Summary:


NtAccessCheck(>) 
 1 
NtGdiHfontCreate(>) 
 2 
NtQueryDefaultUILanguage(>) 
 12 
NtSetValueKey(>) 
 52 

NtAddAtom(>) 
 1 
NtOpenDirectoryObject(>) 
 2 
NtQueryKey(>) 
 12 
NtRequestWaitReplyPort(>) 
 55 

NtCallbackReturn(>) 
 1 
NtQueryInstallUILanguage(>) 
 2 
NtSetEvent(>) 
 12 
NtQueryInformationProcess(>) 
 56 

NtGdiCreateBitmap(>) 
 1 
NtUserCreateWindowEx(>) 
 2 
NtUserCallOneParam(>) 
 12 
NtCreateFile(>) 
 58 

NtGdiCreatePatternBrushInternal(>) 
 1 
NtUserGetObjectInformation(>) 
 2 
NtOpenProcessToken(>) 
 13 
NtSetInformationThread(>) 
 61 

NtGdiInit(>) 
 1 
NtUserMessageCall(>) 
 2 
NtOpenProcessTokenEx(>) 
 18 
NtMapViewOfSection(>) 
 63 

NtGdiQueryFontAssocInfo(>) 
 1 
NtGdiCreateCompatibleDC(>) 
 3 
NtOpenThreadTokenEx(>) 
 18 
NtUserRegisterClassExWOW(>) 
 64 

NtGdiSelectBitmap(>) 
 1 
NtDuplicateObject(>) 
 4 
NtQuerySection(>) 
 18 
NtOpenThreadToken(>) 
 77 

NtOpenKeyedEvent(>) 
 1 
NtUserRegisterWindowMessage(>) 
 4 
NtQueryVolumeInformationFile(>) 
 19 
NtAllocateVirtualMemory(>) 
 79 

NtOpenProcess(>) 
 1 
NtWaitForMultipleObjects(>) 
 4 
NtContinue(>) 
 20 
NtCreateEvent(>) 
 86 

NtOpenSymbolicLinkObject(>) 
 1 
NtDuplicateToken(>) 
 5 
NtProtectVirtualMemory(>) 
 20 
NtQueryDefaultLocale(>) 
 99 

NtQueryEvent(>) 
 1 
NtGdiGetStockObject(>) 
 5 
NtUnmapViewOfSection(>) 
 20 
NtSetInformationFile(>) 
 100 

NtQueryObject(>) 
 1 
NtQuerySecurityObject(>) 
 5 
NtConnectPort(>) 
 22 
NtQueryAttributesFile(>) 
 110 

NtQuerySymbolicLinkObject(>) 
 1 
NtSetInformationObject(>) 
 5 
NtOpenEvent(>) 
 23 
NtQueryInformationFile(>) 
 110 

NtQuerySystemTime(>) 
 1 
NtCreateMutant(>) 
 6 
NtQuerySystemInformation(>) 
 25 
NtOpenFile(>) 
 114 

NtQueryTimerResolution(>) 
 1 
NtNotifyChangeKey(>) 
 6 
NtFreeVirtualMemory(>) 
 28 
NtFsControlFile(>) 
 125 

NtRegisterThreadTerminatePort(>) 
 1 
NtReleaseSemaphore(>) 
 7 
NtQueryDirectoryFile(>) 
 28 
NtQueryVirtualMemory(>) 
 147 

NtSecureConnectPort(>) 
 1 
NtOpenMutant(>) 
 9 
NtQueryDebugFilterState(>) 
 29 
NtCreateKey(>) 
 161 

NtTestAlert(>) 
 1 
NtUserCallNoParam(>) 
 9 
NtCreateSection(>) 
 32 
NtReleaseMutant(>) 
 223 

NtUserGetDC(>) 
 1 
NtDeleteValueKey(>) 
 10 
NtUserGetMessage(>) 
 34 
NtEnumerateValueKey(>) 
 231 

NtUserGetGUIThreadInfo(>) 
 1 
NtFlushInstructionCache(>) 
 10 
NtReadFile(>) 
 35 
NtWaitForSingleObject(>) 
 272 

NtUserGetProcessWindowStation(>) 
 1 
NtUserGetWindowDC(>) 
 10 
NtWriteFile(>) 
 36 
NtOpenKey(>) 
 347 

NtUserGetThreadDesktop(>) 
 1 
NtClearEvent(>) 
 11 
NtUserGetClassInfo(>) 
 37 
NtQueryValueKey(>) 
 644 

NtUserSetProp(>) 
 1 
NtDeviceIoControlFile(>) 
 11 
NtOpenSection(>) 
 45 
NtClose(>) 
 716 

NtUserSetTimer(>) 
 1 
NtUserSystemParametersInfo(>) 
 11 
NtUserFindExistingCursorIcon(>) 
 48 

NtCreateIoCompletion(>) 
 2 
NtCreateSemaphore(>) 
 12 
NtQueryInformationToken(>) 
 51 

