Summary:


NtAdjustPrivilegesToken(>) 
 1 
NtDeleteAtom(>) 
 2 
NtGdiBitBlt(>) 
 7 
NtQueryInformationProcess(>) 
 15 

NtCallbackReturn(>) 
 1 
NtEnumerateKey(>) 
 2 
NtGdiCreateDIBitmapInternal(>) 
 7 
NtCreateSection(>) 
 17 

NtCreateMutant(>) 
 1 
NtGdiCreateSolidBrush(>) 
 2 
NtGdiGetDCObject(>) 
 7 
NtGdiDeleteObjectApp(>) 
 18 

NtCreateProcessEx(>) 
 1 
NtOpenDirectoryObject(>) 
 2 
NtGdiGetDCforBitmap(>) 
 7 
NtReadFile(>) 
 19 

NtCreateThread(>) 
 1 
NtOpenEvent(>) 
 2 
NtGdiGetStockObject(>) 
 7 
NtContinue(>) 
 20 

NtDelayExecution(>) 
 1 
NtOpenSymbolicLinkObject(>) 
 2 
NtGdiRestoreDC(>) 
 7 
NtQuerySystemInformation(>) 
 20 

NtDuplicateToken(>) 
 1 
NtQueryInstallUILanguage(>) 
 2 
NtGdiSaveDC(>) 
 7 
NtUserCallOneParam(>) 
 20 

NtEnumerateValueKey(>) 
 1 
NtQuerySymbolicLinkObject(>) 
 2 
NtGdiSetDIBitsToDeviceInternal(>) 
 7 
NtWaitForSingleObject(>) 
 21 

NtGdiCreatePaletteInternal(>) 
 1 
NtReadVirtualMemory(>) 
 2 
NtOpenProcessToken(>) 
 7 
NtFlushInstructionCache(>) 
 23 

NtGdiInit(>) 
 1 
NtTerminateProcess(>) 
 2 
NtUserDestroyCursor(>) 
 7 
NtWriteFile(>) 
 23 

NtGdiQueryFontAssocInfo(>) 
 1 
NtUserWaitForInputIdle(>) 
 2 
NtUserSetCursorIconData(>) 
 7 
NtOpenProcessTokenEx(>) 
 24 

NtNotifyChangeKey(>) 
 1 
NtAddAtom(>) 
 3 
NtGdiCreateBitmap(>) 
 8 
NtOpenThreadTokenEx(>) 
 24 

NtOpenKeyedEvent(>) 
 1 
NtCreateSemaphore(>) 
 3 
NtQuerySection(>) 
 8 
NtOpenSection(>) 
 25 

NtOpenProcess(>) 
 1 
NtDuplicateObject(>) 
 3 
NtRequestWaitReplyPort(>) 
 8 
NtOpenFile(>) 
 30 

NtQueryInformationJobObject(>) 
 1 
NtFreeVirtualMemory(>) 
 3 
NtSetInformationThread(>) 
 8 
NtQueryAttributesFile(>) 
 31 

NtQueryObject(>) 
 1 
NtGdiHfontCreate(>) 
 3 
NtQueryDebugFilterState(>) 
 9 
NtQueryInformationToken(>) 
 31 

NtQuerySystemTime(>) 
 1 
NtOpenMutant(>) 
 3 
NtSetInformationFile(>) 
 9 
NtMapViewOfSection(>) 
 37 

NtRegisterThreadTerminatePort(>) 
 1 
NtSetInformationObject(>) 
 3 
NtCreateEvent(>) 
 10 
NtReleaseMutant(>) 
 40 

NtResumeThread(>) 
 1 
NtFsControlFile(>) 
 4 
NtGdiCreateCompatibleDC(>) 
 10 
NtAllocateVirtualMemory(>) 
 41 

NtSecureConnectPort(>) 
 1 
NtOpenThreadToken(>) 
 4 
NtGdiExtGetObjectW(>) 
 10 
NtProtectVirtualMemory(>) 
 45 

NtTestAlert(>) 
 1 
NtSetValueKey(>) 
 4 
NtQueryDirectoryFile(>) 
 10 
NtUserUnregisterClass(>) 
 45 

NtUserCallNoParam(>) 
 1 
NtWriteVirtualMemory(>) 
 4 
NtCreateFile(>) 
 11 
NtQueryValueKey(>) 
 51 

NtUserEnumDisplayMonitors(>) 
 1 
NtUserRegisterWindowMessage(>) 
 5 
NtUserGetDC(>) 
 11 
NtGdiSelectBitmap(>) 
 57 

NtUserGetKeyboardLayoutList(>) 
 1 
NtCreateKey(>) 
 6 
NtUnmapViewOfSection(>) 
 12 
NtUserRegisterClassExWOW(>) 
 63 

NtUserGetThreadDesktop(>) 
 1 
NtQueryDefaultUILanguage(>) 
 6 
NtQueryDefaultLocale(>) 
 13 
NtUserGetClassInfo(>) 
 64 

NtUserSetWindowsHookEx(>) 
 1 
NtQueryVirtualMemory(>) 
 6 
NtQueryInformationFile(>) 
 13 
NtUserFindExistingCursorIcon(>) 
 72 

NtAccessCheck(>) 
 2 
NtQueryVolumeInformationFile(>) 
 6 
NtUserSystemParametersInfo(>) 
 13 
NtOpenKey(>) 
 112 

NtCreateIoCompletion(>) 
 2 
NtSetInformationProcess(>) 
 6 
NtUserSelectPalette(>) 
 14 
NtClose(>) 
 165 


