Summary:

NtCallbackReturn(>) 1 NtOpenProcessToken(>) 2 NtOpenProcessTokenEx(>) 10 NtUserRegisterClassExWOW(>) 34
NtConnectPort(>) 1 NtQueryInstallUILanguage(>) 2 NtOpenThreadTokenEx(>) 10 NtContinue(>) 35
NtGdiCreateBitmap(>) 1 NtRaiseException(>) 2 NtWriteFile(>) 10 NtQueryDebugFilterState(>) 36
NtGdiInit(>) 1 NtAddAtom(>) 3 NtQueryVolumeInformationFile(>) 12 NtRequestWaitReplyPort(>) 36
NtGdiQueryFontAssocInfo(>) 1 NtClearEvent(>) 3 NtQueryInformationToken(>) 13 NtQuerySystemInformation(>) 43
NtGdiSelectBitmap(>) 1 NtGdiCreateCompatibleDC(>) 3 NtQueryDefaultUILanguage(>) 14 NtCreateEvent(>) 44
NtOpenKeyedEvent(>) 1 NtNotifyChangeKey(>) 3 NtReadFile(>) 14 NtSetInformationThread(>) 45
NtOpenProcess(>) 1 NtReleaseSemaphore(>) 3 NtUserFindWindowEx(>) 14 NtFreeVirtualMemory(>) 49
NtOpenSymbolicLinkObject(>) 1 NtSetInformationObject(>) 3 NtCreateKey(>) 15 NtCreateSection(>) 52
NtQueryEvent(>) 1 NtTerminateProcess(>) 3 NtSetValueKey(>) 15 NtQueryVirtualMemory(>) 53
NtQueryObject(>) 1 NtUserGetDC(>) 3 NtSetInformationFile(>) 16 NtUserGetClassInfo(>) 54
NtQuerySymbolicLinkObject(>) 1 NtWaitForMultipleObjects(>) 3 NtFsControlFile(>) 18 NtOpenSection(>) 56
NtQuerySystemTime(>) 1 NtDuplicateObject(>) 4 NtUserUnregisterClass(>) 19 NtOpenFile(>) 74
NtQueryTimerResolution(>) 1 NtEnumerateKey(>) 4 NtQueryInformationFile(>) 20 NtMapViewOfSection(>) 80
NtSecureConnectPort(>) 1 NtGdiGetStockObject(>) 5 NtUserRegisterWindowMessage(>) 22 NtProtectVirtualMemory(>) 82
NtSetInformationProcess(>) 1 NtCreateMutant(>) 6 NtUserFindExistingCursorIcon(>) 24 NtSetEvent(>) 92
NtUserCallNoParam(>) 1 NtDeviceIoControlFile(>) 6 NtCreateThread(>) 25 NtQueryAttributesFile(>) 118
NtUserGetForegroundWindow(>) 1 NtOpenEvent(>) 6 NtFlushInstructionCache(>) 25 NtDelayExecution(>) 120
NtUserGetObjectInformation(>) 1 NtOpenThreadToken(>) 7 NtQueryInformationThread(>) 25 NtWaitForSingleObject(>) 141
NtUserGetProcessWindowStation(>) 1 NtQueryInformationProcess(>) 7 NtResumeThread(>) 25 NtOpenKey(>) 157
NtUserGetThreadDesktop(>) 1 NtUserSystemParametersInfo(>) 7 NtCreateFile(>) 26 NtAllocateVirtualMemory(>) 223
NtUserQueryWindow(>) 1 NtQueryDefaultLocale(>) 9 NtRegisterThreadTerminatePort(>) 26 NtClose(>) 318
NtCreateIoCompletion(>) 2 NtReleaseMutant(>) 9 NtTestAlert(>) 26 NtQueryValueKey(>) 329
NtGdiCreateSolidBrush(>) 2 NtCreateSemaphore(>) 10 NtQuerySection(>) 33
NtOpenDirectoryObject(>) 2 NtOpenMutant(>) 10

Trace:

00001 432 NtOpenKey (0x80000000, {24, 0, 0x40, 0, 0, (0x80000000, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\packed.exe"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 00002 432 NtOpenKeyedEvent (0x2000000, {24, 0, 0x0, 0, 0, (0x2000000, {24, 0, 0x0, 0, 0, "\KernelObjects\CritSecOutOfMemoryEvent"}, ... 4, ) }, ... 4, ) == 0x0 00003 432 NtQuerySystemInformation (Basic, 44, ... {Unknown=0,MaximumIncrement=156250,PhysicalPageSize=0x1000,NumberOfPhysicalPages=0xff7c,LowestPhysicalPage=0x1,HighestPhysicalPage=0xffff,AllocationGranularity=0x10000,LowestUserAddress=0x10000,HighestUserAddress=0x7ffeffff,ActiveProcessors=1,NumberProcessors=1,}, 0x0, ) == 0x0 00004 432 NtAllocateVirtualMemory (-1, 0, 0, 1048576, 8192, 4, ... 1310720, 1048576, ) == 0x0 00005 432 NtAllocateVirtualMemory (-1, 1310720, 0, 4096, 4096, 4, ... 1310720, 4096, ) == 0x0 00006 432 NtAllocateVirtualMemory (-1, 1314816, 0, 8192, 4096, 4, ... 1314816, 8192, ) == 0x0 00007 432 NtQuerySystemInformation (Basic, 44, ... {Unknown=0,MaximumIncrement=156250,PhysicalPageSize=0x1000,NumberOfPhysicalPages=0xff7c,LowestPhysicalPage=0x1,HighestPhysicalPage=0xffff,AllocationGranularity=0x10000,LowestUserAddress=0x10000,HighestUserAddress=0x7ffeffff,ActiveProcessors=1,NumberProcessors=1,}, 0x0, ) == 0x0 00008 432 NtAllocateVirtualMemory (-1, 0, 0, 65536, 8192, 4, ... 2359296, 65536, ) == 0x0 00009 432 NtAllocateVirtualMemory (-1, 2359296, 0, 24576, 4096, 4, ... 2359296, 24576, ) == 0x0 00010 432 NtOpenDirectoryObject (0x3, {24, 0, 0x40, 0, 0, (0x3, {24, 0, 0x40, 0, 0, "\KnownDlls"}, ... 8, ) }, ... 8, ) == 0x0 00011 432 NtOpenSymbolicLinkObject (0x1, {24, 8, 0x40, 0, 0, (0x1, {24, 8, 0x40, 0, 0, "KnownDllPath"}, ... 12, ) }, ... 12, ) == 0x0 00012 432 NtQuerySymbolicLinkObject (12, ... (12, ... "C:\WINDOWS\system32", 0x0, ) , 0x0, ) == 0x0 00013 432 NtClose (12, ... ) == 0x0 00014 432 NtOpenFile (0x100020, {24, 0, 0x42, 0, 0, (0x100020, {24, 0, 0x42, 0, 0, "\??\U:\startupscripts\"}, 3, 33, ... 12, {status=0x0, info=1}, ) }, 3, 33, ... 12, {status=0x0, info=1}, ) == 0x0 00015 432 NtQueryVolumeInformationFile (12, 1243848, 8, Device, ... {status=0x0, info=8}, ) == 0x0 00016 432 NtFsControlFile (12, 0, 0x0, 0x0, 0x90028, 0x0, 0, 0, ... ) == STATUS_INVALID_PARAMETER 00017 432 NtQueryAttributesFile ({24, 0, 0x40, 0, 0, ({24, 0, 0x40, 0, 0, "\??\u:\work\packed.exe.Local"}, 1243832, ... ) }, 1243832, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 00018 432 NtOpenSection (0xe, {24, 8, 0x40, 0, 0, (0xe, {24, 8, 0x40, 0, 0, "kernel32.dll"}, ... 16, ) }, ... 16, ) == 0x0 00019 432 NtMapViewOfSection (16, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x77e60000), 0x0, 937984, ) == 0x0 00020 432 NtClose (16, ... ) == 0x0 00021 432 NtQuerySystemInformation (RangeStart, 4, ... {system info, class 50, size 4}, 0x0, ) == 0x0 00022 432 NtQuerySystemInformation (Basic, 44, ... {Unknown=0,MaximumIncrement=156250,PhysicalPageSize=0x1000,NumberOfPhysicalPages=0xff7c,LowestPhysicalPage=0x1,HighestPhysicalPage=0xffff,AllocationGranularity=0x10000,LowestUserAddress=0x10000,HighestUserAddress=0x7ffeffff,ActiveProcessors=1,NumberProcessors=1,}, 0x0, ) == 0x0 00023 432 NtCreateSection (0xf001f, 0x0, {65536, 0}, 4, 67108864, 0, ... 16, ) == 0x0 00024 432 NtSecureConnectPort ( ("\Windows\ApiPort", {0, 2, 1, 1}, {24, 16, 0, 65536, 0, 0}, 1319736, {12, 0, 0}, 1242016, 44, ... 24, {24, 16, 0, 65536, 2424832, 18415616}, {0, 0, 0}, 200, 44, ) , {0, 2, 1, 1}, {24, 16, 0, 65536, 0, 0}, 1319736, {12, 0, 0}, 1242016, 44, ... 24, {24, 16, 0, 65536, 2424832, 18415616}, {0, 0, 0}, 200, 44, ) == 0x0 00025 432 NtClose (16, ... ) == 0x0 00026 432 NtQueryObject (24, Handle, 2, ... {Inherit=0,ProtectFromClose=0,}, -1, ) == 0x0 00027 432 NtSetInformationObject (24, Handle, {Inherit=0,ProtectFromClose=1,}, 256, ... ) == 0x0 00028 432 NtQuerySystemInformation (Basic, 44, ... {Unknown=0,MaximumIncrement=156250,PhysicalPageSize=0x1000,NumberOfPhysicalPages=0xff7c,LowestPhysicalPage=0x1,HighestPhysicalPage=0xffff,AllocationGranularity=0x10000,LowestUserAddress=0x10000,HighestUserAddress=0x7ffeffff,ActiveProcessors=1,NumberProcessors=1,}, 0x0, ) == 0x0 00029 432 NtQueryVirtualMemory (-1, 0x250000, Basic, 28, ... {BaseAddress=0x250000,AllocationBase=0x250000,AllocationProtect=0x4,RegionSize=0x10000,State=0x2000,Protect=0x0,Type=0x40000,}, 0x0, ) == 0x0 00030 432 NtAllocateVirtualMemory (-1, 2424832, 0, 4096, 4096, 4, ... 2424832, 4096, ) == 0x0 00031 432 NtRequestWaitReplyPort (24, {28, 56, new_msg, 0, 0, 0, 0, 0} (24, {28, 56, new_msg, 0, 0, 0, 0, 0} "\210\6\31\1\0\0\0\0\0\0\0\0\0\0\0\0\1\0\0\0\234\6\31\1\4\0\0\0" ... {28, 56, reply, 0, 428, 432, 1478, 0} "\20>\27\0\0\0\0\0\0\0\0\0\0\0\0\0\1\0\0\0\234\6\31\1\4\0\0\0" ) ... {28, 56, reply, 0, 428, 432, 1478, 0} (24, {28, 56, new_msg, 0, 0, 0, 0, 0} "\210\6\31\1\0\0\0\0\0\0\0\0\0\0\0\0\1\0\0\0\234\6\31\1\4\0\0\0" ... {28, 56, reply, 0, 428, 432, 1478, 0} "\20>\27\0\0\0\0\0\0\0\0\0\0\0\0\0\1\0\0\0\234\6\31\1\4\0\0\0" ) ) == 0x0 00032 432 NtRegisterThreadTerminatePort (24, ... ) == 0x0 00033 432 NtOpenKey (0x20019, {24, 0, 0x40, 0, 0, (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\System\CurrentControlSet\Control\Terminal Server"}, ... 16, ) }, ... 16, ) == 0x0 00034 432 NtQueryValueKey (16, (16, "TSAppCompat", Partial, 548, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) , Partial, 548, ... TitleIdx=0, Type=4, Data= (16, "TSAppCompat", Partial, 548, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) }, 16, ) == 0x0 00035 432 NtClose (16, ... ) == 0x0 00036 432 NtAllocateVirtualMemory (-1, 1232896, 0, 4096, 4096, 260, ... 1232896, 4096, ) == 0x0 00037 432 NtOpenMutant (0x1, {24, 0, 0x40, 0, 0, (0x1, {24, 0, 0x40, 0, 0, "\NlsCacheMutant"}, ... 16, ) }, ... 16, ) == 0x0 00038 432 NtOpenSection (0x4, {24, 0, 0x40, 0, 0, (0x4, {24, 0, 0x40, 0, 0, "\NLS\NlsSectionUnicode"}, ... 28, ) }, ... 28, ) == 0x0 00039 432 NtMapViewOfSection (28, -1, (0x0), 0, 0, 0x0, 0, 2, 0, 2, ... (0x260000), 0x0, 90112, ) == 0x0 00040 432 NtClose (28, ... ) == 0x0 00041 432 NtQueryDefaultLocale (0, 2012046252, ... ) == 0x0 00042 432 NtOpenSection (0x4, {24, 0, 0x40, 0, 0, (0x4, {24, 0, 0x40, 0, 0, "\NLS\NlsSectionLocale"}, ... 28, ) }, ... 28, ) == 0x0 00043 432 NtMapViewOfSection (28, -1, (0x0), 0, 0, 0x0, 0, 2, 0, 2, ... (0x280000), 0x0, 212992, ) == 0x0 00044 432 NtClose (28, ... ) == 0x0 00045 432 NtOpenSection (0x5, {24, 0, 0x40, 0, 0, (0x5, {24, 0, 0x40, 0, 0, "\NLS\NlsSectionSortkey"}, ... 28, ) }, ... 28, ) == 0x0 00046 432 NtMapViewOfSection (28, -1, (0x0), 0, 0, 0x0, 0, 2, 0, 2, ... (0x2c0000), 0x0, 266240, ) == 0x0 00047 432 NtQuerySection (28, Basic, 16, ... {BaseAddress=0x0,Attributes=0x800000,Size={0x40004, 0x0},}, 0x0, ) == 0x0 00048 432 NtClose (28, ... ) == 0x0 00049 432 NtOpenSection (0x4, {24, 0, 0x40, 0, 0, (0x4, {24, 0, 0x40, 0, 0, "\NLS\NlsSectionSortTbls"}, ... 28, ) }, ... 28, ) == 0x0 00050 432 NtMapViewOfSection (28, -1, (0x0), 0, 0, 0x0, 0, 2, 0, 2, ... (0x310000), 0x0, 24576, ) == 0x0 00051 432 NtClose (28, ... ) == 0x0 00052 432 NtQueryVirtualMemory (-1, 0x7ffd2000, Basic, 28, ... {BaseAddress=0x7ffd2000,AllocationBase=0x7ffb0000,AllocationProtect=0x2,RegionSize=0x2000,State=0x1000,Protect=0x2,Type=0x40000,}, 0x0, ) == 0x0 00053 432 NtOpenSection (0x4, {24, 0, 0x40, 0, 0, (0x4, {24, 0, 0x40, 0, 0, "\NLS\NlsSectionSortkey00000409"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 00054 432 NtOpenSection (0x4, {24, 0, 0x40, 0, 0, (0x4, {24, 0, 0x40, 0, 0, "\NLS\NlsSectionSortkey00000409"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 00055 432 NtRequestWaitReplyPort (24, {28, 56, new_msg, 0, 2012558373, 2012047104, 2013025280, 0} (24, {28, 56, new_msg, 0, 2012558373, 2012047104, 2013025280, 0} "\210\6\31\1\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\234\6\31\18\6\0\0" ... {28, 56, reply, 0, 428, 432, 1479, 0} "(\261\26\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\234\6\31\18\6\0\0" ) ... {28, 56, reply, 0, 428, 432, 1479, 0} (24, {28, 56, new_msg, 0, 2012558373, 2012047104, 2013025280, 0} "\210\6\31\1\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\234\6\31\18\6\0\0" ... {28, 56, reply, 0, 428, 432, 1479, 0} "(\261\26\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\234\6\31\18\6\0\0" ) ) == 0x0 00056 432 NtProtectVirtualMemory (-1, (0x484000), 4096, 4, ... (0x484000), 4096, 8, ) == 0x0 00057 432 NtProtectVirtualMemory (-1, (0x484000), 4096, 8, ... (0x484000), 4096, 4, ) == 0x0 00058 432 NtFlushInstructionCache (-1, 4734976, 4096, ... ) == 0x0 00059 432 NtOpenSection (0xe, {24, 8, 0x40, 0, 0, (0xe, {24, 8, 0x40, 0, 0, "COMCTL32.dll"}, ... 28, ) }, ... 28, ) == 0x0 00060 432 NtMapViewOfSection (28, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x77340000), 0x0, 569344, ) == 0x0 00061 432 NtClose (28, ... ) == 0x0 00062 432 NtOpenSection (0xe, {24, 8, 0x40, 0, 0, (0xe, {24, 8, 0x40, 0, 0, "GDI32.dll"}, ... 28, ) }, ... 28, ) == 0x0 00063 432 NtMapViewOfSection (28, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x77c70000), 0x0, 262144, ) == 0x0 00064 432 NtClose (28, ... ) == 0x0 00065 432 NtOpenSection (0xe, {24, 8, 0x40, 0, 0, (0xe, {24, 8, 0x40, 0, 0, "USER32.dll"}, ... 28, ) }, ... 28, ) == 0x0 00066 432 NtMapViewOfSection (28, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x77d40000), 0x0, 577536, ) == 0x0 00067 432 NtClose (28, ... ) == 0x0 00068 432 NtOpenSection (0xe, {24, 8, 0x40, 0, 0, (0xe, {24, 8, 0x40, 0, 0, "ADVAPI32.dll"}, ... 28, ) }, ... 28, ) == 0x0 00069 432 NtMapViewOfSection (28, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x77dd0000), 0x0, 569344, ) == 0x0 00070 432 NtClose (28, ... ) == 0x0 00071 432 NtOpenSection (0xe, {24, 8, 0x40, 0, 0, (0xe, {24, 8, 0x40, 0, 0, "RPCRT4.dll"}, ... 28, ) }, ... 28, ) == 0x0 00072 432 NtMapViewOfSection (28, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x77cc0000), 0x0, 479232, ) == 0x0 00073 432 NtClose (28, ... ) == 0x0 00074 432 NtProtectVirtualMemory (-1, (0x484000), 4096, 4, ... (0x484000), 4096, 4, ) == 0x0 00075 432 NtProtectVirtualMemory (-1, (0x484000), 4096, 4, ... (0x484000), 4096, 4, ) == 0x0 00076 432 NtFlushInstructionCache (-1, 4734976, 4096, ... ) == 0x0 00077 432 NtOpenProcessToken (-1, 0x8, ... 28, ) == 0x0 00078 432 NtQueryInformationToken (28, Statistics, 56, ... {token info, class 10, size 56}, 56, ) == 0x0 00079 432 NtClose (28, ... ) == 0x0 00080 432 NtOpenKey (0x20019, {24, 0, 0x40, 0, 0, (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\System\CurrentControlSet\Control\Terminal Server"}, ... 28, ) }, ... 28, ) == 0x0 00081 432 NtQueryValueKey (28, (28, "TSAppCompat", Partial, 548, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) , Partial, 548, ... TitleIdx=0, Type=4, Data= (28, "TSAppCompat", Partial, 548, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) }, 16, ) == 0x0 00082 432 NtClose (28, ... ) == 0x0 00083 432 NtQuerySystemInformation (Basic, 44, ... {Unknown=0,MaximumIncrement=156250,PhysicalPageSize=0x1000,NumberOfPhysicalPages=0xff7c,LowestPhysicalPage=0x1,HighestPhysicalPage=0xffff,AllocationGranularity=0x10000,LowestUserAddress=0x10000,HighestUserAddress=0x7ffeffff,ActiveProcessors=1,NumberProcessors=1,}, 0x0, ) == 0x0 00084 432 NtRequestWaitReplyPort (24, {28, 56, new_msg, 0, 1246456, 1, 24, 2012568566} (24, {28, 56, new_msg, 0, 1246456, 1, 24, 2012568566} "\210\6\31\1\0\0\0\0\314\4\23\0\374\207\16\366\3\0\0\0\234\6\31\1$\1\0\0" ... {28, 56, reply, 0, 428, 432, 1482, 0} "XQ\26\0\0\0\0\0\0\0\0\0\374\207\16\366\3\0\0\0\234\6\31\1$\1\0\0" ) ... {28, 56, reply, 0, 428, 432, 1482, 0} (24, {28, 56, new_msg, 0, 1246456, 1, 24, 2012568566} "\210\6\31\1\0\0\0\0\314\4\23\0\374\207\16\366\3\0\0\0\234\6\31\1$\1\0\0" ... {28, 56, reply, 0, 428, 432, 1482, 0} "XQ\26\0\0\0\0\0\0\0\0\0\374\207\16\366\3\0\0\0\234\6\31\1$\1\0\0" ) ) == 0x0 00085 432 NtOpenKey (0x20019, {24, 0, 0x40, 0, 0, (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\System\CurrentControlSet\Control\Error Message Instrument\"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 00086 432 NtMapViewOfSection (28, -1, (0x0), 0, 0, 0x0, 0, 2, 0, 2, ... (0x590000), 0x0, 1060864, ) == 0x0 00087 432 NtCreateEvent (0x1f0003, 0x0, 1, 0, ... 32, ) == 0x0 00088 432 NtOpenThreadTokenEx (-2, 0x8, 1, 512, ... ) == STATUS_NO_TOKEN 00089 432 NtOpenProcessTokenEx (-1, 0x8, 512, ... -2147482020, ) == 0x0 00090 432 NtQueryInformationToken (-2147482020, Statistics, 0, ... ) == STATUS_BUFFER_TOO_SMALL 00091 432 NtQueryInformationToken (-2147482020, Statistics, 56, ... {token info, class 10, size 56}, 56, ) == 0x0 00092 432 NtClose (-2147482020, ... ) == 0x0 00093 432 NtAllocateVirtualMemory (-1, 0, 0, 32, 4096, 4, ... 4128768, 4096, ) == 0x0 00094 432 NtFreeVirtualMemory (-1, (0x3f0000), 4096, 32768, ... (0x3f0000), 4096, ) == 0x0 00095 432 NtDuplicateObject (-1, 36, -1, 0x0, 0, 2, ... 44, ) == 0x0 00096 432 NtOpenKey (0x20019, {24, 0, 0x240, 0, 0, (0x20019, {24, 0, 0x240, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Compatibility32"}, ... -2147482020, ) }, ... -2147482020, ) == 0x0 00097 432 NtQueryValueKey (-2147482020, (-2147482020, "packed", Partial, 172, ... ) , Partial, 172, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 00098 432 NtClose (-2147482020, ... ) == 0x0 00099 432 NtOpenKey (0x20019, {24, 0, 0x240, 0, 0, (0x20019, {24, 0, 0x240, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\IME Compatibility"}, ... -2147482020, ) }, ... -2147482020, ) == 0x0 00100 432 NtQueryValueKey (-2147482020, (-2147482020, "packed", Partial, 172, ... ) , Partial, 172, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 00101 432 NtClose (-2147482020, ... ) == 0x0 00102 432 NtQueryDefaultLocale (0, -104224244, ... ) == 0x0 00103 432 NtGdiQueryFontAssocInfo (0, ... ) == 0x0 00104 432 NtUserCallNoParam (24, ... ) == 0x0 00105 432 NtGdiCreateCompatibleDC (0, ... 00106 432 NtAllocateVirtualMemory (-1, 0, 0, 4096, 12288, 4, ... 4128768, 4096, ) == 0x0 00105 432 NtGdiCreateCompatibleDC ... ) == 0x1801032b 00107 432 NtGdiGetStockObject (0, ... ) == 0x1900010 00108 432 NtGdiGetStockObject (4, ... ) == 0x1900011 00109 432 NtGdiCreateBitmap (8, 8, 1, 1, 2010393708, ... ) == 0x110503bb 00110 432 NtGdiCreateSolidBrush (0, 0, ... 00111 432 NtAllocateVirtualMemory (-1, 0, 0, 4096, 12288, 4, ... 10092544, 4096, ) == 0x0 00110 432 NtGdiCreateSolidBrush ... ) == 0x201003c3 00112 432 NtGdiGetStockObject (13, ... ) == 0x18a0021 00113 432 NtGdiCreateCompatibleDC (0, ... ) == 0x360103e3 00114 432 NtGdiSelectBitmap (906036195, 285541307, ... ) == 0x185000f 00115 432 NtUserGetThreadDesktop (432, 0, ... ) == 0x28 00116 432 NtOpenKey (0x20019, {24, 0, 0x40, 0, 0, (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Windows"}, ... 48, ) }, ... 48, ) == 0x0 00117 432 NtQueryValueKey (48, (48, "AppInit_DLLs", Partial, 64, ... TitleIdx=0, Type=1, Data="\0\0"}, 14, ) , Partial, 64, ... TitleIdx=0, Type=1, Data= (48, "AppInit_DLLs", Partial, 64, ... TitleIdx=0, Type=1, Data="\0\0"}, 14, ) }, 14, ) == 0x0 00118 432 NtClose (48, ... ) == 0x0 00119 432 NtUserFindExistingCursorIcon (1241204, 1241220, 1241788, ... ) == 0x10011 00120 432 NtUserRegisterClassExWOW (1241724, 1241804, 1241788, 1241820, 673, 128, 0, ... ) == 0x810dc017 00121 432 NtUserFindExistingCursorIcon (1241204, 1241220, 1241788, ... ) == 0x10011 00122 432 NtUserRegisterClassExWOW (1241724, 1241804, 1241788, 1241820, 674, 128, 0, ... ) == 0x810dc01c 00123 432 NtUserFindExistingCursorIcon (1241204, 1241220, 1241788, ... ) == 0x10011 00124 432 NtUserRegisterClassExWOW (1241724, 1241804, 1241788, 1241820, 675, 128, 0, ... ) == 0x810dc01e 00125 432 NtUserFindExistingCursorIcon (1241204, 1241220, 1241788, ... ) == 0x10011 00126 432 NtUserRegisterClassExWOW (1241724, 1241804, 1241788, 1241820, 676, 128, 0, ... ) == 0x810d8002 00127 432 NtUserFindExistingCursorIcon (1241204, 1241220, 1241788, ... ) == 0x10013 00128 432 NtUserRegisterClassExWOW (1241724, 1241804, 1241788, 1241820, 677, 128, 0, ... ) == 0x810dc018 00129 432 NtUserFindExistingCursorIcon (1241204, 1241220, 1241788, ... ) == 0x10011 00130 432 NtUserRegisterClassExWOW (1241724, 1241804, 1241788, 1241820, 678, 128, 0, ... ) == 0x810dc01a 00131 432 NtUserFindExistingCursorIcon (1241204, 1241220, 1241788, ... ) == 0x10011 00132 432 NtUserRegisterClassExWOW (1241724, 1241804, 1241788, 1241820, 679, 128, 0, ... ) == 0x810dc01d 00133 432 NtUserFindExistingCursorIcon (1241204, 1241220, 1241788, ... ) == 0x10011 00134 432 NtUserRegisterClassExWOW (1241724, 1241804, 1241788, 1241820, 681, 128, 0, ... 00135 432 NtAllocateVirtualMemory (-1, 7041024, 0, 4096, 4096, 32, ... 7041024, 4096, ) == 0x0 00134 432 NtUserRegisterClassExWOW ... ) == 0x810dc026 00136 432 NtUserFindExistingCursorIcon (1241204, 1241220, 1241788, ... ) == 0x10011 00137 432 NtUserRegisterClassExWOW (1241724, 1241804, 1241788, 1241820, 680, 128, 0, ... ) == 0x810dc019 00138 432 NtUserRegisterClassExWOW (1241676, 1241756, 1241740, 1241772, 0, 128, 0, ... ) == 0x810dc020 00139 432 NtUserRegisterClassExWOW (1241676, 1241752, 1241768, 1241740, 0, 130, 0, ... ) == 0x810dc022 00140 432 NtUserRegisterClassExWOW (1241676, 1241756, 1241740, 1241772, 0, 128, 0, ... ) == 0x810dc023 00141 432 NtAllocateVirtualMemory (-1, 1323008, 0, 4096, 4096, 4, ... 1323008, 4096, ) == 0x0 00142 432 NtUserRegisterClassExWOW (1241676, 1241752, 1241768, 1241740, 0, 130, 0, ... ) == 0x810dc024 00143 432 NtUserRegisterClassExWOW (1241676, 1241756, 1241740, 1241772, 0, 128, 0, ... ) == 0x810dc025 00144 432 NtCallbackReturn (0, 0, 0, ... 00145 432 NtGdiInit (... ) == 0x1 00146 432 NtGdiGetStockObject (18, ... ) == 0x290001c 00147 432 NtGdiGetStockObject (19, ... ) == 0x1b00019 00148 432 NtOpenKey (0x20019, {24, 0, 0x40, 0, 0, (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\System\CurrentControlSet\Control\Terminal Server"}, ... 48, ) }, ... 48, ) == 0x0 00149 432 NtQueryValueKey (48, (48, "TSAppCompat", Partial, 548, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) , Partial, 548, ... TitleIdx=0, Type=4, Data= (48, "TSAppCompat", Partial, 548, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) }, 16, ) == 0x0 00150 432 NtQueryValueKey (48, (48, "TSUserEnabled", Partial, 548, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) , Partial, 548, ... TitleIdx=0, Type=4, Data= (48, "TSUserEnabled", Partial, 548, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) }, 16, ) == 0x0 00151 432 NtClose (48, ... ) == 0x0 00152 432 NtOpenKey (0x20019, {24, 0, 0x40, 0, 0, (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon"}, ... 48, ) }, ... 48, ) == 0x0 00153 432 NtQueryValueKey (48, (48, "LeakTrack", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 00154 432 NtClose (48, ... ) == 0x0 00155 432 NtOpenKey (0x2000000, {24, 0, 0x40, 0, 0, (0x2000000, {24, 0, 0x40, 0, 0, "\REGISTRY\MACHINE"}, ... 48, ) }, ... 48, ) == 0x0 00156 432 NtSetInformationObject (48, Handle, {Inherit=0,ProtectFromClose=1,}, 2011365632, ... ) == 0x0 00157 432 NtOpenKey (0x20019, {24, 48, 0x40, 0, 0, (0x20019, {24, 48, 0x40, 0, 0, "Software\Microsoft\Windows NT\CurrentVersion\Diagnostics"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 00158 432 NtOpenKey (0x1, {24, 0, 0x40, 0, 0, (0x1, {24, 0, 0x40, 0, 0, "\Registry\MACHINE\System\CurrentControlSet\Control\Session Manager"}, ... 52, ) }, ... 52, ) == 0x0 00159 432 NtQueryValueKey (52, (52, "SafeDllSearchMode", Partial, 16, ... ) , Partial, 16, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 00160 432 NtClose (52, ... ) == 0x0 00161 432 NtOpenProcess (0x400, {24, 0, 0x0, 0, 0, 0x0}, {428, 0}, ... 52, ) == 0x0 00162 432 NtQueryInformationProcess (52, Session, 4, ... {SessionId=0,}, 0x0, ) == 0x0 00163 432 NtClose (52, ... ) == 0x0 00164 432 NtUserRegisterWindowMessage ( ("ShellGetDragImage", ... ) , ... ) == 0xc03a 00165 432 NtUserSystemParametersInfo (104, 0, 2000318720, 0, ... ) == 0x1 00166 432 NtUserSystemParametersInfo (38, 4, 2000318708, 0, ... ) == 0x1 00167 432 NtOpenThreadTokenEx (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN 00168 432 NtOpenProcessTokenEx (-1, 0x20008, 512, ... 52, ) == 0x0 00169 432 NtQueryInformationToken (52, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0 00170 432 NtClose (52, ... ) == 0x0 00171 432 NtOpenKey (0x2000000, {24, 0, 0x640, 0, 0, (0x2000000, {24, 0, 0x640, 0, 0, "\REGISTRY\USER\S-1-5-21-1078081533-484763869-839522115-1003"}, ... 52, ) }, ... 52, ) == 0x0 00172 432 NtSetInformationObject (52, Handle, {Inherit=0,ProtectFromClose=1,}, 1179904, ... ) == 0x0 00173 432 NtOpenKey (0x20019, {24, 52, 0x40, 0, 0, (0x20019, {24, 52, 0x40, 0, 0, "Control Panel\Desktop"}, ... 56, ) }, ... 56, ) == 0x0 00174 432 NtQueryValueKey (56, (56, "SmoothScroll", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 00175 432 NtClose (56, ... ) == 0x0 00176 432 NtUserSystemParametersInfo (41, 500, 1243132, 0, ... ) == 0x1 00177 432 NtUserSystemParametersInfo (102, 0, 2000318732, 0, ... ) == 0x1 00178 432 NtUserGetClassInfo (1999896576, 1243540, 1243492, 1243568, 0, ... ) == 0x0 00179 432 NtUserFindExistingCursorIcon (1242924, 1242940, 1243508, ... ) == 0x10011 00180 432 NtUserRegisterClassExWOW (1243376, 1243456, 1243440, 1243472, 0, 384, 0, ... ) == 0x810dc03b 00181 432 NtUserGetClassInfo (1999896576, 1243540, 1243492, 1243568, 0, ... ) == 0x0 00182 432 NtUserRegisterClassExWOW (1243376, 1243456, 1243440, 1243472, 0, 384, 0, ... ) == 0x810dc03d 00183 432 NtUserGetClassInfo (1999896576, 1243540, 1243492, 1243568, 0, ... ) == 0x0 00184 432 NtUserFindExistingCursorIcon (1242924, 1242940, 1243508, ... ) == 0x10011 00185 432 NtUserRegisterClassExWOW (1243376, 1243456, 1243440, 1243472, 0, 384, 0, ... ) == 0x810dc03f 00186 432 NtUserGetClassInfo (1999896576, 1243540, 1243492, 1243568, 0, ... ) == 0x0 00187 432 NtUserFindExistingCursorIcon (1242924, 1242940, 1243508, ... ) == 0x10011 00188 432 NtUserRegisterClassExWOW (1243376, 1243456, 1243440, 1243472, 0, 384, 0, ... ) == 0x810dc041 00189 432 NtUserGetClassInfo (1999896576, 1243540, 1243492, 1243568, 0, ... ) == 0x0 00190 432 NtUserFindExistingCursorIcon (1242924, 1242940, 1243508, ... ) == 0x10011 00191 432 NtUserRegisterClassExWOW (1243376, 1243456, 1243440, 1243472, 0, 384, 0, ... ) == 0x810dc043 00192 432 NtUserGetClassInfo (1999896576, 1243540, 1243492, 1243568, 0, ... ) == 0x0 00193 432 NtUserRegisterClassExWOW (1243376, 1243456, 1243440, 1243472, 0, 384, 0, ... ) == 0x810dc045 00194 432 NtUserGetClassInfo (1999896576, 1243540, 1243492, 1243568, 0, ... ) == 0x0 00195 432 NtUserFindExistingCursorIcon (1242924, 1242940, 1243508, ... ) == 0x10011 00196 432 NtUserRegisterClassExWOW (1243376, 1243456, 1243440, 1243472, 0, 384, 0, ... ) == 0x810dc047 00197 432 NtUserGetClassInfo (1999896576, 1243540, 1243492, 1243568, 0, ... ) == 0x0 00198 432 NtUserFindExistingCursorIcon (1242920, 1242936, 1243504, ... ) == 0x10011 00199 432 NtUserRegisterClassExWOW (1243372, 1243452, 1243436, 1243468, 0, 384, 0, ... ) == 0x810dc049 00200 432 NtUserGetClassInfo (1999896576, 1243540, 1243492, 1243568, 0, ... ) == 0x0 00201 432 NtUserFindExistingCursorIcon (1242924, 1242940, 1243508, ... ) == 0x10011 00202 432 NtUserRegisterClassExWOW (1243376, 1243456, 1243440, 1243472, 0, 384, 0, ... ) == 0x810dc04b 00203 432 NtUserGetClassInfo (1999896576, 1243540, 1243492, 1243568, 0, ... ) == 0x0 00204 432 NtUserFindExistingCursorIcon (1242924, 1242940, 1243508, ... ) == 0x10011 00205 432 NtUserRegisterClassExWOW (1243376, 1243456, 1243440, 1243472, 0, 384, 0, ... ) == 0x810dc04d 00206 432 NtUserGetClassInfo (1999896576, 1243540, 1243492, 1243568, 0, ... ) == 0x0 00207 432 NtUserFindExistingCursorIcon (1242924, 1242940, 1243508, ... ) == 0x10011 00208 432 NtUserRegisterClassExWOW (1243376, 1243456, 1243440, 1243472, 0, 384, 0, ... ) == 0x810dc04f 00209 432 NtUserGetClassInfo (1999896576, 1243544, 1243496, 1243572, 0, ... ) == 0x0 00210 432 NtUserRegisterClassExWOW (1243380, 1243460, 1243444, 1243476, 0, 384, 0, ... ) == 0x810dc051 00211 432 NtUserGetClassInfo (1999896576, 1243540, 1243492, 1243568, 0, ... ) == 0x0 00212 432 NtUserFindExistingCursorIcon (1242924, 1242940, 1243508, ... ) == 0x10011 00213 432 NtUserRegisterClassExWOW (1243376, 1243456, 1243440, 1243472, 0, 384, 0, ... ) == 0x810dc053 00214 432 NtUserGetClassInfo (1999896576, 1243540, 1243492, 1243568, 0, ... ) == 0x0 00215 432 NtUserFindExistingCursorIcon (1242924, 1242940, 1243508, ... ) == 0x10011 00216 432 NtUserRegisterClassExWOW (1243376, 1243456, 1243440, 1243472, 0, 384, 0, ... ) == 0x810dc055 00217 432 NtUserRegisterClassExWOW (1243376, 1243456, 1243440, 1243472, 0, 384, 0, ... ) == 0x810dc057 00218 432 NtUserGetClassInfo (1999896576, 1243540, 1243492, 1243568, 0, ... ) == 0x0 00219 432 NtUserFindExistingCursorIcon (1242924, 1242940, 1243508, ... ) == 0x10011 00220 432 NtUserRegisterClassExWOW (1243376, 1243456, 1243440, 1243472, 0, 384, 0, ... ) == 0x810dc059 00221 432 NtUserGetClassInfo (1999896576, 1243540, 1243492, 1243568, 0, ... ) == 0x0 00222 432 NtUserFindExistingCursorIcon (1242924, 1242940, 1243508, ... ) == 0x10013 00223 432 NtUserRegisterClassExWOW (1243376, 1243456, 1243440, 1243472, 0, 384, 0, ... ) == 0x810dc05b 00224 432 NtUserGetClassInfo (1999896576, 1243540, 1243492, 1243568, 0, ... ) == 0x0 00225 432 NtUserFindExistingCursorIcon (1242924, 1242940, 1243508, ... ) == 0x10011 00226 432 NtUserRegisterClassExWOW (1243376, 1243456, 1243440, 1243472, 0, 384, 0, ... ) == 0x810dc05d 00227 432 NtUserGetClassInfo (1999896576, 1243540, 1243492, 1243568, 0, ... ) == 0x0 00228 432 NtUserFindExistingCursorIcon (1242924, 1242940, 1243508, ... ) == 0x10011 00229 432 NtUserRegisterClassExWOW (1243376, 1243456, 1243440, 1243472, 0, 384, 0, ... ) == 0x810dc05f 00230 432 NtTestAlert (... ) == 0x0 00231 432 NtContinue (1244464, 1, ... 00232 432 NtSetInformationThread (-2, Win32StartAddress(LpcReceivedMessageId), {StartAddress(LpcReceivedMsgId)=0x485014,}, 4, ... ) == 0x0 00233 432 NtCreateFile (0xc0100080, {24, 0, 0x40, 0, 1244964, (0xc0100080, {24, 0, 0x40, 0, 1244964, "\??\SICE"}, 0x0, 128, 3, 1, 96, 0, 0, ... ) }, 0x0, 128, 3, 1, 96, 0, 0, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 00234 432 NtCreateFile (0xc0100080, {24, 0, 0x40, 0, 1244964, (0xc0100080, {24, 0, 0x40, 0, 1244964, "\??\SIWVID"}, 0x0, 128, 3, 1, 96, 0, 0, ... ) }, 0x0, 128, 3, 1, 96, 0, 0, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 00235 432 NtCreateFile (0xc0100080, {24, 0, 0x40, 0, 1244964, (0xc0100080, {24, 0, 0x40, 0, 1244964, "\??\NTICE"}, 0x0, 128, 3, 1, 96, 0, 0, ... ) }, 0x0, 128, 3, 1, 96, 0, 0, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 00236 432 NtQuerySystemInformation (Basic, 44, ... {Unknown=0,MaximumIncrement=156250,PhysicalPageSize=0x1000,NumberOfPhysicalPages=0xff7c,LowestPhysicalPage=0x1,HighestPhysicalPage=0xffff,AllocationGranularity=0x10000,LowestUserAddress=0x10000,HighestUserAddress=0x7ffeffff,ActiveProcessors=1,NumberProcessors=1,}, 0x0, ) == 0x0 00237 432 NtQuerySystemInformation (Processor, 12, ... {system info, class 1, size 12}, 0x0, ) == 0x0 00238 432 NtContinue (1244368, 0, ... 00239 432 NtContinue (1244336, 0, ... 00240 432 NtCreateFile (0x80100080, {24, 0, 0x40, 0, 1244952, (0x80100080, {24, 0, 0x40, 0, 1244952, "\??\C:\WINDOWS\System32\KERNEL32.dll"}, 0x0, 4, 1, 1, 96, 0, 0, ... 56, {status=0x0, info=1}, ) }, 0x0, 4, 1, 1, 96, 0, 0, ... 56, {status=0x0, info=1}, ) == 0x0 00241 432 NtQueryInformationFile (56, 1245004, 24, Standard, ... {status=0x0, info=24}, ) == 0x0 00242 432 NtAllocateVirtualMemory (-1, 0, 0, 926720, 4096, 64, ... 10158080, 929792, ) == 0x0 00243 432 NtReadFile (56, 0, 0, 0, 926720, 0x0, 0, ... {status=0x0, info=926720}, (56, 0, 0, 0, 926720, 0x0, 0, ... {status=0x0, info=926720}, "MZ\220\0\3\0\0\0\4\0\0\0\377\377\0\0\270\0\0\0\0\0\0\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\370\0\0\0\16\37\272\16\0\264\11\315!\270\1L\315!This program cannot be run in DOS mode.\15\15\12$\0\0\0\0\0\0\0\233\10S\206\337i=\325\337i=\325\337i=\325\337i<\325]h=\325%J$\325\334i=\325\337i=\325\335i=\325%J\2\325\336i=\325HJx\325\336i=\325%J}\325\334i=\325\5J!\325\16i=\325\5J \325\334i=\325%J\0\325\336i=\325Rich\337i=\325\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0PE\0\0L\1\4\0\16\376};\0\0\0\0\0\0\0\0\340\0\16!\13\1\7\0\0H\7\0\0\336\6\0\0\0\0\0A\242\1\0\0\20\0\0\0\20\7\0\0\0\346w\0\20\0\0\0\2\0\0\5\0\1\0\5\0\1\0\4\0\0\0\0\0\0\0\0P\16\0\0\4\0\0\222\207\16\0\3\0\0\0\0\0\4\0\0\20\0\0\0\0\20\0\0\20\0\0\0\0\0\0\20\0\0\0@!\2\0\210i\0\0\304-\7\0(\0\0\0\0\220\7\0\330^\6\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\360\15\0\20S\0\0 V\7\08\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\250f\7\0@\0\0\0\220\2\0\0\34\0\0\0\0\20\0\0\10\6\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0.tex", ) , ) == 0x0 00244 432 NtCreateFile (0x80100080, {24, 0, 0x40, 0, 1244952, (0x80100080, {24, 0, 0x40, 0, 1244952, "\??\C:\WINDOWS\System32\USER32.dll"}, 0x0, 4, 1, 1, 96, 0, 0, ... 60, {status=0x0, info=1}, ) }, 0x0, 4, 1, 1, 96, 0, 0, ... 60, {status=0x0, info=1}, ) == 0x0 00245 432 NtQueryInformationFile (60, 1245004, 24, Standard, ... {status=0x0, info=24}, ) == 0x0 00246 432 NtAllocateVirtualMemory (-1, 0, 0, 561152, 4096, 64, ... 11141120, 561152, ) == 0x0 00247 432 NtReadFile (60, 0, 0, 0, 561152, 0x0, 0, ... {status=0x0, info=561152}, (60, 0, 0, 0, 561152, 0x0, 0, ... {status=0x0, info=561152}, "MZ\220\0\3\0\0\0\4\0\0\0\377\377\0\0\270\0\0\0\0\0\0\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\360\0\0\0\16\37\272\16\0\264\11\315!\270\1L\315!This program cannot be run in DOS mode.\15\15\12$\0\0\0\0\0\0\0cf;e'\7U6'\7U6'\7U6'\7T6`\6U6\335$L6 \7U6'\7U6%\7U6\335$j6&\7U6\260$\206&\7U6\335$\256!\7U6\375$I6U\7U6\335$h6&\7U6Rich'\7U6\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0PE\0\0L\1\4\0\16\376};\0\0\0\0\0\0\0\0\340\0\16!\13\1\7\0\0\262\5\0\0\340\2\0\0\0\0\0KQ\0\0\0\20\0\0\0P\5\0\0\0\324w\0\20\0\0\0\2\0\0\5\0\1\0\5\0\1\0\4\0\0\0\0\0\0\0\0\320\10\0\0\4\0\0\35?\11\0\2\0\0\0\0\0\4\0\0\20\0\0\0\0\20\0\0\20\0\0\0\0\0\0\20\0\0\0pk\1\0\251K\0\0\230\244\5\0P\0\0\0\0\360\5\0\210\240\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\240\10\0\270+\0\0\0\300\5\08\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\210\2\0\0L\0\0\0\0\20\0\0\324\4\0\0\300\241\5\0\240\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0.text\0\0\08\260\5\0", ) , ) == 0x0 00248 432 NtCreateFile (0x80100080, {24, 0, 0x40, 0, 1244956, (0x80100080, {24, 0, 0x40, 0, 1244956, "\??\C:\WINDOWS\System32\ADVAPI32.dll"}, 0x0, 4, 1, 1, 96, 0, 0, ... 64, {status=0x0, info=1}, ) }, 0x0, 4, 1, 1, 96, 0, 0, ... 64, {status=0x0, info=1}, ) == 0x0 00249 432 NtQueryInformationFile (64, 1245008, 24, Standard, ... {status=0x0, info=24}, ) == 0x0 00250 432 NtAllocateVirtualMemory (-1, 0, 0, 549888, 4096, 64, ... 11730944, 552960, ) == 0x0 00251 432 NtReadFile (64, 0, 0, 0, 549888, 0x0, 0, ... {status=0x0, info=549888}, (64, 0, 0, 0, 549888, 0x0, 0, ... {status=0x0, info=549888}, "MZ\220\0\3\0\0\0\4\0\0\0\377\377\0\0\270\0\0\0\0\0\0\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\10\1\0\0\16\37\272\16\0\264\11\315!\270\1L\315!This program cannot be run in DOS mode.\15\15\12$\0\0\0\0\0\0\0\375\343\244\227\271\202\312\304\271\202\312\304\271\202\312\304C\241\323\304\276\202\312\304\271\202\312\304\273\202\312\304C\241\212\304\275\202\312\304\364\241\326\304\262\202\312\304p\240\340\304\277\202\312\304\271\202\313\304\37\203\312\304C\241\365\304\270\202\312\304.\241\217\304\270\202\312\304c\241\327\304\255\202\312\304c\241\326\304:\202\312\304C\241\367\304\270\202\312\304Rich\271\202\312\304\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0PE\0\0L\1\4\0\16\376};\0\0\0\0\0\0\0\0\340\0\16!\13\1\7\0\0B\6\0\02\2\0\0\0\0\0\373\34\0\0\0\20\0\0\0 \6\0\0\0\335w\0\20\0\0\0\2\0\0\5\0\1\0\5\0\1\0\4\0\0\0\0\0\0\0\0\260\10\0\0\4\0\0\305\371\10\0\3\0\0\0\0\0\4\0\0\20\0\0\0\0\20\0\0\20\0\0\0\0\0\0\20\0\0\0\0\224\1\0YQ\0\0\204(\6\0P\0\0\0\0\260\6\0h\251\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0`\10\0\264D\0\0\330P\6\08\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\240\2\0\0L\0\0\0\0\20\0\0\\6\0\0\360&\6\0`\0\0\0\0\0\0\0", ) , ) == 0x0 00252 432 NtClose (64, ... ) == 0x0 00253 432 NtClose (60, ... ) == 0x0 00254 432 NtClose (56, ... ) == 0x0 00255 432 NtRaiseException (1244384, 1243644, 1, ... 00256 432 NtContinue (1242440, 0, ... 00257 432 NtOpenDirectoryObject (0x2000f, {24, 0, 0x40, 0, 0, (0x2000f, {24, 0, 0x40, 0, 0, "\BaseNamedObjects"}, ... 56, ) }, ... 56, ) == 0x0 00258 432 NtOpenMutant (0x120001, {24, 56, 0x2, 0, 0, (0x120001, {24, 56, 0x2, 0, 0, "DBWinMutex"}, ... 60, ) }, ... 60, ) == 0x0 00259 432 NtWaitForSingleObject (60, 0, 0x0, ... ) == 0x0 00260 432 NtOpenSection (0x2, {24, 56, 0x0, 0, 0, (0x2, {24, 56, 0x0, 0, 0, "DBWIN_BUFFER"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 00261 432 NtReleaseMutant (60, ... 0x0, ) == 0x0 00262 432 NtAllocateVirtualMemory (-1, 0, 0, 748, 4096, 4, ... 12320768, 4096, ) == 0x0 00263 432 NtOpenSection (0xe, {24, 8, 0x40, 0, 0, (0xe, {24, 8, 0x40, 0, 0, "winmm.dll"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 00264 432 NtQueryAttributesFile ({24, 0, 0x40, 0, 0, ({24, 0, 0x40, 0, 0, "\??\u:\work\winmm.dll"}, 1243024, ... ) }, 1243024, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 00265 432 NtQueryAttributesFile ({24, 12, 0x40, 0, 0, ({24, 12, 0x40, 0, 0, "winmm.dll"}, 1243024, ... ) }, 1243024, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 00266 432 NtQueryAttributesFile ({24, 0, 0x40, 0, 0, ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\System32\winmm.dll"}, 1243024, ... ) }, 1243024, ... ) == 0x0 00267 432 NtOpenFile (0x100020, {24, 0, 0x40, 0, 0, (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\System32\winmm.dll"}, 5, 96, ... 64, {status=0x0, info=1}, ) }, 5, 96, ... 64, {status=0x0, info=1}, ) == 0x0 00268 432 NtCreateSection (0xf, 0x0, 0x0, 16, 16777216, 64, ... 68, ) == 0x0 00269 432 NtQuerySection (68, Image, 48, ... {section info, class 1, size 48}, 0x0, ) == 0x0 00270 432 NtOpenProcessToken (-1, 0x8, ... 72, ) == 0x0 00271 432 NtQueryInformationToken (72, User, 136, ... {token info, class 1, size 36}, 36, ) == 0x0 00272 432 NtOpenKey (0x3, {24, 0, 0x40, 0, 0, (0x3, {24, 0, 0x40, 0, 0, "\Registry\MACHINE\System\CurrentControlSet\Control\SafeBoot\Option"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 00273 432 NtOpenKey (0x1, {24, 0, 0x40, 0, 0, (0x1, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers"}, ... 76, ) }, ... 76, ) == 0x0 00274 432 NtQueryValueKey (76, (76, "TransparentEnabled", Partial, 80, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) , Partial, 80, ... TitleIdx=0, Type=4, Data= (76, "TransparentEnabled", Partial, 80, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) }, 16, ) == 0x0 00275 432 NtClose (76, ... ) == 0x0 00276 432 NtOpenThreadTokenEx (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN 00277 432 NtOpenProcessTokenEx (-1, 0x20008, 512, ... 76, ) == 0x0 00278 432 NtQueryInformationToken (76, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0 00279 432 NtClose (76, ... ) == 0x0 00280 432 NtOpenKey (0x1, {24, 0, 0x40, 0, 0, (0x1, {24, 0, 0x40, 0, 0, "\REGISTRY\USER\S-1-5-21-1078081533-484763869-839522115-1003\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 00281 432 NtClose (72, ... ) == 0x0 00282 432 NtClose (64, ... ) == 0x0 00283 432 NtMapViewOfSection (68, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x76b40000), 0x0, 180224, ) == 0x0 00284 432 NtClose (68, ... ) == 0x0 00285 432 NtAllocateVirtualMemory (-1, 1327104, 0, 4096, 4096, 4, ... 1327104, 4096, ) == 0x0 00286 432 NtCreateEvent (0x1f0003, 0x0, 0, 0, ... 68, ) == 0x0 00287 432 NtCreateSemaphore (0x100003, 0x0, 0, 2147483647, ... 64, ) == 0x0 00288 432 NtCreateSemaphore (0x100003, 0x0, 0, 2147483647, ... 72, ) == 0x0 00289 432 NtOpenKey (0x80000000, {24, 0, 0x40, 0, 0, (0x80000000, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\DRIVERS32"}, ... 76, ) }, ... 76, ) == 0x0 00290 432 NtQueryValueKey (76, (76, "wave", Partial, 536, ... ) , Partial, 536, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 00291 432 NtQueryValueKey (76, (76, "wave1", Partial, 536, ... ) , Partial, 536, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 00292 432 NtQueryValueKey (76, (76, "wave2", Partial, 536, ... ) , Partial, 536, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 00293 432 NtQueryValueKey (76, (76, "wave3", Partial, 536, ... ) , Partial, 536, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 00294 432 NtQueryValueKey (76, (76, "wave4", Partial, 536, ... ) , Partial, 536, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 00295 432 NtQueryValueKey (76, (76, "wave5", Partial, 536, ... ) , Partial, 536, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 00296 432 NtQueryValueKey (76, (76, "wave6", Partial, 536, ... ) , Partial, 536, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 00297 432 NtQueryValueKey (76, (76, "wave7", Partial, 536, ... ) , Partial, 536, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 00298 432 NtQueryValueKey (76, (76, "wave8", Partial, 536, ... ) , Partial, 536, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 00299 432 NtQueryValueKey (76, (76, "wave9", Partial, 536, ... ) , Partial, 536, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 00300 432 NtQueryValueKey (76, (76, "midi", Partial, 536, ... ) , Partial, 536, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 00301 432 NtQueryValueKey (76, (76, "midi1", Partial, 536, ... ) , Partial, 536, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 00302 432 NtQueryValueKey (76, (76, "midi2", Partial, 536, ... ) , Partial, 536, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 00303 432 NtQueryValueKey (76, (76, "midi3", Partial, 536, ... ) , Partial, 536, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 00304 432 NtQueryValueKey (76, (76, "midi4", Partial, 536, ... ) , Partial, 536, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 00305 432 NtQueryValueKey (76, (76, "midi5", Partial, 536, ... ) , Partial, 536, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 00306 432 NtQueryValueKey (76, (76, "midi6", Partial, 536, ... ) , Partial, 536, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 00307 432 NtQueryValueKey (76, (76, "midi7", Partial, 536, ... ) , Partial, 536, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 00308 432 NtQueryValueKey (76, (76, "midi8", Partial, 536, ... ) , Partial, 536, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 00309 432 NtQueryValueKey (76, (76, "midi9", Partial, 536, ... ) , Partial, 536, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 00310 432 NtQueryTimerResolution (... 156250, 10000, 156250, ) == 0x0 00311 432 NtQueryValueKey (76, (76, "aux", Partial, 536, ... ) , Partial, 536, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 00312 432 NtQueryValueKey (76, (76, "aux1", Partial, 536, ... ) , Partial, 536, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 00313 432 NtQueryValueKey (76, (76, "aux2", Partial, 536, ... ) , Partial, 536, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 00314 432 NtQueryValueKey (76, (76, "aux3", Partial, 536, ... ) , Partial, 536, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 00315 432 NtQueryValueKey (76, (76, "aux4", Partial, 536, ... ) , Partial, 536, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 00316 432 NtQueryValueKey (76, (76, "aux5", Partial, 536, ... ) , Partial, 536, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 00317 432 NtQueryValueKey (76, (76, "aux6", Partial, 536, ... ) , Partial, 536, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 00318 432 NtQueryValueKey (76, (76, "aux7", Partial, 536, ... ) , Partial, 536, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 00319 432 NtQueryValueKey (76, (76, "aux8", Partial, 536, ... ) , Partial, 536, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 00320 432 NtQueryValueKey (76, (76, "aux9", Partial, 536, ... ) , Partial, 536, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 00321 432 NtUserRegisterWindowMessage ( ("MSJSTICK_VJOYD_MSGSTR", ... ) , ... ) == 0xc07c 00322 432 NtOpenKey (0xf003f, {24, 48, 0x40, 0, 0, (0xf003f, {24, 48, 0x40, 0, 0, "System\CurrentControlSet\Control\MediaProperties\PrivateProperties\Joystick\Winmm"}, ... 80, ) }, ... 80, ) == 0x0 00323 432 NtQueryValueKey (80, (80, "wheel", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (80, "wheel", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) }, 16, ) == 0x0 00324 432 NtClose (80, ... ) == 0x0 00325 432 NtCreateEvent (0x1f0003, {24, 56, 0x80, 0, 0, (0x1f0003, {24, 56, 0x80, 0, 0, "DINPUTWINMM"}, 0, 0, ... ) }, 0, 0, ... ) == STATUS_ACCESS_DENIED 00326 432 NtQueryValueKey (76, (76, "mixer", Partial, 536, ... ) , Partial, 536, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 00327 432 NtQueryValueKey (76, (76, "mixer1", Partial, 536, ... ) , Partial, 536, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 00328 432 NtQueryValueKey (76, (76, "mixer2", Partial, 536, ... ) , Partial, 536, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 00329 432 NtQueryValueKey (76, (76, "mixer3", Partial, 536, ... ) , Partial, 536, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 00330 432 NtQueryValueKey (76, (76, "mixer4", Partial, 536, ... ) , Partial, 536, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 00331 432 NtQueryValueKey (76, (76, "mixer5", Partial, 536, ... ) , Partial, 536, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 00332 432 NtQueryValueKey (76, (76, "mixer6", Partial, 536, ... ) , Partial, 536, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 00333 432 NtQueryValueKey (76, (76, "mixer7", Partial, 536, ... ) , Partial, 536, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 00334 432 NtQueryValueKey (76, (76, "mixer8", Partial, 536, ... ) , Partial, 536, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 00335 432 NtQueryValueKey (76, (76, "mixer9", Partial, 536, ... ) , Partial, 536, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 00336 432 NtAllocateVirtualMemory (-1, 0, 0, 1048576, 8192, 4, ... 12386304, 1048576, ) == 0x0 00337 432 NtAllocateVirtualMemory (-1, 13426688, 0, 8192, 4096, 4, ... 13426688, 8192, ) == 0x0 00338 432 NtProtectVirtualMemory (-1, (0xcce000), 4096, 260, ... (0xcce000), 4096, 4, ) == 0x0 00339 432 NtCreateThread (0x1f03ff, 0x0, -1, 1244248, 1244964, 1, ... 80, {428, 588}, ) == 0x0 00340 432 NtQueryInformationThread (80, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ffdd000,Pid=428,Tid=588,}, 0x0, ) == 0x0 00341 432 NtRequestWaitReplyPort (24, {28, 56, new_msg, 0, 3014732, 4980804, 76, 538976288} (24, {28, 56, new_msg, 0, 3014732, 4980804, 76, 538976288} "\0\0\0\0\1\0\1\0- (P\0\0\0\254\1\0\0L\2\0\0" ... {28, 56, reply, 0, 428, 432, 1494, 0} "\0\0\0\0\1\0\1\0\0\0\0\0 (P\0\0\0\254\1\0\0L\2\0\0" ) ... {28, 56, reply, 0, 428, 432, 1494, 0} (24, {28, 56, new_msg, 0, 3014732, 4980804, 76, 538976288} "\0\0\0\0\1\0\1\0- (P\0\0\0\254\1\0\0L\2\0\0" ... {28, 56, reply, 0, 428, 432, 1494, 0} "\0\0\0\0\1\0\1\0\0\0\0\0 (P\0\0\0\254\1\0\0L\2\0\0" ) ) == 0x0 00342 432 NtResumeThread (80, ... 1, ) == 0x0 00343 432 NtAllocateVirtualMemory (-1, 0, 0, 1048576, 8192, 4, ... 13434880, 1048576, ) == 0x0 00344 432 NtAllocateVirtualMemory (-1, 14475264, 0, 8192, 4096, 4, ... 00345 588 NtTestAlert (... ) == 0x0 00346 588 NtContinue (13434160, 1, ... 00347 588 NtRegisterThreadTerminatePort (24, ... ) == 0x0 00348 588 NtDelayExecution (0, {-150000, -1}, ... 00344 432 NtAllocateVirtualMemory ... 14475264, 8192, ) == 0x0 00349 432 NtProtectVirtualMemory (-1, (0xdce000), 4096, 260, ... (0xdce000), 4096, 4, ) == 0x0 00350 432 NtCreateThread (0x1f03ff, 0x0, -1, 1244248, 1244964, 1, ... 84, {428, 572}, ) == 0x0 00351 432 NtQueryInformationThread (84, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ffdc000,Pid=428,Tid=572,}, 0x0, ) == 0x0 00352 432 NtRequestWaitReplyPort (24, {28, 56, new_msg, 0, 428, 432, 1494, 0} (24, {28, 56, new_msg, 0, 428, 432, 1494, 0} "\0\0\0\0\1\0\1\0\0\0\0\0 (T\0\0\0\254\1\0\0<\2\0\0" ... {28, 56, reply, 0, 428, 432, 1495, 0} "\0\0\0\0\1\0\1\0\0\0\0\0 (T\0\0\0\254\1\0\0<\2\0\0" ) ... {28, 56, reply, 0, 428, 432, 1495, 0} (24, {28, 56, new_msg, 0, 428, 432, 1494, 0} "\0\0\0\0\1\0\1\0\0\0\0\0 (T\0\0\0\254\1\0\0<\2\0\0" ... {28, 56, reply, 0, 428, 432, 1495, 0} "\0\0\0\0\1\0\1\0\0\0\0\0 (T\0\0\0\254\1\0\0<\2\0\0" ) ) == 0x0 00353 432 NtResumeThread (84, ... 1, ) == 0x0 00354 572 NtTestAlert (... ) == 0x0 00355 572 NtContinue (14482736, 1, ... 00356 572 NtRegisterThreadTerminatePort (24, ... ) == 0x0 00357 572 NtDelayExecution (0, {-150000, -1}, ... 00358 432 NtAllocateVirtualMemory (-1, 0, 0, 1048576, 8192, 4, ... 14483456, 1048576, ) == 0x0 00359 432 NtAllocateVirtualMemory (-1, 15523840, 0, 8192, 4096, 4, ... 15523840, 8192, ) == 0x0 00360 432 NtProtectVirtualMemory (-1, (0xece000), 4096, 260, ... (0xece000), 4096, 4, ) == 0x0 00361 432 NtCreateThread (0x1f03ff, 0x0, -1, 1244248, 1244964, 1, ... 88, {428, 580}, ) == 0x0 00362 432 NtQueryInformationThread (88, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ffdb000,Pid=428,Tid=580,}, 0x0, ) == 0x0 00363 432 NtRequestWaitReplyPort (24, {28, 56, new_msg, 0, 428, 432, 1495, 0} (24, {28, 56, new_msg, 0, 428, 432, 1495, 0} "\0\0\0\0\1\0\1\0\0\0\0\0 (X\0\0\0\254\1\0\0D\2\0\0" ... {28, 56, reply, 0, 428, 432, 1496, 0} "\0\0\0\0\1\0\1\0\0\0\0\0 (X\0\0\0\254\1\0\0D\2\0\0" ) ... {28, 56, reply, 0, 428, 432, 1496, 0} (24, {28, 56, new_msg, 0, 428, 432, 1495, 0} "\0\0\0\0\1\0\1\0\0\0\0\0 (X\0\0\0\254\1\0\0D\2\0\0" ... {28, 56, reply, 0, 428, 432, 1496, 0} "\0\0\0\0\1\0\1\0\0\0\0\0 (X\0\0\0\254\1\0\0D\2\0\0" ) ) == 0x0 00364 432 NtResumeThread (88, ... 1, ) == 0x0 00365 432 NtAllocateVirtualMemory (-1, 0, 0, 1048576, 8192, 4, ... 15532032, 1048576, ) == 0x0 00366 432 NtAllocateVirtualMemory (-1, 16572416, 0, 8192, 4096, 4, ... 00367 580 NtTestAlert (... ) == 0x0 00368 580 NtContinue (15531312, 1, ... 00369 580 NtRegisterThreadTerminatePort (24, ... ) == 0x0 00370 580 NtDelayExecution (0, {-150000, -1}, ... 00366 432 NtAllocateVirtualMemory ... 16572416, 8192, ) == 0x0 00371 432 NtProtectVirtualMemory (-1, (0xfce000), 4096, 260, ... (0xfce000), 4096, 4, ) == 0x0 00372 432 NtCreateThread (0x1f03ff, 0x0, -1, 1244248, 1244964, 1, ... 92, {428, 576}, ) == 0x0 00373 432 NtQueryInformationThread (92, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ffda000,Pid=428,Tid=576,}, 0x0, ) == 0x0 00374 432 NtRequestWaitReplyPort (24, {28, 56, new_msg, 0, 428, 432, 1496, 0} (24, {28, 56, new_msg, 0, 428, 432, 1496, 0} "\0\0\0\0\1\0\1\0\0\0\0\0 (\\0\0\0\254\1\0\0@\2\0\0" ... {28, 56, reply, 0, 428, 432, 1497, 0} "\0\0\0\0\1\0\1\0\0\0\0\0 (\\0\0\0\254\1\0\0@\2\0\0" ) ... {28, 56, reply, 0, 428, 432, 1497, 0} (24, {28, 56, new_msg, 0, 428, 432, 1496, 0} "\0\0\0\0\1\0\1\0\0\0\0\0 (\\0\0\0\254\1\0\0@\2\0\0" ... {28, 56, reply, 0, 428, 432, 1497, 0} "\0\0\0\0\1\0\1\0\0\0\0\0 (\\0\0\0\254\1\0\0@\2\0\0" ) ) == 0x0 00375 432 NtResumeThread (92, ... 1, ) == 0x0 00376 576 NtTestAlert (... ) == 0x0 00377 576 NtContinue (16579888, 1, ... 00378 576 NtRegisterThreadTerminatePort (24, ... ) == 0x0 00379 576 NtDelayExecution (0, {-150000, -1}, ... 00380 432 NtAllocateVirtualMemory (-1, 0, 0, 1048576, 8192, 4, ... 16580608, 1048576, ) == 0x0 00381 432 NtAllocateVirtualMemory (-1, 17620992, 0, 8192, 4096, 4, ... 17620992, 8192, ) == 0x0 00382 432 NtProtectVirtualMemory (-1, (0x10ce000), 4096, 260, ... (0x10ce000), 4096, 4, ) == 0x0 00383 432 NtCreateThread (0x1f03ff, 0x0, -1, 1244248, 1244964, 1, ... 96, {428, 596}, ) == 0x0 00384 432 NtQueryInformationThread (96, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ffd9000,Pid=428,Tid=596,}, 0x0, ) == 0x0 00385 432 NtRequestWaitReplyPort (24, {28, 56, new_msg, 0, 428, 432, 1497, 0} (24, {28, 56, new_msg, 0, 428, 432, 1497, 0} "\0\0\0\0\1\0\1\0\0\0\0\0 (`\0\0\0\254\1\0\0T\2\0\0" ... {28, 56, reply, 0, 428, 432, 1498, 0} "\0\0\0\0\1\0\1\0\0\0\0\0 (`\0\0\0\254\1\0\0T\2\0\0" ) ... {28, 56, reply, 0, 428, 432, 1498, 0} (24, {28, 56, new_msg, 0, 428, 432, 1497, 0} "\0\0\0\0\1\0\1\0\0\0\0\0 (`\0\0\0\254\1\0\0T\2\0\0" ... {28, 56, reply, 0, 428, 432, 1498, 0} "\0\0\0\0\1\0\1\0\0\0\0\0 (`\0\0\0\254\1\0\0T\2\0\0" ) ) == 0x0 00386 432 NtResumeThread (96, ... 1, ) == 0x0 00387 432 NtAllocateVirtualMemory (-1, 0, 0, 1048576, 8192, 4, ... 17629184, 1048576, ) == 0x0 00388 432 NtAllocateVirtualMemory (-1, 18669568, 0, 8192, 4096, 4, ... 00389 596 NtTestAlert (... ) == 0x0 00390 596 NtContinue (17628464, 1, ... 00391 596 NtRegisterThreadTerminatePort (24, ... ) == 0x0 00392 596 NtDelayExecution (0, {-150000, -1}, ... 00388 432 NtAllocateVirtualMemory ... 18669568, 8192, ) == 0x0 00393 432 NtProtectVirtualMemory (-1, (0x11ce000), 4096, 260, ... (0x11ce000), 4096, 4, ) == 0x0 00394 432 NtCreateThread (0x1f03ff, 0x0, -1, 1244248, 1244964, 1, ... 100, {428, 636}, ) == 0x0 00395 432 NtQueryInformationThread (100, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ffd8000,Pid=428,Tid=636,}, 0x0, ) == 0x0 00396 432 NtRequestWaitReplyPort (24, {28, 56, new_msg, 0, 428, 432, 1498, 0} (24, {28, 56, new_msg, 0, 428, 432, 1498, 0} "\0\0\0\0\1\0\1\0\0\0\0\0 (d\0\0\0\254\1\0\0|\2\0\0" ... {28, 56, reply, 0, 428, 432, 1499, 0} "\0\0\0\0\1\0\1\0\0\0\0\0 (d\0\0\0\254\1\0\0|\2\0\0" ) ... {28, 56, reply, 0, 428, 432, 1499, 0} (24, {28, 56, new_msg, 0, 428, 432, 1498, 0} "\0\0\0\0\1\0\1\0\0\0\0\0 (d\0\0\0\254\1\0\0|\2\0\0" ... {28, 56, reply, 0, 428, 432, 1499, 0} "\0\0\0\0\1\0\1\0\0\0\0\0 (d\0\0\0\254\1\0\0|\2\0\0" ) ) == 0x0 00397 432 NtResumeThread (100, ... 1, ) == 0x0 00398 636 NtTestAlert (... ) == 0x0 00399 636 NtContinue (18677040, 1, ... 00400 636 NtRegisterThreadTerminatePort (24, ... ) == 0x0 00401 636 NtDelayExecution (0, {-150000, -1}, ... 00402 432 NtAllocateVirtualMemory (-1, 0, 0, 1048576, 8192, 4, ... 18677760, 1048576, ) == 0x0 00403 432 NtAllocateVirtualMemory (-1, 19718144, 0, 8192, 4096, 4, ... 19718144, 8192, ) == 0x0 00404 432 NtProtectVirtualMemory (-1, (0x12ce000), 4096, 260, ... (0x12ce000), 4096, 4, ) == 0x0 00405 432 NtCreateThread (0x1f03ff, 0x0, -1, 1244248, 1244964, 1, ... 104, {428, 732}, ) == 0x0 00406 432 NtQueryInformationThread (104, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ffd7000,Pid=428,Tid=732,}, 0x0, ) == 0x0 00407 432 NtRequestWaitReplyPort (24, {28, 56, new_msg, 0, 428, 432, 1499, 0} (24, {28, 56, new_msg, 0, 428, 432, 1499, 0} "\0\0\0\0\1\0\1\0\0\0\0\0 (h\0\0\0\254\1\0\0\334\2\0\0" ... {28, 56, reply, 0, 428, 432, 1500, 0} "\0\0\0\0\1\0\1\0\0\0\0\0 (h\0\0\0\254\1\0\0\334\2\0\0" ) ... {28, 56, reply, 0, 428, 432, 1500, 0} (24, {28, 56, new_msg, 0, 428, 432, 1499, 0} "\0\0\0\0\1\0\1\0\0\0\0\0 (h\0\0\0\254\1\0\0\334\2\0\0" ... {28, 56, reply, 0, 428, 432, 1500, 0} "\0\0\0\0\1\0\1\0\0\0\0\0 (h\0\0\0\254\1\0\0\334\2\0\0" ) ) == 0x0 00408 432 NtResumeThread (104, ... 1, ) == 0x0 00409 432 NtAllocateVirtualMemory (-1, 0, 0, 1048576, 8192, 4, ... 19726336, 1048576, ) == 0x0 00410 432 NtAllocateVirtualMemory (-1, 20766720, 0, 8192, 4096, 4, ... 00411 732 NtTestAlert (... ) == 0x0 00412 732 NtContinue (19725616, 1, ... 00413 732 NtRegisterThreadTerminatePort (24, ... ) == 0x0 00414 732 NtDelayExecution (0, {-150000, -1}, ... 00410 432 NtAllocateVirtualMemory ... 20766720, 8192, ) == 0x0 00415 432 NtProtectVirtualMemory (-1, (0x13ce000), 4096, 260, ... (0x13ce000), 4096, 4, ) == 0x0 00416 432 NtCreateThread (0x1f03ff, 0x0, -1, 1244248, 1244964, 1, ... 108, {428, 744}, ) == 0x0 00417 432 NtQueryInformationThread (108, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ffd6000,Pid=428,Tid=744,}, 0x0, ) == 0x0 00418 432 NtRequestWaitReplyPort (24, {28, 56, new_msg, 0, 428, 432, 1500, 0} (24, {28, 56, new_msg, 0, 428, 432, 1500, 0} "\0\0\0\0\1\0\1\0\0\0\0\0 (l\0\0\0\254\1\0\0\350\2\0\0" ... {28, 56, reply, 0, 428, 432, 1501, 0} "\0\0\0\0\1\0\1\0\0\0\0\0 (l\0\0\0\254\1\0\0\350\2\0\0" ) ... {28, 56, reply, 0, 428, 432, 1501, 0} (24, {28, 56, new_msg, 0, 428, 432, 1500, 0} "\0\0\0\0\1\0\1\0\0\0\0\0 (l\0\0\0\254\1\0\0\350\2\0\0" ... {28, 56, reply, 0, 428, 432, 1501, 0} "\0\0\0\0\1\0\1\0\0\0\0\0 (l\0\0\0\254\1\0\0\350\2\0\0" ) ) == 0x0 00419 432 NtResumeThread (108, ... 1, ) == 0x0 00420 744 NtTestAlert (... ) == 0x0 00421 744 NtContinue (20774192, 1, ... 00422 744 NtRegisterThreadTerminatePort (24, ... ) == 0x0 00423 744 NtDelayExecution (0, {-150000, -1}, ... 00424 432 NtCreateEvent (0x1f0003, 0x0, 1, 0, ... 112, ) == 0x0 00425 432 NtCreateEvent (0x1f0003, 0x0, 1, 0, ... 116, ) == 0x0 00426 432 NtCreateEvent (0x1f0003, 0x0, 1, 0, ... 120, ) == 0x0 00427 432 NtCreateEvent (0x1f0003, 0x0, 1, 0, ... 124, ) == 0x0 00428 432 NtCreateEvent (0x1f0003, 0x0, 1, 0, ... 128, ) == 0x0 00429 432 NtCreateEvent (0x1f0003, 0x0, 1, 0, ... 132, ) == 0x0 00430 432 NtCreateEvent (0x1f0003, 0x0, 1, 0, ... 136, ) == 0x0 00431 432 NtCreateEvent (0x1f0003, 0x0, 1, 0, ... 140, ) == 0x0 00432 432 NtCreateEvent (0x1f0003, 0x0, 1, 0, ... 144, ) == 0x0 00433 432 NtCreateEvent (0x1f0003, 0x0, 1, 0, ... 148, ) == 0x0 00434 432 NtCreateEvent (0x1f0003, 0x0, 1, 0, ... 152, ) == 0x0 00435 432 NtCreateEvent (0x1f0003, 0x0, 1, 0, ... 156, ) == 0x0 00436 432 NtCreateEvent (0x1f0003, 0x0, 1, 0, ... 160, ) == 0x0 00437 432 NtCreateEvent (0x1f0003, 0x0, 1, 0, ... 164, ) == 0x0 00438 432 NtCreateEvent (0x1f0003, 0x0, 1, 0, ... 168, ) == 0x0 00439 432 NtCreateEvent (0x1f0003, 0x0, 1, 0, ... 172, ) == 0x0 00440 432 NtAllocateVirtualMemory (-1, 0, 0, 1048576, 8192, 4, ... 20774912, 1048576, ) == 0x0 00441 432 NtAllocateVirtualMemory (-1, 21815296, 0, 8192, 4096, 4, ... 21815296, 8192, ) == 0x0 00442 432 NtProtectVirtualMemory (-1, (0x14ce000), 4096, 260, ... (0x14ce000), 4096, 4, ) == 0x0 00443 432 NtCreateThread (0x1f03ff, 0x0, -1, 1244216, 1244932, 1, ... 176, {428, 788}, ) == 0x0 00444 432 NtQueryInformationThread (176, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ffd5000,Pid=428,Tid=788,}, 0x0, ) == 0x0 00445 432 NtRequestWaitReplyPort (24, {28, 56, new_msg, 0, 10264591, 5493404, 2147406810, 5463316} (24, {28, 56, new_msg, 0, 10264591, 5493404, 2147406810, 5463316} "\0\0\0\0\1\0\1\0\34\08\0\2\0\0\0\260\0\0\0\254\1\0\0\24\3\0\0" ... {28, 56, reply, 0, 428, 432, 1502, 0} "\0\0\0\0\1\0\1\0\0\0\0\0\2\0\0\0\260\0\0\0\254\1\0\0\24\3\0\0" ) ... {28, 56, reply, 0, 428, 432, 1502, 0} (24, {28, 56, new_msg, 0, 10264591, 5493404, 2147406810, 5463316} "\0\0\0\0\1\0\1\0\34\08\0\2\0\0\0\260\0\0\0\254\1\0\0\24\3\0\0" ... {28, 56, reply, 0, 428, 432, 1502, 0} "\0\0\0\0\1\0\1\0\0\0\0\0\2\0\0\0\260\0\0\0\254\1\0\0\24\3\0\0" ) ) == 0x0 00446 432 NtResumeThread (176, ... 1, ) == 0x0 00447 432 NtSetInformationThread (176, BasePriority, {thread info, class 3, size 4}, 4, ... 00448 788 NtTestAlert (... ) == 0x0 00449 788 NtContinue (21822768, 1, ... 00450 788 NtRegisterThreadTerminatePort (24, ... ) == 0x0 00451 788 NtWaitForSingleObject (112, 0, 0x0, ... 00447 432 NtSetInformationThread ... ) == 0x0 00452 432 NtAllocateVirtualMemory (-1, 0, 0, 1048576, 8192, 4, ... 21823488, 1048576, ) == 0x0 00453 432 NtAllocateVirtualMemory (-1, 22863872, 0, 8192, 4096, 4, ... 22863872, 8192, ) == 0x0 00454 432 NtProtectVirtualMemory (-1, (0x15ce000), 4096, 260, ... (0x15ce000), 4096, 4, ) == 0x0 00455 432 NtCreateThread (0x1f03ff, 0x0, -1, 1244216, 1244932, 1, ... 