NtGdiCreateSolidBrush(>) 
 2 

Trace:
 00001   396   NtOpenKey  (0x80000000, {24, 0, 0x40, 0, 0,  (0x80000000, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\packed.exe"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00002   396   NtOpenKeyedEvent  (0x2000000, {24, 0, 0x0, 0, 0,  (0x2000000, {24, 0, 0x0, 0, 0, "\KernelObjects\CritSecOutOfMemoryEvent"}, ... 4, ) }, ... 4, ) == 0x0
 00003   396   NtQuerySystemInformation  (Basic, 44, ... {Unknown=0,MaximumIncrement=156250,PhysicalPageSize=0x1000,NumberOfPhysicalPages=0xff7c,LowestPhysicalPage=0x1,HighestPhysicalPage=0xffff,AllocationGranularity=0x10000,LowestUserAddress=0x10000,HighestUserAddress=0x7ffeffff,ActiveProcessors=1,NumberProcessors=1,}, 0x0, ) == 0x0
 00004   396   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ... 1310720, 1048576, ) == 0x0
 00005   396   NtAllocateVirtualMemory  (-1, 1310720, 0, 4096, 4096, 4, ... 1310720, 4096, ) == 0x0
 00006   396   NtAllocateVirtualMemory  (-1, 1314816, 0, 8192, 4096, 4, ... 1314816, 8192, ) == 0x0
 00007   396   NtQuerySystemInformation  (Basic, 44, ... {Unknown=0,MaximumIncrement=156250,PhysicalPageSize=0x1000,NumberOfPhysicalPages=0xff7c,LowestPhysicalPage=0x1,HighestPhysicalPage=0xffff,AllocationGranularity=0x10000,LowestUserAddress=0x10000,HighestUserAddress=0x7ffeffff,ActiveProcessors=1,NumberProcessors=1,}, 0x0, ) == 0x0
 00008   396   NtAllocateVirtualMemory  (-1, 0, 0, 65536, 8192, 4, ... 2359296, 65536, ) == 0x0
 00009   396   NtAllocateVirtualMemory  (-1, 2359296, 0, 24576, 4096, 4, ... 2359296, 24576, ) == 0x0
 00010   396   NtOpenDirectoryObject  (0x3, {24, 0, 0x40, 0, 0,  (0x3, {24, 0, 0x40, 0, 0, "\KnownDlls"}, ... 8, ) }, ... 8, ) == 0x0
 00011   396   NtOpenSymbolicLinkObject  (0x1, {24, 8, 0x40, 0, 0,  (0x1, {24, 8, 0x40, 0, 0, "KnownDllPath"}, ... 12, ) }, ... 12, ) == 0x0
 00012   396   NtQuerySymbolicLinkObject  (12, ...  (12, ... "C:\WINDOWS\system32", 0x0, ) , 0x0, ) == 0x0
 00013   396   NtClose  (12, ... ) == 0x0
 00014   396   NtOpenFile  (0x100020, {24, 0, 0x42, 0, 0,  (0x100020, {24, 0, 0x42, 0, 0, "\??\U:\startupscripts\"}, 3, 33, ... 12, {status=0x0, info=1}, ) }, 3, 33, ... 12, {status=0x0, info=1}, ) == 0x0
 00015   396   NtQueryVolumeInformationFile  (12, 1243848, 8, Device, ... {status=0x0, info=8}, ) == 0x0
 00016   396   NtFsControlFile  (12, 0, 0x0, 0x0, 0x90028, 0x0, 0, 0, ... ) == STATUS_INVALID_PARAMETER
 00017   396   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\u:\work\packed.exe.Local"}, 1243832, ... ) }, 1243832, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00018   396   NtOpenSection  (0xe, {24, 8, 0x40, 0, 0,  (0xe, {24, 8, 0x40, 0, 0, "kernel32.dll"}, ... 16, ) }, ... 16, ) == 0x0
 00019   396   NtMapViewOfSection  (16, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x77e60000), 0x0, 937984, ) == 0x0
 00020   396   NtClose  (16, ... ) == 0x0
 00021   396   NtQuerySystemInformation  (RangeStart, 4, ... {system info, class 50, size 4}, 0x0, ) == 0x0
 00022   396   NtQuerySystemInformation  (Basic, 44, ... {Unknown=0,MaximumIncrement=156250,PhysicalPageSize=0x1000,NumberOfPhysicalPages=0xff7c,LowestPhysicalPage=0x1,HighestPhysicalPage=0xffff,AllocationGranularity=0x10000,LowestUserAddress=0x10000,HighestUserAddress=0x7ffeffff,ActiveProcessors=1,NumberProcessors=1,}, 0x0, ) == 0x0
 00023   396   NtCreateSection  (0xf001f, 0x0, {65536, 0}, 4, 67108864, 0, ... 16, ) == 0x0
 00024   396   NtSecureConnectPort  ( ("\Windows\ApiPort", {0, 2, 1, 1}, {24, 16, 0, 65536, 0, 0}, 1319736, {12, 0, 0}, 1242016, 44, ... 24, {24, 16, 0, 65536, 2424832, 18677760}, {0, 0, 0}, 200, 44, ) , {0, 2, 1, 1}, {24, 16, 0, 65536, 0, 0}, 1319736, {12, 0, 0}, 1242016, 44, ... 24, {24, 16, 0, 65536, 2424832, 18677760}, {0, 0, 0}, 200, 44, ) == 0x0
 00025   396   NtClose  (16, ... ) == 0x0
 00026   396   NtQueryObject  (24, Handle, 2, ... {Inherit=0,ProtectFromClose=0,}, -1, ) == 0x0
 00027   396   NtSetInformationObject  (24, Handle, {Inherit=0,ProtectFromClose=1,}, 256, ... ) == 0x0
 00028   396   NtQuerySystemInformation  (Basic, 44, ... {Unknown=0,MaximumIncrement=156250,PhysicalPageSize=0x1000,NumberOfPhysicalPages=0xff7c,LowestPhysicalPage=0x1,HighestPhysicalPage=0xffff,AllocationGranularity=0x10000,LowestUserAddress=0x10000,HighestUserAddress=0x7ffeffff,ActiveProcessors=1,NumberProcessors=1,}, 0x0, ) == 0x0
 00029   396   NtQueryVirtualMemory  (-1, 0x250000, Basic, 28, ... {BaseAddress=0x250000,AllocationBase=0x250000,AllocationProtect=0x4,RegionSize=0x10000,State=0x2000,Protect=0x0,Type=0x40000,}, 0x0, ) == 0x0
 00030   396   NtAllocateVirtualMemory  (-1, 2424832, 0, 4096, 4096, 4, ... 2424832, 4096, ) == 0x0
 00031   396   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 0, 0, 0, 0}  (24, {28, 56, new_msg, 0, 0, 0, 0, 0} "\210\6\35\1\0\0\0\0\0\0\0\0\0\0\0\0\1\0\0\0\234\6\35\1\4\0\0\0" ... {28, 56, reply, 0, 316, 396, 1491, 0} "\0\361\26\0\0\0\0\0\0\0\0\0\0\0\0\0\1\0\0\0\234\6\35\1\4\0\0\0" )  ... {28, 56, reply, 0, 316, 396, 1491, 0}  (24, {28, 56, new_msg, 0, 0, 0, 0, 0} "\210\6\35\1\0\0\0\0\0\0\0\0\0\0\0\0\1\0\0\0\234\6\35\1\4\0\0\0" ... {28, 56, reply, 0, 316, 396, 1491, 0} "\0\361\26\0\0\0\0\0\0\0\0\0\0\0\0\0\1\0\0\0\234\6\35\1\4\0\0\0" )  ) == 0x0
 00032   396   NtRegisterThreadTerminatePort  (24, ... ) == 0x0
 00033   396   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\System\CurrentControlSet\Control\Terminal Server"}, ... 16, ) }, ... 16, ) == 0x0
 00034   396   NtQueryValueKey  (16,  (16, "TSAppCompat", Partial, 548, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) , Partial, 548, ... TitleIdx=0, Type=4, Data= (16, "TSAppCompat", Partial, 548, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) }, 16, ) == 0x0
 00035   396   NtClose  (16, ... ) == 0x0
 00036   396   NtAllocateVirtualMemory  (-1, 1232896, 0, 4096, 4096, 260, ... 1232896, 4096, ) == 0x0
 00037   396   NtOpenMutant  (0x1, {24, 0, 0x40, 0, 0,  (0x1, {24, 0, 0x40, 0, 0, "\NlsCacheMutant"}, ... 16, ) }, ... 16, ) == 0x0
 00038   396   NtOpenSection  (0x4, {24, 0, 0x40, 0, 0,  (0x4, {24, 0, 0x40, 0, 0, "\NLS\NlsSectionUnicode"}, ... 28, ) }, ... 28, ) == 0x0
 00039   396   NtMapViewOfSection  (28, -1, (0x0), 0, 0, 0x0, 0, 2, 0, 2, ... (0x260000), 0x0, 90112, ) == 0x0
 00040   396   NtClose  (28, ... ) == 0x0
 00041   396   NtQueryDefaultLocale  (0, 2012046252, ... ) == 0x0
 00042   396   NtOpenSection  (0x4, {24, 0, 0x40, 0, 0,  (0x4, {24, 0, 0x40, 0, 0, "\NLS\NlsSectionLocale"}, ... 28, ) }, ... 28, ) == 0x0
 00043   396   NtMapViewOfSection  (28, -1, (0x0), 0, 0, 0x0, 0, 2, 0, 2, ... (0x280000), 0x0, 212992, ) == 0x0
 00044   396   NtClose  (28, ... ) == 0x0
 00045   396   NtOpenSection  (0x5, {24, 0, 0x40, 0, 0,  (0x5, {24, 0, 0x40, 0, 0, "\NLS\NlsSectionSortkey"}, ... 28, ) }, ... 28, ) == 0x0
 00046   396   NtMapViewOfSection  (28, -1, (0x0), 0, 0, 0x0, 0, 2, 0, 2, ... (0x2c0000), 0x0, 266240, ) == 0x0
 00047   396   NtQuerySection  (28, Basic, 16, ... {BaseAddress=0x0,Attributes=0x800000,Size={0x40004, 0x0},}, 0x0, ) == 0x0
 00048   396   NtClose  (28, ... ) == 0x0
 00049   396   NtOpenSection  (0x4, {24, 0, 0x40, 0, 0,  (0x4, {24, 0, 0x40, 0, 0, "\NLS\NlsSectionSortTbls"}, ... 28, ) }, ... 28, ) == 0x0
 00050   396   NtMapViewOfSection  (28, -1, (0x0), 0, 0, 0x0, 0, 2, 0, 2, ... (0x310000), 0x0, 24576, ) == 0x0
 00051   396   NtClose  (28, ... ) == 0x0
 00052   396   NtQueryVirtualMemory  (-1, 0x7ffd2000, Basic, 28, ... {BaseAddress=0x7ffd2000,AllocationBase=0x7ffb0000,AllocationProtect=0x2,RegionSize=0x2000,State=0x1000,Protect=0x2,Type=0x40000,}, 0x0, ) == 0x0
 00053   396   NtOpenSection  (0x4, {24, 0, 0x40, 0, 0,  (0x4, {24, 0, 0x40, 0, 0, "\NLS\NlsSectionSortkey00000409"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00054   396   NtOpenSection  (0x4, {24, 0, 0x40, 0, 0,  (0x4, {24, 0, 0x40, 0, 0, "\NLS\NlsSectionSortkey00000409"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00055   396   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 2012558373, 2012047104, 2013025280, 0}  (24, {28, 56, new_msg, 0, 2012558373, 2012047104, 2013025280, 0} "\210\6\35\1\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\234\6\35\18\6\0\0" ... {28, 56, reply, 0, 316, 396, 1494, 0} "\220\270\27\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\234\6\35\18\6\0\0" )  ... {28, 56, reply, 0, 316, 396, 1494, 0}  (24, {28, 56, new_msg, 0, 2012558373, 2012047104, 2013025280, 0} "\210\6\35\1\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\234\6\35\18\6\0\0" ... {28, 56, reply, 0, 316, 396, 1494, 0} "\220\270\27\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\234\6\35\18\6\0\0" )  ) == 0x0
 00056   396   NtProtectVirtualMemory  (-1, (0x40f000), 118784, 4, ... (0x40f000), 118784, 128, ) == 0x0
 00057   396   NtProtectVirtualMemory  (-1, (0x40f000), 118784, 128, ... (0x40f000), 118784, 4, ) == 0x0
 00058   396   NtFlushInstructionCache  (-1, 4255744, 118784, ... ) == 0x0
 00059   396   NtOpenSection  (0xe, {24, 8, 0x40, 0, 0,  (0xe, {24, 8, 0x40, 0, 0, "oleaut32.dll"}, ... 28, ) }, ... 28, ) == 0x0
 00060   396   NtMapViewOfSection  (28, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x77120000), 0x0, 569344, ) == 0x0
 00061   396   NtClose  (28, ... ) == 0x0
 00062   396   NtOpenSection  (0xe, {24, 8, 0x40, 0, 0,  (0xe, {24, 8, 0x40, 0, 0, "MSVCRT.DLL"}, ... 28, ) }, ... 28, ) == 0x0
 00063   396   NtMapViewOfSection  (28, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x77c10000), 0x0, 339968, ) == 0x0
 00064   396   NtClose  (28, ... ) == 0x0
 00065   396   NtOpenSection  (0xe, {24, 8, 0x40, 0, 0,  (0xe, {24, 8, 0x40, 0, 0, "OLE32.DLL"}, ... 28, ) }, ... 28, ) == 0x0
 00066   396   NtMapViewOfSection  (28, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x771b0000), 0x0, 1155072, ) == 0x0
 00067   396   NtClose  (28, ... ) == 0x0
 00068   396   NtOpenSection  (0xe, {24, 8, 0x40, 0, 0,  (0xe, {24, 8, 0x40, 0, 0, "GDI32.dll"}, ... 28, ) }, ... 28, ) == 0x0
 00069   396   NtMapViewOfSection  (28, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x77c70000), 0x0, 262144, ) == 0x0
 00070   396   NtClose  (28, ... ) == 0x0
 00071   396   NtOpenSection  (0xe, {24, 8, 0x40, 0, 0,  (0xe, {24, 8, 0x40, 0, 0, "USER32.dll"}, ... 28, ) }, ... 28, ) == 0x0
 00072   396   NtMapViewOfSection  (28, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x77d40000), 0x0, 577536, ) == 0x0
 00073   396   NtClose  (28, ... ) == 0x0
 00074   396   NtOpenSection  (0xe, {24, 8, 0x40, 0, 0,  (0xe, {24, 8, 0x40, 0, 0, "ADVAPI32.dll"}, ... 28, ) }, ... 28, ) == 0x0
 00075   396   NtMapViewOfSection  (28, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x77dd0000), 0x0, 569344, ) == 0x0
 00076   396   NtClose  (28, ... ) == 0x0
 00077   396   NtOpenSection  (0xe, {24, 8, 0x40, 0, 0,  (0xe, {24, 8, 0x40, 0, 0, "RPCRT4.dll"}, ... 28, ) }, ... 28, ) == 0x0
 00078   396   NtMapViewOfSection  (28, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x77cc0000), 0x0, 479232, ) == 0x0
 00079   396   NtClose  (28, ... ) == 0x0
 00080   396   NtProtectVirtualMemory  (-1, (0x40f000), 118784, 4, ... (0x40f000), 118784, 64, ) == 0x0
 00081   396   NtProtectVirtualMemory  (-1, (0x40f000), 118784, 64, ... (0x40f000), 118784, 4, ) == 0x0
 00082   396   NtFlushInstructionCache  (-1, 4255744, 118784, ... ) == 0x0
 00083   396   NtProtectVirtualMemory  (-1, (0x40f000), 118784, 4, ... (0x40f000), 118784, 64, ) == 0x0
 00084   396   NtProtectVirtualMemory  (-1, (0x40f000), 118784, 64, ... (0x40f000), 118784, 4, ) == 0x0
 00085   396   NtFlushInstructionCache  (-1, 4255744, 118784, ... ) == 0x0
 00086   396   NtOpenProcessToken  (-1, 0x8, ... 28, ) == 0x0
 00087   396   NtQueryInformationToken  (28, Statistics, 56, ... {token info, class 10, size 56}, 56, ) == 0x0
 00088   396   NtClose  (28, ... ) == 0x0
 00089   396   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\System\CurrentControlSet\Control\Terminal Server"}, ... 28, ) }, ... 28, ) == 0x0
 00090   396   NtQueryValueKey  (28,  (28, "TSAppCompat", Partial, 548, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) , Partial, 548, ... TitleIdx=0, Type=4, Data= (28, "TSAppCompat", Partial, 548, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) }, 16, ) == 0x0
 00091   396   NtClose  (28, ... ) == 0x0
 00092   396   NtQuerySystemInformation  (Basic, 44, ... {Unknown=0,MaximumIncrement=156250,PhysicalPageSize=0x1000,NumberOfPhysicalPages=0xff7c,LowestPhysicalPage=0x1,HighestPhysicalPage=0xffff,AllocationGranularity=0x10000,LowestUserAddress=0x10000,HighestUserAddress=0x7ffeffff,ActiveProcessors=1,NumberProcessors=1,}, 0x0, ) == 0x0
 00093   396   NtAllocateVirtualMemory  (-1, 0, 0, 65536, 8192, 4, ... 3276800, 65536, ) == 0x0
 00094   396   NtAllocateVirtualMemory  (-1, 3276800, 0, 4096, 4096, 4, ... 3276800, 4096, ) == 0x0
 00095   396   NtAllocateVirtualMemory  (-1, 3280896, 0, 8192, 4096, 4, ... 3280896, 8192, ) == 0x0
 00096   396   NtAllocateVirtualMemory  (-1, 1323008, 0, 4096, 4096, 4, ... 1323008, 4096, ) == 0x0
 00097   396   NtOpenSection  (0x4, {24, 0, 0x40, 0, 0,  (0x4, {24, 0, 0x40, 0, 0, "\NLS\NlsSectionCType"}, ... 28, ) }, ... 28, ) == 0x0
 00098   396   NtMapViewOfSection  (28, -1, (0x0), 0, 0, 0x0, 0, 2, 0, 2, ... (0x330000), 0x0, 12288, ) == 0x0
 00099   396   NtClose  (28, ... ) == 0x0
 00100   396   NtAllocateVirtualMemory  (-1, 3289088, 0, 4096, 4096, 4, ... 3289088, 4096, ) == 0x0
 00101   396   NtQuerySystemInformation  (Basic, 44, ... {Unknown=0,MaximumIncrement=156250,PhysicalPageSize=0x1000,NumberOfPhysicalPages=0xff7c,LowestPhysicalPage=0x1,HighestPhysicalPage=0xffff,AllocationGranularity=0x10000,LowestUserAddress=0x10000,HighestUserAddress=0x7ffeffff,ActiveProcessors=1,NumberProcessors=1,}, 0x0, ) == 0x0
 00102   396   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1243120, 256, 1242864, 256}  (24, {28, 56, new_msg, 0, 1243120, 256, 1242864, 256} "\210\6\35\1\0\0\0\0\1\0\0\0\360\367\22\0\3\0\0\0\234\6\35\1$\1\0\0" ... {28, 56, reply, 0, 316, 396, 1497, 0} "XQ\26\0\0\0\0\0\0\0\0\0\360\367\22\0\3\0\0\0\234\6\35\1$\1\0\0" )  ... {28, 56, reply, 0, 316, 396, 1497, 0}  (24, {28, 56, new_msg, 0, 1243120, 256, 1242864, 256} "\210\6\35\1\0\0\0\0\1\0\0\0\360\367\22\0\3\0\0\0\234\6\35\1$\1\0\0" ... {28, 56, reply, 0, 316, 396, 1497, 0} "XQ\26\0\0\0\0\0\0\0\0\0\360\367\22\0\3\0\0\0\234\6\35\1$\1\0\0" )  ) == 0x0
 00103   396   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\System\CurrentControlSet\Control\Error Message Instrument\"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00104   396   NtMapViewOfSection  (28, -1, (0x0), 0, 0, 0x0, 0, 2, 0, 2, ... (0x500000), 0x0, 1060864, ) == 0x0
 00105   396   NtCreateEvent  (0x1f0003, 0x0, 1, 0, ... 32, ) == 0x0
 00106   396   NtOpenThreadTokenEx  (-2, 0x8, 1, 512, ... ) == STATUS_NO_TOKEN
 00107   396   NtOpenProcessTokenEx  (-1, 0x8, 512, ... -2147482020, ) == 0x0
 00108   396   NtQueryInformationToken  (-2147482020, Statistics, 0, ... ) == STATUS_BUFFER_TOO_SMALL
 00109   396   NtQueryInformationToken  (-2147482020, Statistics, 56, ... {token info, class 10, size 56}, 56, ) == 0x0
 00110   396   NtClose  (-2147482020, ... ) == 0x0
 00111   396   NtAllocateVirtualMemory  (-1, 0, 0, 32, 4096, 4, ... 3407872, 4096, ) == 0x0
 00112   396   NtFreeVirtualMemory  (-1, (0x340000), 4096, 32768, ... (0x340000), 4096, ) == 0x0
 00113   396   NtDuplicateObject  (-1, 36, -1, 0x0, 0, 2, ... 44, ) == 0x0
 00114   396   NtOpenKey  (0x20019, {24, 0, 0x240, 0, 0,  (0x20019, {24, 0, 0x240, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Compatibility32"}, ... -2147482020, ) }, ... -2147482020, ) == 0x0
 00115   396   NtQueryValueKey  (-2147482020,  (-2147482020, "packed", Partial, 172, ... ) , Partial, 172, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00116   396   NtClose  (-2147482020, ... ) == 0x0
 00117   396   NtOpenKey  (0x20019, {24, 0, 0x240, 0, 0,  (0x20019, {24, 0, 0x240, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\IME Compatibility"}, ... -2147482020, ) }, ... -2147482020, ) == 0x0
 00118   396   NtQueryValueKey  (-2147482020,  (-2147482020, "packed", Partial, 172, ... ) , Partial, 172, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00119   396   NtClose  (-2147482020, ... ) == 0x0
 00120   396   NtQueryDefaultLocale  (0, -136574452, ... ) == 0x0
 00121   396   NtGdiQueryFontAssocInfo  (0, ... ) == 0x0
 00122   396   NtUserCallNoParam  (24, ... ) == 0x0
 00123   396   NtGdiCreateCompatibleDC  (0, ...
 00124   396   NtAllocateVirtualMemory  (-1, 0, 0, 4096, 12288, 4, ... 3407872, 4096, ) == 0x0
 00123   396   NtGdiCreateCompatibleDC  ... ) == 0x13010328
 00125   396   NtGdiGetStockObject  (0, ... ) == 0x1900010
 00126   396   NtGdiGetStockObject  (4, ... ) == 0x1900011
 00127   396   NtGdiCreateBitmap  (8, 8, 1, 1, 2010393708, ... ) == 0x3905031e
 00128   396   NtGdiCreateSolidBrush  (0, 0, ...
 00129   396   NtAllocateVirtualMemory  (-1, 0, 0, 4096, 12288, 4, ... 3473408, 4096, ) == 0x0
 00128   396   NtGdiCreateSolidBrush  ... ) == 0x1d100329
 00130   396   NtGdiGetStockObject  (13, ... ) == 0x18a0021
 00131   396   NtGdiCreateCompatibleDC  (0, ... ) == 0x40010320
 00132   396   NtGdiSelectBitmap  (1073808160, 956629790, ... ) == 0x185000f
 00133   396   NtUserGetThreadDesktop  (396, 0, ... ) == 0x28
 00134   396   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Windows"}, ... 48, ) }, ... 48, ) == 0x0
 00135   396   NtQueryValueKey  (48,  (48, "AppInit_DLLs", Partial, 64, ... TitleIdx=0, Type=1, Data="\0\0"}, 14, ) , Partial, 64, ... TitleIdx=0, Type=1, Data= (48, "AppInit_DLLs", Partial, 64, ... TitleIdx=0, Type=1, Data="\0\0"}, 14, ) }, 14, ) == 0x0
 00136   396   NtClose  (48, ... ) == 0x0
 00137   396   NtUserFindExistingCursorIcon  (1241204, 1241220, 1241788, ... ) == 0x10011
 00138   396   NtUserRegisterClassExWOW  (1241724, 1241804, 1241788, 1241820, 673, 128, 0, ... ) == 0x810dc017
 00139   396   NtUserFindExistingCursorIcon  (1241204, 1241220, 1241788, ... ) == 0x10011
 00140   396   NtUserRegisterClassExWOW  (1241724, 1241804, 1241788, 1241820, 674, 128, 0, ... ) == 0x810dc01c
 00141   396   NtUserFindExistingCursorIcon  (1241204, 1241220, 1241788, ... ) == 0x10011
 00142   396   NtUserRegisterClassExWOW  (1241724, 1241804, 1241788, 1241820, 675, 128, 0, ... ) == 0x810dc01e
 00143   396   NtUserFindExistingCursorIcon  (1241204, 1241220, 1241788, ... ) == 0x10011
 00144   396   NtUserRegisterClassExWOW  (1241724, 1241804, 1241788, 1241820, 676, 128, 0, ... ) == 0x810d8002
 00145   396   NtUserFindExistingCursorIcon  (1241204, 1241220, 1241788, ... ) == 0x10013
 00146   396   NtUserRegisterClassExWOW  (1241724, 1241804, 1241788, 1241820, 677, 128, 0, ... ) == 0x810dc018
 00147   396   NtUserFindExistingCursorIcon  (1241204, 1241220, 1241788, ... ) == 0x10011
 00148   396   NtUserRegisterClassExWOW  (1241724, 1241804, 1241788, 1241820, 678, 128, 0, ... ) == 0x810dc01a
 00149   396   NtUserFindExistingCursorIcon  (1241204, 1241220, 1241788, ... ) == 0x10011
 00150   396   NtUserRegisterClassExWOW  (1241724, 1241804, 1241788, 1241820, 679, 128, 0, ... ) == 0x810dc01d
 00151   396   NtUserFindExistingCursorIcon  (1241204, 1241220, 1241788, ... ) == 0x10011
 00152   396   NtUserRegisterClassExWOW  (1241724, 1241804, 1241788, 1241820, 681, 128, 0, ...
 00153   396   NtAllocateVirtualMemory  (-1, 6451200, 0, 4096, 4096, 32, ... 6451200, 4096, ) == 0x0
 00152   396   NtUserRegisterClassExWOW  ... ) == 0x810dc026
 00154   396   NtUserFindExistingCursorIcon  (1241204, 1241220, 1241788, ... ) == 0x10011
 00155   396   NtUserRegisterClassExWOW  (1241724, 1241804, 1241788, 1241820, 680, 128, 0, ... ) == 0x810dc019
 00156   396   NtUserRegisterClassExWOW  (1241676, 1241756, 1241740, 1241772, 0, 128, 0, ... ) == 0x810dc020
 00157   396   NtUserRegisterClassExWOW  (1241676, 1241752, 1241768, 1241740, 0, 130, 0, ... ) == 0x810dc022
 00158   396   NtUserRegisterClassExWOW  (1241676, 1241756, 1241740, 1241772, 0, 128, 0, ... ) == 0x810dc023
 00159   396   NtUserRegisterClassExWOW  (1241676, 1241752, 1241768, 1241740, 0, 130, 0, ... ) == 0x810dc024
 00160   396   NtUserRegisterClassExWOW  (1241676, 1241756, 1241740, 1241772, 0, 128, 0, ... ) == 0x810dc025
 00161   396   NtCallbackReturn  (0, 0, 0, ...
 00162   396   NtGdiInit  (... ) == 0x1
 00163   396   NtGdiGetStockObject  (18, ... ) == 0x290001c
 00164   396   NtGdiGetStockObject  (19, ... ) == 0x1b00019
 00165   396   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\System\CurrentControlSet\Control\Terminal Server"}, ... 48, ) }, ... 48, ) == 0x0
 00166   396   NtQueryValueKey  (48,  (48, "TSAppCompat", Partial, 548, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) , Partial, 548, ... TitleIdx=0, Type=4, Data= (48, "TSAppCompat", Partial, 548, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) }, 16, ) == 0x0
 00167   396   NtQueryValueKey  (48,  (48, "TSUserEnabled", Partial, 548, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) , Partial, 548, ... TitleIdx=0, Type=4, Data= (48, "TSUserEnabled", Partial, 548, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) }, 16, ) == 0x0
 00168   396   NtClose  (48, ... ) == 0x0
 00169   396   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon"}, ... 48, ) }, ... 48, ) == 0x0
 00170   396   NtQueryValueKey  (48,  (48, "LeakTrack", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00171   396   NtClose  (48, ... ) == 0x0
 00172   396   NtOpenKey  (0x2000000, {24, 0, 0x40, 0, 0,  (0x2000000, {24, 0, 0x40, 0, 0, "\REGISTRY\MACHINE"}, ... 48, ) }, ... 48, ) == 0x0
 00173   396   NtSetInformationObject  (48, Handle, {Inherit=0,ProtectFromClose=1,}, 2011365632, ... ) == 0x0
 00174   396   NtOpenKey  (0x20019, {24, 48, 0x40, 0, 0,  (0x20019, {24, 48, 0x40, 0, 0, "Software\Microsoft\Windows NT\CurrentVersion\Diagnostics"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00175   396   NtQuerySystemInformation  (Basic, 44, ... {Unknown=0,MaximumIncrement=156250,PhysicalPageSize=0x1000,NumberOfPhysicalPages=0xff7c,LowestPhysicalPage=0x1,HighestPhysicalPage=0xffff,AllocationGranularity=0x10000,LowestUserAddress=0x10000,HighestUserAddress=0x7ffeffff,ActiveProcessors=1,NumberProcessors=1,}, 0x0, ) == 0x0
 00176   396   NtQuerySystemInformation  (Processor, 12, ... {system info, class 1, size 12}, 0x0, ) == 0x0
 00177   396   NtOpenKey  (0x20019, {24, 48, 0x40, 0, 0,  (0x20019, {24, 48, 0x40, 0, 0, "SYSTEM\CurrentControlSet\Control\Session Manager"}, ... 52, ) }, ... 52, ) == 0x0
 00178   396   NtQueryValueKey  (52,  (52, "CriticalSectionTimeout", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\215'\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (52, "CriticalSectionTimeout", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\215'\0"}, 16, ) }, 16, ) == 0x0
 00179   396   NtClose  (52, ... ) == 0x0
 00180   396   NtQuerySystemInformation  (Basic, 44, ... {Unknown=0,MaximumIncrement=156250,PhysicalPageSize=0x1000,NumberOfPhysicalPages=0xff7c,LowestPhysicalPage=0x1,HighestPhysicalPage=0xffff,AllocationGranularity=0x10000,LowestUserAddress=0x10000,HighestUserAddress=0x7ffeffff,ActiveProcessors=1,NumberProcessors=1,}, 0x0, ) == 0x0
 00181   396   NtQuerySystemInformation  (Processor, 12, ... {system info, class 1, size 12}, 0x0, ) == 0x0
 00182   396   NtQuerySystemInformation  (Basic, 44, ... {Unknown=0,MaximumIncrement=156250,PhysicalPageSize=0x1000,NumberOfPhysicalPages=0xff7c,LowestPhysicalPage=0x1,HighestPhysicalPage=0xffff,AllocationGranularity=0x10000,LowestUserAddress=0x10000,HighestUserAddress=0x7ffeffff,ActiveProcessors=1,NumberProcessors=1,}, 0x0, ) == 0x0
 00183   396   NtQuerySystemInformation  (Processor, 12, ... {system info, class 1, size 12}, 0x0, ) == 0x0
 00184   396   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Classes\Interface"}, ... 52, ) }, ... 52, ) == 0x0
 00185   396   NtQueryValueKey  (52,  (52, "InterfaceHelperDisableAll", Full, 0, ... ) , Full, 0, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00186   396   NtQueryValueKey  (52,  (52, "InterfaceHelperDisableAllForOle32", Full, 0, ... ) , Full, 0, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00187   396   NtQueryValueKey  (52,  (52, "InterfaceHelperDisableTypeLib", Full, 0, ... ) , Full, 0, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00188   396   NtClose  (52, ... ) == 0x0
 00189   396   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Classes\Interface\{00020400-0000-0000-C000-000000000046}"}, ... 52, ) }, ... 52, ) == 0x0
 00190   396   NtQueryValueKey  (52,  (52, "InterfaceHelperDisableAll", Full, 0, ... ) , Full, 0, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00191   396   NtQueryValueKey  (52,  (52, "InterfaceHelperDisableAllForOle32", Full, 0, ... ) , Full, 0, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00192   396   NtClose  (52, ... ) == 0x0
 00193   396   NtOpenDirectoryObject  (0x2000f, {24, 0, 0x40, 0, 0,  (0x2000f, {24, 0, 0x40, 0, 0, "\BaseNamedObjects"}, ... 52, ) }, ... 52, ) == 0x0
 00194   396   NtOpenEvent  (0x1f0003, {24, 52, 0x0, 0, 0,  (0x1f0003, {24, 52, 0x0, 0, 0, "HookSwitchHookEnabledEvent"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00195   396   NtUserRegisterWindowMessage  ( ("{FB8F0821-0164-101B-84ED-08002B2EC713}", ... ) , ... ) == 0xc07b
 00196   396   NtOpenKey  (0x1, {24, 48, 0x40, 0, 0,  (0x1, {24, 48, 0x40, 0, 0, "SOFTWARE\Microsoft\OLEAUT"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00197   396   NtAllocateVirtualMemory  (-1, 1327104, 0, 4096, 4096, 4, ... 1327104, 4096, ) == 0x0
 00198   396   NtOpenKey  (0x9, {24, 48, 0x40, 0, 0,  (0x9, {24, 48, 0x40, 0, 0, "SOFTWARE\Microsoft\OLEAUT\UserEra"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00199   396   NtOpenKey  (0x1, {24, 0, 0x40, 0, 0,  (0x1, {24, 0, 0x40, 0, 0, "\Registry\MACHINE\System\CurrentControlSet\Control\Session Manager"}, ... 56, ) }, ... 56, ) == 0x0
 00200   396   NtQueryValueKey  (56,  (56, "SafeDllSearchMode", Partial, 16, ... ) , Partial, 16, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00201   396   NtClose  (56, ... ) == 0x0
 00202   396   NtOpenKey  (0x1, {24, 48, 0x40, 0, 0,  (0x1, {24, 48, 0x40, 0, 0, "SOFTWARE\Microsoft\OLEAUT"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00203   396   NtTestAlert  (... ) == 0x0
 00204   396   NtContinue  (1244464, 1, ...
 00205   396   NtSetInformationThread  (-2, Win32StartAddress(LpcReceivedMessageId), {StartAddress(LpcReceivedMsgId)=0x401000,}, 4, ... ) == 0x0
 00206   396   NtAllocateVirtualMemory  (-1, 0, 0, 196608, 4096, 64, ... 3538944, 196608, ) == 0x0
 00207   396   NtAllocateVirtualMemory  (-1, 0, 0, 196608, 4096, 64, ... 3735552, 196608, ) == 0x0
 00208   396   NtFreeVirtualMemory  (-1, (0x360000), 0, 32768, ... (0x360000), 196608, ) == 0x0
 00209   396   NtAllocateVirtualMemory  (-1, 0, 0, 1350, 4096, 4, ... 3538944, 4096, ) == 0x0
 00210   396   NtFreeVirtualMemory  (-1, (0x360000), 0, 32768, ... (0x360000), 4096, ) == 0x0
 00211   396   NtAllocateVirtualMemory  (-1, 0, 0, 148480, 4096, 4, ... 3538944, 151552, ) == 0x0
 00212   396   NtFreeVirtualMemory  (-1, (0x360000), 0, 32768, ... (0x360000), 151552, ) == 0x0
 00213   396   NtAllocateVirtualMemory  (-1, 0, 0, 2560, 4096, 4, ... 3538944, 4096, ) == 0x0
 00214   396   NtFreeVirtualMemory  (-1, (0x360000), 0, 32768, ... (0x360000), 4096, ) == 0x0
 00215   396   NtAllocateVirtualMemory  (-1, 0, 0, 3584, 4096, 4, ... 3538944, 4096, ) == 0x0
 00216   396   NtFreeVirtualMemory  (-1, (0x360000), 0, 32768, ... (0x360000), 4096, ) == 0x0
 00217   396   NtAllocateVirtualMemory  (-1, 0, 0, 8704, 4096, 4, ... 3538944, 12288, ) == 0x0
 00218   396   NtFreeVirtualMemory  (-1, (0x360000), 0, 32768, ... (0x360000), 12288, ) == 0x0
 00219   396   NtOpenSection  (0xe, {24, 8, 0x40, 0, 0,  (0xe, {24, 8, 0x40, 0, 0, "version.dll"}, ... 56, ) }, ... 56, ) == 0x0
 00220   396   NtMapViewOfSection  (56, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x77c00000), 0x0, 28672, ) == 0x0
 00221   396   NtClose  (56, ... ) == 0x0
 00222   396   NtOpenSection  (0xe, {24, 8, 0x40, 0, 0,  (0xe, {24, 8, 0x40, 0, 0, "wsock32.dll"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00223   396   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\u:\work\wsock32.dll"}, 1243008, ... ) }, 1243008, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00224   396   NtQueryAttributesFile  ({24, 12, 0x40, 0, 0,  ({24, 12, 0x40, 0, 0, "wsock32.dll"}, 1243008, ... ) }, 1243008, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00225   396   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\System32\wsock32.dll"}, 1243008, ... ) }, 1243008, ... ) == 0x0
 00226   396   NtOpenFile  (0x100020, {24, 0, 0x40, 0, 0,  (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\System32\wsock32.dll"}, 5, 96, ... 56, {status=0x0, info=1}, ) }, 5, 96, ... 56, {status=0x0, info=1}, ) == 0x0
 00227   396   NtCreateSection  (0xf, 0x0, 0x0, 16, 16777216, 56, ... 60, ) == 0x0
 00228   396   NtQuerySection  (60, Image, 48, ... {section info, class 1, size 48}, 0x0, ) == 0x0
 00229   396   NtOpenProcessToken  (-1, 0x8, ... 64, ) == 0x0
 00230   396   NtQueryInformationToken  (64, User, 136, ... {token info, class 1, size 36}, 36, ) == 0x0
 00231   396   NtOpenKey  (0x3, {24, 0, 0x40, 0, 0,  (0x3, {24, 0, 0x40, 0, 0, "\Registry\MACHINE\System\CurrentControlSet\Control\SafeBoot\Option"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00232   396   NtOpenKey  (0x1, {24, 0, 0x40, 0, 0,  (0x1, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers"}, ... 68, ) }, ... 68, ) == 0x0
 00233   396   NtQueryValueKey  (68,  (68, "TransparentEnabled", Partial, 80, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) , Partial, 80, ... TitleIdx=0, Type=4, Data= (68, "TransparentEnabled", Partial, 80, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) }, 16, ) == 0x0
 00234   396   NtClose  (68, ... ) == 0x0
 00235   396   NtOpenThreadTokenEx  (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN
 00236   396   NtOpenProcessTokenEx  (-1, 0x20008, 512, ... 68, ) == 0x0
 00237   396   NtQueryInformationToken  (68, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0
 00238   396   NtClose  (68, ... ) == 0x0
 00239   396   NtOpenKey  (0x1, {24, 0, 0x40, 0, 0,  (0x1, {24, 0, 0x40, 0, 0, "\REGISTRY\USER\S-1-5-21-1078081533-484763869-839522115-1003\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00240   396   NtClose  (64, ... ) == 0x0
 00241   396   NtClose  (56, ... ) == 0x0
 00242   396   NtMapViewOfSection  (60, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x71ad0000), 0x0, 32768, ) == 0x0
 00243   396   NtClose  (60, ... ) == 0x0
 00244   396   NtOpenSection  (0xe, {24, 8, 0x40, 0, 0,  (0xe, {24, 8, 0x40, 0, 0, "WS2_32.dll"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00245   396   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\u:\work\WS2_32.dll"}, 1242204, ... ) }, 1242204, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00246   396   NtQueryAttributesFile  ({24, 12, 0x40, 0, 0,  ({24, 12, 0x40, 0, 0, "WS2_32.dll"}, 1242204, ... ) }, 1242204, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00247   396   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\System32\WS2_32.dll"}, 1242204, ... ) }, 1242204, ... ) == 0x0
 00248   396   NtOpenFile  (0x100020, {24, 0, 0x40, 0, 0,  (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\System32\WS2_32.dll"}, 5, 96, ... 60, {status=0x0, info=1}, ) }, 5, 96, ... 60, {status=0x0, info=1}, ) == 0x0
 00249   396   NtCreateSection  (0xf, 0x0, 0x0, 16, 16777216, 60, ... 56, ) == 0x0
 00250   396   NtQuerySection  (56, Image, 48, ... {section info, class 1, size 48}, 0x0, ) == 0x0
 00251   396   NtClose  (60, ... ) == 0x0
 00252   396   NtMapViewOfSection  (56, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x71ab0000), 0x0, 86016, ) == 0x0
 00253   396   NtClose  (56, ... ) == 0x0
 00254   396   NtOpenSection  (0xe, {24, 8, 0x40, 0, 0,  (0xe, {24, 8, 0x40, 0, 0, "WS2HELP.dll"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00255   396   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\u:\work\WS2HELP.dll"}, 1241400, ... ) }, 1241400, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00256   396   NtQueryAttributesFile  ({24, 12, 0x40, 0, 0,  ({24, 12, 0x40, 0, 0, "WS2HELP.dll"}, 1241400, ... ) }, 1241400, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00257   396   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\System32\WS2HELP.dll"}, 1241400, ... ) }, 1241400, ... ) == 0x0
 00258   396   NtOpenFile  (0x100020, {24, 0, 0x40, 0, 0,  (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\System32\WS2HELP.dll"}, 5, 96, ... 56, {status=0x0, info=1}, ) }, 5, 96, ... 56, {status=0x0, info=1}, ) == 0x0
 00259   396   NtCreateSection  (0xf, 0x0, 0x0, 16, 16777216, 56, ... 60, ) == 0x0
 00260   396   NtQuerySection  (60, Image, 48, ... {section info, class 1, size 48}, 0x0, ) == 0x0
 00261   396   NtClose  (56, ... ) == 0x0
 00262   396   NtMapViewOfSection  (60, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x71aa0000), 0x0, 32768, ) == 0x0
 00263   396   NtClose  (60, ... ) == 0x0
 00264   396   NtQuerySystemInformation  (Basic, 44, ... {Unknown=0,MaximumIncrement=156250,PhysicalPageSize=0x1000,NumberOfPhysicalPages=0xff7c,LowestPhysicalPage=0x1,HighestPhysicalPage=0xffff,AllocationGranularity=0x10000,LowestUserAddress=0x10000,HighestUserAddress=0x7ffeffff,ActiveProcessors=1,NumberProcessors=1,}, 0x0, ) == 0x0
 00265   396   NtQuerySystemInformation  (Processor, 12, ... {system info, class 1, size 12}, 0x0, ) == 0x0
 00266   396   NtOpenThreadTokenEx  (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN
 00267   396   NtOpenProcessTokenEx  (-1, 0x20008, 512, ... 60, ) == 0x0
 00268   396   NtQueryInformationToken  (60, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0
 00269   396   NtClose  (60, ... ) == 0x0
 00270   396   NtOpenKey  (0x2000000, {24, 0, 0x640, 0, 0,  (0x2000000, {24, 0, 0x640, 0, 0, "\REGISTRY\USER\S-1-5-21-1078081533-484763869-839522115-1003"}, ... 60, ) }, ... 60, ) == 0x0
 00271   396   NtSetInformationObject  (60, Handle, {Inherit=0,ProtectFromClose=1,}, 1179904, ... ) == 0x0
 00272   396   NtOpenKey  (0xf003f, {24, 60, 0x40, 0, 0,  (0xf003f, {24, 60, 0x40, 0, 0, "Software\Borland\Locales"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00273   396   NtOpenKey  (0xf003f, {24, 60, 0x40, 0, 0,  (0xf003f, {24, 60, 0x40, 0, 0, "Software\Borland\Delphi\Locales"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00274   396   NtOpenProcessToken  (-1, 0x8, ... 56, ) == 0x0
 00275   396   NtQueryInformationToken  (56, Statistics, 56, ... {token info, class 10, size 56}, 56, ) == 0x0
 00276   396   NtClose  (56, ... ) == 0x0
 00277   396   NtWaitForSingleObject  (16, 0, 0x0, ... ) == STATUS_ACCESS_DENIED
 00278   396   NtReleaseMutant  (16, ...
 00279   396   NtContinue  (-136576888, 0, ...
 00278   396   NtReleaseMutant  ... ) == STATUS_MUTANT_NOT_OWNED
 00280   396   NtUserCallOneParam  (0, 40, ... ) == 0x4
 00281   396   NtAllocateVirtualMemory  (-1, 1331200, 0, 4096, 4096, 4, ... 1331200, 4096, ) == 0x0
 00282   396   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 1, ... 9502720, 1048576, ) == 0x0
 00283   396   NtAllocateVirtualMemory  (-1, 9502720, 0, 16384, 4096, 4, ... 9502720, 16384, ) == 0x0
 00284   396   NtUserCallNoParam  (29, ...
 00285   396   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\uxtheme.dll"}, 1242276, ... ) }, 1242276, ... ) == 0x0
 00286   396   NtOpenFile  (0x100020, {24, 0, 0x40, 0, 0,  (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\uxtheme.dll"}, 5, 96, ... 56, {status=0x0, info=1}, ) }, 5, 96, ... 56, {status=0x0, info=1}, ) == 0x0
 00287   396   NtCreateSection  (0xe, 0x0, 0x0, 16, 134217728, 56, ... 64, ) == 0x0
 00288   396   NtClose  (56, ... ) == 0x0
 00289   396   NtMapViewOfSection  (64, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 16, ... (0x3c0000), 0x0, 204800, ) == 0x0
 00290   396   NtClose  (64, ... ) == 0x0
 00291   396   NtUnmapViewOfSection  (-1, 0x3c0000, ... ) == 0x0
 00292   396   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\uxtheme.dll"}, 1242592, ... ) }, 1242592, ... ) == 0x0
 00293   396   NtOpenFile  (0x100020, {24, 0, 0x40, 0, 0,  (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\uxtheme.dll"}, 5, 96, ... 64, {status=0x0, info=1}, ) }, 5, 96, ... 64, {status=0x0, info=1}, ) == 0x0
 00294   396   NtCreateSection  (0xf, 0x0, 0x0, 16, 16777216, 64, ... 56, ) == 0x0
 00295   396   NtQuerySection  (56, Image, 48, ... {section info, class 1, size 48}, 0x0, ) == 0x0
 00296   396   NtClose  (64, ... ) == 0x0
 00297   396   NtMapViewOfSection  (56, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x5ad70000), 0x0, 212992, ) == 0x0
 00298   396   NtClose  (56, ... ) == 0x0
 00299   396   NtUserGetWindowDC  (0, ... ) == 0x1010050
 00300   396   NtUserCallOneParam  (16842832, 56, ... ) == 0x1
 00301   396   NtOpenThreadTokenEx  (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN
 00302   396   NtOpenProcessTokenEx  (-1, 0x20008, 512, ... 56, ) == 0x0
 00303   396   NtQueryInformationToken  (56, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0
 00304   396   NtClose  (56, ... ) == 0x0
 00305   396   NtOpenKey  (0x2001f, {24, 0, 0x640, 0, 0,  (0x2001f, {24, 0, 0x640, 0, 0, "\REGISTRY\USER\S-1-5-21-1078081533-484763869-839522115-1003"}, ... 56, ) }, ... 56, ) == 0x0
 00306   396   NtOpenKey  (0x1, {24, 56, 0x40, 0, 0,  (0x1, {24, 56, 0x40, 0, 0, "Software\Microsoft\Windows\CurrentVersion\ThemeManager"}, ... 64, ) }, ... 64, ) == 0x0
 00307   396   NtQueryValueKey  (64,  (64, "Compositing", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00308   396   NtClose  (64, ... ) == 0x0
 00309   396   NtClose  (56, ... ) == 0x0
 00310   396   NtOpenThreadTokenEx  (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN
 00311   396   NtOpenProcessTokenEx  (-1, 0x20008, 512, ... 56, ) == 0x0
 00312   396   NtQueryInformationToken  (56, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0
 00313   396   NtClose  (56, ... ) == 0x0
 00314   396   NtOpenKey  (0x20019, {24, 0, 0x640, 0, 0,  (0x20019, {24, 0, 0x640, 0, 0, "\REGISTRY\USER\S-1-5-21-1078081533-484763869-839522115-1003"}, ... 56, ) }, ... 56, ) == 0x0
 00315   396   NtOpenKey  (0x1, {24, 56, 0x40, 0, 0,  (0x1, {24, 56, 0x40, 0, 0, "Control Panel\Desktop"}, ... 64, ) }, ... 64, ) == 0x0
 00316   396   NtQueryValueKey  (64,  (64, "LameButtonText", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00317   396   NtClose  (64, ... ) == 0x0
 00318   396   NtClose  (56, ... ) == 0x0
 00319   396   NtAllocateVirtualMemory  (-1, 1335296, 0, 4096, 4096, 4, ... 1335296, 4096, ) == 0x0
 00320   396   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\u:\work\UxTheme.dll"}, 1242092, ... ) }, 1242092, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00321   396   NtQueryAttributesFile  ({24, 12, 0x40, 0, 0,  ({24, 12, 0x40, 0, 0, "UxTheme.dll"}, 1242092, ... ) }, 1242092, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00322   396   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\System32\UxTheme.dll"}, 1242092, ... ) }, 1242092, ... ) == 0x0
 00323   396   NtUserGetProcessWindowStation  (... ) == 0x24
 00324   396   NtUserGetObjectInformation  (36, 2, 0, 0, 1244388, ... ) == 0x0
 00325   396   NtUserGetObjectInformation  (36, 2, 1328256, 16, 1244388, ... ) == 0x1
 00326   396   NtUserGetGUIThreadInfo  (396, 1244344, ... ) == 0x1
 00327   396   NtConnectPort  ( ("\ThemeApiPort", {12, 2, 1, 1}, 0x0, 0x0, 1244164, 64, ... 56, 0x0, 0x0, 0x0, 64, ) , {12, 2, 1, 1}, 0x0, 0x0, 1244164, 64, ... 56, 0x0, 0x0, 0x0, 64, ) == 0x0
 00328   396   NtRequestWaitReplyPort  (56, {32, 56, new_msg, 0, 0, 0, 0, 0}  (56, {32, 56, new_msg, 0, 0, 0, 0, 0} "\4\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0" ... {32, 56, reply, 0, 316, 396, 1508, 0} "\0\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0" )  ... {32, 56, reply, 0, 316, 396, 1508, 0}  (56, {32, 56, new_msg, 0, 0, 0, 0, 0} "\4\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0" ... {32, 56, reply, 0, 316, 396, 1508, 0} "\0\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0" )  ) == 0x0
 00329   396   NtRequestWaitReplyPort  (56, {32, 56, new_msg, 0, 0, 0, 0, 0}  (56, {32, 56, new_msg, 0, 0, 0, 0, 0} "\355\3\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0" ... {32, 56, reply, 0, 316, 396, 1509, 0} "\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0" )  ... {32, 56, reply, 0, 316, 396, 1509, 0}  (56, {32, 56, new_msg, 0, 0, 0, 0, 0} "\355\3\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0" ... {32, 56, reply, 0, 316, 396, 1509, 0} "\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0" )  ) == 0x0
 00330   396   NtUserCallNoParam  (29, ...
 00331   396   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\uxtheme.dll"}, 1241636, ... ) }, 1241636, ... ) == 0x0
 00330   396   NtUserCallNoParam  ... ) == 0x0
 00332   396   NtUserSystemParametersInfo  (41, 0, 1524225160, 0, ... ) == 0x1
 00333   396   NtGdiHfontCreate  (1243716, 356, 0, 0, 1326824, ... ) == 0x130a032a
 00334   396   NtGdiHfontCreate  (1243716, 356, 0, 0, 1326816, ... ) == 0xd0a0313
 00335   396   NtRequestWaitReplyPort  (56, {32, 56, new_msg, 0, 0, 0, 0, 0}  (56, {32, 56, new_msg, 0, 0, 0, 0, 0} "\7\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0" ... {32, 56, reply, 0, 316, 396, 1510, 0} "\0\0\0\0\0\0\0\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0" )  ... {32, 56, reply, 0, 316, 396, 1510, 0}  (56, {32, 56, new_msg, 0, 0, 0, 0, 0} "\7\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0" ... {32, 56, reply, 0, 316, 396, 1510, 0} "\0\0\0\0\0\0\0\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0" )  ) == 0x0
 00336   396   NtMapViewOfSection  (64, -1, (0x0), 0, 0, {0, 0}, 0, 1, 0, 2, ... (0xa10000), {0, 0}, 331776, ) == 0x0
 00337   396   NtUserGetWindowDC  (0, ... ) == 0x1010050
 00338   396   NtUserCallOneParam  (16842832, 56, ... ) == 0x1
 00339   396   NtUserGetWindowDC  (0, ... ) == 0x1010050
 00340   396   NtUserCallOneParam  (16842832, 56, ... ) == 0x1
 00341   396   NtUserGetWindowDC  (0, ... ) == 0x1010050
 00342   396   NtUserCallOneParam  (16842832, 56, ... ) == 0x1
 00343   396   NtUserGetWindowDC  (0, ... ) == 0x1010050
 00344   396   NtUserCallOneParam  (16842832, 56, ... ) == 0x1
 00345   396   NtUserGetWindowDC  (0, ... ) == 0x1010050
 00346   396   NtUserCallOneParam  (16842832, 56, ... ) == 0x1
 00347   396   NtUserGetWindowDC  (0, ... ) == 0x1010050
 00348   396   NtUserCallOneParam  (16842832, 56, ... ) == 0x1
 00349   396   NtUserGetWindowDC  (0, ... ) == 0x1010050
 00350   396   NtUserCallOneParam  (16842832, 56, ... ) == 0x1
 00351   396   NtUserGetWindowDC  (0, ... ) == 0x1010050
 00352   396   NtUserCallOneParam  (16842832, 56, ... ) == 0x1
 00353   396   NtUserGetWindowDC  (0, ... ) == 0x1010050
 00354   396   NtGdiCreatePatternBrushInternal  (59048369, 0, 0, ... ) == 0x1c10031f
 00355   396   NtUserCallOneParam  (16842832, 56, ... ) == 0x1
 00356   396   NtUserCallNoParam  (29, ...
 00357   396   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\uxtheme.dll"}, 1241080, ... ) }, 1241080, ... ) == 0x0
 00356   396   NtUserCallNoParam  ... ) == 0x0
 00358   396   NtUserCallNoParam  (29, ...
 00359   396   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\uxtheme.dll"}, 1241076, ... ) }, 1241076, ... ) == 0x0
 00358   396   NtUserCallNoParam  ... ) == 0x0
 00284   396   NtUserCallNoParam  ... ) == 0x1
 00360   396   NtWaitForSingleObject  (16, 0, 0x0, ... ) == STATUS_ACCESS_DENIED
 00361   396   NtReleaseMutant  (16, ...
 00362   396   NtContinue  (-136576888, 0, ...
 00361   396   NtReleaseMutant  ... ) == STATUS_MUTANT_NOT_OWNED
 00363   396   NtWaitForSingleObject  (16, 0, 0x0, ... ) == STATUS_ACCESS_DENIED
 00364   396   NtReleaseMutant  (16, ...
 00365   396   NtContinue  (-136576888, 0, ...
 00364   396   NtReleaseMutant  ... ) == STATUS_MUTANT_NOT_OWNED
 00366   396   NtWaitForSingleObject  (16, 0, 0x0, ... ) == STATUS_ACCESS_DENIED
 00367   396   NtReleaseMutant  (16, ...
 00368   396   NtContinue  (-136576888, 0, ...
 00367   396   NtReleaseMutant  ... ) == STATUS_MUTANT_NOT_OWNED
 00369   396   NtWaitForSingleObject  (16, 0, 0x0, ... ) == STATUS_ACCESS_DENIED
 00370   396   NtReleaseMutant  (16, ...
 00371   396   NtContinue  (-136576888, 0, ...
 00370   396   NtReleaseMutant  ... ) == STATUS_MUTANT_NOT_OWNED
 00372   396   NtWaitForSingleObject  (16, 0, 0x0, ... ) == STATUS_ACCESS_DENIED
 00373   396   NtReleaseMutant  (16, ...
 00374   396   NtContinue  (-136576888, 0, ...
 00373   396   NtReleaseMutant  ... ) == STATUS_MUTANT_NOT_OWNED
 00375   396   NtWaitForSingleObject  (16, 0, 0x0, ... ) == STATUS_ACCESS_DENIED
 00376   396   NtReleaseMutant  (16, ...
 00377   396   NtContinue  (-136576888, 0, ...
 00376   396   NtReleaseMutant  ... ) == STATUS_MUTANT_NOT_OWNED
 00378   396   NtWaitForSingleObject  (16, 0, 0x0, ... ) == STATUS_ACCESS_DENIED
 00379   396   NtReleaseMutant  (16, ...
 00380   396   NtContinue  (-136576888, 0, ...
 00379   396   NtReleaseMutant  ... ) == STATUS_MUTANT_NOT_OWNED
 00381   396   NtWaitForSingleObject  (16, 0, 0x0, ... ) == STATUS_ACCESS_DENIED
 00382   396   NtReleaseMutant  (16, ...
 00383   396   NtContinue  (-136576888, 0, ...
 00382   396   NtReleaseMutant  ... ) == STATUS_MUTANT_NOT_OWNED
 00384   396   NtWaitForSingleObject  (16, 0, 0x0, ... ) == STATUS_ACCESS_DENIED
 00385   396   NtReleaseMutant  (16, ...
 00386   396   NtContinue  (-136576888, 0, ...
 00385   396   NtReleaseMutant  ... ) == STATUS_MUTANT_NOT_OWNED
 00387   396   NtWaitForSingleObject  (16, 0, 0x0, ... ) == STATUS_ACCESS_DENIED
 00388   396   NtReleaseMutant  (16, ...
 00389   396   NtContinue  (-136576888, 0, ...
 00388   396   NtReleaseMutant  ... ) == STATUS_MUTANT_NOT_OWNED
 00390   396   NtWaitForSingleObject  (16, 0, 0x0, ... ) == STATUS_ACCESS_DENIED
 00391   396   NtReleaseMutant  (16, ...
 00392   396   NtContinue  (-136576888, 0, ...
 00391   396   NtReleaseMutant  ... ) == STATUS_MUTANT_NOT_OWNED
 00393   396   NtWaitForSingleObject  (16, 0, 0x0, ... ) == STATUS_ACCESS_DENIED
 00394   396   NtReleaseMutant  (16, ...
 00395   396   NtContinue  (-136576888, 0, ...
 00394   396   NtReleaseMutant  ... ) == STATUS_MUTANT_NOT_OWNED
 00396   396   NtWaitForSingleObject  (16, 0, 0x0, ... ) == STATUS_ACCESS_DENIED
 00397   396   NtReleaseMutant  (16, ...
 00398   396   NtContinue  (-136576888, 0, ...
 00397   396   NtReleaseMutant  ... ) == STATUS_MUTANT_NOT_OWNED
 00399   396   NtWaitForSingleObject  (16, 0, 0x0, ... ) == STATUS_ACCESS_DENIED
 00400   396   NtReleaseMutant  (16, ...
 00401   396   NtContinue  (-136576888, 0, ...
 00400   396   NtReleaseMutant  ... ) == STATUS_MUTANT_NOT_OWNED
 00402   396   NtWaitForSingleObject  (16, 0, 0x0, ... ) == STATUS_ACCESS_DENIED
 00403   396   NtReleaseMutant  (16, ...
 00404   396   NtContinue  (-136576888, 0, ...
 00403   396   NtReleaseMutant  ... ) == STATUS_MUTANT_NOT_OWNED
 00405   396   NtWaitForSingleObject  (16, 0, 0x0, ... ) == STATUS_ACCESS_DENIED
 00406   396   NtReleaseMutant  (16, ...
 00407   396   NtContinue  (-136576888, 0, ...
 00406   396   NtReleaseMutant  ... ) == STATUS_MUTANT_NOT_OWNED
 00408   396   NtWaitForSingleObject  (16, 0, 0x0, ... ) == STATUS_ACCESS_DENIED
 00409   396   NtReleaseMutant  (16, ...
 00410   396   NtContinue  (-136576888, 0, ...
 00409   396   NtReleaseMutant  ... ) == STATUS_MUTANT_NOT_OWNED
 00411   396   NtWaitForSingleObject  (16, 0, 0x0, ... ) == STATUS_ACCESS_DENIED
 00412   396   NtReleaseMutant  (16, ...
 00413   396   NtContinue  (-136576888, 0, ...
 00412   396   NtReleaseMutant  ... ) == STATUS_MUTANT_NOT_OWNED
 00414   396   NtOpenKey  (0x2000000, {24, 48, 0x40, 0, 0,  (0x2000000, {24, 48, 0x40, 0, 0, "System\CurrentControlSet\Services\WinSock2\Parameters"}, ... 68, ) }, ... 68, ) == 0x0
 00415   396   NtQueryValueKey  (68,  (68, "WinSock_Registry_Version", Partial, 144, ... TitleIdx=0, Type=1, Data="2\0.\00\0\0\0"}, 20, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (68, "WinSock_Registry_Version", Partial, 144, ... TitleIdx=0, Type=1, Data="2\0.\00\0\0\0"}, 20, ) }, 20, ) == 0x0
 00416   396   NtQueryValueKey  (68,  (68, "WinSock_Registry_Version", Partial, 144, ... TitleIdx=0, Type=1, Data="2\0.\00\0\0\0"}, 20, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (68, "WinSock_Registry_Version", Partial, 144, ... TitleIdx=0, Type=1, Data="2\0.\00\0\0\0"}, 20, ) }, 20, ) == 0x0
 00417   396   NtCreateEvent  (0x1f0003, 0x0, 0, 0, ... 72, ) == 0x0
 00418   396   NtOpenKey  (0x2000000, {24, 68, 0x40, 0, 0,  (0x2000000, {24, 68, 0x40, 0, 0, "Protocol_Catalog9"}, ... 76, ) }, ... 76, ) == 0x0
 00419   396   NtQueryValueKey  (76,  (76, "Serial_Access_Num", Partial, 144, ... TitleIdx=0, Type=4, Data="\31\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (76, "Serial_Access_Num", Partial, 144, ... TitleIdx=0, Type=4, Data="\31\0\0\0"}, 16, ) }, 16, ) == 0x0
 00420   396   NtNotifyChangeKey  (76, 72, 0, 0, 2011390432, 1, 0, 0, 0, 1, ... ) == 0x103
 00421   396   NtQueryValueKey  (76,  (76, "Serial_Access_Num", Partial, 144, ... TitleIdx=0, Type=4, Data="\31\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (76, "Serial_Access_Num", Partial, 144, ... TitleIdx=0, Type=4, Data="\31\0\0\0"}, 16, ) }, 16, ) == 0x0
 00422   396   NtOpenKey  (0x2000000, {24, 76, 0x40, 0, 0,  (0x2000000, {24, 76, 0x40, 0, 0, "00000019"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00423   396   NtQueryValueKey  (76,  (76, "Next_Catalog_Entry_ID", Partial, 144, ... TitleIdx=0, Type=4, Data="\376\3\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (76, "Next_Catalog_Entry_ID", Partial, 144, ... TitleIdx=0, Type=4, Data="\376\3\0\0"}, 16, ) }, 16, ) == 0x0
 00424   396   NtQueryValueKey  (76,  (76, "Num_Catalog_Entries", Partial, 144, ... TitleIdx=0, Type=4, Data="\13\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (76, "Num_Catalog_Entries", Partial, 144, ... TitleIdx=0, Type=4, Data="\13\0\0\0"}, 16, ) }, 16, ) == 0x0
 00425   396   NtOpenKey  (0x2000000, {24, 76, 0x40, 0, 0,  (0x2000000, {24, 76, 0x40, 0, 0, "Catalog_Entries"}, ... 80, ) }, ... 80, ) == 0x0
 00426   396   NtOpenKey  (0x20019, {24, 80, 0x40, 0, 0,  (0x20019, {24, 80, 0x40, 0, 0, "000000000001"}, ... 84, ) }, ... 84, ) == 0x0
 00427   396   NtQueryValueKey  (84,  (84, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 00428   396   NtQueryValueKey  (84,  (84, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 00429   396   NtQueryValueKey  (84,  (84, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0gram\FSLSP.DLL\0\00\0\0\0\10\0\2\0\10\0\4\1\10\0h\220\354\28\220\354\2\2\0\12\0\4\1\12\00\00\0\0\0\10\0\2\0\14\0\4\1\10\0\210\220\354\2X\220\354\2\2\0\16\0\4\1\12\00\00\0\0\0\10\0\2\0\20\0\4\1\10\0\250\220\354\2x\220\354\2\2\0\22\0\4\1\12\00\00\0\0\0\10\0\2\0\24\0\4\1\10\0\310\220\354\2\230\220\354\2\2\0\26\0\4\1\12\00\00\0\0\0\10\0\2\0\30\0\4\1\10\0\0\0\0\0\270\220\354\2\2\0\32\0\4\1\10\0H\0K\0R\0\0\0\3\0\34\0\4\1\10\0\360\222\354\2\0\0\0\0\0\221\354\2\16\0\0\0<\0\37\0\4\0\10\0X\3\10\0X\3\10\0\4\0\2\0f\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\10\0\0\0\240\32\17\347\213\253\317\21\214\243\0\200_H\241\222\351\3\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\2\0\0\0\20\0\0\0\20\0\0\0\1\0\0\0\6\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0T\0c\0p\0i\0p\0 \0[\0T\0C\0P\0/\0I\0P\0]\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\204\3\0\0\256\1\0\0<\1\0\0\214\1\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0T\0\0\0\256\1\0\0<\1\0\0\214\1\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\257\1\0\0<\1\0\0\214\1\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0P\0\0\0\\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0pa\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\00\02\0\257\1\0\0<\1\0\0\214\1\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0T\0\0\0\260\1\0\0<\1\0\0\214\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0T\0\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\260\1\0\0<\1\0\0\214\1\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\261\1\0\0<\1\0\0\214\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0T\0\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) , Partial, 900, ... TitleIdx=0, Type=3, Data= (84, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0gram\FSLSP.DLL\0\00\0\0\0\10\0\2\0\10\0\4\1\10\0h\220\354\28\220\354\2\2\0\12\0\4\1\12\00\00\0\0\0\10\0\2\0\14\0\4\1\10\0\210\220\354\2X\220\354\2\2\0\16\0\4\1\12\00\00\0\0\0\10\0\2\0\20\0\4\1\10\0\250\220\354\2x\220\354\2\2\0\22\0\4\1\12\00\00\0\0\0\10\0\2\0\24\0\4\1\10\0\310\220\354\2\230\220\354\2\2\0\26\0\4\1\12\00\00\0\0\0\10\0\2\0\30\0\4\1\10\0\0\0\0\0\270\220\354\2\2\0\32\0\4\1\10\0H\0K\0R\0\0\0\3\0\34\0\4\1\10\0\360\222\354\2\0\0\0\0\0\221\354\2\16\0\0\0<\0\37\0\4\0\10\0X\3\10\0X\3\10\0\4\0\2\0f\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\10\0\0\0\240\32\17\347\213\253\317\21\214\243\0\200_H\241\222\351\3\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\2\0\0\0\20\0\0\0\20\0\0\0\1\0\0\0\6\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0T\0c\0p\0i\0p\0 \0[\0T\0C\0P\0/\0I\0P\0]\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\204\3\0\0\256\1\0\0<\1\0\0\214\1\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0T\0\0\0\256\1\0\0<\1\0\0\214\1\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\257\1\0\0<\1\0\0\214\1\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0P\0\0\0\\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0pa\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\00\02\0\257\1\0\0<\1\0\0\214\1\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0T\0\0\0\260\1\0\0<\1\0\0\214\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0T\0\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\260\1\0\0<\1\0\0\214\1\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\261\1\0\0<\1\0\0\214\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0T\0\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) \0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\260\1\0\0<\1\0\0\214\1\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\261\1\0\0<\1\0\0\214\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0T\0\0\0\0\0\0\0 (84, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0gram\FSLSP.DLL\0\00\0\0\0\10\0\2\0\10\0\4\1\10\0h\220\354\28\220\354\2\2\0\12\0\4\1\12\00\00\0\0\0\10\0\2\0\14\0\4\1\10\0\210\220\354\2X\220\354\2\2\0\16\0\4\1\12\00\00\0\0\0\10\0\2\0\20\0\4\1\10\0\250\220\354\2x\220\354\2\2\0\22\0\4\1\12\00\00\0\0\0\10\0\2\0\24\0\4\1\10\0\310\220\354\2\230\220\354\2\2\0\26\0\4\1\12\00\00\0\0\0\10\0\2\0\30\0\4\1\10\0\0\0\0\0\270\220\354\2\2\0\32\0\4\1\10\0H\0K\0R\0\0\0\3\0\34\0\4\1\10\0\360\222\354\2\0\0\0\0\0\221\354\2\16\0\0\0<\0\37\0\4\0\10\0X\3\10\0X\3\10\0\4\0\2\0f\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\10\0\0\0\240\32\17\347\213\253\317\21\214\243\0\200_H\241\222\351\3\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\2\0\0\0\20\0\0\0\20\0\0\0\1\0\0\0\6\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0T\0c\0p\0i\0p\0 \0[\0T\0C\0P\0/\0I\0P\0]\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\204\3\0\0\256\1\0\0<\1\0\0\214\1\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0T\0\0\0\256\1\0\0<\1\0\0\214\1\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\257\1\0\0<\1\0\0\214\1\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0P\0\0\0\\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0pa\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\00\02\0\257\1\0\0<\1\0\0\214\1\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0T\0\0\0\260\1\0\0<\1\0\0\214\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0T\0\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\260\1\0\0<\1\0\0\214\1\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\261\1\0\0<\1\0\0\214\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0T\0\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) }, 900, ) == 0x0
 00430   396   NtClose  (84, ... ) == 0x0
 00431   396   NtOpenKey  (0x20019, {24, 80, 0x40, 0, 0,  (0x20019, {24, 80, 0x40, 0, 0, "000000000002"}, ... 84, ) }, ... 84, ) == 0x0
 00432   396   NtQueryValueKey  (84,  (84, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 00433   396   NtQueryValueKey  (84,  (84, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 00434   396   NtQueryValueKey  (84,  (84, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0gram\FSLSP.DLL\0\00\0\0\0\10\0\2\0\10\0\4\1\10\0h\220\354\28\220\354\2\2\0\12\0\4\1\12\00\00\0\0\0\10\0\2\0\14\0\4\1\10\0\210\220\354\2X\220\354\2\2\0\16\0\4\1\12\00\00\0\0\0\10\0\2\0\20\0\4\1\10\0\250\220\354\2x\220\354\2\2\0\22\0\4\1\12\00\00\0\0\0\10\0\2\0\24\0\4\1\10\0\310\220\354\2\230\220\354\2\2\0\26\0\4\1\12\00\00\0\0\0\10\0\2\0\30\0\4\1\10\0\0\0\0\0\270\220\354\2\2\0\32\0\4\1\10\0H\0K\0R\0\0\0\3\0\34\0\4\1\10\0\360\222\354\2\0\0\0\0\0\221\354\2\16\0\0\0<\0\37\0\4\0\10\0X\3\10\0X\3\10\0\4\0\2\0\11\6\2\0\0\0\0\0\0\0\0\0\0\0\0\0\10\0\0\0\240\32\17\347\213\253\317\21\214\243\0\200_H\241\222\352\3\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\2\0\0\0\20\0\0\0\20\0\0\0\2\0\0\0\21\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\273\377\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0T\0c\0p\0i\0p\0 \0[\0U\0D\0P\0/\0I\0P\0]\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\204\3\0\0\263\1\0\0<\1\0\0\214\1\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0T\0\0\0\263\1\0\0<\1\0\0\214\1\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\264\1\0\0<\1\0\0\214\1\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0P\0\0\0\\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0pa\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\00\03\0\264\1\0\0<\1\0\0\214\1\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0T\0\0\0\265\1\0\0<\1\0\0\214\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0T\0\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\265\1\0\0<\1\0\0\214\1\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\266\1\0\0<\1\0\0\214\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0T\0\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) , Partial, 900, ... TitleIdx=0, Type=3, Data= (84, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0gram\FSLSP.DLL\0\00\0\0\0\10\0\2\0\10\0\4\1\10\0h\220\354\28\220\354\2\2\0\12\0\4\1\12\00\00\0\0\0\10\0\2\0\14\0\4\1\10\0\210\220\354\2X\220\354\2\2\0\16\0\4\1\12\00\00\0\0\0\10\0\2\0\20\0\4\1\10\0\250\220\354\2x\220\354\2\2\0\22\0\4\1\12\00\00\0\0\0\10\0\2\0\24\0\4\1\10\0\310\220\354\2\230\220\354\2\2\0\26\0\4\1\12\00\00\0\0\0\10\0\2\0\30\0\4\1\10\0\0\0\0\0\270\220\354\2\2\0\32\0\4\1\10\0H\0K\0R\0\0\0\3\0\34\0\4\1\10\0\360\222\354\2\0\0\0\0\0\221\354\2\16\0\0\0<\0\37\0\4\0\10\0X\3\10\0X\3\10\0\4\0\2\0\11\6\2\0\0\0\0\0\0\0\0\0\0\0\0\0\10\0\0\0\240\32\17\347\213\253\317\21\214\243\0\200_H\241\222\352\3\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\2\0\0\0\20\0\0\0\20\0\0\0\2\0\0\0\21\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\273\377\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0T\0c\0p\0i\0p\0 \0[\0U\0D\0P\0/\0I\0P\0]\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\204\3\0\0\263\1\0\0<\1\0\0\214\1\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0T\0\0\0\263\1\0\0<\1\0\0\214\1\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\264\1\0\0<\1\0\0\214\1\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0P\0\0\0\\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0pa\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\00\03\0\264\1\0\0<\1\0\0\214\1\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0T\0\0\0\265\1\0\0<\1\0\0\214\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0T\0\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\265\1\0\0<\1\0\0\214\1\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\266\1\0\0<\1\0\0\214\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0T\0\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) \0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\265\1\0\0<\1\0\0\214\1\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\266\1\0\0<\1\0\0\214\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0T\0\0\0\0\0\0\0 (84, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0gram\FSLSP.DLL\0\00\0\0\0\10\0\2\0\10\0\4\1\10\0h\220\354\28\220\354\2\2\0\12\0\4\1\12\00\00\0\0\0\10\0\2\0\14\0\4\1\10\0\210\220\354\2X\220\354\2\2\0\16\0\4\1\12\00\00\0\0\0\10\0\2\0\20\0\4\1\10\0\250\220\354\2x\220\354\2\2\0\22\0\4\1\12\00\00\0\0\0\10\0\2\0\24\0\4\1\10\0\310\220\354\2\230\220\354\2\2\0\26\0\4\1\12\00\00\0\0\0\10\0\2\0\30\0\4\1\10\0\0\0\0\0\270\220\354\2\2\0\32\0\4\1\10\0H\0K\0R\0\0\0\3\0\34\0\4\1\10\0\360\222\354\2\0\0\0\0\0\221\354\2\16\0\0\0<\0\37\0\4\0\10\0X\3\10\0X\3\10\0\4\0\2\0\11\6\2\0\0\0\0\0\0\0\0\0\0\0\0\0\10\0\0\0\240\32\17\347\213\253\317\21\214\243\0\200_H\241\222\352\3\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\2\0\0\0\20\0\0\0\20\0\0\0\2\0\0\0\21\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\273\377\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0T\0c\0p\0i\0p\0 \0[\0U\0D\0P\0/\0I\0P\0]\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\204\3\0\0\263\1\0\0<\1\0\0\214\1\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0T\0\0\0\263\1\0\0<\1\0\0\214\1\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\264\1\0\0<\1\0\0\214\1\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0P\0\0\0\\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0pa\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\00\03\0\264\1\0\0<\1\0\0\214\1\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0T\0\0\0\265\1\0\0<\1\0\0\214\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0T\0\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\265\1\0\0<\1\0\0\214\1\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\266\1\0\0<\1\0\0\214\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0T\0\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) }, 900, ) == 0x0
 00435   396   NtClose  (84, ... ) == 0x0
 00436   396   NtOpenKey  (0x20019, {24, 80, 0x40, 0, 0,  (0x20019, {24, 80, 0x40, 0, 0, "000000000003"}, ... 84, ) }, ... 84, ) == 0x0
 00437   396   NtQueryValueKey  (84,  (84, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 00438   396   NtQueryValueKey  (84,  (84, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 00439   396   NtAllocateVirtualMemory  (-1, 1339392, 0, 4096, 4096, 4, ... 1339392, 4096, ) == 0x0
 00440   396   NtQueryValueKey  (84,  (84, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0gram\FSLSP.DLL\0\00\0\0\0\10\0\2\0\10\0\4\1\10\0h\220\354\28\220\354\2\2\0\12\0\4\1\12\00\00\0\0\0\10\0\2\0\14\0\4\1\10\0\210\220\354\2X\220\354\2\2\0\16\0\4\1\12\00\00\0\0\0\10\0\2\0\20\0\4\1\10\0\250\220\354\2x\220\354\2\2\0\22\0\4\1\12\00\00\0\0\0\10\0\2\0\24\0\4\1\10\0\310\220\354\2\230\220\354\2\2\0\26\0\4\1\12\00\00\0\0\0\10\0\2\0\30\0\4\1\10\0\0\0\0\0\270\220\354\2\2\0\32\0\4\1\10\0H\0K\0R\0\0\0\3\0\34\0\4\1\10\0\360\222\354\2\0\0\0\0\0\221\354\2\16\0\0\0<\0\37\0\4\0\10\0X\3\10\0X\3\10\0\4\0\2\0\11\6\2\0\0\0\0\0\0\0\0\0\0\0\0\0\14\0\0\0\240\32\17\347\213\253\317\21\214\243\0\200_H\241\222\353\3\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\2\0\0\0\20\0\0\0\20\0\0\0\3\0\0\0\0\0\0\0\377\0\0\0\0\0\0\0\0\0\0\0\273\377\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0T\0c\0p\0i\0p\0 \0[\0R\0A\0W\0/\0I\0P\0]\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\204\3\0\0\271\1\0\0<\1\0\0\214\1\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0T\0\0\0\271\1\0\0<\1\0\0\214\1\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\272\1\0\0<\1\0\0\214\1\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0P\0\0\0\\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0pa\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\00\04\0\272\1\0\0<\1\0\0\214\1\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0T\0\0\0\273\1\0\0<\1\0\0\214\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0T\0\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\273\1\0\0<\1\0\0\214\1\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\274\1\0\0<\1\0\0\214\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0T\0\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) , Partial, 900, ... TitleIdx=0, Type=3, Data= (84, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0gram\FSLSP.DLL\0\00\0\0\0\10\0\2\0\10\0\4\1\10\0h\220\354\28\220\354\2\2\0\12\0\4\1\12\00\00\0\0\0\10\0\2\0\14\0\4\1\10\0\210\220\354\2X\220\354\2\2\0\16\0\4\1\12\00\00\0\0\0\10\0\2\0\20\0\4\1\10\0\250\220\354\2x\220\354\2\2\0\22\0\4\1\12\00\00\0\0\0\10\0\2\0\24\0\4\1\10\0\310\220\354\2\230\220\354\2\2\0\26\0\4\1\12\00\00\0\0\0\10\0\2\0\30\0\4\1\10\0\0\0\0\0\270\220\354\2\2\0\32\0\4\1\10\0H\0K\0R\0\0\0\3\0\34\0\4\1\10\0\360\222\354\2\0\0\0\0\0\221\354\2\16\0\0\0<\0\37\0\4\0\10\0X\3\10\0X\3\10\0\4\0\2\0\11\6\2\0\0\0\0\0\0\0\0\0\0\0\0\0\14\0\0\0\240\32\17\347\213\253\317\21\214\243\0\200_H\241\222\353\3\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\2\0\0\0\20\0\0\0\20\0\0\0\3\0\0\0\0\0\0\0\377\0\0\0\0\0\0\0\0\0\0\0\273\377\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0T\0c\0p\0i\0p\0 \0[\0R\0A\0W\0/\0I\0P\0]\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\204\3\0\0\271\1\0\0<\1\0\0\214\1\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0T\0\0\0\271\1\0\0<\1\0\0\214\1\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\272\1\0\0<\1\0\0\214\1\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0P\0\0\0\\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0pa\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\00\04\0\272\1\0\0<\1\0\0\214\1\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0T\0\0\0\273\1\0\0<\1\0\0\214\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0T\0\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\273\1\0\0<\1\0\0\214\1\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\274\1\0\0<\1\0\0\214\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0T\0\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) \0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\273\1\0\0<\1\0\0\214\1\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\274\1\0\0<\1\0\0\214\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0T\0\0\0\0\0\0\0 (84, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0gram\FSLSP.DLL\0\00\0\0\0\10\0\2\0\10\0\4\1\10\0h\220\354\28\220\354\2\2\0\12\0\4\1\12\00\00\0\0\0\10\0\2\0\14\0\4\1\10\0\210\220\354\2X\220\354\2\2\0\16\0\4\1\12\00\00\0\0\0\10\0\2\0\20\0\4\1\10\0\250\220\354\2x\220\354\2\2\0\22\0\4\1\12\00\00\0\0\0\10\0\2\0\24\0\4\1\10\0\310\220\354\2\230\220\354\2\2\0\26\0\4\1\12\00\00\0\0\0\10\0\2\0\30\0\4\1\10\0\0\0\0\0\270\220\354\2\2\0\32\0\4\1\10\0H\0K\0R\0\0\0\3\0\34\0\4\1\10\0\360\222\354\2\0\0\0\0\0\221\354\2\16\0\0\0<\0\37\0\4\0\10\0X\3\10\0X\3\10\0\4\0\2\0\11\6\2\0\0\0\0\0\0\0\0\0\0\0\0\0\14\0\0\0\240\32\17\347\213\253\317\21\214\243\0\200_H\241\222\353\3\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\2\0\0\0\20\0\0\0\20\0\0\0\3\0\0\0\0\0\0\0\377\0\0\0\0\0\0\0\0\0\0\0\273\377\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0T\0c\0p\0i\0p\0 \0[\0R\0A\0W\0/\0I\0P\0]\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\204\3\0\0\271\1\0\0<\1\0\0\214\1\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0T\0\0\0\271\1\0\0<\1\0\0\214\1\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\272\1\0\0<\1\0\0\214\1\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0P\0\0\0\\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0pa\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\00\04\0\272\1\0\0<\1\0\0\214\1\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0T\0\0\0\273\1\0\0<\1\0\0\214\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0T\0\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\273\1\0\0<\1\0\0\214\1\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\274\1\0\0<\1\0\0\214\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0T\0\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) }, 900, ) == 0x0
 00441   396   NtClose  (84, ... ) == 0x0
 00442   396   NtOpenKey  (0x20019, {24, 80, 0x40, 0, 0,  (0x20019, {24, 80, 0x40, 0, 0, "000000000004"}, ... 84, ) }, ... 84, ) == 0x0
 00443   396   NtQueryValueKey  (84,  (84, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 00444   396   NtQueryValueKey  (84,  (84, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 00445   396   NtQueryValueKey  (84,  (84, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\rsvpsp.dll\0\0gram\FSLSP.DLL\0\00\0\0\0\10\0\2\0\10\0\4\1\10\0h\220\354\28\220\354\2\2\0\12\0\4\1\12\00\00\0\0\0\10\0\2\0\14\0\4\1\10\0\210\220\354\2X\220\354\2\2\0\16\0\4\1\12\00\00\0\0\0\10\0\2\0\20\0\4\1\10\0\250\220\354\2x\220\354\2\2\0\22\0\4\1\12\00\00\0\0\0\10\0\2\0\24\0\4\1\10\0\310\220\354\2\230\220\354\2\2\0\26\0\4\1\12\00\00\0\0\0\10\0\2\0\30\0\4\1\10\0\0\0\0\0\270\220\354\2\2\0\32\0\4\1\10\0H\0K\0R\0\0\0\3\0\34\0\4\1\10\0\360\222\354\2\0\0\0\0\0\221\354\2\16\0\0\0<\0\37\0\4\0\10\0X\3\10\0X\3\10\0\4\0\2\0\11&\2\0\0\0\0\0\0\0\0\0\0\0\0\0\10\0\0\0\340\251`\235z3\320\21\275\210\0\0\300\202\346\232\354\3\0\0\1\0\0\0\310\371\252\1\26\0\30\0\10<_u\0\0\0\0|\370\252\1\27\207`u\0\0\0\0\6\0\0\0\2\0\0\0\20\0\0\0\20\0\0\0\2\0\0\0\21\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\273\377\0\0\0\0\0\0R\0S\0V\0P\0 \0U\0D\0P\0 \0S\0e\0r\0v\0i\0c\0e\0 \0P\0r\0o\0v\0i\0d\0e\0r\0\0\0\30\371\252\1\17.\365w\13\30\365w\1\0\0\0\0\374\252\1\4\0\0\0\0\0\0\0\0\0\0\0\1\0\0\0\17.\365w\0\0\0\0\250\371\252\1 \22\365wO\22\365wT\22\365w\0\0\0\0\204\3\0\0\276\1\0\0<\1\0\0\214\1\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0T\0\0\0\276\1\0\0<\1\0\0\214\1\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\277\1\0\0<\1\0\0\214\1\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0P\0\0\0\\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0pa\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\00\05\0\277\1\0\0<\1\0\0\214\1\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0T\0\0\0\300\1\0\0<\1\0\0\214\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0T\0\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\300\1\0\0<\1\0\0\214\1\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\301\1\0\0<\1\0\0\214\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0T\0\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) , Partial, 900, ... TitleIdx=0, Type=3, Data= (84, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\rsvpsp.dll\0\0gram\FSLSP.DLL\0\00\0\0\0\10\0\2\0\10\0\4\1\10\0h\220\354\28\220\354\2\2\0\12\0\4\1\12\00\00\0\0\0\10\0\2\0\14\0\4\1\10\0\210\220\354\2X\220\354\2\2\0\16\0\4\1\12\00\00\0\0\0\10\0\2\0\20\0\4\1\10\0\250\220\354\2x\220\354\2\2\0\22\0\4\1\12\00\00\0\0\0\10\0\2\0\24\0\4\1\10\0\310\220\354\2\230\220\354\2\2\0\26\0\4\1\12\00\00\0\0\0\10\0\2\0\30\0\4\1\10\0\0\0\0\0\270\220\354\2\2\0\32\0\4\1\10\0H\0K\0R\0\0\0\3\0\34\0\4\1\10\0\360\222\354\2\0\0\0\0\0\221\354\2\16\0\0\0<\0\37\0\4\0\10\0X\3\10\0X\3\10\0\4\0\2\0\11&\2\0\0\0\0\0\0\0\0\0\0\0\0\0\10\0\0\0\340\251`\235z3\320\21\275\210\0\0\300\202\346\232\354\3\0\0\1\0\0\0\310\371\252\1\26\0\30\0\10<_u\0\0\0\0|\370\252\1\27\207`u\0\0\0\0\6\0\0\0\2\0\0\0\20\0\0\0\20\0\0\0\2\0\0\0\21\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\273\377\0\0\0\0\0\0R\0S\0V\0P\0 \0U\0D\0P\0 \0S\0e\0r\0v\0i\0c\0e\0 \0P\0r\0o\0v\0i\0d\0e\0r\0\0\0\30\371\252\1\17.\365w\13\30\365w\1\0\0\0\0\374\252\1\4\0\0\0\0\0\0\0\0\0\0\0\1\0\0\0\17.\365w\0\0\0\0\250\371\252\1 \22\365wO\22\365wT\22\365w\0\0\0\0\204\3\0\0\276\1\0\0<\1\0\0\214\1\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0T\0\0\0\276\1\0\0<\1\0\0\214\1\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\277\1\0\0<\1\0\0\214\1\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0P\0\0\0\\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0pa\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\00\05\0\277\1\0\0<\1\0\0\214\1\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0T\0\0\0\300\1\0\0<\1\0\0\214\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0T\0\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\300\1\0\0<\1\0\0\214\1\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\301\1\0\0<\1\0\0\214\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0T\0\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) \0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\300\1\0\0<\1\0\0\214\1\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\301\1\0\0<\1\0\0\214\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0T\0\0\0\0\0\0\0 (84, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\rsvpsp.dll\0\0gram\FSLSP.DLL\0\00\0\0\0\10\0\2\0\10\0\4\1\10\0h\220\354\28\220\354\2\2\0\12\0\4\1\12\00\00\0\0\0\10\0\2\0\14\0\4\1\10\0\210\220\354\2X\220\354\2\2\0\16\0\4\1\12\00\00\0\0\0\10\0\2\0\20\0\4\1\10\0\250\220\354\2x\220\354\2\2\0\22\0\4\1\12\00\00\0\0\0\10\0\2\0\24\0\4\1\10\0\310\220\354\2\230\220\354\2\2\0\26\0\4\1\12\00\00\0\0\0\10\0\2\0\30\0\4\1\10\0\0\0\0\0\270\220\354\2\2\0\32\0\4\1\10\0H\0K\0R\0\0\0\3\0\34\0\4\1\10\0\360\222\354\2\0\0\0\0\0\221\354\2\16\0\0\0<\0\37\0\4\0\10\0X\3\10\0X\3\10\0\4\0\2\0\11&\2\0\0\0\0\0\0\0\0\0\0\0\0\0\10\0\0\0\340\251`\235z3\320\21\275\210\0\0\300\202\346\232\354\3\0\0\1\0\0\0\310\371\252\1\26\0\30\0\10<_u\0\0\0\0|\370\252\1\27\207`u\0\0\0\0\6\0\0\0\2\0\0\0\20\0\0\0\20\0\0\0\2\0\0\0\21\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\273\377\0\0\0\0\0\0R\0S\0V\0P\0 \0U\0D\0P\0 \0S\0e\0r\0v\0i\0c\0e\0 \0P\0r\0o\0v\0i\0d\0e\0r\0\0\0\30\371\252\1\17.\365w\13\30\365w\1\0\0\0\0\374\252\1\4\0\0\0\0\0\0\0\0\0\0\0\1\0\0\0\17.\365w\0\0\0\0\250\371\252\1 \22\365wO\22\365wT\22\365w\0\0\0\0\204\3\0\0\276\1\0\0<\1\0\0\214\1\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0T\0\0\0\276\1\0\0<\1\0\0\214\1\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\277\1\0\0<\1\0\0\214\1\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0P\0\0\0\\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0pa\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\00\05\0\277\1\0\0<\1\0\0\214\1\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0T\0\0\0\300\1\0\0<\1\0\0\214\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0T\0\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\300\1\0\0<\1\0\0\214\1\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\301\1\0\0<\1\0\0\214\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0T\0\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) }, 900, ) == 0x0
 00446   396   NtClose  (84, ... ) == 0x0
 00447   396   NtOpenKey  (0x20019, {24, 80, 0x40, 0, 0,  (0x20019, {24, 80, 0x40, 0, 0, "000000000005"}, ... 84, ) }, ... 84, ) == 0x0
 00448   396   NtQueryValueKey  (84,  (84, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 00449   396   NtQueryValueKey  (84,  (84, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 00450   396   NtQueryValueKey  (84,  (84, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\rsvpsp.dll\0\0gram\FSLSP.DLL\0\00\0\0\0\10\0\2\0\10\0\4\1\10\0h\220\354\28\220\354\2\2\0\12\0\4\1\12\00\00\0\0\0\10\0\2\0\14\0\4\1\10\0\210\220\354\2X\220\354\2\2\0\16\0\4\1\12\00\00\0\0\0\10\0\2\0\20\0\4\1\10\0\250\220\354\2x\220\354\2\2\0\22\0\4\1\12\00\00\0\0\0\10\0\2\0\24\0\4\1\10\0\310\220\354\2\230\220\354\2\2\0\26\0\4\1\12\00\00\0\0\0\10\0\2\0\30\0\4\1\10\0\0\0\0\0\270\220\354\2\2\0\32\0\4\1\10\0H\0K\0R\0\0\0\3\0\34\0\4\1\10\0\360\222\354\2\0\0\0\0\0\221\354\2\16\0\0\0<\0\37\0\4\0\10\0X\3\10\0X\3\10\0\4\0\2\0f \2\0\0\0\0\0\0\0\0\0\0\0\0\0\10\0\0\0\340\251`\235z3\320\21\275\210\0\0\300\202\346\232\355\3\0\0\1\0\0\0\17.\365w\13\30\365w\0\0\0\0\4+Y\1\2\0\0\0\1\0\0\0\17.\365w\6\0\0\0\2\0\0\0\20\0\0\0\20\0\0\0\1\0\0\0\6\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0R\0S\0V\0P\0 \0T\0C\0P\0 \0S\0e\0r\0v\0i\0c\0e\0 \0P\0r\0o\0v\0i\0d\0e\0r\0\0\0\0\0\0\0\362_du\3`du\240\1\10\0\250\5N\1 \0\0\0\0\0\0\0\240\1\10\0\310\5N\1H\344\301\0\0\0\0\0\0\0\0\0\0\0\245\0\0\0\10\0@\5N\1\0\0\0\0\204\3\0\0\303\1\0\0<\1\0\0\214\1\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0T\0\0\0\303\1\0\0<\1\0\0\214\1\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\304\1\0\0<\1\0\0\214\1\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0P\0\0\0\\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0pa\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\00\06\0\304\1\0\0<\1\0\0\214\1\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0T\0\0\0\305\1\0\0<\1\0\0\214\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0T\0\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\305\1\0\0<\1\0\0\214\1\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\306\1\0\0<\1\0\0\214\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0T\0\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) , Partial, 900, ... TitleIdx=0, Type=3, Data= (84, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\rsvpsp.dll\0\0gram\FSLSP.DLL\0\00\0\0\0\10\0\2\0\10\0\4\1\10\0h\220\354\28\220\354\2\2\0\12\0\4\1\12\00\00\0\0\0\10\0\2\0\14\0\4\1\10\0\210\220\354\2X\220\354\2\2\0\16\0\4\1\12\00\00\0\0\0\10\0\2\0\20\0\4\1\10\0\250\220\354\2x\220\354\2\2\0\22\0\4\1\12\00\00\0\0\0\10\0\2\0\24\0\4\1\10\0\310\220\354\2\230\220\354\2\2\0\26\0\4\1\12\00\00\0\0\0\10\0\2\0\30\0\4\1\10\0\0\0\0\0\270\220\354\2\2\0\32\0\4\1\10\0H\0K\0R\0\0\0\3\0\34\0\4\1\10\0\360\222\354\2\0\0\0\0\0\221\354\2\16\0\0\0<\0\37\0\4\0\10\0X\3\10\0X\3\10\0\4\0\2\0f \2\0\0\0\0\0\0\0\0\0\0\0\0\0\10\0\0\0\340\251`\235z3\320\21\275\210\0\0\300\202\346\232\355\3\0\0\1\0\0\0\17.\365w\13\30\365w\0\0\0\0\4+Y\1\2\0\0\0\1\0\0\0\17.\365w\6\0\0\0\2\0\0\0\20\0\0\0\20\0\0\0\1\0\0\0\6\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0R\0S\0V\0P\0 \0T\0C\0P\0 \0S\0e\0r\0v\0i\0c\0e\0 \0P\0r\0o\0v\0i\0d\0e\0r\0\0\0\0\0\0\0\362_du\3`du\240\1\10\0\250\5N\1 \0\0\0\0\0\0\0\240\1\10\0\310\5N\1H\344\301\0\0\0\0\0\0\0\0\0\0\0\245\0\0\0\10\0@\5N\1\0\0\0\0\204\3\0\0\303\1\0\0<\1\0\0\214\1\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0T\0\0\0\303\1\0\0<\1\0\0\214\1\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\304\1\0\0<\1\0\0\214\1\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0P\0\0\0\\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0pa\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\00\06\0\304\1\0\0<\1\0\0\214\1\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0T\0\0\0\305\1\0\0<\1\0\0\214\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0T\0\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\305\1\0\0<\1\0\0\214\1\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\306\1\0\0<\1\0\0\214\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0T\0\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) \0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\305\1\0\0<\1\0\0\214\1\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\306\1\0\0<\1\0\0\214\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0T\0\0\0\0\0\0\0 (84, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\rsvpsp.dll\0\0gram\FSLSP.DLL\0\00\0\0\0\10\0\2\0\10\0\4\1\10\0h\220\354\28\220\354\2\2\0\12\0\4\1\12\00\00\0\0\0\10\0\2\0\14\0\4\1\10\0\210\220\354\2X\220\354\2\2\0\16\0\4\1\12\00\00\0\0\0\10\0\2\0\20\0\4\1\10\0\250\220\354\2x\220\354\2\2\0\22\0\4\1\12\00\00\0\0\0\10\0\2\0\24\0\4\1\10\0\310\220\354\2\230\220\354\2\2\0\26\0\4\1\12\00\00\0\0\0\10\0\2\0\30\0\4\1\10\0\0\0\0\0\270\220\354\2\2\0\32\0\4\1\10\0H\0K\0R\0\0\0\3\0\34\0\4\1\10\0\360\222\354\2\0\0\0\0\0\221\354\2\16\0\0\0<\0\37\0\4\0\10\0X\3\10\0X\3\10\0\4\0\2\0f \2\0\0\0\0\0\0\0\0\0\0\0\0\0\10\0\0\0\340\251`\235z3\320\21\275\210\0\0\300\202\346\232\355\3\0\0\1\0\0\0\17.\365w\13\30\365w\0\0\0\0\4+Y\1\2\0\0\0\1\0\0\0\17.\365w\6\0\0\0\2\0\0\0\20\0\0\0\20\0\0\0\1\0\0\0\6\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0R\0S\0V\0P\0 \0T\0C\0P\0 \0S\0e\0r\0v\0i\0c\0e\0 \0P\0r\0o\0v\0i\0d\0e\0r\0\0\0\0\0\0\0\362_du\3`du\240\1\10\0\250\5N\1 \0\0\0\0\0\0\0\240\1\10\0\310\5N\1H\344\301\0\0\0\0\0\0\0\0\0\0\0\245\0\0\0\10\0@\5N\1\0\0\0\0\204\3\0\0\303\1\0\0<\1\0\0\214\1\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0T\0\0\0\303\1\0\0<\1\0\0\214\1\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\304\1\0\0<\1\0\0\214\1\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0P\0\0\0\\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0pa\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\00\06\0\304\1\0\0<\1\0\0\214\1\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0T\0\0\0\305\1\0\0<\1\0\0\214\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0T\0\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\305\1\0\0<\1\0\0\214\1\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\306\1\0\0<\1\0\0\214\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0T\0\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) }, 900, ) == 0x0
 00451   396   NtClose  (84, ... ) == 0x0
 00452   396   NtOpenKey  (0x20019, {24, 80, 0x40, 0, 0,  (0x20019, {24, 80, 0x40, 0, 0, "000000000006"}, ... 84, ) }, ... 84, ) == 0x0
 00453   396   NtQueryValueKey  (84,  (84, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 00454   396   NtQueryValueKey  (84,  (84, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 00455   396   NtQueryValueKey  (84,  (84, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0gram\FSLSP.DLL\0\00\0\0\0\10\0\2\0\10\0\4\1\10\0h\220\354\28\220\354\2\2\0\12\0\4\1\12\00\00\0\0\0\10\0\2\0\14\0\4\1\10\0\210\220\354\2X\220\354\2\2\0\16\0\4\1\12\00\00\0\0\0\10\0\2\0\20\0\4\1\10\0\250\220\354\2x\220\354\2\2\0\22\0\4\1\12\00\00\0\0\0\10\0\2\0\24\0\4\1\10\0\310\220\354\2\230\220\354\2\2\0\26\0\4\1\12\00\00\0\0\0\10\0\2\0\30\0\4\1\10\0\0\0\0\0\270\220\354\2\2\0\32\0\4\1\10\0H\0K\0R\0\0\0\3\0\34\0\4\1\10\0\360\222\354\2\0\0\0\0\0\221\354\2\16\0\0\0<\0\37\0\4\0\10\0X\3\10\0X\3\10\0\4\0\2\0\16\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\10\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\356\3\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\5\0\0\0\0\0\0\200\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\04\0F\0E\05\07\0D\07\0B\0-\00\03\0A\05\0-\04\08\0B\02\0-\08\0\0\0\0\0\204\3\0\0\310\1\0\0<\1\0\0\214\1\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0T\0\0\0\310\1\0\0<\1\0\0\214\1\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\311\1\0\0<\1\0\0\214\1\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0P\0\0\0\\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0pa\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\00\07\0\311\1\0\0<\1\0\0\214\1\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0T\0\0\0\312\1\0\0<\1\0\0\214\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0T\0\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\312\1\0\0<\1\0\0\214\1\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\313\1\0\0<\1\0\0\214\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0T\0\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) , Partial, 900, ... TitleIdx=0, Type=3, Data= (84, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0gram\FSLSP.DLL\0\00\0\0\0\10\0\2\0\10\0\4\1\10\0h\220\354\28\220\354\2\2\0\12\0\4\1\12\00\00\0\0\0\10\0\2\0\14\0\4\1\10\0\210\220\354\2X\220\354\2\2\0\16\0\4\1\12\00\00\0\0\0\10\0\2\0\20\0\4\1\10\0\250\220\354\2x\220\354\2\2\0\22\0\4\1\12\00\00\0\0\0\10\0\2\0\24\0\4\1\10\0\310\220\354\2\230\220\354\2\2\0\26\0\4\1\12\00\00\0\0\0\10\0\2\0\30\0\4\1\10\0\0\0\0\0\270\220\354\2\2\0\32\0\4\1\10\0H\0K\0R\0\0\0\3\0\34\0\4\1\10\0\360\222\354\2\0\0\0\0\0\221\354\2\16\0\0\0<\0\37\0\4\0\10\0X\3\10\0X\3\10\0\4\0\2\0\16\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\10\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\356\3\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\5\0\0\0\0\0\0\200\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\04\0F\0E\05\07\0D\07\0B\0-\00\03\0A\05\0-\04\08\0B\02\0-\08\0\0\0\0\0\204\3\0\0\310\1\0\0<\1\0\0\214\1\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0T\0\0\0\310\1\0\0<\1\0\0\214\1\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\311\1\0\0<\1\0\0\214\1\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0P\0\0\0\\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0pa\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\00\07\0\311\1\0\0<\1\0\0\214\1\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0T\0\0\0\312\1\0\0<\1\0\0\214\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0T\0\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\312\1\0\0<\1\0\0\214\1\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\313\1\0\0<\1\0\0\214\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0T\0\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) \0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\312\1\0\0<\1\0\0\214\1\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\313\1\0\0<\1\0\0\214\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0T\0\0\0\0\0\0\0 (84, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0gram\FSLSP.DLL\0\00\0\0\0\10\0\2\0\10\0\4\1\10\0h\220\354\28\220\354\2\2\0\12\0\4\1\12\00\00\0\0\0\10\0\2\0\14\0\4\1\10\0\210\220\354\2X\220\354\2\2\0\16\0\4\1\12\00\00\0\0\0\10\0\2\0\20\0\4\1\10\0\250\220\354\2x\220\354\2\2\0\22\0\4\1\12\00\00\0\0\0\10\0\2\0\24\0\4\1\10\0\310\220\354\2\230\220\354\2\2\0\26\0\4\1\12\00\00\0\0\0\10\0\2\0\30\0\4\1\10\0\0\0\0\0\270\220\354\2\2\0\32\0\4\1\10\0H\0K\0R\0\0\0\3\0\34\0\4\1\10\0\360\222\354\2\0\0\0\0\0\221\354\2\16\0\0\0<\0\37\0\4\0\10\0X\3\10\0X\3\10\0\4\0\2\0\16\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\10\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\356\3\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\5\0\0\0\0\0\0\200\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\04\0F\0E\05\07\0D\07\0B\0-\00\03\0A\05\0-\04\08\0B\02\0-\08\0\0\0\0\0\204\3\0\0\310\1\0\0<\1\0\0\214\1\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0T\0\0\0\310\1\0\0<\1\0\0\214\1\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\311\1\0\0<\1\0\0\214\1\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0P\0\0\0\\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0pa\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\00\07\0\311\1\0\0<\1\0\0\214\1\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0T\0\0\0\312\1\0\0<\1\0\0\214\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0T\0\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\312\1\0\0<\1\0\0\214\1\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\313\1\0\0<\1\0\0\214\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0T\0\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) }, 900, ) == 0x0
 00456   396   NtClose  (84, ... ) == 0x0
 00457   396   NtOpenKey  (0x20019, {24, 80, 0x40, 0, 0,  (0x20019, {24, 80, 0x40, 0, 0, "000000000007"}, ... 84, ) }, ... 84, ) == 0x0
 00458   396   NtQueryValueKey  (84,  (84, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 00459   396   NtQueryValueKey  (84,  (84, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 00460   396   NtAllocateVirtualMemory  (-1, 1343488, 0, 4096, 4096, 4, ... 1343488, 4096, ) == 0x0
 00461   396   NtQueryValueKey  (84,  (84, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0gram\FSLSP.DLL\0\00\0\0\0\10\0\2\0\10\0\4\1\10\0h\220\354\28\220\354\2\2\0\12\0\4\1\12\00\00\0\0\0\10\0\2\0\14\0\4\1\10\0\210\220\354\2X\220\354\2\2\0\16\0\4\1\12\00\00\0\0\0\10\0\2\0\20\0\4\1\10\0\250\220\354\2x\220\354\2\2\0\22\0\4\1\12\00\00\0\0\0\10\0\2\0\24\0\4\1\10\0\310\220\354\2\230\220\354\2\2\0\26\0\4\1\12\00\00\0\0\0\10\0\2\0\30\0\4\1\10\0\0\0\0\0\270\220\354\2\2\0\32\0\4\1\10\0H\0K\0R\0\0\0\3\0\34\0\4\1\10\0\360\222\354\2\0\0\0\0\0\221\354\2\16\0\0\0<\0\37\0\4\0\10\0X\3\10\0X\3\10\0\4\0\2\0\11\2\2\0\0\0\0\0\0\0\0\0\0\0\0\0\10\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\357\3\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\2\0\0\0\0\0\0\200\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\04\0F\0E\05\07\0D\07\0B\0-\00\03\0A\05\0-\04\08\0B\02\0-\08\0\0\0\0\0\204\3\0\0\316\1\0\0<\1\0\0\214\1\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0T\0\0\0\316\1\0\0<\1\0\0\214\1\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\317\1\0\0<\1\0\0\214\1\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0P\0\0\0\\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0pa\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\00\08\0\317\1\0\0<\1\0\0\214\1\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0T\0\0\0\320\1\0\0<\1\0\0\214\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0T\0\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\320\1\0\0<\1\0\0\214\1\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\321\1\0\0<\1\0\0\214\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0T\0\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) , Partial, 900, ... TitleIdx=0, Type=3, Data= (84, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0gram\FSLSP.DLL\0\00\0\0\0\10\0\2\0\10\0\4\1\10\0h\220\354\28\220\354\2\2\0\12\0\4\1\12\00\00\0\0\0\10\0\2\0\14\0\4\1\10\0\210\220\354\2X\220\354\2\2\0\16\0\4\1\12\00\00\0\0\0\10\0\2\0\20\0\4\1\10\0\250\220\354\2x\220\354\2\2\0\22\0\4\1\12\00\00\0\0\0\10\0\2\0\24\0\4\1\10\0\310\220\354\2\230\220\354\2\2\0\26\0\4\1\12\00\00\0\0\0\10\0\2\0\30\0\4\1\10\0\0\0\0\0\270\220\354\2\2\0\32\0\4\1\10\0H\0K\0R\0\0\0\3\0\34\0\4\1\10\0\360\222\354\2\0\0\0\0\0\221\354\2\16\0\0\0<\0\37\0\4\0\10\0X\3\10\0X\3\10\0\4\0\2\0\11\2\2\0\0\0\0\0\0\0\0\0\0\0\0\0\10\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\357\3\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\2\0\0\0\0\0\0\200\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\04\0F\0E\05\07\0D\07\0B\0-\00\03\0A\05\0-\04\08\0B\02\0-\08\0\0\0\0\0\204\3\0\0\316\1\0\0<\1\0\0\214\1\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0T\0\0\0\316\1\0\0<\1\0\0\214\1\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\317\1\0\0<\1\0\0\214\1\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0P\0\0\0\\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0pa\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\00\08\0\317\1\0\0<\1\0\0\214\1\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0T\0\0\0\320\1\0\0<\1\0\0\214\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0T\0\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\320\1\0\0<\1\0\0\214\1\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\321\1\0\0<\1\0\0\214\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0T\0\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) \0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\320\1\0\0<\1\0\0\214\1\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\321\1\0\0<\1\0\0\214\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0T\0\0\0\0\0\0\0 (84, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0gram\FSLSP.DLL\0\00\0\0\0\10\0\2\0\10\0\4\1\10\0h\220\354\28\220\354\2\2\0\12\0\4\1\12\00\00\0\0\0\10\0\2\0\14\0\4\1\10\0\210\220\354\2X\220\354\2\2\0\16\0\4\1\12\00\00\0\0\0\10\0\2\0\20\0\4\1\10\0\250\220\354\2x\220\354\2\2\0\22\0\4\1\12\00\00\0\0\0\10\0\2\0\24\0\4\1\10\0\310\220\354\2\230\220\354\2\2\0\26\0\4\1\12\00\00\0\0\0\10\0\2\0\30\0\4\1\10\0\0\0\0\0\270\220\354\2\2\0\32\0\4\1\10\0H\0K\0R\0\0\0\3\0\34\0\4\1\10\0\360\222\354\2\0\0\0\0\0\221\354\2\16\0\0\0<\0\37\0\4\0\10\0X\3\10\0X\3\10\0\4\0\2\0\11\2\2\0\0\0\0\0\0\0\0\0\0\0\0\0\10\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\357\3\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\2\0\0\0\0\0\0\200\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\04\0F\0E\05\07\0D\07\0B\0-\00\03\0A\05\0-\04\08\0B\02\0-\08\0\0\0\0\0\204\3\0\0\316\1\0\0<\1\0\0\214\1\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0T\0\0\0\316\1\0\0<\1\0\0\214\1\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\317\1\0\0<\1\0\0\214\1\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0P\0\0\0\\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0pa\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\00\08\0\317\1\0\0<\1\0\0\214\1\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0T\0\0\0\320\1\0\0<\1\0\0\214\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0T\0\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\320\1\0\0<\1\0\0\214\1\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\321\1\0\0<\1\0\0\214\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0T\0\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) }, 900, ) == 0x0
 00462   396   NtClose  (84, ... ) == 0x0
 00463   396   NtOpenKey  (0x20019, {24, 80, 0x40, 0, 0,  (0x20019, {24, 80, 0x40, 0, 0, "000000000008"}, ... 84, ) }, ... 84, ) == 0x0
 00464   396   NtQueryValueKey  (84,  (84, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 00465   396   NtQueryValueKey  (84,  (84, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 00466   396   NtQueryValueKey  (84,  (84, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0gram\FSLSP.DLL\0\00\0\0\0\10\0\2\0\10\0\4\1\10\0h\220\354\28\220\354\2\2\0\12\0\4\1\12\00\00\0\0\0\10\0\2\0\14\0\4\1\10\0\210\220\354\2X\220\354\2\2\0\16\0\4\1\12\00\00\0\0\0\10\0\2\0\20\0\4\1\10\0\250\220\354\2x\220\354\2\2\0\22\0\4\1\12\00\00\0\0\0\10\0\2\0\24\0\4\1\10\0\310\220\354\2\230\220\354\2\2\0\26\0\4\1\12\00\00\0\0\0\10\0\2\0\30\0\4\1\10\0\0\0\0\0\270\220\354\2\2\0\32\0\4\1\10\0H\0K\0R\0\0\0\3\0\34\0\4\1\10\0\360\222\354\2\0\0\0\0\0\221\354\2\16\0\0\0<\0\37\0\4\0\10\0X\3\10\0X\3\10\0\4\0\2\0\16\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\360\3\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\5\0\0\0\377\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\0A\0B\0E\07\0E\00\06\0F\0-\06\02\00\0F\0-\04\0E\0A\0A\0-\0A\0\0\0\0\0\204\3\0\0\323\1\0\0<\1\0\0\214\1\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0T\0\0\0\323\1\0\0<\1\0\0\214\1\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\324\1\0\0<\1\0\0\214\1\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0P\0\0\0\\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0pa\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\00\09\0\324\1\0\0<\1\0\0\214\1\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0T\0\0\0\325\1\0\0<\1\0\0\214\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0T\0\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\325\1\0\0<\1\0\0\214\1\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\326\1\0\0<\1\0\0\214\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0T\0\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) , Partial, 900, ... TitleIdx=0, Type=3, Data= (84, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0gram\FSLSP.DLL\0\00\0\0\0\10\0\2\0\10\0\4\1\10\0h\220\354\28\220\354\2\2\0\12\0\4\1\12\00\00\0\0\0\10\0\2\0\14\0\4\1\10\0\210\220\354\2X\220\354\2\2\0\16\0\4\1\12\00\00\0\0\0\10\0\2\0\20\0\4\1\10\0\250\220\354\2x\220\354\2\2\0\22\0\4\1\12\00\00\0\0\0\10\0\2\0\24\0\4\1\10\0\310\220\354\2\230\220\354\2\2\0\26\0\4\1\12\00\00\0\0\0\10\0\2\0\30\0\4\1\10\0\0\0\0\0\270\220\354\2\2\0\32\0\4\1\10\0H\0K\0R\0\0\0\3\0\34\0\4\1\10\0\360\222\354\2\0\0\0\0\0\221\354\2\16\0\0\0<\0\37\0\4\0\10\0X\3\10\0X\3\10\0\4\0\2\0\16\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\360\3\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\5\0\0\0\377\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\0A\0B\0E\07\0E\00\06\0F\0-\06\02\00\0F\0-\04\0E\0A\0A\0-\0A\0\0\0\0\0\204\3\0\0\323\1\0\0<\1\0\0\214\1\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0T\0\0\0\323\1\0\0<\1\0\0\214\1\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\324\1\0\0<\1\0\0\214\1\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0P\0\0\0\\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0pa\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\00\09\0\324\1\0\0<\1\0\0\214\1\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0T\0\0\0\325\1\0\0<\1\0\0\214\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0T\0\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\325\1\0\0<\1\0\0\214\1\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\326\1\0\0<\1\0\0\214\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0T\0\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) \0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\325\1\0\0<\1\0\0\214\1\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\326\1\0\0<\1\0\0\214\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0T\0\0\0\0\0\0\0 (84, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0gram\FSLSP.DLL\0\00\0\0\0\10\0\2\0\10\0\4\1\10\0h\220\354\28\220\354\2\2\0\12\0\4\1\12\00\00\0\0\0\10\0\2\0\14\0\4\1\10\0\210\220\354\2X\220\354\2\2\0\16\0\4\1\12\00\00\0\0\0\10\0\2\0\20\0\4\1\10\0\250\220\354\2x\220\354\2\2\0\22\0\4\1\12\00\00\0\0\0\10\0\2\0\24\0\4\1\10\0\310\220\354\2\230\220\354\2\2\0\26\0\4\1\12\00\00\0\0\0\10\0\2\0\30\0\4\1\10\0\0\0\0\0\270\220\354\2\2\0\32\0\4\1\10\0H\0K\0R\0\0\0\3\0\34\0\4\1\10\0\360\222\354\2\0\0\0\0\0\221\354\2\16\0\0\0<\0\37\0\4\0\10\0X\3\10\0X\3\10\0\4\0\2\0\16\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\360\3\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\5\0\0\0\377\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\0A\0B\0E\07\0E\00\06\0F\0-\06\02\00\0F\0-\04\0E\0A\0A\0-\0A\0\0\0\0\0\204\3\0\0\323\1\0\0<\1\0\0\214\1\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0T\0\0\0\323\1\0\0<\1\0\0\214\1\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\324\1\0\0<\1\0\0\214\1\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0P\0\0\0\\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0pa\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\00\09\0\324\1\0\0<\1\0\0\214\1\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0T\0\0\0\325\1\0\0<\1\0\0\214\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0T\0\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\325\1\0\0<\1\0\0\214\1\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\326\1\0\0<\1\0\0\214\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0T\0\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) }, 900, ) == 0x0
 00467   396   NtClose  (84, ... ) == 0x0
 00468   396   NtOpenKey  (0x20019, {24, 80, 0x40, 0, 0,  (0x20019, {24, 80, 0x40, 0, 0, "000000000009"}, ... 84, ) }, ... 84, ) == 0x0
 00469   396   NtQueryValueKey  (84,  (84, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 00470   396   NtQueryValueKey  (84,  (84, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 00471   396   NtQueryValueKey  (84,  (84, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0gram\FSLSP.DLL\0\00\0\0\0\10\0\2\0\10\0\4\1\10\0h\220\354\28\220\354\2\2\0\12\0\4\1\12\00\00\0\0\0\10\0\2\0\14\0\4\1\10\0\210\220\354\2X\220\354\2\2\0\16\0\4\1\12\00\00\0\0\0\10\0\2\0\20\0\4\1\10\0\250\220\354\2x\220\354\2\2\0\22\0\4\1\12\00\00\0\0\0\10\0\2\0\24\0\4\1\10\0\310\220\354\2\230\220\354\2\2\0\26\0\4\1\12\00\00\0\0\0\10\0\2\0\30\0\4\1\10\0\0\0\0\0\270\220\354\2\2\0\32\0\4\1\10\0H\0K\0R\0\0\0\3\0\34\0\4\1\10\0\360\222\354\2\0\0\0\0\0\221\354\2\16\0\0\0<\0\37\0\4\0\10\0X\3\10\0X\3\10\0\4\0\2\0\11\2\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\361\3\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\2\0\0\0\377\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\0A\0B\0E\07\0E\00\06\0F\0-\06\02\00\0F\0-\04\0E\0A\0A\0-\0A\0\0\0\0\0\204\3\0\0\330\1\0\0<\1\0\0\214\1\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0T\0\0\0\330\1\0\0<\1\0\0\214\1\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\331\1\0\0<\1\0\0\214\1\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0P\0\0\0\\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0pa\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\01\00\0\331\1\0\0<\1\0\0\214\1\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0T\0\0\0\332\1\0\0<\1\0\0\214\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0T\0\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\332\1\0\0<\1\0\0\214\1\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\333\1\0\0<\1\0\0\214\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0T\0\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) , Partial, 900, ... TitleIdx=0, Type=3, Data= (84, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0gram\FSLSP.DLL\0\00\0\0\0\10\0\2\0\10\0\4\1\10\0h\220\354\28\220\354\2\2\0\12\0\4\1\12\00\00\0\0\0\10\0\2\0\14\0\4\1\10\0\210\220\354\2X\220\354\2\2\0\16\0\4\1\12\00\00\0\0\0\10\0\2\0\20\0\4\1\10\0\250\220\354\2x\220\354\2\2\0\22\0\4\1\12\00\00\0\0\0\10\0\2\0\24\0\4\1\10\0\310\220\354\2\230\220\354\2\2\0\26\0\4\1\12\00\00\0\0\0\10\0\2\0\30\0\4\1\10\0\0\0\0\0\270\220\354\2\2\0\32\0\4\1\10\0H\0K\0R\0\0\0\3\0\34\0\4\1\10\0\360\222\354\2\0\0\0\0\0\221\354\2\16\0\0\0<\0\37\0\4\0\10\0X\3\10\0X\3\10\0\4\0\2\0\11\2\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\361\3\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\2\0\0\0\377\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\0A\0B\0E\07\0E\00\06\0F\0-\06\02\00\0F\0-\04\0E\0A\0A\0-\0A\0\0\0\0\0\204\3\0\0\330\1\0\0<\1\0\0\214\1\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0T\0\0\0\330\1\0\0<\1\0\0\214\1\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\331\1\0\0<\1\0\0\214\1\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0P\0\0\0\\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0pa\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\01\00\0\331\1\0\0<\1\0\0\214\1\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0T\0\0\0\332\1\0\0<\1\0\0\214\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0T\0\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\332\1\0\0<\1\0\0\214\1\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\333\1\0\0<\1\0\0\214\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0T\0\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) \0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\332\1\0\0<\1\0\0\214\1\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\333\1\0\0<\1\0\0\214\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0T\0\0\0\0\0\0\0 (84, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0gram\FSLSP.DLL\0\00\0\0\0\10\0\2\0\10\0\4\1\10\0h\220\354\28\220\354\2\2\0\12\0\4\1\12\00\00\0\0\0\10\0\2\0\14\0\4\1\10\0\210\220\354\2X\220\354\2\2\0\16\0\4\1\12\00\00\0\0\0\10\0\2\0\20\0\4\1\10\0\250\220\354\2x\220\354\2\2\0\22\0\4\1\12\00\00\0\0\0\10\0\2\0\24\0\4\1\10\0\310\220\354\2\230\220\354\2\2\0\26\0\4\1\12\00\00\0\0\0\10\0\2\0\30\0\4\1\10\0\0\0\0\0\270\220\354\2\2\0\32\0\4\1\10\0H\0K\0R\0\0\0\3\0\34\0\4\1\10\0\360\222\354\2\0\0\0\0\0\221\354\2\16\0\0\0<\0\37\0\4\0\10\0X\3\10\0X\3\10\0\4\0\2\0\11\2\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\361\3\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\2\0\0\0\377\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\0A\0B\0E\07\0E\00\06\0F\0-\06\02\00\0F\0-\04\0E\0A\0A\0-\0A\0\0\0\0\0\204\3\0\0\330\1\0\0<\1\0\0\214\1\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0T\0\0\0\330\1\0\0<\1\0\0\214\1\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\331\1\0\0<\1\0\0\214\1\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0P\0\0\0\\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0pa\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\01\00\0\331\1\0\0<\1\0\0\214\1\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0T\0\0\0\332\1\0\0<\1\0\0\214\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0T\0\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\332\1\0\0<\1\0\0\214\1\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\333\1\0\0<\1\0\0\214\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0T\0\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) }, 900, ) == 0x0
 00472   396   NtClose  (84, ... ) == 0x0
 00473   396   NtOpenKey  (0x20019, {24, 80, 0x40, 0, 0,  (0x20019, {24, 80, 0x40, 0, 0, "000000000010"}, ... 84, ) }, ... 84, ) == 0x0
 00474   396   NtQueryValueKey  (84,  (84, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 00475   396   NtQueryValueKey  (84,  (84, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 00476   396   NtQueryValueKey  (84,  (84, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0gram\FSLSP.DLL\0\00\0\0\0\10\0\2\0\10\0\4\1\10\0h\220\354\28\220\354\2\2\0\12\0\4\1\12\00\00\0\0\0\10\0\2\0\14\0\4\1\10\0\210\220\354\2X\220\354\2\2\0\16\0\4\1\12\00\00\0\0\0\10\0\2\0\20\0\4\1\10\0\250\220\354\2x\220\354\2\2\0\22\0\4\1\12\00\00\0\0\0\10\0\2\0\24\0\4\1\10\0\310\220\354\2\230\220\354\2\2\0\26\0\4\1\12\00\00\0\0\0\10\0\2\0\30\0\4\1\10\0\0\0\0\0\270\220\354\2\2\0\32\0\4\1\10\0H\0K\0R\0\0\0\3\0\34\0\4\1\10\0\360\222\354\2\0\0\0\0\0\221\354\2\16\0\0\0<\0\37\0\4\0\10\0X\3\10\0X\3\10\0\4\0\2\0\16\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\362\3\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\5\0\0\0\376\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\0D\01\09\0D\0F\08\08\02\0-\0A\09\0C\0B\0-\04\01\04\04\0-\08\0\0\0\0\0\204\3\0\0\335\1\0\0<\1\0\0\214\1\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0T\0\0\0\335\1\0\0<\1\0\0\214\1\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\336\1\0\0<\1\0\0\214\1\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0P\0\0\0\\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0pa\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\01\01\0\336\1\0\0<\1\0\0\214\1\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0T\0\0\0\337\1\0\0<\1\0\0\214\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0T\0\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\337\1\0\0<\1\0\0\214\1\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\340\1\0\0<\1\0\0\214\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0T\0\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) , Partial, 900, ... TitleIdx=0, Type=3, Data= (84, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0gram\FSLSP.DLL\0\00\0\0\0\10\0\2\0\10\0\4\1\10\0h\220\354\28\220\354\2\2\0\12\0\4\1\12\00\00\0\0\0\10\0\2\0\14\0\4\1\10\0\210\220\354\2X\220\354\2\2\0\16\0\4\1\12\00\00\0\0\0\10\0\2\0\20\0\4\1\10\0\250\220\354\2x\220\354\2\2\0\22\0\4\1\12\00\00\0\0\0\10\0\2\0\24\0\4\1\10\0\310\220\354\2\230\220\354\2\2\0\26\0\4\1\12\00\00\0\0\0\10\0\2\0\30\0\4\1\10\0\0\0\0\0\270\220\354\2\2\0\32\0\4\1\10\0H\0K\0R\0\0\0\3\0\34\0\4\1\10\0\360\222\354\2\0\0\0\0\0\221\354\2\16\0\0\0<\0\37\0\4\0\10\0X\3\10\0X\3\10\0\4\0\2\0\16\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\362\3\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\5\0\0\0\376\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\0D\01\09\0D\0F\08\08\02\0-\0A\09\0C\0B\0-\04\01\04\04\0-\08\0\0\0\0\0\204\3\0\0\335\1\0\0<\1\0\0\214\1\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0T\0\0\0\335\1\0\0<\1\0\0\214\1\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\336\1\0\0<\1\0\0\214\1\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0P\0\0\0\\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0pa\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\01\01\0\336\1\0\0<\1\0\0\214\1\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0T\0\0\0\337\1\0\0<\1\0\0\214\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0T\0\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\337\1\0\0<\1\0\0\214\1\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\340\1\0\0<\1\0\0\214\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0T\0\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) \0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\337\1\0\0<\1\0\0\214\1\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\340\1\0\0<\1\0\0\214\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0T\0\0\0\0\0\0\0 (84, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0gram\FSLSP.DLL\0\00\0\0\0\10\0\2\0\10\0\4\1\10\0h\220\354\28\220\354\2\2\0\12\0\4\1\12\00\00\0\0\0\10\0\2\0\14\0\4\1\10\0\210\220\354\2X\220\354\2\2\0\16\0\4\1\12\00\00\0\0\0\10\0\2\0\20\0\4\1\10\0\250\220\354\2x\220\354\2\2\0\22\0\4\1\12\00\00\0\0\0\10\0\2\0\24\0\4\1\10\0\310\220\354\2\230\220\354\2\2\0\26\0\4\1\12\00\00\0\0\0\10\0\2\0\30\0\4\1\10\0\0\0\0\0\270\220\354\2\2\0\32\0\4\1\10\0H\0K\0R\0\0\0\3\0\34\0\4\1\10\0\360\222\354\2\0\0\0\0\0\221\354\2\16\0\0\0<\0\37\0\4\0\10\0X\3\10\0X\3\10\0\4\0\2\0\16\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\362\3\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\5\0\0\0\376\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\0D\01\09\0D\0F\08\08\02\0-\0A\09\0C\0B\0-\04\01\04\04\0-\08\0\0\0\0\0\204\3\0\0\335\1\0\0<\1\0\0\214\1\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0T\0\0\0\335\1\0\0<\1\0\0\214\1\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\336\1\0\0<\1\0\0\214\1\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0P\0\0\0\\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0pa\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\01\01\0\336\1\0\0<\1\0\0\214\1\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0T\0\0\0\337\1\0\0<\1\0\0\214\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0T\0\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\337\1\0\0<\1\0\0\214\1\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\340\1\0\0<\1\0\0\214\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0T\0\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) }, 900, ) == 0x0
 00477   396   NtClose  (84, ... ) == 0x0
 00478   396   NtOpenKey  (0x20019, {24, 80, 0x40, 0, 0,  (0x20019, {24, 80, 0x40, 0, 0, "000000000011"}, ... 84, ) }, ... 84, ) == 0x0
 00479   396   NtQueryValueKey  (84,  (84, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 00480   396   NtQueryValueKey  (84,  (84, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 00481   396   NtQueryValueKey  (84,  (84, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0gram\FSLSP.DLL\0\00\0\0\0\10\0\2\0\10\0\4\1\10\0h\220\354\28\220\354\2\2\0\12\0\4\1\12\00\00\0\0\0\10\0\2\0\14\0\4\1\10\0\210\220\354\2X\220\354\2\2\0\16\0\4\1\12\00\00\0\0\0\10\0\2\0\20\0\4\1\10\0\250\220\354\2x\220\354\2\2\0\22\0\4\1\12\00\00\0\0\0\10\0\2\0\24\0\4\1\10\0\310\220\354\2\230\220\354\2\2\0\26\0\4\1\12\00\00\0\0\0\10\0\2\0\30\0\4\1\10\0\0\0\0\0\270\220\354\2\2\0\32\0\4\1\10\0H\0K\0R\0\0\0\3\0\34\0\4\1\10\0\360\222\354\2\0\0\0\0\0\221\354\2\16\0\0\0<\0\37\0\4\0\10\0X\3\10\0X\3\10\0\4\0\2\0\11\2\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\363\3\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\2\0\0\0\376\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\0D\01\09\0D\0F\08\08\02\0-\0A\09\0C\0B\0-\04\01\04\04\0-\08\0\0\0\0\0\204\3\0\0\342\1\0\0<\1\0\0\214\1\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0T\0\0\0\342\1\0\0<\1\0\0\214\1\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\343\1\0\0<\1\0\0\214\1\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0P\0\0\0\343\1\0\0<\1\0\0\214\1\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\344\1\0\0<\1\0\0\214\1\0\0\305\0\0\0\0\0\1\0\0\0\0\0\24\0\0\0H\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\344\1\0\0<\1\0\0\214\1\0\0\305\0\0\0\1\0\1\0\2\1\0\0\0\0\0\0\345\1\0\0<\1\0\0\214\1\0\0\25\0\0\0\0\0\1\0\0\0\0\0\24\0\0\0\3\0\37\0\377\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\345\1\0\0<\1\0\0\214\1\0\0\25\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0P\0\0\0\346\1\0\0<\1\0\0\214\1\0\0\12\0\0\0\0\0\1\0\0\0\0\0 \0\0\0\377\377\377\377\0\0\0\0\0\220\24\0\0\0\0\0\0\0\0\0\0\20\0\0\0\20\0\0\4\0\0\0\346\1\0\0<\1\0\0\214\1\0\0\12\0\0\0\1\0\1\0\0\0\0\0\20\0\0\0\0\0\0\0\0\220\24\0\0\0\0\0\0\20\0\0\347\1\0\0<\1\0\0"}, 900, ) , Partial, 900, ... TitleIdx=0, Type=3, Data= (84, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0gram\FSLSP.DLL\0\00\0\0\0\10\0\2\0\10\0\4\1\10\0h\220\354\28\220\354\2\2\0\12\0\4\1\12\00\00\0\0\0\10\0\2\0\14\0\4\1\10\0\210\220\354\2X\220\354\2\2\0\16\0\4\1\12\00\00\0\0\0\10\0\2\0\20\0\4\1\10\0\250\220\354\2x\220\354\2\2\0\22\0\4\1\12\00\00\0\0\0\10\0\2\0\24\0\4\1\10\0\310\220\354\2\230\220\354\2\2\0\26\0\4\1\12\00\00\0\0\0\10\0\2\0\30\0\4\1\10\0\0\0\0\0\270\220\354\2\2\0\32\0\4\1\10\0H\0K\0R\0\0\0\3\0\34\0\4\1\10\0\360\222\354\2\0\0\0\0\0\221\354\2\16\0\0\0<\0\37\0\4\0\10\0X\3\10\0X\3\10\0\4\0\2\0\11\2\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\363\3\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\2\0\0\0\376\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\0D\01\09\0D\0F\08\08\02\0-\0A\09\0C\0B\0-\04\01\04\04\0-\08\0\0\0\0\0\204\3\0\0\342\1\0\0<\1\0\0\214\1\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0T\0\0\0\342\1\0\0<\1\0\0\214\1\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\343\1\0\0<\1\0\0\214\1\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0P\0\0\0\343\1\0\0<\1\0\0\214\1\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\344\1\0\0<\1\0\0\214\1\0\0\305\0\0\0\0\0\1\0\0\0\0\0\24\0\0\0H\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\344\1\0\0<\1\0\0\214\1\0\0\305\0\0\0\1\0\1\0\2\1\0\0\0\0\0\0\345\1\0\0<\1\0\0\214\1\0\0\25\0\0\0\0\0\1\0\0\0\0\0\24\0\0\0\3\0\37\0\377\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\345\1\0\0<\1\0\0\214\1\0\0\25\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0P\0\0\0\346\1\0\0<\1\0\0\214\1\0\0\12\0\0\0\0\0\1\0\0\0\0\0 \0\0\0\377\377\377\377\0\0\0\0\0\220\24\0\0\0\0\0\0\0\0\0\0\20\0\0\0\20\0\0\4\0\0\0\346\1\0\0<\1\0\0\214\1\0\0\12\0\0\0\1\0\1\0\0\0\0\0\20\0\0\0\0\0\0\0\0\220\24\0\0\0\0\0\0\20\0\0\347\1\0\0<\1\0\0"}, 900, ) }, 900, ) == 0x0
 00482   396   NtClose  (84, ... ) == 0x0
 00483   396   NtClose  (80, ... ) == 0x0
 00484   396   NtWaitForSingleObject  (72, 0, {0, 0}, ... ) == 0x102
 00485   396   NtCreateEvent  (0x1f0003, 0x0, 0, 0, ... 80, ) == 0x0
 00486   396   NtAllocateVirtualMemory  (-1, 1347584, 0, 4096, 4096, 4, ... 1347584, 4096, ) == 0x0
 00487   396   NtOpenKey  (0x2000000, {24, 68, 0x40, 0, 0,  (0x2000000, {24, 68, 0x40, 0, 0, "NameSpace_Catalog5"}, ... 84, ) }, ... 84, ) == 0x0
 00488   396   NtQueryValueKey  (84,  (84, "Serial_Access_Num", Partial, 144, ... TitleIdx=0, Type=4, Data="\4\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (84, "Serial_Access_Num", Partial, 144, ... TitleIdx=0, Type=4, Data="\4\0\0\0"}, 16, ) }, 16, ) == 0x0
 00489   396   NtNotifyChangeKey  (84, 80, 0, 0, 2011390432, 1, 0, 0, 0, 1, ... ) == 0x103
 00490   396   NtQueryValueKey  (84,  (84, "Serial_Access_Num", Partial, 144, ... TitleIdx=0, Type=4, Data="\4\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (84, "Serial_Access_Num", Partial, 144, ... TitleIdx=0, Type=4, Data="\4\0\0\0"}, 16, ) }, 16, ) == 0x0
 00491   396   NtOpenKey  (0x2000000, {24, 84, 0x40, 0, 0,  (0x2000000, {24, 84, 0x40, 0, 0, "00000004"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00492   396   NtQueryValueKey  (84,  (84, "Num_Catalog_Entries", Partial, 144, ... TitleIdx=0, Type=4, Data="\3\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (84, "Num_Catalog_Entries", Partial, 144, ... TitleIdx=0, Type=4, Data="\3\0\0\0"}, 16, ) }, 16, ) == 0x0
 00493   396   NtOpenKey  (0x2000000, {24, 84, 0x40, 0, 0,  (0x2000000, {24, 84, 0x40, 0, 0, "Catalog_Entries"}, ... 88, ) }, ... 88, ) == 0x0
 00494   396   NtOpenKey  (0x20019, {24, 88, 0x40, 0, 0,  (0x20019, {24, 88, 0x40, 0, 0, "000000000001"}, ... 92, ) }, ... 92, ) == 0x0
 00495   396   NtQueryValueKey  (92,  (92, "LibraryPath", Partial, 144, ... TitleIdx=0, Type=1, Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0m\0s\0w\0s\0o\0c\0k\0.\0d\0l\0l\0\0\0"}, 80, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (92, "LibraryPath", Partial, 144, ... TitleIdx=0, Type=1, Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0m\0s\0w\0s\0o\0c\0k\0.\0d\0l\0l\0\0\0"}, 80, ) }, 80, ) == 0x0
 00496   396   NtQueryValueKey  (92,  (92, "LibraryPath", Partial, 144, ... TitleIdx=0, Type=1, Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0m\0s\0w\0s\0o\0c\0k\0.\0d\0l\0l\0\0\0"}, 80, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (92, "LibraryPath", Partial, 144, ... TitleIdx=0, Type=1, Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0m\0s\0w\0s\0o\0c\0k\0.\0d\0l\0l\0\0\0"}, 80, ) }, 80, ) == 0x0
 00497   396   NtQueryValueKey  (92,  (92, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="T\0c\0p\0i\0p\0\0\0"}, 24, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (92, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="T\0c\0p\0i\0p\0\0\0"}, 24, ) }, 24, ) == 0x0
 00498   396   NtQueryValueKey  (92,  (92, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="T\0c\0p\0i\0p\0\0\0"}, 24, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (92, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="T\0c\0p\0i\0p\0\0\0"}, 24, ) }, 24, ) == 0x0
 00499   396   NtQueryValueKey  (92,  (92, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="T\0c\0p\0i\0p\0\0\0"}, 24, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (92, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="T\0c\0p\0i\0p\0\0\0"}, 24, ) }, 24, ) == 0x0
 00500   396   NtQueryValueKey  (92,  (92, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="T\0c\0p\0i\0p\0\0\0"}, 24, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (92, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="T\0c\0p\0i\0p\0\0\0"}, 24, ) }, 24, ) == 0x0
 00501   396   NtQueryValueKey  (92,  (92, "ProviderId", Partial, 144, ... TitleIdx=0, Type=3, Data="@\235\5"\236~\317\21\256Z\0\252\0\247\21+"}, 28, ) , Partial, 144, ... TitleIdx=0, Type=3, Data= (92, "ProviderId", Partial, 144, ... TitleIdx=0, Type=3, Data="@\235\5"\236~\317\21\256Z\0\252\0\247\21+"}, 28, ) \236~\317\21\256Z\0\252\0\247\21+"}, 28, ) == 0x0
 00502   396   NtQueryValueKey  (92,  (92, "AddressFamily", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00503   396   NtQueryValueKey  (92,  (92, "SupportedNameSpace", Partial, 144, ... TitleIdx=0, Type=4, Data="\14\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (92, "SupportedNameSpace", Partial, 144, ... TitleIdx=0, Type=4, Data="\14\0\0\0"}, 16, ) }, 16, ) == 0x0
 00504   396   NtQueryValueKey  (92,  (92, "Enabled", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (92, "Enabled", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) }, 16, ) == 0x0
 00505   396   NtQueryValueKey  (92,  (92, "Version", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (92, "Version", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) }, 16, ) == 0x0
 00506   396   NtQueryValueKey  (92,  (92, "StoresServiceClassInfo", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (92, "StoresServiceClassInfo", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) }, 16, ) == 0x0
 00507   396   NtClose  (92, ... ) == 0x0
 00508   396   NtOpenKey  (0x20019, {24, 88, 0x40, 0, 0,  (0x20019, {24, 88, 0x40, 0, 0, "000000000002"}, ... 92, ) }, ... 92, ) == 0x0
 00509   396   NtQueryValueKey  (92,  (92, "LibraryPath", Partial, 144, ... TitleIdx=0, Type=1, Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0w\0i\0n\0r\0n\0r\0.\0d\0l\0l\0\0\0"}, 78, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (92, "LibraryPath", Partial, 144, ... TitleIdx=0, Type=1, Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0w\0i\0n\0r\0n\0r\0.\0d\0l\0l\0\0\0"}, 78, ) }, 78, ) == 0x0
 00510   396   NtQueryValueKey  (92,  (92, "LibraryPath", Partial, 144, ... TitleIdx=0, Type=1, Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0w\0i\0n\0r\0n\0r\0.\0d\0l\0l\0\0\0"}, 78, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (92, "LibraryPath", Partial, 144, ... TitleIdx=0, Type=1, Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0w\0i\0n\0r\0n\0r\0.\0d\0l\0l\0\0\0"}, 78, ) }, 78, ) == 0x0
 00511   396   NtQueryValueKey  (92,  (92, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="N\0T\0D\0S\0\0\0"}, 22, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (92, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="N\0T\0D\0S\0\0\0"}, 22, ) }, 22, ) == 0x0
 00512   396   NtQueryValueKey  (92,  (92, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="N\0T\0D\0S\0\0\0"}, 22, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (92, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="N\0T\0D\0S\0\0\0"}, 22, ) }, 22, ) == 0x0
 00513   396   NtQueryValueKey  (92,  (92, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="N\0T\0D\0S\0\0\0"}, 22, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (92, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="N\0T\0D\0S\0\0\0"}, 22, ) }, 22, ) == 0x0
 00514   396   NtQueryValueKey  (92,  (92, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="N\0T\0D\0S\0\0\0"}, 22, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (92, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="N\0T\0D\0S\0\0\0"}, 22, ) }, 22, ) == 0x0
 00515   396   NtQueryValueKey  (92,  (92, "ProviderId", Partial, 144, ... TitleIdx=0, Type=3, Data="\3567&;\200\345\317\21\245U\0\300O\330\324\254"}, 28, ) , Partial, 144, ... TitleIdx=0, Type=3, Data= (92, "ProviderId", Partial, 144, ... TitleIdx=0, Type=3, Data="\3567&;\200\345\317\21\245U\0\300O\330\324\254"}, 28, ) }, 28, ) == 0x0
 00516   396   NtQueryValueKey  (92,  (92, "AddressFamily", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00517   396   NtQueryValueKey  (92,  (92, "SupportedNameSpace", Partial, 144, ... TitleIdx=0, Type=4, Data=" \0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (92, "SupportedNameSpace", Partial, 144, ... TitleIdx=0, Type=4, Data=" \0\0\0"}, 16, ) }, 16, ) == 0x0
 00518   396   NtQueryValueKey  (92,  (92, "Enabled", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (92, "Enabled", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) }, 16, ) == 0x0
 00519   396   NtQueryValueKey  (92,  (92, "Version", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (92, "Version", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) }, 16, ) == 0x0
 00520   396   NtQueryValueKey  (92,  (92, "StoresServiceClassInfo", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (92, "StoresServiceClassInfo", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) }, 16, ) == 0x0
 00521   396   NtClose  (92, ... ) == 0x0
 00522   396   NtOpenKey  (0x20019, {24, 88, 0x40, 0, 0,  (0x20019, {24, 88, 0x40, 0, 0, "000000000003"}, ... 92, ) }, ... 92, ) == 0x0
 00523   396   NtQueryValueKey  (92,  (92, "LibraryPath", Partial, 144, ... TitleIdx=0, Type=1, Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0m\0s\0w\0s\0o\0c\0k\0.\0d\0l\0l\0\0\0"}, 80, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (92, "LibraryPath", Partial, 144, ... TitleIdx=0, Type=1, Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0m\0s\0w\0s\0o\0c\0k\0.\0d\0l\0l\0\0\0"}, 80, ) }, 80, ) == 0x0
 00524   396   NtQueryValueKey  (92,  (92, "LibraryPath", Partial, 144, ... TitleIdx=0, Type=1, Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0m\0s\0w\0s\0o\0c\0k\0.\0d\0l\0l\0\0\0"}, 80, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (92, "LibraryPath", Partial, 144, ... TitleIdx=0, Type=1, Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0m\0s\0w\0s\0o\0c\0k\0.\0d\0l\0l\0\0\0"}, 80, ) }, 80, ) == 0x0
 00525   396   NtQueryValueKey  (92,  (92, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="N\0e\0t\0w\0o\0r\0k\0 \0L\0o\0c\0a\0t\0i\0o\0n\0 \0A\0w\0a\0r\0e\0n\0e\0s\0s\0 \0(\0N\0L\0A\0)\0 \0N\0a\0m\0e\0s\0p\0a\0c\0e\0\0\0"}, 98, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (92, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="N\0e\0t\0w\0o\0r\0k\0 \0L\0o\0c\0a\0t\0i\0o\0n\0 \0A\0w\0a\0r\0e\0n\0e\0s\0s\0 \0(\0N\0L\0A\0)\0 \0N\0a\0m\0e\0s\0p\0a\0c\0e\0\0\0"}, 98, ) }, 98, ) == 0x0
 00526   396   NtQueryValueKey  (92,  (92, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="N\0e\0t\0w\0o\0r\0k\0 \0L\0o\0c\0a\0t\0i\0o\0n\0 \0A\0w\0a\0r\0e\0n\0e\0s\0s\0 \0(\0N\0L\0A\0)\0 \0N\0a\0m\0e\0s\0p\0a\0c\0e\0\0\0"}, 98, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (92, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="N\0e\0t\0w\0o\0r\0k\0 \0L\0o\0c\0a\0t\0i\0o\0n\0 \0A\0w\0a\0r\0e\0n\0e\0s\0s\0 \0(\0N\0L\0A\0)\0 \0N\0a\0m\0e\0s\0p\0a\0c\0e\0\0\0"}, 98, ) }, 98, ) == 0x0
 00527   396   NtQueryValueKey  (92,  (92, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="N\0e\0t\0w\0o\0r\0k\0 \0L\0o\0c\0a\0t\0i\0o\0n\0 \0A\0w\0a\0r\0e\0n\0e\0s\0s\0 \0(\0N\0L\0A\0)\0 \0N\0a\0m\0e\0s\0p\0a\0c\0e\0\0\0"}, 98, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (92, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="N\0e\0t\0w\0o\0r\0k\0 \0L\0o\0c\0a\0t\0i\0o\0n\0 \0A\0w\0a\0r\0e\0n\0e\0s\0s\0 \0(\0N\0L\0A\0)\0 \0N\0a\0m\0e\0s\0p\0a\0c\0e\0\0\0"}, 98, ) }, 98, ) == 0x0
 00528   396   NtQueryValueKey  (92,  (92, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="N\0e\0t\0w\0o\0r\0k\0 \0L\0o\0c\0a\0t\0i\0o\0n\0 \0A\0w\0a\0r\0e\0n\0e\0s\0s\0 \0(\0N\0L\0A\0)\0 \0N\0a\0m\0e\0s\0p\0a\0c\0e\0\0\0"}, 98, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (92, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="N\0e\0t\0w\0o\0r\0k\0 \0L\0o\0c\0a\0t\0i\0o\0n\0 \0A\0w\0a\0r\0e\0n\0e\0s\0s\0 \0(\0N\0L\0A\0)\0 \0N\0a\0m\0e\0s\0p\0a\0c\0e\0\0\0"}, 98, ) }, 98, ) == 0x0
 00529   396   NtQueryValueKey  (92,  (92, "ProviderId", Partial, 144, ... TitleIdx=0, Type=3, Data=":$Bf\250;\246J\272\245.\13\327\37\335\203"}, 28, ) , Partial, 144, ... TitleIdx=0, Type=3, Data= (92, "ProviderId", Partial, 144, ... TitleIdx=0, Type=3, Data=":$Bf\250;\246J\272\245.\13\327\37\335\203"}, 28, ) }, 28, ) == 0x0
 00530   396   NtQueryValueKey  (92,  (92, "AddressFamily", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00531   396   NtQueryValueKey  (92,  (92, "SupportedNameSpace", Partial, 144, ... TitleIdx=0, Type=4, Data="\17\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (92, "SupportedNameSpace", Partial, 144, ... TitleIdx=0, Type=4, Data="\17\0\0\0"}, 16, ) }, 16, ) == 0x0
 00532   396   NtQueryValueKey  (92,  (92, "Enabled", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (92, "Enabled", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) }, 16, ) == 0x0
 00533   396   NtQueryValueKey  (92,  (92, "Version", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (92, "Version", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) }, 16, ) == 0x0
 00534   396   NtQueryValueKey  (92,  (92, "StoresServiceClassInfo", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (92, "StoresServiceClassInfo", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) }, 16, ) == 0x0
 00535   396   NtClose  (92, ... ) == 0x0
 00536   396   NtClose  (88, ... ) == 0x0
 00537   396   NtWaitForSingleObject  (80, 0, {0, 0}, ... ) == 0x102
 00538   396   NtClose  (68, ... ) == 0x0
 00539   396   NtQuerySystemInformation  (Basic, 44, ... {Unknown=0,MaximumIncrement=156250,PhysicalPageSize=0x1000,NumberOfPhysicalPages=0xff7c,LowestPhysicalPage=0x1,HighestPhysicalPage=0xffff,AllocationGranularity=0x10000,LowestUserAddress=0x10000,HighestUserAddress=0x7ffeffff,ActiveProcessors=1,NumberProcessors=1,}, 0x0, ) == 0x0
 00540   396   NtQuerySystemInformation  (Processor, 12, ... {system info, class 1, size 12}, 0x0, ) == 0x0
 00541   396   NtOpenKey  (0x1, {24, 48, 0x40, 0, 0,  (0x1, {24, 48, 0x40, 0, 0, "System\CurrentControlSet\Services\Winsock2\Parameters"}, ... 68, ) }, ... 68, ) == 0x0
 00542   396   NtQueryValueKey  (68,  (68, "Ws2_32NumHandleBuckets", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00543   396   NtClose  (68, ... ) == 0x0
 00544   396   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ... 68, ) == 0x0
 00545   396   NtAllocateVirtualMemory  (-1, 9519104, 0, 32768, 4096, 4, ... 9519104, 32768, ) == 0x0
 00546   396   NtAllocateVirtualMemory  (-1, 0, 0, 17, 4096, 64, ... 3538944, 4096, ) == 0x0
 00547   396   NtAllocateVirtualMemory  (-1, 0, 0, 21, 4096, 64, ... 3604480, 4096, ) == 0x0
 00548   396   NtAllocateVirtualMemory  (-1, 0, 0, 24950, 4096, 64, ... 3670016, 28672, ) == 0x0
 00549   396   NtAllocateVirtualMemory  (-1, 9551872, 0, 32768, 4096, 4, ... 9551872, 32768, ) == 0x0
 00550   396   NtFreeVirtualMemory  (-1, (0x920000), 16384, 16384, ... (0x920000), 16384, ) == 0x0
 00551   396   NtFreeVirtualMemory  (-1, (0x91c000), 16384, 16384, ... (0x91c000), 16384, ) == 0x0
 00552   396   NtAllocateVirtualMemory  (-1, 9551872, 0, 32768, 4096, 4, ... 9551872, 32768, ) == 0x0
 00553   396   NtFreeVirtualMemory  (-1, (0x920000), 16384, 16384, ... (0x920000), 16384, ) == 0x0
 00554   396   NtFreeVirtualMemory  (-1, (0x91c000), 16384, 16384, ... (0x91c000), 16384, ) == 0x0
 00555   396   NtFreeVirtualMemory  (-1, (0x914000), 32768, 16384, ... (0x914000), 32768, ) == 0x0
 00556   396   NtAllocateVirtualMemory  (-1, 9519104, 0, 32768, 4096, 4, ... 9519104, 32768, ) == 0x0
 00557   396   NtFreeVirtualMemory  (-1, (0x914000), 32768, 16384, ... (0x914000), 32768, ) == 0x0
 00558   396   NtAllocateVirtualMemory  (-1, 9519104, 0, 16384, 4096, 4, ... 9519104, 16384, ) == 0x0
 00559   396   NtAllocateVirtualMemory  (-1, 9535488, 0, 32768, 4096, 4, ... 9535488, 32768, ) == 0x0
 00560   396   NtFreeVirtualMemory  (-1, (0x918000), 32768, 16384, ... (0x918000), 32768, ) == 0x0
 00561   396   NtFreeVirtualMemory  (-1, (0x914000), 16384, 16384, ... (0x914000), 16384, ) == 0x0
 00562   396   NtAllocateVirtualMemory  (-1, 9519104, 0, 16384, 4096, 4, ... 9519104, 16384, ) == 0x0
 00563   396   NtFreeVirtualMemory  (-1, (0x914000), 16384, 16384, ... (0x914000), 16384, ) == 0x0
 00564   396   NtAllocateVirtualMemory  (-1, 9519104, 0, 32768, 4096, 4, ... 9519104, 32768, ) == 0x0
 00565   396   NtFreeVirtualMemory  (-1, (0x914000), 32768, 16384, ... (0x914000), 32768, ) == 0x0
 00566   396   NtAllocateVirtualMemory  (-1, 9519104, 0, 32768, 4096, 4, ... 9519104, 32768, ) == 0x0
 00567   396   NtFreeVirtualMemory  (-1, (0x914000), 16384, 16384, ... (0x914000), 16384, ) == 0x0
 00568   396   NtCreateFile  (0xc0100080, {24, 0, 0x40, 0, 1243880,  (0xc0100080, {24, 0, 0x40, 0, 1243880, "\??\Scsi0:"}, 0x0, 0, 3, 1, 96, 0, 0, ... 88, {status=0x0, info=0}, ) }, 0x0, 0, 3, 1, 96, 0, 0, ... 88, {status=0x0, info=0}, ) == 0x0
 00569   396   NtDeviceIoControlFile  (88, 0, 0x0, 0x0, 0x4d008,  (88, 0, 0x0, 0x0, 0x4d008, "\34\0\0\0SCSIDISK\2\0\0\0\1\5\33\0\0\0\0\0 \2\0\0\0\2\0\0\0\1\1\0\0\240\354\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0", 572, 572, ... {status=0x0, info=572}, "\34\0\0\0SCSIDISK\2\0\0\0\1\5\33\0\0\0\0\0 \2\0\0\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0zBa\30\0\0\20\0\0\0\0\0?\0\0\0\0\0\0\000000000000000000010\0\0@\0\0\000000010MVawerV riutlaI EDH ra drDvi e          @\200\0\0\0/\0\0\0\2\0\0\7\0a\30\20\0?\0\360\375_\0@\1\0\0`\0\0\0\7\0\3\0x\0x\0\240\0x\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\36\0\27\0\10@\10@\0@\10@\0@\0@\7\4\0\0\0\0\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0", ) , 572, 572, ... {status=0x0, info=572},  (88, 0, 0x0, 0x0, 0x4d008, "\34\0\0\0SCSIDISK\2\0\0\0\1\5\33\0\0\0\0\0 \2\0\0\0\2\0\0\0\1\1\0\0\240\354\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0", 572, 572, ... {status=0x0, info=572}, "\34\0\0\0SCSIDISK\2\0\0\0\1\5\33\0\0\0\0\0 \2\0\0\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0zBa\30\0\0\20\0\0\0\0\0?\0\0\0\0\0\0\000000000000000000010\0\0@\0\0\000000010MVawerV riutlaI EDH ra drDvi e          @\200\0\0\0/\0\0\0\2\0\0\7\0a\30\20\0?\0\360\375_\0@\1\0\0`\0\0\0\7\0\3\0x\0x\0\240\0x\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\36\0\27\0\10@\10@\0@\10@\0@\0@\7\4\0\0\0\0\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0", ) , ) == 0x0
 00570   396   NtClose  (88, ... ) == 0x0
 00571   396   NtQueryInformationProcess  (-1, DeviceMap, 36, ... {process info, class 23, size 36}, 0x0, ) == 0x0
 00572   396   NtOpenFile  (0x100001, {24, 0, 0x40, 0, 0,  (0x100001, {24, 0, 0x40, 0, 0, "\??\C:\"}, 3, 16417, ... 88, {status=0x0, info=1}, ) }, 3, 16417, ... 88, {status=0x0, info=1}, ) == 0x0
 00573   396   NtQueryInformationFile  (88, 1243996, 528, Name, ... {status=0x0, info=6}, ) == 0x0
 00574   396   NtQueryVolumeInformationFile  (88, 1350312, 284, Volume, ... {status=0x0, info=18}, ) == 0x0
 00575   396   NtQueryVolumeInformationFile  (88, 1350608, 276, Attribute, ... {status=0x0, info=22}, ) == 0x0
 00576   396   NtClose  (88, ... ) == 0x0
 00577   396   NtOpenFile  (0x100001, {24, 0, 0x40, 0, 0,  (0x100001, {24, 0, 0x40, 0, 0, "\??\C:\"}, 3, 8388641, ... 88, {status=0x0, info=1}, ) }, 3, 8388641, ... 88, {status=0x0, info=1}, ) == 0x0
 00578   396   NtQueryVolumeInformationFile  (88, 1244780, 24, Size, ... {status=0x0, info=24}, ) == 0x0
 00579   396   NtClose  (88, ... ) == 0x0
 00580   396   NtQueryInformationProcess  (-1, DeviceMap, 36, ... {process info, class 23, size 36}, 0x0, ) == 0x0
 00581   396   NtOpenFile  (0x100001, {24, 0, 0x40, 0, 0,  (0x100001, {24, 0, 0x40, 0, 0, "\??\C:\"}, 3, 16417, ... 88, {status=0x0, info=1}, ) }, 3, 16417, ... 88, {status=0x0, info=1}, ) == 0x0
 00582   396   NtQueryInformationFile  (88, 1244000, 528, Name, ... {status=0x0, info=6}, ) == 0x0
 00583   396   NtQueryVolumeInformationFile  (88, 1350312, 284, Volume, ... {status=0x0, info=18}, ) == 0x0
 00584   396   NtQueryVolumeInformationFile  (88, 1350608, 276, Attribute, ... {status=0x0, info=22}, ) == 0x0
 00585   396   NtClose  (88, ... ) == 0x0
 00586   396   NtOpenFile  (0x100001, {24, 0, 0x40, 0, 0,  (0x100001, {24, 0, 0x40, 0, 0, "\??\C:\"}, 3, 8388641, ... 88, {status=0x0, info=1}, ) }, 3, 8388641, ... 88, {status=0x0, info=1}, ) == 0x0
 00587   396   NtQueryVolumeInformationFile  (88, 1244784, 24, Size, ... {status=0x0, info=24}, ) == 0x0
 00588   396   NtClose  (88, ... ) == 0x0
 00589   396   NtAllocateVirtualMemory  (-1, 0, 0, 768, 4096, 64, ... 3932160, 4096, ) == 0x0
 00590   396   NtAllocateVirtualMemory  (-1, 0, 0, 768, 4096, 64, ... 3997696, 4096, ) == 0x0
 00591   396   NtAllocateVirtualMemory  (-1, 9551872, 0, 32768, 4096, 4, ... 9551872, 32768, ) == 0x0
 00592   396   NtFreeVirtualMemory  (-1, (0x920000), 16384, 16384, ... (0x920000), 16384, ) == 0x0
 00593   396   NtOpenThreadTokenEx  (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN
 00594   396   NtOpenProcessTokenEx  (-1, 0x20008, 512, ... 88, ) == 0x0
 00595   396   NtQueryInformationToken  (88, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0
 00596   396   NtClose  (88, ... ) == 0x0
 00597   396   NtOpenKey  (0x2000000, {24, 0, 0x40, 0, 0,  (0x2000000, {24, 0, 0x40, 0, 0, "\REGISTRY\USER\S-1-5-21-1078081533-484763869-839522115-1003_Classes"}, ... 88, ) }, ... 88, ) == 0x0
 00598   396   NtSetInformationObject  (90, Handle, {Inherit=0,ProtectFromClose=1,}, 1179904, ... ) == 0x0
 00599   396   NtQueryKey  (90, Name, 382, ... {Name= (90, Name, 382, ... {Name="\REGISTRY\USER\S-1-5-21-1078081533-484763869-839522115-1003_CLASSES9"}, 138, ) }, 138, ) == 0x0
 00600   396   NtOpenKey  (0x2000000, {24, 90, 0x40, 0, 0,  (0x2000000, {24, 90, 0x40, 0, 0, ".key"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00601   396   NtOpenKey  (0x2000000, {24, 0, 0x40, 0, 0,  (0x2000000, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Classes"}, ... 92, ) }, ... 92, ) == 0x0
 00602   396   NtCreateKey  (0x2, {24, 92, 0x40, 0, 0,  (0x2, {24, 92, 0x40, 0, 0, ".key"}, 0, 0x0, 0, ... }, 0, 0x0, 0, ...
 00603   396   NtSetInformationFile  (-2147482808, -136576436, 8, EndOfFile, ... {status=0x0, info=0}, ) == 0x0
 00604   396   NtSetInformationFile  (-2147482808, -136576068, 8, EndOfFile, ... {status=0x0, info=0}, ) == 0x0
 00605   396   NtSetInformationFile  (-2147482808, -136576060, 8, EndOfFile, ... {status=0x0, info=0}, ) == 0x0
 00602   396   NtCreateKey  ... 96, 1, ) == 0x0
 00606   396   NtClose  (92, ... ) == 0x0
 00607   396   NtQueryKey  (98, Name, 392, ... {Name= (98, Name, 392, ... {Name="\REGISTRY\MACHINE\SOFTWARE\Classes\.keyo"}, 82, ) }, 82, ) == 0x0
 00608   396   NtOpenThreadTokenEx  (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN
 00609   396   NtOpenProcessTokenEx  (-1, 0x20008, 512, ... 92, ) == 0x0
 00610   396   NtQueryInformationToken  (92, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0
 00611   396   NtClose  (92, ... ) == 0x0
 00612   396   NtOpenKey  (0x2000000, {24, 0, 0x40, 0, 0,  (0x2000000, {24, 0, 0x40, 0, 0, "\REGISTRY\USER\S-1-5-21-1078081533-484763869-839522115-1003_Classes\.key"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00613   396   NtSetValueKey  (98, 0x0, 0, 1,  (98, 0x0, 0, 1, "\0\0", 2, ... ) , 2, ... ) == 0x0
 00614   396   NtClose  (98, ... ) == 0x0
 00615   396   NtQueryKey  (90, Name, 384, ... {Name= (90, Name, 384, ... {Name="\REGISTRY\USER\S-1-5-21-1078081533-484763869-839522115-1003_CLASSES9"}, 138, ) }, 138, ) == 0x0
 00616   396   NtOpenKey  (0x2, {24, 90, 0x40, 0, 0,  (0x2, {24, 90, 0x40, 0, 0, ".key"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00617   396   NtOpenKey  (0x2, {24, 0, 0x40, 0, 0,  (0x2, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Classes\.key"}, ... 96, ) }, ... 96, ) == 0x0
 00618   396   NtQueryKey  (98, Name, 392, ... {Name= (98, Name, 392, ... {Name="\REGISTRY\MACHINE\SOFTWARE\Classes\.keyo"}, 82, ) }, 82, ) == 0x0
 00619   396   NtOpenThreadTokenEx  (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN
 00620   396   NtOpenProcessTokenEx  (-1, 0x20008, 512, ... 92, ) == 0x0
 00621   396   NtQueryInformationToken  (92, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0
 00622   396   NtClose  (92, ... ) == 0x0
 00623   396   NtOpenKey  (0x2000000, {24, 0, 0x40, 0, 0,  (0x2000000, {24, 0, 0x40, 0, 0, "\REGISTRY\USER\S-1-5-21-1078081533-484763869-839522115-1003_Classes\.key"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00624   396   NtSetValueKey  (98, " (98, "", 0, 1, "r\0e\0g\0f\0i\0l\0e\0\0\0", 16, ... ) r\0e\0g\0f\0i\0l\0e\0\0\0", 16, ... ) == 0x0
 00625   396   NtClose  (98, ... ) == 0x0
 00626   396   NtFreeVirtualMemory  (-1, (0x91c000), 16384, 16384, ... (0x91c000), 16384, ) == 0x0
 00627   396   NtAllocateVirtualMemory  (-1, 9551872, 0, 32768, 4096, 4, ... 9551872, 32768, ) == 0x0
 00628   396   NtFreeVirtualMemory  (-1, (0x920000), 16384, 16384, ... (0x920000), 16384, ) == 0x0
 00629   396   NtAllocateVirtualMemory  (-1, 9568256, 0, 32768, 4096, 4, ... 9568256, 32768, ) == 0x0
 00630   396   NtFreeVirtualMemory  (-1, (0x920000), 32768, 16384, ... (0x920000), 32768, ) == 0x0
 00631   396   NtFreeVirtualMemory  (-1, (0x91c000), 16384, 16384, ... (0x91c000), 16384, ) == 0x0
 00632   396   NtOpenSection  (0xe, {24, 8, 0x40, 0, 0,  (0xe, {24, 8, 0x40, 0, 0, "wininet.dll"}, ... 96, ) }, ... 96, ) == 0x0
 00633   396   NtMapViewOfSection  (96, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x76200000), 0x0, 618496, ) == 0x0
 00634   396   NtClose  (96, ... ) == 0x0
 00635   396   NtOpenSection  (0xe, {24, 8, 0x40, 0, 0,  (0xe, {24, 8, 0x40, 0, 0, "SHLWAPI.dll"}, ... 96, ) }, ... 96, ) == 0x0
 00636   396   NtMapViewOfSection  (96, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x772d0000), 0x0, 405504, ) == 0x0
 00637   396   NtClose  (96, ... ) == 0x0
 00638   396   NtOpenSection  (0xe, {24, 8, 0x40, 0, 0,  (0xe, {24, 8, 0x40, 0, 0, "CRYPT32.dll"}, ... 96, ) }, ... 96, ) == 0x0
 00639   396   NtMapViewOfSection  (96, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x762c0000), 0x0, 565248, ) == 0x0
 00640   396   NtClose  (96, ... ) == 0x0
 00641   396   NtOpenSection  (0xe, {24, 8, 0x40, 0, 0,  (0xe, {24, 8, 0x40, 0, 0, "MSASN1.dll"}, ... 96, ) }, ... 96, ) == 0x0
 00642   396   NtMapViewOfSection  (96, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x762a0000), 0x0, 61440, ) == 0x0
 00643   396   NtClose  (96, ... ) == 0x0
 00644   396   NtOpenKey  (0x2000000, {24, 48, 0x40, 0, 0,  (0x2000000, {24, 48, 0x40, 0, 0, "Software\Microsoft\Windows\CurrentVersion\Explorer\Performance"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00645   396   NtAllocateVirtualMemory  (-1, 1351680, 0, 4096, 4096, 4, ... 1351680, 4096, ) == 0x0
 00646   396   NtOpenKey  (0x20019, {24, 48, 0x40, 0, 0,  (0x20019, {24, 48, 0x40, 0, 0, "SYSTEM\CurrentControlSet\Services\crypt32\Performance"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00647   396   NtAllocateVirtualMemory  (-1, 1355776, 0, 4096, 4096, 4, ... 1355776, 4096, ) == 0x0
