Summary:

NtCallbackReturn(>) 1 NtUserGetImeInfoEx(>) 1 NtUserGetObjectInformation(>) 4 NtDeviceIoControlFile(>) 16
NtCreateProcessEx(>) 1 NtUserOpenWindowStation(>) 1 NtUserMessageCall(>) 4 NtCreateEvent(>) 17
NtCreateSemaphore(>) 1 NtUserSetCursor(>) 1 NtUserRemoveProp(>) 4 NtRequestWaitReplyPort(>) 18
NtCreateThread(>) 1 NtUserSetProp(>) 1 NtDuplicateObject(>) 5 NtWaitForSingleObject(>) 18
NtGdiCreateBitmap(>) 1 NtUserSetWindowLong(>) 1 NtGdiGetStockObject(>) 5 NtUserCallOneParam(>) 20
NtGdiCreatePatternBrushInternal(>) 1 NtUserUpdateInputContext(>) 1 NtReadFile(>) 5 NtQuerySection(>) 21
NtGdiGetTextCharsetInfo(>) 1 NtAccessCheck(>) 2 NtSetInformationFile(>) 5 NtQueryDirectoryFile(>) 24
NtGdiGetTextFaceW(>) 1 NtConnectPort(>) 2 NtUserBuildHwndList(>) 5 NtCreateFile(>) 26
NtGdiGetTextMetricsW(>) 1 NtCreateIoCompletion(>) 2 NtWriteVirtualMemory(>) 5 NtOpenSection(>) 27
NtGdiGetWidthTable(>) 1 NtDuplicateToken(>) 2 NtUserGetProcessWindowStation(>) 6 NtQueryDebugFilterState(>) 29
NtGdiInit(>) 1 NtGdiCreateSolidBrush(>) 2 NtFsControlFile(>) 7 NtOpenProcessTokenEx(>) 36
NtGdiQueryFontAssocInfo(>) 1 NtNotifyChangeKey(>) 2 NtQueryInformationFile(>) 7 NtOpenThreadTokenEx(>) 36
NtGdiSelectBitmap(>) 1 NtQueryInformationJobObject(>) 2 NtUserGetDC(>) 7 NtQueryVirtualMemory(>) 39
NtLockVirtualMemory(>) 1 NtQueryPerformanceCounter(>) 2 NtWaitForMultipleObjects(>) 7 NtQueryInformationToken(>) 47
NtOpenEvent(>) 1 NtTerminateProcess(>) 2 NtEnumerateKey(>) 8 NtSetInformationProcess(>) 49
NtOpenKeyedEvent(>) 1 NtUserCloseWindowStation(>) 2 NtOpenProcessToken(>) 8 NtQueryDefaultLocale(>) 60
NtOpenMutant(>) 1 NtUserPostThreadMessage(>) 2 NtOpenThreadToken(>) 8 NtQueryInformationProcess(>) 64
NtQueryInstallUILanguage(>) 1 NtUserSetWindowFNID(>) 2 NtQueryDefaultUILanguage(>) 8 NtUnmapViewOfSection(>) 64
NtQueryObject(>) 1 NtUserSetWindowsHookEx(>) 2 NtSetValueKey(>) 8 NtCreateSection(>) 69
NtQuerySystemTime(>) 1 NtUserUnhookWindowsHookEx(>) 2 NtUserSystemParametersInfo(>) 8 NtOpenFile(>) 70
NtRegisterThreadTerminatePort(>) 1 NtGdiHfontCreate(>) 3 NtUserCallNoParam(>) 9 NtAllocateVirtualMemory(>) 77
NtResumeThread(>) 1 NtOpenDirectoryObject(>) 3 NtCreateMutant(>) 10 NtQuerySystemInformation(>) 78
NtSecureConnectPort(>) 1 NtOpenSymbolicLinkObject(>) 3 NtCreateKey(>) 11 NtMapViewOfSection(>) 88
NtTestAlert(>) 1 NtQuerySymbolicLinkObject(>) 3 NtFreeVirtualMemory(>) 11 NtQueryAttributesFile(>) 99
NtUserBuildNameList(>) 1 NtReadVirtualMemory(>) 3 NtUserFindExistingCursorIcon(>) 11 NtFlushInstructionCache(>) 121
NtUserCallHwndParam(>) 1 NtSetEvent(>) 3 NtWriteFile(>) 11 NtUserValidateHandleSecure(>) 141
NtUserCloseDesktop(>) 1 NtSetInformationObject(>) 3 NtReleaseMutant(>) 12 NtUserQueryWindow(>) 162
NtUserCreateWindowEx(>) 1 NtUserGetThreadDesktop(>) 3 NtUserGetWindowDC(>) 12 NtOpenKey(>) 222
NtUserGetAtomName(>) 1 NtUserOpenDesktop(>) 3 NtUserRegisterWindowMessage(>) 13 NtProtectVirtualMemory(>) 243
NtUserGetClassName(>) 1 NtGdiCreateCompatibleDC(>) 4 NtContinue(>) 15 NtQueryValueKey(>) 243
NtUserGetForegroundWindow(>) 1 NtGdiDeleteObjectApp(>) 4 NtSetInformationThread(>) 15 NtClose(>) 384
NtUserGetGUIThreadInfo(>) 1 NtQueryVolumeInformationFile(>) 4 NtUserRegisterClassExWOW(>) 15

Trace:

00001 464 NtOpenFile (0x80100000, {24, 0, 0x240, 0, 0, (0x80100000, {24, 0, 0x240, 0, 0, "\SystemRoot\Prefetch\PACKED.EXE-09ED06A1.pf"}, 0, 32, ... ) }, 0, 32, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 00002 464 NtOpenKey (0x80000000, {24, 0, 0x40, 0, 0, (0x80000000, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\packed.exe"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 00003 464 NtOpenKeyedEvent (0x2000000, {24, 0, 0x0, 0, 0, (0x2000000, {24, 0, 0x0, 0, 0, "\KernelObjects\CritSecOutOfMemoryEvent"}, ... 4, ) }, ... 4, ) == 0x0 00004 464 NtQuerySystemInformation (Basic, 44, ... {Unknown=0,MaximumIncrement=156250,PhysicalPageSize=0x1000,NumberOfPhysicalPages=0xff7c,LowestPhysicalPage=0x1,HighestPhysicalPage=0xffff,AllocationGranularity=0x10000,LowestUserAddress=0x10000,HighestUserAddress=0x7ffeffff,ActiveProcessors=1,NumberProcessors=1,}, 0x0, ) == 0x0 00005 464 NtAllocateVirtualMemory (-1, 0, 0, 1048576, 8192, 4, ... 1310720, 1048576, ) == 0x0 00006 464 NtAllocateVirtualMemory (-1, 1310720, 0, 4096, 4096, 4, ... 1310720, 4096, ) == 0x0 00007 464 NtAllocateVirtualMemory (-1, 1314816, 0, 8192, 4096, 4, ... 1314816, 8192, ) == 0x0 00008 464 NtQuerySystemInformation (Basic, 44, ... {Unknown=0,MaximumIncrement=156250,PhysicalPageSize=0x1000,NumberOfPhysicalPages=0xff7c,LowestPhysicalPage=0x1,HighestPhysicalPage=0xffff,AllocationGranularity=0x10000,LowestUserAddress=0x10000,HighestUserAddress=0x7ffeffff,ActiveProcessors=1,NumberProcessors=1,}, 0x0, ) == 0x0 00009 464 NtAllocateVirtualMemory (-1, 0, 0, 65536, 8192, 4, ... 2359296, 65536, ) == 0x0 00010 464 NtAllocateVirtualMemory (-1, 2359296, 0, 24576, 4096, 4, ... 2359296, 24576, ) == 0x0 00011 464 NtOpenDirectoryObject (0x3, {24, 0, 0x40, 0, 0, (0x3, {24, 0, 0x40, 0, 0, "\KnownDlls"}, ... 8, ) }, ... 8, ) == 0x0 00012 464 NtOpenSymbolicLinkObject (0x1, {24, 8, 0x40, 0, 0, (0x1, {24, 8, 0x40, 0, 0, "KnownDllPath"}, ... 12, ) }, ... 12, ) == 0x0 00013 464 NtQuerySymbolicLinkObject (12, ... (12, ... "C:\WINDOWS\system32", 0x0, ) , 0x0, ) == 0x0 00014 464 NtClose (12, ... ) == 0x0 00015 464 NtOpenFile (0x100020, {24, 0, 0x42, 0, 0, (0x100020, {24, 0, 0x42, 0, 0, "\??\C:\scripts\"}, 3, 33, ... 12, {status=0x0, info=1}, ) }, 3, 33, ... 12, {status=0x0, info=1}, ) == 0x0 00016 464 NtQueryVolumeInformationFile (12, 1243852, 8, Device, ... {status=0x0, info=8}, ) == 0x0 00017 464 NtQueryAttributesFile ({24, 0, 0x40, 0, 0, ({24, 0, 0x40, 0, 0, "\??\u:\work\packed.exe.Local"}, 1243804, ... ) }, 1243804, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 00018 464 NtOpenSection (0xe, {24, 8, 0x40, 0, 0, (0xe, {24, 8, 0x40, 0, 0, "kernel32.dll"}, ... 16, ) }, ... 16, ) == 0x0 00019 464 NtMapViewOfSection (16, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x7c800000), 0x0, 1003520, ) == 0x0 00020 464 NtClose (16, ... ) == 0x0 00021 464 NtProtectVirtualMemory (-1, (0x7c801000), 1568, 4, ... (0x7c801000), 4096, 32, ) == 0x0 00022 464 NtProtectVirtualMemory (-1, (0x7c801000), 4096, 32, ... (0x7c801000), 4096, 4, ) == 0x0 00023 464 NtFlushInstructionCache (-1, 2088767488, 1568, ... ) == 0x0 00024 464 NtQueryInformationProcess (-1, 36, 4, ... {process info, class 36, size 4}, 0x0, ) == 0x0 00025 464 NtQuerySystemInformation (RangeStart, 4, ... {system info, class 50, size 4}, 0x0, ) == 0x0 00026 464 NtQuerySystemInformation (Basic, 44, ... {Unknown=0,MaximumIncrement=156250,PhysicalPageSize=0x1000,NumberOfPhysicalPages=0xff7c,LowestPhysicalPage=0x1,HighestPhysicalPage=0xffff,AllocationGranularity=0x10000,LowestUserAddress=0x10000,HighestUserAddress=0x7ffeffff,ActiveProcessors=1,NumberProcessors=1,}, 0x0, ) == 0x0 00027 464 NtCreateSection (0xf001f, 0x0, {65536, 0}, 4, 67108864, 0, ... 16, ) == 0x0 00028 464 NtSecureConnectPort ( ("\Windows\ApiPort", {0, 2, 1, 1}, {24, 16, 0, 65536, 0, 0}, 1319736, {12, 0, 0}, 1241944, 44, ... 24, {24, 16, 0, 65536, 2424832, 18415616}, {0, 0, 0}, 200, 44, ) , {0, 2, 1, 1}, {24, 16, 0, 65536, 0, 0}, 1319736, {12, 0, 0}, 1241944, 44, ... 24, {24, 16, 0, 65536, 2424832, 18415616}, {0, 0, 0}, 200, 44, ) == 0x0 00029 464 NtClose (16, ... ) == 0x0 00030 464 NtQueryObject (24, Handle, 2, ... {Inherit=0,ProtectFromClose=0,}, -1, ) == 0x0 00031 464 NtSetInformationObject (24, Handle, {Inherit=0,ProtectFromClose=1,}, 256, ... ) == 0x0 00032 464 NtQuerySystemInformation (Basic, 44, ... {Unknown=0,MaximumIncrement=156250,PhysicalPageSize=0x1000,NumberOfPhysicalPages=0xff7c,LowestPhysicalPage=0x1,HighestPhysicalPage=0xffff,AllocationGranularity=0x10000,LowestUserAddress=0x10000,HighestUserAddress=0x7ffeffff,ActiveProcessors=1,NumberProcessors=1,}, 0x0, ) == 0x0 00033 464 NtQueryVirtualMemory (-1, 0x250000, Basic, 28, ... {BaseAddress=0x250000,AllocationBase=0x250000,AllocationProtect=0x4,RegionSize=0x10000,State=0x2000,Protect=0x0,Type=0x40000,}, 0x0, ) == 0x0 00034 464 NtAllocateVirtualMemory (-1, 2424832, 0, 4096, 4096, 4, ... 2424832, 4096, ) == 0x0 00035 464 NtRequestWaitReplyPort (24, {28, 56, new_msg, 0, 1242260, 1242460, 2089900544, 1242184} (24, {28, 56, new_msg, 0, 1242260, 1242460, 2089900544, 1242184} "\210\6\31\1\0\0\0\0eZ\221|\0\0\0\0\1\0\0\0\234\6\31\1\4\0\0\0" ... {28, 56, reply, 0, 1036, 464, 57957, 0} "`\375\27\0\0\0\0\0\0\0\0\0\0\0\0\0\1\0\0\0\234\6\31\1\4\0\0\0" ) ... {28, 56, reply, 0, 1036, 464, 57957, 0} (24, {28, 56, new_msg, 0, 1242260, 1242460, 2089900544, 1242184} "\210\6\31\1\0\0\0\0eZ\221|\0\0\0\0\1\0\0\0\234\6\31\1\4\0\0\0" ... {28, 56, reply, 0, 1036, 464, 57957, 0} "`\375\27\0\0\0\0\0\0\0\0\0\0\0\0\0\1\0\0\0\234\6\31\1\4\0\0\0" ) ) == 0x0 00036 464 NtRegisterThreadTerminatePort (24, ... ) == 0x0 00037 464 NtAllocateVirtualMemory (-1, 1232896, 0, 4096, 4096, 260, ... 1232896, 4096, ) == 0x0 00038 464 NtOpenKey (0x20019, {24, 0, 0x40, 0, 0, (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\System\CurrentControlSet\Control\Terminal Server"}, ... 16, ) }, ... 16, ) == 0x0 00039 464 NtQueryValueKey (16, (16, "TSAppCompat", Partial, 548, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) , Partial, 548, ... TitleIdx=0, Type=4, Data= (16, "TSAppCompat", Partial, 548, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) }, 16, ) == 0x0 00040 464 NtClose (16, ... ) == 0x0 00041 464 NtOpenSection (0x4, {24, 0, 0x40, 0, 0, (0x4, {24, 0, 0x40, 0, 0, "\NLS\NlsSectionUnicode"}, ... 16, ) }, ... 16, ) == 0x0 00042 464 NtMapViewOfSection (16, -1, (0x0), 0, 0, 0x0, 0, 2, 0, 2, ... (0x260000), 0x0, 90112, ) == 0x0 00043 464 NtClose (16, ... ) == 0x0 00044 464 NtQueryDefaultLocale (0, 2089305000, ... ) == 0x0 00045 464 NtOpenSection (0x4, {24, 0, 0x40, 0, 0, (0x4, {24, 0, 0x40, 0, 0, "\NLS\NlsSectionLocale"}, ... 16, ) }, ... 16, ) == 0x0 00046 464 NtMapViewOfSection (16, -1, (0x0), 0, 0, 0x0, 0, 2, 0, 2, ... (0x280000), 0x0, 249856, ) == 0x0 00047 464 NtClose (16, ... ) == 0x0 00048 464 NtOpenSection (0x5, {24, 0, 0x40, 0, 0, (0x5, {24, 0, 0x40, 0, 0, "\NLS\NlsSectionSortkey"}, ... 16, ) }, ... 16, ) == 0x0 00049 464 NtMapViewOfSection (16, -1, (0x0), 0, 0, 0x0, 0, 2, 0, 2, ... (0x2c0000), 0x0, 266240, ) == 0x0 00050 464 NtQuerySection (16, Basic, 16, ... {BaseAddress=0x0,Attributes=0x800000,Size={0x40004, 0x0},}, 0x0, ) == 0x0 00051 464 NtClose (16, ... ) == 0x0 00052 464 NtOpenSection (0x4, {24, 0, 0x40, 0, 0, (0x4, {24, 0, 0x40, 0, 0, "\NLS\NlsSectionSortTbls"}, ... 16, ) }, ... 16, ) == 0x0 00053 464 NtMapViewOfSection (16, -1, (0x0), 0, 0, 0x0, 0, 2, 0, 2, ... (0x310000), 0x0, 24576, ) == 0x0 00054 464 NtClose (16, ... ) == 0x0 00055 464 NtQueryVirtualMemory (-1, 0x7ffd2000, Basic, 28, ... {BaseAddress=0x7ffd2000,AllocationBase=0x7ffb0000,AllocationProtect=0x2,RegionSize=0x2000,State=0x1000,Protect=0x2,Type=0x40000,}, 0x0, ) == 0x0 00056 464 NtOpenSection (0x4, {24, 0, 0x40, 0, 0, (0x4, {24, 0, 0x40, 0, 0, "\NLS\NlsSectionSortkey00000409"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 00057 464 NtOpenSection (0x4, {24, 0, 0x40, 0, 0, (0x4, {24, 0, 0x40, 0, 0, "\NLS\NlsSectionSortkey00000409"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 00058 464 NtAllocateVirtualMemory (-1, 2428928, 0, 8192, 4096, 4, ... 2428928, 8192, ) == 0x0 00059 464 NtRequestWaitReplyPort (24, {24, 52, new_msg, 0, 7012468, 7929957, 3145776, 3145776} (24, {24, 52, new_msg, 0, 7012468, 7929957, 3145776, 3145776} "\210\6\31\1\36\0\1\0\0\0\0\0\377\377\377\377\234\6\31\1p\30\0\0" ... {24, 52, reply, 0, 1036, 464, 57958, 0} "\10P\30\0\36\0\1\0\0\0\0\0\377\377\377\377\234\6\31\1p\30\0\0" ) ... {24, 52, reply, 0, 1036, 464, 57958, 0} (24, {24, 52, new_msg, 0, 7012468, 7929957, 3145776, 3145776} "\210\6\31\1\36\0\1\0\0\0\0\0\377\377\377\377\234\6\31\1p\30\0\0" ... {24, 52, reply, 0, 1036, 464, 57958, 0} "\10P\30\0\36\0\1\0\0\0\0\0\377\377\377\377\234\6\31\1p\30\0\0" ) ) == 0x0 00060 464 NtRequestWaitReplyPort (24, {28, 56, new_msg, 0, 2089305760, 2090321376, 0, 0} (24, {28, 56, new_msg, 0, 2089305760, 2090321376, 0, 0} "\210\6\31\1\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\234\6\31\18\6\0\0" ... {28, 56, reply, 0, 1036, 464, 57959, 0} "\250\202\26\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\234\6\31\18\6\0\0" ) ... {28, 56, reply, 0, 1036, 464, 57959, 0} (24, {28, 56, new_msg, 0, 2089305760, 2090321376, 0, 0} "\210\6\31\1\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\234\6\31\18\6\0\0" ... {28, 56, reply, 0, 1036, 464, 57959, 0} "\250\202\26\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\234\6\31\18\6\0\0" ) ) == 0x0 00061 464 NtProtectVirtualMemory (-1, (0x46b000), 151552, 4, ... (0x46b000), 151552, 128, ) == 0x0 00062 464 NtProtectVirtualMemory (-1, (0x46b000), 151552, 128, ... (0x46b000), 151552, 4, ) == 0x0 00063 464 NtFlushInstructionCache (-1, 4632576, 151552, ... ) == 0x0 00064 464 NtOpenSection (0xe, {24, 8, 0x40, 0, 0, (0xe, {24, 8, 0x40, 0, 0, "ws2_32.dll"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 00065 464 NtAllocateVirtualMemory (-1, 1323008, 0, 4096, 4096, 4, ... 1323008, 4096, ) == 0x0 00066 464 NtQueryAttributesFile ({24, 0, 0x40, 0, 0, ({24, 0, 0x40, 0, 0, "\??\u:\work\ws2_32.dll"}, 1242572, ... ) }, 1242572, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 00067 464 NtFsControlFile (12, 0, 0x0, 0x0, 0x90028, 0x0, 0, 0, ... {status=0x0, info=0}, 0x0, ) == 0x0 00068 464 NtQueryAttributesFile ({24, 0, 0x40, 0, 0, ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\ws2_32.dll"}, 1242572, ... ) }, 1242572, ... ) == 0x0 00069 464 NtOpenFile (0x100020, {24, 0, 0x40, 0, 0, (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\ws2_32.dll"}, 5, 96, ... 16, {status=0x0, info=1}, ) }, 5, 96, ... 16, {status=0x0, info=1}, ) == 0x0 00070 464 NtCreateSection (0xf, 0x0, 0x0, 16, 16777216, 16, ... 28, ) == 0x0 00071 464 NtQuerySection (28, Image, 48, ... {section info, class 1, size 48}, 0x0, ) == 0x0 00072 464 NtOpenProcessToken (-1, 0x8, ... 32, ) == 0x0 00073 464 NtQueryInformationToken (32, User, 136, ... {token info, class 1, size 36}, 36, ) == 0x0 00074 464 NtOpenKey (0x3, {24, 0, 0x40, 0, 0, (0x3, {24, 0, 0x40, 0, 0, "\Registry\MACHINE\System\CurrentControlSet\Control\SafeBoot\Option"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 00075 464 NtOpenKey (0x1, {24, 0, 0x40, 0, 0, (0x1, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers"}, ... 36, ) }, ... 36, ) == 0x0 00076 464 NtQueryValueKey (36, (36, "TransparentEnabled", Partial, 80, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) , Partial, 80, ... TitleIdx=0, Type=4, Data= (36, "TransparentEnabled", Partial, 80, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) }, 16, ) == 0x0 00077 464 NtClose (36, ... ) == 0x0 00078 464 NtOpenThreadTokenEx (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN 00079 464 NtOpenProcessTokenEx (-1, 0x20008, 512, ... 36, ) == 0x0 00080 464 NtQueryInformationToken (36, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0 00081 464 NtClose (36, ... ) == 0x0 00082 464 NtOpenKey (0x1, {24, 0, 0x40, 0, 0, (0x1, {24, 0, 0x40, 0, 0, "\REGISTRY\USER\S-1-5-21-1292428093-1383384898-725345543-1003\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 00083 464 NtClose (32, ... ) == 0x0 00084 464 NtClose (16, ... ) == 0x0 00085 464 NtMapViewOfSection (28, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x71ab0000), 0x0, 94208, ) == 0x0 00086 464 NtClose (28, ... ) == 0x0 00087 464 NtOpenSection (0xe, {24, 8, 0x40, 0, 0, (0xe, {24, 8, 0x40, 0, 0, "msvcrt.dll"}, ... 28, ) }, ... 28, ) == 0x0 00088 464 NtMapViewOfSection (28, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x77c10000), 0x0, 360448, ) == 0x0 00089 464 NtClose (28, ... ) == 0x0 00090 464 NtProtectVirtualMemory (-1, (0x77c11000), 632, 4, ... (0x77c11000), 4096, 32, ) == 0x0 00091 464 NtProtectVirtualMemory (-1, (0x77c11000), 4096, 32, ... (0x77c11000), 4096, 4, ) == 0x0 00092 464 NtFlushInstructionCache (-1, 2009141248, 632, ... ) == 0x0 00093 464 NtProtectVirtualMemory (-1, (0x71ab1000), 468, 4, ... (0x71ab1000), 4096, 32, ) == 0x0 00094 464 NtProtectVirtualMemory (-1, (0x71ab1000), 4096, 32, ... (0x71ab1000), 4096, 4, ) == 0x0 00095 464 NtFlushInstructionCache (-1, 1907036160, 468, ... ) == 0x0 00096 464 NtOpenSection (0xe, {24, 8, 0x40, 0, 0, (0xe, {24, 8, 0x40, 0, 0, "WS2HELP.dll"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 00097 464 NtQueryAttributesFile ({24, 0, 0x40, 0, 0, ({24, 0, 0x40, 0, 0, "\??\u:\work\WS2HELP.dll"}, 1241756, ... ) }, 1241756, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 00098 464 NtQueryAttributesFile ({24, 0, 0x40, 0, 0, ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\WS2HELP.dll"}, 1241756, ... ) }, 1241756, ... ) == 0x0 00099 464 NtOpenFile (0x100020, {24, 0, 0x40, 0, 0, (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\WS2HELP.dll"}, 5, 96, ... 28, {status=0x0, info=1}, ) }, 5, 96, ... 28, {status=0x0, info=1}, ) == 0x0 00100 464 NtCreateSection (0xf, 0x0, 0x0, 16, 16777216, 28, ... 16, ) == 0x0 00101 464 NtQuerySection (16, Image, 48, ... {section info, class 1, size 48}, 0x0, ) == 0x0 00102 464 NtClose (28, ... ) == 0x0 00103 464 NtMapViewOfSection (16, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x71aa0000), 0x0, 32768, ) == 0x0 00104 464 NtClose (16, ... ) == 0x0 00105 464 NtOpenSection (0xe, {24, 8, 0x40, 0, 0, (0xe, {24, 8, 0x40, 0, 0, "ADVAPI32.dll"}, ... 16, ) }, ... 16, ) == 0x0 00106 464 NtMapViewOfSection (16, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x77dd0000), 0x0, 634880, ) == 0x0 00107 464 NtClose (16, ... ) == 0x0 00108 464 NtProtectVirtualMemory (-1, (0x77dd1000), 1700, 4, ... (0x77dd1000), 4096, 32, ) == 0x0 00109 464 NtProtectVirtualMemory (-1, (0x77dd1000), 4096, 32, ... (0x77dd1000), 4096, 4, ) == 0x0 00110 464 NtFlushInstructionCache (-1, 2010976256, 1700, ... ) == 0x0 00111 464 NtOpenSection (0xe, {24, 8, 0x40, 0, 0, (0xe, {24, 8, 0x40, 0, 0, "RPCRT4.dll"}, ... 16, ) }, ... 16, ) == 0x0 00112 464 NtMapViewOfSection (16, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x77e70000), 0x0, 593920, ) == 0x0 00113 464 NtClose (16, ... ) == 0x0 00114 464 NtProtectVirtualMemory (-1, (0x77e71000), 868, 4, ... (0x77e71000), 4096, 32, ) == 0x0 00115 464 NtProtectVirtualMemory (-1, (0x77e71000), 4096, 32, ... (0x77e71000), 4096, 4, ) == 0x0 00116 464 NtFlushInstructionCache (-1, 2011631616, 868, ... ) == 0x0 00117 464 NtProtectVirtualMemory (-1, (0x77e71000), 868, 4, ... (0x77e71000), 4096, 32, ) == 0x0 00118 464 NtProtectVirtualMemory (-1, (0x77e71000), 4096, 32, ... (0x77e71000), 4096, 4, ) == 0x0 00119 464 NtFlushInstructionCache (-1, 2011631616, 868, ... ) == 0x0 00120 464 NtProtectVirtualMemory (-1, (0x77e71000), 868, 4, ... (0x77e71000), 4096, 32, ) == 0x0 00121 464 NtProtectVirtualMemory (-1, (0x77e71000), 4096, 32, ... (0x77e71000), 4096, 4, ) == 0x0 00122 464 NtFlushInstructionCache (-1, 2011631616, 868, ... ) == 0x0 00123 464 NtProtectVirtualMemory (-1, (0x77dd1000), 1700, 4, ... (0x77dd1000), 4096, 32, ) == 0x0 00124 464 NtProtectVirtualMemory (-1, (0x77dd1000), 4096, 32, ... (0x77dd1000), 4096, 4, ) == 0x0 00125 464 NtFlushInstructionCache (-1, 2010976256, 1700, ... ) == 0x0 00126 464 NtProtectVirtualMemory (-1, (0x71aa1000), 352, 4, ... (0x71aa1000), 4096, 32, ) == 0x0 00127 464 NtProtectVirtualMemory (-1, (0x71aa1000), 4096, 32, ... (0x71aa1000), 4096, 4, ) == 0x0 00128 464 NtFlushInstructionCache (-1, 1906970624, 352, ... ) == 0x0 00129 464 NtProtectVirtualMemory (-1, (0x71ab1000), 468, 4, ... (0x71ab1000), 4096, 32, ) == 0x0 00130 464 NtProtectVirtualMemory (-1, (0x71ab1000), 4096, 32, ... (0x71ab1000), 4096, 4, ) == 0x0 00131 464 NtFlushInstructionCache (-1, 1907036160, 468, ... ) == 0x0 00132 464 NtProtectVirtualMemory (-1, (0x46b000), 151552, 4, ... (0x46b000), 151552, 64, ) == 0x0 00133 464 NtProtectVirtualMemory (-1, (0x46b000), 151552, 64, ... (0x46b000), 151552, 4, ) == 0x0 00134 464 NtFlushInstructionCache (-1, 4632576, 151552, ... ) == 0x0 00135 464 NtOpenSection (0xe, {24, 8, 0x40, 0, 0, (0xe, {24, 8, 0x40, 0, 0, "oleaut32.dll"}, ... 16, ) }, ... 16, ) == 0x0 00136 464 NtMapViewOfSection (16, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x77120000), 0x0, 569344, ) == 0x0 00137 464 NtClose (16, ... ) == 0x0 00138 464 NtProtectVirtualMemory (-1, (0x77121000), 1272, 4, ... (0x77121000), 4096, 32, ) == 0x0 00139 464 NtProtectVirtualMemory (-1, (0x77121000), 4096, 32, ... (0x77121000), 4096, 4, ) == 0x0 00140 464 NtFlushInstructionCache (-1, 1997672448, 1272, ... ) == 0x0 00141 464 NtOpenSection (0xe, {24, 8, 0x40, 0, 0, (0xe, {24, 8, 0x40, 0, 0, "GDI32.dll"}, ... 16, ) }, ... 16, ) == 0x0 00142 464 NtMapViewOfSection (16, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x77f10000), 0x0, 290816, ) == 0x0 00143 464 NtClose (16, ... ) == 0x0 00144 464 NtProtectVirtualMemory (-1, (0x77f11000), 508, 4, ... (0x77f11000), 4096, 32, ) == 0x0 00145 464 NtProtectVirtualMemory (-1, (0x77f11000), 4096, 32, ... (0x77f11000), 4096, 4, ) == 0x0 00146 464 NtFlushInstructionCache (-1, 2012286976, 508, ... ) == 0x0 00147 464 NtProtectVirtualMemory (-1, (0x77f11000), 508, 4, ... (0x77f11000), 4096, 32, ) == 0x0 00148 464 NtProtectVirtualMemory (-1, (0x77f11000), 4096, 32, ... (0x77f11000), 4096, 4, ) == 0x0 00149 464 NtFlushInstructionCache (-1, 2012286976, 508, ... ) == 0x0 00150 464 NtOpenSection (0xe, {24, 8, 0x40, 0, 0, (0xe, {24, 8, 0x40, 0, 0, "USER32.dll"}, ... 16, ) }, ... 16, ) == 0x0 00151 464 NtMapViewOfSection (16, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x7e410000), 0x0, 589824, ) == 0x0 00152 464 NtClose (16, ... ) == 0x0 00153 464 NtProtectVirtualMemory (-1, (0x7e411000), 1252, 4, ... (0x7e411000), 4096, 32, ) == 0x0 00154 464 NtProtectVirtualMemory (-1, (0x7e411000), 4096, 32, ... (0x7e411000), 4096, 4, ) == 0x0 00155 464 NtFlushInstructionCache (-1, 2118193152, 1252, ... ) == 0x0 00156 464 NtProtectVirtualMemory (-1, (0x7e411000), 1252, 4, ... (0x7e411000), 4096, 32, ) == 0x0 00157 464 NtProtectVirtualMemory (-1, (0x7e411000), 4096, 32, ... (0x7e411000), 4096, 4, ) == 0x0 00158 464 NtFlushInstructionCache (-1, 2118193152, 1252, ... ) == 0x0 00159 464 NtProtectVirtualMemory (-1, (0x7e411000), 1252, 4, ... (0x7e411000), 4096, 32, ) == 0x0 00160 464 NtProtectVirtualMemory (-1, (0x7e411000), 4096, 32, ... (0x7e411000), 4096, 4, ) == 0x0 00161 464 NtFlushInstructionCache (-1, 2118193152, 1252, ... ) == 0x0 00162 464 NtProtectVirtualMemory (-1, (0x77f11000), 508, 4, ... (0x77f11000), 4096, 32, ) == 0x0 00163 464 NtProtectVirtualMemory (-1, (0x77f11000), 4096, 32, ... (0x77f11000), 4096, 4, ) == 0x0 00164 464 NtFlushInstructionCache (-1, 2012286976, 508, ... ) == 0x0 00165 464 NtProtectVirtualMemory (-1, (0x77121000), 1272, 4, ... (0x77121000), 4096, 32, ) == 0x0 00166 464 NtProtectVirtualMemory (-1, (0x77121000), 4096, 32, ... (0x77121000), 4096, 4, ) == 0x0 00167 464 NtFlushInstructionCache (-1, 1997672448, 1272, ... ) == 0x0 00168 464 NtProtectVirtualMemory (-1, (0x77121000), 1272, 4, ... (0x77121000), 4096, 32, ) == 0x0 00169 464 NtProtectVirtualMemory (-1, (0x77121000), 4096, 32, ... (0x77121000), 4096, 4, ) == 0x0 00170 464 NtFlushInstructionCache (-1, 1997672448, 1272, ... ) == 0x0 00171 464 NtProtectVirtualMemory (-1, (0x77121000), 1272, 4, ... (0x77121000), 4096, 32, ) == 0x0 00172 464 NtProtectVirtualMemory (-1, (0x77121000), 4096, 32, ... (0x77121000), 4096, 4, ) == 0x0 00173 464 NtFlushInstructionCache (-1, 1997672448, 1272, ... ) == 0x0 00174 464 NtOpenSection (0xe, {24, 8, 0x40, 0, 0, (0xe, {24, 8, 0x40, 0, 0, "ole32.dll"}, ... 16, ) }, ... 16, ) == 0x0 00175 464 NtMapViewOfSection (16, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x774e0000), 0x0, 1298432, ) == 0x0 00176 464 NtClose (16, ... ) == 0x0 00177 464 NtProtectVirtualMemory (-1, (0x774e1000), 2352, 4, ... (0x774e1000), 4096, 32, ) == 0x0 00178 464 NtProtectVirtualMemory (-1, (0x774e1000), 4096, 32, ... (0x774e1000), 4096, 4, ) == 0x0 00179 464 NtFlushInstructionCache (-1, 2001604608, 2352, ... ) == 0x0 00180 464 NtProtectVirtualMemory (-1, (0x774e1000), 2352, 4, ... (0x774e1000), 4096, 32, ) == 0x0 00181 464 NtProtectVirtualMemory (-1, (0x774e1000), 4096, 32, ... (0x774e1000), 4096, 4, ) == 0x0 00182 464 NtFlushInstructionCache (-1, 2001604608, 2352, ... ) == 0x0 00183 464 NtProtectVirtualMemory (-1, (0x774e1000), 2352, 4, ... (0x774e1000), 4096, 32, ) == 0x0 00184 464 NtProtectVirtualMemory (-1, (0x774e1000), 4096, 32, ... (0x774e1000), 4096, 4, ) == 0x0 00185 464 NtFlushInstructionCache (-1, 2001604608, 2352, ... ) == 0x0 00186 464 NtProtectVirtualMemory (-1, (0x774e1000), 2352, 4, ... (0x774e1000), 4096, 32, ) == 0x0 00187 464 NtProtectVirtualMemory (-1, (0x774e1000), 4096, 32, ... (0x774e1000), 4096, 4, ) == 0x0 00188 464 NtFlushInstructionCache (-1, 2001604608, 2352, ... ) == 0x0 00189 464 NtProtectVirtualMemory (-1, (0x774e1000), 2352, 4, ... (0x774e1000), 4096, 32, ) == 0x0 00190 464 NtProtectVirtualMemory (-1, (0x774e1000), 4096, 32, ... (0x774e1000), 4096, 4, ) == 0x0 00191 464 NtFlushInstructionCache (-1, 2001604608, 2352, ... ) == 0x0 00192 464 NtProtectVirtualMemory (-1, (0x774e1000), 2352, 4, ... (0x774e1000), 4096, 32, ) == 0x0 00193 464 NtProtectVirtualMemory (-1, (0x774e1000), 4096, 32, ... (0x774e1000), 4096, 4, ) == 0x0 00194 464 NtFlushInstructionCache (-1, 2001604608, 2352, ... ) == 0x0 00195 464 NtProtectVirtualMemory (-1, (0x774e1000), 2352, 4, ... (0x774e1000), 4096, 32, ) == 0x0 00196 464 NtProtectVirtualMemory (-1, (0x774e1000), 4096, 32, ... (0x774e1000), 4096, 4, ) == 0x0 00197 464 NtFlushInstructionCache (-1, 2001604608, 2352, ... ) == 0x0 00198 464 NtProtectVirtualMemory (-1, (0x77121000), 1272, 4, ... (0x77121000), 4096, 32, ) == 0x0 00199 464 NtProtectVirtualMemory (-1, (0x77121000), 4096, 32, ... (0x77121000), 4096, 4, ) == 0x0 00200 464 NtFlushInstructionCache (-1, 1997672448, 1272, ... ) == 0x0 00201 464 NtProtectVirtualMemory (-1, (0x77121000), 1272, 4, ... (0x77121000), 4096, 32, ) == 0x0 00202 464 NtProtectVirtualMemory (-1, (0x77121000), 4096, 32, ... (0x77121000), 4096, 4, ) == 0x0 00203 464 NtFlushInstructionCache (-1, 1997672448, 1272, ... ) == 0x0 00204 464 NtProtectVirtualMemory (-1, (0x77121000), 1272, 4, ... (0x77121000), 4096, 32, ) == 0x0 00205 464 NtProtectVirtualMemory (-1, (0x77121000), 4096, 32, ... (0x77121000), 4096, 4, ) == 0x0 00206 464 NtFlushInstructionCache (-1, 1997672448, 1272, ... ) == 0x0 00207 464 NtProtectVirtualMemory (-1, (0x46b000), 151552, 4, ... (0x46b000), 151552, 64, ) == 0x0 00208 464 NtProtectVirtualMemory (-1, (0x46b000), 151552, 64, ... (0x46b000), 151552, 4, ) == 0x0 00209 464 NtFlushInstructionCache (-1, 4632576, 151552, ... ) == 0x0 00210 464 NtProtectVirtualMemory (-1, (0x46b000), 151552, 4, ... (0x46b000), 151552, 64, ) == 0x0 00211 464 NtProtectVirtualMemory (-1, (0x46b000), 151552, 64, ... (0x46b000), 151552, 4, ) == 0x0 00212 464 NtFlushInstructionCache (-1, 4632576, 151552, ... ) == 0x0 00213 464 NtQueryInformationProcess (-1, 37, 48, ... {process info, class 37, size 48}, 0x0, ) == 0x0 00214 464 NtOpenFile (0x100001, {24, 0, 0x40, 0, 0, (0x100001, {24, 0, 0x40, 0, 0, "\??\u:\work\packed.exe"}, 5, 96, ... 16, {status=0x0, info=1}, ) }, 5, 96, ... 16, {status=0x0, info=1}, ) == 0x0 00215 464 NtReadFile (16, 0, 0, 0, 4, {259068, 0}, 0, ... {status=0x0, info=4}, (16, 0, 0, 0, 4, {259068, 0}, 0, ... {status=0x0, info=4}, "\0\0\0\0", ) , ) == 0x0 00216 464 NtReadFile (16, 0, 0, 0, 8, {259060, 0}, 0, ... {status=0x0, info=8}, (16, 0, 0, 0, 8, {259060, 0}, 0, ... {status=0x0, info=8}, "\0\0\0\0\0\0\0\0", ) , ) == 0x0 00217 464 NtReadFile (16, 0, 0, 0, 4, {0, 0}, 0, ... {status=0x0, info=4}, (16, 0, 0, 0, 4, {0, 0}, 0, ... {status=0x0, info=4}, "MZ\220\0", ) , ) == 0x0 00218 464 NtClose (16, ... ) == 0x0 00219 464 NtSetInformationProcess (-1, 34, {process info, class 34, size 4}, 4, ... ) == 0x0 00220 464 NtOpenProcessToken (-1, 0x8, ... 16, ) == 0x0 00221 464 NtQueryInformationToken (16, Statistics, 56, ... {token info, class 10, size 56}, 56, ) == 0x0 00222 464 NtClose (16, ... ) == 0x0 00223 464 NtOpenKey (0x20019, {24, 0, 0x40, 0, 0, (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\System\CurrentControlSet\Control\Terminal Server"}, ... 16, ) }, ... 16, ) == 0x0 00224 464 NtQueryValueKey (16, (16, "TSAppCompat", Partial, 548, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) , Partial, 548, ... TitleIdx=0, Type=4, Data= (16, "TSAppCompat", Partial, 548, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) }, 16, ) == 0x0 00225 464 NtClose (16, ... ) == 0x0 00226 464 NtOpenKey (0x80000000, {24, 0, 0x40, 0, 0, (0x80000000, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msvcrt.dll"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 00227 464 NtQuerySystemInformation (Basic, 44, ... {Unknown=0,MaximumIncrement=156250,PhysicalPageSize=0x1000,NumberOfPhysicalPages=0xff7c,LowestPhysicalPage=0x1,HighestPhysicalPage=0xffff,AllocationGranularity=0x10000,LowestUserAddress=0x10000,HighestUserAddress=0x7ffeffff,ActiveProcessors=1,NumberProcessors=1,}, 0x0, ) == 0x0 00228 464 NtAllocateVirtualMemory (-1, 0, 0, 65536, 8192, 4, ... 3276800, 65536, ) == 0x0 00229 464 NtAllocateVirtualMemory (-1, 3276800, 0, 4096, 4096, 4, ... 3276800, 4096, ) == 0x0 00230 464 NtAllocateVirtualMemory (-1, 3280896, 0, 8192, 4096, 4, ... 3280896, 8192, ) == 0x0 00231 464 NtAllocateVirtualMemory (-1, 3289088, 0, 4096, 4096, 4, ... 3289088, 4096, ) == 0x0 00232 464 NtOpenSection (0x4, {24, 0, 0x40, 0, 0, (0x4, {24, 0, 0x40, 0, 0, "\NLS\NlsSectionCType"}, ... 16, ) }, ... 16, ) == 0x0 00233 464 NtMapViewOfSection (16, -1, (0x0), 0, 0, 0x0, 0, 2, 0, 2, ... (0x330000), 0x0, 12288, ) == 0x0 00234 464 NtClose (16, ... ) == 0x0 00235 464 NtAllocateVirtualMemory (-1, 3293184, 0, 4096, 4096, 4, ... 3293184, 4096, ) == 0x0 00236 464 NtQueryVirtualMemory (-1, 0x77c2807c, Basic, 28, ... {BaseAddress=0x77c28000,AllocationBase=0x77c10000,AllocationProtect=0x80,RegionSize=0x35000,State=0x1000,Protect=0x20,Type=0x1000000,}, 28, ) == 0x0 00237 464 NtQueryInformationProcess (-1, 36, 4, ... {process info, class 36, size 4}, 0x0, ) == 0x0 00238 464 NtQueryInformationProcess (-1, 36, 4, ... {process info, class 36, size 4}, 0x0, ) == 0x0 00239 464 NtQueryVirtualMemory (-1, 0x0, Basic, 28, ... {BaseAddress=0x0,AllocationBase=0x0,AllocationProtect=0x0,RegionSize=0x10000,State=0x10000,Protect=0x1,Type=0x0,}, 28, ) == 0x0 00240 464 NtOpenKey (0x80000000, {24, 0, 0x40, 0, 0, (0x80000000, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RPCRT4.dll"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 00241 464 NtOpenKey (0x80000000, {24, 0, 0x40, 0, 0, (0x80000000, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ADVAPI32.dll"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 00242 464 NtOpenKey (0x20019, {24, 0, 0x40, 0, 0, (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\System\CurrentControlSet\Control\Terminal Server"}, ... 16, ) }, ... 16, ) == 0x0 00243 464 NtQueryValueKey (16, (16, "TSAppCompat", Partial, 548, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) , Partial, 548, ... TitleIdx=0, Type=4, Data= (16, "TSAppCompat", Partial, 548, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) }, 16, ) == 0x0 00244 464 NtQueryValueKey (16, (16, "TSUserEnabled", Partial, 548, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) , Partial, 548, ... TitleIdx=0, Type=4, Data= (16, "TSUserEnabled", Partial, 548, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) }, 16, ) == 0x0 00245 464 NtClose (16, ... ) == 0x0 00246 464 NtOpenKey (0x20019, {24, 0, 0x40, 0, 0, (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon"}, ... 16, ) }, ... 16, ) == 0x0 00247 464 NtQueryValueKey (16, (16, "LeakTrack", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 00248 464 NtClose (16, ... ) == 0x0 00249 464 NtOpenKey (0x2000000, {24, 0, 0x40, 0, 0, (0x2000000, {24, 0, 0x40, 0, 0, "\REGISTRY\MACHINE"}, ... 16, ) }, ... 16, ) == 0x0 00250 464 NtSetInformationObject (16, Handle, {Inherit=0,ProtectFromClose=1,}, 2011431168, ... ) == 0x0 00251 464 NtOpenKey (0x20019, {24, 16, 0x40, 0, 0, (0x20019, {24, 16, 0x40, 0, 0, "Software\Microsoft\Windows NT\CurrentVersion\Diagnostics"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 00252 464 NtOpenKey (0x80000000, {24, 0, 0x40, 0, 0, (0x80000000, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\WS2HELP.dll"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 00253 464 NtOpenKey (0x80000000, {24, 0, 0x40, 0, 0, (0x80000000, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ws2_32.dll"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 00254 464 NtQuerySystemInformation (Basic, 44, ... {Unknown=0,MaximumIncrement=156250,PhysicalPageSize=0x1000,NumberOfPhysicalPages=0xff7c,LowestPhysicalPage=0x1,HighestPhysicalPage=0xffff,AllocationGranularity=0x10000,LowestUserAddress=0x10000,HighestUserAddress=0x7ffeffff,ActiveProcessors=1,NumberProcessors=1,}, 0x0, ) == 0x0 00255 464 NtQuerySystemInformation (Processor, 12, ... {system info, class 1, size 12}, 0x0, ) == 0x0 00256 464 NtOpenKey (0x80000000, {24, 0, 0x40, 0, 0, (0x80000000, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\USER32.dll"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 00257 464 NtQuerySystemInformation (Basic, 44, ... {Unknown=0,MaximumIncrement=156250,PhysicalPageSize=0x1000,NumberOfPhysicalPages=0xff7c,LowestPhysicalPage=0x1,HighestPhysicalPage=0xffff,AllocationGranularity=0x10000,LowestUserAddress=0x10000,HighestUserAddress=0x7ffeffff,ActiveProcessors=1,NumberProcessors=1,}, 0x0, ) == 0x0 00258 464 NtRequestWaitReplyPort (24, {28, 56, new_msg, 0, 256, 1243092, 256, 1242836} (24, {28, 56, new_msg, 0, 256, 1243092, 256, 1242836} "\210\6\31\1\0\0\0\0\0\0\0\0\1\0\0\0\3\0\0\0\234\6\31\1$\1\0\0" ... {28, 56, reply, 0, 1036, 464, 57960, 0} "\320G\26\0\0\0\0\0\0\0\0\0\1\0\0\0\3\0\0\0\234\6\31\1$\1\0\0" ) ... {28, 56, reply, 0, 1036, 464, 57960, 0} (24, {28, 56, new_msg, 0, 256, 1243092, 256, 1242836} "\210\6\31\1\0\0\0\0\0\0\0\0\1\0\0\0\3\0\0\0\234\6\31\1$\1\0\0" ... {28, 56, reply, 0, 1036, 464, 57960, 0} "\320G\26\0\0\0\0\0\0\0\0\0\1\0\0\0\3\0\0\0\234\6\31\1$\1\0\0" ) ) == 0x0 00259 464 NtOpenKey (0x1, {24, 0, 0x40, 0, 0, (0x1, {24, 0, 0x40, 0, 0, "\Registry\MACHINE\System\CurrentControlSet\Control\Session Manager"}, ... 28, ) }, ... 28, ) == 0x0 00260 464 NtQueryValueKey (28, (28, "SafeDllSearchMode", Partial, 16, ... ) , Partial, 16, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 00261 464 NtClose (28, ... ) == 0x0 00262 464 NtAllocateVirtualMemory (-1, 1327104, 0, 4096, 4096, 4, ... 1327104, 4096, ) == 0x0 00263 464 NtQueryAttributesFile ({24, 0, 0x40, 0, 0, ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\IMM32.DLL"}, 1239420, ... ) }, 1239420, ... ) == 0x0 00264 464 NtOpenFile (0x100020, {24, 0, 0x40, 0, 0, (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\IMM32.DLL"}, 5, 96, ... 28, {status=0x0, info=1}, ) }, 5, 96, ... 28, {status=0x0, info=1}, ) == 0x0 00265 464 NtCreateSection (0xe, 0x0, 0x0, 16, 134217728, 28, ... 32, ) == 0x0 00266 464 NtClose (28, ... ) == 0x0 00267 464 NtMapViewOfSection (32, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 16, ... (0x340000), 0x0, 110592, ) == 0x0 00268 464 NtClose (32, ... ) == 0x0 00269 464 NtUnmapViewOfSection (-1, 0x340000, ... ) == 0x0 00270 464 NtQueryAttributesFile ({24, 0, 0x40, 0, 0, ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\IMM32.DLL"}, 1239328, ... ) }, 1239328, ... ) == 0x0 00271 464 NtOpenFile (0x100020, {24, 0, 0x40, 0, 0, (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\IMM32.DLL"}, 5, 96, ... 32, {status=0x0, info=1}, ) }, 5, 96, ... 32, {status=0x0, info=1}, ) == 0x0 00272 464 NtCreateSection (0xe, 0x0, 0x0, 16, 134217728, 32, ... 28, ) == 0x0 00273 464 NtClose (32, ... ) == 0x0 00274 464 NtMapViewOfSection (28, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 16, ... (0x340000), 0x0, 110592, ) == 0x0 00275 464 NtClose (28, ... ) == 0x0 00276 464 NtUnmapViewOfSection (-1, 0x340000, ... ) == 0x0 00277 464 NtQueryAttributesFile ({24, 0, 0x40, 0, 0, ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\IMM32.DLL"}, 1239636, ... ) }, 1239636, ... ) == 0x0 00278 464 NtOpenFile (0x100020, {24, 0, 0x40, 0, 0, (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\IMM32.DLL"}, 5, 96, ... 28, {status=0x0, info=1}, ) }, 5, 96, ... 28, {status=0x0, info=1}, ) == 0x0 00279 464 NtCreateSection (0xf, 0x0, 0x0, 16, 16777216, 28, ... 32, ) == 0x0 00280 464 NtQuerySection (32, Image, 48, ... {section info, class 1, size 48}, 0x0, ) == 0x0 00281 464 NtClose (28, ... ) == 0x0 00282 464 NtMapViewOfSection (32, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x76390000), 0x0, 118784, ) == 0x0 00283 464 NtClose (32, ... ) == 0x0 00284 464 NtProtectVirtualMemory (-1, (0x76391000), 696, 4, ... (0x76391000), 4096, 32, ) == 0x0 00285 464 NtProtectVirtualMemory (-1, (0x76391000), 4096, 32, ... (0x76391000), 4096, 4, ) == 0x0 00286 464 NtFlushInstructionCache (-1, 1983451136, 696, ... ) == 0x0 00287 464 NtProtectVirtualMemory (-1, (0x76391000), 696, 4, ... (0x76391000), 4096, 32, ) == 0x0 00288 464 NtProtectVirtualMemory (-1, (0x76391000), 4096, 32, ... (0x76391000), 4096, 4, ) == 0x0 00289 464 NtFlushInstructionCache (-1, 1983451136, 696, ... ) == 0x0 00290 464 NtProtectVirtualMemory (-1, (0x76391000), 696, 4, ... (0x76391000), 4096, 32, ) == 0x0 00291 464 NtProtectVirtualMemory (-1, (0x76391000), 4096, 32, ... (0x76391000), 4096, 4, ) == 0x0 00292 464 NtFlushInstructionCache (-1, 1983451136, 696, ... ) == 0x0 00293 464 NtOpenKey (0x80000000, {24, 0, 0x40, 0, 0, (0x80000000, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\IMM32.DLL"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 00294 464 NtQuerySystemInformation (Basic, 44, ... {Unknown=0,MaximumIncrement=156250,PhysicalPageSize=0x1000,NumberOfPhysicalPages=0xff7c,LowestPhysicalPage=0x1,HighestPhysicalPage=0xffff,AllocationGranularity=0x10000,LowestUserAddress=0x10000,HighestUserAddress=0x7ffeffff,ActiveProcessors=1,NumberProcessors=1,}, 0x0, ) == 0x0 00295 464 NtAllocateVirtualMemory (-1, 1228800, 0, 4096, 4096, 260, ... 1228800, 4096, ) == 0x0 00296 464 NtQueryAttributesFile ({24, 0, 0x40, 0, 0, ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\IMM32.DLL"}, 1236552, ... ) }, 1236552, ... ) == 0x0 00297 464 NtOpenKey (0x80000000, {24, 0, 0x40, 0, 0, (0x80000000, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ntdll.dll"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 00298 464 NtOpenKey (0x80000000, {24, 0, 0x40, 0, 0, (0x80000000, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kernel32.dll"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 00299 464 NtOpenKey (0x80000000, {24, 0, 0x40, 0, 0, (0x80000000, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\GDI32.dll"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 00300 464 NtOpenKey (0x80000000, {24, 0, 0x40, 0, 0, (0x80000000, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ole32.dll"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 00301 464 NtOpenKey (0x80000000, {24, 0, 0x40, 0, 0, (0x80000000, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\oleaut32.dll"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 00302 464 NtQueryAttributesFile ({24, 0, 0x40, 0, 0, ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\IMM32.DLL"}, 1239956, ... ) }, 1239956, ... ) == 0x0 00303 464 NtOpenKey (0x20019, {24, 0, 0x40, 0, 0, (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\System\CurrentControlSet\Control\Error Message Instrument\"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 00304 464 NtOpenKey (0x20019, {24, 0, 0x40, 0, 0, (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\GRE_Initialize"}, ... 32, ) }, ... 32, ) == 0x0 00305 464 NtQueryValueKey (32, (32, "DisableMetaFiles", Partial, 20, ... ) , Partial, 20, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 00306 464 NtClose (32, ... ) == 0x0 00307 464 NtMapViewOfSection (-2147482740, -1, (0x0), 0, 0, 0x0, 0, 2, 0, 2, ... (0x570000), 0x0, 1060864, ) == 0x0 00308 464 NtClose (-2147482740, ... ) == 0x0 00309 464 NtCreateEvent (0x1f0003, 0x0, 1, 0, ... 32, ) == 0x0 00310 464 NtOpenThreadTokenEx (-2, 0x8, 1, 512, ... ) == STATUS_NO_TOKEN 00311 464 NtOpenProcessTokenEx (-1, 0x8, 512, ... -2147482740, ) == 0x0 00312 464 NtQueryInformationToken (-2147482740, Statistics, 0, ... ) == STATUS_BUFFER_TOO_SMALL 00313 464 NtQueryInformationToken (-2147482740, Statistics, 56, ... {token info, class 10, size 56}, 56, ) == 0x0 00314 464 NtClose (-2147482740, ... ) == 0x0 00315 464 NtAllocateVirtualMemory (-1, 0, 0, 32, 4096, 4, ... 3407872, 4096, ) == 0x0 00316 464 NtFreeVirtualMemory (-1, (0x340000), 4096, 32768, ... (0x340000), 4096, ) == 0x0 00317 464 NtDuplicateObject (-1, 28, -1, 0x0, 0, 2, ... 40, ) == 0x0 00318 464 NtOpenKey (0x20019, {24, 0, 0x240, 0, 0, (0x20019, {24, 0, 0x240, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Compatibility32"}, ... -2147482740, ) }, ... -2147482740, ) == 0x0 00319 464 NtQueryValueKey (-2147482740, (-2147482740, "packed", Partial, 172, ... ) , Partial, 172, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 00320 464 NtClose (-2147482740, ... ) == 0x0 00321 464 NtOpenKey (0x20019, {24, 0, 0x240, 0, 0, (0x20019, {24, 0, 0x240, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\IME Compatibility"}, ... -2147482740, ) }, ... -2147482740, ) == 0x0 00322 464 NtQueryValueKey (-2147482740, (-2147482740, "packed", Partial, 172, ... ) , Partial, 172, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 00323 464 NtClose (-2147482740, ... ) == 0x0 00324 464 NtQueryDefaultLocale (0, -139609780, ... ) == 0x0 00325 464 NtGdiQueryFontAssocInfo (0, ... ) == 0x0 00326 464 NtUserCallNoParam (24, ... ) == 0x0 00327 464 NtGdiCreateCompatibleDC (0, ... 00328 464 NtAllocateVirtualMemory (-1, 0, 0, 4096, 12288, 4, ... 3407872, 4096, ) == 0x0 00327 464 NtGdiCreateCompatibleDC ... ) == 0xee0105b0 00329 464 NtGdiGetStockObject (0, ... ) == 0x1900010 00330 464 NtGdiGetStockObject (4, ... ) == 0x1900011 00331 464 NtGdiCreateBitmap (8, 8, 1, 1, 2118200212, ... ) == 0x76050581 00332 464 NtGdiCreateSolidBrush (0, 0, ... 00333 464 NtAllocateVirtualMemory (-1, 0, 0, 4096, 12288, 4, ... 3473408, 4096, ) == 0x0 00332 464 NtGdiCreateSolidBrush ... ) == 0xa51003d2 00334 464 NtGdiGetStockObject (13, ... ) == 0x18a0021 00335 464 NtGdiCreateCompatibleDC (0, ... ) == 0x5201039b 00336 464 NtGdiSelectBitmap (1375798171, 1980040577, ... ) == 0x185000f 00337 464 NtUserGetThreadDesktop (464, 0, ... ) == 0x24 00338 464 NtOpenKey (0x20019, {24, 0, 0x40, 0, 0, (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Windows"}, ... 44, ) }, ... 44, ) == 0x0 00339 464 NtQueryValueKey (44, (44, "AppInit_DLLs", Partial, 64, ... TitleIdx=0, Type=1, Data="\0\0"}, 14, ) , Partial, 64, ... TitleIdx=0, Type=1, Data= (44, "AppInit_DLLs", Partial, 64, ... TitleIdx=0, Type=1, Data="\0\0"}, 14, ) }, 14, ) == 0x0 00340 464 NtClose (44, ... ) == 0x0 00341 464 NtUserFindExistingCursorIcon (1241132, 1241148, 1241196, ... ) == 0x10011 00342 464 NtUserRegisterClassExWOW (1241144, 1241212, 1241228, 1241244, 673, 128, 0, ... ) == 0x8178c017 00343 464 NtUserFindExistingCursorIcon (1241132, 1241148, 1241196, ... ) == 0x10011 00344 464 NtUserRegisterClassExWOW (1241144, 1241212, 1241228, 1241244, 674, 128, 0, ... ) == 0x8178c01c 00345 464 NtUserFindExistingCursorIcon (1241132, 1241148, 1241196, ... ) == 0x10011 00346 464 NtUserRegisterClassExWOW (1241144, 1241212, 1241228, 1241244, 675, 128, 0, ... ) == 0x8178c01e 00347 464 NtUserFindExistingCursorIcon (1241132, 1241148, 1241196, ... ) == 0x10011 00348 464 NtUserRegisterClassExWOW (1241144, 1241212, 1241228, 1241244, 676, 128, 0, ... ) == 0x81788002 00349 464 NtUserFindExistingCursorIcon (1241132, 1241148, 1241196, ... ) == 0x10013 00350 464 NtUserRegisterClassExWOW (1241144, 1241212, 1241228, 1241244, 677, 128, 0, ... ) == 0x8178c018 00351 464 NtUserFindExistingCursorIcon (1241132, 1241148, 1241196, ... ) == 0x10011 00352 464 NtUserRegisterClassExWOW (1241144, 1241212, 1241228, 1241244, 678, 128, 0, ... ) == 0x8178c01a 00353 464 NtUserFindExistingCursorIcon (1241132, 1241148, 1241196, ... ) == 0x10011 00354 464 NtUserRegisterClassExWOW (1241144, 1241212, 1241228, 1241244, 679, 128, 0, ... ) == 0x8178c01d 00355 464 NtUserFindExistingCursorIcon (1241132, 1241148, 1241196, ... ) == 0x10011 00356 464 NtUserRegisterClassExWOW (1241144, 1241212, 1241228, 1241244, 681, 128, 0, ... ) == 0x8178c026 00357 464 NtUserFindExistingCursorIcon (1241132, 1241148, 1241196, ... ) == 0x10011 00358 464 NtUserRegisterClassExWOW (1241144, 1241212, 1241228, 1241244, 680, 128, 0, ... ) == 0x8178c019 00359 464 NtUserRegisterClassExWOW (1241096, 1241164, 1241180, 1241196, 0, 128, 0, ... ) == 0x8178c020 00360 464 NtUserRegisterClassExWOW (1241352, 1241448, 1241432, 1241420, 0, 130, 0, ... ) == 0x8178c022 00361 464 NtUserRegisterClassExWOW (1241096, 1241164, 1241180, 1241196, 0, 128, 0, ... ) == 0x8178c023 00362 464 NtUserRegisterClassExWOW (1241352, 1241448, 1241432, 1241420, 0, 130, 0, ... ) == 0x8178c024 00363 464 NtUserRegisterClassExWOW (1241096, 1241164, 1241180, 1241196, 0, 128, 0, ... ) == 0x8178c025 00364 464 NtCallbackReturn (0, 0, 0, ... 00365 464 NtGdiInit (... ) == 0x1 00366 464 NtGdiGetStockObject (18, ... ) == 0x290001c 00367 464 NtGdiGetStockObject (19, ... ) == 0x1b00019 00368 464 NtAllocateVirtualMemory (-1, 1331200, 0, 4096, 4096, 4, ... 1331200, 4096, ) == 0x0 00369 464 NtOpenFile (0x100001, {24, 0, 0x40, 0, 0, (0x100001, {24, 0, 0x40, 0, 0, "\Device\KsecDD"}, 7, 16, ... 44, {status=0x0, info=0}, ) }, 7, 16, ... 44, {status=0x0, info=0}, ) == 0x0 00370 464 NtDeviceIoControlFile (44, 0, 0x0, 0x0, 0x390008, (44, 0, 0x0, 0x0, 0x390008, "\274|\352\3658\223\375\271\324~w\177\17\271\311\257\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0", 256, 256, ... , 256, 256, ... 00371 464 NtQuerySystemInformation (TimeOfDay, 48, ... {system info, class 3, size 48}, 48, ) == 0x0 00372 464 NtQuerySystemInformation (ProcessorTimes, 48, ... {system info, class 8, size 48}, 48, ) == 0x0 00373 464 NtQuerySystemInformation (Performance, 312, ... {system info, class 2, size 312}, 312, ) == 0x0 00374 464 NtQuerySystemInformation (Exception, 16, ... {system info, class 33, size 16}, 16, ) == 0x0 00375 464 NtQuerySystemInformation (Lookaside, 32, ... {system info, class 45, size 32}, 32, ) == 0x0 00376 464 NtQuerySystemInformation (ProcessorStatistics, 3016, ... {system info, class 23, size 0}, 0, ) == 0x0 00377 464 NtQuerySystemInformation (ProcessesAndThreads, 3008, ... ) == STATUS_INFO_LENGTH_MISMATCH 00378 464 NtCreateKey (0x2, {24, 0, 0x240, 0, 0, (0x2, {24, 0, 0x240, 0, 0, "\Registry\Machine\SOFTWARE\Microsoft\Cryptography\RNG"}, 0, 0x0, 0, ... -2147482740, 2, ) }, 0, 0x0, 0, ... -2147482740, 2, ) == 0x0 00379 464 NtSetValueKey (-2147482740, (-2147482740, "Seed", 0, 3, "\270?\345b\210\16\340Hy\274\264q\264\355\27\211*1\326\6Q=FtY8a\271On}\274\247\334`\331\311\313\225\237-\261\266\355?u\362\362\360\352b\272\235\264\330h\17;\330\306\11\372n\304\3765!\240@\200\351*\275c\342^q\203\11>", 80, ... ) , 0, 3, (-2147482740, "Seed", 0, 3, "\270?\345b\210\16\340Hy\274\264q\264\355\27\211*1\326\6Q=FtY8a\271On}\274\247\334`\331\311\313\225\237-\261\266\355?u\362\362\360\352b\272\235\264\330h\17;\330\306\11\372n\304\3765!\240@\200\351*\275c\342^q\203\11>", 80, ... ) , 80, ... ) == 0x0 00380 464 NtClose (-2147482740, ... ) == 0x0 00370 464 NtDeviceIoControlFile ... {status=0x0, info=256}, ... {status=0x0, info=256}, "y\260\327\336l\169?Wz\230\354\21\340\5\251\330\356\333\10\225\2216 "\345\260C\16\220\3572\354P\350\177\254\35kX'?\0\34\364u\367hZ\231\252cG9\231O\31v\257\340\251\16\373\362+ukGg\10\227\11\366\273\14\366.\326\16\334lyD\25\16x~%_z\372\305D\356\120\373\277\362\337?;\13\205\264>\363\244\317\230\376\336\3\372\272\325\12\16Jc\3475\345\16\231}b'$\334\211\2761\2170\7\377z~\256\276\36\377 G_(\226<\336:'%\336\2V\365\347Mal\5@\355F\311\216\2752d\365\27\257j\14U\351\300\305\322\21Z\207\211\214\333\262\267\352\344\231%\13\265\21\203\15\336\3\1\304\341\220-\274I\37\207+\265\263\21I\220\323$\331\327ZfF\267\177pL\272\372\335\346\227uG\310\26R\344A\255\20\352\243"\26\267\376\232\242}\202\322\272]J#d;", ) \345\260C\16\220\3572\354P\350\177\254\35kX'?\0\34\364u\367hZ\231\252cG9\231O\31v\257\340\251\16\373\362+ukGg\10\227\11\366\273\14\366.\326\16\334lyD\25\16x~%_z\372\305D\356\120\373\277\362\337?;\13\205\264>\363\244\317\230\376\336\3\372\272\325\12\16Jc\3475\345\16\231}b'$\334\211\2761\2170\7\377z~\256\276\36\377 G_(\226<\336:'%\336\2V\365\347Mal\5@\355F\311\216\2752d\365\27\257j\14U\351\300\305\322\21Z\207\211\214\333\262\267\352\344\231%\13\265\21\203\15\336\3\1\304\341\220-\274I\37\207+\265\263\21I\220\323$\331\327ZfF\267\177pL\272\372\335\346\227uG\310\26R\344A\255\20\352\243 ... {status=0x0, info=256}, "y\260\327\336l\169?Wz\230\354\21\340\5\251\330\356\333\10\225\2216 "\345\260C\16\220\3572\354P\350\177\254\35kX'?\0\34\364u\367hZ\231\252cG9\231O\31v\257\340\251\16\373\362+ukGg\10\227\11\366\273\14\366.\326\16\334lyD\25\16x~%_z\372\305D\356\120\373\277\362\337?;\13\205\264>\363\244\317\230\376\336\3\372\272\325\12\16Jc\3475\345\16\231}b'$\334\211\2761\2170\7\377z~\256\276\36\377 G_(\226<\336:'%\336\2V\365\347Mal\5@\355F\311\216\2752d\365\27\257j\14U\351\300\305\322\21Z\207\211\214\333\262\267\352\344\231%\13\265\21\203\15\336\3\1\304\341\220-\274I\37\207+\265\263\21I\220\323$\331\327ZfF\267\177pL\272\372\335\346\227uG\310\26R\344A\255\20\352\243"\26\267\376\232\242}\202\322\272]J#d;", ) , ) == 0x0 00381 464 NtQuerySystemInformation (Basic, 44, ... {Unknown=0,MaximumIncrement=156250,PhysicalPageSize=0x1000,NumberOfPhysicalPages=0xff7c,LowestPhysicalPage=0x1,HighestPhysicalPage=0xffff,AllocationGranularity=0x10000,LowestUserAddress=0x10000,HighestUserAddress=0x7ffeffff,ActiveProcessors=1,NumberProcessors=1,}, 0x0, ) == 0x0 00382 464 NtQuerySystemInformation (Processor, 12, ... {system info, class 1, size 12}, 0x0, ) == 0x0 00383 464 NtOpenKey (0x20019, {24, 16, 0x40, 0, 0, (0x20019, {24, 16, 0x40, 0, 0, "SYSTEM\CurrentControlSet\Control\Session Manager"}, ... 48, ) }, ... 48, ) == 0x0 00384 464 NtQueryValueKey (48, (48, "CriticalSectionTimeout", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\215'\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (48, "CriticalSectionTimeout", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\215'\0"}, 16, ) }, 16, ) == 0x0 00385 464 NtClose (48, ... ) == 0x0 00386 464 NtOpenKey (0x20019, {24, 16, 0x40, 0, 0, (0x20019, {24, 16, 0x40, 0, 0, "Software\Microsoft\Ole"}, ... 48, ) }, ... 48, ) == 0x0 00387 464 NtQueryValueKey (48, (48, "RWLockResourceTimeOut", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 00388 464 NtClose (48, ... ) == 0x0 00389 464 NtQuerySystemInformation (Basic, 44, ... {Unknown=0,MaximumIncrement=156250,PhysicalPageSize=0x1000,NumberOfPhysicalPages=0xff7c,LowestPhysicalPage=0x1,HighestPhysicalPage=0xffff,AllocationGranularity=0x10000,LowestUserAddress=0x10000,HighestUserAddress=0x7ffeffff,ActiveProcessors=1,NumberProcessors=1,}, 0x0, ) == 0x0 00390 464 NtQuerySystemInformation (Processor, 12, ... {system info, class 1, size 12}, 0x0, ) == 0x0 00391 464 NtQuerySystemInformation (Basic, 44, ... {Unknown=0,MaximumIncrement=156250,PhysicalPageSize=0x1000,NumberOfPhysicalPages=0xff7c,LowestPhysicalPage=0x1,HighestPhysicalPage=0xffff,AllocationGranularity=0x10000,LowestUserAddress=0x10000,HighestUserAddress=0x7ffeffff,ActiveProcessors=1,NumberProcessors=1,}, 0x0, ) == 0x0 00392 464 NtQuerySystemInformation (Processor, 12, ... {system info, class 1, size 12}, 0x0, ) == 0x0 00393 464 NtOpenKey (0x20019, {24, 0, 0x40, 0, 0, (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Classes\Interface"}, ... 48, ) }, ... 48, ) == 0x0 00394 464 NtQueryValueKey (48, (48, "InterfaceHelperDisableAll", Full, 0, ... ) , Full, 0, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 00395 464 NtQueryValueKey (48, (48, "InterfaceHelperDisableAllForOle32", Full, 0, ... ) , Full, 0, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 00396 464 NtQueryValueKey (48, (48, "InterfaceHelperDisableTypeLib", Full, 0, ... ) , Full, 0, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 00397 464 NtClose (48, ... ) == 0x0 00398 464 NtOpenKey (0x20019, {24, 0, 0x40, 0, 0, (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Classes\Interface\{00020400-0000-0000-C000-000000000046}"}, ... 48, ) }, ... 48, ) == 0x0 00399 464 NtQueryValueKey (48, (48, "InterfaceHelperDisableAll", Full, 0, ... ) , Full, 0, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 00400 464 NtQueryValueKey (48, (48, "InterfaceHelperDisableAllForOle32", Full, 0, ... ) , Full, 0, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 00401 464 NtClose (48, ... ) == 0x0 00402 464 NtOpenDirectoryObject (0x2000f, {24, 0, 0x40, 0, 0, (0x2000f, {24, 0, 0x40, 0, 0, "\BaseNamedObjects"}, ... 48, ) }, ... 48, ) == 0x0 00403 464 NtOpenEvent (0x1f0003, {24, 48, 0x0, 0, 0, (0x1f0003, {24, 48, 0x0, 0, 0, "HookSwitchHookEnabledEvent"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 00404 464 NtUserRegisterWindowMessage ( ("{FB8F0821-0164-101B-84ED-08002B2EC713}", ... ) , ... ) == 0xc077 00405 464 NtOpenKey (0x1, {24, 16, 0x40, 0, 0, (0x1, {24, 16, 0x40, 0, 0, "SOFTWARE\Microsoft\OLEAUT"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 00406 464 NtOpenKey (0x9, {24, 16, 0x40, 0, 0, (0x9, {24, 16, 0x40, 0, 0, "SOFTWARE\Microsoft\OLEAUT\UserEra"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 00407 464 NtOpenKey (0x1, {24, 16, 0x40, 0, 0, (0x1, {24, 16, 0x40, 0, 0, "SOFTWARE\Microsoft\OLEAUT"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 00408 464 NtTestAlert (... ) == 0x0 00409 464 NtContinue (1244464, 1, ... 00410 464 NtSetInformationThread (-2, Win32StartAddress(LpcReceivedMessageId), {StartAddress(LpcReceivedMsgId)=0x401000,}, 4, ... ) == 0x0 00411 464 NtAllocateVirtualMemory (-1, 0, 0, 278528, 4096, 64, ... 3538944, 278528, ) == 0x0 00412 464 NtAllocateVirtualMemory (-1, 0, 0, 278528, 4096, 64, ... 3866624, 278528, ) == 0x0 00413 464 NtFreeVirtualMemory (-1, (0x360000), 0, 32768, ... (0x360000), 278528, ) == 0x0 00414 464 NtAllocateVirtualMemory (-1, 0, 0, 1350, 4096, 4, ... 3538944, 4096, ) == 0x0 00415 464 NtFreeVirtualMemory (-1, (0x360000), 0, 32768, ... (0x360000), 4096, ) == 0x0 00416 464 NtAllocateVirtualMemory (-1, 0, 0, 208384, 4096, 4, ... 3538944, 208896, ) == 0x0 00417 464 NtFreeVirtualMemory (-1, (0x360000), 0, 32768, ... (0x360000), 208896, ) == 0x0 00418 464 NtAllocateVirtualMemory (-1, 0, 0, 2560, 4096, 4, ... 3538944, 4096, ) == 0x0 00419 464 NtFreeVirtualMemory (-1, (0x360000), 0, 32768, ... (0x360000), 4096, ) == 0x0 00420 464 NtAllocateVirtualMemory (-1, 0, 0, 4096, 4096, 4, ... 3538944, 4096, ) == 0x0 00421 464 NtFreeVirtualMemory (-1, (0x360000), 0, 32768, ... (0x360000), 4096, ) == 0x0 00422 464 NtAllocateVirtualMemory (-1, 0, 0, 10752, 4096, 4, ... 3538944, 12288, ) == 0x0 00423 464 NtFreeVirtualMemory (-1, (0x360000), 0, 32768, ... (0x360000), 12288, ) == 0x0 00424 464 NtOpenSection (0xe, {24, 8, 0x40, 0, 0, (0xe, {24, 8, 0x40, 0, 0, "version.dll"}, ... 52, ) }, ... 52, ) == 0x0 00425 464 NtMapViewOfSection (52, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x77c00000), 0x0, 32768, ) == 0x0 00426 464 NtClose (52, ... ) == 0x0 00427 464 NtProtectVirtualMemory (-1, (0x77c01000), 304, 4, ... (0x77c01000), 4096, 32, ) == 0x0 00428 464 NtProtectVirtualMemory (-1, (0x77c01000), 4096, 32, ... (0x77c01000), 4096, 4, ) == 0x0 00429 464 NtFlushInstructionCache (-1, 2009075712, 304, ... ) == 0x0 00430 464 NtOpenKey (0x80000000, {24, 0, 0x40, 0, 0, (0x80000000, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\version.dll"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 00431 464 NtOpenSection (0xe, {24, 8, 0x40, 0, 0, (0xe, {24, 8, 0x40, 0, 0, "wsock32.dll"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 00432 464 NtQueryAttributesFile ({24, 0, 0x40, 0, 0, ({24, 0, 0x40, 0, 0, "\??\u:\work\wsock32.dll"}, 1242940, ... ) }, 1242940, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 00433 464 NtQueryAttributesFile ({24, 0, 0x40, 0, 0, ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\wsock32.dll"}, 1242940, ... ) }, 1242940, ... ) == 0x0 00434 464 NtOpenFile (0x100020, {24, 0, 0x40, 0, 0, (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\wsock32.dll"}, 5, 96, ... 52, {status=0x0, info=1}, ) }, 5, 96, ... 52, {status=0x0, info=1}, ) == 0x0 00435 464 NtCreateSection (0xf, 0x0, 0x0, 16, 16777216, 52, ... 56, ) == 0x0 00436 464 NtQuerySection (56, Image, 48, ... {section info, class 1, size 48}, 0x0, ) == 0x0 00437 464 NtClose (52, ... ) == 0x0 00438 464 NtMapViewOfSection (56, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x71ad0000), 0x0, 36864, ) == 0x0 00439 464 NtClose (56, ... ) == 0x0 00440 464 NtProtectVirtualMemory (-1, (0x71ad1000), 52, 4, ... (0x71ad1000), 4096, 32, ) == 0x0 00441 464 NtProtectVirtualMemory (-1, (0x71ad1000), 4096, 32, ... (0x71ad1000), 4096, 4, ) == 0x0 00442 464 NtFlushInstructionCache (-1, 1907167232, 52, ... ) == 0x0 00443 464 NtOpenKey (0x80000000, {24, 0, 0x40, 0, 0, (0x80000000, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wsock32.dll"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 00444 464 NtQueryPerformanceCounter (... {924661889, 10}, {3579545, 0}, ) == 0x0 00445 464 NtOpenThreadTokenEx (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN 00446 464 NtOpenProcessTokenEx (-1, 0x20008, 512, ... 