Trace:
 00001   444   NtOpenKey  (0x80000000, {24, 0, 0x40, 0, 0,  (0x80000000, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\packed.exe"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00002   444   NtOpenKeyedEvent  (0x2000000, {24, 0, 0x0, 0, 0,  (0x2000000, {24, 0, 0x0, 0, 0, "\KernelObjects\CritSecOutOfMemoryEvent"}, ... 4, ) }, ... 4, ) == 0x0
 00003   444   NtQuerySystemInformation  (Basic, 44, ... {Unknown=0,MaximumIncrement=156250,PhysicalPageSize=0x1000,NumberOfPhysicalPages=0xff7c,LowestPhysicalPage=0x1,HighestPhysicalPage=0xffff,AllocationGranularity=0x10000,LowestUserAddress=0x10000,HighestUserAddress=0x7ffeffff,ActiveProcessors=1,NumberProcessors=1,}, 0x0, ) == 0x0
 00004   444   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ... 1310720, 1048576, ) == 0x0
 00005   444   NtAllocateVirtualMemory  (-1, 1310720, 0, 4096, 4096, 4, ... 1310720, 4096, ) == 0x0
 00006   444   NtAllocateVirtualMemory  (-1, 1314816, 0, 8192, 4096, 4, ... 1314816, 8192, ) == 0x0
 00007   444   NtQuerySystemInformation  (Basic, 44, ... {Unknown=0,MaximumIncrement=156250,PhysicalPageSize=0x1000,NumberOfPhysicalPages=0xff7c,LowestPhysicalPage=0x1,HighestPhysicalPage=0xffff,AllocationGranularity=0x10000,LowestUserAddress=0x10000,HighestUserAddress=0x7ffeffff,ActiveProcessors=1,NumberProcessors=1,}, 0x0, ) == 0x0
 00008   444   NtAllocateVirtualMemory  (-1, 0, 0, 65536, 8192, 4, ... 2359296, 65536, ) == 0x0
 00009   444   NtAllocateVirtualMemory  (-1, 2359296, 0, 24576, 4096, 4, ... 2359296, 24576, ) == 0x0
 00010   444   NtOpenDirectoryObject  (0x3, {24, 0, 0x40, 0, 0,  (0x3, {24, 0, 0x40, 0, 0, "\KnownDlls"}, ... 8, ) }, ... 8, ) == 0x0
 00011   444   NtOpenSymbolicLinkObject  (0x1, {24, 8, 0x40, 0, 0,  (0x1, {24, 8, 0x40, 0, 0, "KnownDllPath"}, ... 12, ) }, ... 12, ) == 0x0
 00012   444   NtQuerySymbolicLinkObject  (12, ...  (12, ... "C:\WINDOWS\system32", 0x0, ) , 0x0, ) == 0x0
 00013   444   NtClose  (12, ... ) == 0x0
 00014   444   NtOpenFile  (0x100020, {24, 0, 0x42, 0, 0,  (0x100020, {24, 0, 0x42, 0, 0, "\??\U:\startupscripts\"}, 3, 33, ... 12, {status=0x0, info=1}, ) }, 3, 33, ... 12, {status=0x0, info=1}, ) == 0x0
 00015   444   NtQueryVolumeInformationFile  (12, 1243848, 8, Device, ... {status=0x0, info=8}, ) == 0x0
 00016   444   NtFsControlFile  (12, 0, 0x0, 0x0, 0x90028, 0x0, 0, 0, ... ) == STATUS_INVALID_PARAMETER
 00017   444   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\u:\work\packed.exe.Local"}, 1243832, ... ) }, 1243832, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00018   444   NtOpenSection  (0xe, {24, 8, 0x40, 0, 0,  (0xe, {24, 8, 0x40, 0, 0, "kernel32.dll"}, ... 16, ) }, ... 16, ) == 0x0
 00019   444   NtMapViewOfSection  (16, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x77e60000), 0x0, 937984, ) == 0x0
 00020   444   NtClose  (16, ... ) == 0x0
 00021   444   NtQuerySystemInformation  (RangeStart, 4, ... {system info, class 50, size 4}, 0x0, ) == 0x0
 00022   444   NtQuerySystemInformation  (Basic, 44, ... {Unknown=0,MaximumIncrement=156250,PhysicalPageSize=0x1000,NumberOfPhysicalPages=0xff7c,LowestPhysicalPage=0x1,HighestPhysicalPage=0xffff,AllocationGranularity=0x10000,LowestUserAddress=0x10000,HighestUserAddress=0x7ffeffff,ActiveProcessors=1,NumberProcessors=1,}, 0x0, ) == 0x0
 00023   444   NtCreateSection  (0xf001f, 0x0, {65536, 0}, 4, 67108864, 0, ... 16, ) == 0x0
 00024   444   NtSecureConnectPort  ( ("\Windows\ApiPort", {0, 2, 1, 1}, {24, 16, 0, 65536, 0, 0}, 1319736, {12, 0, 0}, 1242016, 44, ... 24, {24, 16, 0, 65536, 2424832, 18481152}, {0, 0, 0}, 200, 44, ) , {0, 2, 1, 1}, {24, 16, 0, 65536, 0, 0}, 1319736, {12, 0, 0}, 1242016, 44, ... 24, {24, 16, 0, 65536, 2424832, 18481152}, {0, 0, 0}, 200, 44, ) == 0x0
 00025   444   NtClose  (16, ... ) == 0x0
 00026   444   NtQueryObject  (24, Handle, 2, ... {Inherit=0,ProtectFromClose=0,}, -1, ) == 0x0
 00027   444   NtSetInformationObject  (24, Handle, {Inherit=0,ProtectFromClose=1,}, 256, ... ) == 0x0
 00028   444   NtQuerySystemInformation  (Basic, 44, ... {Unknown=0,MaximumIncrement=156250,PhysicalPageSize=0x1000,NumberOfPhysicalPages=0xff7c,LowestPhysicalPage=0x1,HighestPhysicalPage=0xffff,AllocationGranularity=0x10000,LowestUserAddress=0x10000,HighestUserAddress=0x7ffeffff,ActiveProcessors=1,NumberProcessors=1,}, 0x0, ) == 0x0
 00029   444   NtQueryVirtualMemory  (-1, 0x250000, Basic, 28, ... {BaseAddress=0x250000,AllocationBase=0x250000,AllocationProtect=0x4,RegionSize=0x10000,State=0x2000,Protect=0x0,Type=0x40000,}, 0x0, ) == 0x0
 00030   444   NtAllocateVirtualMemory  (-1, 2424832, 0, 4096, 4096, 4, ... 2424832, 4096, ) == 0x0
 00031   444   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 0, 0, 0, 0}  (24, {28, 56, new_msg, 0, 0, 0, 0, 0} "\210\6\32\1\0\0\0\0\0\0\0\0\0\0\0\0\1\0\0\0\234\6\32\1\4\0\0\0" ... {28, 56, reply, 0, 436, 444, 1516, 0} "\20\252\26\0\0\0\0\0\0\0\0\0\0\0\0\0\1\0\0\0\234\6\32\1\4\0\0\0" )  ... {28, 56, reply, 0, 436, 444, 1516, 0}  (24, {28, 56, new_msg, 0, 0, 0, 0, 0} "\210\6\32\1\0\0\0\0\0\0\0\0\0\0\0\0\1\0\0\0\234\6\32\1\4\0\0\0" ... {28, 56, reply, 0, 436, 444, 1516, 0} "\20\252\26\0\0\0\0\0\0\0\0\0\0\0\0\0\1\0\0\0\234\6\32\1\4\0\0\0" )  ) == 0x0
 00032   444   NtRegisterThreadTerminatePort  (24, ... ) == 0x0
 00033   444   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\System\CurrentControlSet\Control\Terminal Server"}, ... 16, ) }, ... 16, ) == 0x0
 00034   444   NtQueryValueKey  (16,  (16, "TSAppCompat", Partial, 548, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) , Partial, 548, ... TitleIdx=0, Type=4, Data= (16, "TSAppCompat", Partial, 548, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) }, 16, ) == 0x0
 00035   444   NtClose  (16, ... ) == 0x0
 00036   444   NtAllocateVirtualMemory  (-1, 1232896, 0, 4096, 4096, 260, ... 1232896, 4096, ) == 0x0
 00037   444   NtOpenMutant  (0x1, {24, 0, 0x40, 0, 0,  (0x1, {24, 0, 0x40, 0, 0, "\NlsCacheMutant"}, ... 16, ) }, ... 16, ) == 0x0
 00038   444   NtOpenSection  (0x4, {24, 0, 0x40, 0, 0,  (0x4, {24, 0, 0x40, 0, 0, "\NLS\NlsSectionUnicode"}, ... 28, ) }, ... 28, ) == 0x0
 00039   444   NtMapViewOfSection  (28, -1, (0x0), 0, 0, 0x0, 0, 2, 0, 2, ... (0x260000), 0x0, 90112, ) == 0x0
 00040   444   NtClose  (28, ... ) == 0x0
 00041   444   NtQueryDefaultLocale  (0, 2012046252, ... ) == 0x0
 00042   444   NtOpenSection  (0x4, {24, 0, 0x40, 0, 0,  (0x4, {24, 0, 0x40, 0, 0, "\NLS\NlsSectionLocale"}, ... 28, ) }, ... 28, ) == 0x0
 00043   444   NtMapViewOfSection  (28, -1, (0x0), 0, 0, 0x0, 0, 2, 0, 2, ... (0x280000), 0x0, 212992, ) == 0x0
 00044   444   NtClose  (28, ... ) == 0x0
 00045   444   NtOpenSection  (0x5, {24, 0, 0x40, 0, 0,  (0x5, {24, 0, 0x40, 0, 0, "\NLS\NlsSectionSortkey"}, ... 28, ) }, ... 28, ) == 0x0
 00046   444   NtMapViewOfSection  (28, -1, (0x0), 0, 0, 0x0, 0, 2, 0, 2, ... (0x2c0000), 0x0, 266240, ) == 0x0
 00047   444   NtQuerySection  (28, Basic, 16, ... {BaseAddress=0x0,Attributes=0x800000,Size={0x40004, 0x0},}, 0x0, ) == 0x0
 00048   444   NtClose  (28, ... ) == 0x0
 00049   444   NtOpenSection  (0x4, {24, 0, 0x40, 0, 0,  (0x4, {24, 0, 0x40, 0, 0, "\NLS\NlsSectionSortTbls"}, ... 28, ) }, ... 28, ) == 0x0
 00050   444   NtMapViewOfSection  (28, -1, (0x0), 0, 0, 0x0, 0, 2, 0, 2, ... (0x310000), 0x0, 24576, ) == 0x0
 00051   444   NtClose  (28, ... ) == 0x0
 00052   444   NtQueryVirtualMemory  (-1, 0x7ffd2000, Basic, 28, ... {BaseAddress=0x7ffd2000,AllocationBase=0x7ffb0000,AllocationProtect=0x2,RegionSize=0x2000,State=0x1000,Protect=0x2,Type=0x40000,}, 0x0, ) == 0x0
 00053   444   NtOpenSection  (0x4, {24, 0, 0x40, 0, 0,  (0x4, {24, 0, 0x40, 0, 0, "\NLS\NlsSectionSortkey00000409"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00054   444   NtOpenSection  (0x4, {24, 0, 0x40, 0, 0,  (0x4, {24, 0, 0x40, 0, 0, "\NLS\NlsSectionSortkey00000409"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00055   444   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 2012558373, 2012047104, 2013025280, 0}  (24, {28, 56, new_msg, 0, 2012558373, 2012047104, 2013025280, 0} "\210\6\32\1\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\234\6\32\18\6\0\0" ... {28, 56, reply, 0, 436, 444, 1523, 0} "\10\240\30\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\234\6\32\18\6\0\0" )  ... {28, 56, reply, 0, 436, 444, 1523, 0}  (24, {28, 56, new_msg, 0, 2012558373, 2012047104, 2013025280, 0} "\210\6\32\1\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\234\6\32\18\6\0\0" ... {28, 56, reply, 0, 436, 444, 1523, 0} "\10\240\30\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\234\6\32\18\6\0\0" )  ) == 0x0
 00056   444   NtProtectVirtualMemory  (-1, (0x31428000), 8192, 4, ... (0x31428000), 8192, 128, ) == 0x0
 00057   444   NtProtectVirtualMemory  (-1, (0x31428000), 8192, 128, ... (0x31428000), 8192, 4, ) == 0x0
 00058   444   NtFlushInstructionCache  (-1, 826441728, 8192, ... ) == 0x0
 00059   444   NtOpenSection  (0xe, {24, 8, 0x40, 0, 0,  (0xe, {24, 8, 0x40, 0, 0, "ADVAPI32.dll"}, ... 28, ) }, ... 28, ) == 0x0
 00060   444   NtMapViewOfSection  (28, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x77dd0000), 0x0, 569344, ) == 0x0
 00061   444   NtClose  (28, ... ) == 0x0
 00062   444   NtOpenSection  (0xe, {24, 8, 0x40, 0, 0,  (0xe, {24, 8, 0x40, 0, 0, "RPCRT4.dll"}, ... 28, ) }, ... 28, ) == 0x0
 00063   444   NtMapViewOfSection  (28, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x77cc0000), 0x0, 479232, ) == 0x0
 00064   444   NtClose  (28, ... ) == 0x0
 00065   444   NtProtectVirtualMemory  (-1, (0x31428000), 8192, 4, ... (0x31428000), 8192, 64, ) == 0x0
 00066   444   NtProtectVirtualMemory  (-1, (0x31428000), 8192, 64, ... (0x31428000), 8192, 4, ) == 0x0
 00067   444   NtFlushInstructionCache  (-1, 826441728, 8192, ... ) == 0x0
 00068   444   NtOpenSection  (0xe, {24, 8, 0x40, 0, 0,  (0xe, {24, 8, 0x40, 0, 0, "MSVCRT.dll"}, ... 28, ) }, ... 28, ) == 0x0
 00069   444   NtMapViewOfSection  (28, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x77c10000), 0x0, 339968, ) == 0x0
 00070   444   NtClose  (28, ... ) == 0x0
 00071   444   NtProtectVirtualMemory  (-1, (0x31428000), 8192, 4, ... (0x31428000), 8192, 64, ) == 0x0
 00072   444   NtProtectVirtualMemory  (-1, (0x31428000), 8192, 64, ... (0x31428000), 8192, 4, ) == 0x0
 00073   444   NtFlushInstructionCache  (-1, 826441728, 8192, ... ) == 0x0
 00074   444   NtOpenSection  (0xe, {24, 8, 0x40, 0, 0,  (0xe, {24, 8, 0x40, 0, 0, "USER32.dll"}, ... 28, ) }, ... 28, ) == 0x0
 00075   444   NtMapViewOfSection  (28, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x77d40000), 0x0, 577536, ) == 0x0
 00076   444   NtClose  (28, ... ) == 0x0
 00077   444   NtOpenSection  (0xe, {24, 8, 0x40, 0, 0,  (0xe, {24, 8, 0x40, 0, 0, "GDI32.dll"}, ... 28, ) }, ... 28, ) == 0x0
 00078   444   NtMapViewOfSection  (28, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x77c70000), 0x0, 262144, ) == 0x0
 00079   444   NtClose  (28, ... ) == 0x0
 00080   444   NtProtectVirtualMemory  (-1, (0x31428000), 8192, 4, ... (0x31428000), 8192, 64, ) == 0x0
 00081   444   NtProtectVirtualMemory  (-1, (0x31428000), 8192, 64, ... (0x31428000), 8192, 4, ) == 0x0
 00082   444   NtFlushInstructionCache  (-1, 826441728, 8192, ... ) == 0x0
 00083   444   NtOpenSection  (0xe, {24, 8, 0x40, 0, 0,  (0xe, {24, 8, 0x40, 0, 0, "WININET.dll"}, ... 28, ) }, ... 28, ) == 0x0
 00084   444   NtMapViewOfSection  (28, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x76200000), 0x0, 618496, ) == 0x0
 00085   444   NtClose  (28, ... ) == 0x0
 00086   444   NtOpenSection  (0xe, {24, 8, 0x40, 0, 0,  (0xe, {24, 8, 0x40, 0, 0, "SHLWAPI.dll"}, ... 28, ) }, ... 28, ) == 0x0
 00087   444   NtMapViewOfSection  (28, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x772d0000), 0x0, 405504, ) == 0x0
 00088   444   NtClose  (28, ... ) == 0x0
 00089   444   NtOpenSection  (0xe, {24, 8, 0x40, 0, 0,  (0xe, {24, 8, 0x40, 0, 0, "CRYPT32.dll"}, ... 28, ) }, ... 28, ) == 0x0
 00090   444   NtMapViewOfSection  (28, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x762c0000), 0x0, 565248, ) == 0x0
 00091   444   NtClose  (28, ... ) == 0x0
 00092   444   NtOpenSection  (0xe, {24, 8, 0x40, 0, 0,  (0xe, {24, 8, 0x40, 0, 0, "MSASN1.dll"}, ... 28, ) }, ... 28, ) == 0x0
 00093   444   NtMapViewOfSection  (28, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x762a0000), 0x0, 61440, ) == 0x0
 00094   444   NtClose  (28, ... ) == 0x0
 00095   444   NtOpenSection  (0xe, {24, 8, 0x40, 0, 0,  (0xe, {24, 8, 0x40, 0, 0, "OLEAUT32.dll"}, ... 28, ) }, ... 28, ) == 0x0
 00096   444   NtMapViewOfSection  (28, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x77120000), 0x0, 569344, ) == 0x0
 00097   444   NtClose  (28, ... ) == 0x0
 00098   444   NtOpenSection  (0xe, {24, 8, 0x40, 0, 0,  (0xe, {24, 8, 0x40, 0, 0, "OLE32.DLL"}, ... 28, ) }, ... 28, ) == 0x0
 00099   444   NtMapViewOfSection  (28, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x771b0000), 0x0, 1155072, ) == 0x0
 00100   444   NtClose  (28, ... ) == 0x0
 00101   444   NtProtectVirtualMemory  (-1, (0x31428000), 8192, 4, ... (0x31428000), 8192, 64, ) == 0x0
 00102   444   NtProtectVirtualMemory  (-1, (0x31428000), 8192, 64, ... (0x31428000), 8192, 4, ) == 0x0
 00103   444   NtFlushInstructionCache  (-1, 826441728, 8192, ... ) == 0x0
 00104   444   NtOpenSection  (0xe, {24, 8, 0x40, 0, 0,  (0xe, {24, 8, 0x40, 0, 0, "WS2_32.dll"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00105   444   NtAllocateVirtualMemory  (-1, 1323008, 0, 4096, 4096, 4, ... 1323008, 4096, ) == 0x0
 00106   444   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\u:\work\WS2_32.dll"}, 1242624, ... ) }, 1242624, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00107   444   NtQueryAttributesFile  ({24, 12, 0x40, 0, 0,  ({24, 12, 0x40, 0, 0, "WS2_32.dll"}, 1242624, ... ) }, 1242624, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00108   444   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\System32\WS2_32.dll"}, 1242624, ... ) }, 1242624, ... ) == 0x0
 00109   444   NtOpenFile  (0x100020, {24, 0, 0x40, 0, 0,  (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\System32\WS2_32.dll"}, 5, 96, ... 28, {status=0x0, info=1}, ) }, 5, 96, ... 28, {status=0x0, info=1}, ) == 0x0
 00110   444   NtCreateSection  (0xf, 0x0, 0x0, 16, 16777216, 28, ... 32, ) == 0x0
 00111   444   NtQuerySection  (32, Image, 48, ... {section info, class 1, size 48}, 0x0, ) == 0x0
 00112   444   NtOpenProcessToken  (-1, 0x8, ... 36, ) == 0x0
 00113   444   NtQueryInformationToken  (36, User, 136, ... {token info, class 1, size 36}, 36, ) == 0x0
 00114   444   NtOpenKey  (0x3, {24, 0, 0x40, 0, 0,  (0x3, {24, 0, 0x40, 0, 0, "\Registry\MACHINE\System\CurrentControlSet\Control\SafeBoot\Option"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00115   444   NtOpenKey  (0x1, {24, 0, 0x40, 0, 0,  (0x1, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers"}, ... 40, ) }, ... 40, ) == 0x0
 00116   444   NtQueryValueKey  (40,  (40, "TransparentEnabled", Partial, 80, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) , Partial, 80, ... TitleIdx=0, Type=4, Data= (40, "TransparentEnabled", Partial, 80, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) }, 16, ) == 0x0
 00117   444   NtClose  (40, ... ) == 0x0
 00118   444   NtOpenThreadTokenEx  (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN
 00119   444   NtOpenProcessTokenEx  (-1, 0x20008, 512, ... 40, ) == 0x0
 00120   444   NtQueryInformationToken  (40, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0
 00121   444   NtClose  (40, ... ) == 0x0
 00122   444   NtOpenKey  (0x1, {24, 0, 0x40, 0, 0,  (0x1, {24, 0, 0x40, 0, 0, "\REGISTRY\USER\S-1-5-21-1078081533-484763869-839522115-1003\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00123   444   NtClose  (36, ... ) == 0x0
 00124   444   NtClose  (28, ... ) == 0x0
 00125   444   NtMapViewOfSection  (32, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x71ab0000), 0x0, 86016, ) == 0x0
 00126   444   NtClose  (32, ... ) == 0x0
 00127   444   NtOpenSection  (0xe, {24, 8, 0x40, 0, 0,  (0xe, {24, 8, 0x40, 0, 0, "WS2HELP.dll"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00128   444   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\u:\work\WS2HELP.dll"}, 1241820, ... ) }, 1241820, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00129   444   NtQueryAttributesFile  ({24, 12, 0x40, 0, 0,  ({24, 12, 0x40, 0, 0, "WS2HELP.dll"}, 1241820, ... ) }, 1241820, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00130   444   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\System32\WS2HELP.dll"}, 1241820, ... ) }, 1241820, ... ) == 0x0
 00131   444   NtOpenFile  (0x100020, {24, 0, 0x40, 0, 0,  (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\System32\WS2HELP.dll"}, 5, 96, ... 32, {status=0x0, info=1}, ) }, 5, 96, ... 32, {status=0x0, info=1}, ) == 0x0
 00132   444   NtCreateSection  (0xf, 0x0, 0x0, 16, 16777216, 32, ... 28, ) == 0x0
 00133   444   NtQuerySection  (28, Image, 48, ... {section info, class 1, size 48}, 0x0, ) == 0x0
 00134   444   NtClose  (32, ... ) == 0x0
 00135   444   NtMapViewOfSection  (28, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x71aa0000), 0x0, 32768, ) == 0x0
 00136   444   NtClose  (28, ... ) == 0x0
 00137   444   NtProtectVirtualMemory  (-1, (0x31428000), 8192, 4, ... (0x31428000), 8192, 64, ) == 0x0
 00138   444   NtProtectVirtualMemory  (-1, (0x31428000), 8192, 64, ... (0x31428000), 8192, 4, ) == 0x0
 00139   444   NtFlushInstructionCache  (-1, 826441728, 8192, ... ) == 0x0
 00140   444   NtOpenProcessToken  (-1, 0x8, ... 28, ) == 0x0
 00141   444   NtQueryInformationToken  (28, Statistics, 56, ... {token info, class 10, size 56}, 56, ) == 0x0
 00142   444   NtClose  (28, ... ) == 0x0
 00143   444   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\System\CurrentControlSet\Control\Terminal Server"}, ... 28, ) }, ... 28, ) == 0x0
 00144   444   NtQueryValueKey  (28,  (28, "TSAppCompat", Partial, 548, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) , Partial, 548, ... TitleIdx=0, Type=4, Data= (28, "TSAppCompat", Partial, 548, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) }, 16, ) == 0x0
 00145   444   NtClose  (28, ... ) == 0x0
 00146   444   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\System\CurrentControlSet\Control\Terminal Server"}, ... 28, ) }, ... 28, ) == 0x0
 00147   444   NtQueryValueKey  (28,  (28, "TSAppCompat", Partial, 548, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) , Partial, 548, ... TitleIdx=0, Type=4, Data= (28, "TSAppCompat", Partial, 548, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) }, 16, ) == 0x0
 00148   444   NtQueryValueKey  (28,  (28, "TSUserEnabled", Partial, 548, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) , Partial, 548, ... TitleIdx=0, Type=4, Data= (28, "TSUserEnabled", Partial, 548, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) }, 16, ) == 0x0
 00149   444   NtClose  (28, ... ) == 0x0
 00150   444   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon"}, ... 28, ) }, ... 28, ) == 0x0
 00151   444   NtQueryValueKey  (28,  (28, "LeakTrack", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00152   444   NtClose  (28, ... ) == 0x0
 00153   444   NtOpenKey  (0x2000000, {24, 0, 0x40, 0, 0,  (0x2000000, {24, 0, 0x40, 0, 0, "\REGISTRY\MACHINE"}, ... 28, ) }, ... 28, ) == 0x0
 00154   444   NtSetInformationObject  (28, Handle, {Inherit=0,ProtectFromClose=1,}, 2011365632, ... ) == 0x0
 00155   444   NtOpenKey  (0x20019, {24, 28, 0x40, 0, 0,  (0x20019, {24, 28, 0x40, 0, 0, "Software\Microsoft\Windows NT\CurrentVersion\Diagnostics"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00156   444   NtQuerySystemInformation  (Basic, 44, ... {Unknown=0,MaximumIncrement=156250,PhysicalPageSize=0x1000,NumberOfPhysicalPages=0xff7c,LowestPhysicalPage=0x1,HighestPhysicalPage=0xffff,AllocationGranularity=0x10000,LowestUserAddress=0x10000,HighestUserAddress=0x7ffeffff,ActiveProcessors=1,NumberProcessors=1,}, 0x0, ) == 0x0
 00157   444   NtAllocateVirtualMemory  (-1, 0, 0, 65536, 8192, 4, ... 3276800, 65536, ) == 0x0
 00158   444   NtAllocateVirtualMemory  (-1, 3276800, 0, 4096, 4096, 4, ... 3276800, 4096, ) == 0x0
 00159   444   NtAllocateVirtualMemory  (-1, 3280896, 0, 8192, 4096, 4, ... 3280896, 8192, ) == 0x0
 00160   444   NtOpenSection  (0x4, {24, 0, 0x40, 0, 0,  (0x4, {24, 0, 0x40, 0, 0, "\NLS\NlsSectionCType"}, ... 32, ) }, ... 32, ) == 0x0
 00161   444   NtMapViewOfSection  (32, -1, (0x0), 0, 0, 0x0, 0, 2, 0, 2, ... (0x330000), 0x0, 12288, ) == 0x0
 00162   444   NtClose  (32, ... ) == 0x0
 00163   444   NtAllocateVirtualMemory  (-1, 3289088, 0, 4096, 4096, 4, ... 3289088, 4096, ) == 0x0
 00164   444   NtQuerySystemInformation  (Basic, 44, ... {Unknown=0,MaximumIncrement=156250,PhysicalPageSize=0x1000,NumberOfPhysicalPages=0xff7c,LowestPhysicalPage=0x1,HighestPhysicalPage=0xffff,AllocationGranularity=0x10000,LowestUserAddress=0x10000,HighestUserAddress=0x7ffeffff,ActiveProcessors=1,NumberProcessors=1,}, 0x0, ) == 0x0
 00165   444   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1243120, 256, 1242864, 256}  (24, {28, 56, new_msg, 0, 1243120, 256, 1242864, 256} "\210\6\32\1\0\0\0\0\1\0\0\0\360\367\22\0\3\0\0\0\234\6\32\1$\1\0\0" ... {28, 56, reply, 0, 436, 444, 1558, 0} "XQ\26\0\0\0\0\0\0\0\0\0\360\367\22\0\3\0\0\0\234\6\32\1$\1\0\0" )  ... {28, 56, reply, 0, 436, 444, 1558, 0}  (24, {28, 56, new_msg, 0, 1243120, 256, 1242864, 256} "\210\6\32\1\0\0\0\0\1\0\0\0\360\367\22\0\3\0\0\0\234\6\32\1$\1\0\0" ... {28, 56, reply, 0, 436, 444, 1558, 0} "XQ\26\0\0\0\0\0\0\0\0\0\360\367\22\0\3\0\0\0\234\6\32\1$\1\0\0" )  ) == 0x0
 00166   444   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\System\CurrentControlSet\Control\Error Message Instrument\"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00167   444   NtMapViewOfSection  (32, -1, (0x0), 0, 0, 0x0, 0, 2, 0, 2, ... (0x410000), 0x0, 1060864, ) == 0x0
 00168   444   NtCreateEvent  (0x1f0003, 0x0, 1, 0, ... 36, ) == 0x0
 00169   444   NtOpenThreadTokenEx  (-2, 0x8, 1, 512, ... ) == STATUS_NO_TOKEN
 00170   444   NtOpenProcessTokenEx  (-1, 0x8, 512, ... -2147482032, ) == 0x0
 00171   444   NtQueryInformationToken  (-2147482032, Statistics, 0, ... ) == STATUS_BUFFER_TOO_SMALL
 00172   444   NtQueryInformationToken  (-2147482032, Statistics, 56, ... {token info, class 10, size 56}, 56, ) == 0x0
 00173   444   NtClose  (-2147482032, ... ) == 0x0
 00174   444   NtAllocateVirtualMemory  (-1, 0, 0, 32, 4096, 4, ... 5373952, 4096, ) == 0x0
 00175   444   NtFreeVirtualMemory  (-1, (0x520000), 4096, 32768, ... (0x520000), 4096, ) == 0x0
 00176   444   NtDuplicateObject  (-1, 40, -1, 0x0, 0, 2, ... 48, ) == 0x0
 00177   444   NtOpenKey  (0x20019, {24, 0, 0x240, 0, 0,  (0x20019, {24, 0, 0x240, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Compatibility32"}, ... -2147482032, ) }, ... -2147482032, ) == 0x0
 00178   444   NtQueryValueKey  (-2147482032,  (-2147482032, "packed", Partial, 172, ... ) , Partial, 172, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00179   444   NtClose  (-2147482032, ... ) == 0x0
 00180   444   NtOpenKey  (0x20019, {24, 0, 0x240, 0, 0,  (0x20019, {24, 0, 0x240, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\IME Compatibility"}, ... -2147482032, ) }, ... -2147482032, ) == 0x0
 00181   444   NtQueryValueKey  (-2147482032,  (-2147482032, "packed", Partial, 172, ... ) , Partial, 172, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00182   444   NtClose  (-2147482032, ... ) == 0x0
 00183   444   NtQueryDefaultLocale  (0, -136148468, ... ) == 0x0
 00184   444   NtGdiQueryFontAssocInfo  (0, ... ) == 0x0
 00185   444   NtUserCallNoParam  (24, ... ) == 0x0
 00186   444   NtGdiCreateCompatibleDC  (0, ...
 00187   444   NtAllocateVirtualMemory  (-1, 0, 0, 4096, 12288, 4, ... 5373952, 4096, ) == 0x0
 00186   444   NtGdiCreateCompatibleDC  ... ) == 0xe010451
 00188   444   NtGdiGetStockObject  (0, ... ) == 0x1900010
 00189   444   NtGdiGetStockObject  (4, ... ) == 0x1900011
 00190   444   NtGdiCreateBitmap  (8, 8, 1, 1, 2010393708, ... ) == 0xb050458
 00191   444   NtGdiCreateSolidBrush  (0, 0, ...
 00192   444   NtAllocateVirtualMemory  (-1, 0, 0, 4096, 12288, 4, ... 8585216, 4096, ) == 0x0
 00191   444   NtGdiCreateSolidBrush  ... ) == 0x810045b
 00193   444   NtGdiGetStockObject  (13, ... ) == 0x18a0021
 00194   444   NtGdiCreateCompatibleDC  (0, ... ) == 0x601045c
 00195   444   NtGdiSelectBitmap  (100729948, 184878168, ... ) == 0x185000f
 00196   444   NtUserGetThreadDesktop  (444, 0, ... ) == 0x2c
 00197   444   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Windows"}, ... 52, ) }, ... 52, ) == 0x0
 00198   444   NtQueryValueKey  (52,  (52, "AppInit_DLLs", Partial, 64, ... TitleIdx=0, Type=1, Data="\0\0"}, 14, ) , Partial, 64, ... TitleIdx=0, Type=1, Data= (52, "AppInit_DLLs", Partial, 64, ... TitleIdx=0, Type=1, Data="\0\0"}, 14, ) }, 14, ) == 0x0
 00199   444   NtClose  (52, ... ) == 0x0
 00200   444   NtUserFindExistingCursorIcon  (1241204, 1241220, 1241788, ... ) == 0x10011
 00201   444   NtUserRegisterClassExWOW  (1241724, 1241804, 1241788, 1241820, 673, 128, 0, ... ) == 0x810cc017
 00202   444   NtUserFindExistingCursorIcon  (1241204, 1241220, 1241788, ... ) == 0x10011
 00203   444   NtUserRegisterClassExWOW  (1241724, 1241804, 1241788, 1241820, 674, 128, 0, ... ) == 0x810cc01c
 00204   444   NtUserFindExistingCursorIcon  (1241204, 1241220, 1241788, ... ) == 0x10011
 00205   444   NtUserRegisterClassExWOW  (1241724, 1241804, 1241788, 1241820, 675, 128, 0, ... ) == 0x810cc01e
 00206   444   NtUserFindExistingCursorIcon  (1241204, 1241220, 1241788, ... ) == 0x10011
 00207   444   NtUserRegisterClassExWOW  (1241724, 1241804, 1241788, 1241820, 676, 128, 0, ... ) == 0x810c8002
 00208   444   NtUserFindExistingCursorIcon  (1241204, 1241220, 1241788, ... ) == 0x10013
 00209   444   NtUserRegisterClassExWOW  (1241724, 1241804, 1241788, 1241820, 677, 128, 0, ... ) == 0x810cc018
 00210   444   NtUserFindExistingCursorIcon  (1241204, 1241220, 1241788, ... ) == 0x10011
 00211   444   NtUserRegisterClassExWOW  (1241724, 1241804, 1241788, 1241820, 678, 128, 0, ... ) == 0x810cc01a
 00212   444   NtUserFindExistingCursorIcon  (1241204, 1241220, 1241788, ... ) == 0x10011
 00213   444   NtUserRegisterClassExWOW  (1241724, 1241804, 1241788, 1241820, 679, 128, 0, ... ) == 0x810cc01d
 00214   444   NtUserFindExistingCursorIcon  (1241204, 1241220, 1241788, ... ) == 0x10011
 00215   444   NtUserRegisterClassExWOW  (1241724, 1241804, 1241788, 1241820, 681, 128, 0, ... ) == 0x810cc026
 00216   444   NtUserFindExistingCursorIcon  (1241204, 1241220, 1241788, ... ) == 0x10011
 00217   444   NtUserRegisterClassExWOW  (1241724, 1241804, 1241788, 1241820, 680, 128, 0, ... ) == 0x810cc019
 00218   444   NtUserRegisterClassExWOW  (1241676, 1241756, 1241740, 1241772, 0, 128, 0, ... ) == 0x810cc020
 00219   444   NtUserRegisterClassExWOW  (1241676, 1241752, 1241768, 1241740, 0, 130, 0, ... ) == 0x810cc022
 00220   444   NtUserRegisterClassExWOW  (1241676, 1241756, 1241740, 1241772, 0, 128, 0, ... ) == 0x810cc023
 00221   444   NtUserRegisterClassExWOW  (1241676, 1241752, 1241768, 1241740, 0, 130, 0, ...
 00222   444   NtAllocateVirtualMemory  (-1, 5550080, 0, 4096, 4096, 32, ... 5550080, 4096, ) == 0x0
 00221   444   NtUserRegisterClassExWOW  ... ) == 0x810cc024
 00223   444   NtUserRegisterClassExWOW  (1241676, 1241756, 1241740, 1241772, 0, 128, 0, ... ) == 0x810cc025
 00224   444   NtCallbackReturn  (0, 0, 0, ...
 00225   444   NtGdiInit  (... ) == 0x1
 00226   444   NtGdiGetStockObject  (18, ... ) == 0x290001c
 00227   444   NtGdiGetStockObject  (19, ... ) == 0x1b00019
 00228   444   NtOpenKey  (0x2000000, {24, 28, 0x40, 0, 0,  (0x2000000, {24, 28, 0x40, 0, 0, "Software\Microsoft\Windows\CurrentVersion\Explorer\Performance"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00229   444   NtOpenKey  (0x20019, {24, 28, 0x40, 0, 0,  (0x20019, {24, 28, 0x40, 0, 0, "SYSTEM\CurrentControlSet\Services\crypt32\Performance"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00230   444   NtAllocateVirtualMemory  (-1, 1327104, 0, 4096, 4096, 4, ... 1327104, 4096, ) == 0x0
 00231   444   NtOpenKey  (0x1, {24, 0, 0x40, 0, 0,  (0x1, {24, 0, 0x40, 0, 0, "\Registry\MACHINE\System\CurrentControlSet\Control\Session Manager"}, ... 52, ) }, ... 52, ) == 0x0
 00232   444   NtQueryValueKey  (52,  (52, "SafeDllSearchMode", Partial, 16, ... ) , Partial, 16, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00233   444   NtClose  (52, ... ) == 0x0
 00234   444   NtAllocateVirtualMemory  (-1, 1331200, 0, 4096, 4096, 4, ... 1331200, 4096, ) == 0x0
 00235   444   NtAllocateVirtualMemory  (-1, 1335296, 0, 4096, 4096, 4, ... 1335296, 4096, ) == 0x0
 00236   444   NtAllocateVirtualMemory  (-1, 1339392, 0, 4096, 4096, 4, ... 1339392, 4096, ) == 0x0
 00237   444   NtOpenDirectoryObject  (0x2000f, {24, 0, 0x40, 0, 0,  (0x2000f, {24, 0, 0x40, 0, 0, "\BaseNamedObjects"}, ... 52, ) }, ... 52, ) == 0x0
 00238   444   NtCreateEvent  (0x1f0003, {24, 52, 0x80, 1243532, 0,  (0x1f0003, {24, 52, 0x80, 1243532, 0, "Global\crypt32LogoffEvent"}, 0, 0, ... ) }, 0, 0, ... ) == STATUS_ACCESS_DENIED
 00239   444   NtOpenEvent  (0x100000, {24, 52, 0x0, 0, 0,  (0x100000, {24, 52, 0x0, 0, 0, "Global\crypt32LogoffEvent"}, ... 56, ) }, ... 56, ) == 0x0
 00240   444   NtQuerySystemInformation  (Basic, 44, ... {Unknown=0,MaximumIncrement=156250,PhysicalPageSize=0x1000,NumberOfPhysicalPages=0xff7c,LowestPhysicalPage=0x1,HighestPhysicalPage=0xffff,AllocationGranularity=0x10000,LowestUserAddress=0x10000,HighestUserAddress=0x7ffeffff,ActiveProcessors=1,NumberProcessors=1,}, 0x0, ) == 0x0
 00241   444   NtQuerySystemInformation  (Processor, 12, ... {system info, class 1, size 12}, 0x0, ) == 0x0
 00242   444   NtOpenKey  (0x20019, {24, 28, 0x40, 0, 0,  (0x20019, {24, 28, 0x40, 0, 0, "SYSTEM\CurrentControlSet\Control\Session Manager"}, ... 60, ) }, ... 60, ) == 0x0
 00243   444   NtQueryValueKey  (60,  (60, "CriticalSectionTimeout", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\215'\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (60, "CriticalSectionTimeout", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\215'\0"}, 16, ) }, 16, ) == 0x0
 00244   444   NtClose  (60, ... ) == 0x0
 00245   444   NtAllocateVirtualMemory  (-1, 1343488, 0, 4096, 4096, 4, ... 1343488, 4096, ) == 0x0
 00246   444   NtQuerySystemInformation  (Basic, 44, ... {Unknown=0,MaximumIncrement=156250,PhysicalPageSize=0x1000,NumberOfPhysicalPages=0xff7c,LowestPhysicalPage=0x1,HighestPhysicalPage=0xffff,AllocationGranularity=0x10000,LowestUserAddress=0x10000,HighestUserAddress=0x7ffeffff,ActiveProcessors=1,NumberProcessors=1,}, 0x0, ) == 0x0
 00247   444   NtQuerySystemInformation  (Processor, 12, ... {system info, class 1, size 12}, 0x0, ) == 0x0
 00248   444   NtQuerySystemInformation  (Basic, 44, ... {Unknown=0,MaximumIncrement=156250,PhysicalPageSize=0x1000,NumberOfPhysicalPages=0xff7c,LowestPhysicalPage=0x1,HighestPhysicalPage=0xffff,AllocationGranularity=0x10000,LowestUserAddress=0x10000,HighestUserAddress=0x7ffeffff,ActiveProcessors=1,NumberProcessors=1,}, 0x0, ) == 0x0
 00249   444   NtQuerySystemInformation  (Processor, 12, ... {system info, class 1, size 12}, 0x0, ) == 0x0
 00250   444   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Classes\Interface"}, ... 60, ) }, ... 60, ) == 0x0
 00251   444   NtQueryValueKey  (60,  (60, "InterfaceHelperDisableAll", Full, 0, ... ) , Full, 0, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00252   444   NtQueryValueKey  (60,  (60, "InterfaceHelperDisableAllForOle32", Full, 0, ... ) , Full, 0, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00253   444   NtQueryValueKey  (60,  (60, "InterfaceHelperDisableTypeLib", Full, 0, ... ) , Full, 0, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00254   444   NtClose  (60, ... ) == 0x0
 00255   444   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Classes\Interface\{00020400-0000-0000-C000-000000000046}"}, ... 60, ) }, ... 60, ) == 0x0
 00256   444   NtQueryValueKey  (60,  (60, "InterfaceHelperDisableAll", Full, 0, ... ) , Full, 0, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00257   444   NtQueryValueKey  (60,  (60, "InterfaceHelperDisableAllForOle32", Full, 0, ... ) , Full, 0, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00258   444   NtClose  (60, ... ) == 0x0
 00259   444   NtOpenEvent  (0x1f0003, {24, 52, 0x0, 0, 0,  (0x1f0003, {24, 52, 0x0, 0, 0, "HookSwitchHookEnabledEvent"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00260   444   NtUserRegisterWindowMessage  ( ("{FB8F0821-0164-101B-84ED-08002B2EC713}", ... ) , ... ) == 0xc07b
 00261   444   NtOpenKey  (0x1, {24, 28, 0x40, 0, 0,  (0x1, {24, 28, 0x40, 0, 0, "SOFTWARE\Microsoft\OLEAUT"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00262   444   NtOpenKey  (0x9, {24, 28, 0x40, 0, 0,  (0x9, {24, 28, 0x40, 0, 0, "SOFTWARE\Microsoft\OLEAUT\UserEra"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00263   444   NtOpenKey  (0x1, {24, 28, 0x40, 0, 0,  (0x1, {24, 28, 0x40, 0, 0, "SOFTWARE\Microsoft\OLEAUT"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00264   444   NtAllocateVirtualMemory  (-1, 1347584, 0, 8192, 4096, 4, ... 1347584, 8192, ) == 0x0
 00265   444   NtOpenThreadTokenEx  (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN
 00266   444   NtOpenProcessTokenEx  (-1, 0x20008, 512, ... 60, ) == 0x0
 00267   444   NtQueryInformationToken  (60, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0
 00268   444   NtClose  (60, ... ) == 0x0
 00269   444   NtOpenKey  (0x2000000, {24, 0, 0x640, 0, 0,  (0x2000000, {24, 0, 0x640, 0, 0, "\REGISTRY\USER\S-1-5-21-1078081533-484763869-839522115-1003"}, ... 60, ) }, ... 60, ) == 0x0
 00270   444   NtSetInformationObject  (60, Handle, {Inherit=0,ProtectFromClose=1,}, 1179904, ... ) == 0x0
 00271   444   NtCreateKey  (0xf003f, {24, 60, 0x40, 0, 0,  (0xf003f, {24, 60, 0x40, 0, 0, "SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\P3P\History"}, 0, 0x0, 0, ... 64, 2, ) }, 0, 0x0, 0, ... 64, 2, ) == 0x0
 00272   444   NtQueryDefaultUILanguage  (1241768, ...
 00273   444   NtOpenThreadTokenEx  (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN
 00274   444   NtOpenProcessTokenEx  (-1, 0x20008, 512, ... -2147482032, ) == 0x0
 00275   444   NtQueryInformationToken  (-2147482032, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0
 00276   444   NtClose  (-2147482032, ... ) == 0x0
 00277   444   NtOpenKey  (0x2000000, {24, 0, 0x640, 0, 0,  (0x2000000, {24, 0, 0x640, 0, 0, "\REGISTRY\USER\S-1-5-21-1078081533-484763869-839522115-1003"}, ... -2147482032, ) }, ... -2147482032, ) == 0x0
 00278   444   NtOpenKey  (0x80000000, {24, 0, 0x240, 0, 0,  (0x80000000, {24, 0, 0x240, 0, 0, "\Registry\Machine\System\CurrentControlSet\Control\Nls\MUILanguages"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00279   444   NtOpenKey  (0x80000000, {24, -2147482032, 0x640, 0, 0,  (0x80000000, {24, -2147482032, 0x640, 0, 0, "Control Panel\Desktop"}, ... -2147482044, ) }, ... -2147482044, ) == 0x0
 00280   444   NtQueryValueKey  (-2147482044,  (-2147482044, "MultiUILanguageId", Partial, 256, ... ) , Partial, 256, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00281   444   NtClose  (-2147482044, ... ) == 0x0
 00282   444   NtClose  (-2147482032, ... ) == 0x0
 00272   444   NtQueryDefaultUILanguage  ... ) == 0x0
 00283   444   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\System\CurrentControlSet\Control\Nls\MUILanguages"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00284   444   NtQueryInstallUILanguage  (2012047340, ... ) == 0x0
 00285   444   NtOpenFile  (0x1200a9, {24, 0, 0x40, 0, 0,  (0x1200a9, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\WININET.dll"}, 1, 96, ... 68, {status=0x0, info=1}, ) }, 1, 96, ... 68, {status=0x0, info=1}, ) == 0x0
 00286   444   NtCreateSection  (0x4, 0x0, 0x0, 2, 134217728, 68, ... 72, ) == 0x0
 00287   444   NtMapViewOfSection  (72, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 2, ... (0x840000), 0x0, 593920, ) == 0x0
 00288   444   NtOpenFile  (0x1200a9, {24, 0, 0x40, 0, 0,  (0x1200a9, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\WININET.dll.123.Manifest"}, 1, 96, ... ) }, 1, 96, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00289   444   NtQueryDefaultUILanguage  (2013024600, ...
 00290   444   NtOpenThreadTokenEx  (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN
 00291   444   NtOpenProcessTokenEx  (-1, 0x20008, 512, ... -2147482032, ) == 0x0
 00292   444   NtQueryInformationToken  (-2147482032, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0
 00293   444   NtClose  (-2147482032, ... ) == 0x0
 00294   444   NtOpenKey  (0x2000000, {24, 0, 0x640, 0, 0,  (0x2000000, {24, 0, 0x640, 0, 0, "\REGISTRY\USER\S-1-5-21-1078081533-484763869-839522115-1003"}, ... -2147482032, ) }, ... -2147482032, ) == 0x0
 00295   444   NtOpenKey  (0x80000000, {24, 0, 0x240, 0, 0,  (0x80000000, {24, 0, 0x240, 0, 0, "\Registry\Machine\System\CurrentControlSet\Control\Nls\MUILanguages"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00296   444   NtOpenKey  (0x80000000, {24, -2147482032, 0x640, 0, 0,  (0x80000000, {24, -2147482032, 0x640, 0, 0, "Control Panel\Desktop"}, ... -2147482044, ) }, ... -2147482044, ) == 0x0
 00297   444   NtQueryValueKey  (-2147482044,  (-2147482044, "MultiUILanguageId", Partial, 256, ... ) , Partial, 256, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00298   444   NtClose  (-2147482044, ... ) == 0x0
 00299   444   NtClose  (-2147482032, ... ) == 0x0
 00289   444   NtQueryDefaultUILanguage  ... ) == 0x0
 00300   444   NtAllocateVirtualMemory  (-1, 1228800, 0, 4096, 4096, 260, ... 1228800, 4096, ) == 0x0
 00301   444   NtQueryInstallUILanguage  (2013024602, ... ) == 0x0
 00302   444   NtQueryDefaultLocale  (1, 1239804, ... ) == 0x0
 00303   444   NtOpenFile  (0x1200a9, {24, 0, 0x40, 0, 0,  (0x1200a9, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\WININET.dll.123.Config"}, 1, 96, ... ) }, 1, 96, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00304   444   NtRequestWaitReplyPort  (24, {128, 156, new_msg, 0, 1240660, 1, 96, 0}  (24, {128, 156, new_msg, 0, 1240660, 1, 96, 0} "\210\6\32\1\33\0\1\0\0\0\0\0\1\361\22\0\1\0\0\0\0\0\11\4\1\1\1\0>\0@\0\250\6\32\1D\0\0\0\377\377\377\377\0\0\0\0P\275\213\0\0\0\0\0\312\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0(\0,\0\350\6\32\1\0\0\0\0\0\0\0\0T\365\22\0\0\0\0\0" ... {128, 156, reply, 0, 436, 444, 1559, 0} "(\350\26\0\33\0\1\0\0\0\0\0\1\361\22\0\1\0\0\0\0\0\11\4\1\1\1\0>\0@\0\250\6\32\1D\0\0\0\377\377\377\377\0\0\0\0P\275\213\0\0\0\0\0\312\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0(\0,\0\350\6\32\1\0\0\0\0\0\0\0\0T\365\22\0\0\0\0\0" )  ... {128, 156, reply, 0, 436, 444, 1559, 0}  (24, {128, 156, new_msg, 0, 1240660, 1, 96, 0} "\210\6\32\1\33\0\1\0\0\0\0\0\1\361\22\0\1\0\0\0\0\0\11\4\1\1\1\0>\0@\0\250\6\32\1D\0\0\0\377\377\377\377\0\0\0\0P\275\213\0\0\0\0\0\312\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0(\0,\0\350\6\32\1\0\0\0\0\0\0\0\0T\365\22\0\0\0\0\0" ... {128, 156, reply, 0, 436, 444, 1559, 0} "(\350\26\0\33\0\1\0\0\0\0\0\1\361\22\0\1\0\0\0\0\0\11\4\1\1\1\0>\0@\0\250\6\32\1D\0\0\0\377\377\377\377\0\0\0\0P\275\213\0\0\0\0\0\312\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0(\0,\0\350\6\32\1\0\0\0\0\0\0\0\0T\365\22\0\0\0\0\0" )  ) == 0x0