 00648   396   NtAllocateVirtualMemory  (-1, 1359872, 0, 4096, 4096, 4, ... 1359872, 4096, ) == 0x0
 00649   396   NtAllocateVirtualMemory  (-1, 1363968, 0, 4096, 4096, 4, ... 1363968, 4096, ) == 0x0
 00650   396   NtCreateEvent  (0x1f0003, {24, 52, 0x80, 1242580, 0,  (0x1f0003, {24, 52, 0x80, 1242580, 0, "Global\crypt32LogoffEvent"}, 0, 0, ... ) }, 0, 0, ... ) == STATUS_ACCESS_DENIED
 00651   396   NtOpenEvent  (0x100000, {24, 52, 0x0, 0, 0,  (0x100000, {24, 52, 0x0, 0, 0, "Global\crypt32LogoffEvent"}, ... 96, ) }, ... 96, ) == 0x0
 00652   396   NtAllocateVirtualMemory  (-1, 1368064, 0, 4096, 4096, 4, ... 1368064, 4096, ) == 0x0
 00653   396   NtAllocateVirtualMemory  (-1, 1372160, 0, 8192, 4096, 4, ... 1372160, 8192, ) == 0x0
 00654   396   NtCreateKey  (0xf003f, {24, 60, 0x40, 0, 0,  (0xf003f, {24, 60, 0x40, 0, 0, "SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\P3P\History"}, 0, 0x0, 0, ... 92, 2, ) }, 0, 0x0, 0, ... 92, 2, ) == 0x0
 00655   396   NtQueryDefaultUILanguage  (1240816, ...
 00656   396   NtOpenThreadTokenEx  (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN
 00657   396   NtOpenProcessTokenEx  (-1, 0x20008, 512, ... -2147482020, ) == 0x0
 00658   396   NtQueryInformationToken  (-2147482020, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0
 00659   396   NtClose  (-2147482020, ... ) == 0x0
 00660   396   NtOpenKey  (0x2000000, {24, 0, 0x640, 0, 0,  (0x2000000, {24, 0, 0x640, 0, 0, "\REGISTRY\USER\S-1-5-21-1078081533-484763869-839522115-1003"}, ... -2147482020, ) }, ... -2147482020, ) == 0x0
 00661   396   NtOpenKey  (0x80000000, {24, 0, 0x240, 0, 0,  (0x80000000, {24, 0, 0x240, 0, 0, "\Registry\Machine\System\CurrentControlSet\Control\Nls\MUILanguages"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00662   396   NtOpenKey  (0x80000000, {24, -2147482020, 0x640, 0, 0,  (0x80000000, {24, -2147482020, 0x640, 0, 0, "Control Panel\Desktop"}, ... -2147482032, ) }, ... -2147482032, ) == 0x0
 00663   396   NtQueryValueKey  (-2147482032,  (-2147482032, "MultiUILanguageId", Partial, 256, ... ) , Partial, 256, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00664   396   NtClose  (-2147482032, ... ) == 0x0
 00665   396   NtClose  (-2147482020, ... ) == 0x0
 00655   396   NtQueryDefaultUILanguage  ... ) == 0x0
 00666   396   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\System\CurrentControlSet\Control\Nls\MUILanguages"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00667   396   NtQueryInstallUILanguage  (2012047340, ... ) == 0x0
 00668   396   NtOpenFile  (0x1200a9, {24, 0, 0x40, 0, 0,  (0x1200a9, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\wininet.dll"}, 1, 96, ... 100, {status=0x0, info=1}, ) }, 1, 96, ... 100, {status=0x0, info=1}, ) == 0x0
 00669   396   NtCreateSection  (0x4, 0x0, 0x0, 2, 134217728, 100, ... 104, ) == 0x0
 00670   396   NtMapViewOfSection  (104, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 2, ... (0xa70000), 0x0, 593920, ) == 0x0
 00671   396   NtOpenFile  (0x1200a9, {24, 0, 0x40, 0, 0,  (0x1200a9, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\wininet.dll.123.Manifest"}, 1, 96, ... ) }, 1, 96, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00672   396   NtQueryDefaultUILanguage  (2013024600, ...
 00673   396   NtOpenThreadTokenEx  (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN
 00674   396   NtOpenProcessTokenEx  (-1, 0x20008, 512, ... -2147482020, ) == 0x0
 00675   396   NtQueryInformationToken  (-2147482020, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0
 00676   396   NtClose  (-2147482020, ... ) == 0x0
 00677   396   NtOpenKey  (0x2000000, {24, 0, 0x640, 0, 0,  (0x2000000, {24, 0, 0x640, 0, 0, "\REGISTRY\USER\S-1-5-21-1078081533-484763869-839522115-1003"}, ... -2147482020, ) }, ... -2147482020, ) == 0x0
 00678   396   NtOpenKey  (0x80000000, {24, 0, 0x240, 0, 0,  (0x80000000, {24, 0, 0x240, 0, 0, "\Registry\Machine\System\CurrentControlSet\Control\Nls\MUILanguages"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00679   396   NtOpenKey  (0x80000000, {24, -2147482020, 0x640, 0, 0,  (0x80000000, {24, -2147482020, 0x640, 0, 0, "Control Panel\Desktop"}, ... -2147482032, ) }, ... -2147482032, ) == 0x0
 00680   396   NtQueryValueKey  (-2147482032,  (-2147482032, "MultiUILanguageId", Partial, 256, ... ) , Partial, 256, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00681   396   NtClose  (-2147482032, ... ) == 0x0
 00682   396   NtClose  (-2147482020, ... ) == 0x0
 00672   396   NtQueryDefaultUILanguage  ... ) == 0x0
 00683   396   NtAllocateVirtualMemory  (-1, 1228800, 0, 4096, 4096, 260, ... 1228800, 4096, ) == 0x0
 00684   396   NtQueryInstallUILanguage  (2013024602, ... ) == 0x0
 00685   396   NtQueryDefaultLocale  (1, 1238852, ... ) == 0x0
 00686   396   NtOpenFile  (0x1200a9, {24, 0, 0x40, 0, 0,  (0x1200a9, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\wininet.dll.123.Config"}, 1, 96, ... ) }, 1, 96, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00687   396   NtRequestWaitReplyPort  (24, {128, 156, new_msg, 0, 1239708, 1, 96, 0}  (24, {128, 156, new_msg, 0, 1239708, 1, 96, 0} "\210\6\35\1\33\0\1\0\0\0\0\0\1\355\22\0\1\0\0\0\0\0\11\4\1\1\1\0>\0@\0\250\6\35\1d\0\0\0\377\377\377\377\0\0\0\0P\275\256\0\0\0\0\0\312\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0(\0,\0\350\6\35\1\0\0\0\0\0\0\0\0\234\361\22\0\0\0\0\0" ... {128, 156, reply, 0, 316, 396, 1513, 0} " S\26\0\33\0\1\0\0\0\0\0\1\355\22\0\1\0\0\0\0\0\11\4\1\1\1\0>\0@\0\250\6\35\1d\0\0\0\377\377\377\377\0\0\0\0P\275\256\0\0\0\0\0\312\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0(\0,\0\350\6\35\1\0\0\0\0\0\0\0\0\234\361\22\0\0\0\0\0" )  ... {128, 156, reply, 0, 316, 396, 1513, 0}  (24, {128, 156, new_msg, 0, 1239708, 1, 96, 0} "\210\6\35\1\33\0\1\0\0\0\0\0\1\355\22\0\1\0\0\0\0\0\11\4\1\1\1\0>\0@\0\250\6\35\1d\0\0\0\377\377\377\377\0\0\0\0P\275\256\0\0\0\0\0\312\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0(\0,\0\350\6\35\1\0\0\0\0\0\0\0\0\234\361\22\0\0\0\0\0" ... {128, 156, reply, 0, 316, 396, 1513, 0} " S\26\0\33\0\1\0\0\0\0\0\1\355\22\0\1\0\0\0\0\0\11\4\1\1\1\0>\0@\0\250\6\35\1d\0\0\0\377\377\377\377\0\0\0\0P\275\256\0\0\0\0\0\312\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0(\0,\0\350\6\35\1\0\0\0\0\0\0\0\0\234\361\22\0\0\0\0\0" )  ) == 0x0
 00688   396   NtClose  (100, ... ) == 0x0
 00689   396   NtClose  (104, ... ) == 0x0
 00690   396   NtUnmapViewOfSection  (-1, 0xa70000, ... ) == 0x0
 00691   396   NtUnmapViewOfSection  (-1, 0x12f19c, ... ) == STATUS_NOT_MAPPED_VIEW
 00692   396   NtQueryDebugFilterState  (53, 2, ... ) == 0x0
 00693   396   NtOpenKey  (0x8, {24, 0, 0x40, 0, 0,  (0x8, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows\CurrentVersion\SideBySide\AssemblyStorageRoots"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00694   396   NtQueryDebugFilterState  (53, 2, ... ) == 0x0
 00695   396   NtQueryDebugFilterState  (53, 2, ... ) == 0x0
 00696   396   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\u:\work\packed.exe.Local\"}, 1237392, ... ) }, 1237392, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00697   396   NtQueryDebugFilterState  (53, 2, ... ) == 0x0
 00698   396   NtQueryDebugFilterState  (53, 2, ... ) == 0x0
 00699   396   NtQueryDebugFilterState  (53, 2, ... ) == 0x0
 00700   396   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.0.0_x-ww_1382d70a"}, 1237984, ... ) }, 1237984, ... ) == 0x0
 00701   396   NtOpenFile  (0x100020, {24, 0, 0x40, 0, 0,  (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.0.0_x-ww_1382d70a"}, 3, 33, ... 104, {status=0x0, info=1}, ) }, 3, 33, ... 104, {status=0x0, info=1}, ) == 0x0
 00702   396   NtQueryDebugFilterState  (53, 2, ... ) == 0x0
 00703   396   NtOpenFile  (0x100020, {24, 0, 0x40, 0, 0,  (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.0.0_x-ww_1382d70a\comctl32.dll"}, 5, 96, ... 100, {status=0x0, info=1}, ) }, 5, 96, ... 100, {status=0x0, info=1}, ) == 0x0
 00704   396   NtCreateSection  (0xe, 0x0, 0x0, 16, 134217728, 100, ... 108, ) == 0x0
 00705   396   NtClose  (100, ... ) == 0x0
 00706   396   NtMapViewOfSection  (108, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 16, ... (0xa70000), 0x0, 921600, ) == 0x0
 00707   396   NtClose  (108, ... ) == 0x0
 00708   396   NtUnmapViewOfSection  (-1, 0xa70000, ... ) == 0x0
 00709   396   NtOpenFile  (0x100020, {24, 0, 0x40, 0, 0,  (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.0.0_x-ww_1382d70a\comctl32.dll"}, 5, 96, ... 108, {status=0x0, info=1}, ) }, 5, 96, ... 108, {status=0x0, info=1}, ) == 0x0
 00710   396   NtCreateSection  (0xf, 0x0, 0x0, 16, 16777216, 108, ... 100, ) == 0x0
 00711   396   NtQuerySection  (100, Image, 48, ... {section info, class 1, size 48}, 0x0, ) == 0x0
 00712   396   NtClose  (108, ... ) == 0x0
 00713   396   NtMapViewOfSection  (100, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x71950000), 0x0, 933888, ) == 0x0
 00714   396   NtClose  (100, ... ) == 0x0
 00715   396   NtProtectVirtualMemory  (-1, (0x71951000), 1952, 4, ... (0x71951000), 4096, 32, ) == 0x0
 00716   396   NtProtectVirtualMemory  (-1, (0x71951000), 4096, 32, ... (0x71951000), 4096, 4, ) == 0x0
 00717   396   NtFlushInstructionCache  (-1, 1905594368, 1952, ... ) == 0x0
 00718   396   NtProtectVirtualMemory  (-1, (0x71951000), 1952, 4, ... (0x71951000), 4096, 32, ) == 0x0
 00719   396   NtProtectVirtualMemory  (-1, (0x71951000), 4096, 32, ... (0x71951000), 4096, 4, ) == 0x0
 00720   396   NtFlushInstructionCache  (-1, 1905594368, 1952, ... ) == 0x0
 00721   396   NtProtectVirtualMemory  (-1, (0x71951000), 1952, 4, ... (0x71951000), 4096, 32, ) == 0x0
 00722   396   NtProtectVirtualMemory  (-1, (0x71951000), 4096, 32, ... (0x71951000), 4096, 4, ) == 0x0
 00723   396   NtFlushInstructionCache  (-1, 1905594368, 1952, ... ) == 0x0
 00724   396   NtProtectVirtualMemory  (-1, (0x71951000), 1952, 4, ... (0x71951000), 4096, 32, ) == 0x0
 00725   396   NtProtectVirtualMemory  (-1, (0x71951000), 4096, 32, ... (0x71951000), 4096, 4, ) == 0x0
 00726   396   NtFlushInstructionCache  (-1, 1905594368, 1952, ... ) == 0x0
 00727   396   NtProtectVirtualMemory  (-1, (0x71951000), 1952, 4, ... (0x71951000), 4096, 32, ) == 0x0
 00728   396   NtProtectVirtualMemory  (-1, (0x71951000), 4096, 32, ... (0x71951000), 4096, 4, ) == 0x0
 00729   396   NtFlushInstructionCache  (-1, 1905594368, 1952, ... ) == 0x0
 00730   396   NtProtectVirtualMemory  (-1, (0x71951000), 1952, 4, ... (0x71951000), 4096, 32, ) == 0x0
 00731   396   NtProtectVirtualMemory  (-1, (0x71951000), 4096, 32, ... (0x71951000), 4096, 4, ) == 0x0
 00732   396   NtFlushInstructionCache  (-1, 1905594368, 1952, ... ) == 0x0
 00733   396   NtProtectVirtualMemory  (-1, (0x71951000), 1952, 4, ... (0x71951000), 4096, 32, ) == 0x0
 00734   396   NtProtectVirtualMemory  (-1, (0x71951000), 4096, 32, ... (0x71951000), 4096, 4, ) == 0x0
 00735   396   NtFlushInstructionCache  (-1, 1905594368, 1952, ... ) == 0x0
 00736   396   NtAddAtom  ( ("T\0h\0e\0m\0e\0P\0r\0o\0p\0S\0c\0r\0o\0l\0l\0B\0a\0r\0C\0t\0l\0", 42, 1239168, ... ) , 42, 1239168, ... ) == 0x0
 00737   396   NtQueryDefaultUILanguage  (1237884, ...
 00738   396   NtOpenThreadTokenEx  (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN
 00739   396   NtOpenProcessTokenEx  (-1, 0x20008, 512, ... -2147482020, ) == 0x0
 00740   396   NtQueryInformationToken  (-2147482020, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0
 00741   396   NtClose  (-2147482020, ... ) == 0x0
 00742   396   NtOpenKey  (0x2000000, {24, 0, 0x640, 0, 0,  (0x2000000, {24, 0, 0x640, 0, 0, "\REGISTRY\USER\S-1-5-21-1078081533-484763869-839522115-1003"}, ... -2147482020, ) }, ... -2147482020, ) == 0x0
 00743   396   NtOpenKey  (0x80000000, {24, 0, 0x240, 0, 0,  (0x80000000, {24, 0, 0x240, 0, 0, "\Registry\Machine\System\CurrentControlSet\Control\Nls\MUILanguages"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00744   396   NtOpenKey  (0x80000000, {24, -2147482020, 0x640, 0, 0,  (0x80000000, {24, -2147482020, 0x640, 0, 0, "Control Panel\Desktop"}, ... -2147482032, ) }, ... -2147482032, ) == 0x0
 00745   396   NtQueryValueKey  (-2147482032,  (-2147482032, "MultiUILanguageId", Partial, 256, ... ) , Partial, 256, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00746   396   NtClose  (-2147482032, ... ) == 0x0
 00747   396   NtClose  (-2147482020, ... ) == 0x0
 00737   396   NtQueryDefaultUILanguage  ... ) == 0x0
 00748   396   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\System\CurrentControlSet\Control\Nls\MUILanguages"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00749   396   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\WindowsShell.Manifest"}, 1236736, ... ) }, 1236736, ... ) == 0x0
 00750   396   NtOpenFile  (0x100020, {24, 0, 0x40, 0, 0,  (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\WindowsShell.Manifest"}, 5, 96, ... 100, {status=0x0, info=1}, ) }, 5, 96, ... 100, {status=0x0, info=1}, ) == 0x0
 00751   396   NtCreateSection  (0xe, 0x0, 0x0, 16, 134217728, 100, ... 108, ) == 0x0
 00752   396   NtClose  (100, ... ) == 0x0
 00753   396   NtMapViewOfSection  (108, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 16, ... (0x3f0000), 0x0, 4096, ) == 0x0
 00754   396   NtClose  (108, ... ) == 0x0
 00755   396   NtUnmapViewOfSection  (-1, 0x3f0000, ... ) == 0x0
 00756   396   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\WindowsShell.Manifest"}, 1236376, ... ) }, 1236376, ... ) == 0x0
 00757   396   NtCreateFile  (0x80100080, {24, 0, 0x40, 0, 1237076,  (0x80100080, {24, 0, 0x40, 0, 1237076, "\??\C:\WINDOWS\WindowsShell.Manifest"}, 0x0, 0, 5, 1, 96, 0, 0, ... 108, {status=0x0, info=1}, ) }, 0x0, 0, 5, 1, 96, 0, 0, ... 108, {status=0x0, info=1}, ) == 0x0
 00758   396   NtCreateSection  (0xf0005, 0x0, 0x0, 2, 134217728, 108, ... 100, ) == 0x0
 00759   396   NtClose  (108, ... ) == 0x0
 00760   396   NtMapViewOfSection  (100, -1, (0x0), 0, 0, {0, 0}, 0, 1, 0, 2, ... (0x3f0000), {0, 0}, 4096, ) == 0x0
 00761   396   NtClose  (100, ... ) == 0x0
 00762   396   NtUnmapViewOfSection  (-1, 0x3f0000, ... ) == 0x0
 00763   396   NtOpenFile  (0x1200a9, {24, 0, 0x40, 0, 0,  (0x1200a9, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\WindowsShell.Manifest"}, 1, 96, ... 100, {status=0x0, info=1}, ) }, 1, 96, ... 100, {status=0x0, info=1}, ) == 0x0
 00764   396   NtCreateSection  (0x4, 0x0, 0x0, 2, 134217728, 100, ... 108, ) == 0x0
 00765   396   NtMapViewOfSection  (108, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 2, ... (0x3f0000), 0x0, 4096, ) == 0x0
 00766   396   NtQueryInformationFile  (100, 1236696, 56, NetworkOpen, ... {status=0x0, info=56}, ) == 0x0
 00767   396   NtOpenFile  (0x1200a9, {24, 0, 0x40, 0, 0,  (0x1200a9, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\WindowsShell.Config"}, 1, 96, ... ) }, 1, 96, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00768   396   NtRequestWaitReplyPort  (24, {128, 156, new_msg, 0, 1236776, 1, 96, 0}  (24, {128, 156, new_msg, 0, 1236776, 1, 96, 0} "\210\6\35\1\33\0\1\0\240\315Z\371\2209\307\1\1\0\0\0\0\0\11\4\1\1\3\0@\0D\0\250\6\35\1d\0\0\0l\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\355\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\26\0\30\0\354\6\35\1\0\0\0\0\0\0\0\0(\346\22\0\0\0\0\0" ... {128, 156, reply, 0, 316, 396, 1514, 0} "h\334\26\0\33\0\1\0\0\0\0\0\2209\307\1\1\0\0\0\0\0\11\4\1\1\3\0@\0D\0\250\6\35\1d\0\0\0l\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\355\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\26\0\30\0\354\6\35\1\0\0\0\0\0\0\0\0(\346\22\0\0\0\0\0" )  ... {128, 156, reply, 0, 316, 396, 1514, 0}  (24, {128, 156, new_msg, 0, 1236776, 1, 96, 0} "\210\6\35\1\33\0\1\0\240\315Z\371\2209\307\1\1\0\0\0\0\0\11\4\1\1\3\0@\0D\0\250\6\35\1d\0\0\0l\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\355\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\26\0\30\0\354\6\35\1\0\0\0\0\0\0\0\0(\346\22\0\0\0\0\0" ... {128, 156, reply, 0, 316, 396, 1514, 0} "h\334\26\0\33\0\1\0\0\0\0\0\2209\307\1\1\0\0\0\0\0\11\4\1\1\3\0@\0D\0\250\6\35\1d\0\0\0l\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\355\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\26\0\30\0\354\6\35\1\0\0\0\0\0\0\0\0(\346\22\0\0\0\0\0" )  ) == 0x0
 00769   396   NtClose  (100, ... ) == 0x0
 00770   396   NtClose  (108, ... ) == 0x0
 00771   396   NtUnmapViewOfSection  (-1, 0x3f0000, ... ) == 0x0
 00772   396   NtUnmapViewOfSection  (-1, 0x12e628, ... ) == STATUS_NOT_MAPPED_VIEW
 00773   396   NtQueryDebugFilterState  (53, 2, ... ) == 0x0
 00774   396   NtUserRegisterWindowMessage  ( ("ShellGetDragImage", ... ) , ... ) == 0xc03a
 00775   396   NtUserSystemParametersInfo  (104, 0, 1906151468, 0, ... ) == 0x1
 00776   396   NtUserGetDC  (0, ... ) == 0x1010052
 00777   396   NtUserCallOneParam  (16842834, 56, ... ) == 0x1
 00778   396   NtUserSystemParametersInfo  (38, 4, 1906153440, 0, ... ) == 0x1
 00779   396   NtUserSystemParametersInfo  (66, 12, 1239188, 0, ... ) == 0x1
 00780   396   NtOpenProcessToken  (-1, 0x8, ... 108, ) == 0x0
 00781   396   NtAccessCheck  (1376256, 108, 0x1, 1238592, 1238536, 56, 1238620, ... ) == STATUS_NO_IMPERSONATION_TOKEN
 00782   396   NtClose  (108, ... ) == 0x0
 00783   396   NtOpenKey  (0x20019, {24, 60, 0x40, 0, 0,  (0x20019, {24, 60, 0x40, 0, 0, "Control Panel\Desktop"}, ... 108, ) }, ... 108, ) == 0x0
 00784   396   NtQueryValueKey  (108,  (108, "SmoothScroll", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00785   396   NtClose  (108, ... ) == 0x0
 00786   396   NtUserSystemParametersInfo  (41, 500, 1238688, 0, ... ) == 0x1
 00787   396   NtOpenKey  (0x1, {24, 60, 0x40, 0, 0,  (0x1, {24, 60, 0x40, 0, 0, "software\Microsoft\Windows\CurrentVersion\Explorer\Advanced"}, ... 108, ) }, ... 108, ) == 0x0
 00788   396   NtQueryValueKey  (108,  (108, "EnableBalloonTips", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00789   396   NtOpenKey  (0x1, {24, 48, 0x40, 0, 0,  (0x1, {24, 48, 0x40, 0, 0, "software\Microsoft\Windows\CurrentVersion\Explorer\Advanced"}, ... 100, ) }, ... 100, ) == 0x0
 00790   396   NtQueryValueKey  (100,  (100, "EnableBalloonTips", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00791   396   NtClose  (100, ... ) == 0x0
 00792   396   NtClose  (108, ... ) == 0x0
 00793   396   NtUserSystemParametersInfo  (102, 0, 1906153328, 0, ... ) == 0x1
 00794   396   NtUserSystemParametersInfo  (4130, 0, 1239212, 0, ... ) == 0x1
 00795   396   NtOpenKey  (0x1, {24, 48, 0x40, 0, 0,  (0x1, {24, 48, 0x40, 0, 0, "Software\Microsoft\Windows NT\CurrentVersion\LanguagePack"}, ... 108, ) }, ... 108, ) == 0x0
 00796   396   NtEnumerateValueKey  (108, 0, Full, 220, ... ) == STATUS_NO_MORE_ENTRIES
 00797   396   NtClose  (108, ... ) == 0x0
 00798   396   NtUserFindExistingCursorIcon  (1238496, 1238512, 1239080, ... ) == 0x10011
 00799   396   NtUserRegisterClassExWOW  (1238948, 1239028, 1239012, 1239044, 0, 384, 0, ... ) == 0x810dc03b
 00800   396   NtUserRegisterClassExWOW  (1238948, 1239028, 1239012, 1239044, 0, 384, 0, ... ) == 0x810dc03d
 00801   396   NtUserFindExistingCursorIcon  (1238492, 1238508, 1239076, ... ) == 0x10011
 00802   396   NtUserRegisterClassExWOW  (1238944, 1239024, 1239008, 1239040, 0, 384, 0, ... ) == 0x810dc03f
 00803   396   NtUserFindExistingCursorIcon  (1238496, 1238512, 1239080, ... ) == 0x10011
 00804   396   NtUserRegisterClassExWOW  (1238948, 1239028, 1239012, 1239044, 0, 384, 0, ... ) == 0x810dc041
 00805   396   NtUserFindExistingCursorIcon  (1238496, 1238512, 1239080, ... ) == 0x10011
 00806   396   NtUserRegisterClassExWOW  (1238948, 1239028, 1239012, 1239044, 0, 384, 0, ... ) == 0x810dc043
 00807   396   NtUserRegisterClassExWOW  (1238948, 1239028, 1239012, 1239044, 0, 384, 0, ... ) == 0x810dc045
 00808   396   NtUserFindExistingCursorIcon  (1238496, 1238512, 1239080, ... ) == 0x10011
 00809   396   NtUserRegisterClassExWOW  (1238948, 1239028, 1239012, 1239044, 0, 384, 0, ... ) == 0x810dc047
 00810   396   NtUserFindExistingCursorIcon  (1238492, 1238508, 1239076, ... ) == 0x10011
 00811   396   NtUserRegisterClassExWOW  (1238944, 1239024, 1239008, 1239040, 0, 384, 0, ... ) == 0x810dc049
 00812   396   NtUserGetClassInfo  (1905590272, 1239108, 1239060, 1239136, 0, ... ) == 0xc049
 00813   396   NtUserFindExistingCursorIcon  (1238496, 1238512, 1239080, ... ) == 0x10011
 00814   396   NtUserRegisterClassExWOW  (1238948, 1239028, 1239012, 1239044, 0, 384, 0, ... ) == 0x810dc04b
 00815   396   NtUserFindExistingCursorIcon  (1238496, 1238512, 1239080, ... ) == 0x10011
 00816   396   NtUserRegisterClassExWOW  (1238948, 1239028, 1239012, 1239044, 0, 384, 0, ... ) == 0x810dc04d
 00817   396   NtUserFindExistingCursorIcon  (1238496, 1238512, 1239080, ... ) == 0x10011
 00818   396   NtUserRegisterClassExWOW  (1238948, 1239028, 1239012, 1239044, 0, 384, 0, ... ) == 0x810dc04f
 00819   396   NtUserRegisterClassExWOW  (1238948, 1239028, 1239012, 1239044, 0, 384, 0, ... ) == 0x810dc051
 00820   396   NtUserFindExistingCursorIcon  (1238496, 1238512, 1239080, ... ) == 0x10011
 00821   396   NtUserRegisterClassExWOW  (1238948, 1239028, 1239012, 1239044, 0, 384, 0, ... ) == 0x810dc053
 00822   396   NtUserFindExistingCursorIcon  (1238492, 1238508, 1239076, ... ) == 0x10011
 00823   396   NtUserRegisterClassExWOW  (1238944, 1239024, 1239008, 1239040, 0, 384, 0, ... ) == 0x810dc055
 00824   396   NtUserRegisterClassExWOW  (1238944, 1239024, 1239008, 1239040, 0, 384, 0, ... ) == 0x810dc057
 00825   396   NtUserFindExistingCursorIcon  (1238496, 1238512, 1239080, ... ) == 0x10011
 00826   396   NtUserRegisterClassExWOW  (1238948, 1239028, 1239012, 1239044, 0, 384, 0, ... ) == 0x810dc059
 00827   396   NtUserFindExistingCursorIcon  (1238496, 1238512, 1239080, ... ) == 0x10013
 00828   396   NtUserRegisterClassExWOW  (1238948, 1239028, 1239012, 1239044, 0, 384, 0, ... ) == 0x810dc05b
 00829   396   NtUserFindExistingCursorIcon  (1238496, 1238512, 1239080, ... ) == 0x10011
 00830   396   NtUserRegisterClassExWOW  (1238948, 1239028, 1239012, 1239044, 0, 384, 0, ... ) == 0x810dc05d
 00831   396   NtUserFindExistingCursorIcon  (1238496, 1238512, 1239080, ... ) == 0x10011
 00832   396   NtUserRegisterClassExWOW  (1238948, 1239028, 1239012, 1239044, 0, 384, 0, ... ) == 0x810dc05f
 00833   396   NtUserFindExistingCursorIcon  (1238492, 1238508, 1239076, ... ) == 0x10011
 00834   396   NtUserRegisterClassExWOW  (1238944, 1239024, 1239008, 1239040, 0, 384, 0, ... ) == 0x810dc017
 00835   396   NtUserFindExistingCursorIcon  (1238492, 1238508, 1239076, ... ) == 0x10011
 00836   396   NtUserRegisterClassExWOW  (1238944, 1239024, 1239008, 1239040, 0, 384, 0, ... ) == 0x810dc019
 00837   396   NtUserFindExistingCursorIcon  (1238492, 1238508, 1239076, ... ) == 0x10013
 00838   396   NtUserRegisterClassExWOW  (1238944, 1239024, 1239008, 1239040, 0, 384, 0, ... ) == 0x810dc018
 00839   396   NtUserFindExistingCursorIcon  (1238496, 1238512, 1239080, ... ) == 0x10011
 00840   396   NtUserRegisterClassExWOW  (1238948, 1239028, 1239012, 1239044, 0, 384, 0, ... ) == 0x810dc01a
 00841   396   NtUserFindExistingCursorIcon  (1238492, 1238508, 1239076, ... ) == 0x10011
 00842   396   NtUserRegisterClassExWOW  (1238944, 1239024, 1239008, 1239040, 0, 384, 0, ... ) == 0x810dc01c
 00843   396   NtUserFindExistingCursorIcon  (1238496, 1238512, 1239080, ... ) == 0x10011
 00844   396   NtUserRegisterClassExWOW  (1238948, 1239028, 1239012, 1239044, 0, 384, 0, ...
 00845   396   NtAllocateVirtualMemory  (-1, 6455296, 0, 4096, 4096, 32, ... 6455296, 4096, ) == 0x0
 00844   396   NtUserRegisterClassExWOW  ... ) == 0x810dc01e
 00846   396   NtUserFindExistingCursorIcon  (1238492, 1238508, 1239076, ... ) == 0x10011
 00847   396   NtUserRegisterClassExWOW  (1239004, 1239084, 1239068, 1239100, 0, 384, 0, ... ) == 0x810dc01b
 00848   396   NtUserFindExistingCursorIcon  (1238488, 1238504, 1239072, ... ) == 0x10011
 00849   396   NtUserRegisterClassExWOW  (1239000, 1239080, 1239064, 1239096, 0, 384, 0, ... ) == 0x810dc068
 00850   396   NtUserFindExistingCursorIcon  (1238496, 1238512, 1239080, ... ) == 0x10011
 00851   396   NtUserRegisterClassExWOW  (1238948, 1239028, 1239012, 1239044, 0, 384, 0, ... ) == 0x810dc06a
 00852   396   NtCreateKey  (0x2001f, {24, 60, 0x40, 0, 0,  (0x2001f, {24, 60, 0x40, 0, 0, "SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings"}, 0, 0x0, 0, ... 108, 2, ) }, 0, 0x0, 0, ... 108, 2, ) == 0x0
 00853   396   NtOpenSection  (0xe, {24, 8, 0x40, 0, 0,  (0xe, {24, 8, 0x40, 0, 0, "mpr.dll"}, ... 100, ) }, ... 100, ) == 0x0
 00854   396   NtMapViewOfSection  (100, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x71b20000), 0x0, 69632, ) == 0x0
 00855   396   NtClose  (100, ... ) == 0x0
 00856   396   NtCreateSemaphore  (0x1f0003, 0x0, 1, 1, ... 100, ) == 0x0
 00857   396   NtCreateEvent  (0x1f0003, 0x0, 0, 0, ... 112, ) == 0x0
 00858   396   NtOpenKey  (0x20019, {24, 48, 0x40, 0, 0,  (0x20019, {24, 48, 0x40, 0, 0, "system\CurrentControlSet\control\NetworkProvider\HwOrder"}, ... 116, ) }, ... 116, ) == 0x0
 00859   396   NtNotifyChangeKey  (116, 112, 0, 0, 2011390432, 4, 0, 0, 0, 1, ... ) == 0x103
 00860   396   NtQueryInformationProcess  (-1, 28, 4, ... {process info, class 28, size 4}, 0x0, ) == 0x0
 00861   396   NtCreateSemaphore  (0x100003, 0x0, 0, 2147483647, ... 120, ) == 0x0
 00862   396   NtCreateSemaphore  (0x100003, 0x0, 0, 2147483647, ... 124, ) == 0x0
 00863   396   NtOpenSection  (0xe, {24, 8, 0x40, 0, 0,  (0xe, {24, 8, 0x40, 0, 0, "shell32.dll"}, ... 128, ) }, ... 128, ) == 0x0
 00864   396   NtMapViewOfSection  (128, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x773d0000), 0x0, 8339456, ) == 0x0
 00865   396   NtClose  (128, ... ) == 0x0
 00866   396   NtOpenKey  (0x1, {24, 48, 0x40, 0, 0,  (0x1, {24, 48, 0x40, 0, 0, "SYSTEM\Setup"}, ... 128, ) }, ... 128, ) == 0x0
 00867   396   NtQueryValueKey  (128,  (128, "SystemSetupInProgress", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (128, "SystemSetupInProgress", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) }, 16, ) == 0x0
 00868   396   NtClose  (128, ... ) == 0x0
 00869   396   NtQueryDefaultUILanguage  (1240804, ...
 00870   396   NtOpenThreadTokenEx  (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN
 00871   396   NtOpenProcessTokenEx  (-1, 0x20008, 512, ... -2147482020, ) == 0x0
 00872   396   NtQueryInformationToken  (-2147482020, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0
 00873   396   NtClose  (-2147482020, ... ) == 0x0
 00874   396   NtOpenKey  (0x2000000, {24, 0, 0x640, 0, 0,  (0x2000000, {24, 0, 0x640, 0, 0, "\REGISTRY\USER\S-1-5-21-1078081533-484763869-839522115-1003"}, ... -2147482020, ) }, ... -2147482020, ) == 0x0
 00875   396   NtOpenKey  (0x80000000, {24, 0, 0x240, 0, 0,  (0x80000000, {24, 0, 0x240, 0, 0, "\Registry\Machine\System\CurrentControlSet\Control\Nls\MUILanguages"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00876   396   NtOpenKey  (0x80000000, {24, -2147482020, 0x640, 0, 0,  (0x80000000, {24, -2147482020, 0x640, 0, 0, "Control Panel\Desktop"}, ... -2147482032, ) }, ... -2147482032, ) == 0x0
 00877   396   NtQueryValueKey  (-2147482032,  (-2147482032, "MultiUILanguageId", Partial, 256, ... ) , Partial, 256, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00878   396   NtClose  (-2147482032, ... ) == 0x0
 00879   396   NtClose  (-2147482020, ... ) == 0x0
 00869   396   NtQueryDefaultUILanguage  ... ) == 0x0
 00880   396   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\System\CurrentControlSet\Control\Nls\MUILanguages"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00881   396   NtOpenFile  (0x1200a9, {24, 0, 0x40, 0, 0,  (0x1200a9, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\shell32.dll"}, 1, 96, ... 128, {status=0x0, info=1}, ) }, 1, 96, ... 128, {status=0x0, info=1}, ) == 0x0
 00882   396   NtCreateSection  (0x4, 0x0, 0x0, 2, 134217728, 128, ... 132, ) == 0x0
 00883   396   NtMapViewOfSection  (132, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 2, ... (0xa80000), 0x0, 8323072, ) == 0x0
 00884   396   NtOpenFile  (0x1200a9, {24, 0, 0x40, 0, 0,  (0x1200a9, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\shell32.dll.124.Manifest"}, 1, 96, ... ) }, 1, 96, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00885   396   NtQueryDefaultLocale  (1, 1238840, ... ) == 0x0
 00886   396   NtOpenFile  (0x1200a9, {24, 0, 0x40, 0, 0,  (0x1200a9, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\shell32.dll.124.Config"}, 1, 96, ... ) }, 1, 96, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00887   396   NtRequestWaitReplyPort  (24, {128, 156, new_msg, 0, 1239696, 1, 96, 0}  (24, {128, 156, new_msg, 0, 1239696, 1, 96, 0} "\210\6\35\1\33\0\1\0\0\0\0\0\1\355\22\0\1\0\0\0\0\0\11\4\1\1\1\0>\0@\0\250\6\35\1\200\0\0\0\377\377\377\377\0\0\0\0\20\311\337\0\0\0\0\0\236\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0(\0,\0\350\6\35\1\0\0\0\0\0\0\0\0\220\361\22\0\0\0\0\0" ... {128, 156, reply, 0, 316, 396, 1515, 0} "(\350\26\0\33\0\1\0\0\0\0\0\1\355\22\0\1\0\0\0\0\0\11\4\1\1\1\0>\0@\0\250\6\35\1\200\0\0\0\377\377\377\377\0\0\0\0\20\311\337\0\0\0\0\0\236\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0(\0,\0\350\6\35\1\0\0\0\0\0\0\0\0\220\361\22\0\0\0\0\0" )  ... {128, 156, reply, 0, 316, 396, 1515, 0}  (24, {128, 156, new_msg, 0, 1239696, 1, 96, 0} "\210\6\35\1\33\0\1\0\0\0\0\0\1\355\22\0\1\0\0\0\0\0\11\4\1\1\1\0>\0@\0\250\6\35\1\200\0\0\0\377\377\377\377\0\0\0\0\20\311\337\0\0\0\0\0\236\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0(\0,\0\350\6\35\1\0\0\0\0\0\0\0\0\220\361\22\0\0\0\0\0" ... {128, 156, reply, 0, 316, 396, 1515, 0} "(\350\26\0\33\0\1\0\0\0\0\0\1\355\22\0\1\0\0\0\0\0\11\4\1\1\1\0>\0@\0\250\6\35\1\200\0\0\0\377\377\377\377\0\0\0\0\20\311\337\0\0\0\0\0\236\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0(\0,\0\350\6\35\1\0\0\0\0\0\0\0\0\220\361\22\0\0\0\0\0" )  ) == 0x0
 00888   396   NtClose  (128, ... ) == 0x0
 00889   396   NtClose  (132, ... ) == 0x0
 00890   396   NtUnmapViewOfSection  (-1, 0xa80000, ... ) == 0x0
 00891   396   NtUnmapViewOfSection  (-1, 0x12f190, ... ) == STATUS_NOT_MAPPED_VIEW
 00892   396   NtQueryDebugFilterState  (53, 2, ... ) == 0x0
 00893   396   NtOpenKey  (0x8, {24, 0, 0x40, 0, 0,  (0x8, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows\CurrentVersion\SideBySide\AssemblyStorageRoots"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00894   396   NtQueryDebugFilterState  (53, 2, ... ) == 0x0
 00895   396   NtQueryDebugFilterState  (53, 2, ... ) == 0x0
 00896   396   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\u:\work\packed.exe.Local\"}, 1237924, ... ) }, 1237924, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00897   396   NtQueryDebugFilterState  (53, 2, ... ) == 0x0
 00898   396   NtQueryDebugFilterState  (53, 2, ... ) == 0x0
 00899   396   NtQueryDebugFilterState  (53, 2, ... ) == 0x0
 00900   396   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.0.0_x-ww_1382d70a"}, 1238516, ... ) }, 1238516, ... ) == 0x0
 00901   396   NtOpenFile  (0x100020, {24, 0, 0x40, 0, 0,  (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.0.0_x-ww_1382d70a"}, 3, 33, ... 132, {status=0x0, info=1}, ) }, 3, 33, ... 132, {status=0x0, info=1}, ) == 0x0
 00902   396   NtQueryDebugFilterState  (53, 2, ... ) == 0x0
 00903   396   NtOpenSection  (0xe, {24, 8, 0x40, 0, 0,  (0xe, {24, 8, 0x40, 0, 0, "comctl32.dll"}, ... 128, ) }, ... 128, ) == 0x0
 00904   396   NtMapViewOfSection  (128, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x77340000), 0x0, 569344, ) == 0x0
 00905   396   NtClose  (128, ... ) == 0x0
 00906   396   NtOpenProcess  (0x400, {24, 0, 0x0, 0, 0, 0x0}, {316, 0}, ... 128, ) == 0x0
 00907   396   NtQueryInformationProcess  (128, Session, 4, ... {SessionId=0,}, 0x0, ) == 0x0
 00908   396   NtClose  (128, ... ) == 0x0
 00909   396   NtUserRegisterWindowMessage  ( ("ShellGetDragImage", ... ) , ... ) == 0xc03a
 00910   396   NtUserSystemParametersInfo  (104, 0, 2000318720, 0, ... ) == 0x1
 00911   396   NtUserSystemParametersInfo  (38, 4, 2000318708, 0, ... ) == 0x1
 00912   396   NtOpenKey  (0x20019, {24, 60, 0x40, 0, 0,  (0x20019, {24, 60, 0x40, 0, 0, "Control Panel\Desktop"}, ... 128, ) }, ... 128, ) == 0x0
 00913   396   NtQueryValueKey  (128,  (128, "SmoothScroll", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00914   396   NtClose  (128, ... ) == 0x0
 00915   396   NtUserSystemParametersInfo  (41, 500, 1240380, 0, ... ) == 0x1
 00916   396   NtUserSystemParametersInfo  (102, 0, 2000318732, 0, ... ) == 0x1
 00917   396   NtUserGetClassInfo  (1999896576, 1240788, 1240740, 1240816, 0, ... ) == 0x0
 00918   396   NtUserFindExistingCursorIcon  (1240172, 1240188, 1240756, ... ) == 0x10011
 00919   396   NtUserRegisterClassExWOW  (1240624, 1240704, 1240688, 1240720, 0, 384, 0, ... ) == 0x810dc03b
 00920   396   NtUserGetClassInfo  (1999896576, 1240788, 1240740, 1240816, 0, ... ) == 0x0
 00921   396   NtUserRegisterClassExWOW  (1240624, 1240704, 1240688, 1240720, 0, 384, 0, ... ) == 0x810dc03d
 00922   396   NtUserGetClassInfo  (1999896576, 1240788, 1240740, 1240816, 0, ... ) == 0x0
 00923   396   NtUserFindExistingCursorIcon  (1240172, 1240188, 1240756, ... ) == 0x10011
 00924   396   NtUserRegisterClassExWOW  (1240624, 1240704, 1240688, 1240720, 0, 384, 0, ... ) == 0x810dc03f
 00925   396   NtUserGetClassInfo  (1999896576, 1240788, 1240740, 1240816, 0, ... ) == 0x0
 00926   396   NtUserFindExistingCursorIcon  (1240172, 1240188, 1240756, ... ) == 0x10011
 00927   396   NtUserRegisterClassExWOW  (1240624, 1240704, 1240688, 1240720, 0, 384, 0, ... ) == 0x810dc041
 00928   396   NtUserGetClassInfo  (1999896576, 1240788, 1240740, 1240816, 0, ... ) == 0x0
 00929   396   NtUserFindExistingCursorIcon  (1240172, 1240188, 1240756, ... ) == 0x10011
 00930   396   NtUserRegisterClassExWOW  (1240624, 1240704, 1240688, 1240720, 0, 384, 0, ... ) == 0x810dc043
 00931   396   NtUserGetClassInfo  (1999896576, 1240788, 1240740, 1240816, 0, ... ) == 0x0
 00932   396   NtUserRegisterClassExWOW  (1240624, 1240704, 1240688, 1240720, 0, 384, 0, ... ) == 0x810dc045
 00933   396   NtUserGetClassInfo  (1999896576, 1240788, 1240740, 1240816, 0, ... ) == 0x0
 00934   396   NtUserFindExistingCursorIcon  (1240172, 1240188, 1240756, ... ) == 0x10011
 00935   396   NtUserRegisterClassExWOW  (1240624, 1240704, 1240688, 1240720, 0, 384, 0, ... ) == 0x810dc047
 00936   396   NtUserGetClassInfo  (1999896576, 1240788, 1240740, 1240816, 0, ... ) == 0x0
 00937   396   NtUserFindExistingCursorIcon  (1240168, 1240184, 1240752, ... ) == 0x10011
 00938   396   NtUserRegisterClassExWOW  (1240620, 1240700, 1240684, 1240716, 0, 384, 0, ... ) == 0x810dc049
 00939   396   NtUserGetClassInfo  (1999896576, 1240788, 1240740, 1240816, 0, ... ) == 0x0
 00940   396   NtUserFindExistingCursorIcon  (1240172, 1240188, 1240756, ... ) == 0x10011
 00941   396   NtUserRegisterClassExWOW  (1240624, 1240704, 1240688, 1240720, 0, 384, 0, ... ) == 0x810dc04b
 00942   396   NtUserGetClassInfo  (1999896576, 1240788, 1240740, 1240816, 0, ... ) == 0x0
 00943   396   NtUserFindExistingCursorIcon  (1240172, 1240188, 1240756, ... ) == 0x10011
 00944   396   NtUserRegisterClassExWOW  (1240624, 1240704, 1240688, 1240720, 0, 384, 0, ... ) == 0x810dc04d
 00945   396   NtUserGetClassInfo  (1999896576, 1240788, 1240740, 1240816, 0, ... ) == 0x0
 00946   396   NtUserFindExistingCursorIcon  (1240172, 1240188, 1240756, ... ) == 0x10011
 00947   396   NtUserRegisterClassExWOW  (1240624, 1240704, 1240688, 1240720, 0, 384, 0, ... ) == 0x810dc04f
 00948   396   NtUserGetClassInfo  (1999896576, 1240792, 1240744, 1240820, 0, ... ) == 0x0
 00949   396   NtUserRegisterClassExWOW  (1240628, 1240708, 1240692, 1240724, 0, 384, 0, ... ) == 0x810dc051
 00950   396   NtUserGetClassInfo  (1999896576, 1240788, 1240740, 1240816, 0, ... ) == 0x0
 00951   396   NtUserFindExistingCursorIcon  (1240172, 1240188, 1240756, ... ) == 0x10011
 00952   396   NtUserRegisterClassExWOW  (1240624, 1240704, 1240688, 1240720, 0, 384, 0, ... ) == 0x810dc053
 00953   396   NtUserGetClassInfo  (1999896576, 1240788, 1240740, 1240816, 0, ... ) == 0x0
 00954   396   NtUserFindExistingCursorIcon  (1240172, 1240188, 1240756, ... ) == 0x10011
 00955   396   NtUserRegisterClassExWOW  (1240624, 1240704, 1240688, 1240720, 0, 384, 0, ... ) == 0x810dc055
 00956   396   NtUserRegisterClassExWOW  (1240624, 1240704, 1240688, 1240720, 0, 384, 0, ... ) == 0x810dc057
 00957   396   NtUserGetClassInfo  (1999896576, 1240788, 1240740, 1240816, 0, ... ) == 0x0
 00958   396   NtUserFindExistingCursorIcon  (1240172, 1240188, 1240756, ... ) == 0x10011
 00959   396   NtUserRegisterClassExWOW  (1240624, 1240704, 1240688, 1240720, 0, 384, 0, ... ) == 0x810dc059
 00960   396   NtUserGetClassInfo  (1999896576, 1240788, 1240740, 1240816, 0, ... ) == 0x0
 00961   396   NtUserFindExistingCursorIcon  (1240172, 1240188, 1240756, ... ) == 0x10013
 00962   396   NtUserRegisterClassExWOW  (1240624, 1240704, 1240688, 1240720, 0, 384, 0, ... ) == 0x810dc05b
 00963   396   NtUserGetClassInfo  (1999896576, 1240788, 1240740, 1240816, 0, ... ) == 0x0
 00964   396   NtUserFindExistingCursorIcon  (1240172, 1240188, 1240756, ... ) == 0x10011
 00965   396   NtUserRegisterClassExWOW  (1240624, 1240704, 1240688, 1240720, 0, 384, 0, ... ) == 0x810dc05d
 00966   396   NtUserGetClassInfo  (1999896576, 1240788, 1240740, 1240816, 0, ... ) == 0x0
 00967   396   NtUserFindExistingCursorIcon  (1240172, 1240188, 1240756, ... ) == 0x10011
 00968   396   NtUserRegisterClassExWOW  (1240624, 1240704, 1240688, 1240720, 0, 384, 0, ... ) == 0x810dc05f
 00969   396   NtUserGetClassInfo  (1999896576, 1242540, 1242492, 1242568, 0, ... ) == 0xc03b
 00970   396   NtUserGetClassInfo  (1999896576, 1242540, 1242492, 1242568, 0, ... ) == 0xc03d
 00971   396   NtUserGetClassInfo  (1999896576, 1242540, 1242492, 1242568, 0, ... ) == 0xc03f
 00972   396   NtUserGetClassInfo  (1999896576, 1242540, 1242492, 1242568, 0, ... ) == 0xc041
 00973   396   NtUserGetClassInfo  (1999896576, 1242540, 1242492, 1242568, 0, ... ) == 0xc043
 00974   396   NtUserGetClassInfo  (1999896576, 1242540, 1242492, 1242568, 0, ... ) == 0xc045
 00975   396   NtUserGetClassInfo  (1999896576, 1242540, 1242492, 1242568, 0, ... ) == 0xc047
 00976   396   NtUserGetClassInfo  (1999896576, 1242540, 1242492, 1242568, 0, ... ) == 0xc049
 00977   396   NtUserGetClassInfo  (1999896576, 1242540, 1242492, 1242568, 0, ... ) == 0xc04b
 00978   396   NtUserGetClassInfo  (1999896576, 1242540, 1242492, 1242568, 0, ... ) == 0xc04d
 00979   396   NtUserGetClassInfo  (1999896576, 1242540, 1242492, 1242568, 0, ... ) == 0xc04f
 00980   396   NtUserGetClassInfo  (1999896576, 1242544, 1242496, 1242572, 0, ... ) == 0xc051
 00981   396   NtUserGetClassInfo  (1999896576, 1242540, 1242492, 1242568, 0, ... ) == 0xc053
 00982   396   NtUserGetClassInfo  (1999896576, 1242540, 1242492, 1242568, 0, ... ) == 0xc055
 00983   396   NtUserGetClassInfo  (1999896576, 1242540, 1242492, 1242568, 0, ... ) == 0xc059
 00984   396   NtUserGetClassInfo  (1999896576, 1242540, 1242492, 1242568, 0, ... ) == 0xc05b
 00985   396   NtUserGetClassInfo  (1999896576, 1242540, 1242492, 1242568, 0, ... ) == 0xc05d
 00986   396   NtUserGetClassInfo  (1999896576, 1242540, 1242492, 1242568, 0, ... ) == 0xc05f
 00987   396   NtSetInformationProcess  (-1, PriorityClass, {process info, class 18, size 2}, 6816000, ... ) == 0x0
 00988   396   NtCreateMutant  (0x1f0001, {24, 52, 0x80, 0, 0,  (0x1f0001, {24, 52, 0x80, 0, 0, "mtx_cv_cv_v3.0"}, 0, ... 128, ) }, 0, ... 128, ) == 0x0
 00989   396   NtOpenFile  (0x10080, {24, 0, 0x40, 0, 0,  (0x10080, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\System32\cvrss.exe"}, 7, 2113600, ... ) }, 7, 2113600, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00990   396   NtOpenFile  (0x110080, {24, 0, 0x40, 0, 0,  (0x110080, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\System32\cvrss.exe"}, 7, 2113568, ... ) }, 7, 2113568, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00991   396   NtCreateKey  (0xc0000000, {24, 0, 0xc0, 0, 0,  (0xc0000000, {24, 0, 0xc0, 0, 0, "\Registry\Machine\System\CurrentControlSet\Control\Session Manager"}, 0, 0x0, 0, ... 136, 0x0, ) }, 0, 0x0, 0, ... 136, 0x0, ) == 0x0
 00992   396   NtQueryValueKey  (136,  (136, "PendingFileRenameOperations2", Partial, 1024, ... ) , Partial, 1024, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00993   396   NtClose  (136, ... ) == 0x0
 00994   396   NtCreateKey  (0xc0000000, {24, 0, 0xc0, 0, 0,  (0xc0000000, {24, 0, 0xc0, 0, 0, "\Registry\Machine\System\CurrentControlSet\Control\Session Manager"}, 0, 0x0, 0, ... 136, 0x0, ) }, 0, 0x0, 0, ... 136, 0x0, ) == 0x0
 00995   396   NtQueryValueKey  (136,  (136, "PendingFileRenameOperations", Partial, 1024, ... ) , Partial, 1024, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00996   396   NtSetValueKey  (136,  (136, "PendingFileRenameOperations", 0, 7, "\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0c\0v\0r\0s\0s\0.\0e\0x\0e\0\0\0\0\0\0\0", 72, ... , 0, 7,  (136, "PendingFileRenameOperations", 0, 7, "\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0c\0v\0r\0s\0s\0.\0e\0x\0e\0\0\0\0\0\0\0", 72, ... , 72, ...
 00997   396   NtSetInformationFile  (-2147482844, -136575180, 8, EndOfFile, ... {status=0x0, info=0}, ) == 0x0
 00998   396   NtSetInformationFile  (-2147482844, -136575272, 8, EndOfFile, ... {status=0x0, info=0}, ) == 0x0
 00999   396   NtSetInformationFile  (-2147482844, -136575676, 8, EndOfFile, ... {status=0x0, info=0}, ) == 0x0
 00996   396   NtSetValueKey  ... ) == 0x0
 01000   396   NtClose  (136, ... ) == 0x0
 01001   396   NtOpenFile  (0x10080, {24, 0, 0x40, 0, 0,  (0x10080, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\System32\acrmon32.exe"}, 7, 2113600, ... ) }, 7, 2113600, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01002   396   NtOpenFile  (0x110080, {24, 0, 0x40, 0, 0,  (0x110080, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\System32\acrmon32.exe"}, 7, 2113568, ... ) }, 7, 2113568, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01003   396   NtCreateKey  (0xc0000000, {24, 0, 0xc0, 0, 0,  (0xc0000000, {24, 0, 0xc0, 0, 0, "\Registry\Machine\System\CurrentControlSet\Control\Session Manager"}, 0, 0x0, 0, ... 136, 0x0, ) }, 0, 0x0, 0, ... 136, 0x0, ) == 0x0
 01004   396   NtQueryValueKey  (136,  (136, "PendingFileRenameOperations2", Partial, 1024, ... ) , Partial, 1024, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01005   396   NtClose  (136, ... ) == 0x0
 01006   396   NtCreateKey  (0xc0000000, {24, 0, 0xc0, 0, 0,  (0xc0000000, {24, 0, 0xc0, 0, 0, "\Registry\Machine\System\CurrentControlSet\Control\Session Manager"}, 0, 0x0, 0, ... 136, 0x0, ) }, 0, 0x0, 0, ... 136, 0x0, ) == 0x0
 01007   396   NtQueryValueKey  (136,  (136, "PendingFileRenameOperations", Partial, 1024, ... TitleIdx=0, Type=7, Data="\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0c\0v\0r\0s\0s\0.\0e\0x\0e\0\0\0\0\0\0\0"}, 84, ) , Partial, 1024, ... TitleIdx=0, Type=7, Data= (136, "PendingFileRenameOperations", Partial, 1024, ... TitleIdx=0, Type=7, Data="\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0c\0v\0r\0s\0s\0.\0e\0x\0e\0\0\0\0\0\0\0"}, 84, ) }, 84, ) == 0x0
 01008   396   NtSetValueKey  (136,  (136, "PendingFileRenameOperations", 0, 7, "\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0c\0v\0r\0s\0s\0.\0e\0x\0e\0\0\0\0\0\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0a\0c\0r\0m\0o\0n\03\02\0.\0e\0x\0e\0\0\0\0\0\0\0", 148, ... , 0, 7,  (136, "PendingFileRenameOperations", 0, 7, "\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0c\0v\0r\0s\0s\0.\0e\0x\0e\0\0\0\0\0\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0a\0c\0r\0m\0o\0n\03\02\0.\0e\0x\0e\0\0\0\0\0\0\0", 148, ... , 148, ...
 01009   396   NtSetInformationFile  (-2147482844, -136575568, 8, EndOfFile, ... {status=0x0, info=0}, ) == 0x0
 01008   396   NtSetValueKey  ... ) == 0x0
 01010   396   NtClose  (136, ... ) == 0x0
 01011   396   NtOpenFile  (0x10080, {24, 0, 0x40, 0, 0,  (0x10080, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\System32\acroup.exe"}, 7, 2113600, ... ) }, 7, 2113600, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01012   396   NtOpenFile  (0x110080, {24, 0, 0x40, 0, 0,  (0x110080, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\System32\acroup.exe"}, 7, 2113568, ... ) }, 7, 2113568, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01013   396   NtCreateKey  (0xc0000000, {24, 0, 0xc0, 0, 0,  (0xc0000000, {24, 0, 0xc0, 0, 0, "\Registry\Machine\System\CurrentControlSet\Control\Session Manager"}, 0, 0x0, 0, ... 136, 0x0, ) }, 0, 0x0, 0, ... 136, 0x0, ) == 0x0
 01014   396   NtQueryValueKey  (136,  (136, "PendingFileRenameOperations2", Partial, 1024, ... ) , Partial, 1024, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01015   396   NtClose  (136, ... ) == 0x0
 01016   396   NtCreateKey  (0xc0000000, {24, 0, 0xc0, 0, 0,  (0xc0000000, {24, 0, 0xc0, 0, 0, "\Registry\Machine\System\CurrentControlSet\Control\Session Manager"}, 0, 0x0, 0, ... 136, 0x0, ) }, 0, 0x0, 0, ... 136, 0x0, ) == 0x0
 01017   396   NtQueryValueKey  (136,  (136, "PendingFileRenameOperations", Partial, 1024, ... TitleIdx=0, Type=7, Data="\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0c\0v\0r\0s\0s\0.\0e\0x\0e\0\0\0\0\0\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0a\0c\0r\0m\0o\0n\03\02\0.\0e\0x\0e\0\0\0\0\0\0\0"}, 160, ) , Partial, 1024, ... TitleIdx=0, Type=7, Data= (136, "PendingFileRenameOperations", Partial, 1024, ... TitleIdx=0, Type=7, Data="\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0c\0v\0r\0s\0s\0.\0e\0x\0e\0\0\0\0\0\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0a\0c\0r\0m\0o\0n\03\02\0.\0e\0x\0e\0\0\0\0\0\0\0"}, 160, ) }, 160, ) == 0x0
 01018   396   NtSetValueKey  (136,  (136, "PendingFileRenameOperations", 0, 7, "\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0c\0v\0r\0s\0s\0.\0e\0x\0e\0\0\0\0\0\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0a\0c\0r\0m\0o\0n\03\02\0.\0e\0x\0e\0\0\0\0\0\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0a\0c\0r\0o\0u\0p\0.\0e\0x\0e\0\0\0\0\0\0\0", 220, ... , 0, 7,  (136, "PendingFileRenameOperations", 0, 7, "\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0c\0v\0r\0s\0s\0.\0e\0x\0e\0\0\0\0\0\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0a\0c\0r\0m\0o\0n\03\02\0.\0e\0x\0e\0\0\0\0\0\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0a\0c\0r\0o\0u\0p\0.\0e\0x\0e\0\0\0\0\0\0\0", 220, ... , 220, ...
 01019   396   NtSetInformationFile  (-2147482844, -136575568, 8, EndOfFile, ... {status=0x0, info=0}, ) == 0x0
 01018   396   NtSetValueKey  ... ) == 0x0
 01020   396   NtClose  (136, ... ) == 0x0
 01021   396   NtOpenFile  (0x10080, {24, 0, 0x40, 0, 0,  (0x10080, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\System32\acroup32.exe"}, 7, 2113600, ... ) }, 7, 2113600, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01022   396   NtOpenFile  (0x110080, {24, 0, 0x40, 0, 0,  (0x110080, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\System32\acroup32.exe"}, 7, 2113568, ... ) }, 7, 2113568, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01023   396   NtCreateKey  (0xc0000000, {24, 0, 0xc0, 0, 0,  (0xc0000000, {24, 0, 0xc0, 0, 0, "\Registry\Machine\System\CurrentControlSet\Control\Session Manager"}, 0, 0x0, 0, ... 136, 0x0, ) }, 0, 0x0, 0, ... 136, 0x0, ) == 0x0
 01024   396   NtQueryValueKey  (136,  (136, "PendingFileRenameOperations2", Partial, 1024, ... ) , Partial, 1024, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01025   396   NtClose  (136, ... ) == 0x0
 01026   396   NtCreateKey  (0xc0000000, {24, 0, 0xc0, 0, 0,  (0xc0000000, {24, 0, 0xc0, 0, 0, "\Registry\Machine\System\CurrentControlSet\Control\Session Manager"}, 0, 0x0, 0, ... 136, 0x0, ) }, 0, 0x0, 0, ... 136, 0x0, ) == 0x0
 01027   396   NtQueryValueKey  (136,  (136, "PendingFileRenameOperations", Partial, 1024, ... TitleIdx=0, Type=7, Data="\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0c\0v\0r\0s\0s\0.\0e\0x\0e\0\0\0\0\0\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0a\0c\0r\0m\0o\0n\03\02\0.\0e\0x\0e\0\0\0\0\0\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0a\0c\0r\0o\0u\0p\0.\0e\0x\0e\0\0\0\0\0\0\0"}, 232, ) , Partial, 1024, ... TitleIdx=0, Type=7, Data= (136, "PendingFileRenameOperations", Partial, 1024, ... TitleIdx=0, Type=7, Data="\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0c\0v\0r\0s\0s\0.\0e\0x\0e\0\0\0\0\0\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0a\0c\0r\0m\0o\0n\03\02\0.\0e\0x\0e\0\0\0\0\0\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0a\0c\0r\0o\0u\0p\0.\0e\0x\0e\0\0\0\0\0\0\0"}, 232, ) }, 232, ) == 0x0
 01028   396   NtSetValueKey  (136,  (136, "PendingFileRenameOperations", 0, 7, "\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0c\0v\0r\0s\0s\0.\0e\0x\0e\0\0\0\0\0\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0a\0c\0r\0m\0o\0n\03\02\0.\0e\0x\0e\0\0\0\0\0\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0a\0c\0r\0o\0u\0p\0.\0e\0x\0e\0\0\0\0\0\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0a\0c\0r\0o\0u\0p\03\02\0.\0e\0x\0e\0\0\0\0\0\0\0", 296, ... ) , 0, 7,  (136, "PendingFileRenameOperations", 0, 7, "\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0c\0v\0r\0s\0s\0.\0e\0x\0e\0\0\0\0\0\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0a\0c\0r\0m\0o\0n\03\02\0.\0e\0x\0e\0\0\0\0\0\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0a\0c\0r\0o\0u\0p\0.\0e\0x\0e\0\0\0\0\0\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0a\0c\0r\0o\0u\0p\03\02\0.\0e\0x\0e\0\0\0\0\0\0\0", 296, ... ) , 296, ... ) == 0x0
 01029   396   NtClose  (136, ... ) == 0x0
 01030   396   NtOpenFile  (0x10080, {24, 0, 0x40, 0, 0,  (0x10080, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\System32\rasman32.exe"}, 7, 2113600, ... ) }, 7, 2113600, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01031   396   NtOpenFile  (0x110080, {24, 0, 0x40, 0, 0,  (0x110080, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\System32\rasman32.exe"}, 7, 2113568, ... ) }, 7, 2113568, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01032   396   NtCreateKey  (0xc0000000, {24, 0, 0xc0, 0, 0,  (0xc0000000, {24, 0, 0xc0, 0, 0, "\Registry\Machine\System\CurrentControlSet\Control\Session Manager"}, 0, 0x0, 0, ... 136, 0x0, ) }, 0, 0x0, 0, ... 136, 0x0, ) == 0x0
 01033   396   NtQueryValueKey  (136,  (136, "PendingFileRenameOperations2", Partial, 1024, ... ) , Partial, 1024, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01034   396   NtClose  (136, ... ) == 0x0
 01035   396   NtCreateKey  (0xc0000000, {24, 0, 0xc0, 0, 0,  (0xc0000000, {24, 0, 0xc0, 0, 0, "\Registry\Machine\System\CurrentControlSet\Control\Session Manager"}, 0, 0x0, 0, ... 136, 0x0, ) }, 0, 0x0, 0, ... 136, 0x0, ) == 0x0
 01036   396   NtQueryValueKey  (136,  (136, "PendingFileRenameOperations", Partial, 1024, ... TitleIdx=0, Type=7, Data="\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0c\0v\0r\0s\0s\0.\0e\0x\0e\0\0\0\0\0\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0a\0c\0r\0m\0o\0n\03\02\0.\0e\0x\0e\0\0\0\0\0\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0a\0c\0r\0o\0u\0p\0.\0e\0x\0e\0\0\0\0\0\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0a\0c\0r\0o\0u\0p\03\02\0.\0e\0x\0e\0\0\0\0\0\0\0"}, 308, ) , Partial, 1024, ... TitleIdx=0, Type=7, Data= (136, "PendingFileRenameOperations", Partial, 1024, ... TitleIdx=0, Type=7, Data="\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0c\0v\0r\0s\0s\0.\0e\0x\0e\0\0\0\0\0\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0a\0c\0r\0m\0o\0n\03\02\0.\0e\0x\0e\0\0\0\0\0\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0a\0c\0r\0o\0u\0p\0.\0e\0x\0e\0\0\0\0\0\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0a\0c\0r\0o\0u\0p\03\02\0.\0e\0x\0e\0\0\0\0\0\0\0"}, 308, ) }, 308, ) == 0x0
 01037   396   NtSetValueKey  (136,  (136, "PendingFileRenameOperations", 0, 7, "\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0c\0v\0r\0s\0s\0.\0e\0x\0e\0\0\0\0\0\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0a\0c\0r\0m\0o\0n\03\02\0.\0e\0x\0e\0\0\0\0\0\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0a\0c\0r\0o\0u\0p\0.\0e\0x\0e\0\0\0\0\0\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0a\0c\0r\0o\0u\0p\03\02\0.\0e\0x\0e\0\0\0\0\0\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0r\0a\0s\0m\0a\0n\03\02\0.\0e\0x\0e\0\0\0\0\0\0\0", 372, ... ) , 0, 7,  (136, "PendingFileRenameOperations", 0, 7, "\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0c\0v\0r\0s\0s\0.\0e\0x\0e\0\0\0\0\0\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0a\0c\0r\0m\0o\0n\03\02\0.\0e\0x\0e\0\0\0\0\0\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0a\0c\0r\0o\0u\0p\0.\0e\0x\0e\0\0\0\0\0\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0a\0c\0r\0o\0u\0p\03\02\0.\0e\0x\0e\0\0\0\0\0\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0r\0a\0s\0m\0a\0n\03\02\0.\0e\0x\0e\0\0\0\0\0\0\0", 372, ... ) , 372, ... ) == 0x0
 01038   396   NtClose  (136, ... ) == 0x0
 01039   396   NtOpenFile  (0x10080, {24, 0, 0x40, 0, 0,  (0x10080, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\System32\wcescom32.exe"}, 7, 2113600, ... ) }, 7, 2113600, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01040   396   NtOpenFile  (0x110080, {24, 0, 0x40, 0, 0,  (0x110080, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\System32\wcescom32.exe"}, 7, 2113568, ... ) }, 7, 2113568, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01041   396   NtCreateKey  (0xc0000000, {24, 0, 0xc0, 0, 0,  (0xc0000000, {24, 0, 0xc0, 0, 0, "\Registry\Machine\System\CurrentControlSet\Control\Session Manager"}, 0, 0x0, 0, ... 136, 0x0, ) }, 0, 0x0, 0, ... 136, 0x0, ) == 0x0
 01042   396   NtQueryValueKey  (136,  (136, "PendingFileRenameOperations2", Partial, 1024, ... ) , Partial, 1024, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01043   396   NtClose  (136, ... ) == 0x0
 01044   396   NtCreateKey  (0xc0000000, {24, 0, 0xc0, 0, 0,  (0xc0000000, {24, 0, 0xc0, 0, 0, "\Registry\Machine\System\CurrentControlSet\Control\Session Manager"}, 0, 0x0, 0, ... 136, 0x0, ) }, 0, 0x0, 0, ... 136, 0x0, ) == 0x0
 01045   396   NtQueryValueKey  (136,  (136, "PendingFileRenameOperations", Partial, 1024, ... TitleIdx=0, Type=7, Data="\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0c\0v\0r\0s\0s\0.\0e\0x\0e\0\0\0\0\0\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0a\0c\0r\0m\0o\0n\03\02\0.\0e\0x\0e\0\0\0\0\0\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0a\0c\0r\0o\0u\0p\0.\0e\0x\0e\0\0\0\0\0\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0a\0c\0r\0o\0u\0p\03\02\0.\0e\0x\0e\0\0\0\0\0\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0r\0a\0s\0m\0a\0n\03\02\0.\0e\0x\0e\0\0\0\0\0\0\0"}, 384, ) , Partial, 1024, ... TitleIdx=0, Type=7, Data= (136, "PendingFileRenameOperations", Partial, 1024, ... TitleIdx=0, Type=7, Data="\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0c\0v\0r\0s\0s\0.\0e\0x\0e\0\0\0\0\0\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0a\0c\0r\0m\0o\0n\03\02\0.\0e\0x\0e\0\0\0\0\0\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0a\0c\0r\0o\0u\0p\0.\0e\0x\0e\0\0\0\0\0\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0a\0c\0r\0o\0u\0p\03\02\0.\0e\0x\0e\0\0\0\0\0\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0r\0a\0s\0m\0a\0n\03\02\0.\0e\0x\0e\0\0\0\0\0\0\0"}, 384, ) }, 384, ) == 0x0
 01046   396   NtSetValueKey  (136,  (136, "PendingFileRenameOperations", 0, 7, "\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0c\0v\0r\0s\0s\0.\0e\0x\0e\0\0\0\0\0\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0a\0c\0r\0m\0o\0n\03\02\0.\0e\0x\0e\0\0\0\0\0\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0a\0c\0r\0o\0u\0p\0.\0e\0x\0e\0\0\0\0\0\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0a\0c\0r\0o\0u\0p\03\02\0.\0e\0x\0e\0\0\0\0\0\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0r\0a\0s\0m\0a\0n\03\02\0.\0e\0x\0e\0\0\0\0\0\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0w\0c\0e\0s\0c\0o\0m\03\02\0.\0e\0x\0e\0\0\0\0\0\0\0", 450, ... ) , 0, 7,  (136, "PendingFileRenameOperations", 0, 7, "\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0c\0v\0r\0s\0s\0.\0e\0x\0e\0\0\0\0\0\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0a\0c\0r\0m\0o\0n\03\02\0.\0e\0x\0e\0\0\0\0\0\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0a\0c\0r\0o\0u\0p\0.\0e\0x\0e\0\0\0\0\0\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0a\0c\0r\0o\0u\0p\03\02\0.\0e\0x\0e\0\0\0\0\0\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0r\0a\0s\0m\0a\0n\03\02\0.\0e\0x\0e\0\0\0\0\0\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0w\0c\0e\0s\0c\0o\0m\03\02\0.\0e\0x\0e\0\0\0\0\0\0\0", 450, ... ) , 450, ... ) == 0x0
 01047   396   NtClose  (136, ... ) == 0x0
 01048   396   NtOpenFile  (0x10080, {24, 0, 0x40, 0, 0,  (0x10080, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\System32\qmedia.exe"}, 7, 2113600, ... ) }, 7, 2113600, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01049   396   NtOpenFile  (0x110080, {24, 0, 0x40, 0, 0,  (0x110080, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\System32\qmedia.exe"}, 7, 2113568, ... ) }, 7, 2113568, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01050   396   NtCreateKey  (0xc0000000, {24, 0, 0xc0, 0, 0,  (0xc0000000, {24, 0, 0xc0, 0, 0, "\Registry\Machine\System\CurrentControlSet\Control\Session Manager"}, 0, 0x0, 0, ... 136, 0x0, ) }, 0, 0x0, 0, ... 136, 0x0, ) == 0x0
 01051   396   NtQueryValueKey  (136,  (136, "PendingFileRenameOperations2", Partial, 1024, ... ) , Partial, 1024, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01052   396   NtClose  (136, ... ) == 0x0
 01053   396   NtCreateKey  (0xc0000000, {24, 0, 0xc0, 0, 0,  (0xc0000000, {24, 0, 0xc0, 0, 0, "\Registry\Machine\System\CurrentControlSet\Control\Session Manager"}, 0, 0x0, 0, ... 136, 0x0, ) }, 0, 0x0, 0, ... 136, 0x0, ) == 0x0
 01054   396   NtQueryValueKey  (136,  (136, "PendingFileRenameOperations", Partial, 1024, ... TitleIdx=0, Type=7, Data="\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0c\0v\0r\0s\0s\0.\0e\0x\0e\0\0\0\0\0\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0a\0c\0r\0m\0o\0n\03\02\0.\0e\0x\0e\0\0\0\0\0\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0a\0c\0r\0o\0u\0p\0.\0e\0x\0e\0\0\0\0\0\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0a\0c\0r\0o\0u\0p\03\02\0.\0e\0x\0e\0\0\0\0\0\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0r\0a\0s\0m\0a\0n\03\02\0.\0e\0x\0e\0\0\0\0\0\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0w\0c\0e\0s\0c\0o\0m\03\02\0.\0e\0x\0e\0\0\0\0\0\0\0"}, 462, ) , Partial, 1024, ... TitleIdx=0, Type=7, Data= (136, "PendingFileRenameOperations", Partial, 1024, ... TitleIdx=0, Type=7, Data="\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0c\0v\0r\0s\0s\0.\0e\0x\0e\0\0\0\0\0\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0a\0c\0r\0m\0o\0n\03\02\0.\0e\0x\0e\0\0\0\0\0\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0a\0c\0r\0o\0u\0p\0.\0e\0x\0e\0\0\0\0\0\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0a\0c\0r\0o\0u\0p\03\02\0.\0e\0x\0e\0\0\0\0\0\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0r\0a\0s\0m\0a\0n\03\02\0.\0e\0x\0e\0\0\0\0\0\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0w\0c\0e\0s\0c\0o\0m\03\02\0.\0e\0x\0e\0\0\0\0\0\0\0"}, 462, ) }, 462, ) == 0x0
 01055   396   NtSetValueKey  (136,  (136, "PendingFileRenameOperations", 0, 7, "\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0c\0v\0r\0s\0s\0.\0e\0x\0e\0\0\0\0\0\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0a\0c\0r\0m\0o\0n\03\02\0.\0e\0x\0e\0\0\0\0\0\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0a\0c\0r\0o\0u\0p\0.\0e\0x\0e\0\0\0\0\0\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0a\0c\0r\0o\0u\0p\03\02\0.\0e\0x\0e\0\0\0\0\0\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0r\0a\0s\0m\0a\0n\03\02\0.\0e\0x\0e\0\0\0\0\0\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0w\0c\0e\0s\0c\0o\0m\03\02\0.\0e\0x\0e\0\0\0\0\0\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0q\0m\0", 522, ... , 0, 7,  (136, "PendingFileRenameOperations", 0, 7, "\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0c\0v\0r\0s\0s\0.\0e\0x\0e\0\0\0\0\0\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0a\0c\0r\0m\0o\0n\03\02\0.\0e\0x\0e\0\0\0\0\0\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0a\0c\0r\0o\0u\0p\0.\0e\0x\0e\0\0\0\0\0\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0a\0c\0r\0o\0u\0p\03\02\0.\0e\0x\0e\0\0\0\0\0\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0r\0a\0s\0m\0a\0n\03\02\0.\0e\0x\0e\0\0\0\0\0\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0w\0c\0e\0s\0c\0o\0m\03\02\0.\0e\0x\0e\0\0\0\0\0\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0q\0m\0", 522, ... , 522, ...
 01056   396   NtSetInformationFile  (-2147482844, -136575568, 8, EndOfFile, ... {status=0x0, info=0}, ) == 0x0
 01055   396   NtSetValueKey  ... ) == 0x0
 01057   396   NtClose  (136, ... ) == 0x0
 01058   396   NtOpenSection  (0xe, {24, 8, 0x40, 0, 0,  (0xe, {24, 8, 0x40, 0, 0, "Userenv.dll"}, ... 136, ) }, ... 136, ) == 0x0
 01059   396   NtMapViewOfSection  (136, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x75a70000), 0x0, 667648, ) == 0x0
 01060   396   NtClose  (136, ... ) == 0x0
 01061   396   NtAllocateVirtualMemory  (-1, 3293184, 0, 4096, 4096, 4, ... 3293184, 4096, ) == 0x0
 01062   396   NtOpenKey  (0x2000000, {24, 48, 0x40, 0, 0,  (0x2000000, {24, 48, 0x40, 0, 0, "Software\Microsoft\Windows NT\CurrentVersion\winlogon"}, ... 136, ) }, ... 136, ) == 0x0
 01063   396   NtQueryValueKey  (136,  (136, "UserEnvDebugLevel", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01064   396   NtClose  (136, ... ) == 0x0
 01065   396   NtOpenKey  (0x2000000, {24, 48, 0x40, 0, 0,  (0x2000000, {24, 48, 0x40, 0, 0, "Software\Microsoft\Windows NT\CurrentVersion\winlogon"}, ... 136, ) }, ... 136, ) == 0x0
 01066   396   NtQueryValueKey  (136,  (136, "ChkAccDebugLevel", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01067   396   NtClose  (136, ... ) == 0x0
 01068   396   NtOpenKey  (0x20019, {24, 48, 0x40, 0, 0,  (0x20019, {24, 48, 0x40, 0, 0, "System\CurrentControlSet\Control\ProductOptions"}, ... 136, ) }, ... 136, ) == 0x0
 01069   396   NtQueryValueKey  (136,  (136, "ProductType", Partial, 144, ... TitleIdx=0, Type=1, Data="W\0i\0n\0N\0T\0\0\0"}, 24, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (136, "ProductType", Partial, 144, ... TitleIdx=0, Type=1, Data="W\0i\0n\0N\0T\0\0\0"}, 24, ) }, 24, ) == 0x0
 01070   396   NtClose  (136, ... ) == 0x0
 01071   396   NtCreateEvent  (0x1f0003, {24, 52, 0x80, 1241284, 0,  (0x1f0003, {24, 52, 0x80, 1241284, 0, "Global\userenv:  User Profile setup event"}, 0, 1, ... 136, ) }, 0, 1, ... 136, ) == STATUS_OBJECT_NAME_EXISTS
 01072   396   NtQueryDefaultLocale  (1, 1239120, ... ) == 0x0
 01073   396   NtQueryDefaultLocale  (1, 1239120, ... ) == 0x0
 01074   396   NtQueryDefaultLocale  (1, 1239120, ... ) == 0x0
 01075   396   NtQueryDefaultLocale  (1, 1239120, ... ) == 0x0
 01076   396   NtQueryDefaultLocale  (1, 1239120, ... ) == 0x0
 01077   396   NtQueryDefaultLocale  (1, 1239120, ... ) == 0x0
 01078   396   NtQueryDefaultLocale  (1, 1239120, ... ) == 0x0
 01079   396   NtQueryDefaultLocale  (1, 1239120, ... ) == 0x0
 01080   396   NtQueryDefaultLocale  (1, 1239120, ... ) == 0x0
 01081   396   NtQueryDefaultLocale  (1, 1239120, ... ) == 0x0
 01082   396   NtQueryDefaultLocale  (1, 1239120, ... ) == 0x0
 01083   396   NtQueryDefaultLocale  (1, 1239120, ... ) == 0x0
 01084   396   NtQueryDefaultLocale  (1, 1239120, ... ) == 0x0
 01085   396   NtQueryDefaultLocale  (1, 1239120, ... ) == 0x0
 01086   396   NtQueryDefaultLocale  (1, 1239120, ... ) == 0x0
 01087   396   NtQueryDefaultLocale  (1, 1239120, ... ) == 0x0
 01088   396   NtQueryDefaultLocale  (1, 1239120, ... ) == 0x0
 01089   396   NtQueryDefaultLocale  (1, 1239120, ... ) == 0x0
 01090   396   NtQueryDefaultLocale  (1, 1239120, ... ) == 0x0
 01091   396   NtQueryDefaultLocale  (1, 1239120, ... ) == 0x0
 01092   396   NtQueryDefaultLocale  (1, 1239120, ... ) == 0x0
 01093   396   NtQueryDefaultLocale  (1, 1239120, ... ) == 0x0
 01094   396   NtQueryDefaultLocale  (1, 1239120, ... ) == 0x0
 01095   396   NtQueryDefaultLocale  (1, 1239120, ... ) == 0x0
 01096   396   NtQueryDefaultLocale  (1, 1239120, ... ) == 0x0
 01097   396   NtQueryDefaultLocale  (1, 1239120, ... ) == 0x0
 01098   396   NtOpenThreadTokenEx  (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN
 01099   396   NtOpenProcessTokenEx  (-1, 0x20008, 512, ... 140, ) == 0x0
 01100   396   NtQueryInformationToken  (140, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0
 01101   396   NtClose  (140, ... ) == 0x0
 01102   396   NtOpenKey  (0x20019, {24, 0, 0x640, 0, 0,  (0x20019, {24, 0, 0x640, 0, 0, "\REGISTRY\USER\S-1-5-21-1078081533-484763869-839522115-1003"}, ... 140, ) }, ... 140, ) == 0x0
 01103   396   NtOpenKey  (0x20019, {24, 140, 0x40, 0, 0,  (0x20019, {24, 140, 0x40, 0, 0, "Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders"}, ... 144, ) }, ... 144, ) == 0x0
 01104   396   NtQueryValueKey  (144,  (144, "Personal", Partial, 144, ... TitleIdx=0, Type=2, Data="%\0U\0S\0E\0R\0P\0R\0O\0F\0I\0L\0E\0%\0\\0M\0y\0 \0D\0o\0c\0u\0m\0e\0n\0t\0s\0\0\0"}, 66, ) , Partial, 144, ... TitleIdx=0, Type=2, Data= (144, "Personal", Partial, 144, ... TitleIdx=0, Type=2, Data="%\0U\0S\0E\0R\0P\0R\0O\0F\0I\0L\0E\0%\0\\0M\0y\0 \0D\0o\0c\0u\0m\0e\0n\0t\0s\0\0\0"}, 66, ) }, 66, ) == 0x0
 01105   396   NtQueryDefaultLocale  (1, 1239120, ... ) == 0x0
 01106   396   NtQueryValueKey  (144,  (144, "Local Settings", Partial, 144, ... TitleIdx=0, Type=2, Data="%\0U\0S\0E\0R\0P\0R\0O\0F\0I\0L\0E\0%\0\\0L\0o\0c\0a\0l\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\0\0"}, 70, ) , Partial, 144, ... TitleIdx=0, Type=2, Data= (144, "Local Settings", Partial, 144, ... TitleIdx=0, Type=2, Data="%\0U\0S\0E\0R\0P\0R\0O\0F\0I\0L\0E\0%\0\\0L\0o\0c\0a\0l\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\0\0"}, 70, ) }, 70, ) == 0x0
 01107   396   NtQueryDefaultLocale  (1, 1239120, ... ) == 0x0
 01108   396   NtQueryDefaultLocale  (1, 1239120, ... ) == 0x0
 01109   396   NtQueryDefaultLocale  (1, 1239120, ... ) == 0x0
 01110   396   NtQueryDefaultLocale  (1, 1239120, ... ) == 0x0
 01111   396   NtClose  (144, ... ) == 0x0
 01112   396   NtClose  (140, ... ) == 0x0
 01113   396   NtOpenKey  (0x2000000, {24, 48, 0x40, 0, 0,  (0x2000000, {24, 48, 0x40, 0, 0, "Software\Microsoft\Windows NT\CurrentVersion\winlogon"}, ... 140, ) }, ... 140, ) == 0x0
 01114   396   NtQueryValueKey  (140,  (140, "RsopDebugLevel", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01115   396   NtClose  (140, ... ) == 0x0
 01116   396   NtOpenKey  (0x2000000, {24, 48, 0x40, 0, 0,  (0x2000000, {24, 48, 0x40, 0, 0, "Software\Microsoft\Windows NT\CurrentVersion\winlogon"}, ... 140, ) }, ... 140, ) == 0x0
 01117   396   NtQueryValueKey  (140,  (140, "UserEnvDebugLevel", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01118   396   NtQueryValueKey  (140,  (140, "RsopLogging", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01119   396   NtClose  (140, ... ) == 0x0
 01120   396   NtOpenKey  (0x2000000, {24, 48, 0x40, 0, 0,  (0x2000000, {24, 48, 0x40, 0, 0, "Software\Policies\Microsoft\Windows\System"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01121   396   NtOpenKey  (0x2000000, {24, 48, 0x40, 0, 0,  (0x2000000, {24, 48, 0x40, 0, 0, "Software\Microsoft\Windows NT\CurrentVersion\winlogon"}, ... 140, ) }, ... 140, ) == 0x0
 01122   396   NtQueryValueKey  (140,  (140, "UserEnvDebugLevel", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01123   396   NtClose  (140, ... ) == 0x0
 01124   396   NtOpenKey  (0x2000000, {24, 48, 0x40, 0, 0,  (0x2000000, {24, 48, 0x40, 0, 0, "Software\Policies\Microsoft\Windows\System"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01125   396   NtOpenKey  (0x20019, {24, 48, 0x40, 0, 0,  (0x20019, {24, 48, 0x40, 0, 0, "Software\Microsoft\Windows NT\CurrentVersion\ProfileList"}, ... 140, ) }, ... 140, ) == 0x0
 01126   396   NtQueryValueKey  (140,  (140, "ProfilesDirectory", Partial, 144, ... TitleIdx=0, Type=2, Data="%\0S\0y\0s\0t\0e\0m\0D\0r\0i\0v\0e\0%\0\\0D\0o\0c\0u\0m\0e\0n\0t\0s\0 \0a\0n\0d\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\0\0"}, 86, ) , Partial, 144, ... TitleIdx=0, Type=2, Data= (140, "ProfilesDirectory", Partial, 144, ... TitleIdx=0, Type=2, Data="%\0S\0y\0s\0t\0e\0m\0D\0r\0i\0v\0e\0%\0\\0D\0o\0c\0u\0m\0e\0n\0t\0s\0 \0a\0n\0d\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\0\0"}, 86, ) }, 86, ) == 0x0
 01127   396   NtClose  (140, ... ) == 0x0
 01128   396   NtOpenKey  (0x20019, {24, 48, 0x40, 0, 0,  (0x20019, {24, 48, 0x40, 0, 0, "Software\Microsoft\Windows NT\CurrentVersion\ProfileList"}, ... 140, ) }, ... 140, ) == 0x0
 01129   396   NtQueryValueKey  (140,  (140, "AllUsersProfile", Partial, 144, ... TitleIdx=0, Type=1, Data="A\0l\0l\0 \0U\0s\0e\0r\0s\0\0\0"}, 32, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (140, "AllUsersProfile", Partial, 144, ... TitleIdx=0, Type=1, Data="A\0l\0l\0 \0U\0s\0e\0r\0s\0\0\0"}, 32, ) }, 32, ) == 0x0
 01130   396   NtClose  (140, ... ) == 0x0
 01131   396   NtClose  (136, ... ) == 0x0
 01132   396   NtUnmapViewOfSection  (-1, 0x75a70000, ... ) == 0x0
 01133   396   NtOpenFile  (0x10080, {24, 0, 0x40, 0, 0,  (0x10080, {24, 0, 0x40, 0, 0, "\??\C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Task Manager.exe"}, 7, 2113600, ... ) }, 7, 2113600, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01134   396   NtOpenFile  (0x110080, {24, 0, 0x40, 0, 0,  (0x110080, {24, 0, 0x40, 0, 0, "\??\C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Task Manager.exe"}, 7, 2113568, ... ) }, 7, 2113568, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01135   396   NtCreateKey  (0xc0000000, {24, 0, 0xc0, 0, 0,  (0xc0000000, {24, 0, 0xc0, 0, 0, "\Registry\Machine\System\CurrentControlSet\Control\Session Manager"}, 0, 0x0, 0, ... 136, 0x0, ) }, 0, 0x0, 0, ... 136, 0x0, ) == 0x0
 01136   396   NtQueryValueKey  (136,  (136, "PendingFileRenameOperations2", Partial, 1024, ... ) , Partial, 1024, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01137   396   NtClose  (136, ... ) == 0x0
 01138   396   NtCreateKey  (0xc0000000, {24, 0, 0xc0, 0, 0,  (0xc0000000, {24, 0, 0xc0, 0, 0, "\Registry\Machine\System\CurrentControlSet\Control\Session Manager"}, 0, 0x0, 0, ... 136, 0x0, ) }, 0, 0x0, 0, ... 136, 0x0, ) == 0x0
 01139   396   NtQueryValueKey  (136,  (136, "PendingFileRenameOperations", Partial, 1024, ... TitleIdx=0, Type=7, Data="\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0c\0v\0r\0s\0s\0.\0e\0x\0e\0\0\0\0\0\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0a\0c\0r\0m\0o\0n\03\02\0.\0e\0x\0e\0\0\0\0\0\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0a\0c\0r\0o\0u\0p\0.\0e\0x\0e\0\0\0\0\0\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0a\0c\0r\0o\0u\0p\03\02\0.\0e\0x\0e\0\0\0\0\0\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0r\0a\0s\0m\0a\0n\03\02\0.\0e\0x\0e\0\0\0\0\0\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0w\0c\0e\0s\0c\0o\0m\03\02\0.\0e\0x\0e\0\0\0\0\0\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0\0\0\0\0\26\2\0\0t\4\0\0<\1\0\0\214\1\0\0\263\0\0\0\0\0\1\0\0\0\0\0T\2"}, 534, ) , Partial, 1024, ... TitleIdx=0, Type=7, Data= (136, "PendingFileRenameOperations", Partial, 1024, ... TitleIdx=0, Type=7, Data="\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0c\0v\0r\0s\0s\0.\0e\0x\0e\0\0\0\0\0\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0a\0c\0r\0m\0o\0n\03\02\0.\0e\0x\0e\0\0\0\0\0\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0a\0c\0r\0o\0u\0p\0.\0e\0x\0e\0\0\0\0\0\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0a\0c\0r\0o\0u\0p\03\02\0.\0e\0x\0e\0\0\0\0\0\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0r\0a\0s\0m\0a\0n\03\02\0.\0e\0x\0e\0\0\0\0\0\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0w\0c\0e\0s\0c\0o\0m\03\02\0.\0e\0x\0e\0\0\0\0\0\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0\0\0\0\0\26\2\0\0t\4\0\0<\1\0\0\214\1\0\0\263\0\0\0\0\0\1\0\0\0\0\0T\2"}, 534, ) }, 534, ) == 0x0
 01140   396   NtSetValueKey  (136,  (136, "PendingFileRenameOperations", 0, 7, "\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0c\0v\0r\0s\0s\0.\0e\0x\0e\0\0\0\0\0\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0a\0c\0r\0m\0o\0n\03\02\0.\0e\0x\0e\0\0\0\0\0\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0a\0c\0r\0o\0u\0p\0.\0e\0x\0e\0\0\0\0\0\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0a\0c\0r\0o\0u\0p\03\02\0.\0e\0x\0e\0\0\0\0\0\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0r\0a\0s\0m\0a\0n\03\02\0.\0e\0x\0e\0\0\0\0\0\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0w\0c\0e\0s\0c\0o\0m\03\02\0.\0e\0x\0e\0\0\0\0\0\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0q\0m\0", 694, ... , 0, 7,  (136, "PendingFileRenameOperations", 0, 7, "\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0c\0v\0r\0s\0s\0.\0e\0x\0e\0\0\0\0\0\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0a\0c\0r\0m\0o\0n\03\02\0.\0e\0x\0e\0\0\0\0\0\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0a\0c\0r\0o\0u\0p\0.\0e\0x\0e\0\0\0\0\0\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0a\0c\0r\0o\0u\0p\03\02\0.\0e\0x\0e\0\0\0\0\0\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0r\0a\0s\0m\0a\0n\03\02\0.\0e\0x\0e\0\0\0\0\0\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0w\0c\0e\0s\0c\0o\0m\03\02\0.\0e\0x\0e\0\0\0\0\0\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0q\0m\0", 694, ... , 694, ...
 01141   396   NtSetInformationFile  (-2147482844, -136575568, 8, EndOfFile, ... {status=0x0, info=0}, ) == 0x0
 01140   396   NtSetValueKey  ... ) == 0x0
 01142   396   NtClose  (136, ... ) == 0x0
 01143   396   NtOpenFile  (0x10080, {24, 0, 0x40, 0, 0,  (0x10080, {24, 0, 0x40, 0, 0, "\??\C:\Documents and Settings\All Users\Start Menu\Programs\Startup\taskman.exe"}, 7, 2113600, ... ) }, 7, 2113600, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01144   396   NtOpenFile  (0x110080, {24, 0, 0x40, 0, 0,  (0x110080, {24, 0, 0x40, 0, 0, "\??\C:\Documents and Settings\All Users\Start Menu\Programs\Startup\taskman.exe"}, 7, 2113568, ... ) }, 7, 2113568, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01145   396   NtCreateKey  (0xc0000000, {24, 0, 0xc0, 0, 0,  (0xc0000000, {24, 0, 0xc0, 0, 0, "\Registry\Machine\System\CurrentControlSet\Control\Session Manager"}, 0, 0x0, 0, ... 136, 0x0, ) }, 0, 0x0, 0, ... 136, 0x0, ) == 0x0
 01146   396   NtQueryValueKey  (136,  (136, "PendingFileRenameOperations2", Partial, 1024, ... ) , Partial, 1024, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01147   396   NtClose  (136, ... ) == 0x0
 01148   396   NtCreateKey  (0xc0000000, {24, 0, 0xc0, 0, 0,  (0xc0000000, {24, 0, 0xc0, 0, 0, "\Registry\Machine\System\CurrentControlSet\Control\Session Manager"}, 0, 0x0, 0, ... 136, 0x0, ) }, 0, 0x0, 0, ... 136, 0x0, ) == 0x0
 01149   396   NtQueryValueKey  (136,  (136, "PendingFileRenameOperations", Partial, 1024, ... TitleIdx=0, Type=7, Data="\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0c\0v\0r\0s\0s\0.\0e\0x\0e\0\0\0\0\0\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0a\0c\0r\0m\0o\0n\03\02\0.\0e\0x\0e\0\0\0\0\0\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0a\0c\0r\0o\0u\0p\0.\0e\0x\0e\0\0\0\0\0\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0a\0c\0r\0o\0u\0p\03\02\0.\0e\0x\0e\0\0\0\0\0\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0r\0a\0s\0m\0a\0n\03\02\0.\0e\0x\0e\0\0\0\0\0\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0w\0c\0e\0s\0c\0o\0m\03\02\0.\0e\0x\0e\0\0\0\0\0\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0\0\0\0\0\302\2\0\0~\4\0\0<\1\0\0\214\1\0\0\263\0\0\0\0\0\1\0\0\0\0\0T\2\0\0\210\0\0\0\0\0\0\06\08\0\210\13\355w\0\0\0\0P\0e\0n\0d\0i\0n\0g\0F\0i\0l\0e\0R\0e\0n\0a\0m\0e\0O\0p\0e\0r\0a\0t\0i\0o\0n\0s\0v\0\0\0\0\0\7\0\0\0\0\0\0\0\364\1\0\0\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0c\0v\0r\0s\0s\0.\0e\0x\0e\0\0\0\0\0\\0?\0?\0\\0"}, 706, ) , Partial, 1024, ... TitleIdx=0, Type=7, Data= (136, "PendingFileRenameOperations", Partial, 1024, ... TitleIdx=0, Type=7, Data="\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0c\0v\0r\0s\0s\0.\0e\0x\0e\0\0\0\0\0\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0a\0c\0r\0m\0o\0n\03\02\0.\0e\0x\0e\0\0\0\0\0\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0a\0c\0r\0o\0u\0p\0.\0e\0x\0e\0\0\0\0\0\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0a\0c\0r\0o\0u\0p\03\02\0.\0e\0x\0e\0\0\0\0\0\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0r\0a\0s\0m\0a\0n\03\02\0.\0e\0x\0e\0\0\0\0\0\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0w\0c\0e\0s\0c\0o\0m\03\02\0.\0e\0x\0e\0\0\0\0\0\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0\0\0\0\0\302\2\0\0~\4\0\0<\1\0\0\214\1\0\0\263\0\0\0\0\0\1\0\0\0\0\0T\2\0\0\210\0\0\0\0\0\0\06\08\0\210\13\355w\0\0\0\0P\0e\0n\0d\0i\0n\0g\0F\0i\0l\0e\0R\0e\0n\0a\0m\0e\0O\0p\0e\0r\0a\0t\0i\0o\0n\0s\0v\0\0\0\0\0\7\0\0\0\0\0\0\0\364\1\0\0\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0c\0v\0r\0s\0s\0.\0e\0x\0e\0\0\0\0\0\\0?\0?\0\\0"}, 706, ) }, 706, ) == 0x0
 01150   396   NtSetValueKey  (136,  (136, "PendingFileRenameOperations", 0, 7, "\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0c\0v\0r\0s\0s\0.\0e\0x\0e\0\0\0\0\0\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0a\0c\0r\0m\0o\0n\03\02\0.\0e\0x\0e\0\0\0\0\0\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0a\0c\0r\0o\0u\0p\0.\0e\0x\0e\0\0\0\0\0\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0a\0c\0r\0o\0u\0p\03\02\0.\0e\0x\0e\0\0\0\0\0\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0r\0a\0s\0m\0a\0n\03\02\0.\0e\0x\0e\0\0\0\0\0\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0w\0c\0e\0s\0c\0o\0m\03\02\0.\0e\0x\0e\0\0\0\0\0\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0q\0m\0", 856, ... ) , 0, 7,  (136, "PendingFileRenameOperations", 0, 7, "\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0c\0v\0r\0s\0s\0.\0e\0x\0e\0\0\0\0\0\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0a\0c\0r\0m\0o\0n\03\02\0.\0e\0x\0e\0\0\0\0\0\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0a\0c\0r\0o\0u\0p\0.\0e\0x\0e\0\0\0\0\0\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0a\0c\0r\0o\0u\0p\03\02\0.\0e\0x\0e\0\0\0\0\0\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0r\0a\0s\0m\0a\0n\03\02\0.\0e\0x\0e\0\0\0\0\0\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0w\0c\0e\0s\0c\0o\0m\03\02\0.\0e\0x\0e\0\0\0\0\0\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0q\0m\0", 856, ... ) , 856, ... ) == 0x0
 01151   396   NtClose  (136, ... ) == 0x0
 01152   396   NtOpenFile  (0x10080, {24, 0, 0x40, 0, 0,  (0x10080, {24, 0, 0x40, 0, 0, "\??\C:\Documents and Settings\All Users\Start Menu\Programs\Startup\mmedia.exe"}, 7, 2113600, ... ) }, 7, 2113600, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01153   396   NtOpenFile  (0x110080, {24, 0, 0x40, 0, 0,  (0x110080, {24, 0, 0x40, 0, 0, "\??\C:\Documents and Settings\All Users\Start Menu\Programs\Startup\mmedia.exe"}, 7, 2113568, ... ) }, 7, 2113568, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01154   396   NtCreateKey  (0xc0000000, {24, 0, 0xc0, 0, 0,  (0xc0000000, {24, 0, 0xc0, 0, 0, "\Registry\Machine\System\CurrentControlSet\Control\Session Manager"}, 0, 0x0, 0, ... 136, 0x0, ) }, 0, 0x0, 0, ... 136, 0x0, ) == 0x0
 01155   396   NtQueryValueKey  (136,  (136, "PendingFileRenameOperations2", Partial, 1024, ... ) , Partial, 1024, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01156   396   NtClose  (136, ... ) == 0x0
 01157   396   NtCreateKey  (0xc0000000, {24, 0, 0xc0, 0, 0,  (0xc0000000, {24, 0, 0xc0, 0, 0, "\Registry\Machine\System\CurrentControlSet\Control\Session Manager"}, 0, 0x0, 0, ... 136, 0x0, ) }, 0, 0x0, 0, ... 136, 0x0, ) == 0x0
 01158   396   NtQueryValueKey  (136,  (136, "PendingFileRenameOperations", Partial, 1024, ... TitleIdx=0, Type=7, Data="\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0c\0v\0r\0s\0s\0.\0e\0x\0e\0\0\0\0\0\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0a\0c\0r\0m\0o\0n\03\02\0.\0e\0x\0e\0\0\0\0\0\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0a\0c\0r\0o\0u\0p\0.\0e\0x\0e\0\0\0\0\0\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0a\0c\0r\0o\0u\0p\03\02\0.\0e\0x\0e\0\0\0\0\0\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0r\0a\0s\0m\0a\0n\03\02\0.\0e\0x\0e\0\0\0\0\0\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0w\0c\0e\0s\0c\0o\0m\03\02\0.\0e\0x\0e\0\0\0\0\0\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0\0\0\0\0d\3\0\0\207\4\0\0<\1\0\0\214\1\0\0\263\0\0\0\0\0\1\0\0\0\0\0T\2\0\0\210\0\0\0\0\0\0\06\08\0\210\13\355w\0\0\0\0P\0e\0n\0d\0i\0n\0g\0F\0i\0l\0e\0R\0e\0n\0a\0m\0e\0O\0p\0e\0r\0a\0t\0i\0o\0n\0s\0v\0\0\0\0\0\7\0\0\0\0\0\0\0\364\1\0\0\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0c\0v\0r\0s\0s\0.\0e\0x\0e\0\0\0\0\0\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0a\0c\0r\0m\0o\0n\03\02\0.\0e\0x\0e\0\0\0\0\0\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0a\0c\0r\0o\0u\0p\0.\0e\0x\0e\0\0\0\0\0\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0"}, 868, ) , Partial, 1024, ... TitleIdx=0, Type=7, Data= (136, "PendingFileRenameOperations", Partial, 1024, ... TitleIdx=0, Type=7, Data="\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0c\0v\0r\0s\0s\0.\0e\0x\0e\0\0\0\0\0\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0a\0c\0r\0m\0o\0n\03\02\0.\0e\0x\0e\0\0\0\0\0\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0a\0c\0r\0o\0u\0p\0.\0e\0x\0e\0\0\0\0\0\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0a\0c\0r\0o\0u\0p\03\02\0.\0e\0x\0e\0\0\0\0\0\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0r\0a\0s\0m\0a\0n\03\02\0.\0e\0x\0e\0\0\0\0\0\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0w\0c\0e\0s\0c\0o\0m\03\02\0.\0e\0x\0e\0\0\0\0\0\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0\0\0\0\0d\3\0\0\207\4\0\0<\1\0\0\214\1\0\0\263\0\0\0\0\0\1\0\0\0\0\0T\2\0\0\210\0\0\0\0\0\0\06\08\0\210\13\355w\0\0\0\0P\0e\0n\0d\0i\0n\0g\0F\0i\0l\0e\0R\0e\0n\0a\0m\0e\0O\0p\0e\0r\0a\0t\0i\0o\0n\0s\0v\0\0\0\0\0\7\0\0\0\0\0\0\0\364\1\0\0\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0c\0v\0r\0s\0s\0.\0e\0x\0e\0\0\0\0\0\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0a\0c\0r\0m\0o\0n\03\02\0.\0e\0x\0e\0\0\0\0\0\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0a\0c\0r\0o\0u\0p\0.\0e\0x\0e\0\0\0\0\0\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0"}, 868, ) }, 868, ) == 0x0
 01159   396   NtSetValueKey  (136,  (136, "PendingFileRenameOperations", 0, 7, "\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0c\0v\0r\0s\0s\0.\0e\0x\0e\0\0\0\0\0\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0a\0c\0r\0m\0o\0n\03\02\0.\0e\0x\0e\0\0\0\0\0\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0a\0c\0r\0o\0u\0p\0.\0e\0x\0e\0\0\0\0\0\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0a\0c\0r\0o\0u\0p\03\02\0.\0e\0x\0e\0\0\0\0\0\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0r\0a\0s\0m\0a\0n\03\02\0.\0e\0x\0e\0\0\0\0\0\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0w\0c\0e\0s\0c\0o\0m\03\02\0.\0e\0x\0e\0\0\0\0\0\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0q\0m\0", 1016, ... , 0, 7,  (136, "PendingFileRenameOperations", 0, 7, "\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0c\0v\0r\0s\0s\0.\0e\0x\0e\0\0\0\0\0\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0a\0c\0r\0m\0o\0n\03\02\0.\0e\0x\0e\0\0\0\0\0\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0a\0c\0r\0o\0u\0p\0.\0e\0x\0e\0\0\0\0\0\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0a\0c\0r\0o\0u\0p\03\02\0.\0e\0x\0e\0\0\0\0\0\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0r\0a\0s\0m\0a\0n\03\02\0.\0e\0x\0e\0\0\0\0\0\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0w\0c\0e\0s\0c\0o\0m\03\02\0.\0e\0x\0e\0\0\0\0\0\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0q\0m\0", 1016, ... , 1016, ...
 01160   396   NtSetInformationFile  (-2147482844, -136575568, 8, EndOfFile, ... {status=0x0, info=0}, ) == 0x0
 01159   396   NtSetValueKey  ... ) == 0x0
 01161   396   NtClose  (136, ... ) == 0x0
 01162   396   NtOpenFile  (0x10080, {24, 0, 0x40, 0, 0,  (0x10080, {24, 0, 0x40, 0, 0, "\??\C:\Documents and Settings\All Users\Start Menu\Programs\Startup\winamp.exe"}, 7, 2113600, ... ) }, 7, 2113600, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01163   396   NtOpenFile  (0x110080, {24, 0, 0x40, 0, 0,  (0x110080, {24, 0, 0x40, 0, 0, "\??\C:\Documents and Settings\All Users\Start Menu\Programs\Startup\winamp.exe"}, 7, 2113568, ... ) }, 7, 2113568, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01164   396   NtCreateKey  (0xc0000000, {24, 0, 0xc0, 0, 0,  (0xc0000000, {24, 0, 0xc0, 0, 0, "\Registry\Machine\System\CurrentControlSet\Control\Session Manager"}, 0, 0x0, 0, ... 136, 0x0, ) }, 0, 0x0, 0, ... 136, 0x0, ) == 0x0
 01165   396   NtQueryValueKey  (136,  (136, "PendingFileRenameOperations2", Partial, 1024, ... ) , Partial, 1024, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01166   396   NtClose  (136, ... ) == 0x0
 01167   396   NtCreateKey  (0xc0000000, {24, 0, 0xc0, 0, 0,  (0xc0000000, {24, 0, 0xc0, 0, 0, "\Registry\Machine\System\CurrentControlSet\Control\Session Manager"}, 0, 0x0, 0, ... 136, 0x0, ) }, 0, 0x0, 0, ... 136, 0x0, ) == 0x0
 01168   396   NtQueryValueKey  (136,  (136, "PendingFileRenameOperations", Partial, 1024, ... ) , Partial, 1024, ... ) == STATUS_BUFFER_OVERFLOW
 01169   396   NtQueryValueKey  (136,  (136, "PendingFileRenameOperations", Partial, 1028, ... TitleIdx=0, Type=7, Data="\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0c\0v\0r\0s\0s\0.\0e\0x\0e\0\0\0\0\0\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0a\0c\0r\0m\0o\0n\03\02\0.\0e\0x\0e\0\0\0\0\0\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0a\0c\0r\0o\0u\0p\0.\0e\0x\0e\0\0\0\0\0\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0a\0c\0r\0o\0u\0p\03\02\0.\0e\0x\0e\0\0\0\0\0\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0r\0a\0s\0m\0a\0n\03\02\0.\0e\0x\0e\0\0\0\0\0\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0w\0c\0e\0s\0c\0o\0m\03\02\0.\0e\0x\0e\0\0\0\0\0\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0\0\0\0\0\4\4\0\0\222\4\0\0<\1\0\0\214\1\0\0\263\0\0\0\0\0\1\0\0\0\0\0T\2\0\0\210\0\0\0\0\0\0\06\08\0\210\13\355w\0\0\0\0P\0e\0n\0d\0i\0n\0g\0F\0i\0l\0e\0R\0e\0n\0a\0m\0e\0O\0p\0e\0r\0a\0t\0i\0o\0n\0s\0v\0\0\0\0\0\7\0\0\0\0\0\0\0\364\1\0\0\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0c\0v\0r\0s\0s\0.\0e\0x\0e\0\0\0\0\0\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0a\0c\0r\0m\0o\0n\03\02\0.\0e\0x\0e\0\0\0\0\0\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0a\0c\0r\0o\0u\0p\0.\0e\0x\0e\0\0\0\0\0\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0a\0c\0r\0o\0u\0p\03\02\0.\0e\0x\0e\0\0\0\0\0\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0r\0a\0s\0m\0a\0n\03\02\0.\0e\0x\0e\0\0\0\0\0\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0"}, 1028, ) , Partial, 1028, ... TitleIdx=0, Type=7, Data= (136, "PendingFileRenameOperations", Partial, 1028, ... TitleIdx=0, Type=7, Data="\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0c\0v\0r\0s\0s\0.\0e\0x\0e\0\0\0\0\0\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0a\0c\0r\0m\0o\0n\03\02\0.\0e\0x\0e\0\0\0\0\0\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0a\0c\0r\0o\0u\0p\0.\0e\0x\0e\0\0\0\0\0\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0a\0c\0r\0o\0u\0p\03\02\0.\0e\0x\0e\0\0\0\0\0\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0r\0a\0s\0m\0a\0n\03\02\0.\0e\0x\0e\0\0\0\0\0\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0w\0c\0e\0s\0c\0o\0m\03\02\0.\0e\0x\0e\0\0\0\0\0\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0\0\0\0\0\4\4\0\0\222\4\0\0<\1\0\0\214\1\0\0\263\0\0\0\0\0\1\0\0\0\0\0T\2\0\0\210\0\0\0\0\0\0\06\08\0\210\13\355w\0\0\0\0P\0e\0n\0d\0i\0n\0g\0F\0i\0l\0e\0R\0e\0n\0a\0m\0e\0O\0p\0e\0r\0a\0t\0i\0o\0n\0s\0v\0\0\0\0\0\7\0\0\0\0\0\0\0\364\1\0\0\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0c\0v\0r\0s\0s\0.\0e\0x\0e\0\0\0\0\0\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0a\0c\0r\0m\0o\0n\03\02\0.\0e\0x\0e\0\0\0\0\0\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0a\0c\0r\0o\0u\0p\0.\0e\0x\0e\0\0\0\0\0\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0a\0c\0r\0o\0u\0p\03\02\0.\0e\0x\0e\0\0\0\0\0\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0r\0a\0s\0m\0a\0n\03\02\0.\0e\0x\0e\0\0\0\0\0\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0"}, 1028, ) }, 1028, ) == 0x0
 01170   396   NtSetValueKey  (136,  (136, "PendingFileRenameOperations", 0, 7, "\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0c\0v\0r\0s\0s\0.\0e\0x\0e\0\0\0\0\0\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0a\0c\0r\0m\0o\0n\03\02\0.\0e\0x\0e\0\0\0\0\0\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0a\0c\0r\0o\0u\0p\0.\0e\0x\0e\0\0\0\0\0\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0a\0c\0r\0o\0u\0p\03\02\0.\0e\0x\0e\0\0\0\0\0\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0r\0a\0s\0m\0a\0n\03\02\0.\0e\0x\0e\0\0\0\0\0\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0w\0c\0e\0s\0c\0o\0m\03\02\0.\0e\0x\0e\0\0\0\0\0\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0q\0m\0", 1176, ... ) , 0, 7,  (136, "PendingFileRenameOperations", 0, 7, "\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0c\0v\0r\0s\0s\0.\0e\0x\0e\0\0\0\0\0\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0a\0c\0r\0m\0o\0n\03\02\0.\0e\0x\0e\0\0\0\0\0\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0a\0c\0r\0o\0u\0p\0.\0e\0x\0e\0\0\0\0\0\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0a\0c\0r\0o\0u\0p\03\02\0.\0e\0x\0e\0\0\0\0\0\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0r\0a\0s\0m\0a\0n\03\02\0.\0e\0x\0e\0\0\0\0\0\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0w\0c\0e\0s\0c\0o\0m\03\02\0.\0e\0x\0e\0\0\0\0\0\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0q\0m\0", 1176, ... ) , 1176, ... ) == 0x0
 01171   396   NtClose  (136, ... ) == 0x0
 01172   396   NtOpenFile  (0x10080, {24, 0, 0x40, 0, 0,  (0x10080, {24, 0, 0x40, 0, 0, "\??\C:\Documents and Settings\All Users\Start Menu\Programs\Startup\icq.exe"}, 7, 2113600, ... ) }, 7, 2113600, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01173   396   NtOpenFile  (0x110080, {24, 0, 0x40, 0, 0,  (0x110080, {24, 0, 0x40, 0, 0, "\??\C:\Documents and Settings\All Users\Start Menu\Programs\Startup\icq.exe"}, 7, 2113568, ... ) }, 7, 2113568, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01174   396   NtCreateKey  (0xc0000000, {24, 0, 0xc0, 0, 0,  (0xc0000000, {24, 0, 0xc0, 0, 0, "\Registry\Machine\System\CurrentControlSet\Control\Session Manager"}, 0, 0x0, 0, ... 136, 0x0, ) }, 0, 0x0, 0, ... 136, 0x0, ) == 0x0
 01175   396   NtQueryValueKey  (136,  (136, "PendingFileRenameOperations2", Partial, 1024, ... ) , Partial, 1024, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01176   396   NtClose  (136, ... ) == 0x0
 01177   396   NtCreateKey  (0xc0000000, {24, 0, 0xc0, 0, 0,  (0xc0000000, {24, 0, 0xc0, 0, 0, "\Registry\Machine\System\CurrentControlSet\Control\Session Manager"}, 0, 0x0, 0, ... 136, 0x0, ) }, 0, 0x0, 0, ... 136, 0x0, ) == 0x0
 01178   396   NtQueryValueKey  (136,  (136, "PendingFileRenameOperations", Partial, 1024, ... ) , Partial, 1024, ... ) == STATUS_BUFFER_OVERFLOW
 01179   396   NtQueryValueKey  (136,  (136, "PendingFileRenameOperations", Partial, 1188, ... TitleIdx=0, Type=7, Data="\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0c\0v\0r\0s\0s\0.\0e\0x\0e\0\0\0\0\0\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0a\0c\0r\0m\0o\0n\03\02\0.\0e\0x\0e\0\0\0\0\0\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0a\0c\0r\0o\0u\0p\0.\0e\0x\0e\0\0\0\0\0\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0a\0c\0r\0o\0u\0p\03\02\0.\0e\0x\0e\0\0\0\0\0\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0r\0a\0s\0m\0a\0n\03\02\0.\0e\0x\0e\0\0\0\0\0\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0w\0c\0e\0s\0c\0o\0m\03\02\0.\0e\0x\0e\0\0\0\0\0\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0\0\0\0\0\244\4\0\0\234\4\0\0<\1\0\0\214\1\0\0\263\0\0\0\0\0\1\0\0\0\0\0T\2\0\0\210\0\0\0\0\0\0\06\08\0\210\13\355w\0\0\0\0P\0e\0n\0d\0i\0n\0g\0F\0i\0l\0e\0R\0e\0n\0a\0m\0e\0O\0p\0e\0r\0a\0t\0i\0o\0n\0s\0v\0\0\0\0\0\7\0\0\0\0\0\0\0\364\1\0\0\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0c\0v\0r\0s\0s\0.\0e\0x\0e\0\0\0\0\0\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0a\0c\0r\0m\0o\0n\03\02\0.\0e\0x\0e\0\0\0\0\0\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0a\0c\0r\0o\0u\0p\0.\0e\0x\0e\0\0\0\0\0\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0a\0c\0r\0o\0u\0p\03\02\0.\0e\0x\0e\0\0\0\0\0\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0r\0a\0s\0m\0a\0n\03\02\0.\0e\0x\0e\0\0\0\0\0\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0w\0c\0e\0s\0c\0o\0m\03\02\0.\0e\0x\0e\0\0\0\0\0\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0q\0m\02\5\0\0\235\4\0\0<\1\0\0\214\1\0\0\241\0\0\0\0\0\0\0\0\0\0\0\20\0\0\0$\3\0\200\220\6\334\367\10\0\0\0\24\0\0\0\235\4\0\0<\1\0\0\214\1\0\0"}, 1188, ) , Partial, 1188, ... TitleIdx=0, Type=7, Data= (136, "PendingFileRenameOperations", Partial, 1188, ... TitleIdx=0, Type=7, Data="\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0c\0v\0r\0s\0s\0.\0e\0x\0e\0\0\0\0\0\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0a\0c\0r\0m\0o\0n\03\02\0.\0e\0x\0e\0\0\0\0\0\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0a\0c\0r\0o\0u\0p\0.\0e\0x\0e\0\0\0\0\0\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0a\0c\0r\0o\0u\0p\03\02\0.\0e\0x\0e\0\0\0\0\0\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0r\0a\0s\0m\0a\0n\03\02\0.\0e\0x\0e\0\0\0\0\0\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0w\0c\0e\0s\0c\0o\0m\03\02\0.\0e\0x\0e\0\0\0\0\0\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0\0\0\0\0\244\4\0\0\234\4\0\0<\1\0\0\214\1\0\0\263\0\0\0\0\0\1\0\0\0\0\0T\2\0\0\210\0\0\0\0\0\0\06\08\0\210\13\355w\0\0\0\0P\0e\0n\0d\0i\0n\0g\0F\0i\0l\0e\0R\0e\0n\0a\0m\0e\0O\0p\0e\0r\0a\0t\0i\0o\0n\0s\0v\0\0\0\0\0\7\0\0\0\0\0\0\0\364\1\0\0\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0c\0v\0r\0s\0s\0.\0e\0x\0e\0\0\0\0\0\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0a\0c\0r\0m\0o\0n\03\02\0.\0e\0x\0e\0\0\0\0\0\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0a\0c\0r\0o\0u\0p\0.\0e\0x\0e\0\0\0\0\0\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0a\0c\0r\0o\0u\0p\03\02\0.\0e\0x\0e\0\0\0\0\0\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0r\0a\0s\0m\0a\0n\03\02\0.\0e\0x\0e\0\0\0\0\0\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0w\0c\0e\0s\0c\0o\0m\03\02\0.\0e\0x\0e\0\0\0\0\0\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0q\0m\02\5\0\0\235\4\0\0<\1\0\0\214\1\0\0\241\0\0\0\0\0\0\0\0\0\0\0\20\0\0\0$\3\0\200\220\6\334\367\10\0\0\0\24\0\0\0\235\4\0\0<\1\0\0\214\1\0\0"}, 1188, ) }, 1188, ) == 0x0
 01180   396   NtSetValueKey  (136,  (136, "PendingFileRenameOperations", 0, 7, "\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0c\0v\0r\0s\0s\0.\0e\0x\0e\0\0\0\0\0\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0a\0c\0r\0m\0o\0n\03\02\0.\0e\0x\0e\0\0\0\0\0\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0a\0c\0r\0o\0u\0p\0.\0e\0x\0e\0\0\0\0\0\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0a\0c\0r\0o\0u\0p\03\02\0.\0e\0x\0e\0\0\0\0\0\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0r\0a\0s\0m\0a\0n\03\02\0.\0e\0x\0e\0\0\0\0\0\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0w\0c\0e\0s\0c\0o\0m\03\02\0.\0e\0x\0e\0\0\0\0\0\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0q\0m\0", 1330, ... , 0, 7,  (136, "PendingFileRenameOperations", 0, 7, "\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0c\0v\0r\0s\0s\0.\0e\0x\0e\0\0\0\0\0\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0a\0c\0r\0m\0o\0n\03\02\0.\0e\0x\0e\0\0\0\0\0\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0a\0c\0r\0o\0u\0p\0.\0e\0x\0e\0\0\0\0\0\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0a\0c\0r\0o\0u\0p\03\02\0.\0e\0x\0e\0\0\0\0\0\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0r\0a\0s\0m\0a\0n\03\02\0.\0e\0x\0e\0\0\0\0\0\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0w\0c\0e\0s\0c\0o\0m\03\02\0.\0e\0x\0e\0\0\0\0\0\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0q\0m\0", 1330, ... , 1330, ...
 01181   396   NtSetInformationFile  (-2147482844, -136575344, 8, EndOfFile, ... {status=0x0, info=0}, ) == 0x0
 01182   396   NtSetInformationFile  (-2147482848, -136575324, 8, EndOfFile, ... {status=0x0, info=0}, ) == 0x0
 01183   396   NtSetInformationFile  (-2147482844, -136575380, 8, EndOfFile, ... {status=0x0, info=0}, ) == 0x0
 01180   396   NtSetValueKey  ... ) == 0x0
 01184   396   NtClose  (136, ... ) == 0x0
 01185   396   NtCreateKey  (0x2000000, {24, 48, 0x40, 0, 0,  (0x2000000, {24, 48, 0x40, 0, 0, "Software\Microsoft\Windows\CurrentVersion\Run"}, 0, 0x0, 0, ... 136, 2, ) }, 0, 0x0, 0, ... 136, 2, ) == 0x0
 01186   396   NtDeleteValueKey  (136,  (136, "ATI", ... ) , ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01187   396   NtDeleteValueKey  (136,  (136, "Acrobat", ... ) , ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01188   396   NtDeleteValueKey  (136,  (136, "Acrobat Update", ... ) , ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01189   396   NtDeleteValueKey  (136,  (136, "Acrobat Read", ... ) , ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01190   396   NtDeleteValueKey  (136,  (136, "rasman", ... ) , ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01191   396   NtDeleteValueKey  (136,  (136, "ActiveSync", ... ) , ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01192   396   NtDeleteValueKey  (136,  (136, "Winamp Media", ... ) , ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01193   396   NtClose  (136, ... ) == 0x0
 01194   396   NtUserRegisterClassExWOW  (1244368, 1244444, 1244460, 1244432, 0, 258, 0, ... ) == 0x810dc084
 01195   396   NtUserCreateWindowEx  (-2147483648, 1244352, 1244164, "-2147483648, 0, 0, 1, 1, 0, 0, 1245168, 0, 1073742602, 0, ...
 01196   396   NtUserMessageCall  (0x30062, WM_NCCREATE, 0x0, 0x12f730, 0, 670, 1, ... ) == 0x1
 01197   396   NtUserMessageCall  (0x30062, WM_NCCALCSIZE, 0x0, 0x12f764, 0, 670, 1, ... ) == 0x0
 01198   396   NtUserSetProp  (196706, 43288, -1, ... ) == 0x1
 01199   396   NtCreateFile  (0x80100080, {24, 0, 0x40, 0, 1240828,  (0x80100080, {24, 0, 0x40, 0, 1240828, "\??\u:\work\packed.exe"}, 0x0, 0, 1, 1, 2097252, 0, 0, ... 136, {status=0x0, info=1}, ) }, 0x0, 0, 1, 1, 2097252, 0, 0, ... 136, {status=0x0, info=1}, ) == 0x0
 01200   396   NtQueryInformationFile  (136, 1241764, 8, AttributeFlag, ... {status=0x0, info=8}, ) == 0x0
 01201   396   NtQueryInformationFile  (136, 1241736, 24, Standard, ... {status=0x0, info=24}, ) == 0x0
 01202   396   NtQueryInformationFile  (136, 1241688, 40, Basic, ... {status=0x0, info=40}, ) == 0x0
 01203   396   NtAllocateVirtualMemory  (-1, 1380352, 0, 8192, 4096, 4, ... 1380352, 8192, ) == 0x0
 01204   396   NtQueryInformationFile  (136, 1378096, 4094, Stream, ... {status=0x0, info=38}, ) == 0x0
 01205   396   NtQueryInformationFile  (136, 1240232, 40, Basic, ... {status=0x0, info=40}, ) == 0x0
 01206   396   NtQueryInformationFile  (136, 1240076, 4, Ea, ... {status=0x0, info=4}, ) == 0x0
 01207   396   NtCreateFile  (0x40110080, {24, 0, 0x40, 0, 1240084,  (0x40110080, {24, 0, 0x40, 0, 1240084, "\??\C:\WINDOWS\System32\icq6.exe"}, 0x0, 32, 0, 2, 100, 0, 0, ... 140, {status=0x0, info=2}, ) }, 0x0, 32, 0, 2, 100, 0, 0, ... 140, {status=0x0, info=2}, ) == 0x0
 01208   396   NtQueryVolumeInformationFile  (140, 1239456, 536, Attribute, ... {status=0x0, info=22}, ) == 0x0
 01209   396   NtQueryInformationFile  (140, 1239416, 40, Basic, ... {status=0x0, info=40}, ) == 0x0
 01210   396   NtQueryVolumeInformationFile  (136, 1239456, 536, Attribute, ... {status=0x0, info=20}, ) == 0x0
 01211   396   NtQueryVolumeInformationFile  (136, 1239140, 8, Device, ... {status=0x0, info=8}, ) == 0x0
 01212   396   NtSetInformationFile  (140, 1239244, 8, EndOfFile, ... {status=0x0, info=0}, ) == 0x0
 01213   396   NtCreateSection  (0xf001f, 0x0, 0x0, 2, 134217728, 136, ... 144, ) == 0x0
 01214   396   NtMapViewOfSection  (144, -1, (0x0), 0, 0, {0, 0}, 0, 1, 0, 2, ... (0xa80000), {0, 0}, 131072, ) == 0x0
 01215   396   NtClose  (144, ... ) == 0x0
 01216   396   NtWriteFile  (140, 0, 0, 0,  (140, 0, 0, 0, "MZ\220\0\3\0\0\0\4\0\0\0\377\377\0\0\270\0\0\0\0\0\0\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\320\0\0\0\16\37\272\16\0\264\11\315!\270\1L\315!This program cannot be run in DOS mode.\15\15\12$\0\0\0\0\0\0\0\7\373i\37C\232\7LC\232\7LC\232\7L\300\222ZL@\232\7LC\232\6LA\232\7LF\226gLJ\232\7LF\226]LB\232\7LRichC\232\7L\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0PE\0\0L\1\5\0+7\222F\0\0\0\0\0\0\0\0\340\0\17\1\13\1\7\12\0\272\0\0\0\14\0\0\0\0\0\0\0\20\0\0\0\20\0\0\0\320\0\0\0\0@\0\0\20\0\0\0\2\0\0\4\0\0\0\0\0\0\0\4\0\0\0\0\0\0\0\0\320\2\0\0\4\0\0\0\0\0\0\2\0\0\4\0\0\20\0\0\20\0\0\0\0\20\0\0\20\0\0\0\0\0\0\20\0\0\0\0\0\0\0\0\0\0\0P\372\0\0\244\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\334\371\0\0\10\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\20\0\0\0\0\0\0\0\0\0\0\300\0\0\0\20\0\0\0"\0\0\0\4\0\0\0\0\0\0\0\0\0\0\0\0\0\0@\0\0\340\0\0\0\0", 61440, 0x0, 0, ... {status=0x0, info=61440}, ) \0\0\0\4\0\0\0\0\0\0\0\0\0\0\0\0\0\0@\0\0\340\0\0\0\0", 61440, 0x0, 0, ... {status=0x0, info=61440}, ) == 0x0
 01217   396   NtWriteFile  (140, 0, 0, 0,  (140, 0, 0, 0, "\376\247\324\374)\0u?\377S\346\22\244d\260\354L\372\364?\202\200\11\351E\30\2"S=1\333\200\267\350\345\240\310\253\342\0\366a?\303\11\17u\7}]\0ZVU\263 \26K\321:\352\14\201\3263sR\177\7 \353\264\0@\21BrW1MH\370C<\206)\227%&\0\363 \317D\5f\2\205\263,\14\10|\200\311\264\3\326K\37+`\12\0\260\30.\2\310\6\17\200?S\23\300\15\32\20\10 &A\246J?\0\320>H\330@$P\11y\302\206_\2008\22t\16\216\1L\202(1\322\200\307\310\342\367\0\212\2\1A\13\24\206\366\0\340pu\362X<\336:r7v\367x3\0\315{\37\200\370\17GD\0\366\306suR:\12@w\263\346 \17\323T`\24@\\211\310+a\0Dz\201\342\7jX\344?\304\360\34\311\34x`\334\316@\366\35\0\18u\267\20\243\353\311\1{\12\3609\314V\301\354\4\372\0\274\240`\224\206\235\366\336\16\23\203\254?\0\255\211\320\353\315}\200\0\36 \250\1\331\247\16!\0\361\242\360\362\2\317\270\209\254\244\244\6\15\4\331$\32\201\372\234f\373\260\227s\5<\210\304\0%\7\16\245\374b\17\1\204{\352\372\205)/\360\231\4\16\255\69\340 \7\3032@t,\27z\2319\27\1f\22t\23Y\7\331\277IK\200K\351\274[\353\2\20\24465\24\6\200\330*"\355\310\17H3d\2\240\313\\20\275p\13\340\350&\243\7\224\304\37'*\33\240E>\217\251\0Uy\301K\330\363\273\337\0\37\3\322\316\276d[\362$T\304\274\0\262\221\7P\2J\0tl\6\30\200(\353?\07\215\35\12\271\356\377@\343\374\221\350\41\313`t\353\300\351\23,6\350\21\3#0L\322[\227\240\350\260\230\240\250\5", 61440, 0x0, 0, ... {status=0x0, info=61440}, ) S=1\333\200\267\350\345\240\310\253\342\0\366a?\303\11\17u\7}]\0ZVU\263 \26K\321:\352\14\201\3263sR\177\7 \353\264\0@\21BrW1MH\370C<\206)\227%&\0\363 \317D\5f\2\205\263,\14\10|\200\311\264\3\326K\37+`\12\0\260\30.\2\310\6\17\200?S\23\300\15\32\20\10 &A\246J?\0\320>H\330@$P\11y\302\206_\2008\22t\16\216\1L\202(1\322\200\307\310\342\367\0\212\2\1A\13\24\206\366\0\340pu\362X<\336:r7v\367x3\0\315{\37\200\370\17GD\0\366\306suR:\12@w\263\346 \17\323T`\24@\\211\310+a\0Dz\201\342\7jX\344?\304\360\34\311\34x`\334\316@\366\35\0\18u\267\20\243\353\311\1{\12\3609\314V\301\354\4\372\0\274\240`\224\206\235\366\336\16\23\203\254?\0\255\211\320\353\315}\200\0\36 \250\1\331\247\16!\0\361\242\360\362\2\317\270\209\254\244\244\6\15\4\331$\32\201\372\234f\373\260\227s\5<\210\304\0%\7\16\245\374b\17\1\204{\352\372\205)/\360\231\4\16\255\69\340 \7\3032@t,\27z\2319\27\1f\22t\23Y\7\331\277IK\200K\351\274[\353\2\20\24465\24\6\200\330* (140, 0, 0, 0, "\376\247\324\374)\0u?\377S\346\22\244d\260\354L\372\364?\202\200\11\351E\30\2"S=1\333\200\267\350\345\240\310\253\342\0\366a?\303\11\17u\7}]\0ZVU\263 \26K\321:\352\14\201\3263sR\177\7 \353\264\0@\21BrW1MH\370C<\206)\227%&\0\363 \317D\5f\2\205\263,\14\10|\200\311\264\3\326K\37+`\12\0\260\30.\2\310\6\17\200?S\23\300\15\32\20\10 &A\246J?\0\320>H\330@$P\11y\302\206_\2008\22t\16\216\1L\202(1\322\200\307\310\342\367\0\212\2\1A\13\24\206\366\0\340pu\362X<\336:r7v\367x3\0\315{\37\200\370\17GD\0\366\306suR:\12@w\263\346 \17\323T`\24@\\211\310+a\0Dz\201\342\7jX\344?\304\360\34\311\34x`\334\316@\366\35\0\18u\267\20\243\353\311\1{\12\3609\314V\301\354\4\372\0\274\240`\224\206\235\366\336\16\23\203\254?\0\255\211\320\353\315}\200\0\36 \250\1\331\247\16!\0\361\242\360\362\2\317\270\209\254\244\244\6\15\4\331$\32\201\372\234f\373\260\227s\5<\210\304\0%\7\16\245\374b\17\1\204{\352\372\205)/\360\231\4\16\255\69\340 \7\3032@t,\27z\2319\27\1f\22t\23Y\7\331\277IK\200K\351\274[\353\2\20\24465\24\6\200\330*"\355\310\17H3d\2\240\313\\20\275p\13\340\350&\243\7\224\304\37'*\33\240E>\217\251\0Uy\301K\330\363\273\337\0\37\3\322\316\276d[\362$T\304\274\0\262\221\7P\2J\0tl\6\30\200(\353?\07\215\35\12\271\356\377@\343\374\221\350\41\313`t\353\300\351\23,6\350\21\3#0L\322[\227\240\350\260\230\240\250\5", 61440, 0x0, 0, ... {status=0x0, info=61440}, ) , 61440, 0x0, 0, ... {status=0x0, info=61440}, ) == 0x0
 01218   396   NtWriteFile  (140, 0, 0, 0,  (140, 0, 0, 0, "\26y\354\363?3\242\35d\33\37\17\33\317\275\15\221\3633H\342\360,\326\253\3\263\322dk0#\24\17\277-7~1k\322"\211\1\2\334\274Q\250\0CQ\230\216_\344\36\3279\324\231\330&\317\22\310\23\34\371\22\354\6_\363\237\14\315U\232\216\252\323\304\247\260X\323A\266\300\267\7\377\350\230EE\370\20\363K\317\311\335\364>,`\264\317\314\365fLs\247H\276\33\1\367\324,5\277\201\32]\360\202'b_\325\3655\2241\256\356\362\330\362\344\213\230\206f\372}\2\241\336w~\363\247\27\36d\207\3408\32\375Yb\255\207@Oc\24\340\246l\207\201,%k\251\30\15\215\207.\226\353\311\16\232\307\332\274)\220{\257s\332'?a\276\31\350\325r\10<\371a\316\347v\227`\240\212\306R\17\32\300B|\263\39\253\17\300\25\234qq\336\237\252\271\367\36\236\232\341\237\245/T\316\244\15\23\225\12\1\263D\312\212\2531Z\311\206\6\6P\210_7\200\32"\212\246\34\213\3430\347\232N\211\251H\10e\35\262D0\214\317\306\375\236A\2260\214|`\35r\3215~1{A&\233\13d\212\20Lp\274\315\300\2213z,'\23n\277\27xvK2/\245Oo\351\366\251KJu\354\3246 \262\303\351R\255O3\262s\320D/\264\302\15_\310\221\313\327NH\365\226L:\221\263=+_\352\334a\2034\366\320\273\32\261,\3141\370\263R\277\356\220\27\347\340!\357%ma\304\\345\31\227[z\320=\20\226I\274\14\3466\337/*\245^b\350\2\216\31C\26\241\246Y\177V\247\241"\3674\252\202\375 ?\354\232\263\277\2\211\251=\271\3459&\344'S1\353\251\367\211Gd<{K\336y\1\35g\332\25\336nB\367\255\350\276\377\322Q\204*5\252", 6656, 0x0, 0, ... {status=0x0, info=6656}, ) \211\1\2\334\274Q\250\0CQ\230\216_\344\36\3279\324\231\330&\317\22\310\23\34\371\22\354\6_\363\237\14\315U\232\216\252\323\304\247\260X\323A\266\300\267\7\377\350\230EE\370\20\363K\317\311\335\364>,`\264\317\314\365fLs\247H\276\33\1\367\324,5\277\201\32]\360\202'b_\325\3655\2241\256\356\362\330\362\344\213\230\206f\372}\2\241\336w~\363\247\27\36d\207\3408\32\375Yb\255\207@Oc\24\340\246l\207\201,%k\251\30\15\215\207.\226\353\311\16\232\307\332\274)\220{\257s\332'?a\276\31\350\325r\10<\371a\316\347v\227`\240\212\306R\17\32\300B|\263\39\253\17\300\25\234qq\336\237\252\271\367\36\236\232\341\237\245/T\316\244\15\23\225\12\1\263D\312\212\2531Z\311\206\6\6P\210_7\200\32 (140, 0, 0, 0, "\26y\354\363?3\242\35d\33\37\17\33\317\275\15\221\3633H\342\360,\326\253\3\263\322dk0#\24\17\277-7~1k\322"\211\1\2\334\274Q\250\0CQ\230\216_\344\36\3279\324\231\330&\317\22\310\23\34\371\22\354\6_\363\237\14\315U\232\216\252\323\304\247\260X\323A\266\300\267\7\377\350\230EE\370\20\363K\317\311\335\364>,`\264\317\314\365fLs\247H\276\33\1\367\324,5\277\201\32]\360\202'b_\325\3655\2241\256\356\362\330\362\344\213\230\206f\372}\2\241\336w~\363\247\27\36d\207\3408\32\375Yb\255\207@Oc\24\340\246l\207\201,%k\251\30\15\215\207.\226\353\311\16\232\307\332\274)\220{\257s\332'?a\276\31\350\325r\10<\371a\316\347v\227`\240\212\306R\17\32\300B|\263\39\253\17\300\25\234qq\336\237\252\271\367\36\236\232\341\237\245/T\316\244\15\23\225\12\1\263D\312\212\2531Z\311\206\6\6P\210_7\200\32"\212\246\34\213\3430\347\232N\211\251H\10e\35\262D0\214\317\306\375\236A\2260\214|`\35r\3215~1{A&\233\13d\212\20Lp\274\315\300\2213z,'\23n\277\27xvK2/\245Oo\351\366\251KJu\354\3246 \262\303\351R\255O3\262s\320D/\264\302\15_\310\221\313\327NH\365\226L:\221\263=+_\352\334a\2034\366\320\273\32\261,\3141\370\263R\277\356\220\27\347\340!\357%ma\304\\345\31\227[z\320=\20\226I\274\14\3466\337/*\245^b\350\2\216\31C\26\241\246Y\177V\247\241"\3674\252\202\375 ?\354\232\263\277\2\211\251=\271\3459&\344'S1\353\251\367\211Gd<{K\336y\1\35g\332\25\336nB\367\255\350\276\377\322Q\204*5\252", 6656, 0x0, 0, ... {status=0x0, info=6656}, ) \3674\252\202\375 ?\354\232\263\277\2\211\251=\271\3459&\344'S1\353\251\367\211Gd<{K\336y\1\35g\332\25\336nB\367\255\350\276\377\322Q\204*5\252", 6656, 0x0, 0, ... {status=0x0, info=6656}, ) == 0x0
 01219   396   NtUnmapViewOfSection  (-1, 0xa80000, ... ) == 0x0
 01220   396   NtSetInformationFile  (140, 1241688, 40, Basic, ... {status=0x0, info=0}, ) == 0x0
 01221   396   NtClose  (136, ... ) == 0x0
 01222   396   NtClose  (140, ... ) == 0x0
 01223   396   NtOpenSection  (0xe, {24, 8, 0x40, 0, 0,  (0xe, {24, 8, 0x40, 0, 0, "Userenv.dll"}, ... 140, ) }, ... 140, ) == 0x0
 01224   396   NtMapViewOfSection  (140, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x75a70000), 0x0, 667648, ) == 0x0
 01225   396   NtClose  (140, ... ) == 0x0
 01226   396   NtOpenKey  (0x2000000, {24, 48, 0x40, 0, 0,  (0x2000000, {24, 48, 0x40, 0, 0, "Software\Microsoft\Windows NT\CurrentVersion\winlogon"}, ... 140, ) }, ... 140, ) == 0x0
 01227   396   NtQueryValueKey  (140,  (140, "UserEnvDebugLevel", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01228   396   NtClose  (140, ... ) == 0x0
 01229   396   NtOpenKey  (0x2000000, {24, 48, 0x40, 0, 0,  (0x2000000, {24, 48, 0x40, 0, 0, "Software\Microsoft\Windows NT\CurrentVersion\winlogon"}, ... 140, ) }, ... 140, ) == 0x0
 01230   396   NtQueryValueKey  (140,  (140, "ChkAccDebugLevel", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01231   396   NtClose  (140, ... ) == 0x0
 01232   396   NtOpenKey  (0x20019, {24, 48, 0x40, 0, 0,  (0x20019, {24, 48, 0x40, 0, 0, "System\CurrentControlSet\Control\ProductOptions"}, ... 140, ) }, ... 140, ) == 0x0
 01233   396   NtQueryValueKey  (140,  (140, "ProductType", Partial, 144, ... TitleIdx=0, Type=1, Data="W\0i\0n\0N\0T\0\0\0"}, 24, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (140, "ProductType", Partial, 144, ... TitleIdx=0, Type=1, Data="W\0i\0n\0N\0T\0\0\0"}, 24, ) }, 24, ) == 0x0
 01234   396   NtClose  (140, ... ) == 0x0
 01235   396   NtCreateEvent  (0x1f0003, {24, 52, 0x80, 1238788, 0,  (0x1f0003, {24, 52, 0x80, 1238788, 0, "Global\userenv:  User Profile setup event"}, 0, 1, ... 140, ) }, 0, 1, ... 140, ) == STATUS_OBJECT_NAME_EXISTS
 01236   396   NtQueryDefaultLocale  (1, 1236624, ... ) == 0x0
 01237   396   NtQueryDefaultLocale  (1, 1236624, ... ) == 0x0
 01238   396   NtQueryDefaultLocale  (1, 1236624, ... ) == 0x0
 01239   396   NtQueryDefaultLocale  (1, 1236624, ... ) == 0x0
 01240   396   NtQueryDefaultLocale  (1, 1236624, ... ) == 0x0
 01241   396   NtQueryDefaultLocale  (1, 1236624, ... ) == 0x0
 01242   396   NtQueryDefaultLocale  (1, 1236624, ... ) == 0x0
 01243   396   NtQueryDefaultLocale  (1, 1236624, ... ) == 0x0
 01244   396   NtQueryDefaultLocale  (1, 1236624, ... ) == 0x0
 01245   396   NtQueryDefaultLocale  (1, 1236624, ... ) == 0x0
 01246   396   NtQueryDefaultLocale  (1, 1236624, ... ) == 0x0
 01247   396   NtQueryDefaultLocale  (1, 1236624, ... ) == 0x0
 01248   396   NtQueryDefaultLocale  (1, 1236624, ... ) == 0x0
 01249   396   NtQueryDefaultLocale  (1, 1236624, ... ) == 0x0
 01250   396   NtQueryDefaultLocale  (1, 1236624, ... ) == 0x0
 01251   396   NtQueryDefaultLocale  (1, 1236624, ... ) == 0x0
 01252   396   NtQueryDefaultLocale  (1, 1236624, ... ) == 0x0
 01253   396   NtQueryDefaultLocale  (1, 1236624, ... ) == 0x0
 01254   396   NtQueryDefaultLocale  (1, 1236624, ... ) == 0x0
 01255   396   NtQueryDefaultLocale  (1, 1236624, ... ) == 0x0
 01256   396   NtQueryDefaultLocale  (1, 1236624, ... ) == 0x0
 01257   396   NtQueryDefaultLocale  (1, 1236624, ... ) == 0x0
 01258   396   NtQueryDefaultLocale  (1, 1236624, ... ) == 0x0
 01259   396   NtQueryDefaultLocale  (1, 1236624, ... ) == 0x0
 01260   396   NtQueryDefaultLocale  (1, 1236624, ... ) == 0x0
 01261   396   NtQueryDefaultLocale  (1, 1236624, ... ) == 0x0
 01262   396   NtOpenThreadTokenEx  (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN
 01263   396   NtOpenProcessTokenEx  (-1, 0x20008, 512, ... 136, ) == 0x0
 01264   396   NtQueryInformationToken  (136, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0
 01265   396   NtClose  (136, ... ) == 0x0
 01266   396   NtOpenKey  (0x20019, {24, 0, 0x640, 0, 0,  (0x20019, {24, 0, 0x640, 0, 0, "\REGISTRY\USER\S-1-5-21-1078081533-484763869-839522115-1003"}, ... 136, ) }, ... 136, ) == 0x0
 01267   396   NtOpenKey  (0x20019, {24, 136, 0x40, 0, 0,  (0x20019, {24, 136, 0x40, 0, 0, "Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders"}, ... 144, ) }, ... 144, ) == 0x0
 01268   396   NtQueryValueKey  (144,  (144, "Personal", Partial, 144, ... TitleIdx=0, Type=2, Data="%\0U\0S\0E\0R\0P\0R\0O\0F\0I\0L\0E\0%\0\\0M\0y\0 \0D\0o\0c\0u\0m\0e\0n\0t\0s\0\0\0"}, 66, ) , Partial, 144, ... TitleIdx=0, Type=2, Data= (144, "Personal", Partial, 144, ... TitleIdx=0, Type=2, Data="%\0U\0S\0E\0R\0P\0R\0O\0F\0I\0L\0E\0%\0\\0M\0y\0 \0D\0o\0c\0u\0m\0e\0n\0t\0s\0\0\0"}, 66, ) }, 66, ) == 0x0
 01269   396   NtQueryDefaultLocale  (1, 1236624, ... ) == 0x0
 01270   396   NtQueryValueKey  (144,  (144, "Local Settings", Partial, 144, ... TitleIdx=0, Type=2, Data="%\0U\0S\0E\0R\0P\0R\0O\0F\0I\0L\0E\0%\0\\0L\0o\0c\0a\0l\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\0\0"}, 70, ) , Partial, 144, ... TitleIdx=0, Type=2, Data= (144, "Local Settings", Partial, 144, ... TitleIdx=0, Type=2, Data="%\0U\0S\0E\0R\0P\0R\0O\0F\0I\0L\0E\0%\0\\0L\0o\0c\0a\0l\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\0\0"}, 70, ) }, 70, ) == 0x0
 01271   396   NtQueryDefaultLocale  (1, 1236624, ... ) == 0x0
 01272   396   NtQueryDefaultLocale  (1, 1236624, ... ) == 0x0
 01273   396   NtQueryDefaultLocale  (1, 1236624, ... ) == 0x0
 01274   396   NtQueryDefaultLocale  (1, 1236624, ... ) == 0x0
 01275   396   NtClose  (144, ... ) == 0x0
 01276   396   NtClose  (136, ... ) == 0x0
 01277   396   NtOpenKey  (0x2000000, {24, 48, 0x40, 0, 0,  (0x2000000, {24, 48, 0x40, 0, 0, "Software\Microsoft\Windows NT\CurrentVersion\winlogon"}, ... 136, ) }, ... 136, ) == 0x0
 01278   396   NtQueryValueKey  (136,  (136, "RsopDebugLevel", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01279   396   NtClose  (136, ... ) == 0x0
 01280   396   NtOpenKey  (0x2000000, {24, 48, 0x40, 0, 0,  (0x2000000, {24, 48, 0x40, 0, 0, "Software\Microsoft\Windows NT\CurrentVersion\winlogon"}, ... 136, ) }, ... 136, ) == 0x0
 01281   396   NtQueryValueKey  (136,  (136, "UserEnvDebugLevel", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01282   396   NtQueryValueKey  (136,  (136, "RsopLogging", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01283   396   NtClose  (136, ... ) == 0x0
 01284   396   NtOpenKey  (0x2000000, {24, 48, 0x40, 0, 0,  (0x2000000, {24, 48, 0x40, 0, 0, "Software\Policies\Microsoft\Windows\System"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01285   396   NtOpenKey  (0x2000000, {24, 48, 0x40, 0, 0,  (0x2000000, {24, 48, 0x40, 0, 0, "Software\Microsoft\Windows NT\CurrentVersion\winlogon"}, ... 136, ) }, ... 136, ) == 0x0
 01286   396   NtQueryValueKey  (136,  (136, "UserEnvDebugLevel", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01287   396   NtClose  (136, ... ) == 0x0
 01288   396   NtOpenKey  (0x2000000, {24, 48, 0x40, 0, 0,  (0x2000000, {24, 48, 0x40, 0, 0, "Software\Policies\Microsoft\Windows\System"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01289   396   NtOpenKey  (0x20019, {24, 48, 0x40, 0, 0,  (0x20019, {24, 48, 0x40, 0, 0, "Software\Microsoft\Windows NT\CurrentVersion\ProfileList"}, ... 136, ) }, ... 136, ) == 0x0
 01290   396   NtQueryValueKey  (136,  (136, "ProfilesDirectory", Partial, 144, ... TitleIdx=0, Type=2, Data="%\0S\0y\0s\0t\0e\0m\0D\0r\0i\0v\0e\0%\0\\0D\0o\0c\0u\0m\0e\0n\0t\0s\0 \0a\0n\0d\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\0\0"}, 86, ) , Partial, 144, ... TitleIdx=0, Type=2, Data= (136, "ProfilesDirectory", Partial, 144, ... TitleIdx=0, Type=2, Data="%\0S\0y\0s\0t\0e\0m\0D\0r\0i\0v\0e\0%\0\\0D\0o\0c\0u\0m\0e\0n\0t\0s\0 \0a\0n\0d\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\0\0"}, 86, ) }, 86, ) == 0x0
 01291   396   NtClose  (136, ... ) == 0x0
 01292   396   NtOpenKey  (0x20019, {24, 48, 0x40, 0, 0,  (0x20019, {24, 48, 0x40, 0, 0, "Software\Microsoft\Windows NT\CurrentVersion\ProfileList"}, ... 136, ) }, ... 136, ) == 0x0
 01293   396   NtQueryValueKey  (136,  (136, "AllUsersProfile", Partial, 144, ... TitleIdx=0, Type=1, Data="A\0l\0l\0 \0U\0s\0e\0r\0s\0\0\0"}, 32, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (136, "AllUsersProfile", Partial, 144, ... TitleIdx=0, Type=1, Data="A\0l\0l\0 \0U\0s\0e\0r\0s\0\0\0"}, 32, ) }, 32, ) == 0x0
 01294   396   NtClose  (136, ... ) == 0x0
 01295   396   NtClose  (140, ... ) == 0x0
 01296   396   NtUnmapViewOfSection  (-1, 0x75a70000, ... ) == 0x0
 01297   396   NtCreateFile  (0x80100080, {24, 0, 0x40, 0, 1240028,  (0x80100080, {24, 0, 0x40, 0, 1240028, "\??\u:\work\packed.exe"}, 0x0, 0, 1, 1, 2097252, 0, 0, ... 140, {status=0x0, info=1}, ) }, 0x0, 0, 1, 1, 2097252, 0, 0, ... 140, {status=0x0, info=1}, ) == 0x0
 01298   396   NtQueryInformationFile  (140, 1240964, 8, AttributeFlag, ... {status=0x0, info=8}, ) == 0x0
 01299   396   NtQueryInformationFile  (140, 1240936, 24, Standard, ... {status=0x0, info=24}, ) == 0x0
 01300   396   NtQueryInformationFile  (140, 1240888, 40, Basic, ... {status=0x0, info=40}, ) == 0x0
 01301   396   NtQueryInformationFile  (140, 1378408, 4094, Stream, ... {status=0x0, info=38}, ) == 0x0
 01302   396   NtQueryInformationFile  (140, 1239432, 40, Basic, ... {status=0x0, info=40}, ) == 0x0
 01303   396   NtQueryInformationFile  (140, 1239276, 4, Ea, ... {status=0x0, info=4}, ) == 0x0
 01304   396   NtCreateFile  (0x40110080, {24, 0, 0x40, 0, 1239284,  (0x40110080, {24, 0, 0x40, 0, 1239284, "\??\C:\Documents and Settings\All Users\Start Menu\Programs\Startup\icq agent.exe"}, 0x0, 32, 0, 2, 100, 0, 0, ... 136, {status=0x0, info=2}, ) }, 0x0, 32, 0, 2, 100, 0, 0, ... 136, {status=0x0, info=2}, ) == 0x0
 01305   396   NtQueryVolumeInformationFile  (136, 1238656, 536, Attribute, ... {status=0x0, info=22}, ) == 0x0
 01306   396   NtQueryInformationFile  (136, 1238616, 40, Basic, ... {status=0x0, info=40}, ) == 0x0
 01307   396   NtQueryVolumeInformationFile  (140, 1238656, 536, Attribute, ... {status=0x0, info=20}, ) == 0x0
 01308   396   NtQueryVolumeInformationFile  (140, 1238340, 8, Device, ... {status=0x0, info=8}, ) == 0x0
 01309   396   NtSetInformationFile  (136, 1238444, 8, EndOfFile, ... {status=0x0, info=0}, ) == 0x0
 01310   396   NtCreateSection  (0xf001f, 0x0, 0x0, 2, 134217728, 140, ... 144, ) == 0x0
 01311   396   NtMapViewOfSection  (144, -1, (0x0), 0, 0, {0, 0}, 0, 1, 0, 2, ... (0xa80000), {0, 0}, 131072, ) == 0x0
 01312   396   NtClose  (144, ... ) == 0x0
 01313   396   NtWriteFile  (136, 0, 0, 0,  (136, 0, 0, 0, "MZ\220\0\3\0\0\0\4\0\0\0\377\377\0\0\270\0\0\0\0\0\0\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\320\0\0\0\16\37\272\16\0\264\11\315!\270\1L\315!This program cannot be run in DOS mode.\15\15\12$\0\0\0\0\0\0\0\7\373i\37C\232\7LC\232\7LC\232\7L\300\222ZL@\232\7LC\232\6LA\232\7LF\226gLJ\232\7LF\226]LB\232\7LRichC\232\7L\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0PE\0\0L\1\5\0+7\222F\0\0\0\0\0\0\0\0\340\0\17\1\13\1\7\12\0\272\0\0\0\14\0\0\0\0\0\0\0\20\0\0\0\20\0\0\0\320\0\0\0\0@\0\0\20\0\0\0\2\0\0\4\0\0\0\0\0\0\0\4\0\0\0\0\0\0\0\0\320\2\0\0\4\0\0\0\0\0\0\2\0\0\4\0\0\20\0\0\20\0\0\0\0\20\0\0\20\0\0\0\0\0\0\20\0\0\0\0\0\0\0\0\0\0\0P\372\0\0\244\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\334\371\0\0\10\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\20\0\0\0\0\0\0\0\0\0\0\300\0\0\0\20\0\0\0"\0\0\0\4\0\0\0\0\0\0\0\0\0\0\0\0\0\0@\0\0\340\0\0\0\0", 61440, 0x0, 0, ... {status=0x0, info=61440}, ) \0\0\0\4\0\0\0\0\0\0\0\0\0\0\0\0\0\0@\0\0\340\0\0\0\0", 61440, 0x0, 0, ... {status=0x0, info=61440}, ) == 0x0
 01314   396   NtWriteFile  (136, 0, 0, 0,  (136, 0, 0, 0, "\376\247\324\374)\0u?\377S\346\22\244d\260\354L\372\364?\202\200\11\351E\30\2"S=1\333\200\267\350\345\240\310\253\342\0\366a?\303\11\17u\7}]\0ZVU\263 \26K\321:\352\14\201\3263sR\177\7 \353\264\0@\21BrW1MH\370C<\206)\227%&\0\363 \317D\5f\2\205\263,\14\10|\200\311\264\3\326K\37+`\12\0\260\30.\2\310\6\17\200?S\23\300\15\32\20\10 &A\246J?\0\320>H\330@$P\11y\302\206_\2008\22t\16\216\1L\202(1\322\200\307\310\342\367\0\212\2\1A\13\24\206\366\0\340pu\362X<\336:r7v\367x3\0\315{\37\200\370\17GD\0\366\306suR:\12@w\263\346 \17\323T`\24@\\211\310+a\0Dz\201\342\7jX\344?\304\360\34\311\34x`\334\316@\366\35\0\18u\267\20\243\353\311\1{\12\3609\314V\301\354\4\372\0\274\240`\224\206\235\366\336\16\23\203\254?\0\255\211\320\353\315}\200\0\36 \250\1\331\247\16!\0\361\242\360\362\2\317\270\209\254\244\244\6\15\4\331$\32\201\372\234f\373\260\227s\5<\210\304\0%\7\16\245\374b\17\1\204{\352\372\205)/\360\231\4\16\255\69\340 \7\3032@t,\27z\2319\27\1f\22t\23Y\7\331\277IK\200K\351\274[\353\2\20\24465\24\6\200\330*"\355\310\17H3d\2\240\313\\20\275p\13\340\350&\243\7\224\304\37'*\33\240E>\217\251\0Uy\301K\330\363\273\337\0\37\3\322\316\276d[\362$T\304\274\0\262\221\7P\2J\0tl\6\30\200(\353?\07\215\35\12\271\356\377@\343\374\221\350\41\313`t\353\300\351\23,6\350\21\3#0L\322[\227\240\350\260\230\240\250\5", 61440, 0x0, 0, ... {status=0x0, info=61440}, ) S=1\333\200\267\350\345\240\310\253\342\0\366a?\303\11\17u\7}]\0ZVU\263 \26K\321:\352\14\201\3263sR\177\7 \353\264\0@\21BrW1MH\370C<\206)\227%&\0\363 \317D\5f\2\205\263,\14\10|\200\311\264\3\326K\37+`\12\0\260\30.\2\310\6\17\200?S\23\300\15\32\20\10 &A\246J?\0\320>H\330@$P\11y\302\206_\2008\22t\16\216\1L\202(1\322\200\307\310\342\367\0\212\2\1A\13\24\206\366\0\340pu\362X<\336:r7v\367x3\0\315{\37\200\370\17GD\0\366\306suR:\12@w\263\346 \17\323T`\24@\\211\310+a\0Dz\201\342\7jX\344?\304\360\34\311\34x`\334\316@\366\35\0\18u\267\20\243\353\311\1{\12\3609\314V\301\354\4\372\0\274\240`\224\206\235\366\336\16\23\203\254?\0\255\211\320\353\315}\200\0\36 \250\1\331\247\16!\0\361\242\360\362\2\317\270\209\254\244\244\6\15\4\331$\32\201\372\234f\373\260\227s\5<\210\304\0%\7\16\245\374b\17\1\204{\352\372\205)/\360\231\4\16\255\69\340 \7\3032@t,\27z\2319\27\1f\22t\23Y\7\331\277IK\200K\351\274[\353\2\20\24465\24\6\200\330* (136, 0, 0, 0, "\376\247\324\374)\0u?\377S\346\22\244d\260\354L\372\364?\202\200\11\351E\30\2"S=1\333\200\267\350\345\240\310\253\342\0\366a?\303\11\17u\7}]\0ZVU\263 \26K\321:\352\14\201\3263sR\177\7 \353\264\0@\21BrW1MH\370C<\206)\227%&\0\363 \317D\5f\2\205\263,\14\10|\200\311\264\3\326K\37+`\12\0\260\30.\2\310\6\17\200?S\23\300\15\32\20\10 &A\246J?\0\320>H\330@$P\11y\302\206_\2008\22t\16\216\1L\202(1\322\200\307\310\342\367\0\212\2\1A\13\24\206\366\0\340pu\362X<\336:r7v\367x3\0\315{\37\200\370\17GD\0\366\306suR:\12@w\263\346 \17\323T`\24@\\211\310+a\0Dz\201\342\7jX\344?\304\360\34\311\34x`\334\316@\366\35\0\18u\267\20\243\353\311\1{\12\3609\314V\301\354\4\372\0\274\240`\224\206\235\366\336\16\23\203\254?\0\255\211\320\353\315}\200\0\36 \250\1\331\247\16!\0\361\242\360\362\2\317\270\209\254\244\244\6\15\4\331$\32\201\372\234f\373\260\227s\5<\210\304\0%\7\16\245\374b\17\1\204{\352\372\205)/\360\231\4\16\255\69\340 \7\3032@t,\27z\2319\27\1f\22t\23Y\7\331\277IK\200K\351\274[\353\2\20\24465\24\6\200\330*"\355\310\17H3d\2\240\313\\20\275p\13\340\350&\243\7\224\304\37'*\33\240E>\217\251\0Uy\301K\330\363\273\337\0\37\3\322\316\276d[\362$T\304\274\0\262\221\7P\2J\0tl\6\30\200(\353?\07\215\35\12\271\356\377@\343\374\221\350\41\313`t\353\300\351\23,6\350\21\3#0L\322[\227\240\350\260\230\240\250\5", 61440, 0x0, 0, ... {status=0x0, info=61440}, ) , 61440, 0x0, 0, ... {status=0x0, info=61440}, ) == 0x0
 01315   396   NtWriteFile  (136, 0, 0, 0,  (136, 0, 0, 0, "\26y\354\363?3\242\35d\33\37\17\33\317\275\15\221\3633H\342\360,\326\253\3\263\322dk0#\24\17\277-7~1k\322"\211\1\2\334\274Q\250\0CQ\230\216_\344\36\3279\324\231\330&\317\22\310\23\34\371\22\354\6_\363\237\14\315U\232\216\252\323\304\247\260X\323A\266\300\267\7\377\350\230EE\370\20\363K\317\311\335\364>,`\264\317\314\365fLs\247H\276\33\1\367\324,5\277\201\32]\360\202'b_\325\3655\2241\256\356\362\330\362\344\213\230\206f\372}\2\241\336w~\363\247\27\36d\207\3408\32\375Yb\255\207@Oc\24\340\246l\207\201,%k\251\30\15\215\207.\226\353\311\16\232\307\332\274)\220{\257s\332'?a\276\31\350\325r\10<\371a\316\347v\227`\240\212\306R\17\32\300B|\263\39\253\17\300\25\234qq\336\237\252\271\367\36\236\232\341\237\245/T\316\244\15\23\225\12\1\263D\312\212\2531Z\311\206\6\6P\210_7\200\32"\212\246\34\213\3430\347\232N\211\251H\10e\35\262D0\214\317\306\375\236A\2260\214|`\35r\3215~1{A&\233\13d\212\20Lp\274\315\300\2213z,'\23n\277\27xvK2/\245Oo\351\366\251KJu\354\3246 \262\303\351R\255O3\262s\320D/\264\302\15_\310\221\313\327NH\365\226L:\221\263=+_\352\334a\2034\366\320\273\32\261,\3141\370\263R\277\356\220\27\347\340!\357%ma\304\\345\31\227[z\320=\20\226I\274\14\3466\337/*\245^b\350\2\216\31C\26\241\246Y\177V\247\241"\3674\252\202\375 ?\354\232\263\277\2\211\251=\271\3459&\344'S1\353\251\367\211Gd<{K\336y\1\35g\332\25\336nB\367\255\350\276\377\322Q\204*5\252", 6656, 0x0, 0, ... {status=0x0, info=6656}, ) \211\1\2\334\274Q\250\0CQ\230\216_\344\36\3279\324\231\330&\317\22\310\23\34\371\22\354\6_\363\237\14\315U\232\216\252\323\304\247\260X\323A\266\300\267\7\377\350\230EE\370\20\363K\317\311\335\364>,`\264\317\314\365fLs\247H\276\33\1\367\324,5\277\201\32]\360\202'b_\325\3655\2241\256\356\362\330\362\344\213\230\206f\372}\2\241\336w~\363\247\27\36d\207\3408\32\375Yb\255\207@Oc\24\340\246l\207\201,%k\251\30\15\215\207.\226\353\311\16\232\307\332\274)\220{\257s\332'?a\276\31\350\325r\10<\371a\316\347v\227`\240\212\306R\17\32\300B|\263\39\253\17\300\25\234qq\336\237\252\271\367\36\236\232\341\237\245/T\316\244\15\23\225\12\1\263D\312\212\2531Z\311\206\6\6P\210_7\200\32 (136, 0, 0, 0, "\26y\354\363?3\242\35d\33\37\17\33\317\275\15\221\3633H\342\360,\326\253\3\263\322dk0#\24\17\277-7~1k\322"\211\1\2\334\274Q\250\0CQ\230\216_\344\36\3279\324\231\330&\317\22\310\23\34\371\22\354\6_\363\237\14\315U\232\216\252\323\304\247\260X\323A\266\300\267\7\377\350\230EE\370\20\363K\317\311\335\364>,`\264\317\314\365fLs\247H\276\33\1\367\324,5\277\201\32]\360\202'b_\325\3655\2241\256\356\362\330\362\344\213\230\206f\372}\2\241\336w~\363\247\27\36d\207\3408\32\375Yb\255\207@Oc\24\340\246l\207\201,%k\251\30\15\215\207.\226\353\311\16\232\307\332\274)\220{\257s\332'?a\276\31\350\325r\10<\371a\316\347v\227`\240\212\306R\17\32\300B|\263\39\253\17\300\25\234qq\336\237\252\271\367\36\236\232\341\237\245/T\316\244\15\23\225\12\1\263D\312\212\2531Z\311\206\6\6P\210_7\200\32"\212\246\34\213\3430\347\232N\211\251H\10e\35\262D0\214\317\306\375\236A\2260\214|`\35r\3215~1{A&\233\13d\212\20Lp\274\315\300\2213z,'\23n\277\27xvK2/\245Oo\351\366\251KJu\354\3246 \262\303\351R\255O3\262s\320D/\264\302\15_\310\221\313\327NH\365\226L:\221\263=+_\352\334a\2034\366\320\273\32\261,\3141\370\263R\277\356\220\27\347\340!\357%ma\304\\345\31\227[z\320=\20\226I\274\14\3466\337/*\245^b\350\2\216\31C\26\241\246Y\177V\247\241"\3674\252\202\375 ?\354\232\263\277\2\211\251=\271\3459&\344'S1\353\251\367\211Gd<{K\336y\1\35g\332\25\336nB\367\255\350\276\377\322Q\204*5\252", 6656, 0x0, 0, ... {status=0x0, info=6656}, ) \3674\252\202\375 ?\354\232\263\277\2\211\251=\271\3459&\344'S1\353\251\367\211Gd<{K\336y\1\35g\332\25\336nB\367\255\350\276\377\322Q\204*5\252", 6656, 0x0, 0, ... {status=0x0, info=6656}, ) == 0x0
 01316   396   NtUnmapViewOfSection  (-1, 0xa80000, ... ) == 0x0
 01317   396   NtSetInformationFile  (136, 1240888, 40, Basic, ... {status=0x0, info=0}, ) == 0x0
 01318   396   NtClose  (140, ... ) == 0x0
 01319   396   NtClose  (136, ... ) == 0x0
 01320   396   NtCreateKey  (0x2000000, {24, 48, 0x40, 0, 0,  (0x2000000, {24, 48, 0x40, 0, 0, "Software\Microsoft\Windows\CurrentVersion\Run"}, 0, 0x0, 0, ... 136, 2, ) }, 0, 0x0, 0, ... 136, 2, ) == 0x0
 01321   396   NtSetValueKey  (136,  (136, "ICQ Agent", 0, 1, "C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0i\0c\0q\06\0.\0e\0x\0e\0\0\0_\0\365\0w\0\3\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\0\0\0\0\370\0\353\0\375\0\177\0\314\0\4\0\23\0\0\0\0\0\0\0\0\0\0\0\370\0\353\0\375\0\177\0\350\0"\0$\0\0\0\314\0\4\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\0\0\0\0P\0\362\0\22\0\0\0\0\0\360\0\0\0\0\00\0\7\0\25\0\0\0\0\0\340\0\375\0\177\0\0\0\0\0\0\0\0\0\14\0\362\0\22\0\0\0\252\0d\0\365\0w\00\0\362\0\22\0\0\0t\0\362\0\22\0\0\0X\0\362\0\22\0\0\0\10\0\362\0\22\0\0\0\20\0\365\0\22\0\0\0\0\0\0\0\0\0\0\0\\0\362\0\22\0\0\0"\0Y\0\365\0w\0\314\0#\0$\0\0\0\220\0#\0$\0\0\0\324\0\364\0\22\0\0\0\370\0\353\0\375\0\177\0\272\0`\0\365\0w\0\30\0\354\0\375\0\177\0\0\0\340\0\375\0\177\0\0\0\20\0\0\0\0\0\370\0\353\0\375\0\177\0\350\0"\0$\0\0\0\0\0\0\0\0\0\0\0\3\0\0\0\0\0\0\0\2\0\0\0\0\0\0\0\1\0\0\0\0\0\0\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0 \0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\363\0~\0\255\0\350\0\323\0\307\0\1\0\0\0\363\0~\0\255\0\350\0\323\0\307\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0X\0\363\0\22\0\0\0\0\0\0\0", 520, ... , 0, 1,  (136, "ICQ Agent", 0, 1, "C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0i\0c\0q\06\0.\0e\0x\0e\0\0\0_\0\365\0w\0\3\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\0\0\0\0\370\0\353\0\375\0\177\0\314\0\4\0\23\0\0\0\0\0\0\0\0\0\0\0\370\0\353\0\375\0\177\0\350\0"\0$\0\0\0\314\0\4\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\0\0\0\0P\0\362\0\22\0\0\0\0\0\360\0\0\0\0\00\0\7\0\25\0\0\0\0\0\340\0\375\0\177\0\0\0\0\0\0\0\0\0\14\0\362\0\22\0\0\0\252\0d\0\365\0w\00\0\362\0\22\0\0\0t\0\362\0\22\0\0\0X\0\362\0\22\0\0\0\10\0\362\0\22\0\0\0\20\0\365\0\22\0\0\0\0\0\0\0\0\0\0\0\\0\362\0\22\0\0\0"\0Y\0\365\0w\0\314\0#\0$\0\0\0\220\0#\0$\0\0\0\324\0\364\0\22\0\0\0\370\0\353\0\375\0\177\0\272\0`\0\365\0w\0\30\0\354\0\375\0\177\0\0\0\340\0\375\0\177\0\0\0\20\0\0\0\0\0\370\0\353\0\375\0\177\0\350\0"\0$\0\0\0\0\0\0\0\0\0\0\0\3\0\0\0\0\0\0\0\2\0\0\0\0\0\0\0\1\0\0\0\0\0\0\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0 \0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\363\0~\0\255\0\350\0\323\0\307\0\1\0\0\0\363\0~\0\255\0\350\0\323\0\307\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0X\0\363\0\22\0\0\0\0\0\0\0", 520, ... \0$\0\0\0\314\0\4\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\0\0\0\0P\0\362\0\22\0\0\0\0\0\360\0\0\0\0\00\0\7\0\25\0\0\0\0\0\340\0\375\0\177\0\0\0\0\0\0\0\0\0\14\0\362\0\22\0\0\0\252\0d\0\365\0w\00\0\362\0\22\0\0\0t\0\362\0\22\0\0\0X\0\362\0\22\0\0\0\10\0\362\0\22\0\0\0\20\0\365\0\22\0\0\0\0\0\0\0\0\0\0\0\\0\362\0\22\0\0\0 (136, "ICQ Agent", 0, 1, "C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0i\0c\0q\06\0.\0e\0x\0e\0\0\0_\0\365\0w\0\3\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\0\0\0\0\370\0\353\0\375\0\177\0\314\0\4\0\23\0\0\0\0\0\0\0\0\0\0\0\370\0\353\0\375\0\177\0\350\0"\0$\0\0\0\314\0\4\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\0\0\0\0P\0\362\0\22\0\0\0\0\0\360\0\0\0\0\00\0\7\0\25\0\0\0\0\0\340\0\375\0\177\0\0\0\0\0\0\0\0\0\14\0\362\0\22\0\0\0\252\0d\0\365\0w\00\0\362\0\22\0\0\0t\0\362\0\22\0\0\0X\0\362\0\22\0\0\0\10\0\362\0\22\0\0\0\20\0\365\0\22\0\0\0\0\0\0\0\0\0\0\0\\0\362\0\22\0\0\0"\0Y\0\365\0w\0\314\0#\0$\0\0\0\220\0#\0$\0\0\0\324\0\364\0\22\0\0\0\370\0\353\0\375\0\177\0\272\0`\0\365\0w\0\30\0\354\0\375\0\177\0\0\0\340\0\375\0\177\0\0\0\20\0\0\0\0\0\370\0\353\0\375\0\177\0\350\0"\0$\0\0\0\0\0\0\0\0\0\0\0\3\0\0\0\0\0\0\0\2\0\0\0\0\0\0\0\1\0\0\0\0\0\0\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0 \0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\363\0~\0\255\0\350\0\323\0\307\0\1\0\0\0\363\0~\0\255\0\350\0\323\0\307\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0X\0\363\0\22\0\0\0\0\0\0\0", 520, ... \0$\0\0\0\0\0\0\0\0\0\0\0\3\0\0\0\0\0\0\0\2\0\0\0\0\0\0\0\1\0\0\0\0\0\0\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0 \0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\363\0~\0\255\0\350\0\323\0\307\0\1\0\0\0\363\0~\0\255\0\350\0\323\0\307\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0X\0\363\0\22\0\0\0\0\0\0\0", 520, ...
 01322   396   NtSetInformationFile  (-2147482808, -136578620, 8, EndOfFile, ... {status=0x0, info=0}, ) == 0x0
 01323   396   NtSetInformationFile  (-2147482808, -136578712, 8, EndOfFile, ... {status=0x0, info=0}, ) == 0x0
 01321   396   NtSetValueKey  ... ) == 0x0
 01324   396   NtClose  (136, ... ) == 0x0
 01325   396   NtCreateKey  (0x2000000, {24, 60, 0x40, 0, 0,  (0x2000000, {24, 60, 0x40, 0, 0, "Software\Microsoft\Windows\CurrentVersion\Run"}, 0, 0x0, 0, ... 136, 2, ) }, 0, 0x0, 0, ... 136, 2, ) == 0x0
 01326   396   NtSetValueKey  (136,  (136, "ICQ Agent", 0, 1, "C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0i\0c\0q\06\0.\0e\0x\0e\0\0\0_\0\365\0w\0\3\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\0\0\0\0\370\0\353\0\375\0\177\0\314\0\4\0\23\0\0\0\0\0\0\0\0\0\0\0\370\0\353\0\375\0\177\0\350\0"\0$\0\0\0\314\0\4\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\0\0\0\0P\0\362\0\22\0\0\0\0\0\360\0\0\0\0\00\0\7\0\25\0\0\0\0\0\340\0\375\0\177\0\0\0\0\0\0\0\0\0\14\0\362\0\22\0\0\0\252\0d\0\365\0w\00\0\362\0\22\0\0\0t\0\362\0\22\0\0\0X\0\362\0\22\0\0\0\10\0\362\0\22\0\0\0\20\0\365\0\22\0\0\0\0\0\0\0\0\0\0\0\\0\362\0\22\0\0\0"\0Y\0\365\0w\0\314\0#\0$\0\0\0\220\0#\0$\0\0\0\324\0\364\0\22\0\0\0\370\0\353\0\375\0\177\0\272\0`\0\365\0w\0\30\0\354\0\375\0\177\0\0\0\340\0\375\0\177\0\0\0\20\0\0\0\0\0\370\0\353\0\375\0\177\0\350\0"\0$\0\0\0\0\0\0\0\0\0\0\0\3\0\0\0\0\0\0\0\2\0\0\0\0\0\0\0\1\0\0\0\0\0\0\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0 \0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\363\0~\0\255\0\350\0\323\0\307\0\1\0\0\0\363\0~\0\255\0\350\0\323\0\307\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0X\0\363\0\22\0\0\0\0\0\0\0", 520, ... , 0, 1,  (136, "ICQ Agent", 0, 1, "C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0i\0c\0q\06\0.\0e\0x\0e\0\0\0_\0\365\0w\0\3\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\0\0\0\0\370\0\353\0\375\0\177\0\314\0\4\0\23\0\0\0\0\0\0\0\0\0\0\0\370\0\353\0\375\0\177\0\350\0"\0$\0\0\0\314\0\4\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\0\0\0\0P\0\362\0\22\0\0\0\0\0\360\0\0\0\0\00\0\7\0\25\0\0\0\0\0\340\0\375\0\177\0\0\0\0\0\0\0\0\0\14\0\362\0\22\0\0\0\252\0d\0\365\0w\00\0\362\0\22\0\0\0t\0\362\0\22\0\0\0X\0\362\0\22\0\0\0\10\0\362\0\22\0\0\0\20\0\365\0\22\0\0\0\0\0\0\0\0\0\0\0\\0\362\0\22\0\0\0"\0Y\0\365\0w\0\314\0#\0$\0\0\0\220\0#\0$\0\0\0\324\0\364\0\22\0\0\0\370\0\353\0\375\0\177\0\272\0`\0\365\0w\0\30\0\354\0\375\0\177\0\0\0\340\0\375\0\177\0\0\0\20\0\0\0\0\0\370\0\353\0\375\0\177\0\350\0"\0$\0\0\0\0\0\0\0\0\0\0\0\3\0\0\0\0\0\0\0\2\0\0\0\0\0\0\0\1\0\0\0\0\0\0\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0 \0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\363\0~\0\255\0\350\0\323\0\307\0\1\0\0\0\363\0~\0\255\0\350\0\323\0\307\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0X\0\363\0\22\0\0\0\0\0\0\0", 520, ... \0$\0\0\0\314\0\4\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\0\0\0\0P\0\362\0\22\0\0\0\0\0\360\0\0\0\0\00\0\7\0\25\0\0\0\0\0\340\0\375\0\177\0\0\0\0\0\0\0\0\0\14\0\362\0\22\0\0\0\252\0d\0\365\0w\00\0\362\0\22\0\0\0t\0\362\0\22\0\0\0X\0\362\0\22\0\0\0\10\0\362\0\22\0\0\0\20\0\365\0\22\0\0\0\0\0\0\0\0\0\0\0\\0\362\0\22\0\0\0 (136, "ICQ Agent", 0, 1, "C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0i\0c\0q\06\0.\0e\0x\0e\0\0\0_\0\365\0w\0\3\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\0\0\0\0\370\0\353\0\375\0\177\0\314\0\4\0\23\0\0\0\0\0\0\0\0\0\0\0\370\0\353\0\375\0\177\0\350\0"\0$\0\0\0\314\0\4\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\0\0\0\0P\0\362\0\22\0\0\0\0\0\360\0\0\0\0\00\0\7\0\25\0\0\0\0\0\340\0\375\0\177\0\0\0\0\0\0\0\0\0\14\0\362\0\22\0\0\0\252\0d\0\365\0w\00\0\362\0\22\0\0\0t\0\362\0\22\0\0\0X\0\362\0\22\0\0\0\10\0\362\0\22\0\0\0\20\0\365\0\22\0\0\0\0\0\0\0\0\0\0\0\\0\362\0\22\0\0\0"\0Y\0\365\0w\0\314\0#\0$\0\0\0\220\0#\0$\0\0\0\324\0\364\0\22\0\0\0\370\0\353\0\375\0\177\0\272\0`\0\365\0w\0\30\0\354\0\375\0\177\0\0\0\340\0\375\0\177\0\0\0\20\0\0\0\0\0\370\0\353\0\375\0\177\0\350\0"\0$\0\0\0\0\0\0\0\0\0\0\0\3\0\0\0\0\0\0\0\2\0\0\0\0\0\0\0\1\0\0\0\0\0\0\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0 \0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\363\0~\0\255\0\350\0\323\0\307\0\1\0\0\0\363\0~\0\255\0\350\0\323\0\307\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0X\0\363\0\22\0\0\0\0\0\0\0", 520, ... \0$\0\0\0\0\0\0\0\0\0\0\0\3\0\0\0\0\0\0\0\2\0\0\0\0\0\0\0\1\0\0\0\0\0\0\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0 \0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\363\0~\0\255\0\350\0\323\0\307\0\1\0\0\0\363\0~\0\255\0\350\0\323\0\307\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0X\0\363\0\22\0\0\0\0\0\0\0", 520, ...
 01327   396   NtSetInformationFile  (-2147482732, -136578620, 8, EndOfFile, ... {status=0x0, info=0}, ) == 0x0
 01328   396   NtSetInformationFile  (-2147482732, -136578656, 8, EndOfFile, ... {status=0x0, info=0}, ) == 0x0
 01329   396   NtSetInformationFile  (-2147482732, -136578712, 8, EndOfFile, ... {status=0x0, info=0}, ) == 0x0
 01330   396   NtSetInformationFile  (-2147482732, -136579020, 8, EndOfFile, ... {status=0x0, info=0}, ) == 0x0
 01331   396   NtSetInformationFile  (-2147482732, -136579068, 8, EndOfFile, ... {status=0x0, info=0}, ) == 0x0
 01326   396   NtSetValueKey  ... ) == 0x0
 01332   396   NtClose  (136, ... ) == 0x0
 01333   396   NtUserSetTimer  (196706, 101, 2000, 0, ... ) == 0x65
 01195   396   NtUserCreateWindowEx  ... ) == 0x30062
 01334   396   NtUserGetMessage  (0, 0, 0, ... {0x30062, WM_TIMER, 0x65, 0x0, 0x75cc, {512, 384}}, ) == 0x1
 01335   396   NtQueryValueKey  (108,  (108, "FromCacheTimeout", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01336   396   NtQueryValueKey  (108,  (108, "SecureProtocols", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01337   396   NtQueryValueKey  (108,  (108, "CertificateRevocation", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01338   396   NtQueryValueKey  (108,  (108, "DisableKeepAlive", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01339   396   NtQueryValueKey  (108,  (108, "DisablePassport", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01340   396   NtQueryValueKey  (108,  (108, "CacheMode", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01341   396   NtQueryValueKey  (108,  (108, "EnableHttp1_1", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (108, "EnableHttp1_1", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) }, 16, ) == 0x0