56, ) == 0x0 00447 464 NtQueryInformationToken (56, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0 00448 464 NtClose (56, ... ) == 0x0 00449 464 NtOpenKey (0x2000000, {24, 0, 0x640, 0, 0, (0x2000000, {24, 0, 0x640, 0, 0, "\REGISTRY\USER\S-1-5-21-1292428093-1383384898-725345543-1003"}, ... 56, ) }, ... 56, ) == 0x0 00450 464 NtSetInformationObject (56, Handle, {Inherit=0,ProtectFromClose=1,}, 1179904, ... ) == 0x0 00451 464 NtOpenKey (0xf003f, {24, 56, 0x40, 0, 0, (0xf003f, {24, 56, 0x40, 0, 0, "Software\Borland\Locales"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 00452 464 NtOpenKey (0xf003f, {24, 56, 0x40, 0, 0, (0xf003f, {24, 56, 0x40, 0, 0, "Software\Borland\Delphi\Locales"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 00453 464 NtOpenProcessToken (-1, 0x8, ... 52, ) == 0x0 00454 464 NtQueryInformationToken (52, Statistics, 56, ... {token info, class 10, size 56}, 56, ) == 0x0 00455 464 NtClose (52, ... ) == 0x0 00456 464 NtUserCallOneParam (0, 41, ... ) == 0x4 00457 464 NtAllocateVirtualMemory (-1, 1335296, 0, 4096, 4096, 4, ... 1335296, 4096, ) == 0x0 00458 464 NtAllocateVirtualMemory (-1, 0, 0, 1048576, 8192, 1, ... 9961472, 1048576, ) == 0x0 00459 464 NtAllocateVirtualMemory (-1, 1339392, 0, 4096, 4096, 4, ... 1339392, 4096, ) == 0x0 00460 464 NtAllocateVirtualMemory (-1, 9961472, 0, 16384, 4096, 4, ... 9961472, 16384, ) == 0x0 00461 464 NtUserCallNoParam (29, ... 00462 464 NtQueryAttributesFile ({24, 0, 0x40, 0, 0, ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\uxtheme.dll"}, 1242224, ... ) }, 1242224, ... ) == 0x0 00463 464 NtOpenFile (0x100020, {24, 0, 0x40, 0, 0, (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\uxtheme.dll"}, 5, 96, ... 52, {status=0x0, info=1}, ) }, 5, 96, ... 52, {status=0x0, info=1}, ) == 0x0 00464 464 NtCreateSection (0xe, 0x0, 0x0, 16, 134217728, 52, ... 60, ) == 0x0 00465 464 NtClose (52, ... ) == 0x0 00466 464 NtMapViewOfSection (60, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 16, ... (0x360000), 0x0, 221184, ) == 0x0 00467 464 NtClose (60, ... ) == 0x0 00468 464 NtUnmapViewOfSection (-1, 0x360000, ... ) == 0x0 00469 464 NtQueryAttributesFile ({24, 0, 0x40, 0, 0, ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\uxtheme.dll"}, 1242532, ... ) }, 1242532, ... ) == 0x0 00470 464 NtOpenFile (0x100020, {24, 0, 0x40, 0, 0, (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\uxtheme.dll"}, 5, 96, ... 60, {status=0x0, info=1}, ) }, 5, 96, ... 60, {status=0x0, info=1}, ) == 0x0 00471 464 NtCreateSection (0xf, 0x0, 0x0, 16, 16777216, 60, ... 52, ) == 0x0 00472 464 NtQuerySection (52, Image, 48, ... {section info, class 1, size 48}, 0x0, ) == 0x0 00473 464 NtClose (60, ... ) == 0x0 00474 464 NtMapViewOfSection (52, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x5ad70000), 0x0, 229376, ) == 0x0 00475 464 NtClose (52, ... ) == 0x0 00476 464 NtProtectVirtualMemory (-1, (0x5ad71000), 1300, 4, ... (0x5ad71000), 4096, 32, ) == 0x0 00477 464 NtProtectVirtualMemory (-1, (0x5ad71000), 4096, 32, ... (0x5ad71000), 4096, 4, ) == 0x0 00478 464 NtFlushInstructionCache (-1, 1524043776, 1300, ... ) == 0x0 00479 464 NtProtectVirtualMemory (-1, (0x5ad71000), 1300, 4, ... (0x5ad71000), 4096, 32, ) == 0x0 00480 464 NtProtectVirtualMemory (-1, (0x5ad71000), 4096, 32, ... (0x5ad71000), 4096, 4, ) == 0x0 00481 464 NtFlushInstructionCache (-1, 1524043776, 1300, ... ) == 0x0 00482 464 NtProtectVirtualMemory (-1, (0x5ad71000), 1300, 4, ... (0x5ad71000), 4096, 32, ) == 0x0 00483 464 NtProtectVirtualMemory (-1, (0x5ad71000), 4096, 32, ... (0x5ad71000), 4096, 4, ) == 0x0 00484 464 NtFlushInstructionCache (-1, 1524043776, 1300, ... ) == 0x0 00485 464 NtProtectVirtualMemory (-1, (0x5ad71000), 1300, 4, ... (0x5ad71000), 4096, 32, ) == 0x0 00486 464 NtProtectVirtualMemory (-1, (0x5ad71000), 4096, 32, ... (0x5ad71000), 4096, 4, ) == 0x0 00487 464 NtFlushInstructionCache (-1, 1524043776, 1300, ... ) == 0x0 00488 464 NtOpenKey (0x80000000, {24, 0, 0x40, 0, 0, (0x80000000, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\uxtheme.dll"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 00489 464 NtUserGetWindowDC (0, ... ) == 0x1010051 00490 464 NtUserCallOneParam (16842833, 57, ... ) == 0x1 00491 464 NtOpenThreadTokenEx (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN 00492 464 NtOpenProcessTokenEx (-1, 0x20008, 512, ... 52, ) == 0x0 00493 464 NtQueryInformationToken (52, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0 00494 464 NtClose (52, ... ) == 0x0 00495 464 NtOpenKey (0x2001f, {24, 0, 0x640, 0, 0, (0x2001f, {24, 0, 0x640, 0, 0, "\REGISTRY\USER\S-1-5-21-1292428093-1383384898-725345543-1003"}, ... 52, ) }, ... 52, ) == 0x0 00496 464 NtOpenKey (0x1, {24, 52, 0x40, 0, 0, (0x1, {24, 52, 0x40, 0, 0, "Software\Microsoft\Windows\CurrentVersion\ThemeManager"}, ... 60, ) }, ... 60, ) == 0x0 00497 464 NtQueryValueKey (60, (60, "Compositing", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 00498 464 NtClose (60, ... ) == 0x0 00499 464 NtClose (52, ... ) == 0x0 00500 464 NtOpenThreadTokenEx (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN 00501 464 NtOpenProcessTokenEx (-1, 0x20008, 512, ... 52, ) == 0x0 00502 464 NtQueryInformationToken (52, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0 00503 464 NtClose (52, ... ) == 0x0 00504 464 NtOpenKey (0x20019, {24, 0, 0x640, 0, 0, (0x20019, {24, 0, 0x640, 0, 0, "\REGISTRY\USER\S-1-5-21-1292428093-1383384898-725345543-1003"}, ... 52, ) }, ... 52, ) == 0x0 00505 464 NtOpenKey (0x1, {24, 52, 0x40, 0, 0, (0x1, {24, 52, 0x40, 0, 0, "Control Panel\Desktop"}, ... 60, ) }, ... 60, ) == 0x0 00506 464 NtQueryValueKey (60, (60, "LameButtonText", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 00507 464 NtClose (60, ... ) == 0x0 00508 464 NtClose (52, ... ) == 0x0 00509 464 NtUserGetProcessWindowStation (... ) == 0x1c 00510 464 NtUserGetObjectInformation (28, 2, 1244320, 64, 1244316, ... ) == 0x1 00511 464 NtUserGetGUIThreadInfo (464, 1244340, ... ) == 0x1 00512 464 NtConnectPort ( ("\ThemeApiPort", {12, 2, 1, 1}, 0x0, 0x0, 1244184, 64, ... 52, 0x0, 0x0, 0x0, 64, ) , {12, 2, 1, 1}, 0x0, 0x0, 1244184, 64, ... 52, 0x0, 0x0, 0x0, 64, ) == 0x0 00513 464 NtRequestWaitReplyPort (52, {32, 56, new_msg, 0, 0, 0, 0, 0} (52, {32, 56, new_msg, 0, 0, 0, 0, 0} "\4\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0" ... {32, 56, reply, 0, 1036, 464, 57970, 0} "\0\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0" ) ... {32, 56, reply, 0, 1036, 464, 57970, 0} (52, {32, 56, new_msg, 0, 0, 0, 0, 0} "\4\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0" ... {32, 56, reply, 0, 1036, 464, 57970, 0} "\0\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0" ) ) == 0x0 00514 464 NtRequestWaitReplyPort (52, {32, 56, new_msg, 0, 0, 0, 0, 0} (52, {32, 56, new_msg, 0, 0, 0, 0, 0} "\355\3\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0" ... {32, 56, reply, 0, 1036, 464, 57971, 0} "\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0" ) ... {32, 56, reply, 0, 1036, 464, 57971, 0} (52, {32, 56, new_msg, 0, 0, 0, 0, 0} "\355\3\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0" ... {32, 56, reply, 0, 1036, 464, 57971, 0} "\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0" ) ) == 0x0 00515 464 NtUserCallNoParam (29, ... 00516 464 NtQueryAttributesFile ({24, 0, 0x40, 0, 0, ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\uxtheme.dll"}, 1241580, ... ) }, 1241580, ... ) == 0x0 00515 464 NtUserCallNoParam ... ) == 0x0 00517 464 NtUserSystemParametersInfo (41, 0, 1524240760, 0, ... ) == 0x1 00518 464 NtGdiHfontCreate (1243708, 356, 0, 0, 1333048, ... ) == 0x330a04e1 00519 464 NtGdiHfontCreate (1243708, 356, 0, 0, 1333040, ... ) == 0x520a0634 00520 464 NtRequestWaitReplyPort (52, {32, 56, new_msg, 0, 0, 0, 0, 0} (52, {32, 56, new_msg, 0, 0, 0, 0, 0} "\7\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0" ... {32, 56, reply, 0, 1036, 464, 57972, 0} "\0\0\0\0\0\0\0\0<\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0" ) ... {32, 56, reply, 0, 1036, 464, 57972, 0} (52, {32, 56, new_msg, 0, 0, 0, 0, 0} "\7\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0" ... {32, 56, reply, 0, 1036, 464, 57972, 0} "\0\0\0\0\0\0\0\0<\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0" ) ) == 0x0 00521 464 NtMapViewOfSection (60, -1, (0x0), 0, 0, {0, 0}, 0, 1, 0, 2, ... (0x360000), {0, 0}, 327680, ) == 0x0 00522 464 NtUserGetWindowDC (0, ... ) == 0x1010051 00523 464 NtUserCallOneParam (16842833, 57, ... ) == 0x1 00524 464 NtUserGetWindowDC (0, ... ) == 0x1010051 00525 464 NtUserCallOneParam (16842833, 57, ... ) == 0x1 00526 464 NtUserGetWindowDC (0, ... ) == 0x1010051 00527 464 NtUserCallOneParam (16842833, 57, ... ) == 0x1 00528 464 NtUserGetWindowDC (0, ... ) == 0x1010051 00529 464 NtUserCallOneParam (16842833, 57, ... ) == 0x1 00530 464 NtUserGetWindowDC (0, ... ) == 0x1010051 00531 464 NtUserCallOneParam (16842833, 57, ... ) == 0x1 00532 464 NtUserGetWindowDC (0, ... ) == 0x1010051 00533 464 NtUserCallOneParam (16842833, 57, ... ) == 0x1 00534 464 NtUserGetWindowDC (0, ... ) == 0x1010051 00535 464 NtUserCallOneParam (16842833, 57, ... ) == 0x1 00536 464 NtUserGetWindowDC (0, ... ) == 0x1010051 00537 464 NtUserCallOneParam (16842833, 57, ... ) == 0x1 00538 464 NtUserGetWindowDC (0, ... ) == 0x1010051 00539 464 NtGdiCreatePatternBrushInternal (59048383, 0, 0, ... ) == 0x72100798 00540 464 NtUserCallOneParam (16842833, 57, ... ) == 0x1 00541 464 NtUserCallNoParam (29, ... 00542 464 NtQueryAttributesFile ({24, 0, 0x40, 0, 0, ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\uxtheme.dll"}, 1241020, ... ) }, 1241020, ... ) == 0x0 00541 464 NtUserCallNoParam ... ) == 0x0 00543 464 NtUserCallNoParam (29, ... 00544 464 NtQueryAttributesFile ({24, 0, 0x40, 0, 0, ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\uxtheme.dll"}, 1241016, ... ) }, 1241016, ... ) == 0x0 00543 464 NtUserCallNoParam ... ) == 0x0 00461 464 NtUserCallNoParam ... ) == 0x1 00545 464 NtOpenKey (0x2000000, {24, 16, 0x40, 0, 0, (0x2000000, {24, 16, 0x40, 0, 0, "System\CurrentControlSet\Services\WinSock2\Parameters"}, ... 64, ) }, ... 64, ) == 0x0 00546 464 NtQueryValueKey (64, (64, "WinSock_Registry_Version", Partial, 144, ... TitleIdx=0, Type=1, Data="2\0.\00\0\0\0"}, 20, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (64, "WinSock_Registry_Version", Partial, 144, ... TitleIdx=0, Type=1, Data="2\0.\00\0\0\0"}, 20, ) }, 20, ) == 0x0 00547 464 NtQueryValueKey (64, (64, "WinSock_Registry_Version", Partial, 144, ... TitleIdx=0, Type=1, Data="2\0.\00\0\0\0"}, 20, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (64, "WinSock_Registry_Version", Partial, 144, ... TitleIdx=0, Type=1, Data="2\0.\00\0\0\0"}, 20, ) }, 20, ) == 0x0 00548 464 NtCreateEvent (0x1f0003, 0x0, 0, 0, ... 68, ) == 0x0 00549 464 NtOpenKey (0x2000000, {24, 64, 0x40, 0, 0, (0x2000000, {24, 64, 0x40, 0, 0, "Protocol_Catalog9"}, ... 72, ) }, ... 72, ) == 0x0 00550 464 NtQueryValueKey (72, (72, "Serial_Access_Num", Partial, 144, ... TitleIdx=0, Type=4, Data="\15\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (72, "Serial_Access_Num", Partial, 144, ... TitleIdx=0, Type=4, Data="\15\0\0\0"}, 16, ) }, 16, ) == 0x0 00551 464 NtNotifyChangeKey (72, 68, 0, 0, 2011455960, 1, 0, 0, 0, 1, ... ) == 0x103 00552 464 NtQueryValueKey (72, (72, "Serial_Access_Num", Partial, 144, ... TitleIdx=0, Type=4, Data="\15\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (72, "Serial_Access_Num", Partial, 144, ... TitleIdx=0, Type=4, Data="\15\0\0\0"}, 16, ) }, 16, ) == 0x0 00553 464 NtOpenKey (0x2000000, {24, 72, 0x40, 0, 0, (0x2000000, {24, 72, 0x40, 0, 0, "0000000D"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 00554 464 NtQueryValueKey (72, (72, "Next_Catalog_Entry_ID", Partial, 144, ... TitleIdx=0, Type=4, Data="#\4\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (72, "Next_Catalog_Entry_ID", Partial, 144, ... TitleIdx=0, Type=4, Data="#\4\0\0"}, 16, ) }, 16, ) == 0x0 00555 464 NtQueryValueKey (72, (72, "Num_Catalog_Entries", Partial, 144, ... TitleIdx=0, Type=4, Data="\26\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (72, "Num_Catalog_Entries", Partial, 144, ... TitleIdx=0, Type=4, Data="\26\0\0\0"}, 16, ) }, 16, ) == 0x0 00556 464 NtOpenKey (0x2000000, {24, 72, 0x40, 0, 0, (0x2000000, {24, 72, 0x40, 0, 0, "Catalog_Entries"}, ... 76, ) }, ... 76, ) == 0x0 00557 464 NtOpenKey (0x20019, {24, 76, 0x40, 0, 0, (0x20019, {24, 76, 0x40, 0, 0, "000000000001"}, ... 80, ) }, ... 80, ) == 0x0 00558 464 NtQueryValueKey (80, (80, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW 00559 464 NtQueryValueKey (80, (80, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW 00560 464 NtAllocateVirtualMemory (-1, 1343488, 0, 4096, 4096, 4, ... 1343488, 4096, ) == 0x0 00561 464 NtQueryValueKey (80, (80, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5f\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\10\0\0\0\240\32\17\347\213\253\317\21\214\243\0\200_H\241\222\351\3\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\2\0\0\0\20\0\0\0\20\0\0\0\1\0\0\0\6\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0T\0c\0p\0i\0p\0 \0[\0T\0C\0P\0/\0I\0P\0]\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\204\3\0\02\2\0\0\14\4\0\0\320\1\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0P\0\0\02\2\0\0\14\4\0\0\320\1\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\03\2\0\0\14\4\0\0\320\1\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0L\0\0\0L\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\310r\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\00\02\03\2\0\0\14\4\0\0\320\1\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0P\0\0\0\24\0\0\0\24\0\0\0\0\340\375\177\211e@\0\0\2\0\0\4\0\0\0\0\0\0\08\275D\0\12D@\0:n@\0\2\0\0\0\240\16\210\0@\15\210\0\24\0\0\0\0\0\0\0\0\340\375\177\6\0\0\0\4\255\220\367\224\377\22\0\1\0\0\0\340\377\22\0d\222@\0\30\321@\0\0\0\0\0\360\377\22\0\327o\201|\24\0\0\0\0\0\0\0\0\340\375\177\375?T\200\310\377\22\0P$t\201\377\377\377\377\250\232\203|\340o\201|\0\0\0\0\0\0\0\0\0\0\0\0\206m@\0\0\0\0\0Actx \0\0\0\1\0\0\0\230$\0\0\304\0\0\0\0\0\0\0 \0\0\0\0\0\0\0\24\0\0\0"}, 900, ) , Partial, 900, ... TitleIdx=0, Type=3, Data= (80, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5f\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\10\0\0\0\240\32\17\347\213\253\317\21\214\243\0\200_H\241\222\351\3\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\2\0\0\0\20\0\0\0\20\0\0\0\1\0\0\0\6\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0T\0c\0p\0i\0p\0 \0[\0T\0C\0P\0/\0I\0P\0]\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\204\3\0\02\2\0\0\14\4\0\0\320\1\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0P\0\0\02\2\0\0\14\4\0\0\320\1\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\03\2\0\0\14\4\0\0\320\1\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0L\0\0\0L\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\310r\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\00\02\03\2\0\0\14\4\0\0\320\1\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0P\0\0\0\24\0\0\0\24\0\0\0\0\340\375\177\211e@\0\0\2\0\0\4\0\0\0\0\0\0\08\275D\0\12D@\0:n@\0\2\0\0\0\240\16\210\0@\15\210\0\24\0\0\0\0\0\0\0\0\340\375\177\6\0\0\0\4\255\220\367\224\377\22\0\1\0\0\0\340\377\22\0d\222@\0\30\321@\0\0\0\0\0\360\377\22\0\327o\201|\24\0\0\0\0\0\0\0\0\340\375\177\375?T\200\310\377\22\0P$t\201\377\377\377\377\250\232\203|\340o\201|\0\0\0\0\0\0\0\0\0\0\0\0\206m@\0\0\0\0\0Actx \0\0\0\1\0\0\0\230$\0\0\304\0\0\0\0\0\0\0 \0\0\0\0\0\0\0\24\0\0\0"}, 900, ) }, 900, ) == 0x0 00562 464 NtClose (80, ... ) == 0x0 00563 464 NtOpenKey (0x20019, {24, 76, 0x40, 0, 0, (0x20019, {24, 76, 0x40, 0, 0, "000000000002"}, ... 80, ) }, ... 80, ) == 0x0 00564 464 NtQueryValueKey (80, (80, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW 00565 464 NtQueryValueKey (80, (80, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW 00566 464 NtQueryValueKey (80, (80, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\11\6\2\0\0\0\0\0\0\0\0\0\0\0\0\0\10\0\0\0\240\32\17\347\213\253\317\21\214\243\0\200_H\241\222\352\3\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\2\0\0\0\20\0\0\0\20\0\0\0\2\0\0\0\21\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\273\377\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0T\0c\0p\0i\0p\0 \0[\0U\0D\0P\0/\0I\0P\0]\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\204\3\0\07\2\0\0\14\4\0\0\320\1\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0P\0\0\07\2\0\0\14\4\0\0\320\1\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\08\2\0\0\14\4\0\0\320\1\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0L\0\0\0L\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\310r\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\00\03\08\2\0\0\14\4\0\0\320\1\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0P\0\0\09\2\0\0\14\4\0\0\320\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0P\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\09\2\0\0\14\4\0\0\320\1\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0:\2\0\0\14\4\0\0\320\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0P\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) , Partial, 900, ... TitleIdx=0, Type=3, Data= (80, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\11\6\2\0\0\0\0\0\0\0\0\0\0\0\0\0\10\0\0\0\240\32\17\347\213\253\317\21\214\243\0\200_H\241\222\352\3\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\2\0\0\0\20\0\0\0\20\0\0\0\2\0\0\0\21\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\273\377\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0T\0c\0p\0i\0p\0 \0[\0U\0D\0P\0/\0I\0P\0]\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\204\3\0\07\2\0\0\14\4\0\0\320\1\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0P\0\0\07\2\0\0\14\4\0\0\320\1\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\08\2\0\0\14\4\0\0\320\1\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0L\0\0\0L\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\310r\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\00\03\08\2\0\0\14\4\0\0\320\1\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0P\0\0\09\2\0\0\14\4\0\0\320\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0P\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\09\2\0\0\14\4\0\0\320\1\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0:\2\0\0\14\4\0\0\320\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0P\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) \0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\09\2\0\0\14\4\0\0\320\1\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0:\2\0\0\14\4\0\0\320\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0P\0\0\0\0\0\0\0 (80, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\11\6\2\0\0\0\0\0\0\0\0\0\0\0\0\0\10\0\0\0\240\32\17\347\213\253\317\21\214\243\0\200_H\241\222\352\3\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\2\0\0\0\20\0\0\0\20\0\0\0\2\0\0\0\21\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\273\377\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0T\0c\0p\0i\0p\0 \0[\0U\0D\0P\0/\0I\0P\0]\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\204\3\0\07\2\0\0\14\4\0\0\320\1\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0P\0\0\07\2\0\0\14\4\0\0\320\1\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\08\2\0\0\14\4\0\0\320\1\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0L\0\0\0L\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\310r\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\00\03\08\2\0\0\14\4\0\0\320\1\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0P\0\0\09\2\0\0\14\4\0\0\320\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0P\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\09\2\0\0\14\4\0\0\320\1\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0:\2\0\0\14\4\0\0\320\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0P\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) }, 900, ) == 0x0 00567 464 NtClose (80, ... ) == 0x0 00568 464 NtOpenKey (0x20019, {24, 76, 0x40, 0, 0, (0x20019, {24, 76, 0x40, 0, 0, "000000000003"}, ... 80, ) }, ... 80, ) == 0x0 00569 464 NtQueryValueKey (80, (80, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW 00570 464 NtQueryValueKey (80, (80, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW 00571 464 NtQueryValueKey (80, (80, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\11\6\2\0\0\0\0\0\0\0\0\0\0\0\0\0\14\0\0\0\240\32\17\347\213\253\317\21\214\243\0\200_H\241\222\353\3\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\2\0\0\0\20\0\0\0\20\0\0\0\3\0\0\0\0\0\0\0\377\0\0\0\0\0\0\0\0\0\0\0\273\377\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0T\0c\0p\0i\0p\0 \0[\0R\0A\0W\0/\0I\0P\0]\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\204\3\0\0<\2\0\0\14\4\0\0\320\1\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0P\0\0\0<\2\0\0\14\4\0\0\320\1\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0=\2\0\0\14\4\0\0\320\1\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0L\0\0\0L\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\310r\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\00\04\0=\2\0\0\14\4\0\0\320\1\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0P\0\0\0>\2\0\0\14\4\0\0\320\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0P\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0>\2\0\0\14\4\0\0\320\1\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0?\2\0\0\14\4\0\0\320\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0P\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) , Partial, 900, ... TitleIdx=0, Type=3, Data= (80, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\11\6\2\0\0\0\0\0\0\0\0\0\0\0\0\0\14\0\0\0\240\32\17\347\213\253\317\21\214\243\0\200_H\241\222\353\3\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\2\0\0\0\20\0\0\0\20\0\0\0\3\0\0\0\0\0\0\0\377\0\0\0\0\0\0\0\0\0\0\0\273\377\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0T\0c\0p\0i\0p\0 \0[\0R\0A\0W\0/\0I\0P\0]\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\204\3\0\0<\2\0\0\14\4\0\0\320\1\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0P\0\0\0<\2\0\0\14\4\0\0\320\1\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0=\2\0\0\14\4\0\0\320\1\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0L\0\0\0L\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\310r\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\00\04\0=\2\0\0\14\4\0\0\320\1\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0P\0\0\0>\2\0\0\14\4\0\0\320\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0P\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0>\2\0\0\14\4\0\0\320\1\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0?\2\0\0\14\4\0\0\320\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0P\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) \0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0>\2\0\0\14\4\0\0\320\1\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0?\2\0\0\14\4\0\0\320\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0P\0\0\0\0\0\0\0 (80, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\11\6\2\0\0\0\0\0\0\0\0\0\0\0\0\0\14\0\0\0\240\32\17\347\213\253\317\21\214\243\0\200_H\241\222\353\3\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\2\0\0\0\20\0\0\0\20\0\0\0\3\0\0\0\0\0\0\0\377\0\0\0\0\0\0\0\0\0\0\0\273\377\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0T\0c\0p\0i\0p\0 \0[\0R\0A\0W\0/\0I\0P\0]\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\204\3\0\0<\2\0\0\14\4\0\0\320\1\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0P\0\0\0<\2\0\0\14\4\0\0\320\1\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0=\2\0\0\14\4\0\0\320\1\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0L\0\0\0L\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\310r\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\00\04\0=\2\0\0\14\4\0\0\320\1\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0P\0\0\0>\2\0\0\14\4\0\0\320\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0P\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0>\2\0\0\14\4\0\0\320\1\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0?\2\0\0\14\4\0\0\320\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0P\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) }, 900, ) == 0x0 00572 464 NtClose (80, ... ) == 0x0 00573 464 NtOpenKey (0x20019, {24, 76, 0x40, 0, 0, (0x20019, {24, 76, 0x40, 0, 0, "000000000004"}, ... 80, ) }, ... 80, ) == 0x0 00574 464 NtQueryValueKey (80, (80, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW 00575 464 NtQueryValueKey (80, (80, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW 00576 464 NtQueryValueKey (80, (80, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\rsvpsp.dll\0\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\11&\2\0\0\0\0\0\0\0\0\0\0\0\0\0\10\0\0\0\340\251`\235z3\320\21\275\210\0\0\300\202\346\232\354\3\0\0\1\0\0\0\204\370\272\2|\370\272\2\210\371\272\2\4\244`u\\12\0\0\240<_u\260\371\272\2\6\0\0\0\2\0\0\0\20\0\0\0\20\0\0\0\2\0\0\0\21\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\273\377\0\0\0\0\0\0R\0S\0V\0P\0 \0U\0D\0P\0 \0S\0e\0r\0v\0i\0c\0e\0 \0P\0r\0o\0v\0i\0d\0e\0r\0\0\0\1\0\0\0\344\373\272\2\1\0\0\0\330\273\356\0\0\0\0\0=\373\220|\200\371\272\2\0\0\0\0\0\371\272\2l\373\220|q\373\220|\0\0\0\0\200\371\272\2=\373\220|\334\370\272\2\0\0\0\0\204\3\0\0A\2\0\0\14\4\0\0\320\1\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0P\0\0\0A\2\0\0\14\4\0\0\320\1\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0B\2\0\0\14\4\0\0\320\1\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0L\0\0\0L\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\310r\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\00\05\0B\2\0\0\14\4\0\0\320\1\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0P\0\0\0C\2\0\0\14\4\0\0\320\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0P\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0C\2\0\0\14\4\0\0\320\1\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0D\2\0\0\14\4\0\0\320\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0P\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) , Partial, 900, ... TitleIdx=0, Type=3, Data= (80, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\rsvpsp.dll\0\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\11&\2\0\0\0\0\0\0\0\0\0\0\0\0\0\10\0\0\0\340\251`\235z3\320\21\275\210\0\0\300\202\346\232\354\3\0\0\1\0\0\0\204\370\272\2|\370\272\2\210\371\272\2\4\244`u\\12\0\0\240<_u\260\371\272\2\6\0\0\0\2\0\0\0\20\0\0\0\20\0\0\0\2\0\0\0\21\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\273\377\0\0\0\0\0\0R\0S\0V\0P\0 \0U\0D\0P\0 \0S\0e\0r\0v\0i\0c\0e\0 \0P\0r\0o\0v\0i\0d\0e\0r\0\0\0\1\0\0\0\344\373\272\2\1\0\0\0\330\273\356\0\0\0\0\0=\373\220|\200\371\272\2\0\0\0\0\0\371\272\2l\373\220|q\373\220|\0\0\0\0\200\371\272\2=\373\220|\334\370\272\2\0\0\0\0\204\3\0\0A\2\0\0\14\4\0\0\320\1\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0P\0\0\0A\2\0\0\14\4\0\0\320\1\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0B\2\0\0\14\4\0\0\320\1\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0L\0\0\0L\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\310r\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\00\05\0B\2\0\0\14\4\0\0\320\1\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0P\0\0\0C\2\0\0\14\4\0\0\320\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0P\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0C\2\0\0\14\4\0\0\320\1\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0D\2\0\0\14\4\0\0\320\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0P\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) \0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0C\2\0\0\14\4\0\0\320\1\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0D\2\0\0\14\4\0\0\320\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0P\0\0\0\0\0\0\0 (80, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\rsvpsp.dll\0\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\11&\2\0\0\0\0\0\0\0\0\0\0\0\0\0\10\0\0\0\340\251`\235z3\320\21\275\210\0\0\300\202\346\232\354\3\0\0\1\0\0\0\204\370\272\2|\370\272\2\210\371\272\2\4\244`u\\12\0\0\240<_u\260\371\272\2\6\0\0\0\2\0\0\0\20\0\0\0\20\0\0\0\2\0\0\0\21\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\273\377\0\0\0\0\0\0R\0S\0V\0P\0 \0U\0D\0P\0 \0S\0e\0r\0v\0i\0c\0e\0 \0P\0r\0o\0v\0i\0d\0e\0r\0\0\0\1\0\0\0\344\373\272\2\1\0\0\0\330\273\356\0\0\0\0\0=\373\220|\200\371\272\2\0\0\0\0\0\371\272\2l\373\220|q\373\220|\0\0\0\0\200\371\272\2=\373\220|\334\370\272\2\0\0\0\0\204\3\0\0A\2\0\0\14\4\0\0\320\1\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0P\0\0\0A\2\0\0\14\4\0\0\320\1\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0B\2\0\0\14\4\0\0\320\1\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0L\0\0\0L\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\310r\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\00\05\0B\2\0\0\14\4\0\0\320\1\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0P\0\0\0C\2\0\0\14\4\0\0\320\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0P\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0C\2\0\0\14\4\0\0\320\1\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0D\2\0\0\14\4\0\0\320\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0P\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) }, 900, ) == 0x0 00577 464 NtClose (80, ... ) == 0x0 00578 464 NtOpenKey (0x20019, {24, 76, 0x40, 0, 0, (0x20019, {24, 76, 0x40, 0, 0, "000000000005"}, ... 80, ) }, ... 80, ) == 0x0 00579 464 NtQueryValueKey (80, (80, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW 00580 464 NtQueryValueKey (80, (80, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW 00581 464 NtAllocateVirtualMemory (-1, 1347584, 0, 4096, 4096, 4, ... 1347584, 4096, ) == 0x0 00582 464 NtQueryValueKey (80, (80, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\rsvpsp.dll\0\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5f \2\0\0\0\0\0\0\0\0\0\0\0\0\0\10\0\0\0\340\251`\235z3\320\21\275\210\0\0\300\202\346\232\355\3\0\0\1\0\0\0\210\1\34\0\0\0\34\0\10\0\0\0\0\0\0\0\214\373\272\2\\15\221|\0\0\34\0\6\0\0\0\2\0\0\0\20\0\0\0\20\0\0\0\1\0\0\0\6\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0R\0S\0V\0P\0 \0T\0C\0P\0 \0S\0e\0r\0v\0i\0c\0e\0 \0P\0r\0o\0v\0i\0d\0e\0r\0\0\0\210\1\34\0\0\0\0\0\20\0\0\0P\373\272\2\270Ddu\0\0\0\0(\275\356\0|\373\272\2\364\373\272\2\0\0\34\0\10\0\0\0\0\0\0\0(\374\272\2\\15\221|\0\0\34\0\0\0\0\0\204\3\0\0G\2\0\0\14\4\0\0\320\1\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0P\0\0\0G\2\0\0\14\4\0\0\320\1\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0H\2\0\0\14\4\0\0\320\1\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0L\0\0\0L\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\310r\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\00\06\0H\2\0\0\14\4\0\0\320\1\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0P\0\0\0I\2\0\0\14\4\0\0\320\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0P\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0I\2\0\0\14\4\0\0\320\1\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0J\2\0\0\14\4\0\0\320\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0P\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) , Partial, 900, ... TitleIdx=0, Type=3, Data= (80, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\rsvpsp.dll\0\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5f \2\0\0\0\0\0\0\0\0\0\0\0\0\0\10\0\0\0\340\251`\235z3\320\21\275\210\0\0\300\202\346\232\355\3\0\0\1\0\0\0\210\1\34\0\0\0\34\0\10\0\0\0\0\0\0\0\214\373\272\2\\15\221|\0\0\34\0\6\0\0\0\2\0\0\0\20\0\0\0\20\0\0\0\1\0\0\0\6\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0R\0S\0V\0P\0 \0T\0C\0P\0 \0S\0e\0r\0v\0i\0c\0e\0 \0P\0r\0o\0v\0i\0d\0e\0r\0\0\0\210\1\34\0\0\0\0\0\20\0\0\0P\373\272\2\270Ddu\0\0\0\0(\275\356\0|\373\272\2\364\373\272\2\0\0\34\0\10\0\0\0\0\0\0\0(\374\272\2\\15\221|\0\0\34\0\0\0\0\0\204\3\0\0G\2\0\0\14\4\0\0\320\1\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0P\0\0\0G\2\0\0\14\4\0\0\320\1\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0H\2\0\0\14\4\0\0\320\1\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0L\0\0\0L\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\310r\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\00\06\0H\2\0\0\14\4\0\0\320\1\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0P\0\0\0I\2\0\0\14\4\0\0\320\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0P\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0I\2\0\0\14\4\0\0\320\1\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0J\2\0\0\14\4\0\0\320\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0P\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) \0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0I\2\0\0\14\4\0\0\320\1\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0J\2\0\0\14\4\0\0\320\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0P\0\0\0\0\0\0\0 (80, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\rsvpsp.dll\0\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5f \2\0\0\0\0\0\0\0\0\0\0\0\0\0\10\0\0\0\340\251`\235z3\320\21\275\210\0\0\300\202\346\232\355\3\0\0\1\0\0\0\210\1\34\0\0\0\34\0\10\0\0\0\0\0\0\0\214\373\272\2\\15\221|\0\0\34\0\6\0\0\0\2\0\0\0\20\0\0\0\20\0\0\0\1\0\0\0\6\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0R\0S\0V\0P\0 \0T\0C\0P\0 \0S\0e\0r\0v\0i\0c\0e\0 \0P\0r\0o\0v\0i\0d\0e\0r\0\0\0\210\1\34\0\0\0\0\0\20\0\0\0P\373\272\2\270Ddu\0\0\0\0(\275\356\0|\373\272\2\364\373\272\2\0\0\34\0\10\0\0\0\0\0\0\0(\374\272\2\\15\221|\0\0\34\0\0\0\0\0\204\3\0\0G\2\0\0\14\4\0\0\320\1\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0P\0\0\0G\2\0\0\14\4\0\0\320\1\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0H\2\0\0\14\4\0\0\320\1\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0L\0\0\0L\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\310r\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\00\06\0H\2\0\0\14\4\0\0\320\1\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0P\0\0\0I\2\0\0\14\4\0\0\320\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0P\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0I\2\0\0\14\4\0\0\320\1\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0J\2\0\0\14\4\0\0\320\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0P\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) }, 900, ) == 0x0 00583 464 NtClose (80, ... ) == 0x0 00584 464 NtOpenKey (0x20019, {24, 76, 0x40, 0, 0, (0x20019, {24, 76, 0x40, 0, 0, "000000000006"}, ... 80, ) }, ... 80, ) == 0x0 00585 464 NtQueryValueKey (80, (80, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW 00586 464 NtQueryValueKey (80, (80, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW 00587 464 NtQueryValueKey (80, (80, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5&\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\10\0\0\0d\200\304\237\230r\344C\267\275\30\37 \211y*\374\3\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0 \0\0\0\36\0\0\0\36\0\0\0\1\0\0\0\3\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0R\0f\0C\0o\0m\0m\0 \0[\0B\0l\0u\0e\0t\0o\0o\0t\0h\0]\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\204\3\0\0L\2\0\0\14\4\0\0\320\1\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0P\0\0\0L\2\0\0\14\4\0\0\320\1\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0M\2\0\0\14\4\0\0\320\1\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0L\0\0\0L\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\310r\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\00\07\0M\2\0\0\14\4\0\0\320\1\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0P\0\0\0N\2\0\0\14\4\0\0\320\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0P\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0N\2\0\0\14\4\0\0\320\1\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0O\2\0\0\14\4\0\0\320\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0P\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) , Partial, 900, ... TitleIdx=0, Type=3, Data= (80, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5&\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\10\0\0\0d\200\304\237\230r\344C\267\275\30\37 \211y*\374\3\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0 \0\0\0\36\0\0\0\36\0\0\0\1\0\0\0\3\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0R\0f\0C\0o\0m\0m\0 \0[\0B\0l\0u\0e\0t\0o\0o\0t\0h\0]\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\204\3\0\0L\2\0\0\14\4\0\0\320\1\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0P\0\0\0L\2\0\0\14\4\0\0\320\1\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0M\2\0\0\14\4\0\0\320\1\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0L\0\0\0L\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\310r\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\00\07\0M\2\0\0\14\4\0\0\320\1\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0P\0\0\0N\2\0\0\14\4\0\0\320\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0P\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0N\2\0\0\14\4\0\0\320\1\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0O\2\0\0\14\4\0\0\320\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0P\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) \0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0N\2\0\0\14\4\0\0\320\1\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0O\2\0\0\14\4\0\0\320\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0P\0\0\0\0\0\0\0 (80, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5&\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\10\0\0\0d\200\304\237\230r\344C\267\275\30\37 \211y*\374\3\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0 \0\0\0\36\0\0\0\36\0\0\0\1\0\0\0\3\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0R\0f\0C\0o\0m\0m\0 \0[\0B\0l\0u\0e\0t\0o\0o\0t\0h\0]\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\204\3\0\0L\2\0\0\14\4\0\0\320\1\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0P\0\0\0L\2\0\0\14\4\0\0\320\1\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0M\2\0\0\14\4\0\0\320\1\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0L\0\0\0L\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\310r\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\00\07\0M\2\0\0\14\4\0\0\320\1\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0P\0\0\0N\2\0\0\14\4\0\0\320\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0P\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0N\2\0\0\14\4\0\0\320\1\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0O\2\0\0\14\4\0\0\320\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0P\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) }, 900, ) == 0x0 00588 464 NtClose (80, ... ) == 0x0 00589 464 NtOpenKey (0x20019, {24, 76, 0x40, 0, 0, (0x20019, {24, 76, 0x40, 0, 0, "000000000007"}, ... 80, ) }, ... 80, ) == 0x0 00590 464 NtQueryValueKey (80, (80, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW 00591 464 NtQueryValueKey (80, (80, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW 00592 464 NtQueryValueKey (80, (80, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\16\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\23\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\5\0\0\0\373\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\0F\0C\0C\00\03\0A\04\01\0-\08\0C\0C\0C\0-\04\09\01\09\0-\0A\0\0\0\0\0\204\3\0\0Q\2\0\0\14\4\0\0\320\1\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0P\0\0\0Q\2\0\0\14\4\0\0\320\1\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0R\2\0\0\14\4\0\0\320\1\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0L\0\0\0L\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\310r\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\00\08\0R\2\0\0\14\4\0\0\320\1\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0P\0\0\0S\2\0\0\14\4\0\0\320\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0P\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0S\2\0\0\14\4\0\0\320\1\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0T\2\0\0\14\4\0\0\320\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0P\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) , Partial, 900, ... TitleIdx=0, Type=3, Data= (80, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\16\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\23\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\5\0\0\0\373\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\0F\0C\0C\00\03\0A\04\01\0-\08\0C\0C\0C\0-\04\09\01\09\0-\0A\0\0\0\0\0\204\3\0\0Q\2\0\0\14\4\0\0\320\1\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0P\0\0\0Q\2\0\0\14\4\0\0\320\1\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0R\2\0\0\14\4\0\0\320\1\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0L\0\0\0L\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\310r\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\00\08\0R\2\0\0\14\4\0\0\320\1\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0P\0\0\0S\2\0\0\14\4\0\0\320\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0P\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0S\2\0\0\14\4\0\0\320\1\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0T\2\0\0\14\4\0\0\320\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0P\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) \0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0S\2\0\0\14\4\0\0\320\1\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0T\2\0\0\14\4\0\0\320\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0P\0\0\0\0\0\0\0 (80, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\16\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\23\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\5\0\0\0\373\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\0F\0C\0C\00\03\0A\04\01\0-\08\0C\0C\0C\0-\04\09\01\09\0-\0A\0\0\0\0\0\204\3\0\0Q\2\0\0\14\4\0\0\320\1\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0P\0\0\0Q\2\0\0\14\4\0\0\320\1\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0R\2\0\0\14\4\0\0\320\1\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0L\0\0\0L\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\310r\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\00\08\0R\2\0\0\14\4\0\0\320\1\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0P\0\0\0S\2\0\0\14\4\0\0\320\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0P\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0S\2\0\0\14\4\0\0\320\1\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0T\2\0\0\14\4\0\0\320\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0P\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) }, 900, ) == 0x0 00593 464 NtClose (80, ... ) == 0x0 00594 464 NtOpenKey (0x20019, {24, 76, 0x40, 0, 0, (0x20019, {24, 76, 0x40, 0, 0, "000000000008"}, ... 80, ) }, ... 80, ) == 0x0 00595 464 NtQueryValueKey (80, (80, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW 00596 464 NtQueryValueKey (80, (80, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW 00597 464 NtQueryValueKey (80, (80, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\11\2\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\24\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\2\0\0\0\373\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\0F\0C\0C\00\03\0A\04\01\0-\08\0C\0C\0C\0-\04\09\01\09\0-\0A\0\0\0\0\0\204\3\0\0V\2\0\0\14\4\0\0\320\1\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0P\0\0\0V\2\0\0\14\4\0\0\320\1\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0W\2\0\0\14\4\0\0\320\1\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0L\0\0\0L\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\310r\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\00\09\0W\2\0\0\14\4\0\0\320\1\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0P\0\0\0X\2\0\0\14\4\0\0\320\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0P\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0X\2\0\0\14\4\0\0\320\1\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0Y\2\0\0\14\4\0\0\320\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0P\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) , Partial, 900, ... TitleIdx=0, Type=3, Data= (80, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\11\2\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\24\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\2\0\0\0\373\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\0F\0C\0C\00\03\0A\04\01\0-\08\0C\0C\0C\0-\04\09\01\09\0-\0A\0\0\0\0\0\204\3\0\0V\2\0\0\14\4\0\0\320\1\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0P\0\0\0V\2\0\0\14\4\0\0\320\1\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0W\2\0\0\14\4\0\0\320\1\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0L\0\0\0L\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\310r\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\00\09\0W\2\0\0\14\4\0\0\320\1\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0P\0\0\0X\2\0\0\14\4\0\0\320\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0P\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0X\2\0\0\14\4\0\0\320\1\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0Y\2\0\0\14\4\0\0\320\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0P\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) \0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0X\2\0\0\14\4\0\0\320\1\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0Y\2\0\0\14\4\0\0\320\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0P\0\0\0\0\0\0\0 (80, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\11\2\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\24\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\2\0\0\0\373\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\0F\0C\0C\00\03\0A\04\01\0-\08\0C\0C\0C\0-\04\09\01\09\0-\0A\0\0\0\0\0\204\3\0\0V\2\0\0\14\4\0\0\320\1\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0P\0\0\0V\2\0\0\14\4\0\0\320\1\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0W\2\0\0\14\4\0\0\320\1\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0L\0\0\0L\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\310r\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\00\09\0W\2\0\0\14\4\0\0\320\1\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0P\0\0\0X\2\0\0\14\4\0\0\320\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0P\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0X\2\0\0\14\4\0\0\320\1\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0Y\2\0\0\14\4\0\0\320\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0P\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) }, 900, ) == 0x0 00598 464 NtClose (80, ... ) == 0x0 00599 464 NtOpenKey (0x20019, {24, 76, 0x40, 0, 0, (0x20019, {24, 76, 0x40, 0, 0, "000000000009"}, ... 80, ) }, ... 80, ) == 0x0 00600 464 NtQueryValueKey (80, (80, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW 00601 464 NtQueryValueKey (80, (80, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW 00602 464 NtQueryValueKey (80, (80, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\16\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\25\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\5\0\0\0\374\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\0A\0E\07\04\02\01\0B\05\0-\07\03\02\0D\0-\04\05\06\07\0-\0A\0\0\0\0\0\204\3\0\0[\2\0\0\14\4\0\0\320\1\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0P\0\0\0[\2\0\0\14\4\0\0\320\1\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\\2\0\0\14\4\0\0\320\1\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0L\0\0\0L\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\310r\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\01\00\0\\2\0\0\14\4\0\0\320\1\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0P\0\0\0]\2\0\0\14\4\0\0\320\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0P\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0]\2\0\0\14\4\0\0\320\1\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0^\2\0\0\14\4\0\0\320\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0P\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) , Partial, 900, ... TitleIdx=0, Type=3, Data= (80, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\16\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\25\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\5\0\0\0\374\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\0A\0E\07\04\02\01\0B\05\0-\07\03\02\0D\0-\04\05\06\07\0-\0A\0\0\0\0\0\204\3\0\0[\2\0\0\14\4\0\0\320\1\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0P\0\0\0[\2\0\0\14\4\0\0\320\1\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\\2\0\0\14\4\0\0\320\1\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0L\0\0\0L\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\310r\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\01\00\0\\2\0\0\14\4\0\0\320\1\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0P\0\0\0]\2\0\0\14\4\0\0\320\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0P\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0]\2\0\0\14\4\0\0\320\1\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0^\2\0\0\14\4\0\0\320\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0P\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) \0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0]\2\0\0\14\4\0\0\320\1\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0^\2\0\0\14\4\0\0\320\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0P\0\0\0\0\0\0\0 (80, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\16\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\25\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\5\0\0\0\374\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\0A\0E\07\04\02\01\0B\05\0-\07\03\02\0D\0-\04\05\06\07\0-\0A\0\0\0\0\0\204\3\0\0[\2\0\0\14\4\0\0\320\1\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0P\0\0\0[\2\0\0\14\4\0\0\320\1\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\\2\0\0\14\4\0\0\320\1\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0L\0\0\0L\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\310r\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\01\00\0\\2\0\0\14\4\0\0\320\1\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0P\0\0\0]\2\0\0\14\4\0\0\320\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0P\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0]\2\0\0\14\4\0\0\320\1\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0^\2\0\0\14\4\0\0\320\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0P\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) }, 900, ) == 0x0 00603 464 NtClose (80, ... ) == 0x0 00604 464 NtOpenKey (0x20019, {24, 76, 0x40, 0, 0, (0x20019, {24, 76, 0x40, 0, 0, "000000000010"}, ... 80, ) }, ... 80, ) == 0x0 00605 464 NtQueryValueKey (80, (80, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW 00606 464 NtQueryValueKey (80, (80, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW 00607 464 NtAllocateVirtualMemory (-1, 1351680, 0, 4096, 4096, 4, ... 1351680, 4096, ) == 0x0 00608 464 NtQueryValueKey (80, (80, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\11\2\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\26\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\2\0\0\0\374\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\0A\0E\07\04\02\01\0B\05\0-\07\03\02\0D\0-\04\05\06\07\0-\0A\0\0\0\0\0\204\3\0\0a\2\0\0\14\4\0\0\320\1\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0P\0\0\0a\2\0\0\14\4\0\0\320\1\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0b\2\0\0\14\4\0\0\320\1\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0L\0\0\0L\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\310r\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\01\01\0b\2\0\0\14\4\0\0\320\1\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0P\0\0\0c\2\0\0\14\4\0\0\320\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0P\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0c\2\0\0\14\4\0\0\320\1\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0d\2\0\0\14\4\0\0\320\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0P\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) , Partial, 900, ... TitleIdx=0, Type=3, Data= (80, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\11\2\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\26\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\2\0\0\0\374\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\0A\0E\07\04\02\01\0B\05\0-\07\03\02\0D\0-\04\05\06\07\0-\0A\0\0\0\0\0\204\3\0\0a\2\0\0\14\4\0\0\320\1\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0P\0\0\0a\2\0\0\14\4\0\0\320\1\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0b\2\0\0\14\4\0\0\320\1\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0L\0\0\0L\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\310r\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\01\01\0b\2\0\0\14\4\0\0\320\1\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0P\0\0\0c\2\0\0\14\4\0\0\320\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0P\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0c\2\0\0\14\4\0\0\320\1\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0d\2\0\0\14\4\0\0\320\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0P\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) \0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0c\2\0\0\14\4\0\0\320\1\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0d\2\0\0\14\4\0\0\320\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0P\0\0\0\0\0\0\0 (80, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\11\2\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\26\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\2\0\0\0\374\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\0A\0E\07\04\02\01\0B\05\0-\07\03\02\0D\0-\04\05\06\07\0-\0A\0\0\0\0\0\204\3\0\0a\2\0\0\14\4\0\0\320\1\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0P\0\0\0a\2\0\0\14\4\0\0\320\1\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0b\2\0\0\14\4\0\0\320\1\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0L\0\0\0L\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\310r\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\01\01\0b\2\0\0\14\4\0\0\320\1\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0P\0\0\0c\2\0\0\14\4\0\0\320\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0P\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0c\2\0\0\14\4\0\0\320\1\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0d\2\0\0\14\4\0\0\320\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0P\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) }, 900, ) == 0x0 00609 464 NtClose (80, ... ) == 0x0 00610 464 NtOpenKey (0x20019, {24, 76, 0x40, 0, 0, (0x20019, {24, 76, 0x40, 0, 0, "000000000011"}, ... 80, ) }, ... 