 00305   444   NtClose  (68, ... ) == 0x0
 00306   444   NtClose  (72, ... ) == 0x0
 00307   444   NtUnmapViewOfSection  (-1, 0x840000, ... ) == 0x0
 00308   444   NtUnmapViewOfSection  (-1, 0x12f554, ... ) == STATUS_NOT_MAPPED_VIEW
 00309   444   NtQueryDebugFilterState  (53, 2, ... ) == 0x0
 00310   444   NtOpenKey  (0x8, {24, 0, 0x40, 0, 0,  (0x8, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows\CurrentVersion\SideBySide\AssemblyStorageRoots"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00311   444   NtQueryDebugFilterState  (53, 2, ... ) == 0x0
 00312   444   NtQueryDebugFilterState  (53, 2, ... ) == 0x0
 00313   444   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\u:\work\packed.exe.Local\"}, 1238344, ... ) }, 1238344, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00314   444   NtQueryDebugFilterState  (53, 2, ... ) == 0x0
 00315   444   NtQueryDebugFilterState  (53, 2, ... ) == 0x0
 00316   444   NtQueryDebugFilterState  (53, 2, ... ) == 0x0
 00317   444   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.0.0_x-ww_1382d70a"}, 1238936, ... ) }, 1238936, ... ) == 0x0
 00318   444   NtOpenFile  (0x100020, {24, 0, 0x40, 0, 0,  (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.0.0_x-ww_1382d70a"}, 3, 33, ... 72, {status=0x0, info=1}, ) }, 3, 33, ... 72, {status=0x0, info=1}, ) == 0x0
 00319   444   NtQueryDebugFilterState  (53, 2, ... ) == 0x0
 00320   444   NtOpenFile  (0x100020, {24, 0, 0x40, 0, 0,  (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.0.0_x-ww_1382d70a\comctl32.dll"}, 5, 96, ... 68, {status=0x0, info=1}, ) }, 5, 96, ... 68, {status=0x0, info=1}, ) == 0x0
 00321   444   NtCreateSection  (0xe, 0x0, 0x0, 16, 134217728, 68, ... 76, ) == 0x0
 00322   444   NtClose  (68, ... ) == 0x0
 00323   444   NtMapViewOfSection  (76, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 16, ... (0x8f0000), 0x0, 921600, ) == 0x0
 00324   444   NtClose  (76, ... ) == 0x0
 00325   444   NtUnmapViewOfSection  (-1, 0x8f0000, ... ) == 0x0
 00326   444   NtOpenFile  (0x100020, {24, 0, 0x40, 0, 0,  (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.0.0_x-ww_1382d70a\comctl32.dll"}, 5, 96, ... 76, {status=0x0, info=1}, ) }, 5, 96, ... 76, {status=0x0, info=1}, ) == 0x0
 00327   444   NtCreateSection  (0xf, 0x0, 0x0, 16, 16777216, 76, ... 68, ) == 0x0
 00328   444   NtQuerySection  (68, Image, 48, ... {section info, class 1, size 48}, 0x0, ) == 0x0
 00329   444   NtClose  (76, ... ) == 0x0
 00330   444   NtMapViewOfSection  (68, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x71950000), 0x0, 933888, ) == 0x0
 00331   444   NtClose  (68, ... ) == 0x0
 00332   444   NtProtectVirtualMemory  (-1, (0x71951000), 1952, 4, ... (0x71951000), 4096, 32, ) == 0x0
 00333   444   NtProtectVirtualMemory  (-1, (0x71951000), 4096, 32, ... (0x71951000), 4096, 4, ) == 0x0
 00334   444   NtFlushInstructionCache  (-1, 1905594368, 1952, ... ) == 0x0
 00335   444   NtProtectVirtualMemory  (-1, (0x71951000), 1952, 4, ... (0x71951000), 4096, 32, ) == 0x0
 00336   444   NtProtectVirtualMemory  (-1, (0x71951000), 4096, 32, ... (0x71951000), 4096, 4, ) == 0x0
 00337   444   NtFlushInstructionCache  (-1, 1905594368, 1952, ... ) == 0x0
 00338   444   NtProtectVirtualMemory  (-1, (0x71951000), 1952, 4, ... (0x71951000), 4096, 32, ) == 0x0
 00339   444   NtProtectVirtualMemory  (-1, (0x71951000), 4096, 32, ... (0x71951000), 4096, 4, ) == 0x0
 00340   444   NtFlushInstructionCache  (-1, 1905594368, 1952, ... ) == 0x0
 00341   444   NtProtectVirtualMemory  (-1, (0x71951000), 1952, 4, ... (0x71951000), 4096, 32, ) == 0x0
 00342   444   NtProtectVirtualMemory  (-1, (0x71951000), 4096, 32, ... (0x71951000), 4096, 4, ) == 0x0
 00343   444   NtFlushInstructionCache  (-1, 1905594368, 1952, ... ) == 0x0
 00344   444   NtProtectVirtualMemory  (-1, (0x71951000), 1952, 4, ... (0x71951000), 4096, 32, ) == 0x0
 00345   444   NtProtectVirtualMemory  (-1, (0x71951000), 4096, 32, ... (0x71951000), 4096, 4, ) == 0x0
 00346   444   NtFlushInstructionCache  (-1, 1905594368, 1952, ... ) == 0x0
 00347   444   NtProtectVirtualMemory  (-1, (0x71951000), 1952, 4, ... (0x71951000), 4096, 32, ) == 0x0
 00348   444   NtProtectVirtualMemory  (-1, (0x71951000), 4096, 32, ... (0x71951000), 4096, 4, ) == 0x0
 00349   444   NtFlushInstructionCache  (-1, 1905594368, 1952, ... ) == 0x0
 00350   444   NtProtectVirtualMemory  (-1, (0x71951000), 1952, 4, ... (0x71951000), 4096, 32, ) == 0x0
 00351   444   NtProtectVirtualMemory  (-1, (0x71951000), 4096, 32, ... (0x71951000), 4096, 4, ) == 0x0
 00352   444   NtFlushInstructionCache  (-1, 1905594368, 1952, ... ) == 0x0
 00353   444   NtAddAtom  ( ("T\0h\0e\0m\0e\0P\0r\0o\0p\0S\0c\0r\0o\0l\0l\0B\0a\0r\0C\0t\0l\0", 42, 1240120, ... ) , 42, 1240120, ... ) == 0x0
 00354   444   NtQueryDefaultUILanguage  (1238836, ...
 00355   444   NtOpenThreadTokenEx  (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN
 00356   444   NtOpenProcessTokenEx  (-1, 0x20008, 512, ... -2147482032, ) == 0x0
 00357   444   NtQueryInformationToken  (-2147482032, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0
 00358   444   NtClose  (-2147482032, ... ) == 0x0
 00359   444   NtOpenKey  (0x2000000, {24, 0, 0x640, 0, 0,  (0x2000000, {24, 0, 0x640, 0, 0, "\REGISTRY\USER\S-1-5-21-1078081533-484763869-839522115-1003"}, ... -2147482032, ) }, ... -2147482032, ) == 0x0
 00360   444   NtOpenKey  (0x80000000, {24, 0, 0x240, 0, 0,  (0x80000000, {24, 0, 0x240, 0, 0, "\Registry\Machine\System\CurrentControlSet\Control\Nls\MUILanguages"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00361   444   NtOpenKey  (0x80000000, {24, -2147482032, 0x640, 0, 0,  (0x80000000, {24, -2147482032, 0x640, 0, 0, "Control Panel\Desktop"}, ... -2147482044, ) }, ... -2147482044, ) == 0x0
 00362   444   NtQueryValueKey  (-2147482044,  (-2147482044, "MultiUILanguageId", Partial, 256, ... ) , Partial, 256, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00363   444   NtClose  (-2147482044, ... ) == 0x0
 00364   444   NtClose  (-2147482032, ... ) == 0x0
 00354   444   NtQueryDefaultUILanguage  ... ) == 0x0
 00365   444   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\System\CurrentControlSet\Control\Nls\MUILanguages"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00366   444   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\WindowsShell.Manifest"}, 1237688, ... ) }, 1237688, ... ) == 0x0
 00367   444   NtOpenFile  (0x100020, {24, 0, 0x40, 0, 0,  (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\WindowsShell.Manifest"}, 5, 96, ... 68, {status=0x0, info=1}, ) }, 5, 96, ... 68, {status=0x0, info=1}, ) == 0x0
 00368   444   NtCreateSection  (0xe, 0x0, 0x0, 16, 134217728, 68, ... 76, ) == 0x0
 00369   444   NtClose  (68, ... ) == 0x0
 00370   444   NtMapViewOfSection  (76, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 16, ... (0x840000), 0x0, 4096, ) == 0x0
 00371   444   NtClose  (76, ... ) == 0x0
 00372   444   NtUnmapViewOfSection  (-1, 0x840000, ... ) == 0x0
 00373   444   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\WindowsShell.Manifest"}, 1237328, ... ) }, 1237328, ... ) == 0x0
 00374   444   NtCreateFile  (0x80100080, {24, 0, 0x40, 0, 1238028,  (0x80100080, {24, 0, 0x40, 0, 1238028, "\??\C:\WINDOWS\WindowsShell.Manifest"}, 0x0, 0, 5, 1, 96, 0, 0, ... 76, {status=0x0, info=1}, ) }, 0x0, 0, 5, 1, 96, 0, 0, ... 76, {status=0x0, info=1}, ) == 0x0
 00375   444   NtCreateSection  (0xf0005, 0x0, 0x0, 2, 134217728, 76, ... 68, ) == 0x0
 00376   444   NtClose  (76, ... ) == 0x0
 00377   444   NtMapViewOfSection  (68, -1, (0x0), 0, 0, {0, 0}, 0, 1, 0, 2, ... (0x840000), {0, 0}, 4096, ) == 0x0
 00378   444   NtClose  (68, ... ) == 0x0
 00379   444   NtUnmapViewOfSection  (-1, 0x840000, ... ) == 0x0
 00380   444   NtOpenFile  (0x1200a9, {24, 0, 0x40, 0, 0,  (0x1200a9, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\WindowsShell.Manifest"}, 1, 96, ... 68, {status=0x0, info=1}, ) }, 1, 96, ... 68, {status=0x0, info=1}, ) == 0x0
 00381   444   NtCreateSection  (0x4, 0x0, 0x0, 2, 134217728, 68, ... 76, ) == 0x0
 00382   444   NtMapViewOfSection  (76, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 2, ... (0x840000), 0x0, 4096, ) == 0x0
 00383   444   NtQueryInformationFile  (68, 1237648, 56, NetworkOpen, ... {status=0x0, info=56}, ) == 0x0
 00384   444   NtOpenFile  (0x1200a9, {24, 0, 0x40, 0, 0,  (0x1200a9, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\WindowsShell.Config"}, 1, 96, ... ) }, 1, 96, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00385   444   NtRequestWaitReplyPort  (24, {128, 156, new_msg, 0, 1237728, 1, 96, 0}  (24, {128, 156, new_msg, 0, 1237728, 1, 96, 0} "\210\6\32\1\33\0\1\0\240\315Z\371\2209\307\1\1\0\0\0\0\0\11\4\1\1\3\0@\0D\0\250\6\32\1D\0\0\0L\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\355\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\26\0\30\0\354\6\32\1\0\0\0\0\0\0\0\0\340\351\22\0\0\0\0\0" ... {128, 156, reply, 0, 436, 444, 1560, 0} "h\334\26\0\33\0\1\0\0\0\0\0\2209\307\1\1\0\0\0\0\0\11\4\1\1\3\0@\0D\0\250\6\32\1D\0\0\0L\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\355\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\26\0\30\0\354\6\32\1\0\0\0\0\0\0\0\0\340\351\22\0\0\0\0\0" )  ... {128, 156, reply, 0, 436, 444, 1560, 0}  (24, {128, 156, new_msg, 0, 1237728, 1, 96, 0} "\210\6\32\1\33\0\1\0\240\315Z\371\2209\307\1\1\0\0\0\0\0\11\4\1\1\3\0@\0D\0\250\6\32\1D\0\0\0L\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\355\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\26\0\30\0\354\6\32\1\0\0\0\0\0\0\0\0\340\351\22\0\0\0\0\0" ... {128, 156, reply, 0, 436, 444, 1560, 0} "h\334\26\0\33\0\1\0\0\0\0\0\2209\307\1\1\0\0\0\0\0\11\4\1\1\3\0@\0D\0\250\6\32\1D\0\0\0L\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\355\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\26\0\30\0\354\6\32\1\0\0\0\0\0\0\0\0\340\351\22\0\0\0\0\0" )  ) == 0x0
 00386   444   NtClose  (68, ... ) == 0x0
 00387   444   NtClose  (76, ... ) == 0x0
 00388   444   NtUnmapViewOfSection  (-1, 0x840000, ... ) == 0x0
 00389   444   NtUnmapViewOfSection  (-1, 0x12e9e0, ... ) == STATUS_NOT_MAPPED_VIEW
 00390   444   NtQueryDebugFilterState  (53, 2, ... ) == 0x0
 00391   444   NtUserRegisterWindowMessage  ( ("ShellGetDragImage", ... ) , ... ) == 0xc03a
 00392   444   NtUserSystemParametersInfo  (104, 0, 1906151468, 0, ... ) == 0x1
 00393   444   NtUserGetDC  (0, ... ) == 0x1010052
 00394   444   NtUserCallOneParam  (16842834, 56, ... ) == 0x1
 00395   444   NtUserSystemParametersInfo  (38, 4, 1906153440, 0, ... ) == 0x1
 00396   444   NtUserSystemParametersInfo  (66, 12, 1240140, 0, ... ) == 0x1
 00397   444   NtOpenProcessToken  (-1, 0x8, ... 76, ) == 0x0
 00398   444   NtAccessCheck  (1344424, 76, 0x1, 1239544, 1239488, 56, 1239572, ... ) == STATUS_NO_IMPERSONATION_TOKEN
 00399   444   NtClose  (76, ... ) == 0x0
 00400   444   NtOpenKey  (0x20019, {24, 60, 0x40, 0, 0,  (0x20019, {24, 60, 0x40, 0, 0, "Control Panel\Desktop"}, ... 76, ) }, ... 76, ) == 0x0
 00401   444   NtQueryValueKey  (76,  (76, "SmoothScroll", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00402   444   NtClose  (76, ... ) == 0x0
 00403   444   NtUserSystemParametersInfo  (41, 500, 1239640, 0, ... ) == 0x1
 00404   444   NtOpenKey  (0x1, {24, 60, 0x40, 0, 0,  (0x1, {24, 60, 0x40, 0, 0, "software\Microsoft\Windows\CurrentVersion\Explorer\Advanced"}, ... 76, ) }, ... 76, ) == 0x0
 00405   444   NtQueryValueKey  (76,  (76, "EnableBalloonTips", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00406   444   NtOpenKey  (0x1, {24, 28, 0x40, 0, 0,  (0x1, {24, 28, 0x40, 0, 0, "software\Microsoft\Windows\CurrentVersion\Explorer\Advanced"}, ... 68, ) }, ... 68, ) == 0x0
 00407   444   NtQueryValueKey  (68,  (68, "EnableBalloonTips", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00408   444   NtClose  (68, ... ) == 0x0
 00409   444   NtClose  (76, ... ) == 0x0
 00410   444   NtUserSystemParametersInfo  (102, 0, 1906153328, 0, ... ) == 0x1
 00411   444   NtUserSystemParametersInfo  (4130, 0, 1240164, 0, ... ) == 0x1
 00412   444   NtOpenKey  (0x1, {24, 28, 0x40, 0, 0,  (0x1, {24, 28, 0x40, 0, 0, "Software\Microsoft\Windows NT\CurrentVersion\LanguagePack"}, ... 76, ) }, ... 76, ) == 0x0
 00413   444   NtEnumerateValueKey  (76, 0, Full, 220, ... ) == STATUS_NO_MORE_ENTRIES
 00414   444   NtClose  (76, ... ) == 0x0
 00415   444   NtUserFindExistingCursorIcon  (1239448, 1239464, 1240032, ... ) == 0x10011
 00416   444   NtUserRegisterClassExWOW  (1239900, 1239980, 1239964, 1239996, 0, 384, 0, ... ) == 0x810cc03b
 00417   444   NtUserRegisterClassExWOW  (1239900, 1239980, 1239964, 1239996, 0, 384, 0, ... ) == 0x810cc03d
 00418   444   NtUserFindExistingCursorIcon  (1239444, 1239460, 1240028, ... ) == 0x10011
 00419   444   NtUserRegisterClassExWOW  (1239896, 1239976, 1239960, 1239992, 0, 384, 0, ... ) == 0x810cc03f
 00420   444   NtUserFindExistingCursorIcon  (1239448, 1239464, 1240032, ... ) == 0x10011
 00421   444   NtUserRegisterClassExWOW  (1239900, 1239980, 1239964, 1239996, 0, 384, 0, ... ) == 0x810cc041
 00422   444   NtUserFindExistingCursorIcon  (1239448, 1239464, 1240032, ... ) == 0x10011
 00423   444   NtUserRegisterClassExWOW  (1239900, 1239980, 1239964, 1239996, 0, 384, 0, ... ) == 0x810cc043
 00424   444   NtUserRegisterClassExWOW  (1239900, 1239980, 1239964, 1239996, 0, 384, 0, ... ) == 0x810cc045
 00425   444   NtUserFindExistingCursorIcon  (1239448, 1239464, 1240032, ... ) == 0x10011
 00426   444   NtUserRegisterClassExWOW  (1239900, 1239980, 1239964, 1239996, 0, 384, 0, ... ) == 0x810cc047
 00427   444   NtUserFindExistingCursorIcon  (1239444, 1239460, 1240028, ... ) == 0x10011
 00428   444   NtUserRegisterClassExWOW  (1239896, 1239976, 1239960, 1239992, 0, 384, 0, ... ) == 0x810cc049
 00429   444   NtUserGetClassInfo  (1905590272, 1240060, 1240012, 1240088, 0, ... ) == 0xc049
 00430   444   NtUserFindExistingCursorIcon  (1239448, 1239464, 1240032, ... ) == 0x10011
 00431   444   NtUserRegisterClassExWOW  (1239900, 1239980, 1239964, 1239996, 0, 384, 0, ... ) == 0x810cc04b
 00432   444   NtUserFindExistingCursorIcon  (1239448, 1239464, 1240032, ... ) == 0x10011
 00433   444   NtUserRegisterClassExWOW  (1239900, 1239980, 1239964, 1239996, 0, 384, 0, ... ) == 0x810cc04d
 00434   444   NtUserFindExistingCursorIcon  (1239448, 1239464, 1240032, ... ) == 0x10011
 00435   444   NtUserRegisterClassExWOW  (1239900, 1239980, 1239964, 1239996, 0, 384, 0, ... ) == 0x810cc04f
 00436   444   NtUserRegisterClassExWOW  (1239900, 1239980, 1239964, 1239996, 0, 384, 0, ... ) == 0x810cc051
 00437   444   NtUserFindExistingCursorIcon  (1239448, 1239464, 1240032, ... ) == 0x10011
 00438   444   NtUserRegisterClassExWOW  (1239900, 1239980, 1239964, 1239996, 0, 384, 0, ... ) == 0x810cc053
 00439   444   NtUserFindExistingCursorIcon  (1239444, 1239460, 1240028, ... ) == 0x10011
 00440   444   NtUserRegisterClassExWOW  (1239896, 1239976, 1239960, 1239992, 0, 384, 0, ... ) == 0x810cc055
 00441   444   NtUserRegisterClassExWOW  (1239896, 1239976, 1239960, 1239992, 0, 384, 0, ... ) == 0x810cc057
 00442   444   NtUserFindExistingCursorIcon  (1239448, 1239464, 1240032, ... ) == 0x10011
 00443   444   NtUserRegisterClassExWOW  (1239900, 1239980, 1239964, 1239996, 0, 384, 0, ... ) == 0x810cc059
 00444   444   NtUserFindExistingCursorIcon  (1239448, 1239464, 1240032, ... ) == 0x10013
 00445   444   NtUserRegisterClassExWOW  (1239900, 1239980, 1239964, 1239996, 0, 384, 0, ... ) == 0x810cc05b
 00446   444   NtUserFindExistingCursorIcon  (1239448, 1239464, 1240032, ... ) == 0x10011
 00447   444   NtUserRegisterClassExWOW  (1239900, 1239980, 1239964, 1239996, 0, 384, 0, ... ) == 0x810cc05d
 00448   444   NtUserFindExistingCursorIcon  (1239448, 1239464, 1240032, ... ) == 0x10011
 00449   444   NtUserRegisterClassExWOW  (1239900, 1239980, 1239964, 1239996, 0, 384, 0, ... ) == 0x810cc05f
 00450   444   NtUserFindExistingCursorIcon  (1239444, 1239460, 1240028, ... ) == 0x10011
 00451   444   NtUserRegisterClassExWOW  (1239896, 1239976, 1239960, 1239992, 0, 384, 0, ... ) == 0x810cc017
 00452   444   NtUserFindExistingCursorIcon  (1239444, 1239460, 1240028, ... ) == 0x10011
 00453   444   NtUserRegisterClassExWOW  (1239896, 1239976, 1239960, 1239992, 0, 384, 0, ... ) == 0x810cc019
 00454   444   NtUserFindExistingCursorIcon  (1239444, 1239460, 1240028, ... ) == 0x10013
 00455   444   NtUserRegisterClassExWOW  (1239896, 1239976, 1239960, 1239992, 0, 384, 0, ... ) == 0x810cc018
 00456   444   NtUserFindExistingCursorIcon  (1239448, 1239464, 1240032, ... ) == 0x10011
 00457   444   NtUserRegisterClassExWOW  (1239900, 1239980, 1239964, 1239996, 0, 384, 0, ... ) == 0x810cc01a
 00458   444   NtUserFindExistingCursorIcon  (1239444, 1239460, 1240028, ... ) == 0x10011
 00459   444   NtUserRegisterClassExWOW  (1239896, 1239976, 1239960, 1239992, 0, 384, 0, ... ) == 0x810cc01c
 00460   444   NtUserFindExistingCursorIcon  (1239448, 1239464, 1240032, ... ) == 0x10011
 00461   444   NtUserRegisterClassExWOW  (1239900, 1239980, 1239964, 1239996, 0, 384, 0, ... ) == 0x810cc01e
 00462   444   NtUserFindExistingCursorIcon  (1239444, 1239460, 1240028, ... ) == 0x10011
 00463   444   NtUserRegisterClassExWOW  (1239956, 1240036, 1240020, 1240052, 0, 384, 0, ... ) == 0x810cc01b
 00464   444   NtUserFindExistingCursorIcon  (1239440, 1239456, 1240024, ... ) == 0x10011
 00465   444   NtUserRegisterClassExWOW  (1239952, 1240032, 1240016, 1240048, 0, 384, 0, ... ) == 0x810cc068
 00466   444   NtUserFindExistingCursorIcon  (1239448, 1239464, 1240032, ... ) == 0x10011
 00467   444   NtUserRegisterClassExWOW  (1239900, 1239980, 1239964, 1239996, 0, 384, 0, ...
 00468   444   NtAllocateVirtualMemory  (-1, 5554176, 0, 4096, 4096, 32, ... 5554176, 4096, ) == 0x0
 00467   444   NtUserRegisterClassExWOW  ... ) == 0x810cc06a
 00469   444   NtCreateKey  (0x2001f, {24, 60, 0x40, 0, 0,  (0x2001f, {24, 60, 0x40, 0, 0, "SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings"}, 0, 0x0, 0, ... 76, 2, ) }, 0, 0x0, 0, ... 76, 2, ) == 0x0
 00470   444   NtQuerySystemInformation  (Basic, 44, ... {Unknown=0,MaximumIncrement=156250,PhysicalPageSize=0x1000,NumberOfPhysicalPages=0xff7c,LowestPhysicalPage=0x1,HighestPhysicalPage=0xffff,AllocationGranularity=0x10000,LowestUserAddress=0x10000,HighestUserAddress=0x7ffeffff,ActiveProcessors=1,NumberProcessors=1,}, 0x0, ) == 0x0
 00471   444   NtQuerySystemInformation  (Processor, 12, ... {system info, class 1, size 12}, 0x0, ) == 0x0
 00472   444   NtTestAlert  (... ) == 0x0
 00473   444   NtContinue  (1244464, 1, ...
 00474   444   NtSetInformationThread  (-2, Win32StartAddress(LpcReceivedMessageId), {StartAddress(LpcReceivedMsgId)=0x3142a000,}, 4, ... ) == 0x0
 00475   444   NtOpenKey  (0x20019, {24, 60, 0x40, 0, 0,  (0x20019, {24, 60, 0x40, 0, 0, "Software\Microsoft\Windows\CurrentVersion\Explorer"}, ... 68, ) }, ... 68, ) == 0x0
 00476   444   NtQueryValueKey  (68,  (68, "PINF", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00477   444   NtClose  (68, ... ) == 0x0
 00478   444   NtAllocateVirtualMemory  (-1, 1224704, 0, 4096, 4096, 260, ... 1224704, 4096, ) == 0x0
 00479   444   NtCreateFile  (0x80100080, {24, 0, 0x40, 0, 1234112,  (0x80100080, {24, 0, 0x40, 0, 1234112, "\??\u:\work\packed.exe"}, 0x0, 1, 1, 1, 96, 0, 0, ... 68, {status=0x0, info=1}, ) }, 0x0, 1, 1, 1, 96, 0, 0, ... 68, {status=0x0, info=1}, ) == 0x0
 00480   444   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\DOCUME~1\SRI-user\LOCALS~1\Temp"}, 1233828, ... ) }, 1233828, ... ) == 0x0
 00481   444   NtRequestWaitReplyPort  (24, {20, 48, new_msg, 0, 1354040, 1354584, 1234168, 0}  (24, {20, 48, new_msg, 0, 1354040, 1354584, 1234168, 0} "\0\0\0\0\2\0\1\0\225\0\0\0\0\0\0\0\215\26\365w" ... {20, 48, reply, 0, 436, 444, 1561, 0} "\0\0\0\0\2\0\1\0\1\0\0\0\0\0\0\0\1\0\0\0" )  ... {20, 48, reply, 0, 436, 444, 1561, 0}  (24, {20, 48, new_msg, 0, 1354040, 1354584, 1234168, 0} "\0\0\0\0\2\0\1\0\225\0\0\0\0\0\0\0\215\26\365w" ... {20, 48, reply, 0, 436, 444, 1561, 0} "\0\0\0\0\2\0\1\0\1\0\0\0\0\0\0\0\1\0\0\0" )  ) == 0x0
 00482   444   NtCreateFile  (0x80100080, {24, 0, 0x40, 0, 1233836,  (0x80100080, {24, 0, 0x40, 0, 1233836, "\??\C:\DOCUME~1\SRI-user\LOCALS~1\Temp\yka1.tmp"}, 0x0, 128, 0, 2, 96, 0, 0, ... 80, {status=0x0, info=2}, ) }, 0x0, 128, 0, 2, 96, 0, 0, ... 80, {status=0x0, info=2}, ) == 0x0
 00483   444   NtClose  (80, ... ) == 0x0
 00484   444   NtCreateFile  (0xc0100080, {24, 0, 0x40, 0, 1234112,  (0xc0100080, {24, 0, 0x40, 0, 1234112, "\??\C:\DOCUME~1\SRI-user\LOCALS~1\Temp\yka1.tmp"}, 0x0, 128, 1, 5, 96, 0, 0, ... }, 0x0, 128, 1, 5, 96, 0, 0, ...
 00485   444   NtClose  (-2147482032, ... ) == 0x0
 00484   444   NtCreateFile  ... 80, {status=0x0, info=3}, ) == 0x0
 00486   444   NtSetInformationFile  (68, 1234204, 8, Position, ... {status=0x0, info=0}, ) == 0x0
 00487   444   NtReadFile  (68, 0, 0, 0, 10240, 0x0, 0, ... {status=0x0, info=10240},  (68, 0, 0, 0, 10240, 0x0, 0, ... {status=0x0, info=10240}, "\352\27v\1\245M&\1\243M)\1X\262&\1\37M&\1\247M&\1\347M<\1\247M&\1\247M&\1\247M&\1\247M&\1\247M&\1\247M&\1\247M&\1\247M&\1\247O&\1\35]&\17\270\371/\314\206\365'Mjl\266\221\363%Or\207=Tn\300?Gl\207 Sr\323mDd\207?So\2078He\302?\6V\316#\253\252G\26\247M&\1\247M&\1\247M&\1\247M&\1\247M&\1\247M&\1\247M&\1\247M&\1\247M&\1\247M&\1\247M&\1\247M&\1\247M&\1\247M&\1\247M&\1\247M&\1\247M&\1\247M&\1\247M&\1\247M&\1\247M&\1\247M&\1\247M&\1\247M&\1\247M&\1\247M&\1\247M&\1\247M&\1\247M&\1\247M&\1\247M&\1\247M&\1\247M&\1\247M&\1\247M&\1\247M&\1\247M&\1\247M&\1\247M&\1\247M&\1\247M&\1\247M&\1\247M&\1\247M&\1\247M&\1\247M&\1\247M&\1\247M&\1\247M&\1\247M&\1\247M&\1\247M&\1\247M&\1\247M&\1\247M&\1\247M&\1\247M&\1\247M&\1\247M&\1\247M&\1\247M&\1\247M&\1\247M&\1\247M&\1\247M&\1\247M&\1\247M&\1\247M&\1\247M&\1\247M&\1\247M&\1\247M&\1\247M&\1\247M&\1\247M&\1\247M&\1\247M&\1\247M&\1\247M&\1\247M&\1\247M&\1\247M&\1\247M&\1\247M&\1\247M&\1\247M&\1\247M&\1\247M&\1\247M&\1\247M&\1\247M&\1\247M&\1\247M&\1\247M&\1\247M&\1", ) , ) == 0x0
 00488   444   NtWriteFile  (80, 0, 0, 0,  (80, 0, 0, 0, "MZP\0\2\0\0\0\4\0\17\0\377\377\0\0\270\0\0\0\0\0\0\0@\0\32\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\272\20\0\16\37\264\11\315!\270\1L\315!\220\220This program must be run under Win32\15\12$7\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0", 10240, 0x0, 0, ... {status=0x0, info=10240}, ) , 10240, 0x0, 0, ... {status=0x0, info=10240}, ) == 0x0
 00489   444   NtReadFile  (68, 0, 0, 0, 10240, 0x0, 0, ... {status=0x0, info=10240},  (68, 0, 0, 0, 10240, 0x0, 0, ... {status=0x0, info=10240}, "\362E\20\35\310qkD\310?_-\7 G\11\227N\247\6o\205@\330\305\215g\305o\16\356=\245\1T\335O\274LE\315-w\270\243VZ\376\201\217~|"\342(E\374\345\356\271/\34Y\301\301\306v\0\367\333Mf\306Of\314\333r'\3\31\11\13\33$\217#SRxw\20-\224\25d\207\375\214J\331%e-O\357\364\304\244t\316\352\371\32\372\201\240\312\246\303pFQB\213\\4\300\266M,_\3721(9\352\334\3770\372V0\307\335\376\224\34\377v\13\13Z\255P\350EB\2027I."k\237\12\211\227\213]\23\346C\307\310_\13\16HC{=\36\243\202\326gw\261\2222\241\216\307\14\226\317\3365y!d\267\367)\326Y\231{\364!c\177aVo\311\356\256\353cWQN\11&)\246\221\246\25$w\14\13\327H#\35\314\346\360\13O\35\364=\201=\210\11\3619S\311\342\3133\213z\200\312\11aMA($t\336\250\i\354\233\345\16\37S\275\15q\3457{\27\14,\14\22\325\16\344\353]\356X#,ki\276\364\347@t\315\367\336\246\220\12\337\310\335>\234\2\371\20stg\306{\305l\24\260\356+\216\216\307\13\375\222G\367C\307\225\237\205u\09\345\21\224\201\231\16\216\24\376\343\222Qw\1\251\6M\230l\310u\245y\377 \26\212\23\306lY\212i!\221\330\205\6_\276\256\15\226\263\262\331\13\2135\32\230\206UB\361s\334^\\232c\205\260s(\301\355\246\226*q\255\223\325Q\300.\356\267\271\17\5\351\336\245-4\316\373\302'C\25)\10z\220\26\3\245-f\25\5\216\210\345\25\353\203\26\301\325s\36\205\16#\\224\0KR\227\23\303\5\356\325\240\211|\275\302\344\301%\254F=`!\201\240Z\13\275\373\16", ) \342(E\374\345\356\271/\34Y\301\301\306v\0\367\333Mf\306Of\314\333r'\3\31\11\13\33$\217#SRxw\20-\224\25d\207\375\214J\331%e-O\357\364\304\244t\316\352\371\32\372\201\240\312\246\303pFQB\213\\4\300\266M,_\3721(9\352\334\3770\372V0\307\335\376\224\34\377v\13\13Z\255P\350EB\2027I. (68, 0, 0, 0, 10240, 0x0, 0, ... {status=0x0, info=10240}, "\362E\20\35\310qkD\310?_-\7 G\11\227N\247\6o\205@\330\305\215g\305o\16\356=\245\1T\335O\274LE\315-w\270\243VZ\376\201\217~|"\342(E\374\345\356\271/\34Y\301\301\306v\0\367\333Mf\306Of\314\333r'\3\31\11\13\33$\217#SRxw\20-\224\25d\207\375\214J\331%e-O\357\364\304\244t\316\352\371\32\372\201\240\312\246\303pFQB\213\\4\300\266M,_\3721(9\352\334\3770\372V0\307\335\376\224\34\377v\13\13Z\255P\350EB\2027I."k\237\12\211\227\213]\23\346C\307\310_\13\16HC{=\36\243\202\326gw\261\2222\241\216\307\14\226\317\3365y!d\267\367)\326Y\231{\364!c\177aVo\311\356\256\353cWQN\11&)\246\221\246\25$w\14\13\327H#\35\314\346\360\13O\35\364=\201=\210\11\3619S\311\342\3133\213z\200\312\11aMA($t\336\250\i\354\233\345\16\37S\275\15q\3457{\27\14,\14\22\325\16\344\353]\356X#,ki\276\364\347@t\315\367\336\246\220\12\337\310\335>\234\2\371\20stg\306{\305l\24\260\356+\216\216\307\13\375\222G\367C\307\225\237\205u\09\345\21\224\201\231\16\216\24\376\343\222Qw\1\251\6M\230l\310u\245y\377 \26\212\23\306lY\212i!\221\330\205\6_\276\256\15\226\263\262\331\13\2135\32\230\206UB\361s\334^\\232c\205\260s(\301\355\246\226*q\255\223\325Q\300.\356\267\271\17\5\351\336\245-4\316\373\302'C\25)\10z\220\26\3\245-f\25\5\216\210\345\25\353\203\26\301\325s\36\205\16#\\224\0KR\227\23\303\5\356\325\240\211|\275\302\344\301%\254F=`!\201\240Z\13\275\373\16", ) , ) == 0x0
 00490   444   NtWriteFile  (80, 0, 0, 0,  (80, 0, 0, 0, "U\106\34o\301\21\0\12^]|\168M\221\3311]\33\26\31\220\220\330\225\273\262P\12\254\27\213QO\10d\203\220\4\10#\314\322,\2100\306{\22A\16\341\311\370F(I\3446\33\37\4\317\360f\320\374\2643\6\303\341\151\202\3704\336lB\266Pd\360X>6\322 \3042GW\310\204\310\257L.qP\351D\0(\1\334\200\24\203:*\12p\5\5\34k\253\326\12\350P\322<&p\256\10Vtu\310E\206\25\212\335\315\354\10\306\0g)\2039\370\251\373$\312\232BC9R\32@W\344\22061\15\213A4\324\251\251\315\I\25\5-\314$\230\365@\15R\314P\223\200\221\255\222\356\334\231\321$\370\245}Uu\300\213]\304\313Y\226\357\214\303\250\306\254\260\264FP\16\341\2248\310S\1\236\2507\225&\324(\217\263\263\305\223\366:'\250\241\0\276mo8\203xXm0\213\264\213JX-$\7\220\177\310 ^\31\343+\227\24\377\377\12,x<\231!\30d\360\324\221x]=.\243\261\324e\347\354\1\333\14p\12\336\363Pgc\310\266\36B#\350y\350\135i\266\344&\344X\17\11\335\3350\2\2`@\3\222H\250\211BX;2$[\347\324\324S\243\17\204\21\262\1\354\37\261\22dH\310\324\7\304Z\274e\251\347$\13\13\33a\206\314\206[\254\360\335\17", 10240, 0x0, 0, ... {status=0x0, info=10240}, ) \301\21\0\12^]|\168M\221\3311]\33\26\31\220\220\330\225\273\262P\12\254\27\213QO\10d\203\220\4\10#\314\322,\2100\306{\22A\16\341\311\370F(I\3446\33\37\4\317\360f\320\374\2643\6\303\341\151\202\3704\336lB\266Pd\360X>6\322 \3042GW\310\204\310\257L.qP\351D\0(\1\334\200\24\203:*\12p\5\5\34k\253\326\12\350P\322<&p\256\10Vtu\310E\206\25\212\335\315\354\10\306\0g)\2039\370\251\373$\312\232BC9R\32@W\344\22061\15\213A4\324\251\251\315\I\25\5-\314$\230\365@\15R\314P\223\200\221\255\222\356\334\231\321$\370\245}Uu\300\213]\304\313Y\226\357\214\303\250\306\254\260\264FP\16\341\2248\310S\1\236\2507\225&\324(\217\263\263\305\223\366:'\250\241\0\276mo8\203xXm0\213\264\213JX-$\7\220\177\310 ^\31\343+\227\24\377\377\12,x<\231!\30d\360\324\221x]=.\243\261\324e\347\354\1\333\14p\12\336\363Pgc\310\266\36B#\350y\350\135i\266\344&\344X\17\11\335\3350\2\2`@\3\222H\250\211BX;2$[\347\324\324S\243\17\204\21\262\1\354\37\261\22dH\310\324\7\304Z\274e\251\347$\13\13\33a\206\314\206[\254\360\335\17", 10240, 0x0, 0, ... {status=0x0, info=10240}, ) == 0x0
 00491   444   NtReadFile  (68, 0, 0, 0, 10240, 0x0, 0, ... {status=0x0, info=10240},  (68, 0, 0, 0, 10240, 0x0, 0, ... {status=0x0, info=10240}, "p\217-Y\37_3v\226G*It\0\345\31\355\333j\341\362\350\224I\247\346\264\344\27\310\221|\277\11f\220B\335C[\303\21~X\251\26\274\1\365\6EU\367)\37e\274/27\303-\267\3447(L \313%w\227\344\333T\15\323=\12\34n-\355{\333x^A\215\314\276B\2671<\300\330\310\262\234<-A\21\11=\235\362\236\346p$\265\305*8\214\3116\275\240\306\2408=\14\252\15/"f\322X\272\14\277\217\307a\11\235\235R8Q\13\2352\15\4\363\257?\221q\5^!c\\20I`5T\139\307\21\172\271\11\2412\4\253\3#?\243\332lW\227;\204\311M\313\33\367\242F\246J\347\25\345\125\312s>\254=\345j\10`\315\220\33\251\356\256\223\205'\366\246c\336\26C\13Gm\324\312H\30C\316uU\3258C\0\211N\256\5\310\270\27\323-\350E\267O\21\305"3\255v\234|\357\213\357\16b\11[\262d\266\370M.\214\322B\255}\257J\27\301-C\35K[8\221\177\6\26\250]\255\277:\17Q\216\371\236\3568\304n\374\346\327\370\260\15\2\17\246t\336\177z\350A\4\212\211\35\201\237j)L\243\26\335\303\325\251\243\256\310\372\231\203\323\342\257\320\256,-\213\340\307\14\200W\37\310\357F\262\371~|\307~b3\307x\13"\26un\31318\12\261U\251\37\252t\322\354\252\263~\33'\252\3718l\261\221\1\350\>\32\322\241\313\354\221O\227!0\246\356>'\250\371;\21\215\313\354\275\246\304\34-!<\220\313Ud\3045\262\344\10_\252mtW\302\205;,r\225\5'r#\267\372\356!\202v\2'\266\250\277\331\254\15\372l\21\335J\330\260\325FQ\14\250\362\357\2\355\221\214\4\233\212\331\320)\227\331CB\303\37\0", ) f\322X\272\14\277\217\307a\11\235\235R8Q\13\2352\15\4\363\257?\221q\5^!c\\20I`5T\139\307\21\172\271\11\2412\4\253\3#?\243\332lW\227;\204\311M\313\33\367\242F\246J\347\25\345\125\312s>\254=\345j\10`\315\220\33\251\356\256\223\205'\366\246c\336\26C\13Gm\324\312H\30C\316uU\3258C\0\211N\256\5\310\270\27\323-\350E\267O\21\305 (68, 0, 0, 0, 10240, 0x0, 0, ... {status=0x0, info=10240}, "p\217-Y\37_3v\226G*It\0\345\31\355\333j\341\362\350\224I\247\346\264\344\27\310\221|\277\11f\220B\335C[\303\21~X\251\26\274\1\365\6EU\367)\37e\274/27\303-\267\3447(L \313%w\227\344\333T\15\323=\12\34n-\355{\333x^A\215\314\276B\2671<\300\330\310\262\234<-A\21\11=\235\362\236\346p$\265\305*8\214\3116\275\240\306\2408=\14\252\15/"f\322X\272\14\277\217\307a\11\235\235R8Q\13\2352\15\4\363\257?\221q\5^!c\\20I`5T\139\307\21\172\271\11\2412\4\253\3#?\243\332lW\227;\204\311M\313\33\367\242F\246J\347\25\345\125\312s>\254=\345j\10`\315\220\33\251\356\256\223\205'\366\246c\336\26C\13Gm\324\312H\30C\316uU\3258C\0\211N\256\5\310\270\27\323-\350E\267O\21\305"3\255v\234|\357\213\357\16b\11[\262d\266\370M.\214\322B\255}\257J\27\301-C\35K[8\221\177\6\26\250]\255\277:\17Q\216\371\236\3568\304n\374\346\327\370\260\15\2\17\246t\336\177z\350A\4\212\211\35\201\237j)L\243\26\335\303\325\251\243\256\310\372\231\203\323\342\257\320\256,-\213\340\307\14\200W\37\310\357F\262\371~|\307~b3\307x\13"\26un\31318\12\261U\251\37\252t\322\354\252\263~\33'\252\3718l\261\221\1\350\>\32\322\241\313\354\221O\227!0\246\356>'\250\371;\21\215\313\354\275\246\304\34-!<\220\313Ud\3045\262\344\10_\252mtW\302\205;,r\225\5'r#\267\372\356!\202v\2'\266\250\277\331\254\15\372l\21\335J\330\260\325FQ\14\250\362\357\2\355\221\214\4\233\212\331\320)\227\331CB\303\37\0", ) \26un\31318\12\261U\251\37\252t\322\354\252\263~\33'\252\3718l\261\221\1\350\>\32\322\241\313\354\221O\227!0\246\356>'\250\371;\21\215\313\354\275\246\304\34-!<\220\313Ud\3045\262\344\10_\252mtW\302\205;,r\225\5'r#\267\372\356!\202v\2'\266\250\277\331\254\15\372l\21\335J\330\260\325FQ\14\250\362\357\2\355\221\214\4\233\212\331\320)\227\331CB\303\37\0", ) == 0x0
 00492   444   NtWriteFile  (80, 0, 0, 0,  (80, 0, 0, 0, "\327\302\13X\270\22\25w1\12\14H\323M\303\30J\226L\340U\245\262H\0\253\222\345\260\205\267}\30D@\221\345\220eZd\XY\16[\232\0RKcTPd9d\33b\246d`\221\345\220ej!lhQ\226C\226r\14tp,\35\311`\313z|5x@*\201\230C\20|\32\301\177\205\224\235\233`g\20\256p\273\3639\253V%\22\210\149+\204\20\274\7\213\2069\232A\214\14\210o@\323\377\367*\276(\212G\10:\320t9\366F\2733\252I\325\256\230\334W\4\371lE]\267\4F4\363F\37\306\266B\24\270\256\354\24\5\14N\5>\4\227JV0v\242\310\352\206=\366\5\13\200K@X\303\13\222\207U?\13p\303k\257-\353\221\274\344\310\2574\310\1\367\1.\370\27\344Fals\207n\31\344\203STrue\1.\3\210\4o\3651\322\212P\26D\20\27\304\205~\213w;1\311\212HCD\10\374\377B\267_\0\10\215u\17\213|\10\71\300\212\16;J\374u\267~\241[\216\\12\362\34\16\366\303\337\237Iu\342o[\253\361\371\27@$\16\19\370~\335\245g\5-\304;\2008'\17M\4[\373\302r\344\205\257o\267\277\202t\257\211\321\11a\13\212G\212*\201\360R\356\356\341\377\337\177\333\212Xc\224\212^\12\205[Sol|\36\13\26\30\217\36\159\364\355\15\376X\32\200\347\3379\313\374\267\0O\21\30\33u\354\355\3556\2\261 \227\353\310?\200\345\337:\266\300\355\355\32\353\342\35\212l\32\221l\30B\305\222\377\302\11\370\347Ku\360\217\243:\213?\263\4\200?\5\266]\243\7\203\321O\1\267\17\362\377\255\252\267J\20z\7\376\261r\13w\15\17\277\311\3J\334\252\5<\307\377\321\216\332\377B\345\2169\1", 10240, 0x0, 0, ... {status=0x0, info=10240}, ) , 10240, 0x0, 0, ... {status=0x0, info=10240}, ) == 0x0
 00493   444   NtReadFile  (68, 0, 0, 0, 10240, 0x0, 0, ... {status=0x0, info=10240},  (68, 0, 0, 0, 10240, 0x0, 0, ... {status=0x0, info=10240}, "1\246\333\264'\232\212g\364\304\243\7\261\315\254\264\320\213\243\226\330CQ\20\301\362\222\23\362AC\210\256\355\177\7\24\212G\34\227\361:\211\236\271\241-\300\263?\255M\222\275\300ca\262\326g\3461\276\24\2755\246\212$\317#\357y\270.\332\22u\257\27"\311:\311\260\245\214\223\327u\304\26u\365\362\37\2\360\362Et#\340\315\3404/\301c\12\357\317\215\201\11\307*'\216\315\27\255\232\251\315\13\272FQ\267Q\313\333\12\350\307s\372\260\34cw\222+\347h\227\314\3020`\21P\215\2025\12\3\255\15\244\33#F\336C\0[\246z\222\3736\30i\323V\352\240i\362\351\224\315\260u$\17\1 \317\24fz4O\253\4\263\253\345\376\212`\312O\301\354\261\361\301\352\6\365\262\313\206\267sG\322\365w\2076\241\205\35\226\327\212\224!B[\0I\1\234\35\32.\213l\5\206\267:\329\274?\356\311\233u\329\216l\0\204\0\252i\211\240\226\35v\374C\262\340\246A\206\347f\320&\232\2577 \242\274O\10-b\212p\273\15|0{Q\2176\361\366\300\264a$[2\311C\21\264\247\7\376iYW\246:\31\373\355\215`o\3766\34\224\204r\160\307=\1 \241>\0e=\377\23\5C\345_\230L\324\205\374\312\15\270\362\263\322\14\22\273"\323\332\273c\377\320\33\376\352\215\\12\333\245\13\332\27y0\25;\2330-a3Tl\32\251\327NN6\11{\24\257i\4\17\246Qg\341\307\332D\365\344\3074\21S\27\200\267\241DI\20_\275\212\1\277\255"T\211D\17+\256I\201\27\257\35J\252\33\2715\5l\305\1\246\345K\14IO\325\3258~\3\223kRK\326\355I&t\320t\15\336\235eO\22\1\364:X\351\330=M\331\13]9\323_\30{9", ) \311:\311\260\245\214\223\327u\304\26u\365\362\37\2\360\362Et#\340\315\3404/\301c\12\357\317\215\201\11\307*'\216\315\27\255\232\251\315\13\272FQ\267Q\313\333\12\350\307s\372\260\34cw\222+\347h\227\314\3020`\21P\215\2025\12\3\255\15\244\33#F\336C\0[\246z\222\3736\30i\323V\352\240i\362\351\224\315\260u$\17\1 \317\24fz4O\253\4\263\253\345\376\212`\312O\301\354\261\361\301\352\6\365\262\313\206\267sG\322\365w\2076\241\205\35\226\327\212\224!B[\0I\1\234\35\32.\213l\5\206\267:\329\274?\356\311\233u\329\216l\0\204\0\252i\211\240\226\35v\374C\262\340\246A\206\347f\320&\232\2577 \242\274O\10-b\212p\273\15|0{Q\2176\361\366\300\264a$[2\311C\21\264\247\7\376iYW\246:\31\373\355\215`o\3766\34\224\204r\160\307=\1 \241>\0e=\377\23\5C\345_\230L\324\205\374\312\15\270\362\263\322\14\22\273 (68, 0, 0, 0, 10240, 0x0, 0, ... {status=0x0, info=10240}, "1\246\333\264'\232\212g\364\304\243\7\261\315\254\264\320\213\243\226\330CQ\20\301\362\222\23\362AC\210\256\355\177\7\24\212G\34\227\361:\211\236\271\241-\300\263?\255M\222\275\300ca\262\326g\3461\276\24\2755\246\212$\317#\357y\270.\332\22u\257\27"\311:\311\260\245\214\223\327u\304\26u\365\362\37\2\360\362Et#\340\315\3404/\301c\12\357\317\215\201\11\307*'\216\315\27\255\232\251\315\13\272FQ\267Q\313\333\12\350\307s\372\260\34cw\222+\347h\227\314\3020`\21P\215\2025\12\3\255\15\244\33#F\336C\0[\246z\222\3736\30i\323V\352\240i\362\351\224\315\260u$\17\1 \317\24fz4O\253\4\263\253\345\376\212`\312O\301\354\261\361\301\352\6\365\262\313\206\267sG\322\365w\2076\241\205\35\226\327\212\224!B[\0I\1\234\35\32.\213l\5\206\267:\329\274?\356\311\233u\329\216l\0\204\0\252i\211\240\226\35v\374C\262\340\246A\206\347f\320&\232\2577 \242\274O\10-b\212p\273\15|0{Q\2176\361\366\300\264a$[2\311C\21\264\247\7\376iYW\246:\31\373\355\215`o\3766\34\224\204r\160\307=\1 \241>\0e=\377\23\5C\345_\230L\324\205\374\312\15\270\362\263\322\14\22\273"\323\332\273c\377\320\33\376\352\215\\12\333\245\13\332\27y0\25;\2330-a3Tl\32\251\327NN6\11{\24\257i\4\17\246Qg\341\307\332D\365\344\3074\21S\27\200\267\241DI\20_\275\212\1\277\255"T\211D\17+\256I\201\27\257\35J\252\33\2715\5l\305\1\246\345K\14IO\325\3258~\3\223kRK\326\355I&t\320t\15\336\235eO\22\1\364:X\351\330=M\331\13]9\323_\30{9", ) T\211D\17+\256I\201\27\257\35J\252\33\2715\5l\305\1\246\345K\14IO\325\3258~\3\223kRK\326\355I&t\320t\15\336\235eO\22\1\364:X\351\330=M\331\13]9\323_\30{9", ) == 0x0
 00494   444   NtWriteFile  (80, 0, 0, 0,  (80, 0, 0, 0, "\226\353\375\265\200\327\254fS\211\205\6\26\200\212\265w\306\205\227\177\16w\21f\277\264\22U\14e\211\11\240Y\6\263\307a\350\274\34\210\264{\237\240\212\215\225>\12\0\264\274g.G\263q*\3000\31Y\2334\1\307\2\316\204\242_\271\211\2274t\10Z\4\310\235\204\226\244+\336\361tc[S\364UR$\361U\10R"G\200\3065\210\214E\13H\202\253\200\256\212\14&)\2001\254=\344\353\12\35\13w\266\366\206\375\13O\212U\373\27QEv5f\301i0\201\3441\307\v\214%x,\2\12@\202\32\204\13\370B\247\26\200{5\266\20\31\316\236p\353\7$\324\3503\200\226t\203B'!hY@{\223\2\215\5\24\346\303\377--\354Nf\241\227\360f\247 \364\25\206\240\266\324\12\364\364\320\312\20\240"P\260\326-\331\7C\374Mo\0;P\16\1\34A\340`\227b\364C\212\22\20\364Z\246\266\6\11o\21\370\360\254\0\30\340\4U.\11)*\11\4\247\26\10Pl\253\274\364\23\4\313\210'\247B\6*H\350\230\3639\331N\265j\365\6\360\354\356kR\321\323@\370\234\302\24\0Sw~\350\177pk\330\254\20\37\322\370U]8", 10240, 0x0, 0, ... {status=0x0, info=10240}, ) G\200\3065\210\214E\13H\202\253\200\256\212\14&)\2001\254=\344\353\12\35\13w\266\366\206\375\13O\212U\373\27QEv5f\301i0\201\3441\307\v\214%x,\2\12@\202\32\204\13\370B\247\26\200{5\266\20\31\316\236p\353\7$\324\3503\200\226t\203B'!hY@{\223\2\215\5\24\346\303\377--\354Nf\241\227\360f\247 \364\25\206\240\266\324\12\364\364\320\312\20\240 (80, 0, 0, 0, "\226\353\375\265\200\327\254fS\211\205\6\26\200\212\265w\306\205\227\177\16w\21f\277\264\22U\14e\211\11\240Y\6\263\307a\350\274\34\210\264{\237\240\212\215\225>\12\0\264\274g.G\263q*\3000\31Y\2334\1\307\2\316\204\242_\271\211\2274t\10Z\4\310\235\204\226\244+\336\361tc[S\364UR$\361U\10R"G\200\3065\210\214E\13H\202\253\200\256\212\14&)\2001\254=\344\353\12\35\13w\266\366\206\375\13O\212U\373\27QEv5f\301i0\201\3441\307\v\214%x,\2\12@\202\32\204\13\370B\247\26\200{5\266\20\31\316\236p\353\7$\324\3503\200\226t\203B'!hY@{\223\2\215\5\24\346\303\377--\354Nf\241\227\360f\247 \364\25\206\240\266\324\12\364\364\320\312\20\240"P\260\326-\331\7C\374Mo\0;P\16\1\34A\340`\227b\364C\212\22\20\364Z\246\266\6\11o\21\370\360\254\0\30\340\4U.\11)*\11\4\247\26\10Pl\253\274\364\23\4\313\210'\247B\6*H\350\230\3639\331N\265j\365\6\360\354\356kR\321\323@\370\234\302\24\0Sw~\350\177pk\330\254\20\37\322\370U]8", 10240, 0x0, 0, ... {status=0x0, info=10240}, ) \16\1\34A\340`\227b\364C\212\22\20\364Z\246\266\6\11o\21\370\360\254\0\30\340\4U.\11)*\11\4\247\26\10Pl\253\274\364\23\4\313\210'\247B\6*H\350\230\3639\331N\265j\365\6\360\354\356kR\321\323@\370\234\302\24\0Sw~\350\177pk\330\254\20\37\322\370U]8", 10240, 0x0, 0, ... {status=0x0, info=10240}, ) == 0x0