 01342   396   NtQueryValueKey  (108,  (108, "ProxyHttp1.1", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01343   396   NtQueryValueKey  (108,  (108, "EnableNegotiate", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (108, "EnableNegotiate", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) }, 16, ) == 0x0
 01344   396   NtOpenSection  (0xe, {24, 8, 0x40, 0, 0,  (0xe, {24, 8, 0x40, 0, 0, "Secur32.dll"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01345   396   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\u:\work\Secur32.dll"}, 1240284, ... ) }, 1240284, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01346   396   NtQueryAttributesFile  ({24, 12, 0x40, 0, 0,  ({24, 12, 0x40, 0, 0, "Secur32.dll"}, 1240284, ... ) }, 1240284, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01347   396   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\System32\Secur32.dll"}, 1240284, ... ) }, 1240284, ... ) == 0x0
 01348   396   NtOpenFile  (0x100020, {24, 0, 0x40, 0, 0,  (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\System32\Secur32.dll"}, 5, 96, ... 136, {status=0x0, info=1}, ) }, 5, 96, ... 136, {status=0x0, info=1}, ) == 0x0
 01349   396   NtCreateSection  (0xf, 0x0, 0x0, 16, 16777216, 136, ... 140, ) == 0x0
 01350   396   NtQuerySection  (140, Image, 48, ... {section info, class 1, size 48}, 0x0, ) == 0x0
 01351   396   NtClose  (136, ... ) == 0x0
 01352   396   NtMapViewOfSection  (140, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x76f90000), 0x0, 65536, ) == 0x0
 01353   396   NtClose  (140, ... ) == 0x0
 01354   396   NtCreateSemaphore  (0x100003, 0x0, 0, 2147483647, ... 140, ) == 0x0
 01355   396   NtCreateSemaphore  (0x100003, 0x0, 0, 2147483647, ... 136, ) == 0x0
 01356   396   NtOpenEvent  (0x1, {24, 0, 0x40, 0, 0,  (0x1, {24, 0, 0x40, 0, 0, "\SECURITY\LSA_AUTHENTICATION_INITIALIZED"}, ... 144, ) }, ... 144, ) == 0x0
 01357   396   NtQueryEvent  (144, Basic, 8, ... {EventType=0,SignalState=1,}, 0x0, ) == 0x0
 01358   396   NtClose  (144, ... ) == 0x0
 01359   396   NtConnectPort  ( ("\LsaAuthenticationPort", {12, 2, 1, 0}, 0x0, 0x0, 1241768, 140, ... 144, 0x0, 0x0, 256, 140, ) , {12, 2, 1, 0}, 0x0, 0x0, 1241768, 140, ... 144, 0x0, 0x0, 256, 140, ) == 0x0
 01360   396   NtRequestWaitReplyPort  (144, {28, 52, new_msg, 0, 0, 0, 0, 0}  (144, {28, 52, new_msg, 0, 0, 0, 0, 0} "\37\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\1\0\13\30\10\2\220\36\24\0" ... {176, 200, reply, 0, 316, 396, 1524, 0} "\37\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\1\0\20\0\10\2\220\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0S\0R\0I\0-\0u\0s\0e\0r\0" )  ... {176, 200, reply, 0, 316, 396, 1524, 0}  (144, {28, 52, new_msg, 0, 0, 0, 0, 0} "\37\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\1\0\13\30\10\2\220\36\24\0" ... {176, 200, reply, 0, 316, 396, 1524, 0} "\37\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\1\0\20\0\10\2\220\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0S\0R\0I\0-\0u\0s\0e\0r\0" )  ) == 0x0
 01361   396   NtQueryValueKey  (108,  (108, "SyncMode5", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01362   396   NtOpenKey  (0xf, {24, 48, 0x40, 0, 0,  (0xf, {24, 48, 0x40, 0, 0, "Software\Microsoft\Windows\CurrentVersion\Internet Settings\Cache"}, ... 148, ) }, ... 148, ) == 0x0
 01363   396   NtQueryValueKey  (148,  (148, "FixupKey", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01364   396   NtClose  (148, ... ) == 0x0
 01365   396   NtOpenKey  (0xf, {24, 48, 0x40, 0, 0,  (0xf, {24, 48, 0x40, 0, 0, "Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache"}, ... 148, ) }, ... 148, ) == 0x0
 01366   396   NtQueryValueKey  (148,  (148, "SessionStartTimeDefaultDeltaSecs", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01367   396   NtClose  (148, ... ) == 0x0
 01368   396   NtOpenKey  (0xf, {24, 48, 0x40, 0, 0,  (0xf, {24, 48, 0x40, 0, 0, "Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache"}, ... 148, ) }, ... 148, ) == 0x0
 01369   396   NtOpenKey  (0x20019, {24, 48, 0x40, 0, 0,  (0x20019, {24, 48, 0x40, 0, 0, "System\Setup"}, ... 152, ) }, ... 152, ) == 0x0
 01370   396   NtQueryValueKey  (152,  (152, "SystemSetupInProgress", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (152, "SystemSetupInProgress", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) }, 16, ) == 0x0
 01371   396   NtClose  (152, ... ) == 0x0
 01372   396   NtOpenKey  (0xf, {24, 60, 0x40, 0, 0,  (0xf, {24, 60, 0x40, 0, 0, "Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders"}, ... 152, ) }, ... 152, ) == 0x0
 01373   396   NtOpenKey  (0xf, {24, 60, 0x40, 0, 0,  (0xf, {24, 60, 0x40, 0, 0, "Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache"}, ... 156, ) }, ... 156, ) == 0x0
 01374   396   NtOpenKey  (0xf, {24, 60, 0x40, 0, 0,  (0xf, {24, 60, 0x40, 0, 0, "Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders"}, ... 160, ) }, ... 160, ) == 0x0
 01375   396   NtOpenKey  (0xf, {24, 60, 0x40, 0, 0,  (0xf, {24, 60, 0x40, 0, 0, "Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache"}, ... 164, ) }, ... 164, ) == 0x0
 01376   396   NtQueryValueKey  (164,  (164, "Signature", Partial, 144, ... TitleIdx=0, Type=1, Data="C\0l\0i\0e\0n\0t\0 \0U\0r\0l\0C\0a\0c\0h\0e\0 \0M\0M\0F\0 \0V\0e\0r\0 \05\0.\02\0\0\0"}, 68, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (164, "Signature", Partial, 144, ... TitleIdx=0, Type=1, Data="C\0l\0i\0e\0n\0t\0 \0U\0r\0l\0C\0a\0c\0h\0e\0 \0M\0M\0F\0 \0V\0e\0r\0 \05\0.\02\0\0\0"}, 68, ) }, 68, ) == 0x0
 01377   396   NtQueryValueKey  (164,  (164, "Signature", Partial, 144, ... TitleIdx=0, Type=1, Data="C\0l\0i\0e\0n\0t\0 \0U\0r\0l\0C\0a\0c\0h\0e\0 \0M\0M\0F\0 \0V\0e\0r\0 \05\0.\02\0\0\0"}, 68, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (164, "Signature", Partial, 144, ... TitleIdx=0, Type=1, Data="C\0l\0i\0e\0n\0t\0 \0U\0r\0l\0C\0a\0c\0h\0e\0 \0M\0M\0F\0 \0V\0e\0r\0 \05\0.\02\0\0\0"}, 68, ) }, 68, ) == 0x0
 01378   396   NtClose  (164, ... ) == 0x0
 01379   396   NtOpenKey  (0xf, {24, 60, 0x40, 0, 0,  (0xf, {24, 60, 0x40, 0, 0, "Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders"}, ... 164, ) }, ... 164, ) == 0x0
 01380   396   NtQueryValueKey  (164,  (164, "Cache", Partial, 144, ... TitleIdx=0, Type=2, Data="%\0U\0S\0E\0R\0P\0R\0O\0F\0I\0L\0E\0%\0\\0L\0o\0c\0a\0l\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0T\0e\0m\0p\0o\0r\0a\0r\0y\0 \0I\0n\0t\0e\0r\0n\0e\0t\0 \0F\0i\0l\0e\0s\0\0\0"}, 120, ) , Partial, 144, ... TitleIdx=0, Type=2, Data= (164, "Cache", Partial, 144, ... TitleIdx=0, Type=2, Data="%\0U\0S\0E\0R\0P\0R\0O\0F\0I\0L\0E\0%\0\\0L\0o\0c\0a\0l\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0T\0e\0m\0p\0o\0r\0a\0r\0y\0 \0I\0n\0t\0e\0r\0n\0e\0t\0 \0F\0i\0l\0e\0s\0\0\0"}, 120, ) }, 120, ) == 0x0
 01381   396   NtQueryValueKey  (164,  (164, "Cache", Partial, 144, ... TitleIdx=0, Type=2, Data="%\0U\0S\0E\0R\0P\0R\0O\0F\0I\0L\0E\0%\0\\0L\0o\0c\0a\0l\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0T\0e\0m\0p\0o\0r\0a\0r\0y\0 \0I\0n\0t\0e\0r\0n\0e\0t\0 \0F\0i\0l\0e\0s\0\0\0"}, 120, ) , Partial, 144, ... TitleIdx=0, Type=2, Data= (164, "Cache", Partial, 144, ... TitleIdx=0, Type=2, Data="%\0U\0S\0E\0R\0P\0R\0O\0F\0I\0L\0E\0%\0\\0L\0o\0c\0a\0l\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0T\0e\0m\0p\0o\0r\0a\0r\0y\0 \0I\0n\0t\0e\0r\0n\0e\0t\0 \0F\0i\0l\0e\0s\0\0\0"}, 120, ) }, 120, ) == 0x0
 01382   396   NtQueryValueKey  (164,  (164, "Cookies", Partial, 144, ... TitleIdx=0, Type=2, Data="%\0U\0S\0E\0R\0P\0R\0O\0F\0I\0L\0E\0%\0\\0C\0o\0o\0k\0i\0e\0s\0\0\0"}, 56, ) , Partial, 144, ... TitleIdx=0, Type=2, Data= (164, "Cookies", Partial, 144, ... TitleIdx=0, Type=2, Data="%\0U\0S\0E\0R\0P\0R\0O\0F\0I\0L\0E\0%\0\\0C\0o\0o\0k\0i\0e\0s\0\0\0"}, 56, ) }, 56, ) == 0x0
 01383   396   NtQueryValueKey  (164,  (164, "Cookies", Partial, 144, ... TitleIdx=0, Type=2, Data="%\0U\0S\0E\0R\0P\0R\0O\0F\0I\0L\0E\0%\0\\0C\0o\0o\0k\0i\0e\0s\0\0\0"}, 56, ) , Partial, 144, ... TitleIdx=0, Type=2, Data= (164, "Cookies", Partial, 144, ... TitleIdx=0, Type=2, Data="%\0U\0S\0E\0R\0P\0R\0O\0F\0I\0L\0E\0%\0\\0C\0o\0o\0k\0i\0e\0s\0\0\0"}, 56, ) }, 56, ) == 0x0
 01384   396   NtQueryValueKey  (164,  (164, "History", Partial, 144, ... TitleIdx=0, Type=2, Data="%\0U\0S\0E\0R\0P\0R\0O\0F\0I\0L\0E\0%\0\\0L\0o\0c\0a\0l\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0H\0i\0s\0t\0o\0r\0y\0\0\0"}, 86, ) , Partial, 144, ... TitleIdx=0, Type=2, Data= (164, "History", Partial, 144, ... TitleIdx=0, Type=2, Data="%\0U\0S\0E\0R\0P\0R\0O\0F\0I\0L\0E\0%\0\\0L\0o\0c\0a\0l\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0H\0i\0s\0t\0o\0r\0y\0\0\0"}, 86, ) }, 86, ) == 0x0
 01385   396   NtQueryValueKey  (164,  (164, "History", Partial, 144, ... TitleIdx=0, Type=2, Data="%\0U\0S\0E\0R\0P\0R\0O\0F\0I\0L\0E\0%\0\\0L\0o\0c\0a\0l\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0H\0i\0s\0t\0o\0r\0y\0\0\0"}, 86, ) , Partial, 144, ... TitleIdx=0, Type=2, Data= (164, "History", Partial, 144, ... TitleIdx=0, Type=2, Data="%\0U\0S\0E\0R\0P\0R\0O\0F\0I\0L\0E\0%\0\\0L\0o\0c\0a\0l\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0H\0i\0s\0t\0o\0r\0y\0\0\0"}, 86, ) }, 86, ) == 0x0
 01386   396   NtClose  (164, ... ) == 0x0
 01387   396   NtOpenKey  (0xf, {24, 156, 0x40, 0, 0,  (0xf, {24, 156, 0x40, 0, 0, "Content"}, ... 164, ) }, ... 164, ) == 0x0
 01388   396   NtQueryValueKey  (164,  (164, "PerUserItem", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (164, "PerUserItem", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) }, 16, ) == 0x0
 01389   396   NtClose  (164, ... ) == 0x0
 01390   396   NtOpenKey  (0xf, {24, 156, 0x40, 0, 0,  (0xf, {24, 156, 0x40, 0, 0, "Content"}, ... 164, ) }, ... 164, ) == 0x0
 01391   396   NtOpenThreadToken  (-2, 0xc, 1, ... ) == STATUS_NO_TOKEN
 01392   396   NtCreateSemaphore  (0x1f0003, {24, 52, 0x80, 1377384, 0,  (0x1f0003, {24, 52, 0x80, 1377384, 0, "shell.{210A4BA0-3AEA-1069-A2D9-08002B30309D}"}, 0, 2147483647, ... 168, ) }, 0, 2147483647, ... 168, ) == STATUS_OBJECT_NAME_EXISTS
 01393   396   NtReleaseSemaphore  (168, 1, ... 0, ) == 0x0
 01394   396   NtWaitForSingleObject  (168, 0, {0, 0}, ... ) == 0x0
 01395   396   NtCreateKey  (0x2000000, {24, 60, 0x40, 0, 0,  (0x2000000, {24, 60, 0x40, 0, 0, "Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders"}, 0, 0x0, 0, ... 172, 2, ) }, 0, 0x0, 0, ... 172, 2, ) == 0x0
 01396   396   NtQueryValueKey  (172,  (172, "Cache", Partial, 144, ... TitleIdx=0, Type=2, Data="%\0U\0S\0E\0R\0P\0R\0O\0F\0I\0L\0E\0%\0\\0L\0o\0c\0a\0l\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0T\0e\0m\0p\0o\0r\0a\0r\0y\0 \0I\0n\0t\0e\0r\0n\0e\0t\0 \0F\0i\0l\0e\0s\0\0\0"}, 120, ) , Partial, 144, ... TitleIdx=0, Type=2, Data= (172, "Cache", Partial, 144, ... TitleIdx=0, Type=2, Data="%\0U\0S\0E\0R\0P\0R\0O\0F\0I\0L\0E\0%\0\\0L\0o\0c\0a\0l\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0T\0e\0m\0p\0o\0r\0a\0r\0y\0 \0I\0n\0t\0e\0r\0n\0e\0t\0 \0F\0i\0l\0e\0s\0\0\0"}, 120, ) }, 120, ) == 0x0
 01397   396   NtClose  (172, ... ) == 0x0
 01398   396   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\Documents and Settings\SRI-user\Local Settings\Temporary Internet Files"}, 1238996, ... ) }, 1238996, ... ) == 0x0
 01399   396   NtCreateKey  (0x2000000, {24, 60, 0x40, 0, 0,  (0x2000000, {24, 60, 0x40, 0, 0, "Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders"}, 0, 0x0, 0, ... 172, 2, ) }, 0, 0x0, 0, ... 172, 2, ) == 0x0
 01400   396   NtSetValueKey  (172,  (172, "Cache", 0, 1, "C\0:\0\\0D\0o\0c\0u\0m\0e\0n\0t\0s\0 \0a\0n\0d\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0S\0R\0I\0-\0u\0s\0e\0r\0\\0L\0o\0c\0a\0l\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0T\0e\0m\0p\0o\0r\0a\0r\0y\0 \0I\0n\0t\0e\0r\0n\0e\0t\0 \0F\0i\0l\0e\0s\0\0\0", 150, ... ) , 0, 1,  (172, "Cache", 0, 1, "C\0:\0\\0D\0o\0c\0u\0m\0e\0n\0t\0s\0 \0a\0n\0d\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0S\0R\0I\0-\0u\0s\0e\0r\0\\0L\0o\0c\0a\0l\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0T\0e\0m\0p\0o\0r\0a\0r\0y\0 \0I\0n\0t\0e\0r\0n\0e\0t\0 \0F\0i\0l\0e\0s\0\0\0", 150, ... ) , 150, ... ) == 0x0
 01401   396   NtClose  (172, ... ) == 0x0
 01402   396   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\Documents and Settings\SRI-user\Local Settings\Temporary Internet Files"}, 1240328, ... ) }, 1240328, ... ) == 0x0
 01403   396   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\Documents and Settings\SRI-user\Local Settings\Temporary Internet Files"}, 1240060, ... ) }, 1240060, ... ) == 0x0
 01404   396   NtOpenFile  (0x100100, {24, 0, 0x40, 0, 0,  (0x100100, {24, 0, 0x40, 0, 0, "\??\C:\Documents and Settings\SRI-user\Local Settings\Temporary Internet Files"}, 7, 2113568, ... 172, {status=0x0, info=1}, ) }, 7, 2113568, ... 172, {status=0x0, info=1}, ) == 0x0
 01405   396   NtSetInformationFile  (172, 1240036, 40, Basic, ... {status=0x0, info=0}, ) == 0x0
 01406   396   NtClose  (172, ... ) == 0x0
 01407   396   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\Documents and Settings\SRI-user\Local Settings\Temporary Internet Files\desktop.ini"}, 1240060, ... ) }, 1240060, ... ) == 0x0
 01408   396   NtQueryValueKey  (164,  (164, "CachePrefix", Partial, 144, ... TitleIdx=0, Type=1, Data="\0\0"}, 14, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (164, "CachePrefix", Partial, 144, ... TitleIdx=0, Type=1, Data="\0\0"}, 14, ) }, 14, ) == 0x0
 01409   396   NtQueryValueKey  (164,  (164, "CachePrefix", Partial, 144, ... TitleIdx=0, Type=1, Data="\0\0"}, 14, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (164, "CachePrefix", Partial, 144, ... TitleIdx=0, Type=1, Data="\0\0"}, 14, ) }, 14, ) == 0x0
 01410   396   NtQueryValueKey  (164,  (164, "CacheLimit", Partial, 144, ... TitleIdx=0, Type=4, Data="\251~\1\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (164, "CacheLimit", Partial, 144, ... TitleIdx=0, Type=4, Data="\251~\1\0"}, 16, ) }, 16, ) == 0x0
 01411   396   NtOpenKey  (0xf, {24, 48, 0x40, 0, 0,  (0xf, {24, 48, 0x40, 0, 0, "Software\Microsoft\Windows\CurrentVersion\Internet Settings\Cache"}, ... 172, ) }, ... 172, ) == 0x0
 01412   396   NtOpenKey  (0xf, {24, 172, 0x40, 0, 0,  (0xf, {24, 172, 0x40, 0, 0, "Paths"}, ... 176, ) }, ... 176, ) == 0x0
 01413   396   NtOpenKey  (0xf, {24, 176, 0x40, 0, 0,  (0xf, {24, 176, 0x40, 0, 0, "Path1"}, ... 180, ) }, ... 180, ) == 0x0
 01414   396   NtOpenKey  (0xf, {24, 176, 0x40, 0, 0,  (0xf, {24, 176, 0x40, 0, 0, "Path2"}, ... 184, ) }, ... 184, ) == 0x0
 01415   396   NtOpenKey  (0xf, {24, 176, 0x40, 0, 0,  (0xf, {24, 176, 0x40, 0, 0, "Path3"}, ... 188, ) }, ... 188, ) == 0x0
 01416   396   NtOpenKey  (0xf, {24, 176, 0x40, 0, 0,  (0xf, {24, 176, 0x40, 0, 0, "Path4"}, ... 192, ) }, ... 192, ) == 0x0
 01417   396   NtOpenKey  (0xf, {24, 172, 0x40, 0, 0,  (0xf, {24, 172, 0x40, 0, 0, "Special Paths"}, ... 196, ) }, ... 196, ) == 0x0
 01418   396   NtSetValueKey  (176,  (176, "Directory", 0, 1, "C\0:\0\\0D\0o\0c\0u\0m\0e\0n\0t\0s\0 \0a\0n\0d\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0S\0R\0I\0-\0u\0s\0e\0r\0\\0L\0o\0c\0a\0l\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0T\0e\0m\0p\0o\0r\0a\0r\0y\0 \0I\0n\0t\0e\0r\0n\0e\0t\0 \0F\0i\0l\0e\0s\0\\0C\0o\0n\0t\0e\0n\0t\0.\0I\0E\05\0\0\0", 174, ... ) , 0, 1,  (176, "Directory", 0, 1, "C\0:\0\\0D\0o\0c\0u\0m\0e\0n\0t\0s\0 \0a\0n\0d\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0S\0R\0I\0-\0u\0s\0e\0r\0\\0L\0o\0c\0a\0l\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0T\0e\0m\0p\0o\0r\0a\0r\0y\0 \0I\0n\0t\0e\0r\0n\0e\0t\0 \0F\0i\0l\0e\0s\0\\0C\0o\0n\0t\0e\0n\0t\0.\0I\0E\05\0\0\0", 174, ... ) , 174, ... ) == 0x0
 01419   396   NtSetValueKey  (176,  (176, "Paths", 0, 4, "\4\0\0\0", 4, ... ) , 0, 4,  (176, "Paths", 0, 4, "\4\0\0\0", 4, ... ) , 4, ... ) == 0x0
 01420   396   NtSetValueKey  (180,  (180, "CachePath", 0, 1, "C\0:\0\\0D\0o\0c\0u\0m\0e\0n\0t\0s\0 \0a\0n\0d\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0S\0R\0I\0-\0u\0s\0e\0r\0\\0L\0o\0c\0a\0l\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0T\0e\0m\0p\0o\0r\0a\0r\0y\0 \0I\0n\0t\0e\0r\0n\0e\0t\0 \0F\0i\0l\0e\0s\0\\0C\0o\0n\0t\0e\0n\0t\0.\0I\0E\05\0\\0C\0a\0c\0h\0e\01\0\0\0", 188, ... ) , 0, 1,  (180, "CachePath", 0, 1, "C\0:\0\\0D\0o\0c\0u\0m\0e\0n\0t\0s\0 \0a\0n\0d\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0S\0R\0I\0-\0u\0s\0e\0r\0\\0L\0o\0c\0a\0l\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0T\0e\0m\0p\0o\0r\0a\0r\0y\0 \0I\0n\0t\0e\0r\0n\0e\0t\0 \0F\0i\0l\0e\0s\0\\0C\0o\0n\0t\0e\0n\0t\0.\0I\0E\05\0\\0C\0a\0c\0h\0e\01\0\0\0", 188, ... ) , 188, ... ) == 0x0
 01421   396   NtSetValueKey  (184,  (184, "CachePath", 0, 1, "C\0:\0\\0D\0o\0c\0u\0m\0e\0n\0t\0s\0 \0a\0n\0d\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0S\0R\0I\0-\0u\0s\0e\0r\0\\0L\0o\0c\0a\0l\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0T\0e\0m\0p\0o\0r\0a\0r\0y\0 \0I\0n\0t\0e\0r\0n\0e\0t\0 \0F\0i\0l\0e\0s\0\\0C\0o\0n\0t\0e\0n\0t\0.\0I\0E\05\0\\0C\0a\0c\0h\0e\02\0\0\0", 188, ... ) , 0, 1,  (184, "CachePath", 0, 1, "C\0:\0\\0D\0o\0c\0u\0m\0e\0n\0t\0s\0 \0a\0n\0d\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0S\0R\0I\0-\0u\0s\0e\0r\0\\0L\0o\0c\0a\0l\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0T\0e\0m\0p\0o\0r\0a\0r\0y\0 \0I\0n\0t\0e\0r\0n\0e\0t\0 \0F\0i\0l\0e\0s\0\\0C\0o\0n\0t\0e\0n\0t\0.\0I\0E\05\0\\0C\0a\0c\0h\0e\02\0\0\0", 188, ... ) , 188, ... ) == 0x0
 01422   396   NtSetValueKey  (188,  (188, "CachePath", 0, 1, "C\0:\0\\0D\0o\0c\0u\0m\0e\0n\0t\0s\0 \0a\0n\0d\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0S\0R\0I\0-\0u\0s\0e\0r\0\\0L\0o\0c\0a\0l\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0T\0e\0m\0p\0o\0r\0a\0r\0y\0 \0I\0n\0t\0e\0r\0n\0e\0t\0 \0F\0i\0l\0e\0s\0\\0C\0o\0n\0t\0e\0n\0t\0.\0I\0E\05\0\\0C\0a\0c\0h\0e\03\0\0\0", 188, ... ) , 0, 1,  (188, "CachePath", 0, 1, "C\0:\0\\0D\0o\0c\0u\0m\0e\0n\0t\0s\0 \0a\0n\0d\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0S\0R\0I\0-\0u\0s\0e\0r\0\\0L\0o\0c\0a\0l\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0T\0e\0m\0p\0o\0r\0a\0r\0y\0 \0I\0n\0t\0e\0r\0n\0e\0t\0 \0F\0i\0l\0e\0s\0\\0C\0o\0n\0t\0e\0n\0t\0.\0I\0E\05\0\\0C\0a\0c\0h\0e\03\0\0\0", 188, ... ) , 188, ... ) == 0x0
 01423   396   NtSetValueKey  (192,  (192, "CachePath", 0, 1, "C\0:\0\\0D\0o\0c\0u\0m\0e\0n\0t\0s\0 \0a\0n\0d\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0S\0R\0I\0-\0u\0s\0e\0r\0\\0L\0o\0c\0a\0l\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0T\0e\0m\0p\0o\0r\0a\0r\0y\0 \0I\0n\0t\0e\0r\0n\0e\0t\0 \0F\0i\0l\0e\0s\0\\0C\0o\0n\0t\0e\0n\0t\0.\0I\0E\05\0\\0C\0a\0c\0h\0e\04\0\0\0", 188, ... ) , 0, 1,  (192, "CachePath", 0, 1, "C\0:\0\\0D\0o\0c\0u\0m\0e\0n\0t\0s\0 \0a\0n\0d\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0S\0R\0I\0-\0u\0s\0e\0r\0\\0L\0o\0c\0a\0l\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0T\0e\0m\0p\0o\0r\0a\0r\0y\0 \0I\0n\0t\0e\0r\0n\0e\0t\0 \0F\0i\0l\0e\0s\0\\0C\0o\0n\0t\0e\0n\0t\0.\0I\0E\05\0\\0C\0a\0c\0h\0e\04\0\0\0", 188, ... ) , 188, ... ) == 0x0
 01424   396   NtSetValueKey  (180,  (180, "CacheLimit", 0, 4, "\252_\0\0", 4, ... ) , 0, 4,  (180, "CacheLimit", 0, 4, "\252_\0\0", 4, ... ) , 4, ... ) == 0x0
 01425   396   NtSetValueKey  (184,  (184, "CacheLimit", 0, 4, "\252_\0\0", 4, ... ) , 0, 4,  (184, "CacheLimit", 0, 4, "\252_\0\0", 4, ... ) , 4, ... ) == 0x0
 01426   396   NtSetValueKey  (188,  (188, "CacheLimit", 0, 4, "\252_\0\0", 4, ... ) , 0, 4,  (188, "CacheLimit", 0, 4, "\252_\0\0", 4, ... ) , 4, ... ) == 0x0
 01427   396   NtSetValueKey  (192,  (192, "CacheLimit", 0, 4, "\252_\0\0", 4, ... ) , 0, 4,  (192, "CacheLimit", 0, 4, "\252_\0\0", 4, ... ) , 4, ... ) == 0x0
 01428   396   NtClose  (192, ... ) == 0x0
 01429   396   NtClose  (188, ... ) == 0x0
 01430   396   NtClose  (184, ... ) == 0x0
 01431   396   NtClose  (180, ... ) == 0x0
 01432   396   NtClose  (176, ... ) == 0x0
 01433   396   NtClose  (196, ... ) == 0x0
 01434   396   NtClose  (172, ... ) == 0x0
 01435   396   NtOpenKey  (0xf, {24, 156, 0x40, 0, 0,  (0xf, {24, 156, 0x40, 0, 0, "Cookies"}, ... 172, ) }, ... 172, ) == 0x0
 01436   396   NtQueryValueKey  (172,  (172, "PerUserItem", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (172, "PerUserItem", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) }, 16, ) == 0x0
 01437   396   NtClose  (172, ... ) == 0x0
 01438   396   NtClose  (164, ... ) == 0x0
 01439   396   NtOpenKey  (0xf, {24, 156, 0x40, 0, 0,  (0xf, {24, 156, 0x40, 0, 0, "Cookies"}, ... 164, ) }, ... 164, ) == 0x0
 01440   396   NtOpenThreadToken  (-2, 0xc, 1, ... ) == STATUS_NO_TOKEN
 01441   396   NtReleaseSemaphore  (168, 1, ... 0, ) == 0x0
 01442   396   NtWaitForSingleObject  (168, 0, {0, 0}, ... ) == 0x0
 01443   396   NtCreateKey  (0x2000000, {24, 60, 0x40, 0, 0,  (0x2000000, {24, 60, 0x40, 0, 0, "Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders"}, 0, 0x0, 0, ... 172, 2, ) }, 0, 0x0, 0, ... 172, 2, ) == 0x0
 01444   396   NtQueryValueKey  (172,  (172, "Cookies", Partial, 144, ... TitleIdx=0, Type=2, Data="%\0U\0S\0E\0R\0P\0R\0O\0F\0I\0L\0E\0%\0\\0C\0o\0o\0k\0i\0e\0s\0\0\0"}, 56, ) , Partial, 144, ... TitleIdx=0, Type=2, Data= (172, "Cookies", Partial, 144, ... TitleIdx=0, Type=2, Data="%\0U\0S\0E\0R\0P\0R\0O\0F\0I\0L\0E\0%\0\\0C\0o\0o\0k\0i\0e\0s\0\0\0"}, 56, ) }, 56, ) == 0x0
 01445   396   NtClose  (172, ... ) == 0x0
 01446   396   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\Documents and Settings\SRI-user\Cookies"}, 1238996, ... ) }, 1238996, ... ) == 0x0
 01447   396   NtCreateKey  (0x2000000, {24, 60, 0x40, 0, 0,  (0x2000000, {24, 60, 0x40, 0, 0, "Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders"}, 0, 0x0, 0, ... 172, 2, ) }, 0, 0x0, 0, ... 172, 2, ) == 0x0
 01448   396   NtSetValueKey  (172,  (172, "Cookies", 0, 1, "C\0:\0\\0D\0o\0c\0u\0m\0e\0n\0t\0s\0 \0a\0n\0d\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0S\0R\0I\0-\0u\0s\0e\0r\0\\0C\0o\0o\0k\0i\0e\0s\0\0\0", 86, ... ) , 0, 1,  (172, "Cookies", 0, 1, "C\0:\0\\0D\0o\0c\0u\0m\0e\0n\0t\0s\0 \0a\0n\0d\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0S\0R\0I\0-\0u\0s\0e\0r\0\\0C\0o\0o\0k\0i\0e\0s\0\0\0", 86, ... ) , 86, ... ) == 0x0
 01449   396   NtClose  (172, ... ) == 0x0
 01450   396   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\Documents and Settings\SRI-user\Cookies"}, 1240328, ... ) }, 1240328, ... ) == 0x0
 01451   396   NtQueryValueKey  (164,  (164, "CachePrefix", Partial, 144, ... TitleIdx=0, Type=1, Data="C\0o\0o\0k\0i\0e\0:\0\0\0"}, 28, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (164, "CachePrefix", Partial, 144, ... TitleIdx=0, Type=1, Data="C\0o\0o\0k\0i\0e\0:\0\0\0"}, 28, ) }, 28, ) == 0x0
 01452   396   NtQueryValueKey  (164,  (164, "CachePrefix", Partial, 144, ... TitleIdx=0, Type=1, Data="C\0o\0o\0k\0i\0e\0:\0\0\0"}, 28, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (164, "CachePrefix", Partial, 144, ... TitleIdx=0, Type=1, Data="C\0o\0o\0k\0i\0e\0:\0\0\0"}, 28, ) }, 28, ) == 0x0
 01453   396   NtQueryValueKey  (164,  (164, "CacheLimit", Partial, 144, ... TitleIdx=0, Type=4, Data="\0 \0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (164, "CacheLimit", Partial, 144, ... TitleIdx=0, Type=4, Data="\0 \0\0"}, 16, ) }, 16, ) == 0x0
 01454   396   NtOpenKey  (0xf, {24, 156, 0x40, 0, 0,  (0xf, {24, 156, 0x40, 0, 0, "History"}, ... 172, ) }, ... 172, ) == 0x0
 01455   396   NtQueryValueKey  (172,  (172, "PerUserItem", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (172, "PerUserItem", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) }, 16, ) == 0x0
 01456   396   NtClose  (172, ... ) == 0x0
 01457   396   NtClose  (164, ... ) == 0x0
 01458   396   NtOpenKey  (0xf, {24, 156, 0x40, 0, 0,  (0xf, {24, 156, 0x40, 0, 0, "History"}, ... 164, ) }, ... 164, ) == 0x0
 01459   396   NtOpenThreadToken  (-2, 0xc, 1, ... ) == STATUS_NO_TOKEN
 01460   396   NtReleaseSemaphore  (168, 1, ... 0, ) == 0x0
 01461   396   NtWaitForSingleObject  (168, 0, {0, 0}, ... ) == 0x0
 01462   396   NtCreateKey  (0x2000000, {24, 60, 0x40, 0, 0,  (0x2000000, {24, 60, 0x40, 0, 0, "Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders"}, 0, 0x0, 0, ... 172, 2, ) }, 0, 0x0, 0, ... 172, 2, ) == 0x0
 01463   396   NtQueryValueKey  (172,  (172, "History", Partial, 144, ... TitleIdx=0, Type=2, Data="%\0U\0S\0E\0R\0P\0R\0O\0F\0I\0L\0E\0%\0\\0L\0o\0c\0a\0l\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0H\0i\0s\0t\0o\0r\0y\0\0\0"}, 86, ) , Partial, 144, ... TitleIdx=0, Type=2, Data= (172, "History", Partial, 144, ... TitleIdx=0, Type=2, Data="%\0U\0S\0E\0R\0P\0R\0O\0F\0I\0L\0E\0%\0\\0L\0o\0c\0a\0l\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0H\0i\0s\0t\0o\0r\0y\0\0\0"}, 86, ) }, 86, ) == 0x0
 01464   396   NtClose  (172, ... ) == 0x0
 01465   396   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\Documents and Settings\SRI-user\Local Settings\History"}, 1238996, ... ) }, 1238996, ... ) == 0x0
 01466   396   NtCreateKey  (0x2000000, {24, 60, 0x40, 0, 0,  (0x2000000, {24, 60, 0x40, 0, 0, "Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders"}, 0, 0x0, 0, ... 172, 2, ) }, 0, 0x0, 0, ... 172, 2, ) == 0x0
 01467   396   NtSetValueKey  (172,  (172, "History", 0, 1, "C\0:\0\\0D\0o\0c\0u\0m\0e\0n\0t\0s\0 \0a\0n\0d\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0S\0R\0I\0-\0u\0s\0e\0r\0\\0L\0o\0c\0a\0l\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0H\0i\0s\0t\0o\0r\0y\0\0\0", 116, ... ) , 0, 1,  (172, "History", 0, 1, "C\0:\0\\0D\0o\0c\0u\0m\0e\0n\0t\0s\0 \0a\0n\0d\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0S\0R\0I\0-\0u\0s\0e\0r\0\\0L\0o\0c\0a\0l\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0H\0i\0s\0t\0o\0r\0y\0\0\0", 116, ... ) , 116, ... ) == 0x0
 01468   396   NtClose  (172, ... ) == 0x0
 01469   396   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\Documents and Settings\SRI-user\Local Settings\History"}, 1240328, ... ) }, 1240328, ... ) == 0x0
 01470   396   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\Documents and Settings\SRI-user\Local Settings\History"}, 1240060, ... ) }, 1240060, ... ) == 0x0
 01471   396   NtOpenFile  (0x100100, {24, 0, 0x40, 0, 0,  (0x100100, {24, 0, 0x40, 0, 0, "\??\C:\Documents and Settings\SRI-user\Local Settings\History"}, 7, 2113568, ... 172, {status=0x0, info=1}, ) }, 7, 2113568, ... 172, {status=0x0, info=1}, ) == 0x0
 01472   396   NtSetInformationFile  (172, 1240036, 40, Basic, ... {status=0x0, info=0}, ) == 0x0
 01473   396   NtClose  (172, ... ) == 0x0
 01474   396   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\Documents and Settings\SRI-user\Local Settings\History\desktop.ini"}, 1240060, ... ) }, 1240060, ... ) == 0x0
 01475   396   NtQueryValueKey  (164,  (164, "CachePrefix", Partial, 144, ... TitleIdx=0, Type=1, Data="V\0i\0s\0i\0t\0e\0d\0:\0\0\0"}, 30, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (164, "CachePrefix", Partial, 144, ... TitleIdx=0, Type=1, Data="V\0i\0s\0i\0t\0e\0d\0:\0\0\0"}, 30, ) }, 30, ) == 0x0
 01476   396   NtQueryValueKey  (164,  (164, "CachePrefix", Partial, 144, ... TitleIdx=0, Type=1, Data="V\0i\0s\0i\0t\0e\0d\0:\0\0\0"}, 30, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (164, "CachePrefix", Partial, 144, ... TitleIdx=0, Type=1, Data="V\0i\0s\0i\0t\0e\0d\0:\0\0\0"}, 30, ) }, 30, ) == 0x0
 01477   396   NtQueryValueKey  (164,  (164, "CacheLimit", Partial, 144, ... TitleIdx=0, Type=4, Data="\0 \0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (164, "CacheLimit", Partial, 144, ... TitleIdx=0, Type=4, Data="\0 \0\0"}, 16, ) }, 16, ) == 0x0
 01478   396   NtClose  (164, ... ) == 0x0
 01479   396   NtClose  (160, ... ) == 0x0
 01480   396   NtClose  (152, ... ) == 0x0
 01481   396   NtClose  (156, ... ) == 0x0
 01482   396   NtClose  (148, ... ) == 0x0
 01483   396   NtOpenMutant  (0x100000, {24, 52, 0x0, 0, 0,  (0x100000, {24, 52, 0x0, 0, 0, "_!MSFTHISTORY!_"}, ... 148, ) }, ... 148, ) == 0x0
 01484   396   NtOpenMutant  (0x100000, {24, 52, 0x0, 0, 0,  (0x100000, {24, 52, 0x0, 0, 0, "c:!documents and settings!sri-user!local settings!temporary internet files!content.ie5!"}, ... 156, ) }, ... 156, ) == 0x0
 01485   396   NtWaitForSingleObject  (156, 0, 0x0, ... ) == 0x0
 01486   396   NtOpenFile  (0x100001, {24, 0, 0x40, 0, 0,  (0x100001, {24, 0, 0x40, 0, 0, "\??\C:\Documents and Settings\SRI-user\Local Settings\Temporary Internet Files\Content.IE5\"}, 3, 8388641, ... 152, {status=0x0, info=1}, ) }, 3, 8388641, ... 152, {status=0x0, info=1}, ) == 0x0
 01487   396   NtQueryVolumeInformationFile  (152, 1241580, 24, Size, ... {status=0x0, info=24}, ) == 0x0
 01488   396   NtClose  (152, ... ) == 0x0
 01489   396   NtOpenFile  (0x100001, {24, 0, 0x40, 0, 0,  (0x100001, {24, 0, 0x40, 0, 0, "\??\C:\"}, 3, 8388641, ... 152, {status=0x0, info=1}, ) }, 3, 8388641, ... 152, {status=0x0, info=1}, ) == 0x0
 01490   396   NtQueryVolumeInformationFile  (152, 1241604, 24, Size, ... {status=0x0, info=24}, ) == 0x0
 01491   396   NtClose  (152, ... ) == 0x0
 01492   396   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\Documents and Settings\SRI-user\Local Settings\Temporary Internet Files\Content.IE5\"}, 1241932, ... ) }, 1241932, ... ) == 0x0
 01493   396   NtOpenFile  (0x100100, {24, 0, 0x40, 0, 0,  (0x100100, {24, 0, 0x40, 0, 0, "\??\C:\Documents and Settings\SRI-user\Local Settings\Temporary Internet Files\Content.IE5\"}, 7, 2113568, ... 152, {status=0x0, info=1}, ) }, 7, 2113568, ... 152, {status=0x0, info=1}, ) == 0x0
 01494   396   NtSetInformationFile  (152, 1241908, 40, Basic, ... {status=0x0, info=0}, ) == 0x0
 01495   396   NtClose  (152, ... ) == 0x0
 01496   396   NtCreateFile  (0xc0100080, {24, 0, 0x40, 1377384, 1241924,  (0xc0100080, {24, 0, 0x40, 1377384, 1241924, "\??\C:\Documents and Settings\SRI-user\Local Settings\Temporary Internet Files\Content.IE5\index.dat"}, 0x0, 0, 3, 3, 2144, 0, 0, ... 152, {status=0x0, info=1}, ) }, 0x0, 0, 3, 3, 2144, 0, 0, ... 152, {status=0x0, info=1}, ) == 0x0
 01497   396   NtSetInformationFile  (152, 1241976, 40, Basic, ... {status=0x0, info=0}, ) == 0x0
 01498   396   NtQueryInformationFile  (152, 1241976, 24, Standard, ... {status=0x0, info=24}, ) == 0x0
 01499   396   NtClose  (152, ... ) == 0x0
 01500   396   NtCreateFile  (0xc0100080, {24, 0, 0x40, 1377384, 1241908,  (0xc0100080, {24, 0, 0x40, 1377384, 1241908, "\??\C:\Documents and Settings\SRI-user\Local Settings\Temporary Internet Files\Content.IE5\index.dat"}, 0x0, 0, 3, 3, 2144, 0, 0, ... 152, {status=0x0, info=1}, ) }, 0x0, 0, 3, 3, 2144, 0, 0, ... 152, {status=0x0, info=1}, ) == 0x0
 01501   396   NtOpenSection  (0x2, {24, 52, 0x0, 0, 0,  (0x2, {24, 52, 0x0, 0, 0, "C:_Documents and Settings_SRI-user_Local Settings_Temporary Internet Files_Content.IE5_index.dat_32768"}, ... 160, ) }, ... 160, ) == 0x0
 01502   396   NtMapViewOfSection  (160, -1, (0x0), 0, 0, {0, 0}, 0, 1, 0, 4, ... (0xa80000), {0, 0}, 32768, ) == 0x0
 01503   396   NtReleaseMutant  (156, ... 0x0, ) == 0x0
 01504   396   NtOpenMutant  (0x100000, {24, 52, 0x0, 0, 0,  (0x100000, {24, 52, 0x0, 0, 0, "c:!documents and settings!sri-user!cookies!"}, ... 164, ) }, ... 164, ) == 0x0
 01505   396   NtWaitForSingleObject  (164, 0, 0x0, ... ) == 0x0
 01506   396   NtOpenFile  (0x100001, {24, 0, 0x40, 0, 0,  (0x100001, {24, 0, 0x40, 0, 0, "\??\C:\Documents and Settings\SRI-user\Cookies\"}, 3, 8388641, ... 172, {status=0x0, info=1}, ) }, 3, 8388641, ... 172, {status=0x0, info=1}, ) == 0x0
 01507   396   NtQueryVolumeInformationFile  (172, 1241580, 24, Size, ... {status=0x0, info=24}, ) == 0x0
 01508   396   NtClose  (172, ... ) == 0x0
 01509   396   NtOpenFile  (0x100001, {24, 0, 0x40, 0, 0,  (0x100001, {24, 0, 0x40, 0, 0, "\??\C:\"}, 3, 8388641, ... 172, {status=0x0, info=1}, ) }, 3, 8388641, ... 172, {status=0x0, info=1}, ) == 0x0
 01510   396   NtQueryVolumeInformationFile  (172, 1241604, 24, Size, ... {status=0x0, info=24}, ) == 0x0
 01511   396   NtClose  (172, ... ) == 0x0
 01512   396   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\Documents and Settings\SRI-user\Cookies\"}, 1241932, ... ) }, 1241932, ... ) == 0x0
 01513   396   NtOpenFile  (0x100100, {24, 0, 0x40, 0, 0,  (0x100100, {24, 0, 0x40, 0, 0, "\??\C:\Documents and Settings\SRI-user\Cookies\"}, 7, 2113568, ... 172, {status=0x0, info=1}, ) }, 7, 2113568, ... 172, {status=0x0, info=1}, ) == 0x0
 01514   396   NtSetInformationFile  (172, 1241908, 40, Basic, ... {status=0x0, info=0}, ) == 0x0
 01515   396   NtClose  (172, ... ) == 0x0
 01516   396   NtCreateFile  (0xc0100080, {24, 0, 0x40, 1377384, 1241924,  (0xc0100080, {24, 0, 0x40, 1377384, 1241924, "\??\C:\Documents and Settings\SRI-user\Cookies\index.dat"}, 0x0, 0, 3, 3, 2144, 0, 0, ... 172, {status=0x0, info=1}, ) }, 0x0, 0, 3, 3, 2144, 0, 0, ... 172, {status=0x0, info=1}, ) == 0x0
 01517   396   NtSetInformationFile  (172, 1241976, 40, Basic, ... {status=0x0, info=0}, ) == 0x0
 01518   396   NtQueryInformationFile  (172, 1241976, 24, Standard, ... {status=0x0, info=24}, ) == 0x0
 01519   396   NtClose  (172, ... ) == 0x0
 01520   396   NtCreateFile  (0xc0100080, {24, 0, 0x40, 1377384, 1241908,  (0xc0100080, {24, 0, 0x40, 1377384, 1241908, "\??\C:\Documents and Settings\SRI-user\Cookies\index.dat"}, 0x0, 0, 3, 3, 2144, 0, 0, ... 172, {status=0x0, info=1}, ) }, 0x0, 0, 3, 3, 2144, 0, 0, ... 172, {status=0x0, info=1}, ) == 0x0
 01521   396   NtOpenSection  (0x2, {24, 52, 0x0, 0, 0,  (0x2, {24, 52, 0x0, 0, 0, "C:_Documents and Settings_SRI-user_Cookies_index.dat_16384"}, ... 196, ) }, ... 196, ) == 0x0
 01522   396   NtMapViewOfSection  (196, -1, (0x0), 0, 0, {0, 0}, 0, 1, 0, 4, ... (0xa90000), {0, 0}, 16384, ) == 0x0
 01523   396   NtReleaseMutant  (164, ... 0x0, ) == 0x0
 01524   396   NtOpenMutant  (0x100000, {24, 52, 0x0, 0, 0,  (0x100000, {24, 52, 0x0, 0, 0, "c:!documents and settings!sri-user!local settings!history!history.ie5!"}, ... 176, ) }, ... 176, ) == 0x0
 01525   396   NtWaitForSingleObject  (176, 0, 0x0, ... ) == 0x0
 01526   396   NtOpenFile  (0x100001, {24, 0, 0x40, 0, 0,  (0x100001, {24, 0, 0x40, 0, 0, "\??\C:\Documents and Settings\SRI-user\Local Settings\History\History.IE5\"}, 3, 8388641, ... 180, {status=0x0, info=1}, ) }, 3, 8388641, ... 180, {status=0x0, info=1}, ) == 0x0
 01527   396   NtQueryVolumeInformationFile  (180, 1241580, 24, Size, ... {status=0x0, info=24}, ) == 0x0
 01528   396   NtClose  (180, ... ) == 0x0
 01529   396   NtOpenFile  (0x100001, {24, 0, 0x40, 0, 0,  (0x100001, {24, 0, 0x40, 0, 0, "\??\C:\"}, 3, 8388641, ... 180, {status=0x0, info=1}, ) }, 3, 8388641, ... 180, {status=0x0, info=1}, ) == 0x0
 01530   396   NtQueryVolumeInformationFile  (180, 1241604, 24, Size, ... {status=0x0, info=24}, ) == 0x0
 01531   396   NtClose  (180, ... ) == 0x0
 01532   396   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\Documents and Settings\SRI-user\Local Settings\History\History.IE5\"}, 1241932, ... ) }, 1241932, ... ) == 0x0
 01533   396   NtOpenFile  (0x100100, {24, 0, 0x40, 0, 0,  (0x100100, {24, 0, 0x40, 0, 0, "\??\C:\Documents and Settings\SRI-user\Local Settings\History\History.IE5\"}, 7, 2113568, ... 180, {status=0x0, info=1}, ) }, 7, 2113568, ... 180, {status=0x0, info=1}, ) == 0x0
 01534   396   NtSetInformationFile  (180, 1241908, 40, Basic, ... {status=0x0, info=0}, ) == 0x0
 01535   396   NtClose  (180, ... ) == 0x0
 01536   396   NtCreateFile  (0xc0100080, {24, 0, 0x40, 1377384, 1241924,  (0xc0100080, {24, 0, 0x40, 1377384, 1241924, "\??\C:\Documents and Settings\SRI-user\Local Settings\History\History.IE5\index.dat"}, 0x0, 0, 3, 3, 2144, 0, 0, ... 180, {status=0x0, info=1}, ) }, 0x0, 0, 3, 3, 2144, 0, 0, ... 180, {status=0x0, info=1}, ) == 0x0
 01537   396   NtSetInformationFile  (180, 1241976, 40, Basic, ... {status=0x0, info=0}, ) == 0x0
 01538   396   NtQueryInformationFile  (180, 1241976, 24, Standard, ... {status=0x0, info=24}, ) == 0x0
 01539   396   NtClose  (180, ... ) == 0x0
 01540   396   NtCreateFile  (0xc0100080, {24, 0, 0x40, 1377384, 1241908,  (0xc0100080, {24, 0, 0x40, 1377384, 1241908, "\??\C:\Documents and Settings\SRI-user\Local Settings\History\History.IE5\index.dat"}, 0x0, 0, 3, 3, 2144, 0, 0, ... 180, {status=0x0, info=1}, ) }, 0x0, 0, 3, 3, 2144, 0, 0, ... 180, {status=0x0, info=1}, ) == 0x0
 01541   396   NtOpenSection  (0x2, {24, 52, 0x0, 0, 0,  (0x2, {24, 52, 0x0, 0, 0, "C:_Documents and Settings_SRI-user_Local Settings_History_History.IE5_index.dat_32768"}, ... 184, ) }, ... 184, ) == 0x0
 01542   396   NtMapViewOfSection  (184, -1, (0x0), 0, 0, {0, 0}, 0, 1, 0, 4, ... (0xaa0000), {0, 0}, 32768, ) == 0x0
 01543   396   NtReleaseMutant  (176, ... 0x0, ) == 0x0
 01544   396   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\Documents and Settings\SRI-user\Local Settings\Temporary Internet Files\Content.IE5\"}, 1241988, ... ) }, 1241988, ... ) == 0x0
 01545   396   NtOpenFile  (0x100100, {24, 0, 0x40, 0, 0,  (0x100100, {24, 0, 0x40, 0, 0, "\??\C:\Documents and Settings\SRI-user\Local Settings\Temporary Internet Files\Content.IE5\"}, 7, 2113568, ... 188, {status=0x0, info=1}, ) }, 7, 2113568, ... 188, {status=0x0, info=1}, ) == 0x0
 01546   396   NtSetInformationFile  (188, 1241964, 40, Basic, ... {status=0x0, info=0}, ) == 0x0
 01547   396   NtClose  (188, ... ) == 0x0
 01548   396   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\Documents and Settings\SRI-user\Local Settings\Temporary Internet Files\Content.IE5\desktop.ini"}, 1241988, ... ) }, 1241988, ... ) == 0x0
 01549   396   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\Documents and Settings\SRI-user\Local Settings\History\History.IE5\"}, 1241988, ... ) }, 1241988, ... ) == 0x0
 01550   396   NtOpenFile  (0x100100, {24, 0, 0x40, 0, 0,  (0x100100, {24, 0, 0x40, 0, 0, "\??\C:\Documents and Settings\SRI-user\Local Settings\History\History.IE5\"}, 7, 2113568, ... 188, {status=0x0, info=1}, ) }, 7, 2113568, ... 188, {status=0x0, info=1}, ) == 0x0
 01551   396   NtSetInformationFile  (188, 1241964, 40, Basic, ... {status=0x0, info=0}, ) == 0x0
 01552   396   NtClose  (188, ... ) == 0x0
 01553   396   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\Documents and Settings\SRI-user\Local Settings\History\History.IE5\desktop.ini"}, 1241988, ... ) }, 1241988, ... ) == 0x0
 01554   396   NtWaitForSingleObject  (156, 0, 0x0, ... ) == 0x0
 01555   396   NtQueryInformationFile  (152, 1240372, 24, Standard, ... {status=0x0, info=24}, ) == 0x0
 01556   396   NtReleaseMutant  (156, ... 0x0, ) == 0x0
 01557   396   NtOpenKey  (0xf, {24, 60, 0x40, 0, 0,  (0xf, {24, 60, 0x40, 0, 0, "Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache"}, ... 188, ) }, ... 188, ) == 0x0
 01558   396   NtOpenKey  (0xf, {24, 188, 0x40, 0, 0,  (0xf, {24, 188, 0x40, 0, 0, "Extensible Cache"}, ... 192, ) }, ... 192, ) == 0x0
 01559   396   NtClose  (188, ... ) == 0x0
 01560   396   NtWaitForSingleObject  (148, 0, {-600000000, -1}, ... ) == 0x0
 01561   396   NtEnumerateKey  (192, 0, Basic, 288, ... {LastWrite={0x89210de2,0x1c79d95}, TitleIdx=0, Name= (192, 0, Basic, 288, ... {LastWrite={0x89210de2,0x1c79d95}, TitleIdx=0, Name="MSHist012007051420070521"}, 64, ) }, 64, ) == 0x0
 01562   396   NtOpenKey  (0xf, {24, 192, 0x40, 0, 0,  (0xf, {24, 192, 0x40, 0, 0, "MSHist012007051420070521"}, ... 188, ) }, ... 188, ) == 0x0
 01563   396   NtQueryValueKey  (188,  (188, "CacheRepair", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (188, "CacheRepair", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) }, 16, ) == 0x0
 01564   396   NtQueryValueKey  (188,  (188, "CachePath", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 01565   396   NtQueryValueKey  (188,  (188, "CachePath", Partial, 162, ... TitleIdx=0, Type=2, Data="%\0U\0S\0E\0R\0P\0R\0O\0F\0I\0L\0E\0%\0\\0L\0o\0c\0a\0l\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0H\0i\0s\0t\0o\0r\0y\0\\0H\0i\0s\0t\0o\0r\0y\0.\0I\0E\05\0\\0M\0S\0H\0i\0s\0t\00\01\02\00\00\07\00\05\01\04\02\00\00\07\00\05\02\01\0\\0\0\0"}, 162, ) , Partial, 162, ... TitleIdx=0, Type=2, Data= (188, "CachePath", Partial, 162, ... TitleIdx=0, Type=2, Data="%\0U\0S\0E\0R\0P\0R\0O\0F\0I\0L\0E\0%\0\\0L\0o\0c\0a\0l\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0H\0i\0s\0t\0o\0r\0y\0\\0H\0i\0s\0t\0o\0r\0y\0.\0I\0E\05\0\\0M\0S\0H\0i\0s\0t\00\01\02\00\00\07\00\05\01\04\02\00\00\07\00\05\02\01\0\\0\0\0"}, 162, ) }, 162, ) == 0x0
 01566   396   NtQueryValueKey  (188,  (188, "CachePath", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 01567   396   NtQueryValueKey  (188,  (188, "CachePath", Partial, 162, ... TitleIdx=0, Type=2, Data="%\0U\0S\0E\0R\0P\0R\0O\0F\0I\0L\0E\0%\0\\0L\0o\0c\0a\0l\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0H\0i\0s\0t\0o\0r\0y\0\\0H\0i\0s\0t\0o\0r\0y\0.\0I\0E\05\0\\0M\0S\0H\0i\0s\0t\00\01\02\00\00\07\00\05\01\04\02\00\00\07\00\05\02\01\0\\0\0\0"}, 162, ) , Partial, 162, ... TitleIdx=0, Type=2, Data= (188, "CachePath", Partial, 162, ... TitleIdx=0, Type=2, Data="%\0U\0S\0E\0R\0P\0R\0O\0F\0I\0L\0E\0%\0\\0L\0o\0c\0a\0l\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0H\0i\0s\0t\0o\0r\0y\0\\0H\0i\0s\0t\0o\0r\0y\0.\0I\0E\05\0\\0M\0S\0H\0i\0s\0t\00\01\02\00\00\07\00\05\01\04\02\00\00\07\00\05\02\01\0\\0\0\0"}, 162, ) }, 162, ) == 0x0
 01568   396   NtQueryValueKey  (188,  (188, "CachePrefix", Partial, 144, ... TitleIdx=0, Type=1, Data=":\02\00\00\07\00\05\01\04\02\00\00\07\00\05\02\01\0:\0 \0\0\0"}, 52, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (188, "CachePrefix", Partial, 144, ... TitleIdx=0, Type=1, Data=":\02\00\00\07\00\05\01\04\02\00\00\07\00\05\02\01\0:\0 \0\0\0"}, 52, ) }, 52, ) == 0x0
 01569   396   NtQueryValueKey  (188,  (188, "CachePrefix", Partial, 144, ... TitleIdx=0, Type=1, Data=":\02\00\00\07\00\05\01\04\02\00\00\07\00\05\02\01\0:\0 \0\0\0"}, 52, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (188, "CachePrefix", Partial, 144, ... TitleIdx=0, Type=1, Data=":\02\00\00\07\00\05\01\04\02\00\00\07\00\05\02\01\0:\0 \0\0\0"}, 52, ) }, 52, ) == 0x0
 01570   396   NtQueryValueKey  (188,  (188, "CacheLimit", Partial, 144, ... TitleIdx=0, Type=4, Data="\0 \0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (188, "CacheLimit", Partial, 144, ... TitleIdx=0, Type=4, Data="\0 \0\0"}, 16, ) }, 16, ) == 0x0
 01571   396   NtQueryValueKey  (188,  (188, "CacheOptions", Partial, 144, ... TitleIdx=0, Type=4, Data="\13\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (188, "CacheOptions", Partial, 144, ... TitleIdx=0, Type=4, Data="\13\0\0\0"}, 16, ) }, 16, ) == 0x0
 01572   396   NtClose  (188, ... ) == 0x0
 01573   396   NtEnumerateKey  (192, 1, Basic, 288, ... {LastWrite={0xfe4bb184,0x1c7a3a9}, TitleIdx=0, Name= (192, 1, Basic, 288, ... {LastWrite={0xfe4bb184,0x1c7a3a9}, TitleIdx=0, Name="MSHist012007052120070528"}, 64, ) }, 64, ) == 0x0
 01574   396   NtOpenKey  (0xf, {24, 192, 0x40, 0, 0,  (0xf, {24, 192, 0x40, 0, 0, "MSHist012007052120070528"}, ... 188, ) }, ... 188, ) == 0x0
 01575   396   NtQueryValueKey  (188,  (188, "CacheRepair", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (188, "CacheRepair", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) }, 16, ) == 0x0
 01576   396   NtQueryValueKey  (188,  (188, "CachePath", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 01577   396   NtQueryValueKey  (188,  (188, "CachePath", Partial, 162, ... TitleIdx=0, Type=2, Data="%\0U\0S\0E\0R\0P\0R\0O\0F\0I\0L\0E\0%\0\\0L\0o\0c\0a\0l\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0H\0i\0s\0t\0o\0r\0y\0\\0H\0i\0s\0t\0o\0r\0y\0.\0I\0E\05\0\\0M\0S\0H\0i\0s\0t\00\01\02\00\00\07\00\05\02\01\02\00\00\07\00\05\02\08\0\\0\0\0"}, 162, ) , Partial, 162, ... TitleIdx=0, Type=2, Data= (188, "CachePath", Partial, 162, ... TitleIdx=0, Type=2, Data="%\0U\0S\0E\0R\0P\0R\0O\0F\0I\0L\0E\0%\0\\0L\0o\0c\0a\0l\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0H\0i\0s\0t\0o\0r\0y\0\\0H\0i\0s\0t\0o\0r\0y\0.\0I\0E\05\0\\0M\0S\0H\0i\0s\0t\00\01\02\00\00\07\00\05\02\01\02\00\00\07\00\05\02\08\0\\0\0\0"}, 162, ) }, 162, ) == 0x0
 01578   396   NtQueryValueKey  (188,  (188, "CachePath", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 01579   396   NtQueryValueKey  (188,  (188, "CachePath", Partial, 162, ... TitleIdx=0, Type=2, Data="%\0U\0S\0E\0R\0P\0R\0O\0F\0I\0L\0E\0%\0\\0L\0o\0c\0a\0l\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0H\0i\0s\0t\0o\0r\0y\0\\0H\0i\0s\0t\0o\0r\0y\0.\0I\0E\05\0\\0M\0S\0H\0i\0s\0t\00\01\02\00\00\07\00\05\02\01\02\00\00\07\00\05\02\08\0\\0\0\0"}, 162, ) , Partial, 162, ... TitleIdx=0, Type=2, Data= (188, "CachePath", Partial, 162, ... TitleIdx=0, Type=2, Data="%\0U\0S\0E\0R\0P\0R\0O\0F\0I\0L\0E\0%\0\\0L\0o\0c\0a\0l\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0H\0i\0s\0t\0o\0r\0y\0\\0H\0i\0s\0t\0o\0r\0y\0.\0I\0E\05\0\\0M\0S\0H\0i\0s\0t\00\01\02\00\00\07\00\05\02\01\02\00\00\07\00\05\02\08\0\\0\0\0"}, 162, ) }, 162, ) == 0x0
 01580   396   NtQueryValueKey  (188,  (188, "CachePrefix", Partial, 144, ... TitleIdx=0, Type=1, Data=":\02\00\00\07\00\05\02\01\02\00\00\07\00\05\02\08\0:\0 \0\0\0"}, 52, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (188, "CachePrefix", Partial, 144, ... TitleIdx=0, Type=1, Data=":\02\00\00\07\00\05\02\01\02\00\00\07\00\05\02\08\0:\0 \0\0\0"}, 52, ) }, 52, ) == 0x0
 01581   396   NtQueryValueKey  (188,  (188, "CachePrefix", Partial, 144, ... TitleIdx=0, Type=1, Data=":\02\00\00\07\00\05\02\01\02\00\00\07\00\05\02\08\0:\0 \0\0\0"}, 52, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (188, "CachePrefix", Partial, 144, ... TitleIdx=0, Type=1, Data=":\02\00\00\07\00\05\02\01\02\00\00\07\00\05\02\08\0:\0 \0\0\0"}, 52, ) }, 52, ) == 0x0
 01582   396   NtQueryValueKey  (188,  (188, "CacheLimit", Partial, 144, ... TitleIdx=0, Type=4, Data="\0 \0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (188, "CacheLimit", Partial, 144, ... TitleIdx=0, Type=4, Data="\0 \0\0"}, 16, ) }, 16, ) == 0x0
 01583   396   NtQueryValueKey  (188,  (188, "CacheOptions", Partial, 144, ... TitleIdx=0, Type=4, Data="\13\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (188, "CacheOptions", Partial, 144, ... TitleIdx=0, Type=4, Data="\13\0\0\0"}, 16, ) }, 16, ) == 0x0
 01584   396   NtClose  (188, ... ) == 0x0
 01585   396   NtEnumerateKey  (192, 2, Basic, 288, ... {LastWrite={0xfe4e13de,0x1c7a3a9}, TitleIdx=0, Name= (192, 2, Basic, 288, ... {LastWrite={0xfe4e13de,0x1c7a3a9}, TitleIdx=0, Name="MSHist012007053120070601"}, 64, ) }, 64, ) == 0x0
 01586   396   NtOpenKey  (0xf, {24, 192, 0x40, 0, 0,  (0xf, {24, 192, 0x40, 0, 0, "MSHist012007053120070601"}, ... 188, ) }, ... 188, ) == 0x0
 01587   396   NtQueryValueKey  (188,  (188, "CacheRepair", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (188, "CacheRepair", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) }, 16, ) == 0x0
 01588   396   NtQueryValueKey  (188,  (188, "CachePath", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 01589   396   NtQueryValueKey  (188,  (188, "CachePath", Partial, 162, ... TitleIdx=0, Type=2, Data="%\0U\0S\0E\0R\0P\0R\0O\0F\0I\0L\0E\0%\0\\0L\0o\0c\0a\0l\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0H\0i\0s\0t\0o\0r\0y\0\\0H\0i\0s\0t\0o\0r\0y\0.\0I\0E\05\0\\0M\0S\0H\0i\0s\0t\00\01\02\00\00\07\00\05\03\01\02\00\00\07\00\06\00\01\0\\0\0\0"}, 162, ) , Partial, 162, ... TitleIdx=0, Type=2, Data= (188, "CachePath", Partial, 162, ... TitleIdx=0, Type=2, Data="%\0U\0S\0E\0R\0P\0R\0O\0F\0I\0L\0E\0%\0\\0L\0o\0c\0a\0l\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0H\0i\0s\0t\0o\0r\0y\0\\0H\0i\0s\0t\0o\0r\0y\0.\0I\0E\05\0\\0M\0S\0H\0i\0s\0t\00\01\02\00\00\07\00\05\03\01\02\00\00\07\00\06\00\01\0\\0\0\0"}, 162, ) }, 162, ) == 0x0
 01590   396   NtQueryValueKey  (188,  (188, "CachePath", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 01591   396   NtQueryValueKey  (188,  (188, "CachePath", Partial, 162, ... TitleIdx=0, Type=2, Data="%\0U\0S\0E\0R\0P\0R\0O\0F\0I\0L\0E\0%\0\\0L\0o\0c\0a\0l\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0H\0i\0s\0t\0o\0r\0y\0\\0H\0i\0s\0t\0o\0r\0y\0.\0I\0E\05\0\\0M\0S\0H\0i\0s\0t\00\01\02\00\00\07\00\05\03\01\02\00\00\07\00\06\00\01\0\\0\0\0"}, 162, ) , Partial, 162, ... TitleIdx=0, Type=2, Data= (188, "CachePath", Partial, 162, ... TitleIdx=0, Type=2, Data="%\0U\0S\0E\0R\0P\0R\0O\0F\0I\0L\0E\0%\0\\0L\0o\0c\0a\0l\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0H\0i\0s\0t\0o\0r\0y\0\\0H\0i\0s\0t\0o\0r\0y\0.\0I\0E\05\0\\0M\0S\0H\0i\0s\0t\00\01\02\00\00\07\00\05\03\01\02\00\00\07\00\06\00\01\0\\0\0\0"}, 162, ) }, 162, ) == 0x0
 01592   396   NtQueryValueKey  (188,  (188, "CachePrefix", Partial, 144, ... TitleIdx=0, Type=1, Data=":\02\00\00\07\00\05\03\01\02\00\00\07\00\06\00\01\0:\0 \0\0\0"}, 52, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (188, "CachePrefix", Partial, 144, ... TitleIdx=0, Type=1, Data=":\02\00\00\07\00\05\03\01\02\00\00\07\00\06\00\01\0:\0 \0\0\0"}, 52, ) }, 52, ) == 0x0
 01593   396   NtQueryValueKey  (188,  (188, "CachePrefix", Partial, 144, ... TitleIdx=0, Type=1, Data=":\02\00\00\07\00\05\03\01\02\00\00\07\00\06\00\01\0:\0 \0\0\0"}, 52, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (188, "CachePrefix", Partial, 144, ... TitleIdx=0, Type=1, Data=":\02\00\00\07\00\05\03\01\02\00\00\07\00\06\00\01\0:\0 \0\0\0"}, 52, ) }, 52, ) == 0x0
 01594   396   NtQueryValueKey  (188,  (188, "CacheLimit", Partial, 144, ... TitleIdx=0, Type=4, Data="\0 \0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (188, "CacheLimit", Partial, 144, ... TitleIdx=0, Type=4, Data="\0 \0\0"}, 16, ) }, 16, ) == 0x0
 01595   396   NtQueryValueKey  (188,  (188, "CacheOptions", Partial, 144, ... TitleIdx=0, Type=4, Data="\13\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (188, "CacheOptions", Partial, 144, ... TitleIdx=0, Type=4, Data="\13\0\0\0"}, 16, ) }, 16, ) == 0x0
 01596   396   NtClose  (188, ... ) == 0x0
 01597   396   NtEnumerateKey  (192, 3, Basic, 288, ... ) == STATUS_NO_MORE_ENTRIES
 01598   396   NtReleaseMutant  (148, ... 0x0, ) == 0x0
 01599   396   NtClose  (192, ... ) == 0x0
 01600   396   NtWaitForSingleObject  (156, 0, 0x0, ... ) == 0x0
 01601   396   NtQueryInformationFile  (152, 1242300, 24, Standard, ... {status=0x0, info=24}, ) == 0x0
 01602   396   NtReleaseMutant  (156, ... 0x0, ) == 0x0
 01603   396   NtWaitForSingleObject  (156, 0, 0x0, ... ) == 0x0
 01604   396   NtQueryInformationFile  (152, 1242372, 24, Standard, ... {status=0x0, info=24}, ) == 0x0
 01605   396   NtReleaseMutant  (156, ... 0x0, ) == 0x0
 01606   396   NtOpenKey  (0x1, {24, 60, 0x40, 0, 0,  (0x1, {24, 60, 0x40, 0, 0, "SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01607   396   NtOpenKey  (0x1, {24, 60, 0x40, 0, 0,  (0x1, {24, 60, 0x40, 0, 0, "SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01608   396   NtOpenKey  (0x1, {24, 60, 0x40, 0, 0,  (0x1, {24, 60, 0x40, 0, 0, "SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01609   396   NtOpenKey  (0x1, {24, 60, 0x40, 0, 0,  (0x1, {24, 60, 0x40, 0, 0, "SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01610   396   NtOpenKey  (0x1, {24, 60, 0x40, 0, 0,  (0x1, {24, 60, 0x40, 0, 0, "SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01611   396   NtOpenKey  (0x1, {24, 48, 0x40, 0, 0,  (0x1, {24, 48, 0x40, 0, 0, "SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings"}, ... 192, ) }, ... 192, ) == 0x0
 01612   396   NtQueryValueKey  (192,  (192, "DisableWorkerThreadHibernation", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01613   396   NtClose  (192, ... ) == 0x0
 01614   396   NtQueryValueKey  (108,  (108, "DisableWorkerThreadHibernation", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01615   396   NtQueryValueKey  (108,  (108, "DisableReadRange", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01616   396   NtQueryValueKey  (108,  (108, "SocketSendBufferLength", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01617   396   NtQueryValueKey  (108,  (108, "SocketReceiveBufferLength", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01618   396   NtQueryValueKey  (108,  (108, "KeepAliveTimeout", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01619   396   NtQueryValueKey  (108,  (108, "MaxHttpRedirects", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01620   396   NtQueryValueKey  (108,  (108, "MaxConnectionsPerServer", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01621   396   NtQueryValueKey  (108,  (108, "MaxConnectionsPer1_0Server", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01622   396   NtQueryValueKey  (108,  (108, "ServerInfoTimeout", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01623   396   NtQueryValueKey  (108,  (108, "ReceiveTimeOut", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01624   396   NtQueryValueKey  (108,  (108, "DisableNTLMPreAuth", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01625   396   NtQueryValueKey  (108,  (108, "ScavengeCacheLowerBound", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01626   396   NtOpenKey  (0x1, {24, 60, 0x40, 0, 0,  (0x1, {24, 60, 0x40, 0, 0, "SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache"}, ... 192, ) }, ... 192, ) == 0x0
 01627   396   NtQueryValueKey  (192,  (192, "ScavengeCacheFileLifeTime", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01628   396   NtClose  (192, ... ) == 0x0
 01629   396   NtQueryValueKey  (108,  (108, "HttpDefaultExpiryTimeSecs", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01630   396   NtQueryValueKey  (108,  (108, "FtpDefaultExpiryTimeSecs", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01631   396   NtQueryValueKey  (108,  (108, "GopherDefaultExpiryTimeSecs", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01632   396   NtQueryValueKey  (108,  (108, "DisableCachingOfSSLPages", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01633   396   NtQueryValueKey  (108,  (108, "PerUserCookies", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01634   396   NtQueryValueKey  (108,  (108, "LeashLegacyCookies", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01635   396   NtQueryValueKey  (108,  (108, "DisableNT4RasCheck", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01636   396   NtQueryValueKey  (108,  (108, "DialupUseLanSettings", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01637   396   NtQueryValueKey  (108,  (108, "SendExtraCRLF", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01638   396   NtOpenKey  (0x1, {24, 48, 0x40, 0, 0,  (0x1, {24, 48, 0x40, 0, 0, "SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings"}, ... 192, ) }, ... 192, ) == 0x0
 01639   396   NtQueryValueKey  (192,  (192, "DontUseDNSLoadBalancing", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01640   396   NtClose  (192, ... ) == 0x0
 01641   396   NtQueryValueKey  (108,  (108, "DontUseDNSLoadBalancing", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01642   396   NtQueryValueKey  (108,  (108, "NonBlockingClient32", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01643   396   NtQueryValueKey  (108,  (108, "MimeExclusionListForCache", Partial, 144, ... TitleIdx=0, Type=1, Data="m\0u\0l\0t\0i\0p\0a\0r\0t\0/\0m\0i\0x\0e\0d\0 \0m\0u\0l\0t\0i\0p\0a\0r\0t\0/\0x\0-\0m\0i\0x\0e\0d\0-\0r\0e\0p\0l\0a\0c\0e\0 \0m\0u\0l\0t\0i\0p\0a\0r\0t\0/\0x\0-\0b\0y\0t\0e\0r\0a\0n\0g\0e\0s\0 \0\0\0"}, 144, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (108, "MimeExclusionListForCache", Partial, 144, ... TitleIdx=0, Type=1, Data="m\0u\0l\0t\0i\0p\0a\0r\0t\0/\0m\0i\0x\0e\0d\0 \0m\0u\0l\0t\0i\0p\0a\0r\0t\0/\0x\0-\0m\0i\0x\0e\0d\0-\0r\0e\0p\0l\0a\0c\0e\0 \0m\0u\0l\0t\0i\0p\0a\0r\0t\0/\0x\0-\0b\0y\0t\0e\0r\0a\0n\0g\0e\0s\0 \0\0\0"}, 144, ) }, 144, ) == 0x0
 01644   396   NtQueryValueKey  (108,  (108, "MimeExclusionListForCache", Partial, 144, ... TitleIdx=0, Type=1, Data="m\0u\0l\0t\0i\0p\0a\0r\0t\0/\0m\0i\0x\0e\0d\0 \0m\0u\0l\0t\0i\0p\0a\0r\0t\0/\0x\0-\0m\0i\0x\0e\0d\0-\0r\0e\0p\0l\0a\0c\0e\0 \0m\0u\0l\0t\0i\0p\0a\0r\0t\0/\0x\0-\0b\0y\0t\0e\0r\0a\0n\0g\0e\0s\0 \0\0\0"}, 144, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (108, "MimeExclusionListForCache", Partial, 144, ... TitleIdx=0, Type=1, Data="m\0u\0l\0t\0i\0p\0a\0r\0t\0/\0m\0i\0x\0e\0d\0 \0m\0u\0l\0t\0i\0p\0a\0r\0t\0/\0x\0-\0m\0i\0x\0e\0d\0-\0r\0e\0p\0l\0a\0c\0e\0 \0m\0u\0l\0t\0i\0p\0a\0r\0t\0/\0x\0-\0b\0y\0t\0e\0r\0a\0n\0g\0e\0s\0 \0\0\0"}, 144, ) }, 144, ) == 0x0
 01645   396   NtQueryValueKey  (108,  (108, "MimeExclusionListForCache", Partial, 144, ... TitleIdx=0, Type=1, Data="m\0u\0l\0t\0i\0p\0a\0r\0t\0/\0m\0i\0x\0e\0d\0 \0m\0u\0l\0t\0i\0p\0a\0r\0t\0/\0x\0-\0m\0i\0x\0e\0d\0-\0r\0e\0p\0l\0a\0c\0e\0 \0m\0u\0l\0t\0i\0p\0a\0r\0t\0/\0x\0-\0b\0y\0t\0e\0r\0a\0n\0g\0e\0s\0 \0\0\0"}, 144, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (108, "MimeExclusionListForCache", Partial, 144, ... TitleIdx=0, Type=1, Data="m\0u\0l\0t\0i\0p\0a\0r\0t\0/\0m\0i\0x\0e\0d\0 \0m\0u\0l\0t\0i\0p\0a\0r\0t\0/\0x\0-\0m\0i\0x\0e\0d\0-\0r\0e\0p\0l\0a\0c\0e\0 \0m\0u\0l\0t\0i\0p\0a\0r\0t\0/\0x\0-\0b\0y\0t\0e\0r\0a\0n\0g\0e\0s\0 \0\0\0"}, 144, ) }, 144, ) == 0x0
 01646   396   NtQueryValueKey  (108,  (108, "MimeExclusionListForCache", Partial, 144, ... TitleIdx=0, Type=1, Data="m\0u\0l\0t\0i\0p\0a\0r\0t\0/\0m\0i\0x\0e\0d\0 \0m\0u\0l\0t\0i\0p\0a\0r\0t\0/\0x\0-\0m\0i\0x\0e\0d\0-\0r\0e\0p\0l\0a\0c\0e\0 \0m\0u\0l\0t\0i\0p\0a\0r\0t\0/\0x\0-\0b\0y\0t\0e\0r\0a\0n\0g\0e\0s\0 \0\0\0"}, 144, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (108, "MimeExclusionListForCache", Partial, 144, ... TitleIdx=0, Type=1, Data="m\0u\0l\0t\0i\0p\0a\0r\0t\0/\0m\0i\0x\0e\0d\0 \0m\0u\0l\0t\0i\0p\0a\0r\0t\0/\0x\0-\0m\0i\0x\0e\0d\0-\0r\0e\0p\0l\0a\0c\0e\0 \0m\0u\0l\0t\0i\0p\0a\0r\0t\0/\0x\0-\0b\0y\0t\0e\0r\0a\0n\0g\0e\0s\0 \0\0\0"}, 144, ) }, 144, ) == 0x0
 01647   396   NtQueryValueKey  (108,  (108, "HeaderExclusionListForCache", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01648   396   NtQueryValueKey  (108,  (108, "DnsCacheEnabled", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01649   396   NtQueryValueKey  (108,  (108, "DnsCacheEntries", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01650   396   NtQueryValueKey  (108,  (108, "DnsCacheTimeout", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01651   396   NtQueryValueKey  (108,  (108, "WarnOnPost", Partial, 144, ... TitleIdx=0, Type=3, Data="\1\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=3, Data= (108, "WarnOnPost", Partial, 144, ... TitleIdx=0, Type=3, Data="\1\0\0\0"}, 16, ) }, 16, ) == 0x0
 01652   396   NtQueryValueKey  (108,  (108, "WarnAlwaysOnPost", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01653   396   NtQueryValueKey  (108,  (108, "WarnOnZoneCrossing", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01654   396   NtQueryValueKey  (108,  (108, "WarnOnBadCertSending", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01655   396   NtQueryValueKey  (108,  (108, "WarnOnBadCertRecving", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01656   396   NtQueryValueKey  (108,  (108, "WarnOnPostRedirect", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01657   396   NtQueryValueKey  (108,  (108, "AlwaysDrainOnRedirect", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01658   396   NtOpenMutant  (0x100000, {24, 52, 0x0, 0, 0,  (0x100000, {24, 52, 0x0, 0, 0, "WininetStartupMutex"}, ... 192, ) }, ... 192, ) == 0x0
 01659   396   NtCreateEvent  (0x1f0003, 0x0, 1, 1, ... 188, ) == 0x0
 01660   396   NtQueryValueKey  (108,  (108, "GlobalUserOffline", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01661   396   NtWaitForSingleObject  (156, 0, 0x0, ... ) == 0x0
 01662   396   NtQueryInformationFile  (152, 1242348, 24, Standard, ... {status=0x0, info=24}, ) == 0x0
 01663   396   NtReleaseMutant  (156, ... 0x0, ) == 0x0
 01664   396   NtOpenMutant  (0x100000, {24, 52, 0x0, 0, 0,  (0x100000, {24, 52, 0x0, 0, 0, "WininetConnectionMutex"}, ... 200, ) }, ... 200, ) == 0x0
 01665   396   NtCreateMutant  (0x1f0001, 0x0, 0, ... 204, ) == 0x0
 01666   396   NtOpenMutant  (0x100000, {24, 52, 0x0, 0, 0,  (0x100000, {24, 52, 0x0, 0, 0, "WininetProxyRegistryMutex"}, ... 208, ) }, ... 208, ) == 0x0
 01667   396   NtQueryValueKey  (108,  (108, "EnableAutodial", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (108, "EnableAutodial", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) }, 16, ) == 0x0
 01668   396   NtQueryValueKey  (108,  (108, "NoNetAutodial", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (108, "NoNetAutodial", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) }, 16, ) == 0x0
 01669   396   NtOpenKey  (0x1, {24, 48, 0x40, 0, 0,  (0x1, {24, 48, 0x40, 0, 0, "SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings"}, ... 212, ) }, ... 212, ) == 0x0
 01670   396   NtQueryValueKey  (212,  (212, "UrlEncoding", Partial, 144, ... TitleIdx=0, Type=1, Data="0\0x\00\00\00\00\00\00\00\00\0\0\0"}, 34, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (212, "UrlEncoding", Partial, 144, ... TitleIdx=0, Type=1, Data="0\0x\00\00\00\00\00\00\00\00\0\0\0"}, 34, ) }, 34, ) == 0x0
 01671   396   NtQueryValueKey  (212,  (212, "UrlEncoding", Partial, 144, ... TitleIdx=0, Type=1, Data="0\0x\00\00\00\00\00\00\00\00\0\0\0"}, 34, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (212, "UrlEncoding", Partial, 144, ... TitleIdx=0, Type=1, Data="0\0x\00\00\00\00\00\00\00\00\0\0\0"}, 34, ) }, 34, ) == 0x0
 01672   396   NtClose  (212, ... ) == 0x0
 01673   396   NtWaitForSingleObject  (200, 0, 0x0, ... ) == 0x0
 01674   396   NtWaitForSingleObject  (204, 0, 0x0, ... ) == 0x0
 01675   396   NtOpenSection  (0xe, {24, 8, 0x40, 0, 0,  (0xe, {24, 8, 0x40, 0, 0, "RASAPI32.DLL"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01676   396   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\u:\work\RASAPI32.DLL"}, 1240736, ... ) }, 1240736, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01677   396   NtQueryAttributesFile  ({24, 12, 0x40, 0, 0,  ({24, 12, 0x40, 0, 0, "RASAPI32.DLL"}, 1240736, ... ) }, 1240736, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01678   396   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\System32\RASAPI32.DLL"}, 1240736, ... ) }, 1240736, ... ) == 0x0
 01679   396   NtOpenFile  (0x100020, {24, 0, 0x40, 0, 0,  (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\System32\RASAPI32.DLL"}, 5, 96, ... 212, {status=0x0, info=1}, ) }, 5, 96, ... 212, {status=0x0, info=1}, ) == 0x0
 01680   396   NtCreateSection  (0xf, 0x0, 0x0, 16, 16777216, 212, ... 216, ) == 0x0
 01681   396   NtQuerySection  (216, Image, 48, ... {section info, class 1, size 48}, 0x0, ) == 0x0
 01682   396   NtClose  (212, ... ) == 0x0
 01683   396   NtMapViewOfSection  (216, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x76ee0000), 0x0, 225280, ) == 0x0
 01684   396   NtClose  (216, ... ) == 0x0
 01685   396   NtOpenSection  (0xe, {24, 8, 0x40, 0, 0,  (0xe, {24, 8, 0x40, 0, 0, "rasman.dll"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01686   396   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\u:\work\rasman.dll"}, 1239932, ... ) }, 1239932, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01687   396   NtQueryAttributesFile  ({24, 12, 0x40, 0, 0,  ({24, 12, 0x40, 0, 0, "rasman.dll"}, 1239932, ... ) }, 1239932, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01688   396   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\System32\rasman.dll"}, 1239932, ... ) }, 1239932, ... ) == 0x0
 01689   396   NtOpenFile  (0x100020, {24, 0, 0x40, 0, 0,  (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\System32\rasman.dll"}, 5, 96, ... 216, {status=0x0, info=1}, ) }, 5, 96, ... 216, {status=0x0, info=1}, ) == 0x0
 01690   396   NtCreateSection  (0xf, 0x0, 0x0, 16, 16777216, 216, ... 212, ) == 0x0
 01691   396   NtQuerySection  (212, Image, 48, ... {section info, class 1, size 48}, 0x0, ) == 0x0
 01692   396   NtClose  (216, ... ) == 0x0
 01693   396   NtMapViewOfSection  (212, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x76e90000), 0x0, 69632, ) == 0x0
 01694   396   NtClose  (212, ... ) == 0x0
 01695   396   NtOpenSection  (0xe, {24, 8, 0x40, 0, 0,  (0xe, {24, 8, 0x40, 0, 0, "NETAPI32.dll"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01696   396   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\u:\work\NETAPI32.dll"}, 1239128, ... ) }, 1239128, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01697   396   NtQueryAttributesFile  ({24, 12, 0x40, 0, 0,  ({24, 12, 0x40, 0, 0, "NETAPI32.dll"}, 1239128, ... ) }, 1239128, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01698   396   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\System32\NETAPI32.dll"}, 1239128, ... ) }, 1239128, ... ) == 0x0
 01699   396   NtOpenFile  (0x100020, {24, 0, 0x40, 0, 0,  (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\System32\NETAPI32.dll"}, 5, 96, ... 212, {status=0x0, info=1}, ) }, 5, 96, ... 212, {status=0x0, info=1}, ) == 0x0
 01700   396   NtCreateSection  (0xf, 0x0, 0x0, 16, 16777216, 212, ... 216, ) == 0x0
 01701   396   NtQuerySection  (216, Image, 48, ... {section info, class 1, size 48}, 0x0, ) == 0x0
 01702   396   NtClose  (212, ... ) == 0x0
 01703   396   NtMapViewOfSection  (216, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x71c20000), 0x0, 323584, ) == 0x0
 01704   396   NtClose  (216, ... ) == 0x0
 01705   396   NtOpenSection  (0xe, {24, 8, 0x40, 0, 0,  (0xe, {24, 8, 0x40, 0, 0, "TAPI32.dll"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01706   396   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\u:\work\TAPI32.dll"}, 1239932, ... ) }, 1239932, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01707   396   NtQueryAttributesFile  ({24, 12, 0x40, 0, 0,  ({24, 12, 0x40, 0, 0, "TAPI32.dll"}, 1239932, ... ) }, 1239932, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01708   396   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\System32\TAPI32.dll"}, 1239932, ... ) }, 1239932, ... ) == 0x0
 01709   396   NtOpenFile  (0x100020, {24, 0, 0x40, 0, 0,  (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\System32\TAPI32.dll"}, 5, 96, ... 216, {status=0x0, info=1}, ) }, 5, 96, ... 216, {status=0x0, info=1}, ) == 0x0
 01710   396   NtCreateSection  (0xf, 0x0, 0x0, 16, 16777216, 216, ... 212, ) == 0x0
 01711   396   NtQuerySection  (212, Image, 48, ... {section info, class 1, size 48}, 0x0, ) == 0x0
 01712   396   NtClose  (216, ... ) == 0x0
 01713   396   NtMapViewOfSection  (212, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x76eb0000), 0x0, 172032, ) == 0x0
 01714   396   NtClose  (212, ... ) == 0x0
 01715   396   NtOpenSection  (0xe, {24, 8, 0x40, 0, 0,  (0xe, {24, 8, 0x40, 0, 0, "rtutils.dll"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01716   396   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\u:\work\rtutils.dll"}, 1239128, ... ) }, 1239128, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01717   396   NtQueryAttributesFile  ({24, 12, 0x40, 0, 0,  ({24, 12, 0x40, 0, 0, "rtutils.dll"}, 1239128, ... ) }, 1239128, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01718   396   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\System32\rtutils.dll"}, 1239128, ... ) }, 1239128, ... ) == 0x0
 01719   396   NtOpenFile  (0x100020, {24, 0, 0x40, 0, 0,  (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\System32\rtutils.dll"}, 5, 96, ... 212, {status=0x0, info=1}, ) }, 5, 96, ... 212, {status=0x0, info=1}, ) == 0x0
 01720   396   NtCreateSection  (0xf, 0x0, 0x0, 16, 16777216, 212, ... 216, ) == 0x0
 01721   396   NtQuerySection  (216, Image, 48, ... {section info, class 1, size 48}, 0x0, ) == 0x0
 01722   396   NtClose  (212, ... ) == 0x0
 01723   396   NtMapViewOfSection  (216, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x76e80000), 0x0, 53248, ) == 0x0
 01724   396   NtClose  (216, ... ) == 0x0
 01725   396   NtOpenSection  (0xe, {24, 8, 0x40, 0, 0,  (0xe, {24, 8, 0x40, 0, 0, "WINMM.dll"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01726   396   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\u:\work\WINMM.dll"}, 1239128, ... ) }, 1239128, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01727   396   NtQueryAttributesFile  ({24, 12, 0x40, 0, 0,  ({24, 12, 0x40, 0, 0, "WINMM.dll"}, 1239128, ... ) }, 1239128, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01728   396   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\System32\WINMM.dll"}, 1239128, ... ) }, 1239128, ... ) == 0x0
 01729   396   NtOpenFile  (0x100020, {24, 0, 0x40, 0, 0,  (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\System32\WINMM.dll"}, 5, 96, ... 216, {status=0x0, info=1}, ) }, 5, 96, ... 216, {status=0x0, info=1}, ) == 0x0
 01730   396   NtCreateSection  (0xf, 0x0, 0x0, 16, 16777216, 216, ... 212, ) == 0x0
 01731   396   NtQuerySection  (212, Image, 48, ... {section info, class 1, size 48}, 0x0, ) == 0x0
 01732   396   NtClose  (216, ... ) == 0x0
 01733   396   NtMapViewOfSection  (212, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x76b40000), 0x0, 180224, ) == 0x0
 01734   396   NtClose  (212, ... ) == 0x0
 01735   396   NtCreateEvent  (0x1f0003, 0x0, 0, 0, ... 212, ) == 0x0
 01736   396   NtCreateSemaphore  (0x100003, 0x0, 0, 2147483647, ... 216, ) == 0x0
 01737   396   NtCreateSemaphore  (0x100003, 0x0, 0, 2147483647, ... 220, ) == 0x0
 01738   396   NtOpenKey  (0x80000000, {24, 0, 0x40, 0, 0,  (0x80000000, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\DRIVERS32"}, ... 224, ) }, ... 224, ) == 0x0
 01739   396   NtQueryValueKey  (224,  (224, "wave", Partial, 536, ... ) , Partial, 536, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01740   396   NtQueryValueKey  (224,  (224, "wave1", Partial, 536, ... ) , Partial, 536, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01741   396   NtQueryValueKey  (224,  (224, "wave2", Partial, 536, ... ) , Partial, 536, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01742   396   NtQueryValueKey  (224,  (224, "wave3", Partial, 536, ... ) , Partial, 536, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01743   396   NtQueryValueKey  (224,  (224, "wave4", Partial, 536, ... ) , Partial, 536, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01744   396   NtQueryValueKey  (224,  (224, "wave5", Partial, 536, ... ) , Partial, 536, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01745   396   NtQueryValueKey  (224,  (224, "wave6", Partial, 536, ... ) , Partial, 536, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01746   396   NtQueryValueKey  (224,  (224, "wave7", Partial, 536, ... ) , Partial, 536, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01747   396   NtQueryValueKey  (224,  (224, "wave8", Partial, 536, ... ) , Partial, 536, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01748   396   NtQueryValueKey  (224,  (224, "wave9", Partial, 536, ... ) , Partial, 536, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01749   396   NtQueryValueKey  (224,  (224, "midi", Partial, 536, ... ) , Partial, 536, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01750   396   NtQueryValueKey  (224,  (224, "midi1", Partial, 536, ... ) , Partial, 536, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01751   396   NtQueryValueKey  (224,  (224, "midi2", Partial, 536, ... ) , Partial, 536, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01752   396   NtQueryValueKey  (224,  (224, "midi3", Partial, 536, ... ) , Partial, 536, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01753   396   NtQueryValueKey  (224,  (224, "midi4", Partial, 536, ... ) , Partial, 536, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01754   396   NtQueryValueKey  (224,  (224, "midi5", Partial, 536, ... ) , Partial, 536, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01755   396   NtQueryValueKey  (224,  (224, "midi6", Partial, 536, ... ) , Partial, 536, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01756   396   NtQueryValueKey  (224,  (224, "midi7", Partial, 536, ... ) , Partial, 536, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01757   396   NtQueryValueKey  (224,  (224, "midi8", Partial, 536, ... ) , Partial, 536, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01758   396   NtQueryValueKey  (224,  (224, "midi9", Partial, 536, ... ) , Partial, 536, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01759   396   NtQueryTimerResolution  (... 156250, 10000, 156250, ) == 0x0
 01760   396   NtQueryValueKey  (224,  (224, "aux", Partial, 536, ... ) , Partial, 536, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01761   396   NtQueryValueKey  (224,  (224, "aux1", Partial, 536, ... ) , Partial, 536, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01762   396   NtQueryValueKey  (224,  (224, "aux2", Partial, 536, ... ) , Partial, 536, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01763   396   NtQueryValueKey  (224,  (224, "aux3", Partial, 536, ... ) , Partial, 536, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01764   396   NtQueryValueKey  (224,  (224, "aux4", Partial, 536, ... ) , Partial, 536, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01765   396   NtQueryValueKey  (224,  (224, "aux5", Partial, 536, ... ) , Partial, 536, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01766   396   NtQueryValueKey  (224,  (224, "aux6", Partial, 536, ... ) , Partial, 536, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01767   396   NtQueryValueKey  (224,  (224, "aux7", Partial, 536, ... ) , Partial, 536, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01768   396   NtQueryValueKey  (224,  (224, "aux8", Partial, 536, ... ) , Partial, 536, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01769   396   NtQueryValueKey  (224,  (224, "aux9", Partial, 536, ... ) , Partial, 536, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01770   396   NtUserRegisterWindowMessage  ( ("MSJSTICK_VJOYD_MSGSTR", ... ) , ... ) == 0xc07c
 01771   396   NtOpenKey  (0xf003f, {24, 48, 0x40, 0, 0,  (0xf003f, {24, 48, 0x40, 0, 0, "System\CurrentControlSet\Control\MediaProperties\PrivateProperties\Joystick\Winmm"}, ... 228, ) }, ... 228, ) == 0x0
 01772   396   NtQueryValueKey  (228,  (228, "wheel", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (228, "wheel", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) }, 16, ) == 0x0
 01773   396   NtClose  (228, ... ) == 0x0
 01774   396   NtCreateEvent  (0x1f0003, {24, 52, 0x80, 0, 0,  (0x1f0003, {24, 52, 0x80, 0, 0, "DINPUTWINMM"}, 0, 0, ... ) }, 0, 0, ... ) == STATUS_ACCESS_DENIED
 01775   396   NtQueryValueKey  (224,  (224, "mixer", Partial, 536, ... ) , Partial, 536, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01776   396   NtQueryValueKey  (224,  (224, "mixer1", Partial, 536, ... ) , Partial, 536, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01777   396   NtQueryValueKey  (224,  (224, "mixer2", Partial, 536, ... ) , Partial, 536, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01778   396   NtQueryValueKey  (224,  (224, "mixer3", Partial, 536, ... ) , Partial, 536, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01779   396   NtQueryValueKey  (224,  (224, "mixer4", Partial, 536, ... ) , Partial, 536, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01780   396   NtQueryValueKey  (224,  (224, "mixer5", Partial, 536, ... ) , Partial, 536, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01781   396   NtQueryValueKey  (224,  (224, "mixer6", Partial, 536, ... ) , Partial, 536, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01782   396   NtQueryValueKey  (224,  (224, "mixer7", Partial, 536, ... ) , Partial, 536, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01783   396   NtQueryValueKey  (224,  (224, "mixer8", Partial, 536, ... ) , Partial, 536, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01784   396   NtQueryValueKey  (224,  (224, "mixer9", Partial, 536, ... ) , Partial, 536, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01785   396   NtQueryDefaultUILanguage  (1239128, ...
 01786   396   NtOpenThreadTokenEx  (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN
 01787   396   NtOpenProcessTokenEx  (-1, 0x20008, 512, ... -2147482040, ) == 0x0
 01788   396   NtQueryInformationToken  (-2147482040, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0
 01789   396   NtClose  (-2147482040, ... ) == 0x0
 01790   396   NtOpenKey  (0x2000000, {24, 0, 0x640, 0, 0,  (0x2000000, {24, 0, 0x640, 0, 0, "\REGISTRY\USER\S-1-5-21-1078081533-484763869-839522115-1003"}, ... -2147482040, ) }, ... -2147482040, ) == 0x0
 01791   396   NtOpenKey  (0x80000000, {24, 0, 0x240, 0, 0,  (0x80000000, {24, 0, 0x240, 0, 0, "\Registry\Machine\System\CurrentControlSet\Control\Nls\MUILanguages"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01792   396   NtOpenKey  (0x80000000, {24, -2147482040, 0x640, 0, 0,  (0x80000000, {24, -2147482040, 0x640, 0, 0, "Control Panel\Desktop"}, ... -2147482044, ) }, ... -2147482044, ) == 0x0
 01793   396   NtQueryValueKey  (-2147482044,  (-2147482044, "MultiUILanguageId", Partial, 256, ... ) , Partial, 256, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01794   396   NtClose  (-2147482044, ... ) == 0x0
 01795   396   NtClose  (-2147482040, ... ) == 0x0
 01785   396   NtQueryDefaultUILanguage  ... ) == 0x0
 01796   396   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\System\CurrentControlSet\Control\Nls\MUILanguages"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01797   396   NtOpenFile  (0x1200a9, {24, 0, 0x40, 0, 0,  (0x1200a9, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\System32\TAPI32.dll"}, 1, 96, ... 228, {status=0x0, info=1}, ) }, 1, 96, ... 228, {status=0x0, info=1}, ) == 0x0
 01798   396   NtCreateSection  (0x4, 0x0, 0x0, 2, 134217728, 228, ... 232, ) == 0x0
 01799   396   NtMapViewOfSection  (232, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 2, ... (0xab0000), 0x0, 163840, ) == 0x0
 01800   396   NtOpenFile  (0x1200a9, {24, 0, 0x40, 0, 0,  (0x1200a9, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\System32\TAPI32.dll.124.Manifest"}, 1, 96, ... ) }, 1, 96, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01801   396   NtQueryDefaultLocale  (1, 1237164, ... ) == 0x0
 01802   396   NtOpenFile  (0x1200a9, {24, 0, 0x40, 0, 0,  (0x1200a9, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\System32\TAPI32.dll.124.Config"}, 1, 96, ... ) }, 1, 96, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01803   396   NtRequestWaitReplyPort  (24, {128, 156, new_msg, 0, 1238020, 1, 96, 0}  (24, {128, 156, new_msg, 0, 1238020, 1, 96, 0} "\210\6\35\1\33\0\1\0\0\0\0\0\1\347\22\0\1\0\0\0\0\0\11\4\1\1\1\0<\0@\0\250\6\35\1\344\0\0\0\377\377\377\377\0\0\0\0\360Z\255\0\0\0\0\0\251\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0(\0,\0\350\6\35\1\0\0\0\0\0\0\0\0\4\353\22\0\0\0\0\0" ... {128, 156, reply, 0, 316, 396, 1525, 0} "(\350\26\0\33\0\1\0\0\0\0\0\1\347\22\0\1\0\0\0\0\0\11\4\1\1\1\0<\0@\0\250\6\35\1\344\0\0\0\377\377\377\377\0\0\0\0\360Z\255\0\0\0\0\0\251\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0(\0,\0\350\6\35\1\0\0\0\0\0\0\0\0\4\353\22\0\0\0\0\0" )  ... {128, 156, reply, 0, 316, 396, 1525, 0}  (24, {128, 156, new_msg, 0, 1238020, 1, 96, 0} "\210\6\35\1\33\0\1\0\0\0\0\0\1\347\22\0\1\0\0\0\0\0\11\4\1\1\1\0<\0@\0\250\6\35\1\344\0\0\0\377\377\377\377\0\0\0\0\360Z\255\0\0\0\0\0\251\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0(\0,\0\350\6\35\1\0\0\0\0\0\0\0\0\4\353\22\0\0\0\0\0" ... {128, 156, reply, 0, 316, 396, 1525, 0} "(\350\26\0\33\0\1\0\0\0\0\0\1\347\22\0\1\0\0\0\0\0\11\4\1\1\1\0<\0@\0\250\6\35\1\344\0\0\0\377\377\377\377\0\0\0\0\360Z\255\0\0\0\0\0\251\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0(\0,\0\350\6\35\1\0\0\0\0\0\0\0\0\4\353\22\0\0\0\0\0" )  ) == 0x0
 01804   396   NtClose  (228, ... ) == 0x0
 01805   396   NtClose  (232, ... ) == 0x0
 01806   396   NtUnmapViewOfSection  (-1, 0xab0000, ... ) == 0x0
 01807   396   NtUnmapViewOfSection  (-1, 0x12eb04, ... ) == STATUS_NOT_MAPPED_VIEW
 01808   396   NtQueryDebugFilterState  (53, 2, ... ) == 0x0
 01809   396   NtOpenKey  (0x8, {24, 0, 0x40, 0, 0,  (0x8, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows\CurrentVersion\SideBySide\AssemblyStorageRoots"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01810   396   NtQueryDebugFilterState  (53, 2, ... ) == 0x0
 01811   396   NtQueryDebugFilterState  (53, 2, ... ) == 0x0
 01812   396   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\u:\work\packed.exe.Local\"}, 1236248, ... ) }, 1236248, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01813   396   NtQueryDebugFilterState  (53, 2, ... ) == 0x0
 01814   396   NtQueryDebugFilterState  (53, 2, ... ) == 0x0
 01815   396   NtQueryDebugFilterState  (53, 2, ... ) == 0x0
 01816   396   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.0.0_x-ww_1382d70a"}, 1236840, ... ) }, 1236840, ... ) == 0x0
 01817   396   NtOpenFile  (0x100020, {24, 0, 0x40, 0, 0,  (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.0.0_x-ww_1382d70a"}, 3, 33, ... 232, {status=0x0, info=1}, ) }, 3, 33, ... 232, {status=0x0, info=1}, ) == 0x0
 01818   396   NtQueryDebugFilterState  (53, 2, ... ) == 0x0
 01819   396   NtOpenKey  (0x20019, {24, 48, 0x40, 0, 0,  (0x20019, {24, 48, 0x40, 0, 0, "Software\Microsoft\Windows\CurrentVersion\Telephony"}, ... 228, ) }, ... 228, ) == 0x0
 01820   396   NtQueryValueKey  (228,  (228, "Tapi32MaxNumRequestRetries", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01821   396   NtQueryValueKey  (228,  (228, "Tapi32RequestRetryTimeout", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01822   396   NtClose  (228, ... ) == 0x0
 01823   396   NtCreateMutant  (0x1f0001, 0x0, 0, ... 228, ) == 0x0
 01824   396   NtCreateMutant  (0x1f0001, {24, 52, 0x80, 1385680, 0,  (0x1f0001, {24, 52, 0x80, 1385680, 0, "RasPbFile"}, 0, ... ) }, 0, ... ) == STATUS_ACCESS_DENIED
 01825   396   NtOpenMutant  (0x100000, {24, 52, 0x0, 0, 0,  (0x100000, {24, 52, 0x0, 0, 0, "RasPbFile"}, ... 236, ) }, ... 236, ) == 0x0
 01826   396   NtCreateEvent  (0x1f0003, 0x0, 0, 1, ... 240, ) == 0x0
 01827   396   NtCreateEvent  (0x1f0003, 0x0, 1, 0, ... 244, ) == 0x0
 01828   396   NtCreateEvent  (0x1f0003, 0x0, 0, 1, ... 248, ) == 0x0
 01829   396   NtCreateSemaphore  (0x100003, 0x0, 0, 2147483647, ... 252, ) == 0x0
 01830   396   NtCreateSemaphore  (0x100003, 0x0, 0, 2147483647, ... 256, ) == 0x0
 01831   396   NtCreateEvent  (0x1f0003, 0x0, 1, 0, ... 260, ) == 0x0
 01832   396   NtCreateEvent  (0x1f0003, 0x0, 1, 0, ... 264, ) == 0x0
 01833   396   NtCreateKey  (0xf003f, {24, 48, 0x40, 0, 0,  (0xf003f, {24, 48, 0x40, 0, 0, "Software\Microsoft\Tracing"}, 0, 0x0, 0, ... 268, 2, ) }, 0, 0x0, 0, ... 268, 2, ) == 0x0
 01834   396   NtQueryValueKey  (268,  (268, "EnableConsoleTracing", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (268, "EnableConsoleTracing", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) }, 16, ) == 0x0
 01835   396   NtClose  (268, ... ) == 0x0
 01836   396   NtAllocateVirtualMemory  (-1, 1388544, 0, 4096, 4096, 4, ... 1388544, 4096, ) == 0x0
 01837   396   NtCreateSemaphore  (0x100003, 0x0, 0, 2147483647, ... 268, ) == 0x0
 01838   396   NtCreateSemaphore  (0x100003, 0x0, 0, 2147483647, ... 272, ) == 0x0
 01839   396   NtOpenKey  (0x20019, {24, 48, 0x40, 0, 0,  (0x20019, {24, 48, 0x40, 0, 0, "Software\Microsoft\Tracing\RASAPI32"}, ... 276, ) }, ... 276, ) == 0x0
 01840   396   NtQueryValueKey  (276,  (276, "EnableFileTracing", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (276, "EnableFileTracing", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) }, 16, ) == 0x0
 01841   396   NtQueryValueKey  (276,  (276, "FileTracingMask", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\377\377"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (276, "FileTracingMask", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\377\377"}, 16, ) }, 16, ) == 0x0
 01842   396   NtQueryValueKey  (276,  (276, "EnableConsoleTracing", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (276, "EnableConsoleTracing", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) }, 16, ) == 0x0
 01843   396   NtQueryValueKey  (276,  (276, "ConsoleTracingMask", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\377\377"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (276, "ConsoleTracingMask", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\377\377"}, 16, ) }, 16, ) == 0x0
 01844   396   NtQueryValueKey  (276,  (276, "MaxFileSize", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\20\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (276, "MaxFileSize", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\20\0"}, 16, ) }, 16, ) == 0x0
 01845   396   NtQueryValueKey  (276,  (276, "FileDirectory", Partial, 144, ... TitleIdx=0, Type=2, Data="%\0w\0i\0n\0d\0i\0r\0%\0\\0t\0r\0a\0c\0i\0n\0g\0\0\0"}, 46, ) , Partial, 144, ... TitleIdx=0, Type=2, Data= (276, "FileDirectory", Partial, 144, ... TitleIdx=0, Type=2, Data="%\0w\0i\0n\0d\0i\0r\0%\0\\0t\0r\0a\0c\0i\0n\0g\0\0\0"}, 46, ) }, 46, ) == 0x0
 01846   396   NtQueryValueKey  (276,  (276, "FileDirectory", Partial, 144, ... TitleIdx=0, Type=2, Data="%\0w\0i\0n\0d\0i\0r\0%\0\\0t\0r\0a\0c\0i\0n\0g\0\0\0"}, 46, ) , Partial, 144, ... TitleIdx=0, Type=2, Data= (276, "FileDirectory", Partial, 144, ... TitleIdx=0, Type=2, Data="%\0w\0i\0n\0d\0i\0r\0%\0\\0t\0r\0a\0c\0i\0n\0g\0\0\0"}, 46, ) }, 46, ) == 0x0
 01847   396   NtCreateEvent  (0x1f0003, 0x0, 1, 0, ... 280, ) == 0x0
 01848   396   NtNotifyChangeKey  (276, 280, 0, 0, 2011390432, 14, 0, 0, 0, 1, ... ) == 0x103
 01849   396   NtQueryValueKey  (276,  (276, "EnableFileTracing", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (276, "EnableFileTracing", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) }, 16, ) == 0x0
 01850   396   NtQueryValueKey  (276,  (276, "FileTracingMask", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\377\377"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (276, "FileTracingMask", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\377\377"}, 16, ) }, 16, ) == 0x0
 01851   396   NtQueryValueKey  (276,  (276, "EnableConsoleTracing", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (276, "EnableConsoleTracing", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) }, 16, ) == 0x0
 01852   396   NtQueryValueKey  (276,  (276, "ConsoleTracingMask", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\377\377"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (276, "ConsoleTracingMask", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\377\377"}, 16, ) }, 16, ) == 0x0
 01853   396   NtQueryValueKey  (276,  (276, "MaxFileSize", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\20\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (276, "MaxFileSize", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\20\0"}, 16, ) }, 16, ) == 0x0
 01854   396   NtQueryValueKey  (276,  (276, "FileDirectory", Partial, 144, ... TitleIdx=0, Type=2, Data="%\0w\0i\0n\0d\0i\0r\0%\0\\0t\0r\0a\0c\0i\0n\0g\0\0\0"}, 46, ) , Partial, 144, ... TitleIdx=0, Type=2, Data= (276, "FileDirectory", Partial, 144, ... TitleIdx=0, Type=2, Data="%\0w\0i\0n\0d\0i\0r\0%\0\\0t\0r\0a\0c\0i\0n\0g\0\0\0"}, 46, ) }, 46, ) == 0x0
 01855   396   NtQueryValueKey  (276,  (276, "FileDirectory", Partial, 144, ... TitleIdx=0, Type=2, Data="%\0w\0i\0n\0d\0i\0r\0%\0\\0t\0r\0a\0c\0i\0n\0g\0\0\0"}, 46, ) , Partial, 144, ... TitleIdx=0, Type=2, Data= (276, "FileDirectory", Partial, 144, ... TitleIdx=0, Type=2, Data="%\0w\0i\0n\0d\0i\0r\0%\0\\0t\0r\0a\0c\0i\0n\0g\0\0\0"}, 46, ) }, 46, ) == 0x0
 01856   396   NtNotifyChangeKey  (276, 280, 0, 0, 2011390432, 14, 0, 0, 0, 1, ... ) == 0x103
 01857   396   NtSetEvent  (264, ... 0x0, ) == 0x0
 01858   396   NtOpenEvent  (0x100000, {24, 52, 0x0, 0, 0,  (0x100000, {24, 52, 0x0, 0, 0, "Global\SvcctrlStartEvent_A3752DX"}, ... 284, ) }, ... 284, ) == 0x0
 01859   396   NtWaitForSingleObject  (284, 0, {-1800000000, -1}, ... ) == 0x0
 01860   396   NtClose  (284, ... ) == 0x0
 01861   396   NtQuerySystemInformation  (Basic, 44, ... {Unknown=0,MaximumIncrement=156250,PhysicalPageSize=0x1000,NumberOfPhysicalPages=0xff7c,LowestPhysicalPage=0x1,HighestPhysicalPage=0xffff,AllocationGranularity=0x10000,LowestUserAddress=0x10000,HighestUserAddress=0x7ffeffff,ActiveProcessors=1,NumberProcessors=1,}, 0x0, ) == 0x0
 01862   396   NtOpenKey  (0x20019, {24, 48, 0x40, 0, 0,  (0x20019, {24, 48, 0x40, 0, 0, "Software\Microsoft\Rpc\PagedBuffers"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01863   396   NtOpenKey  (0x20019, {24, 48, 0x40, 0, 0,  (0x20019, {24, 48, 0x40, 0, 0, "Software\Microsoft\Rpc"}, ... 284, ) }, ... 284, ) == 0x0
 01864   396   NtQueryValueKey  (284,  (284, "MaxRpcSize", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01865   396   NtClose  (284, ... ) == 0x0
 01866   396   NtOpenKey  (0x20019, {24, 48, 0x40, 0, 0,  (0x20019, {24, 48, 0x40, 0, 0, "Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\packed.exe\RpcThreadPoolThrottle"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01867   396   NtCreateEvent  (0x1f0003, 0x0, 1, 0, ... 284, ) == 0x0
 01868   396   NtCreateEvent  (0x1f0003, 0x0, 1, 0, ... 288, ) == 0x0
 01869   396   NtQuerySystemTime  (... {-1848886684, 29873128}, ) == 0x0
 01870   396   NtCreateEvent  (0x1f0003, 0x0, 0, 0, ... 292, ) == 0x0
 01871   396   NtOpenKey  (0x20019, {24, 48, 0x40, 0, 0,  (0x20019, {24, 48, 0x40, 0, 0, "Software\Policies\Microsoft\Windows NT\Rpc"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01872   396   NtQuerySystemInformation  (Performance, 312, ... {system info, class 2, size 312}, 0x0, ) == 0x0
 01873   396   NtQueryInformationProcess  (-1, QuotaLimits, 32, ... {process info, class 1, size 32}, 0x0, ) == 0x0
 01874   396   NtQueryInformationProcess  (-1, VmCounters, 44, ... {process info, class 3, size 44}, 0x0, ) == 0x0
 01875   396   NtCreateEvent  (0x1f0003, 0x0, 0, 0, ... 296, ) == 0x0
 01876   396   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ... 300, ) == 0x0
 01877   396   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\System\CurrentControlSet\Control\ComputerName"}, ... 304, ) }, ... 304, ) == 0x0
 01878   396   NtOpenKey  (0x20019, {24, 304, 0x40, 0, 0,  (0x20019, {24, 304, 0x40, 0, 0, "ActiveComputerName"}, ... 308, ) }, ... 308, ) == 0x0
 01879   396   NtQueryValueKey  (308,  (308, "ComputerName", Full, 108, ... TitleIdx=0, Type=1, Name="ComputerName", Data="M\0Y\0W\0O\0R\0L\0D\0\0\0"}, 60, ) , Full, 108, ... TitleIdx=0, Type=1, Name= (308, "ComputerName", Full, 108, ... TitleIdx=0, Type=1, Name="ComputerName", Data="M\0Y\0W\0O\0R\0L\0D\0\0\0"}, 60, ) , Data= (308, "ComputerName", Full, 108, ... TitleIdx=0, Type=1, Name="ComputerName", Data="M\0Y\0W\0O\0R\0L\0D\0\0\0"}, 60, ) }, 60, ) == 0x0
 01880   396   NtClose  (308, ... ) == 0x0
 01881   396   NtClose  (304, ... ) == 0x0
 01882   396   NtCreateIoCompletion  (0x1f0003, 0x0, 0, ... 304, ) == 0x0
 01883   396   NtCreateIoCompletion  (0x1f0003, 0x0, -1, ... 308, ) == 0x0
 01884   396   NtDuplicateObject  (-1, 304, -1, 0x0, 0, 2, ... 312, ) == 0x0
 01885   396   NtAllocateVirtualMemory  (-1, 1392640, 0, 4096, 4096, 4, ... 1392640, 4096, ) == 0x0
 01886   396   NtOpenThreadToken  (-2, 0xc, 1, ... ) == STATUS_NO_TOKEN
 01887   396   NtCreateEvent  (0x1f0003, 0x0, 1, 0, ... 316, ) == 0x0
 01888   396   NtOpenThreadToken  (-2, 0xc, 1, ... ) == STATUS_NO_TOKEN
 01889   396   NtSetInformationThread  (-2, ImpersonationToken, {ImpToken=0,}, 4, ... ) == 0x0
 01890   396   NtCreateFile  (0xc0100080, {24, 0, 0x40, 0, 1240896,  (0xc0100080, {24, 0, 0x40, 0, 1240896, "\??\PIPE\svcctl"}, 0x0, 0, 3, 1, 4194368, 0, 0, ... 320, {status=0x0, info=1}, ) }, 0x0, 0, 3, 1, 4194368, 0, 0, ... 320, {status=0x0, info=1}, ) == 0x0
 01891   396   NtSetInformationFile  (320, 1240952, 8, Pipe, ... {status=0x0, info=0}, ) == 0x0
 01892   396   NtSetInformationFile  (320, 1240944, 8, Completion, ... {status=0x0, info=0}, ) == 0x0
 01893   396   NtSetInformationThread  (-2, ImpersonationToken, {ImpToken=0,}, 4, ... ) == 0x0
 01894   396   NtWriteFile  (320, 297, 0, 0,  (320, 297, 0, 0, "\5\0\13\3\20\0\0\0H\0\0\0\1\0\0\0\270\20\270\20\0\0\0\0\1\0\0\0\0\0\1\0\201\273z6D\230\3615\2552\230\3608\0\20\3\2\0\0\0\4]\210\212\353\34\311\21\237\350\10\0+\20H`\2\0\0\0", 72, {0, 0}, 0, ... {status=0x0, info=72}, ) , 72, {0, 0}, 0, ... {status=0x0, info=72}, ) == 0x0
 01895   396   NtReadFile  (320, 297, 0, 0, 1024, {0, 0}, 0, ... {status=0x0, info=68},  (320, 297, 0, 0, 1024, {0, 0}, 0, ... {status=0x0, info=68}, "\5\0\14\3\20\0\0\0D\0\0\0\1\0\0\0\270\20\270\20$'\0\0\15\0\PIPE\ntsvcs\0\0\1\0\0\0\0\0\0\0\4]\210\212\353\34\311\21\237\350\10\0+\20H`\2\0\0\0", ) , ) == 0x0
 01896   396   NtFsControlFile  (320, 297, 0x0, 0x0, 0x11c017,  (320, 297, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0$\0\0\0\1\0\0\0\14\0\0\0\0\0\17\0\0\0\0\0\0\0\0\0\0\0\0\200", 36, 1024, ... {status=0x103, info=68}, "\5\0\14\3\20\0\0\0D\0\0\0\1\0\0\0\270\20\270\20$'\0\0\15\0\PIPE\ntsvcs\0\0\1\0\0\0\0\0\0\0\4]\210\212\353\34\311\21\237\350\10\0+\20H`\2\0\0\0", ) , 36, 1024, ... {status=0x103, info=68},  (320, 297, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0$\0\0\0\1\0\0\0\14\0\0\0\0\0\17\0\0\0\0\0\0\0\0\0\0\0\0\200", 36, 1024, ... {status=0x103, info=68}, "\5\0\14\3\20\0\0\0D\0\0\0\1\0\0\0\270\20\270\20$'\0\0\15\0\PIPE\ntsvcs\0\0\1\0\0\0\0\0\0\0\4]\210\212\353\34\311\21\237\350\10\0+\20H`\2\0\0\0", ) , ) == 0x103
 01897   396   NtFsControlFile  (320, 297, 0x0, 0x0, 0x11c017,  (320, 297, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0L\0\0\0\2\0\0\04\0\0\0\0\0\20\0\0\0\0\0\13\251\237\311\333?\334\21\261\310\0\14)\371\246\305\7\0\0\0\0\0\0\0\7\0\0\0R\0A\0S\0M\0A\0N\0\0\0\0\0\4\0\0\0", 76, 1024, ... {status=0x103, info=48}, "\5\0\2\3\20\0\0\00\0\0\0\1\0\0\0\30\0\0\0\0\0\0\0\0\0\0\0\13\251\237\311\333?\334\21\261\310\0\14)\371\246\305\0\0\0\0", ) , 76, 1024, ... {status=0x103, info=48},  (320, 297, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0L\0\0\0\2\0\0\04\0\0\0\0\0\20\0\0\0\0\0\13\251\237\311\333?\334\21\261\310\0\14)\371\246\305\7\0\0\0\0\0\0\0\7\0\0\0R\0A\0S\0M\0A\0N\0\0\0\0\0\4\0\0\0", 76, 1024, ... {status=0x103, info=48}, "\5\0\2\3\20\0\0\00\0\0\0\1\0\0\0\30\0\0\0\0\0\0\0\0\0\0\0\13\251\237\311\333?\334\21\261\310\0\14)\371\246\305\0\0\0\0", ) , ) == 0x103
 01898   396   NtFsControlFile  (320, 297, 0x0, 0x0, 0x11c017,  (320, 297, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0,\0\0\0\3\0\0\0\24\0\0\0\0\0\6\0\0\0\0\0\14\251\237\311\333?\334\21\261\310\0\14)\371\246\305", 44, 1024, ... {status=0x103, info=48}, "\5\0\2\3\20\0\0\00\0\0\0\2\0\0\0\30\0\0\0\0\0\0\0\0\0\0\0\14\251\237\311\333?\334\21\261\310\0\14)\371\246\305\0\0\0\0", ) , 44, 1024, ... {status=0x103, info=48},  (320, 297, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0,\0\0\0\3\0\0\0\24\0\0\0\0\0\6\0\0\0\0\0\14\251\237\311\333?\334\21\261\310\0\14)\371\246\305", 44, 1024, ... {status=0x103, info=48}, "\5\0\2\3\20\0\0\00\0\0\0\2\0\0\0\30\0\0\0\0\0\0\0\0\0\0\0\14\251\237\311\333?\334\21\261\310\0\14)\371\246\305\0\0\0\0", ) , ) == 0x103
 01899   396   NtFsControlFile  (320, 297, 0x0, 0x0, 0x11c017,  (320, 297, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0,\0\0\0\4\0\0\0\24\0\0\0\0\0\0\0\0\0\0\0\14\251\237\311\333?\334\21\261\310\0\14)\371\246\305", 44, 1024, ... {status=0x103, info=56}, "\5\0\2\3\20\0\0\08\0\0\0\3\0\0\0 \0\0\0\0\0\0\0 \0\0\0\1\0\0\0\0\0\0\05\4\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0", ) , 44, 1024, ... {status=0x103, info=56},  (320, 297, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0,\0\0\0\4\0\0\0\24\0\0\0\0\0\0\0\0\0\0\0\14\251\237\311\333?\334\21\261\310\0\14)\371\246\305", 44, 1024, ... {status=0x103, info=56}, "\5\0\2\3\20\0\0\08\0\0\0\3\0\0\0 \0\0\0\0\0\0\0 \0\0\0\1\0\0\0\0\0\0\05\4\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0", ) , ) == 0x103
 01900   396   NtFsControlFile  (320, 297, 0x0, 0x0, 0x11c017,  (320, 297, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0,\0\0\0\5\0\0\0\24\0\0\0\0\0\0\0\0\0\0\0\13\251\237\311\333?\334\21\261\310\0\14)\371\246\305", 44, 1024, ... {status=0x103, info=48}, "\5\0\2\3\20\0\0\00\0\0\0\4\0\0\0\30\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0", ) , 44, 1024, ... {status=0x103, info=48},  (320, 297, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0,\0\0\0\5\0\0\0\24\0\0\0\0\0\0\0\0\0\0\0\13\251\237\311\333?\334\21\261\310\0\14)\371\246\305", 44, 1024, ... {status=0x103, info=48}, "\5\0\2\3\20\0\0\00\0\0\0\4\0\0\0\30\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0", ) , ) == 0x103
 01901   396   NtClose  (316, ... ) == 0x0
 01902   396   NtClose  (320, ... ) == 0x0
 01903   396   NtReleaseMutant  (204, ... 0x0, ) == 0x0
 01904   396   NtQueryValueKey  (108,  (108, "EnableAutodial", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (108, "EnableAutodial", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) }, 16, ) == 0x0
 01905   396   NtQueryValueKey  (108,  (108, "NoNetAutodial", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (108, "NoNetAutodial", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) }, 16, ) == 0x0
 01906   396   NtOpenEvent  (0x100000, {24, 0, 0x0, 0, 0,  (0x100000, {24, 0, 0x0, 0, 0, "\INSTALLATION_SECURITY_HOLD"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01907   396   NtAllocateVirtualMemory  (-1, 1396736, 0, 4096, 4096, 4, ... 1396736, 4096, ) == 0x0
 01908   396   NtOpenThreadToken  (-2, 0xc, 1, ... ) == STATUS_NO_TOKEN
 01909   396   NtCreateEvent  (0x1f0003, 0x0, 1, 0, ... 320, ) == 0x0
 01910   396   NtOpenThreadToken  (-2, 0xc, 1, ... ) == STATUS_NO_TOKEN
 01911   396   NtSetInformationThread  (-2, ImpersonationToken, {ImpToken=0,}, 4, ... ) == 0x0
 01912   396   NtCreateFile  (0xc0100080, {24, 0, 0x40, 0, 1238400,  (0xc0100080, {24, 0, 0x40, 0, 1238400, "\??\PIPE\lsarpc"}, 0x0, 0, 3, 1, 64, 0, 0, ... 316, {status=0x0, info=1}, ) }, 0x0, 0, 3, 1, 64, 0, 0, ... 316, {status=0x0, info=1}, ) == 0x0
 01913   396   NtSetInformationFile  (316, 1238456, 8, Pipe, ... {status=0x0, info=0}, ) == 0x0
 01914   396   NtSetInformationFile  (316, 1238448, 8, Completion, ... {status=0x0, info=0}, ) == 0x0
 01915   396   NtSetInformationThread  (-2, ImpersonationToken, {ImpToken=0,}, 4, ... ) == 0x0
 01916   396   NtWriteFile  (316, 297, 0, 0,  (316, 297, 0, 0, "\5\0\13\3\20\0\0\0H\0\0\0\1\0\0\0\270\20\270\20\0\0\0\0\1\0\0\0\0\0\1\0j(\319\14\261\320\21\233\250\0\300O\331.\365\0\0\0\0\4]\210\212\353\34\311\21\237\350\10\0+\20H`\2\0\0\0", 72, {0, 0}, 0, ... {status=0x0, info=72}, ) , 72, {0, 0}, 0, ... {status=0x0, info=72}, ) == 0x0
 01917   396   NtReadFile  (316, 297, 0, 0, 1024, {0, 0}, 0, ... {status=0x0, info=68},  (316, 297, 0, 0, 1024, {0, 0}, 0, ... {status=0x0, info=68}, "\5\0\14\3\20\0\0\0D\0\0\0\1\0\0\0\270\20\270\20\220%\0\0\14\0\PIPE\lsass\0\0\0\1\0\0\0\0\0\0\0\4]\210\212\353\34\311\21\237\350\10\0+\20H`\2\0\0\0", ) , ) == 0x0
 01918   396   NtFsControlFile  (316, 297, 0x0, 0x0, 0x11c017,  (316, 297, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0\32\0\0\0\1\0\0\0\2\0\0\0\0\0\0\0\1\0", 26, 1024, ... {status=0x103, info=68}, "\5\0\14\3\20\0\0\0D\0\0\0\1\0\0\0\270\20\270\20\220%\0\0\14\0\PIPE\lsass\0\0\0\1\0\0\0\0\0\0\0\4]\210\212\353\34\311\21\237\350\10\0+\20H`\2\0\0\0", ) , 26, 1024, ... {status=0x103, info=68},  (316, 297, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0\32\0\0\0\1\0\0\0\2\0\0\0\0\0\0\0\1\0", 26, 1024, ... {status=0x103, info=68}, "\5\0\14\3\20\0\0\0D\0\0\0\1\0\0\0\270\20\270\20\220%\0\0\14\0\PIPE\lsass\0\0\0\1\0\0\0\0\0\0\0\4]\210\212\353\34\311\21\237\350\10\0+\20H`\2\0\0\0", ) , ) == 0x103
 01919   396   NtClose  (320, ... ) == 0x0
 01920   396   NtClose  (316, ... ) == 0x0
 01921   396   NtCreateKey  (0x2001d, {24, 48, 0x40, 0, 0,  (0x2001d, {24, 48, 0x40, 0, 0, "Software\Microsoft\RAS AutoDial"}, 0, 0x0, 0, ... 316, 2, ) }, 0, 0x0, 0, ... 316, 2, ) == 0x0
 01922   396   NtCreateKey  (0x20019, {24, 316, 0x40, 0, 0,  (0x20019, {24, 316, 0x40, 0, 0, "Default"}, 0, 0x0, 0, ... 320, 2, ) }, 0, 0x0, 0, ... 320, 2, ) == 0x0
 01923   396   NtClose  (316, ... ) == 0x0
 01924   396   NtQueryValueKey  (320,  (320, "DefaultInternet", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01925   396   NtClose  (320, ... ) == 0x0
 01926   396   NtOpenEvent  (0x100000, {24, 52, 0x0, 0, 0,  (0x100000, {24, 52, 0x0, 0, 0, "Global\SvcctrlStartEvent_A3752DX"}, ... 320, ) }, ... 320, ) == 0x0
 01927   396   NtWaitForSingleObject  (320, 0, {-1800000000, -1}, ... ) == 0x0
 01928   396   NtClose  (320, ... ) == 0x0
 01929   396   NtOpenThreadToken  (-2, 0xc, 1, ... ) == STATUS_NO_TOKEN
 01930   396   NtCreateEvent  (0x1f0003, 0x0, 1, 0, ... 320, ) == 0x0
 01931   396   NtOpenThreadToken  (-2, 0xc, 1, ... ) == STATUS_NO_TOKEN
 01932   396   NtSetInformationThread  (-2, ImpersonationToken, {ImpToken=0,}, 4, ... ) == 0x0
 01933   396   NtCreateFile  (0xc0100080, {24, 0, 0x40, 0, 1240484,  (0xc0100080, {24, 0, 0x40, 0, 1240484, "\??\PIPE\svcctl"}, 0x0, 0, 3, 1, 4194368, 0, 0, ... 316, {status=0x0, info=1}, ) }, 0x0, 0, 3, 1, 4194368, 0, 0, ... 316, {status=0x0, info=1}, ) == 0x0
 01934   396   NtSetInformationFile  (316, 1240540, 8, Pipe, ... {status=0x0, info=0}, ) == 0x0
 01935   396   NtSetInformationFile  (316, 1240532, 8, Completion, ... {status=0x0, info=0}, ) == 0x0
 01936   396   NtSetInformationThread  (-2, ImpersonationToken, {ImpToken=0,}, 4, ... ) == 0x0
 01937   396   NtWriteFile  (316, 297, 0, 0,  (316, 297, 0, 0, "\5\0\13\3\20\0\0\0H\0\0\0\1\0\0\0\270\20\270\20\0\0\0\0\1\0\0\0\0\0\1\0\201\273z6D\230\3615\2552\230\3608\0\20\3\2\0\0\0\4]\210\212\353\34\311\21\237\350\10\0+\20H`\2\0\0\0", 72, {0, 0}, 0, ... {status=0x0, info=72}, ) , 72, {0, 0}, 0, ... {status=0x0, info=72}, ) == 0x0
 01938   396   NtReadFile  (316, 297, 0, 0, 1024, {0, 0}, 0, ... {status=0x0, info=68},  (316, 297, 0, 0, 1024, {0, 0}, 0, ... {status=0x0, info=68}, "\5\0\14\3\20\0\0\0D\0\0\0\1\0\0\0\270\20\270\20%'\0\0\15\0\PIPE\ntsvcs\0\0\1\0\0\0\0\0\0\0\4]\210\212\353\34\311\21\237\350\10\0+\20H`\2\0\0\0", ) , ) == 0x0
 01939   396   NtFsControlFile  (316, 297, 0x0, 0x0, 0x11c017,  (316, 297, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0$\0\0\0\1\0\0\0\14\0\0\0\0\0\33\0\0\0\0\0\0\0\0\0\0\0\0\200", 36, 1024, ... {status=0x103, info=68}, "\5\0\14\3\20\0\0\0D\0\0\0\1\0\0\0\270\20\270\20%'\0\0\15\0\PIPE\ntsvcs\0\0\1\0\0\0\0\0\0\0\4]\210\212\353\34\311\21\237\350\10\0+\20H`\2\0\0\0", ) , 36, 1024, ... {status=0x103, info=68},  (316, 297, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0$\0\0\0\1\0\0\0\14\0\0\0\0\0\33\0\0\0\0\0\0\0\0\0\0\0\0\200", 36, 1024, ... {status=0x103, info=68}, "\5\0\14\3\20\0\0\0D\0\0\0\1\0\0\0\270\20\270\20%'\0\0\15\0\PIPE\ntsvcs\0\0\1\0\0\0\0\0\0\0\4]\210\212\353\34\311\21\237\350\10\0+\20H`\2\0\0\0", ) , ) == 0x103
 01940   396   NtFsControlFile  (316, 297, 0x0, 0x0, 0x11c017,  (316, 297, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0@\0\0\0\2\0\0\0(\0\0\0\0\0\32\0\0\0\0\0\15\251\237\311\333?\334\21\261\310\0\14)\371\246\3050\0\0\0\1\0\0\0@\2\0\0p\366\22\0\0\0\0\0", 64, 1024, ... {status=0x103, info=48}, "\5\0\2\3\20\0\0\00\0\0\0\1\0\0\0\30\0\0\0\0\0\0\0\0\0\0\0\15\251\237\311\333?\334\21\261\310\0\14)\371\246\305\0\0\0\0", ) , 64, 1024, ... {status=0x103, info=48},  (316, 297, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0@\0\0\0\2\0\0\0(\0\0\0\0\0\32\0\0\0\0\0\15\251\237\311\333?\334\21\261\310\0\14)\371\246\3050\0\0\0\1\0\0\0@\2\0\0p\366\22\0\0\0\0\0", 64, 1024, ... {status=0x103, info=48}, "\5\0\2\3\20\0\0\00\0\0\0\1\0\0\0\30\0\0\0\0\0\0\0\0\0\0\0\15\251\237\311\333?\334\21\261\310\0\14)\371\246\305\0\0\0\0", ) , ) == 0x103
 01941   396   NtWaitForSingleObject  (297, 0, 0x0, ... ) == 0x0
 01942   396   NtFsControlFile  (316, 297, 0x0, 0x0, 0x11c017,  (316, 297, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0@\0\0\0\3\0\0\0(\0\0\0\0\0\32\0\0\0\0\0\15\251\237\311\333?\334\21\261\310\0\14)\371\246\3050\0\0\0\1\0\0\0@\2\0\0p\366\22\02\0\0\0", 64, 1024, ... {status=0x103, info=624}, "\5\0\2\3\20\0\0\0p\2\0\0\2\0\0\0X\2\0\0\0\0\0\0@\2\0\0.\2\0\0\22\2\0\0 \0\0\0\4\0\0\0\200\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\2\0\0\340\1\0\0 \0\0\0\4\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\316\1\0\0\240\1\0\0 \0\0\0\4\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\226\1\0\0~\1\0\0 \0\0\0\4\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0l\1\0\0B\1\0\0 \0\0\0\4\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\1\0\0\32\1\0\0 \0\0\0\4\0\0\0\31\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\16\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0E\0R\0S\0v\0c\0\0\0DNS Client\0\0i\0e\0n\0t\0\0\0Dnscache\0\0c\0h\0e\0\0\0Logical Disk Manager\0\0k\0 \0M\0a\0n\0a\0g\0e\0r\0\0\0dmserver\0\0v\0e\0r\0\0\0DHCP Client\0l\0i\0e\0n\0t\0\0\0Dhcp\0\0p\0\0\0Cryptographic Services\0\0c\0 \0S\0e\0r\0v\0i\0c\0e\0s\0\0\0CryptSvc\0\0", ) , 64, 1024, ... {status=0x103, info=624},  (316, 297, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0@\0\0\0\3\0\0\0(\0\0\0\0\0\32\0\0\0\0\0\15\251\237\311\333?\334\21\261\310\0\14)\371\246\3050\0\0\0\1\0\0\0@\2\0\0p\366\22\02\0\0\0", 64, 1024, ... {status=0x103, info=624}, "\5\0\2\3\20\0\0\0p\2\0\0\2\0\0\0X\2\0\0\0\0\0\0@\2\0\0.\2\0\0\22\2\0\0 \0\0\0\4\0\0\0\200\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\2\0\0\340\1\0\0 \0\0\0\4\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\316\1\0\0\240\1\0\0 \0\0\0\4\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\226\1\0\0~\1\0\0 \0\0\0\4\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0l\1\0\0B\1\0\0 \0\0\0\4\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\1\0\0\32\1\0\0 \0\0\0\4\0\0\0\31\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\16\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0E\0R\0S\0v\0c\0\0\0DNS Client\0\0i\0e\0n\0t\0\0\0Dnscache\0\0c\0h\0e\0\0\0Logical Disk Manager\0\0k\0 \0M\0a\0n\0a\0g\0e\0r\0\0\0dmserver\0\0v\0e\0r\0\0\0DHCP Client\0l\0i\0e\0n\0t\0\0\0Dhcp\0\0p\0\0\0Cryptographic Services\0\0c\0 \0S\0e\0r\0v\0i\0c\0e\0s\0\0\0CryptSvc\0\0", ) , ) == 0x103
 01943   396   NtFsControlFile  (316, 297, 0x0, 0x0, 0x11c017,  (316, 297, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0@\0\0\0\4\0\0\0(\0\0\0\0\0\32\0\0\0\0\0\15\251\237\311\333?\334\21\261\310\0\14)\371\246\3050\0\0\0\1\0\0\0@\2\0\0p\366\22\0>\0\0\0", 64, 1024, ... {status=0x103, info=624}, "\5\0\2\3\20\0\0\0p\2\0\0\3\0\0\0X\2\0\0\0\0\0\0@\2\0\04\2\0\0\4\2\0\0 \0\0\0\4\0\0\0\4\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\362\1\0\0\336\1\0\0 \0\0\0\4\0\0\0\4\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\306\1\0\0\242\1\0\0 \0\0\0\4\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0d\1\0\0 \1\0\0 \0\0\0\4\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\20\1\0\0\356\0\0\0 \0\0\0\4\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0Help and Support\0\0S\0u\0p\0p\0o\0r\0t\0\0\0helpsvc\0s\0v\0c\0\0\0Fast User Switching Compatibility\0n\0g\0 \0C\0o\0m\0p\0a\0t\0i\0b\0i\0l\0i\0t\0y\0\0\0FastUserSwitchingCompatibility\0\0g\0C\0o\0m\0p\0a\0t\0i\0b\0i\0l\0i\0t\0y\0\0\0COM+ Event System\0t\0 \0S\0y\0s\0t\0e\0m\0\0\0EventSystem\0y\0s\0t\0", ) , 64, 1024, ... {status=0x103, info=624},  (316, 297, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0@\0\0\0\4\0\0\0(\0\0\0\0\0\32\0\0\0\0\0\15\251\237\311\333?\334\21\261\310\0\14)\371\246\3050\0\0\0\1\0\0\0@\2\0\0p\366\22\0>\0\0\0", 64, 1024, ... {status=0x103, info=624}, "\5\0\2\3\20\0\0\0p\2\0\0\3\0\0\0X\2\0\0\0\0\0\0@\2\0\04\2\0\0\4\2\0\0 \0\0\0\4\0\0\0\4\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\362\1\0\0\336\1\0\0 \0\0\0\4\0\0\0\4\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\306\1\0\0\242\1\0\0 \0\0\0\4\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0d\1\0\0 \1\0\0 \0\0\0\4\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\20\1\0\0\356\0\0\0 \0\0\0\4\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0Help and Support\0\0S\0u\0p\0p\0o\0r\0t\0\0\0helpsvc\0s\0v\0c\0\0\0Fast User Switching Compatibility\0n\0g\0 \0C\0o\0m\0p\0a\0t\0i\0b\0i\0l\0i\0t\0y\0\0\0FastUserSwitchingCompatibility\0\0g\0C\0o\0m\0p\0a\0t\0i\0b\0i\0l\0i\0t\0y\0\0\0COM+ Event System\0t\0 \0S\0y\0s\0t\0e\0m\0\0\0EventSystem\0y\0s\0t\0", ) , ) == 0x103
 01944   396   NtWaitForSingleObject  (297, 0, 0x0, ... ) == 0x0
 01945   396   NtFsControlFile  (316, 297, 0x0, 0x0, 0x11c017,  (316, 297, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0@\0\0\0\5\0\0\0(\0\0\0\0\0\32\0\0\0\0\0\15\251\237\311\333?\334\21\261\310\0\14)\371\246\3050\0\0\0\1\0\0\0@\2\0\0p\366\22\0p\0\0\0", 64, 1024, ... {status=0x103, info=624}, "\5\0\2\3\20\0\0\0p\2\0\0\4\0\0\0X\2\0\0\0\0\0\0@\2\0\0&\2\0\0\30\2\0\0 \0\0\0\4\0\0\0\7\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\364\1\0\0\334\1\0\0 \0\0\0\4\0\0\0\7\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\314\1\0\0\240\1\0\0 \0\0\0\4\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\214\1\0\0x\1\0\0 \0\0\0\4\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0j\1\0\0B\1\0\0 \1\0\0\4\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0:\1\0\0\370\0\0\0 \0\0\0\4\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0Network Location Awareness (NLA)\0\0A\0w\0a\0r\0e\0n\0e\0s\0s\0 \0(\0N\0L\0A\0)\0\0\0Nla\0a\0\0\0Network Connections\0n\0n\0e\0c\0t\0i\0o\0n\0s\0\0\0Netman\0\0a\0n\0\0\0Messenger\0n\0g\0e\0r\0\0\0Messenger\0n\0g\0e\0r\0\0\0TCP/IP NetBIOS Helper\0I\0O\0S\0 \0H\0e\0l\0p\0e\0r\0\0\0LmHosts\0s\0t\0", ) , 64, 1024, ... {status=0x103, info=624},  (316, 297, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0@\0\0\0\5\0\0\0(\0\0\0\0\0\32\0\0\0\0\0\15\251\237\311\333?\334\21\261\310\0\14)\371\246\3050\0\0\0\1\0\0\0@\2\0\0p\366\22\0p\0\0\0", 64, 1024, ... {status=0x103, info=624}, "\5\0\2\3\20\0\0\0p\2\0\0\4\0\0\0X\2\0\0\0\0\0\0@\2\0\0&\2\0\0\30\2\0\0 \0\0\0\4\0\0\0\7\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\364\1\0\0\334\1\0\0 \0\0\0\4\0\0\0\7\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\314\1\0\0\240\1\0\0 \0\0\0\4\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\214\1\0\0x\1\0\0 \0\0\0\4\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0j\1\0\0B\1\0\0 \1\0\0\4\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0:\1\0\0\370\0\0\0 \0\0\0\4\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0Network Location Awareness (NLA)\0\0A\0w\0a\0r\0e\0n\0e\0s\0s\0 \0(\0N\0L\0A\0)\0\0\0Nla\0a\0\0\0Network Connections\0n\0n\0e\0c\0t\0i\0o\0n\0s\0\0\0Netman\0\0a\0n\0\0\0Messenger\0n\0g\0e\0r\0\0\0Messenger\0n\0g\0e\0r\0\0\0TCP/IP NetBIOS Helper\0I\0O\0S\0 \0H\0e\0l\0p\0e\0r\0\0\0LmHosts\0s\0t\0", ) , ) == 0x103
 01946   396   NtFsControlFile  (316, 297, 0x0, 0x0, 0x11c017,  (316, 297, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0@\0\0\0\6\0\0\0(\0\0\0\0\0\32\0\0\0\0\0\15\251\237\311\333?\334\21\261\310\0\14)\371\246\3050\0\0\0\1\0\0\0@\2\0\0p\366\22\0\242\0\0\0", 64, 1024, ... {status=0x103, info=624}, "\5\0\2\3\20\0\0\0p\2\0\0\5\0\0\0X\2\0\0\0\0\0\0@\2\0\0.\2\0\0\22\2\0\0 \0\0\0\4\0\0\0\204\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\372\1\0\0\334\1\0\0 \0\0\0\4\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\272\1\0\0\226\1\0\0 \1\0\0\4\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0x\1\0\0X\1\0\0 \0\0\0\4\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0L\1\0\0\24\1\0\0 \0\0\0\4\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\10\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0S\0a\0m\0S\0s\0\0\0Remote Procedure Call (RPC)\0r\0e\0 \0C\0a\0l\0l\0 \0(\0R\0P\0C\0)\0\0\0RpcSs\0S\0s\0\0\0Remote Registry\0e\0g\0i\0s\0t\0r\0y\0\0\0RemoteRegistry\0\0g\0i\0s\0t\0r\0y\0\0\0Protected Storage\0 \0S\0t\0o\0r\0a\0g\0e\0\0\0ProtectedStorage\0\0S\0t\0o\0r\0a\0g\0", ) , 64, 1024, ... {status=0x103, info=624},  (316, 297, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0@\0\0\0\6\0\0\0(\0\0\0\0\0\32\0\0\0\0\0\15\251\237\311\333?\334\21\261\310\0\14)\371\246\3050\0\0\0\1\0\0\0@\2\0\0p\366\22\0\242\0\0\0", 64, 1024, ... {status=0x103, info=624}, "\5\0\2\3\20\0\0\0p\2\0\0\5\0\0\0X\2\0\0\0\0\0\0@\2\0\0.\2\0\0\22\2\0\0 \0\0\0\4\0\0\0\204\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\372\1\0\0\334\1\0\0 \0\0\0\4\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\272\1\0\0\226\1\0\0 \1\0\0\4\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0x\1\0\0X\1\0\0 \0\0\0\4\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0L\1\0\0\24\1\0\0 \0\0\0\4\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\10\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0S\0a\0m\0S\0s\0\0\0Remote Procedure Call (RPC)\0r\0e\0 \0C\0a\0l\0l\0 \0(\0R\0P\0C\0)\0\0\0RpcSs\0S\0s\0\0\0Remote Registry\0e\0g\0i\0s\0t\0r\0y\0\0\0RemoteRegistry\0\0g\0i\0s\0t\0r\0y\0\0\0Protected Storage\0 \0S\0t\0o\0r\0a\0g\0e\0\0\0ProtectedStorage\0\0S\0t\0o\0r\0a\0g\0", ) , ) == 0x103
 01947   396   NtFsControlFile  (316, 297, 0x0, 0x0, 0x11c017,  (316, 297, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0,\0\0\0\7\0\0\0\24\0\0\0\0\0\0\0\0\0\0\0\15\251\237\311\333?\334\21\261\310\0\14)\371\246\305", 44, 1024, ... {status=0x103, info=624}, "\5\0\2\3\20\0\0\0p\2\0\0\6\0\0\0X\2\0\0\0\0\0\0@\2\0\04\2\0\0\0\2\0\0 \0\0\0\4\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\356\1\0\0\320\1\0\0 \1\0\0\4\0\0\0G\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\276\1\0\0\236\1\0\0 \1\0\0\4\0\0\0\3\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\224\1\0\0`\1\0\0 \0\0\0\4\0\0\0A\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0>\1\0\0\14\1\0\0 \0\0\0\4\0\0\0\207\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\374\0\0\0\340\0\0\0\20\1\0\0\4\0\0\0E\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0Print Spooler\0p\0o\0o\0l\0e\0r\0\0\0Spooler\0l\0e\0r\0\0\0Shell Hardware Detection\0\0e\0 \0D\0e\0t\0e\0c\0t\0i\0o\0n\0\0\0ShellHWDetection\0\0t\0e\0c\0t\0i\0o\0n\0\0\0System Event Notification\0N\0o\0t\0i\0f\0i\0c\0a\0t\0i\0o\0n\0\0\0SENS\0\0S\0\0\0Secondary Logon\0y\0 \0L\0o\0g\0o\0n\0\0\0seclogon\0\0g\0o\0n\0\0\0Task Sch", ) , 44, 1024, ... {status=0x103, info=624},  (316, 297, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0,\0\0\0\7\0\0\0\24\0\0\0\0\0\0\0\0\0\0\0\15\251\237\311\333?\334\21\261\310\0\14)\371\246\305", 44, 1024, ... {status=0x103, info=624}, "\5\0\2\3\20\0\0\0p\2\0\0\6\0\0\0X\2\0\0\0\0\0\0@\2\0\04\2\0\0\0\2\0\0 \0\0\0\4\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\356\1\0\0\320\1\0\0 \1\0\0\4\0\0\0G\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\276\1\0\0\236\1\0\0 \1\0\0\4\0\0\0\3\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\224\1\0\0`\1\0\0 \0\0\0\4\0\0\0A\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0>\1\0\0\14\1\0\0 \0\0\0\4\0\0\0\207\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\374\0\0\0\340\0\0\0\20\1\0\0\4\0\0\0E\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0Print Spooler\0p\0o\0o\0l\0e\0r\0\0\0Spooler\0l\0e\0r\0\0\0Shell Hardware Detection\0\0e\0 \0D\0e\0t\0e\0c\0t\0i\0o\0n\0\0\0ShellHWDetection\0\0t\0e\0c\0t\0i\0o\0n\0\0\0System Event Notification\0N\0o\0t\0i\0f\0i\0c\0a\0t\0i\0o\0n\0\0\0SENS\0\0S\0\0\0Secondary Logon\0y\0 \0L\0o\0g\0o\0n\0\0\0seclogon\0\0g\0o\0n\0\0\0Task Sch", ) , ) == 0x103
 01948   396   NtClose  (320, ... ) == 0x0
 01949   396   NtClose  (316, ... ) == 0x0
 01950   396   NtOpenSection  (0xe, {24, 8, 0x40, 0, 0,  (0xe, {24, 8, 0x40, 0, 0, "sensapi.dll"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01951   396   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\u:\work\sensapi.dll"}, 1240744, ... ) }, 1240744, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01952   396   NtQueryAttributesFile  ({24, 12, 0x40, 0, 0,  ({24, 12, 0x40, 0, 0, "sensapi.dll"}, 1240744, ... ) }, 1240744, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01953   396   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\System32\sensapi.dll"}, 1240744, ... ) }, 1240744, ... ) == 0x0
 01954   396   NtOpenFile  (0x100020, {24, 0, 0x40, 0, 0,  (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\System32\sensapi.dll"}, 5, 96, ... 316, {status=0x0, info=1}, ) }, 5, 96, ... 316, {status=0x0, info=1}, ) == 0x0
 01955   396   NtCreateSection  (0xf, 0x0, 0x0, 16, 16777216, 316, ... 320, ) == 0x0
 01956   396   NtQuerySection  (320, Image, 48, ... {section info, class 1, size 48}, 0x0, ) == 0x0
 01957   396   NtClose  (316, ... ) == 0x0
 01958   396   NtMapViewOfSection  (320, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x722b0000), 0x0, 20480, ) == 0x0
 01959   396   NtClose  (320, ... ) == 0x0
 01960   396   NtOpenSection  (0x4, {24, 52, 0x0, 0, 0,  (0x4, {24, 52, 0x0, 0, 0, "SENS Information Cache"}, ... 320, ) }, ... 320, ) == 0x0
 01961   396   NtMapViewOfSection  (320, -1, (0x0), 0, 0, {0, 0}, 0, 1, 0, 2, ... (0xab0000), {0, 0}, 4096, ) == 0x0
 01962   396   NtCreateEvent  (0x1f0003, 0x0, 1, 0, ... 316, ) == 0x0
 01963   396   NtConnectPort  ( ("\RPC Control\senssvc", {12, 2, 1, 1}, 0x0, 0x0, 1241208, 112, ... 324, 0x0, 0x0, 0x0, 112, ) , {12, 2, 1, 1}, 0x0, 0x0, 1241208, 112, ... 324, 0x0, 0x0, 0x0, 112, ) == 0x0
 01964   396   NtRequestWaitReplyPort  (324, {128, 152, new_msg, 0, 126540, 1310720, 1240972, 2012750850}  (324, {128, 152, new_msg, 0, 126540, 1310720, 1240972, 2012750850} "\0\366\22\0\2$\370w\370T\367w$\344\373c) \321\21\215\270\0\252\0J\275^\1\0\0\0\1\0\0\0k\23\314w\4\0\0\0\20\344\314wx)\25\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0x\1\24\0x\1\24\0\270C\25\0\240\1\24\08E\25\0\250L\25\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\20\0\0\0\0\0\0\0\255\1\0\0\5\0\0\0" ... {128, 152, reply, 0, 316, 396, 1527, 0} "\7\366\22\0\2$\370w\370T\367w$\344\373c) \321\21\215\270\0\252\0J\275^\1\0\0\0\1\0\0\0\0\0\0\0\4\0\0\0\20\344\314w\377\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0x\1\24\0x\1\24\0\270C\25\0\240\1\24\08E\25\0\250L\25\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\20\0\0\0\0\0\0\0\255\1\0\0\5\0\0\0" )  ... {128, 152, reply, 0, 316, 396, 1527, 0}  (324, {128, 152, new_msg, 0, 126540, 1310720, 1240972, 2012750850} "\0\366\22\0\2$\370w\370T\367w$\344\373c) \321\21\215\270\0\252\0J\275^\1\0\0\0\1\0\0\0k\23\314w\4\0\0\0\20\344\314wx)\25\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0x\1\24\0x\1\24\0\270C\25\0\240\1\24\08E\25\0\250L\25\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\20\0\0\0\0\0\0\0\255\1\0\0\5\0\0\0" ... {128, 152, reply, 0, 316, 396, 1527, 0} "\7\366\22\0\2$\370w\370T\367w$\344\373c) \321\21\215\270\0\252\0J\275^\1\0\0\0\1\0\0\0\0\0\0\0\4\0\0\0\20\344\314w\377\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0x\1\24\0x\1\24\0\270C\25\0\240\1\24\08E\25\0\250L\25\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\20\0\0\0\0\0\0\0\255\1\0\0\5\0\0\0" )  ) == 0x0
 01965   396   NtRequestWaitReplyPort  (324, {32, 56, new_msg, 0, 44, 7, 20, 0}  (324, {32, 56, new_msg, 0, 44, 7, 20, 0} "\1\0\0\0A\2\0\0\333?\334\21\261\310\0\14)\371\246\3050\0\0\0\377\377\377\377@\2\0\0" ... {124, 148, reply, 0, 316, 396, 1528, 0} "\2 \372\177\1\00\300\0\0\0\0\227\4\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\1\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\304\13(\370X\5O\200\0 \372\177\0\0\0\0\0\0\0\0\3604\25\201\20B\34\201\1B\34\201\0\0\0\0\210\376\37\300\20B\34\201\0\0\0\0\0\0\324\0\377\377\323\0\0\0\0\0\0\0\324\0\0\4\0\0\20B\34\201<\13(\370" )  ... {124, 148, reply, 0, 316, 396, 1528, 0}  (324, {32, 56, new_msg, 0, 44, 7, 20, 0} "\1\0\0\0A\2\0\0\333?\334\21\261\310\0\14)\371\246\3050\0\0\0\377\377\377\377@\2\0\0" ... {124, 148, reply, 0, 316, 396, 1528, 0} "\2 \372\177\1\00\300\0\0\0\0\227\4\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\1\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\304\13(\370X\5O\200\0 \372\177\0\0\0\0\0\0\0\0\3604\25\201\20B\34\201\1B\34\201\0\0\0\0\210\376\37\300\20B\34\201\0\0\0\0\0\0\324\0\377\377\323\0\0\0\0\0\0\0\324\0\0\4\0\0\20B\34\201<\13(\370" )  ) == 0x0
 01966   396   NtWaitForSingleObject  (156, 0, 0x0, ... ) == 0x0
 01967   396   NtQueryInformationFile  (152, 1242316, 24, Standard, ... {status=0x0, info=24}, ) == 0x0
 01968   396   NtReleaseMutant  (156, ... 0x0, ) == 0x0
 01969   396   NtRequestWaitReplyPort  (144, {28, 52, new_msg, 0, 0, 0, 0, 0}  (144, {28, 52, new_msg, 0, 0, 0, 0, 0} "\37\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\1\0\13\30\0\2\240R\25\0" ... {176, 200, reply, 0, 316, 396, 1529, 0} "\37\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\1\0\20\0\0\2\220\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0S\0R\0I\0-\0u\0s\0e\0r\0" )  ... {176, 200, reply, 0, 316, 396, 1529, 0}  (144, {28, 52, new_msg, 0, 0, 0, 0, 0} "\37\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\1\0\13\30\0\2\240R\25\0" ... {176, 200, reply, 0, 316, 396, 1529, 0} "\37\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\1\0\20\0\0\2\220\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0S\0R\0I\0-\0u\0s\0e\0r\0" )  ) == 0x0
 01970   396   NtOpenKey  (0x1, {24, 48, 0x40, 0, 0,  (0x1, {24, 48, 0x40, 0, 0, "SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01971   396   NtOpenThreadToken  (-2, 0x20008, 1, ... ) == STATUS_NO_TOKEN
 01972   396   NtOpenProcessToken  (-1, 0x20008, ... 328, ) == 0x0
 01973   396   NtQueryInformationToken  (328, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0
 01974   396   NtClose  (328, ... ) == 0x0
 01975   396   NtOpenKey  (0x2000000, {24, 0, 0x40, 0, 0,  (0x2000000, {24, 0, 0x40, 0, 0, "\REGISTRY\USER"}, ... 328, ) }, ... 328, ) == 0x0
 01976   396   NtSetInformationObject  (328, Handle, {Inherit=0,ProtectFromClose=1,}, 2011365632, ... ) == 0x0
 01977   396   NtOpenKey  (0x3, {24, 328, 0x40, 0, 0,  (0x3, {24, 328, 0x40, 0, 0, "S-1-5-21-1078081533-484763869-839522115-1003"}, ... 332, ) }, ... 332, ) == 0x0
 01978   396   NtOpenKey  (0x1, {24, 332, 0x40, 0, 0,  (0x1, {24, 332, 0x40, 0, 0, "Software\Microsoft\windows\CurrentVersion\Internet Settings"}, ... 336, ) }, ... 336, ) == 0x0
 01979   396   NtQueryValueKey  (336,  (336, "MigrateProxy", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (336, "MigrateProxy", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) }, 16, ) == 0x0
 01980   396   NtClose  (336, ... ) == 0x0
 01981   396   NtAllocateVirtualMemory  (-1, 1400832, 0, 20480, 4096, 4, ... 1400832, 20480, ) == 0x0
 01982   396   NtOpenThreadToken  (-2, 0xc, 1, ... ) == STATUS_NO_TOKEN
 01983   396   NtOpenProcessToken  (-1, 0xc, ... 336, ) == 0x0
 01984   396   NtReleaseSemaphore  (168, 1, ... 0, ) == 0x0
 01985   396   NtWaitForSingleObject  (168, 0, {0, 0}, ... ) == 0x0
 01986   396   NtCreateKey  (0x2000000, {24, 48, 0x40, 0, 0,  (0x2000000, {24, 48, 0x40, 0, 0, "Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders"}, 0, 0x0, 0, ... 340, 2, ) }, 0, 0x0, 0, ... 340, 2, ) == 0x0
 01987   396   NtQueryValueKey  (340,  (340, "Common AppData", Partial, 144, ... TitleIdx=0, Type=2, Data="%\0A\0L\0L\0U\0S\0E\0R\0S\0P\0R\0O\0F\0I\0L\0E\0%\0\\0A\0p\0p\0l\0i\0c\0a\0t\0i\0o\0n\0 \0D\0a\0t\0a\0\0\0"}, 82, ) , Partial, 144, ... TitleIdx=0, Type=2, Data= (340, "Common AppData", Partial, 144, ... TitleIdx=0, Type=2, Data="%\0A\0L\0L\0U\0S\0E\0R\0S\0P\0R\0O\0F\0I\0L\0E\0%\0\\0A\0p\0p\0l\0i\0c\0a\0t\0i\0o\0n\0 \0D\0a\0t\0a\0\0\0"}, 82, ) }, 82, ) == 0x0
 01988   396   NtOpenSection  (0xe, {24, 8, 0x40, 0, 0,  (0xe, {24, 8, 0x40, 0, 0, "USERENV.dll"}, ... 344, ) }, ... 344, ) == 0x0
 01989   396   NtMapViewOfSection  (344, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x75a70000), 0x0, 667648, ) == 0x0
 01990   396   NtClose  (344, ... ) == 0x0
 01991   396   NtOpenKey  (0x2000000, {24, 48, 0x40, 0, 0,  (0x2000000, {24, 48, 0x40, 0, 0, "Software\Microsoft\Windows NT\CurrentVersion\winlogon"}, ... 344, ) }, ... 344, ) == 0x0
 01992   396   NtQueryValueKey  (344,  (344, "UserEnvDebugLevel", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01993   396   NtClose  (344, ... ) == 0x0
 01994   396   NtOpenKey  (0x2000000, {24, 48, 0x40, 0, 0,  (0x2000000, {24, 48, 0x40, 0, 0, "Software\Microsoft\Windows NT\CurrentVersion\winlogon"}, ... 344, ) }, ... 344, ) == 0x0
 01995   396   NtQueryValueKey  (344,  (344, "ChkAccDebugLevel", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01996   396   NtClose  (344, ... ) == 0x0
 01997   396   NtOpenKey  (0x20019, {24, 48, 0x40, 0, 0,  (0x20019, {24, 48, 0x40, 0, 0, "System\CurrentControlSet\Control\ProductOptions"}, ... 344, ) }, ... 344, ) == 0x0
 01998   396   NtQueryValueKey  (344,  (344, "ProductType", Partial, 144, ... TitleIdx=0, Type=1, Data="W\0i\0n\0N\0T\0\0\0"}, 24, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (344, "ProductType", Partial, 144, ... TitleIdx=0, Type=1, Data="W\0i\0n\0N\0T\0\0\0"}, 24, ) }, 24, ) == 0x0
 01999   396   NtClose  (344, ... ) == 0x0
 02000   396   NtCreateEvent  (0x1f0003, {24, 52, 0x80, 1237528, 0,  (0x1f0003, {24, 52, 0x80, 1237528, 0, "Global\userenv:  User Profile setup event"}, 0, 1, ... 344, ) }, 0, 1, ... 344, ) == STATUS_OBJECT_NAME_EXISTS
 02001   396   NtAllocateVirtualMemory  (-1, 1224704, 0, 4096, 4096, 260, ... 1224704, 4096, ) == 0x0
 02002   396   NtQueryDefaultLocale  (1, 1235364, ... ) == 0x0
 02003   396   NtQueryDefaultLocale  (1, 1235364, ... ) == 0x0
 02004   396   NtQueryDefaultLocale  (1, 1235364, ... ) == 0x0
 02005   396   NtQueryDefaultLocale  (1, 1235364, ... ) == 0x0
 02006   396   NtQueryDefaultLocale  (1, 1235364, ... ) == 0x0
 02007   396   NtQueryDefaultLocale  (1, 1235364, ... ) == 0x0
 02008   396   NtQueryDefaultLocale  (1, 1235364, ... ) == 0x0
 02009   396   NtQueryDefaultLocale  (1, 1235364, ... ) == 0x0
 02010   396   NtQueryDefaultLocale  (1, 1235364, ... ) == 0x0
 02011   396   NtQueryDefaultLocale  (1, 1235364, ... ) == 0x0
 02012   396   NtQueryDefaultLocale  (1, 1235364, ... ) == 0x0
 02013   396   NtQueryDefaultLocale  (1, 1235364, ... ) == 0x0
 02014   396   NtQueryDefaultLocale  (1, 1235364, ... ) == 0x0
 02015   396   NtQueryDefaultLocale  (1, 1235364, ... ) == 0x0
 02016   396   NtQueryDefaultLocale  (1, 1235364, ... ) == 0x0
 02017   396   NtQueryDefaultLocale  (1, 1235364, ... ) == 0x0
 02018   396   NtQueryDefaultLocale  (1, 1235364, ... ) == 0x0
 02019   396   NtQueryDefaultLocale  (1, 1235364, ... ) == 0x0
 02020   396   NtQueryDefaultLocale  (1, 1235364, ... ) == 0x0
 02021   396   NtQueryDefaultLocale  (1, 1235364, ... ) == 0x0
 02022   396   NtQueryDefaultLocale  (1, 1235364, ... ) == 0x0
 02023   396   NtQueryDefaultLocale  (1, 1235364, ... ) == 0x0
 02024   396   NtQueryDefaultLocale  (1, 1235364, ... ) == 0x0
 02025   396   NtQueryDefaultLocale  (1, 1235364, ... ) == 0x0
 02026   396   NtQueryDefaultLocale  (1, 1235364, ... ) == 0x0
 02027   396   NtQueryDefaultLocale  (1, 1235364, ... ) == 0x0
 02028   396   NtOpenThreadTokenEx  (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN
 02029   396   NtOpenProcessTokenEx  (-1, 0x20008, 512, ... 348, ) == 0x0
 02030   396   NtQueryInformationToken  (348, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0
 02031   396   NtClose  (348, ... ) == 0x0
 02032   396   NtOpenKey  (0x20019, {24, 0, 0x640, 0, 0,  (0x20019, {24, 0, 0x640, 0, 0, "\REGISTRY\USER\S-1-5-21-1078081533-484763869-839522115-1003"}, ... 348, ) }, ... 348, ) == 0x0
 02033   396   NtOpenKey  (0x20019, {24, 348, 0x40, 0, 0,  (0x20019, {24, 348, 0x40, 0, 0, "Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders"}, ... 352, ) }, ... 352, ) == 0x0
 02034   396   NtQueryValueKey  (352,  (352, "Personal", Partial, 144, ... TitleIdx=0, Type=2, Data="%\0U\0S\0E\0R\0P\0R\0O\0F\0I\0L\0E\0%\0\\0M\0y\0 \0D\0o\0c\0u\0m\0e\0n\0t\0s\0\0\0"}, 66, ) , Partial, 144, ... TitleIdx=0, Type=2, Data= (352, "Personal", Partial, 144, ... TitleIdx=0, Type=2, Data="%\0U\0S\0E\0R\0P\0R\0O\0F\0I\0L\0E\0%\0\\0M\0y\0 \0D\0o\0c\0u\0m\0e\0n\0t\0s\0\0\0"}, 66, ) }, 66, ) == 0x0
 02035   396   NtQueryDefaultLocale  (1, 1235364, ... ) == 0x0
 02036   396   NtQueryValueKey  (352,  (352, "Local Settings", Partial, 144, ... TitleIdx=0, Type=2, Data="%\0U\0S\0E\0R\0P\0R\0O\0F\0I\0L\0E\0%\0\\0L\0o\0c\0a\0l\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\0\0"}, 70, ) , Partial, 144, ... TitleIdx=0, Type=2, Data= (352, "Local Settings", Partial, 144, ... TitleIdx=0, Type=2, Data="%\0U\0S\0E\0R\0P\0R\0O\0F\0I\0L\0E\0%\0\\0L\0o\0c\0a\0l\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\0\0"}, 70, ) }, 70, ) == 0x0
 02037   396   NtQueryDefaultLocale  (1, 1235364, ... ) == 0x0
 02038   396   NtQueryDefaultLocale  (1, 1235364, ... ) == 0x0
 02039   396   NtQueryDefaultLocale  (1, 1235364, ... ) == 0x0
 02040   396   NtQueryDefaultLocale  (1, 1235364, ... ) == 0x0
 02041   396   NtClose  (352, ... ) == 0x0
 02042   396   NtClose  (348, ... ) == 0x0
 02043   396   NtOpenKey  (0x2000000, {24, 48, 0x40, 0, 0,  (0x2000000, {24, 48, 0x40, 0, 0, "Software\Microsoft\Windows NT\CurrentVersion\winlogon"}, ... 348, ) }, ... 348, ) == 0x0
 02044   396   NtQueryValueKey  (348,  (348, "RsopDebugLevel", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02045   396   NtClose  (348, ... ) == 0x0
 02046   396   NtOpenKey  (0x2000000, {24, 48, 0x40, 0, 0,  (0x2000000, {24, 48, 0x40, 0, 0, "Software\Microsoft\Windows NT\CurrentVersion\winlogon"}, ... 348, ) }, ... 348, ) == 0x0
 02047   396   NtQueryValueKey  (348,  (348, "UserEnvDebugLevel", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02048   396   NtQueryValueKey  (348,  (348, "RsopLogging", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02049   396   NtClose  (348, ... ) == 0x0
 02050   396   NtOpenKey  (0x2000000, {24, 48, 0x40, 0, 0,  (0x2000000, {24, 48, 0x40, 0, 0, "Software\Policies\Microsoft\Windows\System"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02051   396   NtOpenKey  (0x2000000, {24, 48, 0x40, 0, 0,  (0x2000000, {24, 48, 0x40, 0, 0, "Software\Microsoft\Windows NT\CurrentVersion\winlogon"}, ... 348, ) }, ... 348, ) == 0x0
 02052   396   NtQueryValueKey  (348,  (348, "UserEnvDebugLevel", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02053   396   NtClose  (348, ... ) == 0x0
 02054   396   NtOpenKey  (0x2000000, {24, 48, 0x40, 0, 0,  (0x2000000, {24, 48, 0x40, 0, 0, "Software\Policies\Microsoft\Windows\System"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02055   396   NtAllocateVirtualMemory  (-1, 0, 0, 1, 4096, 4, ... 11272192, 4096, ) == 0x0
 02056   396   NtAllocateVirtualMemory  (-1, 1421312, 0, 4096, 4096, 4, ... 1421312, 4096, ) == 0x0
 02057   396   NtQueryVirtualMemory  (-1, 0xac0000, Basic, 28, ... {BaseAddress=0xac0000,AllocationBase=0xac0000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 0x0, ) == 0x0
 02058   396   NtQueryVirtualMemory  (-1, 0xac0000, Basic, 28, ... {BaseAddress=0xac0000,AllocationBase=0xac0000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 0x0, ) == 0x0
 02059   396   NtOpenKey  (0x20019, {24, 48, 0x40, 0, 0,  (0x20019, {24, 48, 0x40, 0, 0, "Software\Microsoft\Windows NT\CurrentVersion\ProfileList"}, ... 348, ) }, ... 348, ) == 0x0
 02060   396   NtQueryValueKey  (348,  (348, "ProfilesDirectory", Partial, 144, ... TitleIdx=0, Type=2, Data="%\0S\0y\0s\0t\0e\0m\0D\0r\0i\0v\0e\0%\0\\0D\0o\0c\0u\0m\0e\0n\0t\0s\0 \0a\0n\0d\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\0\0"}, 86, ) , Partial, 144, ... TitleIdx=0, Type=2, Data= (348, "ProfilesDirectory", Partial, 144, ... TitleIdx=0, Type=2, Data="%\0S\0y\0s\0t\0e\0m\0D\0r\0i\0v\0e\0%\0\\0D\0o\0c\0u\0m\0e\0n\0t\0s\0 \0a\0n\0d\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\0\0"}, 86, ) }, 86, ) == 0x0
 02061   396   NtClose  (348, ... ) == 0x0
 02062   396   NtOpenKey  (0x20019, {24, 48, 0x40, 0, 0,  (0x20019, {24, 48, 0x40, 0, 0, "Software\Microsoft\Windows NT\CurrentVersion\ProfileList"}, ... 348, ) }, ... 348, ) == 0x0
 02063   396   NtQueryValueKey  (348,  (348, "AllUsersProfile", Partial, 144, ... TitleIdx=0, Type=1, Data="A\0l\0l\0 \0U\0s\0e\0r\0s\0\0\0"}, 32, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (348, "AllUsersProfile", Partial, 144, ... TitleIdx=0, Type=1, Data="A\0l\0l\0 \0U\0s\0e\0r\0s\0\0\0"}, 32, ) }, 32, ) == 0x0
 02064   396   NtClose  (348, ... ) == 0x0
 02065   396   NtQueryVirtualMemory  (-1, 0xac0000, Basic, 28, ... {BaseAddress=0xac0000,AllocationBase=0xac0000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 0x0, ) == 0x0
 02066   396   NtOpenKey  (0x1, {24, 48, 0x40, 0, 0,  (0x1, {24, 48, 0x40, 0, 0, "System\CurrentControlSet\Control\Session Manager\Environment"}, ... 348, ) }, ... 348, ) == 0x0
 02067   396   NtQueryKey  (348, Full, 176, ... {LastWrite={0x7838d13c,0x1c73999}, TitleIdx=0, Subkeys=0, Values=12, Class=""}, 44, ) == 0x0
 02068   396   NtQuerySecurityObject  (348, 7, 0, ... ) == STATUS_ACCESS_DENIED
 02069   396   NtEnumerateValueKey  (348, 0, Full, 220, ... TitleIdx=0, Type=2, Name= (348, 0, Full, 220, ... TitleIdx=0, Type=2, Name="ComSpec", Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0s\0y\0s\0t\0e\0m\03\02\0\\0c\0m\0d\0.\0e\0x\0e\0\0\0"}, 96, ) , Data= (348, 0, Full, 220, ... TitleIdx=0, Type=2, Name="ComSpec", Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0s\0y\0s\0t\0e\0m\03\02\0\\0c\0m\0d\0.\0e\0x\0e\0\0\0"}, 96, ) }, 96, ) == 0x0
 02070   396   NtEnumerateValueKey  (348, 1, Full, 220, ... TitleIdx=0, Type=2, Name= (348, 1, Full, 220, ... TitleIdx=0, Type=2, Name="Path", Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0s\0y\0s\0t\0e\0m\03\02\0;\0%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0;\0%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0W\0b\0e\0m\0\0\0"}, 152, ) , Data= (348, 1, Full, 220, ... TitleIdx=0, Type=2, Name="Path", Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0s\0y\0s\0t\0e\0m\03\02\0;\0%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0;\0%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0W\0b\0e\0m\0\0\0"}, 152, ) }, 152, ) == 0x0
 02071   396   NtEnumerateValueKey  (348, 2, Full, 220, ... TitleIdx=0, Type=2, Name= (348, 2, Full, 220, ... TitleIdx=0, Type=2, Name="windir", Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\0\0"}, 58, ) , Data= (348, 2, Full, 220, ... TitleIdx=0, Type=2, Name="windir", Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\0\0"}, 58, ) }, 58, ) == 0x0
 02072   396   NtEnumerateValueKey  (348, 3, Full, 220, ... TitleIdx=0, Type=1, Name= (348, 3, Full, 220, ... TitleIdx=0, Type=1, Name="OS", Data="W\0i\0n\0d\0o\0w\0s\0_\0N\0T\0\0\0"}, 46, ) , Data= (348, 3, Full, 220, ... TitleIdx=0, Type=1, Name="OS", Data="W\0i\0n\0d\0o\0w\0s\0_\0N\0T\0\0\0"}, 46, ) }, 46, ) == 0x0
 02073   396   NtQueryVirtualMemory  (-1, 0xac0000, Basic, 28, ... {BaseAddress=0xac0000,AllocationBase=0xac0000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 0x0, ) == 0x0
 02074   396   NtEnumerateValueKey  (348, 4, Full, 220, ... TitleIdx=0, Type=1, Name= (348, 4, Full, 220, ... TitleIdx=0, Type=1, Name="PROCESSOR_ARCHITECTURE", Data="x\08\06\0\0\0"}, 72, ) , Data= (348, 4, Full, 220, ... TitleIdx=0, Type=1, Name="PROCESSOR_ARCHITECTURE", Data="x\08\06\0\0\0"}, 72, ) }, 72, ) == 0x0
 02075   396   NtQueryVirtualMemory  (-1, 0xac0000, Basic, 28, ... {BaseAddress=0xac0000,AllocationBase=0xac0000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 0x0, ) == 0x0
 02076   396   NtEnumerateValueKey  (348, 5, Full, 220, ... TitleIdx=0, Type=1, Name= (348, 5, Full, 220, ... TitleIdx=0, Type=1, Name="PROCESSOR_LEVEL", Data="1\05\0\0\0"}, 58, ) , Data= (348, 5, Full, 220, ... TitleIdx=0, Type=1, Name="PROCESSOR_LEVEL", Data="1\05\0\0\0"}, 58, ) }, 58, ) == 0x0
 02077   396   NtQueryVirtualMemory  (-1, 0xac0000, Basic, 28, ... {BaseAddress=0xac0000,AllocationBase=0xac0000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 0x0, ) == 0x0
 02078   396   NtEnumerateValueKey  (348, 6, Full, 220, ... TitleIdx=0, Type=1, Name= (348, 6, Full, 220, ... TitleIdx=0, Type=1, Name="PROCESSOR_IDENTIFIER", Data="x\08\06\0 \0F\0a\0m\0i\0l\0y\0 \01\05\0 \0M\0o\0d\0e\0l\0 \04\0 \0S\0t\0e\0p\0p\0i\0n\0g\0 \08\0,\0 \0G\0e\0n\0u\0i\0n\0e\0I\0n\0t\0e\0l\0\0\0"}, 154, ) , Data= (348, 6, Full, 220, ... TitleIdx=0, Type=1, Name="PROCESSOR_IDENTIFIER", Data="x\08\06\0 \0F\0a\0m\0i\0l\0y\0 \01\05\0 \0M\0o\0d\0e\0l\0 \04\0 \0S\0t\0e\0p\0p\0i\0n\0g\0 \08\0,\0 \0G\0e\0n\0u\0i\0n\0e\0I\0n\0t\0e\0l\0\0\0"}, 154, ) }, 154, ) == 0x0
 02079   396   NtQueryVirtualMemory  (-1, 0xac0000, Basic, 28, ... {BaseAddress=0xac0000,AllocationBase=0xac0000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 0x0, ) == 0x0
 02080   396   NtEnumerateValueKey  (348, 7, Full, 220, ... TitleIdx=0, Type=1, Name= (348, 7, Full, 220, ... TitleIdx=0, Type=1, Name="PROCESSOR_REVISION", Data="0\04\00\08\0\0\0"}, 66, ) , Data= (348, 7, Full, 220, ... TitleIdx=0, Type=1, Name="PROCESSOR_REVISION", Data="0\04\00\08\0\0\0"}, 66, ) }, 66, ) == 0x0
 02081   396   NtQueryVirtualMemory  (-1, 0xac0000, Basic, 28, ... {BaseAddress=0xac0000,AllocationBase=0xac0000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 0x0, ) == 0x0
 02082   396   NtEnumerateValueKey  (348, 8, Full, 220, ... TitleIdx=0, Type=1, Name= (348, 8, Full, 220, ... TitleIdx=0, Type=1, Name="NUMBER_OF_PROCESSORS", Data="1\0\0\0"}, 64, ) , Data= (348, 8, Full, 220, ... TitleIdx=0, Type=1, Name="NUMBER_OF_PROCESSORS", Data="1\0\0\0"}, 64, ) }, 64, ) == 0x0
 02083   396   NtQueryVirtualMemory  (-1, 0xac0000, Basic, 28, ... {BaseAddress=0xac0000,AllocationBase=0xac0000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 0x0, ) == 0x0
 02084   396   NtEnumerateValueKey  (348, 9, Full, 220, ... TitleIdx=0, Type=1, Name= (348, 9, Full, 220, ... TitleIdx=0, Type=1, Name="PATHEXT", Data=".\0C\0O\0M\0;\0.\0E\0X\0E\0;\0.\0B\0A\0T\0;\0.\0C\0M\0D\0;\0.\0V\0B\0S\0;\0.\0V\0B\0E\0;\0.\0J\0S\0;\0.\0J\0S\0E\0;\0.\0W\0S\0F\0;\0.\0W\0S\0H\0\0\0"}, 134, ) , Data= (348, 9, Full, 220, ... TitleIdx=0, Type=1, Name="PATHEXT", Data=".\0C\0O\0M\0;\0.\0E\0X\0E\0;\0.\0B\0A\0T\0;\0.\0C\0M\0D\0;\0.\0V\0B\0S\0;\0.\0V\0B\0E\0;\0.\0J\0S\0;\0.\0J\0S\0E\0;\0.\0W\0S\0F\0;\0.\0W\0S\0H\0\0\0"}, 134, ) }, 134, ) == 0x0
 02085   396   NtQueryVirtualMemory  (-1, 0xac0000, Basic, 28, ... {BaseAddress=0xac0000,AllocationBase=0xac0000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 0x0, ) == 0x0
 02086   396   NtEnumerateValueKey  (348, 10, Full, 220, ... TitleIdx=0, Type=2, Name= (348, 10, Full, 220, ... TitleIdx=0, Type=2, Name="TEMP", Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0T\0E\0M\0P\0\0\0"}, 64, ) , Data= (348, 10, Full, 220, ... TitleIdx=0, Type=2, Name="TEMP", Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0T\0E\0M\0P\0\0\0"}, 64, ) }, 64, ) == 0x0
 02087   396   NtEnumerateValueKey  (348, 11, Full, 220, ... TitleIdx=0, Type=2, Name= (348, 11, Full, 220, ... TitleIdx=0, Type=2, Name="TMP", Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0T\0E\0M\0P\0\0\0"}, 64, ) , Data= (348, 11, Full, 220, ... TitleIdx=0, Type=2, Name="TMP", Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0T\0E\0M\0P\0\0\0"}, 64, ) }, 64, ) == 0x0
 02088   396   NtEnumerateValueKey  (348, 0, Full, 220, ... TitleIdx=0, Type=2, Name= (348, 0, Full, 220, ... TitleIdx=0, Type=2, Name="ComSpec", Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0s\0y\0s\0t\0e\0m\03\02\0\\0c\0m\0d\0.\0e\0x\0e\0\0\0"}, 96, ) , Data= (348, 0, Full, 220, ... TitleIdx=0, Type=2, Name="ComSpec", Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0s\0y\0s\0t\0e\0m\03\02\0\\0c\0m\0d\0.\0e\0x\0e\0\0\0"}, 96, ) }, 96, ) == 0x0
 02089   396   NtQueryVirtualMemory  (-1, 0xac0000, Basic, 28, ... {BaseAddress=0xac0000,AllocationBase=0xac0000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 0x0, ) == 0x0