80, ) == 0x0 00611 464 NtQueryValueKey (80, (80, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW 00612 464 NtQueryValueKey (80, (80, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW 00613 464 NtQueryValueKey (80, (80, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\16\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\27\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\5\0\0\0\375\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\09\07\0C\02\0D\09\0F\04\0-\06\09\05\04\0-\04\0E\0B\03\0-\08\0\0\0\0\0\204\3\0\0f\2\0\0\14\4\0\0\320\1\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0P\0\0\0f\2\0\0\14\4\0\0\320\1\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0g\2\0\0\14\4\0\0\320\1\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0L\0\0\0L\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\310r\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\01\02\0g\2\0\0\14\4\0\0\320\1\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0P\0\0\0h\2\0\0\14\4\0\0\320\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0P\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0h\2\0\0\14\4\0\0\320\1\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0i\2\0\0\14\4\0\0\320\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0P\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) , Partial, 900, ... TitleIdx=0, Type=3, Data= (80, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\16\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\27\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\5\0\0\0\375\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\09\07\0C\02\0D\09\0F\04\0-\06\09\05\04\0-\04\0E\0B\03\0-\08\0\0\0\0\0\204\3\0\0f\2\0\0\14\4\0\0\320\1\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0P\0\0\0f\2\0\0\14\4\0\0\320\1\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0g\2\0\0\14\4\0\0\320\1\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0L\0\0\0L\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\310r\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\01\02\0g\2\0\0\14\4\0\0\320\1\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0P\0\0\0h\2\0\0\14\4\0\0\320\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0P\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0h\2\0\0\14\4\0\0\320\1\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0i\2\0\0\14\4\0\0\320\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0P\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) \0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0h\2\0\0\14\4\0\0\320\1\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0i\2\0\0\14\4\0\0\320\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0P\0\0\0\0\0\0\0 (80, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\16\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\27\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\5\0\0\0\375\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\09\07\0C\02\0D\09\0F\04\0-\06\09\05\04\0-\04\0E\0B\03\0-\08\0\0\0\0\0\204\3\0\0f\2\0\0\14\4\0\0\320\1\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0P\0\0\0f\2\0\0\14\4\0\0\320\1\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0g\2\0\0\14\4\0\0\320\1\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0L\0\0\0L\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\310r\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\01\02\0g\2\0\0\14\4\0\0\320\1\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0P\0\0\0h\2\0\0\14\4\0\0\320\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0P\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0h\2\0\0\14\4\0\0\320\1\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0i\2\0\0\14\4\0\0\320\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0P\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) }, 900, ) == 0x0 00614 464 NtClose (80, ... ) == 0x0 00615 464 NtOpenKey (0x20019, {24, 76, 0x40, 0, 0, (0x20019, {24, 76, 0x40, 0, 0, "000000000012"}, ... 80, ) }, ... 80, ) == 0x0 00616 464 NtQueryValueKey (80, (80, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW 00617 464 NtQueryValueKey (80, (80, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW 00618 464 NtQueryValueKey (80, (80, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\11\2\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\30\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\2\0\0\0\375\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\09\07\0C\02\0D\09\0F\04\0-\06\09\05\04\0-\04\0E\0B\03\0-\08\0\0\0\0\0\204\3\0\0k\2\0\0\14\4\0\0\320\1\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0P\0\0\0k\2\0\0\14\4\0\0\320\1\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0l\2\0\0\14\4\0\0\320\1\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0L\0\0\0L\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\310r\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\01\03\0l\2\0\0\14\4\0\0\320\1\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0P\0\0\0m\2\0\0\14\4\0\0\320\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0P\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0m\2\0\0\14\4\0\0\320\1\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0n\2\0\0\14\4\0\0\320\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0P\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) , Partial, 900, ... TitleIdx=0, Type=3, Data= (80, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\11\2\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\30\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\2\0\0\0\375\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\09\07\0C\02\0D\09\0F\04\0-\06\09\05\04\0-\04\0E\0B\03\0-\08\0\0\0\0\0\204\3\0\0k\2\0\0\14\4\0\0\320\1\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0P\0\0\0k\2\0\0\14\4\0\0\320\1\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0l\2\0\0\14\4\0\0\320\1\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0L\0\0\0L\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\310r\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\01\03\0l\2\0\0\14\4\0\0\320\1\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0P\0\0\0m\2\0\0\14\4\0\0\320\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0P\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0m\2\0\0\14\4\0\0\320\1\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0n\2\0\0\14\4\0\0\320\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0P\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) \0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0m\2\0\0\14\4\0\0\320\1\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0n\2\0\0\14\4\0\0\320\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0P\0\0\0\0\0\0\0 (80, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\11\2\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\30\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\2\0\0\0\375\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\09\07\0C\02\0D\09\0F\04\0-\06\09\05\04\0-\04\0E\0B\03\0-\08\0\0\0\0\0\204\3\0\0k\2\0\0\14\4\0\0\320\1\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0P\0\0\0k\2\0\0\14\4\0\0\320\1\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0l\2\0\0\14\4\0\0\320\1\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0L\0\0\0L\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\310r\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\01\03\0l\2\0\0\14\4\0\0\320\1\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0P\0\0\0m\2\0\0\14\4\0\0\320\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0P\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0m\2\0\0\14\4\0\0\320\1\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0n\2\0\0\14\4\0\0\320\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0P\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) }, 900, ) == 0x0 00619 464 NtClose (80, ... ) == 0x0 00620 464 NtOpenKey (0x20019, {24, 76, 0x40, 0, 0, (0x20019, {24, 76, 0x40, 0, 0, "000000000013"}, ... 80, ) }, ... 80, ) == 0x0 00621 464 NtQueryValueKey (80, (80, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW 00622 464 NtQueryValueKey (80, (80, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW 00623 464 NtQueryValueKey (80, (80, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\16\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\10\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\31\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\5\0\0\0\0\0\0\200\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\00\0D\04\03\00\0A\06\0F\0-\00\04\01\00\0-\04\0A\06\08\0-\09\0\0\0\0\0\204\3\0\0p\2\0\0\14\4\0\0\320\1\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0P\0\0\0p\2\0\0\14\4\0\0\320\1\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0q\2\0\0\14\4\0\0\320\1\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0L\0\0\0L\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\310r\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\01\04\0q\2\0\0\14\4\0\0\320\1\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0P\0\0\0r\2\0\0\14\4\0\0\320\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0P\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0r\2\0\0\14\4\0\0\320\1\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0s\2\0\0\14\4\0\0\320\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0P\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) , Partial, 900, ... TitleIdx=0, Type=3, Data= (80, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\16\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\10\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\31\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\5\0\0\0\0\0\0\200\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\00\0D\04\03\00\0A\06\0F\0-\00\04\01\00\0-\04\0A\06\08\0-\09\0\0\0\0\0\204\3\0\0p\2\0\0\14\4\0\0\320\1\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0P\0\0\0p\2\0\0\14\4\0\0\320\1\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0q\2\0\0\14\4\0\0\320\1\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0L\0\0\0L\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\310r\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\01\04\0q\2\0\0\14\4\0\0\320\1\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0P\0\0\0r\2\0\0\14\4\0\0\320\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0P\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0r\2\0\0\14\4\0\0\320\1\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0s\2\0\0\14\4\0\0\320\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0P\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) \0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0r\2\0\0\14\4\0\0\320\1\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0s\2\0\0\14\4\0\0\320\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0P\0\0\0\0\0\0\0 (80, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\16\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\10\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\31\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\5\0\0\0\0\0\0\200\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\00\0D\04\03\00\0A\06\0F\0-\00\04\01\00\0-\04\0A\06\08\0-\09\0\0\0\0\0\204\3\0\0p\2\0\0\14\4\0\0\320\1\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0P\0\0\0p\2\0\0\14\4\0\0\320\1\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0q\2\0\0\14\4\0\0\320\1\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0L\0\0\0L\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\310r\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\01\04\0q\2\0\0\14\4\0\0\320\1\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0P\0\0\0r\2\0\0\14\4\0\0\320\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0P\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0r\2\0\0\14\4\0\0\320\1\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0s\2\0\0\14\4\0\0\320\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0P\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) }, 900, ) == 0x0 00624 464 NtClose (80, ... ) == 0x0 00625 464 NtOpenKey (0x20019, {24, 76, 0x40, 0, 0, (0x20019, {24, 76, 0x40, 0, 0, "000000000014"}, ... 80, ) }, ... 80, ) == 0x0 00626 464 NtQueryValueKey (80, (80, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW 00627 464 NtQueryValueKey (80, (80, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW 00628 464 NtAllocateVirtualMemory (-1, 1355776, 0, 4096, 4096, 4, ... 1355776, 4096, ) == 0x0 00629 464 NtQueryValueKey (80, (80, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\11\2\2\0\0\0\0\0\0\0\0\0\0\0\0\0\10\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\32\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\2\0\0\0\0\0\0\200\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\00\0D\04\03\00\0A\06\0F\0-\00\04\01\00\0-\04\0A\06\08\0-\09\0\0\0\0\0\204\3\0\0v\2\0\0\14\4\0\0\320\1\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0P\0\0\0v\2\0\0\14\4\0\0\320\1\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0w\2\0\0\14\4\0\0\320\1\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0L\0\0\0L\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\310r\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\01\05\0w\2\0\0\14\4\0\0\320\1\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0P\0\0\0x\2\0\0\14\4\0\0\320\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0P\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0x\2\0\0\14\4\0\0\320\1\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0y\2\0\0\14\4\0\0\320\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0P\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) , Partial, 900, ... TitleIdx=0, Type=3, Data= (80, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\11\2\2\0\0\0\0\0\0\0\0\0\0\0\0\0\10\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\32\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\2\0\0\0\0\0\0\200\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\00\0D\04\03\00\0A\06\0F\0-\00\04\01\00\0-\04\0A\06\08\0-\09\0\0\0\0\0\204\3\0\0v\2\0\0\14\4\0\0\320\1\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0P\0\0\0v\2\0\0\14\4\0\0\320\1\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0w\2\0\0\14\4\0\0\320\1\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0L\0\0\0L\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\310r\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\01\05\0w\2\0\0\14\4\0\0\320\1\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0P\0\0\0x\2\0\0\14\4\0\0\320\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0P\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0x\2\0\0\14\4\0\0\320\1\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0y\2\0\0\14\4\0\0\320\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0P\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) \0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0x\2\0\0\14\4\0\0\320\1\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0y\2\0\0\14\4\0\0\320\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0P\0\0\0\0\0\0\0 (80, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\11\2\2\0\0\0\0\0\0\0\0\0\0\0\0\0\10\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\32\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\2\0\0\0\0\0\0\200\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\00\0D\04\03\00\0A\06\0F\0-\00\04\01\00\0-\04\0A\06\08\0-\09\0\0\0\0\0\204\3\0\0v\2\0\0\14\4\0\0\320\1\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0P\0\0\0v\2\0\0\14\4\0\0\320\1\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0w\2\0\0\14\4\0\0\320\1\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0L\0\0\0L\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\310r\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\01\05\0w\2\0\0\14\4\0\0\320\1\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0P\0\0\0x\2\0\0\14\4\0\0\320\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0P\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0x\2\0\0\14\4\0\0\320\1\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0y\2\0\0\14\4\0\0\320\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0P\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) }, 900, ) == 0x0 00630 464 NtClose (80, ... ) == 0x0 00631 464 NtOpenKey (0x20019, {24, 76, 0x40, 0, 0, (0x20019, {24, 76, 0x40, 0, 0, "000000000015"}, ... 80, ) }, ... 80, ) == 0x0 00632 464 NtQueryValueKey (80, (80, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW 00633 464 NtQueryValueKey (80, (80, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW 00634 464 NtQueryValueKey (80, (80, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\16\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\33\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\5\0\0\0\377\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\08\0A\0D\04\0D\08\00\06\0-\00\08\01\0B\0-\04\04\04\06\0-\0A\0\0\0\0\0\204\3\0\0{\2\0\0\14\4\0\0\320\1\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0P\0\0\0{\2\0\0\14\4\0\0\320\1\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0|\2\0\0\14\4\0\0\320\1\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0L\0\0\0L\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\310r\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\01\06\0|\2\0\0\14\4\0\0\320\1\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0P\0\0\0}\2\0\0\14\4\0\0\320\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0P\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0}\2\0\0\14\4\0\0\320\1\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0~\2\0\0\14\4\0\0\320\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0P\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) , Partial, 900, ... TitleIdx=0, Type=3, Data= (80, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\16\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\33\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\5\0\0\0\377\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\08\0A\0D\04\0D\08\00\06\0-\00\08\01\0B\0-\04\04\04\06\0-\0A\0\0\0\0\0\204\3\0\0{\2\0\0\14\4\0\0\320\1\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0P\0\0\0{\2\0\0\14\4\0\0\320\1\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0|\2\0\0\14\4\0\0\320\1\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0L\0\0\0L\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\310r\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\01\06\0|\2\0\0\14\4\0\0\320\1\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0P\0\0\0}\2\0\0\14\4\0\0\320\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0P\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0}\2\0\0\14\4\0\0\320\1\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0~\2\0\0\14\4\0\0\320\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0P\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) \0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0}\2\0\0\14\4\0\0\320\1\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0~\2\0\0\14\4\0\0\320\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0P\0\0\0\0\0\0\0 (80, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\16\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\33\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\5\0\0\0\377\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\08\0A\0D\04\0D\08\00\06\0-\00\08\01\0B\0-\04\04\04\06\0-\0A\0\0\0\0\0\204\3\0\0{\2\0\0\14\4\0\0\320\1\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0P\0\0\0{\2\0\0\14\4\0\0\320\1\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0|\2\0\0\14\4\0\0\320\1\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0L\0\0\0L\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\310r\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\01\06\0|\2\0\0\14\4\0\0\320\1\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0P\0\0\0}\2\0\0\14\4\0\0\320\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0P\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0}\2\0\0\14\4\0\0\320\1\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0~\2\0\0\14\4\0\0\320\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0P\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) }, 900, ) == 0x0 00635 464 NtClose (80, ... ) == 0x0 00636 464 NtOpenKey (0x20019, {24, 76, 0x40, 0, 0, (0x20019, {24, 76, 0x40, 0, 0, "000000000016"}, ... 80, ) }, ... 80, ) == 0x0 00637 464 NtQueryValueKey (80, (80, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW 00638 464 NtQueryValueKey (80, (80, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW 00639 464 NtQueryValueKey (80, (80, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\11\2\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\34\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\2\0\0\0\377\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\08\0A\0D\04\0D\08\00\06\0-\00\08\01\0B\0-\04\04\04\06\0-\0A\0\0\0\0\0\204\3\0\0\200\2\0\0\14\4\0\0\320\1\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0P\0\0\0\200\2\0\0\14\4\0\0\320\1\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\201\2\0\0\14\4\0\0\320\1\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0L\0\0\0L\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\310r\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\01\07\0\201\2\0\0\14\4\0\0\320\1\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0P\0\0\0\202\2\0\0\14\4\0\0\320\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0P\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\202\2\0\0\14\4\0\0\320\1\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\203\2\0\0\14\4\0\0\320\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0P\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) , Partial, 900, ... TitleIdx=0, Type=3, Data= (80, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\11\2\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\34\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\2\0\0\0\377\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\08\0A\0D\04\0D\08\00\06\0-\00\08\01\0B\0-\04\04\04\06\0-\0A\0\0\0\0\0\204\3\0\0\200\2\0\0\14\4\0\0\320\1\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0P\0\0\0\200\2\0\0\14\4\0\0\320\1\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\201\2\0\0\14\4\0\0\320\1\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0L\0\0\0L\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\310r\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\01\07\0\201\2\0\0\14\4\0\0\320\1\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0P\0\0\0\202\2\0\0\14\4\0\0\320\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0P\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\202\2\0\0\14\4\0\0\320\1\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\203\2\0\0\14\4\0\0\320\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0P\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) \0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\202\2\0\0\14\4\0\0\320\1\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\203\2\0\0\14\4\0\0\320\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0P\0\0\0\0\0\0\0 (80, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\11\2\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\34\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\2\0\0\0\377\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\08\0A\0D\04\0D\08\00\06\0-\00\08\01\0B\0-\04\04\04\06\0-\0A\0\0\0\0\0\204\3\0\0\200\2\0\0\14\4\0\0\320\1\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0P\0\0\0\200\2\0\0\14\4\0\0\320\1\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\201\2\0\0\14\4\0\0\320\1\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0L\0\0\0L\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\310r\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\01\07\0\201\2\0\0\14\4\0\0\320\1\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0P\0\0\0\202\2\0\0\14\4\0\0\320\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0P\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\202\2\0\0\14\4\0\0\320\1\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\203\2\0\0\14\4\0\0\320\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0P\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) }, 900, ) == 0x0 00640 464 NtClose (80, ... ) == 0x0 00641 464 NtOpenKey (0x20019, {24, 76, 0x40, 0, 0, (0x20019, {24, 76, 0x40, 0, 0, "000000000017"}, ... 80, ) }, ... 80, ) == 0x0 00642 464 NtQueryValueKey (80, (80, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW 00643 464 NtQueryValueKey (80, (80, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW 00644 464 NtQueryValueKey (80, (80, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\16\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\35\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\5\0\0\0\376\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\0E\05\05\09\0B\00\0C\01\0-\0F\0A\04\06\0-\04\06\04\0D\0-\0B\0\0\0\0\0\204\3\0\0\205\2\0\0\14\4\0\0\320\1\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0P\0\0\0\205\2\0\0\14\4\0\0\320\1\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\206\2\0\0\14\4\0\0\320\1\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0L\0\0\0L\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\310r\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\01\08\0\206\2\0\0\14\4\0\0\320\1\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0P\0\0\0\207\2\0\0\14\4\0\0\320\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0P\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\207\2\0\0\14\4\0\0\320\1\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\210\2\0\0\14\4\0\0\320\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0P\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) , Partial, 900, ... TitleIdx=0, Type=3, Data= (80, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\16\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\35\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\5\0\0\0\376\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\0E\05\05\09\0B\00\0C\01\0-\0F\0A\04\06\0-\04\06\04\0D\0-\0B\0\0\0\0\0\204\3\0\0\205\2\0\0\14\4\0\0\320\1\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0P\0\0\0\205\2\0\0\14\4\0\0\320\1\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\206\2\0\0\14\4\0\0\320\1\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0L\0\0\0L\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\310r\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\01\08\0\206\2\0\0\14\4\0\0\320\1\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0P\0\0\0\207\2\0\0\14\4\0\0\320\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0P\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\207\2\0\0\14\4\0\0\320\1\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\210\2\0\0\14\4\0\0\320\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0P\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) \0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\207\2\0\0\14\4\0\0\320\1\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\210\2\0\0\14\4\0\0\320\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0P\0\0\0\0\0\0\0 (80, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\16\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\35\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\5\0\0\0\376\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\0E\05\05\09\0B\00\0C\01\0-\0F\0A\04\06\0-\04\06\04\0D\0-\0B\0\0\0\0\0\204\3\0\0\205\2\0\0\14\4\0\0\320\1\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0P\0\0\0\205\2\0\0\14\4\0\0\320\1\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\206\2\0\0\14\4\0\0\320\1\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0L\0\0\0L\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\310r\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\01\08\0\206\2\0\0\14\4\0\0\320\1\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0P\0\0\0\207\2\0\0\14\4\0\0\320\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0P\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\207\2\0\0\14\4\0\0\320\1\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\210\2\0\0\14\4\0\0\320\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0P\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) }, 900, ) == 0x0 00645 464 NtClose (80, ... ) == 0x0 00646 464 NtOpenKey (0x20019, {24, 76, 0x40, 0, 0, (0x20019, {24, 76, 0x40, 0, 0, "000000000018"}, ... 80, ) }, ... 80, ) == 0x0 00647 464 NtQueryValueKey (80, (80, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW 00648 464 NtQueryValueKey (80, (80, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW 00649 464 NtQueryValueKey (80, (80, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\11\2\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\36\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\2\0\0\0\376\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\0E\05\05\09\0B\00\0C\01\0-\0F\0A\04\06\0-\04\06\04\0D\0-\0B\0\0\0\0\0\204\3\0\0\212\2\0\0\14\4\0\0\320\1\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0P\0\0\0\212\2\0\0\14\4\0\0\320\1\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\213\2\0\0\14\4\0\0\320\1\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0L\0\0\0L\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\310r\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\01\09\0\213\2\0\0\14\4\0\0\320\1\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0P\0\0\0\214\2\0\0\14\4\0\0\320\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0P\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\214\2\0\0\14\4\0\0\320\1\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\215\2\0\0\14\4\0\0\320\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0P\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) , Partial, 900, ... TitleIdx=0, Type=3, Data= (80, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\11\2\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\36\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\2\0\0\0\376\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\0E\05\05\09\0B\00\0C\01\0-\0F\0A\04\06\0-\04\06\04\0D\0-\0B\0\0\0\0\0\204\3\0\0\212\2\0\0\14\4\0\0\320\1\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0P\0\0\0\212\2\0\0\14\4\0\0\320\1\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\213\2\0\0\14\4\0\0\320\1\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0L\0\0\0L\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\310r\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\01\09\0\213\2\0\0\14\4\0\0\320\1\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0P\0\0\0\214\2\0\0\14\4\0\0\320\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0P\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\214\2\0\0\14\4\0\0\320\1\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\215\2\0\0\14\4\0\0\320\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0P\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) \0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\214\2\0\0\14\4\0\0\320\1\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\215\2\0\0\14\4\0\0\320\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0P\0\0\0\0\0\0\0 (80, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\11\2\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\36\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\2\0\0\0\376\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\0E\05\05\09\0B\00\0C\01\0-\0F\0A\04\06\0-\04\06\04\0D\0-\0B\0\0\0\0\0\204\3\0\0\212\2\0\0\14\4\0\0\320\1\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0P\0\0\0\212\2\0\0\14\4\0\0\320\1\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\213\2\0\0\14\4\0\0\320\1\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0L\0\0\0L\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\310r\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\01\09\0\213\2\0\0\14\4\0\0\320\1\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0P\0\0\0\214\2\0\0\14\4\0\0\320\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0P\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\214\2\0\0\14\4\0\0\320\1\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\215\2\0\0\14\4\0\0\320\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0P\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) }, 900, ) == 0x0 00650 464 NtClose (80, ... ) == 0x0 00651 464 NtOpenKey (0x20019, {24, 76, 0x40, 0, 0, (0x20019, {24, 76, 0x40, 0, 0, "000000000019"}, ... 80, ) }, ... 80, ) == 0x0 00652 464 NtQueryValueKey (80, (80, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW 00653 464 NtQueryValueKey (80, (80, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW 00654 464 NtAllocateVirtualMemory (-1, 1359872, 0, 4096, 4096, 4, ... 1359872, 4096, ) == 0x0 00655 464 NtQueryValueKey (80, (80, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\16\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\37\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\5\0\0\0\372\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\0C\0D\03\0C\06\04\0B\08\0-\0D\0B\07\06\0-\04\04\0C\08\0-\09\0\0\0\0\0\204\3\0\0\220\2\0\0\14\4\0\0\320\1\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0P\0\0\0\220\2\0\0\14\4\0\0\320\1\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\221\2\0\0\14\4\0\0\320\1\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0L\0\0\0L\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\310r\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\02\00\0\221\2\0\0\14\4\0\0\320\1\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0P\0\0\0\222\2\0\0\14\4\0\0\320\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0P\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\222\2\0\0\14\4\0\0\320\1\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\223\2\0\0\14\4\0\0\320\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0P\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) , Partial, 900, ... TitleIdx=0, Type=3, Data= (80, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\16\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\37\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\5\0\0\0\372\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\0C\0D\03\0C\06\04\0B\08\0-\0D\0B\07\06\0-\04\04\0C\08\0-\09\0\0\0\0\0\204\3\0\0\220\2\0\0\14\4\0\0\320\1\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0P\0\0\0\220\2\0\0\14\4\0\0\320\1\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\221\2\0\0\14\4\0\0\320\1\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0L\0\0\0L\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\310r\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\02\00\0\221\2\0\0\14\4\0\0\320\1\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0P\0\0\0\222\2\0\0\14\4\0\0\320\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0P\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\222\2\0\0\14\4\0\0\320\1\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\223\2\0\0\14\4\0\0\320\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0P\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) \0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\222\2\0\0\14\4\0\0\320\1\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\223\2\0\0\14\4\0\0\320\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0P\0\0\0\0\0\0\0 (80, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\16\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\37\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\5\0\0\0\372\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\0C\0D\03\0C\06\04\0B\08\0-\0D\0B\07\06\0-\04\04\0C\08\0-\09\0\0\0\0\0\204\3\0\0\220\2\0\0\14\4\0\0\320\1\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0P\0\0\0\220\2\0\0\14\4\0\0\320\1\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\221\2\0\0\14\4\0\0\320\1\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0L\0\0\0L\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\310r\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\02\00\0\221\2\0\0\14\4\0\0\320\1\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0P\0\0\0\222\2\0\0\14\4\0\0\320\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0P\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\222\2\0\0\14\4\0\0\320\1\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\223\2\0\0\14\4\0\0\320\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0P\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) }, 900, ) == 0x0 00656 464 NtClose (80, ... ) == 0x0 00657 464 NtOpenKey (0x20019, {24, 76, 0x40, 0, 0, (0x20019, {24, 76, 0x40, 0, 0, "000000000020"}, ... 80, ) }, ... 80, ) == 0x0 00658 464 NtQueryValueKey (80, (80, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW 00659 464 NtQueryValueKey (80, (80, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW 00660 464 NtQueryValueKey (80, (80, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\11\2\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222 \4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\2\0\0\0\372\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\0C\0D\03\0C\06\04\0B\08\0-\0D\0B\07\06\0-\04\04\0C\08\0-\09\0\0\0\0\0\204\3\0\0\225\2\0\0\14\4\0\0\320\1\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0P\0\0\0\225\2\0\0\14\4\0\0\320\1\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\226\2\0\0\14\4\0\0\320\1\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0L\0\0\0L\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\310r\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\02\01\0\226\2\0\0\14\4\0\0\320\1\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0P\0\0\0\227\2\0\0\14\4\0\0\320\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0P\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\227\2\0\0\14\4\0\0\320\1\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\230\2\0\0\14\4\0\0\320\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0P\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) , Partial, 900, ... TitleIdx=0, Type=3, Data= (80, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\11\2\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222 \4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\2\0\0\0\372\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\0C\0D\03\0C\06\04\0B\08\0-\0D\0B\07\06\0-\04\04\0C\08\0-\09\0\0\0\0\0\204\3\0\0\225\2\0\0\14\4\0\0\320\1\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0P\0\0\0\225\2\0\0\14\4\0\0\320\1\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\226\2\0\0\14\4\0\0\320\1\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0L\0\0\0L\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\310r\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\02\01\0\226\2\0\0\14\4\0\0\320\1\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0P\0\0\0\227\2\0\0\14\4\0\0\320\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0P\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\227\2\0\0\14\4\0\0\320\1\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\230\2\0\0\14\4\0\0\320\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0P\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) \0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\227\2\0\0\14\4\0\0\320\1\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\230\2\0\0\14\4\0\0\320\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0P\0\0\0\0\0\0\0 (80, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\11\2\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222 \4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\2\0\0\0\372\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\0C\0D\03\0C\06\04\0B\08\0-\0D\0B\07\06\0-\04\04\0C\08\0-\09\0\0\0\0\0\204\3\0\0\225\2\0\0\14\4\0\0\320\1\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0P\0\0\0\225\2\0\0\14\4\0\0\320\1\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\226\2\0\0\14\4\0\0\320\1\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0L\0\0\0L\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\310r\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\02\01\0\226\2\0\0\14\4\0\0\320\1\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0P\0\0\0\227\2\0\0\14\4\0\0\320\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0P\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\227\2\0\0\14\4\0\0\320\1\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\230\2\0\0\14\4\0\0\320\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0P\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) }, 900, ) == 0x0 00661 464 NtClose (80, ... ) == 0x0 00662 464 NtOpenKey (0x20019, {24, 76, 0x40, 0, 0, (0x20019, {24, 76, 0x40, 0, 0, "000000000021"}, ... 80, ) }, ... 80, ) == 0x0 00663 464 NtQueryValueKey (80, (80, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW 00664 464 NtQueryValueKey (80, (80, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW 00665 464 NtQueryValueKey (80, (80, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\16\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222!\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\5\0\0\0\371\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\02\01\0B\08\0E\09\0D\05\0-\03\0F\0C\03\0-\04\0F\09\0D\0-\08\0\0\0\0\0\204\3\0\0\232\2\0\0\14\4\0\0\320\1\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0P\0\0\0\232\2\0\0\14\4\0\0\320\1\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\233\2\0\0\14\4\0\0\320\1\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0L\0\0\0L\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\310r\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\02\02\0\233\2\0\0\14\4\0\0\320\1\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0P\0\0\0\234\2\0\0\14\4\0\0\320\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0P\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\234\2\0\0\14\4\0\0\320\1\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\235\2\0\0\14\4\0\0\320\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0P\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) , Partial, 900, ... TitleIdx=0, Type=3, Data= (80, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\16\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222!\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\5\0\0\0\371\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\02\01\0B\08\0E\09\0D\05\0-\03\0F\0C\03\0-\04\0F\09\0D\0-\08\0\0\0\0\0\204\3\0\0\232\2\0\0\14\4\0\0\320\1\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0P\0\0\0\232\2\0\0\14\4\0\0\320\1\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\233\2\0\0\14\4\0\0\320\1\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0L\0\0\0L\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\310r\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\02\02\0\233\2\0\0\14\4\0\0\320\1\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0P\0\0\0\234\2\0\0\14\4\0\0\320\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0P\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\234\2\0\0\14\4\0\0\320\1\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\235\2\0\0\14\4\0\0\320\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0P\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) \0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\234\2\0\0\14\4\0\0\320\1\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\235\2\0\0\14\4\0\0\320\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0P\0\0\0\0\0\0\0 (80, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\16\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222!\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\5\0\0\0\371\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\02\01\0B\08\0E\09\0D\05\0-\03\0F\0C\03\0-\04\0F\09\0D\0-\08\0\0\0\0\0\204\3\0\0\232\2\0\0\14\4\0\0\320\1\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0P\0\0\0\232\2\0\0\14\4\0\0\320\1\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\233\2\0\0\14\4\0\0\320\1\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0L\0\0\0L\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\310r\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\02\02\0\233\2\0\0\14\4\0\0\320\1\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0P\0\0\0\234\2\0\0\14\4\0\0\320\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0P\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\234\2\0\0\14\4\0\0\320\1\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\235\2\0\0\14\4\0\0\320\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0P\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) }, 900, ) == 0x0 00666 464 NtClose (80, ... ) == 0x0 00667 464 NtOpenKey (0x20019, {24, 76, 0x40, 0, 0, (0x20019, {24, 76, 0x40, 0, 0, "000000000022"}, ... 80, ) }, ... 80, ) == 0x0 00668 464 NtQueryValueKey (80, (80, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW 00669 464 NtQueryValueKey (80, (80, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW 00670 464 NtQueryValueKey (80, (80, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\11\2\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222"\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\2\0\0\0\371\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\02\01\0B\08\0E\09\0D\05\0-\03\0F\0C\03\0-\04\0F\09\0D\0-\08\0\0\0\0\0\204\3\0\0\237\2\0\0\14\4\0\0\320\1\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0P\0\0\0\237\2\0\0\14\4\0\0\320\1\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\240\2\0\0\14\4\0\0\320\1\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0L\0\0\0\240\2\0\0\14\4\0\0\320\1\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\241\2\0\0\14\4\0\0\320\1\0\0\305\0\0\0\0\0\1\0\0\0\0\0\24\0\0\0D\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\241\2\0\0\14\4\0\0\320\1\0\0\305\0\0\0\1\0\1\0\2\1\0\0\0\0\0\0\242\2\0\0\14\4\0\0\320\1\0\0\25\0\0\0\0\0\1\0\0\0\0\0\24\0\0\0\3\0\37\0\377\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\242\2\0\0\14\4\0\0\320\1\0\0\25\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0L\0\0\0\243\2\0\0\14\4\0\0\320\1\0\0Q\0\0\0\0\0\1\0\0\0\0\0T\0\0\0\0\0\0\2\0\0\0\0\30\0\0\0@\0\0\0t\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0$\0&\0\230r\24\0\0\0\0\0N\0a\0m\0e\0S\0p\0a\0c\0e\0_\0C\0a\0t\0a\0l\0o\0g\05\0"}, 900, ) , Partial, 900, ... TitleIdx=0, Type=3, Data= (80, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\11\2\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222"\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\2\0\0\0\371\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\02\01\0B\08\0E\09\0D\05\0-\03\0F\0C\03\0-\04\0F\09\0D\0-\08\0\0\0\0\0\204\3\0\0\237\2\0\0\14\4\0\0\320\1\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0P\0\0\0\237\2\0\0\14\4\0\0\320\1\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\240\2\0\0\14\4\0\0\320\1\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0L\0\0\0\240\2\0\0\14\4\0\0\320\1\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\241\2\0\0\14\4\0\0\320\1\0\0\305\0\0\0\0\0\1\0\0\0\0\0\24\0\0\0D\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\241\2\0\0\14\4\0\0\320\1\0\0\305\0\0\0\1\0\1\0\2\1\0\0\0\0\0\0\242\2\0\0\14\4\0\0\320\1\0\0\25\0\0\0\0\0\1\0\0\0\0\0\24\0\0\0\3\0\37\0\377\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\242\2\0\0\14\4\0\0\320\1\0\0\25\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0L\0\0\0\243\2\0\0\14\4\0\0\320\1\0\0Q\0\0\0\0\0\1\0\0\0\0\0T\0\0\0\0\0\0\2\0\0\0\0\30\0\0\0@\0\0\0t\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0$\0&\0\230r\24\0\0\0\0\0N\0a\0m\0e\0S\0p\0a\0c\0e\0_\0C\0a\0t\0a\0l\0o\0g\05\0"}, 900, ) \4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\2\0\0\0\371\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\02\01\0B\08\0E\09\0D\05\0-\03\0F\0C\03\0-\04\0F\09\0D\0-\08\0\0\0\0\0\204\3\0\0\237\2\0\0\14\4\0\0\320\1\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0P\0\0\0\237\2\0\0\14\4\0\0\320\1\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\240\2\0\0\14\4\0\0\320\1\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0L\0\0\0\240\2\0\0\14\4\0\0\320\1\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\241\2\0\0\14\4\0\0\320\1\0\0\305\0\0\0\0\0\1\0\0\0\0\0\24\0\0\0D\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\241\2\0\0\14\4\0\0\320\1\0\0\305\0\0\0\1\0\1\0\2\1\0\0\0\0\0\0\242\2\0\0\14\4\0\0\320\1\0\0\25\0\0\0\0\0\1\0\0\0\0\0\24\0\0\0\3\0\37\0\377\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\242\2\0\0\14\4\0\0\320\1\0\0\25\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0L\0\0\0\243\2\0\0\14\4\0\0\320\1\0\0Q\0\0\0\0\0\1\0\0\0\0\0T\0\0\0\0\0\0\2\0\0\0\0\30\0\0\0@\0\0\0t\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0$\0&\0\230r\24\0\0\0\0\0N\0a\0m\0e\0S\0p\0a\0c\0e\0_\0C\0a\0t\0a\0l\0o\0g\05\0"}, 900, ) == 0x0 00671 464 NtClose (80, ... ) == 0x0 00672 464 NtClose (76, ... ) == 0x0 00673 464 NtWaitForSingleObject (68, 0, {0, 0}, ... ) == 0x102 00674 464 NtCreateEvent (0x1f0003, 0x0, 0, 0, ... 76, ) == 0x0 00675 464 NtOpenKey (0x2000000, {24, 64, 0x40, 0, 0, (0x2000000, {24, 64, 0x40, 0, 0, "NameSpace_Catalog5"}, ... 80, ) }, ... 80, ) == 0x0 00676 464 NtQueryValueKey (80, (80, "Serial_Access_Num", Partial, 144, ... TitleIdx=0, Type=4, Data="\5\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (80, "Serial_Access_Num", Partial, 144, ... TitleIdx=0, Type=4, Data="\5\0\0\0"}, 16, ) }, 16, ) == 0x0 00677 464 NtNotifyChangeKey (80, 76, 0, 0, 2011455960, 1, 0, 0, 0, 1, ... ) == 0x103 00678 464 NtQueryValueKey (80, (80, "Serial_Access_Num", Partial, 144, ... TitleIdx=0, Type=4, Data="\5\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (80, "Serial_Access_Num", Partial, 144, ... TitleIdx=0, Type=4, Data="\5\0\0\0"}, 16, ) }, 16, ) == 0x0 00679 464 NtOpenKey (0x2000000, {24, 80, 0x40, 0, 0, (0x2000000, {24, 80, 0x40, 0, 0, "00000005"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 00680 464 NtQueryValueKey (80, (80, "Num_Catalog_Entries", Partial, 144, ... TitleIdx=0, Type=4, Data="\4\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (80, "Num_Catalog_Entries", Partial, 144, ... TitleIdx=0, Type=4, Data="\4\0\0\0"}, 16, ) }, 16, ) == 0x0 00681 464 NtOpenKey (0x2000000, {24, 80, 0x40, 0, 0, (0x2000000, {24, 80, 0x40, 0, 0, "Catalog_Entries"}, ... 84, ) }, ... 84, ) == 0x0 00682 464 NtOpenKey (0x20019, {24, 84, 0x40, 0, 0, (0x20019, {24, 84, 0x40, 0, 0, "000000000001"}, ... 88, ) }, ... 88, ) == 0x0 00683 464 NtQueryValueKey (88, (88, "LibraryPath", Partial, 144, ... TitleIdx=0, Type=1, Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0m\0s\0w\0s\0o\0c\0k\0.\0d\0l\0l\0\0\0"}, 80, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (88, "LibraryPath", Partial, 144, ... TitleIdx=0, Type=1, Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0m\0s\0w\0s\0o\0c\0k\0.\0d\0l\0l\0\0\0"}, 80, ) }, 80, ) == 0x0 00684 464 NtQueryValueKey (88, (88, "LibraryPath", Partial, 144, ... TitleIdx=0, Type=1, Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0m\0s\0w\0s\0o\0c\0k\0.\0d\0l\0l\0\0\0"}, 80, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (88, "LibraryPath", Partial, 144, ... TitleIdx=0, Type=1, Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0m\0s\0w\0s\0o\0c\0k\0.\0d\0l\0l\0\0\0"}, 80, ) }, 80, ) == 0x0 00685 464 NtQueryValueKey (88, (88, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="T\0c\0p\0i\0p\0\0\0"}, 24, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (88, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="T\0c\0p\0i\0p\0\0\0"}, 24, ) }, 24, ) == 0x0 00686 464 NtQueryValueKey (88, (88, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="T\0c\0p\0i\0p\0\0\0"}, 24, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (88, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="T\0c\0p\0i\0p\0\0\0"}, 24, ) }, 24, ) == 0x0 00687 464 NtQueryValueKey (88, (88, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="T\0c\0p\0i\0p\0\0\0"}, 24, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (88, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="T\0c\0p\0i\0p\0\0\0"}, 24, ) }, 24, ) == 0x0 00688 464 NtQueryValueKey (88, (88, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="T\0c\0p\0i\0p\0\0\0"}, 24, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (88, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="T\0c\0p\0i\0p\0\0\0"}, 24, ) }, 24, ) == 0x0 00689 464 NtQueryValueKey (88, (88, "ProviderId", Partial, 144, ... TitleIdx=0, Type=3, Data="@\235\5"\236~\317\21\256Z\0\252\0\247\21+"}, 28, ) , Partial, 144, ... TitleIdx=0, Type=3, Data= (88, "ProviderId", Partial, 144, ... TitleIdx=0, Type=3, Data="@\235\5"\236~\317\21\256Z\0\252\0\247\21+"}, 28, ) \236~\317\21\256Z\0\252\0\247\21+"}, 28, ) == 0x0 00690 464 NtQueryValueKey (88, (88, "AddressFamily", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 00691 464 NtQueryValueKey (88, (88, "SupportedNameSpace", Partial, 144, ... TitleIdx=0, Type=4, Data="\14\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (88, "SupportedNameSpace", Partial, 144, ... TitleIdx=0, Type=4, Data="\14\0\0\0"}, 16, ) }, 16, ) == 0x0 00692 464 NtQueryValueKey (88, (88, "Enabled", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (88, "Enabled", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) }, 16, ) == 0x0 00693 464 NtQueryValueKey (88, (88, "Version", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (88, "Version", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) }, 16, ) == 0x0 00694 464 NtQueryValueKey (88, (88, "StoresServiceClassInfo", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (88, "StoresServiceClassInfo", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) }, 16, ) == 0x0 00695 464 NtClose (88, ... ) == 0x0 00696 464 NtOpenKey (0x20019, {24, 84, 0x40, 0, 0, (0x20019, {24, 84, 0x40, 0, 0, "000000000002"}, ... 88, ) }, ... 88, ) == 0x0 00697 464 NtQueryValueKey (88, (88, "LibraryPath", Partial, 144, ... TitleIdx=0, Type=1, Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0w\0i\0n\0r\0n\0r\0.\0d\0l\0l\0\0\0"}, 78, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (88, "LibraryPath", Partial, 144, ... TitleIdx=0, Type=1, Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0w\0i\0n\0r\0n\0r\0.\0d\0l\0l\0\0\0"}, 78, ) }, 78, ) == 0x0 00698 464 NtQueryValueKey (88, (88, "LibraryPath", Partial, 144, ... TitleIdx=0, Type=1, Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0w\0i\0n\0r\0n\0r\0.\0d\0l\0l\0\0\0"}, 78, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (88, "LibraryPath", Partial, 144, ... TitleIdx=0, Type=1, Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0w\0i\0n\0r\0n\0r\0.\0d\0l\0l\0\0\0"}, 78, ) }, 78, ) == 0x0 00699 464 NtQueryValueKey (88, (88, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="N\0T\0D\0S\0\0\0"}, 22, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (88, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="N\0T\0D\0S\0\0\0"}, 22, ) }, 22, ) == 0x0 00700 464 NtQueryValueKey (88, (88, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="N\0T\0D\0S\0\0\0"}, 22, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (88, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="N\0T\0D\0S\0\0\0"}, 22, ) }, 22, ) == 0x0 00701 464 NtQueryValueKey (88, (88, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="N\0T\0D\0S\0\0\0"}, 22, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (88, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="N\0T\0D\0S\0\0\0"}, 22, ) }, 22, ) == 0x0 00702 464 NtQueryValueKey (88, (88, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="N\0T\0D\0S\0\0\0"}, 22, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (88, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="N\0T\0D\0S\0\0\0"}, 22, ) }, 22, ) == 0x0 00703 464 NtQueryValueKey (88, (88, "ProviderId", Partial, 144, ... TitleIdx=0, Type=3, Data="\3567&;\200\345\317\21\245U\0\300O\330\324\254"}, 28, ) , Partial, 144, ... TitleIdx=0, Type=3, Data= (88, "ProviderId", Partial, 144, ... TitleIdx=0, Type=3, Data="\3567&;\200\345\317\21\245U\0\300O\330\324\254"}, 28, ) }, 28, ) == 0x0 00704 464 NtQueryValueKey (88, (88, "AddressFamily", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 00705 464 NtQueryValueKey (88, (88, "SupportedNameSpace", Partial, 144, ... TitleIdx=0, Type=4, Data=" \0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (88, "SupportedNameSpace", Partial, 144, ... TitleIdx=0, Type=4, Data=" \0\0\0"}, 16, ) }, 16, ) == 0x0 00706 464 NtQueryValueKey (88, (88, "Enabled", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (88, "Enabled", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) }, 16, ) == 0x0 00707 464 NtQueryValueKey (88, (88, "Version", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (88, "Version", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) }, 16, ) == 0x0 00708 464 NtQueryValueKey (88, (88, "StoresServiceClassInfo", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (88, "StoresServiceClassInfo", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) }, 16, ) == 0x0 00709 464 NtClose (88, ... ) == 0x0 00710 464 NtAllocateVirtualMemory (-1, 1363968, 0, 4096, 4096, 4, ... 1363968, 4096, ) == 0x0 00711 464 NtOpenKey (0x20019, {24, 84, 0x40, 0, 0, (0x20019, {24, 84, 0x40, 0, 0, "000000000003"}, ... 88, ) }, ... 88, ) == 0x0 00712 464 NtQueryValueKey (88, (88, "LibraryPath", Partial, 144, ... TitleIdx=0, Type=1, Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0m\0s\0w\0s\0o\0c\0k\0.\0d\0l\0l\0\0\0"}, 80, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (88, "LibraryPath", Partial, 144, ... TitleIdx=0, Type=1, Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0m\0s\0w\0s\0o\0c\0k\0.\0d\0l\0l\0\0\0"}, 80, ) }, 80, ) == 0x0 00713 464 NtQueryValueKey (88, (88, "LibraryPath", Partial, 144, ... TitleIdx=0, Type=1, Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0m\0s\0w\0s\0o\0c\0k\0.\0d\0l\0l\0\0\0"}, 80, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (88, "LibraryPath", Partial, 144, ... TitleIdx=0, Type=1, Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0m\0s\0w\0s\0o\0c\0k\0.\0d\0l\0l\0\0\0"}, 80, ) }, 80, ) == 0x0 00714 464 NtQueryValueKey (88, (88, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="N\0e\0t\0w\0o\0r\0k\0 \0L\0o\0c\0a\0t\0i\0o\0n\0 \0A\0w\0a\0r\0e\0n\0e\0s\0s\0 \0(\0N\0L\0A\0)\0 \0N\0a\0m\0e\0s\0p\0a\0c\0e\0\0\0"}, 98, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (88, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="N\0e\0t\0w\0o\0r\0k\0 \0L\0o\0c\0a\0t\0i\0o\0n\0 \0A\0w\0a\0r\0e\0n\0e\0s\0s\0 \0(\0N\0L\0A\0)\0 \0N\0a\0m\0e\0s\0p\0a\0c\0e\0\0\0"}, 98, ) }, 98, ) == 0x0 00715 464 NtQueryValueKey (88, (88, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="N\0e\0t\0w\0o\0r\0k\0 \0L\0o\0c\0a\0t\0i\0o\0n\0 \0A\0w\0a\0r\0e\0n\0e\0s\0s\0 \0(\0N\0L\0A\0)\0 \0N\0a\0m\0e\0s\0p\0a\0c\0e\0\0\0"}, 98, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (88, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="N\0e\0t\0w\0o\0r\0k\0 \0L\0o\0c\0a\0t\0i\0o\0n\0 \0A\0w\0a\0r\0e\0n\0e\0s\0s\0 \0(\0N\0L\0A\0)\0 \0N\0a\0m\0e\0s\0p\0a\0c\0e\0\0\0"}, 98, ) }, 98, ) == 0x0 00716 464 NtQueryValueKey (88, (88, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="N\0e\0t\0w\0o\0r\0k\0 \0L\0o\0c\0a\0t\0i\0o\0n\0 \0A\0w\0a\0r\0e\0n\0e\0s\0s\0 \0(\0N\0L\0A\0)\0 \0N\0a\0m\0e\0s\0p\0a\0c\0e\0\0\0"}, 98, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (88, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="N\0e\0t\0w\0o\0r\0k\0 \0L\0o\0c\0a\0t\0i\0o\0n\0 \0A\0w\0a\0r\0e\0n\0e\0s\0s\0 \0(\0N\0L\0A\0)\0 \0N\0a\0m\0e\0s\0p\0a\0c\0e\0\0\0"}, 98, ) }, 98, ) == 0x0 00717 464 NtQueryValueKey (88, (88, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="N\0e\0t\0w\0o\0r\0k\0 \0L\0o\0c\0a\0t\0i\0o\0n\0 \0A\0w\0a\0r\0e\0n\0e\0s\0s\0 \0(\0N\0L\0A\0)\0 \0N\0a\0m\0e\0s\0p\0a\0c\0e\0\0\0"}, 98, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (88, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="N\0e\0t\0w\0o\0r\0k\0 \0L\0o\0c\0a\0t\0i\0o\0n\0 \0A\0w\0a\0r\0e\0n\0e\0s\0s\0 \0(\0N\0L\0A\0)\0 \0N\0a\0m\0e\0s\0p\0a\0c\0e\0\0\0"}, 98, ) }, 98, ) == 0x0 00718 464 NtQueryValueKey (88, (88, "ProviderId", Partial, 144, ... TitleIdx=0, Type=3, Data=":$Bf\250;\246J\272\245.