\??\u:\work\packed.exe"}, 1228840, ... ) }, 1228840, ... ) == 0x0 02116 2020 NtQueryAttributesFile ({24, 0, 0x40, 0, 0, ({24, 0, 0x40, 0, 0, "\??\u:\work\packed.exe"}, 1227612, ... ) }, 1227612, ... ) == 0x0 02117 2020 NtQueryInformationProcess (-1, DefaultHardErrorMode, 4, ... {process info, class 12, size 4}, 0x0, ) == 0x0 02118 2020 NtSetInformationProcess (-1, DefaultHardErrorMode, {process info, class 12, size 4}, 4, ... ) == 0x0 02119 2020 NtCreateFile (0x80100080, {24, 0, 0x40, 0, 0, (0x80100080, {24, 0, 0x40, 0, 0, "\??\u:\work\packed.exe"}, 0x0, 128, 1, 1, 96, 0, 0, ... 236, {status=0x0, info=1}, ) }, 0x0, 128, 1, 1, 96, 0, 0, ... 236, {status=0x0, info=1}, ) == 0x0 02120 2020 NtQueryInformationFile (236, 1230396, 24, Standard, ... {status=0x0, info=24}, ) == 0x0 02121 2020 NtCreateSection (0x4, 0x0, 0x0, 2, 134217728, 236, ... 240, ) == 0x0 02122 2020 NtMapViewOfSection (240, -1, (0x0), 0, 0, 0x0, 0, 2, 0, 2, ... (0xc00000), 0x0, 266240, ) == 0x0 02123 2020 NtUnmapViewOfSection (-1, 0xc00000, ... ) == 0x0 02124 2020 NtClose (240, ... ) == 0x0 02125 2020 NtClose (236, ... ) == 0x0 02126 2020 NtWriteFile (228, 0, 0, 0, (228, 0, 0, 0, " \0 \0 \0 \0<\0M\0A\0T\0C\0H\0I\0N\0G\0_\0F\0I\0L\0E\0 \0N\0A\0M\0E\0=\0"\0p\0a\0c\0k\0e\0d\0.\0e\0x\0e\0"\0 \0S\0I\0Z\0E\0=\0"\02\06\05\02\01\06\0"\0 \0C\0H\0E\0C\0K\0S\0U\0M\0=\0"\00\0x\09\02\0E\04\0B\0E\0B\0D\0"\0 \0M\0O\0D\0U\0L\0E\0_\0T\0Y\0P\0E\0=\0"\0W\0I\0N\03\02\0"\0 \0P\0E\0_\0C\0H\0E\0C\0K\0S\0U\0M\0=\0"\00\0x\03\0B\06\00\0F\0"\0 \0L\0I\0N\0K\0E\0R\0_\0V\0E\0R\0S\0I\0O\0N\0=\0"\00\0x\00\0"\0 \0L\0I\0N\0K\0_\0D\0A\0T\0E\0=\0"\00\09\0/\01\03\0/\02\00\00\07\0 \01\00\0:\00\07\0:\04\01\0"\0 \0U\0P\0T\0O\0_\0L\0I\0N\0K\0_\0D\0A\0T\0E\0=\0"\00\09\0/\01\03\0/\02\00\00\07\0 \01\00\0:\00\07\0:\04\01\0"\0 \0/\0>\0\15\0\12\0", 418, 0x0, 0, ... \0p\0a\0c\0k\0e\0d\0.\0e\0x\0e\0 (228, 0, 0, 0, " \0 \0 \0 \0<\0M\0A\0T\0C\0H\0I\0N\0G\0_\0F\0I\0L\0E\0 \0N\0A\0M\0E\0=\0"\0p\0a\0c\0k\0e\0d\0.\0e\0x\0e\0"\0 \0S\0I\0Z\0E\0=\0"\02\06\05\02\01\06\0"\0 \0C\0H\0E\0C\0K\0S\0U\0M\0=\0"\00\0x\09\02\0E\04\0B\0E\0B\0D\0"\0 \0M\0O\0D\0U\0L\0E\0_\0T\0Y\0P\0E\0=\0"\0W\0I\0N\03\02\0"\0 \0P\0E\0_\0C\0H\0E\0C\0K\0S\0U\0M\0=\0"\00\0x\03\0B\06\00\0F\0"\0 \0L\0I\0N\0K\0E\0R\0_\0V\0E\0R\0S\0I\0O\0N\0=\0"\00\0x\00\0"\0 \0L\0I\0N\0K\0_\0D\0A\0T\0E\0=\0"\00\09\0/\01\03\0/\02\00\00\07\0 \01\00\0:\00\07\0:\04\01\0"\0 \0U\0P\0T\0O\0_\0L\0I\0N\0K\0_\0D\0A\0T\0E\0=\0"\00\09\0/\01\03\0/\02\00\00\07\0 \01\00\0:\00\07\0:\04\01\0"\0 \0/\0>\0\15\0\12\0", 418, 0x0, 0, ... \02\06\05\02\01\06\0 (228, 0, 0, 0, " \0 \0 \0 \0<\0M\0A\0T\0C\0H\0I\0N\0G\0_\0F\0I\0L\0E\0 \0N\0A\0M\0E\0=\0"\0p\0a\0c\0k\0e\0d\0.\0e\0x\0e\0"\0 \0S\0I\0Z\0E\0=\0"\02\06\05\02\01\06\0"\0 \0C\0H\0E\0C\0K\0S\0U\0M\0=\0"\00\0x\09\02\0E\04\0B\0E\0B\0D\0"\0 \0M\0O\0D\0U\0L\0E\0_\0T\0Y\0P\0E\0=\0"\0W\0I\0N\03\02\0"\0 \0P\0E\0_\0C\0H\0E\0C\0K\0S\0U\0M\0=\0"\00\0x\03\0B\06\00\0F\0"\0 \0L\0I\0N\0K\0E\0R\0_\0V\0E\0R\0S\0I\0O\0N\0=\0"\00\0x\00\0"\0 \0L\0I\0N\0K\0_\0D\0A\0T\0E\0=\0"\00\09\0/\01\03\0/\02\00\00\07\0 \01\00\0:\00\07\0:\04\01\0"\0 \0U\0P\0T\0O\0_\0L\0I\0N\0K\0_\0D\0A\0T\0E\0=\0"\00\09\0/\01\03\0/\02\00\00\07\0 \01\00\0:\00\07\0:\04\01\0"\0 \0/\0>\0\15\0\12\0", 418, 0x0, 0, ... \00\0x\09\02\0E\04\0B\0E\0B\0D\0 (228, 0, 0, 0, " \0 \0 \0 \0<\0M\0A\0T\0C\0H\0I\0N\0G\0_\0F\0I\0L\0E\0 \0N\0A\0M\0E\0=\0"\0p\0a\0c\0k\0e\0d\0.\0e\0x\0e\0"\0 \0S\0I\0Z\0E\0=\0"\02\06\05\02\01\06\0"\0 \0C\0H\0E\0C\0K\0S\0U\0M\0=\0"\00\0x\09\02\0E\04\0B\0E\0B\0D\0"\0 \0M\0O\0D\0U\0L\0E\0_\0T\0Y\0P\0E\0=\0"\0W\0I\0N\03\02\0"\0 \0P\0E\0_\0C\0H\0E\0C\0K\0S\0U\0M\0=\0"\00\0x\03\0B\06\00\0F\0"\0 \0L\0I\0N\0K\0E\0R\0_\0V\0E\0R\0S\0I\0O\0N\0=\0"\00\0x\00\0"\0 \0L\0I\0N\0K\0_\0D\0A\0T\0E\0=\0"\00\09\0/\01\03\0/\02\00\00\07\0 \01\00\0:\00\07\0:\04\01\0"\0 \0U\0P\0T\0O\0_\0L\0I\0N\0K\0_\0D\0A\0T\0E\0=\0"\00\09\0/\01\03\0/\02\00\00\07\0 \01\00\0:\00\07\0:\04\01\0"\0 \0/\0>\0\15\0\12\0", 418, 0x0, 0, ... \0W\0I\0N\03\02\0 (228, 0, 0, 0, " \0 \0 \0 \0<\0M\0A\0T\0C\0H\0I\0N\0G\0_\0F\0I\0L\0E\0 \0N\0A\0M\0E\0=\0"\0p\0a\0c\0k\0e\0d\0.\0e\0x\0e\0"\0 \0S\0I\0Z\0E\0=\0"\02\06\05\02\01\06\0"\0 \0C\0H\0E\0C\0K\0S\0U\0M\0=\0"\00\0x\09\02\0E\04\0B\0E\0B\0D\0"\0 \0M\0O\0D\0U\0L\0E\0_\0T\0Y\0P\0E\0=\0"\0W\0I\0N\03\02\0"\0 \0P\0E\0_\0C\0H\0E\0C\0K\0S\0U\0M\0=\0"\00\0x\03\0B\06\00\0F\0"\0 \0L\0I\0N\0K\0E\0R\0_\0V\0E\0R\0S\0I\0O\0N\0=\0"\00\0x\00\0"\0 \0L\0I\0N\0K\0_\0D\0A\0T\0E\0=\0"\00\09\0/\01\03\0/\02\00\00\07\0 \01\00\0:\00\07\0:\04\01\0"\0 \0U\0P\0T\0O\0_\0L\0I\0N\0K\0_\0D\0A\0T\0E\0=\0"\00\09\0/\01\03\0/\02\00\00\07\0 \01\00\0:\00\07\0:\04\01\0"\0 \0/\0>\0\15\0\12\0", 418, 0x0, 0, ... \00\0x\03\0B\06\00\0F\0 (228, 0, 0, 0, " \0 \0 \0 \0<\0M\0A\0T\0C\0H\0I\0N\0G\0_\0F\0I\0L\0E\0 \0N\0A\0M\0E\0=\0"\0p\0a\0c\0k\0e\0d\0.\0e\0x\0e\0"\0 \0S\0I\0Z\0E\0=\0"\02\06\05\02\01\06\0"\0 \0C\0H\0E\0C\0K\0S\0U\0M\0=\0"\00\0x\09\02\0E\04\0B\0E\0B\0D\0"\0 \0M\0O\0D\0U\0L\0E\0_\0T\0Y\0P\0E\0=\0"\0W\0I\0N\03\02\0"\0 \0P\0E\0_\0C\0H\0E\0C\0K\0S\0U\0M\0=\0"\00\0x\03\0B\06\00\0F\0"\0 \0L\0I\0N\0K\0E\0R\0_\0V\0E\0R\0S\0I\0O\0N\0=\0"\00\0x\00\0"\0 \0L\0I\0N\0K\0_\0D\0A\0T\0E\0=\0"\00\09\0/\01\03\0/\02\00\00\07\0 \01\00\0:\00\07\0:\04\01\0"\0 \0U\0P\0T\0O\0_\0L\0I\0N\0K\0_\0D\0A\0T\0E\0=\0"\00\09\0/\01\03\0/\02\00\00\07\0 \01\00\0:\00\07\0:\04\01\0"\0 \0/\0>\0\15\0\12\0", 418, 0x0, 0, ... \00\0x\00\0 (228, 0, 0, 0, " \0 \0 \0 \0<\0M\0A\0T\0C\0H\0I\0N\0G\0_\0F\0I\0L\0E\0 \0N\0A\0M\0E\0=\0"\0p\0a\0c\0k\0e\0d\0.\0e\0x\0e\0"\0 \0S\0I\0Z\0E\0=\0"\02\06\05\02\01\06\0"\0 \0C\0H\0E\0C\0K\0S\0U\0M\0=\0"\00\0x\09\02\0E\04\0B\0E\0B\0D\0"\0 \0M\0O\0D\0U\0L\0E\0_\0T\0Y\0P\0E\0=\0"\0W\0I\0N\03\02\0"\0 \0P\0E\0_\0C\0H\0E\0C\0K\0S\0U\0M\0=\0"\00\0x\03\0B\06\00\0F\0"\0 \0L\0I\0N\0K\0E\0R\0_\0V\0E\0R\0S\0I\0O\0N\0=\0"\00\0x\00\0"\0 \0L\0I\0N\0K\0_\0D\0A\0T\0E\0=\0"\00\09\0/\01\03\0/\02\00\00\07\0 \01\00\0:\00\07\0:\04\01\0"\0 \0U\0P\0T\0O\0_\0L\0I\0N\0K\0_\0D\0A\0T\0E\0=\0"\00\09\0/\01\03\0/\02\00\00\07\0 \01\00\0:\00\07\0:\04\01\0"\0 \0/\0>\0\15\0\12\0", 418, 0x0, 0, ... \00\09\0/\01\03\0/\02\00\00\07\0 \01\00\0:\00\07\0:\04\01\0 (228, 0, 0, 0, " \0 \0 \0 \0<\0M\0A\0T\0C\0H\0I\0N\0G\0_\0F\0I\0L\0E\0 \0N\0A\0M\0E\0=\0"\0p\0a\0c\0k\0e\0d\0.\0e\0x\0e\0"\0 \0S\0I\0Z\0E\0=\0"\02\06\05\02\01\06\0"\0 \0C\0H\0E\0C\0K\0S\0U\0M\0=\0"\00\0x\09\02\0E\04\0B\0E\0B\0D\0"\0 \0M\0O\0D\0U\0L\0E\0_\0T\0Y\0P\0E\0=\0"\0W\0I\0N\03\02\0"\0 \0P\0E\0_\0C\0H\0E\0C\0K\0S\0U\0M\0=\0"\00\0x\03\0B\06\00\0F\0"\0 \0L\0I\0N\0K\0E\0R\0_\0V\0E\0R\0S\0I\0O\0N\0=\0"\00\0x\00\0"\0 \0L\0I\0N\0K\0_\0D\0A\0T\0E\0=\0"\00\09\0/\01\03\0/\02\00\00\07\0 \01\00\0:\00\07\0:\04\01\0"\0 \0U\0P\0T\0O\0_\0L\0I\0N\0K\0_\0D\0A\0T\0E\0=\0"\00\09\0/\01\03\0/\02\00\00\07\0 \01\00\0:\00\07\0:\04\01\0"\0 \0/\0>\0\15\0\12\0", 418, 0x0, 0, ... \00\09\0/\01\03\0/\02\00\00\07\0 \01\00\0:\00\07\0:\04\01\0 (228, 0, 0, 0, " \0 \0 \0 \0<\0M\0A\0T\0C\0H\0I\0N\0G\0_\0F\0I\0L\0E\0 \0N\0A\0M\0E\0=\0"\0p\0a\0c\0k\0e\0d\0.\0e\0x\0e\0"\0 \0S\0I\0Z\0E\0=\0"\02\06\05\02\01\06\0"\0 \0C\0H\0E\0C\0K\0S\0U\0M\0=\0"\00\0x\09\02\0E\04\0B\0E\0B\0D\0"\0 \0M\0O\0D\0U\0L\0E\0_\0T\0Y\0P\0E\0=\0"\0W\0I\0N\03\02\0"\0 \0P\0E\0_\0C\0H\0E\0C\0K\0S\0U\0M\0=\0"\00\0x\03\0B\06\00\0F\0"\0 \0L\0I\0N\0K\0E\0R\0_\0V\0E\0R\0S\0I\0O\0N\0=\0"\00\0x\00\0"\0 \0L\0I\0N\0K\0_\0D\0A\0T\0E\0=\0"\00\09\0/\01\03\0/\02\00\00\07\0 \01\00\0:\00\07\0:\04\01\0"\0 \0U\0P\0T\0O\0_\0L\0I\0N\0K\0_\0D\0A\0T\0E\0=\0"\00\09\0/\01\03\0/\02\00\00\07\0 \01\00\0:\00\07\0:\04\01\0"\0 \0/\0>\0\15\0\12\0", 418, 0x0, 0, ... , 418, 0x0, 0, ... 02127 2020 NtContinue (-142012332, 0, ... 02126 2020 NtWriteFile ... {status=0x0, info=418}, ) == 0x0 02128 2020 NtQueryDirectoryFile (232, 0, 0, 0, 1405864, 4096, BothDirectory, 0, 0x0, 0, ... ) == STATUS_NO_MORE_FILES 02129 2020 NtClose (232, ... ) == 0x0 02130 2020 NtWriteFile (228, 0, 0, 0, (228, 0, 0, 0, "<\0/\0E\0X\0E\0>\0\15\0\12\0", 16, 0x0, 0, ... {status=0x0, info=16}, ) , 16, 0x0, 0, ... {status=0x0, info=16}, ) == 0x0 02131 2020 NtClose (228, ... ) == 0x0 02132 2020 NtQueryAttributesFile ({24, 0, 0x40, 0, 0, ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\kernel32.dll"}, 1231216, ... ) }, 1231216, ... ) == 0x0 02133 2020 NtCreateFile (0x40100080, {24, 0, 0x40, 0, 1231224, (0x40100080, {24, 0, 0x40, 0, 1231224, "\??\C:\DOCUME~1\MARTIM~1\LOCALS~1\Temp\ca43_appcompat.txt"}, 0x0, 128, 0, 3, 96, 0, 0, ... 228, {status=0x0, info=1}, ) }, 0x0, 128, 0, 3, 96, 0, 0, ... 228, {status=0x0, info=1}, ) == 0x0 02134 2020 NtQueryInformationFile (228, 1231248, 24, Standard, ... {status=0x0, info=24}, ) == 0x0 02135 2020 NtSetInformationFile (228, 1231280, 8, Position, ... {status=0x0, info=0}, ) == 0x0 02136 2020 NtOpenFile (0x100001, {24, 0, 0x40, 0, 0, (0x100001, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\"}, 3, 16417, ... 232, {status=0x0, info=1}, ) }, 3, 16417, ... 232, {status=0x0, info=1}, ) == 0x0 02137 2020 NtQueryDirectoryFile (232, 0, 0, 0, 1229928, 616, BothDirectory, 1, (232, 0, 0, 0, 1229928, 616, BothDirectory, 1, "kernel32.dll", 0, ... {status=0x0, info=118}, ) , 0, ... {status=0x0, info=118}, ) == 0x0 02138 2020 NtWriteFile (228, 0, 0, 0, (228, 0, 0, 0, "<\0E\0X\0E\0 \0N\0A\0M\0E\0=\0"\0k\0e\0r\0n\0e\0l\03\02\0.\0d\0l\0l\0"\0 \0F\0I\0L\0T\0E\0R\0=\0"\0G\0R\0A\0B\0M\0I\0_\0F\0I\0L\0T\0E\0R\0_\0T\0H\0I\0S\0F\0I\0L\0E\0O\0N\0L\0Y\0"\0>\0\15\0\12\0", 126, 0x0, 0, ... {status=0x0, info=126}, ) \0k\0e\0r\0n\0e\0l\03\02\0.\0d\0l\0l\0 (228, 0, 0, 0, "<\0E\0X\0E\0 \0N\0A\0M\0E\0=\0"\0k\0e\0r\0n\0e\0l\03\02\0.\0d\0l\0l\0"\0 \0F\0I\0L\0T\0E\0R\0=\0"\0G\0R\0A\0B\0M\0I\0_\0F\0I\0L\0T\0E\0R\0_\0T\0H\0I\0S\0F\0I\0L\0E\0O\0N\0L\0Y\0"\0>\0\15\0\12\0", 126, 0x0, 0, ... {status=0x0, info=126}, ) \0G\0R\0A\0B\0M\0I\0_\0F\0I\0L\0T\0E\0R\0_\0T\0H\0I\0S\0F\0I\0L\0E\0O\0N\0L\0Y\0 (228, 0, 0, 0, "<\0E\0X\0E\0 \0N\0A\0M\0E\0=\0"\0k\0e\0r\0n\0e\0l\03\02\0.\0d\0l\0l\0"\0 \0F\0I\0L\0T\0E\0R\0=\0"\0G\0R\0A\0B\0M\0I\0_\0F\0I\0L\0T\0E\0R\0_\0T\0H\0I\0S\0F\0I\0L\0E\0O\0N\0L\0Y\0"\0>\0\15\0\12\0", 126, 0x0, 0, ... {status=0x0, info=126}, ) , 126, 0x0, 0, ... {status=0x0, info=126}, ) == 0x0 02139 2020 NtQueryAttributesFile ({24, 0, 0x40, 0, 0, ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\kernel32.dll"}, 1230280, ... ) }, 1230280, ... ) == 0x0 02140 2020 NtOpenFile (0x100001, {24, 0, 0x40, 0, 0, (0x100001, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32"}, 3, 16417, ... 236, {status=0x0, info=1}, ) }, 3, 16417, ... 236, {status=0x0, info=1}, ) == 0x0 02141 2020 NtQueryDirectoryFile (236, 0, 0, 0, 1229920, 592, Directory, 1, (236, 0, 0, 0, 1229920, 592, Directory, 1, "kernel32.dll", 0, ... {status=0x0, info=88}, ) , 0, ... {status=0x0, info=88}, ) == 0x0 02142 2020 NtClose (236, ... ) == 0x0 02143 2020 NtQueryInformationProcess (-1, DefaultHardErrorMode, 4, ... {process info, class 12, size 4}, 0x0, ) == 0x0 02144 2020 NtSetInformationProcess (-1, DefaultHardErrorMode, {process info, class 12, size 4}, 4, ... ) == 0x0 02145 2020 NtQueryAttributesFile ({24, 0, 0x40, 0, 0, ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\kernel32.dll"}, 1228840, ... ) }, 1228840, ... ) == 0x0 02146 2020 NtQueryAttributesFile ({24, 0, 0x40, 0, 0, ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\kernel32.dll"}, 1227612, ... ) }, 1227612, ... ) == 0x0 02147 2020 NtQueryInformationProcess (-1, DefaultHardErrorMode, 4, ... {process info, class 12, size 4}, 0x0, ) == 0x0 02148 2020 NtSetInformationProcess (-1, DefaultHardErrorMode, {process info, class 12, size 4}, 4, ... ) == 0x0 02149 2020 NtQueryDefaultLocale (1, 1229800, ... ) == 0x0 02150 2020 NtQueryInformationProcess (-1, DefaultHardErrorMode, 4, ... {process info, class 12, size 4}, 0x0, ) == 0x0 02151 2020 NtSetInformationProcess (-1, DefaultHardErrorMode, {process info, class 12, size 4}, 4, ... ) == 0x0 02152 2020 NtQueryAttributesFile ({24, 0, 0x40, 0, 0, ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\kernel32.dll"}, 1228832, ... ) }, 1228832, ... ) == 0x0 02153 2020 NtQueryAttributesFile ({24, 0, 0x40, 0, 0, ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\kernel32.dll"}, 1227604, ... ) }, 1227604, ... ) == 0x0 02154 2020 NtQueryInformationProcess (-1, DefaultHardErrorMode, 4, ... {process info, class 12, size 4}, 0x0, ) == 0x0 02155 2020 NtSetInformationProcess (-1, DefaultHardErrorMode, {process info, class 12, size 4}, 4, ... ) == 0x0 02156 2020 NtQueryDefaultLocale (1, 1229792, ... ) == 0x0 02157 2020 NtCreateFile (0x80100080, {24, 0, 0x40, 0, 0, (0x80100080, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\kernel32.dll"}, 0x0, 128, 1, 1, 96, 0, 0, ... 236, {status=0x0, info=1}, ) }, 0x0, 128, 1, 1, 96, 0, 0, ... 236, {status=0x0, info=1}, ) == 0x0 02158 2020 NtQueryInformationFile (236, 1230396, 24, Standard, ... {status=0x0, info=24}, ) == 0x0 02159 2020 NtCreateSection (0x4, 0x0, 0x0, 2, 134217728, 236, ... 240, ) == 0x0 02160 2020 NtMapViewOfSection (240, -1, (0x0), 0, 0, 0x0, 0, 2, 0, 2, ... (0xc00000), 0x0, 987136, ) == 0x0 02161 2020 NtUnmapViewOfSection (-1, 0xc00000, ... ) == 0x0 02162 2020 NtClose (240, ... ) == 0x0 02163 2020 NtClose (236, ... ) == 0x0 02164 2020 NtQueryDefaultUILanguage (1229752, ... 