180, {428, 676}, ) == 0x0 00456 432 NtQueryInformationThread (180, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ffd4000,Pid=428,Tid=676,}, 0x0, ) == 0x0 00457 432 NtRequestWaitReplyPort (24, {28, 56, new_msg, 0, 428, 432, 1502, 0} (24, {28, 56, new_msg, 0, 428, 432, 1502, 0} "\0\0\0\0\1\0\1\0\0\0\0\0\2\0\0\0\264\0\0\0\254\1\0\0\244\2\0\0" ... {28, 56, reply, 0, 428, 432, 1503, 0} "\0\0\0\0\1\0\1\0\0\0\0\0\2\0\0\0\264\0\0\0\254\1\0\0\244\2\0\0" ) ... {28, 56, reply, 0, 428, 432, 1503, 0} (24, {28, 56, new_msg, 0, 428, 432, 1502, 0} "\0\0\0\0\1\0\1\0\0\0\0\0\2\0\0\0\264\0\0\0\254\1\0\0\244\2\0\0" ... {28, 56, reply, 0, 428, 432, 1503, 0} "\0\0\0\0\1\0\1\0\0\0\0\0\2\0\0\0\264\0\0\0\254\1\0\0\244\2\0\0" ) ) == 0x0 00458 432 NtResumeThread (180, ... 1, ) == 0x0 00459 432 NtSetInformationThread (180, BasePriority, {thread info, class 3, size 4}, 4, ... 00460 676 NtTestAlert (... ) == 0x0 00461 676 NtContinue (22871344, 1, ... 00462 676 NtRegisterThreadTerminatePort (24, ... ) == 0x0 00463 676 NtWaitForSingleObject (116, 0, 0x0, ... 00459 432 NtSetInformationThread ... ) == 0x0 00464 432 NtAllocateVirtualMemory (-1, 0, 0, 1048576, 8192, 4, ... 22872064, 1048576, ) == 0x0 00465 432 NtAllocateVirtualMemory (-1, 23912448, 0, 8192, 4096, 4, ... 23912448, 8192, ) == 0x0 00466 432 NtProtectVirtualMemory (-1, (0x16ce000), 4096, 260, ... (0x16ce000), 4096, 4, ) == 0x0 00467 432 NtCreateThread (0x1f03ff, 0x0, -1, 1244216, 1244932, 1, ... 184, {428, 784}, ) == 0x0 00468 432 NtQueryInformationThread (184, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ffaf000,Pid=428,Tid=784,}, 0x0, ) == 0x0 00469 432 NtRequestWaitReplyPort (24, {28, 56, new_msg, 0, 428, 432, 1503, 0} (24, {28, 56, new_msg, 0, 428, 432, 1503, 0} "\0\0\0\0\1\0\1\0\0\0\0\0\2\0\0\0\270\0\0\0\254\1\0\0\20\3\0\0" ... {28, 56, reply, 0, 428, 432, 1504, 0} "\0\0\0\0\1\0\1\0\0\0\0\0\2\0\0\0\270\0\0\0\254\1\0\0\20\3\0\0" ) ... {28, 56, reply, 0, 428, 432, 1504, 0} (24, {28, 56, new_msg, 0, 428, 432, 1503, 0} "\0\0\0\0\1\0\1\0\0\0\0\0\2\0\0\0\270\0\0\0\254\1\0\0\20\3\0\0" ... {28, 56, reply, 0, 428, 432, 1504, 0} "\0\0\0\0\1\0\1\0\0\0\0\0\2\0\0\0\270\0\0\0\254\1\0\0\20\3\0\0" ) ) == 0x0 00470 432 NtResumeThread (184, ... 1, ) == 0x0 00471 432 NtSetInformationThread (184, BasePriority, {thread info, class 3, size 4}, 4, ... 00472 784 NtTestAlert (... ) == 0x0 00473 784 NtContinue (23919920, 1, ... 00474 784 NtRegisterThreadTerminatePort (24, ... ) == 0x0 00475 784 NtWaitForSingleObject (120, 0, 0x0, ... 00471 432 NtSetInformationThread ... ) == 0x0 00476 432 NtAllocateVirtualMemory (-1, 0, 0, 1048576, 8192, 4, ... 23920640, 1048576, ) == 0x0 00477 432 NtAllocateVirtualMemory (-1, 24961024, 0, 8192, 4096, 4, ... 24961024, 8192, ) == 0x0 00478 432 NtProtectVirtualMemory (-1, (0x17ce000), 4096, 260, ... (0x17ce000), 4096, 4, ) == 0x0 00479 432 NtCreateThread (0x1f03ff, 0x0, -1, 1244216, 1244932, 1, ... 188, {428, 716}, ) == 0x0 00480 432 NtQueryInformationThread (188, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ffae000,Pid=428,Tid=716,}, 0x0, ) == 0x0 00481 432 NtRequestWaitReplyPort (24, {28, 56, new_msg, 0, 428, 432, 1504, 0} (24, {28, 56, new_msg, 0, 428, 432, 1504, 0} "\0\0\0\0\1\0\1\0\0\0\0\0\2\0\0\0\274\0\0\0\254\1\0\0\314\2\0\0" ... {28, 56, reply, 0, 428, 432, 1505, 0} "\0\0\0\0\1\0\1\0\0\0\0\0\2\0\0\0\274\0\0\0\254\1\0\0\314\2\0\0" ) ... {28, 56, reply, 0, 428, 432, 1505, 0} (24, {28, 56, new_msg, 0, 428, 432, 1504, 0} "\0\0\0\0\1\0\1\0\0\0\0\0\2\0\0\0\274\0\0\0\254\1\0\0\314\2\0\0" ... {28, 56, reply, 0, 428, 432, 1505, 0} "\0\0\0\0\1\0\1\0\0\0\0\0\2\0\0\0\274\0\0\0\254\1\0\0\314\2\0\0" ) ) == 0x0 00482 432 NtResumeThread (188, ... 1, ) == 0x0 00483 432 NtSetInformationThread (188, BasePriority, {thread info, class 3, size 4}, 4, ... 00484 716 NtTestAlert (... ) == 0x0 00485 716 NtContinue (24968496, 1, ... 00486 716 NtRegisterThreadTerminatePort (24, ... ) == 0x0 00487 716 NtWaitForSingleObject (124, 0, 0x0, ... 00483 432 NtSetInformationThread ... ) == 0x0 00488 432 NtAllocateVirtualMemory (-1, 0, 0, 1048576, 8192, 4, ... 24969216, 1048576, ) == 0x0 00489 432 NtAllocateVirtualMemory (-1, 26009600, 0, 8192, 4096, 4, ... 26009600, 8192, ) == 0x0 00490 432 NtProtectVirtualMemory (-1, (0x18ce000), 4096, 260, ... (0x18ce000), 4096, 4, ) == 0x0 00491 432 NtCreateThread (0x1f03ff, 0x0, -1, 1244216, 1244932, 1, ... 192, {428, 836}, ) == 0x0 00492 432 NtQueryInformationThread (192, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ffad000,Pid=428,Tid=836,}, 0x0, ) == 0x0 00493 432 NtRequestWaitReplyPort (24, {28, 56, new_msg, 0, 428, 432, 1505, 0} (24, {28, 56, new_msg, 0, 428, 432, 1505, 0} "\0\0\0\0\1\0\1\0\0\0\0\0\2\0\0\0\300\0\0\0\254\1\0\0D\3\0\0" ... {28, 56, reply, 0, 428, 432, 1506, 0} "\0\0\0\0\1\0\1\0\0\0\0\0\2\0\0\0\300\0\0\0\254\1\0\0D\3\0\0" ) ... {28, 56, reply, 0, 428, 432, 1506, 0} (24, {28, 56, new_msg, 0, 428, 432, 1505, 0} "\0\0\0\0\1\0\1\0\0\0\0\0\2\0\0\0\300\0\0\0\254\1\0\0D\3\0\0" ... {28, 56, reply, 0, 428, 432, 1506, 0} "\0\0\0\0\1\0\1\0\0\0\0\0\2\0\0\0\300\0\0\0\254\1\0\0D\3\0\0" ) ) == 0x0 00494 432 NtResumeThread (192, ... 1, ) == 0x0 00495 432 NtSetInformationThread (192, BasePriority, {thread info, class 3, size 4}, 4, ... 00496 836 NtTestAlert (... ) == 0x0 00497 836 NtContinue (26017072, 1, ... 00498 836 NtRegisterThreadTerminatePort (24, ... ) == 0x0 00499 836 NtWaitForSingleObject (128, 0, 0x0, ... 00495 432 NtSetInformationThread ... ) == 0x0 00500 432 NtAllocateVirtualMemory (-1, 0, 0, 1048576, 8192, 4, ... 26017792, 1048576, ) == 0x0 00501 432 NtAllocateVirtualMemory (-1, 27058176, 0, 8192, 4096, 4, ... 27058176, 8192, ) == 0x0 00502 432 NtProtectVirtualMemory (-1, (0x19ce000), 4096, 260, ... (0x19ce000), 4096, 4, ) == 0x0 00503 432 NtCreateThread (0x1f03ff, 0x0, -1, 1244216, 1244932, 1, ... 196, {428, 856}, ) == 0x0 00504 432 NtQueryInformationThread (196, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ffac000,Pid=428,Tid=856,}, 0x0, ) == 0x0 00505 432 NtRequestWaitReplyPort (24, {28, 56, new_msg, 0, 428, 432, 1506, 0} (24, {28, 56, new_msg, 0, 428, 432, 1506, 0} "\0\0\0\0\1\0\1\0\0\0\0\0\2\0\0\0\304\0\0\0\254\1\0\0X\3\0\0" ... {28, 56, reply, 0, 428, 432, 1507, 0} "\0\0\0\0\1\0\1\0\0\0\0\0\2\0\0\0\304\0\0\0\254\1\0\0X\3\0\0" ) ... {28, 56, reply, 0, 428, 432, 1507, 0} (24, {28, 56, new_msg, 0, 428, 432, 1506, 0} "\0\0\0\0\1\0\1\0\0\0\0\0\2\0\0\0\304\0\0\0\254\1\0\0X\3\0\0" ... {28, 56, reply, 0, 428, 432, 1507, 0} "\0\0\0\0\1\0\1\0\0\0\0\0\2\0\0\0\304\0\0\0\254\1\0\0X\3\0\0" ) ) == 0x0 00506 432 NtResumeThread (196, ... 1, ) == 0x0 00507 856 NtTestAlert (... ) == 0x0 00508 856 NtContinue (27065648, 1, ... 00509 856 NtRegisterThreadTerminatePort (24, ... ) == 0x0 00510 856 NtWaitForSingleObject (132, 0, 0x0, ... 00511 432 NtSetInformationThread (196, BasePriority, {thread info, class 3, size 4}, 4, ... ) == 0x0 00512 432 NtAllocateVirtualMemory (-1, 0, 0, 1048576, 8192, 4, ... 27066368, 1048576, ) == 0x0 00513 432 NtAllocateVirtualMemory (-1, 28106752, 0, 8192, 4096, 4, ... 28106752, 8192, ) == 0x0 00514 432 NtProtectVirtualMemory (-1, (0x1ace000), 4096, 260, ... (0x1ace000), 4096, 4, ) == 0x0 00515 432 NtCreateThread (0x1f03ff, 0x0, -1, 1244216, 1244932, 1, ... 200, {428, 860}, ) == 0x0 00516 432 NtQueryInformationThread (200, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ffab000,Pid=428,Tid=860,}, 0x0, ) == 0x0 00517 432 NtRequestWaitReplyPort (24, {28, 56, new_msg, 0, 428, 432, 1507, 0} (24, {28, 56, new_msg, 0, 428, 432, 1507, 0} "\0\0\0\0\1\0\1\0\0\0\0\0\2\0\0\0\310\0\0\0\254\1\0\0\\3\0\0" ... {28, 56, reply, 0, 428, 432, 1508, 0} "\0\0\0\0\1\0\1\0\0\0\0\0\2\0\0\0\310\0\0\0\254\1\0\0\\3\0\0" ) ... {28, 56, reply, 0, 428, 432, 1508, 0} (24, {28, 56, new_msg, 0, 428, 432, 1507, 0} "\0\0\0\0\1\0\1\0\0\0\0\0\2\0\0\0\310\0\0\0\254\1\0\0\\3\0\0" ... {28, 56, reply, 0, 428, 432, 1508, 0} "\0\0\0\0\1\0\1\0\0\0\0\0\2\0\0\0\310\0\0\0\254\1\0\0\\3\0\0" ) ) == 0x0 00518 432 NtResumeThread (200, ... 1, ) == 0x0 00519 432 NtSetInformationThread (200, BasePriority, {thread info, class 3, size 4}, 4, ... 00520 860 NtTestAlert (... ) == 0x0 00521 860 NtContinue (28114224, 1, ... 00522 860 NtRegisterThreadTerminatePort (24, ... ) == 0x0 00523 860 NtWaitForSingleObject (136, 0, 0x0, ... 00519 432 NtSetInformationThread ... ) == 0x0 00524 432 NtAllocateVirtualMemory (-1, 0, 0, 1048576, 8192, 4, ... 28114944, 1048576, ) == 0x0 00525 432 NtAllocateVirtualMemory (-1, 29155328, 0, 8192, 4096, 4, ... 29155328, 8192, ) == 0x0 00526 432 NtProtectVirtualMemory (-1, (0x1bce000), 4096, 260, ... (0x1bce000), 4096, 4, ) == 0x0 00527 432 NtCreateThread (0x1f03ff, 0x0, -1, 1244216, 1244932, 1, ... 204, {428, 864}, ) == 0x0 00528 432 NtQueryInformationThread (204, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ffaa000,Pid=428,Tid=864,}, 0x0, ) == 0x0 00529 432 NtRequestWaitReplyPort (24, {28, 56, new_msg, 0, 428, 432, 1508, 0} (24, {28, 56, new_msg, 0, 428, 432, 1508, 0} "\0\0\0\0\1\0\1\0\0\0\0\0\2\0\0\0\314\0\0\0\254\1\0\0`\3\0\0" ... {28, 56, reply, 0, 428, 432, 1509, 0} "\0\0\0\0\1\0\1\0\0\0\0\0\2\0\0\0\314\0\0\0\254\1\0\0`\3\0\0" ) ... {28, 56, reply, 0, 428, 432, 1509, 0} (24, {28, 56, new_msg, 0, 428, 432, 1508, 0} "\0\0\0\0\1\0\1\0\0\0\0\0\2\0\0\0\314\0\0\0\254\1\0\0`\3\0\0" ... {28, 56, reply, 0, 428, 432, 1509, 0} "\0\0\0\0\1\0\1\0\0\0\0\0\2\0\0\0\314\0\0\0\254\1\0\0`\3\0\0" ) ) == 0x0 00530 432 NtResumeThread (204, ... 1, ) == 0x0 00531 432 NtSetInformationThread (204, BasePriority, {thread info, class 3, size 4}, 4, ... 00532 864 NtTestAlert (... ) == 0x0 00533 864 NtContinue (29162800, 1, ... 00534 864 NtRegisterThreadTerminatePort (24, ... ) == 0x0 00535 864 NtWaitForSingleObject (140, 0, 0x0, ... 00531 432 NtSetInformationThread ... ) == 0x0 00536 432 NtAllocateVirtualMemory (-1, 0, 0, 1048576, 8192, 4, ... 29163520, 1048576, ) == 0x0 00537 432 NtAllocateVirtualMemory (-1, 30203904, 0, 8192, 4096, 4, ... 30203904, 8192, ) == 0x0 00538 432 NtProtectVirtualMemory (-1, (0x1cce000), 4096, 260, ... (0x1cce000), 4096, 4, ) == 0x0 00539 432 NtCreateThread (0x1f03ff, 0x0, -1, 1244216, 1244932, 1, ... 208, {428, 868}, ) == 0x0 00540 432 NtQueryInformationThread (208, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ffa9000,Pid=428,Tid=868,}, 0x0, ) == 0x0 00541 432 NtRequestWaitReplyPort (24, {28, 56, new_msg, 0, 428, 432, 1509, 0} (24, {28, 56, new_msg, 0, 428, 432, 1509, 0} "\0\0\0\0\1\0\1\0\0\0\0\0\2\0\0\0\320\0\0\0\254\1\0\0d\3\0\0" ... {28, 56, reply, 0, 428, 432, 1510, 0} "\0\0\0\0\1\0\1\0\0\0\0\0\2\0\0\0\320\0\0\0\254\1\0\0d\3\0\0" ) ... {28, 56, reply, 0, 428, 432, 1510, 0} (24, {28, 56, new_msg, 0, 428, 432, 1509, 0} "\0\0\0\0\1\0\1\0\0\0\0\0\2\0\0\0\320\0\0\0\254\1\0\0d\3\0\0" ... {28, 56, reply, 0, 428, 432, 1510, 0} "\0\0\0\0\1\0\1\0\0\0\0\0\2\0\0\0\320\0\0\0\254\1\0\0d\3\0\0" ) ) == 0x0 00542 432 NtResumeThread (208, ... 1, ) == 0x0 00543 432 NtSetInformationThread (208, BasePriority, {thread info, class 3, size 4}, 4, ... 00544 868 NtTestAlert (... ) == 0x0 00545 868 NtContinue (30211376, 1, ... 00546 868 NtRegisterThreadTerminatePort (24, ... ) == 0x0 00547 868 NtWaitForSingleObject (144, 0, 0x0, ... 00543 432 NtSetInformationThread ... ) == 0x0 00548 432 NtAllocateVirtualMemory (-1, 0, 0, 1048576, 8192, 4, ... 30212096, 1048576, ) == 0x0 00549 432 NtAllocateVirtualMemory (-1, 31252480, 0, 8192, 4096, 4, ... 31252480, 8192, ) == 0x0 00550 432 NtProtectVirtualMemory (-1, (0x1dce000), 4096, 260, ... (0x1dce000), 4096, 4, ) == 0x0 00551 432 NtCreateThread (0x1f03ff, 0x0, -1, 1244216, 1244932, 1, ... 212, {428, 872}, ) == 0x0 00552 432 NtQueryInformationThread (212, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ffa8000,Pid=428,Tid=872,}, 0x0, ) == 0x0 00553 432 NtRequestWaitReplyPort (24, {28, 56, new_msg, 0, 428, 432, 1510, 0} (24, {28, 56, new_msg, 0, 428, 432, 1510, 0} "\0\0\0\0\1\0\1\0\0\0\0\0\2\0\0\0\324\0\0\0\254\1\0\0h\3\0\0" ... {28, 56, reply, 0, 428, 432, 1511, 0} "\0\0\0\0\1\0\1\0\0\0\0\0\2\0\0\0\324\0\0\0\254\1\0\0h\3\0\0" ) ... {28, 56, reply, 0, 428, 432, 1511, 0} (24, {28, 56, new_msg, 0, 428, 432, 1510, 0} "\0\0\0\0\1\0\1\0\0\0\0\0\2\0\0\0\324\0\0\0\254\1\0\0h\3\0\0" ... {28, 56, reply, 0, 428, 432, 1511, 0} "\0\0\0\0\1\0\1\0\0\0\0\0\2\0\0\0\324\0\0\0\254\1\0\0h\3\0\0" ) ) == 0x0 00554 432 NtResumeThread (212, ... 1, ) == 0x0 00555 432 NtSetInformationThread (212, BasePriority, {thread info, class 3, size 4}, 4, ... 00556 872 NtTestAlert (... ) == 0x0 00557 872 NtContinue (31259952, 1, ... 00558 872 NtRegisterThreadTerminatePort (24, ... ) == 0x0 00559 872 NtWaitForSingleObject (148, 0, 0x0, ... 00555 432 NtSetInformationThread ... ) == 0x0 00560 432 NtAllocateVirtualMemory (-1, 0, 0, 1048576, 8192, 4, ... 31260672, 1048576, ) == 0x0 00561 432 NtAllocateVirtualMemory (-1, 32301056, 0, 8192, 4096, 4, ... 32301056, 8192, ) == 0x0 00562 432 NtProtectVirtualMemory (-1, (0x1ece000), 4096, 260, ... (0x1ece000), 4096, 4, ) == 0x0 00563 432 NtCreateThread (0x1f03ff, 0x0, -1, 1244216, 1244932, 1, ... 216, {428, 876}, ) == 0x0 00564 432 NtQueryInformationThread (216, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ffa7000,Pid=428,Tid=876,}, 0x0, ) == 0x0 00565 432 NtRequestWaitReplyPort (24, {28, 56, new_msg, 0, 428, 432, 1511, 0} (24, {28, 56, new_msg, 0, 428, 432, 1511, 0} "\0\0\0\0\1\0\1\0\0\0\0\0\2\0\0\0\330\0\0\0\254\1\0\0l\3\0\0" ... {28, 56, reply, 0, 428, 432, 1512, 0} "\0\0\0\0\1\0\1\0\0\0\0\0\2\0\0\0\330\0\0\0\254\1\0\0l\3\0\0" ) ... {28, 56, reply, 0, 428, 432, 1512, 0} (24, {28, 56, new_msg, 0, 428, 432, 1511, 0} "\0\0\0\0\1\0\1\0\0\0\0\0\2\0\0\0\330\0\0\0\254\1\0\0l\3\0\0" ... {28, 56, reply, 0, 428, 432, 1512, 0} "\0\0\0\0\1\0\1\0\0\0\0\0\2\0\0\0\330\0\0\0\254\1\0\0l\3\0\0" ) ) == 0x0 00566 432 NtResumeThread (216, ... 1, ) == 0x0 00567 432 NtSetInformationThread (216, BasePriority, {thread info, class 3, size 4}, 4, ... 00568 876 NtTestAlert (... ) == 0x0 00569 876 NtContinue (32308528, 1, ... 00570 876 NtRegisterThreadTerminatePort (24, ... ) == 0x0 00571 876 NtWaitForSingleObject (152, 0, 0x0, ... 00567 432 NtSetInformationThread ... ) == 0x0 00572 432 NtAllocateVirtualMemory (-1, 0, 0, 1048576, 8192, 4, ... 32309248, 1048576, ) == 0x0 00573 432 NtAllocateVirtualMemory (-1, 33349632, 0, 8192, 4096, 4, ... 33349632, 8192, ) == 0x0 00574 432 NtProtectVirtualMemory (-1, (0x1fce000), 4096, 260, ... (0x1fce000), 4096, 4, ) == 0x0 00575 432 NtCreateThread (0x1f03ff, 0x0, -1, 1244216, 1244932, 1, ... 220, {428, 880}, ) == 0x0 00576 432 NtQueryInformationThread (220, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ffa6000,Pid=428,Tid=880,}, 0x0, ) == 0x0 00577 432 NtRequestWaitReplyPort (24, {28, 56, new_msg, 0, 428, 432, 1512, 0} (24, {28, 56, new_msg, 0, 428, 432, 1512, 0} "\0\0\0\0\1\0\1\0\0\0\0\0\2\0\0\0\334\0\0\0\254\1\0\0p\3\0\0" ... {28, 56, reply, 0, 428, 432, 1513, 0} "\0\0\0\0\1\0\1\0\0\0\0\0\2\0\0\0\334\0\0\0\254\1\0\0p\3\0\0" ) ... {28, 56, reply, 0, 428, 432, 1513, 0} (24, {28, 56, new_msg, 0, 428, 432, 1512, 0} "\0\0\0\0\1\0\1\0\0\0\0\0\2\0\0\0\334\0\0\0\254\1\0\0p\3\0\0" ... {28, 56, reply, 0, 428, 432, 1513, 0} "\0\0\0\0\1\0\1\0\0\0\0\0\2\0\0\0\334\0\0\0\254\1\0\0p\3\0\0" ) ) == 0x0 00578 432 NtResumeThread (220, ... 1, ) == 0x0 00579 880 NtTestAlert (... ) == 0x0 00580 880 NtContinue (33357104, 1, ... 00581 880 NtRegisterThreadTerminatePort (24, ... ) == 0x0 00582 880 NtWaitForSingleObject (156, 0, 0x0, ... 00583 432 NtSetInformationThread (220, BasePriority, {thread info, class 3, size 4}, 4, ... ) == 0x0 00584 432 NtAllocateVirtualMemory (-1, 0, 0, 1048576, 8192, 4, ... 33357824, 1048576, ) == 0x0 00585 432 NtAllocateVirtualMemory (-1, 34398208, 0, 8192, 4096, 4, ... 34398208, 8192, ) == 0x0 00586 432 NtProtectVirtualMemory (-1, (0x20ce000), 4096, 260, ... (0x20ce000), 4096, 4, ) == 0x0 00587 432 NtCreateThread (0x1f03ff, 0x0, -1, 1244216, 1244932, 1, ... 224, {428, 884}, ) == 0x0 00588 432 NtQueryInformationThread (224, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ffa5000,Pid=428,Tid=884,}, 0x0, ) == 0x0 00589 432 NtRequestWaitReplyPort (24, {28, 56, new_msg, 0, 428, 432, 1513, 0} (24, {28, 56, new_msg, 0, 428, 432, 1513, 0} "\0\0\0\0\1\0\1\0\0\0\0\0\2\0\0\0\340\0\0\0\254\1\0\0t\3\0\0" ... {28, 56, reply, 0, 428, 432, 1514, 0} "\0\0\0\0\1\0\1\0\0\0\0\0\2\0\0\0\340\0\0\0\254\1\0\0t\3\0\0" ) ... {28, 56, reply, 0, 428, 432, 1514, 0} (24, {28, 56, new_msg, 0, 428, 432, 1513, 0} "\0\0\0\0\1\0\1\0\0\0\0\0\2\0\0\0\340\0\0\0\254\1\0\0t\3\0\0" ... {28, 56, reply, 0, 428, 432, 1514, 0} "\0\0\0\0\1\0\1\0\0\0\0\0\2\0\0\0\340\0\0\0\254\1\0\0t\3\0\0" ) ) == 0x0 00590 432 NtResumeThread (224, ... 1, ) == 0x0 00591 432 NtSetInformationThread (224, BasePriority, {thread info, class 3, size 4}, 4, ... 00592 884 NtTestAlert (... ) == 0x0 00593 884 NtContinue (34405680, 1, ... 00594 884 NtRegisterThreadTerminatePort (24, ... ) == 0x0 00595 884 NtWaitForSingleObject (160, 0, 0x0, ... 00591 432 NtSetInformationThread ... ) == 0x0 00596 432 NtAllocateVirtualMemory (-1, 0, 0, 1048576, 8192, 4, ... 34406400, 1048576, ) == 0x0 00597 432 NtAllocateVirtualMemory (-1, 35446784, 0, 8192, 4096, 4, ... 35446784, 8192, ) == 0x0 00598 432 NtProtectVirtualMemory (-1, (0x21ce000), 4096, 260, ... (0x21ce000), 4096, 4, ) == 0x0 00599 432 NtCreateThread (0x1f03ff, 0x0, -1, 1244216, 1244932, 1, ... 228, {428, 888}, ) == 0x0 00600 432 NtQueryInformationThread (228, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ffa4000,Pid=428,Tid=888,}, 0x0, ) == 0x0 00601 432 NtRequestWaitReplyPort (24, {28, 56, new_msg, 0, 428, 432, 1514, 0} (24, {28, 56, new_msg, 0, 428, 432, 1514, 0} "\0\0\0\0\1\0\1\0\0\0\0\0\2\0\0\0\344\0\0\0\254\1\0\0x\3\0\0" ... {28, 56, reply, 0, 428, 432, 1515, 0} "\0\0\0\0\1\0\1\0\0\0\0\0\2\0\0\0\344\0\0\0\254\1\0\0x\3\0\0" ) ... {28, 56, reply, 0, 428, 432, 1515, 0} (24, {28, 56, new_msg, 0, 428, 432, 1514, 0} "\0\0\0\0\1\0\1\0\0\0\0\0\2\0\0\0\344\0\0\0\254\1\0\0x\3\0\0" ... {28, 56, reply, 0, 428, 432, 1515, 0} "\0\0\0\0\1\0\1\0\0\0\0\0\2\0\0\0\344\0\0\0\254\1\0\0x\3\0\0" ) ) == 0x0 00602 432 NtResumeThread (228, ... 1, ) == 0x0 00603 432 NtSetInformationThread (228, BasePriority, {thread info, class 3, size 4}, 4, ... 00604 888 NtTestAlert (... ) == 0x0 00605 888 NtContinue (35454256, 1, ... 00606 888 NtRegisterThreadTerminatePort (24, ... ) == 0x0 00607 888 NtWaitForSingleObject (164, 0, 0x0, ... 00603 432 NtSetInformationThread ... ) == 0x0 00608 432 NtAllocateVirtualMemory (-1, 0, 0, 1048576, 8192, 4, ... 35454976, 1048576, ) == 0x0 00609 432 NtAllocateVirtualMemory (-1, 36495360, 0, 8192, 4096, 4, ... 36495360, 8192, ) == 0x0 00610 432 NtProtectVirtualMemory (-1, (0x22ce000), 4096, 260, ... (0x22ce000), 4096, 4, ) == 0x0 00611 432 NtCreateThread (0x1f03ff, 0x0, -1, 1244216, 1244932, 1, ... 232, {428, 892}, ) == 0x0 00612 432 NtQueryInformationThread (232, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ffa3000,Pid=428,Tid=892,}, 0x0, ) == 0x0 00613 432 NtRequestWaitReplyPort (24, {28, 56, new_msg, 0, 428, 432, 1515, 0} (24, {28, 56, new_msg, 0, 428, 432, 1515, 0} "\0\0\0\0\1\0\1\0\0\0\0\0\2\0\0\0\350\0\0\0\254\1\0\0|\3\0\0" ... {28, 56, reply, 0, 428, 432, 1516, 0} "\0\0\0\0\1\0\1\0\0\0\0\0\2\0\0\0\350\0\0\0\254\1\0\0|\3\0\0" ) ... {28, 56, reply, 0, 428, 432, 1516, 0} (24, {28, 56, new_msg, 0, 428, 432, 1515, 0} "\0\0\0\0\1\0\1\0\0\0\0\0\2\0\0\0\350\0\0\0\254\1\0\0|\3\0\0" ... {28, 56, reply, 0, 428, 432, 1516, 0} "\0\0\0\0\1\0\1\0\0\0\0\0\2\0\0\0\350\0\0\0\254\1\0\0|\3\0\0" ) ) == 0x0 00614 432 NtResumeThread (232, ... 1, ) == 0x0 00615 432 NtSetInformationThread (232, BasePriority, {thread info, class 3, size 4}, 4, ... 00616 892 NtTestAlert (... ) == 0x0 00617 892 NtContinue (36502832, 1, ... 00618 892 NtRegisterThreadTerminatePort (24, ... ) == 0x0 00619 892 NtWaitForSingleObject (168, 0, 0x0, ... 00615 432 NtSetInformationThread ... ) == 0x0 00620 432 NtAllocateVirtualMemory (-1, 0, 0, 1048576, 8192, 4, ... 36503552, 1048576, ) == 0x0 00621 432 NtAllocateVirtualMemory (-1, 37543936, 0, 8192, 4096, 4, ... 37543936, 8192, ) == 0x0 00622 432 NtProtectVirtualMemory (-1, (0x23ce000), 4096, 260, ... (0x23ce000), 4096, 4, ) == 0x0 00623 432 NtCreateThread (0x1f03ff, 0x0, -1, 1244216, 1244932, 1, ... 236, {428, 908}, ) == 0x0 00624 432 NtQueryInformationThread (236, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ffa2000,Pid=428,Tid=908,}, 0x0, ) == 0x0 00625 432 NtRequestWaitReplyPort (24, {28, 56, new_msg, 0, 428, 432, 1516, 0} (24, {28, 56, new_msg, 0, 428, 432, 1516, 0} "\0\0\0\0\1\0\1\0\0\0\0\0\2\0\0\0\354\0\0\0\254\1\0\0\214\3\0\0" ... {28, 56, reply, 0, 428, 432, 1517, 0} "\0\0\0\0\1\0\1\0\0\0\0\0\2\0\0\0\354\0\0\0\254\1\0\0\214\3\0\0" ) ... {28, 56, reply, 0, 428, 432, 1517, 0} (24, {28, 56, new_msg, 0, 428, 432, 1516, 0} "\0\0\0\0\1\0\1\0\0\0\0\0\2\0\0\0\354\0\0\0\254\1\0\0\214\3\0\0" ... {28, 56, reply, 0, 428, 432, 1517, 0} "\0\0\0\0\1\0\1\0\0\0\0\0\2\0\0\0\354\0\0\0\254\1\0\0\214\3\0\0" ) ) == 0x0 00626 432 NtResumeThread (236, ... 1, ) == 0x0 00627 432 NtSetInformationThread (236, BasePriority, {thread info, class 3, size 4}, 4, ... 00628 908 NtTestAlert (... ) == 0x0 00629 908 NtContinue (37551408, 1, ... 00630 908 NtRegisterThreadTerminatePort (24, ... ) == 0x0 00631 908 NtWaitForSingleObject (172, 0, 0x0, ... 00627 432 NtSetInformationThread ... ) == 0x0 00632 432 NtSetEvent (156, ... 00582 880 NtWaitForSingleObject ... ) == 0x0 00633 880 NtDelayExecution (0, {0, 0}, ... ) == 0x0 00634 880 NtWaitForSingleObject (156, 0, 0x0, ... 00632 432 NtSetEvent ... 0x0, ) == 0x0 00348 588 NtDelayExecution ... ) == 0x0 00357 572 NtDelayExecution ... ) == 0x0 00370 580 NtDelayExecution ... ) == 0x0 00379 576 NtDelayExecution ... ) == 0x0 00392 596 NtDelayExecution ... ) == 0x0 00401 636 NtDelayExecution ... ) == 0x0 00414 732 NtDelayExecution ... ) == 0x0 00423 744 NtDelayExecution ... ) == 0x0 00635 588 NtDelayExecution (0, {-20010000, -1}, ... 00636 572 NtDelayExecution (0, {-20010000, -1}, ... 00637 580 NtContinue (15531236, 0, ... 00638 576 NtDelayExecution (0, {-20010000, -1}, ... 00639 596 NtDelayExecution (0, {-20010000, -1}, ... 00640 636 NtDelayExecution (0, {-20010000, -1}, ... 00641 732 NtDelayExecution (0, {-20010000, -1}, ... 00642 744 NtDelayExecution (0, {-20010000, -1}, ... 00643 580 NtDelayExecution (0, {-20010000, -1}, ... 00644 432 NtDelayExecution (0, {0, 0}, ... ) == 0x0 00645 432 NtSetEvent (160, ... 00595 884 NtWaitForSingleObject ... ) == 0x0 00646 884 NtDelayExecution (0, {0, 0}, ... ) == 0x0 00647 884 NtWaitForSingleObject (160, 0, 0x0, ... 00645 432 NtSetEvent ... 0x0, ) == 0x0 00648 432 NtDelayExecution (0, {0, 0}, ... ) == 0x0 00649 432 NtSetEvent (116, ... 00463 676 NtWaitForSingleObject ... ) == 0x0 00650 676 NtDelayExecution (0, {0, 0}, ... ) == 0x0 00651 676 NtWaitForSingleObject (116, 0, 0x0, ... 00649 432 NtSetEvent ... 0x0, ) == 0x0 00652 432 NtDelayExecution (0, {0, 0}, ... ) == 0x0 00653 432 NtQueryVirtualMemory (-1, 0x10000, Basic, 28, ... {BaseAddress=0x10000,AllocationBase=0x10000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 0x0, ) == 0x0 00654 432 NtSetEvent (140, ... 00535 864 NtWaitForSingleObject ... ) == 0x0 00655 864 NtDelayExecution (0, {0, 0}, ... ) == 0x0 00656 864 NtWaitForSingleObject (140, 0, 0x0, ... 00654 432 NtSetEvent ... 0x0, ) == 0x0 00657 432 NtDelayExecution (0, {0, 0}, ... ) == 0x0 00658 432 NtSetEvent (160, ... 00647 884 NtWaitForSingleObject ... ) == 0x0 00659 884 NtDelayExecution (0, {0, 0}, ... ) == 0x0 00660 884 NtWaitForSingleObject (160, 0, 0x0, ... 00658 432 NtSetEvent ... 0x0, ) == 0x0 00661 432 NtDelayExecution (0, {0, 0}, ... ) == 0x0 00662 432 NtUserGetForegroundWindow (... ) == 0x100ae 00663 432 NtUserQueryWindow (65710, 0, ... ) == 0x8c 00664 432 NtSetEvent (172, ... 00631 908 NtWaitForSingleObject ... ) == 0x0 00665 908 NtDelayExecution (0, {0, 0}, ... ) == 0x0 00666 908 NtWaitForSingleObject (172, 0, 0x0, ... 00664 432 NtSetEvent ... 0x0, ) == 0x0 00667 432 NtDelayExecution (0, {0, 0}, ... ) == 0x0 00668 432 NtSetEvent (148, ... 00559 872 NtWaitForSingleObject ... ) == 0x0 00669 872 NtDelayExecution (0, {0, 0}, ... ) == 0x0 00670 872 NtWaitForSingleObject (148, 0, 0x0, ... 00668 432 NtSetEvent ... 0x0, ) == 0x0 00671 432 NtDelayExecution (0, {0, 0}, ... ) == 0x0 00672 432 NtSetEvent (132, ... 00510 856 NtWaitForSingleObject ... ) == 0x0 00673 856 NtDelayExecution (0, {0, 0}, ... ) == 0x0 00674 856 NtWaitForSingleObject (132, 0, 0x0, ... 00672 432 NtSetEvent ... 0x0, ) == 0x0 00675 432 NtDelayExecution (0, {0, 0}, ... ) == 0x0 00676 432 NtSetEvent (132, ... 00674 856 NtWaitForSingleObject ... ) == 0x0 00677 856 NtDelayExecution (0, {0, 0}, ... ) == 0x0 00678 856 NtWaitForSingleObject (132, 0, 0x0, ... 00676 432 NtSetEvent ... 0x0, ) == 0x0 00679 432 NtDelayExecution (0, {0, 0}, ... ) == 0x0 00680 432 NtSetEvent (164, ... 00607 888 NtWaitForSingleObject ... ) == 0x0 00681 888 NtDelayExecution (0, {0, 0}, ... ) == 0x0 00682 888 NtWaitForSingleObject (164, 0, 0x0, ... 00680 432 NtSetEvent ... 0x0, ) == 0x0 00683 432 NtDelayExecution (0, {0, 0}, ... ) == 0x0 00684 432 NtSetEvent (116, ... 00651 676 NtWaitForSingleObject ... ) == 0x0 00685 676 NtDelayExecution (0, {0, 0}, ... ) == 0x0 00686 676 NtWaitForSingleObject (116, 0, 0x0, ... 00684 432 NtSetEvent ... 0x0, ) == 0x0 00687 432 NtDelayExecution (0, {0, 0}, ... ) == 0x0 00688 432 NtUserFindWindowEx (0, 0, (0, 0, "OLLYDBG", 0x0, 0, ... ) , 0x0, 0, ... ) == 0x0 00689 432 NtUserFindWindowEx (0, 0, (0, 0, "GBDYLLO", 0x0, 0, ... ) , 0x0, 0, ... ) == 0x0 00690 432 NtUserFindWindowEx (0, 0, (0, 0, "pediy06", 0x0, 0, ... ) , 0x0, 0, ... ) == 0x0 00691 432 NtAllocateVirtualMemory (-1, 0, 0, 65536, 4096, 4, ... 37552128, 65536, ) == 0x0 00692 432 NtQuerySystemInformation (ProcessesAndThreads, 65536, ... {system info, class 5, size 500}, 0x0, ) == 0x0 00693 432 NtCreateSection (0xf001f, 0x0, {4194304, 0}, 4, 67108864, 0, ... 240, ) == 0x0 00694 432 NtMapViewOfSection (240, -1, (0x0), 0, 0, 0x0, 4194304, 2, 0, 4, ... (0x23e0000), 0x0, 4194304, ) == 0x0 00695 432 NtAllocateVirtualMemory (-1, 37617664, 0, 1, 4096, 4, ... 37617664, 4096, ) == 0x0 00696 432 NtCreateSection (0xf001f, 0x0, {4194304, 0}, 4, 67108864, 0, ... 244, ) == 0x0 00697 432 NtMapViewOfSection (244, -1, (0x0), 0, 0, 0x0, 4194304, 2, 0, 4, ... (0x27e0000), 0x0, 4194304, ) == 0x0 00698 432 NtAllocateVirtualMemory (-1, 41811968, 0, 1, 4096, 4, ... 41811968, 4096, ) == 0x0 00699 432 NtCreateSection (0xf0007, 0x0, {29416, 0}, 4, 134217728, 0, ... 248, ) == 0x0 00700 432 NtMapViewOfSection (248, -1, (0x0), 0, 0, {0, 0}, 0, 1, 0, 4, ... (0x2be0000), {0, 0}, 32768, ) == 0x0 00701 432 NtUnmapViewOfSection (-1, 0x2be0000, ... ) == 0x0 00702 432 NtMapViewOfSection (248, -1, (0x0), 0, 0, {0, 0}, 0, 1, 0, 4, ... (0x2be0000), {0, 0}, 32768, ) == 0x0 00703 432 NtClose (244, ... ) == 0x0 00704 432 NtUnmapViewOfSection (-1, 0x27e0000, ... ) == 0x0 00705 432 NtClose (240, ... ) == 0x0 00706 432 NtUnmapViewOfSection (-1, 0x23e0000, ... ) == 0x0 00707 432 NtFreeVirtualMemory (-1, (0x23d0000), 0, 32768, ... (0x23d0000), 65536, ) == 0x0 00708 432 NtUnmapViewOfSection (-1, 0x2be0000, ... ) == 0x0 00709 432 NtMapViewOfSection (248, -1, (0x0), 0, 0, {0, 0}, 0, 1, 0, 4, ... (0x23d0000), {0, 0}, 32768, ) == 0x0 00710 432 NtUnmapViewOfSection (-1, 0x23d0000, ... ) == 0x0 00711 432 NtMapViewOfSection (248, -1, (0x0), 0, 0, {0, 0}, 0, 1, 0, 4, ... (0x23d0000), {0, 0}, 32768, ) == 0x0 00712 432 NtUnmapViewOfSection (-1, 0x23d0000, ... ) == 0x0 00713 432 NtContinue (1243040, 0, ... 00714 432 NtAllocateVirtualMemory (-1, 0, 0, 65536, 4096, 4, ... 37552128, 65536, ) == 0x0 00715 432 NtQuerySystemInformation (Module, 65536, ... {system info, class 11, size 500}, 0x0, ) == 0x0 00716 432 NtFreeVirtualMemory (-1, (0x23d0000), 0, 32768, ... (0x23d0000), 65536, ) == 0x0 00717 432 NtAllocateVirtualMemory (-1, 0, 0, 65536, 4096, 4, ... 37552128, 65536, ) == 0x0 00718 432 NtQuerySystemInformation (Module, 65536, ... {system info, class 11, size 500}, 0x0, ) == 0x0 00719 432 NtFreeVirtualMemory (-1, (0x23d0000), 0, 32768, ... (0x23d0000), 65536, ) == 0x0 00720 432 NtSetEvent (172, ... 00666 908 NtWaitForSingleObject ... ) == 0x0 00721 908 NtDelayExecution (0, {0, 0}, ... ) == 0x0 00722 908 NtWaitForSingleObject (172, 0, 0x0, ... 00720 432 NtSetEvent ... 0x0, ) == 0x0 00723 432 NtDelayExecution (0, {0, 0}, ... ) == 0x0 00724 432 NtSetEvent (140, ... 00656 864 NtWaitForSingleObject ... ) == 0x0 00725 864 NtDelayExecution (0, {0, 0}, ... ) == 0x0 00726 864 NtWaitForSingleObject (140, 0, 0x0, ... 00724 432 NtSetEvent ... 0x0, ) == 0x0 00727 432 NtDelayExecution (0, {0, 0}, ... ) == 0x0 00728 432 NtAllocateVirtualMemory (-1, 0, 0, 1000, 4096, 4, ... 37552128, 4096, ) == 0x0 00729 432 NtQueryInformationProcess (-1, DebugPort, 4, ... {process info, class 7, size 4}, 0x0, ) == 0x0 00730 432 NtFreeVirtualMemory (-1, (0x23d0000), 0, 32768, ... (0x23d0000), 4096, ) == 0x0 00731 432 NtUserFindWindowEx (0, 0, (0, 0, "FilemonClass", 0x0, 0, ... ) , 0x0, 0, ... ) == 0x0 00732 432 NtUserFindWindowEx (0, 0, 0x0, (0, 0, 0x0, "File Monitor - Sysinternals: www.sysinternals.com", 0, ... ) , 0, ... ) == 0x0 00733 432 NtUserFindWindowEx (0, 0, (0, 0, "PROCMON_WINDOW_CLASS", 0x0, 0, ... ) , 0x0, 0, ... ) == 0x0 00734 432 NtUserFindWindowEx (0, 0, 0x0, (0, 0, 0x0, "Process Monitor - Sysinternals: www.sysinternals.com", 0, ... ) , 0, ... ) == 0x0 00735 432 NtAllocateVirtualMemory (-1, 0, 0, 65536, 4096, 4, ... 37552128, 65536, ) == 0x0 00736 432 NtQuerySystemInformation (Module, 65536, ... {system info, class 11, size 500}, 0x0, ) == 0x0 00737 432 NtFreeVirtualMemory (-1, (0x23d0000), 0, 32768, ... (0x23d0000), 65536, ) == 0x0 00738 432 NtSetEvent (160, ... 00660 884 NtWaitForSingleObject ... ) == 0x0 00739 884 NtDelayExecution (0, {0, 0}, ... ) == 0x0 00740 884 NtWaitForSingleObject (160, 0, 0x0, ... 00738 432 NtSetEvent ... 0x0, ) == 0x0 00741 432 NtDelayExecution (0, {0, 0}, ... ) == 0x0 00742 432 NtSetEvent (152, ... 00571 876 NtWaitForSingleObject ... ) == 0x0 00743 876 NtDelayExecution (0, {0, 0}, ... ) == 0x0 00744 876 NtWaitForSingleObject (152, 0, 0x0, ... 00742 432 NtSetEvent ... 0x0, ) == 0x0 00745 432 NtDelayExecution (0, {0, 0}, ... ) == 0x0 00746 432 NtUserFindWindowEx (0, 0, (0, 0, "RegmonClass", 0x0, 0, ... ) , 0x0, 0, ... ) == 0x0 00747 432 NtUserFindWindowEx (0, 0, 0x0, (0, 0, 0x0, "Registry Monitor - Sysinternals: www.sysinternals.com", 0, ... ) , 0, ... ) == 0x0 00748 432 NtUserFindWindowEx (0, 0, (0, 0, "18467-41", 0x0, 0, ... ) , 0x0, 0, ... ) == 0x0 00749 432 NtAllocateVirtualMemory (-1, 0, 0, 65536, 4096, 4, ... 37552128, 65536, ) == 0x0 00750 432 NtQuerySystemInformation (Module, 65536, ... {system info, class 11, size 500}, 0x0, ) == 0x0 00751 432 NtFreeVirtualMemory (-1, (0x23d0000), 0, 32768, ... (0x23d0000), 65536, ) == 0x0 00752 432 NtAllocateVirtualMemory (-1, 0, 0, 65536, 4096, 4, ... 37552128, 65536, ) == 0x0 00753 432 NtQuerySystemInformation (Module, 65536, ... {system info, class 11, size 500}, 0x0, ) == 0x0 00754 432 NtFreeVirtualMemory (-1, (0x23d0000), 0, 32768, ... (0x23d0000), 65536, ) == 0x0 00755 432 NtAllocateVirtualMemory (-1, 0, 0, 65536, 4096, 4, ... 37552128, 65536, ) == 0x0 00756 432 NtQuerySystemInformation (Module, 65536, ... {system info, class 11, size 500}, 0x0, ) == 0x0 00757 432 NtFreeVirtualMemory (-1, (0x23d0000), 0, 32768, ... (0x23d0000), 65536, ) == 0x0 00758 432 NtOpenKey (0x2000000, {24, 48, 0x40, 0, 0, (0x2000000, {24, 48, 0x40, 0, 0, "SOFTWARE\NuMega\DriverStudio"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 00759 432 NtOpenFile (0x100020, {24, 0, 0x42, 0, 0, (0x100020, {24, 0, 0x42, 0, 0, "\??\u:\work"}, 3, 33, ... 240, {status=0x0, info=1}, ) }, 3, 33, ... 240, {status=0x0, info=1}, ) == 0x0 00760 432 NtQueryVolumeInformationFile (240, 1244908, 8, Device, ... {status=0x0, info=8}, ) == 0x0 00761 432 NtClose (12, ... ) == 0x0 00762 432 NtAllocateVirtualMemory (-1, 0, 0, 4096, 4096, 4, ... 37552128, 4096, ) == 0x0 00763 432 NtOpenSection (0xe, {24, 8, 0x40, 0, 0, (0xe, {24, 8, 0x40, 0, 0, "OLEAUT32.dll"}, ... 12, ) }, ... 12, ) == 0x0 00764 432 NtMapViewOfSection (12, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x77120000), 0x0, 569344, ) == 0x0 00765 432 NtClose (12, ... ) == 0x0 00766 432 NtOpenSection (0xe, {24, 8, 0x40, 0, 0, (0xe, {24, 8, 0x40, 0, 0, "MSVCRT.DLL"}, ... 12, ) }, ... 12, ) == 0x0 00767 432 NtMapViewOfSection (12, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x77c10000), 0x0, 339968, ) == 0x0 00768 432 NtClose (12, ... ) == 0x0 00769 432 NtOpenSection (0xe, {24, 8, 0x40, 0, 0, (0xe, {24, 8, 0x40, 0, 0, "OLE32.DLL"}, ... 12, ) }, ... 12, ) == 0x0 00770 432 NtMapViewOfSection (12, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x771b0000), 0x0, 1155072, ) == 0x0 00771 432 NtClose (12, ... ) == 0x0 00772 432 NtQuerySystemInformation (Basic, 44, ... {Unknown=0,MaximumIncrement=156250,PhysicalPageSize=0x1000,NumberOfPhysicalPages=0xff7c,LowestPhysicalPage=0x1,HighestPhysicalPage=0xffff,AllocationGranularity=0x10000,LowestUserAddress=0x10000,HighestUserAddress=0x7ffeffff,ActiveProcessors=1,NumberProcessors=1,}, 0x0, ) == 0x0 00773 432 NtAllocateVirtualMemory (-1, 0, 0, 65536, 8192, 4, ... 37617664, 65536, ) == 0x0 00774 432 NtAllocateVirtualMemory (-1, 37617664, 0, 4096, 4096, 4, ... 37617664, 4096, ) == 0x0 00775 432 NtAllocateVirtualMemory (-1, 37621760, 0, 8192, 4096, 4, ... 37621760, 8192, ) == 0x0 00776 432 NtOpenSection (0x4, {24, 0, 0x40, 0, 0, (0x4, {24, 0, 0x40, 0, 0, "\NLS\NlsSectionCType"}, ... 12, ) }, ... 12, ) == 0x0 00777 432 NtMapViewOfSection (12, -1, (0x0), 0, 0, 0x0, 0, 2, 0, 2, ... (0x23f0000), 0x0, 12288, ) == 0x0 00778 432 NtClose (12, ... ) == 0x0 00779 432 NtAllocateVirtualMemory (-1, 37629952, 0, 4096, 4096, 4, ... 37629952, 4096, ) == 0x0 00780 432 NtQuerySystemInformation (Basic, 44, ... {Unknown=0,MaximumIncrement=156250,PhysicalPageSize=0x1000,NumberOfPhysicalPages=0xff7c,LowestPhysicalPage=0x1,HighestPhysicalPage=0xffff,AllocationGranularity=0x10000,LowestUserAddress=0x10000,HighestUserAddress=0x7ffeffff,ActiveProcessors=1,NumberProcessors=1,}, 0x0, ) == 0x0 00781 432 NtQuerySystemInformation (Processor, 12, ... {system info, class 1, size 12}, 0x0, ) == 0x0 00782 432 NtOpenKey (0x20019, {24, 48, 0x40, 0, 0, (0x20019, {24, 48, 0x40, 0, 0, "SYSTEM\CurrentControlSet\Control\Session Manager"}, ... 12, ) }, ... 12, ) == 0x0 00783 432 NtQueryValueKey (12, (12, "CriticalSectionTimeout", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\215'\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (12, "CriticalSectionTimeout", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\215'\0"}, 16, ) }, 16, ) == 0x0 00784 432 NtClose (12, ... ) == 0x0 00785 432 NtQuerySystemInformation (Basic, 44, ... {Unknown=0,MaximumIncrement=156250,PhysicalPageSize=0x1000,NumberOfPhysicalPages=0xff7c,LowestPhysicalPage=0x1,HighestPhysicalPage=0xffff,AllocationGranularity=0x10000,LowestUserAddress=0x10000,HighestUserAddress=0x7ffeffff,ActiveProcessors=1,NumberProcessors=1,}, 0x0, ) == 0x0 00786 432 NtQuerySystemInformation (Processor, 12, ... {system info, class 1, size 12}, 0x0, ) == 0x0 00787 432 NtQuerySystemInformation (Basic, 44, ... {Unknown=0,MaximumIncrement=156250,PhysicalPageSize=0x1000,NumberOfPhysicalPages=0xff7c,LowestPhysicalPage=0x1,HighestPhysicalPage=0xffff,AllocationGranularity=0x10000,LowestUserAddress=0x10000,HighestUserAddress=0x7ffeffff,ActiveProcessors=1,NumberProcessors=1,}, 0x0, ) == 0x0 00788 432 NtQuerySystemInformation (Processor, 12, ... {system info, class 1, size 12}, 0x0, ) == 0x0 00789 432 NtOpenKey (0x20019, {24, 0, 0x40, 0, 0, (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Classes\Interface"}, ... 12, ) }, ... 12, ) == 0x0 00790 432 NtQueryValueKey (12, (12, "InterfaceHelperDisableAll", Full, 0, ... ) , Full, 0, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 00791 432 NtQueryValueKey (12, (12, "InterfaceHelperDisableAllForOle32", Full, 0, ... ) , Full, 0, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 00792 432 NtQueryValueKey (12, (12, "InterfaceHelperDisableTypeLib", Full, 0, ... ) , Full, 0, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 00793 432 NtClose (12, ... ) == 0x0 00794 432 NtOpenKey (0x20019, {24, 0, 0x40, 0, 0, (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Classes\Interface\{00020400-0000-0000-C000-000000000046}"}, ... 12, ) }, ... 12, ) == 0x0 00795 432 NtQueryValueKey (12, (12, "InterfaceHelperDisableAll", Full, 0, ... ) , Full, 0, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 00796 432 NtQueryValueKey (12, (12, "InterfaceHelperDisableAllForOle32", Full, 0, ... ) , Full, 0, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 00797 432 NtClose (12, ... ) == 0x0 00798 432 NtOpenEvent (0x1f0003, {24, 56, 0x0, 0, 0, (0x1f0003, {24, 56, 0x0, 0, 0, "HookSwitchHookEnabledEvent"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 00799 432 NtUserRegisterWindowMessage ( ("{FB8F0821-0164-101B-84ED-08002B2EC713}", ... ) , ... ) == 0xc07b 00800 432 NtOpenKey (0x1, {24, 48, 0x40, 0, 0, (0x1, {24, 48, 0x40, 0, 0, "SOFTWARE\Microsoft\OLEAUT"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 00801 432 NtOpenKey (0x9, {24, 48, 0x40, 0, 0, (0x9, {24, 48, 0x40, 0, 0, "SOFTWARE\Microsoft\OLEAUT\UserEra"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 00802 432 NtOpenKey (0x1, {24, 48, 0x40, 0, 0, (0x1, {24, 48, 0x40, 0, 0, "SOFTWARE\Microsoft\OLEAUT"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 00803 432 NtOpenFile (0x100020, {24, 0, 0x42, 0, 0, (0x100020, {24, 0, 0x42, 0, 0, "\??\U:\startupscripts"}, 3, 33, ... 12, {status=0x0, info=1}, ) }, 3, 33, ... 12, {status=0x0, info=1}, ) == 0x0 00804 432 NtQueryVolumeInformationFile (12, 1244912, 8, Device, ... {status=0x0, info=8}, ) == 0x0 00805 432 NtClose (240, ... ) == 0x0 00806 432 NtSetEvent (168, ... 00619 892 NtWaitForSingleObject ... ) == 0x0 00807 892 NtDelayExecution (0, {0, 0}, ... ) == 0x0 00808 892 NtWaitForSingleObject (168, 0, 0x0, ... 00806 432 NtSetEvent ... 0x0, ) == 0x0 00809 432 NtDelayExecution (0, {0, 0}, ... ) == 0x0 00810 432 NtSetEvent (144, ... 00547 868 NtWaitForSingleObject ... ) == 0x0 00811 868 NtDelayExecution (0, {0, 0}, ... ) == 0x0 00812 868 NtWaitForSingleObject (144, 0, 0x0, ... 00810 432 NtSetEvent ... 0x0, ) == 0x0 00813 432 NtDelayExecution (0, {0, 0}, ... ) == 0x0 00814 432 NtAllocateVirtualMemory (-1, 0, 0, 200000, 4096, 4, ... 37748736, 200704, ) == 0x0 00815 432 NtAllocateVirtualMemory (-1, 0, 0, 1024, 4096, 4, ... 38010880, 4096, ) == 0x0 00816 432 NtSetEvent (116, ... 00686 676 NtWaitForSingleObject ... ) == 0x0 00817 676 NtDelayExecution (0, {0, 0}, ... ) == 0x0 00818 676 NtWaitForSingleObject (116, 0, 0x0, ... 00816 432 NtSetEvent ... 0x0, ) == 0x0 00819 432 NtDelayExecution (0, {0, 0}, ... ) == 0x0 00820 432 NtSetEvent (156, ... 00634 880 NtWaitForSingleObject ... ) == 0x0 00821 880 NtDelayExecution (0, {0, 0}, ... ) == 0x0 00822 880 NtWaitForSingleObject (156, 0, 0x0, ... 00820 432 NtSetEvent ... 0x0, ) == 0x0 00823 432 NtDelayExecution (0, {0, 0}, ... ) == 0x0 00824 432 NtSetEvent (168, ... 00808 892 NtWaitForSingleObject ... ) == 0x0 00825 892 NtDelayExecution (0, {0, 0}, ... ) == 0x0 00826 892 NtWaitForSingleObject (168, 0, 0x0, ... 00824 432 NtSetEvent ... 0x0, ) == 0x0 00827 432 NtDelayExecution (0, {0, 0}, ... ) == 0x0 00828 432 NtSetEvent (120, ... 00475 784 NtWaitForSingleObject ... ) == 0x0 00829 784 NtDelayExecution (0, {0, 0}, ... ) == 0x0 00830 784 NtWaitForSingleObject (120, 0, 0x0, ... 00828 432 NtSetEvent ... 0x0, ) == 0x0 00831 432 NtDelayExecution (0, {0, 0}, ... ) == 0x0 00832 432 NtSetEvent (140, ... 00726 864 NtWaitForSingleObject ... ) == 0x0 00833 864 NtDelayExecution (0, {0, 0}, ... ) == 0x0 00834 864 NtWaitForSingleObject (140, 0, 0x0, ... 00832 432 NtSetEvent ... 0x0, ) == 0x0 00835 432 NtDelayExecution (0, {0, 0}, ... ) == 0x0 00836 432 NtSetEvent (136, ... 00523 860 NtWaitForSingleObject ... ) == 0x0 00837 860 NtDelayExecution (0, {0, 0}, ... ) == 0x0 00838 860 NtWaitForSingleObject (136, 0, 0x0, ... 00836 432 NtSetEvent ... 0x0, ) == 0x0 00839 432 NtDelayExecution (0, {0, 0}, ... ) == 0x0 00840 432 NtSetEvent (116, ... 00818 676 NtWaitForSingleObject ... ) == 0x0 00841 676 NtDelayExecution (0, {0, 0}, ... ) == 0x0 00842 676 NtWaitForSingleObject (116, 0, 0x0, ... 00840 432 NtSetEvent ... 0x0, ) == 0x0 00843 432 NtDelayExecution (0, {0, 0}, ... ) == 0x0 00844 432 NtSetEvent (140, ... 00834 864 NtWaitForSingleObject ... ) == 0x0 00845 864 NtDelayExecution (0, {0, 0}, ... ) == 0x0 00846 864 NtWaitForSingleObject (140, 0, 0x0, ... 00844 432 NtSetEvent ... 0x0, ) == 0x0 00847 432 NtDelayExecution (0, {0, 0}, ... ) == 0x0 00848 432 NtSetEvent (128, ... 00499 836 NtWaitForSingleObject ... ) == 0x0 00849 836 NtDelayExecution (0, {0, 0}, ... ) == 0x0 00850 836 NtWaitForSingleObject (128, 0, 0x0, ... 00848 432 NtSetEvent ... 0x0, ) == 0x0 00851 432 NtDelayExecution (0, {0, 0}, ... ) == 0x0 00852 432 NtSetEvent (136, ... 00838 860 NtWaitForSingleObject ... ) == 0x0 00853 860 NtDelayExecution (0, {0, 0}, ... ) == 0x0 00854 860 NtWaitForSingleObject (136, 0, 0x0, ... 00852 432 NtSetEvent ... 0x0, ) == 0x0 00855 432 NtDelayExecution (0, {0, 0}, ... ) == 0x0 00856 432 NtSetEvent (124, ... 00487 716 NtWaitForSingleObject ... ) == 0x0 00857 716 NtDelayExecution (0, {0, 0}, ... ) == 0x0 00858 716 NtWaitForSingleObject (124, 0, 0x0, ... 00856 432 NtSetEvent ... 0x0, ) == 0x0 00859 432 NtDelayExecution (0, {0, 0}, ... ) == 0x0 00860 432 NtSetEvent (160, ... 00740 884 NtWaitForSingleObject ... ) == 0x0 00861 884 NtDelayExecution (0, {0, 0}, ... ) == 0x0 00862 884 NtWaitForSingleObject (160, 0, 0x0, ... 00860 432 NtSetEvent ... 0x0, ) == 0x0 00863 432 NtDelayExecution (0, {0, 0}, ... ) == 0x0 00864 432 NtSetEvent (120, ... 00830 784 NtWaitForSingleObject ... ) == 0x0 00865 784 NtDelayExecution (0, {0, 0}, ... ) == 0x0 00866 784 NtWaitForSingleObject (120, 0, 0x0, ... 00864 432 NtSetEvent ... 0x0, ) == 0x0 00867 432 NtDelayExecution (0, {0, 0}, ... ) == 0x0 00868 432 NtSetEvent (124, ... 00858 716 NtWaitForSingleObject ... ) == 0x0 00869 716 NtDelayExecution (0, {0, 0}, ... ) == 0x0 00870 716 NtWaitForSingleObject (124, 0, 0x0, ... 00868 432 NtSetEvent ... 0x0, ) == 0x0 00871 432 NtDelayExecution (0, {0, 0}, ... ) == 0x0 00872 432 NtSetEvent (172, ... 00722 908 NtWaitForSingleObject ... ) == 0x0 00873 908 NtDelayExecution (0, {0, 0}, ... ) == 0x0 00874 908 NtWaitForSingleObject (172, 0, 0x0, ... 00872 432 NtSetEvent ... 0x0, ) == 0x0 00875 432 NtDelayExecution (0, {0, 0}, ... ) == 0x0 00876 432 NtSetEvent (172, ... 00874 908 NtWaitForSingleObject ... ) == 0x0 00877 908 NtDelayExecution (0, {0, 0}, ... ) == 0x0 00878 908 NtWaitForSingleObject (172, 0, 0x0, ... 00876 432 NtSetEvent ... 0x0, ) == 0x0 00879 432 NtDelayExecution (0, {0, 0}, ... ) == 0x0 00880 432 NtProtectVirtualMemory (-1, (0x401000), 52664, 64, ... (0x401000), 53248, 8, ) == 0x0 00881 432 NtUserFindWindowEx (0, 0, (0, 0, "FilemonClass", 0x0, 0, ... ) , 0x0, 0, ... ) == 0x0 00882 432 NtUserFindWindowEx (0, 0, 0x0, (0, 0, 0x0, "File Monitor - Sysinternals: www.sysinternals.com", 0, ... ) , 0, ... ) == 0x0 00883 432 NtUserFindWindowEx (0, 0, (0, 0, "PROCMON_WINDOW_CLASS", 0x0, 0, ... ) , 0x0, 0, ... ) == 0x0 00884 432 NtUserFindWindowEx (0, 0, 0x0, (0, 0, 0x0, "Process Monitor - Sysinternals: www.sysinternals.com", 0, ... ) , 0, ... ) == 0x0 00885 432 NtAllocateVirtualMemory (-1, 0, 0, 65536, 4096, 4, ... 38076416, 65536, ) == 0x0 00886 432 NtQuerySystemInformation (Module, 65536, ... {system info, class 11, size 500}, 0x0, ) == 0x0 00887 432 NtFreeVirtualMemory (-1, (0x2450000), 0, 32768, ... (0x2450000), 65536, ) == 0x0 00888 432 NtSetEvent (112, ... 00451 788 NtWaitForSingleObject ... ) == 0x0 00889 788 NtDelayExecution (0, {0, 0}, ... ) == 0x0 00890 788 NtWaitForSingleObject (112, 0, 0x0, ... 00888 432 NtSetEvent ... 0x0, ) == 0x0 00891 432 NtDelayExecution (0, {0, 0}, ... ) == 0x0 00892 432 NtAllocateVirtualMemory (-1, 0, 0, 532480, 4096, 4, ... 38076416, 532480, ) == 0x0 00893 432 NtFreeVirtualMemory (-1, (0x2450000), 0, 32768, ... (0x2450000), 532480, ) == 0x0 00894 432 NtAllocateVirtualMemory (-1, 0, 0, 1048576, 8192, 4, ... 38076416, 1048576, ) == 0x0 00895 432 NtAllocateVirtualMemory (-1, 39116800, 0, 8192, 4096, 4, ... 39116800, 8192, ) == 0x0 00896 432 NtProtectVirtualMemory (-1, (0x254e000), 4096, 260, ... (0x254e000), 4096, 4, ) == 0x0 00897 432 NtCreateThread (0x1f03ff, 0x0, -1, 1244208, 1244924, 1, ... 240, {428, 912}, ) == 0x0 00898 432 NtQueryInformationThread (240, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ffa1000,Pid=428,Tid=912,}, 0x0, ) == 0x0 00899 432 NtRequestWaitReplyPort (24, {28, 56, new_msg, 0, 131108, 2147348480, 1243932, 34} (24, {28, 56, new_msg, 0, 131108, 2147348480, 1243932, 34} "\0\0\0\0\1\0\1\07(\365w\240o\374w\360\0\0\0\254\1\0\0\220\3\0\0" ... {28, 56, reply, 0, 428, 432, 1518, 0} "\0\0\0\0\1\0\1\0\0\0\0\0\240o\374w\360\0\0\0\254\1\0\0\220\3\0\0" ) ... {28, 56, reply, 0, 428, 432, 1518, 0} (24, {28, 56, new_msg, 0, 131108, 2147348480, 1243932, 34} "\0\0\0\0\1\0\1\07(\365w\240o\374w\360\0\0\0\254\1\0\0\220\3\0\0" ... {28, 56, reply, 0, 428, 432, 1518, 0} "\0\0\0\0\1\0\1\0\0\0\0\0\240o\374w\360\0\0\0\254\1\0\0\220\3\0\0" ) ) == 0x0 00900 432 NtResumeThread (240, ... 1, ) == 0x0 00901 432 NtSetEvent (144, ... 00902 912 NtTestAlert (... ) == 0x0 00903 912 NtContinue (39124272, 1, ... 00904 912 NtRegisterThreadTerminatePort (24, ... ) == 0x0 00905 912 NtDelayExecution (0, {-40000000, -1}, ... 00812 868 NtWaitForSingleObject ... ) == 0x0 00906 868 NtDelayExecution (0, {0, 0}, ... ) == 0x0 00907 868 NtWaitForSingleObject (144, 0, 0x0, ... 00901 432 NtSetEvent ... 0x0, ) == 0x0 00908 432 NtDelayExecution (0, {0, 0}, ... ) == 0x0 00909 432 NtSetEvent (152, ... 00744 876 NtWaitForSingleObject ... ) == 0x0 00910 876 NtDelayExecution (0, {0, 0}, ... ) == 0x0 00911 876 NtWaitForSingleObject (152, 0, 0x0, ... 00909 432 NtSetEvent ... 0x0, ) == 0x0 00912 432 NtDelayExecution (0, {0, 0}, ... ) == 0x0 00913 432 NtProtectVirtualMemory (-1, (0x400000), 4096, 4, ... (0x400000), 4096, 2, ) == 0x0 00914 432 NtProtectVirtualMemory (-1, (0x400000), 4096, 2, ... (0x400000), 4096, 4, ) == 0x0 00915 432 NtAllocateVirtualMemory (-1, 0, 0, 4096, 4096, 4, ... 39124992, 4096, ) == 0x0 00916 432 NtAllocateVirtualMemory (-1, 0, 0, 8192, 4096, 4, ... 39190528, 8192, ) == 0x0 00917 432 NtAllocateVirtualMemory (-1, 0, 0, 65536, 4096, 64, ... 39256064, 65536, ) == 0x0 00918 432 NtAllocateVirtualMemory (-1, 0, 0, 2928, 4096, 4, ... 39321600, 4096, ) == 0x0 00919 432 NtAllocateVirtualMemory (-1, 0, 0, 1812, 4096, 64, ... 39387136, 4096, ) == 0x0 00920 432 NtFreeVirtualMemory (-1, (0x2580000), 0, 32768, ... (0x2580000), 4096, ) == 0x0 00921 432 NtAllocateVirtualMemory (-1, 0, 0, 1584, 4096, 4, ... 39321600, 4096, ) == 0x0 00922 432 NtFreeVirtualMemory (-1, (0x2580000), 0, 32768, ... (0x2580000), 4096, ) == 0x0 00923 432 NtAllocateVirtualMemory (-1, 0, 0, 3316, 4096, 4, ... 39321600, 4096, ) == 0x0 00924 432 NtFreeVirtualMemory (-1, (0x2580000), 0, 32768, ... (0x2580000), 4096, ) == 0x0 00925 432 NtAllocateVirtualMemory (-1, 0, 0, 3712, 4096, 4, ... 39321600, 4096, ) == 0x0 00926 432 NtAllocateVirtualMemory (-1, 0, 0, 506, 4096, 64, ... 39452672, 4096, ) == 0x0 00927 432 NtAllocateVirtualMemory (-1, 0, 0, 7068, 4096, 64, ... 39518208, 8192, ) == 0x0 00928 432 NtAllocateVirtualMemory (-1, 0, 0, 2478, 4096, 64, ... 39583744, 4096, ) == 0x0 00929 432 NtAllocateVirtualMemory (-1, 0, 0, 1768, 4096, 64, ... 39649280, 4096, ) == 0x0 00930 432 NtAllocateVirtualMemory (-1, 0, 0, 2597, 4096, 64, ... 39714816, 4096, ) == 0x0 00931 432 NtAllocateVirtualMemory (-1, 0, 0, 2714, 4096, 64, ... 39780352, 4096, ) == 0x0 00932 432 NtAllocateVirtualMemory (-1, 0, 0, 1491, 4096, 64, ... 39845888, 4096, ) == 0x0 00933 432 NtAllocateVirtualMemory (-1, 0, 0, 7935, 4096, 64, ... 39911424, 8192, ) == 0x0 00934 432 NtAllocateVirtualMemory (-1, 0, 0, 1009, 4096, 64, ... 39976960, 4096, ) == 0x0 00935 432 NtAllocateVirtualMemory (-1, 0, 0, 1806, 4096, 64, ... 40042496, 4096, ) == 0x0 00936 432 NtAllocateVirtualMemory (-1, 0, 0, 4575, 4096, 64, ... 40108032, 8192, ) == 0x0 00937 432 NtAllocateVirtualMemory (-1, 0, 0, 1281, 4096, 64, ... 40173568, 4096, ) == 0x0 00938 432 NtAllocateVirtualMemory (-1, 0, 0, 4234, 4096, 64, ... 40239104, 8192, ) == 0x0 00939 432 NtAllocateVirtualMemory (-1, 0, 0, 752, 4096, 64, ... 40304640, 4096, ) == 0x0 00940 432 NtAllocateVirtualMemory (-1, 0, 0, 1737, 4096, 64, ... 40370176, 4096, ) == 0x0 00941 432 NtAllocateVirtualMemory (-1, 0, 0, 1409, 4096, 64, ... 40435712, 4096, ) == 0x0 00942 432 NtAllocateVirtualMemory (-1, 0, 0, 2796, 4096, 64, ... 40501248, 4096, ) == 0x0 00943 432 NtAllocateVirtualMemory (-1, 0, 0, 2681, 4096, 64, ... 40566784, 4096, ) == 0x0 00944 432 NtAllocateVirtualMemory (-1, 0, 0, 5922, 4096, 64, ... 40632320, 8192, ) == 0x0 00945 432 NtAllocateVirtualMemory (-1, 0, 0, 562, 4096, 64, ... 40697856, 4096, ) == 0x0 00946 432 NtAllocateVirtualMemory (-1, 0, 0, 1105, 4096, 64, ... 40763392, 4096, ) == 0x0 00947 432 NtAllocateVirtualMemory (-1, 0, 0, 1540, 4096, 64, ... 40828928, 4096, ) == 0x0 00948 432 NtAllocateVirtualMemory (-1, 0, 0, 3098, 4096, 64, ... 40894464, 4096, ) == 0x0 00949 432 NtAllocateVirtualMemory (-1, 0, 0, 3122, 4096, 64, ... 40960000, 4096, ) == 0x0 00950 432 NtAllocateVirtualMemory (-1, 0, 0, 749, 4096, 64, ... 41025536, 4096, ) == 0x0 00951 432 NtAllocateVirtualMemory (-1, 0, 0, 4126, 4096, 64, ... 41091072, 8192, ) == 0x0 00952 432 NtAllocateVirtualMemory (-1, 0, 0, 2286, 4096, 64, ... 41156608, 4096, ) == 0x0 00953 432 NtAllocateVirtualMemory (-1, 0, 0, 2724, 4096, 64, ... 41222144, 4096, ) == 0x0 00954 432 NtFreeVirtualMemory (-1, (0x2580000), 0, 32768, ... (0x2580000), 4096, ) == 0x0 00955 432 NtFreeVirtualMemory (-1, (0x2400000), 0, 32768, ... (0x2400000), 200704, ) == 0x0 00956 432 NtFreeVirtualMemory (-1, (0x2440000), 0, 32768, ... (0x2440000), 4096, ) == 0x0 00957 432 NtFreeVirtualMemory (-1, (0x2560000), 0, 32768, ... (0x2560000), 8192, ) == 0x0 00958 432 NtFreeVirtualMemory (-1, (0x2570000), 0, 32768, ... (0x2570000), 65536, ) == 0x0 00959 432 NtFreeVirtualMemory (-1, (0x2550000), 0, 32768, ... (0x2550000), 4096, ) == 0x0 00960 432 NtSetEvent (168, ... 00826 892 NtWaitForSingleObject ... ) == 0x0 00961 892 NtDelayExecution (0, {0, 0}, ... ) == 0x0 00962 892 NtWaitForSingleObject (168, 0, 0x0, ... 00960 432 NtSetEvent ... 0x0, ) == 0x0 00963 432 NtDelayExecution (0, {0, 0}, ... ) == 0x0 00964 432 NtSetEvent (128, ... 00850 836 NtWaitForSingleObject ... ) == 0x0 00965 836 NtDelayExecution (0, {0, 0}, ... ) == 0x0 00966 836 NtWaitForSingleObject (128, 0, 0x0, ... 00964 432 NtSetEvent ... 0x0, ) == 0x0 00967 432 NtDelayExecution (0, {0, 0}, ... ) == 0x0 00968 432 NtProtectVirtualMemory (-1, (0x400000), 4096, 4, ... (0x400000), 4096, 2, ) == 0x0 00969 432 NtProtectVirtualMemory (-1, (0x400000), 4096, 2, ... (0x400000), 4096, 4, ) == 0x0 00970 432 NtSetEvent (148, ... 00670 872 NtWaitForSingleObject ... ) == 0x0 00971 872 NtDelayExecution (0, {0, 0}, ... ) == 0x0 00972 872 NtWaitForSingleObject (148, 0, 0x0, ... 00970 432 NtSetEvent ... 0x0, ) == 0x0 00973 432 NtDelayExecution (0, {0, 0}, ... ) == 0x0 00974 432 NtSetEvent (144, ... 00907 868 NtWaitForSingleObject ... ) == 0x0 00975 868 NtDelayExecution (0, {0, 0}, ... ) == 0x0 00976 868 NtWaitForSingleObject (144, 0, 0x0, ... 00974 432 NtSetEvent ... 0x0, ) == 0x0 00977 432 NtDelayExecution (0, {0, 0}, ... ) == 0x0 00978 432 NtSetEvent (168, ... 00962 892 NtWaitForSingleObject ... ) == 0x0 00979 892 NtDelayExecution (0, {0, 0}, ... ) == 0x0 00980 892 NtWaitForSingleObject (168, 0, 0x0, ... 00978 432 NtSetEvent ... 0x0, ) == 0x0 00981 432 NtDelayExecution (0, {0, 0}, ... ) == 0x0 00982 432 NtProtectVirtualMemory (-1, (0x400000), 4096, 4, ... (0x400000), 4096, 2, ) == 0x0 00983 432 NtProtectVirtualMemory (-1, (0x400000), 4096, 2, ... (0x400000), 4096, 4, ) == 0x0 00984 432 NtSetEvent (172, ... 00878 908 NtWaitForSingleObject ... ) == 0x0 00985 908 NtDelayExecution (0, {0, 0}, ... ) == 0x0 00986 908 NtWaitForSingleObject (172, 0, 0x0, ... 00984 432 NtSetEvent ... 0x0, ) == 0x0 00987 432 NtDelayExecution (0, {0, 0}, ... ) == 0x0 00988 432 NtSetEvent (148, ... 00972 872 NtWaitForSingleObject ... ) == 0x0 00989 872 NtDelayExecution (0, {0, 0}, ... ) == 0x0 00990 872 NtWaitForSingleObject (148, 0, 0x0, ... 00988 432 NtSetEvent ... 0x0, ) == 0x0 00991 432 NtDelayExecution (0, {0, 0}, ... ) == 0x0 00992 432 NtOpenSection (0xe, {24, 8, 0x40, 0, 0, (0xe, {24, 8, 0x40, 0, 0, "ws2_32.dll"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 00993 432 NtQueryAttributesFile ({24, 0, 0x40, 0, 0, ({24, 0, 0x40, 0, 0, "\??\u:\work\ws2_32.dll"}, 1242008, ... ) }, 1242008, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 00994 432 NtQueryAttributesFile ({24, 12, 0x40, 0, 0, ({24, 12, 0x40, 0, 0, "ws2_32.dll"}, 1242008, ... ) }, 1242008, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 00995 432 NtQueryAttributesFile ({24, 0, 0x40, 0, 0, ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\System32\ws2_32.dll"}, 1242008, ... ) }, 1242008, ... ) == 0x0 00996 432 NtOpenFile (0x100020, {24, 0, 0x40, 0, 0, (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\System32\ws2_32.dll"}, 5, 96, ... 244, {status=0x0, info=1}, ) }, 5, 96, ... 244, {status=0x0, info=1}, ) == 0x0 00997 432 NtCreateSection (0xf, 0x0, 0x0, 16, 16777216, 244, ... 252, ) == 0x0 00998 432 NtQuerySection (252, Image, 48, ... {section info, class 1, size 48}, 0x0, ) == 0x0 00999 432 NtClose (244, ... ) == 0x0 01000 432 NtMapViewOfSection (252, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x71ab0000), 0x0, 86016, ) == 0x0 01001 432 NtClose (252, ... ) == 0x0 01002 432 NtOpenSection (0xe, {24, 8, 0x40, 0, 0, (0xe, {24, 8, 0x40, 0, 0, "WS2HELP.dll"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 01003 432 NtQueryAttributesFile ({24, 0, 0x40, 0, 0, ({24, 0, 0x40, 0, 0, "\??\u:\work\WS2HELP.dll"}, 1241204, ... ) }, 1241204, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 01004 432 NtQueryAttributesFile ({24, 12, 0x40, 0, 0, ({24, 12, 0x40, 0, 0, "WS2HELP.dll"}, 1241204, ... ) }, 1241204, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 01005 432 NtQueryAttributesFile ({24, 0, 0x40, 0, 0, ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\System32\WS2HELP.dll"}, 1241204, ... ) }, 1241204, ... ) == 0x0 01006 432 NtOpenFile (0x100020, {24, 0, 0x40, 0, 0, (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\System32\WS2HELP.dll"}, 5, 96, ... 252, {status=0x0, info=1}, ) }, 5, 96, ... 252, {status=0x0, info=1}, ) == 0x0 01007 432 NtCreateSection (0xf, 0x0, 0x0, 16, 16777216, 252, ... 244, ) == 0x0 01008 432 NtQuerySection (244, Image, 48, ... {section info, class 1, size 48}, 0x0, ) == 0x0 01009 432 NtClose (252, ... ) == 0x0 01010 432 NtMapViewOfSection (244, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x71aa0000), 0x0, 32768, ) == 0x0 01011 432 NtClose (244, ... ) == 0x0 01012 432 NtQuerySystemInformation (Basic, 44, ... {Unknown=0,MaximumIncrement=156250,PhysicalPageSize=0x1000,NumberOfPhysicalPages=0xff7c,LowestPhysicalPage=0x1,HighestPhysicalPage=0xffff,AllocationGranularity=0x10000,LowestUserAddress=0x10000,HighestUserAddress=0x7ffeffff,ActiveProcessors=1,NumberProcessors=1,}, 0x0, ) == 0x0 01013 432 NtQuerySystemInformation (Processor, 12, ... {system info, class 1, size 12}, 0x0, ) == 0x0 01014 432 NtOpenSection (0xe, {24, 8, 0x40, 0, 0, (0xe, {24, 8, 0x40, 0, 0, "wininet.dll"}, ... 244, ) }, ... 244, ) == 0x0 01015 432 NtMapViewOfSection (244, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x76200000), 0x0, 618496, ) == 0x0 01016 432 NtClose (244, ... ) == 0x0 01017 432 NtOpenSection (0xe, {24, 8, 0x40, 0, 0, (0xe, {24, 8, 0x40, 0, 0, "SHLWAPI.dll"}, ... 244, ) }, ... 244, ) == 0x0 01018 432 NtMapViewOfSection (244, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x772d0000), 0x0, 405504, ) == 0x0 01019 432 NtClose (244, ... ) == 0x0 01020 432 NtOpenSection (0xe, {24, 8, 0x40, 0, 0, (0xe, {24, 8, 0x40, 0, 0, "CRYPT32.dll"}, ... 244, ) }, ... 244, ) == 0x0 01021 432 NtMapViewOfSection (244, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x762c0000), 0x0, 565248, ) == 0x0 01022 432 NtClose (244, ... ) == 0x0 01023 432 NtOpenSection (0xe, {24, 8, 0x40, 0, 0, (0xe, {24, 8, 0x40, 0, 0, "MSASN1.dll"}, ... 244, ) }, ... 244, ) == 0x0 01024 432 NtMapViewOfSection (244, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x762a0000), 0x0, 61440, ) == 0x0 01025 432 NtClose (244, ... ) == 0x0 01026 432 NtOpenKey (0x2000000, {24, 48, 0x40, 0, 0, (0x2000000, {24, 48, 0x40, 0, 0, "Software\Microsoft\Windows\CurrentVersion\Explorer\Performance"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 01027 432 NtOpenKey (0x20019, {24, 48, 0x40, 0, 0, (0x20019, {24, 48, 0x40, 0, 0, "SYSTEM\CurrentControlSet\Services\crypt32\Performance"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 01028 432 NtAllocateVirtualMemory (-1, 1331200, 0, 4096, 4096, 4, ... 1331200, 4096, ) == 0x0 01029 432 NtAllocateVirtualMemory (-1, 1335296, 0, 4096, 4096, 4, ... 1335296, 4096, ) == 0x0 01030 432 NtAllocateVirtualMemory (-1, 1339392, 0, 4096, 4096, 4, ... 1339392, 4096, ) == 0x0 01031 432 NtAllocateVirtualMemory (-1, 1343488, 0, 4096, 4096, 4, ... 1343488, 4096, ) == 0x0 01032 432 NtCreateEvent (0x1f0003, {24, 56, 0x80, 1242140, 0, (0x1f0003, {24, 56, 0x80, 1242140, 0, "Global\crypt32LogoffEvent"}, 0, 0, ... ) }, 0, 0, ... ) == STATUS_ACCESS_DENIED 01033 432 NtOpenEvent (0x100000, {24, 56, 0x0, 0, 0, (0x100000, {24, 56, 0x0, 0, 0, "Global\crypt32LogoffEvent"}, ... 244, ) }, ... 244, ) == 0x0 01034 432 NtAllocateVirtualMemory (-1, 1347584, 0, 8192, 4096, 4, ... 1347584, 8192, ) == 0x0 01035 432 NtCreateKey (0xf003f, {24, 52, 0x40, 0, 0, (0xf003f, {24, 52, 0x40, 0, 0, "SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\P3P\History"}, 0, 0x0, 0, ... 252, 2, ) }, 0, 0x0, 0, ... 252, 2, ) == 0x0 01036 432 NtQueryDefaultUILanguage (1240376, ... 