\13\327\37\335\203"}, 28, ) , Partial, 144, ... TitleIdx=0, Type=3, Data= (88, "ProviderId", Partial, 144, ... TitleIdx=0, Type=3, Data=":$Bf\250;\246J\272\245.\13\327\37\335\203"}, 28, ) }, 28, ) == 0x0 00719 464 NtQueryValueKey (88, (88, "AddressFamily", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 00720 464 NtQueryValueKey (88, (88, "SupportedNameSpace", Partial, 144, ... TitleIdx=0, Type=4, Data="\17\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (88, "SupportedNameSpace", Partial, 144, ... TitleIdx=0, Type=4, Data="\17\0\0\0"}, 16, ) }, 16, ) == 0x0 00721 464 NtQueryValueKey (88, (88, "Enabled", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (88, "Enabled", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) }, 16, ) == 0x0 00722 464 NtQueryValueKey (88, (88, "Version", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (88, "Version", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) }, 16, ) == 0x0 00723 464 NtQueryValueKey (88, (88, "StoresServiceClassInfo", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (88, "StoresServiceClassInfo", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) }, 16, ) == 0x0 00724 464 NtClose (88, ... ) == 0x0 00725 464 NtOpenKey (0x20019, {24, 84, 0x40, 0, 0, (0x20019, {24, 84, 0x40, 0, 0, "000000000004"}, ... 88, ) }, ... 88, ) == 0x0 00726 464 NtQueryValueKey (88, (88, "LibraryPath", Partial, 144, ... TitleIdx=0, Type=1, Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0s\0y\0s\0t\0e\0m\03\02\0\\0w\0s\0h\0b\0t\0h\0.\0d\0l\0l\0\0\0"}, 78, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (88, "LibraryPath", Partial, 144, ... TitleIdx=0, Type=1, Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0s\0y\0s\0t\0e\0m\03\02\0\\0w\0s\0h\0b\0t\0h\0.\0d\0l\0l\0\0\0"}, 78, ) }, 78, ) == 0x0 00727 464 NtQueryValueKey (88, (88, "LibraryPath", Partial, 144, ... TitleIdx=0, Type=1, Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0s\0y\0s\0t\0e\0m\03\02\0\\0w\0s\0h\0b\0t\0h\0.\0d\0l\0l\0\0\0"}, 78, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (88, "LibraryPath", Partial, 144, ... TitleIdx=0, Type=1, Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0s\0y\0s\0t\0e\0m\03\02\0\\0w\0s\0h\0b\0t\0h\0.\0d\0l\0l\0\0\0"}, 78, ) }, 78, ) == 0x0 00728 464 NtQueryValueKey (88, (88, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="B\0l\0u\0e\0t\0o\0o\0t\0h\0 \0N\0a\0m\0e\0s\0p\0a\0c\0e\0\0\0"}, 52, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (88, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="B\0l\0u\0e\0t\0o\0o\0t\0h\0 \0N\0a\0m\0e\0s\0p\0a\0c\0e\0\0\0"}, 52, ) }, 52, ) == 0x0 00729 464 NtQueryValueKey (88, (88, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="B\0l\0u\0e\0t\0o\0o\0t\0h\0 \0N\0a\0m\0e\0s\0p\0a\0c\0e\0\0\0"}, 52, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (88, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="B\0l\0u\0e\0t\0o\0o\0t\0h\0 \0N\0a\0m\0e\0s\0p\0a\0c\0e\0\0\0"}, 52, ) }, 52, ) == 0x0 00730 464 NtQueryValueKey (88, (88, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="B\0l\0u\0e\0t\0o\0o\0t\0h\0 \0N\0a\0m\0e\0s\0p\0a\0c\0e\0\0\0"}, 52, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (88, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="B\0l\0u\0e\0t\0o\0o\0t\0h\0 \0N\0a\0m\0e\0s\0p\0a\0c\0e\0\0\0"}, 52, ) }, 52, ) == 0x0 00731 464 NtQueryValueKey (88, (88, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="B\0l\0u\0e\0t\0o\0o\0t\0h\0 \0N\0a\0m\0e\0s\0p\0a\0c\0e\0\0\0"}, 52, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (88, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="B\0l\0u\0e\0t\0o\0o\0t\0h\0 \0N\0a\0m\0e\0s\0p\0a\0c\0e\0\0\0"}, 52, ) }, 52, ) == 0x0 00732 464 NtQueryValueKey (88, (88, "ProviderId", Partial, 144, ... TitleIdx=0, Type=3, Data="\340c\252\6`}\377A\257\262>\346\322\3319-"}, 28, ) , Partial, 144, ... TitleIdx=0, Type=3, Data= (88, "ProviderId", Partial, 144, ... TitleIdx=0, Type=3, Data="\340c\252\6`}\377A\257\262>\346\322\3319-"}, 28, ) }, 28, ) == 0x0 00733 464 NtQueryValueKey (88, (88, "AddressFamily", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 00734 464 NtQueryValueKey (88, (88, "SupportedNameSpace", Partial, 144, ... TitleIdx=0, Type=4, Data="\20\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (88, "SupportedNameSpace", Partial, 144, ... TitleIdx=0, Type=4, Data="\20\0\0\0"}, 16, ) }, 16, ) == 0x0 00735 464 NtQueryValueKey (88, (88, "Enabled", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (88, "Enabled", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) }, 16, ) == 0x0 00736 464 NtQueryValueKey (88, (88, "Version", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (88, "Version", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) }, 16, ) == 0x0 00737 464 NtQueryValueKey (88, (88, "StoresServiceClassInfo", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (88, "StoresServiceClassInfo", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) }, 16, ) == 0x0 00738 464 NtClose (88, ... ) == 0x0 00739 464 NtClose (84, ... ) == 0x0 00740 464 NtWaitForSingleObject (76, 0, {0, 0}, ... ) == 0x102 00741 464 NtClose (64, ... ) == 0x0 00742 464 NtQuerySystemInformation (Basic, 44, ... {Unknown=0,MaximumIncrement=156250,PhysicalPageSize=0x1000,NumberOfPhysicalPages=0xff7c,LowestPhysicalPage=0x1,HighestPhysicalPage=0xffff,AllocationGranularity=0x10000,LowestUserAddress=0x10000,HighestUserAddress=0x7ffeffff,ActiveProcessors=1,NumberProcessors=1,}, 0x0, ) == 0x0 00743 464 NtQuerySystemInformation (Processor, 12, ... {system info, class 1, size 12}, 0x0, ) == 0x0 00744 464 NtOpenKey (0x1, {24, 16, 0x40, 0, 0, (0x1, {24, 16, 0x40, 0, 0, "System\CurrentControlSet\Services\Winsock2\Parameters"}, ... 64, ) }, ... 64, ) == 0x0 00745 464 NtQueryValueKey (64, (64, "Ws2_32NumHandleBuckets", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 00746 464 NtClose (64, ... ) == 0x0 00747 464 NtDuplicateObject (-1, -2, -1, 0x0, 0, 2, ... 64, ) == 0x0 00748 464 NtAllocateVirtualMemory (-1, 9977856, 0, 81920, 4096, 4, ... 9977856, 81920, ) == 0x0 00749 464 NtLockVirtualMemory (-1, (0x980440), 65536, 1, ... (0x980000), 69632, ) == 0x0 00750 464 NtCreateEvent (0x1f0003, 0x0, 0, -1, ... 84, ) == 0x0 00751 464 NtQueryVirtualMemory (-1, 0x3df666, Basic, 28, ... {BaseAddress=0x3df000,AllocationBase=0x3b0000,AllocationProtect=0x40,RegionSize=0x15000,State=0x1000,Protect=0x40,Type=0x20000,}, 28, ) == 0x0 00752 464 NtContinue (1244328, 0, ... 00753 464 NtFreeVirtualMemory (-1, (0x994000), 16384, 16384, ... (0x994000), 16384, ) == 0x0 00754 464 NtQueryVirtualMemory (-1, 0x3deb09, Basic, 28, ... {BaseAddress=0x3de000,AllocationBase=0x3b0000,AllocationProtect=0x40,RegionSize=0x16000,State=0x1000,Protect=0x40,Type=0x20000,}, 28, ) == 0x0 00755 464 NtContinue (1244016, 0, ... 00756 464 NtAllocateVirtualMemory (-1, 10043392, 0, 32768, 4096, 4, ... 10043392, 32768, ) == 0x0 00757 464 NtAllocateVirtualMemory (-1, 0, 0, 29, 4096, 64, ... 11010048, 4096, ) == 0x0 00758 464 NtAllocateVirtualMemory (-1, 0, 0, 21, 4096, 64, ... 11075584, 4096, ) == 0x0 00759 464 NtAllocateVirtualMemory (-1, 0, 0, 37, 4096, 64, ... 11141120, 4096, ) == 0x0 00760 464 NtAllocateVirtualMemory (-1, 0, 0, 22, 4096, 64, ... 11206656, 4096, ) == 0x0 00761 464 NtAllocateVirtualMemory (-1, 0, 0, 22, 4096, 64, ... 11272192, 4096, ) == 0x0 00762 464 NtAllocateVirtualMemory (-1, 0, 0, 34, 4096, 64, ... 11337728, 4096, ) == 0x0 00763 464 NtAllocateVirtualMemory (-1, 0, 0, 30, 4096, 64, ... 11403264, 4096, ) == 0x0 00764 464 NtAllocateVirtualMemory (-1, 0, 0, 23, 4096, 64, ... 11468800, 4096, ) == 0x0 00765 464 NtAllocateVirtualMemory (-1, 0, 0, 23, 4096, 64, ... 11534336, 4096, ) == 0x0 00766 464 NtAllocateVirtualMemory (-1, 0, 0, 21, 4096, 64, ... 11599872, 4096, ) == 0x0 00767 464 NtAllocateVirtualMemory (-1, 0, 0, 41, 4096, 64, ... 11665408, 4096, ) == 0x0 00768 464 NtAllocateVirtualMemory (-1, 0, 0, 34, 4096, 64, ... 11730944, 4096, ) == 0x0 00769 464 NtAllocateVirtualMemory (-1, 0, 0, 31, 4096, 64, ... 11796480, 4096, ) == 0x0 00770 464 NtAllocateVirtualMemory (-1, 0, 0, 17, 4096, 64, ... 11862016, 4096, ) == 0x0 00771 464 NtAllocateVirtualMemory (-1, 0, 0, 17, 4096, 64, ... 11927552, 4096, ) == 0x0 00772 464 NtAllocateVirtualMemory (-1, 0, 0, 26, 4096, 64, ... 11993088, 4096, ) == 0x0 00773 464 NtAllocateVirtualMemory (-1, 0, 0, 318, 4096, 64, ... 12058624, 4096, ) == 0x0 00774 464 NtQueryVirtualMemory (-1, 0x3ded53, Basic, 28, ... {BaseAddress=0x3de000,AllocationBase=0x3b0000,AllocationProtect=0x40,RegionSize=0x16000,State=0x1000,Protect=0x40,Type=0x20000,}, 28, ) == 0x0 00775 464 NtContinue (1244016, 0, ... 00776 464 NtFreeVirtualMemory (-1, (0x994000), 32768, 16384, ... (0x994000), 32768, ) == 0x0 00777 464 NtQueryVirtualMemory (-1, 0x3df23a, Basic, 28, ... {BaseAddress=0x3df000,AllocationBase=0x3b0000,AllocationProtect=0x40,RegionSize=0x15000,State=0x1000,Protect=0x40,Type=0x20000,}, 28, ) == 0x0 00778 464 NtContinue (1244016, 0, ... 00779 464 NtAllocateVirtualMemory (-1, 10043392, 0, 32768, 4096, 4, ... 10043392, 32768, ) == 0x0 00780 464 NtQueryVirtualMemory (-1, 0x3c4409, Basic, 28, ... {BaseAddress=0x3c4000,AllocationBase=0x3b0000,AllocationProtect=0x40,RegionSize=0x30000,State=0x1000,Protect=0x40,Type=0x20000,}, 28, ) == 0x0 00781 464 NtQueryVirtualMemory (-1, 0x3df60e, Basic, 28, ... {BaseAddress=0x3df000,AllocationBase=0x3b0000,AllocationProtect=0x40,RegionSize=0x15000,State=0x1000,Protect=0x40,Type=0x20000,}, 28, ) == 0x0 00782 464 NtQueryVirtualMemory (-1, 0x3df854, Basic, 28, ... {BaseAddress=0x3df000,AllocationBase=0x3b0000,AllocationProtect=0x40,RegionSize=0x15000,State=0x1000,Protect=0x40,Type=0x20000,}, 28, ) == 0x0 00783 464 NtContinue (1242888, 0, ... 00784 464 NtUserFindExistingCursorIcon (1242844, 1242860, 1242908, ... ) == 0x10015 00785 464 NtUserSetCursor (65557, ... ) == 0x10015 00786 464 NtGdiCreateCompatibleDC (0, ... ) == 0x6e0106ed 00787 464 NtGdiGetTextCharsetInfo (1845561069, 0, 0, ... ) == 0x0 00788 464 NtGdiHfontCreate (1242600, 356, 0, 0, 1333032, ... ) == 0x3c0a056c 00789 464 NtGdiGetTextMetricsW (1845561069, 1242916, 68, ... ) == 0x1 00790 464 NtGdiGetTextFaceW (1845561069, 32, 1243224, 1, ... ) == 0xe 00791 464 NtAllocateVirtualMemory (-1, 1368064, 0, 4096, 4096, 4, ... 1368064, 4096, ) == 0x0 00792 464 NtGdiGetWidthTable (1845561069, 52, 1367776, 308, 1368392, 1367144, 1367160, ... ) == 0x1 00793 464 NtGdiDeleteObjectApp (1845561069, ... ) == 0x1 00794 464 NtUserGetForegroundWindow (... ) == 0x70104 00795 464 NtUserQueryWindow (459012, 0, ... ) == 0x49c 00796 464 NtUserQueryWindow (459012, 1, ... ) == 0x180 00797 464 NtUserGetAtomName (32770, 1242104, ... ) == 0x6 00798 464 NtUserCreateWindowEx (-2147417855, 32770, 32770, (-2147417855, 32770, 32770, " ", 13240516, 284, 271, 456, 195, 0, 0, 0, 0, 1073742848, 0, ... , 13240516, 284, 271, 456, 195, 0, 0, 0, 0, 1073742848, 0, ... 00799 464 NtQueryAttributesFile ({24, 0, 0x40, 0, 0, ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\MSCTF.dll"}, 1239580, ... ) }, 1239580, ... ) == 0x0 00800 464 NtOpenFile (0x100020, {24, 0, 0x40, 0, 0, (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\MSCTF.dll"}, 5, 96, ... 88, {status=0x0, info=1}, ) }, 5, 96, ... 88, {status=0x0, info=1}, ) == 0x0 00801 464 NtCreateSection (0xe, 0x0, 0x0, 16, 134217728, 88, ... 92, ) == 0x0 00802 464 NtClose (88, ... ) == 0x0 00803 464 NtMapViewOfSection (92, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 16, ... (0xb90000), 0x0, 294912, ) == 0x0 00804 464 NtClose (92, ... ) == 0x0 00805 464 NtUnmapViewOfSection (-1, 0xb90000, ... ) == 0x0 00806 464 NtQueryAttributesFile ({24, 0, 0x40, 0, 0, ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\MSCTF.dll"}, 1239888, ... ) }, 1239888, ... ) == 0x0 00807 464 NtOpenFile (0x100020, {24, 0, 0x40, 0, 0, (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\MSCTF.dll"}, 5, 96, ... 92, {status=0x0, info=1}, ) }, 5, 96, ... 92, {status=0x0, info=1}, ) == 0x0 00808 464 NtCreateSection (0xf, 0x0, 0x0, 16, 16777216, 92, ... 88, ) == 0x0 00809 464 NtQuerySection (88, Image, 48, ... {section info, class 1, size 48}, 0x0, ) == 0x0 00810 464 NtClose (92, ... ) == 0x0 00811 464 NtMapViewOfSection (88, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x74720000), 0x0, 307200, ) == 0x0 00812 464 NtClose (88, ... ) == 0x0 00813 464 NtProtectVirtualMemory (-1, (0x74721000), 928, 4, ... (0x74721000), 4096, 32, ) == 0x0 00814 464 NtProtectVirtualMemory (-1, (0x74721000), 4096, 32, ... (0x74721000), 4096, 4, ) == 0x0 00815 464 NtFlushInstructionCache (-1, 1953632256, 928, ... ) == 0x0 00816 464 NtProtectVirtualMemory (-1, (0x74721000), 928, 4, ... (0x74721000), 4096, 32, ) == 0x0 00817 464 NtProtectVirtualMemory (-1, (0x74721000), 4096, 32, ... (0x74721000), 4096, 4, ) == 0x0 00818 464 NtFlushInstructionCache (-1, 1953632256, 928, ... ) == 0x0 00819 464 NtProtectVirtualMemory (-1, (0x74721000), 928, 4, ... (0x74721000), 4096, 32, ) == 0x0 00820 464 NtProtectVirtualMemory (-1, (0x74721000), 4096, 32, ... (0x74721000), 4096, 4, ) == 0x0 00821 464 NtFlushInstructionCache (-1, 1953632256, 928, ... ) == 0x0 00822 464 NtProtectVirtualMemory (-1, (0x74721000), 928, 4, ... (0x74721000), 4096, 32, ) == 0x0 00823 464 NtProtectVirtualMemory (-1, (0x74721000), 4096, 32, ... (0x74721000), 4096, 4, ) == 0x0 00824 464 NtFlushInstructionCache (-1, 1953632256, 928, ... ) == 0x0 00825 464 NtOpenKey (0x80000000, {24, 0, 0x40, 0, 0, (0x80000000, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MSCTF.dll"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 00826 464 NtQueryAttributesFile ({24, 0, 0x40, 0, 0, ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\ntdll.dll"}, 1237244, ... ) }, 1237244, ... ) == 0x0 00827 464 NtQueryInformationProcess (-1, Wow64, 4, ... {process info, class 26, size 4}, 0x0, ) == 0x0 00828 464 NtUserCallOneParam (0, 40, ... ) == 0x4090409 00829 464 NtUserRegisterWindowMessage ( ("MSUIM.Msg.Private", ... ) , ... ) == 0xc0a1 00830 464 NtUserRegisterWindowMessage ( ("MSUIM.Msg.SetFocus", ... ) , ... ) == 0xc0a2 00831 464 NtUserRegisterWindowMessage ( ("MSUIM.Msg.ThreadTerminate", ... ) , ... ) == 0xc0a3 00832 464 NtUserRegisterWindowMessage ( ("MSUIM.Msg.ThreadItemChange", ... ) , ... ) == 0xc0a4 00833 464 NtUserRegisterWindowMessage ( ("MSUIM.Msg.LangBarModal", ... ) , ... ) == 0xc0a5 00834 464 NtUserRegisterWindowMessage ( ("MSUIM.Msg.RpcSendReceive", ... ) , ... ) == 0xc0a6 00835 464 NtUserRegisterWindowMessage ( ("MSUIM.Msg.ThreadMarshal", ... ) , ... ) == 0xc0a7 00836 464 NtUserRegisterWindowMessage ( ("MSUIM.Msg.CheckThreadInputIdel", ... ) , ... ) == 0xc0a8 00837 464 NtUserRegisterWindowMessage ( ("MSUIM.Msg.StubCleanUp", ... ) , ... ) == 0xc0a9 00838 464 NtUserRegisterWindowMessage ( ("MSUIM.Msg.ShowFloating", ... ) , ... ) == 0xc0aa 00839 464 NtUserRegisterWindowMessage ( ("MSUIM.Msg.LBUpdate", ... ) , ... ) == 0xc0ab 00840 464 NtUserRegisterWindowMessage ( ("MSUIM.Msg.MuiMgrDirtyUpdate", ... ) , ... ) == 0xc0ac 00841 464 NtQueryAttributesFile ({24, 0, 0x40, 0, 0, ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\imm32.dll"}, 1237252, ... ) }, 1237252, ... ) == 0x0 00842 464 NtRequestWaitReplyPort (24, {24, 52, new_msg, 0, 3998, 1239644, 0, 0} (24, {24, 52, new_msg, 0, 3998, 1239644, 0, 0} "\0\0\0\0\5\4\3\0\0\0\0\0\1\0\0\0\320\1\0\0\0\0\0\0" ... {24, 52, reply, 0, 1036, 464, 57973, 0} "\0\0\0\0\5\4\3\0\0\0\0\0\1\0\0\0\320\1\0\0\0\0\0\0" ) ... {24, 52, reply, 0, 1036, 464, 57973, 0} (24, {24, 52, new_msg, 0, 3998, 1239644, 0, 0} "\0\0\0\0\5\4\3\0\0\0\0\0\1\0\0\0\320\1\0\0\0\0\0\0" ... {24, 52, reply, 0, 1036, 464, 57973, 0} "\0\0\0\0\5\4\3\0\0\0\0\0\1\0\0\0\320\1\0\0\0\0\0\0" ) ) == 0x0 00843 464 NtUserGetThreadDesktop (464, 0, ... ) == 0x24 00844 464 NtUserGetObjectInformation (36, 2, 1318544, 520, 1239552, ... ) == 0x1 00845 464 NtOpenProcessToken (-1, 0x8, ... 88, ) == 0x0 00846 464 NtQueryInformationToken (88, User, 0, ... ) == STATUS_BUFFER_TOO_SMALL 00847 464 NtQueryInformationToken (88, User, 36, ... {token info, class 1, size 36}, 36, ) == 0x0 00848 464 NtClose (88, ... ) == 0x0 00849 464 NtCreateSection (0xf0007, {24, 48, 0x80, 0, 0, (0xf0007, {24, 48, 0x80, 0, 0, "CiceroSharedMemDefaultS-1-5-21-1292428093-1383384898-725345543-1003"}, {3240, 0}, 4, 134217728, 0, ... 88, ) }, {3240, 0}, 4, 134217728, 0, ... 88, ) == STATUS_OBJECT_NAME_EXISTS 00850 464 NtMapViewOfSection (88, -1, (0x0), 0, 0, {0, 0}, 0, 1, 0, 4, ... (0xb90000), {0, 0}, 4096, ) == 0x0 00851 464 NtOpenKey (0x20019, {24, 16, 0x40, 0, 0, (0x20019, {24, 16, 0x40, 0, 0, "SOFTWARE\Microsoft\CTF\Compatibility\packed.exe"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 00852 464 NtOpenKey (0x20019, {24, 16, 0x40, 0, 0, (0x20019, {24, 16, 0x40, 0, 0, "SOFTWARE\Microsoft\CTF\SystemShared\"}, ... 92, ) }, ... 92, ) == 0x0 00853 464 NtQueryValueKey (92, (92, "CUAS", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (92, "CUAS", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) }, 16, ) == 0x0 00854 464 NtClose (92, ... ) == 0x0 00855 464 NtUserFindExistingCursorIcon (1239084, 1239100, 1239148, ... ) == 0x10011 00856 464 NtUserRegisterClassExWOW (1239356, 1239452, 1239436, 1239424, 0, 386, 0, ... ) == 0x8178c0ad 00857 464 NtCreateMutant (0x1f0001, {24, 48, 0x80, 0, 0, (0x1f0001, {24, 48, 0x80, 0, 0, "CTF.LBES.MutexDefaultS-1-5-21-1292428093-1383384898-725345543-1003"}, 0, ... 92, ) }, 0, ... 92, ) == STATUS_OBJECT_NAME_EXISTS 00858 464 NtCreateMutant (0x1f0001, {24, 48, 0x80, 0, 0, (0x1f0001, {24, 48, 0x80, 0, 0, "CTF.Compart.MutexDefaultS-1-5-21-1292428093-1383384898-725345543-1003"}, 0, ... 96, ) }, 0, ... 96, ) == STATUS_OBJECT_NAME_EXISTS 00859 464 NtCreateMutant (0x1f0001, {24, 48, 0x80, 0, 0, (0x1f0001, {24, 48, 0x80, 0, 0, "CTF.Asm.MutexDefaultS-1-5-21-1292428093-1383384898-725345543-1003"}, 0, ... 100, ) }, 0, ... 100, ) == STATUS_OBJECT_NAME_EXISTS 00860 464 NtCreateMutant (0x1f0001, {24, 48, 0x80, 0, 0, (0x1f0001, {24, 48, 0x80, 0, 0, "CTF.Layouts.MutexDefaultS-1-5-21-1292428093-1383384898-725345543-1003"}, 0, ... 104, ) }, 0, ... 104, ) == STATUS_OBJECT_NAME_EXISTS 00861 464 NtCreateMutant (0x1f0001, {24, 48, 0x80, 0, 0, (0x1f0001, {24, 48, 0x80, 0, 0, "CTF.TMD.MutexDefaultS-1-5-21-1292428093-1383384898-725345543-1003"}, 0, ... 108, ) }, 0, ... 108, ) == STATUS_OBJECT_NAME_EXISTS 00862 464 NtOpenKey (0x20019, {24, 56, 0x40, 0, 0, (0x20019, {24, 56, 0x40, 0, 0, "Keyboard Layout\Toggle"}, ... 112, ) }, ... 112, ) == 0x0 00863 464 NtQueryValueKey (112, (112, "Language Hotkey", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 00864 464 NtQueryValueKey (112, (112, "Hotkey", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 00865 464 NtQueryValueKey (112, (112, "Layout Hotkey", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 00866 464 NtClose (112, ... ) == 0x0 00867 464 NtQueryAttributesFile ({24, 0, 0x40, 0, 0, ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\KERNEL32.dll"}, 1237072, ... ) }, 1237072, ... ) == 0x0 00868 464 NtQueryDefaultUILanguage (1239632, ... 00869 464 NtOpenThreadTokenEx (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN 00870 464 NtOpenProcessTokenEx (-1, 0x20008, 512, ... -2147482740, ) == 0x0 00871 464 NtQueryInformationToken (-2147482740, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0 00872 464 NtClose (-2147482740, ... ) == 0x0 00873 464 NtOpenKey (0x2000000, {24, 0, 0x640, 0, 0, (0x2000000, {24, 0, 0x640, 0, 0, "\REGISTRY\USER\S-1-5-21-1292428093-1383384898-725345543-1003"}, ... -2147482740, ) }, ... -2147482740, ) == 0x0 00874 464 NtOpenKey (0x80000000, {24, -2147482740, 0x240, 0, 0, (0x80000000, {24, -2147482740, 0x240, 0, 0, "Software\Policies\Microsoft\Control Panel\Desktop"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 00875 464 NtOpenKey (0x80000000, {24, -2147482740, 0x640, 0, 0, (0x80000000, {24, -2147482740, 0x640, 0, 0, "Control Panel\Desktop"}, ... -2147481328, ) }, ... -2147481328, ) == 0x0 00876 464 NtQueryValueKey (-2147481328, (-2147481328, "MultiUILanguageId", Partial, 256, ... ) , Partial, 256, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 00877 464 NtClose (-2147481328, ... ) == 0x0 00878 464 NtClose (-2147482740, ... ) == 0x0 00868 464 NtQueryDefaultUILanguage ... ) == 0x0 00879 464 NtOpenKey (0x20019, {24, 16, 0x40, 0, 0, (0x20019, {24, 16, 0x40, 0, 0, "SOFTWARE\Microsoft\CTF\"}, ... 112, ) }, ... 112, ) == 0x0 00880 464 NtQueryValueKey (112, (112, "EnableAnchorContext", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 00881 464 NtClose (112, ... ) == 0x0 00882 464 NtCreateMutant (0x1f0001, {24, 48, 0x80, 0, 0, (0x1f0001, {24, 48, 0x80, 0, 0, "CTF.TimListCache.FMPDefaultS-1-5-21-1292428093-1383384898-725345543-1003MUTEX.DefaultS-1-5-21-1292428093-1383384898-725345543-1003"}, 0, ... 112, ) }, 0, ... 112, ) == STATUS_OBJECT_NAME_EXISTS 00883 464 NtOpenSection (0xf001f, {24, 48, 0x0, 0, 0, (0xf001f, {24, 48, 0x0, 0, 0, "CTF.TimListCache.FMPDefaultS-1-5-21-1292428093-1383384898-725345543-1003SFM.DefaultS-1-5-21-1292428093-1383384898-725345543-1003"}, ... 116, ) }, ... 116, ) == 0x0 00884 464 NtMapViewOfSection (116, -1, (0x0), 0, 0, {0, 0}, 0, 1, 0, 4, ... (0xba0000), {0, 0}, 262144, ) == 0x0 00885 464 NtWaitForSingleObject (112, 0, {-50000000, -1}, ... ) == 0x0 00886 464 NtReleaseMutant (112, ... 0x0, ) == 0x0 00887 464 NtWaitForSingleObject (112, 0, {-50000000, -1}, ... ) == 0x0 00888 464 NtReleaseMutant (112, ... 0x0, ) == 0x0 00889 464 NtWaitForSingleObject (112, 0, {-50000000, -1}, ... ) == 0x0 00890 464 NtReleaseMutant (112, ... 0x0, ) == 0x0 00891 464 NtUserSetWindowsHookEx (1953628160, 1241116, 464, 2, 1953694283, 2, ... ) == 0xb0277 00892 464 NtUserSetWindowsHookEx (1953628160, 1241116, 464, 7, 1953693577, 2, ... ) == 0x601df 00893 464 NtUserSetWindowFNID (655618, 676, ... ) == 0x1 00894 464 NtUserCallHwndParam (655618, 1369820, 79, ... ) == 0x14e6dc 00895 464 NtUserMessageCall (0xa0102, WM_NCCREATE, 0x0, 0x12f39c, 0, 670, 1, ... ) == 0x1 00896 464 NtUserSetWindowFNID (590100, 681, ... ) == 0x1 00897 464 NtUserSetWindowLong (590100, 0, 1368704, 0, ... ) == 0x0 00898 464 NtOpenKey (0x2000000, {24, 16, 0x40, 0, 0, (0x2000000, {24, 16, 0x40, 0, 0, "Software\Microsoft\Windows NT\CurrentVersion\IMM"}, ... 120, ) }, ... 120, ) == 0x0 00899 464 NtQueryValueKey (120, (120, "Ime File", Partial, 144, ... TitleIdx=0, Type=1, Data="m\0s\0c\0t\0f\0i\0m\0e\0.\0i\0m\0e\0\0\0"}, 38, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (120, "Ime File", Partial, 144, ... TitleIdx=0, Type=1, Data="m\0s\0c\0t\0f\0i\0m\0e\0.\0i\0m\0e\0\0\0"}, 38, ) }, 38, ) == 0x0 00900 464 NtClose (120, ... ) == 0x0 00901 464 NtQueryInformationProcess (-1, DefaultHardErrorMode, 4, ... {process info, class 12, size 4}, 0x0, ) == 0x0 00902 464 NtSetInformationProcess (-1, DefaultHardErrorMode, {process info, class 12, size 4}, 4, ... ) == 0x0 00903 464 NtQueryAttributesFile ({24, 0, 0x40, 0, 0, ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\msctfime.ime"}, 1238372, ... ) }, 1238372, ... ) == 0x0 00904 464 NtOpenFile (0x100020, {24, 0, 0x40, 0, 0, (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\msctfime.ime"}, 5, 96, ... 120, {status=0x0, info=1}, ) }, 5, 96, ... 120, {status=0x0, info=1}, ) == 0x0 00905 464 NtCreateSection (0xe, 0x0, 0x0, 16, 134217728, 120, ... 124, ) == 0x0 00906 464 NtClose (120, ... ) == 0x0 00907 464 NtMapViewOfSection (124, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 16, ... (0xbe0000), 0x0, 180224, ) == 0x0 00908 464 NtClose (124, ... ) == 0x0 00909 464 NtUnmapViewOfSection (-1, 0xbe0000, ... ) == 0x0 00910 464 NtQueryAttributesFile ({24, 0, 0x40, 0, 0, ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\msctfime.ime"}, 1237968, ... ) }, 1237968, ... ) == 0x0 00911 464 NtCreateFile (0x80100080, {24, 0, 0x40, 0, 1238712, (0x80100080, {24, 0, 0x40, 0, 1238712, "\??\C:\WINDOWS\system32\msctfime.ime"}, 0x0, 0, 5, 1, 96, 0, 0, ... 124, {status=0x0, info=1}, ) }, 0x0, 0, 5, 1, 96, 0, 0, ... 124, {status=0x0, info=1}, ) == 0x0 00912 464 NtCreateSection (0xf0005, 0x0, 0x0, 2, 134217728, 124, ... 120, ) == 0x0 00913 464 NtClose (124, ... ) == 0x0 00914 464 NtMapViewOfSection (120, -1, (0x0), 0, 0, {0, 0}, 0, 1, 0, 2, ... (0xbe0000), {0, 0}, 180224, ) == 0x0 00915 464 NtClose (120, ... ) == 0x0 00916 464 NtQueryDefaultUILanguage (2090319928, ... 00917 464 NtOpenThreadTokenEx (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN 00918 464 NtOpenProcessTokenEx (-1, 0x20008, 512, ... -2147482740, ) == 0x0 00919 464 NtQueryInformationToken (-2147482740, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0 00920 464 NtClose (-2147482740, ... ) == 0x0 00921 464 NtOpenKey (0x2000000, {24, 0, 0x640, 0, 0, (0x2000000, {24, 0, 0x640, 0, 0, "\REGISTRY\USER\S-1-5-21-1292428093-1383384898-725345543-1003"}, ... -2147482740, ) }, ... -2147482740, ) == 0x0 00922 464 NtOpenKey (0x80000000, {24, -2147482740, 0x240, 0, 0, (0x80000000, {24, -2147482740, 0x240, 0, 0, "Software\Policies\Microsoft\Control Panel\Desktop"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 00923 464 NtOpenKey (0x80000000, {24, -2147482740, 0x640, 0, 0, (0x80000000, {24, -2147482740, 0x640, 0, 0, "Control Panel\Desktop"}, ... -2147481328, ) }, ... -2147481328, ) == 0x0 00924 464 NtQueryValueKey (-2147481328, (-2147481328, "MultiUILanguageId", Partial, 256, ... ) , Partial, 256, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 00925 464 NtClose (-2147481328, ... ) == 0x0 00926 464 NtClose (-2147482740, ... ) == 0x0 00916 464 NtQueryDefaultUILanguage ... ) == 0x0 00927 464 NtQueryInstallUILanguage (2090319930, ... ) == 0x0 00928 464 NtQueryInformationProcess (-1, DefaultHardErrorMode, 4, ... {process info, class 12, size 4}, 0x0, ) == 0x0 00929 464 NtSetInformationProcess (-1, DefaultHardErrorMode, {process info, class 12, size 4}, 4, ... ) == 0x0 00930 464 NtQueryDefaultLocale (1, 1239332, ... ) == 0x0 00931 464 NtQueryVirtualMemory (-1, 0xbe0000, Basic, 28, ... {BaseAddress=0xbe0000,AllocationBase=0xbe0000,AllocationProtect=0x2,RegionSize=0x2c000,State=0x1000,Protect=0x2,Type=0x40000,}, 0x0, ) == 0x0 00932 464 NtQueryVirtualMemory (-1, 0xbe0000, Basic, 28, ... {BaseAddress=0xbe0000,AllocationBase=0xbe0000,AllocationProtect=0x2,RegionSize=0x2c000,State=0x1000,Protect=0x2,Type=0x40000,}, 0x0, ) == 0x0 00933 464 NtUnmapViewOfSection (-1, 0xbe0000, ... ) == 0x0 00934 464 NtQueryInformationProcess (-1, DefaultHardErrorMode, 4, ... {process info, class 12, size 4}, 0x0, ) == 0x0 00935 464 NtSetInformationProcess (-1, DefaultHardErrorMode, {process info, class 12, size 4}, 4, ... ) == 0x0 00936 464 NtQueryAttributesFile ({24, 0, 0x40, 0, 0, ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\msctfime.ime"}, 1238364, ... ) }, 1238364, ... ) == 0x0 00937 464 NtOpenFile (0x100020, {24, 0, 0x40, 0, 0, (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\msctfime.ime"}, 5, 96, ... 120, {status=0x0, info=1}, ) }, 5, 96, ... 120, {status=0x0, info=1}, ) == 0x0 00938 464 NtCreateSection (0xe, 0x0, 0x0, 16, 134217728, 120, ... 124, ) == 0x0 00939 464 NtClose (120, ... ) == 0x0 00940 464 NtMapViewOfSection (124, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 16, ... (0xbe0000), 0x0, 180224, ) == 0x0 00941 464 NtClose (124, ... ) == 0x0 00942 464 NtUnmapViewOfSection (-1, 0xbe0000, ... ) == 0x0 00943 464 NtQueryAttributesFile ({24, 0, 0x40, 0, 0, ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\msctfime.ime"}, 1237960, ... ) }, 1237960, ... ) == 0x0 00944 464 NtCreateFile (0x80100080, {24, 0, 0x40, 0, 1238704, (0x80100080, {24, 0, 0x40, 0, 1238704, "\??\C:\WINDOWS\system32\msctfime.ime"}, 0x0, 0, 5, 1, 96, 0, 0, ... 124, {status=0x0, info=1}, ) }, 0x0, 0, 5, 1, 96, 0, 0, ... 124, {status=0x0, info=1}, ) == 0x0 00945 464 NtCreateSection (0xf0005, 0x0, 0x0, 2, 134217728, 124, ... 120, ) == 0x0 00946 464 NtClose (124, ... ) == 0x0 00947 464 NtMapViewOfSection (120, -1, (0x0), 0, 0, {0, 0}, 0, 1, 0, 2, ... (0xbe0000), {0, 0}, 180224, ) == 0x0 00948 464 NtClose (120, ... ) == 0x0 00949 464 NtQueryInformationProcess (-1, DefaultHardErrorMode, 4, ... {process info, class 12, size 4}, 0x0, ) == 0x0 00950 464 NtSetInformationProcess (-1, DefaultHardErrorMode, {process info, class 12, size 4}, 4, ... ) == 0x0 00951 464 NtQueryDefaultLocale (1, 1239324, ... ) == 0x0 00952 464 NtQueryVirtualMemory (-1, 0xbe0000, Basic, 28, ... {BaseAddress=0xbe0000,AllocationBase=0xbe0000,AllocationProtect=0x2,RegionSize=0x2c000,State=0x1000,Protect=0x2,Type=0x40000,}, 0x0, ) == 0x0 00953 464 NtUnmapViewOfSection (-1, 0xbe0000, ... ) == 0x0 00954 464 NtOpenMutant (0x120001, {24, 48, 0x0, 0, 0, (0x120001, {24, 48, 0x0, 0, 0, "ShimCacheMutex"}, ... 120, ) }, ... 120, ) == 0x0 00955 464 NtWaitForSingleObject (120, 0, {-1000000, -1}, ... ) == 0x0 00956 464 NtOpenSection (0x2, {24, 48, 0x0, 0, 0, (0x2, {24, 48, 0x0, 0, 0, "ShimSharedMemory"}, ... 124, ) }, ... 124, ) == 0x0 00957 464 NtMapViewOfSection (124, -1, (0x0), 0, 0, {0, 0}, 0, 1, 0, 4, ... (0xbe0000), {0, 0}, 57344, ) == 0x0 00958 464 NtOpenThreadTokenEx (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN 00959 464 NtOpenProcessTokenEx (-1, 0x20008, 512, ... 128, ) == 0x0 00960 464 NtQueryInformationToken (128, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0 00961 464 NtClose (128, ... ) == 0x0 00962 464 NtOpenKey (0x20019, {24, 0, 0x40, 0, 0, (0x20019, {24, 0, 0x40, 0, 0, "\REGISTRY\USER\S-1-5-21-1292428093-1383384898-725345543-1003\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Layers"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 00963 464 NtReleaseMutant (120, ... 0x0, ) == 0x0 00964 464 NtQueryAttributesFile ({24, 0, 0x40, 0, 0, ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\msctfime.ime"}, 1238344, ... ) }, 1238344, ... ) == 0x0 00965 464 NtOpenFile (0x100020, {24, 0, 0x40, 0, 0, (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\msctfime.ime"}, 5, 96, ... 128, {status=0x0, info=1}, ) }, 5, 96, ... 128, {status=0x0, info=1}, ) == 0x0 00966 464 NtCreateSection (0xe, 0x0, 0x0, 16, 134217728, 128, ... 132, ) == 0x0 00967 464 NtClose (128, ... ) == 0x0 00968 464 NtMapViewOfSection (132, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 16, ... (0xbf0000), 0x0, 180224, ) == 0x0 00969 464 NtClose (132, ... ) == 0x0 00970 464 NtUnmapViewOfSection (-1, 0xbf0000, ... ) == 0x0 00971 464 NtQueryAttributesFile ({24, 0, 0x40, 0, 0, ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\msctfime.ime"}, 1238652, ... ) }, 1238652, ... ) == 0x0 00972 464 NtOpenFile (0x100020, {24, 0, 0x40, 0, 0, (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\msctfime.ime"}, 5, 96, ... 132, {status=0x0, info=1}, ) }, 5, 96, ... 132, {status=0x0, info=1}, ) == 0x0 00973 464 NtCreateSection (0xf, 0x0, 0x0, 16, 16777216, 132, ... 128, ) == 0x0 00974 464 NtQuerySection (128, Image, 48, ... {section info, class 1, size 48}, 0x0, ) == 0x0 00975 464 NtClose (132, ... ) == 0x0 00976 464 NtMapViewOfSection (128, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x755c0000), 0x0, 188416, ) == 0x0 00977 464 NtClose (128, ... ) == 0x0 00978 464 NtProtectVirtualMemory (-1, (0x755c1000), 860, 4, ... (0x755c1000), 4096, 32, ) == 0x0 00979 464 NtProtectVirtualMemory (-1, (0x755c1000), 4096, 32, ... (0x755c1000), 4096, 4, ) == 0x0 00980 464 NtFlushInstructionCache (-1, 1968967680, 860, ... ) == 0x0 00981 464 NtProtectVirtualMemory (-1, (0x755c1000), 860, 4, ... (0x755c1000), 4096, 32, ) == 0x0 00982 464 NtProtectVirtualMemory (-1, (0x755c1000), 4096, 32, ... (0x755c1000), 4096, 4, ) == 0x0 00983 464 NtFlushInstructionCache (-1, 1968967680, 860, ... ) == 0x0 00984 464 NtProtectVirtualMemory (-1, (0x755c1000), 860, 4, ... (0x755c1000), 4096, 32, ) == 0x0 00985 464 NtProtectVirtualMemory (-1, (0x755c1000), 4096, 32, ... (0x755c1000), 4096, 4, ) == 0x0 00986 464 NtFlushInstructionCache (-1, 1968967680, 860, ... ) == 0x0 00987 464 NtProtectVirtualMemory (-1, (0x755c1000), 860, 4, ... (0x755c1000), 4096, 32, ) == 0x0 00988 464 NtProtectVirtualMemory (-1, (0x755c1000), 4096, 32, ... (0x755c1000), 4096, 4, ) == 0x0 00989 464 NtFlushInstructionCache (-1, 1968967680, 860, ... ) == 0x0 00990 464 NtProtectVirtualMemory (-1, (0x755c1000), 860, 4, ... (0x755c1000), 4096, 32, ) == 0x0 00991 464 NtProtectVirtualMemory (-1, (0x755c1000), 4096, 32, ... (0x755c1000), 4096, 4, ) == 0x0 00992 464 NtFlushInstructionCache (-1, 1968967680, 860, ... ) == 0x0 00993 464 NtProtectVirtualMemory (-1, (0x755c1000), 860, 4, ... (0x755c1000), 4096, 32, ) == 0x0 00994 464 NtProtectVirtualMemory (-1, (0x755c1000), 4096, 32, ... (0x755c1000), 4096, 4, ) == 0x0 00995 464 NtFlushInstructionCache (-1, 1968967680, 860, ... ) == 0x0 00996 464 NtOpenKey (0x80000000, {24, 0, 0x40, 0, 0, (0x80000000, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msctfime.ime"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 00997 464 NtUserGetDC (0, ... ) == 0x1010052 00998 464 NtUserSystemParametersInfo (66, 12, 1238840, 0, ... ) == 0x1 00999 464 NtUserCallOneParam (16842834, 57, ... ) == 0x1 01000 464 NtQueryVirtualMemory (-1, 0x7c91ca50, Basic, 28, ... {BaseAddress=0x7c91c000,AllocationBase=0x7c900000,AllocationProtect=0x80,RegionSize=0x60000,State=0x1000,Protect=0x20,Type=0x1000000,}, 28, ) == 0x0 01001 464 NtQueryVirtualMemory (-1, 0x7c9163a8, Basic, 28, ... {BaseAddress=0x7c916000,AllocationBase=0x7c900000,AllocationProtect=0x80,RegionSize=0x66000,State=0x1000,Protect=0x20,Type=0x1000000,}, 28, ) == 0x0 01002 464 NtQueryDebugFilterState (87, 3, ... ) == 0x0 01003 464 NtQueryDebugFilterState (87, 3, ... ) == 0x0 01004 464 NtContinue (1237044, 0, ... 01005 464 NtQueryDebugFilterState (87, 3, ... ) == 0x0 01006 464 NtUnmapViewOfSection (-1, 0x755c0000, ... ) == 0x0 01007 464 NtQueryDebugFilterState (87, 3, ... ) == 0x0 01008 464 NtUserMessageCall (0x90114, WM_NCCREATE, 0x0, 0x12f388, 0, 670, 0, ... ) == 0x1 01009 464 NtOpenKey (0x2000000, {24, 16, 0x40, 0, 0, (0x2000000, {24, 16, 0x40, 0, 0, "Software\Microsoft\Windows NT\CurrentVersion\IMM"}, ... 128, ) }, ... 128, ) == 0x0 01010 464 NtQueryValueKey (128, (128, "Ime File", Partial, 144, ... TitleIdx=0, Type=1, Data="m\0s\0c\0t\0f\0i\0m\0e\0.\0i\0m\0e\0\0\0"}, 38, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (128, "Ime File", Partial, 144, ... TitleIdx=0, Type=1, Data="m\0s\0c\0t\0f\0i\0m\0e\0.\0i\0m\0e\0\0\0"}, 38, ) }, 38, ) == 0x0 01011 464 NtClose (128, ... ) == 0x0 01012 464 NtQueryInformationProcess (-1, DefaultHardErrorMode, 4, ... {process info, class 12, size 4}, 0x0, ) == 0x0 01013 464 NtSetInformationProcess (-1, DefaultHardErrorMode, {process info, class 12, size 4}, 4, ... ) == 0x0 01014 464 NtQueryAttributesFile ({24, 0, 0x40, 0, 0, ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\msctfime.ime"}, 1238468, ... ) }, 1238468, ... ) == 0x0 01015 464 NtOpenFile (0x100020, {24, 0, 0x40, 0, 0, (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\msctfime.ime"}, 5, 96, ... 128, {status=0x0, info=1}, ) }, 5, 96, ... 128, {status=0x0, info=1}, ) == 0x0 01016 464 NtCreateSection (0xe, 0x0, 0x0, 16, 134217728, 128, ... 132, ) == 0x0 01017 464 NtClose (128, ... ) == 0x0 01018 464 NtMapViewOfSection (132, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 16, ... (0xbf0000), 0x0, 180224, ) == 0x0 01019 464 NtClose (132, ... ) == 0x0 01020 464 NtUnmapViewOfSection (-1, 0xbf0000, ... ) == 0x0 01021 464 NtQueryAttributesFile ({24, 0, 0x40, 0, 0, ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\msctfime.ime"}, 1238064, ... ) }, 1238064, ... ) == 0x0 01022 464 NtCreateFile (0x80100080, {24, 0, 0x40, 0, 1238808, (0x80100080, {24, 0, 0x40, 0, 1238808, "\??\C:\WINDOWS\system32\msctfime.ime"}, 0x0, 0, 5, 1, 96, 0, 0, ... 132, {status=0x0, info=1}, ) }, 0x0, 0, 5, 1, 96, 0, 0, ... 132, {status=0x0, info=1}, ) == 0x0 01023 464 NtCreateSection (0xf0005, 0x0, 0x0, 2, 134217728, 132, ... 128, ) == 0x0 01024 464 NtClose (132, ... ) == 0x0 01025 464 NtMapViewOfSection (128, -1, (0x0), 0, 0, {0, 0}, 0, 1, 0, 2, ... (0xbf0000), {0, 0}, 180224, ) == 0x0 01026 464 NtClose (128, ... ) == 0x0 01027 464 NtQueryInformationProcess (-1, DefaultHardErrorMode, 4, ... {process info, class 12, size 4}, 0x0, ) == 0x0 01028 464 NtSetInformationProcess (-1, DefaultHardErrorMode, {process info, class 12, size 4}, 4, ... ) == 0x0 01029 464 NtQueryDefaultLocale (1, 1239428, ... ) == 0x0 01030 464 NtQueryVirtualMemory (-1, 0xbf0000, Basic, 28, ... {BaseAddress=0xbf0000,AllocationBase=0xbf0000,AllocationProtect=0x2,RegionSize=0x2c000,State=0x1000,Protect=0x2,Type=0x40000,}, 0x0, ) == 0x0 01031 464 NtQueryVirtualMemory (-1, 0xbf0000, Basic, 28, ... {BaseAddress=0xbf0000,AllocationBase=0xbf0000,AllocationProtect=0x2,RegionSize=0x2c000,State=0x1000,Protect=0x2,Type=0x40000,}, 0x0, ) == 0x0 01032 464 NtUnmapViewOfSection (-1, 0xbf0000, ... ) == 0x0 01033 464 NtAllocateVirtualMemory (-1, 1372160, 0, 4096, 4096, 4, ... 1372160, 4096, ) == 0x0 01034 464 NtQueryInformationProcess (-1, DefaultHardErrorMode, 4, ... {process info, class 12, size 4}, 0x0, ) == 0x0 01035 464 NtSetInformationProcess (-1, DefaultHardErrorMode, {process info, class 12, size 4}, 4, ... ) == 0x0 01036 464 NtQueryAttributesFile ({24, 0, 0x40, 0, 0, ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\msctfime.ime"}, 1238460, ... ) }, 1238460, ... ) == 0x0 01037 464 NtOpenFile (0x100020, {24, 0, 0x40, 0, 0, (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\msctfime.ime"}, 5, 96, ... 128, {status=0x0, info=1}, ) }, 5, 96, ... 128, {status=0x0, info=1}, ) == 0x0 01038 464 NtCreateSection (0xe, 0x0, 0x0, 16, 134217728, 128, ... 132, ) == 0x0 01039 464 NtClose (128, ... ) == 0x0 01040 464 NtMapViewOfSection (132, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 16, ... (0xbf0000), 0x0, 180224, ) == 0x0 01041 464 NtClose (132, ... ) == 0x0 01042 464 NtUnmapViewOfSection (-1, 0xbf0000, ... ) == 0x0 01043 464 NtQueryAttributesFile ({24, 0, 0x40, 0, 0, ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\msctfime.ime"}, 1238056, ... ) }, 1238056, ... ) == 0x0 01044 464 NtCreateFile (0x80100080, {24, 0, 0x40, 0, 1238800, (0x80100080, {24, 0, 0x40, 0, 1238800, "\??\C:\WINDOWS\system32\msctfime.ime"}, 0x0, 0, 5, 1, 96, 0, 0, ... 132, {status=0x0, info=1}, ) }, 0x0, 0, 5, 1, 96, 0, 0, ... 132, {status=0x0, info=1}, ) == 0x0 01045 464 NtCreateSection (0xf0005, 0x0, 0x0, 2, 134217728, 132, ... 128, ) == 0x0 01046 464 NtClose (132, ... ) == 0x0 01047 464 NtMapViewOfSection (128, -1, (0x0), 0, 0, {0, 0}, 0, 1, 0, 2, ... (0xbf0000), {0, 0}, 180224, ) == 0x0 01048 464 NtClose (128, ... ) == 0x0 01049 464 NtQueryInformationProcess (-1, DefaultHardErrorMode, 4, ... {process info, class 12, size 4}, 0x0, ) == 0x0 01050 464 NtSetInformationProcess (-1, DefaultHardErrorMode, {process info, class 12, size 4}, 4, ... ) == 0x0 01051 464 NtQueryDefaultLocale (1, 1239420, ... ) == 0x0 01052 464 NtQueryVirtualMemory (-1, 0xbf0000, Basic, 28, ... {BaseAddress=0xbf0000,AllocationBase=0xbf0000,AllocationProtect=0x2,RegionSize=0x2c000,State=0x1000,Protect=0x2,Type=0x40000,}, 0x0, ) == 0x0 01053 464 NtUnmapViewOfSection (-1, 0xbf0000, ... ) == 0x0 01054 464 NtWaitForSingleObject (120, 0, {-1000000, -1}, ... ) == 0x0 01055 464 NtOpenThreadTokenEx (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN 01056 464 NtOpenProcessTokenEx (-1, 0x20008, 512, ... 128, ) == 0x0 01057 464 NtQueryInformationToken (128, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0 01058 464 NtClose (128, ... ) == 0x0 01059 464 NtOpenKey (0x20019, {24, 0, 0x40, 0, 0, (0x20019, {24, 0, 0x40, 0, 0, "\REGISTRY\USER\S-1-5-21-1292428093-1383384898-725345543-1003\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Layers"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 01060 464 NtReleaseMutant (120, ... 0x0, ) == 0x0 01061 464 NtQueryAttributesFile ({24, 0, 0x40, 0, 0, ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\msctfime.ime"}, 1238440, ... ) }, 1238440, ... ) == 0x0 01062 464 NtOpenFile (0x100020, {24, 0, 0x40, 0, 0, (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\msctfime.ime"}, 5, 96, ... 128, {status=0x0, info=1}, ) }, 5, 96, ... 128, {status=0x0, info=1}, ) == 0x0 01063 464 NtCreateSection (0xe, 0x0, 0x0, 16, 134217728, 128, ... 132, ) == 0x0 01064 464 NtClose (128, ... ) == 0x0 01065 464 NtMapViewOfSection (132, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 16, ... (0xbf0000), 0x0, 180224, ) == 0x0 01066 464 NtClose (132, ... ) == 0x0 01067 464 NtUnmapViewOfSection (-1, 0xbf0000, ... ) == 0x0 01068 464 NtQueryAttributesFile ({24, 0, 0x40, 0, 0, ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\msctfime.ime"}, 1238748, ... ) }, 1238748, ... ) == 0x0 01069 464 NtOpenFile (0x100020, {24, 0, 0x40, 0, 0, (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\msctfime.ime"}, 5, 96, ... 132, {status=0x0, info=1}, ) }, 5, 96, ... 132, {status=0x0, info=1}, ) == 0x0 01070 464 NtCreateSection (0xf, 0x0, 0x0, 16, 16777216, 132, ... 128, ) == 0x0 01071 464 NtQuerySection (128, Image, 48, ... {section info, class 1, size 48}, 0x0, ) == 0x0 01072 464 NtClose (132, ... ) == 0x0 01073 464 NtMapViewOfSection (128, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x755c0000), 0x0, 188416, ) == 0x0 01074 464 NtClose (128, ... ) == 0x0 01075 464 NtProtectVirtualMemory (-1, (0x755c1000), 860, 4, ... (0x755c1000), 4096, 32, ) == 0x0 01076 464 NtProtectVirtualMemory (-1, (0x755c1000), 4096, 32, ... (0x755c1000), 4096, 4, ) == 0x0 01077 464 NtFlushInstructionCache (-1, 1968967680, 860, ... ) == 0x0 01078 464 NtProtectVirtualMemory (-1, (0x755c1000), 860, 4, ... (0x755c1000), 4096, 32, ) == 0x0 01079 464 NtProtectVirtualMemory (-1, (0x755c1000), 4096, 32, ... (0x755c1000), 4096, 4, ) == 0x0 01080 464 NtFlushInstructionCache (-1, 1968967680, 860, ... ) == 0x0 01081 464 NtProtectVirtualMemory (-1, (0x755c1000), 860, 4, ... (0x755c1000), 4096, 32, ) == 0x0 01082 464 NtProtectVirtualMemory (-1, (0x755c1000), 4096, 32, ... (0x755c1000), 4096, 4, ) == 0x0 01083 464 NtFlushInstructionCache (-1, 1968967680, 860, ... ) == 0x0 01084 464 NtProtectVirtualMemory (-1, (0x755c1000), 860, 4, ... (0x755c1000), 4096, 32, ) == 0x0 01085 464 NtProtectVirtualMemory (-1, (0x755c1000), 4096, 32, ... (0x755c1000), 4096, 4, ) == 0x0 01086 464 NtFlushInstructionCache (-1, 1968967680, 860, ... ) == 0x0 01087 464 NtProtectVirtualMemory (-1, (0x755c1000), 860, 4, ... (0x755c1000), 4096, 32, ) == 0x0 01088 464 NtProtectVirtualMemory (-1, (0x755c1000), 4096, 32, ... (0x755c1000), 4096, 4, ) == 0x0 01089 464 NtFlushInstructionCache (-1, 1968967680, 860, ... ) == 0x0 01090 464 NtProtectVirtualMemory (-1, (0x755c1000), 860, 4, ... (0x755c1000), 4096, 32, ) == 0x0 01091 464 NtProtectVirtualMemory (-1, (0x755c1000), 4096, 32, ... (0x755c1000), 4096, 4, ) == 0x0 01092 464 NtFlushInstructionCache (-1, 1968967680, 860, ... ) == 0x0 01093 464 NtOpenKey (0x80000000, {24, 0, 0x40, 0, 0, (0x80000000, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msctfime.ime"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 01094 464 NtUserGetDC (0, ... ) == 0x1010052 01095 464 NtUserSystemParametersInfo (66, 12, 1238936, 0, ... ) == 0x1 01096 464 NtUserCallOneParam (16842834, 57, ... ) == 0x1 01097 464 NtQueryDebugFilterState (87, 3, ... ) == 0x0 01098 464 NtQueryDebugFilterState (87, 3, ... ) == 0x0 01099 464 NtContinue (1237140, 0, ... 01100 464 NtQueryDebugFilterState (87, 3, ... ) == 0x0 01101 464 NtUnmapViewOfSection (-1, 0x755c0000, ... ) == 0x0 01102 464 NtQueryDebugFilterState (87, 3, ... ) == 0x0 01103 464 NtUserMessageCall (0x90114, WM_NCCALCSIZE, 0x0, 0x12f3cc, 0, 670, 0, ... ) == 0x0 01104 464 NtUserSetProp (590100, 43288, -1, ... ) == 0x1 01105 464 NtOpenKey (0x2000000, {24, 16, 0x40, 0, 0, (0x2000000, {24, 16, 0x40, 0, 0, "Software\Microsoft\Windows NT\CurrentVersion\IMM"}, ... 128, ) }, ... 128, ) == 0x0 01106 464 NtQueryValueKey (128, (128, "Ime File", Partial, 144, ... TitleIdx=0, Type=1, Data="m\0s\0c\0t\0f\0i\0m\0e\0.\0i\0m\0e\0\0\0"}, 38, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (128, "Ime File", Partial, 144, ... TitleIdx=0, Type=1, Data="m\0s\0c\0t\0f\0i\0m\0e\0.\0i\0m\0e\0\0\0"}, 38, ) }, 38, ) == 0x0 01107 464 NtClose (128, ... ) == 0x0 01108 464 NtQueryInformationProcess (-1, DefaultHardErrorMode, 4, ... {process info, class 12, size 4}, 0x0, ) == 0x0 01109 464 NtSetInformationProcess (-1, DefaultHardErrorMode, {process info, class 12, size 4}, 4, ... ) == 0x0 01110 464 NtQueryAttributesFile ({24, 0, 0x40, 0, 0, ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\msctfime.ime"}, 1238372, ... ) }, 1238372, ... ) == 0x0 01111 464 NtOpenFile (0x100020, {24, 0, 0x40, 0, 0, (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\msctfime.ime"}, 5, 96, ... 128, {status=0x0, info=1}, ) }, 5, 96, ... 128, {status=0x0, info=1}, ) == 0x0 01112 464 NtCreateSection (0xe, 0x0, 0x0, 16, 134217728, 128, ... 132, ) == 0x0 01113 464 NtClose (128, ... ) == 0x0 01114 464 NtMapViewOfSection (132, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 16, ... (0xbf0000), 0x0, 180224, ) == 0x0 01115 464 NtClose (132, ... ) == 0x0 01116 464 NtUnmapViewOfSection (-1, 0xbf0000, ... ) == 0x0 01117 464 NtQueryAttributesFile ({24, 0, 0x40, 0, 0, ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\msctfime.ime"}, 1237968, ... ) }, 1237968, ... ) == 0x0 01118 464 NtCreateFile (0x80100080, {24, 0, 0x40, 0, 1238712, (0x80100080, {24, 0, 0x40, 0, 1238712, "\??\C:\WINDOWS\system32\msctfime.ime"}, 0x0, 0, 5, 1, 96, 0, 0, ... 132, {status=0x0, info=1}, ) }, 0x0, 0, 5, 1, 96, 0, 0, ... 132, {status=0x0, info=1}, ) == 0x0 01119 464 NtCreateSection (0xf0005, 0x0, 0x0, 2, 134217728, 132, ... 128, ) == 0x0 01120 464 NtClose (132, ... ) == 0x0 01121 464 NtMapViewOfSection (128, -1, (0x0), 0, 0, {0, 0}, 0, 1, 0, 2, ... (0xbf0000), {0, 0}, 180224, ) == 0x0 01122 464 NtClose (128, ... ) == 0x0 01123 464 NtQueryInformationProcess (-1, DefaultHardErrorMode, 4, ... {process info, class 12, size 4}, 0x0, ) == 0x0 01124 464 NtSetInformationProcess (-1, DefaultHardErrorMode, {process info, class 12, size 4}, 4, ... ) == 0x0 01125 464 NtQueryDefaultLocale (1, 1239332, ... ) == 0x0 01126 464 NtQueryVirtualMemory (-1, 0xbf0000, Basic, 28, ... {BaseAddress=0xbf0000,AllocationBase=0xbf0000,AllocationProtect=0x2,RegionSize=0x2c000,State=0x1000,Protect=0x2,Type=0x40000,}, 0x0, ) == 0x0 01127 464 NtQueryVirtualMemory (-1, 0xbf0000, Basic, 28, ... {BaseAddress=0xbf0000,AllocationBase=0xbf0000,AllocationProtect=0x2,RegionSize=0x2c000,State=0x1000,Protect=0x2,Type=0x40000,}, 0x0, ) == 0x0 01128 464 NtUnmapViewOfSection (-1, 0xbf0000, ... ) == 0x0 01129 464 NtQueryInformationProcess (-1, DefaultHardErrorMode, 4, ... {process info, class 12, size 4}, 0x0, ) == 0x0 01130 464 NtSetInformationProcess (-1, DefaultHardErrorMode, {process info, class 12, size 4}, 4, ... ) == 0x0 01131 464 NtQueryAttributesFile ({24, 0, 0x40, 0, 0, ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\msctfime.ime"}, 1238364, ... ) }, 1238364, ... ) == 0x0 01132 464 NtOpenFile (0x100020, {24, 0, 0x40, 0, 0, (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\msctfime.ime"}, 5, 96, ... 128, {status=0x0, info=1}, ) }, 5, 96, ... 128, {status=0x0, info=1}, ) == 0x0 01133 464 NtCreateSection (0xe, 0x0, 0x0, 16, 134217728, 128, ... 132, ) == 0x0 01134 464 NtClose (128, ... ) == 0x0 01135 464 NtMapViewOfSection (132, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 16, ... (0xbf0000), 0x0, 180224, ) == 0x0 01136 464 NtClose (132, ... ) == 0x0 01137 464 NtUnmapViewOfSection (-1, 0xbf0000, ... ) == 0x0 01138 464 NtQueryAttributesFile ({24, 0, 0x40, 0, 0, ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\msctfime.ime"}, 1237960, ... ) }, 1237960, ... ) == 0x0 01139 464 NtCreateFile (0x80100080, {24, 0, 0x40, 0, 1238704, (0x80100080, {24, 0, 0x40, 0, 1238704, "\??\C:\WINDOWS\system32\msctfime.ime"}, 0x0, 0, 5, 1, 96, 0, 0, ... 132, {status=0x0, info=1}, ) }, 0x0, 0, 5, 1, 96, 0, 0, ... 132, {status=0x0, info=1}, ) == 0x0 01140 464 NtCreateSection (0xf0005, 0x0, 0x0, 2, 134217728, 132, ... 128, ) == 0x0 01141 464 NtClose (132, ... ) == 0x0 01142 464 NtMapViewOfSection (128, -1, (0x0), 0, 0, {0, 0}, 0, 1, 0, 2, ... (0xbf0000), {0, 0}, 180224, ) == 0x0 01143 464 NtClose (128, ... ) == 0x0 01144 464 NtQueryInformationProcess (-1, DefaultHardErrorMode, 4, ... {process info, class 12, size 4}, 0x0, ) == 0x0 01145 464 NtSetInformationProcess (-1, DefaultHardErrorMode, {process info, class 12, size 4}, 4, ... ) == 0x0 01146 464 NtQueryDefaultLocale (1, 1239324, ... ) == 0x0 01147 464 NtQueryVirtualMemory (-1, 0xbf0000, Basic, 28, ... {BaseAddress=0xbf0000,AllocationBase=0xbf0000,AllocationProtect=0x2,RegionSize=0x2c000,State=0x1000,Protect=0x2,Type=0x40000,}, 0x0, ) == 0x0 01148 464 NtUnmapViewOfSection (-1, 0xbf0000, ... ) == 0x0 01149 464 NtWaitForSingleObject (120, 0, {-1000000, -1}, ... ) == 0x0 01150 464 NtOpenThreadTokenEx (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN 01151 464 NtOpenProcessTokenEx (-1, 0x20008, 512, ... 128, ) == 0x0 01152 464 NtQueryInformationToken (128, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0 01153 464 NtClose (128, ... ) == 0x0 01154 464 NtOpenKey (0x20019, {24, 0, 0x40, 0, 0, (0x20019, {24, 0, 0x40, 0, 0, "\REGISTRY\USER\S-1-5-21-1292428093-1383384898-725345543-1003\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Layers"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 01155 464 NtReleaseMutant (120, ... 0x0, ) == 0x0 01156 464 NtQueryAttributesFile ({24, 0, 0x40, 0, 0, ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\msctfime.ime"}, 1238344, ... ) }, 1238344, ... ) == 0x0 01157 464 NtOpenFile (0x100020, {24, 0, 0x40, 0, 0, (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\msctfime.ime"}, 5, 96, ... 128, {status=0x0, info=1}, ) }, 5, 96, ... 128, {status=0x0, info=1}, ) == 0x0 01158 464 NtCreateSection (0xe, 0x0, 0x0, 16, 134217728, 128, ... 132, ) == 0x0 01159 464 NtClose (128, ... ) == 0x0 01160 464 NtMapViewOfSection (132, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 16, ... (0xbf0000), 0x0, 180224, ) == 0x0 01161 464 NtClose (132, ... ) == 0x0 01162 464 NtUnmapViewOfSection (-1, 0xbf0000, ... ) == 0x0 01163 464 NtQueryAttributesFile ({24, 0, 0x40, 0, 0, ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\msctfime.ime"}, 1238652, ... ) }, 1238652, ... ) == 0x0 01164 464 NtOpenFile (0x100020, {24, 0, 0x40, 0, 0, (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\msctfime.ime"}, 5, 96, ... 132, {status=0x0, info=1}, ) }, 5, 96, ... 132, {status=0x0, info=1}, ) == 0x0 01165 464 NtCreateSection (0xf, 0x0, 0x0, 16, 16777216, 132, ... 128, ) == 0x0 01166 464 NtQuerySection (128, Image, 48, ... {section info, class 1, size 48}, 0x0, ) == 0x0 01167 464 NtClose (132, ... ) == 0x0 01168 464 NtMapViewOfSection (128, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x755c0000), 0x0, 188416, ) == 0x0 01169 464 NtClose (128, ... ) == 0x0 01170 464 NtProtectVirtualMemory (-1, (0x755c1000), 860, 4, ... (0x755c1000), 4096, 32, ) == 0x0 01171 464 NtProtectVirtualMemory (-1, (0x755c1000), 4096, 32, ... (0x755c1000), 4096, 4, ) == 0x0 01172 464 NtFlushInstructionCache (-1, 1968967680, 860, ... ) == 0x0 01173 464 NtProtectVirtualMemory (-1, (0x755c1000), 860, 4, ... (0x755c1000), 4096, 32, ) == 0x0 01174 464 NtProtectVirtualMemory (-1, (0x755c1000), 4096, 32, ... (0x755c1000), 4096, 4, ) == 0x0 01175 464 NtFlushInstructionCache (-1, 1968967680, 860, ... ) == 0x0 01176 464 NtProtectVirtualMemory (-1, (0x755c1000), 860, 4, ... (0x755c1000), 4096, 32, ) == 0x0 01177 464 NtProtectVirtualMemory (-1, (0x755c1000), 4096, 32, ... (0x755c1000), 4096, 4, ) == 0x0 01178 464 NtFlushInstructionCache (-1, 1968967680, 860, ... ) == 0x0 01179 464 NtProtectVirtualMemory (-1, (0x755c1000), 860, 4, ... (0x755c1000), 4096, 32, ) == 0x0 01180 464 NtProtectVirtualMemory (-1, (0x755c1000), 4096, 32, ... (0x755c1000), 4096, 4, ) == 0x0 01181 464 NtFlushInstructionCache (-1, 1968967680, 860, ... ) == 0x0 01182 464 NtProtectVirtualMemory (-1, (0x755c1000), 860, 4, ... (0x755c1000), 4096, 32, ) == 0x0 01183 464 NtProtectVirtualMemory (-1, (0x755c1000), 4096, 32, ... (0x755c1000), 4096, 4, ) == 0x0 01184 464 NtFlushInstructionCache (-1, 1968967680, 860, ... ) == 0x0 01185 464 NtProtectVirtualMemory (-1, (0x755c1000), 860, 4, ... (0x755c1000), 4096, 32, ) == 0x0 01186 464 NtProtectVirtualMemory (-1, (0x755c1000), 4096, 32, ... (0x755c1000), 4096, 4, ) == 0x0 01187 464 NtFlushInstructionCache (-1, 1968967680, 860, ... ) == 0x0 01188 464 NtOpenKey (0x80000000, {24, 0, 0x40, 0, 0, (0x80000000, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msctfime.ime"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 01189 464 NtUserGetDC (0, ... ) == 0x1010052 01190 464 NtUserSystemParametersInfo (66, 12, 1238840, 0, ... ) == 0x1 01191 464 NtUserCallOneParam (16842834, 57, ... ) == 0x1 01192 464 NtQueryDebugFilterState (87, 3, ... ) == 0x0 01193 464 NtQueryDebugFilterState (87, 3, ... ) == 0x0 01194 464 NtContinue (1237044, 0, ... 01195 464 NtQueryDebugFilterState (87, 3, ... ) == 0x0 01196 464 NtUnmapViewOfSection (-1, 0x755c0000, ... ) == 0x0 01197 464 NtQueryDebugFilterState (87, 3, ... ) == 0x0 01198 464 NtUserValidateHandleSecure (655618, ... ) == 0x1 01199 464 NtUserValidateHandleSecure (7536899, ... ) == 0x1 01200 464 NtUserValidateHandleSecure (7536899, ... ) == 0x1 01201 464 NtUserUpdateInputContext (7536899, 1, 590100, ... ) == 0x1 01202 464 NtOpenKey (0x2000000, {24, 16, 0x40, 0, 0, (0x2000000, {24, 16, 0x40, 0, 0, "Software\Microsoft\Windows NT\CurrentVersion\IMM"}, ... 128, ) }, ... 128, ) == 0x0 01203 464 NtQueryValueKey (128, (128, "Ime File", Partial, 144, ... TitleIdx=0, Type=1, Data="m\0s\0c\0t\0f\0i\0m\0e\0.\0i\0m\0e\0\0\0"}, 38, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (128, "Ime File", Partial, 144, ... TitleIdx=0, Type=1, Data="m\0s\0c\0t\0f\0i\0m\0e\0.\0i\0m\0e\0\0\0"}, 38, ) }, 38, ) == 0x0 01204 464 NtClose (128, ... ) == 0x0 01205 464 NtQueryInformationProcess (-1, DefaultHardErrorMode, 4, ... {process info, class 12, size 4}, 0x0, ) == 0x0 01206 464 NtSetInformationProcess (-1, DefaultHardErrorMode, {process info, class 12, size 4}, 4, ... ) == 0x0 01207 464 NtQueryAttributesFile ({24, 0, 0x40, 0, 0, ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\msctfime.ime"}, 1238480, ... ) }, 1238480, ... ) == 0x0 01208 464 NtOpenFile (0x100020, {24, 0, 0x40, 0, 0, (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\msctfime.ime"}, 5, 96, ... 128, {status=0x0, info=1}, ) }, 5, 96, ... 128, {status=0x0, info=1}, ) == 0x0 01209 464 NtCreateSection (0xe, 0x0, 0x0, 16, 134217728, 128, ... 132, ) == 0x0 01210 464 NtClose (128, ... ) == 0x0 01211 464 NtMapViewOfSection (132, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 16, ... (0xbf0000), 0x0, 180224, ) == 0x0 01212 464 NtClose (132, ... ) == 0x0 01213 464 NtUnmapViewOfSection (-1, 0xbf0000, ... ) == 0x0 01214 464 NtQueryAttributesFile ({24, 0, 0x40, 0, 0, ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\msctfime.ime"}, 1238076, ... ) }, 1238076, ... ) == 0x0 01215 464 NtCreateFile (0x80100080, {24, 0, 0x40, 0, 1238820, (0x80100080, {24, 0, 0x40, 0, 1238820, "\??\C:\WINDOWS\system32\msctfime.ime"}, 0x0, 0, 5, 1, 96, 0, 0, ... 132, {status=0x0, info=1}, ) }, 0x0, 0, 5, 1, 96, 0, 0, ... 132, {status=0x0, info=1}, ) == 0x0 01216 464 NtCreateSection (0xf0005, 0x0, 0x0, 2, 134217728, 132, ... 128, ) == 0x0 01217 464 NtClose (132, ... ) == 0x0 01218 464 NtMapViewOfSection (128, -1, (0x0), 0, 0, {0, 0}, 0, 1, 0, 2, ... (0xbf0000), {0, 0}, 180224, ) == 0x0 01219 464 NtClose (128, ... ) == 0x0 01220 464 NtQueryInformationProcess (-1, DefaultHardErrorMode, 4, ... {process info, class 12, size 4}, 0x0, ) == 0x0 01221 464 NtSetInformationProcess (-1, DefaultHardErrorMode, {process info, class 12, size 4}, 4, ... ) == 0x0 01222 464 NtQueryDefaultLocale (1, 1239440, ... ) == 0x0 01223 464 NtQueryVirtualMemory (-1, 0xbf0000, Basic, 28, ... {BaseAddress=0xbf0000,AllocationBase=0xbf0000,AllocationProtect=0x2,RegionSize=0x2c000,State=0x1000,Protect=0x2,Type=0x40000,}, 0x0, ) == 0x0 01224 464 NtQueryVirtualMemory (-1, 0xbf0000, Basic, 28, ... {BaseAddress=0xbf0000,AllocationBase=0xbf0000,AllocationProtect=0x2,RegionSize=0x2c000,State=0x1000,Protect=0x2,Type=0x40000,}, 0x0, ) == 0x0 01225 464 NtUnmapViewOfSection (-1, 0xbf0000, ... ) == 0x0 01226 464 NtQueryInformationProcess (-1, DefaultHardErrorMode, 4, ... {process info, class 12, size 4}, 0x0, ) == 0x0 01227 464 NtSetInformationProcess (-1, DefaultHardErrorMode, {process info, class 12, size 4}, 4, ... ) == 0x0 01228 464 NtQueryAttributesFile ({24, 0, 0x40, 0, 0, ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\msctfime.ime"}, 1238472, ... ) }, 1238472, ... ) == 0x0 01229 464 NtOpenFile (0x100020, {24, 0, 0x40, 0, 0, (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\msctfime.ime"}, 5, 96, ... 