 02090   396   NtEnumerateValueKey  (348, 1, Full, 220, ... TitleIdx=0, Type=2, Name= (348, 1, Full, 220, ... TitleIdx=0, Type=2, Name="Path", Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0s\0y\0s\0t\0e\0m\03\02\0;\0%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0;\0%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0W\0b\0e\0m\0\0\0"}, 152, ) , Data= (348, 1, Full, 220, ... TitleIdx=0, Type=2, Name="Path", Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0s\0y\0s\0t\0e\0m\03\02\0;\0%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0;\0%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0W\0b\0e\0m\0\0\0"}, 152, ) }, 152, ) == 0x0
 02091   396   NtQueryVirtualMemory  (-1, 0xac0000, Basic, 28, ... {BaseAddress=0xac0000,AllocationBase=0xac0000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 0x0, ) == 0x0
 02092   396   NtEnumerateValueKey  (348, 2, Full, 220, ... TitleIdx=0, Type=2, Name= (348, 2, Full, 220, ... TitleIdx=0, Type=2, Name="windir", Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\0\0"}, 58, ) , Data= (348, 2, Full, 220, ... TitleIdx=0, Type=2, Name="windir", Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\0\0"}, 58, ) }, 58, ) == 0x0
 02093   396   NtQueryVirtualMemory  (-1, 0xac0000, Basic, 28, ... {BaseAddress=0xac0000,AllocationBase=0xac0000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 0x0, ) == 0x0
 02094   396   NtEnumerateValueKey  (348, 3, Full, 220, ... TitleIdx=0, Type=1, Name= (348, 3, Full, 220, ... TitleIdx=0, Type=1, Name="OS", Data="W\0i\0n\0d\0o\0w\0s\0_\0N\0T\0\0\0"}, 46, ) , Data= (348, 3, Full, 220, ... TitleIdx=0, Type=1, Name="OS", Data="W\0i\0n\0d\0o\0w\0s\0_\0N\0T\0\0\0"}, 46, ) }, 46, ) == 0x0
 02095   396   NtEnumerateValueKey  (348, 4, Full, 220, ... TitleIdx=0, Type=1, Name= (348, 4, Full, 220, ... TitleIdx=0, Type=1, Name="PROCESSOR_ARCHITECTURE", Data="x\08\06\0\0\0"}, 72, ) , Data= (348, 4, Full, 220, ... TitleIdx=0, Type=1, Name="PROCESSOR_ARCHITECTURE", Data="x\08\06\0\0\0"}, 72, ) }, 72, ) == 0x0
 02096   396   NtEnumerateValueKey  (348, 5, Full, 220, ... TitleIdx=0, Type=1, Name= (348, 5, Full, 220, ... TitleIdx=0, Type=1, Name="PROCESSOR_LEVEL", Data="1\05\0\0\0"}, 58, ) , Data= (348, 5, Full, 220, ... TitleIdx=0, Type=1, Name="PROCESSOR_LEVEL", Data="1\05\0\0\0"}, 58, ) }, 58, ) == 0x0
 02097   396   NtEnumerateValueKey  (348, 6, Full, 220, ... TitleIdx=0, Type=1, Name= (348, 6, Full, 220, ... TitleIdx=0, Type=1, Name="PROCESSOR_IDENTIFIER", Data="x\08\06\0 \0F\0a\0m\0i\0l\0y\0 \01\05\0 \0M\0o\0d\0e\0l\0 \04\0 \0S\0t\0e\0p\0p\0i\0n\0g\0 \08\0,\0 \0G\0e\0n\0u\0i\0n\0e\0I\0n\0t\0e\0l\0\0\0"}, 154, ) , Data= (348, 6, Full, 220, ... TitleIdx=0, Type=1, Name="PROCESSOR_IDENTIFIER", Data="x\08\06\0 \0F\0a\0m\0i\0l\0y\0 \01\05\0 \0M\0o\0d\0e\0l\0 \04\0 \0S\0t\0e\0p\0p\0i\0n\0g\0 \08\0,\0 \0G\0e\0n\0u\0i\0n\0e\0I\0n\0t\0e\0l\0\0\0"}, 154, ) }, 154, ) == 0x0
 02098   396   NtEnumerateValueKey  (348, 7, Full, 220, ... TitleIdx=0, Type=1, Name= (348, 7, Full, 220, ... TitleIdx=0, Type=1, Name="PROCESSOR_REVISION", Data="0\04\00\08\0\0\0"}, 66, ) , Data= (348, 7, Full, 220, ... TitleIdx=0, Type=1, Name="PROCESSOR_REVISION", Data="0\04\00\08\0\0\0"}, 66, ) }, 66, ) == 0x0
 02099   396   NtEnumerateValueKey  (348, 8, Full, 220, ... TitleIdx=0, Type=1, Name= (348, 8, Full, 220, ... TitleIdx=0, Type=1, Name="NUMBER_OF_PROCESSORS", Data="1\0\0\0"}, 64, ) , Data= (348, 8, Full, 220, ... TitleIdx=0, Type=1, Name="NUMBER_OF_PROCESSORS", Data="1\0\0\0"}, 64, ) }, 64, ) == 0x0
 02100   396   NtEnumerateValueKey  (348, 9, Full, 220, ... TitleIdx=0, Type=1, Name= (348, 9, Full, 220, ... TitleIdx=0, Type=1, Name="PATHEXT", Data=".\0C\0O\0M\0;\0.\0E\0X\0E\0;\0.\0B\0A\0T\0;\0.\0C\0M\0D\0;\0.\0V\0B\0S\0;\0.\0V\0B\0E\0;\0.\0J\0S\0;\0.\0J\0S\0E\0;\0.\0W\0S\0F\0;\0.\0W\0S\0H\0\0\0"}, 134, ) , Data= (348, 9, Full, 220, ... TitleIdx=0, Type=1, Name="PATHEXT", Data=".\0C\0O\0M\0;\0.\0E\0X\0E\0;\0.\0B\0A\0T\0;\0.\0C\0M\0D\0;\0.\0V\0B\0S\0;\0.\0V\0B\0E\0;\0.\0J\0S\0;\0.\0J\0S\0E\0;\0.\0W\0S\0F\0;\0.\0W\0S\0H\0\0\0"}, 134, ) }, 134, ) == 0x0
 02101   396   NtEnumerateValueKey  (348, 10, Full, 220, ... TitleIdx=0, Type=2, Name= (348, 10, Full, 220, ... TitleIdx=0, Type=2, Name="TEMP", Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0T\0E\0M\0P\0\0\0"}, 64, ) , Data= (348, 10, Full, 220, ... TitleIdx=0, Type=2, Name="TEMP", Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0T\0E\0M\0P\0\0\0"}, 64, ) }, 64, ) == 0x0
 02102   396   NtQueryInformationProcess  (-1, DefaultHardErrorMode, 4, ... {process info, class 12, size 4}, 0x0, ) == 0x0
 02103   396   NtSetInformationProcess  (-1, DefaultHardErrorMode, {process info, class 12, size 4}, 4, ... ) == 0x0
 02104   396   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\TEMP"}, 1238452, ... ) }, 1238452, ... ) == 0x0
 02105   396   NtQueryInformationProcess  (-1, DefaultHardErrorMode, 4, ... {process info, class 12, size 4}, 0x0, ) == 0x0
 02106   396   NtSetInformationProcess  (-1, DefaultHardErrorMode, {process info, class 12, size 4}, 4, ... ) == 0x0
 02107   396   NtQueryVirtualMemory  (-1, 0xac0000, Basic, 28, ... {BaseAddress=0xac0000,AllocationBase=0xac0000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 0x0, ) == 0x0
 02108   396   NtEnumerateValueKey  (348, 11, Full, 220, ... TitleIdx=0, Type=2, Name= (348, 11, Full, 220, ... TitleIdx=0, Type=2, Name="TMP", Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0T\0E\0M\0P\0\0\0"}, 64, ) , Data= (348, 11, Full, 220, ... TitleIdx=0, Type=2, Name="TMP", Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0T\0E\0M\0P\0\0\0"}, 64, ) }, 64, ) == 0x0
 02109   396   NtQueryInformationProcess  (-1, DefaultHardErrorMode, 4, ... {process info, class 12, size 4}, 0x0, ) == 0x0
 02110   396   NtSetInformationProcess  (-1, DefaultHardErrorMode, {process info, class 12, size 4}, 4, ... ) == 0x0
 02111   396   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\TEMP"}, 1238452, ... ) }, 1238452, ... ) == 0x0
 02112   396   NtQueryInformationProcess  (-1, DefaultHardErrorMode, 4, ... {process info, class 12, size 4}, 0x0, ) == 0x0
 02113   396   NtSetInformationProcess  (-1, DefaultHardErrorMode, {process info, class 12, size 4}, 4, ... ) == 0x0
 02114   396   NtQueryVirtualMemory  (-1, 0xac0000, Basic, 28, ... {BaseAddress=0xac0000,AllocationBase=0xac0000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 0x0, ) == 0x0
 02115   396   NtClose  (348, ... ) == 0x0
 02116   396   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\System\CurrentControlSet\Control\ComputerName"}, ... 348, ) }, ... 348, ) == 0x0
 02117   396   NtOpenKey  (0x20019, {24, 348, 0x40, 0, 0,  (0x20019, {24, 348, 0x40, 0, 0, "ActiveComputerName"}, ... 352, ) }, ... 352, ) == 0x0
 02118   396   NtQueryValueKey  (352,  (352, "ComputerName", Full, 108, ... TitleIdx=0, Type=1, Name="ComputerName", Data="M\0Y\0W\0O\0R\0L\0D\0\0\0"}, 60, ) , Full, 108, ... TitleIdx=0, Type=1, Name= (352, "ComputerName", Full, 108, ... TitleIdx=0, Type=1, Name="ComputerName", Data="M\0Y\0W\0O\0R\0L\0D\0\0\0"}, 60, ) , Data= (352, "ComputerName", Full, 108, ... TitleIdx=0, Type=1, Name="ComputerName", Data="M\0Y\0W\0O\0R\0L\0D\0\0\0"}, 60, ) }, 60, ) == 0x0
 02119   396   NtClose  (352, ... ) == 0x0
 02120   396   NtClose  (348, ... ) == 0x0
 02121   396   NtQueryVirtualMemory  (-1, 0xac0000, Basic, 28, ... {BaseAddress=0xac0000,AllocationBase=0xac0000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 0x0, ) == 0x0
 02122   396   NtOpenKey  (0x20019, {24, 48, 0x40, 0, 0,  (0x20019, {24, 48, 0x40, 0, 0, "Software\Microsoft\Windows NT\CurrentVersion\ProfileList"}, ... 348, ) }, ... 348, ) == 0x0
 02123   396   NtQueryValueKey  (348,  (348, "ProfilesDirectory", Partial, 144, ... TitleIdx=0, Type=2, Data="%\0S\0y\0s\0t\0e\0m\0D\0r\0i\0v\0e\0%\0\\0D\0o\0c\0u\0m\0e\0n\0t\0s\0 \0a\0n\0d\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\0\0"}, 86, ) , Partial, 144, ... TitleIdx=0, Type=2, Data= (348, "ProfilesDirectory", Partial, 144, ... TitleIdx=0, Type=2, Data="%\0S\0y\0s\0t\0e\0m\0D\0r\0i\0v\0e\0%\0\\0D\0o\0c\0u\0m\0e\0n\0t\0s\0 \0a\0n\0d\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\0\0"}, 86, ) }, 86, ) == 0x0
 02124   396   NtClose  (348, ... ) == 0x0
 02125   396   NtOpenKey  (0x20019, {24, 48, 0x40, 0, 0,  (0x20019, {24, 48, 0x40, 0, 0, "Software\Microsoft\Windows NT\CurrentVersion\ProfileList"}, ... 348, ) }, ... 348, ) == 0x0
 02126   396   NtQueryValueKey  (348,  (348, "DefaultUserProfile", Partial, 144, ... TitleIdx=0, Type=1, Data="D\0e\0f\0a\0u\0l\0t\0 \0U\0s\0e\0r\0\0\0"}, 38, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (348, "DefaultUserProfile", Partial, 144, ... TitleIdx=0, Type=1, Data="D\0e\0f\0a\0u\0l\0t\0 \0U\0s\0e\0r\0\0\0"}, 38, ) }, 38, ) == 0x0
 02127   396   NtClose  (348, ... ) == 0x0
 02128   396   NtQueryVirtualMemory  (-1, 0xac0000, Basic, 28, ... {BaseAddress=0xac0000,AllocationBase=0xac0000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 0x0, ) == 0x0
 02129   396   NtOpenKey  (0x20019, {24, 48, 0x40, 0, 0,  (0x20019, {24, 48, 0x40, 0, 0, "Software\Microsoft\Windows\CurrentVersion"}, ... 348, ) }, ... 348, ) == 0x0
 02130   396   NtQueryValueKey  (348,  (348, "ProgramFilesDir", Partial, 144, ... TitleIdx=0, Type=1, Data="C\0:\0\\0P\0r\0o\0g\0r\0a\0m\0 \0F\0i\0l\0e\0s\0\0\0"}, 46, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (348, "ProgramFilesDir", Partial, 144, ... TitleIdx=0, Type=1, Data="C\0:\0\\0P\0r\0o\0g\0r\0a\0m\0 \0F\0i\0l\0e\0s\0\0\0"}, 46, ) }, 46, ) == 0x0
 02131   396   NtQueryVirtualMemory  (-1, 0xac0000, Basic, 28, ... {BaseAddress=0xac0000,AllocationBase=0xac0000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 0x0, ) == 0x0
 02132   396   NtQueryValueKey  (348,  (348, "CommonFilesDir", Partial, 144, ... TitleIdx=0, Type=1, Data="C\0:\0\\0P\0r\0o\0g\0r\0a\0m\0 \0F\0i\0l\0e\0s\0\\0C\0o\0m\0m\0o\0n\0 \0F\0i\0l\0e\0s\0\0\0"}, 72, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (348, "CommonFilesDir", Partial, 144, ... TitleIdx=0, Type=1, Data="C\0:\0\\0P\0r\0o\0g\0r\0a\0m\0 \0F\0i\0l\0e\0s\0\\0C\0o\0m\0m\0o\0n\0 \0F\0i\0l\0e\0s\0\0\0"}, 72, ) }, 72, ) == 0x0
 02133   396   NtQueryVirtualMemory  (-1, 0xac0000, Basic, 28, ... {BaseAddress=0xac0000,AllocationBase=0xac0000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 0x0, ) == 0x0
 02134   396   NtClose  (348, ... ) == 0x0
 02135   396   NtQueryInformationToken  (336, User, 200, ... {token info, class 1, size 36}, 36, ) == 0x0
 02136   396   NtOpenKey  (0x20019, {24, 328, 0x40, 0, 0,  (0x20019, {24, 328, 0x40, 0, 0, "S-1-5-21-1078081533-484763869-839522115-1003"}, ... 348, ) }, ... 348, ) == 0x0
 02137   396   NtOpenThreadToken  (-2, 0x2000c, 1, ... ) == STATUS_NO_TOKEN
 02138   396   NtQueryInformationToken  (336, Type, 4, ... {token info, class 8, size 4}, 4, ) == 0x0
 02139   396   NtDuplicateToken  (336, 0xc, {24, 0, 0x0, 0, 1239836, 0x0}, 0, 2, ... ) == STATUS_ACCESS_DENIED
 02140   396   NtQueryInformationToken  (336, User, 200, ... {token info, class 1, size 36}, 36, ) == 0x0
 02141   396   NtOpenThreadToken  (-2, 0xc, 1, ... ) == STATUS_NO_TOKEN
 02142   396   NtCreateEvent  (0x1f0003, 0x0, 1, 0, ... 352, ) == 0x0
 02143   396   NtOpenThreadToken  (-2, 0xc, 1, ... ) == STATUS_NO_TOKEN
 02144   396   NtSetInformationThread  (-2, ImpersonationToken, {ImpToken=0,}, 4, ... ) == 0x0
 02145   396   NtCreateFile  (0xc0100080, {24, 0, 0x40, 0, 1238040,  (0xc0100080, {24, 0, 0x40, 0, 1238040, "\??\PIPE\lsarpc"}, 0x0, 0, 3, 1, 64, 0, 0, ... 356, {status=0x0, info=1}, ) }, 0x0, 0, 3, 1, 64, 0, 0, ... 356, {status=0x0, info=1}, ) == 0x0
 02146   396   NtSetInformationFile  (356, 1238096, 8, Pipe, ... {status=0x0, info=0}, ) == 0x0
 02147   396   NtSetInformationFile  (356, 1238088, 8, Completion, ... {status=0x0, info=0}, ) == 0x0
 02148   396   NtSetInformationThread  (-2, ImpersonationToken, {ImpToken=0,}, 4, ... ) == 0x0
 02149   396   NtWriteFile  (356, 297, 0, 0,  (356, 297, 0, 0, "\5\0\13\3\20\0\0\0H\0\0\0\1\0\0\0\270\20\270\20\0\0\0\0\1\0\0\0\0\0\1\0xW4\224\22\315\253\357\0\1#Eg\211\253\0\0\0\0\4]\210\212\353\34\311\21\237\350\10\0+\20H`\2\0\0\0", 72, {0, 0}, 0, ... {status=0x0, info=72}, ) , 72, {0, 0}, 0, ... {status=0x0, info=72}, ) == 0x0
 02150   396   NtReadFile  (356, 297, 0, 0, 1024, {0, 0}, 0, ... {status=0x0, info=68},  (356, 297, 0, 0, 1024, {0, 0}, 0, ... {status=0x0, info=68}, "\5\0\14\3\20\0\0\0D\0\0\0\1\0\0\0\270\20\270\20\221%\0\0\14\0\PIPE\lsass\0\0\0\1\0\0\0\0\0\0\0\4]\210\212\353\34\311\21\237\350\10\0+\20H`\2\0\0\0", ) , ) == 0x0
 02151   396   NtFsControlFile  (356, 297, 0x0, 0x0, 0x11c017,  (356, 297, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0@\0\0\0\1\0\0\0(\0\0\0\0\0,\0\0\0\0\0\30\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\314\352\22\0\14\0\0\0\2\0\1\0\0\10\0\0", 64, 1024, ... {status=0x103, info=68}, "\5\0\14\3\20\0\0\0D\0\0\0\1\0\0\0\270\20\270\20\221%\0\0\14\0\PIPE\lsass\0\0\0\1\0\0\0\0\0\0\0\4]\210\212\353\34\311\21\237\350\10\0+\20H`\2\0\0\0", ) , 64, 1024, ... {status=0x103, info=68},  (356, 297, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0@\0\0\0\1\0\0\0(\0\0\0\0\0,\0\0\0\0\0\30\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\314\352\22\0\14\0\0\0\2\0\1\0\0\10\0\0", 64, 1024, ... {status=0x103, info=68}, "\5\0\14\3\20\0\0\0D\0\0\0\1\0\0\0\270\20\270\20\221%\0\0\14\0\PIPE\lsass\0\0\0\1\0\0\0\0\0\0\0\4]\210\212\353\34\311\21\237\350\10\0+\20H`\2\0\0\0", ) , ) == 0x103
 02152   396   NtFsControlFile  (356, 297, 0x0, 0x0, 0x11c017,  (356, 297, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0t\0\0\0\2\0\0\0\\0\0\0\0\09\0\0\0\0\0oF\235\311\333?\334\21\261\310\0\14)\371\246\305\1\0\0\0\4\353\22\0\1\0\0\0p\254\25\0\5\0\0\0\1\5\0\0\0\0\0\5\25\0\0\0\3757B@\335\350\344\34C\27\122\353\3\0\0\0\0\0\0\0\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0", 116, 1024, ... {status=0x103, info=48}, "\5\0\2\3\20\0\0\00\0\0\0\1\0\0\0\30\0\0\0\0\0\0\0\0\0\0\0oF\235\311\333?\334\21\261\310\0\14)\371\246\305\0\0\0\0", ) , 116, 1024, ... {status=0x103, info=48},  (356, 297, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0t\0\0\0\2\0\0\0\\0\0\0\0\09\0\0\0\0\0oF\235\311\333?\334\21\261\310\0\14)\371\246\305\1\0\0\0\4\353\22\0\1\0\0\0p\254\25\0\5\0\0\0\1\5\0\0\0\0\0\5\25\0\0\0\3757B@\335\350\344\34C\27\122\353\3\0\0\0\0\0\0\0\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0", 116, 1024, ... {status=0x103, info=48}, "\5\0\2\3\20\0\0\00\0\0\0\1\0\0\0\30\0\0\0\0\0\0\0\0\0\0\0oF\235\311\333?\334\21\261\310\0\14)\371\246\305\0\0\0\0", ) , ) == 0x103
 02153   396   NtFsControlFile  (356, 297, 0x0, 0x0, 0x11c017,  (356, 297, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0,\0\0\0\3\0\0\0\24\0\0\0\0\0\0\0\0\0\0\0oF\235\311\333?\334\21\261\310\0\14)\371\246\305", 44, 1024, ... {status=0x103, info=180}, "\5\0\2\3\20\0\0\0\264\0\0\0\2\0\0\0\234\0\0\0\0\0\0\0\230\254\25\0\1\0\0\0\244\254\25\0 \0\0\0\1\0\0\0\16\0\20\0\260\254\25\0\300\254\25\0\10\0\0\0\0\0\0\0\7\0\0\0M\0Y\0W\0O\0R\0L\0D\0O\0\4\0\0\0\1\4\0\0\0\0\0\5\25\0\0\0\3757B@\335\350\344\34C\27\122\1\0\0\0P\257\25\0\1\0\0\0\1\0\0\0\20\0\22\0d\257\25\0\0\0\0\0\0\0\0\0\11\0\0\0\0\0\0\0\10\0\0\0S\0R\0I\0-\0u\0s\0e\0r\0\1\0\0\0\0\0\0\0", ) , 44, 1024, ... {status=0x103, info=180},  (356, 297, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0,\0\0\0\3\0\0\0\24\0\0\0\0\0\0\0\0\0\0\0oF\235\311\333?\334\21\261\310\0\14)\371\246\305", 44, 1024, ... {status=0x103, info=180}, "\5\0\2\3\20\0\0\0\264\0\0\0\2\0\0\0\234\0\0\0\0\0\0\0\230\254\25\0\1\0\0\0\244\254\25\0 \0\0\0\1\0\0\0\16\0\20\0\260\254\25\0\300\254\25\0\10\0\0\0\0\0\0\0\7\0\0\0M\0Y\0W\0O\0R\0L\0D\0O\0\4\0\0\0\1\4\0\0\0\0\0\5\25\0\0\0\3757B@\335\350\344\34C\27\122\1\0\0\0P\257\25\0\1\0\0\0\1\0\0\0\20\0\22\0d\257\25\0\0\0\0\0\0\0\0\0\11\0\0\0\0\0\0\0\10\0\0\0S\0R\0I\0-\0u\0s\0e\0r\0\1\0\0\0\0\0\0\0", ) , ) == 0x103
 02154   396   NtClose  (352, ... ) == 0x0
 02155   396   NtClose  (356, ... ) == 0x0
 02156   396   NtOpenThreadToken  (-2, 0xc, 1, ... ) == STATUS_NO_TOKEN
 02157   396   NtCreateEvent  (0x1f0003, 0x0, 1, 0, ... 356, ) == 0x0
 02158   396   NtOpenThreadToken  (-2, 0xc, 1, ... ) == STATUS_NO_TOKEN
 02159   396   NtSetInformationThread  (-2, ImpersonationToken, {ImpToken=0,}, 4, ... ) == 0x0
 02160   396   NtCreateFile  (0xc0100080, {24, 0, 0x40, 0, 1238036,  (0xc0100080, {24, 0, 0x40, 0, 1238036, "\??\PIPE\lsarpc"}, 0x0, 0, 3, 1, 64, 0, 0, ... 352, {status=0x0, info=1}, ) }, 0x0, 0, 3, 1, 64, 0, 0, ... 352, {status=0x0, info=1}, ) == 0x0
 02161   396   NtSetInformationFile  (352, 1238092, 8, Pipe, ... {status=0x0, info=0}, ) == 0x0
 02162   396   NtSetInformationFile  (352, 1238084, 8, Completion, ... {status=0x0, info=0}, ) == 0x0
 02163   396   NtSetInformationThread  (-2, ImpersonationToken, {ImpToken=0,}, 4, ... ) == 0x0
 02164   396   NtWriteFile  (352, 297, 0, 0,  (352, 297, 0, 0, "\5\0\13\3\20\0\0\0H\0\0\0\1\0\0\0\270\20\270\20\0\0\0\0\1\0\0\0\0\0\1\0xW4\224\22\315\253\357\0\1#Eg\211\253\0\0\0\0\4]\210\212\353\34\311\21\237\350\10\0+\20H`\2\0\0\0", 72, {0, 0}, 0, ... {status=0x0, info=72}, ) , 72, {0, 0}, 0, ... {status=0x0, info=72}, ) == 0x0
 02165   396   NtReadFile  (352, 297, 0, 0, 1024, {0, 0}, 0, ... {status=0x0, info=68},  (352, 297, 0, 0, 1024, {0, 0}, 0, ... {status=0x0, info=68}, "\5\0\14\3\20\0\0\0D\0\0\0\1\0\0\0\270\20\270\20\222%\0\0\14\0\PIPE\lsass\0\0\0\1\0\0\0\0\0\0\0\4]\210\212\353\34\311\21\237\350\10\0+\20H`\2\0\0\0", ) , ) == 0x0
 02166   396   NtFsControlFile  (352, 297, 0x0, 0x0, 0x11c017,  (352, 297, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0@\0\0\0\1\0\0\0(\0\0\0\0\0,\0\0\0\0\0\30\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\310\352\22\0\14\0\0\0\2\0\1\0\0\10\0\0", 64, 1024, ... {status=0x103, info=68}, "\5\0\14\3\20\0\0\0D\0\0\0\1\0\0\0\270\20\270\20\222%\0\0\14\0\PIPE\lsass\0\0\0\1\0\0\0\0\0\0\0\4]\210\212\353\34\311\21\237\350\10\0+\20H`\2\0\0\0", ) , 64, 1024, ... {status=0x103, info=68},  (352, 297, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0@\0\0\0\1\0\0\0(\0\0\0\0\0,\0\0\0\0\0\30\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\310\352\22\0\14\0\0\0\2\0\1\0\0\10\0\0", 64, 1024, ... {status=0x103, info=68}, "\5\0\14\3\20\0\0\0D\0\0\0\1\0\0\0\270\20\270\20\222%\0\0\14\0\PIPE\lsass\0\0\0\1\0\0\0\0\0\0\0\4]\210\212\353\34\311\21\237\350\10\0+\20H`\2\0\0\0", ) , ) == 0x103
 02167   396   NtFsControlFile  (352, 297, 0x0, 0x0, 0x11c017,  (352, 297, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0t\0\0\0\2\0\0\0\\0\0\0\0\09\0\0\0\0\0pF\235\311\333?\334\21\261\310\0\14)\371\246\305\1\0\0\0\0\353\22\0\1\0\0\0p\254\25\0\5\0\0\0\1\5\0\0\0\0\0\5\25\0\0\0\3757B@\335\350\344\34C\27\122\353\3\0\0\0\0\0\0\0\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0", 116, 1024, ... {status=0x103, info=48}, "\5\0\2\3\20\0\0\00\0\0\0\1\0\0\0\30\0\0\0\0\0\0\0\0\0\0\0pF\235\311\333?\334\21\261\310\0\14)\371\246\305\0\0\0\0", ) , 116, 1024, ... {status=0x103, info=48},  (352, 297, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0t\0\0\0\2\0\0\0\\0\0\0\0\09\0\0\0\0\0pF\235\311\333?\334\21\261\310\0\14)\371\246\305\1\0\0\0\0\353\22\0\1\0\0\0p\254\25\0\5\0\0\0\1\5\0\0\0\0\0\5\25\0\0\0\3757B@\335\350\344\34C\27\122\353\3\0\0\0\0\0\0\0\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0", 116, 1024, ... {status=0x103, info=48}, "\5\0\2\3\20\0\0\00\0\0\0\1\0\0\0\30\0\0\0\0\0\0\0\0\0\0\0pF\235\311\333?\334\21\261\310\0\14)\371\246\305\0\0\0\0", ) , ) == 0x103
 02168   396   NtFsControlFile  (352, 297, 0x0, 0x0, 0x11c017,  (352, 297, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0,\0\0\0\3\0\0\0\24\0\0\0\0\0\0\0\0\0\0\0pF\235\311\333?\334\21\261\310\0\14)\371\246\305", 44, 1024, ... {status=0x103, info=180}, "\5\0\2\3\20\0\0\0\264\0\0\0\2\0\0\0\234\0\0\0\0\0\0\0\230\254\25\0\1\0\0\0\244\254\25\0 \0\0\0\1\0\0\0\16\0\20\0\260\254\25\0\300\254\25\0\10\0\0\0\0\0\0\0\7\0\0\0M\0Y\0W\0O\0R\0L\0D\0O\0\4\0\0\0\1\4\0\0\0\0\0\5\25\0\0\0\3757B@\335\350\344\34C\27\122\1\0\0\0P\257\25\0\1\0\0\0\1\0\0\0\20\0\22\0d\257\25\0\0\0\0\0\0\0\0\0\11\0\0\0\0\0\0\0\10\0\0\0S\0R\0I\0-\0u\0s\0e\0r\0\1\0\0\0\0\0\0\0", ) , 44, 1024, ... {status=0x103, info=180},  (352, 297, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0,\0\0\0\3\0\0\0\24\0\0\0\0\0\0\0\0\0\0\0pF\235\311\333?\334\21\261\310\0\14)\371\246\305", 44, 1024, ... {status=0x103, info=180}, "\5\0\2\3\20\0\0\0\264\0\0\0\2\0\0\0\234\0\0\0\0\0\0\0\230\254\25\0\1\0\0\0\244\254\25\0 \0\0\0\1\0\0\0\16\0\20\0\260\254\25\0\300\254\25\0\10\0\0\0\0\0\0\0\7\0\0\0M\0Y\0W\0O\0R\0L\0D\0O\0\4\0\0\0\1\4\0\0\0\0\0\5\25\0\0\0\3757B@\335\350\344\34C\27\122\1\0\0\0P\257\25\0\1\0\0\0\1\0\0\0\20\0\22\0d\257\25\0\0\0\0\0\0\0\0\0\11\0\0\0\0\0\0\0\10\0\0\0S\0R\0I\0-\0u\0s\0e\0r\0\1\0\0\0\0\0\0\0", ) , ) == 0x103
 02169   396   NtClose  (356, ... ) == 0x0
 02170   396   NtClose  (352, ... ) == 0x0
 02171   396   NtOpenEvent  (0x100000, {24, 0, 0x0, 0, 0,  (0x100000, {24, 0, 0x0, 0, 0, "\INSTALLATION_SECURITY_HOLD"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02172   396   NtOpenThreadToken  (-2, 0xc, 1, ... ) == STATUS_NO_TOKEN
 02173   396   NtCreateEvent  (0x1f0003, 0x0, 1, 0, ... 352, ) == 0x0
 02174   396   NtOpenThreadToken  (-2, 0xc, 1, ... ) == STATUS_NO_TOKEN
 02175   396   NtSetInformationThread  (-2, ImpersonationToken, {ImpToken=0,}, 4, ... ) == 0x0
 02176   396   NtCreateFile  (0xc0100080, {24, 0, 0x40, 0, 1237668,  (0xc0100080, {24, 0, 0x40, 0, 1237668, "\??\PIPE\lsarpc"}, 0x0, 0, 3, 1, 64, 0, 0, ... 356, {status=0x0, info=1}, ) }, 0x0, 0, 3, 1, 64, 0, 0, ... 356, {status=0x0, info=1}, ) == 0x0
 02177   396   NtSetInformationFile  (356, 1237724, 8, Pipe, ... {status=0x0, info=0}, ) == 0x0
 02178   396   NtSetInformationFile  (356, 1237716, 8, Completion, ... {status=0x0, info=0}, ) == 0x0
 02179   396   NtSetInformationThread  (-2, ImpersonationToken, {ImpToken=0,}, 4, ... ) == 0x0
 02180   396   NtWriteFile  (356, 297, 0, 0,  (356, 297, 0, 0, "\5\0\13\3\20\0\0\0H\0\0\0\1\0\0\0\270\20\270\20\0\0\0\0\1\0\0\0\0\0\1\0j(\319\14\261\320\21\233\250\0\300O\331.\365\0\0\0\0\4]\210\212\353\34\311\21\237\350\10\0+\20H`\2\0\0\0", 72, {0, 0}, 0, ... {status=0x0, info=72}, ) , 72, {0, 0}, 0, ... {status=0x0, info=72}, ) == 0x0
 02181   396   NtReadFile  (356, 297, 0, 0, 1024, {0, 0}, 0, ... {status=0x0, info=68},  (356, 297, 0, 0, 1024, {0, 0}, 0, ... {status=0x0, info=68}, "\5\0\14\3\20\0\0\0D\0\0\0\1\0\0\0\270\20\270\20\223%\0\0\14\0\PIPE\lsass\0\0\0\1\0\0\0\0\0\0\0\4]\210\212\353\34\311\21\237\350\10\0+\20H`\2\0\0\0", ) , ) == 0x0
 02182   396   NtFsControlFile  (356, 297, 0x0, 0x0, 0x11c017,  (356, 297, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0\32\0\0\0\1\0\0\0\2\0\0\0\0\0\0\0\1\0", 26, 1024, ... {status=0x103, info=68}, "\5\0\14\3\20\0\0\0D\0\0\0\1\0\0\0\270\20\270\20\223%\0\0\14\0\PIPE\lsass\0\0\0\1\0\0\0\0\0\0\0\4]\210\212\353\34\311\21\237\350\10\0+\20H`\2\0\0\0", ) , 26, 1024, ... {status=0x103, info=68},  (356, 297, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0\32\0\0\0\1\0\0\0\2\0\0\0\0\0\0\0\1\0", 26, 1024, ... {status=0x103, info=68}, "\5\0\14\3\20\0\0\0D\0\0\0\1\0\0\0\270\20\270\20\223%\0\0\14\0\PIPE\lsass\0\0\0\1\0\0\0\0\0\0\0\4]\210\212\353\34\311\21\237\350\10\0+\20H`\2\0\0\0", ) , ) == 0x103
 02183   396   NtClose  (352, ... ) == 0x0
 02184   396   NtClose  (356, ... ) == 0x0
 02185   396   NtQueryVirtualMemory  (-1, 0xac0000, Basic, 28, ... {BaseAddress=0xac0000,AllocationBase=0xac0000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 0x0, ) == 0x0
 02186   396   NtQueryVirtualMemory  (-1, 0xac0000, Basic, 28, ... {BaseAddress=0xac0000,AllocationBase=0xac0000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 0x0, ) == 0x0
 02187   396   NtQueryInformationToken  (336, User, 200, ... {token info, class 1, size 36}, 36, ) == 0x0
 02188   396   NtOpenKey  (0x20019, {24, 48, 0x40, 0, 0,  (0x20019, {24, 48, 0x40, 0, 0, "Software\Microsoft\Windows NT\CurrentVersion\ProfileList\S-1-5-21-1078081533-484763869-839522115-1003"}, ... 356, ) }, ... 356, ) == 0x0
 02189   396   NtQueryValueKey  (356,  (356, "ProfileImagePath", Partial, 144, ... TitleIdx=0, Type=2, Data="%\0S\0y\0s\0t\0e\0m\0D\0r\0i\0v\0e\0%\0\\0D\0o\0c\0u\0m\0e\0n\0t\0s\0 \0a\0n\0d\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0S\0R\0I\0-\0u\0s\0e\0r\0\0\0"}, 104, ) , Partial, 144, ... TitleIdx=0, Type=2, Data= (356, "ProfileImagePath", Partial, 144, ... TitleIdx=0, Type=2, Data="%\0S\0y\0s\0t\0e\0m\0D\0r\0i\0v\0e\0%\0\\0D\0o\0c\0u\0m\0e\0n\0t\0s\0 \0a\0n\0d\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0S\0R\0I\0-\0u\0s\0e\0r\0\0\0"}, 104, ) }, 104, ) == 0x0
 02190   396   NtClose  (356, ... ) == 0x0
 02191   396   NtCreateKey  (0x2001f, {24, 348, 0x40, 0, 0,  (0x2001f, {24, 348, 0x40, 0, 0, "Software\Microsoft\Windows NT\CurrentVersion\Winlogon"}, 0, 0x0, 0, ... 356, 2, ) }, 0, 0x0, 0, ... 356, 2, ) == 0x0
 02192   396   NtQueryValueKey  (356,  (356, "ParseAutoexec", Partial, 144, ... TitleIdx=0, Type=1, Data="1\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (356, "ParseAutoexec", Partial, 144, ... TitleIdx=0, Type=1, Data="1\0\0\0"}, 16, ) }, 16, ) == 0x0
 02193   396   NtClose  (356, ... ) == 0x0
 02194   396   NtQueryInformationProcess  (-1, DefaultHardErrorMode, 4, ... {process info, class 12, size 4}, 0x0, ) == 0x0
 02195   396   NtSetInformationProcess  (-1, DefaultHardErrorMode, {process info, class 12, size 4}, 4, ... ) == 0x0
 02196   396   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\c:\autoexec.bat"}, 1239740, ... ) }, 1239740, ... ) == 0x0
 02197   396   NtCreateFile  (0x80100080, {24, 0, 0x40, 0, 1239748,  (0x80100080, {24, 0, 0x40, 0, 1239748, "\??\c:\autoexec.bat"}, 0x0, 128, 1, 1, 96, 0, 0, ... 356, {status=0x0, info=1}, ) }, 0x0, 128, 1, 1, 96, 0, 0, ... 356, {status=0x0, info=1}, ) == 0x0
 02198   396   NtQueryInformationProcess  (-1, DefaultHardErrorMode, 4, ... {process info, class 12, size 4}, 0x0, ) == 0x0
 02199   396   NtSetInformationProcess  (-1, DefaultHardErrorMode, {process info, class 12, size 4}, 4, ... ) == 0x0
 02200   396   NtQueryInformationFile  (356, 1239764, 24, Standard, ... {status=0x0, info=24}, ) == 0x0
 02201   396   NtReadFile  (356, 0, 0, 0, 0, 0x0, 0, ... {status=0x0, info=0}, "", ) == 0x0
 02202   396   NtClose  (356, ... ) == 0x0
 02203   396   NtOpenKey  (0x20019, {24, 348, 0x40, 0, 0,  (0x20019, {24, 348, 0x40, 0, 0, "Environment"}, ... 356, ) }, ... 356, ) == 0x0
 02204   396   NtAllocateVirtualMemory  (-1, 1425408, 0, 12288, 4096, 4, ... 1425408, 12288, ) == 0x0
 02205   396   NtEnumerateValueKey  (356, 0, Full, 220, ... TitleIdx=0, Type=2, Name= (356, 0, Full, 220, ... TitleIdx=0, Type=2, Name="TEMP", Data="%\0U\0S\0E\0R\0P\0R\0O\0F\0I\0L\0E\0%\0\\0L\0o\0c\0a\0l\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0T\0e\0m\0p\0\0\0"}, 96, ) , Data= (356, 0, Full, 220, ... TitleIdx=0, Type=2, Name="TEMP", Data="%\0U\0S\0E\0R\0P\0R\0O\0F\0I\0L\0E\0%\0\\0L\0o\0c\0a\0l\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0T\0e\0m\0p\0\0\0"}, 96, ) }, 96, ) == 0x0
 02206   396   NtEnumerateValueKey  (356, 1, Full, 220, ... TitleIdx=0, Type=2, Name= (356, 1, Full, 220, ... TitleIdx=0, Type=2, Name="TMP", Data="%\0U\0S\0E\0R\0P\0R\0O\0F\0I\0L\0E\0%\0\\0L\0o\0c\0a\0l\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0T\0e\0m\0p\0\0\0"}, 96, ) , Data= (356, 1, Full, 220, ... TitleIdx=0, Type=2, Name="TMP", Data="%\0U\0S\0E\0R\0P\0R\0O\0F\0I\0L\0E\0%\0\\0L\0o\0c\0a\0l\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0T\0e\0m\0p\0\0\0"}, 96, ) }, 96, ) == 0x0
 02207   396   NtEnumerateValueKey  (356, 2, Full, 220, ... ) == STATUS_NO_MORE_ENTRIES
 02208   396   NtEnumerateValueKey  (356, 0, Full, 220, ... TitleIdx=0, Type=2, Name= (356, 0, Full, 220, ... TitleIdx=0, Type=2, Name="TEMP", Data="%\0U\0S\0E\0R\0P\0R\0O\0F\0I\0L\0E\0%\0\\0L\0o\0c\0a\0l\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0T\0e\0m\0p\0\0\0"}, 96, ) , Data= (356, 0, Full, 220, ... TitleIdx=0, Type=2, Name="TEMP", Data="%\0U\0S\0E\0R\0P\0R\0O\0F\0I\0L\0E\0%\0\\0L\0o\0c\0a\0l\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0T\0e\0m\0p\0\0\0"}, 96, ) }, 96, ) == 0x0
 02209   396   NtQueryInformationProcess  (-1, DefaultHardErrorMode, 4, ... {process info, class 12, size 4}, 0x0, ) == 0x0
 02210   396   NtSetInformationProcess  (-1, DefaultHardErrorMode, {process info, class 12, size 4}, 4, ... ) == 0x0
 02211   396   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\Documents and Settings\SRI-user\Local Settings\Temp"}, 1238480, ... ) }, 1238480, ... ) == 0x0
 02212   396   NtOpenFile  (0x100001, {24, 0, 0x40, 0, 0,  (0x100001, {24, 0, 0x40, 0, 0, "\??\C:\"}, 3, 16417, ... 352, {status=0x0, info=1}, ) }, 3, 16417, ... 352, {status=0x0, info=1}, ) == 0x0
 02213   396   NtQueryDirectoryFile  (352, 0, 0, 0, 1237840, 616, BothDirectory, 1,  (352, 0, 0, 0, 1237840, 616, BothDirectory, 1, "Documents and Settings", 0, ... {status=0x0, info=138}, ) , 0, ... {status=0x0, info=138}, ) == 0x0
 02214   396   NtClose  (352, ... ) == 0x0
 02215   396   NtOpenFile  (0x100001, {24, 0, 0x40, 0, 0,  (0x100001, {24, 0, 0x40, 0, 0, "\??\C:\Documents and Settings\SRI-user\"}, 3, 16417, ... 352, {status=0x0, info=1}, ) }, 3, 16417, ... 352, {status=0x0, info=1}, ) == 0x0
 02216   396   NtQueryDirectoryFile  (352, 0, 0, 0, 1237840, 616, BothDirectory, 1,  (352, 0, 0, 0, 1237840, 616, BothDirectory, 1, "Local Settings", 0, ... {status=0x0, info=122}, ) , 0, ... {status=0x0, info=122}, ) == 0x0
 02217   396   NtClose  (352, ... ) == 0x0
 02218   396   NtQueryInformationProcess  (-1, DefaultHardErrorMode, 4, ... {process info, class 12, size 4}, 0x0, ) == 0x0
 02219   396   NtSetInformationProcess  (-1, DefaultHardErrorMode, {process info, class 12, size 4}, 4, ... ) == 0x0
 02220   396   NtQueryVirtualMemory  (-1, 0xac0000, Basic, 28, ... {BaseAddress=0xac0000,AllocationBase=0xac0000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 0x0, ) == 0x0
 02221   396   NtEnumerateValueKey  (356, 1, Full, 220, ... TitleIdx=0, Type=2, Name= (356, 1, Full, 220, ... TitleIdx=0, Type=2, Name="TMP", Data="%\0U\0S\0E\0R\0P\0R\0O\0F\0I\0L\0E\0%\0\\0L\0o\0c\0a\0l\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0T\0e\0m\0p\0\0\0"}, 96, ) , Data= (356, 1, Full, 220, ... TitleIdx=0, Type=2, Name="TMP", Data="%\0U\0S\0E\0R\0P\0R\0O\0F\0I\0L\0E\0%\0\\0L\0o\0c\0a\0l\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0T\0e\0m\0p\0\0\0"}, 96, ) }, 96, ) == 0x0
 02222   396   NtQueryInformationProcess  (-1, DefaultHardErrorMode, 4, ... {process info, class 12, size 4}, 0x0, ) == 0x0
 02223   396   NtSetInformationProcess  (-1, DefaultHardErrorMode, {process info, class 12, size 4}, 4, ... ) == 0x0
 02224   396   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\Documents and Settings\SRI-user\Local Settings\Temp"}, 1238480, ... ) }, 1238480, ... ) == 0x0
 02225   396   NtOpenFile  (0x100001, {24, 0, 0x40, 0, 0,  (0x100001, {24, 0, 0x40, 0, 0, "\??\C:\"}, 3, 16417, ... 352, {status=0x0, info=1}, ) }, 3, 16417, ... 352, {status=0x0, info=1}, ) == 0x0
 02226   396   NtQueryDirectoryFile  (352, 0, 0, 0, 1237840, 616, BothDirectory, 1,  (352, 0, 0, 0, 1237840, 616, BothDirectory, 1, "Documents and Settings", 0, ... {status=0x0, info=138}, ) , 0, ... {status=0x0, info=138}, ) == 0x0
 02227   396   NtClose  (352, ... ) == 0x0
 02228   396   NtOpenFile  (0x100001, {24, 0, 0x40, 0, 0,  (0x100001, {24, 0, 0x40, 0, 0, "\??\C:\Documents and Settings\SRI-user\"}, 3, 16417, ... 352, {status=0x0, info=1}, ) }, 3, 16417, ... 352, {status=0x0, info=1}, ) == 0x0
 02229   396   NtQueryDirectoryFile  (352, 0, 0, 0, 1237840, 616, BothDirectory, 1,  (352, 0, 0, 0, 1237840, 616, BothDirectory, 1, "Local Settings", 0, ... {status=0x0, info=122}, ) , 0, ... {status=0x0, info=122}, ) == 0x0
 02230   396   NtClose  (352, ... ) == 0x0
 02231   396   NtQueryInformationProcess  (-1, DefaultHardErrorMode, 4, ... {process info, class 12, size 4}, 0x0, ) == 0x0
 02232   396   NtSetInformationProcess  (-1, DefaultHardErrorMode, {process info, class 12, size 4}, 4, ... ) == 0x0
 02233   396   NtQueryVirtualMemory  (-1, 0xac0000, Basic, 28, ... {BaseAddress=0xac0000,AllocationBase=0xac0000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 0x0, ) == 0x0
 02234   396   NtEnumerateValueKey  (356, 2, Full, 220, ... ) == STATUS_NO_MORE_ENTRIES
 02235   396   NtClose  (356, ... ) == 0x0
 02236   396   NtOpenKey  (0x20019, {24, 348, 0x40, 0, 0,  (0x20019, {24, 348, 0x40, 0, 0, "Volatile Environment"}, ... 356, ) }, ... 356, ) == 0x0
 02237   396   NtEnumerateValueKey  (356, 0, Full, 220, ... TitleIdx=0, Type=1, Name= (356, 0, Full, 220, ... TitleIdx=0, Type=1, Name="LOGONSERVER", Data="\\0\\0M\0Y\0W\0O\0R\0L\0D\0\0\0"}, 64, ) , Data= (356, 0, Full, 220, ... TitleIdx=0, Type=1, Name="LOGONSERVER", Data="\\0\\0M\0Y\0W\0O\0R\0L\0D\0\0\0"}, 64, ) }, 64, ) == 0x0
 02238   396   NtQueryVirtualMemory  (-1, 0xac0000, Basic, 28, ... {BaseAddress=0xac0000,AllocationBase=0xac0000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 0x0, ) == 0x0
 02239   396   NtEnumerateValueKey  (356, 1, Full, 220, ... TitleIdx=0, Type=1, Name= (356, 1, Full, 220, ... TitleIdx=0, Type=1, Name="HOMEDRIVE", Data="C\0:\0\0\0"}, 46, ) , Data= (356, 1, Full, 220, ... TitleIdx=0, Type=1, Name="HOMEDRIVE", Data="C\0:\0\0\0"}, 46, ) }, 46, ) == 0x0
 02240   396   NtQueryVirtualMemory  (-1, 0xac0000, Basic, 28, ... {BaseAddress=0xac0000,AllocationBase=0xac0000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 0x0, ) == 0x0
 02241   396   NtEnumerateValueKey  (356, 2, Full, 220, ... TitleIdx=0, Type=1, Name= (356, 2, Full, 220, ... TitleIdx=0, Type=1, Name="HOMEPATH", Data="\\0D\0o\0c\0u\0m\0e\0n\0t\0s\0 \0a\0n\0d\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0S\0R\0I\0-\0u\0s\0e\0r\0\0\0"}, 102, ) , Data= (356, 2, Full, 220, ... TitleIdx=0, Type=1, Name="HOMEPATH", Data="\\0D\0o\0c\0u\0m\0e\0n\0t\0s\0 \0a\0n\0d\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0S\0R\0I\0-\0u\0s\0e\0r\0\0\0"}, 102, ) }, 102, ) == 0x0
 02242   396   NtQueryVirtualMemory  (-1, 0xac0000, Basic, 28, ... {BaseAddress=0xac0000,AllocationBase=0xac0000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 0x0, ) == 0x0
 02243   396   NtEnumerateValueKey  (356, 3, Full, 220, ... TitleIdx=0, Type=1, Name= (356, 3, Full, 220, ... TitleIdx=0, Type=1, Name="CLIENTNAME", Data="C\0o\0n\0s\0o\0l\0e\0\0\0"}, 56, ) , Data= (356, 3, Full, 220, ... TitleIdx=0, Type=1, Name="CLIENTNAME", Data="C\0o\0n\0s\0o\0l\0e\0\0\0"}, 56, ) }, 56, ) == 0x0
 02244   396   NtQueryVirtualMemory  (-1, 0xac0000, Basic, 28, ... {BaseAddress=0xac0000,AllocationBase=0xac0000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 0x0, ) == 0x0
 02245   396   NtEnumerateValueKey  (356, 4, Full, 220, ... TitleIdx=0, Type=1, Name= (356, 4, Full, 220, ... TitleIdx=0, Type=1, Name="SESSIONNAME", Data="C\0o\0n\0s\0o\0l\0e\0\0\0"}, 60, ) , Data= (356, 4, Full, 220, ... TitleIdx=0, Type=1, Name="SESSIONNAME", Data="C\0o\0n\0s\0o\0l\0e\0\0\0"}, 60, ) }, 60, ) == 0x0
 02246   396   NtQueryVirtualMemory  (-1, 0xac0000, Basic, 28, ... {BaseAddress=0xac0000,AllocationBase=0xac0000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 0x0, ) == 0x0
 02247   396   NtEnumerateValueKey  (356, 5, Full, 220, ... TitleIdx=0, Type=1, Name= (356, 5, Full, 220, ... TitleIdx=0, Type=1, Name="APPDATA", Data="C\0:\0\\0D\0o\0c\0u\0m\0e\0n\0t\0s\0 \0a\0n\0d\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0S\0R\0I\0-\0u\0s\0e\0r\0\\0A\0p\0p\0l\0i\0c\0a\0t\0i\0o\0n\0 \0D\0a\0t\0a\0\0\0"}, 140, ) , Data= (356, 5, Full, 220, ... TitleIdx=0, Type=1, Name="APPDATA", Data="C\0:\0\\0D\0o\0c\0u\0m\0e\0n\0t\0s\0 \0a\0n\0d\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0S\0R\0I\0-\0u\0s\0e\0r\0\\0A\0p\0p\0l\0i\0c\0a\0t\0i\0o\0n\0 \0D\0a\0t\0a\0\0\0"}, 140, ) }, 140, ) == 0x0
 02248   396   NtQueryVirtualMemory  (-1, 0xac0000, Basic, 28, ... {BaseAddress=0xac0000,AllocationBase=0xac0000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 0x0, ) == 0x0
 02249   396   NtEnumerateValueKey  (356, 6, Full, 220, ... TitleIdx=0, Type=1, Name= (356, 6, Full, 220, ... TitleIdx=0, Type=1, Name="HOMESHARE", Data="\0\0"}, 42, ) , Data= (356, 6, Full, 220, ... TitleIdx=0, Type=1, Name="HOMESHARE", Data="\0\0"}, 42, ) }, 42, ) == 0x0
 02250   396   NtEnumerateValueKey  (356, 7, Full, 220, ... ) == STATUS_NO_MORE_ENTRIES
 02251   396   NtEnumerateValueKey  (356, 0, Full, 220, ... TitleIdx=0, Type=1, Name= (356, 0, Full, 220, ... TitleIdx=0, Type=1, Name="LOGONSERVER", Data="\\0\\0M\0Y\0W\0O\0R\0L\0D\0\0\0"}, 64, ) , Data= (356, 0, Full, 220, ... TitleIdx=0, Type=1, Name="LOGONSERVER", Data="\\0\\0M\0Y\0W\0O\0R\0L\0D\0\0\0"}, 64, ) }, 64, ) == 0x0
 02252   396   NtEnumerateValueKey  (356, 1, Full, 220, ... TitleIdx=0, Type=1, Name= (356, 1, Full, 220, ... TitleIdx=0, Type=1, Name="HOMEDRIVE", Data="C\0:\0\0\0"}, 46, ) , Data= (356, 1, Full, 220, ... TitleIdx=0, Type=1, Name="HOMEDRIVE", Data="C\0:\0\0\0"}, 46, ) }, 46, ) == 0x0
 02253   396   NtEnumerateValueKey  (356, 2, Full, 220, ... TitleIdx=0, Type=1, Name= (356, 2, Full, 220, ... TitleIdx=0, Type=1, Name="HOMEPATH", Data="\\0D\0o\0c\0u\0m\0e\0n\0t\0s\0 \0a\0n\0d\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0S\0R\0I\0-\0u\0s\0e\0r\0\0\0"}, 102, ) , Data= (356, 2, Full, 220, ... TitleIdx=0, Type=1, Name="HOMEPATH", Data="\\0D\0o\0c\0u\0m\0e\0n\0t\0s\0 \0a\0n\0d\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0S\0R\0I\0-\0u\0s\0e\0r\0\0\0"}, 102, ) }, 102, ) == 0x0
 02254   396   NtEnumerateValueKey  (356, 3, Full, 220, ... TitleIdx=0, Type=1, Name= (356, 3, Full, 220, ... TitleIdx=0, Type=1, Name="CLIENTNAME", Data="C\0o\0n\0s\0o\0l\0e\0\0\0"}, 56, ) , Data= (356, 3, Full, 220, ... TitleIdx=0, Type=1, Name="CLIENTNAME", Data="C\0o\0n\0s\0o\0l\0e\0\0\0"}, 56, ) }, 56, ) == 0x0
 02255   396   NtEnumerateValueKey  (356, 4, Full, 220, ... TitleIdx=0, Type=1, Name= (356, 4, Full, 220, ... TitleIdx=0, Type=1, Name="SESSIONNAME", Data="C\0o\0n\0s\0o\0l\0e\0\0\0"}, 60, ) , Data= (356, 4, Full, 220, ... TitleIdx=0, Type=1, Name="SESSIONNAME", Data="C\0o\0n\0s\0o\0l\0e\0\0\0"}, 60, ) }, 60, ) == 0x0
 02256   396   NtEnumerateValueKey  (356, 5, Full, 220, ... TitleIdx=0, Type=1, Name= (356, 5, Full, 220, ... TitleIdx=0, Type=1, Name="APPDATA", Data="C\0:\0\\0D\0o\0c\0u\0m\0e\0n\0t\0s\0 \0a\0n\0d\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0S\0R\0I\0-\0u\0s\0e\0r\0\\0A\0p\0p\0l\0i\0c\0a\0t\0i\0o\0n\0 \0D\0a\0t\0a\0\0\0"}, 140, ) , Data= (356, 5, Full, 220, ... TitleIdx=0, Type=1, Name="APPDATA", Data="C\0:\0\\0D\0o\0c\0u\0m\0e\0n\0t\0s\0 \0a\0n\0d\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0S\0R\0I\0-\0u\0s\0e\0r\0\\0A\0p\0p\0l\0i\0c\0a\0t\0i\0o\0n\0 \0D\0a\0t\0a\0\0\0"}, 140, ) }, 140, ) == 0x0
 02257   396   NtEnumerateValueKey  (356, 6, Full, 220, ... TitleIdx=0, Type=1, Name= (356, 6, Full, 220, ... TitleIdx=0, Type=1, Name="HOMESHARE", Data="\0\0"}, 42, ) , Data= (356, 6, Full, 220, ... TitleIdx=0, Type=1, Name="HOMESHARE", Data="\0\0"}, 42, ) }, 42, ) == 0x0
 02258   396   NtEnumerateValueKey  (356, 7, Full, 220, ... ) == STATUS_NO_MORE_ENTRIES
 02259   396   NtClose  (356, ... ) == 0x0
 02260   396   NtClose  (348, ... ) == 0x0
 02261   396   NtFreeVirtualMemory  (-1, (0xac0000), 0, 32768, ... (0xac0000), 4096, ) == 0x0
 02262   396   NtClose  (340, ... ) == 0x0
 02263   396   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\Documents and Settings\All Users\Application Data"}, 1240404, ... ) }, 1240404, ... ) == 0x0
 02264   396   NtCreateKey  (0x2000000, {24, 48, 0x40, 0, 0,  (0x2000000, {24, 48, 0x40, 0, 0, "Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders"}, 0, 0x0, 0, ... 340, 2, ) }, 0, 0x0, 0, ... 340, 2, ) == 0x0
 02265   396   NtSetValueKey  (340,  (340, "Common AppData", 0, 1, "C\0:\0\\0D\0o\0c\0u\0m\0e\0n\0t\0s\0 \0a\0n\0d\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0A\0l\0l\0 \0U\0s\0e\0r\0s\0\\0A\0p\0p\0l\0i\0c\0a\0t\0i\0o\0n\0 \0D\0a\0t\0a\0\0\0", 106, ... ) , 0, 1,  (340, "Common AppData", 0, 1, "C\0:\0\\0D\0o\0c\0u\0m\0e\0n\0t\0s\0 \0a\0n\0d\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0A\0l\0l\0 \0U\0s\0e\0r\0s\0\\0A\0p\0p\0l\0i\0c\0a\0t\0i\0o\0n\0 \0D\0a\0t\0a\0\0\0", 106, ... ) , 106, ... ) == 0x0
 02266   396   NtClose  (340, ... ) == 0x0
 02267   396   NtClose  (336, ... ) == 0x0
 02268   396   NtOpenFile  (0x100001, {24, 0, 0x40, 0, 0,  (0x100001, {24, 0, 0x40, 0, 0, "\??\C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Connections\Pbk\"}, 3, 16417, ... 336, {status=0x0, info=1}, ) }, 3, 16417, ... 336, {status=0x0, info=1}, ) == 0x0
 02269   396   NtQueryDirectoryFile  (336, 0, 0, 0, 1239380, 616, BothDirectory, 1,  (336, 0, 0, 0, 1239380, 616, BothDirectory, 1, "<.pbk", 0, ... ) , 0, ... ) == STATUS_NO_SUCH_FILE
 02270   396   NtClose  (336, ... ) == 0x0
 02271   396   NtOpenFile  (0x100001, {24, 0, 0x40, 0, 0,  (0x100001, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\System32\Ras\"}, 3, 16417, ... 336, {status=0x0, info=1}, ) }, 3, 16417, ... 336, {status=0x0, info=1}, ) == 0x0
 02272   396   NtQueryDirectoryFile  (336, 0, 0, 0, 1239380, 616, BothDirectory, 1,  (336, 0, 0, 0, 1239380, 616, BothDirectory, 1, "<.pbk", 0, ... ) , 0, ... ) == STATUS_NO_SUCH_FILE
 02273   396   NtClose  (336, ... ) == 0x0
 02274   396   NtOpenThreadToken  (-2, 0xc, 1, ... ) == STATUS_NO_TOKEN
 02275   396   NtOpenProcessToken  (-1, 0xc, ... 336, ) == 0x0
 02276   396   NtQueryInformationToken  (336, User, 64, ... {token info, class 1, size 36}, 36, ) == 0x0
 02277   396   NtOpenKey  (0x2001f, {24, 328, 0x40, 0, 0,  (0x2001f, {24, 328, 0x40, 0, 0, "S-1-5-21-1078081533-484763869-839522115-1003"}, ... 340, ) }, ... 340, ) == 0x0
 02278   396   NtCreateKey  (0x2000000, {24, 340, 0x40, 0, 0,  (0x2000000, {24, 340, 0x40, 0, 0, "Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders"}, 0, 0x0, 0, ... 348, 2, ) }, 0, 0x0, 0, ... 348, 2, ) == 0x0
 02279   396   NtClose  (340, ... ) == 0x0
 02280   396   NtQueryValueKey  (348,  (348, "AppData", Partial, 144, ... TitleIdx=0, Type=2, Data="%\0U\0S\0E\0R\0P\0R\0O\0F\0I\0L\0E\0%\0\\0A\0p\0p\0l\0i\0c\0a\0t\0i\0o\0n\0 \0D\0a\0t\0a\0\0\0"}, 74, ) , Partial, 144, ... TitleIdx=0, Type=2, Data= (348, "AppData", Partial, 144, ... TitleIdx=0, Type=2, Data="%\0U\0S\0E\0R\0P\0R\0O\0F\0I\0L\0E\0%\0\\0A\0p\0p\0l\0i\0c\0a\0t\0i\0o\0n\0 \0D\0a\0t\0a\0\0\0"}, 74, ) }, 74, ) == 0x0
 02281   396   NtAllocateVirtualMemory  (-1, 0, 0, 1, 4096, 4, ... 11272192, 4096, ) == 0x0
 02282   396   NtQueryVirtualMemory  (-1, 0xac0000, Basic, 28, ... {BaseAddress=0xac0000,AllocationBase=0xac0000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 0x0, ) == 0x0
 02283   396   NtQueryVirtualMemory  (-1, 0xac0000, Basic, 28, ... {BaseAddress=0xac0000,AllocationBase=0xac0000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 0x0, ) == 0x0
 02284   396   NtOpenKey  (0x20019, {24, 48, 0x40, 0, 0,  (0x20019, {24, 48, 0x40, 0, 0, "Software\Microsoft\Windows NT\CurrentVersion\ProfileList"}, ... 340, ) }, ... 340, ) == 0x0
 02285   396   NtQueryValueKey  (340,  (340, "ProfilesDirectory", Partial, 144, ... TitleIdx=0, Type=2, Data="%\0S\0y\0s\0t\0e\0m\0D\0r\0i\0v\0e\0%\0\\0D\0o\0c\0u\0m\0e\0n\0t\0s\0 \0a\0n\0d\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\0\0"}, 86, ) , Partial, 144, ... TitleIdx=0, Type=2, Data= (340, "ProfilesDirectory", Partial, 144, ... TitleIdx=0, Type=2, Data="%\0S\0y\0s\0t\0e\0m\0D\0r\0i\0v\0e\0%\0\\0D\0o\0c\0u\0m\0e\0n\0t\0s\0 \0a\0n\0d\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\0\0"}, 86, ) }, 86, ) == 0x0
 02286   396   NtClose  (340, ... ) == 0x0
 02287   396   NtOpenKey  (0x20019, {24, 48, 0x40, 0, 0,  (0x20019, {24, 48, 0x40, 0, 0, "Software\Microsoft\Windows NT\CurrentVersion\ProfileList"}, ... 340, ) }, ... 340, ) == 0x0
 02288   396   NtQueryValueKey  (340,  (340, "AllUsersProfile", Partial, 144, ... TitleIdx=0, Type=1, Data="A\0l\0l\0 \0U\0s\0e\0r\0s\0\0\0"}, 32, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (340, "AllUsersProfile", Partial, 144, ... TitleIdx=0, Type=1, Data="A\0l\0l\0 \0U\0s\0e\0r\0s\0\0\0"}, 32, ) }, 32, ) == 0x0
 02289   396   NtClose  (340, ... ) == 0x0
 02290   396   NtQueryVirtualMemory  (-1, 0xac0000, Basic, 28, ... {BaseAddress=0xac0000,AllocationBase=0xac0000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 0x0, ) == 0x0
 02291   396   NtOpenKey  (0x1, {24, 48, 0x40, 0, 0,  (0x1, {24, 48, 0x40, 0, 0, "System\CurrentControlSet\Control\Session Manager\Environment"}, ... 340, ) }, ... 340, ) == 0x0
 02292   396   NtQueryKey  (340, Full, 176, ... {LastWrite={0x7838d13c,0x1c73999}, TitleIdx=0, Subkeys=0, Values=12, Class=""}, 44, ) == 0x0
 02293   396   NtQuerySecurityObject  (340, 7, 0, ... ) == STATUS_ACCESS_DENIED
 02294   396   NtEnumerateValueKey  (340, 0, Full, 220, ... TitleIdx=0, Type=2, Name= (340, 0, Full, 220, ... TitleIdx=0, Type=2, Name="ComSpec", Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0s\0y\0s\0t\0e\0m\03\02\0\\0c\0m\0d\0.\0e\0x\0e\0\0\0"}, 96, ) , Data= (340, 0, Full, 220, ... TitleIdx=0, Type=2, Name="ComSpec", Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0s\0y\0s\0t\0e\0m\03\02\0\\0c\0m\0d\0.\0e\0x\0e\0\0\0"}, 96, ) }, 96, ) == 0x0
 02295   396   NtEnumerateValueKey  (340, 1, Full, 220, ... TitleIdx=0, Type=2, Name= (340, 1, Full, 220, ... TitleIdx=0, Type=2, Name="Path", Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0s\0y\0s\0t\0e\0m\03\02\0;\0%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0;\0%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0W\0b\0e\0m\0\0\0"}, 152, ) , Data= (340, 1, Full, 220, ... TitleIdx=0, Type=2, Name="Path", Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0s\0y\0s\0t\0e\0m\03\02\0;\0%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0;\0%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0W\0b\0e\0m\0\0\0"}, 152, ) }, 152, ) == 0x0
 02296   396   NtEnumerateValueKey  (340, 2, Full, 220, ... TitleIdx=0, Type=2, Name= (340, 2, Full, 220, ... TitleIdx=0, Type=2, Name="windir", Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\0\0"}, 58, ) , Data= (340, 2, Full, 220, ... TitleIdx=0, Type=2, Name="windir", Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\0\0"}, 58, ) }, 58, ) == 0x0
 02297   396   NtEnumerateValueKey  (340, 3, Full, 220, ... TitleIdx=0, Type=1, Name= (340, 3, Full, 220, ... TitleIdx=0, Type=1, Name="OS", Data="W\0i\0n\0d\0o\0w\0s\0_\0N\0T\0\0\0"}, 46, ) , Data= (340, 3, Full, 220, ... TitleIdx=0, Type=1, Name="OS", Data="W\0i\0n\0d\0o\0w\0s\0_\0N\0T\0\0\0"}, 46, ) }, 46, ) == 0x0
 02298   396   NtQueryVirtualMemory  (-1, 0xac0000, Basic, 28, ... {BaseAddress=0xac0000,AllocationBase=0xac0000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 0x0, ) == 0x0
 02299   396   NtEnumerateValueKey  (340, 4, Full, 220, ... TitleIdx=0, Type=1, Name= (340, 4, Full, 220, ... TitleIdx=0, Type=1, Name="PROCESSOR_ARCHITECTURE", Data="x\08\06\0\0\0"}, 72, ) , Data= (340, 4, Full, 220, ... TitleIdx=0, Type=1, Name="PROCESSOR_ARCHITECTURE", Data="x\08\06\0\0\0"}, 72, ) }, 72, ) == 0x0
 02300   396   NtQueryVirtualMemory  (-1, 0xac0000, Basic, 28, ... {BaseAddress=0xac0000,AllocationBase=0xac0000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 0x0, ) == 0x0
 02301   396   NtEnumerateValueKey  (340, 5, Full, 220, ... TitleIdx=0, Type=1, Name= (340, 5, Full, 220, ... TitleIdx=0, Type=1, Name="PROCESSOR_LEVEL", Data="1\05\0\0\0"}, 58, ) , Data= (340, 5, Full, 220, ... TitleIdx=0, Type=1, Name="PROCESSOR_LEVEL", Data="1\05\0\0\0"}, 58, ) }, 58, ) == 0x0
 02302   396   NtQueryVirtualMemory  (-1, 0xac0000, Basic, 28, ... {BaseAddress=0xac0000,AllocationBase=0xac0000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 0x0, ) == 0x0
 02303   396   NtEnumerateValueKey  (340, 6, Full, 220, ... TitleIdx=0, Type=1, Name= (340, 6, Full, 220, ... TitleIdx=0, Type=1, Name="PROCESSOR_IDENTIFIER", Data="x\08\06\0 \0F\0a\0m\0i\0l\0y\0 \01\05\0 \0M\0o\0d\0e\0l\0 \04\0 \0S\0t\0e\0p\0p\0i\0n\0g\0 \08\0,\0 \0G\0e\0n\0u\0i\0n\0e\0I\0n\0t\0e\0l\0\0\0"}, 154, ) , Data= (340, 6, Full, 220, ... TitleIdx=0, Type=1, Name="PROCESSOR_IDENTIFIER", Data="x\08\06\0 \0F\0a\0m\0i\0l\0y\0 \01\05\0 \0M\0o\0d\0e\0l\0 \04\0 \0S\0t\0e\0p\0p\0i\0n\0g\0 \08\0,\0 \0G\0e\0n\0u\0i\0n\0e\0I\0n\0t\0e\0l\0\0\0"}, 154, ) }, 154, ) == 0x0
 02304   396   NtQueryVirtualMemory  (-1, 0xac0000, Basic, 28, ... {BaseAddress=0xac0000,AllocationBase=0xac0000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 0x0, ) == 0x0
 02305   396   NtEnumerateValueKey  (340, 7, Full, 220, ... TitleIdx=0, Type=1, Name= (340, 7, Full, 220, ... TitleIdx=0, Type=1, Name="PROCESSOR_REVISION", Data="0\04\00\08\0\0\0"}, 66, ) , Data= (340, 7, Full, 220, ... TitleIdx=0, Type=1, Name="PROCESSOR_REVISION", Data="0\04\00\08\0\0\0"}, 66, ) }, 66, ) == 0x0
 02306   396   NtQueryVirtualMemory  (-1, 0xac0000, Basic, 28, ... {BaseAddress=0xac0000,AllocationBase=0xac0000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 0x0, ) == 0x0
 02307   396   NtEnumerateValueKey  (340, 8, Full, 220, ... TitleIdx=0, Type=1, Name= (340, 8, Full, 220, ... TitleIdx=0, Type=1, Name="NUMBER_OF_PROCESSORS", Data="1\0\0\0"}, 64, ) , Data= (340, 8, Full, 220, ... TitleIdx=0, Type=1, Name="NUMBER_OF_PROCESSORS", Data="1\0\0\0"}, 64, ) }, 64, ) == 0x0
 02308   396   NtQueryVirtualMemory  (-1, 0xac0000, Basic, 28, ... {BaseAddress=0xac0000,AllocationBase=0xac0000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 0x0, ) == 0x0
 02309   396   NtEnumerateValueKey  (340, 9, Full, 220, ... TitleIdx=0, Type=1, Name= (340, 9, Full, 220, ... TitleIdx=0, Type=1, Name="PATHEXT", Data=".\0C\0O\0M\0;\0.\0E\0X\0E\0;\0.\0B\0A\0T\0;\0.\0C\0M\0D\0;\0.\0V\0B\0S\0;\0.\0V\0B\0E\0;\0.\0J\0S\0;\0.\0J\0S\0E\0;\0.\0W\0S\0F\0;\0.\0W\0S\0H\0\0\0"}, 134, ) , Data= (340, 9, Full, 220, ... TitleIdx=0, Type=1, Name="PATHEXT", Data=".\0C\0O\0M\0;\0.\0E\0X\0E\0;\0.\0B\0A\0T\0;\0.\0C\0M\0D\0;\0.\0V\0B\0S\0;\0.\0V\0B\0E\0;\0.\0J\0S\0;\0.\0J\0S\0E\0;\0.\0W\0S\0F\0;\0.\0W\0S\0H\0\0\0"}, 134, ) }, 134, ) == 0x0
 02310   396   NtQueryVirtualMemory  (-1, 0xac0000, Basic, 28, ... {BaseAddress=0xac0000,AllocationBase=0xac0000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 0x0, ) == 0x0
 02311   396   NtEnumerateValueKey  (340, 10, Full, 220, ... TitleIdx=0, Type=2, Name= (340, 10, Full, 220, ... TitleIdx=0, Type=2, Name="TEMP", Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0T\0E\0M\0P\0\0\0"}, 64, ) , Data= (340, 10, Full, 220, ... TitleIdx=0, Type=2, Name="TEMP", Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0T\0E\0M\0P\0\0\0"}, 64, ) }, 64, ) == 0x0
 02312   396   NtEnumerateValueKey  (340, 11, Full, 220, ... TitleIdx=0, Type=2, Name= (340, 11, Full, 220, ... TitleIdx=0, Type=2, Name="TMP", Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0T\0E\0M\0P\0\0\0"}, 64, ) , Data= (340, 11, Full, 220, ... TitleIdx=0, Type=2, Name="TMP", Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0T\0E\0M\0P\0\0\0"}, 64, ) }, 64, ) == 0x0
 02313   396   NtEnumerateValueKey  (340, 0, Full, 220, ... TitleIdx=0, Type=2, Name= (340, 0, Full, 220, ... TitleIdx=0, Type=2, Name="ComSpec", Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0s\0y\0s\0t\0e\0m\03\02\0\\0c\0m\0d\0.\0e\0x\0e\0\0\0"}, 96, ) , Data= (340, 0, Full, 220, ... TitleIdx=0, Type=2, Name="ComSpec", Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0s\0y\0s\0t\0e\0m\03\02\0\\0c\0m\0d\0.\0e\0x\0e\0\0\0"}, 96, ) }, 96, ) == 0x0
 02314   396   NtQueryVirtualMemory  (-1, 0xac0000, Basic, 28, ... {BaseAddress=0xac0000,AllocationBase=0xac0000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 0x0, ) == 0x0
 02315   396   NtEnumerateValueKey  (340, 1, Full, 220, ... TitleIdx=0, Type=2, Name= (340, 1, Full, 220, ... TitleIdx=0, Type=2, Name="Path", Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0s\0y\0s\0t\0e\0m\03\02\0;\0%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0;\0%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0W\0b\0e\0m\0\0\0"}, 152, ) , Data= (340, 1, Full, 220, ... TitleIdx=0, Type=2, Name="Path", Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0s\0y\0s\0t\0e\0m\03\02\0;\0%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0;\0%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0W\0b\0e\0m\0\0\0"}, 152, ) }, 152, ) == 0x0
 02316   396   NtQueryVirtualMemory  (-1, 0xac0000, Basic, 28, ... {BaseAddress=0xac0000,AllocationBase=0xac0000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 0x0, ) == 0x0
 02317   396   NtEnumerateValueKey  (340, 2, Full, 220, ... TitleIdx=0, Type=2, Name= (340, 2, Full, 220, ... TitleIdx=0, Type=2, Name="windir", Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\0\0"}, 58, ) , Data= (340, 2, Full, 220, ... TitleIdx=0, Type=2, Name="windir", Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\0\0"}, 58, ) }, 58, ) == 0x0
 02318   396   NtQueryVirtualMemory  (-1, 0xac0000, Basic, 28, ... {BaseAddress=0xac0000,AllocationBase=0xac0000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 0x0, ) == 0x0
 02319   396   NtEnumerateValueKey  (340, 3, Full, 220, ... TitleIdx=0, Type=1, Name= (340, 3, Full, 220, ... TitleIdx=0, Type=1, Name="OS", Data="W\0i\0n\0d\0o\0w\0s\0_\0N\0T\0\0\0"}, 46, ) , Data= (340, 3, Full, 220, ... TitleIdx=0, Type=1, Name="OS", Data="W\0i\0n\0d\0o\0w\0s\0_\0N\0T\0\0\0"}, 46, ) }, 46, ) == 0x0
 02320   396   NtEnumerateValueKey  (340, 4, Full, 220, ... TitleIdx=0, Type=1, Name= (340, 4, Full, 220, ... TitleIdx=0, Type=1, Name="PROCESSOR_ARCHITECTURE", Data="x\08\06\0\0\0"}, 72, ) , Data= (340, 4, Full, 220, ... TitleIdx=0, Type=1, Name="PROCESSOR_ARCHITECTURE", Data="x\08\06\0\0\0"}, 72, ) }, 72, ) == 0x0
 02321   396   NtEnumerateValueKey  (340, 5, Full, 220, ... TitleIdx=0, Type=1, Name= (340, 5, Full, 220, ... TitleIdx=0, Type=1, Name="PROCESSOR_LEVEL", Data="1\05\0\0\0"}, 58, ) , Data= (340, 5, Full, 220, ... TitleIdx=0, Type=1, Name="PROCESSOR_LEVEL", Data="1\05\0\0\0"}, 58, ) }, 58, ) == 0x0
 02322   396   NtEnumerateValueKey  (340, 6, Full, 220, ... TitleIdx=0, Type=1, Name= (340, 6, Full, 220, ... TitleIdx=0, Type=1, Name="PROCESSOR_IDENTIFIER", Data="x\08\06\0 \0F\0a\0m\0i\0l\0y\0 \01\05\0 \0M\0o\0d\0e\0l\0 \04\0 \0S\0t\0e\0p\0p\0i\0n\0g\0 \08\0,\0 \0G\0e\0n\0u\0i\0n\0e\0I\0n\0t\0e\0l\0\0\0"}, 154, ) , Data= (340, 6, Full, 220, ... TitleIdx=0, Type=1, Name="PROCESSOR_IDENTIFIER", Data="x\08\06\0 \0F\0a\0m\0i\0l\0y\0 \01\05\0 \0M\0o\0d\0e\0l\0 \04\0 \0S\0t\0e\0p\0p\0i\0n\0g\0 \08\0,\0 \0G\0e\0n\0u\0i\0n\0e\0I\0n\0t\0e\0l\0\0\0"}, 154, ) }, 154, ) == 0x0
 02323   396   NtEnumerateValueKey  (340, 7, Full, 220, ... TitleIdx=0, Type=1, Name= (340, 7, Full, 220, ... TitleIdx=0, Type=1, Name="PROCESSOR_REVISION", Data="0\04\00\08\0\0\0"}, 66, ) , Data= (340, 7, Full, 220, ... TitleIdx=0, Type=1, Name="PROCESSOR_REVISION", Data="0\04\00\08\0\0\0"}, 66, ) }, 66, ) == 0x0
 02324   396   NtEnumerateValueKey  (340, 8, Full, 220, ... TitleIdx=0, Type=1, Name= (340, 8, Full, 220, ... TitleIdx=0, Type=1, Name="NUMBER_OF_PROCESSORS", Data="1\0\0\0"}, 64, ) , Data= (340, 8, Full, 220, ... TitleIdx=0, Type=1, Name="NUMBER_OF_PROCESSORS", Data="1\0\0\0"}, 64, ) }, 64, ) == 0x0
 02325   396   NtEnumerateValueKey  (340, 9, Full, 220, ... TitleIdx=0, Type=1, Name= (340, 9, Full, 220, ... TitleIdx=0, Type=1, Name="PATHEXT", Data=".\0C\0O\0M\0;\0.\0E\0X\0E\0;\0.\0B\0A\0T\0;\0.\0C\0M\0D\0;\0.\0V\0B\0S\0;\0.\0V\0B\0E\0;\0.\0J\0S\0;\0.\0J\0S\0E\0;\0.\0W\0S\0F\0;\0.\0W\0S\0H\0\0\0"}, 134, ) , Data= (340, 9, Full, 220, ... TitleIdx=0, Type=1, Name="PATHEXT", Data=".\0C\0O\0M\0;\0.\0E\0X\0E\0;\0.\0B\0A\0T\0;\0.\0C\0M\0D\0;\0.\0V\0B\0S\0;\0.\0V\0B\0E\0;\0.\0J\0S\0;\0.\0J\0S\0E\0;\0.\0W\0S\0F\0;\0.\0W\0S\0H\0\0\0"}, 134, ) }, 134, ) == 0x0
 02326   396   NtEnumerateValueKey  (340, 10, Full, 220, ... TitleIdx=0, Type=2, Name= (340, 10, Full, 220, ... TitleIdx=0, Type=2, Name="TEMP", Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0T\0E\0M\0P\0\0\0"}, 64, ) , Data= (340, 10, Full, 220, ... TitleIdx=0, Type=2, Name="TEMP", Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0T\0E\0M\0P\0\0\0"}, 64, ) }, 64, ) == 0x0
 02327   396   NtQueryInformationProcess  (-1, DefaultHardErrorMode, 4, ... {process info, class 12, size 4}, 0x0, ) == 0x0
 02328   396   NtSetInformationProcess  (-1, DefaultHardErrorMode, {process info, class 12, size 4}, 4, ... ) == 0x0
 02329   396   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\TEMP"}, 1238452, ... ) }, 1238452, ... ) == 0x0
 02330   396   NtQueryInformationProcess  (-1, DefaultHardErrorMode, 4, ... {process info, class 12, size 4}, 0x0, ) == 0x0
 02331   396   NtSetInformationProcess  (-1, DefaultHardErrorMode, {process info, class 12, size 4}, 4, ... ) == 0x0
 02332   396   NtQueryVirtualMemory  (-1, 0xac0000, Basic, 28, ... {BaseAddress=0xac0000,AllocationBase=0xac0000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 0x0, ) == 0x0
 02333   396   NtEnumerateValueKey  (340, 11, Full, 220, ... TitleIdx=0, Type=2, Name= (340, 11, Full, 220, ... TitleIdx=0, Type=2, Name="TMP", Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0T\0E\0M\0P\0\0\0"}, 64, ) , Data= (340, 11, Full, 220, ... TitleIdx=0, Type=2, Name="TMP", Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0T\0E\0M\0P\0\0\0"}, 64, ) }, 64, ) == 0x0
 02334   396   NtQueryInformationProcess  (-1, DefaultHardErrorMode, 4, ... {process info, class 12, size 4}, 0x0, ) == 0x0
 02335   396   NtSetInformationProcess  (-1, DefaultHardErrorMode, {process info, class 12, size 4}, 4, ... ) == 0x0
 02336   396   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\TEMP"}, 1238452, ... ) }, 1238452, ... ) == 0x0
 02337   396   NtQueryInformationProcess  (-1, DefaultHardErrorMode, 4, ... {process info, class 12, size 4}, 0x0, ) == 0x0
 02338   396   NtSetInformationProcess  (-1, DefaultHardErrorMode, {process info, class 12, size 4}, 4, ... ) == 0x0
 02339   396   NtQueryVirtualMemory  (-1, 0xac0000, Basic, 28, ... {BaseAddress=0xac0000,AllocationBase=0xac0000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 0x0, ) == 0x0
 02340   396   NtClose  (340, ... ) == 0x0
 02341   396   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\System\CurrentControlSet\Control\ComputerName"}, ... 340, ) }, ... 340, ) == 0x0
 02342   396   NtOpenKey  (0x20019, {24, 340, 0x40, 0, 0,  (0x20019, {24, 340, 0x40, 0, 0, "ActiveComputerName"}, ... 356, ) }, ... 356, ) == 0x0
 02343   396   NtQueryValueKey  (356,  (356, "ComputerName", Full, 108, ... TitleIdx=0, Type=1, Name="ComputerName", Data="M\0Y\0W\0O\0R\0L\0D\0\0\0"}, 60, ) , Full, 108, ... TitleIdx=0, Type=1, Name= (356, "ComputerName", Full, 108, ... TitleIdx=0, Type=1, Name="ComputerName", Data="M\0Y\0W\0O\0R\0L\0D\0\0\0"}, 60, ) , Data= (356, "ComputerName", Full, 108, ... TitleIdx=0, Type=1, Name="ComputerName", Data="M\0Y\0W\0O\0R\0L\0D\0\0\0"}, 60, ) }, 60, ) == 0x0
 02344   396   NtClose  (356, ... ) == 0x0
 02345   396   NtClose  (340, ... ) == 0x0
 02346   396   NtQueryVirtualMemory  (-1, 0xac0000, Basic, 28, ... {BaseAddress=0xac0000,AllocationBase=0xac0000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 0x0, ) == 0x0
 02347   396   NtOpenKey  (0x20019, {24, 48, 0x40, 0, 0,  (0x20019, {24, 48, 0x40, 0, 0, "Software\Microsoft\Windows NT\CurrentVersion\ProfileList"}, ... 340, ) }, ... 340, ) == 0x0
 02348   396   NtQueryValueKey  (340,  (340, "ProfilesDirectory", Partial, 144, ... TitleIdx=0, Type=2, Data="%\0S\0y\0s\0t\0e\0m\0D\0r\0i\0v\0e\0%\0\\0D\0o\0c\0u\0m\0e\0n\0t\0s\0 \0a\0n\0d\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\0\0"}, 86, ) , Partial, 144, ... TitleIdx=0, Type=2, Data= (340, "ProfilesDirectory", Partial, 144, ... TitleIdx=0, Type=2, Data="%\0S\0y\0s\0t\0e\0m\0D\0r\0i\0v\0e\0%\0\\0D\0o\0c\0u\0m\0e\0n\0t\0s\0 \0a\0n\0d\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\0\0"}, 86, ) }, 86, ) == 0x0
 02349   396   NtClose  (340, ... ) == 0x0
 02350   396   NtOpenKey  (0x20019, {24, 48, 0x40, 0, 0,  (0x20019, {24, 48, 0x40, 0, 0, "Software\Microsoft\Windows NT\CurrentVersion\ProfileList"}, ... 340, ) }, ... 340, ) == 0x0
 02351   396   NtQueryValueKey  (340,  (340, "DefaultUserProfile", Partial, 144, ... TitleIdx=0, Type=1, Data="D\0e\0f\0a\0u\0l\0t\0 \0U\0s\0e\0r\0\0\0"}, 38, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (340, "DefaultUserProfile", Partial, 144, ... TitleIdx=0, Type=1, Data="D\0e\0f\0a\0u\0l\0t\0 \0U\0s\0e\0r\0\0\0"}, 38, ) }, 38, ) == 0x0
 02352   396   NtClose  (340, ... ) == 0x0
 02353   396   NtQueryVirtualMemory  (-1, 0xac0000, Basic, 28, ... {BaseAddress=0xac0000,AllocationBase=0xac0000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 0x0, ) == 0x0
 02354   396   NtOpenKey  (0x20019, {24, 48, 0x40, 0, 0,  (0x20019, {24, 48, 0x40, 0, 0, "Software\Microsoft\Windows\CurrentVersion"}, ... 340, ) }, ... 340, ) == 0x0
 02355   396   NtQueryValueKey  (340,  (340, "ProgramFilesDir", Partial, 144, ... TitleIdx=0, Type=1, Data="C\0:\0\\0P\0r\0o\0g\0r\0a\0m\0 \0F\0i\0l\0e\0s\0\0\0"}, 46, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (340, "ProgramFilesDir", Partial, 144, ... TitleIdx=0, Type=1, Data="C\0:\0\\0P\0r\0o\0g\0r\0a\0m\0 \0F\0i\0l\0e\0s\0\0\0"}, 46, ) }, 46, ) == 0x0
 02356   396   NtQueryVirtualMemory  (-1, 0xac0000, Basic, 28, ... {BaseAddress=0xac0000,AllocationBase=0xac0000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 0x0, ) == 0x0
 02357   396   NtQueryValueKey  (340,  (340, "CommonFilesDir", Partial, 144, ... TitleIdx=0, Type=1, Data="C\0:\0\\0P\0r\0o\0g\0r\0a\0m\0 \0F\0i\0l\0e\0s\0\\0C\0o\0m\0m\0o\0n\0 \0F\0i\0l\0e\0s\0\0\0"}, 72, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (340, "CommonFilesDir", Partial, 144, ... TitleIdx=0, Type=1, Data="C\0:\0\\0P\0r\0o\0g\0r\0a\0m\0 \0F\0i\0l\0e\0s\0\\0C\0o\0m\0m\0o\0n\0 \0F\0i\0l\0e\0s\0\0\0"}, 72, ) }, 72, ) == 0x0
 02358   396   NtQueryVirtualMemory  (-1, 0xac0000, Basic, 28, ... {BaseAddress=0xac0000,AllocationBase=0xac0000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 0x0, ) == 0x0
 02359   396   NtClose  (340, ... ) == 0x0
 02360   396   NtQueryInformationToken  (336, User, 200, ... {token info, class 1, size 36}, 36, ) == 0x0
 02361   396   NtOpenKey  (0x20019, {24, 328, 0x40, 0, 0,  (0x20019, {24, 328, 0x40, 0, 0, "S-1-5-21-1078081533-484763869-839522115-1003"}, ... 340, ) }, ... 340, ) == 0x0
 02362   396   NtOpenThreadToken  (-2, 0x2000c, 1, ... ) == STATUS_NO_TOKEN
 02363   396   NtQueryInformationToken  (336, Type, 4, ... {token info, class 8, size 4}, 4, ) == 0x0
 02364   396   NtDuplicateToken  (336, 0xc, {24, 0, 0x0, 0, 1239836, 0x0}, 0, 2, ... ) == STATUS_ACCESS_DENIED
 02365   396   NtQueryInformationToken  (336, User, 200, ... {token info, class 1, size 36}, 36, ) == 0x0
 02366   396   NtOpenThreadToken  (-2, 0xc, 1, ... ) == STATUS_NO_TOKEN
 02367   396   NtCreateEvent  (0x1f0003, 0x0, 1, 0, ... 356, ) == 0x0
 02368   396   NtOpenThreadToken  (-2, 0xc, 1, ... ) == STATUS_NO_TOKEN
 02369   396   NtSetInformationThread  (-2, ImpersonationToken, {ImpToken=0,}, 4, ... ) == 0x0
 02370   396   NtCreateFile  (0xc0100080, {24, 0, 0x40, 0, 1238040,  (0xc0100080, {24, 0, 0x40, 0, 1238040, "\??\PIPE\lsarpc"}, 0x0, 0, 3, 1, 64, 0, 0, ... 352, {status=0x0, info=1}, ) }, 0x0, 0, 3, 1, 64, 0, 0, ... 352, {status=0x0, info=1}, ) == 0x0
 02371   396   NtSetInformationFile  (352, 1238096, 8, Pipe, ... {status=0x0, info=0}, ) == 0x0
 02372   396   NtSetInformationFile  (352, 1238088, 8, Completion, ... {status=0x0, info=0}, ) == 0x0
 02373   396   NtSetInformationThread  (-2, ImpersonationToken, {ImpToken=0,}, 4, ... ) == 0x0
 02374   396   NtWriteFile  (352, 297, 0, 0,  (352, 297, 0, 0, "\5\0\13\3\20\0\0\0H\0\0\0\1\0\0\0\270\20\270\20\0\0\0\0\1\0\0\0\0\0\1\0xW4\224\22\315\253\357\0\1#Eg\211\253\0\0\0\0\4]\210\212\353\34\311\21\237\350\10\0+\20H`\2\0\0\0", 72, {0, 0}, 0, ... {status=0x0, info=72}, ) , 72, {0, 0}, 0, ... {status=0x0, info=72}, ) == 0x0
 02375   396   NtReadFile  (352, 297, 0, 0, 1024, {0, 0}, 0, ... {status=0x0, info=68},  (352, 297, 0, 0, 1024, {0, 0}, 0, ... {status=0x0, info=68}, "\5\0\14\3\20\0\0\0D\0\0\0\1\0\0\0\270\20\270\20\224%\0\0\14\0\PIPE\lsass\0\0\0\1\0\0\0\0\0\0\0\4]\210\212\353\34\311\21\237\350\10\0+\20H`\2\0\0\0", ) , ) == 0x0
 02376   396   NtFsControlFile  (352, 297, 0x0, 0x0, 0x11c017,  (352, 297, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0@\0\0\0\1\0\0\0(\0\0\0\0\0,\0\0\0\0\0\30\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\314\352\22\0\14\0\0\0\2\0\1\0\0\10\0\0", 64, 1024, ... {status=0x103, info=68}, "\5\0\14\3\20\0\0\0D\0\0\0\1\0\0\0\270\20\270\20\224%\0\0\14\0\PIPE\lsass\0\0\0\1\0\0\0\0\0\0\0\4]\210\212\353\34\311\21\237\350\10\0+\20H`\2\0\0\0", ) , 64, 1024, ... {status=0x103, info=68},  (352, 297, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0@\0\0\0\1\0\0\0(\0\0\0\0\0,\0\0\0\0\0\30\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\314\352\22\0\14\0\0\0\2\0\1\0\0\10\0\0", 64, 1024, ... {status=0x103, info=68}, "\5\0\14\3\20\0\0\0D\0\0\0\1\0\0\0\270\20\270\20\224%\0\0\14\0\PIPE\lsass\0\0\0\1\0\0\0\0\0\0\0\4]\210\212\353\34\311\21\237\350\10\0+\20H`\2\0\0\0", ) , ) == 0x103
 02377   396   NtFsControlFile  (352, 297, 0x0, 0x0, 0x11c017,  (352, 297, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0t\0\0\0\2\0\0\0\\0\0\0\0\09\0\0\0\0\0qF\235\311\333?\334\21\261\310\0\14)\371\246\305\1\0\0\0\4\353\22\0\1\0\0\0\0\255\25\0\5\0\0\0\1\5\0\0\0\0\0\5\25\0\0\0\3757B@\335\350\344\34C\27\122\353\3\0\0\0\0\0\0\0\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0", 116, 1024, ... {status=0x103, info=48}, "\5\0\2\3\20\0\0\00\0\0\0\1\0\0\0\30\0\0\0\0\0\0\0\0\0\0\0qF\235\311\333?\334\21\261\310\0\14)\371\246\305\0\0\0\0", ) , 116, 1024, ... {status=0x103, info=48},  (352, 297, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0t\0\0\0\2\0\0\0\\0\0\0\0\09\0\0\0\0\0qF\235\311\333?\334\21\261\310\0\14)\371\246\305\1\0\0\0\4\353\22\0\1\0\0\0\0\255\25\0\5\0\0\0\1\5\0\0\0\0\0\5\25\0\0\0\3757B@\335\350\344\34C\27\122\353\3\0\0\0\0\0\0\0\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0", 116, 1024, ... {status=0x103, info=48}, "\5\0\2\3\20\0\0\00\0\0\0\1\0\0\0\30\0\0\0\0\0\0\0\0\0\0\0qF\235\311\333?\334\21\261\310\0\14)\371\246\305\0\0\0\0", ) , ) == 0x103
 02378   396   NtFsControlFile  (352, 297, 0x0, 0x0, 0x11c017,  (352, 297, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0,\0\0\0\3\0\0\0\24\0\0\0\0\0\0\0\0\0\0\0qF\235\311\333?\334\21\261\310\0\14)\371\246\305", 44, 1024, ... {status=0x103, info=180}, "\5\0\2\3\20\0\0\0\264\0\0\0\2\0\0\0\234\0\0\0\0\0\0\00\340\25\0\1\0\0\0<\340\25\0 \0\0\0\1\0\0\0\16\0\20\0H\340\25\0X\340\25\0\10\0\0\0\0\0\0\0\7\0\0\0M\0Y\0W\0O\0R\0L\0D\0O\0\4\0\0\0\1\4\0\0\0\0\0\5\25\0\0\0\3757B@\335\350\344\34C\27\122\1\0\0\0P\257\25\0\1\0\0\0\1\0\0\0\20\0\22\0d\257\25\0\0\0\0\0\0\0\0\0\11\0\0\0\0\0\0\0\10\0\0\0S\0R\0I\0-\0u\0s\0e\0r\0\1\0\0\0\0\0\0\0", ) , 44, 1024, ... {status=0x103, info=180},  (352, 297, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0,\0\0\0\3\0\0\0\24\0\0\0\0\0\0\0\0\0\0\0qF\235\311\333?\334\21\261\310\0\14)\371\246\305", 44, 1024, ... {status=0x103, info=180}, "\5\0\2\3\20\0\0\0\264\0\0\0\2\0\0\0\234\0\0\0\0\0\0\00\340\25\0\1\0\0\0<\340\25\0 \0\0\0\1\0\0\0\16\0\20\0H\340\25\0X\340\25\0\10\0\0\0\0\0\0\0\7\0\0\0M\0Y\0W\0O\0R\0L\0D\0O\0\4\0\0\0\1\4\0\0\0\0\0\5\25\0\0\0\3757B@\335\350\344\34C\27\122\1\0\0\0P\257\25\0\1\0\0\0\1\0\0\0\20\0\22\0d\257\25\0\0\0\0\0\0\0\0\0\11\0\0\0\0\0\0\0\10\0\0\0S\0R\0I\0-\0u\0s\0e\0r\0\1\0\0\0\0\0\0\0", ) , ) == 0x103
 02379   396   NtClose  (356, ... ) == 0x0
 02380   396   NtClose  (352, ... ) == 0x0
 02381   396   NtOpenThreadToken  (-2, 0xc, 1, ... ) == STATUS_NO_TOKEN
 02382   396   NtCreateEvent  (0x1f0003, 0x0, 1, 0, ... 352, ) == 0x0
 02383   396   NtOpenThreadToken  (-2, 0xc, 1, ... ) == STATUS_NO_TOKEN
 02384   396   NtSetInformationThread  (-2, ImpersonationToken, {ImpToken=0,}, 4, ... ) == 0x0
 02385   396   NtCreateFile  (0xc0100080, {24, 0, 0x40, 0, 1238036,  (0xc0100080, {24, 0, 0x40, 0, 1238036, "\??\PIPE\lsarpc"}, 0x0, 0, 3, 1, 64, 0, 0, ... 356, {status=0x0, info=1}, ) }, 0x0, 0, 3, 1, 64, 0, 0, ... 356, {status=0x0, info=1}, ) == 0x0
 02386   396   NtSetInformationFile  (356, 1238092, 8, Pipe, ... {status=0x0, info=0}, ) == 0x0
 02387   396   NtSetInformationFile  (356, 1238084, 8, Completion, ... {status=0x0, info=0}, ) == 0x0
 02388   396   NtSetInformationThread  (-2, ImpersonationToken, {ImpToken=0,}, 4, ... ) == 0x0
 02389   396   NtWriteFile  (356, 297, 0, 0,  (356, 297, 0, 0, "\5\0\13\3\20\0\0\0H\0\0\0\1\0\0\0\270\20\270\20\0\0\0\0\1\0\0\0\0\0\1\0xW4\224\22\315\253\357\0\1#Eg\211\253\0\0\0\0\4]\210\212\353\34\311\21\237\350\10\0+\20H`\2\0\0\0", 72, {0, 0}, 0, ... {status=0x0, info=72}, ) , 72, {0, 0}, 0, ... {status=0x0, info=72}, ) == 0x0
 02390   396   NtReadFile  (356, 297, 0, 0, 1024, {0, 0}, 0, ... {status=0x0, info=68},  (356, 297, 0, 0, 1024, {0, 0}, 0, ... {status=0x0, info=68}, "\5\0\14\3\20\0\0\0D\0\0\0\1\0\0\0\270\20\270\20\225%\0\0\14\0\PIPE\lsass\0\0\0\1\0\0\0\0\0\0\0\4]\210\212\353\34\311\21\237\350\10\0+\20H`\2\0\0\0", ) , ) == 0x0
 02391   396   NtFsControlFile  (356, 297, 0x0, 0x0, 0x11c017,  (356, 297, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0@\0\0\0\1\0\0\0(\0\0\0\0\0,\0\0\0\0\0\30\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\310\352\22\0\14\0\0\0\2\0\1\0\0\10\0\0", 64, 1024, ... {status=0x103, info=68}, "\5\0\14\3\20\0\0\0D\0\0\0\1\0\0\0\270\20\270\20\225%\0\0\14\0\PIPE\lsass\0\0\0\1\0\0\0\0\0\0\0\4]\210\212\353\34\311\21\237\350\10\0+\20H`\2\0\0\0", ) , 64, 1024, ... {status=0x103, info=68},  (356, 297, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0@\0\0\0\1\0\0\0(\0\0\0\0\0,\0\0\0\0\0\30\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\310\352\22\0\14\0\0\0\2\0\1\0\0\10\0\0", 64, 1024, ... {status=0x103, info=68}, "\5\0\14\3\20\0\0\0D\0\0\0\1\0\0\0\270\20\270\20\225%\0\0\14\0\PIPE\lsass\0\0\0\1\0\0\0\0\0\0\0\4]\210\212\353\34\311\21\237\350\10\0+\20H`\2\0\0\0", ) , ) == 0x103
 02392   396   NtFsControlFile  (356, 297, 0x0, 0x0, 0x11c017,  (356, 297, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0t\0\0\0\2\0\0\0\\0\0\0\0\09\0\0\0\0\0rF\235\311\333?\334\21\261\310\0\14)\371\246\305\1\0\0\0\0\353\22\0\1\0\0\0\0\255\25\0\5\0\0\0\1\5\0\0\0\0\0\5\25\0\0\0\3757B@\335\350\344\34C\27\122\353\3\0\0\0\0\0\0\0\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0", 116, 1024, ... {status=0x103, info=48}, "\5\0\2\3\20\0\0\00\0\0\0\1\0\0\0\30\0\0\0\0\0\0\0\0\0\0\0rF\235\311\333?\334\21\261\310\0\14)\371\246\305\0\0\0\0", ) , 116, 1024, ... {status=0x103, info=48},  (356, 297, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0t\0\0\0\2\0\0\0\\0\0\0\0\09\0\0\0\0\0rF\235\311\333?\334\21\261\310\0\14)\371\246\305\1\0\0\0\0\353\22\0\1\0\0\0\0\255\25\0\5\0\0\0\1\5\0\0\0\0\0\5\25\0\0\0\3757B@\335\350\344\34C\27\122\353\3\0\0\0\0\0\0\0\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0", 116, 1024, ... {status=0x103, info=48}, "\5\0\2\3\20\0\0\00\0\0\0\1\0\0\0\30\0\0\0\0\0\0\0\0\0\0\0rF\235\311\333?\334\21\261\310\0\14)\371\246\305\0\0\0\0", ) , ) == 0x103
 02393   396   NtFsControlFile  (356, 297, 0x0, 0x0, 0x11c017,  (356, 297, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0,\0\0\0\3\0\0\0\24\0\0\0\0\0\0\0\0\0\0\0rF\235\311\333?\334\21\261\310\0\14)\371\246\305", 44, 1024, ... {status=0x103, info=180}, "\5\0\2\3\20\0\0\0\264\0\0\0\2\0\0\0\234\0\0\0\0\0\0\00\340\25\0\1\0\0\0<\340\25\0 \0\0\0\1\0\0\0\16\0\20\0H\340\25\0X\340\25\0\10\0\0\0\0\0\0\0\7\0\0\0M\0Y\0W\0O\0R\0L\0D\0O\0\4\0\0\0\1\4\0\0\0\0\0\5\25\0\0\0\3757B@\335\350\344\34C\27\122\1\0\0\0P\257\25\0\1\0\0\0\1\0\0\0\20\0\22\0d\257\25\0\0\0\0\0\0\0\0\0\11\0\0\0\0\0\0\0\10\0\0\0S\0R\0I\0-\0u\0s\0e\0r\0\1\0\0\0\0\0\0\0", ) , 44, 1024, ... {status=0x103, info=180},  (356, 297, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0,\0\0\0\3\0\0\0\24\0\0\0\0\0\0\0\0\0\0\0rF\235\311\333?\334\21\261\310\0\14)\371\246\305", 44, 1024, ... {status=0x103, info=180}, "\5\0\2\3\20\0\0\0\264\0\0\0\2\0\0\0\234\0\0\0\0\0\0\00\340\25\0\1\0\0\0<\340\25\0 \0\0\0\1\0\0\0\16\0\20\0H\340\25\0X\340\25\0\10\0\0\0\0\0\0\0\7\0\0\0M\0Y\0W\0O\0R\0L\0D\0O\0\4\0\0\0\1\4\0\0\0\0\0\5\25\0\0\0\3757B@\335\350\344\34C\27\122\1\0\0\0P\257\25\0\1\0\0\0\1\0\0\0\20\0\22\0d\257\25\0\0\0\0\0\0\0\0\0\11\0\0\0\0\0\0\0\10\0\0\0S\0R\0I\0-\0u\0s\0e\0r\0\1\0\0\0\0\0\0\0", ) , ) == 0x103
 02394   396   NtClose  (352, ... ) == 0x0
 02395   396   NtClose  (356, ... ) == 0x0
 02396   396   NtQueryVirtualMemory  (-1, 0xac0000, Basic, 28, ... {BaseAddress=0xac0000,AllocationBase=0xac0000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 0x0, ) == 0x0
 02397   396   NtQueryVirtualMemory  (-1, 0xac0000, Basic, 28, ... {BaseAddress=0xac0000,AllocationBase=0xac0000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 0x0, ) == 0x0
 02398   396   NtQueryInformationToken  (336, User, 200, ... {token info, class 1, size 36}, 36, ) == 0x0
 02399   396   NtOpenKey  (0x20019, {24, 48, 0x40, 0, 0,  (0x20019, {24, 48, 0x40, 0, 0, "Software\Microsoft\Windows NT\CurrentVersion\ProfileList\S-1-5-21-1078081533-484763869-839522115-1003"}, ... 356, ) }, ... 356, ) == 0x0
 02400   396   NtQueryValueKey  (356,  (356, "ProfileImagePath", Partial, 144, ... TitleIdx=0, Type=2, Data="%\0S\0y\0s\0t\0e\0m\0D\0r\0i\0v\0e\0%\0\\0D\0o\0c\0u\0m\0e\0n\0t\0s\0 \0a\0n\0d\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0S\0R\0I\0-\0u\0s\0e\0r\0\0\0"}, 104, ) , Partial, 144, ... TitleIdx=0, Type=2, Data= (356, "ProfileImagePath", Partial, 144, ... TitleIdx=0, Type=2, Data="%\0S\0y\0s\0t\0e\0m\0D\0r\0i\0v\0e\0%\0\\0D\0o\0c\0u\0m\0e\0n\0t\0s\0 \0a\0n\0d\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0S\0R\0I\0-\0u\0s\0e\0r\0\0\0"}, 104, ) }, 104, ) == 0x0
 02401   396   NtClose  (356, ... ) == 0x0
 02402   396   NtCreateKey  (0x2001f, {24, 340, 0x40, 0, 0,  (0x2001f, {24, 340, 0x40, 0, 0, "Software\Microsoft\Windows NT\CurrentVersion\Winlogon"}, 0, 0x0, 0, ... 356, 2, ) }, 0, 0x0, 0, ... 356, 2, ) == 0x0
 02403   396   NtQueryValueKey  (356,  (356, "ParseAutoexec", Partial, 144, ... TitleIdx=0, Type=1, Data="1\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (356, "ParseAutoexec", Partial, 144, ... TitleIdx=0, Type=1, Data="1\0\0\0"}, 16, ) }, 16, ) == 0x0
 02404   396   NtClose  (356, ... ) == 0x0
 02405   396   NtQueryInformationProcess  (-1, DefaultHardErrorMode, 4, ... {process info, class 12, size 4}, 0x0, ) == 0x0
 02406   396   NtSetInformationProcess  (-1, DefaultHardErrorMode, {process info, class 12, size 4}, 4, ... ) == 0x0
 02407   396   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\c:\autoexec.bat"}, 1239740, ... ) }, 1239740, ... ) == 0x0
 02408   396   NtCreateFile  (0x80100080, {24, 0, 0x40, 0, 1239748,  (0x80100080, {24, 0, 0x40, 0, 1239748, "\??\c:\autoexec.bat"}, 0x0, 128, 1, 1, 96, 0, 0, ... 356, {status=0x0, info=1}, ) }, 0x0, 128, 1, 1, 96, 0, 0, ... 356, {status=0x0, info=1}, ) == 0x0
 02409   396   NtQueryInformationProcess  (-1, DefaultHardErrorMode, 4, ... {process info, class 12, size 4}, 0x0, ) == 0x0
 02410   396   NtSetInformationProcess  (-1, DefaultHardErrorMode, {process info, class 12, size 4}, 4, ... ) == 0x0
 02411   396   NtQueryInformationFile  (356, 1239764, 24, Standard, ... {status=0x0, info=24}, ) == 0x0
 02412   396   NtReadFile  (356, 0, 0, 0, 0, 0x0, 0, ... {status=0x0, info=0}, "", ) == 0x0
 02413   396   NtClose  (356, ... ) == 0x0
 02414   396   NtOpenKey  (0x20019, {24, 340, 0x40, 0, 0,  (0x20019, {24, 340, 0x40, 0, 0, "Environment"}, ... 356, ) }, ... 356, ) == 0x0
 02415   396   NtEnumerateValueKey  (356, 0, Full, 220, ... TitleIdx=0, Type=2, Name= (356, 0, Full, 220, ... TitleIdx=0, Type=2, Name="TEMP", Data="%\0U\0S\0E\0R\0P\0R\0O\0F\0I\0L\0E\0%\0\\0L\0o\0c\0a\0l\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0T\0e\0m\0p\0\0\0"}, 96, ) , Data= (356, 0, Full, 220, ... TitleIdx=0, Type=2, Name="TEMP", Data="%\0U\0S\0E\0R\0P\0R\0O\0F\0I\0L\0E\0%\0\\0L\0o\0c\0a\0l\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0T\0e\0m\0p\0\0\0"}, 96, ) }, 96, ) == 0x0
 02416   396   NtEnumerateValueKey  (356, 1, Full, 220, ... TitleIdx=0, Type=2, Name= (356, 1, Full, 220, ... TitleIdx=0, Type=2, Name="TMP", Data="%\0U\0S\0E\0R\0P\0R\0O\0F\0I\0L\0E\0%\0\\0L\0o\0c\0a\0l\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0T\0e\0m\0p\0\0\0"}, 96, ) , Data= (356, 1, Full, 220, ... TitleIdx=0, Type=2, Name="TMP", Data="%\0U\0S\0E\0R\0P\0R\0O\0F\0I\0L\0E\0%\0\\0L\0o\0c\0a\0l\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0T\0e\0m\0p\0\0\0"}, 96, ) }, 96, ) == 0x0
 02417   396   NtEnumerateValueKey  (356, 2, Full, 220, ... ) == STATUS_NO_MORE_ENTRIES
 02418   396   NtEnumerateValueKey  (356, 0, Full, 220, ... TitleIdx=0, Type=2, Name= (356, 0, Full, 220, ... TitleIdx=0, Type=2, Name="TEMP", Data="%\0U\0S\0E\0R\0P\0R\0O\0F\0I\0L\0E\0%\0\\0L\0o\0c\0a\0l\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0T\0e\0m\0p\0\0\0"}, 96, ) , Data= (356, 0, Full, 220, ... TitleIdx=0, Type=2, Name="TEMP", Data="%\0U\0S\0E\0R\0P\0R\0O\0F\0I\0L\0E\0%\0\\0L\0o\0c\0a\0l\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0T\0e\0m\0p\0\0\0"}, 96, ) }, 96, ) == 0x0
 02419   396   NtQueryInformationProcess  (-1, DefaultHardErrorMode, 4, ... {process info, class 12, size 4}, 0x0, ) == 0x0
 02420   396   NtSetInformationProcess  (-1, DefaultHardErrorMode, {process info, class 12, size 4}, 4, ... ) == 0x0
 02421   396   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\Documents and Settings\SRI-user\Local Settings\Temp"}, 1238480, ... ) }, 1238480, ... ) == 0x0
 02422   396   NtOpenFile  (0x100001, {24, 0, 0x40, 0, 0,  (0x100001, {24, 0, 0x40, 0, 0, "\??\C:\"}, 3, 16417, ... 352, {status=0x0, info=1}, ) }, 3, 16417, ... 352, {status=0x0, info=1}, ) == 0x0
 02423   396   NtQueryDirectoryFile  (352, 0, 0, 0, 1237840, 616, BothDirectory, 1,  (352, 0, 0, 0, 1237840, 616, BothDirectory, 1, "Documents and Settings", 0, ... {status=0x0, info=138}, ) , 0, ... {status=0x0, info=138}, ) == 0x0
 02424   396   NtClose  (352, ... ) == 0x0
 02425   396   NtOpenFile  (0x100001, {24, 0, 0x40, 0, 0,  (0x100001, {24, 0, 0x40, 0, 0, "\??\C:\Documents and Settings\SRI-user\"}, 3, 16417, ... 352, {status=0x0, info=1}, ) }, 3, 16417, ... 352, {status=0x0, info=1}, ) == 0x0
 02426   396   NtQueryDirectoryFile  (352, 0, 0, 0, 1237840, 616, BothDirectory, 1,  (352, 0, 0, 0, 1237840, 616, BothDirectory, 1, "Local Settings", 0, ... {status=0x0, info=122}, ) , 0, ... {status=0x0, info=122}, ) == 0x0
 02427   396   NtClose  (352, ... ) == 0x0
 02428   396   NtQueryInformationProcess  (-1, DefaultHardErrorMode, 4, ... {process info, class 12, size 4}, 0x0, ) == 0x0
 02429   396   NtSetInformationProcess  (-1, DefaultHardErrorMode, {process info, class 12, size 4}, 4, ... ) == 0x0
 02430   396   NtQueryVirtualMemory  (-1, 0xac0000, Basic, 28, ... {BaseAddress=0xac0000,AllocationBase=0xac0000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 0x0, ) == 0x0
 02431   396   NtEnumerateValueKey  (356, 1, Full, 220, ... TitleIdx=0, Type=2, Name= (356, 1, Full, 220, ... TitleIdx=0, Type=2, Name="TMP", Data="%\0U\0S\0E\0R\0P\0R\0O\0F\0I\0L\0E\0%\0\\0L\0o\0c\0a\0l\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0T\0e\0m\0p\0\0\0"}, 96, ) , Data= (356, 1, Full, 220, ... TitleIdx=0, Type=2, Name="TMP", Data="%\0U\0S\0E\0R\0P\0R\0O\0F\0I\0L\0E\0%\0\\0L\0o\0c\0a\0l\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0T\0e\0m\0p\0\0\0"}, 96, ) }, 96, ) == 0x0
 02432   396   NtQueryInformationProcess  (-1, DefaultHardErrorMode, 4, ... {process info, class 12, size 4}, 0x0, ) == 0x0
 02433   396   NtSetInformationProcess  (-1, DefaultHardErrorMode, {process info, class 12, size 4}, 4, ... ) == 0x0
 02434   396   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\Documents and Settings\SRI-user\Local Settings\Temp"}, 1238480, ... ) }, 1238480, ... ) == 0x0
 02435   396   NtOpenFile  (0x100001, {24, 0, 0x40, 0, 0,  (0x100001, {24, 0, 0x40, 0, 0, "\??\C:\"}, 3, 16417, ... 352, {status=0x0, info=1}, ) }, 3, 16417, ... 352, {status=0x0, info=1}, ) == 0x0
 02436   396   NtQueryDirectoryFile  (352, 0, 0, 0, 1237840, 616, BothDirectory, 1,  (352, 0, 0, 0, 1237840, 616, BothDirectory, 1, "Documents and Settings", 0, ... {status=0x0, info=138}, ) , 0, ... {status=0x0, info=138}, ) == 0x0
 02437   396   NtClose  (352, ... ) == 0x0
 02438   396   NtOpenFile  (0x100001, {24, 0, 0x40, 0, 0,  (0x100001, {24, 0, 0x40, 0, 0, "\??\C:\Documents and Settings\SRI-user\"}, 3, 16417, ... 352, {status=0x0, info=1}, ) }, 3, 16417, ... 352, {status=0x0, info=1}, ) == 0x0
 02439   396   NtQueryDirectoryFile  (352, 0, 0, 0, 1237840, 616, BothDirectory, 1,  (352, 0, 0, 0, 1237840, 616, BothDirectory, 1, "Local Settings", 0, ... {status=0x0, info=122}, ) , 0, ... {status=0x0, info=122}, ) == 0x0
 02440   396   NtClose  (352, ... ) == 0x0
 02441   396   NtQueryInformationProcess  (-1, DefaultHardErrorMode, 4, ... {process info, class 12, size 4}, 0x0, ) == 0x0
 02442   396   NtSetInformationProcess  (-1, DefaultHardErrorMode, {process info, class 12, size 4}, 4, ... ) == 0x0
 02443   396   NtQueryVirtualMemory  (-1, 0xac0000, Basic, 28, ... {BaseAddress=0xac0000,AllocationBase=0xac0000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 0x0, ) == 0x0
 02444   396   NtEnumerateValueKey  (356, 2, Full, 220, ... ) == STATUS_NO_MORE_ENTRIES
 02445   396   NtClose  (356, ... ) == 0x0
 02446   396   NtOpenKey  (0x20019, {24, 340, 0x40, 0, 0,  (0x20019, {24, 340, 0x40, 0, 0, "Volatile Environment"}, ... 356, ) }, ... 356, ) == 0x0
 02447   396   NtEnumerateValueKey  (356, 0, Full, 220, ... TitleIdx=0, Type=1, Name= (356, 0, Full, 220, ... TitleIdx=0, Type=1, Name="LOGONSERVER", Data="\\0\\0M\0Y\0W\0O\0R\0L\0D\0\0\0"}, 64, ) , Data= (356, 0, Full, 220, ... TitleIdx=0, Type=1, Name="LOGONSERVER", Data="\\0\\0M\0Y\0W\0O\0R\0L\0D\0\0\0"}, 64, ) }, 64, ) == 0x0
 02448   396   NtQueryVirtualMemory  (-1, 0xac0000, Basic, 28, ... {BaseAddress=0xac0000,AllocationBase=0xac0000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 0x0, ) == 0x0
 02449   396   NtEnumerateValueKey  (356, 1, Full, 220, ... TitleIdx=0, Type=1, Name= (356, 1, Full, 220, ... TitleIdx=0, Type=1, Name="HOMEDRIVE", Data="C\0:\0\0\0"}, 46, ) , Data= (356, 1, Full, 220, ... TitleIdx=0, Type=1, Name="HOMEDRIVE", Data="C\0:\0\0\0"}, 46, ) }, 46, ) == 0x0
 02450   396   NtQueryVirtualMemory  (-1, 0xac0000, Basic, 28, ... {BaseAddress=0xac0000,AllocationBase=0xac0000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 0x0, ) == 0x0
 02451   396   NtEnumerateValueKey  (356, 2, Full, 220, ... TitleIdx=0, Type=1, Name= (356, 2, Full, 220, ... TitleIdx=0, Type=1, Name="HOMEPATH", Data="\\0D\0o\0c\0u\0m\0e\0n\0t\0s\0 \0a\0n\0d\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0S\0R\0I\0-\0u\0s\0e\0r\0\0\0"}, 102, ) , Data= (356, 2, Full, 220, ... TitleIdx=0, Type=1, Name="HOMEPATH", Data="\\0D\0o\0c\0u\0m\0e\0n\0t\0s\0 \0a\0n\0d\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0S\0R\0I\0-\0u\0s\0e\0r\0\0\0"}, 102, ) }, 102, ) == 0x0
 02452   396   NtQueryVirtualMemory  (-1, 0xac0000, Basic, 28, ... {BaseAddress=0xac0000,AllocationBase=0xac0000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 0x0, ) == 0x0
 02453   396   NtEnumerateValueKey  (356, 3, Full, 220, ... TitleIdx=0, Type=1, Name= (356, 3, Full, 220, ... TitleIdx=0, Type=1, Name="CLIENTNAME", Data="C\0o\0n\0s\0o\0l\0e\0\0\0"}, 56, ) , Data= (356, 3, Full, 220, ... TitleIdx=0, Type=1, Name="CLIENTNAME", Data="C\0o\0n\0s\0o\0l\0e\0\0\0"}, 56, ) }, 56, ) == 0x0
 02454   396   NtQueryVirtualMemory  (-1, 0xac0000, Basic, 28, ... {BaseAddress=0xac0000,AllocationBase=0xac0000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 0x0, ) == 0x0
 02455   396   NtEnumerateValueKey  (356, 4, Full, 220, ... TitleIdx=0, Type=1, Name= (356, 4, Full, 220, ... TitleIdx=0, Type=1, Name="SESSIONNAME", Data="C\0o\0n\0s\0o\0l\0e\0\0\0"}, 60, ) , Data= (356, 4, Full, 220, ... TitleIdx=0, Type=1, Name="SESSIONNAME", Data="C\0o\0n\0s\0o\0l\0e\0\0\0"}, 60, ) }, 60, ) == 0x0
 02456   396   NtQueryVirtualMemory  (-1, 0xac0000, Basic, 28, ... {BaseAddress=0xac0000,AllocationBase=0xac0000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 0x0, ) == 0x0
 02457   396   NtEnumerateValueKey  (356, 5, Full, 220, ... TitleIdx=0, Type=1, Name= (356, 5, Full, 220, ... TitleIdx=0, Type=1, Name="APPDATA", Data="C\0:\0\\0D\0o\0c\0u\0m\0e\0n\0t\0s\0 \0a\0n\0d\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0S\0R\0I\0-\0u\0s\0e\0r\0\\0A\0p\0p\0l\0i\0c\0a\0t\0i\0o\0n\0 \0D\0a\0t\0a\0\0\0"}, 140, ) , Data= (356, 5, Full, 220, ... TitleIdx=0, Type=1, Name="APPDATA", Data="C\0:\0\\0D\0o\0c\0u\0m\0e\0n\0t\0s\0 \0a\0n\0d\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0S\0R\0I\0-\0u\0s\0e\0r\0\\0A\0p\0p\0l\0i\0c\0a\0t\0i\0o\0n\0 \0D\0a\0t\0a\0\0\0"}, 140, ) }, 140, ) == 0x0
 02458   396   NtQueryVirtualMemory  (-1, 0xac0000, Basic, 28, ... {BaseAddress=0xac0000,AllocationBase=0xac0000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 0x0, ) == 0x0
 02459   396   NtEnumerateValueKey  (356, 6, Full, 220, ... TitleIdx=0, Type=1, Name= (356, 6, Full, 220, ... TitleIdx=0, Type=1, Name="HOMESHARE", Data="\0\0"}, 42, ) , Data= (356, 6, Full, 220, ... TitleIdx=0, Type=1, Name="HOMESHARE", Data="\0\0"}, 42, ) }, 42, ) == 0x0
 02460   396   NtEnumerateValueKey  (356, 7, Full, 220, ... ) == STATUS_NO_MORE_ENTRIES
 02461   396   NtEnumerateValueKey  (356, 0, Full, 220, ... TitleIdx=0, Type=1, Name= (356, 0, Full, 220, ... TitleIdx=0, Type=1, Name="LOGONSERVER", Data="\\0\\0M\0Y\0W\0O\0R\0L\0D\0\0\0"}, 64, ) , Data= (356, 0, Full, 220, ... TitleIdx=0, Type=1, Name="LOGONSERVER", Data="\\0\\0M\0Y\0W\0O\0R\0L\0D\0\0\0"}, 64, ) }, 64, ) == 0x0
 02462   396   NtEnumerateValueKey  (356, 1, Full, 220, ... TitleIdx=0, Type=1, Name= (356, 1, Full, 220, ... TitleIdx=0, Type=1, Name="HOMEDRIVE", Data="C\0:\0\0\0"}, 46, ) , Data= (356, 1, Full, 220, ... TitleIdx=0, Type=1, Name="HOMEDRIVE", Data="C\0:\0\0\0"}, 46, ) }, 46, ) == 0x0
 02463   396   NtEnumerateValueKey  (356, 2, Full, 220, ... TitleIdx=0, Type=1, Name= (356, 2, Full, 220, ... TitleIdx=0, Type=1, Name="HOMEPATH", Data="\\0D\0o\0c\0u\0m\0e\0n\0t\0s\0 \0a\0n\0d\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0S\0R\0I\0-\0u\0s\0e\0r\0\0\0"}, 102, ) , Data= (356, 2, Full, 220, ... TitleIdx=0, Type=1, Name="HOMEPATH", Data="\\0D\0o\0c\0u\0m\0e\0n\0t\0s\0 \0a\0n\0d\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0S\0R\0I\0-\0u\0s\0e\0r\0\0\0"}, 102, ) }, 102, ) == 0x0
 02464   396   NtEnumerateValueKey  (356, 3, Full, 220, ... TitleIdx=0, Type=1, Name= (356, 3, Full, 220, ... TitleIdx=0, Type=1, Name="CLIENTNAME", Data="C\0o\0n\0s\0o\0l\0e\0\0\0"}, 56, ) , Data= (356, 3, Full, 220, ... TitleIdx=0, Type=1, Name="CLIENTNAME", Data="C\0o\0n\0s\0o\0l\0e\0\0\0"}, 56, ) }, 56, ) == 0x0
 02465   396   NtEnumerateValueKey  (356, 4, Full, 220, ... TitleIdx=0, Type=1, Name= (356, 4, Full, 220, ... TitleIdx=0, Type=1, Name="SESSIONNAME", Data="C\0o\0n\0s\0o\0l\0e\0\0\0"}, 60, ) , Data= (356, 4, Full, 220, ... TitleIdx=0, Type=1, Name="SESSIONNAME", Data="C\0o\0n\0s\0o\0l\0e\0\0\0"}, 60, ) }, 60, ) == 0x0
 02466   396   NtEnumerateValueKey  (356, 5, Full, 220, ... TitleIdx=0, Type=1, Name= (356, 5, Full, 220, ... TitleIdx=0, Type=1, Name="APPDATA", Data="C\0:\0\\0D\0o\0c\0u\0m\0e\0n\0t\0s\0 \0a\0n\0d\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0S\0R\0I\0-\0u\0s\0e\0r\0\\0A\0p\0p\0l\0i\0c\0a\0t\0i\0o\0n\0 \0D\0a\0t\0a\0\0\0"}, 140, ) , Data= (356, 5, Full, 220, ... TitleIdx=0, Type=1, Name="APPDATA", Data="C\0:\0\\0D\0o\0c\0u\0m\0e\0n\0t\0s\0 \0a\0n\0d\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0S\0R\0I\0-\0u\0s\0e\0r\0\\0A\0p\0p\0l\0i\0c\0a\0t\0i\0o\0n\0 \0D\0a\0t\0a\0\0\0"}, 140, ) }, 140, ) == 0x0
 02467   396   NtEnumerateValueKey  (356, 6, Full, 220, ... TitleIdx=0, Type=1, Name= (356, 6, Full, 220, ... TitleIdx=0, Type=1, Name="HOMESHARE", Data="\0\0"}, 42, ) , Data= (356, 6, Full, 220, ... TitleIdx=0, Type=1, Name="HOMESHARE", Data="\0\0"}, 42, ) }, 42, ) == 0x0
 02468   396   NtEnumerateValueKey  (356, 7, Full, 220, ... ) == STATUS_NO_MORE_ENTRIES
 02469   396   NtClose  (356, ... ) == 0x0
 02470   396   NtClose  (340, ... ) == 0x0
 02471   396   NtFreeVirtualMemory  (-1, (0xac0000), 0, 32768, ... (0xac0000), 4096, ) == 0x0
 02472   396   NtClose  (348, ... ) == 0x0
 02473   396   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\Documents and Settings\SRI-user\Application Data"}, 1240404, ... ) }, 1240404, ... ) == 0x0
 02474   396   NtQueryInformationToken  (336, User, 64, ... {token info, class 1, size 36}, 36, ) == 0x0
 02475   396   NtOpenKey  (0x2001f, {24, 328, 0x40, 0, 0,  (0x2001f, {24, 328, 0x40, 0, 0, "S-1-5-21-1078081533-484763869-839522115-1003"}, ... 348, ) }, ... 348, ) == 0x0
 02476   396   NtCreateKey  (0x2000000, {24, 348, 0x40, 0, 0,  (0x2000000, {24, 348, 0x40, 0, 0, "Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders"}, 0, 0x0, 0, ... 340, 2, ) }, 0, 0x0, 0, ... 340, 2, ) == 0x0
 02477   396   NtClose  (348, ... ) == 0x0
 02478   396   NtSetValueKey  (340,  (340, "AppData", 0, 1, "C\0:\0\\0D\0o\0c\0u\0m\0e\0n\0t\0s\0 \0a\0n\0d\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0S\0R\0I\0-\0u\0s\0e\0r\0\\0A\0p\0p\0l\0i\0c\0a\0t\0i\0o\0n\0 \0D\0a\0t\0a\0\0\0", 104, ... ) , 0, 1,  (340, "AppData", 0, 1, "C\0:\0\\0D\0o\0c\0u\0m\0e\0n\0t\0s\0 \0a\0n\0d\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0S\0R\0I\0-\0u\0s\0e\0r\0\\0A\0p\0p\0l\0i\0c\0a\0t\0i\0o\0n\0 \0D\0a\0t\0a\0\0\0", 104, ... ) , 104, ... ) == 0x0
 02479   396   NtClose  (340, ... ) == 0x0
 02480   396   NtClose  (336, ... ) == 0x0
 02481   396   NtOpenFile  (0x100001, {24, 0, 0x40, 0, 0,  (0x100001, {24, 0, 0x40, 0, 0, "\??\C:\Documents and Settings\SRI-user\Application Data\Microsoft\Network\Connections\Pbk\"}, 3, 16417, ... ) }, 3, 16417, ... ) == STATUS_OBJECT_PATH_NOT_FOUND
 02482   396   NtCreateKey  (0x2, {24, 332, 0x40, 0, 0,  (0x2, {24, 332, 0x40, 0, 0, "Software\Microsoft\windows\CurrentVersion\Internet Settings"}, 0, "", 0, ... 336, 2, ) }, 0, "", 0, ... 336, 2, ) == 0x0
 02483   396   NtSetValueKey  (336,  (336, "MigrateProxy", 0, 4, "\1\0\0\0", 4, ... ) , 0, 4,  (336, "MigrateProxy", 0, 4, "\1\0\0\0", 4, ... ) , 4, ... ) == 0x0
 02484   396   NtClose  (336, ... ) == 0x0
 02485   396   NtOpenKey  (0x20019, {24, 332, 0x40, 0, 0,  (0x20019, {24, 332, 0x40, 0, 0, "Software\Microsoft\windows\CurrentVersion\Internet Settings"}, ... 336, ) }, ... 336, ) == 0x0
 02486   396   NtQueryValueKey  (336,  (336, "ProxyEnable", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (336, "ProxyEnable", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) }, 16, ) == 0x0
 02487   396   NtQueryValueKey  (336,  (336, "ProxyServer", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02488   396   NtQueryValueKey  (336,  (336, "ProxyOverride", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02489   396   NtQueryValueKey  (336,  (336, "AutoConfigURL", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02490   396   NtClose  (336, ... ) == 0x0
 02491   396   NtWaitForSingleObject  (208, 0, 0x0, ... ) == 0x0
 02492   396   NtCreateKey  (0x1, {24, 332, 0x40, 0, 0,  (0x1, {24, 332, 0x40, 0, 0, "Software\Microsoft\windows\CurrentVersion\Internet Settings\Connections"}, 0, "", 0, ... 336, 2, ) }, 0, "", 0, ... 336, 2, ) == 0x0
 02493   396   NtQueryValueKey  (336,  (336, "SavedLegacySettings", Partial, 144, ... TitleIdx=0, Type=3, Data="<\0\0\0\26\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\4\0\0\0\0\0\0\00f\32\27\250\231\307\1\1\0\0\0\300\250|\200\0\0\0\0\0\0\0\0"}, 68, ) , Partial, 144, ... TitleIdx=0, Type=3, Data= (336, "SavedLegacySettings", Partial, 144, ... TitleIdx=0, Type=3, Data="<\0\0\0\26\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\4\0\0\0\0\0\0\00f\32\27\250\231\307\1\1\0\0\0\300\250|\200\0\0\0\0\0\0\0\0"}, 68, ) }, 68, ) == 0x0
 02494   396   NtQueryValueKey  (336,  (336, "SavedLegacySettings", Partial, 144, ... TitleIdx=0, Type=3, Data="<\0\0\0\26\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\4\0\0\0\0\0\0\00f\32\27\250\231\307\1\1\0\0\0\300\250|\200\0\0\0\0\0\0\0\0"}, 68, ) , Partial, 144, ... TitleIdx=0, Type=3, Data= (336, "SavedLegacySettings", Partial, 144, ... TitleIdx=0, Type=3, Data="<\0\0\0\26\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\4\0\0\0\0\0\0\00f\32\27\250\231\307\1\1\0\0\0\300\250|\200\0\0\0\0\0\0\0\0"}, 68, ) }, 68, ) == 0x0
 02495   396   NtReleaseMutant  (208, ... 0x0, ) == 0x0
 02496   396   NtClose  (336, ... ) == 0x0
 02497   396   NtWaitForSingleObject  (208, 0, 0x0, ... ) == 0x0
 02498   396   NtCreateKey  (0x1, {24, 332, 0x40, 0, 0,  (0x1, {24, 332, 0x40, 0, 0, "Software\Microsoft\windows\CurrentVersion\Internet Settings\Connections"}, 0, "", 0, ... 336, 2, ) }, 0, "", 0, ... 336, 2, ) == 0x0
 02499   396   NtQueryValueKey  (336,  (336, "DefaultConnectionSettings", Partial, 144, ... TitleIdx=0, Type=3, Data="<\0\0\0\3\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\4\0\0\0\0\0\0\00f\32\27\250\231\307\1\1\0\0\0\300\250|\200\0\0\0\0\0\0\0\0"}, 68, ) , Partial, 144, ... TitleIdx=0, Type=3, Data= (336, "DefaultConnectionSettings", Partial, 144, ... TitleIdx=0, Type=3, Data="<\0\0\0\3\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\4\0\0\0\0\0\0\00f\32\27\250\231\307\1\1\0\0\0\300\250|\200\0\0\0\0\0\0\0\0"}, 68, ) }, 68, ) == 0x0
 02500   396   NtQueryValueKey  (336,  (336, "DefaultConnectionSettings", Partial, 144, ... TitleIdx=0, Type=3, Data="<\0\0\0\3\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\4\0\0\0\0\0\0\00f\32\27\250\231\307\1\1\0\0\0\300\250|\200\0\0\0\0\0\0\0\0"}, 68, ) , Partial, 144, ... TitleIdx=0, Type=3, Data= (336, "DefaultConnectionSettings", Partial, 144, ... TitleIdx=0, Type=3, Data="<\0\0\0\3\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\4\0\0\0\0\0\0\00f\32\27\250\231\307\1\1\0\0\0\300\250|\200\0\0\0\0\0\0\0\0"}, 68, ) }, 68, ) == 0x0
 02501   396   NtReleaseMutant  (208, ... 0x0, ) == 0x0
 02502   396   NtClose  (336, ... ) == 0x0
 02503   396   NtWaitForSingleObject  (188, 0, 0x0, ... ) == 0x0
 02504   396   NtClearEvent  (188, ... ) == 0x0
 02505   396   NtSetEvent  (188, ... 0x0, ) == 0x0
 02506   396   NtCreateKey  (0x20006, {24, 332, 0x40, 0, 0,  (0x20006, {24, 332, 0x40, 0, 0, "Software\Microsoft\windows\CurrentVersion\Internet Settings"}, 0, "", 0, ... 336, 2, ) }, 0, "", 0, ... 336, 2, ) == 0x0
 02507   396   NtSetValueKey  (336,  (336, "ProxyEnable", 0, 4, "\0\0\0\0", 4, ... ) , 0, 4,  (336, "ProxyEnable", 0, 4, "\0\0\0\0", 4, ... ) , 4, ... ) == 0x0
 02508   396   NtDeleteValueKey  (336,  (336, "ProxyServer", ... ) , ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02509   396   NtDeleteValueKey  (336,  (336, "ProxyOverride", ... ) , ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02510   396   NtDeleteValueKey  (336,  (336, "AutoConfigURL", ... ) , ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02511   396   NtClose  (336, ... ) == 0x0
 02512   396   NtOpenKey  (0x2000000, {24, 0, 0x40, 0, 0,  (0x2000000, {24, 0, 0x40, 0, 0, "\REGISTRY\MACHINE\SYSTEM\CURRENTCONTROLSET\HARDWARE PROFILES\CURRENT"}, ... 336, ) }, ... 336, ) == 0x0
 02513   396   NtCreateKey  (0x2, {24, 336, 0x40, 0, 0,  (0x2, {24, 336, 0x40, 0, 0, "Software\Microsoft\windows\CurrentVersion\Internet Settings"}, 0, "", 0, ... 340, 2, ) }, 0, "", 0, ... 340, 2, ) == 0x0
 02514   396   NtSetValueKey  (340,  (340, "ProxyEnable", 0, 4, "\0\0\0\0", 4, ... ) , 0, 4,  (340, "ProxyEnable", 0, 4, "\0\0\0\0", 4, ... ) , 4, ... ) == 0x0
 02515   396   NtClose  (340, ... ) == 0x0
 02516   396   NtWaitForSingleObject  (208, 0, 0x0, ... ) == 0x0
 02517   396   NtCreateKey  (0x1, {24, 332, 0x40, 0, 0,  (0x1, {24, 332, 0x40, 0, 0, "Software\Microsoft\windows\CurrentVersion\Internet Settings\Connections"}, 0, "", 0, ... 340, 2, ) }, 0, "", 0, ... 340, 2, ) == 0x0
 02518   396   NtQueryValueKey  (340,  (340, "SavedLegacySettings", Partial, 144, ... TitleIdx=0, Type=3, Data="<\0\0\0\26\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\4\0\0\0\0\0\0\00f\32\27\250\231\307\1\1\0\0\0\300\250|\200\0\0\0\0\0\0\0\0"}, 68, ) , Partial, 144, ... TitleIdx=0, Type=3, Data= (340, "SavedLegacySettings", Partial, 144, ... TitleIdx=0, Type=3, Data="<\0\0\0\26\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\4\0\0\0\0\0\0\00f\32\27\250\231\307\1\1\0\0\0\300\250|\200\0\0\0\0\0\0\0\0"}, 68, ) }, 68, ) == 0x0
 02519   396   NtQueryValueKey  (340,  (340, "SavedLegacySettings", Partial, 144, ... TitleIdx=0, Type=3, Data="<\0\0\0\26\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\4\0\0\0\0\0\0\00f\32\27\250\231\307\1\1\0\0\0\300\250|\200\0\0\0\0\0\0\0\0"}, 68, ) , Partial, 144, ... TitleIdx=0, Type=3, Data= (340, "SavedLegacySettings", Partial, 144, ... TitleIdx=0, Type=3, Data="<\0\0\0\26\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\4\0\0\0\0\0\0\00f\32\27\250\231\307\1\1\0\0\0\300\250|\200\0\0\0\0\0\0\0\0"}, 68, ) }, 68, ) == 0x0
 02520   396   NtCreateKey  (0x2, {24, 332, 0x40, 0, 0,  (0x2, {24, 332, 0x40, 0, 0, "Software\Microsoft\windows\CurrentVersion\Internet Settings\Connections"}, 0, "", 0, ... 348, 2, ) }, 0, "", 0, ... 348, 2, ) == 0x0
 02521   396   NtReleaseMutant  (208, ... 0x0, ) == 0x0
 02522   396   NtClose  (340, ... ) == 0x0
 02523   396   NtSetValueKey  (348,  (348, "SavedLegacySettings", 0, 3, "<\0\0\0\27\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\4\0\0\0\0\0\0\00f\32\27\250\231\307\1\1\0\0\0\300\250|\200\0\0\0\0\0\0\0\0", 56, ... , 0, 3,  (348, "SavedLegacySettings", 0, 3, "<\0\0\0\27\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\4\0\0\0\0\0\0\00f\32\27\250\231\307\1\1\0\0\0\300\250|\200\0\0\0\0\0\0\0\0", 56, ... , 56, ...
 02524   396   NtSetInformationFile  (-2147482732, -136575180, 8, EndOfFile, ... {status=0x0, info=0}, ) == 0x0
 02525   396   NtSetInformationFile  (-2147482732, -136575280, 8, EndOfFile, ... {status=0x0, info=0}, ) == 0x0
 02523   396   NtSetValueKey  ... ) == 0x0
 02526   396   NtClose  (348, ... ) == 0x0
 02527   396   NtWaitForSingleObject  (156, 0, 0x0, ... ) == 0x0
 02528   396   NtQueryInformationFile  (152, 1242472, 24, Standard, ... {status=0x0, info=24}, ) == 0x0
 02529   396   NtReleaseMutant  (156, ... 0x0, ) == 0x0
 02530   396   NtReleaseMutant  (200, ... 0x0, ) == 0x0
 02531   396   NtWaitForSingleObject  (80, 0, {0, 0}, ... ) == 0x102
 02532   396   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\System32\mswsock.dll"}, 1238160, ... ) }, 1238160, ... ) == 0x0
 02533   396   NtOpenFile  (0x100020, {24, 0, 0x40, 0, 0,  (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\System32\mswsock.dll"}, 5, 96, ... 348, {status=0x0, info=1}, ) }, 5, 96, ... 348, {status=0x0, info=1}, ) == 0x0
 02534   396   NtCreateSection  (0xe, 0x0, 0x0, 16, 134217728, 348, ... 340, ) == 0x0
 02535   396   NtClose  (348, ... ) == 0x0
 02536   396   NtMapViewOfSection  (340, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 16, ... (0xaf0000), 0x0, 229376, ) == 0x0
 02537   396   NtClose  (340, ... ) == 0x0
 02538   396   NtUnmapViewOfSection  (-1, 0xaf0000, ... ) == 0x0
 02539   396   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\System32\mswsock.dll"}, 1238476, ... ) }, 1238476, ... ) == 0x0
 02540   396   NtOpenFile  (0x100020, {24, 0, 0x40, 0, 0,  (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\System32\mswsock.dll"}, 5, 96, ... 340, {status=0x0, info=1}, ) }, 5, 96, ... 340, {status=0x0, info=1}, ) == 0x0
 02541   396   NtCreateSection  (0xf, 0x0, 0x0, 16, 16777216, 340, ... 348, ) == 0x0
 02542   396   NtQuerySection  (348, Image, 48, ... {section info, class 1, size 48}, 0x0, ) == 0x0
 02543   396   NtClose  (340, ... ) == 0x0
 02544   396   NtMapViewOfSection  (348, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x71a50000), 0x0, 241664, ) == 0x0
 02545   396   NtClose  (348, ... ) == 0x0
 02546   396   NtQuerySystemInformation  (Basic, 44, ... {Unknown=0,MaximumIncrement=156250,PhysicalPageSize=0x1000,NumberOfPhysicalPages=0xff7c,LowestPhysicalPage=0x1,HighestPhysicalPage=0xffff,AllocationGranularity=0x10000,LowestUserAddress=0x10000,HighestUserAddress=0x7ffeffff,ActiveProcessors=1,NumberProcessors=1,}, 0x0, ) == 0x0
 02547   396   NtQuerySystemInformation  (Processor, 12, ... {system info, class 1, size 12}, 0x0, ) == 0x0
 02548   396   NtCreateEvent  (0x1f0003, 0x0, 0, 0, ... 348, ) == 0x0
 02549   396   NtOpenSection  (0xe, {24, 8, 0x40, 0, 0,  (0xe, {24, 8, 0x40, 0, 0, "DNSAPI.dll"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02550   396   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\u:\work\DNSAPI.dll"}, 1238276, ... ) }, 1238276, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02551   396   NtQueryAttributesFile  ({24, 12, 0x40, 0, 0,  ({24, 12, 0x40, 0, 0, "DNSAPI.dll"}, 1238276, ... ) }, 1238276, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02552   396   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\System32\DNSAPI.dll"}, 1238276, ... ) }, 1238276, ... ) == 0x0
 02553   396   NtOpenFile  (0x100020, {24, 0, 0x40, 0, 0,  (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\System32\DNSAPI.dll"}, 5, 96, ... 340, {status=0x0, info=1}, ) }, 5, 96, ... 340, {status=0x0, info=1}, ) == 0x0
 02554   396   NtCreateSection  (0xf, 0x0, 0x0, 16, 16777216, 340, ... 356, ) == 0x0
 02555   396   NtQuerySection  (356, Image, 48, ... {section info, class 1, size 48}, 0x0, ) == 0x0
 02556   396   NtClose  (340, ... ) == 0x0
 02557   396   NtMapViewOfSection  (356, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x76f20000), 0x0, 151552, ) == 0x0
 02558   396   NtClose  (356, ... ) == 0x0
 02559   396   NtCreateKey  (0x20019, {24, 48, 0x40, 0, 0,  (0x20019, {24, 48, 0x40, 0, 0, "System\CurrentControlSet\Services\Tcpip\Parameters"}, 0, "Class", 0, ... 356, 2, ) }, 0,  (0x20019, {24, 48, 0x40, 0, 0, "System\CurrentControlSet\Services\Tcpip\Parameters"}, 0, "Class", 0, ... 356, 2, ) , 0, ... 356, 2, ) == 0x0
 02560   396   NtOpenKey  (0x20019, {24, 48, 0x40, 0, 0,  (0x20019, {24, 48, 0x40, 0, 0, "System\CurrentControlSet\Services\DnsCache\Parameters"}, ... 340, ) }, ... 340, ) == 0x0
 02561   396   NtOpenKey  (0x20019, {24, 48, 0x40, 0, 0,  (0x20019, {24, 48, 0x40, 0, 0, "Software\Policies\Microsoft\Windows NT\DnsClient"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02562   396   NtOpenKey  (0x1, {24, 48, 0x40, 0, 0,  (0x1, {24, 48, 0x40, 0, 0, "System\CurrentControlSet\Services\DNS"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02563   396   NtQueryValueKey  (340,  (340, "QueryAdapterName", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02564   396   NtQueryValueKey  (356,  (356, "DisableAdapterDomainName", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02565   396   NtQueryValueKey  (340,  (340, "UseDomainNameDevolution", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02566   396   NtQueryValueKey  (356,  (356, "UseDomainNameDevolution", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (356, "UseDomainNameDevolution", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) }, 16, ) == 0x0
 02567   396   NtQueryValueKey  (340,  (340, "PrioritizeRecordData", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02568   396   NtQueryValueKey  (356,  (356, "PrioritizeRecordData", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02569   396   NtQueryValueKey  (340,  (340, "AllowUnqualifiedQuery", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02570   396   NtQueryValueKey  (356,  (356, "AllowUnqualifiedQuery", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02571   396   NtQueryValueKey  (340,  (340, "AppendToMultiLabelName", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02572   396   NtQueryValueKey  (340,  (340, "ScreenBadTlds", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02573   396   NtQueryValueKey  (340,  (340, "ScreenUnreachableServers", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02574   396   NtQueryValueKey  (340,  (340, "FilterClusterIp", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02575   396   NtQueryValueKey  (340,  (340, "WaitForNameErrorOnAll", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02576   396   NtQueryValueKey  (340,  (340, "UseEdns", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02577   396   NtQueryValueKey  (340,  (340, "RegistrationEnabled", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02578   396   NtQueryValueKey  (356,  (356, "DisableDynamicUpdate", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02579   396   NtQueryValueKey  (340,  (340, "RegisterPrimaryName", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02580   396   NtQueryValueKey  (340,  (340, "RegisterAdapterName", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02581   396   NtQueryValueKey  (356,  (356, "EnableAdapterDomainNameRegistration", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02582   396   NtQueryValueKey  (340,  (340, "RegisterReverseLookup", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02583   396   NtQueryValueKey  (356,  (356, "DisableReverseAddressRegistrations", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02584   396   NtQueryValueKey  (340,  (340, "RegisterWanAdapters", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02585   396   NtQueryValueKey  (356,  (356, "DisableWanDynamicUpdate", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02586   396   NtQueryValueKey  (340,  (340, "RegistrationOverwritesInConflict", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02587   396   NtQueryValueKey  (356,  (356, "DisableReplaceAddressesInConflicts", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02588   396   NtQueryValueKey  (340,  (340, "RegistrationTtl", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02589   396   NtQueryValueKey  (356,  (356, "DefaultRegistrationTTL", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02590   396   NtQueryValueKey  (340,  (340, "RegistrationRefreshInterval", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02591   396   NtQueryValueKey  (356,  (356, "DefaultRegistrationRefreshInterval", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02592   396   NtQueryValueKey  (340,  (340, "RegistrationMaxAddressCount", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02593   396   NtQueryValueKey  (356,  (356, "MaxNumberOfAddressesToRegister", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02594   396   NtQueryValueKey  (340,  (340, "UpdateSecurityLevel", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02595   396   NtQueryValueKey  (356,  (356, "UpdateSecurityLevel", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02596   396   NtQueryValueKey  (340,  (340, "UpdateZoneExcludeFile", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02597   396   NtQueryValueKey  (340,  (340, "UpdateTopLevelDomainZones", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02598   396   NtQueryValueKey  (340,  (340, "DnsTest", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02599   396   NtQueryValueKey  (340,  (340, "MaxCacheSize", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02600   396   NtQueryValueKey  (340,  (340, "MaxCacheTtl", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02601   396   NtQueryValueKey  (340,  (340, "MaxNegativeCacheTtl", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02602   396   NtQueryValueKey  (340,  (340, "AdapterTimeoutLimit", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02603   396   NtQueryValueKey  (340,  (340, "ServerPriorityTimeLimit", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02604   396   NtQueryValueKey  (340,  (340, "MaxCachedSockets", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02605   396   NtQueryValueKey  (340,  (340, "UseMulticast", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02606   396   NtQueryValueKey  (340,  (340, "MulticastOnNameError", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02607   396   NtQueryValueKey  (340,  (340, "UseDotLocalDomain", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02608   396   NtQueryValueKey  (340,  (340, "ListenOnMulticast", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02609   396   NtOpenKey  (0x1, {24, 48, 0x40, 0, 0,  (0x1, {24, 48, 0x40, 0, 0, "System\Setup"}, ... 352, ) }, ... 352, ) == 0x0
 02610   396   NtQueryValueKey  (352,  (352, "SystemSetupInProgress", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (352, "SystemSetupInProgress", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) }, 16, ) == 0x0
 02611   396   NtClose  (352, ... ) == 0x0
 02612   396   NtClose  (356, ... ) == 0x0
 02613   396   NtClose  (340, ... ) == 0x0
 02614   396   NtOpenKey  (0x1, {24, 48, 0x40, 0, 0,  (0x1, {24, 48, 0x40, 0, 0, "System\CurrentControlSet\Services\Tcpip\Parameters"}, ... 340, ) }, ... 340, ) == 0x0
 02615   396   NtQueryValueKey  (340,  (340, "DnsQueryTimeouts", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02616   396   NtQueryValueKey  (340,  (340, "DnsQuickQueryTimeouts", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02617   396   NtQueryValueKey  (340,  (340, "DnsMulticastQueryTimeouts", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02618   396   NtClose  (340, ... ) == 0x0
 02619   396   NtCreateEvent  (0x1f0003, 0x0, 1, 0, ... 340, ) == 0x0
 02620   396   NtConnectPort  ( ("\RPC Control\DNSResolver", {12, 2, 1, 1}, 0x0, 0x0, 1238752, 112, ... 356, 0x0, 0x0, 0x0, 112, ) , {12, 2, 1, 1}, 0x0, 0x0, 1238752, 112, ... 356, 0x0, 0x0, 0x0, 112, ) == 0x0
 02621   396   NtRequestWaitReplyPort  (356, {128, 152, new_msg, 0, 124084, 1310720, 1238516, 2012750850}  (356, {128, 152, new_msg, 0, 124084, 1310720, 1238516, 2012750850} "\0\354\22\0\2$\370w\370T\367w\1kwEVY\205D\237\200\364(\367\326\1)\2\0\0\0\1\0\0\0k\23\314w\4\0\0\0\20\344\314w\10P\25\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\1\0\3\0\350\352\25\0`\353\25\0h\3\24\0\30\356\25\0@\0\0\0\20\356\25\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\330\4\24\0\0\0\0\0>\0\0\0\5\0\0\0" ... {128, 152, reply, 0, 316, 396, 1531, 0} "\7\354\22\0\2$\370w\370T\367w\1kwEVY\205D\237\200\364(\367\326\1)\2\0\0\0\1\0\0\0\0\0\0\0\4\0\0\0\20\344\314w\377\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\1\0\3\0\350\352\25\0`\353\25\0h\3\24\0\30\356\25\0@\0\0\0\20\356\25\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\330\4\24\0\0\0\0\0>\0\0\0\5\0\0\0" )  ... {128, 152, reply, 0, 316, 396, 1531, 0}  (356, {128, 152, new_msg, 0, 124084, 1310720, 1238516, 2012750850} "\0\354\22\0\2$\370w\370T\367w\1kwEVY\205D\237\200\364(\367\326\1)\2\0\0\0\1\0\0\0k\23\314w\4\0\0\0\20\344\314w\10P\25\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\1\0\3\0\350\352\25\0`\353\25\0h\3\24\0\30\356\25\0@\0\0\0\20\356\25\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\330\4\24\0\0\0\0\0>\0\0\0\5\0\0\0" ... {128, 152, reply, 0, 316, 396, 1531, 0} "\7\354\22\0\2$\370w\370T\367w\1kwEVY\205D\237\200\364(\367\326\1)\2\0\0\0\1\0\0\0\0\0\0\0\4\0\0\0\20\344\314w\377\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\1\0\3\0\350\352\25\0`\353\25\0h\3\24\0\30\356\25\0@\0\0\0\20\356\25\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\330\4\24\0\0\0\0\0>\0\0\0\5\0\0\0" )  ) == 0x0
 02622   396   NtRequestWaitReplyPort  (356, {64, 88, new_msg, 0, 44, 3, 20, 0}  (356, {64, 88, new_msg, 0, 44, 3, 20, 0} "\1\0\0\0A\2\10\0\333?\334\21\261\310\0\14)\371\246\305\1\0\0\0\377\377\377\377\1\0\0\0\0\0\0\0\21\0\0\0\0\0\0\0\0\0\0\0\25\0\0\0\3757B@\335\350\344\34C\27\122" ... {52, 76, reply, 0, 316, 396, 1532, 0} "\2x>\341\1\0\0\0\210k\362\371\0\0\0\0 \0\0\0\5\0\0\0\0\16W\200\0\0\0\0\200W\12\0\1\0\0\0\1\0\0\0\300\250|\201\377\377\377\0" )  ... {52, 76, reply, 0, 316, 396, 1532, 0}  (356, {64, 88, new_msg, 0, 44, 3, 20, 0} "\1\0\0\0A\2\10\0\333?\334\21\261\310\0\14)\371\246\305\1\0\0\0\377\377\377\377\1\0\0\0\0\0\0\0\21\0\0\0\0\0\0\0\0\0\0\0\25\0\0\0\3757B@\335\350\344\34C\27\122" ... {52, 76, reply, 0, 316, 396, 1532, 0} "\2x>\341\1\0\0\0\210k\362\371\0\0\0\0 \0\0\0\5\0\0\0\0\16W\200\0\0\0\0\200W\12\0\1\0\0\0\1\0\0\0\300\250|\201\377\377\377\0" )  ) == 0x0
 02623   396   NtClose  (340, ... ) == 0x0
 02624   396   NtClose  (356, ... ) == 0x0
 02625   396   NtCreateKey  (0x20019, {24, 48, 0x40, 0, 0,  (0x20019, {24, 48, 0x40, 0, 0, "System\CurrentControlSet\Services\Tcpip\Parameters"}, 0, "Class", 0, ... 356, 2, ) }, 0,  (0x20019, {24, 48, 0x40, 0, 0, "System\CurrentControlSet\Services\Tcpip\Parameters"}, 0, "Class", 0, ... 356, 2, ) , 0, ... 356, 2, ) == 0x0
 02626   396   NtOpenKey  (0x20019, {24, 48, 0x40, 0, 0,  (0x20019, {24, 48, 0x40, 0, 0, "System\CurrentControlSet\Services\DnsCache\Parameters"}, ... 340, ) }, ... 340, ) == 0x0
 02627   396   NtOpenKey  (0x20019, {24, 48, 0x40, 0, 0,  (0x20019, {24, 48, 0x40, 0, 0, "Software\Policies\Microsoft\Windows NT\DnsClient"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02628   396   NtQueryValueKey  (356,  (356, "Hostname", Partial, 144, ... TitleIdx=0, Type=1, Data="M\0Y\0W\0O\0R\0L\0D\0\0\0"}, 28, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (356, "Hostname", Partial, 144, ... TitleIdx=0, Type=1, Data="M\0Y\0W\0O\0R\0L\0D\0\0\0"}, 28, ) }, 28, ) == 0x0
 02629   396   NtQueryValueKey  (356,  (356, "Hostname", Partial, 144, ... TitleIdx=0, Type=1, Data="M\0Y\0W\0O\0R\0L\0D\0\0\0"}, 28, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (356, "Hostname", Partial, 144, ... TitleIdx=0, Type=1, Data="M\0Y\0W\0O\0R\0L\0D\0\0\0"}, 28, ) }, 28, ) == 0x0
 02630   396   NtClose  (356, ... ) == 0x0
 02631   396   NtClose  (340, ... ) == 0x0
 02632   396   NtCreateEvent  (0x1f0003, 0x0, 1, 0, ... 340, ) == 0x0
 02633   396   NtConnectPort  ( ("\RPC Control\DNSResolver", {12, 2, 1, 1}, 0x0, 0x0, 1238616, 112, ... 356, 0x0, 0x0, 0x0, 112, ) , {12, 2, 1, 1}, 0x0, 0x0, 1238616, 112, ... 356, 0x0, 0x0, 0x0, 112, ) == 0x0
 02634   396   NtRequestWaitReplyPort  (356, {128, 152, new_msg, 0, 123948, 1310720, 1238380, 2012750850}  (356, {128, 152, new_msg, 0, 123948, 1310720, 1238380, 2012750850} "\0\354\22\0\2$\370w\370T\367w\1kwEVY\205D\237\200\364(\367\326\1)\2\0\0\0\1\0\0\0k\23\314w\4\0\0\0\20\344\314w\10P\25\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\1\0\4\0\350\352\25\0\250\354\25\0\0\0\0\0\10\0\0\0?\360\367w\221\337\314w\0\0\0\0\0\0\22\0X\347\22\0\0\0\0\0\263\26\365w\0\0\0\0\5\0\0\0\5\0\0\0" ... {128, 152, reply, 0, 316, 396, 1535, 0} "\7\354\22\0\2$\370w\370T\367w\1kwEVY\205D\237\200\364(\367\326\1)\2\0\0\0\1\0\0\0\0\0\0\0\4\0\0\0\20\344\314w\377\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\1\0\4\0\350\352\25\0\250\354\25\0\0\0\0\0\10\0\0\0?\360\367w\221\337\314w\0\0\0\0\0\0\22\0X\347\22\0\0\0\0\0\263\26\365w\0\0\0\0\5\0\0\0\5\0\0\0" )  ... {128, 152, reply, 0, 316, 396, 1535, 0}  (356, {128, 152, new_msg, 0, 123948, 1310720, 1238380, 2012750850} "\0\354\22\0\2$\370w\370T\367w\1kwEVY\205D\237\200\364(\367\326\1)\2\0\0\0\1\0\0\0k\23\314w\4\0\0\0\20\344\314w\10P\25\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\1\0\4\0\350\352\25\0\250\354\25\0\0\0\0\0\10\0\0\0?\360\367w\221\337\314w\0\0\0\0\0\0\22\0X\347\22\0\0\0\0\0\263\26\365w\0\0\0\0\5\0\0\0\5\0\0\0" ... {128, 152, reply, 0, 316, 396, 1535, 0} "\7\354\22\0\2$\370w\370T\367w\1kwEVY\205D\237\200\364(\367\326\1)\2\0\0\0\1\0\0\0\0\0\0\0\4\0\0\0\20\344\314w\377\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\1\0\4\0\350\352\25\0\250\354\25\0\0\0\0\0\10\0\0\0?\360\367w\221\337\314w\0\0\0\0\0\0\22\0X\347\22\0\0\0\0\0\263\26\365w\0\0\0\0\5\0\0\0\5\0\0\0" )  ) == 0x0
 02635   396   NtRequestWaitReplyPort  (356, {44, 68, new_msg, 0, 316, 396, 1532, 0}  (356, {44, 68, new_msg, 0, 316, 396, 1532, 0} "\1x\0\0A\2\4\0\210k\362\371\0\0\0\0 \0\0\0\5\0\0\0\377\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\1\0\0\0" ... {40, 64, reply, 0, 316, 396, 1536, 0} "\2x>\341\4\0\0\0\210k\362\371\0\0\0\0 \0\0\0\5\0\0\0\0\16W\200\0\0\0\0\324\1\0\0\240,\11\0" )  ... {40, 64, reply, 0, 316, 396, 1536, 0}  (356, {44, 68, new_msg, 0, 316, 396, 1532, 0} "\1x\0\0A\2\4\0\210k\362\371\0\0\0\0 \0\0\0\5\0\0\0\377\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\1\0\0\0" ... {40, 64, reply, 0, 316, 396, 1536, 0} "\2x>\341\4\0\0\0\210k\362\371\0\0\0\0 \0\0\0\5\0\0\0\0\16W\200\0\0\0\0\324\1\0\0\240,\11\0" )  ) == 0x0
 02636   396   NtRequestWaitReplyPort  (356, {64, 88, new_msg, 56, 0, 1, 0, 0}  (356, {64, 88, new_msg, 56, 0, 1, 0, 0} "\10\350\22\0@\0\314w\200\352\25\0 \350\22\0\210\350\22\0\0\267\362v\210\350\22\0\200\352\25\0\1\0\0\0@\243\25\0\324\1\0\0\324\1\0\0\240,\11\0\0\0\0\0\0\0\0\0\0\0\0\0" ... {64, 88, reply, 56, 316, 396, 1537, 0} "\10\350\22\0@\0\314w\200\352\25\0 \350\22\0\210\350\22\0\0\267\362v\210\350\22\0\200\352\25\0\1\0\0\0@\243\25\0\324\1\0\0\324\1\0\0\240,\11\0\0\0\0\0\0\0\0\0\0\0\0\0" )  ... {64, 88, reply, 56, 316, 396, 1537, 0}  (356, {64, 88, new_msg, 56, 0, 1, 0, 0} "\10\350\22\0@\0\314w\200\352\25\0 \350\22\0\210\350\22\0\0\267\362v\210\350\22\0\200\352\25\0\1\0\0\0@\243\25\0\324\1\0\0\324\1\0\0\240,\11\0\0\0\0\0\0\0\0\0\0\0\0\0" ... {64, 88, reply, 56, 316, 396, 1537, 0} "\10\350\22\0@\0\314w\200\352\25\0 \350\22\0\210\350\22\0\0\267\362v\210\350\22\0\200\352\25\0\1\0\0\0@\243\25\0\324\1\0\0\324\1\0\0\240,\11\0\0\0\0\0\0\0\0\0\0\0\0\0" )  ) == 0x0
 02637   396   NtClose  (340, ... ) == 0x0
 02638   396   NtClose  (356, ... ) == 0x0
 02639   396   NtCreateKey  (0x20019, {24, 48, 0x40, 0, 0,  (0x20019, {24, 48, 0x40, 0, 0, "System\CurrentControlSet\Services\Tcpip\Parameters"}, 0, "Class", 0, ... 356, 2, ) }, 0,  (0x20019, {24, 48, 0x40, 0, 0, "System\CurrentControlSet\Services\Tcpip\Parameters"}, 0, "Class", 0, ... 356, 2, ) , 0, ... 356, 2, ) == 0x0
 02640   396   NtOpenKey  (0x20019, {24, 48, 0x40, 0, 0,  (0x20019, {24, 48, 0x40, 0, 0, "System\CurrentControlSet\Services\DnsCache\Parameters"}, ... 340, ) }, ... 340, ) == 0x0
 02641   396   NtOpenKey  (0x20019, {24, 48, 0x40, 0, 0,  (0x20019, {24, 48, 0x40, 0, 0, "Software\Policies\Microsoft\Windows NT\DnsClient"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02642   396   NtQueryValueKey  (356,  (356, "Domain", Partial, 144, ... TitleIdx=0, Type=1, Data="\0\0"}, 14, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (356, "Domain", Partial, 144, ... TitleIdx=0, Type=1, Data="\0\0"}, 14, ) }, 14, ) == 0x0
 02643   396   NtQueryValueKey  (356,  (356, "Domain", Partial, 144, ... TitleIdx=0, Type=1, Data="\0\0"}, 14, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (356, "Domain", Partial, 144, ... TitleIdx=0, Type=1, Data="\0\0"}, 14, ) }, 14, ) == 0x0
 02644   396   NtClose  (356, ... ) == 0x0
 02645   396   NtClose  (340, ... ) == 0x0
 02646   396   NtOpenKey  (0x1, {24, 48, 0x40, 0, 0,  (0x1, {24, 48, 0x40, 0, 0, "System\CurrentControlSet\Services\Tcpip\Parameters"}, ... 340, ) }, ... 340, ) == 0x0
 02647   396   NtQueryValueKey  (340,  (340, "DnsNbtLookupOrder", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02648   396   NtClose  (340, ... ) == 0x0
 02649   396   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\System32\winrnr.dll"}, 1238160, ... ) }, 1238160, ... ) == 0x0
 02650   396   NtOpenFile  (0x100020, {24, 0, 0x40, 0, 0,  (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\System32\winrnr.dll"}, 5, 96, ... 340, {status=0x0, info=1}, ) }, 5, 96, ... 340, {status=0x0, info=1}, ) == 0x0
 02651   396   NtCreateSection  (0xe, 0x0, 0x0, 16, 134217728, 340, ... 356, ) == 0x0
 02652   396   NtClose  (340, ... ) == 0x0
 02653   396   NtMapViewOfSection  (356, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 16, ... (0xac0000), 0x0, 16384, ) == 0x0
 02654   396   NtClose  (356, ... ) == 0x0
 02655   396   NtUnmapViewOfSection  (-1, 0xac0000, ... ) == 0x0
 02656   396   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\System32\winrnr.dll"}, 1238476, ... ) }, 1238476, ... ) == 0x0
 02657   396   NtOpenFile  (0x100020, {24, 0, 0x40, 0, 0,  (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\System32\winrnr.dll"}, 5, 96, ... 356, {status=0x0, info=1}, ) }, 5, 96, ... 356, {status=0x0, info=1}, ) == 0x0
 02658   396   NtCreateSection  (0xf, 0x0, 0x0, 16, 16777216, 356, ... 340, ) == 0x0
 02659   396   NtQuerySection  (340, Image, 48, ... {section info, class 1, size 48}, 0x0, ) == 0x0
 02660   396   NtClose  (356, ... ) == 0x0
 02661   396   NtMapViewOfSection  (340, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x76fb0000), 0x0, 28672, ) == 0x0
 02662   396   NtClose  (340, ... ) == 0x0
 02663   396   NtOpenSection  (0xe, {24, 8, 0x40, 0, 0,  (0xe, {24, 8, 0x40, 0, 0, "WLDAP32.dll"}, ... 340, ) }, ... 340, ) == 0x0
 02664   396   NtMapViewOfSection  (340, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x76f60000), 0x0, 180224, ) == 0x0
 02665   396   NtClose  (340, ... ) == 0x0
 02666   396   NtCreateEvent  (0x1f0003, 0x0, 1, 0, ... 340, ) == 0x0
 02667   396   NtOpenKey  (0x20019, {24, 48, 0x40, 0, 0,  (0x20019, {24, 48, 0x40, 0, 0, "System\CurrentControlSet\Services\LDAP"}, ... 356, ) }, ... 356, ) == 0x0
 02668   396   NtQueryValueKey  (356,  (356, "LdapClientIntegrity", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (356, "LdapClientIntegrity", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) }, 16, ) == 0x0
 02669   396   NtClose  (356, ... ) == 0x0
 02670   396   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\System32\mswsock.dll"}, 1238160, ... ) }, 1238160, ... ) == 0x0
 02671   396   NtQuerySystemInformation  (Basic, 44, ... {Unknown=0,MaximumIncrement=156250,PhysicalPageSize=0x1000,NumberOfPhysicalPages=0xff7c,LowestPhysicalPage=0x1,HighestPhysicalPage=0xffff,AllocationGranularity=0x10000,LowestUserAddress=0x10000,HighestUserAddress=0x7ffeffff,ActiveProcessors=1,NumberProcessors=1,}, 0x0, ) == 0x0
 02672   396   NtAllocateVirtualMemory  (-1, 0, 0, 65536, 8192, 4, ... 11272192, 65536, ) == 0x0
 02673   396   NtAllocateVirtualMemory  (-1, 11272192, 0, 4096, 4096, 4, ... 11272192, 4096, ) == 0x0
 02674   396   NtAllocateVirtualMemory  (-1, 11276288, 0, 8192, 4096, 4, ... 11276288, 8192, ) == 0x0
 02675   396   NtCreateEvent  (0x1f0003, 0x0, 1, 0, ... 356, ) == 0x0
 02676   396   NtConnectPort  ( ("\RPC Control\DNSResolver", {12, 2, 1, 1}, 0x0, 0x0, 1238448, 112, ... 352, 0x0, 0x0, 0x0, 112, ) , {12, 2, 1, 1}, 0x0, 0x0, 1238448, 112, ... 352, 0x0, 0x0, 0x0, 112, ) == 0x0
 02677   396   NtRequestWaitReplyPort  (352, {128, 152, new_msg, 0, 123780, 1310720, 1238212, 2012750850}  (352, {128, 152, new_msg, 0, 123780, 1310720, 1238212, 2012750850} "\0\353\22\0\2$\370w\370T\367w\1kwEVY\205D\237\200\364(\367\326\1)\2\0\0\0\1\0\0\0k\23\314w\4\0\0\0\20\344\314w\10P\25\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\1\0\5\0\350\352\25\0\220\247\25\0\0\0\0\0\210\247\25\0\260\247\25\0 \251\25\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\230\4\24\0\0\0\0\01\0\0\0\5\0\0\0" ... {128, 152, reply, 0, 316, 396, 1540, 0} "\7\353\22\0\2$\370w\370T\367w\1kwEVY\205D\237\200\364(\367\326\1)\2\0\0\0\1\0\0\0\0\0\0\0\4\0\0\0\20\344\314w\377\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\1\0\5\0\350\352\25\0\220\247\25\0\0\0\0\0\210\247\25\0\260\247\25\0 \251\25\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\230\4\24\0\0\0\0\01\0\0\0\5\0\0\0" )  ... {128, 152, reply, 0, 316, 396, 1540, 0}  (352, {128, 152, new_msg, 0, 123780, 1310720, 1238212, 2012750850} "\0\353\22\0\2$\370w\370T\367w\1kwEVY\205D\237\200\364(\367\326\1)\2\0\0\0\1\0\0\0k\23\314w\4\0\0\0\20\344\314w\10P\25\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\1\0\5\0\350\352\25\0\220\247\25\0\0\0\0\0\210\247\25\0\260\247\25\0 \251\25\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\230\4\24\0\0\0\0\01\0\0\0\5\0\0\0" ... {128, 152, reply, 0, 316, 396, 1540, 0} "\7\353\22\0\2$\370w\370T\367w\1kwEVY\205D\237\200\364(\367\326\1)\2\0\0\0\1\0\0\0\0\0\0\0\4\0\0\0\20\344\314w\377\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\1\0\5\0\350\352\25\0\220\247\25\0\0\0\0\0\210\247\25\0\260\247\25\0 \251\25\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\230\4\24\0\0\0\0\01\0\0\0\5\0\0\0" )  ) == 0x0
 02678   396   NtRequestWaitReplyPort  (352, {64, 88, new_msg, 0, 316, 396, 1536, 0}  (352, {64, 88, new_msg, 0, 316, 396, 1536, 0} "\1x\0\0A\2\10\0\210k\362\371\0\0\0\0 \0\0\0\5\0\0\0\377\377\377\377\0\0\0\0\0\0\0\0\21\0\0\0\0\0\0\0\0\0\0\0\377\377\377\0\3757B@\335\350\344\34C\27\122" ... {52, 76, reply, 0, 316, 396, 1541, 0} "\2\240\372\177\1\00\300\0\0\0\0G\3\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\200]\12\0\1\0\0\0\1\0\0\0\300\250|\201\377\377\377\0" )  ... {52, 76, reply, 0, 316, 396, 1541, 0}  (352, {64, 88, new_msg, 0, 316, 396, 1536, 0} "\1x\0\0A\2\10\0\210k\362\371\0\0\0\0 \0\0\0\5\0\0\0\377\377\377\377\0\0\0\0\0\0\0\0\21\0\0\0\0\0\0\0\0\0\0\0\377\377\377\0\3757B@\335\350\344\34C\27\122" ... {52, 76, reply, 0, 316, 396, 1541, 0} "\2\240\372\177\1\00\300\0\0\0\0G\3\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\200]\12\0\1\0\0\0\1\0\0\0\300\250|\201\377\377\377\0" )  ) == 0x0
 02679   396   NtClose  (356, ... ) == 0x0
 02680   396   NtClose  (352, ... ) == 0x0
 02681   396   NtCreateKey  (0x20019, {24, 48, 0x40, 0, 0,  (0x20019, {24, 48, 0x40, 0, 0, "System\CurrentControlSet\Services\Tcpip\Parameters"}, 0, "Class", 0, ... 352, 2, ) }, 0,  (0x20019, {24, 48, 0x40, 0, 0, "System\CurrentControlSet\Services\Tcpip\Parameters"}, 0, "Class", 0, ... 352, 2, ) , 0, ... 352, 2, ) == 0x0
 02682   396   NtOpenKey  (0x20019, {24, 48, 0x40, 0, 0,  (0x20019, {24, 48, 0x40, 0, 0, "System\CurrentControlSet\Services\DnsCache\Parameters"}, ... 356, ) }, ... 356, ) == 0x0
 02683   396   NtOpenKey  (0x20019, {24, 48, 0x40, 0, 0,  (0x20019, {24, 48, 0x40, 0, 0, "Software\Policies\Microsoft\Windows NT\DnsClient"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02684   396   NtQueryValueKey  (352,  (352, "Hostname", Partial, 144, ... TitleIdx=0, Type=1, Data="M\0Y\0W\0O\0R\0L\0D\0\0\0"}, 28, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (352, "Hostname", Partial, 144, ... TitleIdx=0, Type=1, Data="M\0Y\0W\0O\0R\0L\0D\0\0\0"}, 28, ) }, 28, ) == 0x0
 02685   396   NtQueryValueKey  (352,  (352, "Hostname", Partial, 144, ... TitleIdx=0, Type=1, Data="M\0Y\0W\0O\0R\0L\0D\0\0\0"}, 28, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (352, "Hostname", Partial, 144, ... TitleIdx=0, Type=1, Data="M\0Y\0W\0O\0R\0L\0D\0\0\0"}, 28, ) }, 28, ) == 0x0
 02686   396   NtClose  (352, ... ) == 0x0
 02687   396   NtClose  (356, ... ) == 0x0
 02688   396   NtCreateKey  (0x20019, {24, 48, 0x40, 0, 0,  (0x20019, {24, 48, 0x40, 0, 0, "System\CurrentControlSet\Services\Tcpip\Parameters"}, 0, "Class", 0, ... 356, 2, ) }, 0,  (0x20019, {24, 48, 0x40, 0, 0, "System\CurrentControlSet\Services\Tcpip\Parameters"}, 0, "Class", 0, ... 356, 2, ) , 0, ... 356, 2, ) == 0x0
 02689   396   NtOpenKey  (0x20019, {24, 48, 0x40, 0, 0,  (0x20019, {24, 48, 0x40, 0, 0, "System\CurrentControlSet\Services\DnsCache\Parameters"}, ... 352, ) }, ... 352, ) == 0x0
 02690   396   NtOpenKey  (0x20019, {24, 48, 0x40, 0, 0,  (0x20019, {24, 48, 0x40, 0, 0, "Software\Policies\Microsoft\Windows NT\DnsClient"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02691   396   NtQueryValueKey  (356,  (356, "Domain", Partial, 144, ... TitleIdx=0, Type=1, Data="\0\0"}, 14, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (356, "Domain", Partial, 144, ... TitleIdx=0, Type=1, Data="\0\0"}, 14, ) }, 14, ) == 0x0
 02692   396   NtQueryValueKey  (356,  (356, "Domain", Partial, 144, ... TitleIdx=0, Type=1, Data="\0\0"}, 14, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (356, "Domain", Partial, 144, ... TitleIdx=0, Type=1, Data="\0\0"}, 14, ) }, 14, ) == 0x0
 02693   396   NtClose  (356, ... ) == 0x0
 02694   396   NtClose  (352, ... ) == 0x0
 02695   396   NtWaitForSingleObject  (80, 0, {0, 0}, ... ) == 0x102
 02696   396   NtCreateEvent  (0x1f0003, 0x0, 1, 0, ... 352, ) == 0x0
 02697   396   NtConnectPort  ( ("\RPC Control\DNSResolver", {12, 2, 1, 1}, 0x0, 0x0, 1238248, 112, ... 356, 0x0, 0x0, 0x0, 112, ) , {12, 2, 1, 1}, 0x0, 0x0, 1238248, 112, ... 356, 0x0, 0x0, 0x0, 112, ) == 0x0
 02698   396   NtRequestWaitReplyPort  (356, {128, 152, new_msg, 0, 123580, 1310720, 1238012, 2012750850}  (356, {128, 152, new_msg, 0, 123580, 1310720, 1238012, 2012750850} "\0\352\22\0\2$\370w\370T\367w\1kwEVY\205D\237\200\364(\367\326\1)\2\0\0\0\1\0\0\0k\23\314w\4\0\0\0\20\344\314w\10P\25\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\1\0\6\0\0\0\0\0\240\1\24\0\240\1\24\0l\347\22\0\230\255\25\00\252\25\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\20\0\0\0\0\0\0\0\5\0\0\0\5\0\0\0" ... {128, 152, reply, 0, 316, 396, 1544, 0} "\7\352\22\0\2$\370w\370T\367w\1kwEVY\205D\237\200\364(\367\326\1)\2\0\0\0\1\0\0\0\0\0\0\0\4\0\0\0\20\344\314w\377\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\1\0\6\0\0\0\0\0\240\1\24\0\240\1\24\0l\347\22\0\230\255\25\00\252\25\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\20\0\0\0\0\0\0\0\5\0\0\0\5\0\0\0" )  ... {128, 152, reply, 0, 316, 396, 1544, 0}  (356, {128, 152, new_msg, 0, 123580, 1310720, 1238012, 2012750850} "\0\352\22\0\2$\370w\370T\367w\1kwEVY\205D\237\200\364(\367\326\1)\2\0\0\0\1\0\0\0k\23\314w\4\0\0\0\20\344\314w\10P\25\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\1\0\6\0\0\0\0\0\240\1\24\0\240\1\24\0l\347\22\0\230\255\25\00\252\25\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\20\0\0\0\0\0\0\0\5\0\0\0\5\0\0\0" ... {128, 152, reply, 0, 316, 396, 1544, 0} "\7\352\22\0\2$\370w\370T\367w\1kwEVY\205D\237\200\364(\367\326\1)\2\0\0\0\1\0\0\0\0\0\0\0\4\0\0\0\20\344\314w\377\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\1\0\6\0\0\0\0\0\240\1\24\0\240\1\24\0l\347\22\0\230\255\25\00\252\25\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\20\0\0\0\0\0\0\0\5\0\0\0\5\0\0\0" )  ) == 0x0
 02699   396   NtRequestWaitReplyPort  (356, {64, 88, new_msg, 0, 316, 396, 1541, 0}  (356, {64, 88, new_msg, 0, 316, 396, 1541, 0} "\1\240\0\0A\2\10\0\0\0\0\0G\3\0\0\0\0\0\0\0\0\0\0\377\377\377\377\0\0\0\0\0\0\0\0\21\0\0\0\0\0\0\0\0\0\0\0\377\377\377\0\3757B@\335\350\344\34C\27\122" ... {52, 76, reply, 0, 316, 396, 1545, 0} "\2\240\372\177\1\00\300\0\0\0\0G\3\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\200]\12\0\1\0\0\0\1\0\0\0\300\250|\201\377\377\377\0" )  ... {52, 76, reply, 0, 316, 396, 1545, 0}  (356, {64, 88, new_msg, 0, 316, 396, 1541, 0} "\1\240\0\0A\2\10\0\0\0\0\0G\3\0\0\0\0\0\0\0\0\0\0\377\377\377\377\0\0\0\0\0\0\0\0\21\0\0\0\0\0\0\0\0\0\0\0\377\377\377\0\3757B@\335\350\344\34C\27\122" ... {52, 76, reply, 0, 316, 396, 1545, 0} "\2\240\372\177\1\00\300\0\0\0\0G\3\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\200]\12\0\1\0\0\0\1\0\0\0\300\250|\201\377\377\377\0" )  ) == 0x0
 02700   396   NtClose  (352, ... ) == 0x0
 02701   396   NtClose  (356, ... ) == 0x0
 02702   396   NtCreateKey  (0x20019, {24, 48, 0x40, 0, 0,  (0x20019, {24, 48, 0x40, 0, 0, "System\CurrentControlSet\Services\Tcpip\Parameters"}, 0, "Class", 0, ... 356, 2, ) }, 0,  (0x20019, {24, 48, 0x40, 0, 0, "System\CurrentControlSet\Services\Tcpip\Parameters"}, 0, "Class", 0, ... 356, 2, ) , 0, ... 356, 2, ) == 0x0
 02703   396   NtOpenKey  (0x20019, {24, 48, 0x40, 0, 0,  (0x20019, {24, 48, 0x40, 0, 0, "System\CurrentControlSet\Services\DnsCache\Parameters"}, ... 352, ) }, ... 352, ) == 0x0
 02704   396   NtOpenKey  (0x20019, {24, 48, 0x40, 0, 0,  (0x20019, {24, 48, 0x40, 0, 0, "Software\Policies\Microsoft\Windows NT\DnsClient"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02705   396   NtQueryValueKey  (356,  (356, "Hostname", Partial, 144, ... TitleIdx=0, Type=1, Data="M\0Y\0W\0O\0R\0L\0D\0\0\0"}, 28, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (356, "Hostname", Partial, 144, ... TitleIdx=0, Type=1, Data="M\0Y\0W\0O\0R\0L\0D\0\0\0"}, 28, ) }, 28, ) == 0x0
 02706   396   NtQueryValueKey  (356,  (356, "Hostname", Partial, 144, ... TitleIdx=0, Type=1, Data="M\0Y\0W\0O\0R\0L\0D\0\0\0"}, 28, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (356, "Hostname", Partial, 144, ... TitleIdx=0, Type=1, Data="M\0Y\0W\0O\0R\0L\0D\0\0\0"}, 28, ) }, 28, ) == 0x0
 02707   396   NtClose  (356, ... ) == 0x0
 02708   396   NtClose  (352, ... ) == 0x0
 02709   396   NtCreateKey  (0x20019, {24, 48, 0x40, 0, 0,  (0x20019, {24, 48, 0x40, 0, 0, "System\CurrentControlSet\Services\Tcpip\Parameters"}, 0, "Class", 0, ... 352, 2, ) }, 0,  (0x20019, {24, 48, 0x40, 0, 0, "System\CurrentControlSet\Services\Tcpip\Parameters"}, 0, "Class", 0, ... 352, 2, ) , 0, ... 352, 2, ) == 0x0
 02710   396   NtOpenKey  (0x20019, {24, 48, 0x40, 0, 0,  (0x20019, {24, 48, 0x40, 0, 0, "System\CurrentControlSet\Services\DnsCache\Parameters"}, ... 356, ) }, ... 356, ) == 0x0
 02711   396   NtOpenKey  (0x20019, {24, 48, 0x40, 0, 0,  (0x20019, {24, 48, 0x40, 0, 0, "Software\Policies\Microsoft\Windows NT\DnsClient"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02712   396   NtQueryValueKey  (352,  (352, "Domain", Partial, 144, ... TitleIdx=0, Type=1, Data="\0\0"}, 14, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (352, "Domain", Partial, 144, ... TitleIdx=0, Type=1, Data="\0\0"}, 14, ) }, 14, ) == 0x0
 02713   396   NtQueryValueKey  (352,  (352, "Domain", Partial, 144, ... TitleIdx=0, Type=1, Data="\0\0"}, 14, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (352, "Domain", Partial, 144, ... TitleIdx=0, Type=1, Data="\0\0"}, 14, ) }, 14, ) == 0x0
 02714   396   NtClose  (352, ... ) == 0x0
 02715   396   NtClose  (356, ... ) == 0x0
 02716   396   NtOpenKey  (0x2000000, {24, 48, 0x40, 0, 0,  (0x2000000, {24, 48, 0x40, 0, 0, "System\CurrentControlSet\Services\WinSock2\Parameters"}, ... 356, ) }, ... 356, ) == 0x0
 02717   396   NtQueryValueKey  (356,  (356, "WinSock_Registry_Version", Partial, 144, ... TitleIdx=0, Type=1, Data="2\0.\00\0\0\0"}, 20, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (356, "WinSock_Registry_Version", Partial, 144, ... TitleIdx=0, Type=1, Data="2\0.\00\0\0\0"}, 20, ) }, 20, ) == 0x0
 02718   396   NtQueryValueKey  (356,  (356, "WinSock_Registry_Version", Partial, 144, ... TitleIdx=0, Type=1, Data="2\0.\00\0\0\0"}, 20, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (356, "WinSock_Registry_Version", Partial, 144, ... TitleIdx=0, Type=1, Data="2\0.\00\0\0\0"}, 20, ) }, 20, ) == 0x0
 02719   396   NtQueryValueKey  (356,  (356, "AutodialDLL", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02720   396   NtClose  (356, ... ) == 0x0
 02721   396   NtOpenSection  (0xe, {24, 8, 0x40, 0, 0,  (0xe, {24, 8, 0x40, 0, 0, "rasadhlp.dll"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02722   396   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\u:\work\rasadhlp.dll"}, 1239152, ... ) }, 1239152, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02723   396   NtQueryAttributesFile  ({24, 12, 0x40, 0, 0,  ({24, 12, 0x40, 0, 0, "rasadhlp.dll"}, 1239152, ... ) }, 1239152, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02724   396   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\System32\rasadhlp.dll"}, 1239152, ... ) }, 1239152, ... ) == 0x0
 02725   396   NtOpenFile  (0x100020, {24, 0, 0x40, 0, 0,  (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\System32\rasadhlp.dll"}, 5, 96, ... 356, {status=0x0, info=1}, ) }, 5, 96, ... 356, {status=0x0, info=1}, ) == 0x0
 02726   396   NtCreateSection  (0xf, 0x0, 0x0, 16, 16777216, 356, ... 352, ) == 0x0
 02727   396   NtQuerySection  (352, Image, 48, ... {section info, class 1, size 48}, 0x0, ) == 0x0
 02728   396   NtClose  (356, ... ) == 0x0
 02729   396   NtMapViewOfSection  (352, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x76fc0000), 0x0, 20480, ) == 0x0
 02730   396   NtClose  (352, ... ) == 0x0
 02731   396   NtCreateFile  (0x3, {24, 0, 0x40, 0, 0,  (0x3, {24, 0, 0x40, 0, 0, "\Device\RasAcd"}, 0x0, 128, 3, 3, 0, 0, 0, ... 352, {status=0x0, info=0}, ) }, 0x0, 128, 3, 3, 0, 0, 0, ... 352, {status=0x0, info=0}, ) == 0x0
 02732   396   NtCreateEvent  (0x1f0003, 0x0, 1, 0, ... 356, ) == 0x0
 02733   396   NtDeviceIoControlFile  (352, 356, 0x0, 0x0, 0xf14014,  (352, 356, 0x0, 0x0, 0xf14014, "\3\0\0\0MYWORLD\0\20\0\0\0\0\360\375\177h\2\374v\1\0\0\0\270\351\22\0\34\355\22\0\34\355\22\0\2$\370w\310j\367w\377\377\377\377\364j\365w$P\374w`i\365w\0\0\0\0\10\0\25\300\0\0\0\0\10\6\24\0\2104$\0\254\36$\0\3205$\0\0\340\375\177\24\232\347w3\355\26\0(P\25\06P\25\04\355\25\0\3005$\0\30\0\26\2\350\352\22\0\350\352\22\0r\0a\0s\0a\0d\0h\0l\0p\0.\0d\0l\0l\0\0\0\0\04\355\25\0\377\377\0\0\1\0\0\0\330\357\25\0\260\251\25\0 \0\0\0\0\0\0\0\210\1\24\0\250\251\25\0\0\0\0\0\0\0\0\0\0\0\0\0\365<\245q(\355\25\0\24\355\25\0\2\0\0\0\20\0\0\0\0\0\0\0\0\0\0\0\20\0\0\0\20:\1\1\0\0\24\0\270\352\22\0\230\357\22\0\330\374\22\0\2$\370w\370T\367wa/\245q\2642\250q\0\0\0\0\0\0\0\0:/\245q\20:\25\0\250\354\25\0P\257\25\0h\257\25\0(P\25\06P\25\04\355\25\0\377\377\0\0\0\0\0\04\355\25\0\7\0\0\0(P\25\0\350\353\22\0\177;\245q\0\0\0\0\0\0\0\0(P\25\0\0\0\0\04\355\25\0\377\377\0\0\1\0\0\0\230\1\24\0\310\357\25\0\20\0\0\0\0\0\0\0\230\1\24\0\300\357\25\0\0\0\0\0\0\0\0\0\0\0\0\0\365<\245q(\355\25\0\24\355\25\0\4\0\0\0\20\0\0\0\0\0\0\0\0\0\0\0\20\0\0\0\240\25\1\1\0\0\24\0\200\353\22\0`\360\22\0\330\374\22\0\2$\370w\370T\367wa/\245q\2642\250q\0\0\0\0\0\0\0\0:/\245q\240\25\25\0\250\354\25\0P\257\25\0", 1552, 0, ... {status=0x0, info=0}, 0x0, ) , 1552, 0, ... {status=0x0, info=0}, 0x0, ) == 0x0
 02734   396   NtClose  (356, ... ) == 0x0
 02735   396   NtClose  (352, ... ) == 0x0
 02736   396   NtCreateKey  (0x2000000, {24, 60, 0x40, 0, 0,  (0x2000000, {24, 60, 0x40, 0, 0, "Software\cv3"}, 0, 0x0, 0, ... }, 0, 0x0, 0, ...
 02737   396   NtSetInformationFile  (-2147482732, -136575964, 8, EndOfFile, ... {status=0x0, info=0}, ) == 0x0
 02738   396   NtSetInformationFile  (-2147482732, -136576252, 8, EndOfFile, ... {status=0x0, info=0}, ) == 0x0
 02739   396   NtSetInformationFile  (-2147482732, -136576060, 8, EndOfFile, ... {status=0x0, info=0}, ) == 0x0
 02736   396   NtCreateKey  ... 352, 1, ) == 0x0
 02740   396   NtQueryValueKey  (352,  (352, "n", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02741   396   NtSetValueKey  (352,  (352, "n", 0, 4, "\1\0\0\0", 4, ... ) , 0, 4,  (352, "n", 0, 4, "\1\0\0\0", 4, ... ) , 4, ... ) == 0x0
 02742   396   NtClose  (352, ... ) == 0x0
 02743   396   NtCreateEvent  (0x1f0003, 0x0, 1, 1, ... 352, ) == 0x0
 02744   396   NtWaitForSingleObject  (352, 0, 0x0, ... ) == 0x0
 02745   396   NtClearEvent  (352, ... ) == 0x0
 02746   396   NtSetEvent  (352, ... 0x0, ) == 0x0
 02747   396   NtClearEvent  (188, ... ) == 0x0
 02748   396   NtSetEvent  (188, ... 0x0, ) == 0x0
 02749   396   NtWaitForSingleObject  (156, 0, 0x0, ... ) == 0x0
 02750   396   NtQueryInformationFile  (152, 1240908, 24, Standard, ... {status=0x0, info=24}, ) == 0x0
 02751   396   NtReleaseMutant  (156, ... 0x0, ) == 0x0
 02752   396   NtOpenKey  (0x20019, {24, 60, 0x40, 0, 0,  (0x20019, {24, 60, 0x40, 0, 0, "SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Http Filters\RPA"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02753   396   NtOpenKey  (0x20019, {24, 48, 0x40, 0, 0,  (0x20019, {24, 48, 0x40, 0, 0, "SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Http Filters\RPA"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02754   396   NtWaitForSingleObject  (200, 0, 0x0, ... ) == 0x0
 02755   396   NtWaitForSingleObject  (204, 0, 0x0, ... ) == 0x0
 02756   396   NtReleaseMutant  (204, ... 0x0, ) == 0x0
 02757   396   NtQueryValueKey  (108,  (108, "EnableAutodial", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (108, "EnableAutodial", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) }, 16, ) == 0x0
 02758   396   NtQueryValueKey  (108,  (108, "NoNetAutodial", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (108, "NoNetAutodial", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) }, 16, ) == 0x0
 02759   396   NtWaitForSingleObject  (156, 0, 0x0, ... ) == 0x0
 02760   396   NtQueryInformationFile  (152, 1241104, 24, Standard, ... {status=0x0, info=24}, ) == 0x0
 02761   396   NtReleaseMutant  (156, ... 0x0, ) == 0x0