01037 432 NtOpenThreadTokenEx (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN 01038 432 NtOpenProcessTokenEx (-1, 0x20008, 512, ... -2147482020, ) == 0x0 01039 432 NtQueryInformationToken (-2147482020, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0 01040 432 NtClose (-2147482020, ... ) == 0x0 01041 432 NtOpenKey (0x2000000, {24, 0, 0x640, 0, 0, (0x2000000, {24, 0, 0x640, 0, 0, "\REGISTRY\USER\S-1-5-21-1078081533-484763869-839522115-1003"}, ... -2147482020, ) }, ... -2147482020, ) == 0x0 01042 432 NtOpenKey (0x80000000, {24, 0, 0x240, 0, 0, (0x80000000, {24, 0, 0x240, 0, 0, "\Registry\Machine\System\CurrentControlSet\Control\Nls\MUILanguages"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 01043 432 NtOpenKey (0x80000000, {24, -2147482020, 0x640, 0, 0, (0x80000000, {24, -2147482020, 0x640, 0, 0, "Control Panel\Desktop"}, ... -2147482032, ) }, ... -2147482032, ) == 0x0 01044 432 NtQueryValueKey (-2147482032, (-2147482032, "MultiUILanguageId", Partial, 256, ... ) , Partial, 256, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 01045 432 NtClose (-2147482032, ... ) == 0x0 01046 432 NtClose (-2147482020, ... ) == 0x0 01036 432 NtQueryDefaultUILanguage ... ) == 0x0 01047 432 NtOpenKey (0x20019, {24, 0, 0x40, 0, 0, (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\System\CurrentControlSet\Control\Nls\MUILanguages"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 01048 432 NtQueryInstallUILanguage (2012047340, ... ) == 0x0 01049 432 NtOpenFile (0x1200a9, {24, 0, 0x40, 0, 0, (0x1200a9, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\wininet.dll"}, 1, 96, ... 256, {status=0x0, info=1}, ) }, 1, 96, ... 256, {status=0x0, info=1}, ) == 0x0 01050 432 NtCreateSection (0x4, 0x0, 0x0, 2, 134217728, 256, ... 260, ) == 0x0 01051 432 NtMapViewOfSection (260, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 2, ... (0x2760000), 0x0, 593920, ) == 0x0 01052 432 NtOpenFile (0x1200a9, {24, 0, 0x40, 0, 0, (0x1200a9, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\wininet.dll.123.Manifest"}, 1, 96, ... ) }, 1, 96, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 01053 432 NtQueryDefaultUILanguage (2013024600, ... 01054 432 NtOpenThreadTokenEx (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN 01055 432 NtOpenProcessTokenEx (-1, 0x20008, 512, ... -2147482020, ) == 0x0 01056 432 NtQueryInformationToken (-2147482020, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0 01057 432 NtClose (-2147482020, ... ) == 0x0 01058 432 NtOpenKey (0x2000000, {24, 0, 0x640, 0, 0, (0x2000000, {24, 0, 0x640, 0, 0, "\REGISTRY\USER\S-1-5-21-1078081533-484763869-839522115-1003"}, ... -2147482020, ) }, ... -2147482020, ) == 0x0 01059 432 NtOpenKey (0x80000000, {24, 0, 0x240, 0, 0, (0x80000000, {24, 0, 0x240, 0, 0, "\Registry\Machine\System\CurrentControlSet\Control\Nls\MUILanguages"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 01060 432 NtOpenKey (0x80000000, {24, -2147482020, 0x640, 0, 0, (0x80000000, {24, -2147482020, 0x640, 0, 0, "Control Panel\Desktop"}, ... -2147482032, ) }, ... -2147482032, ) == 0x0 01061 432 NtQueryValueKey (-2147482032, (-2147482032, "MultiUILanguageId", Partial, 256, ... ) , Partial, 256, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 01062 432 NtClose (-2147482032, ... ) == 0x0 01063 432 NtClose (-2147482020, ... ) == 0x0 01053 432 NtQueryDefaultUILanguage ... ) == 0x0 01064 432 NtAllocateVirtualMemory (-1, 1228800, 0, 4096, 4096, 260, ... 1228800, 4096, ) == 0x0 01065 432 NtQueryInstallUILanguage (2013024602, ... ) == 0x0 01066 432 NtQueryDefaultLocale (1, 1238412, ... ) == 0x0 01067 432 NtOpenFile (0x1200a9, {24, 0, 0x40, 0, 0, (0x1200a9, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\wininet.dll.123.Config"}, 1, 96, ... ) }, 1, 96, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 01068 432 NtRequestWaitReplyPort (24, {128, 156, new_msg, 0, 1239268, 1, 96, 0} (24, {128, 156, new_msg, 0, 1239268, 1, 96, 0} "\210\6\31\1\33\0\1\0\0\0\0\0\1\354\22\0\1\0\0\0\0\0\11\4\1\1\1\0>\0@\0\250\6\31\1\0\1\0\0\377\377\377\377\0\0\0\0P\275}\2\0\0\0\0\312\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0(\0,\0\350\6\31\1\0\0\0\0\0\0\0\0\344\357\22\0\0\0\0\0" ... {128, 156, reply, 0, 428, 432, 1519, 0} "(\350\26\0\33\0\1\0\0\0\0\0\1\354\22\0\1\0\0\0\0\0\11\4\1\1\1\0>\0@\0\250\6\31\1\0\1\0\0\377\377\377\377\0\0\0\0P\275}\2\0\0\0\0\312\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0(\0,\0\350\6\31\1\0\0\0\0\0\0\0\0\344\357\22\0\0\0\0\0" ) ... {128, 156, reply, 0, 428, 432, 1519, 0} (24, {128, 156, new_msg, 0, 1239268, 1, 96, 0} "\210\6\31\1\33\0\1\0\0\0\0\0\1\354\22\0\1\0\0\0\0\0\11\4\1\1\1\0>\0@\0\250\6\31\1\0\1\0\0\377\377\377\377\0\0\0\0P\275}\2\0\0\0\0\312\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0(\0,\0\350\6\31\1\0\0\0\0\0\0\0\0\344\357\22\0\0\0\0\0" ... {128, 156, reply, 0, 428, 432, 1519, 0} "(\350\26\0\33\0\1\0\0\0\0\0\1\354\22\0\1\0\0\0\0\0\11\4\1\1\1\0>\0@\0\250\6\31\1\0\1\0\0\377\377\377\377\0\0\0\0P\275}\2\0\0\0\0\312\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0(\0,\0\350\6\31\1\0\0\0\0\0\0\0\0\344\357\22\0\0\0\0\0" ) ) == 0x0 01069 432 NtClose (256, ... ) == 0x0 01070 432 NtClose (260, ... ) == 0x0 01071 432 NtUnmapViewOfSection (-1, 0x2760000, ... ) == 0x0 01072 432 NtUnmapViewOfSection (-1, 0x12efe4, ... ) == STATUS_NOT_MAPPED_VIEW 01073 432 NtQueryDebugFilterState (53, 2, ... ) == 0x0 01074 432 NtOpenKey (0x8, {24, 0, 0x40, 0, 0, (0x8, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows\CurrentVersion\SideBySide\AssemblyStorageRoots"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 01075 432 NtQueryDebugFilterState (53, 2, ... ) == 0x0 01076 432 NtQueryDebugFilterState (53, 2, ... ) == 0x0 01077 432 NtQueryAttributesFile ({24, 0, 0x40, 0, 0, ({24, 0, 0x40, 0, 0, "\??\u:\work\packed.exe.Local\"}, 1236952, ... ) }, 1236952, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 01078 432 NtQueryDebugFilterState (53, 2, ... ) == 0x0 01079 432 NtQueryDebugFilterState (53, 2, ... ) == 0x0 01080 432 NtQueryDebugFilterState (53, 2, ... ) == 0x0 01081 432 NtQueryAttributesFile ({24, 0, 0x40, 0, 0, ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.0.0_x-ww_1382d70a"}, 1237544, ... ) }, 1237544, ... ) == 0x0 01082 432 NtOpenFile (0x100020, {24, 0, 0x40, 0, 0, (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.0.0_x-ww_1382d70a"}, 3, 33, ... 260, {status=0x0, info=1}, ) }, 3, 33, ... 260, {status=0x0, info=1}, ) == 0x0 01083 432 NtQueryDebugFilterState (53, 2, ... ) == 0x0 01084 432 NtOpenFile (0x100020, {24, 0, 0x40, 0, 0, (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.0.0_x-ww_1382d70a\comctl32.dll"}, 5, 96, ... 256, {status=0x0, info=1}, ) }, 5, 96, ... 256, {status=0x0, info=1}, ) == 0x0 01085 432 NtCreateSection (0xe, 0x0, 0x0, 16, 134217728, 256, ... 264, ) == 0x0 01086 432 NtClose (256, ... ) == 0x0 01087 432 NtMapViewOfSection (264, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 16, ... (0x2760000), 0x0, 921600, ) == 0x0 01088 432 NtClose (264, ... ) == 0x0 01089 432 NtUnmapViewOfSection (-1, 0x2760000, ... ) == 0x0 01090 432 NtOpenFile (0x100020, {24, 0, 0x40, 0, 0, (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.0.0_x-ww_1382d70a\comctl32.dll"}, 5, 96, ... 264, {status=0x0, info=1}, ) }, 5, 96, ... 264, {status=0x0, info=1}, ) == 0x0 01091 432 NtCreateSection (0xf, 0x0, 0x0, 16, 16777216, 264, ... 256, ) == 0x0 01092 432 NtQuerySection (256, Image, 48, ... {section info, class 1, size 48}, 0x0, ) == 0x0 01093 432 NtClose (264, ... ) == 0x0 01094 432 NtMapViewOfSection (256, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x71950000), 0x0, 933888, ) == 0x0 01095 432 NtClose (256, ... ) == 0x0 01096 432 NtProtectVirtualMemory (-1, (0x71951000), 1952, 4, ... (0x71951000), 4096, 32, ) == 0x0 01097 432 NtProtectVirtualMemory (-1, (0x71951000), 4096, 32, ... (0x71951000), 4096, 4, ) == 0x0 01098 432 NtFlushInstructionCache (-1, 1905594368, 1952, ... ) == 0x0 01099 432 NtProtectVirtualMemory (-1, (0x71951000), 1952, 4, ... (0x71951000), 4096, 32, ) == 0x0 01100 432 NtProtectVirtualMemory (-1, (0x71951000), 4096, 32, ... (0x71951000), 4096, 4, ) == 0x0 01101 432 NtFlushInstructionCache (-1, 1905594368, 1952, ... ) == 0x0 01102 432 NtProtectVirtualMemory (-1, (0x71951000), 1952, 4, ... (0x71951000), 4096, 32, ) == 0x0 01103 432 NtProtectVirtualMemory (-1, (0x71951000), 4096, 32, ... (0x71951000), 4096, 4, ) == 0x0 01104 432 NtFlushInstructionCache (-1, 1905594368, 1952, ... ) == 0x0 01105 432 NtProtectVirtualMemory (-1, (0x71951000), 1952, 4, ... (0x71951000), 4096, 32, ) == 0x0 01106 432 NtProtectVirtualMemory (-1, (0x71951000), 4096, 32, ... (0x71951000), 4096, 4, ) == 0x0 01107 432 NtFlushInstructionCache (-1, 1905594368, 1952, ... ) == 0x0 01108 432 NtProtectVirtualMemory (-1, (0x71951000), 1952, 4, ... (0x71951000), 4096, 32, ) == 0x0 01109 432 NtProtectVirtualMemory (-1, (0x71951000), 4096, 32, ... (0x71951000), 4096, 4, ) == 0x0 01110 432 NtFlushInstructionCache (-1, 1905594368, 1952, ... ) == 0x0 01111 432 NtProtectVirtualMemory (-1, (0x71951000), 1952, 4, ... (0x71951000), 4096, 32, ) == 0x0 01112 432 NtProtectVirtualMemory (-1, (0x71951000), 4096, 32, ... (0x71951000), 4096, 4, ) == 0x0 01113 432 NtFlushInstructionCache (-1, 1905594368, 1952, ... ) == 0x0 01114 432 NtProtectVirtualMemory (-1, (0x71951000), 1952, 4, ... (0x71951000), 4096, 32, ) == 0x0 01115 432 NtProtectVirtualMemory (-1, (0x71951000), 4096, 32, ... (0x71951000), 4096, 4, ) == 0x0 01116 432 NtFlushInstructionCache (-1, 1905594368, 1952, ... ) == 0x0 01117 432 NtAddAtom ( ("T\0h\0e\0m\0e\0P\0r\0o\0p\0S\0c\0r\0o\0l\0l\0B\0a\0r\0C\0t\0l\0", 42, 1238728, ... ) , 42, 1238728, ... ) == 0x0 01118 432 NtQueryDefaultUILanguage (1237444, ... 01119 432 NtOpenThreadTokenEx (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN 01120 432 NtOpenProcessTokenEx (-1, 0x20008, 512, ... -2147482020, ) == 0x0 01121 432 NtQueryInformationToken (-2147482020, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0 01122 432 NtClose (-2147482020, ... ) == 0x0 01123 432 NtOpenKey (0x2000000, {24, 0, 0x640, 0, 0, (0x2000000, {24, 0, 0x640, 0, 0, "\REGISTRY\USER\S-1-5-21-1078081533-484763869-839522115-1003"}, ... -2147482020, ) }, ... -2147482020, ) == 0x0 01124 432 NtOpenKey (0x80000000, {24, 0, 0x240, 0, 0, (0x80000000, {24, 0, 0x240, 0, 0, "\Registry\Machine\System\CurrentControlSet\Control\Nls\MUILanguages"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 01125 432 NtOpenKey (0x80000000, {24, -2147482020, 0x640, 0, 0, (0x80000000, {24, -2147482020, 0x640, 0, 0, "Control Panel\Desktop"}, ... -2147482032, ) }, ... -2147482032, ) == 0x0 01126 432 NtQueryValueKey (-2147482032, (-2147482032, "MultiUILanguageId", Partial, 256, ... ) , Partial, 256, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 01127 432 NtClose (-2147482032, ... ) == 0x0 01128 432 NtClose (-2147482020, ... ) == 0x0 01118 432 NtQueryDefaultUILanguage ... ) == 0x0 01129 432 NtOpenKey (0x20019, {24, 0, 0x40, 0, 0, (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\System\CurrentControlSet\Control\Nls\MUILanguages"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 01130 432 NtQueryAttributesFile ({24, 0, 0x40, 0, 0, ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\WindowsShell.Manifest"}, 1236296, ... ) }, 1236296, ... ) == 0x0 01131 432 NtOpenFile (0x100020, {24, 0, 0x40, 0, 0, (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\WindowsShell.Manifest"}, 5, 96, ... 256, {status=0x0, info=1}, ) }, 5, 96, ... 256, {status=0x0, info=1}, ) == 0x0 01132 432 NtCreateSection (0xe, 0x0, 0x0, 16, 134217728, 256, ... 264, ) == 0x0 01133 432 NtClose (256, ... ) == 0x0 01134 432 NtMapViewOfSection (264, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 16, ... (0x2410000), 0x0, 4096, ) == 0x0 01135 432 NtClose (264, ... ) == 0x0 01136 432 NtUnmapViewOfSection (-1, 0x2410000, ... ) == 0x0 01137 432 NtQueryAttributesFile ({24, 0, 0x40, 0, 0, ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\WindowsShell.Manifest"}, 1235936, ... ) }, 1235936, ... ) == 0x0 01138 432 NtCreateFile (0x80100080, {24, 0, 0x40, 0, 1236636, (0x80100080, {24, 0, 0x40, 0, 1236636, "\??\C:\WINDOWS\WindowsShell.Manifest"}, 0x0, 0, 5, 1, 96, 0, 0, ... 264, {status=0x0, info=1}, ) }, 0x0, 0, 5, 1, 96, 0, 0, ... 264, {status=0x0, info=1}, ) == 0x0 01139 432 NtCreateSection (0xf0005, 0x0, 0x0, 2, 134217728, 264, ... 256, ) == 0x0 01140 432 NtClose (264, ... ) == 0x0 01141 432 NtMapViewOfSection (256, -1, (0x0), 0, 0, {0, 0}, 0, 1, 0, 2, ... (0x2410000), {0, 0}, 4096, ) == 0x0 01142 432 NtClose (256, ... ) == 0x0 01143 432 NtUnmapViewOfSection (-1, 0x2410000, ... ) == 0x0 01144 432 NtOpenFile (0x1200a9, {24, 0, 0x40, 0, 0, (0x1200a9, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\WindowsShell.Manifest"}, 1, 96, ... 256, {status=0x0, info=1}, ) }, 1, 96, ... 256, {status=0x0, info=1}, ) == 0x0 01145 432 NtCreateSection (0x4, 0x0, 0x0, 2, 134217728, 256, ... 264, ) == 0x0 01146 432 NtMapViewOfSection (264, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 2, ... (0x2410000), 0x0, 4096, ) == 0x0 01147 432 NtQueryInformationFile (256, 1236256, 56, NetworkOpen, ... {status=0x0, info=56}, ) == 0x0 01148 432 NtOpenFile (0x1200a9, {24, 0, 0x40, 0, 0, (0x1200a9, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\WindowsShell.Config"}, 1, 96, ... ) }, 1, 96, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 01149 432 NtRequestWaitReplyPort (24, {128, 156, new_msg, 0, 1236336, 1, 96, 0} (24, {128, 156, new_msg, 0, 1236336, 1, 96, 0} "\210\6\31\1\33\0\1\0\240\315Z\371\2209\307\1\1\0\0\0\0\0\11\4\1\1\3\0@\0D\0\250\6\31\1\0\1\0\0\10\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\355\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\26\0\30\0\354\6\31\1\0\0\0\0\0\0\0\0p\344\22\0\0\0\0\0" ... {128, 156, reply, 0, 428, 432, 1520, 0} "h\334\26\0\33\0\1\0\0\0\0\0\2209\307\1\1\0\0\0\0\0\11\4\1\1\3\0@\0D\0\250\6\31\1\0\1\0\0\10\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\355\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\26\0\30\0\354\6\31\1\0\0\0\0\0\0\0\0p\344\22\0\0\0\0\0" ) ... {128, 156, reply, 0, 428, 432, 1520, 0} (24, {128, 156, new_msg, 0, 1236336, 1, 96, 0} "\210\6\31\1\33\0\1\0\240\315Z\371\2209\307\1\1\0\0\0\0\0\11\4\1\1\3\0@\0D\0\250\6\31\1\0\1\0\0\10\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\355\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\26\0\30\0\354\6\31\1\0\0\0\0\0\0\0\0p\344\22\0\0\0\0\0" ... {128, 156, reply, 0, 428, 432, 1520, 0} "h\334\26\0\33\0\1\0\0\0\0\0\2209\307\1\1\0\0\0\0\0\11\4\1\1\3\0@\0D\0\250\6\31\1\0\1\0\0\10\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\355\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\26\0\30\0\354\6\31\1\0\0\0\0\0\0\0\0p\344\22\0\0\0\0\0" ) ) == 0x0 01150 432 NtClose (256, ... ) == 0x0 01151 432 NtClose (264, ... ) == 0x0 01152 432 NtUnmapViewOfSection (-1, 0x2410000, ... ) == 0x0 01153 432 NtUnmapViewOfSection (-1, 0x12e470, ... ) == STATUS_NOT_MAPPED_VIEW 01154 432 NtQueryDebugFilterState (53, 2, ... ) == 0x0 01155 432 NtUserRegisterWindowMessage ( ("ShellGetDragImage", ... ) , ... ) == 0xc03a 01156 432 NtUserSystemParametersInfo (104, 0, 1906151468, 0, ... ) == 0x1 01157 432 NtUserGetDC (0, ... ) == 0x1010054 01158 432 NtQueryDebugFilterState (87, 3, ... ) == 0x0 01159 432 NtQueryDebugFilterState (87, 3, ... ) == 0x0 01160 432 NtContinue (1236292, 0, ... 01161 432 NtQueryDebugFilterState (87, 3, ... ) == 0x0 01162 432 NtUnmapViewOfSection (-1, 0x71950000, ... ) == 0x0 01163 432 NtQueryDebugFilterState (87, 3, ... ) == 0x0 01164 432 NtUnmapViewOfSection (-1, 0x2400000, ... ) == 0x0 01165 432 NtClose (260, ... ) == 0x0 01166 432 NtCreateKey (0x2001f, {24, 52, 0x40, 0, 0, (0x2001f, {24, 52, 0x40, 0, 0, "SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings"}, 0, 0x0, 0, ... 260, 2, ) }, 0, 0x0, 0, ... 260, 2, ) == 0x0 01167 432 NtQueryValueKey (260, (260, "FromCacheTimeout", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 01168 432 NtQueryValueKey (260, (260, "SecureProtocols", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 01169 432 NtQueryValueKey (260, (260, "CertificateRevocation", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 01170 432 NtQueryValueKey (260, (260, "DisableKeepAlive", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 01171 432 NtQueryValueKey (260, (260, "DisablePassport", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 01172 432 NtQueryValueKey (260, (260, "CacheMode", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 01173 432 NtQueryValueKey (260, (260, "EnableHttp1_1", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (260, "EnableHttp1_1", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) }, 16, ) == 0x0 01174 432 NtQueryValueKey (260, (260, "ProxyHttp1.1", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 01175 432 NtQueryValueKey (260, (260, "EnableNegotiate", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (260, "EnableNegotiate", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) }, 16, ) == 0x0 01176 432 NtOpenSection (0xe, {24, 8, 0x40, 0, 0, (0xe, {24, 8, 0x40, 0, 0, "Secur32.dll"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 01177 432 NtQueryAttributesFile ({24, 0, 0x40, 0, 0, ({24, 0, 0x40, 0, 0, "\??\u:\work\Secur32.dll"}, 1241480, ... ) }, 1241480, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 01178 432 NtQueryAttributesFile ({24, 12, 0x40, 0, 0, ({24, 12, 0x40, 0, 0, "Secur32.dll"}, 1241480, ... ) }, 1241480, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 01179 432 NtQueryAttributesFile ({24, 0, 0x40, 0, 0, ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\System32\Secur32.dll"}, 1241480, ... ) }, 1241480, ... ) == 0x0 01180 432 NtOpenFile (0x100020, {24, 0, 0x40, 0, 0, (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\System32\Secur32.dll"}, 5, 96, ... 264, {status=0x0, info=1}, ) }, 5, 96, ... 264, {status=0x0, info=1}, ) == 0x0 01181 432 NtCreateSection (0xf, 0x0, 0x0, 16, 16777216, 264, ... 256, ) == 0x0 01182 432 NtQuerySection (256, Image, 48, ... {section info, class 1, size 48}, 0x0, ) == 0x0 01183 432 NtClose (264, ... ) == 0x0 01184 432 NtMapViewOfSection (256, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x76f90000), 0x0, 65536, ) == 0x0 01185 432 NtClose (256, ... ) == 0x0 01186 432 NtCreateSemaphore (0x100003, 0x0, 0, 2147483647, ... 256, ) == 0x0 01187 432 NtCreateSemaphore (0x100003, 0x0, 0, 2147483647, ... 264, ) == 0x0 01188 432 NtOpenEvent (0x1, {24, 0, 0x40, 0, 0, (0x1, {24, 0, 0x40, 0, 0, "\SECURITY\LSA_AUTHENTICATION_INITIALIZED"}, ... 268, ) }, ... 268, ) == 0x0 01189 432 NtQueryEvent (268, Basic, 8, ... {EventType=0,SignalState=1,}, 0x0, ) == 0x0 01190 432 NtClose (268, ... ) == 0x0 01191 432 NtConnectPort ( ("\LsaAuthenticationPort", {12, 2, 1, 0}, 0x0, 0x0, 1242964, 140, ... 268, 0x0, 0x0, 256, 140, ) , {12, 2, 1, 0}, 0x0, 0x0, 1242964, 140, ... 268, 0x0, 0x0, 256, 140, ) == 0x0 01192 432 NtRequestWaitReplyPort (268, {28, 52, new_msg, 0, 0, 0, 0, 0} (268, {28, 52, new_msg, 0, 0, 0, 0, 0} "\37\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\1\0\13\30\10\2\220\36\24\0" ... {176, 200, reply, 0, 428, 432, 1522, 0} "\37\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\1\0\20\0\10\2\220\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0S\0R\0I\0-\0u\0s\0e\0r\0" ) ... {176, 200, reply, 0, 428, 432, 1522, 0} (268, {28, 52, new_msg, 0, 0, 0, 0, 0} "\37\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\1\0\13\30\10\2\220\36\24\0" ... {176, 200, reply, 0, 428, 432, 1522, 0} "\37\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\1\0\20\0\10\2\220\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0S\0R\0I\0-\0u\0s\0e\0r\0" ) ) == 0x0 01193 432 NtQueryValueKey (260, (260, "SyncMode5", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 01194 432 NtOpenKey (0xf, {24, 48, 0x40, 0, 0, (0xf, {24, 48, 0x40, 0, 0, "Software\Microsoft\Windows\CurrentVersion\Internet Settings\Cache"}, ... 272, ) }, ... 272, ) == 0x0 01195 432 NtQueryValueKey (272, (272, "FixupKey", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 01196 432 NtClose (272, ... ) == 0x0 01197 432 NtOpenKey (0xf, {24, 48, 0x40, 0, 0, (0xf, {24, 48, 0x40, 0, 0, "Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache"}, ... 272, ) }, ... 272, ) == 0x0 01198 432 NtQueryValueKey (272, (272, "SessionStartTimeDefaultDeltaSecs", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 01199 432 NtClose (272, ... ) == 0x0 01200 432 NtOpenKey (0xf, {24, 48, 0x40, 0, 0, (0xf, {24, 48, 0x40, 0, 0, "Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache"}, ... 272, ) }, ... 272, ) == 0x0 01201 432 NtOpenKey (0x20019, {24, 48, 0x40, 0, 0, (0x20019, {24, 48, 0x40, 0, 0, "System\Setup"}, ... 276, ) }, ... 276, ) == 0x0 01202 432 NtQueryValueKey (276, (276, "SystemSetupInProgress", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (276, "SystemSetupInProgress", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) }, 16, ) == 0x0 01203 432 NtClose (276, ... ) == 0x0 01204 432 NtOpenKey (0xf, {24, 52, 0x40, 0, 0, (0xf, {24, 52, 0x40, 0, 0, "Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders"}, ... 276, ) }, ... 276, ) == 0x0 01205 432 NtOpenKey (0xf, {24, 52, 0x40, 0, 0, (0xf, {24, 52, 0x40, 0, 0, "Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache"}, ... 280, ) }, ... 280, ) == 0x0 01206 432 NtOpenKey (0xf, {24, 52, 0x40, 0, 0, (0xf, {24, 52, 0x40, 0, 0, "Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders"}, ... 284, ) }, ... 284, ) == 0x0 01207 432 NtOpenKey (0xf, {24, 52, 0x40, 0, 0, (0xf, {24, 52, 0x40, 0, 0, "Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache"}, ... 288, ) }, ... 288, ) == 0x0 01208 432 NtQueryValueKey (288, (288, "Signature", Partial, 144, ... TitleIdx=0, Type=1, Data="C\0l\0i\0e\0n\0t\0 \0U\0r\0l\0C\0a\0c\0h\0e\0 \0M\0M\0F\0 \0V\0e\0r\0 \05\0.\02\0\0\0"}, 68, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (288, "Signature", Partial, 144, ... TitleIdx=0, Type=1, Data="C\0l\0i\0e\0n\0t\0 \0U\0r\0l\0C\0a\0c\0h\0e\0 \0M\0M\0F\0 \0V\0e\0r\0 \05\0.\02\0\0\0"}, 68, ) }, 68, ) == 0x0 01209 432 NtQueryValueKey (288, (288, "Signature", Partial, 144, ... TitleIdx=0, Type=1, Data="C\0l\0i\0e\0n\0t\0 \0U\0r\0l\0C\0a\0c\0h\0e\0 \0M\0M\0F\0 \0V\0e\0r\0 \05\0.\02\0\0\0"}, 68, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (288, "Signature", Partial, 144, ... TitleIdx=0, Type=1, Data="C\0l\0i\0e\0n\0t\0 \0U\0r\0l\0C\0a\0c\0h\0e\0 \0M\0M\0F\0 \0V\0e\0r\0 \05\0.\02\0\0\0"}, 68, ) }, 68, ) == 0x0 01210 432 NtClose (288, ... ) == 0x0 01211 432 NtOpenKey (0xf, {24, 52, 0x40, 0, 0, (0xf, {24, 52, 0x40, 0, 0, "Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders"}, ... 288, ) }, ... 288, ) == 0x0 01212 432 NtQueryValueKey (288, (288, "Cache", Partial, 144, ... TitleIdx=0, Type=2, Data="%\0U\0S\0E\0R\0P\0R\0O\0F\0I\0L\0E\0%\0\\0L\0o\0c\0a\0l\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0T\0e\0m\0p\0o\0r\0a\0r\0y\0 \0I\0n\0t\0e\0r\0n\0e\0t\0 \0F\0i\0l\0e\0s\0\0\0"}, 120, ) , Partial, 144, ... TitleIdx=0, Type=2, Data= (288, "Cache", Partial, 144, ... TitleIdx=0, Type=2, Data="%\0U\0S\0E\0R\0P\0R\0O\0F\0I\0L\0E\0%\0\\0L\0o\0c\0a\0l\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0T\0e\0m\0p\0o\0r\0a\0r\0y\0 \0I\0n\0t\0e\0r\0n\0e\0t\0 \0F\0i\0l\0e\0s\0\0\0"}, 120, ) }, 120, ) == 0x0 01213 432 NtQueryValueKey (288, (288, "Cache", Partial, 144, ... TitleIdx=0, Type=2, Data="%\0U\0S\0E\0R\0P\0R\0O\0F\0I\0L\0E\0%\0\\0L\0o\0c\0a\0l\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0T\0e\0m\0p\0o\0r\0a\0r\0y\0 \0I\0n\0t\0e\0r\0n\0e\0t\0 \0F\0i\0l\0e\0s\0\0\0"}, 120, ) , Partial, 144, ... TitleIdx=0, Type=2, Data= (288, "Cache", Partial, 144, ... TitleIdx=0, Type=2, Data="%\0U\0S\0E\0R\0P\0R\0O\0F\0I\0L\0E\0%\0\\0L\0o\0c\0a\0l\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0T\0e\0m\0p\0o\0r\0a\0r\0y\0 \0I\0n\0t\0e\0r\0n\0e\0t\0 \0F\0i\0l\0e\0s\0\0\0"}, 120, ) }, 120, ) == 0x0 01214 432 NtQueryValueKey (288, (288, "Cookies", Partial, 144, ... TitleIdx=0, Type=2, Data="%\0U\0S\0E\0R\0P\0R\0O\0F\0I\0L\0E\0%\0\\0C\0o\0o\0k\0i\0e\0s\0\0\0"}, 56, ) , Partial, 144, ... TitleIdx=0, Type=2, Data= (288, "Cookies", Partial, 144, ... TitleIdx=0, Type=2, Data="%\0U\0S\0E\0R\0P\0R\0O\0F\0I\0L\0E\0%\0\\0C\0o\0o\0k\0i\0e\0s\0\0\0"}, 56, ) }, 56, ) == 0x0 01215 432 NtQueryValueKey (288, (288, "Cookies", Partial, 144, ... TitleIdx=0, Type=2, Data="%\0U\0S\0E\0R\0P\0R\0O\0F\0I\0L\0E\0%\0\\0C\0o\0o\0k\0i\0e\0s\0\0\0"}, 56, ) , Partial, 144, ... TitleIdx=0, Type=2, Data= (288, "Cookies", Partial, 144, ... TitleIdx=0, Type=2, Data="%\0U\0S\0E\0R\0P\0R\0O\0F\0I\0L\0E\0%\0\\0C\0o\0o\0k\0i\0e\0s\0\0\0"}, 56, ) }, 56, ) == 0x0 01216 432 NtQueryValueKey (288, (288, "History", Partial, 144, ... TitleIdx=0, Type=2, Data="%\0U\0S\0E\0R\0P\0R\0O\0F\0I\0L\0E\0%\0\\0L\0o\0c\0a\0l\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0H\0i\0s\0t\0o\0r\0y\0\0\0"}, 86, ) , Partial, 144, ... TitleIdx=0, Type=2, Data= (288, "History", Partial, 144, ... TitleIdx=0, Type=2, Data="%\0U\0S\0E\0R\0P\0R\0O\0F\0I\0L\0E\0%\0\\0L\0o\0c\0a\0l\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0H\0i\0s\0t\0o\0r\0y\0\0\0"}, 86, ) }, 86, ) == 0x0 01217 432 NtQueryValueKey (288, (288, "History", Partial, 144, ... TitleIdx=0, Type=2, Data="%\0U\0S\0E\0R\0P\0R\0O\0F\0I\0L\0E\0%\0\\0L\0o\0c\0a\0l\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0H\0i\0s\0t\0o\0r\0y\0\0\0"}, 86, ) , Partial, 144, ... TitleIdx=0, Type=2, Data= (288, "History", Partial, 144, ... TitleIdx=0, Type=2, Data="%\0U\0S\0E\0R\0P\0R\0O\0F\0I\0L\0E\0%\0\\0L\0o\0c\0a\0l\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0H\0i\0s\0t\0o\0r\0y\0\0\0"}, 86, ) }, 86, ) == 0x0 01218 432 NtClose (288, ... ) == 0x0 01219 432 NtOpenKey (0xf, {24, 280, 0x40, 0, 0, (0xf, {24, 280, 0x40, 0, 0, "Content"}, ... 288, ) }, ... 288, ) == 0x0 01220 432 NtQueryValueKey (288, (288, "PerUserItem", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (288, "PerUserItem", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) }, 16, ) == 0x0 01221 432 NtClose (288, ... ) == 0x0 01222 432 NtOpenKey (0xf, {24, 280, 0x40, 0, 0, (0xf, {24, 280, 0x40, 0, 0, "Content"}, ... 288, ) }, ... 288, ) == 0x0 01223 432 NtOpenSection (0xe, {24, 8, 0x40, 0, 0, (0xe, {24, 8, 0x40, 0, 0, "shell32.dll"}, ... 292, ) }, ... 292, ) == 0x0 01224 432 NtMapViewOfSection (292, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x773d0000), 0x0, 8339456, ) == 0x0 01225 432 NtClose (292, ... ) == 0x0 01226 432 NtOpenKey (0x1, {24, 48, 0x40, 0, 0, (0x1, {24, 48, 0x40, 0, 0, "SYSTEM\Setup"}, ... 292, ) }, ... 292, ) == 0x0 01227 432 NtQueryValueKey (292, (292, "SystemSetupInProgress", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (292, "SystemSetupInProgress", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) }, 16, ) == 0x0 01228 432 NtClose (292, ... ) == 0x0 01229 432 NtQueryDefaultUILanguage (1237932, ... 01230 432 NtOpenThreadTokenEx (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN 01231 432 NtOpenProcessTokenEx (-1, 0x20008, 512, ... -2147482020, ) == 0x0 01232 432 NtQueryInformationToken (-2147482020, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0 01233 432 NtClose (-2147482020, ... ) == 0x0 01234 432 NtOpenKey (0x2000000, {24, 0, 0x640, 0, 0, (0x2000000, {24, 0, 0x640, 0, 0, "\REGISTRY\USER\S-1-5-21-1078081533-484763869-839522115-1003"}, ... -2147482020, ) }, ... -2147482020, ) == 0x0 01235 432 NtOpenKey (0x80000000, {24, 0, 0x240, 0, 0, (0x80000000, {24, 0, 0x240, 0, 0, "\Registry\Machine\System\CurrentControlSet\Control\Nls\MUILanguages"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 01236 432 NtOpenKey (0x80000000, {24, -2147482020, 0x640, 0, 0, (0x80000000, {24, -2147482020, 0x640, 0, 0, "Control Panel\Desktop"}, ... -2147482032, ) }, ... -2147482032, ) == 0x0 01237 432 NtQueryValueKey (-2147482032, (-2147482032, "MultiUILanguageId", Partial, 256, ... ) , Partial, 256, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 01238 432 NtClose (-2147482032, ... ) == 0x0 01239 432 NtClose (-2147482020, ... ) == 0x0 01229 432 NtQueryDefaultUILanguage ... ) == 0x0 01240 432 NtOpenKey (0x20019, {24, 0, 0x40, 0, 0, (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\System\CurrentControlSet\Control\Nls\MUILanguages"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 01241 432 NtOpenFile (0x1200a9, {24, 0, 0x40, 0, 0, (0x1200a9, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\shell32.dll"}, 1, 96, ... 292, {status=0x0, info=1}, ) }, 1, 96, ... 292, {status=0x0, info=1}, ) == 0x0 01242 432 NtCreateSection (0x4, 0x0, 0x0, 2, 134217728, 292, ... 296, ) == 0x0 01243 432 NtMapViewOfSection (296, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 2, ... (0x2760000), 0x0, 8323072, ) == 0x0 01244 432 NtOpenFile (0x1200a9, {24, 0, 0x40, 0, 0, (0x1200a9, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\shell32.dll.124.Manifest"}, 1, 96, ... ) }, 1, 96, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 01245 432 NtAllocateVirtualMemory (-1, 1224704, 0, 4096, 4096, 260, ... 1224704, 4096, ) == 0x0 01246 432 NtQueryDefaultLocale (1, 1235968, ... ) == 0x0 01247 432 NtOpenFile (0x1200a9, {24, 0, 0x40, 0, 0, (0x1200a9, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\shell32.dll.124.Config"}, 1, 96, ... ) }, 1, 96, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 01248 432 NtRequestWaitReplyPort (24, {128, 156, new_msg, 0, 1236824, 1, 96, 0} (24, {128, 156, new_msg, 0, 1236824, 1, 96, 0} "\210\6\31\1\33\0\1\0\0\0\0\0\1\342\22\0\1\0\0\0\0\0\11\4\1\1\1\0>\0@\0\250\6\31\1$\1\0\0\377\377\377\377\0\0\0\0\20\311\255\2\0\0\0\0\236\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0(\0,\0\350\6\31\1\0\0\0\0\0\0\0\0X\346\22\0\0\0\0\0" ... {128, 156, reply, 0, 428, 432, 1523, 0} "\210\347\26\0\33\0\1\0\0\0\0\0\1\342\22\0\1\0\0\0\0\0\11\4\1\1\1\0>\0@\0\250\6\31\1$\1\0\0\377\377\377\377\0\0\0\0\20\311\255\2\0\0\0\0\236\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0(\0,\0\350\6\31\1\0\0\0\0\0\0\0\0X\346\22\0\0\0\0\0" ) ... {128, 156, reply, 0, 428, 432, 1523, 0} (24, {128, 156, new_msg, 0, 1236824, 1, 96, 0} "\210\6\31\1\33\0\1\0\0\0\0\0\1\342\22\0\1\0\0\0\0\0\11\4\1\1\1\0>\0@\0\250\6\31\1$\1\0\0\377\377\377\377\0\0\0\0\20\311\255\2\0\0\0\0\236\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0(\0,\0\350\6\31\1\0\0\0\0\0\0\0\0X\346\22\0\0\0\0\0" ... {128, 156, reply, 0, 428, 432, 1523, 0} "\210\347\26\0\33\0\1\0\0\0\0\0\1\342\22\0\1\0\0\0\0\0\11\4\1\1\1\0>\0@\0\250\6\31\1$\1\0\0\377\377\377\377\0\0\0\0\20\311\255\2\0\0\0\0\236\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0(\0,\0\350\6\31\1\0\0\0\0\0\0\0\0X\346\22\0\0\0\0\0" ) ) == 0x0 01249 432 NtClose (292, ... ) == 0x0 01250 432 NtClose (296, ... ) == 0x0 01251 432 NtUnmapViewOfSection (-1, 0x2760000, ... ) == 0x0 01252 432 NtUnmapViewOfSection (-1, 0x12e658, ... ) == STATUS_NOT_MAPPED_VIEW 01253 432 NtQueryDebugFilterState (53, 2, ... ) == 0x0 01254 432 NtAllocateVirtualMemory (-1, 1355776, 0, 4096, 4096, 4, ... 1355776, 4096, ) == 0x0 01255 432 NtOpenKey (0x8, {24, 0, 0x40, 0, 0, (0x8, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows\CurrentVersion\SideBySide\AssemblyStorageRoots"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 01256 432 NtQueryDebugFilterState (53, 2, ... ) == 0x0 01257 432 NtQueryDebugFilterState (53, 2, ... ) == 0x0 01258 432 NtQueryAttributesFile ({24, 0, 0x40, 0, 0, ({24, 0, 0x40, 0, 0, "\??\u:\work\packed.exe.Local\"}, 1235052, ... ) }, 1235052, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 01259 432 NtQueryDebugFilterState (53, 2, ... ) == 0x0 01260 432 NtQueryDebugFilterState (53, 2, ... ) == 0x0 01261 432 NtQueryDebugFilterState (53, 2, ... ) == 0x0 01262 432 NtQueryAttributesFile ({24, 0, 0x40, 0, 0, ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.0.0_x-ww_1382d70a"}, 1235644, ... ) }, 1235644, ... ) == 0x0 01263 432 NtOpenFile (0x100020, {24, 0, 0x40, 0, 0, (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.0.0_x-ww_1382d70a"}, 3, 33, ... 296, {status=0x0, info=1}, ) }, 3, 33, ... 296, {status=0x0, info=1}, ) == 0x0 01264 432 NtQueryDebugFilterState (53, 2, ... ) == 0x0 01265 432 NtOpenFile (0x100020, {24, 0, 0x40, 0, 0, (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.0.0_x-ww_1382d70a\comctl32.dll"}, 5, 96, ... 292, {status=0x0, info=1}, ) }, 5, 96, ... 292, {status=0x0, info=1}, ) == 0x0 01266 432 NtCreateSection (0xe, 0x0, 0x0, 16, 134217728, 292, ... 300, ) == 0x0 01267 432 NtClose (292, ... ) == 0x0 01268 432 NtMapViewOfSection (300, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 16, ... (0x2760000), 0x0, 921600, ) == 0x0 01269 432 NtClose (300, ... ) == 0x0 01270 432 NtUnmapViewOfSection (-1, 0x2760000, ... ) == 0x0 01271 432 NtOpenFile (0x100020, {24, 0, 0x40, 0, 0, (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.0.0_x-ww_1382d70a\comctl32.dll"}, 5, 96, ... 300, {status=0x0, info=1}, ) }, 5, 96, ... 300, {status=0x0, info=1}, ) == 0x0 01272 432 NtCreateSection (0xf, 0x0, 0x0, 16, 16777216, 300, ... 292, ) == 0x0 01273 432 NtQuerySection (292, Image, 48, ... {section info, class 1, size 48}, 0x0, ) == 0x0 01274 432 NtClose (300, ... ) == 0x0 01275 432 NtMapViewOfSection (292, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x71950000), 0x0, 933888, ) == 0x0 01276 432 NtClose (292, ... ) == 0x0 01277 432 NtProtectVirtualMemory (-1, (0x71951000), 1952, 4, ... (0x71951000), 4096, 32, ) == 0x0 01278 432 NtProtectVirtualMemory (-1, (0x71951000), 4096, 32, ... (0x71951000), 4096, 4, ) == 0x0 01279 432 NtFlushInstructionCache (-1, 1905594368, 1952, ... ) == 0x0 01280 432 NtProtectVirtualMemory (-1, (0x71951000), 1952, 4, ... (0x71951000), 4096, 32, ) == 0x0 01281 432 NtProtectVirtualMemory (-1, (0x71951000), 4096, 32, ... (0x71951000), 4096, 4, ) == 0x0 01282 432 NtFlushInstructionCache (-1, 1905594368, 1952, ... ) == 0x0 01283 432 NtProtectVirtualMemory (-1, (0x71951000), 1952, 4, ... (0x71951000), 4096, 32, ) == 0x0 01284 432 NtProtectVirtualMemory (-1, (0x71951000), 4096, 32, ... (0x71951000), 4096, 4, ) == 0x0 01285 432 NtFlushInstructionCache (-1, 1905594368, 1952, ... ) == 0x0 01286 432 NtProtectVirtualMemory (-1, (0x71951000), 1952, 4, ... (0x71951000), 4096, 32, ) == 0x0 01287 432 NtProtectVirtualMemory (-1, (0x71951000), 4096, 32, ... (0x71951000), 4096, 4, ) == 0x0 01288 432 NtFlushInstructionCache (-1, 1905594368, 1952, ... ) == 0x0 01289 432 NtProtectVirtualMemory (-1, (0x71951000), 1952, 4, ... (0x71951000), 4096, 32, ) == 0x0 01290 432 NtProtectVirtualMemory (-1, (0x71951000), 4096, 32, ... (0x71951000), 4096, 4, ) == 0x0 01291 432 NtFlushInstructionCache (-1, 1905594368, 1952, ... ) == 0x0 01292 432 NtProtectVirtualMemory (-1, (0x71951000), 1952, 4, ... (0x71951000), 4096, 32, ) == 0x0 01293 432 NtProtectVirtualMemory (-1, (0x71951000), 4096, 32, ... (0x71951000), 4096, 4, ) == 0x0 01294 432 NtFlushInstructionCache (-1, 1905594368, 1952, ... ) == 0x0 01295 432 NtProtectVirtualMemory (-1, (0x71951000), 1952, 4, ... (0x71951000), 4096, 32, ) == 0x0 01296 432 NtProtectVirtualMemory (-1, (0x71951000), 4096, 32, ... (0x71951000), 4096, 4, ) == 0x0 01297 432 NtFlushInstructionCache (-1, 1905594368, 1952, ... ) == 0x0 01298 432 NtAddAtom ( ("T\0h\0e\0m\0e\0P\0r\0o\0p\0S\0c\0r\0o\0l\0l\0B\0a\0r\0C\0t\0l\0", 42, 1236828, ... ) , 42, 1236828, ... ) == 0x0 01299 432 NtQueryDefaultUILanguage (1235544, ... 01300 432 NtOpenThreadTokenEx (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN 01301 432 NtOpenProcessTokenEx (-1, 0x20008, 512, ... -2147482020, ) == 0x0 01302 432 NtQueryInformationToken (-2147482020, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0 01303 432 NtClose (-2147482020, ... ) == 0x0 01304 432 NtOpenKey (0x2000000, {24, 0, 0x640, 0, 0, (0x2000000, {24, 0, 0x640, 0, 0, "\REGISTRY\USER\S-1-5-21-1078081533-484763869-839522115-1003"}, ... -2147482020, ) }, ... -2147482020, ) == 0x0 01305 432 NtOpenKey (0x80000000, {24, 0, 0x240, 0, 0, (0x80000000, {24, 0, 0x240, 0, 0, "\Registry\Machine\System\CurrentControlSet\Control\Nls\MUILanguages"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 01306 432 NtOpenKey (0x80000000, {24, -2147482020, 0x640, 0, 0, (0x80000000, {24, -2147482020, 0x640, 0, 0, "Control Panel\Desktop"}, ... -2147482032, ) }, ... -2147482032, ) == 0x0 01307 432 NtQueryValueKey (-2147482032, (-2147482032, "MultiUILanguageId", Partial, 256, ... ) , Partial, 256, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 01308 432 NtClose (-2147482032, ... ) == 0x0 01309 432 NtClose (-2147482020, ... ) == 0x0 01299 432 NtQueryDefaultUILanguage ... ) == 0x0 01310 432 NtOpenKey (0x20019, {24, 0, 0x40, 0, 0, (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\System\CurrentControlSet\Control\Nls\MUILanguages"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 01311 432 NtQueryAttributesFile ({24, 0, 0x40, 0, 0, ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\WindowsShell.Manifest"}, 1234396, ... ) }, 1234396, ... ) == 0x0 01312 432 NtOpenFile (0x100020, {24, 0, 0x40, 0, 0, (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\WindowsShell.Manifest"}, 5, 96, ... 292, {status=0x0, info=1}, ) }, 5, 96, ... 292, {status=0x0, info=1}, ) == 0x0 01313 432 NtCreateSection (0xe, 0x0, 0x0, 16, 134217728, 292, ... 300, ) == 0x0 01314 432 NtClose (292, ... ) == 0x0 01315 432 NtMapViewOfSection (300, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 16, ... (0x2410000), 0x0, 4096, ) == 0x0 01316 432 NtClose (300, ... ) == 0x0 01317 432 NtUnmapViewOfSection (-1, 0x2410000, ... ) == 0x0 01318 432 NtQueryAttributesFile ({24, 0, 0x40, 0, 0, ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\WindowsShell.Manifest"}, 1234036, ... ) }, 1234036, ... ) == 0x0 01319 432 NtCreateFile (0x80100080, {24, 0, 0x40, 0, 1234736, (0x80100080, {24, 0, 0x40, 0, 1234736, "\??\C:\WINDOWS\WindowsShell.Manifest"}, 0x0, 0, 5, 1, 96, 0, 0, ... 300, {status=0x0, info=1}, ) }, 0x0, 0, 5, 1, 96, 0, 0, ... 300, {status=0x0, info=1}, ) == 0x0 01320 432 NtCreateSection (0xf0005, 0x0, 0x0, 2, 134217728, 300, ... 292, ) == 0x0 01321 432 NtClose (300, ... ) == 0x0 01322 432 NtMapViewOfSection (292, -1, (0x0), 0, 0, {0, 0}, 0, 1, 0, 2, ... (0x2410000), {0, 0}, 4096, ) == 0x0 01323 432 NtClose (292, ... ) == 0x0 01324 432 NtUnmapViewOfSection (-1, 0x2410000, ... ) == 0x0 01325 432 NtOpenFile (0x1200a9, {24, 0, 0x40, 0, 0, (0x1200a9, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\WindowsShell.Manifest"}, 1, 96, ... 292, {status=0x0, info=1}, ) }, 1, 96, ... 292, {status=0x0, info=1}, ) == 0x0 01326 432 NtCreateSection (0x4, 0x0, 0x0, 2, 134217728, 292, ... 300, ) == 0x0 01327 432 NtMapViewOfSection (300, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 2, ... (0x2410000), 0x0, 4096, ) == 0x0 01328 432 NtQueryInformationFile (292, 1234356, 56, NetworkOpen, ... {status=0x0, info=56}, ) == 0x0 01329 432 NtOpenFile (0x1200a9, {24, 0, 0x40, 0, 0, (0x1200a9, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\WindowsShell.Config"}, 1, 96, ... ) }, 1, 96, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 01330 432 NtRequestWaitReplyPort (24, {128, 156, new_msg, 0, 1234436, 1, 96, 0} (24, {128, 156, new_msg, 0, 1234436, 1, 96, 0} "\210\6\31\1\33\0\1\0\240\315Z\371\2209\307\1\1\0\0\0\0\0\11\4\1\1\3\0@\0D\0\250\6\31\1$\1\0\0,\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\355\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\26\0\30\0\354\6\31\1\0\0\0\0\0\0\0\0\4\335\22\0\0\0\0\0" ... {128, 156, reply, 0, 428, 432, 1524, 0} "h\334\26\0\33\0\1\0\0\0\0\0\2209\307\1\1\0\0\0\0\0\11\4\1\1\3\0@\0D\0\250\6\31\1$\1\0\0,\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\355\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\26\0\30\0\354\6\31\1\0\0\0\0\0\0\0\0\4\335\22\0\0\0\0\0" ) ... {128, 156, reply, 0, 428, 432, 1524, 0} (24, {128, 156, new_msg, 0, 1234436, 1, 96, 0} "\210\6\31\1\33\0\1\0\240\315Z\371\2209\307\1\1\0\0\0\0\0\11\4\1\1\3\0@\0D\0\250\6\31\1$\1\0\0,\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\355\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\26\0\30\0\354\6\31\1\0\0\0\0\0\0\0\0\4\335\22\0\0\0\0\0" ... {128, 156, reply, 0, 428, 432, 1524, 0} "h\334\26\0\33\0\1\0\0\0\0\0\2209\307\1\1\0\0\0\0\0\11\4\1\1\3\0@\0D\0\250\6\31\1$\1\0\0,\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\355\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\26\0\30\0\354\6\31\1\0\0\0\0\0\0\0\0\4\335\22\0\0\0\0\0" ) ) == 0x0 01331 432 NtClose (292, ... ) == 0x0 01332 432 NtClose (300, ... ) == 0x0 01333 432 NtUnmapViewOfSection (-1, 0x2410000, ... ) == 0x0 01334 432 NtUnmapViewOfSection (-1, 0x12dd04, ... ) == STATUS_NOT_MAPPED_VIEW 01335 432 NtQueryDebugFilterState (53, 2, ... ) == 0x0 01336 432 NtUserRegisterWindowMessage ( ("ShellGetDragImage", ... ) , ... ) == 0xc03a 01337 432 NtUserSystemParametersInfo (104, 0, 1906151468, 0, ... ) == 0x1 01338 432 NtUserGetDC (0, ... ) == 0x1010053 01339 432 NtQueryDebugFilterState (87, 3, ... ) == 0x0 01340 432 NtQueryDebugFilterState (87, 3, ... ) == 0x0 01341 432 NtContinue (1234400, 0, ... 01342 432 NtQueryDebugFilterState (87, 3, ... ) == 0x0 01343 432 NtUnmapViewOfSection (-1, 0x71950000, ... ) == 0x0 01344 432 NtQueryDebugFilterState (87, 3, ... ) == 0x0 01345 432 NtUnmapViewOfSection (-1, 0x2400000, ... ) == 0x0 01346 432 NtClose (296, ... ) == 0x0 01347 432 NtUserGetClassInfo (1999896576, 1239668, 1239620, 1239696, 0, ... ) == 0xc03b 01348 432 NtUserGetClassInfo (1999896576, 1239668, 1239620, 1239696, 0, ... ) == 0xc03d 01349 432 NtUserGetClassInfo (1999896576, 1239668, 1239620, 1239696, 0, ... ) == 0xc03f 01350 432 NtUserGetClassInfo (1999896576, 1239668, 1239620, 1239696, 0, ... ) == 0xc041 01351 432 NtUserGetClassInfo (1999896576, 1239668, 1239620, 1239696, 0, ... ) == 0xc043 01352 432 NtUserGetClassInfo (1999896576, 1239668, 1239620, 1239696, 0, ... ) == 0xc045 01353 432 NtUserGetClassInfo (1999896576, 1239668, 1239620, 1239696, 0, ... ) == 0xc047 01354 432 NtUserGetClassInfo (1999896576, 1239668, 1239620, 1239696, 0, ... ) == 0xc049 01355 432 NtUserGetClassInfo (1999896576, 1239668, 1239620, 1239696, 0, ... ) == 0xc04b 01356 432 NtUserGetClassInfo (1999896576, 1239668, 1239620, 1239696, 0, ... ) == 0xc04d 01357 432 NtUserGetClassInfo (1999896576, 1239668, 1239620, 1239696, 0, ... ) == 0xc04f 01358 432 NtUserGetClassInfo (1999896576, 1239672, 1239624, 1239700, 0, ... ) == 0xc051 01359 432 NtUserGetClassInfo (1999896576, 1239668, 1239620, 1239696, 0, ... ) == 0xc053 01360 432 NtUserGetClassInfo (1999896576, 1239668, 1239620, 1239696, 0, ... ) == 0xc055 01361 432 NtUserGetClassInfo (1999896576, 1239668, 1239620, 1239696, 0, ... ) == 0xc059 01362 432 NtUserGetClassInfo (1999896576, 1239668, 1239620, 1239696, 0, ... ) == 0xc05b 01363 432 NtUserGetClassInfo (1999896576, 1239668, 1239620, 1239696, 0, ... ) == 0xc05d 01364 432 NtUserGetClassInfo (1999896576, 1239668, 1239620, 1239696, 0, ... ) == 0xc05f 01365 432 NtOpenThreadToken (-2, 0xc, 1, ... ) == STATUS_NO_TOKEN 01366 432 NtCreateSemaphore (0x1f0003, {24, 56, 0x80, 1353424, 0, (0x1f0003, {24, 56, 0x80, 1353424, 0, "shell.{210A4BA0-3AEA-1069-A2D9-08002B30309D}"}, 0, 2147483647, ... 296, ) }, 0, 2147483647, ... 296, ) == STATUS_OBJECT_NAME_EXISTS 01367 432 NtReleaseSemaphore (296, 1, ... 0, ) == 0x0 01368 432 NtWaitForSingleObject (296, 0, {0, 0}, ... ) == 0x0 01369 432 NtCreateKey (0x2000000, {24, 52, 0x40, 0, 0, (0x2000000, {24, 52, 0x40, 0, 0, "Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders"}, 0, 0x0, 0, ... 300, 2, ) }, 0, 0x0, 0, ... 300, 2, ) == 0x0 01370 432 NtQueryValueKey (300, (300, "Cache", Partial, 144, ... TitleIdx=0, Type=2, Data="%\0U\0S\0E\0R\0P\0R\0O\0F\0I\0L\0E\0%\0\\0L\0o\0c\0a\0l\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0T\0e\0m\0p\0o\0r\0a\0r\0y\0 \0I\0n\0t\0e\0r\0n\0e\0t\0 \0F\0i\0l\0e\0s\0\0\0"}, 120, ) , Partial, 144, ... TitleIdx=0, Type=2, Data= (300, "Cache", Partial, 144, ... TitleIdx=0, Type=2, Data="%\0U\0S\0E\0R\0P\0R\0O\0F\0I\0L\0E\0%\0\\0L\0o\0c\0a\0l\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0T\0e\0m\0p\0o\0r\0a\0r\0y\0 \0I\0n\0t\0e\0r\0n\0e\0t\0 \0F\0i\0l\0e\0s\0\0\0"}, 120, ) }, 120, ) == 0x0 01371 432 NtClose (300, ... ) == 0x0 01372 432 NtQueryAttributesFile ({24, 0, 0x40, 0, 0, ({24, 0, 0x40, 0, 0, "\??\C:\Documents and Settings\SRI-user\Local Settings\Temporary Internet Files"}, 1240192, ... ) }, 1240192, ... ) == 0x0 01373 432 NtCreateKey (0x2000000, {24, 52, 0x40, 0, 0, (0x2000000, {24, 52, 0x40, 0, 0, "Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders"}, 0, 0x0, 0, ... 300, 2, ) }, 0, 0x0, 0, ... 300, 2, ) == 0x0 01374 432 NtSetValueKey (300, (300, "Cache", 0, 1, "C\0:\0\\0D\0o\0c\0u\0m\0e\0n\0t\0s\0 \0a\0n\0d\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0S\0R\0I\0-\0u\0s\0e\0r\0\\0L\0o\0c\0a\0l\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0T\0e\0m\0p\0o\0r\0a\0r\0y\0 \0I\0n\0t\0e\0r\0n\0e\0t\0 \0F\0i\0l\0e\0s\0\0\0", 150, ... ) , 0, 1, (300, "Cache", 0, 1, "C\0:\0\\0D\0o\0c\0u\0m\0e\0n\0t\0s\0 \0a\0n\0d\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0S\0R\0I\0-\0u\0s\0e\0r\0\\0L\0o\0c\0a\0l\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0T\0e\0m\0p\0o\0r\0a\0r\0y\0 \0I\0n\0t\0e\0r\0n\0e\0t\0 \0F\0i\0l\0e\0s\0\0\0", 150, ... ) , 150, ... ) == 0x0 01375 432 NtClose (300, ... ) == 0x0 01376 432 NtQueryAttributesFile ({24, 0, 0x40, 0, 0, ({24, 0, 0x40, 0, 0, "\??\C:\Documents and Settings\SRI-user\Local Settings\Temporary Internet Files"}, 1241524, ... ) }, 1241524, ... ) == 0x0 01377 432 NtQueryAttributesFile ({24, 0, 0x40, 0, 0, ({24, 0, 0x40, 0, 0, "\??\C:\Documents and Settings\SRI-user\Local Settings\Temporary Internet Files"}, 1241256, ... ) }, 1241256, ... ) == 0x0 01378 432 NtOpenFile (0x100100, {24, 0, 0x40, 0, 0, (0x100100, {24, 0, 0x40, 0, 0, "\??\C:\Documents and Settings\SRI-user\Local Settings\Temporary Internet Files"}, 7, 2113568, ... 300, {status=0x0, info=1}, ) }, 7, 2113568, ... 300, {status=0x0, info=1}, ) == 0x0 01379 432 NtSetInformationFile (300, 1241232, 40, Basic, ... {status=0x0, info=0}, ) == 0x0 01380 432 NtClose (300, ... ) == 0x0 01381 432 NtQueryAttributesFile ({24, 0, 0x40, 0, 0, ({24, 0, 0x40, 0, 0, "\??\C:\Documents and Settings\SRI-user\Local Settings\Temporary Internet Files\desktop.ini"}, 1241256, ... ) }, 1241256, ... ) == 0x0 01382 432 NtQueryValueKey (288, (288, "CachePrefix", Partial, 144, ... TitleIdx=0, Type=1, Data="\0\0"}, 14, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (288, "CachePrefix", Partial, 144, ... TitleIdx=0, Type=1, Data="\0\0"}, 14, ) }, 14, ) == 0x0 01383 432 NtQueryValueKey (288, (288, "CachePrefix", Partial, 144, ... TitleIdx=0, Type=1, Data="\0\0"}, 14, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (288, "CachePrefix", Partial, 144, ... TitleIdx=0, Type=1, Data="\0\0"}, 14, ) }, 14, ) == 0x0 01384 432 NtQueryValueKey (288, (288, "CacheLimit", Partial, 144, ... TitleIdx=0, Type=4, Data="\251~\1\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (288, "CacheLimit", Partial, 144, ... TitleIdx=0, Type=4, Data="\251~\1\0"}, 16, ) }, 16, ) == 0x0 01385 432 NtOpenKey (0xf, {24, 48, 0x40, 0, 0, (0xf, {24, 48, 0x40, 0, 0, "Software\Microsoft\Windows\CurrentVersion\Internet Settings\Cache"}, ... 300, ) }, ... 300, ) == 0x0 01386 432 NtOpenKey (0xf, {24, 300, 0x40, 0, 0, (0xf, {24, 300, 0x40, 0, 0, "Paths"}, ... 292, ) }, ... 292, ) == 0x0 01387 432 NtOpenKey (0xf, {24, 292, 0x40, 0, 0, (0xf, {24, 292, 0x40, 0, 0, "Path1"}, ... 304, ) }, ... 304, ) == 0x0 01388 432 NtOpenKey (0xf, {24, 292, 0x40, 0, 0, (0xf, {24, 292, 0x40, 0, 0, "Path2"}, ... 308, ) }, ... 308, ) == 0x0 01389 432 NtOpenKey (0xf, {24, 292, 0x40, 0, 0, (0xf, {24, 292, 0x40, 0, 0, "Path3"}, ... 312, ) }, ... 312, ) == 0x0 01390 432 NtOpenKey (0xf, {24, 292, 0x40, 0, 0, (0xf, {24, 292, 0x40, 0, 0, "Path4"}, ... 316, ) }, ... 316, ) == 0x0 01391 432 NtOpenKey (0xf, {24, 300, 0x40, 0, 0, (0xf, {24, 300, 0x40, 0, 0, "Special Paths"}, ... 320, ) }, ... 320, ) == 0x0 01392 432 NtSetValueKey (292, (292, "Directory", 0, 1, "C\0:\0\\0D\0o\0c\0u\0m\0e\0n\0t\0s\0 \0a\0n\0d\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0S\0R\0I\0-\0u\0s\0e\0r\0\\0L\0o\0c\0a\0l\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0T\0e\0m\0p\0o\0r\0a\0r\0y\0 \0I\0n\0t\0e\0r\0n\0e\0t\0 \0F\0i\0l\0e\0s\0\\0C\0o\0n\0t\0e\0n\0t\0.\0I\0E\05\0\0\0", 174, ... ) , 0, 1, (292, "Directory", 0, 1, "C\0:\0\\0D\0o\0c\0u\0m\0e\0n\0t\0s\0 \0a\0n\0d\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0S\0R\0I\0-\0u\0s\0e\0r\0\\0L\0o\0c\0a\0l\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0T\0e\0m\0p\0o\0r\0a\0r\0y\0 \0I\0n\0t\0e\0r\0n\0e\0t\0 \0F\0i\0l\0e\0s\0\\0C\0o\0n\0t\0e\0n\0t\0.\0I\0E\05\0\0\0", 174, ... ) , 174, ... ) == 0x0 01393 432 NtSetValueKey (292, (292, "Paths", 0, 4, "\4\0\0\0", 4, ... ) , 0, 4, (292, "Paths", 0, 4, "\4\0\0\0", 4, ... ) , 4, ... ) == 0x0 01394 432 NtSetValueKey (304, (304, "CachePath", 0, 1, "C\0:\0\\0D\0o\0c\0u\0m\0e\0n\0t\0s\0 \0a\0n\0d\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0S\0R\0I\0-\0u\0s\0e\0r\0\\0L\0o\0c\0a\0l\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0T\0e\0m\0p\0o\0r\0a\0r\0y\0 \0I\0n\0t\0e\0r\0n\0e\0t\0 \0F\0i\0l\0e\0s\0\\0C\0o\0n\0t\0e\0n\0t\0.\0I\0E\05\0\\0C\0a\0c\0h\0e\01\0\0\0", 188, ... ) , 0, 1, (304, "CachePath", 0, 1, "C\0:\0\\0D\0o\0c\0u\0m\0e\0n\0t\0s\0 \0a\0n\0d\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0S\0R\0I\0-\0u\0s\0e\0r\0\\0L\0o\0c\0a\0l\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0T\0e\0m\0p\0o\0r\0a\0r\0y\0 \0I\0n\0t\0e\0r\0n\0e\0t\0 \0F\0i\0l\0e\0s\0\\0C\0o\0n\0t\0e\0n\0t\0.\0I\0E\05\0\\0C\0a\0c\0h\0e\01\0\0\0", 188, ... ) , 188, ... ) == 0x0 01395 432 NtSetValueKey (308, (308, "CachePath", 0, 1, "C\0:\0\\0D\0o\0c\0u\0m\0e\0n\0t\0s\0 \0a\0n\0d\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0S\0R\0I\0-\0u\0s\0e\0r\0\\0L\0o\0c\0a\0l\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0T\0e\0m\0p\0o\0r\0a\0r\0y\0 \0I\0n\0t\0e\0r\0n\0e\0t\0 \0F\0i\0l\0e\0s\0\\0C\0o\0n\0t\0e\0n\0t\0.\0I\0E\05\0\\0C\0a\0c\0h\0e\02\0\0\0", 188, ... ) , 0, 1, (308, "CachePath", 0, 1, "C\0:\0\\0D\0o\0c\0u\0m\0e\0n\0t\0s\0 \0a\0n\0d\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0S\0R\0I\0-\0u\0s\0e\0r\0\\0L\0o\0c\0a\0l\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0T\0e\0m\0p\0o\0r\0a\0r\0y\0 \0I\0n\0t\0e\0r\0n\0e\0t\0 \0F\0i\0l\0e\0s\0\\0C\0o\0n\0t\0e\0n\0t\0.\0I\0E\05\0\\0C\0a\0c\0h\0e\02\0\0\0", 188, ... ) , 188, ... ) == 0x0 01396 432 NtSetValueKey (312, (312, "CachePath", 0, 1, "C\0:\0\\0D\0o\0c\0u\0m\0e\0n\0t\0s\0 \0a\0n\0d\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0S\0R\0I\0-\0u\0s\0e\0r\0\\0L\0o\0c\0a\0l\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0T\0e\0m\0p\0o\0r\0a\0r\0y\0 \0I\0n\0t\0e\0r\0n\0e\0t\0 \0F\0i\0l\0e\0s\0\\0C\0o\0n\0t\0e\0n\0t\0.\0I\0E\05\0\\0C\0a\0c\0h\0e\03\0\0\0", 188, ... ) , 0, 1, (312, "CachePath", 0, 1, "C\0:\0\\0D\0o\0c\0u\0m\0e\0n\0t\0s\0 \0a\0n\0d\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0S\0R\0I\0-\0u\0s\0e\0r\0\\0L\0o\0c\0a\0l\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0T\0e\0m\0p\0o\0r\0a\0r\0y\0 \0I\0n\0t\0e\0r\0n\0e\0t\0 \0F\0i\0l\0e\0s\0\\0C\0o\0n\0t\0e\0n\0t\0.\0I\0E\05\0\\0C\0a\0c\0h\0e\03\0\0\0", 188, ... ) , 188, ... ) == 0x0 01397 432 NtSetValueKey (316, (316, "CachePath", 0, 1, "C\0:\0\\0D\0o\0c\0u\0m\0e\0n\0t\0s\0 \0a\0n\0d\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0S\0R\0I\0-\0u\0s\0e\0r\0\\0L\0o\0c\0a\0l\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0T\0e\0m\0p\0o\0r\0a\0r\0y\0 \0I\0n\0t\0e\0r\0n\0e\0t\0 \0F\0i\0l\0e\0s\0\\0C\0o\0n\0t\0e\0n\0t\0.\0I\0E\05\0\\0C\0a\0c\0h\0e\04\0\0\0", 188, ... ) , 0, 1, (316, "CachePath", 0, 1, "C\0:\0\\0D\0o\0c\0u\0m\0e\0n\0t\0s\0 \0a\0n\0d\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0S\0R\0I\0-\0u\0s\0e\0r\0\\0L\0o\0c\0a\0l\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0T\0e\0m\0p\0o\0r\0a\0r\0y\0 \0I\0n\0t\0e\0r\0n\0e\0t\0 \0F\0i\0l\0e\0s\0\\0C\0o\0n\0t\0e\0n\0t\0.\0I\0E\05\0\\0C\0a\0c\0h\0e\04\0\0\0", 188, ... ) , 188, ... ) == 0x0 01398 432 NtSetValueKey (304, (304, "CacheLimit", 0, 4, "\252_\0\0", 4, ... ) , 0, 4, (304, "CacheLimit", 0, 4, "\252_\0\0", 4, ... ) , 4, ... ) == 0x0 01399 432 NtSetValueKey (308, (308, "CacheLimit", 0, 4, "\252_\0\0", 4, ... ) , 0, 4, (308, "CacheLimit", 0, 4, "\252_\0\0", 4, ... ) , 4, ... ) == 0x0 01400 432 NtSetValueKey (312, (312, "CacheLimit", 0, 4, "\252_\0\0", 4, ... ) , 0, 4, (312, "CacheLimit", 0, 4, "\252_\0\0", 4, ... ) , 4, ... ) == 0x0 01401 432 NtSetValueKey (316, (316, "CacheLimit", 0, 4, "\252_\0\0", 4, ... ) , 0, 4, (316, "CacheLimit", 0, 4, "\252_\0\0", 4, ... ) , 4, ... ) == 0x0 01402 432 NtClose (316, ... ) == 0x0 01403 432 NtClose (312, ... ) == 0x0 01404 432 NtClose (308, ... ) == 0x0 01405 432 NtClose (304, ... ) == 0x0 01406 432 NtClose (292, ... ) == 0x0 01407 432 NtClose (320, ... ) == 0x0 01408 432 NtClose (300, ... ) == 0x0 01409 432 NtOpenKey (0xf, {24, 280, 0x40, 0, 0, (0xf, {24, 280, 0x40, 0, 0, "Cookies"}, ... 300, ) }, ... 300, ) == 0x0 01410 432 NtQueryValueKey (300, (300, "PerUserItem", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (300, "PerUserItem", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) }, 16, ) == 0x0 01411 432 NtClose (300, ... ) == 0x0 01412 432 NtClose (288, ... ) == 0x0 01413 432 NtOpenKey (0xf, {24, 280, 0x40, 0, 0, (0xf, {24, 280, 0x40, 0, 0, "Cookies"}, ... 288, ) }, ... 288, ) == 0x0 01414 432 NtOpenThreadToken (-2, 0xc, 1, ... ) == STATUS_NO_TOKEN 01415 432 NtReleaseSemaphore (296, 1, ... 0, ) == 0x0 01416 432 NtWaitForSingleObject (296, 0, {0, 0}, ... ) == 0x0 01417 432 NtCreateKey (0x2000000, {24, 52, 0x40, 0, 0, (0x2000000, {24, 52, 0x40, 0, 0, "Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders"}, 0, 0x0, 0, ... 300, 2, ) }, 0, 0x0, 0, ... 300, 2, ) == 0x0 01418 432 NtQueryValueKey (300, (300, "Cookies", Partial, 144, ... TitleIdx=0, Type=2, Data="%\0U\0S\0E\0R\0P\0R\0O\0F\0I\0L\0E\0%\0\\0C\0o\0o\0k\0i\0e\0s\0\0\0"}, 56, ) , Partial, 144, ... TitleIdx=0, Type=2, Data= (300, "Cookies", Partial, 144, ... TitleIdx=0, Type=2, Data="%\0U\0S\0E\0R\0P\0R\0O\0F\0I\0L\0E\0%\0\\0C\0o\0o\0k\0i\0e\0s\0\0\0"}, 56, ) }, 56, ) == 0x0 01419 432 NtClose (300, ... ) == 0x0 01420 432 NtQueryAttributesFile ({24, 0, 0x40, 0, 0, ({24, 0, 0x40, 0, 0, "\??\C:\Documents and Settings\SRI-user\Cookies"}, 1240192, ... ) }, 1240192, ... ) == 0x0 01421 432 NtCreateKey (0x2000000, {24, 52, 0x40, 0, 0, (0x2000000, {24, 52, 0x40, 0, 0, "Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders"}, 0, 0x0, 0, ... 300, 2, ) }, 0, 0x0, 0, ... 300, 2, ) == 0x0 01422 432 NtSetValueKey (300, (300, "Cookies", 0, 1, "C\0:\0\\0D\0o\0c\0u\0m\0e\0n\0t\0s\0 \0a\0n\0d\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0S\0R\0I\0-\0u\0s\0e\0r\0\\0C\0o\0o\0k\0i\0e\0s\0\0\0", 86, ... ) , 0, 1, (300, "Cookies", 0, 1, "C\0:\0\\0D\0o\0c\0u\0m\0e\0n\0t\0s\0 \0a\0n\0d\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0S\0R\0I\0-\0u\0s\0e\0r\0\\0C\0o\0o\0k\0i\0e\0s\0\0\0", 86, ... ) , 86, ... ) == 0x0 01423 432 NtClose (300, ... ) == 0x0 01424 432 NtQueryAttributesFile ({24, 0, 0x40, 0, 0, ({24, 0, 0x40, 0, 0, "\??\C:\Documents and Settings\SRI-user\Cookies"}, 1241524, ... ) }, 1241524, ... ) == 0x0 01425 432 NtQueryValueKey (288, (288, "CachePrefix", Partial, 144, ... TitleIdx=0, Type=1, Data="C\0o\0o\0k\0i\0e\0:\0\0\0"}, 28, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (288, "CachePrefix", Partial, 144, ... TitleIdx=0, Type=1, Data="C\0o\0o\0k\0i\0e\0:\0\0\0"}, 28, ) }, 28, ) == 0x0 01426 432 NtQueryValueKey (288, (288, "CachePrefix", Partial, 144, ... TitleIdx=0, Type=1, Data="C\0o\0o\0k\0i\0e\0:\0\0\0"}, 28, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (288, "CachePrefix", Partial, 144, ... TitleIdx=0, Type=1, Data="C\0o\0o\0k\0i\0e\0:\0\0\0"}, 28, ) }, 28, ) == 0x0 01427 432 NtQueryValueKey (288, (288, "CacheLimit", Partial, 144, ... TitleIdx=0, Type=4, Data="\0 \0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (288, "CacheLimit", Partial, 144, ... TitleIdx=0, Type=4, Data="\0 \0\0"}, 16, ) }, 16, ) == 0x0 01428 432 NtOpenKey (0xf, {24, 280, 0x40, 0, 0, (0xf, {24, 280, 0x40, 0, 0, "History"}, ... 300, ) }, ... 300, ) == 0x0 01429 432 NtQueryValueKey (300, (300, "PerUserItem", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (300, "PerUserItem", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) }, 16, ) == 0x0 01430 432 NtClose (300, ... ) == 0x0 01431 432 NtClose (288, ... ) == 0x0 01432 432 NtOpenKey (0xf, {24, 280, 0x40, 0, 0, (0xf, {24, 280, 0x40, 0, 0, "History"}, ... 288, ) }, ... 288, ) == 0x0 01433 432 NtOpenThreadToken (-2, 0xc, 1, ... ) == STATUS_NO_TOKEN 01434 432 NtReleaseSemaphore (296, 1, ... 0, ) == 0x0 01435 432 NtWaitForSingleObject (296, 0, {0, 0}, ... ) == 0x0 01436 432 NtCreateKey (0x2000000, {24, 52, 0x40, 0, 0, (0x2000000, {24, 52, 0x40, 0, 0, "Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders"}, 0, 0x0, 0, ... 300, 2, ) }, 0, 0x0, 0, ... 300, 2, ) == 0x0 01437 432 NtQueryValueKey (300, (300, "History", Partial, 144, ... TitleIdx=0, Type=2, Data="%\0U\0S\0E\0R\0P\0R\0O\0F\0I\0L\0E\0%\0\\0L\0o\0c\0a\0l\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0H\0i\0s\0t\0o\0r\0y\0\0\0"}, 86, ) , Partial, 144, ... TitleIdx=0, Type=2, Data= (300, "History", Partial, 144, ... TitleIdx=0, Type=2, Data="%\0U\0S\0E\0R\0P\0R\0O\0F\0I\0L\0E\0%\0\\0L\0o\0c\0a\0l\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0H\0i\0s\0t\0o\0r\0y\0\0\0"}, 86, ) }, 86, ) == 0x0 01438 432 NtClose (300, ... ) == 0x0 01439 432 NtQueryAttributesFile ({24, 0, 0x40, 0, 0, ({24, 0, 0x40, 0, 0, "\??\C:\Documents and Settings\SRI-user\Local Settings\History"}, 1240192, ... ) }, 1240192, ... ) == 0x0 01440 432 NtCreateKey (0x2000000, {24, 52, 0x40, 0, 0, (0x2000000, {24, 52, 0x40, 0, 0, "Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders"}, 0, 0x0, 0, ... 300, 2, ) }, 0, 0x0, 0, ... 