 00495   444   NtReadFile  (68, 0, 0, 0, 10240, 0x0, 0, ... {status=0x0, info=10240},  (68, 0, 0, 0, 10240, 0x0, 0, ... {status=0x0, info=10240}, "\270"\344"\206]\346\10\37a\364\344\303B\217x\301\217\247\306\347/=\340\271o\244}\246E\244/\377[3'\204\346\316z\346\377\345\271\251A\236$\346\361\367\272.\25\0vq\300V\31\260\365\227\262`G\257\35n_[\315\341\367-!\257\33\275\3001\345\374\232\312@\300z+M\310X}':\335{e!\360\322\230\213\211\245I\341\\247\363\7\265A\2457y\235+9`\27\205F\314SP\332\253\362\337\14\263\15Ms\314\331\332\36\323\222;\3^\323Rq\306\251F$B\202e\2749LL\311\304\5nH\4\27\204PXK +Q\211\20\312\270\320\1^\352\232\374\234\371\2679/G{UH\302\257\353\1\24{S.E\330\325\313\243\304m\223\346g\15\237\15\224\14\363\223\333L\230w/l\2411\23\203V\303\276\204op\360\36\35\371\24\222\236\322\4\202:\342\315S?\303 \376B\363;\22K\363\216\256<\247G\314\5\27w\6l\235$\235\302\301\204N+\221T\363\240W\302\16\31\222\375\215\367\225\225B%9$+Y\220\217\1i+~\375\264\274\315\3121\220\204\322\247\276F\2564\15\352\20\30\221cW\264\257[6\215MZ\257\343\213\200\373p\317\345\226%\343\370o\5\247X\256\366\255\23v\344\237\326J\363\265=c\345\367\365?G=\301-\255"-\257\25q\315\242\34\315\11\22<\241-\5G|\300\200I\11\362\252\3\341\363\315!\317/\261\212+L'Y\37\317\203H\253\24\301\363\265\255E\3u\335\302h\253#\306\15UH#\332\246W\306\263\250\312\273\331\255\305\35u\225\263\230k\255\324\306\341\365\341\35\204\32:\200\20\33l\226~\27\204\260\31\253\333u}\361\357g\356'\374nh\264W1\216\360\237}\371\316p0\310\225\225\264\214\261\201\17\342\254\7n\6", ) \344 (68, 0, 0, 0, 10240, 0x0, 0, ... {status=0x0, info=10240}, "\270"\344"\206]\346\10\37a\364\344\303B\217x\301\217\247\306\347/=\340\271o\244}\246E\244/\377[3'\204\346\316z\346\377\345\271\251A\236$\346\361\367\272.\25\0vq\300V\31\260\365\227\262`G\257\35n_[\315\341\367-!\257\33\275\3001\345\374\232\312@\300z+M\310X}':\335{e!\360\322\230\213\211\245I\341\\247\363\7\265A\2457y\235+9`\27\205F\314SP\332\253\362\337\14\263\15Ms\314\331\332\36\323\222;\3^\323Rq\306\251F$B\202e\2749LL\311\304\5nH\4\27\204PXK +Q\211\20\312\270\320\1^\352\232\374\234\371\2679/G{UH\302\257\353\1\24{S.E\330\325\313\243\304m\223\346g\15\237\15\224\14\363\223\333L\230w/l\2411\23\203V\303\276\204op\360\36\35\371\24\222\236\322\4\202:\342\315S?\303 \376B\363;\22K\363\216\256<\247G\314\5\27w\6l\235$\235\302\301\204N+\221T\363\240W\302\16\31\222\375\215\367\225\225B%9$+Y\220\217\1i+~\375\264\274\315\3121\220\204\322\247\276F\2564\15\352\20\30\221cW\264\257[6\215MZ\257\343\213\200\373p\317\345\226%\343\370o\5\247X\256\366\255\23v\344\237\326J\363\265=c\345\367\365?G=\301-\255"-\257\25q\315\242\34\315\11\22<\241-\5G|\300\200I\11\362\252\3\341\363\315!\317/\261\212+L'Y\37\317\203H\253\24\301\363\265\255E\3u\335\302h\253#\306\15UH#\332\246W\306\263\250\312\273\331\255\305\35u\225\263\230k\255\324\306\341\365\341\35\204\32:\200\20\33l\226~\27\204\260\31\253\333u}\361\357g\356'\374nh\264W1\216\360\237}\371\316p0\310\225\225\264\214\261\201\17\342\254\7n\6", ) -\257\25q\315\242\34\315\11\22<\241-\5G|\300\200I\11\362\252\3\341\363\315!\317/\261\212+L'Y\37\317\203H\253\24\301\363\265\255E\3u\335\302h\253#\306\15UH#\332\246W\306\263\250\312\273\331\255\305\35u\225\263\230k\255\324\306\341\365\341\35\204\32:\200\20\33l\226~\27\204\260\31\253\333u}\361\357g\356'\374nh\264W1\216\360\237}\371\316p0\310\225\225\264\214\261\201\17\342\254\7n\6", ) == 0x0
 00496   444   NtWriteFile  (80, 0, 0, 0,  (80, 0, 0, 0, "\37o\302#!\20\300\11\270,\322\345d\17\251yf\302\201\307@b\33\341\36"\202|\1\10\202.X\26\25&#\253\350{A\262\303\270\16\14\270%A\274\321\273\211X&w\326\215p\30\27\270\261\263\307\12\211\34\311\22}\314F\272\13 \10V\233\301\226\250\332\233m\15\346{\214\0\356Y\332j\34\334\334(\7\361u\325\255\210\2\4\307]\0\276!\264\346\350\21x:f\37a\260\310`\315\364\35\374\252U\222*\262\252\0U\315~\2278\3225v%_t\37W\307\16\13\2C%(\2328\353\1\357\305\242#n\5\260\311vY\354m\15P.]\354\271wLx\353=\261\272\370\20t\11F\334\30n\303\10\246'\25\334\36\10D\177\230\355\242c \265\347\300@\271\143A\325\222|\1\276v\210!\2070\264\316p\302\31\311IqWS;\370\263_\24\237uI\244;E\200u>dm\330CTv4JT\303\210=\0\12\352\4\260: m:i\273\303f\311h*6\31\325\241\360\217(\305\260\253\3662\330d$\236i\15X7\302'h\2143\333\265\33\200\35407\311\364\246\31\13\2105\252\2476\316.q\265\10\26\20\214\352\27\211\342,\315\335qh\250\260$D\265I\4\0\25\210\367\12^P\3458\233l\362\22pE\344P\270\31F\232\214\13\254\205`\211\24\326\200\204\35jD4=\6`#F\333\215\246H\256\277\214\2F\276\353 hb\227\213\214\1\1X\270\202\245I\14Y\347\362\22\340c\2\322\220\344i\14n\340\14\362\5\5\333\1\32\340\262\17\207\235\330\12\210;t2\376\276j\12\231\340\340R\254;\205\275w\246\21\274!\260\177\260\311\226\30\14\226S|V\242A\357\200\261Hi\23\32\27\217W\322[\370i=\26\3112\330\222\215\26\314)\343\13JH\7", 10240, 0x0, 0, ... {status=0x0, info=10240}, ) \202|\1\10\202.X\26\25&#\253\350{A\262\303\270\16\14\270%A\274\321\273\211X&w\326\215p\30\27\270\261\263\307\12\211\34\311\22}\314F\272\13 \10V\233\301\226\250\332\233m\15\346{\214\0\356Y\332j\34\334\334(\7\361u\325\255\210\2\4\307]\0\276!\264\346\350\21x:f\37a\260\310`\315\364\35\374\252U\222*\262\252\0U\315~\2278\3225v%_t\37W\307\16\13\2C%(\2328\353\1\357\305\242#n\5\260\311vY\354m\15P.]\354\271wLx\353=\261\272\370\20t\11F\334\30n\303\10\246'\25\334\36\10D\177\230\355\242c \265\347\300@\271\143A\325\222|\1\276v\210!\2070\264\316p\302\31\311IqWS;\370\263_\24\237uI\244;E\200u>dm\330CTv4JT\303\210=\0\12\352\4\260: m:i\273\303f\311h*6\31\325\241\360\217(\305\260\253\3662\330d$\236i\15X7\302'h\2143\333\265\33\200\35407\311\364\246\31\13\2105\252\2476\316.q\265\10\26\20\214\352\27\211\342,\315\335qh\250\260$D\265I\4\0\25\210\367\12^P\3458\233l\362\22pE\344P\270\31F\232\214\13\254\205`\211\24\326\200\204\35jD4=\6`#F\333\215\246H\256\277\214\2F\276\353 hb\227\213\214\1\1X\270\202\245I\14Y\347\362\22\340c\2\322\220\344i\14n\340\14\362\5\5\333\1\32\340\262\17\207\235\330\12\210;t2\376\276j\12\231\340\340R\254;\205\275w\246\21\274!\260\177\260\311\226\30\14\226S|V\242A\357\200\261Hi\23\32\27\217W\322[\370i=\26\3112\330\222\215\26\314)\343\13JH\7", 10240, 0x0, 0, ... {status=0x0, info=10240}, ) == 0x0
 00497   444   NtReadFile  (68, 0, 0, 0, 10240, 0x0, 0, ... {status=0x0, info=10240},  (68, 0, 0, 0, 10240, 0x0, 0, ... {status=0x0, info=10240}, "\225\323v\21`mf\13\25\5\32\351yFp\35\257`\3\15\223\237'\325lj\322\376'\20\237@\205\303\275\274x\5-\251xk\324*`\23t!\273\206\330\343\345\370\366S;S\255\3727"\315\23\374Z(\333\301\2620,\243*\233JHv\315K\314\327\15T\323\25\21V\221mA\23\244i\3\20Ty\7$\10\331\246\340\342\235{O=\302C\376Cj_\337\265?\250\253"\R$\221\205G\266E\12\240\313I/\326\331\355KJ\24\244fvk!\15\313t\371\372\274Z\262\211\2\0"\324\357\324=\353\237u\244\270\354\20\212\3I\10\24\353O\236\177\251j\222\236!C\207\356%=\2hMv\12\304]\6j\266S\270\213\1m\316\12\334\22<\2\355\20\247y\263\211|\356\211uX\22\362k\207&\353\373M&\320)r\316\365K6R\373)mb,P\337K\237fJ\261p\334<\305\254C\364!\362xJ\25\250R\210\33\2633\376:\364i\216\344a\354\204\\242\332e\31)\211\313\201R\1\212"w\304\4\307\344J\243\372l~\317\0v\211\14d\247\14\242\13\361\351M\336\331\2625\210\243\213f-\247N\3A\312y$\3254a@\211:%B\243\243\234]\177\207\2557\361\330q\301;\375\345\\236Q\10R\370\253\226k\20\274W\352,\223\235X\5\310\246\12\214\343\266 \204u0$\301\214I5\352l\33\204k\362P8\15\323C"\216\36\0\13\26\267f\344\262\222:Q\5\331K\376\345of\354\14\221/\12?,B{\21\323P\222\2047\14\234\1~\365\2462\376\242\344\343Y\32g\37\223\310K\201|vOu\276\275*Q\272\177/&iu\357:\227\315z\311\247\371\26\367\206\355U1\24B\256\5\33`\252\205\220\36\36\26.\35\36\220&\347\267'\25N2\274", ) \315\23\374Z(\333\301\2620,\243*\233JHv\315K\314\327\15T\323\25\21V\221mA\23\244i\3\20Ty\7$\10\331\246\340\342\235{O=\302C\376Cj_\337\265?\250\253 (68, 0, 0, 0, 10240, 0x0, 0, ... {status=0x0, info=10240}, "\225\323v\21`mf\13\25\5\32\351yFp\35\257`\3\15\223\237'\325lj\322\376'\20\237@\205\303\275\274x\5-\251xk\324*`\23t!\273\206\330\343\345\370\366S;S\255\3727"\315\23\374Z(\333\301\2620,\243*\233JHv\315K\314\327\15T\323\25\21V\221mA\23\244i\3\20Ty\7$\10\331\246\340\342\235{O=\302C\376Cj_\337\265?\250\253"\R$\221\205G\266E\12\240\313I/\326\331\355KJ\24\244fvk!\15\313t\371\372\274Z\262\211\2\0"\324\357\324=\353\237u\244\270\354\20\212\3I\10\24\353O\236\177\251j\222\236!C\207\356%=\2hMv\12\304]\6j\266S\270\213\1m\316\12\334\22<\2\355\20\247y\263\211|\356\211uX\22\362k\207&\353\373M&\320)r\316\365K6R\373)mb,P\337K\237fJ\261p\334<\305\254C\364!\362xJ\25\250R\210\33\2633\376:\364i\216\344a\354\204\\242\332e\31)\211\313\201R\1\212"w\304\4\307\344J\243\372l~\317\0v\211\14d\247\14\242\13\361\351M\336\331\2625\210\243\213f-\247N\3A\312y$\3254a@\211:%B\243\243\234]\177\207\2557\361\330q\301;\375\345\\236Q\10R\370\253\226k\20\274W\352,\223\235X\5\310\246\12\214\343\266 \204u0$\301\214I5\352l\33\204k\362P8\15\323C"\216\36\0\13\26\267f\344\262\222:Q\5\331K\376\345of\354\14\221/\12?,B{\21\323P\222\2047\14\234\1~\365\2462\376\242\344\343Y\32g\37\223\310K\201|vOu\276\275*Q\272\177/&iu\357:\227\315z\311\247\371\26\367\206\355U1\24B\256\5\33`\252\205\220\36\36\26.\35\36\220&\347\267'\25N2\274", ) \324\357\324=\353\237u\244\270\354\20\212\3I\10\24\353O\236\177\251j\222\236!C\207\356%=\2hMv\12\304]\6j\266S\270\213\1m\316\12\334\22<\2\355\20\247y\263\211|\356\211uX\22\362k\207&\353\373M&\320)r\316\365K6R\373)mb,P\337K\237fJ\261p\334<\305\254C\364!\362xJ\25\250R\210\33\2633\376:\364i\216\344a\354\204\\242\332e\31)\211\313\201R\1\212 (68, 0, 0, 0, 10240, 0x0, 0, ... {status=0x0, info=10240}, "\225\323v\21`mf\13\25\5\32\351yFp\35\257`\3\15\223\237'\325lj\322\376'\20\237@\205\303\275\274x\5-\251xk\324*`\23t!\273\206\330\343\345\370\366S;S\255\3727"\315\23\374Z(\333\301\2620,\243*\233JHv\315K\314\327\15T\323\25\21V\221mA\23\244i\3\20Ty\7$\10\331\246\340\342\235{O=\302C\376Cj_\337\265?\250\253"\R$\221\205G\266E\12\240\313I/\326\331\355KJ\24\244fvk!\15\313t\371\372\274Z\262\211\2\0"\324\357\324=\353\237u\244\270\354\20\212\3I\10\24\353O\236\177\251j\222\236!C\207\356%=\2hMv\12\304]\6j\266S\270\213\1m\316\12\334\22<\2\355\20\247y\263\211|\356\211uX\22\362k\207&\353\373M&\320)r\316\365K6R\373)mb,P\337K\237fJ\261p\334<\305\254C\364!\362xJ\25\250R\210\33\2633\376:\364i\216\344a\354\204\\242\332e\31)\211\313\201R\1\212"w\304\4\307\344J\243\372l~\317\0v\211\14d\247\14\242\13\361\351M\336\331\2625\210\243\213f-\247N\3A\312y$\3254a@\211:%B\243\243\234]\177\207\2557\361\330q\301;\375\345\\236Q\10R\370\253\226k\20\274W\352,\223\235X\5\310\246\12\214\343\266 \204u0$\301\214I5\352l\33\204k\362P8\15\323C"\216\36\0\13\26\267f\344\262\222:Q\5\331K\376\345of\354\14\221/\12?,B{\21\323P\222\2047\14\234\1~\365\2462\376\242\344\343Y\32g\37\223\310K\201|vOu\276\275*Q\272\177/&iu\357:\227\315z\311\247\371\26\367\206\355U1\24B\256\5\33`\252\205\220\36\36\26.\35\36\220&\347\267'\25N2\274", ) \216\36\0\13\26\267f\344\262\222:Q\5\331K\376\345of\354\14\221/\12?,B{\21\323P\222\2047\14\234\1~\365\2462\376\242\344\343Y\32g\37\223\310K\201|vOu\276\275*Q\272\177/&iu\357:\227\315z\311\247\371\26\367\206\355U1\24B\256\5\33`\252\205\220\36\36\26.\35\36\220&\347\267'\25N2\274", ) == 0x0
 00498   444   NtWriteFile  (80, 0, 0, 0,  (80, 0, 0, 0, "2\236P\20\307 @\12\262H<\350\336\13V\34\10-%\144\322\1\324\313'\364\377\200]\271A"\216\233\275\337H\13\250\337&\362+\307^R \34\313\376\342B\265\320R\234\36\213\373\220o\353\22[\27\16\332f\377\26-\4g\275K\357;\353Jk\232+UtX7W6 g\22\3$%\21\3634!%\257\224\200\341E\320]N\232\217e\377\344'y\336\22r\216\252\205\21t%6\310a\267\342G\206\312\356b\360\330J\6l\25\3+Pj\206@\355u^\267\232[\25\304$\1\205\231\311\325\232\246\271t\3\365\312\21-No\11\263\246i\237\330\344L\2239le\206Ih\33\3\317\0P\13c\20 k\21\36\236\212\246 \350\13{_\32\3J]\201x\24\304Z\357.8~\23U&\241'L\266k'wdT\317R\6\20S\dKc\213\35\371J8+l\260\327\221\32\304\13\16\322 U5l\24\17\37\256\32\24~\330;S$\250\345\306\241\242]\5\227C\30\216\304\355\200\365L\254#\320\211"\306C\7\205\373\3133\351\1\321\304*e\0A\204\12V\244k\337~\377\23\211\4\306@,\0\3%@m4\2\324\223,f\210\235hd\242\4\321{~ \340\21\360\177<\347:Z\250z\237\366Et\371\14\333M\21\33\32\314-4\320~\4o\353,\215D\373\6\205\322}\2\300+\4\23\353\313V\242jU\35\36\14t\16\4\217\271M-\27\20+\302\2635ww\4~\6\330\344\310+\312\156b,>\213\17]\20t\35\264\205\220A\272\0\331\270\2003Y\357\302\342\376WA\364\205m\200\333;it\31\360\14P\352\11'\3168\311;0\200\\310\0\2640\366!\240s0\263\17\210\4\274-\214\2047S8\27\211P8\221\201\252\221&\262\3\24\275", 10240, 0x0, 0, ... {status=0x0, info=10240}, ) \216\233\275\337H\13\250\337&\362+\307^R \34\313\376\342B\265\320R\234\36\213\373\220o\353\22[\27\16\332f\377\26-\4g\275K\357;\353Jk\232+UtX7W6 g\22\3$%\21\3634!%\257\224\200\341E\320]N\232\217e\377\344'y\336\22r\216\252\205\21t%6\310a\267\342G\206\312\356b\360\330J\6l\25\3+Pj\206@\355u^\267\232[\25\304$\1\205\231\311\325\232\246\271t\3\365\312\21-No\11\263\246i\237\330\344L\2239le\206Ih\33\3\317\0P\13c\20 k\21\36\236\212\246 \350\13{_\32\3J]\201x\24\304Z\357.8~\23U&\241'L\266k'wdT\317R\6\20S\dKc\213\35\371J8+l\260\327\221\32\304\13\16\322 U5l\24\17\37\256\32\24~\330;S$\250\345\306\241\242]\5\227C\30\216\304\355\200\365L\254#\320\211 (80, 0, 0, 0, "2\236P\20\307 @\12\262H<\350\336\13V\34\10-%\144\322\1\324\313'\364\377\200]\271A"\216\233\275\337H\13\250\337&\362+\307^R \34\313\376\342B\265\320R\234\36\213\373\220o\353\22[\27\16\332f\377\26-\4g\275K\357;\353Jk\232+UtX7W6 g\22\3$%\21\3634!%\257\224\200\341E\320]N\232\217e\377\344'y\336\22r\216\252\205\21t%6\310a\267\342G\206\312\356b\360\330J\6l\25\3+Pj\206@\355u^\267\232[\25\304$\1\205\231\311\325\232\246\271t\3\365\312\21-No\11\263\246i\237\330\344L\2239le\206Ih\33\3\317\0P\13c\20 k\21\36\236\212\246 \350\13{_\32\3J]\201x\24\304Z\357.8~\23U&\241'L\266k'wdT\317R\6\20S\dKc\213\35\371J8+l\260\327\221\32\304\13\16\322 U5l\24\17\37\256\32\24~\330;S$\250\345\306\241\242]\5\227C\30\216\304\355\200\365L\254#\320\211"\306C\7\205\373\3133\351\1\321\304*e\0A\204\12V\244k\337~\377\23\211\4\306@,\0\3%@m4\2\324\223,f\210\235hd\242\4\321{~ \340\21\360\177<\347:Z\250z\237\366Et\371\14\333M\21\33\32\314-4\320~\4o\353,\215D\373\6\205\322}\2\300+\4\23\353\313V\242jU\35\36\14t\16\4\217\271M-\27\20+\302\2635ww\4~\6\330\344\310+\312\156b,>\213\17]\20t\35\264\205\220A\272\0\331\270\2003Y\357\302\342\376WA\364\205m\200\333;it\31\360\14P\352\11'\3168\311;0\200\\310\0\2640\366!\240s0\263\17\210\4\274-\214\2047S8\27\211P8\221\201\252\221&\262\3\24\275", 10240, 0x0, 0, ... {status=0x0, info=10240}, ) , 10240, 0x0, 0, ... {status=0x0, info=10240}, ) == 0x0
 00499   444   NtReadFile  (68, 0, 0, 0, 10240, 0x0, 0, ... {status=0x0, info=10240},  (68, 0, 0, 0, 10240, 0x0, 0, ... {status=0x0, info=10240}, "\245\276\376I\322\347\214\276o\14\4\211z\316\253\326\364\22\226\336\260\215\356e\265\24\16a\361H\222`\274_\233\376\261\235\305&\37\27\37\213\353L\331\201NG\250\374}\27\236\5\244\322l\214\201)\22>\240\270\253H\347\7S\337\370?\215\15{"$\24\327A\324MDD\\5`3\207\5\15\356\324e\246hQ\3\204\261\3443\205\17\235\30\341\250h4U\16\350V\257_Ri-\256\256O\235(O\324\12\265u<\235\306\31\354\177o\374\371S\373\37\324\273\373\360X\322\234;:\213o\265\334/\255^\1W\347t+\252\36\322,5n\224\214\332\265\203w\315\314\3741\323\216\256\1\335D*\255D\312\330!\207\3577\2E\220\370\200\275\254U\37M\323\351\222\246\356%|\3239H\242\351{\2\\3133t\17s\272\236#\270\20n\355\257\257do\254\377'\13M\204(H\220{\345\2\245\305\357\27WS\2367\373\235\371\333\271\20\212\33v\271\221-Tu\33\343\0\333\373\3\271\265\306(_4E\265\0\5='\362B\246\367\266k7*\265'.\236g#\331^\323B\257-*u\274`\331\256\243\317I\273\265\314e\5-\35a\350\356c\345\34L<)\271_\312\32\3457\265\336B\243\265\356\1\325h\336\371\302\215\305L_?\237j\203H\243\345\201\335\225=\320A\254\342Q\365\342\225\307\15\347q|\306\347!\333\15\342\31Ck\3676\203t\215\363\277\326\254R\340\312(\17\247\351*\352\236\2773I\242\376$)\257\316t\363\242O\1\351\273\307yS\346\375\237i\323;\356\247%\214\256l7\364N\215agg\25\357\236\265UW\210\3161\314O&\310\264\204\1\356\245e)`\241]\233n\247\2~`\366\234DI\267j\215\361\227\331B\25\233M`adena\200U\27\31", ) $\24\327A\324MDD\\5`3\207\5\15\356\324e\246hQ\3\204\261\3443\205\17\235\30\341\250h4U\16\350V\257_Ri-\256\256O\235(O\324\12\265u<\235\306\31\354\177o\374\371S\373\37\324\273\373\360X\322\234;:\213o\265\334/\255^\1W\347t+\252\36\322,5n\224\214\332\265\203w\315\314\3741\323\216\256\1\335D*\255D\312\330!\207\3577\2E\220\370\200\275\254U\37M\323\351\222\246\356%|\3239H\242\351{\2\\3133t\17s\272\236#\270\20n\355\257\257do\254\377'\13M\204(H\220{\345\2\245\305\357\27WS\2367\373\235\371\333\271\20\212\33v\271\221-Tu\33\343\0\333\373\3\271\265\306(_4E\265\0\5='\362B\246\367\266k7*\265'.\236g#\331^\323B\257-*u\274`\331\256\243\317I\273\265\314e\5-\35a\350\356c\345\34L<)\271_\312\32\3457\265\336B\243\265\356\1\325h\336\371\302\215\305L_?\237j\203H\243\345\201\335\225=\320A\254\342Q\365\342\225\307\15\347q|\306\347!\333\15\342\31Ck\3676\203t\215\363\277\326\254R\340\312(\17\247\351*\352\236\2773I\242\376$)\257\316t\363\242O\1\351\273\307yS\346\375\237i\323;\356\247%\214\256l7\364N\215agg\25\357\236\265UW\210\3161\314O&\310\264\204\1\356\245e)`\241]\233n\247\2~`\366\234DI\267j\215\361\227\331B\25\233M`adena\200U\27\31", ) == 0x0
 00500   444   NtWriteFile  (80, 0, 0, 0,  (80, 0, 0, 0, "\2\363\330Hu\252\252\277\310A"\210\335\203\215\327S_\260\337\27\300\310d\22Y(`V\5\264a\33\22\275\377\26\320\343'\270Z9\212L\1\377\200\351\12\216\375\332Z\270\4\3\237J\215&d4?\7\365\215I@Ju\336_r\253\14\334o\2\25p\14\362L\343\11z\4\307~\241\4\252\243\362d\1%w\2#\374\3022"B\273\31F\345N5\362C\316W\10\22th\212\343\210N:ei\325\255\370S=:\213?\355\330"\332\370\364\2669\325\34\266\326Yu\321\35;,"\223\335\210\340x\0\360\252R*\15S\364-\222#\262\215}\370\245vj\201\3320t\303\210\0z\11\14\254\343\207\376  \242\21\3\342\335\336\201\32\341s\36\352\236\317\223\1\243\3}ttn\243N6$]l~R\16\324\367\270"\37]H\354\10\342Bn\13\262\1\12\352\311\16I76\303\3\2\210\311\26\360\36\2706\\32090|\3646\213\274;\237\220\212\31S\32DM\375\372\244\364\223\307\217\22\22D\22M#<\200S\24C\1\272\220j\220g\223&\211\323A"~\23\365C\10`\14t\33-\377\257\4\202o\272\22\201C\4\212PG\351I.\303\35\353q\17\270\370\207<\344\220\370\370C\4\370\310\0r%\370\370e\300\343M\370r\271k$\5\205\344&\220\263, 10240, 0x0, 0, ... {status=0x0, info=10240}, ) \210\335\203\215\327S_\260\337\27\300\310d\22Y(`V\5\264a\33\22\275\377\26\320\343'\270Z9\212L\1\377\200\351\12\216\375\332Z\270\4\3\237J\215&d4?\7\365\215I@Ju\336_r\253\14\334o\2\25p\14\362L\343\11z\4\307~\241\4\252\243\362d\1%w\2#\374\3022 (80, 0, 0, 0, "\2\363\330Hu\252\252\277\310A"\210\335\203\215\327S_\260\337\27\300\310d\22Y(`V\5\264a\33\22\275\377\26\320\343'\270Z9\212L\1\377\200\351\12\216\375\332Z\270\4\3\237J\215&d4?\7\365\215I@Ju\336_r\253\14\334o\2\25p\14\362L\343\11z\4\307~\241\4\252\243\362d\1%w\2#\374\3022"B\273\31F\345N5\362C\316W\10\22th\212\343\210N:ei\325\255\370S=:\213?\355\330"\332\370\364\2669\325\34\266\326Yu\321\35;,"\223\335\210\340x\0\360\252R*\15S\364-\222#\262\215}\370\245vj\201\3320t\303\210\0z\11\14\254\343\207\376  \242\21\3\342\335\336\201\32\341s\36\352\236\317\223\1\243\3}ttn\243N6$]l~R\16\324\367\270"\37]H\354\10\342Bn\13\262\1\12\352\311\16I76\303\3\2\210\311\26\360\36\2706\\32090|\3646\213\274;\237\220\212\31S\32DM\375\372\244\364\223\307\217\22\22D\22M#<\200S\24C\1\272\220j\220g\223&\211\323A"~\23\365C\10`\14t\33-\377\257\4\202o\272\22\201C\4\212PG\351I.\303\35\353q\17\270\370\207<\344\220\370\370C\4\370\310\0r%\370\370e\300\343M\370r\271k$\5\205\344&\220\263, 10240, 0x0, 0, ... {status=0x0, info=10240}, ) \332\370\364\2669\325\34\266\326Yu\321\35;, (80, 0, 0, 0, "\2\363\330Hu\252\252\277\310A"\210\335\203\215\327S_\260\337\27\300\310d\22Y(`V\5\264a\33\22\275\377\26\320\343'\270Z9\212L\1\377\200\351\12\216\375\332Z\270\4\3\237J\215&d4?\7\365\215I@Ju\336_r\253\14\334o\2\25p\14\362L\343\11z\4\307~\241\4\252\243\362d\1%w\2#\374\3022"B\273\31F\345N5\362C\316W\10\22th\212\343\210N:ei\325\255\370S=:\213?\355\330"\332\370\364\2669\325\34\266\326Yu\321\35;,"\223\335\210\340x\0\360\252R*\15S\364-\222#\262\215}\370\245vj\201\3320t\303\210\0z\11\14\254\343\207\376  \242\21\3\342\335\336\201\32\341s\36\352\236\317\223\1\243\3}ttn\243N6$]l~R\16\324\367\270"\37]H\354\10\342Bn\13\262\1\12\352\311\16I76\303\3\2\210\311\26\360\36\2706\\32090|\3646\213\274;\237\220\212\31S\32DM\375\372\244\364\223\307\217\22\22D\22M#<\200S\24C\1\272\220j\220g\223&\211\323A"~\23\365C\10`\14t\33-\377\257\4\202o\272\22\201C\4\212PG\351I.\303\35\353q\17\270\370\207<\344\220\370\370C\4\370\310\0r%\370\370e\300\343M\370r\271k$\5\205\344&\220\263, 10240, 0x0, 0, ... {status=0x0, info=10240}, ) \37]H\354\10\342Bn\13\262\1\12\352\311\16I76\303\3\2\210\311\26\360\36\2706\\32090|\3646\213\274;\237\220\212\31S\32DM\375\372\244\364\223\307\217\22\22D\22M#<\200S\24C\1\272\220j\220g\223&\211\323A (80, 0, 0, 0, "\2\363\330Hu\252\252\277\310A"\210\335\203\215\327S_\260\337\27\300\310d\22Y(`V\5\264a\33\22\275\377\26\320\343'\270Z9\212L\1\377\200\351\12\216\375\332Z\270\4\3\237J\215&d4?\7\365\215I@Ju\336_r\253\14\334o\2\25p\14\362L\343\11z\4\307~\241\4\252\243\362d\1%w\2#\374\3022"B\273\31F\345N5\362C\316W\10\22th\212\343\210N:ei\325\255\370S=:\213?\355\330"\332\370\364\2669\325\34\266\326Yu\321\35;,"\223\335\210\340x\0\360\252R*\15S\364-\222#\262\215}\370\245vj\201\3320t\303\210\0z\11\14\254\343\207\376  \242\21\3\342\335\336\201\32\341s\36\352\236\317\223\1\243\3}ttn\243N6$]l~R\16\324\367\270"\37]H\354\10\342Bn\13\262\1\12\352\311\16I76\303\3\2\210\311\26\360\36\2706\\32090|\3646\213\274;\237\220\212\31S\32DM\375\372\244\364\223\307\217\22\22D\22M#<\200S\24C\1\272\220j\220g\223&\211\323A"~\23\365C\10`\14t\33-\377\257\4\202o\272\22\201C\4\212PG\351I.\303\35\353q\17\270\370\207<\344\220\370\370C\4\370\310\0r%\370\370e\300\343M\370r\271k$\5\205\344&\220\263, 10240, 0x0, 0, ... {status=0x0, info=10240}, ) , 10240, 0x0, 0, ... {status=0x0, info=10240}, ) == 0x0
 00501   444   NtReadFile  (68, 0, 0, 0, 10240, 0x0, 0, ... {status=0x0, info=10240},  (68, 0, 0, 0, 10240, 0x0, 0, ... {status=0x0, info=10240}, "\337-\10\231\354\3I\375\260\277\11z\354^nR\327!Ou\361\341\307-\206\22k\5\316\35\337c\330\24\241R\366\1q`\217."\204'\310#\322\23j$\367\267\0&\226\243J\22!\306\366\352\326\374E\21\261\374\272\275\1\220/\15{\244^\25\24\25i\21\13<\0\226\16\244b\5\341\247\32\255\327\356Y\32\1\3172nR\356\11'\341\2525\377\221%\257\313\352\267l\355H\35\265~\304\246\257E\263\224E\277\261\2251e\215\263\217x|*\36'\270\246\16g\203-^\4}\322M\35\201\276\317ha}X\256\266\244\255.+\242\354/\13\237H\37\326\15}\244\217\321")\270\212(\31\243\5\371\33\214\261\304\217)\267\361;!4L\262=\22L\342tX\3152\7\262p\246Y\267\252\37\243\362s$\200\273MA\306\205\355!\24EC\16in\376\212\220\250\34-\4g^\s\310V\204\363Sv^\5\213\262%\25\234\33.H\363^\254}lJ:\324\13/\223\253\243\231\252\324\242WR\3657b\216\10\330\266\336\206\315Dw,\277\307\256:\17N\261\2013\24\244&\343"\366\5*\0\336\347'-\347\10Ol.\312\204B\215\253\2606\262p?F\4Y\243\4)\245\4\315(\11\222Wc\23\205z\220\25\363\376E\32\332\2442pk\365$\1;])\376k]\233\3\231\0nt\252\30\243#Q\260\1779Lp\230\17cq\225!\247\211\315'\17\3349+\317X\323\204\243\335&}\342:\14\13\315O\221\253\20\340\204F{\263SF`\27'\2\245/B\237\213\206\224m\242A*\21\267Y\224-l\3772\31\277m\6\312\25a\355%\203e\16-\213Y\275\1\305\232\327\203\367\14\252\354\363M\215R\250\270\256g\366\362m\243\204\27$\212vN\314\10s\356\203w\307\241*\2", ) \204'\310#\322\23j$\367\267\0&\226\243J\22!\306\366\352\326\374E\21\261\374\272\275\1\220/\15{\244^\25\24\25i\21\13<\0\226\16\244b\5\341\247\32\255\327\356Y\32\1\3172nR\356\11'\341\2525\377\221%\257\313\352\267l\355H\35\265~\304\246\257E\263\224E\277\261\2251e\215\263\217x|*\36'\270\246\16g\203-^\4}\322M\35\201\276\317ha}X\256\266\244\255.+\242\354/\13\237H\37\326\15}\244\217\321 (68, 0, 0, 0, 10240, 0x0, 0, ... {status=0x0, info=10240}, "\337-\10\231\354\3I\375\260\277\11z\354^nR\327!Ou\361\341\307-\206\22k\5\316\35\337c\330\24\241R\366\1q`\217."\204'\310#\322\23j$\367\267\0&\226\243J\22!\306\366\352\326\374E\21\261\374\272\275\1\220/\15{\244^\25\24\25i\21\13<\0\226\16\244b\5\341\247\32\255\327\356Y\32\1\3172nR\356\11'\341\2525\377\221%\257\313\352\267l\355H\35\265~\304\246\257E\263\224E\277\261\2251e\215\263\217x|*\36'\270\246\16g\203-^\4}\322M\35\201\276\317ha}X\256\266\244\255.+\242\354/\13\237H\37\326\15}\244\217\321")\270\212(\31\243\5\371\33\214\261\304\217)\267\361;!4L\262=\22L\342tX\3152\7\262p\246Y\267\252\37\243\362s$\200\273MA\306\205\355!\24EC\16in\376\212\220\250\34-\4g^\s\310V\204\363Sv^\5\213\262%\25\234\33.H\363^\254}lJ:\324\13/\223\253\243\231\252\324\242WR\3657b\216\10\330\266\336\206\315Dw,\277\307\256:\17N\261\2013\24\244&\343"\366\5*\0\336\347'-\347\10Ol.\312\204B\215\253\2606\262p?F\4Y\243\4)\245\4\315(\11\222Wc\23\205z\220\25\363\376E\32\332\2442pk\365$\1;])\376k]\233\3\231\0nt\252\30\243#Q\260\1779Lp\230\17cq\225!\247\211\315'\17\3349+\317X\323\204\243\335&}\342:\14\13\315O\221\253\20\340\204F{\263SF`\27'\2\245/B\237\213\206\224m\242A*\21\267Y\224-l\3772\31\277m\6\312\25a\355%\203e\16-\213Y\275\1\305\232\327\203\367\14\252\354\363M\215R\250\270\256g\366\362m\243\204\27$\212vN\314\10s\356\203w\307\241*\2", ) \366\5*\0\336\347'-\347\10Ol.\312\204B\215\253\2606\262p?F\4Y\243\4)\245\4\315(\11\222Wc\23\205z\220\25\363\376E\32\332\2442pk\365$\1;])\376k]\233\3\231\0nt\252\30\243#Q\260\1779Lp\230\17cq\225!\247\211\315'\17\3349+\317X\323\204\243\335&}\342:\14\13\315O\221\253\20\340\204F{\263SF`\27'\2\245/B\237\213\206\224m\242A*\21\267Y\224-l\3772\31\277m\6\312\25a\355%\203e\16-\213Y\275\1\305\232\327\203\367\14\252\354\363M\215R\250\270\256g\366\362m\243\204\27$\212vN\314\10s\356\203w\307\241*\2", ) == 0x0
 00502   444   NtWriteFile  (80, 0, 0, 0,  (80, 0, 0, 0, "x`.\230KNo\374\27\362/{K\23HSplitV\254\341,!_M\4iP\371b\177Y\207SQLWa(c\4\205\200\205\5\323\264'\2\366\20M\0\227\4\74 a\273\314\327[\107\260[\367\233\07b+z\3\233\25\262$7\12\233M\260\17\3/#\340\0W\213\326I\24<\0h\177HSID\1\340\15x\331\220\202\342\355\353\20!\313I\272\370X\305\1\342c\2623\10\231\2602|C\214\24\302^}\215S\1\271\1CA\202\212\23"|u\0;\200\31\202N`\332\25\210\267\3\340\10*\5\241\11\128\59\327\2520\202\216vo\17\271-e?\242\242\264=\215\26\211\251(\20\274\35 \223\1\224<\265\1\304u\377\200\24\6\25=\200X\20\3479\242U>\2\201\34\0g\307"\240\7\25\342\16(h\311\263\254\221\17Q\13\5\300\23zro\33\242\362\364;x\4,\377\3\24;V\10IT\23\212|\313\7\34\325\254b\265\252\4\324\214\325\5\32t\364\220/\250\11\177\373\370\207j\11Q-\30\212\210;\250\3\227\200\224Y\202'Do\320\4\215M\370\346\200`\301\11\350!\10\313#\17\253\252\27{\224q\230\13"X\4I\17\244\243\200\16\105\32E\22"7\266\24T\263c\33}\351\24q\314\270\2\0\234\20\17\377\314\20\275\2>MHu\15U\205"\366\375Y8\353=\276\16\304<\263 \0\304\353&\250\221\37*h\25\365\205\4\220\0|Ew*\12j\2\267\252\267\255\242G\334\376uG\307Z\1\3\2bd\236,\313\262l\5\14\14\20\20\24\262,\313\262\24\30\30  \313\262,\313$$((,,\24\233\0b\327\361\202PA\214\355T\0\253S\17\365\210fQ\277K\242#Z\2\213\321\3\352\11\324\243\245v`\354\14\3", 10240, 0x0, 0, ... {status=0x0, info=10240}, ) |u\0;\200\31\202N`\332\25\210\267\3\340\10*\5\241\11\128\59\327\2520\202\216vo\17\271-e?\242\242\264=\215\26\211\251(\20\274\35 \223\1\224<\265\1\304u\377\200\24\6\25=\200X\20\3479\242U>\2\201\34\0g\307 (80, 0, 0, 0, "x`.\230KNo\374\27\362/{K\23HSplitV\254\341,!_M\4iP\371b\177Y\207SQLWa(c\4\205\200\205\5\323\264'\2\366\20M\0\227\4\74 a\273\314\327[\107\260[\367\233\07b+z\3\233\25\262$7\12\233M\260\17\3/#\340\0W\213\326I\24<\0h\177HSID\1\340\15x\331\220\202\342\355\353\20!\313I\272\370X\305\1\342c\2623\10\231\2602|C\214\24\302^}\215S\1\271\1CA\202\212\23"|u\0;\200\31\202N`\332\25\210\267\3\340\10*\5\241\11\128\59\327\2520\202\216vo\17\271-e?\242\242\264=\215\26\211\251(\20\274\35 \223\1\224<\265\1\304u\377\200\24\6\25=\200X\20\3479\242U>\2\201\34\0g\307"\240\7\25\342\16(h\311\263\254\221\17Q\13\5\300\23zro\33\242\362\364;x\4,\377\3\24;V\10IT\23\212|\313\7\34\325\254b\265\252\4\324\214\325\5\32t\364\220/\250\11\177\373\370\207j\11Q-\30\212\210;\250\3\227\200\224Y\202'Do\320\4\215M\370\346\200`\301\11\350!\10\313#\17\253\252\27{\224q\230\13"X\4I\17\244\243\200\16\105\32E\22"7\266\24T\263c\33}\351\24q\314\270\2\0\234\20\17\377\314\20\275\2>MHu\15U\205"\366\375Y8\353=\276\16\304<\263 \0\304\353&\250\221\37*h\25\365\205\4\220\0|Ew*\12j\2\267\252\267\255\242G\334\376uG\307Z\1\3\2bd\236,\313\262l\5\14\14\20\20\24\262,\313\262\24\30\30  \313\262,\313$$((,,\24\233\0b\327\361\202PA\214\355T\0\253S\17\365\210fQ\277K\242#Z\2\213\321\3\352\11\324\243\245v`\354\14\3", 10240, 0x0, 0, ... {status=0x0, info=10240}, ) X\4I\17\244\243\200\16\105\32E\22 (80, 0, 0, 0, "x`.\230KNo\374\27\362/{K\23HSplitV\254\341,!_M\4iP\371b\177Y\207SQLWa(c\4\205\200\205\5\323\264'\2\366\20M\0\227\4\74 a\273\314\327[\107\260[\367\233\07b+z\3\233\25\262$7\12\233M\260\17\3/#\340\0W\213\326I\24<\0h\177HSID\1\340\15x\331\220\202\342\355\353\20!\313I\272\370X\305\1\342c\2623\10\231\2602|C\214\24\302^}\215S\1\271\1CA\202\212\23"|u\0;\200\31\202N`\332\25\210\267\3\340\10*\5\241\11\128\59\327\2520\202\216vo\17\271-e?\242\242\264=\215\26\211\251(\20\274\35 \223\1\224<\265\1\304u\377\200\24\6\25=\200X\20\3479\242U>\2\201\34\0g\307"\240\7\25\342\16(h\311\263\254\221\17Q\13\5\300\23zro\33\242\362\364;x\4,\377\3\24;V\10IT\23\212|\313\7\34\325\254b\265\252\4\324\214\325\5\32t\364\220/\250\11\177\373\370\207j\11Q-\30\212\210;\250\3\227\200\224Y\202'Do\320\4\215M\370\346\200`\301\11\350!\10\313#\17\253\252\27{\224q\230\13"X\4I\17\244\243\200\16\105\32E\22"7\266\24T\263c\33}\351\24q\314\270\2\0\234\20\17\377\314\20\275\2>MHu\15U\205"\366\375Y8\353=\276\16\304<\263 \0\304\353&\250\221\37*h\25\365\205\4\220\0|Ew*\12j\2\267\252\267\255\242G\334\376uG\307Z\1\3\2bd\236,\313\262l\5\14\14\20\20\24\262,\313\262\24\30\30  \313\262,\313$$((,,\24\233\0b\327\361\202PA\214\355T\0\253S\17\365\210fQ\277K\242#Z\2\213\321\3\352\11\324\243\245v`\354\14\3", 10240, 0x0, 0, ... {status=0x0, info=10240}, ) \366\375Y8\353=\276\16\304<\263 \0\304\353&\250\221\37*h\25\365\205\4\220\0|Ew*\12j\2\267\252\267\255\242G\334\376uG\307Z\1\3\2bd\236,\313\262l\5\14\14\20\20\24\262,\313\262\24\30\30  \313\262,\313$$((,,\24\233\0b\327\361\202PA\214\355T\0\253S\17\365\210fQ\277K\242#Z\2\213\321\3\352\11\324\243\245v`\354\14\3", 10240, 0x0, 0, ... {status=0x0, info=10240}, ) == 0x0
 00503   444   NtReadFile  (68, 0, 0, 0, 10240, 0x0, 0, ... {status=0x0, info=10240},  (68, 0, 0, 0, 10240, 0x0, 0, ... {status=0x0, info=10240}, "\262\252\351n"o70|\246&\315\273\315\33\310;G&t`\202Q\273\345\326\355\2107r\37h\25\177?\322\2234\235EDJ\0\243\362j!\21\31*\361\226J\334\16\355\1\214\177\207V\275m\3765\317Q\354Q(\213x\207o\24[\321\34Q\366>\361\17\266L$\217(\43\5\4n^\202\262M\201\323;e%1\204.-}\273\313)9iJ6\212\342\275\246\1\213\323M7\2670\362I\331\210;!\362\275\374\246\177\234e\334\158\324\301\237\322X\257O\266B\251t%\5\242\6\214a\325~\346\302\301\241=\310r \226i\3A3=5\30\370\223E]>H|\203P\10'\214\14\337\312\357\203^\27U\6\207\253\5b\2/\204-\210\361t\360\22\3447t07\304k\355l5\312\204w\336\256]qWaa\343\242'0\274\337t\3513}\312D\311\226\6\0\2403]\320\353LH{\37|\302\26\326/bJ\320\230\256M\276I\26\36Sm\6\201[O\361\24\357\214\304\263u\17r\26\251]2i\362df\1l{\323%\261\343\255\0u\275\322{fV-\201\340I\2038\265E\306$\212\275\302\201\323\\202\345pQ\20\306\300\15\365`?\207\323\27\343\14z\276LwD\265\37\253I\366a\337\333\177F\35\202\362N]/\340\256Q\251E>ax*\363"\2565\254\207`\222\3675\313\232\376\23X\236l\332\377N-\373\217\10\334\233\6R\211\301\206;\224\2\257F.%\211\1^\25\320W?~a\25*\10d\240\321\337\1\345\242]\177\11\2114\366a\275\221UX>4#c\364\250\35\373\350>#f:D\332\dQJ\13QtRJ\35\270\31Od\243\256\347\246\201\33\31\311\3\246%1\12\216\27\327<_\220\224\374-\34\240\247 \330\276\15", ) o70|\246&\315\273\315\33\310;G&t`\202Q\273\345\326\355\2107r\37h\25\177?\322\2234\235EDJ\0\243\362j!\21\31*\361\226J\334\16\355\1\214\177\207V\275m\3765\317Q\354Q(\213x\207o\24[\321\34Q\366>\361\17\266L$\217(\43\5\4n^\202\262M\201\323;e%1\204.-}\273\313)9iJ6\212\342\275\246\1\213\323M7\2670\362I\331\210;!\362\275\374\246\177\234e\334\158\324\301\237\322X\257O\266B\251t%\5\242\6\214a\325~\346\302\301\241=\310r \226i\3A3=5\30\370\223E]>H|\203P\10'\214\14\337\312\357\203^\27U\6\207\253\5b\2/\204-\210\361t\360\22\3447t07\304k\355l5\312\204w\336\256]qWaa\343\242'0\274\337t\3513}\312D\311\226\6\0\2403]\320\353LH{\37|\302\26\326/bJ\320\230\256M\276I\26\36Sm\6\201[O\361\24\357\214\304\263u\17r\26\251]2i\362df\1l{\323%\261\343\255\0u\275\322{fV-\201\340I\2038\265E\306$\212\275\302\201\323\\202\345pQ\20\306\300\15\365`?\207\323\27\343\14z\276LwD\265\37\253I\366a\337\333\177F\35\202\362N]/\340\256Q\251E>ax*\363 (68, 0, 0, 0, 10240, 0x0, 0, ... {status=0x0, info=10240}, "\262\252\351n"o70|\246&\315\273\315\33\310;G&t`\202Q\273\345\326\355\2107r\37h\25\177?\322\2234\235EDJ\0\243\362j!\21\31*\361\226J\334\16\355\1\214\177\207V\275m\3765\317Q\354Q(\213x\207o\24[\321\34Q\366>\361\17\266L$\217(\43\5\4n^\202\262M\201\323;e%1\204.-}\273\313)9iJ6\212\342\275\246\1\213\323M7\2670\362I\331\210;!\362\275\374\246\177\234e\334\158\324\301\237\322X\257O\266B\251t%\5\242\6\214a\325~\346\302\301\241=\310r \226i\3A3=5\30\370\223E]>H|\203P\10'\214\14\337\312\357\203^\27U\6\207\253\5b\2/\204-\210\361t\360\22\3447t07\304k\355l5\312\204w\336\256]qWaa\343\242'0\274\337t\3513}\312D\311\226\6\0\2403]\320\353LH{\37|\302\26\326/bJ\320\230\256M\276I\26\36Sm\6\201[O\361\24\357\214\304\263u\17r\26\251]2i\362df\1l{\323%\261\343\255\0u\275\322{fV-\201\340I\2038\265E\306$\212\275\302\201\323\\202\345pQ\20\306\300\15\365`?\207\323\27\343\14z\276LwD\265\37\253I\366a\337\333\177F\35\202\362N]/\340\256Q\251E>ax*\363"\2565\254\207`\222\3675\313\232\376\23X\236l\332\377N-\373\217\10\334\233\6R\211\301\206;\224\2\257F.%\211\1^\25\320W?~a\25*\10d\240\321\337\1\345\242]\177\11\2114\366a\275\221UX>4#c\364\250\35\373\350>#f:D\332\dQJ\13QtRJ\35\270\31Od\243\256\347\246\201\33\31\311\3\246%1\12\216\27\327<_\220\224\374-\34\240\247 \330\276\15", ) , ) == 0x0
 00504   444   NtWriteFile  (80, 0, 0, 0,  (80, 0, 0, 0, "\25\347\317o\205"\211\333\353\0\314\34T\23\32ova'\323-\244P\34\250\360\354/zT\36\317XY>u\336\22\234\342\11l\1\4\277L \266T\14\3601\7\372\17JL\252~ \33\233lYx\351PK\34\16\212\337\312I\25\374\234:PQs\327\16\21\1\2\216\217I\25\4\243#x\203\25\0\247\322\234(\30#c\13|\34\206\178\316\7\20\213E\360\200\0,\236k6\20}\324H~\305\35 U\360\332\25\2212\272d{@\36\325f\322\364Y\10\2\220C\169\3\4\5K\252`r3\300\303f\354\33\311\325m\260h\244\14\25<\222U\336\222\342\20\30I\333\316v\11\200\301*\336m\242\245_\260\30 \206\14HD\3\210\311\13\211V9\326\23CzR1\220\211M\354\313x\354\205\320\223\210\\326\32G`D\357\11\33\222R\350\2240\354En\333 \1\7~{\321L\1nz\2701\344\27qbDKw\325\210L\31\40\37\364  \200\374\2\327\25H\301\342\262\322BT\27\16\20\24hU)@\0\3136\365$\26\256\213\1\322\360\364z\301\33\13\200G\4\2459\22\10\340%-\360\344\200t\21\244\344\327\34$1a\215+\364\307r\241\322\260\256*{\31\1QE\22R\215HQ,\371\332\330\13;\203U\3{.G\343w\24\226\10\30`\337g\325#\11x\212\206\307\337\3214l\327\330\22\377\323J\333X\3\13\372(E\372\232\241\37\257\300!v\262\3\10\13\10$.Lx\24w\32\31\177\306X\14\11\303\355\367\336\246\250\204\\330D\2575Q,\233\220\362\25\305\204.\322\251\272\266\316?\204+\34E}\21BP\355Fwu\365\7;\271\276\2B\242\11\252\200\200\274T\357\2\1h\27\13)Z\361=\370\335\262\375\212Q\206\246\207\225\230\14", 10240, 0x0, 0, ... {status=0x0, info=10240}, ) \211\333\353\0\314\34T\23\32ova'\323-\244P\34\250\360\354/zT\36\317XY>u\336\22\234\342\11l\1\4\277L \266T\14\3601\7\372\17JL\252~ \33\233lYx\351PK\34\16\212\337\312I\25\374\234:PQs\327\16\21\1\2\216\217I\25\4\243#x\203\25\0\247\322\234(\30#c\13|\34\206\178\316\7\20\213E\360\200\0,\236k6\20}\324H~\305\35 U\360\332\25\2212\272d{@\36\325f\322\364Y\10\2\220C\169\3\4\5K\252`r3\300\303f\354\33\311\325m\260h\244\14\25<\222U\336\222\342\20\30I\333\316v\11\200\301*\336m\242\245_\260\30 \206\14HD\3\210\311\13\211V9\326\23CzR1\220\211M\354\313x\354\205\320\223\210\\326\32G`D\357\11\33\222R\350\2240\354En\333 \1\7~{\321L\1nz\2701\344\27qbDKw\325\210L\31\40\37\364  \200\374\2\327\25H\301\342\262\322BT\27\16\20\24hU)@\0\3136\365$\26\256\213\1\322\360\364z\301\33\13\200G\4\2459\22\10\340%-\360\344\200t\21\244\344\327\34$1a\215+\364\307r\241\322\260\256*{\31\1QE\22R\215HQ,\371\332\330\13;\203U\3{.G\343w\24\226\10\30`\337g\325#\11x\212\206\307\337\3214l\327\330\22\377\323J\333X\3\13\372(E\372\232\241\37\257\300!v\262\3\10\13\10$.Lx\24w\32\31\177\306X\14\11\303\355\367\336\246\250\204\\330D\2575Q,\233\220\362\25\305\204.\322\251\272\266\316?\204+\34E}\21BP\355Fwu\365\7;\271\276\2B\242\11\252\200\200\274T\357\2\1h\27\13)Z\361=\370\335\262\375\212Q\206\246\207\225\230\14", 10240, 0x0, 0, ... {status=0x0, info=10240}, ) == 0x0
 00505   444   NtReadFile  (68, 0, 0, 0, 10240, 0x0, 0, ... {status=0x0, info=10240},  (68, 0, 0, 0, 10240, 0x0, 0, ... {status=0x0, info=10240}, "\246\354\331O\3\230.\23\370PB\263{\311\15p\214\14?\366/z#5\5\300\244;(\3\224B\311!\177\204\331m\25\30\202\7\12\12\14K\246\0>\15\230'\200L$\21\367#G\314c>i7/\312.\371LK\34\6\34\270v\200\312N\307\366\235O\275\314\363;\321\323lI~\6'\257H~r\2537\255\301\257u>+E\23BW, ) , ) == 0x0
