Summary:


NtAdjustPrivilegesToken(>) 
 1 
NtGdiExtGetObjectW(>) 
 2 
NtQueryInformationJobObject(>) 
 6 
NtUserCallOneParam(>) 
 26 

NtCallbackReturn(>) 
 1 
NtNotifyChangeKey(>) 
 2 
NtReadVirtualMemory(>) 
 6 
NtWaitForSingleObject(>) 
 26 

NtCreateSemaphore(>) 
 1 
NtQueryKey(>) 
 2 
NtSetEvent(>) 
 6 
NtOpenProcess(>) 
 29 

NtDelayExecution(>) 
 1 
NtUserCallHwndParam(>) 
 2 
NtUserCloseWindowStation(>) 
 6 
NtQueryInformationFile(>) 
 31 

NtGdiCreateBitmap(>) 
 1 
NtUserGetClassName(>) 
 2 
NtDuplicateObject(>) 
 7 
NtQuerySection(>) 
 31 

NtGdiCreatePatternBrushInternal(>) 
 1 
NtUserModifyUserStartupInfoFlags(>) 
 2 
NtOpenSymbolicLinkObject(>) 
 7 
NtRequestWaitReplyPort(>) 
 33 

NtGdiCreateRectRgn(>) 
 1 
NtUserRemoveProp(>) 
 2 
NtQuerySymbolicLinkObject(>) 
 7 
NtQueryDebugFilterState(>) 
 34 

NtGdiExcludeClipRect(>) 
 1 
NtUserSetWindowsHookEx(>) 
 2 
NtReadFile(>) 
 7 
NtCreateEvent(>) 
 36 

NtGdiInit(>) 
 1 
NtYieldExecution(>) 
 2 
NtUserCreateWindowEx(>) 
 7 
NtWriteFile(>) 
 37 

NtGdiQueryFontAssocInfo(>) 
 1 
NtCreateThread(>) 
 3 
NtUserGetObjectInformation(>) 
 7 
NtOpenProcessTokenEx(>) 
 47 

NtGdiSelectBitmap(>) 
 1 
NtGdiDeleteObjectApp(>) 
 3 
NtEnumerateKey(>) 
 8 
NtOpenThreadTokenEx(>) 
 47 

NtOpenEvent(>) 
 1 
NtGdiGetTextMetricsW(>) 
 3 
NtSetValueKey(>) 
 8 
NtQueryVirtualMemory(>) 
 51 

NtOpenKeyedEvent(>) 
 1 
NtGdiGetWidthTable(>) 
 3 
NtUserGetDC(>) 
 8 
NtSetInformationFile(>) 
 57 

NtOpenMutant(>) 
 1 
NtResumeThread(>) 
 3 
NtUserQueryWindow(>) 
 8 
NtQueryInformationToken(>) 
 64 

NtQueryInstallUILanguage(>) 
 1 
NtSetInformationObject(>) 
 3 
NtUserCallNoParam(>) 
 9 
NtOpenSection(>) 
 68 

NtQueryObject(>) 
 1 
NtUserGetDCEx(>) 
 3 
NtUserSystemParametersInfo(>) 
 9 
NtQueryDirectoryFile(>) 
 69 

NtQuerySystemTime(>) 
 1 
NtUserOpenWindowStation(>) 
 3 
NtFreeVirtualMemory(>) 
 11 
NtAllocateVirtualMemory(>) 
 71 

NtRegisterThreadTerminatePort(>) 
 1 
NtConnectPort(>) 
 4 
NtQueryVolumeInformationFile(>) 
 12 
NtCreateFile(>) 
 73 

NtSecureConnectPort(>) 
 1 
NtGdiGetTextCharsetInfo(>) 
 4 
NtOpenProcessToken(>) 
 13 
NtQuerySystemInformation(>) 
 80 

NtTestAlert(>) 
 1 
NtGdiHfontCreate(>) 
 4 
NtUserGetWindowDC(>) 
 13 
NtSetInformationProcess(>) 
 98 

NtUserCalcMenuBar(>) 
 1 
NtQueryPerformanceCounter(>) 
 4 
NtUserRegisterWindowMessage(>) 
 13 
NtCreateSection(>) 
 117 

NtUserCallHwnd(>) 
 1 
NtUserGetAtomName(>) 
 4 
NtWaitForMultipleObjects(>) 
 13 
NtQueryInformationProcess(>) 
 123 

NtUserCallHwndLock(>) 
 1 
NtUserGetProcessWindowStation(>) 
 4 
NtUserFindExistingCursorIcon(>) 
 14 
NtQueryDefaultLocale(>) 
 134 

NtUserGetGUIThreadInfo(>) 
 1 
NtUserGetThreadDesktop(>) 
 4 
NtUserRegisterClassExWOW(>) 
 15 
NtWriteVirtualMemory(>) 
 134 

NtUserGetImeInfoEx(>) 
 1 
NtUserSetCursor(>) 
 4 
NtContinue(>) 
 16 
NtOpenFile(>) 
 156 

NtUserGetTitleBarInfo(>) 
 1 
NtUserSetProp(>) 
 4 
NtDeviceIoControlFile(>) 
 16 
NtFlushInstructionCache(>) 
 177 

NtUserInternalGetWindowText(>) 
 1 
NtUserSetWindowLong(>) 
 4 
NtQueryDefaultUILanguage(>) 
 16 
NtQueryAttributesFile(>) 
 195 

NtUserPostThreadMessage(>) 
 1 
NtGdiCreateCompatibleDC(>) 
 5 
NtCreateKey(>) 
 17 
NtUnmapViewOfSection(>) 
 218 

NtUserSetFocus(>) 
 1 
NtGdiExtSelectClipRgn(>) 
 5 
NtReleaseMutant(>) 
 17 
NtMapViewOfSection(>) 
 284 

NtUserUpdateInputContext(>) 
 1 
NtGdiGetRandomRgn(>) 
 5 
NtCreateMutant(>) 
 18 
NtOpenKey(>) 
 328 

NtAccessCheck(>) 
 2 
NtGdiGetStockObject(>) 
 5 
NtUserValidateHandleSecure(>) 
 19 
NtQueryValueKey(>) 
 344 

NtCreateIoCompletion(>) 
 2 
NtGdiIntersectClipRect(>) 
 5 
NtSetInformationThread(>) 
 20 
NtProtectVirtualMemory(>) 
 481 

NtCreateProcessEx(>) 
 2 
NtOpenDirectoryObject(>) 
 5 
NtUserMessageCall(>) 
 20 
NtClose(>) 
 716 

NtDuplicateToken(>) 
 2 
NtUserGetForegroundWindow(>) 
 5 
NtFsControlFile(>) 
 22 