02165 2020 NtOpenThreadTokenEx (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN 02166 2020 NtOpenProcessTokenEx (-1, 0x20008, 512, ... -2147482576, ) == 0x0 02167 2020 NtQueryInformationToken (-2147482576, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0 02168 2020 NtClose (-2147482576, ... ) == 0x0 02169 2020 NtOpenKey (0x2000000, {24, 0, 0x640, 0, 0, (0x2000000, {24, 0, 0x640, 0, 0, "\REGISTRY\USER\S-1-5-21-1292428093-1383384898-725345543-1003"}, ... -2147482576, ) }, ... -2147482576, ) == 0x0 02170 2020 NtOpenKey (0x80000000, {24, -2147482576, 0x240, 0, 0, (0x80000000, {24, -2147482576, 0x240, 0, 0, "Software\Policies\Microsoft\Control Panel\Desktop"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 02171 2020 NtOpenKey (0x80000000, {24, -2147482576, 0x640, 0, 0, (0x80000000, {24, -2147482576, 0x640, 0, 0, "Control Panel\Desktop"}, ... -2147482648, ) }, ... -2147482648, ) == 0x0 02172 2020 NtQueryValueKey (-2147482648, (-2147482648, "MultiUILanguageId", Partial, 256, ... ) , Partial, 256, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 02173 2020 NtClose (-2147482648, ... ) == 0x0 02174 2020 NtClose (-2147482576, ... ) == 0x0 02164 2020 NtQueryDefaultUILanguage ... ) == 0x0 02175 2020 NtWriteFile (228, 0, 0, 0, (228, 0, 0, 0, " \0 \0 \0 \0<\0M\0A\0T\0C\0H\0I\0N\0G\0_\0F\0I\0L\0E\0 \0N\0A\0M\0E\0=\0"\0k\0e\0r\0n\0e\0l\03\02\0.\0d\0l\0l\0"\0 \0S\0I\0Z\0E\0=\0"\09\08\04\05\07\06\0"\0 \0C\0H\0E\0C\0K\0S\0U\0M\0=\0"\00\0x\0F\00\0B\03\03\01\0F\06\0"\0 \0B\0I\0N\0_\0F\0I\0L\0E\0_\0V\0E\0R\0S\0I\0O\0N\0=\0"\05\0.\01\0.\02\06\00\00\0.\03\01\01\09\0"\0 \0B\0I\0N\0_\0P\0R\0O\0D\0U\0C\0T\0_\0V\0E\0R\0S\0I\0O\0N\0=\0"\05\0.\01\0.\02\06\00\00\0.\03\01\01\09\0"\0 \0P\0R\0O\0D\0U\0C\0T\0_\0V\0E\0R\0S\0I\0O\0N\0=\0"\05\0.\01\0.\02\06\00\00\0.\03\01\01\09\0"\0 \0F\0I\0L\0E\0_\0D\0E\0S\0C\0R\0I\0P\0T\0I\0O\0N\0=\0"\0W\0i\0n\0d\0o\0w\0s\0 \0N\0T\0 \0B\0A\0S\0E\0 \0A\0P\0I\0 \0C\0l\0i\0e\0n\0t\0 \0D\0L\0L\0"\0 \0C\0O\0M\0P\0A\0N\0Y\0_\0N\0A\0M\0E\0=\0"\0M\0i\0c\0r\0o\0s\0o\0f\0t\0 \0", 1666, 0x0, 0, ... {status=0x0, info=1666}, ) \0k\0e\0r\0n\0e\0l\03\02\0.\0d\0l\0l\0 (228, 0, 0, 0, " \0 \0 \0 \0<\0M\0A\0T\0C\0H\0I\0N\0G\0_\0F\0I\0L\0E\0 \0N\0A\0M\0E\0=\0"\0k\0e\0r\0n\0e\0l\03\02\0.\0d\0l\0l\0"\0 \0S\0I\0Z\0E\0=\0"\09\08\04\05\07\06\0"\0 \0C\0H\0E\0C\0K\0S\0U\0M\0=\0"\00\0x\0F\00\0B\03\03\01\0F\06\0"\0 \0B\0I\0N\0_\0F\0I\0L\0E\0_\0V\0E\0R\0S\0I\0O\0N\0=\0"\05\0.\01\0.\02\06\00\00\0.\03\01\01\09\0"\0 \0B\0I\0N\0_\0P\0R\0O\0D\0U\0C\0T\0_\0V\0E\0R\0S\0I\0O\0N\0=\0"\05\0.\01\0.\02\06\00\00\0.\03\01\01\09\0"\0 \0P\0R\0O\0D\0U\0C\0T\0_\0V\0E\0R\0S\0I\0O\0N\0=\0"\05\0.\01\0.\02\06\00\00\0.\03\01\01\09\0"\0 \0F\0I\0L\0E\0_\0D\0E\0S\0C\0R\0I\0P\0T\0I\0O\0N\0=\0"\0W\0i\0n\0d\0o\0w\0s\0 \0N\0T\0 \0B\0A\0S\0E\0 \0A\0P\0I\0 \0C\0l\0i\0e\0n\0t\0 \0D\0L\0L\0"\0 \0C\0O\0M\0P\0A\0N\0Y\0_\0N\0A\0M\0E\0=\0"\0M\0i\0c\0r\0o\0s\0o\0f\0t\0 \0", 1666, 0x0, 0, ... {status=0x0, info=1666}, ) \09\08\04\05\07\06\0 (228, 0, 0, 0, " \0 \0 \0 \0<\0M\0A\0T\0C\0H\0I\0N\0G\0_\0F\0I\0L\0E\0 \0N\0A\0M\0E\0=\0"\0k\0e\0r\0n\0e\0l\03\02\0.\0d\0l\0l\0"\0 \0S\0I\0Z\0E\0=\0"\09\08\04\05\07\06\0"\0 \0C\0H\0E\0C\0K\0S\0U\0M\0=\0"\00\0x\0F\00\0B\03\03\01\0F\06\0"\0 \0B\0I\0N\0_\0F\0I\0L\0E\0_\0V\0E\0R\0S\0I\0O\0N\0=\0"\05\0.\01\0.\02\06\00\00\0.\03\01\01\09\0"\0 \0B\0I\0N\0_\0P\0R\0O\0D\0U\0C\0T\0_\0V\0E\0R\0S\0I\0O\0N\0=\0"\05\0.\01\0.\02\06\00\00\0.\03\01\01\09\0"\0 \0P\0R\0O\0D\0U\0C\0T\0_\0V\0E\0R\0S\0I\0O\0N\0=\0"\05\0.\01\0.\02\06\00\00\0.\03\01\01\09\0"\0 \0F\0I\0L\0E\0_\0D\0E\0S\0C\0R\0I\0P\0T\0I\0O\0N\0=\0"\0W\0i\0n\0d\0o\0w\0s\0 \0N\0T\0 \0B\0A\0S\0E\0 \0A\0P\0I\0 \0C\0l\0i\0e\0n\0t\0 \0D\0L\0L\0"\0 \0C\0O\0M\0P\0A\0N\0Y\0_\0N\0A\0M\0E\0=\0"\0M\0i\0c\0r\0o\0s\0o\0f\0t\0 \0", 1666, 0x0, 0, ... {status=0x0, info=1666}, ) \00\0x\0F\00\0B\03\03\01\0F\06\0 (228, 0, 0, 0, " \0 \0 \0 \0<\0M\0A\0T\0C\0H\0I\0N\0G\0_\0F\0I\0L\0E\0 \0N\0A\0M\0E\0=\0"\0k\0e\0r\0n\0e\0l\03\02\0.\0d\0l\0l\0"\0 \0S\0I\0Z\0E\0=\0"\09\08\04\05\07\06\0"\0 \0C\0H\0E\0C\0K\0S\0U\0M\0=\0"\00\0x\0F\00\0B\03\03\01\0F\06\0"\0 \0B\0I\0N\0_\0F\0I\0L\0E\0_\0V\0E\0R\0S\0I\0O\0N\0=\0"\05\0.\01\0.\02\06\00\00\0.\03\01\01\09\0"\0 \0B\0I\0N\0_\0P\0R\0O\0D\0U\0C\0T\0_\0V\0E\0R\0S\0I\0O\0N\0=\0"\05\0.\01\0.\02\06\00\00\0.\03\01\01\09\0"\0 \0P\0R\0O\0D\0U\0C\0T\0_\0V\0E\0R\0S\0I\0O\0N\0=\0"\05\0.\01\0.\02\06\00\00\0.\03\01\01\09\0"\0 \0F\0I\0L\0E\0_\0D\0E\0S\0C\0R\0I\0P\0T\0I\0O\0N\0=\0"\0W\0i\0n\0d\0o\0w\0s\0 \0N\0T\0 \0B\0A\0S\0E\0 \0A\0P\0I\0 \0C\0l\0i\0e\0n\0t\0 \0D\0L\0L\0"\0 \0C\0O\0M\0P\0A\0N\0Y\0_\0N\0A\0M\0E\0=\0"\0M\0i\0c\0r\0o\0s\0o\0f\0t\0 \0", 1666, 0x0, 0, ... {status=0x0, info=1666}, ) \05\0.\01\0.\02\06\00\00\0.\03\01\01\09\0 (228, 0, 0, 0, " \0 \0 \0 \0<\0M\0A\0T\0C\0H\0I\0N\0G\0_\0F\0I\0L\0E\0 \0N\0A\0M\0E\0=\0"\0k\0e\0r\0n\0e\0l\03\02\0.\0d\0l\0l\0"\0 \0S\0I\0Z\0E\0=\0"\09\08\04\05\07\06\0"\0 \0C\0H\0E\0C\0K\0S\0U\0M\0=\0"\00\0x\0F\00\0B\03\03\01\0F\06\0"\0 \0B\0I\0N\0_\0F\0I\0L\0E\0_\0V\0E\0R\0S\0I\0O\0N\0=\0"\05\0.\01\0.\02\06\00\00\0.\03\01\01\09\0"\0 \0B\0I\0N\0_\0P\0R\0O\0D\0U\0C\0T\0_\0V\0E\0R\0S\0I\0O\0N\0=\0"\05\0.\01\0.\02\06\00\00\0.\03\01\01\09\0"\0 \0P\0R\0O\0D\0U\0C\0T\0_\0V\0E\0R\0S\0I\0O\0N\0=\0"\05\0.\01\0.\02\06\00\00\0.\03\01\01\09\0"\0 \0F\0I\0L\0E\0_\0D\0E\0S\0C\0R\0I\0P\0T\0I\0O\0N\0=\0"\0W\0i\0n\0d\0o\0w\0s\0 \0N\0T\0 \0B\0A\0S\0E\0 \0A\0P\0I\0 \0C\0l\0i\0e\0n\0t\0 \0D\0L\0L\0"\0 \0C\0O\0M\0P\0A\0N\0Y\0_\0N\0A\0M\0E\0=\0"\0M\0i\0c\0r\0o\0s\0o\0f\0t\0 \0", 1666, 0x0, 0, ... {status=0x0, info=1666}, ) \05\0.\01\0.\02\06\00\00\0.\03\01\01\09\0 (228, 0, 0, 0, " \0 \0 \0 \0<\0M\0A\0T\0C\0H\0I\0N\0G\0_\0F\0I\0L\0E\0 \0N\0A\0M\0E\0=\0"\0k\0e\0r\0n\0e\0l\03\02\0.\0d\0l\0l\0"\0 \0S\0I\0Z\0E\0=\0"\09\08\04\05\07\06\0"\0 \0C\0H\0E\0C\0K\0S\0U\0M\0=\0"\00\0x\0F\00\0B\03\03\01\0F\06\0"\0 \0B\0I\0N\0_\0F\0I\0L\0E\0_\0V\0E\0R\0S\0I\0O\0N\0=\0"\05\0.\01\0.\02\06\00\00\0.\03\01\01\09\0"\0 \0B\0I\0N\0_\0P\0R\0O\0D\0U\0C\0T\0_\0V\0E\0R\0S\0I\0O\0N\0=\0"\05\0.\01\0.\02\06\00\00\0.\03\01\01\09\0"\0 \0P\0R\0O\0D\0U\0C\0T\0_\0V\0E\0R\0S\0I\0O\0N\0=\0"\05\0.\01\0.\02\06\00\00\0.\03\01\01\09\0"\0 \0F\0I\0L\0E\0_\0D\0E\0S\0C\0R\0I\0P\0T\0I\0O\0N\0=\0"\0W\0i\0n\0d\0o\0w\0s\0 \0N\0T\0 \0B\0A\0S\0E\0 \0A\0P\0I\0 \0C\0l\0i\0e\0n\0t\0 \0D\0L\0L\0"\0 \0C\0O\0M\0P\0A\0N\0Y\0_\0N\0A\0M\0E\0=\0"\0M\0i\0c\0r\0o\0s\0o\0f\0t\0 \0", 1666, 0x0, 0, ... {status=0x0, info=1666}, ) \05\0.\01\0.\02\06\00\00\0.\03\01\01\09\0 (228, 0, 0, 0, " \0 \0 \0 \0<\0M\0A\0T\0C\0H\0I\0N\0G\0_\0F\0I\0L\0E\0 \0N\0A\0M\0E\0=\0"\0k\0e\0r\0n\0e\0l\03\02\0.\0d\0l\0l\0"\0 \0S\0I\0Z\0E\0=\0"\09\08\04\05\07\06\0"\0 \0C\0H\0E\0C\0K\0S\0U\0M\0=\0"\00\0x\0F\00\0B\03\03\01\0F\06\0"\0 \0B\0I\0N\0_\0F\0I\0L\0E\0_\0V\0E\0R\0S\0I\0O\0N\0=\0"\05\0.\01\0.\02\06\00\00\0.\03\01\01\09\0"\0 \0B\0I\0N\0_\0P\0R\0O\0D\0U\0C\0T\0_\0V\0E\0R\0S\0I\0O\0N\0=\0"\05\0.\01\0.\02\06\00\00\0.\03\01\01\09\0"\0 \0P\0R\0O\0D\0U\0C\0T\0_\0V\0E\0R\0S\0I\0O\0N\0=\0"\05\0.\01\0.\02\06\00\00\0.\03\01\01\09\0"\0 \0F\0I\0L\0E\0_\0D\0E\0S\0C\0R\0I\0P\0T\0I\0O\0N\0=\0"\0W\0i\0n\0d\0o\0w\0s\0 \0N\0T\0 \0B\0A\0S\0E\0 \0A\0P\0I\0 \0C\0l\0i\0e\0n\0t\0 \0D\0L\0L\0"\0 \0C\0O\0M\0P\0A\0N\0Y\0_\0N\0A\0M\0E\0=\0"\0M\0i\0c\0r\0o\0s\0o\0f\0t\0 \0", 1666, 0x0, 0, ... {status=0x0, info=1666}, ) \0W\0i\0n\0d\0o\0w\0s\0 \0N\0T\0 \0B\0A\0S\0E\0 \0A\0P\0I\0 \0C\0l\0i\0e\0n\0t\0 \0D\0L\0L\0 (228, 0, 0, 0, " \0 \0 \0 \0<\0M\0A\0T\0C\0H\0I\0N\0G\0_\0F\0I\0L\0E\0 \0N\0A\0M\0E\0=\0"\0k\0e\0r\0n\0e\0l\03\02\0.\0d\0l\0l\0"\0 \0S\0I\0Z\0E\0=\0"\09\08\04\05\07\06\0"\0 \0C\0H\0E\0C\0K\0S\0U\0M\0=\0"\00\0x\0F\00\0B\03\03\01\0F\06\0"\0 \0B\0I\0N\0_\0F\0I\0L\0E\0_\0V\0E\0R\0S\0I\0O\0N\0=\0"\05\0.\01\0.\02\06\00\00\0.\03\01\01\09\0"\0 \0B\0I\0N\0_\0P\0R\0O\0D\0U\0C\0T\0_\0V\0E\0R\0S\0I\0O\0N\0=\0"\05\0.\01\0.\02\06\00\00\0.\03\01\01\09\0"\0 \0P\0R\0O\0D\0U\0C\0T\0_\0V\0E\0R\0S\0I\0O\0N\0=\0"\05\0.\01\0.\02\06\00\00\0.\03\01\01\09\0"\0 \0F\0I\0L\0E\0_\0D\0E\0S\0C\0R\0I\0P\0T\0I\0O\0N\0=\0"\0W\0i\0n\0d\0o\0w\0s\0 \0N\0T\0 \0B\0A\0S\0E\0 \0A\0P\0I\0 \0C\0l\0i\0e\0n\0t\0 \0D\0L\0L\0"\0 \0C\0O\0M\0P\0A\0N\0Y\0_\0N\0A\0M\0E\0=\0"\0M\0i\0c\0r\0o\0s\0o\0f\0t\0 \0", 1666, 0x0, 0, ... {status=0x0, info=1666}, ) \0M\0i\0c\0r\0o\0s\0o\0f\0t\0 \0", 1666, 0x0, 0, ... {status=0x0, info=1666}, ) == 0x0 02176 2020 NtQueryDirectoryFile (232, 0, 0, 0, 1397160, 4096, BothDirectory, 0, 0x0, 0, ... ) == STATUS_NO_MORE_FILES 02177 2020 NtClose (232, ... ) == 0x0 02178 2020 NtWriteFile (228, 0, 0, 0, (228, 0, 0, 0, "<\0/\0E\0X\0E\0>\0\15\0\12\0<\0/\0D\0A\0T\0A\0B\0A\0S\0E\0>\0\15\0\12\0", 42, 0x0, 0, ... {status=0x0, info=42}, ) , 42, 0x0, 0, ... {status=0x0, info=42}, ) == 0x0 02179 2020 NtClose (228, ... ) == 0x0 02180 2020 NtUnmapViewOfSection (-1, 0x77b40000, ... ) == 0x0 02181 2020 NtQueryInformationJobObject (0, BasicUIRestrictions, 4, ... ) == STATUS_ACCESS_DENIED 02182 2020 NtQueryAttributesFile ({24, 0, 0x40, 0, 0, ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\dwwin.exe"}, 1228488, ... ) }, 1228488, ... ) == 0x0 02183 2020 NtQueryAttributesFile ({24, 0, 0x40, 0, 0, ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\dwwin.exe"}, 1229224, ... ) }, 1229224, ... ) == 0x0 02184 2020 NtOpenFile (0x1000a1, {24, 0, 0x40, 0, 0, (0x1000a1, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\dwwin.exe"}, 5, 96, ... 228, {status=0x0, info=1}, ) }, 5, 96, ... 228, {status=0x0, info=1}, ) == 0x0 02185 2020 NtCreateSection (0xf001f, 0x0, 0x0, 16, 16777216, 228, ... 232, ) == 0x0 02186 2020 NtOpenKey (0x1, {24, 0, 0x40, 0, 0, (0x1, {24, 0, 0x40, 0, 0, "\Registry\MACHINE\System\CurrentControlSet\Control\Session Manager\AppCertDlls"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 02187 2020 NtOpenKey (0x1, {24, 0, 0x40, 0, 0, (0x1, {24, 0, 0x40, 0, 0, "\Registry\MACHINE\System\CurrentControlSet\Control\Session Manager\AppCompatibility"}, ... 236, ) }, ... 236, ) == 0x0 02188 2020 NtQueryValueKey (236, (236, "DisableAppCompat", Partial, 20, ... ) , Partial, 20, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 02189 2020 NtClose (236, ... ) == 0x0 02190 2020 NtQueryVolumeInformationFile (228, 1228500, 8, Device, ... {status=0x0, info=8}, ) == 0x0 02191 2020 NtWaitForSingleObject (120, 0, {-1000000, -1}, ... ) == 0x0 02192 2020 NtReleaseMutant (120, ... 0x0, ) == 0x0 02193 2020 NtQueryAttributesFile ({24, 0, 0x40, 0, 0, ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\Apphelp.dll"}, 1226432, ... ) }, 1226432, ... ) == 0x0 02194 2020 NtOpenFile (0x100020, {24, 0, 0x40, 0, 0, (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\Apphelp.dll"}, 5, 96, ... 236, {status=0x0, info=1}, ) }, 5, 96, ... 236, {status=0x0, info=1}, ) == 0x0 02195 2020 NtCreateSection (0xe, 0x0, 0x0, 16, 134217728, 236, ... 240, ) == 0x0 02196 2020 NtClose (236, ... ) == 0x0 02197 2020 NtMapViewOfSection (240, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 16, ... (0xc00000), 0x0, 126976, ) == 0x0 02198 2020 NtClose (240, ... ) == 0x0 02199 2020 NtUnmapViewOfSection (-1, 0xc00000, ... ) == 0x0 02200 2020 NtQueryAttributesFile ({24, 0, 0x40, 0, 0, ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\Apphelp.dll"}, 1226740, ... ) }, 1226740, ... ) == 0x0 02201 2020 NtOpenFile (0x100020, {24, 0, 0x40, 0, 0, (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\Apphelp.dll"}, 5, 96, ... 240, {status=0x0, info=1}, ) }, 5, 96, ... 240, {status=0x0, info=1}, ) == 0x0 02202 2020 NtCreateSection (0xf, 0x0, 0x0, 16, 16777216, 240, ... 236, ) == 0x0 02203 2020 NtQuerySection (236, Image, 48, ... {section info, class 1, size 48}, 0x0, ) == 0x0 02204 2020 NtClose (240, ... ) == 0x0 02205 2020 NtMapViewOfSection (236, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x77b40000), 0x0, 139264, ) == 0x0 02206 2020 NtClose (236, ... ) == 0x0 02207 2020 NtProtectVirtualMemory (-1, (0x77b41000), 524, 4, ... (0x77b41000), 4096, 32, ) == 0x0 02208 2020 NtProtectVirtualMemory (-1, (0x77b41000), 4096, 32, ... (0x77b41000), 4096, 4, ) == 0x0 02209 2020 NtFlushInstructionCache (-1, 2008289280, 524, ... ) == 0x0 02210 2020 NtOpenKey (0x80000000, {24, 0, 0x40, 0, 0, (0x80000000, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Apphelp.dll"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 02211 2020 NtCreateFile (0x80100080, {24, 0, 0x40, 0, 0, (0x80100080, {24, 0, 0x40, 0, 0, "\SystemRoot\AppPatch\sysmain.sdb"}, 0x0, 128, 1, 1, 96, 0, 0, ... 236, {status=0x0, info=1}, ) }, 0x0, 128, 1, 1, 96, 0, 0, ... 236, {status=0x0, info=1}, ) == 0x0 02212 2020 NtQueryInformationFile (236, 1226756, 24, Standard, ... {status=0x0, info=24}, ) == 0x0 02213 2020 NtCreateSection (0x4, 0x0, 0x0, 2, 134217728, 236, ... 240, ) == 0x0 02214 2020 NtMapViewOfSection (240, -1, (0x0), 0, 0, 0x0, 0, 2, 0, 2, ... (0xc00000), 0x0, 1191936, ) == 0x0 02215 2020 NtQueryInformationFile (236, 1226856, 24, Standard, ... {status=0x0, info=24}, ) == 0x0 02216 2020 NtCreateFile (0x80100080, {24, 0, 0x40, 0, 0, (0x80100080, {24, 0, 0x40, 0, 0, "\SystemRoot\AppPatch\systest.sdb"}, 0x0, 128, 1, 1, 96, 0, 0, ... ) }, 0x0, 128, 1, 1, 96, 0, 0, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 02217 2020 NtAllocateVirtualMemory (-1, 1216512, 0, 4096, 4096, 260, ... 