128, {status=0x0, info=1}, ) }, 5, 96, ... 128, {status=0x0, info=1}, ) == 0x0 01230 464 NtCreateSection (0xe, 0x0, 0x0, 16, 134217728, 128, ... 132, ) == 0x0 01231 464 NtClose (128, ... ) == 0x0 01232 464 NtMapViewOfSection (132, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 16, ... (0xbf0000), 0x0, 180224, ) == 0x0 01233 464 NtClose (132, ... ) == 0x0 01234 464 NtUnmapViewOfSection (-1, 0xbf0000, ... ) == 0x0 01235 464 NtQueryAttributesFile ({24, 0, 0x40, 0, 0, ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\msctfime.ime"}, 1238068, ... ) }, 1238068, ... ) == 0x0 01236 464 NtCreateFile (0x80100080, {24, 0, 0x40, 0, 1238812, (0x80100080, {24, 0, 0x40, 0, 1238812, "\??\C:\WINDOWS\system32\msctfime.ime"}, 0x0, 0, 5, 1, 96, 0, 0, ... 132, {status=0x0, info=1}, ) }, 0x0, 0, 5, 1, 96, 0, 0, ... 132, {status=0x0, info=1}, ) == 0x0 01237 464 NtCreateSection (0xf0005, 0x0, 0x0, 2, 134217728, 132, ... 128, ) == 0x0 01238 464 NtClose (132, ... ) == 0x0 01239 464 NtMapViewOfSection (128, -1, (0x0), 0, 0, {0, 0}, 0, 1, 0, 2, ... (0xbf0000), {0, 0}, 180224, ) == 0x0 01240 464 NtClose (128, ... ) == 0x0 01241 464 NtQueryInformationProcess (-1, DefaultHardErrorMode, 4, ... {process info, class 12, size 4}, 0x0, ) == 0x0 01242 464 NtSetInformationProcess (-1, DefaultHardErrorMode, {process info, class 12, size 4}, 4, ... ) == 0x0 01243 464 NtQueryDefaultLocale (1, 1239432, ... ) == 0x0 01244 464 NtQueryVirtualMemory (-1, 0xbf0000, Basic, 28, ... {BaseAddress=0xbf0000,AllocationBase=0xbf0000,AllocationProtect=0x2,RegionSize=0x2c000,State=0x1000,Protect=0x2,Type=0x40000,}, 0x0, ) == 0x0 01245 464 NtUnmapViewOfSection (-1, 0xbf0000, ... ) == 0x0 01246 464 NtWaitForSingleObject (120, 0, {-1000000, -1}, ... ) == 0x0 01247 464 NtOpenThreadTokenEx (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN 01248 464 NtOpenProcessTokenEx (-1, 0x20008, 512, ... 128, ) == 0x0 01249 464 NtQueryInformationToken (128, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0 01250 464 NtClose (128, ... ) == 0x0 01251 464 NtOpenKey (0x20019, {24, 0, 0x40, 0, 0, (0x20019, {24, 0, 0x40, 0, 0, "\REGISTRY\USER\S-1-5-21-1292428093-1383384898-725345543-1003\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Layers"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 01252 464 NtReleaseMutant (120, ... 0x0, ) == 0x0 01253 464 NtQueryAttributesFile ({24, 0, 0x40, 0, 0, ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\msctfime.ime"}, 1238452, ... ) }, 1238452, ... ) == 0x0 01254 464 NtOpenFile (0x100020, {24, 0, 0x40, 0, 0, (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\msctfime.ime"}, 5, 96, ... 128, {status=0x0, info=1}, ) }, 5, 96, ... 128, {status=0x0, info=1}, ) == 0x0 01255 464 NtCreateSection (0xe, 0x0, 0x0, 16, 134217728, 128, ... 132, ) == 0x0 01256 464 NtClose (128, ... ) == 0x0 01257 464 NtMapViewOfSection (132, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 16, ... (0xbf0000), 0x0, 180224, ) == 0x0 01258 464 NtClose (132, ... ) == 0x0 01259 464 NtUnmapViewOfSection (-1, 0xbf0000, ... ) == 0x0 01260 464 NtQueryAttributesFile ({24, 0, 0x40, 0, 0, ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\msctfime.ime"}, 1238760, ... ) }, 1238760, ... ) == 0x0 01261 464 NtOpenFile (0x100020, {24, 0, 0x40, 0, 0, (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\msctfime.ime"}, 5, 96, ... 132, {status=0x0, info=1}, ) }, 5, 96, ... 132, {status=0x0, info=1}, ) == 0x0 01262 464 NtCreateSection (0xf, 0x0, 0x0, 16, 16777216, 132, ... 128, ) == 0x0 01263 464 NtQuerySection (128, Image, 48, ... {section info, class 1, size 48}, 0x0, ) == 0x0 01264 464 NtClose (132, ... ) == 0x0 01265 464 NtMapViewOfSection (128, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x755c0000), 0x0, 188416, ) == 0x0 01266 464 NtClose (128, ... ) == 0x0 01267 464 NtProtectVirtualMemory (-1, (0x755c1000), 860, 4, ... (0x755c1000), 4096, 32, ) == 0x0 01268 464 NtProtectVirtualMemory (-1, (0x755c1000), 4096, 32, ... (0x755c1000), 4096, 4, ) == 0x0 01269 464 NtFlushInstructionCache (-1, 1968967680, 860, ... ) == 0x0 01270 464 NtProtectVirtualMemory (-1, (0x755c1000), 860, 4, ... (0x755c1000), 4096, 32, ) == 0x0 01271 464 NtProtectVirtualMemory (-1, (0x755c1000), 4096, 32, ... (0x755c1000), 4096, 4, ) == 0x0 01272 464 NtFlushInstructionCache (-1, 1968967680, 860, ... ) == 0x0 01273 464 NtProtectVirtualMemory (-1, (0x755c1000), 860, 4, ... (0x755c1000), 4096, 32, ) == 0x0 01274 464 NtProtectVirtualMemory (-1, (0x755c1000), 4096, 32, ... (0x755c1000), 4096, 4, ) == 0x0 01275 464 NtFlushInstructionCache (-1, 1968967680, 860, ... ) == 0x0 01276 464 NtProtectVirtualMemory (-1, (0x755c1000), 860, 4, ... (0x755c1000), 4096, 32, ) == 0x0 01277 464 NtProtectVirtualMemory (-1, (0x755c1000), 4096, 32, ... (0x755c1000), 4096, 4, ) == 0x0 01278 464 NtFlushInstructionCache (-1, 1968967680, 860, ... ) == 0x0 01279 464 NtProtectVirtualMemory (-1, (0x755c1000), 860, 4, ... (0x755c1000), 4096, 32, ) == 0x0 01280 464 NtProtectVirtualMemory (-1, (0x755c1000), 4096, 32, ... (0x755c1000), 4096, 4, ) == 0x0 01281 464 NtFlushInstructionCache (-1, 1968967680, 860, ... ) == 0x0 01282 464 NtProtectVirtualMemory (-1, (0x755c1000), 860, 4, ... (0x755c1000), 4096, 32, ) == 0x0 01283 464 NtProtectVirtualMemory (-1, (0x755c1000), 4096, 32, ... (0x755c1000), 4096, 4, ) == 0x0 01284 464 NtFlushInstructionCache (-1, 1968967680, 860, ... ) == 0x0 01285 464 NtOpenKey (0x80000000, {24, 0, 0x40, 0, 0, (0x80000000, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msctfime.ime"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 01286 464 NtUserGetDC (0, ... ) == 0x1010052 01287 464 NtUserSystemParametersInfo (66, 12, 1238948, 0, ... ) == 0x1 01288 464 NtUserCallOneParam (16842834, 57, ... ) == 0x1 01289 464 NtQueryDebugFilterState (87, 3, ... ) == 0x0 01290 464 NtQueryDebugFilterState (87, 3, ... ) == 0x0 01291 464 NtContinue (1237152, 0, ... 01292 464 NtQueryDebugFilterState (87, 3, ... ) == 0x0 01293 464 NtUnmapViewOfSection (-1, 0x755c0000, ... ) == 0x0 01294 464 NtQueryDebugFilterState (87, 3, ... ) == 0x0 01295 464 NtOpenKey (0x2000000, {24, 16, 0x40, 0, 0, (0x2000000, {24, 16, 0x40, 0, 0, "Software\Microsoft\Windows NT\CurrentVersion\IMM"}, ... 128, ) }, ... 128, ) == 0x0 01296 464 NtQueryValueKey (128, (128, "Ime File", Partial, 144, ... TitleIdx=0, Type=1, Data="m\0s\0c\0t\0f\0i\0m\0e\0.\0i\0m\0e\0\0\0"}, 38, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (128, "Ime File", Partial, 144, ... TitleIdx=0, Type=1, Data="m\0s\0c\0t\0f\0i\0m\0e\0.\0i\0m\0e\0\0\0"}, 38, ) }, 38, ) == 0x0 01297 464 NtClose (128, ... ) == 0x0 01298 464 NtQueryInformationProcess (-1, DefaultHardErrorMode, 4, ... {process info, class 12, size 4}, 0x0, ) == 0x0 01299 464 NtSetInformationProcess (-1, DefaultHardErrorMode, {process info, class 12, size 4}, 4, ... ) == 0x0 01300 464 NtQueryAttributesFile ({24, 0, 0x40, 0, 0, ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\msctfime.ime"}, 1238480, ... ) }, 1238480, ... ) == 0x0 01301 464 NtOpenFile (0x100020, {24, 0, 0x40, 0, 0, (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\msctfime.ime"}, 5, 96, ... 128, {status=0x0, info=1}, ) }, 5, 96, ... 128, {status=0x0, info=1}, ) == 0x0 01302 464 NtCreateSection (0xe, 0x0, 0x0, 16, 134217728, 128, ... 132, ) == 0x0 01303 464 NtClose (128, ... ) == 0x0 01304 464 NtMapViewOfSection (132, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 16, ... (0xbf0000), 0x0, 180224, ) == 0x0 01305 464 NtClose (132, ... ) == 0x0 01306 464 NtUnmapViewOfSection (-1, 0xbf0000, ... ) == 0x0 01307 464 NtQueryAttributesFile ({24, 0, 0x40, 0, 0, ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\msctfime.ime"}, 1238076, ... ) }, 1238076, ... ) == 0x0 01308 464 NtCreateFile (0x80100080, {24, 0, 0x40, 0, 1238820, (0x80100080, {24, 0, 0x40, 0, 1238820, "\??\C:\WINDOWS\system32\msctfime.ime"}, 0x0, 0, 5, 1, 96, 0, 0, ... 132, {status=0x0, info=1}, ) }, 0x0, 0, 5, 1, 96, 0, 0, ... 132, {status=0x0, info=1}, ) == 0x0 01309 464 NtCreateSection (0xf0005, 0x0, 0x0, 2, 134217728, 132, ... 128, ) == 0x0 01310 464 NtClose (132, ... ) == 0x0 01311 464 NtMapViewOfSection (128, -1, (0x0), 0, 0, {0, 0}, 0, 1, 0, 2, ... (0xbf0000), {0, 0}, 180224, ) == 0x0 01312 464 NtClose (128, ... ) == 0x0 01313 464 NtQueryInformationProcess (-1, DefaultHardErrorMode, 4, ... {process info, class 12, size 4}, 0x0, ) == 0x0 01314 464 NtSetInformationProcess (-1, DefaultHardErrorMode, {process info, class 12, size 4}, 4, ... ) == 0x0 01315 464 NtQueryDefaultLocale (1, 1239440, ... ) == 0x0 01316 464 NtQueryVirtualMemory (-1, 0xbf0000, Basic, 28, ... {BaseAddress=0xbf0000,AllocationBase=0xbf0000,AllocationProtect=0x2,RegionSize=0x2c000,State=0x1000,Protect=0x2,Type=0x40000,}, 0x0, ) == 0x0 01317 464 NtQueryVirtualMemory (-1, 0xbf0000, Basic, 28, ... {BaseAddress=0xbf0000,AllocationBase=0xbf0000,AllocationProtect=0x2,RegionSize=0x2c000,State=0x1000,Protect=0x2,Type=0x40000,}, 0x0, ) == 0x0 01318 464 NtUnmapViewOfSection (-1, 0xbf0000, ... ) == 0x0 01319 464 NtQueryInformationProcess (-1, DefaultHardErrorMode, 4, ... {process info, class 12, size 4}, 0x0, ) == 0x0 01320 464 NtSetInformationProcess (-1, DefaultHardErrorMode, {process info, class 12, size 4}, 4, ... ) == 0x0 01321 464 NtQueryAttributesFile ({24, 0, 0x40, 0, 0, ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\msctfime.ime"}, 1238472, ... ) }, 1238472, ... ) == 0x0 01322 464 NtOpenFile (0x100020, {24, 0, 0x40, 0, 0, (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\msctfime.ime"}, 5, 96, ... 128, {status=0x0, info=1}, ) }, 5, 96, ... 128, {status=0x0, info=1}, ) == 0x0 01323 464 NtCreateSection (0xe, 0x0, 0x0, 16, 134217728, 128, ... 132, ) == 0x0 01324 464 NtClose (128, ... ) == 0x0 01325 464 NtMapViewOfSection (132, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 16, ... (0xbf0000), 0x0, 180224, ) == 0x0 01326 464 NtClose (132, ... ) == 0x0 01327 464 NtUnmapViewOfSection (-1, 0xbf0000, ... ) == 0x0 01328 464 NtQueryAttributesFile ({24, 0, 0x40, 0, 0, ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\msctfime.ime"}, 1238068, ... ) }, 1238068, ... ) == 0x0 01329 464 NtCreateFile (0x80100080, {24, 0, 0x40, 0, 1238812, (0x80100080, {24, 0, 0x40, 0, 1238812, "\??\C:\WINDOWS\system32\msctfime.ime"}, 0x0, 0, 5, 1, 96, 0, 0, ... 132, {status=0x0, info=1}, ) }, 0x0, 0, 5, 1, 96, 0, 0, ... 132, {status=0x0, info=1}, ) == 0x0 01330 464 NtCreateSection (0xf0005, 0x0, 0x0, 2, 134217728, 132, ... 128, ) == 0x0 01331 464 NtClose (132, ... ) == 0x0 01332 464 NtMapViewOfSection (128, -1, (0x0), 0, 0, {0, 0}, 0, 1, 0, 2, ... (0xbf0000), {0, 0}, 180224, ) == 0x0 01333 464 NtClose (128, ... ) == 0x0 01334 464 NtQueryInformationProcess (-1, DefaultHardErrorMode, 4, ... {process info, class 12, size 4}, 0x0, ) == 0x0 01335 464 NtSetInformationProcess (-1, DefaultHardErrorMode, {process info, class 12, size 4}, 4, ... ) == 0x0 01336 464 NtQueryDefaultLocale (1, 1239432, ... ) == 0x0 01337 464 NtQueryVirtualMemory (-1, 0xbf0000, Basic, 28, ... {BaseAddress=0xbf0000,AllocationBase=0xbf0000,AllocationProtect=0x2,RegionSize=0x2c000,State=0x1000,Protect=0x2,Type=0x40000,}, 0x0, ) == 0x0 01338 464 NtUnmapViewOfSection (-1, 0xbf0000, ... ) == 0x0 01339 464 NtWaitForSingleObject (120, 0, {-1000000, -1}, ... ) == 0x0 01340 464 NtOpenThreadTokenEx (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN 01341 464 NtOpenProcessTokenEx (-1, 0x20008, 512, ... 128, ) == 0x0 01342 464 NtQueryInformationToken (128, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0 01343 464 NtClose (128, ... ) == 0x0 01344 464 NtOpenKey (0x20019, {24, 0, 0x40, 0, 0, (0x20019, {24, 0, 0x40, 0, 0, "\REGISTRY\USER\S-1-5-21-1292428093-1383384898-725345543-1003\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Layers"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 01345 464 NtReleaseMutant (120, ... 0x0, ) == 0x0 01346 464 NtQueryAttributesFile ({24, 0, 0x40, 0, 0, ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\msctfime.ime"}, 1238452, ... ) }, 1238452, ... ) == 0x0 01347 464 NtOpenFile (0x100020, {24, 0, 0x40, 0, 0, (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\msctfime.ime"}, 5, 96, ... 128, {status=0x0, info=1}, ) }, 5, 96, ... 128, {status=0x0, info=1}, ) == 0x0 01348 464 NtCreateSection (0xe, 0x0, 0x0, 16, 134217728, 128, ... 132, ) == 0x0 01349 464 NtClose (128, ... ) == 0x0 01350 464 NtMapViewOfSection (132, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 16, ... (0xbf0000), 0x0, 180224, ) == 0x0 01351 464 NtClose (132, ... ) == 0x0 01352 464 NtUnmapViewOfSection (-1, 0xbf0000, ... ) == 0x0 01353 464 NtQueryAttributesFile ({24, 0, 0x40, 0, 0, ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\msctfime.ime"}, 1238760, ... ) }, 1238760, ... ) == 0x0 01354 464 NtOpenFile (0x100020, {24, 0, 0x40, 0, 0, (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\msctfime.ime"}, 5, 96, ... 132, {status=0x0, info=1}, ) }, 5, 96, ... 132, {status=0x0, info=1}, ) == 0x0 01355 464 NtCreateSection (0xf, 0x0, 0x0, 16, 16777216, 132, ... 128, ) == 0x0 01356 464 NtQuerySection (128, Image, 48, ... {section info, class 1, size 48}, 0x0, ) == 0x0 01357 464 NtClose (132, ... ) == 0x0 01358 464 NtMapViewOfSection (128, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x755c0000), 0x0, 188416, ) == 0x0 01359 464 NtClose (128, ... ) == 0x0 01360 464 NtProtectVirtualMemory (-1, (0x755c1000), 860, 4, ... (0x755c1000), 4096, 32, ) == 0x0 01361 464 NtProtectVirtualMemory (-1, (0x755c1000), 4096, 32, ... (0x755c1000), 4096, 4, ) == 0x0 01362 464 NtFlushInstructionCache (-1, 1968967680, 860, ... ) == 0x0 01363 464 NtProtectVirtualMemory (-1, (0x755c1000), 860, 4, ... (0x755c1000), 4096, 32, ) == 0x0 01364 464 NtProtectVirtualMemory (-1, (0x755c1000), 4096, 32, ... (0x755c1000), 4096, 4, ) == 0x0 01365 464 NtFlushInstructionCache (-1, 1968967680, 860, ... ) == 0x0 01366 464 NtProtectVirtualMemory (-1, (0x755c1000), 860, 4, ... (0x755c1000), 4096, 32, ) == 0x0 01367 464 NtProtectVirtualMemory (-1, (0x755c1000), 4096, 32, ... (0x755c1000), 4096, 4, ) == 0x0 01368 464 NtFlushInstructionCache (-1, 1968967680, 860, ... ) == 0x0 01369 464 NtProtectVirtualMemory (-1, (0x755c1000), 860, 4, ... (0x755c1000), 4096, 32, ) == 0x0 01370 464 NtProtectVirtualMemory (-1, (0x755c1000), 4096, 32, ... (0x755c1000), 4096, 4, ) == 0x0 01371 464 NtFlushInstructionCache (-1, 1968967680, 860, ... ) == 0x0 01372 464 NtProtectVirtualMemory (-1, (0x755c1000), 860, 4, ... (0x755c1000), 4096, 32, ) == 0x0 01373 464 NtProtectVirtualMemory (-1, (0x755c1000), 4096, 32, ... (0x755c1000), 4096, 4, ) == 0x0 01374 464 NtFlushInstructionCache (-1, 1968967680, 860, ... ) == 0x0 01375 464 NtProtectVirtualMemory (-1, (0x755c1000), 860, 4, ... (0x755c1000), 4096, 32, ) == 0x0 01376 464 NtProtectVirtualMemory (-1, (0x755c1000), 4096, 32, ... (0x755c1000), 4096, 4, ) == 0x0 01377 464 NtFlushInstructionCache (-1, 1968967680, 860, ... ) == 0x0 01378 464 NtOpenKey (0x80000000, {24, 0, 0x40, 0, 0, (0x80000000, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msctfime.ime"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 01379 464 NtUserGetDC (0, ... ) == 0x1010052 01380 464 NtUserSystemParametersInfo (66, 12, 1238948, 0, ... ) == 0x1 01381 464 NtUserCallOneParam (16842834, 57, ... ) == 0x1 01382 464 NtQueryDebugFilterState (87, 3, ... ) == 0x0 01383 464 NtQueryDebugFilterState (87, 3, ... ) == 0x0 01384 464 NtContinue (1237152, 0, ... 01385 464 NtQueryDebugFilterState (87, 3, ... ) == 0x0 01386 464 NtUnmapViewOfSection (-1, 0x755c0000, ... ) == 0x0 01387 464 NtQueryDebugFilterState (87, 3, ... ) == 0x0 01388 464 NtOpenKey (0x2000000, {24, 16, 0x40, 0, 0, (0x2000000, {24, 16, 0x40, 0, 0, "Software\Microsoft\Windows NT\CurrentVersion\IMM"}, ... 128, ) }, ... 128, ) == 0x0 01389 464 NtQueryValueKey (128, (128, "Ime File", Partial, 144, ... TitleIdx=0, Type=1, Data="m\0s\0c\0t\0f\0i\0m\0e\0.\0i\0m\0e\0\0\0"}, 38, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (128, "Ime File", Partial, 144, ... TitleIdx=0, Type=1, Data="m\0s\0c\0t\0f\0i\0m\0e\0.\0i\0m\0e\0\0\0"}, 38, ) }, 38, ) == 0x0 01390 464 NtClose (128, ... ) == 0x0 01391 464 NtQueryInformationProcess (-1, DefaultHardErrorMode, 4, ... {process info, class 12, size 4}, 0x0, ) == 0x0 01392 464 NtSetInformationProcess (-1, DefaultHardErrorMode, {process info, class 12, size 4}, 4, ... ) == 0x0 01393 464 NtQueryAttributesFile ({24, 0, 0x40, 0, 0, ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\msctfime.ime"}, 1238480, ... ) }, 1238480, ... ) == 0x0 01394 464 NtOpenFile (0x100020, {24, 0, 0x40, 0, 0, (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\msctfime.ime"}, 5, 96, ... 128, {status=0x0, info=1}, ) }, 5, 96, ... 128, {status=0x0, info=1}, ) == 0x0 01395 464 NtCreateSection (0xe, 0x0, 0x0, 16, 134217728, 128, ... 132, ) == 0x0 01396 464 NtClose (128, ... ) == 0x0 01397 464 NtMapViewOfSection (132, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 16, ... (0xbf0000), 0x0, 180224, ) == 0x0 01398 464 NtClose (132, ... ) == 0x0 01399 464 NtUnmapViewOfSection (-1, 0xbf0000, ... ) == 0x0 01400 464 NtQueryAttributesFile ({24, 0, 0x40, 0, 0, ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\msctfime.ime"}, 1238076, ... ) }, 1238076, ... ) == 0x0 01401 464 NtCreateFile (0x80100080, {24, 0, 0x40, 0, 1238820, (0x80100080, {24, 0, 0x40, 0, 1238820, "\??\C:\WINDOWS\system32\msctfime.ime"}, 0x0, 0, 5, 1, 96, 0, 0, ... 132, {status=0x0, info=1}, ) }, 0x0, 0, 5, 1, 96, 0, 0, ... 132, {status=0x0, info=1}, ) == 0x0 01402 464 NtCreateSection (0xf0005, 0x0, 0x0, 2, 134217728, 132, ... 128, ) == 0x0 01403 464 NtClose (132, ... ) == 0x0 01404 464 NtMapViewOfSection (128, -1, (0x0), 0, 0, {0, 0}, 0, 1, 0, 2, ... (0xbf0000), {0, 0}, 180224, ) == 0x0 01405 464 NtClose (128, ... ) == 0x0 01406 464 NtQueryInformationProcess (-1, DefaultHardErrorMode, 4, ... {process info, class 12, size 4}, 0x0, ) == 0x0 01407 464 NtSetInformationProcess (-1, DefaultHardErrorMode, {process info, class 12, size 4}, 4, ... ) == 0x0 01408 464 NtQueryDefaultLocale (1, 1239440, ... ) == 0x0 01409 464 NtQueryVirtualMemory (-1, 0xbf0000, Basic, 28, ... {BaseAddress=0xbf0000,AllocationBase=0xbf0000,AllocationProtect=0x2,RegionSize=0x2c000,State=0x1000,Protect=0x2,Type=0x40000,}, 0x0, ) == 0x0 01410 464 NtQueryVirtualMemory (-1, 0xbf0000, Basic, 28, ... {BaseAddress=0xbf0000,AllocationBase=0xbf0000,AllocationProtect=0x2,RegionSize=0x2c000,State=0x1000,Protect=0x2,Type=0x40000,}, 0x0, ) == 0x0 01411 464 NtUnmapViewOfSection (-1, 0xbf0000, ... ) == 0x0 01412 464 NtAllocateVirtualMemory (-1, 1376256, 0, 4096, 4096, 4, ... 1376256, 4096, ) == 0x0 01413 464 NtQueryInformationProcess (-1, DefaultHardErrorMode, 4, ... {process info, class 12, size 4}, 0x0, ) == 0x0 01414 464 NtSetInformationProcess (-1, DefaultHardErrorMode, {process info, class 12, size 4}, 4, ... ) == 0x0 01415 464 NtQueryAttributesFile ({24, 0, 0x40, 0, 0, ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\msctfime.ime"}, 1238472, ... ) }, 1238472, ... ) == 0x0 01416 464 NtOpenFile (0x100020, {24, 0, 0x40, 0, 0, (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\msctfime.ime"}, 5, 96, ... 128, {status=0x0, info=1}, ) }, 5, 96, ... 128, {status=0x0, info=1}, ) == 0x0 01417 464 NtCreateSection (0xe, 0x0, 0x0, 16, 134217728, 128, ... 132, ) == 0x0 01418 464 NtClose (128, ... ) == 0x0 01419 464 NtMapViewOfSection (132, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 16, ... (0xbf0000), 0x0, 180224, ) == 0x0 01420 464 NtClose (132, ... ) == 0x0 01421 464 NtUnmapViewOfSection (-1, 0xbf0000, ... ) == 0x0 01422 464 NtQueryAttributesFile ({24, 0, 0x40, 0, 0, ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\msctfime.ime"}, 1238068, ... ) }, 1238068, ... ) == 0x0 01423 464 NtCreateFile (0x80100080, {24, 0, 0x40, 0, 1238812, (0x80100080, {24, 0, 0x40, 0, 1238812, "\??\C:\WINDOWS\system32\msctfime.ime"}, 0x0, 0, 5, 1, 96, 0, 0, ... 132, {status=0x0, info=1}, ) }, 0x0, 0, 5, 1, 96, 0, 0, ... 132, {status=0x0, info=1}, ) == 0x0 01424 464 NtCreateSection (0xf0005, 0x0, 0x0, 2, 134217728, 132, ... 128, ) == 0x0 01425 464 NtClose (132, ... ) == 0x0 01426 464 NtMapViewOfSection (128, -1, (0x0), 0, 0, {0, 0}, 0, 1, 0, 2, ... (0xbf0000), {0, 0}, 180224, ) == 0x0 01427 464 NtClose (128, ... ) == 0x0 01428 464 NtQueryInformationProcess (-1, DefaultHardErrorMode, 4, ... {process info, class 12, size 4}, 0x0, ) == 0x0 01429 464 NtSetInformationProcess (-1, DefaultHardErrorMode, {process info, class 12, size 4}, 4, ... ) == 0x0 01430 464 NtQueryDefaultLocale (1, 1239432, ... ) == 0x0 01431 464 NtQueryVirtualMemory (-1, 0xbf0000, Basic, 28, ... {BaseAddress=0xbf0000,AllocationBase=0xbf0000,AllocationProtect=0x2,RegionSize=0x2c000,State=0x1000,Protect=0x2,Type=0x40000,}, 0x0, ) == 0x0 01432 464 NtUnmapViewOfSection (-1, 0xbf0000, ... ) == 0x0 01433 464 NtWaitForSingleObject (120, 0, {-1000000, -1}, ... ) == 0x0 01434 464 NtOpenThreadTokenEx (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN 01435 464 NtOpenProcessTokenEx (-1, 0x20008, 512, ... 128, ) == 0x0 01436 464 NtQueryInformationToken (128, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0 01437 464 NtClose (128, ... ) == 0x0 01438 464 NtOpenKey (0x20019, {24, 0, 0x40, 0, 0, (0x20019, {24, 0, 0x40, 0, 0, "\REGISTRY\USER\S-1-5-21-1292428093-1383384898-725345543-1003\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Layers"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 01439 464 NtReleaseMutant (120, ... 0x0, ) == 0x0 01440 464 NtQueryAttributesFile ({24, 0, 0x40, 0, 0, ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\msctfime.ime"}, 1238452, ... ) }, 1238452, ... ) == 0x0 01441 464 NtOpenFile (0x100020, {24, 0, 0x40, 0, 0, (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\msctfime.ime"}, 5, 96, ... 128, {status=0x0, info=1}, ) }, 5, 96, ... 128, {status=0x0, info=1}, ) == 0x0 01442 464 NtCreateSection (0xe, 0x0, 0x0, 16, 134217728, 128, ... 132, ) == 0x0 01443 464 NtClose (128, ... ) == 0x0 01444 464 NtMapViewOfSection (132, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 16, ... (0xbf0000), 0x0, 180224, ) == 0x0 01445 464 NtClose (132, ... ) == 0x0 01446 464 NtUnmapViewOfSection (-1, 0xbf0000, ... ) == 0x0 01447 464 NtQueryAttributesFile ({24, 0, 0x40, 0, 0, ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\msctfime.ime"}, 1238760, ... ) }, 1238760, ... ) == 0x0 01448 464 NtOpenFile (0x100020, {24, 0, 0x40, 0, 0, (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\msctfime.ime"}, 5, 96, ... 132, {status=0x0, info=1}, ) }, 5, 96, ... 132, {status=0x0, info=1}, ) == 0x0 01449 464 NtCreateSection (0xf, 0x0, 0x0, 16, 16777216, 132, ... 128, ) == 0x0 01450 464 NtQuerySection (128, Image, 48, ... {section info, class 1, size 48}, 0x0, ) == 0x0 01451 464 NtClose (132, ... ) == 0x0 01452 464 NtMapViewOfSection (128, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x755c0000), 0x0, 188416, ) == 0x0 01453 464 NtClose (128, ... ) == 0x0 01454 464 NtProtectVirtualMemory (-1, (0x755c1000), 860, 4, ... (0x755c1000), 4096, 32, ) == 0x0 01455 464 NtProtectVirtualMemory (-1, (0x755c1000), 4096, 32, ... (0x755c1000), 4096, 4, ) == 0x0 01456 464 NtFlushInstructionCache (-1, 1968967680, 860, ... ) == 0x0 01457 464 NtProtectVirtualMemory (-1, (0x755c1000), 860, 4, ... (0x755c1000), 4096, 32, ) == 0x0 01458 464 NtProtectVirtualMemory (-1, (0x755c1000), 4096, 32, ... (0x755c1000), 4096, 4, ) == 0x0 01459 464 NtFlushInstructionCache (-1, 1968967680, 860, ... ) == 0x0 01460 464 NtProtectVirtualMemory (-1, (0x755c1000), 860, 4, ... (0x755c1000), 4096, 32, ) == 0x0 01461 464 NtProtectVirtualMemory (-1, (0x755c1000), 4096, 32, ... (0x755c1000), 4096, 4, ) == 0x0 01462 464 NtFlushInstructionCache (-1, 1968967680, 860, ... ) == 0x0 01463 464 NtProtectVirtualMemory (-1, (0x755c1000), 860, 4, ... (0x755c1000), 4096, 32, ) == 0x0 01464 464 NtProtectVirtualMemory (-1, (0x755c1000), 4096, 32, ... (0x755c1000), 4096, 4, ) == 0x0 01465 464 NtFlushInstructionCache (-1, 1968967680, 860, ... ) == 0x0 01466 464 NtProtectVirtualMemory (-1, (0x755c1000), 860, 4, ... (0x755c1000), 4096, 32, ) == 0x0 01467 464 NtProtectVirtualMemory (-1, (0x755c1000), 4096, 32, ... (0x755c1000), 4096, 4, ) == 0x0 01468 464 NtFlushInstructionCache (-1, 1968967680, 860, ... ) == 0x0 01469 464 NtProtectVirtualMemory (-1, (0x755c1000), 860, 4, ... (0x755c1000), 4096, 32, ) == 0x0 01470 464 NtProtectVirtualMemory (-1, (0x755c1000), 4096, 32, ... (0x755c1000), 4096, 4, ) == 0x0 01471 464 NtFlushInstructionCache (-1, 1968967680, 860, ... ) == 0x0 01472 464 NtOpenKey (0x80000000, {24, 0, 0x40, 0, 0, (0x80000000, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msctfime.ime"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 01473 464 NtUserGetDC (0, ... ) == 0x1010052 01474 464 NtUserSystemParametersInfo (66, 12, 1238948, 0, ... ) == 0x1 01475 464 NtUserCallOneParam (16842834, 57, ... ) == 0x1 01476 464 NtQueryDebugFilterState (87, 3, ... ) == 0x0 01477 464 NtQueryDebugFilterState (87, 3, ... ) == 0x0 01478 464 NtContinue (1237152, 0, ... 01479 464 NtQueryDebugFilterState (87, 3, ... ) == 0x0 01480 464 NtUnmapViewOfSection (-1, 0x755c0000, ... ) == 0x0 01481 464 NtQueryDebugFilterState (87, 3, ... ) == 0x0 01482 464 NtOpenKey (0x2000000, {24, 56, 0x40, 0, 0, (0x2000000, {24, 56, 0x40, 0, 0, "SOFTWARE\Microsoft\CTF"}, ... 128, ) }, ... 128, ) == 0x0 01483 464 NtQueryValueKey (128, (128, "Disable Thread Input Manager", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 01484 464 NtClose (128, ... ) == 0x0 01485 464 NtOpenThreadToken (-2, 0x8, 0, ... ) == STATUS_NO_TOKEN 01486 464 NtOpenProcessToken (-1, 0xa, ... 128, ) == 0x0 01487 464 NtDuplicateToken (128, 0xc, {24, 0, 0x0, 0, 1240836, 0x0}, 0, 2, ... 132, ) == 0x0 01488 464 NtClose (128, ... ) == 0x0 01489 464 NtAccessCheck (1375016, 132, 0x1, 1240912, 1240964, 56, 1240944, ... (0x1), ) == 0x0 01490 464 NtClose (132, ... ) == 0x0 01491 464 NtOpenKey (0x2000000, {24, 16, 0x40, 0, 0, (0x2000000, {24, 16, 0x40, 0, 0, "Software\Microsoft\CTF\SystemShared"}, ... 132, ) }, ... 132, ) == 0x0 01492 464 NtQueryValueKey (132, (132, "CUAS", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (132, "CUAS", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) }, 16, ) == 0x0 01493 464 NtClose (132, ... ) == 0x0 01494 464 NtUserGetImeInfoEx (1240728, 0, ... ) == 0x1 01495 464 NtWaitForSingleObject (120, 0, {-1000000, -1}, ... ) == 0x0 01496 464 NtOpenThreadTokenEx (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN 01497 464 NtOpenProcessTokenEx (-1, 0x20008, 512, ... 132, ) == 0x0 01498 464 NtQueryInformationToken (132, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0 01499 464 NtClose (132, ... ) == 0x0 01500 464 NtOpenKey (0x20019, {24, 0, 0x40, 0, 0, (0x20019, {24, 0, 0x40, 0, 0, "\REGISTRY\USER\S-1-5-21-1292428093-1383384898-725345543-1003\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Layers"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 01501 464 NtReleaseMutant (120, ... 0x0, ) == 0x0 01502 464 NtQueryAttributesFile ({24, 0, 0x40, 0, 0, ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\msctfime.ime"}, 1237760, ... ) }, 1237760, ... ) == 0x0 01503 464 NtOpenFile (0x100020, {24, 0, 0x40, 0, 0, (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\msctfime.ime"}, 5, 96, ... 132, {status=0x0, info=1}, ) }, 5, 96, ... 132, {status=0x0, info=1}, ) == 0x0 01504 464 NtCreateSection (0xe, 0x0, 0x0, 16, 134217728, 132, ... 128, ) == 0x0 01505 464 NtClose (132, ... ) == 0x0 01506 464 NtMapViewOfSection (128, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 16, ... (0xbf0000), 0x0, 180224, ) == 0x0 01507 464 NtClose (128, ... ) == 0x0 01508 464 NtUnmapViewOfSection (-1, 0xbf0000, ... ) == 0x0 01509 464 NtQueryAttributesFile ({24, 0, 0x40, 0, 0, ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\msctfime.ime"}, 1238068, ... ) }, 1238068, ... ) == 0x0 01510 464 NtOpenFile (0x100020, {24, 0, 0x40, 0, 0, (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\msctfime.ime"}, 5, 96, ... 128, {status=0x0, info=1}, ) }, 5, 96, ... 128, {status=0x0, info=1}, ) == 0x0 01511 464 NtCreateSection (0xf, 0x0, 0x0, 16, 16777216, 128, ... 132, ) == 0x0 01512 464 NtQuerySection (132, Image, 48, ... {section info, class 1, size 48}, 0x0, ) == 0x0 01513 464 NtClose (128, ... ) == 0x0 01514 464 NtMapViewOfSection (132, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x755c0000), 0x0, 188416, ) == 0x0 01515 464 NtClose (132, ... ) == 0x0 01516 464 NtProtectVirtualMemory (-1, (0x755c1000), 860, 4, ... (0x755c1000), 4096, 32, ) == 0x0 01517 464 NtProtectVirtualMemory (-1, (0x755c1000), 4096, 32, ... (0x755c1000), 4096, 4, ) == 0x0 01518 464 NtFlushInstructionCache (-1, 1968967680, 860, ... ) == 0x0 01519 464 NtProtectVirtualMemory (-1, (0x755c1000), 860, 4, ... (0x755c1000), 4096, 32, ) == 0x0 01520 464 NtProtectVirtualMemory (-1, (0x755c1000), 4096, 32, ... (0x755c1000), 4096, 4, ) == 0x0 01521 464 NtFlushInstructionCache (-1, 1968967680, 860, ... ) == 0x0 01522 464 NtProtectVirtualMemory (-1, (0x755c1000), 860, 4, ... (0x755c1000), 4096, 32, ) == 0x0 01523 464 NtProtectVirtualMemory (-1, (0x755c1000), 4096, 32, ... (0x755c1000), 4096, 4, ) == 0x0 01524 464 NtFlushInstructionCache (-1, 1968967680, 860, ... ) == 0x0 01525 464 NtProtectVirtualMemory (-1, (0x755c1000), 860, 4, ... (0x755c1000), 4096, 32, ) == 0x0 01526 464 NtProtectVirtualMemory (-1, (0x755c1000), 4096, 32, ... (0x755c1000), 4096, 4, ) == 0x0 01527 464 NtFlushInstructionCache (-1, 1968967680, 860, ... ) == 0x0 01528 464 NtProtectVirtualMemory (-1, (0x755c1000), 860, 4, ... (0x755c1000), 4096, 32, ) == 0x0 01529 464 NtProtectVirtualMemory (-1, (0x755c1000), 4096, 32, ... (0x755c1000), 4096, 4, ) == 0x0 01530 464 NtFlushInstructionCache (-1, 1968967680, 860, ... ) == 0x0 01531 464 NtProtectVirtualMemory (-1, (0x755c1000), 860, 4, ... (0x755c1000), 4096, 32, ) == 0x0 01532 464 NtProtectVirtualMemory (-1, (0x755c1000), 4096, 32, ... (0x755c1000), 4096, 4, ) == 0x0 01533 464 NtFlushInstructionCache (-1, 1968967680, 860, ... ) == 0x0 01534 464 NtOpenKey (0x80000000, {24, 0, 0x40, 0, 0, (0x80000000, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msctfime.ime"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 01535 464 NtUserGetDC (0, ... ) == 0x1010052 01536 464 NtUserSystemParametersInfo (66, 12, 1238256, 0, ... ) == 0x1 01537 464 NtUserCallOneParam (16842834, 57, ... ) == 0x1 01538 464 NtQueryDebugFilterState (87, 3, ... ) == 0x0 01539 464 NtQueryDebugFilterState (87, 3, ... ) == 0x0 01540 464 NtContinue (1236460, 0, ... 01541 464 NtQueryDebugFilterState (87, 3, ... ) == 0x0 01542 464 NtUnmapViewOfSection (-1, 0x755c0000, ... ) == 0x0 01543 464 NtQueryDebugFilterState (87, 3, ... ) == 0x0 01544 464 NtUserMessageCall (0xa0102, WM_NCCALCSIZE, 0x0, 0x12f3cc, 0, 670, 1, ... ) == 0x0 01545 464 NtUserGetClassName (655618, 0, 1241236, ... ) == 0x6 01546 464 NtUserRemoveProp (655618, 43282, ... ) == 0x0 01547 464 NtRequestWaitReplyPort (24, {24, 52, new_msg, 0, 262144, 6881357, 7471203, 7536751} (24, {24, 52, new_msg, 0, 262144, 6881357, 7471203, 7536751} "\0\0\0\0\5\4\3\0T\0e\0x\0t\0\320\1\0\0\34\357\22\0" ... {24, 52, reply, 0, 1036, 464, 57974, 0} "\0\0\0\0\5\4\3\0\0\0\0\0x\0t\0\320\1\0\0\0\0\0\0" ) ... {24, 52, reply, 0, 1036, 464, 57974, 0} (24, {24, 52, new_msg, 0, 262144, 6881357, 7471203, 7536751} "\0\0\0\0\5\4\3\0T\0e\0x\0t\0\320\1\0\0\34\357\22\0" ... {24, 52, reply, 0, 1036, 464, 57974, 0} "\0\0\0\0\5\4\3\0\0\0\0\0x\0t\0\320\1\0\0\0\0\0\0" ) ) == 0x0 01548 464 NtUserGetThreadDesktop (464, 0, ... ) == 0x24 01549 464 NtUserGetObjectInformation (36, 2, 1240920, 520, 0, ... ) == 0x1 01550 464 NtGdiDeleteObjectApp (1913653144, ... ) == 0x1 01551 464 NtUserGetWindowDC (0, ... ) == 0x1010051 01552 464 NtUserCallOneParam (16842833, 57, ... ) == 0x1 01553 464 NtUserGetWindowDC (0, ... ) == 0x1010051 01554 464 NtQueryVirtualMemory (-1, 0x7e418830, Basic, 28, ... {BaseAddress=0x7e418000,AllocationBase=0x7e410000,AllocationProtect=0x80,RegionSize=0x58000,State=0x1000,Protect=0x20,Type=0x1000000,}, 28, ) == 0x0 01555 464 NtQueryVirtualMemory (-1, 0x3b2fcf, Basic, 28, ... {BaseAddress=0x3b2000,AllocationBase=0x3b0000,AllocationProtect=0x40,RegionSize=0x42000,State=0x1000,Protect=0x40,Type=0x20000,}, 28, ) == 0x0 01556 464 NtQueryVirtualMemory (-1, 0x7c816fe0, Basic, 28, ... {BaseAddress=0x7c816000,AllocationBase=0x7c800000,AllocationProtect=0x80,RegionSize=0x6e000,State=0x1000,Protect=0x20,Type=0x1000000,}, 28, ) == 0x0 01557 464 NtQueryInformationProcess (-1, DebugPort, 4, ... {process info, class 7, size 4}, 0x0, ) == 0x0 01558 464 NtQueryInformationProcess (-1, 36, 4, ... {process info, class 36, size 4}, 0x0, ) == 0x0 01559 464 NtQueryVirtualMemory (-1, 0x77c2807c, Basic, 28, ... {BaseAddress=0x77c28000,AllocationBase=0x77c10000,AllocationProtect=0x80,RegionSize=0x35000,State=0x1000,Protect=0x20,Type=0x1000000,}, 28, ) == 0x0 01560 464 NtQueryInformationProcess (-1, DefaultHardErrorMode, 4, ... {process info, class 12, size 4}, 0x0, ) == 0x0 01561 464 NtQueryInformationJobObject (0, BasicLimit, 48, ... ) == STATUS_ACCESS_DENIED 01562 464 NtOpenKey (0x1, {24, 0, 0x40, 0, 0, (0x1, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\AeDebug"}, ... 132, ) }, ... 132, ) == 0x0 01563 464 NtQueryValueKey (132, (132, "Auto", Partial, 526, ... TitleIdx=0, Type=1, Data="0\0\0\0"}, 16, ) , Partial, 526, ... TitleIdx=0, Type=1, Data= (132, "Auto", Partial, 526, ... TitleIdx=0, Type=1, Data="0\0\0\0"}, 16, ) }, 16, ) == 0x0 01564 464 NtQueryValueKey (132, (132, "Debugger", Partial, 526, ... TitleIdx=0, Type=1, Data=""\0C\0:\0\\0P\0r\0o\0g\0r\0a\0m\0 \0F\0i\0l\0e\0s\0\\0M\0i\0c\0r\0o\0s\0o\0f\0t\0 \0V\0i\0s\0u\0a\0l\0 \0S\0t\0u\0d\0i\0o\0\\0C\0o\0m\0m\0o\0n\0\\0M\0S\0D\0e\0v\09\08\0\\0B\0i\0n\0\\0m\0s\0d\0e\0v\0.\0e\0x\0e\0"\0 \0-\0p\0 \0%\0l\0d\0 \0-\0e\0 \0%\0l\0d\0\0\0"}, 184, ) , Partial, 526, ... TitleIdx=0, Type=1, Data=" (132, "Debugger", Partial, 526, ... TitleIdx=0, Type=1, Data=""\0C\0:\0\\0P\0r\0o\0g\0r\0a\0m\0 \0F\0i\0l\0e\0s\0\\0M\0i\0c\0r\0o\0s\0o\0f\0t\0 \0V\0i\0s\0u\0a\0l\0 \0S\0t\0u\0d\0i\0o\0\\0C\0o\0m\0m\0o\0n\0\\0M\0S\0D\0e\0v\09\08\0\\0B\0i\0n\0\\0m\0s\0d\0e\0v\0.\0e\0x\0e\0"\0 \0-\0p\0 \0%\0l\0d\0 \0-\0e\0 \0%\0l\0d\0\0\0"}, 184, ) \0 \0-\0p\0 \0%\0l\0d\0 \0-\0e\0 \0%\0l\0d\0\0\0"}, 184, ) == 0x0 01565 464 NtClose (132, ... ) == 0x0 01566 464 NtQueryAttributesFile ({24, 0, 0x40, 0, 0, ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\faultrep.dll"}, 1236420, ... ) }, 1236420, ... ) == 0x0 01567 464 NtOpenFile (0x100020, {24, 0, 0x40, 0, 0, (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\faultrep.dll"}, 5, 96, ... 132, {status=0x0, info=1}, ) }, 5, 96, ... 132, {status=0x0, info=1}, ) == 0x0 01568 464 NtCreateSection (0xe, 0x0, 0x0, 16, 134217728, 132, ... 128, ) == 0x0 01569 464 NtClose (132, ... ) == 0x0 01570 464 NtMapViewOfSection (128, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 16, ... (0xbf0000), 0x0, 81920, ) == 0x0 01571 464 NtClose (128, ... ) == 0x0 01572 464 NtUnmapViewOfSection (-1, 0xbf0000, ... ) == 0x0 01573 464 NtQueryAttributesFile ({24, 0, 0x40, 0, 0, ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\faultrep.dll"}, 1236728, ... ) }, 1236728, ... ) == 0x0 01574 464 NtOpenFile (0x100020, {24, 0, 0x40, 0, 0, (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\faultrep.dll"}, 5, 96, ... 128, {status=0x0, info=1}, ) }, 5, 96, ... 128, {status=0x0, info=1}, ) == 0x0 01575 464 NtCreateSection (0xf, 0x0, 0x0, 16, 16777216, 128, ... 132, ) == 0x0 01576 464 NtQuerySection (132, Image, 48, ... {section info, class 1, size 48}, 0x0, ) == 0x0 01577 464 NtClose (128, ... ) == 0x0 01578 464 NtMapViewOfSection (132, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x69450000), 0x0, 90112, ) == 0x0 01579 464 NtClose (132, ... ) == 0x0 01580 464 NtOpenSection (0xe, {24, 8, 0x40, 0, 0, (0xe, {24, 8, 0x40, 0, 0, "USERENV.dll"}, ... 132, ) }, ... 132, ) == 0x0 01581 464 NtMapViewOfSection (132, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x769c0000), 0x0, 733184, ) == 0x0 01582 464 NtClose (132, ... ) == 0x0 01583 464 NtProtectVirtualMemory (-1, (0x769c1000), 1244, 4, ... (0x769c1000), 4096, 32, ) == 0x0 01584 464 NtProtectVirtualMemory (-1, (0x769c1000), 4096, 32, ... (0x769c1000), 4096, 4, ) == 0x0 01585 464 NtFlushInstructionCache (-1, 1989939200, 1244, ... ) == 0x0 01586 464 NtProtectVirtualMemory (-1, (0x769c1000), 1244, 4, ... (0x769c1000), 4096, 32, ) == 0x0 01587 464 NtProtectVirtualMemory (-1, (0x769c1000), 4096, 32, ... (0x769c1000), 4096, 4, ) == 0x0 01588 464 NtFlushInstructionCache (-1, 1989939200, 1244, ... ) == 0x0 01589 464 NtProtectVirtualMemory (-1, (0x769c1000), 1244, 4, ... (0x769c1000), 4096, 32, ) == 0x0 01590 464 NtProtectVirtualMemory (-1, (0x769c1000), 4096, 32, ... (0x769c1000), 4096, 4, ) == 0x0 01591 464 NtFlushInstructionCache (-1, 1989939200, 1244, ... ) == 0x0 01592 464 NtProtectVirtualMemory (-1, (0x769c1000), 1244, 4, ... (0x769c1000), 4096, 32, ) == 0x0 01593 464 NtProtectVirtualMemory (-1, (0x769c1000), 4096, 32, ... (0x769c1000), 4096, 4, ) == 0x0 01594 464 NtFlushInstructionCache (-1, 1989939200, 1244, ... ) == 0x0 01595 464 NtOpenSection (0xe, {24, 8, 0x40, 0, 0, (0xe, {24, 8, 0x40, 0, 0, "WINSTA.dll"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 01596 464 NtQueryAttributesFile ({24, 0, 0x40, 0, 0, ({24, 0, 0x40, 0, 0, "\??\u:\work\WINSTA.dll"}, 1235904, ... ) }, 1235904, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 01597 464 NtQueryAttributesFile ({24, 0, 0x40, 0, 0, ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\WINSTA.dll"}, 1235904, ... ) }, 1235904, ... ) == 0x0 01598 464 NtOpenFile (0x100020, {24, 0, 0x40, 0, 0, (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\WINSTA.dll"}, 5, 96, ... 132, {status=0x0, info=1}, ) }, 5, 96, ... 132, {status=0x0, info=1}, ) == 0x0 01599 464 NtCreateSection (0xf, 0x0, 0x0, 16, 16777216, 132, ... 128, ) == 0x0 01600 464 NtQuerySection (128, Image, 48, ... {section info, class 1, size 48}, 0x0, ) == 0x0 01601 464 NtClose (132, ... ) == 0x0 01602 464 NtMapViewOfSection (128, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x76360000), 0x0, 65536, ) == 0x0 01603 464 NtClose (128, ... ) == 0x0 01604 464 NtProtectVirtualMemory (-1, (0x76361000), 212, 4, ... (0x76361000), 4096, 32, ) == 0x0 01605 464 NtProtectVirtualMemory (-1, (0x76361000), 4096, 32, ... (0x76361000), 4096, 4, ) == 0x0 01606 464 NtFlushInstructionCache (-1, 1983254528, 212, ... ) == 0x0 01607 464 NtProtectVirtualMemory (-1, (0x76361000), 212, 4, ... (0x76361000), 4096, 32, ) == 0x0 01608 464 NtProtectVirtualMemory (-1, (0x76361000), 4096, 32, ... (0x76361000), 4096, 4, ) == 0x0 01609 464 NtFlushInstructionCache (-1, 1983254528, 212, ... ) == 0x0 01610 464 NtOpenSection (0xe, {24, 8, 0x40, 0, 0, (0xe, {24, 8, 0x40, 0, 0, "NETAPI32.dll"}, ... 128, ) }, ... 128, ) == 0x0 01611 464 NtMapViewOfSection (128, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x5b860000), 0x0, 344064, ) == 0x0 01612 464 NtClose (128, ... ) == 0x0 01613 464 NtProtectVirtualMemory (-1, (0x5b861000), 1168, 4, ... (0x5b861000), 4096, 32, ) == 0x0 01614 464 NtProtectVirtualMemory (-1, (0x5b861000), 4096, 32, ... (0x5b861000), 4096, 4, ) == 0x0 01615 464 NtFlushInstructionCache (-1, 1535512576, 1168, ... ) == 0x0 01616 464 NtProtectVirtualMemory (-1, (0x5b861000), 1168, 4, ... (0x5b861000), 4096, 32, ) == 0x0 01617 464 NtProtectVirtualMemory (-1, (0x5b861000), 4096, 32, ... (0x5b861000), 4096, 4, ) == 0x0 01618 464 NtFlushInstructionCache (-1, 1535512576, 1168, ... ) == 0x0 01619 464 NtProtectVirtualMemory (-1, (0x5b861000), 1168, 4, ... (0x5b861000), 4096, 32, ) == 0x0 01620 464 NtProtectVirtualMemory (-1, (0x5b861000), 4096, 32, ... (0x5b861000), 4096, 4, ) == 0x0 01621 464 NtFlushInstructionCache (-1, 1535512576, 1168, ... ) == 0x0 01622 464 NtProtectVirtualMemory (-1, (0x5b861000), 1168, 4, ... (0x5b861000), 4096, 32, ) == 0x0 01623 464 NtProtectVirtualMemory (-1, (0x5b861000), 4096, 32, ... (0x5b861000), 4096, 4, ) == 0x0 01624 464 NtFlushInstructionCache (-1, 1535512576, 1168, ... ) == 0x0 01625 464 NtProtectVirtualMemory (-1, (0x5b861000), 1168, 4, ... (0x5b861000), 4096, 32, ) == 0x0 01626 464 NtProtectVirtualMemory (-1, (0x5b861000), 4096, 32, ... (0x5b861000), 4096, 4, ) == 0x0 01627 464 NtFlushInstructionCache (-1, 1535512576, 1168, ... ) == 0x0 01628 464 NtProtectVirtualMemory (-1, (0x76361000), 212, 4, ... (0x76361000), 4096, 32, ) == 0x0 01629 464 NtProtectVirtualMemory (-1, (0x76361000), 4096, 32, ... (0x76361000), 4096, 4, ) == 0x0 01630 464 NtFlushInstructionCache (-1, 1983254528, 212, ... ) == 0x0 01631 464 NtProtectVirtualMemory (-1, (0x76361000), 212, 4, ... (0x76361000), 4096, 32, ) == 0x0 01632 464 NtProtectVirtualMemory (-1, (0x76361000), 4096, 32, ... (0x76361000), 4096, 4, ) == 0x0 01633 464 NtFlushInstructionCache (-1, 1983254528, 212, ... ) == 0x0 01634 464 NtOpenSection (0xe, {24, 8, 0x40, 0, 0, (0xe, {24, 8, 0x40, 0, 0, "WTSAPI32.dll"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 01635 464 NtQueryAttributesFile ({24, 0, 0x40, 0, 0, ({24, 0, 0x40, 0, 0, "\??\u:\work\WTSAPI32.dll"}, 1235904, ... ) }, 1235904, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 01636 464 NtQueryAttributesFile ({24, 0, 0x40, 0, 0, ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\WTSAPI32.dll"}, 1235904, ... ) }, 1235904, ... ) == 0x0 01637 464 NtOpenFile (0x100020, {24, 0, 0x40, 0, 0, (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\WTSAPI32.dll"}, 5, 96, ... 128, {status=0x0, info=1}, ) }, 5, 96, ... 128, {status=0x0, info=1}, ) == 0x0 01638 464 NtCreateSection (0xf, 0x0, 0x0, 16, 16777216, 128, ... 132, ) == 0x0 01639 464 NtQuerySection (132, Image, 48, ... {section info, class 1, size 48}, 0x0, ) == 0x0 01640 464 NtClose (128, ... ) == 0x0 01641 464 NtMapViewOfSection (132, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x76f50000), 0x0, 32768, ) == 0x0 01642 464 NtClose (132, ... ) == 0x0 01643 464 NtProtectVirtualMemory (-1, (0x76f51000), 332, 4, ... (0x76f51000), 4096, 32, ) == 0x0 01644 464 NtProtectVirtualMemory (-1, (0x76f51000), 4096, 32, ... (0x76f51000), 4096, 4, ) == 0x0 01645 464 NtFlushInstructionCache (-1, 1995771904, 332, ... ) == 0x0 01646 464 NtProtectVirtualMemory (-1, (0x76f51000), 332, 4, ... (0x76f51000), 4096, 32, ) == 0x0 01647 464 NtProtectVirtualMemory (-1, (0x76f51000), 4096, 32, ... (0x76f51000), 4096, 4, ) == 0x0 01648 464 NtFlushInstructionCache (-1, 1995771904, 332, ... ) == 0x0 01649 464 NtProtectVirtualMemory (-1, (0x76f51000), 332, 4, ... (0x76f51000), 4096, 32, ) == 0x0 01650 464 NtProtectVirtualMemory (-1, (0x76f51000), 4096, 32, ... (0x76f51000), 4096, 4, ) == 0x0 01651 464 NtFlushInstructionCache (-1, 1995771904, 332, ... ) == 0x0 01652 464 NtProtectVirtualMemory (-1, (0x76f51000), 332, 4, ... (0x76f51000), 4096, 32, ) == 0x0 01653 464 NtProtectVirtualMemory (-1, (0x76f51000), 4096, 32, ... (0x76f51000), 4096, 4, ) == 0x0 01654 464 NtFlushInstructionCache (-1, 1995771904, 332, ... ) == 0x0 01655 464 NtOpenSection (0xe, {24, 8, 0x40, 0, 0, (0xe, {24, 8, 0x40, 0, 0, "SETUPAPI.dll"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 01656 464 NtQueryAttributesFile ({24, 0, 0x40, 0, 0, ({24, 0, 0x40, 0, 0, "\??\u:\work\SETUPAPI.dll"}, 1235904, ... ) }, 1235904, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 01657 464 NtQueryAttributesFile ({24, 0, 0x40, 0, 0, ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\SETUPAPI.dll"}, 1235904, ... ) }, 1235904, ... ) == 0x0 01658 464 NtOpenFile (0x100020, {24, 0, 0x40, 0, 0, (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\SETUPAPI.dll"}, 5, 96, ... 132, {status=0x0, info=1}, ) }, 5, 96, ... 132, {status=0x0, info=1}, ) == 0x0 01659 464 NtCreateSection (0xf, 0x0, 0x0, 16, 16777216, 132, ... 128, ) == 0x0 01660 464 NtQuerySection (128, Image, 48, ... {section info, class 1, size 48}, 0x0, ) == 0x0 01661 464 NtClose (132, ... ) == 0x0 01662 464 NtMapViewOfSection (128, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x77920000), 0x0, 995328, ) == 0x0 01663 464 NtClose (128, ... ) == 0x0 01664 464 NtProtectVirtualMemory (-1, (0x77921000), 1368, 4, ... (0x77921000), 4096, 32, ) == 0x0 01665 464 NtProtectVirtualMemory (-1, (0x77921000), 4096, 32, ... (0x77921000), 4096, 4, ) == 0x0 01666 464 NtFlushInstructionCache (-1, 2006061056, 1368, ... ) == 0x0 01667 464 NtProtectVirtualMemory (-1, (0x77921000), 1368, 4, ... (0x77921000), 4096, 32, ) == 0x0 01668 464 NtProtectVirtualMemory (-1, (0x77921000), 4096, 32, ... (0x77921000), 4096, 4, ) == 0x0 01669 464 NtFlushInstructionCache (-1, 2006061056, 1368, ... ) == 0x0 01670 464 NtProtectVirtualMemory (-1, (0x77921000), 1368, 4, ... (0x77921000), 4096, 32, ) == 0x0 01671 464 NtProtectVirtualMemory (-1, (0x77921000), 4096, 32, ... (0x77921000), 4096, 4, ) == 0x0 01672 464 NtFlushInstructionCache (-1, 2006061056, 1368, ... ) == 0x0 01673 464 NtProtectVirtualMemory (-1, (0x77921000), 1368, 4, ... (0x77921000), 4096, 32, ) == 0x0 01674 464 NtProtectVirtualMemory (-1, (0x77921000), 4096, 32, ... (0x77921000), 4096, 4, ) == 0x0 01675 464 NtFlushInstructionCache (-1, 2006061056, 1368, ... ) == 0x0 01676 464 NtProtectVirtualMemory (-1, (0x77921000), 1368, 4, ... (0x77921000), 4096, 32, ) == 0x0 01677 464 NtProtectVirtualMemory (-1, (0x77921000), 4096, 32, ... (0x77921000), 4096, 4, ) == 0x0 01678 464 NtFlushInstructionCache (-1, 2006061056, 1368, ... ) == 0x0 01679 464 NtOpenSection (0xe, {24, 8, 0x40, 0, 0, (0xe, {24, 8, 0x40, 0, 0, "SHLWAPI.dll"}, ... 128, ) }, ... 128, ) == 0x0 01680 464 NtMapViewOfSection (128, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x77f60000), 0x0, 483328, ) == 0x0 01681 464 NtClose (128, ... ) == 0x0 01682 464 NtProtectVirtualMemory (-1, (0x77f61000), 2076, 4, ... (0x77f61000), 4096, 32, ) == 0x0 01683 464 NtProtectVirtualMemory (-1, (0x77f61000), 4096, 32, ... (0x77f61000), 4096, 4, ) == 0x0 01684 464 NtFlushInstructionCache (-1, 2012614656, 2076, ... ) == 0x0 01685 464 NtProtectVirtualMemory (-1, (0x77f61000), 2076, 4, ... (0x77f61000), 4096, 32, ) == 0x0 01686 464 NtProtectVirtualMemory (-1, (0x77f61000), 4096, 32, ... (0x77f61000), 4096, 4, ) == 0x0 01687 464 NtFlushInstructionCache (-1, 2012614656, 2076, ... ) == 0x0 01688 464 NtProtectVirtualMemory (-1, (0x77f61000), 2076, 4, ... (0x77f61000), 4096, 32, ) == 0x0 01689 464 NtProtectVirtualMemory (-1, (0x77f61000), 4096, 32, ... (0x77f61000), 4096, 4, ) == 0x0 01690 464 NtFlushInstructionCache (-1, 2012614656, 2076, ... ) == 0x0 01691 464 NtProtectVirtualMemory (-1, (0x77f61000), 2076, 4, ... (0x77f61000), 4096, 32, ) == 0x0 01692 464 NtProtectVirtualMemory (-1, (0x77f61000), 4096, 32, ... (0x77f61000), 4096, 4, ) == 0x0 01693 464 NtFlushInstructionCache (-1, 2012614656, 2076, ... ) == 0x0 01694 464 NtProtectVirtualMemory (-1, (0x77f61000), 2076, 4, ... (0x77f61000), 4096, 32, ) == 0x0 01695 464 NtProtectVirtualMemory (-1, (0x77f61000), 4096, 32, ... (0x77f61000), 4096, 4, ) == 0x0 01696 464 NtFlushInstructionCache (-1, 2012614656, 2076, ... ) == 0x0 01697 464 NtProtectVirtualMemory (-1, (0x69451000), 736, 4, ... (0x69451000), 4096, 32, ) == 0x0 01698 464 NtProtectVirtualMemory (-1, (0x69451000), 4096, 32, ... (0x69451000), 4096, 4, ) == 0x0 01699 464 NtFlushInstructionCache (-1, 1766133760, 736, ... ) == 0x0 01700 464 NtProtectVirtualMemory (-1, (0x69451000), 736, 4, ... (0x69451000), 4096, 32, ) == 0x0 01701 464 NtProtectVirtualMemory (-1, (0x69451000), 4096, 32, ... (0x69451000), 4096, 4, ) == 0x0 01702 464 NtFlushInstructionCache (-1, 1766133760, 736, ... ) == 0x0 01703 464 NtProtectVirtualMemory (-1, (0x69451000), 736, 4, ... (0x69451000), 4096, 32, ) == 0x0 01704 464 NtProtectVirtualMemory (-1, (0x69451000), 4096, 32, ... (0x69451000), 4096, 4, ) == 0x0 01705 464 NtFlushInstructionCache (-1, 1766133760, 736, ... ) == 0x0 01706 464 NtOpenKey (0x80000000, {24, 0, 0x40, 0, 0, (0x80000000, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\USERENV.dll"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 01707 464 NtOpenKey (0x2000000, {24, 16, 0x40, 0, 0, (0x2000000, {24, 16, 0x40, 0, 0, "Software\Microsoft\Windows NT\CurrentVersion\winlogon"}, ... 128, ) }, ... 128, ) == 0x0 01708 464 NtQueryValueKey (128, (128, "UserEnvDebugLevel", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 01709 464 NtClose (128, ... ) == 0x0 01710 464 NtOpenKey (0x2000000, {24, 16, 0x40, 0, 0, (0x2000000, {24, 16, 0x40, 0, 0, "Software\Microsoft\Windows NT\CurrentVersion\winlogon"}, ... 128, ) }, ... 128, ) == 0x0 01711 464 NtQueryValueKey (128, (128, "ChkAccDebugLevel", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 01712 464 NtClose (128, ... ) == 0x0 01713 464 NtOpenKey (0x20019, {24, 16, 0x40, 0, 0, (0x20019, {24, 16, 0x40, 0, 0, "System\CurrentControlSet\Control\ProductOptions"}, ... 128, ) }, ... 128, ) == 0x0 01714 464 NtQueryValueKey (128, (128, "ProductType", Partial, 144, ... TitleIdx=0, Type=1, Data="W\0i\0n\0N\0T\0\0\0"}, 24, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (128, "ProductType", Partial, 144, ... TitleIdx=0, Type=1, Data="W\0i\0n\0N\0T\0\0\0"}, 24, ) }, 24, ) == 0x0 01715 464 NtClose (128, ... ) == 0x0 01716 464 NtCreateEvent (0x1f0003, {24, 48, 0x80, 1234496, 0, (0x1f0003, {24, 48, 0x80, 1234496, 0, "Global\userenv: User Profile setup event"}, 0, 1, ... 128, ) }, 0, 1, ... 128, ) == STATUS_OBJECT_NAME_EXISTS 01717 464 NtAllocateVirtualMemory (-1, 1224704, 0, 4096, 4096, 260, ... 1224704, 4096, ) == 0x0 01718 464 NtQueryDefaultLocale (1, 1234248, ... ) == 0x0 01719 464 NtQueryDefaultLocale (1, 1234248, ... ) == 0x0 01720 464 NtQueryDefaultLocale (1, 1234248, ... ) == 0x0 01721 464 NtQueryDefaultLocale (1, 1234248, ... ) == 0x0 01722 464 NtQueryDefaultLocale (1, 1234248, ... ) == 0x0 01723 464 NtQueryDefaultLocale (1, 1234248, ... ) == 0x0 01724 464 NtQueryDefaultLocale (1, 1234248, ... ) == 0x0 01725 464 NtQueryDefaultLocale (1, 1234248, ... ) == 0x0 01726 464 NtQueryDefaultLocale (1, 1234248, ... ) == 0x0 01727 464 NtQueryDefaultLocale (1, 1234248, ... ) == 0x0 01728 464 NtQueryDefaultLocale (1, 1234248, ... ) == 0x0 01729 464 NtQueryDefaultLocale (1, 1234248, ... ) == 0x0 01730 464 NtQueryDefaultLocale (1, 1234248, ... ) == 0x0 01731 464 NtQueryDefaultLocale (1, 1234248, ... ) == 0x0 01732 464 NtQueryDefaultLocale (1, 1234248, ... ) == 0x0 01733 464 NtQueryDefaultLocale (1, 1234248, ... ) == 0x0 01734 464 NtQueryDefaultLocale (1, 1234248, ... ) == 0x0 01735 464 NtQueryDefaultLocale (1, 1234248, ... ) == 0x0 01736 464 NtQueryDefaultLocale (1, 1234248, ... ) == 0x0 01737 464 NtQueryDefaultLocale (1, 1234248, ... ) == 0x0 01738 464 NtQueryDefaultLocale (1, 1234248, ... ) == 0x0 01739 464 NtQueryDefaultLocale (1, 1234248, ... ) == 0x0 01740 464 NtQueryDefaultLocale (1, 1234248, ... ) == 0x0 01741 464 NtQueryDefaultLocale (1, 1234248, ... ) == 0x0 01742 464 NtQueryDefaultLocale (1, 1234248, ... ) == 0x0 01743 464 NtQueryDefaultLocale (1, 1234248, ... ) == 0x0 01744 464 NtOpenThreadTokenEx (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN 01745 464 NtOpenProcessTokenEx (-1, 0x20008, 512, ... 132, ) == 0x0 01746 464 NtQueryInformationToken (132, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0 01747 464 NtClose (132, ... ) == 0x0 01748 464 NtOpenKey (0x20019, {24, 0, 0x640, 0, 0, (0x20019, {24, 0, 0x640, 0, 0, "\REGISTRY\USER\S-1-5-21-1292428093-1383384898-725345543-1003"}, ... 132, ) }, ... 132, ) == 0x0 01749 464 NtOpenKey (0x20019, {24, 132, 0x40, 0, 0, (0x20019, {24, 132, 0x40, 0, 0, "Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders"}, ... 136, ) }, ... 136, ) == 0x0 01750 464 NtQueryValueKey (136, (136, "Personal", Partial, 144, ... TitleIdx=0, Type=2, Data="%\0U\0S\0E\0R\0P\0R\0O\0F\0I\0L\0E\0%\0\\0M\0y\0 \0D\0o\0c\0u\0m\0e\0n\0t\0s\0\0\0"}, 66, ) , Partial, 144, ... TitleIdx=0, Type=2, Data= (136, "Personal", Partial, 144, ... TitleIdx=0, Type=2, Data="%\0U\0S\0E\0R\0P\0R\0O\0F\0I\0L\0E\0%\0\\0M\0y\0 \0D\0o\0c\0u\0m\0e\0n\0t\0s\0\0\0"}, 66, ) }, 66, ) == 0x0 01751 464 NtQueryDefaultLocale (1, 1234248, ... ) == 0x0 01752 464 NtQueryValueKey (136, (136, "Local Settings", Partial, 144, ... TitleIdx=0, Type=2, Data="%\0U\0S\0E\0R\0P\0R\0O\0F\0I\0L\0E\0%\0\\0L\0o\0c\0a\0l\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\0\0"}, 70, ) , Partial, 144, ... TitleIdx=0, Type=2, Data= (136, "Local Settings", Partial, 144, ... TitleIdx=0, Type=2, Data="%\0U\0S\0E\0R\0P\0R\0O\0F\0I\0L\0E\0%\0\\0L\0o\0c\0a\0l\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\0\0"}, 70, ) }, 70, ) == 0x0 01753 464 NtQueryDefaultLocale (1, 1234248, ... ) == 0x0 01754 464 NtQueryDefaultLocale (1, 1234248, ... ) == 0x0 01755 464 NtQueryDefaultLocale (1, 1234248, ... ) == 0x0 01756 464 NtQueryDefaultLocale (1, 1234248, ... ) == 0x0 01757 464 NtClose (136, ... ) == 0x0 01758 464 NtClose (132, ... ) == 0x0 01759 464 NtAllocateVirtualMemory (-1, 3297280, 0, 4096, 4096, 4, ... 3297280, 4096, ) == 0x0 01760 464 NtOpenKey (0x2000000, {24, 16, 0x40, 0, 0, (0x2000000, {24, 16, 0x40, 0, 0, "Software\Microsoft\Windows NT\CurrentVersion\winlogon"}, ... 132, ) }, ... 132, ) == 0x0 01761 464 NtQueryValueKey (132, (132, "RsopDebugLevel", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 01762 464 NtClose (132, ... ) == 0x0 01763 464 NtOpenKey (0x2000000, {24, 16, 0x40, 0, 0, (0x2000000, {24, 16, 0x40, 0, 0, "Software\Microsoft\Windows NT\CurrentVersion\winlogon"}, ... 132, ) }, ... 132, ) == 0x0 01764 464 NtQueryValueKey (132, (132, "UserEnvDebugLevel", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 01765 464 NtQueryValueKey (132, (132, "RsopLogging", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 01766 464 NtClose (132, ... ) == 0x0 01767 464 NtOpenKey (0x2000000, {24, 16, 0x40, 0, 0, (0x2000000, {24, 16, 0x40, 0, 0, "Software\Policies\Microsoft\Windows\System"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 01768 464 NtOpenKey (0x2000000, {24, 16, 0x40, 0, 0, (0x2000000, {24, 16, 0x40, 0, 0, "Software\Microsoft\Windows NT\CurrentVersion\winlogon"}, ... 132, ) }, ... 132, ) == 0x0 01769 464 NtQueryValueKey (132, (132, "UserEnvDebugLevel", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 01770 464 NtClose (132, ... ) == 0x0 01771 464 NtOpenKey (0x2000000, {24, 16, 0x40, 0, 0, (0x2000000, {24, 16, 0x40, 0, 0, "Software\Policies\Microsoft\Windows\System"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 01772 464 NtOpenKey (0x80000000, {24, 0, 0x40, 0, 0, (0x80000000, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\NETAPI32.dll"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 01773 464 NtOpenKey (0x80000000, {24, 0, 0x40, 0, 0, (0x80000000, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\WINSTA.dll"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 01774 464 NtOpenKey (0x80000000, {24, 0, 0x40, 0, 0, (0x80000000, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\WTSAPI32.dll"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 01775 464 NtQueryPerformanceCounter (... {925054110, 10}, {3579545, 0}, ) == 0x0 01776 464 NtOpenKey (0x80000000, {24, 0, 0x40, 0, 0, (0x80000000, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SETUPAPI.dll"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 01777 464 NtQueryDefaultLocale (1, 1236624, ... ) == 0x0 01778 464 NtQueryInformationProcess (-1, Wow64, 4, ... {process info, class 26, size 4}, 0x0, ) == 0x0 01779 464 NtOpenKey (0x20019, {24, 16, 0x40, 0, 0, (0x20019, {24, 16, 0x40, 0, 0, "System\Setup"}, ... 132, ) }, ... 132, ) == 0x0 01780 464 NtQueryValueKey (132, (132, "SystemSetupInProgress", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (132, "SystemSetupInProgress", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) }, 16, ) == 0x0 01781 464 NtClose (132, ... ) == 0x0 01782 464 NtUserGetProcessWindowStation (... ) == 0x1c 01783 464 NtUserGetObjectInformation (28, 1, 1236220, 12, 1236232, ... ) == 0x1 01784 464 NtOpenKey (0xf003f, {24, 16, 0x40, 0, 0, (0xf003f, {24, 16, 0x40, 0, 0, "SYSTEM\CurrentControlSet\Control\MiniNT"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 01785 464 NtOpenKey (0x20019, {24, 16, 0x40, 0, 0, (0x20019, {24, 16, 0x40, 0, 0, "System\WPA\PnP"}, ... 132, ) }, ... 132, ) == 0x0 01786 464 NtQueryValueKey (132, (132, "seed", Partial, 144, ... TitleIdx=0, Type=4, Data="\240d\351\211"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (132, "seed", Partial, 144, ... TitleIdx=0, Type=4, Data="\240d\351\211"}, 16, ) }, 16, ) == 0x0 01787 464 NtClose (132, ... ) == 0x0 01788 464 NtOpenKey (0x20019, {24, 16, 0x40, 0, 0, (0x20019, {24, 16, 0x40, 0, 0, "SYSTEM\Setup"}, ... 132, ) }, ... 132, ) == 0x0 01789 464 NtQueryValueKey (132, (132, "OsLoaderPath", Partial, 144, ... TitleIdx=0, Type=1, Data="\\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (132, "OsLoaderPath", Partial, 144, ... TitleIdx=0, Type=1, Data="\\0\0\0"}, 16, ) }, 16, ) == 0x0 01790 464 NtQueryValueKey (132, (132, "OsLoaderPath", Partial, 144, ... TitleIdx=0, Type=1, Data="\\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (132, "OsLoaderPath", Partial, 144, ... TitleIdx=0, Type=1, Data="\\0\0\0"}, 16, ) }, 16, ) == 0x0 01791 464 NtClose (132, ... ) == 0x0 01792 464 NtOpenKey (0x20019, {24, 16, 0x40, 0, 0, (0x20019, {24, 16, 0x40, 0, 0, "SYSTEM\Setup"}, ... 