 00506   444   NtWriteFile  (80, 0, 0, 0,  (80, 0, 0, 0, "\1\241\377N\244\325\10\22_\35d\262\334\204+q+A\31\367\2107\54\242\215\202:\217N\262CnlY\205~ 3\31%J,\13\253\6\200\1\231@\276&'\1\2\20Pna\315\304sO6\210\207\10\370\353\6:\7\273\365P\201m\3\341\367:\2\233\315Tqu\32i\262\222\254RZ\34\254A\207\327/\224,px\201\335\27\367R\35.\14\262D\264\254L\63\204\261jI\23\310\316[\251\336\250&\330\356\210C\20\3668\361Ep\205\317\300h\371\212\276\266\1* \211\13\34F\3\270\375\11w@\307FD\36\340?\234\234\365m\3563 &\10\5Xs\14z\213\300\108\30*\342^dV\233\36\321\352\302>C\270\35`\353F.\314\25\322\30\14\320,\200L\204!\277m\2\354\200L\37A|\254\360\33\13K "B\230\33t,\233[8m\240 \316\5\24\24\340E\304\262\30\30sK'\313\326\257\14\14\14\30\2\24c\7\353\226;u\12\10\215_\24\347\26\212\215u\255\211g\374G\327G\252\366\276`7d\353\27\312\23\30\36\30\202\220\235t\14\301\360\204\232\20\25I\354O@\270\226\252\257\25\213D\30\212Z\31X\255u\346[7\310\213A\14\16\33\12|\333Ys\267B\2J\30\23\10\240P\267Q\262,\333\22k!\24\14\30\30}\266\330r\14\30-\273HP\10D,a\314\15\200[\367U\315\22#ZK\270y:\356\12\32B\267\232\302\177*[;\266\3~I\374\5\370+b\22|z\340\361\261\27"\364\307\0\22\13\222\360\330 \237mq1\316B\2u9\0A\314\326\251T+\2043\3\2531\260\340\216\341\0Q\307ZA<\370\200\275\364`\366*\216@ 2\17\217\370\377\24\365\222\16\300\304\3r\30;\306\300l\227m\31\336(8\15\320\311N", 10240, 0x0, 0, ... {status=0x0, info=10240}, ) B\230\33t,\233[8m\240 \316\5\24\24\340E\304\262\30\30sK'\313\326\257\14\14\14\30\2\24c\7\353\226;u\12\10\215_\24\347\26\212\215u\255\211g\374G\327G\252\366\276`7d\353\27\312\23\30\36\30\202\220\235t\14\301\360\204\232\20\25I\354O@\270\226\252\257\25\213D\30\212Z\31X\255u\346[7\310\213A\14\16\33\12|\333Ys\267B\2J\30\23\10\240P\267Q\262,\333\22k!\24\14\30\30}\266\330r\14\30-\273HP\10D,a\314\15\200[\367U\315\22#ZK\270y:\356\12\32B\267\232\302\177*[;\266\3~I\374\5\370+b\22|z\340\361\261\27 (80, 0, 0, 0, "\1\241\377N\244\325\10\22_\35d\262\334\204+q+A\31\367\2107\54\242\215\202:\217N\262CnlY\205~ 3\31%J,\13\253\6\200\1\231@\276&'\1\2\20Pna\315\304sO6\210\207\10\370\353\6:\7\273\365P\201m\3\341\367:\2\233\315Tqu\32i\262\222\254RZ\34\254A\207\327/\224,px\201\335\27\367R\35.\14\262D\264\254L\63\204\261jI\23\310\316[\251\336\250&\330\356\210C\20\3668\361Ep\205\317\300h\371\212\276\266\1* \211\13\34F\3\270\375\11w@\307FD\36\340?\234\234\365m\3563 &\10\5Xs\14z\213\300\108\30*\342^dV\233\36\321\352\302>C\270\35`\353F.\314\25\322\30\14\320,\200L\204!\277m\2\354\200L\37A|\254\360\33\13K "B\230\33t,\233[8m\240 \316\5\24\24\340E\304\262\30\30sK'\313\326\257\14\14\14\30\2\24c\7\353\226;u\12\10\215_\24\347\26\212\215u\255\211g\374G\327G\252\366\276`7d\353\27\312\23\30\36\30\202\220\235t\14\301\360\204\232\20\25I\354O@\270\226\252\257\25\213D\30\212Z\31X\255u\346[7\310\213A\14\16\33\12|\333Ys\267B\2J\30\23\10\240P\267Q\262,\333\22k!\24\14\30\30}\266\330r\14\30-\273HP\10D,a\314\15\200[\367U\315\22#ZK\270y:\356\12\32B\267\232\302\177*[;\266\3~I\374\5\370+b\22|z\340\361\261\27"\364\307\0\22\13\222\360\330 \237mq1\316B\2u9\0A\314\326\251T+\2043\3\2531\260\340\216\341\0Q\307ZA<\370\200\275\364`\366*\216@ 2\17\217\370\377\24\365\222\16\300\304\3r\30;\306\300l\227m\31\336(8\15\320\311N", 10240, 0x0, 0, ... {status=0x0, info=10240}, ) , 10240, 0x0, 0, ... {status=0x0, info=10240}, ) == 0x0
 00507   444   NtReadFile  (68, 0, 0, 0, 10240, 0x0, 0, ... {status=0x0, info=10240},  (68, 0, 0, 0, 10240, 0x0, 0, ... {status=0x0, info=10240}, "\315I\324\31\331\243\245\333\346\355\362}/B\225\236i/C\205O\255\345z,Ac\333\315\325\3551!\234\37\34\266\332\306E\264\302\352\'\232BE\217\332X#\76S\14\325LX\35\361\323o\216\1\340\336\227\262`\241g\372\201\342\352\327W\277\15\267D-\24kH\2229\270\214B\332\351\225Y\361\251Or\4d\300\11\371\212\232%\10\15\4U\266\15\200r\22\270ke\270a\315|PW[E\27461\244\232.\251\34\235\353?\2426\257\245\252\340\352\317\266\342\232\266\2472\263|}\245n\307$\217\31\335\22\263\211\305\236\0e\314\335V\255Cy\342\331D\341\21\257\246\3651\245u\247l\23X\300\217\211\277\267\216 `$\177\242\306#\341\21\21\267\310K\333\227\31\354[\262\12[\271\246\2\265\220\15\337\323\236\17\2201\31#E\205\265\27 '\314=\235\266\230n\27\310I\235\234&C\267\34~)\256J11\312\251\337\/D6\275:\331\\337T\262{.\321\30\352\24s\210[\272\14+Y\347\7\2Z\321\347M\263,\305}\250I"\3727\205)\266n_\256 \23\257\25\4E\237 \33\214g9c\270Q}\31\256\30{\365.=[\255-\310[\11\301\314\354\264e\26\246\17a\02\242\5e\20\24O0{e\203/l\364W\13\16E\334\373\273\352\220\312\3619\237\304^\345C\207Px\332i\36\365#\10t\25\23Z\234\223\207\315\215\5o/eaV\231\330\1\371Gb\210E\335\23\374\243kH2\330\235]\15\205L\322\257\261\342/r\257f\321`d\37\2339\260v\350\303VT%\306V\312\216\347a'r\253K\206\351\206\314\345g?\221z\277ZDR\15\301\262\357\5L]\257Q\254L \2\367gg<\366BfR\357l\241\215\24\336\236E\246j\7\352", ) \3727\205)\266n_\256 \23\257\25\4E\237 \33\214g9c\270Q}\31\256\30{\365.=[\255-\310[\11\301\314\354\264e\26\246\17a\02\242\5e\20\24O0{e\203/l\364W\13\16E\334\373\273\352\220\312\3619\237\304^\345C\207Px\332i\36\365#\10t\25\23Z\234\223\207\315\215\5o/eaV\231\330\1\371Gb\210E\335\23\374\243kH2\330\235]\15\205L\322\257\261\342/r\257f\321`d\37\2339\260v\350\303VT%\306V\312\216\347a'r\253K\206\351\206\314\345g?\221z\277ZDR\15\301\262\357\5L]\257Q\254L \2\367gg<\366BfR\357l\241\215\24\336\236E\246j\7\352", ) == 0x0
 00508   444   NtWriteFile  (80, 0, 0, 0,  (80, 0, 0, 0, "j\4\362\30~\356\203\332A\240\324|\210\17\263\237\316be\204\350\340\303{\213\14E\332j\230\3130\206\3219\35\21\227\340D\23\217\314]\200\327dD(\227~"\240{u\15r\1~\34V\236I\217\246\255\370\226\25-\207f]\314\304\353p\32\231\14\20\11\13\25\314\5\2648\37\301d\333N\330\177\360\16\2T\5\303\215/\370-\327\3\11\252Is\267\252\315T\23\37&C\271\306\200ZQ\360\26c\275\221|\202\233\211\344:\234Lr\2047\10\350\214\341M\202\220\343=\373\2013\241[\244\311\212\2\216\276\2204\262.\210\270\1\302\201\373W\12\16_\343~\11\307\20\10\353\3230\28\201m\264\25\346\216.\362\221\217\207-\2~\5\213\5\340\266\\221\311\354\226\261\30K\26\224\13\374\364\200\3\22\335+\336t\323)\221\226T\5D"\3701!\200\201\33\234\21\325H\26o\4\273\235\201\16\221\35\331d\210K\226|\354\250x\21\11E\221\360\34\330\373\222r\263\334c\367\31MYU\211\374\367**\376\252!\3\375\234\301L\24a\343|\17\4\4\373\220\310\17\267\311\22\210!\264\3423\5\342\322\6\32+*\37b\37\34[\30\11U]\364\211p}\254\212\205}\10f\201\312\265\302[\200\16\306M\24\243\242(6\25\350}]d$bJ\365\360F(D{\266\235\3537\207\32788\211x\344\344\312vy}$8\364\204ER\24\264\27\272\222 \200\253\4\310bC`\361\324\376\0^\12D\211\342\2205\375\4&n3\177\320{\14"\1\364\256\26\257\11s\10+\367a\303R\2758\27;\316\302\361\31\3\307\361T\24\217@,\1s\14\6\240\350!\201\303f\230\334\\276\375\11t\14f\377\311\4\353\20\211P\13\1\6\3P*A=Q\17@SH!\207\214\263\223\270D\1'!\353", 10240, 0x0, 0, ... {status=0x0, info=10240}, ) \240{u\15r\1~\34V\236I\217\246\255\370\226\25-\207f]\314\304\353p\32\231\14\20\11\13\25\314\5\2648\37\301d\333N\330\177\360\16\2T\5\303\215/\370-\327\3\11\252Is\267\252\315T\23\37&C\271\306\200ZQ\360\26c\275\221|\202\233\211\344:\234Lr\2047\10\350\214\341M\202\220\343=\373\2013\241[\244\311\212\2\216\276\2204\262.\210\270\1\302\201\373W\12\16_\343~\11\307\20\10\353\3230\28\201m\264\25\346\216.\362\221\217\207-\2~\5\213\5\340\266\\221\311\354\226\261\30K\26\224\13\374\364\200\3\22\335+\336t\323)\221\226T\5D (80, 0, 0, 0, "j\4\362\30~\356\203\332A\240\324|\210\17\263\237\316be\204\350\340\303{\213\14E\332j\230\3130\206\3219\35\21\227\340D\23\217\314]\200\327dD(\227~"\240{u\15r\1~\34V\236I\217\246\255\370\226\25-\207f]\314\304\353p\32\231\14\20\11\13\25\314\5\2648\37\301d\333N\330\177\360\16\2T\5\303\215/\370-\327\3\11\252Is\267\252\315T\23\37&C\271\306\200ZQ\360\26c\275\221|\202\233\211\344:\234Lr\2047\10\350\214\341M\202\220\343=\373\2013\241[\244\311\212\2\216\276\2204\262.\210\270\1\302\201\373W\12\16_\343~\11\307\20\10\353\3230\28\201m\264\25\346\216.\362\221\217\207-\2~\5\213\5\340\266\\221\311\354\226\261\30K\26\224\13\374\364\200\3\22\335+\336t\323)\221\226T\5D"\3701!\200\201\33\234\21\325H\26o\4\273\235\201\16\221\35\331d\210K\226|\354\250x\21\11E\221\360\34\330\373\222r\263\334c\367\31MYU\211\374\367**\376\252!\3\375\234\301L\24a\343|\17\4\4\373\220\310\17\267\311\22\210!\264\3423\5\342\322\6\32+*\37b\37\34[\30\11U]\364\211p}\254\212\205}\10f\201\312\265\302[\200\16\306M\24\243\242(6\25\350}]d$bJ\365\360F(D{\266\235\3537\207\32788\211x\344\344\312vy}$8\364\204ER\24\264\27\272\222 \200\253\4\310bC`\361\324\376\0^\12D\211\342\2205\375\4&n3\177\320{\14"\1\364\256\26\257\11s\10+\367a\303R\2758\27;\316\302\361\31\3\307\361T\24\217@,\1s\14\6\240\350!\201\303f\230\334\\276\375\11t\14f\377\311\4\353\20\211P\13\1\6\3P*A=Q\17@SH!\207\214\263\223\270D\1'!\353", 10240, 0x0, 0, ... {status=0x0, info=10240}, ) \1\364\256\26\257\11s\10+\367a\303R\2758\27;\316\302\361\31\3\307\361T\24\217@,\1s\14\6\240\350!\201\303f\230\334\\276\375\11t\14f\377\311\4\353\20\211P\13\1\6\3P*A=Q\17@SH!\207\214\263\223\270D\1'!\353", 10240, 0x0, 0, ... {status=0x0, info=10240}, ) == 0x0
 00509   444   NtReadFile  (68, 0, 0, 0, 10240, 0x0, 0, ... {status=0x0, info=10240},  (68, 0, 0, 0, 10240, 0x0, 0, ... {status=0x0, info=10240}, "\264j5\222\334dz\14]\245Y\2\250\14\203\241\312 \346*\236i\372>\356\367\13\334\11\275D\214\372c\344\11\ES\322\223\200Q\366jj\5\362H\16\3655\352S<%\207\36\6vQ\216`N\5\231z\272L\200\220\307\263\265}\372\354w\322\213\201\315\332*\331I\13t{\177\302\270:\373\360/\17\14`1\366\264\352\233\22.w_\364\307P\215a7\255,\374[\331ZL\305\205\302X3\256\13aVZ\15\376\221\331L\1773M\244]8\320\352\252\262+\260d\251X\23L\14\364b\274\333\16B\271Fm\20G3\27|\25S\206\213\23FM\270\241\347S\352\271\320,\26\206\26\374\24\367\256)\263o\277\252L\315]s/\31E\25G\16\31n\323\275\205\0\302\361\36=\370\213!\313N\10\347 \342K\5\13\11\21\2620\17\274\350\3\365\245p t\205+\321\241m\30\341G\241\3237\34\323\254@\227\2423+\2\347$\340B\31aV\266K\244cA|c\224>\316\2156L!\306$\337\242\214\336\21\332\244\323\226O`\371\371~\254\3540\357\224\332\332\212\306L\12x\353V\331~\326\373\203<\36\324\351x/[@\323D\374\272I\265\371tA\300]\2X\2409\203\203\326\254E\262\250\372\301OI\246\345\250+#\361J\372\3741\227\254G\352\225\215\214\212CN[\11\336\354\300\341\372\277\244:\332A\35\5_3\335\26\335_U&\221v%4\325h\340E\241Miy\252\263\307oX\252!\23\236:\313\352\270+\341\244\226MG\12\310\375\221_\30\337\2\30\207\355\327\332\234\355N\361\274\265@\300M'\257\6\267\255\336\2/\36$\302\346\204$\341\12O\37\311\254\207[\200\374\3342\372\336JP\366\177\316\374\13'\340\26\13\301Fk}_\273\35{\24319\276\251\14\13 ", ) , ) == 0x0
 00510   444   NtWriteFile  (80, 0, 0, 0,  (80, 0, 0, 0, "\23'\23\223{)\\15\372\350\177\3\17A\245\240mm\300+9$\334?I\272-\335\256\360b\215].\302\10\373\10u\3234\315w\367\315'#\363\357C\3234M\36\32$ S w\366\303FO\242\324\\273\353\315\266\306\24\370[\373K:\364\212&\200\374+~\4-u\3342\344\271\235\266\326.\250AF0Q\371\314\232\265cQ^S\212v\214\306z\213-[\26\377[\353\210\243\303\377~\210\12\306\33|\14Y\334\377M\330~k\245\372u\366\353\15\377\15\261\303\344~\22\353A\322c\33\226(C\36\13K\21\340~1}\262\36\240\212\264\13k\271\6\252u\353\36\235\12\27![\332\25P\343\17\262\310\362\214Mj\20U.\276\103F\251TH\322\32\310&\303VS\33\371,l\355O\257\252\6\343\354H-\10\266\377\26\16\33\245%\364\2=\6u"f\367\240\312U\307F\6\236\21\35t\341f\226\5~\15\3@i\306C\276,p\267\354\351E@\333.\262?i\300\20M\206\213\2\336\5\301\370\20}\351\365\227\350-\337\370\331\341\3121H\331\374\333-\213j\13\337\246p\330\331\233\335\202\233S\362\350\337b}At\11\332\273\356\370\337u\346\215{\3\377\355\37\202$\233\212D\25\345\334\300\350\4\200\344\17f\5\360\355\267\33200\341a\3532\300\252\213\344\3}\10y\241\346\340]\362\202;}\14;\4\370~\373\27z\22s'6;\35r%\306D\6\0Ox\15\376\341n\377\347\7\229w\355\353\37f\307\2451\0a\13o\260\267^\277\222$\31 \240\361\333;\240h\360\33\370f\301\352j\211\7\20\340\370\3\210S\2\303A\311\2\340\255\29\310\13\312}\201[\221\24\373y\7v\367\330\203\332\12\200\2550\12f\13M|\370\366;z\4|\37\277\16A-!", 10240, 0x0, 0, ... {status=0x0, info=10240}, ) f\367\240\312U\307F\6\236\21\35t\341f\226\5~\15\3@i\306C\276,p\267\354\351E@\333.\262?i\300\20M\206\213\2\336\5\301\370\20}\351\365\227\350-\337\370\331\341\3121H\331\374\333-\213j\13\337\246p\330\331\233\335\202\233S\362\350\337b}At\11\332\273\356\370\337u\346\215{\3\377\355\37\202$\233\212D\25\345\334\300\350\4\200\344\17f\5\360\355\267\33200\341a\3532\300\252\213\344\3}\10y\241\346\340]\362\202;}\14;\4\370~\373\27z\22s'6;\35r%\306D\6\0Ox\15\376\341n\377\347\7\229w\355\353\37f\307\2451\0a\13o\260\267^\277\222$\31 \240\361\333;\240h\360\33\370f\301\352j\211\7\20\340\370\3\210S\2\303A\311\2\340\255\29\310\13\312}\201[\221\24\373y\7v\367\330\203\332\12\200\2550\12f\13M|\370\366;z\4|\37\277\16A-!", 10240, 0x0, 0, ... {status=0x0, info=10240}, ) == 0x0
 00511   444   NtReadFile  (68, 0, 0, 0, 10240, 0x0, 0, ... {status=0x0, info=10240},  (68, 0, 0, 0, 10240, 0x0, 0, ... {status=0x0, info=10240}, "\227l\16\3371A\315&\261Np\14!\263\261\255\252Q1\212xv\315te\3300\12\215\363\343\236Kk\226\255\24\346[\374\235\335\212\310\271\15\241\225\326Tm\351Nl\5\334~'\5\230&\353v\371\\237\254\343\30~\272\2463\376\30\347\375#(\37\11B\21\326\256\20\3521G\255\376\244\203g\305\321f\24\26\234\202\333(\261M\237\267:k2@\358\367)\5\310\350\212L\315p\25\265\345\3625\361g\36\330#\246*o\364\15\226G[V\35\372\322\310\362\220\16\33\211X\204\20\257\31:s\373\237\241d\247\307\223\314\300=\236M<\0\227R>Tf_wW\353\254qP\232\265\257:\260\236\236F\231/\35\255k.5%'t%\351\247\243\207\273\357\272\335^\246\323\250^\362\245\305a\315;\346\277\26Iii\254\30tt\2705#\314\201\12"%\376O\312\25\320;\3751~\315\4\242K\305.S\343I\35\271F\301{\351IN\343\210R\306;U\260WXOL\34\324r(\243Q\15{`\12\201\244;\35\30\320v\35b\177\276\332!\304#\25\253;\35c$\360\12u\361?\243\13`\230G\235\35Hc\251?B\371\250E\211\211\253\3778\201P\236\10Ijf\350\231\30\251D&\361\246\116\345\261L\33\335\257@\210Z\30\335\206\11\374\235\255\353&\317HZv\250&\377\244A\247\303\222\326]\232\252\314\304\17atb)K-yU6\210c\212\222\203\257\217\205-\32\317\331\361\220\334\315.\335\216\321G\373:\334E\237.\250Z\372\212\242\262P\37\360]\15\372\360\374;w\31\36\346C\2\246/7\202D\254\316\251\364\232\211UT\20'\214\370\325\240&\253\357\21C{\22\234LNi\311n,\373GQf @#u\360l\310r:%\324N\255\5\234\242U\215", ) %\376O\312\25\320;\3751~\315\4\242K\305.S\343I\35\271F\301{\351IN\343\210R\306;U\260WXOL\34\324r(\243Q\15{`\12\201\244;\35\30\320v\35b\177\276\332!\304#\25\253;\35c$\360\12u\361?\243\13`\230G\235\35Hc\251?B\371\250E\211\211\253\3778\201P\236\10Ijf\350\231\30\251D&\361\246\116\345\261L\33\335\257@\210Z\30\335\206\11\374\235\255\353&\317HZv\250&\377\244A\247\303\222\326]\232\252\314\304\17atb)K-yU6\210c\212\222\203\257\217\205-\32\317\331\361\220\334\315.\335\216\321G\373:\334E\237.\250Z\372\212\242\262P\37\360]\15\372\360\374;w\31\36\346C\2\246/7\202D\254\316\251\364\232\211UT\20'\214\370\325\240&\253\357\21C{\22\234LNi\311n,\373GQf @#u\360l\310r:%\324N\255\5\234\242U\215", ) == 0x0
 00512   444   NtWriteFile  (80, 0, 0, 0,  (80, 0, 0, 0, "0!(\336\226\14\353'\26\3V\15\206\376\227\254\15\34\27\213\337;\353u\302\225\26\13*\276\305\237\354&47\12Y\300Z[\320\373\213o\364+\2402\233rlN\3J\4{3\1\4?k\315w^\21\271\255DUX\273\1~\330\31@\260\5)\270Dd\20q\3436\353\226\12\213\377\3\316A\304v+2\27;\317\375)\26\0\271\266\235&\24A\272u\321(\242\205\316\213\353\200V\24\22\250\3244V*8\331\204\353\14nS@\260F\374\33;\373u\205\324\221\251V\257Y#]\211\30\235>\335\236\6)\201\3064\201\346<9\0\32\10\37\30U\301\22QVL\341WQ=\370\211;\27\323\270G>b;\254\314c\23$\2009\3\350\0\356\241\272H\367\373_\1\236\216_U\350\343`jv\300\276\261\4Oh\13URu\37x\5\315&G\4$Y\2\354\24wv\3330\331\200"\243\354\210\10RD\4;\270\341\214]\350\356\3\305\211\365\213\35T\27\32~N\353Q\362s\217\356w\14\334-,\200\3v;\31w;;c\250z\230\333\206\211\5\24\14v;b\203\275,tVr\205\12\307\325a\234\272\5E\250\230\17\337\251\342\304\257\252Xu\247Q9Eok\301\245\277\31\16\11\0\360\1D\20\344\26\1=\334\10\15\256[\277\220\240\10[\320\213\352\201\202n[\321\345\0\376\3\14\201\3025\233{\233\15\201\342\16\3069D(\354`_T\221\305E\2135\316\211\216"`<\316~\274\266\335jc\373\217v\12\335;{\10\271/\17\27\334\213\5\377v\36W\20+\373W\261\35v\276S\300B\245\353\116%\11\212\317\16\271\274\210\362\316&+\265\363\241\201\346\311\20\34464\235\353\3O\310\311a\335F\366+\6A\2048\326mo?\34$s\3\213\4;\357s\214", 10240, 0x0, 0, ... {status=0x0, info=10240}, ) \243\354\210\10RD\4;\270\341\214]\350\356\3\305\211\365\213\35T\27\32~N\353Q\362s\217\356w\14\334-,\200\3v;\31w;;c\250z\230\333\206\211\5\24\14v;b\203\275,tVr\205\12\307\325a\234\272\5E\250\230\17\337\251\342\304\257\252Xu\247Q9Eok\301\245\277\31\16\11\0\360\1D\20\344\26\1=\334\10\15\256[\277\220\240\10[\320\213\352\201\202n[\321\345\0\376\3\14\201\3025\233{\233\15\201\342\16\3069D(\354`_T\221\305E\2135\316\211\216 (80, 0, 0, 0, "0!(\336\226\14\353'\26\3V\15\206\376\227\254\15\34\27\213\337;\353u\302\225\26\13*\276\305\237\354&47\12Y\300Z[\320\373\213o\364+\2402\233rlN\3J\4{3\1\4?k\315w^\21\271\255DUX\273\1~\330\31@\260\5)\270Dd\20q\3436\353\226\12\213\377\3\316A\304v+2\27;\317\375)\26\0\271\266\235&\24A\272u\321(\242\205\316\213\353\200V\24\22\250\3244V*8\331\204\353\14nS@\260F\374\33;\373u\205\324\221\251V\257Y#]\211\30\235>\335\236\6)\201\3064\201\346<9\0\32\10\37\30U\301\22QVL\341WQ=\370\211;\27\323\270G>b;\254\314c\23$\2009\3\350\0\356\241\272H\367\373_\1\236\216_U\350\343`jv\300\276\261\4Oh\13URu\37x\5\315&G\4$Y\2\354\24wv\3330\331\200"\243\354\210\10RD\4;\270\341\214]\350\356\3\305\211\365\213\35T\27\32~N\353Q\362s\217\356w\14\334-,\200\3v;\31w;;c\250z\230\333\206\211\5\24\14v;b\203\275,tVr\205\12\307\325a\234\272\5E\250\230\17\337\251\342\304\257\252Xu\247Q9Eok\301\245\277\31\16\11\0\360\1D\20\344\26\1=\334\10\15\256[\277\220\240\10[\320\213\352\201\202n[\321\345\0\376\3\14\201\3025\233{\233\15\201\342\16\3069D(\354`_T\221\305E\2135\316\211\216"`<\316~\274\266\335jc\373\217v\12\335;{\10\271/\17\27\334\213\5\377v\36W\20+\373W\261\35v\276S\300B\245\353\116%\11\212\317\16\271\274\210\362\316&+\265\363\241\201\346\311\20\34464\235\353\3O\310\311a\335F\366+\6A\2048\326mo?\34$s\3\213\4;\357s\214", 10240, 0x0, 0, ... {status=0x0, info=10240}, ) , 10240, 0x0, 0, ... {status=0x0, info=10240}, ) == 0x0
 00513   444   NtReadFile  (68, 0, 0, 0, 10240, 0x0, 0, ... {status=0x0, info=10240},  (68, 0, 0, 0, 10240, 0x0, 0, ... {status=0x0, info=10240}, "\264`\255\275$w\30\335Zxk\14\255\304'\240\241\221\340\1\2514Z\365\301\206\14\262\30\302q\3pH\263\33`D\342\230=l.\16#\336\1\352\214\10\302\34\367f"\203^\327;\256\367\244[\216\257\35715TP\10\257\303\262b\370n\6!\30\202rq?\377\350\206\324\333B~11\352,/\21\220:#\2508\1f\5s}\14u"\271P\16\13\16\303\31d\1\207\216\311U\226[9\21s^\210\264\355K\201\177\255B}\24\353,9u\232$qQg[A\35\350\350\215\2545\261\212E\276y^\352\365\32u\247\3528R^\360M2\361\277u\230\241\227\300V\31P\351u\301\347\14\343\260}=+\210\255\317\315/\276\337m*\33\335\216\223\256tl\321\17\24'e\303\335\216\32;t\264\264\212E\226\367Y\346\2<\26sQ\15\315$\23\0\313\235\221\337S\26\311\303:-\231^\355\257\313\366 ~Mf\207\260\321\255J\221R\12O\326[\257\366Y\330\207\345\263\203\243L\377\232\346\220\25\212m\332\271"\214\315\331\261\206v\330s\2069\13\374\276O^\254\212j\106K K\260\271q\332\260[B`\256\304q\261~\356\302q\213W\375\5\341\34]v\213G\272\344\375\352\20@\252_\372I\230*\11\375\241\12$\212\240\214\314\2\265(\375\333\312J-\5\355\222#\11\257A\260d\376\333\1\21\263S>\35\376\333CX\262m\2\15\217\6#\276\342GY1\3558\356\351\346E@\254\32\261Hl\255J\377Z\4\242)\12/J\330\313\25-b\26XXH\256\322\376\255\204\301B\361\362\301\346\271\3\377\273?\3569\177\346%[\335\331\375U\343\253vX\306[\15\214\264\241\366\217\275k\20\313\254c\251\2448\13\212z\33\353\0\253W\356\0\247\314x\341\20\200\304\201", ) \203^\327;\256\367\244[\216\257\35715TP\10\257\303\262b\370n\6!\30\202rq?\377\350\206\324\333B~11\352,/\21\220:#\2508\1f\5s}\14u (68, 0, 0, 0, 10240, 0x0, 0, ... {status=0x0, info=10240}, "\264`\255\275$w\30\335Zxk\14\255\304'\240\241\221\340\1\2514Z\365\301\206\14\262\30\302q\3pH\263\33`D\342\230=l.\16#\336\1\352\214\10\302\34\367f"\203^\327;\256\367\244[\216\257\35715TP\10\257\303\262b\370n\6!\30\202rq?\377\350\206\324\333B~11\352,/\21\220:#\2508\1f\5s}\14u"\271P\16\13\16\303\31d\1\207\216\311U\226[9\21s^\210\264\355K\201\177\255B}\24\353,9u\232$qQg[A\35\350\350\215\2545\261\212E\276y^\352\365\32u\247\3528R^\360M2\361\277u\230\241\227\300V\31P\351u\301\347\14\343\260}=+\210\255\317\315/\276\337m*\33\335\216\223\256tl\321\17\24'e\303\335\216\32;t\264\264\212E\226\367Y\346\2<\26sQ\15\315$\23\0\313\235\221\337S\26\311\303:-\231^\355\257\313\366 ~Mf\207\260\321\255J\221R\12O\326[\257\366Y\330\207\345\263\203\243L\377\232\346\220\25\212m\332\271"\214\315\331\261\206v\330s\2069\13\374\276O^\254\212j\106K K\260\271q\332\260[B`\256\304q\261~\356\302q\213W\375\5\341\34]v\213G\272\344\375\352\20@\252_\372I\230*\11\375\241\12$\212\240\214\314\2\265(\375\333\312J-\5\355\222#\11\257A\260d\376\333\1\21\263S>\35\376\333CX\262m\2\15\217\6#\276\342GY1\3558\356\351\346E@\254\32\261Hl\255J\377Z\4\242)\12/J\330\313\25-b\26XXH\256\322\376\255\204\301B\361\362\301\346\271\3\377\273?\3569\177\346%[\335\331\375U\343\253vX\306[\15\214\264\241\366\217\275k\20\313\254c\251\2448\13\212z\33\353\0\253W\356\0\247\314x\341\20\200\304\201", ) \214\315\331\261\206v\330s\2069\13\374\276O^\254\212j\106K K\260\271q\332\260[B`\256\304q\261~\356\302q\213W\375\5\341\34]v\213G\272\344\375\352\20@\252_\372I\230*\11\375\241\12$\212\240\214\314\2\265(\375\333\312J-\5\355\222#\11\257A\260d\376\333\1\21\263S>\35\376\333CX\262m\2\15\217\6#\276\342GY1\3558\356\351\346E@\254\32\261Hl\255J\377Z\4\242)\12/J\330\313\25-b\26XXH\256\322\376\255\204\301B\361\362\301\346\271\3\377\273?\3569\177\346%[\335\331\375U\343\253vX\306[\15\214\264\241\366\217\275k\20\313\254c\251\2448\13\212z\33\353\0\253W\356\0\247\314x\341\20\200\304\201", ) == 0x0
 00514   444   NtWriteFile  (80, 0, 0, 0,  (80, 0, 0, 0, "\23-\213\274\203:>\334\3755M\15\12\211\1\241\6\334\306\0\16y|\364f\313*\263\277\217W\2\327\5\225\32\307\11\304\231\232!\10\17\204\223'\353+E\344\35P+\4\202\371\232\35\257P\351}\217\10P\210\222\31v\11\10\216\224c_#  \277\317Tp\230\262\316\207s\226d\177\226|\314-\210\\266;\204\345\36\0\301HU|\2538\4\270\367C-\17dTB\0 \303\357T1\26\37\20\324\23\256\265J\6\247~\12\17[\25La\37t=iWP\300\26g\34O\245\253\255\222\374\254D\314x\353RWS\246Mut_W\0\24\360\308\276\2400\215p\30\367\244S\300@A\305\261\332p\15\211\12\202\353.\31\222K+\274\220\250\222\119J\320\250Y\1dd\220\250\33\234905\23\307c\227P\24\300\3\233[UP\252\200\2\22\247\206\273\220x\360\310dw\13\230\371\240\211\312QmXL\301\312\226\320\12\7\267S\255\2\360Z\10\273\177\331 \250\225\202\4\1\331\233A\3353\213\312\227\237#+\200\377\260!;\376r!t-\375\31\2x\255-'.7\354mm\261\36<\374\261\374\17F\257c<\227\177I\217W\212\360\260#\340\273\20P\212\340\367\302\374M]f\253\370\267o\231\215L\27\374\6G\2\213\7\301\352\3\22e\333\332m\7\13\4J\337\5\10\10\14\226eY\226'\20\24\36\30\34Y\226eY\25 $\14(K\5\277E\12\1770Ju\310\350A\10f\255\275\374nm\12\7\331[\243\357\17\13\210\7\376\312\262`D\27\377\25n\257u\263\213\205f\17\327\363f\253\237\2X\366\31\357\2362\300$\374\220\377\374\362\256\215w\377\213}\14+\371\207\367(\360M\21l\341E\250\3u-\213\335V\315\1\14\32\310\1\0\201^\340\267\315\342\200", 10240, 0x0, 0, ... {status=0x0, info=10240}, ) , 10240, 0x0, 0, ... {status=0x0, info=10240}, ) == 0x0
 00515   444   NtReadFile  (68, 0, 0, 0, 10240, 0x0, 0, ... {status=0x0, info=10240},  (68, 0, 0, 0, 10240, 0x0, 0, ... {status=0x0, info=10240}, "\204\2703\204\301\13\332\7\2749\255\23\242\226.r\210\226\270\243\311y\34B9O\304\7\266\242&3\23?\310.\12\267\35\372\320\357[\30\27\;\352\;\311\376\313\262!\17\207\357\263\13\234\0\336~7N\36\1\247\374S\212\23\37\335yn\25\3531{*gaL\274\370\4\257\372\13\226C\313\272\230\2\245\366\17cU\220\374_J\316\12\323e?V\262\20\215\201\260\11\253^\243\3\234\25G{\14\33m\30>\25nT\236>\225v\21}M"\211\331@\314\246\15\177]\306\203\307\234\264\331\' \305\253\371\300nF \261\266$\262\313i\3460#\4\37\27 \14]\24\203\33_\2444\16,~xO\343\317\277\351\376\274\336\2276\315\222\37\27\251\226\16\215\315Q\31\264\316Z\222h\33E\200\3452\317u\341M;\246\217\315\247\20\4\230-\15\334`\375\212\277\34q\340\231\109\236\361\212\365\365\230|\215v\20\334q\2\203\262+\177r\210>^\224fr\225\33p\30\3001B\245$\33/\270\361\201\311g\12\246\7\277\2\265M\3577\263\265wo\0\345\267\13\355"\333\337\340\376$\317\264\360+\23\267U\34\236\31`\5\366\322\206\311\362\2\7I\371\357\367\263\35\4B\327j\272\3577l;\271w\302\310O#\347\273\35u`\350\275\246o\327\260\17\377\5\2646\0m\37g\300Y\201\217#\307\\336\272#,&-/\336%\371\322|\324\242\372\35w\350\14-\345\203\264)\36\212m\367>N\257U'\347\376\25r3'\344\350\371\363\377\366\263\265\365\364\23\260y1)\260f\326\322C\24\346b\361IE\16\241~\261Ed\371-\261\17\313~y\364Xv\377|L\247z0\300:\225\342J'\0\332[\273}\203a\316\1\323\306\24\\315Q`\355\266\271\14\360|\16\341jH;%]", ) \211\331@\314\246\15\177]\306\203\307\234\264\331\' \305\253\371\300nF \261\266$\262\313i\3460#\4\37\27 \14]\24\203\33_\2444\16,~xO\343\317\277\351\376\274\336\2276\315\222\37\27\251\226\16\215\315Q\31\264\316Z\222h\33E\200\3452\317u\341M;\246\217\315\247\20\4\230-\15\334`\375\212\277\34q\340\231\109\236\361\212\365\365\230|\215v\20\334q\2\203\262+\177r\210>^\224fr\225\33p\30\3001B\245$\33/\270\361\201\311g\12\246\7\277\2\265M\3577\263\265wo\0\345\267\13\355 (68, 0, 0, 0, 10240, 0x0, 0, ... {status=0x0, info=10240}, "\204\2703\204\301\13\332\7\2749\255\23\242\226.r\210\226\270\243\311y\34B9O\304\7\266\242&3\23?\310.\12\267\35\372\320\357[\30\27\;\352\;\311\376\313\262!\17\207\357\263\13\234\0\336~7N\36\1\247\374S\212\23\37\335yn\25\3531{*gaL\274\370\4\257\372\13\226C\313\272\230\2\245\366\17cU\220\374_J\316\12\323e?V\262\20\215\201\260\11\253^\243\3\234\25G{\14\33m\30>\25nT\236>\225v\21}M"\211\331@\314\246\15\177]\306\203\307\234\264\331\' \305\253\371\300nF \261\266$\262\313i\3460#\4\37\27 \14]\24\203\33_\2444\16,~xO\343\317\277\351\376\274\336\2276\315\222\37\27\251\226\16\215\315Q\31\264\316Z\222h\33E\200\3452\317u\341M;\246\217\315\247\20\4\230-\15\334`\375\212\277\34q\340\231\109\236\361\212\365\365\230|\215v\20\334q\2\203\262+\177r\210>^\224fr\225\33p\30\3001B\245$\33/\270\361\201\311g\12\246\7\277\2\265M\3577\263\265wo\0\345\267\13\355"\333\337\340\376$\317\264\360+\23\267U\34\236\31`\5\366\322\206\311\362\2\7I\371\357\367\263\35\4B\327j\272\3577l;\271w\302\310O#\347\273\35u`\350\275\246o\327\260\17\377\5\2646\0m\37g\300Y\201\217#\307\\336\272#,&-/\336%\371\322|\324\242\372\35w\350\14-\345\203\264)\36\212m\367>N\257U'\347\376\25r3'\344\350\371\363\377\366\263\265\365\364\23\260y1)\260f\326\322C\24\346b\361IE\16\241~\261Ed\371-\261\17\313~y\364Xv\377|L\247z0\300:\225\342J'\0\332[\273}\203a\316\1\323\306\24\\315Q`\355\266\271\14\360|\16\341jH;%]", ) , ) == 0x0
 00516   444   NtWriteFile  (80, 0, 0, 0,  (80, 0, 0, 0, "#\365\25\205fF\374\6\33t\213\22\5\333\10s/\333\236\242n4:C\236\2\342\6\21\357\02\264r\356/\255\372;\373w\242}\31\260\21\35\353\373v\357\377l\377\7\16 \242\225\12;M\370\177\220\38\0\0\261u\213\264R\373x\311X\3150\334gA`\353\361\336\5\10\267-\227\344\206\234\231\245\350\320\16\304\30\266\375\370\7\350\13t(\31W\25]\253\200\27D\215_\4N\272\24\3406*\32\312U\30\24\311\31\270?2;7|\352o\257\330\347\201\200\14\330\20\340\202`\321\222\330\373j\6\304\14\264\346o\341m\227\267\203\377\355hA}\5\5\270Z\6\15\372Y\245\32\370\351\22\17\2133^ND\202\231\350Y\361\370\226\221\200\264\36\260\344\260\17*\200w\30\23\203|\223\317Vc\201B\177\351tF\0\35\247(\200\201\21\243\325\13\14{-\333\213\30QW\341>E\37\237V\307\323\364?1\253w\267\221W\3$\377\15~\325\305\30_3+T\224\274=>\301\226\17\203%\274b\236\360&\204A\13\1J\231\3\22\0\3116\24\370Qn\247\250\221\12Jo\375\336G\263\2\316\23\275\15\22\20\30:\237\276-#\367u\313\357\363\245Jo\370H\272\225\34\243\17\361k\35\242\21m\234\364Q\303o\2\5\346\34PSaO\360\200np\375)\376\242\371\20\1\312RA\301\376\314\251"`\21\370\273\204a\0,\210\223\3\370u1\362\243]PQ\351\253`\303\202\23d8\213\312\272\30O\10\30\1\346YXT2\200\251\316\370T\262\320\262\22\270\322\22\274\27(\27+\360\323\344Y\300cV\4c\17\63\227D\303\264\13\260\250\206XxS\25P\376\333\1\201{\227\215\34\224E\7\1\1}\26\235|$,\350\0t\2132]j\34F\354\21\364*\361\333C\307k\357v\3\", 10240, 0x0, 0, ... {status=0x0, info=10240}, ) `\21\370\273\204a\0,\210\223\3\370u1\362\243]PQ\351\253`\303\202\23d8\213\312\272\30O\10\30\1\346YXT2\200\251\316\370T\262\320\262\22\270\322\22\274\27(\27+\360\323\344Y\300cV\4c\17\63\227D\303\264\13\260\250\206XxS\25P\376\333\1\201{\227\215\34\224E\7\1\1}\26\235|$,\350\0t\2132]j\34F\354\21\364*\361\333C\307k\357v\3\", 10240, 0x0, 0, ... {status=0x0, info=10240}, ) == 0x0
 00517   444   NtReadFile  (68, 0, 0, 0, 10240, 0x0, 0, ... {status=0x0, info=10240},  (68, 0, 0, 0, 10240, 0x0, 0, ... {status=0x0, info=10240}, "\304\3> \213v\5\265=NPC\346\31-E\263LEu\347\3Bu\263*g\15o(\353\5\263u\5\221\13\6\261=$iz\311\230\5\317_\306\321\256\232\345\25\5\365\344\204C)\333\4*\241\17\23r\4\324R\356\2\246\346lE\242\16>\317\240\204\355I\246NC\31\247s\2\312\5g\376\6w\237\254@\215\315\266\205\343\267"\230'\206/;\207\10p\6~\246\10L\213:"\307\254\251j\200\344\15\21\2Q\205|*\344\301-}\317\15h\233\263L\272\2557\332\327K\240\2\200\356\366\20\360+\334bw\275T\332%$\27!&N\30\2\7\232\307\222b\25\343y.J\241\241C\12\343]\59\24Z\357\214#\164\25\343\251\365\15\337I4R\342E\235\10\236\330\272R\222\10\36\34e\35\376R\273"^2\253\332\33\2053\22\355D\17\22r`\33\205P.\362E\325D\177"\367\266k9s\302(B\22u\210t\267^\342\261`\31\310\331l\233\212\334\5I\37\312\246\221\274!%vI\367kq<\32a\31\244*!\247\307m\237\0%j'\270\317N\337!^M55\247\32\36\216ZK\302\1\366\255$h\25\35T\2\362)@U\263\202VU\247m\244+\37\224\210\26\365u6\345\320\33\357'\240U0Q\266:p\0\22\2037\26\>\346\355\13G\33\346\230\36F\21\267\337'D\227\331vUG\263\31Ro\I\350\35\241\242\347\254\31t\3x\21\355\31\207\374\260\335|N\250q\246_\315\3l\12\232\366\215\264Z\5\247\12\376I\263nl/\344\4\2369\376\205 \245\255Uz\243\243\266*\3\35286\256\357NB\3\5\353~i\314\250Aq\274T\302\2\10a\357\361\236\272"\5\264\335$\2u@"\267\253M&\11\273N\354\227\223Nf!\264\360\243L", ) \230'\206/;\207\10p\6~\246\10L\213: (68, 0, 0, 0, 10240, 0x0, 0, ... {status=0x0, info=10240}, "\304\3> \213v\5\265=NPC\346\31-E\263LEu\347\3Bu\263*g\15o(\353\5\263u\5\221\13\6\261=$iz\311\230\5\317_\306\321\256\232\345\25\5\365\344\204C)\333\4*\241\17\23r\4\324R\356\2\246\346lE\242\16>\317\240\204\355I\246NC\31\247s\2\312\5g\376\6w\237\254@\215\315\266\205\343\267"\230'\206/;\207\10p\6~\246\10L\213:"\307\254\251j\200\344\15\21\2Q\205|*\344\301-}\317\15h\233\263L\272\2557\332\327K\240\2\200\356\366\20\360+\334bw\275T\332%$\27!&N\30\2\7\232\307\222b\25\343y.J\241\241C\12\343]\59\24Z\357\214#\164\25\343\251\365\15\337I4R\342E\235\10\236\330\272R\222\10\36\34e\35\376R\273"^2\253\332\33\2053\22\355D\17\22r`\33\205P.\362E\325D\177"\367\266k9s\302(B\22u\210t\267^\342\261`\31\310\331l\233\212\334\5I\37\312\246\221\274!%vI\367kq<\32a\31\244*!\247\307m\237\0%j'\270\317N\337!^M55\247\32\36\216ZK\302\1\366\255$h\25\35T\2\362)@U\263\202VU\247m\244+\37\224\210\26\365u6\345\320\33\357'\240U0Q\266:p\0\22\2037\26\>\346\355\13G\33\346\230\36F\21\267\337'D\227\331vUG\263\31Ro\I\350\35\241\242\347\254\31t\3x\21\355\31\207\374\260\335|N\250q\246_\315\3l\12\232\366\215\264Z\5\247\12\376I\263nl/\344\4\2369\376\205 \245\255Uz\243\243\266*\3\35286\256\357NB\3\5\353~i\314\250Aq\274T\302\2\10a\357\361\236\272"\5\264\335$\2u@"\267\253M&\11\273N\354\227\223Nf!\264\360\243L", ) ^2\253\332\33\2053\22\355D\17\22r`\33\205P.\362E\325D\177 (68, 0, 0, 0, 10240, 0x0, 0, ... {status=0x0, info=10240}, "\304\3> \213v\5\265=NPC\346\31-E\263LEu\347\3Bu\263*g\15o(\353\5\263u\5\221\13\6\261=$iz\311\230\5\317_\306\321\256\232\345\25\5\365\344\204C)\333\4*\241\17\23r\4\324R\356\2\246\346lE\242\16>\317\240\204\355I\246NC\31\247s\2\312\5g\376\6w\237\254@\215\315\266\205\343\267"\230'\206/;\207\10p\6~\246\10L\213:"\307\254\251j\200\344\15\21\2Q\205|*\344\301-}\317\15h\233\263L\272\2557\332\327K\240\2\200\356\366\20\360+\334bw\275T\332%$\27!&N\30\2\7\232\307\222b\25\343y.J\241\241C\12\343]\59\24Z\357\214#\164\25\343\251\365\15\337I4R\342E\235\10\236\330\272R\222\10\36\34e\35\376R\273"^2\253\332\33\2053\22\355D\17\22r`\33\205P.\362E\325D\177"\367\266k9s\302(B\22u\210t\267^\342\261`\31\310\331l\233\212\334\5I\37\312\246\221\274!%vI\367kq<\32a\31\244*!\247\307m\237\0%j'\270\317N\337!^M55\247\32\36\216ZK\302\1\366\255$h\25\35T\2\362)@U\263\202VU\247m\244+\37\224\210\26\365u6\345\320\33\357'\240U0Q\266:p\0\22\2037\26\>\346\355\13G\33\346\230\36F\21\267\337'D\227\331vUG\263\31Ro\I\350\35\241\242\347\254\31t\3x\21\355\31\207\374\260\335|N\250q\246_\315\3l\12\232\366\215\264Z\5\247\12\376I\263nl/\344\4\2369\376\205 \245\255Uz\243\243\266*\3\35286\256\357NB\3\5\353~i\314\250Aq\274T\302\2\10a\357\361\236\272"\5\264\335$\2u@"\267\253M&\11\273N\354\227\223Nf!\264\360\243L", ) \5\264\335$\2u@ (68, 0, 0, 0, 10240, 0x0, 0, ... {status=0x0, info=10240}, "\304\3> \213v\5\265=NPC\346\31-E\263LEu\347\3Bu\263*g\15o(\353\5\263u\5\221\13\6\261=$iz\311\230\5\317_\306\321\256\232\345\25\5\365\344\204C)\333\4*\241\17\23r\4\324R\356\2\246\346lE\242\16>\317\240\204\355I\246NC\31\247s\2\312\5g\376\6w\237\254@\215\315\266\205\343\267"\230'\206/;\207\10p\6~\246\10L\213:"\307\254\251j\200\344\15\21\2Q\205|*\344\301-}\317\15h\233\263L\272\2557\332\327K\240\2\200\356\366\20\360+\334bw\275T\332%$\27!&N\30\2\7\232\307\222b\25\343y.J\241\241C\12\343]\59\24Z\357\214#\164\25\343\251\365\15\337I4R\342E\235\10\236\330\272R\222\10\36\34e\35\376R\273"^2\253\332\33\2053\22\355D\17\22r`\33\205P.\362E\325D\177"\367\266k9s\302(B\22u\210t\267^\342\261`\31\310\331l\233\212\334\5I\37\312\246\221\274!%vI\367kq<\32a\31\244*!\247\307m\237\0%j'\270\317N\337!^M55\247\32\36\216ZK\302\1\366\255$h\25\35T\2\362)@U\263\202VU\247m\244+\37\224\210\26\365u6\345\320\33\357'\240U0Q\266:p\0\22\2037\26\>\346\355\13G\33\346\230\36F\21\267\337'D\227\331vUG\263\31Ro\I\350\35\241\242\347\254\31t\3x\21\355\31\207\374\260\335|N\250q\246_\315\3l\12\232\366\215\264Z\5\247\12\376I\263nl/\344\4\2369\376\205 \245\255Uz\243\243\266*\3\35286\256\357NB\3\5\353~i\314\250Aq\274T\302\2\10a\357\361\236\272"\5\264\335$\2u@"\267\253M&\11\273N\354\227\223Nf!\264\360\243L", ) , ) == 0x0
 00518   444   NtWriteFile  (80, 0, 0, 0,  (80, 0, 0, 0, "cN\30!,;#\264\232\3vBAT\13D\24\1ct@Ndt\24gA\14\310e\315\4\248#\220\254K\227<\203$\\310?H\351^a\234\210\233BX#\364C\311e(|I\14\240\250^T\5s\37\310\3\1\253JD\5C\30\316\7\311\313H\1\3e\30\0>$\313\242*\330\7\320\322\212A*\200\220\204D\372\4\231\200\313\11: EV\7\331\353.M,w\4\306\13\344L\201C@7\3\366\310Z+C\214\13|h@N\232\24\1\234\254\220\227\361J\7O\246\357Q]\326*{/Q\274\363\227\3%\260l\0O\277O!\233`\337D\24D4\10K\6\354e\13D\20#8\263\27\311\215\204C\22\24D\344\323\14x\4\22SE\10\273\119\225\234S5E8\35\302P\330S\34ox3\14\227=\204\224_\313E\250_Ta\274\310v/U\10\363E\330o\321\267\314tU\303\217\174t/9\221_E\374F\30o\224J\232-\221#H\270\207\200\220\33l\3w\356\272Mp\233WG\30\3g\7\246` \271\1\202'\1\271h\3\371 \371\0\234\0W8\217\375\6\344\0Q\340\2i\262Pr\3UdfT\24\317pT\0 \202*\270\331\256\27R8\20\344wV\311&\7\30\26P\21wV\1\265\316\21\27\373s\300\354\254\12=\347?S`\20\20\222\1E0\224PT\340\376?S\310\21o\351\272\354\204\346\13TR\2\337\\313\30 \261\226\334\333\3\216p\1\22\353\2\313G\274\367*\371|\4\0G\330H\24#J.CI\2708Y\310\6\244\12\30\\242\4\373\14\2Mu\20\257H\3d\2\242\246Xhk\345gp\33\31\344\3\257,\311\3609\367\4\4\23\220\2\3\322\15\4\266\14\0\0\10\34\3\312\2264\3@ \23\275\205M", 10240, 0x0, 0, ... {status=0x0, info=10240}, ) , 10240, 0x0, 0, ... {status=0x0, info=10240}, ) == 0x0
 00519   444   NtReadFile  (68, 0, 0, 0, 10240, 0x0, 0, ... {status=0x0, info=10240},  (68, 0, 0, 0, 10240, 0x0, 0, ... {status=0x0, info=10240}, "=\156\215\245Q6\204,\34=\26gvj9\366l\303S\312\352p\211W\363%}m!\270\10\207\23\266\347\274\215\343iQB\13\331\267|\226GL\261j\14\303F]\300\253M\376\16\233G`\20c[zj]m@@\272L\362j\357\336,\344D\253\256`\310\225-*\254!\220\215\205\3636\200\245\357\315\300\30L@A\33\224\15w)C\376\263\207\15)\20\27}\276\314\355\177k\262Kh\275A\337C\240\15n\2004\227\217\5(\12\203\15\345A\267\10\254\260\376V\247}\303G/\220\220\326#\21\0\u\361\32\216\224\10\356FzC`N8\356\20A\340\216Y\17v\260#gz\202\306\214d\21-\266\0\365\257\317\214\210\235\374J\27\3\3034\15\201>\27\3520O\275\10\311i6rfc\\267\236\20\10X+\177A\21|9v\4\24G\17\371\25D\355\353\260\371\351;\253i=C\367Gr\21\257["L\241\34\12\3\243\211Ye\242&2\7\341\351\266\10\261F\244\243\314k8"\376P$, ) L\241\34\12\3\243\211Ye\242&2\7\341\351\266\10\261F\244\243\314k8 (68, 0, 0, 0, 10240, 0x0, 0, ... {status=0x0, info=10240}, "=\156\215\245Q6\204,\34=\26gvj9\366l\303S\312\352p\211W\363%}m!\270\10\207\23\266\347\274\215\343iQB\13\331\267|\226GL\261j\14\303F]\300\253M\376\16\233G`\20c[zj]m@@\272L\362j\357\336,\344D\253\256`\310\225-*\254!\220\215\205\3636\200\245\357\315\300\30L@A\33\224\15w)C\376\263\207\15)\20\27}\276\314\355\177k\262Kh\275A\337C\240\15n\2004\227\217\5(\12\203\15\345A\267\10\254\260\376V\247}\303G/\220\220\326#\21\0\u\361\32\216\224\10\356FzC`N8\356\20A\340\216Y\17v\260#gz\202\306\214d\21-\266\0\365\257\317\214\210\235\374J\27\3\3034\15\201>\27\3520O\275\10\311i6rfc\\267\236\20\10X+\177A\21|9v\4\24G\17\371\25D\355\353\260\371\351;\253i=C\367Gr\21\257["L\241\34\12\3\243\211Ye\242&2\7\341\351\266\10\261F\244\243\314k8"\376P$, ) , ) == 0x0
 00520   444   NtWriteFile  (80, 0, 0, 0,  (80, 0, 0, 0, "\232@\20\214\2\34\20\205\213Q\33\27\300;L8Q!\345Rm\247V\210\360\276\3|\312l\236\11 ^\220\346\33\300\305h\366\17-\330\201\260F\353\374L\15d\13{\301\14\0\330\17<\12F\21\304\26\k\372 fA\35\1\324kH\223\12\345\343\346\210ao\330\13+\13l\266\214"\276\20\201\2\242\353\301\277\1f@\274\331+v\216\16\330\262 @\17\21\2600\230\315J2M\263\354%\233@x\16\206\14\311\315\22\226(H\16\13$@\303@\20E\212\261Y\33\201|d\12\11\2217\233\5\20\247\21S\360\275\303\262\11I\13\B\307\3\36\357\267\14\306\217\376BP\261\204*\\203a\301B\20\212\373&\364\10\202\252\211:\261l\26\244\216\22\14&s1\353\227\2\233\11n$\20s\301.z\2669].Y\2142g\20\333tP\5\263\12)\370\262\11\313\352\27\264\317:\14$\33BP\12T\20\10\26\4M\6Q,\2\4\304\177d\5k\24\6F\244\220\11\26\13\202\242k&\36#Y\35\2=\350\314\230\5\341\225\3438\20\33\31\263\5Ot\242\352\22\226\260\23)5\26;\30\6\234Ve;;\304bL\20\214\23\243\10`\2638$\254'\21IH\230k\4\160p\232-{\21n\15\350`\300\203a0\211/,\331\214\331p\24\2\374\16#\250\30\302X\337\\311\236-\17ub\236EVQ\21\4\36\17\22B\14F@\177R\262C\312\12\262\14\335\276\10\322\260\242S\344m\4lY\303\253F\16\202\31\263%\235\17\242\3363t\313F\321l\106\14`\237)"\375\272A\14X\300\340a, 10240, 0x0, 0, ... {status=0x0, info=10240}, ) \276\20\201\2\242\353\301\277\1f@\274\331+v\216\16\330\262 @\17\21\2600\230\315J2M\263\354%\233@x\16\206\14\311\315\22\226(H\16\13$@\303@\20E\212\261Y\33\201|d\12\11\2217\233\5\20\247\21S\360\275\303\262\11I\13\B\307\3\36\357\267\14\306\217\376BP\261\204*\\203a\301B\20\212\373&\364\10\202\252\211:\261l\26\244\216\22\14&s1\353\227\2\233\11n$\20s\301.z\2669].Y\2142g\20\333tP\5\263\12)\370\262\11\313\352\27\264\317:\14$\33BP\12T\20\10\26\4M\6Q,\2\4\304\177d\5k\24\6F\244\220\11\26\13\202\242k&\36#Y\35\2=\350\314\230\5\341\225\3438\20\33\31\263\5Ot\242\352\22\226\260\23)5\26;\30\6\234Ve;;\304bL\20\214\23\243\10`\2638$\254'\21IH\230k\4\160p\232-{\21n\15\350`\300\203a0\211/,\331\214\331p\24\2\374\16#\250\30\302X\337\\311\236-\17ub\236EVQ\21\4\36\17\22B\14F@\177R\262C\312\12\262\14\335\276\10\322\260\242S\344m\4lY\303\253F\16\202\31\263%\235\17\242\3363t\313F\321l\106\14`\237) (80, 0, 0, 0, "\232@\20\214\2\34\20\205\213Q\33\27\300;L8Q!\345Rm\247V\210\360\276\3|\312l\236\11 ^\220\346\33\300\305h\366\17-\330\201\260F\353\374L\15d\13{\301\14\0\330\17<\12F\21\304\26\k\372 fA\35\1\324kH\223\12\345\343\346\210ao\330\13+\13l\266\214"\276\20\201\2\242\353\301\277\1f@\274\331+v\216\16\330\262 @\17\21\2600\230\315J2M\263\354%\233@x\16\206\14\311\315\22\226(H\16\13$@\303@\20E\212\261Y\33\201|d\12\11\2217\233\5\20\247\21S\360\275\303\262\11I\13\B\307\3\36\357\267\14\306\217\376BP\261\204*\\203a\301B\20\212\373&\364\10\202\252\211:\261l\26\244\216\22\14&s1\353\227\2\233\11n$\20s\301.z\2669].Y\2142g\20\333tP\5\263\12)\370\262\11\313\352\27\264\317:\14$\33BP\12T\20\10\26\4M\6Q,\2\4\304\177d\5k\24\6F\244\220\11\26\13\202\242k&\36#Y\35\2=\350\314\230\5\341\225\3438\20\33\31\263\5Ot\242\352\22\226\260\23)5\26;\30\6\234Ve;;\304bL\20\214\23\243\10`\2638$\254'\21IH\230k\4\160p\232-{\21n\15\350`\300\203a0\211/,\331\214\331p\24\2\374\16#\250\30\302X\337\\311\236-\17ub\236EVQ\21\4\36\17\22B\14F@\177R\262C\312\12\262\14\335\276\10\322\260\242S\344m\4lY\303\253F\16\202\31\263%\235\17\242\3363t\313F\321l\106\14`\237)"\375\272A\14X\300\340a, 10240, 0x0, 0, ... {status=0x0, info=10240}, ) , 10240, 0x0, 0, ... {status=0x0, info=10240}, ) == 0x0