1216512, 4096, ) == 0x0 02218 2020 NtQuerySystemInformation (Processor, 12, ... {system info, class 1, size 12}, 0x0, ) == 0x0 02219 2020 NtQueryInformationProcess (-1, Wow64, 4, ... {process info, class 26, size 4}, 0x0, ) == 0x0 02220 2020 NtOpenKey (0x101, {24, 0, 0x40, 0, 0, (0x101, {24, 0, 0x40, 0, 0, "\Registry\Machine\System\WPA\TabletPC"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 02221 2020 NtOpenKey (0x101, {24, 0, 0x40, 0, 0, (0x101, {24, 0, 0x40, 0, 0, "\Registry\Machine\SYSTEM\WPA\MediaCenter"}, ... 244, ) }, ... 244, ) == 0x0 02222 2020 NtQueryValueKey (244, (244, "Installed", Partial, 256, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) , Partial, 256, ... TitleIdx=0, Type=4, Data= (244, "Installed", Partial, 256, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) }, 16, ) == 0x0 02223 2020 NtClose (244, ... ) == 0x0 02224 2020 NtCreateFile (0x120116, {24, 0, 0x40, 0, 0, (0x120116, {24, 0, 0x40, 0, 0, "\Device\NamedPipe\ShimViewer"}, 0x0, 128, 0, 1, 0, 0, 0, ... ) }, 0x0, 128, 0, 1, 0, 0, 0, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 02225 2020 NtOpenFile (0x100001, {24, 0, 0x40, 0, 0, (0x100001, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\"}, 3, 16417, ... 244, {status=0x0, info=1}, ) }, 3, 16417, ... 244, {status=0x0, info=1}, ) == 0x0 02226 2020 NtQueryDirectoryFile (244, 0, 0, 0, 1224452, 616, BothDirectory, 1, (244, 0, 0, 0, 1224452, 616, BothDirectory, 1, "dwwin.exe", 0, ... {status=0x0, info=112}, ) , 0, ... {status=0x0, info=112}, ) == 0x0 02227 2020 NtClose (244, ... ) == 0x0 02228 2020 NtQueryInformationProcess (-1, DefaultHardErrorMode, 4, ... {process info, class 12, size 4}, 0x0, ) == 0x0 02229 2020 NtSetInformationProcess (-1, DefaultHardErrorMode, {process info, class 12, size 4}, 4, ... ) == 0x0 02230 2020 NtQueryAttributesFile ({24, 0, 0x40, 0, 0, ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\dwwin.exe"}, 1224828, ... ) }, 1224828, ... ) == 0x0 02231 2020 NtOpenFile (0x100001, {24, 0, 0x40, 0, 0, (0x100001, {24, 0, 0x40, 0, 0, "\??\C:\"}, 3, 16417, ... 244, {status=0x0, info=1}, ) }, 3, 16417, ... 244, {status=0x0, info=1}, ) == 0x0 02232 2020 NtQueryDirectoryFile (244, 0, 0, 0, 1224256, 616, BothDirectory, 1, (244, 0, 0, 0, 1224256, 616, BothDirectory, 1, "WINDOWS", 0, ... {status=0x0, info=108}, ) , 0, ... {status=0x0, info=108}, ) == 0x0 02233 2020 NtClose (244, ... ) == 0x0 02234 2020 NtOpenFile (0x100001, {24, 0, 0x40, 0, 0, (0x100001, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\"}, 3, 16417, ... 244, {status=0x0, info=1}, ) }, 3, 16417, ... 244, {status=0x0, info=1}, ) == 0x0 02235 2020 NtQueryDirectoryFile (244, 0, 0, 0, 1224256, 616, BothDirectory, 1, (244, 0, 0, 0, 1224256, 616, BothDirectory, 1, "system32", 0, ... {status=0x0, info=110}, ) , 0, ... {status=0x0, info=110}, ) == 0x0 02236 2020 NtClose (244, ... ) == 0x0 02237 2020 NtOpenFile (0x100001, {24, 0, 0x40, 0, 0, (0x100001, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\"}, 3, 16417, ... 244, {status=0x0, info=1}, ) }, 3, 16417, ... 244, {status=0x0, info=1}, ) == 0x0 02238 2020 NtQueryDirectoryFile (244, 0, 0, 0, 1224256, 616, BothDirectory, 1, (244, 0, 0, 0, 1224256, 616, BothDirectory, 1, "dwwin.exe", 0, ... {status=0x0, info=112}, ) , 0, ... {status=0x0, info=112}, ) == 0x0 02239 2020 NtClose (244, ... ) == 0x0 02240 2020 NtQueryInformationProcess (-1, DefaultHardErrorMode, 4, ... {process info, class 12, size 4}, 0x0, ) == 0x0 02241 2020 NtSetInformationProcess (-1, DefaultHardErrorMode, {process info, class 12, size 4}, 4, ... ) == 0x0 02242 2020 NtQueryInformationProcess (-1, DeviceMap, 36, ... {process info, class 23, size 36}, 0x0, ) == 0x0 02243 2020 NtOpenKey (0x80000100, {24, 0, 0x40, 0, 0, (0x80000100, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Layers"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 02244 2020 NtOpenThreadTokenEx (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN 02245 2020 NtOpenProcessTokenEx (-1, 0x20008, 512, ... 244, ) == 0x0 02246 2020 NtQueryInformationToken (244, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0 02247 2020 NtClose (244, ... ) == 0x0 02248 2020 NtOpenKey (0x80000100, {24, 0, 0x40, 0, 0, (0x80000100, {24, 0, 0x40, 0, 0, "\REGISTRY\USER\S-1-5-21-1292428093-1383384898-725345543-1003\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Layers"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 02249 2020 NtOpenKey (0x80000100, {24, 0, 0x40, 0, 0, (0x80000100, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Custom\dwwin.exe"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 02250 2020 NtQueryAttributesFile ({24, 0, 0x40, 0, 0, ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\dwwin.exe"}, 1225660, ... ) }, 1225660, ... ) == 0x0 02251 2020 NtQueryInformationProcess (-1, DefaultHardErrorMode, 4, ... {process info, class 12, size 4}, 0x0, ) == 0x0 02252 2020 NtSetInformationProcess (-1, DefaultHardErrorMode, {process info, class 12, size 4}, 4, ... ) == 0x0 02253 2020 NtQueryAttributesFile ({24, 0, 0x40, 0, 0, ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\dwwin.exe"}, 1224528, ... ) }, 1224528, ... ) == 0x0 02254 2020 NtOpenFile (0x100020, {24, 0, 0x40, 0, 0, (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\dwwin.exe"}, 5, 96, ... 244, {status=0x0, info=1}, ) }, 5, 96, ... 244, {status=0x0, info=1}, ) == 0x0 02255 2020 NtCreateSection (0xe, 0x0, 0x0, 16, 134217728, 244, ... 248, ) == 0x0 02256 2020 NtClose (244, ... ) == 0x0 02257 2020 NtMapViewOfSection (248, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 16, ... (0xd30000), 0x0, 180224, ) == 0x0 02258 2020 NtClose (248, ... ) == 0x0 02259 2020 NtUnmapViewOfSection (-1, 0xd30000, ... ) == 0x0 02260 2020 NtQueryAttributesFile ({24, 0, 0x40, 0, 0, ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\dwwin.exe"}, 1224124, ... ) }, 1224124, ... ) == 0x0 02261 2020 NtCreateFile (0x80100080, {24, 0, 0x40, 0, 1224868, (0x80100080, {24, 0, 0x40, 0, 1224868, "\??\C:\WINDOWS\system32\dwwin.exe"}, 0x0, 0, 5, 1, 96, 0, 0, ... 248, {status=0x0, info=1}, ) }, 0x0, 0, 5, 1, 96, 0, 0, ... 248, {status=0x0, info=1}, ) == 0x0 02262 2020 NtCreateSection (0xf0005, 0x0, 0x0, 2, 134217728, 248, ... 244, ) == 0x0 02263 2020 NtClose (248, ... ) == 0x0 02264 2020 NtMapViewOfSection (244, -1, (0x0), 0, 0, {0, 0}, 0, 1, 0, 2, ... (0xd30000), {0, 0}, 180224, ) == 0x0 02265 2020 NtClose (244, ... ) == 0x0 02266 2020 NtQueryInformationProcess (-1, DefaultHardErrorMode, 4, ... {process info, class 12, size 4}, 0x0, ) == 0x0 02267 2020 NtSetInformationProcess (-1, DefaultHardErrorMode, {process info, class 12, size 4}, 4, ... ) == 0x0 02268 2020 NtQueryDefaultLocale (1, 1225488, ... ) == 0x0 02269 2020 NtQueryVirtualMemory (-1, 0xd30000, Basic, 28, ... {BaseAddress=0xd30000,AllocationBase=0xd30000,AllocationProtect=0x2,RegionSize=0x2c000,State=0x1000,Protect=0x2,Type=0x40000,}, 0x0, ) == 0x0 02270 2020 NtQueryVirtualMemory (-1, 0xd30000, Basic, 28, ... {BaseAddress=0xd30000,AllocationBase=0xd30000,AllocationProtect=0x2,RegionSize=0x2c000,State=0x1000,Protect=0x2,Type=0x40000,}, 0x0, ) == 0x0 02271 2020 NtUnmapViewOfSection (-1, 0xd30000, ... ) == 0x0 02272 2020 NtQueryInformationProcess (-1, DefaultHardErrorMode, 4, ... {process info, class 12, size 4}, 0x0, ) == 0x0 02273 2020 NtSetInformationProcess (-1, DefaultHardErrorMode, {process info, class 12, size 4}, 4, ... ) == 0x0 02274 2020 NtQueryAttributesFile ({24, 0, 0x40, 0, 0, ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\dwwin.exe"}, 1224520, ... ) }, 1224520, ... ) == 0x0 02275 2020 NtOpenFile (0x100020, {24, 0, 0x40, 0, 0, (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\dwwin.exe"}, 5, 96, ... 244, {status=0x0, info=1}, ) }, 5, 96, ... 244, {status=0x0, info=1}, ) == 0x0 02276 2020 NtCreateSection (0xe, 0x0, 0x0, 16, 134217728, 244, ... 248, ) == 0x0 02277 2020 NtClose (244, ... ) == 0x0 02278 2020 NtMapViewOfSection (248, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 16, ... (0xd30000), 0x0, 180224, ) == 0x0 02279 2020 NtClose (248, ... ) == 0x0 02280 2020 NtUnmapViewOfSection (-1, 0xd30000, ... ) == 0x0 02281 2020 NtQueryAttributesFile ({24, 0, 0x40, 0, 0, ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\dwwin.exe"}, 1224116, ... ) }, 1224116, ... ) == 0x0 02282 2020 NtCreateFile (0x80100080, {24, 0, 0x40, 0, 1224860, (0x80100080, {24, 0, 0x40, 0, 1224860, "\??\C:\WINDOWS\system32\dwwin.exe"}, 0x0, 0, 5, 1, 96, 0, 0, ... 248, {status=0x0, info=1}, ) }, 0x0, 0, 5, 1, 96, 0, 0, ... 248, {status=0x0, info=1}, ) == 0x0 02283 2020 NtCreateSection (0xf0005, 0x0, 0x0, 2, 134217728, 248, ... 244, ) == 0x0 02284 2020 NtClose (248, ... ) == 0x0 02285 2020 NtMapViewOfSection (244, -1, (0x0), 0, 0, {0, 0}, 0, 1, 0, 2, ... (0xd30000), {0, 0}, 180224, ) == 0x0 02286 2020 NtClose (244, ... ) == 0x0 02287 2020 NtQueryInformationProcess (-1, DefaultHardErrorMode, 4, ... {process info, class 12, size 4}, 0x0, ) == 0x0 02288 2020 NtSetInformationProcess (-1, DefaultHardErrorMode, {process info, class 12, size 4}, 4, ... ) == 0x0 02289 2020 NtQueryDefaultLocale (1, 1225480, ... ) == 0x0 02290 2020 NtQueryVirtualMemory (-1, 0xd30000, Basic, 28, ... {BaseAddress=0xd30000,AllocationBase=0xd30000,AllocationProtect=0x2,RegionSize=0x2c000,State=0x1000,Protect=0x2,Type=0x40000,}, 0x0, ) == 0x0 02291 2020 NtUnmapViewOfSection (-1, 0xd30000, ... ) == 0x0 02292 2020 NtOpenKey (0x80000100, {24, 0, 0x40, 0, 0, (0x80000100, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 02293 2020 NtOpenThreadTokenEx (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN 02294 2020 NtOpenProcessTokenEx (-1, 0x20008, 512, ... 244, ) == 0x0 02295 2020 NtQueryInformationToken (244, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0 02296 2020 NtClose (244, ... ) == 0x0 02297 2020 NtOpenKey (0x80000100, {24, 0, 0x40, 0, 0, (0x80000100, {24, 0, 0x40, 0, 0, "\REGISTRY\USER\S-1-5-21-1292428093-1383384898-725345543-1003\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 02298 2020 NtQueryInformationProcess (-1, DefaultHardErrorMode, 4, ... {process info, class 12, size 4}, 0x0, ) == 0x0 02299 2020 NtSetInformationProcess (-1, DefaultHardErrorMode, {process info, class 12, size 4}, 4, ... ) == 0x0 02300 2020 NtQueryAttributesFile ({24, 0, 0x40, 0, 0, ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\dwwin.exe"}, 1226080, ... ) }, 1226080, ... ) == 0x0 02301 2020 NtOpenFile (0x100001, {24, 0, 0x40, 0, 0, (0x100001, {24, 0, 0x40, 0, 0, "\??\C:\"}, 3, 16417, ... 244, {status=0x0, info=1}, ) }, 3, 16417, ... 244, {status=0x0, info=1}, ) == 0x0 02302 2020 NtQueryDirectoryFile (244, 0, 0, 0, 1225508, 616, BothDirectory, 1, (244, 0, 0, 0, 1225508, 616, BothDirectory, 1, "WINDOWS", 0, ... {status=0x0, info=108}, ) , 0, ... {status=0x0, info=108}, ) == 0x0 02303 2020 NtClose (244, ... ) == 0x0 02304 2020 NtOpenFile (0x100001, {24, 0, 0x40, 0, 0, (0x100001, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\"}, 3, 16417, ... 244, {status=0x0, info=1}, ) }, 3, 16417, ... 244, {status=0x0, info=1}, ) == 0x0 02305 2020 NtQueryDirectoryFile (244, 0, 0, 0, 1225508, 616, BothDirectory, 1, (244, 0, 0, 0, 1225508, 616, BothDirectory, 1, "system32", 0, ... {status=0x0, info=110}, ) , 0, ... {status=0x0, info=110}, ) == 0x0 02306 2020 NtClose (244, ... ) == 0x0 02307 2020 NtOpenFile (0x100001, {24, 0, 0x40, 0, 0, (0x100001, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\"}, 3, 16417, ... 244, {status=0x0, info=1}, ) }, 3, 16417, ... 244, {status=0x0, info=1}, ) == 0x0 02308 2020 NtQueryDirectoryFile (244, 0, 0, 0, 1225508, 616, BothDirectory, 1, (244, 0, 0, 0, 1225508, 616, BothDirectory, 1, "dwwin.exe", 0, ... {status=0x0, info=112}, ) , 0, ... {status=0x0, info=112}, ) == 0x0 02309 2020 NtClose (244, ... ) == 0x0 02310 2020 NtQueryInformationProcess (-1, DefaultHardErrorMode, 4, ... {process info, class 12, size 4}, 0x0, ) == 0x0 02311 2020 NtSetInformationProcess (-1, DefaultHardErrorMode, {process info, class 12, size 4}, 4, ... ) == 0x0 02312 2020 NtWaitForSingleObject (120, 0, {-1000000, -1}, ... ) == 0x0 02313 2020 NtReleaseMutant (120, ... 0x0, ) == 0x0 02314 2020 NtUnmapViewOfSection (-1, 0xc00000, ... ) == 0x0 02315 2020 NtClose (240, ... ) == 0x0 02316 2020 NtClose (236, ... ) == 0x0 02317 2020 NtOpenThreadToken (-2, 0x2000000, 1, ... ) == STATUS_NO_TOKEN 02318 2020 NtOpenProcessToken (-1, 0xa, ... 236, ) == 0x0 02319 2020 NtQueryInformationToken (236, User, 136, ... {token info, class 1, size 36}, 36, ) == 0x0 02320 2020 NtOpenKey (0x3, {24, 0, 0x40, 0, 0, (0x3, {24, 0, 0x40, 0, 0, "\Registry\MACHINE\System\CurrentControlSet\Control\SafeBoot\Option"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 02321 2020 NtOpenKey (0x1, {24, 0, 0x40, 0, 0, (0x1, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers"}, ... 240, ) }, ... 240, ) == 0x0 02322 2020 NtQueryValueKey (240, (240, "TransparentEnabled", Partial, 80, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) , Partial, 80, ... TitleIdx=0, Type=4, Data= (240, "TransparentEnabled", Partial, 80, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) }, 16, ) == 0x0 02323 2020 NtQueryValueKey (240, (240, "AuthenticodeEnabled", Partial, 80, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) , Partial, 80, ... TitleIdx=0, Type=4, Data= (240, "AuthenticodeEnabled", Partial, 80, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) }, 16, ) == 0x0 02324 2020 NtClose (240, ... ) == 0x0 02325 2020 NtOpenKey (0x20019, {24, 0, 0x40, 0, 0, (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Policies\Microsoft\Windows\Safer\LevelObjects"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 02326 2020 NtOpenKey (0x1, {24, 0, 0x40, 0, 0, (0x1, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers"}, ... 