NtGdiCreateSolidBrush(>) 
 2 
NtUserSetWindowFNID(>) 
 5 

Trace:
 00001   860   NtOpenFile  (0x80100000, {24, 0, 0x240, 0, 0,  (0x80100000, {24, 0, 0x240, 0, 0, "\SystemRoot\Prefetch\PACKED.EXE-09ED06A1.pf"}, 0, 32, ... ) }, 0, 32, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00002   860   NtOpenKey  (0x80000000, {24, 0, 0x40, 0, 0,  (0x80000000, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\packed.exe"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00003   860   NtOpenKeyedEvent  (0x2000000, {24, 0, 0x0, 0, 0,  (0x2000000, {24, 0, 0x0, 0, 0, "\KernelObjects\CritSecOutOfMemoryEvent"}, ... 4, ) }, ... 4, ) == 0x0
 00004   860   NtQuerySystemInformation  (Basic, 44, ... {Unknown=0,MaximumIncrement=156250,PhysicalPageSize=0x1000,NumberOfPhysicalPages=0xff7c,LowestPhysicalPage=0x1,HighestPhysicalPage=0xffff,AllocationGranularity=0x10000,LowestUserAddress=0x10000,HighestUserAddress=0x7ffeffff,ActiveProcessors=1,NumberProcessors=1,}, 0x0, ) == 0x0
 00005   860   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ... 1310720, 1048576, ) == 0x0
 00006   860   NtAllocateVirtualMemory  (-1, 1310720, 0, 4096, 4096, 4, ... 1310720, 4096, ) == 0x0
 00007   860   NtAllocateVirtualMemory  (-1, 1314816, 0, 8192, 4096, 4, ... 1314816, 8192, ) == 0x0
 00008   860   NtQuerySystemInformation  (Basic, 44, ... {Unknown=0,MaximumIncrement=156250,PhysicalPageSize=0x1000,NumberOfPhysicalPages=0xff7c,LowestPhysicalPage=0x1,HighestPhysicalPage=0xffff,AllocationGranularity=0x10000,LowestUserAddress=0x10000,HighestUserAddress=0x7ffeffff,ActiveProcessors=1,NumberProcessors=1,}, 0x0, ) == 0x0
 00009   860   NtAllocateVirtualMemory  (-1, 0, 0, 65536, 8192, 4, ... 2359296, 65536, ) == 0x0
 00010   860   NtAllocateVirtualMemory  (-1, 2359296, 0, 24576, 4096, 4, ... 2359296, 24576, ) == 0x0
 00011   860   NtOpenDirectoryObject  (0x3, {24, 0, 0x40, 0, 0,  (0x3, {24, 0, 0x40, 0, 0, "\KnownDlls"}, ... 8, ) }, ... 8, ) == 0x0
 00012   860   NtOpenSymbolicLinkObject  (0x1, {24, 8, 0x40, 0, 0,  (0x1, {24, 8, 0x40, 0, 0, "KnownDllPath"}, ... 12, ) }, ... 12, ) == 0x0
 00013   860   NtQuerySymbolicLinkObject  (12, ...  (12, ... "C:\WINDOWS\system32", 0x0, ) , 0x0, ) == 0x0
 00014   860   NtClose  (12, ... ) == 0x0
 00015   860   NtOpenFile  (0x100020, {24, 0, 0x42, 0, 0,  (0x100020, {24, 0, 0x42, 0, 0, "\??\C:\scripts\"}, 3, 33, ... 12, {status=0x0, info=1}, ) }, 3, 33, ... 12, {status=0x0, info=1}, ) == 0x0
 00016   860   NtQueryVolumeInformationFile  (12, 1243852, 8, Device, ... {status=0x0, info=8}, ) == 0x0
 00017   860   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\u:\work\packed.exe.Local"}, 1243804, ... ) }, 1243804, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00018   860   NtOpenSection  (0xe, {24, 8, 0x40, 0, 0,  (0xe, {24, 8, 0x40, 0, 0, "kernel32.dll"}, ... 16, ) }, ... 16, ) == 0x0
 00019   860   NtMapViewOfSection  (16, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x7c800000), 0x0, 1003520, ) == 0x0
 00020   860   NtClose  (16, ... ) == 0x0
 00021   860   NtProtectVirtualMemory  (-1, (0x7c801000), 1568, 4, ... (0x7c801000), 4096, 32, ) == 0x0
 00022   860   NtProtectVirtualMemory  (-1, (0x7c801000), 4096, 32, ... (0x7c801000), 4096, 4, ) == 0x0
 00023   860   NtFlushInstructionCache  (-1, 2088767488, 1568, ... ) == 0x0
 00024   860   NtQueryInformationProcess  (-1, 36, 4, ... {process info, class 36, size 4}, 0x0, ) == 0x0
 00025   860   NtQuerySystemInformation  (RangeStart, 4, ... {system info, class 50, size 4}, 0x0, ) == 0x0
 00026   860   NtQuerySystemInformation  (Basic, 44, ... {Unknown=0,MaximumIncrement=156250,PhysicalPageSize=0x1000,NumberOfPhysicalPages=0xff7c,LowestPhysicalPage=0x1,HighestPhysicalPage=0xffff,AllocationGranularity=0x10000,LowestUserAddress=0x10000,HighestUserAddress=0x7ffeffff,ActiveProcessors=1,NumberProcessors=1,}, 0x0, ) == 0x0
 00027   860   NtCreateSection  (0xf001f, 0x0, {65536, 0}, 4, 67108864, 0, ... 16, ) == 0x0
 00028   860   NtSecureConnectPort  ( ("\Windows\ApiPort", {0, 2, 1, 1}, {24, 16, 0, 65536, 0, 0}, 1319736, {12, 0, 0}, 1241944, 44, ... 24, {24, 16, 0, 65536, 2424832, 18415616}, {0, 0, 0}, 200, 44, ) , {0, 2, 1, 1}, {24, 16, 0, 65536, 0, 0}, 1319736, {12, 0, 0}, 1241944, 44, ... 24, {24, 16, 0, 65536, 2424832, 18415616}, {0, 0, 0}, 200, 44, ) == 0x0
 00029   860   NtClose  (16, ... ) == 0x0
 00030   860   NtQueryObject  (24, Handle, 2, ... {Inherit=0,ProtectFromClose=0,}, -1, ) == 0x0
 00031   860   NtSetInformationObject  (24, Handle, {Inherit=0,ProtectFromClose=1,}, 256, ... ) == 0x0
 00032   860   NtQuerySystemInformation  (Basic, 44, ... {Unknown=0,MaximumIncrement=156250,PhysicalPageSize=0x1000,NumberOfPhysicalPages=0xff7c,LowestPhysicalPage=0x1,HighestPhysicalPage=0xffff,AllocationGranularity=0x10000,LowestUserAddress=0x10000,HighestUserAddress=0x7ffeffff,ActiveProcessors=1,NumberProcessors=1,}, 0x0, ) == 0x0
 00033   860   NtQueryVirtualMemory  (-1, 0x250000, Basic, 28, ... {BaseAddress=0x250000,AllocationBase=0x250000,AllocationProtect=0x4,RegionSize=0x10000,State=0x2000,Protect=0x0,Type=0x40000,}, 0x0, ) == 0x0
 00034   860   NtAllocateVirtualMemory  (-1, 2424832, 0, 4096, 4096, 4, ... 2424832, 4096, ) == 0x0
 00035   860   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1242260, 1242460, 2089900544, 1242184}  (24, {28, 56, new_msg, 0, 1242260, 1242460, 2089900544, 1242184} "\210\6\31\1\0\0\0\0eZ\221|\0\0\0\0\1\0\0\0\234\6\31\1\4\0\0\0" ... {28, 56, reply, 0, 464, 860, 57957, 0} "`\375\27\0\0\0\0\0\0\0\0\0\0\0\0\0\1\0\0\0\234\6\31\1\4\0\0\0" )  ... {28, 56, reply, 0, 464, 860, 57957, 0}  (24, {28, 56, new_msg, 0, 1242260, 1242460, 2089900544, 1242184} "\210\6\31\1\0\0\0\0eZ\221|\0\0\0\0\1\0\0\0\234\6\31\1\4\0\0\0" ... {28, 56, reply, 0, 464, 860, 57957, 0} "`\375\27\0\0\0\0\0\0\0\0\0\0\0\0\0\1\0\0\0\234\6\31\1\4\0\0\0" )  ) == 0x0
 00036   860   NtRegisterThreadTerminatePort  (24, ... ) == 0x0
 00037   860   NtAllocateVirtualMemory  (-1, 1232896, 0, 4096, 4096, 260, ... 1232896, 4096, ) == 0x0
 00038   860   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\System\CurrentControlSet\Control\Terminal Server"}, ... 16, ) }, ... 16, ) == 0x0
 00039   860   NtQueryValueKey  (16,  (16, "TSAppCompat", Partial, 548, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) , Partial, 548, ... TitleIdx=0, Type=4, Data= (16, "TSAppCompat", Partial, 548, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) }, 16, ) == 0x0
 00040   860   NtClose  (16, ... ) == 0x0
 00041   860   NtOpenSection  (0x4, {24, 0, 0x40, 0, 0,  (0x4, {24, 0, 0x40, 0, 0, "\NLS\NlsSectionUnicode"}, ... 16, ) }, ... 16, ) == 0x0
 00042   860   NtMapViewOfSection  (16, -1, (0x0), 0, 0, 0x0, 0, 2, 0, 2, ... (0x260000), 0x0, 90112, ) == 0x0
 00043   860   NtClose  (16, ... ) == 0x0
 00044   860   NtQueryDefaultLocale  (0, 2089305000, ... ) == 0x0
 00045   860   NtOpenSection  (0x4, {24, 0, 0x40, 0, 0,  (0x4, {24, 0, 0x40, 0, 0, "\NLS\NlsSectionLocale"}, ... 16, ) }, ... 16, ) == 0x0
 00046   860   NtMapViewOfSection  (16, -1, (0x0), 0, 0, 0x0, 0, 2, 0, 2, ... (0x280000), 0x0, 249856, ) == 0x0
 00047   860   NtClose  (16, ... ) == 0x0
 00048   860   NtOpenSection  (0x5, {24, 0, 0x40, 0, 0,  (0x5, {24, 0, 0x40, 0, 0, "\NLS\NlsSectionSortkey"}, ... 16, ) }, ... 16, ) == 0x0
 00049   860   NtMapViewOfSection  (16, -1, (0x0), 0, 0, 0x0, 0, 2, 0, 2, ... (0x2c0000), 0x0, 266240, ) == 0x0
 00050   860   NtQuerySection  (16, Basic, 16, ... {BaseAddress=0x0,Attributes=0x800000,Size={0x40004, 0x0},}, 0x0, ) == 0x0
 00051   860   NtClose  (16, ... ) == 0x0
 00052   860   NtOpenSection  (0x4, {24, 0, 0x40, 0, 0,  (0x4, {24, 0, 0x40, 0, 0, "\NLS\NlsSectionSortTbls"}, ... 16, ) }, ... 16, ) == 0x0
 00053   860   NtMapViewOfSection  (16, -1, (0x0), 0, 0, 0x0, 0, 2, 0, 2, ... (0x310000), 0x0, 24576, ) == 0x0
 00054   860   NtClose  (16, ... ) == 0x0
 00055   860   NtQueryVirtualMemory  (-1, 0x7ffd2000, Basic, 28, ... {BaseAddress=0x7ffd2000,AllocationBase=0x7ffb0000,AllocationProtect=0x2,RegionSize=0x2000,State=0x1000,Protect=0x2,Type=0x40000,}, 0x0, ) == 0x0
 00056   860   NtOpenSection  (0x4, {24, 0, 0x40, 0, 0,  (0x4, {24, 0, 0x40, 0, 0, "\NLS\NlsSectionSortkey00000409"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00057   860   NtOpenSection  (0x4, {24, 0, 0x40, 0, 0,  (0x4, {24, 0, 0x40, 0, 0, "\NLS\NlsSectionSortkey00000409"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00058   860   NtAllocateVirtualMemory  (-1, 2428928, 0, 8192, 4096, 4, ... 2428928, 8192, ) == 0x0
 00059   860   NtRequestWaitReplyPort  (24, {24, 52, new_msg, 0, 7012468, 7929957, 3145776, 3145776}  (24, {24, 52, new_msg, 0, 7012468, 7929957, 3145776, 3145776} "\210\6\31\1\36\0\1\0\0\0\0\0\377\377\377\377\234\6\31\1p\30\0\0" ... {24, 52, reply, 0, 464, 860, 57958, 0} "\10P\30\0\36\0\1\0\0\0\0\0\377\377\377\377\234\6\31\1p\30\0\0" )  ... {24, 52, reply, 0, 464, 860, 57958, 0}  (24, {24, 52, new_msg, 0, 7012468, 7929957, 3145776, 3145776} "\210\6\31\1\36\0\1\0\0\0\0\0\377\377\377\377\234\6\31\1p\30\0\0" ... {24, 52, reply, 0, 464, 860, 57958, 0} "\10P\30\0\36\0\1\0\0\0\0\0\377\377\377\377\234\6\31\1p\30\0\0" )  ) == 0x0
 00060   860   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 2089305760, 2090321376, 0, 0}  (24, {28, 56, new_msg, 0, 2089305760, 2090321376, 0, 0} "\210\6\31\1\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\234\6\31\18\6\0\0" ... {28, 56, reply, 0, 464, 860, 57959, 0} "\250\202\26\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\234\6\31\18\6\0\0" )  ... {28, 56, reply, 0, 464, 860, 57959, 0}  (24, {28, 56, new_msg, 0, 2089305760, 2090321376, 0, 0} "\210\6\31\1\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\234\6\31\18\6\0\0" ... {28, 56, reply, 0, 464, 860, 57959, 0} "\250\202\26\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\234\6\31\18\6\0\0" )  ) == 0x0
 00061   860   NtProtectVirtualMemory  (-1, (0x461000), 110592, 4, ... (0x461000), 110592, 128, ) == 0x0
 00062   860   NtProtectVirtualMemory  (-1, (0x461000), 110592, 128, ... (0x461000), 110592, 4, ) == 0x0
 00063   860   NtFlushInstructionCache  (-1, 4591616, 110592, ... ) == 0x0
 00064   860   NtOpenSection  (0xe, {24, 8, 0x40, 0, 0,  (0xe, {24, 8, 0x40, 0, 0, "ws2_32.dll"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00065   860   NtAllocateVirtualMemory  (-1, 1323008, 0, 4096, 4096, 4, ... 1323008, 4096, ) == 0x0
 00066   860   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\u:\work\ws2_32.dll"}, 1242572, ... ) }, 1242572, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00067   860   NtFsControlFile  (12, 0, 0x0, 0x0, 0x90028, 0x0, 0, 0, ... {status=0x0, info=0}, 0x0, ) == 0x0
 00068   860   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\ws2_32.dll"}, 1242572, ... ) }, 1242572, ... ) == 0x0
 00069   860   NtOpenFile  (0x100020, {24, 0, 0x40, 0, 0,  (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\ws2_32.dll"}, 5, 96, ... 16, {status=0x0, info=1}, ) }, 5, 96, ... 16, {status=0x0, info=1}, ) == 0x0
 00070   860   NtCreateSection  (0xf, 0x0, 0x0, 16, 16777216, 16, ... 28, ) == 0x0
 00071   860   NtQuerySection  (28, Image, 48, ... {section info, class 1, size 48}, 0x0, ) == 0x0
 00072   860   NtOpenProcessToken  (-1, 0x8, ... 32, ) == 0x0
 00073   860   NtQueryInformationToken  (32, User, 136, ... {token info, class 1, size 36}, 36, ) == 0x0
 00074   860   NtOpenKey  (0x3, {24, 0, 0x40, 0, 0,  (0x3, {24, 0, 0x40, 0, 0, "\Registry\MACHINE\System\CurrentControlSet\Control\SafeBoot\Option"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00075   860   NtOpenKey  (0x1, {24, 0, 0x40, 0, 0,  (0x1, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers"}, ... 36, ) }, ... 36, ) == 0x0
 00076   860   NtQueryValueKey  (36,  (36, "TransparentEnabled", Partial, 80, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) , Partial, 80, ... TitleIdx=0, Type=4, Data= (36, "TransparentEnabled", Partial, 80, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) }, 16, ) == 0x0
 00077   860   NtClose  (36, ... ) == 0x0
 00078   860   NtOpenThreadTokenEx  (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN
 00079   860   NtOpenProcessTokenEx  (-1, 0x20008, 512, ... 36, ) == 0x0
 00080   860   NtQueryInformationToken  (36, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0
 00081   860   NtClose  (36, ... ) == 0x0
 00082   860   NtOpenKey  (0x1, {24, 0, 0x40, 0, 0,  (0x1, {24, 0, 0x40, 0, 0, "\REGISTRY\USER\S-1-5-21-1292428093-1383384898-725345543-1003\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00083   860   NtClose  (32, ... ) == 0x0
 00084   860   NtClose  (16, ... ) == 0x0
 00085   860   NtMapViewOfSection  (28, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x71ab0000), 0x0, 94208, ) == 0x0
 00086   860   NtClose  (28, ... ) == 0x0
 00087   860   NtOpenSection  (0xe, {24, 8, 0x40, 0, 0,  (0xe, {24, 8, 0x40, 0, 0, "msvcrt.dll"}, ... 28, ) }, ... 28, ) == 0x0
 00088   860   NtMapViewOfSection  (28, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x77c10000), 0x0, 360448, ) == 0x0
 00089   860   NtClose  (28, ... ) == 0x0
 00090   860   NtProtectVirtualMemory  (-1, (0x77c11000), 632, 4, ... (0x77c11000), 4096, 32, ) == 0x0
 00091   860   NtProtectVirtualMemory  (-1, (0x77c11000), 4096, 32, ... (0x77c11000), 4096, 4, ) == 0x0
 00092   860   NtFlushInstructionCache  (-1, 2009141248, 632, ... ) == 0x0
 00093   860   NtProtectVirtualMemory  (-1, (0x71ab1000), 468, 4, ... (0x71ab1000), 4096, 32, ) == 0x0
 00094   860   NtProtectVirtualMemory  (-1, (0x71ab1000), 4096, 32, ... (0x71ab1000), 4096, 4, ) == 0x0
 00095   860   NtFlushInstructionCache  (-1, 1907036160, 468, ... ) == 0x0
 00096   860   NtOpenSection  (0xe, {24, 8, 0x40, 0, 0,  (0xe, {24, 8, 0x40, 0, 0, "WS2HELP.dll"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00097   860   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\u:\work\WS2HELP.dll"}, 1241756, ... ) }, 1241756, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00098   860   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\WS2HELP.dll"}, 1241756, ... ) }, 1241756, ... ) == 0x0
 00099   860   NtOpenFile  (0x100020, {24, 0, 0x40, 0, 0,  (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\WS2HELP.dll"}, 5, 96, ... 28, {status=0x0, info=1}, ) }, 5, 96, ... 28, {status=0x0, info=1}, ) == 0x0
 00100   860   NtCreateSection  (0xf, 0x0, 0x0, 16, 16777216, 28, ... 16, ) == 0x0
 00101   860   NtQuerySection  (16, Image, 48, ... {section info, class 1, size 48}, 0x0, ) == 0x0
 00102   860   NtClose  (28, ... ) == 0x0
 00103   860   NtMapViewOfSection  (16, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x71aa0000), 0x0, 32768, ) == 0x0
 00104   860   NtClose  (16, ... ) == 0x0
 00105   860   NtOpenSection  (0xe, {24, 8, 0x40, 0, 0,  (0xe, {24, 8, 0x40, 0, 0, "ADVAPI32.dll"}, ... 16, ) }, ... 16, ) == 0x0
 00106   860   NtMapViewOfSection  (16, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x77dd0000), 0x0, 634880, ) == 0x0
 00107   860   NtClose  (16, ... ) == 0x0
 00108   860   NtProtectVirtualMemory  (-1, (0x77dd1000), 1700, 4, ... (0x77dd1000), 4096, 32, ) == 0x0
 00109   860   NtProtectVirtualMemory  (-1, (0x77dd1000), 4096, 32, ... (0x77dd1000), 4096, 4, ) == 0x0
 00110   860   NtFlushInstructionCache  (-1, 2010976256, 1700, ... ) == 0x0
 00111   860   NtOpenSection  (0xe, {24, 8, 0x40, 0, 0,  (0xe, {24, 8, 0x40, 0, 0, "RPCRT4.dll"}, ... 16, ) }, ... 16, ) == 0x0
 00112   860   NtMapViewOfSection  (16, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x77e70000), 0x0, 593920, ) == 0x0
 00113   860   NtClose  (16, ... ) == 0x0
 00114   860   NtProtectVirtualMemory  (-1, (0x77e71000), 868, 4, ... (0x77e71000), 4096, 32, ) == 0x0
 00115   860   NtProtectVirtualMemory  (-1, (0x77e71000), 4096, 32, ... (0x77e71000), 4096, 4, ) == 0x0
 00116   860   NtFlushInstructionCache  (-1, 2011631616, 868, ... ) == 0x0
 00117   860   NtProtectVirtualMemory  (-1, (0x77e71000), 868, 4, ... (0x77e71000), 4096, 32, ) == 0x0
 00118   860   NtProtectVirtualMemory  (-1, (0x77e71000), 4096, 32, ... (0x77e71000), 4096, 4, ) == 0x0
 00119   860   NtFlushInstructionCache  (-1, 2011631616, 868, ... ) == 0x0
 00120   860   NtProtectVirtualMemory  (-1, (0x77e71000), 868, 4, ... (0x77e71000), 4096, 32, ) == 0x0
 00121   860   NtProtectVirtualMemory  (-1, (0x77e71000), 4096, 32, ... (0x77e71000), 4096, 4, ) == 0x0
 00122   860   NtFlushInstructionCache  (-1, 2011631616, 868, ... ) == 0x0
 00123   860   NtProtectVirtualMemory  (-1, (0x77dd1000), 1700, 4, ... (0x77dd1000), 4096, 32, ) == 0x0
 00124   860   NtProtectVirtualMemory  (-1, (0x77dd1000), 4096, 32, ... (0x77dd1000), 4096, 4, ) == 0x0
 00125   860   NtFlushInstructionCache  (-1, 2010976256, 1700, ... ) == 0x0
 00126   860   NtProtectVirtualMemory  (-1, (0x71aa1000), 352, 4, ... (0x71aa1000), 4096, 32, ) == 0x0
 00127   860   NtProtectVirtualMemory  (-1, (0x71aa1000), 4096, 32, ... (0x71aa1000), 4096, 4, ) == 0x0
 00128   860   NtFlushInstructionCache  (-1, 1906970624, 352, ... ) == 0x0
 00129   860   NtProtectVirtualMemory  (-1, (0x71ab1000), 468, 4, ... (0x71ab1000), 4096, 32, ) == 0x0
 00130   860   NtProtectVirtualMemory  (-1, (0x71ab1000), 4096, 32, ... (0x71ab1000), 4096, 4, ) == 0x0
 00131   860   NtFlushInstructionCache  (-1, 1907036160, 468, ... ) == 0x0
 00132   860   NtProtectVirtualMemory  (-1, (0x461000), 110592, 4, ... (0x461000), 110592, 64, ) == 0x0
 00133   860   NtProtectVirtualMemory  (-1, (0x461000), 110592, 64, ... (0x461000), 110592, 4, ) == 0x0
 00134   860   NtFlushInstructionCache  (-1, 4591616, 110592, ... ) == 0x0
 00135   860   NtOpenSection  (0xe, {24, 8, 0x40, 0, 0,  (0xe, {24, 8, 0x40, 0, 0, "oleaut32.dll"}, ... 16, ) }, ... 16, ) == 0x0
 00136   860   NtMapViewOfSection  (16, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x77120000), 0x0, 569344, ) == 0x0
 00137   860   NtClose  (16, ... ) == 0x0
 00138   860   NtProtectVirtualMemory  (-1, (0x77121000), 1272, 4, ... (0x77121000), 4096, 32, ) == 0x0
 00139   860   NtProtectVirtualMemory  (-1, (0x77121000), 4096, 32, ... (0x77121000), 4096, 4, ) == 0x0
 00140   860   NtFlushInstructionCache  (-1, 1997672448, 1272, ... ) == 0x0
 00141   860   NtOpenSection  (0xe, {24, 8, 0x40, 0, 0,  (0xe, {24, 8, 0x40, 0, 0, "GDI32.dll"}, ... 16, ) }, ... 16, ) == 0x0
 00142   860   NtMapViewOfSection  (16, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x77f10000), 0x0, 290816, ) == 0x0
 00143   860   NtClose  (16, ... ) == 0x0
 00144   860   NtProtectVirtualMemory  (-1, (0x77f11000), 508, 4, ... (0x77f11000), 4096, 32, ) == 0x0
 00145   860   NtProtectVirtualMemory  (-1, (0x77f11000), 4096, 32, ... (0x77f11000), 4096, 4, ) == 0x0
 00146   860   NtFlushInstructionCache  (-1, 2012286976, 508, ... ) == 0x0
 00147   860   NtProtectVirtualMemory  (-1, (0x77f11000), 508, 4, ... (0x77f11000), 4096, 32, ) == 0x0
 00148   860   NtProtectVirtualMemory  (-1, (0x77f11000), 4096, 32, ... (0x77f11000), 4096, 4, ) == 0x0
 00149   860   NtFlushInstructionCache  (-1, 2012286976, 508, ... ) == 0x0
 00150   860   NtOpenSection  (0xe, {24, 8, 0x40, 0, 0,  (0xe, {24, 8, 0x40, 0, 0, "USER32.dll"}, ... 16, ) }, ... 16, ) == 0x0
 00151   860   NtMapViewOfSection  (16, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x7e410000), 0x0, 589824, ) == 0x0
 00152   860   NtClose  (16, ... ) == 0x0
 00153   860   NtProtectVirtualMemory  (-1, (0x7e411000), 1252, 4, ... (0x7e411000), 4096, 32, ) == 0x0
 00154   860   NtProtectVirtualMemory  (-1, (0x7e411000), 4096, 32, ... (0x7e411000), 4096, 4, ) == 0x0
 00155   860   NtFlushInstructionCache  (-1, 2118193152, 1252, ... ) == 0x0
 00156   860   NtProtectVirtualMemory  (-1, (0x7e411000), 1252, 4, ... (0x7e411000), 4096, 32, ) == 0x0
 00157   860   NtProtectVirtualMemory  (-1, (0x7e411000), 4096, 32, ... (0x7e411000), 4096, 4, ) == 0x0
 00158   860   NtFlushInstructionCache  (-1, 2118193152, 1252, ... ) == 0x0
 00159   860   NtProtectVirtualMemory  (-1, (0x7e411000), 1252, 4, ... (0x7e411000), 4096, 32, ) == 0x0
 00160   860   NtProtectVirtualMemory  (-1, (0x7e411000), 4096, 32, ... (0x7e411000), 4096, 4, ) == 0x0
 00161   860   NtFlushInstructionCache  (-1, 2118193152, 1252, ... ) == 0x0
 00162   860   NtProtectVirtualMemory  (-1, (0x77f11000), 508, 4, ... (0x77f11000), 4096, 32, ) == 0x0
 00163   860   NtProtectVirtualMemory  (-1, (0x77f11000), 4096, 32, ... (0x77f11000), 4096, 4, ) == 0x0
 00164   860   NtFlushInstructionCache  (-1, 2012286976, 508, ... ) == 0x0
 00165   860   NtProtectVirtualMemory  (-1, (0x77121000), 1272, 4, ... (0x77121000), 4096, 32, ) == 0x0
 00166   860   NtProtectVirtualMemory  (-1, (0x77121000), 4096, 32, ... (0x77121000), 4096, 4, ) == 0x0
 00167   860   NtFlushInstructionCache  (-1, 1997672448, 1272, ... ) == 0x0
 00168   860   NtProtectVirtualMemory  (-1, (0x77121000), 1272, 4, ... (0x77121000), 4096, 32, ) == 0x0
 00169   860   NtProtectVirtualMemory  (-1, (0x77121000), 4096, 32, ... (0x77121000), 4096, 4, ) == 0x0
 00170   860   NtFlushInstructionCache  (-1, 1997672448, 1272, ... ) == 0x0
 00171   860   NtProtectVirtualMemory  (-1, (0x77121000), 1272, 4, ... (0x77121000), 4096, 32, ) == 0x0
 00172   860   NtProtectVirtualMemory  (-1, (0x77121000), 4096, 32, ... (0x77121000), 4096, 4, ) == 0x0
 00173   860   NtFlushInstructionCache  (-1, 1997672448, 1272, ... ) == 0x0
 00174   860   NtOpenSection  (0xe, {24, 8, 0x40, 0, 0,  (0xe, {24, 8, 0x40, 0, 0, "ole32.dll"}, ... 16, ) }, ... 16, ) == 0x0
 00175   860   NtMapViewOfSection  (16, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x774e0000), 0x0, 1298432, ) == 0x0
 00176   860   NtClose  (16, ... ) == 0x0
 00177   860   NtProtectVirtualMemory  (-1, (0x774e1000), 2352, 4, ... (0x774e1000), 4096, 32, ) == 0x0
 00178   860   NtProtectVirtualMemory  (-1, (0x774e1000), 4096, 32, ... (0x774e1000), 4096, 4, ) == 0x0
 00179   860   NtFlushInstructionCache  (-1, 2001604608, 2352, ... ) == 0x0
 00180   860   NtProtectVirtualMemory  (-1, (0x774e1000), 2352, 4, ... (0x774e1000), 4096, 32, ) == 0x0
 00181   860   NtProtectVirtualMemory  (-1, (0x774e1000), 4096, 32, ... (0x774e1000), 4096, 4, ) == 0x0
 00182   860   NtFlushInstructionCache  (-1, 2001604608, 2352, ... ) == 0x0
 00183   860   NtProtectVirtualMemory  (-1, (0x774e1000), 2352, 4, ... (0x774e1000), 4096, 32, ) == 0x0
 00184   860   NtProtectVirtualMemory  (-1, (0x774e1000), 4096, 32, ... (0x774e1000), 4096, 4, ) == 0x0
 00185   860   NtFlushInstructionCache  (-1, 2001604608, 2352, ... ) == 0x0
 00186   860   NtProtectVirtualMemory  (-1, (0x774e1000), 2352, 4, ... (0x774e1000), 4096, 32, ) == 0x0
 00187   860   NtProtectVirtualMemory  (-1, (0x774e1000), 4096, 32, ... (0x774e1000), 4096, 4, ) == 0x0
 00188   860   NtFlushInstructionCache  (-1, 2001604608, 2352, ... ) == 0x0
 00189   860   NtProtectVirtualMemory  (-1, (0x774e1000), 2352, 4, ... (0x774e1000), 4096, 32, ) == 0x0
 00190   860   NtProtectVirtualMemory  (-1, (0x774e1000), 4096, 32, ... (0x774e1000), 4096, 4, ) == 0x0
 00191   860   NtFlushInstructionCache  (-1, 2001604608, 2352, ... ) == 0x0
 00192   860   NtProtectVirtualMemory  (-1, (0x774e1000), 2352, 4, ... (0x774e1000), 4096, 32, ) == 0x0
 00193   860   NtProtectVirtualMemory  (-1, (0x774e1000), 4096, 32, ... (0x774e1000), 4096, 4, ) == 0x0
 00194   860   NtFlushInstructionCache  (-1, 2001604608, 2352, ... ) == 0x0
 00195   860   NtProtectVirtualMemory  (-1, (0x774e1000), 2352, 4, ... (0x774e1000), 4096, 32, ) == 0x0
 00196   860   NtProtectVirtualMemory  (-1, (0x774e1000), 4096, 32, ... (0x774e1000), 4096, 4, ) == 0x0
 00197   860   NtFlushInstructionCache  (-1, 2001604608, 2352, ... ) == 0x0
 00198   860   NtProtectVirtualMemory  (-1, (0x77121000), 1272, 4, ... (0x77121000), 4096, 32, ) == 0x0
 00199   860   NtProtectVirtualMemory  (-1, (0x77121000), 4096, 32, ... (0x77121000), 4096, 4, ) == 0x0
 00200   860   NtFlushInstructionCache  (-1, 1997672448, 1272, ... ) == 0x0
 00201   860   NtProtectVirtualMemory  (-1, (0x77121000), 1272, 4, ... (0x77121000), 4096, 32, ) == 0x0
 00202   860   NtProtectVirtualMemory  (-1, (0x77121000), 4096, 32, ... (0x77121000), 4096, 4, ) == 0x0
 00203   860   NtFlushInstructionCache  (-1, 1997672448, 1272, ... ) == 0x0
 00204   860   NtProtectVirtualMemory  (-1, (0x77121000), 1272, 4, ... (0x77121000), 4096, 32, ) == 0x0
 00205   860   NtProtectVirtualMemory  (-1, (0x77121000), 4096, 32, ... (0x77121000), 4096, 4, ) == 0x0
 00206   860   NtFlushInstructionCache  (-1, 1997672448, 1272, ... ) == 0x0
 00207   860   NtProtectVirtualMemory  (-1, (0x461000), 110592, 4, ... (0x461000), 110592, 64, ) == 0x0
 00208   860   NtProtectVirtualMemory  (-1, (0x461000), 110592, 64, ... (0x461000), 110592, 4, ) == 0x0
 00209   860   NtFlushInstructionCache  (-1, 4591616, 110592, ... ) == 0x0
 00210   860   NtProtectVirtualMemory  (-1, (0x461000), 110592, 4, ... (0x461000), 110592, 64, ) == 0x0
 00211   860   NtProtectVirtualMemory  (-1, (0x461000), 110592, 64, ... (0x461000), 110592, 4, ) == 0x0
 00212   860   NtFlushInstructionCache  (-1, 4591616, 110592, ... ) == 0x0
 00213   860   NtQueryInformationProcess  (-1, 37, 48, ... {process info, class 37, size 48}, 0x0, ) == 0x0
 00214   860   NtSetInformationProcess  (-1, 34, {process info, class 34, size 4}, 4, ... ) == 0x0
 00215   860   NtOpenProcessToken  (-1, 0x8, ... 16, ) == 0x0
 00216   860   NtQueryInformationToken  (16, Statistics, 56, ... {token info, class 10, size 56}, 56, ) == 0x0
 00217   860   NtClose  (16, ... ) == 0x0
 00218   860   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\System\CurrentControlSet\Control\Terminal Server"}, ... 16, ) }, ... 16, ) == 0x0
 00219   860   NtQueryValueKey  (16,  (16, "TSAppCompat", Partial, 548, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) , Partial, 548, ... TitleIdx=0, Type=4, Data= (16, "TSAppCompat", Partial, 548, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) }, 16, ) == 0x0
 00220   860   NtClose  (16, ... ) == 0x0
 00221   860   NtOpenKey  (0x80000000, {24, 0, 0x40, 0, 0,  (0x80000000, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msvcrt.dll"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00222   860   NtQuerySystemInformation  (Basic, 44, ... {Unknown=0,MaximumIncrement=156250,PhysicalPageSize=0x1000,NumberOfPhysicalPages=0xff7c,LowestPhysicalPage=0x1,HighestPhysicalPage=0xffff,AllocationGranularity=0x10000,LowestUserAddress=0x10000,HighestUserAddress=0x7ffeffff,ActiveProcessors=1,NumberProcessors=1,}, 0x0, ) == 0x0
 00223   860   NtAllocateVirtualMemory  (-1, 0, 0, 65536, 8192, 4, ... 3276800, 65536, ) == 0x0
 00224   860   NtAllocateVirtualMemory  (-1, 3276800, 0, 4096, 4096, 4, ... 3276800, 4096, ) == 0x0
 00225   860   NtAllocateVirtualMemory  (-1, 3280896, 0, 8192, 4096, 4, ... 3280896, 8192, ) == 0x0
 00226   860   NtAllocateVirtualMemory  (-1, 3289088, 0, 4096, 4096, 4, ... 3289088, 4096, ) == 0x0
 00227   860   NtOpenSection  (0x4, {24, 0, 0x40, 0, 0,  (0x4, {24, 0, 0x40, 0, 0, "\NLS\NlsSectionCType"}, ... 16, ) }, ... 16, ) == 0x0
 00228   860   NtMapViewOfSection  (16, -1, (0x0), 0, 0, 0x0, 0, 2, 0, 2, ... (0x330000), 0x0, 12288, ) == 0x0
 00229   860   NtClose  (16, ... ) == 0x0
 00230   860   NtAllocateVirtualMemory  (-1, 3293184, 0, 4096, 4096, 4, ... 3293184, 4096, ) == 0x0
 00231   860   NtQueryVirtualMemory  (-1, 0x77c2807c, Basic, 28, ... {BaseAddress=0x77c28000,AllocationBase=0x77c10000,AllocationProtect=0x80,RegionSize=0x35000,State=0x1000,Protect=0x20,Type=0x1000000,}, 28, ) == 0x0
 00232   860   NtQueryInformationProcess  (-1, 36, 4, ... {process info, class 36, size 4}, 0x0, ) == 0x0
 00233   860   NtQueryInformationProcess  (-1, 36, 4, ... {process info, class 36, size 4}, 0x0, ) == 0x0
 00234   860   NtQueryVirtualMemory  (-1, 0x0, Basic, 28, ... {BaseAddress=0x0,AllocationBase=0x0,AllocationProtect=0x0,RegionSize=0x10000,State=0x10000,Protect=0x1,Type=0x0,}, 28, ) == 0x0
 00235   860   NtOpenKey  (0x80000000, {24, 0, 0x40, 0, 0,  (0x80000000, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RPCRT4.dll"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00236   860   NtOpenKey  (0x80000000, {24, 0, 0x40, 0, 0,  (0x80000000, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ADVAPI32.dll"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00237   860   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\System\CurrentControlSet\Control\Terminal Server"}, ... 16, ) }, ... 16, ) == 0x0
 00238   860   NtQueryValueKey  (16,  (16, "TSAppCompat", Partial, 548, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) , Partial, 548, ... TitleIdx=0, Type=4, Data= (16, "TSAppCompat", Partial, 548, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) }, 16, ) == 0x0
 00239   860   NtQueryValueKey  (16,  (16, "TSUserEnabled", Partial, 548, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) , Partial, 548, ... TitleIdx=0, Type=4, Data= (16, "TSUserEnabled", Partial, 548, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) }, 16, ) == 0x0
 00240   860   NtClose  (16, ... ) == 0x0
 00241   860   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon"}, ... 16, ) }, ... 16, ) == 0x0
 00242   860   NtQueryValueKey  (16,  (16, "LeakTrack", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00243   860   NtClose  (16, ... ) == 0x0
 00244   860   NtOpenKey  (0x2000000, {24, 0, 0x40, 0, 0,  (0x2000000, {24, 0, 0x40, 0, 0, "\REGISTRY\MACHINE"}, ... 16, ) }, ... 16, ) == 0x0
 00245   860   NtSetInformationObject  (16, Handle, {Inherit=0,ProtectFromClose=1,}, 2011431168, ... ) == 0x0
 00246   860   NtOpenKey  (0x20019, {24, 16, 0x40, 0, 0,  (0x20019, {24, 16, 0x40, 0, 0, "Software\Microsoft\Windows NT\CurrentVersion\Diagnostics"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00247   860   NtOpenKey  (0x80000000, {24, 0, 0x40, 0, 0,  (0x80000000, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\WS2HELP.dll"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00248   860   NtOpenKey  (0x80000000, {24, 0, 0x40, 0, 0,  (0x80000000, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ws2_32.dll"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00249   860   NtQuerySystemInformation  (Basic, 44, ... {Unknown=0,MaximumIncrement=156250,PhysicalPageSize=0x1000,NumberOfPhysicalPages=0xff7c,LowestPhysicalPage=0x1,HighestPhysicalPage=0xffff,AllocationGranularity=0x10000,LowestUserAddress=0x10000,HighestUserAddress=0x7ffeffff,ActiveProcessors=1,NumberProcessors=1,}, 0x0, ) == 0x0
 00250   860   NtQuerySystemInformation  (Processor, 12, ... {system info, class 1, size 12}, 0x0, ) == 0x0
 00251   860   NtOpenKey  (0x80000000, {24, 0, 0x40, 0, 0,  (0x80000000, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\USER32.dll"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00252   860   NtQuerySystemInformation  (Basic, 44, ... {Unknown=0,MaximumIncrement=156250,PhysicalPageSize=0x1000,NumberOfPhysicalPages=0xff7c,LowestPhysicalPage=0x1,HighestPhysicalPage=0xffff,AllocationGranularity=0x10000,LowestUserAddress=0x10000,HighestUserAddress=0x7ffeffff,ActiveProcessors=1,NumberProcessors=1,}, 0x0, ) == 0x0
 00253   860   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 256, 1243092, 256, 1242836}  (24, {28, 56, new_msg, 0, 256, 1243092, 256, 1242836} "\210\6\31\1\0\0\0\0\0\0\0\0\1\0\0\0\3\0\0\0\234\6\31\1$\1\0\0" ... {28, 56, reply, 0, 464, 860, 57960, 0} "\320G\26\0\0\0\0\0\0\0\0\0\1\0\0\0\3\0\0\0\234\6\31\1$\1\0\0" )  ... {28, 56, reply, 0, 464, 860, 57960, 0}  (24, {28, 56, new_msg, 0, 256, 1243092, 256, 1242836} "\210\6\31\1\0\0\0\0\0\0\0\0\1\0\0\0\3\0\0\0\234\6\31\1$\1\0\0" ... {28, 56, reply, 0, 464, 860, 57960, 0} "\320G\26\0\0\0\0\0\0\0\0\0\1\0\0\0\3\0\0\0\234\6\31\1$\1\0\0" )  ) == 0x0
 00254   860   NtOpenKey  (0x1, {24, 0, 0x40, 0, 0,  (0x1, {24, 0, 0x40, 0, 0, "\Registry\MACHINE\System\CurrentControlSet\Control\Session Manager"}, ... 28, ) }, ... 28, ) == 0x0
 00255   860   NtQueryValueKey  (28,  (28, "SafeDllSearchMode", Partial, 16, ... ) , Partial, 16, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00256   860   NtClose  (28, ... ) == 0x0
 00257   860   NtAllocateVirtualMemory  (-1, 1327104, 0, 4096, 4096, 4, ... 1327104, 4096, ) == 0x0
 00258   860   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\IMM32.DLL"}, 1239420, ... ) }, 1239420, ... ) == 0x0
 00259   860   NtOpenFile  (0x100020, {24, 0, 0x40, 0, 0,  (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\IMM32.DLL"}, 5, 96, ... 28, {status=0x0, info=1}, ) }, 5, 96, ... 28, {status=0x0, info=1}, ) == 0x0
 00260   860   NtCreateSection  (0xe, 0x0, 0x0, 16, 134217728, 28, ... 32, ) == 0x0
 00261   860   NtClose  (28, ... ) == 0x0
 00262   860   NtMapViewOfSection  (32, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 16, ... (0x340000), 0x0, 110592, ) == 0x0
 00263   860   NtClose  (32, ... ) == 0x0
 00264   860   NtUnmapViewOfSection  (-1, 0x340000, ... ) == 0x0
 00265   860   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\IMM32.DLL"}, 1239328, ... ) }, 1239328, ... ) == 0x0
 00266   860   NtOpenFile  (0x100020, {24, 0, 0x40, 0, 0,  (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\IMM32.DLL"}, 5, 96, ... 32, {status=0x0, info=1}, ) }, 5, 96, ... 32, {status=0x0, info=1}, ) == 0x0
 00267   860   NtCreateSection  (0xe, 0x0, 0x0, 16, 134217728, 32, ... 28, ) == 0x0
 00268   860   NtClose  (32, ... ) == 0x0
 00269   860   NtMapViewOfSection  (28, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 16, ... (0x340000), 0x0, 110592, ) == 0x0
 00270   860   NtClose  (28, ... ) == 0x0
 00271   860   NtUnmapViewOfSection  (-1, 0x340000, ... ) == 0x0
 00272   860   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\IMM32.DLL"}, 1239636, ... ) }, 1239636, ... ) == 0x0
 00273   860   NtOpenFile  (0x100020, {24, 0, 0x40, 0, 0,  (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\IMM32.DLL"}, 5, 96, ... 28, {status=0x0, info=1}, ) }, 5, 96, ... 28, {status=0x0, info=1}, ) == 0x0
 00274   860   NtCreateSection  (0xf, 0x0, 0x0, 16, 16777216, 28, ... 32, ) == 0x0
 00275   860   NtQuerySection  (32, Image, 48, ... {section info, class 1, size 48}, 0x0, ) == 0x0
 00276   860   NtClose  (28, ... ) == 0x0
 00277   860   NtMapViewOfSection  (32, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x76390000), 0x0, 118784, ) == 0x0
 00278   860   NtClose  (32, ... ) == 0x0
 00279   860   NtProtectVirtualMemory  (-1, (0x76391000), 696, 4, ... (0x76391000), 4096, 32, ) == 0x0
 00280   860   NtProtectVirtualMemory  (-1, (0x76391000), 4096, 32, ... (0x76391000), 4096, 4, ) == 0x0
 00281   860   NtFlushInstructionCache  (-1, 1983451136, 696, ... ) == 0x0
 00282   860   NtProtectVirtualMemory  (-1, (0x76391000), 696, 4, ... (0x76391000), 4096, 32, ) == 0x0
 00283   860   NtProtectVirtualMemory  (-1, (0x76391000), 4096, 32, ... (0x76391000), 4096, 4, ) == 0x0
 00284   860   NtFlushInstructionCache  (-1, 1983451136, 696, ... ) == 0x0
 00285   860   NtProtectVirtualMemory  (-1, (0x76391000), 696, 4, ... (0x76391000), 4096, 32, ) == 0x0
 00286   860   NtProtectVirtualMemory  (-1, (0x76391000), 4096, 32, ... (0x76391000), 4096, 4, ) == 0x0
 00287   860   NtFlushInstructionCache  (-1, 1983451136, 696, ... ) == 0x0
 00288   860   NtOpenKey  (0x80000000, {24, 0, 0x40, 0, 0,  (0x80000000, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\IMM32.DLL"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00289   860   NtQuerySystemInformation  (Basic, 44, ... {Unknown=0,MaximumIncrement=156250,PhysicalPageSize=0x1000,NumberOfPhysicalPages=0xff7c,LowestPhysicalPage=0x1,HighestPhysicalPage=0xffff,AllocationGranularity=0x10000,LowestUserAddress=0x10000,HighestUserAddress=0x7ffeffff,ActiveProcessors=1,NumberProcessors=1,}, 0x0, ) == 0x0
 00290   860   NtAllocateVirtualMemory  (-1, 1228800, 0, 4096, 4096, 260, ... 1228800, 4096, ) == 0x0
 00291   860   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\IMM32.DLL"}, 1236552, ... ) }, 1236552, ... ) == 0x0
 00292   860   NtOpenKey  (0x80000000, {24, 0, 0x40, 0, 0,  (0x80000000, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ntdll.dll"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00293   860   NtOpenKey  (0x80000000, {24, 0, 0x40, 0, 0,  (0x80000000, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kernel32.dll"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00294   860   NtOpenKey  (0x80000000, {24, 0, 0x40, 0, 0,  (0x80000000, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\GDI32.dll"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00295   860   NtOpenKey  (0x80000000, {24, 0, 0x40, 0, 0,  (0x80000000, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ole32.dll"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00296   860   NtOpenKey  (0x80000000, {24, 0, 0x40, 0, 0,  (0x80000000, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\oleaut32.dll"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00297   860   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\IMM32.DLL"}, 1239956, ... ) }, 1239956, ... ) == 0x0
 00298   860   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\System\CurrentControlSet\Control\Error Message Instrument\"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00299   860   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\GRE_Initialize"}, ... 32, ) }, ... 32, ) == 0x0
 00300   860   NtQueryValueKey  (32,  (32, "DisableMetaFiles", Partial, 20, ... ) , Partial, 20, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00301   860   NtClose  (32, ... ) == 0x0
 00302   860   NtMapViewOfSection  (-2147482740, -1, (0x0), 0, 0, 0x0, 0, 2, 0, 2, ... (0x560000), 0x0, 1060864, ) == 0x0
 00303   860   NtClose  (-2147482740, ... ) == 0x0
 00304   860   NtCreateEvent  (0x1f0003, 0x0, 1, 0, ... 32, ) == 0x0
 00305   860   NtOpenThreadTokenEx  (-2, 0x8, 1, 512, ... ) == STATUS_NO_TOKEN
 00306   860   NtOpenProcessTokenEx  (-1, 0x8, 512, ... -2147482740, ) == 0x0
 00307   860   NtQueryInformationToken  (-2147482740, Statistics, 0, ... ) == STATUS_BUFFER_TOO_SMALL
 00308   860   NtQueryInformationToken  (-2147482740, Statistics, 56, ... {token info, class 10, size 56}, 56, ) == 0x0
 00309   860   NtClose  (-2147482740, ... ) == 0x0
 00310   860   NtAllocateVirtualMemory  (-1, 0, 0, 32, 4096, 4, ... 3407872, 4096, ) == 0x0
 00311   860   NtFreeVirtualMemory  (-1, (0x340000), 4096, 32768, ... (0x340000), 4096, ) == 0x0
 00312   860   NtDuplicateObject  (-1, 28, -1, 0x0, 0, 2, ... 40, ) == 0x0
 00313   860   NtOpenKey  (0x20019, {24, 0, 0x240, 0, 0,  (0x20019, {24, 0, 0x240, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Compatibility32"}, ... -2147482740, ) }, ... -2147482740, ) == 0x0
 00314   860   NtQueryValueKey  (-2147482740,  (-2147482740, "packed", Partial, 172, ... ) , Partial, 172, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00315   860   NtClose  (-2147482740, ... ) == 0x0
 00316   860   NtOpenKey  (0x20019, {24, 0, 0x240, 0, 0,  (0x20019, {24, 0, 0x240, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\IME Compatibility"}, ... -2147482740, ) }, ... -2147482740, ) == 0x0
 00317   860   NtQueryValueKey  (-2147482740,  (-2147482740, "packed", Partial, 172, ... ) , Partial, 172, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00318   860   NtClose  (-2147482740, ... ) == 0x0
 00319   860   NtQueryDefaultLocale  (0, -139609780, ... ) == 0x0
 00320   860   NtGdiQueryFontAssocInfo  (0, ... ) == 0x0
 00321   860   NtUserCallNoParam  (24, ... ) == 0x0
 00322   860   NtGdiCreateCompatibleDC  (0, ...
 00323   860   NtAllocateVirtualMemory  (-1, 0, 0, 4096, 12288, 4, ... 3407872, 4096, ) == 0x0
 00322   860   NtGdiCreateCompatibleDC  ... ) == 0xee0105b0
 00324   860   NtGdiGetStockObject  (0, ... ) == 0x1900010
 00325   860   NtGdiGetStockObject  (4, ... ) == 0x1900011
 00326   860   NtGdiCreateBitmap  (8, 8, 1, 1, 2118200212, ... ) == 0x76050581
 00327   860   NtGdiCreateSolidBrush  (0, 0, ...
 00328   860   NtAllocateVirtualMemory  (-1, 0, 0, 4096, 12288, 4, ... 3473408, 4096, ) == 0x0
 00327   860   NtGdiCreateSolidBrush  ... ) == 0xa51003d2
 00329   860   NtGdiGetStockObject  (13, ... ) == 0x18a0021
 00330   860   NtGdiCreateCompatibleDC  (0, ... ) == 0x5201039b
 00331   860   NtGdiSelectBitmap  (1375798171, 1980040577, ... ) == 0x185000f
 00332   860   NtUserGetThreadDesktop  (860, 0, ... ) == 0x24
 00333   860   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Windows"}, ... 44, ) }, ... 44, ) == 0x0
 00334   860   NtQueryValueKey  (44,  (44, "AppInit_DLLs", Partial, 64, ... TitleIdx=0, Type=1, Data="\0\0"}, 14, ) , Partial, 64, ... TitleIdx=0, Type=1, Data= (44, "AppInit_DLLs", Partial, 64, ... TitleIdx=0, Type=1, Data="\0\0"}, 14, ) }, 14, ) == 0x0
 00335   860   NtClose  (44, ... ) == 0x0
 00336   860   NtUserFindExistingCursorIcon  (1241132, 1241148, 1241196, ... ) == 0x10011
 00337   860   NtUserRegisterClassExWOW  (1241144, 1241212, 1241228, 1241244, 673, 128, 0, ... ) == 0x816ec017
 00338   860   NtUserFindExistingCursorIcon  (1241132, 1241148, 1241196, ... ) == 0x10011
 00339   860   NtUserRegisterClassExWOW  (1241144, 1241212, 1241228, 1241244, 674, 128, 0, ... ) == 0x816ec01c
 00340   860   NtUserFindExistingCursorIcon  (1241132, 1241148, 1241196, ... ) == 0x10011
 00341   860   NtUserRegisterClassExWOW  (1241144, 1241212, 1241228, 1241244, 675, 128, 0, ... ) == 0x816ec01e
 00342   860   NtUserFindExistingCursorIcon  (1241132, 1241148, 1241196, ... ) == 0x10011
 00343   860   NtUserRegisterClassExWOW  (1241144, 1241212, 1241228, 1241244, 676, 128, 0, ... ) == 0x816e8002
 00344   860   NtUserFindExistingCursorIcon  (1241132, 1241148, 1241196, ... ) == 0x10013
 00345   860   NtUserRegisterClassExWOW  (1241144, 1241212, 1241228, 1241244, 677, 128, 0, ... ) == 0x816ec018
 00346   860   NtUserFindExistingCursorIcon  (1241132, 1241148, 1241196, ... ) == 0x10011
 00347   860   NtUserRegisterClassExWOW  (1241144, 1241212, 1241228, 1241244, 678, 128, 0, ... ) == 0x816ec01a
 00348   860   NtUserFindExistingCursorIcon  (1241132, 1241148, 1241196, ... ) == 0x10011
 00349   860   NtUserRegisterClassExWOW  (1241144, 1241212, 1241228, 1241244, 679, 128, 0, ... ) == 0x816ec01d
 00350   860   NtUserFindExistingCursorIcon  (1241132, 1241148, 1241196, ... ) == 0x10011
 00351   860   NtUserRegisterClassExWOW  (1241144, 1241212, 1241228, 1241244, 681, 128, 0, ... ) == 0x816ec026
 00352   860   NtUserFindExistingCursorIcon  (1241132, 1241148, 1241196, ... ) == 0x10011
 00353   860   NtUserRegisterClassExWOW  (1241144, 1241212, 1241228, 1241244, 680, 128, 0, ... ) == 0x816ec019
 00354   860   NtUserRegisterClassExWOW  (1241096, 1241164, 1241180, 1241196, 0, 128, 0, ... ) == 0x816ec020
 00355   860   NtUserRegisterClassExWOW  (1241352, 1241448, 1241432, 1241420, 0, 130, 0, ... ) == 0x816ec022
 00356   860   NtUserRegisterClassExWOW  (1241096, 1241164, 1241180, 1241196, 0, 128, 0, ... ) == 0x816ec023
 00357   860   NtUserRegisterClassExWOW  (1241352, 1241448, 1241432, 1241420, 0, 130, 0, ... ) == 0x816ec024
 00358   860   NtUserRegisterClassExWOW  (1241096, 1241164, 1241180, 1241196, 0, 128, 0, ... ) == 0x816ec025
 00359   860   NtCallbackReturn  (0, 0, 0, ...
 00360   860   NtGdiInit  (... ) == 0x1
 00361   860   NtGdiGetStockObject  (18, ... ) == 0x290001c
 00362   860   NtGdiGetStockObject  (19, ... ) == 0x1b00019
 00363   860   NtAllocateVirtualMemory  (-1, 1331200, 0, 4096, 4096, 4, ... 1331200, 4096, ) == 0x0
 00364   860   NtOpenFile  (0x100001, {24, 0, 0x40, 0, 0,  (0x100001, {24, 0, 0x40, 0, 0, "\Device\KsecDD"}, 7, 16, ... 44, {status=0x0, info=0}, ) }, 7, 16, ... 44, {status=0x0, info=0}, ) == 0x0
 00365   860   NtDeviceIoControlFile  (44, 0, 0x0, 0x0, 0x390008,  (44, 0, 0x0, 0x0, 0x390008, "\324d\365\27\7%k\242F\356\34Y\334\15od\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0", 256, 256, ... , 256, 256, ...
 00366   860   NtQuerySystemInformation  (TimeOfDay, 48, ... {system info, class 3, size 48}, 48, ) == 0x0
 00367   860   NtQuerySystemInformation  (ProcessorTimes, 48, ... {system info, class 8, size 48}, 48, ) == 0x0
 00368   860   NtQuerySystemInformation  (Performance, 312, ... {system info, class 2, size 312}, 312, ) == 0x0
 00369   860   NtQuerySystemInformation  (Exception, 16, ... {system info, class 33, size 16}, 16, ) == 0x0
 00370   860   NtQuerySystemInformation  (Lookaside, 32, ... {system info, class 45, size 32}, 32, ) == 0x0
 00371   860   NtQuerySystemInformation  (ProcessorStatistics, 3016, ... {system info, class 23, size 0}, 0, ) == 0x0
 00372   860   NtQuerySystemInformation  (ProcessesAndThreads, 3008, ... ) == STATUS_INFO_LENGTH_MISMATCH