 00521   444   NtReadFile  (68, 0, 0, 0, 2048, 0x0, 0, ... {status=0x0, info=2048},  (68, 0, 0, 0, 2048, 0x0, 0, ... {status=0x0, info=2048}, "\347\6&\1\367\6&\1\303\26&\1\323\26&\1C$&\1S$&\1\243'&\1\253'&\1\263'&\1\273'&\1\203'&\1\213'&\1\223'&\1\233'&\1\343'&\1\353'&\1\7'&\1\23'&\1\177'&\1\273&&\1\367&&\1\17&&\1w&&\1\267!&\17!&\1O!&\1##&\1W"&\1\227=&\1\263<&\1\7<&\1\323>&\1\3338&\1\343:&\1\2175&\1o5&\1\3574&\1/4&\1\3337&\1;7&\1g7&\1W7&\1?\16#\1G\16#\1pd!\1Ld!\1\245g!\1\275g!\1\223g!\1\351g!\1\316g!\1#g!\1\7g!\1\36g!\1sg!\1Og!\1Yg!\1\265f!\1\217f!\1\346f!\1\367f!\1\332f!\11f!\1\20f!\1vf!\1_f!\1\274a!\1\355a!\1\310a!\15a!\1fa!\1Fa!\1\243`!\1\236`!\1\300`!\1\333`!\15`!\1\15`!\1g`!\1q`!\1K`!\1\246c!\1\275c!\1\210c!\1\343c!\1\371c!\1\336c!\1#c!\1-c!\14c!\18c!\1\273M0\1\260M?\1\263M>\1\262M<\1\243M%\1\257M!\1\241M#\1\214M=\1\272M8\1\203M\6\1\217M\14\1\216M\7\1\204M\4\1\270M\3\1\201M\1\1\264M7\1\265M*\1\267M(\1\250M+\1\254M,\1\256M\12\1\247M$\1\246M\10\1\212M&\1\247M&\1\247M&\1\247M&A\2035V%\226\177hl\322)VA\363\3kT\343\35&A\2035V%\226xhl", ) &\1\227=&\1\263<&\1\7<&\1\323>&\1\3338&\1\343:&\1\2175&\1o5&\1\3574&\1/4&\1\3337&\1;7&\1g7&\1W7&\1?\16#\1G\16#\1pd!\1Ld!\1\245g!\1\275g!\1\223g!\1\351g!\1\316g!\1#g!\1\7g!\1\36g!\1sg!\1Og!\1Yg!\1\265f!\1\217f!\1\346f!\1\367f!\1\332f!\11f!\1\20f!\1vf!\1_f!\1\274a!\1\355a!\1\310a!\15a!\1fa!\1Fa!\1\243`!\1\236`!\1\300`!\1\333`!\15`!\1\15`!\1g`!\1q`!\1K`!\1\246c!\1\275c!\1\210c!\1\343c!\1\371c!\1\336c!\1#c!\1-c!\14c!\18c!\1\273M0\1\260M?\1\263M>\1\262M<\1\243M%\1\257M!\1\241M#\1\214M=\1\272M8\1\203M\6\1\217M\14\1\216M\7\1\204M\4\1\270M\3\1\201M\1\1\264M7\1\265M*\1\267M(\1\250M+\1\254M,\1\256M\12\1\247M$\1\246M\10\1\212M&\1\247M&\1\247M&\1\247M&A\2035V%\226\177hl\322)VA\363\3kT\343\35&A\2035V%\226xhl", ) == 0x0
 00522   444   NtWriteFile  (80, 0, 0, 0,  (80, 0, 0, 0, "@K\0\0PK\0\0d[\0\0t[\0\0\344i\0\0\364i\0\0\4j\0\0\14j\0\0\24j\0\0\34j\0\0$j\0\0,j\0\04j\0\0\0\37\0%\0&\0'\0\23\0\21\0\22\0\14\0\20\0\16\0\17\0\15\0\13\0\12\0\11\0,\0\0\0\2\0\1\0.\0-\0\0\0\0\0\0\0\0\0\0\0\0\0\0@$xp$12Nmudp@TNMUDP\0@$xp$15Nm", 2048, 0x0, 0, ... {status=0x0, info=2048}, ) \0\37\0%\0&\0'\0\23\0\21\0\22\0\14\0\20\0\16\0\17\0\15\0\13\0\12\0\11\0,\0\0\0\2\0\1\0.\0-\0\0\0\0\0\0\0\0\0\0\0\0\0\0@$xp$12Nmudp@TNMUDP\0@$xp$15Nm", 2048, 0x0, 0, ... {status=0x0, info=2048}, ) == 0x0
 00523   444   NtClose  (80, ... ) == 0x0
 00524   444   NtClose  (68, ... ) == 0x0
 00525   444   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\DOCUME~1\SRI-user\LOCALS~1\Temp\yka1.tmp"}, 1242420, ... ) }, 1242420, ... ) == 0x0
 00526   444   NtOpenFile  (0x100020, {24, 0, 0x40, 0, 0,  (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\DOCUME~1\SRI-user\LOCALS~1\Temp\yka1.tmp"}, 5, 96, ... 68, {status=0x0, info=1}, ) }, 5, 96, ... 68, {status=0x0, info=1}, ) == 0x0
 00527   444   NtCreateSection  (0xe, 0x0, 0x0, 16, 134217728, 68, ... 80, ) == 0x0
 00528   444   NtClose  (68, ... ) == 0x0
 00529   444   NtMapViewOfSection  (80, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 16, ... (0x860000), 0x0, 176128, ) == 0x0
 00530   444   NtClose  (80, ... ) == 0x0
 00531   444   NtUnmapViewOfSection  (-1, 0x860000, ... ) == 0x0
 00532   444   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\DOCUME~1\SRI-user\LOCALS~1\Temp\yka1.tmp"}, 1242736, ... ) }, 1242736, ... ) == 0x0
 00533   444   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\DOCUME~1\SRI-user\LOCALS~1\Temp\yka1.tmp"}, 1242736, ... ) }, 1242736, ... ) == 0x0
 00534   444   NtOpenFile  (0x100020, {24, 0, 0x40, 0, 0,  (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\DOCUME~1\SRI-user\LOCALS~1\Temp\yka1.tmp"}, 5, 96, ... 80, {status=0x0, info=1}, ) }, 5, 96, ... 80, {status=0x0, info=1}, ) == 0x0
 00535   444   NtCreateSection  (0xf, 0x0, 0x0, 16, 16777216, 80, ... 68, ) == 0x0
 00536   444   NtQuerySection  (68, Image, 48, ... {section info, class 1, size 48}, 0x0, ) == 0x0
 00537   444   NtClose  (80, ... ) == 0x0
 00538   444   NtMapViewOfSection  (68, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x860000), 0x0, 471040, ) == STATUS_IMAGE_NOT_AT_BASE
 00539   444   NtMapViewOfSection  (68, -1, (0x860000), 0, 0, 0x0, 471040, 1, 0, 4, ... ) == STATUS_CONFLICTING_ADDRESSES
 00540   444   NtFlushInstructionCache  (-1, 0, 0, ... ) == 0x0
 00541   444   NtClose  (68, ... ) == 0x0
 00542   444   NtProtectVirtualMemory  (-1, (0x8d2000), 4096, 4, ... (0x8d2000), 4096, 8, ) == 0x0
 00543   444   NtProtectVirtualMemory  (-1, (0x8d2000), 4096, 8, ... (0x8d2000), 4096, 4, ) == 0x0
 00544   444   NtFlushInstructionCache  (-1, 9248768, 4096, ... ) == 0x0
 00545   444   NtProtectVirtualMemory  (-1, (0x8d2000), 4096, 4, ... (0x8d2000), 4096, 4, ) == 0x0
 00546   444   NtProtectVirtualMemory  (-1, (0x8d2000), 4096, 4, ... (0x8d2000), 4096, 4, ) == 0x0
 00547   444   NtFlushInstructionCache  (-1, 9248768, 4096, ... ) == 0x0
 00548   444   NtOpenSection  (0xe, {24, 8, 0x40, 0, 0,  (0xe, {24, 8, 0x40, 0, 0, "COMCTL32.DLL"}, ... 68, ) }, ... 68, ) == 0x0
 00549   444   NtMapViewOfSection  (68, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x77340000), 0x0, 569344, ) == 0x0
 00550   444   NtClose  (68, ... ) == 0x0
 00551   444   NtProtectVirtualMemory  (-1, (0x8d2000), 4096, 4, ... (0x8d2000), 4096, 4, ) == 0x0
 00552   444   NtProtectVirtualMemory  (-1, (0x8d2000), 4096, 4, ... (0x8d2000), 4096, 4, ) == 0x0
 00553   444   NtFlushInstructionCache  (-1, 9248768, 4096, ... ) == 0x0
 00554   444   NtProtectVirtualMemory  (-1, (0x8d2000), 4096, 4, ... (0x8d2000), 4096, 4, ) == 0x0
 00555   444   NtProtectVirtualMemory  (-1, (0x8d2000), 4096, 4, ... (0x8d2000), 4096, 4, ) == 0x0
 00556   444   NtFlushInstructionCache  (-1, 9248768, 4096, ... ) == 0x0
 00557   444   NtOpenSection  (0xe, {24, 8, 0x40, 0, 0,  (0xe, {24, 8, 0x40, 0, 0, "MPR.DLL"}, ... 68, ) }, ... 68, ) == 0x0
 00558   444   NtMapViewOfSection  (68, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x71b20000), 0x0, 69632, ) == 0x0
 00559   444   NtClose  (68, ... ) == 0x0
 00560   444   NtProtectVirtualMemory  (-1, (0x8d2000), 4096, 4, ... (0x8d2000), 4096, 4, ) == 0x0
 00561   444   NtProtectVirtualMemory  (-1, (0x8d2000), 4096, 4, ... (0x8d2000), 4096, 4, ) == 0x0
 00562   444   NtFlushInstructionCache  (-1, 9248768, 4096, ... ) == 0x0
 00563   444   NtProtectVirtualMemory  (-1, (0x8d2000), 4096, 4, ... (0x8d2000), 4096, 4, ) == 0x0
 00564   444   NtProtectVirtualMemory  (-1, (0x8d2000), 4096, 4, ... (0x8d2000), 4096, 4, ) == 0x0
 00565   444   NtFlushInstructionCache  (-1, 9248768, 4096, ... ) == 0x0
 00566   444   NtProtectVirtualMemory  (-1, (0x8d2000), 4096, 4, ... (0x8d2000), 4096, 4, ) == 0x0
 00567   444   NtProtectVirtualMemory  (-1, (0x8d2000), 4096, 4, ... (0x8d2000), 4096, 4, ) == 0x0
 00568   444   NtFlushInstructionCache  (-1, 9248768, 4096, ... ) == 0x0
 00569   444   NtProtectVirtualMemory  (-1, (0x8d2000), 4096, 4, ... (0x8d2000), 4096, 4, ) == 0x0
 00570   444   NtProtectVirtualMemory  (-1, (0x8d2000), 4096, 4, ... (0x8d2000), 4096, 4, ) == 0x0
 00571   444   NtFlushInstructionCache  (-1, 9248768, 4096, ... ) == 0x0
 00572   444   NtOpenSection  (0xe, {24, 8, 0x40, 0, 0,  (0xe, {24, 8, 0x40, 0, 0, "WSOCK32.DLL"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00573   444   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\u:\work\WSOCK32.DLL"}, 1241952, ... ) }, 1241952, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00574   444   NtQueryAttributesFile  ({24, 12, 0x40, 0, 0,  ({24, 12, 0x40, 0, 0, "WSOCK32.DLL"}, 1241952, ... ) }, 1241952, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00575   444   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\System32\WSOCK32.DLL"}, 1241952, ... ) }, 1241952, ... ) == 0x0
 00576   444   NtOpenFile  (0x100020, {24, 0, 0x40, 0, 0,  (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\System32\WSOCK32.DLL"}, 5, 96, ... 68, {status=0x0, info=1}, ) }, 5, 96, ... 68, {status=0x0, info=1}, ) == 0x0
 00577   444   NtCreateSection  (0xf, 0x0, 0x0, 16, 16777216, 68, ... 80, ) == 0x0
 00578   444   NtQuerySection  (80, Image, 48, ... {section info, class 1, size 48}, 0x0, ) == 0x0
 00579   444   NtClose  (68, ... ) == 0x0
 00580   444   NtMapViewOfSection  (80, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x71ad0000), 0x0, 32768, ) == 0x0
 00581   444   NtClose  (80, ... ) == 0x0
 00582   444   NtProtectVirtualMemory  (-1, (0x8d2000), 4096, 4, ... (0x8d2000), 4096, 4, ) == 0x0
 00583   444   NtProtectVirtualMemory  (-1, (0x8d2000), 4096, 4, ... (0x8d2000), 4096, 4, ) == 0x0
 00584   444   NtFlushInstructionCache  (-1, 9248768, 4096, ... ) == 0x0
 00585   444   NtOpenProcess  (0x400, {24, 0, 0x0, 0, 0, 0x0}, {436, 0}, ... 80, ) == 0x0
 00586   444   NtQueryInformationProcess  (80, Session, 4, ... {SessionId=0,}, 0x0, ) == 0x0
 00587   444   NtClose  (80, ... ) == 0x0
 00588   444   NtUserRegisterWindowMessage  ( ("ShellGetDragImage", ... ) , ... ) == 0xc03a
 00589   444   NtUserSystemParametersInfo  (104, 0, 2000318720, 0, ... ) == 0x1
 00590   444   NtUserSystemParametersInfo  (38, 4, 2000318708, 0, ... ) == 0x1
 00591   444   NtOpenKey  (0x20019, {24, 60, 0x40, 0, 0,  (0x20019, {24, 60, 0x40, 0, 0, "Control Panel\Desktop"}, ... 80, ) }, ... 80, ) == 0x0
 00592   444   NtQueryValueKey  (80,  (80, "SmoothScroll", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00593   444   NtClose  (80, ... ) == 0x0
 00594   444   NtUserSystemParametersInfo  (41, 500, 1242460, 0, ... ) == 0x1
 00595   444   NtUserSystemParametersInfo  (102, 0, 2000318732, 0, ... ) == 0x1
 00596   444   NtUserGetClassInfo  (1999896576, 1242868, 1242820, 1242896, 0, ... ) == 0x0
 00597   444   NtUserFindExistingCursorIcon  (1242252, 1242268, 1242836, ... ) == 0x10011
 00598   444   NtUserRegisterClassExWOW  (1242704, 1242784, 1242768, 1242800, 0, 384, 0, ... ) == 0x810cc03b
 00599   444   NtUserGetClassInfo  (1999896576, 1242868, 1242820, 1242896, 0, ... ) == 0x0
 00600   444   NtUserRegisterClassExWOW  (1242704, 1242784, 1242768, 1242800, 0, 384, 0, ... ) == 0x810cc03d
 00601   444   NtUserGetClassInfo  (1999896576, 1242868, 1242820, 1242896, 0, ... ) == 0x0
 00602   444   NtUserFindExistingCursorIcon  (1242252, 1242268, 1242836, ... ) == 0x10011
 00603   444   NtUserRegisterClassExWOW  (1242704, 1242784, 1242768, 1242800, 0, 384, 0, ... ) == 0x810cc03f
 00604   444   NtUserGetClassInfo  (1999896576, 1242868, 1242820, 1242896, 0, ... ) == 0x0
 00605   444   NtUserFindExistingCursorIcon  (1242252, 1242268, 1242836, ... ) == 0x10011
 00606   444   NtUserRegisterClassExWOW  (1242704, 1242784, 1242768, 1242800, 0, 384, 0, ... ) == 0x810cc041
 00607   444   NtUserGetClassInfo  (1999896576, 1242868, 1242820, 1242896, 0, ... ) == 0x0
 00608   444   NtUserFindExistingCursorIcon  (1242252, 1242268, 1242836, ... ) == 0x10011
 00609   444   NtUserRegisterClassExWOW  (1242704, 1242784, 1242768, 1242800, 0, 384, 0, ... ) == 0x810cc043
 00610   444   NtUserGetClassInfo  (1999896576, 1242868, 1242820, 1242896, 0, ... ) == 0x0
 00611   444   NtUserRegisterClassExWOW  (1242704, 1242784, 1242768, 1242800, 0, 384, 0, ... ) == 0x810cc045
 00612   444   NtUserGetClassInfo  (1999896576, 1242868, 1242820, 1242896, 0, ... ) == 0x0
 00613   444   NtUserFindExistingCursorIcon  (1242252, 1242268, 1242836, ... ) == 0x10011
 00614   444   NtUserRegisterClassExWOW  (1242704, 1242784, 1242768, 1242800, 0, 384, 0, ... ) == 0x810cc047
 00615   444   NtUserGetClassInfo  (1999896576, 1242868, 1242820, 1242896, 0, ... ) == 0x0
 00616   444   NtUserFindExistingCursorIcon  (1242248, 1242264, 1242832, ... ) == 0x10011
 00617   444   NtUserRegisterClassExWOW  (1242700, 1242780, 1242764, 1242796, 0, 384, 0, ... ) == 0x810cc049
 00618   444   NtUserGetClassInfo  (1999896576, 1242868, 1242820, 1242896, 0, ... ) == 0x0
 00619   444   NtUserFindExistingCursorIcon  (1242252, 1242268, 1242836, ... ) == 0x10011
 00620   444   NtUserRegisterClassExWOW  (1242704, 1242784, 1242768, 1242800, 0, 384, 0, ... ) == 0x810cc04b
 00621   444   NtUserGetClassInfo  (1999896576, 1242868, 1242820, 1242896, 0, ... ) == 0x0
 00622   444   NtUserFindExistingCursorIcon  (1242252, 1242268, 1242836, ... ) == 0x10011
 00623   444   NtUserRegisterClassExWOW  (1242704, 1242784, 1242768, 1242800, 0, 384, 0, ... ) == 0x810cc04d
 00624   444   NtUserGetClassInfo  (1999896576, 1242868, 1242820, 1242896, 0, ... ) == 0x0
 00625   444   NtUserFindExistingCursorIcon  (1242252, 1242268, 1242836, ... ) == 0x10011
 00626   444   NtUserRegisterClassExWOW  (1242704, 1242784, 1242768, 1242800, 0, 384, 0, ... ) == 0x810cc04f
 00627   444   NtUserGetClassInfo  (1999896576, 1242872, 1242824, 1242900, 0, ... ) == 0x0
 00628   444   NtUserRegisterClassExWOW  (1242708, 1242788, 1242772, 1242804, 0, 384, 0, ... ) == 0x810cc051
 00629   444   NtUserGetClassInfo  (1999896576, 1242868, 1242820, 1242896, 0, ... ) == 0x0
 00630   444   NtUserFindExistingCursorIcon  (1242252, 1242268, 1242836, ... ) == 0x10011
 00631   444   NtUserRegisterClassExWOW  (1242704, 1242784, 1242768, 1242800, 0, 384, 0, ... ) == 0x810cc053
 00632   444   NtUserGetClassInfo  (1999896576, 1242868, 1242820, 1242896, 0, ... ) == 0x0
 00633   444   NtUserFindExistingCursorIcon  (1242252, 1242268, 1242836, ... ) == 0x10011
 00634   444   NtUserRegisterClassExWOW  (1242704, 1242784, 1242768, 1242800, 0, 384, 0, ... ) == 0x810cc055
 00635   444   NtUserRegisterClassExWOW  (1242704, 1242784, 1242768, 1242800, 0, 384, 0, ... ) == 0x810cc057
 00636   444   NtUserGetClassInfo  (1999896576, 1242868, 1242820, 1242896, 0, ... ) == 0x0
 00637   444   NtUserFindExistingCursorIcon  (1242252, 1242268, 1242836, ... ) == 0x10011
 00638   444   NtUserRegisterClassExWOW  (1242704, 1242784, 1242768, 1242800, 0, 384, 0, ... ) == 0x810cc059
 00639   444   NtUserGetClassInfo  (1999896576, 1242868, 1242820, 1242896, 0, ... ) == 0x0
 00640   444   NtUserFindExistingCursorIcon  (1242252, 1242268, 1242836, ... ) == 0x10013
 00641   444   NtUserRegisterClassExWOW  (1242704, 1242784, 1242768, 1242800, 0, 384, 0, ... ) == 0x810cc05b
 00642   444   NtUserGetClassInfo  (1999896576, 1242868, 1242820, 1242896, 0, ... ) == 0x0
 00643   444   NtUserFindExistingCursorIcon  (1242252, 1242268, 1242836, ... ) == 0x10011
 00644   444   NtUserRegisterClassExWOW  (1242704, 1242784, 1242768, 1242800, 0, 384, 0, ... ) == 0x810cc05d
 00645   444   NtUserGetClassInfo  (1999896576, 1242868, 1242820, 1242896, 0, ... ) == 0x0
 00646   444   NtUserFindExistingCursorIcon  (1242252, 1242268, 1242836, ... ) == 0x10011
 00647   444   NtUserRegisterClassExWOW  (1242704, 1242784, 1242768, 1242800, 0, 384, 0, ... ) == 0x810cc05f
 00648   444   NtCreateSemaphore  (0x1f0003, 0x0, 1, 1, ... 80, ) == 0x0
 00649   444   NtCreateEvent  (0x1f0003, 0x0, 0, 0, ... 68, ) == 0x0
 00650   444   NtOpenKey  (0x20019, {24, 28, 0x40, 0, 0,  (0x20019, {24, 28, 0x40, 0, 0, "system\CurrentControlSet\control\NetworkProvider\HwOrder"}, ... 84, ) }, ... 84, ) == 0x0
 00651   444   NtNotifyChangeKey  (84, 68, 0, 0, 2011390432, 4, 0, 0, 0, 1, ... ) == 0x103
 00652   444   NtQueryInformationProcess  (-1, 28, 4, ... {process info, class 28, size 4}, 0x0, ) == 0x0
 00653   444   NtCreateSemaphore  (0x100003, 0x0, 0, 2147483647, ... 88, ) == 0x0
 00654   444   NtCreateSemaphore  (0x100003, 0x0, 0, 2147483647, ... 92, ) == 0x0
 00655   444   NtUserCallOneParam  (0, 40, ... ) == 0x4
 00656   444   NtAllocateVirtualMemory  (-1, 1355776, 0, 4096, 4096, 4, ... 1355776, 4096, ) == 0x0
 00657   444   NtQueryVirtualMemory  (-1, 0x12f674, Basic, 28, ... {BaseAddress=0x12f000,AllocationBase=0x30000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 28, ) == 0x0
 00658   444   NtAllocateVirtualMemory  (-1, 1359872, 0, 4096, 4096, 4, ... 1359872, 4096, ) == 0x0
 00659   444   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 1, ... 9371648, 1048576, ) == 0x0
 00660   444   NtAllocateVirtualMemory  (-1, 9371648, 0, 16384, 4096, 4, ... 9371648, 16384, ) == 0x0
 00661   444   NtQuerySystemInformation  (TimeZone, 172, ... {system info, class 44, size 172}, 0x0, ) == 0x0
 00662   444   NtQuerySystemInformation  (TimeZone, 172, ... {system info, class 44, size 172}, 0x0, ) == 0x0
 00663   444   NtOpenKey  (0xf003f, {24, 60, 0x40, 0, 0,  (0xf003f, {24, 60, 0x40, 0, 0, "Software\Borland\Locales"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00664   444   NtOpenKey  (0xf003f, {24, 60, 0x40, 0, 0,  (0xf003f, {24, 60, 0x40, 0, 0, "Software\Borland\Delphi\Locales"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00665   444   NtOpenProcessToken  (-1, 0x8, ... 96, ) == 0x0
 00666   444   NtQueryInformationToken  (96, Statistics, 56, ... {token info, class 10, size 56}, 56, ) == 0x0
 00667   444   NtClose  (96, ... ) == 0x0
 00668   444   NtWaitForSingleObject  (16, 0, 0x0, ... ) == STATUS_ACCESS_DENIED
 00669   444   NtReleaseMutant  (16, ...
 00670   444   NtContinue  (-136150904, 0, ...
 00669   444   NtReleaseMutant  ... ) == STATUS_MUTANT_NOT_OWNED
 00671   444   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\DOCUME~1\SRI-user\LOCALS~1\Temp\yka1.ENU"}, 1241184, ... ) }, 1241184, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00672   444   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\DOCUME~1\SRI-user\LOCALS~1\Temp\yka1.ENU"}, 1240824, ... ) }, 1240824, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00673   444   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\DOCUME~1\SRI-user\LOCALS~1\Temp\yka1.ENU.DLL"}, 1240824, ... ) }, 1240824, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00674   444   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\DOCUME~1\SRI-user\LOCALS~1\Temp\yka1.EN"}, 1241184, ... ) }, 1241184, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00675   444   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\DOCUME~1\SRI-user\LOCALS~1\Temp\yka1.EN"}, 1240824, ... ) }, 1240824, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00676   444   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\DOCUME~1\SRI-user\LOCALS~1\Temp\yka1.EN.DLL"}, 1240824, ... ) }, 1240824, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00677   444   NtWaitForSingleObject  (16, 0, 0x0, ... ) == STATUS_ACCESS_DENIED
 00678   444   NtReleaseMutant  (16, ...
 00679   444   NtContinue  (-136150904, 0, ...
 00678   444   NtReleaseMutant  ... ) == STATUS_MUTANT_NOT_OWNED
 00680   444   NtWaitForSingleObject  (16, 0, 0x0, ... ) == STATUS_ACCESS_DENIED
 00681   444   NtReleaseMutant  (16, ...
 00682   444   NtContinue  (-136150904, 0, ...
 00681   444   NtReleaseMutant  ... ) == STATUS_MUTANT_NOT_OWNED
 00683   444   NtWaitForSingleObject  (16, 0, 0x0, ... ) == STATUS_ACCESS_DENIED
 00684   444   NtReleaseMutant  (16, ...
 00685   444   NtContinue  (-136150904, 0, ...
 00684   444   NtReleaseMutant  ... ) == STATUS_MUTANT_NOT_OWNED
 00686   444   NtWaitForSingleObject  (16, 0, 0x0, ... ) == STATUS_ACCESS_DENIED
 00687   444   NtReleaseMutant  (16, ...
 00688   444   NtContinue  (-136150904, 0, ...
 00687   444   NtReleaseMutant  ... ) == STATUS_MUTANT_NOT_OWNED
 00689   444   NtWaitForSingleObject  (16, 0, 0x0, ... ) == STATUS_ACCESS_DENIED
 00690   444   NtReleaseMutant  (16, ...
 00691   444   NtContinue  (-136150904, 0, ...
 00690   444   NtReleaseMutant  ... ) == STATUS_MUTANT_NOT_OWNED
 00692   444   NtWaitForSingleObject  (16, 0, 0x0, ... ) == STATUS_ACCESS_DENIED
 00693   444   NtReleaseMutant  (16, ...
 00694   444   NtContinue  (-136150904, 0, ...
 00693   444   NtReleaseMutant  ... ) == STATUS_MUTANT_NOT_OWNED
 00695   444   NtWaitForSingleObject  (16, 0, 0x0, ... ) == STATUS_ACCESS_DENIED
 00696   444   NtReleaseMutant  (16, ...
 00697   444   NtContinue  (-136150904, 0, ...
 00696   444   NtReleaseMutant  ... ) == STATUS_MUTANT_NOT_OWNED
 00698   444   NtWaitForSingleObject  (16, 0, 0x0, ... ) == STATUS_ACCESS_DENIED
 00699   444   NtReleaseMutant  (16, ...
 00700   444   NtContinue  (-136150904, 0, ...
 00699   444   NtReleaseMutant  ... ) == STATUS_MUTANT_NOT_OWNED
 00701   444   NtWaitForSingleObject  (16, 0, 0x0, ... ) == STATUS_ACCESS_DENIED
 00702   444   NtReleaseMutant  (16, ...
 00703   444   NtContinue  (-136150904, 0, ...
 00702   444   NtReleaseMutant  ... ) == STATUS_MUTANT_NOT_OWNED
 00704   444   NtWaitForSingleObject  (16, 0, 0x0, ... ) == STATUS_ACCESS_DENIED
 00705   444   NtReleaseMutant  (16, ...
 00706   444   NtContinue  (-136150904, 0, ...
 00705   444   NtReleaseMutant  ... ) == STATUS_MUTANT_NOT_OWNED
 00707   444   NtWaitForSingleObject  (16, 0, 0x0, ... ) == STATUS_ACCESS_DENIED
 00708   444   NtReleaseMutant  (16, ...
 00709   444   NtContinue  (-136150904, 0, ...
 00708   444   NtReleaseMutant  ... ) == STATUS_MUTANT_NOT_OWNED
 00710   444   NtWaitForSingleObject  (16, 0, 0x0, ... ) == STATUS_ACCESS_DENIED
 00711   444   NtReleaseMutant  (16, ...
 00712   444   NtContinue  (-136150904, 0, ...
 00711   444   NtReleaseMutant  ... ) == STATUS_MUTANT_NOT_OWNED
 00713   444   NtWaitForSingleObject  (16, 0, 0x0, ... ) == STATUS_ACCESS_DENIED
 00714   444   NtReleaseMutant  (16, ...
 00715   444   NtContinue  (-136150904, 0, ...
 00714   444   NtReleaseMutant  ... ) == STATUS_MUTANT_NOT_OWNED
 00716   444   NtWaitForSingleObject  (16, 0, 0x0, ... ) == STATUS_ACCESS_DENIED
 00717   444   NtReleaseMutant  (16, ...
 00718   444   NtContinue  (-136150904, 0, ...
 00717   444   NtReleaseMutant  ... ) == STATUS_MUTANT_NOT_OWNED
 00719   444   NtWaitForSingleObject  (16, 0, 0x0, ... ) == STATUS_ACCESS_DENIED
 00720   444   NtReleaseMutant  (16, ...
 00721   444   NtContinue  (-136150904, 0, ...
 00720   444   NtReleaseMutant  ... ) == STATUS_MUTANT_NOT_OWNED
 00722   444   NtWaitForSingleObject  (16, 0, 0x0, ... ) == STATUS_ACCESS_DENIED
 00723   444   NtReleaseMutant  (16, ...
 00724   444   NtContinue  (-136150904, 0, ...
 00723   444   NtReleaseMutant  ... ) == STATUS_MUTANT_NOT_OWNED
 00725   444   NtWaitForSingleObject  (16, 0, 0x0, ... ) == STATUS_ACCESS_DENIED
 00726   444   NtReleaseMutant  (16, ...
 00727   444   NtContinue  (-136150904, 0, ...
 00726   444   NtReleaseMutant  ... ) == STATUS_MUTANT_NOT_OWNED
 00728   444   NtWaitForSingleObject  (16, 0, 0x0, ... ) == STATUS_ACCESS_DENIED
 00729   444   NtReleaseMutant  (16, ...
 00730   444   NtContinue  (-136150904, 0, ...
 00729   444   NtReleaseMutant  ... ) == STATUS_MUTANT_NOT_OWNED
 00731   444   NtCreateEvent  (0x1f0003, 0x0, 0, -1, ... 96, ) == 0x0
 00732   444   NtUserGetDC  (0, ... ) == 0x1010052
 00733   444   NtUserCallOneParam  (16842834, 56, ... ) == 0x1
 00734   444   NtUserGetDC  (0, ... ) == 0x1010052
 00735   444   NtUserCallOneParam  (16842834, 56, ... ) == 0x1
 00736   444   NtGdiCreatePaletteInternal  (1241872, 16, ... ) == 0x608045d
 00737   444   NtGdiGetStockObject  (7, ... ) == 0x1b00017
 00738   444   NtGdiGetStockObject  (5, ... ) == 0x1900015
 00739   444   NtUserFindExistingCursorIcon  (1242268, 1242284, 1242852, ... ) == 0x10003
 00740   444   NtAddAtom  ( ("D\0e\0l\0p\0h\0i\00\00\00\00\00\01\0B\04\0", 28, 1242804, ... ) , 28, 1242804, ... ) == 0x0
 00741   444   NtAddAtom  ( ("C\0o\0n\0t\0r\0o\0l\0O\0f\0s\00\00\08\06\00\00\00\00\00\00\00\00\00\01\0B\0C\0", 52, 1242804, ... ) , 52, 1242804, ... ) == 0x0
 00742   444   NtUserSystemParametersInfo  (104, 0, 9376892, 0, ... ) == 0x1
 00743   444   NtUserFindExistingCursorIcon  (1242152, 1242168, 1242736, ... ) == 0x10011
 00744   444   NtUserFindExistingCursorIcon  (1242152, 1242168, 1242736, ... ) == 0x10023
 00745   444   NtUserFindExistingCursorIcon  (1242152, 1242168, 1242736, ... ) == 0x0
 00746   444   NtUserGetDC  (0, ... ) == 0x1010052
 00747   444   NtGdiCreateDIBitmapInternal  (16842834, 32, 64, 2, 0, 2010764464, 0, 48, 0, 0, 0, ... ) == 0x105045f
 00748   444   NtUserCallOneParam  (16842834, 56, ... ) == 0x1
 00749   444   NtGdiSelectBitmap  (234947665, 17106015, ... ) == 0x185000f
 00750   444   NtGdiGetDCforBitmap  (17106015, ... ) == 0xe010451
 00751   444   NtGdiSaveDC  (234947665, ... ) == 0x1
 00752   444   NtGdiSelectBitmap  (234947665, 17106015, ... ) == 0x105045f
 00753   444   NtGdiGetDCObject  (234947665, 524288, ... ) == 0x188000b
 00754   444   NtUserSelectPalette  (234947665, 25690123, 0, ... ) == 0x188000b
 00755   444   NtGdiSetDIBitsToDeviceInternal  (234947665, 0, 0, 32, 64, 0, 0, 0, 64, 9188876, 1344632, 0, 256, 48, 1, 0, ... ) == 0x40
 00756   444   NtUserSelectPalette  (234947665, 25690123, 0, ... ) == 0x188000b
 00757   444   NtGdiSelectBitmap  (234947665, 17106015, ... ) == 0x105045f
 00758   444   NtGdiRestoreDC  (234947665, -1, ... ) == 0x1
 00759   444   NtGdiSelectBitmap  (234947665, 25493519, ... ) == 0x105045f
 00760   444   NtGdiCreateCompatibleDC  (234947665, ... ) == 0x2010460
 00761   444   NtGdiExtGetObjectW  (17106015, 24, 1241324, ... ) == 0x18
 00762   444   NtGdiCreateBitmap  (32, 64, 1, 1, 0, ... ) == 0x2050461
 00763   444   NtGdiSelectBitmap  (234947665, 17106015, ... ) == 0x185000f
 00764   444   NtGdiSelectBitmap  (33621088, 33883233, ... ) == 0x185000f
 00765   444   NtGdiBitBlt  (33621088, 0, 0, 32, 64, 234947665, 0, 0, 13369376, -1, 0, ... ) == 0x1
 00766   444   NtGdiSelectBitmap  (234947665, 25493519, ... ) == 0x105045f
 00767   444   NtGdiSelectBitmap  (33621088, 25493519, ... ) == 0x2050461
 00768   444   NtGdiDeleteObjectApp  (17106015, ... ) == 0x1
 00769   444   NtGdiDeleteObjectApp  (33621088, ... ) == 0x1
 00770   444   NtUserCallOneParam  (0, 33, ... ) == 0x100b3
 00771   444   NtUserSetCursorIconData  (65715, 1241432, 1241448, 1242028, ... ) == 0x1
 00772   444   NtUserFindExistingCursorIcon  (1242152, 1242168, 1242736, ... ) == 0x10029
 00773   444   NtUserFindExistingCursorIcon  (1242152, 1242168, 1242736, ... ) == 0x10027
 00774   444   NtUserFindExistingCursorIcon  (1242152, 1242168, 1242736, ... ) == 0x10025
 00775   444   NtUserFindExistingCursorIcon  (1242152, 1242168, 1242736, ... ) == 0x0
 00776   444   NtUserGetDC  (0, ... ) == 0x1010052
 00777   444   NtGdiCreateDIBitmapInternal  (16842834, 32, 64, 2, 0, 2010764464, 0, 48, 0, 0, 0, ... ) == 0x705045e
 00778   444   NtUserCallOneParam  (16842834, 56, ... ) == 0x1
 00779   444   NtGdiSelectBitmap  (234947665, 117769310, ... ) == 0x185000f
 00780   444   NtGdiGetDCforBitmap  (117769310, ... ) == 0xe010451
 00781   444   NtGdiSaveDC  (234947665, ... ) == 0x1
 00782   444   NtGdiSelectBitmap  (234947665, 117769310, ... ) == 0x705045e
 00783   444   NtGdiGetDCObject  (234947665, 524288, ... ) == 0x188000b
 00784   444   NtUserSelectPalette  (234947665, 25690123, 0, ... ) == 0x188000b
 00785   444   NtGdiSetDIBitsToDeviceInternal  (234947665, 0, 0, 32, 64, 0, 0, 0, 64, 9189184, 1344632, 0, 256, 48, 1, 0, ... ) == 0x40
 00786   444   NtUserSelectPalette  (234947665, 25690123, 0, ... ) == 0x188000b
 00787   444   NtGdiSelectBitmap  (234947665, 117769310, ... ) == 0x705045e
 00788   444   NtGdiRestoreDC  (234947665, -1, ... ) == 0x1
 00789   444   NtGdiSelectBitmap  (234947665, 25493519, ... ) == 0x705045e
 00790   444   NtGdiCreateCompatibleDC  (234947665, ... ) == 0x301045f
 00791   444   NtGdiExtGetObjectW  (117769310, 24, 1241324, ... ) == 0x18
 00792   444   NtGdiCreateBitmap  (32, 64, 1, 1, 0, ... ) == 0x3050462
 00793   444   NtGdiSelectBitmap  (234947665, 117769310, ... ) == 0x185000f
 00794   444   NtGdiSelectBitmap  (50398303, 50660450, ... ) == 0x185000f
 00795   444   NtGdiBitBlt  (50398303, 0, 0, 32, 64, 234947665, 0, 0, 13369376, -1, 0, ... ) == 0x1
 00796   444   NtGdiSelectBitmap  (234947665, 25493519, ... ) == 0x705045e
 00797   444   NtGdiSelectBitmap  (50398303, 25493519, ... ) == 0x3050462
 00798   444   NtGdiDeleteObjectApp  (117769310, ... ) == 0x1
 00799   444   NtGdiDeleteObjectApp  (50398303, ... ) == 0x1
 00800   444   NtUserCallOneParam  (0, 33, ... ) == 0x100b5
 00801   444   NtUserSetCursorIconData  (65717, 1241432, 1241448, 1242028, ... ) == 0x1
 00802   444   NtUserFindExistingCursorIcon  (1242152, 1242168, 1242736, ... ) == 0x0
 00803   444   NtUserGetDC  (0, ... ) == 0x1010052
 00804   444   NtGdiCreateDIBitmapInternal  (16842834, 32, 64, 2, 0, 2010764464, 0, 48, 0, 0, 0, ... ) == 0x4050460
 00805   444   NtUserCallOneParam  (16842834, 56, ... ) == 0x1
 00806   444   NtGdiSelectBitmap  (234947665, 67437664, ... ) == 0x185000f
 00807   444   NtGdiGetDCforBitmap  (67437664, ... ) == 0xe010451
 00808   444   NtGdiSaveDC  (234947665, ... ) == 0x1
 00809   444   NtGdiSelectBitmap  (234947665, 67437664, ... ) == 0x4050460
 00810   444   NtGdiGetDCObject  (234947665, 524288, ... ) == 0x188000b
 00811   444   NtUserSelectPalette  (234947665, 25690123, 0, ... ) == 0x188000b
 00812   444   NtGdiSetDIBitsToDeviceInternal  (234947665, 0, 0, 32, 64, 0, 0, 0, 64, 9189492, 1344632, 0, 256, 48, 1, 0, ... ) == 0x40
 00813   444   NtUserSelectPalette  (234947665, 25690123, 0, ... ) == 0x188000b
 00814   444   NtGdiSelectBitmap  (234947665, 67437664, ... ) == 0x4050460
 00815   444   NtGdiRestoreDC  (234947665, -1, ... ) == 0x1
 00816   444   NtGdiSelectBitmap  (234947665, 25493519, ... ) == 0x4050460
 00817   444   NtGdiCreateCompatibleDC  (234947665, ... ) == 0x901045e
 00818   444   NtGdiExtGetObjectW  (67437664, 24, 1241324, ... ) == 0x18
 00819   444   NtGdiCreateBitmap  (32, 64, 1, 1, 0, ... ) == 0x3050463
 00820   444   NtGdiSelectBitmap  (234947665, 67437664, ... ) == 0x185000f
 00821   444   NtGdiSelectBitmap  (151061598, 50660451, ... ) == 0x185000f
 00822   444   NtGdiBitBlt  (151061598, 0, 0, 32, 64, 234947665, 0, 0, 13369376, -1, 0, ... ) == 0x1
 00823   444   NtGdiSelectBitmap  (234947665, 25493519, ... ) == 0x4050460
 00824   444   NtGdiSelectBitmap  (151061598, 25493519, ... ) == 0x3050463
 00825   444   NtGdiDeleteObjectApp  (67437664, ... ) == 0x1
 00826   444   NtGdiDeleteObjectApp  (151061598, ... ) == 0x1
 00827   444   NtUserCallOneParam  (0, 33, ... ) == 0x100b7
 00828   444   NtUserSetCursorIconData  (65719, 1241432, 1241448, 1242028, ... ) == 0x1
 00829   444   NtUserFindExistingCursorIcon  (1242152, 1242168, 1242736, ... ) == 0x0
 00830   444   NtUserGetDC  (0, ... ) == 0x1010052
 00831   444   NtGdiCreateDIBitmapInternal  (16842834, 32, 64, 2, 0, 2010764464, 0, 48, 0, 0, 0, ... ) == 0x505045f
 00832   444   NtUserCallOneParam  (16842834, 56, ... ) == 0x1
 00833   444   NtGdiSelectBitmap  (234947665, 84214879, ... ) == 0x185000f
 00834   444   NtGdiGetDCforBitmap  (84214879, ... ) == 0xe010451
 00835   444   NtGdiSaveDC  (234947665, ... ) == 0x1
 00836   444   NtGdiSelectBitmap  (234947665, 84214879, ... ) == 0x505045f
 00837   444   NtGdiGetDCObject  (234947665, 524288, ... ) == 0x188000b
 00838   444   NtUserSelectPalette  (234947665, 25690123, 0, ... ) == 0x188000b
 00839   444   NtGdiSetDIBitsToDeviceInternal  (234947665, 0, 0, 32, 64, 0, 0, 0, 64, 9189800, 1344632, 0, 256, 48, 1, 0, ... ) == 0x40
 00840   444   NtUserSelectPalette  (234947665, 25690123, 0, ... ) == 0x188000b
 00841   444   NtGdiSelectBitmap  (234947665, 84214879, ... ) == 0x505045f
 00842   444   NtGdiRestoreDC  (234947665, -1, ... ) == 0x1
 00843   444   NtGdiSelectBitmap  (234947665, 25493519, ... ) == 0x505045f
 00844   444   NtGdiCreateCompatibleDC  (234947665, ... ) == 0x6010460
 00845   444   NtGdiExtGetObjectW  (84214879, 24, 1241324, ... ) == 0x18
 00846   444   NtGdiCreateBitmap  (32, 64, 1, 1, 0, ... ) == 0x3050464
 00847   444   NtGdiSelectBitmap  (234947665, 84214879, ... ) == 0x185000f
 00848   444   NtGdiSelectBitmap  (100729952, 50660452, ... ) == 0x185000f
 00849   444   NtGdiBitBlt  (100729952, 0, 0, 32, 64, 234947665, 0, 0, 13369376, -1, 0, ... ) == 0x1
 00850   444   NtGdiSelectBitmap  (234947665, 25493519, ... ) == 0x505045f
 00851   444   NtGdiSelectBitmap  (100729952, 25493519, ... ) == 0x3050464
 00852   444   NtGdiDeleteObjectApp  (84214879, ... ) == 0x1
 00853   444   NtGdiDeleteObjectApp  (100729952, ... ) == 0x1
 00854   444   NtUserCallOneParam  (0, 33, ... ) == 0x100b9
 00855   444   NtUserSetCursorIconData  (65721, 1241432, 1241448, 1242028, ... ) == 0x1
 00856   444   NtUserFindExistingCursorIcon  (1242152, 1242168, 1242736, ... ) == 0x0
 00857   444   NtUserGetDC  (0, ... ) == 0x1010052
 00858   444   NtGdiCreateDIBitmapInternal  (16842834, 32, 64, 2, 0, 2010764464, 0, 48, 0, 0, 0, ... ) == 0xb05045e
 00859   444   NtUserCallOneParam  (16842834, 56, ... ) == 0x1
 00860   444   NtGdiSelectBitmap  (234947665, 184878174, ... ) == 0x185000f
 00861   444   NtGdiGetDCforBitmap  (184878174, ... ) == 0xe010451
 00862   444   NtGdiSaveDC  (234947665, ... ) == 0x1
 00863   444   NtGdiSelectBitmap  (234947665, 184878174, ... ) == 0xb05045e
 00864   444   NtGdiGetDCObject  (234947665, 524288, ... ) == 0x188000b
 00865   444   NtUserSelectPalette  (234947665, 25690123, 0, ... ) == 0x188000b
 00866   444   NtGdiSetDIBitsToDeviceInternal  (234947665, 0, 0, 32, 64, 0, 0, 0, 64, 9190108, 1344632, 0, 256, 48, 1, 0, ... ) == 0x40
 00867   444   NtUserSelectPalette  (234947665, 25690123, 0, ... ) == 0x188000b
 00868   444   NtGdiSelectBitmap  (234947665, 184878174, ... ) == 0xb05045e
 00869   444   NtGdiRestoreDC  (234947665, -1, ... ) == 0x1
 00870   444   NtGdiSelectBitmap  (234947665, 25493519, ... ) == 0xb05045e
 00871   444   NtGdiCreateCompatibleDC  (234947665, ... ) == 0x701045f
 00872   444   NtGdiExtGetObjectW  (184878174, 24, 1241324, ... ) == 0x18
 00873   444   NtGdiCreateBitmap  (32, 64, 1, 1, 0, ... ) == 0x3050465
 00874   444   NtGdiSelectBitmap  (234947665, 184878174, ... ) == 0x185000f
 00875   444   NtGdiSelectBitmap  (117507167, 50660453, ... ) == 0x185000f
 00876   444   NtGdiBitBlt  (117507167, 0, 0, 32, 64, 234947665, 0, 0, 13369376, -1, 0, ... ) == 0x1
 00877   444   NtGdiSelectBitmap  (234947665, 25493519, ... ) == 0xb05045e
 00878   444   NtGdiSelectBitmap  (117507167, 25493519, ... ) == 0x3050465
 00879   444   NtGdiDeleteObjectApp  (184878174, ... ) == 0x1
 00880   444   NtGdiDeleteObjectApp  (117507167, ... ) == 0x1
 00881   444   NtUserCallOneParam  (0, 33, ... ) == 0x100bb
 00882   444   NtUserSetCursorIconData  (65723, 1241432, 1241448, 1242028, ... ) == 0x1
 00883   444   NtUserFindExistingCursorIcon  (1242152, 1242168, 1242736, ... ) == 0x0
 00884   444   NtUserGetDC  (0, ... ) == 0x1010052
 00885   444   NtGdiCreateDIBitmapInternal  (16842834, 32, 64, 2, 0, 2010764464, 0, 48, 0, 0, 0, ... ) == 0x8050460
 00886   444   NtUserCallOneParam  (16842834, 56, ... ) == 0x1
 00887   444   NtGdiSelectBitmap  (234947665, 134546528, ... ) == 0x185000f
 00888   444   NtGdiGetDCforBitmap  (134546528, ... ) == 0xe010451
 00889   444   NtGdiSaveDC  (234947665, ... ) == 0x1
 00890   444   NtGdiSelectBitmap  (234947665, 134546528, ... ) == 0x8050460
 00891   444   NtGdiGetDCObject  (234947665, 524288, ... ) == 0x188000b
 00892   444   NtUserSelectPalette  (234947665, 25690123, 0, ... ) == 0x188000b
 00893   444   NtGdiSetDIBitsToDeviceInternal  (234947665, 0, 0, 32, 64, 0, 0, 0, 64, 9190724, 1344632, 0, 256, 48, 1, 0, ... ) == 0x40
 00894   444   NtUserSelectPalette  (234947665, 25690123, 0, ... ) == 0x188000b
 00895   444   NtGdiSelectBitmap  (234947665, 134546528, ... ) == 0x8050460
 00896   444   NtGdiRestoreDC  (234947665, -1, ... ) == 0x1
 00897   444   NtGdiSelectBitmap  (234947665, 25493519, ... ) == 0x8050460
 00898   444   NtGdiCreateCompatibleDC  (234947665, ... ) == 0xd01045e
 00899   444   NtGdiExtGetObjectW  (134546528, 24, 1241324, ... ) == 0x18
 00900   444   NtGdiCreateBitmap  (32, 64, 1, 1, 0, ... ) == 0x3050466
 00901   444   NtGdiSelectBitmap  (234947665, 134546528, ... ) == 0x185000f
 00902   444   NtGdiSelectBitmap  (218170462, 50660454, ... ) == 0x185000f
 00903   444   NtGdiBitBlt  (218170462, 0, 0, 32, 64, 234947665, 0, 0, 13369376, -1, 0, ... ) == 0x1
 00904   444   NtGdiSelectBitmap  (234947665, 25493519, ... ) == 0x8050460
 00905   444   NtGdiSelectBitmap  (218170462, 25493519, ... ) == 0x3050466
 00906   444   NtGdiDeleteObjectApp  (134546528, ... ) == 0x1
 00907   444   NtGdiDeleteObjectApp  (218170462, ... ) == 0x1
 00908   444   NtUserCallOneParam  (0, 33, ... ) == 0x100bd
 00909   444   NtUserSetCursorIconData  (65725, 1241432, 1241448, 1242028, ... ) == 0x1
 00910   444   NtUserFindExistingCursorIcon  (1242152, 1242168, 1242736, ... ) == 0x0
 00911   444   NtUserGetDC  (0, ... ) == 0x1010052
 00912   444   NtGdiCreateDIBitmapInternal  (16842834, 32, 64, 2, 0, 2010764464, 0, 48, 0, 0, 0, ... ) == 0x905045f
 00913   444   NtUserCallOneParam  (16842834, 56, ... ) == 0x1
 00914   444   NtGdiSelectBitmap  (234947665, 151323743, ... ) == 0x185000f
 00915   444   NtGdiGetDCforBitmap  (151323743, ... ) == 0xe010451
 00916   444   NtGdiSaveDC  (234947665, ... ) == 0x1
 00917   444   NtGdiSelectBitmap  (234947665, 151323743, ... ) == 0x905045f
 00918   444   NtGdiGetDCObject  (234947665, 524288, ... ) == 0x188000b
 00919   444   NtUserSelectPalette  (234947665, 25690123, 0, ... ) == 0x188000b
 00920   444   NtGdiSetDIBitsToDeviceInternal  (234947665, 0, 0, 32, 64, 0, 0, 0, 64, 9190416, 1344632, 0, 256, 48, 1, 0, ... ) == 0x40
 00921   444   NtUserSelectPalette  (234947665, 25690123, 0, ... ) == 0x188000b
 00922   444   NtGdiSelectBitmap  (234947665, 151323743, ... ) == 0x905045f
 00923   444   NtGdiRestoreDC  (234947665, -1, ... ) == 0x1
 00924   444   NtGdiSelectBitmap  (234947665, 25493519, ... ) == 0x905045f
 00925   444   NtGdiCreateCompatibleDC  (234947665, ... ) == 0xa010460
 00926   444   NtGdiExtGetObjectW  (151323743, 24, 1241324, ... ) == 0x18
 00927   444   NtGdiCreateBitmap  (32, 64, 1, 1, 0, ... ) == 0x3050467
 00928   444   NtGdiSelectBitmap  (234947665, 151323743, ... ) == 0x185000f
 00929   444   NtGdiSelectBitmap  (167838816, 50660455, ... ) == 0x185000f
 00930   444   NtGdiBitBlt  (167838816, 0, 0, 32, 64, 234947665, 0, 0, 13369376, -1, 0, ... ) == 0x1
 00931   444   NtGdiSelectBitmap  (234947665, 25493519, ... ) == 0x905045f
 00932   444   NtGdiSelectBitmap  (167838816, 25493519, ... ) == 0x3050467
 00933   444   NtGdiDeleteObjectApp  (151323743, ... ) == 0x1
 00934   444   NtGdiDeleteObjectApp  (167838816, ... ) == 0x1
 00935   444   NtUserCallOneParam  (0, 33, ... ) == 0x100bf
 00936   444   NtUserSetCursorIconData  (65727, 1241432, 1241448, 1242028, ... ) == 0x1
 00937   444   NtUserFindExistingCursorIcon  (1242152, 1242168, 1242736, ... ) == 0x10015
 00938   444   NtUserFindExistingCursorIcon  (1242152, 1242168, 1242736, ... ) == 0x10019
 00939   444   NtUserFindExistingCursorIcon  (1242152, 1242168, 1242736, ... ) == 0x1001f
 00940   444   NtUserFindExistingCursorIcon  (1242152, 1242168, 1242736, ... ) == 0x1001b
 00941   444   NtUserFindExistingCursorIcon  (1242152, 1242168, 1242736, ... ) == 0x10021
 00942   444   NtUserFindExistingCursorIcon  (1242152, 1242168, 1242736, ... ) == 0x1001d
 00943   444   NtUserFindExistingCursorIcon  (1242152, 1242168, 1242736, ... ) == 0x10013
 00944   444   NtUserFindExistingCursorIcon  (1242152, 1242168, 1242736, ... ) == 0x10017
 00945   444   NtUserFindExistingCursorIcon  (1242152, 1242168, 1242736, ... ) == 0x10011
 00946   444   NtUserCallOneParam  (0, 39, ... ) == 0x4090409
 00947   444   NtUserGetDC  (0, ... ) == 0x1010052
 00948   444   NtUserCallOneParam  (16842834, 56, ... ) == 0x1
 00949   444   NtUserEnumDisplayMonitors  (0, 0, 8913508, 9377472, ... ) == 0x1