240, ) }, ... 240, ) == 0x0 02327 2020 NtQueryValueKey (240, (240, "Levels", Partial, 536, ... ) , Partial, 536, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 02328 2020 NtClose (240, ... ) == 0x0 02329 2020 NtQueryDefaultLocale (1, 1227928, ... ) == 0x0 02330 2020 NtQueryDefaultLocale (1, 1227928, ... ) == 0x0 02331 2020 NtQueryDefaultLocale (1, 1227928, ... ) == 0x0 02332 2020 NtQueryDefaultLocale (1, 1227928, ... ) == 0x0 02333 2020 NtQueryDefaultLocale (1, 1227928, ... ) == 0x0 02334 2020 NtQueryDefaultLocale (1, 1227928, ... ) == 0x0 02335 2020 NtQueryDefaultLocale (1, 1227928, ... ) == 0x0 02336 2020 NtQueryDefaultLocale (1, 1227928, ... ) == 0x0 02337 2020 NtQueryDefaultLocale (1, 1227928, ... ) == 0x0 02338 2020 NtQueryDefaultLocale (1, 1227928, ... ) == 0x0 02339 2020 NtOpenKey (0x20019, {24, 0, 0x40, 0, 0, (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\0\Paths"}, ... 240, ) }, ... 240, ) == 0x0 02340 2020 NtEnumerateKey (240, 0, Basic, 280, ... {LastWrite={0x3a5edea,0x1c74da9}, TitleIdx=0, Name= (240, 0, Basic, 280, ... {LastWrite={0x3a5edea,0x1c74da9}, TitleIdx=0, Name="{dda3f824-d8cb-441b-834d-be2efd2c1a33}"}, 92, ) }, 92, ) == 0x0 02341 2020 NtOpenKey (0x20019, {24, 240, 0x40, 0, 0, (0x20019, {24, 240, 0x40, 0, 0, "{dda3f824-d8cb-441b-834d-be2efd2c1a33}"}, ... 244, ) }, ... 244, ) == 0x0 02342 2020 NtQueryValueKey (244, (244, "ItemData", Partial, 280, ... TitleIdx=0, Type=2, Data="%\0H\0K\0E\0Y\0_\0C\0U\0R\0R\0E\0N\0T\0_\0U\0S\0E\0R\0\\0S\0o\0f\0t\0w\0a\0r\0e\0\\0M\0i\0c\0r\0o\0s\0o\0f\0t\0\\0W\0i\0n\0d\0o\0w\0s\0\\0C\0u\0r\0r\0e\0n\0t\0V\0e\0r\0s\0i\0o\0n\0\\0E\0x\0p\0l\0o\0r\0e\0r\0\\0S\0h\0e\0l\0l\0 \0F\0o\0l\0d\0e\0r\0s\0\\0C\0a\0c\0h\0e\0%\0O\0L\0K\0*\0\0\0"}, 202, ) , Partial, 280, ... TitleIdx=0, Type=2, Data= (244, "ItemData", Partial, 280, ... TitleIdx=0, Type=2, Data="%\0H\0K\0E\0Y\0_\0C\0U\0R\0R\0E\0N\0T\0_\0U\0S\0E\0R\0\\0S\0o\0f\0t\0w\0a\0r\0e\0\\0M\0i\0c\0r\0o\0s\0o\0f\0t\0\\0W\0i\0n\0d\0o\0w\0s\0\\0C\0u\0r\0r\0e\0n\0t\0V\0e\0r\0s\0i\0o\0n\0\\0E\0x\0p\0l\0o\0r\0e\0r\0\\0S\0h\0e\0l\0l\0 \0F\0o\0l\0d\0e\0r\0s\0\\0C\0a\0c\0h\0e\0%\0O\0L\0K\0*\0\0\0"}, 202, ) }, 202, ) == 0x0 02343 2020 NtQueryValueKey (244, (244, "SaferFlags", Partial, 280, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) , Partial, 280, ... TitleIdx=0, Type=4, Data= (244, "SaferFlags", Partial, 280, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) }, 16, ) == 0x0 02344 2020 NtClose (244, ... ) == 0x0 02345 2020 NtEnumerateKey (240, 1, Basic, 280, ... ) == STATUS_NO_MORE_ENTRIES 02346 2020 NtClose (240, ... ) == 0x0 02347 2020 NtOpenKey (0x20019, {24, 0, 0x40, 0, 0, (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\0\Hashes"}, ... 240, ) }, ... 240, ) == 0x0 02348 2020 NtEnumerateKey (240, 0, Basic, 280, ... {LastWrite={0x38ab3b74,0x1c74d7e}, TitleIdx=0, Name= (240, 0, Basic, 280, ... {LastWrite={0x38ab3b74,0x1c74d7e}, TitleIdx=0, Name="{349d35ab-37b5-462f-9b89-edd5fbde1328}"}, 92, ) }, 92, ) == 0x0 02349 2020 NtOpenKey (0x20019, {24, 240, 0x40, 0, 0, (0x20019, {24, 240, 0x40, 0, 0, "{349d35ab-37b5-462f-9b89-edd5fbde1328}"}, ... 244, ) }, ... 244, ) == 0x0 02350 2020 NtQueryValueKey (244, (244, "ItemData", Partial, 280, ... TitleIdx=0, Type=3, Data="^\2530O\225zI\211j\0l\341\25@\25"}, 28, ) , Partial, 280, ... TitleIdx=0, Type=3, Data= (244, "ItemData", Partial, 280, ... TitleIdx=0, Type=3, Data="^\2530O\225zI\211j\0l\341\25@\25"}, 28, ) }, 28, ) == 0x0 02351 2020 NtQueryValueKey (244, (244, "HashAlg", Partial, 280, ... TitleIdx=0, Type=4, Data="\3\200\0\0"}, 16, ) , Partial, 280, ... TitleIdx=0, Type=4, Data= (244, "HashAlg", Partial, 280, ... TitleIdx=0, Type=4, Data="\3\200\0\0"}, 16, ) }, 16, ) == 0x0 02352 2020 NtQueryValueKey (244, (244, "ItemSize", Partial, 280, ... TitleIdx=0, Type=11, Data="\13\3\0\0\0\0\0\0"}, 20, ) , Partial, 280, ... TitleIdx=0, Type=11, Data= (244, "ItemSize", Partial, 280, ... TitleIdx=0, Type=11, Data="\13\3\0\0\0\0\0\0"}, 20, ) }, 20, ) == 0x0 02353 2020 NtQueryValueKey (244, (244, "SaferFlags", Partial, 280, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) , Partial, 280, ... TitleIdx=0, Type=4, Data= (244, "SaferFlags", Partial, 280, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) }, 16, ) == 0x0 02354 2020 NtClose (244, ... ) == 0x0 02355 2020 NtEnumerateKey (240, 1, Basic, 280, ... {LastWrite={0x38ab3b74,0x1c74d7e}, TitleIdx=0, Name= (240, 1, Basic, 280, ... {LastWrite={0x38ab3b74,0x1c74d7e}, TitleIdx=0, Name="{7fb9cd2e-3076-4df9-a57b-b813f72dbb91}"}, 92, ) }, 92, ) == 0x0 02356 2020 NtOpenKey (0x20019, {24, 240, 0x40, 0, 0, (0x20019, {24, 240, 0x40, 0, 0, "{7fb9cd2e-3076-4df9-a57b-b813f72dbb91}"}, ... 244, ) }, ... 244, ) == 0x0 02357 2020 NtQueryValueKey (244, (244, "ItemData", Partial, 280, ... TitleIdx=0, Type=3, Data="g\260\324\2134:?\323\274\351\334dg\4\363\224"}, 28, ) , Partial, 280, ... TitleIdx=0, Type=3, Data= (244, "ItemData", Partial, 280, ... TitleIdx=0, Type=3, Data="g\260\324\2134:?\323\274\351\334dg\4\363\224"}, 28, ) }, 28, ) == 0x0 02358 2020 NtQueryValueKey (244, (244, "HashAlg", Partial, 280, ... TitleIdx=0, Type=4, Data="\3\200\0\0"}, 16, ) , Partial, 280, ... TitleIdx=0, Type=4, Data= (244, "HashAlg", Partial, 280, ... TitleIdx=0, Type=4, Data="\3\200\0\0"}, 16, ) }, 16, ) == 0x0 02359 2020 NtQueryValueKey (244, (244, "ItemSize", Partial, 280, ... TitleIdx=0, Type=11, Data="\5\2\0\0\0\0\0\0"}, 20, ) , Partial, 280, ... TitleIdx=0, Type=11, Data= (244, "ItemSize", Partial, 280, ... TitleIdx=0, Type=11, Data="\5\2\0\0\0\0\0\0"}, 20, ) }, 20, ) == 0x0 02360 2020 NtQueryValueKey (244, (244, "SaferFlags", Partial, 280, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) , Partial, 280, ... TitleIdx=0, Type=4, Data= (244, "SaferFlags", Partial, 280, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) }, 16, ) == 0x0 02361 2020 NtClose (244, ... ) == 0x0 02362 2020 NtEnumerateKey (240, 2, Basic, 280, ... {LastWrite={0x38ab3b74,0x1c74d7e}, TitleIdx=0, Name= (240, 2, Basic, 280, ... {LastWrite={0x38ab3b74,0x1c74d7e}, TitleIdx=0, Name="{81d1fe15-dd9d-4762-b16d-7c29ddecae3f}"}, 92, ) }, 92, ) == 0x0 02363 2020 NtOpenKey (0x20019, {24, 240, 0x40, 0, 0, (0x20019, {24, 240, 0x40, 0, 0, "{81d1fe15-dd9d-4762-b16d-7c29ddecae3f}"}, ... 244, ) }, ... 244, ) == 0x0 02364 2020 NtQueryValueKey (244, (244, "ItemData", Partial, 280, ... TitleIdx=0, Type=3, Data="2x\2\334\376\370\310\223\334\212\260\6\335\204}\35"}, 28, ) , Partial, 280, ... TitleIdx=0, Type=3, Data= (244, "ItemData", Partial, 280, ... TitleIdx=0, Type=3, Data="2x\2\334\376\370\310\223\334\212\260\6\335\204}\35"}, 28, ) }, 28, ) == 0x0 02365 2020 NtQueryValueKey (244, (244, "HashAlg", Partial, 280, ... TitleIdx=0, Type=4, Data="\3\200\0\0"}, 16, ) , Partial, 280, ... TitleIdx=0, Type=4, Data= (244, "HashAlg", Partial, 280, ... TitleIdx=0, Type=4, Data="\3\200\0\0"}, 16, ) }, 16, ) == 0x0 02366 2020 NtQueryValueKey (244, (244, "ItemSize", Partial, 280, ... TitleIdx=0, Type=11, Data="\226\3\0\0\0\0\0\0"}, 20, ) , Partial, 280, ... TitleIdx=0, Type=11, Data= (244, "ItemSize", Partial, 280, ... TitleIdx=0, Type=11, Data="\226\3\0\0\0\0\0\0"}, 20, ) }, 20, ) == 0x0 02367 2020 NtQueryValueKey (244, (244, "SaferFlags", Partial, 280, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) , Partial, 280, ... TitleIdx=0, Type=4, Data= (244, "SaferFlags", Partial, 280, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) }, 16, ) == 0x0 02368 2020 NtClose (244, ... ) == 0x0 02369 2020 NtEnumerateKey (240, 3, Basic, 280, ... {LastWrite={0x38ab3b74,0x1c74d7e}, TitleIdx=0, Name= (240, 3, Basic, 280, ... {LastWrite={0x38ab3b74,0x1c74d7e}, TitleIdx=0, Name="{94e3e076-8f53-42a5-8411-085bcc18a68d}"}, 92, ) }, 92, ) == 0x0 02370 2020 NtOpenKey (0x20019, {24, 240, 0x40, 0, 0, (0x20019, {24, 240, 0x40, 0, 0, "{94e3e076-8f53-42a5-8411-085bcc18a68d}"}, ... 244, ) }, ... 244, ) == 0x0 02371 2020 NtQueryValueKey (244, (244, "ItemData", Partial, 280, ... TitleIdx=0, Type=3, Data="\275\232*\333B\353\330V\16%\16M\370\26/g"}, 28, ) , Partial, 280, ... TitleIdx=0, Type=3, Data= (244, "ItemData", Partial, 280, ... TitleIdx=0, Type=3, Data="\275\232*\333B\353\330V\16%\16M\370\26/g"}, 28, ) }, 28, ) == 0x0 02372 2020 NtQueryValueKey (244, (244, "HashAlg", Partial, 280, ... TitleIdx=0, Type=4, Data="\3\200\0\0"}, 16, ) , Partial, 280, ... TitleIdx=0, Type=4, Data= (244, "HashAlg", Partial, 280, ... TitleIdx=0, Type=4, Data="\3\200\0\0"}, 16, ) }, 16, ) == 0x0 02373 2020 NtQueryValueKey (244, (244, "ItemSize", Partial, 280, ... TitleIdx=0, Type=11, Data="\345\0\0\0\0\0\0\0"}, 20, ) , Partial, 280, ... TitleIdx=0, Type=11, Data= (244, "ItemSize", Partial, 280, ... TitleIdx=0, Type=11, Data="\345\0\0\0\0\0\0\0"}, 20, ) }, 20, ) == 0x0 02374 2020 NtQueryValueKey (244, (244, "SaferFlags", Partial, 280, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) , Partial, 280, ... TitleIdx=0, Type=4, Data= (244, "SaferFlags", Partial, 280, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) }, 16, ) == 0x0 02375 2020 NtClose (244, ... ) == 0x0 02376 2020 NtEnumerateKey (240, 4, Basic, 280, ... {LastWrite={0x38ab3b74,0x1c74d7e}, TitleIdx=0, Name= (240, 4, Basic, 280, ... {LastWrite={0x38ab3b74,0x1c74d7e}, TitleIdx=0, Name="{dc971ee5-44eb-4fe4-ae2e-b91490411bfc}"}, 92, ) }, 92, ) == 0x0 02377 2020 NtOpenKey (0x20019, {24, 240, 0x40, 0, 0, (0x20019, {24, 240, 0x40, 0, 0, "{dc971ee5-44eb-4fe4-ae2e-b91490411bfc}"}, ... 244, ) }, ... 244, ) == 0x0 02378 2020 NtQueryValueKey (244, (244, "ItemData", Partial, 280, ... TitleIdx=0, Type=3, Data="8k\10_\204\354\366i\323k\225j"\300\36\200"}, 28, ) , Partial, 280, ... TitleIdx=0, Type=3, Data= (244, "ItemData", Partial, 280, ... TitleIdx=0, Type=3, Data="8k\10_\204\354\366i\323k\225j"\300\36\200"}, 28, ) \300\36\200"}, 28, ) == 0x0 02379 2020 NtQueryValueKey (244, (244, "HashAlg", Partial, 280, ... TitleIdx=0, Type=4, Data="\3\200\0\0"}, 16, ) , Partial, 280, ... TitleIdx=0, Type=4, Data= (244, "HashAlg", Partial, 280, ... TitleIdx=0, Type=4, Data="\3\200\0\0"}, 16, ) }, 16, ) == 0x0 02380 2020 NtQueryValueKey (244, (244, "ItemSize", Partial, 280, ... TitleIdx=0, Type=11, Data="r\1\0\0\0\0\0\0"}, 20, ) , Partial, 280, ... TitleIdx=0, Type=11, Data= (244, "ItemSize", Partial, 280, ... TitleIdx=0, Type=11, Data="r\1\0\0\0\0\0\0"}, 20, ) }, 20, ) == 0x0 02381 2020 NtQueryValueKey (244, (244, "SaferFlags", Partial, 280, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) , Partial, 280, ... TitleIdx=0, Type=4, Data= (244, "SaferFlags", Partial, 280, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) }, 16, ) == 0x0 02382 2020 NtClose (244, ... ) == 0x0 02383 2020 NtEnumerateKey (240, 5, Basic, 280, ... ) == STATUS_NO_MORE_ENTRIES 02384 2020 NtClose (240, ... ) == 0x0 02385 2020 NtOpenKey (0x20019, {24, 0, 0x40, 0, 0, (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\0\UrlZones"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 02386 2020 NtOpenKey (0x20019, {24, 0, 0x40, 0, 0, (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\4096\Paths"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 02387 2020 NtOpenKey (0x20019, {24, 0, 0x40, 0, 0, (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\4096\Hashes"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 02388 2020 NtOpenKey (0x20019, {24, 0, 0x40, 0, 0, (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\4096\UrlZones"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 02389 2020 NtOpenKey (0x20019, {24, 0, 0x40, 0, 0, (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\65536\Paths"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 02390 2020 NtOpenKey (0x20019, {24, 0, 0x40, 0, 0, (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\65536\Hashes"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 02391 2020 NtOpenKey (0x20019, {24, 0, 0x40, 0, 0, (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\65536\UrlZones"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 02392 2020 NtOpenKey (0x20019, {24, 0, 0x40, 0, 0, (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\131072\Paths"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 02393 2020 NtOpenKey (0x20019, {24, 0, 0x40, 0, 0, (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\131072\Hashes"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 02394 2020 NtOpenKey (0x20019, {24, 0, 0x40, 0, 0, (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\131072\UrlZones"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 02395 2020 NtOpenKey (0x20019, {24, 0, 0x40, 0, 0, (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\262144\Paths"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 02396 2020 NtOpenKey (0x20019, {24, 0, 0x40, 0, 0, (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\262144\Hashes"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 02397 2020 NtOpenKey (0x20019, {24, 0, 0x40, 0, 0, (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\262144\UrlZones"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 02398 2020 NtOpenThreadTokenEx (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN 02399 2020 NtOpenProcessTokenEx (-1, 0x20008, 512, ... 