 00373   860   NtCreateKey  (0x2, {24, 0, 0x240, 0, 0,  (0x2, {24, 0, 0x240, 0, 0, "\Registry\Machine\SOFTWARE\Microsoft\Cryptography\RNG"}, 0, 0x0, 0, ... -2147482740, 2, ) }, 0, 0x0, 0, ... -2147482740, 2, ) == 0x0
 00374   860   NtSetValueKey  (-2147482740,  (-2147482740, "Seed", 0, 3, "\311\26v\352AQ\273\266\263?V\267\214\3704\2\322\303\34\332@\0\15\247}i\15!\225\313\2\334\341\273\337\5#y\306\254\30\304\321\277\10\302\207\367\371\234\23\313\260\230\361\243\233\320\342\240n\311\351\341\271\11;\216..&/\303c\252\w\303\3\300", 80, ... ) , 0, 3,  (-2147482740, "Seed", 0, 3, "\311\26v\352AQ\273\266\263?V\267\214\3704\2\322\303\34\332@\0\15\247}i\15!\225\313\2\334\341\273\337\5#y\306\254\30\304\321\277\10\302\207\367\371\234\23\313\260\230\361\243\233\320\342\240n\311\351\341\271\11;\216..&/\303c\252\w\303\3\300", 80, ... ) , 80, ... ) == 0x0
 00375   860   NtClose  (-2147482740, ... ) == 0x0
 00365   860   NtDeviceIoControlFile  ... {status=0x0, info=256},  ... {status=0x0, info=256}, "\203\323Aq\351\30\376\212\211\210\332\24\345$W0\354\10g\35rm\232j\337\303\0\237NA\217kT`F\365\350B\370\333(\245\36\|lm\225s\22\331\322\s\16_NIr\10\317\237\11s\270\23v\24i\3020\310O8\27314P\332\350Y\367\321^\315L\344\262\254x\35\26\35\222\14\12\373\337\322\243\367x\254D\356\224\302\314&\202W1\374\260\344\262!\274/.Uj\10\31\332\331#\243\22\26\226\333q6\221\241\200\321\265\236\364\3\350H8\361\4jm\316\350\250 \261\215\265\30x\30ja\262\361\11B\210\367\257\241^\376\274X\2\16\31\252\3\230~\367\247\\233\226\361\253Yvb\365\203z\30\363\300\257|\211\251(l\357\244n\301\353"45\15\273{JK\267\0\361\304\20\213\31"\276\214\201\356\213\22\261@\361E\354\340\245\4pY\210\1\315\372j\362)\277\2647\203\207\352\232\253\5\360", ) 45\15\273{JK\267\0\361\304\20\213\31 ... {status=0x0, info=256}, "\203\323Aq\351\30\376\212\211\210\332\24\345$W0\354\10g\35rm\232j\337\303\0\237NA\217kT`F\365\350B\370\333(\245\36\|lm\225s\22\331\322\s\16_NIr\10\317\237\11s\270\23v\24i\3020\310O8\27314P\332\350Y\367\321^\315L\344\262\254x\35\26\35\222\14\12\373\337\322\243\367x\254D\356\224\302\314&\202W1\374\260\344\262!\274/.Uj\10\31\332\331#\243\22\26\226\333q6\221\241\200\321\265\236\364\3\350H8\361\4jm\316\350\250 \261\215\265\30x\30ja\262\361\11B\210\367\257\241^\376\274X\2\16\31\252\3\230~\367\247\\233\226\361\253Yvb\365\203z\30\363\300\257|\211\251(l\357\244n\301\353"45\15\273{JK\267\0\361\304\20\213\31"\276\214\201\356\213\22\261@\361E\354\340\245\4pY\210\1\315\372j\362)\277\2647\203\207\352\232\253\5\360", ) , ) == 0x0
 00376   860   NtQuerySystemInformation  (Basic, 44, ... {Unknown=0,MaximumIncrement=156250,PhysicalPageSize=0x1000,NumberOfPhysicalPages=0xff7c,LowestPhysicalPage=0x1,HighestPhysicalPage=0xffff,AllocationGranularity=0x10000,LowestUserAddress=0x10000,HighestUserAddress=0x7ffeffff,ActiveProcessors=1,NumberProcessors=1,}, 0x0, ) == 0x0
 00377   860   NtQuerySystemInformation  (Processor, 12, ... {system info, class 1, size 12}, 0x0, ) == 0x0
 00378   860   NtOpenKey  (0x20019, {24, 16, 0x40, 0, 0,  (0x20019, {24, 16, 0x40, 0, 0, "SYSTEM\CurrentControlSet\Control\Session Manager"}, ... 48, ) }, ... 48, ) == 0x0
 00379   860   NtQueryValueKey  (48,  (48, "CriticalSectionTimeout", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\215'\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (48, "CriticalSectionTimeout", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\215'\0"}, 16, ) }, 16, ) == 0x0
 00380   860   NtClose  (48, ... ) == 0x0
 00381   860   NtOpenKey  (0x20019, {24, 16, 0x40, 0, 0,  (0x20019, {24, 16, 0x40, 0, 0, "Software\Microsoft\Ole"}, ... 48, ) }, ... 48, ) == 0x0
 00382   860   NtQueryValueKey  (48,  (48, "RWLockResourceTimeOut", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00383   860   NtClose  (48, ... ) == 0x0
 00384   860   NtQuerySystemInformation  (Basic, 44, ... {Unknown=0,MaximumIncrement=156250,PhysicalPageSize=0x1000,NumberOfPhysicalPages=0xff7c,LowestPhysicalPage=0x1,HighestPhysicalPage=0xffff,AllocationGranularity=0x10000,LowestUserAddress=0x10000,HighestUserAddress=0x7ffeffff,ActiveProcessors=1,NumberProcessors=1,}, 0x0, ) == 0x0
 00385   860   NtQuerySystemInformation  (Processor, 12, ... {system info, class 1, size 12}, 0x0, ) == 0x0
 00386   860   NtQuerySystemInformation  (Basic, 44, ... {Unknown=0,MaximumIncrement=156250,PhysicalPageSize=0x1000,NumberOfPhysicalPages=0xff7c,LowestPhysicalPage=0x1,HighestPhysicalPage=0xffff,AllocationGranularity=0x10000,LowestUserAddress=0x10000,HighestUserAddress=0x7ffeffff,ActiveProcessors=1,NumberProcessors=1,}, 0x0, ) == 0x0
 00387   860   NtQuerySystemInformation  (Processor, 12, ... {system info, class 1, size 12}, 0x0, ) == 0x0
 00388   860   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Classes\Interface"}, ... 48, ) }, ... 48, ) == 0x0
 00389   860   NtQueryValueKey  (48,  (48, "InterfaceHelperDisableAll", Full, 0, ... ) , Full, 0, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00390   860   NtQueryValueKey  (48,  (48, "InterfaceHelperDisableAllForOle32", Full, 0, ... ) , Full, 0, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00391   860   NtQueryValueKey  (48,  (48, "InterfaceHelperDisableTypeLib", Full, 0, ... ) , Full, 0, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00392   860   NtClose  (48, ... ) == 0x0
 00393   860   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Classes\Interface\{00020400-0000-0000-C000-000000000046}"}, ... 48, ) }, ... 48, ) == 0x0
 00394   860   NtQueryValueKey  (48,  (48, "InterfaceHelperDisableAll", Full, 0, ... ) , Full, 0, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00395   860   NtQueryValueKey  (48,  (48, "InterfaceHelperDisableAllForOle32", Full, 0, ... ) , Full, 0, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00396   860   NtClose  (48, ... ) == 0x0
 00397   860   NtOpenDirectoryObject  (0x2000f, {24, 0, 0x40, 0, 0,  (0x2000f, {24, 0, 0x40, 0, 0, "\BaseNamedObjects"}, ... 48, ) }, ... 48, ) == 0x0
 00398   860   NtOpenEvent  (0x1f0003, {24, 48, 0x0, 0, 0,  (0x1f0003, {24, 48, 0x0, 0, 0, "HookSwitchHookEnabledEvent"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00399   860   NtUserRegisterWindowMessage  ( ("{FB8F0821-0164-101B-84ED-08002B2EC713}", ... ) , ... ) == 0xc077
 00400   860   NtOpenKey  (0x1, {24, 16, 0x40, 0, 0,  (0x1, {24, 16, 0x40, 0, 0, "SOFTWARE\Microsoft\OLEAUT"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00401   860   NtOpenKey  (0x9, {24, 16, 0x40, 0, 0,  (0x9, {24, 16, 0x40, 0, 0, "SOFTWARE\Microsoft\OLEAUT\UserEra"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00402   860   NtOpenKey  (0x1, {24, 16, 0x40, 0, 0,  (0x1, {24, 16, 0x40, 0, 0, "SOFTWARE\Microsoft\OLEAUT"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00403   860   NtTestAlert  (... ) == 0x0
 00404   860   NtContinue  (1244464, 1, ...
 00405   860   NtSetInformationThread  (-2, Win32StartAddress(LpcReceivedMessageId), {StartAddress(LpcReceivedMsgId)=0x401000,}, 4, ... ) == 0x0
 00406   860   NtQueryVirtualMemory  (-1, 0x401009, Basic, 28, ... {BaseAddress=0x401000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x60000,State=0x1000,Protect=0x80,Type=0x1000000,}, 28, ) == 0x0
 00407   860   NtContinue  (1244268, 0, ...
 00408   860   NtCreateEvent  (0x1f0003, {24, 48, 0x80, 1245092, 0,  (0x1f0003, {24, 48, 0x80, 1245092, 0, "VT_3"}, 1, 0, ... 52, ) }, 1, 0, ... 52, ) == 0x0
 00409   860   NtCreateSection  (0xe, {24, 0, 0x40, 1245092, 0,  (0xe, {24, 0, 0x40, 1245092, 0, "\BaseNamedObjects\W32_Virtu"}, {27086, 0}, 64, 134217728, 0, ... 56, ) }, {27086, 0}, 64, 134217728, 0, ... 56, ) == 0x0
 00410   860   NtMapViewOfSection  (56, -1, (0x0), 0, 27086, 0x0, 27086, 2, 0, 64, ... (0x360000), 0x0, 28672, ) == 0x0
 00411   860   NtOpenProcessToken  (-1, 0x20, ... 60, ) == 0x0
 00412   860   NtQuerySystemInformation  (Basic, 44, ... {Unknown=0,MaximumIncrement=156250,PhysicalPageSize=0x1000,NumberOfPhysicalPages=0xff7c,LowestPhysicalPage=0x1,HighestPhysicalPage=0xffff,AllocationGranularity=0x10000,LowestUserAddress=0x10000,HighestUserAddress=0x7ffeffff,ActiveProcessors=1,NumberProcessors=1,}, 0x0, ) == 0x0
 00413   860   NtOpenKey  (0x20019, {24, 16, 0x40, 0, 0,  (0x20019, {24, 16, 0x40, 0, 0, "Software\Microsoft\Rpc\PagedBuffers"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00414   860   NtOpenKey  (0x20019, {24, 16, 0x40, 0, 0,  (0x20019, {24, 16, 0x40, 0, 0, "Software\Microsoft\Rpc"}, ... 64, ) }, ... 64, ) == 0x0
 00415   860   NtQueryValueKey  (64,  (64, "MaxRpcSize", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00416   860   NtClose  (64, ... ) == 0x0
 00417   860   NtOpenKey  (0x20019, {24, 16, 0x40, 0, 0,  (0x20019, {24, 16, 0x40, 0, 0, "Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\packed.exe\RpcThreadPoolThrottle"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00418   860   NtCreateEvent  (0x1f0003, 0x0, 1, 0, ... 64, ) == 0x0
 00419   860   NtCreateEvent  (0x1f0003, 0x0, 1, 0, ... 68, ) == 0x0
 00420   860   NtQuerySystemTime  (... {-249058212, 29916846}, ) == 0x0
 00421   860   NtAllocateVirtualMemory  (-1, 1335296, 0, 4096, 4096, 4, ... 1335296, 4096, ) == 0x0
 00422   860   NtCreateEvent  (0x1f0003, 0x0, 0, 0, ... 72, ) == 0x0
 00423   860   NtOpenKey  (0x20019, {24, 16, 0x40, 0, 0,  (0x20019, {24, 16, 0x40, 0, 0, "Software\Policies\Microsoft\Windows NT\Rpc"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00424   860   NtQuerySystemInformation  (Performance, 312, ... {system info, class 2, size 312}, 0x0, ) == 0x0
 00425   860   NtQueryInformationProcess  (-1, QuotaLimits, 32, ... {process info, class 1, size 32}, 0x0, ) == 0x0
 00426   860   NtQueryInformationProcess  (-1, VmCounters, 44, ... {process info, class 3, size 44}, 0x0, ) == 0x0
 00427   860   NtCreateEvent  (0x1f0003, 0x0, 0, 0, ... 76, ) == 0x0
 00428   860   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ... 80, ) == 0x0
 00429   860   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\System\CurrentControlSet\Control\ComputerName"}, ... 84, ) }, ... 84, ) == 0x0
 00430   860   NtOpenKey  (0x20019, {24, 84, 0x40, 0, 0,  (0x20019, {24, 84, 0x40, 0, 0, "ActiveComputerName"}, ... 88, ) }, ... 88, ) == 0x0
 00431   860   NtQueryValueKey  (88,  (88, "ComputerName", Full, 108, ... TitleIdx=0, Type=1, Name="ComputerName", Data="V\0I\0R\0T\0U\0A\0L\0\0\0"}, 60, ) , Full, 108, ... TitleIdx=0, Type=1, Name= (88, "ComputerName", Full, 108, ... TitleIdx=0, Type=1, Name="ComputerName", Data="V\0I\0R\0T\0U\0A\0L\0\0\0"}, 60, ) , Data= (88, "ComputerName", Full, 108, ... TitleIdx=0, Type=1, Name="ComputerName", Data="V\0I\0R\0T\0U\0A\0L\0\0\0"}, 60, ) }, 60, ) == 0x0
 00432   860   NtClose  (88, ... ) == 0x0
 00433   860   NtClose  (84, ... ) == 0x0
 00434   860   NtCreateIoCompletion  (0x1f0003, 0x0, 0, ... 84, ) == 0x0
 00435   860   NtCreateIoCompletion  (0x1f0003, 0x0, -1, ... 88, ) == 0x0
 00436   860   NtDuplicateObject  (-1, 84, -1, 0x0, 0, 2, ... 92, ) == 0x0
 00437   860   NtOpenThreadToken  (-2, 0xc, 1, ... ) == STATUS_NO_TOKEN
 00438   860   NtAllocateVirtualMemory  (-1, 1339392, 0, 4096, 4096, 4, ... 1339392, 4096, ) == 0x0
 00439   860   NtCreateEvent  (0x1f0003, 0x0, 1, 0, ... 96, ) == 0x0
 00440   860   NtOpenThreadToken  (-2, 0xc, 1, ... ) == STATUS_NO_TOKEN
 00441   860   NtSetInformationThread  (-2, ImpersonationToken, {ImpToken=0,}, 4, ... ) == 0x0
 00442   860   NtCreateFile  (0xc0100080, {24, 0, 0x40, 0, 1243252,  (0xc0100080, {24, 0, 0x40, 0, 1243252, "\??\PIPE\lsarpc"}, 0x0, 0, 3, 1, 64, 0, 0, ... 100, {status=0x0, info=1}, ) }, 0x0, 0, 3, 1, 64, 0, 0, ... 100, {status=0x0, info=1}, ) == 0x0
 00443   860   NtSetInformationFile  (100, 1243308, 8, Pipe, ... {status=0x0, info=0}, ) == 0x0
 00444   860   NtSetInformationFile  (100, 1243296, 8, Completion, ... {status=0x0, info=0}, ) == 0x0
 00445   860   NtSetInformationThread  (-2, ImpersonationToken, {ImpToken=0,}, 4, ... ) == 0x0
 00446   860   NtWriteFile  (100, 77, 0, 0,  (100, 77, 0, 0, "\5\0\13\3\20\0\0\0H\0\0\0\1\0\0\0\270\20\270\20\0\0\0\0\1\0\0\0\0\0\1\0xW4\224\22\315\253\357\0\1#Eg\211\253\0\0\0\0\4]\210\212\353\34\311\21\237\350\10\0+\20H`\2\0\0\0", 72, {0, 0}, 0, ... {status=0x0, info=72}, ) , 72, {0, 0}, 0, ... {status=0x0, info=72}, ) == 0x0
 00447   860   NtReadFile  (100, 77, 0, 0, 1024, {0, 0}, 0, ... {status=0x0, info=68},  (100, 77, 0, 0, 1024, {0, 0}, 0, ... {status=0x0, info=68}, "\5\0\14\3\20\0\0\0D\0\0\0\1\0\0\0\270\20\270\20++\0\0\14\0\PIPE\lsass\0\0\0\1\0\0\0\0\0\0\0\4]\210\212\353\34\311\21\237\350\10\0+\20H`\2\0\0\0", ) , ) == 0x0
 00448   860   NtFsControlFile  (100, 77, 0x0, 0x0, 0x11c017,  (100, 77, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0@\0\0\0\1\0\0\0(\0\0\0\0\0,\0\0\0\0\0\30\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0<\377\22\0\14\0\0\0\2\0\1\0\0\10\0\0", 64, 1024, ... {status=0x103, info=68}, "\5\0\14\3\20\0\0\0D\0\0\0\1\0\0\0\270\20\270\20++\0\0\14\0\PIPE\lsass\0\0\0\1\0\0\0\0\0\0\0\4]\210\212\353\34\311\21\237\350\10\0+\20H`\2\0\0\0", ) , 64, 1024, ... {status=0x103, info=68},  (100, 77, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0@\0\0\0\1\0\0\0(\0\0\0\0\0,\0\0\0\0\0\30\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0<\377\22\0\14\0\0\0\2\0\1\0\0\10\0\0", 64, 1024, ... {status=0x103, info=68}, "\5\0\14\3\20\0\0\0D\0\0\0\1\0\0\0\270\20\270\20++\0\0\14\0\PIPE\lsass\0\0\0\1\0\0\0\0\0\0\0\4]\210\212\353\34\311\21\237\350\10\0+\20H`\2\0\0\0", ) , ) == 0x103
 00449   860   NtFsControlFile  (100, 77, 0x0, 0x0, 0x11c017,  (100, 77, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0`\0\0\0\2\0\0\0H\0\0\0\0\0\37\0\0\0\0\0\266\275.l\215\373FC\227[\347p\214Nse \0"\0\300X\24\0\21\0\0\0\0\0\0\0\20\0\0\0S\0e\0D\0e\0b\0u\0g\0P\0r\0i\0v\0i\0l\0e\0g\0e\0", 96, 1024, ... {status=0x103, info=48}, "\5\0\2\3\20\0\0\00\0\0\0\1\0\0\0\30\0\0\0\0\0\0\0\0\0\0\0\266\275.l\215\373FC\227[\347p\214Nse\0\0\0\0", ) \0\300X\24\0\21\0\0\0\0\0\0\0\20\0\0\0S\0e\0D\0e\0b\0u\0g\0P\0r\0i\0v\0i\0l\0e\0g\0e\0 (100, 77, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0`\0\0\0\2\0\0\0H\0\0\0\0\0\37\0\0\0\0\0\266\275.l\215\373FC\227[\347p\214Nse \0"\0\300X\24\0\21\0\0\0\0\0\0\0\20\0\0\0S\0e\0D\0e\0b\0u\0g\0P\0r\0i\0v\0i\0l\0e\0g\0e\0", 96, 1024, ... {status=0x103, info=48}, "\5\0\2\3\20\0\0\00\0\0\0\1\0\0\0\30\0\0\0\0\0\0\0\0\0\0\0\266\275.l\215\373FC\227[\347p\214Nse\0\0\0\0", ) \5\0\2\3\20\0\0\00\0\0\0\1\0\0\0\30\0\0\0\0\0\0\0\0\0\0\0\266\275.l\215\373FC\227[\347p\214Nse\0\0\0\0", ) == 0x103
 00450   860   NtFsControlFile  (100, 77, 0x0, 0x0, 0x11c017,  (100, 77, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0,\0\0\0\3\0\0\0\24\0\0\0\0\0\0\0\0\0\0\0\266\275.l\215\373FC\227[\347p\214Nse", 44, 1024, ... {status=0x103, info=36}, "\5\0\2\3\20\0\0\0$\0\0\0\2\0\0\0\14\0\0\0\0\0\0\0\24\0\0\0\0\0\0\0\0\0\0\0", ) , 44, 1024, ... {status=0x103, info=36},  (100, 77, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0,\0\0\0\3\0\0\0\24\0\0\0\0\0\0\0\0\0\0\0\266\275.l\215\373FC\227[\347p\214Nse", 44, 1024, ... {status=0x103, info=36}, "\5\0\2\3\20\0\0\0$\0\0\0\2\0\0\0\14\0\0\0\0\0\0\0\24\0\0\0\0\0\0\0\0\0\0\0", ) , ) == 0x103
 00451   860   NtClose  (96, ... ) == 0x0
 00452   860   NtClose  (100, ... ) == 0x0
 00453   860   NtAdjustPrivilegesToken  (60, 0, 1245096, 0, 0, 0, ... ) == 0x0
 00454   860   NtClose  (60, ... ) == 0x0
 00455   860   NtAllocateVirtualMemory  (-1, 0, 0, 65536, 4096, 4, ... 3604480, 65536, ) == 0x0
 00456   860   NtQuerySystemInformation  (ProcessesAndThreads, 65536, ... {system info, class 5, size 500}, 0x0, ) == 0x0
 00457   860   NtCreateSection  (0xf0007, 0x0, {18400, 0}, 4, 134217728, 0, ... 60, ) == 0x0
 00458   860   NtMapViewOfSection  (60, -1, (0x0), 0, 0, {0, 0}, 0, 1, 0, 4, ... (0x380000), {0, 0}, 20480, ) == 0x0
 00459   860   NtUnmapViewOfSection  (-1, 0x380000, ... ) == 0x0
 00460   860   NtMapViewOfSection  (60, -1, (0x0), 0, 0, {0, 0}, 0, 1, 0, 4, ... (0x380000), {0, 0}, 20480, ) == 0x0
 00461   860   NtFreeVirtualMemory  (-1, (0x370000), 0, 32768, ... (0x370000), 65536, ) == 0x0
 00462   860   NtUnmapViewOfSection  (-1, 0x380000, ... ) == 0x0
 00463   860   NtMapViewOfSection  (60, -1, (0x0), 0, 0, {0, 0}, 0, 1, 0, 4, ... (0x370000), {0, 0}, 20480, ) == 0x0
 00464   860   NtUnmapViewOfSection  (-1, 0x370000, ... ) == 0x0
 00465   860   NtMapViewOfSection  (60, -1, (0x0), 0, 0, {0, 0}, 0, 1, 0, 4, ... (0x370000), {0, 0}, 20480, ) == 0x0
 00466   860   NtUnmapViewOfSection  (-1, 0x370000, ... ) == 0x0
 00467   860   NtMapViewOfSection  (60, -1, (0x0), 0, 0, {0, 0}, 0, 1, 0, 4, ... (0x370000), {0, 0}, 20480, ) == 0x0
 00468   860   NtUnmapViewOfSection  (-1, 0x370000, ... ) == 0x0
 00469   860   NtMapViewOfSection  (60, -1, (0x0), 0, 0, {0, 0}, 0, 1, 0, 4, ... (0x370000), {0, 0}, 20480, ) == 0x0
 00470   860   NtUnmapViewOfSection  (-1, 0x370000, ... ) == 0x0
 00471   860   NtMapViewOfSection  (60, -1, (0x0), 0, 0, {0, 0}, 0, 1, 0, 4, ... (0x370000), {0, 0}, 20480, ) == 0x0
 00472   860   NtUnmapViewOfSection  (-1, 0x370000, ... ) == 0x0
 00473   860   NtOpenProcess  (0x2a, {24, 0, 0x0, 0, 0, 0x0}, {580, 0}, ... 100, ) == 0x0
 00474   860   NtOpenSection  (0xe, {24, 48, 0x0, 0, 0,  (0xe, {24, 48, 0x0, 0, 0, "W32_Virtu"}, ... 96, ) }, ... 96, ) == 0x0
 00475   860   NtMapViewOfSection  (96, 100, (0x0), 0, 27086, 0x0, 27086, 2, 1048576, 64, ... (0x7ff90000), 0x0, 28672, ) == 0x0
 00476   860   NtClose  (96, ... ) == 0x0
 00477   860   NtProtectVirtualMemory  (100, (0x7c90d682), 5, 64, ... (0x7c90d000), 4096, 32, ) == 0x0
 00478   860   NtWriteVirtualMemory  (100, 0x7c90d682,  (100, 0x7c90d682, "\350\15Mh\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00479   860   NtProtectVirtualMemory  (100, (0x7c90dcfd), 5, 64, ... (0x7c90d000), 4096, 64, ) == 0x0
 00480   860   NtWriteVirtualMemory  (100, 0x7c90dcfd,  (100, 0x7c90dcfd, "\350\337Fh\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00481   860   NtProtectVirtualMemory  (100, (0x7c90d754), 5, 64, ... (0x7c90d000), 4096, 64, ) == 0x0
 00482   860   NtWriteVirtualMemory  (100, 0x7c90d754,  (100, 0x7c90d754, "\350\217Lh\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00483   860   NtProtectVirtualMemory  (100, (0x7c90d769), 5, 64, ... (0x7c90d000), 4096, 64, ) == 0x0
 00484   860   NtWriteVirtualMemory  (100, 0x7c90d769,  (100, 0x7c90d769, "\350\207Lh\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00485   860   NtAllocateVirtualMemory  (100, 0, 0, 1048576, 8192, 4, ... 27852800, 1048576, ) == 0x0
 00486   860   NtAllocateVirtualMemory  (100, 28893184, 0, 8192, 4096, 4, ... 28893184, 8192, ) == 0x0
 00487   860   NtProtectVirtualMemory  (100, (0x1b8e000), 4096, 260, ... (0x1b8e000), 4096, 4, ) == 0x0
 00488   860   NtCreateThread  (0x1f03ff, 0x0, 100, 1243840, 1243784, 1, ... 96, {580, 1956}, ) == 0x0
 00489   860   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 0, 0, 0, 0}  (24, {28, 56, new_msg, 0, 0, 0, 0, 0} "\0\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0`\0\0\0D\2\0\0\244\7\0\0" ... {28, 56, reply, 0, 464, 860, 57968, 0} "\0\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0`\0\0\0D\2\0\0\244\7\0\0" )  ... {28, 56, reply, 0, 464, 860, 57968, 0}  (24, {28, 56, new_msg, 0, 0, 0, 0, 0} "\0\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0`\0\0\0D\2\0\0\244\7\0\0" ... {28, 56, reply, 0, 464, 860, 57968, 0} "\0\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0`\0\0\0D\2\0\0\244\7\0\0" )  ) == 0x0
 00490   860   NtResumeThread  (96, ... 1, ) == 0x0
 00491   860   NtDelayExecution  (0, {-100000, -1}, ... ) == 0x0
 00492   860   NtClose  (100, ... ) == 0x0
 00493   860   NtMapViewOfSection  (60, -1, (0x0), 0, 0, {0, 0}, 0, 1, 0, 4, ... (0x370000), {0, 0}, 20480, ) == 0x0
 00494   860   NtUnmapViewOfSection  (-1, 0x370000, ... ) == 0x0
 00495   860   NtOpenProcess  (0x2a, {24, 0, 0x0, 0, 0, 0x0}, {640, 0}, ... 100, ) == 0x0
 00496   860   NtOpenSection  (0xe, {24, 48, 0x0, 0, 0,  (0xe, {24, 48, 0x0, 0, 0, "W32_Virtu"}, ... 104, ) }, ... 104, ) == 0x0
 00497   860   NtMapViewOfSection  (104, 100, (0x0), 0, 27086, 0x0, 27086, 2, 1048576, 64, ... (0x7ff90000), 0x0, 28672, ) == 0x0
 00498   860   NtClose  (104, ... ) == 0x0
 00499   860   NtProtectVirtualMemory  (100, (0x7c90d682), 5, 64, ... (0x7c90d000), 4096, 32, ) == 0x0
 00500   860   NtWriteVirtualMemory  (100, 0x7c90d682,  (100, 0x7c90d682, "\350\15Mh\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00501   860   NtProtectVirtualMemory  (100, (0x7c90dcfd), 5, 64, ... (0x7c90d000), 4096, 64, ) == 0x0
 00502   860   NtWriteVirtualMemory  (100, 0x7c90dcfd,  (100, 0x7c90dcfd, "\350\337Fh\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00503   860   NtProtectVirtualMemory  (100, (0x7c90d754), 5, 64, ... (0x7c90d000), 4096, 64, ) == 0x0
 00504   860   NtWriteVirtualMemory  (100, 0x7c90d754,  (100, 0x7c90d754, "\350\217Lh\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00505   860   NtProtectVirtualMemory  (100, (0x7c90d769), 5, 64, ... (0x7c90d000), 4096, 64, ) == 0x0
 00506   860   NtWriteVirtualMemory  (100, 0x7c90d769,  (100, 0x7c90d769, "\350\207Lh\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00507   860   NtClose  (100, ... ) == 0x0
 00508   860   NtMapViewOfSection  (60, -1, (0x0), 0, 0, {0, 0}, 0, 1, 0, 4, ... (0x370000), {0, 0}, 20480, ) == 0x0
 00509   860   NtUnmapViewOfSection  (-1, 0x370000, ... ) == 0x0
 00510   860   NtOpenProcess  (0x2a, {24, 0, 0x0, 0, 0, 0x0}, {652, 0}, ... 100, ) == 0x0
 00511   860   NtOpenSection  (0xe, {24, 48, 0x0, 0, 0,  (0xe, {24, 48, 0x0, 0, 0, "W32_Virtu"}, ... 104, ) }, ... 104, ) == 0x0
 00512   860   NtMapViewOfSection  (104, 100, (0x0), 0, 27086, 0x0, 27086, 2, 1048576, 64, ... (0x7ff90000), 0x0, 28672, ) == 0x0
 00513   860   NtClose  (104, ... ) == 0x0
 00514   860   NtProtectVirtualMemory  (100, (0x7c90d682), 5, 64, ... (0x7c90d000), 4096, 32, ) == 0x0
 00515   860   NtWriteVirtualMemory  (100, 0x7c90d682,  (100, 0x7c90d682, "\350\15Mh\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00516   860   NtProtectVirtualMemory  (100, (0x7c90dcfd), 5, 64, ... (0x7c90d000), 4096, 64, ) == 0x0
 00517   860   NtWriteVirtualMemory  (100, 0x7c90dcfd,  (100, 0x7c90dcfd, "\350\337Fh\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00518   860   NtProtectVirtualMemory  (100, (0x7c90d754), 5, 64, ... (0x7c90d000), 4096, 64, ) == 0x0
 00519   860   NtWriteVirtualMemory  (100, 0x7c90d754,  (100, 0x7c90d754, "\350\217Lh\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00520   860   NtProtectVirtualMemory  (100, (0x7c90d769), 5, 64, ... (0x7c90d000), 4096, 64, ) == 0x0
 00521   860   NtWriteVirtualMemory  (100, 0x7c90d769,  (100, 0x7c90d769, "\350\207Lh\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00522   860   NtClose  (100, ... ) == 0x0
 00523   860   NtMapViewOfSection  (60, -1, (0x0), 0, 0, {0, 0}, 0, 1, 0, 4, ... (0x370000), {0, 0}, 20480, ) == 0x0
 00524   860   NtUnmapViewOfSection  (-1, 0x370000, ... ) == 0x0
 00525   860   NtOpenProcess  (0x2a, {24, 0, 0x0, 0, 0, 0x0}, {816, 0}, ... 100, ) == 0x0
 00526   860   NtOpenSection  (0xe, {24, 48, 0x0, 0, 0,  (0xe, {24, 48, 0x0, 0, 0, "W32_Virtu"}, ... 104, ) }, ... 104, ) == 0x0
 00527   860   NtMapViewOfSection  (104, 100, (0x0), 0, 27086, 0x0, 27086, 2, 1048576, 64, ... (0x7ffa0000), 0x0, 28672, ) == 0x0
 00528   860   NtClose  (104, ... ) == 0x0
 00529   860   NtProtectVirtualMemory  (100, (0x7c90d682), 5, 64, ... (0x7c90d000), 4096, 32, ) == 0x0
 00530   860   NtWriteVirtualMemory  (100, 0x7c90d682,  (100, 0x7c90d682, "\350\15Mi\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00531   860   NtProtectVirtualMemory  (100, (0x7c90dcfd), 5, 64, ... (0x7c90d000), 4096, 64, ) == 0x0
 00532   860   NtWriteVirtualMemory  (100, 0x7c90dcfd,  (100, 0x7c90dcfd, "\350\337Fi\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00533   860   NtProtectVirtualMemory  (100, (0x7c90d754), 5, 64, ... (0x7c90d000), 4096, 64, ) == 0x0
 00534   860   NtWriteVirtualMemory  (100, 0x7c90d754,  (100, 0x7c90d754, "\350\217Li\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00535   860   NtProtectVirtualMemory  (100, (0x7c90d769), 5, 64, ... (0x7c90d000), 4096, 64, ) == 0x0
 00536   860   NtWriteVirtualMemory  (100, 0x7c90d769,  (100, 0x7c90d769, "\350\207Li\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00537   860   NtClose  (100, ... ) == 0x0
 00538   860   NtMapViewOfSection  (60, -1, (0x0), 0, 0, {0, 0}, 0, 1, 0, 4, ... (0x370000), {0, 0}, 20480, ) == 0x0
 00539   860   NtUnmapViewOfSection  (-1, 0x370000, ... ) == 0x0
 00540   860   NtOpenProcess  (0x2a, {24, 0, 0x0, 0, 0, 0x0}, {904, 0}, ... 100, ) == 0x0
 00541   860   NtOpenSection  (0xe, {24, 48, 0x0, 0, 0,  (0xe, {24, 48, 0x0, 0, 0, "W32_Virtu"}, ... 104, ) }, ... 104, ) == 0x0
 00542   860   NtMapViewOfSection  (104, 100, (0x0), 0, 27086, 0x0, 27086, 2, 1048576, 64, ... (0x7ffa0000), 0x0, 28672, ) == 0x0
 00543   860   NtClose  (104, ... ) == 0x0
 00544   860   NtProtectVirtualMemory  (100, (0x7c90d682), 5, 64, ... (0x7c90d000), 4096, 32, ) == 0x0
 00545   860   NtWriteVirtualMemory  (100, 0x7c90d682,  (100, 0x7c90d682, "\350\15Mi\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00546   860   NtProtectVirtualMemory  (100, (0x7c90dcfd), 5, 64, ... (0x7c90d000), 4096, 64, ) == 0x0
 00547   860   NtWriteVirtualMemory  (100, 0x7c90dcfd,  (100, 0x7c90dcfd, "\350\337Fi\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00548   860   NtProtectVirtualMemory  (100, (0x7c90d754), 5, 64, ... (0x7c90d000), 4096, 64, ) == 0x0
 00549   860   NtWriteVirtualMemory  (100, 0x7c90d754,  (100, 0x7c90d754, "\350\217Li\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00550   860   NtProtectVirtualMemory  (100, (0x7c90d769), 5, 64, ... (0x7c90d000), 4096, 64, ) == 0x0
 00551   860   NtWriteVirtualMemory  (100, 0x7c90d769,  (100, 0x7c90d769, "\350\207Li\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00552   860   NtClose  (100, ... ) == 0x0
 00553   860   NtMapViewOfSection  (60, -1, (0x0), 0, 0, {0, 0}, 0, 1, 0, 4, ... (0x370000), {0, 0}, 20480, ) == 0x0
 00554   860   NtUnmapViewOfSection  (-1, 0x370000, ... ) == 0x0
 00555   860   NtOpenProcess  (0x2a, {24, 0, 0x0, 0, 0, 0x0}, {1000, 0}, ... 100, ) == 0x0
 00556   860   NtOpenSection  (0xe, {24, 48, 0x0, 0, 0,  (0xe, {24, 48, 0x0, 0, 0, "W32_Virtu"}, ... 104, ) }, ... 104, ) == 0x0
 00557   860   NtMapViewOfSection  (104, 100, (0x0), 0, 27086, 0x0, 27086, 2, 1048576, 64, ... (0x7ff50000), 0x0, 28672, ) == 0x0
 00558   860   NtClose  (104, ... ) == 0x0
 00559   860   NtProtectVirtualMemory  (100, (0x7c90d682), 5, 64, ... (0x7c90d000), 4096, 32, ) == 0x0
 00560   860   NtWriteVirtualMemory  (100, 0x7c90d682,  (100, 0x7c90d682, "\350\15Md\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00561   860   NtProtectVirtualMemory  (100, (0x7c90dcfd), 5, 64, ... (0x7c90d000), 4096, 64, ) == 0x0
 00562   860   NtWriteVirtualMemory  (100, 0x7c90dcfd,  (100, 0x7c90dcfd, "\350\337Fd\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00563   860   NtProtectVirtualMemory  (100, (0x7c90d754), 5, 64, ... (0x7c90d000), 4096, 64, ) == 0x0
 00564   860   NtWriteVirtualMemory  (100, 0x7c90d754,  (100, 0x7c90d754, "\350\217Ld\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00565   860   NtProtectVirtualMemory  (100, (0x7c90d769), 5, 64, ... (0x7c90d000), 4096, 64, ) == 0x0
 00566   860   NtWriteVirtualMemory  (100, 0x7c90d769,  (100, 0x7c90d769, "\350\207Ld\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00567   860   NtClose  (100, ... ) == 0x0
 00568   860   NtMapViewOfSection  (60, -1, (0x0), 0, 0, {0, 0}, 0, 1, 0, 4, ... (0x370000), {0, 0}, 20480, ) == 0x0
 00569   860   NtUnmapViewOfSection  (-1, 0x370000, ... ) == 0x0
 00570   860   NtOpenProcess  (0x2a, {24, 0, 0x0, 0, 0, 0x0}, {1044, 0}, ... 100, ) == 0x0
 00571   860   NtOpenSection  (0xe, {24, 48, 0x0, 0, 0,  (0xe, {24, 48, 0x0, 0, 0, "W32_Virtu"}, ... 104, ) }, ... 104, ) == 0x0
 00572   860   NtMapViewOfSection  (104, 100, (0x0), 0, 27086, 0x0, 27086, 2, 1048576, 64, ... (0x7ffa0000), 0x0, 28672, ) == 0x0
 00573   860   NtClose  (104, ... ) == 0x0
 00574   860   NtProtectVirtualMemory  (100, (0x7c90d682), 5, 64, ... (0x7c90d000), 4096, 32, ) == 0x0
 00575   860   NtWriteVirtualMemory  (100, 0x7c90d682,  (100, 0x7c90d682, "\350\15Mi\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00576   860   NtProtectVirtualMemory  (100, (0x7c90dcfd), 5, 64, ... (0x7c90d000), 4096, 64, ) == 0x0
 00577   860   NtWriteVirtualMemory  (100, 0x7c90dcfd,  (100, 0x7c90dcfd, "\350\337Fi\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00578   860   NtProtectVirtualMemory  (100, (0x7c90d754), 5, 64, ... (0x7c90d000), 4096, 64, ) == 0x0
 00579   860   NtWriteVirtualMemory  (100, 0x7c90d754,  (100, 0x7c90d754, "\350\217Li\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00580   860   NtProtectVirtualMemory  (100, (0x7c90d769), 5, 64, ... (0x7c90d000), 4096, 64, ) == 0x0
 00581   860   NtWriteVirtualMemory  (100, 0x7c90d769,  (100, 0x7c90d769, "\350\207Li\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00582   860   NtClose  (100, ... ) == 0x0
 00583   860   NtMapViewOfSection  (60, -1, (0x0), 0, 0, {0, 0}, 0, 1, 0, 4, ... (0x370000), {0, 0}, 20480, ) == 0x0
 00584   860   NtUnmapViewOfSection  (-1, 0x370000, ... ) == 0x0
 00585   860   NtOpenProcess  (0x2a, {24, 0, 0x0, 0, 0, 0x0}, {1196, 0}, ... 100, ) == 0x0
 00586   860   NtOpenSection  (0xe, {24, 48, 0x0, 0, 0,  (0xe, {24, 48, 0x0, 0, 0, "W32_Virtu"}, ... 104, ) }, ... 104, ) == 0x0
 00587   860   NtMapViewOfSection  (104, 100, (0x0), 0, 27086, 0x0, 27086, 2, 1048576, 64, ... (0x7ffa0000), 0x0, 28672, ) == 0x0
 00588   860   NtClose  (104, ... ) == 0x0
 00589   860   NtProtectVirtualMemory  (100, (0x7c90d682), 5, 64, ... (0x7c90d000), 4096, 32, ) == 0x0
 00590   860   NtWriteVirtualMemory  (100, 0x7c90d682,  (100, 0x7c90d682, "\350\15Mi\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00591   860   NtProtectVirtualMemory  (100, (0x7c90dcfd), 5, 64, ... (0x7c90d000), 4096, 64, ) == 0x0
 00592   860   NtWriteVirtualMemory  (100, 0x7c90dcfd,  (100, 0x7c90dcfd, "\350\337Fi\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00593   860   NtProtectVirtualMemory  (100, (0x7c90d754), 5, 64, ... (0x7c90d000), 4096, 64, ) == 0x0
 00594   860   NtWriteVirtualMemory  (100, 0x7c90d754,  (100, 0x7c90d754, "\350\217Li\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00595   860   NtProtectVirtualMemory  (100, (0x7c90d769), 5, 64, ... (0x7c90d000), 4096, 64, ) == 0x0
 00596   860   NtWriteVirtualMemory  (100, 0x7c90d769,  (100, 0x7c90d769, "\350\207Li\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00597   860   NtClose  (100, ... ) == 0x0
 00598   860   NtMapViewOfSection  (60, -1, (0x0), 0, 0, {0, 0}, 0, 1, 0, 4, ... (0x370000), {0, 0}, 20480, ) == 0x0
 00599   860   NtUnmapViewOfSection  (-1, 0x370000, ... ) == 0x0
 00600   860   NtOpenProcess  (0x2a, {24, 0, 0x0, 0, 0, 0x0}, {1468, 0}, ... 100, ) == 0x0
 00601   860   NtOpenSection  (0xe, {24, 48, 0x0, 0, 0,  (0xe, {24, 48, 0x0, 0, 0, "W32_Virtu"}, ... 104, ) }, ... 104, ) == 0x0
 00602   860   NtMapViewOfSection  (104, 100, (0x0), 0, 27086, 0x0, 27086, 2, 1048576, 64, ... (0x7ffa0000), 0x0, 28672, ) == 0x0
 00603   860   NtClose  (104, ... ) == 0x0
 00604   860   NtProtectVirtualMemory  (100, (0x7c90d682), 5, 64, ... (0x7c90d000), 4096, 32, ) == 0x0
 00605   860   NtWriteVirtualMemory  (100, 0x7c90d682,  (100, 0x7c90d682, "\350\15Mi\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00606   860   NtProtectVirtualMemory  (100, (0x7c90dcfd), 5, 64, ... (0x7c90d000), 4096, 64, ) == 0x0
 00607   860   NtWriteVirtualMemory  (100, 0x7c90dcfd,  (100, 0x7c90dcfd, "\350\337Fi\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00608   860   NtProtectVirtualMemory  (100, (0x7c90d754), 5, 64, ... (0x7c90d000), 4096, 64, ) == 0x0
 00609   860   NtWriteVirtualMemory  (100, 0x7c90d754,  (100, 0x7c90d754, "\350\217Li\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00610   860   NtProtectVirtualMemory  (100, (0x7c90d769), 5, 64, ... (0x7c90d000), 4096, 64, ) == 0x0
 00611   860   NtWriteVirtualMemory  (100, 0x7c90d769,  (100, 0x7c90d769, "\350\207Li\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00612   860   NtClose  (100, ... ) == 0x0
 00613   860   NtMapViewOfSection  (60, -1, (0x0), 0, 0, {0, 0}, 0, 1, 0, 4, ... (0x370000), {0, 0}, 20480, ) == 0x0
 00614   860   NtUnmapViewOfSection  (-1, 0x370000, ... ) == 0x0
 00615   860   NtOpenProcess  (0x2a, {24, 0, 0x0, 0, 0, 0x0}, {1720, 0}, ... 100, ) == 0x0
 00616   860   NtOpenSection  (0xe, {24, 48, 0x0, 0, 0,  (0xe, {24, 48, 0x0, 0, 0, "W32_Virtu"}, ... 104, ) }, ... 104, ) == 0x0
 00617   860   NtMapViewOfSection  (104, 100, (0x0), 0, 27086, 0x0, 27086, 2, 1048576, 64, ... (0x7ffa0000), 0x0, 28672, ) == 0x0
 00618   860   NtClose  (104, ... ) == 0x0
 00619   860   NtProtectVirtualMemory  (100, (0x7c90d682), 5, 64, ... (0x7c90d000), 4096, 32, ) == 0x0
 00620   860   NtWriteVirtualMemory  (100, 0x7c90d682,  (100, 0x7c90d682, "\350\15Mi\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00621   860   NtProtectVirtualMemory  (100, (0x7c90dcfd), 5, 64, ... (0x7c90d000), 4096, 64, ) == 0x0
 00622   860   NtWriteVirtualMemory  (100, 0x7c90dcfd,  (100, 0x7c90dcfd, "\350\337Fi\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00623   860   NtProtectVirtualMemory  (100, (0x7c90d754), 5, 64, ... (0x7c90d000), 4096, 64, ) == 0x0
 00624   860   NtWriteVirtualMemory  (100, 0x7c90d754,  (100, 0x7c90d754, "\350\217Li\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00625   860   NtProtectVirtualMemory  (100, (0x7c90d769), 5, 64, ... (0x7c90d000), 4096, 64, ) == 0x0
 00626   860   NtWriteVirtualMemory  (100, 0x7c90d769,  (100, 0x7c90d769, "\350\207Li\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00627   860   NtClose  (100, ... ) == 0x0
 00628   860   NtMapViewOfSection  (60, -1, (0x0), 0, 0, {0, 0}, 0, 1, 0, 4, ... (0x370000), {0, 0}, 20480, ) == 0x0
 00629   860   NtUnmapViewOfSection  (-1, 0x370000, ... ) == 0x0
 00630   860   NtOpenProcess  (0x2a, {24, 0, 0x0, 0, 0, 0x0}, {1888, 0}, ... 100, ) == 0x0
 00631   860   NtOpenSection  (0xe, {24, 48, 0x0, 0, 0,  (0xe, {24, 48, 0x0, 0, 0, "W32_Virtu"}, ... 104, ) }, ... 104, ) == 0x0
 00632   860   NtMapViewOfSection  (104, 100, (0x0), 0, 27086, 0x0, 27086, 2, 1048576, 64, ... (0x7ffa0000), 0x0, 28672, ) == 0x0
 00633   860   NtClose  (104, ... ) == 0x0
 00634   860   NtProtectVirtualMemory  (100, (0x7c90d682), 5, 64, ... (0x7c90d000), 4096, 32, ) == 0x0
 00635   860   NtWriteVirtualMemory  (100, 0x7c90d682,  (100, 0x7c90d682, "\350\15Mi\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00636   860   NtProtectVirtualMemory  (100, (0x7c90dcfd), 5, 64, ... (0x7c90d000), 4096, 64, ) == 0x0
 00637   860   NtWriteVirtualMemory  (100, 0x7c90dcfd,  (100, 0x7c90dcfd, "\350\337Fi\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00638   860   NtProtectVirtualMemory  (100, (0x7c90d754), 5, 64, ... (0x7c90d000), 4096, 64, ) == 0x0
 00639   860   NtWriteVirtualMemory  (100, 0x7c90d754,  (100, 0x7c90d754, "\350\217Li\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00640   860   NtProtectVirtualMemory  (100, (0x7c90d769), 5, 64, ... (0x7c90d000), 4096, 64, ) == 0x0
 00641   860   NtWriteVirtualMemory  (100, 0x7c90d769,  (100, 0x7c90d769, "\350\207Li\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00642   860   NtClose  (100, ... ) == 0x0
 00643   860   NtMapViewOfSection  (60, -1, (0x0), 0, 0, {0, 0}, 0, 1, 0, 4, ... (0x370000), {0, 0}, 20480, ) == 0x0
 00644   860   NtUnmapViewOfSection  (-1, 0x370000, ... ) == 0x0
 00645   860   NtOpenProcess  (0x2a, {24, 0, 0x0, 0, 0, 0x0}, {2024, 0}, ... 100, ) == 0x0
 00646   860   NtOpenSection  (0xe, {24, 48, 0x0, 0, 0,  (0xe, {24, 48, 0x0, 0, 0, "W32_Virtu"}, ... 104, ) }, ... 104, ) == 0x0
 00647   860   NtMapViewOfSection  (104, 100, (0x0), 0, 27086, 0x0, 27086, 2, 1048576, 64, ... (0x7ffa0000), 0x0, 28672, ) == 0x0
 00648   860   NtClose  (104, ... ) == 0x0
 00649   860   NtProtectVirtualMemory  (100, (0x7c90d682), 5, 64, ... (0x7c90d000), 4096, 32, ) == 0x0
 00650   860   NtWriteVirtualMemory  (100, 0x7c90d682,  (100, 0x7c90d682, "\350\15Mi\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00651   860   NtProtectVirtualMemory  (100, (0x7c90dcfd), 5, 64, ... (0x7c90d000), 4096, 64, ) == 0x0
 00652   860   NtWriteVirtualMemory  (100, 0x7c90dcfd,  (100, 0x7c90dcfd, "\350\337Fi\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00653   860   NtProtectVirtualMemory  (100, (0x7c90d754), 5, 64, ... (0x7c90d000), 4096, 64, ) == 0x0
 00654   860   NtWriteVirtualMemory  (100, 0x7c90d754,  (100, 0x7c90d754, "\350\217Li\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00655   860   NtProtectVirtualMemory  (100, (0x7c90d769), 5, 64, ... (0x7c90d000), 4096, 64, ) == 0x0
 00656   860   NtWriteVirtualMemory  (100, 0x7c90d769,  (100, 0x7c90d769, "\350\207Li\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00657   860   NtClose  (100, ... ) == 0x0
 00658   860   NtMapViewOfSection  (60, -1, (0x0), 0, 0, {0, 0}, 0, 1, 0, 4, ... (0x370000), {0, 0}, 20480, ) == 0x0
 00659   860   NtUnmapViewOfSection  (-1, 0x370000, ... ) == 0x0
 00660   860   NtOpenProcess  (0x2a, {24, 0, 0x0, 0, 0, 0x0}, {180, 0}, ... 100, ) == 0x0
 00661   860   NtOpenSection  (0xe, {24, 48, 0x0, 0, 0,  (0xe, {24, 48, 0x0, 0, 0, "W32_Virtu"}, ... 104, ) }, ... 104, ) == 0x0
 00662   860   NtMapViewOfSection  (104, 100, (0x0), 0, 27086, 0x0, 27086, 2, 1048576, 64, ... (0x7ffa0000), 0x0, 28672, ) == 0x0
 00663   860   NtClose  (104, ... ) == 0x0
 00664   860   NtProtectVirtualMemory  (100, (0x7c90d682), 5, 64, ... (0x7c90d000), 4096, 32, ) == 0x0
 00665   860   NtWriteVirtualMemory  (100, 0x7c90d682,  (100, 0x7c90d682, "\350\15Mi\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00666   860   NtProtectVirtualMemory  (100, (0x7c90dcfd), 5, 64, ... (0x7c90d000), 4096, 64, ) == 0x0
 00667   860   NtWriteVirtualMemory  (100, 0x7c90dcfd,  (100, 0x7c90dcfd, "\350\337Fi\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00668   860   NtProtectVirtualMemory  (100, (0x7c90d754), 5, 64, ... (0x7c90d000), 4096, 64, ) == 0x0
 00669   860   NtWriteVirtualMemory  (100, 0x7c90d754,  (100, 0x7c90d754, "\350\217Li\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00670   860   NtProtectVirtualMemory  (100, (0x7c90d769), 5, 64, ... (0x7c90d000), 4096, 64, ) == 0x0
 00671   860   NtWriteVirtualMemory  (100, 0x7c90d769,  (100, 0x7c90d769, "\350\207Li\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00672   860   NtClose  (100, ... ) == 0x0
 00673   860   NtMapViewOfSection  (60, -1, (0x0), 0, 0, {0, 0}, 0, 1, 0, 4, ... (0x370000), {0, 0}, 20480, ) == 0x0
 00674   860   NtUnmapViewOfSection  (-1, 0x370000, ... ) == 0x0
 00675   860   NtOpenProcess  (0x2a, {24, 0, 0x0, 0, 0, 0x0}, {196, 0}, ... 100, ) == 0x0
 00676   860   NtOpenSection  (0xe, {24, 48, 0x0, 0, 0,  (0xe, {24, 48, 0x0, 0, 0, "W32_Virtu"}, ... 104, ) }, ... 104, ) == 0x0
 00677   860   NtMapViewOfSection  (104, 100, (0x0), 0, 27086, 0x0, 27086, 2, 1048576, 64, ... (0x7ffa0000), 0x0, 28672, ) == 0x0
 00678   860   NtClose  (104, ... ) == 0x0
 00679   860   NtProtectVirtualMemory  (100, (0x7c90d682), 5, 64, ... (0x7c90d000), 4096, 32, ) == 0x0
 00680   860   NtWriteVirtualMemory  (100, 0x7c90d682,  (100, 0x7c90d682, "\350\15Mi\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00681   860   NtProtectVirtualMemory  (100, (0x7c90dcfd), 5, 64, ... (0x7c90d000), 4096, 64, ) == 0x0
 00682   860   NtWriteVirtualMemory  (100, 0x7c90dcfd,  (100, 0x7c90dcfd, "\350\337Fi\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00683   860   NtProtectVirtualMemory  (100, (0x7c90d754), 5, 64, ... (0x7c90d000), 4096, 64, ) == 0x0
 00684   860   NtWriteVirtualMemory  (100, 0x7c90d754,  (100, 0x7c90d754, "\350\217Li\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00685   860   NtProtectVirtualMemory  (100, (0x7c90d769), 5, 64, ... (0x7c90d000), 4096, 64, ) == 0x0
 00686   860   NtWriteVirtualMemory  (100, 0x7c90d769,  (100, 0x7c90d769, "\350\207Li\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00687   860   NtClose  (100, ... ) == 0x0
 00688   860   NtMapViewOfSection  (60, -1, (0x0), 0, 0, {0, 0}, 0, 1, 0, 4, ... (0x370000), {0, 0}, 20480, ) == 0x0
 00689   860   NtUnmapViewOfSection  (-1, 0x370000, ... ) == 0x0
 00690   860   NtOpenProcess  (0x2a, {24, 0, 0x0, 0, 0, 0x0}, {160, 0}, ... 100, ) == 0x0
 00691   860   NtOpenSection  (0xe, {24, 48, 0x0, 0, 0,  (0xe, {24, 48, 0x0, 0, 0, "W32_Virtu"}, ... 104, ) }, ... 104, ) == 0x0
 00692   860   NtMapViewOfSection  (104, 100, (0x0), 0, 27086, 0x0, 27086, 2, 1048576, 64, ... (0x7ffa0000), 0x0, 28672, ) == 0x0
 00693   860   NtClose  (104, ... ) == 0x0
 00694   860   NtProtectVirtualMemory  (100, (0x7c90d682), 5, 64, ... (0x7c90d000), 4096, 32, ) == 0x0
 00695   860   NtWriteVirtualMemory  (100, 0x7c90d682,  (100, 0x7c90d682, "\350\15Mi\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00696   860   NtProtectVirtualMemory  (100, (0x7c90dcfd), 5, 64, ... (0x7c90d000), 4096, 64, ) == 0x0
 00697   860   NtWriteVirtualMemory  (100, 0x7c90dcfd,  (100, 0x7c90dcfd, "\350\337Fi\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00698   860   NtProtectVirtualMemory  (100, (0x7c90d754), 5, 64, ... (0x7c90d000), 4096, 64, ) == 0x0
 00699   860   NtWriteVirtualMemory  (100, 0x7c90d754,  (100, 0x7c90d754, "\350\217Li\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00700   860   NtProtectVirtualMemory  (100, (0x7c90d769), 5, 64, ... (0x7c90d000), 4096, 64, ) == 0x0
 00701   860   NtWriteVirtualMemory  (100, 0x7c90d769,  (100, 0x7c90d769, "\350\207Li\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00702   860   NtClose  (100, ... ) == 0x0
 00703   860   NtMapViewOfSection  (60, -1, (0x0), 0, 0, {0, 0}, 0, 1, 0, 4, ... (0x370000), {0, 0}, 20480, ) == 0x0
 00704   860   NtUnmapViewOfSection  (-1, 0x370000, ... ) == 0x0
 00705   860   NtOpenProcess  (0x2a, {24, 0, 0x0, 0, 0, 0x0}, {260, 0}, ... 100, ) == 0x0
 00706   860   NtOpenSection  (0xe, {24, 48, 0x0, 0, 0,  (0xe, {24, 48, 0x0, 0, 0, "W32_Virtu"}, ... 104, ) }, ... 104, ) == 0x0
 00707   860   NtMapViewOfSection  (104, 100, (0x0), 0, 27086, 0x0, 27086, 2, 1048576, 64, ... (0x7ffa0000), 0x0, 28672, ) == 0x0
 00708   860   NtClose  (104, ... ) == 0x0
 00709   860   NtProtectVirtualMemory  (100, (0x7c90d682), 5, 64, ... (0x7c90d000), 4096, 32, ) == 0x0
 00710   860   NtWriteVirtualMemory  (100, 0x7c90d682,  (100, 0x7c90d682, "\350\15Mi\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00711   860   NtProtectVirtualMemory  (100, (0x7c90dcfd), 5, 64, ... (0x7c90d000), 4096, 64, ) == 0x0
 00712   860   NtWriteVirtualMemory  (100, 0x7c90dcfd,  (100, 0x7c90dcfd, "\350\337Fi\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00713   860   NtProtectVirtualMemory  (100, (0x7c90d754), 5, 64, ... (0x7c90d000), 4096, 64, ) == 0x0
 00714   860   NtWriteVirtualMemory  (100, 0x7c90d754,  (100, 0x7c90d754, "\350\217Li\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00715   860   NtProtectVirtualMemory  (100, (0x7c90d769), 5, 64, ... (0x7c90d000), 4096, 64, ) == 0x0
 00716   860   NtWriteVirtualMemory  (100, 0x7c90d769,  (100, 0x7c90d769, "\350\207Li\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00717   860   NtClose  (100, ... ) == 0x0
 00718   860   NtMapViewOfSection  (60, -1, (0x0), 0, 0, {0, 0}, 0, 1, 0, 4, ... (0x370000), {0, 0}, 20480, ) == 0x0
 00719   860   NtUnmapViewOfSection  (-1, 0x370000, ... ) == 0x0
 00720   860   NtOpenProcess  (0x2a, {24, 0, 0x0, 0, 0, 0x0}, {288, 0}, ... 100, ) == 0x0
 00721   860   NtOpenSection  (0xe, {24, 48, 0x0, 0, 0,  (0xe, {24, 48, 0x0, 0, 0, "W32_Virtu"}, ... 104, ) }, ... 104, ) == 0x0
 00722   860   NtMapViewOfSection  (104, 100, (0x0), 0, 27086, 0x0, 27086, 2, 1048576, 64, ... (0x7ffa0000), 0x0, 28672, ) == 0x0
 00723   860   NtClose  (104, ... ) == 0x0
 00724   860   NtProtectVirtualMemory  (100, (0x7c90d682), 5, 64, ... (0x7c90d000), 4096, 32, ) == 0x0
 00725   860   NtWriteVirtualMemory  (100, 0x7c90d682,  (100, 0x7c90d682, "\350\15Mi\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00726   860   NtProtectVirtualMemory  (100, (0x7c90dcfd), 5, 64, ... (0x7c90d000), 4096, 64, ) == 0x0
 00727   860   NtWriteVirtualMemory  (100, 0x7c90dcfd,  (100, 0x7c90dcfd, "\350\337Fi\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00728   860   NtProtectVirtualMemory  (100, (0x7c90d754), 5, 64, ... (0x7c90d000), 4096, 64, ) == 0x0