132, ) }, ... 132, ) == 0x0 01793 464 NtQueryValueKey (132, (132, "SystemPartition", Partial, 144, ... TitleIdx=0, Type=1, Data="\\0D\0e\0v\0i\0c\0e\0\\0H\0a\0r\0d\0d\0i\0s\0k\0V\0o\0l\0u\0m\0e\01\0\0\0"}, 60, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (132, "SystemPartition", Partial, 144, ... TitleIdx=0, Type=1, Data="\\0D\0e\0v\0i\0c\0e\0\\0H\0a\0r\0d\0d\0i\0s\0k\0V\0o\0l\0u\0m\0e\01\0\0\0"}, 60, ) }, 60, ) == 0x0 01794 464 NtQueryValueKey (132, (132, "SystemPartition", Partial, 144, ... TitleIdx=0, Type=1, Data="\\0D\0e\0v\0i\0c\0e\0\\0H\0a\0r\0d\0d\0i\0s\0k\0V\0o\0l\0u\0m\0e\01\0\0\0"}, 60, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (132, "SystemPartition", Partial, 144, ... TitleIdx=0, Type=1, Data="\\0D\0e\0v\0i\0c\0e\0\\0H\0a\0r\0d\0d\0i\0s\0k\0V\0o\0l\0u\0m\0e\01\0\0\0"}, 60, ) }, 60, ) == 0x0 01795 464 NtClose (132, ... ) == 0x0 01796 464 NtOpenKey (0x20019, {24, 16, 0x40, 0, 0, (0x20019, {24, 16, 0x40, 0, 0, "Software\Microsoft\Windows\CurrentVersion\Setup"}, ... 132, ) }, ... 132, ) == 0x0 01797 464 NtQueryValueKey (132, (132, "SourcePath", Partial, 144, ... TitleIdx=0, Type=1, Data="D\0:\0\\0\0\0"}, 20, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (132, "SourcePath", Partial, 144, ... TitleIdx=0, Type=1, Data="D\0:\0\\0\0\0"}, 20, ) }, 20, ) == 0x0 01798 464 NtQueryValueKey (132, (132, "SourcePath", Partial, 144, ... TitleIdx=0, Type=1, Data="D\0:\0\\0\0\0"}, 20, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (132, "SourcePath", Partial, 144, ... TitleIdx=0, Type=1, Data="D\0:\0\\0\0\0"}, 20, ) }, 20, ) == 0x0 01799 464 NtClose (132, ... ) == 0x0 01800 464 NtOpenKey (0x20019, {24, 16, 0x40, 0, 0, (0x20019, {24, 16, 0x40, 0, 0, "Software\Microsoft\Windows\CurrentVersion\Setup"}, ... 132, ) }, ... 132, ) == 0x0 01801 464 NtQueryValueKey (132, (132, "ServicePackSourcePath", Partial, 144, ... TitleIdx=0, Type=1, Data="D\0:\0\\0\0\0"}, 20, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (132, "ServicePackSourcePath", Partial, 144, ... TitleIdx=0, Type=1, Data="D\0:\0\\0\0\0"}, 20, ) }, 20, ) == 0x0 01802 464 NtQueryValueKey (132, (132, "ServicePackSourcePath", Partial, 144, ... TitleIdx=0, Type=1, Data="D\0:\0\\0\0\0"}, 20, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (132, "ServicePackSourcePath", Partial, 144, ... TitleIdx=0, Type=1, Data="D\0:\0\\0\0\0"}, 20, ) }, 20, ) == 0x0 01803 464 NtClose (132, ... ) == 0x0 01804 464 NtOpenKey (0x20019, {24, 16, 0x40, 0, 0, (0x20019, {24, 16, 0x40, 0, 0, "Software\Microsoft\Windows\CurrentVersion\Setup"}, ... 132, ) }, ... 132, ) == 0x0 01805 464 NtQueryValueKey (132, (132, "ServicePackCachePath", Partial, 144, ... TitleIdx=0, Type=1, Data="c\0:\0\\0w\0i\0n\0d\0o\0w\0s\0\\0S\0e\0r\0v\0i\0c\0e\0P\0a\0c\0k\0F\0i\0l\0e\0s\0\\0S\0e\0r\0v\0i\0c\0e\0P\0a\0c\0k\0C\0a\0c\0h\0e\0\0\0"}, 102, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (132, "ServicePackCachePath", Partial, 144, ... TitleIdx=0, Type=1, Data="c\0:\0\\0w\0i\0n\0d\0o\0w\0s\0\\0S\0e\0r\0v\0i\0c\0e\0P\0a\0c\0k\0F\0i\0l\0e\0s\0\\0S\0e\0r\0v\0i\0c\0e\0P\0a\0c\0k\0C\0a\0c\0h\0e\0\0\0"}, 102, ) }, 102, ) == 0x0 01806 464 NtQueryValueKey (132, (132, "ServicePackCachePath", Partial, 144, ... TitleIdx=0, Type=1, Data="c\0:\0\\0w\0i\0n\0d\0o\0w\0s\0\\0S\0e\0r\0v\0i\0c\0e\0P\0a\0c\0k\0F\0i\0l\0e\0s\0\\0S\0e\0r\0v\0i\0c\0e\0P\0a\0c\0k\0C\0a\0c\0h\0e\0\0\0"}, 102, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (132, "ServicePackCachePath", Partial, 144, ... TitleIdx=0, Type=1, Data="c\0:\0\\0w\0i\0n\0d\0o\0w\0s\0\\0S\0e\0r\0v\0i\0c\0e\0P\0a\0c\0k\0F\0i\0l\0e\0s\0\\0S\0e\0r\0v\0i\0c\0e\0P\0a\0c\0k\0C\0a\0c\0h\0e\0\0\0"}, 102, ) }, 102, ) == 0x0 01807 464 NtClose (132, ... ) == 0x0 01808 464 NtOpenKey (0x20019, {24, 16, 0x40, 0, 0, (0x20019, {24, 16, 0x40, 0, 0, "Software\Microsoft\Windows\CurrentVersion\Setup"}, ... 132, ) }, ... 132, ) == 0x0 01809 464 NtQueryValueKey (132, (132, "DriverCachePath", Partial, 144, ... TitleIdx=0, Type=2, Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0D\0r\0i\0v\0e\0r\0 \0C\0a\0c\0h\0e\0\0\0"}, 64, ) , Partial, 144, ... TitleIdx=0, Type=2, Data= (132, "DriverCachePath", Partial, 144, ... TitleIdx=0, Type=2, Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0D\0r\0i\0v\0e\0r\0 \0C\0a\0c\0h\0e\0\0\0"}, 64, ) }, 64, ) == 0x0 01810 464 NtQueryValueKey (132, (132, "DriverCachePath", Partial, 144, ... TitleIdx=0, Type=2, Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0D\0r\0i\0v\0e\0r\0 \0C\0a\0c\0h\0e\0\0\0"}, 64, ) , Partial, 144, ... TitleIdx=0, Type=2, Data= (132, "DriverCachePath", Partial, 144, ... TitleIdx=0, Type=2, Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0D\0r\0i\0v\0e\0r\0 \0C\0a\0c\0h\0e\0\0\0"}, 64, ) }, 64, ) == 0x0 01811 464 NtClose (132, ... ) == 0x0 01812 464 NtOpenKey (0x20019, {24, 16, 0x40, 0, 0, (0x20019, {24, 16, 0x40, 0, 0, "Software\Microsoft\Windows\CurrentVersion"}, ... 132, ) }, ... 132, ) == 0x0 01813 464 NtQueryValueKey (132, (132, "DevicePath", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW 01814 464 NtQueryValueKey (132, (132, "DevicePath", Partial, 346, ... TitleIdx=0, Type=2, Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0i\0n\0f\0;\0%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0d\0e\0l\0l\0\\0a\0a\0c\0;\0%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0d\0e\0l\0l\0\\0a\0a\0r\0i\0c\0h\0;\0%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0d\0e\0l\0l\0\\0c\0e\0r\0c\0s\0r\06\0;\0%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0d\0e\0l\0l\0\\0a\03\02\00\0r\0a\0i\0d\0;\0%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0d\0e\0l\0l\0\\0i\0a\0s\0t\0o\0r\0;\0%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0d\0e\0l\0l\0\\0n\0v\0r\0a\0i\0d\0\0\0"}, 346, ) , Partial, 346, ... TitleIdx=0, Type=2, Data= (132, "DevicePath", Partial, 346, ... TitleIdx=0, Type=2, Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0i\0n\0f\0;\0%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0d\0e\0l\0l\0\\0a\0a\0c\0;\0%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0d\0e\0l\0l\0\\0a\0a\0r\0i\0c\0h\0;\0%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0d\0e\0l\0l\0\\0c\0e\0r\0c\0s\0r\06\0;\0%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0d\0e\0l\0l\0\\0a\03\02\00\0r\0a\0i\0d\0;\0%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0d\0e\0l\0l\0\\0i\0a\0s\0t\0o\0r\0;\0%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0d\0e\0l\0l\0\\0n\0v\0r\0a\0i\0d\0\0\0"}, 346, ) }, 346, ) == 0x0 01815 464 NtAllocateVirtualMemory (-1, 1380352, 0, 4096, 4096, 4, ... 1380352, 4096, ) == 0x0 01816 464 NtClose (132, ... ) == 0x0 01817 464 NtCreateEvent (0x1f0003, 0x0, 0, 0, ... 132, ) == 0x0 01818 464 NtCreateMutant (0x1f0001, 0x0, 0, ... 136, ) == 0x0 01819 464 NtCreateEvent (0x1f0003, 0x0, 0, 0, ... 140, ) == 0x0 01820 464 NtCreateMutant (0x1f0001, 0x0, 0, ... 144, ) == 0x0 01821 464 NtCreateEvent (0x1f0003, 0x0, 0, 0, ... 148, ) == 0x0 01822 464 NtCreateMutant (0x1f0001, 0x0, 0, ... 152, ) == 0x0 01823 464 NtOpenKey (0x1, {24, 16, 0x40, 0, 0, (0x1, {24, 16, 0x40, 0, 0, "Software\Microsoft\Windows\CurrentVersion\Setup"}, ... 156, ) }, ... 156, ) == 0x0 01824 464 NtQueryValueKey (156, (156, "LogLevel", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (156, "LogLevel", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) }, 16, ) == 0x0 01825 464 NtQueryValueKey (156, (156, "LogLevel", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (156, "LogLevel", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) }, 16, ) == 0x0 01826 464 NtQueryValueKey (156, (156, "LogPath", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 01827 464 NtOpenKey (0x1, {24, 156, 0x40, 0, 0, (0x1, {24, 156, 0x40, 0, 0, "AppLogLevels"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 01828 464 NtClose (156, ... ) == 0x0 01829 464 NtQueryAttributesFile ({24, 0, 0x40, 0, 0, ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\"}, 1236136, ... ) }, 1236136, ... ) == 0x0 01830 464 NtOpenKey (0x20019, {24, 0, 0x40, 0, 0, (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\System\CurrentControlSet\Control\ComputerName\ActiveComputerName"}, ... 156, ) }, ... 156, ) == 0x0 01831 464 NtQueryValueKey (156, (156, "ComputerName", Full, 128, ... TitleIdx=0, Type=1, Name="ComputerName", Data="V\0I\0R\0T\0U\0A\0L\0\0\0"}, 60, ) , Full, 128, ... TitleIdx=0, Type=1, Name= (156, "ComputerName", Full, 128, ... TitleIdx=0, Type=1, Name="ComputerName", Data="V\0I\0R\0T\0U\0A\0L\0\0\0"}, 60, ) , Data= (156, "ComputerName", Full, 128, ... TitleIdx=0, Type=1, Name="ComputerName", Data="V\0I\0R\0T\0U\0A\0L\0\0\0"}, 60, ) }, 60, ) == 0x0 01832 464 NtClose (156, ... ) == 0x0 01833 464 NtOpenKey (0x20019, {24, 0, 0x40, 0, 0, (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\System\CurrentControlSet\Services\Tcpip\Parameters"}, ... 156, ) }, ... 156, ) == 0x0 01834 464 NtQueryValueKey (156, (156, "Hostname", Full, 128, ... TitleIdx=0, Type=1, Name="Hostname", Data="v\0i\0r\0t\0u\0a\0l\0\0\0"}, 52, ) , Full, 128, ... TitleIdx=0, Type=1, Name= (156, "Hostname", Full, 128, ... TitleIdx=0, Type=1, Name="Hostname", Data="v\0i\0r\0t\0u\0a\0l\0\0\0"}, 52, ) , Data= (156, "Hostname", Full, 128, ... TitleIdx=0, Type=1, Name="Hostname", Data="v\0i\0r\0t\0u\0a\0l\0\0\0"}, 52, ) }, 52, ) == 0x0 01835 464 NtClose (156, ... ) == 0x0 01836 464 NtOpenKey (0x20019, {24, 0, 0x40, 0, 0, (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Policies\Microsoft\System\DNSclient"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 01837 464 NtOpenKey (0x20019, {24, 0, 0x40, 0, 0, (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\System\CurrentControlSet\Services\Tcpip\Parameters"}, ... 156, ) }, ... 156, ) == 0x0 01838 464 NtQueryValueKey (156, (156, "Domain", Full, 128, ... TitleIdx=0, Type=1, Name="Domain", Data="\0\0"}, 34, ) , Full, 128, ... TitleIdx=0, Type=1, Name= (156, "Domain", Full, 128, ... TitleIdx=0, Type=1, Name="Domain", Data="\0\0"}, 34, ) , Data= (156, "Domain", Full, 128, ... TitleIdx=0, Type=1, Name="Domain", Data="\0\0"}, 34, ) }, 34, ) == 0x0 01839 464 NtClose (156, ... ) == 0x0 01840 464 NtOpenKey (0x80000000, {24, 0, 0x40, 0, 0, (0x80000000, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SHLWAPI.dll"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 01841 464 NtOpenKey (0x2000000, {24, 16, 0x40, 0, 0, (0x2000000, {24, 16, 0x40, 0, 0, "Software\Microsoft\Windows\CurrentVersion\Explorer\Performance"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 01842 464 NtCreateSemaphore (0x1f0003, {24, 48, 0x80, 1378072, 0, (0x1f0003, {24, 48, 0x80, 1378072, 0, "shell.{A48F1A32-A340-11D1-BC6B-00A0C90312E1}"}, 0, 2147483647, ... 156, ) }, 0, 2147483647, ... 156, ) == STATUS_OBJECT_NAME_EXISTS 01843 464 NtOpenKey (0x80000000, {24, 0, 0x40, 0, 0, (0x80000000, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\faultrep.dll"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 01844 464 NtOpenKey (0x20119, {24, 16, 0x40, 0, 0, (0x20119, {24, 16, 0x40, 0, 0, "Software\Policies\Microsoft\PCHealth\ErrorReporting"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 01845 464 NtCreateKey (0x20119, {24, 16, 0x40, 0, 0, (0x20119, {24, 16, 0x40, 0, 0, "Software\Microsoft\PCHealth\ErrorReporting"}, 0, 0x0, 0, ... 160, 2, ) }, 0, 0x0, 0, ... 160, 2, ) == 0x0 01846 464 NtOpenKey (0x10000, {24, 160, 0x40, 0, 0, (0x10000, {24, 160, 0x40, 0, 0, "DW"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 01847 464 NtQueryValueKey (160, (160, "DoReport", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (160, "DoReport", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) }, 16, ) == 0x0 01848 464 NtQueryValueKey (160, (160, "ShowUI", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (160, "ShowUI", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) }, 16, ) == 0x0 01849 464 NtQueryValueKey (160, (160, "AllOrNone", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (160, "AllOrNone", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) }, 16, ) == 0x0 01850 464 NtQueryValueKey (160, (160, "IncludeMicrosoftApps", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (160, "IncludeMicrosoftApps", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) }, 16, ) == 0x0 01851 464 NtQueryValueKey (160, (160, "IncludeWindowsApps", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (160, "IncludeWindowsApps", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) }, 16, ) == 0x0 01852 464 NtQueryValueKey (160, (160, "DoTextLog", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 01853 464 NtQueryValueKey (160, (160, "IncludeKernelFaults", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (160, "IncludeKernelFaults", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) }, 16, ) == 0x0 01854 464 NtQueryValueKey (160, (160, "IncludeShutdownErrs", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 01855 464 NtQueryValueKey (160, (160, "NumberOfFaultPipes", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 01856 464 NtQueryValueKey (160, (160, "NumberOfHangPipes", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 01857 464 NtQueryValueKey (160, (160, "MaxUserQueueSize", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 01858 464 NtQueryValueKey (160, (160, "ForceQueueMode", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 01859 464 NtCreateKey (0x20119, {24, 160, 0x40, 0, 0, (0x20119, {24, 160, 0x40, 0, 0, "ExclusionList"}, 0, 0x0, 0, ... 164, 2, ) }, 0, 0x0, 0, ... 164, 2, ) == 0x0 01860 464 NtCreateKey (0x20119, {24, 160, 0x40, 0, 0, (0x20119, {24, 160, 0x40, 0, 0, "InclusionList"}, 0, 0x0, 0, ... 168, 2, ) }, 0, 0x0, 0, ... 168, 2, ) == 0x0 01861 464 NtClose (160, ... ) == 0x0 01862 464 NtOpenKey (0x20019, {24, 16, 0x40, 0, 0, (0x20019, {24, 16, 0x40, 0, 0, "System\Setup"}, ... 160, ) }, ... 160, ) == 0x0 01863 464 NtQueryValueKey (160, (160, "SystemSetupInProgress", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (160, "SystemSetupInProgress", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) }, 16, ) == 0x0 01864 464 NtClose (160, ... ) == 0x0 01865 464 NtQueryInformationProcess (-1, DefaultHardErrorMode, 4, ... {process info, class 12, size 4}, 0x0, ) == 0x0 01866 464 NtSetInformationProcess (-1, DefaultHardErrorMode, {process info, class 12, size 4}, 4, ... ) == 0x0 01867 464 NtQueryAttributesFile ({24, 0, 0x40, 0, 0, ({24, 0, 0x40, 0, 0, "\??\u:\work\packed.exe"}, 1233664, ... ) }, 1233664, ... ) == 0x0 01868 464 NtOpenFile (0x100001, {24, 0, 0x40, 0, 0, (0x100001, {24, 0, 0x40, 0, 0, "\??\u:\"}, 3, 16417, ... 160, {status=0x0, info=1}, ) }, 3, 16417, ... 160, {status=0x0, info=1}, ) == 0x0 01869 464 NtQueryDirectoryFile (160, 0, 0, 0, 1233092, 616, BothDirectory, 1, (160, 0, 0, 0, 1233092, 616, BothDirectory, 1, "work", 0, ... {status=0x0, info=108}, ) , 0, ... {status=0x0, info=108}, ) == 0x0 01870 464 NtClose (160, ... ) == 0x0 01871 464 NtOpenFile (0x100001, {24, 0, 0x40, 0, 0, (0x100001, {24, 0, 0x40, 0, 0, "\??\u:\work\"}, 3, 16417, ... 160, {status=0x0, info=1}, ) }, 3, 16417, ... 160, {status=0x0, info=1}, ) == 0x0 01872 464 NtQueryDirectoryFile (160, 0, 0, 0, 1233092, 616, BothDirectory, 1, (160, 0, 0, 0, 1233092, 616, BothDirectory, 1, "packed.exe", 0, ... {status=0x0, info=116}, ) , 0, ... {status=0x0, info=116}, ) == 0x0 01873 464 NtClose (160, ... ) == 0x0 01874 464 NtQueryInformationProcess (-1, DefaultHardErrorMode, 4, ... {process info, class 12, size 4}, 0x0, ) == 0x0 01875 464 NtSetInformationProcess (-1, DefaultHardErrorMode, {process info, class 12, size 4}, 4, ... ) == 0x0 01876 464 NtQueryInformationProcess (-1, DefaultHardErrorMode, 4, ... {process info, class 12, size 4}, 0x0, ) == 0x0 01877 464 NtSetInformationProcess (-1, DefaultHardErrorMode, {process info, class 12, size 4}, 4, ... ) == 0x0 01878 464 NtQueryAttributesFile ({24, 0, 0x40, 0, 0, ({24, 0, 0x40, 0, 0, "\??\u:\work\packed.exe"}, 1232312, ... ) }, 1232312, ... ) == 0x0 01879 464 NtQueryAttributesFile ({24, 0, 0x40, 0, 0, ({24, 0, 0x40, 0, 0, "\??\u:\work\packed.exe"}, 1231084, ... ) }, 1231084, ... ) == 0x0 01880 464 NtQueryInformationProcess (-1, DefaultHardErrorMode, 4, ... {process info, class 12, size 4}, 0x0, ) == 0x0 01881 464 NtSetInformationProcess (-1, DefaultHardErrorMode, {process info, class 12, size 4}, 4, ... ) == 0x0 01882 464 NtQueryValueKey (164, (164, "packed.exe", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 01883 464 NtOpenThreadToken (-2, 0x2000c, 1, ... ) == STATUS_NO_TOKEN 01884 464 NtSetInformationThread (-2, ImpersonationToken, {ImpToken=0,}, 4, ... ) == 0x0 01885 464 NtQuerySystemInformation (Basic, 44, ... {Unknown=0,MaximumIncrement=156250,PhysicalPageSize=0x1000,NumberOfPhysicalPages=0xff7c,LowestPhysicalPage=0x1,HighestPhysicalPage=0xffff,AllocationGranularity=0x10000,LowestUserAddress=0x10000,HighestUserAddress=0x7ffeffff,ActiveProcessors=1,NumberProcessors=1,}, 0x0, ) == 0x0 01886 464 NtOpenKey (0x20019, {24, 16, 0x40, 0, 0, (0x20019, {24, 16, 0x40, 0, 0, "Software\Microsoft\Rpc\PagedBuffers"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 01887 464 NtOpenKey (0x20019, {24, 16, 0x40, 0, 0, (0x20019, {24, 16, 0x40, 0, 0, "Software\Microsoft\Rpc"}, ... 160, ) }, ... 160, ) == 0x0 01888 464 NtQueryValueKey (160, (160, "MaxRpcSize", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 01889 464 NtClose (160, ... ) == 0x0 01890 464 NtOpenKey (0x20019, {24, 16, 0x40, 0, 0, (0x20019, {24, 16, 0x40, 0, 0, "Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\packed.exe\RpcThreadPoolThrottle"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 01891 464 NtCreateEvent (0x1f0003, 0x0, 1, 0, ... 160, ) == 0x0 01892 464 NtCreateEvent (0x1f0003, 0x0, 1, 0, ... 172, ) == 0x0 01893 464 NtQuerySystemTime (... {-197443008, 29916847}, ) == 0x0 01894 464 NtCreateEvent (0x1f0003, 0x0, 0, 0, ... 176, ) == 0x0 01895 464 NtOpenKey (0x20019, {24, 16, 0x40, 0, 0, (0x20019, {24, 16, 0x40, 0, 0, "Software\Policies\Microsoft\Windows NT\Rpc"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 01896 464 NtQuerySystemInformation (Performance, 312, ... {system info, class 2, size 312}, 0x0, ) == 0x0 01897 464 NtQueryInformationProcess (-1, QuotaLimits, 32, ... {process info, class 1, size 32}, 0x0, ) == 0x0 01898 464 NtQueryInformationProcess (-1, VmCounters, 44, ... {process info, class 3, size 44}, 0x0, ) == 0x0 01899 464 NtCreateEvent (0x1f0003, 0x0, 0, 0, ... 180, ) == 0x0 01900 464 NtDuplicateObject (-1, -2, -1, 0x0, 0, 2, ... 184, ) == 0x0 01901 464 NtAllocateVirtualMemory (-1, 1384448, 0, 4096, 4096, 4, ... 1384448, 4096, ) == 0x0 01902 464 NtDeviceIoControlFile (44, 0, 0x0, 0x0, 0x390008, (44, 0, 0x0, 0x0, 0x390008, "\274|\352\3658\223\375\275\12I\312_i$!\252\315u\206Y\313\22B\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0", 256, 256, ... , 256, 256, ... 01903 464 NtQuerySystemInformation (TimeOfDay, 48, ... {system info, class 3, size 48}, 48, ) == 0x0 01904 464 NtQuerySystemInformation (ProcessorTimes, 48, ... {system info, class 8, size 48}, 48, ) == 0x0 01905 464 NtQuerySystemInformation (Performance, 312, ... {system info, class 2, size 312}, 312, ) == 0x0 01906 464 NtQuerySystemInformation (Exception, 16, ... {system info, class 33, size 16}, 16, ) == 0x0 01907 464 NtQuerySystemInformation (Lookaside, 32, ... {system info, class 45, size 32}, 32, ) == 0x0 01908 464 NtQuerySystemInformation (ProcessorStatistics, 3016, ... {system info, class 23, size 0}, 0, ) == 0x0 01909 464 NtQuerySystemInformation (ProcessesAndThreads, 3008, ... ) == STATUS_INFO_LENGTH_MISMATCH 01910 464 NtCreateKey (0x2, {24, 0, 0x240, 0, 0, (0x2, {24, 0, 0x240, 0, 0, "\Registry\Machine\SOFTWARE\Microsoft\Cryptography\RNG"}, 0, 0x0, 0, ... -2147482740, 2, ) }, 0, 0x0, 0, ... -2147482740, 2, ) == 0x0 01911 464 NtSetValueKey (-2147482740, (-2147482740, "Seed", 0, 3, "\35V\332r\254\276\346\217\12\220\263\3438@\356?\203\344\376\366h\300\029b\35\367b\303\20\24u\30fO:\2544\361\300\0]\34T\304\206}\202\301\313\272\324\253eU|\13g}x\322\314\243T5\27q\276\31\271\304\365\230\325\230\201\356\314`", 80, ... ) , 0, 3, (-2147482740, "Seed", 0, 3, "\35V\332r\254\276\346\217\12\220\263\3438@\356?\203\344\376\366h\300\029b\35\367b\303\20\24u\30fO:\2544\361\300\0]\34T\304\206}\202\301\313\272\324\253eU|\13g}x\322\314\243T5\27q\276\31\271\304\365\230\325\230\201\356\314`", 80, ... ) , 80, ... ) == 0x0 01912 464 NtClose (-2147482740, ... ) == 0x0 01902 464 NtDeviceIoControlFile ... {status=0x0, info=256}, ... {status=0x0, info=256}, "\272=\10 \331\362=h\213y0\304\306\33\273\306\3408\351\230\220\344*\264\373~\216\31O\301D\364\266\21\12\331;\205S\204\34el\355\353jt\304\351\246\270\222o\263\371\300\265\266\367'\226\3226\5f\260\2169c\305\373A\266\327~\252\224\236\264UZ\245\273W\225\211\266\38 1\261\327\303s\233\22\372\233\212g2P\361\325\14\272YR\254\26\24z\344\224MO<\272;p\361\305\367N(\356\10\267\261U\17\3634\40}\273\374n9\117?\11\331\276\210\250\Q'\273w\272d\353\261kP\231\216\320(\1?\1_Z\301\266\270\377\224\4\33\235\244@<1\246\215:\334\351C-\212x?d_\7\337\363E\222\322\24\364U^l\7\205N\357\324\10\1\351\254\344\\7\256\17:\272\26\305\330S\10\312\1p\257,d\203sm\70;t4\33,\211\231h)\31fs\23U\277\273\273\321\262\33", ) , ) == 0x0 01913 464 NtDeviceIoControlFile (44, 0, 0x0, 0x0, 0x390008, (44, 0, 0x0, 0x0, 0x390008, "\274|\352\3658\223\375\275\12I\312_i$%t\372\310\246?V\372G\315u\206Y\313\22B\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0", 256, 256, ... , 256, 256, ... 01914 464 NtQuerySystemInformation (TimeOfDay, 48, ... {system info, class 3, size 48}, 48, ) == 0x0 01915 464 NtQuerySystemInformation (ProcessorTimes, 48, ... {system info, class 8, size 48}, 48, ) == 0x0 01916 464 NtQuerySystemInformation (Performance, 312, ... {system info, class 2, size 312}, 312, ) == 0x0 01917 464 NtQuerySystemInformation (Exception, 16, ... {system info, class 33, size 16}, 16, ) == 0x0 01918 464 NtQuerySystemInformation (Lookaside, 32, ... {system info, class 45, size 32}, 32, ) == 0x0 01919 464 NtQuerySystemInformation (ProcessorStatistics, 3016, ... {system info, class 23, size 0}, 0, ) == 0x0 01920 464 NtQuerySystemInformation (ProcessesAndThreads, 3008, ... ) == STATUS_INFO_LENGTH_MISMATCH 01921 464 NtCreateKey (0x2, {24, 0, 0x240, 0, 0, (0x2, {24, 0, 0x240, 0, 0, "\Registry\Machine\SOFTWARE\Microsoft\Cryptography\RNG"}, 0, 0x0, 0, ... -2147482740, 2, ) }, 0, 0x0, 0, ... -2147482740, 2, ) == 0x0 01922 464 NtSetValueKey (-2147482740, (-2147482740, "Seed", 0, 3, "z\322\327bt\336\36\347x\255P\347"\360\205\337\241\302\24\324\344\335\24i\353\26Ma^\20\271"c\226\343\35\372\246\326\377\15\27\267\320\350DfP\315\10Rd\257\344G\245\330\274d?\342\275\36\33tgP\257\352i\357\2262L \344\321\356\0B", 80, ... ) , 0, 3, (-2147482740, "Seed", 0, 3, "z\322\327bt\336\36\347x\255P\347"\360\205\337\241\302\24\324\344\335\24i\353\26Ma^\20\271"c\226\343\35\372\246\326\377\15\27\267\320\350DfP\315\10Rd\257\344G\245\330\274d?\342\275\36\33tgP\257\352i\357\2262L \344\321\356\0B", 80, ... ) \360\205\337\241\302\24\324\344\335\24i\353\26Ma^\20\271 (-2147482740, "Seed", 0, 3, "z\322\327bt\336\36\347x\255P\347"\360\205\337\241\302\24\324\344\335\24i\353\26Ma^\20\271"c\226\343\35\372\246\326\377\15\27\267\320\350DfP\315\10Rd\257\344G\245\330\274d?\342\275\36\33tgP\257\352i\357\2262L \344\321\356\0B", 80, ... ) , 80, ... ) == 0x0 01923 464 NtClose (-2147482740, ... ) == 0x0 01913 464 NtDeviceIoControlFile ... {status=0x0, info=256}, ... {status=0x0, info=256}, "\37O}3]\351\207\334%\370\360dk\23Rr\242\5\234\253\17'\360\2370\25\241\211\23\321&w\220^\317\34\373o2\330\255\317*\354\246C\230\273\231O1.\275\243Js\353\324\3144\217\17\377Pc\37\366\302V\304\206\233b\323@\210\242, ) , ) == 0x0 01924 464 NtDeviceIoControlFile (44, 0, 0x0, 0x0, 0x390008, (44, 0, 0x0, 0x0, 0x390008, "\274|\352\3658\223\375\275\12I\312_i$%t\372\310\246?V\376\231\372\310\246?V\372G\315u\206Y\313\22B\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0", 256, 256, ... , 256, 256, ... 01925 464 NtQuerySystemInformation (TimeOfDay, 48, ... {system info, class 3, size 48}, 48, ) == 0x0 01926 464 NtQuerySystemInformation (ProcessorTimes, 48, ... {system info, class 8, size 48}, 48, ) == 0x0 01927 464 NtQuerySystemInformation (Performance, 312, ... {system info, class 2, size 312}, 312, ) == 0x0 01928 464 NtQuerySystemInformation (Exception, 16, ... {system info, class 33, size 16}, 16, ) == 0x0 01929 464 NtQuerySystemInformation (Lookaside, 32, ... {system info, class 45, size 32}, 32, ) == 0x0 01930 464 NtQuerySystemInformation (ProcessorStatistics, 3016, ... {system info, class 23, size 0}, 0, ) == 0x0 01931 464 NtQuerySystemInformation (ProcessesAndThreads, 3008, ... ) == STATUS_INFO_LENGTH_MISMATCH 01932 464 NtCreateKey (0x2, {24, 0, 0x240, 0, 0, (0x2, {24, 0, 0x240, 0, 0, "\Registry\Machine\SOFTWARE\Microsoft\Cryptography\RNG"}, 0, 0x0, 0, ... -2147482740, 2, ) }, 0, 0x0, 0, ... -2147482740, 2, ) == 0x0 01933 464 NtSetValueKey (-2147482740, (-2147482740, "Seed", 0, 3, "\323t9\226#\370\307o\320\206\246\277.\3K\314z\13\252#\310@)\204/l\211 \364\265I\243\20Onc\272v\354\304\331\226\236\251\350px\265\275\364\361\355}C\260\306~6x\325Y\367\361=%\257\237\320\236\233\277m\233@\263\304Z\244\203\215", 80, ... ) , 0, 3, (-2147482740, "Seed", 0, 3, "\323t9\226#\370\307o\320\206\246\277.\3K\314z\13\252#\310@)\204/l\211 \364\265I\243\20Onc\272v\354\304\331\226\236\251\350px\265\275\364\361\355}C\260\306~6x\325Y\367\361=%\257\237\320\236\233\277m\233@\263\304Z\244\203\215", 80, ... ) , 80, ... ) == 0x0 01934 464 NtClose (-2147482740, ... ) == 0x0 01924 464 NtDeviceIoControlFile ... {status=0x0, info=256}, ... {status=0x0, info=256}, "\240\307\321R\204e\24\2\27%\31\345B\22\5:DtZ\324g#\274\302R\343\338\205&\300t\255\221-\260_\372z\2248\304\316\322`\227\3276%\210\236\3053\360h\203\277\13\343t\0\266\306\336\206\330\336;\300oO\221\254\240\257\260\325\353\306\354\271\366&^4\207;\243\244\226\3512\271pJn\262k\34M\374s\24\15\353\21\241\373\357\322\215M\35y\\201Bg\342\7L\211\315e^/\363\224\265\317d\240J\240\234\220\337\1\334(\353\36\34u\14\263o I\370\341\340\223/B\314\273\217\234\226\352\210~\15c\353\262I\336\23\334\267\310\350\16\224-\352\12v\352\225"[\2{HZ\363\375\311\233\337\13\333i\323n\212r`\264nA\221\252bt\375f\376%\353-\274YJ\375X\237{-\267\17\332\262\345\205\343\247%q\374\231\!\242O\270\3319l\301\203\223\347\354\377\337\302\352w\262\316\361\30", ) [\2{HZ\363\375\311\233\337\13\333i\323n\212r`\264nA\221\252bt\375f\376%\353-\274YJ\375X\237{-\267\17\332\262\345\205\343\247%q\374\231\!\242O\270\3319l\301\203\223\347\354\377\337\302\352w\262\316\361\30", ) == 0x0 01935 464 NtDeviceIoControlFile (44, 0, 0x0, 0x0, 0x390008, (44, 0, 0x0, 0x0, 0x390008, "\274|\352\3658\223\375\275\12I\312_i$%t\372\310\246?V\376\231\372\310\246?V\376\231\372\310\246?V\372G\315u\206Y\313\22B\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0", 256, 256, ... , 256, 256, ... 01936 464 NtQuerySystemInformation (TimeOfDay, 48, ... {system info, class 3, size 48}, 48, ) == 0x0 01937 464 NtQuerySystemInformation (ProcessorTimes, 48, ... {system info, class 8, size 48}, 48, ) == 0x0 01938 464 NtQuerySystemInformation (Performance, 312, ... {system info, class 2, size 312}, 312, ) == 0x0 01939 464 NtQuerySystemInformation (Exception, 16, ... {system info, class 33, size 16}, 16, ) == 0x0 01940 464 NtQuerySystemInformation (Lookaside, 32, ... {system info, class 45, size 32}, 32, ) == 0x0 01941 464 NtQuerySystemInformation (ProcessorStatistics, 3016, ... {system info, class 23, size 0}, 0, ) == 0x0 01942 464 NtQuerySystemInformation (ProcessesAndThreads, 3008, ... ) == STATUS_INFO_LENGTH_MISMATCH 01943 464 NtCreateKey (0x2, {24, 0, 0x240, 0, 0, (0x2, {24, 0, 0x240, 0, 0, "\Registry\Machine\SOFTWARE\Microsoft\Cryptography\RNG"}, 0, 0x0, 0, ... -2147482740, 2, ) }, 0, 0x0, 0, ... -2147482740, 2, ) == 0x0 01944 464 NtSetValueKey (-2147482740, (-2147482740, "Seed", 0, 3, "'\252\265Q\336\13\32\325\13\312\32\322\332m\333\6\23[I\257S\362fn@\345\236\13\232\12[\203\4U\324\7\236i\202\224\231\373wJ\35$ \246\241E\335F\322z4\257\14\233_\17\275\240K\213\273\321\267\373O\321\37'}E\326\377\223*\231-", 80, ... ) , 0, 3, (-2147482740, "Seed", 0, 3, "'\252\265Q\336\13\32\325\13\312\32\322\332m\333\6\23[I\257S\362fn@\345\236\13\232\12[\203\4U\324\7\236i\202\224\231\373wJ\35$ \246\241E\335F\322z4\257\14\233_\17\275\240K\213\273\321\267\373O\321\37'}E\326\377\223*\231-", 80, ... ) , 80, ... ) == 0x0 01945 464 NtClose (-2147482740, ... ) == 0x0 01935 464 NtDeviceIoControlFile ... {status=0x0, info=256}, ... {status=0x0, info=256}, "\34\221\302\2\21\2011\337\245\306\322rO\226\2308\376]\208\306g@\221\366\3\37a\255\273\350\26sO\16\356\26k\245a\210\213\253\370\266\273\274\347nq\217\277\351\340\343b\344&o'"\233\246\204D\376\222\25\207\260\344\354\366\374\364T\275-\2K\3046N@\224\36\325g\2165\220\241\307&\330e\243\0\4X\33G\252\272A\350\26\s\311\310\201[\233S\275\12\16\343v\371_\330\32\257\336\343\33]\372w(H\312\321\217w\377\252\325\343'\215 \36\367\201K\10\377\2639k\36376\360\351\3076\6\373J\202\273>N&\341\222\373]?\341\26h\254]\373\244/\305\250\2164\301\36:\324\314\221\\215#\177\246\365P>U\267\264\12\37\330;\217]T\271^\267\270t\215\352\336\220a\36G\262zW~\212\231\311E>\237\251M\242\357\266#,*;^k\322\366\324\33\333\300q\35VD4>", ) \233\246\204D\376\222\25\207\260\344\354\366\374\364T\275-\2K\3046N@\224\36\325g\2165\220\241\307&\330e\243\0\4X\33G\252\272A\350\26\s\311\310\201[\233S\275\12\16\343v\371_\330\32\257\336\343\33]\372w(H\312\321\217w\377\252\325\343'\215 \36\367\201K\10\377\2639k\36376\360\351\3076\6\373J\202\273>N&\341\222\373]?\341\26h\254]\373\244/\305\250\2164\301\36:\324\314\221\\215#\177\246\365P>U\267\264\12\37\330;\217]T\271^\267\270t\215\352\336\220a\36G\262zW~\212\231\311E>\237\251M\242\357\266#,*;^k\322\366\324\33\333\300q\35VD4>", ) == 0x0 01946 464 NtDeviceIoControlFile (44, 0, 0x0, 0x0, 0x390008, (44, 0, 0x0, 0x0, 0x390008, "\274|\352\3658\223\375\275\12I\312_i$%t\372\310\246?V\376\231\372\310\246?V\376\231\372\310\246?V\376\231\372\310\246?V\372G\315u\206Y\313\22B\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0", 256, 256, ... , 256, 256, ... 01947 464 NtQuerySystemInformation (TimeOfDay, 48, ... {system info, class 3, size 48}, 48, ) == 0x0 01948 464 NtQuerySystemInformation (ProcessorTimes, 48, ... {system info, class 8, size 48}, 48, ) == 0x0 01949 464 NtQuerySystemInformation (Performance, 312, ... {system info, class 2, size 312}, 312, ) == 0x0 01950 464 NtQuerySystemInformation (Exception, 16, ... {system info, class 33, size 16}, 16, ) == 0x0 01951 464 NtQuerySystemInformation (Lookaside, 32, ... {system info, class 45, size 32}, 32, ) == 0x0 01952 464 NtQuerySystemInformation (ProcessorStatistics, 3016, ... {system info, class 23, size 0}, 0, ) == 0x0 01953 464 NtQuerySystemInformation (ProcessesAndThreads, 3008, ... ) == STATUS_INFO_LENGTH_MISMATCH 01954 464 NtCreateKey (0x2, {24, 0, 0x240, 0, 0, (0x2, {24, 0, 0x240, 0, 0, "\Registry\Machine\SOFTWARE\Microsoft\Cryptography\RNG"}, 0, 0x0, 0, ... -2147482740, 2, ) }, 0, 0x0, 0, ... -2147482740, 2, ) == 0x0 01955 464 NtSetValueKey (-2147482740, (-2147482740, "Seed", 0, 3, "I\220\16T\2344\312\202t\237N\307\1H\355\203\240\201\271\303%\260\245\237fq,\247r\235\305I\312[\15\213B#\325\271\0\322\215eIt\3131I&\7\375\32\N\316,|\343\370\36\5\265\12\274Z\245F\227\31j,W\304\372\316\376R\21\226", 80, ... ) , 0, 3, (-2147482740, "Seed", 0, 3, "I\220\16T\2344\312\202t\237N\307\1H\355\203\240\201\271\303%\260\245\237fq,\247r\235\305I\312[\15\213B#\325\271\0\322\215eIt\3131I&\7\375\32\N\316,|\343\370\36\5\265\12\274Z\245F\227\31j,W\304\372\316\376R\21\226", 80, ... ) , 80, ... ) == 0x0 01956 464 NtClose (-2147482740, ... ) == 0x0 01946 464 NtDeviceIoControlFile ... {status=0x0, info=256}, ... {status=0x0, info=256}, "O\246\177\21r}V*\330M*\375\27\226y8\2146\26\343\222\311\361\352?>!Z\306^\36(y\235\35\376\233\367a\311\263\375\361\32V\332Ch\366g\354\307\251{b\33\362h\356\34\357\307\241bO\215%|\320, ) , ) == 0x0 01957 464 NtDeviceIoControlFile (44, 0, 0x0, 0x0, 0x390008, (44, 0, 0x0, 0x0, 0x390008, "\274|\352\3658\223\375\275\12I\312_i$%t\372\310\246?V\376\231\372\310\246?V\376\231\372\310\246?V\376\231\372\310\246?V\376\231\372\310\246?V\372G\315u\206Y\313\22B\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0", 256, 256, ... , 256, 256, ... 01958 464 NtQuerySystemInformation (TimeOfDay, 48, ... {system info, class 3, size 48}, 48, ) == 0x0 01959 464 NtQuerySystemInformation (ProcessorTimes, 48, ... {system info, class 8, size 48}, 48, ) == 0x0 01960 464 NtQuerySystemInformation (Performance, 312, ... {system info, class 2, size 312}, 312, ) == 0x0 01961 464 NtQuerySystemInformation (Exception, 16, ... {system info, class 33, size 16}, 16, ) == 0x0 01962 464 NtQuerySystemInformation (Lookaside, 32, ... {system info, class 45, size 32}, 32, ) == 0x0 01963 464 NtQuerySystemInformation (ProcessorStatistics, 3016, ... {system info, class 23, size 0}, 0, ) == 0x0 01964 464 NtQuerySystemInformation (ProcessesAndThreads, 3008, ... ) == STATUS_INFO_LENGTH_MISMATCH 01965 464 NtCreateKey (0x2, {24, 0, 0x240, 0, 0, (0x2, {24, 0, 0x240, 0, 0, "\Registry\Machine\SOFTWARE\Microsoft\Cryptography\RNG"}, 0, 0x0, 0, ... -2147482740, 2, ) }, 0, 0x0, 0, ... -2147482740, 2, ) == 0x0 01966 464 NtSetValueKey (-2147482740, (-2147482740, "Seed", 0, 3, "Gf"\215\247t\23K\15s4]\243\324\27o/\15\320\324Wo\177"\14\245>y\256\227/ye\357+V\364\341\321\232\225\306g\335\263\230\14{\225\372\242\23x\36X\342\26\214\305\327\211\247kU\20:\334\357@\353\221\356z\265l+_\222\224\225", 80, ... ) , 0, 3, (-2147482740, "Seed", 0, 3, "Gf"\215\247t\23K\15s4]\243\324\27o/\15\320\324Wo\177"\14\245>y\256\227/ye\357+V\364\341\321\232\225\306g\335\263\230\14{\225\372\242\23x\36X\342\26\214\305\327\211\247kU\20:\334\357@\353\221\356z\265l+_\222\224\225", 80, ... ) \215\247t\23K\15s4]\243\324\27o/\15\320\324Wo\177 (-2147482740, "Seed", 0, 3, "Gf"\215\247t\23K\15s4]\243\324\27o/\15\320\324Wo\177"\14\245>y\256\227/ye\357+V\364\341\321\232\225\306g\335\263\230\14{\225\372\242\23x\36X\342\26\214\305\327\211\247kU\20:\334\357@\353\221\356z\265l+_\222\224\225", 80, ... ) , 80, ... ) == 0x0 01967 464 NtClose (-2147482740, ... ) == 0x0 01957 464 NtDeviceIoControlFile ... {status=0x0, info=256}, ... {status=0x0, info=256}, "\200P\337QE\254\323\373\215H\240\310`\20j\237\245\31\244\337z:\354i\250\27'\204\346\305Nku\17\220\202_\375}\225\355\332\12\276\324\240\353\340\23n:dG\272\265\4\252K9\14\17\257m\207\200\366\6\16\277$\20\241\214\371 $4\304g\33\225\201Bq\371\271\5\214\342\266\34\11+\204\277\370\204XE\0\177\350\30m\2673a\242w8\322\231\376\341\3659\335\206S\4\233\3019\320\216, ) , ) == 0x0 01968 464 NtDeviceIoControlFile (44, 0, 0x0, 0x0, 0x390008, (44, 0, 0x0, 0x0, 0x390008, "\274|\352\3658\223\375\275\12I\312_i$%t\372\310\246?V\376\231\372\310\246?V\376\231\372\310\246?V\376\231\372\310\246?V\376\231\372\310\246?V\376\231\372\310\246?V\372G\315u\206Y\313\22B\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0", 256, 256, ... , 256, 256, ... 01969 464 NtQuerySystemInformation (TimeOfDay, 48, ... {system info, class 3, size 48}, 48, ) == 0x0 01970 464 NtQuerySystemInformation (ProcessorTimes, 48, ... {system info, class 8, size 48}, 48, ) == 0x0 01971 464 NtQuerySystemInformation (Performance, 312, ... {system info, class 2, size 312}, 312, ) == 0x0 01972 464 NtQuerySystemInformation (Exception, 16, ... {system info, class 33, size 16}, 16, ) == 0x0 01973 464 NtQuerySystemInformation (Lookaside, 32, ... {system info, class 45, size 32}, 32, ) == 0x0 01974 464 NtQuerySystemInformation (ProcessorStatistics, 3016, ... {system info, class 23, size 0}, 0, ) == 0x0 01975 464 NtQuerySystemInformation (ProcessesAndThreads, 3008, ... ) == STATUS_INFO_LENGTH_MISMATCH 01976 464 NtCreateKey (0x2, {24, 0, 0x240, 0, 0, (0x2, {24, 0, 0x240, 0, 0, "\Registry\Machine\SOFTWARE\Microsoft\Cryptography\RNG"}, 0, 0x0, 0, ... -2147482740, 2, ) }, 0, 0x0, 0, ... -2147482740, 2, ) == 0x0 01977 464 NtSetValueKey (-2147482740, (-2147482740, "Seed", 0, 3, "\1\336cw\322\376\21\304S\212<\370\35\10J\342\274X\301:\211\365izw(\227l\32\16\356b\326z\224\263G\220\24\331\2\212\236\11\355\357(h\300<\177,\334H\256=\\6\333`[\35G\210\260r\34\14\361V\240\205\344\2426 \266\340Cr", 80, ... ) , 0, 3, (-2147482740, "Seed", 0, 3, "\1\336cw\322\376\21\304S\212<\370\35\10J\342\274X\301:\211\365izw(\227l\32\16\356b\326z\224\263G\220\24\331\2\212\236\11\355\357(h\300<\177,\334H\256=\\6\333`[\35G\210\260r\34\14\361V\240\205\344\2426 \266\340Cr", 80, ... ) , 80, ... ) == 0x0 01978 464 NtClose (-2147482740, ... ) == 0x0 01968 464 NtDeviceIoControlFile ... {status=0x0, info=256}, ... {status=0x0, info=256}, ".\233;\22%4\14\3208\230\335\273n\351\7E}\235xm\364\315\267<\301\247\356*\4\20\30\247h\266\242\271\2714\3309',\25\253\36\333RE\210e\236\236\334\33\240\270;\335S\207U\250C\231\7L\243\205Zzj~b&g\327\204\203\362IF\265\12M\262;b,%\365u\227\347\366\345\327\326\365n\216,W\23\276;\17u\34>\223F\311n\373+\227\7T\211\236N\325\23DZ\311m6\373\351~d\232N\323-Yd,\227\255\245\26\214\237i\13oa\343\222\16\25\227G__\275$\361\226\344\360\315\33\304\337t\16\177\245\214W\215\326*\265\2579\3427\17~:\255\243\375\263\212\331h\2\334\36Z\3\254\257x\361@\353\275\317\271\217m\1*\333\37\321\267U\200\213K\365^\267J\7'V3\267\304<\366\310\342\337e\226~\325Y\7\341Fq#\234\302\2624\355\373\263\275\12\210\372;(m", ) , ) == 0x0 01979 464 NtCreateEvent (0x1f0003, 0x0, 1, 0, ... 188, ) == 0x0 01980 464 NtConnectPort ( ("\RPC Control\IcaApi", {12, 2, 1, 0}, 0x0, 0x0, 1231456, 188, ... 192, 0x0, 0x0, 0x0, 188, ) , {12, 2, 1, 0}, 0x0, 0x0, 1231456, 188, ... 192, 0x0, 0x0, 0x0, 188, ) == 0x0 01981 464 NtRequestWaitReplyPort (192, {200, 224, new_msg, 0, 2621478, 1385184, 12, 2} (192, {200, 224, new_msg, 0, 2621478, 1385184, 12, 2} "\0\0\24\0\10\0\0\0\274\0\0\0`\247\244\\261\353\317\21\206\21\0\240$T \355\1\0\0\0\1\0\0\0\0\0\2\0\4\0\0\002\24\0\270"\25\0\10\0\0\0\5\0\0\0x\1\24\0\0\0\0\0\0\0\25\0\2\0\0\0:\207i\26o\32\32A\260"\25\0h\1\24\0\12\0\0\0\0\0\0\0\260"\25\0(\0\0\0\270"\25\0\34T\7Lx\1\24\0(\0\0\0\316\325\0\0\0\0\24\0\274\310\22\0\252\1\0\0\0\0\0\0\20X\24\0\360\6\221|\377\377\377\377P\0\0\0\346\31\0|\0\0\24\0\340\310\22\0\372\31\221|t\320\22\0\30\356\220|\0\0\0\0\0\0\0\0\0\0\0\0\351\201\347w" ... {200, 224, reply, 0, 1036, 464, 57976, 0} "\7\0\24\0\10\0\0\0\274\0\0\0`\247\244\\261\353\317\21\206\21\0\240$T \355\1\0\0\0\1\0\0\0\0\0\0\0\4\0\0\002\24\0\377\377\377\377\10\0\0\0\5\0\0\0x\1\24\0\0\0\0\0\0\0\25\0\2\0\0\0:\207i\26o\32\32A\260"\25\0h\1\24\0\12\0\0\0\0\0\0\0\260"\25\0(\0\0\0\270"\25\0\34T\7Lx\1\24\0(\0\0\0\316\325\0\0\0\0\24\0\274\310\22\0\252\1\0\0\0\0\0\0\20X\24\0\360\6\221|\377\377\377\377P\0\0\0\346\31\0|\0\0\24\0\340\310\22\0\372\31\221|t\320\22\0\30\356\220|\0\0\0\0\0\0\0\0\0\0\0\0\351\201\347w" ) \25\0\10\0\0\0\5\0\0\0x\1\24\0\0\0\0\0\0\0\25\0\2\0\0\0:\207i\26o\32\32A\260 (192, {200, 224, new_msg, 0, 2621478, 1385184, 12, 2} "\0\0\24\0\10\0\0\0\274\0\0\0`\247\244\\261\353\317\21\206\21\0\240$T \355\1\0\0\0\1\0\0\0\0\0\2\0\4\0\0\002\24\0\270"\25\0\10\0\0\0\5\0\0\0x\1\24\0\0\0\0\0\0\0\25\0\2\0\0\0:\207i\26o\32\32A\260"\25\0h\1\24\0\12\0\0\0\0\0\0\0\260"\25\0(\0\0\0\270"\25\0\34T\7Lx\1\24\0(\0\0\0\316\325\0\0\0\0\24\0\274\310\22\0\252\1\0\0\0\0\0\0\20X\24\0\360\6\221|\377\377\377\377P\0\0\0\346\31\0|\0\0\24\0\340\310\22\0\372\31\221|t\320\22\0\30\356\220|\0\0\0\0\0\0\0\0\0\0\0\0\351\201\347w" ... {200, 224, reply, 0, 1036, 464, 57976, 0} "\7\0\24\0\10\0\0\0\274\0\0\0`\247\244\\261\353\317\21\206\21\0\240$T \355\1\0\0\0\1\0\0\0\0\0\0\0\4\0\0\002\24\0\377\377\377\377\10\0\0\0\5\0\0\0x\1\24\0\0\0\0\0\0\0\25\0\2\0\0\0:\207i\26o\32\32A\260"\25\0h\1\24\0\12\0\0\0\0\0\0\0\260"\25\0(\0\0\0\270"\25\0\34T\7Lx\1\24\0(\0\0\0\316\325\0\0\0\0\24\0\274\310\22\0\252\1\0\0\0\0\0\0\20X\24\0\360\6\221|\377\377\377\377P\0\0\0\346\31\0|\0\0\24\0\340\310\22\0\372\31\221|t\320\22\0\30\356\220|\0\0\0\0\0\0\0\0\0\0\0\0\351\201\347w" ) \25\0(\0\0\0\270 (192, {200, 224, new_msg, 0, 2621478, 1385184, 12, 2} "\0\0\24\0\10\0\0\0\274\0\0\0`\247\244\\261\353\317\21\206\21\0\240$T \355\1\0\0\0\1\0\0\0\0\0\2\0\4\0\0\002\24\0\270"\25\0\10\0\0\0\5\0\0\0x\1\24\0\0\0\0\0\0\0\25\0\2\0\0\0:\207i\26o\32\32A\260"\25\0h\1\24\0\12\0\0\0\0\0\0\0\260"\25\0(\0\0\0\270"\25\0\34T\7Lx\1\24\0(\0\0\0\316\325\0\0\0\0\24\0\274\310\22\0\252\1\0\0\0\0\0\0\20X\24\0\360\6\221|\377\377\377\377P\0\0\0\346\31\0|\0\0\24\0\340\310\22\0\372\31\221|t\320\22\0\30\356\220|\0\0\0\0\0\0\0\0\0\0\0\0\351\201\347w" ... {200, 224, reply, 0, 1036, 464, 57976, 0} "\7\0\24\0\10\0\0\0\274\0\0\0`\247\244\\261\353\317\21\206\21\0\240$T \355\1\0\0\0\1\0\0\0\0\0\0\0\4\0\0\002\24\0\377\377\377\377\10\0\0\0\5\0\0\0x\1\24\0\0\0\0\0\0\0\25\0\2\0\0\0:\207i\26o\32\32A\260"\25\0h\1\24\0\12\0\0\0\0\0\0\0\260"\25\0(\0\0\0\270"\25\0\34T\7Lx\1\24\0(\0\0\0\316\325\0\0\0\0\24\0\274\310\22\0\252\1\0\0\0\0\0\0\20X\24\0\360\6\221|\377\377\377\377P\0\0\0\346\31\0|\0\0\24\0\340\310\22\0\372\31\221|t\320\22\0\30\356\220|\0\0\0\0\0\0\0\0\0\0\0\0\351\201\347w" ) ... {200, 224, reply, 0, 1036, 464, 57976, 0} (192, {200, 224, new_msg, 0, 2621478, 1385184, 12, 2} "\0\0\24\0\10\0\0\0\274\0\0\0`\247\244\\261\353\317\21\206\21\0\240$T \355\1\0\0\0\1\0\0\0\0\0\2\0\4\0\0\002\24\0\270"\25\0\10\0\0\0\5\0\0\0x\1\24\0\0\0\0\0\0\0\25\0\2\0\0\0:\207i\26o\32\32A\260"\25\0h\1\24\0\12\0\0\0\0\0\0\0\260"\25\0(\0\0\0\270"\25\0\34T\7Lx\1\24\0(\0\0\0\316\325\0\0\0\0\24\0\274\310\22\0\252\1\0\0\0\0\0\0\20X\24\0\360\6\221|\377\377\377\377P\0\0\0\346\31\0|\0\0\24\0\340\310\22\0\372\31\221|t\320\22\0\30\356\220|\0\0\0\0\0\0\0\0\0\0\0\0\351\201\347w" ... {200, 224, reply, 0, 1036, 464, 57976, 0} "\7\0\24\0\10\0\0\0\274\0\0\0`\247\244\\261\353\317\21\206\21\0\240$T \355\1\0\0\0\1\0\0\0\0\0\0\0\4\0\0\002\24\0\377\377\377\377\10\0\0\0\5\0\0\0x\1\24\0\0\0\0\0\0\0\25\0\2\0\0\0:\207i\26o\32\32A\260"\25\0h\1\24\0\12\0\0\0\0\0\0\0\260"\25\0(\0\0\0\270"\25\0\34T\7Lx\1\24\0(\0\0\0\316\325\0\0\0\0\24\0\274\310\22\0\252\1\0\0\0\0\0\0\20X\24\0\360\6\221|\377\377\377\377P\0\0\0\346\31\0|\0\0\24\0\340\310\22\0\372\31\221|t\320\22\0\30\356\220|\0\0\0\0\0\0\0\0\0\0\0\0\351\201\347w" ) \25\0h\1\24\0\12\0\0\0\0\0\0\0\260 (192, {200, 224, new_msg, 0, 2621478, 1385184, 12, 2} "\0\0\24\0\10\0\0\0\274\0\0\0`\247\244\\261\353\317\21\206\21\0\240$T \355\1\0\0\0\1\0\0\0\0\0\2\0\4\0\0\002\24\0\270"\25\0\10\0\0\0\5\0\0\0x\1\24\0\0\0\0\0\0\0\25\0\2\0\0\0:\207i\26o\32\32A\260"\25\0h\1\24\0\12\0\0\0\0\0\0\0\260"\25\0(\0\0\0\270"\25\0\34T\7Lx\1\24\0(\0\0\0\316\325\0\0\0\0\24\0\274\310\22\0\252\1\0\0\0\0\0\0\20X\24\0\360\6\221|\377\377\377\377P\0\0\0\346\31\0|\0\0\24\0\340\310\22\0\372\31\221|t\320\22\0\30\356\220|\0\0\0\0\0\0\0\0\0\0\0\0\351\201\347w" ... {200, 224, reply, 0, 1036, 464, 57976, 0} "\7\0\24\0\10\0\0\0\274\0\0\0`\247\244\\261\353\317\21\206\21\0\240$T \355\1\0\0\0\1\0\0\0\0\0\0\0\4\0\0\002\24\0\377\377\377\377\10\0\0\0\5\0\0\0x\1\24\0\0\0\0\0\0\0\25\0\2\0\0\0:\207i\26o\32\32A\260"\25\0h\1\24\0\12\0\0\0\0\0\0\0\260"\25\0(\0\0\0\270"\25\0\34T\7Lx\1\24\0(\0\0\0\316\325\0\0\0\0\24\0\274\310\22\0\252\1\0\0\0\0\0\0\20X\24\0\360\6\221|\377\377\377\377P\0\0\0\346\31\0|\0\0\24\0\340\310\22\0\372\31\221|t\320\22\0\30\356\220|\0\0\0\0\0\0\0\0\0\0\0\0\351\201\347w" ) \25\0\34T\7Lx\1\24\0(\0\0\0\316\325\0\0\0\0\24\0\274\310\22\0\252\1\0\0\0\0\0\0\20X\24\0\360\6\221|\377\377\377\377P\0\0\0\346\31\0|\0\0\24\0\340\310\22\0\372\31\221|t\320\22\0\30\356\220|\0\0\0\0\0\0\0\0\0\0\0\0\351\201\347w" ) == 0x0 01982 464 NtRequestWaitReplyPort (192, {32, 56, new_msg, 0, 0, 0, 0, 0} (192, {32, 56, new_msg, 0, 0, 0, 0, 0} "\1\0\0\0A\3\0\0`\247\244\\261\353\317\21\206\21\0\240$T \355\377\377\377\377\0\0\0\0" ... {124, 148, reply, 0, 1036, 464, 57977, 0} "\2\356Q\200\1\0\0\0\30b\202\201\0\260\375\177\220k\364\367\370\37`\300lk\364\367X\353Q\200\0\0\0\0\0\0\0\0)%\25E?>\A\250\245\22\360\331E\16S\1\300\375\177(l\364\367\253\362Q\200\324k\364\367\300\250U\200aFT\200\0\0\0\0h\242\250\201\0;\251\201\1`\202\201\0\0\0\0\0\376?\300\344\243n\371\20W\271\201\2\0\0\0\240V\271\201\240V\271\201" ) ... {124, 148, reply, 0, 1036, 464, 57977, 0} (192, {32, 56, new_msg, 0, 0, 0, 0, 0} "\1\0\0\0A\3\0\0`\247\244\\261\353\317\21\206\21\0\240$T \355\377\377\377\377\0\0\0\0" ... {124, 148, reply, 0, 1036, 464, 57977, 0} "\2\356Q\200\1\0\0\0\30b\202\201\0\260\375\177\220k\364\367\370\37`\300lk\364\367X\353Q\200\0\0\0\0\0\0\0\0)%\25E?>\A\250\245\22\360\331E\16S\1\300\375\177(l\364\367\253\362Q\200\324k\364\367\300\250U\200aFT\200\0\0\0\0h\242\250\201\0;\251\201\1`\202\201\0\0\0\0\0\376?\300\344\243n\371\20W\271\201\2\0\0\0\240V\271\201\240V\271\201" ) ) == 0x0 01983 464 NtRequestWaitReplyPort (192, {44, 68, new_msg, 56, 1036, 464, 57977, 0} (192, {44, 68, new_msg, 56, 1036, 464, 57977, 0} "\1\356\0\0B\2\5\0\30b\202\201\0\260\375\177\220k\364\367\370\37`\300\377\377\377\377X\353Q\200\1\0\0\0`%\25\0\10\5\0\0" ... {40, 64, reply, 0, 1036, 464, 57978, 0} "\2\376\255\201\4\0\0\0\200Y\274\201V\347\340\341\264\311\275\201:\332R\200X;\350\371\324\376\255\201\14\5\0\0\320\371\15\0" ) ... {40, 64, reply, 0, 1036, 464, 57978, 0} (192, {44, 68, new_msg, 56, 1036, 464, 57977, 0} "\1\356\0\0B\2\5\0\30b\202\201\0\260\375\177\220k\364\367\370\37`\300\377\377\377\377X\353Q\200\1\0\0\0`%\25\0\10\5\0\0" ... {40, 64, reply, 0, 1036, 464, 57978, 0} "\2\376\255\201\4\0\0\0\200Y\274\201V\347\340\341\264\311\275\201:\332R\200X;\350\371\324\376\255\201\14\5\0\0\320\371\15\0" ) ) == 0x0 01984 464 NtRequestWaitReplyPort (192, {64, 88, new_msg, 56, 1385544, 1232032, 1385816, 0} (192, {64, 88, new_msg, 56, 1385544, 1232032, 1385816, 0} "\10\0\0\0@\0\1\1U\1\0\0\230\313\22\0`%\25\0\264\320\22\0\30\356\220|p\5\221|\1\0\0\0`%\25\0\14\5\0\0\14\5\0\0\320\371\15\0\0\0\0\0\0\0\0\0\273f\347w" ... {64, 88, reply, 56, 1036, 464, 57979, 0} "\10\0\0\0@\0\1\1U\1\0\0\230\313\22\0`%\25\0\264\320\22\0\30\356\220|p\5\221|\1\0\0\0`%\25\0\14\5\0\0\14\5\0\0\320\371\15\0\0\0\0\0\0\0\0\0\273f\347w" ) ... {64, 88, reply, 56, 1036, 464, 57979, 0} (192, {64, 88, new_msg, 56, 1385544, 1232032, 1385816, 0} "\10\0\0\0@\0\1\1U\1\0\0\230\313\22\0`%\25\0\264\320\22\0\30\356\220|p\5\221|\1\0\0\0`%\25\0\14\5\0\0\14\5\0\0\320\371\15\0\0\0\0\0\0\0\0\0\273f\347w" ... {64, 88, reply, 56, 1036, 464, 57979, 0} "\10\0\0\0@\0\1\1U\1\0\0\230\313\22\0`%\25\0\264\320\22\0\30\356\220|p\5\221|\1\0\0\0`%\25\0\14\5\0\0\14\5\0\0\320\371\15\0\0\0\0\0\0\0\0\0\273f\347w" ) ) == 0x0 01985 464 NtRequestWaitReplyPort (192, {44, 68, new_msg, 56, 1036, 464, 57978, 0} (192, {44, 68, new_msg, 56, 1036, 464, 57978, 0} "\1\376\0\0B\2\5\0\200Y\274\201V\347\340\341\264\311\275\201:\332R\200\377\377\377\377\324\376\255\201\1\0\0\00*\25\0\10\5\0\0" ... {40, 64, reply, 0, 1036, 464, 57980, 0} "\2\356Q\200\4\0\0\0\30b\202\201\0\260\375\177\220k\364\367\370\37`\300lk\364\367X\353Q\200\14\5\0\0\320\371\15\0" ) ... {40, 64, reply, 0, 1036, 464, 57980, 0} (192, {44, 68, new_msg, 56, 1036, 464, 57978, 0} "\1\376\0\0B\2\5\0\200Y\274\201V\347\340\341\264\311\275\201:\332R\200\377\377\377\377\324\376\255\201\1\0\0\00*\25\0\10\5\0\0" ... {40, 64, reply, 0, 1036, 464, 57980, 0} "\2\356Q\200\4\0\0\0\30b\202\201\0\260\375\177\220k\364\367\370\37`\300lk\364\367X\353Q\200\14\5\0\0\320\371\15\0" ) ) == 0x0 01986 464 NtRequestWaitReplyPort (192, {64, 88, new_msg, 56, 1385544, 1232032, 1387048, 0} (192, {64, 88, new_msg, 56, 1385544, 1232032, 1387048, 0} "\10\0\0\0@\0\1\1\273\0\0\0\230\313\22\00*\25\0\264\320\22\0\30\356\220|p\5\221|\1\0\0\00*\25\0\14\5\0\0\14\5\0\0\320\371\15\0\0\0\0\0\0\0\0\0\273f\347w" ... {64, 88, reply, 56, 1036, 464, 57981, 0} "\10\0\0\0@\0\1\1\273\0\0\0\230\313\22\00*\25\0\264\320\22\0\30\356\220|p\5\221|\1\0\0\00*\25\0\14\5\0\0\14\5\0\0\320\371\15\0\0\0\0\0\0\0\0\0\273f\347w" ) ... {64, 88, reply, 56, 1036, 464, 57981, 0} (192, {64, 88, new_msg, 56, 1385544, 1232032, 1387048, 0} "\10\0\0\0@\0\1\1\273\0\0\0\230\313\22\00*\25\0\264\320\22\0\30\356\220|p\5\221|\1\0\0\00*\25\0\14\5\0\0\14\5\0\0\320\371\15\0\0\0\0\0\0\0\0\0\273f\347w" ... {64, 88, reply, 56, 1036, 464, 57981, 0} "\10\0\0\0@\0\1\1\273\0\0\0\230\313\22\00*\25\0\264\320\22\0\30\356\220|p\5\221|\1\0\0\00*\25\0\14\5\0\0\14\5\0\0\320\371\15\0\0\0\0\0\0\0\0\0\273f\347w" ) ) == 0x0 01987 464 NtOpenKey (0x20019, {24, 0, 0x40, 0, 0, (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\System\CurrentControlSet\Control\ComputerName"}, ... 196, ) }, ... 196, ) == 0x0 01988 464 NtOpenKey (0x20019, {24, 196, 0x40, 0, 0, (0x20019, {24, 196, 0x40, 0, 0, "ActiveComputerName"}, ... 200, ) }, ... 200, ) == 0x0 01989 464 NtQueryValueKey (200, (200, "ComputerName", Full, 108, ... TitleIdx=0, Type=1, Name="ComputerName", Data="V\0I\0R\0T\0U\0A\0L\0\0\0"}, 60, ) , Full, 108, ... TitleIdx=0, Type=1, Name= (200, "ComputerName", Full, 108, ... TitleIdx=0, Type=1, Name="ComputerName", Data="V\0I\0R\0T\0U\0A\0L\0\0\0"}, 60, ) , Data= (200, "ComputerName", Full, 108, ... TitleIdx=0, Type=1, Name="ComputerName", Data="V\0I\0R\0T\0U\0A\0L\0\0\0"}, 60, ) }, 60, ) == 0x0 01990 464 NtClose (200, ... ) == 0x0 01991 464 NtClose (196, ... ) == 0x0 01992 464 NtCreateIoCompletion (0x1f0003, 0x0, 0, ... 196, ) == 0x0 01993 464 NtCreateIoCompletion (0x1f0003, 0x0, -1, ... 200, ) == 0x0 01994 464 NtDuplicateObject (-1, 196, -1, 0x0, 0, 2, ... 204, ) == 0x0 01995 464 NtOpenThreadToken (-2, 0xc, 1, ... ) == STATUS_NO_TOKEN 01996 464 NtCreateEvent (0x1f0003, 0x0, 1, 0, ... 208, ) == 0x0 01997 464 NtOpenThreadToken (-2, 0xc, 1, ... ) == STATUS_NO_TOKEN 01998 464 NtSetInformationThread (-2, ImpersonationToken, {ImpToken=0,}, 4, ... ) == 0x0 01999 464 NtCreateFile (0xc0100080, {24, 0, 0x40, 0, 1231492, (0xc0100080, {24, 0, 0x40, 0, 1231492, "\??\PIPE\lsarpc"}, 0x0, 0, 3, 1, 64, 0, 0, ... 212, {status=0x0, info=1}, ) }, 0x0, 0, 3, 1, 64, 0, 0, ... 212, {status=0x0, info=1}, ) == 0x0 02000 464 NtSetInformationFile (212, 1231548, 8, Pipe, ... {status=0x0, info=0}, ) == 0x0 02001 464 NtSetInformationFile (212, 1231536, 8, Completion, ... {status=0x0, info=0}, ) == 0x0 02002 464 NtSetInformationThread (-2, ImpersonationToken, {ImpToken=0,}, 4, ... ) == 0x0 02003 464 NtWriteFile (212, 181, 0, 0, (212, 181, 0, 0, "\5\0\13\3\20\0\0\0H\0\0\0\1\0\0\0\270\20\270\20\0\0\0\0\1\0\0\0\0\0\1\0xW4\224\22\315\253\357\0\1#Eg\211\253\0\0\0\0\4]\210\212\353\34\311\21\237\350\10\0+\20H`\2\0\0\0", 72, {0, 0}, 0, ... {status=0x0, info=72}, ) , 72, {0, 0}, 0, ... {status=0x0, info=72}, ) == 0x0 02004 464 NtReadFile (212, 181, 0, 0, 1024, {0, 0}, 0, ... {status=0x0, info=68}, (212, 181, 0, 0, 1024, {0, 0}, 0, ... {status=0x0, info=68}, "\5\0\14\3\20\0\0\0D\0\0\0\1\0\0\0\270\20\270\20,+\0\0\14\0\PIPE\lsass\0\0\0\1\0\0\0\0\0\0\0\4]\210\212\353\34\311\21\237\350\10\0+\20H`\2\0\0\0", ) , ) == 0x0 02005 464 NtFsControlFile (212, 181, 0x0, 0x0, 0x11c017, (212, 181, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0@\0\0\0\1\0\0\0(\0\0\0\0\0,\0\0\0\0\0\30\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0L\321\22\0\14\0\0\0\2\0\1\0\0\10\0\0", 64, 1024, ... {status=0x103, info=68}, "\5\0\14\3\20\0\0\0D\0\0\0\1\0\0\0\270\20\270\20,+\0\0\14\0\PIPE\lsass\0\0\0\1\0\0\0\0\0\0\0\4]\210\212\353\34\311\21\237\350\10\0+\20H`\2\0\0\0", ) , 64, 1024, ... {status=0x103, info=68}, (212, 181, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0@\0\0\0\1\0\0\0(\0\0\0\0\0,\0\0\0\0\0\30\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0L\321\22\0\14\0\0\0\2\0\1\0\0\10\0\0", 64, 1024, ... {status=0x103, info=68}, "\5\0\14\3\20\0\0\0D\0\0\0\1\0\0\0\270\20\270\20,+\0\0\14\0\PIPE\lsass\0\0\0\1\0\0\0\0\0\0\0\4]\210\212\353\34\311\21\237\350\10\0+\20H`\2\0\0\0", ) , ) == 0x103 02006 464 NtAllocateVirtualMemory (-1, 1388544, 0, 4096, 4096, 4, ... 1388544, 4096, ) == 0x0 02007 464 NtFsControlFile (212, 181, 0x0, 0x0, 0x11c017, (212, 181, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0\214\0\0\0\2\0\0\0t\0\0\0\0\0D\0\0\0\0\0\24\316\274T\274\235tH\233\354\372\234W@\301\22\1\0\0\0\1\0\0\0,\0.\0\0\324\22\0\27\0\0\0\0\0\0\0\26\0\0\0V\0I\0R\0T\0U\0A\0L\0\\0M\0a\0r\0t\0i\0m\0 \0C\0a\0r\0b\0o\0n\0e\0\0\0\0\0\0\0\0\0\1\0as\0\0\0\0\0\0\0\0\2\0\0\0", 140, 1024, ... {status=0x103, info=48}, "\5\0\2\3\20\0\0\00\0\0\0\1\0\0\0\30\0\0\0\0\0\0\0\0\0\0\0\24\316\274T\274\235tH\233\354\372\234W@\301\22\0\0\0\0", ) , 140, 1024, ... {status=0x103, info=48}, (212, 181, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0\214\0\0\0\2\0\0\0t\0\0\0\0\0D\0\0\0\0\0\24\316\274T\274\235tH\233\354\372\234W@\301\22\1\0\0\0\1\0\0\0,\0.\0\0\324\22\0\27\0\0\0\0\0\0\0\26\0\0\0V\0I\0R\0T\0U\0A\0L\0\\0M\0a\0r\0t\0i\0m\0 \0C\0a\0r\0b\0o\0n\0e\0\0\0\0\0\0\0\0\0\1\0as\0\0\0\0\0\0\0\0\2\0\0\0", 140, 1024, ... {status=0x103, info=48}, "\5\0\2\3\20\0\0\00\0\0\0\1\0\0\0\30\0\0\0\0\0\0\0\0\0\0\0\24\316\274T\274\235tH\233\354\372\234W@\301\22\0\0\0\0", ) , ) == 0x103 02008 464 NtFsControlFile (212, 181, 0x0, 0x0, 0x11c017, (212, 181, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0,\0\0\0\3\0\0\0\24\0\0\0\0\0\0\0\0\0\0\0\24\316\274T\274\235tH\233\354\372\234W@\301\22", 44, 1024, ... {status=0x103, info=180}, "\5\0\2\3\20\0\0\0\264\0\0\0\2\0\0\0\234\0\0\0\0\0\0\0\3400\25\0\1\0\0\0\3540\25\0 \0\0\0\1\0\0\0\16\0\20\0\3700\25\0\101\25\0\10\0\0\0\0\0\0\0\7\0\0\0V\0I\0R\0T\0U\0A\0L\0\0\5\4\0\0\0\1\4\0\0\0\0\0\5\25\0\0\0=\343\10MB\307tR\7\345;+\1\0\0\0H1\25\0\1\0\0\0\1\0\0\0X1\25\0\0\0\0\0\0\0\0\0\5\0\0\0\1\5\0\0\0\0\0\5\25\0\0\0=\343\10MB\307tR\7\345;+\353\3\0\0\1\0\0\0\0\0\0\0", ) , 44, 1024, ... {status=0x103, info=180}, (212, 181, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0,\0\0\0\3\0\0\0\24\0\0\0\0\0\0\0\0\0\0\0\24\316\274T\274\235tH\233\354\372\234W@\301\22", 44, 1024, ... {status=0x103, info=180}, "\5\0\2\3\20\0\0\0\264\0\0\0\2\0\0\0\234\0\0\0\0\0\0\0\3400\25\0\1\0\0\0\3540\25\0 \0\0\0\1\0\0\0\16\0\20\0\3700\25\0\101\25\0\10\0\0\0\0\0\0\0\7\0\0\0V\0I\0R\0T\0U\0A\0L\0\0\5\4\0\0\0\1\4\0\0\0\0\0\5\25\0\0\0=\343\10MB\307tR\7\345;+\1\0\0\0H1\25\0\1\0\0\0\1\0\0\0X1\25\0\0\0\0\0\0\0\0\0\5\0\0\0\1\5\0\0\0\0\0\5\25\0\0\0=\343\10MB\307tR\7\345;+\353\3\0\0\1\0\0\0\0\0\0\0", ) , ) == 0x103 02009 464 NtClose (208, ... ) == 0x0 02010 464 NtClose (212, ... ) == 0x0 02011 464 NtOpenThreadToken (-2, 0xc, 1, ... ) == STATUS_NO_TOKEN 02012 464 NtCreateEvent (0x1f0003, 0x0, 1, 0, ... 212, ) == 0x0 02013 464 NtOpenThreadToken (-2, 0xc, 1, ... ) == STATUS_NO_TOKEN 02014 464 NtSetInformationThread (-2, ImpersonationToken, {ImpToken=0,}, 4, ... ) == 0x0 02015 464 NtCreateFile (0xc0100080, {24, 0, 0x40, 0, 1231464, (0xc0100080, {24, 0, 0x40, 0, 1231464, "\??\PIPE\lsarpc"}, 0x0, 0, 3, 1, 64, 0, 0, ... 208, {status=0x0, info=1}, ) }, 0x0, 0, 3, 1, 64, 0, 0, ... 208, {status=0x0, info=1}, ) == 0x0 02016 464 NtSetInformationFile (208, 1231520, 8, Pipe, ... {status=0x0, info=0}, ) == 0x0 02017 464 NtSetInformationFile (208, 1231508, 8, Completion, ... {status=0x0, info=0}, ) == 0x0 02018 464 NtSetInformationThread (-2, ImpersonationToken, {ImpToken=0,}, 4, ... ) == 0x0 02019 464 NtWriteFile (208, 181, 0, 0, (208, 181, 0, 0, "\5\0\13\3\20\0\0\0H\0\0\0\1\0\0\0\270\20\270\20\0\0\0\0\1\0\0\0\0\0\1\0xW4\224\22\315\253\357\0\1#Eg\211\253\0\0\0\0\4]\210\212\353\34\311\21\237\350\10\0+\20H`\2\0\0\0", 72, {0, 0}, 0, ... {status=0x0, info=72}, ) , 72, {0, 0}, 0, ... {status=0x0, info=72}, ) == 0x0 02020 464 NtReadFile (208, 181, 0, 0, 1024, {0, 0}, 0, ... {status=0x0, info=68}, (208, 181, 0, 0, 1024, {0, 0}, 0, ... {status=0x0, info=68}, "\5\0\14\3\20\0\0\0D\0\0\0\1\0\0\0\270\20\270\20-+\0\0\14\0\PIPE\lsass\0\0\0\1\0\0\0\0\0\0\0\4]\210\212\353\34\311\21\237\350\10\0+\20H`\2\0\0\0", ) , ) == 0x0 02021 464 NtFsControlFile (208, 181, 0x0, 0x0, 0x11c017, (208, 181, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0@\0\0\0\1\0\0\0(\0\0\0\0\0,\0\0\0\0\0\30\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\321\22\0\14\0\0\0\2\0\1\0\0\10\0\0", 64, 1024, ... {status=0x103, info=68}, "\5\0\14\3\20\0\0\0D\0\0\0\1\0\0\0\270\20\270\20-+\0\0\14\0\PIPE\lsass\0\0\0\1\0\0\0\0\0\0\0\4]\210\212\353\34\311\21\237\350\10\0+\20H`\2\0\0\0", ) , 64, 1024, ... {status=0x103, info=68}, (208, 181, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0@\0\0\0\1\0\0\0(\0\0\0\0\0,\0\0\0\0\0\30\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\321\22\0\14\0\0\0\2\0\1\0\0\10\0\0", 64, 1024, ... {status=0x103, info=68}, "\5\0\14\3\20\0\0\0D\0\0\0\1\0\0\0\270\20\270\20-+\0\0\14\0\PIPE\lsass\0\0\0\1\0\0\0\0\0\0\0\4]\210\212\353\34\311\21\237\350\10\0+\20H`\2\0\0\0", ) , ) == 0x103 02022 464 NtFsControlFile (208, 181, 0x0, 0x0, 0x11c017, (208, 181, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0\214\0\0\0\2\0\0\0t\0\0\0\0\0D\0\0\0\0\0\2169\4V\276h{J\225\236o\243\366\340=\216\1\0\0\0\1\0\0\0,\0.\0\0\324\22\0\27\0\0\0\0\0\0\0\26\0\0\0V\0I\0R\0T\0U\0A\0L\0\\0M\0a\0r\0t\0i\0m\0 \0C\0a\0r\0b\0o\0n\0e\0\0\0\0\0\0\0\0\0\1\0as\0\0\0\0\0\0\0\0\2\0\0\0", 140, 1024, ... {status=0x103, info=48}, "\5\0\2\3\20\0\0\00\0\0\0\1\0\0\0\30\0\0\0\0\0\0\0\0\0\0\0\2169\4V\276h{J\225\236o\243\366\340=\216\0\0\0\0", ) , 140, 1024, ... {status=0x103, info=48}, (208, 181, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0\214\0\0\0\2\0\0\0t\0\0\0\0\0D\0\0\0\0\0\2169\4V\276h{J\225\236o\243\366\340=\216\1\0\0\0\1\0\0\0,\0.