300, 2, ) == 0x0 01441 432 NtSetValueKey (300, (300, "History", 0, 1, "C\0:\0\\0D\0o\0c\0u\0m\0e\0n\0t\0s\0 \0a\0n\0d\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0S\0R\0I\0-\0u\0s\0e\0r\0\\0L\0o\0c\0a\0l\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0H\0i\0s\0t\0o\0r\0y\0\0\0", 116, ... ) , 0, 1, (300, "History", 0, 1, "C\0:\0\\0D\0o\0c\0u\0m\0e\0n\0t\0s\0 \0a\0n\0d\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0S\0R\0I\0-\0u\0s\0e\0r\0\\0L\0o\0c\0a\0l\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0H\0i\0s\0t\0o\0r\0y\0\0\0", 116, ... ) , 116, ... ) == 0x0 01442 432 NtClose (300, ... ) == 0x0 01443 432 NtQueryAttributesFile ({24, 0, 0x40, 0, 0, ({24, 0, 0x40, 0, 0, "\??\C:\Documents and Settings\SRI-user\Local Settings\History"}, 1241524, ... ) }, 1241524, ... ) == 0x0 01444 432 NtQueryAttributesFile ({24, 0, 0x40, 0, 0, ({24, 0, 0x40, 0, 0, "\??\C:\Documents and Settings\SRI-user\Local Settings\History"}, 1241256, ... ) }, 1241256, ... ) == 0x0 01445 432 NtOpenFile (0x100100, {24, 0, 0x40, 0, 0, (0x100100, {24, 0, 0x40, 0, 0, "\??\C:\Documents and Settings\SRI-user\Local Settings\History"}, 7, 2113568, ... 300, {status=0x0, info=1}, ) }, 7, 2113568, ... 300, {status=0x0, info=1}, ) == 0x0 01446 432 NtSetInformationFile (300, 1241232, 40, Basic, ... {status=0x0, info=0}, ) == 0x0 01447 432 NtClose (300, ... ) == 0x0 01448 432 NtQueryAttributesFile ({24, 0, 0x40, 0, 0, ({24, 0, 0x40, 0, 0, "\??\C:\Documents and Settings\SRI-user\Local Settings\History\desktop.ini"}, 1241256, ... ) }, 1241256, ... ) == 0x0 01449 432 NtQueryValueKey (288, (288, "CachePrefix", Partial, 144, ... TitleIdx=0, Type=1, Data="V\0i\0s\0i\0t\0e\0d\0:\0\0\0"}, 30, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (288, "CachePrefix", Partial, 144, ... TitleIdx=0, Type=1, Data="V\0i\0s\0i\0t\0e\0d\0:\0\0\0"}, 30, ) }, 30, ) == 0x0 01450 432 NtQueryValueKey (288, (288, "CachePrefix", Partial, 144, ... TitleIdx=0, Type=1, Data="V\0i\0s\0i\0t\0e\0d\0:\0\0\0"}, 30, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (288, "CachePrefix", Partial, 144, ... TitleIdx=0, Type=1, Data="V\0i\0s\0i\0t\0e\0d\0:\0\0\0"}, 30, ) }, 30, ) == 0x0 01451 432 NtQueryValueKey (288, (288, "CacheLimit", Partial, 144, ... TitleIdx=0, Type=4, Data="\0 \0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (288, "CacheLimit", Partial, 144, ... TitleIdx=0, Type=4, Data="\0 \0\0"}, 16, ) }, 16, ) == 0x0 01452 432 NtClose (288, ... ) == 0x0 01453 432 NtClose (284, ... ) == 0x0 01454 432 NtClose (276, ... ) == 0x0 01455 432 NtClose (280, ... ) == 0x0 01456 432 NtClose (272, ... ) == 0x0 01457 432 NtOpenMutant (0x100000, {24, 56, 0x0, 0, 0, (0x100000, {24, 56, 0x0, 0, 0, "_!MSFTHISTORY!_"}, ... 272, ) }, ... 272, ) == 0x0 01458 432 NtOpenMutant (0x100000, {24, 56, 0x0, 0, 0, (0x100000, {24, 56, 0x0, 0, 0, "c:!documents and settings!sri-user!local settings!temporary internet files!content.ie5!"}, ... 280, ) }, ... 280, ) == 0x0 01459 432 NtWaitForSingleObject (280, 0, 0x0, ... ) == 0x0 01460 432 NtOpenFile (0x100001, {24, 0, 0x40, 0, 0, (0x100001, {24, 0, 0x40, 0, 0, "\??\C:\Documents and Settings\SRI-user\Local Settings\Temporary Internet Files\Content.IE5\"}, 3, 8388641, ... 276, {status=0x0, info=1}, ) }, 3, 8388641, ... 276, {status=0x0, info=1}, ) == 0x0 01461 432 NtQueryVolumeInformationFile (276, 1242776, 24, Size, ... {status=0x0, info=24}, ) == 0x0 01462 432 NtClose (276, ... ) == 0x0 01463 432 NtOpenFile (0x100001, {24, 0, 0x40, 0, 0, (0x100001, {24, 0, 0x40, 0, 0, "\??\C:\"}, 3, 8388641, ... 276, {status=0x0, info=1}, ) }, 3, 8388641, ... 276, {status=0x0, info=1}, ) == 0x0 01464 432 NtQueryVolumeInformationFile (276, 1242800, 24, Size, ... {status=0x0, info=24}, ) == 0x0 01465 432 NtClose (276, ... ) == 0x0 01466 432 NtQueryAttributesFile ({24, 0, 0x40, 0, 0, ({24, 0, 0x40, 0, 0, "\??\C:\Documents and Settings\SRI-user\Local Settings\Temporary Internet Files\Content.IE5\"}, 1243128, ... ) }, 1243128, ... ) == 0x0 01467 432 NtOpenFile (0x100100, {24, 0, 0x40, 0, 0, (0x100100, {24, 0, 0x40, 0, 0, "\??\C:\Documents and Settings\SRI-user\Local Settings\Temporary Internet Files\Content.IE5\"}, 7, 2113568, ... 276, {status=0x0, info=1}, ) }, 7, 2113568, ... 276, {status=0x0, info=1}, ) == 0x0 01468 432 NtSetInformationFile (276, 1243104, 40, Basic, ... {status=0x0, info=0}, ) == 0x0 01469 432 NtClose (276, ... ) == 0x0 01470 432 NtCreateFile (0xc0100080, {24, 0, 0x40, 1353424, 1243120, (0xc0100080, {24, 0, 0x40, 1353424, 1243120, "\??\C:\Documents and Settings\SRI-user\Local Settings\Temporary Internet Files\Content.IE5\index.dat"}, 0x0, 0, 3, 3, 2144, 0, 0, ... 276, {status=0x0, info=1}, ) }, 0x0, 0, 3, 3, 2144, 0, 0, ... 276, {status=0x0, info=1}, ) == 0x0 01471 432 NtSetInformationFile (276, 1243172, 40, Basic, ... {status=0x0, info=0}, ) == 0x0 01472 432 NtQueryInformationFile (276, 1243172, 24, Standard, ... {status=0x0, info=24}, ) == 0x0 01473 432 NtClose (276, ... ) == 0x0 01474 432 NtCreateFile (0xc0100080, {24, 0, 0x40, 1353424, 1243104, (0xc0100080, {24, 0, 0x40, 1353424, 1243104, "\??\C:\Documents and Settings\SRI-user\Local Settings\Temporary Internet Files\Content.IE5\index.dat"}, 0x0, 0, 3, 3, 2144, 0, 0, ... 276, {status=0x0, info=1}, ) }, 0x0, 0, 3, 3, 2144, 0, 0, ... 276, {status=0x0, info=1}, ) == 0x0 01475 432 NtOpenSection (0x2, {24, 56, 0x0, 0, 0, (0x2, {24, 56, 0x0, 0, 0, "C:_Documents and Settings_SRI-user_Local Settings_Temporary Internet Files_Content.IE5_index.dat_32768"}, ... 284, ) }, ... 284, ) == 0x0 01476 432 NtMapViewOfSection (284, -1, (0x0), 0, 0, {0, 0}, 0, 1, 0, 4, ... (0x2400000), {0, 0}, 32768, ) == 0x0 01477 432 NtReleaseMutant (280, ... 0x0, ) == 0x0 01478 432 NtOpenMutant (0x100000, {24, 56, 0x0, 0, 0, (0x100000, {24, 56, 0x0, 0, 0, "c:!documents and settings!sri-user!cookies!"}, ... 288, ) }, ... 288, ) == 0x0 01479 432 NtWaitForSingleObject (288, 0, 0x0, ... ) == 0x0 01480 432 NtOpenFile (0x100001, {24, 0, 0x40, 0, 0, (0x100001, {24, 0, 0x40, 0, 0, "\??\C:\Documents and Settings\SRI-user\Cookies\"}, 3, 8388641, ... 300, {status=0x0, info=1}, ) }, 3, 8388641, ... 300, {status=0x0, info=1}, ) == 0x0 01481 432 NtQueryVolumeInformationFile (300, 1242776, 24, Size, ... {status=0x0, info=24}, ) == 0x0 01482 432 NtClose (300, ... ) == 0x0 01483 432 NtOpenFile (0x100001, {24, 0, 0x40, 0, 0, (0x100001, {24, 0, 0x40, 0, 0, "\??\C:\"}, 3, 8388641, ... 300, {status=0x0, info=1}, ) }, 3, 8388641, ... 300, {status=0x0, info=1}, ) == 0x0 01484 432 NtQueryVolumeInformationFile (300, 1242800, 24, Size, ... {status=0x0, info=24}, ) == 0x0 01485 432 NtClose (300, ... ) == 0x0 01486 432 NtQueryAttributesFile ({24, 0, 0x40, 0, 0, ({24, 0, 0x40, 0, 0, "\??\C:\Documents and Settings\SRI-user\Cookies\"}, 1243128, ... ) }, 1243128, ... ) == 0x0 01487 432 NtOpenFile (0x100100, {24, 0, 0x40, 0, 0, (0x100100, {24, 0, 0x40, 0, 0, "\??\C:\Documents and Settings\SRI-user\Cookies\"}, 7, 2113568, ... 300, {status=0x0, info=1}, ) }, 7, 2113568, ... 300, {status=0x0, info=1}, ) == 0x0 01488 432 NtSetInformationFile (300, 1243104, 40, Basic, ... {status=0x0, info=0}, ) == 0x0 01489 432 NtClose (300, ... ) == 0x0 01490 432 NtCreateFile (0xc0100080, {24, 0, 0x40, 1353424, 1243120, (0xc0100080, {24, 0, 0x40, 1353424, 1243120, "\??\C:\Documents and Settings\SRI-user\Cookies\index.dat"}, 0x0, 0, 3, 3, 2144, 0, 0, ... 300, {status=0x0, info=1}, ) }, 0x0, 0, 3, 3, 2144, 0, 0, ... 300, {status=0x0, info=1}, ) == 0x0 01491 432 NtSetInformationFile (300, 1243172, 40, Basic, ... {status=0x0, info=0}, ) == 0x0 01492 432 NtQueryInformationFile (300, 1243172, 24, Standard, ... {status=0x0, info=24}, ) == 0x0 01493 432 NtClose (300, ... ) == 0x0 01494 432 NtCreateFile (0xc0100080, {24, 0, 0x40, 1353424, 1243104, (0xc0100080, {24, 0, 0x40, 1353424, 1243104, "\??\C:\Documents and Settings\SRI-user\Cookies\index.dat"}, 0x0, 0, 3, 3, 2144, 0, 0, ... 300, {status=0x0, info=1}, ) }, 0x0, 0, 3, 3, 2144, 0, 0, ... 300, {status=0x0, info=1}, ) == 0x0 01495 432 NtOpenSection (0x2, {24, 56, 0x0, 0, 0, (0x2, {24, 56, 0x0, 0, 0, "C:_Documents and Settings_SRI-user_Cookies_index.dat_16384"}, ... 320, ) }, ... 320, ) == 0x0 01496 432 NtMapViewOfSection (320, -1, (0x0), 0, 0, {0, 0}, 0, 1, 0, 4, ... (0x2410000), {0, 0}, 16384, ) == 0x0 01497 432 NtReleaseMutant (288, ... 0x0, ) == 0x0 01498 432 NtOpenMutant (0x100000, {24, 56, 0x0, 0, 0, (0x100000, {24, 56, 0x0, 0, 0, "c:!documents and settings!sri-user!local settings!history!history.ie5!"}, ... 292, ) }, ... 292, ) == 0x0 01499 432 NtWaitForSingleObject (292, 0, 0x0, ... ) == 0x0 01500 432 NtOpenFile (0x100001, {24, 0, 0x40, 0, 0, (0x100001, {24, 0, 0x40, 0, 0, "\??\C:\Documents and Settings\SRI-user\Local Settings\History\History.IE5\"}, 3, 8388641, ... 304, {status=0x0, info=1}, ) }, 3, 8388641, ... 304, {status=0x0, info=1}, ) == 0x0 01501 432 NtQueryVolumeInformationFile (304, 1242776, 24, Size, ... {status=0x0, info=24}, ) == 0x0 01502 432 NtClose (304, ... ) == 0x0 01503 432 NtOpenFile (0x100001, {24, 0, 0x40, 0, 0, (0x100001, {24, 0, 0x40, 0, 0, "\??\C:\"}, 3, 8388641, ... 304, {status=0x0, info=1}, ) }, 3, 8388641, ... 304, {status=0x0, info=1}, ) == 0x0 01504 432 NtQueryVolumeInformationFile (304, 1242800, 24, Size, ... {status=0x0, info=24}, ) == 0x0 01505 432 NtClose (304, ... ) == 0x0 01506 432 NtQueryAttributesFile ({24, 0, 0x40, 0, 0, ({24, 0, 0x40, 0, 0, "\??\C:\Documents and Settings\SRI-user\Local Settings\History\History.IE5\"}, 1243128, ... ) }, 1243128, ... ) == 0x0 01507 432 NtOpenFile (0x100100, {24, 0, 0x40, 0, 0, (0x100100, {24, 0, 0x40, 0, 0, "\??\C:\Documents and Settings\SRI-user\Local Settings\History\History.IE5\"}, 7, 2113568, ... 304, {status=0x0, info=1}, ) }, 7, 2113568, ... 304, {status=0x0, info=1}, ) == 0x0 01508 432 NtSetInformationFile (304, 1243104, 40, Basic, ... {status=0x0, info=0}, ) == 0x0 01509 432 NtClose (304, ... ) == 0x0 01510 432 NtCreateFile (0xc0100080, {24, 0, 0x40, 1353424, 1243120, (0xc0100080, {24, 0, 0x40, 1353424, 1243120, "\??\C:\Documents and Settings\SRI-user\Local Settings\History\History.IE5\index.dat"}, 0x0, 0, 3, 3, 2144, 0, 0, ... 304, {status=0x0, info=1}, ) }, 0x0, 0, 3, 3, 2144, 0, 0, ... 304, {status=0x0, info=1}, ) == 0x0 01511 432 NtSetInformationFile (304, 1243172, 40, Basic, ... {status=0x0, info=0}, ) == 0x0 01512 432 NtQueryInformationFile (304, 1243172, 24, Standard, ... {status=0x0, info=24}, ) == 0x0 01513 432 NtClose (304, ... ) == 0x0 01514 432 NtCreateFile (0xc0100080, {24, 0, 0x40, 1353424, 1243104, (0xc0100080, {24, 0, 0x40, 1353424, 1243104, "\??\C:\Documents and Settings\SRI-user\Local Settings\History\History.IE5\index.dat"}, 0x0, 0, 3, 3, 2144, 0, 0, ... 304, {status=0x0, info=1}, ) }, 0x0, 0, 3, 3, 2144, 0, 0, ... 304, {status=0x0, info=1}, ) == 0x0 01515 432 NtOpenSection (0x2, {24, 56, 0x0, 0, 0, (0x2, {24, 56, 0x0, 0, 0, "C:_Documents and Settings_SRI-user_Local Settings_History_History.IE5_index.dat_32768"}, ... 308, ) }, ... 308, ) == 0x0 01516 432 NtMapViewOfSection (308, -1, (0x0), 0, 0, {0, 0}, 0, 1, 0, 4, ... (0x2440000), {0, 0}, 32768, ) == 0x0 01517 432 NtReleaseMutant (292, ... 0x0, ) == 0x0 01518 432 NtQueryAttributesFile ({24, 0, 0x40, 0, 0, ({24, 0, 0x40, 0, 0, "\??\C:\Documents and Settings\SRI-user\Local Settings\Temporary Internet Files\Content.IE5\"}, 1243184, ... ) }, 1243184, ... ) == 0x0 01519 432 NtOpenFile (0x100100, {24, 0, 0x40, 0, 0, (0x100100, {24, 0, 0x40, 0, 0, "\??\C:\Documents and Settings\SRI-user\Local Settings\Temporary Internet Files\Content.IE5\"}, 7, 2113568, ... 312, {status=0x0, info=1}, ) }, 7, 2113568, ... 312, {status=0x0, info=1}, ) == 0x0 01520 432 NtSetInformationFile (312, 1243160, 40, Basic, ... {status=0x0, info=0}, ) == 0x0 01521 432 NtClose (312, ... ) == 0x0 01522 432 NtQueryAttributesFile ({24, 0, 0x40, 0, 0, ({24, 0, 0x40, 0, 0, "\??\C:\Documents and Settings\SRI-user\Local Settings\Temporary Internet Files\Content.IE5\desktop.ini"}, 1243184, ... ) }, 1243184, ... ) == 0x0 01523 432 NtQueryAttributesFile ({24, 0, 0x40, 0, 0, ({24, 0, 0x40, 0, 0, "\??\C:\Documents and Settings\SRI-user\Local Settings\History\History.IE5\"}, 1243184, ... ) }, 1243184, ... ) == 0x0 01524 432 NtOpenFile (0x100100, {24, 0, 0x40, 0, 0, (0x100100, {24, 0, 0x40, 0, 0, "\??\C:\Documents and Settings\SRI-user\Local Settings\History\History.IE5\"}, 7, 2113568, ... 312, {status=0x0, info=1}, ) }, 7, 2113568, ... 312, {status=0x0, info=1}, ) == 0x0 01525 432 NtSetInformationFile (312, 1243160, 40, Basic, ... {status=0x0, info=0}, ) == 0x0 01526 432 NtClose (312, ... ) == 0x0 01527 432 NtQueryAttributesFile ({24, 0, 0x40, 0, 0, ({24, 0, 0x40, 0, 0, "\??\C:\Documents and Settings\SRI-user\Local Settings\History\History.IE5\desktop.ini"}, 1243184, ... ) }, 1243184, ... ) == 0x0 01528 432 NtWaitForSingleObject (280, 0, 0x0, ... ) == 0x0 01529 432 NtQueryInformationFile (276, 1241568, 24, Standard, ... {status=0x0, info=24}, ) == 0x0 01530 432 NtReleaseMutant (280, ... 0x0, ) == 0x0 01531 432 NtOpenKey (0xf, {24, 52, 0x40, 0, 0, (0xf, {24, 52, 0x40, 0, 0, "Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache"}, ... 312, ) }, ... 312, ) == 0x0 01532 432 NtOpenKey (0xf, {24, 312, 0x40, 0, 0, (0xf, {24, 312, 0x40, 0, 0, "Extensible Cache"}, ... 316, ) }, ... 316, ) == 0x0 01533 432 NtClose (312, ... ) == 0x0 01534 432 NtWaitForSingleObject (272, 0, {-600000000, -1}, ... ) == 0x0 01535 432 NtEnumerateKey (316, 0, Basic, 288, ... {LastWrite={0x89210de2,0x1c79d95}, TitleIdx=0, Name= (316, 0, Basic, 288, ... {LastWrite={0x89210de2,0x1c79d95}, TitleIdx=0, Name="MSHist012007051420070521"}, 64, ) }, 64, ) == 0x0 01536 432 NtOpenKey (0xf, {24, 316, 0x40, 0, 0, (0xf, {24, 316, 0x40, 0, 0, "MSHist012007051420070521"}, ... 312, ) }, ... 312, ) == 0x0 01537 432 NtQueryValueKey (312, (312, "CacheRepair", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (312, "CacheRepair", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) }, 16, ) == 0x0 01538 432 NtQueryValueKey (312, (312, "CachePath", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW 01539 432 NtQueryValueKey (312, (312, "CachePath", Partial, 162, ... TitleIdx=0, Type=2, Data="%\0U\0S\0E\0R\0P\0R\0O\0F\0I\0L\0E\0%\0\\0L\0o\0c\0a\0l\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0H\0i\0s\0t\0o\0r\0y\0\\0H\0i\0s\0t\0o\0r\0y\0.\0I\0E\05\0\\0M\0S\0H\0i\0s\0t\00\01\02\00\00\07\00\05\01\04\02\00\00\07\00\05\02\01\0\\0\0\0"}, 162, ) , Partial, 162, ... TitleIdx=0, Type=2, Data= (312, "CachePath", Partial, 162, ... TitleIdx=0, Type=2, Data="%\0U\0S\0E\0R\0P\0R\0O\0F\0I\0L\0E\0%\0\\0L\0o\0c\0a\0l\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0H\0i\0s\0t\0o\0r\0y\0\\0H\0i\0s\0t\0o\0r\0y\0.\0I\0E\05\0\\0M\0S\0H\0i\0s\0t\00\01\02\00\00\07\00\05\01\04\02\00\00\07\00\05\02\01\0\\0\0\0"}, 162, ) }, 162, ) == 0x0 01540 432 NtQueryValueKey (312, (312, "CachePath", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW 01541 432 NtQueryValueKey (312, (312, "CachePath", Partial, 162, ... TitleIdx=0, Type=2, Data="%\0U\0S\0E\0R\0P\0R\0O\0F\0I\0L\0E\0%\0\\0L\0o\0c\0a\0l\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0H\0i\0s\0t\0o\0r\0y\0\\0H\0i\0s\0t\0o\0r\0y\0.\0I\0E\05\0\\0M\0S\0H\0i\0s\0t\00\01\02\00\00\07\00\05\01\04\02\00\00\07\00\05\02\01\0\\0\0\0"}, 162, ) , Partial, 162, ... TitleIdx=0, Type=2, Data= (312, "CachePath", Partial, 162, ... TitleIdx=0, Type=2, Data="%\0U\0S\0E\0R\0P\0R\0O\0F\0I\0L\0E\0%\0\\0L\0o\0c\0a\0l\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0H\0i\0s\0t\0o\0r\0y\0\\0H\0i\0s\0t\0o\0r\0y\0.\0I\0E\05\0\\0M\0S\0H\0i\0s\0t\00\01\02\00\00\07\00\05\01\04\02\00\00\07\00\05\02\01\0\\0\0\0"}, 162, ) }, 162, ) == 0x0 01542 432 NtQueryValueKey (312, (312, "CachePrefix", Partial, 144, ... TitleIdx=0, Type=1, Data=":\02\00\00\07\00\05\01\04\02\00\00\07\00\05\02\01\0:\0 \0\0\0"}, 52, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (312, "CachePrefix", Partial, 144, ... TitleIdx=0, Type=1, Data=":\02\00\00\07\00\05\01\04\02\00\00\07\00\05\02\01\0:\0 \0\0\0"}, 52, ) }, 52, ) == 0x0 01543 432 NtQueryValueKey (312, (312, "CachePrefix", Partial, 144, ... TitleIdx=0, Type=1, Data=":\02\00\00\07\00\05\01\04\02\00\00\07\00\05\02\01\0:\0 \0\0\0"}, 52, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (312, "CachePrefix", Partial, 144, ... TitleIdx=0, Type=1, Data=":\02\00\00\07\00\05\01\04\02\00\00\07\00\05\02\01\0:\0 \0\0\0"}, 52, ) }, 52, ) == 0x0 01544 432 NtQueryValueKey (312, (312, "CacheLimit", Partial, 144, ... TitleIdx=0, Type=4, Data="\0 \0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (312, "CacheLimit", Partial, 144, ... TitleIdx=0, Type=4, Data="\0 \0\0"}, 16, ) }, 16, ) == 0x0 01545 432 NtQueryValueKey (312, (312, "CacheOptions", Partial, 144, ... TitleIdx=0, Type=4, Data="\13\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (312, "CacheOptions", Partial, 144, ... TitleIdx=0, Type=4, Data="\13\0\0\0"}, 16, ) }, 16, ) == 0x0 01546 432 NtClose (312, ... ) == 0x0 01547 432 NtEnumerateKey (316, 1, Basic, 288, ... {LastWrite={0xfe4bb184,0x1c7a3a9}, TitleIdx=0, Name= (316, 1, Basic, 288, ... {LastWrite={0xfe4bb184,0x1c7a3a9}, TitleIdx=0, Name="MSHist012007052120070528"}, 64, ) }, 64, ) == 0x0 01548 432 NtOpenKey (0xf, {24, 316, 0x40, 0, 0, (0xf, {24, 316, 0x40, 0, 0, "MSHist012007052120070528"}, ... 312, ) }, ... 312, ) == 0x0 01549 432 NtQueryValueKey (312, (312, "CacheRepair", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (312, "CacheRepair", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) }, 16, ) == 0x0 01550 432 NtQueryValueKey (312, (312, "CachePath", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW 01551 432 NtQueryValueKey (312, (312, "CachePath", Partial, 162, ... TitleIdx=0, Type=2, Data="%\0U\0S\0E\0R\0P\0R\0O\0F\0I\0L\0E\0%\0\\0L\0o\0c\0a\0l\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0H\0i\0s\0t\0o\0r\0y\0\\0H\0i\0s\0t\0o\0r\0y\0.\0I\0E\05\0\\0M\0S\0H\0i\0s\0t\00\01\02\00\00\07\00\05\02\01\02\00\00\07\00\05\02\08\0\\0\0\0"}, 162, ) , Partial, 162, ... TitleIdx=0, Type=2, Data= (312, "CachePath", Partial, 162, ... TitleIdx=0, Type=2, Data="%\0U\0S\0E\0R\0P\0R\0O\0F\0I\0L\0E\0%\0\\0L\0o\0c\0a\0l\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0H\0i\0s\0t\0o\0r\0y\0\\0H\0i\0s\0t\0o\0r\0y\0.\0I\0E\05\0\\0M\0S\0H\0i\0s\0t\00\01\02\00\00\07\00\05\02\01\02\00\00\07\00\05\02\08\0\\0\0\0"}, 162, ) }, 162, ) == 0x0 01552 432 NtQueryValueKey (312, (312, "CachePath", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW 01553 432 NtQueryValueKey (312, (312, "CachePath", Partial, 162, ... TitleIdx=0, Type=2, Data="%\0U\0S\0E\0R\0P\0R\0O\0F\0I\0L\0E\0%\0\\0L\0o\0c\0a\0l\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0H\0i\0s\0t\0o\0r\0y\0\\0H\0i\0s\0t\0o\0r\0y\0.\0I\0E\05\0\\0M\0S\0H\0i\0s\0t\00\01\02\00\00\07\00\05\02\01\02\00\00\07\00\05\02\08\0\\0\0\0"}, 162, ) , Partial, 162, ... TitleIdx=0, Type=2, Data= (312, "CachePath", Partial, 162, ... TitleIdx=0, Type=2, Data="%\0U\0S\0E\0R\0P\0R\0O\0F\0I\0L\0E\0%\0\\0L\0o\0c\0a\0l\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0H\0i\0s\0t\0o\0r\0y\0\\0H\0i\0s\0t\0o\0r\0y\0.\0I\0E\05\0\\0M\0S\0H\0i\0s\0t\00\01\02\00\00\07\00\05\02\01\02\00\00\07\00\05\02\08\0\\0\0\0"}, 162, ) }, 162, ) == 0x0 01554 432 NtQueryValueKey (312, (312, "CachePrefix", Partial, 144, ... TitleIdx=0, Type=1, Data=":\02\00\00\07\00\05\02\01\02\00\00\07\00\05\02\08\0:\0 \0\0\0"}, 52, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (312, "CachePrefix", Partial, 144, ... TitleIdx=0, Type=1, Data=":\02\00\00\07\00\05\02\01\02\00\00\07\00\05\02\08\0:\0 \0\0\0"}, 52, ) }, 52, ) == 0x0 01555 432 NtQueryValueKey (312, (312, "CachePrefix", Partial, 144, ... TitleIdx=0, Type=1, Data=":\02\00\00\07\00\05\02\01\02\00\00\07\00\05\02\08\0:\0 \0\0\0"}, 52, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (312, "CachePrefix", Partial, 144, ... TitleIdx=0, Type=1, Data=":\02\00\00\07\00\05\02\01\02\00\00\07\00\05\02\08\0:\0 \0\0\0"}, 52, ) }, 52, ) == 0x0 01556 432 NtQueryValueKey (312, (312, "CacheLimit", Partial, 144, ... TitleIdx=0, Type=4, Data="\0 \0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (312, "CacheLimit", Partial, 144, ... TitleIdx=0, Type=4, Data="\0 \0\0"}, 16, ) }, 16, ) == 0x0 01557 432 NtQueryValueKey (312, (312, "CacheOptions", Partial, 144, ... TitleIdx=0, Type=4, Data="\13\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (312, "CacheOptions", Partial, 144, ... TitleIdx=0, Type=4, Data="\13\0\0\0"}, 16, ) }, 16, ) == 0x0 01558 432 NtClose (312, ... ) == 0x0 01559 432 NtEnumerateKey (316, 2, Basic, 288, ... {LastWrite={0xfe4e13de,0x1c7a3a9}, TitleIdx=0, Name= (316, 2, Basic, 288, ... {LastWrite={0xfe4e13de,0x1c7a3a9}, TitleIdx=0, Name="MSHist012007053120070601"}, 64, ) }, 64, ) == 0x0 01560 432 NtOpenKey (0xf, {24, 316, 0x40, 0, 0, (0xf, {24, 316, 0x40, 0, 0, "MSHist012007053120070601"}, ... 312, ) }, ... 312, ) == 0x0 01561 432 NtQueryValueKey (312, (312, "CacheRepair", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (312, "CacheRepair", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) }, 16, ) == 0x0 01562 432 NtQueryValueKey (312, (312, "CachePath", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW 01563 432 NtQueryValueKey (312, (312, "CachePath", Partial, 162, ... TitleIdx=0, Type=2, Data="%\0U\0S\0E\0R\0P\0R\0O\0F\0I\0L\0E\0%\0\\0L\0o\0c\0a\0l\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0H\0i\0s\0t\0o\0r\0y\0\\0H\0i\0s\0t\0o\0r\0y\0.\0I\0E\05\0\\0M\0S\0H\0i\0s\0t\00\01\02\00\00\07\00\05\03\01\02\00\00\07\00\06\00\01\0\\0\0\0"}, 162, ) , Partial, 162, ... TitleIdx=0, Type=2, Data= (312, "CachePath", Partial, 162, ... TitleIdx=0, Type=2, Data="%\0U\0S\0E\0R\0P\0R\0O\0F\0I\0L\0E\0%\0\\0L\0o\0c\0a\0l\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0H\0i\0s\0t\0o\0r\0y\0\\0H\0i\0s\0t\0o\0r\0y\0.\0I\0E\05\0\\0M\0S\0H\0i\0s\0t\00\01\02\00\00\07\00\05\03\01\02\00\00\07\00\06\00\01\0\\0\0\0"}, 162, ) }, 162, ) == 0x0 01564 432 NtQueryValueKey (312, (312, "CachePath", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW 01565 432 NtQueryValueKey (312, (312, "CachePath", Partial, 162, ... TitleIdx=0, Type=2, Data="%\0U\0S\0E\0R\0P\0R\0O\0F\0I\0L\0E\0%\0\\0L\0o\0c\0a\0l\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0H\0i\0s\0t\0o\0r\0y\0\\0H\0i\0s\0t\0o\0r\0y\0.\0I\0E\05\0\\0M\0S\0H\0i\0s\0t\00\01\02\00\00\07\00\05\03\01\02\00\00\07\00\06\00\01\0\\0\0\0"}, 162, ) , Partial, 162, ... TitleIdx=0, Type=2, Data= (312, "CachePath", Partial, 162, ... TitleIdx=0, Type=2, Data="%\0U\0S\0E\0R\0P\0R\0O\0F\0I\0L\0E\0%\0\\0L\0o\0c\0a\0l\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0H\0i\0s\0t\0o\0r\0y\0\\0H\0i\0s\0t\0o\0r\0y\0.\0I\0E\05\0\\0M\0S\0H\0i\0s\0t\00\01\02\00\00\07\00\05\03\01\02\00\00\07\00\06\00\01\0\\0\0\0"}, 162, ) }, 162, ) == 0x0 01566 432 NtQueryValueKey (312, (312, "CachePrefix", Partial, 144, ... TitleIdx=0, Type=1, Data=":\02\00\00\07\00\05\03\01\02\00\00\07\00\06\00\01\0:\0 \0\0\0"}, 52, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (312, "CachePrefix", Partial, 144, ... TitleIdx=0, Type=1, Data=":\02\00\00\07\00\05\03\01\02\00\00\07\00\06\00\01\0:\0 \0\0\0"}, 52, ) }, 52, ) == 0x0 01567 432 NtQueryValueKey (312, (312, "CachePrefix", Partial, 144, ... TitleIdx=0, Type=1, Data=":\02\00\00\07\00\05\03\01\02\00\00\07\00\06\00\01\0:\0 \0\0\0"}, 52, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (312, "CachePrefix", Partial, 144, ... TitleIdx=0, Type=1, Data=":\02\00\00\07\00\05\03\01\02\00\00\07\00\06\00\01\0:\0 \0\0\0"}, 52, ) }, 52, ) == 0x0 01568 432 NtQueryValueKey (312, (312, "CacheLimit", Partial, 144, ... TitleIdx=0, Type=4, Data="\0 \0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (312, "CacheLimit", Partial, 144, ... TitleIdx=0, Type=4, Data="\0 \0\0"}, 16, ) }, 16, ) == 0x0 01569 432 NtQueryValueKey (312, (312, "CacheOptions", Partial, 144, ... TitleIdx=0, Type=4, Data="\13\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (312, "CacheOptions", Partial, 144, ... TitleIdx=0, Type=4, Data="\13\0\0\0"}, 16, ) }, 16, ) == 0x0 01570 432 NtClose (312, ... ) == 0x0 01571 432 NtEnumerateKey (316, 3, Basic, 288, ... ) == STATUS_NO_MORE_ENTRIES 01572 432 NtReleaseMutant (272, ... 0x0, ) == 0x0 01573 432 NtClose (316, ... ) == 0x0 01574 432 NtWaitForSingleObject (280, 0, 0x0, ... ) == 0x0 01575 432 NtQueryInformationFile (276, 1243496, 24, Standard, ... {status=0x0, info=24}, ) == 0x0 01576 432 NtReleaseMutant (280, ... 0x0, ) == 0x0 01577 432 NtWaitForSingleObject (280, 0, 0x0, ... ) == 0x0 01578 432 NtQueryInformationFile (276, 1243568, 24, Standard, ... {status=0x0, info=24}, ) == 0x0 01579 432 NtReleaseMutant (280, ... 0x0, ) == 0x0 01580 432 NtOpenKey (0x1, {24, 52, 0x40, 0, 0, (0x1, {24, 52, 0x40, 0, 0, "SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 01581 432 NtOpenKey (0x1, {24, 52, 0x40, 0, 0, (0x1, {24, 52, 0x40, 0, 0, "SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 01582 432 NtOpenKey (0x1, {24, 52, 0x40, 0, 0, (0x1, {24, 52, 0x40, 0, 0, "SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 01583 432 NtOpenKey (0x1, {24, 52, 0x40, 0, 0, (0x1, {24, 52, 0x40, 0, 0, "SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 01584 432 NtOpenKey (0x1, {24, 52, 0x40, 0, 0, (0x1, {24, 52, 0x40, 0, 0, "SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 01585 432 NtOpenKey (0x1, {24, 48, 0x40, 0, 0, (0x1, {24, 48, 0x40, 0, 0, "SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings"}, ... 316, ) }, ... 316, ) == 0x0 01586 432 NtQueryValueKey (316, (316, "DisableWorkerThreadHibernation", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 01587 432 NtClose (316, ... ) == 0x0 01588 432 NtQueryValueKey (260, (260, "DisableWorkerThreadHibernation", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 01589 432 NtQueryValueKey (260, (260, "DisableReadRange", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 01590 432 NtQueryValueKey (260, (260, "SocketSendBufferLength", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 01591 432 NtQueryValueKey (260, (260, "SocketReceiveBufferLength", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 01592 432 NtQueryValueKey (260, (260, "KeepAliveTimeout", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 01593 432 NtQueryValueKey (260, (260, "MaxHttpRedirects", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 01594 432 NtQueryValueKey (260, (260, "MaxConnectionsPerServer", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 01595 432 NtQueryValueKey (260, (260, "MaxConnectionsPer1_0Server", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 01596 432 NtQueryValueKey (260, (260, "ServerInfoTimeout", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 01597 432 NtQueryValueKey (260, (260, "ReceiveTimeOut", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 01598 432 NtQueryValueKey (260, (260, "DisableNTLMPreAuth", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 01599 432 NtQueryValueKey (260, (260, "ScavengeCacheLowerBound", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 01600 432 NtOpenKey (0x1, {24, 52, 0x40, 0, 0, (0x1, {24, 52, 0x40, 0, 0, "SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache"}, ... 316, ) }, ... 316, ) == 0x0 01601 432 NtQueryValueKey (316, (316, "ScavengeCacheFileLifeTime", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 01602 432 NtClose (316, ... ) == 0x0 01603 432 NtQueryValueKey (260, (260, "HttpDefaultExpiryTimeSecs", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 01604 432 NtQueryValueKey (260, (260, "FtpDefaultExpiryTimeSecs", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 01605 432 NtQueryValueKey (260, (260, "GopherDefaultExpiryTimeSecs", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 01606 432 NtQueryValueKey (260, (260, "DisableCachingOfSSLPages", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 01607 432 NtQueryValueKey (260, (260, "PerUserCookies", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 01608 432 NtQueryValueKey (260, (260, "LeashLegacyCookies", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 01609 432 NtQueryValueKey (260, (260, "DisableNT4RasCheck", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 01610 432 NtQueryValueKey (260, (260, "DialupUseLanSettings", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 01611 432 NtQueryValueKey (260, (260, "SendExtraCRLF", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 01612 432 NtOpenKey (0x1, {24, 48, 0x40, 0, 0, (0x1, {24, 48, 0x40, 0, 0, "SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings"}, ... 316, ) }, ... 316, ) == 0x0 01613 432 NtQueryValueKey (316, (316, "DontUseDNSLoadBalancing", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 01614 432 NtClose (316, ... ) == 0x0 01615 432 NtQueryValueKey (260, (260, "DontUseDNSLoadBalancing", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 01616 432 NtQueryValueKey (260, (260, "NonBlockingClient32", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 01617 432 NtQueryValueKey (260, (260, "MimeExclusionListForCache", Partial, 144, ... TitleIdx=0, Type=1, Data="m\0u\0l\0t\0i\0p\0a\0r\0t\0/\0m\0i\0x\0e\0d\0 \0m\0u\0l\0t\0i\0p\0a\0r\0t\0/\0x\0-\0m\0i\0x\0e\0d\0-\0r\0e\0p\0l\0a\0c\0e\0 \0m\0u\0l\0t\0i\0p\0a\0r\0t\0/\0x\0-\0b\0y\0t\0e\0r\0a\0n\0g\0e\0s\0 \0\0\0"}, 144, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (260, "MimeExclusionListForCache", Partial, 144, ... TitleIdx=0, Type=1, Data="m\0u\0l\0t\0i\0p\0a\0r\0t\0/\0m\0i\0x\0e\0d\0 \0m\0u\0l\0t\0i\0p\0a\0r\0t\0/\0x\0-\0m\0i\0x\0e\0d\0-\0r\0e\0p\0l\0a\0c\0e\0 \0m\0u\0l\0t\0i\0p\0a\0r\0t\0/\0x\0-\0b\0y\0t\0e\0r\0a\0n\0g\0e\0s\0 \0\0\0"}, 144, ) }, 144, ) == 0x0 01618 432 NtQueryValueKey (260, (260, "MimeExclusionListForCache", Partial, 144, ... TitleIdx=0, Type=1, Data="m\0u\0l\0t\0i\0p\0a\0r\0t\0/\0m\0i\0x\0e\0d\0 \0m\0u\0l\0t\0i\0p\0a\0r\0t\0/\0x\0-\0m\0i\0x\0e\0d\0-\0r\0e\0p\0l\0a\0c\0e\0 \0m\0u\0l\0t\0i\0p\0a\0r\0t\0/\0x\0-\0b\0y\0t\0e\0r\0a\0n\0g\0e\0s\0 \0\0\0"}, 144, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (260, "MimeExclusionListForCache", Partial, 144, ... TitleIdx=0, Type=1, Data="m\0u\0l\0t\0i\0p\0a\0r\0t\0/\0m\0i\0x\0e\0d\0 \0m\0u\0l\0t\0i\0p\0a\0r\0t\0/\0x\0-\0m\0i\0x\0e\0d\0-\0r\0e\0p\0l\0a\0c\0e\0 \0m\0u\0l\0t\0i\0p\0a\0r\0t\0/\0x\0-\0b\0y\0t\0e\0r\0a\0n\0g\0e\0s\0 \0\0\0"}, 144, ) }, 144, ) == 0x0 01619 432 NtQueryValueKey (260, (260, "MimeExclusionListForCache", Partial, 144, ... TitleIdx=0, Type=1, Data="m\0u\0l\0t\0i\0p\0a\0r\0t\0/\0m\0i\0x\0e\0d\0 \0m\0u\0l\0t\0i\0p\0a\0r\0t\0/\0x\0-\0m\0i\0x\0e\0d\0-\0r\0e\0p\0l\0a\0c\0e\0 \0m\0u\0l\0t\0i\0p\0a\0r\0t\0/\0x\0-\0b\0y\0t\0e\0r\0a\0n\0g\0e\0s\0 \0\0\0"}, 144, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (260, "MimeExclusionListForCache", Partial, 144, ... TitleIdx=0, Type=1, Data="m\0u\0l\0t\0i\0p\0a\0r\0t\0/\0m\0i\0x\0e\0d\0 \0m\0u\0l\0t\0i\0p\0a\0r\0t\0/\0x\0-\0m\0i\0x\0e\0d\0-\0r\0e\0p\0l\0a\0c\0e\0 \0m\0u\0l\0t\0i\0p\0a\0r\0t\0/\0x\0-\0b\0y\0t\0e\0r\0a\0n\0g\0e\0s\0 \0\0\0"}, 144, ) }, 144, ) == 0x0 01620 432 NtQueryValueKey (260, (260, "MimeExclusionListForCache", Partial, 144, ... TitleIdx=0, Type=1, Data="m\0u\0l\0t\0i\0p\0a\0r\0t\0/\0m\0i\0x\0e\0d\0 \0m\0u\0l\0t\0i\0p\0a\0r\0t\0/\0x\0-\0m\0i\0x\0e\0d\0-\0r\0e\0p\0l\0a\0c\0e\0 \0m\0u\0l\0t\0i\0p\0a\0r\0t\0/\0x\0-\0b\0y\0t\0e\0r\0a\0n\0g\0e\0s\0 \0\0\0"}, 144, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (260, "MimeExclusionListForCache", Partial, 144, ... TitleIdx=0, Type=1, Data="m\0u\0l\0t\0i\0p\0a\0r\0t\0/\0m\0i\0x\0e\0d\0 \0m\0u\0l\0t\0i\0p\0a\0r\0t\0/\0x\0-\0m\0i\0x\0e\0d\0-\0r\0e\0p\0l\0a\0c\0e\0 \0m\0u\0l\0t\0i\0p\0a\0r\0t\0/\0x\0-\0b\0y\0t\0e\0r\0a\0n\0g\0e\0s\0 \0\0\0"}, 144, ) }, 144, ) == 0x0 01621 432 NtQueryValueKey (260, (260, "HeaderExclusionListForCache", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 01622 432 NtQueryValueKey (260, (260, "DnsCacheEnabled", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 01623 432 NtQueryValueKey (260, (260, "DnsCacheEntries", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 01624 432 NtQueryValueKey (260, (260, "DnsCacheTimeout", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 01625 432 NtQueryValueKey (260, (260, "WarnOnPost", Partial, 144, ... TitleIdx=0, Type=3, Data="\1\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=3, Data= (260, "WarnOnPost", Partial, 144, ... TitleIdx=0, Type=3, Data="\1\0\0\0"}, 16, ) }, 16, ) == 0x0 01626 432 NtQueryValueKey (260, (260, "WarnAlwaysOnPost", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 01627 432 NtQueryValueKey (260, (260, "WarnOnZoneCrossing", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 01628 432 NtQueryValueKey (260, (260, "WarnOnBadCertSending", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 01629 432 NtQueryValueKey (260, (260, "WarnOnBadCertRecving", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 01630 432 NtQueryValueKey (260, (260, "WarnOnPostRedirect", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 01631 432 NtQueryValueKey (260, (260, "AlwaysDrainOnRedirect", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 01632 432 NtOpenMutant (0x100000, {24, 56, 0x0, 0, 0, (0x100000, {24, 56, 0x0, 0, 0, "WininetStartupMutex"}, ... 316, ) }, ... 316, ) == 0x0 01633 432 NtCreateEvent (0x1f0003, 0x0, 1, 1, ... 312, ) == 0x0 01634 432 NtQueryValueKey (260, (260, "GlobalUserOffline", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 01635 432 NtWaitForSingleObject (280, 0, 0x0, ... ) == 0x0 01636 432 NtQueryInformationFile (276, 1243544, 24, Standard, ... {status=0x0, info=24}, ) == 0x0 01637 432 NtReleaseMutant (280, ... 0x0, ) == 0x0 01638 432 NtOpenMutant (0x100000, {24, 56, 0x0, 0, 0, (0x100000, {24, 56, 0x0, 0, 0, "WininetConnectionMutex"}, ... 324, ) }, ... 324, ) == 0x0 01639 432 NtCreateMutant (0x1f0001, 0x0, 0, ... 328, ) == 0x0 01640 432 NtOpenMutant (0x100000, {24, 56, 0x0, 0, 0, (0x100000, {24, 56, 0x0, 0, 0, "WininetProxyRegistryMutex"}, ... 332, ) }, ... 332, ) == 0x0 01641 432 NtQueryValueKey (260, (260, "EnableAutodial", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (260, "EnableAutodial", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) }, 16, ) == 0x0 01642 432 NtQueryValueKey (260, (260, "NoNetAutodial", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (260, "NoNetAutodial", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) }, 16, ) == 0x0 01643 432 NtOpenKey (0x1, {24, 48, 0x40, 0, 0, (0x1, {24, 48, 0x40, 0, 0, "SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings"}, ... 336, ) }, ... 336, ) == 0x0 01644 432 NtQueryValueKey (336, (336, "UrlEncoding", Partial, 144, ... TitleIdx=0, Type=1, Data="0\0x\00\00\00\00\00\00\00\00\0\0\0"}, 34, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (336, "UrlEncoding", Partial, 144, ... TitleIdx=0, Type=1, Data="0\0x\00\00\00\00\00\00\00\00\0\0\0"}, 34, ) }, 34, ) == 0x0 01645 432 NtQueryValueKey (336, (336, "UrlEncoding", Partial, 144, ... TitleIdx=0, Type=1, Data="0\0x\00\00\00\00\00\00\00\00\0\0\0"}, 34, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (336, "UrlEncoding", Partial, 144, ... TitleIdx=0, Type=1, Data="0\0x\00\00\00\00\00\00\00\00\0\0\0"}, 34, ) }, 34, ) == 0x0 01646 432 NtClose (336, ... ) == 0x0 01647 432 NtAllocateVirtualMemory (-1, 1359872, 0, 4096, 4096, 4, ... 1359872, 4096, ) == 0x0 01648 432 NtCreateEvent (0x1f0003, 0x0, 1, 1, ... 336, ) == 0x0 01649 432 NtWaitForSingleObject (336, 0, 0x0, ... ) == 0x0 01650 432 NtClearEvent (336, ... ) == 0x0 01651 432 NtSetEvent (336, ... 0x0, ) == 0x0 01652 432 NtOpenSection (0xe, {24, 8, 0x40, 0, 0, (0xe, {24, 8, 0x40, 0, 0, "wsock32.dll"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 01653 432 NtQueryAttributesFile ({24, 0, 0x40, 0, 0, ({24, 0, 0x40, 0, 0, "\??\u:\work\wsock32.dll"}, 1241476, ... ) }, 1241476, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 01654 432 NtQueryAttributesFile ({24, 12, 0x40, 0, 0, ({24, 12, 0x40, 0, 0, "wsock32.dll"}, 1241476, ... ) }, 1241476, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 01655 432 NtQueryAttributesFile ({24, 0, 0x40, 0, 0, ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\System32\wsock32.dll"}, 1241476, ... ) }, 1241476, ... ) == 0x0 01656 432 NtOpenFile (0x100020, {24, 0, 0x40, 0, 0, (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\System32\wsock32.dll"}, 5, 96, ... 340, {status=0x0, info=1}, ) }, 5, 96, ... 340, {status=0x0, info=1}, ) == 0x0 01657 432 NtCreateSection (0xf, 0x0, 0x0, 16, 16777216, 340, ... 344, ) == 0x0 01658 432 NtQuerySection (344, Image, 48, ... {section info, class 1, size 48}, 0x0, ) == 0x0 01659 432 NtClose (340, ... ) == 0x0 01660 432 NtMapViewOfSection (344, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x71ad0000), 0x0, 32768, ) == 0x0 01661 432 NtClose (344, ... ) == 0x0 01662 432 NtOpenKey (0x2000000, {24, 48, 0x40, 0, 0, (0x2000000, {24, 48, 0x40, 0, 0, "System\CurrentControlSet\Services\WinSock2\Parameters"}, ... 344, ) }, ... 344, ) == 0x0 01663 432 NtQueryValueKey (344, (344, "WinSock_Registry_Version", Partial, 144, ... TitleIdx=0, Type=1, Data="2\0.\00\0\0\0"}, 20, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (344, "WinSock_Registry_Version", Partial, 144, ... TitleIdx=0, Type=1, Data="2\0.\00\0\0\0"}, 20, ) }, 20, ) == 0x0 01664 432 NtQueryValueKey (344, (344, "WinSock_Registry_Version", Partial, 144, ... TitleIdx=0, Type=1, Data="2\0.\00\0\0\0"}, 20, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (344, "WinSock_Registry_Version", Partial, 144, ... TitleIdx=0, Type=1, Data="2\0.\00\0\0\0"}, 20, ) }, 20, ) == 0x0 01665 432 NtCreateEvent (0x1f0003, 0x0, 0, 0, ... 340, ) == 0x0 01666 432 NtOpenKey (0x2000000, {24, 344, 0x40, 0, 0, (0x2000000, {24, 344, 0x40, 0, 0, "Protocol_Catalog9"}, ... 348, ) }, ... 348, ) == 0x0 01667 432 NtQueryValueKey (348, (348, "Serial_Access_Num", Partial, 144, ... TitleIdx=0, Type=4, Data="\31\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (348, "Serial_Access_Num", Partial, 144, ... TitleIdx=0, Type=4, Data="\31\0\0\0"}, 16, ) }, 16, ) == 0x0 01668 432 NtNotifyChangeKey (348, 340, 0, 0, 2011390432, 1, 0, 0, 0, 1, ... ) == 0x103 01669 432 NtQueryValueKey (348, (348, "Serial_Access_Num", Partial, 144, ... TitleIdx=0, Type=4, Data="\31\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (348, "Serial_Access_Num", Partial, 144, ... TitleIdx=0, Type=4, Data="\31\0\0\0"}, 16, ) }, 16, ) == 0x0 01670 432 NtOpenKey (0x2000000, {24, 348, 0x40, 0, 0, (0x2000000, {24, 348, 0x40, 0, 0, "00000019"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 01671 432 NtQueryValueKey (348, (348, "Next_Catalog_Entry_ID", Partial, 144, ... TitleIdx=0, Type=4, Data="\376\3\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (348, "Next_Catalog_Entry_ID", Partial, 144, ... TitleIdx=0, Type=4, Data="\376\3\0\0"}, 16, ) }, 16, ) == 0x0 01672 432 NtQueryValueKey (348, (348, "Num_Catalog_Entries", Partial, 144, ... TitleIdx=0, Type=4, Data="\13\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (348, "Num_Catalog_Entries", Partial, 144, ... TitleIdx=0, Type=4, Data="\13\0\0\0"}, 16, ) }, 16, ) == 0x0 01673 432 NtOpenKey (0x2000000, {24, 348, 0x40, 0, 0, (0x2000000, {24, 348, 0x40, 0, 0, "Catalog_Entries"}, ... 352, ) }, ... 352, ) == 0x0 01674 432 NtOpenKey (0x20019, {24, 352, 0x40, 0, 0, (0x20019, {24, 352, 0x40, 0, 0, "000000000001"}, ... 356, ) }, ... 356, ) == 0x0 01675 432 NtQueryValueKey (356, (356, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW 01676 432 NtAllocateVirtualMemory (-1, 1363968, 0, 4096, 4096, 4, ... 1363968, 4096, ) == 0x0 01677 432 NtQueryValueKey (356, (356, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW 01678 432 NtQueryValueKey (356, (356, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0gram\FSLSP.DLL\0\00\0\0\0\10\0\2\0\10\0\4\1\10\0h\220\354\28\220\354\2\2\0\12\0\4\1\12\00\00\0\0\0\10\0\2\0\14\0\4\1\10\0\210\220\354\2X\220\354\2\2\0\16\0\4\1\12\00\00\0\0\0\10\0\2\0\20\0\4\1\10\0\250\220\354\2x\220\354\2\2\0\22\0\4\1\12\00\00\0\0\0\10\0\2\0\24\0\4\1\10\0\310\220\354\2\230\220\354\2\2\0\26\0\4\1\12\00\00\0\0\0\10\0\2\0\30\0\4\1\10\0\0\0\0\0\270\220\354\2\2\0\32\0\4\1\10\0H\0K\0R\0\0\0\3\0\34\0\4\1\10\0\360\222\354\2\0\0\0\0\0\221\354\2\16\0\0\0<\0\37\0\4\0\10\0X\3\10\0X\3\10\0\4\0\2\0f\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\10\0\0\0\240\32\17\347\213\253\317\21\214\243\0\200_H\241\222\351\3\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\2\0\0\0\20\0\0\0\20\0\0\0\1\0\0\0\6\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0T\0c\0p\0i\0p\0 \0[\0T\0C\0P\0/\0I\0P\0]\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\204\3\0\0\217\6\0\0\254\1\0\0\260\1\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0d\1\0\0\217\6\0\0\254\1\0\0\260\1\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\220\6\0\0\254\1\0\0\260\1\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0`\1\0\0T\370\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\330\312\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\00\02\0\220\6\0\0\254\1\0\0\260\1\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0d\1\0\0\221\6\0\0\254\1\0\0\260\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0d\1\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\221\6\0\0\254\1\0\0\260\1\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\222\6\0\0\254\1\0\0\260\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0d\1\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) , Partial, 900, ... TitleIdx=0, Type=3, Data= (356, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0gram\FSLSP.DLL\0\00\0\0\0\10\0\2\0\10\0\4\1\10\0h\220\354\28\220\354\2\2\0\12\0\4\1\12\00\00\0\0\0\10\0\2\0\14\0\4\1\10\0\210\220\354\2X\220\354\2\2\0\16\0\4\1\12\00\00\0\0\0\10\0\2\0\20\0\4\1\10\0\250\220\354\2x\220\354\2\2\0\22\0\4\1\12\00\00\0\0\0\10\0\2\0\24\0\4\1\10\0\310\220\354\2\230\220\354\2\2\0\26\0\4\1\12\00\00\0\0\0\10\0\2\0\30\0\4\1\10\0\0\0\0\0\270\220\354\2\2\0\32\0\4\1\10\0H\0K\0R\0\0\0\3\0\34\0\4\1\10\0\360\222\354\2\0\0\0\0\0\221\354\2\16\0\0\0<\0\37\0\4\0\10\0X\3\10\0X\3\10\0\4\0\2\0f\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\10\0\0\0\240\32\17\347\213\253\317\21\214\243\0\200_H\241\222\351\3\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\2\0\0\0\20\0\0\0\20\0\0\0\1\0\0\0\6\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0T\0c\0p\0i\0p\0 \0[\0T\0C\0P\0/\0I\0P\0]\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\204\3\0\0\217\6\0\0\254\1\0\0\260\1\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0d\1\0\0\217\6\0\0\254\1\0\0\260\1\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\220\6\0\0\254\1\0\0\260\1\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0`\1\0\0T\370\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\330\312\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\00\02\0\220\6\0\0\254\1\0\0\260\1\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0d\1\0\0\221\6\0\0\254\1\0\0\260\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0d\1\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\221\6\0\0\254\1\0\0\260\1\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\222\6\0\0\254\1\0\0\260\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0d\1\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) \0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\221\6\0\0\254\1\0\0\260\1\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\222\6\0\0\254\1\0\0\260\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0d\1\0\0\0\0\0\0 (356, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0gram\FSLSP.DLL\0\00\0\0\0\10\0\2\0\10\0\4\1\10\0h\220\354\28\220\354\2\2\0\12\0\4\1\12\00\00\0\0\0\10\0\2\0\14\0\4\1\10\0\210\220\354\2X\220\354\2\2\0\16\0\4\1\12\00\00\0\0\0\10\0\2\0\20\0\4\1\10\0\250\220\354\2x\220\354\2\2\0\22\0\4\1\12\00\00\0\0\0\10\0\2\0\24\0\4\1\10\0\310\220\354\2\230\220\354\2\2\0\26\0\4\1\12\00\00\0\0\0\10\0\2\0\30\0\4\1\10\0\0\0\0\0\270\220\354\2\2\0\32\0\4\1\10\0H\0K\0R\0\0\0\3\0\34\0\4\1\10\0\360\222\354\2\0\0\0\0\0\221\354\2\16\0\0\0<\0\37\0\4\0\10\0X\3\10\0X\3\10\0\4\0\2\0f\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\10\0\0\0\240\32\17\347\213\253\317\21\214\243\0\200_H\241\222\351\3\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\2\0\0\0\20\0\0\0\20\0\0\0\1\0\0\0\6\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0T\0c\0p\0i\0p\0 \0[\0T\0C\0P\0/\0I\0P\0]\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\204\3\0\0\217\6\0\0\254\1\0\0\260\1\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0d\1\0\0\217\6\0\0\254\1\0\0\260\1\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\220\6\0\0\254\1\0\0\260\1\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0`\1\0\0T\370\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\330\312\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\00\02\0\220\6\0\0\254\1\0\0\260\1\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0d\1\0\0\221\6\0\0\254\1\0\0\260\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0d\1\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\221\6\0\0\254\1\0\0\260\1\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\222\6\0\0\254\1\0\0\260\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0d\1\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) }, 900, ) == 0x0 01679 432 NtClose (356, ... ) == 0x0 01680 432 NtOpenKey (0x20019, {24, 352, 0x40, 0, 0, (0x20019, {24, 352, 0x40, 0, 0, "000000000002"}, ... 356, ) }, ... 356, ) == 0x0 01681 432 NtQueryValueKey (356, (356, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW 01682 432 NtQueryValueKey (356, (356, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW 01683 432 NtQueryValueKey (356, (356, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0gram\FSLSP.DLL\0\00\0\0\0\10\0\2\0\10\0\4\1\10\0h\220\354\28\220\354\2\2\0\12\0\4\1\12\00\00\0\0\0\10\0\2\0\14\0\4\1\10\0\210\220\354\2X\220\354\2\2\0\16\0\4\1\12\00\00\0\0\0\10\0\2\0\20\0\4\1\10\0\250\220\354\2x\220\354\2\2\0\22\0\4\1\12\00\00\0\0\0\10\0\2\0\24\0\4\1\10\0\310\220\354\2\230\220\354\2\2\0\26\0\4\1\12\00\00\0\0\0\10\0\2\0\30\0\4\1\10\0\0\0\0\0\270\220\354\2\2\0\32\0\4\1\10\0H\0K\0R\0\0\0\3\0\34\0\4\1\10\0\360\222\354\2\0\0\0\0\0\221\354\2\16\0\0\0<\0\37\0\4\0\10\0X\3\10\0X\3\10\0\4\0\2\0\11\6\2\0\0\0\0\0\0\0\0\0\0\0\0\0\10\0\0\0\240\32\17\347\213\253\317\21\214\243\0\200_H\241\222\352\3\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\2\0\0\0\20\0\0\0\20\0\0\0\2\0\0\0\21\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\273\377\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0T\0c\0p\0i\0p\0 \0[\0U\0D\0P\0/\0I\0P\0]\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\204\3\0\0\224\6\0\0\254\1\0\0\260\1\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0d\1\0\0\224\6\0\0\254\1\0\0\260\1\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\225\6\0\0\254\1\0\0\260\1\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0`\1\0\0T\370\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\330\312\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\00\03\0\225\6\0\0\254\1\0\0\260\1\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0d\1\0\0\226\6\0\0\254\1\0\0\260\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0d\1\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\226\6\0\0\254\1\0\0\260\1\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\227\6\0\0\254\1\0\0\260\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0d\1\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) , Partial, 900, ... TitleIdx=0, Type=3, Data= (356, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0gram\FSLSP.DLL\0\00\0\0\0\10\0\2\0\10\0\4\1\10\0h\220\354\28\220\354\2\2\0\12\0\4\1\12\00\00\0\0\0\10\0\2\0\14\0\4\1\10\0\210\220\354\2X\220\354\2\2\0\16\0\4\1\12\00\00\0\0\0\10\0\2\0\20\0\4\1\10\0\250\220\354\2x\220\354\2\2\0\22\0\4\1\12\00\00\0\0\0\10\0\2\0\24\0\4\1\10\0\310\220\354\2\230\220\354\2\2\0\26\0\4\1\12\00\00\0\0\0\10\0\2\0\30\0\4\1\10\0\0\0\0\0\270\220\354\2\2\0\32\0\4\1\10\0H\0K\0R\0\0\0\3\0\34\0\4\1\10\0\360\222\354\2\0\0\0\0\0\221\354\2\16\0\0\0<\0\37\0\4\0\10\0X\3\10\0X\3\10\0\4\0\2\0\11\6\2\0\0\0\0\0\0\0\0\0\0\0\0\0\10\0\0\0\240\32\17\347\213\253\317\21\214\243\0\200_H\241\222\352\3\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\2\0\0\0\20\0\0\0\20\0\0\0\2\0\0\0\21\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\273\377\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0T\0c\0p\0i\0p\0 \0[\0U\0D\0P\0/\0I\0P\0]\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\204\3\0\0\224\6\0\0\254\1\0\0\260\1\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0d\1\0\0\224\6\0\0\254\1\0\0\260\1\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\225\6\0\0\254\1\0\0\260\1\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0`\1\0\0T\370\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\330\312\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\00\03\0\225\6\0\0\254\1\0\0\260\1\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0d\1\0\0\226\6\0\0\254\1\0\0\260\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0d\1\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\226\6\0\0\254\1\0\0\260\1\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\227\6\0\0\254\1\0\0\260\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0d\1\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) \0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\226\6\0\0\254\1\0\0\260\1\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\227\6\0\0\254\1\0\0\260\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0d\1\0\0\0\0\0\0 (356, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0gram\FSLSP.DLL\0\00\0\0\0\10\0\2\0\10\0\4\1\10\0h\220\354\28\220\354\2\2\0\12\0\4\1\12\00\00\0\0\0\10\0\2\0\14\0\4\1\10\0\210\220\354\2X\220\354\2\2\0\16\0\4\1\12\00\00\0\0\0\10\0\2\0\20\0\4\1\10\0\250\220\354\2x\220\354\2\2\0\22\0\4\1\12\00\00\0\0\0\10\0\2\0\24\0\4\1\10\0\310\220\354\2\230\220\354\2\2\0\26\0\4\1\12\00\00\0\0\0\10\0\2\0\30\0\4\1\10\0\0\0\0\0\270\220\354\2\2\0\32\0\4\1\10\0H\0K\0R\0\0\0\3\0\34\0\4\1\10\0\360\222\354\2\0\0\0\0\0\221\354\2\16\0\0\0<\0\37\0\4\0\10\0X\3\10\0X\3\10\0\4\0\2\0\11\6\2\0\0\0\0\0\0\0\0\0\0\0\0\0\10\0\0\0\240\32\17\347\213\253\317\21\214\243\0\200_H\241\222\352\3\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\2\0\0\0\20\0\0\0\20\0\0\0\2\0\0\0\21\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\273\377\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0T\0c\0p\0i\0p\0 \0[\0U\0D\0P\0/\0I\0P\0]\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\204\3\0\0\224\6\0\0\254\1\0\0\260\1\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0d\1\0\0\224\6\0\0\254\1\0\0\260\1\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\225\6\0\0\254\1\0\0\260\1\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0`\1\0\0T\370\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\330\312\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\00\03\0\225\6\0\0\254\1\0\0\260\1\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0d\1\0\0\226\6\0\0\254\1\0\0\260\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0d\1\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\226\6\0\0\254\1\0\0\260\1\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\227\6\0\0\254\1\0\0\260\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0d\1\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) }, 900, ) == 0x0 01684 432 NtClose (356, ... ) == 0x0 01685 432 NtOpenKey (0x20019, {24, 352, 0x40, 0, 0, (0x20019, {24, 352, 0x40, 0, 0, "000000000003"}, ... 356, ) }, ... 356, ) == 0x0 01686 432 NtQueryValueKey (356, (356, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW 01687 432 NtQueryValueKey (356, (356, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW 01688 432 NtQueryValueKey (356, (356, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0gram\FSLSP.DLL\0\00\0\0\0\10\0\2\0\10\0\4\1\10\0h\220\354\28\220\354\2\2\0\12\0\4\1\12\00\00\0\0\0\10\0\2\0\14\0\4\1\10\0\210\220\354\2X\220\354\2\2\0\16\0\4\1\12\00\00\0\0\0\10\0\2\0\20\0\4\1\10\0\250\220\354\2x\220\354\2\2\0\22\0\4\1\12\00\00\0\0\0\10\0\2\0\24\0\4\1\10\0\310\220\354\2\230\220\354\2\2\0\26\0\4\1\12\00\00\0\0\0\10\0\2\0\30\0\4\1\10\0\0\0\0\0\270\220\354\2\2\0\32\0\4\1\10\0H\0K\0R\0\0\0\3\0\34\0\4\1\10\0\360\222\354\2\0\0\0\0\0\221\354\2\16\0\0\0<\0\37\0\4\0\10\0X\3\10\0X\3\10\0\4\0\2\0\11\6\2\0\0\0\0\0\0\0\0\0\0\0\0\0\14\0\0\0\240\32\17\347\213\253\317\21\214\243\0\200_H\241\222\353\3\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\2\0\0\0\20\0\0\0\20\0\0\0\3\0\0\0\0\0\0\0\377\0\0\0\0\0\0\0\0\0\0\0\273\377\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0T\0c\0p\0i\0p\0 \0[\0R\0A\0W\0/\0I\0P\0]\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\204\3\0\0\231\6\0\0\254\1\0\0\260\1\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0d\1\0\0\231\6\0\0\254\1\0\0\260\1\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\232\6\0\0\254\1\0\0\260\1\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0`\1\0\0T\370\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\330\312\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\00\04\0\232\6\0\0\254\1\0\0\260\1\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0d\1\0\0\233\6\0\0\254\1\0\0\260\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0d\1\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\233\6\0\0\254\1\0\0\260\1\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\234\6\0\0\254\1\0\0\260\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0d\1\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) , Partial, 900, ... TitleIdx=0, Type=3, Data= (356, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0gram\FSLSP.DLL\0\00\0\0\0\10\0\2\0\10\0\4\1\10\0h\220\354\28\220\354\2\2\0\12\0\4\1\12\00\00\0\0\0\10\0\2\0\14\0\4\1\10\0\210\220\354\2X\220\354\2\2\0\16\0\4\1\12\00\00\0\0\0\10\0\2\0\20\0\4\1\10\0\250\220\354\2x\220\354\2\2\0\22\0\4\1\12\00\00\0\0\0\10\0\2\0\24\0\4\1\10\0\310\220\354\2\230\220\354\2\2\0\26\0\4\1\12\00\00\0\0\0\10\0\2\0\30\0\4\1\10\0\0\0\0\0\270\220\354\2\2\0\32\0\4\1\10\0H\0K\0R\0\0\0\3\0\34\0\4\1\10\0\360\222\354\2\0\0\0\0\0\221\354\2\16\0\0\0<\0\37\0\4\0\10\0X\3\10\0X\3\10\0\4\0\2\0\11\6\2\0\0\0\0\0\0\0\0\0\0\0\0\0\14\0\0\0\240\32\17\347\213\253\317\21\214\243\0\200_H\241\222\353\3\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\2\0\0\0\20\0\0\0\20\0\0\0\3\0\0\0\0\0\0\0\377\0\0\0\0\0\0\0\0\0\0\0\273\377\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0T\0c\0p\0i\0p\0 \0[\0R\0A\0W\0/\0I\0P\0]\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\204\3\0\0\231\6\0\0\254\1\0\0\260\1\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0d\1\0\0\231\6\0\0\254\1\0\0\260\1\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\232\6\0\0\254\1\0\0\260\1\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0`\1\0\0T\370\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\330\312\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\00\04\0\232\6\0\0\254\1\0\0\260\1\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0d\1\0\0\233\6\0\0\254\1\0\0\260\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0d\1\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\233\6\0\0\254\1\0\0\260\1\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\234\6\0\0\254\1\0\0\260\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0d\1\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) \0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\233\6\0\0\254\1\0\0\260\1\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\234\6\0\0\254\1\0\0\260\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0d\1\0\0\0\0\0\0 (356, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0gram\FSLSP.DLL\0\00\0\0\0\10\0\2\0\10\0\4\1\10\0h\220\354\28\220\354\2\2\0\12\0\4\1\12\00\00\0\0\0\10\0\2\0\14\0\4\1\10\0\210\220\354\2X\220\354\2\2\0\16\0\4\1\12\00\00\0\0\0\10\0\2\0\20\0\4\1\10\0\250\220\354\2x\220\354\2\2\0\22\0\4\1\12\00\00\0\0\0\10\0\2\0\24\0\4\1\10\0\310\220\354\2\230\220\354\2\2\0\26\0\4\1\12\00\00\0\0\0\10\0\2\0\30\0\4\1\10\0\0\0\0\0\270\220\354\2\2\0\32\0\4\1\10\0H\0K\0R\0\0\0\3\0\34\0\4\1\10\0\360\222\354\2\0\0\0\0\0\221\354\2\16\0\0\0<\0\37\0\4\0\10\0X\3\10\0X\3\10\0\4\0\2\0\11\6\2\0\0\0\0\0\0\0\0\0\0\0\0\0\14\0\0\0\240\32\17\347\213\253\317\21\214\243\0\200_H\241\222\353\3\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\2\0\0\0\20\0\0\0\20\0\0\0\3\0\0\0\0\0\0\0\377\0\0\0\0\0\0\0\0\0\0\0\273\377\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0T\0c\0p\0i\0p\0 \0[\0R\0A\0W\0/\0I\0P\0]\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\204\3\0\0\231\6\0\0\254\1\0\0\260\1\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0d\1\0\0\231\6\0\0\254\1\0\0\260\1\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\232\6\0\0\254\1\0\0\260\1\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0`\1\0\0T\370\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\330\312\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\00\04\0\232\6\0\0\254\1\0\0\260\1\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0d\1\0\0\233\6\0\0\254\1\0\0\260\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0d\1\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\233\6\0\0\254\1\0\0\260\1\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\234\6\0\0\254\1\0\0\260\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0d\1\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) }, 900, ) == 0x0 01689 432 NtClose (356, ... ) == 0x0 01690 432 NtOpenKey (0x20019, {24, 352, 0x40, 0, 0, (0x20019, {24, 352, 0x40, 0, 0, "000000000004"}, ... 356, ) }, ... 356, ) == 0x0 01691 432 NtQueryValueKey (356, (356, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW 01692 432 NtQueryValueKey (356, (356, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW 01693 432 NtAllocateVirtualMemory (-1, 1368064, 0, 4096, 4096, 4, ... 