 00729   860   NtWriteVirtualMemory  (100, 0x7c90d754,  (100, 0x7c90d754, "\350\217Li\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00730   860   NtProtectVirtualMemory  (100, (0x7c90d769), 5, 64, ... (0x7c90d000), 4096, 64, ) == 0x0
 00731   860   NtWriteVirtualMemory  (100, 0x7c90d769,  (100, 0x7c90d769, "\350\207Li\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00732   860   NtClose  (100, ... ) == 0x0
 00733   860   NtMapViewOfSection  (60, -1, (0x0), 0, 0, {0, 0}, 0, 1, 0, 4, ... (0x370000), {0, 0}, 20480, ) == 0x0
 00734   860   NtUnmapViewOfSection  (-1, 0x370000, ... ) == 0x0
 00735   860   NtOpenProcess  (0x2a, {24, 0, 0x0, 0, 0, 0x0}, {412, 0}, ... 100, ) == 0x0
 00736   860   NtOpenSection  (0xe, {24, 48, 0x0, 0, 0,  (0xe, {24, 48, 0x0, 0, 0, "W32_Virtu"}, ... 104, ) }, ... 104, ) == 0x0
 00737   860   NtMapViewOfSection  (104, 100, (0x0), 0, 27086, 0x0, 27086, 2, 1048576, 64, ... (0x7ffa0000), 0x0, 28672, ) == 0x0
 00738   860   NtClose  (104, ... ) == 0x0
 00739   860   NtProtectVirtualMemory  (100, (0x7c90d682), 5, 64, ... (0x7c90d000), 4096, 32, ) == 0x0
 00740   860   NtWriteVirtualMemory  (100, 0x7c90d682,  (100, 0x7c90d682, "\350\15Mi\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00741   860   NtProtectVirtualMemory  (100, (0x7c90dcfd), 5, 64, ... (0x7c90d000), 4096, 64, ) == 0x0
 00742   860   NtWriteVirtualMemory  (100, 0x7c90dcfd,  (100, 0x7c90dcfd, "\350\337Fi\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00743   860   NtProtectVirtualMemory  (100, (0x7c90d754), 5, 64, ... (0x7c90d000), 4096, 64, ) == 0x0
 00744   860   NtWriteVirtualMemory  (100, 0x7c90d754,  (100, 0x7c90d754, "\350\217Li\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00745   860   NtProtectVirtualMemory  (100, (0x7c90d769), 5, 64, ... (0x7c90d000), 4096, 64, ) == 0x0
 00746   860   NtWriteVirtualMemory  (100, 0x7c90d769,  (100, 0x7c90d769, "\350\207Li\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00747   860   NtClose  (100, ... ) == 0x0
 00748   860   NtMapViewOfSection  (60, -1, (0x0), 0, 0, {0, 0}, 0, 1, 0, 4, ... (0x370000), {0, 0}, 20480, ) == 0x0
 00749   860   NtUnmapViewOfSection  (-1, 0x370000, ... ) == 0x0
 00750   860   NtOpenProcess  (0x2a, {24, 0, 0x0, 0, 0, 0x0}, {1408, 0}, ... 100, ) == 0x0
 00751   860   NtOpenSection  (0xe, {24, 48, 0x0, 0, 0,  (0xe, {24, 48, 0x0, 0, 0, "W32_Virtu"}, ... 104, ) }, ... 104, ) == 0x0
 00752   860   NtMapViewOfSection  (104, 100, (0x0), 0, 27086, 0x0, 27086, 2, 1048576, 64, ... (0x7ffa0000), 0x0, 28672, ) == 0x0
 00753   860   NtClose  (104, ... ) == 0x0
 00754   860   NtProtectVirtualMemory  (100, (0x7c90d682), 5, 64, ... (0x7c90d000), 4096, 32, ) == 0x0
 00755   860   NtWriteVirtualMemory  (100, 0x7c90d682,  (100, 0x7c90d682, "\350\15Mi\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00756   860   NtProtectVirtualMemory  (100, (0x7c90dcfd), 5, 64, ... (0x7c90d000), 4096, 64, ) == 0x0
 00757   860   NtWriteVirtualMemory  (100, 0x7c90dcfd,  (100, 0x7c90dcfd, "\350\337Fi\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00758   860   NtProtectVirtualMemory  (100, (0x7c90d754), 5, 64, ... (0x7c90d000), 4096, 64, ) == 0x0
 00759   860   NtWriteVirtualMemory  (100, 0x7c90d754,  (100, 0x7c90d754, "\350\217Li\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00760   860   NtProtectVirtualMemory  (100, (0x7c90d769), 5, 64, ... (0x7c90d000), 4096, 64, ) == 0x0
 00761   860   NtWriteVirtualMemory  (100, 0x7c90d769,  (100, 0x7c90d769, "\350\207Li\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00762   860   NtClose  (100, ... ) == 0x0
 00763   860   NtMapViewOfSection  (60, -1, (0x0), 0, 0, {0, 0}, 0, 1, 0, 4, ... (0x370000), {0, 0}, 20480, ) == 0x0
 00764   860   NtUnmapViewOfSection  (-1, 0x370000, ... ) == 0x0
 00765   860   NtOpenProcess  (0x2a, {24, 0, 0x0, 0, 0, 0x0}, {556, 0}, ... 100, ) == 0x0
 00766   860   NtOpenSection  (0xe, {24, 48, 0x0, 0, 0,  (0xe, {24, 48, 0x0, 0, 0, "W32_Virtu"}, ... 104, ) }, ... 104, ) == 0x0
 00767   860   NtMapViewOfSection  (104, 100, (0x0), 0, 27086, 0x0, 27086, 2, 1048576, 64, ... (0x7ffa0000), 0x0, 28672, ) == 0x0
 00768   860   NtClose  (104, ... ) == 0x0
 00769   860   NtProtectVirtualMemory  (100, (0x7c90d682), 5, 64, ... (0x7c90d000), 4096, 32, ) == 0x0
 00770   860   NtWriteVirtualMemory  (100, 0x7c90d682,  (100, 0x7c90d682, "\350\15Mi\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00771   860   NtProtectVirtualMemory  (100, (0x7c90dcfd), 5, 64, ... (0x7c90d000), 4096, 64, ) == 0x0
 00772   860   NtWriteVirtualMemory  (100, 0x7c90dcfd,  (100, 0x7c90dcfd, "\350\337Fi\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00773   860   NtProtectVirtualMemory  (100, (0x7c90d754), 5, 64, ... (0x7c90d000), 4096, 64, ) == 0x0
 00774   860   NtWriteVirtualMemory  (100, 0x7c90d754,  (100, 0x7c90d754, "\350\217Li\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00775   860   NtProtectVirtualMemory  (100, (0x7c90d769), 5, 64, ... (0x7c90d000), 4096, 64, ) == 0x0
 00776   860   NtWriteVirtualMemory  (100, 0x7c90d769,  (100, 0x7c90d769, "\350\207Li\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00777   860   NtClose  (100, ... ) == 0x0
 00778   860   NtMapViewOfSection  (60, -1, (0x0), 0, 0, {0, 0}, 0, 1, 0, 4, ... (0x370000), {0, 0}, 20480, ) == 0x0
 00779   860   NtUnmapViewOfSection  (-1, 0x370000, ... ) == 0x0
 00780   860   NtOpenProcess  (0x2a, {24, 0, 0x0, 0, 0, 0x0}, {1204, 0}, ... 100, ) == 0x0
 00781   860   NtOpenSection  (0xe, {24, 48, 0x0, 0, 0,  (0xe, {24, 48, 0x0, 0, 0, "W32_Virtu"}, ... 104, ) }, ... 104, ) == 0x0
 00782   860   NtMapViewOfSection  (104, 100, (0x0), 0, 27086, 0x0, 27086, 2, 1048576, 64, ... (0x7ffa0000), 0x0, 28672, ) == 0x0
 00783   860   NtClose  (104, ... ) == 0x0
 00784   860   NtProtectVirtualMemory  (100, (0x7c90d682), 5, 64, ... (0x7c90d000), 4096, 32, ) == 0x0
 00785   860   NtWriteVirtualMemory  (100, 0x7c90d682,  (100, 0x7c90d682, "\350\15Mi\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00786   860   NtProtectVirtualMemory  (100, (0x7c90dcfd), 5, 64, ... (0x7c90d000), 4096, 64, ) == 0x0
 00787   860   NtWriteVirtualMemory  (100, 0x7c90dcfd,  (100, 0x7c90dcfd, "\350\337Fi\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00788   860   NtProtectVirtualMemory  (100, (0x7c90d754), 5, 64, ... (0x7c90d000), 4096, 64, ) == 0x0
 00789   860   NtWriteVirtualMemory  (100, 0x7c90d754,  (100, 0x7c90d754, "\350\217Li\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00790   860   NtProtectVirtualMemory  (100, (0x7c90d769), 5, 64, ... (0x7c90d000), 4096, 64, ) == 0x0
 00791   860   NtWriteVirtualMemory  (100, 0x7c90d769,  (100, 0x7c90d769, "\350\207Li\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00792   860   NtClose  (100, ... ) == 0x0
 00793   860   NtMapViewOfSection  (60, -1, (0x0), 0, 0, {0, 0}, 0, 1, 0, 4, ... (0x370000), {0, 0}, 20480, ) == 0x0
 00794   860   NtUnmapViewOfSection  (-1, 0x370000, ... ) == 0x0
 00795   860   NtOpenProcess  (0x2a, {24, 0, 0x0, 0, 0, 0x0}, {1452, 0}, ... 100, ) == 0x0
 00796   860   NtOpenSection  (0xe, {24, 48, 0x0, 0, 0,  (0xe, {24, 48, 0x0, 0, 0, "W32_Virtu"}, ... 104, ) }, ... 104, ) == 0x0
 00797   860   NtMapViewOfSection  (104, 100, (0x0), 0, 27086, 0x0, 27086, 2, 1048576, 64, ... (0x7ffa0000), 0x0, 28672, ) == 0x0
 00798   860   NtClose  (104, ... ) == 0x0
 00799   860   NtProtectVirtualMemory  (100, (0x7c90d682), 5, 64, ... (0x7c90d000), 4096, 32, ) == 0x0
 00800   860   NtWriteVirtualMemory  (100, 0x7c90d682,  (100, 0x7c90d682, "\350\15Mi\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00801   860   NtProtectVirtualMemory  (100, (0x7c90dcfd), 5, 64, ... (0x7c90d000), 4096, 64, ) == 0x0
 00802   860   NtWriteVirtualMemory  (100, 0x7c90dcfd,  (100, 0x7c90dcfd, "\350\337Fi\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00803   860   NtProtectVirtualMemory  (100, (0x7c90d754), 5, 64, ... (0x7c90d000), 4096, 64, ) == 0x0
 00804   860   NtWriteVirtualMemory  (100, 0x7c90d754,  (100, 0x7c90d754, "\350\217Li\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00805   860   NtProtectVirtualMemory  (100, (0x7c90d769), 5, 64, ... (0x7c90d000), 4096, 64, ) == 0x0
 00806   860   NtWriteVirtualMemory  (100, 0x7c90d769,  (100, 0x7c90d769, "\350\207Li\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00807   860   NtClose  (100, ... ) == 0x0
 00808   860   NtMapViewOfSection  (60, -1, (0x0), 0, 0, {0, 0}, 0, 1, 0, 4, ... (0x370000), {0, 0}, 20480, ) == 0x0
 00809   860   NtUnmapViewOfSection  (-1, 0x370000, ... ) == 0x0
 00810   860   NtOpenProcess  (0x2a, {24, 0, 0x0, 0, 0, 0x0}, {1708, 0}, ... 100, ) == 0x0
 00811   860   NtOpenSection  (0xe, {24, 48, 0x0, 0, 0,  (0xe, {24, 48, 0x0, 0, 0, "W32_Virtu"}, ... 104, ) }, ... 104, ) == 0x0
 00812   860   NtMapViewOfSection  (104, 100, (0x0), 0, 27086, 0x0, 27086, 2, 1048576, 64, ... (0x7ffa0000), 0x0, 28672, ) == 0x0
 00813   860   NtClose  (104, ... ) == 0x0
 00814   860   NtProtectVirtualMemory  (100, (0x7c90d682), 5, 64, ... (0x7c90d000), 4096, 32, ) == 0x0
 00815   860   NtWriteVirtualMemory  (100, 0x7c90d682,  (100, 0x7c90d682, "\350\15Mi\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00816   860   NtProtectVirtualMemory  (100, (0x7c90dcfd), 5, 64, ... (0x7c90d000), 4096, 64, ) == 0x0
 00817   860   NtWriteVirtualMemory  (100, 0x7c90dcfd,  (100, 0x7c90dcfd, "\350\337Fi\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00818   860   NtProtectVirtualMemory  (100, (0x7c90d754), 5, 64, ... (0x7c90d000), 4096, 64, ) == 0x0
 00819   860   NtWriteVirtualMemory  (100, 0x7c90d754,  (100, 0x7c90d754, "\350\217Li\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00820   860   NtProtectVirtualMemory  (100, (0x7c90d769), 5, 64, ... (0x7c90d000), 4096, 64, ) == 0x0
 00821   860   NtWriteVirtualMemory  (100, 0x7c90d769,  (100, 0x7c90d769, "\350\207Li\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00822   860   NtClose  (100, ... ) == 0x0
 00823   860   NtMapViewOfSection  (60, -1, (0x0), 0, 0, {0, 0}, 0, 1, 0, 4, ... (0x370000), {0, 0}, 20480, ) == 0x0
 00824   860   NtUnmapViewOfSection  (-1, 0x370000, ... ) == 0x0
 00825   860   NtOpenProcess  (0x2a, {24, 0, 0x0, 0, 0, 0x0}, {1180, 0}, ... 100, ) == 0x0
 00826   860   NtOpenSection  (0xe, {24, 48, 0x0, 0, 0,  (0xe, {24, 48, 0x0, 0, 0, "W32_Virtu"}, ... 104, ) }, ... 104, ) == 0x0
 00827   860   NtMapViewOfSection  (104, 100, (0x0), 0, 27086, 0x0, 27086, 2, 1048576, 64, ... (0x7ffa0000), 0x0, 28672, ) == 0x0
 00828   860   NtClose  (104, ... ) == 0x0
 00829   860   NtProtectVirtualMemory  (100, (0x7c90d682), 5, 64, ... (0x7c90d000), 4096, 32, ) == 0x0
 00830   860   NtWriteVirtualMemory  (100, 0x7c90d682,  (100, 0x7c90d682, "\350\15Mi\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00831   860   NtProtectVirtualMemory  (100, (0x7c90dcfd), 5, 64, ... (0x7c90d000), 4096, 64, ) == 0x0
 00832   860   NtWriteVirtualMemory  (100, 0x7c90dcfd,  (100, 0x7c90dcfd, "\350\337Fi\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00833   860   NtProtectVirtualMemory  (100, (0x7c90d754), 5, 64, ... (0x7c90d000), 4096, 64, ) == 0x0
 00834   860   NtWriteVirtualMemory  (100, 0x7c90d754,  (100, 0x7c90d754, "\350\217Li\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00835   860   NtProtectVirtualMemory  (100, (0x7c90d769), 5, 64, ... (0x7c90d000), 4096, 64, ) == 0x0
 00836   860   NtWriteVirtualMemory  (100, 0x7c90d769,  (100, 0x7c90d769, "\350\207Li\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00837   860   NtClose  (100, ... ) == 0x0
 00838   860   NtMapViewOfSection  (60, -1, (0x0), 0, 0, {0, 0}, 0, 1, 0, 4, ... (0x370000), {0, 0}, 20480, ) == 0x0
 00839   860   NtUnmapViewOfSection  (-1, 0x370000, ... ) == 0x0
 00840   860   NtOpenProcess  (0x2a, {24, 0, 0x0, 0, 0, 0x0}, {1512, 0}, ... 100, ) == 0x0
 00841   860   NtOpenSection  (0xe, {24, 48, 0x0, 0, 0,  (0xe, {24, 48, 0x0, 0, 0, "W32_Virtu"}, ... 104, ) }, ... 104, ) == 0x0
 00842   860   NtMapViewOfSection  (104, 100, (0x0), 0, 27086, 0x0, 27086, 2, 1048576, 64, ... (0x7ffa0000), 0x0, 28672, ) == 0x0
 00843   860   NtClose  (104, ... ) == 0x0
 00844   860   NtProtectVirtualMemory  (100, (0x7c90d682), 5, 64, ... (0x7c90d000), 4096, 32, ) == 0x0
 00845   860   NtWriteVirtualMemory  (100, 0x7c90d682,  (100, 0x7c90d682, "\350\15Mi\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00846   860   NtProtectVirtualMemory  (100, (0x7c90dcfd), 5, 64, ... (0x7c90d000), 4096, 64, ) == 0x0
 00847   860   NtWriteVirtualMemory  (100, 0x7c90dcfd,  (100, 0x7c90dcfd, "\350\337Fi\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00848   860   NtProtectVirtualMemory  (100, (0x7c90d754), 5, 64, ... (0x7c90d000), 4096, 64, ) == 0x0
 00849   860   NtWriteVirtualMemory  (100, 0x7c90d754,  (100, 0x7c90d754, "\350\217Li\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00850   860   NtProtectVirtualMemory  (100, (0x7c90d769), 5, 64, ... (0x7c90d000), 4096, 64, ) == 0x0
 00851   860   NtWriteVirtualMemory  (100, 0x7c90d769,  (100, 0x7c90d769, "\350\207Li\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00852   860   NtClose  (100, ... ) == 0x0
 00853   860   NtMapViewOfSection  (60, -1, (0x0), 0, 0, {0, 0}, 0, 1, 0, 4, ... (0x370000), {0, 0}, 20480, ) == 0x0
 00854   860   NtUnmapViewOfSection  (-1, 0x370000, ... ) == 0x0
 00855   860   NtOpenProcess  (0x2a, {24, 0, 0x0, 0, 0, 0x0}, {1028, 0}, ... 100, ) == 0x0
 00856   860   NtOpenSection  (0xe, {24, 48, 0x0, 0, 0,  (0xe, {24, 48, 0x0, 0, 0, "W32_Virtu"}, ... 104, ) }, ... 104, ) == 0x0
 00857   860   NtMapViewOfSection  (104, 100, (0x0), 0, 27086, 0x0, 27086, 2, 1048576, 64, ... (0x7ffa0000), 0x0, 28672, ) == 0x0
 00858   860   NtClose  (104, ... ) == 0x0
 00859   860   NtProtectVirtualMemory  (100, (0x7c90d682), 5, 64, ... (0x7c90d000), 4096, 32, ) == 0x0
 00860   860   NtWriteVirtualMemory  (100, 0x7c90d682,  (100, 0x7c90d682, "\350\15Mi\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00861   860   NtProtectVirtualMemory  (100, (0x7c90dcfd), 5, 64, ... (0x7c90d000), 4096, 64, ) == 0x0
 00862   860   NtWriteVirtualMemory  (100, 0x7c90dcfd,  (100, 0x7c90dcfd, "\350\337Fi\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00863   860   NtProtectVirtualMemory  (100, (0x7c90d754), 5, 64, ... (0x7c90d000), 4096, 64, ) == 0x0
 00864   860   NtWriteVirtualMemory  (100, 0x7c90d754,  (100, 0x7c90d754, "\350\217Li\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00865   860   NtProtectVirtualMemory  (100, (0x7c90d769), 5, 64, ... (0x7c90d000), 4096, 64, ) == 0x0
 00866   860   NtWriteVirtualMemory  (100, 0x7c90d769,  (100, 0x7c90d769, "\350\207Li\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00867   860   NtClose  (100, ... ) == 0x0
 00868   860   NtMapViewOfSection  (60, -1, (0x0), 0, 0, {0, 0}, 0, 1, 0, 4, ... (0x370000), {0, 0}, 20480, ) == 0x0
 00869   860   NtUnmapViewOfSection  (-1, 0x370000, ... ) == 0x0
 00870   860   NtOpenProcess  (0x2a, {24, 0, 0x0, 0, 0, 0x0}, {928, 0}, ... 100, ) == 0x0
 00871   860   NtOpenSection  (0xe, {24, 48, 0x0, 0, 0,  (0xe, {24, 48, 0x0, 0, 0, "W32_Virtu"}, ... 104, ) }, ... 104, ) == 0x0
 00872   860   NtMapViewOfSection  (104, 100, (0x0), 0, 27086, 0x0, 27086, 2, 1048576, 64, ... (0x7ffa0000), 0x0, 28672, ) == 0x0
 00873   860   NtClose  (104, ... ) == 0x0
 00874   860   NtProtectVirtualMemory  (100, (0x7c90d682), 5, 64, ... (0x7c90d000), 4096, 32, ) == 0x0
 00875   860   NtWriteVirtualMemory  (100, 0x7c90d682,  (100, 0x7c90d682, "\350\15Mi\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00876   860   NtProtectVirtualMemory  (100, (0x7c90dcfd), 5, 64, ... (0x7c90d000), 4096, 64, ) == 0x0
 00877   860   NtWriteVirtualMemory  (100, 0x7c90dcfd,  (100, 0x7c90dcfd, "\350\337Fi\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00878   860   NtProtectVirtualMemory  (100, (0x7c90d754), 5, 64, ... (0x7c90d000), 4096, 64, ) == 0x0
 00879   860   NtWriteVirtualMemory  (100, 0x7c90d754,  (100, 0x7c90d754, "\350\217Li\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00880   860   NtProtectVirtualMemory  (100, (0x7c90d769), 5, 64, ... (0x7c90d000), 4096, 64, ) == 0x0
 00881   860   NtWriteVirtualMemory  (100, 0x7c90d769,  (100, 0x7c90d769, "\350\207Li\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00882   860   NtClose  (100, ... ) == 0x0
 00883   860   NtMapViewOfSection  (60, -1, (0x0), 0, 0, {0, 0}, 0, 1, 0, 4, ... (0x370000), {0, 0}, 20480, ) == 0x0
 00884   860   NtUnmapViewOfSection  (-1, 0x370000, ... ) == 0x0
 00885   860   NtOpenProcess  (0x2a, {24, 0, 0x0, 0, 0, 0x0}, {1656, 0}, ... 100, ) == 0x0
 00886   860   NtOpenSection  (0xe, {24, 48, 0x0, 0, 0,  (0xe, {24, 48, 0x0, 0, 0, "W32_Virtu"}, ... 104, ) }, ... 104, ) == 0x0
 00887   860   NtMapViewOfSection  (104, 100, (0x0), 0, 27086, 0x0, 27086, 2, 1048576, 64, ... (0x7ffa0000), 0x0, 28672, ) == 0x0
 00888   860   NtClose  (104, ... ) == 0x0
 00889   860   NtProtectVirtualMemory  (100, (0x7c90d682), 5, 64, ... (0x7c90d000), 4096, 32, ) == 0x0
 00890   860   NtWriteVirtualMemory  (100, 0x7c90d682,  (100, 0x7c90d682, "\350\15Mi\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00891   860   NtProtectVirtualMemory  (100, (0x7c90dcfd), 5, 64, ... (0x7c90d000), 4096, 64, ) == 0x0
 00892   860   NtWriteVirtualMemory  (100, 0x7c90dcfd,  (100, 0x7c90dcfd, "\350\337Fi\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00893   860   NtProtectVirtualMemory  (100, (0x7c90d754), 5, 64, ... (0x7c90d000), 4096, 64, ) == 0x0
 00894   860   NtWriteVirtualMemory  (100, 0x7c90d754,  (100, 0x7c90d754, "\350\217Li\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00895   860   NtProtectVirtualMemory  (100, (0x7c90d769), 5, 64, ... (0x7c90d000), 4096, 64, ) == 0x0
 00896   860   NtWriteVirtualMemory  (100, 0x7c90d769,  (100, 0x7c90d769, "\350\207Li\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00897   860   NtClose  (100, ... ) == 0x0
 00898   860   NtMapViewOfSection  (60, -1, (0x0), 0, 0, {0, 0}, 0, 1, 0, 4, ... (0x370000), {0, 0}, 20480, ) == 0x0
 00899   860   NtUnmapViewOfSection  (-1, 0x370000, ... ) == 0x0
 00900   860   NtOpenProcess  (0x2a, {24, 0, 0x0, 0, 0, 0x0}, {464, 0}, ... 100, ) == 0x0
 00901   860   NtOpenSection  (0xe, {24, 48, 0x0, 0, 0,  (0xe, {24, 48, 0x0, 0, 0, "W32_Virtu"}, ... 104, ) }, ... 104, ) == 0x0
 00902   860   NtMapViewOfSection  (104, 100, (0x0), 0, 27086, 0x0, 27086, 2, 1048576, 64, ... (0x7ffa0000), 0x0, 28672, ) == 0x0
 00903   860   NtClose  (104, ... ) == 0x0
 00904   860   NtProtectVirtualMemory  (100, (0x7c90d682), 5, 64, ... (0x7c90d000), 4096, 32, ) == 0x0
 00905   860   NtWriteVirtualMemory  (100, 0x7c90d682,  (100, 0x7c90d682, "\350\15Mi\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00906   860   NtProtectVirtualMemory  (100, (0x7c90dcfd), 5, 64, ... (0x7c90d000), 4096, 64, ) == 0x0
 00907   860   NtWriteVirtualMemory  (100, 0x7c90dcfd,  (100, 0x7c90dcfd, "\350\337Fi\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00908   860   NtProtectVirtualMemory  (100, (0x7c90d754), 5, 64, ... (0x7c90d000), 4096, 64, ) == 0x0
 00909   860   NtWriteVirtualMemory  (100, 0x7c90d754,  (100, 0x7c90d754, "\350\217Li\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00910   860   NtProtectVirtualMemory  (100, (0x7c90d769), 5, 64, ... (0x7c90d000), 4096, 64, ) == 0x0
 00911   860   NtWriteVirtualMemory  (100, 0x7c90d769,  (100, 0x7c90d769, "\350\207Li\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00912   860   NtClose  (100, ... ) == 0x0
 00913   860   NtMapViewOfSection  (60, -1, (0x0), 0, 0, {0, 0}, 0, 1, 0, 4, ... (0x370000), {0, 0}, 20480, ) == 0x0
 00914   860   NtUnmapViewOfSection  (-1, 0x370000, ... ) == 0x0
 00915   860   NtClose  (60, ... ) == 0x0
 00916   860   NtClose  (52, ... ) == 0x0
 00917   860   NtAllocateVirtualMemory  (-1, 0, 0, 196608, 4096, 64, ... 3604480, 196608, ) == 0x0
 00918   860   NtAllocateVirtualMemory  (-1, 0, 0, 196608, 4096, 64, ... 3801088, 196608, ) == 0x0
 00919   860   NtFreeVirtualMemory  (-1, (0x370000), 0, 32768, ... (0x370000), 196608, ) == 0x0
 00920   860   NtAllocateVirtualMemory  (-1, 0, 0, 1350, 4096, 4, ... 3604480, 4096, ) == 0x0
 00921   860   NtFreeVirtualMemory  (-1, (0x370000), 0, 32768, ... (0x370000), 4096, ) == 0x0
 00922   860   NtAllocateVirtualMemory  (-1, 0, 0, 148480, 4096, 4, ... 3604480, 151552, ) == 0x0
 00923   860   NtFreeVirtualMemory  (-1, (0x370000), 0, 32768, ... (0x370000), 151552, ) == 0x0
 00924   860   NtAllocateVirtualMemory  (-1, 0, 0, 2560, 4096, 4, ... 3604480, 4096, ) == 0x0
 00925   860   NtFreeVirtualMemory  (-1, (0x370000), 0, 32768, ... (0x370000), 4096, ) == 0x0
 00926   860   NtAllocateVirtualMemory  (-1, 0, 0, 3584, 4096, 4, ... 3604480, 4096, ) == 0x0
 00927   860   NtFreeVirtualMemory  (-1, (0x370000), 0, 32768, ... (0x370000), 4096, ) == 0x0
 00928   860   NtAllocateVirtualMemory  (-1, 0, 0, 8704, 4096, 4, ... 3604480, 12288, ) == 0x0
 00929   860   NtFreeVirtualMemory  (-1, (0x370000), 0, 32768, ... (0x370000), 12288, ) == 0x0
 00930   860   NtOpenSection  (0xe, {24, 8, 0x40, 0, 0,  (0xe, {24, 8, 0x40, 0, 0, "version.dll"}, ... 52, ) }, ... 52, ) == 0x0
 00931   860   NtMapViewOfSection  (52, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x77c00000), 0x0, 32768, ) == 0x0
 00932   860   NtClose  (52, ... ) == 0x0
 00933   860   NtProtectVirtualMemory  (-1, (0x77c01000), 304, 4, ... (0x77c01000), 4096, 32, ) == 0x0
 00934   860   NtProtectVirtualMemory  (-1, (0x77c01000), 4096, 32, ... (0x77c01000), 4096, 4, ) == 0x0
 00935   860   NtFlushInstructionCache  (-1, 2009075712, 304, ... ) == 0x0
 00936   860   NtOpenKey  (0x80000000, {24, 0, 0x40, 0, 0,  (0x80000000, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\version.dll"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00937   860   NtOpenSection  (0xe, {24, 8, 0x40, 0, 0,  (0xe, {24, 8, 0x40, 0, 0, "wsock32.dll"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00938   860   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\u:\work\wsock32.dll"}, 1242940, ... ) }, 1242940, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00939   860   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\wsock32.dll"}, 1242940, ... ) }, 1242940, ... ) == 0x0
 00940   860   NtOpenFile  (0x100020, {24, 0, 0x40, 0, 0,  (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\wsock32.dll"}, 5, 96, ... 52, {status=0x0, info=1}, ) }, 5, 96, ... 52, {status=0x0, info=1}, ) == 0x0
 00941   860   NtCreateSection  (0xf, 0x0, 0x0, 16, 16777216, 52, ... 60, ) == 0x0
 00942   860   NtQuerySection  (60, Image, 48, ... {section info, class 1, size 48}, 0x0, ) == 0x0
 00943   860   NtClose  (52, ... ) == 0x0
 00944   860   NtMapViewOfSection  (60, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x71ad0000), 0x0, 36864, ) == 0x0
 00945   860   NtClose  (60, ... ) == 0x0
 00946   860   NtProtectVirtualMemory  (-1, (0x71ad1000), 52, 4, ... (0x71ad1000), 4096, 32, ) == 0x0
 00947   860   NtProtectVirtualMemory  (-1, (0x71ad1000), 4096, 32, ... (0x71ad1000), 4096, 4, ) == 0x0
 00948   860   NtFlushInstructionCache  (-1, 1907167232, 52, ... ) == 0x0
 00949   860   NtOpenKey  (0x80000000, {24, 0, 0x40, 0, 0,  (0x80000000, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wsock32.dll"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00950   860   NtQueryPerformanceCounter  (... {925850858, 10}, {3579545, 0}, ) == 0x0
 00951   860   NtOpenThreadTokenEx  (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN
 00952   860   NtOpenProcessTokenEx  (-1, 0x20008, 512, ... 60, ) == 0x0
 00953   860   NtQueryInformationToken  (60, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0
 00954   860   NtClose  (60, ... ) == 0x0
 00955   860   NtOpenKey  (0x2000000, {24, 0, 0x640, 0, 0,  (0x2000000, {24, 0, 0x640, 0, 0, "\REGISTRY\USER\S-1-5-21-1292428093-1383384898-725345543-1003"}, ... 60, ) }, ... 60, ) == 0x0
 00956   860   NtSetInformationObject  (60, Handle, {Inherit=0,ProtectFromClose=1,}, 1179904, ... ) == 0x0
 00957   860   NtOpenKey  (0xf003f, {24, 60, 0x40, 0, 0,  (0xf003f, {24, 60, 0x40, 0, 0, "Software\Borland\Locales"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00958   860   NtOpenKey  (0xf003f, {24, 60, 0x40, 0, 0,  (0xf003f, {24, 60, 0x40, 0, 0, "Software\Borland\Delphi\Locales"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00959   860   NtOpenProcessToken  (-1, 0x8, ... 52, ) == 0x0
 00960   860   NtQueryInformationToken  (52, Statistics, 56, ... {token info, class 10, size 56}, 56, ) == 0x0
 00961   860   NtClose  (52, ... ) == 0x0
 00962   860   NtUserCallOneParam  (0, 41, ... ) == 0x4
 00963   860   NtAllocateVirtualMemory  (-1, 1343488, 0, 4096, 4096, 4, ... 1343488, 4096, ) == 0x0
 00964   860   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 1, ... 9895936, 1048576, ) == 0x0
 00965   860   NtAllocateVirtualMemory  (-1, 1347584, 0, 4096, 4096, 4, ... 1347584, 4096, ) == 0x0
 00966   860   NtAllocateVirtualMemory  (-1, 9895936, 0, 16384, 4096, 4, ... 9895936, 16384, ) == 0x0
 00967   860   NtUserCallNoParam  (29, ...
 00968   860   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\uxtheme.dll"}, 1242224, ... ) }, 1242224, ... ) == 0x0
 00969   860   NtOpenFile  (0x100020, {24, 0, 0x40, 0, 0,  (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\uxtheme.dll"}, 5, 96, ... 52, {status=0x0, info=1}, ) }, 5, 96, ... 52, {status=0x0, info=1}, ) == 0x0
 00970   860   NtCreateSection  (0xe, 0x0, 0x0, 16, 134217728, 52, ... 100, ) == 0x0
 00971   860   NtClose  (52, ... ) == 0x0
 00972   860   NtMapViewOfSection  (100, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 16, ... (0xa70000), 0x0, 221184, ) == 0x0
 00973   860   NtClose  (100, ... ) == 0x0
 00974   860   NtUnmapViewOfSection  (-1, 0xa70000, ... ) == 0x0
 00975   860   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\uxtheme.dll"}, 1242532, ... ) }, 1242532, ... ) == 0x0
 00976   860   NtOpenFile  (0x100020, {24, 0, 0x40, 0, 0,  (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\uxtheme.dll"}, 5, 96, ... 100, {status=0x0, info=1}, ) }, 5, 96, ... 100, {status=0x0, info=1}, ) == 0x0
 00977   860   NtCreateSection  (0xf, 0x0, 0x0, 16, 16777216, 100, ... 52, ) == 0x0
 00978   860   NtQuerySection  (52, Image, 48, ... {section info, class 1, size 48}, 0x0, ) == 0x0
 00979   860   NtClose  (100, ... ) == 0x0
 00980   860   NtMapViewOfSection  (52, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x5ad70000), 0x0, 229376, ) == 0x0
 00981   860   NtClose  (52, ... ) == 0x0
 00982   860   NtProtectVirtualMemory  (-1, (0x5ad71000), 1300, 4, ... (0x5ad71000), 4096, 32, ) == 0x0
 00983   860   NtProtectVirtualMemory  (-1, (0x5ad71000), 4096, 32, ... (0x5ad71000), 4096, 4, ) == 0x0
 00984   860   NtFlushInstructionCache  (-1, 1524043776, 1300, ... ) == 0x0
 00985   860   NtProtectVirtualMemory  (-1, (0x5ad71000), 1300, 4, ... (0x5ad71000), 4096, 32, ) == 0x0
 00986   860   NtProtectVirtualMemory  (-1, (0x5ad71000), 4096, 32, ... (0x5ad71000), 4096, 4, ) == 0x0
 00987   860   NtFlushInstructionCache  (-1, 1524043776, 1300, ... ) == 0x0
 00988   860   NtProtectVirtualMemory  (-1, (0x5ad71000), 1300, 4, ... (0x5ad71000), 4096, 32, ) == 0x0
 00989   860   NtProtectVirtualMemory  (-1, (0x5ad71000), 4096, 32, ... (0x5ad71000), 4096, 4, ) == 0x0
 00990   860   NtFlushInstructionCache  (-1, 1524043776, 1300, ... ) == 0x0
 00991   860   NtProtectVirtualMemory  (-1, (0x5ad71000), 1300, 4, ... (0x5ad71000), 4096, 32, ) == 0x0
 00992   860   NtProtectVirtualMemory  (-1, (0x5ad71000), 4096, 32, ... (0x5ad71000), 4096, 4, ) == 0x0
 00993   860   NtFlushInstructionCache  (-1, 1524043776, 1300, ... ) == 0x0
 00994   860   NtOpenKey  (0x80000000, {24, 0, 0x40, 0, 0,  (0x80000000, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\uxtheme.dll"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00995   860   NtUserGetWindowDC  (0, ... ) == 0x1010051
 00996   860   NtUserCallOneParam  (16842833, 57, ... ) == 0x1
 00997   860   NtOpenThreadTokenEx  (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN
 00998   860   NtOpenProcessTokenEx  (-1, 0x20008, 512, ... 52, ) == 0x0
 00999   860   NtQueryInformationToken  (52, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0
 01000   860   NtClose  (52, ... ) == 0x0
 01001   860   NtOpenKey  (0x2001f, {24, 0, 0x640, 0, 0,  (0x2001f, {24, 0, 0x640, 0, 0, "\REGISTRY\USER\S-1-5-21-1292428093-1383384898-725345543-1003"}, ... 52, ) }, ... 52, ) == 0x0
 01002   860   NtOpenKey  (0x1, {24, 52, 0x40, 0, 0,  (0x1, {24, 52, 0x40, 0, 0, "Software\Microsoft\Windows\CurrentVersion\ThemeManager"}, ... 100, ) }, ... 100, ) == 0x0
 01003   860   NtQueryValueKey  (100,  (100, "Compositing", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01004   860   NtClose  (100, ... ) == 0x0
 01005   860   NtClose  (52, ... ) == 0x0
 01006   860   NtOpenThreadTokenEx  (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN
 01007   860   NtOpenProcessTokenEx  (-1, 0x20008, 512, ... 52, ) == 0x0
 01008   860   NtQueryInformationToken  (52, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0
 01009   860   NtClose  (52, ... ) == 0x0
 01010   860   NtOpenKey  (0x20019, {24, 0, 0x640, 0, 0,  (0x20019, {24, 0, 0x640, 0, 0, "\REGISTRY\USER\S-1-5-21-1292428093-1383384898-725345543-1003"}, ... 52, ) }, ... 52, ) == 0x0
 01011   860   NtOpenKey  (0x1, {24, 52, 0x40, 0, 0,  (0x1, {24, 52, 0x40, 0, 0, "Control Panel\Desktop"}, ... 100, ) }, ... 100, ) == 0x0
 01012   860   NtQueryValueKey  (100,  (100, "LameButtonText", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01013   860   NtClose  (100, ... ) == 0x0
 01014   860   NtClose  (52, ... ) == 0x0
 01015   860   NtUserGetProcessWindowStation  (... ) == 0x1c
 01016   860   NtUserGetObjectInformation  (28, 2, 1244320, 64, 1244316, ... ) == 0x1
 01017   860   NtUserGetGUIThreadInfo  (860, 1244340, ... ) == 0x1
 01018   860   NtConnectPort  ( ("\ThemeApiPort", {12, 2, 1, 1}, 0x0, 0x0, 1244184, 64, ... 52, 0x0, 0x0, 0x0, 64, ) , {12, 2, 1, 1}, 0x0, 0x0, 1244184, 64, ... 52, 0x0, 0x0, 0x0, 64, ) == 0x0
 01019   860   NtRequestWaitReplyPort  (52, {32, 56, new_msg, 0, 0, 0, 0, 0}  (52, {32, 56, new_msg, 0, 0, 0, 0, 0} "\4\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0" ... {32, 56, reply, 0, 464, 860, 58022, 0} "\0\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0" )  ... {32, 56, reply, 0, 464, 860, 58022, 0}  (52, {32, 56, new_msg, 0, 0, 0, 0, 0} "\4\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0" ... {32, 56, reply, 0, 464, 860, 58022, 0} "\0\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0" )  ) == 0x0
 01020   860   NtRequestWaitReplyPort  (52, {32, 56, new_msg, 0, 0, 0, 0, 0}  (52, {32, 56, new_msg, 0, 0, 0, 0, 0} "\355\3\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0" ... {32, 56, reply, 0, 464, 860, 58023, 0} "\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0" )  ... {32, 56, reply, 0, 464, 860, 58023, 0}  (52, {32, 56, new_msg, 0, 0, 0, 0, 0} "\355\3\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0" ... {32, 56, reply, 0, 464, 860, 58023, 0} "\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0" )  ) == 0x0
 01021   860   NtUserCallNoParam  (29, ...
 01022   860   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\uxtheme.dll"}, 1241580, ... ) }, 1241580, ... ) == 0x0
 01021   860   NtUserCallNoParam  ... ) == 0x0
 01023   860   NtUserSystemParametersInfo  (41, 0, 1524240760, 0, ... ) == 0x1
 01024   860   NtGdiHfontCreate  (1243708, 356, 0, 0, 1333048, ... ) == 0x330a04e1
 01025   860   NtGdiHfontCreate  (1243708, 356, 0, 0, 1333040, ... ) == 0x520a0634
 01026   860   NtRequestWaitReplyPort  (52, {32, 56, new_msg, 0, 0, 0, 0, 0}  (52, {32, 56, new_msg, 0, 0, 0, 0, 0} "\7\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0" ... {32, 56, reply, 0, 464, 860, 58024, 0} "\0\0\0\0\0\0\0\0d\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0" )  ... {32, 56, reply, 0, 464, 860, 58024, 0}  (52, {32, 56, new_msg, 0, 0, 0, 0, 0} "\7\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0" ... {32, 56, reply, 0, 464, 860, 58024, 0} "\0\0\0\0\0\0\0\0d\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0" )  ) == 0x0
 01027   860   NtMapViewOfSection  (100, -1, (0x0), 0, 0, {0, 0}, 0, 1, 0, 2, ... (0xa70000), {0, 0}, 327680, ) == 0x0
 01028   860   NtUserGetWindowDC  (0, ... ) == 0x1010051
 01029   860   NtUserCallOneParam  (16842833, 57, ... ) == 0x1
 01030   860   NtUserGetWindowDC  (0, ... ) == 0x1010051
 01031   860   NtUserCallOneParam  (16842833, 57, ... ) == 0x1
 01032   860   NtUserGetWindowDC  (0, ... ) == 0x1010051
 01033   860   NtUserCallOneParam  (16842833, 57, ... ) == 0x1
 01034   860   NtUserGetWindowDC  (0, ... ) == 0x1010051
 01035   860   NtUserCallOneParam  (16842833, 57, ... ) == 0x1
 01036   860   NtUserGetWindowDC  (0, ... ) == 0x1010051
 01037   860   NtUserCallOneParam  (16842833, 57, ... ) == 0x1
 01038   860   NtUserGetWindowDC  (0, ... ) == 0x1010051
 01039   860   NtUserCallOneParam  (16842833, 57, ... ) == 0x1
 01040   860   NtUserGetWindowDC  (0, ... ) == 0x1010051
 01041   860   NtUserCallOneParam  (16842833, 57, ... ) == 0x1
 01042   860   NtUserGetWindowDC  (0, ... ) == 0x1010051
 01043   860   NtUserCallOneParam  (16842833, 57, ... ) == 0x1
 01044   860   NtUserGetWindowDC  (0, ... ) == 0x1010051
 01045   860   NtGdiCreatePatternBrushInternal  (59048383, 0, 0, ... ) == 0x72100798
 01046   860   NtUserCallOneParam  (16842833, 57, ... ) == 0x1
 01047   860   NtUserCallNoParam  (29, ...
 01048   860   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\uxtheme.dll"}, 1241020, ... ) }, 1241020, ... ) == 0x0
 01047   860   NtUserCallNoParam  ... ) == 0x0
 01049   860   NtUserCallNoParam  (29, ...
 01050   860   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\uxtheme.dll"}, 1241016, ... ) }, 1241016, ... ) == 0x0
 01049   860   NtUserCallNoParam  ... ) == 0x0
 00967   860   NtUserCallNoParam  ... ) == 0x1
 01051   860   NtOpenKey  (0x2000000, {24, 16, 0x40, 0, 0,  (0x2000000, {24, 16, 0x40, 0, 0, "System\CurrentControlSet\Services\WinSock2\Parameters"}, ... 104, ) }, ... 104, ) == 0x0
 01052   860   NtQueryValueKey  (104,  (104, "WinSock_Registry_Version", Partial, 144, ... TitleIdx=0, Type=1, Data="2\0.\00\0\0\0"}, 20, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (104, "WinSock_Registry_Version", Partial, 144, ... TitleIdx=0, Type=1, Data="2\0.\00\0\0\0"}, 20, ) }, 20, ) == 0x0
 01053   860   NtQueryValueKey  (104,  (104, "WinSock_Registry_Version", Partial, 144, ... TitleIdx=0, Type=1, Data="2\0.\00\0\0\0"}, 20, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (104, "WinSock_Registry_Version", Partial, 144, ... TitleIdx=0, Type=1, Data="2\0.\00\0\0\0"}, 20, ) }, 20, ) == 0x0
 01054   860   NtCreateEvent  (0x1f0003, 0x0, 0, 0, ... 108, ) == 0x0
 01055   860   NtOpenKey  (0x2000000, {24, 104, 0x40, 0, 0,  (0x2000000, {24, 104, 0x40, 0, 0, "Protocol_Catalog9"}, ... 112, ) }, ... 112, ) == 0x0
 01056   860   NtQueryValueKey  (112,  (112, "Serial_Access_Num", Partial, 144, ... TitleIdx=0, Type=4, Data="\15\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (112, "Serial_Access_Num", Partial, 144, ... TitleIdx=0, Type=4, Data="\15\0\0\0"}, 16, ) }, 16, ) == 0x0
 01057   860   NtNotifyChangeKey  (112, 108, 0, 0, 2011455960, 1, 0, 0, 0, 1, ... ) == 0x103
 01058   860   NtQueryValueKey  (112,  (112, "Serial_Access_Num", Partial, 144, ... TitleIdx=0, Type=4, Data="\15\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (112, "Serial_Access_Num", Partial, 144, ... TitleIdx=0, Type=4, Data="\15\0\0\0"}, 16, ) }, 16, ) == 0x0
 01059   860   NtOpenKey  (0x2000000, {24, 112, 0x40, 0, 0,  (0x2000000, {24, 112, 0x40, 0, 0, "0000000D"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01060   860   NtQueryValueKey  (112,  (112, "Next_Catalog_Entry_ID", Partial, 144, ... TitleIdx=0, Type=4, Data="#\4\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (112, "Next_Catalog_Entry_ID", Partial, 144, ... TitleIdx=0, Type=4, Data="#\4\0\0"}, 16, ) }, 16, ) == 0x0
 01061   860   NtQueryValueKey  (112,  (112, "Num_Catalog_Entries", Partial, 144, ... TitleIdx=0, Type=4, Data="\26\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (112, "Num_Catalog_Entries", Partial, 144, ... TitleIdx=0, Type=4, Data="\26\0\0\0"}, 16, ) }, 16, ) == 0x0
 01062   860   NtOpenKey  (0x2000000, {24, 112, 0x40, 0, 0,  (0x2000000, {24, 112, 0x40, 0, 0, "Catalog_Entries"}, ... 116, ) }, ... 116, ) == 0x0
 01063   860   NtOpenKey  (0x20019, {24, 116, 0x40, 0, 0,  (0x20019, {24, 116, 0x40, 0, 0, "000000000001"}, ... 120, ) }, ... 120, ) == 0x0
 01064   860   NtQueryValueKey  (120,  (120, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 01065   860   NtQueryValueKey  (120,  (120, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 01066   860   NtAllocateVirtualMemory  (-1, 1351680, 0, 4096, 4096, 4, ... 1351680, 4096, ) == 0x0
 01067   860   NtQueryValueKey  (120,  (120, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5f\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\10\0\0\0\240\32\17\347\213\253\317\21\214\243\0\200_H\241\222\351\3\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\2\0\0\0\20\0\0\0\20\0\0\0\1\0\0\0\6\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0T\0c\0p\0i\0p\0 \0[\0T\0C\0P\0/\0I\0P\0]\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\204\3\0\0,\4\0\0\320\1\0\0\\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0x\0\0\0,\4\0\0\320\1\0\0\\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0-\4\0\0\320\1\0\0\\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0t\0\0\0L\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0x\221\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\00\02\0-\4\0\0\320\1\0\0\\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0x\0\0\0.\4\0\0\320\1\0\0\\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0x\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0.\4\0\0\320\1\0\0\\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0/\4\0\0\320\1\0\0\\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0x\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) , Partial, 900, ... TitleIdx=0, Type=3, Data= (120, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5f\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\10\0\0\0\240\32\17\347\213\253\317\21\214\243\0\200_H\241\222\351\3\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\2\0\0\0\20\0\0\0\20\0\0\0\1\0\0\0\6\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0T\0c\0p\0i\0p\0 \0[\0T\0C\0P\0/\0I\0P\0]\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\204\3\0\0,\4\0\0\320\1\0\0\\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0x\0\0\0,\4\0\0\320\1\0\0\\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0-\4\0\0\320\1\0\0\\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0t\0\0\0L\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0x\221\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\00\02\0-\4\0\0\320\1\0\0\\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0x\0\0\0.\4\0\0\320\1\0\0\\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0x\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0.\4\0\0\320\1\0\0\\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0/\4\0\0\320\1\0\0\\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0x\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) \0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0.\4\0\0\320\1\0\0\\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0/\4\0\0\320\1\0\0\\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0x\0\0\0\0\0\0\0 (120, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5f\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\10\0\0\0\240\32\17\347\213\253\317\21\214\243\0\200_H\241\222\351\3\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\2\0\0\0\20\0\0\0\20\0\0\0\1\0\0\0\6\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0T\0c\0p\0i\0p\0 \0[\0T\0C\0P\0/\0I\0P\0]\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\204\3\0\0,\4\0\0\320\1\0\0\\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0x\0\0\0,\4\0\0\320\1\0\0\\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0-\4\0\0\320\1\0\0\\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0t\0\0\0L\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0x\221\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\00\02\0-\4\0\0\320\1\0\0\\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0x\0\0\0.\4\0\0\320\1\0\0\\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0x\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0.\4\0\0\320\1\0\0\\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0/\4\0\0\320\1\0\0\\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0x\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) }, 900, ) == 0x0
 01068   860   NtClose  (120, ... ) == 0x0
 01069   860   NtOpenKey  (0x20019, {24, 116, 0x40, 0, 0,  (0x20019, {24, 116, 0x40, 0, 0, "000000000002"}, ... 120, ) }, ... 120, ) == 0x0
 01070   860   NtQueryValueKey  (120,  (120, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 01071   860   NtQueryValueKey  (120,  (120, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 01072   860   NtQueryValueKey  (120,  (120, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\11\6\2\0\0\0\0\0\0\0\0\0\0\0\0\0\10\0\0\0\240\32\17\347\213\253\317\21\214\243\0\200_H\241\222\352\3\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\2\0\0\0\20\0\0\0\20\0\0\0\2\0\0\0\21\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\273\377\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0T\0c\0p\0i\0p\0 \0[\0U\0D\0P\0/\0I\0P\0]\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\204\3\0\01\4\0\0\320\1\0\0\\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0x\0\0\01\4\0\0\320\1\0\0\\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\02\4\0\0\320\1\0\0\\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0t\0\0\0L\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0x\221\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\00\03\02\4\0\0\320\1\0\0\\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0x\0\0\03\4\0\0\320\1\0\0\\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0x\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\03\4\0\0\320\1\0\0\\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\04\4\0\0\320\1\0\0\\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0x\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) , Partial, 900, ... TitleIdx=0, Type=3, Data= (120, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\11\6\2\0\0\0\0\0\0\0\0\0\0\0\0\0\10\0\0\0\240\32\17\347\213\253\317\21\214\243\0\200_H\241\222\352\3\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\2\0\0\0\20\0\0\0\20\0\0\0\2\0\0\0\21\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\273\377\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0T\0c\0p\0i\0p\0 \0[\0U\0D\0P\0/\0I\0P\0]\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\204\3\0\01\4\0\0\320\1\0\0\\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0x\0\0\01\4\0\0\320\1\0\0\\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\02\4\0\0\320\1\0\0\\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0t\0\0\0L\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0x\221\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\00\03\02\4\0\0\320\1\0\0\\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0x\0\0\03\4\0\0\320\1\0\0\\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0x\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\03\4\0\0\320\1\0\0\\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\04\4\0\0\320\1\0\0\\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0x\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) \0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\03\4\0\0\320\1\0\0\\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\04\4\0\0\320\1\0\0\\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0x\0\0\0\0\0\0\0 (120, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\11\6\2\0\0\0\0\0\0\0\0\0\0\0\0\0\10\0\0\0\240\32\17\347\213\253\317\21\214\243\0\200_H\241\222\352\3\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\2\0\0\0\20\0\0\0\20\0\0\0\2\0\0\0\21\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\273\377\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0T\0c\0p\0i\0p\0 \0[\0U\0D\0P\0/\0I\0P\0]\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\204\3\0\01\4\0\0\320\1\0\0\\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0x\0\0\01\4\0\0\320\1\0\0\\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\02\4\0\0\320\1\0\0\\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0t\0\0\0L\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0x\221\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\00\03\02\4\0\0\320\1\0\0\\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0x\0\0\03\4\0\0\320\1\0\0\\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0x\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\03\4\0\0\320\1\0\0\\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\04\4\0\0\320\1\0\0\\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0x\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) }, 900, ) == 0x0