\0\0\324\22\0\27\0\0\0\0\0\0\0\26\0\0\0V\0I\0R\0T\0U\0A\0L\0\\0M\0a\0r\0t\0i\0m\0 \0C\0a\0r\0b\0o\0n\0e\0\0\0\0\0\0\0\0\0\1\0as\0\0\0\0\0\0\0\0\2\0\0\0", 140, 1024, ... {status=0x103, info=48}, "\5\0\2\3\20\0\0\00\0\0\0\1\0\0\0\30\0\0\0\0\0\0\0\0\0\0\0\2169\4V\276h{J\225\236o\243\366\340=\216\0\0\0\0", ) , ) == 0x103 02023 464 NtFsControlFile (208, 181, 0x0, 0x0, 0x11c017, (208, 181, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0,\0\0\0\3\0\0\0\24\0\0\0\0\0\0\0\0\0\0\0\2169\4V\276h{J\225\236o\243\366\340=\216", 44, 1024, ... {status=0x103, info=180}, "\5\0\2\3\20\0\0\0\264\0\0\0\2\0\0\0\234\0\0\0\0\0\0\0\3400\25\0\1\0\0\0\3540\25\0 \0\0\0\1\0\0\0\16\0\20\0\3700\25\0\101\25\0\10\0\0\0\0\0\0\0\7\0\0\0V\0I\0R\0T\0U\0A\0L\0\0\5\4\0\0\0\1\4\0\0\0\0\0\5\25\0\0\0=\343\10MB\307tR\7\345;+\1\0\0\0H1\25\0\1\0\0\0\1\0\0\0X1\25\0\0\0\0\0\0\0\0\0\5\0\0\0\1\5\0\0\0\0\0\5\25\0\0\0=\343\10MB\307tR\7\345;+\353\3\0\0\1\0\0\0\0\0\0\0", ) , 44, 1024, ... {status=0x103, info=180}, (208, 181, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0,\0\0\0\3\0\0\0\24\0\0\0\0\0\0\0\0\0\0\0\2169\4V\276h{J\225\236o\243\366\340=\216", 44, 1024, ... {status=0x103, info=180}, "\5\0\2\3\20\0\0\0\264\0\0\0\2\0\0\0\234\0\0\0\0\0\0\0\3400\25\0\1\0\0\0\3540\25\0 \0\0\0\1\0\0\0\16\0\20\0\3700\25\0\101\25\0\10\0\0\0\0\0\0\0\7\0\0\0V\0I\0R\0T\0U\0A\0L\0\0\5\4\0\0\0\1\4\0\0\0\0\0\5\25\0\0\0=\343\10MB\307tR\7\345;+\1\0\0\0H1\25\0\1\0\0\0\1\0\0\0X1\25\0\0\0\0\0\0\0\0\0\5\0\0\0\1\5\0\0\0\0\0\5\25\0\0\0=\343\10MB\307tR\7\345;+\353\3\0\0\1\0\0\0\0\0\0\0", ) , ) == 0x103 02024 464 NtClose (212, ... ) == 0x0 02025 464 NtClose (208, ... ) == 0x0 02026 464 NtOpenProcessToken (-1, 0x20008, ... 208, ) == 0x0 02027 464 NtQueryInformationToken (208, User, 0, ... ) == STATUS_BUFFER_TOO_SMALL 02028 464 NtQueryInformationToken (208, User, 36, ... {token info, class 1, size 36}, 36, ) == 0x0 02029 464 NtOpenDirectoryObject (0x2, {24, 0, 0x40, 0, 0, (0x2, {24, 0, 0x40, 0, 0, "\Windows\WindowStations"}, ... 212, ) }, ... 212, ) == 0x0 02030 464 NtUserOpenWindowStation ({24, 212, 0x40, 0, 0, ({24, 212, 0x40, 0, 0, "winsta0"}, 0x37f, ... ) }, 0x37f, ... ) == 0xd8 02031 464 NtClose (212, ... ) == 0x0 02032 464 NtUserCloseWindowStation (216, ... 02033 464 NtClose (216, ... ) == 0x0 02032 464 NtUserCloseWindowStation ... ) == 0x1 02034 464 NtClose (208, ... ) == 0x0 02035 464 NtCreateEvent (0x1f0003, {24, 0, 0x2, 0, 0, 0x0}, 1, 0, ... 208, ) == 0x0 02036 464 NtCreateEvent (0x1f0003, {24, 0, 0x2, 0, 0, 0x0}, 1, 0, ... 216, ) == 0x0 02037 464 NtCreateMutant (0x1f0001, {24, 0, 0x2, 0, 0, 0x0}, 0, ... 212, ) == 0x0 02038 464 NtDuplicateObject (-1, -1, -1, 0x1f0fff, 2, 0, ... 220, ) == 0x0 02039 464 NtCreateSection (0xf0007, {24, 0, 0x2, 0, 0, 0x0}, {7248, 0}, 4, 134217728, 0, ... 224, ) == 0x0 02040 464 NtMapViewOfSection (224, -1, (0x0), 0, 0, {0, 0}, 0, 1, 0, 4, ... (0xbf0000), {0, 0}, 8192, ) == 0x0 02041 464 NtQueryDefaultUILanguage (1232156, ... 02042 464 NtOpenThreadTokenEx (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN 02043 464 NtOpenProcessTokenEx (-1, 0x20008, 512, ... -2147482740, ) == 0x0 02044 464 NtQueryInformationToken (-2147482740, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0 02045 464 NtClose (-2147482740, ... ) == 0x0 02046 464 NtOpenKey (0x2000000, {24, 0, 0x640, 0, 0, (0x2000000, {24, 0, 0x640, 0, 0, "\REGISTRY\USER\S-1-5-21-1292428093-1383384898-725345543-1003"}, ... -2147482740, ) }, ... -2147482740, ) == 0x0 02047 464 NtOpenKey (0x80000000, {24, -2147482740, 0x240, 0, 0, (0x80000000, {24, -2147482740, 0x240, 0, 0, "Software\Policies\Microsoft\Control Panel\Desktop"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 02048 464 NtOpenKey (0x80000000, {24, -2147482740, 0x640, 0, 0, (0x80000000, {24, -2147482740, 0x640, 0, 0, "Control Panel\Desktop"}, ... -2147481328, ) }, ... -2147481328, ) == 0x0 02049 464 NtQueryValueKey (-2147481328, (-2147481328, "MultiUILanguageId", Partial, 256, ... ) , Partial, 256, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 02050 464 NtClose (-2147481328, ... ) == 0x0 02051 464 NtClose (-2147482740, ... ) == 0x0 02041 464 NtQueryDefaultUILanguage ... ) == 0x0 02052 464 NtQueryInformationProcess (-1, DefaultHardErrorMode, 4, ... {process info, class 12, size 4}, 0x0, ) == 0x0 02053 464 NtSetInformationProcess (-1, DefaultHardErrorMode, {process info, class 12, size 4}, 4, ... ) == 0x0 02054 464 NtQueryAttributesFile ({24, 0, 0x40, 0, 0, ({24, 0, 0x40, 0, 0, "\??\u:\work\packed.exe"}, 1230400, ... ) }, 1230400, ... ) == 0x0 02055 464 NtAllocateVirtualMemory (-1, 1220608, 0, 4096, 4096, 260, ... 1220608, 4096, ) == 0x0 02056 464 NtQueryAttributesFile ({24, 0, 0x40, 0, 0, ({24, 0, 0x40, 0, 0, "\??\u:\work\packed.exe"}, 1229172, ... ) }, 1229172, ... ) == 0x0 02057 464 NtQueryInformationProcess (-1, DefaultHardErrorMode, 4, ... {process info, class 12, size 4}, 0x0, ) == 0x0 02058 464 NtSetInformationProcess (-1, DefaultHardErrorMode, {process info, class 12, size 4}, 4, ... ) == 0x0 02059 464 NtCreateFile (0x10100080, {24, 0, 0x40, 0, 1231508, (0x10100080, {24, 0, 0x40, 0, 1231508, "\??\C:\DOCUME~1\MARTIM~1\LOCALS~1\Temp\d16_appcompat.txt"}, 0x0, 128, 0, 2, 96, 0, 0, ... }, 0x0, 128, 0, 2, 96, 0, 0, ... 02060 464 NtQueryDirectoryFile (-2147482740, 0, 0, 0, -519819264, 4096, Names, 1, (-2147482740, 0, 0, 0, -519819264, 4096, Names, 1, "DOCUME~1", 1, ... {status=0x0, info=56}, ) , 1, ... {status=0x0, info=56}, ) == 0x0 02061 464 NtClose (-2147482740, ... ) == 0x0 02062 464 NtQueryDirectoryFile (-2147482740, 0, 0, 0, -519819264, 4096, Names, 1, (-2147482740, 0, 0, 0, -519819264, 4096, Names, 1, "MARTIM~1", 1, ... {status=0x0, info=40}, ) , 1, ... {status=0x0, info=40}, ) == 0x0 02063 464 NtClose (-2147482740, ... ) == 0x0 02064 464 NtQueryDirectoryFile (-2147482740, 0, 0, 0, -519819264, 4096, Names, 1, (-2147482740, 0, 0, 0, -519819264, 4096, Names, 1, "LOCALS~1", 1, ... {status=0x0, info=40}, ) , 1, ... {status=0x0, info=40}, ) == 0x0 02065 464 NtClose (-2147482740, ... ) == 0x0 02059 464 NtCreateFile ... 228, {status=0x0, info=2}, ) == 0x0 02066 464 NtClose (228, ... ) == 0x0 02067 464 NtClose (-1, ... ) == STATUS_INVALID_HANDLE 02068 464 NtQueryInformationProcess (-1, DeviceMap, 36, ... {process info, class 23, size 36}, 0x0, ) == 0x0 02069 464 NtOpenFile (0x100080, {24, 0, 0x40, 0, 0, (0x100080, {24, 0, 0x40, 0, 0, "\??\u:"}, 3, 96, ... 228, {status=0x0, info=1}, ) }, 3, 96, ... 228, {status=0x0, info=1}, ) == 0x0 02070 464 NtOpenSymbolicLinkObject (0x1, {24, 0, 0x40, 0, 0, (0x1, {24, 0, 0x40, 0, 0, "\??\u:"}, ... 232, ) }, ... 232, ) == 0x0 02071 464 NtQuerySymbolicLinkObject (232, ... (232, ... "\Device\WinDfs\U:0000000000009f43", 66, ) , 66, ) == 0x0 02072 464 NtClose (232, ... ) == 0x0 02073 464 NtQueryVolumeInformationFile (228, 1230724, 8, Device, ... {status=0x0, info=8}, ) == 0x0 02074 464 NtClose (228, ... ) == 0x0 02075 464 NtQueryAttributesFile ({24, 0, 0x40, 0, 0, ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\apphelp.dll"}, 1229520, ... ) }, 1229520, ... ) == 0x0 02076 464 NtOpenFile (0x100020, {24, 0, 0x40, 0, 0, (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\apphelp.dll"}, 5, 96, ... 228, {status=0x0, info=1}, ) }, 5, 96, ... 228, {status=0x0, info=1}, ) == 0x0 02077 464 NtCreateSection (0xe, 0x0, 0x0, 16, 134217728, 228, ... 232, ) == 0x0 02078 464 NtClose (228, ... ) == 0x0 02079 464 NtMapViewOfSection (232, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 16, ... (0xc00000), 0x0, 126976, ) == 0x0 02080 464 NtClose (232, ... ) == 0x0 02081 464 NtUnmapViewOfSection (-1, 0xc00000, ... ) == 0x0 02082 464 NtQueryAttributesFile ({24, 0, 0x40, 0, 0, ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\apphelp.dll"}, 1229828, ... ) }, 1229828, ... ) == 0x0 02083 464 NtOpenFile (0x100020, {24, 0, 0x40, 0, 0, (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\apphelp.dll"}, 5, 96, ... 232, {status=0x0, info=1}, ) }, 5, 96, ... 232, {status=0x0, info=1}, ) == 0x0 02084 464 NtCreateSection (0xf, 0x0, 0x0, 16, 16777216, 232, ... 228, ) == 0x0 02085 464 NtQuerySection (228, Image, 48, ... {section info, class 1, size 48}, 0x0, ) == 0x0 02086 464 NtClose (232, ... ) == 0x0 02087 464 NtMapViewOfSection (228, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x77b40000), 0x0, 139264, ) == 0x0 02088 464 NtClose (228, ... ) == 0x0 02089 464 NtProtectVirtualMemory (-1, (0x77b41000), 524, 4, ... (0x77b41000), 4096, 32, ) == 0x0 02090 464 NtProtectVirtualMemory (-1, (0x77b41000), 4096, 32, ... (0x77b41000), 4096, 4, ) == 0x0 02091 464 NtFlushInstructionCache (-1, 2008289280, 524, ... ) == 0x0 02092 464 NtOpenKey (0x80000000, {24, 0, 0x40, 0, 0, (0x80000000, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\apphelp.dll"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 02093 464 NtAllocateVirtualMemory (-1, 1392640, 0, 12288, 4096, 4, ... 1392640, 12288, ) == 0x0 02094 464 NtQueryAttributesFile ({24, 0, 0x40, 0, 0, ({24, 0, 0x40, 0, 0, "\??\u:\work\packed.exe"}, 1231216, ... ) }, 1231216, ... ) == 0x0 02095 464 NtCreateFile (0x40100080, {24, 0, 0x40, 0, 1231224, (0x40100080, {24, 0, 0x40, 0, 1231224, "\??\C:\DOCUME~1\MARTIM~1\LOCALS~1\Temp\d16_appcompat.txt"}, 0x0, 128, 0, 5, 96, 0, 0, ... }, 0x0, 128, 0, 5, 96, 0, 0, ... 02096 464 NtClose (-2147482740, ... ) == 0x0 02097 464 NtQueryDirectoryFile (-2147482740, 0, 0, 0, -519819264, 4096, Names, 1, (-2147482740, 0, 0, 0, -519819264, 4096, Names, 1, "DOCUME~1", 1, ... {status=0x0, info=56}, ) , 1, ... {status=0x0, info=56}, ) == 0x0 02098 464 NtClose (-2147482740, ... ) == 0x0 02099 464 NtQueryDirectoryFile (-2147482740, 0, 0, 0, -519819264, 4096, Names, 1, (-2147482740, 0, 0, 0, -519819264, 4096, Names, 1, "MARTIM~1", 1, ... {status=0x0, info=40}, ) , 1, ... {status=0x0, info=40}, ) == 0x0 02100 464 NtClose (-2147482740, ... ) == 0x0 02101 464 NtQueryDirectoryFile (-2147482740, 0, 0, 0, -519819264, 4096, Names, 1, (-2147482740, 0, 0, 0, -519819264, 4096, Names, 1, "LOCALS~1", 1, ... {status=0x0, info=40}, ) , 1, ... {status=0x0, info=40}, ) == 0x0 02102 464 NtClose (-2147482740, ... ) == 0x0 02095 464 NtCreateFile ... 228, {status=0x0, info=3}, ) == 0x0 02103 464 NtAllocateVirtualMemory (-1, 1404928, 0, 12288, 4096, 4, ... 1404928, 12288, ) == 0x0 02104 464 NtOpenFile (0x100001, {24, 0, 0x40, 0, 0, (0x100001, {24, 0, 0x40, 0, 0, "\??\u:\work\"}, 3, 16417, ... 232, {status=0x0, info=1}, ) }, 3, 16417, ... 232, {status=0x0, info=1}, ) == 0x0 02105 464 NtQueryDirectoryFile (232, 0, 0, 0, 1229928, 616, BothDirectory, 1, (232, 0, 0, 0, 1229928, 616, BothDirectory, 1, "packed.exe", 0, ... {status=0x0, info=120}, ) , 0, ... {status=0x0, info=120}, ) == 0x0 02106 464 NtWriteFile (228, 0, 0, 0, (228, 0, 0, 0, "\377\376", 2, 0x0, 0, ... {status=0x0, info=2}, ) , 2, 0x0, 0, ... {status=0x0, info=2}, ) == 0x0 02107 464 NtWriteFile (228, 0, 0, 0, (228, 0, 0, 0, "<\0?\0x\0m\0l\0 \0v\0e\0r\0s\0i\0o\0n\0=\0"\01\0.\00\0"\0 \0e\0n\0c\0o\0d\0i\0n\0g\0=\0"\0U\0T\0F\0-\01\06\0"\0?\0>\0\15\0\12\0<\0D\0A\0T\0A\0B\0A\0S\0E\0>\0\15\0\12\0", 106, 0x0, 0, ... {status=0x0, info=106}, ) \01\0.\00\0 (228, 0, 0, 0, "<\0?\0x\0m\0l\0 \0v\0e\0r\0s\0i\0o\0n\0=\0"\01\0.\00\0"\0 \0e\0n\0c\0o\0d\0i\0n\0g\0=\0"\0U\0T\0F\0-\01\06\0"\0?\0>\0\15\0\12\0<\0D\0A\0T\0A\0B\0A\0S\0E\0>\0\15\0\12\0", 106, 0x0, 0, ... {status=0x0, info=106}, ) \0U\0T\0F\0-\01\06\0 (228, 0, 0, 0, "<\0?\0x\0m\0l\0 \0v\0e\0r\0s\0i\0o\0n\0=\0"\01\0.\00\0"\0 \0e\0n\0c\0o\0d\0i\0n\0g\0=\0"\0U\0T\0F\0-\01\06\0"\0?\0>\0\15\0\12\0<\0D\0A\0T\0A\0B\0A\0S\0E\0>\0\15\0\12\0", 106, 0x0, 0, ... {status=0x0, info=106}, ) , 106, 0x0, 0, ... {status=0x0, info=106}, ) == 0x0 02108 464 NtWriteFile (228, 0, 0, 0, (228, 0, 0, 0, "<\0E\0X\0E\0 \0N\0A\0M\0E\0=\0"\0p\0a\0c\0k\0e\0d\0.\0e\0x\0e\0"\0 \0F\0I\0L\0T\0E\0R\0=\0"\0G\0R\0A\0B\0M\0I\0_\0F\0I\0L\0T\0E\0R\0_\0T\0H\0I\0S\0F\0I\0L\0E\0O\0N\0L\0Y\0"\0>\0\15\0\12\0", 122, 0x0, 0, ... {status=0x0, info=122}, ) \0p\0a\0c\0k\0e\0d\0.\0e\0x\0e\0 (228, 0, 0, 0, "<\0E\0X\0E\0 \0N\0A\0M\0E\0=\0"\0p\0a\0c\0k\0e\0d\0.\0e\0x\0e\0"\0 \0F\0I\0L\0T\0E\0R\0=\0"\0G\0R\0A\0B\0M\0I\0_\0F\0I\0L\0T\0E\0R\0_\0T\0H\0I\0S\0F\0I\0L\0E\0O\0N\0L\0Y\0"\0>\0\15\0\12\0", 122, 0x0, 0, ... {status=0x0, info=122}, ) \0G\0R\0A\0B\0M\0I\0_\0F\0I\0L\0T\0E\0R\0_\0T\0H\0I\0S\0F\0I\0L\0E\0O\0N\0L\0Y\0 (228, 0, 0, 0, "<\0E\0X\0E\0 \0N\0A\0M\0E\0=\0"\0p\0a\0c\0k\0e\0d\0.\0e\0x\0e\0"\0 \0F\0I\0L\0T\0E\0R\0=\0"\0G\0R\0A\0B\0M\0I\0_\0F\0I\0L\0T\0E\0R\0_\0T\0H\0I\0S\0F\0I\0L\0E\0O\0N\0L\0Y\0"\0>\0\15\0\12\0", 122, 0x0, 0, ... {status=0x0, info=122}, ) , 122, 0x0, 0, ... {status=0x0, info=122}, ) == 0x0 02109 464 NtQueryAttributesFile ({24, 0, 0x40, 0, 0, ({24, 0, 0x40, 0, 0, "\??\u:\work\packed.exe"}, 1230308, ... ) }, 1230308, ... ) == 0x0 02110 464 NtOpenFile (0x100001, {24, 0, 0x40, 0, 0, (0x100001, {24, 0, 0x40, 0, 0, "\??\u:\work"}, 3, 16417, ... 236, {status=0x0, info=1}, ) }, 3, 16417, ... 236, {status=0x0, info=1}, ) == 0x0 02111 464 NtQueryDirectoryFile (236, 0, 0, 0, 1229920, 592, Directory, 1, (236, 0, 0, 0, 1229920, 592, Directory, 1, "packed.exe", 0, ... {status=0x0, info=84}, ) , 0, ... {status=0x0, info=84}, ) == 0x0 02112 464 NtClose (236, ... ) == 0x0 02113 464 NtQueryInformationProcess (-1, DefaultHardErrorMode, 4, ... {process info, class 12, size 4}, 0x0, ) == 0x0 02114 464 NtSetInformationProcess (-1, DefaultHardErrorMode, {process info, class 12, size 4}, 4, ... ) == 0x0 02115 464 NtQueryAttributesFile ({24, 0, 0x40, 0, 0, ({24, 0, 0x40, 0, 0, "\??\u:\work\packed.exe"}, 1228840, ... ) }, 1228840, ... ) == 0x0 02116 464 NtQueryAttributesFile ({24, 0, 0x40, 0, 0, ({24, 0, 0x40, 0, 0, "\??\u:\work\packed.exe"}, 1227612, ... ) }, 1227612, ... ) == 0x0 02117 464 NtQueryInformationProcess (-1, DefaultHardErrorMode, 4, ... {process info, class 12, size 4}, 0x0, ) == 0x0 02118 464 NtSetInformationProcess (-1, DefaultHardErrorMode, {process info, class 12, size 4}, 4, ... ) == 0x0 02119 464 NtCreateFile (0x80100080, {24, 0, 0x40, 0, 0, (0x80100080, {24, 0, 0x40, 0, 0, "\??\u:\work\packed.exe"}, 0x0, 128, 1, 1, 96, 0, 0, ... 236, {status=0x0, info=1}, ) }, 0x0, 128, 1, 1, 96, 0, 0, ... 236, {status=0x0, info=1}, ) == 0x0 02120 464 NtQueryInformationFile (236, 1230396, 24, Standard, ... {status=0x0, info=24}, ) == 0x0 02121 464 NtCreateSection (0x4, 0x0, 0x0, 2, 134217728, 236, ... 240, ) == 0x0 02122 464 NtMapViewOfSection (240, -1, (0x0), 0, 0, 0x0, 0, 2, 0, 2, ... (0xc00000), 0x0, 262144, ) == 0x0 02123 464 NtUnmapViewOfSection (-1, 0xc00000, ... ) == 0x0 02124 464 NtClose (240, ... ) == 0x0 02125 464 NtClose (236, ... ) == 0x0 02126 464 NtWriteFile (228, 0, 0, 0, (228, 0, 0, 0, " \0 \0 \0 \0<\0M\0A\0T\0C\0H\0I\0N\0G\0_\0F\0I\0L\0E\0 \0N\0A\0M\0E\0=\0"\0p\0a\0c\0k\0e\0d\0.\0e\0x\0e\0"\0 \0S\0I\0Z\0E\0=\0"\02\05\09\00\07\02\0"\0 \0C\0H\0E\0C\0K\0S\0U\0M\0=\0"\00\0x\09\02\0E\04\0B\0E\0B\0D\0"\0 \0M\0O\0D\0U\0L\0E\0_\0T\0Y\0P\0E\0=\0"\0W\0I\0N\03\02\0"\0 \0P\0E\0_\0C\0H\0E\0C\0K\0S\0U\0M\0=\0"\00\0x\03\0B\06\00\0F\0"\0 \0L\0I\0N\0K\0E\0R\0_\0V\0E\0R\0S\0I\0O\0N\0=\0"\00\0x\00\0"\0 \0L\0I\0N\0K\0_\0D\0A\0T\0E\0=\0"\00\09\0/\01\03\0/\02\00\00\07\0 \01\00\0:\00\07\0:\04\01\0"\0 \0U\0P\0T\0O\0_\0L\0I\0N\0K\0_\0D\0A\0T\0E\0=\0"\00\09\0/\01\03\0/\02\00\00\07\0 \01\00\0:\00\07\0:\04\01\0"\0 \0/\0>\0\15\0\12\0", 418, 0x0, 0, ... \0p\0a\0c\0k\0e\0d\0.\0e\0x\0e\0 (228, 0, 0, 0, " \0 \0 \0 \0<\0M\0A\0T\0C\0H\0I\0N\0G\0_\0F\0I\0L\0E\0 \0N\0A\0M\0E\0=\0"\0p\0a\0c\0k\0e\0d\0.\0e\0x\0e\0"\0 \0S\0I\0Z\0E\0=\0"\02\05\09\00\07\02\0"\0 \0C\0H\0E\0C\0K\0S\0U\0M\0=\0"\00\0x\09\02\0E\04\0B\0E\0B\0D\0"\0 \0M\0O\0D\0U\0L\0E\0_\0T\0Y\0P\0E\0=\0"\0W\0I\0N\03\02\0"\0 \0P\0E\0_\0C\0H\0E\0C\0K\0S\0U\0M\0=\0"\00\0x\03\0B\06\00\0F\0"\0 \0L\0I\0N\0K\0E\0R\0_\0V\0E\0R\0S\0I\0O\0N\0=\0"\00\0x\00\0"\0 \0L\0I\0N\0K\0_\0D\0A\0T\0E\0=\0"\00\09\0/\01\03\0/\02\00\00\07\0 \01\00\0:\00\07\0:\04\01\0"\0 \0U\0P\0T\0O\0_\0L\0I\0N\0K\0_\0D\0A\0T\0E\0=\0"\00\09\0/\01\03\0/\02\00\00\07\0 \01\00\0:\00\07\0:\04\01\0"\0 \0/\0>\0\15\0\12\0", 418, 0x0, 0, ... \02\05\09\00\07\02\0 (228, 0, 0, 0, " \0 \0 \0 \0<\0M\0A\0T\0C\0H\0I\0N\0G\0_\0F\0I\0L\0E\0 \0N\0A\0M\0E\0=\0"\0p\0a\0c\0k\0e\0d\0.\0e\0x\0e\0"\0 \0S\0I\0Z\0E\0=\0"\02\05\09\00\07\02\0"\0 \0C\0H\0E\0C\0K\0S\0U\0M\0=\0"\00\0x\09\02\0E\04\0B\0E\0B\0D\0"\0 \0M\0O\0D\0U\0L\0E\0_\0T\0Y\0P\0E\0=\0"\0W\0I\0N\03\02\0"\0 \0P\0E\0_\0C\0H\0E\0C\0K\0S\0U\0M\0=\0"\00\0x\03\0B\06\00\0F\0"\0 \0L\0I\0N\0K\0E\0R\0_\0V\0E\0R\0S\0I\0O\0N\0=\0"\00\0x\00\0"\0 \0L\0I\0N\0K\0_\0D\0A\0T\0E\0=\0"\00\09\0/\01\03\0/\02\00\00\07\0 \01\00\0:\00\07\0:\04\01\0"\0 \0U\0P\0T\0O\0_\0L\0I\0N\0K\0_\0D\0A\0T\0E\0=\0"\00\09\0/\01\03\0/\02\00\00\07\0 \01\00\0:\00\07\0:\04\01\0"\0 \0/\0>\0\15\0\12\0", 418, 0x0, 0, ... \00\0x\09\02\0E\04\0B\0E\0B\0D\0 (228, 0, 0, 0, " \0 \0 \0 \0<\0M\0A\0T\0C\0H\0I\0N\0G\0_\0F\0I\0L\0E\0 \0N\0A\0M\0E\0=\0"\0p\0a\0c\0k\0e\0d\0.\0e\0x\0e\0"\0 \0S\0I\0Z\0E\0=\0"\02\05\09\00\07\02\0"\0 \0C\0H\0E\0C\0K\0S\0U\0M\0=\0"\00\0x\09\02\0E\04\0B\0E\0B\0D\0"\0 \0M\0O\0D\0U\0L\0E\0_\0T\0Y\0P\0E\0=\0"\0W\0I\0N\03\02\0"\0 \0P\0E\0_\0C\0H\0E\0C\0K\0S\0U\0M\0=\0"\00\0x\03\0B\06\00\0F\0"\0 \0L\0I\0N\0K\0E\0R\0_\0V\0E\0R\0S\0I\0O\0N\0=\0"\00\0x\00\0"\0 \0L\0I\0N\0K\0_\0D\0A\0T\0E\0=\0"\00\09\0/\01\03\0/\02\00\00\07\0 \01\00\0:\00\07\0:\04\01\0"\0 \0U\0P\0T\0O\0_\0L\0I\0N\0K\0_\0D\0A\0T\0E\0=\0"\00\09\0/\01\03\0/\02\00\00\07\0 \01\00\0:\00\07\0:\04\01\0"\0 \0/\0>\0\15\0\12\0", 418, 0x0, 0, ... \0W\0I\0N\03\02\0 (228, 0, 0, 0, " \0 \0 \0 \0<\0M\0A\0T\0C\0H\0I\0N\0G\0_\0F\0I\0L\0E\0 \0N\0A\0M\0E\0=\0"\0p\0a\0c\0k\0e\0d\0.\0e\0x\0e\0"\0 \0S\0I\0Z\0E\0=\0"\02\05\09\00\07\02\0"\0 \0C\0H\0E\0C\0K\0S\0U\0M\0=\0"\00\0x\09\02\0E\04\0B\0E\0B\0D\0"\0 \0M\0O\0D\0U\0L\0E\0_\0T\0Y\0P\0E\0=\0"\0W\0I\0N\03\02\0"\0 \0P\0E\0_\0C\0H\0E\0C\0K\0S\0U\0M\0=\0"\00\0x\03\0B\06\00\0F\0"\0 \0L\0I\0N\0K\0E\0R\0_\0V\0E\0R\0S\0I\0O\0N\0=\0"\00\0x\00\0"\0 \0L\0I\0N\0K\0_\0D\0A\0T\0E\0=\0"\00\09\0/\01\03\0/\02\00\00\07\0 \01\00\0:\00\07\0:\04\01\0"\0 \0U\0P\0T\0O\0_\0L\0I\0N\0K\0_\0D\0A\0T\0E\0=\0"\00\09\0/\01\03\0/\02\00\00\07\0 \01\00\0:\00\07\0:\04\01\0"\0 \0/\0>\0\15\0\12\0", 418, 0x0, 0, ... \00\0x\03\0B\06\00\0F\0 (228, 0, 0, 0, " \0 \0 \0 \0<\0M\0A\0T\0C\0H\0I\0N\0G\0_\0F\0I\0L\0E\0 \0N\0A\0M\0E\0=\0"\0p\0a\0c\0k\0e\0d\0.\0e\0x\0e\0"\0 \0S\0I\0Z\0E\0=\0"\02\05\09\00\07\02\0"\0 \0C\0H\0E\0C\0K\0S\0U\0M\0=\0"\00\0x\09\02\0E\04\0B\0E\0B\0D\0"\0 \0M\0O\0D\0U\0L\0E\0_\0T\0Y\0P\0E\0=\0"\0W\0I\0N\03\02\0"\0 \0P\0E\0_\0C\0H\0E\0C\0K\0S\0U\0M\0=\0"\00\0x\03\0B\06\00\0F\0"\0 \0L\0I\0N\0K\0E\0R\0_\0V\0E\0R\0S\0I\0O\0N\0=\0"\00\0x\00\0"\0 \0L\0I\0N\0K\0_\0D\0A\0T\0E\0=\0"\00\09\0/\01\03\0/\02\00\00\07\0 \01\00\0:\00\07\0:\04\01\0"\0 \0U\0P\0T\0O\0_\0L\0I\0N\0K\0_\0D\0A\0T\0E\0=\0"\00\09\0/\01\03\0/\02\00\00\07\0 \01\00\0:\00\07\0:\04\01\0"\0 \0/\0>\0\15\0\12\0", 418, 0x0, 0, ... \00\0x\00\0 (228, 0, 0, 0, " \0 \0 \0 \0<\0M\0A\0T\0C\0H\0I\0N\0G\0_\0F\0I\0L\0E\0 \0N\0A\0M\0E\0=\0"\0p\0a\0c\0k\0e\0d\0.\0e\0x\0e\0"\0 \0S\0I\0Z\0E\0=\0"\02\05\09\00\07\02\0"\0 \0C\0H\0E\0C\0K\0S\0U\0M\0=\0"\00\0x\09\02\0E\04\0B\0E\0B\0D\0"\0 \0M\0O\0D\0U\0L\0E\0_\0T\0Y\0P\0E\0=\0"\0W\0I\0N\03\02\0"\0 \0P\0E\0_\0C\0H\0E\0C\0K\0S\0U\0M\0=\0"\00\0x\03\0B\06\00\0F\0"\0 \0L\0I\0N\0K\0E\0R\0_\0V\0E\0R\0S\0I\0O\0N\0=\0"\00\0x\00\0"\0 \0L\0I\0N\0K\0_\0D\0A\0T\0E\0=\0"\00\09\0/\01\03\0/\02\00\00\07\0 \01\00\0:\00\07\0:\04\01\0"\0 \0U\0P\0T\0O\0_\0L\0I\0N\0K\0_\0D\0A\0T\0E\0=\0"\00\09\0/\01\03\0/\02\00\00\07\0 \01\00\0:\00\07\0:\04\01\0"\0 \0/\0>\0\15\0\12\0", 418, 0x0, 0, ... \00\09\0/\01\03\0/\02\00\00\07\0 \01\00\0:\00\07\0:\04\01\0 (228, 0, 0, 0, " \0 \0 \0 \0<\0M\0A\0T\0C\0H\0I\0N\0G\0_\0F\0I\0L\0E\0 \0N\0A\0M\0E\0=\0"\0p\0a\0c\0k\0e\0d\0.\0e\0x\0e\0"\0 \0S\0I\0Z\0E\0=\0"\02\05\09\00\07\02\0"\0 \0C\0H\0E\0C\0K\0S\0U\0M\0=\0"\00\0x\09\02\0E\04\0B\0E\0B\0D\0"\0 \0M\0O\0D\0U\0L\0E\0_\0T\0Y\0P\0E\0=\0"\0W\0I\0N\03\02\0"\0 \0P\0E\0_\0C\0H\0E\0C\0K\0S\0U\0M\0=\0"\00\0x\03\0B\06\00\0F\0"\0 \0L\0I\0N\0K\0E\0R\0_\0V\0E\0R\0S\0I\0O\0N\0=\0"\00\0x\00\0"\0 \0L\0I\0N\0K\0_\0D\0A\0T\0E\0=\0"\00\09\0/\01\03\0/\02\00\00\07\0 \01\00\0:\00\07\0:\04\01\0"\0 \0U\0P\0T\0O\0_\0L\0I\0N\0K\0_\0D\0A\0T\0E\0=\0"\00\09\0/\01\03\0/\02\00\00\07\0 \01\00\0:\00\07\0:\04\01\0"\0 \0/\0>\0\15\0\12\0", 418, 0x0, 0, ... \00\09\0/\01\03\0/\02\00\00\07\0 \01\00\0:\00\07\0:\04\01\0 (228, 0, 0, 0, " \0 \0 \0 \0<\0M\0A\0T\0C\0H\0I\0N\0G\0_\0F\0I\0L\0E\0 \0N\0A\0M\0E\0=\0"\0p\0a\0c\0k\0e\0d\0.\0e\0x\0e\0"\0 \0S\0I\0Z\0E\0=\0"\02\05\09\00\07\02\0"\0 \0C\0H\0E\0C\0K\0S\0U\0M\0=\0"\00\0x\09\02\0E\04\0B\0E\0B\0D\0"\0 \0M\0O\0D\0U\0L\0E\0_\0T\0Y\0P\0E\0=\0"\0W\0I\0N\03\02\0"\0 \0P\0E\0_\0C\0H\0E\0C\0K\0S\0U\0M\0=\0"\00\0x\03\0B\06\00\0F\0"\0 \0L\0I\0N\0K\0E\0R\0_\0V\0E\0R\0S\0I\0O\0N\0=\0"\00\0x\00\0"\0 \0L\0I\0N\0K\0_\0D\0A\0T\0E\0=\0"\00\09\0/\01\03\0/\02\00\00\07\0 \01\00\0:\00\07\0:\04\01\0"\0 \0U\0P\0T\0O\0_\0L\0I\0N\0K\0_\0D\0A\0T\0E\0=\0"\00\09\0/\01\03\0/\02\00\00\07\0 \01\00\0:\00\07\0:\04\01\0"\0 \0/\0>\0\15\0\12\0", 418, 0x0, 0, ... , 418, 0x0, 0, ... 02127 464 NtContinue (-139616172, 0, ... 02126 464 NtWriteFile ... {status=0x0, info=418}, ) == 0x0 02128 464 NtQueryDirectoryFile (232, 0, 0, 0, 1405864, 4096, BothDirectory, 0, 0x0, 0, ... ) == STATUS_NO_MORE_FILES 02129 464 NtClose (232, ... ) == 0x0 02130 464 NtWriteFile (228, 0, 0, 0, (228, 0, 0, 0, "<\0/\0E\0X\0E\0>\0\15\0\12\0", 16, 0x0, 0, ... {status=0x0, info=16}, ) , 16, 0x0, 0, ... {status=0x0, info=16}, ) == 0x0 02131 464 NtClose (228, ... ) == 0x0 02132 464 NtQueryAttributesFile ({24, 0, 0x40, 0, 0, ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\kernel32.dll"}, 1231216, ... ) }, 1231216, ... ) == 0x0 02133 464 NtCreateFile (0x40100080, {24, 0, 0x40, 0, 1231224, (0x40100080, {24, 0, 0x40, 0, 1231224, "\??\C:\DOCUME~1\MARTIM~1\LOCALS~1\Temp\d16_appcompat.txt"}, 0x0, 128, 0, 3, 96, 0, 0, ... 228, {status=0x0, info=1}, ) }, 0x0, 128, 0, 3, 96, 0, 0, ... 228, {status=0x0, info=1}, ) == 0x0 02134 464 NtQueryInformationFile (228, 1231248, 24, Standard, ... {status=0x0, info=24}, ) == 0x0 02135 464 NtSetInformationFile (228, 1231280, 8, Position, ... {status=0x0, info=0}, ) == 0x0 02136 464 NtOpenFile (0x100001, {24, 0, 0x40, 0, 0, (0x100001, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\"}, 3, 16417, ... 232, {status=0x0, info=1}, ) }, 3, 16417, ... 232, {status=0x0, info=1}, ) == 0x0 02137 464 NtQueryDirectoryFile (232, 0, 0, 0, 1229928, 616, BothDirectory, 1, (232, 0, 0, 0, 1229928, 616, BothDirectory, 1, "kernel32.dll", 0, ... {status=0x0, info=118}, ) , 0, ... {status=0x0, info=118}, ) == 0x0 02138 464 NtWriteFile (228, 0, 0, 0, (228, 0, 0, 0, "<\0E\0X\0E\0 \0N\0A\0M\0E\0=\0"\0k\0e\0r\0n\0e\0l\03\02\0.\0d\0l\0l\0"\0 \0F\0I\0L\0T\0E\0R\0=\0"\0G\0R\0A\0B\0M\0I\0_\0F\0I\0L\0T\0E\0R\0_\0T\0H\0I\0S\0F\0I\0L\0E\0O\0N\0L\0Y\0"\0>\0\15\0\12\0", 126, 0x0, 0, ... {status=0x0, info=126}, ) \0k\0e\0r\0n\0e\0l\03\02\0.\0d\0l\0l\0 (228, 0, 0, 0, "<\0E\0X\0E\0 \0N\0A\0M\0E\0=\0"\0k\0e\0r\0n\0e\0l\03\02\0.\0d\0l\0l\0"\0 \0F\0I\0L\0T\0E\0R\0=\0"\0G\0R\0A\0B\0M\0I\0_\0F\0I\0L\0T\0E\0R\0_\0T\0H\0I\0S\0F\0I\0L\0E\0O\0N\0L\0Y\0"\0>\0\15\0\12\0", 126, 0x0, 0, ... {status=0x0, info=126}, ) \0G\0R\0A\0B\0M\0I\0_\0F\0I\0L\0T\0E\0R\0_\0T\0H\0I\0S\0F\0I\0L\0E\0O\0N\0L\0Y\0 (228, 0, 0, 0, "<\0E\0X\0E\0 \0N\0A\0M\0E\0=\0"\0k\0e\0r\0n\0e\0l\03\02\0.\0d\0l\0l\0"\0 \0F\0I\0L\0T\0E\0R\0=\0"\0G\0R\0A\0B\0M\0I\0_\0F\0I\0L\0T\0E\0R\0_\0T\0H\0I\0S\0F\0I\0L\0E\0O\0N\0L\0Y\0"\0>\0\15\0\12\0", 126, 0x0, 0, ... {status=0x0, info=126}, ) , 126, 0x0, 0, ... {status=0x0, info=126}, ) == 0x0 02139 464 NtQueryAttributesFile ({24, 0, 0x40, 0, 0, ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\kernel32.dll"}, 1230280, ... ) }, 1230280, ... ) == 0x0 02140 464 NtOpenFile (0x100001, {24, 0, 0x40, 0, 0, (0x100001, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32"}, 3, 16417, ... 236, {status=0x0, info=1}, ) }, 3, 16417, ... 236, {status=0x0, info=1}, ) == 0x0 02141 464 NtQueryDirectoryFile (236, 0, 0, 0, 1229920, 592, Directory, 1, (236, 0, 0, 0, 1229920, 592, Directory, 1, "kernel32.dll", 0, ... {status=0x0, info=88}, ) , 0, ... {status=0x0, info=88}, ) == 0x0 02142 464 NtClose (236, ... ) == 0x0 02143 464 NtQueryInformationProcess (-1, DefaultHardErrorMode, 4, ... {process info, class 12, size 4}, 0x0, ) == 0x0 02144 464 NtSetInformationProcess (-1, DefaultHardErrorMode, {process info, class 12, size 4}, 4, ... ) == 0x0 02145 464 NtQueryAttributesFile ({24, 0, 0x40, 0, 0, ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\kernel32.dll"}, 1228840, ... ) }, 1228840, ... ) == 0x0 02146 464 NtQueryAttributesFile ({24, 0, 0x40, 0, 0, ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\kernel32.dll"}, 1227612, ... ) }, 1227612, ... ) == 0x0 02147 464 NtQueryInformationProcess (-1, DefaultHardErrorMode, 4, ... {process info, class 12, size 4}, 0x0, ) == 0x0 02148 464 NtSetInformationProcess (-1, DefaultHardErrorMode, {process info, class 12, size 4}, 4, ... ) == 0x0 02149 464 NtQueryDefaultLocale (1, 1229800, ... ) == 0x0 02150 464 NtQueryInformationProcess (-1, DefaultHardErrorMode, 4, ... {process info, class 12, size 4}, 0x0, ) == 0x0 02151 464 NtSetInformationProcess (-1, DefaultHardErrorMode, {process info, class 12, size 4}, 4, ... ) == 0x0 02152 464 NtQueryAttributesFile ({24, 0, 0x40, 0, 0, ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\kernel32.dll"}, 1228832, ... ) }, 1228832, ... ) == 0x0 02153 464 NtQueryAttributesFile ({24, 0, 0x40, 0, 0, ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\kernel32.dll"}, 1227604, ... ) }, 1227604, ... ) == 0x0 02154 464 NtQueryInformationProcess (-1, DefaultHardErrorMode, 4, ... {process info, class 12, size 4}, 0x0, ) == 0x0 02155 464 NtSetInformationProcess (-1, DefaultHardErrorMode, {process info, class 12, size 4}, 4, ... ) == 0x0 02156 464 NtQueryDefaultLocale (1, 1229792, ... ) == 0x0 02157 464 NtCreateFile (0x80100080, {24, 0, 0x40, 0, 0, (0x80100080, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\kernel32.dll"}, 0x0, 128, 1, 1, 96, 0, 0, ... 236, {status=0x0, info=1}, ) }, 0x0, 128, 1, 1, 96, 0, 0, ... 236, {status=0x0, info=1}, ) == 0x0 02158 464 NtQueryInformationFile (236, 1230396, 24, Standard, ... {status=0x0, info=24}, ) == 0x0 02159 464 NtCreateSection (0x4, 0x0, 0x0, 2, 134217728, 236, ... 240, ) == 0x0 02160 464 NtMapViewOfSection (240, -1, (0x0), 0, 0, 0x0, 0, 2, 0, 2, ... (0xc00000), 0x0, 987136, ) == 0x0 02161 464 NtUnmapViewOfSection (-1, 0xc00000, ... ) == 0x0 02162 464 NtClose (240, ... ) == 0x0 02163 464 NtClose (236, ... ) == 0x0 02164 464 NtQueryDefaultUILanguage (1229752, ... 02165 464 NtOpenThreadTokenEx (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN 02166 464 NtOpenProcessTokenEx (-1, 0x20008, 512, ... -2147482740, ) == 0x0 02167 464 NtQueryInformationToken (-2147482740, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0 02168 464 NtClose (-2147482740, ... ) == 0x0 02169 464 NtOpenKey (0x2000000, {24, 0, 0x640, 0, 0, (0x2000000, {24, 0, 0x640, 0, 0, "\REGISTRY\USER\S-1-5-21-1292428093-1383384898-725345543-1003"}, ... -2147482740, ) }, ... -2147482740, ) == 0x0 02170 464 NtOpenKey (0x80000000, {24, -2147482740, 0x240, 0, 0, (0x80000000, {24, -2147482740, 0x240, 0, 0, "Software\Policies\Microsoft\Control Panel\Desktop"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 02171 464 NtOpenKey (0x80000000, {24, -2147482740, 0x640, 0, 0, (0x80000000, {24, -2147482740, 0x640, 0, 0, "Control Panel\Desktop"}, ... -2147481328, ) }, ... -2147481328, ) == 0x0 02172 464 NtQueryValueKey (-2147481328, (-2147481328, "MultiUILanguageId", Partial, 256, ... ) , Partial, 256, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 02173 464 NtClose (-2147481328, ... ) == 0x0 02174 464 NtClose (-2147482740, ... ) == 0x0 02164 464 NtQueryDefaultUILanguage ... ) == 0x0 02175 464 NtWriteFile (228, 0, 0, 0, (228, 0, 0, 0, " \0 \0 \0 \0<\0M\0A\0T\0C\0H\0I\0N\0G\0_\0F\0I\0L\0E\0 \0N\0A\0M\0E\0=\0"\0k\0e\0r\0n\0e\0l\03\02\0.\0d\0l\0l\0"\0 \0S\0I\0Z\0E\0=\0"\09\08\04\05\07\06\0"\0 \0C\0H\0E\0C\0K\0S\0U\0M\0=\0"\00\0x\0F\00\0B\03\03\01\0F\06\0"\0 \0B\0I\0N\0_\0F\0I\0L\0E\0_\0V\0E\0R\0S\0I\0O\0N\0=\0"\05\0.\01\0.\02\06\00\00\0.\03\01\01\09\0"\0 \0B\0I\0N\0_\0P\0R\0O\0D\0U\0C\0T\0_\0V\0E\0R\0S\0I\0O\0N\0=\0"\05\0.\01\0.\02\06\00\00\0.\03\01\01\09\0"\0 \0P\0R\0O\0D\0U\0C\0T\0_\0V\0E\0R\0S\0I\0O\0N\0=\0"\05\0.\01\0.\02\06\00\00\0.\03\01\01\09\0"\0 \0F\0I\0L\0E\0_\0D\0E\0S\0C\0R\0I\0P\0T\0I\0O\0N\0=\0"\0W\0i\0n\0d\0o\0w\0s\0 \0N\0T\0 \0B\0A\0S\0E\0 \0A\0P\0I\0 \0C\0l\0i\0e\0n\0t\0 \0D\0L\0L\0"\0 \0C\0O\0M\0P\0A\0N\0Y\0_\0N\0A\0M\0E\0=\0"\0M\0i\0c\0r\0o\0s\0o\0f\0t\0 \0", 1666, 0x0, 0, ... {status=0x0, info=1666}, ) \0k\0e\0r\0n\0e\0l\03\02\0.\0d\0l\0l\0 (228, 0, 0, 0, " \0 \0 \0 \0<\0M\0A\0T\0C\0H\0I\0N\0G\0_\0F\0I\0L\0E\0 \0N\0A\0M\0E\0=\0"\0k\0e\0r\0n\0e\0l\03\02\0.\0d\0l\0l\0"\0 \0S\0I\0Z\0E\0=\0"\09\08\04\05\07\06\0"\0 \0C\0H\0E\0C\0K\0S\0U\0M\0=\0"\00\0x\0F\00\0B\03\03\01\0F\06\0"\0 \0B\0I\0N\0_\0F\0I\0L\0E\0_\0V\0E\0R\0S\0I\0O\0N\0=\0"\05\0.\01\0.\02\06\00\00\0.\03\01\01\09\0"\0 \0B\0I\0N\0_\0P\0R\0O\0D\0U\0C\0T\0_\0V\0E\0R\0S\0I\0O\0N\0=\0"\05\0.\01\0.\02\06\00\00\0.\03\01\01\09\0"\0 \0P\0R\0O\0D\0U\0C\0T\0_\0V\0E\0R\0S\0I\0O\0N\0=\0"\05\0.\01\0.\02\06\00\00\0.\03\01\01\09\0"\0 \0F\0I\0L\0E\0_\0D\0E\0S\0C\0R\0I\0P\0T\0I\0O\0N\0=\0"\0W\0i\0n\0d\0o\0w\0s\0 \0N\0T\0 \0B\0A\0S\0E\0 \0A\0P\0I\0 \0C\0l\0i\0e\0n\0t\0 \0D\0L\0L\0"\0 \0C\0O\0M\0P\0A\0N\0Y\0_\0N\0A\0M\0E\0=\0"\0M\0i\0c\0r\0o\0s\0o\0f\0t\0 \0", 1666, 0x0, 0, ... {status=0x0, info=1666}, ) \09\08\04\05\07\06\0 (228, 0, 0, 0, " \0 \0 \0 \0<\0M\0A\0T\0C\0H\0I\0N\0G\0_\0F\0I\0L\0E\0 \0N\0A\0M\0E\0=\0"\0k\0e\0r\0n\0e\0l\03\02\0.\0d\0l\0l\0"\0 \0S\0I\0Z\0E\0=\0"\09\08\04\05\07\06\0"\0 \0C\0H\0E\0C\0K\0S\0U\0M\0=\0"\00\0x\0F\00\0B\03\03\01\0F\06\0"\0 \0B\0I\0N\0_\0F\0I\0L\0E\0_\0V\0E\0R\0S\0I\0O\0N\0=\0"\05\0.\01\0.\02\06\00\00\0.\03\01\01\09\0"\0 \0B\0I\0N\0_\0P\0R\0O\0D\0U\0C\0T\0_\0V\0E\0R\0S\0I\0O\0N\0=\0"\05\0.\01\0.\02\06\00\00\0.\03\01\01\09\0"\0 \0P\0R\0O\0D\0U\0C\0T\0_\0V\0E\0R\0S\0I\0O\0N\0=\0"\05\0.\01\0.\02\06\00\00\0.\03\01\01\09\0"\0 \0F\0I\0L\0E\0_\0D\0E\0S\0C\0R\0I\0P\0T\0I\0O\0N\0=\0"\0W\0i\0n\0d\0o\0w\0s\0 \0N\0T\0 \0B\0A\0S\0E\0 \0A\0P\0I\0 \0C\0l\0i\0e\0n\0t\0 \0D\0L\0L\0"\0 \0C\0O\0M\0P\0A\0N\0Y\0_\0N\0A\0M\0E\0=\0"\0M\0i\0c\0r\0o\0s\0o\0f\0t\0 \0", 1666, 0x0, 0, ... {status=0x0, info=1666}, ) \00\0x\0F\00\0B\03\03\01\0F\06\0 (228, 0, 0, 0, " \0 \0 \0 \0<\0M\0A\0T\0C\0H\0I\0N\0G\0_\0F\0I\0L\0E\0 \0N\0A\0M\0E\0=\0"\0k\0e\0r\0n\0e\0l\03\02\0.\0d\0l\0l\0"\0 \0S\0I\0Z\0E\0=\0"\09\08\04\05\07\06\0"\0 \0C\0H\0E\0C\0K\0S\0U\0M\0=\0"\00\0x\0F\00\0B\03\03\01\0F\06\0"\0 \0B\0I\0N\0_\0F\0I\0L\0E\0_\0V\0E\0R\0S\0I\0O\0N\0=\0"\05\0.\01\0.\02\06\00\00\0.\03\01\01\09\0"\0 \0B\0I\0N\0_\0P\0R\0O\0D\0U\0C\0T\0_\0V\0E\0R\0S\0I\0O\0N\0=\0"\05\0.\01\0.\02\06\00\00\0.\03\01\01\09\0"\0 \0P\0R\0O\0D\0U\0C\0T\0_\0V\0E\0R\0S\0I\0O\0N\0=\0"\05\0.\01\0.\02\06\00\00\0.\03\01\01\09\0"\0 \0F\0I\0L\0E\0_\0D\0E\0S\0C\0R\0I\0P\0T\0I\0O\0N\0=\0"\0W\0i\0n\0d\0o\0w\0s\0 \0N\0T\0 \0B\0A\0S\0E\0 \0A\0P\0I\0 \0C\0l\0i\0e\0n\0t\0 \0D\0L\0L\0"\0 \0C\0O\0M\0P\0A\0N\0Y\0_\0N\0A\0M\0E\0=\0"\0M\0i\0c\0r\0o\0s\0o\0f\0t\0 \0", 1666, 0x0, 0, ... {status=0x0, info=1666}, ) \05\0.\01\0.\02\06\00\00\0.\03\01\01\09\0 (228, 0, 0, 0, " \0 \0 \0 \0<\0M\0A\0T\0C\0H\0I\0N\0G\0_\0F\0I\0L\0E\0 \0N\0A\0M\0E\0=\0"\0k\0e\0r\0n\0e\0l\03\02\0.\0d\0l\0l\0"\0 \0S\0I\0Z\0E\0=\0"\09\08\04\05\07\06\0"\0 \0C\0H\0E\0C\0K\0S\0U\0M\0=\0"\00\0x\0F\00\0B\03\03\01\0F\06\0"\0 \0B\0I\0N\0_\0F\0I\0L\0E\0_\0V\0E\0R\0S\0I\0O\0N\0=\0"\05\0.\01\0.\02\06\00\00\0.\03\01\01\09\0"\0 \0B\0I\0N\0_\0P\0R\0O\0D\0U\0C\0T\0_\0V\0E\0R\0S\0I\0O\0N\0=\0"\05\0.\01\0.\02\06\00\00\0.\03\01\01\09\0"\0 \0P\0R\0O\0D\0U\0C\0T\0_\0V\0E\0R\0S\0I\0O\0N\0=\0"\05\0.\01\0.\02\06\00\00\0.\03\01\01\09\0"\0 \0F\0I\0L\0E\0_\0D\0E\0S\0C\0R\0I\0P\0T\0I\0O\0N\0=\0"\0W\0i\0n\0d\0o\0w\0s\0 \0N\0T\0 \0B\0A\0S\0E\0 \0A\0P\0I\0 \0C\0l\0i\0e\0n\0t\0 \0D\0L\0L\0"\0 \0C\0O\0M\0P\0A\0N\0Y\0_\0N\0A\0M\0E\0=\0"\0M\0i\0c\0r\0o\0s\0o\0f\0t\0 \0", 1666, 0x0, 0, ... {status=0x0, info=1666}, ) \05\0.\01\0.\02\06\00\00\0.\03\01\01\09\0 (228, 0, 0, 0, " \0 \0 \0 \0<\0M\0A\0T\0C\0H\0I\0N\0G\0_\0F\0I\0L\0E\0 \0N\0A\0M\0E\0=\0"\0k\0e\0r\0n\0e\0l\03\02\0.\0d\0l\0l\0"\0 \0S\0I\0Z\0E\0=\0"\09\08\04\05\07\06\0"\0 \0C\0H\0E\0C\0K\0S\0U\0M\0=\0"\00\0x\0F\00\0B\03\03\01\0F\06\0"\0 \0B\0I\0N\0_\0F\0I\0L\0E\0_\0V\0E\0R\0S\0I\0O\0N\0=\0"\05\0.\01\0.\02\06\00\00\0.\03\01\01\09\0"\0 \0B\0I\0N\0_\0P\0R\0O\0D\0U\0C\0T\0_\0V\0E\0R\0S\0I\0O\0N\0=\0"\05\0.\01\0.\02\06\00\00\0.\03\01\01\09\0"\0 \0P\0R\0O\0D\0U\0C\0T\0_\0V\0E\0R\0S\0I\0O\0N\0=\0"\05\0.\01\0.\02\06\00\00\0.\03\01\01\09\0"\0 \0F\0I\0L\0E\0_\0D\0E\0S\0C\0R\0I\0P\0T\0I\0O\0N\0=\0"\0W\0i\0n\0d\0o\0w\0s\0 \0N\0T\0 \0B\0A\0S\0E\0 \0A\0P\0I\0 \0C\0l\0i\0e\0n\0t\0 \0D\0L\0L\0"\0 \0C\0O\0M\0P\0A\0N\0Y\0_\0N\0A\0M\0E\0=\0"\0M\0i\0c\0r\0o\0s\0o\0f\0t\0 \0", 1666, 0x0, 0, ... {status=0x0, info=1666}, ) \05\0.\01\0.\02\06\00\00\0.\03\01\01\09\0 (228, 0, 0, 0, " \0 \0 \0 \0<\0M\0A\0T\0C\0H\0I\0N\0G\0_\0F\0I\0L\0E\0 \0N\0A\0M\0E\0=\0"\0k\0e\0r\0n\0e\0l\03\02\0.\0d\0l\0l\0"\0 \0S\0I\0Z\0E\0=\0"\09\08\04\05\07\06\0"\0 \0C\0H\0E\0C\0K\0S\0U\0M\0=\0"\00\0x\0F\00\0B\03\03\01\0F\06\0"\0 \0B\0I\0N\0_\0F\0I\0L\0E\0_\0V\0E\0R\0S\0I\0O\0N\0=\0"\05\0.\01\0.\02\06\00\00\0.\03\01\01\09\0"\0 \0B\0I\0N\0_\0P\0R\0O\0D\0U\0C\0T\0_\0V\0E\0R\0S\0I\0O\0N\0=\0"\05\0.\01\0.\02\06\00\00\0.\03\01\01\09\0"\0 \0P\0R\0O\0D\0U\0C\0T\0_\0V\0E\0R\0S\0I\0O\0N\0=\0"\05\0.\01\0.\02\06\00\00\0.\03\01\01\09\0"\0 \0F\0I\0L\0E\0_\0D\0E\0S\0C\0R\0I\0P\0T\0I\0O\0N\0=\0"\0W\0i\0n\0d\0o\0w\0s\0 \0N\0T\0 \0B\0A\0S\0E\0 \0A\0P\0I\0 \0C\0l\0i\0e\0n\0t\0 \0D\0L\0L\0"\0 \0C\0O\0M\0P\0A\0N\0Y\0_\0N\0A\0M\0E\0=\0"\0M\0i\0c\0r\0o\0s\0o\0f\0t\0 \0", 1666, 0x0, 0, ... {status=0x0, info=1666}, ) \0W\0i\0n\0d\0o\0w\0s\0 \0N\0T\0 \0B\0A\0S\0E\0 \0A\0P\0I\0 \0C\0l\0i\0e\0n\0t\0 \0D\0L\0L\0 (228, 0, 0, 0, " \0 \0 \0 \0<\0M\0A\0T\0C\0H\0I\0N\0G\0_\0F\0I\0L\0E\0 \0N\0A\0M\0E\0=\0"\0k\0e\0r\0n\0e\0l\03\02\0.\0d\0l\0l\0"\0 \0S\0I\0Z\0E\0=\0"\09\08\04\05\07\06\0"\0 \0C\0H\0E\0C\0K\0S\0U\0M\0=\0"\00\0x\0F\00\0B\03\03\01\0F\06\0"\0 \0B\0I\0N\0_\0F\0I\0L\0E\0_\0V\0E\0R\0S\0I\0O\0N\0=\0"\05\0.\01\0.\02\06\00\00\0.\03\01\01\09\0"\0 \0B\0I\0N\0_\0P\0R\0O\0D\0U\0C\0T\0_\0V\0E\0R\0S\0I\0O\0N\0=\0"\05\0.\01\0.\02\06\00\00\0.\03\01\01\09\0"\0 \0P\0R\0O\0D\0U\0C\0T\0_\0V\0E\0R\0S\0I\0O\0N\0=\0"\05\0.\01\0.\02\06\00\00\0.\03\01\01\09\0"\0 \0F\0I\0L\0E\0_\0D\0E\0S\0C\0R\0I\0P\0T\0I\0O\0N\0=\0"\0W\0i\0n\0d\0o\0w\0s\0 \0N\0T\0 \0B\0A\0S\0E\0 \0A\0P\0I\0 \0C\0l\0i\0e\0n\0t\0 \0D\0L\0L\0"\0 \0C\0O\0M\0P\0A\0N\0Y\0_\0N\0A\0M\0E\0=\0"\0M\0i\0c\0r\0o\0s\0o\0f\0t\0 \0", 1666, 0x0, 0, ... {status=0x0, info=1666}, ) \0M\0i\0c\0r\0o\0s\0o\0f\0t\0 \0", 1666, 0x0, 0, ... {status=0x0, info=1666}, ) == 0x0 02176 464 NtQueryDirectoryFile (232, 0, 0, 0, 1397160, 4096, BothDirectory, 0, 0x0, 0, ... ) == STATUS_NO_MORE_FILES 02177 464 NtClose (232, ... ) == 0x0 02178 464 NtWriteFile (228, 0, 0, 0, (228, 0, 0, 0, "<\0/\0E\0X\0E\0>\0\15\0\12\0<\0/\0D\0A\0T\0A\0B\0A\0S\0E\0>\0\15\0\12\0", 42, 0x0, 0, ... {status=0x0, info=42}, ) , 42, 0x0, 0, ... {status=0x0, info=42}, ) == 0x0 02179 464 NtClose (228, ... ) == 0x0 02180 464 NtUnmapViewOfSection (-1, 0x77b40000, ... ) == 0x0 02181 464 NtQueryInformationJobObject (0, BasicUIRestrictions, 4, ... ) == STATUS_ACCESS_DENIED 02182 464 NtQueryAttributesFile ({24, 0, 0x40, 0, 0, ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\dwwin.exe"}, 1228488, ... ) }, 1228488, ... ) == 0x0 02183 464 NtQueryAttributesFile ({24, 0, 0x40, 0, 0, ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\dwwin.exe"}, 1229224, ... ) }, 1229224, ... ) == 0x0 02184 464 NtOpenFile (0x1000a1, {24, 0, 0x40, 0, 0, (0x1000a1, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\dwwin.exe"}, 5, 96, ... 228, {status=0x0, info=1}, ) }, 5, 96, ... 228, {status=0x0, info=1}, ) == 0x0 02185 464 NtCreateSection (0xf001f, 0x0, 0x0, 16, 16777216, 228, ... 232, ) == 0x0 02186 464 NtOpenKey (0x1, {24, 0, 0x40, 0, 0, (0x1, {24, 0, 0x40, 0, 0, "\Registry\MACHINE\System\CurrentControlSet\Control\Session Manager\AppCertDlls"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 02187 464 NtOpenKey (0x1, {24, 0, 0x40, 0, 0, (0x1, {24, 0, 0x40, 0, 0, "\Registry\MACHINE\System\CurrentControlSet\Control\Session Manager\AppCompatibility"}, ... 236, ) }, ... 236, ) == 0x0 02188 464 NtQueryValueKey (236, (236, "DisableAppCompat", Partial, 20, ... ) , Partial, 20, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 02189 464 NtClose (236, ... ) == 0x0 02190 464 NtQueryVolumeInformationFile (228, 1228500, 8, Device, ... {status=0x0, info=8}, ) == 0x0 02191 464 NtWaitForSingleObject (120, 0, {-1000000, -1}, ... ) == 0x0 02192 464 NtReleaseMutant (120, ... 0x0, ) == 0x0 02193 464 NtQueryAttributesFile ({24, 0, 0x40, 0, 0, ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\Apphelp.dll"}, 1226432, ... ) }, 1226432, ... ) == 0x0 02194 464 NtOpenFile (0x100020, {24, 0, 0x40, 0, 0, (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\Apphelp.dll"}, 5, 96, ... 236, {status=0x0, info=1}, ) }, 5, 96, ... 236, {status=0x0, info=1}, ) == 0x0 02195 464 NtCreateSection (0xe, 0x0, 0x0, 16, 134217728, 236, ... 240, ) == 0x0 02196 464 NtClose (236, ... ) == 0x0 02197 464 NtMapViewOfSection (240, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 16, ... (0xc00000), 0x0, 126976, ) == 0x0 02198 464 NtClose (240, ... ) == 0x0 02199 464 NtUnmapViewOfSection (-1, 0xc00000, ... ) == 0x0 02200 464 NtQueryAttributesFile ({24, 0, 0x40, 0, 0, ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\Apphelp.dll"}, 1226740, ... ) }, 1226740, ... ) == 0x0 02201 464 NtOpenFile (0x100020, {24, 0, 0x40, 0, 0, (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\Apphelp.dll"}, 5, 96, ... 240, {status=0x0, info=1}, ) }, 5, 96, ... 240, {status=0x0, info=1}, ) == 0x0 02202 464 NtCreateSection (0xf, 0x0, 0x0, 16, 16777216, 240, ... 236, ) == 0x0 02203 464 NtQuerySection (236, Image, 48, ... {section info, class 1, size 48}, 0x0, ) == 0x0 02204 464 NtClose (240, ... ) == 0x0 02205 464 NtMapViewOfSection (236, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x77b40000), 0x0, 139264, ) == 0x0 02206 464 NtClose (236, ... ) == 0x0 02207 464 NtProtectVirtualMemory (-1, (0x77b41000), 524, 4, ... (0x77b41000), 4096, 32, ) == 0x0 02208 464 NtProtectVirtualMemory (-1, (0x77b41000), 4096, 32, ... (0x77b41000), 4096, 4, ) == 0x0 02209 464 NtFlushInstructionCache (-1, 2008289280, 524, ... ) == 0x0 02210 464 NtOpenKey (0x80000000, {24, 0, 0x40, 0, 0, (0x80000000, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Apphelp.dll"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 02211 464 NtCreateFile (0x80100080, {24, 0, 0x40, 0, 0, (0x80100080, {24, 0, 0x40, 0, 0, "\SystemRoot\AppPatch\sysmain.sdb"}, 0x0, 128, 1, 1, 96, 0, 0, ... 236, {status=0x0, info=1}, ) }, 0x0, 128, 1, 1, 96, 0, 0, ... 236, {status=0x0, info=1}, ) == 0x0 02212 464 NtQueryInformationFile (236, 1226756, 24, Standard, ... {status=0x0, info=24}, ) == 0x0 02213 464 NtCreateSection (0x4, 0x0, 0x0, 2, 134217728, 236, ... 240, ) == 0x0 02214 464 NtMapViewOfSection (240, -1, (0x0), 0, 0, 0x0, 0, 2, 0, 2, ... (0xc00000), 0x0, 1191936, ) == 0x0 02215 464 NtQueryInformationFile (236, 1226856, 24, Standard, ... {status=0x0, info=24}, ) == 0x0 02216 464 NtCreateFile (0x80100080, {24, 0, 0x40, 0, 0, (0x80100080, {24, 0, 0x40, 0, 0, "\SystemRoot\AppPatch\systest.sdb"}, 0x0, 128, 1, 1, 96, 0, 0, ... ) }, 0x0, 128, 1, 1, 96, 0, 0, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 02217 464 NtAllocateVirtualMemory (-1, 1216512, 0, 4096, 4096, 260, ... 1216512, 4096, ) == 0x0 02218 464 NtQuerySystemInformation (Processor, 12, ... {system info, class 1, size 12}, 0x0, ) == 0x0 02219 464 NtQueryInformationProcess (-1, Wow64, 4, ... {process info, class 26, size 4}, 0x0, ) == 0x0 02220 464 NtOpenKey (0x101, {24, 0, 0x40, 0, 0, (0x101, {24, 0, 0x40, 0, 0, "\Registry\Machine\System\WPA\TabletPC"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 02221 464 NtOpenKey (0x101, {24, 0, 0x40, 0, 0, (0x101, {24, 0, 0x40, 0, 0, "\Registry\Machine\SYSTEM\WPA\MediaCenter"}, ... 244, ) }, ... 244, ) == 0x0 02222 464 NtQueryValueKey (244, (244, "Installed", Partial, 256, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) , Partial, 256, ... TitleIdx=0, Type=4, Data= (244, "Installed", Partial, 256, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) }, 16, ) == 0x0 02223 464 NtClose (244, ... ) == 0x0 02224 464 NtCreateFile (0x120116, {24, 0, 0x40, 0, 0, (0x120116, {24, 0, 0x40, 0, 0, "\Device\NamedPipe\ShimViewer"}, 0x0, 128, 0, 1, 0, 0, 0, ... ) }, 0x0, 128, 0, 1, 0, 0, 0, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 02225 464 NtOpenFile (0x100001, {24, 0, 0x40, 0, 0, (0x100001, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\"}, 3, 16417, ... 244, {status=0x0, info=1}, ) }, 3, 16417, ... 244, {status=0x0, info=1}, ) == 0x0 02226 464 NtQueryDirectoryFile (244, 0, 0, 0, 1224452, 616, BothDirectory, 1, (244, 0, 0, 0, 1224452, 616, BothDirectory, 1, "dwwin.exe", 0, ... {status=0x0, info=112}, ) , 0, ... {status=0x0, info=112}, ) == 0x0 02227 464 NtClose (244, ... ) == 0x0 02228 464 NtQueryInformationProcess (-1, DefaultHardErrorMode, 4, ... {process info, class 12, size 4}, 0x0, ) == 0x0 02229 464 NtSetInformationProcess (-1, DefaultHardErrorMode, {process info, class 12, size 4}, 4, ... ) == 0x0 02230 464 NtQueryAttributesFile ({24, 0, 0x40, 0, 0, ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\dwwin.exe"}, 1224828, ... ) }, 1224828, ... ) == 0x0 02231 464 NtOpenFile (0x100001, {24, 0, 0x40, 0, 0, (0x100001, {24, 0, 0x40, 0, 0, "\??\C:\"}, 3, 16417, ... 244, {status=0x0, info=1}, ) }, 3, 16417, ... 244, {status=0x0, info=1}, ) == 0x0 02232 464 NtQueryDirectoryFile (244, 0, 0, 0, 1224256, 616, BothDirectory, 1, (244, 0, 0, 0, 1224256, 616, BothDirectory, 1, "WINDOWS", 0, ... {status=0x0, info=108}, ) , 0, ... {status=0x0, info=108}, ) == 0x0 02233 464 NtClose (244, ... ) == 0x0 02234 464 NtOpenFile (0x100001, {24, 0, 0x40, 0, 0, (0x100001, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\"}, 3, 16417, ... 244, {status=0x0, info=1}, ) }, 3, 16417, ... 244, {status=0x0, info=1}, ) == 0x0 02235 464 NtQueryDirectoryFile (244, 0, 0, 0, 1224256, 616, BothDirectory, 1, (244, 0, 0, 0, 1224256, 616, BothDirectory, 1, "system32", 0, ... {status=0x0, info=110}, ) , 0, ... {status=0x0, info=110}, ) == 0x0 02236 464 NtClose (244, ... ) == 0x0 02237 464 NtOpenFile (0x100001, {24, 0, 0x40, 0, 0, (0x100001, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\"}, 3, 16417, ... 244, {status=0x0, info=1}, ) }, 3, 16417, ... 244, {status=0x0, info=1}, ) == 0x0 02238 464 NtQueryDirectoryFile (244, 0, 0, 0, 1224256, 616, BothDirectory, 1, (244, 0, 0, 0, 1224256, 616, BothDirectory, 1, "dwwin.exe", 0, ... {status=0x0, info=112}, ) , 0, ... {status=0x0, info=112}, ) == 0x0 02239 464 NtClose (244, ... ) == 0x0 02240 464 NtQueryInformationProcess (-1, DefaultHardErrorMode, 4, ... {process info, class 12, size 4}, 0x0, ) == 0x0 02241 464 NtSetInformationProcess (-1, DefaultHardErrorMode, {process info, class 12, size 4}, 4, ... ) == 0x0 02242 464 NtQueryInformationProcess (-1, DeviceMap, 36, ... {process info, class 23, size 36}, 0x0, ) == 0x0 02243 464 NtOpenKey (0x80000100, {24, 0, 0x40, 0, 0, (0x80000100, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Layers"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 02244 464 NtOpenThreadTokenEx (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN 02245 464 NtOpenProcessTokenEx (-1, 0x20008, 512, ... 244, ) == 0x0 02246 464 NtQueryInformationToken (244, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0 02247 464 NtClose (244, ... ) == 0x0 02248 464 NtOpenKey (0x80000100, {24, 0, 0x40, 0, 0, (0x80000100, {24, 0, 0x40, 0, 0, "\REGISTRY\USER\S-1-5-21-1292428093-1383384898-725345543-1003\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Layers"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 02249 464 NtOpenKey (0x80000100, {24, 0, 0x40, 0, 0, (0x80000100, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Custom\dwwin.exe"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 02250 464 NtQueryAttributesFile ({24, 0, 0x40, 0, 0, ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\dwwin.exe"}, 1225660, ... ) }, 1225660, ... ) == 0x0 02251 464 NtQueryInformationProcess (-1, DefaultHardErrorMode, 4, ... {process info, class 12, size 4}, 0x0, ) == 0x0 02252 464 NtSetInformationProcess (-1, DefaultHardErrorMode, {process info, class 12, size 4}, 4, ... ) == 0x0 02253 464 NtQueryAttributesFile ({24, 0, 0x40, 0, 0, ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\dwwin.exe"}, 1224528, ... ) }, 1224528, ... ) == 0x0 02254 464 NtOpenFile (0x100020, {24, 0, 0x40, 0, 0, (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\dwwin.exe"}, 5, 96, ... 244, {status=0x0, info=1}, ) }, 5, 96, ... 244, {status=0x0, info=1}, ) == 0x0 02255 464 NtCreateSection (0xe, 0x0, 0x0, 16, 134217728, 244, ... 248, ) == 0x0 02256 464 NtClose (244, ... ) == 0x0 02257 464 NtMapViewOfSection (248, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 16, ... (0xd30000), 0x0, 180224, ) == 0x0 02258 464 NtClose (248, ... ) == 0x0 02259 464 NtUnmapViewOfSection (-1, 0xd30000, ... ) == 0x0 02260 464 NtQueryAttributesFile ({24, 0, 0x40, 0, 0, ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\dwwin.exe"}, 1224124, ... ) }, 1224124, ... ) == 0x0 02261 464 NtCreateFile (0x80100080, {24, 0, 0x40, 0, 1224868, (0x80100080, {24, 0, 0x40, 0, 1224868, "\??\C:\WINDOWS\system32\dwwin.exe"}, 0x0, 0, 5, 1, 96, 0, 0, ... 248, {status=0x0, info=1}, ) }, 0x0, 0, 5, 1, 96, 0, 0, ... 248, {status=0x0, info=1}, ) == 0x0 02262 464 NtCreateSection (0xf0005, 0x0, 0x0, 2, 134217728, 248, ... 244, ) == 0x0 02263 464 NtClose (248, ... ) == 0x0 02264 464 NtMapViewOfSection (244, -1, (0x0), 0, 0, {0, 0}, 0, 1, 0, 2, ... (0xd30000), {0, 0}, 180224, ) == 0x0 02265 464 NtClose (244, ... ) == 0x0 02266 464 NtQueryInformationProcess (-1, DefaultHardErrorMode, 4, ... {process info, class 12, size 4}, 0x0, ) == 0x0 02267 464 NtSetInformationProcess (-1, DefaultHardErrorMode, {process info, class 12, size 4}, 4, ... ) == 0x0 02268 464 NtQueryDefaultLocale (1, 1225488, ... ) == 0x0 02269 464 NtQueryVirtualMemory (-1, 0xd30000, Basic, 28, ... {BaseAddress=0xd30000,AllocationBase=0xd30000,AllocationProtect=0x2,RegionSize=0x2c000,State=0x1000,Protect=0x2,Type=0x40000,}, 0x0, ) == 0x0 02270 464 NtQueryVirtualMemory (-1, 0xd30000, Basic, 28, ... {BaseAddress=0xd30000,AllocationBase=0xd30000,AllocationProtect=0x2,RegionSize=0x2c000,State=0x1000,Protect=0x2,Type=0x40000,}, 0x0, ) == 0x0 02271 464 NtUnmapViewOfSection (-1, 0xd30000, ... ) == 0x0 02272 464 NtQueryInformationProcess (-1, DefaultHardErrorMode, 4, ... {process info, class 12, size 4}, 0x0, ) == 0x0 02273 464 NtSetInformationProcess (-1, DefaultHardErrorMode, {process info, class 12, size 4}, 4, ... ) == 0x0 02274 464 NtQueryAttributesFile ({24, 0, 0x40, 0, 0, ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\dwwin.exe"}, 1224520, ... ) }, 1224520, ... ) == 0x0 02275 464 NtOpenFile (0x100020, {24, 0, 0x40, 0, 0, (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\dwwin.exe"}, 5, 96, ... 244, {status=0x0, info=1}, ) }, 5, 96, ... 244, {status=0x0, info=1}, ) == 0x0 02276 464 NtCreateSection (0xe, 0x0, 0x0, 16, 134217728, 244, ... 248, ) == 0x0 02277 464 NtClose (244, ... ) == 0x0 02278 464 NtMapViewOfSection (248, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 16, ... (0xd30000), 0x0, 180224, ) == 0x0 02279 464 NtClose (248, ... ) == 0x0 02280 464 NtUnmapViewOfSection (-1, 0xd30000, ... ) == 0x0 02281 464 NtQueryAttributesFile ({24, 0, 0x40, 0, 0, ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\dwwin.exe"}, 1224116, ... ) }, 1224116, ... ) == 0x0 02282 464 NtCreateFile (0x80100080, {24, 0, 0x40, 0, 1224860, (0x80100080, {24, 0, 0x40, 0, 1224860, "\??\C:\WINDOWS\system32\dwwin.exe"}, 0x0, 0, 5, 1, 96, 0, 0, ... 248, {status=0x0, info=1}, ) }, 0x0, 0, 5, 1, 96, 0, 0, ... 248, {status=0x0, info=1}, ) == 0x0 02283 464 NtCreateSection (0xf0005, 0x0, 0x0, 2, 134217728, 248, ... 244, ) == 0x0 02284 464 NtClose (248, ... ) == 0x0 02285 464 NtMapViewOfSection (244, -1, (0x0), 0, 0, {0, 0}, 0, 1, 0, 2, ... (0xd30000), {0, 0}, 180224, ) == 0x0 02286 464 NtClose (244, ... ) == 0x0 02287 464 NtQueryInformationProcess (-1, DefaultHardErrorMode, 4, ... {process info, class 12, size 4}, 0x0, ) == 0x0 02288 464 NtSetInformationProcess (-1, DefaultHardErrorMode, {process info, class 12, size 4}, 4, ... ) == 0x0 02289 464 NtQueryDefaultLocale (1, 1225480, ... ) == 0x0 02290 464 NtQueryVirtualMemory (-1, 0xd30000, Basic, 28, ... {BaseAddress=0xd30000,AllocationBase=0xd30000,AllocationProtect=0x2,RegionSize=0x2c000,State=0x1000,Protect=0x2,Type=0x40000,}, 0x0, ) == 0x0 02291 464 NtUnmapViewOfSection (-1, 0xd30000, ... ) == 0x0 02292 464 NtOpenKey (0x80000100, {24, 0, 0x40, 0, 0, (0x80000100, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 02293 464 NtOpenThreadTokenEx (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN 02294 464 NtOpenProcessTokenEx (-1, 0x20008, 512, ... 244, ) == 0x0 02295 464 NtQueryInformationToken (244, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0 02296 464 NtClose (244, ... ) == 0x0 02297 464 NtOpenKey (0x80000100, {24, 0, 0x40, 0, 0, (0x80000100, {24, 0, 0x40, 0, 0, "\REGISTRY\USER\S-1-5-21-1292428093-1383384898-725345543-1003\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 02298 464 NtQueryInformationProcess (-1, DefaultHardErrorMode, 4, ... {process info, class 12, size 4}, 0x0, ) == 0x0 02299 464 NtSetInformationProcess (-1, DefaultHardErrorMode, {process info, class 12, size 4}, 4, ... ) == 0x0 02300 464 NtQueryAttributesFile ({24, 0, 0x40, 0, 0, ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\dwwin.exe"}, 1226080, ... ) }, 1226080, ... ) == 0x0 02301 464 NtOpenFile (0x100001, {24, 0, 0x40, 0, 0, (0x100001, {24, 0, 0x40, 0, 0, "\??\C:\"}, 3, 16417, ... 244, {status=0x0, info=1}, ) }, 3, 16417, ... 244, {status=0x0, info=1}, ) == 0x0 02302 464 NtQueryDirectoryFile (244, 0, 0, 0, 1225508, 616, BothDirectory, 1, (244, 0, 0, 0, 1225508, 616, BothDirectory, 1, "WINDOWS", 0, ... {status=0x0, info=108}, ) , 0, ... {status=0x0, info=108}, ) == 0x0 02303 464 NtClose (244, ... ) == 0x0 02304 464 NtOpenFile (0x100001, {24, 0, 0x40, 0, 0, (0x100001, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\"}, 3, 16417, ... 244, {status=0x0, info=1}, ) }, 3, 16417, ... 244, {status=0x0, info=1}, ) == 0x0 02305 464 NtQueryDirectoryFile (244, 0, 0, 0, 1225508, 616, BothDirectory, 1, (244, 0, 0, 0, 1225508, 616, BothDirectory, 1, "system32", 0, ... {status=0x0, info=110}, ) , 0, ... {status=0x0, info=110}, ) == 0x0 02306 464 NtClose (244, ... ) == 0x0 02307 464 NtOpenFile (0x100001, {24, 0, 0x40, 0, 0, (0x100001, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\"}, 3, 16417, ... 244, {status=0x0, info=1}, ) }, 3, 16417, ... 244, {status=0x0, info=1}, ) == 0x0 02308 464 NtQueryDirectoryFile (244, 0, 0, 0, 1225508, 616, BothDirectory, 1, (244, 0, 0, 0, 1225508, 616, BothDirectory, 1, "dwwin.exe", 0, ... {status=0x0, info=112}, ) , 0, ... {status=0x0, info=112}, ) == 0x0 02309 464 NtClose (244, ... ) == 0x0 02310 464 NtQueryInformationProcess (-1, DefaultHardErrorMode, 4, ... {process info, class 12, size 4}, 0x0, ) == 0x0 02311 464 NtSetInformationProcess (-1, DefaultHardErrorMode, {process info, class 12, size 4}, 4, ... ) == 0x0 02312 464 NtWaitForSingleObject (120, 0, {-1000000, -1}, ... ) == 0x0 02313 464 NtReleaseMutant (120, ... 0x0, ) == 0x0 02314 464 NtUnmapViewOfSection (-1, 0xc00000, ... ) == 0x0 02315 464 NtClose (240, ... ) == 0x0 02316 464 NtClose (236, ... ) == 0x0 02317 464 NtOpenThreadToken (-2, 0x2000000, 1, ... ) == STATUS_NO_TOKEN 02318 464 NtOpenProcessToken (-1, 0xa, ... 236, ) == 0x0 02319 464 NtQueryInformationToken (236, User, 136, ... {token info, class 1, size 36}, 36, ) == 0x0 02320 464 NtOpenKey (0x3, {24, 0, 0x40, 0, 0, (0x3, {24, 0, 0x40, 0, 0, "\Registry\MACHINE\System\CurrentControlSet\Control\SafeBoot\Option"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 02321 464 NtOpenKey (0x1, {24, 0, 0x40, 0, 0, (0x1, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers"}, ... 240, ) }, ... 240, ) == 0x0 02322 464 NtQueryValueKey (240, (240, "TransparentEnabled", Partial, 80, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) , Partial, 80, ... TitleIdx=0, Type=4, Data= (240, "TransparentEnabled", Partial, 80, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) }, 16, ) == 0x0 02323 464 NtQueryValueKey (240, (240, "AuthenticodeEnabled", Partial, 80, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) , Partial, 80, ... TitleIdx=0, Type=4, Data= (240, "AuthenticodeEnabled", Partial, 80, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) }, 16, ) == 0x0 02324 464 NtClose (240, ... ) == 0x0 02325 464 NtOpenKey (0x20019, {24, 0, 0x40, 0, 0, (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Policies\Microsoft\Windows\Safer\LevelObjects"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 02326 464 NtOpenKey (0x1, {24, 0, 0x40, 0, 0, (0x1, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers"}, ... 240, ) }, ... 240, ) == 0x0 02327 464 NtQueryValueKey (240, (240, "Levels", Partial, 536, ... ) , Partial, 536, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 02328 464 NtClose (240, ... ) == 0x0 02329 464 NtQueryDefaultLocale (1, 1227928, ... ) == 0x0 02330 464 NtQueryDefaultLocale (1, 1227928, ... ) == 0x0 02331 464 NtQueryDefaultLocale (1, 1227928, ... ) == 0x0 02332 464 NtQueryDefaultLocale (1, 1227928, ... ) == 0x0 02333 464 NtQueryDefaultLocale (1, 1227928, ... ) == 0x0 02334 464 NtQueryDefaultLocale (1, 1227928, ... ) == 0x0 02335 464 NtQueryDefaultLocale (1, 1227928, ... ) == 0x0 02336 464 NtQueryDefaultLocale (1, 1227928, ... ) == 0x0 02337 464 NtQueryDefaultLocale (1, 1227928, ... ) == 0x0 02338 464 NtQueryDefaultLocale (1, 1227928, ... ) == 0x0 02339 464 NtOpenKey (0x20019, {24, 0, 0x40, 0, 0, (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\0\Paths"}, ... 240, ) }, ... 240, ) == 0x0 02340 464 NtEnumerateKey (240, 0, Basic, 280, ... {LastWrite={0x3a5edea,0x1c74da9}, TitleIdx=0, Name= (240, 0, Basic, 280, ... {LastWrite={0x3a5edea,0x1c74da9}, TitleIdx=0, Name="{dda3f824-d8cb-441b-834d-be2efd2c1a33}"}, 92, ) }, 92, ) == 0x0 02341 464 NtOpenKey (0x20019, {24, 240, 0x40, 0, 0, (0x20019, {24, 240, 0x40, 0, 0, "{dda3f824-d8cb-441b-834d-be2efd2c1a33}"}, ... 244, ) }, ... 244, ) == 0x0 02342 464 NtQueryValueKey (244, (244, "ItemData", Partial, 280, ... TitleIdx=0, Type=2, Data="%\0H\0K\0E\0Y\0_\0C\0U\0R\0R\0E\0N\0T\0_\0U\0S\0E\0R\0\\0S\0o\0f\0t\0w\0a\0r\0e\0\\0M\0i\0c\0r\0o\0s\0o\0f\0t\0\\0W\0i\0n\0d\0o\0w\0s\0\\0C\0u\0r\0r\0e\0n\0t\0V\0e\0r\0s\0i\0o\0n\0\\0E\0x\0p\0l\0o\0r\0e\0r\0\\0S\0h\0e\0l\0l\0 \0F\0o\0l\0d\0e\0r\0s\0\\0C\0a\0c\0h\0e\0%\0O\0L\0K\0*\0\0\0"}, 202, ) , Partial, 280, ... TitleIdx=0, Type=2, Data= (244, "ItemData", Partial, 280, ... TitleIdx=0, Type=2, Data="%\0H\0K\0E\0Y\0_\0C\0U\0R\0R\0E\0N\0T\0_\0U\0S\0E\0R\0\\0S\0o\0f\0t\0w\0a\0r\0e\0\\0M\0i\0c\0r\0o\0s\0o\0f\0t\0\\0W\0i\0n\0d\0o\0w\0s\0\\0C\0u\0r\0r\0e\0n\0t\0V\0e\0r\0s\0i\0o\0n\0\\0E\0x\0p\0l\0o\0r\0e\0r\0\\0S\0h\0e\0l\0l\0 \0F\0o\0l\0d\0e\0r\0s\0\\0C\0a\0c\0h\0e\0%\0O\0L\0K\0*\0\0\0"}, 202, ) }, 202, ) == 0x0 02343 464 NtQueryValueKey (244, (244, "SaferFlags", Partial, 280, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) , Partial, 280, ... TitleIdx=0, Type=4, Data= (244, "SaferFlags", Partial, 280, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) }, 16, ) == 0x0 02344 464 NtClose (244, ... ) == 0x0 02345 464 NtEnumerateKey (240, 1, Basic, 280, ... ) == STATUS_NO_MORE_ENTRIES 02346 464 NtClose (240, ... ) == 0x0 02347 464 NtOpenKey (0x20019, {24, 0, 0x40, 0, 0, (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\0\Hashes"}, ... 240, ) }, ... 240, ) == 0x0 02348 464 NtEnumerateKey (240, 0, Basic, 280, ... {LastWrite={0x38ab3b74,0x1c74d7e}, TitleIdx=0, Name= (240, 0, Basic, 280, ... {LastWrite={0x38ab3b74,0x1c74d7e}, TitleIdx=0, Name="{349d35ab-37b5-462f-9b89-edd5fbde1328}"}, 92, ) }, 92, ) == 0x0 02349 464 NtOpenKey (0x20019, {24, 240, 0x40, 0, 0, (0x20019, {24, 240, 0x40, 0, 0, "{349d35ab-37b5-462f-9b89-edd5fbde1328}"}, ... 244, ) }, ... 244, ) == 0x0 02350 464 NtQueryValueKey (244, (244, "ItemData", Partial, 280, ... TitleIdx=0, Type=3, Data="^\2530O\225zI\211j\0l\341\25@\25"}, 28, ) , Partial, 280, ... TitleIdx=0, Type=3, Data= (244, "ItemData", Partial, 280, ... TitleIdx=0, Type=3, Data="^\2530O\225zI\211j\0l\341\25@\25"}, 28, ) }, 28, ) == 0x0 02351 464 NtQueryValueKey (244, (244, "HashAlg", Partial, 280, ... TitleIdx=0, Type=4, Data="\3\200\0\0"}, 16, ) , Partial, 280, ... TitleIdx=0, Type=4, Data= (244, "HashAlg", Partial, 280, ... TitleIdx=0, Type=4, Data="\3\200\0\0"}, 16, ) }, 16, ) == 0x0 02352 464 NtQueryValueKey (244, (244, "ItemSize", Partial, 280, ... TitleIdx=0, Type=11, Data="\13\3\0\0\0\0\0\0"}, 20, ) , Partial, 280, ... TitleIdx=0, Type=11, Data= (244, "ItemSize", Partial, 280, ... TitleIdx=0, Type=11, Data="\13\3\0\0\0\0\0\0"}, 20, ) }, 20, ) == 0x0 02353 464 NtQueryValueKey (244, (244, "SaferFlags", Partial, 280, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) , Partial, 280, ... TitleIdx=0, Type=4, Data= (244, "SaferFlags", Partial, 280, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) }, 16, ) == 0x0 02354 464 NtClose (244, ... ) == 0x0 02355 464 NtEnumerateKey (240, 1, Basic, 280, ... {LastWrite={0x38ab3b74,0x1c74d7e}, TitleIdx=0, Name= (240, 1, Basic, 280, ... {LastWrite={0x38ab3b74,0x1c74d7e}, TitleIdx=0, Name="{7fb9cd2e-3076-4df9-a57b-b813f72dbb91}"}, 92, ) }, 92, ) == 0x0 02356 464 NtOpenKey (0x20019, {24, 240, 0x40, 0, 0, (0x20019, {24, 240, 0x40, 0, 0, "{7fb9cd2e-3076-4df9-a57b-b813f72dbb91}"}, ... 