1368064, 4096, ) == 0x0 01694 432 NtQueryValueKey (356, (356, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\rsvpsp.dll\0\0gram\FSLSP.DLL\0\00\0\0\0\10\0\2\0\10\0\4\1\10\0h\220\354\28\220\354\2\2\0\12\0\4\1\12\00\00\0\0\0\10\0\2\0\14\0\4\1\10\0\210\220\354\2X\220\354\2\2\0\16\0\4\1\12\00\00\0\0\0\10\0\2\0\20\0\4\1\10\0\250\220\354\2x\220\354\2\2\0\22\0\4\1\12\00\00\0\0\0\10\0\2\0\24\0\4\1\10\0\310\220\354\2\230\220\354\2\2\0\26\0\4\1\12\00\00\0\0\0\10\0\2\0\30\0\4\1\10\0\0\0\0\0\270\220\354\2\2\0\32\0\4\1\10\0H\0K\0R\0\0\0\3\0\34\0\4\1\10\0\360\222\354\2\0\0\0\0\0\221\354\2\16\0\0\0<\0\37\0\4\0\10\0X\3\10\0X\3\10\0\4\0\2\0\11&\2\0\0\0\0\0\0\0\0\0\0\0\0\0\10\0\0\0\340\251`\235z3\320\21\275\210\0\0\300\202\346\232\354\3\0\0\1\0\0\0\310\371\252\1\26\0\30\0\10<_u\0\0\0\0|\370\252\1\27\207`u\0\0\0\0\6\0\0\0\2\0\0\0\20\0\0\0\20\0\0\0\2\0\0\0\21\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\273\377\0\0\0\0\0\0R\0S\0V\0P\0 \0U\0D\0P\0 \0S\0e\0r\0v\0i\0c\0e\0 \0P\0r\0o\0v\0i\0d\0e\0r\0\0\0\30\371\252\1\17.\365w\13\30\365w\1\0\0\0\0\374\252\1\4\0\0\0\0\0\0\0\0\0\0\0\1\0\0\0\17.\365w\0\0\0\0\250\371\252\1 \22\365wO\22\365wT\22\365w\0\0\0\0\204\3\0\0\237\6\0\0\254\1\0\0\260\1\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0d\1\0\0\237\6\0\0\254\1\0\0\260\1\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\240\6\0\0\254\1\0\0\260\1\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0`\1\0\0T\370\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\330\312\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\00\05\0\240\6\0\0\254\1\0\0\260\1\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0d\1\0\0\241\6\0\0\254\1\0\0\260\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0d\1\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\241\6\0\0\254\1\0\0\260\1\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\242\6\0\0\254\1\0\0\260\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0d\1\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) , Partial, 900, ... TitleIdx=0, Type=3, Data= (356, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\rsvpsp.dll\0\0gram\FSLSP.DLL\0\00\0\0\0\10\0\2\0\10\0\4\1\10\0h\220\354\28\220\354\2\2\0\12\0\4\1\12\00\00\0\0\0\10\0\2\0\14\0\4\1\10\0\210\220\354\2X\220\354\2\2\0\16\0\4\1\12\00\00\0\0\0\10\0\2\0\20\0\4\1\10\0\250\220\354\2x\220\354\2\2\0\22\0\4\1\12\00\00\0\0\0\10\0\2\0\24\0\4\1\10\0\310\220\354\2\230\220\354\2\2\0\26\0\4\1\12\00\00\0\0\0\10\0\2\0\30\0\4\1\10\0\0\0\0\0\270\220\354\2\2\0\32\0\4\1\10\0H\0K\0R\0\0\0\3\0\34\0\4\1\10\0\360\222\354\2\0\0\0\0\0\221\354\2\16\0\0\0<\0\37\0\4\0\10\0X\3\10\0X\3\10\0\4\0\2\0\11&\2\0\0\0\0\0\0\0\0\0\0\0\0\0\10\0\0\0\340\251`\235z3\320\21\275\210\0\0\300\202\346\232\354\3\0\0\1\0\0\0\310\371\252\1\26\0\30\0\10<_u\0\0\0\0|\370\252\1\27\207`u\0\0\0\0\6\0\0\0\2\0\0\0\20\0\0\0\20\0\0\0\2\0\0\0\21\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\273\377\0\0\0\0\0\0R\0S\0V\0P\0 \0U\0D\0P\0 \0S\0e\0r\0v\0i\0c\0e\0 \0P\0r\0o\0v\0i\0d\0e\0r\0\0\0\30\371\252\1\17.\365w\13\30\365w\1\0\0\0\0\374\252\1\4\0\0\0\0\0\0\0\0\0\0\0\1\0\0\0\17.\365w\0\0\0\0\250\371\252\1 \22\365wO\22\365wT\22\365w\0\0\0\0\204\3\0\0\237\6\0\0\254\1\0\0\260\1\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0d\1\0\0\237\6\0\0\254\1\0\0\260\1\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\240\6\0\0\254\1\0\0\260\1\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0`\1\0\0T\370\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\330\312\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\00\05\0\240\6\0\0\254\1\0\0\260\1\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0d\1\0\0\241\6\0\0\254\1\0\0\260\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0d\1\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\241\6\0\0\254\1\0\0\260\1\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\242\6\0\0\254\1\0\0\260\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0d\1\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) \0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\241\6\0\0\254\1\0\0\260\1\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\242\6\0\0\254\1\0\0\260\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0d\1\0\0\0\0\0\0 (356, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\rsvpsp.dll\0\0gram\FSLSP.DLL\0\00\0\0\0\10\0\2\0\10\0\4\1\10\0h\220\354\28\220\354\2\2\0\12\0\4\1\12\00\00\0\0\0\10\0\2\0\14\0\4\1\10\0\210\220\354\2X\220\354\2\2\0\16\0\4\1\12\00\00\0\0\0\10\0\2\0\20\0\4\1\10\0\250\220\354\2x\220\354\2\2\0\22\0\4\1\12\00\00\0\0\0\10\0\2\0\24\0\4\1\10\0\310\220\354\2\230\220\354\2\2\0\26\0\4\1\12\00\00\0\0\0\10\0\2\0\30\0\4\1\10\0\0\0\0\0\270\220\354\2\2\0\32\0\4\1\10\0H\0K\0R\0\0\0\3\0\34\0\4\1\10\0\360\222\354\2\0\0\0\0\0\221\354\2\16\0\0\0<\0\37\0\4\0\10\0X\3\10\0X\3\10\0\4\0\2\0\11&\2\0\0\0\0\0\0\0\0\0\0\0\0\0\10\0\0\0\340\251`\235z3\320\21\275\210\0\0\300\202\346\232\354\3\0\0\1\0\0\0\310\371\252\1\26\0\30\0\10<_u\0\0\0\0|\370\252\1\27\207`u\0\0\0\0\6\0\0\0\2\0\0\0\20\0\0\0\20\0\0\0\2\0\0\0\21\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\273\377\0\0\0\0\0\0R\0S\0V\0P\0 \0U\0D\0P\0 \0S\0e\0r\0v\0i\0c\0e\0 \0P\0r\0o\0v\0i\0d\0e\0r\0\0\0\30\371\252\1\17.\365w\13\30\365w\1\0\0\0\0\374\252\1\4\0\0\0\0\0\0\0\0\0\0\0\1\0\0\0\17.\365w\0\0\0\0\250\371\252\1 \22\365wO\22\365wT\22\365w\0\0\0\0\204\3\0\0\237\6\0\0\254\1\0\0\260\1\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0d\1\0\0\237\6\0\0\254\1\0\0\260\1\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\240\6\0\0\254\1\0\0\260\1\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0`\1\0\0T\370\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\330\312\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\00\05\0\240\6\0\0\254\1\0\0\260\1\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0d\1\0\0\241\6\0\0\254\1\0\0\260\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0d\1\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\241\6\0\0\254\1\0\0\260\1\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\242\6\0\0\254\1\0\0\260\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0d\1\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) }, 900, ) == 0x0 01695 432 NtClose (356, ... ) == 0x0 01696 432 NtOpenKey (0x20019, {24, 352, 0x40, 0, 0, (0x20019, {24, 352, 0x40, 0, 0, "000000000005"}, ... 356, ) }, ... 356, ) == 0x0 01697 432 NtQueryValueKey (356, (356, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW 01698 432 NtQueryValueKey (356, (356, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW 01699 432 NtQueryValueKey (356, (356, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\rsvpsp.dll\0\0gram\FSLSP.DLL\0\00\0\0\0\10\0\2\0\10\0\4\1\10\0h\220\354\28\220\354\2\2\0\12\0\4\1\12\00\00\0\0\0\10\0\2\0\14\0\4\1\10\0\210\220\354\2X\220\354\2\2\0\16\0\4\1\12\00\00\0\0\0\10\0\2\0\20\0\4\1\10\0\250\220\354\2x\220\354\2\2\0\22\0\4\1\12\00\00\0\0\0\10\0\2\0\24\0\4\1\10\0\310\220\354\2\230\220\354\2\2\0\26\0\4\1\12\00\00\0\0\0\10\0\2\0\30\0\4\1\10\0\0\0\0\0\270\220\354\2\2\0\32\0\4\1\10\0H\0K\0R\0\0\0\3\0\34\0\4\1\10\0\360\222\354\2\0\0\0\0\0\221\354\2\16\0\0\0<\0\37\0\4\0\10\0X\3\10\0X\3\10\0\4\0\2\0f \2\0\0\0\0\0\0\0\0\0\0\0\0\0\10\0\0\0\340\251`\235z3\320\21\275\210\0\0\300\202\346\232\355\3\0\0\1\0\0\0\17.\365w\13\30\365w\0\0\0\0\4+Y\1\2\0\0\0\1\0\0\0\17.\365w\6\0\0\0\2\0\0\0\20\0\0\0\20\0\0\0\1\0\0\0\6\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0R\0S\0V\0P\0 \0T\0C\0P\0 \0S\0e\0r\0v\0i\0c\0e\0 \0P\0r\0o\0v\0i\0d\0e\0r\0\0\0\0\0\0\0\362_du\3`du\240\1\10\0\250\5N\1 \0\0\0\0\0\0\0\240\1\10\0\310\5N\1H\344\301\0\0\0\0\0\0\0\0\0\0\0\245\0\0\0\10\0@\5N\1\0\0\0\0\204\3\0\0\244\6\0\0\254\1\0\0\260\1\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0d\1\0\0\244\6\0\0\254\1\0\0\260\1\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\245\6\0\0\254\1\0\0\260\1\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0`\1\0\0T\370\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\330\312\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\00\06\0\245\6\0\0\254\1\0\0\260\1\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0d\1\0\0\246\6\0\0\254\1\0\0\260\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0d\1\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\246\6\0\0\254\1\0\0\260\1\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\247\6\0\0\254\1\0\0\260\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0d\1\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) , Partial, 900, ... TitleIdx=0, Type=3, Data= (356, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\rsvpsp.dll\0\0gram\FSLSP.DLL\0\00\0\0\0\10\0\2\0\10\0\4\1\10\0h\220\354\28\220\354\2\2\0\12\0\4\1\12\00\00\0\0\0\10\0\2\0\14\0\4\1\10\0\210\220\354\2X\220\354\2\2\0\16\0\4\1\12\00\00\0\0\0\10\0\2\0\20\0\4\1\10\0\250\220\354\2x\220\354\2\2\0\22\0\4\1\12\00\00\0\0\0\10\0\2\0\24\0\4\1\10\0\310\220\354\2\230\220\354\2\2\0\26\0\4\1\12\00\00\0\0\0\10\0\2\0\30\0\4\1\10\0\0\0\0\0\270\220\354\2\2\0\32\0\4\1\10\0H\0K\0R\0\0\0\3\0\34\0\4\1\10\0\360\222\354\2\0\0\0\0\0\221\354\2\16\0\0\0<\0\37\0\4\0\10\0X\3\10\0X\3\10\0\4\0\2\0f \2\0\0\0\0\0\0\0\0\0\0\0\0\0\10\0\0\0\340\251`\235z3\320\21\275\210\0\0\300\202\346\232\355\3\0\0\1\0\0\0\17.\365w\13\30\365w\0\0\0\0\4+Y\1\2\0\0\0\1\0\0\0\17.\365w\6\0\0\0\2\0\0\0\20\0\0\0\20\0\0\0\1\0\0\0\6\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0R\0S\0V\0P\0 \0T\0C\0P\0 \0S\0e\0r\0v\0i\0c\0e\0 \0P\0r\0o\0v\0i\0d\0e\0r\0\0\0\0\0\0\0\362_du\3`du\240\1\10\0\250\5N\1 \0\0\0\0\0\0\0\240\1\10\0\310\5N\1H\344\301\0\0\0\0\0\0\0\0\0\0\0\245\0\0\0\10\0@\5N\1\0\0\0\0\204\3\0\0\244\6\0\0\254\1\0\0\260\1\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0d\1\0\0\244\6\0\0\254\1\0\0\260\1\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\245\6\0\0\254\1\0\0\260\1\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0`\1\0\0T\370\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\330\312\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\00\06\0\245\6\0\0\254\1\0\0\260\1\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0d\1\0\0\246\6\0\0\254\1\0\0\260\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0d\1\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\246\6\0\0\254\1\0\0\260\1\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\247\6\0\0\254\1\0\0\260\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0d\1\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) \0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\246\6\0\0\254\1\0\0\260\1\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\247\6\0\0\254\1\0\0\260\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0d\1\0\0\0\0\0\0 (356, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\rsvpsp.dll\0\0gram\FSLSP.DLL\0\00\0\0\0\10\0\2\0\10\0\4\1\10\0h\220\354\28\220\354\2\2\0\12\0\4\1\12\00\00\0\0\0\10\0\2\0\14\0\4\1\10\0\210\220\354\2X\220\354\2\2\0\16\0\4\1\12\00\00\0\0\0\10\0\2\0\20\0\4\1\10\0\250\220\354\2x\220\354\2\2\0\22\0\4\1\12\00\00\0\0\0\10\0\2\0\24\0\4\1\10\0\310\220\354\2\230\220\354\2\2\0\26\0\4\1\12\00\00\0\0\0\10\0\2\0\30\0\4\1\10\0\0\0\0\0\270\220\354\2\2\0\32\0\4\1\10\0H\0K\0R\0\0\0\3\0\34\0\4\1\10\0\360\222\354\2\0\0\0\0\0\221\354\2\16\0\0\0<\0\37\0\4\0\10\0X\3\10\0X\3\10\0\4\0\2\0f \2\0\0\0\0\0\0\0\0\0\0\0\0\0\10\0\0\0\340\251`\235z3\320\21\275\210\0\0\300\202\346\232\355\3\0\0\1\0\0\0\17.\365w\13\30\365w\0\0\0\0\4+Y\1\2\0\0\0\1\0\0\0\17.\365w\6\0\0\0\2\0\0\0\20\0\0\0\20\0\0\0\1\0\0\0\6\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0R\0S\0V\0P\0 \0T\0C\0P\0 \0S\0e\0r\0v\0i\0c\0e\0 \0P\0r\0o\0v\0i\0d\0e\0r\0\0\0\0\0\0\0\362_du\3`du\240\1\10\0\250\5N\1 \0\0\0\0\0\0\0\240\1\10\0\310\5N\1H\344\301\0\0\0\0\0\0\0\0\0\0\0\245\0\0\0\10\0@\5N\1\0\0\0\0\204\3\0\0\244\6\0\0\254\1\0\0\260\1\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0d\1\0\0\244\6\0\0\254\1\0\0\260\1\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\245\6\0\0\254\1\0\0\260\1\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0`\1\0\0T\370\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\330\312\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\00\06\0\245\6\0\0\254\1\0\0\260\1\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0d\1\0\0\246\6\0\0\254\1\0\0\260\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0d\1\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\246\6\0\0\254\1\0\0\260\1\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\247\6\0\0\254\1\0\0\260\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0d\1\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) }, 900, ) == 0x0 01700 432 NtClose (356, ... ) == 0x0 01701 432 NtOpenKey (0x20019, {24, 352, 0x40, 0, 0, (0x20019, {24, 352, 0x40, 0, 0, "000000000006"}, ... 356, ) }, ... 356, ) == 0x0 01702 432 NtQueryValueKey (356, (356, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW 01703 432 NtQueryValueKey (356, (356, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW 01704 432 NtQueryValueKey (356, (356, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0gram\FSLSP.DLL\0\00\0\0\0\10\0\2\0\10\0\4\1\10\0h\220\354\28\220\354\2\2\0\12\0\4\1\12\00\00\0\0\0\10\0\2\0\14\0\4\1\10\0\210\220\354\2X\220\354\2\2\0\16\0\4\1\12\00\00\0\0\0\10\0\2\0\20\0\4\1\10\0\250\220\354\2x\220\354\2\2\0\22\0\4\1\12\00\00\0\0\0\10\0\2\0\24\0\4\1\10\0\310\220\354\2\230\220\354\2\2\0\26\0\4\1\12\00\00\0\0\0\10\0\2\0\30\0\4\1\10\0\0\0\0\0\270\220\354\2\2\0\32\0\4\1\10\0H\0K\0R\0\0\0\3\0\34\0\4\1\10\0\360\222\354\2\0\0\0\0\0\221\354\2\16\0\0\0<\0\37\0\4\0\10\0X\3\10\0X\3\10\0\4\0\2\0\16\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\10\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\356\3\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\5\0\0\0\0\0\0\200\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\04\0F\0E\05\07\0D\07\0B\0-\00\03\0A\05\0-\04\08\0B\02\0-\08\0\0\0\0\0\204\3\0\0\251\6\0\0\254\1\0\0\260\1\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0d\1\0\0\251\6\0\0\254\1\0\0\260\1\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\252\6\0\0\254\1\0\0\260\1\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0`\1\0\0T\370\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\330\312\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\00\07\0\252\6\0\0\254\1\0\0\260\1\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0d\1\0\0\253\6\0\0\254\1\0\0\260\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0d\1\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\253\6\0\0\254\1\0\0\260\1\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\254\6\0\0\254\1\0\0\260\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0d\1\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) , Partial, 900, ... TitleIdx=0, Type=3, Data= (356, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0gram\FSLSP.DLL\0\00\0\0\0\10\0\2\0\10\0\4\1\10\0h\220\354\28\220\354\2\2\0\12\0\4\1\12\00\00\0\0\0\10\0\2\0\14\0\4\1\10\0\210\220\354\2X\220\354\2\2\0\16\0\4\1\12\00\00\0\0\0\10\0\2\0\20\0\4\1\10\0\250\220\354\2x\220\354\2\2\0\22\0\4\1\12\00\00\0\0\0\10\0\2\0\24\0\4\1\10\0\310\220\354\2\230\220\354\2\2\0\26\0\4\1\12\00\00\0\0\0\10\0\2\0\30\0\4\1\10\0\0\0\0\0\270\220\354\2\2\0\32\0\4\1\10\0H\0K\0R\0\0\0\3\0\34\0\4\1\10\0\360\222\354\2\0\0\0\0\0\221\354\2\16\0\0\0<\0\37\0\4\0\10\0X\3\10\0X\3\10\0\4\0\2\0\16\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\10\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\356\3\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\5\0\0\0\0\0\0\200\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\04\0F\0E\05\07\0D\07\0B\0-\00\03\0A\05\0-\04\08\0B\02\0-\08\0\0\0\0\0\204\3\0\0\251\6\0\0\254\1\0\0\260\1\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0d\1\0\0\251\6\0\0\254\1\0\0\260\1\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\252\6\0\0\254\1\0\0\260\1\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0`\1\0\0T\370\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\330\312\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\00\07\0\252\6\0\0\254\1\0\0\260\1\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0d\1\0\0\253\6\0\0\254\1\0\0\260\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0d\1\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\253\6\0\0\254\1\0\0\260\1\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\254\6\0\0\254\1\0\0\260\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0d\1\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) \0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\253\6\0\0\254\1\0\0\260\1\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\254\6\0\0\254\1\0\0\260\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0d\1\0\0\0\0\0\0 (356, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0gram\FSLSP.DLL\0\00\0\0\0\10\0\2\0\10\0\4\1\10\0h\220\354\28\220\354\2\2\0\12\0\4\1\12\00\00\0\0\0\10\0\2\0\14\0\4\1\10\0\210\220\354\2X\220\354\2\2\0\16\0\4\1\12\00\00\0\0\0\10\0\2\0\20\0\4\1\10\0\250\220\354\2x\220\354\2\2\0\22\0\4\1\12\00\00\0\0\0\10\0\2\0\24\0\4\1\10\0\310\220\354\2\230\220\354\2\2\0\26\0\4\1\12\00\00\0\0\0\10\0\2\0\30\0\4\1\10\0\0\0\0\0\270\220\354\2\2\0\32\0\4\1\10\0H\0K\0R\0\0\0\3\0\34\0\4\1\10\0\360\222\354\2\0\0\0\0\0\221\354\2\16\0\0\0<\0\37\0\4\0\10\0X\3\10\0X\3\10\0\4\0\2\0\16\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\10\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\356\3\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\5\0\0\0\0\0\0\200\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\04\0F\0E\05\07\0D\07\0B\0-\00\03\0A\05\0-\04\08\0B\02\0-\08\0\0\0\0\0\204\3\0\0\251\6\0\0\254\1\0\0\260\1\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0d\1\0\0\251\6\0\0\254\1\0\0\260\1\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\252\6\0\0\254\1\0\0\260\1\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0`\1\0\0T\370\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\330\312\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\00\07\0\252\6\0\0\254\1\0\0\260\1\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0d\1\0\0\253\6\0\0\254\1\0\0\260\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0d\1\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\253\6\0\0\254\1\0\0\260\1\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\254\6\0\0\254\1\0\0\260\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0d\1\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) }, 900, ) == 0x0 01705 432 NtClose (356, ... ) == 0x0 01706 432 NtOpenKey (0x20019, {24, 352, 0x40, 0, 0, (0x20019, {24, 352, 0x40, 0, 0, "000000000007"}, ... 356, ) }, ... 356, ) == 0x0 01707 432 NtQueryValueKey (356, (356, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW 01708 432 NtQueryValueKey (356, (356, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW 01709 432 NtQueryValueKey (356, (356, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0gram\FSLSP.DLL\0\00\0\0\0\10\0\2\0\10\0\4\1\10\0h\220\354\28\220\354\2\2\0\12\0\4\1\12\00\00\0\0\0\10\0\2\0\14\0\4\1\10\0\210\220\354\2X\220\354\2\2\0\16\0\4\1\12\00\00\0\0\0\10\0\2\0\20\0\4\1\10\0\250\220\354\2x\220\354\2\2\0\22\0\4\1\12\00\00\0\0\0\10\0\2\0\24\0\4\1\10\0\310\220\354\2\230\220\354\2\2\0\26\0\4\1\12\00\00\0\0\0\10\0\2\0\30\0\4\1\10\0\0\0\0\0\270\220\354\2\2\0\32\0\4\1\10\0H\0K\0R\0\0\0\3\0\34\0\4\1\10\0\360\222\354\2\0\0\0\0\0\221\354\2\16\0\0\0<\0\37\0\4\0\10\0X\3\10\0X\3\10\0\4\0\2\0\11\2\2\0\0\0\0\0\0\0\0\0\0\0\0\0\10\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\357\3\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\2\0\0\0\0\0\0\200\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\04\0F\0E\05\07\0D\07\0B\0-\00\03\0A\05\0-\04\08\0B\02\0-\08\0\0\0\0\0\204\3\0\0\256\6\0\0\254\1\0\0\260\1\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0d\1\0\0\256\6\0\0\254\1\0\0\260\1\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\257\6\0\0\254\1\0\0\260\1\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0`\1\0\0T\370\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\330\312\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\00\08\0\257\6\0\0\254\1\0\0\260\1\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0d\1\0\0\260\6\0\0\254\1\0\0\260\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0d\1\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\260\6\0\0\254\1\0\0\260\1\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\261\6\0\0\254\1\0\0\260\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0d\1\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) , Partial, 900, ... TitleIdx=0, Type=3, Data= (356, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0gram\FSLSP.DLL\0\00\0\0\0\10\0\2\0\10\0\4\1\10\0h\220\354\28\220\354\2\2\0\12\0\4\1\12\00\00\0\0\0\10\0\2\0\14\0\4\1\10\0\210\220\354\2X\220\354\2\2\0\16\0\4\1\12\00\00\0\0\0\10\0\2\0\20\0\4\1\10\0\250\220\354\2x\220\354\2\2\0\22\0\4\1\12\00\00\0\0\0\10\0\2\0\24\0\4\1\10\0\310\220\354\2\230\220\354\2\2\0\26\0\4\1\12\00\00\0\0\0\10\0\2\0\30\0\4\1\10\0\0\0\0\0\270\220\354\2\2\0\32\0\4\1\10\0H\0K\0R\0\0\0\3\0\34\0\4\1\10\0\360\222\354\2\0\0\0\0\0\221\354\2\16\0\0\0<\0\37\0\4\0\10\0X\3\10\0X\3\10\0\4\0\2\0\11\2\2\0\0\0\0\0\0\0\0\0\0\0\0\0\10\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\357\3\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\2\0\0\0\0\0\0\200\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\04\0F\0E\05\07\0D\07\0B\0-\00\03\0A\05\0-\04\08\0B\02\0-\08\0\0\0\0\0\204\3\0\0\256\6\0\0\254\1\0\0\260\1\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0d\1\0\0\256\6\0\0\254\1\0\0\260\1\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\257\6\0\0\254\1\0\0\260\1\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0`\1\0\0T\370\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\330\312\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\00\08\0\257\6\0\0\254\1\0\0\260\1\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0d\1\0\0\260\6\0\0\254\1\0\0\260\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0d\1\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\260\6\0\0\254\1\0\0\260\1\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\261\6\0\0\254\1\0\0\260\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0d\1\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) \0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\260\6\0\0\254\1\0\0\260\1\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\261\6\0\0\254\1\0\0\260\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0d\1\0\0\0\0\0\0 (356, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0gram\FSLSP.DLL\0\00\0\0\0\10\0\2\0\10\0\4\1\10\0h\220\354\28\220\354\2\2\0\12\0\4\1\12\00\00\0\0\0\10\0\2\0\14\0\4\1\10\0\210\220\354\2X\220\354\2\2\0\16\0\4\1\12\00\00\0\0\0\10\0\2\0\20\0\4\1\10\0\250\220\354\2x\220\354\2\2\0\22\0\4\1\12\00\00\0\0\0\10\0\2\0\24\0\4\1\10\0\310\220\354\2\230\220\354\2\2\0\26\0\4\1\12\00\00\0\0\0\10\0\2\0\30\0\4\1\10\0\0\0\0\0\270\220\354\2\2\0\32\0\4\1\10\0H\0K\0R\0\0\0\3\0\34\0\4\1\10\0\360\222\354\2\0\0\0\0\0\221\354\2\16\0\0\0<\0\37\0\4\0\10\0X\3\10\0X\3\10\0\4\0\2\0\11\2\2\0\0\0\0\0\0\0\0\0\0\0\0\0\10\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\357\3\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\2\0\0\0\0\0\0\200\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\04\0F\0E\05\07\0D\07\0B\0-\00\03\0A\05\0-\04\08\0B\02\0-\08\0\0\0\0\0\204\3\0\0\256\6\0\0\254\1\0\0\260\1\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0d\1\0\0\256\6\0\0\254\1\0\0\260\1\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\257\6\0\0\254\1\0\0\260\1\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0`\1\0\0T\370\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\330\312\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\00\08\0\257\6\0\0\254\1\0\0\260\1\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0d\1\0\0\260\6\0\0\254\1\0\0\260\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0d\1\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\260\6\0\0\254\1\0\0\260\1\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\261\6\0\0\254\1\0\0\260\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0d\1\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) }, 900, ) == 0x0 01710 432 NtClose (356, ... ) == 0x0 01711 432 NtOpenKey (0x20019, {24, 352, 0x40, 0, 0, (0x20019, {24, 352, 0x40, 0, 0, "000000000008"}, ... 356, ) }, ... 356, ) == 0x0 01712 432 NtQueryValueKey (356, (356, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW 01713 432 NtQueryValueKey (356, (356, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW 01714 432 NtQueryValueKey (356, (356, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0gram\FSLSP.DLL\0\00\0\0\0\10\0\2\0\10\0\4\1\10\0h\220\354\28\220\354\2\2\0\12\0\4\1\12\00\00\0\0\0\10\0\2\0\14\0\4\1\10\0\210\220\354\2X\220\354\2\2\0\16\0\4\1\12\00\00\0\0\0\10\0\2\0\20\0\4\1\10\0\250\220\354\2x\220\354\2\2\0\22\0\4\1\12\00\00\0\0\0\10\0\2\0\24\0\4\1\10\0\310\220\354\2\230\220\354\2\2\0\26\0\4\1\12\00\00\0\0\0\10\0\2\0\30\0\4\1\10\0\0\0\0\0\270\220\354\2\2\0\32\0\4\1\10\0H\0K\0R\0\0\0\3\0\34\0\4\1\10\0\360\222\354\2\0\0\0\0\0\221\354\2\16\0\0\0<\0\37\0\4\0\10\0X\3\10\0X\3\10\0\4\0\2\0\16\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\360\3\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\5\0\0\0\377\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\0A\0B\0E\07\0E\00\06\0F\0-\06\02\00\0F\0-\04\0E\0A\0A\0-\0A\0\0\0\0\0\204\3\0\0\263\6\0\0\254\1\0\0\260\1\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0d\1\0\0\263\6\0\0\254\1\0\0\260\1\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\264\6\0\0\254\1\0\0\260\1\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0`\1\0\0T\370\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\330\312\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\00\09\0\264\6\0\0\254\1\0\0\260\1\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0d\1\0\0\265\6\0\0\254\1\0\0\260\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0d\1\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\265\6\0\0\254\1\0\0\260\1\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\266\6\0\0\254\1\0\0\260\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0d\1\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) , Partial, 900, ... TitleIdx=0, Type=3, Data= (356, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0gram\FSLSP.DLL\0\00\0\0\0\10\0\2\0\10\0\4\1\10\0h\220\354\28\220\354\2\2\0\12\0\4\1\12\00\00\0\0\0\10\0\2\0\14\0\4\1\10\0\210\220\354\2X\220\354\2\2\0\16\0\4\1\12\00\00\0\0\0\10\0\2\0\20\0\4\1\10\0\250\220\354\2x\220\354\2\2\0\22\0\4\1\12\00\00\0\0\0\10\0\2\0\24\0\4\1\10\0\310\220\354\2\230\220\354\2\2\0\26\0\4\1\12\00\00\0\0\0\10\0\2\0\30\0\4\1\10\0\0\0\0\0\270\220\354\2\2\0\32\0\4\1\10\0H\0K\0R\0\0\0\3\0\34\0\4\1\10\0\360\222\354\2\0\0\0\0\0\221\354\2\16\0\0\0<\0\37\0\4\0\10\0X\3\10\0X\3\10\0\4\0\2\0\16\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\360\3\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\5\0\0\0\377\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\0A\0B\0E\07\0E\00\06\0F\0-\06\02\00\0F\0-\04\0E\0A\0A\0-\0A\0\0\0\0\0\204\3\0\0\263\6\0\0\254\1\0\0\260\1\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0d\1\0\0\263\6\0\0\254\1\0\0\260\1\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\264\6\0\0\254\1\0\0\260\1\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0`\1\0\0T\370\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\330\312\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\00\09\0\264\6\0\0\254\1\0\0\260\1\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0d\1\0\0\265\6\0\0\254\1\0\0\260\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0d\1\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\265\6\0\0\254\1\0\0\260\1\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\266\6\0\0\254\1\0\0\260\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0d\1\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) \0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\265\6\0\0\254\1\0\0\260\1\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\266\6\0\0\254\1\0\0\260\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0d\1\0\0\0\0\0\0 (356, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0gram\FSLSP.DLL\0\00\0\0\0\10\0\2\0\10\0\4\1\10\0h\220\354\28\220\354\2\2\0\12\0\4\1\12\00\00\0\0\0\10\0\2\0\14\0\4\1\10\0\210\220\354\2X\220\354\2\2\0\16\0\4\1\12\00\00\0\0\0\10\0\2\0\20\0\4\1\10\0\250\220\354\2x\220\354\2\2\0\22\0\4\1\12\00\00\0\0\0\10\0\2\0\24\0\4\1\10\0\310\220\354\2\230\220\354\2\2\0\26\0\4\1\12\00\00\0\0\0\10\0\2\0\30\0\4\1\10\0\0\0\0\0\270\220\354\2\2\0\32\0\4\1\10\0H\0K\0R\0\0\0\3\0\34\0\4\1\10\0\360\222\354\2\0\0\0\0\0\221\354\2\16\0\0\0<\0\37\0\4\0\10\0X\3\10\0X\3\10\0\4\0\2\0\16\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\360\3\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\5\0\0\0\377\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\0A\0B\0E\07\0E\00\06\0F\0-\06\02\00\0F\0-\04\0E\0A\0A\0-\0A\0\0\0\0\0\204\3\0\0\263\6\0\0\254\1\0\0\260\1\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0d\1\0\0\263\6\0\0\254\1\0\0\260\1\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\264\6\0\0\254\1\0\0\260\1\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0`\1\0\0T\370\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\330\312\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\00\09\0\264\6\0\0\254\1\0\0\260\1\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0d\1\0\0\265\6\0\0\254\1\0\0\260\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0d\1\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\265\6\0\0\254\1\0\0\260\1\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\266\6\0\0\254\1\0\0\260\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0d\1\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) }, 900, ) == 0x0 01715 432 NtClose (356, ... ) == 0x0 01716 432 NtOpenKey (0x20019, {24, 352, 0x40, 0, 0, (0x20019, {24, 352, 0x40, 0, 0, "000000000009"}, ... 356, ) }, ... 356, ) == 0x0 01717 432 NtQueryValueKey (356, (356, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW 01718 432 NtQueryValueKey (356, (356, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW 01719 432 NtAllocateVirtualMemory (-1, 1372160, 0, 4096, 4096, 4, ... 1372160, 4096, ) == 0x0 01720 432 NtQueryValueKey (356, (356, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0gram\FSLSP.DLL\0\00\0\0\0\10\0\2\0\10\0\4\1\10\0h\220\354\28\220\354\2\2\0\12\0\4\1\12\00\00\0\0\0\10\0\2\0\14\0\4\1\10\0\210\220\354\2X\220\354\2\2\0\16\0\4\1\12\00\00\0\0\0\10\0\2\0\20\0\4\1\10\0\250\220\354\2x\220\354\2\2\0\22\0\4\1\12\00\00\0\0\0\10\0\2\0\24\0\4\1\10\0\310\220\354\2\230\220\354\2\2\0\26\0\4\1\12\00\00\0\0\0\10\0\2\0\30\0\4\1\10\0\0\0\0\0\270\220\354\2\2\0\32\0\4\1\10\0H\0K\0R\0\0\0\3\0\34\0\4\1\10\0\360\222\354\2\0\0\0\0\0\221\354\2\16\0\0\0<\0\37\0\4\0\10\0X\3\10\0X\3\10\0\4\0\2\0\11\2\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\361\3\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\2\0\0\0\377\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\0A\0B\0E\07\0E\00\06\0F\0-\06\02\00\0F\0-\04\0E\0A\0A\0-\0A\0\0\0\0\0\204\3\0\0\271\6\0\0\254\1\0\0\260\1\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0d\1\0\0\271\6\0\0\254\1\0\0\260\1\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\272\6\0\0\254\1\0\0\260\1\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0`\1\0\0T\370\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\330\312\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\01\00\0\272\6\0\0\254\1\0\0\260\1\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0d\1\0\0\273\6\0\0\254\1\0\0\260\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0d\1\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\273\6\0\0\254\1\0\0\260\1\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\274\6\0\0\254\1\0\0\260\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0d\1\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) , Partial, 900, ... TitleIdx=0, Type=3, Data= (356, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0gram\FSLSP.DLL\0\00\0\0\0\10\0\2\0\10\0\4\1\10\0h\220\354\28\220\354\2\2\0\12\0\4\1\12\00\00\0\0\0\10\0\2\0\14\0\4\1\10\0\210\220\354\2X\220\354\2\2\0\16\0\4\1\12\00\00\0\0\0\10\0\2\0\20\0\4\1\10\0\250\220\354\2x\220\354\2\2\0\22\0\4\1\12\00\00\0\0\0\10\0\2\0\24\0\4\1\10\0\310\220\354\2\230\220\354\2\2\0\26\0\4\1\12\00\00\0\0\0\10\0\2\0\30\0\4\1\10\0\0\0\0\0\270\220\354\2\2\0\32\0\4\1\10\0H\0K\0R\0\0\0\3\0\34\0\4\1\10\0\360\222\354\2\0\0\0\0\0\221\354\2\16\0\0\0<\0\37\0\4\0\10\0X\3\10\0X\3\10\0\4\0\2\0\11\2\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\361\3\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\2\0\0\0\377\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\0A\0B\0E\07\0E\00\06\0F\0-\06\02\00\0F\0-\04\0E\0A\0A\0-\0A\0\0\0\0\0\204\3\0\0\271\6\0\0\254\1\0\0\260\1\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0d\1\0\0\271\6\0\0\254\1\0\0\260\1\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\272\6\0\0\254\1\0\0\260\1\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0`\1\0\0T\370\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\330\312\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\01\00\0\272\6\0\0\254\1\0\0\260\1\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0d\1\0\0\273\6\0\0\254\1\0\0\260\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0d\1\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\273\6\0\0\254\1\0\0\260\1\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\274\6\0\0\254\1\0\0\260\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0d\1\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) \0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\273\6\0\0\254\1\0\0\260\1\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\274\6\0\0\254\1\0\0\260\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0d\1\0\0\0\0\0\0 (356, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0gram\FSLSP.DLL\0\00\0\0\0\10\0\2\0\10\0\4\1\10\0h\220\354\28\220\354\2\2\0\12\0\4\1\12\00\00\0\0\0\10\0\2\0\14\0\4\1\10\0\210\220\354\2X\220\354\2\2\0\16\0\4\1\12\00\00\0\0\0\10\0\2\0\20\0\4\1\10\0\250\220\354\2x\220\354\2\2\0\22\0\4\1\12\00\00\0\0\0\10\0\2\0\24\0\4\1\10\0\310\220\354\2\230\220\354\2\2\0\26\0\4\1\12\00\00\0\0\0\10\0\2\0\30\0\4\1\10\0\0\0\0\0\270\220\354\2\2\0\32\0\4\1\10\0H\0K\0R\0\0\0\3\0\34\0\4\1\10\0\360\222\354\2\0\0\0\0\0\221\354\2\16\0\0\0<\0\37\0\4\0\10\0X\3\10\0X\3\10\0\4\0\2\0\11\2\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\361\3\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\2\0\0\0\377\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\0A\0B\0E\07\0E\00\06\0F\0-\06\02\00\0F\0-\04\0E\0A\0A\0-\0A\0\0\0\0\0\204\3\0\0\271\6\0\0\254\1\0\0\260\1\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0d\1\0\0\271\6\0\0\254\1\0\0\260\1\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\272\6\0\0\254\1\0\0\260\1\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0`\1\0\0T\370\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\330\312\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\01\00\0\272\6\0\0\254\1\0\0\260\1\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0d\1\0\0\273\6\0\0\254\1\0\0\260\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0d\1\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\273\6\0\0\254\1\0\0\260\1\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\274\6\0\0\254\1\0\0\260\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0d\1\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) }, 900, ) == 0x0 01721 432 NtClose (356, ... ) == 0x0 01722 432 NtOpenKey (0x20019, {24, 352, 0x40, 0, 0, (0x20019, {24, 352, 0x40, 0, 0, "000000000010"}, ... 356, ) }, ... 356, ) == 0x0 01723 432 NtQueryValueKey (356, (356, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW 01724 432 NtQueryValueKey (356, (356, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW 01725 432 NtQueryValueKey (356, (356, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0gram\FSLSP.DLL\0\00\0\0\0\10\0\2\0\10\0\4\1\10\0h\220\354\28\220\354\2\2\0\12\0\4\1\12\00\00\0\0\0\10\0\2\0\14\0\4\1\10\0\210\220\354\2X\220\354\2\2\0\16\0\4\1\12\00\00\0\0\0\10\0\2\0\20\0\4\1\10\0\250\220\354\2x\220\354\2\2\0\22\0\4\1\12\00\00\0\0\0\10\0\2\0\24\0\4\1\10\0\310\220\354\2\230\220\354\2\2\0\26\0\4\1\12\00\00\0\0\0\10\0\2\0\30\0\4\1\10\0\0\0\0\0\270\220\354\2\2\0\32\0\4\1\10\0H\0K\0R\0\0\0\3\0\34\0\4\1\10\0\360\222\354\2\0\0\0\0\0\221\354\2\16\0\0\0<\0\37\0\4\0\10\0X\3\10\0X\3\10\0\4\0\2\0\16\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\362\3\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\5\0\0\0\376\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\0D\01\09\0D\0F\08\08\02\0-\0A\09\0C\0B\0-\04\01\04\04\0-\08\0\0\0\0\0\204\3\0\0\276\6\0\0\254\1\0\0\260\1\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0d\1\0\0\276\6\0\0\254\1\0\0\260\1\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\277\6\0\0\254\1\0\0\260\1\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0`\1\0\0T\370\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\330\312\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\01\01\0\277\6\0\0\254\1\0\0\260\1\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0d\1\0\0\300\6\0\0\254\1\0\0\260\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0d\1\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\300\6\0\0\254\1\0\0\260\1\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\301\6\0\0\254\1\0\0\260\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0d\1\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) , Partial, 900, ... TitleIdx=0, Type=3, Data= (356, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0gram\FSLSP.DLL\0\00\0\0\0\10\0\2\0\10\0\4\1\10\0h\220\354\28\220\354\2\2\0\12\0\4\1\12\00\00\0\0\0\10\0\2\0\14\0\4\1\10\0\210\220\354\2X\220\354\2\2\0\16\0\4\1\12\00\00\0\0\0\10\0\2\0\20\0\4\1\10\0\250\220\354\2x\220\354\2\2\0\22\0\4\1\12\00\00\0\0\0\10\0\2\0\24\0\4\1\10\0\310\220\354\2\230\220\354\2\2\0\26\0\4\1\12\00\00\0\0\0\10\0\2\0\30\0\4\1\10\0\0\0\0\0\270\220\354\2\2\0\32\0\4\1\10\0H\0K\0R\0\0\0\3\0\34\0\4\1\10\0\360\222\354\2\0\0\0\0\0\221\354\2\16\0\0\0<\0\37\0\4\0\10\0X\3\10\0X\3\10\0\4\0\2\0\16\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\362\3\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\5\0\0\0\376\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\0D\01\09\0D\0F\08\08\02\0-\0A\09\0C\0B\0-\04\01\04\04\0-\08\0\0\0\0\0\204\3\0\0\276\6\0\0\254\1\0\0\260\1\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0d\1\0\0\276\6\0\0\254\1\0\0\260\1\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\277\6\0\0\254\1\0\0\260\1\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0`\1\0\0T\370\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\330\312\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\01\01\0\277\6\0\0\254\1\0\0\260\1\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0d\1\0\0\300\6\0\0\254\1\0\0\260\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0d\1\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\300\6\0\0\254\1\0\0\260\1\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\301\6\0\0\254\1\0\0\260\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0d\1\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) \0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\300\6\0\0\254\1\0\0\260\1\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\301\6\0\0\254\1\0\0\260\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0d\1\0\0\0\0\0\0 (356, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0gram\FSLSP.DLL\0\00\0\0\0\10\0\2\0\10\0\4\1\10\0h\220\354\28\220\354\2\2\0\12\0\4\1\12\00\00\0\0\0\10\0\2\0\14\0\4\1\10\0\210\220\354\2X\220\354\2\2\0\16\0\4\1\12\00\00\0\0\0\10\0\2\0\20\0\4\1\10\0\250\220\354\2x\220\354\2\2\0\22\0\4\1\12\00\00\0\0\0\10\0\2\0\24\0\4\1\10\0\310\220\354\2\230\220\354\2\2\0\26\0\4\1\12\00\00\0\0\0\10\0\2\0\30\0\4\1\10\0\0\0\0\0\270\220\354\2\2\0\32\0\4\1\10\0H\0K\0R\0\0\0\3\0\34\0\4\1\10\0\360\222\354\2\0\0\0\0\0\221\354\2\16\0\0\0<\0\37\0\4\0\10\0X\3\10\0X\3\10\0\4\0\2\0\16\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\362\3\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\5\0\0\0\376\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\0D\01\09\0D\0F\08\08\02\0-\0A\09\0C\0B\0-\04\01\04\04\0-\08\0\0\0\0\0\204\3\0\0\276\6\0\0\254\1\0\0\260\1\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0d\1\0\0\276\6\0\0\254\1\0\0\260\1\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\277\6\0\0\254\1\0\0\260\1\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0`\1\0\0T\370\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\330\312\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\01\01\0\277\6\0\0\254\1\0\0\260\1\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0d\1\0\0\300\6\0\0\254\1\0\0\260\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0d\1\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\300\6\0\0\254\1\0\0\260\1\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\301\6\0\0\254\1\0\0\260\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0d\1\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) }, 900, ) == 0x0 01726 432 NtClose (356, ... ) == 0x0 01727 432 NtOpenKey (0x20019, {24, 352, 0x40, 0, 0, (0x20019, {24, 352, 0x40, 0, 0, "000000000011"}, ... 356, ) }, ... 356, ) == 0x0 01728 432 NtQueryValueKey (356, (356, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW 01729 432 NtQueryValueKey (356, (356, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW 01730 432 NtQueryValueKey (356, (356, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0gram\FSLSP.DLL\0\00\0\0\0\10\0\2\0\10\0\4\1\10\0h\220\354\28\220\354\2\2\0\12\0\4\1\12\00\00\0\0\0\10\0\2\0\14\0\4\1\10\0\210\220\354\2X\220\354\2\2\0\16\0\4\1\12\00\00\0\0\0\10\0\2\0\20\0\4\1\10\0\250\220\354\2x\220\354\2\2\0\22\0\4\1\12\00\00\0\0\0\10\0\2\0\24\0\4\1\10\0\310\220\354\2\230\220\354\2\2\0\26\0\4\1\12\00\00\0\0\0\10\0\2\0\30\0\4\1\10\0\0\0\0\0\270\220\354\2\2\0\32\0\4\1\10\0H\0K\0R\0\0\0\3\0\34\0\4\1\10\0\360\222\354\2\0\0\0\0\0\221\354\2\16\0\0\0<\0\37\0\4\0\10\0X\3\10\0X\3\10\0\4\0\2\0\11\2\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\363\3\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\2\0\0\0\376\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\0D\01\09\0D\0F\08\08\02\0-\0A\09\0C\0B\0-\04\01\04\04\0-\08\0\0\0\0\0\204\3\0\0\303\6\0\0\254\1\0\0\260\1\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0d\1\0\0\303\6\0\0\254\1\0\0\260\1\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\304\6\0\0\254\1\0\0\260\1\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0`\1\0\0\304\6\0\0\254\1\0\0\260\1\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\305\6\0\0\254\1\0\0\260\1\0\0\305\0\0\0\0\0\1\0\0\0\0\0\24\0\0\0T\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\305\6\0\0\254\1\0\0\260\1\0\0\305\0\0\0\1\0\1\0\2\1\0\0\0\0\0\0\306\6\0\0\254\1\0\0\260\1\0\0\25\0\0\0\0\0\1\0\0\0\0\0\24\0\0\0\3\0\37\0\377\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\306\6\0\0\254\1\0\0\260\1\0\0\25\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0`\1\0\0\307\6\0\0\254\1\0\0\260\1\0\0Q\0\0\0\0\0\1\0\0\0\0\0T\0\0\0\0\0\0\2\0\0\0\0\30\0\0\0X\1\0\0p\370\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0$\0&\0\250\312\24\0\0\0\0\0N\0a\0m\0e\0S\0p\0a\0c\0e\0_\0C\0a\0t\0a\0l\0o\0g\05\0"}, 900, ) , Partial, 900, ... TitleIdx=0, Type=3, Data= (356, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0gram\FSLSP.DLL\0\00\0\0\0\10\0\2\0\10\0\4\1\10\0h\220\354\28\220\354\2\2\0\12\0\4\1\12\00\00\0\0\0\10\0\2\0\14\0\4\1\10\0\210\220\354\2X\220\354\2\2\0\16\0\4\1\12\00\00\0\0\0\10\0\2\0\20\0\4\1\10\0\250\220\354\2x\220\354\2\2\0\22\0\4\1\12\00\00\0\0\0\10\0\2\0\24\0\4\1\10\0\310\220\354\2\230\220\354\2\2\0\26\0\4\1\12\00\00\0\0\0\10\0\2\0\30\0\4\1\10\0\0\0\0\0\270\220\354\2\2\0\32\0\4\1\10\0H\0K\0R\0\0\0\3\0\34\0\4\1\10\0\360\222\354\2\0\0\0\0\0\221\354\2\16\0\0\0<\0\37\0\4\0\10\0X\3\10\0X\3\10\0\4\0\2\0\11\2\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\363\3\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\2\0\0\0\376\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\0D\01\09\0D\0F\08\08\02\0-\0A\09\0C\0B\0-\04\01\04\04\0-\08\0\0\0\0\0\204\3\0\0\303\6\0\0\254\1\0\0\260\1\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0d\1\0\0\303\6\0\0\254\1\0\0\260\1\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\304\6\0\0\254\1\0\0\260\1\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0`\1\0\0\304\6\0\0\254\1\0\0\260\1\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\305\6\0\0\254\1\0\0\260\1\0\0\305\0\0\0\0\0\1\0\0\0\0\0\24\0\0\0T\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\305\6\0\0\254\1\0\0\260\1\0\0\305\0\0\0\1\0\1\0\2\1\0\0\0\0\0\0\306\6\0\0\254\1\0\0\260\1\0\0\25\0\0\0\0\0\1\0\0\0\0\0\24\0\0\0\3\0\37\0\377\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\306\6\0\0\254\1\0\0\260\1\0\0\25\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0`\1\0\0\307\6\0\0\254\1\0\0\260\1\0\0Q\0\0\0\0\0\1\0\0\0\0\0T\0\0\0\0\0\0\2\0\0\0\0\30\0\0\0X\1\0\0p\370\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0$\0&\0\250\312\24\0\0\0\0\0N\0a\0m\0e\0S\0p\0a\0c\0e\0_\0C\0a\0t\0a\0l\0o\0g\05\0"}, 900, ) }, 900, ) == 0x0 01731 432 NtClose (356, ... ) == 0x0 01732 432 NtClose (352, ... ) == 0x0 01733 432 NtWaitForSingleObject (340, 0, {0, 0}, ... ) == 0x102 01734 432 NtCreateEvent (0x1f0003, 0x0, 0, 0, ... 352, ) == 0x0 01735 432 NtOpenKey (0x2000000, {24, 344, 0x40, 0, 0, (0x2000000, {24, 344, 0x40, 0, 0, "NameSpace_Catalog5"}, ... 356, ) }, ... 356, ) == 0x0 01736 432 NtQueryValueKey (356, (356, "Serial_Access_Num", Partial, 144, ... TitleIdx=0, Type=4, Data="\4\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (356, "Serial_Access_Num", Partial, 144, ... TitleIdx=0, Type=4, Data="\4\0\0\0"}, 16, ) }, 16, ) == 0x0 01737 432 NtNotifyChangeKey (356, 352, 0, 0, 2011390432, 1, 0, 0, 0, 1, ... ) == 0x103 01738 432 NtQueryValueKey (356, (356, "Serial_Access_Num", Partial, 144, ... TitleIdx=0, Type=4, Data="\4\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (356, "Serial_Access_Num", Partial, 144, ... TitleIdx=0, Type=4, Data="\4\0\0\0"}, 16, ) }, 16, ) == 0x0 01739 432 NtOpenKey (0x2000000, {24, 356, 0x40, 0, 0, (0x2000000, {24, 356, 0x40, 0, 0, "00000004"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 01740 432 NtQueryValueKey (356, (356, "Num_Catalog_Entries", Partial, 144, ... TitleIdx=0, Type=4, Data="\3\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (356, "Num_Catalog_Entries", Partial, 144, ... TitleIdx=0, Type=4, Data="\3\0\0\0"}, 16, ) }, 16, ) == 0x0 01741 432 NtOpenKey (0x2000000, {24, 356, 0x40, 0, 0, (0x2000000, {24, 356, 0x40, 0, 0, "Catalog_Entries"}, ... 360, ) }, ... 360, ) == 0x0 01742 432 NtOpenKey (0x20019, {24, 360, 0x40, 0, 0, (0x20019, {24, 360, 0x40, 0, 0, "000000000001"}, ... 364, ) }, ... 364, ) == 0x0 01743 432 NtQueryValueKey (364, (364, "LibraryPath", Partial, 144, ... TitleIdx=0, Type=1, Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0m\0s\0w\0s\0o\0c\0k\0.\0d\0l\0l\0\0\0"}, 80, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (364, "LibraryPath", Partial, 144, ... TitleIdx=0, Type=1, Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0m\0s\0w\0s\0o\0c\0k\0.\0d\0l\0l\0\0\0"}, 80, ) }, 80, ) == 0x0 01744 432 NtQueryValueKey (364, (364, "LibraryPath", Partial, 144, ... TitleIdx=0, Type=1, Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0m\0s\0w\0s\0o\0c\0k\0.\0d\0l\0l\0\0\0"}, 80, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (364, "LibraryPath", Partial, 144, ... TitleIdx=0, Type=1, Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0m\0s\0w\0s\0o\0c\0k\0.\0d\0l\0l\0\0\0"}, 80, ) }, 80, ) == 0x0 01745 432 NtQueryValueKey (364, (364, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="T\0c\0p\0i\0p\0\0\0"}, 24, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (364, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="T\0c\0p\0i\0p\0\0\0"}, 24, ) }, 24, ) == 0x0 01746 432 NtQueryValueKey (364, (364, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="T\0c\0p\0i\0p\0\0\0"}, 24, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (364, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="T\0c\0p\0i\0p\0\0\0"}, 24, ) }, 24, ) == 0x0 01747 432 NtQueryValueKey (364, (364, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="T\0c\0p\0i\0p\0\0\0"}, 24, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (364, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="T\0c\0p\0i\0p\0\0\0"}, 24, ) }, 24, ) == 0x0 01748 432 NtQueryValueKey (364, (364, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="T\0c\0p\0i\0p\0\0\0"}, 24, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (364, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="T\0c\0p\0i\0p\0\0\0"}, 24, ) }, 24, ) == 0x0 01749 432 NtQueryValueKey (364, (364, "ProviderId", Partial, 144, ... TitleIdx=0, Type=3, Data="@\235\5"\236~\317\21\256Z\0\252\0\247\21+"}, 28, ) , Partial, 144, ... TitleIdx=0, Type=3, Data= (364, "ProviderId", Partial, 144, ... TitleIdx=0, Type=3, Data="@\235\5"\236~\317\21\256Z\0\252\0\247\21+"}, 28, ) \236~\317\21\256Z\0\252\0\247\21+"}, 28, ) == 0x0 01750 432 NtQueryValueKey (364, (364, "AddressFamily", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 01751 432 NtQueryValueKey (364, (364, "SupportedNameSpace", Partial, 144, ... TitleIdx=0, Type=4, Data="\14\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (364, "SupportedNameSpace", Partial, 144, ... TitleIdx=0, Type=4, Data="\14\0\0\0"}, 16, ) }, 16, ) == 0x0 01752 432 NtQueryValueKey (364, (364, "Enabled", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (364, "Enabled", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) }, 16, ) == 0x0 01753 432 NtQueryValueKey (364, (364, "Version", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (364, "Version", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) }, 16, ) == 0x0 01754 432 NtQueryValueKey (364, (364, "StoresServiceClassInfo", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (364, "StoresServiceClassInfo", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) }, 16, ) == 0x0 01755 432 NtClose (364, ... ) == 0x0 01756 432 NtOpenKey (0x20019, {24, 360, 0x40, 0, 0, (0x20019, {24, 360, 0x40, 0, 0, "000000000002"}, ... 364, ) }, ... 364, ) == 0x0 01757 432 NtQueryValueKey (364, (364, "LibraryPath", Partial, 144, ... TitleIdx=0, Type=1, Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0w\0i\0n\0r\0n\0r\0.\0d\0l\0l\0\0\0"}, 78, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (364, "LibraryPath", Partial, 144, ... TitleIdx=0, Type=1, Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0w\0i\0n\0r\0n\0r\0.\0d\0l\0l\0\0\0"}, 78, ) }, 78, ) == 0x0 01758 432 NtQueryValueKey (364, (364, "LibraryPath", Partial, 144, ... TitleIdx=0, Type=1, Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0w\0i\0n\0r\0n\0r\0.\0d\0l\0l\0\0\0"}, 78, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (364, "LibraryPath", Partial, 144, ... TitleIdx=0, Type=1, Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0w\0i\0n\0r\0n\0r\0.\0d\0l\0l\0\0\0"}, 78, ) }, 78, ) == 0x0 01759 432 NtQueryValueKey (364, (364, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="N\0T\0D\0S\0\0\0"}, 22, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (364, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="N\0T\0D\0S\0\0\0"}, 22, ) }, 22, ) == 0x0 01760 432 NtQueryValueKey (364, (364, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="N\0T\0D\0S\0\0\0"}, 22, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (364, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="N\0T\0D\0S\0\0\0"}, 22, ) }, 22, ) == 0x0 01761 432 NtQueryValueKey (364, (364, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="N\0T\0D\0S\0\0\0"}, 22, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (364, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="N\0T\0D\0S\0\0\0"}, 22, ) }, 22, ) == 0x0 01762 432 NtQueryValueKey (364, (364, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="N\0T\0D\0S\0\0\0"}, 22, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (364, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="N\0T\0D\0S\0\0\0"}, 22, ) }, 22, ) == 0x0 01763 432 NtQueryValueKey (364, (364, "ProviderId", Partial, 144, ... TitleIdx=0, Type=3, Data="\3567&;\200\345\317\21\245U\0\300O\330\324\254"}, 28, ) , Partial, 144, ... TitleIdx=0, Type=3, Data= (364, "ProviderId", Partial, 144, ... TitleIdx=0, Type=3, Data="\3567&;\200\345\317\21\245U\0\300O\330\324\254"}, 28, ) }, 28, ) == 0x0 01764 432 NtQueryValueKey (364, (364, "AddressFamily", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 01765 432 NtQueryValueKey (364, (364, "SupportedNameSpace", Partial, 144, ... TitleIdx=0, Type=4, Data=" \0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (364, "SupportedNameSpace", Partial, 144, ... TitleIdx=0, Type=4, Data=" \0\0\0"}, 16, ) }, 16, ) == 0x0 01766 432 NtQueryValueKey (364, (364, "Enabled", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (364, "Enabled", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) }, 16, ) == 0x0 01767 432 NtQueryValueKey (364, (364, "Version", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (364, "Version", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) }, 16, ) == 0x0 01768 432 NtQueryValueKey (364, (364, "StoresServiceClassInfo", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (364, "StoresServiceClassInfo", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) }, 16, ) == 0x0 01769 432 NtClose (364, ... ) == 0x0 01770 432 NtAllocateVirtualMemory (-1, 1376256, 0, 4096, 4096, 4, ... 1376256, 4096, ) == 0x0 01771 432 NtOpenKey (0x20019, {24, 360, 0x40, 0, 0, (0x20019, {24, 360, 0x40, 0, 0, "000000000003"}, ... 364, ) }, ... 364, ) == 0x0 01772 432 NtQueryValueKey (364, (364, "LibraryPath", Partial, 144, ... TitleIdx=0, Type=1, Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0m\0s\0w\0s\0o\0c\0k\0.\0d\0l\0l\0\0\0"}, 80, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (364, "LibraryPath", Partial, 144, ... TitleIdx=0, Type=1, Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0m\0s\0w\0s\0o\0c\0k\0.\0d\0l\0l\0\0\0"}, 80, ) }, 80, ) == 0x0 01773 432 NtQueryValueKey (364, (364, "LibraryPath", Partial, 144, ... TitleIdx=0, Type=1, Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0m\0s\0w\0s\0o\0c\0k\0.\0d\0l\0l\0\0\0"}, 80, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (364, "LibraryPath", Partial, 144, ... TitleIdx=0, Type=1, Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0m\0s\0w\0s\0o\0c\0k\0.\0d\0l\0l\0\0\0"}, 80, ) }, 80, ) == 0x0 01774 432 NtQueryValueKey (364, (364, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="N\0e\0t\0w\0o\0r\0k\0 \0L\0o\0c\0a\0t\0i\0o\0n\0 \0A\0w\0a\0r\0e\0n\0e\0s\0s\0 \0(\0N\0L\0A\0)\0 \0N\0a\0m\0e\0s\0p\0a\0c\0e\0\0\0"}, 98, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (364, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="N\0e\0t\0w\0o\0r\0k\0 \0L\0o\0c\0a\0t\0i\0o\0n\0 \0A\0w\0a\0r\0e\0n\0e\0s\0s\0 \0(\0N\0L\0A\0)\0 \0N\0a\0m\0e\0s\0p\0a\0c\0e\0\0\0"}, 98, ) }, 98, ) == 0x0 01775 432 NtQueryValueKey (364, (364, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="N\0e\0t\0w\0o\0r\0k\0 \0L\0o\0c\0a\0t\0i\0o\0n\0 \0A\0w\0a\0r\0e\0n\0e\0s\0s\0 \0(\0N\0L\0A\0)\0 \0N\0a\0m\0e\0s\0p\0a\0c\0e\0\0\0"}, 98, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (364, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="N\0e\0t\0w\0o\0r\0k\0 \0L\0o\0c\0a\0t\0i\0o\0n\0 \0A\0w\0a\0r\0e\0n\0e\0s\0s\0 \0(\0N\0L\0A\0)\0 \0N\0a\0m\0e\0s\0p\0a\0c\0e\0\0\0"}, 98, ) }, 98, ) == 0x0 01776 432 NtQueryValueKey (364, (364, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="N\0e\0t\0w\0o\0r\0k\0 \0L\0o\0c\0a\0t\0i\0o\0n\0 \0A\0w\0a\0r\0e\0n\0e\0s\0s\0 \0(\0N\0L\0A\0)\0 \0N\0a\0m\0e\0s\0p\0a\0c\0e\0\0\0"}, 98, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (364, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="N\0e\0t\0w\0o\0r\0k\0 \0L\0o\0c\0a\0t\0i\0o\0n\0 \0A\0w\0a\0r\0e\0n\0e\0s\0s\0 \0(\0N\0L\0A\0)\0 \0N\0a\0m\0e\0s\0p\0a\0c\0e\0\0\0"}, 98, ) }, 98, ) == 0x0 01777 432 NtQueryValueKey (364, (364, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="N\0e\0t\0w\0o\0r\0k\0 \0L\0o\0c\0a\0t\0i\0o\0n\0 \0A\0w\0a\0r\0e\0n\0e\0s\0s\0 \0(\0N\0L\0A\0)\0 \0N\0a\0m\0e\0s\0p\0a\0c\0e\0\0\0"}, 98, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (364, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="N\0e\0t\0w\0o\0r\0k\0 \0L\0o\0c\0a\0t\0i\0o\0n\0 \0A\0w\0a\0r\0e\0n\0e\0s\0s\0 \0(\0N\0L\0A\0)\0 \0N\0a\0m\0e\0s\0p\0a\0c\0e\0\0\0"}, 98, ) }, 98, ) == 0x0 01778 432 NtQueryValueKey (364, (364, "ProviderId", Partial, 144, ... TitleIdx=0, Type=3, Data=":$Bf\250;\246J\272\245.\13\327\37\335\203"}, 28, ) , Partial, 144, ... TitleIdx=0, Type=3, Data= (364, "ProviderId", Partial, 144, ... TitleIdx=0, Type=3, Data=":$Bf\250;\246J\272\245.\13\327\37\335\203"}, 28, ) }, 28, ) == 0x0 01779 432 NtQueryValueKey (364, (364, "AddressFamily", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 01780 432 NtQueryValueKey (364, (364, "SupportedNameSpace", Partial, 144, ... TitleIdx=0, Type=4, Data="\17\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (364, "SupportedNameSpace", Partial, 144, ... TitleIdx=0, Type=4, Data="\17\0\0\0"}, 16, ) }, 16, ) == 0x0 01781 432 NtQueryValueKey (364, (364, "Enabled", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (364, "Enabled", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) }, 16, ) == 0x0 01782 432 NtQueryValueKey (364, (364, "Version", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (364, "Version", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) }, 16, ) == 0x0 01783 432 NtQueryValueKey (364, (364, "StoresServiceClassInfo", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (364, "StoresServiceClassInfo", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) }, 16, ) == 0x0 01784 432 NtClose (364, ... ) == 0x0 01785 432 NtClose (360, ... ) == 0x0 01786 432 NtWaitForSingleObject (352, 0, {0, 0}, ... ) == 0x102 01787 432 NtClose (344, ... ) == 0x0 01788 432 NtQuerySystemInformation (Basic, 44, ... {Unknown=0,MaximumIncrement=156250,PhysicalPageSize=0x1000,NumberOfPhysicalPages=0xff7c,LowestPhysicalPage=0x1,HighestPhysicalPage=0xffff,AllocationGranularity=0x10000,LowestUserAddress=0x10000,HighestUserAddress=0x7ffeffff,ActiveProcessors=1,NumberProcessors=1,}, 0x0, ) == 0x0 01789 432 NtQuerySystemInformation (Processor, 12, ... {system info, class 1, size 12}, 0x0, ) == 0x0 01790 432 NtOpenKey (0x1, {24, 48, 0x40, 0, 0, (0x1, {24, 48, 0x40, 0, 0, "System\CurrentControlSet\Services\Winsock2\Parameters"}, ... 