 01073   860   NtClose  (120, ... ) == 0x0
 01074   860   NtOpenKey  (0x20019, {24, 116, 0x40, 0, 0,  (0x20019, {24, 116, 0x40, 0, 0, "000000000003"}, ... 120, ) }, ... 120, ) == 0x0
 01075   860   NtQueryValueKey  (120,  (120, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 01076   860   NtQueryValueKey  (120,  (120, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 01077   860   NtQueryValueKey  (120,  (120, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\11\6\2\0\0\0\0\0\0\0\0\0\0\0\0\0\14\0\0\0\240\32\17\347\213\253\317\21\214\243\0\200_H\241\222\353\3\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\2\0\0\0\20\0\0\0\20\0\0\0\3\0\0\0\0\0\0\0\377\0\0\0\0\0\0\0\0\0\0\0\273\377\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0T\0c\0p\0i\0p\0 \0[\0R\0A\0W\0/\0I\0P\0]\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\204\3\0\06\4\0\0\320\1\0\0\\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0x\0\0\06\4\0\0\320\1\0\0\\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\07\4\0\0\320\1\0\0\\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0t\0\0\0L\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0x\221\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\00\04\07\4\0\0\320\1\0\0\\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0x\0\0\08\4\0\0\320\1\0\0\\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0x\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\08\4\0\0\320\1\0\0\\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\09\4\0\0\320\1\0\0\\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0x\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) , Partial, 900, ... TitleIdx=0, Type=3, Data= (120, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\11\6\2\0\0\0\0\0\0\0\0\0\0\0\0\0\14\0\0\0\240\32\17\347\213\253\317\21\214\243\0\200_H\241\222\353\3\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\2\0\0\0\20\0\0\0\20\0\0\0\3\0\0\0\0\0\0\0\377\0\0\0\0\0\0\0\0\0\0\0\273\377\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0T\0c\0p\0i\0p\0 \0[\0R\0A\0W\0/\0I\0P\0]\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\204\3\0\06\4\0\0\320\1\0\0\\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0x\0\0\06\4\0\0\320\1\0\0\\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\07\4\0\0\320\1\0\0\\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0t\0\0\0L\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0x\221\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\00\04\07\4\0\0\320\1\0\0\\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0x\0\0\08\4\0\0\320\1\0\0\\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0x\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\08\4\0\0\320\1\0\0\\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\09\4\0\0\320\1\0\0\\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0x\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) \0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\08\4\0\0\320\1\0\0\\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\09\4\0\0\320\1\0\0\\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0x\0\0\0\0\0\0\0 (120, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\11\6\2\0\0\0\0\0\0\0\0\0\0\0\0\0\14\0\0\0\240\32\17\347\213\253\317\21\214\243\0\200_H\241\222\353\3\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\2\0\0\0\20\0\0\0\20\0\0\0\3\0\0\0\0\0\0\0\377\0\0\0\0\0\0\0\0\0\0\0\273\377\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0T\0c\0p\0i\0p\0 \0[\0R\0A\0W\0/\0I\0P\0]\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\204\3\0\06\4\0\0\320\1\0\0\\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0x\0\0\06\4\0\0\320\1\0\0\\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\07\4\0\0\320\1\0\0\\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0t\0\0\0L\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0x\221\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\00\04\07\4\0\0\320\1\0\0\\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0x\0\0\08\4\0\0\320\1\0\0\\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0x\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\08\4\0\0\320\1\0\0\\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\09\4\0\0\320\1\0\0\\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0x\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) }, 900, ) == 0x0
 01078   860   NtClose  (120, ... ) == 0x0
 01079   860   NtOpenKey  (0x20019, {24, 116, 0x40, 0, 0,  (0x20019, {24, 116, 0x40, 0, 0, "000000000004"}, ... 120, ) }, ... 120, ) == 0x0
 01080   860   NtQueryValueKey  (120,  (120, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 01081   860   NtQueryValueKey  (120,  (120, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 01082   860   NtQueryValueKey  (120,  (120, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\rsvpsp.dll\0\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\11&\2\0\0\0\0\0\0\0\0\0\0\0\0\0\10\0\0\0\340\251`\235z3\320\21\275\210\0\0\300\202\346\232\354\3\0\0\1\0\0\0\204\370\272\2|\370\272\2\210\371\272\2\4\244`u\\12\0\0\240<_u\260\371\272\2\6\0\0\0\2\0\0\0\20\0\0\0\20\0\0\0\2\0\0\0\21\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\273\377\0\0\0\0\0\0R\0S\0V\0P\0 \0U\0D\0P\0 \0S\0e\0r\0v\0i\0c\0e\0 \0P\0r\0o\0v\0i\0d\0e\0r\0\0\0\1\0\0\0\344\373\272\2\1\0\0\0\330\273\356\0\0\0\0\0=\373\220|\200\371\272\2\0\0\0\0\0\371\272\2l\373\220|q\373\220|\0\0\0\0\200\371\272\2=\373\220|\334\370\272\2\0\0\0\0\204\3\0\0;\4\0\0\320\1\0\0\\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0x\0\0\0;\4\0\0\320\1\0\0\\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0<\4\0\0\320\1\0\0\\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0t\0\0\0L\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0x\221\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\00\05\0<\4\0\0\320\1\0\0\\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0x\0\0\0=\4\0\0\320\1\0\0\\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0x\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0=\4\0\0\320\1\0\0\\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0>\4\0\0\320\1\0\0\\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0x\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) , Partial, 900, ... TitleIdx=0, Type=3, Data= (120, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\rsvpsp.dll\0\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\11&\2\0\0\0\0\0\0\0\0\0\0\0\0\0\10\0\0\0\340\251`\235z3\320\21\275\210\0\0\300\202\346\232\354\3\0\0\1\0\0\0\204\370\272\2|\370\272\2\210\371\272\2\4\244`u\\12\0\0\240<_u\260\371\272\2\6\0\0\0\2\0\0\0\20\0\0\0\20\0\0\0\2\0\0\0\21\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\273\377\0\0\0\0\0\0R\0S\0V\0P\0 \0U\0D\0P\0 \0S\0e\0r\0v\0i\0c\0e\0 \0P\0r\0o\0v\0i\0d\0e\0r\0\0\0\1\0\0\0\344\373\272\2\1\0\0\0\330\273\356\0\0\0\0\0=\373\220|\200\371\272\2\0\0\0\0\0\371\272\2l\373\220|q\373\220|\0\0\0\0\200\371\272\2=\373\220|\334\370\272\2\0\0\0\0\204\3\0\0;\4\0\0\320\1\0\0\\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0x\0\0\0;\4\0\0\320\1\0\0\\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0<\4\0\0\320\1\0\0\\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0t\0\0\0L\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0x\221\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\00\05\0<\4\0\0\320\1\0\0\\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0x\0\0\0=\4\0\0\320\1\0\0\\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0x\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0=\4\0\0\320\1\0\0\\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0>\4\0\0\320\1\0\0\\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0x\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) \0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0=\4\0\0\320\1\0\0\\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0>\4\0\0\320\1\0\0\\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0x\0\0\0\0\0\0\0 (120, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\rsvpsp.dll\0\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\11&\2\0\0\0\0\0\0\0\0\0\0\0\0\0\10\0\0\0\340\251`\235z3\320\21\275\210\0\0\300\202\346\232\354\3\0\0\1\0\0\0\204\370\272\2|\370\272\2\210\371\272\2\4\244`u\\12\0\0\240<_u\260\371\272\2\6\0\0\0\2\0\0\0\20\0\0\0\20\0\0\0\2\0\0\0\21\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\273\377\0\0\0\0\0\0R\0S\0V\0P\0 \0U\0D\0P\0 \0S\0e\0r\0v\0i\0c\0e\0 \0P\0r\0o\0v\0i\0d\0e\0r\0\0\0\1\0\0\0\344\373\272\2\1\0\0\0\330\273\356\0\0\0\0\0=\373\220|\200\371\272\2\0\0\0\0\0\371\272\2l\373\220|q\373\220|\0\0\0\0\200\371\272\2=\373\220|\334\370\272\2\0\0\0\0\204\3\0\0;\4\0\0\320\1\0\0\\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0x\0\0\0;\4\0\0\320\1\0\0\\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0<\4\0\0\320\1\0\0\\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0t\0\0\0L\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0x\221\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\00\05\0<\4\0\0\320\1\0\0\\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0x\0\0\0=\4\0\0\320\1\0\0\\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0x\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0=\4\0\0\320\1\0\0\\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0>\4\0\0\320\1\0\0\\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0x\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) }, 900, ) == 0x0
 01083   860   NtClose  (120, ... ) == 0x0
 01084   860   NtOpenKey  (0x20019, {24, 116, 0x40, 0, 0,  (0x20019, {24, 116, 0x40, 0, 0, "000000000005"}, ... 120, ) }, ... 120, ) == 0x0
 01085   860   NtQueryValueKey  (120,  (120, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 01086   860   NtQueryValueKey  (120,  (120, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 01087   860   NtQueryValueKey  (120,  (120, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\rsvpsp.dll\0\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5f \2\0\0\0\0\0\0\0\0\0\0\0\0\0\10\0\0\0\340\251`\235z3\320\21\275\210\0\0\300\202\346\232\355\3\0\0\1\0\0\0\210\1\34\0\0\0\34\0\10\0\0\0\0\0\0\0\214\373\272\2\\15\221|\0\0\34\0\6\0\0\0\2\0\0\0\20\0\0\0\20\0\0\0\1\0\0\0\6\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0R\0S\0V\0P\0 \0T\0C\0P\0 \0S\0e\0r\0v\0i\0c\0e\0 \0P\0r\0o\0v\0i\0d\0e\0r\0\0\0\210\1\34\0\0\0\0\0\20\0\0\0P\373\272\2\270Ddu\0\0\0\0(\275\356\0|\373\272\2\364\373\272\2\0\0\34\0\10\0\0\0\0\0\0\0(\374\272\2\\15\221|\0\0\34\0\0\0\0\0\204\3\0\0@\4\0\0\320\1\0\0\\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0x\0\0\0@\4\0\0\320\1\0\0\\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0A\4\0\0\320\1\0\0\\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0t\0\0\0L\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0x\221\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\00\06\0A\4\0\0\320\1\0\0\\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0x\0\0\0B\4\0\0\320\1\0\0\\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0x\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0B\4\0\0\320\1\0\0\\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0C\4\0\0\320\1\0\0\\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0x\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) , Partial, 900, ... TitleIdx=0, Type=3, Data= (120, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\rsvpsp.dll\0\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5f \2\0\0\0\0\0\0\0\0\0\0\0\0\0\10\0\0\0\340\251`\235z3\320\21\275\210\0\0\300\202\346\232\355\3\0\0\1\0\0\0\210\1\34\0\0\0\34\0\10\0\0\0\0\0\0\0\214\373\272\2\\15\221|\0\0\34\0\6\0\0\0\2\0\0\0\20\0\0\0\20\0\0\0\1\0\0\0\6\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0R\0S\0V\0P\0 \0T\0C\0P\0 \0S\0e\0r\0v\0i\0c\0e\0 \0P\0r\0o\0v\0i\0d\0e\0r\0\0\0\210\1\34\0\0\0\0\0\20\0\0\0P\373\272\2\270Ddu\0\0\0\0(\275\356\0|\373\272\2\364\373\272\2\0\0\34\0\10\0\0\0\0\0\0\0(\374\272\2\\15\221|\0\0\34\0\0\0\0\0\204\3\0\0@\4\0\0\320\1\0\0\\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0x\0\0\0@\4\0\0\320\1\0\0\\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0A\4\0\0\320\1\0\0\\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0t\0\0\0L\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0x\221\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\00\06\0A\4\0\0\320\1\0\0\\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0x\0\0\0B\4\0\0\320\1\0\0\\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0x\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0B\4\0\0\320\1\0\0\\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0C\4\0\0\320\1\0\0\\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0x\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) \0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0B\4\0\0\320\1\0\0\\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0C\4\0\0\320\1\0\0\\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0x\0\0\0\0\0\0\0 (120, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\rsvpsp.dll\0\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5f \2\0\0\0\0\0\0\0\0\0\0\0\0\0\10\0\0\0\340\251`\235z3\320\21\275\210\0\0\300\202\346\232\355\3\0\0\1\0\0\0\210\1\34\0\0\0\34\0\10\0\0\0\0\0\0\0\214\373\272\2\\15\221|\0\0\34\0\6\0\0\0\2\0\0\0\20\0\0\0\20\0\0\0\1\0\0\0\6\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0R\0S\0V\0P\0 \0T\0C\0P\0 \0S\0e\0r\0v\0i\0c\0e\0 \0P\0r\0o\0v\0i\0d\0e\0r\0\0\0\210\1\34\0\0\0\0\0\20\0\0\0P\373\272\2\270Ddu\0\0\0\0(\275\356\0|\373\272\2\364\373\272\2\0\0\34\0\10\0\0\0\0\0\0\0(\374\272\2\\15\221|\0\0\34\0\0\0\0\0\204\3\0\0@\4\0\0\320\1\0\0\\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0x\0\0\0@\4\0\0\320\1\0\0\\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0A\4\0\0\320\1\0\0\\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0t\0\0\0L\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0x\221\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\00\06\0A\4\0\0\320\1\0\0\\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0x\0\0\0B\4\0\0\320\1\0\0\\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0x\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0B\4\0\0\320\1\0\0\\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0C\4\0\0\320\1\0\0\\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0x\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) }, 900, ) == 0x0
 01088   860   NtClose  (120, ... ) == 0x0
 01089   860   NtOpenKey  (0x20019, {24, 116, 0x40, 0, 0,  (0x20019, {24, 116, 0x40, 0, 0, "000000000006"}, ... 120, ) }, ... 120, ) == 0x0
 01090   860   NtQueryValueKey  (120,  (120, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 01091   860   NtQueryValueKey  (120,  (120, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 01092   860   NtAllocateVirtualMemory  (-1, 1355776, 0, 4096, 4096, 4, ... 1355776, 4096, ) == 0x0
 01093   860   NtQueryValueKey  (120,  (120, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5&\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\10\0\0\0d\200\304\237\230r\344C\267\275\30\37 \211y*\374\3\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0 \0\0\0\36\0\0\0\36\0\0\0\1\0\0\0\3\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0R\0f\0C\0o\0m\0m\0 \0[\0B\0l\0u\0e\0t\0o\0o\0t\0h\0]\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\204\3\0\0F\4\0\0\320\1\0\0\\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0x\0\0\0F\4\0\0\320\1\0\0\\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0G\4\0\0\320\1\0\0\\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0t\0\0\0L\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0x\221\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\00\07\0G\4\0\0\320\1\0\0\\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0x\0\0\0H\4\0\0\320\1\0\0\\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0x\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0H\4\0\0\320\1\0\0\\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0I\4\0\0\320\1\0\0\\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0x\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) , Partial, 900, ... TitleIdx=0, Type=3, Data= (120, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5&\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\10\0\0\0d\200\304\237\230r\344C\267\275\30\37 \211y*\374\3\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0 \0\0\0\36\0\0\0\36\0\0\0\1\0\0\0\3\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0R\0f\0C\0o\0m\0m\0 \0[\0B\0l\0u\0e\0t\0o\0o\0t\0h\0]\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\204\3\0\0F\4\0\0\320\1\0\0\\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0x\0\0\0F\4\0\0\320\1\0\0\\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0G\4\0\0\320\1\0\0\\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0t\0\0\0L\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0x\221\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\00\07\0G\4\0\0\320\1\0\0\\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0x\0\0\0H\4\0\0\320\1\0\0\\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0x\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0H\4\0\0\320\1\0\0\\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0I\4\0\0\320\1\0\0\\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0x\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) \0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0H\4\0\0\320\1\0\0\\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0I\4\0\0\320\1\0\0\\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0x\0\0\0\0\0\0\0 (120, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5&\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\10\0\0\0d\200\304\237\230r\344C\267\275\30\37 \211y*\374\3\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0 \0\0\0\36\0\0\0\36\0\0\0\1\0\0\0\3\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0R\0f\0C\0o\0m\0m\0 \0[\0B\0l\0u\0e\0t\0o\0o\0t\0h\0]\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\204\3\0\0F\4\0\0\320\1\0\0\\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0x\0\0\0F\4\0\0\320\1\0\0\\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0G\4\0\0\320\1\0\0\\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0t\0\0\0L\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0x\221\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\00\07\0G\4\0\0\320\1\0\0\\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0x\0\0\0H\4\0\0\320\1\0\0\\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0x\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0H\4\0\0\320\1\0\0\\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0I\4\0\0\320\1\0\0\\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0x\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) }, 900, ) == 0x0
 01094   860   NtClose  (120, ... ) == 0x0
 01095   860   NtOpenKey  (0x20019, {24, 116, 0x40, 0, 0,  (0x20019, {24, 116, 0x40, 0, 0, "000000000007"}, ... 120, ) }, ... 120, ) == 0x0
 01096   860   NtQueryValueKey  (120,  (120, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 01097   860   NtQueryValueKey  (120,  (120, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 01098   860   NtQueryValueKey  (120,  (120, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\16\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\23\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\5\0\0\0\373\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\0F\0C\0C\00\03\0A\04\01\0-\08\0C\0C\0C\0-\04\09\01\09\0-\0A\0\0\0\0\0\204\3\0\0K\4\0\0\320\1\0\0\\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0x\0\0\0K\4\0\0\320\1\0\0\\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0L\4\0\0\320\1\0\0\\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0t\0\0\0L\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0x\221\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\00\08\0L\4\0\0\320\1\0\0\\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0x\0\0\0M\4\0\0\320\1\0\0\\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0x\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0M\4\0\0\320\1\0\0\\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0N\4\0\0\320\1\0\0\\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0x\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) , Partial, 900, ... TitleIdx=0, Type=3, Data= (120, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\16\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\23\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\5\0\0\0\373\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\0F\0C\0C\00\03\0A\04\01\0-\08\0C\0C\0C\0-\04\09\01\09\0-\0A\0\0\0\0\0\204\3\0\0K\4\0\0\320\1\0\0\\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0x\0\0\0K\4\0\0\320\1\0\0\\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0L\4\0\0\320\1\0\0\\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0t\0\0\0L\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0x\221\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\00\08\0L\4\0\0\320\1\0\0\\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0x\0\0\0M\4\0\0\320\1\0\0\\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0x\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0M\4\0\0\320\1\0\0\\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0N\4\0\0\320\1\0\0\\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0x\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) \0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0M\4\0\0\320\1\0\0\\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0N\4\0\0\320\1\0\0\\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0x\0\0\0\0\0\0\0 (120, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\16\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\23\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\5\0\0\0\373\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\0F\0C\0C\00\03\0A\04\01\0-\08\0C\0C\0C\0-\04\09\01\09\0-\0A\0\0\0\0\0\204\3\0\0K\4\0\0\320\1\0\0\\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0x\0\0\0K\4\0\0\320\1\0\0\\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0L\4\0\0\320\1\0\0\\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0t\0\0\0L\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0x\221\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\00\08\0L\4\0\0\320\1\0\0\\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0x\0\0\0M\4\0\0\320\1\0\0\\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0x\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0M\4\0\0\320\1\0\0\\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0N\4\0\0\320\1\0\0\\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0x\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) }, 900, ) == 0x0
 01099   860   NtClose  (120, ... ) == 0x0
 01100   860   NtOpenKey  (0x20019, {24, 116, 0x40, 0, 0,  (0x20019, {24, 116, 0x40, 0, 0, "000000000008"}, ... 120, ) }, ... 120, ) == 0x0
 01101   860   NtQueryValueKey  (120,  (120, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 01102   860   NtQueryValueKey  (120,  (120, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 01103   860   NtQueryValueKey  (120,  (120, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\11\2\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\24\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\2\0\0\0\373\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\0F\0C\0C\00\03\0A\04\01\0-\08\0C\0C\0C\0-\04\09\01\09\0-\0A\0\0\0\0\0\204\3\0\0P\4\0\0\320\1\0\0\\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0x\0\0\0P\4\0\0\320\1\0\0\\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0Q\4\0\0\320\1\0\0\\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0t\0\0\0L\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0x\221\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\00\09\0Q\4\0\0\320\1\0\0\\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0x\0\0\0R\4\0\0\320\1\0\0\\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0x\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0R\4\0\0\320\1\0\0\\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0S\4\0\0\320\1\0\0\\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0x\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) , Partial, 900, ... TitleIdx=0, Type=3, Data= (120, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\11\2\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\24\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\2\0\0\0\373\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\0F\0C\0C\00\03\0A\04\01\0-\08\0C\0C\0C\0-\04\09\01\09\0-\0A\0\0\0\0\0\204\3\0\0P\4\0\0\320\1\0\0\\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0x\0\0\0P\4\0\0\320\1\0\0\\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0Q\4\0\0\320\1\0\0\\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0t\0\0\0L\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0x\221\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\00\09\0Q\4\0\0\320\1\0\0\\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0x\0\0\0R\4\0\0\320\1\0\0\\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0x\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0R\4\0\0\320\1\0\0\\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0S\4\0\0\320\1\0\0\\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0x\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) \0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0R\4\0\0\320\1\0\0\\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0S\4\0\0\320\1\0\0\\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0x\0\0\0\0\0\0\0 (120, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\11\2\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\24\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\2\0\0\0\373\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\0F\0C\0C\00\03\0A\04\01\0-\08\0C\0C\0C\0-\04\09\01\09\0-\0A\0\0\0\0\0\204\3\0\0P\4\0\0\320\1\0\0\\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0x\0\0\0P\4\0\0\320\1\0\0\\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0Q\4\0\0\320\1\0\0\\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0t\0\0\0L\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0x\221\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\00\09\0Q\4\0\0\320\1\0\0\\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0x\0\0\0R\4\0\0\320\1\0\0\\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0x\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0R\4\0\0\320\1\0\0\\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0S\4\0\0\320\1\0\0\\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0x\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) }, 900, ) == 0x0
 01104   860   NtClose  (120, ... ) == 0x0
 01105   860   NtOpenKey  (0x20019, {24, 116, 0x40, 0, 0,  (0x20019, {24, 116, 0x40, 0, 0, "000000000009"}, ... 120, ) }, ... 120, ) == 0x0
 01106   860   NtQueryValueKey  (120,  (120, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 01107   860   NtQueryValueKey  (120,  (120, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 01108   860   NtQueryValueKey  (120,  (120, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\16\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\25\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\5\0\0\0\374\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\0A\0E\07\04\02\01\0B\05\0-\07\03\02\0D\0-\04\05\06\07\0-\0A\0\0\0\0\0\204\3\0\0U\4\0\0\320\1\0\0\\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0x\0\0\0U\4\0\0\320\1\0\0\\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0V\4\0\0\320\1\0\0\\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0t\0\0\0L\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0x\221\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\01\00\0V\4\0\0\320\1\0\0\\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0x\0\0\0W\4\0\0\320\1\0\0\\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0x\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0W\4\0\0\320\1\0\0\\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0X\4\0\0\320\1\0\0\\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0x\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) , Partial, 900, ... TitleIdx=0, Type=3, Data= (120, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\16\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\25\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\5\0\0\0\374\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\0A\0E\07\04\02\01\0B\05\0-\07\03\02\0D\0-\04\05\06\07\0-\0A\0\0\0\0\0\204\3\0\0U\4\0\0\320\1\0\0\\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0x\0\0\0U\4\0\0\320\1\0\0\\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0V\4\0\0\320\1\0\0\\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0t\0\0\0L\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0x\221\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\01\00\0V\4\0\0\320\1\0\0\\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0x\0\0\0W\4\0\0\320\1\0\0\\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0x\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0W\4\0\0\320\1\0\0\\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0X\4\0\0\320\1\0\0\\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0x\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) \0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0W\4\0\0\320\1\0\0\\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0X\4\0\0\320\1\0\0\\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0x\0\0\0\0\0\0\0 (120, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\16\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\25\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\5\0\0\0\374\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\0A\0E\07\04\02\01\0B\05\0-\07\03\02\0D\0-\04\05\06\07\0-\0A\0\0\0\0\0\204\3\0\0U\4\0\0\320\1\0\0\\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0x\0\0\0U\4\0\0\320\1\0\0\\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0V\4\0\0\320\1\0\0\\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0t\0\0\0L\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0x\221\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\01\00\0V\4\0\0\320\1\0\0\\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0x\0\0\0W\4\0\0\320\1\0\0\\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0x\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0W\4\0\0\320\1\0\0\\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0X\4\0\0\320\1\0\0\\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0x\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) }, 900, ) == 0x0
 01109   860   NtClose  (120, ... ) == 0x0
 01110   860   NtOpenKey  (0x20019, {24, 116, 0x40, 0, 0,  (0x20019, {24, 116, 0x40, 0, 0, "000000000010"}, ... 120, ) }, ... 120, ) == 0x0
 01111   860   NtQueryValueKey  (120,  (120, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 01112   860   NtQueryValueKey  (120,  (120, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 01113   860   NtAllocateVirtualMemory  (-1, 1359872, 0, 4096, 4096, 4, ... 1359872, 4096, ) == 0x0
 01114   860   NtQueryValueKey  (120,  (120, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\11\2\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\26\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\2\0\0\0\374\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\0A\0E\07\04\02\01\0B\05\0-\07\03\02\0D\0-\04\05\06\07\0-\0A\0\0\0\0\0\204\3\0\0[\4\0\0\320\1\0\0\\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0x\0\0\0[\4\0\0\320\1\0\0\\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\\4\0\0\320\1\0\0\\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0t\0\0\0L\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0x\221\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\01\01\0\\4\0\0\320\1\0\0\\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0x\0\0\0]\4\0\0\320\1\0\0\\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0x\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0]\4\0\0\320\1\0\0\\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0^\4\0\0\320\1\0\0\\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0x\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) , Partial, 900, ... TitleIdx=0, Type=3, Data= (120, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\11\2\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\26\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\2\0\0\0\374\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\0A\0E\07\04\02\01\0B\05\0-\07\03\02\0D\0-\04\05\06\07\0-\0A\0\0\0\0\0\204\3\0\0[\4\0\0\320\1\0\0\\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0x\0\0\0[\4\0\0\320\1\0\0\\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\\4\0\0\320\1\0\0\\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0t\0\0\0L\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0x\221\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\01\01\0\\4\0\0\320\1\0\0\\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0x\0\0\0]\4\0\0\320\1\0\0\\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0x\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0]\4\0\0\320\1\0\0\\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0^\4\0\0\320\1\0\0\\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0x\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) \0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0]\4\0\0\320\1\0\0\\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0^\4\0\0\320\1\0\0\\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0x\0\0\0\0\0\0\0 (120, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\11\2\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\26\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\2\0\0\0\374\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\0A\0E\07\04\02\01\0B\05\0-\07\03\02\0D\0-\04\05\06\07\0-\0A\0\0\0\0\0\204\3\0\0[\4\0\0\320\1\0\0\\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0x\0\0\0[\4\0\0\320\1\0\0\\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\\4\0\0\320\1\0\0\\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0t\0\0\0L\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0x\221\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\01\01\0\\4\0\0\320\1\0\0\\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0x\0\0\0]\4\0\0\320\1\0\0\\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0x\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0]\4\0\0\320\1\0\0\\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0^\4\0\0\320\1\0\0\\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0x\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) }, 900, ) == 0x0
 01115   860   NtClose  (120, ... ) == 0x0
 01116   860   NtOpenKey  (0x20019, {24, 116, 0x40, 0, 0,  (0x20019, {24, 116, 0x40, 0, 0, "000000000011"}, ... 120, ) }, ... 120, ) == 0x0
 01117   860   NtQueryValueKey  (120,  (120, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 01118   860   NtQueryValueKey  (120,  (120, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 01119   860   NtQueryValueKey  (120,  (120, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\16\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\27\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\5\0\0\0\375\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\09\07\0C\02\0D\09\0F\04\0-\06\09\05\04\0-\04\0E\0B\03\0-\08\0\0\0\0\0\204\3\0\0`\4\0\0\320\1\0\0\\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0x\0\0\0`\4\0\0\320\1\0\0\\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0a\4\0\0\320\1\0\0\\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0t\0\0\0L\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0x\221\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\01\02\0a\4\0\0\320\1\0\0\\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0x\0\0\0b\4\0\0\320\1\0\0\\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0x\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0b\4\0\0\320\1\0\0\\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0c\4\0\0\320\1\0\0\\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0x\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) , Partial, 900, ... TitleIdx=0, Type=3, Data= (120, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\16\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\27\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\5\0\0\0\375\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\09\07\0C\02\0D\09\0F\04\0-\06\09\05\04\0-\04\0E\0B\03\0-\08\0\0\0\0\0\204\3\0\0`\4\0\0\320\1\0\0\\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0x\0\0\0`\4\0\0\320\1\0\0\\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0a\4\0\0\320\1\0\0\\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0t\0\0\0L\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0x\221\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\01\02\0a\4\0\0\320\1\0\0\\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0x\0\0\0b\4\0\0\320\1\0\0\\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0x\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0b\4\0\0\320\1\0\0\\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0c\4\0\0\320\1\0\0\\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0x\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) \0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0b\4\0\0\320\1\0\0\\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0c\4\0\0\320\1\0\0\\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0x\0\0\0\0\0\0\0 (120, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\16\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\27\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\5\0\0\0\375\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\09\07\0C\02\0D\09\0F\04\0-\06\09\05\04\0-\04\0E\0B\03\0-\08\0\0\0\0\0\204\3\0\0`\4\0\0\320\1\0\0\\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0x\0\0\0`\4\0\0\320\1\0\0\\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0a\4\0\0\320\1\0\0\\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0t\0\0\0L\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0x\221\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\01\02\0a\4\0\0\320\1\0\0\\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0x\0\0\0b\4\0\0\320\1\0\0\\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0x\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0b\4\0\0\320\1\0\0\\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0c\4\0\0\320\1\0\0\\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0x\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) }, 900, ) == 0x0
 01120   860   NtClose  (120, ... ) == 0x0
 01121   860   NtOpenKey  (0x20019, {24, 116, 0x40, 0, 0,  (0x20019, {24, 116, 0x40, 0, 0, "000000000012"}, ... 120, ) }, ... 120, ) == 0x0
 01122   860   NtQueryValueKey  (120,  (120, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 01123   860   NtQueryValueKey  (120,  (120, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 01124   860   NtQueryValueKey  (120,  (120, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\11\2\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\30\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\2\0\0\0\375\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\09\07\0C\02\0D\09\0F\04\0-\06\09\05\04\0-\04\0E\0B\03\0-\08\0\0\0\0\0\204\3\0\0e\4\0\0\320\1\0\0\\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0x\0\0\0e\4\0\0\320\1\0\0\\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0f\4\0\0\320\1\0\0\\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0t\0\0\0L\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0x\221\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\01\03\0f\4\0\0\320\1\0\0\\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0x\0\0\0g\4\0\0\320\1\0\0\\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0x\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0g\4\0\0\320\1\0\0\\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0h\4\0\0\320\1\0\0\\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0x\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) , Partial, 900, ... TitleIdx=0, Type=3, Data= (120, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\11\2\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\30\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\2\0\0\0\375\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\09\07\0C\02\0D\09\0F\04\0-\06\09\05\04\0-\04\0E\0B\03\0-\08\0\0\0\0\0\204\3\0\0e\4\0\0\320\1\0\0\\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0x\0\0\0e\4\0\0\320\1\0\0\\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0f\4\0\0\320\1\0\0\\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0t\0\0\0L\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0x\221\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\01\03\0f\4\0\0\320\1\0\0\\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0x\0\0\0g\4\0\0\320\1\0\0\\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0x\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0g\4\0\0\320\1\0\0\\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0h\4\0\0\320\1\0\0\\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0x\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) \0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0g\4\0\0\320\1\0\0\\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0h\4\0\0\320\1\0\0\\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0x\0\0\0\0\0\0\0 (120, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\11\2\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\30\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\2\0\0\0\375\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\09\07\0C\02\0D\09\0F\04\0-\06\09\05\04\0-\04\0E\0B\03\0-\08\0\0\0\0\0\204\3\0\0e\4\0\0\320\1\0\0\\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0x\0\0\0e\4\0\0\320\1\0\0\\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0f\4\0\0\320\1\0\0\\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0t\0\0\0L\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0x\221\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\01\03\0f\4\0\0\320\1\0\0\\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0x\0\0\0g\4\0\0\320\1\0\0\\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0x\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0g\4\0\0\320\1\0\0\\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0h\4\0\0\320\1\0\0\\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0x\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) }, 900, ) == 0x0
 01125   860   NtClose  (120, ... ) == 0x0
 01126   860   NtOpenKey  (0x20019, {24, 116, 0x40, 0, 0,  (0x20019, {24, 116, 0x40, 0, 0, "000000000013"}, ... 120, ) }, ... 120, ) == 0x0