240, ) == 0x0 02400 2020 NtQueryInformationToken (240, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0 02401 2020 NtClose (240, ... ) == 0x0 02402 2020 NtOpenKey (0x20019, {24, 0, 0x40, 0, 0, (0x20019, {24, 0, 0x40, 0, 0, "\REGISTRY\USER\S-1-5-21-1292428093-1383384898-725345543-1003\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\0\Paths"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 02403 2020 NtOpenThreadTokenEx (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN 02404 2020 NtOpenProcessTokenEx (-1, 0x20008, 512, ... 240, ) == 0x0 02405 2020 NtQueryInformationToken (240, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0 02406 2020 NtClose (240, ... ) == 0x0 02407 2020 NtOpenKey (0x20019, {24, 0, 0x40, 0, 0, (0x20019, {24, 0, 0x40, 0, 0, "\REGISTRY\USER\S-1-5-21-1292428093-1383384898-725345543-1003\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\0\Hashes"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 02408 2020 NtOpenThreadTokenEx (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN 02409 2020 NtOpenProcessTokenEx (-1, 0x20008, 512, ... 240, ) == 0x0 02410 2020 NtQueryInformationToken (240, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0 02411 2020 NtClose (240, ... ) == 0x0 02412 2020 NtOpenKey (0x20019, {24, 0, 0x40, 0, 0, (0x20019, {24, 0, 0x40, 0, 0, "\REGISTRY\USER\S-1-5-21-1292428093-1383384898-725345543-1003\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\0\UrlZones"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 02413 2020 NtOpenThreadTokenEx (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN 02414 2020 NtOpenProcessTokenEx (-1, 0x20008, 512, ... 240, ) == 0x0 02415 2020 NtQueryInformationToken (240, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0 02416 2020 NtClose (240, ... ) == 0x0 02417 2020 NtOpenKey (0x20019, {24, 0, 0x40, 0, 0, (0x20019, {24, 0, 0x40, 0, 0, "\REGISTRY\USER\S-1-5-21-1292428093-1383384898-725345543-1003\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\4096\Paths"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 02418 2020 NtOpenThreadTokenEx (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN 02419 2020 NtOpenProcessTokenEx (-1, 0x20008, 512, ... 240, ) == 0x0 02420 2020 NtQueryInformationToken (240, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0 02421 2020 NtClose (240, ... ) == 0x0 02422 2020 NtOpenKey (0x20019, {24, 0, 0x40, 0, 0, (0x20019, {24, 0, 0x40, 0, 0, "\REGISTRY\USER\S-1-5-21-1292428093-1383384898-725345543-1003\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\4096\Hashes"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 02423 2020 NtOpenThreadTokenEx (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN 02424 2020 NtOpenProcessTokenEx (-1, 0x20008, 512, ... 240, ) == 0x0 02425 2020 NtQueryInformationToken (240, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0 02426 2020 NtClose (240, ... ) == 0x0 02427 2020 NtOpenKey (0x20019, {24, 0, 0x40, 0, 0, (0x20019, {24, 0, 0x40, 0, 0, "\REGISTRY\USER\S-1-5-21-1292428093-1383384898-725345543-1003\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\4096\UrlZones"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 02428 2020 NtOpenThreadTokenEx (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN 02429 2020 NtOpenProcessTokenEx (-1, 0x20008, 512, ... 240, ) == 0x0 02430 2020 NtQueryInformationToken (240, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0 02431 2020 NtClose (240, ... ) == 0x0 02432 2020 NtOpenKey (0x20019, {24, 0, 0x40, 0, 0, (0x20019, {24, 0, 0x40, 0, 0, "\REGISTRY\USER\S-1-5-21-1292428093-1383384898-725345543-1003\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\65536\Paths"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 02433 2020 NtOpenThreadTokenEx (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN 02434 2020 NtOpenProcessTokenEx (-1, 0x20008, 512, ... 240, ) == 0x0 02435 2020 NtQueryInformationToken (240, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0 02436 2020 NtClose (240, ... ) == 0x0 02437 2020 NtOpenKey (0x20019, {24, 0, 0x40, 0, 0, (0x20019, {24, 0, 0x40, 0, 0, "\REGISTRY\USER\S-1-5-21-1292428093-1383384898-725345543-1003\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\65536\Hashes"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 02438 2020 NtOpenThreadTokenEx (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN 02439 2020 NtOpenProcessTokenEx (-1, 0x20008, 512, ... 240, ) == 0x0 02440 2020 NtQueryInformationToken (240, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0 02441 2020 NtClose (240, ... ) == 0x0 02442 2020 NtOpenKey (0x20019, {24, 0, 0x40, 0, 0, (0x20019, {24, 0, 0x40, 0, 0, "\REGISTRY\USER\S-1-5-21-1292428093-1383384898-725345543-1003\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\65536\UrlZones"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 02443 2020 NtOpenThreadTokenEx (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN 02444 2020 NtOpenProcessTokenEx (-1, 0x20008, 512, ... 240, ) == 0x0 02445 2020 NtQueryInformationToken (240, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0 02446 2020 NtClose (240, ... ) == 0x0 02447 2020 NtOpenKey (0x20019, {24, 0, 0x40, 0, 0, (0x20019, {24, 0, 0x40, 0, 0, "\REGISTRY\USER\S-1-5-21-1292428093-1383384898-725345543-1003\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\131072\Paths"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 02448 2020 NtOpenThreadTokenEx (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN 02449 2020 NtOpenProcessTokenEx (-1, 0x20008, 512, ... 240, ) == 0x0 02450 2020 NtQueryInformationToken (240, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0 02451 2020 NtClose (240, ... ) == 0x0 02452 2020 NtOpenKey (0x20019, {24, 0, 0x40, 0, 0, (0x20019, {24, 0, 0x40, 0, 0, "\REGISTRY\USER\S-1-5-21-1292428093-1383384898-725345543-1003\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\131072\Hashes"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 02453 2020 NtOpenThreadTokenEx (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN 02454 2020 NtOpenProcessTokenEx (-1, 0x20008, 512, ... 240, ) == 0x0 02455 2020 NtQueryInformationToken (240, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0 02456 2020 NtClose (240, ... ) == 0x0 02457 2020 NtOpenKey (0x20019, {24, 0, 0x40, 0, 0, (0x20019, {24, 0, 0x40, 0, 0, "\REGISTRY\USER\S-1-5-21-1292428093-1383384898-725345543-1003\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\131072\UrlZones"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 02458 2020 NtOpenThreadTokenEx (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN 02459 2020 NtOpenProcessTokenEx (-1, 0x20008, 512, ... 240, ) == 0x0 02460 2020 NtQueryInformationToken (240, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0 02461 2020 NtClose (240, ... ) == 0x0 02462 2020 NtOpenKey (0x20019, {24, 0, 0x40, 0, 0, (0x20019, {24, 0, 0x40, 0, 0, "\REGISTRY\USER\S-1-5-21-1292428093-1383384898-725345543-1003\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\262144\Paths"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 02463 2020 NtOpenThreadTokenEx (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN 02464 2020 NtOpenProcessTokenEx (-1, 0x20008, 512, ... 240, ) == 0x0 02465 2020 NtQueryInformationToken (240, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0 02466 2020 NtClose (240, ... ) == 0x0 02467 2020 NtOpenKey (0x20019, {24, 0, 0x40, 0, 0, (0x20019, {24, 0, 0x40, 0, 0, "\REGISTRY\USER\S-1-5-21-1292428093-1383384898-725345543-1003\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\262144\Hashes"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 02468 2020 NtOpenThreadTokenEx (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN 02469 2020 NtOpenProcessTokenEx (-1, 0x20008, 512, ... 240, ) == 0x0 02470 2020 NtQueryInformationToken (240, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0 02471 2020 NtClose (240, ... ) == 0x0 02472 2020 NtOpenKey (0x20019, {24, 0, 0x40, 0, 0, (0x20019, {24, 0, 0x40, 0, 0, "\REGISTRY\USER\S-1-5-21-1292428093-1383384898-725345543-1003\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\262144\UrlZones"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 02473 2020 NtOpenKey (0x20019, {24, 0, 0x40, 0, 0, (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers"}, ... 240, ) }, ... 240, ) == 0x0 02474 2020 NtQueryValueKey (240, (240, "DefaultLevel", Full, 524, ... TitleIdx=0, Type=4, Name="DefaultLevel", Data="\0\0\4\0"}, 48, ) , Full, 524, ... TitleIdx=0, Type=4, Name= (240, "DefaultLevel", Full, 524, ... TitleIdx=0, Type=4, Name="DefaultLevel", Data="\0\0\4\0"}, 48, ) , Data= (240, "DefaultLevel", Full, 524, ... TitleIdx=0, Type=4, Name="DefaultLevel", Data="\0\0\4\0"}, 48, ) }, 48, ) == 0x0 02475 2020 NtClose (240, ... ) == 0x0 02476 2020 NtOpenThreadTokenEx (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN 02477 2020 NtOpenProcessTokenEx (-1, 0x20008, 512, ... 240, ) == 0x0 02478 2020 NtQueryInformationToken (240, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0 02479 2020 NtClose (240, ... ) == 0x0 02480 2020 NtOpenKey (0x20019, {24, 0, 0x40, 0, 0, (0x20019, {24, 0, 0x40, 0, 0, "\REGISTRY\USER\S-1-5-21-1292428093-1383384898-725345543-1003\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 02481 2020 NtOpenThreadToken (-2, 0x8, 0, ... ) == STATUS_NO_TOKEN 02482 2020 NtOpenProcessToken (-1, 0xa, ... 240, ) == 0x0 02483 2020 NtDuplicateToken (240, 0xc, {24, 0, 0x0, 0, 1228360, 0x0}, 0, 2, ... 244, ) == 0x0 02484 2020 NtClose (240, ... ) == 0x0 02485 2020 NtAccessCheck (1379992, 244, 0x1, 1228436, 1228488, 56, 1228468, ... (0x1), ) == 0x0 02486 2020 NtClose (244, ... ) == 0x0 02487 2020 NtOpenKey (0x1, {24, 0, 0x40, 0, 0, (0x1, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers"}, ... 244, ) }, ... 244, ) == 0x0 02488 2020 NtQueryValueKey (244, (244, "PolicyScope", Partial, 80, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) , Partial, 80, ... TitleIdx=0, Type=4, Data= (244, "PolicyScope", Partial, 80, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) }, 16, ) == 0x0 02489 2020 NtClose (244, ... ) == 0x0 02490 2020 NtOpenSymbolicLinkObject (0x1, {24, 0, 0x40, 0, 0, (0x1, {24, 0, 0x40, 0, 0, "\??\C:"}, ... 244, ) }, ... 244, ) == 0x0 02491 2020 NtQuerySymbolicLinkObject (244, ... (244, ... "\Device\HarddiskVolume1", 48, ) , 48, ) == 0x0 02492 2020 NtClose (244, ... ) == 0x0 02493 2020 NtQueryVolumeInformationFile (228, 1226192, 8, Device, ... {status=0x0, info=8}, ) == 0x0 02494 2020 NtQueryInformationFile (228, 1226308, 528, Name, ... {status=0x0, info=58}, ) == 0x0 02495 2020 NtQueryInformationProcess (-1, DefaultHardErrorMode, 4, ... {process info, class 12, size 4}, 0x0, ) == 0x0 02496 2020 NtSetInformationProcess (-1, DefaultHardErrorMode, {process info, class 12, size 4}, 4, ... ) == 0x0 02497 2020 NtQueryAttributesFile ({24, 0, 0x40, 0, 0, ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\dwwin.exe"}, 1225480, ... ) }, 1225480, ... ) == 0x0 02498 2020 NtOpenFile (0x100001, {24, 0, 0x40, 0, 0, (0x100001, {24, 0, 0x40, 0, 0, "\??\C:\"}, 3, 16417, ... 244, {status=0x0, info=1}, ) }, 3, 16417, ... 244, {status=0x0, info=1}, ) == 0x0 02499 2020 NtQueryDirectoryFile (244, 0, 0, 0, 1224908, 616, BothDirectory, 1, (244, 0, 0, 0, 1224908, 616, BothDirectory, 1, "WINDOWS", 0, ... {status=0x0, info=108}, ) , 0, ... {status=0x0, info=108}, ) == 0x0 02500 2020 NtClose (244, ... ) == 0x0 02501 2020 NtOpenFile (0x100001, {24, 0, 0x40, 0, 0, (0x100001, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\"}, 3, 16417, ... 244, {status=0x0, info=1}, ) }, 3, 16417, ... 244, {status=0x0, info=1}, ) == 0x0 02502 2020 NtQueryDirectoryFile (244, 0, 0, 0, 1224908, 616, BothDirectory, 1, (244, 0, 0, 0, 1224908, 616, BothDirectory, 1, "system32", 0, ... {status=0x0, info=110}, ) , 0, ... {status=0x0, info=110}, ) == 0x0 02503 2020 NtClose (244, ... ) == 0x0 02504 2020 NtOpenFile (0x100001, {24, 0, 0x40, 0, 0, (0x100001, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\"}, 3, 16417, ... 244, {status=0x0, info=1}, ) }, 3, 16417, ... 244, {status=0x0, info=1}, ) == 0x0 02505 2020 NtQueryDirectoryFile (244, 0, 0, 0, 1224908, 616, BothDirectory, 1, (244, 0, 0, 0, 1224908, 616, BothDirectory, 1, "dwwin.exe", 0, ... {status=0x0, info=112}, ) , 0, ... {status=0x0, info=112}, ) == 0x0 02506 2020 NtClose (244, ... ) == 0x0 02507 2020 NtQueryInformationProcess (-1, DefaultHardErrorMode, 4, ... {process info, class 12, size 4}, 0x0, ) == 0x0 02508 2020 NtSetInformationProcess (-1, DefaultHardErrorMode, {process info, class 12, size 4}, 4, ... ) == 0x0 02509 2020 NtQueryInformationFile (228, 1228348, 24, Standard, ... {status=0x0, info=24}, ) == 0x0 02510 2020 NtCreateSection (0xf0005, 0x0, {180224, 0}, 2, 134217728, 228, ... 