344, ) }, ... 344, ) == 0x0 01791 432 NtQueryValueKey (344, (344, "Ws2_32NumHandleBuckets", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 01792 432 NtClose (344, ... ) == 0x0 01793 432 NtDuplicateObject (-1, -2, -1, 0x0, 0, 2, ... 344, ) == 0x0 01794 432 NtClearEvent (312, ... ) == 0x0 01795 432 NtSetEvent (312, ... 0x0, ) == 0x0 01796 432 NtOpenSection (0xe, {24, 8, 0x40, 0, 0, (0xe, {24, 8, 0x40, 0, 0, "icmp.dll"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 01797 432 NtQueryAttributesFile ({24, 0, 0x40, 0, 0, ({24, 0, 0x40, 0, 0, "\??\u:\work\icmp.dll"}, 1242008, ... ) }, 1242008, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 01798 432 NtQueryAttributesFile ({24, 12, 0x40, 0, 0, ({24, 12, 0x40, 0, 0, "icmp.dll"}, 1242008, ... ) }, 1242008, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 01799 432 NtQueryAttributesFile ({24, 0, 0x40, 0, 0, ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\System32\icmp.dll"}, 1242008, ... ) }, 1242008, ... ) == 0x0 01800 432 NtOpenFile (0x100020, {24, 0, 0x40, 0, 0, (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\System32\icmp.dll"}, 5, 96, ... 360, {status=0x0, info=1}, ) }, 5, 96, ... 360, {status=0x0, info=1}, ) == 0x0 01801 432 NtCreateSection (0xf, 0x0, 0x0, 16, 16777216, 360, ... 364, ) == 0x0 01802 432 NtQuerySection (364, Image, 48, ... {section info, class 1, size 48}, 0x0, ) == 0x0 01803 432 NtClose (360, ... ) == 0x0 01804 432 NtMapViewOfSection (364, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x74290000), 0x0, 16384, ) == 0x0 01805 432 NtClose (364, ... ) == 0x0 01806 432 NtOpenSection (0xe, {24, 8, 0x40, 0, 0, (0xe, {24, 8, 0x40, 0, 0, "iphlpapi.dll"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 01807 432 NtQueryAttributesFile ({24, 0, 0x40, 0, 0, ({24, 0, 0x40, 0, 0, "\??\u:\work\iphlpapi.dll"}, 1242472, ... ) }, 1242472, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 01808 432 NtQueryAttributesFile ({24, 12, 0x40, 0, 0, ({24, 12, 0x40, 0, 0, "iphlpapi.dll"}, 1242472, ... ) }, 1242472, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 01809 432 NtQueryAttributesFile ({24, 0, 0x40, 0, 0, ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\System32\iphlpapi.dll"}, 1242472, ... ) }, 1242472, ... ) == 0x0 01810 432 NtOpenFile (0x100020, {24, 0, 0x40, 0, 0, (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\System32\iphlpapi.dll"}, 5, 96, ... 364, {status=0x0, info=1}, ) }, 5, 96, ... 364, {status=0x0, info=1}, ) == 0x0 01811 432 NtCreateSection (0xf, 0x0, 0x0, 16, 16777216, 364, ... 360, ) == 0x0 01812 432 NtQuerySection (360, Image, 48, ... {section info, class 1, size 48}, 0x0, ) == 0x0 01813 432 NtClose (364, ... ) == 0x0 01814 432 NtMapViewOfSection (360, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x76d60000), 0x0, 86016, ) == 0x0 01815 432 NtClose (360, ... ) == 0x0 01816 432 NtOpenSection (0xe, {24, 8, 0x40, 0, 0, (0xe, {24, 8, 0x40, 0, 0, "netman.dll"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 01817 432 NtQueryAttributesFile ({24, 0, 0x40, 0, 0, ({24, 0, 0x40, 0, 0, "\??\u:\work\netman.dll"}, 1241668, ... ) }, 1241668, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 01818 432 NtQueryAttributesFile ({24, 12, 0x40, 0, 0, ({24, 12, 0x40, 0, 0, "netman.dll"}, 1241668, ... ) }, 1241668, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 01819 432 NtQueryAttributesFile ({24, 0, 0x40, 0, 0, ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\System32\netman.dll"}, 1241668, ... ) }, 1241668, ... ) == 0x0 01820 432 NtOpenFile (0x100020, {24, 0, 0x40, 0, 0, (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\System32\netman.dll"}, 5, 96, ... 360, {status=0x0, info=1}, ) }, 5, 96, ... 360, {status=0x0, info=1}, ) == 0x0 01821 432 NtCreateSection (0xf, 0x0, 0x0, 16, 16777216, 360, ... 364, ) == 0x0 01822 432 NtQuerySection (364, Image, 48, ... {section info, class 1, size 48}, 0x0, ) == 0x0 01823 432 NtClose (360, ... ) == 0x0 01824 432 NtMapViewOfSection (364, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x76de0000), 0x0, 155648, ) == 0x0 01825 432 NtClose (364, ... ) == 0x0 01826 432 NtOpenSection (0xe, {24, 8, 0x40, 0, 0, (0xe, {24, 8, 0x40, 0, 0, "MPRAPI.dll"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 01827 432 NtQueryAttributesFile ({24, 0, 0x40, 0, 0, ({24, 0, 0x40, 0, 0, "\??\u:\work\MPRAPI.dll"}, 1240864, ... ) }, 1240864, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 01828 432 NtQueryAttributesFile ({24, 12, 0x40, 0, 0, ({24, 12, 0x40, 0, 0, "MPRAPI.dll"}, 1240864, ... ) }, 1240864, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 01829 432 NtQueryAttributesFile ({24, 0, 0x40, 0, 0, ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\System32\MPRAPI.dll"}, 1240864, ... ) }, 1240864, ... ) == 0x0 01830 432 NtOpenFile (0x100020, {24, 0, 0x40, 0, 0, (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\System32\MPRAPI.dll"}, 5, 96, ... 364, {status=0x0, info=1}, ) }, 5, 96, ... 364, {status=0x0, info=1}, ) == 0x0 01831 432 NtCreateSection (0xf, 0x0, 0x0, 16, 16777216, 364, ... 360, ) == 0x0 01832 432 NtQuerySection (360, Image, 48, ... {section info, class 1, size 48}, 0x0, ) == 0x0 01833 432 NtClose (364, ... ) == 0x0 01834 432 NtMapViewOfSection (360, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x76d40000), 0x0, 90112, ) == 0x0 01835 432 NtClose (360, ... ) == 0x0 01836 432 NtOpenSection (0xe, {24, 8, 0x40, 0, 0, (0xe, {24, 8, 0x40, 0, 0, "ACTIVEDS.dll"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 01837 432 NtQueryAttributesFile ({24, 0, 0x40, 0, 0, ({24, 0, 0x40, 0, 0, "\??\u:\work\ACTIVEDS.dll"}, 1240060, ... ) }, 1240060, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 01838 432 NtQueryAttributesFile ({24, 12, 0x40, 0, 0, ({24, 12, 0x40, 0, 0, "ACTIVEDS.dll"}, 1240060, ... ) }, 1240060, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 01839 432 NtQueryAttributesFile ({24, 0, 0x40, 0, 0, ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\System32\ACTIVEDS.dll"}, 1240060, ... ) }, 1240060, ... ) == 0x0 01840 432 NtOpenFile (0x100020, {24, 0, 0x40, 0, 0, (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\System32\ACTIVEDS.dll"}, 5, 96, ... 360, {status=0x0, info=1}, ) }, 5, 96, ... 360, {status=0x0, info=1}, ) == 0x0 01841 432 NtCreateSection (0xf, 0x0, 0x0, 16, 16777216, 360, ... 364, ) == 0x0 01842 432 NtQuerySection (364, Image, 48, ... {section info, class 1, size 48}, 0x0, ) == 0x0 01843 432 NtClose (360, ... ) == 0x0 01844 432 NtMapViewOfSection (364, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x76e40000), 0x0, 192512, ) == 0x0 01845 432 NtClose (364, ... ) == 0x0 01846 432 NtOpenSection (0xe, {24, 8, 0x40, 0, 0, (0xe, {24, 8, 0x40, 0, 0, "adsldpc.dll"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 01847 432 NtQueryAttributesFile ({24, 0, 0x40, 0, 0, ({24, 0, 0x40, 0, 0, "\??\u:\work\adsldpc.dll"}, 1239256, ... ) }, 1239256, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 01848 432 NtQueryAttributesFile ({24, 12, 0x40, 0, 0, ({24, 12, 0x40, 0, 0, "adsldpc.dll"}, 1239256, ... ) }, 1239256, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 01849 432 NtQueryAttributesFile ({24, 0, 0x40, 0, 0, ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\System32\adsldpc.dll"}, 1239256, ... ) }, 1239256, ... ) == 0x0 01850 432 NtOpenFile (0x100020, {24, 0, 0x40, 0, 0, (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\System32\adsldpc.dll"}, 5, 96, ... 364, {status=0x0, info=1}, ) }, 5, 96, ... 364, {status=0x0, info=1}, ) == 0x0 01851 432 NtCreateSection (0xf, 0x0, 0x0, 16, 16777216, 364, ... 360, ) == 0x0 01852 432 NtQuerySection (360, Image, 48, ... {section info, class 1, size 48}, 0x0, ) == 0x0 01853 432 NtClose (364, ... ) == 0x0 01854 432 NtMapViewOfSection (360, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x76e10000), 0x0, 147456, ) == 0x0 01855 432 NtClose (360, ... ) == 0x0 01856 432 NtOpenSection (0xe, {24, 8, 0x40, 0, 0, (0xe, {24, 8, 0x40, 0, 0, "NETAPI32.dll"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 01857 432 NtQueryAttributesFile ({24, 0, 0x40, 0, 0, ({24, 0, 0x40, 0, 0, "\??\u:\work\NETAPI32.dll"}, 1238452, ... ) }, 1238452, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 01858 432 NtQueryAttributesFile ({24, 12, 0x40, 0, 0, ({24, 12, 0x40, 0, 0, "NETAPI32.dll"}, 1238452, ... ) }, 1238452, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 01859 432 NtQueryAttributesFile ({24, 0, 0x40, 0, 0, ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\System32\NETAPI32.dll"}, 1238452, ... ) }, 1238452, ... ) == 0x0 01860 432 NtOpenFile (0x100020, {24, 0, 0x40, 0, 0, (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\System32\NETAPI32.dll"}, 5, 96, ... 360, {status=0x0, info=1}, ) }, 5, 96, ... 360, {status=0x0, info=1}, ) == 0x0 01861 432 NtCreateSection (0xf, 0x0, 0x0, 16, 16777216, 360, ... 364, ) == 0x0 01862 432 NtQuerySection (364, Image, 48, ... {section info, class 1, size 48}, 0x0, ) == 0x0 01863 432 NtClose (360, ... ) == 0x0 01864 432 NtMapViewOfSection (364, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x71c20000), 0x0, 323584, ) == 0x0 01865 432 NtClose (364, ... ) == 0x0 01866 432 NtOpenSection (0xe, {24, 8, 0x40, 0, 0, (0xe, {24, 8, 0x40, 0, 0, "WLDAP32.dll"}, ... 364, ) }, ... 364, ) == 0x0 01867 432 NtMapViewOfSection (364, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x76f60000), 0x0, 180224, ) == 0x0 01868 432 NtClose (364, ... ) == 0x0 01869 432 NtOpenSection (0xe, {24, 8, 0x40, 0, 0, (0xe, {24, 8, 0x40, 0, 0, "ATL.DLL"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 01870 432 NtQueryAttributesFile ({24, 0, 0x40, 0, 0, ({24, 0, 0x40, 0, 0, "\??\u:\work\ATL.DLL"}, 1239256, ... ) }, 1239256, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 01871 432 NtQueryAttributesFile ({24, 12, 0x40, 0, 0, ({24, 12, 0x40, 0, 0, "ATL.DLL"}, 1239256, ... ) }, 1239256, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 01872 432 NtQueryAttributesFile ({24, 0, 0x40, 0, 0, ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\System32\ATL.DLL"}, 1239256, ... ) }, 1239256, ... ) == 0x0 01873 432 NtOpenFile (0x100020, {24, 0, 0x40, 0, 0, (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\System32\ATL.DLL"}, 5, 96, ... 364, {status=0x0, info=1}, ) }, 5, 96, ... 364, {status=0x0, info=1}, ) == 0x0 01874 432 NtCreateSection (0xf, 0x0, 0x0, 16, 16777216, 364, ... 360, ) == 0x0 01875 432 NtQuerySection (360, Image, 48, ... {section info, class 1, size 48}, 0x0, ) == 0x0 01876 432 NtClose (364, ... ) == 0x0 01877 432 NtMapViewOfSection (360, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x76b20000), 0x0, 86016, ) == 0x0 01878 432 NtClose (360, ... ) == 0x0 01879 432 NtOpenSection (0xe, {24, 8, 0x40, 0, 0, (0xe, {24, 8, 0x40, 0, 0, "rtutils.dll"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 01880 432 NtQueryAttributesFile ({24, 0, 0x40, 0, 0, ({24, 0, 0x40, 0, 0, "\??\u:\work\rtutils.dll"}, 1240060, ... ) }, 1240060, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 01881 432 NtQueryAttributesFile ({24, 12, 0x40, 0, 0, ({24, 12, 0x40, 0, 0, "rtutils.dll"}, 1240060, ... ) }, 1240060, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 01882 432 NtQueryAttributesFile ({24, 0, 0x40, 0, 0, ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\System32\rtutils.dll"}, 1240060, ... ) }, 1240060, ... ) == 0x0 01883 432 NtOpenFile (0x100020, {24, 0, 0x40, 0, 0, (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\System32\rtutils.dll"}, 5, 96, ... 360, {status=0x0, info=1}, ) }, 5, 96, ... 360, {status=0x0, info=1}, ) == 0x0 01884 432 NtCreateSection (0xf, 0x0, 0x0, 16, 16777216, 360, ... 364, ) == 0x0 01885 432 NtQuerySection (364, Image, 48, ... {section info, class 1, size 48}, 0x0, ) == 0x0 01886 432 NtClose (360, ... ) == 0x0 01887 432 NtMapViewOfSection (364, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x76e80000), 0x0, 53248, ) == 0x0 01888 432 NtClose (364, ... ) == 0x0 01889 432 NtOpenSection (0xe, {24, 8, 0x40, 0, 0, (0xe, {24, 8, 0x40, 0, 0, "SAMLIB.dll"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 01890 432 NtQueryAttributesFile ({24, 0, 0x40, 0, 0, ({24, 0, 0x40, 0, 0, "\??\u:\work\SAMLIB.dll"}, 1240060, ... ) }, 1240060, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 01891 432 NtQueryAttributesFile ({24, 12, 0x40, 0, 0, ({24, 12, 0x40, 0, 0, "SAMLIB.dll"}, 1240060, ... ) }, 1240060, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 01892 432 NtQueryAttributesFile ({24, 0, 0x40, 0, 0, ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\System32\SAMLIB.dll"}, 1240060, ... ) }, 1240060, ... ) == 0x0 01893 432 NtOpenFile (0x100020, {24, 0, 0x40, 0, 0, (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\System32\SAMLIB.dll"}, 5, 96, ... 364, {status=0x0, info=1}, ) }, 5, 96, ... 364, {status=0x0, info=1}, ) == 0x0 01894 432 NtCreateSection (0xf, 0x0, 0x0, 16, 16777216, 364, ... 360, ) == 0x0 01895 432 NtQuerySection (360, Image, 48, ... {section info, class 1, size 48}, 0x0, ) == 0x0 01896 432 NtClose (364, ... ) == 0x0 01897 432 NtMapViewOfSection (360, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x71bf0000), 0x0, 69632, ) == 0x0 01898 432 NtClose (360, ... ) == 0x0 01899 432 NtOpenSection (0xe, {24, 8, 0x40, 0, 0, (0xe, {24, 8, 0x40, 0, 0, "SETUPAPI.dll"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 01900 432 NtQueryAttributesFile ({24, 0, 0x40, 0, 0, ({24, 0, 0x40, 0, 0, "\??\u:\work\SETUPAPI.dll"}, 1240060, ... ) }, 1240060, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 01901 432 NtQueryAttributesFile ({24, 12, 0x40, 0, 0, ({24, 12, 0x40, 0, 0, "SETUPAPI.dll"}, 1240060, ... ) }, 1240060, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 01902 432 NtQueryAttributesFile ({24, 0, 0x40, 0, 0, ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\System32\SETUPAPI.dll"}, 1240060, ... ) }, 1240060, ... ) == 0x0 01903 432 NtOpenFile (0x100020, {24, 0, 0x40, 0, 0, (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\System32\SETUPAPI.dll"}, 5, 96, ... 360, {status=0x0, info=1}, ) }, 5, 96, ... 360, {status=0x0, info=1}, ) == 0x0 01904 432 NtCreateSection (0xf, 0x0, 0x0, 16, 16777216, 360, ... 364, ) == 0x0 01905 432 NtQuerySection (364, Image, 48, ... {section info, class 1, size 48}, 0x0, ) == 0x0 01906 432 NtClose (360, ... ) == 0x0 01907 432 NtMapViewOfSection (364, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x76670000), 0x0, 933888, ) == 0x0 01908 432 NtClose (364, ... ) == 0x0 01909 432 NtOpenSection (0xe, {24, 8, 0x40, 0, 0, (0xe, {24, 8, 0x40, 0, 0, "RASAPI32.dll"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 01910 432 NtQueryAttributesFile ({24, 0, 0x40, 0, 0, ({24, 0, 0x40, 0, 0, "\??\u:\work\RASAPI32.dll"}, 1240864, ... ) }, 1240864, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 01911 432 NtQueryAttributesFile ({24, 12, 0x40, 0, 0, ({24, 12, 0x40, 0, 0, "RASAPI32.dll"}, 1240864, ... ) }, 1240864, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 01912 432 NtQueryAttributesFile ({24, 0, 0x40, 0, 0, ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\System32\RASAPI32.dll"}, 1240864, ... ) }, 1240864, ... ) == 0x0 01913 432 NtOpenFile (0x100020, {24, 0, 0x40, 0, 0, (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\System32\RASAPI32.dll"}, 5, 96, ... 364, {status=0x0, info=1}, ) }, 5, 96, ... 364, {status=0x0, info=1}, ) == 0x0 01914 432 NtCreateSection (0xf, 0x0, 0x0, 16, 16777216, 364, ... 360, ) == 0x0 01915 432 NtQuerySection (360, Image, 48, ... {section info, class 1, size 48}, 0x0, ) == 0x0 01916 432 NtClose (364, ... ) == 0x0 01917 432 NtMapViewOfSection (360, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x76ee0000), 0x0, 225280, ) == 0x0 01918 432 NtClose (360, ... ) == 0x0 01919 432 NtOpenSection (0xe, {24, 8, 0x40, 0, 0, (0xe, {24, 8, 0x40, 0, 0, "rasman.dll"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 01920 432 NtQueryAttributesFile ({24, 0, 0x40, 0, 0, ({24, 0, 0x40, 0, 0, "\??\u:\work\rasman.dll"}, 1240060, ... ) }, 1240060, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 01921 432 NtQueryAttributesFile ({24, 12, 0x40, 0, 0, ({24, 12, 0x40, 0, 0, "rasman.dll"}, 1240060, ... ) }, 1240060, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 01922 432 NtQueryAttributesFile ({24, 0, 0x40, 0, 0, ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\System32\rasman.dll"}, 1240060, ... ) }, 1240060, ... ) == 0x0 01923 432 NtOpenFile (0x100020, {24, 0, 0x40, 0, 0, (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\System32\rasman.dll"}, 5, 96, ... 360, {status=0x0, info=1}, ) }, 5, 96, ... 360, {status=0x0, info=1}, ) == 0x0 01924 432 NtCreateSection (0xf, 0x0, 0x0, 16, 16777216, 360, ... 364, ) == 0x0 01925 432 NtQuerySection (364, Image, 48, ... {section info, class 1, size 48}, 0x0, ) == 0x0 01926 432 NtClose (360, ... ) == 0x0 01927 432 NtMapViewOfSection (364, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x76e90000), 0x0, 69632, ) == 0x0 01928 432 NtClose (364, ... ) == 0x0 01929 432 NtOpenSection (0xe, {24, 8, 0x40, 0, 0, (0xe, {24, 8, 0x40, 0, 0, "TAPI32.dll"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 01930 432 NtQueryAttributesFile ({24, 0, 0x40, 0, 0, ({24, 0, 0x40, 0, 0, "\??\u:\work\TAPI32.dll"}, 1240060, ... ) }, 1240060, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 01931 432 NtQueryAttributesFile ({24, 12, 0x40, 0, 0, ({24, 12, 0x40, 0, 0, "TAPI32.dll"}, 1240060, ... ) }, 1240060, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 01932 432 NtQueryAttributesFile ({24, 0, 0x40, 0, 0, ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\System32\TAPI32.dll"}, 1240060, ... ) }, 1240060, ... ) == 0x0 01933 432 NtOpenFile (0x100020, {24, 0, 0x40, 0, 0, (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\System32\TAPI32.dll"}, 5, 96, ... 364, {status=0x0, info=1}, ) }, 5, 96, ... 364, {status=0x0, info=1}, ) == 0x0 01934 432 NtCreateSection (0xf, 0x0, 0x0, 16, 16777216, 364, ... 360, ) == 0x0 01935 432 NtQuerySection (360, Image, 48, ... {section info, class 1, size 48}, 0x0, ) == 0x0 01936 432 NtClose (364, ... ) == 0x0 01937 432 NtMapViewOfSection (360, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x76eb0000), 0x0, 172032, ) == 0x0 01938 432 NtClose (360, ... ) == 0x0 01939 432 NtOpenSection (0xe, {24, 8, 0x40, 0, 0, (0xe, {24, 8, 0x40, 0, 0, "WZCSvc.DLL"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 01940 432 NtQueryAttributesFile ({24, 0, 0x40, 0, 0, ({24, 0, 0x40, 0, 0, "\??\u:\work\WZCSvc.DLL"}, 1240864, ... ) }, 1240864, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 01941 432 NtQueryAttributesFile ({24, 12, 0x40, 0, 0, ({24, 12, 0x40, 0, 0, "WZCSvc.DLL"}, 1240864, ... ) }, 1240864, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 01942 432 NtQueryAttributesFile ({24, 0, 0x40, 0, 0, ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\System32\WZCSvc.DLL"}, 1240864, ... ) }, 1240864, ... ) == 0x0 01943 432 NtOpenFile (0x100020, {24, 0, 0x40, 0, 0, (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\System32\WZCSvc.DLL"}, 5, 96, ... 360, {status=0x0, info=1}, ) }, 5, 96, ... 360, {status=0x0, info=1}, ) == 0x0 01944 432 NtCreateSection (0xf, 0x0, 0x0, 16, 16777216, 360, ... 364, ) == 0x0 01945 432 NtQuerySection (364, Image, 48, ... {section info, class 1, size 48}, 0x0, ) == 0x0 01946 432 NtClose (360, ... ) == 0x0 01947 432 NtMapViewOfSection (364, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x76da0000), 0x0, 196608, ) == 0x0 01948 432 NtClose (364, ... ) == 0x0 01949 432 NtOpenSection (0xe, {24, 8, 0x40, 0, 0, (0xe, {24, 8, 0x40, 0, 0, "WMI.dll"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 01950 432 NtQueryAttributesFile ({24, 0, 0x40, 0, 0, ({24, 0, 0x40, 0, 0, "\??\u:\work\WMI.dll"}, 1240060, ... ) }, 1240060, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 01951 432 NtQueryAttributesFile ({24, 12, 0x40, 0, 0, ({24, 12, 0x40, 0, 0, "WMI.dll"}, 1240060, ... ) }, 1240060, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 01952 432 NtQueryAttributesFile ({24, 0, 0x40, 0, 0, ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\System32\WMI.dll"}, 1240060, ... ) }, 1240060, ... ) == 0x0 01953 432 NtOpenFile (0x100020, {24, 0, 0x40, 0, 0, (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\System32\WMI.dll"}, 5, 96, ... 364, {status=0x0, info=1}, ) }, 5, 96, ... 364, {status=0x0, info=1}, ) == 0x0 01954 432 NtCreateSection (0xf, 0x0, 0x0, 16, 16777216, 364, ... 360, ) == 0x0 01955 432 NtQuerySection (360, Image, 48, ... {section info, class 1, size 48}, 0x0, ) == 0x0 01956 432 NtClose (364, ... ) == 0x0 01957 432 NtMapViewOfSection (360, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x76d30000), 0x0, 16384, ) == 0x0 01958 432 NtClose (360, ... ) == 0x0 01959 432 NtOpenSection (0xe, {24, 8, 0x40, 0, 0, (0xe, {24, 8, 0x40, 0, 0, "DHCPCSVC.DLL"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 01960 432 NtQueryAttributesFile ({24, 0, 0x40, 0, 0, ({24, 0, 0x40, 0, 0, "\??\u:\work\DHCPCSVC.DLL"}, 1240060, ... ) }, 1240060, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 01961 432 NtQueryAttributesFile ({24, 12, 0x40, 0, 0, ({24, 12, 0x40, 0, 0, "DHCPCSVC.DLL"}, 1240060, ... ) }, 1240060, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 01962 432 NtQueryAttributesFile ({24, 0, 0x40, 0, 0, ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\System32\DHCPCSVC.DLL"}, 1240060, ... ) }, 1240060, ... ) == 0x0 01963 432 NtOpenFile (0x100020, {24, 0, 0x40, 0, 0, (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\System32\DHCPCSVC.DLL"}, 5, 96, ... 360, {status=0x0, info=1}, ) }, 5, 96, ... 360, {status=0x0, info=1}, ) == 0x0 01964 432 NtCreateSection (0xf, 0x0, 0x0, 16, 16777216, 360, ... 364, ) == 0x0 01965 432 NtQuerySection (364, Image, 48, ... {section info, class 1, size 48}, 0x0, ) == 0x0 01966 432 NtClose (360, ... ) == 0x0 01967 432 NtMapViewOfSection (364, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x76d80000), 0x0, 106496, ) == 0x0 01968 432 NtClose (364, ... ) == 0x0 01969 432 NtOpenSection (0xe, {24, 8, 0x40, 0, 0, (0xe, {24, 8, 0x40, 0, 0, "DNSAPI.dll"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 01970 432 NtQueryAttributesFile ({24, 0, 0x40, 0, 0, ({24, 0, 0x40, 0, 0, "\??\u:\work\DNSAPI.dll"}, 1239256, ... ) }, 1239256, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 01971 432 NtQueryAttributesFile ({24, 12, 0x40, 0, 0, ({24, 12, 0x40, 0, 0, "DNSAPI.dll"}, 1239256, ... ) }, 1239256, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 01972 432 NtQueryAttributesFile ({24, 0, 0x40, 0, 0, ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\System32\DNSAPI.dll"}, 1239256, ... ) }, 1239256, ... ) == 0x0 01973 432 NtOpenFile (0x100020, {24, 0, 0x40, 0, 0, (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\System32\DNSAPI.dll"}, 5, 96, ... 364, {status=0x0, info=1}, ) }, 5, 96, ... 364, {status=0x0, info=1}, ) == 0x0 01974 432 NtCreateSection (0xf, 0x0, 0x0, 16, 16777216, 364, ... 360, ) == 0x0 01975 432 NtQuerySection (360, Image, 48, ... {section info, class 1, size 48}, 0x0, ) == 0x0 01976 432 NtClose (364, ... ) == 0x0 01977 432 NtMapViewOfSection (360, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x76f20000), 0x0, 151552, ) == 0x0 01978 432 NtClose (360, ... ) == 0x0 01979 432 NtOpenSection (0xe, {24, 8, 0x40, 0, 0, (0xe, {24, 8, 0x40, 0, 0, "WTSAPI32.dll"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 01980 432 NtQueryAttributesFile ({24, 0, 0x40, 0, 0, ({24, 0, 0x40, 0, 0, "\??\u:\work\WTSAPI32.dll"}, 1240060, ... ) }, 1240060, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 01981 432 NtQueryAttributesFile ({24, 12, 0x40, 0, 0, ({24, 12, 0x40, 0, 0, "WTSAPI32.dll"}, 1240060, ... ) }, 1240060, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 01982 432 NtQueryAttributesFile ({24, 0, 0x40, 0, 0, ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\System32\WTSAPI32.dll"}, 1240060, ... ) }, 1240060, ... ) == 0x0 01983 432 NtOpenFile (0x100020, {24, 0, 0x40, 0, 0, (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\System32\WTSAPI32.dll"}, 5, 96, ... 360, {status=0x0, info=1}, ) }, 5, 96, ... 360, {status=0x0, info=1}, ) == 0x0 01984 432 NtCreateSection (0xf, 0x0, 0x0, 16, 16777216, 360, ... 364, ) == 0x0 01985 432 NtQuerySection (364, Image, 48, ... {section info, class 1, size 48}, 0x0, ) == 0x0 01986 432 NtClose (360, ... ) == 0x0 01987 432 NtMapViewOfSection (364, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x76f50000), 0x0, 32768, ) == 0x0 01988 432 NtClose (364, ... ) == 0x0 01989 432 NtOpenSection (0xe, {24, 8, 0x40, 0, 0, (0xe, {24, 8, 0x40, 0, 0, "WINSTA.dll"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 01990 432 NtQueryAttributesFile ({24, 0, 0x40, 0, 0, ({24, 0, 0x40, 0, 0, "\??\u:\work\WINSTA.dll"}, 1239256, ... ) }, 1239256, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 01991 432 NtQueryAttributesFile ({24, 12, 0x40, 0, 0, ({24, 12, 0x40, 0, 0, "WINSTA.dll"}, 1239256, ... ) }, 1239256, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 01992 432 NtQueryAttributesFile ({24, 0, 0x40, 0, 0, ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\System32\WINSTA.dll"}, 1239256, ... ) }, 1239256, ... ) == 0x0 01993 432 NtOpenFile (0x100020, {24, 0, 0x40, 0, 0, (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\System32\WINSTA.dll"}, 5, 96, ... 364, {status=0x0, info=1}, ) }, 5, 96, ... 364, {status=0x0, info=1}, ) == 0x0 01994 432 NtCreateSection (0xf, 0x0, 0x0, 16, 16777216, 364, ... 360, ) == 0x0 01995 432 NtQuerySection (360, Image, 48, ... {section info, class 1, size 48}, 0x0, ) == 0x0 01996 432 NtClose (364, ... ) == 0x0 01997 432 NtMapViewOfSection (360, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x76360000), 0x0, 61440, ) == 0x0 01998 432 NtClose (360, ... ) == 0x0 01999 432 NtCreateEvent (0x1f0003, 0x0, 1, 0, ... 360, ) == 0x0 02000 432 NtOpenKey (0x20019, {24, 48, 0x40, 0, 0, (0x20019, {24, 48, 0x40, 0, 0, "System\CurrentControlSet\Services\LDAP"}, ... 364, ) }, ... 364, ) == 0x0 02001 432 NtQueryValueKey (364, (364, "LdapClientIntegrity", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (364, "LdapClientIntegrity", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) }, 16, ) == 0x0 02002 432 NtClose (364, ... ) == 0x0 02003 432 NtQueryDefaultLocale (1, 1243116, ... ) == 0x0 02004 432 NtQuerySystemInformation (Basic, 44, ... {Unknown=0,MaximumIncrement=156250,PhysicalPageSize=0x1000,NumberOfPhysicalPages=0xff7c,LowestPhysicalPage=0x1,HighestPhysicalPage=0xffff,AllocationGranularity=0x10000,LowestUserAddress=0x10000,HighestUserAddress=0x7ffeffff,ActiveProcessors=1,NumberProcessors=1,}, 0x0, ) == 0x0 02005 432 NtAllocateVirtualMemory (-1, 0, 0, 262144, 8192, 4, ... 39124992, 262144, ) == 0x0 02006 432 NtAllocateVirtualMemory (-1, 39124992, 0, 4096, 4096, 4, ... 39124992, 4096, ) == 0x0 02007 432 NtAllocateVirtualMemory (-1, 39129088, 0, 8192, 4096, 4, ... 39129088, 8192, ) == 0x0 02008 432 NtQuerySystemInformation (Basic, 44, ... {Unknown=0,MaximumIncrement=156250,PhysicalPageSize=0x1000,NumberOfPhysicalPages=0xff7c,LowestPhysicalPage=0x1,HighestPhysicalPage=0xffff,AllocationGranularity=0x10000,LowestUserAddress=0x10000,HighestUserAddress=0x7ffeffff,ActiveProcessors=1,NumberProcessors=1,}, 0x0, ) == 0x0 02009 432 NtQuerySystemInformation (Processor, 12, ... {system info, class 1, size 12}, 0x0, ) == 0x0 02010 432 NtQueryDefaultLocale (1, 1243076, ... ) == 0x0 02011 432 NtQueryInformationProcess (-1, Wow64, 4, ... {process info, class 26, size 4}, 0x0, ) == 0x0 02012 432 NtOpenKey (0x20019, {24, 48, 0x40, 0, 0, (0x20019, {24, 48, 0x40, 0, 0, "System\Setup"}, ... 364, ) }, ... 364, ) == 0x0 02013 432 NtQueryValueKey (364, (364, "SystemSetupInProgress", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (364, "SystemSetupInProgress", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) }, 16, ) == 0x0 02014 432 NtClose (364, ... ) == 0x0 02015 432 NtUserGetProcessWindowStation (... ) == 0x24 02016 432 NtUserGetObjectInformation (36, 1, 1242748, 12, 1242760, ... ) == 0x1 02017 432 NtOpenKey (0x20019, {24, 48, 0x40, 0, 0, (0x20019, {24, 48, 0x40, 0, 0, "System\CurrentControlSet\Control\Session Manager\WPA\PnP"}, ... 364, ) }, ... 364, ) == 0x0 02018 432 NtQueryValueKey (364, (364, "seed", Partial, 144, ... TitleIdx=0, Type=4, Data="\345\252r\363"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (364, "seed", Partial, 144, ... TitleIdx=0, Type=4, Data="\345\252r\363"}, 16, ) }, 16, ) == 0x0 02019 432 NtClose (364, ... ) == 0x0 02020 432 NtOpenKey (0x20019, {24, 48, 0x40, 0, 0, (0x20019, {24, 48, 0x40, 0, 0, "SYSTEM\Setup"}, ... 364, ) }, ... 364, ) == 0x0 02021 432 NtQueryValueKey (364, (364, "OsLoaderPath", Partial, 144, ... TitleIdx=0, Type=1, Data="\\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (364, "OsLoaderPath", Partial, 144, ... TitleIdx=0, Type=1, Data="\\0\0\0"}, 16, ) }, 16, ) == 0x0 02022 432 NtQueryValueKey (364, (364, "OsLoaderPath", Partial, 144, ... TitleIdx=0, Type=1, Data="\\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (364, "OsLoaderPath", Partial, 144, ... TitleIdx=0, Type=1, Data="\\0\0\0"}, 16, ) }, 16, ) == 0x0 02023 432 NtClose (364, ... ) == 0x0 02024 432 NtOpenKey (0x20019, {24, 48, 0x40, 0, 0, (0x20019, {24, 48, 0x40, 0, 0, "SYSTEM\Setup"}, ... 364, ) }, ... 364, ) == 0x0 02025 432 NtQueryValueKey (364, (364, "SystemPartition", Partial, 144, ... TitleIdx=0, Type=1, Data="\\0D\0e\0v\0i\0c\0e\0\\0H\0a\0r\0d\0d\0i\0s\0k\0V\0o\0l\0u\0m\0e\01\0\0\0"}, 60, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (364, "SystemPartition", Partial, 144, ... TitleIdx=0, Type=1, Data="\\0D\0e\0v\0i\0c\0e\0\\0H\0a\0r\0d\0d\0i\0s\0k\0V\0o\0l\0u\0m\0e\01\0\0\0"}, 60, ) }, 60, ) == 0x0 02026 432 NtQueryValueKey (364, (364, "SystemPartition", Partial, 144, ... TitleIdx=0, Type=1, Data="\\0D\0e\0v\0i\0c\0e\0\\0H\0a\0r\0d\0d\0i\0s\0k\0V\0o\0l\0u\0m\0e\01\0\0\0"}, 60, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (364, "SystemPartition", Partial, 144, ... TitleIdx=0, Type=1, Data="\\0D\0e\0v\0i\0c\0e\0\\0H\0a\0r\0d\0d\0i\0s\0k\0V\0o\0l\0u\0m\0e\01\0\0\0"}, 60, ) }, 60, ) == 0x0 02027 432 NtClose (364, ... ) == 0x0 02028 432 NtOpenKey (0x20019, {24, 48, 0x40, 0, 0, (0x20019, {24, 48, 0x40, 0, 0, "Software\Microsoft\Windows\CurrentVersion\Setup"}, ... 364, ) }, ... 364, ) == 0x0 02029 432 NtQueryValueKey (364, (364, "SourcePath", Partial, 144, ... TitleIdx=0, Type=1, Data="D\0:\0\\0\0\0"}, 20, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (364, "SourcePath", Partial, 144, ... TitleIdx=0, Type=1, Data="D\0:\0\\0\0\0"}, 20, ) }, 20, ) == 0x0 02030 432 NtQueryValueKey (364, (364, "SourcePath", Partial, 144, ... TitleIdx=0, Type=1, Data="D\0:\0\\0\0\0"}, 20, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (364, "SourcePath", Partial, 144, ... TitleIdx=0, Type=1, Data="D\0:\0\\0\0\0"}, 20, ) }, 20, ) == 0x0 02031 432 NtClose (364, ... ) == 0x0 02032 432 NtOpenKey (0x20019, {24, 48, 0x40, 0, 0, (0x20019, {24, 48, 0x40, 0, 0, "Software\Microsoft\Windows\CurrentVersion\Setup"}, ... 364, ) }, ... 364, ) == 0x0 02033 432 NtQueryValueKey (364, (364, "ServicePackSourcePath", Partial, 144, ... TitleIdx=0, Type=1, Data="D\0:\0\\0\0\0"}, 20, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (364, "ServicePackSourcePath", Partial, 144, ... TitleIdx=0, Type=1, Data="D\0:\0\\0\0\0"}, 20, ) }, 20, ) == 0x0 02034 432 NtQueryValueKey (364, (364, "ServicePackSourcePath", Partial, 144, ... TitleIdx=0, Type=1, Data="D\0:\0\\0\0\0"}, 20, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (364, "ServicePackSourcePath", Partial, 144, ... TitleIdx=0, Type=1, Data="D\0:\0\\0\0\0"}, 20, ) }, 20, ) == 0x0 02035 432 NtClose (364, ... ) == 0x0 02036 432 NtOpenKey (0x20019, {24, 48, 0x40, 0, 0, (0x20019, {24, 48, 0x40, 0, 0, "Software\Microsoft\Windows\CurrentVersion\Setup"}, ... 364, ) }, ... 364, ) == 0x0 02037 432 NtQueryValueKey (364, (364, "DriverCachePath", Partial, 144, ... TitleIdx=0, Type=2, Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0D\0r\0i\0v\0e\0r\0 \0C\0a\0c\0h\0e\0\0\0"}, 64, ) , Partial, 144, ... TitleIdx=0, Type=2, Data= (364, "DriverCachePath", Partial, 144, ... TitleIdx=0, Type=2, Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0D\0r\0i\0v\0e\0r\0 \0C\0a\0c\0h\0e\0\0\0"}, 64, ) }, 64, ) == 0x0 02038 432 NtQueryValueKey (364, (364, "DriverCachePath", Partial, 144, ... TitleIdx=0, Type=2, Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0D\0r\0i\0v\0e\0r\0 \0C\0a\0c\0h\0e\0\0\0"}, 64, ) , Partial, 144, ... TitleIdx=0, Type=2, Data= (364, "DriverCachePath", Partial, 144, ... TitleIdx=0, Type=2, Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0D\0r\0i\0v\0e\0r\0 \0C\0a\0c\0h\0e\0\0\0"}, 64, ) }, 64, ) == 0x0 02039 432 NtClose (364, ... ) == 0x0 02040 432 NtOpenKey (0x20019, {24, 48, 0x40, 0, 0, (0x20019, {24, 48, 0x40, 0, 0, "Software\Microsoft\Windows\CurrentVersion"}, ... 364, ) }, ... 364, ) == 0x0 02041 432 NtQueryValueKey (364, (364, "DevicePath", Partial, 144, ... TitleIdx=0, Type=2, Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0i\0n\0f\0\0\0"}, 46, ) , Partial, 144, ... TitleIdx=0, Type=2, Data= (364, "DevicePath", Partial, 144, ... TitleIdx=0, Type=2, Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0i\0n\0f\0\0\0"}, 46, ) }, 46, ) == 0x0 02042 432 NtClose (364, ... ) == 0x0 02043 432 NtCreateEvent (0x1f0003, 0x0, 0, 0, ... 364, ) == 0x0 02044 432 NtCreateMutant (0x1f0001, 0x0, 0, ... 368, ) == 0x0 02045 432 NtCreateEvent (0x1f0003, 0x0, 0, 0, ... 372, ) == 0x0 02046 432 NtCreateMutant (0x1f0001, 0x0, 0, ... 376, ) == 0x0 02047 432 NtCreateEvent (0x1f0003, 0x0, 0, 0, ... 380, ) == 0x0 02048 432 NtCreateMutant (0x1f0001, 0x0, 0, ... 384, ) == 0x0 02049 432 NtOpenKey (0x1, {24, 48, 0x40, 0, 0, (0x1, {24, 48, 0x40, 0, 0, "Software\Microsoft\Windows\CurrentVersion\Setup"}, ... 388, ) }, ... 388, ) == 0x0 02050 432 NtQueryValueKey (388, (388, "LogLevel", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 02051 432 NtQueryValueKey (388, (388, "LogPath", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 02052 432 NtOpenKey (0x1, {24, 388, 0x40, 0, 0, (0x1, {24, 388, 0x40, 0, 0, "AppLogLevels"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 02053 432 NtClose (388, ... ) == 0x0 02054 432 NtQueryAttributesFile ({24, 0, 0x40, 0, 0, ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\"}, 1242668, ... ) }, 1242668, ... ) == 0x0 02055 432 NtOpenKey (0x20019, {24, 0, 0x40, 0, 0, (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\System\CurrentControlSet\Control\ComputerName\ActiveComputerName"}, ... 388, ) }, ... 388, ) == 0x0 02056 432 NtQueryValueKey (388, (388, "ComputerName", Full, 128, ... TitleIdx=0, Type=1, Name="ComputerName", Data="M\0Y\0W\0O\0R\0L\0D\0\0\0"}, 60, ) , Full, 128, ... TitleIdx=0, Type=1, Name= (388, "ComputerName", Full, 128, ... TitleIdx=0, Type=1, Name="ComputerName", Data="M\0Y\0W\0O\0R\0L\0D\0\0\0"}, 60, ) , Data= (388, "ComputerName", Full, 128, ... TitleIdx=0, Type=1, Name="ComputerName", Data="M\0Y\0W\0O\0R\0L\0D\0\0\0"}, 60, ) }, 60, ) == 0x0 02057 432 NtClose (388, ... ) == 0x0 02058 432 NtOpenKey (0x20019, {24, 0, 0x40, 0, 0, (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\System\CurrentControlSet\Services\Tcpip\Parameters"}, ... 388, ) }, ... 388, ) == 0x0 02059 432 NtQueryValueKey (388, (388, "Hostname", Full, 128, ... TitleIdx=0, Type=1, Name="Hostname", Data="M\0Y\0W\0O\0R\0L\0D\0\0\0"}, 52, ) , Full, 128, ... TitleIdx=0, Type=1, Name= (388, "Hostname", Full, 128, ... TitleIdx=0, Type=1, Name="Hostname", Data="M\0Y\0W\0O\0R\0L\0D\0\0\0"}, 52, ) , Data= (388, "Hostname", Full, 128, ... TitleIdx=0, Type=1, Name="Hostname", Data="M\0Y\0W\0O\0R\0L\0D\0\0\0"}, 52, ) }, 52, ) == 0x0 02060 432 NtClose (388, ... ) == 0x0 02061 432 NtOpenKey (0x20019, {24, 0, 0x40, 0, 0, (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Policies\Microsoft\System\DNSclient"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 02062 432 NtOpenKey (0x20019, {24, 0, 0x40, 0, 0, (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\System\CurrentControlSet\Services\Tcpip\Parameters"}, ... 388, ) }, ... 388, ) == 0x0 02063 432 NtQueryValueKey (388, (388, "Domain", Full, 128, ... TitleIdx=0, Type=1, Name="Domain", Data="\0\0"}, 34, ) , Full, 128, ... TitleIdx=0, Type=1, Name= (388, "Domain", Full, 128, ... TitleIdx=0, Type=1, Name="Domain", Data="\0\0"}, 34, ) , Data= (388, "Domain", Full, 128, ... TitleIdx=0, Type=1, Name="Domain", Data="\0\0"}, 34, ) }, 34, ) == 0x0 02064 432 NtClose (388, ... ) == 0x0 02065 432 NtQueryDefaultUILanguage (1241636, ... 02066 432 NtOpenThreadTokenEx (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN 02067 432 NtOpenProcessTokenEx (-1, 0x20008, 512, ... -2147482020, ) == 0x0 02068 432 NtQueryInformationToken (-2147482020, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0 02069 432 NtClose (-2147482020, ... ) == 0x0 02070 432 NtOpenKey (0x2000000, {24, 0, 0x640, 0, 0, (0x2000000, {24, 0, 0x640, 0, 0, "\REGISTRY\USER\S-1-5-21-1078081533-484763869-839522115-1003"}, ... -2147482020, ) }, ... -2147482020, ) == 0x0 02071 432 NtOpenKey (0x80000000, {24, 0, 0x240, 0, 0, (0x80000000, {24, 0, 0x240, 0, 0, "\Registry\Machine\System\CurrentControlSet\Control\Nls\MUILanguages"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 02072 432 NtOpenKey (0x80000000, {24, -2147482020, 0x640, 0, 0, (0x80000000, {24, -2147482020, 0x640, 0, 0, "Control Panel\Desktop"}, ... -2147482032, ) }, ... -2147482032, ) == 0x0 02073 432 NtQueryValueKey (-2147482032, (-2147482032, "MultiUILanguageId", Partial, 256, ... ) , Partial, 256, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 02074 432 NtClose (-2147482032, ... ) == 0x0 02075 432 NtClose (-2147482020, ... ) == 0x0 02065 432 NtQueryDefaultUILanguage ... ) == 0x0 02076 432 NtOpenKey (0x20019, {24, 0, 0x40, 0, 0, (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\System\CurrentControlSet\Control\Nls\MUILanguages"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 02077 432 NtOpenFile (0x1200a9, {24, 0, 0x40, 0, 0, (0x1200a9, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\System32\TAPI32.dll"}, 1, 96, ... 388, {status=0x0, info=1}, ) }, 1, 96, ... 388, {status=0x0, info=1}, ) == 0x0 02078 432 NtCreateSection (0x4, 0x0, 0x0, 2, 134217728, 388, ... 392, ) == 0x0 02079 432 NtMapViewOfSection (392, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 2, ... (0x2760000), 0x0, 163840, ) == 0x0 02080 432 NtOpenFile (0x1200a9, {24, 0, 0x40, 0, 0, (0x1200a9, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\System32\TAPI32.dll.124.Manifest"}, 1, 96, ... ) }, 1, 96, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 02081 432 NtQueryDefaultLocale (1, 1239672, ... ) == 0x0 02082 432 NtOpenFile (0x1200a9, {24, 0, 0x40, 0, 0, (0x1200a9, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\System32\TAPI32.dll.124.Config"}, 1, 96, ... ) }, 1, 96, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 02083 432 NtRequestWaitReplyPort (24, {128, 156, new_msg, 0, 1240528, 1, 96, 0} (24, {128, 156, new_msg, 0, 1240528, 1, 96, 0} "\210\6\31\1\33\0\1\0\0\0\0\0\1\361\22\0\1\0\0\0\0\0\11\4\1\1\1\0<\0@\0\250\6\31\1\204\1\0\0\377\377\377\377\0\0\0\0\360Zx\2\0\0\0\0\251\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0(\0,\0\350\6\31\1\0\0\0\0\0\0\0\0\320\364\22\0\0\0\0\0" ... {128, 156, reply, 0, 428, 432, 1525, 0} " S\26\0\33\0\1\0\0\0\0\0\1\361\22\0\1\0\0\0\0\0\11\4\1\1\1\0<\0@\0\250\6\31\1\204\1\0\0\377\377\377\377\0\0\0\0\360Zx\2\0\0\0\0\251\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0(\0,\0\350\6\31\1\0\0\0\0\0\0\0\0\320\364\22\0\0\0\0\0" ) ... {128, 156, reply, 0, 428, 432, 1525, 0} (24, {128, 156, new_msg, 0, 1240528, 1, 96, 0} "\210\6\31\1\33\0\1\0\0\0\0\0\1\361\22\0\1\0\0\0\0\0\11\4\1\1\1\0<\0@\0\250\6\31\1\204\1\0\0\377\377\377\377\0\0\0\0\360Zx\2\0\0\0\0\251\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0(\0,\0\350\6\31\1\0\0\0\0\0\0\0\0\320\364\22\0\0\0\0\0" ... {128, 156, reply, 0, 428, 432, 1525, 0} " S\26\0\33\0\1\0\0\0\0\0\1\361\22\0\1\0\0\0\0\0\11\4\1\1\1\0<\0@\0\250\6\31\1\204\1\0\0\377\377\377\377\0\0\0\0\360Zx\2\0\0\0\0\251\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0(\0,\0\350\6\31\1\0\0\0\0\0\0\0\0\320\364\22\0\0\0\0\0" ) ) == 0x0 02084 432 NtClose (388, ... ) == 0x0 02085 432 NtClose (392, ... ) == 0x0 02086 432 NtUnmapViewOfSection (-1, 0x2760000, ... ) == 0x0 02087 432 NtUnmapViewOfSection (-1, 0x12f4d0, ... ) == STATUS_NOT_MAPPED_VIEW 02088 432 NtQueryDebugFilterState (53, 2, ... ) == 0x0 02089 432 NtAllocateVirtualMemory (-1, 1380352, 0, 4096, 4096, 4, ... 1380352, 4096, ) == 0x0 02090 432 NtOpenKey (0x8, {24, 0, 0x40, 0, 0, (0x8, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows\CurrentVersion\SideBySide\AssemblyStorageRoots"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 02091 432 NtQueryDebugFilterState (53, 2, ... ) == 0x0 02092 432 NtQueryDebugFilterState (53, 2, ... ) == 0x0 02093 432 NtQueryAttributesFile ({24, 0, 0x40, 0, 0, ({24, 0, 0x40, 0, 0, "\??\u:\work\packed.exe.Local\"}, 1238756, ... ) }, 1238756, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 02094 432 NtQueryDebugFilterState (53, 2, ... ) == 0x0 02095 432 NtQueryDebugFilterState (53, 2, ... ) == 0x0 02096 432 NtQueryDebugFilterState (53, 2, ... ) == 0x0 02097 432 NtQueryAttributesFile ({24, 0, 0x40, 0, 0, ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.0.0_x-ww_1382d70a"}, 1239348, ... ) }, 1239348, ... ) == 0x0 02098 432 NtOpenFile (0x100020, {24, 0, 0x40, 0, 0, (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.0.0_x-ww_1382d70a"}, 3, 33, ... 392, {status=0x0, info=1}, ) }, 3, 33, ... 392, {status=0x0, info=1}, ) == 0x0 02099 432 NtQueryDebugFilterState (53, 2, ... ) == 0x0 02100 432 NtOpenFile (0x100020, {24, 0, 0x40, 0, 0, (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.0.0_x-ww_1382d70a\comctl32.dll"}, 5, 96, ... 388, {status=0x0, info=1}, ) }, 5, 96, ... 388, {status=0x0, info=1}, ) == 0x0 02101 432 NtCreateSection (0xe, 0x0, 0x0, 16, 134217728, 388, ... 396, ) == 0x0 02102 432 NtClose (388, ... ) == 0x0 02103 432 NtMapViewOfSection (396, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 16, ... (0x27a0000), 0x0, 921600, ) == 0x0 02104 432 NtClose (396, ... ) == 0x0 02105 432 NtUnmapViewOfSection (-1, 0x27a0000, ... ) == 0x0 02106 432 NtOpenFile (0x100020, {24, 0, 0x40, 0, 0, (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.0.0_x-ww_1382d70a\comctl32.dll"}, 5, 96, ... 396, {status=0x0, info=1}, ) }, 5, 96, ... 396, {status=0x0, info=1}, ) == 0x0 02107 432 NtCreateSection (0xf, 0x0, 0x0, 16, 16777216, 396, ... 388, ) == 0x0 02108 432 NtQuerySection (388, Image, 48, ... {section info, class 1, size 48}, 0x0, ) == 0x0 02109 432 NtClose (396, ... ) == 0x0 02110 432 NtMapViewOfSection (388, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x71950000), 0x0, 933888, ) == 0x0 02111 432 NtClose (388, ... ) == 0x0 02112 432 NtProtectVirtualMemory (-1, (0x71951000), 1952, 4, ... (0x71951000), 4096, 32, ) == 0x0 02113 432 NtProtectVirtualMemory (-1, (0x71951000), 4096, 32, ... (0x71951000), 4096, 4, ) == 0x0 02114 432 NtFlushInstructionCache (-1, 1905594368, 1952, ... ) == 0x0 02115 432 NtProtectVirtualMemory (-1, (0x71951000), 1952, 4, ... (0x71951000), 4096, 32, ) == 0x0 02116 432 NtProtectVirtualMemory (-1, (0x71951000), 4096, 32, ... (0x71951000), 4096, 4, ) == 0x0 02117 432 NtFlushInstructionCache (-1, 1905594368, 1952, ... ) == 0x0 02118 432 NtProtectVirtualMemory (-1, (0x71951000), 1952, 4, ... (0x71951000), 4096, 32, ) == 0x0 02119 432 NtProtectVirtualMemory (-1, (0x71951000), 4096, 32, ... (0x71951000), 4096, 4, ) == 0x0 02120 432 NtFlushInstructionCache (-1, 1905594368, 1952, ... ) == 0x0 02121 432 NtProtectVirtualMemory (-1, (0x71951000), 1952, 4, ... (0x71951000), 4096, 32, ) == 0x0 02122 432 NtProtectVirtualMemory (-1, (0x71951000), 4096, 32, ... (0x71951000), 4096, 4, ) == 0x0 02123 432 NtFlushInstructionCache (-1, 1905594368, 1952, ... ) == 0x0 02124 432 NtProtectVirtualMemory (-1, (0x71951000), 1952, 4, ... (0x71951000), 4096, 32, ) == 0x0 02125 432 NtProtectVirtualMemory (-1, (0x71951000), 4096, 32, ... (0x71951000), 4096, 4, ) == 0x0 02126 432 NtFlushInstructionCache (-1, 1905594368, 1952, ... ) == 0x0 02127 432 NtProtectVirtualMemory (-1, (0x71951000), 1952, 4, ... (0x71951000), 4096, 32, ) == 0x0 02128 432 NtProtectVirtualMemory (-1, (0x71951000), 4096, 32, ... (0x71951000), 4096, 4, ) == 0x0 02129 432 NtFlushInstructionCache (-1, 1905594368, 1952, ... ) == 0x0 02130 432 NtProtectVirtualMemory (-1, (0x71951000), 1952, 4, ... (0x71951000), 4096, 32, ) == 0x0 02131 432 NtProtectVirtualMemory (-1, (0x71951000), 4096, 32, ... (0x71951000), 4096, 4, ) == 0x0 02132 432 NtFlushInstructionCache (-1, 1905594368, 1952, ... ) == 0x0 02133 432 NtAddAtom ( ("T\0h\0e\0m\0e\0P\0r\0o\0p\0S\0c\0r\0o\0l\0l\0B\0a\0r\0C\0t\0l\0", 42, 1240532, ... ) , 42, 1240532, ... ) == 0x0 02134 432 NtQueryDefaultUILanguage (1239248, ... 02135 432 NtOpenThreadTokenEx (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN 02136 432 NtOpenProcessTokenEx (-1, 0x20008, 512, ... -2147482020, ) == 0x0 02137 432 NtQueryInformationToken (-2147482020, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0 02138 432 NtClose (-2147482020, ... ) == 0x0 02139 432 NtOpenKey (0x2000000, {24, 0, 0x640, 0, 0, (0x2000000, {24, 0, 0x640, 0, 0, "\REGISTRY\USER\S-1-5-21-1078081533-484763869-839522115-1003"}, ... -2147482020, ) }, ... -2147482020, ) == 0x0 02140 432 NtOpenKey (0x80000000, {24, 0, 0x240, 0, 0, (0x80000000, {24, 0, 0x240, 0, 0, "\Registry\Machine\System\CurrentControlSet\Control\Nls\MUILanguages"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 02141 432 NtOpenKey (0x80000000, {24, -2147482020, 0x640, 0, 0, (0x80000000, {24, -2147482020, 0x640, 0, 0, "Control Panel\Desktop"}, ... -2147482032, ) }, ... -2147482032, ) == 0x0 02142 432 NtQueryValueKey (-2147482032, (-2147482032, "MultiUILanguageId", Partial, 256, ... ) , Partial, 256, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 02143 432 NtClose (-2147482032, ... ) == 0x0 02144 432 NtClose (-2147482020, ... ) == 0x0 02134 432 NtQueryDefaultUILanguage ... ) == 0x0 02145 432 NtOpenKey (0x20019, {24, 0, 0x40, 0, 0, (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\System\CurrentControlSet\Control\Nls\MUILanguages"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 02146 432 NtQueryAttributesFile ({24, 0, 0x40, 0, 0, ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\WindowsShell.Manifest"}, 1238100, ... ) }, 1238100, ... ) == 0x0 02147 432 NtOpenFile (0x100020, {24, 0, 0x40, 0, 0, (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\WindowsShell.Manifest"}, 5, 96, ... 388, {status=0x0, info=1}, ) }, 5, 96, ... 388, {status=0x0, info=1}, ) == 0x0 02148 432 NtCreateSection (0xe, 0x0, 0x0, 16, 134217728, 388, ... 396, ) == 0x0 02149 432 NtClose (388, ... ) == 0x0 02150 432 NtMapViewOfSection (396, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 16, ... (0x2760000), 0x0, 4096, ) == 0x0 02151 432 NtClose (396, ... ) == 0x0 02152 432 NtUnmapViewOfSection (-1, 0x2760000, ... ) == 0x0 02153 432 NtQueryAttributesFile ({24, 0, 0x40, 0, 0, ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\WindowsShell.Manifest"}, 1237740, ... ) }, 1237740, ... ) == 0x0 02154 432 NtCreateFile (0x80100080, {24, 0, 0x40, 0, 1238440, (0x80100080, {24, 0, 0x40, 0, 1238440, "\??\C:\WINDOWS\WindowsShell.Manifest"}, 0x0, 0, 5, 1, 96, 0, 0, ... 396, {status=0x0, info=1}, ) }, 0x0, 0, 5, 1, 96, 0, 0, ... 396, {status=0x0, info=1}, ) == 0x0 02155 432 NtCreateSection (0xf0005, 0x0, 0x0, 2, 134217728, 396, ... 388, ) == 0x0 02156 432 NtClose (396, ... ) == 0x0 02157 432 NtMapViewOfSection (388, -1, (0x0), 0, 0, {0, 0}, 0, 1, 0, 2, ... (0x2760000), {0, 0}, 4096, ) == 0x0 02158 432 NtClose (388, ... ) == 0x0 02159 432 NtUnmapViewOfSection (-1, 0x2760000, ... ) == 0x0 02160 432 NtOpenFile (0x1200a9, {24, 0, 0x40, 0, 0, (0x1200a9, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\WindowsShell.Manifest"}, 1, 96, ... 388, {status=0x0, info=1}, ) }, 1, 96, ... 388, {status=0x0, info=1}, ) == 0x0 02161 432 NtCreateSection (0x4, 0x0, 0x0, 2, 134217728, 388, ... 396, ) == 0x0 02162 432 NtMapViewOfSection (396, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 2, ... (0x2760000), 0x0, 4096, ) == 0x0 02163 432 NtQueryInformationFile (388, 1238060, 56, NetworkOpen, ... {status=0x0, info=56}, ) == 0x0 02164 432 NtOpenFile (0x1200a9, {24, 0, 0x40, 0, 0, (0x1200a9, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\WindowsShell.Config"}, 1, 96, ... ) }, 1, 96, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 02165 432 NtRequestWaitReplyPort (24, {128, 156, new_msg, 0, 1238140, 1, 96, 0} (24, {128, 156, new_msg, 0, 1238140, 1, 96, 0} "\210\6\31\1\33\0\1\0\240\315Z\371\2209\307\1\1\0\0\0\0\0\11\4\1\1\3\0@\0D\0\250\6\31\1\204\1\0\0\214\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\355\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\26\0\30\0\354\6\31\1\0\0\0\0\0\0\0\0|\353\22\0\0\0\0\0" ... {128, 156, reply, 0, 428, 432, 1526, 0} "h\334\26\0\33\0\1\0\0\0\0\0\2209\307\1\1\0\0\0\0\0\11\4\1\1\3\0@\0D\0\250\6\31\1\204\1\0\0\214\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\355\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\26\0\30\0\354\6\31\1\0\0\0\0\0\0\0\0|\353\22\0\0\0\0\0" ) ... {128, 156, reply, 0, 428, 432, 1526, 0} (24, {128, 156, new_msg, 0, 1238140, 1, 96, 0} "\210\6\31\1\33\0\1\0\240\315Z\371\2209\307\1\1\0\0\0\0\0\11\4\1\1\3\0@\0D\0\250\6\31\1\204\1\0\0\214\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\355\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\26\0\30\0\354\6\31\1\0\0\0\0\0\0\0\0|\353\22\0\0\0\0\0" ... {128, 156, reply, 0, 428, 432, 1526, 0} "h\334\26\0\33\0\1\0\0\0\0\0\2209\307\1\1\0\0\0\0\0\11\4\1\1\3\0@\0D\0\250\6\31\1\204\1\0\0\214\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\355\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\26\0\30\0\354\6\31\1\0\0\0\0\0\0\0\0|\353\22\0\0\0\0\0" ) ) == 0x0 02166 432 NtClose (388, ... ) == 0x0 02167 432 NtClose (396, ... ) == 0x0 02168 432 NtUnmapViewOfSection (-1, 0x2760000, ... ) == 0x0 02169 432 NtUnmapViewOfSection (-1, 0x12eb7c, ... ) == STATUS_NOT_MAPPED_VIEW 02170 432 NtQueryDebugFilterState (53, 2, ... ) == 0x0 02171 432 NtUserRegisterWindowMessage ( ("ShellGetDragImage", ... ) , ... ) == 0xc03a 02172 432 NtUserSystemParametersInfo (104, 0, 1906151468, 0, ... ) == 0x1 02173 432 NtUserGetDC (0, ... ) == 0x1010052 02174 432 NtQueryDebugFilterState (87, 3, ... ) == 0x0 02175 432 NtQueryDebugFilterState (87, 3, ... ) == 0x0 02176 432 NtContinue (1238104, 0, ... 02177 432 NtQueryDebugFilterState (87, 3, ... ) == 0x0 02178 432 NtUnmapViewOfSection (-1, 0x71950000, ... ) == 0x0 02179 432 NtQueryDebugFilterState (87, 3, ... ) == 0x0 02180 432 NtUnmapViewOfSection (-1, 0x2790000, ... ) == 0x0 02181 432 NtClose (392, ... ) == 0x0 02182 432 NtOpenKey (0x20019, {24, 48, 0x40, 0, 0, (0x20019, {24, 48, 0x40, 0, 0, "Software\Microsoft\Windows\CurrentVersion\Telephony"}, ... 392, ) }, ... 392, ) == 0x0 02183 432 NtQueryValueKey (392, (392, "Tapi32MaxNumRequestRetries", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 02184 432 NtQueryValueKey (392, (392, "Tapi32RequestRetryTimeout", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 02185 432 NtClose (392, ... ) == 0x0 02186 432 NtCreateMutant (0x1f0001, 0x0, 0, ... 392, ) == 0x0 02187 432 NtCreateMutant (0x1f0001, {24, 56, 0x80, 1381520, 0, (0x1f0001, {24, 56, 0x80, 1381520, 0, "RasPbFile"}, 0, ... ) }, 0, ... ) == STATUS_ACCESS_DENIED 02188 432 NtOpenMutant (0x100000, {24, 56, 0x0, 0, 0, (0x100000, {24, 56, 0x0, 0, 0, "RasPbFile"}, ... 396, ) }, ... 396, ) == 0x0 02189 432 NtCreateEvent (0x1f0003, 0x0, 0, 1, ... 388, ) == 0x0 02190 432 NtCreateEvent (0x1f0003, 0x0, 1, 0, ... 400, ) == 0x0 02191 432 NtCreateEvent (0x1f0003, 0x0, 0, 1, ... 404, ) == 0x0 02192 432 NtCreateKey (0x20019, {24, 48, 0x40, 0, 0, (0x20019, {24, 48, 0x40, 0, 0, "System\CurrentControlSet\Services\Tcpip\Parameters"}, 0, "Class", 0, ... 408, 2, ) }, 0, (0x20019, {24, 48, 0x40, 0, 0, "System\CurrentControlSet\Services\Tcpip\Parameters"}, 0, "Class", 0, ... 408, 2, ) , 0, ... 408, 2, ) == 0x0 02193 432 NtOpenKey (0x20019, {24, 48, 0x40, 0, 0, (0x20019, {24, 48, 0x40, 0, 0, "System\CurrentControlSet\Services\DnsCache\Parameters"}, ... 412, ) }, ... 412, ) == 0x0 02194 432 NtOpenKey (0x20019, {24, 48, 0x40, 0, 0, (0x20019, {24, 48, 0x40, 0, 0, "Software\Policies\Microsoft\Windows NT\DnsClient"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 02195 432 NtOpenKey (0x1, {24, 48, 0x40, 0, 0, (0x1, {24, 48, 0x40, 0, 0, "System\CurrentControlSet\Services\DNS"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 02196 432 NtQueryValueKey (412, (412, "QueryAdapterName", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 02197 432 NtQueryValueKey (408, (408, "DisableAdapterDomainName", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 02198 432 NtQueryValueKey (412, (412, "UseDomainNameDevolution", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 02199 432 NtQueryValueKey (408, (408, "UseDomainNameDevolution", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (408, "UseDomainNameDevolution", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) }, 16, ) == 0x0 02200 432 NtQueryValueKey (412, (412, "PrioritizeRecordData", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 02201 432 NtQueryValueKey (408, (408, "PrioritizeRecordData", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 02202 432 NtQueryValueKey (412, (412, "AllowUnqualifiedQuery", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 02203 432 NtQueryValueKey (408, (408, "AllowUnqualifiedQuery", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 02204 432 NtQueryValueKey (412, (412, "AppendToMultiLabelName", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 02205 432 NtQueryValueKey (412, (412, "ScreenBadTlds", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 02206 432 NtQueryValueKey (412, (412, "ScreenUnreachableServers", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 02207 432 NtQueryValueKey (412, (412, "FilterClusterIp", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 02208 432 NtQueryValueKey (412, (412, "WaitForNameErrorOnAll", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 02209 432 NtQueryValueKey (412, (412, "UseEdns", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 02210 432 NtQueryValueKey (412, (412, "RegistrationEnabled", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 02211 432 NtQueryValueKey (408, (408, "DisableDynamicUpdate", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 02212 432 NtQueryValueKey (412, (412, "RegisterPrimaryName", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 02213 432 NtQueryValueKey (412, (412, "RegisterAdapterName", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 02214 432 NtQueryValueKey (408, (408, "EnableAdapterDomainNameRegistration", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 02215 432 NtQueryValueKey (412, (412, "RegisterReverseLookup", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 02216 432 NtQueryValueKey (408, (408, "DisableReverseAddressRegistrations", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 02217 432 NtQueryValueKey (412, (412, "RegisterWanAdapters", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 02218 432 NtQueryValueKey (408, (408, "DisableWanDynamicUpdate", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 02219 432 NtQueryValueKey (412, (412, "RegistrationOverwritesInConflict", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 02220 432 NtQueryValueKey (408, (408, "DisableReplaceAddressesInConflicts", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 02221 432 NtQueryValueKey (412, (412, "RegistrationTtl", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 02222 432 NtQueryValueKey (408, (408, "DefaultRegistrationTTL", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 02223 432 NtQueryValueKey (412, (412, "RegistrationRefreshInterval", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 02224 432 NtQueryValueKey (408, (408, "DefaultRegistrationRefreshInterval", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 02225 432 NtQueryValueKey (412, (412, "RegistrationMaxAddressCount", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 02226 432 NtQueryValueKey (408, (408, "MaxNumberOfAddressesToRegister", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 02227 432 NtQueryValueKey (412, (412, "UpdateSecurityLevel", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 02228 432 NtQueryValueKey (408, (408, "UpdateSecurityLevel", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 02229 432 NtQueryValueKey (412, (412, "UpdateZoneExcludeFile", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 02230 432 NtQueryValueKey (412, (412, "UpdateTopLevelDomainZones", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 02231 432 NtQueryValueKey (412, (412, "DnsTest", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 02232 432 NtQueryValueKey (412, (412, "MaxCacheSize", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 02233 432 NtQueryValueKey (412, (412, "MaxCacheTtl", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 02234 432 NtQueryValueKey (412, (412, "MaxNegativeCacheTtl", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 02235 432 NtQueryValueKey (412, (412, "AdapterTimeoutLimit", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 02236 432 NtQueryValueKey (412, (412, "ServerPriorityTimeLimit", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 02237 432 NtQueryValueKey (412, (412, "MaxCachedSockets", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 02238 432 NtQueryValueKey (412, (412, "UseMulticast", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 02239 432 NtQueryValueKey (412, (412, "MulticastOnNameError", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 02240 432 NtQueryValueKey (412, (412, "UseDotLocalDomain", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 02241 432 NtQueryValueKey (412, (412, "ListenOnMulticast", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 02242 432 NtOpenKey (0x1, {24, 48, 0x40, 0, 0, (0x1, {24, 48, 0x40, 0, 0, "System\Setup"}, ... 