 01127   860   NtQueryValueKey  (120,  (120, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 01128   860   NtQueryValueKey  (120,  (120, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 01129   860   NtQueryValueKey  (120,  (120, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\16\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\10\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\31\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\5\0\0\0\0\0\0\200\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\00\0D\04\03\00\0A\06\0F\0-\00\04\01\00\0-\04\0A\06\08\0-\09\0\0\0\0\0\204\3\0\0j\4\0\0\320\1\0\0\\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0x\0\0\0j\4\0\0\320\1\0\0\\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0k\4\0\0\320\1\0\0\\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0t\0\0\0L\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0x\221\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\01\04\0k\4\0\0\320\1\0\0\\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0x\0\0\0l\4\0\0\320\1\0\0\\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0x\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0l\4\0\0\320\1\0\0\\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0m\4\0\0\320\1\0\0\\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0x\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) , Partial, 900, ... TitleIdx=0, Type=3, Data= (120, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\16\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\10\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\31\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\5\0\0\0\0\0\0\200\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\00\0D\04\03\00\0A\06\0F\0-\00\04\01\00\0-\04\0A\06\08\0-\09\0\0\0\0\0\204\3\0\0j\4\0\0\320\1\0\0\\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0x\0\0\0j\4\0\0\320\1\0\0\\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0k\4\0\0\320\1\0\0\\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0t\0\0\0L\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0x\221\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\01\04\0k\4\0\0\320\1\0\0\\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0x\0\0\0l\4\0\0\320\1\0\0\\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0x\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0l\4\0\0\320\1\0\0\\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0m\4\0\0\320\1\0\0\\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0x\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) \0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0l\4\0\0\320\1\0\0\\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0m\4\0\0\320\1\0\0\\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0x\0\0\0\0\0\0\0 (120, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\16\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\10\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\31\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\5\0\0\0\0\0\0\200\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\00\0D\04\03\00\0A\06\0F\0-\00\04\01\00\0-\04\0A\06\08\0-\09\0\0\0\0\0\204\3\0\0j\4\0\0\320\1\0\0\\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0x\0\0\0j\4\0\0\320\1\0\0\\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0k\4\0\0\320\1\0\0\\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0t\0\0\0L\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0x\221\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\01\04\0k\4\0\0\320\1\0\0\\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0x\0\0\0l\4\0\0\320\1\0\0\\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0x\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0l\4\0\0\320\1\0\0\\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0m\4\0\0\320\1\0\0\\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0x\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) }, 900, ) == 0x0
 01130   860   NtClose  (120, ... ) == 0x0
 01131   860   NtOpenKey  (0x20019, {24, 116, 0x40, 0, 0,  (0x20019, {24, 116, 0x40, 0, 0, "000000000014"}, ... 120, ) }, ... 120, ) == 0x0
 01132   860   NtQueryValueKey  (120,  (120, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 01133   860   NtQueryValueKey  (120,  (120, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 01134   860   NtQueryValueKey  (120,  (120, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\11\2\2\0\0\0\0\0\0\0\0\0\0\0\0\0\10\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\32\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\2\0\0\0\0\0\0\200\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\00\0D\04\03\00\0A\06\0F\0-\00\04\01\00\0-\04\0A\06\08\0-\09\0\0\0\0\0\204\3\0\0o\4\0\0\320\1\0\0\\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0x\0\0\0o\4\0\0\320\1\0\0\\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0p\4\0\0\320\1\0\0\\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0t\0\0\0L\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0x\221\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\01\05\0p\4\0\0\320\1\0\0\\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0x\0\0\0q\4\0\0\320\1\0\0\\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0x\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0q\4\0\0\320\1\0\0\\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0r\4\0\0\320\1\0\0\\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0x\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) , Partial, 900, ... TitleIdx=0, Type=3, Data= (120, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\11\2\2\0\0\0\0\0\0\0\0\0\0\0\0\0\10\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\32\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\2\0\0\0\0\0\0\200\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\00\0D\04\03\00\0A\06\0F\0-\00\04\01\00\0-\04\0A\06\08\0-\09\0\0\0\0\0\204\3\0\0o\4\0\0\320\1\0\0\\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0x\0\0\0o\4\0\0\320\1\0\0\\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0p\4\0\0\320\1\0\0\\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0t\0\0\0L\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0x\221\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\01\05\0p\4\0\0\320\1\0\0\\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0x\0\0\0q\4\0\0\320\1\0\0\\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0x\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0q\4\0\0\320\1\0\0\\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0r\4\0\0\320\1\0\0\\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0x\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) \0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0q\4\0\0\320\1\0\0\\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0r\4\0\0\320\1\0\0\\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0x\0\0\0\0\0\0\0 (120, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\11\2\2\0\0\0\0\0\0\0\0\0\0\0\0\0\10\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\32\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\2\0\0\0\0\0\0\200\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\00\0D\04\03\00\0A\06\0F\0-\00\04\01\00\0-\04\0A\06\08\0-\09\0\0\0\0\0\204\3\0\0o\4\0\0\320\1\0\0\\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0x\0\0\0o\4\0\0\320\1\0\0\\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0p\4\0\0\320\1\0\0\\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0t\0\0\0L\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0x\221\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\01\05\0p\4\0\0\320\1\0\0\\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0x\0\0\0q\4\0\0\320\1\0\0\\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0x\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0q\4\0\0\320\1\0\0\\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0r\4\0\0\320\1\0\0\\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0x\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) }, 900, ) == 0x0
 01135   860   NtClose  (120, ... ) == 0x0
 01136   860   NtOpenKey  (0x20019, {24, 116, 0x40, 0, 0,  (0x20019, {24, 116, 0x40, 0, 0, "000000000015"}, ... 120, ) }, ... 120, ) == 0x0
 01137   860   NtQueryValueKey  (120,  (120, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 01138   860   NtQueryValueKey  (120,  (120, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 01139   860   NtAllocateVirtualMemory  (-1, 1363968, 0, 4096, 4096, 4, ... 1363968, 4096, ) == 0x0
 01140   860   NtQueryValueKey  (120,  (120, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\16\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\33\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\5\0\0\0\377\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\08\0A\0D\04\0D\08\00\06\0-\00\08\01\0B\0-\04\04\04\06\0-\0A\0\0\0\0\0\204\3\0\0u\4\0\0\320\1\0\0\\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0x\0\0\0u\4\0\0\320\1\0\0\\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0v\4\0\0\320\1\0\0\\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0t\0\0\0L\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0x\221\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\01\06\0v\4\0\0\320\1\0\0\\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0x\0\0\0w\4\0\0\320\1\0\0\\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0x\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0w\4\0\0\320\1\0\0\\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0x\4\0\0\320\1\0\0\\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0x\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) , Partial, 900, ... TitleIdx=0, Type=3, Data= (120, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\16\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\33\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\5\0\0\0\377\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\08\0A\0D\04\0D\08\00\06\0-\00\08\01\0B\0-\04\04\04\06\0-\0A\0\0\0\0\0\204\3\0\0u\4\0\0\320\1\0\0\\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0x\0\0\0u\4\0\0\320\1\0\0\\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0v\4\0\0\320\1\0\0\\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0t\0\0\0L\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0x\221\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\01\06\0v\4\0\0\320\1\0\0\\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0x\0\0\0w\4\0\0\320\1\0\0\\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0x\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0w\4\0\0\320\1\0\0\\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0x\4\0\0\320\1\0\0\\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0x\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) \0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0w\4\0\0\320\1\0\0\\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0x\4\0\0\320\1\0\0\\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0x\0\0\0\0\0\0\0 (120, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\16\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\33\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\5\0\0\0\377\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\08\0A\0D\04\0D\08\00\06\0-\00\08\01\0B\0-\04\04\04\06\0-\0A\0\0\0\0\0\204\3\0\0u\4\0\0\320\1\0\0\\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0x\0\0\0u\4\0\0\320\1\0\0\\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0v\4\0\0\320\1\0\0\\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0t\0\0\0L\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0x\221\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\01\06\0v\4\0\0\320\1\0\0\\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0x\0\0\0w\4\0\0\320\1\0\0\\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0x\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0w\4\0\0\320\1\0\0\\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0x\4\0\0\320\1\0\0\\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0x\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) }, 900, ) == 0x0
 01141   860   NtClose  (120, ... ) == 0x0
 01142   860   NtOpenKey  (0x20019, {24, 116, 0x40, 0, 0,  (0x20019, {24, 116, 0x40, 0, 0, "000000000016"}, ... 120, ) }, ... 120, ) == 0x0
 01143   860   NtQueryValueKey  (120,  (120, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 01144   860   NtQueryValueKey  (120,  (120, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 01145   860   NtQueryValueKey  (120,  (120, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\11\2\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\34\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\2\0\0\0\377\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\08\0A\0D\04\0D\08\00\06\0-\00\08\01\0B\0-\04\04\04\06\0-\0A\0\0\0\0\0\204\3\0\0z\4\0\0\320\1\0\0\\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0x\0\0\0z\4\0\0\320\1\0\0\\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0{\4\0\0\320\1\0\0\\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0t\0\0\0L\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0x\221\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\01\07\0{\4\0\0\320\1\0\0\\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0x\0\0\0|\4\0\0\320\1\0\0\\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0x\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0|\4\0\0\320\1\0\0\\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0}\4\0\0\320\1\0\0\\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0x\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) , Partial, 900, ... TitleIdx=0, Type=3, Data= (120, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\11\2\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\34\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\2\0\0\0\377\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\08\0A\0D\04\0D\08\00\06\0-\00\08\01\0B\0-\04\04\04\06\0-\0A\0\0\0\0\0\204\3\0\0z\4\0\0\320\1\0\0\\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0x\0\0\0z\4\0\0\320\1\0\0\\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0{\4\0\0\320\1\0\0\\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0t\0\0\0L\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0x\221\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\01\07\0{\4\0\0\320\1\0\0\\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0x\0\0\0|\4\0\0\320\1\0\0\\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0x\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0|\4\0\0\320\1\0\0\\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0}\4\0\0\320\1\0\0\\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0x\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) \0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0|\4\0\0\320\1\0\0\\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0}\4\0\0\320\1\0\0\\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0x\0\0\0\0\0\0\0 (120, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\11\2\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\34\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\2\0\0\0\377\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\08\0A\0D\04\0D\08\00\06\0-\00\08\01\0B\0-\04\04\04\06\0-\0A\0\0\0\0\0\204\3\0\0z\4\0\0\320\1\0\0\\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0x\0\0\0z\4\0\0\320\1\0\0\\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0{\4\0\0\320\1\0\0\\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0t\0\0\0L\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0x\221\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\01\07\0{\4\0\0\320\1\0\0\\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0x\0\0\0|\4\0\0\320\1\0\0\\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0x\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0|\4\0\0\320\1\0\0\\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0}\4\0\0\320\1\0\0\\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0x\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) }, 900, ) == 0x0
 01146   860   NtClose  (120, ... ) == 0x0
 01147   860   NtOpenKey  (0x20019, {24, 116, 0x40, 0, 0,  (0x20019, {24, 116, 0x40, 0, 0, "000000000017"}, ... 120, ) }, ... 120, ) == 0x0
 01148   860   NtQueryValueKey  (120,  (120, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 01149   860   NtQueryValueKey  (120,  (120, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 01150   860   NtQueryValueKey  (120,  (120, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\16\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\35\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\5\0\0\0\376\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\0E\05\05\09\0B\00\0C\01\0-\0F\0A\04\06\0-\04\06\04\0D\0-\0B\0\0\0\0\0\204\3\0\0\177\4\0\0\320\1\0\0\\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0x\0\0\0\177\4\0\0\320\1\0\0\\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\200\4\0\0\320\1\0\0\\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0t\0\0\0L\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0x\221\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\01\08\0\200\4\0\0\320\1\0\0\\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0x\0\0\0\201\4\0\0\320\1\0\0\\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0x\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\201\4\0\0\320\1\0\0\\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\202\4\0\0\320\1\0\0\\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0x\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) , Partial, 900, ... TitleIdx=0, Type=3, Data= (120, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\16\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\35\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\5\0\0\0\376\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\0E\05\05\09\0B\00\0C\01\0-\0F\0A\04\06\0-\04\06\04\0D\0-\0B\0\0\0\0\0\204\3\0\0\177\4\0\0\320\1\0\0\\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0x\0\0\0\177\4\0\0\320\1\0\0\\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\200\4\0\0\320\1\0\0\\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0t\0\0\0L\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0x\221\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\01\08\0\200\4\0\0\320\1\0\0\\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0x\0\0\0\201\4\0\0\320\1\0\0\\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0x\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\201\4\0\0\320\1\0\0\\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\202\4\0\0\320\1\0\0\\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0x\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) \0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\201\4\0\0\320\1\0\0\\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\202\4\0\0\320\1\0\0\\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0x\0\0\0\0\0\0\0 (120, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\16\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\35\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\5\0\0\0\376\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\0E\05\05\09\0B\00\0C\01\0-\0F\0A\04\06\0-\04\06\04\0D\0-\0B\0\0\0\0\0\204\3\0\0\177\4\0\0\320\1\0\0\\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0x\0\0\0\177\4\0\0\320\1\0\0\\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\200\4\0\0\320\1\0\0\\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0t\0\0\0L\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0x\221\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\01\08\0\200\4\0\0\320\1\0\0\\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0x\0\0\0\201\4\0\0\320\1\0\0\\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0x\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\201\4\0\0\320\1\0\0\\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\202\4\0\0\320\1\0\0\\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0x\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) }, 900, ) == 0x0
 01151   860   NtClose  (120, ... ) == 0x0
 01152   860   NtOpenKey  (0x20019, {24, 116, 0x40, 0, 0,  (0x20019, {24, 116, 0x40, 0, 0, "000000000018"}, ... 120, ) }, ... 120, ) == 0x0
 01153   860   NtQueryValueKey  (120,  (120, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 01154   860   NtQueryValueKey  (120,  (120, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 01155   860   NtQueryValueKey  (120,  (120, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\11\2\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\36\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\2\0\0\0\376\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\0E\05\05\09\0B\00\0C\01\0-\0F\0A\04\06\0-\04\06\04\0D\0-\0B\0\0\0\0\0\204\3\0\0\204\4\0\0\320\1\0\0\\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0x\0\0\0\204\4\0\0\320\1\0\0\\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\205\4\0\0\320\1\0\0\\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0t\0\0\0L\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0x\221\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\01\09\0\205\4\0\0\320\1\0\0\\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0x\0\0\0\206\4\0\0\320\1\0\0\\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0x\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\206\4\0\0\320\1\0\0\\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\207\4\0\0\320\1\0\0\\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0x\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) , Partial, 900, ... TitleIdx=0, Type=3, Data= (120, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\11\2\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\36\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\2\0\0\0\376\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\0E\05\05\09\0B\00\0C\01\0-\0F\0A\04\06\0-\04\06\04\0D\0-\0B\0\0\0\0\0\204\3\0\0\204\4\0\0\320\1\0\0\\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0x\0\0\0\204\4\0\0\320\1\0\0\\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\205\4\0\0\320\1\0\0\\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0t\0\0\0L\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0x\221\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\01\09\0\205\4\0\0\320\1\0\0\\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0x\0\0\0\206\4\0\0\320\1\0\0\\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0x\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\206\4\0\0\320\1\0\0\\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\207\4\0\0\320\1\0\0\\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0x\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) \0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\206\4\0\0\320\1\0\0\\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\207\4\0\0\320\1\0\0\\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0x\0\0\0\0\0\0\0 (120, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\11\2\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\36\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\2\0\0\0\376\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\0E\05\05\09\0B\00\0C\01\0-\0F\0A\04\06\0-\04\06\04\0D\0-\0B\0\0\0\0\0\204\3\0\0\204\4\0\0\320\1\0\0\\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0x\0\0\0\204\4\0\0\320\1\0\0\\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\205\4\0\0\320\1\0\0\\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0t\0\0\0L\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0x\221\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\01\09\0\205\4\0\0\320\1\0\0\\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0x\0\0\0\206\4\0\0\320\1\0\0\\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0x\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\206\4\0\0\320\1\0\0\\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\207\4\0\0\320\1\0\0\\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0x\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) }, 900, ) == 0x0
 01156   860   NtClose  (120, ... ) == 0x0
 01157   860   NtOpenKey  (0x20019, {24, 116, 0x40, 0, 0,  (0x20019, {24, 116, 0x40, 0, 0, "000000000019"}, ... 120, ) }, ... 120, ) == 0x0
 01158   860   NtQueryValueKey  (120,  (120, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 01159   860   NtQueryValueKey  (120,  (120, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 01160   860   NtAllocateVirtualMemory  (-1, 1368064, 0, 4096, 4096, 4, ... 1368064, 4096, ) == 0x0
 01161   860   NtQueryValueKey  (120,  (120, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\16\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\37\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\5\0\0\0\372\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\0C\0D\03\0C\06\04\0B\08\0-\0D\0B\07\06\0-\04\04\0C\08\0-\09\0\0\0\0\0\204\3\0\0\212\4\0\0\320\1\0\0\\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0x\0\0\0\212\4\0\0\320\1\0\0\\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\213\4\0\0\320\1\0\0\\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0t\0\0\0L\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0x\221\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\02\00\0\213\4\0\0\320\1\0\0\\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0x\0\0\0\214\4\0\0\320\1\0\0\\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0x\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\214\4\0\0\320\1\0\0\\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\215\4\0\0\320\1\0\0\\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0x\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) , Partial, 900, ... TitleIdx=0, Type=3, Data= (120, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\16\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\37\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\5\0\0\0\372\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\0C\0D\03\0C\06\04\0B\08\0-\0D\0B\07\06\0-\04\04\0C\08\0-\09\0\0\0\0\0\204\3\0\0\212\4\0\0\320\1\0\0\\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0x\0\0\0\212\4\0\0\320\1\0\0\\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\213\4\0\0\320\1\0\0\\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0t\0\0\0L\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0x\221\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\02\00\0\213\4\0\0\320\1\0\0\\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0x\0\0\0\214\4\0\0\320\1\0\0\\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0x\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\214\4\0\0\320\1\0\0\\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\215\4\0\0\320\1\0\0\\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0x\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) \0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\214\4\0\0\320\1\0\0\\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\215\4\0\0\320\1\0\0\\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0x\0\0\0\0\0\0\0 (120, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\16\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\37\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\5\0\0\0\372\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\0C\0D\03\0C\06\04\0B\08\0-\0D\0B\07\06\0-\04\04\0C\08\0-\09\0\0\0\0\0\204\3\0\0\212\4\0\0\320\1\0\0\\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0x\0\0\0\212\4\0\0\320\1\0\0\\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\213\4\0\0\320\1\0\0\\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0t\0\0\0L\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0x\221\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\02\00\0\213\4\0\0\320\1\0\0\\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0x\0\0\0\214\4\0\0\320\1\0\0\\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0x\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\214\4\0\0\320\1\0\0\\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\215\4\0\0\320\1\0\0\\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0x\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) }, 900, ) == 0x0
 01162   860   NtClose  (120, ... ) == 0x0
 01163   860   NtOpenKey  (0x20019, {24, 116, 0x40, 0, 0,  (0x20019, {24, 116, 0x40, 0, 0, "000000000020"}, ... 120, ) }, ... 120, ) == 0x0
 01164   860   NtQueryValueKey  (120,  (120, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 01165   860   NtQueryValueKey  (120,  (120, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 01166   860   NtQueryValueKey  (120,  (120, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\11\2\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222 \4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\2\0\0\0\372\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\0C\0D\03\0C\06\04\0B\08\0-\0D\0B\07\06\0-\04\04\0C\08\0-\09\0\0\0\0\0\204\3\0\0\217\4\0\0\320\1\0\0\\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0x\0\0\0\217\4\0\0\320\1\0\0\\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\220\4\0\0\320\1\0\0\\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0t\0\0\0L\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0x\221\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\02\01\0\220\4\0\0\320\1\0\0\\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0x\0\0\0\221\4\0\0\320\1\0\0\\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0x\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\221\4\0\0\320\1\0\0\\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\222\4\0\0\320\1\0\0\\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0x\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) , Partial, 900, ... TitleIdx=0, Type=3, Data= (120, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\11\2\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222 \4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\2\0\0\0\372\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\0C\0D\03\0C\06\04\0B\08\0-\0D\0B\07\06\0-\04\04\0C\08\0-\09\0\0\0\0\0\204\3\0\0\217\4\0\0\320\1\0\0\\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0x\0\0\0\217\4\0\0\320\1\0\0\\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\220\4\0\0\320\1\0\0\\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0t\0\0\0L\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0x\221\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\02\01\0\220\4\0\0\320\1\0\0\\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0x\0\0\0\221\4\0\0\320\1\0\0\\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0x\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\221\4\0\0\320\1\0\0\\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\222\4\0\0\320\1\0\0\\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0x\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) \0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\221\4\0\0\320\1\0\0\\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\222\4\0\0\320\1\0\0\\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0x\0\0\0\0\0\0\0 (120, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\11\2\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222 \4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\2\0\0\0\372\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\0C\0D\03\0C\06\04\0B\08\0-\0D\0B\07\06\0-\04\04\0C\08\0-\09\0\0\0\0\0\204\3\0\0\217\4\0\0\320\1\0\0\\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0x\0\0\0\217\4\0\0\320\1\0\0\\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\220\4\0\0\320\1\0\0\\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0t\0\0\0L\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0x\221\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\02\01\0\220\4\0\0\320\1\0\0\\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0x\0\0\0\221\4\0\0\320\1\0\0\\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0x\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\221\4\0\0\320\1\0\0\\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\222\4\0\0\320\1\0\0\\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0x\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) }, 900, ) == 0x0
 01167   860   NtClose  (120, ... ) == 0x0
 01168   860   NtOpenKey  (0x20019, {24, 116, 0x40, 0, 0,  (0x20019, {24, 116, 0x40, 0, 0, "000000000021"}, ... 120, ) }, ... 120, ) == 0x0
 01169   860   NtQueryValueKey  (120,  (120, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 01170   860   NtQueryValueKey  (120,  (120, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 01171   860   NtQueryValueKey  (120,  (120, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\16\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222!\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\5\0\0\0\371\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\02\01\0B\08\0E\09\0D\05\0-\03\0F\0C\03\0-\04\0F\09\0D\0-\08\0\0\0\0\0\204\3\0\0\224\4\0\0\320\1\0\0\\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0x\0\0\0\224\4\0\0\320\1\0\0\\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\225\4\0\0\320\1\0\0\\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0t\0\0\0L\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0x\221\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\02\02\0\225\4\0\0\320\1\0\0\\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0x\0\0\0\226\4\0\0\320\1\0\0\\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0x\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\226\4\0\0\320\1\0\0\\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\227\4\0\0\320\1\0\0\\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0x\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) , Partial, 900, ... TitleIdx=0, Type=3, Data= (120, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\16\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222!\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\5\0\0\0\371\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\02\01\0B\08\0E\09\0D\05\0-\03\0F\0C\03\0-\04\0F\09\0D\0-\08\0\0\0\0\0\204\3\0\0\224\4\0\0\320\1\0\0\\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0x\0\0\0\224\4\0\0\320\1\0\0\\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\225\4\0\0\320\1\0\0\\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0t\0\0\0L\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0x\221\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\02\02\0\225\4\0\0\320\1\0\0\\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0x\0\0\0\226\4\0\0\320\1\0\0\\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0x\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\226\4\0\0\320\1\0\0\\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\227\4\0\0\320\1\0\0\\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0x\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) \0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\226\4\0\0\320\1\0\0\\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\227\4\0\0\320\1\0\0\\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0x\0\0\0\0\0\0\0 (120, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\16\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222!\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\5\0\0\0\371\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\02\01\0B\08\0E\09\0D\05\0-\03\0F\0C\03\0-\04\0F\09\0D\0-\08\0\0\0\0\0\204\3\0\0\224\4\0\0\320\1\0\0\\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0x\0\0\0\224\4\0\0\320\1\0\0\\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\225\4\0\0\320\1\0\0\\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0t\0\0\0L\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0x\221\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\02\02\0\225\4\0\0\320\1\0\0\\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0x\0\0\0\226\4\0\0\320\1\0\0\\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0x\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\226\4\0\0\320\1\0\0\\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\227\4\0\0\320\1\0\0\\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0x\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) }, 900, ) == 0x0
 01172   860   NtClose  (120, ... ) == 0x0
 01173   860   NtOpenKey  (0x20019, {24, 116, 0x40, 0, 0,  (0x20019, {24, 116, 0x40, 0, 0, "000000000022"}, ... 120, ) }, ... 120, ) == 0x0
 01174   860   NtQueryValueKey  (120,  (120, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 01175   860   NtQueryValueKey  (120,  (120, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 01176   860   NtQueryValueKey  (120,  (120, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\11\2\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222"\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\2\0\0\0\371\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\02\01\0B\08\0E\09\0D\05\0-\03\0F\0C\03\0-\04\0F\09\0D\0-\08\0\0\0\0\0\204\3\0\0\231\4\0\0\320\1\0\0\\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0x\0\0\0\231\4\0\0\320\1\0\0\\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\232\4\0\0\320\1\0\0\\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0t\0\0\0\232\4\0\0\320\1\0\0\\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\233\4\0\0\320\1\0\0\\3\0\0\305\0\0\0\0\0\1\0\0\0\0\0\24\0\0\0l\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\233\4\0\0\320\1\0\0\\3\0\0\305\0\0\0\1\0\1\0\2\1\0\0\0\0\0\0\234\4\0\0\320\1\0\0\\3\0\0\25\0\0\0\0\0\1\0\0\0\0\0\24\0\0\0\3\0\37\0\377\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\234\4\0\0\320\1\0\0\\3\0\0\25\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0t\0\0\0\235\4\0\0\320\1\0\0\\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0T\0\0\0\0\0\0\2\0\0\0\0\30\0\0\0h\0\0\0t\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0$\0&\0\300X\24\0\0\0\0\0N\0a\0m\0e\0S\0p\0a\0c\0e\0_\0C\0a\0t\0a\0l\0o\0g\05\0"}, 900, ) , Partial, 900, ... TitleIdx=0, Type=3, Data= (120, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\11\2\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222"\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\2\0\0\0\371\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\02\01\0B\08\0E\09\0D\05\0-\03\0F\0C\03\0-\04\0F\09\0D\0-\08\0\0\0\0\0\204\3\0\0\231\4\0\0\320\1\0\0\\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0x\0\0\0\231\4\0\0\320\1\0\0\\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\232\4\0\0\320\1\0\0\\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0t\0\0\0\232\4\0\0\320\1\0\0\\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\233\4\0\0\320\1\0\0\\3\0\0\305\0\0\0\0\0\1\0\0\0\0\0\24\0\0\0l\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\233\4\0\0\320\1\0\0\\3\0\0\305\0\0\0\1\0\1\0\2\1\0\0\0\0\0\0\234\4\0\0\320\1\0\0\\3\0\0\25\0\0\0\0\0\1\0\0\0\0\0\24\0\0\0\3\0\37\0\377\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\234\4\0\0\320\1\0\0\\3\0\0\25\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0t\0\0\0\235\4\0\0\320\1\0\0\\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0T\0\0\0\0\0\0\2\0\0\0\0\30\0\0\0h\0\0\0t\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0$\0&\0\300X\24\0\0\0\0\0N\0a\0m\0e\0S\0p\0a\0c\0e\0_\0C\0a\0t\0a\0l\0o\0g\05\0"}, 900, ) \4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\2\0\0\0\371\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\02\01\0B\08\0E\09\0D\05\0-\03\0F\0C\03\0-\04\0F\09\0D\0-\08\0\0\0\0\0\204\3\0\0\231\4\0\0\320\1\0\0\\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0x\0\0\0\231\4\0\0\320\1\0\0\\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\232\4\0\0\320\1\0\0\\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0t\0\0\0\232\4\0\0\320\1\0\0\\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\233\4\0\0\320\1\0\0\\3\0\0\305\0\0\0\0\0\1\0\0\0\0\0\24\0\0\0l\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\233\4\0\0\320\1\0\0\\3\0\0\305\0\0\0\1\0\1\0\2\1\0\0\0\0\0\0\234\4\0\0\320\1\0\0\\3\0\0\25\0\0\0\0\0\1\0\0\0\0\0\24\0\0\0\3\0\37\0\377\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\234\4\0\0\320\1\0\0\\3\0\0\25\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0t\0\0\0\235\4\0\0\320\1\0\0\\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0T\0\0\0\0\0\0\2\0\0\0\0\30\0\0\0h\0\0\0t\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0$\0&\0\300X\24\0\0\0\0\0N\0a\0m\0e\0S\0p\0a\0c\0e\0_\0C\0a\0t\0a\0l\0o\0g\05\0"}, 900, ) == 0x0
 01177   860   NtClose  (120, ... ) == 0x0
 01178   860   NtClose  (116, ... ) == 0x0
 01179   860   NtWaitForSingleObject  (108, 0, {0, 0}, ... ) == 0x102
 01180   860   NtCreateEvent  (0x1f0003, 0x0, 0, 0, ... 116, ) == 0x0
 01181   860   NtOpenKey  (0x2000000, {24, 104, 0x40, 0, 0,  (0x2000000, {24, 104, 0x40, 0, 0, "NameSpace_Catalog5"}, ... 120, ) }, ... 120, ) == 0x0
 01182   860   NtQueryValueKey  (120,  (120, "Serial_Access_Num", Partial, 144, ... TitleIdx=0, Type=4, Data="\5\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (120, "Serial_Access_Num", Partial, 144, ... TitleIdx=0, Type=4, Data="\5\0\0\0"}, 16, ) }, 16, ) == 0x0
 01183   860   NtNotifyChangeKey  (120, 116, 0, 0, 2011455960, 1, 0, 0, 0, 1, ... ) == 0x103
 01184   860   NtQueryValueKey  (120,  (120, "Serial_Access_Num", Partial, 144, ... TitleIdx=0, Type=4, Data="\5\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (120, "Serial_Access_Num", Partial, 144, ... TitleIdx=0, Type=4, Data="\5\0\0\0"}, 16, ) }, 16, ) == 0x0
 01185   860   NtOpenKey  (0x2000000, {24, 120, 0x40, 0, 0,  (0x2000000, {24, 120, 0x40, 0, 0, "00000005"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01186   860   NtQueryValueKey  (120,  (120, "Num_Catalog_Entries", Partial, 144, ... TitleIdx=0, Type=4, Data="\4\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (120, "Num_Catalog_Entries", Partial, 144, ... TitleIdx=0, Type=4, Data="\4\0\0\0"}, 16, ) }, 16, ) == 0x0
 01187   860   NtOpenKey  (0x2000000, {24, 120, 0x40, 0, 0,  (0x2000000, {24, 120, 0x40, 0, 0, "Catalog_Entries"}, ... 124, ) }, ... 124, ) == 0x0
 01188   860   NtOpenKey  (0x20019, {24, 124, 0x40, 0, 0,  (0x20019, {24, 124, 0x40, 0, 0, "000000000001"}, ... 128, ) }, ... 128, ) == 0x0
 01189   860   NtQueryValueKey  (128,  (128, "LibraryPath", Partial, 144, ... TitleIdx=0, Type=1, Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0m\0s\0w\0s\0o\0c\0k\0.\0d\0l\0l\0\0\0"}, 80, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (128, "LibraryPath", Partial, 144, ... TitleIdx=0, Type=1, Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0m\0s\0w\0s\0o\0c\0k\0.\0d\0l\0l\0\0\0"}, 80, ) }, 80, ) == 0x0
 01190   860   NtQueryValueKey  (128,  (128, "LibraryPath", Partial, 144, ... TitleIdx=0, Type=1, Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0m\0s\0w\0s\0o\0c\0k\0.\0d\0l\0l\0\0\0"}, 80, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (128, "LibraryPath", Partial, 144, ... TitleIdx=0, Type=1, Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0m\0s\0w\0s\0o\0c\0k\0.\0d\0l\0l\0\0\0"}, 80, ) }, 80, ) == 0x0
 01191   860   NtQueryValueKey  (128,  (128, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="T\0c\0p\0i\0p\0\0\0"}, 24, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (128, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="T\0c\0p\0i\0p\0\0\0"}, 24, ) }, 24, ) == 0x0
 01192   860   NtQueryValueKey  (128,  (128, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="T\0c\0p\0i\0p\0\0\0"}, 24, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (128, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="T\0c\0p\0i\0p\0\0\0"}, 24, ) }, 24, ) == 0x0
 01193   860   NtQueryValueKey  (128,  (128, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="T\0c\0p\0i\0p\0\0\0"}, 24, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (128, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="T\0c\0p\0i\0p\0\0\0"}, 24, ) }, 24, ) == 0x0
 01194   860   NtQueryValueKey  (128,  (128, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="T\0c\0p\0i\0p\0\0\0"}, 24, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (128, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="T\0c\0p\0i\0p\0\0\0"}, 24, ) }, 24, ) == 0x0
 01195   860   NtQueryValueKey  (128,  (128, "ProviderId", Partial, 144, ... TitleIdx=0, Type=3, Data="@\235\5"\236~\317\21\256Z\0\252\0\247\21+"}, 28, ) , Partial, 144, ... TitleIdx=0, Type=3, Data= (128, "ProviderId", Partial, 144, ... TitleIdx=0, Type=3, Data="@\235\5"\236~\317\21\256Z\0\252\0\247\21+"}, 28, ) \236~\317\21\256Z\0\252\0\247\21+"}, 28, ) == 0x0
 01196   860   NtQueryValueKey  (128,  (128, "AddressFamily", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01197   860   NtQueryValueKey  (128,  (128, "SupportedNameSpace", Partial, 144, ... TitleIdx=0, Type=4, Data="\14\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (128, "SupportedNameSpace", Partial, 144, ... TitleIdx=0, Type=4, Data="\14\0\0\0"}, 16, ) }, 16, ) == 0x0