 00950   444   NtUserSystemParametersInfo  (31, 60, 1241588, 0, ... ) == 0x1
 00951   444   NtGdiHfontCreate  (1241984, 356, 0, 0, 1344496, ... ) == 0xb0a0460
 00952   444   NtGdiExtGetObjectW  (185205856, 420, 1241808, ... ) == 0x164
 00953   444   NtUserSystemParametersInfo  (41, 0, 1241788, 0, ... ) == 0x1
 00954   444   NtGdiHfontCreate  (1241984, 356, 0, 0, 1344488, ... ) == 0xf0a045e
 00955   444   NtGdiExtGetObjectW  (252314718, 420, 1241808, ... ) == 0x164
 00956   444   NtGdiHfontCreate  (1241984, 356, 0, 0, 1344480, ... ) == 0xa0a045f
 00957   444   NtGdiExtGetObjectW  (168428639, 420, 1241808, ... ) == 0x164
 00958   444   NtUserFindExistingCursorIcon  (1241896, 1241912, 1242480, ... ) == 0x0
 00959   444   NtAllocateVirtualMemory  (-1, 0, 0, 4096, 4096, 64, ... 8650752, 4096, ) == 0x0
 00960   444   NtUserGetKeyboardLayoutList  (64, 1242468, ... ) == 0x1
 00961   444   NtAllocateVirtualMemory  (-1, 1363968, 0, 4096, 4096, 4, ... 1363968, 4096, ) == 0x0
 00962   444   NtUserRegisterWindowMessage  ( ("Delphi Picture", ... ) , ... ) == 0xc0d6
 00963   444   NtUserRegisterWindowMessage  ( ("Delphi Component", ... ) , ... ) == 0xc0d7
 00964   444   NtOpenMutant  (0x1f0001, {24, 52, 0x0, 0, 0,  (0x1f0001, {24, 52, 0x0, 0, 0, "Residented"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00965   444   NtUserSetWindowsHookEx  (8781824, 1243796, 0, 4, 8789692, 2, ... ) == 0x100c1
 00966   444   NtOpenFile  (0x10080, {24, 12, 0x40, 0, 0,  (0x10080, {24, 12, 0x40, 0, 0, "ftpupd.exe"}, 7, 2113600, ... ) }, 7, 2113600, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00967   444   NtCreateMutant  (0x1f0001, {24, 52, 0x80, 0, 0,  (0x1f0001, {24, 52, 0x80, 0, 0, "uterm19"}, 1, ... 100, ) }, 1, ... 100, ) == 0x0
 00968   444   NtOpenProcessToken  (-1, 0x20, ... 104, ) == 0x0
 00969   444   NtQuerySystemInformation  (Basic, 44, ... {Unknown=0,MaximumIncrement=156250,PhysicalPageSize=0x1000,NumberOfPhysicalPages=0xff7c,LowestPhysicalPage=0x1,HighestPhysicalPage=0xffff,AllocationGranularity=0x10000,LowestUserAddress=0x10000,HighestUserAddress=0x7ffeffff,ActiveProcessors=1,NumberProcessors=1,}, 0x0, ) == 0x0
 00970   444   NtOpenKey  (0x20019, {24, 28, 0x40, 0, 0,  (0x20019, {24, 28, 0x40, 0, 0, "Software\Microsoft\Rpc\PagedBuffers"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00971   444   NtOpenKey  (0x20019, {24, 28, 0x40, 0, 0,  (0x20019, {24, 28, 0x40, 0, 0, "Software\Microsoft\Rpc"}, ... 108, ) }, ... 108, ) == 0x0
 00972   444   NtQueryValueKey  (108,  (108, "MaxRpcSize", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00973   444   NtClose  (108, ... ) == 0x0
 00974   444   NtOpenKey  (0x20019, {24, 28, 0x40, 0, 0,  (0x20019, {24, 28, 0x40, 0, 0, "Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\packed.exe\RpcThreadPoolThrottle"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00975   444   NtCreateEvent  (0x1f0003, 0x0, 1, 0, ... 108, ) == 0x0
 00976   444   NtCreateEvent  (0x1f0003, 0x0, 1, 0, ... 112, ) == 0x0
 00977   444   NtQuerySystemTime  (... {-1966808406, 29882035}, ) == 0x0
 00978   444   NtCreateEvent  (0x1f0003, 0x0, 0, 0, ... 116, ) == 0x0
 00979   444   NtOpenKey  (0x20019, {24, 28, 0x40, 0, 0,  (0x20019, {24, 28, 0x40, 0, 0, "Software\Policies\Microsoft\Windows NT\Rpc"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00980   444   NtQuerySystemInformation  (Performance, 312, ... {system info, class 2, size 312}, 0x0, ) == 0x0
 00981   444   NtQueryInformationProcess  (-1, QuotaLimits, 32, ... {process info, class 1, size 32}, 0x0, ) == 0x0
 00982   444   NtQueryInformationProcess  (-1, VmCounters, 44, ... {process info, class 3, size 44}, 0x0, ) == 0x0
 00983   444   NtCreateEvent  (0x1f0003, 0x0, 0, 0, ... 120, ) == 0x0
 00984   444   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ... 124, ) == 0x0
 00985   444   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\System\CurrentControlSet\Control\ComputerName"}, ... 128, ) }, ... 128, ) == 0x0
 00986   444   NtOpenKey  (0x20019, {24, 128, 0x40, 0, 0,  (0x20019, {24, 128, 0x40, 0, 0, "ActiveComputerName"}, ... 132, ) }, ... 132, ) == 0x0
 00987   444   NtQueryValueKey  (132,  (132, "ComputerName", Full, 108, ... TitleIdx=0, Type=1, Name="ComputerName", Data="M\0Y\0W\0O\0R\0L\0D\0\0\0"}, 60, ) , Full, 108, ... TitleIdx=0, Type=1, Name= (132, "ComputerName", Full, 108, ... TitleIdx=0, Type=1, Name="ComputerName", Data="M\0Y\0W\0O\0R\0L\0D\0\0\0"}, 60, ) , Data= (132, "ComputerName", Full, 108, ... TitleIdx=0, Type=1, Name="ComputerName", Data="M\0Y\0W\0O\0R\0L\0D\0\0\0"}, 60, ) }, 60, ) == 0x0
 00988   444   NtClose  (132, ... ) == 0x0
 00989   444   NtClose  (128, ... ) == 0x0
 00990   444   NtCreateIoCompletion  (0x1f0003, 0x0, 0, ... 128, ) == 0x0
 00991   444   NtCreateIoCompletion  (0x1f0003, 0x0, -1, ... 132, ) == 0x0
 00992   444   NtDuplicateObject  (-1, 128, -1, 0x0, 0, 2, ... 136, ) == 0x0
 00993   444   NtAllocateVirtualMemory  (-1, 1368064, 0, 4096, 4096, 4, ... 1368064, 4096, ) == 0x0
 00994   444   NtOpenThreadToken  (-2, 0xc, 1, ... ) == STATUS_NO_TOKEN
 00995   444   NtCreateEvent  (0x1f0003, 0x0, 1, 0, ... 140, ) == 0x0
 00996   444   NtOpenThreadToken  (-2, 0xc, 1, ... ) == STATUS_NO_TOKEN
 00997   444   NtSetInformationThread  (-2, ImpersonationToken, {ImpToken=0,}, 4, ... ) == 0x0
 00998   444   NtCreateFile  (0xc0100080, {24, 0, 0x40, 0, 1243244,  (0xc0100080, {24, 0, 0x40, 0, 1243244, "\??\PIPE\lsarpc"}, 0x0, 0, 3, 1, 64, 0, 0, ... 144, {status=0x0, info=1}, ) }, 0x0, 0, 3, 1, 64, 0, 0, ... 144, {status=0x0, info=1}, ) == 0x0
 00999   444   NtSetInformationFile  (144, 1243300, 8, Pipe, ... {status=0x0, info=0}, ) == 0x0
 01000   444   NtSetInformationFile  (144, 1243292, 8, Completion, ... {status=0x0, info=0}, ) == 0x0
 01001   444   NtSetInformationThread  (-2, ImpersonationToken, {ImpToken=0,}, 4, ... ) == 0x0
 01002   444   NtWriteFile  (144, 121, 0, 0,  (144, 121, 0, 0, "\5\0\13\3\20\0\0\0H\0\0\0\1\0\0\0\270\20\270\20\0\0\0\0\1\0\0\0\0\0\1\0xW4\224\22\315\253\357\0\1#Eg\211\253\0\0\0\0\4]\210\212\353\34\311\21\237\350\10\0+\20H`\2\0\0\0", 72, {0, 0}, 0, ... {status=0x0, info=72}, ) , 72, {0, 0}, 0, ... {status=0x0, info=72}, ) == 0x0
 01003   444   NtReadFile  (144, 121, 0, 0, 1024, {0, 0}, 0, ... {status=0x0, info=68},  (144, 121, 0, 0, 1024, {0, 0}, 0, ... {status=0x0, info=68}, "\5\0\14\3\20\0\0\0D\0\0\0\1\0\0\0\270\20\270\20\300 \0\0\14\0\PIPE\lsass\0\0\0\1\0\0\0\0\0\0\0\4]\210\212\353\34\311\21\237\350\10\0+\20H`\2\0\0\0", ) , ) == 0x0
 01004   444   NtFsControlFile  (144, 121, 0x0, 0x0, 0x11c017,  (144, 121, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0@\0\0\0\1\0\0\0(\0\0\0\0\0,\0\0\0\0\0\30\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0$\377\22\0\14\0\0\0\2\0\1\0\0\10\0\0", 64, 1024, ... {status=0x103, info=68}, "\5\0\14\3\20\0\0\0D\0\0\0\1\0\0\0\270\20\270\20\300 \0\0\14\0\PIPE\lsass\0\0\0\1\0\0\0\0\0\0\0\4]\210\212\353\34\311\21\237\350\10\0+\20H`\2\0\0\0", ) , 64, 1024, ... {status=0x103, info=68},  (144, 121, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0@\0\0\0\1\0\0\0(\0\0\0\0\0,\0\0\0\0\0\30\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0$\377\22\0\14\0\0\0\2\0\1\0\0\10\0\0", 64, 1024, ... {status=0x103, info=68}, "\5\0\14\3\20\0\0\0D\0\0\0\1\0\0\0\270\20\270\20\300 \0\0\14\0\PIPE\lsass\0\0\0\1\0\0\0\0\0\0\0\4]\210\212\353\34\311\21\237\350\10\0+\20H`\2\0\0\0", ) , ) == 0x103
 01005   444   NtFsControlFile  (144, 121, 0x0, 0x0, 0x11c017,  (144, 121, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0`\0\0\0\2\0\0\0H\0\0\0\0\0\37\0\0\0\0\07\242\25\304\246b\334\21\261\310\0\14)\371\246\305 \0"\0 \320\24\0\21\0\0\0\0\0\0\0\20\0\0\0S\0e\0D\0e\0b\0u\0g\0P\0r\0i\0v\0i\0l\0e\0g\0e\0", 96, 1024, ... {status=0x103, info=48}, "\5\0\2\3\20\0\0\00\0\0\0\1\0\0\0\30\0\0\0\0\0\0\0\0\0\0\07\242\25\304\246b\334\21\261\310\0\14)\371\246\305\0\0\0\0", ) \0 \320\24\0\21\0\0\0\0\0\0\0\20\0\0\0S\0e\0D\0e\0b\0u\0g\0P\0r\0i\0v\0i\0l\0e\0g\0e\0 (144, 121, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0`\0\0\0\2\0\0\0H\0\0\0\0\0\37\0\0\0\0\07\242\25\304\246b\334\21\261\310\0\14)\371\246\305 \0"\0 \320\24\0\21\0\0\0\0\0\0\0\20\0\0\0S\0e\0D\0e\0b\0u\0g\0P\0r\0i\0v\0i\0l\0e\0g\0e\0", 96, 1024, ... {status=0x103, info=48}, "\5\0\2\3\20\0\0\00\0\0\0\1\0\0\0\30\0\0\0\0\0\0\0\0\0\0\07\242\25\304\246b\334\21\261\310\0\14)\371\246\305\0\0\0\0", ) \5\0\2\3\20\0\0\00\0\0\0\1\0\0\0\30\0\0\0\0\0\0\0\0\0\0\07\242\25\304\246b\334\21\261\310\0\14)\371\246\305\0\0\0\0", ) == 0x103
 01006   444   NtFsControlFile  (144, 121, 0x0, 0x0, 0x11c017,  (144, 121, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0,\0\0\0\3\0\0\0\24\0\0\0\0\0\0\0\0\0\0\07\242\25\304\246b\334\21\261\310\0\14)\371\246\305", 44, 1024, ... {status=0x103, info=36}, "\5\0\2\3\20\0\0\0$\0\0\0\2\0\0\0\14\0\0\0\0\0\0\0\24\0\0\0\0\0\0\0\0\0\0\0", ) , 44, 1024, ... {status=0x103, info=36},  (144, 121, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0,\0\0\0\3\0\0\0\24\0\0\0\0\0\0\0\0\0\0\07\242\25\304\246b\334\21\261\310\0\14)\371\246\305", 44, 1024, ... {status=0x103, info=36}, "\5\0\2\3\20\0\0\0$\0\0\0\2\0\0\0\14\0\0\0\0\0\0\0\24\0\0\0\0\0\0\0\0\0\0\0", ) , ) == 0x103
 01007   444   NtClose  (140, ... ) == 0x0
 01008   444   NtClose  (144, ... ) == 0x0
 01009   444   NtAdjustPrivilegesToken  (104, 0, 1245080, 16, 0, 0, ... ) == 0x0
 01010   444   NtOpenKey  (0xf003f, {24, 28, 0x40, 0, 0,  (0xf003f, {24, 28, 0x40, 0, 0, "SOFTWARE\Microsoft\Windows\CurrentVersion\Run"}, ... 144, ) }, ... 144, ) == 0x0
 01011   444   NtQueryValueKey  (144,  (144, "Windows Security Manager", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01012   444   NtClose  (144, ... ) == 0x0
 01013   444   NtOpenKey  (0xf003f, {24, 28, 0x40, 0, 0,  (0xf003f, {24, 28, 0x40, 0, 0, "SOFTWARE\Microsoft\Windows\CurrentVersion\Run"}, ... 144, ) }, ... 144, ) == 0x0
 01014   444   NtQueryValueKey  (144,  (144, "Disk Defragmenter", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01015   444   NtClose  (144, ... ) == 0x0
 01016   444   NtOpenKey  (0xf003f, {24, 28, 0x40, 0, 0,  (0xf003f, {24, 28, 0x40, 0, 0, "SOFTWARE\Microsoft\Windows\CurrentVersion\Run"}, ... 144, ) }, ... 144, ) == 0x0
 01017   444   NtQueryValueKey  (144,  (144, "System Restore Service", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01018   444   NtClose  (144, ... ) == 0x0
 01019   444   NtOpenKey  (0xf003f, {24, 28, 0x40, 0, 0,  (0xf003f, {24, 28, 0x40, 0, 0, "SOFTWARE\Microsoft\Windows\CurrentVersion\Run"}, ... 144, ) }, ... 144, ) == 0x0
 01020   444   NtQueryValueKey  (144,  (144, "Bot Loader", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01021   444   NtClose  (144, ... ) == 0x0
 01022   444   NtOpenKey  (0xf003f, {24, 28, 0x40, 0, 0,  (0xf003f, {24, 28, 0x40, 0, 0, "SOFTWARE\Microsoft\Windows\CurrentVersion\Run"}, ... 144, ) }, ... 144, ) == 0x0
 01023   444   NtQueryValueKey  (144,  (144, "SysTray", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01024   444   NtClose  (144, ... ) == 0x0
 01025   444   NtOpenKey  (0xf003f, {24, 28, 0x40, 0, 0,  (0xf003f, {24, 28, 0x40, 0, 0, "SOFTWARE\Microsoft\Windows\CurrentVersion\Run"}, ... 144, ) }, ... 144, ) == 0x0
 01026   444   NtQueryValueKey  (144,  (144, "WinUpdate", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01027   444   NtClose  (144, ... ) == 0x0
 01028   444   NtOpenKey  (0xf003f, {24, 28, 0x40, 0, 0,  (0xf003f, {24, 28, 0x40, 0, 0, "SOFTWARE\Microsoft\Windows\CurrentVersion\Run"}, ... 144, ) }, ... 144, ) == 0x0
 01029   444   NtQueryValueKey  (144,  (144, "Windows Update Service", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01030   444   NtClose  (144, ... ) == 0x0
 01031   444   NtOpenKey  (0xf003f, {24, 28, 0x40, 0, 0,  (0xf003f, {24, 28, 0x40, 0, 0, "SOFTWARE\Microsoft\Windows\CurrentVersion\Run"}, ... 144, ) }, ... 144, ) == 0x0
 01032   444   NtQueryValueKey  (144,  (144, "avserve.exe", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01033   444   NtClose  (144, ... ) == 0x0
 01034   444   NtOpenKey  (0xf003f, {24, 28, 0x40, 0, 0,  (0xf003f, {24, 28, 0x40, 0, 0, "SOFTWARE\Microsoft\Windows\CurrentVersion\Run"}, ... 144, ) }, ... 144, ) == 0x0
 01035   444   NtQueryValueKey  (144,  (144, "avserve2.exeUpdate Service", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01036   444   NtClose  (144, ... ) == 0x0
 01037   444   NtOpenKey  (0xf003f, {24, 28, 0x40, 0, 0,  (0xf003f, {24, 28, 0x40, 0, 0, "SOFTWARE\Microsoft\Windows\CurrentVersion\Run"}, ... 144, ) }, ... 144, ) == 0x0
 01038   444   NtQueryValueKey  (144,  (144, "MS Config v13", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01039   444   NtClose  (144, ... ) == 0x0
 01040   444   NtOpenKey  (0xf003f, {24, 28, 0x40, 0, 0,  (0xf003f, {24, 28, 0x40, 0, 0, "SOFTWARE\Microsoft\Windows\CurrentVersion\Run"}, ... 144, ) }, ... 144, ) == 0x0
 01041   444   NtQueryValueKey  (144,  (144, "Windows Update", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01042   444   NtClose  (144, ... ) == 0x0
 01043   444   NtOpenKey  (0xf003f, {24, 28, 0x40, 0, 0,  (0xf003f, {24, 28, 0x40, 0, 0, "Software\Microsoft\Wireless"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01044   444   NtCreateKey  (0xf003f, {24, 28, 0x40, 0, 0,  (0xf003f, {24, 28, 0x40, 0, 0, "Software\Microsoft\Wireless"}, 0, 0x0, 0, ... }, 0, 0x0, 0, ...
 01045   444   NtSetInformationFile  (-2147482848, -136149980, 8, EndOfFile, ... {status=0x0, info=0}, ) == 0x0
 01046   444   NtSetInformationFile  (-2147482848, -136150452, 8, EndOfFile, ... {status=0x0, info=0}, ) == 0x0
 01044   444   NtCreateKey  ... 144, 1, ) == 0x0
 01047   444   NtSetValueKey  (144,  (144, "ID", 0, 1, "p\0x\0y\0q\0j\0s\0h\0a\0k\0g\0n\0x\0j\0\0\0", 28, ... ) , 0, 1,  (144, "ID", 0, 1, "p\0x\0y\0q\0j\0s\0h\0a\0k\0g\0n\0x\0j\0\0\0", 28, ... ) , 28, ... ) == 0x0
 01048   444   NtClose  (144, ... ) == 0x0
 01049   444   NtOpenKey  (0xf003f, {24, 28, 0x40, 0, 0,  (0xf003f, {24, 28, 0x40, 0, 0, "SOFTWARE\Microsoft\Windows\CurrentVersion\Run"}, ... 144, ) }, ... 144, ) == 0x0
 01050   444   NtQueryValueKey  (144,  (144, "Cryptographic Service", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01051   444   NtClose  (144, ... ) == 0x0
 01052   444   NtCreateKey  (0xf003f, {24, 28, 0x40, 0, 0,  (0xf003f, {24, 28, 0x40, 0, 0, "Software\Microsoft\Wireless"}, 0, 0x0, 0, ... 144, 2, ) }, 0, 0x0, 0, ... 144, 2, ) == 0x0
 01053   444   NtSetValueKey  (144,  (144, "Client", 0, 1, "1\0\0\0", 4, ... ) , 0, 1,  (144, "Client", 0, 1, "1\0\0\0", 4, ... ) , 4, ... ) == 0x0
 01054   444   NtClose  (144, ... ) == 0x0
 01055   444   NtCreateFile  (0x80100080, {24, 0, 0x40, 0, 1243516,  (0x80100080, {24, 0, 0x40, 0, 1243516, "\??\u:\work\packed.exe"}, 0x0, 0, 1, 1, 2097252, 0, 0, ... 144, {status=0x0, info=1}, ) }, 0x0, 0, 1, 1, 2097252, 0, 0, ... 144, {status=0x0, info=1}, ) == 0x0
 01056   444   NtQueryInformationFile  (144, 1244452, 8, AttributeFlag, ... {status=0x0, info=8}, ) == 0x0
 01057   444   NtQueryInformationFile  (144, 1244424, 24, Standard, ... {status=0x0, info=24}, ) == 0x0
 01058   444   NtQueryInformationFile  (144, 1244376, 40, Basic, ... {status=0x0, info=40}, ) == 0x0
 01059   444   NtAllocateVirtualMemory  (-1, 1372160, 0, 8192, 4096, 4, ... 1372160, 8192, ) == 0x0
 01060   444   NtQueryInformationFile  (144, 1371664, 4094, Stream, ... {status=0x0, info=38}, ) == 0x0
 01061   444   NtQueryInformationFile  (144, 1242920, 40, Basic, ... {status=0x0, info=40}, ) == 0x0
 01062   444   NtQueryInformationFile  (144, 1242764, 4, Ea, ... {status=0x0, info=4}, ) == 0x0
 01063   444   NtCreateFile  (0x40110080, {24, 0, 0x40, 0, 1242772,  (0x40110080, {24, 0, 0x40, 0, 1242772, "\??\C:\WINDOWS\System32\lmkxqry.exe"}, 0x0, 32, 0, 5, 100, 0, 0, ... }, 0x0, 32, 0, 5, 100, 0, 0, ...
 01064   444   NtClose  (-2147482032, ... ) == 0x0
 01063   444   NtCreateFile  ... 140, {status=0x0, info=2}, ) == 0x0
 01065   444   NtQueryVolumeInformationFile  (140, 1242144, 536, Attribute, ... {status=0x0, info=22}, ) == 0x0
 01066   444   NtQueryInformationFile  (140, 1242104, 40, Basic, ... {status=0x0, info=40}, ) == 0x0
 01067   444   NtQueryVolumeInformationFile  (144, 1242144, 536, Attribute, ... {status=0x0, info=20}, ) == 0x0
 01068   444   NtQueryVolumeInformationFile  (144, 1241828, 8, Device, ... {status=0x0, info=8}, ) == 0x0
 01069   444   NtSetInformationFile  (140, 1241932, 8, EndOfFile, ... {status=0x0, info=0}, ) == 0x0
 01070   444   NtCreateSection  (0xf001f, 0x0, 0x0, 2, 134217728, 144, ... 148, ) == 0x0
 01071   444   NtMapViewOfSection  (148, -1, (0x0), 0, 0, {0, 0}, 0, 1, 0, 2, ... (0x9f0000), {0, 0}, 188416, ) == 0x0
 01072   444   NtClose  (148, ... ) == 0x0
 01073   444   NtWriteFile  (140, 0, 0, 0,  (140, 0, 0, 0, "MZ\220\0\3\0\0\0\4\0\0\0\377\377\0\0\270\0\0\0\0\0\0\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0fn\0\0\330\0\0\0\16\37\272\16\0\264\11\315!\270\1L\315!This program cannot be run in DOS mode.\15\15\12$\0\0\0\0\0\0\0I\3538\210\15\212V\333\15\212V\333\15\212V\333\216\226X\333\17\212V\333\345\225R\333\17\212V\333\15\212V\333\12\212V\333\15\212W\333[\212V\333o\225E\333\4\212V\333\345\225]\333\7\212V\333Rich\15\212V\333\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0PE\0\0L\1\4\0\310Y\330@\0\0\0\0\0\0\0\0\340\0\17\1\13\1\6\0\0 \0\0\0\20\0\0\0P\0\0\0\240\0\0\0`\0\0\0\200\0\0\0\0B1\0\20\0\0\0\2\0\0\4\0\0\0\0\0\0\0\4\0\0\0\0\0\0\0\0\260\0\0\0\20\0\0\0\0\0\0\2\0\0\0\0\0\20\0\0\20\0\0\0\0\20\0\0\20\0\0\0\0\0\0\20\0\0\0\0\0\0\0\0\0\0\0\0\200\0\0h\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0UPX0\0\0\0\0\0P\0\0\0\20\0\0\0\0\0\0\0\4\0\0\0\0\0\0\0\0\0\0\0\0\0\0", 61440, 0x0, 0, ... {status=0x0, info=61440}, ) , 61440, 0x0, 0, ... {status=0x0, info=61440}, ) == 0x0
 01074   444   NtWriteFile  (140, 0, 0, 0,  (140, 0, 0, 0, "\274\215%\241\12+\225\357\310C~:\362\221R\36\252\\4/\130R\276\205-N\13#Z\244\371\273=\326Yq\20A\243_S\272lU\214J3\317\376FC\252\357(+\3300E\327\260\346\254\25x\265\332\243H\10f\345[\36\341\321j'\201a\247\22=\340#\305\321\256\237J\5s&\266\276\251\332\272\255\361g\331\342&-PH\351\301\272\340\5\224\237\233Tr\315\355\0\256E"5\204\200n\0\257O6\21\267\347\376\213\210_\256\261\244\15\373\17\245Q],\6\307\371Rei\232z\354\345\304Y\36\20n^\307\20v\226\323vV\367\341\24`\267\177]\246\217\257\"\236(B\30\245L.\3F\337Z\226\267I\246I\207M/x\302]\301\303u\345~\243iV\2\4t}#b\267\12|\356\11\335\321/\241\344\330\246P%a\240\246$\1\177\355(\26U\272\4\354\212\344\262\27\245\215\241\206}%`\10\&\333\246\307\310Y\337\345\\310d0\344\341U|d\4\233\3554\234\362\326\257c\207\373\322/h\336=\363.\21\322\263\303]\6e\2668n\302#\0.'\366b\214\376\266\14\4\212\215\270\21\243\317C\375\211\340U@\270\367M\374\273\267\341i\13m\214\362M\246\271\340\260\250Y\346Z\242\312a\35\246nao\10x4\7\347I\32\15\217\255Pr\266\3269-\246Nb\0\372\30,\12\272K\254\205\343H\313A\270y\200\22\273\256)\363\246\327\246+,\263\254V\273\341\352\341\303TU\219D\346\15\247K.{l=@\350\212\356\6\33ta\342\256\217/\277^\277M\303a\336\17\375\307\207lp2@o\374\322\27\251\234\346\347\217]J\243IuW\254\332\230|\304!\34Fy\31\254B\354\217T\13\213O\322\354\10O\250=L\160J\24494\320", 61440, 0x0, 0, ... {status=0x0, info=61440}, ) 5\204\200n\0\257O6\21\267\347\376\213\210_\256\261\244\15\373\17\245Q],\6\307\371Rei\232z\354\345\304Y\36\20n^\307\20v\226\323vV\367\341\24`\267\177]\246\217\257\ (140, 0, 0, 0, "\274\215%\241\12+\225\357\310C~:\362\221R\36\252\\4/\130R\276\205-N\13#Z\244\371\273=\326Yq\20A\243_S\272lU\214J3\317\376FC\252\357(+\3300E\327\260\346\254\25x\265\332\243H\10f\345[\36\341\321j'\201a\247\22=\340#\305\321\256\237J\5s&\266\276\251\332\272\255\361g\331\342&-PH\351\301\272\340\5\224\237\233Tr\315\355\0\256E"5\204\200n\0\257O6\21\267\347\376\213\210_\256\261\244\15\373\17\245Q],\6\307\371Rei\232z\354\345\304Y\36\20n^\307\20v\226\323vV\367\341\24`\267\177]\246\217\257\"\236(B\30\245L.\3F\337Z\226\267I\246I\207M/x\302]\301\303u\345~\243iV\2\4t}#b\267\12|\356\11\335\321/\241\344\330\246P%a\240\246$\1\177\355(\26U\272\4\354\212\344\262\27\245\215\241\206}%`\10\&\333\246\307\310Y\337\345\\310d0\344\341U|d\4\233\3554\234\362\326\257c\207\373\322/h\336=\363.\21\322\263\303]\6e\2668n\302#\0.'\366b\214\376\266\14\4\212\215\270\21\243\317C\375\211\340U@\270\367M\374\273\267\341i\13m\214\362M\246\271\340\260\250Y\346Z\242\312a\35\246nao\10x4\7\347I\32\15\217\255Pr\266\3269-\246Nb\0\372\30,\12\272K\254\205\343H\313A\270y\200\22\273\256)\363\246\327\246+,\263\254V\273\341\352\341\303TU\219D\346\15\247K.{l=@\350\212\356\6\33ta\342\256\217/\277^\277M\303a\336\17\375\307\207lp2@o\374\322\27\251\234\346\347\217]J\243IuW\254\332\230|\304!\34Fy\31\254B\354\217T\13\213O\322\354\10O\250=L\160J\24494\320", 61440, 0x0, 0, ... {status=0x0, info=61440}, ) , 61440, 0x0, 0, ... {status=0x0, info=61440}, ) == 0x0
 01075   444   NtWriteFile  (140, 0, 0, 0,  (140, 0, 0, 0, "\257\223L\201\261I\231r\354\253\2Z\!\177\10\250.\361\347\207C\204\265\276\14w%\212l\6k\372\3757\13(N\206\371\12$\271r\367,Ej\200xcR\266\234B\11\244b\326\376\36u6&\347;\34j\254\223\34A\230^\255G\351\14\16kR\356h\234KQZE\242\322L\330\37\357\246\370bk\254\343\232\306[\4\366\376\372_\226D4\177\265\304v\300!\226\314\271\250\12\302\21\221<\260+f\271.\372Kl\220\23\252\315\342\210\254`QZ@o\272;\324\17\356\26@q\253\343X\316\373\265\356\341Z\270\376\276\202\352\204\300S\346\250\373Q\32\243\34?!\323I"v\256/5\265\265\31\23\355\245\376}\25\23\20K\25:f\301\265\214k3A\310\306}_\370\256\33\311\2\2267K\244\341\316\36"\341,\266"\273m<\244\375\26Od\312eu\256`\214\26\17'\227\302\313\6\0\323\234{W\372X\0*~\270\316\337\374\333W-\310\330Q\0\253'Vf\241\210\257\375:\346\26\214\366~B\325\253LQ\260vK\242\235C\3409?\253E\265!\24-\255\4g\14@\16P\333\226!"_d-\345\310\3732\3202\1\15`\243;\227\354K~\254$\217\306NH\267\17\222*\300]\332\252ER\5\325O\12\261\342\307{\344\30\30\302K\15\226\213\252OG\375t\31Ga|\241\353\321o\3740\335\333LK,\345\27\307\342\2535~\372\31Px\231\332YV:a'\217\26\211\264\16o\12s\240\227\350\354\307%\253\234\216IcQ\221S\371\377?\271\202]_T\4\35\314\226Qt\360\307\324\242\246p\332h\263\21\353 \260\347I\24N\320\362-\221e\214\3569A\334J\272+J\322\271\353[\15U\315\353cW\330\342z3\320\272\256ulu\253\14S\370\215\7S\366", 61440, 0x0, 0, ... {status=0x0, info=61440}, ) v\256/5\265\265\31\23\355\245\376}\25\23\20K\25:f\301\265\214k3A\310\306}_\370\256\33\311\2\2267K\244\341\316\36 (140, 0, 0, 0, "\257\223L\201\261I\231r\354\253\2Z\!\177\10\250.\361\347\207C\204\265\276\14w%\212l\6k\372\3757\13(N\206\371\12$\271r\367,Ej\200xcR\266\234B\11\244b\326\376\36u6&\347;\34j\254\223\34A\230^\255G\351\14\16kR\356h\234KQZE\242\322L\330\37\357\246\370bk\254\343\232\306[\4\366\376\372_\226D4\177\265\304v\300!\226\314\271\250\12\302\21\221<\260+f\271.\372Kl\220\23\252\315\342\210\254`QZ@o\272;\324\17\356\26@q\253\343X\316\373\265\356\341Z\270\376\276\202\352\204\300S\346\250\373Q\32\243\34?!\323I"v\256/5\265\265\31\23\355\245\376}\25\23\20K\25:f\301\265\214k3A\310\306}_\370\256\33\311\2\2267K\244\341\316\36"\341,\266"\273m<\244\375\26Od\312eu\256`\214\26\17'\227\302\313\6\0\323\234{W\372X\0*~\270\316\337\374\333W-\310\330Q\0\253'Vf\241\210\257\375:\346\26\214\366~B\325\253LQ\260vK\242\235C\3409?\253E\265!\24-\255\4g\14@\16P\333\226!"_d-\345\310\3732\3202\1\15`\243;\227\354K~\254$\217\306NH\267\17\222*\300]\332\252ER\5\325O\12\261\342\307{\344\30\30\302K\15\226\213\252OG\375t\31Ga|\241\353\321o\3740\335\333LK,\345\27\307\342\2535~\372\31Px\231\332YV:a'\217\26\211\264\16o\12s\240\227\350\354\307%\253\234\216IcQ\221S\371\377?\271\202]_T\4\35\314\226Qt\360\307\324\242\246p\332h\263\21\353 \260\347I\24N\320\362-\221e\214\3569A\334J\272+J\322\271\353[\15U\315\353cW\330\342z3\320\272\256ulu\253\14S\370\215\7S\366", 61440, 0x0, 0, ... {status=0x0, info=61440}, ) \273m<\244\375\26Od\312eu\256`\214\26\17'\227\302\313\6\0\323\234{W\372X\0*~\270\316\337\374\333W-\310\330Q\0\253'Vf\241\210\257\375:\346\26\214\366~B\325\253LQ\260vK\242\235C\3409?\253E\265!\24-\255\4g\14@\16P\333\226! (140, 0, 0, 0, "\257\223L\201\261I\231r\354\253\2Z\!\177\10\250.\361\347\207C\204\265\276\14w%\212l\6k\372\3757\13(N\206\371\12$\271r\367,Ej\200xcR\266\234B\11\244b\326\376\36u6&\347;\34j\254\223\34A\230^\255G\351\14\16kR\356h\234KQZE\242\322L\330\37\357\246\370bk\254\343\232\306[\4\366\376\372_\226D4\177\265\304v\300!\226\314\271\250\12\302\21\221<\260+f\271.\372Kl\220\23\252\315\342\210\254`QZ@o\272;\324\17\356\26@q\253\343X\316\373\265\356\341Z\270\376\276\202\352\204\300S\346\250\373Q\32\243\34?!\323I"v\256/5\265\265\31\23\355\245\376}\25\23\20K\25:f\301\265\214k3A\310\306}_\370\256\33\311\2\2267K\244\341\316\36"\341,\266"\273m<\244\375\26Od\312eu\256`\214\26\17'\227\302\313\6\0\323\234{W\372X\0*~\270\316\337\374\333W-\310\330Q\0\253'Vf\241\210\257\375:\346\26\214\366~B\325\253LQ\260vK\242\235C\3409?\253E\265!\24-\255\4g\14@\16P\333\226!"_d-\345\310\3732\3202\1\15`\243;\227\354K~\254$\217\306NH\267\17\222*\300]\332\252ER\5\325O\12\261\342\307{\344\30\30\302K\15\226\213\252OG\375t\31Ga|\241\353\321o\3740\335\333LK,\345\27\307\342\2535~\372\31Px\231\332YV:a'\217\26\211\264\16o\12s\240\227\350\354\307%\253\234\216IcQ\221S\371\377?\271\202]_T\4\35\314\226Qt\360\307\324\242\246p\332h\263\21\353 \260\347I\24N\320\362-\221e\214\3569A\334J\272+J\322\271\353[\15U\315\353cW\330\342z3\320\272\256ulu\253\14S\370\215\7S\366", 61440, 0x0, 0, ... {status=0x0, info=61440}, ) , 61440, 0x0, 0, ... {status=0x0, info=61440}, ) == 0x0
 01076   444   NtWriteFile  (140, 0, 0, 0,  (140, 0, 0, 0, "\247M&\1\247M&\1\36\4a*\247M&\1\247M'\1\247M&\1\347I&\1\223\21 \1\314L&\1\247M&\1\247M&\1\247M&\1\36\4a*\247M&\1\247M!\1^2&\1?I&\201]2&\1gI&\201\2&\1OI&\201[2&\1\267H&\201Z2&\1\237H&\201Y2&\1\307H&\201X2&\1/H&\201\247M&\1\36\4a*\247M&\1\247M'\1\247M&\1\27I&\1\7\20 \1\263M&\1\247M&\1\247M&\1\247M&\1\36\4a*\247M&\1\247M'\1\247M&\1\177I&\1\23\20 \1\263M&\1\247M&\1\247M&\1\247M&\1\36\4a*\247M&\1\247M'\1\247M&\1\247H&\1o\20 \1\263M&\1\247M&\1\247M&\1\247M&\1\36\4a*\247M&\1\247M'\1\247M&\1\217H&\1{\20 \1\263M&\1\247M&\1\247M&\1\247M&\1\36\4a*\247M&\1\247M'\1\247M&\1\367H&\1W\20 \1\263M&\1\247M&\1\247M&\1\247M&\1\36\4a*\247M&\1\247M'\1\247M&\1\337H&\1\243\23 \1\263M&\1\247M&\1\247M&\1\247M&\1\36\4a*\247M&\1\247M'\1\247M&\1\7H&\1\277\23 \1\263M&\1\247M&\1\247M&\1\241Mb\1\361Me\1\353Mg\1\353M-\1\363M`\1\362Mh\1\344Mk\1\350Mb\1\362Mj\1\342M&\1\247M&\1\247M&\1\247M&\1Kk!\1\7k!\1\247M&\1\247M&\1\247M&\1^k!\1\13k!\1\247M&\1\247M&\1\247M&\1\241j!\1\23k!\1\247M&\1", 3036, 0x0, 0, ... {status=0x0, info=3036}, ) , 3036, 0x0, 0, ... {status=0x0, info=3036}, ) == 0x0
 01077   444   NtUnmapViewOfSection  (-1, 0x9f0000, ... ) == 0x0
 01078   444   NtSetInformationFile  (140, 1244376, 40, Basic, ... {status=0x0, info=0}, ) == 0x0
 01079   444   NtClose  (144, ... ) == 0x0
 01080   444   NtClose  (140, ... ) == 0x0
 01081   444   NtCreateKey  (0xf003f, {24, 28, 0x40, 0, 0,  (0xf003f, {24, 28, 0x40, 0, 0, "SOFTWARE\Microsoft\Windows\CurrentVersion\Run"}, 0, 0x0, 0, ... 140, 2, ) }, 0, 0x0, 0, ... 140, 2, ) == 0x0
 01082   444   NtSetValueKey  (140,  (140, "Cryptographic Service", 0, 1, "C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0l\0m\0k\0x\0q\0r\0y\0.\0e\0x\0e\0\0\0", 64, ... , 0, 1,  (140, "Cryptographic Service", 0, 1, "C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0l\0m\0k\0x\0q\0r\0y\0.\0e\0x\0e\0\0\0", 64, ... , 64, ...
 01083   444   NtSetInformationFile  (-2147482848, -136149196, 8, EndOfFile, ... {status=0x0, info=0}, ) == 0x0
 01084   444   NtSetInformationFile  (-2147482848, -136149288, 8, EndOfFile, ... {status=0x0, info=0}, ) == 0x0
 01082   444   NtSetValueKey  ... ) == 0x0
 01085   444   NtClose  (140, ... ) == 0x0
 01086   444   NtClose  (100, ... ) == 0x0
 01087   444   NtQueryInformationJobObject  (0, BasicUIRestrictions, 4, ... ) == STATUS_ACCESS_DENIED
 01088   444   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\System32\lmkxqry.exe"}, 1241008, ... ) }, 1241008, ... ) == 0x0
 01089   444   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\System32\lmkxqry.exe"}, 1241700, ... ) }, 1241700, ... ) == 0x0
 01090   444   NtOpenFile  (0x1000a1, {24, 0, 0x40, 0, 0,  (0x1000a1, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\System32\lmkxqry.exe"}, 5, 96, ... 100, {status=0x0, info=1}, ) }, 5, 96, ... 100, {status=0x0, info=1}, ) == 0x0
 01091   444   NtCreateSection  (0xf001f, 0x0, 0x0, 16, 16777216, 100, ... 140, ) == 0x0
 01092   444   NtOpenKey  (0x1, {24, 0, 0x40, 0, 0,  (0x1, {24, 0, 0x40, 0, 0, "\Registry\MACHINE\System\CurrentControlSet\Control\Session Manager\AppCertDlls"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01093   444   NtOpenKey  (0x1, {24, 0, 0x40, 0, 0,  (0x1, {24, 0, 0x40, 0, 0, "\Registry\MACHINE\System\CurrentControlSet\Control\Session Manager\AppCompatibility"}, ... 144, ) }, ... 144, ) == 0x0
 01094   444   NtQueryValueKey  (144,  (144, "DisableAppCompat", Partial, 20, ... ) , Partial, 20, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01095   444   NtClose  (144, ... ) == 0x0
 01096   444   NtQueryVolumeInformationFile  (100, 1241008, 8, Device, ... {status=0x0, info=8}, ) == 0x0
 01097   444   NtOpenMutant  (0x120001, {24, 52, 0x0, 0, 0,  (0x120001, {24, 52, 0x0, 0, 0, "ShimCacheMutex"}, ... 144, ) }, ... 144, ) == 0x0
 01098   444   NtWaitForSingleObject  (144, 0, {-1000000, -1}, ... ) == 0x0
 01099   444   NtOpenSection  (0x2, {24, 52, 0x0, 0, 0,  (0x2, {24, 52, 0x0, 0, 0, "ShimSharedMemory"}, ... 148, ) }, ... 148, ) == 0x0
 01100   444   NtMapViewOfSection  (148, -1, (0x0), 0, 0, {0, 0}, 0, 1, 0, 4, ... (0x9f0000), {0, 0}, 57344, ) == 0x0
 01101   444   NtReleaseMutant  (144, ... 0x0, ) == 0x0
 01102   444   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\Apphelp.dll"}, 1238992, ... ) }, 1238992, ... ) == 0x0
 01103   444   NtOpenFile  (0x100020, {24, 0, 0x40, 0, 0,  (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\Apphelp.dll"}, 5, 96, ... 152, {status=0x0, info=1}, ) }, 5, 96, ... 152, {status=0x0, info=1}, ) == 0x0
 01104   444   NtCreateSection  (0xe, 0x0, 0x0, 16, 134217728, 152, ... 156, ) == 0x0
 01105   444   NtClose  (152, ... ) == 0x0
 01106   444   NtMapViewOfSection  (156, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 16, ... (0xa00000), 0x0, 106496, ) == 0x0
 01107   444   NtClose  (156, ... ) == 0x0
 01108   444   NtUnmapViewOfSection  (-1, 0xa00000, ... ) == 0x0
 01109   444   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\Apphelp.dll"}, 1239308, ... ) }, 1239308, ... ) == 0x0
 01110   444   NtOpenFile  (0x100020, {24, 0, 0x40, 0, 0,  (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\Apphelp.dll"}, 5, 96, ... 156, {status=0x0, info=1}, ) }, 5, 96, ... 156, {status=0x0, info=1}, ) == 0x0
 01111   444   NtCreateSection  (0xf, 0x0, 0x0, 16, 16777216, 156, ... 152, ) == 0x0
 01112   444   NtQuerySection  (152, Image, 48, ... {section info, class 1, size 48}, 0x0, ) == 0x0
 01113   444   NtClose  (156, ... ) == 0x0
 01114   444   NtMapViewOfSection  (152, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x75f40000), 0x0, 118784, ) == 0x0
 01115   444   NtClose  (152, ... ) == 0x0
 01116   444   NtCreateFile  (0x80100080, {24, 0, 0x40, 0, 0,  (0x80100080, {24, 0, 0x40, 0, 0, "\SystemRoot\AppPatch\sysmain.sdb"}, 0x0, 128, 1, 1, 96, 0, 0, ... 152, {status=0x0, info=1}, ) }, 0x0, 128, 1, 1, 96, 0, 0, ... 152, {status=0x0, info=1}, ) == 0x0
 01117   444   NtQueryInformationFile  (152, 1239596, 24, Standard, ... {status=0x0, info=24}, ) == 0x0
 01118   444   NtCreateSection  (0x4, 0x0, 0x0, 2, 134217728, 152, ... 156, ) == 0x0
 01119   444   NtMapViewOfSection  (156, -1, (0x0), 0, 0, 0x0, 0, 2, 0, 2, ... (0xa00000), 0x0, 1028096, ) == 0x0
 01120   444   NtQueryInformationFile  (152, 1239692, 24, Standard, ... {status=0x0, info=24}, ) == 0x0
 01121   444   NtCreateFile  (0x80100080, {24, 0, 0x40, 0, 0,  (0x80100080, {24, 0, 0x40, 0, 0, "\SystemRoot\AppPatch\systest.sdb"}, 0x0, 128, 1, 1, 96, 0, 0, ... ) }, 0x0, 128, 1, 1, 96, 0, 0, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01122   444   NtQuerySystemInformation  (Processor, 12, ... {system info, class 1, size 12}, 0x0, ) == 0x0
 01123   444   NtQueryInformationProcess  (-1, Wow64, 4, ... {process info, class 26, size 4}, 0x0, ) == 0x0
 01124   444   NtOpenFile  (0x100001, {24, 0, 0x40, 0, 0,  (0x100001, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\System32\"}, 3, 16417, ... 160, {status=0x0, info=1}, ) }, 3, 16417, ... 160, {status=0x0, info=1}, ) == 0x0
 01125   444   NtQueryDirectoryFile  (160, 0, 0, 0, 1237256, 616, BothDirectory, 1,  (160, 0, 0, 0, 1237256, 616, BothDirectory, 1, "lmkxqry.exe", 0, ... {status=0x0, info=116}, ) , 0, ... {status=0x0, info=116}, ) == 0x0
 01126   444   NtClose  (160, ... ) == 0x0
 01127   444   NtQueryInformationProcess  (-1, DefaultHardErrorMode, 4, ... {process info, class 12, size 4}, 0x0, ) == 0x0
 01128   444   NtSetInformationProcess  (-1, DefaultHardErrorMode, {process info, class 12, size 4}, 4, ... ) == 0x0
 01129   444   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\System32\lmkxqry.exe"}, 1236644, ... ) }, 1236644, ... ) == 0x0
 01130   444   NtOpenFile  (0x100001, {24, 0, 0x40, 0, 0,  (0x100001, {24, 0, 0x40, 0, 0, "\??\C:\"}, 3, 16417, ... 160, {status=0x0, info=1}, ) }, 3, 16417, ... 160, {status=0x0, info=1}, ) == 0x0
 01131   444   NtQueryDirectoryFile  (160, 0, 0, 0, 1236004, 616, BothDirectory, 1,  (160, 0, 0, 0, 1236004, 616, BothDirectory, 1, "WINDOWS", 0, ... {status=0x0, info=108}, ) , 0, ... {status=0x0, info=108}, ) == 0x0
 01132   444   NtClose  (160, ... ) == 0x0
 01133   444   NtOpenFile  (0x100001, {24, 0, 0x40, 0, 0,  (0x100001, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\"}, 3, 16417, ... 160, {status=0x0, info=1}, ) }, 3, 16417, ... 160, {status=0x0, info=1}, ) == 0x0
 01134   444   NtQueryDirectoryFile  (160, 0, 0, 0, 1236004, 616, BothDirectory, 1,  (160, 0, 0, 0, 1236004, 616, BothDirectory, 1, "System32", 0, ... {status=0x0, info=110}, ) , 0, ... {status=0x0, info=110}, ) == 0x0
 01135   444   NtClose  (160, ... ) == 0x0
 01136   444   NtOpenFile  (0x100001, {24, 0, 0x40, 0, 0,  (0x100001, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\System32\"}, 3, 16417, ... 160, {status=0x0, info=1}, ) }, 3, 16417, ... 160, {status=0x0, info=1}, ) == 0x0
 01137   444   NtQueryDirectoryFile  (160, 0, 0, 0, 1236004, 616, BothDirectory, 1,  (160, 0, 0, 0, 1236004, 616, BothDirectory, 1, "lmkxqry.exe", 0, ... {status=0x0, info=116}, ) , 0, ... {status=0x0, info=116}, ) == 0x0
 01138   444   NtClose  (160, ... ) == 0x0
 01139   444   NtQueryInformationProcess  (-1, DefaultHardErrorMode, 4, ... {process info, class 12, size 4}, 0x0, ) == 0x0
 01140   444   NtSetInformationProcess  (-1, DefaultHardErrorMode, {process info, class 12, size 4}, 4, ... ) == 0x0
 01141   444   NtQueryInformationProcess  (-1, DeviceMap, 36, ... {process info, class 23, size 36}, 0x0, ) == 0x0
 01142   444   NtOpenThreadTokenEx  (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN
 01143   444   NtOpenProcessTokenEx  (-1, 0x20008, 512, ... 160, ) == 0x0
 01144   444   NtQueryInformationToken  (160, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0
 01145   444   NtClose  (160, ... ) == 0x0
 01146   444   NtOpenKey  (0x80000100, {24, 0, 0x40, 0, 0,  (0x80000100, {24, 0, 0x40, 0, 0, "\REGISTRY\USER\S-1-5-21-1078081533-484763869-839522115-1003\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Layers"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01147   444   NtOpenKey  (0x80000100, {24, 0, 0x40, 0, 0,  (0x80000100, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Custom\lmkxqry.exe"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01148   444   NtQueryInformationProcess  (-1, DefaultHardErrorMode, 4, ... {process info, class 12, size 4}, 0x0, ) == 0x0
 01149   444   NtSetInformationProcess  (-1, DefaultHardErrorMode, {process info, class 12, size 4}, 4, ... ) == 0x0
 01150   444   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\System32\lmkxqry.exe"}, 1238924, ... ) }, 1238924, ... ) == 0x0
 01151   444   NtOpenFile  (0x100001, {24, 0, 0x40, 0, 0,  (0x100001, {24, 0, 0x40, 0, 0, "\??\C:\"}, 3, 16417, ... 160, {status=0x0, info=1}, ) }, 3, 16417, ... 160, {status=0x0, info=1}, ) == 0x0
 01152   444   NtQueryDirectoryFile  (160, 0, 0, 0, 1238284, 616, BothDirectory, 1,  (160, 0, 0, 0, 1238284, 616, BothDirectory, 1, "WINDOWS", 0, ... {status=0x0, info=108}, ) , 0, ... {status=0x0, info=108}, ) == 0x0
 01153   444   NtClose  (160, ... ) == 0x0
 01154   444   NtOpenFile  (0x100001, {24, 0, 0x40, 0, 0,  (0x100001, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\"}, 3, 16417, ... 160, {status=0x0, info=1}, ) }, 3, 16417, ... 160, {status=0x0, info=1}, ) == 0x0
 01155   444   NtQueryDirectoryFile  (160, 0, 0, 0, 1238284, 616, BothDirectory, 1,  (160, 0, 0, 0, 1238284, 616, BothDirectory, 1, "System32", 0, ... {status=0x0, info=110}, ) , 0, ... {status=0x0, info=110}, ) == 0x0
 01156   444   NtClose  (160, ... ) == 0x0
 01157   444   NtOpenFile  (0x100001, {24, 0, 0x40, 0, 0,  (0x100001, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\System32\"}, 3, 16417, ... 160, {status=0x0, info=1}, ) }, 3, 16417, ... 160, {status=0x0, info=1}, ) == 0x0
 01158   444   NtQueryDirectoryFile  (160, 0, 0, 0, 1238284, 616, BothDirectory, 1,  (160, 0, 0, 0, 1238284, 616, BothDirectory, 1, "lmkxqry.exe", 0, ... {status=0x0, info=116}, ) , 0, ... {status=0x0, info=116}, ) == 0x0
 01159   444   NtClose  (160, ... ) == 0x0
 01160   444   NtQueryInformationProcess  (-1, DefaultHardErrorMode, 4, ... {process info, class 12, size 4}, 0x0, ) == 0x0
 01161   444   NtSetInformationProcess  (-1, DefaultHardErrorMode, {process info, class 12, size 4}, 4, ... ) == 0x0
 01162   444   NtWaitForSingleObject  (144, 0, {-1000000, -1}, ... ) == 0x0
 01163   444   NtQueryVolumeInformationFile  (100, 1239568, 8, Device, ... {status=0x0, info=8}, ) == 0x0
 01164   444   NtQueryInformationFile  (100, 1239548, 40, Basic, ... {status=0x0, info=40}, ) == 0x0
 01165   444   NtQueryInformationFile  (100, 1239588, 24, Standard, ... {status=0x0, info=24}, ) == 0x0
 01166   444   NtReleaseMutant  (144, ... 0x0, ) == 0x0
 01167   444   NtUnmapViewOfSection  (-1, 0xa00000, ... ) == 0x0
 01168   444   NtClose  (156, ... ) == 0x0
 01169   444   NtClose  (152, ... ) == 0x0
 01170   444   NtQuerySection  (140, Image, 48, ... {section info, class 1, size 48}, 0x0, ) == 0x0
 01171   444   NtOpenKey  (0x80000000, {24, 0, 0x40, 0, 0,  (0x80000000, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\lmkxqry.exe"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01172   444   NtOpenThreadToken  (-2, 0x2000000, 1, ... ) == STATUS_NO_TOKEN
 01173   444   NtOpenProcessToken  (-1, 0xa, ... 152, ) == 0x0
 01174   444   NtQueryInformationToken  (152, User, 136, ... {token info, class 1, size 36}, 36, ) == 0x0
 01175   444   NtOpenKey  (0x3, {24, 0, 0x40, 0, 0,  (0x3, {24, 0, 0x40, 0, 0, "\Registry\MACHINE\System\CurrentControlSet\Control\SafeBoot\Option"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01176   444   NtOpenKey  (0x1, {24, 0, 0x40, 0, 0,  (0x1, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers"}, ... 156, ) }, ... 156, ) == 0x0