416, ) }, ... 416, ) == 0x0 02243 432 NtQueryValueKey (416, (416, "SystemSetupInProgress", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (416, "SystemSetupInProgress", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) }, 16, ) == 0x0 02244 432 NtClose (416, ... ) == 0x0 02245 432 NtClose (408, ... ) == 0x0 02246 432 NtClose (412, ... ) == 0x0 02247 432 NtOpenKey (0x1, {24, 48, 0x40, 0, 0, (0x1, {24, 48, 0x40, 0, 0, "System\CurrentControlSet\Services\Tcpip\Parameters"}, ... 412, ) }, ... 412, ) == 0x0 02248 432 NtQueryValueKey (412, (412, "DnsQueryTimeouts", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 02249 432 NtQueryValueKey (412, (412, "DnsQuickQueryTimeouts", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 02250 432 NtQueryValueKey (412, (412, "DnsMulticastQueryTimeouts", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 02251 432 NtClose (412, ... ) == 0x0 02252 432 NtCreateEvent (0x1f0003, 0x0, 0, 0, ... 412, ) == 0x0 02253 432 NtCreateSemaphore (0x100003, 0x0, 0, 2147483647, ... 408, ) == 0x0 02254 432 NtCreateSemaphore (0x100003, 0x0, 0, 2147483647, ... 416, ) == 0x0 02255 432 NtQuerySystemInformation (Basic, 44, ... {Unknown=0,MaximumIncrement=156250,PhysicalPageSize=0x1000,NumberOfPhysicalPages=0xff7c,LowestPhysicalPage=0x1,HighestPhysicalPage=0xffff,AllocationGranularity=0x10000,LowestUserAddress=0x10000,HighestUserAddress=0x7ffeffff,ActiveProcessors=1,NumberProcessors=1,}, 0x0, ) == 0x0 02256 432 NtAllocateVirtualMemory (-1, 0, 0, 65536, 8192, 4, ... 41287680, 65536, ) == 0x0 02257 432 NtAllocateVirtualMemory (-1, 41287680, 0, 4096, 4096, 4, ... 41287680, 4096, ) == 0x0 02258 432 NtAllocateVirtualMemory (-1, 41291776, 0, 8192, 4096, 4, ... 41291776, 8192, ) == 0x0 02259 432 NtCreateFile (0x20000000, {24, 0, 0x40, 0, 0, (0x20000000, {24, 0, 0x40, 0, 0, "\Device\Tcp"}, 0x0, 128, 3, 3, 0, 0, 0, ... 420, {status=0x0, info=0}, ) }, 0x0, 128, 3, 3, 0, 0, 0, ... 420, {status=0x0, info=0}, ) == 0x0 02260 432 NtCreateFile (0x40000000, {24, 0, 0x40, 0, 0, (0x40000000, {24, 0, 0x40, 0, 0, "\Device\Tcp"}, 0x0, 128, 3, 3, 0, 0, 0, ... 424, {status=0x0, info=0}, ) }, 0x0, 128, 3, 3, 0, 0, 0, ... 424, {status=0x0, info=0}, ) == 0x0 02261 432 NtCreateFile (0x20000000, {24, 0, 0x40, 0, 0, (0x20000000, {24, 0, 0x40, 0, 0, "\Device\Ip"}, 0x0, 128, 3, 3, 0, 0, 0, ... 428, {status=0x0, info=0}, ) }, 0x0, 128, 3, 3, 0, 0, 0, ... 428, {status=0x0, info=0}, ) == 0x0 02262 432 NtCreateFile (0x100003, {24, 0, 0x40, 0, 0, (0x100003, {24, 0, 0x40, 0, 0, "\Device\Ip"}, 0x0, 128, 3, 3, 0, 0, 0, ... 432, {status=0x0, info=0}, ) }, 0x0, 128, 3, 3, 0, 0, 0, ... 432, {status=0x0, info=0}, ) == 0x0 02263 432 NtCreateFile (0x20100080, {24, 0, 0x40, 0, 1243200, (0x20100080, {24, 0, 0x40, 0, 1243200, "\??\Ip"}, 0x0, 128, 3, 1, 64, 0, 0, ... 436, {status=0x0, info=0}, ) }, 0x0, 128, 3, 1, 64, 0, 0, ... 436, {status=0x0, info=0}, ) == 0x0 02264 432 NtAllocateVirtualMemory (-1, 41299968, 0, 36864, 4096, 4, ... 41299968, 36864, ) == 0x0 02265 432 NtCreateEvent (0x1f0003, 0x0, 0, 0, ... 440, ) == 0x0 02266 432 NtDeviceIoControlFile (420, 440, 0x0, 0x0, 0x120003, (420, 440, 0x0, 0x0, 0x120003, "\0\0\0\0\0\0\0\0\0\1\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0", 36, 32768, ... {status=0x0, info=56}, "\0\4\0\0\0\0\0\0\1\4\0\0\0\0\0\0\1\3\0\0\0\0\0\0\200\3\0\0\0\0\0\0\0\2\0\0\0\0\0\0\200\2\0\0\0\0\0\0\0\2\0\0\1\0\0\0", ) , 36, 32768, ... {status=0x0, info=56}, (420, 440, 0x0, 0x0, 0x120003, "\0\0\0\0\0\0\0\0\0\1\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0", 36, 32768, ... {status=0x0, info=56}, "\0\4\0\0\0\0\0\0\1\4\0\0\0\0\0\0\1\3\0\0\0\0\0\0\200\3\0\0\0\0\0\0\0\2\0\0\0\0\0\0\200\2\0\0\0\0\0\0\0\2\0\0\1\0\0\0", ) , ) == 0x0 02267 432 NtClose (440, ... ) == 0x0 02268 432 NtCreateEvent (0x1f0003, 0x0, 0, 0, ... 440, ) == 0x0 02269 432 NtDeviceIoControlFile (420, 440, 0x0, 0x0, 0x120003, (420, 440, 0x0, 0x0, 0x120003, "\0\2\0\0\0\0\0\0\0\2\0\0\0\1\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0", 36, 348, ... {status=0x0, info=118}, "\1\0\0\0\30\0\0\0\360\5\0\0\200\226\230\0\0\0\0\0\0\0\0\0\0\0\0\0\1\0\0\0\5\0\0\0\273\264(\273\241\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\241\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\32\0\0\0MS TCP Loopback interface\0", ) , 36, 348, ... {status=0x0, info=118}, (420, 440, 0x0, 0x0, 0x120003, "\0\2\0\0\0\0\0\0\0\2\0\0\0\1\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0", 36, 348, ... {status=0x0, info=118}, "\1\0\0\0\30\0\0\0\360\5\0\0\200\226\230\0\0\0\0\0\0\0\0\0\0\0\0\0\1\0\0\0\5\0\0\0\273\264(\273\241\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\241\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\32\0\0\0MS TCP Loopback interface\0", ) , ) == 0x0 02270 432 NtClose (440, ... ) == 0x0 02271 432 NtCreateEvent (0x1f0003, 0x0, 0, 0, ... 440, ) == 0x0 02272 432 NtDeviceIoControlFile (420, 440, 0x0, 0x0, 0x120003, (420, 440, 0x0, 0x0, 0x120003, "\0\2\0\0\1\0\0\0\0\2\0\0\0\1\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0", 36, 348, ... {status=0x0, info=158}, "\3\0\1\0\6\0\0\0\334\5\0\0\0\312\232;\6\0\0\0\0\14)\371\246\305\0\0\1\0\0\0\5\0\0\0\333\264(\273~n\10\0\360\1\0\0,\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0Z\240\0\0O\1\0\0+\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0B\0\0\0AMD PCNET Family PCI Ethernet Adapter - Packet Scheduler Miniport\0", ) , 36, 348, ... {status=0x0, info=158}, (420, 440, 0x0, 0x0, 0x120003, "\0\2\0\0\1\0\0\0\0\2\0\0\0\1\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0", 36, 348, ... {status=0x0, info=158}, "\3\0\1\0\6\0\0\0\334\5\0\0\0\312\232;\6\0\0\0\0\14)\371\246\305\0\0\1\0\0\0\5\0\0\0\333\264(\273~n\10\0\360\1\0\0,\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0Z\240\0\0O\1\0\0+\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0B\0\0\0AMD PCNET Family PCI Ethernet Adapter - Packet Scheduler Miniport\0", ) , ) == 0x0 02273 432 NtClose (440, ... ) == 0x0 02274 432 NtCreateFile (0x20000000, {24, 0, 0x40, 0, 0, (0x20000000, {24, 0, 0x40, 0, 0, "\Device\Tcp6"}, 0x0, 128, 3, 3, 0, 0, 0, ... ) }, 0x0, 128, 3, 3, 0, 0, 0, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 02275 432 NtCreateEvent (0x1f0003, 0x0, 0, 0, ... 440, ) == 0x0 02276 432 NtDeviceIoControlFile (420, 440, 0x0, 0x0, 0x120003, (420, 440, 0x0, 0x0, 0x120003, "\0\0\0\0\0\0\0\0\0\1\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0", 36, 32768, ... {status=0x0, info=56}, "\0\4\0\0\0\0\0\0\1\4\0\0\0\0\0\0\1\3\0\0\0\0\0\0\200\3\0\0\0\0\0\0\0\2\0\0\0\0\0\0\200\2\0\0\0\0\0\0\0\2\0\0\1\0\0\0", ) , 36, 32768, ... {status=0x0, info=56}, (420, 440, 0x0, 0x0, 0x120003, "\0\0\0\0\0\0\0\0\0\1\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0", 36, 32768, ... {status=0x0, info=56}, "\0\4\0\0\0\0\0\0\1\4\0\0\0\0\0\0\1\3\0\0\0\0\0\0\200\3\0\0\0\0\0\0\0\2\0\0\0\0\0\0\200\2\0\0\0\0\0\0\0\2\0\0\1\0\0\0", ) , ) == 0x0 02277 432 NtClose (440, ... ) == 0x0 02278 432 NtCreateEvent (0x1f0003, 0x0, 0, 0, ... 440, ) == 0x0 02279 432 NtDeviceIoControlFile (420, 440, 0x0, 0x0, 0x120003, (420, 440, 0x0, 0x0, 0x120003, "\200\2\0\0\0\0\0\0\0\1\0\0\0\1\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0", 36, 4, ... {status=0x0, info=4}, "\200\2\0\0", ) , 36, 4, ... {status=0x0, info=4}, (420, 440, 0x0, 0x0, 0x120003, "\200\2\0\0\0\0\0\0\0\1\0\0\0\1\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0", 36, 4, ... {status=0x0, info=4}, "\200\2\0\0", ) , ) == 0x0 02280 432 NtClose (440, ... ) == 0x0 02281 432 NtCreateEvent (0x1f0003, 0x0, 0, 0, ... 440, ) == 0x0 02282 432 NtDeviceIoControlFile (420, 440, 0x0, 0x0, 0x120003, (420, 440, 0x0, 0x0, 0x120003, "\200\2\0\0\0\0\0\0\0\2\0\0\0\1\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0", 36, 8, ... {status=0x0, info=8}, "\1\0\0\0\3\0\1\0", ) , 36, 8, ... {status=0x0, info=8}, (420, 440, 0x0, 0x0, 0x120003, "\200\2\0\0\0\0\0\0\0\2\0\0\0\1\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0", 36, 8, ... {status=0x0, info=8}, "\1\0\0\0\3\0\1\0", ) , ) == 0x0 02283 432 NtClose (440, ... ) == 0x0 02284 432 NtAllocateVirtualMemory (-1, 0, 0, 65536, 8192, 4, ... 41418752, 65536, ) == 0x0 02285 432 NtQueryVirtualMemory (-1, 0x2780000, Basic, 28, ... {BaseAddress=0x2780000,AllocationBase=0x2780000,AllocationProtect=0x4,RegionSize=0x10000,State=0x2000,Protect=0x0,Type=0x20000,}, 28, ) == 0x0 02286 432 NtAllocateVirtualMemory (-1, 41418752, 0, 1, 4096, 4, ... 41418752, 4096, ) == 0x0 02287 432 NtQueryVirtualMemory (-1, 0x2780000, Basic, 28, ... {BaseAddress=0x2780000,AllocationBase=0x2780000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 28, ) == 0x0 02288 432 NtFreeVirtualMemory (-1, (0x2780000), 0, 32768, ... (0x2780000), 65536, ) == 0x0 02289 432 NtAllocateVirtualMemory (-1, 0, 0, 65536, 8192, 4, ... 41418752, 65536, ) == 0x0 02290 432 NtQueryVirtualMemory (-1, 0x2780000, Basic, 28, ... {BaseAddress=0x2780000,AllocationBase=0x2780000,AllocationProtect=0x4,RegionSize=0x10000,State=0x2000,Protect=0x0,Type=0x20000,}, 28, ) == 0x0 02291 432 NtAllocateVirtualMemory (-1, 41418752, 0, 1, 4096, 4, ... 41418752, 4096, ) == 0x0 02292 432 NtQueryVirtualMemory (-1, 0x2780000, Basic, 28, ... {BaseAddress=0x2780000,AllocationBase=0x2780000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 28, ) == 0x0 02293 432 NtFreeVirtualMemory (-1, (0x2780000), 0, 32768, ... (0x2780000), 65536, ) == 0x0 02294 432 NtAllocateVirtualMemory (-1, 0, 0, 65536, 8192, 4, ... 41418752, 65536, ) == 0x0 02295 432 NtQueryVirtualMemory (-1, 0x2780000, Basic, 28, ... {BaseAddress=0x2780000,AllocationBase=0x2780000,AllocationProtect=0x4,RegionSize=0x10000,State=0x2000,Protect=0x0,Type=0x20000,}, 28, ) == 0x0 02296 432 NtAllocateVirtualMemory (-1, 41418752, 0, 1, 4096, 4, ... 41418752, 4096, ) == 0x0 02297 432 NtQueryVirtualMemory (-1, 0x2780000, Basic, 28, ... {BaseAddress=0x2780000,AllocationBase=0x2780000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 28, ) == 0x0 02298 432 NtFreeVirtualMemory (-1, (0x2780000), 0, 32768, ... (0x2780000), 65536, ) == 0x0 02299 432 NtAllocateVirtualMemory (-1, 0, 0, 65536, 8192, 4, ... 41418752, 65536, ) == 0x0 02300 432 NtQueryVirtualMemory (-1, 0x2780000, Basic, 28, ... {BaseAddress=0x2780000,AllocationBase=0x2780000,AllocationProtect=0x4,RegionSize=0x10000,State=0x2000,Protect=0x0,Type=0x20000,}, 28, ) == 0x0 02301 432 NtAllocateVirtualMemory (-1, 41418752, 0, 1, 4096, 4, ... 41418752, 4096, ) == 0x0 02302 432 NtQueryVirtualMemory (-1, 0x2780000, Basic, 28, ... {BaseAddress=0x2780000,AllocationBase=0x2780000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 28, ) == 0x0 02303 432 NtFreeVirtualMemory (-1, (0x2780000), 0, 32768, ... (0x2780000), 65536, ) == 0x0 02304 432 NtAllocateVirtualMemory (-1, 0, 0, 65536, 8192, 4, ... 41418752, 65536, ) == 0x0 02305 432 NtQueryVirtualMemory (-1, 0x2780000, Basic, 28, ... {BaseAddress=0x2780000,AllocationBase=0x2780000,AllocationProtect=0x4,RegionSize=0x10000,State=0x2000,Protect=0x0,Type=0x20000,}, 28, ) == 0x0 02306 432 NtAllocateVirtualMemory (-1, 41418752, 0, 1, 4096, 4, ... 41418752, 4096, ) == 0x0 02307 432 NtQueryVirtualMemory (-1, 0x2780000, Basic, 28, ... {BaseAddress=0x2780000,AllocationBase=0x2780000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 28, ) == 0x0 02308 432 NtFreeVirtualMemory (-1, (0x2780000), 0, 32768, ... (0x2780000), 65536, ) == 0x0 02309 432 NtAllocateVirtualMemory (-1, 0, 0, 65536, 8192, 4, ... 41418752, 65536, ) == 0x0 02310 432 NtQueryVirtualMemory (-1, 0x2780000, Basic, 28, ... {BaseAddress=0x2780000,AllocationBase=0x2780000,AllocationProtect=0x4,RegionSize=0x10000,State=0x2000,Protect=0x0,Type=0x20000,}, 28, ) == 0x0 02311 432 NtAllocateVirtualMemory (-1, 41418752, 0, 1, 4096, 4, ... 41418752, 4096, ) == 0x0 02312 432 NtQueryVirtualMemory (-1, 0x2780000, Basic, 28, ... {BaseAddress=0x2780000,AllocationBase=0x2780000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 28, ) == 0x0 02313 432 NtFreeVirtualMemory (-1, (0x2780000), 0, 32768, ... (0x2780000), 65536, ) == 0x0 02314 432 NtAllocateVirtualMemory (-1, 0, 0, 65536, 8192, 4, ... 41418752, 65536, ) == 0x0 02315 432 NtQueryVirtualMemory (-1, 0x2780000, Basic, 28, ... {BaseAddress=0x2780000,AllocationBase=0x2780000,AllocationProtect=0x4,RegionSize=0x10000,State=0x2000,Protect=0x0,Type=0x20000,}, 28, ) == 0x0 02316 432 NtAllocateVirtualMemory (-1, 41418752, 0, 1, 4096, 4, ... 41418752, 4096, ) == 0x0 02317 432 NtQueryVirtualMemory (-1, 0x2780000, Basic, 28, ... {BaseAddress=0x2780000,AllocationBase=0x2780000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 28, ) == 0x0 02318 432 NtFreeVirtualMemory (-1, (0x2780000), 0, 32768, ... (0x2780000), 65536, ) == 0x0 02319 432 NtAllocateVirtualMemory (-1, 0, 0, 65536, 8192, 4, ... 41418752, 65536, ) == 0x0 02320 432 NtQueryVirtualMemory (-1, 0x2780000, Basic, 28, ... {BaseAddress=0x2780000,AllocationBase=0x2780000,AllocationProtect=0x4,RegionSize=0x10000,State=0x2000,Protect=0x0,Type=0x20000,}, 28, ) == 0x0 02321 432 NtAllocateVirtualMemory (-1, 41418752, 0, 1, 4096, 4, ... 41418752, 4096, ) == 0x0 02322 432 NtQueryVirtualMemory (-1, 0x2780000, Basic, 28, ... {BaseAddress=0x2780000,AllocationBase=0x2780000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 28, ) == 0x0 02323 432 NtFreeVirtualMemory (-1, (0x2780000), 0, 32768, ... (0x2780000), 65536, ) == 0x0 02324 432 NtAllocateVirtualMemory (-1, 0, 0, 65536, 8192, 4, ... 41418752, 65536, ) == 0x0 02325 432 NtQueryVirtualMemory (-1, 0x2780000, Basic, 28, ... {BaseAddress=0x2780000,AllocationBase=0x2780000,AllocationProtect=0x4,RegionSize=0x10000,State=0x2000,Protect=0x0,Type=0x20000,}, 28, ) == 0x0 02326 432 NtAllocateVirtualMemory (-1, 41418752, 0, 1, 4096, 4, ... 41418752, 4096, ) == 0x0 02327 432 NtQueryVirtualMemory (-1, 0x2780000, Basic, 28, ... {BaseAddress=0x2780000,AllocationBase=0x2780000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 28, ) == 0x0 02328 432 NtFreeVirtualMemory (-1, (0x2780000), 0, 32768, ... (0x2780000), 65536, ) == 0x0 02329 432 NtAllocateVirtualMemory (-1, 0, 0, 65536, 8192, 4, ... 41418752, 65536, ) == 0x0 02330 432 NtQueryVirtualMemory (-1, 0x2780000, Basic, 28, ... {BaseAddress=0x2780000,AllocationBase=0x2780000,AllocationProtect=0x4,RegionSize=0x10000,State=0x2000,Protect=0x0,Type=0x20000,}, 28, ) == 0x0 02331 432 NtAllocateVirtualMemory (-1, 41418752, 0, 1, 4096, 4, ... 41418752, 4096, ) == 0x0 02332 432 NtQueryVirtualMemory (-1, 0x2780000, Basic, 28, ... {BaseAddress=0x2780000,AllocationBase=0x2780000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 28, ) == 0x0 02333 432 NtFreeVirtualMemory (-1, (0x2780000), 0, 32768, ... (0x2780000), 65536, ) == 0x0 02334 432 NtAllocateVirtualMemory (-1, 0, 0, 65536, 8192, 4, ... 41418752, 65536, ) == 0x0 02335 432 NtQueryVirtualMemory (-1, 0x2780000, Basic, 28, ... {BaseAddress=0x2780000,AllocationBase=0x2780000,AllocationProtect=0x4,RegionSize=0x10000,State=0x2000,Protect=0x0,Type=0x20000,}, 28, ) == 0x0 02336 432 NtAllocateVirtualMemory (-1, 41418752, 0, 1, 4096, 4, ... 41418752, 4096, ) == 0x0 02337 432 NtQueryVirtualMemory (-1, 0x2780000, Basic, 28, ... {BaseAddress=0x2780000,AllocationBase=0x2780000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 28, ) == 0x0 02338 432 NtFreeVirtualMemory (-1, (0x2780000), 0, 32768, ... (0x2780000), 65536, ) == 0x0 02339 432 NtAllocateVirtualMemory (-1, 0, 0, 65536, 8192, 4, ... 41418752, 65536, ) == 0x0 02340 432 NtQueryVirtualMemory (-1, 0x2780000, Basic, 28, ... {BaseAddress=0x2780000,AllocationBase=0x2780000,AllocationProtect=0x4,RegionSize=0x10000,State=0x2000,Protect=0x0,Type=0x20000,}, 28, ) == 0x0 02341 432 NtAllocateVirtualMemory (-1, 41418752, 0, 1, 4096, 4, ... 41418752, 4096, ) == 0x0 02342 432 NtQueryVirtualMemory (-1, 0x2780000, Basic, 28, ... {BaseAddress=0x2780000,AllocationBase=0x2780000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 28, ) == 0x0 02343 432 NtFreeVirtualMemory (-1, (0x2780000), 0, 32768, ... (0x2780000), 65536, ) == 0x0 02344 432 NtAllocateVirtualMemory (-1, 0, 0, 65536, 8192, 4, ... 41418752, 65536, ) == 0x0 02345 432 NtQueryVirtualMemory (-1, 0x2780000, Basic, 28, ... {BaseAddress=0x2780000,AllocationBase=0x2780000,AllocationProtect=0x4,RegionSize=0x10000,State=0x2000,Protect=0x0,Type=0x20000,}, 28, ) == 0x0 02346 432 NtAllocateVirtualMemory (-1, 41418752, 0, 1, 4096, 4, ... 41418752, 4096, ) == 0x0 02347 432 NtQueryVirtualMemory (-1, 0x2780000, Basic, 28, ... {BaseAddress=0x2780000,AllocationBase=0x2780000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 28, ) == 0x0 02348 432 NtFreeVirtualMemory (-1, (0x2780000), 0, 32768, ... (0x2780000), 65536, ) == 0x0 02349 432 NtAllocateVirtualMemory (-1, 0, 0, 65536, 8192, 4, ... 41418752, 65536, ) == 0x0 02350 432 NtQueryVirtualMemory (-1, 0x2780000, Basic, 28, ... {BaseAddress=0x2780000,AllocationBase=0x2780000,AllocationProtect=0x4,RegionSize=0x10000,State=0x2000,Protect=0x0,Type=0x20000,}, 28, ) == 0x0 02351 432 NtAllocateVirtualMemory (-1, 41418752, 0, 1, 4096, 4, ... 41418752, 4096, ) == 0x0 02352 432 NtQueryVirtualMemory (-1, 0x2780000, Basic, 28, ... {BaseAddress=0x2780000,AllocationBase=0x2780000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 28, ) == 0x0 02353 432 NtFreeVirtualMemory (-1, (0x2780000), 0, 32768, ... (0x2780000), 65536, ) == 0x0 02354 432 NtAllocateVirtualMemory (-1, 0, 0, 65536, 8192, 4, ... 41418752, 65536, ) == 0x0 02355 432 NtQueryVirtualMemory (-1, 0x2780000, Basic, 28, ... {BaseAddress=0x2780000,AllocationBase=0x2780000,AllocationProtect=0x4,RegionSize=0x10000,State=0x2000,Protect=0x0,Type=0x20000,}, 28, ) == 0x0 02356 432 NtAllocateVirtualMemory (-1, 41418752, 0, 1, 4096, 4, ... 41418752, 4096, ) == 0x0 02357 432 NtQueryVirtualMemory (-1, 0x2780000, Basic, 28, ... {BaseAddress=0x2780000,AllocationBase=0x2780000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 28, ) == 0x0 02358 432 NtFreeVirtualMemory (-1, (0x2780000), 0, 32768, ... (0x2780000), 65536, ) == 0x0 02359 432 NtAllocateVirtualMemory (-1, 0, 0, 65536, 8192, 4, ... 41418752, 65536, ) == 0x0 02360 432 NtQueryVirtualMemory (-1, 0x2780000, Basic, 28, ... {BaseAddress=0x2780000,AllocationBase=0x2780000,AllocationProtect=0x4,RegionSize=0x10000,State=0x2000,Protect=0x0,Type=0x20000,}, 28, ) == 0x0 02361 432 NtAllocateVirtualMemory (-1, 41418752, 0, 1, 4096, 4, ... 41418752, 4096, ) == 0x0 02362 432 NtQueryVirtualMemory (-1, 0x2780000, Basic, 28, ... {BaseAddress=0x2780000,AllocationBase=0x2780000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 28, ) == 0x0 02363 432 NtFreeVirtualMemory (-1, (0x2780000), 0, 32768, ... (0x2780000), 65536, ) == 0x0 02364 432 NtAllocateVirtualMemory (-1, 0, 0, 65536, 8192, 4, ... 41418752, 65536, ) == 0x0 02365 432 NtQueryVirtualMemory (-1, 0x2780000, Basic, 28, ... {BaseAddress=0x2780000,AllocationBase=0x2780000,AllocationProtect=0x4,RegionSize=0x10000,State=0x2000,Protect=0x0,Type=0x20000,}, 28, ) == 0x0 02366 432 NtAllocateVirtualMemory (-1, 41418752, 0, 1, 4096, 4, ... 41418752, 4096, ) == 0x0 02367 432 NtQueryVirtualMemory (-1, 0x2780000, Basic, 28, ... {BaseAddress=0x2780000,AllocationBase=0x2780000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 28, ) == 0x0 02368 432 NtFreeVirtualMemory (-1, (0x2780000), 0, 32768, ... (0x2780000), 65536, ) == 0x0 02369 432 NtAllocateVirtualMemory (-1, 0, 0, 65536, 8192, 4, ... 41418752, 65536, ) == 0x0 02370 432 NtQueryVirtualMemory (-1, 0x2780000, Basic, 28, ... {BaseAddress=0x2780000,AllocationBase=0x2780000,AllocationProtect=0x4,RegionSize=0x10000,State=0x2000,Protect=0x0,Type=0x20000,}, 28, ) == 0x0 02371 432 NtAllocateVirtualMemory (-1, 41418752, 0, 1, 4096, 4, ... 41418752, 4096, ) == 0x0 02372 432 NtQueryVirtualMemory (-1, 0x2780000, Basic, 28, ... {BaseAddress=0x2780000,AllocationBase=0x2780000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 28, ) == 0x0 02373 432 NtFreeVirtualMemory (-1, (0x2780000), 0, 32768, ... (0x2780000), 65536, ) == 0x0 02374 432 NtAllocateVirtualMemory (-1, 0, 0, 65536, 8192, 4, ... 41418752, 65536, ) == 0x0 02375 432 NtQueryVirtualMemory (-1, 0x2780000, Basic, 28, ... {BaseAddress=0x2780000,AllocationBase=0x2780000,AllocationProtect=0x4,RegionSize=0x10000,State=0x2000,Protect=0x0,Type=0x20000,}, 28, ) == 0x0 02376 432 NtAllocateVirtualMemory (-1, 41418752, 0, 1, 4096, 4, ... 41418752, 4096, ) == 0x0 02377 432 NtQueryVirtualMemory (-1, 0x2780000, Basic, 28, ... {BaseAddress=0x2780000,AllocationBase=0x2780000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 28, ) == 0x0 02378 432 NtFreeVirtualMemory (-1, (0x2780000), 0, 32768, ... (0x2780000), 65536, ) == 0x0 02379 432 NtAllocateVirtualMemory (-1, 0, 0, 65536, 8192, 4, ... 41418752, 65536, ) == 0x0 02380 432 NtQueryVirtualMemory (-1, 0x2780000, Basic, 28, ... {BaseAddress=0x2780000,AllocationBase=0x2780000,AllocationProtect=0x4,RegionSize=0x10000,State=0x2000,Protect=0x0,Type=0x20000,}, 28, ) == 0x0 02381 432 NtAllocateVirtualMemory (-1, 41418752, 0, 1, 4096, 4, ... 41418752, 4096, ) == 0x0 02382 432 NtQueryVirtualMemory (-1, 0x2780000, Basic, 28, ... {BaseAddress=0x2780000,AllocationBase=0x2780000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 28, ) == 0x0 02383 432 NtFreeVirtualMemory (-1, (0x2780000), 0, 32768, ... (0x2780000), 65536, ) == 0x0 02384 432 NtAllocateVirtualMemory (-1, 0, 0, 65536, 8192, 4, ... 41418752, 65536, ) == 0x0 02385 432 NtQueryVirtualMemory (-1, 0x2780000, Basic, 28, ... {BaseAddress=0x2780000,AllocationBase=0x2780000,AllocationProtect=0x4,RegionSize=0x10000,State=0x2000,Protect=0x0,Type=0x20000,}, 28, ) == 0x0 02386 432 NtAllocateVirtualMemory (-1, 41418752, 0, 1, 4096, 4, ... 41418752, 4096, ) == 0x0 02387 432 NtQueryVirtualMemory (-1, 0x2780000, Basic, 28, ... {BaseAddress=0x2780000,AllocationBase=0x2780000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 28, ) == 0x0 02388 432 NtFreeVirtualMemory (-1, (0x2780000), 0, 32768, ... (0x2780000), 65536, ) == 0x0 02389 432 NtAllocateVirtualMemory (-1, 0, 0, 65536, 8192, 4, ... 41418752, 65536, ) == 0x0 02390 432 NtQueryVirtualMemory (-1, 0x2780000, Basic, 28, ... {BaseAddress=0x2780000,AllocationBase=0x2780000,AllocationProtect=0x4,RegionSize=0x10000,State=0x2000,Protect=0x0,Type=0x20000,}, 28, ) == 0x0 02391 432 NtAllocateVirtualMemory (-1, 41418752, 0, 1, 4096, 4, ... 41418752, 4096, ) == 0x0 02392 432 NtQueryVirtualMemory (-1, 0x2780000, Basic, 28, ... {BaseAddress=0x2780000,AllocationBase=0x2780000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 28, ) == 0x0 02393 432 NtFreeVirtualMemory (-1, (0x2780000), 0, 32768, ... (0x2780000), 65536, ) == 0x0 02394 432 NtAllocateVirtualMemory (-1, 0, 0, 65536, 8192, 4, ... 41418752, 65536, ) == 0x0 02395 432 NtQueryVirtualMemory (-1, 0x2780000, Basic, 28, ... {BaseAddress=0x2780000,AllocationBase=0x2780000,AllocationProtect=0x4,RegionSize=0x10000,State=0x2000,Protect=0x0,Type=0x20000,}, 28, ) == 0x0 02396 432 NtAllocateVirtualMemory (-1, 41418752, 0, 1, 4096, 4, ... 41418752, 4096, ) == 0x0 02397 432 NtQueryVirtualMemory (-1, 0x2780000, Basic, 28, ... {BaseAddress=0x2780000,AllocationBase=0x2780000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 28, ) == 0x0 02398 432 NtFreeVirtualMemory (-1, (0x2780000), 0, 32768, ... (0x2780000), 65536, ) == 0x0 02399 432 NtAllocateVirtualMemory (-1, 0, 0, 65536, 8192, 4, ... 41418752, 65536, ) == 0x0 02400 432 NtQueryVirtualMemory (-1, 0x2780000, Basic, 28, ... {BaseAddress=0x2780000,AllocationBase=0x2780000,AllocationProtect=0x4,RegionSize=0x10000,State=0x2000,Protect=0x0,Type=0x20000,}, 28, ) == 0x0 02401 432 NtAllocateVirtualMemory (-1, 41418752, 0, 1, 4096, 4, ... 41418752, 4096, ) == 0x0 02402 432 NtQueryVirtualMemory (-1, 0x2780000, Basic, 28, ... {BaseAddress=0x2780000,AllocationBase=0x2780000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 28, ) == 0x0 02403 432 NtFreeVirtualMemory (-1, (0x2780000), 0, 32768, ... (0x2780000), 65536, ) == 0x0 02404 432 NtAllocateVirtualMemory (-1, 0, 0, 65536, 8192, 4, ... 41418752, 65536, ) == 0x0 02405 432 NtQueryVirtualMemory (-1, 0x2780000, Basic, 28, ... {BaseAddress=0x2780000,AllocationBase=0x2780000,AllocationProtect=0x4,RegionSize=0x10000,State=0x2000,Protect=0x0,Type=0x20000,}, 28, ) == 0x0 02406 432 NtAllocateVirtualMemory (-1, 41418752, 0, 1, 4096, 4, ... 41418752, 4096, ) == 0x0 02407 432 NtQueryVirtualMemory (-1, 0x2780000, Basic, 28, ... {BaseAddress=0x2780000,AllocationBase=0x2780000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 28, ) == 0x0 02408 432 NtFreeVirtualMemory (-1, (0x2780000), 0, 32768, ... (0x2780000), 65536, ) == 0x0 02409 432 NtOpenKey (0x20019, {24, 48, 0x40, 0, 0, (0x20019, {24, 48, 0x40, 0, 0, "SYSTEM\CurrentControlSet\Services\Tcpip\Linkage"}, ... 440, ) }, ... 440, ) == 0x0 02410 432 NtOpenKey (0x20019, {24, 48, 0x40, 0, 0, (0x20019, {24, 48, 0x40, 0, 0, "SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\"}, ... 444, ) }, ... 444, ) == 0x0 02411 432 NtOpenKey (0x20019, {24, 48, 0x40, 0, 0, (0x20019, {24, 48, 0x40, 0, 0, "SYSTEM\CurrentControlSet\Services\NetBT\Parameters\Interfaces"}, ... 448, ) }, ... 448, ) == 0x0 02412 432 NtOpenKey (0x20019, {24, 48, 0x40, 0, 0, (0x20019, {24, 48, 0x40, 0, 0, "SYSTEM\CurrentControlSet\Services\NetBT\Parameters"}, ... 452, ) }, ... 452, ) == 0x0 02413 432 NtQueryDefaultLocale (1, 1243136, ... ) == 0x0 02414 432 NtOpenSection (0xe, {24, 8, 0x40, 0, 0, (0xe, {24, 8, 0x40, 0, 0, "mpr.dll"}, ... 456, ) }, ... 456, ) == 0x0 02415 432 NtMapViewOfSection (456, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x71b20000), 0x0, 69632, ) == 0x0 02416 432 NtClose (456, ... ) == 0x0 02417 432 NtCreateSemaphore (0x1f0003, 0x0, 1, 1, ... 456, ) == 0x0 02418 432 NtCreateEvent (0x1f0003, 0x0, 0, 0, ... 460, ) == 0x0 02419 432 NtOpenKey (0x20019, {24, 48, 0x40, 0, 0, (0x20019, {24, 48, 0x40, 0, 0, "system\CurrentControlSet\control\NetworkProvider\HwOrder"}, ... 464, ) }, ... 464, ) == 0x0 02420 432 NtNotifyChangeKey (464, 460, 0, 0, 2011390432, 4, 0, 0, 0, 1, ... ) == 0x103 02421 432 NtQueryInformationProcess (-1, 28, 4, ... {process info, class 28, size 4}, 0x0, ) == 0x0 02422 432 NtCreateSemaphore (0x100003, 0x0, 0, 2147483647, ... 468, ) == 0x0 02423 432 NtCreateSemaphore (0x100003, 0x0, 0, 2147483647, ... 472, ) == 0x0 02424 432 NtOpenSection (0xe, {24, 8, 0x40, 0, 0, (0xe, {24, 8, 0x40, 0, 0, "odbc32.dll"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 02425 432 NtQueryAttributesFile ({24, 0, 0x40, 0, 0, ({24, 0, 0x40, 0, 0, "\??\u:\work\odbc32.dll"}, 1242008, ... ) }, 1242008, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 02426 432 NtQueryAttributesFile ({24, 12, 0x40, 0, 0, ({24, 12, 0x40, 0, 0, "odbc32.dll"}, 1242008, ... ) }, 1242008, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 02427 432 NtQueryAttributesFile ({24, 0, 0x40, 0, 0, ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\System32\odbc32.dll"}, 1242008, ... ) }, 1242008, ... ) == 0x0 02428 432 NtOpenFile (0x100020, {24, 0, 0x40, 0, 0, (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\System32\odbc32.dll"}, 5, 96, ... 476, {status=0x0, info=1}, ) }, 5, 96, ... 476, {status=0x0, info=1}, ) == 0x0 02429 432 NtCreateSection (0xf, 0x0, 0x0, 16, 16777216, 476, ... 480, ) == 0x0 02430 432 NtQuerySection (480, Image, 48, ... {section info, class 1, size 48}, 0x0, ) == 0x0 02431 432 NtClose (476, ... ) == 0x0 02432 432 NtMapViewOfSection (480, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x1f7b0000), 0x0, 200704, ) == 0x0 02433 432 NtClose (480, ... ) == 0x0 02434 432 NtProtectVirtualMemory (-1, (0x1f7b1000), 724, 4, ... (0x1f7b1000), 4096, 32, ) == 0x0 02435 432 NtProtectVirtualMemory (-1, (0x1f7b1000), 4096, 32, ... (0x1f7b1000), 4096, 4, ) == 0x0 02436 432 NtFlushInstructionCache (-1, 528158720, 724, ... ) == 0x0 02437 432 NtOpenSection (0xe, {24, 8, 0x40, 0, 0, (0xe, {24, 8, 0x40, 0, 0, "comdlg32.dll"}, ... 480, ) }, ... 480, ) == 0x0 02438 432 NtMapViewOfSection (480, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x763b0000), 0x0, 282624, ) == 0x0 02439 432 NtClose (480, ... ) == 0x0 02440 432 NtProtectVirtualMemory (-1, (0x763b1000), 1536, 4, ... (0x763b1000), 4096, 32, ) == 0x0 02441 432 NtProtectVirtualMemory (-1, (0x763b1000), 4096, 32, ... (0x763b1000), 4096, 4, ) == 0x0 02442 432 NtFlushInstructionCache (-1, 1983582208, 1536, ... ) == 0x0 02443 432 NtUserRegisterWindowMessage ( ("WOWLFChange", ... ) , ... ) == 0xc06b 02444 432 NtUserRegisterWindowMessage ( ("WOWDirChange", ... ) , ... ) == 0xc06c 02445 432 NtUserRegisterWindowMessage ( ("WOWCHOOSEFONT_GETLOGFONT", ... ) , ... ) == 0xc06d 02446 432 NtUserRegisterWindowMessage ( ("commdlg_LBSelChangedNotify", ... ) , ... ) == 0xc06e 02447 432 NtUserRegisterWindowMessage ( ("commdlg_ShareViolation", ... ) , ... ) == 0xc06f 02448 432 NtUserRegisterWindowMessage ( ("commdlg_FileNameOK", ... ) , ... ) == 0xc070 02449 432 NtUserRegisterWindowMessage ( ("commdlg_ColorOK", ... ) , ... ) == 0xc071 02450 432 NtUserRegisterWindowMessage ( ("commdlg_SetRGBColor", ... ) , ... ) == 0xc072 02451 432 NtUserRegisterWindowMessage ( ("commdlg_LBSelChangedNotify", ... ) , ... ) == 0xc06e 02452 432 NtUserRegisterWindowMessage ( ("commdlg_ShareViolation", ... ) , ... ) == 0xc06f 02453 432 NtUserRegisterWindowMessage ( ("commdlg_FileNameOK", ... ) , ... ) == 0xc070 02454 432 NtUserRegisterWindowMessage ( ("commdlg_ColorOK", ... ) , ... ) == 0xc071 02455 432 NtUserRegisterWindowMessage ( ("commdlg_SetRGBColor", ... ) , ... ) == 0xc072 02456 432 NtUserRegisterWindowMessage ( ("Shell IDList Array", ... ) , ... ) == 0xc073 02457 432 NtUserRegisterWindowMessage ( ("commdlg_help", ... ) , ... ) == 0xc074 02458 432 NtUserRegisterWindowMessage ( ("commdlg_help", ... ) , ... ) == 0xc074 02459 432 NtOpenKey (0x20019, {24, 48, 0x40, 0, 0, (0x20019, {24, 48, 0x40, 0, 0, "SOFTWARE\Microsoft\MDAC"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 02460 432 NtQuerySystemInformation (Basic, 44, ... {Unknown=0,MaximumIncrement=156250,PhysicalPageSize=0x1000,NumberOfPhysicalPages=0xff7c,LowestPhysicalPage=0x1,HighestPhysicalPage=0xffff,AllocationGranularity=0x10000,LowestUserAddress=0x10000,HighestUserAddress=0x7ffeffff,ActiveProcessors=1,NumberProcessors=1,}, 0x0, ) == 0x0 02461 432 NtQuerySystemInformation (Processor, 12, ... {system info, class 1, size 12}, 0x0, ) == 0x0 02462 432 NtQuerySystemInformation (Basic, 44, ... {Unknown=0,MaximumIncrement=156250,PhysicalPageSize=0x1000,NumberOfPhysicalPages=0xff7c,LowestPhysicalPage=0x1,HighestPhysicalPage=0xffff,AllocationGranularity=0x10000,LowestUserAddress=0x10000,HighestUserAddress=0x7ffeffff,ActiveProcessors=1,NumberProcessors=1,}, 0x0, ) == 0x0 02463 432 NtAllocateVirtualMemory (-1, 0, 0, 262144, 8192, 4, ... 41418752, 262144, ) == 0x0 02464 432 NtAllocateVirtualMemory (-1, 41418752, 0, 4096, 4096, 4, ... 41418752, 4096, ) == 0x0 02465 432 NtQuerySystemInformation (Basic, 44, ... {Unknown=0,MaximumIncrement=156250,PhysicalPageSize=0x1000,NumberOfPhysicalPages=0xff7c,LowestPhysicalPage=0x1,HighestPhysicalPage=0xffff,AllocationGranularity=0x10000,LowestUserAddress=0x10000,HighestUserAddress=0x7ffeffff,ActiveProcessors=1,NumberProcessors=1,}, 0x0, ) == 0x0 02466 432 NtAllocateVirtualMemory (-1, 0, 0, 262144, 8192, 4, ... 41680896, 262144, ) == 0x0 02467 432 NtAllocateVirtualMemory (-1, 41680896, 0, 4096, 4096, 4, ... 41680896, 4096, ) == 0x0 02468 432 NtQuerySystemInformation (Basic, 44, ... {Unknown=0,MaximumIncrement=156250,PhysicalPageSize=0x1000,NumberOfPhysicalPages=0xff7c,LowestPhysicalPage=0x1,HighestPhysicalPage=0xffff,AllocationGranularity=0x10000,LowestUserAddress=0x10000,HighestUserAddress=0x7ffeffff,ActiveProcessors=1,NumberProcessors=1,}, 0x0, ) == 0x0 02469 432 NtAllocateVirtualMemory (-1, 0, 0, 262144, 8192, 4, ... 41943040, 262144, ) == 0x0 02470 432 NtAllocateVirtualMemory (-1, 41943040, 0, 4096, 4096, 4, ... 41943040, 4096, ) == 0x0 02471 432 NtQuerySystemInformation (Basic, 44, ... {Unknown=0,MaximumIncrement=156250,PhysicalPageSize=0x1000,NumberOfPhysicalPages=0xff7c,LowestPhysicalPage=0x1,HighestPhysicalPage=0xffff,AllocationGranularity=0x10000,LowestUserAddress=0x10000,HighestUserAddress=0x7ffeffff,ActiveProcessors=1,NumberProcessors=1,}, 0x0, ) == 0x0 02472 432 NtAllocateVirtualMemory (-1, 0, 0, 262144, 8192, 4, ... 42205184, 262144, ) == 0x0 02473 432 NtAllocateVirtualMemory (-1, 42205184, 0, 4096, 4096, 4, ... 42205184, 4096, ) == 0x0 02474 432 NtQuerySystemInformation (Basic, 44, ... {Unknown=0,MaximumIncrement=156250,PhysicalPageSize=0x1000,NumberOfPhysicalPages=0xff7c,LowestPhysicalPage=0x1,HighestPhysicalPage=0xffff,AllocationGranularity=0x10000,LowestUserAddress=0x10000,HighestUserAddress=0x7ffeffff,ActiveProcessors=1,NumberProcessors=1,}, 0x0, ) == 0x0 02475 432 NtQuerySystemInformation (Processor, 12, ... {system info, class 1, size 12}, 0x0, ) == 0x0 02476 432 NtQuerySystemInformation (Basic, 44, ... {Unknown=0,MaximumIncrement=156250,PhysicalPageSize=0x1000,NumberOfPhysicalPages=0xff7c,LowestPhysicalPage=0x1,HighestPhysicalPage=0xffff,AllocationGranularity=0x10000,LowestUserAddress=0x10000,HighestUserAddress=0x7ffeffff,ActiveProcessors=1,NumberProcessors=1,}, 0x0, ) == 0x0 02477 432 NtQuerySystemInformation (Processor, 12, ... {system info, class 1, size 12}, 0x0, ) == 0x0 02478 432 NtAllocateVirtualMemory (-1, 1384448, 0, 4096, 4096, 4, ... 1384448, 4096, ) == 0x0 02479 432 NtQueryAttributesFile ({24, 0, 0x40, 0, 0, ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\System32\odbcint.dll"}, 1237980, ... ) }, 1237980, ... ) == 0x0 02480 432 NtOpenFile (0x100020, {24, 0, 0x40, 0, 0, (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\System32\odbcint.dll"}, 5, 96, ... 480, {status=0x0, info=1}, ) }, 5, 96, ... 480, {status=0x0, info=1}, ) == 0x0 02481 432 NtCreateSection (0xe, 0x0, 0x0, 16, 134217728, 480, ... 476, ) == 0x0 02482 432 NtClose (480, ... ) == 0x0 02483 432 NtMapViewOfSection (476, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 16, ... (0x2880000), 0x0, 90112, ) == 0x0 02484 432 NtClose (476, ... ) == 0x0 02485 432 NtUnmapViewOfSection (-1, 0x2880000, ... ) == 0x0 02486 432 NtQueryAttributesFile ({24, 0, 0x40, 0, 0, ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\System32\odbcint.dll"}, 1238296, ... ) }, 1238296, ... ) == 0x0 02487 432 NtOpenFile (0x100020, {24, 0, 0x40, 0, 0, (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\System32\odbcint.dll"}, 5, 96, ... 476, {status=0x0, info=1}, ) }, 5, 96, ... 476, {status=0x0, info=1}, ) == 0x0 02488 432 NtCreateSection (0xf, 0x0, 0x0, 16, 16777216, 476, ... 480, ) == 0x0 02489 432 NtQuerySection (480, Image, 48, ... {section info, class 1, size 48}, 0x0, ) == 0x0 02490 432 NtClose (476, ... ) == 0x0 02491 432 NtMapViewOfSection (480, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x1f850000), 0x0, 90112, ) == 0x0 02492 432 NtClose (480, ... ) == 0x0 02493 432 NtQueryDefaultLocale (1, 1239984, ... ) == 0x0 02494 432 NtAllocateVirtualMemory (-1, 41422848, 0, 4096, 4096, 4, ... 41422848, 4096, ) == 0x0 02495 432 NtOpenKey (0x20019, {24, 48, 0x40, 0, 0, (0x20019, {24, 48, 0x40, 0, 0, "SOFTWARE"}, ... 480, ) }, ... 480, ) == 0x0 02496 432 NtClose (480, ... ) == 0x0 02497 432 NtOpenKey (0x20019, {24, 52, 0x40, 0, 0, (0x20019, {24, 52, 0x40, 0, 0, "SOFTWARE\ODBC\ODBC.INI\ODBC"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 02498 432 NtOpenKey (0x20019, {24, 48, 0x40, 0, 0, (0x20019, {24, 48, 0x40, 0, 0, "SOFTWARE\ODBC\ODBC.INI\ODBC"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 02499 432 NtOpenKey (0x20019, {24, 52, 0x40, 0, 0, (0x20019, {24, 52, 0x40, 0, 0, "SOFTWARE\ODBC\ODBC.INI\ODBC"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 02500 432 NtOpenKey (0x20019, {24, 48, 0x40, 0, 0, (0x20019, {24, 48, 0x40, 0, 0, "SOFTWARE\ODBC\ODBC.INI\ODBC"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 02501 432 NtOpenSection (0xe, {24, 8, 0x40, 0, 0, (0xe, {24, 8, 0x40, 0, 0, "psapi.dll"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 02502 432 NtQueryAttributesFile ({24, 0, 0x40, 0, 0, ({24, 0, 0x40, 0, 0, "\??\u:\work\psapi.dll"}, 1242008, ... ) }, 1242008, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 02503 432 NtQueryAttributesFile ({24, 12, 0x40, 0, 0, ({24, 12, 0x40, 0, 0, "psapi.dll"}, 1242008, ... ) }, 1242008, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 02504 432 NtQueryAttributesFile ({24, 0, 0x40, 0, 0, ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\System32\psapi.dll"}, 1242008, ... ) }, 1242008, ... ) == 0x0 02505 432 NtOpenFile (0x100020, {24, 0, 0x40, 0, 0, (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\System32\psapi.dll"}, 5, 96, ... 480, {status=0x0, info=1}, ) }, 5, 96, ... 480, {status=0x0, info=1}, ) == 0x0 02506 432 NtCreateSection (0xf, 0x0, 0x0, 16, 16777216, 480, ... 476, ) == 0x0 02507 432 NtQuerySection (476, Image, 48, ... {section info, class 1, size 48}, 0x0, ) == 0x0 02508 432 NtClose (480, ... ) == 0x0 02509 432 NtMapViewOfSection (476, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x76bf0000), 0x0, 45056, ) == 0x0 02510 432 NtClose (476, ... ) == 0x0 02511 432 NtOpenSection (0xe, {24, 8, 0x40, 0, 0, (0xe, {24, 8, 0x40, 0, 0, "pstorec.dll"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 02512 432 NtQueryAttributesFile ({24, 0, 0x40, 0, 0, ({24, 0, 0x40, 0, 0, "\??\u:\work\pstorec.dll"}, 1242008, ... ) }, 1242008, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 02513 432 NtQueryAttributesFile ({24, 12, 0x40, 0, 0, ({24, 12, 0x40, 0, 0, "pstorec.dll"}, 1242008, ... ) }, 1242008, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 02514 432 NtQueryAttributesFile ({24, 0, 0x40, 0, 0, ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\System32\pstorec.dll"}, 1242008, ... ) }, 1242008, ... ) == 0x0 02515 432 NtOpenFile (0x100020, {24, 0, 0x40, 0, 0, (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\System32\pstorec.dll"}, 5, 96, ... 476, {status=0x0, info=1}, ) }, 5, 96, ... 476, {status=0x0, info=1}, ) == 0x0 02516 432 NtCreateSection (0xf, 0x0, 0x0, 16, 16777216, 476, ... 480, ) == 0x0 02517 432 NtQuerySection (480, Image, 48, ... {section info, class 1, size 48}, 0x0, ) == 0x0 02518 432 NtClose (476, ... ) == 0x0 02519 432 NtMapViewOfSection (480, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x5e0c0000), 0x0, 49152, ) == 0x0 02520 432 NtClose (480, ... ) == 0x0 02521 432 NtQueryInformationProcess (-1, DefaultHardErrorMode, 4, ... {process info, class 12, size 4}, 0x0, ) == 0x0 02522 432 NtSetInformationProcess (-1, DefaultHardErrorMode, {process info, class 12, size 4}, 4, ... ) == 0x0 02523 432 NtQueryAttributesFile ({24, 0, 0x40, 0, 0, ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\ntvdm.exe"}, 1243132, ... ) }, 1243132, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 02524 432 NtCreateFile (0x80100080, {24, 0, 0x40, 0, 1242044, (0x80100080, {24, 0, 0x40, 0, 1242044, "\??\u:\work\packed.exe"}, 0x0, 0, 1, 1, 2097252, 0, 0, ... 480, {status=0x0, info=1}, ) }, 0x0, 0, 1, 1, 2097252, 0, 0, ... 480, {status=0x0, info=1}, ) == 0x0 02525 432 NtQueryInformationFile (480, 1242980, 8, AttributeFlag, ... {status=0x0, info=8}, ) == 0x0 02526 432 NtQueryInformationFile (480, 1242952, 24, Standard, ... {status=0x0, info=24}, ) == 0x0 02527 432 NtQueryInformationFile (480, 1242904, 40, Basic, ... {status=0x0, info=40}, ) == 0x0 02528 432 NtAllocateVirtualMemory (-1, 1388544, 0, 8192, 4096, 4, ... 1388544, 8192, ) == 0x0 02529 432 NtQueryInformationFile (480, 1385320, 4094, Stream, ... {status=0x0, info=38}, ) == 0x0 02530 432 NtQueryInformationFile (480, 1241448, 40, Basic, ... {status=0x0, info=40}, ) == 0x0 02531 432 NtQueryInformationFile (480, 1241292, 4, Ea, ... {status=0x0, info=4}, ) == 0x0 02532 432 NtCreateFile (0x40110080, {24, 0, 0x40, 0, 1241300, (0x40110080, {24, 0, 0x40, 0, 1241300, "\??\C:\WINDOWS\ntvdm.exe"}, 0x0, 32, 0, 5, 100, 0, 0, ... }, 0x0, 32, 0, 5, 100, 0, 0, ... 02533 432 NtClose (-2147482020, ... ) == 0x0 02532 432 NtCreateFile ... 476, {status=0x0, info=2}, ) == 0x0 02534 432 NtQueryVolumeInformationFile (476, 1240672, 536, Attribute, ... {status=0x0, info=22}, ) == 0x0 02535 432 NtQueryInformationFile (476, 1240632, 40, Basic, ... {status=0x0, info=40}, ) == 0x0 02536 432 NtQueryVolumeInformationFile (480, 1240672, 536, Attribute, ... {status=0x0, info=20}, ) == 0x0 02537 432 NtQueryVolumeInformationFile (480, 1240356, 8, Device, ... {status=0x0, info=8}, ) == 0x0 02538 432 NtSetInformationFile (476, 1240460, 8, EndOfFile, ... {status=0x0, info=0}, ) == 0x0 02539 432 NtAllocateVirtualMemory (-1, 1396736, 0, 65536, 4096, 4, ... 1396736, 65536, ) == 0x0 02540 432 NtReadFile (480, 0, 0, 0, 61440, 0x0, 0, ... {status=0x0, info=61440}, (480, 0, 0, 0, 61440, 0x0, 0, ... {status=0x0, info=61440}, "MZ\220\0\3\0\0\0\4\0\0\0\377\377\0\0\270\0\0\0\0\0\0\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\250\0\0\0\321\370\216\370\225\231\340\253\225\231\340\253\225\231\340\253\356\205\354\253\226\231\340\253\26\205\356\253\220\231\340\253}\206\352\253\236\231\340\253V\226\275\253\223\231\340\253\225\231\341\2534\231\340\253}\206\344\253\220\231\340\253}\206\353\253\265\231\340\253Rich\225\231\340\253\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0PE\0\0L\1\4\0\251&\204F\0\0\0\0\0\0\0\0\340\0\17\1\13\1\6\0\00\1\0\0\342\6\0\0\0\0\0\24P\10\0\0\20\0\0\0@\1\0\0\0@\0\0\20\0\0\0\2\0\0\4\0\0\0\0\0\0\0\4\0\0\0\0\0\0\0\0\240\30\0\0\4\0\0\271i\10\0\2\0\0\0\0\0\20\0\0\20\0\0\0\0\20\0\0\20\0\0\0\0\0\0\20\0\0\0\0\0\0\0\0\0\0\0\24@\10\0<\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0 \0 \0 \10\0\0\20\0\0\0\316\0\0\0\20\0\0\0\0\0\0\0\0\0\0\0\0\0\0@\0\0\300.rsrc \0\20\0\0\00\10\0\0\0\0\0\0\336\0\0\0\0\0\0\0\0\0\0\0\0\0\0@\0\0\300.ida", ) , ) == 0x0 02541 432 NtWriteFile (476, 0, 0, 0, (476, 0, 0, 0, "MZ\220\0\3\0\0\0\4\0\0\0\377\377\0\0\270\0\0\0\0\0\0\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\250\0\0\0\321\370\216\370\225\231\340\253\225\231\340\253\225\231\340\253\356\205\354\253\226\231\340\253\26\205\356\253\220\231\340\253}\206\352\253\236\231\340\253V\226\275\253\223\231\340\253\225\231\341\2534\231\340\253}\206\344\253\220\231\340\253}\206\353\253\265\231\340\253Rich\225\231\340\253\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0PE\0\0L\1\4\0\251&\204F\0\0\0\0\0\0\0\0\340\0\17\1\13\1\6\0\00\1\0\0\342\6\0\0\0\0\0\24P\10\0\0\20\0\0\0@\1\0\0\0@\0\0\20\0\0\0\2\0\0\4\0\0\0\0\0\0\0\4\0\0\0\0\0\0\0\0\240\30\0\0\4\0\0\271i\10\0\2\0\0\0\0\0\20\0\0\20\0\0\0\0\20\0\0\20\0\0\0\0\0\0\20\0\0\0\0\0\0\0\0\0\0\0\24@\10\0<\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0 \0 \0 \10\0\0\20\0\0\0\316\0\0\0\20\0\0\0\0\0\0\0\0\0\0\0\0\0\0@\0\0\300.rsrc \0\20\0\0\00\10\0\0\0\0\0\0\336\0\0\0\0\0\0\0\0\0\0\0\0\0\0@\0\0\300.ida", 61440, 0x0, 0, ... {status=0x0, info=61440}, ) , 61440, 0x0, 0, ... {status=0x0, info=61440}, ) == 0x0 02542 432 NtReadFile (480, 0, 0, 0, 61440, 0x0, 0, ... {status=0x0, info=61440}, " (480, 0, 0, 0, 61440, 0x0, 0, ... {status=0x0, info=61440}, ""\316y\35\6\332C9\221\244\2712\243v\310[/ J8\254\23K3\365{a\334\25\20\377\336\220\17!P\332\300iU\277\15\246\302\30\305\233\244\264(T\3\320\331\247(\6Q\200uX\20\305|\333\1\354\257\2376\244\251a\350\320\245\336TE\240\316\5i\35Tvjh@/\14\272\245\335\329\363\1L\323\334C!.]1:\337\22\221\304\362FD*A1\215<\301K\364wP\244\1a\327\252\324\244X\256P4\254d\205\340\360\331\223R\3\320q\344!\303Z$\321\232\310\3\256\333\328\355\20\306H+t\274d\32m\304Y\10\303a\243@\207@ \370\273\250\250\30\242\3039X\306q(a;TB\313\20.\222v\6\230\206\246\340?q\0\277\270\334\217\307\216\1r\352\337\35\367w\267\346\30*p\\261'v\14_K\376\254\201Z\5\17F\355\315\2202 )\220\274\251\211\302H\233RWA\234\363 \240<\16\33\234Z@\257\3\262F\20\21I8\0\363\241\213g/\310{\370\0\354\247\314\30\7\331\346o\0\3078\35K\265\241\327)\5H|\207\367\304\303N\301\340\203\213\234\7,\216w\360\372`\236\266\31\347\0\343(\320\357M\251\210\247\1\331%\241}\213\245\303\330\23\3070\202\204@\2\216j\0\343\364\237\236\250\15\325\372\3Y$\375 K\371\364\300P\241\214\304\0\367\301g\206\310\256v\213Hs\337\2e\343\346\237\220K\350F\340\4\253\345@\370\240)\304g\345H\364\330\0\251d\323\362Y\3140\7`N\370\224\232\200K}\305\245\374$\1\212\307\273\300Ux,\200@\357\354\342\321\246\322\3\341\372X\327\3756\200\346\217\331\17!\210\326(\200\351"\36\313\276 \314\213\10\232]\362\347\14\254\322B2\0\320\375$T\304\250H>\37\222y\305@\255\31\32\313\253", ) \36\313\276 \314\213\10\232]\362\347\14\254\322B2\0\320\375$T\304\250H>\37\222y\305@\255\31\32\313\253", ) == 0x0 02543 432 NtWriteFile (476, 0, 0, 0, " (476, 0, 0, 0, ""\316y\35\6\332C9\221\244\2712\243v\310[/ J8\254\23K3\365{a\334\25\20\377\336\220\17!P\332\300iU\277\15\246\302\30\305\233\244\264(T\3\320\331\247(\6Q\200uX\20\305|\333\1\354\257\2376\244\251a\350\320\245\336TE\240\316\5i\35Tvjh@/\14\272\245\335\329\363\1L\323\334C!.]1:\337\22\221\304\362FD*A1\215<\301K\364wP\244\1a\327\252\324\244X\256P4\254d\205\340\360\331\223R\3\320q\344!\303Z$\321\232\310\3\256\333\328\355\20\306H+t\274d\32m\304Y\10\303a\243@\207@ \370\273\250\250\30\242\3039X\306q(a;TB\313\20.\222v\6\230\206\246\340?q\0\277\270\334\217\307\216\1r\352\337\35\367w\267\346\30*p\\261'v\14_K\376\254\201Z\5\17F\355\315\2202 )\220\274\251\211\302H\233RWA\234\363 \240<\16\33\234Z@\257\3\262F\20\21I8\0\363\241\213g/\310{\370\0\354\247\314\30\7\331\346o\0\3078\35K\265\241\327)\5H|\207\367\304\303N\301\340\203\213\234\7,\216w\360\372`\236\266\31\347\0\343(\320\357M\251\210\247\1\331%\241}\213\245\303\330\23\3070\202\204@\2\216j\0\343\364\237\236\250\15\325\372\3Y$\375 K\371\364\300P\241\214\304\0\367\301g\206\310\256v\213Hs\337\2e\343\346\237\220K\350F\340\4\253\345@\370\240)\304g\345H\364\330\0\251d\323\362Y\3140\7`N\370\224\232\200K}\305\245\374$\1\212\307\273\300Ux,\200@\357\354\342\321\246\322\3\341\372X\327\3756\200\346\217\331\17!\210\326(\200\351"\36\313\276 \314\213\10\232]\362\347\14\254\322B2\0\320\375$T\304\250H>\37\222y\305@\255\31\32\313\253", 61440, 0x0, 0, ... {status=0x0, info=61440}, ) \36\313\276 \314\213\10\232]\362\347\14\254\322B2\0\320\375$T\304\250H>\37\222y\305@\255\31\32\313\253", 61440, 0x0, 0, ... {status=0x0, info=61440}, ) == 0x0 02544 432 NtReadFile (480, 0, 0, 0, 61440, 0x0, 0, ... {status=0x0, info=61440}, (480, 0, 0, 0, 61440, 0x0, 0, ... {status=0x0, info=61440}, "\34\233\3779&L~\327XZZ\202\351\354\233\375E\267H4\10+x(\216/\372\376j"\330\345\35;\210\307\244\312\35Q\207\371\3512}2j\204\330\254\3414\264<\357\333\325kq\11\324\366\23\222Z\304\354\23\231\310\217\30NC!\247h"\306\177f\2QY\327Y\22*\270S`\30EX\363\5hh!\264'\351\222=~\263\253\26H\25\3735?\357,?\264\345\5\276\4\367\235I\311\263\3546\31Yy\223~*\321\261\243D/_\267\3127}E2\220\357\205hQ\257\22\376\252-\257{\346\367^\363|\27\351\257A1Z0\307Xq\275.\221J6+\0\351mS\235To\344\24F\330\371\256HB\27\2\364\36\365#\211V\230\1\346\327C-&\177\1r\333\334\362,\365\305/\270IL\11 \353l)V8\352\11"\227\207\16\213\207\322\343\26\351E\2247u\203\314\374p~\245\1V\3\3\305\35\7@n\20\10\345\337\20\251W\17K\347\34\206$)\207-\200\104\304\4\263\21\4\210\215\4\334\16\4\255\14\4(\33\6\250\270H1\205\315\10\321t\210\30S\252\30\2251\231\240\304\20bz\6\_\10 V\275 /\3427\346\321(\206\220\1014,\30\17\327\1A'\214\20\203i\10=@4k\343\1\274\376\210(\33S\10]\212\10R\\10p\5\10F\222\10\234A\10\233\300\14\330\235\30\331\314\271`1\245ba\10\312\202\3\335\2371(\311iG\247\1\344v\7\304\226\14l\271H\210\363\340\304\20IX\12\26\310\210\314\271\10\3055\15\220%\271\22\300\373\242\240\307h\2\327&\17\330\211\36\250\200\24C\200\276\303\203\205L\240w\321db\3640\264\330\3\36\2651\31\311\10Q\242\210 Vp\10\300\253\10\254j\10\360\325$\2321\20*\366\1P\267\220", ) \330\345\35;\210\307\244\312\35Q\207\371\3512}2j\204\330\254\3414\264<\357\333\325kq\11\324\366\23\222Z\304\354\23\231\310\217\30NC!\247h (480, 0, 0, 0, 61440, 0x0, 0, ... {status=0x0, info=61440}, "\34\233\3779&L~\327XZZ\202\351\354\233\375E\267H4\10+x(\216/\372\376j"\330\345\35;\210\307\244\312\35Q\207\371\3512}2j\204\330\254\3414\264<\357\333\325kq\11\324\366\23\222Z\304\354\23\231\310\217\30NC!\247h"\306\177f\2QY\327Y\22*\270S`\30EX\363\5hh!\264'\351\222=~\263\253\26H\25\3735?\357,?\264\345\5\276\4\367\235I\311\263\3546\31Yy\223~*\321\261\243D/_\267\3127}E2\220\357\205hQ\257\22\376\252-\257{\346\367^\363|\27\351\257A1Z0\307Xq\275.\221J6+\0\351mS\235To\344\24F\330\371\256HB\27\2\364\36\365#\211V\230\1\346\327C-&\177\1r\333\334\362,\365\305/\270IL\11 \353l)V8\352\11"\227\207\16\213\207\322\343\26\351E\2247u\203\314\374p~\245\1V\3\3\305\35\7@n\20\10\345\337\20\251W\17K\347\34\206$)\207-\200\104\304\4\263\21\4\210\215\4\334\16\4\255\14\4(\33\6\250\270H1\205\315\10\321t\210\30S\252\30\2251\231\240\304\20bz\6\_\10 V\275 /\3427\346\321(\206\220\1014,\30\17\327\1A'\214\20\203i\10=@4k\343\1\274\376\210(\33S\10]\212\10R\\10p\5\10F\222\10\234A\10\233\300\14\330\235\30\331\314\271`1\245ba\10\312\202\3\335\2371(\311iG\247\1\344v\7\304\226\14l\271H\210\363\340\304\20IX\12\26\310\210\314\271\10\3055\15\220%\271\22\300\373\242\240\307h\2\327&\17\330\211\36\250\200\24C\200\276\303\203\205L\240w\321db\3640\264\330\3\36\2651\31\311\10Q\242\210 Vp\10\300\253\10\254j\10\360\325$\2321\20*\366\1P\267\220", ) \227\207\16\213\207\322\343\26\351E\2247u\203\314\374p~\245\1V\3\3\305\35\7@n\20\10\345\337\20\251W\17K\347\34\206$)\207-\200\104\304\4\263\21\4\210\215\4\334\16\4\255\14\4(\33\6\250\270H1\205\315\10\321t\210\30S\252\30\2251\231\240\304\20bz\6\_\10 V\275 /\3427\346\321(\206\220\1014,\30\17\327\1A'\214\20\203i\10=@4k\343\1\274\376\210(\33S\10]\212\10R\\10p\5\10F\222\10\234A\10\233\300\14\330\235\30\331\314\271`1\245ba\10\312\202\3\335\2371(\311iG\247\1\344v\7\304\226\14l\271H\210\363\340\304\20IX\12\26\310\210\314\271\10\3055\15\220%\271\22\300\373\242\240\307h\2\327&\17\330\211\36\250\200\24C\200\276\303\203\205L\240w\321db\3640\264\330\3\36\2651\31\311\10Q\242\210 Vp\10\300\253\10\254j\10\360\325$\2321\20*\366\1P\267\220", ) == 0x0 02545 432 NtWriteFile (476, 0, 0, 0, (476, 0, 0, 0, "\34\233\3779&L~\327XZZ\202\351\354\233\375E\267H4\10+x(\216/\372\376j"\330\345\35;\210\307\244\312\35Q\207\371\3512}2j\204\330\254\3414\264<\357\333\325kq\11\324\366\23\222Z\304\354\23\231\310\217\30NC!\247h"\306\177f\2QY\327Y\22*\270S`\30EX\363\5hh!\264'\351\222=~\263\253\26H\25\3735?\357,?\264\345\5\276\4\367\235I\311\263\3546\31Yy\223~*\321\261\243D/_\267\3127}E2\220\357\205hQ\257\22\376\252-\257{\346\367^\363|\27\351\257A1Z0\307Xq\275.\221J6+\0\351mS\235To\344\24F\330\371\256HB\27\2\364\36\365#\211V\230\1\346\327C-&\177\1r\333\334\362,\365\305/\270IL\11 \353l)V8\352\11"\227\207\16\213\207\322\343\26\351E\2247u\203\314\374p~\245\1V\3\3\305\35\7@n\20\10\345\337\20\251W\17K\347\34\206$)\207-\200\104\304\4\263\21\4\210\215\4\334\16\4\255\14\4(\33\6\250\270H1\205\315\10\321t\210\30S\252\30\2251\231\240\304\20bz\6\_\10 V\275 /\3427\346\321(\206\220\1014,\30\17\327\1A'\214\20\203i\10=@4k\343\1\274\376\210(\33S\10]\212\10R\\10p\5\10F\222\10\234A\10\233\300\14\330\235\30\331\314\271`1\245ba\10\312\202\3\335\2371(\311iG\247\1\344v\7\304\226\14l\271H\210\363\340\304\20IX\12\26\310\210\314\271\10\3055\15\220%\271\22\300\373\242\240\307h\2\327&\17\330\211\36\250\200\24C\200\276\303\203\205L\240w\321db\3640\264\330\3\36\2651\31\311\10Q\242\210 Vp\10\300\253\10\254j\10\360\325$\2321\20*\366\1P\267\220", 61440, 0x0, 0, ... {status=0x0, info=61440}, ) \330\345\35;\210\307\244\312\35Q\207\371\3512}2j\204\330\254\3414\264<\357\333\325kq\11\324\366\23\222Z\304\354\23\231\310\217\30NC!\247h (476, 0, 0, 0, "\34\233\3779&L~\327XZZ\202\351\354\233\375E\267H4\10+x(\216/\372\376j"\330\345\35;\210\307\244\312\35Q\207\371\3512}2j\204\330\254\3414\264<\357\333\325kq\11\324\366\23\222Z\304\354\23\231\310\217\30NC!\247h"\306\177f\2QY\327Y\22*\270S`\30EX\363\5hh!\264'\351\222=~\263\253\26H\25\3735?\357,?\264\345\5\276\4\367\235I\311\263\3546\31Yy\223~*\321\261\243D/_\267\3127}E2\220\357\205hQ\257\22\376\252-\257{\346\367^\363|\27\351\257A1Z0\307Xq\275.\221J6+\0\351mS\235To\344\24F\330\371\256HB\27\2\364\36\365#\211V\230\1\346\327C-&\177\1r\333\334\362,\365\305/\270IL\11 \353l)V8\352\11"\227\207\16\213\207\322\343\26\351E\2247u\203\314\374p~\245\1V\3\3\305\35\7@n\20\10\345\337\20\251W\17K\347\34\206$)\207-\200\104\304\4\263\21\4\210\215\4\334\16\4\255\14\4(\33\6\250\270H1\205\315\10\321t\210\30S\252\30\2251\231\240\304\20bz\6\_\10 V\275 /\3427\346\321(\206\220\1014,\30\17\327\1A'\214\20\203i\10=@4k\343\1\274\376\210(\33S\10]\212\10R\\10p\5\10F\222\10\234A\10\233\300\14\330\235\30\331\314\271`1\245ba\10\312\202\3\335\2371(\311iG\247\1\344v\7\304\226\14l\271H\210\363\340\304\20IX\12\26\310\210\314\271\10\3055\15\220%\271\22\300\373\242\240\307h\2\327&\17\330\211\36\250\200\24C\200\276\303\203\205L\240w\321db\3640\264\330\3\36\2651\31\311\10Q\242\210 Vp\10\300\253\10\254j\10\360\325$\2321\20*\366\1P\267\220", 61440, 0x0, 0, ... {status=0x0, info=61440}, ) \227\207\16\213\207\322\343\26\351E\2247u\203\314\374p~\245\1V\3\3\305\35\7@n\20\10\345\337\20\251W\17K\347\34\206$)\207-\200\104\304\4\263\21\4\210\215\4\334\16\4\255\14\4(\33\6\250\270H1\205\315\10\321t\210\30S\252\30\2251\231\240\304\20bz\6\_\10 V\275 /\3427\346\321(\206\220\1014,\30\17\327\1A'\214\20\203i\10=@4k\343\1\274\376\210(\33S\10]\212\10R\\10p\5\10F\222\10\234A\10\233\300\14\330\235\30\331\314\271`1\245ba\10\312\202\3\335\2371(\311iG\247\1\344v\7\304\226\14l\271H\210\363\340\304\20IX\12\26\310\210\314\271\10\3055\15\220%\271\22\300\373\242\240\307h\2\327&\17\330\211\36\250\200\24C\200\276\303\203\205L\240w\321db\3640\264\330\3\36\2651\31\311\10Q\242\210 Vp\10\300\253\10\254j\10\360\325$\2321\20*\366\1P\267\220", 61440, 0x0, 0, ... {status=0x0, info=61440}, ) == 0x0 02546 432 NtReadFile (480, 0, 0, 0, 61440, 0x0, 0, ... {status=0x0, info=61440}, (480, 0, 0, 0, 61440, 0x0, 0, ... {status=0x0, info=61440}, "\5Kk\234\17\276\300\343\351\27x\271\16\357\306\267\274\35\4\342Bs{|\201\260\1779\0\210\345X\22(\353Y\373\312\231\202h\365\34F|\16\260\2154^B+\14Ga\300\22*\220Y*z\240\345+\360\177E\4\315\37\351\202\343\376 }\307]y\7\255p\227\367\320<.\330/0 \300N\351\306-\232\274T\273 \323:\317F\245\30AG\14Gr\320h}?s\275R\260\360xx\25\240\307\255\274\225Q9o\266\273(\215{\272@\225P\342 \373d\25h\302|\177}\37\317\271\376\255\177\273\253\361nJ\202q\352S:N\325\226\312\3P\270\274f\226OIn\220\202\351\247\375\350\327\245=\257A'\252T\263z\300\36(v'\222\1\343\310\15|rA1p+\203\355D\314\3P\260\274\301O\2\201\251\305.\252K\332\355>>\327\323N\344kg\325\310\352\342\231\0\201\357\330y\15\10O\240\346\32%'\251xi\11\367\334\274\26\240\210a\316\200\267\207Z(\34i\17\310\4\32p\360]\227W\2\225\235hwz\315\354\362\266ti\336]\13\20\271\336\366Rw\371\206`\22t:cKI\0\257\276\327m{]\267p\273 \340<\265\340\223a_^\32DVZf\370\214\324xy,g\227\337\213\234\337%5\301Qs\215O\32/+\271\363\337\323\262\360\300,p\323:\320\4[\375\263\2269Dn\340\274\370\232\254\265\q\2\275\12\204e\334*ahbu>0\22IS\15\220\353 \237\245\4\273:\252A\315\376\321n?(:\366\36\224\270E.\320\5\264\4Z\13QhXGT\334g\375\4E\201\\2057"\340J\352\307\10\263\353\360(L\\363\362u\220\35\237Y", ) \340J\352\307\10\263\353\360(L\\363\362u\220\35\237Y", ) == 0x0 02547 432 NtWriteFile (476, 0, 0, 0, (476, 0, 0, 0, "\5Kk\234\17\276\300\343\351\27x\271\16\357\306\267\274\35\4\342Bs{|\201\260\1779\0\210\345X\22(\353Y\373\312\231\202h\365\34F|\16\260\2154^B+\14Ga\300\22*\220Y*z\240\345+\360\177E\4\315\37\351\202\343\376 }\307]y\7\255p\227\367\320<.\330/0 \300N\351\306-\232\274T\273 \323:\317F\245\30AG\14Gr\320h}?s\275R\260\360xx\25\240\307\255\274\225Q9o\266\273(\215{\272@\225P\342 \373d\25h\302|\177}\37\317\271\376\255\177\273\253\361nJ\202q\352S:N\325\226\312\3P\270\274f\226OIn\220\202\351\247\375\350\327\245=\257A'\252T\263z\300\36(v'\222\1\343\310\15|rA1p+\203\355D\314\3P\260\274\301O\2\201\251\305.\252K\332\355>>\327\323N\344kg\325\310\352\342\231\0\201\357\330y\15\10O\240\346\32%'\251xi\11\367\334\274\26\240\210a\316\200\267\207Z(\34i\17\310\4\32p\360]\227W\2\225\235hwz\315\354\362\266ti\336]\13\20\271\336\366Rw\371\206`\22t:cKI\0\257\276\327m{]\267p\273 \340<\265\340\223a_^\32DVZf\370\214\324xy,g\227\337\213\234\337%5\301Qs\215O\32/+\271\363\337\323\262\360\300,p\323:\320\4[\375\263\2269Dn\340\274\370\232\254\265\q\2\275\12\204e\334*ahbu>0\22IS\15\220\353 \237\245\4\273:\252A\315\376\321n?(:\366\36\224\270E.\320\5\264\4Z\13QhXGT\334g\375\4E\201\\2057"\340J\352\307\10\263\353\360(L\\363\362u\220\35\237Y", 61440, 0x0, 0, ... {status=0x0, info=61440}, ) \340J\352\307\10\263\353\360(L\\363\362u\220\35\237Y", 61440, 0x0, 0, ... {status=0x0, info=61440}, ) == 0x0 02548 432 NtReadFile (480, 0, 0, 0, 61440, 0x0, 0, ... {status=0x0, info=61440}, (480, 0, 0, 0, 61440, 0x0, 0, ... {status=0x0, info=61440}, "\2\344\7:*\16yp\0\279\326\25\207\350\3415\11\342\314\3326\241\224\313\300m\260*=\307\354\342\23w\220,\355\223,\316W\313l\210E\316\0X\202!]\342\5,O\250\320\1 \250\256\14\203\27\2\336h\310\3609\0\251\254\2238C^\203\34p\314\247\344DK`w\7\13\344*\27k\3755\200\264\275\215:\236\20\221F\5\342=\302;\11\214\332\344XDW\307\0?\347\222-\264f\237\232\0\267\5\352k\311\21hg\7\3418\2\340zG\3EX\362\240\362\2460|}\7\31Q\15\2568@\334\222\350\262\13\255#f\1\20\11\354\232E\13G\264DK`\202x\200\4\22(!