 01198   860   NtQueryValueKey  (128,  (128, "Enabled", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (128, "Enabled", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) }, 16, ) == 0x0
 01199   860   NtQueryValueKey  (128,  (128, "Version", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (128, "Version", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) }, 16, ) == 0x0
 01200   860   NtQueryValueKey  (128,  (128, "StoresServiceClassInfo", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (128, "StoresServiceClassInfo", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) }, 16, ) == 0x0
 01201   860   NtClose  (128, ... ) == 0x0
 01202   860   NtOpenKey  (0x20019, {24, 124, 0x40, 0, 0,  (0x20019, {24, 124, 0x40, 0, 0, "000000000002"}, ... 128, ) }, ... 128, ) == 0x0
 01203   860   NtQueryValueKey  (128,  (128, "LibraryPath", Partial, 144, ... TitleIdx=0, Type=1, Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0w\0i\0n\0r\0n\0r\0.\0d\0l\0l\0\0\0"}, 78, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (128, "LibraryPath", Partial, 144, ... TitleIdx=0, Type=1, Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0w\0i\0n\0r\0n\0r\0.\0d\0l\0l\0\0\0"}, 78, ) }, 78, ) == 0x0
 01204   860   NtQueryValueKey  (128,  (128, "LibraryPath", Partial, 144, ... TitleIdx=0, Type=1, Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0w\0i\0n\0r\0n\0r\0.\0d\0l\0l\0\0\0"}, 78, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (128, "LibraryPath", Partial, 144, ... TitleIdx=0, Type=1, Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0w\0i\0n\0r\0n\0r\0.\0d\0l\0l\0\0\0"}, 78, ) }, 78, ) == 0x0
 01205   860   NtQueryValueKey  (128,  (128, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="N\0T\0D\0S\0\0\0"}, 22, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (128, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="N\0T\0D\0S\0\0\0"}, 22, ) }, 22, ) == 0x0
 01206   860   NtQueryValueKey  (128,  (128, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="N\0T\0D\0S\0\0\0"}, 22, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (128, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="N\0T\0D\0S\0\0\0"}, 22, ) }, 22, ) == 0x0
 01207   860   NtQueryValueKey  (128,  (128, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="N\0T\0D\0S\0\0\0"}, 22, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (128, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="N\0T\0D\0S\0\0\0"}, 22, ) }, 22, ) == 0x0
 01208   860   NtQueryValueKey  (128,  (128, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="N\0T\0D\0S\0\0\0"}, 22, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (128, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="N\0T\0D\0S\0\0\0"}, 22, ) }, 22, ) == 0x0
 01209   860   NtQueryValueKey  (128,  (128, "ProviderId", Partial, 144, ... TitleIdx=0, Type=3, Data="\3567&;\200\345\317\21\245U\0\300O\330\324\254"}, 28, ) , Partial, 144, ... TitleIdx=0, Type=3, Data= (128, "ProviderId", Partial, 144, ... TitleIdx=0, Type=3, Data="\3567&;\200\345\317\21\245U\0\300O\330\324\254"}, 28, ) }, 28, ) == 0x0
 01210   860   NtQueryValueKey  (128,  (128, "AddressFamily", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01211   860   NtQueryValueKey  (128,  (128, "SupportedNameSpace", Partial, 144, ... TitleIdx=0, Type=4, Data=" \0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (128, "SupportedNameSpace", Partial, 144, ... TitleIdx=0, Type=4, Data=" \0\0\0"}, 16, ) }, 16, ) == 0x0
 01212   860   NtQueryValueKey  (128,  (128, "Enabled", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (128, "Enabled", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) }, 16, ) == 0x0
 01213   860   NtQueryValueKey  (128,  (128, "Version", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (128, "Version", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) }, 16, ) == 0x0
 01214   860   NtQueryValueKey  (128,  (128, "StoresServiceClassInfo", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (128, "StoresServiceClassInfo", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) }, 16, ) == 0x0
 01215   860   NtClose  (128, ... ) == 0x0
 01216   860   NtOpenKey  (0x20019, {24, 124, 0x40, 0, 0,  (0x20019, {24, 124, 0x40, 0, 0, "000000000003"}, ... 128, ) }, ... 128, ) == 0x0
 01217   860   NtQueryValueKey  (128,  (128, "LibraryPath", Partial, 144, ... TitleIdx=0, Type=1, Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0m\0s\0w\0s\0o\0c\0k\0.\0d\0l\0l\0\0\0"}, 80, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (128, "LibraryPath", Partial, 144, ... TitleIdx=0, Type=1, Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0m\0s\0w\0s\0o\0c\0k\0.\0d\0l\0l\0\0\0"}, 80, ) }, 80, ) == 0x0
 01218   860   NtQueryValueKey  (128,  (128, "LibraryPath", Partial, 144, ... TitleIdx=0, Type=1, Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0m\0s\0w\0s\0o\0c\0k\0.\0d\0l\0l\0\0\0"}, 80, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (128, "LibraryPath", Partial, 144, ... TitleIdx=0, Type=1, Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0m\0s\0w\0s\0o\0c\0k\0.\0d\0l\0l\0\0\0"}, 80, ) }, 80, ) == 0x0
 01219   860   NtQueryValueKey  (128,  (128, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="N\0e\0t\0w\0o\0r\0k\0 \0L\0o\0c\0a\0t\0i\0o\0n\0 \0A\0w\0a\0r\0e\0n\0e\0s\0s\0 \0(\0N\0L\0A\0)\0 \0N\0a\0m\0e\0s\0p\0a\0c\0e\0\0\0"}, 98, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (128, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="N\0e\0t\0w\0o\0r\0k\0 \0L\0o\0c\0a\0t\0i\0o\0n\0 \0A\0w\0a\0r\0e\0n\0e\0s\0s\0 \0(\0N\0L\0A\0)\0 \0N\0a\0m\0e\0s\0p\0a\0c\0e\0\0\0"}, 98, ) }, 98, ) == 0x0
 01220   860   NtQueryValueKey  (128,  (128, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="N\0e\0t\0w\0o\0r\0k\0 \0L\0o\0c\0a\0t\0i\0o\0n\0 \0A\0w\0a\0r\0e\0n\0e\0s\0s\0 \0(\0N\0L\0A\0)\0 \0N\0a\0m\0e\0s\0p\0a\0c\0e\0\0\0"}, 98, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (128, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="N\0e\0t\0w\0o\0r\0k\0 \0L\0o\0c\0a\0t\0i\0o\0n\0 \0A\0w\0a\0r\0e\0n\0e\0s\0s\0 \0(\0N\0L\0A\0)\0 \0N\0a\0m\0e\0s\0p\0a\0c\0e\0\0\0"}, 98, ) }, 98, ) == 0x0
 01221   860   NtQueryValueKey  (128,  (128, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="N\0e\0t\0w\0o\0r\0k\0 \0L\0o\0c\0a\0t\0i\0o\0n\0 \0A\0w\0a\0r\0e\0n\0e\0s\0s\0 \0(\0N\0L\0A\0)\0 \0N\0a\0m\0e\0s\0p\0a\0c\0e\0\0\0"}, 98, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (128, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="N\0e\0t\0w\0o\0r\0k\0 \0L\0o\0c\0a\0t\0i\0o\0n\0 \0A\0w\0a\0r\0e\0n\0e\0s\0s\0 \0(\0N\0L\0A\0)\0 \0N\0a\0m\0e\0s\0p\0a\0c\0e\0\0\0"}, 98, ) }, 98, ) == 0x0
 01222   860   NtAllocateVirtualMemory  (-1, 1372160, 0, 4096, 4096, 4, ... 1372160, 4096, ) == 0x0
 01223   860   NtQueryValueKey  (128,  (128, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="N\0e\0t\0w\0o\0r\0k\0 \0L\0o\0c\0a\0t\0i\0o\0n\0 \0A\0w\0a\0r\0e\0n\0e\0s\0s\0 \0(\0N\0L\0A\0)\0 \0N\0a\0m\0e\0s\0p\0a\0c\0e\0\0\0"}, 98, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (128, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="N\0e\0t\0w\0o\0r\0k\0 \0L\0o\0c\0a\0t\0i\0o\0n\0 \0A\0w\0a\0r\0e\0n\0e\0s\0s\0 \0(\0N\0L\0A\0)\0 \0N\0a\0m\0e\0s\0p\0a\0c\0e\0\0\0"}, 98, ) }, 98, ) == 0x0
 01224   860   NtQueryValueKey  (128,  (128, "ProviderId", Partial, 144, ... TitleIdx=0, Type=3, Data=":$Bf\250;\246J\272\245.\13\327\37\335\203"}, 28, ) , Partial, 144, ... TitleIdx=0, Type=3, Data= (128, "ProviderId", Partial, 144, ... TitleIdx=0, Type=3, Data=":$Bf\250;\246J\272\245.\13\327\37\335\203"}, 28, ) }, 28, ) == 0x0
 01225   860   NtQueryValueKey  (128,  (128, "AddressFamily", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01226   860   NtQueryValueKey  (128,  (128, "SupportedNameSpace", Partial, 144, ... TitleIdx=0, Type=4, Data="\17\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (128, "SupportedNameSpace", Partial, 144, ... TitleIdx=0, Type=4, Data="\17\0\0\0"}, 16, ) }, 16, ) == 0x0
 01227   860   NtQueryValueKey  (128,  (128, "Enabled", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (128, "Enabled", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) }, 16, ) == 0x0
 01228   860   NtQueryValueKey  (128,  (128, "Version", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (128, "Version", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) }, 16, ) == 0x0
 01229   860   NtQueryValueKey  (128,  (128, "StoresServiceClassInfo", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (128, "StoresServiceClassInfo", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) }, 16, ) == 0x0
 01230   860   NtClose  (128, ... ) == 0x0
 01231   860   NtOpenKey  (0x20019, {24, 124, 0x40, 0, 0,  (0x20019, {24, 124, 0x40, 0, 0, "000000000004"}, ... 128, ) }, ... 128, ) == 0x0
 01232   860   NtQueryValueKey  (128,  (128, "LibraryPath", Partial, 144, ... TitleIdx=0, Type=1, Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0s\0y\0s\0t\0e\0m\03\02\0\\0w\0s\0h\0b\0t\0h\0.\0d\0l\0l\0\0\0"}, 78, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (128, "LibraryPath", Partial, 144, ... TitleIdx=0, Type=1, Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0s\0y\0s\0t\0e\0m\03\02\0\\0w\0s\0h\0b\0t\0h\0.\0d\0l\0l\0\0\0"}, 78, ) }, 78, ) == 0x0
 01233   860   NtQueryValueKey  (128,  (128, "LibraryPath", Partial, 144, ... TitleIdx=0, Type=1, Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0s\0y\0s\0t\0e\0m\03\02\0\\0w\0s\0h\0b\0t\0h\0.\0d\0l\0l\0\0\0"}, 78, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (128, "LibraryPath", Partial, 144, ... TitleIdx=0, Type=1, Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0s\0y\0s\0t\0e\0m\03\02\0\\0w\0s\0h\0b\0t\0h\0.\0d\0l\0l\0\0\0"}, 78, ) }, 78, ) == 0x0
 01234   860   NtQueryValueKey  (128,  (128, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="B\0l\0u\0e\0t\0o\0o\0t\0h\0 \0N\0a\0m\0e\0s\0p\0a\0c\0e\0\0\0"}, 52, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (128, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="B\0l\0u\0e\0t\0o\0o\0t\0h\0 \0N\0a\0m\0e\0s\0p\0a\0c\0e\0\0\0"}, 52, ) }, 52, ) == 0x0
 01235   860   NtQueryValueKey  (128,  (128, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="B\0l\0u\0e\0t\0o\0o\0t\0h\0 \0N\0a\0m\0e\0s\0p\0a\0c\0e\0\0\0"}, 52, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (128, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="B\0l\0u\0e\0t\0o\0o\0t\0h\0 \0N\0a\0m\0e\0s\0p\0a\0c\0e\0\0\0"}, 52, ) }, 52, ) == 0x0
 01236   860   NtQueryValueKey  (128,  (128, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="B\0l\0u\0e\0t\0o\0o\0t\0h\0 \0N\0a\0m\0e\0s\0p\0a\0c\0e\0\0\0"}, 52, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (128, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="B\0l\0u\0e\0t\0o\0o\0t\0h\0 \0N\0a\0m\0e\0s\0p\0a\0c\0e\0\0\0"}, 52, ) }, 52, ) == 0x0
 01237   860   NtQueryValueKey  (128,  (128, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="B\0l\0u\0e\0t\0o\0o\0t\0h\0 \0N\0a\0m\0e\0s\0p\0a\0c\0e\0\0\0"}, 52, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (128, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="B\0l\0u\0e\0t\0o\0o\0t\0h\0 \0N\0a\0m\0e\0s\0p\0a\0c\0e\0\0\0"}, 52, ) }, 52, ) == 0x0
 01238   860   NtQueryValueKey  (128,  (128, "ProviderId", Partial, 144, ... TitleIdx=0, Type=3, Data="\340c\252\6`}\377A\257\262>\346\322\3319-"}, 28, ) , Partial, 144, ... TitleIdx=0, Type=3, Data= (128, "ProviderId", Partial, 144, ... TitleIdx=0, Type=3, Data="\340c\252\6`}\377A\257\262>\346\322\3319-"}, 28, ) }, 28, ) == 0x0
 01239   860   NtQueryValueKey  (128,  (128, "AddressFamily", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01240   860   NtQueryValueKey  (128,  (128, "SupportedNameSpace", Partial, 144, ... TitleIdx=0, Type=4, Data="\20\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (128, "SupportedNameSpace", Partial, 144, ... TitleIdx=0, Type=4, Data="\20\0\0\0"}, 16, ) }, 16, ) == 0x0
 01241   860   NtQueryValueKey  (128,  (128, "Enabled", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (128, "Enabled", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) }, 16, ) == 0x0
 01242   860   NtQueryValueKey  (128,  (128, "Version", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (128, "Version", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) }, 16, ) == 0x0
 01243   860   NtQueryValueKey  (128,  (128, "StoresServiceClassInfo", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (128, "StoresServiceClassInfo", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) }, 16, ) == 0x0
 01244   860   NtClose  (128, ... ) == 0x0
 01245   860   NtClose  (124, ... ) == 0x0
 01246   860   NtWaitForSingleObject  (116, 0, {0, 0}, ... ) == 0x102
 01247   860   NtClose  (104, ... ) == 0x0
 01248   860   NtQuerySystemInformation  (Basic, 44, ... {Unknown=0,MaximumIncrement=156250,PhysicalPageSize=0x1000,NumberOfPhysicalPages=0xff7c,LowestPhysicalPage=0x1,HighestPhysicalPage=0xffff,AllocationGranularity=0x10000,LowestUserAddress=0x10000,HighestUserAddress=0x7ffeffff,ActiveProcessors=1,NumberProcessors=1,}, 0x0, ) == 0x0
 01249   860   NtQuerySystemInformation  (Processor, 12, ... {system info, class 1, size 12}, 0x0, ) == 0x0
 01250   860   NtOpenKey  (0x1, {24, 16, 0x40, 0, 0,  (0x1, {24, 16, 0x40, 0, 0, "System\CurrentControlSet\Services\Winsock2\Parameters"}, ... 104, ) }, ... 104, ) == 0x0
 01251   860   NtQueryValueKey  (104,  (104, "Ws2_32NumHandleBuckets", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01252   860   NtClose  (104, ... ) == 0x0
 01253   860   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ... 104, ) == 0x0
 01254   860   NtQueryVirtualMemory  (-1, 0x3a7231, Basic, 28, ... {BaseAddress=0x3a7000,AllocationBase=0x3a0000,AllocationProtect=0x40,RegionSize=0x29000,State=0x1000,Protect=0x40,Type=0x20000,}, 28, ) == 0x0
 01255   860   NtQueryVirtualMemory  (-1, 0x3a341e, Basic, 28, ... {BaseAddress=0x3a3000,AllocationBase=0x3a0000,AllocationProtect=0x40,RegionSize=0x2d000,State=0x1000,Protect=0x40,Type=0x20000,}, 28, ) == 0x0
 01256   860   NtContinue  (1243080, 0, ...
 01257   860   NtYieldExecution  (... ) == STATUS_NO_YIELD_PERFORMED
 01258   860   NtClose  (112, ... ) == 0x0
 01259   860   NtClose  (108, ... ) == 0x0
 01260   860   NtYieldExecution  (... ) == STATUS_NO_YIELD_PERFORMED
 01261   860   NtClose  (120, ... ) == 0x0
 01262   860   NtClose  (116, ... ) == 0x0
 01263   860   NtFreeVirtualMemory  (-1, (0x970000), 0, 32768, ... (0x970000), 1048576, ) == 0x0
 01264   860   NtQueryVirtualMemory  (-1, 0x3a3197, Basic, 28, ... {BaseAddress=0x3a3000,AllocationBase=0x3a0000,AllocationProtect=0x40,RegionSize=0x2d000,State=0x1000,Protect=0x40,Type=0x20000,}, 28, ) == 0x0
 01265   860   NtQueryVirtualMemory  (-1, 0x3a3294, Basic, 28, ... {BaseAddress=0x3a3000,AllocationBase=0x3a0000,AllocationProtect=0x40,RegionSize=0x2d000,State=0x1000,Protect=0x40,Type=0x20000,}, 28, ) == 0x0
 01266   860   NtQueryInformationProcess  (-1, DebugPort, 4, ... {process info, class 7, size 4}, 0x0, ) == 0x0
 01267   860   NtQueryInformationProcess  (-1, 36, 4, ... {process info, class 36, size 4}, 0x0, ) == 0x0
 01268   860   NtQueryVirtualMemory  (-1, 0x77c2807c, Basic, 28, ... {BaseAddress=0x77c28000,AllocationBase=0x77c10000,AllocationProtect=0x80,RegionSize=0x35000,State=0x1000,Protect=0x20,Type=0x1000000,}, 28, ) == 0x0
 01269   860   NtQueryInformationProcess  (-1, DefaultHardErrorMode, 4, ... {process info, class 12, size 4}, 0x0, ) == 0x0
 01270   860   NtQueryInformationJobObject  (0, BasicLimit, 48, ... ) == STATUS_ACCESS_DENIED
 01271   860   NtOpenKey  (0x1, {24, 0, 0x40, 0, 0,  (0x1, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\AeDebug"}, ... 116, ) }, ... 116, ) == 0x0
 01272   860   NtQueryValueKey  (116,  (116, "Auto", Partial, 526, ... TitleIdx=0, Type=1, Data="0\0\0\0"}, 16, ) , Partial, 526, ... TitleIdx=0, Type=1, Data= (116, "Auto", Partial, 526, ... TitleIdx=0, Type=1, Data="0\0\0\0"}, 16, ) }, 16, ) == 0x0
 01273   860   NtQueryValueKey  (116,  (116, "Debugger", Partial, 526, ... TitleIdx=0, Type=1, Data=""\0C\0:\0\\0P\0r\0o\0g\0r\0a\0m\0 \0F\0i\0l\0e\0s\0\\0M\0i\0c\0r\0o\0s\0o\0f\0t\0 \0V\0i\0s\0u\0a\0l\0 \0S\0t\0u\0d\0i\0o\0\\0C\0o\0m\0m\0o\0n\0\\0M\0S\0D\0e\0v\09\08\0\\0B\0i\0n\0\\0m\0s\0d\0e\0v\0.\0e\0x\0e\0"\0 \0-\0p\0 \0%\0l\0d\0 \0-\0e\0 \0%\0l\0d\0\0\0"}, 184, ) , Partial, 526, ... TitleIdx=0, Type=1, Data=" (116, "Debugger", Partial, 526, ... TitleIdx=0, Type=1, Data=""\0C\0:\0\\0P\0r\0o\0g\0r\0a\0m\0 \0F\0i\0l\0e\0s\0\\0M\0i\0c\0r\0o\0s\0o\0f\0t\0 \0V\0i\0s\0u\0a\0l\0 \0S\0t\0u\0d\0i\0o\0\\0C\0o\0m\0m\0o\0n\0\\0M\0S\0D\0e\0v\09\08\0\\0B\0i\0n\0\\0m\0s\0d\0e\0v\0.\0e\0x\0e\0"\0 \0-\0p\0 \0%\0l\0d\0 \0-\0e\0 \0%\0l\0d\0\0\0"}, 184, ) \0 \0-\0p\0 \0%\0l\0d\0 \0-\0e\0 \0%\0l\0d\0\0\0"}, 184, ) == 0x0
 01274   860   NtClose  (116, ... ) == 0x0
 01275   860   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\faultrep.dll"}, 1238888, ... ) }, 1238888, ... ) == 0x0
 01276   860   NtOpenFile  (0x100020, {24, 0, 0x40, 0, 0,  (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\faultrep.dll"}, 5, 96, ... 116, {status=0x0, info=1}, ) }, 5, 96, ... 116, {status=0x0, info=1}, ) == 0x0
 01277   860   NtCreateSection  (0xe, 0x0, 0x0, 16, 134217728, 116, ... 120, ) == 0x0
 01278   860   NtClose  (116, ... ) == 0x0
 01279   860   NtMapViewOfSection  (120, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 16, ... (0x370000), 0x0, 81920, ) == 0x0
 01280   860   NtClose  (120, ... ) == 0x0
 01281   860   NtUnmapViewOfSection  (-1, 0x370000, ... ) == 0x0
 01282   860   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\faultrep.dll"}, 1239196, ... ) }, 1239196, ... ) == 0x0
 01283   860   NtOpenFile  (0x100020, {24, 0, 0x40, 0, 0,  (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\faultrep.dll"}, 5, 96, ... 120, {status=0x0, info=1}, ) }, 5, 96, ... 120, {status=0x0, info=1}, ) == 0x0
 01284   860   NtCreateSection  (0xf, 0x0, 0x0, 16, 16777216, 120, ... 116, ) == 0x0
 01285   860   NtQuerySection  (116, Image, 48, ... {section info, class 1, size 48}, 0x0, ) == 0x0
 01286   860   NtClose  (120, ... ) == 0x0
 01287   860   NtMapViewOfSection  (116, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x69450000), 0x0, 90112, ) == 0x0
 01288   860   NtClose  (116, ... ) == 0x0
 01289   860   NtOpenSection  (0xe, {24, 8, 0x40, 0, 0,  (0xe, {24, 8, 0x40, 0, 0, "USERENV.dll"}, ... 116, ) }, ... 116, ) == 0x0
 01290   860   NtMapViewOfSection  (116, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x769c0000), 0x0, 733184, ) == 0x0
 01291   860   NtClose  (116, ... ) == 0x0
 01292   860   NtProtectVirtualMemory  (-1, (0x769c1000), 1244, 4, ... (0x769c1000), 4096, 32, ) == 0x0
 01293   860   NtProtectVirtualMemory  (-1, (0x769c1000), 4096, 32, ... (0x769c1000), 4096, 4, ) == 0x0
 01294   860   NtFlushInstructionCache  (-1, 1989939200, 1244, ... ) == 0x0
 01295   860   NtProtectVirtualMemory  (-1, (0x769c1000), 1244, 4, ... (0x769c1000), 4096, 32, ) == 0x0
 01296   860   NtProtectVirtualMemory  (-1, (0x769c1000), 4096, 32, ... (0x769c1000), 4096, 4, ) == 0x0
 01297   860   NtFlushInstructionCache  (-1, 1989939200, 1244, ... ) == 0x0
 01298   860   NtProtectVirtualMemory  (-1, (0x769c1000), 1244, 4, ... (0x769c1000), 4096, 32, ) == 0x0
 01299   860   NtProtectVirtualMemory  (-1, (0x769c1000), 4096, 32, ... (0x769c1000), 4096, 4, ) == 0x0
 01300   860   NtFlushInstructionCache  (-1, 1989939200, 1244, ... ) == 0x0
 01301   860   NtProtectVirtualMemory  (-1, (0x769c1000), 1244, 4, ... (0x769c1000), 4096, 32, ) == 0x0
 01302   860   NtProtectVirtualMemory  (-1, (0x769c1000), 4096, 32, ... (0x769c1000), 4096, 4, ) == 0x0
 01303   860   NtFlushInstructionCache  (-1, 1989939200, 1244, ... ) == 0x0
 01304   860   NtOpenSection  (0xe, {24, 8, 0x40, 0, 0,  (0xe, {24, 8, 0x40, 0, 0, "WINSTA.dll"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01305   860   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\u:\work\WINSTA.dll"}, 1238372, ... ) }, 1238372, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01306   860   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\WINSTA.dll"}, 1238372, ... ) }, 1238372, ... ) == 0x0
 01307   860   NtOpenFile  (0x100020, {24, 0, 0x40, 0, 0,  (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\WINSTA.dll"}, 5, 96, ... 116, {status=0x0, info=1}, ) }, 5, 96, ... 116, {status=0x0, info=1}, ) == 0x0
 01308   860   NtCreateSection  (0xf, 0x0, 0x0, 16, 16777216, 116, ... 120, ) == 0x0
 01309   860   NtQuerySection  (120, Image, 48, ... {section info, class 1, size 48}, 0x0, ) == 0x0
 01310   860   NtClose  (116, ... ) == 0x0
 01311   860   NtMapViewOfSection  (120, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x76360000), 0x0, 65536, ) == 0x0
 01312   860   NtClose  (120, ... ) == 0x0
 01313   860   NtProtectVirtualMemory  (-1, (0x76361000), 212, 4, ... (0x76361000), 4096, 32, ) == 0x0
 01314   860   NtProtectVirtualMemory  (-1, (0x76361000), 4096, 32, ... (0x76361000), 4096, 4, ) == 0x0
 01315   860   NtFlushInstructionCache  (-1, 1983254528, 212, ... ) == 0x0
 01316   860   NtProtectVirtualMemory  (-1, (0x76361000), 212, 4, ... (0x76361000), 4096, 32, ) == 0x0
 01317   860   NtProtectVirtualMemory  (-1, (0x76361000), 4096, 32, ... (0x76361000), 4096, 4, ) == 0x0
 01318   860   NtFlushInstructionCache  (-1, 1983254528, 212, ... ) == 0x0
 01319   860   NtOpenSection  (0xe, {24, 8, 0x40, 0, 0,  (0xe, {24, 8, 0x40, 0, 0, "NETAPI32.dll"}, ... 120, ) }, ... 120, ) == 0x0
 01320   860   NtMapViewOfSection  (120, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x5b860000), 0x0, 344064, ) == 0x0
 01321   860   NtClose  (120, ... ) == 0x0
 01322   860   NtProtectVirtualMemory  (-1, (0x5b861000), 1168, 4, ... (0x5b861000), 4096, 32, ) == 0x0
 01323   860   NtProtectVirtualMemory  (-1, (0x5b861000), 4096, 32, ... (0x5b861000), 4096, 4, ) == 0x0
 01324   860   NtFlushInstructionCache  (-1, 1535512576, 1168, ... ) == 0x0
 01325   860   NtProtectVirtualMemory  (-1, (0x5b861000), 1168, 4, ... (0x5b861000), 4096, 32, ) == 0x0
 01326   860   NtProtectVirtualMemory  (-1, (0x5b861000), 4096, 32, ... (0x5b861000), 4096, 4, ) == 0x0
 01327   860   NtFlushInstructionCache  (-1, 1535512576, 1168, ... ) == 0x0
 01328   860   NtProtectVirtualMemory  (-1, (0x5b861000), 1168, 4, ... (0x5b861000), 4096, 32, ) == 0x0
 01329   860   NtProtectVirtualMemory  (-1, (0x5b861000), 4096, 32, ... (0x5b861000), 4096, 4, ) == 0x0
 01330   860   NtFlushInstructionCache  (-1, 1535512576, 1168, ... ) == 0x0
 01331   860   NtProtectVirtualMemory  (-1, (0x5b861000), 1168, 4, ... (0x5b861000), 4096, 32, ) == 0x0
 01332   860   NtProtectVirtualMemory  (-1, (0x5b861000), 4096, 32, ... (0x5b861000), 4096, 4, ) == 0x0
 01333   860   NtFlushInstructionCache  (-1, 1535512576, 1168, ... ) == 0x0
 01334   860   NtProtectVirtualMemory  (-1, (0x5b861000), 1168, 4, ... (0x5b861000), 4096, 32, ) == 0x0
 01335   860   NtProtectVirtualMemory  (-1, (0x5b861000), 4096, 32, ... (0x5b861000), 4096, 4, ) == 0x0
 01336   860   NtFlushInstructionCache  (-1, 1535512576, 1168, ... ) == 0x0
 01337   860   NtProtectVirtualMemory  (-1, (0x76361000), 212, 4, ... (0x76361000), 4096, 32, ) == 0x0
 01338   860   NtProtectVirtualMemory  (-1, (0x76361000), 4096, 32, ... (0x76361000), 4096, 4, ) == 0x0
 01339   860   NtFlushInstructionCache  (-1, 1983254528, 212, ... ) == 0x0
 01340   860   NtProtectVirtualMemory  (-1, (0x76361000), 212, 4, ... (0x76361000), 4096, 32, ) == 0x0
 01341   860   NtProtectVirtualMemory  (-1, (0x76361000), 4096, 32, ... (0x76361000), 4096, 4, ) == 0x0
 01342   860   NtFlushInstructionCache  (-1, 1983254528, 212, ... ) == 0x0
 01343   860   NtOpenSection  (0xe, {24, 8, 0x40, 0, 0,  (0xe, {24, 8, 0x40, 0, 0, "WTSAPI32.dll"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01344   860   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\u:\work\WTSAPI32.dll"}, 1238372, ... ) }, 1238372, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01345   860   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\WTSAPI32.dll"}, 1238372, ... ) }, 1238372, ... ) == 0x0
 01346   860   NtOpenFile  (0x100020, {24, 0, 0x40, 0, 0,  (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\WTSAPI32.dll"}, 5, 96, ... 120, {status=0x0, info=1}, ) }, 5, 96, ... 120, {status=0x0, info=1}, ) == 0x0
 01347   860   NtCreateSection  (0xf, 0x0, 0x0, 16, 16777216, 120, ... 116, ) == 0x0
 01348   860   NtQuerySection  (116, Image, 48, ... {section info, class 1, size 48}, 0x0, ) == 0x0
 01349   860   NtClose  (120, ... ) == 0x0
 01350   860   NtMapViewOfSection  (116, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x76f50000), 0x0, 32768, ) == 0x0
 01351   860   NtClose  (116, ... ) == 0x0
 01352   860   NtProtectVirtualMemory  (-1, (0x76f51000), 332, 4, ... (0x76f51000), 4096, 32, ) == 0x0
 01353   860   NtProtectVirtualMemory  (-1, (0x76f51000), 4096, 32, ... (0x76f51000), 4096, 4, ) == 0x0
 01354   860   NtFlushInstructionCache  (-1, 1995771904, 332, ... ) == 0x0
 01355   860   NtProtectVirtualMemory  (-1, (0x76f51000), 332, 4, ... (0x76f51000), 4096, 32, ) == 0x0
 01356   860   NtProtectVirtualMemory  (-1, (0x76f51000), 4096, 32, ... (0x76f51000), 4096, 4, ) == 0x0
 01357   860   NtFlushInstructionCache  (-1, 1995771904, 332, ... ) == 0x0
 01358   860   NtProtectVirtualMemory  (-1, (0x76f51000), 332, 4, ... (0x76f51000), 4096, 32, ) == 0x0
 01359   860   NtProtectVirtualMemory  (-1, (0x76f51000), 4096, 32, ... (0x76f51000), 4096, 4, ) == 0x0
 01360   860   NtFlushInstructionCache  (-1, 1995771904, 332, ... ) == 0x0
 01361   860   NtProtectVirtualMemory  (-1, (0x76f51000), 332, 4, ... (0x76f51000), 4096, 32, ) == 0x0
 01362   860   NtProtectVirtualMemory  (-1, (0x76f51000), 4096, 32, ... (0x76f51000), 4096, 4, ) == 0x0
 01363   860   NtFlushInstructionCache  (-1, 1995771904, 332, ... ) == 0x0
 01364   860   NtOpenSection  (0xe, {24, 8, 0x40, 0, 0,  (0xe, {24, 8, 0x40, 0, 0, "SETUPAPI.dll"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01365   860   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\u:\work\SETUPAPI.dll"}, 1238372, ... ) }, 1238372, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01366   860   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\SETUPAPI.dll"}, 1238372, ... ) }, 1238372, ... ) == 0x0
 01367   860   NtOpenFile  (0x100020, {24, 0, 0x40, 0, 0,  (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\SETUPAPI.dll"}, 5, 96, ... 116, {status=0x0, info=1}, ) }, 5, 96, ... 116, {status=0x0, info=1}, ) == 0x0
 01368   860   NtCreateSection  (0xf, 0x0, 0x0, 16, 16777216, 116, ... 120, ) == 0x0
 01369   860   NtQuerySection  (120, Image, 48, ... {section info, class 1, size 48}, 0x0, ) == 0x0
 01370   860   NtClose  (116, ... ) == 0x0
 01371   860   NtMapViewOfSection  (120, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x77920000), 0x0, 995328, ) == 0x0
 01372   860   NtClose  (120, ... ) == 0x0
 01373   860   NtProtectVirtualMemory  (-1, (0x77921000), 1368, 4, ... (0x77921000), 4096, 32, ) == 0x0
 01374   860   NtProtectVirtualMemory  (-1, (0x77921000), 4096, 32, ... (0x77921000), 4096, 4, ) == 0x0
 01375   860   NtFlushInstructionCache  (-1, 2006061056, 1368, ... ) == 0x0
 01376   860   NtProtectVirtualMemory  (-1, (0x77921000), 1368, 4, ... (0x77921000), 4096, 32, ) == 0x0
 01377   860   NtProtectVirtualMemory  (-1, (0x77921000), 4096, 32, ... (0x77921000), 4096, 4, ) == 0x0
 01378   860   NtFlushInstructionCache  (-1, 2006061056, 1368, ... ) == 0x0
 01379   860   NtProtectVirtualMemory  (-1, (0x77921000), 1368, 4, ... (0x77921000), 4096, 32, ) == 0x0
 01380   860   NtProtectVirtualMemory  (-1, (0x77921000), 4096, 32, ... (0x77921000), 4096, 4, ) == 0x0
 01381   860   NtFlushInstructionCache  (-1, 2006061056, 1368, ... ) == 0x0
 01382   860   NtProtectVirtualMemory  (-1, (0x77921000), 1368, 4, ... (0x77921000), 4096, 32, ) == 0x0
 01383   860   NtProtectVirtualMemory  (-1, (0x77921000), 4096, 32, ... (0x77921000), 4096, 4, ) == 0x0
 01384   860   NtFlushInstructionCache  (-1, 2006061056, 1368, ... ) == 0x0
 01385   860   NtProtectVirtualMemory  (-1, (0x77921000), 1368, 4, ... (0x77921000), 4096, 32, ) == 0x0
 01386   860   NtProtectVirtualMemory  (-1, (0x77921000), 4096, 32, ... (0x77921000), 4096, 4, ) == 0x0
 01387   860   NtFlushInstructionCache  (-1, 2006061056, 1368, ... ) == 0x0
 01388   860   NtOpenSection  (0xe, {24, 8, 0x40, 0, 0,  (0xe, {24, 8, 0x40, 0, 0, "SHLWAPI.dll"}, ... 120, ) }, ... 120, ) == 0x0
 01389   860   NtMapViewOfSection  (120, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x77f60000), 0x0, 483328, ) == 0x0
 01390   860   NtClose  (120, ... ) == 0x0
 01391   860   NtProtectVirtualMemory  (-1, (0x77f61000), 2076, 4, ... (0x77f61000), 4096, 32, ) == 0x0
 01392   860   NtProtectVirtualMemory  (-1, (0x77f61000), 4096, 32, ... (0x77f61000), 4096, 4, ) == 0x0
 01393   860   NtFlushInstructionCache  (-1, 2012614656, 2076, ... ) == 0x0
 01394   860   NtProtectVirtualMemory  (-1, (0x77f61000), 2076, 4, ... (0x77f61000), 4096, 32, ) == 0x0
 01395   860   NtProtectVirtualMemory  (-1, (0x77f61000), 4096, 32, ... (0x77f61000), 4096, 4, ) == 0x0
 01396   860   NtFlushInstructionCache  (-1, 2012614656, 2076, ... ) == 0x0
 01397   860   NtProtectVirtualMemory  (-1, (0x77f61000), 2076, 4, ... (0x77f61000), 4096, 32, ) == 0x0
 01398   860   NtProtectVirtualMemory  (-1, (0x77f61000), 4096, 32, ... (0x77f61000), 4096, 4, ) == 0x0
 01399   860   NtFlushInstructionCache  (-1, 2012614656, 2076, ... ) == 0x0
 01400   860   NtProtectVirtualMemory  (-1, (0x77f61000), 2076, 4, ... (0x77f61000), 4096, 32, ) == 0x0
 01401   860   NtProtectVirtualMemory  (-1, (0x77f61000), 4096, 32, ... (0x77f61000), 4096, 4, ) == 0x0
 01402   860   NtFlushInstructionCache  (-1, 2012614656, 2076, ... ) == 0x0
 01403   860   NtProtectVirtualMemory  (-1, (0x77f61000), 2076, 4, ... (0x77f61000), 4096, 32, ) == 0x0
 01404   860   NtProtectVirtualMemory  (-1, (0x77f61000), 4096, 32, ... (0x77f61000), 4096, 4, ) == 0x0
 01405   860   NtFlushInstructionCache  (-1, 2012614656, 2076, ... ) == 0x0
 01406   860   NtProtectVirtualMemory  (-1, (0x69451000), 736, 4, ... (0x69451000), 4096, 32, ) == 0x0
 01407   860   NtProtectVirtualMemory  (-1, (0x69451000), 4096, 32, ... (0x69451000), 4096, 4, ) == 0x0
 01408   860   NtFlushInstructionCache  (-1, 1766133760, 736, ... ) == 0x0
 01409   860   NtProtectVirtualMemory  (-1, (0x69451000), 736, 4, ... (0x69451000), 4096, 32, ) == 0x0
 01410   860   NtProtectVirtualMemory  (-1, (0x69451000), 4096, 32, ... (0x69451000), 4096, 4, ) == 0x0
 01411   860   NtFlushInstructionCache  (-1, 1766133760, 736, ... ) == 0x0
 01412   860   NtProtectVirtualMemory  (-1, (0x69451000), 736, 4, ... (0x69451000), 4096, 32, ) == 0x0
 01413   860   NtProtectVirtualMemory  (-1, (0x69451000), 4096, 32, ... (0x69451000), 4096, 4, ) == 0x0
 01414   860   NtFlushInstructionCache  (-1, 1766133760, 736, ... ) == 0x0
 01415   860   NtOpenKey  (0x80000000, {24, 0, 0x40, 0, 0,  (0x80000000, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\USERENV.dll"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01416   860   NtOpenKey  (0x2000000, {24, 16, 0x40, 0, 0,  (0x2000000, {24, 16, 0x40, 0, 0, "Software\Microsoft\Windows NT\CurrentVersion\winlogon"}, ... 120, ) }, ... 120, ) == 0x0
 01417   860   NtQueryValueKey  (120,  (120, "UserEnvDebugLevel", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01418   860   NtClose  (120, ... ) == 0x0
 01419   860   NtOpenKey  (0x2000000, {24, 16, 0x40, 0, 0,  (0x2000000, {24, 16, 0x40, 0, 0, "Software\Microsoft\Windows NT\CurrentVersion\winlogon"}, ... 120, ) }, ... 120, ) == 0x0
 01420   860   NtQueryValueKey  (120,  (120, "ChkAccDebugLevel", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01421   860   NtClose  (120, ... ) == 0x0
 01422   860   NtOpenKey  (0x20019, {24, 16, 0x40, 0, 0,  (0x20019, {24, 16, 0x40, 0, 0, "System\CurrentControlSet\Control\ProductOptions"}, ... 120, ) }, ... 120, ) == 0x0
 01423   860   NtQueryValueKey  (120,  (120, "ProductType", Partial, 144, ... TitleIdx=0, Type=1, Data="W\0i\0n\0N\0T\0\0\0"}, 24, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (120, "ProductType", Partial, 144, ... TitleIdx=0, Type=1, Data="W\0i\0n\0N\0T\0\0\0"}, 24, ) }, 24, ) == 0x0
 01424   860   NtClose  (120, ... ) == 0x0
 01425   860   NtCreateEvent  (0x1f0003, {24, 48, 0x80, 1236964, 0,  (0x1f0003, {24, 48, 0x80, 1236964, 0, "Global\userenv:  User Profile setup event"}, 0, 1, ... 120, ) }, 0, 1, ... 120, ) == STATUS_OBJECT_NAME_EXISTS
 01426   860   NtQueryDefaultUILanguage  (2090319928, ...
 01427   860   NtOpenThreadTokenEx  (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN
 01428   860   NtOpenProcessTokenEx  (-1, 0x20008, 512, ... -2147482740, ) == 0x0
 01429   860   NtQueryInformationToken  (-2147482740, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0
 01430   860   NtClose  (-2147482740, ... ) == 0x0
 01431   860   NtOpenKey  (0x2000000, {24, 0, 0x640, 0, 0,  (0x2000000, {24, 0, 0x640, 0, 0, "\REGISTRY\USER\S-1-5-21-1292428093-1383384898-725345543-1003"}, ... -2147482740, ) }, ... -2147482740, ) == 0x0
 01432   860   NtOpenKey  (0x80000000, {24, -2147482740, 0x240, 0, 0,  (0x80000000, {24, -2147482740, 0x240, 0, 0, "Software\Policies\Microsoft\Control Panel\Desktop"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01433   860   NtOpenKey  (0x80000000, {24, -2147482740, 0x640, 0, 0,  (0x80000000, {24, -2147482740, 0x640, 0, 0, "Control Panel\Desktop"}, ... -2147481328, ) }, ... -2147481328, ) == 0x0
 01434   860   NtQueryValueKey  (-2147481328,  (-2147481328, "MultiUILanguageId", Partial, 256, ... ) , Partial, 256, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01435   860   NtClose  (-2147481328, ... ) == 0x0
 01436   860   NtClose  (-2147482740, ... ) == 0x0
 01426   860   NtQueryDefaultUILanguage  ... ) == 0x0
 01437   860   NtQueryInstallUILanguage  (2090319930, ... ) == 0x0
 01438   860   NtQueryDefaultLocale  (1, 1236716, ... ) == 0x0
 01439   860   NtQueryDefaultLocale  (1, 1236716, ... ) == 0x0
 01440   860   NtQueryDefaultLocale  (1, 1236716, ... ) == 0x0
 01441   860   NtQueryDefaultLocale  (1, 1236716, ... ) == 0x0
 01442   860   NtQueryDefaultLocale  (1, 1236716, ... ) == 0x0
 01443   860   NtQueryDefaultLocale  (1, 1236716, ... ) == 0x0
 01444   860   NtQueryDefaultLocale  (1, 1236716, ... ) == 0x0
 01445   860   NtQueryDefaultLocale  (1, 1236716, ... ) == 0x0
 01446   860   NtQueryDefaultLocale  (1, 1236716, ... ) == 0x0
 01447   860   NtQueryDefaultLocale  (1, 1236716, ... ) == 0x0
 01448   860   NtQueryDefaultLocale  (1, 1236716, ... ) == 0x0
 01449   860   NtQueryDefaultLocale  (1, 1236716, ... ) == 0x0
 01450   860   NtQueryDefaultLocale  (1, 1236716, ... ) == 0x0
 01451   860   NtQueryDefaultLocale  (1, 1236716, ... ) == 0x0
 01452   860   NtQueryDefaultLocale  (1, 1236716, ... ) == 0x0
 01453   860   NtQueryDefaultLocale  (1, 1236716, ... ) == 0x0
 01454   860   NtQueryDefaultLocale  (1, 1236716, ... ) == 0x0
 01455   860   NtQueryDefaultLocale  (1, 1236716, ... ) == 0x0
 01456   860   NtQueryDefaultLocale  (1, 1236716, ... ) == 0x0
 01457   860   NtQueryDefaultLocale  (1, 1236716, ... ) == 0x0
 01458   860   NtQueryDefaultLocale  (1, 1236716, ... ) == 0x0
 01459   860   NtQueryDefaultLocale  (1, 1236716, ... ) == 0x0
 01460   860   NtQueryDefaultLocale  (1, 1236716, ... ) == 0x0
 01461   860   NtQueryDefaultLocale  (1, 1236716, ... ) == 0x0
 01462   860   NtQueryDefaultLocale  (1, 1236716, ... ) == 0x0
 01463   860   NtQueryDefaultLocale  (1, 1236716, ... ) == 0x0
 01464   860   NtOpenThreadTokenEx  (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN
 01465   860   NtOpenProcessTokenEx  (-1, 0x20008, 512, ... 116, ) == 0x0
 01466   860   NtQueryInformationToken  (116, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0
 01467   860   NtClose  (116, ... ) == 0x0
 01468   860   NtOpenKey  (0x20019, {24, 0, 0x640, 0, 0,  (0x20019, {24, 0, 0x640, 0, 0, "\REGISTRY\USER\S-1-5-21-1292428093-1383384898-725345543-1003"}, ... 116, ) }, ... 116, ) == 0x0
 01469   860   NtOpenKey  (0x20019, {24, 116, 0x40, 0, 0,  (0x20019, {24, 116, 0x40, 0, 0, "Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders"}, ... 108, ) }, ... 108, ) == 0x0
 01470   860   NtQueryValueKey  (108,  (108, "Personal", Partial, 144, ... TitleIdx=0, Type=2, Data="%\0U\0S\0E\0R\0P\0R\0O\0F\0I\0L\0E\0%\0\\0M\0y\0 \0D\0o\0c\0u\0m\0e\0n\0t\0s\0\0\0"}, 66, ) , Partial, 144, ... TitleIdx=0, Type=2, Data= (108, "Personal", Partial, 144, ... TitleIdx=0, Type=2, Data="%\0U\0S\0E\0R\0P\0R\0O\0F\0I\0L\0E\0%\0\\0M\0y\0 \0D\0o\0c\0u\0m\0e\0n\0t\0s\0\0\0"}, 66, ) }, 66, ) == 0x0
 01471   860   NtQueryDefaultLocale  (1, 1236716, ... ) == 0x0
 01472   860   NtQueryValueKey  (108,  (108, "Local Settings", Partial, 144, ... TitleIdx=0, Type=2, Data="%\0U\0S\0E\0R\0P\0R\0O\0F\0I\0L\0E\0%\0\\0L\0o\0c\0a\0l\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\0\0"}, 70, ) , Partial, 144, ... TitleIdx=0, Type=2, Data= (108, "Local Settings", Partial, 144, ... TitleIdx=0, Type=2, Data="%\0U\0S\0E\0R\0P\0R\0O\0F\0I\0L\0E\0%\0\\0L\0o\0c\0a\0l\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\0\0"}, 70, ) }, 70, ) == 0x0
 01473   860   NtQueryDefaultLocale  (1, 1236716, ... ) == 0x0
 01474   860   NtQueryDefaultLocale  (1, 1236716, ... ) == 0x0
 01475   860   NtQueryDefaultLocale  (1, 1236716, ... ) == 0x0
 01476   860   NtQueryDefaultLocale  (1, 1236716, ... ) == 0x0
 01477   860   NtClose  (108, ... ) == 0x0
 01478   860   NtClose  (116, ... ) == 0x0
 01479   860   NtOpenKey  (0x2000000, {24, 16, 0x40, 0, 0,  (0x2000000, {24, 16, 0x40, 0, 0, "Software\Microsoft\Windows NT\CurrentVersion\winlogon"}, ... 116, ) }, ... 116, ) == 0x0
 01480   860   NtQueryValueKey  (116,  (116, "RsopDebugLevel", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01481   860   NtClose  (116, ... ) == 0x0
 01482   860   NtOpenKey  (0x2000000, {24, 16, 0x40, 0, 0,  (0x2000000, {24, 16, 0x40, 0, 0, "Software\Microsoft\Windows NT\CurrentVersion\winlogon"}, ... 116, ) }, ... 116, ) == 0x0
 01483   860   NtQueryValueKey  (116,  (116, "UserEnvDebugLevel", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01484   860   NtQueryValueKey  (116,  (116, "RsopLogging", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01485   860   NtClose  (116, ... ) == 0x0
 01486   860   NtOpenKey  (0x2000000, {24, 16, 0x40, 0, 0,  (0x2000000, {24, 16, 0x40, 0, 0, "Software\Policies\Microsoft\Windows\System"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01487   860   NtOpenKey  (0x2000000, {24, 16, 0x40, 0, 0,  (0x2000000, {24, 16, 0x40, 0, 0, "Software\Microsoft\Windows NT\CurrentVersion\winlogon"}, ... 116, ) }, ... 116, ) == 0x0
 01488   860   NtQueryValueKey  (116,  (116, "UserEnvDebugLevel", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01489   860   NtClose  (116, ... ) == 0x0
 01490   860   NtOpenKey  (0x2000000, {24, 16, 0x40, 0, 0,  (0x2000000, {24, 16, 0x40, 0, 0, "Software\Policies\Microsoft\Windows\System"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01491   860   NtOpenKey  (0x80000000, {24, 0, 0x40, 0, 0,  (0x80000000, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\NETAPI32.dll"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01492   860   NtOpenKey  (0x80000000, {24, 0, 0x40, 0, 0,  (0x80000000, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\WINSTA.dll"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01493   860   NtOpenKey  (0x80000000, {24, 0, 0x40, 0, 0,  (0x80000000, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\WTSAPI32.dll"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01494   860   NtQueryPerformanceCounter  (... {925961817, 10}, {3579545, 0}, ) == 0x0
 01495   860   NtOpenKey  (0x80000000, {24, 0, 0x40, 0, 0,  (0x80000000, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SETUPAPI.dll"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01496   860   NtQueryDefaultLocale  (1, 1239092, ... ) == 0x0
 01497   860   NtQueryInformationProcess  (-1, Wow64, 4, ... {process info, class 26, size 4}, 0x0, ) == 0x0
 01498   860   NtOpenKey  (0x20019, {24, 16, 0x40, 0, 0,  (0x20019, {24, 16, 0x40, 0, 0, "System\Setup"}, ... 116, ) }, ... 116, ) == 0x0
 01499   860   NtQueryValueKey  (116,  (116, "SystemSetupInProgress", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (116, "SystemSetupInProgress", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) }, 16, ) == 0x0
 01500   860   NtClose  (116, ... ) == 0x0
 01501   860   NtUserGetProcessWindowStation  (... ) == 0x1c
 01502   860   NtUserGetObjectInformation  (28, 1, 1238688, 12, 1238700, ... ) == 0x1
 01503   860   NtOpenKey  (0xf003f, {24, 16, 0x40, 0, 0,  (0xf003f, {24, 16, 0x40, 0, 0, "SYSTEM\CurrentControlSet\Control\MiniNT"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01504   860   NtOpenKey  (0x20019, {24, 16, 0x40, 0, 0,  (0x20019, {24, 16, 0x40, 0, 0, "System\WPA\PnP"}, ... 116, ) }, ... 116, ) == 0x0
 01505   860   NtQueryValueKey  (116,  (116, "seed", Partial, 144, ... TitleIdx=0, Type=4, Data="\240d\351\211"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (116, "seed", Partial, 144, ... TitleIdx=0, Type=4, Data="\240d\351\211"}, 16, ) }, 16, ) == 0x0
 01506   860   NtClose  (116, ... ) == 0x0
 01507   860   NtOpenKey  (0x20019, {24, 16, 0x40, 0, 0,  (0x20019, {24, 16, 0x40, 0, 0, "SYSTEM\Setup"}, ... 116, ) }, ... 116, ) == 0x0
 01508   860   NtQueryValueKey  (116,  (116, "OsLoaderPath", Partial, 144, ... TitleIdx=0, Type=1, Data="\\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (116, "OsLoaderPath", Partial, 144, ... TitleIdx=0, Type=1, Data="\\0\0\0"}, 16, ) }, 16, ) == 0x0
 01509   860   NtQueryValueKey  (116,  (116, "OsLoaderPath", Partial, 144, ... TitleIdx=0, Type=1, Data="\\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (116, "OsLoaderPath", Partial, 144, ... TitleIdx=0, Type=1, Data="\\0\0\0"}, 16, ) }, 16, ) == 0x0
 01510   860   NtClose  (116, ... ) == 0x0
 01511   860   NtOpenKey  (0x20019, {24, 16, 0x40, 0, 0,  (0x20019, {24, 16, 0x40, 0, 0, "SYSTEM\Setup"}, ... 116, ) }, ... 116, ) == 0x0
 01512   860   NtQueryValueKey  (116,  (116, "SystemPartition", Partial, 144, ... TitleIdx=0, Type=1, Data="\\0D\0e\0v\0i\0c\0e\0\\0H\0a\0r\0d\0d\0i\0s\0k\0V\0o\0l\0u\0m\0e\01\0\0\0"}, 60, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (116, "SystemPartition", Partial, 144, ... TitleIdx=0, Type=1, Data="\\0D\0e\0v\0i\0c\0e\0\\0H\0a\0r\0d\0d\0i\0s\0k\0V\0o\0l\0u\0m\0e\01\0\0\0"}, 60, ) }, 60, ) == 0x0
 01513   860   NtQueryValueKey  (116,  (116, "SystemPartition", Partial, 144, ... TitleIdx=0, Type=1, Data="\\0D\0e\0v\0i\0c\0e\0\\0H\0a\0r\0d\0d\0i\0s\0k\0V\0o\0l\0u\0m\0e\01\0\0\0"}, 60, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (116, "SystemPartition", Partial, 144, ... TitleIdx=0, Type=1, Data="\\0D\0e\0v\0i\0c\0e\0\\0H\0a\0r\0d\0d\0i\0s\0k\0V\0o\0l\0u\0m\0e\01\0\0\0"}, 60, ) }, 60, ) == 0x0
 01514   860   NtClose  (116, ... ) == 0x0
 01515   860   NtOpenKey  (0x20019, {24, 16, 0x40, 0, 0,  (0x20019, {24, 16, 0x40, 0, 0, "Software\Microsoft\Windows\CurrentVersion\Setup"}, ... 116, ) }, ... 116, ) == 0x0
 01516   860   NtQueryValueKey  (116,  (116, "SourcePath", Partial, 144, ... TitleIdx=0, Type=1, Data="D\0:\0\\0\0\0"}, 20, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (116, "SourcePath", Partial, 144, ... TitleIdx=0, Type=1, Data="D\0:\0\\0\0\0"}, 20, ) }, 20, ) == 0x0
 01517   860   NtQueryValueKey  (116,  (116, "SourcePath", Partial, 144, ... TitleIdx=0, Type=1, Data="D\0:\0\\0\0\0"}, 20, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (116, "SourcePath", Partial, 144, ... TitleIdx=0, Type=1, Data="D\0:\0\\0\0\0"}, 20, ) }, 20, ) == 0x0
 01518   860   NtClose  (116, ... ) == 0x0
 01519   860   NtOpenKey  (0x20019, {24, 16, 0x40, 0, 0,  (0x20019, {24, 16, 0x40, 0, 0, "Software\Microsoft\Windows\CurrentVersion\Setup"}, ... 116, ) }, ... 116, ) == 0x0
 01520   860   NtQueryValueKey  (116,  (116, "ServicePackSourcePath", Partial, 144, ... TitleIdx=0, Type=1, Data="D\0:\0\\0\0\0"}, 20, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (116, "ServicePackSourcePath", Partial, 144, ... TitleIdx=0, Type=1, Data="D\0:\0\\0\0\0"}, 20, ) }, 20, ) == 0x0
 01521   860   NtQueryValueKey  (116,  (116, "ServicePackSourcePath", Partial, 144, ... TitleIdx=0, Type=1, Data="D\0:\0\\0\0\0"}, 20, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (116, "ServicePackSourcePath", Partial, 144, ... TitleIdx=0, Type=1, Data="D\0:\0\\0\0\0"}, 20, ) }, 20, ) == 0x0