 02762   396   NtReleaseMutant  (200, ... 0x0, ) == 0x0
 02763   396   NtOpenSection  (0xe, {24, 8, 0x40, 0, 0,  (0xe, {24, 8, 0x40, 0, 0, "urlmon.dll"}, ... 356, ) }, ... 356, ) == 0x0
 02764   396   NtMapViewOfSection  (356, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x760f0000), 0x0, 491520, ) == 0x0
 02765   396   NtClose  (356, ... ) == 0x0
 02766   396   NtQuerySystemInformation  (Basic, 44, ... {Unknown=0,MaximumIncrement=156250,PhysicalPageSize=0x1000,NumberOfPhysicalPages=0xff7c,LowestPhysicalPage=0x1,HighestPhysicalPage=0xffff,AllocationGranularity=0x10000,LowestUserAddress=0x10000,HighestUserAddress=0x7ffeffff,ActiveProcessors=1,NumberProcessors=1,}, 0x0, ) == 0x0
 02767   396   NtAllocateVirtualMemory  (-1, 0, 0, 65536, 8192, 4, ... 11337728, 65536, ) == 0x0
 02768   396   NtAllocateVirtualMemory  (-1, 11337728, 0, 4096, 4096, 4, ... 11337728, 4096, ) == 0x0
 02769   396   NtAllocateVirtualMemory  (-1, 11341824, 0, 8192, 4096, 4, ... 11341824, 8192, ) == 0x0
 02770   396   NtCreateMutant  (0x1f0001, {24, 52, 0x80, 0, 0,  (0x1f0001, {24, 52, 0x80, 0, 0, "ZonesCounterMutex"}, 0, ... 356, ) }, 0, ... 356, ) == 0x0
 02771   396   NtCreateMutant  (0x1f0001, {24, 52, 0x80, 0, 0,  (0x1f0001, {24, 52, 0x80, 0, 0, "ZonesCacheCounterMutex"}, 0, ... 360, ) }, 0, ... 360, ) == 0x0
 02772   396   NtQueryDefaultUILanguage  (1237128, ...
 02773   396   NtOpenThreadTokenEx  (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN
 02774   396   NtOpenProcessTokenEx  (-1, 0x20008, 512, ... -2147482040, ) == 0x0
 02775   396   NtQueryInformationToken  (-2147482040, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0
 02776   396   NtClose  (-2147482040, ... ) == 0x0
 02777   396   NtOpenKey  (0x2000000, {24, 0, 0x640, 0, 0,  (0x2000000, {24, 0, 0x640, 0, 0, "\REGISTRY\USER\S-1-5-21-1078081533-484763869-839522115-1003"}, ... -2147482040, ) }, ... -2147482040, ) == 0x0
 02778   396   NtOpenKey  (0x80000000, {24, 0, 0x240, 0, 0,  (0x80000000, {24, 0, 0x240, 0, 0, "\Registry\Machine\System\CurrentControlSet\Control\Nls\MUILanguages"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02779   396   NtOpenKey  (0x80000000, {24, -2147482040, 0x640, 0, 0,  (0x80000000, {24, -2147482040, 0x640, 0, 0, "Control Panel\Desktop"}, ... -2147482044, ) }, ... -2147482044, ) == 0x0
 02780   396   NtQueryValueKey  (-2147482044,  (-2147482044, "MultiUILanguageId", Partial, 256, ... ) , Partial, 256, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02781   396   NtClose  (-2147482044, ... ) == 0x0
 02782   396   NtClose  (-2147482040, ... ) == 0x0
 02772   396   NtQueryDefaultUILanguage  ... ) == 0x0
 02783   396   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\System\CurrentControlSet\Control\Nls\MUILanguages"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02784   396   NtOpenFile  (0x1200a9, {24, 0, 0x40, 0, 0,  (0x1200a9, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\urlmon.dll"}, 1, 96, ... 364, {status=0x0, info=1}, ) }, 1, 96, ... 364, {status=0x0, info=1}, ) == 0x0
 02785   396   NtCreateSection  (0x4, 0x0, 0x0, 2, 134217728, 364, ... 368, ) == 0x0
 02786   396   NtMapViewOfSection  (368, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 2, ... (0xaf0000), 0x0, 454656, ) == 0x0
 02787   396   NtOpenFile  (0x1200a9, {24, 0, 0x40, 0, 0,  (0x1200a9, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\urlmon.dll.123.Manifest"}, 1, 96, ... ) }, 1, 96, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02788   396   NtQueryDefaultLocale  (1, 1235164, ... ) == 0x0
 02789   396   NtOpenFile  (0x1200a9, {24, 0, 0x40, 0, 0,  (0x1200a9, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\urlmon.dll.123.Config"}, 1, 96, ... ) }, 1, 96, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02790   396   NtRequestWaitReplyPort  (24, {128, 156, new_msg, 0, 1236020, 1, 96, 0}  (24, {128, 156, new_msg, 0, 1236020, 1, 96, 0} "\210\6\35\1\33\0\1\0\0\0\0\0\1\337\22\0\1\0\0\0\0\0\11\4\1\1\1\0<\0@\0\250\6\35\1l\1\0\0\377\377\377\377\0\0\0\0\240\302\264\0\0\0\0\0\303\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0(\0,\0\350\6\35\1\0\0\0\0\0\0\0\04\343\22\0\0\0\0\0" ... {128, 156, reply, 0, 316, 396, 1547, 0} "(\350\26\0\33\0\1\0\0\0\0\0\1\337\22\0\1\0\0\0\0\0\11\4\1\1\1\0<\0@\0\250\6\35\1l\1\0\0\377\377\377\377\0\0\0\0\240\302\264\0\0\0\0\0\303\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0(\0,\0\350\6\35\1\0\0\0\0\0\0\0\04\343\22\0\0\0\0\0" )  ... {128, 156, reply, 0, 316, 396, 1547, 0}  (24, {128, 156, new_msg, 0, 1236020, 1, 96, 0} "\210\6\35\1\33\0\1\0\0\0\0\0\1\337\22\0\1\0\0\0\0\0\11\4\1\1\1\0<\0@\0\250\6\35\1l\1\0\0\377\377\377\377\0\0\0\0\240\302\264\0\0\0\0\0\303\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0(\0,\0\350\6\35\1\0\0\0\0\0\0\0\04\343\22\0\0\0\0\0" ... {128, 156, reply, 0, 316, 396, 1547, 0} "(\350\26\0\33\0\1\0\0\0\0\0\1\337\22\0\1\0\0\0\0\0\11\4\1\1\1\0<\0@\0\250\6\35\1l\1\0\0\377\377\377\377\0\0\0\0\240\302\264\0\0\0\0\0\303\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0(\0,\0\350\6\35\1\0\0\0\0\0\0\0\04\343\22\0\0\0\0\0" )  ) == 0x0
 02791   396   NtClose  (364, ... ) == 0x0
 02792   396   NtClose  (368, ... ) == 0x0
 02793   396   NtUnmapViewOfSection  (-1, 0xaf0000, ... ) == 0x0
 02794   396   NtUnmapViewOfSection  (-1, 0x12e334, ... ) == STATUS_NOT_MAPPED_VIEW
 02795   396   NtQueryDebugFilterState  (53, 2, ... ) == 0x0
 02796   396   NtOpenKey  (0x8, {24, 0, 0x40, 0, 0,  (0x8, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows\CurrentVersion\SideBySide\AssemblyStorageRoots"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02797   396   NtQueryDebugFilterState  (53, 2, ... ) == 0x0
 02798   396   NtQueryDebugFilterState  (53, 2, ... ) == 0x0
 02799   396   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\u:\work\packed.exe.Local\"}, 1233704, ... ) }, 1233704, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02800   396   NtQueryDebugFilterState  (53, 2, ... ) == 0x0
 02801   396   NtQueryDebugFilterState  (53, 2, ... ) == 0x0
 02802   396   NtQueryDebugFilterState  (53, 2, ... ) == 0x0
 02803   396   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.0.0_x-ww_1382d70a"}, 1234296, ... ) }, 1234296, ... ) == 0x0
 02804   396   NtOpenFile  (0x100020, {24, 0, 0x40, 0, 0,  (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.0.0_x-ww_1382d70a"}, 3, 33, ... 368, {status=0x0, info=1}, ) }, 3, 33, ... 368, {status=0x0, info=1}, ) == 0x0
 02805   396   NtQueryDebugFilterState  (53, 2, ... ) == 0x0
 02806   396   NtQuerySystemInformation  (Basic, 44, ... {Unknown=0,MaximumIncrement=156250,PhysicalPageSize=0x1000,NumberOfPhysicalPages=0xff7c,LowestPhysicalPage=0x1,HighestPhysicalPage=0xffff,AllocationGranularity=0x10000,LowestUserAddress=0x10000,HighestUserAddress=0x7ffeffff,ActiveProcessors=1,NumberProcessors=1,}, 0x0, ) == 0x0
 02807   396   NtQuerySystemInformation  (Processor, 12, ... {system info, class 1, size 12}, 0x0, ) == 0x0
 02808   396   NtOpenKey  (0x1, {24, 48, 0x40, 0, 0,  (0x1, {24, 48, 0x40, 0, 0, "Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02809   396   NtQueryKey  (90, Name, 384, ... {Name= (90, Name, 384, ... {Name="\REGISTRY\USER\S-1-5-21-1078081533-484763869-839522115-1003_CLASSESi"}, 138, ) }, 138, ) == 0x0
 02810   396   NtOpenKey  (0x2000000, {24, 90, 0x40, 0, 0,  (0x2000000, {24, 90, 0x40, 0, 0, "PROTOCOLS\Name-Space Handler\"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02811   396   NtOpenKey  (0x2000000, {24, 0, 0x40, 0, 0,  (0x2000000, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Classes\PROTOCOLS\Name-Space Handler"}, ... 364, ) }, ... 364, ) == 0x0
 02812   396   NtQueryKey  (366, Name, 392, ... {Name= (366, Name, 392, ... {Name="\REGISTRY\MACHINE\SOFTWARE\Classes\PROTOCOLS\Name-Space HandlerS"}, 130, ) }, 130, ) == 0x0
 02813   396   NtOpenThreadTokenEx  (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN
 02814   396   NtOpenProcessTokenEx  (-1, 0x20008, 512, ... 372, ) == 0x0
 02815   396   NtQueryInformationToken  (372, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0
 02816   396   NtClose  (372, ... ) == 0x0
 02817   396   NtOpenKey  (0x2000000, {24, 0, 0x40, 0, 0,  (0x2000000, {24, 0, 0x40, 0, 0, "\REGISTRY\USER\S-1-5-21-1078081533-484763869-839522115-1003_Classes\PROTOCOLS\Name-Space Handler"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02818   396   NtEnumerateKey  (366, 0, Node, 288, ... {LastWrite={0x5d796f8c,0x1c73999}, TitleIdx=0, Name= (366, 0, Node, 288, ... {LastWrite={0x5d796f8c,0x1c73999}, TitleIdx=0, Name="mk", Class=""}, 28, ) , Class=""}, 28, ) == 0x0
 02819   396   NtEnumerateKey  (366, 1, Node, 288, ... ) == STATUS_NO_MORE_ENTRIES
 02820   396   NtClose  (366, ... ) == 0x0
 02821   396   NtOpenKey  (0x1, {24, 60, 0x40, 0, 0,  (0x1, {24, 60, 0x40, 0, 0, "SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02822   396   NtOpenKey  (0x1, {24, 60, 0x40, 0, 0,  (0x1, {24, 60, 0x40, 0, 0, "SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02823   396   NtOpenKey  (0x20019, {24, 60, 0x40, 0, 0,  (0x20019, {24, 60, 0x40, 0, 0, "Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\"}, ... 364, ) }, ... 364, ) == 0x0
 02824   396   NtOpenKey  (0x20019, {24, 364, 0x40, 0, 0,  (0x20019, {24, 364, 0x40, 0, 0, "Ranges\"}, ... 372, ) }, ... 372, ) == 0x0
 02825   396   NtQueryKey  (372, 4, 176, ... {key info, class 4, size 40}, 40, ) == 0x0
 02826   396   NtClose  (372, ... ) == 0x0
 02827   396   NtRequestWaitReplyPort  (144, {28, 52, new_msg, 0, 0, 0, 0, 0}  (144, {28, 52, new_msg, 0, 0, 0, 0, 0} "\37\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\1\0\13\30\10\2\220\36\24\0" ... {176, 200, reply, 0, 316, 396, 1548, 0} "\37\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\1\0\20\0\10\2\220\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0S\0R\0I\0-\0u\0s\0e\0r\0" )  ... {176, 200, reply, 0, 316, 396, 1548, 0}  (144, {28, 52, new_msg, 0, 0, 0, 0, 0} "\37\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\1\0\13\30\10\2\220\36\24\0" ... {176, 200, reply, 0, 316, 396, 1548, 0} "\37\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\1\0\20\0\10\2\220\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0S\0R\0I\0-\0u\0s\0e\0r\0" )  ) == 0x0
 02828   396   NtCreateSection  (0xf0007, {24, 52, 0x80, 0, 0,  (0xf0007, {24, 52, 0x80, 0, 0, "UrlZonesSM_SRI-user"}, {8, 0}, 4, 134217728, 0, ... 372, ) }, {8, 0}, 4, 134217728, 0, ... 372, ) == 0x0
 02829   396   NtMapViewOfSection  (372, -1, (0x0), 0, 0, {0, 0}, 0, 1, 0, 4, ... (0xaf0000), {0, 0}, 4096, ) == 0x0
 02830   396   NtOpenKey  (0x20019, {24, 48, 0x40, 0, 0,  (0x20019, {24, 48, 0x40, 0, 0, "System\Setup"}, ... 376, ) }, ... 376, ) == 0x0
 02831   396   NtQueryValueKey  (376,  (376, "SystemSetupInProgress", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (376, "SystemSetupInProgress", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) }, 16, ) == 0x0
 02832   396   NtClose  (376, ... ) == 0x0
 02833   396   NtOpenKey  (0x20019, {24, 60, 0x40, 0, 0,  (0x20019, {24, 60, 0x40, 0, 0, "Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\"}, ... 376, ) }, ... 376, ) == 0x0
 02834   396   NtOpenKey  (0x20019, {24, 376, 0x40, 0, 0,  (0x20019, {24, 376, 0x40, 0, 0, "0"}, ... 380, ) }, ... 380, ) == 0x0
 02835   396   NtClose  (380, ... ) == 0x0
 02836   396   NtOpenKey  (0x20019, {24, 376, 0x40, 0, 0,  (0x20019, {24, 376, 0x40, 0, 0, "1"}, ... 380, ) }, ... 380, ) == 0x0
 02837   396   NtClose  (380, ... ) == 0x0
 02838   396   NtOpenKey  (0x20019, {24, 376, 0x40, 0, 0,  (0x20019, {24, 376, 0x40, 0, 0, "2"}, ... 380, ) }, ... 380, ) == 0x0
 02839   396   NtClose  (380, ... ) == 0x0
 02840   396   NtOpenKey  (0x20019, {24, 376, 0x40, 0, 0,  (0x20019, {24, 376, 0x40, 0, 0, "3"}, ... 380, ) }, ... 380, ) == 0x0
 02841   396   NtClose  (380, ... ) == 0x0
 02842   396   NtOpenKey  (0x20019, {24, 376, 0x40, 0, 0,  (0x20019, {24, 376, 0x40, 0, 0, "4"}, ... 380, ) }, ... 380, ) == 0x0
 02843   396   NtClose  (380, ... ) == 0x0
 02844   396   NtClose  (376, ... ) == 0x0
 02845   396   NtOpenKey  (0x20019, {24, 60, 0x40, 0, 0,  (0x20019, {24, 60, 0x40, 0, 0, "Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\"}, ... 376, ) }, ... 376, ) == 0x0
 02846   396   NtEnumerateKey  (376, 0, Basic, 288, ... {LastWrite={0x8db90da8,0x1c7399c}, TitleIdx=0, Name= (376, 0, Basic, 288, ... {LastWrite={0x8db90da8,0x1c7399c}, TitleIdx=0, Name="0"}, 18, ) }, 18, ) == 0x0
 02847   396   NtOpenKey  (0x20019, {24, 60, 0x40, 0, 0,  (0x20019, {24, 60, 0x40, 0, 0, "Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0"}, ... 380, ) }, ... 380, ) == 0x0
 02848   396   NtQueryValueKey  (380,  (380, "Flags", Partial, 144, ... TitleIdx=0, Type=4, Data="!\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (380, "Flags", Partial, 144, ... TitleIdx=0, Type=4, Data="!\0\0\0"}, 16, ) }, 16, ) == 0x0
 02849   396   NtClose  (380, ... ) == 0x0
 02850   396   NtEnumerateKey  (376, 1, Basic, 288, ... {LastWrite={0x8f7e0c74,0x1c7399c}, TitleIdx=0, Name= (376, 1, Basic, 288, ... {LastWrite={0x8f7e0c74,0x1c7399c}, TitleIdx=0, Name="1"}, 18, ) }, 18, ) == 0x0
 02851   396   NtOpenKey  (0x20019, {24, 60, 0x40, 0, 0,  (0x20019, {24, 60, 0x40, 0, 0, "Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1"}, ... 380, ) }, ... 380, ) == 0x0
 02852   396   NtQueryValueKey  (380,  (380, "Flags", Partial, 144, ... TitleIdx=0, Type=4, Data="\333\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (380, "Flags", Partial, 144, ... TitleIdx=0, Type=4, Data="\333\0\0\0"}, 16, ) }, 16, ) == 0x0
 02853   396   NtWaitForSingleObject  (356, 0, 0x0, ... ) == 0x0
 02854   396   NtReleaseMutant  (356, ... 0x0, ) == 0x0
 02855   396   NtOpenKey  (0x2001f, {24, 60, 0x40, 0, 0,  (0x2001f, {24, 60, 0x40, 0, 0, "Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\"}, ... 384, ) }, ... 384, ) == 0x0
 02856   396   NtSetValueKey  (384,  (384, "ProxyBypass", 0, 4, "\1\0\0\0", 4, ... ) , 0, 4,  (384, "ProxyBypass", 0, 4, "\1\0\0\0", 4, ... ) , 4, ... ) == 0x0
 02857   396   NtSetValueKey  (384,  (384, "IntranetName", 0, 4, "\1\0\0\0", 4, ... ) , 0, 4,  (384, "IntranetName", 0, 4, "\1\0\0\0", 4, ... ) , 4, ... ) == 0x0
 02858   396   NtSetValueKey  (384,  (384, "UNCAsIntranet", 0, 4, "\1\0\0\0", 4, ... ) , 0, 4,  (384, "UNCAsIntranet", 0, 4, "\1\0\0\0", 4, ... ) , 4, ... ) == 0x0
 02859   396   NtClose  (384, ... ) == 0x0
 02860   396   NtClose  (380, ... ) == 0x0
 02861   396   NtEnumerateKey  (376, 2, Basic, 288, ... {LastWrite={0x8f7e0c74,0x1c7399c}, TitleIdx=0, Name= (376, 2, Basic, 288, ... {LastWrite={0x8f7e0c74,0x1c7399c}, TitleIdx=0, Name="2I"}, 18, ) }, 18, ) == 0x0
 02862   396   NtOpenKey  (0x20019, {24, 60, 0x40, 0, 0,  (0x20019, {24, 60, 0x40, 0, 0, "Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2"}, ... 380, ) }, ... 380, ) == 0x0
 02863   396   NtQueryValueKey  (380,  (380, "Flags", Partial, 144, ... TitleIdx=0, Type=4, Data="G\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (380, "Flags", Partial, 144, ... TitleIdx=0, Type=4, Data="G\0\0\0"}, 16, ) }, 16, ) == 0x0
 02864   396   NtClose  (380, ... ) == 0x0
 02865   396   NtEnumerateKey  (376, 3, Basic, 288, ... {LastWrite={0x8f7e0c74,0x1c7399c}, TitleIdx=0, Name= (376, 3, Basic, 288, ... {LastWrite={0x8f7e0c74,0x1c7399c}, TitleIdx=0, Name="3"}, 18, ) }, 18, ) == 0x0
 02866   396   NtOpenKey  (0x20019, {24, 60, 0x40, 0, 0,  (0x20019, {24, 60, 0x40, 0, 0, "Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3"}, ... 380, ) }, ... 380, ) == 0x0
 02867   396   NtQueryValueKey  (380,  (380, "Flags", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (380, "Flags", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) }, 16, ) == 0x0
 02868   396   NtClose  (380, ... ) == 0x0
 02869   396   NtEnumerateKey  (376, 4, Basic, 288, ... {LastWrite={0x8f7e0c74,0x1c7399c}, TitleIdx=0, Name= (376, 4, Basic, 288, ... {LastWrite={0x8f7e0c74,0x1c7399c}, TitleIdx=0, Name="4"}, 18, ) }, 18, ) == 0x0
 02870   396   NtOpenKey  (0x20019, {24, 60, 0x40, 0, 0,  (0x20019, {24, 60, 0x40, 0, 0, "Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4"}, ... 380, ) }, ... 380, ) == 0x0
 02871   396   NtQueryValueKey  (380,  (380, "Flags", Partial, 144, ... TitleIdx=0, Type=4, Data="\3\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (380, "Flags", Partial, 144, ... TitleIdx=0, Type=4, Data="\3\0\0\0"}, 16, ) }, 16, ) == 0x0
 02872   396   NtClose  (380, ... ) == 0x0
 02873   396   NtEnumerateKey  (376, 5, Basic, 288, ... ) == STATUS_NO_MORE_ENTRIES
 02874   396   NtClose  (376, ... ) == 0x0
 02875   396   NtWaitForSingleObject  (356, 0, 0x0, ... ) == 0x0
 02876   396   NtReleaseMutant  (356, ... 0x0, ) == 0x0
 02877   396   NtOpenKey  (0x20019, {24, 364, 0x40, 0, 0,  (0x20019, {24, 364, 0x40, 0, 0, "Domains\bashchelik.com"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02878   396   NtOpenKey  (0x20019, {24, 48, 0x40, 0, 0,  (0x20019, {24, 48, 0x40, 0, 0, "Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\bashchelik.com"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02879   396   NtQueryValueKey  (364,  (364, "IntranetName", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (364, "IntranetName", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) }, 16, ) == 0x0
 02880   396   NtQueryValueKey  (364,  (364, "ProxyBypass", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (364, "ProxyBypass", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) }, 16, ) == 0x0
 02881   396   NtClearEvent  (188, ... ) == 0x0
 02882   396   NtSetEvent  (188, ... 0x0, ) == 0x0
 02883   396   NtOpenKey  (0x20019, {24, 364, 0x40, 0, 0,  (0x20019, {24, 364, 0x40, 0, 0, "ProtocolDefaults\"}, ... 376, ) }, ... 376, ) == 0x0
 02884   396   NtQueryValueKey  (376,  (376, "http", Partial, 144, ... TitleIdx=0, Type=4, Data="\3\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (376, "http", Partial, 144, ... TitleIdx=0, Type=4, Data="\3\0\0\0"}, 16, ) }, 16, ) == 0x0
 02885   396   NtClose  (376, ... ) == 0x0
 02886   396   NtWaitForSingleObject  (356, 0, 0x0, ... ) == 0x0
 02887   396   NtReleaseMutant  (356, ... 0x0, ) == 0x0
 02888   396   NtWaitForSingleObject  (356, 0, 0x0, ... ) == 0x0
 02889   396   NtReleaseMutant  (356, ... 0x0, ) == 0x0
 02890   396   NtWaitForSingleObject  (360, 0, 0x0, ... ) == 0x0
 02891   396   NtReleaseMutant  (360, ... 0x0, ) == 0x0
 02892   396   NtOpenKey  (0x20019, {24, 60, 0x40, 0, 0,  (0x20019, {24, 60, 0x40, 0, 0, "Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3"}, ... 376, ) }, ... 376, ) == 0x0
 02893   396   NtQueryValueKey  (376,  (376, "1A10", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (376, "1A10", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) }, 16, ) == 0x0
 02894   396   NtWaitForSingleObject  (360, 0, 0x0, ... ) == 0x0
 02895   396   NtReleaseMutant  (360, ... 0x0, ) == 0x0
 02896   396   NtWaitForSingleObject  (360, 0, 0x0, ... ) == 0x0
 02897   396   NtReleaseMutant  (360, ... 0x0, ) == 0x0
 02898   396   NtClose  (376, ... ) == 0x0
 02899   396   NtWaitForSingleObject  (156, 0, 0x0, ... ) == 0x0
 02900   396   NtQueryInformationFile  (152, 1241356, 24, Standard, ... {status=0x0, info=24}, ) == 0x0
 02901   396   NtReleaseMutant  (156, ... 0x0, ) == 0x0
 02902   396   NtWaitForSingleObject  (156, 0, 0x0, ... ) == 0x0
 02903   396   NtQueryInformationFile  (152, 1238972, 24, Standard, ... {status=0x0, info=24}, ) == 0x0
 02904   396   NtReleaseMutant  (156, ... 0x0, ) == 0x0
 02905   396   NtWaitForSingleObject  (164, 0, 0x0, ... ) == 0x0
 02906   396   NtQueryInformationFile  (172, 1240936, 24, Standard, ... {status=0x0, info=24}, ) == 0x0
 02907   396   NtReleaseMutant  (164, ... 0x0, ) == 0x0
 02908   396   NtWaitForSingleObject  (164, 0, 0x0, ... ) == 0x0
 02909   396   NtQueryInformationFile  (172, 1240896, 24, Standard, ... {status=0x0, info=24}, ) == 0x0
 02910   396   NtReleaseMutant  (164, ... 0x0, ) == 0x0
 02911   396   NtWaitForSingleObject  (80, 0, {0, 0}, ... ) == 0x102
 02912   396   NtCreateEvent  (0x1f0003, 0x0, 1, 0, ... 376, ) == 0x0
 02913   396   NtConnectPort  ( ("\RPC Control\DNSResolver", {12, 2, 1, 1}, 0x0, 0x0, 1237812, 112, ... 380, 0x0, 0x0, 0x0, 112, ) , {12, 2, 1, 1}, 0x0, 0x0, 1237812, 112, ... 380, 0x0, 0x0, 0x0, 112, ) == 0x0
 02914   396   NtRequestWaitReplyPort  (380, {128, 152, new_msg, 0, 1310720, 123144, 1310720, 1237576}  (380, {128, 152, new_msg, 0, 1310720, 123144, 1310720, 1237576} "\0$\370w\370\350\22\0\2$\370w\1kwEVY\205D\237\200\364(\367\326\1)\2\0\0\0\1\0\0\0\0\312\25\0\4\0\0\0\0\312\25\0\20\344\314w\0\312\25\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\1\0\7\0\0\0\0\0H\337\25\0\0\0\0\0\250\311\25\0h\337\25\0\200\311\25\0\0\0\0\0\0\0\0\0\0\0\0\0\250\311\25\0\0\0\0\0\0\0\0\0\0\0\0\0" ... {128, 152, reply, 0, 316, 396, 1550, 0} "\7$\370w\370\350\22\0\2$\370w\1kwEVY\205D\237\200\364(\367\326\1)\2\0\0\0\1\0\0\0\0\0\0\0\4\0\0\0\0\312\25\0\377\377\377\377\0\312\25\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\1\0\7\0\0\0\0\0H\337\25\0\0\0\0\0\250\311\25\0h\337\25\0\200\311\25\0\0\0\0\0\0\0\0\0\0\0\0\0\250\311\25\0\0\0\0\0\0\0\0\0\0\0\0\0" )  ... {128, 152, reply, 0, 316, 396, 1550, 0}  (380, {128, 152, new_msg, 0, 1310720, 123144, 1310720, 1237576} "\0$\370w\370\350\22\0\2$\370w\1kwEVY\205D\237\200\364(\367\326\1)\2\0\0\0\1\0\0\0\0\312\25\0\4\0\0\0\0\312\25\0\20\344\314w\0\312\25\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\1\0\7\0\0\0\0\0H\337\25\0\0\0\0\0\250\311\25\0h\337\25\0\200\311\25\0\0\0\0\0\0\0\0\0\0\0\0\0\250\311\25\0\0\0\0\0\0\0\0\0\0\0\0\0" ... {128, 152, reply, 0, 316, 396, 1550, 0} "\7$\370w\370\350\22\0\2$\370w\1kwEVY\205D\237\200\364(\367\326\1)\2\0\0\0\1\0\0\0\0\0\0\0\4\0\0\0\0\312\25\0\377\377\377\377\0\312\25\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\1\0\7\0\0\0\0\0H\337\25\0\0\0\0\0\250\311\25\0h\337\25\0\200\311\25\0\0\0\0\0\0\0\0\0\0\0\0\0\250\311\25\0\0\0\0\0\0\0\0\0\0\0\0\0" )  ) == 0x0
 02915   396   NtRequestWaitReplyPort  (380, {64, 88, new_msg, 0, 316, 396, 1545, 0}  (380, {64, 88, new_msg, 0, 316, 396, 1545, 0} "\1\240\0\0A\2\10\0\0\0\0\0G\3\0\0\0\0\0\0\0\0\0\0\377\377\377\377\0\0\0\0\0\0\0\0\21\0\0\0\0\0\0\0\0\0\0\0\377\377\377\0\3757B@\335\350\344\34C\27\122" ... {52, 76, reply, 0, 316, 396, 1551, 0} "\2\240\372\177\1\00\300\0\0\0\0G\3\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\200]\12\0\1\0\0\0\1\0\0\0\300\250|\201\377\377\377\0" )  ... {52, 76, reply, 0, 316, 396, 1551, 0}  (380, {64, 88, new_msg, 0, 316, 396, 1545, 0} "\1\240\0\0A\2\10\0\0\0\0\0G\3\0\0\0\0\0\0\0\0\0\0\377\377\377\377\0\0\0\0\0\0\0\0\21\0\0\0\0\0\0\0\0\0\0\0\377\377\377\0\3757B@\335\350\344\34C\27\122" ... {52, 76, reply, 0, 316, 396, 1551, 0} "\2\240\372\177\1\00\300\0\0\0\0G\3\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\200]\12\0\1\0\0\0\1\0\0\0\300\250|\201\377\377\377\0" )  ) == 0x0
 02916   396   NtClose  (376, ... ) == 0x0
 02917   396   NtClose  (380, ... ) == 0x0
 02918   396   NtCreateKey  (0x20019, {24, 48, 0x40, 0, 0,  (0x20019, {24, 48, 0x40, 0, 0, "System\CurrentControlSet\Services\Tcpip\Parameters"}, 0, "Class", 0, ... 380, 2, ) }, 0,  (0x20019, {24, 48, 0x40, 0, 0, "System\CurrentControlSet\Services\Tcpip\Parameters"}, 0, "Class", 0, ... 380, 2, ) , 0, ... 380, 2, ) == 0x0
 02919   396   NtOpenKey  (0x20019, {24, 48, 0x40, 0, 0,  (0x20019, {24, 48, 0x40, 0, 0, "System\CurrentControlSet\Services\DnsCache\Parameters"}, ... 376, ) }, ... 376, ) == 0x0
 02920   396   NtOpenKey  (0x20019, {24, 48, 0x40, 0, 0,  (0x20019, {24, 48, 0x40, 0, 0, "Software\Policies\Microsoft\Windows NT\DnsClient"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02921   396   NtQueryValueKey  (380,  (380, "Hostname", Partial, 144, ... TitleIdx=0, Type=1, Data="M\0Y\0W\0O\0R\0L\0D\0\0\0"}, 28, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (380, "Hostname", Partial, 144, ... TitleIdx=0, Type=1, Data="M\0Y\0W\0O\0R\0L\0D\0\0\0"}, 28, ) }, 28, ) == 0x0
 02922   396   NtQueryValueKey  (380,  (380, "Hostname", Partial, 144, ... TitleIdx=0, Type=1, Data="M\0Y\0W\0O\0R\0L\0D\0\0\0"}, 28, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (380, "Hostname", Partial, 144, ... TitleIdx=0, Type=1, Data="M\0Y\0W\0O\0R\0L\0D\0\0\0"}, 28, ) }, 28, ) == 0x0
 02923   396   NtClose  (380, ... ) == 0x0
 02924   396   NtClose  (376, ... ) == 0x0
 02925   396   NtCreateKey  (0x20019, {24, 48, 0x40, 0, 0,  (0x20019, {24, 48, 0x40, 0, 0, "System\CurrentControlSet\Services\Tcpip\Parameters"}, 0, "Class", 0, ... 376, 2, ) }, 0,  (0x20019, {24, 48, 0x40, 0, 0, "System\CurrentControlSet\Services\Tcpip\Parameters"}, 0, "Class", 0, ... 376, 2, ) , 0, ... 376, 2, ) == 0x0
 02926   396   NtOpenKey  (0x20019, {24, 48, 0x40, 0, 0,  (0x20019, {24, 48, 0x40, 0, 0, "System\CurrentControlSet\Services\DnsCache\Parameters"}, ... 380, ) }, ... 380, ) == 0x0
 02927   396   NtOpenKey  (0x20019, {24, 48, 0x40, 0, 0,  (0x20019, {24, 48, 0x40, 0, 0, "Software\Policies\Microsoft\Windows NT\DnsClient"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02928   396   NtQueryValueKey  (376,  (376, "Domain", Partial, 144, ... TitleIdx=0, Type=1, Data="\0\0"}, 14, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (376, "Domain", Partial, 144, ... TitleIdx=0, Type=1, Data="\0\0"}, 14, ) }, 14, ) == 0x0
 02929   396   NtQueryValueKey  (376,  (376, "Domain", Partial, 144, ... TitleIdx=0, Type=1, Data="\0\0"}, 14, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (376, "Domain", Partial, 144, ... TitleIdx=0, Type=1, Data="\0\0"}, 14, ) }, 14, ) == 0x0
 02930   396   NtClose  (376, ... ) == 0x0
 02931   396   NtClose  (380, ... ) == 0x0
 02932   396   NtOpenKey  (0x1, {24, 48, 0x40, 0, 0,  (0x1, {24, 48, 0x40, 0, 0, "System\CurrentControlSet\Services\VxD\MSTCP"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02933   396   NtOpenKey  (0x1, {24, 48, 0x40, 0, 0,  (0x1, {24, 48, 0x40, 0, 0, "System\CurrentControlSet\Control\ComputerName\ComputerName"}, ... 380, ) }, ... 380, ) == 0x0
 02934   396   NtQueryValueKey  (380,  (380, "ComputerName", Partial, 144, ... TitleIdx=0, Type=1, Data="M\0Y\0W\0O\0R\0L\0D\0\0\0"}, 28, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (380, "ComputerName", Partial, 144, ... TitleIdx=0, Type=1, Data="M\0Y\0W\0O\0R\0L\0D\0\0\0"}, 28, ) }, 28, ) == 0x0
 02935   396   NtQueryValueKey  (380,  (380, "ComputerName", Partial, 144, ... TitleIdx=0, Type=1, Data="M\0Y\0W\0O\0R\0L\0D\0\0\0"}, 28, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (380, "ComputerName", Partial, 144, ... TitleIdx=0, Type=1, Data="M\0Y\0W\0O\0R\0L\0D\0\0\0"}, 28, ) }, 28, ) == 0x0
 02936   396   NtClose  (380, ... ) == 0x0
 02937   396   NtWaitForSingleObject  (72, 0, {0, 0}, ... ) == 0x102
 02938   396   NtWaitForSingleObject  (72, 0, {0, 0}, ... ) == 0x102
 02939   396   NtWaitForSingleObject  (72, 0, {0, 0}, ... ) == 0x102
 02940   396   NtWaitForSingleObject  (80, 0, {0, 0}, ... ) == 0x102
 02941   396   NtCreateEvent  (0x1f0003, 0x0, 1, 0, ... 380, ) == 0x0
 02942   396   NtConnectPort  ( ("\RPC Control\DNSResolver", {12, 2, 1, 1}, 0x0, 0x0, 1237148, 112, ... 376, 0x0, 0x0, 0x0, 112, ) , {12, 2, 1, 1}, 0x0, 0x0, 1237148, 112, ... 376, 0x0, 0x0, 0x0, 112, ) == 0x0
 02943   396   NtRequestWaitReplyPort  (376, {128, 152, new_msg, 0, 1310720, 122480, 1310720, 1236912}  (376, {128, 152, new_msg, 0, 1310720, 122480, 1310720, 1236912} "\0$\370w`\346\22\0\2$\370w\1kwEVY\205D\237\200\364(\367\326\1)\2\0\0\0\1\0\0\0\0\312\25\0\4\0\0\0\0\312\25\0\20\344\314w\0\312\25\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\1\0\10\0\20\311\25\00\335\25\0\0\0\0\0\0\0\0\0\24\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\20\0\0\0\374\340\22\0\0\0\0\0\365\26\365w\5\0\0\0" ... {128, 152, reply, 0, 316, 396, 1554, 0} "\7$\370w`\346\22\0\2$\370w\1kwEVY\205D\237\200\364(\367\326\1)\2\0\0\0\1\0\0\0\0\0\0\0\4\0\0\0\0\312\25\0\377\377\377\377\0\312\25\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\1\0\10\0\20\311\25\00\335\25\0\0\0\0\0\0\0\0\0\24\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\20\0\0\0\374\340\22\0\0\0\0\0\365\26\365w\5\0\0\0" )  ... {128, 152, reply, 0, 316, 396, 1554, 0}  (376, {128, 152, new_msg, 0, 1310720, 122480, 1310720, 1236912} "\0$\370w`\346\22\0\2$\370w\1kwEVY\205D\237\200\364(\367\326\1)\2\0\0\0\1\0\0\0\0\312\25\0\4\0\0\0\0\312\25\0\20\344\314w\0\312\25\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\1\0\10\0\20\311\25\00\335\25\0\0\0\0\0\0\0\0\0\24\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\20\0\0\0\374\340\22\0\0\0\0\0\365\26\365w\5\0\0\0" ... {128, 152, reply, 0, 316, 396, 1554, 0} "\7$\370w`\346\22\0\2$\370w\1kwEVY\205D\237\200\364(\367\326\1)\2\0\0\0\1\0\0\0\0\0\0\0\4\0\0\0\0\312\25\0\377\377\377\377\0\312\25\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\1\0\10\0\20\311\25\00\335\25\0\0\0\0\0\0\0\0\0\24\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\20\0\0\0\374\340\22\0\0\0\0\0\365\26\365w\5\0\0\0" )  ) == 0x0
 02944   396   NtRequestWaitReplyPort  (376, {112, 136, new_msg, 0, 316, 396, 1551, 0}  (376, {112, 136, new_msg, 0, 316, 396, 1551, 0} "\1\240\0\0A\2\11\0\0\0\0\0G\3\0\0\0\0\0\0\0\0\0\0\377\377\377\377\0\0\0\0\0\0\0\0,\10\25\0\25\0\0\0\0\0\0\0\25\0\0\0s\0r\0v\00\01\0.\0b\0a\0s\0h\0c\0h\0e\0l\0i\0k\0.\0c\0o\0m\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0" ... {44, 68, reply, 0, 316, 396, 1555, 0} "\2\240\372\177\1\00\300\0\0\0\0G\3\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\264\5\0\0\1\0\0\0" )  ... {44, 68, reply, 0, 316, 396, 1555, 0}  (376, {112, 136, new_msg, 0, 316, 396, 1551, 0} "\1\240\0\0A\2\11\0\0\0\0\0G\3\0\0\0\0\0\0\0\0\0\0\377\377\377\377\0\0\0\0\0\0\0\0,\10\25\0\25\0\0\0\0\0\0\0\25\0\0\0s\0r\0v\00\01\0.\0b\0a\0s\0h\0c\0h\0e\0l\0i\0k\0.\0c\0o\0m\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0" ... {44, 68, reply, 0, 316, 396, 1555, 0} "\2\240\372\177\1\00\300\0\0\0\0G\3\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\264\5\0\0\1\0\0\0" )  ) == 0x0
 02945   396   NtClose  (380, ... ) == 0x0
 02946   396   NtClose  (376, ... ) == 0x0
 02947   396   NtCreateFile  (0x3, {24, 0, 0x40, 0, 0,  (0x3, {24, 0, 0x40, 0, 0, "\Device\RasAcd"}, 0x0, 128, 3, 3, 0, 0, 0, ... 376, {status=0x0, info=0}, ) }, 0x0, 128, 3, 3, 0, 0, 0, ... 376, {status=0x0, info=0}, ) == 0x0
 02948   396   NtCreateEvent  (0x1f0003, 0x0, 1, 0, ... 380, ) == 0x0
 02949   396   NtDeviceIoControlFile  (376, 380, 0x0, 0x0, 0xf14014,  (376, 380, 0x0, 0x0, 0xf14014, "\3\0\0\0srv01.bashchelik.com\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0", 1552, 0, ... ) , 1552, 0, ... ) == STATUS_UNSUCCESSFUL
 02950   396   NtClose  (380, ... ) == 0x0
 02951   396   NtClose  (376, ... ) == 0x0
 02952   396   NtWaitForSingleObject  (200, 0, 0x0, ... ) == 0x0
 02953   396   NtWaitForSingleObject  (204, 0, 0x0, ... ) == 0x0
 02954   396   NtReleaseMutant  (204, ... 0x0, ) == 0x0
 02955   396   NtQueryValueKey  (108,  (108, "EnableAutodial", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (108, "EnableAutodial", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) }, 16, ) == 0x0
 02956   396   NtQueryValueKey  (108,  (108, "NoNetAutodial", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (108, "NoNetAutodial", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) }, 16, ) == 0x0
 02957   396   NtCreateKey  (0x2001d, {24, 48, 0x40, 0, 0,  (0x2001d, {24, 48, 0x40, 0, 0, "Software\Microsoft\RAS AutoDial"}, 0, 0x0, 0, ... 376, 2, ) }, 0, 0x0, 0, ... 376, 2, ) == 0x0
 02958   396   NtCreateKey  (0x20019, {24, 376, 0x40, 0, 0,  (0x20019, {24, 376, 0x40, 0, 0, "Default"}, 0, 0x0, 0, ... 380, 2, ) }, 0, 0x0, 0, ... 380, 2, ) == 0x0
 02959   396   NtClose  (376, ... ) == 0x0
 02960   396   NtQueryValueKey  (380,  (380, "DefaultInternet", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02961   396   NtClose  (380, ... ) == 0x0
 02962   396   NtOpenThreadToken  (-2, 0xc, 1, ... ) == STATUS_NO_TOKEN
 02963   396   NtOpenProcessToken  (-1, 0xc, ... 380, ) == 0x0
 02964   396   NtReleaseSemaphore  (168, 1, ... 0, ) == 0x0
 02965   396   NtWaitForSingleObject  (168, 0, {0, 0}, ... ) == 0x0
 02966   396   NtClose  (380, ... ) == 0x0
 02967   396   NtOpenFile  (0x100001, {24, 0, 0x40, 0, 0,  (0x100001, {24, 0, 0x40, 0, 0, "\??\C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Connections\Pbk\"}, 3, 16417, ... 380, {status=0x0, info=1}, ) }, 3, 16417, ... 380, {status=0x0, info=1}, ) == 0x0
 02968   396   NtQueryDirectoryFile  (380, 0, 0, 0, 1236932, 616, BothDirectory, 1,  (380, 0, 0, 0, 1236932, 616, BothDirectory, 1, "<.pbk", 0, ... ) , 0, ... ) == STATUS_NO_SUCH_FILE
 02969   396   NtClose  (380, ... ) == 0x0
 02970   396   NtOpenFile  (0x100001, {24, 0, 0x40, 0, 0,  (0x100001, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\System32\Ras\"}, 3, 16417, ... 380, {status=0x0, info=1}, ) }, 3, 16417, ... 380, {status=0x0, info=1}, ) == 0x0
 02971   396   NtQueryDirectoryFile  (380, 0, 0, 0, 1236932, 616, BothDirectory, 1,  (380, 0, 0, 0, 1236932, 616, BothDirectory, 1, "<.pbk", 0, ... ) , 0, ... ) == STATUS_NO_SUCH_FILE
 02972   396   NtClose  (380, ... ) == 0x0
 02973   396   NtOpenThreadToken  (-2, 0xc, 1, ... ) == STATUS_NO_TOKEN
 02974   396   NtOpenProcessToken  (-1, 0xc, ... 380, ) == 0x0
 02975   396   NtQueryInformationToken  (380, User, 64, ... {token info, class 1, size 36}, 36, ) == 0x0
 02976   396   NtOpenKey  (0x2001f, {24, 328, 0x40, 0, 0,  (0x2001f, {24, 328, 0x40, 0, 0, "S-1-5-21-1078081533-484763869-839522115-1003"}, ... 376, ) }, ... 376, ) == 0x0
 02977   396   NtCreateKey  (0x2000000, {24, 376, 0x40, 0, 0,  (0x2000000, {24, 376, 0x40, 0, 0, "Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders"}, 0, 0x0, 0, ... 384, 2, ) }, 0, 0x0, 0, ... 384, 2, ) == 0x0
 02978   396   NtClose  (376, ... ) == 0x0
 02979   396   NtQueryValueKey  (384,  (384, "AppData", Partial, 144, ... TitleIdx=0, Type=2, Data="%\0U\0S\0E\0R\0P\0R\0O\0F\0I\0L\0E\0%\0\\0A\0p\0p\0l\0i\0c\0a\0t\0i\0o\0n\0 \0D\0a\0t\0a\0\0\0"}, 74, ) , Partial, 144, ... TitleIdx=0, Type=2, Data= (384, "AppData", Partial, 144, ... TitleIdx=0, Type=2, Data="%\0U\0S\0E\0R\0P\0R\0O\0F\0I\0L\0E\0%\0\\0A\0p\0p\0l\0i\0c\0a\0t\0i\0o\0n\0 \0D\0a\0t\0a\0\0\0"}, 74, ) }, 74, ) == 0x0
 02980   396   NtAllocateVirtualMemory  (-1, 0, 0, 1, 4096, 4, ... 11534336, 4096, ) == 0x0
 02981   396   NtAllocateVirtualMemory  (-1, 1437696, 0, 4096, 4096, 4, ... 1437696, 4096, ) == 0x0
 02982   396   NtAllocateVirtualMemory  (-1, 1441792, 0, 4096, 4096, 4, ... 1441792, 4096, ) == 0x0
 02983   396   NtQueryVirtualMemory  (-1, 0xb00000, Basic, 28, ... {BaseAddress=0xb00000,AllocationBase=0xb00000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 0x0, ) == 0x0
 02984   396   NtQueryVirtualMemory  (-1, 0xb00000, Basic, 28, ... {BaseAddress=0xb00000,AllocationBase=0xb00000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 0x0, ) == 0x0
 02985   396   NtOpenKey  (0x20019, {24, 48, 0x40, 0, 0,  (0x20019, {24, 48, 0x40, 0, 0, "Software\Microsoft\Windows NT\CurrentVersion\ProfileList"}, ... 376, ) }, ... 376, ) == 0x0
 02986   396   NtQueryValueKey  (376,  (376, "ProfilesDirectory", Partial, 144, ... TitleIdx=0, Type=2, Data="%\0S\0y\0s\0t\0e\0m\0D\0r\0i\0v\0e\0%\0\\0D\0o\0c\0u\0m\0e\0n\0t\0s\0 \0a\0n\0d\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\0\0"}, 86, ) , Partial, 144, ... TitleIdx=0, Type=2, Data= (376, "ProfilesDirectory", Partial, 144, ... TitleIdx=0, Type=2, Data="%\0S\0y\0s\0t\0e\0m\0D\0r\0i\0v\0e\0%\0\\0D\0o\0c\0u\0m\0e\0n\0t\0s\0 \0a\0n\0d\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\0\0"}, 86, ) }, 86, ) == 0x0
 02987   396   NtClose  (376, ... ) == 0x0
 02988   396   NtOpenKey  (0x20019, {24, 48, 0x40, 0, 0,  (0x20019, {24, 48, 0x40, 0, 0, "Software\Microsoft\Windows NT\CurrentVersion\ProfileList"}, ... 376, ) }, ... 376, ) == 0x0
 02989   396   NtQueryValueKey  (376,  (376, "AllUsersProfile", Partial, 144, ... TitleIdx=0, Type=1, Data="A\0l\0l\0 \0U\0s\0e\0r\0s\0\0\0"}, 32, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (376, "AllUsersProfile", Partial, 144, ... TitleIdx=0, Type=1, Data="A\0l\0l\0 \0U\0s\0e\0r\0s\0\0\0"}, 32, ) }, 32, ) == 0x0
 02990   396   NtClose  (376, ... ) == 0x0
 02991   396   NtQueryVirtualMemory  (-1, 0xb00000, Basic, 28, ... {BaseAddress=0xb00000,AllocationBase=0xb00000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 0x0, ) == 0x0
 02992   396   NtOpenKey  (0x1, {24, 48, 0x40, 0, 0,  (0x1, {24, 48, 0x40, 0, 0, "System\CurrentControlSet\Control\Session Manager\Environment"}, ... 376, ) }, ... 376, ) == 0x0
 02993   396   NtQueryKey  (376, Full, 176, ... {LastWrite={0x7838d13c,0x1c73999}, TitleIdx=0, Subkeys=0, Values=12, Class=""}, 44, ) == 0x0
 02994   396   NtQuerySecurityObject  (376, 7, 0, ... ) == STATUS_ACCESS_DENIED
 02995   396   NtEnumerateValueKey  (376, 0, Full, 220, ... TitleIdx=0, Type=2, Name= (376, 0, Full, 220, ... TitleIdx=0, Type=2, Name="ComSpec", Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0s\0y\0s\0t\0e\0m\03\02\0\\0c\0m\0d\0.\0e\0x\0e\0\0\0"}, 96, ) , Data= (376, 0, Full, 220, ... TitleIdx=0, Type=2, Name="ComSpec", Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0s\0y\0s\0t\0e\0m\03\02\0\\0c\0m\0d\0.\0e\0x\0e\0\0\0"}, 96, ) }, 96, ) == 0x0
 02996   396   NtEnumerateValueKey  (376, 1, Full, 220, ... TitleIdx=0, Type=2, Name= (376, 1, Full, 220, ... TitleIdx=0, Type=2, Name="Path", Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0s\0y\0s\0t\0e\0m\03\02\0;\0%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0;\0%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0W\0b\0e\0m\0\0\0"}, 152, ) , Data= (376, 1, Full, 220, ... TitleIdx=0, Type=2, Name="Path", Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0s\0y\0s\0t\0e\0m\03\02\0;\0%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0;\0%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0W\0b\0e\0m\0\0\0"}, 152, ) }, 152, ) == 0x0
 02997   396   NtEnumerateValueKey  (376, 2, Full, 220, ... TitleIdx=0, Type=2, Name= (376, 2, Full, 220, ... TitleIdx=0, Type=2, Name="windir", Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\0\0"}, 58, ) , Data= (376, 2, Full, 220, ... TitleIdx=0, Type=2, Name="windir", Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\0\0"}, 58, ) }, 58, ) == 0x0
 02998   396   NtEnumerateValueKey  (376, 3, Full, 220, ... TitleIdx=0, Type=1, Name= (376, 3, Full, 220, ... TitleIdx=0, Type=1, Name="OS", Data="W\0i\0n\0d\0o\0w\0s\0_\0N\0T\0\0\0"}, 46, ) , Data= (376, 3, Full, 220, ... TitleIdx=0, Type=1, Name="OS", Data="W\0i\0n\0d\0o\0w\0s\0_\0N\0T\0\0\0"}, 46, ) }, 46, ) == 0x0
 02999   396   NtQueryVirtualMemory  (-1, 0xb00000, Basic, 28, ... {BaseAddress=0xb00000,AllocationBase=0xb00000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 0x0, ) == 0x0
 03000   396   NtEnumerateValueKey  (376, 4, Full, 220, ... TitleIdx=0, Type=1, Name= (376, 4, Full, 220, ... TitleIdx=0, Type=1, Name="PROCESSOR_ARCHITECTURE", Data="x\08\06\0\0\0"}, 72, ) , Data= (376, 4, Full, 220, ... TitleIdx=0, Type=1, Name="PROCESSOR_ARCHITECTURE", Data="x\08\06\0\0\0"}, 72, ) }, 72, ) == 0x0
 03001   396   NtQueryVirtualMemory  (-1, 0xb00000, Basic, 28, ... {BaseAddress=0xb00000,AllocationBase=0xb00000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 0x0, ) == 0x0
 03002   396   NtEnumerateValueKey  (376, 5, Full, 220, ... TitleIdx=0, Type=1, Name= (376, 5, Full, 220, ... TitleIdx=0, Type=1, Name="PROCESSOR_LEVEL", Data="1\05\0\0\0"}, 58, ) , Data= (376, 5, Full, 220, ... TitleIdx=0, Type=1, Name="PROCESSOR_LEVEL", Data="1\05\0\0\0"}, 58, ) }, 58, ) == 0x0
 03003   396   NtQueryVirtualMemory  (-1, 0xb00000, Basic, 28, ... {BaseAddress=0xb00000,AllocationBase=0xb00000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 0x0, ) == 0x0
 03004   396   NtEnumerateValueKey  (376, 6, Full, 220, ... TitleIdx=0, Type=1, Name= (376, 6, Full, 220, ... TitleIdx=0, Type=1, Name="PROCESSOR_IDENTIFIER", Data="x\08\06\0 \0F\0a\0m\0i\0l\0y\0 \01\05\0 \0M\0o\0d\0e\0l\0 \04\0 \0S\0t\0e\0p\0p\0i\0n\0g\0 \08\0,\0 \0G\0e\0n\0u\0i\0n\0e\0I\0n\0t\0e\0l\0\0\0"}, 154, ) , Data= (376, 6, Full, 220, ... TitleIdx=0, Type=1, Name="PROCESSOR_IDENTIFIER", Data="x\08\06\0 \0F\0a\0m\0i\0l\0y\0 \01\05\0 \0M\0o\0d\0e\0l\0 \04\0 \0S\0t\0e\0p\0p\0i\0n\0g\0 \08\0,\0 \0G\0e\0n\0u\0i\0n\0e\0I\0n\0t\0e\0l\0\0\0"}, 154, ) }, 154, ) == 0x0
 03005   396   NtQueryVirtualMemory  (-1, 0xb00000, Basic, 28, ... {BaseAddress=0xb00000,AllocationBase=0xb00000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 0x0, ) == 0x0
 03006   396   NtEnumerateValueKey  (376, 7, Full, 220, ... TitleIdx=0, Type=1, Name= (376, 7, Full, 220, ... TitleIdx=0, Type=1, Name="PROCESSOR_REVISION", Data="0\04\00\08\0\0\0"}, 66, ) , Data= (376, 7, Full, 220, ... TitleIdx=0, Type=1, Name="PROCESSOR_REVISION", Data="0\04\00\08\0\0\0"}, 66, ) }, 66, ) == 0x0
 03007   396   NtQueryVirtualMemory  (-1, 0xb00000, Basic, 28, ... {BaseAddress=0xb00000,AllocationBase=0xb00000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 0x0, ) == 0x0
 03008   396   NtEnumerateValueKey  (376, 8, Full, 220, ... TitleIdx=0, Type=1, Name= (376, 8, Full, 220, ... TitleIdx=0, Type=1, Name="NUMBER_OF_PROCESSORS", Data="1\0\0\0"}, 64, ) , Data= (376, 8, Full, 220, ... TitleIdx=0, Type=1, Name="NUMBER_OF_PROCESSORS", Data="1\0\0\0"}, 64, ) }, 64, ) == 0x0
 03009   396   NtQueryVirtualMemory  (-1, 0xb00000, Basic, 28, ... {BaseAddress=0xb00000,AllocationBase=0xb00000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 0x0, ) == 0x0
 03010   396   NtEnumerateValueKey  (376, 9, Full, 220, ... TitleIdx=0, Type=1, Name= (376, 9, Full, 220, ... TitleIdx=0, Type=1, Name="PATHEXT", Data=".\0C\0O\0M\0;\0.\0E\0X\0E\0;\0.\0B\0A\0T\0;\0.\0C\0M\0D\0;\0.\0V\0B\0S\0;\0.\0V\0B\0E\0;\0.\0J\0S\0;\0.\0J\0S\0E\0;\0.\0W\0S\0F\0;\0.\0W\0S\0H\0\0\0"}, 134, ) , Data= (376, 9, Full, 220, ... TitleIdx=0, Type=1, Name="PATHEXT", Data=".\0C\0O\0M\0;\0.\0E\0X\0E\0;\0.\0B\0A\0T\0;\0.\0C\0M\0D\0;\0.\0V\0B\0S\0;\0.\0V\0B\0E\0;\0.\0J\0S\0;\0.\0J\0S\0E\0;\0.\0W\0S\0F\0;\0.\0W\0S\0H\0\0\0"}, 134, ) }, 134, ) == 0x0
 03011   396   NtQueryVirtualMemory  (-1, 0xb00000, Basic, 28, ... {BaseAddress=0xb00000,AllocationBase=0xb00000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 0x0, ) == 0x0
 03012   396   NtEnumerateValueKey  (376, 10, Full, 220, ... TitleIdx=0, Type=2, Name= (376, 10, Full, 220, ... TitleIdx=0, Type=2, Name="TEMP", Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0T\0E\0M\0P\0\0\0"}, 64, ) , Data= (376, 10, Full, 220, ... TitleIdx=0, Type=2, Name="TEMP", Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0T\0E\0M\0P\0\0\0"}, 64, ) }, 64, ) == 0x0
 03013   396   NtEnumerateValueKey  (376, 11, Full, 220, ... TitleIdx=0, Type=2, Name= (376, 11, Full, 220, ... TitleIdx=0, Type=2, Name="TMP", Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0T\0E\0M\0P\0\0\0"}, 64, ) , Data= (376, 11, Full, 220, ... TitleIdx=0, Type=2, Name="TMP", Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0T\0E\0M\0P\0\0\0"}, 64, ) }, 64, ) == 0x0
 03014   396   NtEnumerateValueKey  (376, 0, Full, 220, ... TitleIdx=0, Type=2, Name= (376, 0, Full, 220, ... TitleIdx=0, Type=2, Name="ComSpec", Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0s\0y\0s\0t\0e\0m\03\02\0\\0c\0m\0d\0.\0e\0x\0e\0\0\0"}, 96, ) , Data= (376, 0, Full, 220, ... TitleIdx=0, Type=2, Name="ComSpec", Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0s\0y\0s\0t\0e\0m\03\02\0\\0c\0m\0d\0.\0e\0x\0e\0\0\0"}, 96, ) }, 96, ) == 0x0
 03015   396   NtQueryVirtualMemory  (-1, 0xb00000, Basic, 28, ... {BaseAddress=0xb00000,AllocationBase=0xb00000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 0x0, ) == 0x0
 03016   396   NtEnumerateValueKey  (376, 1, Full, 220, ... TitleIdx=0, Type=2, Name= (376, 1, Full, 220, ... TitleIdx=0, Type=2, Name="Path", Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0s\0y\0s\0t\0e\0m\03\02\0;\0%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0;\0%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0W\0b\0e\0m\0\0\0"}, 152, ) , Data= (376, 1, Full, 220, ... TitleIdx=0, Type=2, Name="Path", Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0s\0y\0s\0t\0e\0m\03\02\0;\0%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0;\0%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0W\0b\0e\0m\0\0\0"}, 152, ) }, 152, ) == 0x0
 03017   396   NtQueryVirtualMemory  (-1, 0xb00000, Basic, 28, ... {BaseAddress=0xb00000,AllocationBase=0xb00000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 0x0, ) == 0x0
 03018   396   NtEnumerateValueKey  (376, 2, Full, 220, ... TitleIdx=0, Type=2, Name= (376, 2, Full, 220, ... TitleIdx=0, Type=2, Name="windir", Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\0\0"}, 58, ) , Data= (376, 2, Full, 220, ... TitleIdx=0, Type=2, Name="windir", Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\0\0"}, 58, ) }, 58, ) == 0x0
 03019   396   NtQueryVirtualMemory  (-1, 0xb00000, Basic, 28, ... {BaseAddress=0xb00000,AllocationBase=0xb00000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 0x0, ) == 0x0
 03020   396   NtEnumerateValueKey  (376, 3, Full, 220, ... TitleIdx=0, Type=1, Name= (376, 3, Full, 220, ... TitleIdx=0, Type=1, Name="OS", Data="W\0i\0n\0d\0o\0w\0s\0_\0N\0T\0\0\0"}, 46, ) , Data= (376, 3, Full, 220, ... TitleIdx=0, Type=1, Name="OS", Data="W\0i\0n\0d\0o\0w\0s\0_\0N\0T\0\0\0"}, 46, ) }, 46, ) == 0x0
 03021   396   NtEnumerateValueKey  (376, 4, Full, 220, ... TitleIdx=0, Type=1, Name= (376, 4, Full, 220, ... TitleIdx=0, Type=1, Name="PROCESSOR_ARCHITECTURE", Data="x\08\06\0\0\0"}, 72, ) , Data= (376, 4, Full, 220, ... TitleIdx=0, Type=1, Name="PROCESSOR_ARCHITECTURE", Data="x\08\06\0\0\0"}, 72, ) }, 72, ) == 0x0
 03022   396   NtEnumerateValueKey  (376, 5, Full, 220, ... TitleIdx=0, Type=1, Name= (376, 5, Full, 220, ... TitleIdx=0, Type=1, Name="PROCESSOR_LEVEL", Data="1\05\0\0\0"}, 58, ) , Data= (376, 5, Full, 220, ... TitleIdx=0, Type=1, Name="PROCESSOR_LEVEL", Data="1\05\0\0\0"}, 58, ) }, 58, ) == 0x0
 03023   396   NtEnumerateValueKey  (376, 6, Full, 220, ... TitleIdx=0, Type=1, Name= (376, 6, Full, 220, ... TitleIdx=0, Type=1, Name="PROCESSOR_IDENTIFIER", Data="x\08\06\0 \0F\0a\0m\0i\0l\0y\0 \01\05\0 \0M\0o\0d\0e\0l\0 \04\0 \0S\0t\0e\0p\0p\0i\0n\0g\0 \08\0,\0 \0G\0e\0n\0u\0i\0n\0e\0I\0n\0t\0e\0l\0\0\0"}, 154, ) , Data= (376, 6, Full, 220, ... TitleIdx=0, Type=1, Name="PROCESSOR_IDENTIFIER", Data="x\08\06\0 \0F\0a\0m\0i\0l\0y\0 \01\05\0 \0M\0o\0d\0e\0l\0 \04\0 \0S\0t\0e\0p\0p\0i\0n\0g\0 \08\0,\0 \0G\0e\0n\0u\0i\0n\0e\0I\0n\0t\0e\0l\0\0\0"}, 154, ) }, 154, ) == 0x0
 03024   396   NtEnumerateValueKey  (376, 7, Full, 220, ... TitleIdx=0, Type=1, Name= (376, 7, Full, 220, ... TitleIdx=0, Type=1, Name="PROCESSOR_REVISION", Data="0\04\00\08\0\0\0"}, 66, ) , Data= (376, 7, Full, 220, ... TitleIdx=0, Type=1, Name="PROCESSOR_REVISION", Data="0\04\00\08\0\0\0"}, 66, ) }, 66, ) == 0x0
 03025   396   NtEnumerateValueKey  (376, 8, Full, 220, ... TitleIdx=0, Type=1, Name= (376, 8, Full, 220, ... TitleIdx=0, Type=1, Name="NUMBER_OF_PROCESSORS", Data="1\0\0\0"}, 64, ) , Data= (376, 8, Full, 220, ... TitleIdx=0, Type=1, Name="NUMBER_OF_PROCESSORS", Data="1\0\0\0"}, 64, ) }, 64, ) == 0x0
 03026   396   NtEnumerateValueKey  (376, 9, Full, 220, ... TitleIdx=0, Type=1, Name= (376, 9, Full, 220, ... TitleIdx=0, Type=1, Name="PATHEXT", Data=".\0C\0O\0M\0;\0.\0E\0X\0E\0;\0.\0B\0A\0T\0;\0.\0C\0M\0D\0;\0.\0V\0B\0S\0;\0.\0V\0B\0E\0;\0.\0J\0S\0;\0.\0J\0S\0E\0;\0.\0W\0S\0F\0;\0.\0W\0S\0H\0\0\0"}, 134, ) , Data= (376, 9, Full, 220, ... TitleIdx=0, Type=1, Name="PATHEXT", Data=".\0C\0O\0M\0;\0.\0E\0X\0E\0;\0.\0B\0A\0T\0;\0.\0C\0M\0D\0;\0.\0V\0B\0S\0;\0.\0V\0B\0E\0;\0.\0J\0S\0;\0.\0J\0S\0E\0;\0.\0W\0S\0F\0;\0.\0W\0S\0H\0\0\0"}, 134, ) }, 134, ) == 0x0
 03027   396   NtEnumerateValueKey  (376, 10, Full, 220, ... TitleIdx=0, Type=2, Name= (376, 10, Full, 220, ... TitleIdx=0, Type=2, Name="TEMP", Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0T\0E\0M\0P\0\0\0"}, 64, ) , Data= (376, 10, Full, 220, ... TitleIdx=0, Type=2, Name="TEMP", Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0T\0E\0M\0P\0\0\0"}, 64, ) }, 64, ) == 0x0
 03028   396   NtQueryInformationProcess  (-1, DefaultHardErrorMode, 4, ... {process info, class 12, size 4}, 0x0, ) == 0x0
 03029   396   NtSetInformationProcess  (-1, DefaultHardErrorMode, {process info, class 12, size 4}, 4, ... ) == 0x0
 03030   396   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\TEMP"}, 1236004, ... ) }, 1236004, ... ) == 0x0
 03031   396   NtQueryInformationProcess  (-1, DefaultHardErrorMode, 4, ... {process info, class 12, size 4}, 0x0, ) == 0x0
 03032   396   NtSetInformationProcess  (-1, DefaultHardErrorMode, {process info, class 12, size 4}, 4, ... ) == 0x0
 03033   396   NtQueryVirtualMemory  (-1, 0xb00000, Basic, 28, ... {BaseAddress=0xb00000,AllocationBase=0xb00000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 0x0, ) == 0x0
 03034   396   NtEnumerateValueKey  (376, 11, Full, 220, ... TitleIdx=0, Type=2, Name= (376, 11, Full, 220, ... TitleIdx=0, Type=2, Name="TMP", Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0T\0E\0M\0P\0\0\0"}, 64, ) , Data= (376, 11, Full, 220, ... TitleIdx=0, Type=2, Name="TMP", Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0T\0E\0M\0P\0\0\0"}, 64, ) }, 64, ) == 0x0
 03035   396   NtQueryInformationProcess  (-1, DefaultHardErrorMode, 4, ... {process info, class 12, size 4}, 0x0, ) == 0x0
 03036   396   NtSetInformationProcess  (-1, DefaultHardErrorMode, {process info, class 12, size 4}, 4, ... ) == 0x0
 03037   396   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\TEMP"}, 1236004, ... ) }, 1236004, ... ) == 0x0
 03038   396   NtQueryInformationProcess  (-1, DefaultHardErrorMode, 4, ... {process info, class 12, size 4}, 0x0, ) == 0x0
 03039   396   NtSetInformationProcess  (-1, DefaultHardErrorMode, {process info, class 12, size 4}, 4, ... ) == 0x0
 03040   396   NtQueryVirtualMemory  (-1, 0xb00000, Basic, 28, ... {BaseAddress=0xb00000,AllocationBase=0xb00000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 0x0, ) == 0x0
 03041   396   NtClose  (376, ... ) == 0x0
 03042   396   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\System\CurrentControlSet\Control\ComputerName"}, ... 376, ) }, ... 376, ) == 0x0
 03043   396   NtOpenKey  (0x20019, {24, 376, 0x40, 0, 0,  (0x20019, {24, 376, 0x40, 0, 0, "ActiveComputerName"}, ... 388, ) }, ... 388, ) == 0x0
 03044   396   NtQueryValueKey  (388,  (388, "ComputerName", Full, 108, ... TitleIdx=0, Type=1, Name="ComputerName", Data="M\0Y\0W\0O\0R\0L\0D\0\0\0"}, 60, ) , Full, 108, ... TitleIdx=0, Type=1, Name= (388, "ComputerName", Full, 108, ... TitleIdx=0, Type=1, Name="ComputerName", Data="M\0Y\0W\0O\0R\0L\0D\0\0\0"}, 60, ) , Data= (388, "ComputerName", Full, 108, ... TitleIdx=0, Type=1, Name="ComputerName", Data="M\0Y\0W\0O\0R\0L\0D\0\0\0"}, 60, ) }, 60, ) == 0x0
 03045   396   NtClose  (388, ... ) == 0x0
 03046   396   NtClose  (376, ... ) == 0x0
 03047   396   NtQueryVirtualMemory  (-1, 0xb00000, Basic, 28, ... {BaseAddress=0xb00000,AllocationBase=0xb00000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 0x0, ) == 0x0
 03048   396   NtOpenKey  (0x20019, {24, 48, 0x40, 0, 0,  (0x20019, {24, 48, 0x40, 0, 0, "Software\Microsoft\Windows NT\CurrentVersion\ProfileList"}, ... 376, ) }, ... 376, ) == 0x0
 03049   396   NtQueryValueKey  (376,  (376, "ProfilesDirectory", Partial, 144, ... TitleIdx=0, Type=2, Data="%\0S\0y\0s\0t\0e\0m\0D\0r\0i\0v\0e\0%\0\\0D\0o\0c\0u\0m\0e\0n\0t\0s\0 \0a\0n\0d\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\0\0"}, 86, ) , Partial, 144, ... TitleIdx=0, Type=2, Data= (376, "ProfilesDirectory", Partial, 144, ... TitleIdx=0, Type=2, Data="%\0S\0y\0s\0t\0e\0m\0D\0r\0i\0v\0e\0%\0\\0D\0o\0c\0u\0m\0e\0n\0t\0s\0 \0a\0n\0d\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\0\0"}, 86, ) }, 86, ) == 0x0
 03050   396   NtClose  (376, ... ) == 0x0
 03051   396   NtOpenKey  (0x20019, {24, 48, 0x40, 0, 0,  (0x20019, {24, 48, 0x40, 0, 0, "Software\Microsoft\Windows NT\CurrentVersion\ProfileList"}, ... 376, ) }, ... 376, ) == 0x0
 03052   396   NtQueryValueKey  (376,  (376, "DefaultUserProfile", Partial, 144, ... TitleIdx=0, Type=1, Data="D\0e\0f\0a\0u\0l\0t\0 \0U\0s\0e\0r\0\0\0"}, 38, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (376, "DefaultUserProfile", Partial, 144, ... TitleIdx=0, Type=1, Data="D\0e\0f\0a\0u\0l\0t\0 \0U\0s\0e\0r\0\0\0"}, 38, ) }, 38, ) == 0x0
 03053   396   NtClose  (376, ... ) == 0x0
 03054   396   NtQueryVirtualMemory  (-1, 0xb00000, Basic, 28, ... {BaseAddress=0xb00000,AllocationBase=0xb00000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 0x0, ) == 0x0
 03055   396   NtOpenKey  (0x20019, {24, 48, 0x40, 0, 0,  (0x20019, {24, 48, 0x40, 0, 0, "Software\Microsoft\Windows\CurrentVersion"}, ... 376, ) }, ... 376, ) == 0x0
 03056   396   NtQueryValueKey  (376,  (376, "ProgramFilesDir", Partial, 144, ... TitleIdx=0, Type=1, Data="C\0:\0\\0P\0r\0o\0g\0r\0a\0m\0 \0F\0i\0l\0e\0s\0\0\0"}, 46, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (376, "ProgramFilesDir", Partial, 144, ... TitleIdx=0, Type=1, Data="C\0:\0\\0P\0r\0o\0g\0r\0a\0m\0 \0F\0i\0l\0e\0s\0\0\0"}, 46, ) }, 46, ) == 0x0
 03057   396   NtQueryVirtualMemory  (-1, 0xb00000, Basic, 28, ... {BaseAddress=0xb00000,AllocationBase=0xb00000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 0x0, ) == 0x0
 03058   396   NtQueryValueKey  (376,  (376, "CommonFilesDir", Partial, 144, ... TitleIdx=0, Type=1, Data="C\0:\0\\0P\0r\0o\0g\0r\0a\0m\0 \0F\0i\0l\0e\0s\0\\0C\0o\0m\0m\0o\0n\0 \0F\0i\0l\0e\0s\0\0\0"}, 72, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (376, "CommonFilesDir", Partial, 144, ... TitleIdx=0, Type=1, Data="C\0:\0\\0P\0r\0o\0g\0r\0a\0m\0 \0F\0i\0l\0e\0s\0\\0C\0o\0m\0m\0o\0n\0 \0F\0i\0l\0e\0s\0\0\0"}, 72, ) }, 72, ) == 0x0
 03059   396   NtQueryVirtualMemory  (-1, 0xb00000, Basic, 28, ... {BaseAddress=0xb00000,AllocationBase=0xb00000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 0x0, ) == 0x0
 03060   396   NtClose  (376, ... ) == 0x0
 03061   396   NtQueryInformationToken  (380, User, 200, ... {token info, class 1, size 36}, 36, ) == 0x0
 03062   396   NtOpenKey  (0x20019, {24, 328, 0x40, 0, 0,  (0x20019, {24, 328, 0x40, 0, 0, "S-1-5-21-1078081533-484763869-839522115-1003"}, ... 376, ) }, ... 376, ) == 0x0
 03063   396   NtOpenThreadToken  (-2, 0x2000c, 1, ... ) == STATUS_NO_TOKEN
 03064   396   NtQueryInformationToken  (380, Type, 4, ... {token info, class 8, size 4}, 4, ) == 0x0
 03065   396   NtDuplicateToken  (380, 0xc, {24, 0, 0x0, 0, 1237388, 0x0}, 0, 2, ... ) == STATUS_ACCESS_DENIED
 03066   396   NtQueryInformationToken  (380, User, 200, ... {token info, class 1, size 36}, 36, ) == 0x0
 03067   396   NtOpenThreadToken  (-2, 0xc, 1, ... ) == STATUS_NO_TOKEN
 03068   396   NtCreateEvent  (0x1f0003, 0x0, 1, 0, ... 388, ) == 0x0
 03069   396   NtOpenThreadToken  (-2, 0xc, 1, ... ) == STATUS_NO_TOKEN
 03070   396   NtSetInformationThread  (-2, ImpersonationToken, {ImpToken=0,}, 4, ... ) == 0x0
 03071   396   NtCreateFile  (0xc0100080, {24, 0, 0x40, 0, 1235592,  (0xc0100080, {24, 0, 0x40, 0, 1235592, "\??\PIPE\lsarpc"}, 0x0, 0, 3, 1, 64, 0, 0, ... 392, {status=0x0, info=1}, ) }, 0x0, 0, 3, 1, 64, 0, 0, ... 392, {status=0x0, info=1}, ) == 0x0
 03072   396   NtSetInformationFile  (392, 1235648, 8, Pipe, ... {status=0x0, info=0}, ) == 0x0
 03073   396   NtSetInformationFile  (392, 1235640, 8, Completion, ... {status=0x0, info=0}, ) == 0x0
 03074   396   NtSetInformationThread  (-2, ImpersonationToken, {ImpToken=0,}, 4, ... ) == 0x0
 03075   396   NtWriteFile  (392, 297, 0, 0,  (392, 297, 0, 0, "\5\0\13\3\20\0\0\0H\0\0\0\1\0\0\0\270\20\270\20\0\0\0\0\1\0\0\0\0\0\1\0xW4\224\22\315\253\357\0\1#Eg\211\253\0\0\0\0\4]\210\212\353\34\311\21\237\350\10\0+\20H`\2\0\0\0", 72, {0, 0}, 0, ... {status=0x0, info=72}, ) , 72, {0, 0}, 0, ... {status=0x0, info=72}, ) == 0x0
 03076   396   NtReadFile  (392, 297, 0, 0, 1024, {0, 0}, 0, ... {status=0x0, info=68},  (392, 297, 0, 0, 1024, {0, 0}, 0, ... {status=0x0, info=68}, "\5\0\14\3\20\0\0\0D\0\0\0\1\0\0\0\270\20\270\20\226%\0\0\14\0\PIPE\lsass\0\0\0\1\0\0\0\0\0\0\0\4]\210\212\353\34\311\21\237\350\10\0+\20H`\2\0\0\0", ) , ) == 0x0
 03077   396   NtFsControlFile  (392, 297, 0x0, 0x0, 0x11c017,  (392, 297, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0@\0\0\0\1\0\0\0(\0\0\0\0\0,\0\0\0\0\0\30\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0<\341\22\0\14\0\0\0\2\0\1\0\0\10\0\0", 64, 1024, ... {status=0x103, info=68}, "\5\0\14\3\20\0\0\0D\0\0\0\1\0\0\0\270\20\270\20\226%\0\0\14\0\PIPE\lsass\0\0\0\1\0\0\0\0\0\0\0\4]\210\212\353\34\311\21\237\350\10\0+\20H`\2\0\0\0", ) , 64, 1024, ... {status=0x103, info=68},  (392, 297, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0@\0\0\0\1\0\0\0(\0\0\0\0\0,\0\0\0\0\0\30\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0<\341\22\0\14\0\0\0\2\0\1\0\0\10\0\0", 64, 1024, ... {status=0x103, info=68}, "\5\0\14\3\20\0\0\0D\0\0\0\1\0\0\0\270\20\270\20\226%\0\0\14\0\PIPE\lsass\0\0\0\1\0\0\0\0\0\0\0\4]\210\212\353\34\311\21\237\350\10\0+\20H`\2\0\0\0", ) , ) == 0x103
 03078   396   NtFsControlFile  (392, 297, 0x0, 0x0, 0x11c017,  (392, 297, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0t\0\0\0\2\0\0\0\\0\0\0\0\09\0\0\0\0\0sF\235\311\333?\334\21\261\310\0\14)\371\246\305\1\0\0\0t\341\22\0\1\0\0\00\335\25\0\5\0\0\0\1\5\0\0\0\0\0\5\25\0\0\0\3757B@\335\350\344\34C\27\122\353\3\0\0\0\0\0\0\0\0\0\0\1\0l\0\0\0\0\0\0\0\0\0\2\0\0\0", 116, 1024, ... {status=0x103, info=48}, "\5\0\2\3\20\0\0\00\0\0\0\1\0\0\0\30\0\0\0\0\0\0\0\0\0\0\0sF\235\311\333?\334\21\261\310\0\14)\371\246\305\0\0\0\0", ) , 116, 1024, ... {status=0x103, info=48},  (392, 297, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0t\0\0\0\2\0\0\0\\0\0\0\0\09\0\0\0\0\0sF\235\311\333?\334\21\261\310\0\14)\371\246\305\1\0\0\0t\341\22\0\1\0\0\00\335\25\0\5\0\0\0\1\5\0\0\0\0\0\5\25\0\0\0\3757B@\335\350\344\34C\27\122\353\3\0\0\0\0\0\0\0\0\0\0\1\0l\0\0\0\0\0\0\0\0\0\2\0\0\0", 116, 1024, ... {status=0x103, info=48}, "\5\0\2\3\20\0\0\00\0\0\0\1\0\0\0\30\0\0\0\0\0\0\0\0\0\0\0sF\235\311\333?\334\21\261\310\0\14)\371\246\305\0\0\0\0", ) , ) == 0x103
 03079   396   NtFsControlFile  (392, 297, 0x0, 0x0, 0x11c017,  (392, 297, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0,\0\0\0\3\0\0\0\24\0\0\0\0\0\0\0\0\0\0\0sF\235\311\333?\334\21\261\310\0\14)\371\246\305", 44, 1024, ... {status=0x103, info=180}, "\5\0\2\3\20\0\0\0\264\0\0\0\2\0\0\0\234\0\0\0\0\0\0\0\230\254\25\0\1\0\0\0\244\254\25\0 \0\0\0\1\0\0\0\16\0\20\0\260\254\25\0\300\254\25\0\10\0\0\0\0\0\0\0\7\0\0\0M\0Y\0W\0O\0R\0L\0D\0O\0\4\0\0\0\1\4\0\0\0\0\0\5\25\0\0\0\3757B@\335\350\344\34C\27\122\1\0\0\0x\245\25\0\1\0\0\0\1\0\0\0\20\0\22\0\214\245\25\0\0\0\0\0\0\0\0\0\11\0\0\0\0\0\0\0\10\0\0\0S\0R\0I\0-\0u\0s\0e\0r\0\1\0\0\0\0\0\0\0", ) , 44, 1024, ... {status=0x103, info=180},  (392, 297, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0,\0\0\0\3\0\0\0\24\0\0\0\0\0\0\0\0\0\0\0sF\235\311\333?\334\21\261\310\0\14)\371\246\305", 44, 1024, ... {status=0x103, info=180}, "\5\0\2\3\20\0\0\0\264\0\0\0\2\0\0\0\234\0\0\0\0\0\0\0\230\254\25\0\1\0\0\0\244\254\25\0 \0\0\0\1\0\0\0\16\0\20\0\260\254\25\0\300\254\25\0\10\0\0\0\0\0\0\0\7\0\0\0M\0Y\0W\0O\0R\0L\0D\0O\0\4\0\0\0\1\4\0\0\0\0\0\5\25\0\0\0\3757B@\335\350\344\34C\27\122\1\0\0\0x\245\25\0\1\0\0\0\1\0\0\0\20\0\22\0\214\245\25\0\0\0\0\0\0\0\0\0\11\0\0\0\0\0\0\0\10\0\0\0S\0R\0I\0-\0u\0s\0e\0r\0\1\0\0\0\0\0\0\0", ) , ) == 0x103
 03080   396   NtClose  (388, ... ) == 0x0
 03081   396   NtClose  (392, ... ) == 0x0
 03082   396   NtOpenThreadToken  (-2, 0xc, 1, ... ) == STATUS_NO_TOKEN
 03083   396   NtCreateEvent  (0x1f0003, 0x0, 1, 0, ... 392, ) == 0x0
 03084   396   NtOpenThreadToken  (-2, 0xc, 1, ... ) == STATUS_NO_TOKEN
 03085   396   NtSetInformationThread  (-2, ImpersonationToken, {ImpToken=0,}, 4, ... ) == 0x0
 03086   396   NtCreateFile  (0xc0100080, {24, 0, 0x40, 0, 1235588,  (0xc0100080, {24, 0, 0x40, 0, 1235588, "\??\PIPE\lsarpc"}, 0x0, 0, 3, 1, 64, 0, 0, ... 388, {status=0x0, info=1}, ) }, 0x0, 0, 3, 1, 64, 0, 0, ... 388, {status=0x0, info=1}, ) == 0x0
 03087   396   NtSetInformationFile  (388, 1235644, 8, Pipe, ... {status=0x0, info=0}, ) == 0x0
 03088   396   NtSetInformationFile  (388, 1235636, 8, Completion, ... {status=0x0, info=0}, ) == 0x0
 03089   396   NtSetInformationThread  (-2, ImpersonationToken, {ImpToken=0,}, 4, ... ) == 0x0
 03090   396   NtWriteFile  (388, 297, 0, 0,  (388, 297, 0, 0, "\5\0\13\3\20\0\0\0H\0\0\0\1\0\0\0\270\20\270\20\0\0\0\0\1\0\0\0\0\0\1\0xW4\224\22\315\253\357\0\1#Eg\211\253\0\0\0\0\4]\210\212\353\34\311\21\237\350\10\0+\20H`\2\0\0\0", 72, {0, 0}, 0, ... {status=0x0, info=72}, ) , 72, {0, 0}, 0, ... {status=0x0, info=72}, ) == 0x0
 03091   396   NtReadFile  (388, 297, 0, 0, 1024, {0, 0}, 0, ... {status=0x0, info=68},  (388, 297, 0, 0, 1024, {0, 0}, 0, ... {status=0x0, info=68}, "\5\0\14\3\20\0\0\0D\0\0\0\1\0\0\0\270\20\270\20\227%\0\0\14\0\PIPE\lsass\0\0\0\1\0\0\0\0\0\0\0\4]\210\212\353\34\311\21\237\350\10\0+\20H`\2\0\0\0", ) , ) == 0x0
 03092   396   NtFsControlFile  (388, 297, 0x0, 0x0, 0x11c017,  (388, 297, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0@\0\0\0\1\0\0\0(\0\0\0\0\0,\0\0\0\0\0\30\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\08\341\22\0\14\0\0\0\2\0\1\0\0\10\0\0", 64, 1024, ... {status=0x103, info=68}, "\5\0\14\3\20\0\0\0D\0\0\0\1\0\0\0\270\20\270\20\227%\0\0\14\0\PIPE\lsass\0\0\0\1\0\0\0\0\0\0\0\4]\210\212\353\34\311\21\237\350\10\0+\20H`\2\0\0\0", ) , 64, 1024, ... {status=0x103, info=68},  (388, 297, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0@\0\0\0\1\0\0\0(\0\0\0\0\0,\0\0\0\0\0\30\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\08\341\22\0\14\0\0\0\2\0\1\0\0\10\0\0", 64, 1024, ... {status=0x103, info=68}, "\5\0\14\3\20\0\0\0D\0\0\0\1\0\0\0\270\20\270\20\227%\0\0\14\0\PIPE\lsass\0\0\0\1\0\0\0\0\0\0\0\4]\210\212\353\34\311\21\237\350\10\0+\20H`\2\0\0\0", ) , ) == 0x103
 03093   396   NtFsControlFile  (388, 297, 0x0, 0x0, 0x11c017,  (388, 297, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0t\0\0\0\2\0\0\0\\0\0\0\0\09\0\0\0\0\0tF\235\311\333?\334\21\261\310\0\14)\371\246\305\1\0\0\0p\341\22\0\1\0\0\00\335\25\0\5\0\0\0\1\5\0\0\0\0\0\5\25\0\0\0\3757B@\335\350\344\34C\27\122\353\3\0\0\0\0\0\0\0\0\0\0\1\0l\0\0\0\0\0\0\0\0\0\2\0\0\0", 116, 1024, ... {status=0x103, info=48}, "\5\0\2\3\20\0\0\00\0\0\0\1\0\0\0\30\0\0\0\0\0\0\0\0\0\0\0tF\235\311\333?\334\21\261\310\0\14)\371\246\305\0\0\0\0", ) , 116, 1024, ... {status=0x103, info=48},  (388, 297, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0t\0\0\0\2\0\0\0\\0\0\0\0\09\0\0\0\0\0tF\235\311\333?\334\21\261\310\0\14)\371\246\305\1\0\0\0p\341\22\0\1\0\0\00\335\25\0\5\0\0\0\1\5\0\0\0\0\0\5\25\0\0\0\3757B@\335\350\344\34C\27\122\353\3\0\0\0\0\0\0\0\0\0\0\1\0l\0\0\0\0\0\0\0\0\0\2\0\0\0", 116, 1024, ... {status=0x103, info=48}, "\5\0\2\3\20\0\0\00\0\0\0\1\0\0\0\30\0\0\0\0\0\0\0\0\0\0\0tF\235\311\333?\334\21\261\310\0\14)\371\246\305\0\0\0\0", ) , ) == 0x103
 03094   396   NtFsControlFile  (388, 297, 0x0, 0x0, 0x11c017,  (388, 297, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0,\0\0\0\3\0\0\0\24\0\0\0\0\0\0\0\0\0\0\0tF\235\311\333?\334\21\261\310\0\14)\371\246\305", 44, 1024, ... {status=0x103, info=180}, "\5\0\2\3\20\0\0\0\264\0\0\0\2\0\0\0\234\0\0\0\0\0\0\0\230\254\25\0\1\0\0\0\244\254\25\0 \0\0\0\1\0\0\0\16\0\20\0\260\254\25\0\300\254\25\0\10\0\0\0\0\0\0\0\7\0\0\0M\0Y\0W\0O\0R\0L\0D\0O\0\4\0\0\0\1\4\0\0\0\0\0\5\25\0\0\0\3757B@\335\350\344\34C\27\122\1\0\0\0x\245\25\0\1\0\0\0\1\0\0\0\20\0\22\0\214\245\25\0\0\0\0\0\0\0\0\0\11\0\0\0\0\0\0\0\10\0\0\0S\0R\0I\0-\0u\0s\0e\0r\0\1\0\0\0\0\0\0\0", ) , 44, 1024, ... {status=0x103, info=180},  (388, 297, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0,\0\0\0\3\0\0\0\24\0\0\0\0\0\0\0\0\0\0\0tF\235\311\333?\334\21\261\310\0\14)\371\246\305", 44, 1024, ... {status=0x103, info=180}, "\5\0\2\3\20\0\0\0\264\0\0\0\2\0\0\0\234\0\0\0\0\0\0\0\230\254\25\0\1\0\0\0\244\254\25\0 \0\0\0\1\0\0\0\16\0\20\0\260\254\25\0\300\254\25\0\10\0\0\0\0\0\0\0\7\0\0\0M\0Y\0W\0O\0R\0L\0D\0O\0\4\0\0\0\1\4\0\0\0\0\0\5\25\0\0\0\3757B@\335\350\344\34C\27\122\1\0\0\0x\245\25\0\1\0\0\0\1\0\0\0\20\0\22\0\214\245\25\0\0\0\0\0\0\0\0\0\11\0\0\0\0\0\0\0\10\0\0\0S\0R\0I\0-\0u\0s\0e\0r\0\1\0\0\0\0\0\0\0", ) , ) == 0x103
 03095   396   NtClose  (392, ... ) == 0x0
 03096   396   NtClose  (388, ... ) == 0x0
 03097   396   NtQueryVirtualMemory  (-1, 0xb00000, Basic, 28, ... {BaseAddress=0xb00000,AllocationBase=0xb00000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 0x0, ) == 0x0
 03098   396   NtQueryVirtualMemory  (-1, 0xb00000, Basic, 28, ... {BaseAddress=0xb00000,AllocationBase=0xb00000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 0x0, ) == 0x0
 03099   396   NtQueryInformationToken  (380, User, 200, ... {token info, class 1, size 36}, 36, ) == 0x0
 03100   396   NtOpenKey  (0x20019, {24, 48, 0x40, 0, 0,  (0x20019, {24, 48, 0x40, 0, 0, "Software\Microsoft\Windows NT\CurrentVersion\ProfileList\S-1-5-21-1078081533-484763869-839522115-1003"}, ... 388, ) }, ... 388, ) == 0x0
 03101   396   NtQueryValueKey  (388,  (388, "ProfileImagePath", Partial, 144, ... TitleIdx=0, Type=2, Data="%\0S\0y\0s\0t\0e\0m\0D\0r\0i\0v\0e\0%\0\\0D\0o\0c\0u\0m\0e\0n\0t\0s\0 \0a\0n\0d\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0S\0R\0I\0-\0u\0s\0e\0r\0\0\0"}, 104, ) , Partial, 144, ... TitleIdx=0, Type=2, Data= (388, "ProfileImagePath", Partial, 144, ... TitleIdx=0, Type=2, Data="%\0S\0y\0s\0t\0e\0m\0D\0r\0i\0v\0e\0%\0\\0D\0o\0c\0u\0m\0e\0n\0t\0s\0 \0a\0n\0d\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0S\0R\0I\0-\0u\0s\0e\0r\0\0\0"}, 104, ) }, 104, ) == 0x0
 03102   396   NtClose  (388, ... ) == 0x0
 03103   396   NtCreateKey  (0x2001f, {24, 376, 0x40, 0, 0,  (0x2001f, {24, 376, 0x40, 0, 0, "Software\Microsoft\Windows NT\CurrentVersion\Winlogon"}, 0, 0x0, 0, ... 388, 2, ) }, 0, 0x0, 0, ... 388, 2, ) == 0x0
 03104   396   NtQueryValueKey  (388,  (388, "ParseAutoexec", Partial, 144, ... TitleIdx=0, Type=1, Data="1\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (388, "ParseAutoexec", Partial, 144, ... TitleIdx=0, Type=1, Data="1\0\0\0"}, 16, ) }, 16, ) == 0x0
 03105   396   NtClose  (388, ... ) == 0x0
 03106   396   NtQueryInformationProcess  (-1, DefaultHardErrorMode, 4, ... {process info, class 12, size 4}, 0x0, ) == 0x0
 03107   396   NtSetInformationProcess  (-1, DefaultHardErrorMode, {process info, class 12, size 4}, 4, ... ) == 0x0
 03108   396   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\c:\autoexec.bat"}, 1237292, ... ) }, 1237292, ... ) == 0x0
 03109   396   NtCreateFile  (0x80100080, {24, 0, 0x40, 0, 1237300,  (0x80100080, {24, 0, 0x40, 0, 1237300, "\??\c:\autoexec.bat"}, 0x0, 128, 1, 1, 96, 0, 0, ... 388, {status=0x0, info=1}, ) }, 0x0, 128, 1, 1, 96, 0, 0, ... 388, {status=0x0, info=1}, ) == 0x0
 03110   396   NtQueryInformationProcess  (-1, DefaultHardErrorMode, 4, ... {process info, class 12, size 4}, 0x0, ) == 0x0
 03111   396   NtSetInformationProcess  (-1, DefaultHardErrorMode, {process info, class 12, size 4}, 4, ... ) == 0x0
 03112   396   NtQueryInformationFile  (388, 1237316, 24, Standard, ... {status=0x0, info=24}, ) == 0x0
 03113   396   NtReadFile  (388, 0, 0, 0, 0, 0x0, 0, ... {status=0x0, info=0}, "", ) == 0x0
 03114   396   NtClose  (388, ... ) == 0x0
 03115   396   NtOpenKey  (0x20019, {24, 376, 0x40, 0, 0,  (0x20019, {24, 376, 0x40, 0, 0, "Environment"}, ... 388, ) }, ... 388, ) == 0x0
 03116   396   NtAllocateVirtualMemory  (-1, 1445888, 0, 12288, 4096, 4, ... 1445888, 12288, ) == 0x0
 03117   396   NtEnumerateValueKey  (388, 0, Full, 220, ... TitleIdx=0, Type=2, Name= (388, 0, Full, 220, ... TitleIdx=0, Type=2, Name="TEMP", Data="%\0U\0S\0E\0R\0P\0R\0O\0F\0I\0L\0E\0%\0\\0L\0o\0c\0a\0l\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0T\0e\0m\0p\0\0\0"}, 96, ) , Data= (388, 0, Full, 220, ... TitleIdx=0, Type=2, Name="TEMP", Data="%\0U\0S\0E\0R\0P\0R\0O\0F\0I\0L\0E\0%\0\\0L\0o\0c\0a\0l\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0T\0e\0m\0p\0\0\0"}, 96, ) }, 96, ) == 0x0
 03118   396   NtEnumerateValueKey  (388, 1, Full, 220, ... TitleIdx=0, Type=2, Name= (388, 1, Full, 220, ... TitleIdx=0, Type=2, Name="TMP", Data="%\0U\0S\0E\0R\0P\0R\0O\0F\0I\0L\0E\0%\0\\0L\0o\0c\0a\0l\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0T\0e\0m\0p\0\0\0"}, 96, ) , Data= (388, 1, Full, 220, ... TitleIdx=0, Type=2, Name="TMP", Data="%\0U\0S\0E\0R\0P\0R\0O\0F\0I\0L\0E\0%\0\\0L\0o\0c\0a\0l\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0T\0e\0m\0p\0\0\0"}, 96, ) }, 96, ) == 0x0
 03119   396   NtEnumerateValueKey  (388, 2, Full, 220, ... ) == STATUS_NO_MORE_ENTRIES
 03120   396   NtEnumerateValueKey  (388, 0, Full, 220, ... TitleIdx=0, Type=2, Name= (388, 0, Full, 220, ... TitleIdx=0, Type=2, Name="TEMP", Data="%\0U\0S\0E\0R\0P\0R\0O\0F\0I\0L\0E\0%\0\\0L\0o\0c\0a\0l\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0T\0e\0m\0p\0\0\0"}, 96, ) , Data= (388, 0, Full, 220, ... TitleIdx=0, Type=2, Name="TEMP", Data="%\0U\0S\0E\0R\0P\0R\0O\0F\0I\0L\0E\0%\0\\0L\0o\0c\0a\0l\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0T\0e\0m\0p\0\0\0"}, 96, ) }, 96, ) == 0x0
 03121   396   NtQueryInformationProcess  (-1, DefaultHardErrorMode, 4, ... {process info, class 12, size 4}, 0x0, ) == 0x0
 03122   396   NtSetInformationProcess  (-1, DefaultHardErrorMode, {process info, class 12, size 4}, 4, ... ) == 0x0
 03123   396   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\Documents and Settings\SRI-user\Local Settings\Temp"}, 1236032, ... ) }, 1236032, ... ) == 0x0
 03124   396   NtOpenFile  (0x100001, {24, 0, 0x40, 0, 0,  (0x100001, {24, 0, 0x40, 0, 0, "\??\C:\"}, 3, 16417, ... 392, {status=0x0, info=1}, ) }, 3, 16417, ... 392, {status=0x0, info=1}, ) == 0x0
 03125   396   NtQueryDirectoryFile  (392, 0, 0, 0, 1235392, 616, BothDirectory, 1,  (392, 0, 0, 0, 1235392, 616, BothDirectory, 1, "Documents and Settings", 0, ... {status=0x0, info=138}, ) , 0, ... {status=0x0, info=138}, ) == 0x0
 03126   396   NtClose  (392, ... ) == 0x0
 03127   396   NtOpenFile  (0x100001, {24, 0, 0x40, 0, 0,  (0x100001, {24, 0, 0x40, 0, 0, "\??\C:\Documents and Settings\SRI-user\"}, 3, 16417, ... 392, {status=0x0, info=1}, ) }, 3, 16417, ... 392, {status=0x0, info=1}, ) == 0x0
 03128   396   NtQueryDirectoryFile  (392, 0, 0, 0, 1235392, 616, BothDirectory, 1,  (392, 0, 0, 0, 1235392, 616, BothDirectory, 1, "Local Settings", 0, ... {status=0x0, info=122}, ) , 0, ... {status=0x0, info=122}, ) == 0x0
 03129   396   NtClose  (392, ... ) == 0x0
 03130   396   NtQueryInformationProcess  (-1, DefaultHardErrorMode, 4, ... {process info, class 12, size 4}, 0x0, ) == 0x0
 03131   396   NtSetInformationProcess  (-1, DefaultHardErrorMode, {process info, class 12, size 4}, 4, ... ) == 0x0
 03132   396   NtQueryVirtualMemory  (-1, 0xb00000, Basic, 28, ... {BaseAddress=0xb00000,AllocationBase=0xb00000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 0x0, ) == 0x0
 03133   396   NtEnumerateValueKey  (388, 1, Full, 220, ... TitleIdx=0, Type=2, Name= (388, 1, Full, 220, ... TitleIdx=0, Type=2, Name="TMP", Data="%\0U\0S\0E\0R\0P\0R\0O\0F\0I\0L\0E\0%\0\\0L\0o\0c\0a\0l\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0T\0e\0m\0p\0\0\0"}, 96, ) , Data= (388, 1, Full, 220, ... TitleIdx=0, Type=2, Name="TMP", Data="%\0U\0S\0E\0R\0P\0R\0O\0F\0I\0L\0E\0%\0\\0L\0o\0c\0a\0l\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0T\0e\0m\0p\0\0\0"}, 96, ) }, 96, ) == 0x0
 03134   396   NtQueryInformationProcess  (-1, DefaultHardErrorMode, 4, ... {process info, class 12, size 4}, 0x0, ) == 0x0
 03135   396   NtSetInformationProcess  (-1, DefaultHardErrorMode, {process info, class 12, size 4}, 4, ... ) == 0x0
 03136   396   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\Documents and Settings\SRI-user\Local Settings\Temp"}, 1236032, ... ) }, 1236032, ... ) == 0x0
 03137   396   NtOpenFile  (0x100001, {24, 0, 0x40, 0, 0,  (0x100001, {24, 0, 0x40, 0, 0, "\??\C:\"}, 3, 16417, ... 392, {status=0x0, info=1}, ) }, 3, 16417, ... 392, {status=0x0, info=1}, ) == 0x0
 03138   396   NtQueryDirectoryFile  (392, 0, 0, 0, 1235392, 616, BothDirectory, 1,  (392, 0, 0, 0, 1235392, 616, BothDirectory, 1, "Documents and Settings", 0, ... {status=0x0, info=138}, ) , 0, ... {status=0x0, info=138}, ) == 0x0
 03139   396   NtClose  (392, ... ) == 0x0
 03140   396   NtOpenFile  (0x100001, {24, 0, 0x40, 0, 0,  (0x100001, {24, 0, 0x40, 0, 0, "\??\C:\Documents and Settings\SRI-user\"}, 3, 16417, ... 392, {status=0x0, info=1}, ) }, 3, 16417, ... 392, {status=0x0, info=1}, ) == 0x0
 03141   396   NtQueryDirectoryFile  (392, 0, 0, 0, 1235392, 616, BothDirectory, 1,  (392, 0, 0, 0, 1235392, 616, BothDirectory, 1, "Local Settings", 0, ... {status=0x0, info=122}, ) , 0, ... {status=0x0, info=122}, ) == 0x0
 03142   396   NtClose  (392, ... ) == 0x0
 03143   396   NtQueryInformationProcess  (-1, DefaultHardErrorMode, 4, ... {process info, class 12, size 4}, 0x0, ) == 0x0
 03144   396   NtSetInformationProcess  (-1, DefaultHardErrorMode, {process info, class 12, size 4}, 4, ... ) == 0x0
 03145   396   NtQueryVirtualMemory  (-1, 0xb00000, Basic, 28, ... {BaseAddress=0xb00000,AllocationBase=0xb00000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 0x0, ) == 0x0
 03146   396   NtEnumerateValueKey  (388, 2, Full, 220, ... ) == STATUS_NO_MORE_ENTRIES
 03147   396   NtClose  (388, ... ) == 0x0
 03148   396   NtOpenKey  (0x20019, {24, 376, 0x40, 0, 0,  (0x20019, {24, 376, 0x40, 0, 0, "Volatile Environment"}, ... 388, ) }, ... 388, ) == 0x0
 03149   396   NtEnumerateValueKey  (388, 0, Full, 220, ... TitleIdx=0, Type=1, Name= (388, 0, Full, 220, ... TitleIdx=0, Type=1, Name="LOGONSERVER", Data="\\0\\0M\0Y\0W\0O\0R\0L\0D\0\0\0"}, 64, ) , Data= (388, 0, Full, 220, ... TitleIdx=0, Type=1, Name="LOGONSERVER", Data="\\0\\0M\0Y\0W\0O\0R\0L\0D\0\0\0"}, 64, ) }, 64, ) == 0x0
 03150   396   NtQueryVirtualMemory  (-1, 0xb00000, Basic, 28, ... {BaseAddress=0xb00000,AllocationBase=0xb00000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 0x0, ) == 0x0
 03151   396   NtEnumerateValueKey  (388, 1, Full, 220, ... TitleIdx=0, Type=1, Name= (388, 1, Full, 220, ... TitleIdx=0, Type=1, Name="HOMEDRIVE", Data="C\0:\0\0\0"}, 46, ) , Data= (388, 1, Full, 220, ... TitleIdx=0, Type=1, Name="HOMEDRIVE", Data="C\0:\0\0\0"}, 46, ) }, 46, ) == 0x0
 03152   396   NtQueryVirtualMemory  (-1, 0xb00000, Basic, 28, ... {BaseAddress=0xb00000,AllocationBase=0xb00000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 0x0, ) == 0x0
 03153   396   NtEnumerateValueKey  (388, 2, Full, 220, ... TitleIdx=0, Type=1, Name= (388, 2, Full, 220, ... TitleIdx=0, Type=1, Name="HOMEPATH", Data="\\0D\0o\0c\0u\0m\0e\0n\0t\0s\0 \0a\0n\0d\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0S\0R\0I\0-\0u\0s\0e\0r\0\0\0"}, 102, ) , Data= (388, 2, Full, 220, ... TitleIdx=0, Type=1, Name="HOMEPATH", Data="\\0D\0o\0c\0u\0m\0e\0n\0t\0s\0 \0a\0n\0d\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0S\0R\0I\0-\0u\0s\0e\0r\0\0\0"}, 102, ) }, 102, ) == 0x0
 03154   396   NtQueryVirtualMemory  (-1, 0xb00000, Basic, 28, ... {BaseAddress=0xb00000,AllocationBase=0xb00000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 0x0, ) == 0x0
 03155   396   NtEnumerateValueKey  (388, 3, Full, 220, ... TitleIdx=0, Type=1, Name= (388, 3, Full, 220, ... TitleIdx=0, Type=1, Name="CLIENTNAME", Data="C\0o\0n\0s\0o\0l\0e\0\0\0"}, 56, ) , Data= (388, 3, Full, 220, ... TitleIdx=0, Type=1, Name="CLIENTNAME", Data="C\0o\0n\0s\0o\0l\0e\0\0\0"}, 56, ) }, 56, ) == 0x0
 03156   396   NtQueryVirtualMemory  (-1, 0xb00000, Basic, 28, ... {BaseAddress=0xb00000,AllocationBase=0xb00000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 0x0, ) == 0x0
 03157   396   NtEnumerateValueKey  (388, 4, Full, 220, ... TitleIdx=0, Type=1, Name= (388, 4, Full, 220, ... TitleIdx=0, Type=1, Name="SESSIONNAME", Data="C\0o\0n\0s\0o\0l\0e\0\0\0"}, 60, ) , Data= (388, 4, Full, 220, ... TitleIdx=0, Type=1, Name="SESSIONNAME", Data="C\0o\0n\0s\0o\0l\0e\0\0\0"}, 60, ) }, 60, ) == 0x0
 03158   396   NtQueryVirtualMemory  (-1, 0xb00000, Basic, 28, ... {BaseAddress=0xb00000,AllocationBase=0xb00000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 0x0, ) == 0x0
 03159   396   NtEnumerateValueKey  (388, 5, Full, 220, ... TitleIdx=0, Type=1, Name= (388, 5, Full, 220, ... TitleIdx=0, Type=1, Name="APPDATA", Data="C\0:\0\\0D\0o\0c\0u\0m\0e\0n\0t\0s\0 \0a\0n\0d\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0S\0R\0I\0-\0u\0s\0e\0r\0\\0A\0p\0p\0l\0i\0c\0a\0t\0i\0o\0n\0 \0D\0a\0t\0a\0\0\0"}, 140, ) , Data= (388, 5, Full, 220, ... TitleIdx=0, Type=1, Name="APPDATA", Data="C\0:\0\\0D\0o\0c\0u\0m\0e\0n\0t\0s\0 \0a\0n\0d\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0S\0R\0I\0-\0u\0s\0e\0r\0\\0A\0p\0p\0l\0i\0c\0a\0t\0i\0o\0n\0 \0D\0a\0t\0a\0\0\0"}, 140, ) }, 140, ) == 0x0
 03160   396   NtQueryVirtualMemory  (-1, 0xb00000, Basic, 28, ... {BaseAddress=0xb00000,AllocationBase=0xb00000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 0x0, ) == 0x0
 03161   396   NtEnumerateValueKey  (388, 6, Full, 220, ... TitleIdx=0, Type=1, Name= (388, 6, Full, 220, ... TitleIdx=0, Type=1, Name="HOMESHARE", Data="\0\0"}, 42, ) , Data= (388, 6, Full, 220, ... TitleIdx=0, Type=1, Name="HOMESHARE", Data="\0\0"}, 42, ) }, 42, ) == 0x0
 03162   396   NtEnumerateValueKey  (388, 7, Full, 220, ... ) == STATUS_NO_MORE_ENTRIES
 03163   396   NtEnumerateValueKey  (388, 0, Full, 220, ... TitleIdx=0, Type=1, Name= (388, 0, Full, 220, ... TitleIdx=0, Type=1, Name="LOGONSERVER", Data="\\0\\0M\0Y\0W\0O\0R\0L\0D\0\0\0"}, 64, ) , Data= (388, 0, Full, 220, ... TitleIdx=0, Type=1, Name="LOGONSERVER", Data="\\0\\0M\0Y\0W\0O\0R\0L\0D\0\0\0"}, 64, ) }, 64, ) == 0x0
 03164   396   NtEnumerateValueKey  (388, 1, Full, 220, ... TitleIdx=0, Type=1, Name= (388, 1, Full, 220, ... TitleIdx=0, Type=1, Name="HOMEDRIVE", Data="C\0:\0\0\0"}, 46, ) , Data= (388, 1, Full, 220, ... TitleIdx=0, Type=1, Name="HOMEDRIVE", Data="C\0:\0\0\0"}, 46, ) }, 46, ) == 0x0
 03165   396   NtEnumerateValueKey  (388, 2, Full, 220, ... TitleIdx=0, Type=1, Name= (388, 2, Full, 220, ... TitleIdx=0, Type=1, Name="HOMEPATH", Data="\\0D\0o\0c\0u\0m\0e\0n\0t\0s\0 \0a\0n\0d\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0S\0R\0I\0-\0u\0s\0e\0r\0\0\0"}, 102, ) , Data= (388, 2, Full, 220, ... TitleIdx=0, Type=1, Name="HOMEPATH", Data="\\0D\0o\0c\0u\0m\0e\0n\0t\0s\0 \0a\0n\0d\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0S\0R\0I\0-\0u\0s\0e\0r\0\0\0"}, 102, ) }, 102, ) == 0x0
 03166   396   NtEnumerateValueKey  (388, 3, Full, 220, ... TitleIdx=0, Type=1, Name= (388, 3, Full, 220, ... TitleIdx=0, Type=1, Name="CLIENTNAME", Data="C\0o\0n\0s\0o\0l\0e\0\0\0"}, 56, ) , Data= (388, 3, Full, 220, ... TitleIdx=0, Type=1, Name="CLIENTNAME", Data="C\0o\0n\0s\0o\0l\0e\0\0\0"}, 56, ) }, 56, ) == 0x0
 03167   396   NtEnumerateValueKey  (388, 4, Full, 220, ... TitleIdx=0, Type=1, Name= (388, 4, Full, 220, ... TitleIdx=0, Type=1, Name="SESSIONNAME", Data="C\0o\0n\0s\0o\0l\0e\0\0\0"}, 60, ) , Data= (388, 4, Full, 220, ... TitleIdx=0, Type=1, Name="SESSIONNAME", Data="C\0o\0n\0s\0o\0l\0e\0\0\0"}, 60, ) }, 60, ) == 0x0
 03168   396   NtEnumerateValueKey  (388, 5, Full, 220, ... TitleIdx=0, Type=1, Name= (388, 5, Full, 220, ... TitleIdx=0, Type=1, Name="APPDATA", Data="C\0:\0\\0D\0o\0c\0u\0m\0e\0n\0t\0s\0 \0a\0n\0d\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0S\0R\0I\0-\0u\0s\0e\0r\0\\0A\0p\0p\0l\0i\0c\0a\0t\0i\0o\0n\0 \0D\0a\0t\0a\0\0\0"}, 140, ) , Data= (388, 5, Full, 220, ... TitleIdx=0, Type=1, Name="APPDATA", Data="C\0:\0\\0D\0o\0c\0u\0m\0e\0n\0t\0s\0 \0a\0n\0d\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0S\0R\0I\0-\0u\0s\0e\0r\0\\0A\0p\0p\0l\0i\0c\0a\0t\0i\0o\0n\0 \0D\0a\0t\0a\0\0\0"}, 140, ) }, 140, ) == 0x0
 03169   396   NtEnumerateValueKey  (388, 6, Full, 220, ... TitleIdx=0, Type=1, Name= (388, 6, Full, 220, ... TitleIdx=0, Type=1, Name="HOMESHARE", Data="\0\0"}, 42, ) , Data= (388, 6, Full, 220, ... TitleIdx=0, Type=1, Name="HOMESHARE", Data="\0\0"}, 42, ) }, 42, ) == 0x0
 03170   396   NtEnumerateValueKey  (388, 7, Full, 220, ... ) == STATUS_NO_MORE_ENTRIES
 03171   396   NtClose  (388, ... ) == 0x0
 03172   396   NtClose  (376, ... ) == 0x0
 03173   396   NtFreeVirtualMemory  (-1, (0xb00000), 0, 32768, ... (0xb00000), 4096, ) == 0x0
 03174   396   NtClose  (384, ... ) == 0x0
 03175   396   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\Documents and Settings\SRI-user\Application Data"}, 1237956, ... ) }, 1237956, ... ) == 0x0
 03176   396   NtQueryInformationToken  (380, User, 64, ... {token info, class 1, size 36}, 36, ) == 0x0
 03177   396   NtOpenKey  (0x2001f, {24, 328, 0x40, 0, 0,  (0x2001f, {24, 328, 0x40, 0, 0, "S-1-5-21-1078081533-484763869-839522115-1003"}, ... 384, ) }, ... 384, ) == 0x0
 03178   396   NtCreateKey  (0x2000000, {24, 384, 0x40, 0, 0,  (0x2000000, {24, 384, 0x40, 0, 0, "Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders"}, 0, 0x0, 0, ... 376, 2, ) }, 0, 0x0, 0, ... 376, 2, ) == 0x0
 03179   396   NtClose  (384, ... ) == 0x0
 03180   396   NtSetValueKey  (376,  (376, "AppData", 0, 1, "C\0:\0\\0D\0o\0c\0u\0m\0e\0n\0t\0s\0 \0a\0n\0d\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0S\0R\0I\0-\0u\0s\0e\0r\0\\0A\0p\0p\0l\0i\0c\0a\0t\0i\0o\0n\0 \0D\0a\0t\0a\0\0\0", 104, ... ) , 0, 1,  (376, "AppData", 0, 1, "C\0:\0\\0D\0o\0c\0u\0m\0e\0n\0t\0s\0 \0a\0n\0d\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0S\0R\0I\0-\0u\0s\0e\0r\0\\0A\0p\0p\0l\0i\0c\0a\0t\0i\0o\0n\0 \0D\0a\0t\0a\0\0\0", 104, ... ) , 104, ... ) == 0x0
 03181   396   NtClose  (376, ... ) == 0x0
 03182   396   NtClose  (380, ... ) == 0x0
 03183   396   NtOpenFile  (0x100001, {24, 0, 0x40, 0, 0,  (0x100001, {24, 0, 0x40, 0, 0, "\??\C:\Documents and Settings\SRI-user\Application Data\Microsoft\Network\Connections\Pbk\"}, 3, 16417, ... ) }, 3, 16417, ... ) == STATUS_OBJECT_PATH_NOT_FOUND
 03184   396   NtWaitForSingleObject  (156, 0, 0x0, ... ) == 0x0
 03185   396   NtQueryInformationFile  (152, 1239004, 24, Standard, ... {status=0x0, info=24}, ) == 0x0
 03186   396   NtReleaseMutant  (156, ... 0x0, ) == 0x0
 03187   396   NtReleaseMutant  (200, ... 0x0, ) == 0x0
 03188   396   NtWaitForSingleObject  (72, 0, {0, 0}, ... ) == 0x102
 03189   396   NtWaitForSingleObject  (72, 0, {0, 0}, ... ) == 0x102
 03190   396   NtWaitForSingleObject  (72, 0, {0, 0}, ... ) == 0x102
 03191   396   NtWaitForSingleObject  (80, 0, {0, 0}, ... ) == 0x102
 03192   396   NtCreateEvent  (0x1f0003, 0x0, 1, 0, ... 380, ) == 0x0
 03193   396   NtConnectPort  ( ("\RPC Control\DNSResolver", {12, 2, 1, 1}, 0x0, 0x0, 1237144, 112, ... 376, 0x0, 0x0, 0x0, 112, ) , {12, 2, 1, 1}, 0x0, 0x0, 1237144, 112, ... 376, 0x0, 0x0, 0x0, 112, ) == 0x0
 03194   396   NtRequestWaitReplyPort  (376, {128, 152, new_msg, 0, 122476, 1310720, 1236908, 2012750850}  (376, {128, 152, new_msg, 0, 122476, 1310720, 1236908, 2012750850} "\0\346\22\0\2$\370w\370T\367w\1kwEVY\205D\237\200\364(\367\326\1)\2\0\0\0\1\0\0\0k\23\314w\4\0\0\0\20\344\314w\0\312\25\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\1\0\11\0\20\311\25\0\20\337\25\0\0\0\0\0f\0\0\03\0\0\0L\347\22\0\0\0\0\0\0\0\22\0H\340\22\0hE\25\0t\343\22\0\0\0\0\0\5\0\0\0\5\0\0\0" ... {128, 152, reply, 0, 316, 396, 1558, 0} "\7\346\22\0\2$\370w\370T\367w\1kwEVY\205D\237\200\364(\367\326\1)\2\0\0\0\1\0\0\0\0\0\0\0\4\0\0\0\20\344\314w\377\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\1\0\11\0\20\311\25\0\20\337\25\0\0\0\0\0f\0\0\03\0\0\0L\347\22\0\0\0\0\0\0\0\22\0H\340\22\0hE\25\0t\343\22\0\0\0\0\0\5\0\0\0\5\0\0\0" )  ... {128, 152, reply, 0, 316, 396, 1558, 0}  (376, {128, 152, new_msg, 0, 122476, 1310720, 1236908, 2012750850} "\0\346\22\0\2$\370w\370T\367w\1kwEVY\205D\237\200\364(\367\326\1)\2\0\0\0\1\0\0\0k\23\314w\4\0\0\0\20\344\314w\0\312\25\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\1\0\11\0\20\311\25\0\20\337\25\0\0\0\0\0f\0\0\03\0\0\0L\347\22\0\0\0\0\0\0\0\22\0H\340\22\0hE\25\0t\343\22\0\0\0\0\0\5\0\0\0\5\0\0\0" ... {128, 152, reply, 0, 316, 396, 1558, 0} "\7\346\22\0\2$\370w\370T\367w\1kwEVY\205D\237\200\364(\367\326\1)\2\0\0\0\1\0\0\0\0\0\0\0\4\0\0\0\20\344\314w\377\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\1\0\11\0\20\311\25\0\20\337\25\0\0\0\0\0f\0\0\03\0\0\0L\347\22\0\0\0\0\0\0\0\22\0H\340\22\0hE\25\0t\343\22\0\0\0\0\0\5\0\0\0\5\0\0\0" )  ) == 0x0
 03195   396   NtRequestWaitReplyPort  (376, {112, 136, new_msg, 0, 44, 3, 20, 0}  (376, {112, 136, new_msg, 0, 44, 3, 20, 0} "\1\0\0\0A\2\11\0\333?\334\21\261\310\0\14)\371\246\305\1\0\0\0\377\377\377\377\1\0\0\0\0\0\0\0,\10\25\0\25\0\0\0\0\0\0\0\25\0\0\0s\0r\0v\00\01\0.\0b\0a\0s\0h\0c\0h\0e\0l\0i\0k\0.\0c\0o\0m\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0" ... {44, 68, reply, 0, 316, 396, 1559, 0} "\2\240\372\177\1\00\300\0\0\0\0G\3\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\264\5\0\0\1\0\0\0" )  ... {44, 68, reply, 0, 316, 396, 1559, 0}  (376, {112, 136, new_msg, 0, 44, 3, 20, 0} "\1\0\0\0A\2\11\0\333?\334\21\261\310\0\14)\371\246\305\1\0\0\0\377\377\377\377\1\0\0\0\0\0\0\0,\10\25\0\25\0\0\0\0\0\0\0\25\0\0\0s\0r\0v\00\01\0.\0b\0a\0s\0h\0c\0h\0e\0l\0i\0k\0.\0c\0o\0m\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0" ... {44, 68, reply, 0, 316, 396, 1559, 0} "\2\240\372\177\1\00\300\0\0\0\0G\3\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\264\5\0\0\1\0\0\0" )  ) == 0x0
 03196   396   NtClose  (380, ... ) == 0x0
 03197   396   NtClose  (376, ... ) == 0x0
 03198   396   NtCreateFile  (0x3, {24, 0, 0x40, 0, 0,  (0x3, {24, 0, 0x40, 0, 0, "\Device\RasAcd"}, 0x0, 128, 3, 3, 0, 0, 0, ... 376, {status=0x0, info=0}, ) }, 0x0, 128, 3, 3, 0, 0, 0, ... 376, {status=0x0, info=0}, ) == 0x0
 03199   396   NtCreateEvent  (0x1f0003, 0x0, 1, 0, ... 380, ) == 0x0
 03200   396   NtDeviceIoControlFile  (376, 380, 0x0, 0x0, 0xf14014,  (376, 380, 0x0, 0x0, 0xf14014, "\3\0\0\0srv01.bashchelik.com\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0", 1552, 0, ... ) , 1552, 0, ... ) == STATUS_UNSUCCESSFUL
 03201   396   NtClose  (380, ... ) == 0x0
 03202   396   NtClose  (376, ... ) == 0x0
 03203   396   NtClearEvent  (352, ... ) == 0x0
 03204   396   NtSetEvent  (352, ... 0x0, ) == 0x0
 03205   396   NtClose  (352, ... ) == 0x0
 03206   396   NtWaitForSingleObject  (80, 0, {0, 0}, ... ) == 0x102
 03207   396   NtCreateEvent  (0x1f0003, 0x0, 1, 0, ... 352, ) == 0x0
 03208   396   NtConnectPort  ( ("\RPC Control\DNSResolver", {12, 2, 1, 1}, 0x0, 0x0, 1238448, 112, ... 376, 0x0, 0x0, 0x0, 112, ) , {12, 2, 1, 1}, 0x0, 0x0, 1238448, 112, ... 376, 0x0, 0x0, 0x0, 112, ) == 0x0
 03209   396   NtRequestWaitReplyPort  (376, {128, 152, new_msg, 0, 123780, 1310720, 1238212, 2012750850}  (376, {128, 152, new_msg, 0, 123780, 1310720, 1238212, 2012750850} "\0\353\22\0\2$\370w\370T\367w\1kwEVY\205D\237\200\364(\367\326\1)\2\0\0\0\1\0\0\0k\23\314w\4\0\0\0\20\344\314w\300\356\25\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\1\0\12\0\350\352\25\0\240\255\25\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\5\0\0\0\5\0\0\0" ... {128, 152, reply, 0, 316, 396, 1562, 0} "\7\353\22\0\2$\370w\370T\367w\1kwEVY\205D\237\200\364(\367\326\1)\2\0\0\0\1\0\0\0\0\0\0\0\4\0\0\0\20\344\314w\377\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\1\0\12\0\350\352\25\0\240\255\25\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\5\0\0\0\5\0\0\0" )  ... {128, 152, reply, 0, 316, 396, 1562, 0}  (376, {128, 152, new_msg, 0, 123780, 1310720, 1238212, 2012750850} "\0\353\22\0\2$\370w\370T\367w\1kwEVY\205D\237\200\364(\367\326\1)\2\0\0\0\1\0\0\0k\23\314w\4\0\0\0\20\344\314w\300\356\25\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\1\0\12\0\350\352\25\0\240\255\25\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\5\0\0\0\5\0\0\0" ... {128, 152, reply, 0, 316, 396, 1562, 0} "\7\353\22\0\2$\370w\370T\367w\1kwEVY\205D\237\200\364(\367\326\1)\2\0\0\0\1\0\0\0\0\0\0\0\4\0\0\0\20\344\314w\377\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\1\0\12\0\350\352\25\0\240\255\25\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\5\0\0\0\5\0\0\0" )  ) == 0x0
 03210   396   NtRequestWaitReplyPort  (376, {64, 88, new_msg, 0, 316, 396, 1559, 0}  (376, {64, 88, new_msg, 0, 316, 396, 1559, 0} "\1\240\0\0A\2\10\0\0\0\0\0G\3\0\0\0\0\0\0\0\0\0\0\377\377\377\377\0\0\0\0\0\0\0\0\21\0\0\0\0\0\0\0\0\0\0\0\25\0\0\0s\0r\0v\00\01\0.\0" ... {52, 76, reply, 0, 316, 396, 1563, 0} "\2\240\372\177\1\00\300\0\0\0\0G\3\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\200]\12\0\1\0\0\0\1\0\0\0\300\250|\201\377\377\377\0" )  ... {52, 76, reply, 0, 316, 396, 1563, 0}  (376, {64, 88, new_msg, 0, 316, 396, 1559, 0} "\1\240\0\0A\2\10\0\0\0\0\0G\3\0\0\0\0\0\0\0\0\0\0\377\377\377\377\0\0\0\0\0\0\0\0\21\0\0\0\0\0\0\0\0\0\0\0\25\0\0\0s\0r\0v\00\01\0.\0" ... {52, 76, reply, 0, 316, 396, 1563, 0} "\2\240\372\177\1\00\300\0\0\0\0G\3\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\200]\12\0\1\0\0\0\1\0\0\0\300\250|\201\377\377\377\0" )  ) == 0x0
 03211   396   NtClose  (352, ... ) == 0x0
 03212   396   NtClose  (376, ... ) == 0x0
 03213   396   NtCreateKey  (0x20019, {24, 48, 0x40, 0, 0,  (0x20019, {24, 48, 0x40, 0, 0, "System\CurrentControlSet\Services\Tcpip\Parameters"}, 0, "Class", 0, ... 376, 2, ) }, 0,  (0x20019, {24, 48, 0x40, 0, 0, "System\CurrentControlSet\Services\Tcpip\Parameters"}, 0, "Class", 0, ... 376, 2, ) , 0, ... 376, 2, ) == 0x0
 03214   396   NtOpenKey  (0x20019, {24, 48, 0x40, 0, 0,  (0x20019, {24, 48, 0x40, 0, 0, "System\CurrentControlSet\Services\DnsCache\Parameters"}, ... 352, ) }, ... 352, ) == 0x0
 03215   396   NtOpenKey  (0x20019, {24, 48, 0x40, 0, 0,  (0x20019, {24, 48, 0x40, 0, 0, "Software\Policies\Microsoft\Windows NT\DnsClient"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 03216   396   NtQueryValueKey  (376,  (376, "Hostname", Partial, 144, ... TitleIdx=0, Type=1, Data="M\0Y\0W\0O\0R\0L\0D\0\0\0"}, 28, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (376, "Hostname", Partial, 144, ... TitleIdx=0, Type=1, Data="M\0Y\0W\0O\0R\0L\0D\0\0\0"}, 28, ) }, 28, ) == 0x0
 03217   396   NtQueryValueKey  (376,  (376, "Hostname", Partial, 144, ... TitleIdx=0, Type=1, Data="M\0Y\0W\0O\0R\0L\0D\0\0\0"}, 28, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (376, "Hostname", Partial, 144, ... TitleIdx=0, Type=1, Data="M\0Y\0W\0O\0R\0L\0D\0\0\0"}, 28, ) }, 28, ) == 0x0
 03218   396   NtClose  (376, ... ) == 0x0
 03219   396   NtClose  (352, ... ) == 0x0
 03220   396   NtCreateKey  (0x20019, {24, 48, 0x40, 0, 0,  (0x20019, {24, 48, 0x40, 0, 0, "System\CurrentControlSet\Services\Tcpip\Parameters"}, 0, "Class", 0, ... 352, 2, ) }, 0,  (0x20019, {24, 48, 0x40, 0, 0, "System\CurrentControlSet\Services\Tcpip\Parameters"}, 0, "Class", 0, ... 352, 2, ) , 0, ... 352, 2, ) == 0x0
 03221   396   NtOpenKey  (0x20019, {24, 48, 0x40, 0, 0,  (0x20019, {24, 48, 0x40, 0, 0, "System\CurrentControlSet\Services\DnsCache\Parameters"}, ... 376, ) }, ... 376, ) == 0x0
 03222   396   NtOpenKey  (0x20019, {24, 48, 0x40, 0, 0,  (0x20019, {24, 48, 0x40, 0, 0, "Software\Policies\Microsoft\Windows NT\DnsClient"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 03223   396   NtQueryValueKey  (352,  (352, "Domain", Partial, 144, ... TitleIdx=0, Type=1, Data="\0\0"}, 14, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (352, "Domain", Partial, 144, ... TitleIdx=0, Type=1, Data="\0\0"}, 14, ) }, 14, ) == 0x0
 03224   396   NtQueryValueKey  (352,  (352, "Domain", Partial, 144, ... TitleIdx=0, Type=1, Data="\0\0"}, 14, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (352, "Domain", Partial, 144, ... TitleIdx=0, Type=1, Data="\0\0"}, 14, ) }, 14, ) == 0x0
 03225   396   NtClose  (352, ... ) == 0x0
 03226   396   NtClose  (376, ... ) == 0x0
 03227   396   NtWaitForSingleObject  (80, 0, {0, 0}, ... ) == 0x102
 03228   396   NtCreateEvent  (0x1f0003, 0x0, 1, 0, ... 376, ) == 0x0
 03229   396   NtConnectPort  ( ("\RPC Control\DNSResolver", {12, 2, 1, 1}, 0x0, 0x0, 1238248, 112, ... 352, 0x0, 0x0, 0x0, 112, ) , {12, 2, 1, 1}, 0x0, 0x0, 1238248, 112, ... 352, 0x0, 0x0, 0x0, 112, ) == 0x0
 03230   396   NtRequestWaitReplyPort  (352, {128, 152, new_msg, 0, 123580, 1310720, 1238012, 2012750850}  (352, {128, 152, new_msg, 0, 123580, 1310720, 1238012, 2012750850} "\0\352\22\0\2$\370w\370T\367w\1kwEVY\205D\237\200\364(\367\326\1)\2\0\0\0\1\0\0\0k\23\314w\4\0\0\0\20\344\314w\300\356\25\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\1\0\13\0\350\352\25\0(\251\25\0\0\0\0\0l\347\22\0\34\347\22\0\14\351\22\0\0\0\0\0\0\0\25\0\377\377\377\377\365\26\365w\315\27\365w\0\0\0\0\5\0\0\0\5\0\0\0" ... {128, 152, reply, 0, 316, 396, 1566, 0} "\7\352\22\0\2$\370w\370T\367w\1kwEVY\205D\237\200\364(\367\326\1)\2\0\0\0\1\0\0\0\0\0\0\0\4\0\0\0\20\344\314w\377\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\1\0\13\0\350\352\25\0(\251\25\0\0\0\0\0l\347\22\0\34\347\22\0\14\351\22\0\0\0\0\0\0\0\25\0\377\377\377\377\365\26\365w\315\27\365w\0\0\0\0\5\0\0\0\5\0\0\0" )  ... {128, 152, reply, 0, 316, 396, 1566, 0}  (352, {128, 152, new_msg, 0, 123580, 1310720, 1238012, 2012750850} "\0\352\22\0\2$\370w\370T\367w\1kwEVY\205D\237\200\364(\367\326\1)\2\0\0\0\1\0\0\0k\23\314w\4\0\0\0\20\344\314w\300\356\25\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\1\0\13\0\350\352\25\0(\251\25\0\0\0\0\0l\347\22\0\34\347\22\0\14\351\22\0\0\0\0\0\0\0\25\0\377\377\377\377\365\26\365w\315\27\365w\0\0\0\0\5\0\0\0\5\0\0\0" ... {128, 152, reply, 0, 316, 396, 1566, 0} "\7\352\22\0\2$\370w\370T\367w\1kwEVY\205D\237\200\364(\367\326\1)\2\0\0\0\1\0\0\0\0\0\0\0\4\0\0\0\20\344\314w\377\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\1\0\13\0\350\352\25\0(\251\25\0\0\0\0\0l\347\22\0\34\347\22\0\14\351\22\0\0\0\0\0\0\0\25\0\377\377\377\377\365\26\365w\315\27\365w\0\0\0\0\5\0\0\0\5\0\0\0" )  ) == 0x0
 03231   396   NtRequestWaitReplyPort  (352, {64, 88, new_msg, 0, 316, 396, 1563, 0}  (352, {64, 88, new_msg, 0, 316, 396, 1563, 0} "\1\240\0\0A\2\10\0\0\0\0\0G\3\0\0\0\0\0\0\0\0\0\0\377\377\377\377\0\0\0\0\0\0\0\0\21\0\0\0\0\0\0\0\0\0\0\0\377\377\377\0s\0r\0v\00\01\0.\0" ... {52, 76, reply, 0, 316, 396, 1567, 0} "\2\240\372\177\1\00\300\0\0\0\0G\3\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\200]\12\0\1\0\0\0\1\0\0\0\300\250|\201\377\377\377\0" )  ... {52, 76, reply, 0, 316, 396, 1567, 0}  (352, {64, 88, new_msg, 0, 316, 396, 1563, 0} "\1\240\0\0A\2\10\0\0\0\0\0G\3\0\0\0\0\0\0\0\0\0\0\377\377\377\377\0\0\0\0\0\0\0\0\21\0\0\0\0\0\0\0\0\0\0\0\377\377\377\0s\0r\0v\00\01\0.\0" ... {52, 76, reply, 0, 316, 396, 1567, 0} "\2\240\372\177\1\00\300\0\0\0\0G\3\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\200]\12\0\1\0\0\0\1\0\0\0\300\250|\201\377\377\377\0" )  ) == 0x0
 03232   396   NtClose  (376, ... ) == 0x0
 03233   396   NtClose  (352, ... ) == 0x0
 03234   396   NtCreateKey  (0x20019, {24, 48, 0x40, 0, 0,  (0x20019, {24, 48, 0x40, 0, 0, "System\CurrentControlSet\Services\Tcpip\Parameters"}, 0, "Class", 0, ... 352, 2, ) }, 0,  (0x20019, {24, 48, 0x40, 0, 0, "System\CurrentControlSet\Services\Tcpip\Parameters"}, 0, "Class", 0, ... 352, 2, ) , 0, ... 352, 2, ) == 0x0
 03235   396   NtOpenKey  (0x20019, {24, 48, 0x40, 0, 0,  (0x20019, {24, 48, 0x40, 0, 0, "System\CurrentControlSet\Services\DnsCache\Parameters"}, ... 376, ) }, ... 376, ) == 0x0
 03236   396   NtOpenKey  (0x20019, {24, 48, 0x40, 0, 0,  (0x20019, {24, 48, 0x40, 0, 0, "Software\Policies\Microsoft\Windows NT\DnsClient"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 03237   396   NtQueryValueKey  (352,  (352, "Hostname", Partial, 144, ... TitleIdx=0, Type=1, Data="M\0Y\0W\0O\0R\0L\0D\0\0\0"}, 28, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (352, "Hostname", Partial, 144, ... TitleIdx=0, Type=1, Data="M\0Y\0W\0O\0R\0L\0D\0\0\0"}, 28, ) }, 28, ) == 0x0
 03238   396   NtQueryValueKey  (352,  (352, "Hostname", Partial, 144, ... TitleIdx=0, Type=1, Data="M\0Y\0W\0O\0R\0L\0D\0\0\0"}, 28, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (352, "Hostname", Partial, 144, ... TitleIdx=0, Type=1, Data="M\0Y\0W\0O\0R\0L\0D\0\0\0"}, 28, ) }, 28, ) == 0x0
 03239   396   NtClose  (352, ... ) == 0x0
 03240   396   NtClose  (376, ... ) == 0x0
 03241   396   NtCreateKey  (0x20019, {24, 48, 0x40, 0, 0,  (0x20019, {24, 48, 0x40, 0, 0, "System\CurrentControlSet\Services\Tcpip\Parameters"}, 0, "Class", 0, ... 376, 2, ) }, 0,  (0x20019, {24, 48, 0x40, 0, 0, "System\CurrentControlSet\Services\Tcpip\Parameters"}, 0, "Class", 0, ... 376, 2, ) , 0, ... 376, 2, ) == 0x0
 03242   396   NtOpenKey  (0x20019, {24, 48, 0x40, 0, 0,  (0x20019, {24, 48, 0x40, 0, 0, "System\CurrentControlSet\Services\DnsCache\Parameters"}, ... 352, ) }, ... 352, ) == 0x0
 03243   396   NtOpenKey  (0x20019, {24, 48, 0x40, 0, 0,  (0x20019, {24, 48, 0x40, 0, 0, "Software\Policies\Microsoft\Windows NT\DnsClient"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 03244   396   NtQueryValueKey  (376,  (376, "Domain", Partial, 144, ... TitleIdx=0, Type=1, Data="\0\0"}, 14, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (376, "Domain", Partial, 144, ... TitleIdx=0, Type=1, Data="\0\0"}, 14, ) }, 14, ) == 0x0
 03245   396   NtQueryValueKey  (376,  (376, "Domain", Partial, 144, ... TitleIdx=0, Type=1, Data="\0\0"}, 14, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (376, "Domain", Partial, 144, ... TitleIdx=0, Type=1, Data="\0\0"}, 14, ) }, 14, ) == 0x0
 03246   396   NtClose  (376, ... ) == 0x0
 03247   396   NtClose  (352, ... ) == 0x0
 03248   396   NtCreateFile  (0x3, {24, 0, 0x40, 0, 0,  (0x3, {24, 0, 0x40, 0, 0, "\Device\RasAcd"}, 0x0, 128, 3, 3, 0, 0, 0, ... 352, {status=0x0, info=0}, ) }, 0x0, 128, 3, 3, 0, 0, 0, ... 352, {status=0x0, info=0}, ) == 0x0
 03249   396   NtCreateEvent  (0x1f0003, 0x0, 1, 0, ... 376, ) == 0x0
 03250   396   NtDeviceIoControlFile  (352, 376, 0x0, 0x0, 0xf14014,  (352, 376, 0x0, 0x0, 0xf14014, "\3\0\0\0MYWORLD\0\231%\362v\2\0\0\200\330\304\362v\0\0\0\0d\352\22\0O\345\367w{\30\335w\0\0\0\0\300.\24\0\0\0\24\0\320\357\25\0\0\0\0\0t\353\22\0\277\37\365w\0\0\24\0\203 \365w\10\6\24\0\215\26\365w\0\0\0\0\320\354\25\0\20:\25\0\24\232\347w3\355\26\0\340\356\25\0\356\356\25\04\355\25\0\377\377\0\0\0\0\0\04\355\25\0\7\0\0\0\340\356\25\0 \353\22\0\177;\245q\0\0\0\0\0\0\0\0\340\356\25\0\0\0\0\04\355\25\0\377\377\0\0\1\0\0\0p\312\25\0\330\357\25\04\355\25\0\300\356\25\0\210\1\24\0\320\357\25\0\0\0\0\0\0\0\0\0\0\0\0\0\365<\245q(\355\25\0\24\355\25\0\2\0\0\0\20\0\0\0\0\0\0\0\0\0\0\0\20\0\0\0\20:\1\1\0\0\24\0\270\352\22\0\230\357\22\0\330\374\22\0\2$\370w\370T\367wa/\245q\2642\250q\0\0\0\0\0\0\0\0:/\245q\20:\25\0\370\305\25\0P\257\25\0h\257\25\0\340\356\25\0\356\356\25\04\355\25\0\377\377\0\0\0\0\0\04\355\25\0\7\0\0\0\340\356\25\0\350\353\22\0\177;\245q\0\0\0\0\0\0\0\0\340\356\25\0\0\0\0\04\355\25\0\377\377\0\0\1\0\0\0p\312\25\0\250\337\25\0\4\0\0\0\0\0\0\0\210\1\24\0\240\337\25\0\0\0\0\0\0\0\0\0\0\0\0\0\365<\245q(\355\25\0\24\355\25\0\2\0\0\0\20\0\0\0\0\0\0\0\0\0\0\0\20\0\0\0\240\25\1\1\0\0\24\0\200\353\22\0`\360\22\0\330\374\22\0\2$\370w\370T\367wa/\245q\2642\250q\0\0\0\0\0\0\0\0:/\245q\240\25\25\0\370\305\25\0P\257\25\0", 1552, 0, ... {status=0x0, info=0}, 0x0, ) , 1552, 0, ... {status=0x0, info=0}, 0x0, ) == 0x0
 03251   396   NtClose  (376, ... ) == 0x0
 03252   396   NtClose  (352, ... ) == 0x0
 03253   396   NtCreateKey  (0x2000000, {24, 60, 0x40, 0, 0,  (0x2000000, {24, 60, 0x40, 0, 0, "Software\cv3"}, 0, 0x0, 0, ... 352, 2, ) }, 0, 0x0, 0, ... 352, 2, ) == 0x0
 03254   396   NtQueryValueKey  (352,  (352, "n", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (352, "n", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) }, 16, ) == 0x0
 03255   396   NtClose  (352, ... ) == 0x0
 03256   396   NtCreateEvent  (0x1f0003, 0x0, 1, 1, ... 352, ) == 0x0
 03257   396   NtWaitForSingleObject  (352, 0, 0x0, ... ) == 0x0
 03258   396   NtClearEvent  (352, ... ) == 0x0
 03259   396   NtSetEvent  (352, ... 0x0, ) == 0x0
 03260   396   NtWaitForSingleObject  (156, 0, 0x0, ... ) == 0x0
 03261   396   NtQueryInformationFile  (152, 1240908, 24, Standard, ... {status=0x0, info=24}, ) == 0x0
 03262   396   NtReleaseMutant  (156, ... 0x0, ) == 0x0
 03263   396   NtOpenKey  (0x20019, {24, 60, 0x40, 0, 0,  (0x20019, {24, 60, 0x40, 0, 0, "SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Http Filters\RPA"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 03264   396   NtOpenKey  (0x20019, {24, 48, 0x40, 0, 0,  (0x20019, {24, 48, 0x40, 0, 0, "SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Http Filters\RPA"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 03265   396   NtWaitForSingleObject  (200, 0, 0x0, ... ) == 0x0
 03266   396   NtWaitForSingleObject  (204, 0, 0x0, ... ) == 0x0
 03267   396   NtReleaseMutant  (204, ... 0x0, ) == 0x0
 03268   396   NtQueryValueKey  (108,  (108, "EnableAutodial", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (108, "EnableAutodial", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) }, 16, ) == 0x0
 03269   396   NtQueryValueKey  (108,  (108, "NoNetAutodial", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (108, "NoNetAutodial", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) }, 16, ) == 0x0
 03270   396   NtWaitForSingleObject  (156, 0, 0x0, ... ) == 0x0
 03271   396   NtQueryInformationFile  (152, 1241104, 24, Standard, ... {status=0x0, info=24}, ) == 0x0
 03272   396   NtReleaseMutant  (156, ... 0x0, ) == 0x0
 03273   396   NtReleaseMutant  (200, ... 0x0, ) == 0x0
 03274   396   NtWaitForSingleObject  (356, 0, 0x0, ... ) == 0x0
 03275   396   NtReleaseMutant  (356, ... 0x0, ) == 0x0
 03276   396   NtOpenKey  (0x20019, {24, 364, 0x40, 0, 0,  (0x20019, {24, 364, 0x40, 0, 0, "Domains\bashchelik.com"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 03277   396   NtOpenKey  (0x20019, {24, 48, 0x40, 0, 0,  (0x20019, {24, 48, 0x40, 0, 0, "Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\bashchelik.com"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 03278   396   NtQueryValueKey  (364,  (364, "IntranetName", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (364, "IntranetName", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) }, 16, ) == 0x0
 03279   396   NtQueryValueKey  (364,  (364, "ProxyBypass", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (364, "ProxyBypass", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) }, 16, ) == 0x0
 03280   396   NtClearEvent  (188, ... ) == 0x0
 03281   396   NtSetEvent  (188, ... 0x0, ) == 0x0
 03282   396   NtOpenKey  (0x20019, {24, 364, 0x40, 0, 0,  (0x20019, {24, 364, 0x40, 0, 0, "ProtocolDefaults\"}, ... 376, ) }, ... 376, ) == 0x0
 03283   396   NtQueryValueKey  (376,  (376, "http", Partial, 144, ... TitleIdx=0, Type=4, Data="\3\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (376, "http", Partial, 144, ... TitleIdx=0, Type=4, Data="\3\0\0\0"}, 16, ) }, 16, ) == 0x0
 03284   396   NtClose  (376, ... ) == 0x0
 03285   396   NtWaitForSingleObject  (356, 0, 0x0, ... ) == 0x0
 03286   396   NtReleaseMutant  (356, ... 0x0, ) == 0x0
 03287   396   NtWaitForSingleObject  (356, 0, 0x0, ... ) == 0x0
 03288   396   NtReleaseMutant  (356, ... 0x0, ) == 0x0
 03289   396   NtWaitForSingleObject  (360, 0, 0x0, ... ) == 0x0
 03290   396   NtReleaseMutant  (360, ... 0x0, ) == 0x0
 03291   396   NtWaitForSingleObject  (156, 0, 0x0, ... ) == 0x0
 03292   396   NtQueryInformationFile  (152, 1241352, 24, Standard, ... {status=0x0, info=24}, ) == 0x0
 03293   396   NtReleaseMutant  (156, ... 0x0, ) == 0x0
 03294   396   NtWaitForSingleObject  (80, 0, {0, 0}, ... ) == 0x102
 03295   396   NtCreateEvent  (0x1f0003, 0x0, 1, 0, ... 376, ) == 0x0
 03296   396   NtConnectPort  ( ("\RPC Control\DNSResolver", {12, 2, 1, 1}, 0x0, 0x0, 1237812, 112, ... 380, 0x0, 0x0, 0x0, 112, ) , {12, 2, 1, 1}, 0x0, 0x0, 1237812, 112, ... 380, 0x0, 0x0, 0x0, 112, ) == 0x0
 03297   396   NtRequestWaitReplyPort  (380, {128, 152, new_msg, 0, 1310720, 123144, 1310720, 1237576}  (380, {128, 152, new_msg, 0, 1310720, 123144, 1310720, 1237576} "\0$\370w\370\350\22\0\2$\370w\1kwEVY\205D\237\200\364(\367\326\1)\2\0\0\0\1\0\0\0\0\312\25\0\4\0\0\0\0\312\25\0\20\344\314w\0\312\25\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\1\0\14\0\20\311\25\0\230\327\25\0\0\0\0\0\0\0\0\0\0\0\0\0\330\330\25\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0 U\367w\5\0\0\0" ... {128, 152, reply, 0, 316, 396, 1570, 0} "\7$\370w\370\350\22\0\2$\370w\1kwEVY\205D\237\200\364(\367\326\1)\2\0\0\0\1\0\0\0\0\0\0\0\4\0\0\0\0\312\25\0\377\377\377\377\0\312\25\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\1\0\14\0\20\311\25\0\230\327\25\0\0\0\0\0\0\0\0\0\0\0\0\0\330\330\25\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0 U\367w\5\0\0\0" )  ... {128, 152, reply, 0, 316, 396, 1570, 0}  (380, {128, 152, new_msg, 0, 1310720, 123144, 1310720, 1237576} "\0$\370w\370\350\22\0\2$\370w\1kwEVY\205D\237\200\364(\367\326\1)\2\0\0\0\1\0\0\0\0\312\25\0\4\0\0\0\0\312\25\0\20\344\314w\0\312\25\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\1\0\14\0\20\311\25\0\230\327\25\0\0\0\0\0\0\0\0\0\0\0\0\0\330\330\25\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0 U\367w\5\0\0\0" ... {128, 152, reply, 0, 316, 396, 1570, 0} "\7$\370w\370\350\22\0\2$\370w\1kwEVY\205D\237\200\364(\367\326\1)\2\0\0\0\1\0\0\0\0\0\0\0\4\0\0\0\0\312\25\0\377\377\377\377\0\312\25\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\1\0\14\0\20\311\25\0\230\327\25\0\0\0\0\0\0\0\0\0\0\0\0\0\330\330\25\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0 U\367w\5\0\0\0" )  ) == 0x0
 03298   396   NtRequestWaitReplyPort  (380, {64, 88, new_msg, 0, 316, 396, 1567, 0}  (380, {64, 88, new_msg, 0, 316, 396, 1567, 0} "\1\240\0\0A\2\10\0\0\0\0\0G\3\0\0\0\0\0\0\0\0\0\0\377\377\377\377\0\0\0\0\0\0\0\0\21\0\0\0\0\0\0\0\0\0\0\0\377\377\377\0s\0r\0v\00\01\0.\0" ... {52, 76, reply, 0, 316, 396, 1571, 0} "\2\240\372\177\1\00\300\0\0\0\0G\3\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\200]\12\0\1\0\0\0\1\0\0\0\300\250|\201\377\377\377\0" )  ... {52, 76, reply, 0, 316, 396, 1571, 0}  (380, {64, 88, new_msg, 0, 316, 396, 1567, 0} "\1\240\0\0A\2\10\0\0\0\0\0G\3\0\0\0\0\0\0\0\0\0\0\377\377\377\377\0\0\0\0\0\0\0\0\21\0\0\0\0\0\0\0\0\0\0\0\377\377\377\0s\0r\0v\00\01\0.\0" ... {52, 76, reply, 0, 316, 396, 1571, 0} "\2\240\372\177\1\00\300\0\0\0\0G\3\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\200]\12\0\1\0\0\0\1\0\0\0\300\250|\201\377\377\377\0" )  ) == 0x0
 03299   396   NtClose  (376, ... ) == 0x0
 03300   396   NtClose  (380, ... ) == 0x0
 03301   396   NtCreateKey  (0x20019, {24, 48, 0x40, 0, 0,  (0x20019, {24, 48, 0x40, 0, 0, "System\CurrentControlSet\Services\Tcpip\Parameters"}, 0, "Class", 0, ... 380, 2, ) }, 0,  (0x20019, {24, 48, 0x40, 0, 0, "System\CurrentControlSet\Services\Tcpip\Parameters"}, 0, "Class", 0, ... 380, 2, ) , 0, ... 380, 2, ) == 0x0
 03302   396   NtOpenKey  (0x20019, {24, 48, 0x40, 0, 0,  (0x20019, {24, 48, 0x40, 0, 0, "System\CurrentControlSet\Services\DnsCache\Parameters"}, ... 376, ) }, ... 376, ) == 0x0
 03303   396   NtOpenKey  (0x20019, {24, 48, 0x40, 0, 0,  (0x20019, {24, 48, 0x40, 0, 0, "Software\Policies\Microsoft\Windows NT\DnsClient"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 03304   396   NtQueryValueKey  (380,  (380, "Hostname", Partial, 144, ... TitleIdx=0, Type=1, Data="M\0Y\0W\0O\0R\0L\0D\0\0\0"}, 28, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (380, "Hostname", Partial, 144, ... TitleIdx=0, Type=1, Data="M\0Y\0W\0O\0R\0L\0D\0\0\0"}, 28, ) }, 28, ) == 0x0
 03305   396   NtQueryValueKey  (380,  (380, "Hostname", Partial, 144, ... TitleIdx=0, Type=1, Data="M\0Y\0W\0O\0R\0L\0D\0\0\0"}, 28, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (380, "Hostname", Partial, 144, ... TitleIdx=0, Type=1, Data="M\0Y\0W\0O\0R\0L\0D\0\0\0"}, 28, ) }, 28, ) == 0x0
 03306   396   NtClose  (380, ... ) == 0x0
 03307   396   NtClose  (376, ... ) == 0x0
 03308   396   NtCreateKey  (0x20019, {24, 48, 0x40, 0, 0,  (0x20019, {24, 48, 0x40, 0, 0, "System\CurrentControlSet\Services\Tcpip\Parameters"}, 0, "Class", 0, ... 376, 2, ) }, 0,  (0x20019, {24, 48, 0x40, 0, 0, "System\CurrentControlSet\Services\Tcpip\Parameters"}, 0, "Class", 0, ... 376, 2, ) , 0, ... 376, 2, ) == 0x0
 03309   396   NtOpenKey  (0x20019, {24, 48, 0x40, 0, 0,  (0x20019, {24, 48, 0x40, 0, 0, "System\CurrentControlSet\Services\DnsCache\Parameters"}, ... 380, ) }, ... 380, ) == 0x0
 03310   396   NtOpenKey  (0x20019, {24, 48, 0x40, 0, 0,  (0x20019, {24, 48, 0x40, 0, 0, "Software\Policies\Microsoft\Windows NT\DnsClient"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 03311   396   NtQueryValueKey  (376,  (376, "Domain", Partial, 144, ... TitleIdx=0, Type=1, Data="\0\0"}, 14, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (376, "Domain", Partial, 144, ... TitleIdx=0, Type=1, Data="\0\0"}, 14, ) }, 14, ) == 0x0
 03312   396   NtQueryValueKey  (376,  (376, "Domain", Partial, 144, ... TitleIdx=0, Type=1, Data="\0\0"}, 14, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (376, "Domain", Partial, 144, ... TitleIdx=0, Type=1, Data="\0\0"}, 14, ) }, 14, ) == 0x0
 03313   396   NtClose  (376, ... ) == 0x0
 03314   396   NtClose  (380, ... ) == 0x0
 03315   396   NtOpenKey  (0x1, {24, 48, 0x40, 0, 0,  (0x1, {24, 48, 0x40, 0, 0, "System\CurrentControlSet\Services\VxD\MSTCP"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 03316   396   NtOpenKey  (0x1, {24, 48, 0x40, 0, 0,  (0x1, {24, 48, 0x40, 0, 0, "System\CurrentControlSet\Control\ComputerName\ComputerName"}, ... 380, ) }, ... 380, ) == 0x0
 03317   396   NtQueryValueKey  (380,  (380, "ComputerName", Partial, 144, ... TitleIdx=0, Type=1, Data="M\0Y\0W\0O\0R\0L\0D\0\0\0"}, 28, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (380, "ComputerName", Partial, 144, ... TitleIdx=0, Type=1, Data="M\0Y\0W\0O\0R\0L\0D\0\0\0"}, 28, ) }, 28, ) == 0x0
 03318   396   NtQueryValueKey  (380,  (380, "ComputerName", Partial, 144, ... TitleIdx=0, Type=1, Data="M\0Y\0W\0O\0R\0L\0D\0\0\0"}, 28, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (380, "ComputerName", Partial, 144, ... TitleIdx=0, Type=1, Data="M\0Y\0W\0O\0R\0L\0D\0\0\0"}, 28, ) }, 28, ) == 0x0
 03319   396   NtClose  (380, ... ) == 0x0
 03320   396   NtWaitForSingleObject  (72, 0, {0, 0}, ... ) == 0x102
 03321   396   NtWaitForSingleObject  (72, 0, {0, 0}, ... ) == 0x102
 03322   396   NtWaitForSingleObject  (72, 0, {0, 0}, ... ) == 0x102
 03323   396   NtWaitForSingleObject  (80, 0, {0, 0}, ... ) == 0x102
 03324   396   NtCreateEvent  (0x1f0003, 0x0, 1, 0, ... 380, ) == 0x0
 03325   396   NtConnectPort  ( ("\RPC Control\DNSResolver", {12, 2, 1, 1}, 0x0, 0x0, 1237148, 112, ... 376, 0x0, 0x0, 0x0, 112, ) , {12, 2, 1, 1}, 0x0, 0x0, 1237148, 112, ... 376, 0x0, 0x0, 0x0, 112, ) == 0x0
 03326   396   NtRequestWaitReplyPort  (376, {128, 152, new_msg, 0, 1310720, 122480, 1310720, 1236912}  (376, {128, 152, new_msg, 0, 1310720, 122480, 1310720, 1236912} "\0$\370w`\346\22\0\2$\370w\1kwEVY\205D\237\200\364(\367\326\1)\2\0\0\0\1\0\0\0\0\312\25\0\4\0\0\0\0\312\25\0\20\344\314w\0\312\25\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\1\0\15\0\20\311\25\0\230\327\25\0\0\0\0\0\0\0\0\0$1\347w\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\374\340\22\0\0\0\0\0\365\26\365w\5\0\0\0" ... {128, 152, reply, 0, 316, 396, 1574, 0} "\7$\370w`\346\22\0\2$\370w\1kwEVY\205D\237\200\364(\367\326\1)\2\0\0\0\1\0\0\0\0\0\0\0\4\0\0\0\0\312\25\0\377\377\377\377\0\312\25\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\1\0\15\0\20\311\25\0\230\327\25\0\0\0\0\0\0\0\0\0$1\347w\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\374\340\22\0\0\0\0\0\365\26\365w\5\0\0\0" )  ... {128, 152, reply, 0, 316, 396, 1574, 0}  (376, {128, 152, new_msg, 0, 1310720, 122480, 1310720, 1236912} "\0$\370w`\346\22\0\2$\370w\1kwEVY\205D\237\200\364(\367\326\1)\2\0\0\0\1\0\0\0\0\312\25\0\4\0\0\0\0\312\25\0\20\344\314w\0\312\25\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\1\0\15\0\20\311\25\0\230\327\25\0\0\0\0\0\0\0\0\0$1\347w\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\374\340\22\0\0\0\0\0\365\26\365w\5\0\0\0" ... {128, 152, reply, 0, 316, 396, 1574, 0} "\7$\370w`\346\22\0\2$\370w\1kwEVY\205D\237\200\364(\367\326\1)\2\0\0\0\1\0\0\0\0\0\0\0\4\0\0\0\0\312\25\0\377\377\377\377\0\312\25\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\1\0\15\0\20\311\25\0\230\327\25\0\0\0\0\0\0\0\0\0$1\347w\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\374\340\22\0\0\0\0\0\365\26\365w\5\0\0\0" )  ) == 0x0
 03327   396   NtRequestWaitReplyPort  (376, {112, 136, new_msg, 0, 316, 396, 1571, 0}  (376, {112, 136, new_msg, 0, 316, 396, 1571, 0} "\1\240\0\0A\2\11\0\0\0\0\0G\3\0\0\0\0\0\0\0\0\0\0\377\377\377\377\0\0\0\0\0\0\0\0,\10\25\0\25\0\0\0\0\0\0\0\25\0\0\0s\0r\0v\00\02\0.\0b\0a\0s\0h\0c\0h\0e\0l\0i\0k\0.\0c\0o\0m\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0" ... {44, 68, reply, 0, 316, 396, 1575, 0} "\2\240\372\177\1\00\300\0\0\0\0G\3\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\264\5\0\0\1\0\0\0" )  ... {44, 68, reply, 0, 316, 396, 1575, 0}  (376, {112, 136, new_msg, 0, 316, 396, 1571, 0} "\1\240\0\0A\2\11\0\0\0\0\0G\3\0\0\0\0\0\0\0\0\0\0\377\377\377\377\0\0\0\0\0\0\0\0,\10\25\0\25\0\0\0\0\0\0\0\25\0\0\0s\0r\0v\00\02\0.\0b\0a\0s\0h\0c\0h\0e\0l\0i\0k\0.\0c\0o\0m\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0" ... {44, 68, reply, 0, 316, 396, 1575, 0} "\2\240\372\177\1\00\300\0\0\0\0G\3\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\264\5\0\0\1\0\0\0" )  ) == 0x0
 03328   396   NtClose  (380, ... ) == 0x0
 03329   396   NtClose  (376, ... ) == 0x0
 03330   396   NtCreateFile  (0x3, {24, 0, 0x40, 0, 0,  (0x3, {24, 0, 0x40, 0, 0, "\Device\RasAcd"}, 0x0, 128, 3, 3, 0, 0, 0, ... 376, {status=0x0, info=0}, ) }, 0x0, 128, 3, 3, 0, 0, 0, ... 376, {status=0x0, info=0}, ) == 0x0
 03331   396   NtCreateEvent  (0x1f0003, 0x0, 1, 0, ... 380, ) == 0x0
 03332   396   NtDeviceIoControlFile  (376, 380, 0x0, 0x0, 0xf14014,  (376, 380, 0x0, 0x0, 0xf14014, "\3\0\0\0srv02.bashchelik.com\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0", 1552, 0, ... ) , 1552, 0, ... ) == STATUS_UNSUCCESSFUL
 03333   396   NtClose  (380, ... ) == 0x0
 03334   396   NtClose  (376, ... ) == 0x0
 03335   396   NtWaitForSingleObject  (200, 0, 0x0, ... ) == 0x0
 03336   396   NtWaitForSingleObject  (204, 0, 0x0, ... ) == 0x0
 03337   396   NtReleaseMutant  (204, ... 0x0, ) == 0x0
 03338   396   NtQueryValueKey  (108,  (108, "EnableAutodial", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (108, "EnableAutodial", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) }, 16, ) == 0x0
 03339   396   NtQueryValueKey  (108,  (108, "NoNetAutodial", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (108, "NoNetAutodial", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) }, 16, ) == 0x0
 03340   396   NtCreateKey  (0x2001d, {24, 48, 0x40, 0, 0,  (0x2001d, {24, 48, 0x40, 0, 0, "Software\Microsoft\RAS AutoDial"}, 0, 0x0, 0, ... 376, 2, ) }, 0, 0x0, 0, ... 376, 2, ) == 0x0
 03341   396   NtCreateKey  (0x20019, {24, 376, 0x40, 0, 0,  (0x20019, {24, 376, 0x40, 0, 0, "Default"}, 0, 0x0, 0, ... 380, 2, ) }, 0, 0x0, 0, ... 380, 2, ) == 0x0
 03342   396   NtClose  (376, ... ) == 0x0
 03343   396   NtQueryValueKey  (380,  (380, "DefaultInternet", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 03344   396   NtClose  (380, ... ) == 0x0
 03345   396   NtOpenThreadToken  (-2, 0xc, 1, ... ) == STATUS_NO_TOKEN
 03346   396   NtOpenProcessToken  (-1, 0xc, ... 380, ) == 0x0
 03347   396   NtReleaseSemaphore  (168, 1, ... 0, ) == 0x0
 03348   396   NtWaitForSingleObject  (168, 0, {0, 0}, ... ) == 0x0
 03349   396   NtClose  (380, ... ) == 0x0
 03350   396   NtOpenFile  (0x100001, {24, 0, 0x40, 0, 0,  (0x100001, {24, 0, 0x40, 0, 0, "\??\C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Connections\Pbk\"}, 3, 16417, ... 380, {status=0x0, info=1}, ) }, 3, 16417, ... 380, {status=0x0, info=1}, ) == 0x0
 03351   396   NtQueryDirectoryFile  (380, 0, 0, 0, 1236932, 616, BothDirectory, 1,  (380, 0, 0, 0, 1236932, 616, BothDirectory, 1, "<.pbk", 0, ... ) , 0, ... ) == STATUS_NO_SUCH_FILE
 03352   396   NtClose  (380, ... ) == 0x0
 03353   396   NtOpenFile  (0x100001, {24, 0, 0x40, 0, 0,  (0x100001, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\System32\Ras\"}, 3, 16417, ... 380, {status=0x0, info=1}, ) }, 3, 16417, ... 380, {status=0x0, info=1}, ) == 0x0
 03354   396   NtQueryDirectoryFile  (380, 0, 0, 0, 1236932, 616, BothDirectory, 1,  (380, 0, 0, 0, 1236932, 616, BothDirectory, 1, "<.pbk", 0, ... ) , 0, ... ) == STATUS_NO_SUCH_FILE
 03355   396   NtClose  (380, ... ) == 0x0
 03356   396   NtOpenThreadToken  (-2, 0xc, 1, ... ) == STATUS_NO_TOKEN
 03357   396   NtOpenProcessToken  (-1, 0xc, ... 380, ) == 0x0
 03358   396   NtQueryInformationToken  (380, User, 64, ... {token info, class 1, size 36}, 36, ) == 0x0
 03359   396   NtOpenKey  (0x2001f, {24, 328, 0x40, 0, 0,  (0x2001f, {24, 328, 0x40, 0, 0, "S-1-5-21-1078081533-484763869-839522115-1003"}, ... 376, ) }, ... 376, ) == 0x0
 03360   396   NtCreateKey  (0x2000000, {24, 376, 0x40, 0, 0,  (0x2000000, {24, 376, 0x40, 0, 0, "Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders"}, 0, 0x0, 0, ... 384, 2, ) }, 0, 0x0, 0, ... 384, 2, ) == 0x0
 03361   396   NtClose  (376, ... ) == 0x0
 03362   396   NtQueryValueKey  (384,  (384, "AppData", Partial, 144, ... TitleIdx=0, Type=2, Data="%\0U\0S\0E\0R\0P\0R\0O\0F\0I\0L\0E\0%\0\\0A\0p\0p\0l\0i\0c\0a\0t\0i\0o\0n\0 \0D\0a\0t\0a\0\0\0"}, 74, ) , Partial, 144, ... TitleIdx=0, Type=2, Data= (384, "AppData", Partial, 144, ... TitleIdx=0, Type=2, Data="%\0U\0S\0E\0R\0P\0R\0O\0F\0I\0L\0E\0%\0\\0A\0p\0p\0l\0i\0c\0a\0t\0i\0o\0n\0 \0D\0a\0t\0a\0\0\0"}, 74, ) }, 74, ) == 0x0
 03363   396   NtAllocateVirtualMemory  (-1, 0, 0, 1, 4096, 4, ... 11534336, 4096, ) == 0x0
 03364   396   NtQueryVirtualMemory  (-1, 0xb00000, Basic, 28, ... {BaseAddress=0xb00000,AllocationBase=0xb00000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 0x0, ) == 0x0
 03365   396   NtQueryVirtualMemory  (-1, 0xb00000, Basic, 28, ... {BaseAddress=0xb00000,AllocationBase=0xb00000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 0x0, ) == 0x0
 03366   396   NtOpenKey  (0x20019, {24, 48, 0x40, 0, 0,  (0x20019, {24, 48, 0x40, 0, 0, "Software\Microsoft\Windows NT\CurrentVersion\ProfileList"}, ... 376, ) }, ... 376, ) == 0x0
 03367   396   NtQueryValueKey  (376,  (376, "ProfilesDirectory", Partial, 144, ... TitleIdx=0, Type=2, Data="%\0S\0y\0s\0t\0e\0m\0D\0r\0i\0v\0e\0%\0\\0D\0o\0c\0u\0m\0e\0n\0t\0s\0 \0a\0n\0d\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\0\0"}, 86, ) , Partial, 144, ... TitleIdx=0, Type=2, Data= (376, "ProfilesDirectory", Partial, 144, ... TitleIdx=0, Type=2, Data="%\0S\0y\0s\0t\0e\0m\0D\0r\0i\0v\0e\0%\0\\0D\0o\0c\0u\0m\0e\0n\0t\0s\0 \0a\0n\0d\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\0\0"}, 86, ) }, 86, ) == 0x0
 03368   396   NtClose  (376, ... ) == 0x0
 03369   396   NtOpenKey  (0x20019, {24, 48, 0x40, 0, 0,  (0x20019, {24, 48, 0x40, 0, 0, "Software\Microsoft\Windows NT\CurrentVersion\ProfileList"}, ... 376, ) }, ... 376, ) == 0x0
 03370   396   NtQueryValueKey  (376,  (376, "AllUsersProfile", Partial, 144, ... TitleIdx=0, Type=1, Data="A\0l\0l\0 \0U\0s\0e\0r\0s\0\0\0"}, 32, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (376, "AllUsersProfile", Partial, 144, ... TitleIdx=0, Type=1, Data="A\0l\0l\0 \0U\0s\0e\0r\0s\0\0\0"}, 32, ) }, 32, ) == 0x0
 03371   396   NtClose  (376, ... ) == 0x0
 03372   396   NtQueryVirtualMemory  (-1, 0xb00000, Basic, 28, ... {BaseAddress=0xb00000,AllocationBase=0xb00000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 0x0, ) == 0x0
 03373   396   NtOpenKey  (0x1, {24, 48, 0x40, 0, 0,  (0x1, {24, 48, 0x40, 0, 0, "System\CurrentControlSet\Control\Session Manager\Environment"}, ... 376, ) }, ... 376, ) == 0x0
 03374   396   NtQueryKey  (376, Full, 176, ... {LastWrite={0x7838d13c,0x1c73999}, TitleIdx=0, Subkeys=0, Values=12, Class=""}, 44, ) == 0x0
 03375   396   NtQuerySecurityObject  (376, 7, 0, ... ) == STATUS_ACCESS_DENIED
 03376   396   NtEnumerateValueKey  (376, 0, Full, 220, ... TitleIdx=0, Type=2, Name= (376, 0, Full, 220, ... TitleIdx=0, Type=2, Name="ComSpec", Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0s\0y\0s\0t\0e\0m\03\02\0\\0c\0m\0d\0.\0e\0x\0e\0\0\0"}, 96, ) , Data= (376, 0, Full, 220, ... TitleIdx=0, Type=2, Name="ComSpec", Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0s\0y\0s\0t\0e\0m\03\02\0\\0c\0m\0d\0.\0e\0x\0e\0\0\0"}, 96, ) }, 96, ) == 0x0
 03377   396   NtEnumerateValueKey  (376, 1, Full, 220, ... TitleIdx=0, Type=2, Name= (376, 1, Full, 220, ... TitleIdx=0, Type=2, Name="Path", Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0s\0y\0s\0t\0e\0m\03\02\0;\0%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0;\0%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0W\0b\0e\0m\0\0\0"}, 152, ) , Data= (376, 1, Full, 220, ... TitleIdx=0, Type=2, Name="Path", Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0s\0y\0s\0t\0e\0m\03\02\0;\0%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0;\0%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0W\0b\0e\0m\0\0\0"}, 152, ) }, 152, ) == 0x0
 03378   396   NtEnumerateValueKey  (376, 2, Full, 220, ... TitleIdx=0, Type=2, Name= (376, 2, Full, 220, ... TitleIdx=0, Type=2, Name="windir", Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\0\0"}, 58, ) , Data= (376, 2, Full, 220, ... TitleIdx=0, Type=2, Name="windir", Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\0\0"}, 58, ) }, 58, ) == 0x0
 03379   396   NtEnumerateValueKey  (376, 3, Full, 220, ... TitleIdx=0, Type=1, Name= (376, 3, Full, 220, ... TitleIdx=0, Type=1, Name="OS", Data="W\0i\0n\0d\0o\0w\0s\0_\0N\0T\0\0\0"}, 46, ) , Data= (376, 3, Full, 220, ... TitleIdx=0, Type=1, Name="OS", Data="W\0i\0n\0d\0o\0w\0s\0_\0N\0T\0\0\0"}, 46, ) }, 46, ) == 0x0
 03380   396   NtQueryVirtualMemory  (-1, 0xb00000, Basic, 28, ... {BaseAddress=0xb00000,AllocationBase=0xb00000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 0x0, ) == 0x0
 03381   396   NtEnumerateValueKey  (376, 4, Full, 220, ... TitleIdx=0, Type=1, Name= (376, 4, Full, 220, ... TitleIdx=0, Type=1, Name="PROCESSOR_ARCHITECTURE", Data="x\08\06\0\0\0"}, 72, ) , Data= (376, 4, Full, 220, ... TitleIdx=0, Type=1, Name="PROCESSOR_ARCHITECTURE", Data="x\08\06\0\0\0"}, 72, ) }, 72, ) == 0x0
 03382   396   NtQueryVirtualMemory  (-1, 0xb00000, Basic, 28, ... {BaseAddress=0xb00000,AllocationBase=0xb00000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 0x0, ) == 0x0
 03383   396   NtEnumerateValueKey  (376, 5, Full, 220, ... TitleIdx=0, Type=1, Name= (376, 5, Full, 220, ... TitleIdx=0, Type=1, Name="PROCESSOR_LEVEL", Data="1\05\0\0\0"}, 58, ) , Data= (376, 5, Full, 220, ... TitleIdx=0, Type=1, Name="PROCESSOR_LEVEL", Data="1\05\0\0\0"}, 58, ) }, 58, ) == 0x0
 03384   396   NtQueryVirtualMemory  (-1, 0xb00000, Basic, 28, ... {BaseAddress=0xb00000,AllocationBase=0xb00000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 0x0, ) == 0x0
 03385   396   NtEnumerateValueKey  (376, 6, Full, 220, ... TitleIdx=0, Type=1, Name= (376, 6, Full, 220, ... TitleIdx=0, Type=1, Name="PROCESSOR_IDENTIFIER", Data="x\08\06\0 \0F\0a\0m\0i\0l\0y\0 \01\05\0 \0M\0o\0d\0e\0l\0 \04\0 \0S\0t\0e\0p\0p\0i\0n\0g\0 \08\0,\0 \0G\0e\0n\0u\0i\0n\0e\0I\0n\0t\0e\0l\0\0\0"}, 154, ) , Data= (376, 6, Full, 220, ... TitleIdx=0, Type=1, Name="PROCESSOR_IDENTIFIER", Data="x\08\06\0 \0F\0a\0m\0i\0l\0y\0 \01\05\0 \0M\0o\0d\0e\0l\0 \04\0 \0S\0t\0e\0p\0p\0i\0n\0g\0 \08\0,\0 \0G\0e\0n\0u\0i\0n\0e\0I\0n\0t\0e\0l\0\0\0"}, 154, ) }, 154, ) == 0x0
 03386   396   NtQueryVirtualMemory  (-1, 0xb00000, Basic, 28, ... {BaseAddress=0xb00000,AllocationBase=0xb00000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 0x0, ) == 0x0
 03387   396   NtEnumerateValueKey  (376, 7, Full, 220, ... TitleIdx=0, Type=1, Name= (376, 7, Full, 220, ... TitleIdx=0, Type=1, Name="PROCESSOR_REVISION", Data="0\04\00\08\0\0\0"}, 66, ) , Data= (376, 7, Full, 220, ... TitleIdx=0, Type=1, Name="PROCESSOR_REVISION", Data="0\04\00\08\0\0\0"}, 66, ) }, 66, ) == 0x0
 03388   396   NtQueryVirtualMemory  (-1, 0xb00000, Basic, 28, ... {BaseAddress=0xb00000,AllocationBase=0xb00000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 0x0, ) == 0x0
 03389   396   NtEnumerateValueKey  (376, 8, Full, 220, ... TitleIdx=0, Type=1, Name= (376, 8, Full, 220, ... TitleIdx=0, Type=1, Name="NUMBER_OF_PROCESSORS", Data="1\0\0\0"}, 64, ) , Data= (376, 8, Full, 220, ... TitleIdx=0, Type=1, Name="NUMBER_OF_PROCESSORS", Data="1\0\0\0"}, 64, ) }, 64, ) == 0x0
 03390   396   NtQueryVirtualMemory  (-1, 0xb00000, Basic, 28, ... {BaseAddress=0xb00000,AllocationBase=0xb00000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 0x0, ) == 0x0
 03391   396   NtEnumerateValueKey  (376, 9, Full, 220, ... TitleIdx=0, Type=1, Name= (376, 9, Full, 220, ... TitleIdx=0, Type=1, Name="PATHEXT", Data=".\0C\0O\0M\0;\0.\0E\0X\0E\0;\0.\0B\0A\0T\0;\0.\0C\0M\0D\0;\0.\0V\0B\0S\0;\0.\0V\0B\0E\0;\0.\0J\0S\0;\0.\0J\0S\0E\0;\0.\0W\0S\0F\0;\0.\0W\0S\0H\0\0\0"}, 134, ) , Data= (376, 9, Full, 220, ... TitleIdx=0, Type=1, Name="PATHEXT", Data=".\0C\0O\0M\0;\0.\0E\0X\0E\0;\0.\0B\0A\0T\0;\0.\0C\0M\0D\0;\0.\0V\0B\0S\0;\0.\0V\0B\0E\0;\0.\0J\0S\0;\0.\0J\0S\0E\0;\0.\0W\0S\0F\0;\0.\0W\0S\0H\0\0\0"}, 134, ) }, 134, ) == 0x0
 03392   396   NtQueryVirtualMemory  (-1, 0xb00000, Basic, 28, ... {BaseAddress=0xb00000,AllocationBase=0xb00000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 0x0, ) == 0x0
 03393   396   NtEnumerateValueKey  (376, 10, Full, 220, ... TitleIdx=0, Type=2, Name= (376, 10, Full, 220, ... TitleIdx=0, Type=2, Name="TEMP", Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0T\0E\0M\0P\0\0\0"}, 64, ) , Data= (376, 10, Full, 220, ... TitleIdx=0, Type=2, Name="TEMP", Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0T\0E\0M\0P\0\0\0"}, 64, ) }, 64, ) == 0x0
 03394   396   NtEnumerateValueKey  (376, 11, Full, 220, ... TitleIdx=0, Type=2, Name= (376, 11, Full, 220, ... TitleIdx=0, Type=2, Name="TMP", Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0T\0E\0M\0P\0\0\0"}, 64, ) , Data= (376, 11, Full, 220, ... TitleIdx=0, Type=2, Name="TMP", Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0T\0E\0M\0P\0\0\0"}, 64, ) }, 64, ) == 0x0
 03395   396   NtEnumerateValueKey  (376, 0, Full, 220, ... TitleIdx=0, Type=2, Name= (376, 0, Full, 220, ... TitleIdx=0, Type=2, Name="ComSpec", Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0s\0y\0s\0t\0e\0m\03\02\0\\0c\0m\0d\0.\0e\0x\0e\0\0\0"}, 96, ) , Data= (376, 0, Full, 220, ... TitleIdx=0, Type=2, Name="ComSpec", Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0s\0y\0s\0t\0e\0m\03\02\0\\0c\0m\0d\0.\0e\0x\0e\0\0\0"}, 96, ) }, 96, ) == 0x0
 03396   396   NtQueryVirtualMemory  (-1, 0xb00000, Basic, 28, ... {BaseAddress=0xb00000,AllocationBase=0xb00000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 0x0, ) == 0x0
 03397   396   NtEnumerateValueKey  (376, 1, Full, 220, ... TitleIdx=0, Type=2, Name= (376, 1, Full, 220, ... TitleIdx=0, Type=2, Name="Path", Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0s\0y\0s\0t\0e\0m\03\02\0;\0%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0;\0%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0W\0b\0e\0m\0\0\0"}, 152, ) , Data= (376, 1, Full, 220, ... TitleIdx=0, Type=2, Name="Path", Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0s\0y\0s\0t\0e\0m\03\02\0;\0%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0;\0%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0W\0b\0e\0m\0\0\0"}, 152, ) }, 152, ) == 0x0
 03398   396   NtQueryVirtualMemory  (-1, 0xb00000, Basic, 28, ... {BaseAddress=0xb00000,AllocationBase=0xb00000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 0x0, ) == 0x0
 03399   396   NtEnumerateValueKey  (376, 2, Full, 220, ... TitleIdx=0, Type=2, Name= (376, 2, Full, 220, ... TitleIdx=0, Type=2, Name="windir", Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\0\0"}, 58, ) , Data= (376, 2, Full, 220, ... TitleIdx=0, Type=2, Name="windir", Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\0\0"}, 58, ) }, 58, ) == 0x0
 03400   396   NtQueryVirtualMemory  (-1, 0xb00000, Basic, 28, ... {BaseAddress=0xb00000,AllocationBase=0xb00000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 0x0, ) == 0x0
 03401   396   NtEnumerateValueKey  (376, 3, Full, 220, ... TitleIdx=0, Type=1, Name= (376, 3, Full, 220, ... TitleIdx=0, Type=1, Name="OS", Data="W\0i\0n\0d\0o\0w\0s\0_\0N\0T\0\0\0"}, 46, ) , Data= (376, 3, Full, 220, ... TitleIdx=0, Type=1, Name="OS", Data="W\0i\0n\0d\0o\0w\0s\0_\0N\0T\0\0\0"}, 46, ) }, 46, ) == 0x0
 03402   396   NtEnumerateValueKey  (376, 4, Full, 220, ... TitleIdx=0, Type=1, Name= (376, 4, Full, 220, ... TitleIdx=0, Type=1, Name="PROCESSOR_ARCHITECTURE", Data="x\08\06\0\0\0"}, 72, ) , Data= (376, 4, Full, 220, ... TitleIdx=0, Type=1, Name="PROCESSOR_ARCHITECTURE", Data="x\08\06\0\0\0"}, 72, ) }, 72, ) == 0x0
 03403   396   NtEnumerateValueKey  (376, 5, Full, 220, ... TitleIdx=0, Type=1, Name= (376, 5, Full, 220, ... TitleIdx=0, Type=1, Name="PROCESSOR_LEVEL", Data="1\05\0\0\0"}, 58, ) , Data= (376, 5, Full, 220, ... TitleIdx=0, Type=1, Name="PROCESSOR_LEVEL", Data="1\05\0\0\0"}, 58, ) }, 58, ) == 0x0
 03404   396   NtEnumerateValueKey  (376, 6, Full, 220, ... TitleIdx=0, Type=1, Name= (376, 6, Full, 220, ... TitleIdx=0, Type=1, Name="PROCESSOR_IDENTIFIER", Data="x\08\06\0 \0F\0a\0m\0i\0l\0y\0 \01\05\0 \0M\0o\0d\0e\0l\0 \04\0 \0S\0t\0e\0p\0p\0i\0n\0g\0 \08\0,\0 \0G\0e\0n\0u\0i\0n\0e\0I\0n\0t\0e\0l\0\0\0"}, 154, ) , Data= (376, 6, Full, 220, ... TitleIdx=0, Type=1, Name="PROCESSOR_IDENTIFIER", Data="x\08\06\0 \0F\0a\0m\0i\0l\0y\0 \01\05\0 \0M\0o\0d\0e\0l\0 \04\0 \0S\0t\0e\0p\0p\0i\0n\0g\0 \08\0,\0 \0G\0e\0n\0u\0i\0n\0e\0I\0n\0t\0e\0l\0\0\0"}, 154, ) }, 154, ) == 0x0
 03405   396   NtEnumerateValueKey  (376, 7, Full, 220, ... TitleIdx=0, Type=1, Name= (376, 7, Full, 220, ... TitleIdx=0, Type=1, Name="PROCESSOR_REVISION", Data="0\04\00\08\0\0\0"}, 66, ) , Data= (376, 7, Full, 220, ... TitleIdx=0, Type=1, Name="PROCESSOR_REVISION", Data="0\04\00\08\0\0\0"}, 66, ) }, 66, ) == 0x0
 03406   396   NtEnumerateValueKey  (376, 8, Full, 220, ... TitleIdx=0, Type=1, Name= (376, 8, Full, 220, ... TitleIdx=0, Type=1, Name="NUMBER_OF_PROCESSORS", Data="1\0\0\0"}, 64, ) , Data= (376, 8, Full, 220, ... TitleIdx=0, Type=1, Name="NUMBER_OF_PROCESSORS", Data="1\0\0\0"}, 64, ) }, 64, ) == 0x0
 03407   396   NtEnumerateValueKey  (376, 9, Full, 220, ... TitleIdx=0, Type=1, Name= (376, 9, Full, 220, ... TitleIdx=0, Type=1, Name="PATHEXT", Data=".\0C\0O\0M\0;\0.\0E\0X\0E\0;\0.\0B\0A\0T\0;\0.\0C\0M\0D\0;\0.\0V\0B\0S\0;\0.\0V\0B\0E\0;\0.\0J\0S\0;\0.\0J\0S\0E\0;\0.\0W\0S\0F\0;\0.\0W\0S\0H\0\0\0"}, 134, ) , Data= (376, 9, Full, 220, ... TitleIdx=0, Type=1, Name="PATHEXT", Data=".\0C\0O\0M\0;\0.\0E\0X\0E\0;\0.\0B\0A\0T\0;\0.\0C\0M\0D\0;\0.\0V\0B\0S\0;\0.\0V\0B\0E\0;\0.\0J\0S\0;\0.\0J\0S\0E\0;\0.\0W\0S\0F\0;\0.\0W\0S\0H\0\0\0"}, 134, ) }, 134, ) == 0x0
 03408   396   NtEnumerateValueKey  (376, 10, Full, 220, ... TitleIdx=0, Type=2, Name= (376, 10, Full, 220, ... TitleIdx=0, Type=2, Name="TEMP", Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0T\0E\0M\0P\0\0\0"}, 64, ) , Data= (376, 10, Full, 220, ... TitleIdx=0, Type=2, Name="TEMP", Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0T\0E\0M\0P\0\0\0"}, 64, ) }, 64, ) == 0x0
 03409   396   NtQueryInformationProcess  (-1, DefaultHardErrorMode, 4, ... {process info, class 12, size 4}, 0x0, ) == 0x0
 03410   396   NtSetInformationProcess  (-1, DefaultHardErrorMode, {process info, class 12, size 4}, 4, ... ) == 0x0
 03411   396   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\TEMP"}, 1236004, ... ) }, 1236004, ... ) == 0x0
 03412   396   NtQueryInformationProcess  (-1, DefaultHardErrorMode, 4, ... {process info, class 12, size 4}, 0x0, ) == 0x0
 03413   396   NtSetInformationProcess  (-1, DefaultHardErrorMode, {process info, class 12, size 4}, 4, ... ) == 0x0
 03414   396   NtQueryVirtualMemory  (-1, 0xb00000, Basic, 28, ... {BaseAddress=0xb00000,AllocationBase=0xb00000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 0x0, ) == 0x0
 03415   396   NtEnumerateValueKey  (376, 11, Full, 220, ... TitleIdx=0, Type=2, Name= (376, 11, Full, 220, ... TitleIdx=0, Type=2, Name="TMP", Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0T\0E\0M\0P\0\0\0"}, 64, ) , Data= (376, 11, Full, 220, ... TitleIdx=0, Type=2, Name="TMP", Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0T\0E\0M\0P\0\0\0"}, 64, ) }, 64, ) == 0x0
 03416   396   NtQueryInformationProcess  (-1, DefaultHardErrorMode, 4, ... {process info, class 12, size 4}, 0x0, ) == 0x0
 03417   396   NtSetInformationProcess  (-1, DefaultHardErrorMode, {process info, class 12, size 4}, 4, ... ) == 0x0
 03418   396   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\TEMP"}, 1236004, ... ) }, 1236004, ... ) == 0x0
 03419   396   NtQueryInformationProcess  (-1, DefaultHardErrorMode, 4, ... {process info, class 12, size 4}, 0x0, ) == 0x0
 03420   396   NtSetInformationProcess  (-1, DefaultHardErrorMode, {process info, class 12, size 4}, 4, ... ) == 0x0
 03421   396   NtQueryVirtualMemory  (-1, 0xb00000, Basic, 28, ... {BaseAddress=0xb00000,AllocationBase=0xb00000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 0x0, ) == 0x0
 03422   396   NtClose  (376, ... ) == 0x0
 03423   396   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\System\CurrentControlSet\Control\ComputerName"}, ... 376, ) }, ... 376, ) == 0x0
 03424   396   NtOpenKey  (0x20019, {24, 376, 0x40, 0, 0,  (0x20019, {24, 376, 0x40, 0, 0, "ActiveComputerName"}, ... 388, ) }, ... 388, ) == 0x0
 03425   396   NtQueryValueKey  (388,  (388, "ComputerName", Full, 108, ... TitleIdx=0, Type=1, Name="ComputerName", Data="M\0Y\0W\0O\0R\0L\0D\0\0\0"}, 60, ) , Full, 108, ... TitleIdx=0, Type=1, Name= (388, "ComputerName", Full, 108, ... TitleIdx=0, Type=1, Name="ComputerName", Data="M\0Y\0W\0O\0R\0L\0D\0\0\0"}, 60, ) , Data= (388, "ComputerName", Full, 108, ... TitleIdx=0, Type=1, Name="ComputerName", Data="M\0Y\0W\0O\0R\0L\0D\0\0\0"}, 60, ) }, 60, ) == 0x0
 03426   396   NtClose  (388, ... ) == 0x0
 03427   396   NtClose  (376, ... ) == 0x0
 03428   396   NtQueryVirtualMemory  (-1, 0xb00000, Basic, 28, ... {BaseAddress=0xb00000,AllocationBase=0xb00000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 0x0, ) == 0x0
 03429   396   NtOpenKey  (0x20019, {24, 48, 0x40, 0, 0,  (0x20019, {24, 48, 0x40, 0, 0, "Software\Microsoft\Windows NT\CurrentVersion\ProfileList"}, ... 376, ) }, ... 376, ) == 0x0
 03430   396   NtQueryValueKey  (376,  (376, "ProfilesDirectory", Partial, 144, ... TitleIdx=0, Type=2, Data="%\0S\0y\0s\0t\0e\0m\0D\0r\0i\0v\0e\0%\0\\0D\0o\0c\0u\0m\0e\0n\0t\0s\0 \0a\0n\0d\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\0\0"}, 86, ) , Partial, 144, ... TitleIdx=0, Type=2, Data= (376, "ProfilesDirectory", Partial, 144, ... TitleIdx=0, Type=2, Data="%\0S\0y\0s\0t\0e\0m\0D\0r\0i\0v\0e\0%\0\\0D\0o\0c\0u\0m\0e\0n\0t\0s\0 \0a\0n\0d\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\0\0"}, 86, ) }, 86, ) == 0x0
 03431   396   NtClose  (376, ... ) == 0x0
 03432   396   NtOpenKey  (0x20019, {24, 48, 0x40, 0, 0,  (0x20019, {24, 48, 0x40, 0, 0, "Software\Microsoft\Windows NT\CurrentVersion\ProfileList"}, ... 376, ) }, ... 376, ) == 0x0
 03433   396   NtQueryValueKey  (376,  (376, "DefaultUserProfile", Partial, 144, ... TitleIdx=0, Type=1, Data="D\0e\0f\0a\0u\0l\0t\0 \0U\0s\0e\0r\0\0\0"}, 38, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (376, "DefaultUserProfile", Partial, 144, ... TitleIdx=0, Type=1, Data="D\0e\0f\0a\0u\0l\0t\0 \0U\0s\0e\0r\0\0\0"}, 38, ) }, 38, ) == 0x0
 03434   396   NtClose  (376, ... ) == 0x0
 03435   396   NtQueryVirtualMemory  (-1, 0xb00000, Basic, 28, ... {BaseAddress=0xb00000,AllocationBase=0xb00000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 0x0, ) == 0x0
 03436   396   NtOpenKey  (0x20019, {24, 48, 0x40, 0, 0,  (0x20019, {24, 48, 0x40, 0, 0, "Software\Microsoft\Windows\CurrentVersion"}, ... 376, ) }, ... 376, ) == 0x0
 03437   396   NtQueryValueKey  (376,  (376, "ProgramFilesDir", Partial, 144, ... TitleIdx=0, Type=1, Data="C\0:\0\\0P\0r\0o\0g\0r\0a\0m\0 \0F\0i\0l\0e\0s\0\0\0"}, 46, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (376, "ProgramFilesDir", Partial, 144, ... TitleIdx=0, Type=1, Data="C\0:\0\\0P\0r\0o\0g\0r\0a\0m\0 \0F\0i\0l\0e\0s\0\0\0"}, 46, ) }, 46, ) == 0x0
 03438   396   NtQueryVirtualMemory  (-1, 0xb00000, Basic, 28, ... {BaseAddress=0xb00000,AllocationBase=0xb00000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 0x0, ) == 0x0
 03439   396   NtQueryValueKey  (376,  (376, "CommonFilesDir", Partial, 144, ... TitleIdx=0, Type=1, Data="C\0:\0\\0P\0r\0o\0g\0r\0a\0m\0 \0F\0i\0l\0e\0s\0\\0C\0o\0m\0m\0o\0n\0 \0F\0i\0l\0e\0s\0\0\0"}, 72, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (376, "CommonFilesDir", Partial, 144, ... TitleIdx=0, Type=1, Data="C\0:\0\\0P\0r\0o\0g\0r\0a\0m\0 \0F\0i\0l\0e\0s\0\\0C\0o\0m\0m\0o\0n\0 \0F\0i\0l\0e\0s\0\0\0"}, 72, ) }, 72, ) == 0x0
 03440   396   NtQueryVirtualMemory  (-1, 0xb00000, Basic, 28, ... {BaseAddress=0xb00000,AllocationBase=0xb00000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 0x0, ) == 0x0
 03441   396   NtClose  (376, ... ) == 0x0
 03442   396   NtQueryInformationToken  (380, User, 200, ... {token info, class 1, size 36}, 36, ) == 0x0
 03443   396   NtOpenKey  (0x20019, {24, 328, 0x40, 0, 0,  (0x20019, {24, 328, 0x40, 0, 0, "S-1-5-21-1078081533-484763869-839522115-1003"}, ... 376, ) }, ... 376, ) == 0x0
 03444   396   NtOpenThreadToken  (-2, 0x2000c, 1, ... ) == STATUS_NO_TOKEN
 03445   396   NtQueryInformationToken  (380, Type, 4, ... {token info, class 8, size 4}, 4, ) == 0x0
 03446   396   NtDuplicateToken  (380, 0xc, {24, 0, 0x0, 0, 1237388, 0x0}, 0, 2, ... ) == STATUS_ACCESS_DENIED
 03447   396   NtQueryInformationToken  (380, User, 200, ... {token info, class 1, size 36}, 36, ) == 0x0
 03448   396   NtOpenThreadToken  (-2, 0xc, 1, ... ) == STATUS_NO_TOKEN
 03449   396   NtCreateEvent  (0x1f0003, 0x0, 1, 0, ... 388, ) == 0x0
 03450   396   NtOpenThreadToken  (-2, 0xc, 1, ... ) == STATUS_NO_TOKEN
 03451   396   NtSetInformationThread  (-2, ImpersonationToken, {ImpToken=0,}, 4, ... ) == 0x0
 03452   396   NtCreateFile  (0xc0100080, {24, 0, 0x40, 0, 1235592,  (0xc0100080, {24, 0, 0x40, 0, 1235592, "\??\PIPE\lsarpc"}, 0x0, 0, 3, 1, 64, 0, 0, ... 392, {status=0x0, info=1}, ) }, 0x0, 0, 3, 1, 64, 0, 0, ... 392, {status=0x0, info=1}, ) == 0x0
 03453   396   NtSetInformationFile  (392, 1235648, 8, Pipe, ... {status=0x0, info=0}, ) == 0x0
 03454   396   NtSetInformationFile  (392, 1235640, 8, Completion, ... {status=0x0, info=0}, ) == 0x0
 03455   396   NtSetInformationThread  (-2, ImpersonationToken, {ImpToken=0,}, 4, ... ) == 0x0
 03456   396   NtWriteFile  (392, 297, 0, 0,  (392, 297, 0, 0, "\5\0\13\3\20\0\0\0H\0\0\0\1\0\0\0\270\20\270\20\0\0\0\0\1\0\0\0\0\0\1\0xW4\224\22\315\253\357\0\1#Eg\211\253\0\0\0\0\4]\210\212\353\34\311\21\237\350\10\0+\20H`\2\0\0\0", 72, {0, 0}, 0, ... {status=0x0, info=72}, ) , 72, {0, 0}, 0, ... {status=0x0, info=72}, ) == 0x0
 03457   396   NtReadFile  (392, 297, 0, 0, 1024, {0, 0}, 0, ... {status=0x0, info=68},  (392, 297, 0, 0, 1024, {0, 0}, 0, ... {status=0x0, info=68}, "\5\0\14\3\20\0\0\0D\0\0\0\1\0\0\0\270\20\270\20\230%\0\0\14\0\PIPE\lsass\0\0\0\1\0\0\0\0\0\0\0\4]\210\212\353\34\311\21\237\350\10\0+\20H`\2\0\0\0", ) , ) == 0x0