\277h\302\214", ) \11\354\232E\13G\264DK`\202x\200\4\22(!\277h\302\214", ) == 0x0 02549 432 NtWriteFile (476, 0, 0, 0, (476, 0, 0, 0, "\2\344\7:*\16yp\0\279\326\25\207\350\3415\11\342\314\3326\241\224\313\300m\260*=\307\354\342\23w\220,\355\223,\316W\313l\210E\316\0X\202!]\342\5,O\250\320\1 \250\256\14\203\27\2\336h\310\3609\0\251\254\2238C^\203\34p\314\247\344DK`w\7\13\344*\27k\3755\200\264\275\215:\236\20\221F\5\342=\302;\11\214\332\344XDW\307\0?\347\222-\264f\237\232\0\267\5\352k\311\21hg\7\3418\2\340zG\3EX\362\240\362\2460|}\7\31Q\15\2568@\334\222\350\262\13\255#f\1\20\11\354\232E\13G\264DK`\202x\200\4\22(!\277h\302\214", 61440, 0x0, 0, ... {status=0x0, info=61440}, ) \11\354\232E\13G\264DK`\202x\200\4\22(!\277h\302\214", 61440, 0x0, 0, ... {status=0x0, info=61440}, ) == 0x0 02550 432 NtReadFile (480, 0, 0, 0, 61440, 0x0, 0, ... {status=0x0, info=61440}, (480, 0, 0, 0, 61440, 0x0, 0, ... {status=0x0, info=61440}, "\335]\1h\264\206>b\252\0\375\332\251\32\222\272\201\681n\211\340\10`r!\276\22\222\35\0\220\23`,\12\31\333\20\0\233\370\344os\202j%\35\203\5\340p\20\357\333y\0\177R\332\11\267]\222\353N/\26\351\31\246\11\340\200!\275\252\352\33\233T\0I\373\3478\204\1UE\1\376\375#\13;\337|0\16^\17\366nb\264\241\230\6G\225\343\246\260\14z1c\205TC3Q\357\11T\0h\375\32yfM\301A\1\342%\376\364\302|\353\260Y\221\375\357\12\35;\343c\307\272,\30\15 \138\210R\304N\300J\345\224\266\6S\264L\207\247P\362<\5YO&i\32\0\234\6\355\254\242r\240\254\232\322\13\221\317\351N\216T\300\365\376\207\277\256\3K\222\325\262L\2\320\254\14\227\0\305\37\274k\341\205\240@\372\217\1\231\365B\322\310\364\243\360\235\211L\246\212\0IbDY\273we\34\207\327\31\17\21g\0\361H\30\202\214\0\262\254\351M*\251\330\33\3i\230\23\253\327}\300? rr\360\0\341,\371\315$+g\0\254i\267\200\220\240*\3\13\1S\350=\266n\313\340/\355\37wX\0\7\332\303\351:\300\34\216\358\10j\300>\356K\242\4\224>\240\207\4(\247"X\377\12\5\235\372\216@\14\330\3541\211\306\14\14"I6C\322\20\3444\210\336\201\237\351r\353\6\360\3V\376\241\7\250\16\245\224)\203\216\201\231\300\330t\225\30V\69 \37\257\3p\213\305\4\235\367uQ\14\310\337\353\3118\33\0\240\2100\224\307\12\361\3338\325\207\17\225\241"\202X\213\36\1\316\317\301\340I\33\241\10\304\340\234\203\301\221\7\366\37`\341\266\3642\263)4\202\224\2!\211\35\31\201\210\340\37\316\0)\377-\0\365\24", ) \371\315$+g\0\254i\267\200\220\240*\3\13\1S\350=\266n\313\340/\355\37wX\0\7\332\303\351:\300\34\216\358\10j\300>\356K\242\4\224>\240\207\4(\247 (480, 0, 0, 0, 61440, 0x0, 0, ... {status=0x0, info=61440}, "\335]\1h\264\206>b\252\0\375\332\251\32\222\272\201\681n\211\340\10`r!\276\22\222\35\0\220\23`,\12\31\333\20\0\233\370\344os\202j%\35\203\5\340p\20\357\333y\0\177R\332\11\267]\222\353N/\26\351\31\246\11\340\200!\275\252\352\33\233T\0I\373\3478\204\1UE\1\376\375#\13;\337|0\16^\17\366nb\264\241\230\6G\225\343\246\260\14z1c\205TC3Q\357\11T\0h\375\32yfM\301A\1\342%\376\364\302|\353\260Y\221\375\357\12\35;\343c\307\272,\30\15 \138\210R\304N\300J\345\224\266\6S\264L\207\247P\362<\5YO&i\32\0\234\6\355\254\242r\240\254\232\322\13\221\317\351N\216T\300\365\376\207\277\256\3K\222\325\262L\2\320\254\14\227\0\305\37\274k\341\205\240@\372\217\1\231\365B\322\310\364\243\360\235\211L\246\212\0IbDY\273we\34\207\327\31\17\21g\0\361H\30\202\214\0\262\254\351M*\251\330\33\3i\230\23\253\327}\300? rr\360\0\341,\371\315$+g\0\254i\267\200\220\240*\3\13\1S\350=\266n\313\340/\355\37wX\0\7\332\303\351:\300\34\216\358\10j\300>\356K\242\4\224>\240\207\4(\247"X\377\12\5\235\372\216@\14\330\3541\211\306\14\14"I6C\322\20\3444\210\336\201\237\351r\353\6\360\3V\376\241\7\250\16\245\224)\203\216\201\231\300\330t\225\30V\69 \37\257\3p\213\305\4\235\367uQ\14\310\337\353\3118\33\0\240\2100\224\307\12\361\3338\325\207\17\225\241"\202X\213\36\1\316\317\301\340I\33\241\10\304\340\234\203\301\221\7\366\37`\341\266\3642\263)4\202\224\2!\211\35\31\201\210\340\37\316\0)\377-\0\365\24", ) I6C\322\20\3444\210\336\201\237\351r\353\6\360\3V\376\241\7\250\16\245\224)\203\216\201\231\300\330t\225\30V\69 \37\257\3p\213\305\4\235\367uQ\14\310\337\353\3118\33\0\240\2100\224\307\12\361\3338\325\207\17\225\241 (480, 0, 0, 0, 61440, 0x0, 0, ... {status=0x0, info=61440}, "\335]\1h\264\206>b\252\0\375\332\251\32\222\272\201\681n\211\340\10`r!\276\22\222\35\0\220\23`,\12\31\333\20\0\233\370\344os\202j%\35\203\5\340p\20\357\333y\0\177R\332\11\267]\222\353N/\26\351\31\246\11\340\200!\275\252\352\33\233T\0I\373\3478\204\1UE\1\376\375#\13;\337|0\16^\17\366nb\264\241\230\6G\225\343\246\260\14z1c\205TC3Q\357\11T\0h\375\32yfM\301A\1\342%\376\364\302|\353\260Y\221\375\357\12\35;\343c\307\272,\30\15 \138\210R\304N\300J\345\224\266\6S\264L\207\247P\362<\5YO&i\32\0\234\6\355\254\242r\240\254\232\322\13\221\317\351N\216T\300\365\376\207\277\256\3K\222\325\262L\2\320\254\14\227\0\305\37\274k\341\205\240@\372\217\1\231\365B\322\310\364\243\360\235\211L\246\212\0IbDY\273we\34\207\327\31\17\21g\0\361H\30\202\214\0\262\254\351M*\251\330\33\3i\230\23\253\327}\300? rr\360\0\341,\371\315$+g\0\254i\267\200\220\240*\3\13\1S\350=\266n\313\340/\355\37wX\0\7\332\303\351:\300\34\216\358\10j\300>\356K\242\4\224>\240\207\4(\247"X\377\12\5\235\372\216@\14\330\3541\211\306\14\14"I6C\322\20\3444\210\336\201\237\351r\353\6\360\3V\376\241\7\250\16\245\224)\203\216\201\231\300\330t\225\30V\69 \37\257\3p\213\305\4\235\367uQ\14\310\337\353\3118\33\0\240\2100\224\307\12\361\3338\325\207\17\225\241"\202X\213\36\1\316\317\301\340I\33\241\10\304\340\234\203\301\221\7\366\37`\341\266\3642\263)4\202\224\2!\211\35\31\201\210\340\37\316\0)\377-\0\365\24", ) , ) == 0x0 02551 432 NtWriteFile (476, 0, 0, 0, (476, 0, 0, 0, "\335]\1h\264\206>b\252\0\375\332\251\32\222\272\201\681n\211\340\10`r!\276\22\222\35\0\220\23`,\12\31\333\20\0\233\370\344os\202j%\35\203\5\340p\20\357\333y\0\177R\332\11\267]\222\353N/\26\351\31\246\11\340\200!\275\252\352\33\233T\0I\373\3478\204\1UE\1\376\375#\13;\337|0\16^\17\366nb\264\241\230\6G\225\343\246\260\14z1c\205TC3Q\357\11T\0h\375\32yfM\301A\1\342%\376\364\302|\353\260Y\221\375\357\12\35;\343c\307\272,\30\15 \138\210R\304N\300J\345\224\266\6S\264L\207\247P\362<\5YO&i\32\0\234\6\355\254\242r\240\254\232\322\13\221\317\351N\216T\300\365\376\207\277\256\3K\222\325\262L\2\320\254\14\227\0\305\37\274k\341\205\240@\372\217\1\231\365B\322\310\364\243\360\235\211L\246\212\0IbDY\273we\34\207\327\31\17\21g\0\361H\30\202\214\0\262\254\351M*\251\330\33\3i\230\23\253\327}\300? rr\360\0\341,\371\315$+g\0\254i\267\200\220\240*\3\13\1S\350=\266n\313\340/\355\37wX\0\7\332\303\351:\300\34\216\358\10j\300>\356K\242\4\224>\240\207\4(\247"X\377\12\5\235\372\216@\14\330\3541\211\306\14\14"I6C\322\20\3444\210\336\201\237\351r\353\6\360\3V\376\241\7\250\16\245\224)\203\216\201\231\300\330t\225\30V\69 \37\257\3p\213\305\4\235\367uQ\14\310\337\353\3118\33\0\240\2100\224\307\12\361\3338\325\207\17\225\241"\202X\213\36\1\316\317\301\340I\33\241\10\304\340\234\203\301\221\7\366\37`\341\266\3642\263)4\202\224\2!\211\35\31\201\210\340\37\316\0)\377-\0\365\24", 61440, 0x0, 0, ... {status=0x0, info=61440}, ) \371\315$+g\0\254i\267\200\220\240*\3\13\1S\350=\266n\313\340/\355\37wX\0\7\332\303\351:\300\34\216\358\10j\300>\356K\242\4\224>\240\207\4(\247 (476, 0, 0, 0, "\335]\1h\264\206>b\252\0\375\332\251\32\222\272\201\681n\211\340\10`r!\276\22\222\35\0\220\23`,\12\31\333\20\0\233\370\344os\202j%\35\203\5\340p\20\357\333y\0\177R\332\11\267]\222\353N/\26\351\31\246\11\340\200!\275\252\352\33\233T\0I\373\3478\204\1UE\1\376\375#\13;\337|0\16^\17\366nb\264\241\230\6G\225\343\246\260\14z1c\205TC3Q\357\11T\0h\375\32yfM\301A\1\342%\376\364\302|\353\260Y\221\375\357\12\35;\343c\307\272,\30\15 \138\210R\304N\300J\345\224\266\6S\264L\207\247P\362<\5YO&i\32\0\234\6\355\254\242r\240\254\232\322\13\221\317\351N\216T\300\365\376\207\277\256\3K\222\325\262L\2\320\254\14\227\0\305\37\274k\341\205\240@\372\217\1\231\365B\322\310\364\243\360\235\211L\246\212\0IbDY\273we\34\207\327\31\17\21g\0\361H\30\202\214\0\262\254\351M*\251\330\33\3i\230\23\253\327}\300? rr\360\0\341,\371\315$+g\0\254i\267\200\220\240*\3\13\1S\350=\266n\313\340/\355\37wX\0\7\332\303\351:\300\34\216\358\10j\300>\356K\242\4\224>\240\207\4(\247"X\377\12\5\235\372\216@\14\330\3541\211\306\14\14"I6C\322\20\3444\210\336\201\237\351r\353\6\360\3V\376\241\7\250\16\245\224)\203\216\201\231\300\330t\225\30V\69 \37\257\3p\213\305\4\235\367uQ\14\310\337\353\3118\33\0\240\2100\224\307\12\361\3338\325\207\17\225\241"\202X\213\36\1\316\317\301\340I\33\241\10\304\340\234\203\301\221\7\366\37`\341\266\3642\263)4\202\224\2!\211\35\31\201\210\340\37\316\0)\377-\0\365\24", 61440, 0x0, 0, ... {status=0x0, info=61440}, ) I6C\322\20\3444\210\336\201\237\351r\353\6\360\3V\376\241\7\250\16\245\224)\203\216\201\231\300\330t\225\30V\69 \37\257\3p\213\305\4\235\367uQ\14\310\337\353\3118\33\0\240\2100\224\307\12\361\3338\325\207\17\225\241 (476, 0, 0, 0, "\335]\1h\264\206>b\252\0\375\332\251\32\222\272\201\681n\211\340\10`r!\276\22\222\35\0\220\23`,\12\31\333\20\0\233\370\344os\202j%\35\203\5\340p\20\357\333y\0\177R\332\11\267]\222\353N/\26\351\31\246\11\340\200!\275\252\352\33\233T\0I\373\3478\204\1UE\1\376\375#\13;\337|0\16^\17\366nb\264\241\230\6G\225\343\246\260\14z1c\205TC3Q\357\11T\0h\375\32yfM\301A\1\342%\376\364\302|\353\260Y\221\375\357\12\35;\343c\307\272,\30\15 \138\210R\304N\300J\345\224\266\6S\264L\207\247P\362<\5YO&i\32\0\234\6\355\254\242r\240\254\232\322\13\221\317\351N\216T\300\365\376\207\277\256\3K\222\325\262L\2\320\254\14\227\0\305\37\274k\341\205\240@\372\217\1\231\365B\322\310\364\243\360\235\211L\246\212\0IbDY\273we\34\207\327\31\17\21g\0\361H\30\202\214\0\262\254\351M*\251\330\33\3i\230\23\253\327}\300? rr\360\0\341,\371\315$+g\0\254i\267\200\220\240*\3\13\1S\350=\266n\313\340/\355\37wX\0\7\332\303\351:\300\34\216\358\10j\300>\356K\242\4\224>\240\207\4(\247"X\377\12\5\235\372\216@\14\330\3541\211\306\14\14"I6C\322\20\3444\210\336\201\237\351r\353\6\360\3V\376\241\7\250\16\245\224)\203\216\201\231\300\330t\225\30V\69 \37\257\3p\213\305\4\235\367uQ\14\310\337\353\3118\33\0\240\2100\224\307\12\361\3338\325\207\17\225\241"\202X\213\36\1\316\317\301\340I\33\241\10\304\340\234\203\301\221\7\366\37`\341\266\3642\263)4\202\224\2!\211\35\31\201\210\340\37\316\0)\377-\0\365\24", 61440, 0x0, 0, ... {status=0x0, info=61440}, ) , 61440, 0x0, 0, ... {status=0x0, info=61440}, ) == 0x0 02552 432 NtReadFile (480, 0, 0, 0, 61440, 0x0, 0, ... {status=0x0, info=61440}, (480, 0, 0, 0, 61440, 0x0, 0, ... {status=0x0, info=61440}, "\204iM\244~\1\344\237\23\235#\335Ap\331\0\201\16\26\310u\254EO\1\222\35\337,d\217G$l\264\3\15u;\343Hi\7\220\201\254\323\315p\14\334\240\355\16\204E\324\301@|y\314b\236\0`\266\232o>\252\30\374\11p\254\311,\200,\234\347\3456\344\305\3\23\301\310\222\364"\260\20\320\244\11K\262i\6\203\320\1\231\210F\345\316\263\3710\357\0\307+\204^J\21\26Y\17\253\30\334\20\377\361\5\250s?\3601\304F\2\254\200\10K\200\244\3325A\3750PQ\20\3316\260\356\374\0\352\213=\23r\363\245\1\0K\307\330+!\356\353\4\0QO|\337\255\233\253\232X\265\264\1\227\355\340\201\365p\310gw\4\375\277f4\213\3400iu\362\0F\330\2173\223\11\334S\354\32\350?\2\326m;\272\324\357\200\334y\301~\273\0\320g\234x\2376/\17\1\223f\277"K_W (\6\0\233\2\346\324\312\215I\240\0FN\373\20/4sb\0\22\347\210\265\311\272X3\0h\277\231\255\305\273\243\332\1)\252Kq\264\204\235\332P\354\352A\0-3\254\5\225@D\211\0T\23q\355"`B\370\0\312\203\11x\35\245\226\177\3708\3\341\30\235\216\34\363\350\266\356\221\0PB\262\3543Z\351\336\300!\361\12r\234yX\326l\7\264\3\206\376\17'F\204\2216'\4@\210\15\205\241\0\373-BA\327\312\354X$<\235(;\1~\372\271\37 )\364\313\322\34\315\30X\334?\300+\257\217\200\23\25\0\273\22\31\264\241\36\330\360\0\211\7$\245\2130a\214\0\3Q\34=\342\270"\371\04\252M\3751\211\304\316\2\334\230(\261\346\260\216\300`q\251Q\25/X\307\2108\207\15\211\256\263 "\324|\0\2235\320<\245\345T$=\3\352\200L\226K", ) \260\20\320\244\11K\262i\6\203\320\1\231\210F\345\316\263\3710\357\0\307+\204^J\21\26Y\17\253\30\334\20\377\361\5\250s?\3601\304F\2\254\200\10K\200\244\3325A\3750PQ\20\3316\260\356\374\0\352\213=\23r\363\245\1\0K\307\330+!\356\353\4\0QO|\337\255\233\253\232X\265\264\1\227\355\340\201\365p\310gw\4\375\277f4\213\3400iu\362\0F\330\2173\223\11\334S\354\32\350?\2\326m;\272\324\357\200\334y\301~\273\0\320g\234x\2376/\17\1\223f\277 (480, 0, 0, 0, 61440, 0x0, 0, ... {status=0x0, info=61440}, "\204iM\244~\1\344\237\23\235#\335Ap\331\0\201\16\26\310u\254EO\1\222\35\337,d\217G$l\264\3\15u;\343Hi\7\220\201\254\323\315p\14\334\240\355\16\204E\324\301@|y\314b\236\0`\266\232o>\252\30\374\11p\254\311,\200,\234\347\3456\344\305\3\23\301\310\222\364"\260\20\320\244\11K\262i\6\203\320\1\231\210F\345\316\263\3710\357\0\307+\204^J\21\26Y\17\253\30\334\20\377\361\5\250s?\3601\304F\2\254\200\10K\200\244\3325A\3750PQ\20\3316\260\356\374\0\352\213=\23r\363\245\1\0K\307\330+!\356\353\4\0QO|\337\255\233\253\232X\265\264\1\227\355\340\201\365p\310gw\4\375\277f4\213\3400iu\362\0F\330\2173\223\11\334S\354\32\350?\2\326m;\272\324\357\200\334y\301~\273\0\320g\234x\2376/\17\1\223f\277"K_W (\6\0\233\2\346\324\312\215I\240\0FN\373\20/4sb\0\22\347\210\265\311\272X3\0h\277\231\255\305\273\243\332\1)\252Kq\264\204\235\332P\354\352A\0-3\254\5\225@D\211\0T\23q\355"`B\370\0\312\203\11x\35\245\226\177\3708\3\341\30\235\216\34\363\350\266\356\221\0PB\262\3543Z\351\336\300!\361\12r\234yX\326l\7\264\3\206\376\17'F\204\2216'\4@\210\15\205\241\0\373-BA\327\312\354X$<\235(;\1~\372\271\37 )\364\313\322\34\315\30X\334?\300+\257\217\200\23\25\0\273\22\31\264\241\36\330\360\0\211\7$\245\2130a\214\0\3Q\34=\342\270"\371\04\252M\3751\211\304\316\2\334\230(\261\346\260\216\300`q\251Q\25/X\307\2108\207\15\211\256\263 "\324|\0\2235\320<\245\345T$=\3\352\200L\226K", ) `B\370\0\312\203\11x\35\245\226\177\3708\3\341\30\235\216\34\363\350\266\356\221\0PB\262\3543Z\351\336\300!\361\12r\234yX\326l\7\264\3\206\376\17'F\204\2216'\4@\210\15\205\241\0\373-BA\327\312\354X$<\235(;\1~\372\271\37 )\364\313\322\34\315\30X\334?\300+\257\217\200\23\25\0\273\22\31\264\241\36\330\360\0\211\7$\245\2130a\214\0\3Q\34=\342\270 (480, 0, 0, 0, 61440, 0x0, 0, ... {status=0x0, info=61440}, "\204iM\244~\1\344\237\23\235#\335Ap\331\0\201\16\26\310u\254EO\1\222\35\337,d\217G$l\264\3\15u;\343Hi\7\220\201\254\323\315p\14\334\240\355\16\204E\324\301@|y\314b\236\0`\266\232o>\252\30\374\11p\254\311,\200,\234\347\3456\344\305\3\23\301\310\222\364"\260\20\320\244\11K\262i\6\203\320\1\231\210F\345\316\263\3710\357\0\307+\204^J\21\26Y\17\253\30\334\20\377\361\5\250s?\3601\304F\2\254\200\10K\200\244\3325A\3750PQ\20\3316\260\356\374\0\352\213=\23r\363\245\1\0K\307\330+!\356\353\4\0QO|\337\255\233\253\232X\265\264\1\227\355\340\201\365p\310gw\4\375\277f4\213\3400iu\362\0F\330\2173\223\11\334S\354\32\350?\2\326m;\272\324\357\200\334y\301~\273\0\320g\234x\2376/\17\1\223f\277"K_W (\6\0\233\2\346\324\312\215I\240\0FN\373\20/4sb\0\22\347\210\265\311\272X3\0h\277\231\255\305\273\243\332\1)\252Kq\264\204\235\332P\354\352A\0-3\254\5\225@D\211\0T\23q\355"`B\370\0\312\203\11x\35\245\226\177\3708\3\341\30\235\216\34\363\350\266\356\221\0PB\262\3543Z\351\336\300!\361\12r\234yX\326l\7\264\3\206\376\17'F\204\2216'\4@\210\15\205\241\0\373-BA\327\312\354X$<\235(;\1~\372\271\37 )\364\313\322\34\315\30X\334?\300+\257\217\200\23\25\0\273\22\31\264\241\36\330\360\0\211\7$\245\2130a\214\0\3Q\34=\342\270"\371\04\252M\3751\211\304\316\2\334\230(\261\346\260\216\300`q\251Q\25/X\307\2108\207\15\211\256\263 "\324|\0\2235\320<\245\345T$=\3\352\200L\226K", ) \324|\0\2235\320<\245\345T$=\3\352\200L\226K", ) == 0x0 02553 432 NtWriteFile (476, 0, 0, 0, (476, 0, 0, 0, "\204iM\244~\1\344\237\23\235#\335Ap\331\0\201\16\26\310u\254EO\1\222\35\337,d\217G$l\264\3\15u;\343Hi\7\220\201\254\323\315p\14\334\240\355\16\204E\324\301@|y\314b\236\0`\266\232o>\252\30\374\11p\254\311,\200,\234\347\3456\344\305\3\23\301\310\222\364"\260\20\320\244\11K\262i\6\203\320\1\231\210F\345\316\263\3710\357\0\307+\204^J\21\26Y\17\253\30\334\20\377\361\5\250s?\3601\304F\2\254\200\10K\200\244\3325A\3750PQ\20\3316\260\356\374\0\352\213=\23r\363\245\1\0K\307\330+!\356\353\4\0QO|\337\255\233\253\232X\265\264\1\227\355\340\201\365p\310gw\4\375\277f4\213\3400iu\362\0F\330\2173\223\11\334S\354\32\350?\2\326m;\272\324\357\200\334y\301~\273\0\320g\234x\2376/\17\1\223f\277"K_W (\6\0\233\2\346\324\312\215I\240\0FN\373\20/4sb\0\22\347\210\265\311\272X3\0h\277\231\255\305\273\243\332\1)\252Kq\264\204\235\332P\354\352A\0-3\254\5\225@D\211\0T\23q\355"`B\370\0\312\203\11x\35\245\226\177\3708\3\341\30\235\216\34\363\350\266\356\221\0PB\262\3543Z\351\336\300!\361\12r\234yX\326l\7\264\3\206\376\17'F\204\2216'\4@\210\15\205\241\0\373-BA\327\312\354X$<\235(;\1~\372\271\37 )\364\313\322\34\315\30X\334?\300+\257\217\200\23\25\0\273\22\31\264\241\36\330\360\0\211\7$\245\2130a\214\0\3Q\34=\342\270"\371\04\252M\3751\211\304\316\2\334\230(\261\346\260\216\300`q\251Q\25/X\307\2108\207\15\211\256\263 "\324|\0\2235\320<\245\345T$=\3\352\200L\226K", 61440, 0x0, 0, ... {status=0x0, info=61440}, ) \260\20\320\244\11K\262i\6\203\320\1\231\210F\345\316\263\3710\357\0\307+\204^J\21\26Y\17\253\30\334\20\377\361\5\250s?\3601\304F\2\254\200\10K\200\244\3325A\3750PQ\20\3316\260\356\374\0\352\213=\23r\363\245\1\0K\307\330+!\356\353\4\0QO|\337\255\233\253\232X\265\264\1\227\355\340\201\365p\310gw\4\375\277f4\213\3400iu\362\0F\330\2173\223\11\334S\354\32\350?\2\326m;\272\324\357\200\334y\301~\273\0\320g\234x\2376/\17\1\223f\277 (476, 0, 0, 0, "\204iM\244~\1\344\237\23\235#\335Ap\331\0\201\16\26\310u\254EO\1\222\35\337,d\217G$l\264\3\15u;\343Hi\7\220\201\254\323\315p\14\334\240\355\16\204E\324\301@|y\314b\236\0`\266\232o>\252\30\374\11p\254\311,\200,\234\347\3456\344\305\3\23\301\310\222\364"\260\20\320\244\11K\262i\6\203\320\1\231\210F\345\316\263\3710\357\0\307+\204^J\21\26Y\17\253\30\334\20\377\361\5\250s?\3601\304F\2\254\200\10K\200\244\3325A\3750PQ\20\3316\260\356\374\0\352\213=\23r\363\245\1\0K\307\330+!\356\353\4\0QO|\337\255\233\253\232X\265\264\1\227\355\340\201\365p\310gw\4\375\277f4\213\3400iu\362\0F\330\2173\223\11\334S\354\32\350?\2\326m;\272\324\357\200\334y\301~\273\0\320g\234x\2376/\17\1\223f\277"K_W (\6\0\233\2\346\324\312\215I\240\0FN\373\20/4sb\0\22\347\210\265\311\272X3\0h\277\231\255\305\273\243\332\1)\252Kq\264\204\235\332P\354\352A\0-3\254\5\225@D\211\0T\23q\355"`B\370\0\312\203\11x\35\245\226\177\3708\3\341\30\235\216\34\363\350\266\356\221\0PB\262\3543Z\351\336\300!\361\12r\234yX\326l\7\264\3\206\376\17'F\204\2216'\4@\210\15\205\241\0\373-BA\327\312\354X$<\235(;\1~\372\271\37 )\364\313\322\34\315\30X\334?\300+\257\217\200\23\25\0\273\22\31\264\241\36\330\360\0\211\7$\245\2130a\214\0\3Q\34=\342\270"\371\04\252M\3751\211\304\316\2\334\230(\261\346\260\216\300`q\251Q\25/X\307\2108\207\15\211\256\263 "\324|\0\2235\320<\245\345T$=\3\352\200L\226K", 61440, 0x0, 0, ... {status=0x0, info=61440}, ) `B\370\0\312\203\11x\35\245\226\177\3708\3\341\30\235\216\34\363\350\266\356\221\0PB\262\3543Z\351\336\300!\361\12r\234yX\326l\7\264\3\206\376\17'F\204\2216'\4@\210\15\205\241\0\373-BA\327\312\354X$<\235(;\1~\372\271\37 )\364\313\322\34\315\30X\334?\300+\257\217\200\23\25\0\273\22\31\264\241\36\330\360\0\211\7$\245\2130a\214\0\3Q\34=\342\270 (476, 0, 0, 0, "\204iM\244~\1\344\237\23\235#\335Ap\331\0\201\16\26\310u\254EO\1\222\35\337,d\217G$l\264\3\15u;\343Hi\7\220\201\254\323\315p\14\334\240\355\16\204E\324\301@|y\314b\236\0`\266\232o>\252\30\374\11p\254\311,\200,\234\347\3456\344\305\3\23\301\310\222\364"\260\20\320\244\11K\262i\6\203\320\1\231\210F\345\316\263\3710\357\0\307+\204^J\21\26Y\17\253\30\334\20\377\361\5\250s?\3601\304F\2\254\200\10K\200\244\3325A\3750PQ\20\3316\260\356\374\0\352\213=\23r\363\245\1\0K\307\330+!\356\353\4\0QO|\337\255\233\253\232X\265\264\1\227\355\340\201\365p\310gw\4\375\277f4\213\3400iu\362\0F\330\2173\223\11\334S\354\32\350?\2\326m;\272\324\357\200\334y\301~\273\0\320g\234x\2376/\17\1\223f\277"K_W (\6\0\233\2\346\324\312\215I\240\0FN\373\20/4sb\0\22\347\210\265\311\272X3\0h\277\231\255\305\273\243\332\1)\252Kq\264\204\235\332P\354\352A\0-3\254\5\225@D\211\0T\23q\355"`B\370\0\312\203\11x\35\245\226\177\3708\3\341\30\235\216\34\363\350\266\356\221\0PB\262\3543Z\351\336\300!\361\12r\234yX\326l\7\264\3\206\376\17'F\204\2216'\4@\210\15\205\241\0\373-BA\327\312\354X$<\235(;\1~\372\271\37 )\364\313\322\34\315\30X\334?\300+\257\217\200\23\25\0\273\22\31\264\241\36\330\360\0\211\7$\245\2130a\214\0\3Q\34=\342\270"\371\04\252M\3751\211\304\316\2\334\230(\261\346\260\216\300`q\251Q\25/X\307\2108\207\15\211\256\263 "\324|\0\2235\320<\245\345T$=\3\352\200L\226K", 61440, 0x0, 0, ... {status=0x0, info=61440}, ) \324|\0\2235\320<\245\345T$=\3\352\200L\226K", 61440, 0x0, 0, ... {status=0x0, info=61440}, ) == 0x0 02554 432 NtReadFile (480, 0, 0, 0, 61440, 0x0, 0, ... {status=0x0, info=61440}, (480, 0, 0, 0, 61440, 0x0, 0, ... {status=0x0, info=61440}, "W\330\217,\334j\351\0\261\322\256.%\236\0\300\262c\255\33626,tg\0\3024\325\3120\36\202\12\0C\323\250\203<\276R\301\0f\346\374\244:q\3004>\327\340\17\211O\343\0\255!\342\237@?1i\201wT\274\225\317\216\200H\336\354m\337\206S\1\32\327\204\360\177\25\363\354\207\357\17\20k\210\226BdP\236\214\200\320\273w\35\12\250\211\371\310\214\207\210\362\367\340\6wD\316\0\334\22\301yj`e\221\0\267\347\306\26543\332\321\0\368 xD\1\333\317\0\355z`\3022\330\274=\0;p\203\24v\303\267\50\352\206\25\365\36\353\372.\355>&\311\0B\267kO\342\276\4\4\346\207w\266\300\313\366\375\26u`7,oQ\207\213w#\0\207\302U\17\355\373HX\0\253s\260\27\317\177\2032\17>\244\231?\264\301\0l\207K\241\302\274~\17\34\25p\254l\32`\364\0\362U=t0\3732\225c)\10|\36\16 T%V\240^\247C\207j:\364r\201GQy\311\350u\214`\245\250>\0\360\262\312\366\4\12\216\362\240\224e\352`g\31110\272\25\300\30o\6\262l\200y\236\20j>\216\40\12#\226\204\351\0\204S\22\257\343\317\6\314\311\261\367 \100\177\233x8\337\260\0\24x\310\313,n\366\227\0\326\20%\25c\371\332=\0\205K\10U\23L\2519\7s8\360\260\363\0VO+\326\0\270\237\350\266\13\262\276\36\0\14\226\221\364\307\301\274D\16\27\344\\352@\244\340;v&\16K\347\323d\200\230\13Lj\225\0R\272U\322\215\17!/\0M\347Z\350\2323J\304\1\303\327\266qV\305 \15R\0\265\312\3171\366\225\370\357\0\260\340n\257zZeA\0p\322\275\224\235\3034\138\260\37\35\213\3\200k, ) , ) == 0x0 02555 432 NtWriteFile (476, 0, 0, 0, (476, 0, 0, 0, "W\330\217,\334j\351\0\261\322\256.%\236\0\300\262c\255\33626,tg\0\3024\325\3120\36\202\12\0C\323\250\203<\276R\301\0f\346\374\244:q\3004>\327\340\17\211O\343\0\255!\342\237@?1i\201wT\274\225\317\216\200H\336\354m\337\206S\1\32\327\204\360\177\25\363\354\207\357\17\20k\210\226BdP\236\214\200\320\273w\35\12\250\211\371\310\214\207\210\362\367\340\6wD\316\0\334\22\301yj`e\221\0\267\347\306\26543\332\321\0\368 xD\1\333\317\0\355z`\3022\330\274=\0;p\203\24v\303\267\50\352\206\25\365\36\353\372.\355>&\311\0B\267kO\342\276\4\4\346\207w\266\300\313\366\375\26u`7,oQ\207\213w#\0\207\302U\17\355\373HX\0\253s\260\27\317\177\2032\17>\244\231?\264\301\0l\207K\241\302\274~\17\34\25p\254l\32`\364\0\362U=t0\3732\225c)\10|\36\16 T%V\240^\247C\207j:\364r\201GQy\311\350u\214`\245\250>\0\360\262\312\366\4\12\216\362\240\224e\352`g\31110\272\25\300\30o\6\262l\200y\236\20j>\216\40\12#\226\204\351\0\204S\22\257\343\317\6\314\311\261\367 \100\177\233x8\337\260\0\24x\310\313,n\366\227\0\326\20%\25c\371\332=\0\205K\10U\23L\2519\7s8\360\260\363\0VO+\326\0\270\237\350\266\13\262\276\36\0\14\226\221\364\307\301\274D\16\27\344\\352@\244\340;v&\16K\347\323d\200\230\13Lj\225\0R\272U\322\215\17!/\0M\347Z\350\2323J\304\1\303\327\266qV\305 \15R\0\265\312\3171\366\225\370\357\0\260\340n\257zZeA\0p\322\275\224\235\3034\138\260\37\35\213\3\200k, 61440, 0x0, 0, ... {status=0x0, info=61440}, ) , 61440, 0x0, 0, ... {status=0x0, info=61440}, ) == 0x0 02556 432 NtReadFile (480, 0, 0, 0, 61440, 0x0, 0, ... {status=0x0, info=25088}, (480, 0, 0, 0, 61440, 0x0, 0, ... {status=0x0, info=25088}, "\331%\17PZu\37\37\300\366\216b\351\343\205M\217\34`\356\350\326\372\260\356{\222D\370:\0\34\271\207\275x\217Vw\2b\26\21\225\247)a\335e!\271\314\307\317\3hP\350*1 \200\206\241$LF\324\11\243J]I,4\301\2450r\244\0\304\3320\224s{\371B.R@\35\0O\374\306m\35\230\23\326\376\14@\10\220\204\363\346\237Ga#I\350\14v \300\306>\267\321\0\35\227\360\253\257bV\341\354Z\320\6mHx\262\3651\0\304\247\26r(:\362=t)\0+\333J\357\351Bl\352\0\372wy\14\344\234\11O\1\211\307m\241k\301\256$\230G\0\210\372\177S\322\342\242#\7\335\23\7\255\144\355\201|\317(\361\214@\210R\346.1\310\22\21\34\150\2677\0!\314\333\204\236_\177\244\0\206/\246P&\252R\23\0$g\15\264\265\253\313\255\0\312\301\37\222\31\12f\233\374>\1\266pB\26z\310x\370yG\270\234\161h\3123\302\235\231N`\314\304\364\0q{\32\352\2325\341D\301\30\372\347\240\344o\341n\365e\300\247s\23\305y\263I\244\22\3\340\357'\370%\301", ) , ) == 0x0 02557 432 NtWriteFile (476, 0, 0, 0, (476, 0, 0, 0, "\331%\17PZu\37\37\300\366\216b\351\343\205M\217\34`\356\350\326\372\260\356{\222D\370:\0\34\271\207\275x\217Vw\2b\26\21\225\247)a\335e!\271\314\307\317\3hP\350*1 \200\206\241$LF\324\11\243J]I,4\301\2450r\244\0\304\3320\224s{\371B.R@\35\0O\374\306m\35\230\23\326\376\14@\10\220\204\363\346\237Ga#I\350\14v \300\306>\267\321\0\35\227\360\253\257bV\341\354Z\320\6mHx\262\3651\0\304\247\26r(:\362=t)\0+\333J\357\351Bl\352\0\372wy\14\344\234\11O\1\211\307m\241k\301\256$\230G\0\210\372\177S\322\342\242#\7\335\23\7\255\144\355\201|\317(\361\214@\210R\346.1\310\22\21\34\150\2677\0!\314\333\204\236_\177\244\0\206/\246P&\252R\23\0$g\15\264\265\253\313\255\0\312\301\37\222\31\12f\233\374>\1\266pB\26z\310x\370yG\270\234\161h\3123\302\235\231N`\314\304\364\0q{\32\352\2325\341D\301\30\372\347\240\344o\341n\365e\300\247s\23\305y\263I\244\22\3\340\357'\370%\301", 25088, 0x0, 0, ... {status=0x0, info=25088}, ) , 25088, 0x0, 0, ... {status=0x0, info=25088}, ) == 0x0 02558 432 NtReadFile (480, 0, 0, 0, 61440, 0x0, 0, ... ) == STATUS_END_OF_FILE 02559 432 NtFreeVirtualMemory (-1, (0x154000), 69632, 16384, ... (0x154000), 69632, ) == 0x0 02560 432 NtSetInformationFile (476, 1242904, 40, Basic, ... {status=0x0, info=0}, ) == 0x0 02561 432 NtClose (480, ... ) == 0x0 02562 432 NtClose (476, ... ) == 0x0 02563 432 NtOpenKey (0xf003f, {24, 48, 0x40, 0, 0, (0xf003f, {24, 48, 0x40, 0, 0, "SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon"}, ... 476, ) }, ... 476, ) == 0x0 02564 432 NtQueryValueKey (476, (476, "Shell", Partial, 144, ... TitleIdx=0, Type=1, Data="E\0x\0p\0l\0o\0r\0e\0r\0.\0e\0x\0e\0\0\0"}, 38, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (476, "Shell", Partial, 144, ... TitleIdx=0, Type=1, Data="E\0x\0p\0l\0o\0r\0e\0r\0.\0e\0x\0e\0\0\0"}, 38, ) }, 38, ) == 0x0 02565 432 NtQueryValueKey (476, (476, "Shell", Partial, 144, ... TitleIdx=0, Type=1, Data="E\0x\0p\0l\0o\0r\0e\0r\0.\0e\0x\0e\0\0\0"}, 38, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (476, "Shell", Partial, 144, ... TitleIdx=0, Type=1, Data="E\0x\0p\0l\0o\0r\0e\0r\0.\0e\0x\0e\0\0\0"}, 38, ) }, 38, ) == 0x0 02566 432 NtClose (476, ... ) == 0x0 02567 432 NtCreateFile (0x80100080, {24, 0, 0x40, 0, 1242812, (0x80100080, {24, 0, 0x40, 0, 1242812, "\??\C:\WINDOWSExplorer.exe"}, 0x0, 128, 1, 1, 96, 0, 0, ... ) }, 0x0, 128, 1, 1, 96, 0, 0, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 02568 432 NtOpenFile (0x100100, {24, 0, 0x40, 0, 0, (0x100100, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\ntvdm.exe"}, 7, 2113568, ... 476, {status=0x0, info=1}, ) }, 7, 2113568, ... 476, {status=0x0, info=1}, ) == 0x0 02569 432 NtSetInformationFile (476, 1243104, 40, Basic, ... {status=0x0, info=0}, ) == 0x0 02570 432 NtClose (476, ... ) == 0x0 02571 432 NtAllocateVirtualMemory (-1, 1220608, 0, 4096, 4096, 260, ... 1220608, 4096, ) == 0x0 02572 432 NtAllocateVirtualMemory (-1, 1216512, 0, 4096, 4096, 260, ... 1216512, 4096, ) == 0x0 02573 432 NtAllocateVirtualMemory (-1, 1212416, 0, 4096, 4096, 260, ... 1212416, 4096, ) == 0x0 02574 432 NtAllocateVirtualMemory (-1, 1208320, 0, 4096, 4096, 260, ... 1208320, 4096, ) == 0x0 02575 432 NtAllocateVirtualMemory (-1, 1204224, 0, 4096, 4096, 260, ... 1204224, 4096, ) == 0x0 02576 432 NtAllocateVirtualMemory (-1, 1200128, 0, 4096, 4096, 260, ... 1200128, 4096, ) == 0x0 02577 432 NtAllocateVirtualMemory (-1, 1196032, 0, 4096, 4096, 260, ... 1196032, 4096, ) == 0x0 02578 432 NtAllocateVirtualMemory (-1, 1191936, 0, 4096, 4096, 260, ... 1191936, 4096, ) == 0x0 02579 432 NtAllocateVirtualMemory (-1, 1187840, 0, 4096, 4096, 260, ... 1187840, 4096, ) == 0x0 02580 432 NtAllocateVirtualMemory (-1, 1183744, 0, 4096, 4096, 260, ... 1183744, 4096, ) == 0x0 02581 432 NtAllocateVirtualMemory (-1, 1179648, 0, 4096, 4096, 260, ... 1179648, 4096, ) == 0x0 02582 432 NtAllocateVirtualMemory (-1, 1175552, 0, 4096, 4096, 260, ... 1175552, 4096, ) == 0x0 02583 432 NtAllocateVirtualMemory (-1, 1171456, 0, 4096, 4096, 260, ... 1171456, 4096, ) == 0x0 02584 432 NtCreateKey (0x20006, {24, 48, 0x40, 0, 0, (0x20006, {24, 48, 0x40, 0, 0, "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Shell Extensions"}, 0, 0x0, 0, ... ) }, 0, 0x0, 0, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 02585 432 NtCreateKey (0x2000000, {24, 48, 0x40, 0, 0, (0x2000000, {24, 48, 0x40, 0, 0, "SOFTWARE"}, 0, 0x0, 0, ... 476, 2, ) }, 0, 0x0, 0, ... 476, 2, ) == 0x0 02586 432 NtCreateKey (0x2000000, {24, 476, 0x40, 0, 0, (0x2000000, {24, 476, 0x40, 0, 0, "Microsoft"}, 0, 0x0, 0, ... 480, 2, ) }, 0, 0x0, 0, ... 480, 2, ) == 0x0 02587 432 NtClose (476, ... ) == 0x0 02588 432 NtCreateKey (0x2000000, {24, 480, 0x40, 0, 0, (0x2000000, {24, 480, 0x40, 0, 0, "Windows"}, 0, 0x0, 0, ... 476, 2, ) }, 0, 0x0, 0, ... 476, 2, ) == 0x0 02589 432 NtClose (480, ... ) == 0x0 02590 432 NtCreateKey (0x2000000, {24, 476, 0x40, 0, 0, (0x2000000, {24, 476, 0x40, 0, 0, "CurrentVersion"}, 0, 0x0, 0, ... 480, 2, ) }, 0, 0x0, 0, ... 480, 2, ) == 0x0 02591 432 NtClose (476, ... ) == 0x0 02592 432 NtCreateKey (0x20006, {24, 480, 0x40, 0, 0, (0x20006, {24, 480, 0x40, 0, 0, "Shell Extensions"}, 0, 0x0, 0, ... 476, 2, ) }, 0, 0x0, 0, ... 476, 2, ) == 0x0 02593 432 NtClose (480, ... ) == 0x0 02594 432 NtSetValueKey (476, (476, "665578", 0, 1, "u\0:\0\\0w\0o\0r\0k\0\\0p\0a\0c\0k\0e\0d\0.\0e\0x\0e\0\0\0", 38, ... , 0, 1, (476, "665578", 0, 1, "u\0:\0\\0w\0o\0r\0k\0\\0p\0a\0c\0k\0e\0d\0.\0e\0x\0e\0\0\0", 38, ... , 38, ... 02595 432 NtSetInformationFile (-2147482808, -104224972, 8, EndOfFile, ... {status=0x0, info=0}, ) == 0x0 02594 432 NtSetValueKey ... ) == 0x0 02596 432 NtClose (476, ... ) == 0x0 02597 432 NtOpenKey (0x1, {24, 48, 0x40, 0, 0, (0x1, {24, 48, 0x40, 0, 0, "SOFTWARE\Kazaa\LocalContent"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 02598 432 NtOpenEvent (0x100000, {24, 56, 0x0, 0, 0, (0x100000, {24, 56, 0x0, 0, 0, "Global\SvcctrlStartEvent_A3752DX"}, ... 476, ) }, ... 476, ) == 0x0 02599 432 NtWaitForSingleObject (476, 0, {-1800000000, -1}, ... ) == 0x0 02600 432 NtClose (476, ... ) == 0x0 02601 432 NtQuerySystemInformation (Basic, 44, ... {Unknown=0,MaximumIncrement=156250,PhysicalPageSize=0x1000,NumberOfPhysicalPages=0xff7c,LowestPhysicalPage=0x1,HighestPhysicalPage=0xffff,AllocationGranularity=0x10000,LowestUserAddress=0x10000,HighestUserAddress=0x7ffeffff,ActiveProcessors=1,NumberProcessors=1,}, 0x0, ) == 0x0 02602 432 NtOpenKey (0x20019, {24, 48, 0x40, 0, 0, (0x20019, {24, 48, 0x40, 0, 0, "Software\Microsoft\Rpc\PagedBuffers"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 02603 432 NtOpenKey (0x20019, {24, 48, 0x40, 0, 0, (0x20019, {24, 48, 0x40, 0, 0, "Software\Microsoft\Rpc"}, ... 476, ) }, ... 476, ) == 0x0 02604 432 NtQueryValueKey (476, (476, "MaxRpcSize", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 02605 432 NtClose (476, ... ) == 0x0 02606 432 NtOpenKey (0x20019, {24, 48, 0x40, 0, 0, (0x20019, {24, 48, 0x40, 0, 0, "Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\packed.exe\RpcThreadPoolThrottle"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 02607 432 NtCreateEvent (0x1f0003, 0x0, 1, 0, ... 476, ) == 0x0 02608 432 NtCreateEvent (0x1f0003, 0x0, 1, 0, ... 480, ) == 0x0 02609 432 NtQuerySystemTime (... {151555486, 29873109}, ) == 0x0 02610 432 NtCreateEvent (0x1f0003, 0x0, 0, 0, ... 484, ) == 0x0 02611 432 NtOpenKey (0x20019, {24, 48, 0x40, 0, 0, (0x20019, {24, 48, 0x40, 0, 0, "Software\Policies\Microsoft\Windows NT\Rpc"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 02612 432 NtQuerySystemInformation (Performance, 312, ... {system info, class 2, size 312}, 0x0, ) == 0x0 02613 432 NtQueryInformationProcess (-1, QuotaLimits, 32, ... {process info, class 1, size 32}, 0x0, ) == 0x0 02614 432 NtQueryInformationProcess (-1, VmCounters, 44, ... {process info, class 3, size 44}, 0x0, ) == 0x0 02615 432 NtCreateEvent (0x1f0003, 0x0, 0, 0, ... 488, ) == 0x0 02616 432 NtDuplicateObject (-1, -2, -1, 0x0, 0, 2, ... 492, ) == 0x0 02617 432 NtOpenKey (0x20019, {24, 0, 0x40, 0, 0, (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\System\CurrentControlSet\Control\ComputerName"}, ... 496, ) }, ... 496, ) == 0x0 02618 432 NtOpenKey (0x20019, {24, 496, 0x40, 0, 0, (0x20019, {24, 496, 0x40, 0, 0, "ActiveComputerName"}, ... 500, ) }, ... 500, ) == 0x0 02619 432 NtQueryValueKey (500, (500, "ComputerName", Full, 108, ... TitleIdx=0, Type=1, Name="ComputerName", Data="M\0Y\0W\0O\0R\0L\0D\0\0\0"}, 60, ) , Full, 108, ... TitleIdx=0, Type=1, Name= (500, "ComputerName", Full, 108, ... TitleIdx=0, Type=1, Name="ComputerName", Data="M\0Y\0W\0O\0R\0L\0D\0\0\0"}, 60, ) , Data= (500, "ComputerName", Full, 108, ... TitleIdx=0, Type=1, Name="ComputerName", Data="M\0Y\0W\0O\0R\0L\0D\0\0\0"}, 60, ) }, 60, ) == 0x0 02620 432 NtClose (500, ... ) == 0x0 02621 432 NtClose (496, ... ) == 0x0 02622 432 NtCreateIoCompletion (0x1f0003, 0x0, 0, ... 496, ) == 0x0 02623 432 NtCreateIoCompletion (0x1f0003, 0x0, -1, ... 500, ) == 0x0 02624 432 NtDuplicateObject (-1, 496, -1, 0x0, 0, 2, ... 504, ) == 0x0 02625 432 NtOpenThreadToken (-2, 0xc, 1, ... ) == STATUS_NO_TOKEN 02626 432 NtCreateEvent (0x1f0003, 0x0, 1, 0, ... 508, ) == 0x0 02627 432 NtOpenThreadToken (-2, 0xc, 1, ... ) == STATUS_NO_TOKEN 02628 432 NtSetInformationThread (-2, ImpersonationToken, {ImpToken=0,}, 4, ... ) == 0x0 02629 432 NtCreateFile (0xc0100080, {24, 0, 0x40, 0, 1242088, (0xc0100080, {24, 0, 0x40, 0, 1242088, "\??\PIPE\svcctl"}, 0x0, 0, 3, 1, 4194368, 0, 0, ... 512, {status=0x0, info=1}, ) }, 0x0, 0, 3, 1, 4194368, 0, 0, ... 512, {status=0x0, info=1}, ) == 0x0 02630 432 NtSetInformationFile (512, 1242144, 8, Pipe, ... {status=0x0, info=0}, ) == 0x0 02631 432 NtSetInformationFile (512, 1242136, 8, Completion, ... {status=0x0, info=0}, ) == 0x0 02632 432 NtSetInformationThread (-2, ImpersonationToken, {ImpToken=0,}, 4, ... ) == 0x0 02633 432 NtWriteFile (512, 489, 0, 0, (512, 489, 0, 0, "\5\0\13\3\20\0\0\0H\0\0\0\1\0\0\0\270\20\270\20\0\0\0\0\1\0\0\0\0\0\1\0\201\273z6D\230\3615\2552\230\3608\0\20\3\2\0\0\0\4]\210\212\353\34\311\21\237\350\10\0+\20H`\2\0\0\0", 72, {0, 0}, 0, ... {status=0x0, info=72}, ) , 72, {0, 0}, 0, ... {status=0x0, info=72}, ) == 0x0 02634 432 NtReadFile (512, 489, 0, 0, 1024, {0, 0}, 0, ... {status=0x0, info=68}, (512, 489, 0, 0, 1024, {0, 0}, 0, ... {status=0x0, info=68}, "\5\0\14\3\20\0\0\0D\0\0\0\1\0\0\0\270\20\270\20\220"\0\0\15\0\PIPE\ntsvcs\0\0\1\0\0\0\0\0\0\0\4]\210\212\353\34\311\21\237\350\10\0+\20H`\2\0\0\0", ) \0\0\15\0\PIPE\ntsvcs\0\0\1\0\0\0\0\0\0\0\4]\210\212\353\34\311\21\237\350\10\0+\20H`\2\0\0\0", ) == 0x0 02635 432 NtFsControlFile (512, 489, 0x0, 0x0, 0x11c017, (512, 489, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0$\0\0\0\1\0\0\0\14\0\0\0\0\0\33\0\0\0\0\0\0\0\0\0\2\0\0\0", 36, 1024, ... {status=0x103, info=68}, "\5\0\14\3\20\0\0\0D\0\0\0\1\0\0\0\270\20\270\20\220"\0\0\15\0\PIPE\ntsvcs\0\0\1\0\0\0\0\0\0\0\4]\210\212\353\34\311\21\237\350\10\0+\20H`\2\0\0\0", ) , 36, 1024, ... {status=0x103, info=68}, (512, 489, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0$\0\0\0\1\0\0\0\14\0\0\0\0\0\33\0\0\0\0\0\0\0\0\0\2\0\0\0", 36, 1024, ... {status=0x103, info=68}, "\5\0\14\3\20\0\0\0D\0\0\0\1\0\0\0\270\20\270\20\220"\0\0\15\0\PIPE\ntsvcs\0\0\1\0\0\0\0\0\0\0\4]\210\212\353\34\311\21\237\350\10\0+\20H`\2\0\0\0", ) \0\0\15\0\PIPE\ntsvcs\0\0\1\0\0\0\0\0\0\0\4]\210\212\353\34\311\21\237\350\10\0+\20H`\2\0\0\0", ) == 0x103 02636 432 NtFsControlFile (512, 489, 0x0, 0x0, 0x11c017, (512, 489, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0\250\0\0\0\2\0\0\0\220\0\0\0\0\0\30\0\0\0\0\0c\236\317C\310?\334\21\261\310\0\14)\371\246\305\7\0\0\0\0\0\0\0\7\0\0\0NTVDM.\0\0\250\251A\0\7\0\0\0\0\0\0\0\7\0\0\0NTVDM.\0\0\377\1\17\0\20\1\0\0\2\0\0\0\0\0\0\0\27\0\0\0\0\0\0\0\27\0\0\0"C:\WINDOWS\ntvdm.exe"\0\237\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0", 168, 1024, ... {status=0x103, info=48}, "\5\0\2\3\20\0\0\00\0\0\0\1\0\0\0\30\0\0\0\0\0\0\0\0\0\0\0c\236\317C\310?\334\21\261\310\0\14)\371\246\305\0\0\0\0", ) C:\WINDOWS\ntvdm.exe (512, 489, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0\250\0\0\0\2\0\0\0\220\0\0\0\0\0\30\0\0\0\0\0c\236\317C\310?\334\21\261\310\0\14)\371\246\305\7\0\0\0\0\0\0\0\7\0\0\0NTVDM.\0\0\250\251A\0\7\0\0\0\0\0\0\0\7\0\0\0NTVDM.\0\0\377\1\17\0\20\1\0\0\2\0\0\0\0\0\0\0\27\0\0\0\0\0\0\0\27\0\0\0"C:\WINDOWS\ntvdm.exe"\0\237\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0", 168, 1024, ... {status=0x103, info=48}, "\5\0\2\3\20\0\0\00\0\0\0\1\0\0\0\30\0\0\0\0\0\0\0\0\0\0\0c\236\317C\310?\334\21\261\310\0\14)\371\246\305\0\0\0\0", ) , 168, 1024, ... {status=0x103, info=48}, (512, 489, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0\250\0\0\0\2\0\0\0\220\0\0\0\0\0\30\0\0\0\0\0c\236\317C\310?\334\21\261\310\0\14)\371\246\305\7\0\0\0\0\0\0\0\7\0\0\0NTVDM.\0\0\250\251A\0\7\0\0\0\0\0\0\0\7\0\0\0NTVDM.\0\0\377\1\17\0\20\1\0\0\2\0\0\0\0\0\0\0\27\0\0\0\0\0\0\0\27\0\0\0"C:\WINDOWS\ntvdm.exe"\0\237\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0", 168, 1024, ... {status=0x103, info=48}, "\5\0\2\3\20\0\0\00\0\0\0\1\0\0\0\30\0\0\0\0\0\0\0\0\0\0\0c\236\317C\310?\334\21\261\310\0\14)\371\246\305\0\0\0\0", ) , ) == 0x103 02637 432 NtWaitForSingleObject (489, 0, 0x0, ... ) == 0x0 02638 432 NtOpenEvent (0x100000, {24, 56, 0x0, 0, 0, (0x100000, {24, 56, 0x0, 0, 0, "Global\SvcctrlStartEvent_A3752DX"}, ... 516, ) }, ... 516, ) == 0x0 02639 432 NtWaitForSingleObject (516, 0, {-1800000000, -1}, ... ) == 0x0 02640 432 NtClose (516, ... ) == 0x0 02641 432 NtOpenThreadToken (-2, 0xc, 1, ... ) == STATUS_NO_TOKEN 02642 432 NtFsControlFile (512, 489, 0x0, 0x0, 0x11c017, (512, 489, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0$\0\0\0\3\0\0\0\14\0\0\0\0\0\33\0\0\0\0\0\0\0\0\0?\0\17\0", 36, 1024, ... {status=0x103, info=52}, "\5\0\2\3\20\0\0\04\0\0\0\2\0\0\0\34\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0d\236\317C\310?\334\21\261\310\0\14)\371\246\305\0\0\0\0", ) , 36, 1024, ... {status=0x103, info=52}, (512, 489, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0$\0\0\0\3\0\0\0\14\0\0\0\0\0\33\0\0\0\0\0\0\0\0\0?\0\17\0", 36, 1024, ... {status=0x103, info=52}, "\5\0\2\3\20\0\0\04\0\0\0\2\0\0\0\34\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0d\236\317C\310?\334\21\261\310\0\14)\371\246\305\0\0\0\0", ) , ) == 0x103 02643 432 NtFsControlFile (512, 489, 0x0, 0x0, 0x11c017, (512, 489, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0D\0\0\0\4\0\0\0,\0\0\0\0\0\34\0\0\0\0\0e\236\317C\310?\334\21\261\310\0\14)\371\246\305\7\0\0\0\0\0\0\0\7\0\0\0NTVDM.\0\0\377\1\17\0", 68, 1024, ... {status=0x103, info=48}, "\5\0\2\3\20\0\0\00\0\0\0\3\0\0\0\30\0\0\0\0\0\0\0\0\0\0\0e\236\317C\310?\334\21\261\310\0\14)\371\246\305\0\0\0\0", ) , 68, 1024, ... {status=0x103, info=48}, (512, 489, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0D\0\0\0\4\0\0\0,\0\0\0\0\0\34\0\0\0\0\0e\236\317C\310?\334\21\261\310\0\14)\371\246\305\7\0\0\0\0\0\0\0\7\0\0\0NTVDM.\0\0\377\1\17\0", 68, 1024, ... {status=0x103, info=48}, "\5\0\2\3\20\0\0\00\0\0\0\3\0\0\0\30\0\0\0\0\0\0\0\0\0\0\0e\236\317C\310?\334\21\261\310\0\14)\371\246\305\0\0\0\0", ) , ) == 0x103 02644 432 NtFsControlFile (512, 489, 0x0, 0x0, 0x11c017, (512, 489, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0,\0\0\0\5\0\0\0\24\0\0\0\0\0\3\0\0\0\0\0e\236\317C\310?\334\21\261\310\0\14)\371\246\305", 44, 1024, ... {status=0x103, info=48}, "\5\0\2\3\20\0\0\00\0\0\0\4\0\0\0\30\0\0\0\0\0\0\0\0\0\0\0f\236\317C\310?\334\21\261\310\0\14)\371\246\305\0\0\0\0", ) , 44, 1024, ... {status=0x103, info=48}, (512, 489, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0,\0\0\0\5\0\0\0\24\0\0\0\0\0\3\0\0\0\0\0e\236\317C\310?\334\21\261\310\0\14)\371\246\305", 44, 1024, ... {status=0x103, info=48}, "\5\0\2\3\20\0\0\00\0\0\0\4\0\0\0\30\0\0\0\0\0\0\0\0\0\0\0f\236\317C\310?\334\21\261\310\0\14)\371\246\305\0\0\0\0", ) , ) == 0x103 02645 432 NtAllocateVirtualMemory (-1, 1392640, 0, 4096, 4096, 4, ... 1392640, 4096, ) == 0x0 02646 432 NtFsControlFile (512, 489, 0x0, 0x0, 0x11c017, (512, 489, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0D\0\0\0\6\0\0\0,\0\0\0\0\0\34\0\0\0\0\0e\236\317C\310?\334\21\261\310\0\14)\371\246\305\7\0\0\0\0\0\0\0\7\0\0\0NTVDM.\0\0\2\0\0\0", 68, 1024, ... {status=0x103, info=48}, "\5\0\2\3\20\0\0\00\0\0\0\5\0\0\0\30\0\0\0\0\0\0\0\0\0\0\0g\236\317C\310?\334\21\261\310\0\14)\371\246\305\0\0\0\0", ) , 68, 1024, ... {status=0x103, info=48}, (512, 489, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0D\0\0\0\6\0\0\0,\0\0\0\0\0\34\0\0\0\0\0e\236\317C\310?\334\21\261\310\0\14)\371\246\305\7\0\0\0\0\0\0\0\7\0\0\0NTVDM.\0\0\2\0\0\0", 68, 1024, ... {status=0x103, info=48}, "\5\0\2\3\20\0\0\00\0\0\0\5\0\0\0\30\0\0\0\0\0\0\0\0\0\0\0g\236\317C\310?\334\21\261\310\0\14)\371\246\305\0\0\0\0", ) , ) == 0x103 02647 432 NtFsControlFile (512, 489, 0x0, 0x0, 0x11c017, (512, 489, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0X\0\0\0\7\0\0\0@\0\0\0\0\0$\0\0\0\0\0f\236\317C\310?\334\21\261\310\0\14)\371\246\305\2\0\0\0\2\0\0\00\372\22\0\12\0\0\0\0\0\0\0\0\0\0\0\1\0\0\0D\372\22\0\1\0\0\0\1\0\0\0\270\13\0\0", 88, 1024, ... {status=0x103, info=48}, "\5\0\2\3\20\0\0\00\0\0\0\6\0\0\0\30\0\0\0\0\0\0\0\0\0\0\0h\236\317C\310?\334\21\261\310\0\14)\371\246\305\0\0\0\0", ) , 88, 1024, ... {status=0x103, info=48}, (512, 489, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0X\0\0\0\7\0\0\0@\0\0\0\0\0$\0\0\0\0\0f\236\317C\310?\334\21\261\310\0\14)\371\246\305\2\0\0\0\2\0\0\00\372\22\0\12\0\0\0\0\0\0\0\0\0\0\0\1\0\0\0D\372\22\0\1\0\0\0\1\0\0\0\270\13\0\0", 88, 1024, ... {status=0x103, info=48}, "\5\0\2\3\20\0\0\00\0\0\0\6\0\0\0\30\0\0\0\0\0\0\0\0\0\0\0h\236\317C\310?\334\21\261\310\0\14)\371\246\305\0\0\0\0", ) , ) == 0x103 02648 432 NtWaitForSingleObject (489, 0, 0x0, ... ) == 0x0 02649 432 NtFsControlFile (512, 489, 0x0, 0x0, 0x11c017, (512, 489, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0O\0\0\0\10\0\0\07\0\0\0\0\0$\0\0\0\0\0f\236\317C\310?\334\21\261\310\0\14)\371\246\305\1\0\0\0\1\0\0\0T\372\22\0\260\251A\0\7\0\0\0\0\0\0\0\7\0\0\0NTVDM.\0", 79, 1024, ... {status=0x103, info=28}, "\5\0\2\3\20\0\0\0\34\0\0\0\7\0\0\0\4\0\0\0\0\0\0\0\0\0\0\0", ) , 79, 1024, ... {status=0x103, info=28}, (512, 489, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0O\0\0\0\10\0\0\07\0\0\0\0\0$\0\0\0\0\0f\236\317C\310?\334\21\261\310\0\14)\371\246\305\1\0\0\0\1\0\0\0T\372\22\0\260\251A\0\7\0\0\0\0\0\0\0\7\0\0\0NTVDM.\0", 79, 1024, ... {status=0x103, info=28}, "\5\0\2\3\20\0\0\0\34\0\0\0\7\0\0\0\4\0\0\0\0\0\0\0\0\0\0\0", ) , ) == 0x103 02650 432 NtWaitForSingleObject (489, 0, 0x0, ... ) == 0x0 02651 432 NtFsControlFile (512, 489, 0x0, 0x0, 0x11c017, (512, 489, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0,\0\0\0\11\0\0\0\24\0\0\0\0\0\10\0\0\0\0\0g\236\317C\310?\334\21\261\310\0\14)\371\246\305", 44, 1024, ... {status=0x103, info=28}, "\5\0\2\3\20\0\0\0\34\0\0\0\10\0\0\0\4\0\0\0\0\0\0\0\0\0\0\0", ) , 44, 1024, ... {status=0x103, info=28}, (512, 489, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0,\0\0\0\11\0\0\0\24\0\0\0\0\0\10\0\0\0\0\0g\236\317C\310?\334\21\261\310\0\14)\371\246\305", 44, 1024, ... {status=0x103, info=28}, "\5\0\2\3\20\0\0\0\34\0\0\0\10\0\0\0\4\0\0\0\0\0\0\0\0\0\0\0", ) , ) == 0x103 02652 432 NtFsControlFile (512, 489, 0x0, 0x0, 0x11c017, (512, 489, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0,\0\0\0\12\0\0\0\24\0\0\0\0\0\0\0\0\0\0\0f\236\317C\310?\334\21\261\310\0\14)\371\246\305", 44, 1024, ... {status=0x103, info=48}, "\5\0\2\3\20\0\0\00\0\0\0\11\0\0\0\30\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0", ) , 44, 1024, ... {status=0x103, info=48}, (512, 489, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0,\0\0\0\12\0\0\0\24\0\0\0\0\0\0\0\0\0\0\0f\236\317C\310?\334\21\261\310\0\14)\371\246\305", 44, 1024, ... {status=0x103, info=48}, "\5\0\2\3\20\0\0\00\0\0\0\11\0\0\0\30\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0", ) , ) == 0x103 02653 432 NtFsControlFile (512, 489, 0x0, 0x0, 0x11c017, (512, 489, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0,\0\0\0\13\0\0\0\24\0\0\0\0\0\0\0\0\0\0\0h\236\317C\310?\334\21\261\310\0\14)\371\246\305", 44, 1024, ... {status=0x103, info=48}, "\5\0\2\3\20\0\0\00\0\0\0\12\0\0\0\30\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0", ) , 44, 1024, ... {status=0x103, info=48}, (512, 489, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0,\0\0\0\13\0\0\0\24\0\0\0\0\0\0\0\0\0\0\0h\236\317C\310?\334\21\261\310\0\14)\371\246\305", 44, 1024, ... {status=0x103, info=48}, "\5\0\2\3\20\0\0\00\0\0\0\12\0\0\0\30\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0", ) , ) == 0x103 02654 432 NtOpenEvent (0x100000, {24, 56, 0x0, 0, 0, (0x100000, {24, 56, 0x0, 0, 0, "Global\SvcctrlStartEvent_A3752DX"}, ... 516, ) }, ... 516, ) == 0x0 02655 432 NtWaitForSingleObject (516, 0, {-1800000000, -1}, ... ) == 0x0 02656 432 NtClose (516, ... ) == 0x0 02657 432 NtOpenThreadToken (-2, 0xc, 1, ... ) == STATUS_NO_TOKEN 02658 432 NtFsControlFile (512, 489, 0x0, 0x0, 0x11c017, (512, 489, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0$\0\0\0\14\0\0\0\14\0\0\0\0\0\33\0\0\0\0\0\0\0\0\0?\0\17\0", 36, 1024, ... {status=0x103, info=48}, "\5\0\2\3\20\0\0\00\0\0\0\13\0\0\0\30\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0", ) , 36, 1024, ... {status=0x103, info=48}, (512, 489, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0$\0\0\0\14\0\0\0\14\0\0\0\0\0\33\0\0\0\0\0\0\0\0\0?\0\17\0", 36, 1024, ... {status=0x103, info=48}, "\5\0\2\3\20\0\0\00\0\0\0\13\0\0\0\30\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0", ) , ) == 0x103 02659 432 NtFsControlFile (512, 489, 0x0, 0x0, 0x11c017, (512, 489, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0D\0\0\0\15\0\0\0,\0\0\0\0\0\34\0\0\0\0\0i\236\317C\310?\334\21\261\310\0\14)\371\246\305\7\0\0\0\0\0\0\0\7\0\0\0NTVDM.\0\0\377\1\17\0", 68, 1024, ... {status=0x103, info=48}, "\5\0\2\3\20\0\0\00\0\0\0\14\0\0\0\30\0\0\0\0\0\0\0\0\0\0\0i\236\317C\310?\334\21\261\310\0\14)\371\246\305\0\0\0\0", ) , 68, 1024, ... {status=0x103, info=48}, (512, 489, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0D\0\0\0\15\0\0\0,\0\0\0\0\0\34\0\0\0\0\0i\236\317C\310?\334\21\261\310\0\14)\371\246\305\7\0\0\0\0\0\0\0\7\0\0\0NTVDM.\0\0\377\1\17\0", 68, 1024, ... {status=0x103, info=48}, "\5\0\2\3\20\0\0\00\0\0\0\14\0\0\0\30\0\0\0\0\0\0\0\0\0\0\0i\236\317C\310?\334\21\261\310\0\14)\371\246\305\0\0\0\0", ) , ) == 0x103 02660 432 NtFsControlFile (512, 489, 0x0, 0x0, 0x11c017, (512, 489, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\04\0\0\0\16\0\0\0\34\0\0\0\0\0\37\0\0\0\0\0j\236\317C\310?\334\21\261\310\0\14)\371\246\305\0\0\0\0\0\0\0\0", 52, 1024, ... {status=0x103, info=48}, "\5\0\2\3\20\0\0\00\0\0\0\15\0\0\0\30\0\0\0\0\0\0\0\0\0\0\0j\236\317C\310?\334\21\261\310\0\14)\371\246\305\0\0\0\0", ) , 52, 1024, ... {status=0x103, info=48}, (512, 489, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\04\0\0\0\16\0\0\0\34\0\0\0\0\0\37\0\0\0\0\0j\236\317C\310?\334\21\261\310\0\14)\371\246\305\0\0\0\0\0\0\0\0", 52, 1024, ... {status=0x103, info=48}, "\5\0\2\3\20\0\0\00\0\0\0\15\0\0\0\30\0\0\0\0\0\0\0\0\0\0\0j\236\317C\310?\334\21\261\310\0\14)\371\246\305\0\0\0\0", ) , ) == 0x103 02661 432 NtWaitForSingleObject (489, 0, 0x0, ... ) == 0x0 02662 432 NtFsControlFile (512, 489, 0x0, 0x0, 0x11c017, (512, 489, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0,\0\0\0\17\0\0\0\24\0\0\0\0\0\0\0\0\0\0\0i\236\317C\310?\334\21\261\310\0\14)\371\246\305", 44, 1024, ... {status=0x103, info=28}, "\5\0\2\3\20\0\0\0\34\0\0\0\16\0\0\0\4\0\0\0\0\0\0\0\0\0\0\0", ) , 44, 1024, ... {status=0x103, info=28}, (512, 489, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0,\0\0\0\17\0\0\0\24\0\0\0\0\0\0\0\0\0\0\0i\236\317C\310?\334\21\261\310\0\14)\371\246\305", 44, 1024, ... {status=0x103, info=28}, "\5\0\2\3\20\0\0\0\34\0\0\0\16\0\0\0\4\0\0\0\0\0\0\0\0\0\0\0", ) , ) == 0x103 02663 432 NtFsControlFile (512, 489, 0x0, 0x0, 0x11c017, (512, 489, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0,\0\0\0\20\0\0\0\24\0\0\0\0\0\0\0\0\0\0\0j\236\317C\310?\334\21\261\310\0\14)\371\246\305", 44, 1024, ... {status=0x103, info=48}, "\5\0\2\3\20\0\0\00\0\0\0\17\0\0\0\30\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0", ) , 44, 1024, ... {status=0x103, info=48}, (512, 489, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0,\0\0\0\20\0\0\0\24\0\0\0\0\0\0\0\0\0\0\0j\236\317C\310?\334\21\261\310\0\14)\371\246\305", 44, 1024, ... {status=0x103, info=48}, "\5\0\2\3\20\0\0\00\0\0\0\17\0\0\0\30\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0", ) , ) == 0x103 02664 432 NtFsControlFile (512, 489, 0x0, 0x0, 0x11c017, (512, 489, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0,\0\0\0\21\0\0\0\24\0\0\0\0\0\0\0\0\0\0\0d\236\317C\310?\334\21\261\310\0\14)\371\246\305", 44, 1024, ... {status=0x103, info=48}, "\5\0\2\3\20\0\0\00\0\0\0\20\0\0\0\30\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0", ) , 44, 1024, ... {status=0x103, info=48}, (512, 489, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0,\0\0\0\21\0\0\0\24\0\0\0\0\0\0\0\0\0\0\0d\236\317C\310?\334\21\261\310\0\14)\371\246\305", 44, 1024, ... {status=0x103, info=48}, "\5\0\2\3\20\0\0\00\0\0\0\20\0\0\0\30\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0", ) , ) == 0x103 02665 432 NtRaiseException (1242540, 1241800, 1, ... 02666 432 NtContinue (1240604, 0, ... 02667 432 NtTerminateProcess (0, 1, ... 00635 588 NtDelayExecution ... ) == 0xc0 00636 572 NtDelayExecution ... ) == 0xc0 00643 580 NtDelayExecution ... ) == 0xc0 00638 576 NtDelayExecution ... ) == 0xc0 00639 596 NtDelayExecution ... ) == 0xc0 00640 636 NtDelayExecution ... ) == 0xc0 00641 732 NtDelayExecution ... ) == 0xc0 00642 744 NtDelayExecution ... ) == 0xc0 00890 788 NtWaitForSingleObject ... ) == 0xc0 00842 676 NtWaitForSingleObject ... ) == 0xc0 00866 784 NtWaitForSingleObject ... ) == 0xc0 00870 716 NtWaitForSingleObject ... ) == 0xc0 00966 836 NtWaitForSingleObject ... ) == 0xc0 00678 856 NtWaitForSingleObject ... ) == 0xc0 00854 860 NtWaitForSingleObject ... ) == 0xc0 00846 864 NtWaitForSingleObject ... ) == 0xc0 00976 868 NtWaitForSingleObject ... ) == 0xc0 00990 872 NtWaitForSingleObject ... ) == 0xc0 00911 876 NtWaitForSingleObject ... ) == 0xc0 00822 880 NtWaitForSingleObject ... ) == 0xc0 00862 884 NtWaitForSingleObject ... ) == 0xc0 00682 888 NtWaitForSingleObject ... ) == 0xc0 00980 892 NtWaitForSingleObject ... ) == 0xc0 00986 908 NtWaitForSingleObject ... ) == 0xc0 00905 912 NtDelayExecution ... ) == 0xc0 02667 432 NtTerminateProcess ... ) == 0x0 02668 432 NtFreeVirtualMemory (-1, (0x2760000), 0, 32768, ... (0x2760000), 65536, ) == 0x0 02669 432 NtClose (420, ... ) == 0x0 02670 432 NtClose (424, ... ) == 0x0 02671 432 NtClose (432, ... ) == 0x0 02672 432 NtClose (428, ... ) == 0x0 02673 432 NtClose (436, ... ) == 0x0 02674 432 NtClose (408, ... ) == 0x0 02675 432 NtClose (416, ... ) == 0x0 02676 432 NtClose (452, ... ) == 0x0 02677 432 NtClose (448, ... ) == 0x0 02678 432 NtClose (444, ... ) == 0x0 02679 432 NtClose (440, ... ) == 0x0 02680 432 NtClose (412, ... ) == 0x0 02681 432 NtClose (388, ... ) == 0x0 02682 432 NtClose (396, ... ) == 0x0 02683 432 NtSetInformationThread (-2, ZeroTlsCell, {ZeroTlsCell=0xf,}, 4, ... ) == 0x0 02684 432 NtSetInformationThread (-2, ZeroTlsCell, {ZeroTlsCell=0x10,}, 4, ... ) == 0x0 02685 432 NtClose (392, ... ) == 0x0 02686 432 NtSetInformationThread (-2, ZeroTlsCell, {ZeroTlsCell=0xe,}, 4, ... ) == 0x0 02687 432 NtWaitForMultipleObjects (2, (364, 368, ), 1, 0, 0x0, ... ) == 0x1 02688 432 NtClose (368, ... ) == 0x0 02689 432 NtSetEvent (364, ... 0x0, ) == 0x0 02690 432 NtClose (364, ... ) == 0x0 02691 432 NtWaitForMultipleObjects (2, (372, 376, ), 1, 0, 0x0, ... ) == 0x1 02692 432 NtClose (376, ... ) == 0x0 02693 432 NtSetEvent (372, ... 0x0, ) == 0x0 02694 432 NtClose (372, ... ) == 0x0 02695 432 NtWaitForMultipleObjects (2, (380, 384, ), 1, 0, 0x0, ... ) == 0x1 02696 432 NtClose (384, ... ) == 0x0 02697 432 NtSetEvent (380, ... 0x0, ) == 0x0 02698 432 NtClose (380, ... ) == 0x0 02699 432 NtSetInformationThread (-2, ZeroTlsCell, {ZeroTlsCell=0xd,}, 4, ... ) == 0x0 02700 432 NtFreeVirtualMemory (-1, (0x2550000), 0, 32768, ... (0x2550000), 262144, ) == 0x0 02701 432 NtUserUnregisterClass (1243440, 1991376896, 1243428, ... ) == 0x0 02702 432 NtSetInformationThread (-2, ZeroTlsCell, {ZeroTlsCell=0xb,}, 4, ... ) == 0x0 02703 432 NtClose (296, ... ) == 0x0 02704 432 NtSetInformationThread (-2, ZeroTlsCell, {ZeroTlsCell=0x9,}, 4, ... ) == 0x0 02705 432 NtSetInformationThread (-2, ZeroTlsCell, {ZeroTlsCell=0xa,}, 4, ... ) == 0x0 02706 432 NtClose (256, ... ) == 0x0 02707 432 NtClose (264, ... ) == 0x0 02708 432 NtClose (268, ... ) == 0x0 02709 432 NtClose (260, ... ) == 0x0 02710 432 NtClose (252, ... ) == 0x0 02711 432 NtWaitForSingleObject (312, 0, 0x0, ... ) == 0x0 02712 432 NtClearEvent (312, ... ) == 0x0 02713 432 NtSetEvent (312, ... 0x0, ) == 0x0 02714 432 NtClose (312, ... ) == 0x0 02715 432 NtSetInformationThread (-2, ZeroTlsCell, {ZeroTlsCell=0x4,}, 4, ... ) == 0x0 02716 432 NtSetInformationThread (-2, ZeroTlsCell, {ZeroTlsCell=0x5,}, 4, ... ) == 0x0 02717 432 NtSetInformationThread (-2, ZeroTlsCell, {ZeroTlsCell=0x6,}, 4, ... ) == 0x0 02718 432 NtSetInformationThread (-2, ZeroTlsCell, {ZeroTlsCell=0x2,}, 4, ... ) == 0x0 02719 432 NtClose (76, ... ) == 0x0 02720 432 NtClose (68, ... ) == 0x0 02721 432 NtClose (64, ... ) == 0x0 02722 432 NtClose (72, ... ) == 0x0 02723 432 NtSetInformationThread (-2, ZeroTlsCell, {ZeroTlsCell=0x0,}, 4, ... ) == 0x0 02724 432 NtUserGetClassInfo (1999896576, 1243528, 1243480, 1243556, 0, ... ) == 0xc03b 02725 432 NtUserUnregisterClass (1243532, 1999896576, 1243520, ... ) == 0x1 02726 432 NtUserGetClassInfo (1999896576, 1243528, 1243480, 1243556, 0, ... ) == 0xc03d 02727 432 NtUserUnregisterClass (1243532, 1999896576, 1243520, ... ) == 0x1 02728 432 NtUserGetClassInfo (1999896576, 1243528, 1243480, 1243556, 0, ... ) == 0xc03f 02729 432 NtUserUnregisterClass (1243532, 1999896576, 1243520, ... ) == 0x1 02730 432 NtUserGetClassInfo (1999896576, 1243528, 1243480, 1243556, 0, ... ) == 0xc041 02731 432 NtUserUnregisterClass (1243532, 1999896576, 1243520, ... ) == 0x1 02732 432 NtUserGetClassInfo (1999896576, 1243528, 1243480, 1243556, 0, ... ) == 0xc043 02733 432 NtUserUnregisterClass (1243532, 1999896576, 1243520, ... ) == 0x1 02734 432 NtUserGetClassInfo (1999896576, 1243528, 1243480, 1243556, 0, ... ) == 0xc045 02735 432 NtUserUnregisterClass (1243532, 1999896576, 1243520, ... ) == 0x1 02736 432 NtUserGetClassInfo (1999896576, 1243528, 1243480, 1243556, 0, ... ) == 0xc047 02737 432 NtUserUnregisterClass (1243532, 1999896576, 1243520, ... ) == 0x1 02738 432 NtUserGetClassInfo (1999896576, 1243528, 1243480, 1243556, 0, ... ) == 0xc049 02739 432 NtUserUnregisterClass (1243532, 1999896576, 1243520, ... ) == 0x1 02740 432 NtUserGetClassInfo (1999896576, 1243528, 1243480, 1243556, 0, ... ) == 0xc04b 02741 432 NtUserUnregisterClass (1243532, 1999896576, 1243520, ... ) == 0x1 02742 432 NtUserGetClassInfo (1999896576, 1243528, 1243480, 1243556, 0, ... ) == 0xc04d 02743 432 NtUserUnregisterClass (1243532, 1999896576, 1243520, ... ) == 0x1 02744 432 NtUserGetClassInfo (1999896576, 1243528, 1243480, 1243556, 0, ... ) == 0xc04f 02745 432 NtUserUnregisterClass (1243532, 1999896576, 1243520, ... ) == 0x1 02746 432 NtUserGetClassInfo (1999896576, 1243528, 1243480, 1243556, 0, ... ) == 0xc051 02747 432 NtUserUnregisterClass (1243532, 1999896576, 1243520, ... ) == 0x1 02748 432 NtUserGetClassInfo (1999896576, 1243528, 1243480, 1243556, 0, ... ) == 0xc053 02749 432 NtUserUnregisterClass (1243532, 1999896576, 1243520, ... ) == 0x1 02750 432 NtUserGetClassInfo (1999896576, 1243528, 1243480, 1243556, 0, ... ) == 0xc057 02751 432 NtUserUnregisterClass (1243532, 1999896576, 1243520, ... ) == 0x1 02752 432 NtUserGetClassInfo (1999896576, 1243528, 1243480, 1243556, 0, ... ) == 0xc059 02753 432 NtUserUnregisterClass (1243532, 1999896576, 1243520, ... ) == 0x1 02754 432 NtUserGetClassInfo (1999896576, 1243528, 1243480, 1243556, 0, ... ) == 0xc05b 02755 432 NtUserUnregisterClass (1243532, 1999896576, 1243520, ... ) == 0x1 02756 432 NtUserGetClassInfo (1999896576, 1243528, 1243480, 1243556, 0, ... ) == 0xc05d 02757 432 NtUserUnregisterClass (1243532, 1999896576, 1243520, ... ) == 0x1 02758 432 NtUserGetClassInfo (1999896576, 1243528, 1243480, 1243556, 0, ... ) == 0xc05f 02759 432 NtUserUnregisterClass (1243532, 1999896576, 1243520, ... ) == 0x1 02760 432 NtFreeVirtualMemory (-1, (0x0), 0, 32768, ... ) == STATUS_MEMORY_NOT_ALLOCATED 02761 432 NtRequestWaitReplyPort (24, {20, 48, new_msg, 0, 2013032352, 2012568799, 1379990, 1379976} (24, {20, 48, new_msg, 0, 2013032352, 2012568799, 1379990, 1379976} "\0\0\0\0\3\0\1\0\315\224s\366M>H\351\1\0\0\0" ... {20, 48, reply, 0, 428, 432, 1596, 0} "\0\0\0\0\3\0\1\0\0\0\0\0M>H\351\1\0\0\0" ) ... {20, 48, reply, 0, 428, 432, 1596, 0} (24, {20, 48, new_msg, 0, 2013032352, 2012568799, 1379990, 1379976} "\0\0\0\0\3\0\1\0\315\224s\366M>H\351\1\0\0\0" ... {20, 48, reply, 0, 428, 432, 1596, 0} "\0\0\0\0\3\0\1\0\0\0\0\0M>H\351\1\0\0\0" ) ) == 0x0 02762 432 NtTerminateProcess (-1, 1, ... 02763 432 NtClose (40, ... ) == 0x0