244, ) == 0x0 02511 2020 NtMapViewOfSection (244, -1, (0x0), 0, 0, {0, 0}, 180224, 1, 0, 2, ... (0xc00000), {0, 0}, 180224, ) == 0x0 02512 2020 NtClose (244, ... ) == 0x0 02513 2020 NtOpenThreadTokenEx (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN 02514 2020 NtOpenProcessTokenEx (-1, 0x20008, 512, ... 244, ) == 0x0 02515 2020 NtQueryInformationToken (244, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0 02516 2020 NtClose (244, ... ) == 0x0 02517 2020 NtOpenKey (0x20019, {24, 0, 0x640, 0, 0, (0x20019, {24, 0, 0x640, 0, 0, "\REGISTRY\USER\S-1-5-21-1292428093-1383384898-725345543-1003"}, ... 244, ) }, ... 244, ) == 0x0 02518 2020 NtOpenKey (0x20019, {24, 244, 0x40, 0, 0, (0x20019, {24, 244, 0x40, 0, 0, "Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders"}, ... 240, ) }, ... 240, ) == 0x0 02519 2020 NtClose (244, ... ) == 0x0 02520 2020 NtQueryValueKey (240, (240, "Cache", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW 02521 2020 NtQueryValueKey (240, (240, "Cache", Partial, 174, ... TitleIdx=0, Type=1, Data="C\0:\0\\0D\0o\0c\0u\0m\0e\0n\0t\0s\0 \0a\0n\0d\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0M\0a\0r\0t\0i\0m\0 \0C\0a\0r\0b\0o\0n\0e\0\\0L\0o\0c\0a\0l\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0T\0e\0m\0p\0o\0r\0a\0r\0y\0 \0I\0n\0t\0e\0r\0n\0e\0t\0 \0F\0i\0l\0e\0s\0\0\0"}, 174, ) , Partial, 174, ... TitleIdx=0, Type=1, Data= (240, "Cache", Partial, 174, ... TitleIdx=0, Type=1, Data="C\0:\0\\0D\0o\0c\0u\0m\0e\0n\0t\0s\0 \0a\0n\0d\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0M\0a\0r\0t\0i\0m\0 \0C\0a\0r\0b\0o\0n\0e\0\\0L\0o\0c\0a\0l\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0T\0e\0m\0p\0o\0r\0a\0r\0y\0 \0I\0n\0t\0e\0r\0n\0e\0t\0 \0F\0i\0l\0e\0s\0\0\0"}, 174, ) }, 174, ) == 0x0 02522 2020 NtClose (240, ... ) == 0x0 02523 2020 NtUnmapViewOfSection (-1, 0xc00000, ... ) == 0x0 02524 2020 NtAllocateVirtualMemory (-1, 0, 0, 4096, 8192, 4, ... 12582912, 4096, ) == 0x0 02525 2020 NtAllocateVirtualMemory (-1, 12582912, 0, 4096, 4096, 4, ... 12582912, 4096, ) == 0x0 02526 2020 NtOpenKey (0x1, {24, 0, 0x40, 0, 0, (0x1, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers"}, ... 240, ) }, ... 240, ) == 0x0 02527 2020 NtQueryValueKey (240, (240, "LogFileName", Partial, 536, ... ) , Partial, 536, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 02528 2020 NtClose (240, ... ) == 0x0 02529 2020 NtOpenKey (0x3, {24, 0, 0x40, 0, 0, (0x3, {24, 0, 0x40, 0, 0, "\Registry\MACHINE\System\CurrentControlSet\Control\SafeBoot\Option"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 02530 2020 NtQueryInformationToken (236, User, 128, ... {token info, class 1, size 36}, 36, ) == 0x0 02531 2020 NtQueryInformationToken (236, 15, 4, ... {token info, class 15, size 4}, 4, ) == 0x0 02532 2020 NtClose (236, ... ) == 0x0 02533 2020 NtQuerySection (232, Image, 48, ... {section info, class 1, size 48}, 0x0, ) == 0x0 02534 2020 NtOpenKey (0x80000000, {24, 0, 0x40, 0, 0, (0x80000000, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\dwwin.exe"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 02535 2020 NtQuerySystemInformation (71, 4, ... {system info, class 71, size 4}, 0x0, ) == 0x0 02536 2020 NtCreateProcessEx (1230272, 2035711, 0, -1, 4, 232, 0, 0, 0, ... ) == 0x0 02537 2020 NtSetInformationProcess (236, PriorityClass, {process info, class 18, size 2}, 512, ... ) == 0x0 02538 2020 NtSetInformationProcess (236, DefaultHardErrorMode, {process info, class 12, size 4}, 4, ... ) == 0x0 02539 2020 NtQueryInformationProcess (236, Basic, 24, ... {ExitStatus=0x103,PebBaseAddress=0x7ffde000,AffinityMask=0x1,BasePriority=8,Pid=120,ParentPid=868,}, 0x0, ) == 0x0 02540 2020 NtReadVirtualMemory (236, 0x7ffde008, 4, ... (236, 0x7ffde008, 4, ... "\0\0\00", 0x0, ) , 0x0, ) == 0x0 02541 2020 NtOpenFile (0x1200a9, {24, 0, 0x40, 0, 0, (0x1200a9, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\dwwin.exe.Manifest"}, 1, 96, ... ) }, 1, 96, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 02542 2020 NtReadVirtualMemory (236, 0x30000000, 4096, ... (236, 0x30000000, 4096, ... "MZ\220\0\3\0\0\0\4\0\0\0\377\377\0\0\270\0\0\0\0\0\0\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\360\0\0\0\16\37\272\16\0\264\11\315!\270\1L\315!This program cannot be run in DOS mode.\15\15\12$\0\0\0\0\0\0\0$\206\244\23`\347\312@`\347\312@`\347\312@9\304\331@b\347\312@`\347\313@d\347\312@\210\370\301@a\347\312@\343\373\304@j\347\312@\210\370\300@I\347\312@6\370\331@h\347\312@\272\304\326@i\347\312@\220\370\301@p\347\312@`\347\312@H\346\312@Rich`\347\312@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0PE\0\0L\1\3\0N\23\216?\0\0\0\0\0\0\0\0\340\0\17\1\13\1\6\24\0\220\2\0\0\240\0\0\0\0\0\0\232t\0\0\0\20\0\0\0\320\3\0\0\0\00\0\20\0\0\0\20\0\0\4\0\0\0\0\0\0\0\4\0\0\0\0\0\0\0\0@\3\0\0\20\0\0\237*\3\0\2\0\0\0\0\0\20\0\0\20\0\0\0\0\20\0\0\20\0\0\0\0\0\0\20\0\0\0\0\0\0\0\0\0\0\0\327\211\2\0z\1\0\0\00\3\0\244\12\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0Z\236\2\08\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0`\2\0\0\370\0\0\0\0\20\0\0\270\3\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0.text\0\0\0\222\216\2\0", 4096, ) , 4096, ) == 0x0 02543 2020 NtReadVirtualMemory (236, 0x30033000, 256, ... (236, 0x30033000, 256, ... "\0\0\0\0J\23\216?\0\0\0\0\0\0\3\0\5\0\0\0(\0\0\200\13\0\0\0@\0\0\200\20\0\0\0X\0\0\200\0\0\0\0J\23\216?\0\0\0\0\0\0\1\0e\0\0\0p\0\0\200\0\0\0\0J\23\216?\0\0\0\0\0\0\1\0\1\0\0\0\210\0\0\200\0\0\0\0J\23\216?\0\0\0\0\0\0\1\0\1\0\0\0\240\0\0\200\0\0\0\0J\23\216?\0\0\0\0\0\0\1\0\11\4\0\0\270\0\0\0\0\0\0\0J\23\216?\0\0\0\0\0\0\1\0\11\4\0\0\310\0\0\0\0\0\0\0J\23\216?\0\0\0\0\0\0\1\0\11\4\0\0\330\0\0\0\3600\3\0\26\3\0\0\0\0\0\0\0\0\0\0\104\3\0\254\1\0\0\0\0\0\0\0\0\0\0\2645\3\0\360\4\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\300\0\310\200\0\0\0\0\14\0\0\0\0\0f\1", 256, ) , 256, ) == 0x0 02544 2020 NtQueryDebugFilterState (53, 2, ... ) == 0x0 02545 2020 NtQueryInformationProcess (236, Basic, 24, ... {ExitStatus=0x103,PebBaseAddress=0x7ffde000,AffinityMask=0x1,BasePriority=8,Pid=120,ParentPid=868,}, 0x0, ) == 0x0 02546 2020 NtQueryAttributesFile ({24, 0, 0x40, 0, 0, ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32"}, 1229224, ... ) }, 1229224, ... ) == 0x0 02547 2020 NtAllocateVirtualMemory (-1, 0, 0, 2428, 4096, 4, ... 12648448, 4096, ) == 0x0 02548 2020 NtAllocateVirtualMemory (236, 0, 0, 6432, 4096, 4, ... 65536, 8192, ) == 0x0 02549 2020 NtWriteVirtualMemory (236, 0x10000, (236, 0x10000, "=\0A\0:\0=\0A\0:\0\\0\0\0=\0C\0:\0=\0C\0:\0\\0s\0c\0r\0i\0p\0t\0s\0\0\0=\0U\0:\0=\0U\0:\0\\0\0\0A\0L\0L\0U\0S\0E\0R\0S\0P\0R\0O\0F\0I\0L\0E\0=\0C\0:\0\\0D\0o\0c\0u\0m\0e\0n\0t\0s\0 \0a\0n\0d\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0A\0l\0l\0 \0U\0s\0e\0r\0s\0\0\0A\0P\0P\0D\0A\0T\0A\0=\0C\0:\0\\0D\0o\0c\0u\0m\0e\0n\0t\0s\0 \0a\0n\0d\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0M\0a\0r\0t\0i\0m\0 \0C\0a\0r\0b\0o\0n\0e\0\\0A\0p\0p\0l\0i\0c\0a\0t\0i\0o\0n\0 \0D\0a\0t\0a\0\0\0A\0T\0L\0_\0I\0N\0C\0_\0P\0A\0T\0H\0=\0C\0:\0\\0W\0I\0N\0D\0D\0K\0\\03\07\09\00\0~\01\0.\01\08\03\0\\0i\0n\0c\0\0\0A\0T\0L\0_\0I\0N\0C\0_\0R\0O\0O\0T\0=\0C\0:\0\\0W\0I\0N\0D\0D\0K\0\\03\07\09\00\0~\01\0.\01\08\03\0\\0i\0n\0c\0\0\0A\0T\0L\0_\0L\0I\0B\0_\0P\0A\0T\0H\0=\0C\0:\0\\0W\0I\0N\0D\0D\0K\0\\03\07\0", 6432, ... 0x0, ) , 6432, ... 0x0, ) == 0x0 02550 2020 NtAllocateVirtualMemory (236, 0, 0, 2428, 4096, 4, ... 131072, 4096, ) == 0x0 02551 2020 NtWriteVirtualMemory (236, 0x20000, (236, 0x20000, "\0\20\0\0|\11\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\3\0\0\0\0\0\0\0\13\0\0\0&\0\10\2\220\2\0\0\16\0\0\0\364\3\366\3\230\4\0\0:\0<\0\220\10\0\0N\0P\0\314\10\0\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0:\0<\0\34\11\0\0\36\0 \0X\11\0\0\0\0\2\0x\11\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0", 2428, ... 0x0, ) , 2428, ... 0x0, ) == 0x0 02552 2020 NtWriteVirtualMemory (236, 0x7ffde010, (236, 0x7ffde010, "\0\0\2\0", 4, ... 0x0, ) , 4, ... 0x0, ) == 0x0 02553 2020 NtAllocateVirtualMemory (236, 0, 0, 388, 4096, 4, ... 196608, 4096, ) == 0x0 02554 2020 NtWriteVirtualMemory (236, 0x30000, (236, 0x30000, "S\0h\0i\0m\0E\0n\0g\0.\0d\0l\0l\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\204\1\0\0\253\355\15\254\210\255\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\1\0\0\0\21\21\21\21\21\21\21\21\21\21\21\21\21\21\21\21\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0", 388, ... 0x0, ) , 388, ... 0x0, ) == 0x0 02555 2020 NtWriteVirtualMemory (236, 0x7ffde1e8, (236, 0x7ffde1e8, "\0\0\3\0", 4, ... 0x0, ) , 4, ... 0x0, ) == 0x0 02556 2020 NtFreeVirtualMemory (-1, (0xc10000), 0, 32768, ... (0xc10000), 4096, ) == 0x0 02557 2020 NtAllocateVirtualMemory (236, 0, 0, 1048576, 8192, 4, ... 262144, 1048576, ) == 0x0 02558 2020 NtAllocateVirtualMemory (236, 1302528, 0, 8192, 4096, 4, ... 1302528, 8192, ) == 0x0 02559 2020 NtProtectVirtualMemory (236, (0x13e000), 4096, 260, ... (0x13e000), 4096, 4, ) == 0x0 02560 2020 NtCreateThread (0x1f03ff, 0x0, 236, 1230280, 1229944, 1, ... 240, {120, 928}, ) == 0x0 02561 2020 NtRequestWaitReplyPort (24, {168, 196, new_msg, 0, 0, 2147348480, 2008285840, 0} (24, {168, 196, new_msg, 0, 0, 2147348480, 2008285840, 0} "\0\0\0\0\0\0\1\0\0\0\0\0x\2\264w\357\0\0\0\360\0\0\0x\0\0\0\240\3\0\0\0\0\0\0\0\0\0\0\0\0\0\4\0\0\0\0\260\311\22\0x\1\24\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\340\375\177\0\0\0\0\0\0\25\0\10 \0\0" ... {168, 196, reply, 0, 868, 2020, 75661, 0} "\0\0\0\0\0\0\1\0\0\0\0\0x\2\264w\354\0\0\0\360\0\0\0x\0\0\0\240\3\0\0\0\0\0\0\0\0\0\0\0\0\0\4\0\0\0\0\260\311\22\0x\1\24\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\340\375\177\0\0\0\0\0\0\25\0\10 \0\0" ) ... {168, 196, reply, 0, 868, 2020, 75661, 0} (24, {168, 196, new_msg, 0, 0, 2147348480, 2008285840, 0} "\0\0\0\0\0\0\1\0\0\0\0\0x\2\264w\357\0\0\0\360\0\0\0x\0\0\0\240\3\0\0\0\0\0\0\0\0\0\0\0\0\0\4\0\0\0\0\260\311\22\0x\1\24\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\340\375\177\0\0\0\0\0\0\25\0\10 \0\0" ... {168, 196, reply, 0, 868, 2020, 75661, 0} "\0\0\0\0\0\0\1\0\0\0\0\0x\2\264w\354\0\0\0\360\0\0\0x\0\0\0\240\3\0\0\0\0\0\0\0\0\0\0\0\0\0\4\0\0\0\0\260\311\22\0x\1\24\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\340\375\177\0\0\0\0\0\0\25\0\10 \0\0" ) ) == 0x0 02562 2020 NtResumeThread (240, ... 1, ) == 0x0 02563 2020 NtClose (228, ... ) == 0x0 02564 2020 NtClose (232, ... ) == 0x0 02565 2020 NtClose (240, ... ) == 0x0 02566 2020 NtWaitForMultipleObjects (2, (216, 236, ), 1, 0, {1294967296, -1}, ... ) == 0x0 02567 2020 NtWaitForSingleObject (208, 0, {0, 0}, ... ) == 0x102 02568 2020 NtWaitForMultipleObjects (2, (216, 236, ), 1, 0, {1294967296, -1}, ... ) == 0x0 02569 2020 NtWaitForSingleObject (208, 0, {0, 0}, ... ) == 0x102 02570 2020 NtWaitForMultipleObjects (2, (216, 236, ), 1, 0, {1294967296, -1}, ... ) == 0x0 02571 2020 NtWaitForSingleObject (208, 0, {0, 0}, ... ) == 0x102 02572 2020 NtWaitForMultipleObjects (2, (216, 236, ), 1, 0, {1294967296, -1}, ... ) == 0x0 02573 2020 NtWaitForSingleObject (208, 0, {0, 0}, ... ) == 0x0 02574 2020 NtClose (236, ... ) == 0x0 02575 2020 NtUnmapViewOfSection (-1, 0xbf0000, ... ) == 0x0 02576 2020 NtClose (224, ... ) == 0x0 02577 2020 NtClose (208, ... ) == 0x0 02578 2020 NtClose (216, ... ) == 0x0 02579 2020 NtClose (212, ... ) == 0x0 02580 2020 NtClose (220, ... ) == 0x0 02581 2020 NtClose (164, ... ) == 0x0 02582 2020 NtClose (168, ... ) == 0x0 02583 2020 NtSetInformationThread (-2, ZeroTlsCell, {ZeroTlsCell=0x10,}, 4, ... ) == 0x0 02584 2020 NtWaitForMultipleObjects (2, (132, 136, ), 1, 0, 0x0, ... ) == 0x1 02585 2020 NtClose (136, ... ) == 0x0 02586 2020 NtSetEvent (132, ... 0x0, ) == 0x0 02587 2020 NtClose (132, ... ) == 0x0 02588 2020 NtWaitForMultipleObjects (2, (140, 144, ), 1, 0, 0x0, ... ) == 0x1 02589 2020 NtClose (144, ... ) == 0x0 02590 2020 NtSetEvent (140, ... 0x0, ) == 0x0 02591 2020 NtClose (140, ... ) == 0x0 02592 2020 NtWaitForMultipleObjects (2, (148, 152, ), 1, 0, 0x0, ... ) == 0x1 02593 2020 NtClose (152, ... ) == 0x0 02594 2020 NtSetEvent (148, ... 0x0, ) == 0x0 02595 2020 NtClose (148, ... ) == 0x0 02596 2020 NtRequestWaitReplyPort (192, {88, 112, new_msg, 0, 868, 2020, 75659, 0} (192, {88, 112, new_msg, 0, 868, 2020, 75659, 0} "\1\0\0\0A\2<\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\377\377\377\377\0\0\0\0\0\0\0\0\262 #\244\235\324.B\233\211j\376]\25\300\227]\25\300\227\1\0\0\0\1\0\0\0\4\0\0\0\1\365\11\0\1\0\0\0d\365\11\0\0\0\0\0\0\0\0\0" ... {124, 148, reply, 0, 868, 2020, 75806, 0} "\2\31\221|\1\0\221|\200\300\227|p\31\221|\250$\12\0\330\0\0\0d\365\11\0\0\300\372\177\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\1\0\0\0\1\0\0\0\4\0\0\0\1\365\11\0\1\0\0\0d\365\11\0\0\0\0\0\0\0\0\0\1\0\0\0\10\376\257\0\0\0\0\0\334\377\257\0\30\356\220|p\5\221|\377\377\377\377m\5\221|\344f\347w" ) ... {124, 148, reply, 0, 868, 2020, 75806, 0} (192, {88, 112, new_msg, 0, 868, 2020, 75659, 0} "\1\0\0\0A\2<\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\377\377\377\377\0\0\0\0\0\0\0\0\262 #\244\235\324.B\233\211j\376]\25\300\227]\25\300\227\1\0\0\0\1\0\0\0\4\0\0\0\1\365\11\0\1\0\0\0d\365\11\0\0\0\0\0\0\0\0\0" ... {124, 148, reply, 0, 868, 2020, 75806, 0} "\2\31\221|\1\0\221|\200\300\227|p\31\221|\250$\12\0\330\0\0\0d\365\11\0\0\300\372\177\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\1\0\0\0\1\0\0\0\4\0\0\0\1\365\11\0\1\0\0\0d\365\11\0\0\0\0\0\0\0\0\0\1\0\0\0\10\376\257\0\0\0\0\0\334\377\257\0\30\356\220|p\5\221|\377\377\377\377m\5\221|\344f\347w" ) ) == 0x0 02597 2020 NtClose (188, ... ) == 0x0 02598 2020 NtClose (192, ... ) == 0x0 02599 2020 NtClose (128, ... ) == 0x0 02600 2020 NtUnmapViewOfSection (-1, 0x69450000, ... ) == 0x0 02601 2020 NtUnmapViewOfSection (-1, 0x77920000, ... ) == 0x0 02602 2020 NtUnmapViewOfSection (-1, 0x76f50000, ... ) == 0x0 02603 2020 NtUnmapViewOfSection (-1, 0x76360000, ... ) == 0x0 02604 2020 NtUnmapViewOfSection (-1, 0x5b860000, ... ) == 0x0 02605 2020 NtUnmapViewOfSection (-1, 0x769c0000, ... ) == 0x0 02606 2020 NtContinue (1239608, 0, ... 