 03458   396   NtFsControlFile  (392, 297, 0x0, 0x0, 0x11c017,  (392, 297, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0@\0\0\0\1\0\0\0(\0\0\0\0\0,\0\0\0\0\0\30\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0<\341\22\0\14\0\0\0\2\0\1\0\0\10\0\0", 64, 1024, ... {status=0x103, info=68}, "\5\0\14\3\20\0\0\0D\0\0\0\1\0\0\0\270\20\270\20\230%\0\0\14\0\PIPE\lsass\0\0\0\1\0\0\0\0\0\0\0\4]\210\212\353\34\311\21\237\350\10\0+\20H`\2\0\0\0", ) , 64, 1024, ... {status=0x103, info=68},  (392, 297, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0@\0\0\0\1\0\0\0(\0\0\0\0\0,\0\0\0\0\0\30\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0<\341\22\0\14\0\0\0\2\0\1\0\0\10\0\0", 64, 1024, ... {status=0x103, info=68}, "\5\0\14\3\20\0\0\0D\0\0\0\1\0\0\0\270\20\270\20\230%\0\0\14\0\PIPE\lsass\0\0\0\1\0\0\0\0\0\0\0\4]\210\212\353\34\311\21\237\350\10\0+\20H`\2\0\0\0", ) , ) == 0x103
 03459   396   NtFsControlFile  (392, 297, 0x0, 0x0, 0x11c017,  (392, 297, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0t\0\0\0\2\0\0\0\\0\0\0\0\09\0\0\0\0\0uF\235\311\333?\334\21\261\310\0\14)\371\246\305\1\0\0\0t\341\22\0\1\0\0\0H\327\25\0\5\0\0\0\1\5\0\0\0\0\0\5\25\0\0\0\3757B@\335\350\344\34C\27\122\353\3\0\0\0\0\0\0\0\0\0\0\1\0l\0\0\0\0\0\0\0\0\0\2\0\0\0", 116, 1024, ... {status=0x103, info=48}, "\5\0\2\3\20\0\0\00\0\0\0\1\0\0\0\30\0\0\0\0\0\0\0\0\0\0\0uF\235\311\333?\334\21\261\310\0\14)\371\246\305\0\0\0\0", ) , 116, 1024, ... {status=0x103, info=48},  (392, 297, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0t\0\0\0\2\0\0\0\\0\0\0\0\09\0\0\0\0\0uF\235\311\333?\334\21\261\310\0\14)\371\246\305\1\0\0\0t\341\22\0\1\0\0\0H\327\25\0\5\0\0\0\1\5\0\0\0\0\0\5\25\0\0\0\3757B@\335\350\344\34C\27\122\353\3\0\0\0\0\0\0\0\0\0\0\1\0l\0\0\0\0\0\0\0\0\0\2\0\0\0", 116, 1024, ... {status=0x103, info=48}, "\5\0\2\3\20\0\0\00\0\0\0\1\0\0\0\30\0\0\0\0\0\0\0\0\0\0\0uF\235\311\333?\334\21\261\310\0\14)\371\246\305\0\0\0\0", ) , ) == 0x103
 03460   396   NtFsControlFile  (392, 297, 0x0, 0x0, 0x11c017,  (392, 297, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0,\0\0\0\3\0\0\0\24\0\0\0\0\0\0\0\0\0\0\0uF\235\311\333?\334\21\261\310\0\14)\371\246\305", 44, 1024, ... {status=0x103, info=180}, "\5\0\2\3\20\0\0\0\264\0\0\0\2\0\0\0\234\0\0\0\0\0\0\00\340\25\0\1\0\0\0<\340\25\0 \0\0\0\1\0\0\0\16\0\20\0H\340\25\0X\340\25\0\10\0\0\0\0\0\0\0\7\0\0\0M\0Y\0W\0O\0R\0L\0D\0O\0\4\0\0\0\1\4\0\0\0\0\0\5\25\0\0\0\3757B@\335\350\344\34C\27\122\1\0\0\0x\245\25\0\1\0\0\0\1\0\0\0\20\0\22\0\214\245\25\0\0\0\0\0\0\0\0\0\11\0\0\0\0\0\0\0\10\0\0\0S\0R\0I\0-\0u\0s\0e\0r\0\1\0\0\0\0\0\0\0", ) , 44, 1024, ... {status=0x103, info=180},  (392, 297, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0,\0\0\0\3\0\0\0\24\0\0\0\0\0\0\0\0\0\0\0uF\235\311\333?\334\21\261\310\0\14)\371\246\305", 44, 1024, ... {status=0x103, info=180}, "\5\0\2\3\20\0\0\0\264\0\0\0\2\0\0\0\234\0\0\0\0\0\0\00\340\25\0\1\0\0\0<\340\25\0 \0\0\0\1\0\0\0\16\0\20\0H\340\25\0X\340\25\0\10\0\0\0\0\0\0\0\7\0\0\0M\0Y\0W\0O\0R\0L\0D\0O\0\4\0\0\0\1\4\0\0\0\0\0\5\25\0\0\0\3757B@\335\350\344\34C\27\122\1\0\0\0x\245\25\0\1\0\0\0\1\0\0\0\20\0\22\0\214\245\25\0\0\0\0\0\0\0\0\0\11\0\0\0\0\0\0\0\10\0\0\0S\0R\0I\0-\0u\0s\0e\0r\0\1\0\0\0\0\0\0\0", ) , ) == 0x103
 03461   396   NtClose  (388, ... ) == 0x0
 03462   396   NtClose  (392, ... ) == 0x0
 03463   396   NtOpenThreadToken  (-2, 0xc, 1, ... ) == STATUS_NO_TOKEN
 03464   396   NtCreateEvent  (0x1f0003, 0x0, 1, 0, ... 392, ) == 0x0
 03465   396   NtOpenThreadToken  (-2, 0xc, 1, ... ) == STATUS_NO_TOKEN
 03466   396   NtSetInformationThread  (-2, ImpersonationToken, {ImpToken=0,}, 4, ... ) == 0x0
 03467   396   NtCreateFile  (0xc0100080, {24, 0, 0x40, 0, 1235588,  (0xc0100080, {24, 0, 0x40, 0, 1235588, "\??\PIPE\lsarpc"}, 0x0, 0, 3, 1, 64, 0, 0, ... 388, {status=0x0, info=1}, ) }, 0x0, 0, 3, 1, 64, 0, 0, ... 388, {status=0x0, info=1}, ) == 0x0
 03468   396   NtSetInformationFile  (388, 1235644, 8, Pipe, ... {status=0x0, info=0}, ) == 0x0
 03469   396   NtSetInformationFile  (388, 1235636, 8, Completion, ... {status=0x0, info=0}, ) == 0x0
 03470   396   NtSetInformationThread  (-2, ImpersonationToken, {ImpToken=0,}, 4, ... ) == 0x0
 03471   396   NtWriteFile  (388, 297, 0, 0,  (388, 297, 0, 0, "\5\0\13\3\20\0\0\0H\0\0\0\1\0\0\0\270\20\270\20\0\0\0\0\1\0\0\0\0\0\1\0xW4\224\22\315\253\357\0\1#Eg\211\253\0\0\0\0\4]\210\212\353\34\311\21\237\350\10\0+\20H`\2\0\0\0", 72, {0, 0}, 0, ... {status=0x0, info=72}, ) , 72, {0, 0}, 0, ... {status=0x0, info=72}, ) == 0x0
 03472   396   NtReadFile  (388, 297, 0, 0, 1024, {0, 0}, 0, ... {status=0x0, info=68},  (388, 297, 0, 0, 1024, {0, 0}, 0, ... {status=0x0, info=68}, "\5\0\14\3\20\0\0\0D\0\0\0\1\0\0\0\270\20\270\20\231%\0\0\14\0\PIPE\lsass\0\0\0\1\0\0\0\0\0\0\0\4]\210\212\353\34\311\21\237\350\10\0+\20H`\2\0\0\0", ) , ) == 0x0
 03473   396   NtFsControlFile  (388, 297, 0x0, 0x0, 0x11c017,  (388, 297, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0@\0\0\0\1\0\0\0(\0\0\0\0\0,\0\0\0\0\0\30\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\08\341\22\0\14\0\0\0\2\0\1\0\0\10\0\0", 64, 1024, ... {status=0x103, info=68}, "\5\0\14\3\20\0\0\0D\0\0\0\1\0\0\0\270\20\270\20\231%\0\0\14\0\PIPE\lsass\0\0\0\1\0\0\0\0\0\0\0\4]\210\212\353\34\311\21\237\350\10\0+\20H`\2\0\0\0", ) , 64, 1024, ... {status=0x103, info=68},  (388, 297, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0@\0\0\0\1\0\0\0(\0\0\0\0\0,\0\0\0\0\0\30\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\08\341\22\0\14\0\0\0\2\0\1\0\0\10\0\0", 64, 1024, ... {status=0x103, info=68}, "\5\0\14\3\20\0\0\0D\0\0\0\1\0\0\0\270\20\270\20\231%\0\0\14\0\PIPE\lsass\0\0\0\1\0\0\0\0\0\0\0\4]\210\212\353\34\311\21\237\350\10\0+\20H`\2\0\0\0", ) , ) == 0x103
 03474   396   NtFsControlFile  (388, 297, 0x0, 0x0, 0x11c017,  (388, 297, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0t\0\0\0\2\0\0\0\\0\0\0\0\09\0\0\0\0\0vF\235\311\333?\334\21\261\310\0\14)\371\246\305\1\0\0\0p\341\22\0\1\0\0\0H\327\25\0\5\0\0\0\1\5\0\0\0\0\0\5\25\0\0\0\3757B@\335\350\344\34C\27\122\353\3\0\0\0\0\0\0\0\0\0\0\1\0l\0\0\0\0\0\0\0\0\0\2\0\0\0", 116, 1024, ... {status=0x103, info=48}, "\5\0\2\3\20\0\0\00\0\0\0\1\0\0\0\30\0\0\0\0\0\0\0\0\0\0\0vF\235\311\333?\334\21\261\310\0\14)\371\246\305\0\0\0\0", ) , 116, 1024, ... {status=0x103, info=48},  (388, 297, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0t\0\0\0\2\0\0\0\\0\0\0\0\09\0\0\0\0\0vF\235\311\333?\334\21\261\310\0\14)\371\246\305\1\0\0\0p\341\22\0\1\0\0\0H\327\25\0\5\0\0\0\1\5\0\0\0\0\0\5\25\0\0\0\3757B@\335\350\344\34C\27\122\353\3\0\0\0\0\0\0\0\0\0\0\1\0l\0\0\0\0\0\0\0\0\0\2\0\0\0", 116, 1024, ... {status=0x103, info=48}, "\5\0\2\3\20\0\0\00\0\0\0\1\0\0\0\30\0\0\0\0\0\0\0\0\0\0\0vF\235\311\333?\334\21\261\310\0\14)\371\246\305\0\0\0\0", ) , ) == 0x103
 03475   396   NtFsControlFile  (388, 297, 0x0, 0x0, 0x11c017,  (388, 297, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0,\0\0\0\3\0\0\0\24\0\0\0\0\0\0\0\0\0\0\0vF\235\311\333?\334\21\261\310\0\14)\371\246\305", 44, 1024, ... {status=0x103, info=180}, "\5\0\2\3\20\0\0\0\264\0\0\0\2\0\0\0\234\0\0\0\0\0\0\00\340\25\0\1\0\0\0<\340\25\0 \0\0\0\1\0\0\0\16\0\20\0H\340\25\0X\340\25\0\10\0\0\0\0\0\0\0\7\0\0\0M\0Y\0W\0O\0R\0L\0D\0O\0\4\0\0\0\1\4\0\0\0\0\0\5\25\0\0\0\3757B@\335\350\344\34C\27\122\1\0\0\0x\245\25\0\1\0\0\0\1\0\0\0\20\0\22\0\214\245\25\0\0\0\0\0\0\0\0\0\11\0\0\0\0\0\0\0\10\0\0\0S\0R\0I\0-\0u\0s\0e\0r\0\1\0\0\0\0\0\0\0", ) , 44, 1024, ... {status=0x103, info=180},  (388, 297, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0,\0\0\0\3\0\0\0\24\0\0\0\0\0\0\0\0\0\0\0vF\235\311\333?\334\21\261\310\0\14)\371\246\305", 44, 1024, ... {status=0x103, info=180}, "\5\0\2\3\20\0\0\0\264\0\0\0\2\0\0\0\234\0\0\0\0\0\0\00\340\25\0\1\0\0\0<\340\25\0 \0\0\0\1\0\0\0\16\0\20\0H\340\25\0X\340\25\0\10\0\0\0\0\0\0\0\7\0\0\0M\0Y\0W\0O\0R\0L\0D\0O\0\4\0\0\0\1\4\0\0\0\0\0\5\25\0\0\0\3757B@\335\350\344\34C\27\122\1\0\0\0x\245\25\0\1\0\0\0\1\0\0\0\20\0\22\0\214\245\25\0\0\0\0\0\0\0\0\0\11\0\0\0\0\0\0\0\10\0\0\0S\0R\0I\0-\0u\0s\0e\0r\0\1\0\0\0\0\0\0\0", ) , ) == 0x103
 03476   396   NtClose  (392, ... ) == 0x0
 03477   396   NtClose  (388, ... ) == 0x0
 03478   396   NtQueryVirtualMemory  (-1, 0xb00000, Basic, 28, ... {BaseAddress=0xb00000,AllocationBase=0xb00000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 0x0, ) == 0x0
 03479   396   NtQueryVirtualMemory  (-1, 0xb00000, Basic, 28, ... {BaseAddress=0xb00000,AllocationBase=0xb00000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 0x0, ) == 0x0
 03480   396   NtQueryInformationToken  (380, User, 200, ... {token info, class 1, size 36}, 36, ) == 0x0
 03481   396   NtOpenKey  (0x20019, {24, 48, 0x40, 0, 0,  (0x20019, {24, 48, 0x40, 0, 0, "Software\Microsoft\Windows NT\CurrentVersion\ProfileList\S-1-5-21-1078081533-484763869-839522115-1003"}, ... 388, ) }, ... 388, ) == 0x0
 03482   396   NtQueryValueKey  (388,  (388, "ProfileImagePath", Partial, 144, ... TitleIdx=0, Type=2, Data="%\0S\0y\0s\0t\0e\0m\0D\0r\0i\0v\0e\0%\0\\0D\0o\0c\0u\0m\0e\0n\0t\0s\0 \0a\0n\0d\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0S\0R\0I\0-\0u\0s\0e\0r\0\0\0"}, 104, ) , Partial, 144, ... TitleIdx=0, Type=2, Data= (388, "ProfileImagePath", Partial, 144, ... TitleIdx=0, Type=2, Data="%\0S\0y\0s\0t\0e\0m\0D\0r\0i\0v\0e\0%\0\\0D\0o\0c\0u\0m\0e\0n\0t\0s\0 \0a\0n\0d\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0S\0R\0I\0-\0u\0s\0e\0r\0\0\0"}, 104, ) }, 104, ) == 0x0
 03483   396   NtClose  (388, ... ) == 0x0
 03484   396   NtCreateKey  (0x2001f, {24, 376, 0x40, 0, 0,  (0x2001f, {24, 376, 0x40, 0, 0, "Software\Microsoft\Windows NT\CurrentVersion\Winlogon"}, 0, 0x0, 0, ... 388, 2, ) }, 0, 0x0, 0, ... 388, 2, ) == 0x0
 03485   396   NtQueryValueKey  (388,  (388, "ParseAutoexec", Partial, 144, ... TitleIdx=0, Type=1, Data="1\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (388, "ParseAutoexec", Partial, 144, ... TitleIdx=0, Type=1, Data="1\0\0\0"}, 16, ) }, 16, ) == 0x0
 03486   396   NtClose  (388, ... ) == 0x0
 03487   396   NtQueryInformationProcess  (-1, DefaultHardErrorMode, 4, ... {process info, class 12, size 4}, 0x0, ) == 0x0
 03488   396   NtSetInformationProcess  (-1, DefaultHardErrorMode, {process info, class 12, size 4}, 4, ... ) == 0x0
 03489   396   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\c:\autoexec.bat"}, 1237292, ... ) }, 1237292, ... ) == 0x0
 03490   396   NtCreateFile  (0x80100080, {24, 0, 0x40, 0, 1237300,  (0x80100080, {24, 0, 0x40, 0, 1237300, "\??\c:\autoexec.bat"}, 0x0, 128, 1, 1, 96, 0, 0, ... 388, {status=0x0, info=1}, ) }, 0x0, 128, 1, 1, 96, 0, 0, ... 388, {status=0x0, info=1}, ) == 0x0
 03491   396   NtQueryInformationProcess  (-1, DefaultHardErrorMode, 4, ... {process info, class 12, size 4}, 0x0, ) == 0x0
 03492   396   NtSetInformationProcess  (-1, DefaultHardErrorMode, {process info, class 12, size 4}, 4, ... ) == 0x0
 03493   396   NtQueryInformationFile  (388, 1237316, 24, Standard, ... {status=0x0, info=24}, ) == 0x0
 03494   396   NtReadFile  (388, 0, 0, 0, 0, 0x0, 0, ... {status=0x0, info=0}, "", ) == 0x0
 03495   396   NtClose  (388, ... ) == 0x0
 03496   396   NtOpenKey  (0x20019, {24, 376, 0x40, 0, 0,  (0x20019, {24, 376, 0x40, 0, 0, "Environment"}, ... 388, ) }, ... 388, ) == 0x0
 03497   396   NtEnumerateValueKey  (388, 0, Full, 220, ... TitleIdx=0, Type=2, Name= (388, 0, Full, 220, ... TitleIdx=0, Type=2, Name="TEMP", Data="%\0U\0S\0E\0R\0P\0R\0O\0F\0I\0L\0E\0%\0\\0L\0o\0c\0a\0l\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0T\0e\0m\0p\0\0\0"}, 96, ) , Data= (388, 0, Full, 220, ... TitleIdx=0, Type=2, Name="TEMP", Data="%\0U\0S\0E\0R\0P\0R\0O\0F\0I\0L\0E\0%\0\\0L\0o\0c\0a\0l\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0T\0e\0m\0p\0\0\0"}, 96, ) }, 96, ) == 0x0
 03498   396   NtEnumerateValueKey  (388, 1, Full, 220, ... TitleIdx=0, Type=2, Name= (388, 1, Full, 220, ... TitleIdx=0, Type=2, Name="TMP", Data="%\0U\0S\0E\0R\0P\0R\0O\0F\0I\0L\0E\0%\0\\0L\0o\0c\0a\0l\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0T\0e\0m\0p\0\0\0"}, 96, ) , Data= (388, 1, Full, 220, ... TitleIdx=0, Type=2, Name="TMP", Data="%\0U\0S\0E\0R\0P\0R\0O\0F\0I\0L\0E\0%\0\\0L\0o\0c\0a\0l\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0T\0e\0m\0p\0\0\0"}, 96, ) }, 96, ) == 0x0
 03499   396   NtEnumerateValueKey  (388, 2, Full, 220, ... ) == STATUS_NO_MORE_ENTRIES
 03500   396   NtEnumerateValueKey  (388, 0, Full, 220, ... TitleIdx=0, Type=2, Name= (388, 0, Full, 220, ... TitleIdx=0, Type=2, Name="TEMP", Data="%\0U\0S\0E\0R\0P\0R\0O\0F\0I\0L\0E\0%\0\\0L\0o\0c\0a\0l\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0T\0e\0m\0p\0\0\0"}, 96, ) , Data= (388, 0, Full, 220, ... TitleIdx=0, Type=2, Name="TEMP", Data="%\0U\0S\0E\0R\0P\0R\0O\0F\0I\0L\0E\0%\0\\0L\0o\0c\0a\0l\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0T\0e\0m\0p\0\0\0"}, 96, ) }, 96, ) == 0x0
 03501   396   NtQueryInformationProcess  (-1, DefaultHardErrorMode, 4, ... {process info, class 12, size 4}, 0x0, ) == 0x0
 03502   396   NtSetInformationProcess  (-1, DefaultHardErrorMode, {process info, class 12, size 4}, 4, ... ) == 0x0
 03503   396   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\Documents and Settings\SRI-user\Local Settings\Temp"}, 1236032, ... ) }, 1236032, ... ) == 0x0
 03504   396   NtOpenFile  (0x100001, {24, 0, 0x40, 0, 0,  (0x100001, {24, 0, 0x40, 0, 0, "\??\C:\"}, 3, 16417, ... 392, {status=0x0, info=1}, ) }, 3, 16417, ... 392, {status=0x0, info=1}, ) == 0x0
 03505   396   NtQueryDirectoryFile  (392, 0, 0, 0, 1235392, 616, BothDirectory, 1,  (392, 0, 0, 0, 1235392, 616, BothDirectory, 1, "Documents and Settings", 0, ... {status=0x0, info=138}, ) , 0, ... {status=0x0, info=138}, ) == 0x0
 03506   396   NtClose  (392, ... ) == 0x0
 03507   396   NtOpenFile  (0x100001, {24, 0, 0x40, 0, 0,  (0x100001, {24, 0, 0x40, 0, 0, "\??\C:\Documents and Settings\SRI-user\"}, 3, 16417, ... 392, {status=0x0, info=1}, ) }, 3, 16417, ... 392, {status=0x0, info=1}, ) == 0x0
 03508   396   NtQueryDirectoryFile  (392, 0, 0, 0, 1235392, 616, BothDirectory, 1,  (392, 0, 0, 0, 1235392, 616, BothDirectory, 1, "Local Settings", 0, ... {status=0x0, info=122}, ) , 0, ... {status=0x0, info=122}, ) == 0x0
 03509   396   NtClose  (392, ... ) == 0x0
 03510   396   NtQueryInformationProcess  (-1, DefaultHardErrorMode, 4, ... {process info, class 12, size 4}, 0x0, ) == 0x0
 03511   396   NtSetInformationProcess  (-1, DefaultHardErrorMode, {process info, class 12, size 4}, 4, ... ) == 0x0
 03512   396   NtQueryVirtualMemory  (-1, 0xb00000, Basic, 28, ... {BaseAddress=0xb00000,AllocationBase=0xb00000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 0x0, ) == 0x0
 03513   396   NtEnumerateValueKey  (388, 1, Full, 220, ... TitleIdx=0, Type=2, Name= (388, 1, Full, 220, ... TitleIdx=0, Type=2, Name="TMP", Data="%\0U\0S\0E\0R\0P\0R\0O\0F\0I\0L\0E\0%\0\\0L\0o\0c\0a\0l\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0T\0e\0m\0p\0\0\0"}, 96, ) , Data= (388, 1, Full, 220, ... TitleIdx=0, Type=2, Name="TMP", Data="%\0U\0S\0E\0R\0P\0R\0O\0F\0I\0L\0E\0%\0\\0L\0o\0c\0a\0l\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0T\0e\0m\0p\0\0\0"}, 96, ) }, 96, ) == 0x0
 03514   396   NtQueryInformationProcess  (-1, DefaultHardErrorMode, 4, ... {process info, class 12, size 4}, 0x0, ) == 0x0
 03515   396   NtSetInformationProcess  (-1, DefaultHardErrorMode, {process info, class 12, size 4}, 4, ... ) == 0x0
 03516   396   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\Documents and Settings\SRI-user\Local Settings\Temp"}, 1236032, ... ) }, 1236032, ... ) == 0x0
 03517   396   NtOpenFile  (0x100001, {24, 0, 0x40, 0, 0,  (0x100001, {24, 0, 0x40, 0, 0, "\??\C:\"}, 3, 16417, ... 392, {status=0x0, info=1}, ) }, 3, 16417, ... 392, {status=0x0, info=1}, ) == 0x0
 03518   396   NtQueryDirectoryFile  (392, 0, 0, 0, 1235392, 616, BothDirectory, 1,  (392, 0, 0, 0, 1235392, 616, BothDirectory, 1, "Documents and Settings", 0, ... {status=0x0, info=138}, ) , 0, ... {status=0x0, info=138}, ) == 0x0
 03519   396   NtClose  (392, ... ) == 0x0
 03520   396   NtOpenFile  (0x100001, {24, 0, 0x40, 0, 0,  (0x100001, {24, 0, 0x40, 0, 0, "\??\C:\Documents and Settings\SRI-user\"}, 3, 16417, ... 392, {status=0x0, info=1}, ) }, 3, 16417, ... 392, {status=0x0, info=1}, ) == 0x0
 03521   396   NtQueryDirectoryFile  (392, 0, 0, 0, 1235392, 616, BothDirectory, 1,  (392, 0, 0, 0, 1235392, 616, BothDirectory, 1, "Local Settings", 0, ... {status=0x0, info=122}, ) , 0, ... {status=0x0, info=122}, ) == 0x0
 03522   396   NtClose  (392, ... ) == 0x0
 03523   396   NtQueryInformationProcess  (-1, DefaultHardErrorMode, 4, ... {process info, class 12, size 4}, 0x0, ) == 0x0
 03524   396   NtSetInformationProcess  (-1, DefaultHardErrorMode, {process info, class 12, size 4}, 4, ... ) == 0x0
 03525   396   NtQueryVirtualMemory  (-1, 0xb00000, Basic, 28, ... {BaseAddress=0xb00000,AllocationBase=0xb00000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 0x0, ) == 0x0
 03526   396   NtEnumerateValueKey  (388, 2, Full, 220, ... ) == STATUS_NO_MORE_ENTRIES
 03527   396   NtClose  (388, ... ) == 0x0
 03528   396   NtOpenKey  (0x20019, {24, 376, 0x40, 0, 0,  (0x20019, {24, 376, 0x40, 0, 0, "Volatile Environment"}, ... 388, ) }, ... 388, ) == 0x0
 03529   396   NtEnumerateValueKey  (388, 0, Full, 220, ... TitleIdx=0, Type=1, Name= (388, 0, Full, 220, ... TitleIdx=0, Type=1, Name="LOGONSERVER", Data="\\0\\0M\0Y\0W\0O\0R\0L\0D\0\0\0"}, 64, ) , Data= (388, 0, Full, 220, ... TitleIdx=0, Type=1, Name="LOGONSERVER", Data="\\0\\0M\0Y\0W\0O\0R\0L\0D\0\0\0"}, 64, ) }, 64, ) == 0x0
 03530   396   NtQueryVirtualMemory  (-1, 0xb00000, Basic, 28, ... {BaseAddress=0xb00000,AllocationBase=0xb00000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 0x0, ) == 0x0
 03531   396   NtEnumerateValueKey  (388, 1, Full, 220, ... TitleIdx=0, Type=1, Name= (388, 1, Full, 220, ... TitleIdx=0, Type=1, Name="HOMEDRIVE", Data="C\0:\0\0\0"}, 46, ) , Data= (388, 1, Full, 220, ... TitleIdx=0, Type=1, Name="HOMEDRIVE", Data="C\0:\0\0\0"}, 46, ) }, 46, ) == 0x0
 03532   396   NtQueryVirtualMemory  (-1, 0xb00000, Basic, 28, ... {BaseAddress=0xb00000,AllocationBase=0xb00000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 0x0, ) == 0x0
 03533   396   NtEnumerateValueKey  (388, 2, Full, 220, ... TitleIdx=0, Type=1, Name= (388, 2, Full, 220, ... TitleIdx=0, Type=1, Name="HOMEPATH", Data="\\0D\0o\0c\0u\0m\0e\0n\0t\0s\0 \0a\0n\0d\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0S\0R\0I\0-\0u\0s\0e\0r\0\0\0"}, 102, ) , Data= (388, 2, Full, 220, ... TitleIdx=0, Type=1, Name="HOMEPATH", Data="\\0D\0o\0c\0u\0m\0e\0n\0t\0s\0 \0a\0n\0d\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0S\0R\0I\0-\0u\0s\0e\0r\0\0\0"}, 102, ) }, 102, ) == 0x0
 03534   396   NtQueryVirtualMemory  (-1, 0xb00000, Basic, 28, ... {BaseAddress=0xb00000,AllocationBase=0xb00000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 0x0, ) == 0x0
 03535   396   NtEnumerateValueKey  (388, 3, Full, 220, ... TitleIdx=0, Type=1, Name= (388, 3, Full, 220, ... TitleIdx=0, Type=1, Name="CLIENTNAME", Data="C\0o\0n\0s\0o\0l\0e\0\0\0"}, 56, ) , Data= (388, 3, Full, 220, ... TitleIdx=0, Type=1, Name="CLIENTNAME", Data="C\0o\0n\0s\0o\0l\0e\0\0\0"}, 56, ) }, 56, ) == 0x0
 03536   396   NtQueryVirtualMemory  (-1, 0xb00000, Basic, 28, ... {BaseAddress=0xb00000,AllocationBase=0xb00000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 0x0, ) == 0x0
 03537   396   NtEnumerateValueKey  (388, 4, Full, 220, ... TitleIdx=0, Type=1, Name= (388, 4, Full, 220, ... TitleIdx=0, Type=1, Name="SESSIONNAME", Data="C\0o\0n\0s\0o\0l\0e\0\0\0"}, 60, ) , Data= (388, 4, Full, 220, ... TitleIdx=0, Type=1, Name="SESSIONNAME", Data="C\0o\0n\0s\0o\0l\0e\0\0\0"}, 60, ) }, 60, ) == 0x0
 03538   396   NtQueryVirtualMemory  (-1, 0xb00000, Basic, 28, ... {BaseAddress=0xb00000,AllocationBase=0xb00000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 0x0, ) == 0x0
 03539   396   NtEnumerateValueKey  (388, 5, Full, 220, ... TitleIdx=0, Type=1, Name= (388, 5, Full, 220, ... TitleIdx=0, Type=1, Name="APPDATA", Data="C\0:\0\\0D\0o\0c\0u\0m\0e\0n\0t\0s\0 \0a\0n\0d\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0S\0R\0I\0-\0u\0s\0e\0r\0\\0A\0p\0p\0l\0i\0c\0a\0t\0i\0o\0n\0 \0D\0a\0t\0a\0\0\0"}, 140, ) , Data= (388, 5, Full, 220, ... TitleIdx=0, Type=1, Name="APPDATA", Data="C\0:\0\\0D\0o\0c\0u\0m\0e\0n\0t\0s\0 \0a\0n\0d\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0S\0R\0I\0-\0u\0s\0e\0r\0\\0A\0p\0p\0l\0i\0c\0a\0t\0i\0o\0n\0 \0D\0a\0t\0a\0\0\0"}, 140, ) }, 140, ) == 0x0
 03540   396   NtQueryVirtualMemory  (-1, 0xb00000, Basic, 28, ... {BaseAddress=0xb00000,AllocationBase=0xb00000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 0x0, ) == 0x0
 03541   396   NtEnumerateValueKey  (388, 6, Full, 220, ... TitleIdx=0, Type=1, Name= (388, 6, Full, 220, ... TitleIdx=0, Type=1, Name="HOMESHARE", Data="\0\0"}, 42, ) , Data= (388, 6, Full, 220, ... TitleIdx=0, Type=1, Name="HOMESHARE", Data="\0\0"}, 42, ) }, 42, ) == 0x0
 03542   396   NtEnumerateValueKey  (388, 7, Full, 220, ... ) == STATUS_NO_MORE_ENTRIES
 03543   396   NtEnumerateValueKey  (388, 0, Full, 220, ... TitleIdx=0, Type=1, Name= (388, 0, Full, 220, ... TitleIdx=0, Type=1, Name="LOGONSERVER", Data="\\0\\0M\0Y\0W\0O\0R\0L\0D\0\0\0"}, 64, ) , Data= (388, 0, Full, 220, ... TitleIdx=0, Type=1, Name="LOGONSERVER", Data="\\0\\0M\0Y\0W\0O\0R\0L\0D\0\0\0"}, 64, ) }, 64, ) == 0x0
 03544   396   NtEnumerateValueKey  (388, 1, Full, 220, ... TitleIdx=0, Type=1, Name= (388, 1, Full, 220, ... TitleIdx=0, Type=1, Name="HOMEDRIVE", Data="C\0:\0\0\0"}, 46, ) , Data= (388, 1, Full, 220, ... TitleIdx=0, Type=1, Name="HOMEDRIVE", Data="C\0:\0\0\0"}, 46, ) }, 46, ) == 0x0
 03545   396   NtEnumerateValueKey  (388, 2, Full, 220, ... TitleIdx=0, Type=1, Name= (388, 2, Full, 220, ... TitleIdx=0, Type=1, Name="HOMEPATH", Data="\\0D\0o\0c\0u\0m\0e\0n\0t\0s\0 \0a\0n\0d\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0S\0R\0I\0-\0u\0s\0e\0r\0\0\0"}, 102, ) , Data= (388, 2, Full, 220, ... TitleIdx=0, Type=1, Name="HOMEPATH", Data="\\0D\0o\0c\0u\0m\0e\0n\0t\0s\0 \0a\0n\0d\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0S\0R\0I\0-\0u\0s\0e\0r\0\0\0"}, 102, ) }, 102, ) == 0x0
 03546   396   NtEnumerateValueKey  (388, 3, Full, 220, ... TitleIdx=0, Type=1, Name= (388, 3, Full, 220, ... TitleIdx=0, Type=1, Name="CLIENTNAME", Data="C\0o\0n\0s\0o\0l\0e\0\0\0"}, 56, ) , Data= (388, 3, Full, 220, ... TitleIdx=0, Type=1, Name="CLIENTNAME", Data="C\0o\0n\0s\0o\0l\0e\0\0\0"}, 56, ) }, 56, ) == 0x0
 03547   396   NtEnumerateValueKey  (388, 4, Full, 220, ... TitleIdx=0, Type=1, Name= (388, 4, Full, 220, ... TitleIdx=0, Type=1, Name="SESSIONNAME", Data="C\0o\0n\0s\0o\0l\0e\0\0\0"}, 60, ) , Data= (388, 4, Full, 220, ... TitleIdx=0, Type=1, Name="SESSIONNAME", Data="C\0o\0n\0s\0o\0l\0e\0\0\0"}, 60, ) }, 60, ) == 0x0
 03548   396   NtEnumerateValueKey  (388, 5, Full, 220, ... TitleIdx=0, Type=1, Name= (388, 5, Full, 220, ... TitleIdx=0, Type=1, Name="APPDATA", Data="C\0:\0\\0D\0o\0c\0u\0m\0e\0n\0t\0s\0 \0a\0n\0d\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0S\0R\0I\0-\0u\0s\0e\0r\0\\0A\0p\0p\0l\0i\0c\0a\0t\0i\0o\0n\0 \0D\0a\0t\0a\0\0\0"}, 140, ) , Data= (388, 5, Full, 220, ... TitleIdx=0, Type=1, Name="APPDATA", Data="C\0:\0\\0D\0o\0c\0u\0m\0e\0n\0t\0s\0 \0a\0n\0d\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0S\0R\0I\0-\0u\0s\0e\0r\0\\0A\0p\0p\0l\0i\0c\0a\0t\0i\0o\0n\0 \0D\0a\0t\0a\0\0\0"}, 140, ) }, 140, ) == 0x0
 03549   396   NtEnumerateValueKey  (388, 6, Full, 220, ... TitleIdx=0, Type=1, Name= (388, 6, Full, 220, ... TitleIdx=0, Type=1, Name="HOMESHARE", Data="\0\0"}, 42, ) , Data= (388, 6, Full, 220, ... TitleIdx=0, Type=1, Name="HOMESHARE", Data="\0\0"}, 42, ) }, 42, ) == 0x0
 03550   396   NtEnumerateValueKey  (388, 7, Full, 220, ... ) == STATUS_NO_MORE_ENTRIES
 03551   396   NtClose  (388, ... ) == 0x0
 03552   396   NtClose  (376, ... ) == 0x0
 03553   396   NtFreeVirtualMemory  (-1, (0xb00000), 0, 32768, ... (0xb00000), 4096, ) == 0x0
 03554   396   NtClose  (384, ... ) == 0x0
 03555   396   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\Documents and Settings\SRI-user\Application Data"}, 1237956, ... ) }, 1237956, ... ) == 0x0
 03556   396   NtQueryInformationToken  (380, User, 64, ... {token info, class 1, size 36}, 36, ) == 0x0
 03557   396   NtOpenKey  (0x2001f, {24, 328, 0x40, 0, 0,  (0x2001f, {24, 328, 0x40, 0, 0, "S-1-5-21-1078081533-484763869-839522115-1003"}, ... 384, ) }, ... 384, ) == 0x0
 03558   396   NtCreateKey  (0x2000000, {24, 384, 0x40, 0, 0,  (0x2000000, {24, 384, 0x40, 0, 0, "Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders"}, 0, 0x0, 0, ... 376, 2, ) }, 0, 0x0, 0, ... 376, 2, ) == 0x0
 03559   396   NtClose  (384, ... ) == 0x0
 03560   396   NtSetValueKey  (376,  (376, "AppData", 0, 1, "C\0:\0\\0D\0o\0c\0u\0m\0e\0n\0t\0s\0 \0a\0n\0d\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0S\0R\0I\0-\0u\0s\0e\0r\0\\0A\0p\0p\0l\0i\0c\0a\0t\0i\0o\0n\0 \0D\0a\0t\0a\0\0\0", 104, ... ) , 0, 1,  (376, "AppData", 0, 1, "C\0:\0\\0D\0o\0c\0u\0m\0e\0n\0t\0s\0 \0a\0n\0d\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0S\0R\0I\0-\0u\0s\0e\0r\0\\0A\0p\0p\0l\0i\0c\0a\0t\0i\0o\0n\0 \0D\0a\0t\0a\0\0\0", 104, ... ) , 104, ... ) == 0x0
 03561   396   NtClose  (376, ... ) == 0x0
 03562   396   NtClose  (380, ... ) == 0x0
 03563   396   NtOpenFile  (0x100001, {24, 0, 0x40, 0, 0,  (0x100001, {24, 0, 0x40, 0, 0, "\??\C:\Documents and Settings\SRI-user\Application Data\Microsoft\Network\Connections\Pbk\"}, 3, 16417, ... ) }, 3, 16417, ... ) == STATUS_OBJECT_PATH_NOT_FOUND
 03564   396   NtWaitForSingleObject  (156, 0, 0x0, ... ) == 0x0
 03565   396   NtQueryInformationFile  (152, 1239004, 24, Standard, ... {status=0x0, info=24}, ) == 0x0
 03566   396   NtReleaseMutant  (156, ... 0x0, ) == 0x0
 03567   396   NtReleaseMutant  (200, ... 0x0, ) == 0x0
 03568   396   NtWaitForSingleObject  (72, 0, {0, 0}, ... ) == 0x102
 03569   396   NtWaitForSingleObject  (72, 0, {0, 0}, ... ) == 0x102
 03570   396   NtWaitForSingleObject  (72, 0, {0, 0}, ... ) == 0x102
 03571   396   NtWaitForSingleObject  (80, 0, {0, 0}, ... ) == 0x102
 03572   396   NtCreateEvent  (0x1f0003, 0x0, 1, 0, ... 380, ) == 0x0
 03573   396   NtConnectPort  ( ("\RPC Control\DNSResolver", {12, 2, 1, 1}, 0x0, 0x0, 1237144, 112, ... 376, 0x0, 0x0, 0x0, 112, ) , {12, 2, 1, 1}, 0x0, 0x0, 1237144, 112, ... 376, 0x0, 0x0, 0x0, 112, ) == 0x0
 03574   396   NtRequestWaitReplyPort  (376, {128, 152, new_msg, 0, 122476, 1310720, 1236908, 2012750850}  (376, {128, 152, new_msg, 0, 122476, 1310720, 1236908, 2012750850} "\0\346\22\0\2$\370w\370T\367w\1kwEVY\205D\237\200\364(\367\326\1)\2\0\0\0\1\0\0\0k\23\314w\4\0\0\0\20\344\314w\0\312\25\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\1\0\16\0\20\311\25\0\210\311\25\0\0\0\0\0f\0\0\03\0\0\0L\347\22\0\0\0\0\0\0\0\22\0H\340\22\0hE\25\0t\343\22\0\0\0\0\0\5\0\0\0\5\0\0\0" ... {128, 152, reply, 0, 316, 396, 1578, 0} "\7\346\22\0\2$\370w\370T\367w\1kwEVY\205D\237\200\364(\367\326\1)\2\0\0\0\1\0\0\0\0\0\0\0\4\0\0\0\20\344\314w\377\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\1\0\16\0\20\311\25\0\210\311\25\0\0\0\0\0f\0\0\03\0\0\0L\347\22\0\0\0\0\0\0\0\22\0H\340\22\0hE\25\0t\343\22\0\0\0\0\0\5\0\0\0\5\0\0\0" )  ... {128, 152, reply, 0, 316, 396, 1578, 0}  (376, {128, 152, new_msg, 0, 122476, 1310720, 1236908, 2012750850} "\0\346\22\0\2$\370w\370T\367w\1kwEVY\205D\237\200\364(\367\326\1)\2\0\0\0\1\0\0\0k\23\314w\4\0\0\0\20\344\314w\0\312\25\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\1\0\16\0\20\311\25\0\210\311\25\0\0\0\0\0f\0\0\03\0\0\0L\347\22\0\0\0\0\0\0\0\22\0H\340\22\0hE\25\0t\343\22\0\0\0\0\0\5\0\0\0\5\0\0\0" ... {128, 152, reply, 0, 316, 396, 1578, 0} "\7\346\22\0\2$\370w\370T\367w\1kwEVY\205D\237\200\364(\367\326\1)\2\0\0\0\1\0\0\0\0\0\0\0\4\0\0\0\20\344\314w\377\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\1\0\16\0\20\311\25\0\210\311\25\0\0\0\0\0f\0\0\03\0\0\0L\347\22\0\0\0\0\0\0\0\22\0H\340\22\0hE\25\0t\343\22\0\0\0\0\0\5\0\0\0\5\0\0\0" )  ) == 0x0
 03575   396   NtRequestWaitReplyPort  (376, {112, 136, new_msg, 0, 44, 3, 20, 0}  (376, {112, 136, new_msg, 0, 44, 3, 20, 0} "\1\0\0\0A\2\11\0\333?\334\21\261\310\0\14)\371\246\305\1\0\0\0\377\377\377\377\1\0\0\0\0\0\0\0,\10\25\0\25\0\0\0\0\0\0\0\25\0\0\0s\0r\0v\00\02\0.\0b\0a\0s\0h\0c\0h\0e\0l\0i\0k\0.\0c\0o\0m\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0" ... {44, 68, reply, 0, 316, 396, 1579, 0} "\2\240\372\177\1\00\300\0\0\0\0G\3\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\264\5\0\0\1\0\0\0" )  ... {44, 68, reply, 0, 316, 396, 1579, 0}  (376, {112, 136, new_msg, 0, 44, 3, 20, 0} "\1\0\0\0A\2\11\0\333?\334\21\261\310\0\14)\371\246\305\1\0\0\0\377\377\377\377\1\0\0\0\0\0\0\0,\10\25\0\25\0\0\0\0\0\0\0\25\0\0\0s\0r\0v\00\02\0.\0b\0a\0s\0h\0c\0h\0e\0l\0i\0k\0.\0c\0o\0m\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0" ... {44, 68, reply, 0, 316, 396, 1579, 0} "\2\240\372\177\1\00\300\0\0\0\0G\3\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\264\5\0\0\1\0\0\0" )  ) == 0x0
 03576   396   NtClose  (380, ... ) == 0x0
 03577   396   NtClose  (376, ... ) == 0x0
 03578   396   NtCreateFile  (0x3, {24, 0, 0x40, 0, 0,  (0x3, {24, 0, 0x40, 0, 0, "\Device\RasAcd"}, 0x0, 128, 3, 3, 0, 0, 0, ... 376, {status=0x0, info=0}, ) }, 0x0, 128, 3, 3, 0, 0, 0, ... 376, {status=0x0, info=0}, ) == 0x0
 03579   396   NtCreateEvent  (0x1f0003, 0x0, 1, 0, ... 380, ) == 0x0
 03580   396   NtDeviceIoControlFile  (376, 380, 0x0, 0x0, 0xf14014,  (376, 380, 0x0, 0x0, 0xf14014, "\3\0\0\0srv02.bashchelik.com\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0", 1552, 0, ... ) , 1552, 0, ... ) == STATUS_UNSUCCESSFUL
 03581   396   NtClose  (380, ... ) == 0x0
 03582   396   NtClose  (376, ... ) == 0x0
 03583   396   NtClearEvent  (352, ... ) == 0x0
 03584   396   NtSetEvent  (352, ... 0x0, ) == 0x0
 03585   396   NtClose  (352, ... ) == 0x0
 03586   396   NtWaitForSingleObject  (80, 0, {0, 0}, ... ) == 0x102
 03587   396   NtCreateEvent  (0x1f0003, 0x0, 1, 0, ... 352, ) == 0x0
 03588   396   NtConnectPort  ( ("\RPC Control\DNSResolver", {12, 2, 1, 1}, 0x0, 0x0, 1238448, 112, ... 376, 0x0, 0x0, 0x0, 112, ) , {12, 2, 1, 1}, 0x0, 0x0, 1238448, 112, ... 376, 0x0, 0x0, 0x0, 112, ) == 0x0
 03589   396   NtRequestWaitReplyPort  (376, {128, 152, new_msg, 0, 123780, 1310720, 1238212, 2012750850}  (376, {128, 152, new_msg, 0, 123780, 1310720, 1238212, 2012750850} "\0\353\22\0\2$\370w\370T\367w\1kwEVY\205D\237\200\364(\367\326\1)\2\0\0\0\1\0\0\0k\23\314w\4\0\0\0\20\344\314w(\357\25\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\1\0\17\0\350\352\25\0P\350\25\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\5\0\0\0\5\0\0\0" ... {128, 152, reply, 0, 316, 396, 1582, 0} "\7\353\22\0\2$\370w\370T\367w\1kwEVY\205D\237\200\364(\367\326\1)\2\0\0\0\1\0\0\0\0\0\0\0\4\0\0\0\20\344\314w\377\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\1\0\17\0\350\352\25\0P\350\25\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\5\0\0\0\5\0\0\0" )  ... {128, 152, reply, 0, 316, 396, 1582, 0}  (376, {128, 152, new_msg, 0, 123780, 1310720, 1238212, 2012750850} "\0\353\22\0\2$\370w\370T\367w\1kwEVY\205D\237\200\364(\367\326\1)\2\0\0\0\1\0\0\0k\23\314w\4\0\0\0\20\344\314w(\357\25\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\1\0\17\0\350\352\25\0P\350\25\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\5\0\0\0\5\0\0\0" ... {128, 152, reply, 0, 316, 396, 1582, 0} "\7\353\22\0\2$\370w\370T\367w\1kwEVY\205D\237\200\364(\367\326\1)\2\0\0\0\1\0\0\0\0\0\0\0\4\0\0\0\20\344\314w\377\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\1\0\17\0\350\352\25\0P\350\25\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\5\0\0\0\5\0\0\0" )  ) == 0x0
 03590   396   NtRequestWaitReplyPort  (376, {64, 88, new_msg, 0, 316, 396, 1579, 0}  (376, {64, 88, new_msg, 0, 316, 396, 1579, 0} "\1\240\0\0A\2\10\0\0\0\0\0G\3\0\0\0\0\0\0\0\0\0\0\377\377\377\377\0\0\0\0\0\0\0\0\21\0\0\0\0\0\0\0\0\0\0\0\25\0\0\0s\0r\0v\00\02\0.\0" ... {52, 76, reply, 0, 316, 396, 1583, 0} "\2\240\372\177\1\00\300\0\0\0\0G\3\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\200]\12\0\1\0\0\0\1\0\0\0\300\250|\201\377\377\377\0" )  ... {52, 76, reply, 0, 316, 396, 1583, 0}  (376, {64, 88, new_msg, 0, 316, 396, 1579, 0} "\1\240\0\0A\2\10\0\0\0\0\0G\3\0\0\0\0\0\0\0\0\0\0\377\377\377\377\0\0\0\0\0\0\0\0\21\0\0\0\0\0\0\0\0\0\0\0\25\0\0\0s\0r\0v\00\02\0.\0" ... {52, 76, reply, 0, 316, 396, 1583, 0} "\2\240\372\177\1\00\300\0\0\0\0G\3\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\200]\12\0\1\0\0\0\1\0\0\0\300\250|\201\377\377\377\0" )  ) == 0x0
 03591   396   NtClose  (352, ... ) == 0x0
 03592   396   NtClose  (376, ... ) == 0x0
 03593   396   NtCreateKey  (0x20019, {24, 48, 0x40, 0, 0,  (0x20019, {24, 48, 0x40, 0, 0, "System\CurrentControlSet\Services\Tcpip\Parameters"}, 0, "Class", 0, ... 376, 2, ) }, 0,  (0x20019, {24, 48, 0x40, 0, 0, "System\CurrentControlSet\Services\Tcpip\Parameters"}, 0, "Class", 0, ... 376, 2, ) , 0, ... 376, 2, ) == 0x0
 03594   396   NtOpenKey  (0x20019, {24, 48, 0x40, 0, 0,  (0x20019, {24, 48, 0x40, 0, 0, "System\CurrentControlSet\Services\DnsCache\Parameters"}, ... 352, ) }, ... 352, ) == 0x0
 03595   396   NtOpenKey  (0x20019, {24, 48, 0x40, 0, 0,  (0x20019, {24, 48, 0x40, 0, 0, "Software\Policies\Microsoft\Windows NT\DnsClient"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 03596   396   NtQueryValueKey  (376,  (376, "Hostname", Partial, 144, ... TitleIdx=0, Type=1, Data="M\0Y\0W\0O\0R\0L\0D\0\0\0"}, 28, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (376, "Hostname", Partial, 144, ... TitleIdx=0, Type=1, Data="M\0Y\0W\0O\0R\0L\0D\0\0\0"}, 28, ) }, 28, ) == 0x0
 03597   396   NtQueryValueKey  (376,  (376, "Hostname", Partial, 144, ... TitleIdx=0, Type=1, Data="M\0Y\0W\0O\0R\0L\0D\0\0\0"}, 28, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (376, "Hostname", Partial, 144, ... TitleIdx=0, Type=1, Data="M\0Y\0W\0O\0R\0L\0D\0\0\0"}, 28, ) }, 28, ) == 0x0
 03598   396   NtClose  (376, ... ) == 0x0
 03599   396   NtClose  (352, ... ) == 0x0
 03600   396   NtCreateKey  (0x20019, {24, 48, 0x40, 0, 0,  (0x20019, {24, 48, 0x40, 0, 0, "System\CurrentControlSet\Services\Tcpip\Parameters"}, 0, "Class", 0, ... 352, 2, ) }, 0,  (0x20019, {24, 48, 0x40, 0, 0, "System\CurrentControlSet\Services\Tcpip\Parameters"}, 0, "Class", 0, ... 352, 2, ) , 0, ... 352, 2, ) == 0x0
 03601   396   NtOpenKey  (0x20019, {24, 48, 0x40, 0, 0,  (0x20019, {24, 48, 0x40, 0, 0, "System\CurrentControlSet\Services\DnsCache\Parameters"}, ... 376, ) }, ... 376, ) == 0x0
 03602   396   NtOpenKey  (0x20019, {24, 48, 0x40, 0, 0,  (0x20019, {24, 48, 0x40, 0, 0, "Software\Policies\Microsoft\Windows NT\DnsClient"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 03603   396   NtQueryValueKey  (352,  (352, "Domain", Partial, 144, ... TitleIdx=0, Type=1, Data="\0\0"}, 14, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (352, "Domain", Partial, 144, ... TitleIdx=0, Type=1, Data="\0\0"}, 14, ) }, 14, ) == 0x0
 03604   396   NtQueryValueKey  (352,  (352, "Domain", Partial, 144, ... TitleIdx=0, Type=1, Data="\0\0"}, 14, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (352, "Domain", Partial, 144, ... TitleIdx=0, Type=1, Data="\0\0"}, 14, ) }, 14, ) == 0x0
 03605   396   NtClose  (352, ... ) == 0x0
 03606   396   NtClose  (376, ... ) == 0x0
 03607   396   NtWaitForSingleObject  (80, 0, {0, 0}, ... ) == 0x102
 03608   396   NtCreateEvent  (0x1f0003, 0x0, 1, 0, ... 376, ) == 0x0
 03609   396   NtConnectPort  ( ("\RPC Control\DNSResolver", {12, 2, 1, 1}, 0x0, 0x0, 1238248, 112, ... 352, 0x0, 0x0, 0x0, 112, ) , {12, 2, 1, 1}, 0x0, 0x0, 1238248, 112, ... 352, 0x0, 0x0, 0x0, 112, ) == 0x0
 03610   396   NtRequestWaitReplyPort  (352, {128, 152, new_msg, 0, 123580, 1310720, 1238012, 2012750850}  (352, {128, 152, new_msg, 0, 123580, 1310720, 1238012, 2012750850} "\0\352\22\0\2$\370w\370T\367w\1kwEVY\205D\237\200\364(\367\326\1)\2\0\0\0\1\0\0\0k\23\314w\4\0\0\0\20\344\314w(\357\25\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\1\0\20\0\350\352\25\0(\251\25\0\0\0\0\0l\347\22\0\34\347\22\0\14\351\22\0\0\0\0\0\0\0\25\0\377\377\377\377\365\26\365w\315\27\365w\0\0\0\0\5\0\0\0\5\0\0\0" ... {128, 152, reply, 0, 316, 396, 1586, 0} "\7\352\22\0\2$\370w\370T\367w\1kwEVY\205D\237\200\364(\367\326\1)\2\0\0\0\1\0\0\0\0\0\0\0\4\0\0\0\20\344\314w\377\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\1\0\20\0\350\352\25\0(\251\25\0\0\0\0\0l\347\22\0\34\347\22\0\14\351\22\0\0\0\0\0\0\0\25\0\377\377\377\377\365\26\365w\315\27\365w\0\0\0\0\5\0\0\0\5\0\0\0" )  ... {128, 152, reply, 0, 316, 396, 1586, 0}  (352, {128, 152, new_msg, 0, 123580, 1310720, 1238012, 2012750850} "\0\352\22\0\2$\370w\370T\367w\1kwEVY\205D\237\200\364(\367\326\1)\2\0\0\0\1\0\0\0k\23\314w\4\0\0\0\20\344\314w(\357\25\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\1\0\20\0\350\352\25\0(\251\25\0\0\0\0\0l\347\22\0\34\347\22\0\14\351\22\0\0\0\0\0\0\0\25\0\377\377\377\377\365\26\365w\315\27\365w\0\0\0\0\5\0\0\0\5\0\0\0" ... {128, 152, reply, 0, 316, 396, 1586, 0} "\7\352\22\0\2$\370w\370T\367w\1kwEVY\205D\237\200\364(\367\326\1)\2\0\0\0\1\0\0\0\0\0\0\0\4\0\0\0\20\344\314w\377\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\1\0\20\0\350\352\25\0(\251\25\0\0\0\0\0l\347\22\0\34\347\22\0\14\351\22\0\0\0\0\0\0\0\25\0\377\377\377\377\365\26\365w\315\27\365w\0\0\0\0\5\0\0\0\5\0\0\0" )  ) == 0x0
 03611   396   NtRequestWaitReplyPort  (352, {64, 88, new_msg, 0, 316, 396, 1583, 0}  (352, {64, 88, new_msg, 0, 316, 396, 1583, 0} "\1\240\0\0A\2\10\0\0\0\0\0G\3\0\0\0\0\0\0\0\0\0\0\377\377\377\377\0\0\0\0\0\0\0\0\21\0\0\0\0\0\0\0\0\0\0\0\377\377\377\0s\0r\0v\00\02\0.\0" ... {52, 76, reply, 0, 316, 396, 1587, 0} "\2\240\372\177\1\00\300\0\0\0\0G\3\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\200]\12\0\1\0\0\0\1\0\0\0\300\250|\201\377\377\377\0" )  ... {52, 76, reply, 0, 316, 396, 1587, 0}  (352, {64, 88, new_msg, 0, 316, 396, 1583, 0} "\1\240\0\0A\2\10\0\0\0\0\0G\3\0\0\0\0\0\0\0\0\0\0\377\377\377\377\0\0\0\0\0\0\0\0\21\0\0\0\0\0\0\0\0\0\0\0\377\377\377\0s\0r\0v\00\02\0.\0" ... {52, 76, reply, 0, 316, 396, 1587, 0} "\2\240\372\177\1\00\300\0\0\0\0G\3\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\200]\12\0\1\0\0\0\1\0\0\0\300\250|\201\377\377\377\0" )  ) == 0x0
 03612   396   NtClose  (376, ... ) == 0x0
 03613   396   NtClose  (352, ... ) == 0x0
 03614   396   NtCreateKey  (0x20019, {24, 48, 0x40, 0, 0,  (0x20019, {24, 48, 0x40, 0, 0, "System\CurrentControlSet\Services\Tcpip\Parameters"}, 0, "Class", 0, ... 352, 2, ) }, 0,  (0x20019, {24, 48, 0x40, 0, 0, "System\CurrentControlSet\Services\Tcpip\Parameters"}, 0, "Class", 0, ... 352, 2, ) , 0, ... 352, 2, ) == 0x0
 03615   396   NtOpenKey  (0x20019, {24, 48, 0x40, 0, 0,  (0x20019, {24, 48, 0x40, 0, 0, "System\CurrentControlSet\Services\DnsCache\Parameters"}, ... 376, ) }, ... 376, ) == 0x0
 03616   396   NtOpenKey  (0x20019, {24, 48, 0x40, 0, 0,  (0x20019, {24, 48, 0x40, 0, 0, "Software\Policies\Microsoft\Windows NT\DnsClient"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 03617   396   NtQueryValueKey  (352,  (352, "Hostname", Partial, 144, ... TitleIdx=0, Type=1, Data="M\0Y\0W\0O\0R\0L\0D\0\0\0"}, 28, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (352, "Hostname", Partial, 144, ... TitleIdx=0, Type=1, Data="M\0Y\0W\0O\0R\0L\0D\0\0\0"}, 28, ) }, 28, ) == 0x0
 03618   396   NtQueryValueKey  (352,  (352, "Hostname", Partial, 144, ... TitleIdx=0, Type=1, Data="M\0Y\0W\0O\0R\0L\0D\0\0\0"}, 28, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (352, "Hostname", Partial, 144, ... TitleIdx=0, Type=1, Data="M\0Y\0W\0O\0R\0L\0D\0\0\0"}, 28, ) }, 28, ) == 0x0
 03619   396   NtClose  (352, ... ) == 0x0
 03620   396   NtClose  (376, ... ) == 0x0
 03621   396   NtCreateKey  (0x20019, {24, 48, 0x40, 0, 0,  (0x20019, {24, 48, 0x40, 0, 0, "System\CurrentControlSet\Services\Tcpip\Parameters"}, 0, "Class", 0, ... 376, 2, ) }, 0,  (0x20019, {24, 48, 0x40, 0, 0, "System\CurrentControlSet\Services\Tcpip\Parameters"}, 0, "Class", 0, ... 376, 2, ) , 0, ... 376, 2, ) == 0x0
 03622   396   NtOpenKey  (0x20019, {24, 48, 0x40, 0, 0,  (0x20019, {24, 48, 0x40, 0, 0, "System\CurrentControlSet\Services\DnsCache\Parameters"}, ... 352, ) }, ... 352, ) == 0x0
 03623   396   NtOpenKey  (0x20019, {24, 48, 0x40, 0, 0,  (0x20019, {24, 48, 0x40, 0, 0, "Software\Policies\Microsoft\Windows NT\DnsClient"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 03624   396   NtQueryValueKey  (376,  (376, "Domain", Partial, 144, ... TitleIdx=0, Type=1, Data="\0\0"}, 14, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (376, "Domain", Partial, 144, ... TitleIdx=0, Type=1, Data="\0\0"}, 14, ) }, 14, ) == 0x0
 03625   396   NtQueryValueKey  (376,  (376, "Domain", Partial, 144, ... TitleIdx=0, Type=1, Data="\0\0"}, 14, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (376, "Domain", Partial, 144, ... TitleIdx=0, Type=1, Data="\0\0"}, 14, ) }, 14, ) == 0x0
 03626   396   NtClose  (376, ... ) == 0x0
 03627   396   NtClose  (352, ... ) == 0x0
 03628   396   NtCreateFile  (0x3, {24, 0, 0x40, 0, 0,  (0x3, {24, 0, 0x40, 0, 0, "\Device\RasAcd"}, 0x0, 128, 3, 3, 0, 0, 0, ... 352, {status=0x0, info=0}, ) }, 0x0, 128, 3, 3, 0, 0, 0, ... 352, {status=0x0, info=0}, ) == 0x0
 03629   396   NtCreateEvent  (0x1f0003, 0x0, 1, 0, ... 376, ) == 0x0
 03630   396   NtDeviceIoControlFile  (352, 376, 0x0, 0x0, 0xf14014,  (352, 376, 0x0, 0x0, 0xf14014, "\3\0\0\0MYWORLD\0\231%\362v\2\0\0\200\330\304\362v\0\0\0\0d\352\22\0O\345\367w{\30\335w\0\0\0\0\300.\24\0H\357\25\0"\2\373\177t\353\22\0\0\0\0\0\263\26\365w\320\357\25\0q\26\365w\350\6\24\0\215\26\365w\0\0\0\0\320\354\25\0\20:\25\0\24\232\347w3\355\26\0H\357\25\0V\357\25\04\355\25\0\377\377\0\0\0\0\0\04\355\25\0\7\0\0\0H\357\25\0 \353\22\0\177;\245q\0\0\0\0\0\0\0\0H\357\25\0\0\0\0\04\355\25\0\377\377\0\0\1\0\0\0\0\0\0\0@\357\25\04\355\25\0(\357\25\0`\353\22\0}<\245q4\355\25\0\0\0\0\0H\357\25\0\365<\245q(\355\25\0\24\355\25\0\2\0\0\0\20\0\0\0\0\0\0\0\0\0\0\0\20\0\0\0\20:\1\0\0\0\24\0\270\352\22\0\230\357\22\0\330\374\22\0\2$\370w\370T\367wa/\245q\2642\250q\0\0\0\0\0\0\0\0:/\245q\20:\25\0h\246\25\0P\257\25\0h\257\25\0H\357\25\0V\357\25\04\355\25\0\377\377\0\0\0\0\0\04\355\25\0\7\0\0\0H\357\25\0\350\353\22\0\177;\245q\0\0\0\0\0\0\0\0H\357\25\0\0\0\0\04\355\25\0\377\377\0\0\1\0\0\0\0\0\0\0@\357\25\04\355\25\0(\357\25\0(\354\22\0}<\245q4\355\25\0\0\0\0\0H\357\25\0\365<\245q(\355\25\0\24\355\25\0\2\0\0\0\20\0\0\0\0\0\0\0\0\0\0\0\20\0\0\0\240\25\1\0\0\0\24\0\200\353\22\0`\360\22\0\330\374\22\0\2$\370w\370T\367wa/\245q\2642\250q\0\0\0\0\0\0\0\0:/\245q\240\25\25\0X\304\25\0P\257\25\0", 1552, 0, ... {status=0x0, info=0}, 0x0, ) \2\373\177t\353\22\0\0\0\0\0\263\26\365w\320\357\25\0q\26\365w\350\6\24\0\215\26\365w\0\0\0\0\320\354\25\0\20:\25\0\24\232\347w3\355\26\0H\357\25\0V\357\25\04\355\25\0\377\377\0\0\0\0\0\04\355\25\0\7\0\0\0H\357\25\0 \353\22\0\177;\245q\0\0\0\0\0\0\0\0H\357\25\0\0\0\0\04\355\25\0\377\377\0\0\1\0\0\0\0\0\0\0@\357\25\04\355\25\0(\357\25\0`\353\22\0}<\245q4\355\25\0\0\0\0\0H\357\25\0\365<\245q(\355\25\0\24\355\25\0\2\0\0\0\20\0\0\0\0\0\0\0\0\0\0\0\20\0\0\0\20:\1\0\0\0\24\0\270\352\22\0\230\357\22\0\330\374\22\0\2$\370w\370T\367wa/\245q\2642\250q\0\0\0\0\0\0\0\0:/\245q\20:\25\0h\246\25\0P\257\25\0h\257\25\0H\357\25\0V\357\25\04\355\25\0\377\377\0\0\0\0\0\04\355\25\0\7\0\0\0H\357\25\0\350\353\22\0\177;\245q\0\0\0\0\0\0\0\0H\357\25\0\0\0\0\04\355\25\0\377\377\0\0\1\0\0\0\0\0\0\0@\357\25\04\355\25\0(\357\25\0(\354\22\0}<\245q4\355\25\0\0\0\0\0H\357\25\0\365<\245q(\355\25\0\24\355\25\0\2\0\0\0\20\0\0\0\0\0\0\0\0\0\0\0\20\0\0\0\240\25\1\0\0\0\24\0\200\353\22\0`\360\22\0\330\374\22\0\2$\370w\370T\367wa/\245q\2642\250q\0\0\0\0\0\0\0\0:/\245q\240\25\25\0X\304\25\0P\257\25\0", 1552, 0, ... {status=0x0, info=0}, 0x0, ) == 0x0
 03631   396   NtClose  (376, ... ) == 0x0
 03632   396   NtClose  (352, ... ) == 0x0
 03633   396   NtCreateKey  (0x2000000, {24, 60, 0x40, 0, 0,  (0x2000000, {24, 60, 0x40, 0, 0, "Software\cv3"}, 0, 0x0, 0, ... 352, 2, ) }, 0, 0x0, 0, ... 352, 2, ) == 0x0
 03634   396   NtQueryValueKey  (352,  (352, "n", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (352, "n", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) }, 16, ) == 0x0
 03635   396   NtClose  (352, ... ) == 0x0
 03636   396   NtCreateEvent  (0x1f0003, 0x0, 1, 1, ... 352, ) == 0x0
 03637   396   NtWaitForSingleObject  (352, 0, 0x0, ... ) == 0x0
 03638   396   NtClearEvent  (352, ... ) == 0x0
 03639   396   NtSetEvent  (352, ... 0x0, ) == 0x0
 03640   396   NtWaitForSingleObject  (156, 0, 0x0, ... ) == 0x0
 03641   396   NtQueryInformationFile  (152, 1240908, 24, Standard, ... {status=0x0, info=24}, ) == 0x0
 03642   396   NtReleaseMutant  (156, ... 0x0, ) == 0x0
 03643   396   NtOpenKey  (0x20019, {24, 60, 0x40, 0, 0,  (0x20019, {24, 60, 0x40, 0, 0, "SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Http Filters\RPA"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 03644   396   NtOpenKey  (0x20019, {24, 48, 0x40, 0, 0,  (0x20019, {24, 48, 0x40, 0, 0, "SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Http Filters\RPA"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 03645   396   NtWaitForSingleObject  (200, 0, 0x0, ... ) == 0x0
 03646   396   NtWaitForSingleObject  (204, 0, 0x0, ... ) == 0x0
 03647   396   NtReleaseMutant  (204, ... 0x0, ) == 0x0
 03648   396   NtQueryValueKey  (108,  (108, "EnableAutodial", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (108, "EnableAutodial", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) }, 16, ) == 0x0
 03649   396   NtQueryValueKey  (108,  (108, "NoNetAutodial", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (108, "NoNetAutodial", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) }, 16, ) == 0x0
 03650   396   NtWaitForSingleObject  (156, 0, 0x0, ... ) == 0x0
 03651   396   NtQueryInformationFile  (152, 1241104, 24, Standard, ... {status=0x0, info=24}, ) == 0x0
 03652   396   NtReleaseMutant  (156, ... 0x0, ) == 0x0
 03653   396   NtReleaseMutant  (200, ... 0x0, ) == 0x0
 03654   396   NtWaitForSingleObject  (356, 0, 0x0, ... ) == 0x0
 03655   396   NtReleaseMutant  (356, ... 0x0, ) == 0x0
 03656   396   NtOpenKey  (0x20019, {24, 364, 0x40, 0, 0,  (0x20019, {24, 364, 0x40, 0, 0, "Domains\debelizombi.com"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 03657   396   NtOpenKey  (0x20019, {24, 48, 0x40, 0, 0,  (0x20019, {24, 48, 0x40, 0, 0, "Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\debelizombi.com"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 03658   396   NtQueryValueKey  (364,  (364, "IntranetName", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (364, "IntranetName", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) }, 16, ) == 0x0
 03659   396   NtQueryValueKey  (364,  (364, "ProxyBypass", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (364, "ProxyBypass", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) }, 16, ) == 0x0
 03660   396   NtClearEvent  (188, ... ) == 0x0
 03661   396   NtSetEvent  (188, ... 0x0, ) == 0x0
 03662   396   NtOpenKey  (0x20019, {24, 364, 0x40, 0, 0,  (0x20019, {24, 364, 0x40, 0, 0, "ProtocolDefaults\"}, ... 376, ) }, ... 376, ) == 0x0
 03663   396   NtQueryValueKey  (376,  (376, "http", Partial, 144, ... TitleIdx=0, Type=4, Data="\3\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (376, "http", Partial, 144, ... TitleIdx=0, Type=4, Data="\3\0\0\0"}, 16, ) }, 16, ) == 0x0
 03664   396   NtClose  (376, ... ) == 0x0
 03665   396   NtWaitForSingleObject  (356, 0, 0x0, ... ) == 0x0
 03666   396   NtReleaseMutant  (356, ... 0x0, ) == 0x0
 03667   396   NtWaitForSingleObject  (356, 0, 0x0, ... ) == 0x0
 03668   396   NtReleaseMutant  (356, ... 0x0, ) == 0x0
 03669   396   NtWaitForSingleObject  (360, 0, 0x0, ... ) == 0x0
 03670   396   NtReleaseMutant  (360, ... 0x0, ) == 0x0
 03671   396   NtWaitForSingleObject  (156, 0, 0x0, ... ) == 0x0
 03672   396   NtQueryInformationFile  (152, 1241352, 24, Standard, ... {status=0x0, info=24}, ) == 0x0
 03673   396   NtReleaseMutant  (156, ... 0x0, ) == 0x0
 03674   396   NtWaitForSingleObject  (80, 0, {0, 0}, ... ) == 0x102
 03675   396   NtCreateEvent  (0x1f0003, 0x0, 1, 0, ... 376, ) == 0x0
 03676   396   NtConnectPort  ( ("\RPC Control\DNSResolver", {12, 2, 1, 1}, 0x0, 0x0, 1237812, 112, ... 380, 0x0, 0x0, 0x0, 112, ) , {12, 2, 1, 1}, 0x0, 0x0, 1237812, 112, ... 380, 0x0, 0x0, 0x0, 112, ) == 0x0
 03677   396   NtRequestWaitReplyPort  (380, {128, 152, new_msg, 0, 1310720, 123144, 1310720, 1237576}  (380, {128, 152, new_msg, 0, 1310720, 123144, 1310720, 1237576} "\0$\370w\370\350\22\0\2$\370w\1kwEVY\205D\237\200\364(\367\326\1)\2\0\0\0\1\0\0\0\300\356\25\0\4\0\0\0\300\356\25\0\20\344\314w\300\356\25\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\1\0\21\0\20\311\25\00\331\25\0\0\0\0\0\0\0\0\0\0\0\0\0\204\361\22\0\0\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\0\0\0\0 U\367w\5\0\0\0" ... {128, 152, reply, 0, 316, 396, 1590, 0} "\7$\370w\370\350\22\0\2$\370w\1kwEVY\205D\237\200\364(\367\326\1)\2\0\0\0\1\0\0\0\0\0\0\0\4\0\0\0\300\356\25\0\377\377\377\377\300\356\25\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\1\0\21\0\20\311\25\00\331\25\0\0\0\0\0\0\0\0\0\0\0\0\0\204\361\22\0\0\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\0\0\0\0 U\367w\5\0\0\0" )  ... {128, 152, reply, 0, 316, 396, 1590, 0}  (380, {128, 152, new_msg, 0, 1310720, 123144, 1310720, 1237576} "\0$\370w\370\350\22\0\2$\370w\1kwEVY\205D\237\200\364(\367\326\1)\2\0\0\0\1\0\0\0\300\356\25\0\4\0\0\0\300\356\25\0\20\344\314w\300\356\25\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\1\0\21\0\20\311\25\00\331\25\0\0\0\0\0\0\0\0\0\0\0\0\0\204\361\22\0\0\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\0\0\0\0 U\367w\5\0\0\0" ... {128, 152, reply, 0, 316, 396, 1590, 0} "\7$\370w\370\350\22\0\2$\370w\1kwEVY\205D\237\200\364(\367\326\1)\2\0\0\0\1\0\0\0\0\0\0\0\4\0\0\0\300\356\25\0\377\377\377\377\300\356\25\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\1\0\21\0\20\311\25\00\331\25\0\0\0\0\0\0\0\0\0\0\0\0\0\204\361\22\0\0\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\0\0\0\0 U\367w\5\0\0\0" )  ) == 0x0
 03678   396   NtRequestWaitReplyPort  (380, {64, 88, new_msg, 0, 316, 396, 1587, 0}  (380, {64, 88, new_msg, 0, 316, 396, 1587, 0} "\1\240\0\0A\2\10\0\0\0\0\0G\3\0\0\0\0\0\0\0\0\0\0\377\377\377\377\0\0\0\0\0\0\0\0\21\0\0\0\0\0\0\0\0\0\0\0\377\377\377\0s\0r\0v\00\02\0.\0" ... {52, 76, reply, 0, 316, 396, 1591, 0} "\2\240\372\177\1\00\300\0\0\0\0G\3\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\200]\12\0\1\0\0\0\1\0\0\0\300\250|\201\377\377\377\0" )  ... {52, 76, reply, 0, 316, 396, 1591, 0}  (380, {64, 88, new_msg, 0, 316, 396, 1587, 0} "\1\240\0\0A\2\10\0\0\0\0\0G\3\0\0\0\0\0\0\0\0\0\0\377\377\377\377\0\0\0\0\0\0\0\0\21\0\0\0\0\0\0\0\0\0\0\0\377\377\377\0s\0r\0v\00\02\0.\0" ... {52, 76, reply, 0, 316, 396, 1591, 0} "\2\240\372\177\1\00\300\0\0\0\0G\3\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\200]\12\0\1\0\0\0\1\0\0\0\300\250|\201\377\377\377\0" )  ) == 0x0
 03679   396   NtClose  (376, ... ) == 0x0
 03680   396   NtClose  (380, ... ) == 0x0
 03681   396   NtCreateKey  (0x20019, {24, 48, 0x40, 0, 0,  (0x20019, {24, 48, 0x40, 0, 0, "System\CurrentControlSet\Services\Tcpip\Parameters"}, 0, "Class", 0, ... 380, 2, ) }, 0,  (0x20019, {24, 48, 0x40, 0, 0, "System\CurrentControlSet\Services\Tcpip\Parameters"}, 0, "Class", 0, ... 380, 2, ) , 0, ... 380, 2, ) == 0x0
 03682   396   NtOpenKey  (0x20019, {24, 48, 0x40, 0, 0,  (0x20019, {24, 48, 0x40, 0, 0, "System\CurrentControlSet\Services\DnsCache\Parameters"}, ... 376, ) }, ... 376, ) == 0x0
 03683   396   NtOpenKey  (0x20019, {24, 48, 0x40, 0, 0,  (0x20019, {24, 48, 0x40, 0, 0, "Software\Policies\Microsoft\Windows NT\DnsClient"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 03684   396   NtQueryValueKey  (380,  (380, "Hostname", Partial, 144, ... TitleIdx=0, Type=1, Data="M\0Y\0W\0O\0R\0L\0D\0\0\0"}, 28, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (380, "Hostname", Partial, 144, ... TitleIdx=0, Type=1, Data="M\0Y\0W\0O\0R\0L\0D\0\0\0"}, 28, ) }, 28, ) == 0x0
 03685   396   NtQueryValueKey  (380,  (380, "Hostname", Partial, 144, ... TitleIdx=0, Type=1, Data="M\0Y\0W\0O\0R\0L\0D\0\0\0"}, 28, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (380, "Hostname", Partial, 144, ... TitleIdx=0, Type=1, Data="M\0Y\0W\0O\0R\0L\0D\0\0\0"}, 28, ) }, 28, ) == 0x0
 03686   396   NtClose  (380, ... ) == 0x0
 03687   396   NtClose  (376, ... ) == 0x0
 03688   396   NtCreateKey  (0x20019, {24, 48, 0x40, 0, 0,  (0x20019, {24, 48, 0x40, 0, 0, "System\CurrentControlSet\Services\Tcpip\Parameters"}, 0, "Class", 0, ... 376, 2, ) }, 0,  (0x20019, {24, 48, 0x40, 0, 0, "System\CurrentControlSet\Services\Tcpip\Parameters"}, 0, "Class", 0, ... 376, 2, ) , 0, ... 376, 2, ) == 0x0
 03689   396   NtOpenKey  (0x20019, {24, 48, 0x40, 0, 0,  (0x20019, {24, 48, 0x40, 0, 0, "System\CurrentControlSet\Services\DnsCache\Parameters"}, ... 380, ) }, ... 380, ) == 0x0
 03690   396   NtOpenKey  (0x20019, {24, 48, 0x40, 0, 0,  (0x20019, {24, 48, 0x40, 0, 0, "Software\Policies\Microsoft\Windows NT\DnsClient"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 03691   396   NtQueryValueKey  (376,  (376, "Domain", Partial, 144, ... TitleIdx=0, Type=1, Data="\0\0"}, 14, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (376, "Domain", Partial, 144, ... TitleIdx=0, Type=1, Data="\0\0"}, 14, ) }, 14, ) == 0x0
 03692   396   NtQueryValueKey  (376,  (376, "Domain", Partial, 144, ... TitleIdx=0, Type=1, Data="\0\0"}, 14, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (376, "Domain", Partial, 144, ... TitleIdx=0, Type=1, Data="\0\0"}, 14, ) }, 14, ) == 0x0
 03693   396   NtClose  (376, ... ) == 0x0
 03694   396   NtClose  (380, ... ) == 0x0
 03695   396   NtOpenKey  (0x1, {24, 48, 0x40, 0, 0,  (0x1, {24, 48, 0x40, 0, 0, "System\CurrentControlSet\Services\VxD\MSTCP"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 03696   396   NtOpenKey  (0x1, {24, 48, 0x40, 0, 0,  (0x1, {24, 48, 0x40, 0, 0, "System\CurrentControlSet\Control\ComputerName\ComputerName"}, ... 380, ) }, ... 380, ) == 0x0
 03697   396   NtQueryValueKey  (380,  (380, "ComputerName", Partial, 144, ... TitleIdx=0, Type=1, Data="M\0Y\0W\0O\0R\0L\0D\0\0\0"}, 28, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (380, "ComputerName", Partial, 144, ... TitleIdx=0, Type=1, Data="M\0Y\0W\0O\0R\0L\0D\0\0\0"}, 28, ) }, 28, ) == 0x0
 03698   396   NtQueryValueKey  (380,  (380, "ComputerName", Partial, 144, ... TitleIdx=0, Type=1, Data="M\0Y\0W\0O\0R\0L\0D\0\0\0"}, 28, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (380, "ComputerName", Partial, 144, ... TitleIdx=0, Type=1, Data="M\0Y\0W\0O\0R\0L\0D\0\0\0"}, 28, ) }, 28, ) == 0x0
 03699   396   NtClose  (380, ... ) == 0x0
 03700   396   NtWaitForSingleObject  (72, 0, {0, 0}, ... ) == 0x102
 03701   396   NtWaitForSingleObject  (72, 0, {0, 0}, ... ) == 0x102
 03702   396   NtWaitForSingleObject  (72, 0, {0, 0}, ... ) == 0x102
 03703   396   NtWaitForSingleObject  (80, 0, {0, 0}, ... ) == 0x102
 03704   396   NtCreateEvent  (0x1f0003, 0x0, 1, 0, ... 380, ) == 0x0
 03705   396   NtConnectPort  ( ("\RPC Control\DNSResolver", {12, 2, 1, 1}, 0x0, 0x0, 1237148, 112, ... 376, 0x0, 0x0, 0x0, 112, ) , {12, 2, 1, 1}, 0x0, 0x0, 1237148, 112, ... 376, 0x0, 0x0, 0x0, 112, ) == 0x0
 03706   396   NtRequestWaitReplyPort  (376, {128, 152, new_msg, 0, 1310720, 122480, 1310720, 1236912}  (376, {128, 152, new_msg, 0, 1310720, 122480, 1310720, 1236912} "\0$\370w`\346\22\0\2$\370w\1kwEVY\205D\237\200\364(\367\326\1)\2\0\0\0\1\0\0\0\300\356\25\0\4\0\0\0\300\356\25\0\20\344\314w\300\356\25\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\1\0\22\0\20\311\25\00\331\25\0\0\0\0\0\0\0\0\0$1\347w\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\374\340\22\0\0\0\0\0\365\26\365w\5\0\0\0" ... {128, 152, reply, 0, 316, 396, 1594, 0} "\7$\370w`\346\22\0\2$\370w\1kwEVY\205D\237\200\364(\367\326\1)\2\0\0\0\1\0\0\0\0\0\0\0\4\0\0\0\300\356\25\0\377\377\377\377\300\356\25\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\1\0\22\0\20\311\25\00\331\25\0\0\0\0\0\0\0\0\0$1\347w\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\374\340\22\0\0\0\0\0\365\26\365w\5\0\0\0" )  ... {128, 152, reply, 0, 316, 396, 1594, 0}  (376, {128, 152, new_msg, 0, 1310720, 122480, 1310720, 1236912} "\0$\370w`\346\22\0\2$\370w\1kwEVY\205D\237\200\364(\367\326\1)\2\0\0\0\1\0\0\0\300\356\25\0\4\0\0\0\300\356\25\0\20\344\314w\300\356\25\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\1\0\22\0\20\311\25\00\331\25\0\0\0\0\0\0\0\0\0$1\347w\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\374\340\22\0\0\0\0\0\365\26\365w\5\0\0\0" ... {128, 152, reply, 0, 316, 396, 1594, 0} "\7$\370w`\346\22\0\2$\370w\1kwEVY\205D\237\200\364(\367\326\1)\2\0\0\0\1\0\0\0\0\0\0\0\4\0\0\0\300\356\25\0\377\377\377\377\300\356\25\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\1\0\22\0\20\311\25\00\331\25\0\0\0\0\0\0\0\0\0$1\347w\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\374\340\22\0\0\0\0\0\365\26\365w\5\0\0\0" )  ) == 0x0
 03707   396   NtRequestWaitReplyPort  (376, {112, 136, new_msg, 0, 316, 396, 1591, 0}  (376, {112, 136, new_msg, 0, 316, 396, 1591, 0} "\1\240\0\0A\2\11\0\0\0\0\0G\3\0\0\0\0\0\0\0\0\0\0\377\377\377\377\0\0\0\0\0\0\0\0,\10\25\0\26\0\0\0\0\0\0\0\26\0\0\0s\0r\0v\00\01\0.\0d\0e\0b\0e\0l\0i\0z\0o\0m\0b\0i\0.\0c\0o\0m\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0" ... {44, 68, reply, 0, 316, 396, 1595, 0} "\2\240\372\177\1\00\300\0\0\0\0G\3\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\264\5\0\0\1\0\0\0" )  ... {44, 68, reply, 0, 316, 396, 1595, 0}  (376, {112, 136, new_msg, 0, 316, 396, 1591, 0} "\1\240\0\0A\2\11\0\0\0\0\0G\3\0\0\0\0\0\0\0\0\0\0\377\377\377\377\0\0\0\0\0\0\0\0,\10\25\0\26\0\0\0\0\0\0\0\26\0\0\0s\0r\0v\00\01\0.\0d\0e\0b\0e\0l\0i\0z\0o\0m\0b\0i\0.\0c\0o\0m\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0" ... {44, 68, reply, 0, 316, 396, 1595, 0} "\2\240\372\177\1\00\300\0\0\0\0G\3\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\264\5\0\0\1\0\0\0" )  ) == 0x0
 03708   396   NtClose  (380, ... ) == 0x0
 03709   396   NtClose  (376, ... ) == 0x0
 03710   396   NtCreateFile  (0x3, {24, 0, 0x40, 0, 0,  (0x3, {24, 0, 0x40, 0, 0, "\Device\RasAcd"}, 0x0, 128, 3, 3, 0, 0, 0, ... 376, {status=0x0, info=0}, ) }, 0x0, 128, 3, 3, 0, 0, 0, ... 376, {status=0x0, info=0}, ) == 0x0
 03711   396   NtCreateEvent  (0x1f0003, 0x0, 1, 0, ... 380, ) == 0x0
 03712   396   NtDeviceIoControlFile  (376, 380, 0x0, 0x0, 0xf14014,  (376, 380, 0x0, 0x0, 0xf14014, "\3\0\0\0srv01.debelizombi.com\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0", 1552, 0, ... ) , 1552, 0, ... ) == STATUS_UNSUCCESSFUL
 03713   396   NtClose  (380, ... ) == 0x0
 03714   396   NtClose  (376, ... ) == 0x0
 03715   396   NtWaitForSingleObject  (200, 0, 0x0, ... ) == 0x0
 03716   396   NtWaitForSingleObject  (204, 0, 0x0, ... ) == 0x0
 03717   396   NtReleaseMutant  (204, ... 0x0, ) == 0x0
 03718   396   NtQueryValueKey  (108,  (108, "EnableAutodial", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (108, "EnableAutodial", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) }, 16, ) == 0x0
 03719   396   NtQueryValueKey  (108,  (108, "NoNetAutodial", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (108, "NoNetAutodial", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) }, 16, ) == 0x0
 03720   396   NtCreateKey  (0x2001d, {24, 48, 0x40, 0, 0,  (0x2001d, {24, 48, 0x40, 0, 0, "Software\Microsoft\RAS AutoDial"}, 0, 0x0, 0, ... 376, 2, ) }, 0, 0x0, 0, ... 376, 2, ) == 0x0
 03721   396   NtCreateKey  (0x20019, {24, 376, 0x40, 0, 0,  (0x20019, {24, 376, 0x40, 0, 0, "Default"}, 0, 0x0, 0, ... 380, 2, ) }, 0, 0x0, 0, ... 380, 2, ) == 0x0
 03722   396   NtClose  (376, ... ) == 0x0
 03723   396   NtQueryValueKey  (380,  (380, "DefaultInternet", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 03724   396   NtClose  (380, ... ) == 0x0
 03725   396   NtOpenThreadToken  (-2, 0xc, 1, ... ) == STATUS_NO_TOKEN
 03726   396   NtOpenProcessToken  (-1, 0xc, ... 380, ) == 0x0
 03727   396   NtReleaseSemaphore  (168, 1, ... 0, ) == 0x0
 03728   396   NtWaitForSingleObject  (168, 0, {0, 0}, ... ) == 0x0
 03729   396   NtClose  (380, ... ) == 0x0
 03730   396   NtOpenFile  (0x100001, {24, 0, 0x40, 0, 0,  (0x100001, {24, 0, 0x40, 0, 0, "\??\C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Connections\Pbk\"}, 3, 16417, ... 380, {status=0x0, info=1}, ) }, 3, 16417, ... 380, {status=0x0, info=1}, ) == 0x0
 03731   396   NtQueryDirectoryFile  (380, 0, 0, 0, 1236932, 616, BothDirectory, 1,  (380, 0, 0, 0, 1236932, 616, BothDirectory, 1, "<.pbk", 0, ... ) , 0, ... ) == STATUS_NO_SUCH_FILE
 03732   396   NtClose  (380, ... ) == 0x0
 03733   396   NtOpenFile  (0x100001, {24, 0, 0x40, 0, 0,  (0x100001, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\System32\Ras\"}, 3, 16417, ... 380, {status=0x0, info=1}, ) }, 3, 16417, ... 380, {status=0x0, info=1}, ) == 0x0
 03734   396   NtQueryDirectoryFile  (380, 0, 0, 0, 1236932, 616, BothDirectory, 1,  (380, 0, 0, 0, 1236932, 616, BothDirectory, 1, "<.pbk", 0, ... ) , 0, ... ) == STATUS_NO_SUCH_FILE
 03735   396   NtClose  (380, ... ) == 0x0
 03736   396   NtOpenThreadToken  (-2, 0xc, 1, ... ) == STATUS_NO_TOKEN
 03737   396   NtOpenProcessToken  (-1, 0xc, ... 380, ) == 0x0
 03738   396   NtQueryInformationToken  (380, User, 64, ... {token info, class 1, size 36}, 36, ) == 0x0
 03739   396   NtOpenKey  (0x2001f, {24, 328, 0x40, 0, 0,  (0x2001f, {24, 328, 0x40, 0, 0, "S-1-5-21-1078081533-484763869-839522115-1003"}, ... 376, ) }, ... 376, ) == 0x0
 03740   396   NtCreateKey  (0x2000000, {24, 376, 0x40, 0, 0,  (0x2000000, {24, 376, 0x40, 0, 0, "Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders"}, 0, 0x0, 0, ... 384, 2, ) }, 0, 0x0, 0, ... 384, 2, ) == 0x0
 03741   396   NtClose  (376, ... ) == 0x0
 03742   396   NtQueryValueKey  (384,  (384, "AppData", Partial, 144, ... TitleIdx=0, Type=2, Data="%\0U\0S\0E\0R\0P\0R\0O\0F\0I\0L\0E\0%\0\\0A\0p\0p\0l\0i\0c\0a\0t\0i\0o\0n\0 \0D\0a\0t\0a\0\0\0"}, 74, ) , Partial, 144, ... TitleIdx=0, Type=2, Data= (384, "AppData", Partial, 144, ... TitleIdx=0, Type=2, Data="%\0U\0S\0E\0R\0P\0R\0O\0F\0I\0L\0E\0%\0\\0A\0p\0p\0l\0i\0c\0a\0t\0i\0o\0n\0 \0D\0a\0t\0a\0\0\0"}, 74, ) }, 74, ) == 0x0
 03743   396   NtAllocateVirtualMemory  (-1, 0, 0, 1, 4096, 4, ... 11534336, 4096, ) == 0x0
 03744   396   NtQueryVirtualMemory  (-1, 0xb00000, Basic, 28, ... {BaseAddress=0xb00000,AllocationBase=0xb00000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 0x0, ) == 0x0
 03745   396   NtQueryVirtualMemory  (-1, 0xb00000, Basic, 28, ... {BaseAddress=0xb00000,AllocationBase=0xb00000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 0x0, ) == 0x0
 03746   396   NtOpenKey  (0x20019, {24, 48, 0x40, 0, 0,  (0x20019, {24, 48, 0x40, 0, 0, "Software\Microsoft\Windows NT\CurrentVersion\ProfileList"}, ... 376, ) }, ... 376, ) == 0x0
 03747   396   NtQueryValueKey  (376,  (376, "ProfilesDirectory", Partial, 144, ... TitleIdx=0, Type=2, Data="%\0S\0y\0s\0t\0e\0m\0D\0r\0i\0v\0e\0%\0\\0D\0o\0c\0u\0m\0e\0n\0t\0s\0 \0a\0n\0d\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\0\0"}, 86, ) , Partial, 144, ... TitleIdx=0, Type=2, Data= (376, "ProfilesDirectory", Partial, 144, ... TitleIdx=0, Type=2, Data="%\0S\0y\0s\0t\0e\0m\0D\0r\0i\0v\0e\0%\0\\0D\0o\0c\0u\0m\0e\0n\0t\0s\0 \0a\0n\0d\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\0\0"}, 86, ) }, 86, ) == 0x0
 03748   396   NtClose  (376, ... ) == 0x0
 03749   396   NtOpenKey  (0x20019, {24, 48, 0x40, 0, 0,  (0x20019, {24, 48, 0x40, 0, 0, "Software\Microsoft\Windows NT\CurrentVersion\ProfileList"}, ... 376, ) }, ... 376, ) == 0x0
 03750   396   NtQueryValueKey  (376,  (376, "AllUsersProfile", Partial, 144, ... TitleIdx=0, Type=1, Data="A\0l\0l\0 \0U\0s\0e\0r\0s\0\0\0"}, 32, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (376, "AllUsersProfile", Partial, 144, ... TitleIdx=0, Type=1, Data="A\0l\0l\0 \0U\0s\0e\0r\0s\0\0\0"}, 32, ) }, 32, ) == 0x0
 03751   396   NtClose  (376, ... ) == 0x0
 03752   396   NtQueryVirtualMemory  (-1, 0xb00000, Basic, 28, ... {BaseAddress=0xb00000,AllocationBase=0xb00000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 0x0, ) == 0x0
 03753   396   NtOpenKey  (0x1, {24, 48, 0x40, 0, 0,  (0x1, {24, 48, 0x40, 0, 0, "System\CurrentControlSet\Control\Session Manager\Environment"}, ... 376, ) }, ... 376, ) == 0x0
 03754   396   NtQueryKey  (376, Full, 176, ... {LastWrite={0x7838d13c,0x1c73999}, TitleIdx=0, Subkeys=0, Values=12, Class=""}, 44, ) == 0x0
 03755   396   NtQuerySecurityObject  (376, 7, 0, ... ) == STATUS_ACCESS_DENIED
 03756   396   NtEnumerateValueKey  (376, 0, Full, 220, ... TitleIdx=0, Type=2, Name= (376, 0, Full, 220, ... TitleIdx=0, Type=2, Name="ComSpec", Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0s\0y\0s\0t\0e\0m\03\02\0\\0c\0m\0d\0.\0e\0x\0e\0\0\0"}, 96, ) , Data= (376, 0, Full, 220, ... TitleIdx=0, Type=2, Name="ComSpec", Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0s\0y\0s\0t\0e\0m\03\02\0\\0c\0m\0d\0.\0e\0x\0e\0\0\0"}, 96, ) }, 96, ) == 0x0
 03757   396   NtEnumerateValueKey  (376, 1, Full, 220, ... TitleIdx=0, Type=2, Name= (376, 1, Full, 220, ... TitleIdx=0, Type=2, Name="Path", Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0s\0y\0s\0t\0e\0m\03\02\0;\0%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0;\0%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0W\0b\0e\0m\0\0\0"}, 152, ) , Data= (376, 1, Full, 220, ... TitleIdx=0, Type=2, Name="Path", Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0s\0y\0s\0t\0e\0m\03\02\0;\0%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0;\0%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0W\0b\0e\0m\0\0\0"}, 152, ) }, 152, ) == 0x0
 03758   396   NtEnumerateValueKey  (376, 2, Full, 220, ... TitleIdx=0, Type=2, Name= (376, 2, Full, 220, ... TitleIdx=0, Type=2, Name="windir", Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\0\0"}, 58, ) , Data= (376, 2, Full, 220, ... TitleIdx=0, Type=2, Name="windir", Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\0\0"}, 58, ) }, 58, ) == 0x0
 03759   396   NtEnumerateValueKey  (376, 3, Full, 220, ... TitleIdx=0, Type=1, Name= (376, 3, Full, 220, ... TitleIdx=0, Type=1, Name="OS", Data="W\0i\0n\0d\0o\0w\0s\0_\0N\0T\0\0\0"}, 46, ) , Data= (376, 3, Full, 220, ... TitleIdx=0, Type=1, Name="OS", Data="W\0i\0n\0d\0o\0w\0s\0_\0N\0T\0\0\0"}, 46, ) }, 46, ) == 0x0
 03760   396   NtQueryVirtualMemory  (-1, 0xb00000, Basic, 28, ... {BaseAddress=0xb00000,AllocationBase=0xb00000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 0x0, ) == 0x0
 03761   396   NtEnumerateValueKey  (376, 4, Full, 220, ... TitleIdx=0, Type=1, Name= (376, 4, Full, 220, ... TitleIdx=0, Type=1, Name="PROCESSOR_ARCHITECTURE", Data="x\08\06\0\0\0"}, 72, ) , Data= (376, 4, Full, 220, ... TitleIdx=0, Type=1, Name="PROCESSOR_ARCHITECTURE", Data="x\08\06\0\0\0"}, 72, ) }, 72, ) == 0x0
 03762   396   NtQueryVirtualMemory  (-1, 0xb00000, Basic, 28, ... {BaseAddress=0xb00000,AllocationBase=0xb00000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 0x0, ) == 0x0
 03763   396   NtEnumerateValueKey  (376, 5, Full, 220, ... TitleIdx=0, Type=1, Name= (376, 5, Full, 220, ... TitleIdx=0, Type=1, Name="PROCESSOR_LEVEL", Data="1\05\0\0\0"}, 58, ) , Data= (376, 5, Full, 220, ... TitleIdx=0, Type=1, Name="PROCESSOR_LEVEL", Data="1\05\0\0\0"}, 58, ) }, 58, ) == 0x0
 03764   396   NtQueryVirtualMemory  (-1, 0xb00000, Basic, 28, ... {BaseAddress=0xb00000,AllocationBase=0xb00000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 0x0, ) == 0x0
 03765   396   NtEnumerateValueKey  (376, 6, Full, 220, ... TitleIdx=0, Type=1, Name= (376, 6, Full, 220, ... TitleIdx=0, Type=1, Name="PROCESSOR_IDENTIFIER", Data="x\08\06\0 \0F\0a\0m\0i\0l\0y\0 \01\05\0 \0M\0o\0d\0e\0l\0 \04\0 \0S\0t\0e\0p\0p\0i\0n\0g\0 \08\0,\0 \0G\0e\0n\0u\0i\0n\0e\0I\0n\0t\0e\0l\0\0\0"}, 154, ) , Data= (376, 6, Full, 220, ... TitleIdx=0, Type=1, Name="PROCESSOR_IDENTIFIER", Data="x\08\06\0 \0F\0a\0m\0i\0l\0y\0 \01\05\0 \0M\0o\0d\0e\0l\0 \04\0 \0S\0t\0e\0p\0p\0i\0n\0g\0 \08\0,\0 \0G\0e\0n\0u\0i\0n\0e\0I\0n\0t\0e\0l\0\0\0"}, 154, ) }, 154, ) == 0x0
 03766   396   NtQueryVirtualMemory  (-1, 0xb00000, Basic, 28, ... {BaseAddress=0xb00000,AllocationBase=0xb00000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 0x0, ) == 0x0
 03767   396   NtEnumerateValueKey  (376, 7, Full, 220, ... TitleIdx=0, Type=1, Name= (376, 7, Full, 220, ... TitleIdx=0, Type=1, Name="PROCESSOR_REVISION", Data="0\04\00\08\0\0\0"}, 66, ) , Data= (376, 7, Full, 220, ... TitleIdx=0, Type=1, Name="PROCESSOR_REVISION", Data="0\04\00\08\0\0\0"}, 66, ) }, 66, ) == 0x0
 03768   396   NtQueryVirtualMemory  (-1, 0xb00000, Basic, 28, ... {BaseAddress=0xb00000,AllocationBase=0xb00000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 0x0, ) == 0x0
 03769   396   NtEnumerateValueKey  (376, 8, Full, 220, ... TitleIdx=0, Type=1, Name= (376, 8, Full, 220, ... TitleIdx=0, Type=1, Name="NUMBER_OF_PROCESSORS", Data="1\0\0\0"}, 64, ) , Data= (376, 8, Full, 220, ... TitleIdx=0, Type=1, Name="NUMBER_OF_PROCESSORS", Data="1\0\0\0"}, 64, ) }, 64, ) == 0x0
 03770   396   NtQueryVirtualMemory  (-1, 0xb00000, Basic, 28, ... {BaseAddress=0xb00000,AllocationBase=0xb00000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 0x0, ) == 0x0
 03771   396   NtEnumerateValueKey  (376, 9, Full, 220, ... TitleIdx=0, Type=1, Name= (376, 9, Full, 220, ... TitleIdx=0, Type=1, Name="PATHEXT", Data=".\0C\0O\0M\0;\0.\0E\0X\0E\0;\0.\0B\0A\0T\0;\0.\0C\0M\0D\0;\0.\0V\0B\0S\0;\0.\0V\0B\0E\0;\0.\0J\0S\0;\0.\0J\0S\0E\0;\0.\0W\0S\0F\0;\0.\0W\0S\0H\0\0\0"}, 134, ) , Data= (376, 9, Full, 220, ... TitleIdx=0, Type=1, Name="PATHEXT", Data=".\0C\0O\0M\0;\0.\0E\0X\0E\0;\0.\0B\0A\0T\0;\0.\0C\0M\0D\0;\0.\0V\0B\0S\0;\0.\0V\0B\0E\0;\0.\0J\0S\0;\0.\0J\0S\0E\0;\0.\0W\0S\0F\0;\0.\0W\0S\0H\0\0\0"}, 134, ) }, 134, ) == 0x0
 03772   396   NtQueryVirtualMemory  (-1, 0xb00000, Basic, 28, ... {BaseAddress=0xb00000,AllocationBase=0xb00000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 0x0, ) == 0x0
 03773   396   NtEnumerateValueKey  (376, 10, Full, 220, ... TitleIdx=0, Type=2, Name= (376, 10, Full, 220, ... TitleIdx=0, Type=2, Name="TEMP", Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0T\0E\0M\0P\0\0\0"}, 64, ) , Data= (376, 10, Full, 220, ... TitleIdx=0, Type=2, Name="TEMP", Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0T\0E\0M\0P\0\0\0"}, 64, ) }, 64, ) == 0x0
 03774   396   NtEnumerateValueKey  (376, 11, Full, 220, ... TitleIdx=0, Type=2, Name= (376, 11, Full, 220, ... TitleIdx=0, Type=2, Name="TMP", Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0T\0E\0M\0P\0\0\0"}, 64, ) , Data= (376, 11, Full, 220, ... TitleIdx=0, Type=2, Name="TMP", Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0T\0E\0M\0P\0\0\0"}, 64, ) }, 64, ) == 0x0
 03775   396   NtEnumerateValueKey  (376, 0, Full, 220, ... TitleIdx=0, Type=2, Name= (376, 0, Full, 220, ... TitleIdx=0, Type=2, Name="ComSpec", Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0s\0y\0s\0t\0e\0m\03\02\0\\0c\0m\0d\0.\0e\0x\0e\0\0\0"}, 96, ) , Data= (376, 0, Full, 220, ... TitleIdx=0, Type=2, Name="ComSpec", Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0s\0y\0s\0t\0e\0m\03\02\0\\0c\0m\0d\0.\0e\0x\0e\0\0\0"}, 96, ) }, 96, ) == 0x0
 03776   396   NtQueryVirtualMemory  (-1, 0xb00000, Basic, 28, ... {BaseAddress=0xb00000,AllocationBase=0xb00000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 0x0, ) == 0x0
 03777   396   NtEnumerateValueKey  (376, 1, Full, 220, ... TitleIdx=0, Type=2, Name= (376, 1, Full, 220, ... TitleIdx=0, Type=2, Name="Path", Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0s\0y\0s\0t\0e\0m\03\02\0;\0%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0;\0%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0W\0b\0e\0m\0\0\0"}, 152, ) , Data= (376, 1, Full, 220, ... TitleIdx=0, Type=2, Name="Path", Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0s\0y\0s\0t\0e\0m\03\02\0;\0%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0;\0%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0W\0b\0e\0m\0\0\0"}, 152, ) }, 152, ) == 0x0
 03778   396   NtQueryVirtualMemory  (-1, 0xb00000, Basic, 28, ... {BaseAddress=0xb00000,AllocationBase=0xb00000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 0x0, ) == 0x0
 03779   396   NtEnumerateValueKey  (376, 2, Full, 220, ... TitleIdx=0, Type=2, Name= (376, 2, Full, 220, ... TitleIdx=0, Type=2, Name="windir", Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\0\0"}, 58, ) , Data= (376, 2, Full, 220, ... TitleIdx=0, Type=2, Name="windir", Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\0\0"}, 58, ) }, 58, ) == 0x0
 03780   396   NtQueryVirtualMemory  (-1, 0xb00000, Basic, 28, ... {BaseAddress=0xb00000,AllocationBase=0xb00000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 0x0, ) == 0x0
 03781   396   NtEnumerateValueKey  (376, 3, Full, 220, ... TitleIdx=0, Type=1, Name= (376, 3, Full, 220, ... TitleIdx=0, Type=1, Name="OS", Data="W\0i\0n\0d\0o\0w\0s\0_\0N\0T\0\0\0"}, 46, ) , Data= (376, 3, Full, 220, ... TitleIdx=0, Type=1, Name="OS", Data="W\0i\0n\0d\0o\0w\0s\0_\0N\0T\0\0\0"}, 46, ) }, 46, ) == 0x0
 03782   396   NtEnumerateValueKey  (376, 4, Full, 220, ... TitleIdx=0, Type=1, Name= (376, 4, Full, 220, ... TitleIdx=0, Type=1, Name="PROCESSOR_ARCHITECTURE", Data="x\08\06\0\0\0"}, 72, ) , Data= (376, 4, Full, 220, ... TitleIdx=0, Type=1, Name="PROCESSOR_ARCHITECTURE", Data="x\08\06\0\0\0"}, 72, ) }, 72, ) == 0x0
 03783   396   NtEnumerateValueKey  (376, 5, Full, 220, ... TitleIdx=0, Type=1, Name= (376, 5, Full, 220, ... TitleIdx=0, Type=1, Name="PROCESSOR_LEVEL", Data="1\05\0\0\0"}, 58, ) , Data= (376, 5, Full, 220, ... TitleIdx=0, Type=1, Name="PROCESSOR_LEVEL", Data="1\05\0\0\0"}, 58, ) }, 58, ) == 0x0
 03784   396   NtEnumerateValueKey  (376, 6, Full, 220, ... TitleIdx=0, Type=1, Name= (376, 6, Full, 220, ... TitleIdx=0, Type=1, Name="PROCESSOR_IDENTIFIER", Data="x\08\06\0 \0F\0a\0m\0i\0l\0y\0 \01\05\0 \0M\0o\0d\0e\0l\0 \04\0 \0S\0t\0e\0p\0p\0i\0n\0g\0 \08\0,\0 \0G\0e\0n\0u\0i\0n\0e\0I\0n\0t\0e\0l\0\0\0"}, 154, ) , Data= (376, 6, Full, 220, ... TitleIdx=0, Type=1, Name="PROCESSOR_IDENTIFIER", Data="x\08\06\0 \0F\0a\0m\0i\0l\0y\0 \01\05\0 \0M\0o\0d\0e\0l\0 \04\0 \0S\0t\0e\0p\0p\0i\0n\0g\0 \08\0,\0 \0G\0e\0n\0u\0i\0n\0e\0I\0n\0t\0e\0l\0\0\0"}, 154, ) }, 154, ) == 0x0
 03785   396   NtEnumerateValueKey  (376, 7, Full, 220, ... TitleIdx=0, Type=1, Name= (376, 7, Full, 220, ... TitleIdx=0, Type=1, Name="PROCESSOR_REVISION", Data="0\04\00\08\0\0\0"}, 66, ) , Data= (376, 7, Full, 220, ... TitleIdx=0, Type=1, Name="PROCESSOR_REVISION", Data="0\04\00\08\0\0\0"}, 66, ) }, 66, ) == 0x0
 03786   396   NtEnumerateValueKey  (376, 8, Full, 220, ... TitleIdx=0, Type=1, Name= (376, 8, Full, 220, ... TitleIdx=0, Type=1, Name="NUMBER_OF_PROCESSORS", Data="1\0\0\0"}, 64, ) , Data= (376, 8, Full, 220, ... TitleIdx=0, Type=1, Name="NUMBER_OF_PROCESSORS", Data="1\0\0\0"}, 64, ) }, 64, ) == 0x0
 03787   396   NtEnumerateValueKey  (376, 9, Full, 220, ... TitleIdx=0, Type=1, Name= (376, 9, Full, 220, ... TitleIdx=0, Type=1, Name="PATHEXT", Data=".\0C\0O\0M\0;\0.\0E\0X\0E\0;\0.\0B\0A\0T\0;\0.\0C\0M\0D\0;\0.\0V\0B\0S\0;\0.\0V\0B\0E\0;\0.\0J\0S\0;\0.\0J\0S\0E\0;\0.\0W\0S\0F\0;\0.\0W\0S\0H\0\0\0"}, 134, ) , Data= (376, 9, Full, 220, ... TitleIdx=0, Type=1, Name="PATHEXT", Data=".\0C\0O\0M\0;\0.\0E\0X\0E\0;\0.\0B\0A\0T\0;\0.\0C\0M\0D\0;\0.\0V\0B\0S\0;\0.\0V\0B\0E\0;\0.\0J\0S\0;\0.\0J\0S\0E\0;\0.\0W\0S\0F\0;\0.\0W\0S\0H\0\0\0"}, 134, ) }, 134, ) == 0x0
 03788   396   NtEnumerateValueKey  (376, 10, Full, 220, ... TitleIdx=0, Type=2, Name= (376, 10, Full, 220, ... TitleIdx=0, Type=2, Name="TEMP", Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0T\0E\0M\0P\0\0\0"}, 64, ) , Data= (376, 10, Full, 220, ... TitleIdx=0, Type=2, Name="TEMP", Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0T\0E\0M\0P\0\0\0"}, 64, ) }, 64, ) == 0x0
 03789   396   NtQueryInformationProcess  (-1, DefaultHardErrorMode, 4, ... {process info, class 12, size 4}, 0x0, ) == 0x0
 03790   396   NtSetInformationProcess  (-1, DefaultHardErrorMode, {process info, class 12, size 4}, 4, ... ) == 0x0
 03791   396   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\TEMP"}, 1236004, ... ) }, 1236004, ... ) == 0x0
 03792   396   NtQueryInformationProcess  (-1, DefaultHardErrorMode, 4, ... {process info, class 12, size 4}, 0x0, ) == 0x0
 03793   396   NtSetInformationProcess  (-1, DefaultHardErrorMode, {process info, class 12, size 4}, 4, ... ) == 0x0
 03794   396   NtQueryVirtualMemory  (-1, 0xb00000, Basic, 28, ... {BaseAddress=0xb00000,AllocationBase=0xb00000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 0x0, ) == 0x0
 03795   396   NtEnumerateValueKey  (376, 11, Full, 220, ... TitleIdx=0, Type=2, Name= (376, 11, Full, 220, ... TitleIdx=0, Type=2, Name="TMP", Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0T\0E\0M\0P\0\0\0"}, 64, ) , Data= (376, 11, Full, 220, ... TitleIdx=0, Type=2, Name="TMP", Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0T\0E\0M\0P\0\0\0"}, 64, ) }, 64, ) == 0x0
 03796   396   NtQueryInformationProcess  (-1, DefaultHardErrorMode, 4, ... {process info, class 12, size 4}, 0x0, ) == 0x0
 03797   396   NtSetInformationProcess  (-1, DefaultHardErrorMode, {process info, class 12, size 4}, 4, ... ) == 0x0
 03798   396   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\TEMP"}, 1236004, ... ) }, 1236004, ... ) == 0x0
 03799   396   NtQueryInformationProcess  (-1, DefaultHardErrorMode, 4, ... {process info, class 12, size 4}, 0x0, ) == 0x0
 03800   396   NtSetInformationProcess  (-1, DefaultHardErrorMode, {process info, class 12, size 4}, 4, ... ) == 0x0
 03801   396   NtQueryVirtualMemory  (-1, 0xb00000, Basic, 28, ... {BaseAddress=0xb00000,AllocationBase=0xb00000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 0x0, ) == 0x0
 03802   396   NtClose  (376, ... ) == 0x0
 03803   396   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\System\CurrentControlSet\Control\ComputerName"}, ... 376, ) }, ... 376, ) == 0x0
 03804   396   NtOpenKey  (0x20019, {24, 376, 0x40, 0, 0,  (0x20019, {24, 376, 0x40, 0, 0, "ActiveComputerName"}, ... 388, ) }, ... 388, ) == 0x0
 03805   396   NtQueryValueKey  (388,  (388, "ComputerName", Full, 108, ... TitleIdx=0, Type=1, Name="ComputerName", Data="M\0Y\0W\0O\0R\0L\0D\0\0\0"}, 60, ) , Full, 108, ... TitleIdx=0, Type=1, Name= (388, "ComputerName", Full, 108, ... TitleIdx=0, Type=1, Name="ComputerName", Data="M\0Y\0W\0O\0R\0L\0D\0\0\0"}, 60, ) , Data= (388, "ComputerName", Full, 108, ... TitleIdx=0, Type=1, Name="ComputerName", Data="M\0Y\0W\0O\0R\0L\0D\0\0\0"}, 60, ) }, 60, ) == 0x0
 03806   396   NtClose  (388, ... ) == 0x0
 03807   396   NtClose  (376, ... ) == 0x0
 03808   396   NtQueryVirtualMemory  (-1, 0xb00000, Basic, 28, ... {BaseAddress=0xb00000,AllocationBase=0xb00000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 0x0, ) == 0x0
 03809   396   NtOpenKey  (0x20019, {24, 48, 0x40, 0, 0,  (0x20019, {24, 48, 0x40, 0, 0, "Software\Microsoft\Windows NT\CurrentVersion\ProfileList"}, ... 376, ) }, ... 376, ) == 0x0
 03810   396   NtQueryValueKey  (376,  (376, "ProfilesDirectory", Partial, 144, ... TitleIdx=0, Type=2, Data="%\0S\0y\0s\0t\0e\0m\0D\0r\0i\0v\0e\0%\0\\0D\0o\0c\0u\0m\0e\0n\0t\0s\0 \0a\0n\0d\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\0\0"}, 86, ) , Partial, 144, ... TitleIdx=0, Type=2, Data= (376, "ProfilesDirectory", Partial, 144, ... TitleIdx=0, Type=2, Data="%\0S\0y\0s\0t\0e\0m\0D\0r\0i\0v\0e\0%\0\\0D\0o\0c\0u\0m\0e\0n\0t\0s\0 \0a\0n\0d\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\0\0"}, 86, ) }, 86, ) == 0x0
 03811   396   NtClose  (376, ... ) == 0x0
 03812   396   NtOpenKey  (0x20019, {24, 48, 0x40, 0, 0,  (0x20019, {24, 48, 0x40, 0, 0, "Software\Microsoft\Windows NT\CurrentVersion\ProfileList"}, ... 376, ) }, ... 376, ) == 0x0
 03813   396   NtQueryValueKey  (376,  (376, "DefaultUserProfile", Partial, 144, ... TitleIdx=0, Type=1, Data="D\0e\0f\0a\0u\0l\0t\0 \0U\0s\0e\0r\0\0\0"}, 38, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (376, "DefaultUserProfile", Partial, 144, ... TitleIdx=0, Type=1, Data="D\0e\0f\0a\0u\0l\0t\0 \0U\0s\0e\0r\0\0\0"}, 38, ) }, 38, ) == 0x0
 03814   396   NtClose  (376, ... ) == 0x0
 03815   396   NtQueryVirtualMemory  (-1, 0xb00000, Basic, 28, ... {BaseAddress=0xb00000,AllocationBase=0xb00000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 0x0, ) == 0x0
 03816   396   NtOpenKey  (0x20019, {24, 48, 0x40, 0, 0,  (0x20019, {24, 48, 0x40, 0, 0, "Software\Microsoft\Windows\CurrentVersion"}, ... 376, ) }, ... 376, ) == 0x0
 03817   396   NtQueryValueKey  (376,  (376, "ProgramFilesDir", Partial, 144, ... TitleIdx=0, Type=1, Data="C\0:\0\\0P\0r\0o\0g\0r\0a\0m\0 \0F\0i\0l\0e\0s\0\0\0"}, 46, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (376, "ProgramFilesDir", Partial, 144, ... TitleIdx=0, Type=1, Data="C\0:\0\\0P\0r\0o\0g\0r\0a\0m\0 \0F\0i\0l\0e\0s\0\0\0"}, 46, ) }, 46, ) == 0x0
 03818   396   NtQueryVirtualMemory  (-1, 0xb00000, Basic, 28, ... {BaseAddress=0xb00000,AllocationBase=0xb00000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 0x0, ) == 0x0
 03819   396   NtQueryValueKey  (376,  (376, "CommonFilesDir", Partial, 144, ... TitleIdx=0, Type=1, Data="C\0:\0\\0P\0r\0o\0g\0r\0a\0m\0 \0F\0i\0l\0e\0s\0\\0C\0o\0m\0m\0o\0n\0 \0F\0i\0l\0e\0s\0\0\0"}, 72, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (376, "CommonFilesDir", Partial, 144, ... TitleIdx=0, Type=1, Data="C\0:\0\\0P\0r\0o\0g\0r\0a\0m\0 \0F\0i\0l\0e\0s\0\\0C\0o\0m\0m\0o\0n\0 \0F\0i\0l\0e\0s\0\0\0"}, 72, ) }, 72, ) == 0x0
 03820   396   NtQueryVirtualMemory  (-1, 0xb00000, Basic, 28, ... {BaseAddress=0xb00000,AllocationBase=0xb00000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 0x0, ) == 0x0
 03821   396   NtClose  (376, ... ) == 0x0
 03822   396   NtQueryInformationToken  (380, User, 200, ... {token info, class 1, size 36}, 36, ) == 0x0
 03823   396   NtOpenKey  (0x20019, {24, 328, 0x40, 0, 0,  (0x20019, {24, 328, 0x40, 0, 0, "S-1-5-21-1078081533-484763869-839522115-1003"}, ... 376, ) }, ... 376, ) == 0x0
 03824   396   NtOpenThreadToken  (-2, 0x2000c, 1, ... ) == STATUS_NO_TOKEN
 03825   396   NtQueryInformationToken  (380, Type, 4, ... {token info, class 8, size 4}, 4, ) == 0x0
 03826   396   NtDuplicateToken  (380, 0xc, {24, 0, 0x0, 0, 1237388, 0x0}, 0, 2, ... ) == STATUS_ACCESS_DENIED
 03827   396   NtQueryInformationToken  (380, User, 200, ... {token info, class 1, size 36}, 36, ) == 0x0
 03828   396   NtOpenThreadToken  (-2, 0xc, 1, ... ) == STATUS_NO_TOKEN
 03829   396   NtCreateEvent  (0x1f0003, 0x0, 1, 0, ... 388, ) == 0x0
 03830   396   NtOpenThreadToken  (-2, 0xc, 1, ... ) == STATUS_NO_TOKEN
 03831   396   NtSetInformationThread  (-2, ImpersonationToken, {ImpToken=0,}, 4, ... ) == 0x0
 03832   396   NtCreateFile  (0xc0100080, {24, 0, 0x40, 0, 1235592,  (0xc0100080, {24, 0, 0x40, 0, 1235592, "\??\PIPE\lsarpc"}, 0x0, 0, 3, 1, 64, 0, 0, ... 392, {status=0x0, info=1}, ) }, 0x0, 0, 3, 1, 64, 0, 0, ... 392, {status=0x0, info=1}, ) == 0x0
 03833   396   NtSetInformationFile  (392, 1235648, 8, Pipe, ... {status=0x0, info=0}, ) == 0x0
 03834   396   NtSetInformationFile  (392, 1235640, 8, Completion, ... {status=0x0, info=0}, ) == 0x0
 03835   396   NtSetInformationThread  (-2, ImpersonationToken, {ImpToken=0,}, 4, ... ) == 0x0
 03836   396   NtWriteFile  (392, 297, 0, 0,  (392, 297, 0, 0, "\5\0\13\3\20\0\0\0H\0\0\0\1\0\0\0\270\20\270\20\0\0\0\0\1\0\0\0\0\0\1\0xW4\224\22\315\253\357\0\1#Eg\211\253\0\0\0\0\4]\210\212\353\34\311\21\237\350\10\0+\20H`\2\0\0\0", 72, {0, 0}, 0, ... {status=0x0, info=72}, ) , 72, {0, 0}, 0, ... {status=0x0, info=72}, ) == 0x0
 03837   396   NtReadFile  (392, 297, 0, 0, 1024, {0, 0}, 0, ... {status=0x0, info=68},  (392, 297, 0, 0, 1024, {0, 0}, 0, ... {status=0x0, info=68}, "\5\0\14\3\20\0\0\0D\0\0\0\1\0\0\0\270\20\270\20\232%\0\0\14\0\PIPE\lsass\0\0\0\1\0\0\0\0\0\0\0\4]\210\212\353\34\311\21\237\350\10\0+\20H`\2\0\0\0", ) , ) == 0x0
 03838   396   NtFsControlFile  (392, 297, 0x0, 0x0, 0x11c017,  (392, 297, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0@\0\0\0\1\0\0\0(\0\0\0\0\0,\0\0\0\0\0\30\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0<\341\22\0\14\0\0\0\2\0\1\0\0\10\0\0", 64, 1024, ... {status=0x103, info=68}, "\5\0\14\3\20\0\0\0D\0\0\0\1\0\0\0\270\20\270\20\232%\0\0\14\0\PIPE\lsass\0\0\0\1\0\0\0\0\0\0\0\4]\210\212\353\34\311\21\237\350\10\0+\20H`\2\0\0\0", ) , 64, 1024, ... {status=0x103, info=68},  (392, 297, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0@\0\0\0\1\0\0\0(\0\0\0\0\0,\0\0\0\0\0\30\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0<\341\22\0\14\0\0\0\2\0\1\0\0\10\0\0", 64, 1024, ... {status=0x103, info=68}, "\5\0\14\3\20\0\0\0D\0\0\0\1\0\0\0\270\20\270\20\232%\0\0\14\0\PIPE\lsass\0\0\0\1\0\0\0\0\0\0\0\4]\210\212\353\34\311\21\237\350\10\0+\20H`\2\0\0\0", ) , ) == 0x103
 03839   396   NtFsControlFile  (392, 297, 0x0, 0x0, 0x11c017,  (392, 297, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0t\0\0\0\2\0\0\0\\0\0\0\0\09\0\0\0\0\0wF\235\311\333?\334\21\261\310\0\14)\371\246\305\1\0\0\0t\341\22\0\1\0\0\0\340\330\25\0\5\0\0\0\1\5\0\0\0\0\0\5\25\0\0\0\3757B@\335\350\344\34C\27\122\353\3\0\0\0\0\0\0\0\0\0\0\1\0o\0\0\0\0\0\0\0\0\0\2\0\0\0", 116, 1024, ... {status=0x103, info=48}, "\5\0\2\3\20\0\0\00\0\0\0\1\0\0\0\30\0\0\0\0\0\0\0\0\0\0\0wF\235\311\333?\334\21\261\310\0\14)\371\246\305\0\0\0\0", ) , 116, 1024, ... {status=0x103, info=48},  (392, 297, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0t\0\0\0\2\0\0\0\\0\0\0\0\09\0\0\0\0\0wF\235\311\333?\334\21\261\310\0\14)\371\246\305\1\0\0\0t\341\22\0\1\0\0\0\340\330\25\0\5\0\0\0\1\5\0\0\0\0\0\5\25\0\0\0\3757B@\335\350\344\34C\27\122\353\3\0\0\0\0\0\0\0\0\0\0\1\0o\0\0\0\0\0\0\0\0\0\2\0\0\0", 116, 1024, ... {status=0x103, info=48}, "\5\0\2\3\20\0\0\00\0\0\0\1\0\0\0\30\0\0\0\0\0\0\0\0\0\0\0wF\235\311\333?\334\21\261\310\0\14)\371\246\305\0\0\0\0", ) , ) == 0x103
 03840   396   NtFsControlFile  (392, 297, 0x0, 0x0, 0x11c017,  (392, 297, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0,\0\0\0\3\0\0\0\24\0\0\0\0\0\0\0\0\0\0\0wF\235\311\333?\334\21\261\310\0\14)\371\246\305", 44, 1024, ... {status=0x103, info=180}, "\5\0\2\3\20\0\0\0\264\0\0\0\2\0\0\0\234\0\0\0\0\0\0\0\230\336\25\0\1\0\0\0\244\336\25\0 \0\0\0\1\0\0\0\16\0\20\0\260\336\25\0\300\336\25\0\10\0\0\0\0\0\0\0\7\0\0\0M\0Y\0W\0O\0R\0L\0D\0O\0\4\0\0\0\1\4\0\0\0\0\0\5\25\0\0\0\3757B@\335\350\344\34C\27\122\1\0\0\0x\245\25\0\1\0\0\0\1\0\0\0\20\0\22\0\214\245\25\0\0\0\0\0\0\0\0\0\11\0\0\0\0\0\0\0\10\0\0\0S\0R\0I\0-\0u\0s\0e\0r\0\1\0\0\0\0\0\0\0", ) , 44, 1024, ... {status=0x103, info=180},  (392, 297, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0,\0\0\0\3\0\0\0\24\0\0\0\0\0\0\0\0\0\0\0wF\235\311\333?\334\21\261\310\0\14)\371\246\305", 44, 1024, ... {status=0x103, info=180}, "\5\0\2\3\20\0\0\0\264\0\0\0\2\0\0\0\234\0\0\0\0\0\0\0\230\336\25\0\1\0\0\0\244\336\25\0 \0\0\0\1\0\0\0\16\0\20\0\260\336\25\0\300\336\25\0\10\0\0\0\0\0\0\0\7\0\0\0M\0Y\0W\0O\0R\0L\0D\0O\0\4\0\0\0\1\4\0\0\0\0\0\5\25\0\0\0\3757B@\335\350\344\34C\27\122\1\0\0\0x\245\25\0\1\0\0\0\1\0\0\0\20\0\22\0\214\245\25\0\0\0\0\0\0\0\0\0\11\0\0\0\0\0\0\0\10\0\0\0S\0R\0I\0-\0u\0s\0e\0r\0\1\0\0\0\0\0\0\0", ) , ) == 0x103
 03841   396   NtClose  (388, ... ) == 0x0
 03842   396   NtClose  (392, ... ) == 0x0
 03843   396   NtOpenThreadToken  (-2, 0xc, 1, ... ) == STATUS_NO_TOKEN
 03844   396   NtCreateEvent  (0x1f0003, 0x0, 1, 0, ... 392, ) == 0x0
 03845   396   NtOpenThreadToken  (-2, 0xc, 1, ... ) == STATUS_NO_TOKEN
 03846   396   NtSetInformationThread  (-2, ImpersonationToken, {ImpToken=0,}, 4, ... ) == 0x0
 03847   396   NtCreateFile  (0xc0100080, {24, 0, 0x40, 0, 1235588,  (0xc0100080, {24, 0, 0x40, 0, 1235588, "\??\PIPE\lsarpc"}, 0x0, 0, 3, 1, 64, 0, 0, ... 388, {status=0x0, info=1}, ) }, 0x0, 0, 3, 1, 64, 0, 0, ... 388, {status=0x0, info=1}, ) == 0x0
 03848   396   NtSetInformationFile  (388, 1235644, 8, Pipe, ... {status=0x0, info=0}, ) == 0x0
 03849   396   NtSetInformationFile  (388, 1235636, 8, Completion, ... {status=0x0, info=0}, ) == 0x0
 03850   396   NtSetInformationThread  (-2, ImpersonationToken, {ImpToken=0,}, 4, ... ) == 0x0
 03851   396   NtWriteFile  (388, 297, 0, 0,  (388, 297, 0, 0, "\5\0\13\3\20\0\0\0H\0\0\0\1\0\0\0\270\20\270\20\0\0\0\0\1\0\0\0\0\0\1\0xW4\224\22\315\253\357\0\1#Eg\211\253\0\0\0\0\4]\210\212\353\34\311\21\237\350\10\0+\20H`\2\0\0\0", 72, {0, 0}, 0, ... {status=0x0, info=72}, ) , 72, {0, 0}, 0, ... {status=0x0, info=72}, ) == 0x0
 03852   396   NtReadFile  (388, 297, 0, 0, 1024, {0, 0}, 0, ... {status=0x0, info=68},  (388, 297, 0, 0, 1024, {0, 0}, 0, ... {status=0x0, info=68}, "\5\0\14\3\20\0\0\0D\0\0\0\1\0\0\0\270\20\270\20\233%\0\0\14\0\PIPE\lsass\0\0\0\1\0\0\0\0\0\0\0\4]\210\212\353\34\311\21\237\350\10\0+\20H`\2\0\0\0", ) , ) == 0x0
 03853   396   NtFsControlFile  (388, 297, 0x0, 0x0, 0x11c017,  (388, 297, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0@\0\0\0\1\0\0\0(\0\0\0\0\0,\0\0\0\0\0\30\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\08\341\22\0\14\0\0\0\2\0\1\0\0\10\0\0", 64, 1024, ... {status=0x103, info=68}, "\5\0\14\3\20\0\0\0D\0\0\0\1\0\0\0\270\20\270\20\233%\0\0\14\0\PIPE\lsass\0\0\0\1\0\0\0\0\0\0\0\4]\210\212\353\34\311\21\237\350\10\0+\20H`\2\0\0\0", ) , 64, 1024, ... {status=0x103, info=68},  (388, 297, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0@\0\0\0\1\0\0\0(\0\0\0\0\0,\0\0\0\0\0\30\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\08\341\22\0\14\0\0\0\2\0\1\0\0\10\0\0", 64, 1024, ... {status=0x103, info=68}, "\5\0\14\3\20\0\0\0D\0\0\0\1\0\0\0\270\20\270\20\233%\0\0\14\0\PIPE\lsass\0\0\0\1\0\0\0\0\0\0\0\4]\210\212\353\34\311\21\237\350\10\0+\20H`\2\0\0\0", ) , ) == 0x103
 03854   396   NtFsControlFile  (388, 297, 0x0, 0x0, 0x11c017,  (388, 297, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0t\0\0\0\2\0\0\0\\0\0\0\0\09\0\0\0\0\0xF\235\311\333?\334\21\261\310\0\14)\371\246\305\1\0\0\0p\341\22\0\1\0\0\0\340\330\25\0\5\0\0\0\1\5\0\0\0\0\0\5\25\0\0\0\3757B@\335\350\344\34C\27\122\353\3\0\0\0\0\0\0\0\0\0\0\1\0o\0\0\0\0\0\0\0\0\0\2\0\0\0", 116, 1024, ... {status=0x103, info=48}, "\5\0\2\3\20\0\0\00\0\0\0\1\0\0\0\30\0\0\0\0\0\0\0\0\0\0\0xF\235\311\333?\334\21\261\310\0\14)\371\246\305\0\0\0\0", ) , 116, 1024, ... {status=0x103, info=48},  (388, 297, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0t\0\0\0\2\0\0\0\\0\0\0\0\09\0\0\0\0\0xF\235\311\333?\334\21\261\310\0\14)\371\246\305\1\0\0\0p\341\22\0\1\0\0\0\340\330\25\0\5\0\0\0\1\5\0\0\0\0\0\5\25\0\0\0\3757B@\335\350\344\34C\27\122\353\3\0\0\0\0\0\0\0\0\0\0\1\0o\0\0\0\0\0\0\0\0\0\2\0\0\0", 116, 1024, ... {status=0x103, info=48}, "\5\0\2\3\20\0\0\00\0\0\0\1\0\0\0\30\0\0\0\0\0\0\0\0\0\0\0xF\235\311\333?\334\21\261\310\0\14)\371\246\305\0\0\0\0", ) , ) == 0x103
 03855   396   NtFsControlFile  (388, 297, 0x0, 0x0, 0x11c017,  (388, 297, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0,\0\0\0\3\0\0\0\24\0\0\0\0\0\0\0\0\0\0\0xF\235\311\333?\334\21\261\310\0\14)\371\246\305", 44, 1024, ... {status=0x103, info=180}, "\5\0\2\3\20\0\0\0\264\0\0\0\2\0\0\0\234\0\0\0\0\0\0\0\230\336\25\0\1\0\0\0\244\336\25\0 \0\0\0\1\0\0\0\16\0\20\0\260\336\25\0\300\336\25\0\10\0\0\0\0\0\0\0\7\0\0\0M\0Y\0W\0O\0R\0L\0D\0O\0\4\0\0\0\1\4\0\0\0\0\0\5\25\0\0\0\3757B@\335\350\344\34C\27\122\1\0\0\0x\245\25\0\1\0\0\0\1\0\0\0\20\0\22\0\214\245\25\0\0\0\0\0\0\0\0\0\11\0\0\0\0\0\0\0\10\0\0\0S\0R\0I\0-\0u\0s\0e\0r\0\1\0\0\0\0\0\0\0", ) , 44, 1024, ... {status=0x103, info=180},  (388, 297, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0,\0\0\0\3\0\0\0\24\0\0\0\0\0\0\0\0\0\0\0xF\235\311\333?\334\21\261\310\0\14)\371\246\305", 44, 1024, ... {status=0x103, info=180}, "\5\0\2\3\20\0\0\0\264\0\0\0\2\0\0\0\234\0\0\0\0\0\0\0\230\336\25\0\1\0\0\0\244\336\25\0 \0\0\0\1\0\0\0\16\0\20\0\260\336\25\0\300\336\25\0\10\0\0\0\0\0\0\0\7\0\0\0M\0Y\0W\0O\0R\0L\0D\0O\0\4\0\0\0\1\4\0\0\0\0\0\5\25\0\0\0\3757B@\335\350\344\34C\27\122\1\0\0\0x\245\25\0\1\0\0\0\1\0\0\0\20\0\22\0\214\245\25\0\0\0\0\0\0\0\0\0\11\0\0\0\0\0\0\0\10\0\0\0S\0R\0I\0-\0u\0s\0e\0r\0\1\0\0\0\0\0\0\0", ) , ) == 0x103
 03856   396   NtClose  (392, ... ) == 0x0
 03857   396   NtClose  (388, ... ) == 0x0
 03858   396   NtQueryVirtualMemory  (-1, 0xb00000, Basic, 28, ... {BaseAddress=0xb00000,AllocationBase=0xb00000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 0x0, ) == 0x0
 03859   396   NtQueryVirtualMemory  (-1, 0xb00000, Basic, 28, ... {BaseAddress=0xb00000,AllocationBase=0xb00000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 0x0, ) == 0x0
 03860   396   NtQueryInformationToken  (380, User, 200, ... {token info, class 1, size 36}, 36, ) == 0x0
 03861   396   NtOpenKey  (0x20019, {24, 48, 0x40, 0, 0,  (0x20019, {24, 48, 0x40, 0, 0, "Software\Microsoft\Windows NT\CurrentVersion\ProfileList\S-1-5-21-1078081533-484763869-839522115-1003"}, ... 388, ) }, ... 388, ) == 0x0
 03862   396   NtQueryValueKey  (388,  (388, "ProfileImagePath", Partial, 144, ... TitleIdx=0, Type=2, Data="%\0S\0y\0s\0t\0e\0m\0D\0r\0i\0v\0e\0%\0\\0D\0o\0c\0u\0m\0e\0n\0t\0s\0 \0a\0n\0d\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0S\0R\0I\0-\0u\0s\0e\0r\0\0\0"}, 104, ) , Partial, 144, ... TitleIdx=0, Type=2, Data= (388, "ProfileImagePath", Partial, 144, ... TitleIdx=0, Type=2, Data="%\0S\0y\0s\0t\0e\0m\0D\0r\0i\0v\0e\0%\0\\0D\0o\0c\0u\0m\0e\0n\0t\0s\0 \0a\0n\0d\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0S\0R\0I\0-\0u\0s\0e\0r\0\0\0"}, 104, ) }, 104, ) == 0x0
 03863   396   NtClose  (388, ... ) == 0x0
 03864   396   NtCreateKey  (0x2001f, {24, 376, 0x40, 0, 0,  (0x2001f, {24, 376, 0x40, 0, 0, "Software\Microsoft\Windows NT\CurrentVersion\Winlogon"}, 0, 0x0, 0, ... 388, 2, ) }, 0, 0x0, 0, ... 388, 2, ) == 0x0
 03865   396   NtQueryValueKey  (388,  (388, "ParseAutoexec", Partial, 144, ... TitleIdx=0, Type=1, Data="1\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (388, "ParseAutoexec", Partial, 144, ... TitleIdx=0, Type=1, Data="1\0\0\0"}, 16, ) }, 16, ) == 0x0
 03866   396   NtClose  (388, ... ) == 0x0
 03867   396   NtQueryInformationProcess  (-1, DefaultHardErrorMode, 4, ... {process info, class 12, size 4}, 0x0, ) == 0x0
 03868   396   NtSetInformationProcess  (-1, DefaultHardErrorMode, {process info, class 12, size 4}, 4, ... ) == 0x0
 03869   396   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\c:\autoexec.bat"}, 1237292, ... ) }, 1237292, ... ) == 0x0
 03870   396   NtCreateFile  (0x80100080, {24, 0, 0x40, 0, 1237300,  (0x80100080, {24, 0, 0x40, 0, 1237300, "\??\c:\autoexec.bat"}, 0x0, 128, 1, 1, 96, 0, 0, ... 388, {status=0x0, info=1}, ) }, 0x0, 128, 1, 1, 96, 0, 0, ... 388, {status=0x0, info=1}, ) == 0x0
 03871   396   NtQueryInformationProcess  (-1, DefaultHardErrorMode, 4, ... {process info, class 12, size 4}, 0x0, ) == 0x0
 03872   396   NtSetInformationProcess  (-1, DefaultHardErrorMode, {process info, class 12, size 4}, 4, ... ) == 0x0
 03873   396   NtQueryInformationFile  (388, 1237316, 24, Standard, ... {status=0x0, info=24}, ) == 0x0
 03874   396   NtReadFile  (388, 0, 0, 0, 0, 0x0, 0, ... {status=0x0, info=0}, "", ) == 0x0
 03875   396   NtClose  (388, ... ) == 0x0
 03876   396   NtOpenKey  (0x20019, {24, 376, 0x40, 0, 0,  (0x20019, {24, 376, 0x40, 0, 0, "Environment"}, ... 388, ) }, ... 388, ) == 0x0
 03877   396   NtEnumerateValueKey  (388, 0, Full, 220, ... TitleIdx=0, Type=2, Name= (388, 0, Full, 220, ... TitleIdx=0, Type=2, Name="TEMP", Data="%\0U\0S\0E\0R\0P\0R\0O\0F\0I\0L\0E\0%\0\\0L\0o\0c\0a\0l\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0T\0e\0m\0p\0\0\0"}, 96, ) , Data= (388, 0, Full, 220, ... TitleIdx=0, Type=2, Name="TEMP", Data="%\0U\0S\0E\0R\0P\0R\0O\0F\0I\0L\0E\0%\0\\0L\0o\0c\0a\0l\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0T\0e\0m\0p\0\0\0"}, 96, ) }, 96, ) == 0x0
 03878   396   NtEnumerateValueKey  (388, 1, Full, 220, ... TitleIdx=0, Type=2, Name= (388, 1, Full, 220, ... TitleIdx=0, Type=2, Name="TMP", Data="%\0U\0S\0E\0R\0P\0R\0O\0F\0I\0L\0E\0%\0\\0L\0o\0c\0a\0l\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0T\0e\0m\0p\0\0\0"}, 96, ) , Data= (388, 1, Full, 220, ... TitleIdx=0, Type=2, Name="TMP", Data="%\0U\0S\0E\0R\0P\0R\0O\0F\0I\0L\0E\0%\0\\0L\0o\0c\0a\0l\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0T\0e\0m\0p\0\0\0"}, 96, ) }, 96, ) == 0x0
 03879   396   NtEnumerateValueKey  (388, 2, Full, 220, ... ) == STATUS_NO_MORE_ENTRIES
 03880   396   NtEnumerateValueKey  (388, 0, Full, 220, ... TitleIdx=0, Type=2, Name= (388, 0, Full, 220, ... TitleIdx=0, Type=2, Name="TEMP", Data="%\0U\0S\0E\0R\0P\0R\0O\0F\0I\0L\0E\0%\0\\0L\0o\0c\0a\0l\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0T\0e\0m\0p\0\0\0"}, 96, ) , Data= (388, 0, Full, 220, ... TitleIdx=0, Type=2, Name="TEMP", Data="%\0U\0S\0E\0R\0P\0R\0O\0F\0I\0L\0E\0%\0\\0L\0o\0c\0a\0l\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0T\0e\0m\0p\0\0\0"}, 96, ) }, 96, ) == 0x0
 03881   396   NtQueryInformationProcess  (-1, DefaultHardErrorMode, 4, ... {process info, class 12, size 4}, 0x0, ) == 0x0
 03882   396   NtSetInformationProcess  (-1, DefaultHardErrorMode, {process info, class 12, size 4}, 4, ... ) == 0x0
 03883   396   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\Documents and Settings\SRI-user\Local Settings\Temp"}, 1236032, ... ) }, 1236032, ... ) == 0x0
 03884   396   NtOpenFile  (0x100001, {24, 0, 0x40, 0, 0,  (0x100001, {24, 0, 0x40, 0, 0, "\??\C:\"}, 3, 16417, ... 392, {status=0x0, info=1}, ) }, 3, 16417, ... 392, {status=0x0, info=1}, ) == 0x0
 03885   396   NtQueryDirectoryFile  (392, 0, 0, 0, 1235392, 616, BothDirectory, 1,  (392, 0, 0, 0, 1235392, 616, BothDirectory, 1, "Documents and Settings", 0, ... {status=0x0, info=138}, ) , 0, ... {status=0x0, info=138}, ) == 0x0
 03886   396   NtClose  (392, ... ) == 0x0
 03887   396   NtOpenFile  (0x100001, {24, 0, 0x40, 0, 0,  (0x100001, {24, 0, 0x40, 0, 0, "\??\C:\Documents and Settings\SRI-user\"}, 3, 16417, ... 392, {status=0x0, info=1}, ) }, 3, 16417, ... 392, {status=0x0, info=1}, ) == 0x0
 03888   396   NtQueryDirectoryFile  (392, 0, 0, 0, 1235392, 616, BothDirectory, 1,  (392, 0, 0, 0, 1235392, 616, BothDirectory, 1, "Local Settings", 0, ... {status=0x0, info=122}, ) , 0, ... {status=0x0, info=122}, ) == 0x0
 03889   396   NtClose  (392, ... ) == 0x0
 03890   396   NtQueryInformationProcess  (-1, DefaultHardErrorMode, 4, ... {process info, class 12, size 4}, 0x0, ) == 0x0
 03891   396   NtSetInformationProcess  (-1, DefaultHardErrorMode, {process info, class 12, size 4}, 4, ... ) == 0x0
 03892   396   NtQueryVirtualMemory  (-1, 0xb00000, Basic, 28, ... {BaseAddress=0xb00000,AllocationBase=0xb00000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 0x0, ) == 0x0
 03893   396   NtEnumerateValueKey  (388, 1, Full, 220, ... TitleIdx=0, Type=2, Name= (388, 1, Full, 220, ... TitleIdx=0, Type=2, Name="TMP", Data="%\0U\0S\0E\0R\0P\0R\0O\0F\0I\0L\0E\0%\0\\0L\0o\0c\0a\0l\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0T\0e\0m\0p\0\0\0"}, 96, ) , Data= (388, 1, Full, 220, ... TitleIdx=0, Type=2, Name="TMP", Data="%\0U\0S\0E\0R\0P\0R\0O\0F\0I\0L\0E\0%\0\\0L\0o\0c\0a\0l\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0T\0e\0m\0p\0\0\0"}, 96, ) }, 96, ) == 0x0
 03894   396   NtQueryInformationProcess  (-1, DefaultHardErrorMode, 4, ... {process info, class 12, size 4}, 0x0, ) == 0x0
 03895   396   NtSetInformationProcess  (-1, DefaultHardErrorMode, {process info, class 12, size 4}, 4, ... ) == 0x0
 03896   396   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\Documents and Settings\SRI-user\Local Settings\Temp"}, 1236032, ... ) }, 1236032, ... ) == 0x0
 03897   396   NtOpenFile  (0x100001, {24, 0, 0x40, 0, 0,  (0x100001, {24, 0, 0x40, 0, 0, "\??\C:\"}, 3, 16417, ... 392, {status=0x0, info=1}, ) }, 3, 16417, ... 392, {status=0x0, info=1}, ) == 0x0
 03898   396   NtQueryDirectoryFile  (392, 0, 0, 0, 1235392, 616, BothDirectory, 1,  (392, 0, 0, 0, 1235392, 616, BothDirectory, 1, "Documents and Settings", 0, ... {status=0x0, info=138}, ) , 0, ... {status=0x0, info=138}, ) == 0x0
 03899   396   NtClose  (392, ... ) == 0x0
 03900   396   NtOpenFile  (0x100001, {24, 0, 0x40, 0, 0,  (0x100001, {24, 0, 0x40, 0, 0, "\??\C:\Documents and Settings\SRI-user\"}, 3, 16417, ... 392, {status=0x0, info=1}, ) }, 3, 16417, ... 392, {status=0x0, info=1}, ) == 0x0
 03901   396   NtQueryDirectoryFile  (392, 0, 0, 0, 1235392, 616, BothDirectory, 1,  (392, 0, 0, 0, 1235392, 616, BothDirectory, 1, "Local Settings", 0, ... {status=0x0, info=122}, ) , 0, ... {status=0x0, info=122}, ) == 0x0
 03902   396   NtClose  (392, ... ) == 0x0
 03903   396   NtQueryInformationProcess  (-1, DefaultHardErrorMode, 4, ... {process info, class 12, size 4}, 0x0, ) == 0x0
 03904   396   NtSetInformationProcess  (-1, DefaultHardErrorMode, {process info, class 12, size 4}, 4, ... ) == 0x0
 03905   396   NtQueryVirtualMemory  (-1, 0xb00000, Basic, 28, ... {BaseAddress=0xb00000,AllocationBase=0xb00000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 0x0, ) == 0x0
 03906   396   NtEnumerateValueKey  (388, 2, Full, 220, ... ) == STATUS_NO_MORE_ENTRIES
 03907   396   NtClose  (388, ... ) == 0x0
 03908   396   NtOpenKey  (0x20019, {24, 376, 0x40, 0, 0,  (0x20019, {24, 376, 0x40, 0, 0, "Volatile Environment"}, ... 388, ) }, ... 388, ) == 0x0
 03909   396   NtEnumerateValueKey  (388, 0, Full, 220, ... TitleIdx=0, Type=1, Name= (388, 0, Full, 220, ... TitleIdx=0, Type=1, Name="LOGONSERVER", Data="\\0\\0M\0Y\0W\0O\0R\0L\0D\0\0\0"}, 64, ) , Data= (388, 0, Full, 220, ... TitleIdx=0, Type=1, Name="LOGONSERVER", Data="\\0\\0M\0Y\0W\0O\0R\0L\0D\0\0\0"}, 64, ) }, 64, ) == 0x0
 03910   396   NtQueryVirtualMemory  (-1, 0xb00000, Basic, 28, ... {BaseAddress=0xb00000,AllocationBase=0xb00000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 0x0, ) == 0x0
 03911   396   NtEnumerateValueKey  (388, 1, Full, 220, ... TitleIdx=0, Type=1, Name= (388, 1, Full, 220, ... TitleIdx=0, Type=1, Name="HOMEDRIVE", Data="C\0:\0\0\0"}, 46, ) , Data= (388, 1, Full, 220, ... TitleIdx=0, Type=1, Name="HOMEDRIVE", Data="C\0:\0\0\0"}, 46, ) }, 46, ) == 0x0
 03912   396   NtQueryVirtualMemory  (-1, 0xb00000, Basic, 28, ... {BaseAddress=0xb00000,AllocationBase=0xb00000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 0x0, ) == 0x0
 03913   396   NtEnumerateValueKey  (388, 2, Full, 220, ... TitleIdx=0, Type=1, Name= (388, 2, Full, 220, ... TitleIdx=0, Type=1, Name="HOMEPATH", Data="\\0D\0o\0c\0u\0m\0e\0n\0t\0s\0 \0a\0n\0d\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0S\0R\0I\0-\0u\0s\0e\0r\0\0\0"}, 102, ) , Data= (388, 2, Full, 220, ... TitleIdx=0, Type=1, Name="HOMEPATH", Data="\\0D\0o\0c\0u\0m\0e\0n\0t\0s\0 \0a\0n\0d\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0S\0R\0I\0-\0u\0s\0e\0r\0\0\0"}, 102, ) }, 102, ) == 0x0
 03914   396   NtQueryVirtualMemory  (-1, 0xb00000, Basic, 28, ... {BaseAddress=0xb00000,AllocationBase=0xb00000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 0x0, ) == 0x0
 03915   396   NtEnumerateValueKey  (388, 3, Full, 220, ... TitleIdx=0, Type=1, Name= (388, 3, Full, 220, ... TitleIdx=0, Type=1, Name="CLIENTNAME", Data="C\0o\0n\0s\0o\0l\0e\0\0\0"}, 56, ) , Data= (388, 3, Full, 220, ... TitleIdx=0, Type=1, Name="CLIENTNAME", Data="C\0o\0n\0s\0o\0l\0e\0\0\0"}, 56, ) }, 56, ) == 0x0
 03916   396   NtQueryVirtualMemory  (-1, 0xb00000, Basic, 28, ... {BaseAddress=0xb00000,AllocationBase=0xb00000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 0x0, ) == 0x0
 03917   396   NtEnumerateValueKey  (388, 4, Full, 220, ... TitleIdx=0, Type=1, Name= (388, 4, Full, 220, ... TitleIdx=0, Type=1, Name="SESSIONNAME", Data="C\0o\0n\0s\0o\0l\0e\0\0\0"}, 60, ) , Data= (388, 4, Full, 220, ... TitleIdx=0, Type=1, Name="SESSIONNAME", Data="C\0o\0n\0s\0o\0l\0e\0\0\0"}, 60, ) }, 60, ) == 0x0
 03918   396   NtQueryVirtualMemory  (-1, 0xb00000, Basic, 28, ... {BaseAddress=0xb00000,AllocationBase=0xb00000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 0x0, ) == 0x0
 03919   396   NtEnumerateValueKey  (388, 5, Full, 220, ... TitleIdx=0, Type=1, Name= (388, 5, Full, 220, ... TitleIdx=0, Type=1, Name="APPDATA", Data="C\0:\0\\0D\0o\0c\0u\0m\0e\0n\0t\0s\0 \0a\0n\0d\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0S\0R\0I\0-\0u\0s\0e\0r\0\\0A\0p\0p\0l\0i\0c\0a\0t\0i\0o\0n\0 \0D\0a\0t\0a\0\0\0"}, 140, ) , Data= (388, 5, Full, 220, ... TitleIdx=0, Type=1, Name="APPDATA", Data="C\0:\0\\0D\0o\0c\0u\0m\0e\0n\0t\0s\0 \0a\0n\0d\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0S\0R\0I\0-\0u\0s\0e\0r\0\\0A\0p\0p\0l\0i\0c\0a\0t\0i\0o\0n\0 \0D\0a\0t\0a\0\0\0"}, 140, ) }, 140, ) == 0x0
 03920   396   NtQueryVirtualMemory  (-1, 0xb00000, Basic, 28, ... {BaseAddress=0xb00000,AllocationBase=0xb00000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 0x0, ) == 0x0
 03921   396   NtEnumerateValueKey  (388, 6, Full, 220, ... TitleIdx=0, Type=1, Name= (388, 6, Full, 220, ... TitleIdx=0, Type=1, Name="HOMESHARE", Data="\0\0"}, 42, ) , Data= (388, 6, Full, 220, ... TitleIdx=0, Type=1, Name="HOMESHARE", Data="\0\0"}, 42, ) }, 42, ) == 0x0
 03922   396   NtEnumerateValueKey  (388, 7, Full, 220, ... ) == STATUS_NO_MORE_ENTRIES
 03923   396   NtEnumerateValueKey  (388, 0, Full, 220, ... TitleIdx=0, Type=1, Name= (388, 0, Full, 220, ... TitleIdx=0, Type=1, Name="LOGONSERVER", Data="\\0\\0M\0Y\0W\0O\0R\0L\0D\0\0\0"}, 64, ) , Data= (388, 0, Full, 220, ... TitleIdx=0, Type=1, Name="LOGONSERVER", Data="\\0\\0M\0Y\0W\0O\0R\0L\0D\0\0\0"}, 64, ) }, 64, ) == 0x0
 03924   396   NtEnumerateValueKey  (388, 1, Full, 220, ... TitleIdx=0, Type=1, Name= (388, 1, Full, 220, ... TitleIdx=0, Type=1, Name="HOMEDRIVE", Data="C\0:\0\0\0"}, 46, ) , Data= (388, 1, Full, 220, ... TitleIdx=0, Type=1, Name="HOMEDRIVE", Data="C\0:\0\0\0"}, 46, ) }, 46, ) == 0x0
 03925   396   NtEnumerateValueKey  (388, 2, Full, 220, ... TitleIdx=0, Type=1, Name= (388, 2, Full, 220, ... TitleIdx=0, Type=1, Name="HOMEPATH", Data="\\0D\0o\0c\0u\0m\0e\0n\0t\0s\0 \0a\0n\0d\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0S\0R\0I\0-\0u\0s\0e\0r\0\0\0"}, 102, ) , Data= (388, 2, Full, 220, ... TitleIdx=0, Type=1, Name="HOMEPATH", Data="\\0D\0o\0c\0u\0m\0e\0n\0t\0s\0 \0a\0n\0d\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0S\0R\0I\0-\0u\0s\0e\0r\0\0\0"}, 102, ) }, 102, ) == 0x0
 03926   396   NtEnumerateValueKey  (388, 3, Full, 220, ... TitleIdx=0, Type=1, Name= (388, 3, Full, 220, ... TitleIdx=0, Type=1, Name="CLIENTNAME", Data="C\0o\0n\0s\0o\0l\0e\0\0\0"}, 56, ) , Data= (388, 3, Full, 220, ... TitleIdx=0, Type=1, Name="CLIENTNAME", Data="C\0o\0n\0s\0o\0l\0e\0\0\0"}, 56, ) }, 56, ) == 0x0
 03927   396   NtEnumerateValueKey  (388, 4, Full, 220, ... TitleIdx=0, Type=1, Name= (388, 4, Full, 220, ... TitleIdx=0, Type=1, Name="SESSIONNAME", Data="C\0o\0n\0s\0o\0l\0e\0\0\0"}, 60, ) , Data= (388, 4, Full, 220, ... TitleIdx=0, Type=1, Name="SESSIONNAME", Data="C\0o\0n\0s\0o\0l\0e\0\0\0"}, 60, ) }, 60, ) == 0x0
 03928   396   NtEnumerateValueKey  (388, 5, Full, 220, ... TitleIdx=0, Type=1, Name= (388, 5, Full, 220, ... TitleIdx=0, Type=1, Name="APPDATA", Data="C\0:\0\\0D\0o\0c\0u\0m\0e\0n\0t\0s\0 \0a\0n\0d\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0S\0R\0I\0-\0u\0s\0e\0r\0\\0A\0p\0p\0l\0i\0c\0a\0t\0i\0o\0n\0 \0D\0a\0t\0a\0\0\0"}, 140, ) , Data= (388, 5, Full, 220, ... TitleIdx=0, Type=1, Name="APPDATA", Data="C\0:\0\\0D\0o\0c\0u\0m\0e\0n\0t\0s\0 \0a\0n\0d\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0S\0R\0I\0-\0u\0s\0e\0r\0\\0A\0p\0p\0l\0i\0c\0a\0t\0i\0o\0n\0 \0D\0a\0t\0a\0\0\0"}, 140, ) }, 140, ) == 0x0
 03929   396   NtEnumerateValueKey  (388, 6, Full, 220, ... TitleIdx=0, Type=1, Name= (388, 6, Full, 220, ... TitleIdx=0, Type=1, Name="HOMESHARE", Data="\0\0"}, 42, ) , Data= (388, 6, Full, 220, ... TitleIdx=0, Type=1, Name="HOMESHARE", Data="\0\0"}, 42, ) }, 42, ) == 0x0
 03930   396   NtEnumerateValueKey  (388, 7, Full, 220, ... ) == STATUS_NO_MORE_ENTRIES
 03931   396   NtClose  (388, ... ) == 0x0
 03932   396   NtClose  (376, ... ) == 0x0
 03933   396   NtFreeVirtualMemory  (-1, (0xb00000), 0, 32768, ... (0xb00000), 4096, ) == 0x0
 03934   396   NtClose  (384, ... ) == 0x0
 03935   396   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\Documents and Settings\SRI-user\Application Data"}, 1237956, ... ) }, 1237956, ... ) == 0x0
 03936   396   NtQueryInformationToken  (380, User, 64, ... {token info, class 1, size 36}, 36, ) == 0x0
 03937   396   NtOpenKey  (0x2001f, {24, 328, 0x40, 0, 0,  (0x2001f, {24, 328, 0x40, 0, 0, "S-1-5-21-1078081533-484763869-839522115-1003"}, ... 384, ) }, ... 384, ) == 0x0
 03938   396   NtCreateKey  (0x2000000, {24, 384, 0x40, 0, 0,  (0x2000000, {24, 384, 0x40, 0, 0, "Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders"}, 0, 0x0, 0, ... 376, 2, ) }, 0, 0x0, 0, ... 376, 2, ) == 0x0
 03939   396   NtClose  (384, ... ) == 0x0
 03940   396   NtSetValueKey  (376,  (376, "AppData", 0, 1, "C\0:\0\\0D\0o\0c\0u\0m\0e\0n\0t\0s\0 \0a\0n\0d\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0S\0R\0I\0-\0u\0s\0e\0r\0\\0A\0p\0p\0l\0i\0c\0a\0t\0i\0o\0n\0 \0D\0a\0t\0a\0\0\0", 104, ... ) , 0, 1,  (376, "AppData", 0, 1, "C\0:\0\\0D\0o\0c\0u\0m\0e\0n\0t\0s\0 \0a\0n\0d\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0S\0R\0I\0-\0u\0s\0e\0r\0\\0A\0p\0p\0l\0i\0c\0a\0t\0i\0o\0n\0 \0D\0a\0t\0a\0\0\0", 104, ... ) , 104, ... ) == 0x0
 03941   396   NtClose  (376, ... ) == 0x0
 03942   396   NtClose  (380, ... ) == 0x0
 03943   396   NtOpenFile  (0x100001, {24, 0, 0x40, 0, 0,  (0x100001, {24, 0, 0x40, 0, 0, "\??\C:\Documents and Settings\SRI-user\Application Data\Microsoft\Network\Connections\Pbk\"}, 3, 16417, ... ) }, 3, 16417, ... ) == STATUS_OBJECT_PATH_NOT_FOUND
 03944   396   NtWaitForSingleObject  (156, 0, 0x0, ... ) == 0x0
 03945   396   NtQueryInformationFile  (152, 1239004, 24, Standard, ... {status=0x0, info=24}, ) == 0x0
 03946   396   NtReleaseMutant  (156, ... 0x0, ) == 0x0
 03947   396   NtReleaseMutant  (200, ... 0x0, ) == 0x0
 03948   396   NtWaitForSingleObject  (72, 0, {0, 0}, ... ) == 0x102
 03949   396   NtWaitForSingleObject  (72, 0, {0, 0}, ... ) == 0x102
 03950   396   NtWaitForSingleObject  (72, 0, {0, 0}, ... ) == 0x102
 03951   396   NtWaitForSingleObject  (80, 0, {0, 0}, ... ) == 0x102
 03952   396   NtCreateEvent  (0x1f0003, 0x0, 1, 0, ... 380, ) == 0x0
 03953   396   NtConnectPort  ( ("\RPC Control\DNSResolver", {12, 2, 1, 1}, 0x0, 0x0, 1237144, 112, ... 376, 0x0, 0x0, 0x0, 112, ) , {12, 2, 1, 1}, 0x0, 0x0, 1237144, 112, ... 376, 0x0, 0x0, 0x0, 112, ) == 0x0
 03954   396   NtRequestWaitReplyPort  (376, {128, 152, new_msg, 0, 122476, 1310720, 1236908, 2012750850}  (376, {128, 152, new_msg, 0, 122476, 1310720, 1236908, 2012750850} "\0\346\22\0\2$\370w\370T\367w\1kwEVY\205D\237\200\364(\367\326\1)\2\0\0\0\1\0\0\0k\23\314w\4\0\0\0\20\344\314w\300\356\25\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\1\0\23\0\20\311\25\0X\331\25\0\0\0\0\0f\0\0\03\0\0\0L\347\22\0\0\0\0\0\0\0\22\0H\340\22\0hE\25\0t\343\22\0\0\0\0\0\5\0\0\0\5\0\0\0" ... {128, 152, reply, 0, 316, 396, 1598, 0} "\7\346\22\0\2$\370w\370T\367w\1kwEVY\205D\237\200\364(\367\326\1)\2\0\0\0\1\0\0\0\0\0\0\0\4\0\0\0\20\344\314w\377\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\1\0\23\0\20\311\25\0X\331\25\0\0\0\0\0f\0\0\03\0\0\0L\347\22\0\0\0\0\0\0\0\22\0H\340\22\0hE\25\0t\343\22\0\0\0\0\0\5\0\0\0\5\0\0\0" )  ... {128, 152, reply, 0, 316, 396, 1598, 0}  (376, {128, 152, new_msg, 0, 122476, 1310720, 1236908, 2012750850} "\0\346\22\0\2$\370w\370T\367w\1kwEVY\205D\237\200\364(\367\326\1)\2\0\0\0\1\0\0\0k\23\314w\4\0\0\0\20\344\314w\300\356\25\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\1\0\23\0\20\311\25\0X\331\25\0\0\0\0\0f\0\0\03\0\0\0L\347\22\0\0\0\0\0\0\0\22\0H\340\22\0hE\25\0t\343\22\0\0\0\0\0\5\0\0\0\5\0\0\0" ... {128, 152, reply, 0, 316, 396, 1598, 0} "\7\346\22\0\2$\370w\370T\367w\1kwEVY\205D\237\200\364(\367\326\1)\2\0\0\0\1\0\0\0\0\0\0\0\4\0\0\0\20\344\314w\377\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\1\0\23\0\20\311\25\0X\331\25\0\0\0\0\0f\0\0\03\0\0\0L\347\22\0\0\0\0\0\0\0\22\0H\340\22\0hE\25\0t\343\22\0\0\0\0\0\5\0\0\0\5\0\0\0" )  ) == 0x0
 03955   396   NtRequestWaitReplyPort  (376, {112, 136, new_msg, 0, 44, 3, 20, 0}  (376, {112, 136, new_msg, 0, 44, 3, 20, 0} "\1\0\0\0A\2\11\0\333?\334\21\261\310\0\14)\371\246\305\1\0\0\0\377\377\377\377\1\0\0\0\0\0\0\0,\10\25\0\26\0\0\0\0\0\0\0\26\0\0\0s\0r\0v\00\01\0.\0d\0e\0b\0e\0l\0i\0z\0o\0m\0b\0i\0.\0c\0o\0m\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0" ... {44, 68, reply, 0, 316, 396, 1599, 0} "\2\240\372\177\1\00\300\0\0\0\0G\3\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\264\5\0\0\1\0\0\0" )  ... {44, 68, reply, 0, 316, 396, 1599, 0}  (376, {112, 136, new_msg, 0, 44, 3, 20, 0} "\1\0\0\0A\2\11\0\333?\334\21\261\310\0\14)\371\246\305\1\0\0\0\377\377\377\377\1\0\0\0\0\0\0\0,\10\25\0\26\0\0\0\0\0\0\0\26\0\0\0s\0r\0v\00\01\0.\0d\0e\0b\0e\0l\0i\0z\0o\0m\0b\0i\0.\0c\0o\0m\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0" ... {44, 68, reply, 0, 316, 396, 1599, 0} "\2\240\372\177\1\00\300\0\0\0\0G\3\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\264\5\0\0\1\0\0\0" )  ) == 0x0
 03956   396   NtClose  (380, ... ) == 0x0
 03957   396   NtClose  (376, ... ) == 0x0
 03958   396   NtCreateFile  (0x3, {24, 0, 0x40, 0, 0,  (0x3, {24, 0, 0x40, 0, 0, "\Device\RasAcd"}, 0x0, 128, 3, 3, 0, 0, 0, ... 376, {status=0x0, info=0}, ) }, 0x0, 128, 3, 3, 0, 0, 0, ... 376, {status=0x0, info=0}, ) == 0x0
 03959   396   NtCreateEvent  (0x1f0003, 0x0, 1, 0, ... 380, ) == 0x0
 03960   396   NtDeviceIoControlFile  (376, 380, 0x0, 0x0, 0xf14014,  (376, 380, 0x0, 0x0, 0xf14014, "\3\0\0\0srv01.debelizombi.com\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0", 1552, 0, ... ) , 1552, 0, ... ) == STATUS_UNSUCCESSFUL
 03961   396   NtClose  (380, ... ) == 0x0
 03962   396   NtClose  (376, ... ) == 0x0
 03963   396   NtClearEvent  (352, ... ) == 0x0
 03964   396   NtSetEvent  (352, ... 0x0, ) == 0x0
 03965   396   NtClose  (352, ... ) == 0x0
 03966   396   NtCreateFile  (0x80100080, {24, 0, 0x40, 0, 1241776,  (0x80100080, {24, 0, 0x40, 0, 1241776, "\??\C:\WINDOWS\imon.cfg"}, 0x0, 0, 1, 1, 96, 0, 0, ... ) }, 0x0, 0, 1, 1, 96, 0, 0, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 03967   396   NtWaitForSingleObject  (80, 0, {0, 0}, ... ) == 0x102
 03968   396   NtCreateEvent  (0x1f0003, 0x0, 1, 0, ... 352, ) == 0x0
 03969   396   NtConnectPort  ( ("\RPC Control\DNSResolver", {12, 2, 1, 1}, 0x0, 0x0, 1238588, 112, ... 376, 0x0, 0x0, 0x0, 112, ) , {12, 2, 1, 1}, 0x0, 0x0, 1238588, 112, ... 376, 0x0, 0x0, 0x0, 112, ) == 0x0
 03970   396   NtRequestWaitReplyPort  (376, {128, 152, new_msg, 0, 1310720, 123920, 1310720, 1238352}  (376, {128, 152, new_msg, 0, 1310720, 123920, 1310720, 1238352} "\0$\370w\0\354\22\0\2$\370w\1kwEVY\205D\237\200\364(\367\326\1)\2\0\0\0\1\0\0\0(\357\25\0\4\0\0\0(\357\25\0\20\344\314w(\357\25\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\1\0\24\0\350\352\25\0\300\327\25\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\5\0\0\0" ... {128, 152, reply, 0, 316, 396, 1602, 0} "\7$\370w\0\354\22\0\2$\370w\1kwEVY\205D\237\200\364(\367\326\1)\2\0\0\0\1\0\0\0\0\0\0\0\4\0\0\0(\357\25\0\377\377\377\377(\357\25\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\1\0\24\0\350\352\25\0\300\327\25\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\5\0\0\0" )  ... {128, 152, reply, 0, 316, 396, 1602, 0}  (376, {128, 152, new_msg, 0, 1310720, 123920, 1310720, 1238352} "\0$\370w\0\354\22\0\2$\370w\1kwEVY\205D\237\200\364(\367\326\1)\2\0\0\0\1\0\0\0(\357\25\0\4\0\0\0(\357\25\0\20\344\314w(\357\25\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\1\0\24\0\350\352\25\0\300\327\25\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\5\0\0\0" ... {128, 152, reply, 0, 316, 396, 1602, 0} "\7$\370w\0\354\22\0\2$\370w\1kwEVY\205D\237\200\364(\367\326\1)\2\0\0\0\1\0\0\0\0\0\0\0\4\0\0\0(\357\25\0\377\377\377\377(\357\25\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\1\0\24\0\350\352\25\0\300\327\25\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\5\0\0\0" )  ) == 0x0
 03971   396   NtRequestWaitReplyPort  (376, {64, 88, new_msg, 0, 316, 396, 1599, 0}  (376, {64, 88, new_msg, 0, 316, 396, 1599, 0} "\1\240\0\0A\2\10\0\0\0\0\0G\3\0\0\0\0\0\0\0\0\0\0\377\377\377\377\0\0\0\0\0\0\0\0\21\0\0\0\0\0\0\0\0\0\0\0\26\0\0\0s\0r\0v\00\01\0.\0" ... {52, 76, reply, 0, 316, 396, 1603, 0} "\2\240\372\177\1\00\300\0\0\0\0G\3\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\200]\12\0\1\0\0\0\1\0\0\0\300\250|\201\377\377\377\0" )  ... {52, 76, reply, 0, 316, 396, 1603, 0}  (376, {64, 88, new_msg, 0, 316, 396, 1599, 0} "\1\240\0\0A\2\10\0\0\0\0\0G\3\0\0\0\0\0\0\0\0\0\0\377\377\377\377\0\0\0\0\0\0\0\0\21\0\0\0\0\0\0\0\0\0\0\0\26\0\0\0s\0r\0v\00\01\0.\0" ... {52, 76, reply, 0, 316, 396, 1603, 0} "\2\240\372\177\1\00\300\0\0\0\0G\3\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\200]\12\0\1\0\0\0\1\0\0\0\300\250|\201\377\377\377\0" )  ) == 0x0
 03972   396   NtClose  (352, ... ) == 0x0
 03973   396   NtClose  (376, ... ) == 0x0
 03974   396   NtCreateKey  (0x20019, {24, 48, 0x40, 0, 0,  (0x20019, {24, 48, 0x40, 0, 0, "System\CurrentControlSet\Services\Tcpip\Parameters"}, 0, "Class", 0, ... 376, 2, ) }, 0,  (0x20019, {24, 48, 0x40, 0, 0, "System\CurrentControlSet\Services\Tcpip\Parameters"}, 0, "Class", 0, ... 376, 2, ) , 0, ... 376, 2, ) == 0x0
 03975   396   NtOpenKey  (0x20019, {24, 48, 0x40, 0, 0,  (0x20019, {24, 48, 0x40, 0, 0, "System\CurrentControlSet\Services\DnsCache\Parameters"}, ... 352, ) }, ... 352, ) == 0x0
 03976   396   NtOpenKey  (0x20019, {24, 48, 0x40, 0, 0,  (0x20019, {24, 48, 0x40, 0, 0, "Software\Policies\Microsoft\Windows NT\DnsClient"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 03977   396   NtQueryValueKey  (376,  (376, "Hostname", Partial, 144, ... TitleIdx=0, Type=1, Data="M\0Y\0W\0O\0R\0L\0D\0\0\0"}, 28, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (376, "Hostname", Partial, 144, ... TitleIdx=0, Type=1, Data="M\0Y\0W\0O\0R\0L\0D\0\0\0"}, 28, ) }, 28, ) == 0x0
 03978   396   NtQueryValueKey  (376,  (376, "Hostname", Partial, 144, ... TitleIdx=0, Type=1, Data="M\0Y\0W\0O\0R\0L\0D\0\0\0"}, 28, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (376, "Hostname", Partial, 144, ... TitleIdx=0, Type=1, Data="M\0Y\0W\0O\0R\0L\0D\0\0\0"}, 28, ) }, 28, ) == 0x0
 03979   396   NtClose  (376, ... ) == 0x0
 03980   396   NtClose  (352, ... ) == 0x0
 03981   396   NtCreateKey  (0x20019, {24, 48, 0x40, 0, 0,  (0x20019, {24, 48, 0x40, 0, 0, "System\CurrentControlSet\Services\Tcpip\Parameters"}, 0, "Class", 0, ... 352, 2, ) }, 0,  (0x20019, {24, 48, 0x40, 0, 0, "System\CurrentControlSet\Services\Tcpip\Parameters"}, 0, "Class", 0, ... 352, 2, ) , 0, ... 352, 2, ) == 0x0
 03982   396   NtOpenKey  (0x20019, {24, 48, 0x40, 0, 0,  (0x20019, {24, 48, 0x40, 0, 0, "System\CurrentControlSet\Services\DnsCache\Parameters"}, ... 376, ) }, ... 376, ) == 0x0
 03983   396   NtOpenKey  (0x20019, {24, 48, 0x40, 0, 0,  (0x20019, {24, 48, 0x40, 0, 0, "Software\Policies\Microsoft\Windows NT\DnsClient"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 03984   396   NtQueryValueKey  (352,  (352, "Domain", Partial, 144, ... TitleIdx=0, Type=1, Data="\0\0"}, 14, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (352, "Domain", Partial, 144, ... TitleIdx=0, Type=1, Data="\0\0"}, 14, ) }, 14, ) == 0x0
 03985   396   NtQueryValueKey  (352,  (352, "Domain", Partial, 144, ... TitleIdx=0, Type=1, Data="\0\0"}, 14, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (352, "Domain", Partial, 144, ... TitleIdx=0, Type=1, Data="\0\0"}, 14, ) }, 14, ) == 0x0
 03986   396   NtClose  (352, ... ) == 0x0
 03987   396   NtClose  (376, ... ) == 0x0
 03988   396   NtWaitForSingleObject  (80, 0, {0, 0}, ... ) == 0x102
 03989   396   NtCreateEvent  (0x1f0003, 0x0, 1, 0, ... 376, ) == 0x0
 03990   396   NtConnectPort  ( ("\RPC Control\DNSResolver", {12, 2, 1, 1}, 0x0, 0x0, 1238388, 112, ... 352, 0x0, 0x0, 0x0, 112, ) , {12, 2, 1, 1}, 0x0, 0x0, 1238388, 112, ... 352, 0x0, 0x0, 0x0, 112, ) == 0x0
 03991   396   NtRequestWaitReplyPort  (352, {128, 152, new_msg, 0, 1310720, 123720, 1310720, 1238152}  (352, {128, 152, new_msg, 0, 1310720, 123720, 1310720, 1238152} "\0$\370w8\353\22\0\2$\370w\1kwEVY\205D\237\200\364(\367\326\1)\2\0\0\0\1\0\0\0(\357\25\0\4\0\0\0(\357\25\0\20\344\314w(\357\25\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\1\0\25\0\350\352\25\0(\251\25\0\0\0\0\0\370\347\22\0\250\347\22\0\230\351\22\0\0\0\0\0\0\0\25\0\377\377\377\377\365\26\365w\0\0\0\0\13\30\365w\5\0\0\0" ... {128, 152, reply, 0, 316, 396, 1606, 0} "\7$\370w8\353\22\0\2$\370w\1kwEVY\205D\237\200\364(\367\326\1)\2\0\0\0\1\0\0\0\0\0\0\0\4\0\0\0(\357\25\0\377\377\377\377(\357\25\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\1\0\25\0\350\352\25\0(\251\25\0\0\0\0\0\370\347\22\0\250\347\22\0\230\351\22\0\0\0\0\0\0\0\25\0\377\377\377\377\365\26\365w\0\0\0\0\13\30\365w\5\0\0\0" )  ... {128, 152, reply, 0, 316, 396, 1606, 0}  (352, {128, 152, new_msg, 0, 1310720, 123720, 1310720, 1238152} "\0$\370w8\353\22\0\2$\370w\1kwEVY\205D\237\200\364(\367\326\1)\2\0\0\0\1\0\0\0(\357\25\0\4\0\0\0(\357\25\0\20\344\314w(\357\25\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\1\0\25\0\350\352\25\0(\251\25\0\0\0\0\0\370\347\22\0\250\347\22\0\230\351\22\0\0\0\0\0\0\0\25\0\377\377\377\377\365\26\365w\0\0\0\0\13\30\365w\5\0\0\0" ... {128, 152, reply, 0, 316, 396, 1606, 0} "\7$\370w8\353\22\0\2$\370w\1kwEVY\205D\237\200\364(\367\326\1)\2\0\0\0\1\0\0\0\0\0\0\0\4\0\0\0(\357\25\0\377\377\377\377(\357\25\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\1\0\25\0\350\352\25\0(\251\25\0\0\0\0\0\370\347\22\0\250\347\22\0\230\351\22\0\0\0\0\0\0\0\25\0\377\377\377\377\365\26\365w\0\0\0\0\13\30\365w\5\0\0\0" )  ) == 0x0
 03992   396   NtRequestWaitReplyPort  (352, {64, 88, new_msg, 0, 316, 396, 1603, 0}  (352, {64, 88, new_msg, 0, 316, 396, 1603, 0} "\1\240\0\0A\2\10\0\0\0\0\0G\3\0\0\0\0\0\0\0\0\0\0\377\377\377\377\0\0\0\0\0\0\0\0\21\0\0\0\0\0\0\0\0\0\0\0\377\377\377\0s\0r\0v\00\01\0.\0" ... {52, 76, reply, 0, 316, 396, 1607, 0} "\2\240\372\177\1\00\300\0\0\0\0G\3\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\200]\12\0\1\0\0\0\1\0\0\0\300\250|\201\377\377\377\0" )  ... {52, 76, reply, 0, 316, 396, 1607, 0}  (352, {64, 88, new_msg, 0, 316, 396, 1603, 0} "\1\240\0\0A\2\10\0\0\0\0\0G\3\0\0\0\0\0\0\0\0\0\0\377\377\377\377\0\0\0\0\0\0\0\0\21\0\0\0\0\0\0\0\0\0\0\0\377\377\377\0s\0r\0v\00\01\0.\0" ... {52, 76, reply, 0, 316, 396, 1607, 0} "\2\240\372\177\1\00\300\0\0\0\0G\3\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\200]\12\0\1\0\0\0\1\0\0\0\300\250|\201\377\377\377\0" )  ) == 0x0
 03993   396   NtClose  (376, ... ) == 0x0
 03994   396   NtClose  (352, ... ) == 0x0
 03995   396   NtCreateKey  (0x20019, {24, 48, 0x40, 0, 0,  (0x20019, {24, 48, 0x40, 0, 0, "System\CurrentControlSet\Services\Tcpip\Parameters"}, 0, "Class", 0, ... 352, 2, ) }, 0,  (0x20019, {24, 48, 0x40, 0, 0, "System\CurrentControlSet\Services\Tcpip\Parameters"}, 0, "Class", 0, ... 352, 2, ) , 0, ... 352, 2, ) == 0x0
 03996   396   NtOpenKey  (0x20019, {24, 48, 0x40, 0, 0,  (0x20019, {24, 48, 0x40, 0, 0, "System\CurrentControlSet\Services\DnsCache\Parameters"}, ... 376, ) }, ... 376, ) == 0x0
 03997   396   NtOpenKey  (0x20019, {24, 48, 0x40, 0, 0,  (0x20019, {24, 48, 0x40, 0, 0, "Software\Policies\Microsoft\Windows NT\DnsClient"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 03998   396   NtQueryValueKey  (352,  (352, "Hostname", Partial, 144, ... TitleIdx=0, Type=1, Data="M\0Y\0W\0O\0R\0L\0D\0\0\0"}, 28, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (352, "Hostname", Partial, 144, ... TitleIdx=0, Type=1, Data="M\0Y\0W\0O\0R\0L\0D\0\0\0"}, 28, ) }, 28, ) == 0x0
 03999   396   NtQueryValueKey  (352,  (352, "Hostname", Partial, 144, ... TitleIdx=0, Type=1, Data="M\0Y\0W\0O\0R\0L\0D\0\0\0"}, 28, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (352, "Hostname", Partial, 144, ... TitleIdx=0, Type=1, Data="M\0Y\0W\0O\0R\0L\0D\0\0\0"}, 28, ) }, 28, ) == 0x0
 04000   396   NtClose  (352, ... ) == 0x0
 04001   396   NtClose  (376, ... ) == 0x0
 04002   396   NtCreateKey  (0x20019, {24, 48, 0x40, 0, 0,  (0x20019, {24, 48, 0x40, 0, 0, "System\CurrentControlSet\Services\Tcpip\Parameters"}, 0, "Class", 0, ... 376, 2, ) }, 0,  (0x20019, {24, 48, 0x40, 0, 0, "System\CurrentControlSet\Services\Tcpip\Parameters"}, 0, "Class", 0, ... 376, 2, ) , 0, ... 376, 2, ) == 0x0
 04003   396   NtOpenKey  (0x20019, {24, 48, 0x40, 0, 0,  (0x20019, {24, 48, 0x40, 0, 0, "System\CurrentControlSet\Services\DnsCache\Parameters"}, ... 352, ) }, ... 352, ) == 0x0
 04004   396   NtOpenKey  (0x20019, {24, 48, 0x40, 0, 0,  (0x20019, {24, 48, 0x40, 0, 0, "Software\Policies\Microsoft\Windows NT\DnsClient"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 04005   396   NtQueryValueKey  (376,  (376, "Domain", Partial, 144, ... TitleIdx=0, Type=1, Data="\0\0"}, 14, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (376, "Domain", Partial, 144, ... TitleIdx=0, Type=1, Data="\0\0"}, 14, ) }, 14, ) == 0x0
 04006   396   NtQueryValueKey  (376,  (376, "Domain", Partial, 144, ... TitleIdx=0, Type=1, Data="\0\0"}, 14, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (376, "Domain", Partial, 144, ... TitleIdx=0, Type=1, Data="\0\0"}, 14, ) }, 14, ) == 0x0
 04007   396   NtClose  (376, ... ) == 0x0
 04008   396   NtClose  (352, ... ) == 0x0
 04009   396   NtCreateFile  (0x3, {24, 0, 0x40, 0, 0,  (0x3, {24, 0, 0x40, 0, 0, "\Device\RasAcd"}, 0x0, 128, 3, 3, 0, 0, 0, ... 352, {status=0x0, info=0}, ) }, 0x0, 128, 3, 3, 0, 0, 0, ... 352, {status=0x0, info=0}, ) == 0x0
 04010   396   NtCreateEvent  (0x1f0003, 0x0, 1, 0, ... 376, ) == 0x0
 04011   396   NtDeviceIoControlFile  (352, 376, 0x0, 0x0, 0xf14014,  (352, 376, 0x0, 0x0, 0xf14014, "\3\0\0\0MYWORLD\0\231%\362v\2\0\0\200\330\304\362v\0\0\0\0\360\352\22\0O\345\367w{\30\335w\0\0\0\0\300.\24\0H\357\25\0"\2\373\177\0\354\22\0\0\0\0\0\263\26\365w0\337\25\0q\26\365w\350\6\24\0\215\26\365w\0\0\0\0\320\354\25\0\20:\25\0\24\232\347w3\355\26\0H\357\25\0V\357\25\04\355\25\0\377\377\0\0\0\0\0\04\355\25\0\7\0\0\0H\357\25\0\254\353\22\0\177;\245q\0\0\0\0\0\0\0\0H\357\25\0\0\0\0\04\355\25\0\377\377\0\0\1\0\0\0\0\0\0\0@\357\25\04\355\25\0(\357\25\0\354\353\22\0}<\245q4\355\25\0\0\0\0\0H\357\25\0\365<\245q(\355\25\0\24\355\25\0\2\0\0\0\20\0\0\0\0\0\0\0\0\0\0\0\20\0\0\0\20:\1\0\0\0\24\0D\353\22\0$\360\22\0\330\374\22\0\2$\370w\370T\367wa/\245q\2642\250q\0\0\0\0\0\0\0\0:/\245q\20:\25\0P\247\25\0P\257\25\0h\257\25\0H\357\25\0V\357\25\04\355\25\0\377\377\0\0\0\0\0\04\355\25\0\7\0\0\0H\357\25\0t\354\22\0\177;\245q\0\0\0\0\0\0\0\0H\357\25\0\0\0\0\04\355\25\0\377\377\0\0\1\0\0\0\0\0\0\0@\357\25\04\355\25\0(\357\25\0\264\354\22\0}<\245q4\355\25\0\0\0\0\0H\357\25\0\365<\245q(\355\25\0\24\355\25\0\2\0\0\0\20\0\0\0\0\0\0\0\0\0\0\0\20\0\0\0\240\25\1\0\0\0\24\0\14\354\22\0\354\360\22\0\330\374\22\0\2$\370w\370T\367wa/\245q\2642\250q\0\0\0\0\0\0\0\0:/\245q\240\25\25\0(\305\25\0P\257\25\0", 1552, 0, ... {status=0x0, info=0}, 0x0, ) \2\373\177\0\354\22\0\0\0\0\0\263\26\365w0\337\25\0q\26\365w\350\6\24\0\215\26\365w\0\0\0\0\320\354\25\0\20:\25\0\24\232\347w3\355\26\0H\357\25\0V\357\25\04\355\25\0\377\377\0\0\0\0\0\04\355\25\0\7\0\0\0H\357\25\0\254\353\22\0\177;\245q\0\0\0\0\0\0\0\0H\357\25\0\0\0\0\04\355\25\0\377\377\0\0\1\0\0\0\0\0\0\0@\357\25\04\355\25\0(\357\25\0\354\353\22\0}<\245q4\355\25\0\0\0\0\0H\357\25\0\365<\245q(\355\25\0\24\355\25\0\2\0\0\0\20\0\0\0\0\0\0\0\0\0\0\0\20\0\0\0\20:\1\0\0\0\24\0D\353\22\0$\360\22\0\330\374\22\0\2$\370w\370T\367wa/\245q\2642\250q\0\0\0\0\0\0\0\0:/\245q\20:\25\0P\247\25\0P\257\25\0h\257\25\0H\357\25\0V\357\25\04\355\25\0\377\377\0\0\0\0\0\04\355\25\0\7\0\0\0H\357\25\0t\354\22\0\177;\245q\0\0\0\0\0\0\0\0H\357\25\0\0\0\0\04\355\25\0\377\377\0\0\1\0\0\0\0\0\0\0@\357\25\04\355\25\0(\357\25\0\264\354\22\0}<\245q4\355\25\0\0\0\0\0H\357\25\0\365<\245q(\355\25\0\24\355\25\0\2\0\0\0\20\0\0\0\0\0\0\0\0\0\0\0\20\0\0\0\240\25\1\0\0\0\24\0\14\354\22\0\354\360\22\0\330\374\22\0\2$\370w\370T\367wa/\245q\2642\250q\0\0\0\0\0\0\0\0:/\245q\240\25\25\0(\305\25\0P\257\25\0", 1552, 0, ... {status=0x0, info=0}, 0x0, ) == 0x0
 04012   396   NtClose  (376, ... ) == 0x0
 04013   396   NtClose  (352, ... ) == 0x0
 04014   396   NtUserGetMessage  (0, 0, 0, ... {0x30062, WM_TIMER, 0x65, 0x0, 0x7dab, {512, 384}}, ) == 0x1
 04015   396   NtWaitForSingleObject  (200, 0, 0x0, ... ) == 0x0
 04016   396   NtWaitForSingleObject  (204, 0, 0x0, ... ) == 0x0
 04017   396   NtReleaseMutant  (204, ... 0x0, ) == 0x0
 04018   396   NtQueryValueKey  (108,  (108, "EnableAutodial", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (108, "EnableAutodial", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) }, 16, ) == 0x0
 04019   396   NtQueryValueKey  (108,  (108, "NoNetAutodial", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (108, "NoNetAutodial", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) }, 16, ) == 0x0
 04020   396   NtCreateKey  (0x2001d, {24, 48, 0x40, 0, 0,  (0x2001d, {24, 48, 0x40, 0, 0, "Software\Microsoft\RAS AutoDial"}, 0, 0x0, 0, ... 352, 2, ) }, 0, 0x0, 0, ... 352, 2, ) == 0x0
 04021   396   NtCreateKey  (0x20019, {24, 352, 0x40, 0, 0,  (0x20019, {24, 352, 0x40, 0, 0, "Default"}, 0, 0x0, 0, ... 376, 2, ) }, 0, 0x0, 0, ... 376, 2, ) == 0x0
 04022   396   NtClose  (352, ... ) == 0x0
 04023   396   NtQueryValueKey  (376,  (376, "DefaultInternet", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 04024   396   NtClose  (376, ... ) == 0x0
 04025   396   NtWaitForSingleObject  (156, 0, 0x0, ... ) == 0x0
 04026   396   NtQueryInformationFile  (152, 1242316, 24, Standard, ... {status=0x0, info=24}, ) == 0x0
 04027   396   NtReleaseMutant  (156, ... 0x0, ) == 0x0
 04028   396   NtWaitForSingleObject  (156, 0, 0x0, ... ) == 0x0
 04029   396   NtQueryInformationFile  (152, 1242472, 24, Standard, ... {status=0x0, info=24}, ) == 0x0
 04030   396   NtReleaseMutant  (156, ... 0x0, ) == 0x0
 04031   396   NtReleaseMutant  (200, ... 0x0, ) == 0x0
 04032   396   NtUserGetMessage  (0, 0, 0, ... {0x30062, WM_TIMER, 0x65, 0x0, 0x857b, {512, 384}}, ) == 0x1
 04033   396   NtWaitForSingleObject  (200, 0, 0x0, ... ) == 0x0
 04034   396   NtWaitForSingleObject  (204, 0, 0x0, ... ) == 0x0
 04035   396   NtOpenEvent  (0x100000, {24, 52, 0x0, 0, 0,  (0x100000, {24, 52, 0x0, 0, 0, "Global\SvcctrlStartEvent_A3752DX"}, ... 376, ) }, ... 376, ) == 0x0
 04036   396   NtWaitForSingleObject  (376, 0, {-1800000000, -1}, ... ) == 0x0
 04037   396   NtClose  (376, ... ) == 0x0
 04038   396   NtOpenThreadToken  (-2, 0xc, 1, ... ) == STATUS_NO_TOKEN
 04039   396   NtCreateEvent  (0x1f0003, 0x0, 1, 0, ... 376, ) == 0x0
 04040   396   NtOpenThreadToken  (-2, 0xc, 1, ... ) == STATUS_NO_TOKEN
 04041   396   NtSetInformationThread  (-2, ImpersonationToken, {ImpToken=0,}, 4, ... ) == 0x0
 04042   396   NtCreateFile  (0xc0100080, {24, 0, 0x40, 0, 1240896,  (0xc0100080, {24, 0, 0x40, 0, 1240896, "\??\PIPE\svcctl"}, 0x0, 0, 3, 1, 4194368, 0, 0, ... 352, {status=0x0, info=1}, ) }, 0x0, 0, 3, 1, 4194368, 0, 0, ... 352, {status=0x0, info=1}, ) == 0x0
 04043   396   NtSetInformationFile  (352, 1240952, 8, Pipe, ... {status=0x0, info=0}, ) == 0x0
 04044   396   NtSetInformationFile  (352, 1240944, 8, Completion, ... {status=0x0, info=0}, ) == 0x0
 04045   396   NtSetInformationThread  (-2, ImpersonationToken, {ImpToken=0,}, 4, ... ) == 0x0
 04046   396   NtWriteFile  (352, 297, 0, 0,  (352, 297, 0, 0, "\5\0\13\3\20\0\0\0H\0\0\0\1\0\0\0\270\20\270\20\0\0\0\0\1\0\0\0\0\0\1\0\201\273z6D\230\3615\2552\230\3608\0\20\3\2\0\0\0\4]\210\212\353\34\311\21\237\350\10\0+\20H`\2\0\0\0", 72, {0, 0}, 0, ... {status=0x0, info=72}, ) , 72, {0, 0}, 0, ... {status=0x0, info=72}, ) == 0x0
 04047   396   NtReadFile  (352, 297, 0, 0, 1024, {0, 0}, 0, ... {status=0x0, info=68},  (352, 297, 0, 0, 1024, {0, 0}, 0, ... {status=0x0, info=68}, "\5\0\14\3\20\0\0\0D\0\0\0\1\0\0\0\270\20\270\20)'\0\0\15\0\PIPE\ntsvcs\0\0\1\0\0\0\0\0\0\0\4]\210\212\353\34\311\21\237\350\10\0+\20H`\2\0\0\0", ) , ) == 0x0
 04048   396   NtFsControlFile  (352, 297, 0x0, 0x0, 0x11c017,  (352, 297, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0$\0\0\0\1\0\0\0\14\0\0\0\0\0\17\0\0\0\0\0\0\0\0\0\0\0\0\200", 36, 1024, ... {status=0x103, info=68}, "\5\0\14\3\20\0\0\0D\0\0\0\1\0\0\0\270\20\270\20)'\0\0\15\0\PIPE\ntsvcs\0\0\1\0\0\0\0\0\0\0\4]\210\212\353\34\311\21\237\350\10\0+\20H`\2\0\0\0", ) , 36, 1024, ... {status=0x103, info=68},  (352, 297, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0$\0\0\0\1\0\0\0\14\0\0\0\0\0\17\0\0\0\0\0\0\0\0\0\0\0\0\200", 36, 1024, ... {status=0x103, info=68}, "\5\0\14\3\20\0\0\0D\0\0\0\1\0\0\0\270\20\270\20)'\0\0\15\0\PIPE\ntsvcs\0\0\1\0\0\0\0\0\0\0\4]\210\212\353\34\311\21\237\350\10\0+\20H`\2\0\0\0", ) , ) == 0x103
 04049   396   NtFsControlFile  (352, 297, 0x0, 0x0, 0x11c017,  (352, 297, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0L\0\0\0\2\0\0\04\0\0\0\0\0\20\0\0\0\0\0\\234\257\317\333?\334\21\261\310\0\14)\371\246\305\7\0\0\0\0\0\0\0\7\0\0\0R\0A\0S\0M\0A\0N\0\0\0\0\0\4\0\0\0", 76, 1024, ... {status=0x103, info=48}, "\5\0\2\3\20\0\0\00\0\0\0\1\0\0\0\30\0\0\0\0\0\0\0\0\0\0\0\\234\257\317\333?\334\21\261\310\0\14)\371\246\305\0\0\0\0", ) , 76, 1024, ... {status=0x103, info=48},  (352, 297, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0L\0\0\0\2\0\0\04\0\0\0\0\0\20\0\0\0\0\0\\234\257\317\333?\334\21\261\310\0\14)\371\246\305\7\0\0\0\0\0\0\0\7\0\0\0R\0A\0S\0M\0A\0N\0\0\0\0\0\4\0\0\0", 76, 1024, ... {status=0x103, info=48}, "\5\0\2\3\20\0\0\00\0\0\0\1\0\0\0\30\0\0\0\0\0\0\0\0\0\0\0\\234\257\317\333?\334\21\261\310\0\14)\371\246\305\0\0\0\0", ) , ) == 0x103
 04050   396   NtFsControlFile  (352, 297, 0x0, 0x0, 0x11c017,  (352, 297, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0,\0\0\0\3\0\0\0\24\0\0\0\0\0\6\0\0\0\0\0]\234\257\317\333?\334\21\261\310\0\14)\371\246\305", 44, 1024, ... {status=0x103, info=48}, "\5\0\2\3\20\0\0\00\0\0\0\2\0\0\0\30\0\0\0\0\0\0\0\0\0\0\0]\234\257\317\333?\334\21\261\310\0\14)\371\246\305\0\0\0\0", ) , 44, 1024, ... {status=0x103, info=48},  (352, 297, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0,\0\0\0\3\0\0\0\24\0\0\0\0\0\6\0\0\0\0\0]\234\257\317\333?\334\21\261\310\0\14)\371\246\305", 44, 1024, ... {status=0x103, info=48}, "\5\0\2\3\20\0\0\00\0\0\0\2\0\0\0\30\0\0\0\0\0\0\0\0\0\0\0]\234\257\317\333?\334\21\261\310\0\14)\371\246\305\0\0\0\0", ) , ) == 0x103
 04051   396   NtFsControlFile  (352, 297, 0x0, 0x0, 0x11c017,  (352, 297, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0,\0\0\0\4\0\0\0\24\0\0\0\0\0\0\0\0\0\0\0]\234\257\317\333?\334\21\261\310\0\14)\371\246\305", 44, 1024, ... {status=0x103, info=56}, "\5\0\2\3\20\0\0\08\0\0\0\3\0\0\0 \0\0\0\0\0\0\0 \0\0\0\1\0\0\0\0\0\0\05\4\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0", ) , 44, 1024, ... {status=0x103, info=56},  (352, 297, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0,\0\0\0\4\0\0\0\24\0\0\0\0\0\0\0\0\0\0\0]\234\257\317\333?\334\21\261\310\0\14)\371\246\305", 44, 1024, ... {status=0x103, info=56}, "\5\0\2\3\20\0\0\08\0\0\0\3\0\0\0 \0\0\0\0\0\0\0 \0\0\0\1\0\0\0\0\0\0\05\4\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0", ) , ) == 0x103
 04052   396   NtFsControlFile  (352, 297, 0x0, 0x0, 0x11c017,  (352, 297, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0,\0\0\0\5\0\0\0\24\0\0\0\0\0\0\0\0\0\0\0\\234\257\317\333?\334\21\261\310\0\14)\371\246\305", 44, 1024, ... {status=0x103, info=48}, "\5\0\2\3\20\0\0\00\0\0\0\4\0\0\0\30\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0", ) , 44, 1024, ... {status=0x103, info=48},  (352, 297, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0,\0\0\0\5\0\0\0\24\0\0\0\0\0\0\0\0\0\0\0\\234\257\317\333?\334\21\261\310\0\14)\371\246\305", 44, 1024, ... {status=0x103, info=48}, "\5\0\2\3\20\0\0\00\0\0\0\4\0\0\0\30\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0", ) , ) == 0x103
 04053   396   NtClose  (376, ... ) == 0x0
 04054   396   NtClose  (352, ... ) == 0x0
 04055   396   NtReleaseMutant  (204, ... 0x0, ) == 0x0
 04056   396   NtQueryValueKey  (108,  (108, "EnableAutodial", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (108, "EnableAutodial", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) }, 16, ) == 0x0
 04057   396   NtQueryValueKey  (108,  (108, "NoNetAutodial", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (108, "NoNetAutodial", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) }, 16, ) == 0x0
 04058   396   NtCreateKey  (0x2001d, {24, 48, 0x40, 0, 0,  (0x2001d, {24, 48, 0x40, 0, 0, "Software\Microsoft\RAS AutoDial"}, 0, 0x0, 0, ... 352, 2, ) }, 0, 0x0, 0, ... 352, 2, ) == 0x0
 04059   396   NtCreateKey  (0x20019, {24, 352, 0x40, 0, 0,  (0x20019, {24, 352, 0x40, 0, 0, "Default"}, 0, 0x0, 0, ... 376, 2, ) }, 0, 0x0, 0, ... 376, 2, ) == 0x0
 04060   396   NtClose  (352, ... ) == 0x0
 04061   396   NtQueryValueKey  (376,  (376, "DefaultInternet", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 04062   396   NtClose  (376, ... ) == 0x0
 04063   396   NtWaitForSingleObject  (156, 0, 0x0, ... ) == 0x0
 04064   396   NtQueryInformationFile  (152, 1242316, 24, Standard, ... {status=0x0, info=24}, ) == 0x0
 04065   396   NtReleaseMutant  (156, ... 0x0, ) == 0x0
 04066   396   NtWaitForSingleObject  (156, 0, 0x0, ... ) == 0x0
 04067   396   NtQueryInformationFile  (152, 1242472, 24, Standard, ... {status=0x0, info=24}, ) == 0x0
 04068   396   NtReleaseMutant  (156, ... 0x0, ) == 0x0
 04069   396   NtReleaseMutant  (200, ... 0x0, ) == 0x0
 04070   396   NtUserGetMessage  (0, 0, 0, ... {0x30062, WM_TIMER, 0x65, 0x0, 0x8d4b, {512, 384}}, ) == 0x1
 04071   396   NtWaitForSingleObject  (200, 0, 0x0, ... ) == 0x0
 04072   396   NtWaitForSingleObject  (204, 0, 0x0, ... ) == 0x0
 04073   396   NtReleaseMutant  (204, ... 0x0, ) == 0x0
 04074   396   NtQueryValueKey  (108,  (108, "EnableAutodial", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (108, "EnableAutodial", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) }, 16, ) == 0x0
 04075   396   NtQueryValueKey  (108,  (108, "NoNetAutodial", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (108, "NoNetAutodial", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) }, 16, ) == 0x0
 04076   396   NtCreateKey  (0x2001d, {24, 48, 0x40, 0, 0,  (0x2001d, {24, 48, 0x40, 0, 0, "Software\Microsoft\RAS AutoDial"}, 0, 0x0, 0, ... 376, 2, ) }, 0, 0x0, 0, ... 376, 2, ) == 0x0
 04077   396   NtCreateKey  (0x20019, {24, 376, 0x40, 0, 0,  (0x20019, {24, 376, 0x40, 0, 0, "Default"}, 0, 0x0, 0, ... 352, 2, ) }, 0, 0x0, 0, ... 352, 2, ) == 0x0
 04078   396   NtClose  (376, ... ) == 0x0
 04079   396   NtQueryValueKey  (352,  (352, "DefaultInternet", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 04080   396   NtClose  (352, ... ) == 0x0
 04081   396   NtWaitForSingleObject  (156, 0, 0x0, ... ) == 0x0
 04082   396   NtQueryInformationFile  (152, 1242316, 24, Standard, ... {status=0x0, info=24}, ) == 0x0
 04083   396   NtReleaseMutant  (156, ... 0x0, ) == 0x0
 04084   396   NtWaitForSingleObject  (156, 0, 0x0, ... ) == 0x0
 04085   396   NtQueryInformationFile  (152, 1242472, 24, Standard, ... {status=0x0, info=24}, ) == 0x0
 04086   396   NtReleaseMutant  (156, ... 0x0, ) == 0x0
 04087   396   NtReleaseMutant  (200, ... 0x0, ) == 0x0
 04088   396   NtUserGetMessage  (0, 0, 0, ... {0x30062, WM_TIMER, 0x65, 0x0, 0x951b, {512, 384}}, ) == 0x1
 04089   396   NtWaitForSingleObject  (200, 0, 0x0, ... ) == 0x0
 04090   396   NtWaitForSingleObject  (204, 0, 0x0, ... ) == 0x0
 04091   396   NtOpenEvent  (0x100000, {24, 52, 0x0, 0, 0,  (0x100000, {24, 52, 0x0, 0, 0, "Global\SvcctrlStartEvent_A3752DX"}, ... 352, ) }, ... 352, ) == 0x0
 04092   396   NtWaitForSingleObject  (352, 0, {-1800000000, -1}, ... ) == 0x0