 01177   444   NtQueryValueKey  (156,  (156, "TransparentEnabled", Partial, 80, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) , Partial, 80, ... TitleIdx=0, Type=4, Data= (156, "TransparentEnabled", Partial, 80, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) }, 16, ) == 0x0
 01178   444   NtQueryValueKey  (156,  (156, "AuthenticodeEnabled", Partial, 80, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) , Partial, 80, ... TitleIdx=0, Type=4, Data= (156, "AuthenticodeEnabled", Partial, 80, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) }, 16, ) == 0x0
 01179   444   NtClose  (156, ... ) == 0x0
 01180   444   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers"}, ... 156, ) }, ... 156, ) == 0x0
 01181   444   NtQueryValueKey  (156,  (156, "ExecutableTypes", Partial, 0, ... ) , Partial, 0, ... ) == STATUS_BUFFER_TOO_SMALL
 01182   444   NtQueryValueKey  (156,  (156, "ExecutableTypes", Partial, 260, ... TitleIdx=0, Type=7, Data="A\0D\0E\0\0\0A\0D\0P\0\0\0B\0A\0S\0\0\0B\0A\0T\0\0\0C\0H\0M\0\0\0C\0M\0D\0\0\0C\0O\0M\0\0\0C\0P\0L\0\0\0C\0R\0T\0\0\0E\0X\0E\0\0\0H\0L\0P\0\0\0H\0T\0A\0\0\0I\0N\0F\0\0\0I\0N\0S\0\0\0I\0S\0P\0\0\0L\0N\0K\0\0\0M\0D\0B\0\0\0M\0D\0E\0\0\0M\0S\0C\0\0\0M\0S\0I\0\0\0M\0S\0P\0\0\0M\0S\0T\0\0\0O\0C\0X\0\0\0P\0C\0D\0\0\0P\0I\0F\0\0\0R\0E\0G\0\0\0S\0C\0R\0\0\0S\0H\0S\0\0\0U\0R\0L\0\0\0V\0B\0\0\0W\0S\0C\0\0\0\0\0"}, 260, ) , Partial, 260, ... TitleIdx=0, Type=7, Data= (156, "ExecutableTypes", Partial, 260, ... TitleIdx=0, Type=7, Data="A\0D\0E\0\0\0A\0D\0P\0\0\0B\0A\0S\0\0\0B\0A\0T\0\0\0C\0H\0M\0\0\0C\0M\0D\0\0\0C\0O\0M\0\0\0C\0P\0L\0\0\0C\0R\0T\0\0\0E\0X\0E\0\0\0H\0L\0P\0\0\0H\0T\0A\0\0\0I\0N\0F\0\0\0I\0N\0S\0\0\0I\0S\0P\0\0\0L\0N\0K\0\0\0M\0D\0B\0\0\0M\0D\0E\0\0\0M\0S\0C\0\0\0M\0S\0I\0\0\0M\0S\0P\0\0\0M\0S\0T\0\0\0O\0C\0X\0\0\0P\0C\0D\0\0\0P\0I\0F\0\0\0R\0E\0G\0\0\0S\0C\0R\0\0\0S\0H\0S\0\0\0U\0R\0L\0\0\0V\0B\0\0\0W\0S\0C\0\0\0\0\0"}, 260, ) }, 260, ) == 0x0
 01183   444   NtClose  (156, ... ) == 0x0
 01184   444   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Policies\Microsoft\Windows\Safer\LevelObjects"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01185   444   NtOpenKey  (0x1, {24, 0, 0x40, 0, 0,  (0x1, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers"}, ... 156, ) }, ... 156, ) == 0x0
 01186   444   NtQueryValueKey  (156,  (156, "Levels", Partial, 536, ... ) , Partial, 536, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01187   444   NtClose  (156, ... ) == 0x0
 01188   444   NtQueryDefaultLocale  (1, 1240380, ... ) == 0x0
 01189   444   NtQueryDefaultLocale  (1, 1240380, ... ) == 0x0
 01190   444   NtQueryDefaultLocale  (1, 1240380, ... ) == 0x0
 01191   444   NtQueryDefaultLocale  (1, 1240380, ... ) == 0x0
 01192   444   NtQueryDefaultLocale  (1, 1240380, ... ) == 0x0
 01193   444   NtQueryDefaultLocale  (1, 1240380, ... ) == 0x0
 01194   444   NtQueryDefaultLocale  (1, 1240380, ... ) == 0x0
 01195   444   NtQueryDefaultLocale  (1, 1240380, ... ) == 0x0
 01196   444   NtQueryDefaultLocale  (1, 1240380, ... ) == 0x0
 01197   444   NtQueryDefaultLocale  (1, 1240380, ... ) == 0x0
 01198   444   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\0\Paths"}, ... 156, ) }, ... 156, ) == 0x0
 01199   444   NtEnumerateKey  (156, 0, Basic, 280, ... {LastWrite={0x6f7a111e,0x1c73999}, TitleIdx=0, Name= (156, 0, Basic, 280, ... {LastWrite={0x6f7a111e,0x1c73999}, TitleIdx=0, Name="{dda3f824-d8cb-441b-834d-be2efd2c1a33}"}, 92, ) }, 92, ) == 0x0
 01200   444   NtOpenKey  (0x20019, {24, 156, 0x40, 0, 0,  (0x20019, {24, 156, 0x40, 0, 0, "{dda3f824-d8cb-441b-834d-be2efd2c1a33}"}, ... 160, ) }, ... 160, ) == 0x0
 01201   444   NtQueryValueKey  (160,  (160, "ItemData", Partial, 280, ... TitleIdx=0, Type=2, Data="%\0H\0K\0E\0Y\0_\0C\0U\0R\0R\0E\0N\0T\0_\0U\0S\0E\0R\0\\0S\0o\0f\0t\0w\0a\0r\0e\0\\0M\0i\0c\0r\0o\0s\0o\0f\0t\0\\0W\0i\0n\0d\0o\0w\0s\0\\0C\0u\0r\0r\0e\0n\0t\0V\0e\0r\0s\0i\0o\0n\0\\0E\0x\0p\0l\0o\0r\0e\0r\0\\0S\0h\0e\0l\0l\0 \0F\0o\0l\0d\0e\0r\0s\0\\0C\0a\0c\0h\0e\0%\0O\0L\0K\0*\0\0\0"}, 202, ) , Partial, 280, ... TitleIdx=0, Type=2, Data= (160, "ItemData", Partial, 280, ... TitleIdx=0, Type=2, Data="%\0H\0K\0E\0Y\0_\0C\0U\0R\0R\0E\0N\0T\0_\0U\0S\0E\0R\0\\0S\0o\0f\0t\0w\0a\0r\0e\0\\0M\0i\0c\0r\0o\0s\0o\0f\0t\0\\0W\0i\0n\0d\0o\0w\0s\0\\0C\0u\0r\0r\0e\0n\0t\0V\0e\0r\0s\0i\0o\0n\0\\0E\0x\0p\0l\0o\0r\0e\0r\0\\0S\0h\0e\0l\0l\0 \0F\0o\0l\0d\0e\0r\0s\0\\0C\0a\0c\0h\0e\0%\0O\0L\0K\0*\0\0\0"}, 202, ) }, 202, ) == 0x0
 01202   444   NtQueryValueKey  (160,  (160, "SaferFlags", Partial, 280, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) , Partial, 280, ... TitleIdx=0, Type=4, Data= (160, "SaferFlags", Partial, 280, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) }, 16, ) == 0x0
 01203   444   NtClose  (160, ... ) == 0x0
 01204   444   NtEnumerateKey  (156, 1, Basic, 280, ... ) == STATUS_NO_MORE_ENTRIES
 01205   444   NtClose  (156, ... ) == 0x0
 01206   444   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\0\Hashes"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01207   444   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\0\UrlZones"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01208   444   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\4096\Paths"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01209   444   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\4096\Hashes"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01210   444   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\4096\UrlZones"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01211   444   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\65536\Paths"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01212   444   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\65536\Hashes"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01213   444   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\65536\UrlZones"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01214   444   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\131072\Paths"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01215   444   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\131072\Hashes"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01216   444   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\131072\UrlZones"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01217   444   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\262144\Paths"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01218   444   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\262144\Hashes"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01219   444   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\262144\UrlZones"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01220   444   NtOpenThreadTokenEx  (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN
 01221   444   NtOpenProcessTokenEx  (-1, 0x20008, 512, ... 156, ) == 0x0
 01222   444   NtQueryInformationToken  (156, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0
 01223   444   NtClose  (156, ... ) == 0x0
 01224   444   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\REGISTRY\USER\S-1-5-21-1078081533-484763869-839522115-1003\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\0\Paths"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01225   444   NtOpenThreadTokenEx  (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN
 01226   444   NtOpenProcessTokenEx  (-1, 0x20008, 512, ... 156, ) == 0x0
 01227   444   NtQueryInformationToken  (156, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0
 01228   444   NtClose  (156, ... ) == 0x0
 01229   444   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\REGISTRY\USER\S-1-5-21-1078081533-484763869-839522115-1003\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\0\Hashes"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01230   444   NtOpenThreadTokenEx  (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN
 01231   444   NtOpenProcessTokenEx  (-1, 0x20008, 512, ... 156, ) == 0x0
 01232   444   NtQueryInformationToken  (156, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0
 01233   444   NtClose  (156, ... ) == 0x0
 01234   444   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\REGISTRY\USER\S-1-5-21-1078081533-484763869-839522115-1003\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\0\UrlZones"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01235   444   NtOpenThreadTokenEx  (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN
 01236   444   NtOpenProcessTokenEx  (-1, 0x20008, 512, ... 156, ) == 0x0
 01237   444   NtQueryInformationToken  (156, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0
 01238   444   NtClose  (156, ... ) == 0x0
 01239   444   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\REGISTRY\USER\S-1-5-21-1078081533-484763869-839522115-1003\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\4096\Paths"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01240   444   NtOpenThreadTokenEx  (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN
 01241   444   NtOpenProcessTokenEx  (-1, 0x20008, 512, ... 156, ) == 0x0
 01242   444   NtQueryInformationToken  (156, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0
 01243   444   NtClose  (156, ... ) == 0x0
 01244   444   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\REGISTRY\USER\S-1-5-21-1078081533-484763869-839522115-1003\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\4096\Hashes"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01245   444   NtOpenThreadTokenEx  (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN
 01246   444   NtOpenProcessTokenEx  (-1, 0x20008, 512, ... 156, ) == 0x0
 01247   444   NtQueryInformationToken  (156, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0
 01248   444   NtClose  (156, ... ) == 0x0
 01249   444   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\REGISTRY\USER\S-1-5-21-1078081533-484763869-839522115-1003\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\4096\UrlZones"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01250   444   NtOpenThreadTokenEx  (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN
 01251   444   NtOpenProcessTokenEx  (-1, 0x20008, 512, ... 156, ) == 0x0
 01252   444   NtQueryInformationToken  (156, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0
 01253   444   NtClose  (156, ... ) == 0x0
 01254   444   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\REGISTRY\USER\S-1-5-21-1078081533-484763869-839522115-1003\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\65536\Paths"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01255   444   NtOpenThreadTokenEx  (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN
 01256   444   NtOpenProcessTokenEx  (-1, 0x20008, 512, ... 156, ) == 0x0
 01257   444   NtQueryInformationToken  (156, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0
 01258   444   NtClose  (156, ... ) == 0x0
 01259   444   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\REGISTRY\USER\S-1-5-21-1078081533-484763869-839522115-1003\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\65536\Hashes"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01260   444   NtOpenThreadTokenEx  (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN
 01261   444   NtOpenProcessTokenEx  (-1, 0x20008, 512, ... 156, ) == 0x0
 01262   444   NtQueryInformationToken  (156, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0
 01263   444   NtClose  (156, ... ) == 0x0
 01264   444   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\REGISTRY\USER\S-1-5-21-1078081533-484763869-839522115-1003\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\65536\UrlZones"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01265   444   NtOpenThreadTokenEx  (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN
 01266   444   NtOpenProcessTokenEx  (-1, 0x20008, 512, ... 156, ) == 0x0
 01267   444   NtQueryInformationToken  (156, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0
 01268   444   NtClose  (156, ... ) == 0x0
 01269   444   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\REGISTRY\USER\S-1-5-21-1078081533-484763869-839522115-1003\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\131072\Paths"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01270   444   NtOpenThreadTokenEx  (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN
 01271   444   NtOpenProcessTokenEx  (-1, 0x20008, 512, ... 156, ) == 0x0
 01272   444   NtQueryInformationToken  (156, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0
 01273   444   NtClose  (156, ... ) == 0x0
 01274   444   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\REGISTRY\USER\S-1-5-21-1078081533-484763869-839522115-1003\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\131072\Hashes"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01275   444   NtOpenThreadTokenEx  (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN
 01276   444   NtOpenProcessTokenEx  (-1, 0x20008, 512, ... 156, ) == 0x0
 01277   444   NtQueryInformationToken  (156, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0
 01278   444   NtClose  (156, ... ) == 0x0
 01279   444   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\REGISTRY\USER\S-1-5-21-1078081533-484763869-839522115-1003\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\131072\UrlZones"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01280   444   NtOpenThreadTokenEx  (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN
 01281   444   NtOpenProcessTokenEx  (-1, 0x20008, 512, ... 156, ) == 0x0
 01282   444   NtQueryInformationToken  (156, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0
 01283   444   NtClose  (156, ... ) == 0x0
 01284   444   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\REGISTRY\USER\S-1-5-21-1078081533-484763869-839522115-1003\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\262144\Paths"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01285   444   NtOpenThreadTokenEx  (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN
 01286   444   NtOpenProcessTokenEx  (-1, 0x20008, 512, ... 156, ) == 0x0
 01287   444   NtQueryInformationToken  (156, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0
 01288   444   NtClose  (156, ... ) == 0x0
 01289   444   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\REGISTRY\USER\S-1-5-21-1078081533-484763869-839522115-1003\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\262144\Hashes"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01290   444   NtOpenThreadTokenEx  (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN
 01291   444   NtOpenProcessTokenEx  (-1, 0x20008, 512, ... 156, ) == 0x0
 01292   444   NtQueryInformationToken  (156, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0
 01293   444   NtClose  (156, ... ) == 0x0
 01294   444   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\REGISTRY\USER\S-1-5-21-1078081533-484763869-839522115-1003\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\262144\UrlZones"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01295   444   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers"}, ... 156, ) }, ... 156, ) == 0x0
 01296   444   NtQueryValueKey  (156,  (156, "DefaultLevel", Full, 524, ... TitleIdx=0, Type=4, Name="DefaultLevel", Data="\0\0\4\0"}, 48, ) , Full, 524, ... TitleIdx=0, Type=4, Name= (156, "DefaultLevel", Full, 524, ... TitleIdx=0, Type=4, Name="DefaultLevel", Data="\0\0\4\0"}, 48, ) , Data= (156, "DefaultLevel", Full, 524, ... TitleIdx=0, Type=4, Name="DefaultLevel", Data="\0\0\4\0"}, 48, ) }, 48, ) == 0x0
 01297   444   NtClose  (156, ... ) == 0x0
 01298   444   NtOpenThreadTokenEx  (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN
 01299   444   NtOpenProcessTokenEx  (-1, 0x20008, 512, ... 156, ) == 0x0
 01300   444   NtQueryInformationToken  (156, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0
 01301   444   NtClose  (156, ... ) == 0x0
 01302   444   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\REGISTRY\USER\S-1-5-21-1078081533-484763869-839522115-1003\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01303   444   NtOpenThreadToken  (-2, 0x8, 0, ... ) == STATUS_NO_TOKEN
 01304   444   NtOpenProcessToken  (-1, 0xa, ... 156, ) == 0x0
 01305   444   NtDuplicateToken  (156, 0xc, {24, 0, 0x0, 0, 1240900, 0x0}, 0, 2, ... 160, ) == 0x0
 01306   444   NtClose  (156, ... ) == 0x0
 01307   444   NtAccessCheck  (1378928, 160, 0x1, 1241028, 1240972, 56, 1241056, ... (0x1), ) == 0x0
 01308   444   NtClose  (160, ... ) == 0x0
 01309   444   NtOpenKey  (0x1, {24, 0, 0x40, 0, 0,  (0x1, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers"}, ... 160, ) }, ... 160, ) == 0x0
 01310   444   NtQueryValueKey  (160,  (160, "PolicyScope", Partial, 80, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) , Partial, 80, ... TitleIdx=0, Type=4, Data= (160, "PolicyScope", Partial, 80, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) }, 16, ) == 0x0
 01311   444   NtClose  (160, ... ) == 0x0
 01312   444   NtOpenSymbolicLinkObject  (0x1, {24, 0, 0x40, 0, 0,  (0x1, {24, 0, 0x40, 0, 0, "\??\C:"}, ... 160, ) }, ... 160, ) == 0x0
 01313   444   NtQuerySymbolicLinkObject  (160, ...  (160, ... "\Device\HarddiskVolume1", 48, ) , 48, ) == 0x0
 01314   444   NtClose  (160, ... ) == 0x0
 01315   444   NtQueryInformationFile  (100, 1239360, 528, Name, ... {status=0x0, info=62}, ) == 0x0
 01316   444   NtQueryInformationProcess  (-1, DefaultHardErrorMode, 4, ... {process info, class 12, size 4}, 0x0, ) == 0x0
 01317   444   NtSetInformationProcess  (-1, DefaultHardErrorMode, {process info, class 12, size 4}, 4, ... ) == 0x0
 01318   444   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\System32\lmkxqry.exe"}, 1238040, ... ) }, 1238040, ... ) == 0x0
 01319   444   NtOpenFile  (0x100001, {24, 0, 0x40, 0, 0,  (0x100001, {24, 0, 0x40, 0, 0, "\??\C:\"}, 3, 16417, ... 160, {status=0x0, info=1}, ) }, 3, 16417, ... 160, {status=0x0, info=1}, ) == 0x0
 01320   444   NtQueryDirectoryFile  (160, 0, 0, 0, 1237400, 616, BothDirectory, 1,  (160, 0, 0, 0, 1237400, 616, BothDirectory, 1, "WINDOWS", 0, ... {status=0x0, info=108}, ) , 0, ... {status=0x0, info=108}, ) == 0x0
 01321   444   NtClose  (160, ... ) == 0x0
 01322   444   NtOpenFile  (0x100001, {24, 0, 0x40, 0, 0,  (0x100001, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\"}, 3, 16417, ... 160, {status=0x0, info=1}, ) }, 3, 16417, ... 160, {status=0x0, info=1}, ) == 0x0
 01323   444   NtQueryDirectoryFile  (160, 0, 0, 0, 1237400, 616, BothDirectory, 1,  (160, 0, 0, 0, 1237400, 616, BothDirectory, 1, "System32", 0, ... {status=0x0, info=110}, ) , 0, ... {status=0x0, info=110}, ) == 0x0
 01324   444   NtClose  (160, ... ) == 0x0
 01325   444   NtOpenFile  (0x100001, {24, 0, 0x40, 0, 0,  (0x100001, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\System32\"}, 3, 16417, ... 160, {status=0x0, info=1}, ) }, 3, 16417, ... 160, {status=0x0, info=1}, ) == 0x0
 01326   444   NtQueryDirectoryFile  (160, 0, 0, 0, 1237400, 616, BothDirectory, 1,  (160, 0, 0, 0, 1237400, 616, BothDirectory, 1, "lmkxqry.exe", 0, ... {status=0x0, info=116}, ) , 0, ... {status=0x0, info=116}, ) == 0x0
 01327   444   NtClose  (160, ... ) == 0x0
 01328   444   NtQueryInformationProcess  (-1, DefaultHardErrorMode, 4, ... {process info, class 12, size 4}, 0x0, ) == 0x0
 01329   444   NtSetInformationProcess  (-1, DefaultHardErrorMode, {process info, class 12, size 4}, 4, ... ) == 0x0
 01330   444   NtOpenThreadTokenEx  (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN
 01331   444   NtOpenProcessTokenEx  (-1, 0x20008, 512, ... 160, ) == 0x0
 01332   444   NtQueryInformationToken  (160, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0
 01333   444   NtClose  (160, ... ) == 0x0
 01334   444   NtOpenKey  (0x20019, {24, 0, 0x640, 0, 0,  (0x20019, {24, 0, 0x640, 0, 0, "\REGISTRY\USER\S-1-5-21-1078081533-484763869-839522115-1003"}, ... 160, ) }, ... 160, ) == 0x0
 01335   444   NtOpenKey  (0x20019, {24, 160, 0x40, 0, 0,  (0x20019, {24, 160, 0x40, 0, 0, "Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders"}, ... 156, ) }, ... 156, ) == 0x0
 01336   444   NtClose  (160, ... ) == 0x0
 01337   444   NtQueryValueKey  (156,  (156, "Cache", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 01338   444   NtQueryValueKey  (156,  (156, "Cache", Partial, 162, ... TitleIdx=0, Type=1, Data="C\0:\0\\0D\0o\0c\0u\0m\0e\0n\0t\0s\0 \0a\0n\0d\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0S\0R\0I\0-\0u\0s\0e\0r\0\\0L\0o\0c\0a\0l\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0T\0e\0m\0p\0o\0r\0a\0r\0y\0 \0I\0n\0t\0e\0r\0n\0e\0t\0 \0F\0i\0l\0e\0s\0\0\0"}, 162, ) , Partial, 162, ... TitleIdx=0, Type=1, Data= (156, "Cache", Partial, 162, ... TitleIdx=0, Type=1, Data="C\0:\0\\0D\0o\0c\0u\0m\0e\0n\0t\0s\0 \0a\0n\0d\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0S\0R\0I\0-\0u\0s\0e\0r\0\\0L\0o\0c\0a\0l\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0T\0e\0m\0p\0o\0r\0a\0r\0y\0 \0I\0n\0t\0e\0r\0n\0e\0t\0 \0F\0i\0l\0e\0s\0\0\0"}, 162, ) }, 162, ) == 0x0
 01339   444   NtClose  (156, ... ) == 0x0
 01340   444   NtAllocateVirtualMemory  (-1, 0, 0, 4096, 8192, 4, ... 10485760, 4096, ) == 0x0
 01341   444   NtAllocateVirtualMemory  (-1, 10485760, 0, 4096, 4096, 4, ... 10485760, 4096, ) == 0x0
 01342   444   NtOpenKey  (0x1, {24, 0, 0x40, 0, 0,  (0x1, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers"}, ... 156, ) }, ... 156, ) == 0x0
 01343   444   NtQueryValueKey  (156,  (156, "LogFileName", Partial, 536, ... ) , Partial, 536, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01344   444   NtClose  (156, ... ) == 0x0
 01345   444   NtOpenKey  (0x3, {24, 0, 0x40, 0, 0,  (0x3, {24, 0, 0x40, 0, 0, "\Registry\MACHINE\System\CurrentControlSet\Control\SafeBoot\Option"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01346   444   NtQueryInformationToken  (152, User, 128, ... {token info, class 1, size 36}, 36, ) == 0x0
 01347   444   NtQueryInformationToken  (152, 15, 4, ... {token info, class 15, size 4}, 4, ) == 0x0
 01348   444   NtClose  (152, ... ) == 0x0
 01349   444   NtCreateProcessEx  (1243636, 2035711, 0, -1, 0, 140, 0, 0, 0, ... ) == 0x0
 01350   444   NtQueryInformationProcess  (152, Basic, 24, ... {ExitStatus=0x103,PebBaseAddress=0x7ffdf000,AffinityMask=0x1,BasePriority=8,Pid=320,ParentPid=436,}, 0x0, ) == 0x0
 01351   444   NtReadVirtualMemory  (152, 0x7ffdf008, 4, ...  (152, 0x7ffdf008, 4, ... "\0\0B1", 0x0, ) , 0x0, ) == 0x0
 01352   444   NtOpenFile  (0x1200a9, {24, 0, 0x40, 0, 0,  (0x1200a9, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\System32\lmkxqry.exe.Manifest"}, 1, 96, ... ) }, 1, 96, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01353   444   NtAllocateVirtualMemory  (-1, 1380352, 0, 8192, 4096, 4, ... 1380352, 8192, ) == 0x0
 01354   444   NtReadVirtualMemory  (152, 0x31420000, 4096, ...  (152, 0x31420000, 4096, ... "MZ\220\0\3\0\0\0\4\0\0\0\377\377\0\0\270\0\0\0\0\0\0\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0fn\0\0\330\0\0\0\16\37\272\16\0\264\11\315!\270\1L\315!This program cannot be run in DOS mode.\15\15\12$\0\0\0\0\0\0\0I\3538\210\15\212V\333\15\212V\333\15\212V\333\216\226X\333\17\212V\333\345\225R\333\17\212V\333\15\212V\333\12\212V\333\15\212W\333[\212V\333o\225E\333\4\212V\333\345\225]\333\7\212V\333Rich\15\212V\333\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0PE\0\0L\1\4\0\310Y\330@\0\0\0\0\0\0\0\0\340\0\17\1\13\1\6\0\0 \0\0\0\20\0\0\0P\0\0\0\240\0\0\0`\0\0\0\200\0\0\0\0B1\0\20\0\0\0\2\0\0\4\0\0\0\0\0\0\0\4\0\0\0\0\0\0\0\0\260\0\0\0\20\0\0\0\0\0\0\2\0\0\0\0\0\20\0\0\20\0\0\0\0\20\0\0\20\0\0\0\0\0\0\20\0\0\0\0\0\0\0\0\0\0\0\0\200\0\0h\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0UPX0\0\0\0\0\0P\0\0\0\20\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0", 4096, ) , 4096, ) == 0x0
 01355   444   NtQueryDebugFilterState  (53, 2, ... ) == 0x0
 01356   444   NtQueryInformationProcess  (152, Basic, 24, ... {ExitStatus=0x103,PebBaseAddress=0x7ffdf000,AffinityMask=0x1,BasePriority=8,Pid=320,ParentPid=436,}, 0x0, ) == 0x0
 01357   444   NtAllocateVirtualMemory  (-1, 0, 0, 1660, 4096, 4, ... 10551296, 4096, ) == 0x0
 01358   444   NtAllocateVirtualMemory  (152, 0, 0, 1910, 4096, 4, ... 65536, 4096, ) == 0x0
 01359   444   NtWriteVirtualMemory  (152, 0x10000,  (152, 0x10000, "=\0:\0:\0=\0:\0:\0\\0\0\0=\0C\0:\0=\0C\0:\0\\0p\0o\0l\0y\0u\0n\0p\0a\0c\0k\0\0\0=\0E\0x\0i\0t\0C\0o\0d\0e\0=\00\00\00\00\00\00\00\02\0\0\0=\0U\0:\0=\0U\0:\0\\0s\0t\0a\0r\0t\0u\0p\0s\0c\0r\0i\0p\0t\0s\0\0\0A\0L\0L\0U\0S\0E\0R\0S\0P\0R\0O\0F\0I\0L\0E\0=\0C\0:\0\\0D\0o\0c\0u\0m\0e\0n\0t\0s\0 \0a\0n\0d\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0A\0l\0l\0 \0U\0s\0e\0r\0s\0\0\0A\0P\0P\0D\0A\0T\0A\0=\0C\0:\0\\0D\0o\0c\0u\0m\0e\0n\0t\0s\0 \0a\0n\0d\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0S\0R\0I\0-\0u\0s\0e\0r\0\\0A\0p\0p\0l\0i\0c\0a\0t\0i\0o\0n\0 \0D\0a\0t\0a\0\0\0C\0L\0I\0E\0N\0T\0N\0A\0M\0E\0=\0C\0o\0n\0s\0o\0l\0e\0\0\0C\0o\0m\0m\0o\0n\0P\0r\0o\0g\0r\0a\0m\0F\0i\0l\0e\0s\0=\0C\0:\0\\0P\0r\0o\0g\0r\0a\0m\0 \0F\0i\0l\0e\0s\0\\0C\0o\0m\0m\0o\0n\0 \0F\0i\0l\0e\0s\0\0\0C\0O\0M\0", 1910, ... 0x0, ) , 1910, ... 0x0, ) == 0x0
 01360   444   NtAllocateVirtualMemory  (152, 0, 0, 1660, 4096, 4, ... 131072, 4096, ) == 0x0
 01361   444   NtWriteVirtualMemory  (152, 0x20000,  (152, 0x20000, "\0\20\0\0|\6\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\3\0\0\0\0\0\0\0\13\0\0\0$\0\10\2\220\2\0\0\0\0\0\0\374\0\376\0\230\4\0\0>\0@\0\230\5\0\0>\0@\0\330\5\0\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\1\0\0\0\0\0\0\0>\0@\0\30\6\0\0\36\0 \0X\6\0\0\0\0\2\0x\6\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0", 1660, ... 0x0, ) , 1660, ... 0x0, ) == 0x0
 01362   444   NtWriteVirtualMemory  (152, 0x7ffdf010,  (152, 0x7ffdf010, "\0\0\2\0", 4, ... 0x0, ) , 4, ... 0x0, ) == 0x0
 01363   444   NtWriteVirtualMemory  (152, 0x7ffdf1e8,  (152, 0x7ffdf1e8, "\0\0\0\0", 4, ... 0x0, ) , 4, ... 0x0, ) == 0x0
 01364   444   NtFreeVirtualMemory  (-1, (0xa10000), 0, 32768, ... (0xa10000), 4096, ) == 0x0
 01365   444   NtAllocateVirtualMemory  (152, 0, 0, 1048576, 8192, 4, ... 196608, 1048576, ) == 0x0
 01366   444   NtAllocateVirtualMemory  (152, 1236992, 0, 8192, 4096, 4, ... 1236992, 8192, ) == 0x0
 01367   444   NtProtectVirtualMemory  (152, (0x12e000), 4096, 260, ... (0x12e000), 4096, 4, ) == 0x0
 01368   444   NtCreateThread  (0x1f03ff, 0x0, 152, 1241900, 1242620, 1, ... 156, {320, 832}, ) == 0x0
 01369   444   NtRequestWaitReplyPort  (24, {168, 196, new_msg, 0, 1312824, 1310720, 1368240, 1243720}  (24, {168, 196, new_msg, 0, 1312824, 1310720, 1368240, 1243720} "\0\0\0\0\0\0\1\0\2$\370w U\367w\233\0\0\0\234\0\0\0@\1\0\0@\3\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\360\375\177\0\0\0\0\0\0\24\0\0\0\0\0" ... {168, 196, reply, 0, 436, 444, 1562, 0} "\0\0\0\0\0\0\1\0\0\0\0\0 U\367w\230\0\0\0\234\0\0\0@\1\0\0@\3\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\360\375\177\0\0\0\0\0\0\24\0\0\0\0\0" )  ... {168, 196, reply, 0, 436, 444, 1562, 0}  (24, {168, 196, new_msg, 0, 1312824, 1310720, 1368240, 1243720} "\0\0\0\0\0\0\1\0\2$\370w U\367w\233\0\0\0\234\0\0\0@\1\0\0@\3\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\360\375\177\0\0\0\0\0\0\24\0\0\0\0\0" ... {168, 196, reply, 0, 436, 444, 1562, 0} "\0\0\0\0\0\0\1\0\0\0\0\0 U\367w\230\0\0\0\234\0\0\0@\1\0\0@\3\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\360\375\177\0\0\0\0\0\0\24\0\0\0\0\0" )  ) == 0x0
 01370   444   NtResumeThread  (156, ... 1, ) == 0x0
 01371   444   NtClose  (100, ... ) == 0x0
 01372   444   NtClose  (140, ... ) == 0x0
 01373   444   NtQueryInformationProcess  (152, Basic, 24, ... {ExitStatus=0x103,PebBaseAddress=0x7ffdf000,AffinityMask=0x1,BasePriority=8,Pid=320,ParentPid=436,}, 0x0, ) == 0x0
 01374   444   NtUserWaitForInputIdle  (320, 30000, 0, ...
 01375   444   NtCreateEvent  (0x1f0003, 0x0, 0, 0, ... 140, ) == 0x0
 01376   444   NtClose  (140, ... ) == 0x0
 01374   444   NtUserWaitForInputIdle  ... ) == 0x0
 01377   444   NtClose  (152, ... ) == 0x0
 01378   444   NtClose  (156, ... ) == 0x0
 01379   444   NtDelayExecution  (0, {-5000000, -1}, ... ) == 0x0
 01380   444   NtTerminateProcess  (0, 0, ... ) == 0x0
 01381   444   NtQueryVirtualMemory  (-1, 0x896d20, Basic, 28, ... {BaseAddress=0x896000,AllocationBase=0x860000,AllocationProtect=0x80,RegionSize=0x12000,State=0x1000,Protect=0x4,Type=0x1000000,}, 28, ) == 0x0
 01382   444   NtQueryVirtualMemory  (-1, 0x89762c, Basic, 28, ... {BaseAddress=0x897000,AllocationBase=0x860000,AllocationProtect=0x80,RegionSize=0x11000,State=0x1000,Protect=0x4,Type=0x1000000,}, 28, ) == 0x0
 01383   444   NtQueryVirtualMemory  (-1, 0x86cef4, Basic, 28, ... {BaseAddress=0x86c000,AllocationBase=0x860000,AllocationProtect=0x80,RegionSize=0x3c000,State=0x1000,Protect=0x4,Type=0x1000000,}, 28, ) == 0x0
 01384   444   NtGdiDeleteObjectApp  (252314718, ... ) == 0x1
 01385   444   NtGdiDeleteObjectApp  (168428639, ... ) == 0x1
 01386   444   NtGdiDeleteObjectApp  (185205856, ... ) == 0x1
 01387   444   NtUserDestroyCursor  (65727, 1, ... ) == 0x1
 01388   444   NtUserDestroyCursor  (65725, 1, ... ) == 0x1
 01389   444   NtUserDestroyCursor  (65723, 1, ... ) == 0x1
 01390   444   NtUserDestroyCursor  (65721, 1, ... ) == 0x1
 01391   444   NtUserDestroyCursor  (65719, 1, ... ) == 0x1
 01392   444   NtUserDestroyCursor  (65717, 1, ... ) == 0x1
 01393   444   NtUserDestroyCursor  (65715, 1, ... ) == 0x1
 01394   444   NtUserFindExistingCursorIcon  (1243472, 1243488, 1244056, ... ) == 0x10011
 01395   444   NtDeleteAtom  (49180, ... ) == 0x0
 01396   444   NtDeleteAtom  (49181, ... ) == 0x0
 01397   444   NtGdiDeleteObjectApp  (101188701, ... ) == 0x1
 01398   444   NtClose  (96, ... ) == 0x0
 01399   444   NtSetInformationThread  (-2, ZeroTlsCell, {ZeroTlsCell=0x8,}, 4, ... ) == 0x0
 01400   444   NtUserGetClassInfo  (1999896576, 1244172, 1244124, 1244200, 0, ... ) == 0xc03b
 01401   444   NtUserUnregisterClass  (1244176, 1999896576, 1244164, ... ) == 0x1
 01402   444   NtUserGetClassInfo  (1999896576, 1244172, 1244124, 1244200, 0, ... ) == 0xc03d
 01403   444   NtUserUnregisterClass  (1244176, 1999896576, 1244164, ... ) == 0x1
 01404   444   NtUserGetClassInfo  (1999896576, 1244172, 1244124, 1244200, 0, ... ) == 0xc03f
 01405   444   NtUserUnregisterClass  (1244176, 1999896576, 1244164, ... ) == 0x1
 01406   444   NtUserGetClassInfo  (1999896576, 1244172, 1244124, 1244200, 0, ... ) == 0xc041
 01407   444   NtUserUnregisterClass  (1244176, 1999896576, 1244164, ... ) == 0x1
 01408   444   NtUserGetClassInfo  (1999896576, 1244172, 1244124, 1244200, 0, ... ) == 0xc043
 01409   444   NtUserUnregisterClass  (1244176, 1999896576, 1244164, ... ) == 0x1
 01410   444   NtUserGetClassInfo  (1999896576, 1244172, 1244124, 1244200, 0, ... ) == 0xc045
 01411   444   NtUserUnregisterClass  (1244176, 1999896576, 1244164, ... ) == 0x1
 01412   444   NtUserGetClassInfo  (1999896576, 1244172, 1244124, 1244200, 0, ... ) == 0xc047
 01413   444   NtUserUnregisterClass  (1244176, 1999896576, 1244164, ... ) == 0x1
 01414   444   NtUserGetClassInfo  (1999896576, 1244172, 1244124, 1244200, 0, ... ) == 0xc049
 01415   444   NtUserUnregisterClass  (1244176, 1999896576, 1244164, ... ) == 0x1
 01416   444   NtUserGetClassInfo  (1999896576, 1244172, 1244124, 1244200, 0, ... ) == 0xc04b
 01417   444   NtUserUnregisterClass  (1244176, 1999896576, 1244164, ... ) == 0x1
 01418   444   NtUserGetClassInfo  (1999896576, 1244172, 1244124, 1244200, 0, ... ) == 0xc04d
 01419   444   NtUserUnregisterClass  (1244176, 1999896576, 1244164, ... ) == 0x1
 01420   444   NtUserGetClassInfo  (1999896576, 1244172, 1244124, 1244200, 0, ... ) == 0xc04f
 01421   444   NtUserUnregisterClass  (1244176, 1999896576, 1244164, ... ) == 0x1
 01422   444   NtUserGetClassInfo  (1999896576, 1244172, 1244124, 1244200, 0, ... ) == 0xc051
 01423   444   NtUserUnregisterClass  (1244176, 1999896576, 1244164, ... ) == 0x1
 01424   444   NtUserGetClassInfo  (1999896576, 1244172, 1244124, 1244200, 0, ... ) == 0xc053
 01425   444   NtUserUnregisterClass  (1244176, 1999896576, 1244164, ... ) == 0x1
 01426   444   NtUserGetClassInfo  (1999896576, 1244172, 1244124, 1244200, 0, ... ) == 0xc057
 01427   444   NtUserUnregisterClass  (1244176, 1999896576, 1244164, ... ) == 0x1
 01428   444   NtUserGetClassInfo  (1999896576, 1244172, 1244124, 1244200, 0, ... ) == 0xc059
 01429   444   NtUserUnregisterClass  (1244176, 1999896576, 1244164, ... ) == 0x1
 01430   444   NtUserGetClassInfo  (1999896576, 1244172, 1244124, 1244200, 0, ... ) == 0xc05b
 01431   444   NtUserUnregisterClass  (1244176, 1999896576, 1244164, ... ) == 0x1
 01432   444   NtUserGetClassInfo  (1999896576, 1244172, 1244124, 1244200, 0, ... ) == 0xc05d
 01433   444   NtUserUnregisterClass  (1244176, 1999896576, 1244164, ... ) == 0x1
 01434   444   NtUserGetClassInfo  (1999896576, 1244172, 1244124, 1244200, 0, ... ) == 0xc05f
 01435   444   NtUserUnregisterClass  (1244176, 1999896576, 1244164, ... ) == 0x1
 01436   444   NtUserGetClassInfo  (1905590272, 1244172, 1244124, 1244200, 0, ... ) == 0xc03b
 01437   444   NtUserUnregisterClass  (1244176, 1905590272, 1244164, ... ) == 0x1
 01438   444   NtUserGetClassInfo  (1905590272, 1244172, 1244124, 1244200, 0, ... ) == 0xc03d
 01439   444   NtUserUnregisterClass  (1244176, 1905590272, 1244164, ... ) == 0x1
 01440   444   NtUserGetClassInfo  (1905590272, 1244172, 1244124, 1244200, 0, ... ) == 0xc03f
 01441   444   NtUserUnregisterClass  (1244176, 1905590272, 1244164, ... ) == 0x1
 01442   444   NtUserGetClassInfo  (1905590272, 1244172, 1244124, 1244200, 0, ... ) == 0xc041
 01443   444   NtUserUnregisterClass  (1244176, 1905590272, 1244164, ... ) == 0x1
 01444   444   NtUserGetClassInfo  (1905590272, 1244172, 1244124, 1244200, 0, ... ) == 0xc043
 01445   444   NtUserUnregisterClass  (1244176, 1905590272, 1244164, ... ) == 0x1
 01446   444   NtUserGetClassInfo  (1905590272, 1244172, 1244124, 1244200, 0, ... ) == 0xc045
 01447   444   NtUserUnregisterClass  (1244176, 1905590272, 1244164, ... ) == 0x1
 01448   444   NtUserGetClassInfo  (1905590272, 1244172, 1244124, 1244200, 0, ... ) == 0xc047
 01449   444   NtUserUnregisterClass  (1244176, 1905590272, 1244164, ... ) == 0x1
 01450   444   NtUserGetClassInfo  (1905590272, 1244172, 1244124, 1244200, 0, ... ) == 0xc049
 01451   444   NtUserUnregisterClass  (1244176, 1905590272, 1244164, ... ) == 0x1
 01452   444   NtUserGetClassInfo  (1905590272, 1244172, 1244124, 1244200, 0, ... ) == 0xc04b
 01453   444   NtUserUnregisterClass  (1244176, 1905590272, 1244164, ... ) == 0x1
 01454   444   NtUserGetClassInfo  (1905590272, 1244172, 1244124, 1244200, 0, ... ) == 0xc04d
 01455   444   NtUserUnregisterClass  (1244176, 1905590272, 1244164, ... ) == 0x1
 01456   444   NtUserGetClassInfo  (1905590272, 1244172, 1244124, 1244200, 0, ... ) == 0xc04f
 01457   444   NtUserUnregisterClass  (1244176, 1905590272, 1244164, ... ) == 0x1
 01458   444   NtUserGetClassInfo  (1905590272, 1244172, 1244124, 1244200, 0, ... ) == 0xc051
 01459   444   NtUserUnregisterClass  (1244176, 1905590272, 1244164, ... ) == 0x1
 01460   444   NtUserGetClassInfo  (1905590272, 1244172, 1244124, 1244200, 0, ... ) == 0xc053
 01461   444   NtUserUnregisterClass  (1244176, 1905590272, 1244164, ... ) == 0x1
 01462   444   NtUserGetClassInfo  (1905590272, 1244172, 1244124, 1244200, 0, ... ) == 0xc057
 01463   444   NtUserUnregisterClass  (1244176, 1905590272, 1244164, ... ) == 0x1
 01464   444   NtUserGetClassInfo  (1905590272, 1244172, 1244124, 1244200, 0, ... ) == 0xc059
 01465   444   NtUserUnregisterClass  (1244176, 1905590272, 1244164, ... ) == 0x1
 01466   444   NtUserGetClassInfo  (1905590272, 1244172, 1244124, 1244200, 0, ... ) == 0xc05b
 01467   444   NtUserUnregisterClass  (1244176, 1905590272, 1244164, ... ) == 0x1
 01468   444   NtUserGetClassInfo  (1905590272, 1244172, 1244124, 1244200, 0, ... ) == 0xc05d
 01469   444   NtUserUnregisterClass  (1244176, 1905590272, 1244164, ... ) == 0x1
 01470   444   NtUserGetClassInfo  (1905590272, 1244172, 1244124, 1244200, 0, ... ) == 0xc05f
 01471   444   NtUserUnregisterClass  (1244176, 1905590272, 1244164, ... ) == 0x1
 01472   444   NtUserGetClassInfo  (1905590272, 1244172, 1244124, 1244200, 0, ... ) == 0xc017
 01473   444   NtUserUnregisterClass  (1244176, 1905590272, 1244164, ... ) == 0x1
 01474   444   NtUserGetClassInfo  (1905590272, 1244172, 1244124, 1244200, 0, ... ) == 0xc019
 01475   444   NtUserUnregisterClass  (1244176, 1905590272, 1244164, ... ) == 0x1
 01476   444   NtUserGetClassInfo  (1905590272, 1244172, 1244124, 1244200, 0, ... ) == 0xc018
 01477   444   NtUserUnregisterClass  (1244176, 1905590272, 1244164, ... ) == 0x1
 01478   444   NtUserGetClassInfo  (1905590272, 1244172, 1244124, 1244200, 0, ... ) == 0xc01a
 01479   444   NtUserUnregisterClass  (1244176, 1905590272, 1244164, ... ) == 0x1
 01480   444   NtUserGetClassInfo  (1905590272, 1244172, 1244124, 1244200, 0, ... ) == 0xc01c
 01481   444   NtUserUnregisterClass  (1244176, 1905590272, 1244164, ... ) == 0x1
 01482   444   NtUserGetClassInfo  (1905590272, 1244172, 1244124, 1244200, 0, ... ) == 0xc01e
 01483   444   NtUserUnregisterClass  (1244176, 1905590272, 1244164, ... ) == 0x1
 01484   444   NtUserGetClassInfo  (1905590272, 1244172, 1244124, 1244200, 0, ... ) == 0xc01b
 01485   444   NtUserUnregisterClass  (1244176, 1905590272, 1244164, ... ) == 0x1
 01486   444   NtUserGetClassInfo  (1905590272, 1244172, 1244124, 1244200, 0, ... ) == 0xc068
 01487   444   NtUserUnregisterClass  (1244176, 1905590272, 1244164, ... ) == 0x1
 01488   444   NtUserGetClassInfo  (1905590272, 1244172, 1244124, 1244200, 0, ... ) == 0xc06a
 01489   444   NtUserUnregisterClass  (1244176, 1905590272, 1244164, ... ) == 0x1
 01490   444   NtUnmapViewOfSection  (-1, 0x850000, ... ) == 0x0
 01491   444   NtClose  (76, ... ) == 0x0
 01492   444   NtClose  (64, ... ) == 0x0
 01493   444   NtSetInformationThread  (-2, ZeroTlsCell, {ZeroTlsCell=0x5,}, 4, ... ) == 0x0
 01494   444   NtSetInformationThread  (-2, ZeroTlsCell, {ZeroTlsCell=0x1,}, 4, ... ) == 0x0
 01495   444   NtSetInformationThread  (-2, ZeroTlsCell, {ZeroTlsCell=0x2,}, 4, ... ) == 0x0
 01496   444   NtSetInformationThread  (-2, ZeroTlsCell, {ZeroTlsCell=0x3,}, 4, ... ) == 0x0
 01497   444   NtFreeVirtualMemory  (-1, (0xa00000), 4096, 32768, ... (0xa00000), 4096, ) == 0x0
 01498   444   NtRequestWaitReplyPort  (24, {20, 48, new_msg, 0, 0, 0, 0, 0}  (24, {20, 48, new_msg, 0, 0, 0, 0, 0} "\0\0\0\0\3\0\1\0@U\367w\0\0\0\0\0\0\0\0" ... {20, 48, reply, 0, 436, 444, 3265, 0} "\0\0\0\0\3\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0" )  ... {20, 48, reply, 0, 436, 444, 3265, 0}  (24, {20, 48, new_msg, 0, 0, 0, 0, 0} "\0\0\0\0\3\0\1\0@U\367w\0\0\0\0\0\0\0\0" ... {20, 48, reply, 0, 436, 444, 3265, 0} "\0\0\0\0\3\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0" )  ) == 0x0
 01499   444   NtTerminateProcess  (-1, 0, ...
 01500   444   NtClose  (44, ... ) == 0x0