02607 2020 NtTerminateProcess (0, -1073741680, ... ) == 0x0 02608 2020 NtSetInformationThread (-2, ZeroTlsCell, {ZeroTlsCell=0x11,}, 4, ... ) == 0x0 02609 2020 NtSetInformationThread (-2, ZeroTlsCell, {ZeroTlsCell=0x12,}, 4, ... ) == 0x0 02610 2020 NtSetInformationThread (-2, ZeroTlsCell, {ZeroTlsCell=0x13,}, 4, ... ) == 0x0 02611 2020 NtClose (156, ... ) == 0x0 02612 2020 NtUserPostThreadMessage (1748, 49315, 0, 2020, ... ) == 0x1 02613 2020 NtUserPostThreadMessage (416, 49315, 0, 2020, ... ) == 0x1 02614 2020 NtUserValidateHandleSecure (0, ... ) == 0x0 02615 2020 NtUserUnhookWindowsHookEx (3998123, ... ) == 0x1 02616 2020 NtUserUnhookWindowsHookEx (5964315, ... ) == 0x1 02617 2020 NtSetInformationThread (-2, ZeroTlsCell, {ZeroTlsCell=0x8,}, 4, ... ) == 0x0 02618 2020 NtUnmapViewOfSection (-1, 0xba0000, ... ) == 0x0 02619 2020 NtClose (116, ... ) == 0x0 02620 2020 NtClose (112, ... ) == 0x0 02621 2020 NtClose (92, ... ) == 0x0 02622 2020 NtClose (96, ... ) == 0x0 02623 2020 NtClose (100, ... ) == 0x0 02624 2020 NtClose (104, ... ) == 0x0 02625 2020 NtClose (108, ... ) == 0x0 02626 2020 NtUnmapViewOfSection (-1, 0xb90000, ... ) == 0x0 02627 2020 NtClose (88, ... ) == 0x0 02628 2020 NtSetInformationThread (-2, ZeroTlsCell, {ZeroTlsCell=0x7,}, 4, ... ) == 0x0 02629 2020 NtUserGetProcessWindowStation (... ) == 0x1c 02630 2020 NtUserBuildNameList (28, 522, 1414064, 1244228, ... ) == 0x0 02631 2020 NtUserGetProcessWindowStation (... ) == 0x1c 02632 2020 NtUserOpenDesktop ({24, 28, 0x40, 0, 0, ({24, 28, 0x40, 0, 0, "Default"}, 1, 0x41, ... ) }, 1, 0x41, ... ) == 0x58 02633 2020 NtUserBuildHwndList (88, 0, 0, 0, 64, ... (0x1a00f4, 0x5009e, 0x400fa, 0x10074, 0x10070, 0x10080, 0x10084, 0x30048, 0x10072, 0x20052, 0x5009c, 0x1401b6, 0xc01d2, 0xd0102, 0x500a2, 0xd011a, 0x10090, 0x100d0, 0x200b0, 0x100cc, 0x60148, 0x13010c, 0x60138, 0x16012c, 0x7015a, 0xd01c8, 0xe01ac, 0xc01d0, 0xa01cc, 0x3014c, 0x1011c, 0x100e6, 0x100d6, 0x100d2, 0x100ca, 0x100c8, 0x100ba, 0x100ae, 0x100ac, 0x300a6, 0x10078, 0x30062, 0x50036, 0x5005c, 0x100be, 0x400fe, 0x10092, 0x10086, 0x40034, 0x50050, 0x1013c, 0x10120, 0x100c2, 0x100bc, 0x60136, 0x2014e, 0x100d8, 0x100b6, 0x100b8, 0x100b4, 0x100c0, 0x1009a, 0x5005e, 0x1, ), 64, ) == 0x0 02634 2020 NtUserValidateHandleSecure (1704180, ... ) == 0x1 02635 2020 NtUserQueryWindow (1704180, 0, ... ) == 0x6b8 02636 2020 NtUserQueryWindow (1704180, 1, ... ) == 0x6d4 02637 2020 NtUserValidateHandleSecure (1704180, ... ) == 0x1 02638 2020 NtUserValidateHandleSecure (327838, ... ) == 0x1 02639 2020 NtUserQueryWindow (327838, 0, ... ) == 0x6b8 02640 2020 NtUserQueryWindow (327838, 1, ... ) == 0x6d4 02641 2020 NtUserValidateHandleSecure (327838, ... ) == 0x1 02642 2020 NtUserValidateHandleSecure (262394, ... ) == 0x1 02643 2020 NtUserQueryWindow (262394, 0, ... ) == 0x6b8 02644 2020 NtUserQueryWindow (262394, 1, ... ) == 0x6d4 02645 2020 NtUserValidateHandleSecure (262394, ... ) == 0x1 02646 2020 NtUserBuildHwndList (0, 262394, 1, 0, 64, ... (0x80064, 0x60068, 0x6006c, 0x50094, 0x50096, 0x60066, 0x7006a, 0x90058, 0x6006e, 0x5008a, 0x50088, 0x500a0, 0x1, ), 13, ) == 0x0 02647 2020 NtUserValidateHandleSecure (524388, ... ) == 0x1 02648 2020 NtUserQueryWindow (524388, 0, ... ) == 0x6b8 02649 2020 NtUserQueryWindow (524388, 1, ... ) == 0x6d4 02650 2020 NtUserValidateHandleSecure (393320, ... ) == 0x1 02651 2020 NtUserQueryWindow (393320, 0, ... ) == 0x6b8 02652 2020 NtUserQueryWindow (393320, 1, ... ) == 0x6d4 02653 2020 NtUserValidateHandleSecure (393324, ... ) == 0x1 02654 2020 NtUserQueryWindow (393324, 0, ... ) == 0x6b8 02655 2020 NtUserQueryWindow (393324, 1, ... ) == 0x6d4 02656 2020 NtUserValidateHandleSecure (327828, ... ) == 0x1 02657 2020 NtUserQueryWindow (327828, 0, ... ) == 0x6b8 02658 2020 NtUserQueryWindow (327828, 1, ... ) == 0x6d4 02659 2020 NtUserValidateHandleSecure (327830, ... ) == 0x1 02660 2020 NtUserQueryWindow (327830, 0, ... ) == 0x6b8 02661 2020 NtUserQueryWindow (327830, 1, ... ) == 0x6d4 02662 2020 NtUserValidateHandleSecure (393318, ... ) == 0x1 02663 2020 NtUserQueryWindow (393318, 0, ... ) == 0x6b8 02664 2020 NtUserQueryWindow (393318, 1, ... ) == 0x6d4 02665 2020 NtUserValidateHandleSecure (458858, ... ) == 0x1 02666 2020 NtUserQueryWindow (458858, 0, ... ) == 0x6b8 02667 2020 NtUserQueryWindow (458858, 1, ... ) == 0x6d4 02668 2020 NtUserValidateHandleSecure (589912, ... ) == 0x1 02669 2020 NtUserQueryWindow (589912, 0, ... ) == 0x6b8 02670 2020 NtUserQueryWindow (589912, 1, ... ) == 0x6d4 02671 2020 NtUserValidateHandleSecure (393326, ... ) == 0x1 02672 2020 NtUserQueryWindow (393326, 0, ... ) == 0x6b8 02673 2020 NtUserQueryWindow (393326, 1, ... ) == 0x6d4 02674 2020 NtUserValidateHandleSecure (327818, ... ) == 0x1 02675 2020 NtUserQueryWindow (327818, 0, ... ) == 0x6b8 02676 2020 NtUserQueryWindow (327818, 1, ... ) == 0x6d4 02677 2020 NtUserValidateHandleSecure (327816, ... ) == 0x1 02678 2020 NtUserQueryWindow (327816, 0, ... ) == 0x6b8 02679 2020 NtUserQueryWindow (327816, 1, ... ) == 0x6d4 02680 2020 NtUserValidateHandleSecure (327840, ... ) == 0x1 02681 2020 NtUserQueryWindow (327840, 0, ... ) == 0x6b8 02682 2020 NtUserQueryWindow (327840, 1, ... ) == 0x6d4 02683 2020 NtUserValidateHandleSecure (65652, ... ) == 0x1 02684 2020 NtUserQueryWindow (65652, 0, ... ) == 0x6b8 02685 2020 NtUserQueryWindow (65652, 1, ... ) == 0x6d4 02686 2020 NtUserValidateHandleSecure (65652, ... ) == 0x1 02687 2020 NtUserValidateHandleSecure (65648, ... ) == 0x1 02688 2020 NtUserQueryWindow (65648, 0, ... ) == 0x6b8 02689 2020 NtUserQueryWindow (65648, 1, ... ) == 0x6d4 02690 2020 NtUserValidateHandleSecure (65648, ... ) == 0x1 02691 2020 NtUserValidateHandleSecure (65664, ... ) == 0x1 02692 2020 NtUserQueryWindow (65664, 0, ... ) == 0x6b8 02693 2020 NtUserQueryWindow (65664, 1, ... ) == 0x6d4 02694 2020 NtUserValidateHandleSecure (65664, ... ) == 0x1 02695 2020 NtUserValidateHandleSecure (65668, ... ) == 0x1 02696 2020 NtUserQueryWindow (65668, 0, ... ) == 0x6b8 02697 2020 NtUserQueryWindow (65668, 1, ... ) == 0x6d4 02698 2020 NtUserValidateHandleSecure (65668, ... ) == 0x1 02699 2020 NtUserValidateHandleSecure (196680, ... ) == 0x1 02700 2020 NtUserQueryWindow (196680, 0, ... ) == 0x6b8 02701 2020 NtUserQueryWindow (196680, 1, ... ) == 0x6d4 02702 2020 NtUserValidateHandleSecure (196680, ... ) == 0x1 02703 2020 NtUserValidateHandleSecure (65650, ... ) == 0x1 02704 2020 NtUserQueryWindow (65650, 0, ... ) == 0x6b8 02705 2020 NtUserQueryWindow (65650, 1, ... ) == 0x6d4 02706 2020 NtUserValidateHandleSecure (65650, ... ) == 0x1 02707 2020 NtUserValidateHandleSecure (131154, ... ) == 0x1 02708 2020 NtUserQueryWindow (131154, 0, ... ) == 0x6b8 02709 2020 NtUserQueryWindow (131154, 1, ... ) == 0x6d4 02710 2020 NtUserValidateHandleSecure (131154, ... ) == 0x1 02711 2020 NtUserBuildHwndList (0, 131154, 1, 0, 64, ... (0x3003e, 0x3003c, 0x30040, 0x30042, 0x30044, 0x30046, 0x10076, 0x10082, 0x1007a, 0x1007e, 0x1, ), 11, ) == 0x0 02712 2020 NtUserValidateHandleSecure (196670, ... ) == 0x1 02713 2020 NtUserQueryWindow (196670, 0, ... ) == 0x6b8 02714 2020 NtUserQueryWindow (196670, 1, ... ) == 0x6d4 02715 2020 NtUserValidateHandleSecure (196668, ... ) == 0x1 02716 2020 NtUserQueryWindow (196668, 0, ... ) == 0x6b8 02717 2020 NtUserQueryWindow (196668, 1, ... ) == 0x6d4 02718 2020 NtUserValidateHandleSecure (196672, ... ) == 0x1 02719 2020 NtUserQueryWindow (196672, 0, ... ) == 0x6b8 02720 2020 NtUserQueryWindow (196672, 1, ... ) == 0x6d4 02721 2020 NtUserValidateHandleSecure (196674, ... ) == 0x1 02722 2020 NtUserQueryWindow (196674, 0, ... ) == 0x6b8 02723 2020 NtUserQueryWindow (196674, 1, ... ) == 0x6d4 02724 2020 NtUserValidateHandleSecure (196676, ... ) == 0x1 02725 2020 NtUserQueryWindow (196676, 0, ... ) == 0x6b8 02726 2020 NtUserQueryWindow (196676, 1, ... ) == 0x6d4 02727 2020 NtUserValidateHandleSecure (196678, ... ) == 0x1 02728 2020 NtUserQueryWindow (196678, 0, ... ) == 0x6b8 02729 2020 NtUserQueryWindow (196678, 1, ... ) == 0x6d4 02730 2020 NtUserValidateHandleSecure (65654, ... ) == 0x1 02731 2020 NtUserQueryWindow (65654, 0, ... ) == 0x6b8 02732 2020 NtUserQueryWindow (65654, 1, ... ) == 0x6d4 02733 2020 NtUserValidateHandleSecure (65666, ... ) == 0x1 02734 2020 NtUserQueryWindow (65666, 0, ... ) == 0x6b8 02735 2020 NtUserQueryWindow (65666, 1, ... ) == 0x6d4 02736 2020 NtUserValidateHandleSecure (65658, ... ) == 0x1 02737 2020 NtUserQueryWindow (65658, 0, ... ) == 0x6b8 02738 2020 NtUserQueryWindow (65658, 1, ... ) == 0x6d4 02739 2020 NtUserValidateHandleSecure (65662, ... ) == 0x1 02740 2020 NtUserQueryWindow (65662, 0, ... ) == 0x6b8 02741 2020 NtUserQueryWindow (65662, 1, ... ) == 0x6d4 02742 2020 NtUserValidateHandleSecure (327836, ... ) == 0x1 02743 2020 NtUserQueryWindow (327836, 0, ... ) == 0x6b8 02744 2020 NtUserQueryWindow (327836, 1, ... ) == 0x6d4 02745 2020 NtUserValidateHandleSecure (327836, ... ) == 0x1 02746 2020 NtUserValidateHandleSecure (1311158, ... ) == 0x1 02747 2020 NtUserQueryWindow (1311158, 0, ... ) == 0x6b8 02748 2020 NtUserQueryWindow (1311158, 1, ... ) == 0x6d4 02749 2020 NtUserValidateHandleSecure (1311158, ... ) == 0x1 02750 2020 NtUserBuildHwndList (0, 1311158, 1, 0, 64, ... (0xf0192, 0x80198, 0x1, ), 3, ) == 0x0 02751 2020 NtUserValidateHandleSecure (983442, ... ) == 0x1 02752 2020 NtUserQueryWindow (983442, 0, ... ) == 0x6b8 02753 2020 NtUserQueryWindow (983442, 1, ... ) == 0x6d4 02754 2020 NtUserValidateHandleSecure (524696, ... ) == 0x1 02755 2020 NtUserQueryWindow (524696, 0, ... ) == 0x6b8 02756 2020 NtUserQueryWindow (524696, 1, ... ) == 0x6d4 02757 2020 NtUserValidateHandleSecure (786898, ... ) == 0x1 02758 2020 NtUserQueryWindow (786898, 0, ... ) == 0x6b8 02759 2020 NtUserQueryWindow (786898, 1, ... ) == 0x6d4 02760 2020 NtUserValidateHandleSecure (786898, ... ) == 0x1 02761 2020 NtUserValidateHandleSecure (852226, ... ) == 0x1 02762 2020 NtUserQueryWindow (852226, 0, ... ) == 0x6b8 02763 2020 NtUserQueryWindow (852226, 1, ... ) == 0x6d4 02764 2020 NtUserValidateHandleSecure (852226, ... ) == 0x1 02765 2020 NtUserBuildHwndList (0, 852226, 1, 0, 64, ... (0x700fc, 0xc0114, 0x1, ), 3, ) == 0x0 02766 2020 NtUserValidateHandleSecure (459004, ... ) == 0x1 02767 2020 NtUserQueryWindow (459004, 0, ... ) == 0x6b8 02768 2020 NtUserQueryWindow (459004, 1, ... ) == 0x6d4 02769 2020 NtUserValidateHandleSecure (786708, ... ) == 0x1 02770 2020 NtUserQueryWindow (786708, 0, ... ) == 0x6b8 02771 2020 NtUserQueryWindow (786708, 1, ... ) == 0x6d4 02772 2020 NtUserValidateHandleSecure (327842, ... ) == 0x1 02773 2020 NtUserQueryWindow (327842, 0, ... ) == 0x6b8 02774 2020 NtUserQueryWindow (327842, 1, ... ) == 0x6d4 02775 2020 NtUserValidateHandleSecure (327842, ... ) == 0x1 02776 2020 NtUserValidateHandleSecure (852250, ... ) == 0x1 02777 2020 NtUserQueryWindow (852250, 0, ... ) == 0x6b8 02778 2020 NtUserQueryWindow (852250, 1, ... ) == 0x6d4 02779 2020 NtUserValidateHandleSecure (852250, ... ) == 0x1 02780 2020 NtUserValidateHandleSecure (65680, ... ) == 0x1 02781 2020 NtUserQueryWindow (65680, 0, ... ) == 0x6b8 02782 2020 NtUserQueryWindow (65680, 1, ... ) == 0x6bc 02783 2020 NtUserValidateHandleSecure (65680, ... ) == 0x1 02784 2020 NtUserValidateHandleSecure (65744, ... ) == 0x1 02785 2020 NtUserQueryWindow (65744, 0, ... ) == 0x19c 02786 2020 NtUserQueryWindow (65744, 1, ... ) == 0x1a0 02787 2020 NtUserValidateHandleSecure (65744, ... ) == 0x1 02788 2020 NtUserValidateHandleSecure (131248, ... ) == 0x1 02789 2020 NtUserQueryWindow (131248, 0, ... ) == 0xa0 02790 2020 NtUserQueryWindow (131248, 1, ... ) == 0xe4 02791 2020 NtUserValidateHandleSecure (131248, ... ) == 0x1 02792 2020 NtUserValidateHandleSecure (65740, ... ) == 0x1 02793 2020 NtUserQueryWindow (65740, 0, ... ) == 0x19c 02794 2020 NtUserQueryWindow (65740, 1, ... ) == 0x1a0 02795 2020 NtUserValidateHandleSecure (65740, ... ) == 0x1 02796 2020 NtUserValidateHandleSecure (393544, ... ) == 0x1 02797 2020 NtUserQueryWindow (393544, 0, ... ) == 0x78 02798 2020 NtUserQueryWindow (393544, 1, ... ) == 0x3a0 02799 2020 NtUserValidateHandleSecure (393544, ... ) == 0x1 02800 2020 NtUserValidateHandleSecure (1245452, ... ) == 0x1 02801 2020 NtUserQueryWindow (1245452, 0, ... ) == 0x5e8 02802 2020 NtUserQueryWindow (1245452, 1, ... ) == 0x534 02803 2020 