 04093   396   NtClose  (352, ... ) == 0x0
 04094   396   NtOpenThreadToken  (-2, 0xc, 1, ... ) == STATUS_NO_TOKEN
 04095   396   NtCreateEvent  (0x1f0003, 0x0, 1, 0, ... 352, ) == 0x0
 04096   396   NtOpenThreadToken  (-2, 0xc, 1, ... ) == STATUS_NO_TOKEN
 04097   396   NtSetInformationThread  (-2, ImpersonationToken, {ImpToken=0,}, 4, ... ) == 0x0
 04098   396   NtCreateFile  (0xc0100080, {24, 0, 0x40, 0, 1240896,  (0xc0100080, {24, 0, 0x40, 0, 1240896, "\??\PIPE\svcctl"}, 0x0, 0, 3, 1, 4194368, 0, 0, ... 376, {status=0x0, info=1}, ) }, 0x0, 0, 3, 1, 4194368, 0, 0, ... 376, {status=0x0, info=1}, ) == 0x0
 04099   396   NtSetInformationFile  (376, 1240952, 8, Pipe, ... {status=0x0, info=0}, ) == 0x0
 04100   396   NtSetInformationFile  (376, 1240944, 8, Completion, ... {status=0x0, info=0}, ) == 0x0
 04101   396   NtSetInformationThread  (-2, ImpersonationToken, {ImpToken=0,}, 4, ... ) == 0x0
 04102   396   NtWriteFile  (376, 297, 0, 0,  (376, 297, 0, 0, "\5\0\13\3\20\0\0\0H\0\0\0\1\0\0\0\270\20\270\20\0\0\0\0\1\0\0\0\0\0\1\0\201\273z6D\230\3615\2552\230\3608\0\20\3\2\0\0\0\4]\210\212\353\34\311\21\237\350\10\0+\20H`\2\0\0\0", 72, {0, 0}, 0, ... {status=0x0, info=72}, ) , 72, {0, 0}, 0, ... {status=0x0, info=72}, ) == 0x0
 04103   396   NtReadFile  (376, 297, 0, 0, 1024, {0, 0}, 0, ... {status=0x0, info=68},  (376, 297, 0, 0, 1024, {0, 0}, 0, ... {status=0x0, info=68}, "\5\0\14\3\20\0\0\0D\0\0\0\1\0\0\0\270\20\270\20+'\0\0\15\0\PIPE\ntsvcs\0\0\1\0\0\0\0\0\0\0\4]\210\212\353\34\311\21\237\350\10\0+\20H`\2\0\0\0", ) , ) == 0x0
 04104   396   NtFsControlFile  (376, 297, 0x0, 0x0, 0x11c017,  (376, 297, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0$\0\0\0\1\0\0\0\14\0\0\0\0\0\17\0\0\0\0\0\0\0\0\0\0\0\0\200", 36, 1024, ... {status=0x103, info=68}, "\5\0\14\3\20\0\0\0D\0\0\0\1\0\0\0\270\20\270\20+'\0\0\15\0\PIPE\ntsvcs\0\0\1\0\0\0\0\0\0\0\4]\210\212\353\34\311\21\237\350\10\0+\20H`\2\0\0\0", ) , 36, 1024, ... {status=0x103, info=68},  (376, 297, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0$\0\0\0\1\0\0\0\14\0\0\0\0\0\17\0\0\0\0\0\0\0\0\0\0\0\0\200", 36, 1024, ... {status=0x103, info=68}, "\5\0\14\3\20\0\0\0D\0\0\0\1\0\0\0\270\20\270\20+'\0\0\15\0\PIPE\ntsvcs\0\0\1\0\0\0\0\0\0\0\4]\210\212\353\34\311\21\237\350\10\0+\20H`\2\0\0\0", ) , ) == 0x103
 04105   396   NtFsControlFile  (376, 297, 0x0, 0x0, 0x11c017,  (376, 297, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0L\0\0\0\2\0\0\04\0\0\0\0\0\20\0\0\0\0\0`\234\257\317\333?\334\21\261\310\0\14)\371\246\305\7\0\0\0\0\0\0\0\7\0\0\0R\0A\0S\0M\0A\0N\0\0\0\0\0\4\0\0\0", 76, 1024, ... {status=0x103, info=48}, "\5\0\2\3\20\0\0\00\0\0\0\1\0\0\0\30\0\0\0\0\0\0\0\0\0\0\0`\234\257\317\333?\334\21\261\310\0\14)\371\246\305\0\0\0\0", ) , 76, 1024, ... {status=0x103, info=48},  (376, 297, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0L\0\0\0\2\0\0\04\0\0\0\0\0\20\0\0\0\0\0`\234\257\317\333?\334\21\261\310\0\14)\371\246\305\7\0\0\0\0\0\0\0\7\0\0\0R\0A\0S\0M\0A\0N\0\0\0\0\0\4\0\0\0", 76, 1024, ... {status=0x103, info=48}, "\5\0\2\3\20\0\0\00\0\0\0\1\0\0\0\30\0\0\0\0\0\0\0\0\0\0\0`\234\257\317\333?\334\21\261\310\0\14)\371\246\305\0\0\0\0", ) , ) == 0x103
 04106   396   NtFsControlFile  (376, 297, 0x0, 0x0, 0x11c017,  (376, 297, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0,\0\0\0\3\0\0\0\24\0\0\0\0\0\6\0\0\0\0\0a\234\257\317\333?\334\21\261\310\0\14)\371\246\305", 44, 1024, ... {status=0x103, info=48}, "\5\0\2\3\20\0\0\00\0\0\0\2\0\0\0\30\0\0\0\0\0\0\0\0\0\0\0a\234\257\317\333?\334\21\261\310\0\14)\371\246\305\0\0\0\0", ) , 44, 1024, ... {status=0x103, info=48},  (376, 297, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0,\0\0\0\3\0\0\0\24\0\0\0\0\0\6\0\0\0\0\0a\234\257\317\333?\334\21\261\310\0\14)\371\246\305", 44, 1024, ... {status=0x103, info=48}, "\5\0\2\3\20\0\0\00\0\0\0\2\0\0\0\30\0\0\0\0\0\0\0\0\0\0\0a\234\257\317\333?\334\21\261\310\0\14)\371\246\305\0\0\0\0", ) , ) == 0x103
 04107   396   NtFsControlFile  (376, 297, 0x0, 0x0, 0x11c017,  (376, 297, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0,\0\0\0\4\0\0\0\24\0\0\0\0\0\0\0\0\0\0\0a\234\257\317\333?\334\21\261\310\0\14)\371\246\305", 44, 1024, ... {status=0x103, info=56}, "\5\0\2\3\20\0\0\08\0\0\0\3\0\0\0 \0\0\0\0\0\0\0 \0\0\0\1\0\0\0\0\0\0\05\4\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0", ) , 44, 1024, ... {status=0x103, info=56},  (376, 297, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0,\0\0\0\4\0\0\0\24\0\0\0\0\0\0\0\0\0\0\0a\234\257\317\333?\334\21\261\310\0\14)\371\246\305", 44, 1024, ... {status=0x103, info=56}, "\5\0\2\3\20\0\0\08\0\0\0\3\0\0\0 \0\0\0\0\0\0\0 \0\0\0\1\0\0\0\0\0\0\05\4\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0", ) , ) == 0x103
 04108   396   NtFsControlFile  (376, 297, 0x0, 0x0, 0x11c017,  (376, 297, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0,\0\0\0\5\0\0\0\24\0\0\0\0\0\0\0\0\0\0\0`\234\257\317\333?\334\21\261\310\0\14)\371\246\305", 44, 1024, ... {status=0x103, info=48}, "\5\0\2\3\20\0\0\00\0\0\0\4\0\0\0\30\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0", ) , 44, 1024, ... {status=0x103, info=48},  (376, 297, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0,\0\0\0\5\0\0\0\24\0\0\0\0\0\0\0\0\0\0\0`\234\257\317\333?\334\21\261\310\0\14)\371\246\305", 44, 1024, ... {status=0x103, info=48}, "\5\0\2\3\20\0\0\00\0\0\0\4\0\0\0\30\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0", ) , ) == 0x103
 04109   396   NtClose  (352, ... ) == 0x0
 04110   396   NtClose  (376, ... ) == 0x0
 04111   396   NtReleaseMutant  (204, ... 0x0, ) == 0x0
 04112   396   NtQueryValueKey  (108,  (108, "EnableAutodial", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (108, "EnableAutodial", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) }, 16, ) == 0x0
 04113   396   NtQueryValueKey  (108,  (108, "NoNetAutodial", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (108, "NoNetAutodial", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) }, 16, ) == 0x0
 04114   396   NtCreateKey  (0x2001d, {24, 48, 0x40, 0, 0,  (0x2001d, {24, 48, 0x40, 0, 0, "Software\Microsoft\RAS AutoDial"}, 0, 0x0, 0, ... 376, 2, ) }, 0, 0x0, 0, ... 376, 2, ) == 0x0
 04115   396   NtCreateKey  (0x20019, {24, 376, 0x40, 0, 0,  (0x20019, {24, 376, 0x40, 0, 0, "Default"}, 0, 0x0, 0, ... 352, 2, ) }, 0, 0x0, 0, ... 352, 2, ) == 0x0
 04116   396   NtClose  (376, ... ) == 0x0
 04117   396   NtQueryValueKey  (352,  (352, "DefaultInternet", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 04118   396   NtClose  (352, ... ) == 0x0
 04119   396   NtWaitForSingleObject  (156, 0, 0x0, ... ) == 0x0
 04120   396   NtQueryInformationFile  (152, 1242316, 24, Standard, ... {status=0x0, info=24}, ) == 0x0
 04121   396   NtReleaseMutant  (156, ... 0x0, ) == 0x0
 04122   396   NtWaitForSingleObject  (156, 0, 0x0, ... ) == 0x0
 04123   396   NtQueryInformationFile  (152, 1242472, 24, Standard, ... {status=0x0, info=24}, ) == 0x0
 04124   396   NtReleaseMutant  (156, ... 0x0, ) == 0x0
 04125   396   NtReleaseMutant  (200, ... 0x0, ) == 0x0
 04126   396   NtUserGetMessage  (0, 0, 0, ... {0x30062, WM_TIMER, 0x65, 0x0, 0x9ceb, {512, 384}}, ) == 0x1
 04127   396   NtWaitForSingleObject  (200, 0, 0x0, ... ) == 0x0
 04128   396   NtWaitForSingleObject  (204, 0, 0x0, ... ) == 0x0
 04129   396   NtReleaseMutant  (204, ... 0x0, ) == 0x0
 04130   396   NtQueryValueKey  (108,  (108, "EnableAutodial", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (108, "EnableAutodial", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) }, 16, ) == 0x0
 04131   396   NtQueryValueKey  (108,  (108, "NoNetAutodial", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (108, "NoNetAutodial", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) }, 16, ) == 0x0
 04132   396   NtCreateKey  (0x2001d, {24, 48, 0x40, 0, 0,  (0x2001d, {24, 48, 0x40, 0, 0, "Software\Microsoft\RAS AutoDial"}, 0, 0x0, 0, ... 352, 2, ) }, 0, 0x0, 0, ... 352, 2, ) == 0x0
 04133   396   NtCreateKey  (0x20019, {24, 352, 0x40, 0, 0,  (0x20019, {24, 352, 0x40, 0, 0, "Default"}, 0, 0x0, 0, ... 376, 2, ) }, 0, 0x0, 0, ... 376, 2, ) == 0x0
 04134   396   NtClose  (352, ... ) == 0x0
 04135   396   NtQueryValueKey  (376,  (376, "DefaultInternet", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 04136   396   NtClose  (376, ... ) == 0x0
 04137   396   NtWaitForSingleObject  (156, 0, 0x0, ... ) == 0x0
 04138   396   NtQueryInformationFile  (152, 1242316, 24, Standard, ... {status=0x0, info=24}, ) == 0x0
 04139   396   NtReleaseMutant  (156, ... 0x0, ) == 0x0
 04140   396   NtWaitForSingleObject  (156, 0, 0x0, ... ) == 0x0
 04141   396   NtQueryInformationFile  (152, 1242472, 24, Standard, ... {status=0x0, info=24}, ) == 0x0
 04142   396   NtReleaseMutant  (156, ... 0x0, ) == 0x0
 04143   396   NtReleaseMutant  (200, ... 0x0, ) == 0x0
 04144   396   NtUserGetMessage  (0, 0, 0, ... {0x30062, WM_TIMER, 0x65, 0x0, 0xa4bb, {512, 384}}, ) == 0x1
 04145   396   NtWaitForSingleObject  (200, 0, 0x0, ... ) == 0x0
 04146   396   NtWaitForSingleObject  (204, 0, 0x0, ... ) == 0x0
 04147   396   NtOpenEvent  (0x100000, {24, 52, 0x0, 0, 0,  (0x100000, {24, 52, 0x0, 0, 0, "Global\SvcctrlStartEvent_A3752DX"}, ... 376, ) }, ... 376, ) == 0x0
 04148   396   NtWaitForSingleObject  (376, 0, {-1800000000, -1}, ... ) == 0x0
 04149   396   NtClose  (376, ... ) == 0x0
 04150   396   NtOpenThreadToken  (-2, 0xc, 1, ... ) == STATUS_NO_TOKEN
 04151   396   NtCreateEvent  (0x1f0003, 0x0, 1, 0, ... 376, ) == 0x0
 04152   396   NtOpenThreadToken  (-2, 0xc, 1, ... ) == STATUS_NO_TOKEN
 04153   396   NtSetInformationThread  (-2, ImpersonationToken, {ImpToken=0,}, 4, ... ) == 0x0
 04154   396   NtCreateFile  (0xc0100080, {24, 0, 0x40, 0, 1240896,  (0xc0100080, {24, 0, 0x40, 0, 1240896, "\??\PIPE\svcctl"}, 0x0, 0, 3, 1, 4194368, 0, 0, ... 352, {status=0x0, info=1}, ) }, 0x0, 0, 3, 1, 4194368, 0, 0, ... 352, {status=0x0, info=1}, ) == 0x0
 04155   396   NtSetInformationFile  (352, 1240952, 8, Pipe, ... {status=0x0, info=0}, ) == 0x0
 04156   396   NtSetInformationFile  (352, 1240944, 8, Completion, ... {status=0x0, info=0}, ) == 0x0
 04157   396   NtSetInformationThread  (-2, ImpersonationToken, {ImpToken=0,}, 4, ... ) == 0x0
 04158   396   NtWriteFile  (352, 297, 0, 0,  (352, 297, 0, 0, "\5\0\13\3\20\0\0\0H\0\0\0\1\0\0\0\270\20\270\20\0\0\0\0\1\0\0\0\0\0\1\0\201\273z6D\230\3615\2552\230\3608\0\20\3\2\0\0\0\4]\210\212\353\34\311\21\237\350\10\0+\20H`\2\0\0\0", 72, {0, 0}, 0, ... {status=0x0, info=72}, ) , 72, {0, 0}, 0, ... {status=0x0, info=72}, ) == 0x0
 04159   396   NtReadFile  (352, 297, 0, 0, 1024, {0, 0}, 0, ... {status=0x0, info=68},  (352, 297, 0, 0, 1024, {0, 0}, 0, ... {status=0x0, info=68}, "\5\0\14\3\20\0\0\0D\0\0\0\1\0\0\0\270\20\270\20-'\0\0\15\0\PIPE\ntsvcs\0\0\1\0\0\0\0\0\0\0\4]\210\212\353\34\311\21\237\350\10\0+\20H`\2\0\0\0", ) , ) == 0x0
 04160   396   NtFsControlFile  (352, 297, 0x0, 0x0, 0x11c017,  (352, 297, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0$\0\0\0\1\0\0\0\14\0\0\0\0\0\17\0\0\0\0\0\0\0\0\0\0\0\0\200", 36, 1024, ... {status=0x103, info=68}, "\5\0\14\3\20\0\0\0D\0\0\0\1\0\0\0\270\20\270\20-'\0\0\15\0\PIPE\ntsvcs\0\0\1\0\0\0\0\0\0\0\4]\210\212\353\34\311\21\237\350\10\0+\20H`\2\0\0\0", ) , 36, 1024, ... {status=0x103, info=68},  (352, 297, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0$\0\0\0\1\0\0\0\14\0\0\0\0\0\17\0\0\0\0\0\0\0\0\0\0\0\0\200", 36, 1024, ... {status=0x103, info=68}, "\5\0\14\3\20\0\0\0D\0\0\0\1\0\0\0\270\20\270\20-'\0\0\15\0\PIPE\ntsvcs\0\0\1\0\0\0\0\0\0\0\4]\210\212\353\34\311\21\237\350\10\0+\20H`\2\0\0\0", ) , ) == 0x103
 04161   396   NtFsControlFile  (352, 297, 0x0, 0x0, 0x11c017,  (352, 297, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0L\0\0\0\2\0\0\04\0\0\0\0\0\20\0\0\0\0\0\212\17\233\326\333?\334\21\261\310\0\14)\371\246\305\7\0\0\0\0\0\0\0\7\0\0\0R\0A\0S\0M\0A\0N\0\0\0\0\0\4\0\0\0", 76, 1024, ... {status=0x103, info=48}, "\5\0\2\3\20\0\0\00\0\0\0\1\0\0\0\30\0\0\0\0\0\0\0\0\0\0\0\212\17\233\326\333?\334\21\261\310\0\14)\371\246\305\0\0\0\0", ) , 76, 1024, ... {status=0x103, info=48},  (352, 297, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0L\0\0\0\2\0\0\04\0\0\0\0\0\20\0\0\0\0\0\212\17\233\326\333?\334\21\261\310\0\14)\371\246\305\7\0\0\0\0\0\0\0\7\0\0\0R\0A\0S\0M\0A\0N\0\0\0\0\0\4\0\0\0", 76, 1024, ... {status=0x103, info=48}, "\5\0\2\3\20\0\0\00\0\0\0\1\0\0\0\30\0\0\0\0\0\0\0\0\0\0\0\212\17\233\326\333?\334\21\261\310\0\14)\371\246\305\0\0\0\0", ) , ) == 0x103
 04162   396   NtFsControlFile  (352, 297, 0x0, 0x0, 0x11c017,  (352, 297, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0,\0\0\0\3\0\0\0\24\0\0\0\0\0\6\0\0\0\0\0\213\17\233\326\333?\334\21\261\310\0\14)\371\246\305", 44, 1024, ... {status=0x103, info=48}, "\5\0\2\3\20\0\0\00\0\0\0\2\0\0\0\30\0\0\0\0\0\0\0\0\0\0\0\213\17\233\326\333?\334\21\261\310\0\14)\371\246\305\0\0\0\0", ) , 44, 1024, ... {status=0x103, info=48},  (352, 297, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0,\0\0\0\3\0\0\0\24\0\0\0\0\0\6\0\0\0\0\0\213\17\233\326\333?\334\21\261\310\0\14)\371\246\305", 44, 1024, ... {status=0x103, info=48}, "\5\0\2\3\20\0\0\00\0\0\0\2\0\0\0\30\0\0\0\0\0\0\0\0\0\0\0\213\17\233\326\333?\334\21\261\310\0\14)\371\246\305\0\0\0\0", ) , ) == 0x103
 04163   396   NtFsControlFile  (352, 297, 0x0, 0x0, 0x11c017,  (352, 297, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0,\0\0\0\4\0\0\0\24\0\0\0\0\0\0\0\0\0\0\0\213\17\233\326\333?\334\21\261\310\0\14)\371\246\305", 44, 1024, ... {status=0x103, info=56}, "\5\0\2\3\20\0\0\08\0\0\0\3\0\0\0 \0\0\0\0\0\0\0 \0\0\0\1\0\0\0\0\0\0\05\4\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0", ) , 44, 1024, ... {status=0x103, info=56},  (352, 297, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0,\0\0\0\4\0\0\0\24\0\0\0\0\0\0\0\0\0\0\0\213\17\233\326\333?\334\21\261\310\0\14)\371\246\305", 44, 1024, ... {status=0x103, info=56}, "\5\0\2\3\20\0\0\08\0\0\0\3\0\0\0 \0\0\0\0\0\0\0 \0\0\0\1\0\0\0\0\0\0\05\4\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0", ) , ) == 0x103
 04164   396   NtFsControlFile  (352, 297, 0x0, 0x0, 0x11c017,  (352, 297, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0,\0\0\0\5\0\0\0\24\0\0\0\0\0\0\0\0\0\0\0\212\17\233\326\333?\334\21\261\310\0\14)\371\246\305", 44, 1024, ... {status=0x103, info=48}, "\5\0\2\3\20\0\0\00\0\0\0\4\0\0\0\30\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0", ) , 44, 1024, ... {status=0x103, info=48},  (352, 297, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0,\0\0\0\5\0\0\0\24\0\0\0\0\0\0\0\0\0\0\0\212\17\233\326\333?\334\21\261\310\0\14)\371\246\305", 44, 1024, ... {status=0x103, info=48}, "\5\0\2\3\20\0\0\00\0\0\0\4\0\0\0\30\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0", ) , ) == 0x103
 04165   396   NtClose  (376, ... ) == 0x0
 04166   396   NtClose  (352, ... ) == 0x0
 04167   396   NtReleaseMutant  (204, ... 0x0, ) == 0x0
 04168   396   NtQueryValueKey  (108,  (108, "EnableAutodial", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (108, "EnableAutodial", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) }, 16, ) == 0x0
 04169   396   NtQueryValueKey  (108,  (108, "NoNetAutodial", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (108, "NoNetAutodial", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) }, 16, ) == 0x0
 04170   396   NtCreateKey  (0x2001d, {24, 48, 0x40, 0, 0,  (0x2001d, {24, 48, 0x40, 0, 0, "Software\Microsoft\RAS AutoDial"}, 0, 0x0, 0, ... 352, 2, ) }, 0, 0x0, 0, ... 352, 2, ) == 0x0
 04171   396   NtCreateKey  (0x20019, {24, 352, 0x40, 0, 0,  (0x20019, {24, 352, 0x40, 0, 0, "Default"}, 0, 0x0, 0, ... 376, 2, ) }, 0, 0x0, 0, ... 376, 2, ) == 0x0
 04172   396   NtClose  (352, ... ) == 0x0
 04173   396   NtQueryValueKey  (376,  (376, "DefaultInternet", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 04174   396   NtClose  (376, ... ) == 0x0
 04175   396   NtWaitForSingleObject  (156, 0, 0x0, ... ) == 0x0
 04176   396   NtQueryInformationFile  (152, 1242316, 24, Standard, ... {status=0x0, info=24}, ) == 0x0
 04177   396   NtReleaseMutant  (156, ... 0x0, ) == 0x0
 04178   396   NtWaitForSingleObject  (156, 0, 0x0, ... ) == 0x0
 04179   396   NtQueryInformationFile  (152, 1242472, 24, Standard, ... {status=0x0, info=24}, ) == 0x0
 04180   396   NtReleaseMutant  (156, ... 0x0, ) == 0x0
 04181   396   NtReleaseMutant  (200, ... 0x0, ) == 0x0
 04182   396   NtUserGetMessage  (0, 0, 0, ... {0x30062, WM_TIMER, 0x65, 0x0, 0xac8b, {512, 384}}, ) == 0x1
 04183   396   NtWaitForSingleObject  (200, 0, 0x0, ... ) == 0x0
 04184   396   NtWaitForSingleObject  (204, 0, 0x0, ... ) == 0x0
 04185   396   NtReleaseMutant  (204, ... 0x0, ) == 0x0
 04186   396   NtQueryValueKey  (108,  (108, "EnableAutodial", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (108, "EnableAutodial", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) }, 16, ) == 0x0
 04187   396   NtQueryValueKey  (108,  (108, "NoNetAutodial", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (108, "NoNetAutodial", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) }, 16, ) == 0x0
 04188   396   NtCreateKey  (0x2001d, {24, 48, 0x40, 0, 0,  (0x2001d, {24, 48, 0x40, 0, 0, "Software\Microsoft\RAS AutoDial"}, 0, 0x0, 0, ... 376, 2, ) }, 0, 0x0, 0, ... 376, 2, ) == 0x0
 04189   396   NtCreateKey  (0x20019, {24, 376, 0x40, 0, 0,  (0x20019, {24, 376, 0x40, 0, 0, "Default"}, 0, 0x0, 0, ... 352, 2, ) }, 0, 0x0, 0, ... 352, 2, ) == 0x0
 04190   396   NtClose  (376, ... ) == 0x0
 04191   396   NtQueryValueKey  (352,  (352, "DefaultInternet", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 04192   396   NtClose  (352, ... ) == 0x0
 04193   396   NtWaitForSingleObject  (156, 0, 0x0, ... ) == 0x0
 04194   396   NtQueryInformationFile  (152, 1242316, 24, Standard, ... {status=0x0, info=24}, ) == 0x0
 04195   396   NtReleaseMutant  (156, ... 0x0, ) == 0x0
 04196   396   NtWaitForSingleObject  (156, 0, 0x0, ... ) == 0x0
 04197   396   NtQueryInformationFile  (152, 1242472, 24, Standard, ... {status=0x0, info=24}, ) == 0x0
 04198   396   NtReleaseMutant  (156, ... 0x0, ) == 0x0
 04199   396   NtReleaseMutant  (200, ... 0x0, ) == 0x0
 04200   396   NtUserGetMessage  (0, 0, 0, ... {0x30062, WM_TIMER, 0x65, 0x0, 0xb45b, {512, 384}}, ) == 0x1
 04201   396   NtWaitForSingleObject  (200, 0, 0x0, ... ) == 0x0
 04202   396   NtWaitForSingleObject  (204, 0, 0x0, ... ) == 0x0
 04203   396   NtOpenEvent  (0x100000, {24, 52, 0x0, 0, 0,  (0x100000, {24, 52, 0x0, 0, 0, "Global\SvcctrlStartEvent_A3752DX"}, ... 352, ) }, ... 352, ) == 0x0
 04204   396   NtWaitForSingleObject  (352, 0, {-1800000000, -1}, ... ) == 0x0
 04205   396   NtClose  (352, ... ) == 0x0
 04206   396   NtOpenThreadToken  (-2, 0xc, 1, ... ) == STATUS_NO_TOKEN
 04207   396   NtCreateEvent  (0x1f0003, 0x0, 1, 0, ... 352, ) == 0x0
 04208   396   NtOpenThreadToken  (-2, 0xc, 1, ... ) == STATUS_NO_TOKEN
 04209   396   NtSetInformationThread  (-2, ImpersonationToken, {ImpToken=0,}, 4, ... ) == 0x0
 04210   396   NtCreateFile  (0xc0100080, {24, 0, 0x40, 0, 1240896,  (0xc0100080, {24, 0, 0x40, 0, 1240896, "\??\PIPE\svcctl"}, 0x0, 0, 3, 1, 4194368, 0, 0, ... 376, {status=0x0, info=1}, ) }, 0x0, 0, 3, 1, 4194368, 0, 0, ... 376, {status=0x0, info=1}, ) == 0x0
 04211   396   NtSetInformationFile  (376, 1240952, 8, Pipe, ... {status=0x0, info=0}, ) == 0x0
 04212   396   NtSetInformationFile  (376, 1240944, 8, Completion, ... {status=0x0, info=0}, ) == 0x0
 04213   396   NtSetInformationThread  (-2, ImpersonationToken, {ImpToken=0,}, 4, ... ) == 0x0
 04214   396   NtWriteFile  (376, 297, 0, 0,  (376, 297, 0, 0, "\5\0\13\3\20\0\0\0H\0\0\0\1\0\0\0\270\20\270\20\0\0\0\0\1\0\0\0\0\0\1\0\201\273z6D\230\3615\2552\230\3608\0\20\3\2\0\0\0\4]\210\212\353\34\311\21\237\350\10\0+\20H`\2\0\0\0", 72, {0, 0}, 0, ... {status=0x0, info=72}, ) , 72, {0, 0}, 0, ... {status=0x0, info=72}, ) == 0x0
 04215   396   NtReadFile  (376, 297, 0, 0, 1024, {0, 0}, 0, ... {status=0x0, info=68},  (376, 297, 0, 0, 1024, {0, 0}, 0, ... {status=0x0, info=68}, "\5\0\14\3\20\0\0\0D\0\0\0\1\0\0\0\270\20\270\20/'\0\0\15\0\PIPE\ntsvcs\0\0\1\0\0\0\0\0\0\0\4]\210\212\353\34\311\21\237\350\10\0+\20H`\2\0\0\0", ) , ) == 0x0
 04216   396   NtFsControlFile  (376, 297, 0x0, 0x0, 0x11c017,  (376, 297, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0$\0\0\0\1\0\0\0\14\0\0\0\0\0\17\0\0\0\0\0\0\0\0\0\0\0\0\200", 36, 1024, ... {status=0x103, info=68}, "\5\0\14\3\20\0\0\0D\0\0\0\1\0\0\0\270\20\270\20/'\0\0\15\0\PIPE\ntsvcs\0\0\1\0\0\0\0\0\0\0\4]\210\212\353\34\311\21\237\350\10\0+\20H`\2\0\0\0", ) , 36, 1024, ... {status=0x103, info=68},  (376, 297, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0$\0\0\0\1\0\0\0\14\0\0\0\0\0\17\0\0\0\0\0\0\0\0\0\0\0\0\200", 36, 1024, ... {status=0x103, info=68}, "\5\0\14\3\20\0\0\0D\0\0\0\1\0\0\0\270\20\270\20/'\0\0\15\0\PIPE\ntsvcs\0\0\1\0\0\0\0\0\0\0\4]\210\212\353\34\311\21\237\350\10\0+\20H`\2\0\0\0", ) , ) == 0x103
 04217   396   NtFsControlFile  (376, 297, 0x0, 0x0, 0x11c017,  (376, 297, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0L\0\0\0\2\0\0\04\0\0\0\0\0\20\0\0\0\0\0\216\17\233\326\333?\334\21\261\310\0\14)\371\246\305\7\0\0\0\0\0\0\0\7\0\0\0R\0A\0S\0M\0A\0N\0\0\0\0\0\4\0\0\0", 76, 1024, ... {status=0x103, info=48}, "\5\0\2\3\20\0\0\00\0\0\0\1\0\0\0\30\0\0\0\0\0\0\0\0\0\0\0\216\17\233\326\333?\334\21\261\310\0\14)\371\246\305\0\0\0\0", ) , 76, 1024, ... {status=0x103, info=48},  (376, 297, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0L\0\0\0\2\0\0\04\0\0\0\0\0\20\0\0\0\0\0\216\17\233\326\333?\334\21\261\310\0\14)\371\246\305\7\0\0\0\0\0\0\0\7\0\0\0R\0A\0S\0M\0A\0N\0\0\0\0\0\4\0\0\0", 76, 1024, ... {status=0x103, info=48}, "\5\0\2\3\20\0\0\00\0\0\0\1\0\0\0\30\0\0\0\0\0\0\0\0\0\0\0\216\17\233\326\333?\334\21\261\310\0\14)\371\246\305\0\0\0\0", ) , ) == 0x103
 04218   396   NtFsControlFile  (376, 297, 0x0, 0x0, 0x11c017,  (376, 297, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0,\0\0\0\3\0\0\0\24\0\0\0\0\0\6\0\0\0\0\0\217\17\233\326\333?\334\21\261\310\0\14)\371\246\305", 44, 1024, ... {status=0x103, info=48}, "\5\0\2\3\20\0\0\00\0\0\0\2\0\0\0\30\0\0\0\0\0\0\0\0\0\0\0\217\17\233\326\333?\334\21\261\310\0\14)\371\246\305\0\0\0\0", ) , 44, 1024, ... {status=0x103, info=48},  (376, 297, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0,\0\0\0\3\0\0\0\24\0\0\0\0\0\6\0\0\0\0\0\217\17\233\326\333?\334\21\261\310\0\14)\371\246\305", 44, 1024, ... {status=0x103, info=48}, "\5\0\2\3\20\0\0\00\0\0\0\2\0\0\0\30\0\0\0\0\0\0\0\0\0\0\0\217\17\233\326\333?\334\21\261\310\0\14)\371\246\305\0\0\0\0", ) , ) == 0x103
 04219   396   NtFsControlFile  (376, 297, 0x0, 0x0, 0x11c017,  (376, 297, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0,\0\0\0\4\0\0\0\24\0\0\0\0\0\0\0\0\0\0\0\217\17\233\326\333?\334\21\261\310\0\14)\371\246\305", 44, 1024, ... {status=0x103, info=56}, "\5\0\2\3\20\0\0\08\0\0\0\3\0\0\0 \0\0\0\0\0\0\0 \0\0\0\1\0\0\0\0\0\0\05\4\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0", ) , 44, 1024, ... {status=0x103, info=56},  (376, 297, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0,\0\0\0\4\0\0\0\24\0\0\0\0\0\0\0\0\0\0\0\217\17\233\326\333?\334\21\261\310\0\14)\371\246\305", 44, 1024, ... {status=0x103, info=56}, "\5\0\2\3\20\0\0\08\0\0\0\3\0\0\0 \0\0\0\0\0\0\0 \0\0\0\1\0\0\0\0\0\0\05\4\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0", ) , ) == 0x103
 04220   396   NtFsControlFile  (376, 297, 0x0, 0x0, 0x11c017,  (376, 297, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0,\0\0\0\5\0\0\0\24\0\0\0\0\0\0\0\0\0\0\0\216\17\233\326\333?\334\21\261\310\0\14)\371\246\305", 44, 1024, ... {status=0x103, info=48}, "\5\0\2\3\20\0\0\00\0\0\0\4\0\0\0\30\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0", ) , 44, 1024, ... {status=0x103, info=48},  (376, 297, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0,\0\0\0\5\0\0\0\24\0\0\0\0\0\0\0\0\0\0\0\216\17\233\326\333?\334\21\261\310\0\14)\371\246\305", 44, 1024, ... {status=0x103, info=48}, "\5\0\2\3\20\0\0\00\0\0\0\4\0\0\0\30\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0", ) , ) == 0x103
 04221   396   NtClose  (352, ... ) == 0x0
 04222   396   NtClose  (376, ... ) == 0x0
 04223   396   NtReleaseMutant  (204, ... 0x0, ) == 0x0
 04224   396   NtQueryValueKey  (108,  (108, "EnableAutodial", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (108, "EnableAutodial", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) }, 16, ) == 0x0
 04225   396   NtQueryValueKey  (108,  (108, "NoNetAutodial", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (108, "NoNetAutodial", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) }, 16, ) == 0x0
 04226   396   NtCreateKey  (0x2001d, {24, 48, 0x40, 0, 0,  (0x2001d, {24, 48, 0x40, 0, 0, "Software\Microsoft\RAS AutoDial"}, 0, 0x0, 0, ... 376, 2, ) }, 0, 0x0, 0, ... 376, 2, ) == 0x0
 04227   396   NtCreateKey  (0x20019, {24, 376, 0x40, 0, 0,  (0x20019, {24, 376, 0x40, 0, 0, "Default"}, 0, 0x0, 0, ... 352, 2, ) }, 0, 0x0, 0, ... 352, 2, ) == 0x0
 04228   396   NtClose  (376, ... ) == 0x0
 04229   396   NtQueryValueKey  (352,  (352, "DefaultInternet", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 04230   396   NtClose  (352, ... ) == 0x0
 04231   396   NtWaitForSingleObject  (156, 0, 0x0, ... ) == 0x0
 04232   396   NtQueryInformationFile  (152, 1242316, 24, Standard, ... {status=0x0, info=24}, ) == 0x0
 04233   396   NtReleaseMutant  (156, ... 0x0, ) == 0x0
 04234   396   NtWaitForSingleObject  (156, 0, 0x0, ... ) == 0x0
 04235   396   NtQueryInformationFile  (152, 1242472, 24, Standard, ... {status=0x0, info=24}, ) == 0x0
 04236   396   NtReleaseMutant  (156, ... 0x0, ) == 0x0
 04237   396   NtReleaseMutant  (200, ... 0x0, ) == 0x0
 04238   396   NtUserGetMessage  (0, 0, 0, ... {0x30062, WM_TIMER, 0x65, 0x0, 0xbc2b, {512, 384}}, ) == 0x1
 04239   396   NtWaitForSingleObject  (200, 0, 0x0, ... ) == 0x0
 04240   396   NtWaitForSingleObject  (204, 0, 0x0, ... ) == 0x0
 04241   396   NtReleaseMutant  (204, ... 0x0, ) == 0x0
 04242   396   NtQueryValueKey  (108,  (108, "EnableAutodial", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (108, "EnableAutodial", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) }, 16, ) == 0x0
 04243   396   NtQueryValueKey  (108,  (108, "NoNetAutodial", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (108, "NoNetAutodial", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) }, 16, ) == 0x0
 04244   396   NtCreateKey  (0x2001d, {24, 48, 0x40, 0, 0,  (0x2001d, {24, 48, 0x40, 0, 0, "Software\Microsoft\RAS AutoDial"}, 0, 0x0, 0, ... 352, 2, ) }, 0, 0x0, 0, ... 352, 2, ) == 0x0
 04245   396   NtCreateKey  (0x20019, {24, 352, 0x40, 0, 0,  (0x20019, {24, 352, 0x40, 0, 0, "Default"}, 0, 0x0, 0, ... 376, 2, ) }, 0, 0x0, 0, ... 376, 2, ) == 0x0
 04246   396   NtClose  (352, ... ) == 0x0
 04247   396   NtQueryValueKey  (376,  (376, "DefaultInternet", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 04248   396   NtClose  (376, ... ) == 0x0
 04249   396   NtWaitForSingleObject  (156, 0, 0x0, ... ) == 0x0
 04250   396   NtQueryInformationFile  (152, 1242316, 24, Standard, ... {status=0x0, info=24}, ) == 0x0
 04251   396   NtReleaseMutant  (156, ... 0x0, ) == 0x0
 04252   396   NtWaitForSingleObject  (156, 0, 0x0, ... ) == 0x0
 04253   396   NtQueryInformationFile  (152, 1242472, 24, Standard, ... {status=0x0, info=24}, ) == 0x0
 04254   396   NtReleaseMutant  (156, ... 0x0, ) == 0x0
 04255   396   NtReleaseMutant  (200, ... 0x0, ) == 0x0
 04256   396   NtUserGetMessage  (0, 0, 0, ... {0x30062, WM_TIMER, 0x65, 0x0, 0xc3fb, {512, 384}}, ) == 0x1
 04257   396   NtWaitForSingleObject  (200, 0, 0x0, ... ) == 0x0
 04258   396   NtWaitForSingleObject  (204, 0, 0x0, ... ) == 0x0
 04259   396   NtOpenEvent  (0x100000, {24, 52, 0x0, 0, 0,  (0x100000, {24, 52, 0x0, 0, 0, "Global\SvcctrlStartEvent_A3752DX"}, ... 376, ) }, ... 376, ) == 0x0
 04260   396   NtWaitForSingleObject  (376, 0, {-1800000000, -1}, ... ) == 0x0
 04261   396   NtClose  (376, ... ) == 0x0
 04262   396   NtOpenThreadToken  (-2, 0xc, 1, ... ) == STATUS_NO_TOKEN
 04263   396   NtCreateEvent  (0x1f0003, 0x0, 1, 0, ... 376, ) == 0x0
 04264   396   NtOpenThreadToken  (-2, 0xc, 1, ... ) == STATUS_NO_TOKEN
 04265   396   NtSetInformationThread  (-2, ImpersonationToken, {ImpToken=0,}, 4, ... ) == 0x0
 04266   396   NtCreateFile  (0xc0100080, {24, 0, 0x40, 0, 1240896,  (0xc0100080, {24, 0, 0x40, 0, 1240896, "\??\PIPE\svcctl"}, 0x0, 0, 3, 1, 4194368, 0, 0, ... 352, {status=0x0, info=1}, ) }, 0x0, 0, 3, 1, 4194368, 0, 0, ... 352, {status=0x0, info=1}, ) == 0x0
 04267   396   NtSetInformationFile  (352, 1240952, 8, Pipe, ... {status=0x0, info=0}, ) == 0x0
 04268   396   NtSetInformationFile  (352, 1240944, 8, Completion, ... {status=0x0, info=0}, ) == 0x0
 04269   396   NtSetInformationThread  (-2, ImpersonationToken, {ImpToken=0,}, 4, ... ) == 0x0
 04270   396   NtWriteFile  (352, 297, 0, 0,  (352, 297, 0, 0, "\5\0\13\3\20\0\0\0H\0\0\0\1\0\0\0\270\20\270\20\0\0\0\0\1\0\0\0\0\0\1\0\201\273z6D\230\3615\2552\230\3608\0\20\3\2\0\0\0\4]\210\212\353\34\311\21\237\350\10\0+\20H`\2\0\0\0", 72, {0, 0}, 0, ... {status=0x0, info=72}, ) , 72, {0, 0}, 0, ... {status=0x0, info=72}, ) == 0x0
 04271   396   NtReadFile  (352, 297, 0, 0, 1024, {0, 0}, 0, ... {status=0x0, info=68},  (352, 297, 0, 0, 1024, {0, 0}, 0, ... {status=0x0, info=68}, "\5\0\14\3\20\0\0\0D\0\0\0\1\0\0\0\270\20\270\200'\0\0\15\0\PIPE\ntsvcs\0\0\1\0\0\0\0\0\0\0\4]\210\212\353\34\311\21\237\350\10\0+\20H`\2\0\0\0", ) , ) == 0x0
 04272   396   NtFsControlFile  (352, 297, 0x0, 0x0, 0x11c017,  (352, 297, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0$\0\0\0\1\0\0\0\14\0\0\0\0\0\17\0\0\0\0\0\0\0\0\0\0\0\0\200", 36, 1024, ... {status=0x103, info=68}, "\5\0\14\3\20\0\0\0D\0\0\0\1\0\0\0\270\20\270\200'\0\0\15\0\PIPE\ntsvcs\0\0\1\0\0\0\0\0\0\0\4]\210\212\353\34\311\21\237\350\10\0+\20H`\2\0\0\0", ) , 36, 1024, ... {status=0x103, info=68},  (352, 297, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0$\0\0\0\1\0\0\0\14\0\0\0\0\0\17\0\0\0\0\0\0\0\0\0\0\0\0\200", 36, 1024, ... {status=0x103, info=68}, "\5\0\14\3\20\0\0\0D\0\0\0\1\0\0\0\270\20\270\200'\0\0\15\0\PIPE\ntsvcs\0\0\1\0\0\0\0\0\0\0\4]\210\212\353\34\311\21\237\350\10\0+\20H`\2\0\0\0", ) , ) == 0x103
 04273   396   NtFsControlFile  (352, 297, 0x0, 0x0, 0x11c017,  (352, 297, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0L\0\0\0\2\0\0\04\0\0\0\0\0\20\0\0\0\0\0\220\17\233\326\333?\334\21\261\310\0\14)\371\246\305\7\0\0\0\0\0\0\0\7\0\0\0R\0A\0S\0M\0A\0N\0\0\0\0\0\4\0\0\0", 76, 1024, ... {status=0x103, info=48}, "\5\0\2\3\20\0\0\00\0\0\0\1\0\0\0\30\0\0\0\0\0\0\0\0\0\0\0\220\17\233\326\333?\334\21\261\310\0\14)\371\246\305\0\0\0\0", ) , 76, 1024, ... {status=0x103, info=48},  (352, 297, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0L\0\0\0\2\0\0\04\0\0\0\0\0\20\0\0\0\0\0\220\17\233\326\333?\334\21\261\310\0\14)\371\246\305\7\0\0\0\0\0\0\0\7\0\0\0R\0A\0S\0M\0A\0N\0\0\0\0\0\4\0\0\0", 76, 1024, ... {status=0x103, info=48}, "\5\0\2\3\20\0\0\00\0\0\0\1\0\0\0\30\0\0\0\0\0\0\0\0\0\0\0\220\17\233\326\333?\334\21\261\310\0\14)\371\246\305\0\0\0\0", ) , ) == 0x103
 04274   396   NtFsControlFile  (352, 297, 0x0, 0x0, 0x11c017,  (352, 297, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0,\0\0\0\3\0\0\0\24\0\0\0\0\0\6\0\0\0\0\0\221\17\233\326\333?\334\21\261\310\0\14)\371\246\305", 44, 1024, ... {status=0x103, info=48}, "\5\0\2\3\20\0\0\00\0\0\0\2\0\0\0\30\0\0\0\0\0\0\0\0\0\0\0\221\17\233\326\333?\334\21\261\310\0\14)\371\246\305\0\0\0\0", ) , 44, 1024, ... {status=0x103, info=48},  (352, 297, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0,\0\0\0\3\0\0\0\24\0\0\0\0\0\6\0\0\0\0\0\221\17\233\326\333?\334\21\261\310\0\14)\371\246\305", 44, 1024, ... {status=0x103, info=48}, "\5\0\2\3\20\0\0\00\0\0\0\2\0\0\0\30\0\0\0\0\0\0\0\0\0\0\0\221\17\233\326\333?\334\21\261\310\0\14)\371\246\305\0\0\0\0", ) , ) == 0x103
 04275   396   NtFsControlFile  (352, 297, 0x0, 0x0, 0x11c017,  (352, 297, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0,\0\0\0\4\0\0\0\24\0\0\0\0\0\0\0\0\0\0\0\221\17\233\326\333?\334\21\261\310\0\14)\371\246\305", 44, 1024, ... {status=0x103, info=56}, "\5\0\2\3\20\0\0\08\0\0\0\3\0\0\0 \0\0\0\0\0\0\0 \0\0\0\1\0\0\0\0\0\0\05\4\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0", ) , 44, 1024, ... {status=0x103, info=56},  (352, 297, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0,\0\0\0\4\0\0\0\24\0\0\0\0\0\0\0\0\0\0\0\221\17\233\326\333?\334\21\261\310\0\14)\371\246\305", 44, 1024, ... {status=0x103, info=56}, "\5\0\2\3\20\0\0\08\0\0\0\3\0\0\0 \0\0\0\0\0\0\0 \0\0\0\1\0\0\0\0\0\0\05\4\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0", ) , ) == 0x103
 04276   396   NtFsControlFile  (352, 297, 0x0, 0x0, 0x11c017,  (352, 297, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0,\0\0\0\5\0\0\0\24\0\0\0\0\0\0\0\0\0\0\0\220\17\233\326\333?\334\21\261\310\0\14)\371\246\305", 44, 1024, ... {status=0x103, info=48}, "\5\0\2\3\20\0\0\00\0\0\0\4\0\0\0\30\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0", ) , 44, 1024, ... {status=0x103, info=48},  (352, 297, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0,\0\0\0\5\0\0\0\24\0\0\0\0\0\0\0\0\0\0\0\220\17\233\326\333?\334\21\261\310\0\14)\371\246\305", 44, 1024, ... {status=0x103, info=48}, "\5\0\2\3\20\0\0\00\0\0\0\4\0\0\0\30\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0", ) , ) == 0x103
 04277   396   NtClose  (376, ... ) == 0x0
 04278   396   NtClose  (352, ... ) == 0x0
 04279   396   NtReleaseMutant  (204, ... 0x0, ) == 0x0
 04280   396   NtQueryValueKey  (108,  (108, "EnableAutodial", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (108, "EnableAutodial", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) }, 16, ) == 0x0
 04281   396   NtQueryValueKey  (108,  (108, "NoNetAutodial", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (108, "NoNetAutodial", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) }, 16, ) == 0x0
 04282   396   NtCreateKey  (0x2001d, {24, 48, 0x40, 0, 0,  (0x2001d, {24, 48, 0x40, 0, 0, "Software\Microsoft\RAS AutoDial"}, 0, 0x0, 0, ... 352, 2, ) }, 0, 0x0, 0, ... 352, 2, ) == 0x0
 04283   396   NtCreateKey  (0x20019, {24, 352, 0x40, 0, 0,  (0x20019, {24, 352, 0x40, 0, 0, "Default"}, 0, 0x0, 0, ... 376, 2, ) }, 0, 0x0, 0, ... 376, 2, ) == 0x0
 04284   396   NtClose  (352, ... ) == 0x0
 04285   396   NtQueryValueKey  (376,  (376, "DefaultInternet", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 04286   396   NtClose  (376, ... ) == 0x0
 04287   396   NtWaitForSingleObject  (156, 0, 0x0, ... ) == 0x0
 04288   396   NtQueryInformationFile  (152, 1242316, 24, Standard, ... {status=0x0, info=24}, ) == 0x0
 04289   396   NtReleaseMutant  (156, ... 0x0, ) == 0x0
 04290   396   NtWaitForSingleObject  (156, 0, 0x0, ... ) == 0x0
 04291   396   NtQueryInformationFile  (152, 1242472, 24, Standard, ... {status=0x0, info=24}, ) == 0x0
 04292   396   NtReleaseMutant  (156, ... 0x0, ) == 0x0
 04293   396   NtReleaseMutant  (200, ... 0x0, ) == 0x0
 04294   396   NtUserGetMessage  (0, 0, 0, ... {0x30062, WM_TIMER, 0x65, 0x0, 0xcbcb, {512, 384}}, ) == 0x1
 04295   396   NtWaitForSingleObject  (200, 0, 0x0, ... ) == 0x0
 04296   396   NtWaitForSingleObject  (204, 0, 0x0, ... ) == 0x0
 04297   396   NtReleaseMutant  (204, ... 0x0, ) == 0x0
 04298   396   NtQueryValueKey  (108,  (108, "EnableAutodial", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (108, "EnableAutodial", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) }, 16, ) == 0x0
 04299   396   NtQueryValueKey  (108,  (108, "NoNetAutodial", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (108, "NoNetAutodial", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) }, 16, ) == 0x0
 04300   396   NtCreateKey  (0x2001d, {24, 48, 0x40, 0, 0,  (0x2001d, {24, 48, 0x40, 0, 0, "Software\Microsoft\RAS AutoDial"}, 0, 0x0, 0, ... 376, 2, ) }, 0, 0x0, 0, ... 376, 2, ) == 0x0
 04301   396   NtCreateKey  (0x20019, {24, 376, 0x40, 0, 0,  (0x20019, {24, 376, 0x40, 0, 0, "Default"}, 0, 0x0, 0, ... 352, 2, ) }, 0, 0x0, 0, ... 352, 2, ) == 0x0
 04302   396   NtClose  (376, ... ) == 0x0
 04303   396   NtQueryValueKey  (352,  (352, "DefaultInternet", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 04304   396   NtClose  (352, ... ) == 0x0
 04305   396   NtWaitForSingleObject  (156, 0, 0x0, ... ) == 0x0
 04306   396   NtQueryInformationFile  (152, 1242316, 24, Standard, ... {status=0x0, info=24}, ) == 0x0
 04307   396   NtReleaseMutant  (156, ... 0x0, ) == 0x0
 04308   396   NtWaitForSingleObject  (156, 0, 0x0, ... ) == 0x0
 04309   396   NtQueryInformationFile  (152, 1242472, 24, Standard, ... {status=0x0, info=24}, ) == 0x0
 04310   396   NtReleaseMutant  (156, ... 0x0, ) == 0x0
 04311   396   NtReleaseMutant  (200, ... 0x0, ) == 0x0
 04312   396   NtUserGetMessage  (0, 0, 0, ... {0x30062, WM_TIMER, 0x65, 0x0, 0xd39b, {512, 384}}, ) == 0x1
 04313   396   NtWaitForSingleObject  (200, 0, 0x0, ... ) == 0x0
 04314   396   NtWaitForSingleObject  (204, 0, 0x0, ... ) == 0x0
 04315   396   NtOpenEvent  (0x100000, {24, 52, 0x0, 0, 0,  (0x100000, {24, 52, 0x0, 0, 0, "Global\SvcctrlStartEvent_A3752DX"}, ... 352, ) }, ... 352, ) == 0x0
 04316   396   NtWaitForSingleObject  (352, 0, {-1800000000, -1}, ... ) == 0x0
 04317   396   NtClose  (352, ... ) == 0x0
 04318   396   NtOpenThreadToken  (-2, 0xc, 1, ... ) == STATUS_NO_TOKEN
 04319   396   NtCreateEvent  (0x1f0003, 0x0, 1, 0, ... 352, ) == 0x0
 04320   396   NtOpenThreadToken  (-2, 0xc, 1, ... ) == STATUS_NO_TOKEN
 04321   396   NtSetInformationThread  (-2, ImpersonationToken, {ImpToken=0,}, 4, ... ) == 0x0
 04322   396   NtCreateFile  (0xc0100080, {24, 0, 0x40, 0, 1240896,  (0xc0100080, {24, 0, 0x40, 0, 1240896, "\??\PIPE\svcctl"}, 0x0, 0, 3, 1, 4194368, 0, 0, ... 376, {status=0x0, info=1}, ) }, 0x0, 0, 3, 1, 4194368, 0, 0, ... 376, {status=0x0, info=1}, ) == 0x0
 04323   396   NtSetInformationFile  (376, 1240952, 8, Pipe, ... {status=0x0, info=0}, ) == 0x0
 04324   396   NtSetInformationFile  (376, 1240944, 8, Completion, ... {status=0x0, info=0}, ) == 0x0
 04325   396   NtSetInformationThread  (-2, ImpersonationToken, {ImpToken=0,}, 4, ... ) == 0x0
 04326   396   NtWriteFile  (376, 297, 0, 0,  (376, 297, 0, 0, "\5\0\13\3\20\0\0\0H\0\0\0\1\0\0\0\270\20\270\20\0\0\0\0\1\0\0\0\0\0\1\0\201\273z6D\230\3615\2552\230\3608\0\20\3\2\0\0\0\4]\210\212\353\34\311\21\237\350\10\0+\20H`\2\0\0\0", 72, {0, 0}, 0, ... {status=0x0, info=72}, ) , 72, {0, 0}, 0, ... {status=0x0, info=72}, ) == 0x0
 04327   396   NtReadFile  (376, 297, 0, 0, 1024, {0, 0}, 0, ... {status=0x0, info=68},  (376, 297, 0, 0, 1024, {0, 0}, 0, ... {status=0x0, info=68}, "\5\0\14\3\20\0\0\0D\0\0\0\1\0\0\0\270\20\270\202'\0\0\15\0\PIPE\ntsvcs\0\0\1\0\0\0\0\0\0\0\4]\210\212\353\34\311\21\237\350\10\0+\20H`\2\0\0\0", ) , ) == 0x0
 04328   396   NtFsControlFile  (376, 297, 0x0, 0x0, 0x11c017,  (376, 297, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0$\0\0\0\1\0\0\0\14\0\0\0\0\0\17\0\0\0\0\0\0\0\0\0\0\0\0\200", 36, 1024, ... {status=0x103, info=68}, "\5\0\14\3\20\0\0\0D\0\0\0\1\0\0\0\270\20\270\202'\0\0\15\0\PIPE\ntsvcs\0\0\1\0\0\0\0\0\0\0\4]\210\212\353\34\311\21\237\350\10\0+\20H`\2\0\0\0", ) , 36, 1024, ... {status=0x103, info=68},  (376, 297, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0$\0\0\0\1\0\0\0\14\0\0\0\0\0\17\0\0\0\0\0\0\0\0\0\0\0\0\200", 36, 1024, ... {status=0x103, info=68}, "\5\0\14\3\20\0\0\0D\0\0\0\1\0\0\0\270\20\270\202'\0\0\15\0\PIPE\ntsvcs\0\0\1\0\0\0\0\0\0\0\4]\210\212\353\34\311\21\237\350\10\0+\20H`\2\0\0\0", ) , ) == 0x103
 04329   396   NtFsControlFile  (376, 297, 0x0, 0x0, 0x11c017,  (376, 297, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0L\0\0\0\2\0\0\04\0\0\0\0\0\20\0\0\0\0\0\212\35\302\335\333?\334\21\261\310\0\14)\371\246\305\7\0\0\0\0\0\0\0\7\0\0\0R\0A\0S\0M\0A\0N\0\0\0\0\0\4\0\0\0", 76, 1024, ... {status=0x103, info=48}, "\5\0\2\3\20\0\0\00\0\0\0\1\0\0\0\30\0\0\0\0\0\0\0\0\0\0\0\212\35\302\335\333?\334\21\261\310\0\14)\371\246\305\0\0\0\0", ) , 76, 1024, ... {status=0x103, info=48},  (376, 297, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0L\0\0\0\2\0\0\04\0\0\0\0\0\20\0\0\0\0\0\212\35\302\335\333?\334\21\261\310\0\14)\371\246\305\7\0\0\0\0\0\0\0\7\0\0\0R\0A\0S\0M\0A\0N\0\0\0\0\0\4\0\0\0", 76, 1024, ... {status=0x103, info=48}, "\5\0\2\3\20\0\0\00\0\0\0\1\0\0\0\30\0\0\0\0\0\0\0\0\0\0\0\212\35\302\335\333?\334\21\261\310\0\14)\371\246\305\0\0\0\0", ) , ) == 0x103
 04330   396   NtFsControlFile  (376, 297, 0x0, 0x0, 0x11c017,  (376, 297, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0,\0\0\0\3\0\0\0\24\0\0\0\0\0\6\0\0\0\0\0\213\35\302\335\333?\334\21\261\310\0\14)\371\246\305", 44, 1024, ... {status=0x103, info=48}, "\5\0\2\3\20\0\0\00\0\0\0\2\0\0\0\30\0\0\0\0\0\0\0\0\0\0\0\213\35\302\335\333?\334\21\261\310\0\14)\371\246\305\0\0\0\0", ) , 44, 1024, ... {status=0x103, info=48},  (376, 297, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0,\0\0\0\3\0\0\0\24\0\0\0\0\0\6\0\0\0\0\0\213\35\302\335\333?\334\21\261\310\0\14)\371\246\305", 44, 1024, ... {status=0x103, info=48}, "\5\0\2\3\20\0\0\00\0\0\0\2\0\0\0\30\0\0\0\0\0\0\0\0\0\0\0\213\35\302\335\333?\334\21\261\310\0\14)\371\246\305\0\0\0\0", ) , ) == 0x103
 04331   396   NtFsControlFile  (376, 297, 0x0, 0x0, 0x11c017,  (376, 297, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0,\0\0\0\4\0\0\0\24\0\0\0\0\0\0\0\0\0\0\0\213\35\302\335\333?\334\21\261\310\0\14)\371\246\305", 44, 1024, ... {status=0x103, info=56}, "\5\0\2\3\20\0\0\08\0\0\0\3\0\0\0 \0\0\0\0\0\0\0 \0\0\0\1\0\0\0\0\0\0\05\4\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0", ) , 44, 1024, ... {status=0x103, info=56},  (376, 297, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0,\0\0\0\4\0\0\0\24\0\0\0\0\0\0\0\0\0\0\0\213\35\302\335\333?\334\21\261\310\0\14)\371\246\305", 44, 1024, ... {status=0x103, info=56}, "\5\0\2\3\20\0\0\08\0\0\0\3\0\0\0 \0\0\0\0\0\0\0 \0\0\0\1\0\0\0\0\0\0\05\4\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0", ) , ) == 0x103
 04332   396   NtFsControlFile  (376, 297, 0x0, 0x0, 0x11c017,  (376, 297, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0,\0\0\0\5\0\0\0\24\0\0\0\0\0\0\0\0\0\0\0\212\35\302\335\333?\334\21\261\310\0\14)\371\246\305", 44, 1024, ... {status=0x103, info=48}, "\5\0\2\3\20\0\0\00\0\0\0\4\0\0\0\30\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0", ) , 44, 1024, ... {status=0x103, info=48},  (376, 297, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0,\0\0\0\5\0\0\0\24\0\0\0\0\0\0\0\0\0\0\0\212\35\302\335\333?\334\21\261\310\0\14)\371\246\305", 44, 1024, ... {status=0x103, info=48}, "\5\0\2\3\20\0\0\00\0\0\0\4\0\0\0\30\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0", ) , ) == 0x103
 04333   396   NtClose  (352, ... ) == 0x0
 04334   396   NtClose  (376, ... ) == 0x0
 04335   396   NtReleaseMutant  (204, ... 0x0, ) == 0x0
 04336   396   NtQueryValueKey  (108,  (108, "EnableAutodial", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (108, "EnableAutodial", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) }, 16, ) == 0x0
 04337   396   NtQueryValueKey  (108,  (108, "NoNetAutodial", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (108, "NoNetAutodial", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) }, 16, ) == 0x0
 04338   396   NtCreateKey  (0x2001d, {24, 48, 0x40, 0, 0,  (0x2001d, {24, 48, 0x40, 0, 0, "Software\Microsoft\RAS AutoDial"}, 0, 0x0, 0, ... 376, 2, ) }, 0, 0x0, 0, ... 376, 2, ) == 0x0
 04339   396   NtCreateKey  (0x20019, {24, 376, 0x40, 0, 0,  (0x20019, {24, 376, 0x40, 0, 0, "Default"}, 0, 0x0, 0, ... 352, 2, ) }, 0, 0x0, 0, ... 352, 2, ) == 0x0
 04340   396   NtClose  (376, ... ) == 0x0
 04341   396   NtQueryValueKey  (352,  (352, "DefaultInternet", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 04342   396   NtClose  (352, ... ) == 0x0
 04343   396   NtWaitForSingleObject  (156, 0, 0x0, ... ) == 0x0
 04344   396   NtQueryInformationFile  (152, 1242316, 24, Standard, ... {status=0x0, info=24}, ) == 0x0
 04345   396   NtReleaseMutant  (156, ... 0x0, ) == 0x0
 04346   396   NtWaitForSingleObject  (156, 0, 0x0, ... ) == 0x0
 04347   396   NtQueryInformationFile  (152, 1242472, 24, Standard, ... {status=0x0, info=24}, ) == 0x0
 04348   396   NtReleaseMutant  (156, ... 0x0, ) == 0x0
 04349   396   NtReleaseMutant  (200, ... 0x0, ) == 0x0
 04350   396   NtUserGetMessage  (0, 0, 0, ... {0x30062, WM_TIMER, 0x65, 0x0, 0xdb6b, {512, 384}}, ) == 0x1
 04351   396   NtWaitForSingleObject  (200, 0, 0x0, ... ) == 0x0
 04352   396   NtWaitForSingleObject  (204, 0, 0x0, ... ) == 0x0
 04353   396   NtReleaseMutant  (204, ... 0x0, ) == 0x0
 04354   396   NtQueryValueKey  (108,  (108, "EnableAutodial", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (108, "EnableAutodial", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) }, 16, ) == 0x0
 04355   396   NtQueryValueKey  (108,  (108, "NoNetAutodial", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (108, "NoNetAutodial", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) }, 16, ) == 0x0
 04356   396   NtCreateKey  (0x2001d, {24, 48, 0x40, 0, 0,  (0x2001d, {24, 48, 0x40, 0, 0, "Software\Microsoft\RAS AutoDial"}, 0, 0x0, 0, ... 352, 2, ) }, 0, 0x0, 0, ... 352, 2, ) == 0x0
 04357   396   NtCreateKey  (0x20019, {24, 352, 0x40, 0, 0,  (0x20019, {24, 352, 0x40, 0, 0, "Default"}, 0, 0x0, 0, ... 376, 2, ) }, 0, 0x0, 0, ... 376, 2, ) == 0x0
 04358   396   NtClose  (352, ... ) == 0x0
 04359   396   NtQueryValueKey  (376,  (376, "DefaultInternet", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 04360   396   NtClose  (376, ... ) == 0x0
 04361   396   NtWaitForSingleObject  (156, 0, 0x0, ... ) == 0x0
 04362   396   NtQueryInformationFile  (152, 1242316, 24, Standard, ... {status=0x0, info=24}, ) == 0x0
 04363   396   NtReleaseMutant  (156, ... 0x0, ) == 0x0
 04364   396   NtWaitForSingleObject  (156, 0, 0x0, ... ) == 0x0
 04365   396   NtQueryInformationFile  (152, 1242472, 24, Standard, ... {status=0x0, info=24}, ) == 0x0
 04366   396   NtReleaseMutant  (156, ... 0x0, ) == 0x0
 04367   396   NtReleaseMutant  (200, ... 0x0, ) == 0x0
 04368   396   NtUserGetMessage  (0, 0, 0, ... {0x30062, WM_TIMER, 0x65, 0x0, 0xe33b, {512, 384}}, ) == 0x1
 04369   396   NtWaitForSingleObject  (200, 0, 0x0, ... ) == 0x0
 04370   396   NtWaitForSingleObject  (204, 0, 0x0, ... ) == 0x0
 04371   396   NtOpenEvent  (0x100000, {24, 52, 0x0, 0, 0,  (0x100000, {24, 52, 0x0, 0, 0, "Global\SvcctrlStartEvent_A3752DX"}, ... 376, ) }, ... 376, ) == 0x0
 04372   396   NtWaitForSingleObject  (376, 0, {-1800000000, -1}, ... ) == 0x0
 04373   396   NtClose  (376, ... ) == 0x0
 04374   396   NtOpenThreadToken  (-2, 0xc, 1, ... ) == STATUS_NO_TOKEN
 04375   396   NtCreateEvent  (0x1f0003, 0x0, 1, 0, ... 376, ) == 0x0
 04376   396   NtOpenThreadToken  (-2, 0xc, 1, ... ) == STATUS_NO_TOKEN
 04377   396   NtSetInformationThread  (-2, ImpersonationToken, {ImpToken=0,}, 4, ... ) == 0x0
 04378   396   NtCreateFile  (0xc0100080, {24, 0, 0x40, 0, 1240896,  (0xc0100080, {24, 0, 0x40, 0, 1240896, "\??\PIPE\svcctl"}, 0x0, 0, 3, 1, 4194368, 0, 0, ... 352, {status=0x0, info=1}, ) }, 0x0, 0, 3, 1, 4194368, 0, 0, ... 352, {status=0x0, info=1}, ) == 0x0
 04379   396   NtSetInformationFile  (352, 1240952, 8, Pipe, ... {status=0x0, info=0}, ) == 0x0
 04380   396   NtSetInformationFile  (352, 1240944, 8, Completion, ... {status=0x0, info=0}, ) == 0x0
 04381   396   NtSetInformationThread  (-2, ImpersonationToken, {ImpToken=0,}, 4, ... ) == 0x0
 04382   396   NtWriteFile  (352, 297, 0, 0,  (352, 297, 0, 0, "\5\0\13\3\20\0\0\0H\0\0\0\1\0\0\0\270\20\270\20\0\0\0\0\1\0\0\0\0\0\1\0\201\273z6D\230\3615\2552\230\3608\0\20\3\2\0\0\0\4]\210\212\353\34\311\21\237\350\10\0+\20H`\2\0\0\0", 72, {0, 0}, 0, ... {status=0x0, info=72}, ) , 72, {0, 0}, 0, ... {status=0x0, info=72}, ) == 0x0
 04383   396   NtReadFile  (352, 297, 0, 0, 1024, {0, 0}, 0, ... {status=0x0, info=68},  (352, 297, 0, 0, 1024, {0, 0}, 0, ... {status=0x0, info=68}, "\5\0\14\3\20\0\0\0D\0\0\0\1\0\0\0\270\20\270\204'\0\0\15\0\PIPE\ntsvcs\0\0\1\0\0\0\0\0\0\0\4]\210\212\353\34\311\21\237\350\10\0+\20H`\2\0\0\0", ) , ) == 0x0
 04384   396   NtFsControlFile  (352, 297, 0x0, 0x0, 0x11c017,  (352, 297, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0$\0\0\0\1\0\0\0\14\0\0\0\0\0\17\0\0\0\0\0\0\0\0\0\0\0\0\200", 36, 1024, ... {status=0x103, info=68}, "\5\0\14\3\20\0\0\0D\0\0\0\1\0\0\0\270\20\270\204'\0\0\15\0\PIPE\ntsvcs\0\0\1\0\0\0\0\0\0\0\4]\210\212\353\34\311\21\237\350\10\0+\20H`\2\0\0\0", ) , 36, 1024, ... {status=0x103, info=68},  (352, 297, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0$\0\0\0\1\0\0\0\14\0\0\0\0\0\17\0\0\0\0\0\0\0\0\0\0\0\0\200", 36, 1024, ... {status=0x103, info=68}, "\5\0\14\3\20\0\0\0D\0\0\0\1\0\0\0\270\20\270\204'\0\0\15\0\PIPE\ntsvcs\0\0\1\0\0\0\0\0\0\0\4]\210\212\353\34\311\21\237\350\10\0+\20H`\2\0\0\0", ) , ) == 0x103
 04385   396   NtFsControlFile  (352, 297, 0x0, 0x0, 0x11c017,  (352, 297, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0L\0\0\0\2\0\0\04\0\0\0\0\0\20\0\0\0\0\0\216\35\302\335\333?\334\21\261\310\0\14)\371\246\305\7\0\0\0\0\0\0\0\7\0\0\0R\0A\0S\0M\0A\0N\0\0\0\0\0\4\0\0\0", 76, 1024, ... {status=0x103, info=48}, "\5\0\2\3\20\0\0\00\0\0\0\1\0\0\0\30\0\0\0\0\0\0\0\0\0\0\0\216\35\302\335\333?\334\21\261\310\0\14)\371\246\305\0\0\0\0", ) , 76, 1024, ... {status=0x103, info=48},  (352, 297, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0L\0\0\0\2\0\0\04\0\0\0\0\0\20\0\0\0\0\0\216\35\302\335\333?\334\21\261\310\0\14)\371\246\305\7\0\0\0\0\0\0\0\7\0\0\0R\0A\0S\0M\0A\0N\0\0\0\0\0\4\0\0\0", 76, 1024, ... {status=0x103, info=48}, "\5\0\2\3\20\0\0\00\0\0\0\1\0\0\0\30\0\0\0\0\0\0\0\0\0\0\0\216\35\302\335\333?\334\21\261\310\0\14)\371\246\305\0\0\0\0", ) , ) == 0x103
 04386   396   NtFsControlFile  (352, 297, 0x0, 0x0, 0x11c017,  (352, 297, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0,\0\0\0\3\0\0\0\24\0\0\0\0\0\6\0\0\0\0\0\217\35\302\335\333?\334\21\261\310\0\14)\371\246\305", 44, 1024, ... {status=0x103, info=48}, "\5\0\2\3\20\0\0\00\0\0\0\2\0\0\0\30\0\0\0\0\0\0\0\0\0\0\0\217\35\302\335\333?\334\21\261\310\0\14)\371\246\305\0\0\0\0", ) , 44, 1024, ... {status=0x103, info=48},  (352, 297, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0,\0\0\0\3\0\0\0\24\0\0\0\0\0\6\0\0\0\0\0\217\35\302\335\333?\334\21\261\310\0\14)\371\246\305", 44, 1024, ... {status=0x103, info=48}, "\5\0\2\3\20\0\0\00\0\0\0\2\0\0\0\30\0\0\0\0\0\0\0\0\0\0\0\217\35\302\335\333?\334\21\261\310\0\14)\371\246\305\0\0\0\0", ) , ) == 0x103
 04387   396   NtFsControlFile  (352, 297, 0x0, 0x0, 0x11c017,  (352, 297, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0,\0\0\0\4\0\0\0\24\0\0\0\0\0\0\0\0\0\0\0\217\35\302\335\333?\334\21\261\310\0\14)\371\246\305", 44, 1024, ... {status=0x103, info=56}, "\5\0\2\3\20\0\0\08\0\0\0\3\0\0\0 \0\0\0\0\0\0\0 \0\0\0\1\0\0\0\0\0\0\05\4\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0", ) , 44, 1024, ... {status=0x103, info=56},  (352, 297, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0,\0\0\0\4\0\0\0\24\0\0\0\0\0\0\0\0\0\0\0\217\35\302\335\333?\334\21\261\310\0\14)\371\246\305", 44, 1024, ... {status=0x103, info=56}, "\5\0\2\3\20\0\0\08\0\0\0\3\0\0\0 \0\0\0\0\0\0\0 \0\0\0\1\0\0\0\0\0\0\05\4\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0", ) , ) == 0x103
 04388   396   NtFsControlFile  (352, 297, 0x0, 0x0, 0x11c017,  (352, 297, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0,\0\0\0\5\0\0\0\24\0\0\0\0\0\0\0\0\0\0\0\216\35\302\335\333?\334\21\261\310\0\14)\371\246\305", 44, 1024, ... {status=0x103, info=48}, "\5\0\2\3\20\0\0\00\0\0\0\4\0\0\0\30\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0", ) , 44, 1024, ... {status=0x103, info=48},  (352, 297, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0,\0\0\0\5\0\0\0\24\0\0\0\0\0\0\0\0\0\0\0\216\35\302\335\333?\334\21\261\310\0\14)\371\246\305", 44, 1024, ... {status=0x103, info=48}, "\5\0\2\3\20\0\0\00\0\0\0\4\0\0\0\30\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0", ) , ) == 0x103
 04389   396   NtClose  (376, ... ) == 0x0
 04390   396   NtClose  (352, ... ) == 0x0
 04391   396   NtReleaseMutant  (204, ... 0x0, ) == 0x0
 04392   396   NtQueryValueKey  (108,  (108, "EnableAutodial", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (108, "EnableAutodial", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) }, 16, ) == 0x0
 04393   396   NtQueryValueKey  (108,  (108, "NoNetAutodial", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (108, "NoNetAutodial", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) }, 16, ) == 0x0
 04394   396   NtCreateKey  (0x2001d, {24, 48, 0x40, 0, 0,  (0x2001d, {24, 48, 0x40, 0, 0, "Software\Microsoft\RAS AutoDial"}, 0, 0x0, 0, ... 352, 2, ) }, 0, 0x0, 0, ... 352, 2, ) == 0x0
 04395   396   NtCreateKey  (0x20019, {24, 352, 0x40, 0, 0,  (0x20019, {24, 352, 0x40, 0, 0, "Default"}, 0, 0x0, 0, ... 376, 2, ) }, 0, 0x0, 0, ... 376, 2, ) == 0x0
 04396   396   NtClose  (352, ... ) == 0x0
 04397   396   NtQueryValueKey  (376,  (376, "DefaultInternet", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 04398   396   NtClose  (376, ... ) == 0x0
 04399   396   NtWaitForSingleObject  (156, 0, 0x0, ... ) == 0x0
 04400   396   NtQueryInformationFile  (152, 1242316, 24, Standard, ... {status=0x0, info=24}, ) == 0x0
 04401   396   NtReleaseMutant  (156, ... 0x0, ) == 0x0
 04402   396   NtWaitForSingleObject  (156, 0, 0x0, ... ) == 0x0
 04403   396   NtQueryInformationFile  (152, 1242472, 24, Standard, ... {status=0x0, info=24}, ) == 0x0
 04404   396   NtReleaseMutant  (156, ... 0x0, ) == 0x0
 04405   396   NtReleaseMutant  (200, ... 0x0, ) == 0x0
 04406   396   NtUserGetMessage  (0, 0, 0, ... {0x30062, WM_TIMER, 0x65, 0x0, 0xeb0b, {512, 384}}, ) == 0x1
 04407   396   NtWaitForSingleObject  (200, 0, 0x0, ... ) == 0x0
 04408   396   NtWaitForSingleObject  (204, 0, 0x0, ... ) == 0x0
 04409   396   NtReleaseMutant  (204, ... 0x0, ) == 0x0
 04410   396   NtQueryValueKey  (108,  (108, "EnableAutodial", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (108, "EnableAutodial", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) }, 16, ) == 0x0
 04411   396   NtQueryValueKey  (108,  (108, "NoNetAutodial", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (108, "NoNetAutodial", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) }, 16, ) == 0x0
 04412   396   NtCreateKey  (0x2001d, {24, 48, 0x40, 0, 0,  (0x2001d, {24, 48, 0x40, 0, 0, "Software\Microsoft\RAS AutoDial"}, 0, 0x0, 0, ... 376, 2, ) }, 0, 0x0, 0, ... 376, 2, ) == 0x0
 04413   396   NtCreateKey  (0x20019, {24, 376, 0x40, 0, 0,  (0x20019, {24, 376, 0x40, 0, 0, "Default"}, 0, 0x0, 0, ... 352, 2, ) }, 0, 0x0, 0, ... 352, 2, ) == 0x0
 04414   396   NtClose  (376, ... ) == 0x0
 04415   396   NtQueryValueKey  (352,  (352, "DefaultInternet", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 04416   396   NtClose  (352, ... ) == 0x0
 04417   396   NtWaitForSingleObject  (156, 0, 0x0, ... ) == 0x0
 04418   396   NtQueryInformationFile  (152, 1242316, 24, Standard, ... {status=0x0, info=24}, ) == 0x0
 04419   396   NtReleaseMutant  (156, ... 0x0, ) == 0x0
 04420   396   NtWaitForSingleObject  (156, 0, 0x0, ... ) == 0x0
 04421   396   NtQueryInformationFile  (152, 1242472, 24, Standard, ... {status=0x0, info=24}, ) == 0x0
 04422   396   NtReleaseMutant  (156, ... 0x0, ) == 0x0
 04423   396   NtReleaseMutant  (200, ... 0x0, ) == 0x0
 04424   396   NtUserGetMessage  (0, 0, 0, ... {0x30062, WM_TIMER, 0x65, 0x0, 0xf2db, {512, 384}}, ) == 0x1
 04425   396   NtWaitForSingleObject  (200, 0, 0x0, ... ) == 0x0
 04426   396   NtWaitForSingleObject  (204, 0, 0x0, ... ) == 0x0
 04427   396   NtWaitForMultipleObjects  (2, (264, 280, ), 1, 0, {0, 0}, ... ) == 0x0
 04428   396   NtQueryValueKey  (276,  (276, "EnableFileTracing", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (276, "EnableFileTracing", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) }, 16, ) == 0x0
 04429   396   NtQueryValueKey  (276,  (276, "FileTracingMask", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\377\377"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (276, "FileTracingMask", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\377\377"}, 16, ) }, 16, ) == 0x0
 04430   396   NtQueryValueKey  (276,  (276, "EnableConsoleTracing", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (276, "EnableConsoleTracing", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) }, 16, ) == 0x0
 04431   396   NtQueryValueKey  (276,  (276, "ConsoleTracingMask", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\377\377"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (276, "ConsoleTracingMask", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\377\377"}, 16, ) }, 16, ) == 0x0
 04432   396   NtQueryValueKey  (276,  (276, "MaxFileSize", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\20\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (276, "MaxFileSize", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\20\0"}, 16, ) }, 16, ) == 0x0
 04433   396   NtQueryValueKey  (276,  (276, "FileDirectory", Partial, 144, ... TitleIdx=0, Type=2, Data="%\0w\0i\0n\0d\0i\0r\0%\0\\0t\0r\0a\0c\0i\0n\0g\0\0\0"}, 46, ) , Partial, 144, ... TitleIdx=0, Type=2, Data= (276, "FileDirectory", Partial, 144, ... TitleIdx=0, Type=2, Data="%\0w\0i\0n\0d\0i\0r\0%\0\\0t\0r\0a\0c\0i\0n\0g\0\0\0"}, 46, ) }, 46, ) == 0x0
 04434   396   NtQueryValueKey  (276,  (276, "FileDirectory", Partial, 144, ... TitleIdx=0, Type=2, Data="%\0w\0i\0n\0d\0i\0r\0%\0\\0t\0r\0a\0c\0i\0n\0g\0\0\0"}, 46, ) , Partial, 144, ... TitleIdx=0, Type=2, Data= (276, "FileDirectory", Partial, 144, ... TitleIdx=0, Type=2, Data="%\0w\0i\0n\0d\0i\0r\0%\0\\0t\0r\0a\0c\0i\0n\0g\0\0\0"}, 46, ) }, 46, ) == 0x0
 04435   396   NtNotifyChangeKey  (276, 280, 0, 0, 2011390432, 14, 0, 0, 0, 1, ... ) == 0x103
 04436   396   NtOpenEvent  (0x100000, {24, 52, 0x0, 0, 0,  (0x100000, {24, 52, 0x0, 0, 0, "Global\SvcctrlStartEvent_A3752DX"}, ... 352, ) }, ... 352, ) == 0x0
 04437   396   NtWaitForSingleObject  (352, 0, {-1800000000, -1}, ... ) == 0x0
 04438   396   NtClose  (352, ... ) == 0x0
 04439   396   NtOpenThreadToken  (-2, 0xc, 1, ... ) == STATUS_NO_TOKEN
 04440   396   NtCreateEvent  (0x1f0003, 0x0, 1, 0, ... 352, ) == 0x0
 04441   396   NtOpenThreadToken  (-2, 0xc, 1, ... ) == STATUS_NO_TOKEN
 04442   396   NtSetInformationThread  (-2, ImpersonationToken, {ImpToken=0,}, 4, ... ) == 0x0
 04443   396   NtCreateFile  (0xc0100080, {24, 0, 0x40, 0, 1240896,  (0xc0100080, {24, 0, 0x40, 0, 1240896, "\??\PIPE\svcctl"}, 0x0, 0, 3, 1, 4194368, 0, 0, ... 376, {status=0x0, info=1}, ) }, 0x0, 0, 3, 1, 4194368, 0, 0, ... 376, {status=0x0, info=1}, ) == 0x0
 04444   396   NtSetInformationFile  (376, 1240952, 8, Pipe, ... {status=0x0, info=0}, ) == 0x0
 04445   396   NtSetInformationFile  (376, 1240944, 8, Completion, ... {status=0x0, info=0}, ) == 0x0
 04446   396   NtSetInformationThread  (-2, ImpersonationToken, {ImpToken=0,}, 4, ... ) == 0x0
 04447   396   NtWriteFile  (376, 297, 0, 0,  (376, 297, 0, 0, "\5\0\13\3\20\0\0\0H\0\0\0\1\0\0\0\270\20\270\20\0\0\0\0\1\0\0\0\0\0\1\0\201\273z6D\230\3615\2552\230\3608\0\20\3\2\0\0\0\4]\210\212\353\34\311\21\237\350\10\0+\20H`\2\0\0\0", 72, {0, 0}, 0, ... {status=0x0, info=72}, ) , 72, {0, 0}, 0, ... {status=0x0, info=72}, ) == 0x0
 04448   396   NtReadFile  (376, 297, 0, 0, 1024, {0, 0}, 0, ... {status=0x0, info=68},  (376, 297, 0, 0, 1024, {0, 0}, 0, ... {status=0x0, info=68}, "\5\0\14\3\20\0\0\0D\0\0\0\1\0\0\0\270\20\270\206'\0\0\15\0\PIPE\ntsvcs\0\0\1\0\0\0\0\0\0\0\4]\210\212\353\34\311\21\237\350\10\0+\20H`\2\0\0\0", ) , ) == 0x0
 04449   396   NtFsControlFile  (376, 297, 0x0, 0x0, 0x11c017,  (376, 297, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0$\0\0\0\1\0\0\0\14\0\0\0\0\0\17\0\0\0\0\0\0\0\0\0\0\0\0\200", 36, 1024, ... {status=0x103, info=68}, "\5\0\14\3\20\0\0\0D\0\0\0\1\0\0\0\270\20\270\206'\0\0\15\0\PIPE\ntsvcs\0\0\1\0\0\0\0\0\0\0\4]\210\212\353\34\311\21\237\350\10\0+\20H`\2\0\0\0", ) , 36, 1024, ... {status=0x103, info=68},  (376, 297, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0$\0\0\0\1\0\0\0\14\0\0\0\0\0\17\0\0\0\0\0\0\0\0\0\0\0\0\200", 36, 1024, ... {status=0x103, info=68}, "\5\0\14\3\20\0\0\0D\0\0\0\1\0\0\0\270\20\270\206'\0\0\15\0\PIPE\ntsvcs\0\0\1\0\0\0\0\0\0\0\4]\210\212\353\34\311\21\237\350\10\0+\20H`\2\0\0\0", ) , ) == 0x103
 04450   396   NtFsControlFile  (376, 297, 0x0, 0x0, 0x11c017,  (376, 297, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0L\0\0\0\2\0\0\04\0\0\0\0\0\20\0\0\0\0\0\222\35\302\335\333?\334\21\261\310\0\14)\371\246\305\7\0\0\0\0\0\0\0\7\0\0\0R\0A\0S\0M\0A\0N\0\0\0\0\0\4\0\0\0", 76, 1024, ... {status=0x103, info=48}, "\5\0\2\3\20\0\0\00\0\0\0\1\0\0\0\30\0\0\0\0\0\0\0\0\0\0\0\222\35\302\335\333?\334\21\261\310\0\14)\371\246\305\0\0\0\0", ) , 76, 1024, ... {status=0x103, info=48},  (376, 297, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0L\0\0\0\2\0\0\04\0\0\0\0\0\20\0\0\0\0\0\222\35\302\335\333?\334\21\261\310\0\14)\371\246\305\7\0\0\0\0\0\0\0\7\0\0\0R\0A\0S\0M\0A\0N\0\0\0\0\0\4\0\0\0", 76, 1024, ... {status=0x103, info=48}, "\5\0\2\3\20\0\0\00\0\0\0\1\0\0\0\30\0\0\0\0\0\0\0\0\0\0\0\222\35\302\335\333?\334\21\261\310\0\14)\371\246\305\0\0\0\0", ) , ) == 0x103
 04451   396   NtFsControlFile  (376, 297, 0x0, 0x0, 0x11c017,  (376, 297, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0,\0\0\0\3\0\0\0\24\0\0\0\0\0\6\0\0\0\0\0\223\35\302\335\333?\334\21\261\310\0\14)\371\246\305", 44, 1024, ... {status=0x103, info=48}, "\5\0\2\3\20\0\0\00\0\0\0\2\0\0\0\30\0\0\0\0\0\0\0\0\0\0\0\223\35\302\335\333?\334\21\261\310\0\14)\371\246\305\0\0\0\0", ) , 44, 1024, ... {status=0x103, info=48},  (376, 297, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0,\0\0\0\3\0\0\0\24\0\0\0\0\0\6\0\0\0\0\0\223\35\302\335\333?\334\21\261\310\0\14)\371\246\305", 44, 1024, ... {status=0x103, info=48}, "\5\0\2\3\20\0\0\00\0\0\0\2\0\0\0\30\0\0\0\0\0\0\0\0\0\0\0\223\35\302\335\333?\334\21\261\310\0\14)\371\246\305\0\0\0\0", ) , ) == 0x103
 04452   396   NtFsControlFile  (376, 297, 0x0, 0x0, 0x11c017,  (376, 297, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0,\0\0\0\4\0\0\0\24\0\0\0\0\0\0\0\0\0\0\0\223\35\302\335\333?\334\21\261\310\0\14)\371\246\305", 44, 1024, ... {status=0x103, info=56}, "\5\0\2\3\20\0\0\08\0\0\0\3\0\0\0 \0\0\0\0\0\0\0 \0\0\0\1\0\0\0\0\0\0\05\4\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0", ) , 44, 1024, ... {status=0x103, info=56},  (376, 297, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0,\0\0\0\4\0\0\0\24\0\0\0\0\0\0\0\0\0\0\0\223\35\302\335\333?\334\21\261\310\0\14)\371\246\305", 44, 1024, ... {status=0x103, info=56}, "\5\0\2\3\20\0\0\08\0\0\0\3\0\0\0 \0\0\0\0\0\0\0 \0\0\0\1\0\0\0\0\0\0\05\4\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0", ) , ) == 0x103
 04453   396   NtFsControlFile  (376, 297, 0x0, 0x0, 0x11c017,  (376, 297, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0,\0\0\0\5\0\0\0\24\0\0\0\0\0\0\0\0\0\0\0\222\35\302\335\333?\334\21\261\310\0\14)\371\246\305", 44, 1024, ... {status=0x103, info=48}, "\5\0\2\3\20\0\0\00\0\0\0\4\0\0\0\30\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0", ) , 44, 1024, ... {status=0x103, info=48},  (376, 297, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0,\0\0\0\5\0\0\0\24\0\0\0\0\0\0\0\0\0\0\0\222\35\302\335\333?\334\21\261\310\0\14)\371\246\305", 44, 1024, ... {status=0x103, info=48}, "\5\0\2\3\20\0\0\00\0\0\0\4\0\0\0\30\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0", ) , ) == 0x103
 04454   396   NtClose  (352, ... ) == 0x0
 04455   396   NtClose  (376, ... ) == 0x0
 04456   396   NtReleaseMutant  (204, ... 0x0, ) == 0x0
 04457   396   NtQueryValueKey  (108,  (108, "EnableAutodial", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (108, "EnableAutodial", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) }, 16, ) == 0x0
 04458   396   NtQueryValueKey  (108,  (108, "NoNetAutodial", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (108, "NoNetAutodial", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) }, 16, ) == 0x0
 04459   396   NtCreateKey  (0x2001d, {24, 48, 0x40, 0, 0,  (0x2001d, {24, 48, 0x40, 0, 0, "Software\Microsoft\RAS AutoDial"}, 0, 0x0, 0, ... 376, 2, ) }, 0, 0x0, 0, ... 376, 2, ) == 0x0
 04460   396   NtCreateKey  (0x20019, {24, 376, 0x40, 0, 0,  (0x20019, {24, 376, 0x40, 0, 0, "Default"}, 0, 0x0, 0, ... 352, 2, ) }, 0, 0x0, 0, ... 352, 2, ) == 0x0
 04461   396   NtClose  (376, ... ) == 0x0
 04462   396   NtQueryValueKey  (352,  (352, "DefaultInternet", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 04463   396   NtClose  (352, ... ) == 0x0
 04464   396   NtWaitForSingleObject  (156, 0, 0x0, ... ) == 0x0
 04465   396   NtQueryInformationFile  (152, 1242316, 24, Standard, ... {status=0x0, info=24}, ) == 0x0
 04466   396   NtReleaseMutant  (156, ... 0x0, ) == 0x0
 04467   396   NtWaitForSingleObject  (156, 0, 0x0, ... ) == 0x0
 04468   396   NtQueryInformationFile  (152, 1242472, 24, Standard, ... {status=0x0, info=24}, ) == 0x0
 04469   396   NtReleaseMutant  (156, ... 0x0, ) == 0x0
 04470   396   NtReleaseMutant  (200, ... 0x0, ) == 0x0
 04471   396   NtUserGetMessage  (0, 0, 0, ... {0x30062, WM_TIMER, 0x65, 0x0, 0xfaab, {512, 384}}, ) == 0x1
 04472   396   NtWaitForSingleObject  (200, 0, 0x0, ... ) == 0x0
 04473   396   NtWaitForSingleObject  (204, 0, 0x0, ... ) == 0x0
 04474   396   NtReleaseMutant  (204, ... 0x0, ) == 0x0
 04475   396   NtQueryValueKey  (108,  (108, "EnableAutodial", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (108, "EnableAutodial", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) }, 16, ) == 0x0
 04476   396   NtQueryValueKey  (108,  (108, "NoNetAutodial", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (108, "NoNetAutodial", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) }, 16, ) == 0x0
 04477   396   NtCreateKey  (0x2001d, {24, 48, 0x40, 0, 0,  (0x2001d, {24, 48, 0x40, 0, 0, "Software\Microsoft\RAS AutoDial"}, 0, 0x0, 0, ... 352, 2, ) }, 0, 0x0, 0, ... 352, 2, ) == 0x0
 04478   396   NtCreateKey  (0x20019, {24, 352, 0x40, 0, 0,  (0x20019, {24, 352, 0x40, 0, 0, "Default"}, 0, 0x0, 0, ... 376, 2, ) }, 0, 0x0, 0, ... 376, 2, ) == 0x0
 04479   396   NtClose  (352, ... ) == 0x0
 04480   396   NtQueryValueKey  (376,  (376, "DefaultInternet", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 04481   396   NtClose  (376, ... ) == 0x0
 04482   396   NtWaitForSingleObject  (156, 0, 0x0, ... ) == 0x0
 04483   396   NtQueryInformationFile  (152, 1242316, 24, Standard, ... {status=0x0, info=24}, ) == 0x0
 04484   396   NtReleaseMutant  (156, ... 0x0, ) == 0x0
 04485   396   NtWaitForSingleObject  (156, 0, 0x0, ... ) == 0x0
 04486   396   NtQueryInformationFile  (152, 1242472, 24, Standard, ... {status=0x0, info=24}, ) == 0x0
 04487   396   NtReleaseMutant  (156, ... 0x0, ) == 0x0
 04488   396   NtReleaseMutant  (200, ... 0x0, ) == 0x0
 04489   396   NtUserGetMessage  (0, 0, 0, ... {0x30062, WM_TIMER, 0x65, 0x0, 0x1027b, {512, 384}}, ) == 0x1
 04490   396   NtWaitForSingleObject  (200, 0, 0x0, ... ) == 0x0
 04491   396   NtWaitForSingleObject  (204, 0, 0x0, ... ) == 0x0
 04492   396   NtOpenEvent  (0x100000, {24, 52, 0x0, 0, 0,  (0x100000, {24, 52, 0x0, 0, 0, "Global\SvcctrlStartEvent_A3752DX"}, ... 376, ) }, ... 376, ) == 0x0
 04493   396   NtWaitForSingleObject  (376, 0, {-1800000000, -1}, ... ) == 0x0
 04494   396   NtClose  (376, ... ) == 0x0
 04495   396   NtOpenThreadToken  (-2, 0xc, 1, ... ) == STATUS_NO_TOKEN
 04496   396   NtCreateEvent  (0x1f0003, 0x0, 1, 0, ... 376, ) == 0x0
 04497   396   NtOpenThreadToken  (-2, 0xc, 1, ... ) == STATUS_NO_TOKEN
 04498   396   NtSetInformationThread  (-2, ImpersonationToken, {ImpToken=0,}, 4, ... ) == 0x0
 04499   396   NtCreateFile  (0xc0100080, {24, 0, 0x40, 0, 1240896,  (0xc0100080, {24, 0, 0x40, 0, 1240896, "\??\PIPE\svcctl"}, 0x0, 0, 3, 1, 4194368, 0, 0, ... 352, {status=0x0, info=1}, ) }, 0x0, 0, 3, 1, 4194368, 0, 0, ... 352, {status=0x0, info=1}, ) == 0x0
 04500   396   NtSetInformationFile  (352, 1240952, 8, Pipe, ... {status=0x0, info=0}, ) == 0x0
 04501   396   NtSetInformationFile  (352, 1240944, 8, Completion, ... {status=0x0, info=0}, ) == 0x0
 04502   396   NtSetInformationThread  (-2, ImpersonationToken, {ImpToken=0,}, 4, ... ) == 0x0
 04503   396   NtWriteFile  (352, 297, 0, 0,  (352, 297, 0, 0, "\5\0\13\3\20\0\0\0H\0\0\0\1\0\0\0\270\20\270\20\0\0\0\0\1\0\0\0\0\0\1\0\201\273z6D\230\3615\2552\230\3608\0\20\3\2\0\0\0\4]\210\212\353\34\311\21\237\350\10\0+\20H`\2\0\0\0", 72, {0, 0}, 0, ... {status=0x0, info=72}, ) , 72, {0, 0}, 0, ... {status=0x0, info=72}, ) == 0x0
 04504   396   NtReadFile  (352, 297, 0, 0, 1024, {0, 0}, 0, ... {status=0x0, info=68},  (352, 297, 0, 0, 1024, {0, 0}, 0, ... {status=0x0, info=68}, "\5\0\14\3\20\0\0\0D\0\0\0\1\0\0\0\270\20\270\208'\0\0\15\0\PIPE\ntsvcs\0\0\1\0\0\0\0\0\0\0\4]\210\212\353\34\311\21\237\350\10\0+\20H`\2\0\0\0", ) , ) == 0x0
 04505   396   NtFsControlFile  (352, 297, 0x0, 0x0, 0x11c017,  (352, 297, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0$\0\0\0\1\0\0\0\14\0\0\0\0\0\17\0\0\0\0\0\0\0\0\0\0\0\0\200", 36, 1024, ... {status=0x103, info=68}, "\5\0\14\3\20\0\0\0D\0\0\0\1\0\0\0\270\20\270\208'\0\0\15\0\PIPE\ntsvcs\0\0\1\0\0\0\0\0\0\0\4]\210\212\353\34\311\21\237\350\10\0+\20H`\2\0\0\0", ) , 36, 1024, ... {status=0x103, info=68},  (352, 297, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0$\0\0\0\1\0\0\0\14\0\0\0\0\0\17\0\0\0\0\0\0\0\0\0\0\0\0\200", 36, 1024, ... {status=0x103, info=68}, "\5\0\14\3\20\0\0\0D\0\0\0\1\0\0\0\270\20\270\208'\0\0\15\0\PIPE\ntsvcs\0\0\1\0\0\0\0\0\0\0\4]\210\212\353\34\311\21\237\350\10\0+\20H`\2\0\0\0", ) , ) == 0x103
 04506   396   NtFsControlFile  (352, 297, 0x0, 0x0, 0x11c017,  (352, 297, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0L\0\0\0\2\0\0\04\0\0\0\0\0\20\0\0\0\0\0\212\364\220\344\333?\334\21\261\310\0\14)\371\246\305\7\0\0\0\0\0\0\0\7\0\0\0R\0A\0S\0M\0A\0N\0\0\0\0\0\4\0\0\0", 76, 1024, ... {status=0x103, info=48}, "\5\0\2\3\20\0\0\00\0\0\0\1\0\0\0\30\0\0\0\0\0\0\0\0\0\0\0\212\364\220\344\333?\334\21\261\310\0\14)\371\246\305\0\0\0\0", ) , 76, 1024, ... {status=0x103, info=48},  (352, 297, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0L\0\0\0\2\0\0\04\0\0\0\0\0\20\0\0\0\0\0\212\364\220\344\333?\334\21\261\310\0\14)\371\246\305\7\0\0\0\0\0\0\0\7\0\0\0R\0A\0S\0M\0A\0N\0\0\0\0\0\4\0\0\0", 76, 1024, ... {status=0x103, info=48}, "\5\0\2\3\20\0\0\00\0\0\0\1\0\0\0\30\0\0\0\0\0\0\0\0\0\0\0\212\364\220\344\333?\334\21\261\310\0\14)\371\246\305\0\0\0\0", ) , ) == 0x103
 04507   396   NtFsControlFile  (352, 297, 0x0, 0x0, 0x11c017,  (352, 297, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0,\0\0\0\3\0\0\0\24\0\0\0\0\0\6\0\0\0\0\0\213\364\220\344\333?\334\21\261\310\0\14)\371\246\305", 44, 1024, ... {status=0x103, info=48}, "\5\0\2\3\20\0\0\00\0\0\0\2\0\0\0\30\0\0\0\0\0\0\0\0\0\0\0\213\364\220\344\333?\334\21\261\310\0\14)\371\246\305\0\0\0\0", ) , 44, 1024, ... {status=0x103, info=48},  (352, 297, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0,\0\0\0\3\0\0\0\24\0\0\0\0\0\6\0\0\0\0\0\213\364\220\344\333?\334\21\261\310\0\14)\371\246\305", 44, 1024, ... {status=0x103, info=48}, "\5\0\2\3\20\0\0\00\0\0\0\2\0\0\0\30\0\0\0\0\0\0\0\0\0\0\0\213\364\220\344\333?\334\21\261\310\0\14)\371\246\305\0\0\0\0", ) , ) == 0x103
 04508   396   NtFsControlFile  (352, 297, 0x0, 0x0, 0x11c017,  (352, 297, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0,\0\0\0\4\0\0\0\24\0\0\0\0\0\0\0\0\0\0\0\213\364\220\344\333?\334\21\261\310\0\14)\371\246\305", 44, 1024, ... {status=0x103, info=56}, "\5\0\2\3\20\0\0\08\0\0\0\3\0\0\0 \0\0\0\0\0\0\0 \0\0\0\1\0\0\0\0\0\0\05\4\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0", ) , 44, 1024, ... {status=0x103, info=56},  (352, 297, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0,\0\0\0\4\0\0\0\24\0\0\0\0\0\0\0\0\0\0\0\213\364\220\344\333?\334\21\261\310\0\14)\371\246\305", 44, 1024, ... {status=0x103, info=56}, "\5\0\2\3\20\0\0\08\0\0\0\3\0\0\0 \0\0\0\0\0\0\0 \0\0\0\1\0\0\0\0\0\0\05\4\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0", ) , ) == 0x103
 04509   396   NtFsControlFile  (352, 297, 0x0, 0x0, 0x11c017,  (352, 297, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0,\0\0\0\5\0\0\0\24\0\0\0\0\0\0\0\0\0\0\0\212\364\220\344\333?\334\21\261\310\0\14)\371\246\305", 44, 1024, ... {status=0x103, info=48}, "\5\0\2\3\20\0\0\00\0\0\0\4\0\0\0\30\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0", ) , 44, 1024, ... {status=0x103, info=48},  (352, 297, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0,\0\0\0\5\0\0\0\24\0\0\0\0\0\0\0\0\0\0\0\212\364\220\344\333?\334\21\261\310\0\14)\371\246\305", 44, 1024, ... {status=0x103, info=48}, "\5\0\2\3\20\0\0\00\0\0\0\4\0\0\0\30\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0", ) , ) == 0x103
 04510   396   NtClose  (376, ... ) == 0x0
 04511   396   NtClose  (352, ... ) == 0x0
 04512   396   NtReleaseMutant  (204, ... 0x0, ) == 0x0
 04513   396   NtQueryValueKey  (108,  (108, "EnableAutodial", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (108, "EnableAutodial", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) }, 16, ) == 0x0
 04514   396   NtQueryValueKey  (108,  (108, "NoNetAutodial", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (108, "NoNetAutodial", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) }, 16, ) == 0x0
 04515   396   NtCreateKey  (0x2001d, {24, 48, 0x40, 0, 0,  (0x2001d, {24, 48, 0x40, 0, 0, "Software\Microsoft\RAS AutoDial"}, 0, 0x0, 0, ... 352, 2, ) }, 0, 0x0, 0, ... 352, 2, ) == 0x0
 04516   396   NtCreateKey  (0x20019, {24, 352, 0x40, 0, 0,  (0x20019, {24, 352, 0x40, 0, 0, "Default"}, 0, 0x0, 0, ... 376, 2, ) }, 0, 0x0, 0, ... 376, 2, ) == 0x0
 04517   396   NtClose  (352, ... ) == 0x0
 04518   396   NtQueryValueKey  (376,  (376, "DefaultInternet", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 04519   396   NtClose  (376, ... ) == 0x0
 04520   396   NtWaitForSingleObject  (156, 0, 0x0, ... ) == 0x0
 04521   396   NtQueryInformationFile  (152, 1242316, 24, Standard, ... {status=0x0, info=24}, ) == 0x0
 04522   396   NtReleaseMutant  (156, ... 0x0, ) == 0x0
 04523   396   NtWaitForSingleObject  (156, 0, 0x0, ... ) == 0x0
 04524   396   NtQueryInformationFile  (152, 1242472, 24, Standard, ... {status=0x0, info=24}, ) == 0x0
 04525   396   NtReleaseMutant  (156, ... 0x0, ) == 0x0
 04526   396   NtReleaseMutant  (200, ... 0x0, ) == 0x0
 04527   396   NtUserGetMessage  (0, 0, 0, ... {0x30062, WM_TIMER, 0x65, 0x0, 0x10a4b, {512, 384}}, ) == 0x1
 04528   396   NtWaitForSingleObject  (200, 0, 0x0, ... ) == 0x0
 04529   396   NtWaitForSingleObject  (204, 0, 0x0, ... ) == 0x0
 04530   396   NtReleaseMutant  (204, ... 0x0, ) == 0x0
 04531   396   NtQueryValueKey  (108,  (108, "EnableAutodial", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (108, "EnableAutodial", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) }, 16, ) == 0x0
 04532   396   NtQueryValueKey  (108,  (108, "NoNetAutodial", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (108, "NoNetAutodial", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) }, 16, ) == 0x0
 04533   396   NtCreateKey  (0x2001d, {24, 48, 0x40, 0, 0,  (0x2001d, {24, 48, 0x40, 0, 0, "Software\Microsoft\RAS AutoDial"}, 0, 0x0, 0, ... 376, 2, ) }, 0, 0x0, 0, ... 376, 2, ) == 0x0
 04534   396   NtCreateKey  (0x20019, {24, 376, 0x40, 0, 0,  (0x20019, {24, 376, 0x40, 0, 0, "Default"}, 0, 0x0, 0, ... 352, 2, ) }, 0, 0x0, 0, ... 352, 2, ) == 0x0
 04535   396   NtClose  (376, ... ) == 0x0
 04536   396   NtQueryValueKey  (352,  (352, "DefaultInternet", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 04537   396   NtClose  (352, ... ) == 0x0
 04538   396   NtWaitForSingleObject  (156, 0, 0x0, ... ) == 0x0
 04539   396   NtQueryInformationFile  (152, 1242316, 24, Standard, ... {status=0x0, info=24}, ) == 0x0
 04540   396   NtReleaseMutant  (156, ... 0x0, ) == 0x0
 04541   396   NtWaitForSingleObject  (156, 0, 0x0, ... ) == 0x0
 04542   396   NtQueryInformationFile  (152, 1242472, 24, Standard, ... {status=0x0, info=24}, ) == 0x0
 04543   396   NtReleaseMutant  (156, ... 0x0, ) == 0x0
 04544   396   NtReleaseMutant  (200, ... 0x0, ) == 0x0
 04545   396   NtUserGetMessage  (0, 0, 0, ... {0x30062, WM_TIMER, 0x65, 0x0, 0x1121b, {512, 384}}, ) == 0x1
 04546   396   NtWaitForSingleObject  (200, 0, 0x0, ... ) == 0x0
 04547   396   NtWaitForSingleObject  (204, 0, 0x0, ... ) == 0x0
 04548   396   NtOpenEvent  (0x100000, {24, 52, 0x0, 0, 0,  (0x100000, {24, 52, 0x0, 0, 0, "Global\SvcctrlStartEvent_A3752DX"}, ... 352, ) }, ... 352, ) == 0x0
 04549   396   NtWaitForSingleObject  (352, 0, {-1800000000, -1}, ... ) == 0x0
 04550   396   NtClose  (352, ... ) == 0x0
 04551   396   NtOpenThreadToken  (-2, 0xc, 1, ... ) == STATUS_NO_TOKEN
 04552   396   NtCreateEvent  (0x1f0003, 0x0, 1, 0, ... 352, ) == 0x0
 04553   396   NtOpenThreadToken  (-2, 0xc, 1, ... ) == STATUS_NO_TOKEN
 04554   396   NtSetInformationThread  (-2, ImpersonationToken, {ImpToken=0,}, 4, ... ) == 0x0
 04555   396   NtCreateFile  (0xc0100080, {24, 0, 0x40, 0, 1240896,  (0xc0100080, {24, 0, 0x40, 0, 1240896, "\??\PIPE\svcctl"}, 0x0, 0, 3, 1, 4194368, 0, 0, ... 376, {status=0x0, info=1}, ) }, 0x0, 0, 3, 1, 4194368, 0, 0, ... 376, {status=0x0, info=1}, ) == 0x0
 04556   396   NtSetInformationFile  (376, 1240952, 8, Pipe, ... {status=0x0, info=0}, ) == 0x0
 04557   396   NtSetInformationFile  (376, 1240944, 8, Completion, ... {status=0x0, info=0}, ) == 0x0
 04558   396   NtSetInformationThread  (-2, ImpersonationToken, {ImpToken=0,}, 4, ... ) == 0x0
 04559   396   NtWriteFile  (376, 297, 0, 0,  (376, 297, 0, 0, "\5\0\13\3\20\0\0\0H\0\0\0\1\0\0\0\270\20\270\20\0\0\0\0\1\0\0\0\0\0\1\0\201\273z6D\230\3615\2552\230\3608\0\20\3\2\0\0\0\4]\210\212\353\34\311\21\237\350\10\0+\20H`\2\0\0\0", 72, {0, 0}, 0, ... {status=0x0, info=72}, ) , 72, {0, 0}, 0, ... {status=0x0, info=72}, ) == 0x0
 04560   396   NtReadFile  (376, 297, 0, 0, 1024, {0, 0}, 0, ... {status=0x0, info=68},  (376, 297, 0, 0, 1024, {0, 0}, 0, ... {status=0x0, info=68}, "\5\0\14\3\20\0\0\0D\0\0\0\1\0\0\0\270\20\270\209'\0\0\15\0\PIPE\ntsvcs\0\0\1\0\0\0\0\0\0\0\4]\210\212\353\34\311\21\237\350\10\0+\20H`\2\0\0\0", ) , ) == 0x0
 04561   396   NtFsControlFile  (376, 297, 0x0, 0x0, 0x11c017,  (376, 297, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0$\0\0\0\1\0\0\0\14\0\0\0\0\0\17\0\0\0\0\0\0\0\0\0\0\0\0\200", 36, 1024, ... {status=0x103, info=68}, "\5\0\14\3\20\0\0\0D\0\0\0\1\0\0\0\270\20\270\209'\0\0\15\0\PIPE\ntsvcs\0\0\1\0\0\0\0\0\0\0\4]\210\212\353\34\311\21\237\350\10\0+\20H`\2\0\0\0", ) , 36, 1024, ... {status=0x103, info=68},  (376, 297, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0$\0\0\0\1\0\0\0\14\0\0\0\0\0\17\0\0\0\0\0\0\0\0\0\0\0\0\200", 36, 1024, ... {status=0x103, info=68}, "\5\0\14\3\20\0\0\0D\0\0\0\1\0\0\0\270\20\270\209'\0\0\15\0\PIPE\ntsvcs\0\0\1\0\0\0\0\0\0\0\4]\210\212\353\34\311\21\237\350\10\0+\20H`\2\0\0\0", ) , ) == 0x103
 04562   396   NtFsControlFile  (376, 297, 0x0, 0x0, 0x11c017,  (376, 297, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0L\0\0\0\2\0\0\04\0\0\0\0\0\20\0\0\0\0\0\214\364\220\344\333?\334\21\261\310\0\14)\371\246\305\7\0\0\0\0\0\0\0\7\0\0\0R\0A\0S\0M\0A\0N\0\0\0\0\0\4\0\0\0", 76, 1024, ... {status=0x103, info=48}, "\5\0\2\3\20\0\0\00\0\0\0\1\0\0\0\30\0\0\0\0\0\0\0\0\0\0\0\214\364\220\344\333?\334\21\261\310\0\14)\371\246\305\0\0\0\0", ) , 76, 1024, ... {status=0x103, info=48},  (376, 297, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0L\0\0\0\2\0\0\04\0\0\0\0\0\20\0\0\0\0\0\214\364\220\344\333?\334\21\261\310\0\14)\371\246\305\7\0\0\0\0\0\0\0\7\0\0\0R\0A\0S\0M\0A\0N\0\0\0\0\0\4\0\0\0", 76, 1024, ... {status=0x103, info=48}, "\5\0\2\3\20\0\0\00\0\0\0\1\0\0\0\30\0\0\0\0\0\0\0\0\0\0\0\214\364\220\344\333?\334\21\261\310\0\14)\371\246\305\0\0\0\0", ) , ) == 0x103
 04563   396   NtFsControlFile  (376, 297, 0x0, 0x0, 0x11c017,  (376, 297, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0,\0\0\0\3\0\0\0\24\0\0\0\0\0\6\0\0\0\0\0\215\364\220\344\333?\334\21\261\310\0\14)\371\246\305", 44, 1024, ... {status=0x103, info=48}, "\5\0\2\3\20\0\0\00\0\0\0\2\0\0\0\30\0\0\0\0\0\0\0\0\0\0\0\215\364\220\344\333?\334\21\261\310\0\14)\371\246\305\0\0\0\0", ) , 44, 1024, ... {status=0x103, info=48},  (376, 297, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0,\0\0\0\3\0\0\0\24\0\0\0\0\0\6\0\0\0\0\0\215\364\220\344\333?\334\21\261\310\0\14)\371\246\305", 44, 1024, ... {status=0x103, info=48}, "\5\0\2\3\20\0\0\00\0\0\0\2\0\0\0\30\0\0\0\0\0\0\0\0\0\0\0\215\364\220\344\333?\334\21\261\310\0\14)\371\246\305\0\0\0\0", ) , ) == 0x103
 04564   396   NtFsControlFile  (376, 297, 0x0, 0x0, 0x11c017,  (376, 297, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0,\0\0\0\4\0\0\0\24\0\0\0\0\0\0\0\0\0\0\0\215\364\220\344\333?\334\21\261\310\0\14)\371\246\305", 44, 1024, ... {status=0x103, info=56}, "\5\0\2\3\20\0\0\08\0\0\0\3\0\0\0 \0\0\0\0\0\0\0 \0\0\0\1\0\0\0\0\0\0\05\4\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0", ) , 44, 1024, ... {status=0x103, info=56},  (376, 297, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0,\0\0\0\4\0\0\0\24\0\0\0\0\0\0\0\0\0\0\0\215\364\220\344\333?\334\21\261\310\0\14)\371\246\305", 44, 1024, ... {status=0x103, info=56}, "\5\0\2\3\20\0\0\08\0\0\0\3\0\0\0 \0\0\0\0\0\0\0 \0\0\0\1\0\0\0\0\0\0\05\4\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0", ) , ) == 0x103
 04565   396   NtFsControlFile  (376, 297, 0x0, 0x0, 0x11c017,  (376, 297, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0,\0\0\0\5\0\0\0\24\0\0\0\0\0\0\0\0\0\0\0\214\364\220\344\333?\334\21\261\310\0\14)\371\246\305", 44, 1024, ... {status=0x103, info=48}, "\5\0\2\3\20\0\0\00\0\0\0\4\0\0\0\30\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0", ) , 44, 1024, ... {status=0x103, info=48},  (376, 297, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0,\0\0\0\5\0\0\0\24\0\0\0\0\0\0\0\0\0\0\0\214\364\220\344\333?\334\21\261\310\0\14)\371\246\305", 44, 1024, ... {status=0x103, info=48}, "\5\0\2\3\20\0\0\00\0\0\0\4\0\0\0\30\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0", ) , ) == 0x103
 04566   396   NtClose  (352, ... ) == 0x0
 04567   396   NtClose  (376, ... ) == 0x0
 04568   396   NtReleaseMutant  (204, ... 0x0, ) == 0x0
 04569   396   NtQueryValueKey  (108,  (108, "EnableAutodial", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (108, "EnableAutodial", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) }, 16, ) == 0x0
 04570   396   NtQueryValueKey  (108,  (108, "NoNetAutodial", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (108, "NoNetAutodial", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) }, 16, ) == 0x0
 04571   396   NtCreateKey  (0x2001d, {24, 48, 0x40, 0, 0,  (0x2001d, {24, 48, 0x40, 0, 0, "Software\Microsoft\RAS AutoDial"}, 0, 0x0, 0, ... 376, 2, ) }, 0, 0x0, 0, ... 376, 2, ) == 0x0
 04572   396   NtCreateKey  (0x20019, {24, 376, 0x40, 0, 0,  (0x20019, {24, 376, 0x40, 0, 0, "Default"}, 0, 0x0, 0, ... 352, 2, ) }, 0, 0x0, 0, ... 352, 2, ) == 0x0
 04573   396   NtClose  (376, ... ) == 0x0
 04574   396   NtQueryValueKey  (352,  (352, "DefaultInternet", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 04575   396   NtClose  (352, ... ) == 0x0
 04576   396   NtWaitForSingleObject  (156, 0, 0x0, ... ) == 0x0
 04577   396   NtQueryInformationFile  (152, 1242316, 24, Standard, ... {status=0x0, info=24}, ) == 0x0
 04578   396   NtReleaseMutant  (156, ... 0x0, ) == 0x0
 04579   396   NtWaitForSingleObject  (156, 0, 0x0, ... ) == 0x0
 04580   396   NtQueryInformationFile  (152, 1242472, 24, Standard, ... {status=0x0, info=24}, ) == 0x0
 04581   396   NtReleaseMutant  (156, ... 0x0, ) == 0x0
 04582   396   NtReleaseMutant  (200, ... 0x0, ) == 0x0
 04583   396   NtUserGetMessage  (0, 0, 0, ... {0x30062, WM_TIMER, 0x65, 0x0, 0x119eb, {512, 384}}, ) == 0x1
 04584   396   NtWaitForSingleObject  (200, 0, 0x0, ... ) == 0x0
 04585   396   NtWaitForSingleObject  (204, 0, 0x0, ... ) == 0x0
 04586   396   NtReleaseMutant  (204, ... 0x0, ) == 0x0
 04587   396   NtQueryValueKey  (108,  (108, "EnableAutodial", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (108, "EnableAutodial", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) }, 16, ) == 0x0
 04588   396   NtQueryValueKey  (108,  (108, "NoNetAutodial", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (108, "NoNetAutodial", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) }, 16, ) == 0x0
 04589   396   NtCreateKey  (0x2001d, {24, 48, 0x40, 0, 0,  (0x2001d, {24, 48, 0x40, 0, 0, "Software\Microsoft\RAS AutoDial"}, 0, 0x0, 0, ... 352, 2, ) }, 0, 0x0, 0, ... 352, 2, ) == 0x0
 04590   396   NtCreateKey  (0x20019, {24, 352, 0x40, 0, 0,  (0x20019, {24, 352, 0x40, 0, 0, "Default"}, 0, 0x0, 0, ... 376, 2, ) }, 0, 0x0, 0, ... 376, 2, ) == 0x0
 04591   396   NtClose  (352, ... ) == 0x0
 04592   396   NtQueryValueKey  (376,  (376, "DefaultInternet", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 04593   396   NtClose  (376, ... ) == 0x0
 04594   396   NtWaitForSingleObject  (156, 0, 0x0, ... ) == 0x0
 04595   396   NtQueryInformationFile  (152, 1242316, 24, Standard, ... {status=0x0, info=24}, ) == 0x0
 04596   396   NtReleaseMutant  (156, ... 0x0, ) == 0x0
 04597   396   NtWaitForSingleObject  (156, 0, 0x0, ... ) == 0x0
 04598   396   NtQueryInformationFile  (152, 1242472, 24, Standard, ... {status=0x0, info=24}, ) == 0x0
 04599   396   NtReleaseMutant  (156, ... 0x0, ) == 0x0
 04600   396   NtReleaseMutant  (200, ... 0x0, ) == 0x0
 04601   396   NtUserGetMessage  (0, 0, 0, ... {0x30062, WM_TIMER, 0x65, 0x0, 0x121bb, {512, 384}}, ) == 0x1
 04602   396   NtWaitForSingleObject  (200, 0, 0x0, ... ) == 0x0
 04603   396   NtWaitForSingleObject  (204, 0, 0x0, ... ) == 0x0
 04604   396   NtOpenEvent  (0x100000, {24, 52, 0x0, 0, 0,  (0x100000, {24, 52, 0x0, 0, 0, "Global\SvcctrlStartEvent_A3752DX"}, ... 376, ) }, ... 376, ) == 0x0
 04605   396   NtWaitForSingleObject  (376, 0, {-1800000000, -1}, ... ) == 0x0
 04606   396   NtClose  (376, ... ) == 0x0
 04607   396   NtOpenThreadToken  (-2, 0xc, 1, ... ) == STATUS_NO_TOKEN
 04608   396   NtCreateEvent  (0x1f0003, 0x0, 1, 0, ... 376, ) == 0x0
 04609   396   NtOpenThreadToken  (-2, 0xc, 1, ... ) == STATUS_NO_TOKEN
 04610   396   NtSetInformationThread  (-2, ImpersonationToken, {ImpToken=0,}, 4, ... ) == 0x0
 04611   396   NtCreateFile  (0xc0100080, {24, 0, 0x40, 0, 1240896,  (0xc0100080, {24, 0, 0x40, 0, 1240896, "\??\PIPE\svcctl"}, 0x0, 0, 3, 1, 4194368, 0, 0, ... 352, {status=0x0, info=1}, ) }, 0x0, 0, 3, 1, 4194368, 0, 0, ... 352, {status=0x0, info=1}, ) == 0x0
 04612   396   NtSetInformationFile  (352, 1240952, 8, Pipe, ... {status=0x0, info=0}, ) == 0x0
 04613   396   NtSetInformationFile  (352, 1240944, 8, Completion, ... {status=0x0, info=0}, ) == 0x0
 04614   396   NtSetInformationThread  (-2, ImpersonationToken, {ImpToken=0,}, 4, ... ) == 0x0
 04615   396   NtWriteFile  (352, 297, 0, 0,  (352, 297, 0, 0, "\5\0\13\3\20\0\0\0H\0\0\0\1\0\0\0\270\20\270\20\0\0\0\0\1\0\0\0\0\0\1\0\201\273z6D\230\3615\2552\230\3608\0\20\3\2\0\0\0\4]\210\212\353\34\311\21\237\350\10\0+\20H`\2\0\0\0", 72, {0, 0}, 0, ... {status=0x0, info=72}, ) , 72, {0, 0}, 0, ... {status=0x0, info=72}, ) == 0x0
 04616   396   NtReadFile  (352, 297, 0, 0, 1024, {0, 0}, 0, ... {status=0x0, info=68},  (352, 297, 0, 0, 1024, {0, 0}, 0, ... {status=0x0, info=68}, "\5\0\14\3\20\0\0\0D\0\0\0\1\0\0\0\270\20\270\20;'\0\0\15\0\PIPE\ntsvcs\0\0\1\0\0\0\0\0\0\0\4]\210\212\353\34\311\21\237\350\10\0+\20H`\2\0\0\0", ) , ) == 0x0
 04617   396   NtFsControlFile  (352, 297, 0x0, 0x0, 0x11c017,  (352, 297, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0$\0\0\0\1\0\0\0\14\0\0\0\0\0\17\0\0\0\0\0\0\0\0\0\0\0\0\200", 36, 1024, ... {status=0x103, info=68}, "\5\0\14\3\20\0\0\0D\0\0\0\1\0\0\0\270\20\270\20;'\0\0\15\0\PIPE\ntsvcs\0\0\1\0\0\0\0\0\0\0\4]\210\212\353\34\311\21\237\350\10\0+\20H`\2\0\0\0", ) , 36, 1024, ... {status=0x103, info=68},  (352, 297, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0$\0\0\0\1\0\0\0\14\0\0\0\0\0\17\0\0\0\0\0\0\0\0\0\0\0\0\200", 36, 1024, ... {status=0x103, info=68}, "\5\0\14\3\20\0\0\0D\0\0\0\1\0\0\0\270\20\270\20;'\0\0\15\0\PIPE\ntsvcs\0\0\1\0\0\0\0\0\0\0\4]\210\212\353\34\311\21\237\350\10\0+\20H`\2\0\0\0", ) , ) == 0x103
 04618   396   NtFsControlFile  (352, 297, 0x0, 0x0, 0x11c017,  (352, 297, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0L\0\0\0\2\0\0\04\0\0\0\0\0\20\0\0\0\0\0\220\364\220\344\333?\334\21\261\310\0\14)\371\246\305\7\0\0\0\0\0\0\0\7\0\0\0R\0A\0S\0M\0A\0N\0\0\0\0\0\4\0\0\0", 76, 1024, ... {status=0x103, info=48}, "\5\0\2\3\20\0\0\00\0\0\0\1\0\0\0\30\0\0\0\0\0\0\0\0\0\0\0\220\364\220\344\333?\334\21\261\310\0\14)\371\246\305\0\0\0\0", ) , 76, 1024, ... {status=0x103, info=48},  (352, 297, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0L\0\0\0\2\0\0\04\0\0\0\0\0\20\0\0\0\0\0\220\364\220\344\333?\334\21\261\310\0\14)\371\246\305\7\0\0\0\0\0\0\0\7\0\0\0R\0A\0S\0M\0A\0N\0\0\0\0\0\4\0\0\0", 76, 1024, ... {status=0x103, info=48}, "\5\0\2\3\20\0\0\00\0\0\0\1\0\0\0\30\0\0\0\0\0\0\0\0\0\0\0\220\364\220\344\333?\334\21\261\310\0\14)\371\246\305\0\0\0\0", ) , ) == 0x103
 04619   396   NtFsControlFile  (352, 297, 0x0, 0x0, 0x11c017,  (352, 297, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0,\0\0\0\3\0\0\0\24\0\0\0\0\0\6\0\0\0\0\0\221\364\220\344\333?\334\21\261\310\0\14)\371\246\305", 44, 1024, ... {status=0x103, info=48}, "\5\0\2\3\20\0\0\00\0\0\0\2\0\0\0\30\0\0\0\0\0\0\0\0\0\0\0\221\364\220\344\333?\334\21\261\310\0\14)\371\246\305\0\0\0\0", ) , 44, 1024, ... {status=0x103, info=48},  (352, 297, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0,\0\0\0\3\0\0\0\24\0\0\0\0\0\6\0\0\0\0\0\221\364\220\344\333?\334\21\261\310\0\14)\371\246\305", 44, 1024, ... {status=0x103, info=48}, "\5\0\2\3\20\0\0\00\0\0\0\2\0\0\0\30\0\0\0\0\0\0\0\0\0\0\0\221\364\220\344\333?\334\21\261\310\0\14)\371\246\305\0\0\0\0", ) , ) == 0x103
 04620   396   NtFsControlFile  (352, 297, 0x0, 0x0, 0x11c017,  (352, 297, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0,\0\0\0\4\0\0\0\24\0\0\0\0\0\0\0\0\0\0\0\221\364\220\344\333?\334\21\261\310\0\14)\371\246\305", 44, 1024, ... {status=0x103, info=56}, "\5\0\2\3\20\0\0\08\0\0\0\3\0\0\0 \0\0\0\0\0\0\0 \0\0\0\1\0\0\0\0\0\0\05\4\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0", ) , 44, 1024, ... {status=0x103, info=56},  (352, 297, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0,\0\0\0\4\0\0\0\24\0\0\0\0\0\0\0\0\0\0\0\221\364\220\344\333?\334\21\261\310\0\14)\371\246\305", 44, 1024, ... {status=0x103, info=56}, "\5\0\2\3\20\0\0\08\0\0\0\3\0\0\0 \0\0\0\0\0\0\0 \0\0\0\1\0\0\0\0\0\0\05\4\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0", ) , ) == 0x103
 04621   396   NtFsControlFile  (352, 297, 0x0, 0x0, 0x11c017,  (352, 297, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0,\0\0\0\5\0\0\0\24\0\0\0\0\0\0\0\0\0\0\0\220\364\220\344\333?\334\21\261\310\0\14)\371\246\305", 44, 1024, ... {status=0x103, info=48}, "\5\0\2\3\20\0\0\00\0\0\0\4\0\0\0\30\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0", ) , 44, 1024, ... {status=0x103, info=48},  (352, 297, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0,\0\0\0\5\0\0\0\24\0\0\0\0\0\0\0\0\0\0\0\220\364\220\344\333?\334\21\261\310\0\14)\371\246\305", 44, 1024, ... {status=0x103, info=48}, "\5\0\2\3\20\0\0\00\0\0\0\4\0\0\0\30\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0", ) , ) == 0x103
 04622   396   NtClose  (376, ... ) == 0x0
 04623   396   NtClose  (352, ... ) == 0x0
 04624   396   NtReleaseMutant  (204, ... 0x0, ) == 0x0
 04625   396   NtQueryValueKey  (108,  (108, "EnableAutodial", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (108, "EnableAutodial", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) }, 16, ) == 0x0
 04626   396   NtQueryValueKey  (108,  (108, "NoNetAutodial", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (108, "NoNetAutodial", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) }, 16, ) == 0x0
 04627   396   NtCreateKey  (0x2001d, {24, 48, 0x40, 0, 0,  (0x2001d, {24, 48, 0x40, 0, 0, "Software\Microsoft\RAS AutoDial"}, 0, 0x0, 0, ... 352, 2, ) }, 0, 0x0, 0, ... 352, 2, ) == 0x0
 04628   396   NtCreateKey  (0x20019, {24, 352, 0x40, 0, 0,  (0x20019, {24, 352, 0x40, 0, 0, "Default"}, 0, 0x0, 0, ... 376, 2, ) }, 0, 0x0, 0, ... 376, 2, ) == 0x0
 04629   396   NtClose  (352, ... ) == 0x0
 04630   396   NtQueryValueKey  (376,  (376, "DefaultInternet", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 04631   396   NtClose  (376, ... ) == 0x0
 04632   396   NtWaitForSingleObject  (156, 0, 0x0, ... ) == 0x0
 04633   396   NtQueryInformationFile  (152, 1242316, 24, Standard, ... {status=0x0, info=24}, ) == 0x0
 04634   396   NtReleaseMutant  (156, ... 0x0, ) == 0x0
 04635   396   NtWaitForSingleObject  (156, 0, 0x0, ... ) == 0x0
 04636   396   NtQueryInformationFile  (152, 1242472, 24, Standard, ... {status=0x0, info=24}, ) == 0x0
 04637   396   NtReleaseMutant  (156, ... 0x0, ) == 0x0
 04638   396   NtReleaseMutant  (200, ... 0x0, ) == 0x0
 04639   396   NtUserGetMessage  (0, 0, 0, ... {0x30062, WM_TIMER, 0x65, 0x0, 0x1298b, {512, 384}}, ) == 0x1
 04640   396   NtWaitForSingleObject  (200, 0, 0x0, ... ) == 0x0
 04641   396   NtWaitForSingleObject  (204, 0, 0x0, ... ) == 0x0
 04642   396   NtReleaseMutant  (204, ... 0x0, ) == 0x0
 04643   396   NtQueryValueKey  (108,  (108, "EnableAutodial", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (108, "EnableAutodial", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) }, 16, ) == 0x0
 04644   396   NtQueryValueKey  (108,  (108, "NoNetAutodial", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (108, "NoNetAutodial", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) }, 16, ) == 0x0
 04645   396   NtCreateKey  (0x2001d, {24, 48, 0x40, 0, 0,  (0x2001d, {24, 48, 0x40, 0, 0, "Software\Microsoft\RAS AutoDial"}, 0, 0x0, 0, ... 376, 2, ) }, 0, 0x0, 0, ... 376, 2, ) == 0x0
 04646   396   NtCreateKey  (0x20019, {24, 376, 0x40, 0, 0,  (0x20019, {24, 376, 0x40, 0, 0, "Default"}, 0, 0x0, 0, ... 352, 2, ) }, 0, 0x0, 0, ... 352, 2, ) == 0x0
 04647   396   NtClose  (376, ... ) == 0x0
 04648   396   NtQueryValueKey  (352,  (352, "DefaultInternet", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 04649   396   NtClose  (352, ... ) == 0x0
 04650   396   NtWaitForSingleObject  (156, 0, 0x0, ... ) == 0x0
 04651   396   NtQueryInformationFile  (152, 1242316, 24, Standard, ... {status=0x0, info=24}, ) == 0x0
 04652   396   NtReleaseMutant  (156, ... 0x0, ) == 0x0
 04653   396   NtWaitForSingleObject  (156, 0, 0x0, ... ) == 0x0
 04654   396   NtQueryInformationFile  (152, 1242472, 24, Standard, ... {status=0x0, info=24}, ) == 0x0
 04655   396   NtReleaseMutant  (156, ... 0x0, ) == 0x0
 04656   396   NtReleaseMutant  (200, ... 0x0, ) == 0x0
 04657   396   NtUserGetMessage  (0, 0, 0, ... {0x30062, WM_TIMER, 0x65, 0x0, 0x1315b, {512, 384}}, ) == 0x1
 04658   396   NtWaitForSingleObject  (200, 0, 0x0, ... ) == 0x0
 04659   396   NtWaitForSingleObject  (204, 0, 0x0, ... ) == 0x0
 04660   396   NtOpenEvent  (0x100000, {24, 52, 0x0, 0, 0,  (0x100000, {24, 52, 0x0, 0, 0, "Global\SvcctrlStartEvent_A3752DX"}, ... 352, ) }, ... 352, ) == 0x0
 04661   396   NtWaitForSingleObject  (352, 0, {-1800000000, -1}, ... ) == 0x0
 04662   396   NtClose  (352, ... ) == 0x0
 04663   396   NtOpenThreadToken  (-2, 0xc, 1, ... ) == STATUS_NO_TOKEN
 04664   396   NtCreateEvent  (0x1f0003, 0x0, 1, 0, ... 352, ) == 0x0
 04665   396   NtOpenThreadToken  (-2, 0xc, 1, ... ) == STATUS_NO_TOKEN
 04666   396   NtSetInformationThread  (-2, ImpersonationToken, {ImpToken=0,}, 4, ... ) == 0x0
 04667   396   NtCreateFile  (0xc0100080, {24, 0, 0x40, 0, 1240896,  (0xc0100080, {24, 0, 0x40, 0, 1240896, "\??\PIPE\svcctl"}, 0x0, 0, 3, 1, 4194368, 0, 0, ... 376, {status=0x0, info=1}, ) }, 0x0, 0, 3, 1, 4194368, 0, 0, ... 376, {status=0x0, info=1}, ) == 0x0
 04668   396   NtSetInformationFile  (376, 1240952, 8, Pipe, ... {status=0x0, info=0}, ) == 0x0
 04669   396   NtSetInformationFile  (376, 1240944, 8, Completion, ... {status=0x0, info=0}, ) == 0x0
 04670   396   NtSetInformationThread  (-2, ImpersonationToken, {ImpToken=0,}, 4, ... ) == 0x0
 04671   396   NtWriteFile  (376, 297, 0, 0,  (376, 297, 0, 0, "\5\0\13\3\20\0\0\0H\0\0\0\1\0\0\0\270\20\270\20\0\0\0\0\1\0\0\0\0\0\1\0\201\273z6D\230\3615\2552\230\3608\0\20\3\2\0\0\0\4]\210\212\353\34\311\21\237\350\10\0+\20H`\2\0\0\0", 72, {0, 0}, 0, ... {status=0x0, info=72}, ) , 72, {0, 0}, 0, ... {status=0x0, info=72}, ) == 0x0
 04672   396   NtReadFile  (376, 297, 0, 0, 1024, {0, 0}, 0, ... {status=0x0, info=68},  (376, 297, 0, 0, 1024, {0, 0}, 0, ... {status=0x0, info=68}, "\5\0\14\3\20\0\0\0D\0\0\0\1\0\0\0\270\20\270\20='\0\0\15\0\PIPE\ntsvcs\0\0\1\0\0\0\0\0\0\0\4]\210\212\353\34\311\21\237\350\10\0+\20H`\2\0\0\0", ) , ) == 0x0
 04673   396   NtFsControlFile  (376, 297, 0x0, 0x0, 0x11c017,  (376, 297, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0$\0\0\0\1\0\0\0\14\0\0\0\0\0\17\0\0\0\0\0\0\0\0\0\0\0\0\200", 36, 1024, ... {status=0x103, info=68}, "\5\0\14\3\20\0\0\0D\0\0\0\1\0\0\0\270\20\270\20='\0\0\15\0\PIPE\ntsvcs\0\0\1\0\0\0\0\0\0\0\4]\210\212\353\34\311\21\237\350\10\0+\20H`\2\0\0\0", ) , 36, 1024, ... {status=0x103, info=68},  (376, 297, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0$\0\0\0\1\0\0\0\14\0\0\0\0\0\17\0\0\0\0\0\0\0\0\0\0\0\0\200", 36, 1024, ... {status=0x103, info=68}, "\5\0\14\3\20\0\0\0D\0\0\0\1\0\0\0\270\20\270\20='\0\0\15\0\PIPE\ntsvcs\0\0\1\0\0\0\0\0\0\0\4]\210\212\353\34\311\21\237\350\10\0+\20H`\2\0\0\0", ) , ) == 0x103
 04674   396   NtFsControlFile  (376, 297, 0x0, 0x0, 0x11c017,  (376, 297, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0L\0\0\0\2\0\0\04\0\0\0\0\0\20\0\0\0\0\0\2129\20\354\333?\334\21\261\310\0\14)\371\246\305\7\0\0\0\0\0\0\0\7\0\0\0R\0A\0S\0M\0A\0N\0\0\0\0\0\4\0\0\0", 76, 1024, ... {status=0x103, info=48}, "\5\0\2\3\20\0\0\00\0\0\0\1\0\0\0\30\0\0\0\0\0\0\0\0\0\0\0\2129\20\354\333?\334\21\261\310\0\14)\371\246\305\0\0\0\0", ) , 76, 1024, ... {status=0x103, info=48},  (376, 297, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0L\0\0\0\2\0\0\04\0\0\0\0\0\20\0\0\0\0\0\2129\20\354\333?\334\21\261\310\0\14)\371\246\305\7\0\0\0\0\0\0\0\7\0\0\0R\0A\0S\0M\0A\0N\0\0\0\0\0\4\0\0\0", 76, 1024, ... {status=0x103, info=48}, "\5\0\2\3\20\0\0\00\0\0\0\1\0\0\0\30\0\0\0\0\0\0\0\0\0\0\0\2129\20\354\333?\334\21\261\310\0\14)\371\246\305\0\0\0\0", ) , ) == 0x103
 04675   396   NtFsControlFile  (376, 297, 0x0, 0x0, 0x11c017,  (376, 297, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0,\0\0\0\3\0\0\0\24\0\0\0\0\0\6\0\0\0\0\0\2139\20\354\333?\334\21\261\310\0\14)\371\246\305", 44, 1024, ... {status=0x103, info=48}, "\5\0\2\3\20\0\0\00\0\0\0\2\0\0\0\30\0\0\0\0\0\0\0\0\0\0\0\2139\20\354\333?\334\21\261\310\0\14)\371\246\305\0\0\0\0", ) , 44, 1024, ... {status=0x103, info=48},  (376, 297, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0,\0\0\0\3\0\0\0\24\0\0\0\0\0\6\0\0\0\0\0\2139\20\354\333?\334\21\261\310\0\14)\371\246\305", 44, 1024, ... {status=0x103, info=48}, "\5\0\2\3\20\0\0\00\0\0\0\2\0\0\0\30\0\0\0\0\0\0\0\0\0\0\0\2139\20\354\333?\334\21\261\310\0\14)\371\246\305\0\0\0\0", ) , ) == 0x103
 04676   396   NtFsControlFile  (376, 297, 0x0, 0x0, 0x11c017,  (376, 297, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0,\0\0\0\4\0\0\0\24\0\0\0\0\0\0\0\0\0\0\0\2139\20\354\333?\334\21\261\310\0\14)\371\246\305", 44, 1024, ... {status=0x103, info=56}, "\5\0\2\3\20\0\0\08\0\0\0\3\0\0\0 \0\0\0\0\0\0\0 \0\0\0\1\0\0\0\0\0\0\05\4\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0", ) , 44, 1024, ... {status=0x103, info=56},  (376, 297, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0,\0\0\0\4\0\0\0\24\0\0\0\0\0\0\0\0\0\0\0\2139\20\354\333?\334\21\261\310\0\14)\371\246\305", 44, 1024, ... {status=0x103, info=56}, "\5\0\2\3\20\0\0\08\0\0\0\3\0\0\0 \0\0\0\0\0\0\0 \0\0\0\1\0\0\0\0\0\0\05\4\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0", ) , ) == 0x103
 04677   396   NtFsControlFile  (376, 297, 0x0, 0x0, 0x11c017,  (376, 297, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0,\0\0\0\5\0\0\0\24\0\0\0\0\0\0\0\0\0\0\0\2129\20\354\333?\334\21\261\310\0\14)\371\246\305", 44, 1024, ... {status=0x103, info=48}, "\5\0\2\3\20\0\0\00\0\0\0\4\0\0\0\30\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0", ) , 44, 1024, ... {status=0x103, info=48},  (376, 297, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0,\0\0\0\5\0\0\0\24\0\0\0\0\0\0\0\0\0\0\0\2129\20\354\333?\334\21\261\310\0\14)\371\246\305", 44, 1024, ... {status=0x103, info=48}, "\5\0\2\3\20\0\0\00\0\0\0\4\0\0\0\30\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0", ) , ) == 0x103
 04678   396   NtClose  (352, ... ) == 0x0
 04679   396   NtClose  (376, ... ) == 0x0
 04680   396   NtReleaseMutant  (204, ... 0x0, ) == 0x0
 04681   396   NtQueryValueKey  (108,  (108, "EnableAutodial", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (108, "EnableAutodial", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) }, 16, ) == 0x0
 04682   396   NtQueryValueKey  (108,  (108, "NoNetAutodial", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (108, "NoNetAutodial", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) }, 16, ) == 0x0
 04683   396   NtCreateKey  (0x2001d, {24, 48, 0x40, 0, 0,  (0x2001d, {24, 48, 0x40, 0, 0, "Software\Microsoft\RAS AutoDial"}, 0, 0x0, 0, ... 376, 2, ) }, 0, 0x0, 0, ... 376, 2, ) == 0x0
 04684   396   NtCreateKey  (0x20019, {24, 376, 0x40, 0, 0,  (0x20019, {24, 376, 0x40, 0, 0, "Default"}, 0, 0x0, 0, ... 352, 2, ) }, 0, 0x0, 0, ... 352, 2, ) == 0x0
 04685   396   NtClose  (376, ... ) == 0x0
 04686   396   NtQueryValueKey  (352,  (352, "DefaultInternet", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 04687   396   NtClose  (352, ... ) == 0x0
 04688   396   NtWaitForSingleObject  (156, 0, 0x0, ... ) == 0x0
 04689   396   NtQueryInformationFile  (152, 1242316, 24, Standard, ... {status=0x0, info=24}, ) == 0x0
 04690   396   NtReleaseMutant  (156, ... 0x0, ) == 0x0
 04691   396   NtWaitForSingleObject  (156, 0, 0x0, ... ) == 0x0
 04692   396   NtQueryInformationFile  (152, 1242472, 24, Standard, ... {status=0x0, info=24}, ) == 0x0
 04693   396   NtReleaseMutant  (156, ... 0x0, ) == 0x0
 04694   396   NtReleaseMutant  (200, ... 0x0, ) == 0x0
 04695   396   NtUserGetMessage  (0, 0, 0, ... {0x30062, WM_TIMER, 0x65, 0x0, 0x1392b, {512, 384}}, ) == 0x1
 04696   396   NtWaitForSingleObject  (200, 0, 0x0, ... ) == 0x0
 04697   396   NtWaitForSingleObject  (204, 0, 0x0, ... ) == 0x0
 04698   396   NtReleaseMutant  (204, ... 0x0, ) == 0x0
 04699   396   NtQueryValueKey  (108,  (108, "EnableAutodial", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (108, "EnableAutodial", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) }, 16, ) == 0x0
 04700   396   NtQueryValueKey  (108,  (108, "NoNetAutodial", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (108, "NoNetAutodial", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) }, 16, ) == 0x0
 04701   396   NtCreateKey  (0x2001d, {24, 48, 0x40, 0, 0,  (0x2001d, {24, 48, 0x40, 0, 0, "Software\Microsoft\RAS AutoDial"}, 0, 0x0, 0, ... 352, 2, ) }, 0, 0x0, 0, ... 352, 2, ) == 0x0
 04702   396   NtCreateKey  (0x20019, {24, 352, 0x40, 0, 0,  (0x20019, {24, 352, 0x40, 0, 0, "Default"}, 0, 0x0, 0, ... 376, 2, ) }, 0, 0x0, 0, ... 376, 2, ) == 0x0
 04703   396   NtClose  (352, ... ) == 0x0
 04704   396   NtQueryValueKey  (376,  (376, "DefaultInternet", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 04705   396   NtClose  (376, ... ) == 0x0
 04706   396   NtWaitForSingleObject  (156, 0, 0x0, ... ) == 0x0
 04707   396   NtQueryInformationFile  (152, 1242316, 24, Standard, ... {status=0x0, info=24}, ) == 0x0
 04708   396   NtReleaseMutant  (156, ... 0x0, ) == 0x0
 04709   396   NtWaitForSingleObject  (156, 0, 0x0, ... ) == 0x0
 04710   396   NtQueryInformationFile  (152, 1242472, 24, Standard, ... {status=0x0, info=24}, ) == 0x0
 04711   396   NtReleaseMutant  (156, ... 0x0, ) == 0x0
 04712   396   NtReleaseMutant  (200, ... 0x0, ) == 0x0
 04713   396   NtUserGetMessage  (0, 0, 0, ... {0x30062, WM_TIMER, 0x65, 0x0, 0x140fb, {512, 384}}, ) == 0x1
 04714   396   NtWaitForSingleObject  (200, 0, 0x0, ... ) == 0x0
 04715   396   NtWaitForSingleObject  (204, 0, 0x0, ... ) == 0x0
 04716   396   NtOpenEvent  (0x100000, {24, 52, 0x0, 0, 0,  (0x100000, {24, 52, 0x0, 0, 0, "Global\SvcctrlStartEvent_A3752DX"}, ... 376, ) }, ... 376, ) == 0x0
 04717   396   NtWaitForSingleObject  (376, 0, {-1800000000, -1}, ... ) == 0x0
 04718   396   NtClose  (376, ... ) == 0x0
 04719   396   NtOpenThreadToken  (-2, 0xc, 1, ... ) == STATUS_NO_TOKEN
 04720   396   NtCreateEvent  (0x1f0003, 0x0, 1, 0, ... 376, ) == 0x0
 04721   396   NtOpenThreadToken  (-2, 0xc, 1, ... ) == STATUS_NO_TOKEN
 04722   396   NtSetInformationThread  (-2, ImpersonationToken, {ImpToken=0,}, 4, ... ) == 0x0
 04723   396   NtCreateFile  (0xc0100080, {24, 0, 0x40, 0, 1240896,  (0xc0100080, {24, 0, 0x40, 0, 1240896, "\??\PIPE\svcctl"}, 0x0, 0, 3, 1, 4194368, 0, 0, ... 352, {status=0x0, info=1}, ) }, 0x0, 0, 3, 1, 4194368, 0, 0, ... 352, {status=0x0, info=1}, ) == 0x0
 04724   396   NtSetInformationFile  (352, 1240952, 8, Pipe, ... {status=0x0, info=0}, ) == 0x0
 04725   396   NtSetInformationFile  (352, 1240944, 8, Completion, ... {status=0x0, info=0}, ) == 0x0
 04726   396   NtSetInformationThread  (-2, ImpersonationToken, {ImpToken=0,}, 4, ... ) == 0x0
 04727   396   NtWriteFile  (352, 297, 0, 0,  (352, 297, 0, 0, "\5\0\13\3\20\0\0\0H\0\0\0\1\0\0\0\270\20\270\20\0\0\0\0\1\0\0\0\0\0\1\0\201\273z6D\230\3615\2552\230\3608\0\20\3\2\0\0\0\4]\210\212\353\34\311\21\237\350\10\0+\20H`\2\0\0\0", 72, {0, 0}, 0, ... {status=0x0, info=72}, ) , 72, {0, 0}, 0, ... {status=0x0, info=72}, ) == 0x0
 04728   396   NtReadFile  (352, 297, 0, 0, 1024, {0, 0}, 0, ... {status=0x0, info=68},  (352, 297, 0, 0, 1024, {0, 0}, 0, ... {status=0x0, info=68}, "\5\0\14\3\20\0\0\0D\0\0\0\1\0\0\0\270\20\270\20?'\0\0\15\0\PIPE\ntsvcs\0\0\1\0\0\0\0\0\0\0\4]\210\212\353\34\311\21\237\350\10\0+\20H`\2\0\0\0", ) , ) == 0x0
 04729   396   NtFsControlFile  (352, 297, 0x0, 0x0, 0x11c017,  (352, 297, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0$\0\0\0\1\0\0\0\14\0\0\0\0\0\17\0\0\0\0\0\0\0\0\0\0\0\0\200", 36, 1024, ... {status=0x103, info=68}, "\5\0\14\3\20\0\0\0D\0\0\0\1\0\0\0\270\20\270\20?'\0\0\15\0\PIPE\ntsvcs\0\0\1\0\0\0\0\0\0\0\4]\210\212\353\34\311\21\237\350\10\0+\20H`\2\0\0\0", ) , 36, 1024, ... {status=0x103, info=68},  (352, 297, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0$\0\0\0\1\0\0\0\14\0\0\0\0\0\17\0\0\0\0\0\0\0\0\0\0\0\0\200", 36, 1024, ... {status=0x103, info=68}, "\5\0\14\3\20\0\0\0D\0\0\0\1\0\0\0\270\20\270\20?'\0\0\15\0\PIPE\ntsvcs\0\0\1\0\0\0\0\0\0\0\4]\210\212\353\34\311\21\237\350\10\0+\20H`\2\0\0\0", ) , ) == 0x103
 04730   396   NtFsControlFile  (352, 297, 0x0, 0x0, 0x11c017,  (352, 297, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0L\0\0\0\2\0\0\04\0\0\0\0\0\20\0\0\0\0\0\2169\20\354\333?\334\21\261\310\0\14)\371\246\305\7\0\0\0\0\0\0\0\7\0\0\0R\0A\0S\0M\0A\0N\0\0\0\0\0\4\0\0\0", 76, 1024, ... {status=0x103, info=48}, "\5\0\2\3\20\0\0\00\0\0\0\1\0\0\0\30\0\0\0\0\0\0\0\0\0\0\0\2169\20\354\333?\334\21\261\310\0\14)\371\246\305\0\0\0\0", ) , 76, 1024, ... {status=0x103, info=48},  (352, 297, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0L\0\0\0\2\0\0\04\0\0\0\0\0\20\0\0\0\0\0\2169\20\354\333?\334\21\261\310\0\14)\371\246\305\7\0\0\0\0\0\0\0\7\0\0\0R\0A\0S\0M\0A\0N\0\0\0\0\0\4\0\0\0", 76, 1024, ... {status=0x103, info=48}, "\5\0\2\3\20\0\0\00\0\0\0\1\0\0\0\30\0\0\0\0\0\0\0\0\0\0\0\2169\20\354\333?\334\21\261\310\0\14)\371\246\305\0\0\0\0", ) , ) == 0x103
 04731   396   NtFsControlFile  (352, 297, 0x0, 0x0, 0x11c017,  (352, 297, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0,\0\0\0\3\0\0\0\24\0\0\0\0\0\6\0\0\0\0\0\2179\20\354\333?\334\21\261\310\0\14)\371\246\305", 44, 1024, ... {status=0x103, info=48}, "\5\0\2\3\20\0\0\00\0\0\0\2\0\0\0\30\0\0\0\0\0\0\0\0\0\0\0\2179\20\354\333?\334\21\261\310\0\14)\371\246\305\0\0\0\0", ) , 44, 1024, ... {status=0x103, info=48},  (352, 297, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0,\0\0\0\3\0\0\0\24\0\0\0\0\0\6\0\0\0\0\0\2179\20\354\333?\334\21\261\310\0\14)\371\246\305", 44, 1024, ... {status=0x103, info=48}, "\5\0\2\3\20\0\0\00\0\0\0\2\0\0\0\30\0\0\0\0\0\0\0\0\0\0\0\2179\20\354\333?\334\21\261\310\0\14)\371\246\305\0\0\0\0", ) , ) == 0x103
 04732   396   NtFsControlFile  (352, 297, 0x0, 0x0, 0x11c017,  (352, 297, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0,\0\0\0\4\0\0\0\24\0\0\0\0\0\0\0\0\0\0\0\2179\20\354\333?\334\21\261\310\0\14)\371\246\305", 44, 1024, ... {status=0x103, info=56}, "\5\0\2\3\20\0\0\08\0\0\0\3\0\0\0 \0\0\0\0\0\0\0 \0\0\0\1\0\0\0\0\0\0\05\4\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0", ) , 44, 1024, ... {status=0x103, info=56},  (352, 297, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0,\0\0\0\4\0\0\0\24\0\0\0\0\0\0\0\0\0\0\0\2179\20\354\333?\334\21\261\310\0\14)\371\246\305", 44, 1024, ... {status=0x103, info=56}, "\5\0\2\3\20\0\0\08\0\0\0\3\0\0\0 \0\0\0\0\0\0\0 \0\0\0\1\0\0\0\0\0\0\05\4\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0", ) , ) == 0x103
 04733   396   NtFsControlFile  (352, 297, 0x0, 0x0, 0x11c017,  (352, 297, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0,\0\0\0\5\0\0\0\24\0\0\0\0\0\0\0\0\0\0\0\2169\20\354\333?\334\21\261\310\0\14)\371\246\305", 44, 1024, ... {status=0x103, info=48}, "\5\0\2\3\20\0\0\00\0\0\0\4\0\0\0\30\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0", ) , 44, 1024, ... {status=0x103, info=48},  (352, 297, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0,\0\0\0\5\0\0\0\24\0\0\0\0\0\0\0\0\0\0\0\2169\20\354\333?\334\21\261\310\0\14)\371\246\305", 44, 1024, ... {status=0x103, info=48}, "\5\0\2\3\20\0\0\00\0\0\0\4\0\0\0\30\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0", ) , ) == 0x103
 04734   396   NtClose  (376, ... ) == 0x0
 04735   396   NtClose  (352, ... ) == 0x0
 04736   396   NtReleaseMutant  (204, ... 0x0, ) == 0x0
 04737   396   NtQueryValueKey  (108,  (108, "EnableAutodial", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (108, "EnableAutodial", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) }, 16, ) == 0x0
 04738   396   NtQueryValueKey  (108,  (108, "NoNetAutodial", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (108, "NoNetAutodial", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) }, 16, ) == 0x0
 04739   396   NtCreateKey  (0x2001d, {24, 48, 0x40, 0, 0,  (0x2001d, {24, 48, 0x40, 0, 0, "Software\Microsoft\RAS AutoDial"}, 0, 0x0, 0, ... 352, 2, ) }, 0, 0x0, 0, ... 352, 2, ) == 0x0
 04740   396   NtCreateKey  (0x20019, {24, 352, 0x40, 0, 0,  (0x20019, {24, 352, 0x40, 0, 0, "Default"}, 0, 0x0, 0, ... 376, 2, ) }, 0, 0x0, 0, ... 376, 2, ) == 0x0
 04741   396   NtClose  (352, ... ) == 0x0
 04742   396   NtQueryValueKey  (376,  (376, "DefaultInternet", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 04743   396   NtClose  (376, ... ) == 0x0
 04744   396   NtWaitForSingleObject  (156, 0, 0x0, ... ) == 0x0
 04745   396   NtQueryInformationFile  (152, 1242316, 24, Standard, ... {status=0x0, info=24}, ) == 0x0
 04746   396   NtReleaseMutant  (156, ... 0x0, ) == 0x0
 04747   396   NtWaitForSingleObject  (156, 0, 0x0, ... ) == 0x0
 04748   396   NtQueryInformationFile  (152, 1242472, 24, Standard, ... {status=0x0, info=24}, ) == 0x0
 04749   396   NtReleaseMutant  (156, ... 0x0, ) == 0x0
 04750   396   NtReleaseMutant  (200, ... 0x0, ) == 0x0
 04751   396   NtUserGetMessage  (0, 0, 0, ... {0x30062, WM_TIMER, 0x65, 0x0, 0x148cb, {512, 384}}, ) == 0x1
 04752   396   NtWaitForSingleObject  (200, 0, 0x0, ... ) == 0x0
 04753   396   NtWaitForSingleObject  (204, 0, 0x0, ... ) == 0x0
 04754   396   NtReleaseMutant  (204, ... 0x0, ) == 0x0
 04755   396   NtQueryValueKey  (108,  (108, "EnableAutodial", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (108, "EnableAutodial", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) }, 16, ) == 0x0
 04756   396   NtQueryValueKey  (108,  (108, "NoNetAutodial", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (108, "NoNetAutodial", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) }, 16, ) == 0x0
 04757   396   NtCreateKey  (0x2001d, {24, 48, 0x40, 0, 0,  (0x2001d, {24, 48, 0x40, 0, 0, "Software\Microsoft\RAS AutoDial"}, 0, 0x0, 0, ... 376, 2, ) }, 0, 0x0, 0, ... 376, 2, ) == 0x0
 04758   396   NtCreateKey  (0x20019, {24, 376, 0x40, 0, 0,  (0x20019, {24, 376, 0x40, 0, 0, "Default"}, 0, 0x0, 0, ... 352, 2, ) }, 0, 0x0, 0, ... 352, 2, ) == 0x0
 04759   396   NtClose  (376, ... ) == 0x0
 04760   396   NtQueryValueKey  (352,  (352, "DefaultInternet", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 04761   396   NtClose  (352, ... ) == 0x0
 04762   396   NtWaitForSingleObject  (156, 0, 0x0, ... ) == 0x0
 04763   396   NtQueryInformationFile  (152, 1242316, 24, Standard, ... {status=0x0, info=24}, ) == 0x0
 04764   396   NtReleaseMutant  (156, ... 0x0, ) == 0x0
 04765   396   NtWaitForSingleObject  (156, 0, 0x0, ... ) == 0x0
 04766   396   NtQueryInformationFile  (152, 1242472, 24, Standard, ... {status=0x0, info=24}, ) == 0x0
 04767   396   NtReleaseMutant  (156, ... 0x0, ) == 0x0
 04768   396   NtReleaseMutant  (200, ... 0x0, ) == 0x0
 04769   396   NtUserGetMessage  (0, 0, 0, ... {0x30062, WM_TIMER, 0x65, 0x0, 0x1509b, {512, 384}}, ) == 0x1
 04770   396   NtWaitForSingleObject  (200, 0, 0x0, ... ) == 0x0
 04771   396   NtWaitForSingleObject  (204, 0, 0x0, ... ) == 0x0
 04772   396   NtOpenEvent  (0x100000, {24, 52, 0x0, 0, 0,  (0x100000, {24, 52, 0x0, 0, 0, "Global\SvcctrlStartEvent_A3752DX"}, ... 352, ) }, ... 352, ) == 0x0
 04773   396   NtWaitForSingleObject  (352, 0, {-1800000000, -1}, ... ) == 0x0
 04774   396   NtClose  (352, ... ) == 0x0
 04775   396   NtOpenThreadToken  (-2, 0xc, 1, ... ) == STATUS_NO_TOKEN
 04776   396   NtCreateEvent  (0x1f0003, 0x0, 1, 0, ... 352, ) == 0x0
 04777   396   NtOpenThreadToken  (-2, 0xc, 1, ... ) == STATUS_NO_TOKEN
 04778   396   NtSetInformationThread  (-2, ImpersonationToken, {ImpToken=0,}, 4, ... ) == 0x0
 04779   396   NtCreateFile  (0xc0100080, {24, 0, 0x40, 0, 1240896,  (0xc0100080, {24, 0, 0x40, 0, 1240896, "\??\PIPE\svcctl"}, 0x0, 0, 3, 1, 4194368, 0, 0, ... 376, {status=0x0, info=1}, ) }, 0x0, 0, 3, 1, 4194368, 0, 0, ... 376, {status=0x0, info=1}, ) == 0x0
 04780   396   NtSetInformationFile  (376, 1240952, 8, Pipe, ... {status=0x0, info=0}, ) == 0x0
 04781   396   NtSetInformationFile  (376, 1240944, 8, Completion, ... {status=0x0, info=0}, ) == 0x0
 04782   396   NtSetInformationThread  (-2, ImpersonationToken, {ImpToken=0,}, 4, ... ) == 0x0
 04783   396   NtWriteFile  (376, 297, 0, 0,  (376, 297, 0, 0, "\5\0\13\3\20\0\0\0H\0\0\0\1\0\0\0\270\20\270\20\0\0\0\0\1\0\0\0\0\0\1\0\201\273z6D\230\3615\2552\230\3608\0\20\3\2\0\0\0\4]\210\212\353\34\311\21\237\350\10\0+\20H`\2\0\0\0", 72, {0, 0}, 0, ... {status=0x0, info=72}, ) , 72, {0, 0}, 0, ... {status=0x0, info=72}, ) == 0x0
 04784   396   NtReadFile  (376, 297, 0, 0, 1024, {0, 0}, 0, ... {status=0x0, info=68},  (376, 297, 0, 0, 1024, {0, 0}, 0, ... {status=0x0, info=68}, "\5\0\14\3\20\0\0\0D\0\0\0\1\0\0\0\270\20\270\20A'\0\0\15\0\PIPE\ntsvcs\0\0\1\0\0\0\0\0\0\0\4]\210\212\353\34\311\21\237\350\10\0+\20H`\2\0\0\0", ) , ) == 0x0
 04785   396   NtFsControlFile  (376, 297, 0x0, 0x0, 0x11c017,  (376, 297, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0$\0\0\0\1\0\0\0\14\0\0\0\0\0\17\0\0\0\0\0\0\0\0\0\0\0\0\200", 36, 1024, ... {status=0x103, info=68}, "\5\0\14\3\20\0\0\0D\0\0\0\1\0\0\0\270\20\270\20A'\0\0\15\0\PIPE\ntsvcs\0\0\1\0\0\0\0\0\0\0\4]\210\212\353\34\311\21\237\350\10\0+\20H`\2\0\0\0", ) , 36, 1024, ... {status=0x103, info=68},  (376, 297, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0$\0\0\0\1\0\0\0\14\0\0\0\0\0\17\0\0\0\0\0\0\0\0\0\0\0\0\200", 36, 1024, ... {status=0x103, info=68}, "\5\0\14\3\20\0\0\0D\0\0\0\1\0\0\0\270\20\270\20A'\0\0\15\0\PIPE\ntsvcs\0\0\1\0\0\0\0\0\0\0\4]\210\212\353\34\311\21\237\350\10\0+\20H`\2\0\0\0", ) , ) == 0x103
 04786   396   NtFsControlFile  (376, 297, 0x0, 0x0, 0x11c017,  (376, 297, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0L\0\0\0\2\0\0\04\0\0\0\0\0\20\0\0\0\0\0\2269\20\354\333?\334\21\261\310\0\14)\371\246\305\7\0\0\0\0\0\0\0\7\0\0\0R\0A\0S\0M\0A\0N\0\0\0\0\0\4\0\0\0", 76, 1024, ... {status=0x103, info=48}, "\5\0\2\3\20\0\0\00\0\0\0\1\0\0\0\30\0\0\0\0\0\0\0\0\0\0\0\2269\20\354\333?\334\21\261\310\0\14)\371\246\305\0\0\0\0", ) , 76, 1024, ... {status=0x103, info=48},  (376, 297, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0L\0\0\0\2\0\0\04\0\0\0\0\0\20\0\0\0\0\0\2269\20\354\333?\334\21\261\310\0\14)\371\246\305\7\0\0\0\0\0\0\0\7\0\0\0R\0A\0S\0M\0A\0N\0\0\0\0\0\4\0\0\0", 76, 1024, ... {status=0x103, info=48}, "\5\0\2\3\20\0\0\00\0\0\0\1\0\0\0\30\0\0\0\0\0\0\0\0\0\0\0\2269\20\354\333?\334\21\261\310\0\14)\371\246\305\0\0\0\0", ) , ) == 0x103
 04787   396   NtFsControlFile  (376, 297, 0x0, 0x0, 0x11c017,  (376, 297, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0,\0\0\0\3\0\0\0\24\0\0\0\0\0\6\0\0\0\0\0\2279\20\354\333?\334\21\261\310\0\14)\371\246\305", 44, 1024, ... {status=0x103, info=48}, "\5\0\2\3\20\0\0\00\0\0\0\2\0\0\0\30\0\0\0\0\0\0\0\0\0\0\0\2279\20\354\333?\334\21\261\310\0\14)\371\246\305\0\0\0\0", ) , 44, 1024, ... {status=0x103, info=48},  (376, 297, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0,\0\0\0\3\0\0\0\24\0\0\0\0\0\6\0\0\0\0\0\2279\20\354\333?\334\21\261\310\0\14)\371\246\305", 44, 1024, ... {status=0x103, info=48}, "\5\0\2\3\20\0\0\00\0\0\0\2\0\0\0\30\0\0\0\0\0\0\0\0\0\0\0\2279\20\354\333?\334\21\261\310\0\14)\371\246\305\0\0\0\0", ) , ) == 0x103
 04788   396   NtFsControlFile  (376, 297, 0x0, 0x0, 0x11c017,  (376, 297, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0,\0\0\0\4\0\0\0\24\0\0\0\0\0\0\0\0\0\0\0\2279\20\354\333?\334\21\261\310\0\14)\371\246\305", 44, 1024, ... {status=0x103, info=56}, "\5\0\2\3\20\0\0\08\0\0\0\3\0\0\0 \0\0\0\0\0\0\0 \0\0\0\1\0\0\0\0\0\0\05\4\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0", ) , 44, 1024, ... {status=0x103, info=56},  (376, 297, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0,\0\0\0\4\0\0\0\24\0\0\0\0\0\0\0\0\0\0\0\2279\20\354\333?\334\21\261\310\0\14)\371\246\305", 44, 1024, ... {status=0x103, info=56}, "\5\0\2\3\20\0\0\08\0\0\0\3\0\0\0 \0\0\0\0\0\0\0 \0\0\0\1\0\0\0\0\0\0\05\4\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0", ) , ) == 0x103
 04789   396   NtFsControlFile  (376, 297, 0x0, 0x0, 0x11c017,  (376, 297, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0,\0\0\0\5\0\0\0\24\0\0\0\0\0\0\0\0\0\0\0\2269\20\354\333?\334\21\261\310\0\14)\371\246\305", 44, 1024, ... {status=0x103, info=48}, "\5\0\2\3\20\0\0\00\0\0\0\4\0\0\0\30\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0", ) , 44, 1024, ... {status=0x103, info=48},  (376, 297, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0,\0\0\0\5\0\0\0\24\0\0\0\0\0\0\0\0\0\0\0\2269\20\354\333?\334\21\261\310\0\14)\371\246\305", 44, 1024, ... {status=0x103, info=48}, "\5\0\2\3\20\0\0\00\0\0\0\4\0\0\0\30\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0", ) , ) == 0x103
 04790   396   NtClose  (352, ... ) == 0x0
 04791   396   NtClose  (376, ... ) == 0x0
 04792   396   NtReleaseMutant  (204, ... 0x0, ) == 0x0
 04793   396   NtQueryValueKey  (108,  (108, "EnableAutodial", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (108, "EnableAutodial", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) }, 16, ) == 0x0
 04794   396   NtQueryValueKey  (108,  (108, "NoNetAutodial", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (108, "NoNetAutodial", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) }, 16, ) == 0x0
 04795   396   NtCreateKey  (0x2001d, {24, 48, 0x40, 0, 0,  (0x2001d, {24, 48, 0x40, 0, 0, "Software\Microsoft\RAS AutoDial"}, 0, 0x0, 0, ... 376, 2, ) }, 0, 0x0, 0, ... 376, 2, ) == 0x0
 04796   396   NtCreateKey  (0x20019, {24, 376, 0x40, 0, 0,  (0x20019, {24, 376, 0x40, 0, 0, "Default"}, 0, 0x0, 0, ... 352, 2, ) }, 0, 0x0, 0, ... 352, 2, ) == 0x0
 04797   396   NtClose  (376, ... ) == 0x0
 04798   396   NtQueryValueKey  (352,  (352, "DefaultInternet", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 04799   396   NtClose  (352, ... ) == 0x0
 04800   396   NtWaitForSingleObject  (156, 0, 0x0, ... ) == 0x0
 04801   396   NtQueryInformationFile  (152, 1242316, 24, Standard, ... {status=0x0, info=24}, ) == 0x0
 04802   396   NtReleaseMutant  (156, ... 0x0, ) == 0x0
 04803   396   NtWaitForSingleObject  (156, 0, 0x0, ... ) == 0x0
 04804   396   NtQueryInformationFile  (152, 1242472, 24, Standard, ... {status=0x0, info=24}, ) == 0x0
 04805   396   NtReleaseMutant  (156, ... 0x0, ) == 0x0
 04806   396   NtReleaseMutant  (200, ... 0x0, ) == 0x0
 04807   396   NtUserGetMessage  (0, 0, 0, ... {0x30062, WM_TIMER, 0x65, 0x0, 0x1586b, {512, 384}}, ) == 0x1
 04808   396   NtWaitForSingleObject  (200, 0, 0x0, ... ) == 0x0
 04809   396   NtWaitForSingleObject  (204, 0, 0x0, ... ) == 0x0
 04810   396   NtReleaseMutant  (204, ... 0x0, ) == 0x0
 04811   396   NtQueryValueKey  (108,  (108, "EnableAutodial", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (108, "EnableAutodial", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) }, 16, ) == 0x0
 04812   396   NtQueryValueKey  (108,  (108, "NoNetAutodial", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (108, "NoNetAutodial", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) }, 16, ) == 0x0
 04813   396   NtCreateKey  (0x2001d, {24, 48, 0x40, 0, 0,  (0x2001d, {24, 48, 0x40, 0, 0, "Software\Microsoft\RAS AutoDial"}, 0, 0x0, 0, ... 352, 2, ) }, 0, 0x0, 0, ... 352, 2, ) == 0x0
 04814   396   NtCreateKey  (0x20019, {24, 352, 0x40, 0, 0,  (0x20019, {24, 352, 0x40, 0, 0, "Default"}, 0, 0x0, 0, ... 376, 2, ) }, 0, 0x0, 0, ... 376, 2, ) == 0x0
 04815   396   NtClose  (352, ... ) == 0x0
 04816   396   NtQueryValueKey  (376,  (376, "DefaultInternet", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 04817   396   NtClose  (376, ... ) == 0x0
 04818   396   NtWaitForSingleObject  (156, 0, 0x0, ... ) == 0x0
 04819   396   NtQueryInformationFile  (152, 1242316, 24, Standard, ... {status=0x0, info=24}, ) == 0x0
 04820   396   NtReleaseMutant  (156, ... 0x0, ) == 0x0
 04821   396   NtWaitForSingleObject  (156, 0, 0x0, ... ) == 0x0
 04822   396   NtQueryInformationFile  (152, 1242472, 24, Standard, ... {status=0x0, info=24}, ) == 0x0
 04823   396   NtReleaseMutant  (156, ... 0x0, ) == 0x0
 04824   396   NtReleaseMutant  (200, ... 0x0, ) == 0x0
 04825   396   NtUserGetMessage  (0, 0, 0, ... {0x30062, WM_TIMER, 0x65, 0x0, 0x1603b, {512, 384}}, ) == 0x1
 04826   396   NtWaitForSingleObject  (200, 0, 0x0, ... ) == 0x0
 04827   396   NtWaitForSingleObject  (204, 0, 0x0, ... ) == 0x0
 04828   396   NtOpenEvent  (0x100000, {24, 52, 0x0, 0, 0,  (0x100000, {24, 52, 0x0, 0, 0, "Global\SvcctrlStartEvent_A3752DX"}, ... 376, ) }, ... 376, ) == 0x0
 04829   396   NtWaitForSingleObject  (376, 0, {-1800000000, -1}, ... ) == 0x0
 04830   396   NtClose  (376, ... ) == 0x0
 04831   396   NtOpenThreadToken  (-2, 0xc, 1, ... ) == STATUS_NO_TOKEN
 04832   396   NtCreateEvent  (0x1f0003, 0x0, 1, 0, ... 376, ) == 0x0
 04833   396   NtOpenThreadToken  (-2, 0xc, 1, ... ) == STATUS_NO_TOKEN
 04834   396   NtSetInformationThread  (-2, ImpersonationToken, {ImpToken=0,}, 4, ... ) == 0x0
 04835   396   NtCreateFile  (0xc0100080, {24, 0, 0x40, 0, 1240896,  (0xc0100080, {24, 0, 0x40, 0, 1240896, "\??\PIPE\svcctl"}, 0x0, 0, 3, 1, 4194368, 0, 0, ... 352, {status=0x0, info=1}, ) }, 0x0, 0, 3, 1, 4194368, 0, 0, ... 352, {status=0x0, info=1}, ) == 0x0
 04836   396   NtSetInformationFile  (352, 1240952, 8, Pipe, ... {status=0x0, info=0}, ) == 0x0
 04837   396   NtSetInformationFile  (352, 1240944, 8, Completion, ... {status=0x0, info=0}, ) == 0x0
 04838   396   NtSetInformationThread  (-2, ImpersonationToken, {ImpToken=0,}, 4, ... ) == 0x0
 04839   396   NtWriteFile  (352, 297, 0, 0,  (352, 297, 0, 0, "\5\0\13\3\20\0\0\0H\0\0\0\1\0\0\0\270\20\270\20\0\0\0\0\1\0\0\0\0\0\1\0\201\273z6D\230\3615\2552\230\3608\0\20\3\2\0\0\0\4]\210\212\353\34\311\21\237\350\10\0+\20H`\2\0\0\0", 72, {0, 0}, 0, ... {status=0x0, info=72}, ) , 72, {0, 0}, 0, ... {status=0x0, info=72}, ) == 0x0
 04840   396   NtReadFile  (352, 297, 0, 0, 1024, {0, 0}, 0, ... {status=0x0, info=68},  (352, 297, 0, 0, 1024, {0, 0}, 0, ... {status=0x0, info=68}, "\5\0\14\3\20\0\0\0D\0\0\0\1\0\0\0\270\20\270\20B'\0\0\15\0\PIPE\ntsvcs\0\0\1\0\0\0\0\0\0\0\4]\210\212\353\34\311\21\237\350\10\0+\20H`\2\0\0\0", ) , ) == 0x0
 04841   396   NtFsControlFile  (352, 297, 0x0, 0x0, 0x11c017,  (352, 297, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0$\0\0\0\1\0\0\0\14\0\0\0\0\0\17\0\0\0\0\0\0\0\0\0\0\0\0\200", 36, 1024, ... {status=0x103, info=68}, "\5\0\14\3\20\0\0\0D\0\0\0\1\0\0\0\270\20\270\20B'\0\0\15\0\PIPE\ntsvcs\0\0\1\0\0\0\0\0\0\0\4]\210\212\353\34\311\21\237\350\10\0+\20H`\2\0\0\0", ) , 36, 1024, ... {status=0x103, info=68},  (352, 297, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0$\0\0\0\1\0\0\0\14\0\0\0\0\0\17\0\0\0\0\0\0\0\0\0\0\0\0\200", 36, 1024, ... {status=0x103, info=68}, "\5\0\14\3\20\0\0\0D\0\0\0\1\0\0\0\270\20\270\20B'\0\0\15\0\PIPE\ntsvcs\0\0\1\0\0\0\0\0\0\0\4]\210\212\353\34\311\21\237\350\10\0+\20H`\2\0\0\0", ) , ) == 0x103
 04842   396   NtFsControlFile  (352, 297, 0x0, 0x0, 0x11c017,  (352, 297, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0L\0\0\0\2\0\0\04\0\0\0\0\0\20\0\0\0\0\0\212G7\363\333?\334\21\261\310\0\14)\371\246\305\7\0\0\0\0\0\0\0\7\0\0\0R\0A\0S\0M\0A\0N\0\0\0\0\0\4\0\0\0", 76, 1024, ... {status=0x103, info=48}, "\5\0\2\3\20\0\0\00\0\0\0\1\0\0\0\30\0\0\0\0\0\0\0\0\0\0\0\212G7\363\333?\334\21\261\310\0\14)\371\246\305\0\0\0\0", ) , 76, 1024, ... {status=0x103, info=48},  (352, 297, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0L\0\0\0\2\0\0\04\0\0\0\0\0\20\0\0\0\0\0\212G7\363\333?\334\21\261\310\0\14)\371\246\305\7\0\0\0\0\0\0\0\7\0\0\0R\0A\0S\0M\0A\0N\0\0\0\0\0\4\0\0\0", 76, 1024, ... {status=0x103, info=48}, "\5\0\2\3\20\0\0\00\0\0\0\1\0\0\0\30\0\0\0\0\0\0\0\0\0\0\0\212G7\363\333?\334\21\261\310\0\14)\371\246\305\0\0\0\0", ) , ) == 0x103
 04843   396   NtFsControlFile  (352, 297, 0x0, 0x0, 0x11c017,  (352, 297, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0,\0\0\0\3\0\0\0\24\0\0\0\0\0\6\0\0\0\0\0\213G7\363\333?\334\21\261\310\0\14)\371\246\305", 44, 1024, ... {status=0x103, info=48}, "\5\0\2\3\20\0\0\00\0\0\0\2\0\0\0\30\0\0\0\0\0\0\0\0\0\0\0\213G7\363\333?\334\21\261\310\0\14)\371\246\305\0\0\0\0", ) , 44, 1024, ... {status=0x103, info=48},  (352, 297, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0,\0\0\0\3\0\0\0\24\0\0\0\0\0\6\0\0\0\0\0\213G7\363\333?\334\21\261\310\0\14)\371\246\305", 44, 1024, ... {status=0x103, info=48}, "\5\0\2\3\20\0\0\00\0\0\0\2\0\0\0\30\0\0\0\0\0\0\0\0\0\0\0\213G7\363\333?\334\21\261\310\0\14)\371\246\305\0\0\0\0", ) , ) == 0x103
 04844   396   NtFsControlFile  (352, 297, 0x0, 0x0, 0x11c017,  (352, 297, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0,\0\0\0\4\0\0\0\24\0\0\0\0\0\0\0\0\0\0\0\213G7\363\333?\334\21\261\310\0\14)\371\246\305", 44, 1024, ... {status=0x103, info=56}, "\5\0\2\3\20\0\0\08\0\0\0\3\0\0\0 \0\0\0\0\0\0\0 \0\0\0\1\0\0\0\0\0\0\05\4\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0", ) , 44, 1024, ... {status=0x103, info=56},  (352, 297, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0,\0\0\0\4\0\0\0\24\0\0\0\0\0\0\0\0\0\0\0\213G7\363\333?\334\21\261\310\0\14)\371\246\305", 44, 1024, ... {status=0x103, info=56}, "\5\0\2\3\20\0\0\08\0\0\0\3\0\0\0 \0\0\0\0\0\0\0 \0\0\0\1\0\0\0\0\0\0\05\4\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0", ) , ) == 0x103
 04845   396   NtFsControlFile  (352, 297, 0x0, 0x0, 0x11c017,  (352, 297, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0,\0\0\0\5\0\0\0\24\0\0\0\0\0\0\0\0\0\0\0\212G7\363\333?\334\21\261\310\0\14)\371\246\305", 44, 1024, ... {status=0x103, info=48}, "\5\0\2\3\20\0\0\00\0\0\0\4\0\0\0\30\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0", ) , 44, 1024, ... {status=0x103, info=48},  (352, 297, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0,\0\0\0\5\0\0\0\24\0\0\0\0\0\0\0\0\0\0\0\212G7\363\333?\334\21\261\310\0\14)\371\246\305", 44, 1024, ... {status=0x103, info=48}, "\5\0\2\3\20\0\0\00\0\0\0\4\0\0\0\30\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0", ) , ) == 0x103
 04846   396   NtClose  (376, ... ) == 0x0
 04847   396   NtClose  (352, ... ) == 0x0
 04848   396   NtReleaseMutant  (204, ... 0x0, ) == 0x0
 04849   396   NtQueryValueKey  (108,  (108, "EnableAutodial", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (108, "EnableAutodial", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) }, 16, ) == 0x0
 04850   396   NtQueryValueKey  (108,  (108, "NoNetAutodial", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (108, "NoNetAutodial", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) }, 16, ) == 0x0
 04851   396   NtCreateKey  (0x2001d, {24, 48, 0x40, 0, 0,  (0x2001d, {24, 48, 0x40, 0, 0, "Software\Microsoft\RAS AutoDial"}, 0, 0x0, 0, ... 352, 2, ) }, 0, 0x0, 0, ... 352, 2, ) == 0x0
 04852   396   NtCreateKey  (0x20019, {24, 352, 0x40, 0, 0,  (0x20019, {24, 352, 0x40, 0, 0, "Default"}, 0, 0x0, 0, ... 376, 2, ) }, 0, 0x0, 0, ... 376, 2, ) == 0x0
 04853   396   NtClose  (352, ... ) == 0x0
 04854   396   NtQueryValueKey  (376,  (376, "DefaultInternet", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 04855   396   NtClose  (376, ... ) == 0x0
 04856   396   NtWaitForSingleObject  (156, 0, 0x0, ... ) == 0x0
 04857   396   NtQueryInformationFile  (152, 1242316, 24, Standard, ... {status=0x0, info=24}, ) == 0x0
 04858   396   NtReleaseMutant  (156, ... 0x0, ) == 0x0
 04859   396   NtWaitForSingleObject  (156, 0, 0x0, ... ) == 0x0
 04860   396   NtQueryInformationFile  (152, 1242472, 24, Standard, ... {status=0x0, info=24}, ) == 0x0
 04861   396   NtReleaseMutant  (156, ... 0x0, ) == 0x0
 04862   396   NtReleaseMutant  (200, ... 0x0, ) == 0x0
 04863   396   NtUserGetMessage  (0, 0, 0, ... {0x30062, WM_TIMER, 0x65, 0x0, 0x1680b, {512, 384}}, ) == 0x1
 04864   396   NtWaitForSingleObject  (200, 0, 0x0, ... ) == 0x0
 04865   396   NtWaitForSingleObject  (204, 0, 0x0, ... ) == 0x0
 04866   396   NtReleaseMutant  (204, ... 0x0, ) == 0x0
 04867   396   NtQueryValueKey  (108,  (108, "EnableAutodial", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (108, "EnableAutodial", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) }, 16, ) == 0x0
 04868   396   NtQueryValueKey  (108,  (108, "NoNetAutodial", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (108, "NoNetAutodial", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) }, 16, ) == 0x0
 04869   396   NtWaitForMultipleObjects  (2, (264, 280, ), 1, 0, {0, 0}, ... ) == 0x102
 04870   396   NtCreateKey  (0x2001d, {24, 48, 0x40, 0, 0,  (0x2001d, {24, 48, 0x40, 0, 0, "Software\Microsoft\RAS AutoDial"}, 0, 0x0, 0, ... 376, 2, ) }, 0, 0x0, 0, ... 376, 2, ) == 0x0
 04871   396   NtCreateKey  (0x20019, {24, 376, 0x40, 0, 0,  (0x20019, {24, 376, 0x40, 0, 0, "Default"}, 0, 0x0, 0, ... 352, 2, ) }, 0, 0x0, 0, ... 352, 2, ) == 0x0
 04872   396   NtClose  (376, ... ) == 0x0
 04873   396   NtQueryValueKey  (352,  (352, "DefaultInternet", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 04874   396   NtClose  (352, ... ) == 0x0
 04875   396   NtWaitForSingleObject  (156, 0, 0x0, ... ) == 0x0
 04876   396   NtQueryInformationFile  (152, 1242316, 24, Standard, ... {status=0x0, info=24}, ) == 0x0
 04877   396   NtReleaseMutant  (156, ... 0x0, ) == 0x0
 04878   396   NtWaitForSingleObject  (156, 0, 0x0, ... ) == 0x0
 04879   396   NtQueryInformationFile  (152, 1242472, 24, Standard, ... {status=0x0, info=24}, ) == 0x0
 04880   396   NtReleaseMutant  (156, ... 0x0, ) == 0x0
 04881   396   NtReleaseMutant  (200, ... 0x0, ) == 0x0
 04882   396   NtUserGetMessage  (0, 0, 0, ... {0x30062, WM_TIMER, 0x65, 0x0, 0x16fdb, {512, 384}}, ) == 0x1
 04883   396   NtWaitForSingleObject  (200, 0, 0x0, ... ) == 0x0
 04884   396   NtWaitForSingleObject  (204, 0, 0x0, ... ) == 0x0
 04885   396   NtWaitForMultipleObjects  (2, (264, 280, ), 1, 0, {0, 0}, ... ) == 0x102
 04886   396   NtOpenEvent  (0x100000, {24, 52, 0x0, 0, 0,  (0x100000, {24, 52, 0x0, 0, 0, "Global\SvcctrlStartEvent_A3752DX"}, ... 352, ) }, ... 352, ) == 0x0
 04887   396   NtWaitForSingleObject  (352, 0, {-1800000000, -1}, ... ) == 0x0
 04888   396   NtClose  (352, ... ) == 0x0
 04889   396   NtOpenThreadToken  (-2, 0xc, 1, ... ) == STATUS_NO_TOKEN
 04890   396   NtCreateEvent  (0x1f0003, 0x0, 1, 0, ... 352, ) == 0x0
 04891   396   NtOpenThreadToken  (-2, 0xc, 1, ... ) == STATUS_NO_TOKEN
 04892   396   NtSetInformationThread  (-2, ImpersonationToken, {ImpToken=0,}, 4, ... ) == 0x0
 04893   396   NtCreateFile  (0xc0100080, {24, 0, 0x40, 0, 1240896,  (0xc0100080, {24, 0, 0x40, 0, 1240896, "\??\PIPE\svcctl"}, 0x0, 0, 3, 1, 4194368, 0, 0, ... 376, {status=0x0, info=1}, ) }, 0x0, 0, 3, 1, 4194368, 0, 0, ... 376, {status=0x0, info=1}, ) == 0x0
 04894   396   NtSetInformationFile  (376, 1240952, 8, Pipe, ... {status=0x0, info=0}, ) == 0x0
 04895   396   NtSetInformationFile  (376, 1240944, 8, Completion, ... {status=0x0, info=0}, ) == 0x0
 04896   396   NtSetInformationThread  (-2, ImpersonationToken, {ImpToken=0,}, 4, ... ) == 0x0
 04897   396   NtWriteFile  (376, 297, 0, 0,  (376, 297, 0, 0, "\5\0\13\3\20\0\0\0H\0\0\0\1\0\0\0\270\20\270\20\0\0\0\0\1\0\0\0\0\0\1\0\201\273z6D\230\3615\2552\230\3608\0\20\3\2\0\0\0\4]\210\212\353\34\311\21\237\350\10\0+\20H`\2\0\0\0", 72, {0, 0}, 0, ... {status=0x0, info=72}, ) , 72, {0, 0}, 0, ... {status=0x0, info=72}, ) == 0x0
 04898   396   NtReadFile  (376, 297, 0, 0, 1024, {0, 0}, 0, ... {status=0x0, info=68},  (376, 297, 0, 0, 1024, {0, 0}, 0, ... {status=0x0, info=68}, "\5\0\14\3\20\0\0\0D\0\0\0\1\0\0\0\270\20\270\20D'\0\0\15\0\PIPE\ntsvcs\0\0\1\0\0\0\0\0\0\0\4]\210\212\353\34\311\21\237\350\10\0+\20H`\2\0\0\0", ) , ) == 0x0
 04899   396   NtFsControlFile  (376, 297, 0x0, 0x0, 0x11c017,  (376, 297, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0$\0\0\0\1\0\0\0\14\0\0\0\0\0\17\0\0\0\0\0\0\0\0\0\0\0\0\200", 36, 1024, ... {status=0x103, info=68}, "\5\0\14\3\20\0\0\0D\0\0\0\1\0\0\0\270\20\270\20D'\0\0\15\0\PIPE\ntsvcs\0\0\1\0\0\0\0\0\0\0\4]\210\212\353\34\311\21\237\350\10\0+\20H`\2\0\0\0", ) , 36, 1024, ... {status=0x103, info=68},  (376, 297, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0$\0\0\0\1\0\0\0\14\0\0\0\0\0\17\0\0\0\0\0\0\0\0\0\0\0\0\200", 36, 1024, ... {status=0x103, info=68}, "\5\0\14\3\20\0\0\0D\0\0\0\1\0\0\0\270\20\270\20D'\0\0\15\0\PIPE\ntsvcs\0\0\1\0\0\0\0\0\0\0\4]\210\212\353\34\311\21\237\350\10\0+\20H`\2\0\0\0", ) , ) == 0x103
 04900   396   NtFsControlFile  (376, 297, 0x0, 0x0, 0x11c017,  (376, 297, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0L\0\0\0\2\0\0\04\0\0\0\0\0\20\0\0\0\0\0\216G7\363\333?\334\21\261\310\0\14)\371\246\305\7\0\0\0\0\0\0\0\7\0\0\0R\0A\0S\0M\0A\0N\0\0\0\0\0\4\0\0\0", 76, 1024, ... {status=0x103, info=48}, "\5\0\2\3\20\0\0\00\0\0\0\1\0\0\0\30\0\0\0\0\0\0\0\0\0\0\0\216G7\363\333?\334\21\261\310\0\14)\371\246\305\0\0\0\0", ) , 76, 1024, ... {status=0x103, info=48},  (376, 297, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0L\0\0\0\2\0\0\04\0\0\0\0\0\20\0\0\0\0\0\216G7\363\333?\334\21\261\310\0\14)\371\246\305\7\0\0\0\0\0\0\0\7\0\0\0R\0A\0S\0M\0A\0N\0\0\0\0\0\4\0\0\0", 76, 1024, ... {status=0x103, info=48}, "\5\0\2\3\20\0\0\00\0\0\0\1\0\0\0\30\0\0\0\0\0\0\0\0\0\0\0\216G7\363\333?\334\21\261\310\0\14)\371\246\305\0\0\0\0", ) , ) == 0x103
 04901   396   NtFsControlFile  (376, 297, 0x0, 0x0, 0x11c017,  (376, 297, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0,\0\0\0\3\0\0\0\24\0\0\0\0\0\6\0\0\0\0\0\217G7\363\333?\334\21\261\310\0\14)\371\246\305", 44, 1024, ... {status=0x103, info=48}, "\5\0\2\3\20\0\0\00\0\0\0\2\0\0\0\30\0\0\0\0\0\0\0\0\0\0\0\217G7\363\333?\334\21\261\310\0\14)\371\246\305\0\0\0\0", ) , 44, 1024, ... {status=0x103, info=48},  (376, 297, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0,\0\0\0\3\0\0\0\24\0\0\0\0\0\6\0\0\0\0\0\217G7\363\333?\334\21\261\310\0\14)\371\246\305", 44, 1024, ... {status=0x103, info=48}, "\5\0\2\3\20\0\0\00\0\0\0\2\0\0\0\30\0\0\0\0\0\0\0\0\0\0\0\217G7\363\333?\334\21\261\310\0\14)\371\246\305\0\0\0\0", ) , ) == 0x103
 04902   396   NtFsControlFile  (376, 297, 0x0, 0x0, 0x11c017,  (376, 297, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0,\0\0\0\4\0\0\0\24\0\0\0\0\0\0\0\0\0\0\0\217G7\363\333?\334\21\261\310\0\14)\371\246\305", 44, 1024, ... {status=0x103, info=56}, "\5\0\2\3\20\0\0\08\0\0\0\3\0\0\0 \0\0\0\0\0\0\0 \0\0\0\1\0\0\0\0\0\0\05\4\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0", ) , 44, 1024, ... {status=0x103, info=56},  (376, 297, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0,\0\0\0\4\0\0\0\24\0\0\0\0\0\0\0\0\0\0\0\217G7\363\333?\334\21\261\310\0\14)\371\246\305", 44, 1024, ... {status=0x103, info=56}, "\5\0\2\3\20\0\0\08\0\0\0\3\0\0\0 \0\0\0\0\0\0\0 \0\0\0\1\0\0\0\0\0\0\05\4\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0", ) , ) == 0x103
 04903   396   NtFsControlFile  (376, 297, 0x0, 0x0, 0x11c017,  (376, 297, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0,\0\0\0\5\0\0\0\24\0\0\0\0\0\0\0\0\0\0\0\216G7\363\333?\334\21\261\310\0\14)\371\246\305", 44, 1024, ... {status=0x103, info=48}, "\5\0\2\3\20\0\0\00\0\0\0\4\0\0\0\30\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0", ) , 44, 1024, ... {status=0x103, info=48},  (376, 297, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0,\0\0\0\5\0\0\0\24\0\0\0\0\0\0\0\0\0\0\0\216G7\363\333?\334\21\261\310\0\14)\371\246\305", 44, 1024, ... {status=0x103, info=48}, "\5\0\2\3\20\0\0\00\0\0\0\4\0\0\0\30\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0", ) , ) == 0x103
 04904   396   NtClose  (352, ... ) == 0x0
 04905   396   NtClose  (376, ... ) == 0x0
 04906   396   NtReleaseMutant  (204, ... 0x0, ) == 0x0
 04907   396   NtQueryValueKey  (108,  (108, "EnableAutodial", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (108, "EnableAutodial", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) }, 16, ) == 0x0
 04908   396   NtQueryValueKey  (108,  (108, "NoNetAutodial", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (108, "NoNetAutodial", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) }, 16, ) == 0x0
 04909   396   NtWaitForMultipleObjects  (2, (264, 280, ), 1, 0, {0, 0}, ... ) == 0x102
 04910   396   NtCreateKey  (0x2001d, {24, 48, 0x40, 0, 0,  (0x2001d, {24, 48, 0x40, 0, 0, "Software\Microsoft\RAS AutoDial"}, 0, 0x0, 0, ... 376, 2, ) }, 0, 0x0, 0, ... 376, 2, ) == 0x0
 04911   396   NtCreateKey  (0x20019, {24, 376, 0x40, 0, 0,  (0x20019, {24, 376, 0x40, 0, 0, "Default"}, 0, 0x0, 0, ... 352, 2, ) }, 0, 0x0, 0, ... 352, 2, ) == 0x0
 04912   396   NtClose  (376, ... ) == 0x0
 04913   396   NtQueryValueKey  (352,  (352, "DefaultInternet", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 04914   396   NtClose  (352, ... ) == 0x0
 04915   396   NtWaitForSingleObject  (156, 0, 0x0, ... ) == 0x0
 04916   396   NtQueryInformationFile  (152, 1242316, 24, Standard, ... {status=0x0, info=24}, ) == 0x0
 04917   396   NtReleaseMutant  (156, ... 0x0, ) == 0x0
 04918   396   NtWaitForSingleObject  (156, 0, 0x0, ... ) == 0x0
 04919   396   NtQueryInformationFile  (152, 1242472, 24, Standard, ... {status=0x0, info=24}, ) == 0x0
 04920   396   NtReleaseMutant  (156, ... 0x0, ) == 0x0
 04921   396   NtReleaseMutant  (200, ... 0x0, ) == 0x0
 04922   396   NtUserGetMessage  (0, 0, 0, ...