244, ) }, ... 244, ) == 0x0 02357 464 NtQueryValueKey (244, (244, "ItemData", Partial, 280, ... TitleIdx=0, Type=3, Data="g\260\324\2134:?\323\274\351\334dg\4\363\224"}, 28, ) , Partial, 280, ... TitleIdx=0, Type=3, Data= (244, "ItemData", Partial, 280, ... TitleIdx=0, Type=3, Data="g\260\324\2134:?\323\274\351\334dg\4\363\224"}, 28, ) }, 28, ) == 0x0 02358 464 NtQueryValueKey (244, (244, "HashAlg", Partial, 280, ... TitleIdx=0, Type=4, Data="\3\200\0\0"}, 16, ) , Partial, 280, ... TitleIdx=0, Type=4, Data= (244, "HashAlg", Partial, 280, ... TitleIdx=0, Type=4, Data="\3\200\0\0"}, 16, ) }, 16, ) == 0x0 02359 464 NtQueryValueKey (244, (244, "ItemSize", Partial, 280, ... TitleIdx=0, Type=11, Data="\5\2\0\0\0\0\0\0"}, 20, ) , Partial, 280, ... TitleIdx=0, Type=11, Data= (244, "ItemSize", Partial, 280, ... TitleIdx=0, Type=11, Data="\5\2\0\0\0\0\0\0"}, 20, ) }, 20, ) == 0x0 02360 464 NtQueryValueKey (244, (244, "SaferFlags", Partial, 280, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) , Partial, 280, ... TitleIdx=0, Type=4, Data= (244, "SaferFlags", Partial, 280, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) }, 16, ) == 0x0 02361 464 NtClose (244, ... ) == 0x0 02362 464 NtEnumerateKey (240, 2, Basic, 280, ... {LastWrite={0x38ab3b74,0x1c74d7e}, TitleIdx=0, Name= (240, 2, Basic, 280, ... {LastWrite={0x38ab3b74,0x1c74d7e}, TitleIdx=0, Name="{81d1fe15-dd9d-4762-b16d-7c29ddecae3f}"}, 92, ) }, 92, ) == 0x0 02363 464 NtOpenKey (0x20019, {24, 240, 0x40, 0, 0, (0x20019, {24, 240, 0x40, 0, 0, "{81d1fe15-dd9d-4762-b16d-7c29ddecae3f}"}, ... 244, ) }, ... 244, ) == 0x0 02364 464 NtQueryValueKey (244, (244, "ItemData", Partial, 280, ... TitleIdx=0, Type=3, Data="2x\2\334\376\370\310\223\334\212\260\6\335\204}\35"}, 28, ) , Partial, 280, ... TitleIdx=0, Type=3, Data= (244, "ItemData", Partial, 280, ... TitleIdx=0, Type=3, Data="2x\2\334\376\370\310\223\334\212\260\6\335\204}\35"}, 28, ) }, 28, ) == 0x0 02365 464 NtQueryValueKey (244, (244, "HashAlg", Partial, 280, ... TitleIdx=0, Type=4, Data="\3\200\0\0"}, 16, ) , Partial, 280, ... TitleIdx=0, Type=4, Data= (244, "HashAlg", Partial, 280, ... TitleIdx=0, Type=4, Data="\3\200\0\0"}, 16, ) }, 16, ) == 0x0 02366 464 NtQueryValueKey (244, (244, "ItemSize", Partial, 280, ... TitleIdx=0, Type=11, Data="\226\3\0\0\0\0\0\0"}, 20, ) , Partial, 280, ... TitleIdx=0, Type=11, Data= (244, "ItemSize", Partial, 280, ... TitleIdx=0, Type=11, Data="\226\3\0\0\0\0\0\0"}, 20, ) }, 20, ) == 0x0 02367 464 NtQueryValueKey (244, (244, "SaferFlags", Partial, 280, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) , Partial, 280, ... TitleIdx=0, Type=4, Data= (244, "SaferFlags", Partial, 280, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) }, 16, ) == 0x0 02368 464 NtClose (244, ... ) == 0x0 02369 464 NtEnumerateKey (240, 3, Basic, 280, ... {LastWrite={0x38ab3b74,0x1c74d7e}, TitleIdx=0, Name= (240, 3, Basic, 280, ... {LastWrite={0x38ab3b74,0x1c74d7e}, TitleIdx=0, Name="{94e3e076-8f53-42a5-8411-085bcc18a68d}"}, 92, ) }, 92, ) == 0x0 02370 464 NtOpenKey (0x20019, {24, 240, 0x40, 0, 0, (0x20019, {24, 240, 0x40, 0, 0, "{94e3e076-8f53-42a5-8411-085bcc18a68d}"}, ... 244, ) }, ... 244, ) == 0x0 02371 464 NtQueryValueKey (244, (244, "ItemData", Partial, 280, ... TitleIdx=0, Type=3, Data="\275\232*\333B\353\330V\16%\16M\370\26/g"}, 28, ) , Partial, 280, ... TitleIdx=0, Type=3, Data= (244, "ItemData", Partial, 280, ... TitleIdx=0, Type=3, Data="\275\232*\333B\353\330V\16%\16M\370\26/g"}, 28, ) }, 28, ) == 0x0 02372 464 NtQueryValueKey (244, (244, "HashAlg", Partial, 280, ... TitleIdx=0, Type=4, Data="\3\200\0\0"}, 16, ) , Partial, 280, ... TitleIdx=0, Type=4, Data= (244, "HashAlg", Partial, 280, ... TitleIdx=0, Type=4, Data="\3\200\0\0"}, 16, ) }, 16, ) == 0x0 02373 464 NtQueryValueKey (244, (244, "ItemSize", Partial, 280, ... TitleIdx=0, Type=11, Data="\345\0\0\0\0\0\0\0"}, 20, ) , Partial, 280, ... TitleIdx=0, Type=11, Data= (244, "ItemSize", Partial, 280, ... TitleIdx=0, Type=11, Data="\345\0\0\0\0\0\0\0"}, 20, ) }, 20, ) == 0x0 02374 464 NtQueryValueKey (244, (244, "SaferFlags", Partial, 280, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) , Partial, 280, ... TitleIdx=0, Type=4, Data= (244, "SaferFlags", Partial, 280, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) }, 16, ) == 0x0 02375 464 NtClose (244, ... ) == 0x0 02376 464 NtEnumerateKey (240, 4, Basic, 280, ... {LastWrite={0x38ab3b74,0x1c74d7e}, TitleIdx=0, Name= (240, 4, Basic, 280, ... {LastWrite={0x38ab3b74,0x1c74d7e}, TitleIdx=0, Name="{dc971ee5-44eb-4fe4-ae2e-b91490411bfc}"}, 92, ) }, 92, ) == 0x0 02377 464 NtOpenKey (0x20019, {24, 240, 0x40, 0, 0, (0x20019, {24, 240, 0x40, 0, 0, "{dc971ee5-44eb-4fe4-ae2e-b91490411bfc}"}, ... 244, ) }, ... 244, ) == 0x0 02378 464 NtQueryValueKey (244, (244, "ItemData", Partial, 280, ... TitleIdx=0, Type=3, Data="8k\10_\204\354\366i\323k\225j"\300\36\200"}, 28, ) , Partial, 280, ... TitleIdx=0, Type=3, Data= (244, "ItemData", Partial, 280, ... TitleIdx=0, Type=3, Data="8k\10_\204\354\366i\323k\225j"\300\36\200"}, 28, ) \300\36\200"}, 28, ) == 0x0 02379 464 NtQueryValueKey (244, (244, "HashAlg", Partial, 280, ... TitleIdx=0, Type=4, Data="\3\200\0\0"}, 16, ) , Partial, 280, ... TitleIdx=0, Type=4, Data= (244, "HashAlg", Partial, 280, ... TitleIdx=0, Type=4, Data="\3\200\0\0"}, 16, ) }, 16, ) == 0x0 02380 464 NtQueryValueKey (244, (244, "ItemSize", Partial, 280, ... TitleIdx=0, Type=11, Data="r\1\0\0\0\0\0\0"}, 20, ) , Partial, 280, ... TitleIdx=0, Type=11, Data= (244, "ItemSize", Partial, 280, ... TitleIdx=0, Type=11, Data="r\1\0\0\0\0\0\0"}, 20, ) }, 20, ) == 0x0 02381 464 NtQueryValueKey (244, (244, "SaferFlags", Partial, 280, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) , Partial, 280, ... TitleIdx=0, Type=4, Data= (244, "SaferFlags", Partial, 280, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) }, 16, ) == 0x0 02382 464 NtClose (244, ... ) == 0x0 02383 464 NtEnumerateKey (240, 5, Basic, 280, ... ) == STATUS_NO_MORE_ENTRIES 02384 464 NtClose (240, ... ) == 0x0 02385 464 NtOpenKey (0x20019, {24, 0, 0x40, 0, 0, (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\0\UrlZones"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 02386 464 NtOpenKey (0x20019, {24, 0, 0x40, 0, 0, (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\4096\Paths"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 02387 464 NtOpenKey (0x20019, {24, 0, 0x40, 0, 0, (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\4096\Hashes"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 02388 464 NtOpenKey (0x20019, {24, 0, 0x40, 0, 0, (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\4096\UrlZones"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 02389 464 NtOpenKey (0x20019, {24, 0, 0x40, 0, 0, (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\65536\Paths"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 02390 464 NtOpenKey (0x20019, {24, 0, 0x40, 0, 0, (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\65536\Hashes"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 02391 464 NtOpenKey (0x20019, {24, 0, 0x40, 0, 0, (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\65536\UrlZones"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 02392 464 NtOpenKey (0x20019, {24, 0, 0x40, 0, 0, (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\131072\Paths"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 02393 464 NtOpenKey (0x20019, {24, 0, 0x40, 0, 0, (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\131072\Hashes"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 02394 464 NtOpenKey (0x20019, {24, 0, 0x40, 0, 0, (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\131072\UrlZones"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 02395 464 NtOpenKey (0x20019, {24, 0, 0x40, 0, 0, (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\262144\Paths"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 02396 464 NtOpenKey (0x20019, {24, 0, 0x40, 0, 0, (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\262144\Hashes"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 02397 464 NtOpenKey (0x20019, {24, 0, 0x40, 0, 0, (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\262144\UrlZones"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 02398 464 NtOpenThreadTokenEx (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN 02399 464 NtOpenProcessTokenEx (-1, 0x20008, 512, ... 240, ) == 0x0 02400 464 NtQueryInformationToken (240, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0 02401 464 NtClose (240, ... ) == 0x0 02402 464 NtOpenKey (0x20019, {24, 0, 0x40, 0, 0, (0x20019, {24, 0, 0x40, 0, 0, "\REGISTRY\USER\S-1-5-21-1292428093-1383384898-725345543-1003\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\0\Paths"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 02403 464 NtOpenThreadTokenEx (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN 02404 464 NtOpenProcessTokenEx (-1, 0x20008, 512, ... 240, ) == 0x0 02405 464 NtQueryInformationToken (240, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0 02406 464 NtClose (240, ... ) == 0x0 02407 464 NtOpenKey (0x20019, {24, 0, 0x40, 0, 0, (0x20019, {24, 0, 0x40, 0, 0, "\REGISTRY\USER\S-1-5-21-1292428093-1383384898-725345543-1003\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\0\Hashes"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 02408 464 NtOpenThreadTokenEx (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN 02409 464 NtOpenProcessTokenEx (-1, 0x20008, 512, ... 240, ) == 0x0 02410 464 NtQueryInformationToken (240, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0 02411 464 NtClose (240, ... ) == 0x0 02412 464 NtOpenKey (0x20019, {24, 0, 0x40, 0, 0, (0x20019, {24, 0, 0x40, 0, 0, "\REGISTRY\USER\S-1-5-21-1292428093-1383384898-725345543-1003\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\0\UrlZones"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 02413 464 NtOpenThreadTokenEx (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN 02414 464 NtOpenProcessTokenEx (-1, 0x20008, 512, ... 240, ) == 0x0 02415 464 NtQueryInformationToken (240, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0 02416 464 NtClose (240, ... ) == 0x0 02417 464 NtOpenKey (0x20019, {24, 0, 0x40, 0, 0, (0x20019, {24, 0, 0x40, 0, 0, "\REGISTRY\USER\S-1-5-21-1292428093-1383384898-725345543-1003\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\4096\Paths"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 02418 464 NtOpenThreadTokenEx (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN 02419 464 NtOpenProcessTokenEx (-1, 0x20008, 512, ... 240, ) == 0x0 02420 464 NtQueryInformationToken (240, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0 02421 464 NtClose (240, ... ) == 0x0 02422 464 NtOpenKey (0x20019, {24, 0, 0x40, 0, 0, (0x20019, {24, 0, 0x40, 0, 0, "\REGISTRY\USER\S-1-5-21-1292428093-1383384898-725345543-1003\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\4096\Hashes"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 02423 464 NtOpenThreadTokenEx (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN 02424 464 NtOpenProcessTokenEx (-1, 0x20008, 512, ... 240, ) == 0x0 02425 464 NtQueryInformationToken (240, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0 02426 464 NtClose (240, ... ) == 0x0 02427 464 NtOpenKey (0x20019, {24, 0, 0x40, 0, 0, (0x20019, {24, 0, 0x40, 0, 0, "\REGISTRY\USER\S-1-5-21-1292428093-1383384898-725345543-1003\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\4096\UrlZones"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 02428 464 NtOpenThreadTokenEx (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN 02429 464 NtOpenProcessTokenEx (-1, 0x20008, 512, ... 240, ) == 0x0 02430 464 NtQueryInformationToken (240, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0 02431 464 NtClose (240, ... ) == 0x0 02432 464 NtOpenKey (0x20019, {24, 0, 0x40, 0, 0, (0x20019, {24, 0, 0x40, 0, 0, "\REGISTRY\USER\S-1-5-21-1292428093-1383384898-725345543-1003\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\65536\Paths"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 02433 464 NtOpenThreadTokenEx (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN 02434 464 NtOpenProcessTokenEx (-1, 0x20008, 512, ... 240, ) == 0x0 02435 464 NtQueryInformationToken (240, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0 02436 464 NtClose (240, ... ) == 0x0 02437 464 NtOpenKey (0x20019, {24, 0, 0x40, 0, 0, (0x20019, {24, 0, 0x40, 0, 0, "\REGISTRY\USER\S-1-5-21-1292428093-1383384898-725345543-1003\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\65536\Hashes"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 02438 464 NtOpenThreadTokenEx (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN 02439 464 NtOpenProcessTokenEx (-1, 0x20008, 512, ... 240, ) == 0x0 02440 464 NtQueryInformationToken (240, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0 02441 464 NtClose (240, ... ) == 0x0 02442 464 NtOpenKey (0x20019, {24, 0, 0x40, 0, 0, (0x20019, {24, 0, 0x40, 0, 0, "\REGISTRY\USER\S-1-5-21-1292428093-1383384898-725345543-1003\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\65536\UrlZones"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 02443 464 NtOpenThreadTokenEx (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN 02444 464 NtOpenProcessTokenEx (-1, 0x20008, 512, ... 240, ) == 0x0 02445 464 NtQueryInformationToken (240, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0 02446 464 NtClose (240, ... ) == 0x0 02447 464 NtOpenKey (0x20019, {24, 0, 0x40, 0, 0, (0x20019, {24, 0, 0x40, 0, 0, "\REGISTRY\USER\S-1-5-21-1292428093-1383384898-725345543-1003\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\131072\Paths"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 02448 464 NtOpenThreadTokenEx (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN 02449 464 NtOpenProcessTokenEx (-1, 0x20008, 512, ... 240, ) == 0x0 02450 464 NtQueryInformationToken (240, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0 02451 464 NtClose (240, ... ) == 0x0 02452 464 NtOpenKey (0x20019, {24, 0, 0x40, 0, 0, (0x20019, {24, 0, 0x40, 0, 0, "\REGISTRY\USER\S-1-5-21-1292428093-1383384898-725345543-1003\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\131072\Hashes"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 02453 464 NtOpenThreadTokenEx (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN 02454 464 NtOpenProcessTokenEx (-1, 0x20008, 512, ... 240, ) == 0x0 02455 464 NtQueryInformationToken (240, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0 02456 464 NtClose (240, ... ) == 0x0 02457 464 NtOpenKey (0x20019, {24, 0, 0x40, 0, 0, (0x20019, {24, 0, 0x40, 0, 0, "\REGISTRY\USER\S-1-5-21-1292428093-1383384898-725345543-1003\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\131072\UrlZones"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 02458 464 NtOpenThreadTokenEx (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN 02459 464 NtOpenProcessTokenEx (-1, 0x20008, 512, ... 240, ) == 0x0 02460 464 NtQueryInformationToken (240, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0 02461 464 NtClose (240, ... ) == 0x0 02462 464 NtOpenKey (0x20019, {24, 0, 0x40, 0, 0, (0x20019, {24, 0, 0x40, 0, 0, "\REGISTRY\USER\S-1-5-21-1292428093-1383384898-725345543-1003\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\262144\Paths"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 02463 464 NtOpenThreadTokenEx (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN 02464 464 NtOpenProcessTokenEx (-1, 0x20008, 512, ... 240, ) == 0x0 02465 464 NtQueryInformationToken (240, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0 02466 464 NtClose (240, ... ) == 0x0 02467 464 NtOpenKey (0x20019, {24, 0, 0x40, 0, 0, (0x20019, {24, 0, 0x40, 0, 0, "\REGISTRY\USER\S-1-5-21-1292428093-1383384898-725345543-1003\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\262144\Hashes"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 02468 464 NtOpenThreadTokenEx (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN 02469 464 NtOpenProcessTokenEx (-1, 0x20008, 512, ... 240, ) == 0x0 02470 464 NtQueryInformationToken (240, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0 02471 464 NtClose (240, ... ) == 0x0 02472 464 NtOpenKey (0x20019, {24, 0, 0x40, 0, 0, (0x20019, {24, 0, 0x40, 0, 0, "\REGISTRY\USER\S-1-5-21-1292428093-1383384898-725345543-1003\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\262144\UrlZones"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 02473 464 NtOpenKey (0x20019, {24, 0, 0x40, 0, 0, (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers"}, ... 240, ) }, ... 240, ) == 0x0 02474 464 NtQueryValueKey (240, (240, "DefaultLevel", Full, 524, ... TitleIdx=0, Type=4, Name="DefaultLevel", Data="\0\0\4\0"}, 48, ) , Full, 524, ... TitleIdx=0, Type=4, Name= (240, "DefaultLevel", Full, 524, ... TitleIdx=0, Type=4, Name="DefaultLevel", Data="\0\0\4\0"}, 48, ) , Data= (240, "DefaultLevel", Full, 524, ... TitleIdx=0, Type=4, Name="DefaultLevel", Data="\0\0\4\0"}, 48, ) }, 48, ) == 0x0 02475 464 NtClose (240, ... ) == 0x0 02476 464 NtOpenThreadTokenEx (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN 02477 464 NtOpenProcessTokenEx (-1, 0x20008, 512, ... 240, ) == 0x0 02478 464 NtQueryInformationToken (240, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0 02479 464 NtClose (240, ... ) == 0x0 02480 464 NtOpenKey (0x20019, {24, 0, 0x40, 0, 0, (0x20019, {24, 0, 0x40, 0, 0, "\REGISTRY\USER\S-1-5-21-1292428093-1383384898-725345543-1003\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 02481 464 NtOpenThreadToken (-2, 0x8, 0, ... ) == STATUS_NO_TOKEN 02482 464 NtOpenProcessToken (-1, 0xa, ... 240, ) == 0x0 02483 464 NtDuplicateToken (240, 0xc, {24, 0, 0x0, 0, 1228360, 0x0}, 0, 2, ... 244, ) == 0x0 02484 464 NtClose (240, ... ) == 0x0 02485 464 NtAccessCheck (1379992, 244, 0x1, 1228436, 1228488, 56, 1228468, ... (0x1), ) == 0x0 02486 464 NtClose (244, ... ) == 0x0 02487 464 NtOpenKey (0x1, {24, 0, 0x40, 0, 0, (0x1, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers"}, ... 244, ) }, ... 244, ) == 0x0 02488 464 NtQueryValueKey (244, (244, "PolicyScope", Partial, 80, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) , Partial, 80, ... TitleIdx=0, Type=4, Data= (244, "PolicyScope", Partial, 80, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) }, 16, ) == 0x0 02489 464 NtClose (244, ... ) == 0x0 02490 464 NtOpenSymbolicLinkObject (0x1, {24, 0, 0x40, 0, 0, (0x1, {24, 0, 0x40, 0, 0, "\??\C:"}, ... 244, ) }, ... 244, ) == 0x0 02491 464 NtQuerySymbolicLinkObject (244, ... (244, ... "\Device\HarddiskVolume1", 48, ) , 48, ) == 0x0 02492 464 NtClose (244, ... ) == 0x0 02493 464 NtQueryVolumeInformationFile (228, 1226192, 8, Device, ... {status=0x0, info=8}, ) == 0x0 02494 464 NtQueryInformationFile (228, 1226308, 528, Name, ... {status=0x0, info=58}, ) == 0x0 02495 464 NtQueryInformationProcess (-1, DefaultHardErrorMode, 4, ... {process info, class 12, size 4}, 0x0, ) == 0x0 02496 464 NtSetInformationProcess (-1, DefaultHardErrorMode, {process info, class 12, size 4}, 4, ... ) == 0x0 02497 464 NtQueryAttributesFile ({24, 0, 0x40, 0, 0, ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\dwwin.exe"}, 1225480, ... ) }, 1225480, ... ) == 0x0 02498 464 NtOpenFile (0x100001, {24, 0, 0x40, 0, 0, (0x100001, {24, 0, 0x40, 0, 0, "\??\C:\"}, 3, 16417, ... 244, {status=0x0, info=1}, ) }, 3, 16417, ... 244, {status=0x0, info=1}, ) == 0x0 02499 464 NtQueryDirectoryFile (244, 0, 0, 0, 1224908, 616, BothDirectory, 1, (244, 0, 0, 0, 1224908, 616, BothDirectory, 1, "WINDOWS", 0, ... {status=0x0, info=108}, ) , 0, ... {status=0x0, info=108}, ) == 0x0 02500 464 NtClose (244, ... ) == 0x0 02501 464 NtOpenFile (0x100001, {24, 0, 0x40, 0, 0, (0x100001, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\"}, 3, 16417, ... 244, {status=0x0, info=1}, ) }, 3, 16417, ... 244, {status=0x0, info=1}, ) == 0x0 02502 464 NtQueryDirectoryFile (244, 0, 0, 0, 1224908, 616, BothDirectory, 1, (244, 0, 0, 0, 1224908, 616, BothDirectory, 1, "system32", 0, ... {status=0x0, info=110}, ) , 0, ... {status=0x0, info=110}, ) == 0x0 02503 464 NtClose (244, ... ) == 0x0 02504 464 NtOpenFile (0x100001, {24, 0, 0x40, 0, 0, (0x100001, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\"}, 3, 16417, ... 244, {status=0x0, info=1}, ) }, 3, 16417, ... 244, {status=0x0, info=1}, ) == 0x0 02505 464 NtQueryDirectoryFile (244, 0, 0, 0, 1224908, 616, BothDirectory, 1, (244, 0, 0, 0, 1224908, 616, BothDirectory, 1, "dwwin.exe", 0, ... {status=0x0, info=112}, ) , 0, ... {status=0x0, info=112}, ) == 0x0 02506 464 NtClose (244, ... ) == 0x0 02507 464 NtQueryInformationProcess (-1, DefaultHardErrorMode, 4, ... {process info, class 12, size 4}, 0x0, ) == 0x0 02508 464 NtSetInformationProcess (-1, DefaultHardErrorMode, {process info, class 12, size 4}, 4, ... ) == 0x0 02509 464 NtQueryInformationFile (228, 1228348, 24, Standard, ... {status=0x0, info=24}, ) == 0x0 02510 464 NtCreateSection (0xf0005, 0x0, {180224, 0}, 2, 134217728, 228, ... 244, ) == 0x0 02511 464 NtMapViewOfSection (244, -1, (0x0), 0, 0, {0, 0}, 180224, 1, 0, 2, ... (0xc00000), {0, 0}, 180224, ) == 0x0 02512 464 NtClose (244, ... ) == 0x0 02513 464 NtOpenThreadTokenEx (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN 02514 464 NtOpenProcessTokenEx (-1, 0x20008, 512, ... 244, ) == 0x0 02515 464 NtQueryInformationToken (244, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0 02516 464 NtClose (244, ... ) == 0x0 02517 464 NtOpenKey (0x20019, {24, 0, 0x640, 0, 0, (0x20019, {24, 0, 0x640, 0, 0, "\REGISTRY\USER\S-1-5-21-1292428093-1383384898-725345543-1003"}, ... 244, ) }, ... 244, ) == 0x0 02518 464 NtOpenKey (0x20019, {24, 244, 0x40, 0, 0, (0x20019, {24, 244, 0x40, 0, 0, "Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders"}, ... 240, ) }, ... 240, ) == 0x0 02519 464 NtClose (244, ... ) == 0x0 02520 464 NtQueryValueKey (240, (240, "Cache", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW 02521 464 NtQueryValueKey (240, (240, "Cache", Partial, 174, ... TitleIdx=0, Type=1, Data="C\0:\0\\0D\0o\0c\0u\0m\0e\0n\0t\0s\0 \0a\0n\0d\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0M\0a\0r\0t\0i\0m\0 \0C\0a\0r\0b\0o\0n\0e\0\\0L\0o\0c\0a\0l\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0T\0e\0m\0p\0o\0r\0a\0r\0y\0 \0I\0n\0t\0e\0r\0n\0e\0t\0 \0F\0i\0l\0e\0s\0\0\0"}, 174, ) , Partial, 174, ... TitleIdx=0, Type=1, Data= (240, "Cache", Partial, 174, ... TitleIdx=0, Type=1, Data="C\0:\0\\0D\0o\0c\0u\0m\0e\0n\0t\0s\0 \0a\0n\0d\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0M\0a\0r\0t\0i\0m\0 \0C\0a\0r\0b\0o\0n\0e\0\\0L\0o\0c\0a\0l\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0T\0e\0m\0p\0o\0r\0a\0r\0y\0 \0I\0n\0t\0e\0r\0n\0e\0t\0 \0F\0i\0l\0e\0s\0\0\0"}, 174, ) }, 174, ) == 0x0 02522 464 NtClose (240, ... ) == 0x0 02523 464 NtUnmapViewOfSection (-1, 0xc00000, ... ) == 0x0 02524 464 NtAllocateVirtualMemory (-1, 0, 0, 4096, 8192, 4, ... 12582912, 4096, ) == 0x0 02525 464 NtAllocateVirtualMemory (-1, 12582912, 0, 4096, 4096, 4, ... 12582912, 4096, ) == 0x0 02526 464 NtOpenKey (0x1, {24, 0, 0x40, 0, 0, (0x1, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers"}, ... 240, ) }, ... 240, ) == 0x0 02527 464 NtQueryValueKey (240, (240, "LogFileName", Partial, 536, ... ) , Partial, 536, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 02528 464 NtClose (240, ... ) == 0x0 02529 464 NtOpenKey (0x3, {24, 0, 0x40, 0, 0, (0x3, {24, 0, 0x40, 0, 0, "\Registry\MACHINE\System\CurrentControlSet\Control\SafeBoot\Option"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 02530 464 NtQueryInformationToken (236, User, 128, ... {token info, class 1, size 36}, 36, ) == 0x0 02531 464 NtQueryInformationToken (236, 15, 4, ... {token info, class 15, size 4}, 4, ) == 0x0 02532 464 NtClose (236, ... ) == 0x0 02533 464 NtQuerySection (232, Image, 48, ... {section info, class 1, size 48}, 0x0, ) == 0x0 02534 464 NtOpenKey (0x80000000, {24, 0, 0x40, 0, 0, (0x80000000, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\dwwin.exe"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 02535 464 NtQuerySystemInformation (71, 4, ... {system info, class 71, size 4}, 0x0, ) == 0x0 02536 464 NtCreateProcessEx (1230272, 2035711, 0, -1, 4, 232, 0, 0, 0, ... ) == 0x0 02537 464 NtSetInformationProcess (236, PriorityClass, {process info, class 18, size 2}, 512, ... ) == 0x0 02538 464 NtSetInformationProcess (236, DefaultHardErrorMode, {process info, class 12, size 4}, 4, ... ) == 0x0 02539 464 NtQueryInformationProcess (236, Basic, 24, ... {ExitStatus=0x103,PebBaseAddress=0x7ffd6000,AffinityMask=0x1,BasePriority=8,Pid=1756,ParentPid=1036,}, 0x0, ) == 0x0 02540 464 NtReadVirtualMemory (236, 0x7ffd6008, 4, ... (236, 0x7ffd6008, 4, ... "\0\0\00", 0x0, ) , 0x0, ) == 0x0 02541 464 NtOpenFile (0x1200a9, {24, 0, 0x40, 0, 0, (0x1200a9, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\dwwin.exe.Manifest"}, 1, 96, ... ) }, 1, 96, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 02542 464 NtReadVirtualMemory (236, 0x30000000, 4096, ... (236, 0x30000000, 4096, ... "MZ\220\0\3\0\0\0\4\0\0\0\377\377\0\0\270\0\0\0\0\0\0\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\360\0\0\0\16\37\272\16\0\264\11\315!\270\1L\315!This program cannot be run in DOS mode.\15\15\12$\0\0\0\0\0\0\0$\206\244\23`\347\312@`\347\312@`\347\312@9\304\331@b\347\312@`\347\313@d\347\312@\210\370\301@a\347\312@\343\373\304@j\347\312@\210\370\300@I\347\312@6\370\331@h\347\312@\272\304\326@i\347\312@\220\370\301@p\347\312@`\347\312@H\346\312@Rich`\347\312@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0PE\0\0L\1\3\0N\23\216?\0\0\0\0\0\0\0\0\340\0\17\1\13\1\6\24\0\220\2\0\0\240\0\0\0\0\0\0\232t\0\0\0\20\0\0\0\320\3\0\0\0\00\0\20\0\0\0\20\0\0\4\0\0\0\0\0\0\0\4\0\0\0\0\0\0\0\0@\3\0\0\20\0\0\237*\3\0\2\0\0\0\0\0\20\0\0\20\0\0\0\0\20\0\0\20\0\0\0\0\0\0\20\0\0\0\0\0\0\0\0\0\0\0\327\211\2\0z\1\0\0\00\3\0\244\12\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0Z\236\2\08\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0`\2\0\0\370\0\0\0\0\20\0\0\270\3\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0.text\0\0\0\222\216\2\0", 4096, ) , 4096, ) == 0x0 02543 464 NtReadVirtualMemory (236, 0x30033000, 256, ... (236, 0x30033000, 256, ... "\0\0\0\0J\23\216?\0\0\0\0\0\0\3\0\5\0\0\0(\0\0\200\13\0\0\0@\0\0\200\20\0\0\0X\0\0\200\0\0\0\0J\23\216?\0\0\0\0\0\0\1\0e\0\0\0p\0\0\200\0\0\0\0J\23\216?\0\0\0\0\0\0\1\0\1\0\0\0\210\0\0\200\0\0\0\0J\23\216?\0\0\0\0\0\0\1\0\1\0\0\0\240\0\0\200\0\0\0\0J\23\216?\0\0\0\0\0\0\1\0\11\4\0\0\270\0\0\0\0\0\0\0J\23\216?\0\0\0\0\0\0\1\0\11\4\0\0\310\0\0\0\0\0\0\0J\23\216?\0\0\0\0\0\0\1\0\11\4\0\0\330\0\0\0\3600\3\0\26\3\0\0\0\0\0\0\0\0\0\0\104\3\0\254\1\0\0\0\0\0\0\0\0\0\0\2645\3\0\360\4\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\300\0\310\200\0\0\0\0\14\0\0\0\0\0f\1", 256, ) , 256, ) == 0x0 02544 464 NtQueryDebugFilterState (53, 2, ... ) == 0x0 02545 464 NtQueryInformationProcess (236, Basic, 24, ... {ExitStatus=0x103,PebBaseAddress=0x7ffd6000,AffinityMask=0x1,BasePriority=8,Pid=1756,ParentPid=1036,}, 0x0, ) == 0x0 02546 464 NtQueryAttributesFile ({24, 0, 0x40, 0, 0, ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32"}, 1229224, ... ) }, 1229224, ... ) == 0x0 02547 464 NtAllocateVirtualMemory (-1, 0, 0, 2428, 4096, 4, ... 12648448, 4096, ) == 0x0 02548 464 NtAllocateVirtualMemory (236, 0, 0, 6432, 4096, 4, ... 65536, 8192, ) == 0x0 02549 464 NtWriteVirtualMemory (236, 0x10000, (236, 0x10000, "=\0A\0:\0=\0A\0:\0\\0\0\0=\0C\0:\0=\0C\0:\0\\0s\0c\0r\0i\0p\0t\0s\0\0\0=\0U\0:\0=\0U\0:\0\\0\0\0A\0L\0L\0U\0S\0E\0R\0S\0P\0R\0O\0F\0I\0L\0E\0=\0C\0:\0\\0D\0o\0c\0u\0m\0e\0n\0t\0s\0 \0a\0n\0d\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0A\0l\0l\0 \0U\0s\0e\0r\0s\0\0\0A\0P\0P\0D\0A\0T\0A\0=\0C\0:\0\\0D\0o\0c\0u\0m\0e\0n\0t\0s\0 \0a\0n\0d\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0M\0a\0r\0t\0i\0m\0 \0C\0a\0r\0b\0o\0n\0e\0\\0A\0p\0p\0l\0i\0c\0a\0t\0i\0o\0n\0 \0D\0a\0t\0a\0\0\0A\0T\0L\0_\0I\0N\0C\0_\0P\0A\0T\0H\0=\0C\0:\0\\0W\0I\0N\0D\0D\0K\0\\03\07\09\00\0~\01\0.\01\08\03\0\\0i\0n\0c\0\0\0A\0T\0L\0_\0I\0N\0C\0_\0R\0O\0O\0T\0=\0C\0:\0\\0W\0I\0N\0D\0D\0K\0\\03\07\09\00\0~\01\0.\01\08\03\0\\0i\0n\0c\0\0\0A\0T\0L\0_\0L\0I\0B\0_\0P\0A\0T\0H\0=\0C\0:\0\\0W\0I\0N\0D\0D\0K\0\\03\07\0", 6432, ... 0x0, ) , 6432, ... 0x0, ) == 0x0 02550 464 NtAllocateVirtualMemory (236, 0, 0, 2428, 4096, 4, ... 131072, 4096, ) == 0x0 02551 464 NtWriteVirtualMemory (236, 0x20000, (236, 0x20000, "\0\20\0\0|\11\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\3\0\0\0\0\0\0\0\13\0\0\0&\0\10\2\220\2\0\0\16\0\0\0\364\3\366\3\230\4\0\0:\0<\0\220\10\0\0N\0P\0\314\10\0\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0:\0<\0\34\11\0\0\36\0 \0X\11\0\0\0\0\2\0x\11\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0", 2428, ... 0x0, ) , 2428, ... 0x0, ) == 0x0 02552 464 NtWriteVirtualMemory (236, 0x7ffd6010, (236, 0x7ffd6010, "\0\0\2\0", 4, ... 0x0, ) , 4, ... 0x0, ) == 0x0 02553 464 NtAllocateVirtualMemory (236, 0, 0, 388, 4096, 4, ... 196608, 4096, ) == 0x0 02554 464 NtWriteVirtualMemory (236, 0x30000, (236, 0x30000, "S\0h\0i\0m\0E\0n\0g\0.\0d\0l\0l\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\204\1\0\0\253\355\15\254\210\255\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\1\0\0\0\21\21\21\21\21\21\21\21\21\21\21\21\21\21\21\21\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0", 388, ... 0x0, ) , 388, ... 0x0, ) == 0x0 02555 464 NtWriteVirtualMemory (236, 0x7ffd61e8, (236, 0x7ffd61e8, "\0\0\3\0", 4, ... 0x0, ) , 4, ... 0x0, ) == 0x0 02556 464 NtFreeVirtualMemory (-1, (0xc10000), 0, 32768, ... (0xc10000), 4096, ) == 0x0 02557 464 NtAllocateVirtualMemory (236, 0, 0, 1048576, 8192, 4, ... 262144, 1048576, ) == 0x0 02558 464 NtAllocateVirtualMemory (236, 1302528, 0, 8192, 4096, 4, ... 1302528, 8192, ) == 0x0 02559 464 NtProtectVirtualMemory (236, (0x13e000), 4096, 260, ... (0x13e000), 4096, 4, ) == 0x0 02560 464 NtCreateThread (0x1f03ff, 0x0, 236, 1230280, 1229944, 1, ... 240, {1756, 1292}, ) == 0x0 02561 464 NtRequestWaitReplyPort (24, {168, 196, new_msg, 0, 0, 2147348480, 2008285840, 0} (24, {168, 196, new_msg, 0, 0, 2147348480, 2008285840, 0} "\0\0\0\0\0\0\1\0\0\0\0\0x\2\264w\357\0\0\0\360\0\0\0\334\6\0\0\14\5\0\0\0\0\0\0\0\0\0\0\0\0\0\4\0\0\0\0\260\311\22\0x\1\24\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0`\375\177\0\0\0\0\0\0\25\0\10 \0\0" ... {168, 196, reply, 0, 1036, 464, 57982, 0} "\0\0\0\0\0\0\1\0\0\0\0\0x\2\264w\354\0\0\0\360\0\0\0\334\6\0\0\14\5\0\0\0\0\0\0\0\0\0\0\0\0\0\4\0\0\0\0\260\311\22\0x\1\24\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0`\375\177\0\0\0\0\0\0\25\0\10 \0\0" ) ... {168, 196, reply, 0, 1036, 464, 57982, 0} (24, {168, 196, new_msg, 0, 0, 2147348480, 2008285840, 0} "\0\0\0\0\0\0\1\0\0\0\0\0x\2\264w\357\0\0\0\360\0\0\0\334\6\0\0\14\5\0\0\0\0\0\0\0\0\0\0\0\0\0\4\0\0\0\0\260\311\22\0x\1\24\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0`\375\177\0\0\0\0\0\0\25\0\10 \0\0" ... {168, 196, reply, 0, 1036, 464, 57982, 0} "\0\0\0\0\0\0\1\0\0\0\0\0x\2\264w\354\0\0\0\360\0\0\0\334\6\0\0\14\5\0\0\0\0\0\0\0\0\0\0\0\0\0\4\0\0\0\0\260\311\22\0x\1\24\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0`\375\177\0\0\0\0\0\0\25\0\10 \0\0" ) ) == 0x0 02562 464 NtResumeThread (240, ... 1, ) == 0x0 02563 464 NtClose (228, ... ) == 0x0 02564 464 NtClose (232, ... ) == 0x0 02565 464 NtClose (240, ... ) == 0x0 02566 464 NtWaitForMultipleObjects (2, (216, 236, ), 1, 0, {1294967296, -1}, ... ) == 0x0 02567 464 NtWaitForSingleObject (208, 0, {0, 0}, ... ) == 0x102 02568 464 NtWaitForMultipleObjects (2, (216, 236, ), 1, 0, {1294967296, -1}, ... ) == 0x0 02569 464 NtWaitForSingleObject (208, 0, {0, 0}, ... ) == 0x102 02570 464 NtWaitForMultipleObjects (2, (216, 236, ), 1, 0, {1294967296, -1}, ... ) == 0x0 02571 464 NtWaitForSingleObject (208, 0, {0, 0}, ... ) == 0x102 02572 464 NtWaitForMultipleObjects (2, (216, 236, ), 1, 0, {1294967296, -1}, ... ) == 0x0 02573 464 NtWaitForSingleObject (208, 0, {0, 0}, ... ) == 0x0 02574 464 NtClose (236, ... ) == 0x0 02575 464 NtUnmapViewOfSection (-1, 0xbf0000, ... ) == 0x0 02576 464 NtClose (224, ... ) == 0x0 02577 464 NtClose (208, ... ) == 0x0 02578 464 NtClose (216, ... ) == 0x0 02579 464 NtClose (212, ... ) == 0x0 02580 464 NtClose (220, ... ) == 0x0 02581 464 NtClose (164, ... ) == 0x0 02582 464 NtClose (168, ... ) == 0x0 02583 464 NtSetInformationThread (-2, ZeroTlsCell, {ZeroTlsCell=0x10,}, 4, ... ) == 0x0 02584 464 NtWaitForMultipleObjects (2, (132, 136, ), 1, 0, 0x0, ... ) == 0x1 02585 464 NtClose (136, ... ) == 0x0 02586 464 NtSetEvent (132, ... 0x0, ) == 0x0 02587 464 NtClose (132, ... ) == 0x0 02588 464 NtWaitForMultipleObjects (2, (140, 144, ), 1, 0, 0x0, ... ) == 0x1 02589 464 NtClose (144, ... ) == 0x0 02590 464 NtSetEvent (140, ... 0x0, ) == 0x0 02591 464 NtClose (140, ... ) == 0x0 02592 464 NtWaitForMultipleObjects (2, (148, 152, ), 1, 0, 0x0, ... ) == 0x1 02593 464 NtClose (152, ... ) == 0x0 02594 464 NtSetEvent (148, ... 0x0, ) == 0x0 02595 464 NtClose (148, ... ) == 0x0 02596 464 NtRequestWaitReplyPort (192, {88, 112, new_msg, 0, 1036, 464, 57980, 0} (192, {88, 112, new_msg, 0, 1036, 464, 57980, 0} "\1\356\0\0A\2<\0\30b\202\201\0\260\375\177\220k\364\367\370\37`\300\377\377\377\377X\353Q\200\0\0\0\0)%\25E?>\A\250\245\22\360\331E\16S\331E\16S\1\300\375\177(l\364\367\253\362Q\200\324k\364\367\300\250U\200aFT\200\0\0\0\0h\242\250\201" ... {124, 148, reply, 0, 1036, 464, 58113, 0} "\2\31\221|\1\0\221|\200\300\227|p\31\221|\250$\12\0\330\0\0\0d\365\11\0\0\300\372\177\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\1\0\0\0\0\0\0\0\4\0\0\0\1\365\11\0\1\0\0\0d\365\11\0\0\0\0\0\0\0\0\0\1\0\0\0\10\376\257\0\0\0\0\0\334\377\257\0\30\356\220|p\5\221|\377\377\377\377m\5\221|\344f\347w" ) ... {124, 148, reply, 0, 1036, 464, 58113, 0} (192, {88, 112, new_msg, 0, 1036, 464, 57980, 0} "\1\356\0\0A\2<\0\30b\202\201\0\260\375\177\220k\364\367\370\37`\300\377\377\377\377X\353Q\200\0\0\0\0)%\25E?>\A\250\245\22\360\331E\16S\331E\16S\1\300\375\177(l\364\367\253\362Q\200\324k\364\367\300\250U\200aFT\200\0\0\0\0h\242\250\201" ... {124, 148, reply, 0, 1036, 464, 58113, 0} "\2\31\221|\1\0\221|\200\300\227|p\31\221|\250$\12\0\330\0\0\0d\365\11\0\0\300\372\177\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\1\0\0\0\0\0\0\0\4\0\0\0\1\365\11\0\1\0\0\0d\365\11\0\0\0\0\0\0\0\0\0\1\0\0\0\10\376\257\0\0\0\0\0\334\377\257\0\30\356\220|p\5\221|\377\377\377\377m\5\221|\344f\347w" ) ) == 0x0 02597 464 NtClose (188, ... ) == 0x0 02598 464 NtClose (192, ... ) == 0x0 02599 464 NtClose (128, ... ) == 0x0 02600 464 NtUnmapViewOfSection (-1, 0x69450000, ... ) == 0x0 02601 464 NtUnmapViewOfSection (-1, 0x77920000, ... ) == 0x0 02602 464 NtUnmapViewOfSection (-1, 0x76f50000, ... ) == 0x0 02603 464 NtUnmapViewOfSection (-1, 0x76360000, ... ) == 0x0 02604 464 NtUnmapViewOfSection (-1, 0x5b860000, ... ) == 0x0 02605 464 NtUnmapViewOfSection (-1, 0x769c0000, ... ) == 0x0 02606 464 NtContinue (1239608, 0, ... 02607 464 NtTerminateProcess (0, -1073741680, ... ) == 0x0 02608 464 NtSetInformationThread (-2, ZeroTlsCell, {ZeroTlsCell=0x11,}, 4, ... ) == 0x0 02609 464 NtSetInformationThread (-2, ZeroTlsCell, {ZeroTlsCell=0x12,}, 4, ... ) == 0x0 02610 464 NtSetInformationThread (-2, ZeroTlsCell, {ZeroTlsCell=0x13,}, 4, ... ) == 0x0 02611 464 NtClose (156, ... ) == 0x0 02612 464 NtUserPostThreadMessage (1748, 49315, 0, 464, ... ) == 0x1 02613 464 NtUserPostThreadMessage (416, 49315, 0, 464, ... ) == 0x1 02614 464 NtUserValidateHandleSecure (0, ... ) == 0x0 02615 464 NtUserUnhookWindowsHookEx (721527, ... ) == 0x1 02616 464 NtUserUnhookWindowsHookEx (393695, ... ) == 0x1 02617 464 NtSetInformationThread (-2, ZeroTlsCell, {ZeroTlsCell=0x8,}, 4, ... ) == 0x0 02618 464 NtUnmapViewOfSection (-1, 0xba0000, ... ) == 0x0 02619 464 NtClose (116, ... ) == 0x0 02620 464 NtClose (112, ... ) == 0x0 02621 464 NtClose (92, ... ) == 0x0 02622 464 NtClose (96, ... ) == 0x0 02623 464 NtClose (100, ... ) == 0x0 02624 464 NtClose (104, ... ) == 0x0 02625 464 NtClose (108, ... ) == 0x0 02626 464 NtUnmapViewOfSection (-1, 0xb90000, ... ) == 0x0 02627 464 NtClose (88, ... ) == 0x0 02628 464 NtSetInformationThread (-2, ZeroTlsCell, {ZeroTlsCell=0x7,}, 4, ... ) == 0x0 02629 464 NtUserGetProcessWindowStation (... ) == 0x1c 02630 464 NtUserBuildNameList (28, 522, 1414064, 1244228, ... ) == 0x0 02631 464 NtUserGetProcessWindowStation (... ) == 0x1c 02632 464 NtUserOpenDesktop ({24, 28, 0x40, 0, 0, ({24, 28, 0x40, 0, 0, "Default"}, 1, 0x41, ... ) }, 1, 0x41, ... ) == 0x58 02633 464 NtUserBuildHwndList (88, 0, 0, 0, 64, ... (0x5009e, 0x400fa, 0x10074, 0x10080, 0x10070, 0x10084, 0x30048, 0x10072, 0x20052, 0x5009c, 0x10090, 0x500a2, 0x100d0, 0x200b0, 0x100cc, 0x1800f4, 0xa0102, 0x70104, 0x70100, 0x20118, 0x3014c, 0x1011c, 0x100e6, 0x100d6, 0x100d2, 0x100ca, 0x100c8, 0x100ba, 0x100ae, 0x100ac, 0x300a6, 0x10078, 0x30062, 0x50036, 0x5005c, 0x100be, 0x400fe, 0x10092, 0x10086, 0x40034, 0x50050, 0x1013c, 0x10120, 0x100c2, 0x100bc, 0x90114, 0x2014e, 0x100d8, 0x100b6, 0x100b8, 0x100b4, 0x100c0, 0x1009a, 0x5005e, 0x1, ), 55, ) == 0x0 02634 464 NtUserValidateHandleSecure (327838, ... ) == 0x1 02635 464 NtUserQueryWindow (327838, 0, ... ) == 0x6b8 02636 464 NtUserQueryWindow (327838, 1, ... ) == 0x6d4 02637 464 NtUserValidateHandleSecure (327838, ... ) == 0x1 02638 464 NtUserValidateHandleSecure (262394, ... ) == 0x1 02639 464 NtUserQueryWindow (262394, 0, ... ) == 0x6b8 02640 464 NtUserQueryWindow (262394, 1, ... ) == 0x6d4 02641 464 NtUserValidateHandleSecure (262394, ... ) == 0x1 02642 464 NtUserBuildHwndList (0, 262394, 1, 0, 64, ... (0x80064, 0x60068, 0x6006c, 0x50094, 0x50096, 0x60066, 0x7006a, 0x90058, 0x6006e, 0x5008a, 0x50088, 0x500a0, 0x1, ), 13, ) == 0x0 02643 464 NtUserValidateHandleSecure (524388, ... ) == 0x1 02644 464 NtUserQueryWindow (524388, 0, ... ) == 0x6b8 02645 464 NtUserQueryWindow (524388, 1, ... ) == 0x6d4 02646 464 NtUserValidateHandleSecure (393320, ... ) == 0x1 02647 464 NtUserQueryWindow (393320, 0, ... ) == 0x6b8 02648 464 NtUserQueryWindow (393320, 1, ... ) == 0x6d4 02649 464 NtUserValidateHandleSecure (393324, ... ) == 0x1 02650 464 NtUserQueryWindow (393324, 0, ... ) == 0x6b8 02651 464 NtUserQueryWindow (393324, 1, ... ) == 0x6d4 02652 464 NtUserValidateHandleSecure (327828, ... ) == 0x1 02653 464 NtUserQueryWindow (327828, 0, ... ) == 0x6b8 02654 464 NtUserQueryWindow (327828, 1, ... ) == 0x6d4 02655 464 NtUserValidateHandleSecure (327830, ... ) == 0x1 02656 464 NtUserQueryWindow (327830, 0, ... ) == 0x6b8 02657 464 NtUserQueryWindow (327830, 1, ... ) == 0x6d4 02658 464 NtUserValidateHandleSecure (393318, ... ) == 0x1 02659 464 NtUserQueryWindow (393318, 0, ... ) == 0x6b8 02660 464 NtUserQueryWindow (393318, 1, ... ) == 0x6d4 02661 464 NtUserValidateHandleSecure (458858, ... ) == 0x1 02662 464 NtUserQueryWindow (458858, 0, ... ) == 0x6b8 02663 464 NtUserQueryWindow (458858, 1, ... ) == 0x6d4 02664 464 NtUserValidateHandleSecure (589912, ... ) == 0x1 02665 464 NtUserQueryWindow (589912, 0, ... ) == 0x6b8 02666 464 NtUserQueryWindow (589912, 1, ... ) == 0x6d4 02667 464 NtUserValidateHandleSecure (393326, ... ) == 0x1 02668 464 NtUserQueryWindow (393326, 0, ... ) == 0x6b8 02669 464 NtUserQueryWindow (393326, 1, ... ) == 0x6d4 02670 464 NtUserValidateHandleSecure (327818, ... ) == 0x1 02671 464 NtUserQueryWindow (327818, 0, ... ) == 0x6b8 02672 464 NtUserQueryWindow (327818, 1, ... ) == 0x6d4 02673 464 NtUserValidateHandleSecure (327816, ... ) == 0x1 02674 464 NtUserQueryWindow (327816, 0, ... ) == 0x6b8 02675 464 NtUserQueryWindow (327816, 1, ... ) == 0x6d4 02676 464 NtUserValidateHandleSecure (327840, ... ) == 0x1 02677 464 NtUserQueryWindow (327840, 0, ... ) == 0x6b8 02678 464 NtUserQueryWindow (327840, 1, ... ) == 0x6d4 02679 464 NtUserValidateHandleSecure (65652, ... ) == 0x1 02680 464 NtUserQueryWindow (65652, 0, ... ) == 0x6b8 02681 464 NtUserQueryWindow (65652, 1, ... ) == 0x6d4 02682 464 NtUserValidateHandleSecure (65652, ... ) == 0x1 02683 464 NtUserValidateHandleSecure (65664, ... ) == 0x1 02684 464 NtUserQueryWindow (65664, 0, ... ) == 0x6b8 02685 464 NtUserQueryWindow (65664, 1, ... ) == 0x6d4 02686 464 NtUserValidateHandleSecure (65664, ... ) == 0x1 02687 464 NtUserValidateHandleSecure (65648, ... ) == 0x1 02688 464 NtUserQueryWindow (65648, 0, ... ) == 0x6b8 02689 464 NtUserQueryWindow (65648, 1, ... ) == 0x6d4 02690 464 NtUserValidateHandleSecure (65648, ... ) == 0x1 02691 464 NtUserValidateHandleSecure (65668, ... ) == 0x1 02692 464 NtUserQueryWindow (65668, 0, ... ) == 0x6b8 02693 464 NtUserQueryWindow (65668, 1, ... ) == 0x6d4 02694 464 NtUserValidateHandleSecure (65668, ... ) == 0x1 02695 464 NtUserValidateHandleSecure (196680, ... ) == 0x1 02696 464 NtUserQueryWindow (196680, 0, ... ) == 0x6b8 02697 464 NtUserQueryWindow (196680, 1, ... ) == 0x6d4 02698 464 NtUserValidateHandleSecure (196680, ... ) == 0x1 02699 464 NtUserValidateHandleSecure (65650, ... ) == 0x1 02700 464 NtUserQueryWindow (65650, 0, ... ) == 0x6b8 02701 464 NtUserQueryWindow (65650, 1, ... ) == 0x6d4 02702 464 NtUserValidateHandleSecure (65650, ... ) == 0x1 02703 464 NtUserValidateHandleSecure (131154, ... ) == 0x1 02704 464 NtUserQueryWindow (131154, 0, ... ) == 0x6b8 02705 464 NtUserQueryWindow (131154, 1, ... ) == 0x6d4 02706 464 NtUserValidateHandleSecure (131154, ... ) == 0x1 02707 464 NtUserBuildHwndList (0, 131154, 1, 0, 64, ... (0x3003e, 0x3003c, 0x30040, 0x30042, 0x30044, 0x30046, 0x10076, 0x10082, 0x1007a, 0x1007e, 0x1, ), 11, ) == 0x0 02708 464 NtUserValidateHandleSecure (196670, ... ) == 0x1 02709 464 NtUserQueryWindow (196670, 0, ... ) == 0x6b8 02710 464 NtUserQueryWindow (196670, 1, ... ) == 0x6d4 02711 464 NtUserValidateHandleSecure (196668, ... ) == 0x1 02712 464 NtUserQueryWindow (196668, 0, ... ) == 0x6b8 02713 464 NtUserQueryWindow (196668, 1, ... ) == 0x6d4 02714 464 NtUserValidateHandleSecure (196672, ... ) == 0x1 02715 464 NtUserQueryWindow (196672, 0, ... ) == 0x6b8 02716 464 NtUserQueryWindow (196672, 1, ... ) == 0x6d4 02717 464 NtUserValidateHandleSecure (196674, ... ) == 0x1 02718 464 NtUserQueryWindow (196674, 0, ... ) == 0x6b8 02719 464 NtUserQueryWindow (196674, 1, ... ) == 0x6d4 02720 464 NtUserValidateHandleSecure (196676, ... ) == 0x1 02721 464 NtUserQueryWindow (196676, 0, ... ) == 0x6b8 02722 464 NtUserQueryWindow (196676, 1, ... ) == 0x6d4 02723 464 NtUserValidateHandleSecure (196678, ... ) == 0x1 02724 464 NtUserQueryWindow (196678, 0, ... ) == 0x6b8 02725 464 NtUserQueryWindow (196678, 1, ... ) == 0x6d4 02726 464 NtUserValidateHandleSecure (65654, ... ) == 0x1 02727 464 NtUserQueryWindow (65654, 0, ... ) == 0x6b8 02728 464 NtUserQueryWindow (65654, 1, ... ) == 0x6d4 02729 464 NtUserValidateHandleSecure (65666, ... ) == 0x1 02730 464 NtUserQueryWindow (65666, 0, ... ) == 0x6b8 02731 464 NtUserQueryWindow (65666, 1, ... ) == 0x6d4 02732 464 NtUserValidateHandleSecure (65658, ... ) == 0x1 02733 464 NtUserQueryWindow (65658, 0, ... ) == 0x6b8 02734 464 NtUserQueryWindow (65658, 1, ... ) == 0x6d4 02735 464 NtUserValidateHandleSecure (65662, ... ) == 0x1 02736 464 NtUserQueryWindow (65662, 0, ... ) == 0x6b8 02737 464 NtUserQueryWindow (65662, 1, ... ) == 0x6d4 02738 464 NtUserValidateHandleSecure (327836, ... ) == 0x1 02739 464 NtUserQueryWindow (327836, 0, ... ) == 0x6b8 02740 464 NtUserQueryWindow (327836, 1, ... ) == 0x6d4 02741 464 NtUserValidateHandleSecure (327836, ... ) == 0x1 02742 464 NtUserValidateHandleSecure (65680, ... ) == 0x1 02743 464 NtUserQueryWindow (65680, 0, ... ) == 0x6b8 02744 464 NtUserQueryWindow (65680, 1, ... ) == 0x6bc 02745 464 NtUserValidateHandleSecure (65680, ... ) == 0x1 02746 464 NtUserValidateHandleSecure (327842, ... ) == 0x1 02747 464 NtUserQueryWindow (327842, 0, ... ) == 0x6b8 02748 464 NtUserQueryWindow (327842, 1, ... ) == 0x6d4 02749 464 NtUserValidateHandleSecure (327842, ... ) == 0x1 02750 464 NtUserValidateHandleSecure (65744, ... ) == 0x1 02751 464 NtUserQueryWindow (65744, 0, ... ) == 0x19c 02752 464 NtUserQueryWindow (65744, 1, ... ) == 0x1a0 02753 464 NtUserValidateHandleSecure (65744, ... ) == 0x1 02754 464 NtUserValidateHandleSecure (131248, ... ) == 0x1 02755 464 NtUserQueryWindow (131248, 0, ... ) == 0xa0 02756 464 NtUserQueryWindow (131248, 1, ... ) == 0xe4 02757 464 NtUserValidateHandleSecure (131248, ... ) == 0x1 02758 464 NtUserValidateHandleSecure (65740, ... ) == 0x1 02759 464 NtUserQueryWindow (65740, 0, ... ) == 0x19c 02760 464 NtUserQueryWindow (65740, 1, ... ) == 0x1a0 02761 464 NtUserValidateHandleSecure (65740, ... ) == 0x1 02762 464 NtUserValidateHandleSecure (1573108, ... ) == 0x1 02763 464 NtUserQueryWindow (1573108, 0, ... ) == 0x6dc 02764 464 NtUserQueryWindow (1573108, 1, ... ) == 0x50c 02765 464 NtUserValidateHandleSecure (1573108, ... ) == 0x1 02766 464 NtUserRemoveProp (655618, 43282, ... ) == 0x0 02767 464 NtUserValidateHandleSecure (459012, ... ) == 0x1 02768 464 NtUserQueryWindow (459012, 0, ... ) == 0x49c 02769 464 NtUserQueryWindow (459012, 1, ... ) == 0x180 02770 464 NtUserValidateHandleSecure (459012, ... ) == 0x1 02771 464 NtUserValidateHandleSecure (459008, ... ) == 0x1 02772 464 NtUserQueryWindow (459008, 0, ... ) == 0x5e8 02773 464 NtUserQueryWindow (459008, 1, ... ) == 0x1dc 02774 464 NtUserValidateHandleSecure (459008, ... ) == 0x1 02775 464 NtUserValidateHandleSecure (131352, ... ) == 0x1 02776 464 NtUserQueryWindow (131352, 0, ... ) == 0x6ac 02777 464 NtUserQueryWindow (131352, 1, ... ) == 0x7f4 02778 464 NtUserValidateHandleSecure (131352, ... ) == 0x1 02779 464 NtUserValidateHandleSecure (196940, ... ) == 0x1 02780 464 NtUserQueryWindow (196940, 0, ... ) == 0x4b4 02781 464 NtUserQueryWindow (196940, 1, ... ) == 0x474 02782 464 NtUserValidateHandleSecure (196940, ... ) == 0x1 02783 464 NtUserValidateHandleSecure (65820, ... ) == 0x1 02784 464 NtUserQueryWindow (65820, 0, ... ) == 0x22c 02785 464 NtUserQueryWindow (65820, 1, ... ) == 0x220 02786 464 NtUserValidateHandleSecure (65820, ... ) == 0x1 02787 464 NtUserValidateHandleSecure (65766, ... ) == 0x1 02788 464 NtUserQueryWindow (65766, 0, ... ) == 0x6b8 02789 464 NtUserQueryWindow (65766, 1, ... ) == 0x13c 02790 464 NtUserValidateHandleSecure (65766, ... ) == 0x1 02791 464 NtUserValidateHandleSecure (65750, ... ) == 0x1 02792 464 NtUserQueryWindow (65750, 0, ... ) == 0x6b8 02793 464 NtUserQueryWindow (65750, 1, ... ) == 0x13c 02794 464 NtUserValidateHandleSecure (65750, ... ) == 0x1 02795 464 NtUserBuildHwndList (0, 65750, 1, 0, 64, ... (0x100da, 0x100dc, 0x100de, 0x100e0, 0x1, ), 5, ) == 0x0 02796 464 NtUserValidateHandleSecure (65754, ... ) == 0x1 02797 464 NtUserQueryWindow (65754, 0, ... ) == 0x6b8 02798 464 NtUserQueryWindow (65754, 1, ... ) == 0x13c 02799 464 NtUserValidateHandleSecure (65756, ... ) == 0x1 02800 464 NtUserQueryWindow (65756, 0, ... ) == 0x6b8 02801 464 NtUserQueryWindow (65756, 1, ... ) == 0x13c 02802 464 NtUserValidateHandleSecure (65758, ... ) == 0x1 02803 464 NtUserQueryWindow (65758, 0, ... ) == 0x6b8 02804 464 NtUserQueryWindow (65758, 1, ... ) == 0x13c 02805 464 NtUserValidateHandleSecure (65760, ... ) == 0x1 02806 464 NtUserQueryWindow (65760, 0, ... ) == 0x6b8 02807 464 NtUserQueryWindow (65760, 1, ... ) == 0x13c 02808 464 NtUserValidateHandleSecure (65746, ... ) == 0x1 02809 464 NtUserQueryWindow (65746, 0, ... ) == 0x6b8 02810 464 NtUserQueryWindow (65746, 1, ... ) == 0x6d4 02811 464 NtUserValidateHandleSecure (65746, ... ) == 0x1 02812 464 NtUserValidateHandleSecure (65738, ... ) == 0x1 02813 464 NtUserQueryWindow (65738, 0, ... ) == 0x19c 02814 464 NtUserQueryWindow (65738, 1, ... ) == 0x1a0 02815 464 NtUserValidateHandleSecure (65738, ... ) == 0x1 02816 464 NtUserValidateHandleSecure (65736, ... ) == 0x1 02817 464 NtUserQueryWindow (65736, 0, ... ) == 0xa0 02818 464 NtUserQueryWindow (65736, 1, ... ) == 0xe4 02819 464 NtUserValidateHandleSecure (65736, ... ) == 0x1 02820 464 NtUserValidateHandleSecure (65722, ... ) == 0x1 02821 464 NtUserQueryWindow (65722, 0, ... ) == 0x104 02822 464 NtUserQueryWindow (65722, 1, ... ) == 0x108 02823 464 NtUserValidateHandleSecure (65722, ... ) == 0x1 02824 464 NtUserValidateHandleSecure (65710, ... ) == 0x1 02825 464 NtUserQueryWindow (65710, 0, ... ) == 0x104 02826 464 NtUserQueryWindow (65710, 1, ... ) == 0x108 02827 464 NtUserValidateHandleSecure (65710, ... ) == 0x1 02828 464 NtUserValidateHandleSecure (65708, ... ) == 0x1 02829 464 NtUserQueryWindow (65708, 0, ... ) == 0x120 02830 464 NtUserQueryWindow (65708, 1, ... ) == 0x124 02831 464 NtUserValidateHandleSecure (65708, ... ) == 0x1 02832 464 NtUserValidateHandleSecure (196774, ... ) == 0x1 02833 464 NtUserQueryWindow (196774, 0, ... ) == 0xc4 02834 464 NtUserQueryWindow (196774, 1, ... ) == 0xc8 02835 464 NtUserValidateHandleSecure (196774, ... ) == 0x1 02836 464 NtUserValidateHandleSecure (65656, ... ) == 0x1 02837 464 NtUserQueryWindow (65656, 0, ... ) == 0x6b8 02838 464 NtUserQueryWindow (65656, 1, ... ) == 0x6ec 02839 464 NtUserValidateHandleSecure (65656, ... ) == 0x1 02840 464 NtUserValidateHandleSecure (196706, ... ) == 0x1 02841 464 NtUserQueryWindow (196706, 0, ... ) == 0x6b8 02842 464 NtUserQueryWindow (196706, 1, ... ) == 0x6bc 02843 464 NtUserValidateHandleSecure (196706, ... ) == 0x1 02844 464 NtUserValidateHandleSecure (327734, ... ) == 0x1 02845 464 NtUserQueryWindow (327734, 0, ... ) == 0x6b8 02846 464 NtUserQueryWindow (327734, 1, ... ) == 0x6bc 02847 464 NtUserValidateHandleSecure (327734, ... ) == 0x1 02848 464 NtUserValidateHandleSecure (327772, ... ) == 0x1 02849 464 NtUserQueryWindow (327772, 0, ... ) == 0x6b8 02850 464 NtUserQueryWindow (327772, 1, ... ) == 0x6bc 02851 464 NtUserValidateHandleSecure (327772, ... ) == 0x1 02852 464 NtUserValidateHandleSecure (65726, ... ) == 0x1 02853 464 NtUserQueryWindow (65726, 0, ... ) == 0x19c 02854 464 NtUserQueryWindow (65726, 1, ... ) == 0x1a0 02855 464 NtUserValidateHandleSecure (65726, ... ) == 0x1 02856 464 NtUserValidateHandleSecure (262398, ... ) == 0x1 02857 464 NtUserQueryWindow (262398, 0, ... ) == 0x6b8 02858 464 NtUserQueryWindow (262398, 1, ... ) == 0x6d4 02859 464 NtUserValidateHandleSecure (262398, ... ) == 0x1 02860 464 NtUserValidateHandleSecure (65682, ... ) == 0x1 02861 464 NtUserQueryWindow (65682, 0, ... ) == 0x6b8 02862 464 NtUserQueryWindow (65682, 1, ... ) == 0x6bc 02863 464 NtUserValidateHandleSecure (65682, ... ) == 0x1 02864 464 NtUserValidateHandleSecure (65670, ... ) == 0x1 02865 464 NtUserQueryWindow (65670, 0, ... ) == 0x6b8 02866 464 NtUserQueryWindow (65670, 1, ... ) == 0x6bc 02867 464 NtUserValidateHandleSecure (65670, ... ) == 0x1 02868 464 NtUserBuildHwndList (0, 65670, 1, 0, 64, ... (0x1008c, 0x1008e, 0x1, ), 3, ) == 0x0 02869 464 NtUserValidateHandleSecure (65676, ... ) == 0x1 02870 464 NtUserQueryWindow (65676, 0, ... ) == 0x6b8 02871 464 NtUserQueryWindow (65676, 1, ... ) == 0x6bc 02872 464 NtUserValidateHandleSecure (65678, ... ) == 0x1 02873 464 NtUserQueryWindow (65678, 0, ... ) == 0x6b8 02874 464 NtUserQueryWindow (65678, 1, ... ) == 0x6bc 02875 464 NtUserValidateHandleSecure (262196, ... ) == 0x1 02876 464 NtUserQueryWindow (262196, 0, ... ) == 0x6b8 02877 464 NtUserQueryWindow (262196, 1, ... ) == 0x6d4 02878 464 NtUserValidateHandleSecure (262196, ... ) == 0x1 02879 464 NtUserValidateHandleSecure (327760, ... ) == 0x1 02880 464 NtUserQueryWindow (327760, 0, ... ) == 0x6b8 02881 464 NtUserQueryWindow (327760, 1, ... ) == 0x6d4 02882 464 NtUserValidateHandleSecure (327760, ... ) == 0x1 02883 464 NtUserValidateHandleSecure (65852, ... ) == 0x1 02884 464 NtUserQueryWindow (65852, 0, ... ) == 0x22c 02885 464 NtUserQueryWindow (65852, 1, ... ) == 0x220 02886 464 NtUserValidateHandleSecure (65852, ... ) == 0x1 02887 464 NtUserValidateHandleSecure (65824, ... ) == 0x1 02888 464 NtUserQueryWindow (65824, 0, ... ) == 0x22c 02889 464 NtUserQueryWindow (65824, 1, ... ) == 0x220 02890 464 NtUserValidateHandleSecure (65824, ... ) == 0x1 02891 464 NtUserValidateHandleSecure (65730, ... ) == 0x1 02892 464 NtUserQueryWindow (65730, 0, ... ) == 0xa0 02893 464 NtUserQueryWindow (65730, 1, ... ) == 0xe4 02894 464 NtUserValidateHandleSecure (65730, ... ) == 0x1 02895 464 NtUserValidateHandleSecure (65724, ... ) == 0x1 02896 464 NtUserQueryWindow (65724, 0, ... ) == 0xa0 02897 464 NtUserQueryWindow (65724, 1, ... ) == 0xe4 02898 464 NtUserValidateHandleSecure (65724, ... ) == 0x1 02899 464 NtUserValidateHandleSecure (590100, ... ) == 0x1 02900 464 NtUserValidateHandleSecure (590100, ... ) == 0x1 02901 464 NtUserValidateHandleSecure (590100, ... ) == 0x1 02902 464 NtUserRemoveProp (590100, 43288, ... ) == 0xffffffff 02903 464 NtUserRemoveProp (590100, 43282, ... ) == 0x0 02904 464 NtUserValidateHandleSecure (590100, ... ) == 0x1 02905 464 NtUserValidateHandleSecure (590100, ... ) == 0x1 02906 464 NtUserValidateHandleSecure (131406, ... ) == 0x1 02907 464 NtUserQueryWindow (131406, 0, ... ) == 0x4b4 02908 464 NtUserQueryWindow (131406, 1, ... ) == 0x474 02909 464 NtUserValidateHandleSecure (131406, ... ) == 0x1 02910 464 NtUserValidateHandleSecure (65752, ... ) == 0x1 02911 464 NtUserQueryWindow (65752, 0, ... ) == 0x6b8 02912 464 NtUserQueryWindow (65752, 1, ... ) == 0x13c 02913 464 NtUserValidateHandleSecure (65752, ... ) == 0x1 02914 464 NtUserValidateHandleSecure (65718, ... ) == 0x1 02915 464 NtUserQueryWindow (65718, 0, ... ) == 0x104 02916 464 NtUserQueryWindow (65718, 1, ... ) == 0x108 02917 464 NtUserValidateHandleSecure (65718, ... ) == 0x1 02918 464 NtUserValidateHandleSecure (65720, ... ) == 0x1 02919 464 NtUserQueryWindow (65720, 0, ... ) == 0x120 02920 464 NtUserQueryWindow (65720, 1, ... ) == 0x124 02921 464 NtUserValidateHandleSecure (65720, ... ) == 0x1 02922 464 NtUserValidateHandleSecure (65716, ... ) == 0x1 02923 464 NtUserQueryWindow (65716, 0, ... ) == 0xc4 02924 464 NtUserQueryWindow (65716, 1, ... ) == 0xc8 02925 464 NtUserValidateHandleSecure (65716, ... ) == 0x1 02926 464 NtUserValidateHandleSecure (65728, ... ) == 0x1 02927 464 NtUserQueryWindow (65728, 0, ... ) == 0x19c 02928 464 NtUserQueryWindow (65728, 1, ... ) == 0x1a0 02929 464 NtUserValidateHandleSecure (65728, ... ) == 0x1 02930 464 NtUserValidateHandleSecure (65690, ... ) == 0x1 02931 464 NtUserQueryWindow (65690, 0, ... ) == 0x6b8 02932 464 NtUserQueryWindow (65690, 1, ... ) == 0x6bc 02933 464 NtUserValidateHandleSecure (65690, ... ) == 0x1 02934 464 NtUserValidateHandleSecure (327774, ... ) == 0x1 02935 464 NtUserQueryWindow (327774, 0, ... ) == 0x6b8 02936 464 NtUserQueryWindow (327774, 1, ... ) == 0x6bc 02937 464 NtUserValidateHandleSecure (327774, ... ) == 0x1 02938 464 NtUserCloseDesktop (88, ... ) == 0x1 02939 464 NtUserGetProcessWindowStation (... ) == 0x1c 02940 464 NtUserOpenDesktop ({24, 28, 0x40, 0, 0, ({24, 28, 0x40, 0, 0, "Disconnect"}, 1, 0x41, ... ) }, 1, 0x41, ... ) == 0x0 02941 464 NtUserGetProcessWindowStation (... ) == 0x1c 02942 464 NtUserOpenDesktop ({24, 28, 0x40, 0, 0, ({24, 28, 0x40, 0, 0, "Winlogon"}, 1, 0x41, ... ) }, 1, 0x41, ... ) == 0x0 02943 464 NtGdiDeleteObjectApp (856294625, ... ) == 0x1 02944 464 NtGdiDeleteObjectApp (1376388660, ... ) == 0x1 02945 464 NtUnmapViewOfSection (-1, 0x360000, ... ) == 0x0 02946 464 NtClose (60, ... ) == 0x0 02947 464 NtClose (52, ... ) == 0x0 02948 464 NtSetInformationThread (-2, ZeroTlsCell, {ZeroTlsCell=0x6,}, 4, ... ) == 0x0 02949 464 NtSetInformationThread (-2, ZeroTlsCell, {ZeroTlsCell=0x4,}, 4, ... ) == 0x0 02950 464 NtSetInformationThread (-2, ZeroTlsCell, {ZeroTlsCell=0x3,}, 4, ... ) == 0x0 02951 464 NtOpenKey (0x20019, {24, 0, 0x40, 0, 0, (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\GRE_Initialize"}, ... 52, ) }, ... 52, ) == 0x0 02952 464 NtQueryValueKey (52, (52, "DisableMetaFiles", Partial, 20, ... ) , Partial, 20, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 02953 464 NtClose (52, ... ) == 0x0 02954 464 NtClose (44, ... ) == 0x0 02955 464 NtFreeVirtualMemory (-1, (0xc00000), 4096, 32768, ... (0xc00000), 4096, ) == 0x0 02956 464 NtQueryInformationProcess (-1, 36, 4, ... {process info, class 36, size 4}, 0x0, ) == 0x0 02957 464 NtQueryInformationProcess (-1, 36, 4, ... {process info, class 36, size 4}, 0x0, ) == 0x0 02958 464 NtQueryVirtualMemory (-1, 0x77c2807c, Basic, 28, ... {BaseAddress=0x77c28000,AllocationBase=0x77c10000,AllocationProtect=0x80,RegionSize=0x35000,State=0x1000,Protect=0x20,Type=0x1000000,}, 28, ) == 0x0 02959 464 NtRequestWaitReplyPort (24, {20, 48, new_msg, 0, 2011664592, 1178048, 1178452, 1178016} (24, {20, 48, new_msg, 0, 2011664592, 1178048, 1178452, 1178016} "\0\0\0\0\3\0\1\0X\35\336w\234\375\21\0\220\0\0\300" ... {20, 48, reply, 0, 1036, 464, 58116, 0} "\0\0\0\0\3\0\1\0\0\0\0\0\234\375\21\0\220\0\0\300" ) ... {20, 48, reply, 0, 1036, 464, 58116, 0} (24, {20, 48, new_msg, 0, 2011664592, 1178048, 1178452, 1178016} "\0\0\0\0\3\0\1\0X\35\336w\234\375\21\0\220\0\0\300" ... {20, 48, reply, 0, 1036, 464, 58116, 0} "\0\0\0\0\3\0\1\0\0\0\0\0\234\375\21\0\220\0\0\300" ) ) == 0x0 02960 464 NtTerminateProcess (-1, -1073741680, ...