NtUserValidateHandleSecure (1245452, ... ) == 0x1 02804 2020 NtUserRemoveProp (393528, 43282, ... ) == 0x0 02805 2020 NtUserValidateHandleSecure (1442092, ... ) == 0x1 02806 2020 NtUserQueryWindow (1442092, 0, ... ) == 0xa4 02807 2020 NtUserQueryWindow (1442092, 1, ... ) == 0x61c 02808 2020 NtUserValidateHandleSecure (1442092, ... ) == 0x1 02809 2020 NtUserValidateHandleSecure (459098, ... ) == 0x1 02810 2020 NtUserQueryWindow (459098, 0, ... ) == 0x4b0 02811 2020 NtUserQueryWindow (459098, 1, ... ) == 0x780 02812 2020 NtUserValidateHandleSecure (459098, ... ) == 0x1 02813 2020 NtUserValidateHandleSecure (852424, ... ) == 0x1 02814 2020 NtUserQueryWindow (852424, 0, ... ) == 0x6b8 02815 2020 NtUserQueryWindow (852424, 1, ... ) == 0x6d4 02816 2020 NtUserValidateHandleSecure (852424, ... ) == 0x1 02817 2020 NtUserValidateHandleSecure (917932, ... ) == 0x1 02818 2020 NtUserQueryWindow (917932, 0, ... ) == 0x6b8 02819 2020 NtUserQueryWindow (917932, 1, ... ) == 0x6d4 02820 2020 NtUserValidateHandleSecure (917932, ... ) == 0x1 02821 2020 NtUserValidateHandleSecure (786896, ... ) == 0x1 02822 2020 NtUserQueryWindow (786896, 0, ... ) == 0x6b8 02823 2020 NtUserQueryWindow (786896, 1, ... ) == 0x6d4 02824 2020 NtUserValidateHandleSecure (786896, ... ) == 0x1 02825 2020 NtUserValidateHandleSecure (655820, ... ) == 0x1 02826 2020 NtUserQueryWindow (655820, 0, ... ) == 0x6b8 02827 2020 NtUserQueryWindow (655820, 1, ... ) == 0x6d4 02828 2020 NtUserValidateHandleSecure (655820, ... ) == 0x1 02829 2020 NtUserValidateHandleSecure (196940, ... ) == 0x1 02830 2020 NtUserQueryWindow (196940, 0, ... ) == 0x4b4 02831 2020 NtUserQueryWindow (196940, 1, ... ) == 0x474 02832 2020 NtUserValidateHandleSecure (196940, ... ) == 0x1 02833 2020 NtUserValidateHandleSecure (65820, ... ) == 0x1 02834 2020 NtUserQueryWindow (65820, 0, ... ) == 0x22c 02835 2020 NtUserQueryWindow (65820, 1, ... ) == 0x220 02836 2020 NtUserValidateHandleSecure (65820, ... ) == 0x1 02837 2020 NtUserValidateHandleSecure (65766, ... ) == 0x1 02838 2020 NtUserQueryWindow (65766, 0, ... ) == 0x6b8 02839 2020 NtUserQueryWindow (65766, 1, ... ) == 0x13c 02840 2020 NtUserValidateHandleSecure (65766, ... ) == 0x1 02841 2020 NtUserValidateHandleSecure (65750, ... ) == 0x1 02842 2020 NtUserQueryWindow (65750, 0, ... ) == 0x6b8 02843 2020 NtUserQueryWindow (65750, 1, ... ) == 0x13c 02844 2020 NtUserValidateHandleSecure (65750, ... ) == 0x1 02845 2020 NtUserBuildHwndList (0, 65750, 1, 0, 64, ... (0x100da, 0x100dc, 0x100de, 0x100e0, 0x1, ), 5, ) == 0x0 02846 2020 NtUserValidateHandleSecure (65754, ... ) == 0x1 02847 2020 NtUserQueryWindow (65754, 0, ... ) == 0x6b8 02848 2020 NtUserQueryWindow (65754, 1, ... ) == 0x13c 02849 2020 NtUserValidateHandleSecure (65756, ... ) == 0x1 02850 2020 NtUserQueryWindow (65756, 0, ... ) == 0x6b8 02851 2020 NtUserQueryWindow (65756, 1, ... ) == 0x13c 02852 2020 NtUserValidateHandleSecure (65758, ... ) == 0x1 02853 2020 NtUserQueryWindow (65758, 0, ... ) == 0x6b8 02854 2020 NtUserQueryWindow (65758, 1, ... ) == 0x13c 02855 2020 NtUserValidateHandleSecure (65760, ... ) == 0x1 02856 2020 NtUserQueryWindow (65760, 0, ... ) == 0x6b8 02857 2020 NtUserQueryWindow (65760, 1, ... ) == 0x13c 02858 2020 NtUserValidateHandleSecure (65746, ... ) == 0x1 02859 2020 NtUserQueryWindow (65746, 0, ... ) == 0x6b8 02860 2020 NtUserQueryWindow (65746, 1, ... ) == 0x6d4 02861 2020 NtUserValidateHandleSecure (65746, ... ) == 0x1 02862 2020 NtUserValidateHandleSecure (65738, ... ) == 0x1 02863 2020 NtUserQueryWindow (65738, 0, ... ) == 0x19c 02864 2020 NtUserQueryWindow (65738, 1, ... ) == 0x1a0 02865 2020 NtUserValidateHandleSecure (65738, ... ) == 0x1 02866 2020 NtUserValidateHandleSecure (65736, ... ) == 0x1 02867 2020 NtUserQueryWindow (65736, 0, ... ) == 0xa0 02868 2020 NtUserQueryWindow (65736, 1, ... ) == 0xe4 02869 2020 NtUserValidateHandleSecure (65736, ... ) == 0x1 02870 2020 NtUserValidateHandleSecure (65722, ... ) == 0x1 02871 2020 NtUserQueryWindow (65722, 0, ... ) == 0x104 02872 2020 NtUserQueryWindow (65722, 1, ... ) == 0x108 02873 2020 NtUserValidateHandleSecure (65722, ... ) == 0x1 02874 2020 NtUserValidateHandleSecure (65710, ... ) == 0x1 02875 2020 NtUserQueryWindow (65710, 0, ... ) == 0x104 02876 2020 NtUserQueryWindow (65710, 1, ... ) == 0x108 02877 2020 NtUserValidateHandleSecure (65710, ... ) == 0x1 02878 2020 NtUserValidateHandleSecure (65708, ... ) == 0x1 02879 2020 NtUserQueryWindow (65708, 0, ... ) == 0x120 02880 2020 NtUserQueryWindow (65708, 1, ... ) == 0x124 02881 2020 NtUserValidateHandleSecure (65708, ... ) == 0x1 02882 2020 NtUserValidateHandleSecure (196774, ... ) == 0x1 02883 2020 NtUserQueryWindow (196774, 0, ... ) == 0xc4 02884 2020 NtUserQueryWindow (196774, 1, ... ) == 0xc8 02885 2020 NtUserValidateHandleSecure (196774, ... ) == 0x1 02886 2020 NtUserValidateHandleSecure (65656, ... ) == 0x1 02887 2020 NtUserQueryWindow (65656, 0, ... ) == 0x6b8 02888 2020 NtUserQueryWindow (65656, 1, ... ) == 0x6ec 02889 2020 NtUserValidateHandleSecure (65656, ... ) == 0x1 02890 2020 NtUserValidateHandleSecure (196706, ... ) == 0x1 02891 2020 NtUserQueryWindow (196706, 0, ... ) == 0x6b8 02892 2020 NtUserQueryWindow (196706, 1, ... ) == 0x6bc 02893 2020 NtUserValidateHandleSecure (196706, ... ) == 0x1 02894 2020 NtUserValidateHandleSecure (327734, ... ) == 0x1 02895 2020 NtUserQueryWindow (327734, 0, ... ) == 0x6b8 02896 2020 NtUserQueryWindow (327734, 1, ... ) == 0x6bc 02897 2020 NtUserValidateHandleSecure (327734, ... ) == 0x1 02898 2020 NtUserValidateHandleSecure (327772, ... ) == 0x1 02899 2020 NtUserQueryWindow (327772, 0, ... ) == 0x6b8 02900 2020 NtUserQueryWindow (327772, 1, ... ) == 0x6bc 02901 2020 NtUserValidateHandleSecure (327772, ... ) == 0x1 02902 2020 NtUserValidateHandleSecure (65726, ... ) == 0x1 02903 2020 NtUserQueryWindow (65726, 0, ... ) == 0x19c 02904 2020 NtUserQueryWindow (65726, 1, ... ) == 0x1a0 02905 2020 NtUserValidateHandleSecure (65726, ... ) == 0x1 02906 2020 NtUserValidateHandleSecure (262398, ... ) == 0x1 02907 2020 NtUserQueryWindow (262398, 0, ... ) == 0x6b8 02908 2020 NtUserQueryWindow (262398, 1, ... ) == 0x6d4 02909 2020 NtUserValidateHandleSecure (262398, ... ) == 0x1 02910 2020 NtUserValidateHandleSecure (65682, ... ) == 0x1 02911 2020 NtUserQueryWindow (65682, 0, ... ) == 0x6b8 02912 2020 NtUserQueryWindow (65682, 1, ... ) == 0x6bc 02913 2020 NtUserValidateHandleSecure (65682, ... ) == 0x1 02914 2020 NtUserValidateHandleSecure (65670, ... ) == 0x1 02915 2020 NtUserQueryWindow (65670, 0, ... ) == 0x6b8 02916 2020 NtUserQueryWindow (65670, 1, ... ) == 0x6bc 02917 2020 NtUserValidateHandleSecure (65670, ... ) == 0x1 02918 2020 NtUserBuildHwndList (0, 65670, 1, 0, 64, ... (0x1008c, 0x1008e, 0x1, ), 3, ) == 0x0 02919 2020 NtUserValidateHandleSecure (65676, ... ) == 0x1 02920 2020 NtUserQueryWindow (65676, 0, ... ) == 0x6b8 02921 2020 NtUserQueryWindow (65676, 1, ... ) == 0x6bc 02922 2020 NtUserValidateHandleSecure (65678, ... ) == 0x1 02923 2020 NtUserQueryWindow (65678, 0, ... ) == 0x6b8 02924 2020 NtUserQueryWindow (65678, 1, ... ) == 0x6bc 02925 2020 NtUserValidateHandleSecure (262196, ... ) == 0x1 02926 2020 NtUserQueryWindow (262196, 0, ... ) == 0x6b8 02927 2020 NtUserQueryWindow (262196, 1, ... ) == 0x6d4 02928 2020 NtUserValidateHandleSecure (262196, ... ) == 0x1 02929 2020 NtUserValidateHandleSecure (327760, ... ) == 0x1 02930 2020 NtUserQueryWindow (327760, 0, ... ) == 0x6b8 02931 2020 NtUserQueryWindow (327760, 1, ... ) == 0x6d4 02932 2020 NtUserValidateHandleSecure (327760, ... ) == 0x1 02933 2020 NtUserValidateHandleSecure (65852, ... ) == 0x1 02934 2020 NtUserQueryWindow (65852, 0, ... ) == 0x22c 02935 2020 NtUserQueryWindow (65852, 1, ... ) == 0x220 02936 2020 NtUserValidateHandleSecure (65852, ... ) == 0x1 02937 2020 NtUserValidateHandleSecure (65824, ... ) == 0x1 02938 2020 NtUserQueryWindow (65824, 0, ... ) == 0x22c 02939 2020 NtUserQueryWindow (65824, 1, ... ) == 0x220 02940 2020 NtUserValidateHandleSecure (65824, ... ) == 0x1 02941 2020 NtUserValidateHandleSecure (65730, ... ) == 0x1 02942 2020 NtUserQueryWindow (65730, 0, ... ) == 0xa0 02943 2020 NtUserQueryWindow (65730, 1, ... ) == 0xe4 02944 2020 NtUserValidateHandleSecure (65730, ... ) == 0x1 02945 2020 NtUserValidateHandleSecure (65724, ... ) == 0x1 02946 2020 NtUserQueryWindow (65724, 0, ... ) == 0xa0 02947 2020 NtUserQueryWindow (65724, 1, ... ) == 0xe4 02948 2020 NtUserValidateHandleSecure (65724, ... ) == 0x1 02949 2020 NtUserValidateHandleSecure (393526, ... ) == 0x1 02950 2020 NtUserValidateHandleSecure (393526, ... ) == 0x1 02951 2020 NtUserValidateHandleSecure (393526, ... ) == 0x1 02952 2020 NtUserRemoveProp (393526, 43288, ... ) == 0xffffffff 02953 2020 NtUserRemoveProp (393526, 43282, ... ) == 0x0 02954 2020 NtUserValidateHandleSecure (393526, ... ) == 0x1 02955 2020 NtUserValidateHandleSecure (393526, ... ) == 0x1 02956 2020 NtUserValidateHandleSecure (131406, ... ) == 0x1 02957 2020 NtUserQueryWindow (131406, 0, ... ) == 0x4b4 02958 2020 NtUserQueryWindow (131406, 1, ... ) == 0x474 02959 2020 NtUserValidateHandleSecure (131406, ... ) == 0x1 02960 2020 NtUserValidateHandleSecure (65752, ... ) == 0x1 02961 2020 NtUserQueryWindow (65752, 0, ... ) == 0x6b8 02962 2020 NtUserQueryWindow (65752, 1, ... ) == 0x13c 02963 2020 NtUserValidateHandleSecure (65752, ... ) == 0x1 02964 2020 NtUserValidateHandleSecure (65718, ... ) == 0x1 02965 2020 NtUserQueryWindow (65718, 0, ... ) == 0x104 02966 2020 NtUserQueryWindow (65718, 1, ... ) == 0x108 02967 2020 NtUserValidateHandleSecure (65718, ... ) == 0x1 02968 2020 NtUserValidateHandleSecure (65720, ... ) == 0x1 02969 2020 NtUserQueryWindow (65720, 0, ... ) == 0x120 02970 2020 NtUserQueryWindow (65720, 1, ... ) == 0x124 02971 2020 NtUserValidateHandleSecure (65720, ... ) == 0x1 02972 2020 NtUserValidateHandleSecure (65716, ... ) == 0x1 02973 2020 NtUserQueryWindow (65716, 0, ... ) == 0xc4 02974 2020 NtUserQueryWindow (65716, 1, ... ) == 0xc8 02975 2020 NtUserValidateHandleSecure (65716, ... ) == 0x1 02976 2020 NtUserValidateHandleSecure (65728, ... ) == 0x1 02977 2020 NtUserQueryWindow (65728, 0, ... ) == 0x19c 02978 2020 NtUserQueryWindow (65728, 1, ... ) == 0x1a0 02979 2020 NtUserValidateHandleSecure (65728, ... ) == 0x1 02980 2020 NtUserValidateHandleSecure (65690, ... ) == 0x1 02981 2020 NtUserQueryWindow (65690, 0, ... ) == 0x6b8 02982 2020 NtUserQueryWindow (65690, 1, ... ) == 0x6bc 02983 2020 NtUserValidateHandleSecure (65690, ... ) == 0x1 02984 2020 NtUserValidateHandleSecure (327774, ... ) == 0x1 02985 2020 NtUserQueryWindow (327774, 0, ... ) == 0x6b8 02986 2020 NtUserQueryWindow (327774, 1, ... ) == 0x6bc 02987 2020 NtUserValidateHandleSecure (327774, ... ) == 0x1 02988 2020 NtUserCloseDesktop (88, ... ) == 0x1 02989 2020 NtUserGetProcessWindowStation (... ) == 0x1c 02990 2020 NtUserOpenDesktop ({24, 28, 0x40, 0, 0, ({24, 28, 0x40, 0, 0, "Disconnect"}, 1, 0x41, ... ) }, 1, 0x41, ... ) == 0x0 02991 2020 NtUserGetProcessWindowStation (... ) == 0x1c 02992 2020 NtUserOpenDesktop ({24, 28, 0x40, 0, 0, ({24, 28, 0x40, 0, 0, "Winlogon"}, 1, 0x41, ... ) }, 1, 0x41, ... ) == 0x0 02993 2020 NtGdiDeleteObjectApp (1326057013, ... ) == 0x1 02994 2020 NtGdiDeleteObjectApp (1795818684, ... ) == 0x1 02995 2020 NtUnmapViewOfSection (-1, 0x360000, ... ) == 0x0 02996 2020 NtClose (60, ... ) == 0x0 02997 2020 NtClose (52, ... ) == 0x0 02998 2020 NtSetInformationThread (-2, ZeroTlsCell, {ZeroTlsCell=0x6,}, 4, ... ) == 0x0 02999 2020 NtSetInformationThread (-2, ZeroTlsCell, {ZeroTlsCell=0x4,}, 4, ... ) == 0x0 03000 2020 NtSetInformationThread (-2, ZeroTlsCell, {ZeroTlsCell=0x3,}, 4, ... ) == 0x0 03001 2020 NtOpenKey (0x20019, {24, 0, 0x40, 0, 0, (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\GRE_Initialize"}, ... 52, ) }, ... 52, ) == 0x0 03002 2020 NtQueryValueKey (52, (52, "DisableMetaFiles", Partial, 20, ... ) , Partial, 20, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 03003 2020 NtClose (52, ... ) == 0x0 03004 2020 NtClose (44, ... ) == 0x0 03005 2020 NtFreeVirtualMemory (-1, (0xc00000), 4096, 32768, ... (0xc00000), 4096, ) == 0x0 03006 2020 NtQueryInformationProcess (-1, 36, 4, ... {process info, class 36, size 4}, 0x0, ) == 0x0 03007 2020 NtQueryInformationProcess (-1, 36, 4, ... {process info, class 36, size 4}, 0x0, ) == 0x0 03008 2020 NtQueryVirtualMemory (-1, 0x77c2807c, Basic, 28, ... {BaseAddress=0x77c28000,AllocationBase=0x77c10000,AllocationProtect=0x80,RegionSize=0x35000,State=0x1000,Protect=0x20,Type=0x1000000,}, 28, ) == 0x0 03009 2020 NtRequestWaitReplyPort (24, {20, 48, new_msg, 0, 2011664592, 1178048, 1178452, 1178016} (24, {20, 48, new_msg, 0, 2011664592, 1178048, 1178452, 1178016} "\0\0\0\0\3\0\1\0X\35\336w\234\375\21\0\220\0\0\300" ... {20, 48, reply, 0, 868, 2020, 75809, 0} "\0\0\0\0\3\0\1\0\0\0\0\0\234\375\21\0\220\0\0\300" ) ... {20, 48, reply, 0, 868, 2020, 75809, 0} (24, {20, 48, new_msg, 0, 2011664592, 1178048, 1178452, 1178016} "\0\0\0\0\3\0\1\0X\35\336w\234\375\21\0\220\0\0\300" ... {20, 48, reply, 0, 868, 2020, 75809, 0} "\0\0\0\0\3\0\1\0\0\0\0\0\234\375\21\0\220\0\0\300" ) ) == 0x0 03010 2020 NtTerminateProcess (-1, -1073741680, ...