 01522   860   NtClose  (116, ... ) == 0x0
 01523   860   NtOpenKey  (0x20019, {24, 16, 0x40, 0, 0,  (0x20019, {24, 16, 0x40, 0, 0, "Software\Microsoft\Windows\CurrentVersion\Setup"}, ... 116, ) }, ... 116, ) == 0x0
 01524   860   NtQueryValueKey  (116,  (116, "ServicePackCachePath", Partial, 144, ... TitleIdx=0, Type=1, Data="c\0:\0\\0w\0i\0n\0d\0o\0w\0s\0\\0S\0e\0r\0v\0i\0c\0e\0P\0a\0c\0k\0F\0i\0l\0e\0s\0\\0S\0e\0r\0v\0i\0c\0e\0P\0a\0c\0k\0C\0a\0c\0h\0e\0\0\0"}, 102, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (116, "ServicePackCachePath", Partial, 144, ... TitleIdx=0, Type=1, Data="c\0:\0\\0w\0i\0n\0d\0o\0w\0s\0\\0S\0e\0r\0v\0i\0c\0e\0P\0a\0c\0k\0F\0i\0l\0e\0s\0\\0S\0e\0r\0v\0i\0c\0e\0P\0a\0c\0k\0C\0a\0c\0h\0e\0\0\0"}, 102, ) }, 102, ) == 0x0
 01525   860   NtQueryValueKey  (116,  (116, "ServicePackCachePath", Partial, 144, ... TitleIdx=0, Type=1, Data="c\0:\0\\0w\0i\0n\0d\0o\0w\0s\0\\0S\0e\0r\0v\0i\0c\0e\0P\0a\0c\0k\0F\0i\0l\0e\0s\0\\0S\0e\0r\0v\0i\0c\0e\0P\0a\0c\0k\0C\0a\0c\0h\0e\0\0\0"}, 102, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (116, "ServicePackCachePath", Partial, 144, ... TitleIdx=0, Type=1, Data="c\0:\0\\0w\0i\0n\0d\0o\0w\0s\0\\0S\0e\0r\0v\0i\0c\0e\0P\0a\0c\0k\0F\0i\0l\0e\0s\0\\0S\0e\0r\0v\0i\0c\0e\0P\0a\0c\0k\0C\0a\0c\0h\0e\0\0\0"}, 102, ) }, 102, ) == 0x0
 01526   860   NtClose  (116, ... ) == 0x0
 01527   860   NtOpenKey  (0x20019, {24, 16, 0x40, 0, 0,  (0x20019, {24, 16, 0x40, 0, 0, "Software\Microsoft\Windows\CurrentVersion\Setup"}, ... 116, ) }, ... 116, ) == 0x0
 01528   860   NtQueryValueKey  (116,  (116, "DriverCachePath", Partial, 144, ... TitleIdx=0, Type=2, Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0D\0r\0i\0v\0e\0r\0 \0C\0a\0c\0h\0e\0\0\0"}, 64, ) , Partial, 144, ... TitleIdx=0, Type=2, Data= (116, "DriverCachePath", Partial, 144, ... TitleIdx=0, Type=2, Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0D\0r\0i\0v\0e\0r\0 \0C\0a\0c\0h\0e\0\0\0"}, 64, ) }, 64, ) == 0x0
 01529   860   NtQueryValueKey  (116,  (116, "DriverCachePath", Partial, 144, ... TitleIdx=0, Type=2, Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0D\0r\0i\0v\0e\0r\0 \0C\0a\0c\0h\0e\0\0\0"}, 64, ) , Partial, 144, ... TitleIdx=0, Type=2, Data= (116, "DriverCachePath", Partial, 144, ... TitleIdx=0, Type=2, Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0D\0r\0i\0v\0e\0r\0 \0C\0a\0c\0h\0e\0\0\0"}, 64, ) }, 64, ) == 0x0
 01530   860   NtClose  (116, ... ) == 0x0
 01531   860   NtOpenKey  (0x20019, {24, 16, 0x40, 0, 0,  (0x20019, {24, 16, 0x40, 0, 0, "Software\Microsoft\Windows\CurrentVersion"}, ... 116, ) }, ... 116, ) == 0x0
 01532   860   NtQueryValueKey  (116,  (116, "DevicePath", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 01533   860   NtQueryValueKey  (116,  (116, "DevicePath", Partial, 346, ... TitleIdx=0, Type=2, Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0i\0n\0f\0;\0%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0d\0e\0l\0l\0\\0a\0a\0c\0;\0%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0d\0e\0l\0l\0\\0a\0a\0r\0i\0c\0h\0;\0%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0d\0e\0l\0l\0\\0c\0e\0r\0c\0s\0r\06\0;\0%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0d\0e\0l\0l\0\\0a\03\02\00\0r\0a\0i\0d\0;\0%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0d\0e\0l\0l\0\\0i\0a\0s\0t\0o\0r\0;\0%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0d\0e\0l\0l\0\\0n\0v\0r\0a\0i\0d\0\0\0"}, 346, ) , Partial, 346, ... TitleIdx=0, Type=2, Data= (116, "DevicePath", Partial, 346, ... TitleIdx=0, Type=2, Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0i\0n\0f\0;\0%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0d\0e\0l\0l\0\\0a\0a\0c\0;\0%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0d\0e\0l\0l\0\\0a\0a\0r\0i\0c\0h\0;\0%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0d\0e\0l\0l\0\\0c\0e\0r\0c\0s\0r\06\0;\0%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0d\0e\0l\0l\0\\0a\03\02\00\0r\0a\0i\0d\0;\0%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0d\0e\0l\0l\0\\0i\0a\0s\0t\0o\0r\0;\0%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0d\0e\0l\0l\0\\0n\0v\0r\0a\0i\0d\0\0\0"}, 346, ) }, 346, ) == 0x0
 01534   860   NtClose  (116, ... ) == 0x0
 01535   860   NtCreateEvent  (0x1f0003, 0x0, 0, 0, ... 116, ) == 0x0
 01536   860   NtCreateMutant  (0x1f0001, 0x0, 0, ... 108, ) == 0x0
 01537   860   NtCreateEvent  (0x1f0003, 0x0, 0, 0, ... 112, ) == 0x0
 01538   860   NtCreateMutant  (0x1f0001, 0x0, 0, ... 124, ) == 0x0
 01539   860   NtCreateEvent  (0x1f0003, 0x0, 0, 0, ... 128, ) == 0x0
 01540   860   NtCreateMutant  (0x1f0001, 0x0, 0, ... 132, ) == 0x0
 01541   860   NtOpenKey  (0x1, {24, 16, 0x40, 0, 0,  (0x1, {24, 16, 0x40, 0, 0, "Software\Microsoft\Windows\CurrentVersion\Setup"}, ... 136, ) }, ... 136, ) == 0x0
 01542   860   NtQueryValueKey  (136,  (136, "LogLevel", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (136, "LogLevel", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) }, 16, ) == 0x0
 01543   860   NtQueryValueKey  (136,  (136, "LogLevel", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (136, "LogLevel", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) }, 16, ) == 0x0
 01544   860   NtQueryValueKey  (136,  (136, "LogPath", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01545   860   NtOpenKey  (0x1, {24, 136, 0x40, 0, 0,  (0x1, {24, 136, 0x40, 0, 0, "AppLogLevels"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01546   860   NtClose  (136, ... ) == 0x0
 01547   860   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\"}, 1238604, ... ) }, 1238604, ... ) == 0x0
 01548   860   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\System\CurrentControlSet\Control\ComputerName\ActiveComputerName"}, ... 136, ) }, ... 136, ) == 0x0
 01549   860   NtQueryValueKey  (136,  (136, "ComputerName", Full, 128, ... TitleIdx=0, Type=1, Name="ComputerName", Data="V\0I\0R\0T\0U\0A\0L\0\0\0"}, 60, ) , Full, 128, ... TitleIdx=0, Type=1, Name= (136, "ComputerName", Full, 128, ... TitleIdx=0, Type=1, Name="ComputerName", Data="V\0I\0R\0T\0U\0A\0L\0\0\0"}, 60, ) , Data= (136, "ComputerName", Full, 128, ... TitleIdx=0, Type=1, Name="ComputerName", Data="V\0I\0R\0T\0U\0A\0L\0\0\0"}, 60, ) }, 60, ) == 0x0
 01550   860   NtClose  (136, ... ) == 0x0
 01551   860   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\System\CurrentControlSet\Services\Tcpip\Parameters"}, ... 136, ) }, ... 136, ) == 0x0
 01552   860   NtQueryValueKey  (136,  (136, "Hostname", Full, 128, ... TitleIdx=0, Type=1, Name="Hostname", Data="v\0i\0r\0t\0u\0a\0l\0\0\0"}, 52, ) , Full, 128, ... TitleIdx=0, Type=1, Name= (136, "Hostname", Full, 128, ... TitleIdx=0, Type=1, Name="Hostname", Data="v\0i\0r\0t\0u\0a\0l\0\0\0"}, 52, ) , Data= (136, "Hostname", Full, 128, ... TitleIdx=0, Type=1, Name="Hostname", Data="v\0i\0r\0t\0u\0a\0l\0\0\0"}, 52, ) }, 52, ) == 0x0
 01553   860   NtClose  (136, ... ) == 0x0
 01554   860   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Policies\Microsoft\System\DNSclient"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01555   860   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\System\CurrentControlSet\Services\Tcpip\Parameters"}, ... 136, ) }, ... 136, ) == 0x0
 01556   860   NtQueryValueKey  (136,  (136, "Domain", Full, 128, ... TitleIdx=0, Type=1, Name="Domain", Data="\0\0"}, 34, ) , Full, 128, ... TitleIdx=0, Type=1, Name= (136, "Domain", Full, 128, ... TitleIdx=0, Type=1, Name="Domain", Data="\0\0"}, 34, ) , Data= (136, "Domain", Full, 128, ... TitleIdx=0, Type=1, Name="Domain", Data="\0\0"}, 34, ) }, 34, ) == 0x0
 01557   860   NtClose  (136, ... ) == 0x0
 01558   860   NtOpenKey  (0x80000000, {24, 0, 0x40, 0, 0,  (0x80000000, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SHLWAPI.dll"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01559   860   NtOpenKey  (0x2000000, {24, 16, 0x40, 0, 0,  (0x2000000, {24, 16, 0x40, 0, 0, "Software\Microsoft\Windows\CurrentVersion\Explorer\Performance"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01560   860   NtCreateSemaphore  (0x1f0003, {24, 48, 0x80, 1375096, 0,  (0x1f0003, {24, 48, 0x80, 1375096, 0, "shell.{A48F1A32-A340-11D1-BC6B-00A0C90312E1}"}, 0, 2147483647, ... 136, ) }, 0, 2147483647, ... 136, ) == STATUS_OBJECT_NAME_EXISTS
 01561   860   NtOpenKey  (0x80000000, {24, 0, 0x40, 0, 0,  (0x80000000, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\faultrep.dll"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01562   860   NtOpenKey  (0x20119, {24, 16, 0x40, 0, 0,  (0x20119, {24, 16, 0x40, 0, 0, "Software\Policies\Microsoft\PCHealth\ErrorReporting"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01563   860   NtCreateKey  (0x20119, {24, 16, 0x40, 0, 0,  (0x20119, {24, 16, 0x40, 0, 0, "Software\Microsoft\PCHealth\ErrorReporting"}, 0, 0x0, 0, ... 140, 2, ) }, 0, 0x0, 0, ... 140, 2, ) == 0x0
 01564   860   NtOpenKey  (0x10000, {24, 140, 0x40, 0, 0,  (0x10000, {24, 140, 0x40, 0, 0, "DW"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01565   860   NtQueryValueKey  (140,  (140, "DoReport", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (140, "DoReport", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) }, 16, ) == 0x0
 01566   860   NtQueryValueKey  (140,  (140, "ShowUI", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (140, "ShowUI", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) }, 16, ) == 0x0
 01567   860   NtQueryValueKey  (140,  (140, "AllOrNone", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (140, "AllOrNone", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) }, 16, ) == 0x0
 01568   860   NtQueryValueKey  (140,  (140, "IncludeMicrosoftApps", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (140, "IncludeMicrosoftApps", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) }, 16, ) == 0x0
 01569   860   NtQueryValueKey  (140,  (140, "IncludeWindowsApps", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (140, "IncludeWindowsApps", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) }, 16, ) == 0x0
 01570   860   NtQueryValueKey  (140,  (140, "DoTextLog", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01571   860   NtQueryValueKey  (140,  (140, "IncludeKernelFaults", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (140, "IncludeKernelFaults", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) }, 16, ) == 0x0
 01572   860   NtQueryValueKey  (140,  (140, "IncludeShutdownErrs", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01573   860   NtQueryValueKey  (140,  (140, "NumberOfFaultPipes", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01574   860   NtQueryValueKey  (140,  (140, "NumberOfHangPipes", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01575   860   NtQueryValueKey  (140,  (140, "MaxUserQueueSize", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01576   860   NtQueryValueKey  (140,  (140, "ForceQueueMode", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01577   860   NtCreateKey  (0x20119, {24, 140, 0x40, 0, 0,  (0x20119, {24, 140, 0x40, 0, 0, "ExclusionList"}, 0, 0x0, 0, ... 144, 2, ) }, 0, 0x0, 0, ... 144, 2, ) == 0x0
 01578   860   NtCreateKey  (0x20119, {24, 140, 0x40, 0, 0,  (0x20119, {24, 140, 0x40, 0, 0, "InclusionList"}, 0, 0x0, 0, ... 148, 2, ) }, 0, 0x0, 0, ... 148, 2, ) == 0x0
 01579   860   NtClose  (140, ... ) == 0x0
 01580   860   NtOpenKey  (0x20019, {24, 16, 0x40, 0, 0,  (0x20019, {24, 16, 0x40, 0, 0, "System\Setup"}, ... 140, ) }, ... 140, ) == 0x0
 01581   860   NtQueryValueKey  (140,  (140, "SystemSetupInProgress", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (140, "SystemSetupInProgress", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) }, 16, ) == 0x0
 01582   860   NtClose  (140, ... ) == 0x0
 01583   860   NtQueryInformationProcess  (-1, DefaultHardErrorMode, 4, ... {process info, class 12, size 4}, 0x0, ) == 0x0
 01584   860   NtSetInformationProcess  (-1, DefaultHardErrorMode, {process info, class 12, size 4}, 4, ... ) == 0x0
 01585   860   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\u:\work\packed.exe"}, 1236132, ... ) }, 1236132, ... ) == 0x0
 01586   860   NtOpenFile  (0x100001, {24, 0, 0x40, 0, 0,  (0x100001, {24, 0, 0x40, 0, 0, "\??\u:\"}, 3, 16417, ... 140, {status=0x0, info=1}, ) }, 3, 16417, ... 140, {status=0x0, info=1}, ) == 0x0
 01587   860   NtQueryDirectoryFile  (140, 0, 0, 0, 1235560, 616, BothDirectory, 1,  (140, 0, 0, 0, 1235560, 616, BothDirectory, 1, "work", 0, ... {status=0x0, info=104}, ) , 0, ... {status=0x0, info=104}, ) == 0x0
 01588   860   NtClose  (140, ... ) == 0x0
 01589   860   NtOpenFile  (0x100001, {24, 0, 0x40, 0, 0,  (0x100001, {24, 0, 0x40, 0, 0, "\??\u:\work\"}, 3, 16417, ... 140, {status=0x0, info=1}, ) }, 3, 16417, ... 140, {status=0x0, info=1}, ) == 0x0
 01590   860   NtQueryDirectoryFile  (140, 0, 0, 0, 1235560, 616, BothDirectory, 1,  (140, 0, 0, 0, 1235560, 616, BothDirectory, 1, "packed.exe", 0, ... {status=0x0, info=120}, ) , 0, ... {status=0x0, info=120}, ) == 0x0
 01591   860   NtClose  (140, ... ) == 0x0
 01592   860   NtQueryInformationProcess  (-1, DefaultHardErrorMode, 4, ... {process info, class 12, size 4}, 0x0, ) == 0x0
 01593   860   NtSetInformationProcess  (-1, DefaultHardErrorMode, {process info, class 12, size 4}, 4, ... ) == 0x0
 01594   860   NtQueryInformationProcess  (-1, DefaultHardErrorMode, 4, ... {process info, class 12, size 4}, 0x0, ) == 0x0
 01595   860   NtSetInformationProcess  (-1, DefaultHardErrorMode, {process info, class 12, size 4}, 4, ... ) == 0x0
 01596   860   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\u:\work\packed.exe"}, 1234780, ... ) }, 1234780, ... ) == 0x0
 01597   860   NtAllocateVirtualMemory  (-1, 1224704, 0, 4096, 4096, 260, ... 1224704, 4096, ) == 0x0
 01598   860   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\u:\work\packed.exe"}, 1233552, ... ) }, 1233552, ... ) == 0x0
 01599   860   NtQueryInformationProcess  (-1, DefaultHardErrorMode, 4, ... {process info, class 12, size 4}, 0x0, ) == 0x0
 01600   860   NtSetInformationProcess  (-1, DefaultHardErrorMode, {process info, class 12, size 4}, 4, ... ) == 0x0
 01601   860   NtQueryValueKey  (144,  (144, "packed.exe", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01602   860   NtOpenThreadToken  (-2, 0x2000c, 1, ... ) == STATUS_NO_TOKEN
 01603   860   NtSetInformationThread  (-2, ImpersonationToken, {ImpToken=0,}, 4, ... ) == 0x0
 01604   860   NtDeviceIoControlFile  (44, 0, 0x0, 0x0, 0x390008,  (44, 0, 0x0, 0x0, 0x390008, "\324d\365\27\7%k\32h=\335\351\367\345\373\323\363\26Zl\272\210s\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0", 256, 256, ... , 256, 256, ...
 01605   860   NtQuerySystemInformation  (TimeOfDay, 48, ... {system info, class 3, size 48}, 48, ) == 0x0
 01606   860   NtQuerySystemInformation  (ProcessorTimes, 48, ... {system info, class 8, size 48}, 48, ) == 0x0
 01607   860   NtQuerySystemInformation  (Performance, 312, ... {system info, class 2, size 312}, 312, ) == 0x0
 01608   860   NtQuerySystemInformation  (Exception, 16, ... {system info, class 33, size 16}, 16, ) == 0x0
 01609   860   NtQuerySystemInformation  (Lookaside, 32, ... {system info, class 45, size 32}, 32, ) == 0x0
 01610   860   NtQuerySystemInformation  (ProcessorStatistics, 3016, ... {system info, class 23, size 0}, 0, ) == 0x0
 01611   860   NtQuerySystemInformation  (ProcessesAndThreads, 3008, ... ) == STATUS_INFO_LENGTH_MISMATCH
 01612   860   NtCreateKey  (0x2, {24, 0, 0x240, 0, 0,  (0x2, {24, 0, 0x240, 0, 0, "\Registry\Machine\SOFTWARE\Microsoft\Cryptography\RNG"}, 0, 0x0, 0, ... -2147482740, 2, ) }, 0, 0x0, 0, ... -2147482740, 2, ) == 0x0
 01613   860   NtSetValueKey  (-2147482740,  (-2147482740, "Seed", 0, 3, "\333\227\270zm\16\326F\6E\202~/5)#\262+v\14\15\21o\334/\352(\210\323\325\271\27\276\342\332-5~\3632Z\232sp\224O\\361\237\201\32*\241[\365\273\333\341)y}\225(N>\210\361y\247\317\37\220I\334B\335\206\351`G", 80, ... ) , 0, 3,  (-2147482740, "Seed", 0, 3, "\333\227\270zm\16\326F\6E\202~/5)#\262+v\14\15\21o\334/\352(\210\323\325\271\27\276\342\332-5~\3632Z\232sp\224O\\361\237\201\32*\241[\365\273\333\341)y}\225(N>\210\361y\247\317\37\220I\334B\335\206\351`G", 80, ... ) , 80, ... ) == 0x0
 01614   860   NtClose  (-2147482740, ... ) == 0x0
 01604   860   NtDeviceIoControlFile  ... {status=0x0, info=256},  ... {status=0x0, info=256}, "\207'n\327%\272\376\351{2\236\20\2046\227\304\272\307\337I\342\266b\326\240\27021\326, ) , ) == 0x0
 01615   860   NtDeviceIoControlFile  (44, 0, 0x0, 0x0, 0x390008,  (44, 0, 0x0, 0x0, 0x390008, "\324d\365\27\7%k\32h=\335\351\367\345C\375 \327\352GR\34\304\363\26Zl\272\210s\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0", 256, 256, ... , 256, 256, ...
 01616   860   NtQuerySystemInformation  (TimeOfDay, 48, ... {system info, class 3, size 48}, 48, ) == 0x0
 01617   860   NtQuerySystemInformation  (ProcessorTimes, 48, ... {system info, class 8, size 48}, 48, ) == 0x0
 01618   860   NtQuerySystemInformation  (Performance, 312, ... {system info, class 2, size 312}, 312, ) == 0x0
 01619   860   NtQuerySystemInformation  (Exception, 16, ... {system info, class 33, size 16}, 16, ) == 0x0
 01620   860   NtQuerySystemInformation  (Lookaside, 32, ... {system info, class 45, size 32}, 32, ) == 0x0
 01621   860   NtQuerySystemInformation  (ProcessorStatistics, 3016, ... {system info, class 23, size 0}, 0, ) == 0x0
 01622   860   NtQuerySystemInformation  (ProcessesAndThreads, 3008, ... ) == STATUS_INFO_LENGTH_MISMATCH
 01623   860   NtCreateKey  (0x2, {24, 0, 0x240, 0, 0,  (0x2, {24, 0, 0x240, 0, 0, "\Registry\Machine\SOFTWARE\Microsoft\Cryptography\RNG"}, 0, 0x0, 0, ... -2147482740, 2, ) }, 0, 0x0, 0, ... -2147482740, 2, ) == 0x0
 01624   860   NtSetValueKey  (-2147482740,  (-2147482740, "Seed", 0, 3, "\30H`Y^I\236\203D_\344\15\346e\342\254\5\277\225n\240\263\333\264m\325\11(\322\230\233\34V\6m3\345\26\274\21z\236\265\206\355\7\274w"~\7\373\31\375\205\251\365/F`\235\212\220\25\217.\214\301\30t*\23R\247\30\241F>\241 ", 80, ... ) , 0, 3,  (-2147482740, "Seed", 0, 3, "\30H`Y^I\236\203D_\344\15\346e\342\254\5\277\225n\240\263\333\264m\325\11(\322\230\233\34V\6m3\345\26\274\21z\236\265\206\355\7\274w"~\7\373\31\375\205\251\365/F`\235\212\220\25\217.\214\301\30t*\23R\247\30\241F>\241 ", 80, ... ) ~\7\373\31\375\205\251\365/F`\235\212\220\25\217.\214\301\30t*\23R\247\30\241F>\241 ", 80, ... ) == 0x0
 01625   860   NtClose  (-2147482740, ... ) == 0x0
 01615   860   NtDeviceIoControlFile  ... {status=0x0, info=256},  ... {status=0x0, info=256}, "\360\210.\200\343,\211\301\206\326\244,Z\324nv\377\235R\374e\367\211+\24\267\25\201\234\345\327\13x:\35\273@XI\17*\335\17\337\363\205\275\232y\210\354\222\331f\266w\202\325\260\342~\26\7\277\4\234\25Cd\32\364\204\225\333(T_\177\20T|\311\230\241~XB>\231G\335o3\250v\2632\224'\36\321."\205a`y \234\273\206\264P0:\255&\267m\205\206\34z\312w8\16*\33\\271\307\277\15,\237KLN}sms\237\202:\1v\242\14\336@\343\364K7\336\341\6\2051\357\277\2\0;E\276\224\35\372\321\256\263/\207\375\6\261\247\205\253\237\31\231r;\264\303\363\201\206\341\11\305\200\37y\264\312\345\206\266\306l\1\355\241=\370\314\244\2074\372c\266\272M\237\376\5u\364\255`\35\320V\340\246\26\\321l$C\345o\216\264\1\316\316H\241\327\252\220\13d\23\347\270", ) \205a`y \234\273\206\264P0:\255&\267m\205\206\34z\312w8\16*\33\\271\307\277\15,\237KLN}sms\237\202:\1v\242\14\336@\343\364K7\336\341\6\2051\357\277\2\0;E\276\224\35\372\321\256\263/\207\375\6\261\247\205\253\237\31\231r;\264\303\363\201\206\341\11\305\200\37y\264\312\345\206\266\306l\1\355\241=\370\314\244\2074\372c\266\272M\237\376\5u\364\255`\35\320V\340\246\26\\321l$C\345o\216\264\1\316\316H\241\327\252\220\13d\23\347\270", ) == 0x0
 01626   860   NtDeviceIoControlFile  (44, 0, 0x0, 0x0, 0x390008,  (44, 0, 0x0, 0x0, 0x390008, "\324d\365\27\7%k\32h=\335\351\367\345C\375 \327\352GR\244\352 \327\352GR\34\304\363\26Zl\272\210s\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0", 256, 256, ... , 256, 256, ...
 01627   860   NtQuerySystemInformation  (TimeOfDay, 48, ... {system info, class 3, size 48}, 48, ) == 0x0
 01628   860   NtQuerySystemInformation  (ProcessorTimes, 48, ... {system info, class 8, size 48}, 48, ) == 0x0
 01629   860   NtQuerySystemInformation  (Performance, 312, ... {system info, class 2, size 312}, 312, ) == 0x0
 01630   860   NtQuerySystemInformation  (Exception, 16, ... {system info, class 33, size 16}, 16, ) == 0x0
 01631   860   NtQuerySystemInformation  (Lookaside, 32, ... {system info, class 45, size 32}, 32, ) == 0x0
 01632   860   NtQuerySystemInformation  (ProcessorStatistics, 3016, ... {system info, class 23, size 0}, 0, ) == 0x0
 01633   860   NtQuerySystemInformation  (ProcessesAndThreads, 3008, ... ) == STATUS_INFO_LENGTH_MISMATCH
 01634   860   NtCreateKey  (0x2, {24, 0, 0x240, 0, 0,  (0x2, {24, 0, 0x240, 0, 0, "\Registry\Machine\SOFTWARE\Microsoft\Cryptography\RNG"}, 0, 0x0, 0, ... -2147482740, 2, ) }, 0, 0x0, 0, ... -2147482740, 2, ) == 0x0
 01635   860   NtSetValueKey  (-2147482740,  (-2147482740, "Seed", 0, 3, "H\362+\205l\36\312\311\300m\33Y\275N\270\223\240\355g\302\271\337"\274D\2P<\276`w\337\244k\213H\351q\312\56\33\233[\10:P?lJ\201|\364@Q\327\271V\376\274\316\7\231\17\256\374'\243\306\354h\16\0Q\12\361\300\355.\226", 80, ... ) , 0, 3,  (-2147482740, "Seed", 0, 3, "H\362+\205l\36\312\311\300m\33Y\275N\270\223\240\355g\302\271\337"\274D\2P<\276`w\337\244k\213H\351q\312\56\33\233[\10:P?lJ\201|\364@Q\327\271V\376\274\316\7\231\17\256\374'\243\306\354h\16\0Q\12\361\300\355.\226", 80, ... ) \274D\2P<\276`w\337\244k\213H\351q\312\56\33\233[\10:P?lJ\201|\364@Q\327\271V\376\274\316\7\231\17\256\374'\243\306\354h\16\0Q\12\361\300\355.\226", 80, ... ) == 0x0
 01636   860   NtClose  (-2147482740, ... ) == 0x0
 01626   860   NtDeviceIoControlFile  ... {status=0x0, info=256},  ... {status=0x0, info=256}, "\335\3423{\335\15\263,\205lf\332DY\373\253 \252aU\330Z1\333!\302\234y.\25\237\30w\241\206\254\323\372\24\255|\37\313\263\341\224\377c\365g\37\320\27\362\236\370\23Y\245\265\363Lhh\37\322\374\30G\242\237^P\3076JC~\223\347]\230\13\222x_\326yAr\5\240\310@\370![s\215\37\272\263\26\340+\362\327Ui\334\226}\252\3\203\10-\375@+\216J\211\251\10\330|c \231\213\26\230s\377\231nuT5\267&\254\34\211\246l\264\254W\312z\6\25\315\352\221n17&\26\352\335A\303\206\317*\307\346\305\344\375\2078\233[\375G_+\204\276\35t6)P\253}\360\22\34'\250J#\312\236\36njb\230>\317G]\177\327\367\263e\343\177\350\307W\21mtg\230\202\32:w\364*\206\322\331\241\372V\35}\263\255\216\367\307\270\241\12\352\325P\222\25\234\374\226H\355", ) , ) == 0x0
 01637   860   NtDeviceIoControlFile  (44, 0, 0x0, 0x0, 0x390008,  (44, 0, 0x0, 0x0, 0x390008, "\324d\365\27\7%k\32h=\335\351\367\345C\375 \327\352GR\244\352 \327\352GR\244\352 \327\352GR\34\304\363\26Zl\272\210s\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0", 256, 256, ... , 256, 256, ...
 01638   860   NtQuerySystemInformation  (TimeOfDay, 48, ... {system info, class 3, size 48}, 48, ) == 0x0
 01639   860   NtQuerySystemInformation  (ProcessorTimes, 48, ... {system info, class 8, size 48}, 48, ) == 0x0
 01640   860   NtQuerySystemInformation  (Performance, 312, ... {system info, class 2, size 312}, 312, ) == 0x0
 01641   860   NtQuerySystemInformation  (Exception, 16, ... {system info, class 33, size 16}, 16, ) == 0x0
 01642   860   NtQuerySystemInformation  (Lookaside, 32, ... {system info, class 45, size 32}, 32, ) == 0x0
 01643   860   NtQuerySystemInformation  (ProcessorStatistics, 3016, ... {system info, class 23, size 0}, 0, ) == 0x0
 01644   860   NtQuerySystemInformation  (ProcessesAndThreads, 3008, ... ) == STATUS_INFO_LENGTH_MISMATCH
 01645   860   NtCreateKey  (0x2, {24, 0, 0x240, 0, 0,  (0x2, {24, 0, 0x240, 0, 0, "\Registry\Machine\SOFTWARE\Microsoft\Cryptography\RNG"}, 0, 0x0, 0, ... -2147482740, 2, ) }, 0, 0x0, 0, ... -2147482740, 2, ) == 0x0
 01646   860   NtSetValueKey  (-2147482740,  (-2147482740, "Seed", 0, 3, "\3\371\2679\334\250Q;\356\205\25\217\327\300x:\221\335^\276\31\10\272\16\307\31\222\330\207\26\322y\0\370\247T:&+I\251\334Y\7\375&\371\36\266\1\333wa\36\377 \347\242Nc5c\12\32\10\211\212\230 \363\326$\270q\340\332\311\224+8", 80, ... ) , 0, 3,  (-2147482740, "Seed", 0, 3, "\3\371\2679\334\250Q;\356\205\25\217\327\300x:\221\335^\276\31\10\272\16\307\31\222\330\207\26\322y\0\370\247T:&+I\251\334Y\7\375&\371\36\266\1\333wa\36\377 \347\242Nc5c\12\32\10\211\212\230 \363\326$\270q\340\332\311\224+8", 80, ... ) , 80, ... ) == 0x0
 01647   860   NtClose  (-2147482740, ... ) == 0x0
 01637   860   NtDeviceIoControlFile  ... {status=0x0, info=256},  ... {status=0x0, info=256}, "#\320\220f\2414\3060\236\335\244\310\301\202\11ySY\355-\330h\342@{\375%\353h\316\48\262G\250k\341\302G\37\354m!\324\324\333l\354\327J\26\261\251`\337\7U\4\343jV\213&\225(\204;E?\372\204\231\260g\201\252\323\202\226@\3662x\13\276\240[X\273\366\353\304\32t\23\257\31\2060\311\324\27@GX\225)\371\317\224\217\272\216\2\253\364G\306\235\371$k\256\264Y\376\305\314\253:[_\200R'i\342^\330O\264\303\35\357\320\247";\2\375\354\364\6i3\307K\270\221\253\2652\2\212\33\374\341\315\272\177\216U\353\213\304l)]\221B\213s\220<\313\311\253HYv\270%s\216\314\27]S\341\353\373\305\210\331\247\22\265CZ\213T\34X\177\6^\276\212\227\256wZ\344\7@2\331\235\317\345\223\276\342\230m\310 \317\273\370\236'\15\310\321\210z\317'\20\204\244$F\332\37", ) ;\2\375\354\364\6i3\307K\270\221\253\2652\2\212\33\374\341\315\272\177\216U\353\213\304l)]\221B\213s\220<\313\311\253HYv\270%s\216\314\27]S\341\353\373\305\210\331\247\22\265CZ\213T\34X\177\6^\276\212\227\256wZ\344\7@2\331\235\317\345\223\276\342\230m\310 \317\273\370\236'\15\310\321\210z\317'\20\204\244$F\332\37", ) == 0x0
 01648   860   NtDeviceIoControlFile  (44, 0, 0x0, 0x0, 0x390008,  (44, 0, 0x0, 0x0, 0x390008, "\324d\365\27\7%k\32h=\335\351\367\345C\375 \327\352GR\244\352 \327\352GR\244\352 \327\352GR\244\352 \327\352GR\34\304\363\26Zl\272\210s\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0", 256, 256, ... , 256, 256, ...
 01649   860   NtQuerySystemInformation  (TimeOfDay, 48, ... {system info, class 3, size 48}, 48, ) == 0x0
 01650   860   NtQuerySystemInformation  (ProcessorTimes, 48, ... {system info, class 8, size 48}, 48, ) == 0x0
 01651   860   NtQuerySystemInformation  (Performance, 312, ... {system info, class 2, size 312}, 312, ) == 0x0
 01652   860   NtQuerySystemInformation  (Exception, 16, ... {system info, class 33, size 16}, 16, ) == 0x0
 01653   860   NtQuerySystemInformation  (Lookaside, 32, ... {system info, class 45, size 32}, 32, ) == 0x0
 01654   860   NtQuerySystemInformation  (ProcessorStatistics, 3016, ... {system info, class 23, size 0}, 0, ) == 0x0
 01655   860   NtQuerySystemInformation  (ProcessesAndThreads, 3008, ... ) == STATUS_INFO_LENGTH_MISMATCH
 01656   860   NtCreateKey  (0x2, {24, 0, 0x240, 0, 0,  (0x2, {24, 0, 0x240, 0, 0, "\Registry\Machine\SOFTWARE\Microsoft\Cryptography\RNG"}, 0, 0x0, 0, ... -2147482740, 2, ) }, 0, 0x0, 0, ... -2147482740, 2, ) == 0x0
 01657   860   NtSetValueKey  (-2147482740,  (-2147482740, "Seed", 0, 3, "\25\275\177_B\242n\3513^\211\314b\240\355<\260Z\372\36\377t\23\3552\314\2534\335\214\302\276\322.HF\325\10\263\354\256\267\20|)\334\24\20\177\342\215G\226\325\274[\372\376Fv\244T\270\16\207\315u\335\367mj\377\222\300\220\346\350\331\272\277", 80, ... ) , 0, 3,  (-2147482740, "Seed", 0, 3, "\25\275\177_B\242n\3513^\211\314b\240\355<\260Z\372\36\377t\23\3552\314\2534\335\214\302\276\322.HF\325\10\263\354\256\267\20|)\334\24\20\177\342\215G\226\325\274[\372\376Fv\244T\270\16\207\315u\335\367mj\377\222\300\220\346\350\331\272\277", 80, ... ) , 80, ... ) == 0x0
 01658   860   NtClose  (-2147482740, ... ) == 0x0
 01648   860   NtDeviceIoControlFile  ... {status=0x0, info=256},  ... {status=0x0, info=256}, "\4\11\375\26B{\270\300\225\334\313\5X\251\313\21\230\372\236L$D\345\27\3569n\263 [/*y\331\242\212+\327\256t(\206\251M_p\364[Y\376C\212\257\327\305\217R\332\265v\261'\332\324\322\352\340\243r_^\24\260\32\255a\21P8R\337\210|\2u\276WqV\31:uo\306\15t=I\20\240\314\273Kf5C\253\364e\a?%\352\366Q\360\360o\225\370\206\14)\340\217\334\221\327\261\25kX\11\10#V\251_\327%8\3164*\246\272EJ\373xd<\260K\360K\275\233\210\247\342\270\24\231P\345\234\10\354\304\225\327\25\0?\323\22\260\364\270\21_\366\232\20N)\316\331\372\262];{\266\16(Y@\201\30\330ek~\24\21\364\371L:\16\216D\3\226,\224\2471C\260\254\247\271\275l}\327C'_\3526\276?\322D\254\3\234\20\200c\377\373 \375\236d\366i\211\304\272", ) , ) == 0x0
 01659   860   NtDeviceIoControlFile  (44, 0, 0x0, 0x0, 0x390008,  (44, 0, 0x0, 0x0, 0x390008, "\324d\365\27\7%k\32h=\335\351\367\345C\375 \327\352GR\244\352 \327\352GR\244\352 \327\352GR\244\352 \327\352GR\244\352 \327\352GR\34\304\363\26Zl\272\210s\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0", 256, 256, ... , 256, 256, ...
 01660   860   NtQuerySystemInformation  (TimeOfDay, 48, ... {system info, class 3, size 48}, 48, ) == 0x0
 01661   860   NtQuerySystemInformation  (ProcessorTimes, 48, ... {system info, class 8, size 48}, 48, ) == 0x0
 01662   860   NtQuerySystemInformation  (Performance, 312, ... {system info, class 2, size 312}, 312, ) == 0x0
 01663   860   NtQuerySystemInformation  (Exception, 16, ... {system info, class 33, size 16}, 16, ) == 0x0
 01664   860   NtQuerySystemInformation  (Lookaside, 32, ... {system info, class 45, size 32}, 32, ) == 0x0
 01665   860   NtQuerySystemInformation  (ProcessorStatistics, 3016, ... {system info, class 23, size 0}, 0, ) == 0x0
 01666   860   NtQuerySystemInformation  (ProcessesAndThreads, 3008, ... ) == STATUS_INFO_LENGTH_MISMATCH
 01667   860   NtCreateKey  (0x2, {24, 0, 0x240, 0, 0,  (0x2, {24, 0, 0x240, 0, 0, "\Registry\Machine\SOFTWARE\Microsoft\Cryptography\RNG"}, 0, 0x0, 0, ... -2147482740, 2, ) }, 0, 0x0, 0, ... -2147482740, 2, ) == 0x0
 01668   860   NtSetValueKey  (-2147482740,  (-2147482740, "Seed", 0, 3, "_\27^]x'\323E'\357\250\207\202\370\224\375w\227\272\210-\304'\274\371\25\223t\222cA.{\344\270\224\3415,2\270\2159\231X\36\326)\3713(\376\226gX\203\312\245\236\247\21\247\270{\262\313V\367\313\261`%;@\37\6\323\6'", 80, ... ) , 0, 3,  (-2147482740, "Seed", 0, 3, "_\27^]x'\323E'\357\250\207\202\370\224\375w\227\272\210-\304'\274\371\25\223t\222cA.{\344\270\224\3415,2\270\2159\231X\36\326)\3713(\376\226gX\203\312\245\236\247\21\247\270{\262\313V\367\313\261`%;@\37\6\323\6'", 80, ... ) , 80, ... ) == 0x0
 01669   860   NtClose  (-2147482740, ... ) == 0x0
 01659   860   NtDeviceIoControlFile  ... {status=0x0, info=256},  ... {status=0x0, info=256}, ".\347\324\3\332\327\37\270afV\363tJ\262\325O\213\27\322\20r\366\13\330\244\36=2\367\325\302#\232/\267\6XMb\35i^\215O\304\25;c\275w\366\263;\220w\37\255\214Oj49\325\247\365u\362\177t\0)\241\351\300\34\252lM\220\0\200a\236,:\13L\262\301u4\325,z\304~>\35\246J\352\313S\255\303\311\21\5\351\271\302\330\312\231-\342&Bz\237+\310xg5\342\36%'m\15\224G\13\215\31d\363\315\322\15\254\213)\3452\330Qx\273\233\216+\3261R\272\7\50\256\37\10~\324\177\25\267(\336\343bA0n\213sy\251\256\323\270\331\200!\325"\263c7\261l\305\264>?\375\344\120\352\320\226%\246\216$\336G\323\272\315~\375PZ\264\315\14E*\30Z\257E\3143)\314Q\13\15\6UG\362\2717\241\221\312i\334e\207\16n\360\327L\2221F", ) \263c7\261l\305\264>?\375\344\120\352\320\226%\246\216$\336G\323\272\315~\375PZ\264\315\14E*\30Z\257E\3143)\314Q\13\15\6UG\362\2717\241\221\312i\334e\207\16n\360\327L\2221F", ) == 0x0
 01670   860   NtDeviceIoControlFile  (44, 0, 0x0, 0x0, 0x390008,  (44, 0, 0x0, 0x0, 0x390008, "\324d\365\27\7%k\32h=\335\351\367\345C\375 \327\352GR\244\352 \327\352GR\244\352 \327\352GR\244\352 \327\352GR\244\352 \327\352GR\244\352 \327\352GR\34\304\363\26Zl\272\210s\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0", 256, 256, ... , 256, 256, ...
 01671   860   NtQuerySystemInformation  (TimeOfDay, 48, ... {system info, class 3, size 48}, 48, ) == 0x0
 01672   860   NtQuerySystemInformation  (ProcessorTimes, 48, ... {system info, class 8, size 48}, 48, ) == 0x0
 01673   860   NtQuerySystemInformation  (Performance, 312, ... {system info, class 2, size 312}, 312, ) == 0x0
 01674   860   NtQuerySystemInformation  (Exception, 16, ... {system info, class 33, size 16}, 16, ) == 0x0
 01675   860   NtQuerySystemInformation  (Lookaside, 32, ... {system info, class 45, size 32}, 32, ) == 0x0
 01676   860   NtQuerySystemInformation  (ProcessorStatistics, 3016, ... {system info, class 23, size 0}, 0, ) == 0x0
 01677   860   NtQuerySystemInformation  (ProcessesAndThreads, 3008, ... ) == STATUS_INFO_LENGTH_MISMATCH
 01678   860   NtCreateKey  (0x2, {24, 0, 0x240, 0, 0,  (0x2, {24, 0, 0x240, 0, 0, "\Registry\Machine\SOFTWARE\Microsoft\Cryptography\RNG"}, 0, 0x0, 0, ... -2147482740, 2, ) }, 0, 0x0, 0, ... -2147482740, 2, ) == 0x0
 01679   860   NtSetValueKey  (-2147482740,  (-2147482740, "Seed", 0, 3, "\210\204\263?0\4\341\\245nC]\332\23\34\3142\363"\241bt\237\322w\1n\314\371\3768\237\324U\274\361\244\26\270\234s\250\230\221\37\336\30\342\32\315\374\317\225\261\377\321[\334\177\\205\361\25\243\217`Y\332\272\324\241w\262\345\336=;'\203\306", 80, ... ) , 0, 3,  (-2147482740, "Seed", 0, 3, "\210\204\263?0\4\341\\245nC]\332\23\34\3142\363"\241bt\237\322w\1n\314\371\3768\237\324U\274\361\244\26\270\234s\250\230\221\37\336\30\342\32\315\374\317\225\261\377\321[\334\177\\205\361\25\243\217`Y\332\272\324\241w\262\345\336=;'\203\306", 80, ... ) \241bt\237\322w\1n\314\371\3768\237\324U\274\361\244\26\270\234s\250\230\221\37\336\30\342\32\315\374\317\225\261\377\321[\334\177\\205\361\25\243\217`Y\332\272\324\241w\262\345\336=;'\203\306", 80, ... ) == 0x0
 01680   860   NtClose  (-2147482740, ... ) == 0x0
 01670   860   NtDeviceIoControlFile  ... {status=0x0, info=256},  ... {status=0x0, info=256}, "\361\32p\2603/\312\343\346\307\255\345\217\224;9\36\352)\345(\274\350\177\231\2u\262\361\357\35\241=\304%\252\307\357\7\355e6@<6(\3638>\225v\253tF\26\265\376\3\322\333\3047{\237\334\221^\377\316\242\206\207J\243\235\273d\270\371\221\370<\326\33\276\221bXyo\323\301\321\363S\270\253)\317C\213\357e";\324\372\337-\302/ks\336\346\3663\345P\253\235[\230\224V\251[\375\216\214\27\210\201Z\332\214ngm.\335-H\243\233\244U\36\230\223q\325\323\334\220\207\0\230[\346~\23W\236\302x\15Gl\200\222\2315\342\25\363\13\11\227%\27\13Lo\210\264\241\266Ok_AN\223\302\343P\2144EJ6\345\2330\16\206\204\21030\177\310`v\303o\0\32IB\11\265El6L\3\36\303\253\0.\245\32\347\215\344\374\340v.\343\341\236\22\353\353\274F@\251\334\237\201\2", ) ;\324\372\337-\302/ks\336\346\3663\345P\253\235[\230\224V\251[\375\216\214\27\210\201Z\332\214ngm.\335-H\243\233\244U\36\230\223q\325\323\334\220\207\0\230[\346~\23W\236\302x\15Gl\200\222\2315\342\25\363\13\11\227%\27\13Lo\210\264\241\266Ok_AN\223\302\343P\2144EJ6\345\2330\16\206\204\21030\177\310`v\303o\0\32IB\11\265El6L\3\36\303\253\0.\245\32\347\215\344\374\340v.\343\341\236\22\353\353\274F@\251\334\237\201\2", ) == 0x0
 01681   860   NtCreateEvent  (0x1f0003, 0x0, 1, 0, ... 140, ) == 0x0
 01682   860   NtConnectPort  ( ("\RPC Control\IcaApi", {12, 2, 1, 0}, 0x0, 0x0, 1233924, 188, ... 152, 0x0, 0x0, 0x0, 188, ) , {12, 2, 1, 0}, 0x0, 0x0, 1233924, 188, ... 152, 0x0, 0x0, 0x0, 188, ) == 0x0
 01683   860   NtRequestWaitReplyPort  (152, {200, 224, new_msg, 0, 1345392, 12, 2, 1310721}  (152, {200, 224, new_msg, 0, 1345392, 12, 2, 1310721} "\0\1\24\0\274\0\0\0\240\243\24\0`\247\244\\261\353\317\21\206\21\0\240$T \355\1\0\0\0\1\0\0\0\30\206\24\0\4\0\0\0\2\0\0\0\10\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\377\377\2\0\0\0\305\12\37\201\217Z\7\2\320\377\24\0\\1\24\0\12\0\0\0\0\0\0\0\320\377\24\00\0\0\0\330\377\24\0"\210\345\252\250\1\24\0(\0\0\0\212\35\0\20\0\0\24\0`\322\22\0(\1\0\0\0\0\0\0\20X\24\0\360\6\221|\377\377\377\377P\0\0\0\346\31\0|\0\0\24\0\204\322\22\0\372\31\221|\30\332\22\0\30\356\220|\360\6\221|\0\0\0\0\0\0\0\0\0\0\0\0\6\0\0\0" ... {200, 224, reply, 0, 464, 860, 58026, 0} "\7\1\24\0\274\0\0\0\240\243\24\0`\247\244\\261\353\317\21\206\21\0\240$T \355\1\0\0\0\1\0\0\0\0\0\0\0\4\0\0\0\2\0\0\0\377\377\377\377\5\0\0\0\0\0\0\0\0\0\0\0\0\0\377\377\2\0\0\0\305\12\37\201\217Z\7\2\320\377\24\0\\1\24\0\12\0\0\0\0\0\0\0\320\377\24\00\0\0\0\330\377\24\0"\210\345\252\250\1\24\0(\0\0\0\212\35\0\20\0\0\24\0`\322\22\0(\1\0\0\0\0\0\0\20X\24\0\360\6\221|\377\377\377\377P\0\0\0\346\31\0|\0\0\24\0\204\322\22\0\372\31\221|\30\332\22\0\30\356\220|\360\6\221|\0\0\0\0\0\0\0\0\0\0\0\0\6\0\0\0" ) \210\345\252\250\1\24\0(\0\0\0\212\35\0\20\0\0\24\0`\322\22\0(\1\0\0\0\0\0\0\20X\24\0\360\6\221|\377\377\377\377P\0\0\0\346\31\0|\0\0\24\0\204\322\22\0\372\31\221|\30\332\22\0\30\356\220|\360\6\221|\0\0\0\0\0\0\0\0\0\0\0\0\6\0\0\0 (152, {200, 224, new_msg, 0, 1345392, 12, 2, 1310721} "\0\1\24\0\274\0\0\0\240\243\24\0`\247\244\\261\353\317\21\206\21\0\240$T \355\1\0\0\0\1\0\0\0\30\206\24\0\4\0\0\0\2\0\0\0\10\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\377\377\2\0\0\0\305\12\37\201\217Z\7\2\320\377\24\0\\1\24\0\12\0\0\0\0\0\0\0\320\377\24\00\0\0\0\330\377\24\0"\210\345\252\250\1\24\0(\0\0\0\212\35\0\20\0\0\24\0`\322\22\0(\1\0\0\0\0\0\0\20X\24\0\360\6\221|\377\377\377\377P\0\0\0\346\31\0|\0\0\24\0\204\322\22\0\372\31\221|\30\332\22\0\30\356\220|\360\6\221|\0\0\0\0\0\0\0\0\0\0\0\0\6\0\0\0" ... {200, 224, reply, 0, 464, 860, 58026, 0} "\7\1\24\0\274\0\0\0\240\243\24\0`\247\244\\261\353\317\21\206\21\0\240$T \355\1\0\0\0\1\0\0\0\0\0\0\0\4\0\0\0\2\0\0\0\377\377\377\377\5\0\0\0\0\0\0\0\0\0\0\0\0\0\377\377\2\0\0\0\305\12\37\201\217Z\7\2\320\377\24\0\\1\24\0\12\0\0\0\0\0\0\0\320\377\24\00\0\0\0\330\377\24\0"\210\345\252\250\1\24\0(\0\0\0\212\35\0\20\0\0\24\0`\322\22\0(\1\0\0\0\0\0\0\20X\24\0\360\6\221|\377\377\377\377P\0\0\0\346\31\0|\0\0\24\0\204\322\22\0\372\31\221|\30\332\22\0\30\356\220|\360\6\221|\0\0\0\0\0\0\0\0\0\0\0\0\6\0\0\0" ) \7\1\24\0\274\0\0\0\240\243\24\0`\247\244\\261\353\317\21\206\21\0\240$T \355\1\0\0\0\1\0\0\0\0\0\0\0\4\0\0\0\2\0\0\0\377\377\377\377\5\0\0\0\0\0\0\0\0\0\0\0\0\0\377\377\2\0\0\0\305\12\37\201\217Z\7\2\320\377\24\0\\1\24\0\12\0\0\0\0\0\0\0\320\377\24\00\0\0\0\330\377\24\0 (152, {200, 224, new_msg, 0, 1345392, 12, 2, 1310721} "\0\1\24\0\274\0\0\0\240\243\24\0`\247\244\\261\353\317\21\206\21\0\240$T \355\1\0\0\0\1\0\0\0\30\206\24\0\4\0\0\0\2\0\0\0\10\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\377\377\2\0\0\0\305\12\37\201\217Z\7\2\320\377\24\0\\1\24\0\12\0\0\0\0\0\0\0\320\377\24\00\0\0\0\330\377\24\0"\210\345\252\250\1\24\0(\0\0\0\212\35\0\20\0\0\24\0`\322\22\0(\1\0\0\0\0\0\0\20X\24\0\360\6\221|\377\377\377\377P\0\0\0\346\31\0|\0\0\24\0\204\322\22\0\372\31\221|\30\332\22\0\30\356\220|\360\6\221|\0\0\0\0\0\0\0\0\0\0\0\0\6\0\0\0" ... {200, 224, reply, 0, 464, 860, 58026, 0} "\7\1\24\0\274\0\0\0\240\243\24\0`\247\244\\261\353\317\21\206\21\0\240$T \355\1\0\0\0\1\0\0\0\0\0\0\0\4\0\0\0\2\0\0\0\377\377\377\377\5\0\0\0\0\0\0\0\0\0\0\0\0\0\377\377\2\0\0\0\305\12\37\201\217Z\7\2\320\377\24\0\\1\24\0\12\0\0\0\0\0\0\0\320\377\24\00\0\0\0\330\377\24\0"\210\345\252\250\1\24\0(\0\0\0\212\35\0\20\0\0\24\0`\322\22\0(\1\0\0\0\0\0\0\20X\24\0\360\6\221|\377\377\377\377P\0\0\0\346\31\0|\0\0\24\0\204\322\22\0\372\31\221|\30\332\22\0\30\356\220|\360\6\221|\0\0\0\0\0\0\0\0\0\0\0\0\6\0\0\0" )  ) == 0x0
 01684   860   NtRequestWaitReplyPort  (152, {32, 56, new_msg, 0, 44, 3, 20, 0}  (152, {32, 56, new_msg, 0, 44, 3, 20, 0} "\1\0\0\0A\3\0\0`\247\244\\261\353\317\21\206\21\0\240$T \355\377\377\377\377\21\0\0\0" ... {124, 148, reply, 0, 464, 860, 58027, 0} "\2\376\255\201\1\0\0\0\200Y\274\201V\347\340\341\264\311\275\201:\332R\200X;\350\371\324\376\255\201\0\0\0\0\0\0\0\0)%\25E?>\A\250\245\22\360\331E\16S\10\210\300\310\0\0\0\3\1\0\0\3\1\0\0\10A\210\300\0@\250\300\220\276u\201\264;\350\371R\250S\200\304;\350\371\4\0\0\0\0\0\0\0\220\276u\201<(\255\201\7\0\0\0\304\277u\201]\0\0\0" )  ... {124, 148, reply, 0, 464, 860, 58027, 0}  (152, {32, 56, new_msg, 0, 44, 3, 20, 0} "\1\0\0\0A\3\0\0`\247\244\\261\353\317\21\206\21\0\240$T \355\377\377\377\377\21\0\0\0" ... {124, 148, reply, 0, 464, 860, 58027, 0} "\2\376\255\201\1\0\0\0\200Y\274\201V\347\340\341\264\311\275\201:\332R\200X;\350\371\324\376\255\201\0\0\0\0\0\0\0\0)%\25E?>\A\250\245\22\360\331E\16S\10\210\300\310\0\0\0\3\1\0\0\3\1\0\0\10A\210\300\0@\250\300\220\276u\201\264;\350\371R\250S\200\304;\350\371\4\0\0\0\0\0\0\0\220\276u\201<(\255\201\7\0\0\0\304\277u\201]\0\0\0" )  ) == 0x0
 01685   860   NtRequestWaitReplyPort  (152, {44, 68, new_msg, 56, 464, 860, 58027, 0}  (152, {44, 68, new_msg, 56, 464, 860, 58027, 0} "\1\376\0\0B\2\5\0\200Y\274\201V\347\340\341\264\311\275\201:\332R\200\377\377\377\377\324\376\255\201\1\0\0\0\340\210\24\0\10\5\0\0" ... {40, 64, reply, 0, 464, 860, 58028, 0} "\2\356Q\200\4\0\0\0\30b\202\201\0\260\375\177\220k\364\367\370\37`\300lk\364\367X\353Q\200\14\5\0\0\320\371\15\0" )  ... {40, 64, reply, 0, 464, 860, 58028, 0}  (152, {44, 68, new_msg, 56, 464, 860, 58027, 0} "\1\376\0\0B\2\5\0\200Y\274\201V\347\340\341\264\311\275\201:\332R\200\377\377\377\377\324\376\255\201\1\0\0\0\340\210\24\0\10\5\0\0" ... {40, 64, reply, 0, 464, 860, 58028, 0} "\2\356Q\200\4\0\0\0\30b\202\201\0\260\375\177\220k\364\367\370\37`\300lk\364\367X\353Q\200\14\5\0\0\320\371\15\0" )  ) == 0x0
 01686   860   NtRequestWaitReplyPort  (152, {64, 88, new_msg, 56, 1347752, 1234500, 1345752, 0}  (152, {64, 88, new_msg, 56, 1347752, 1234500, 1345752, 0} "\10\0\0\0@\0\1\1\372\0\0\0<\325\22\0\340\210\24\0X\332\22\0\30\356\220|p\5\221|\1\0\0\0\340\210\24\0\14\5\0\0\14\5\0\0\320\371\15\0\0\0\0\0\0\0\0\0\273f\347w" ... {64, 88, reply, 56, 464, 860, 58029, 0} "\10\0\0\0@\0\1\1\372\0\0\0<\325\22\0\340\210\24\0X\332\22\0\30\356\220|p\5\221|\1\0\0\0\340\210\24\0\14\5\0\0\14\5\0\0\320\371\15\0\0\0\0\0\0\0\0\0\273f\347w" )  ... {64, 88, reply, 56, 464, 860, 58029, 0}  (152, {64, 88, new_msg, 56, 1347752, 1234500, 1345752, 0} "\10\0\0\0@\0\1\1\372\0\0\0<\325\22\0\340\210\24\0X\332\22\0\30\356\220|p\5\221|\1\0\0\0\340\210\24\0\14\5\0\0\14\5\0\0\320\371\15\0\0\0\0\0\0\0\0\0\273f\347w" ... {64, 88, reply, 56, 464, 860, 58029, 0} "\10\0\0\0@\0\1\1\372\0\0\0<\325\22\0\340\210\24\0X\332\22\0\30\356\220|p\5\221|\1\0\0\0\340\210\24\0\14\5\0\0\14\5\0\0\320\371\15\0\0\0\0\0\0\0\0\0\273f\347w" )  ) == 0x0
 01687   860   NtRequestWaitReplyPort  (152, {44, 68, new_msg, 56, 464, 860, 58028, 0}  (152, {44, 68, new_msg, 56, 464, 860, 58028, 0} "\1\356\0\0B\2\5\0\30b\202\201\0\260\375\177\220k\364\367\370\37`\300\377\377\377\377X\353Q\200\1\0\0\0\250\243\24\0\10\5\0\0" ... {40, 64, reply, 0, 464, 860, 58030, 0} "\2\376\255\201\4\0\0\0\200Y\274\201V\347\340\341\264\311\275\201:\332R\200X;\350\371\324\376\255\201\14\5\0\0\320\371\15\0" )  ... {40, 64, reply, 0, 464, 860, 58030, 0}  (152, {44, 68, new_msg, 56, 464, 860, 58028, 0} "\1\356\0\0B\2\5\0\30b\202\201\0\260\375\177\220k\364\367\370\37`\300\377\377\377\377X\353Q\200\1\0\0\0\250\243\24\0\10\5\0\0" ... {40, 64, reply, 0, 464, 860, 58030, 0} "\2\376\255\201\4\0\0\0\200Y\274\201V\347\340\341\264\311\275\201:\332R\200X;\350\371\324\376\255\201\14\5\0\0\320\371\15\0" )  ) == 0x0
 01688   860   NtRequestWaitReplyPort  (152, {64, 88, new_msg, 56, 1369936, 1234500, 1352608, 0}  (152, {64, 88, new_msg, 56, 1369936, 1234500, 1352608, 0} "\10\0\0\0@\0\1\1v\10\0\0<\325\22\0\250\243\24\0X\332\22\0\30\356\220|p\5\221|\1\0\0\0\250\243\24\0\14\5\0\0\14\5\0\0\320\371\15\0\0\0\0\0\0\0\0\0\273f\347w" ... {64, 88, reply, 56, 464, 860, 58031, 0} "\10\0\0\0@\0\1\1v\10\0\0<\325\22\0\250\243\24\0X\332\22\0\30\356\220|p\5\221|\1\0\0\0\250\243\24\0\14\5\0\0\14\5\0\0\320\371\15\0\0\0\0\0\0\0\0\0\273f\347w" )  ... {64, 88, reply, 56, 464, 860, 58031, 0}  (152, {64, 88, new_msg, 56, 1369936, 1234500, 1352608, 0} "\10\0\0\0@\0\1\1v\10\0\0<\325\22\0\250\243\24\0X\332\22\0\30\356\220|p\5\221|\1\0\0\0\250\243\24\0\14\5\0\0\14\5\0\0\320\371\15\0\0\0\0\0\0\0\0\0\273f\347w" ... {64, 88, reply, 56, 464, 860, 58031, 0} "\10\0\0\0@\0\1\1v\10\0\0<\325\22\0\250\243\24\0X\332\22\0\30\356\220|p\5\221|\1\0\0\0\250\243\24\0\14\5\0\0\14\5\0\0\320\371\15\0\0\0\0\0\0\0\0\0\273f\347w" )  ) == 0x0
 01689   860   NtOpenThreadToken  (-2, 0xc, 1, ... ) == STATUS_NO_TOKEN
 01690   860   NtCreateEvent  (0x1f0003, 0x0, 1, 0, ... 156, ) == 0x0
 01691   860   NtOpenThreadToken  (-2, 0xc, 1, ... ) == STATUS_NO_TOKEN
 01692   860   NtSetInformationThread  (-2, ImpersonationToken, {ImpToken=0,}, 4, ... ) == 0x0
 01693   860   NtCreateFile  (0xc0100080, {24, 0, 0x40, 0, 1233960,  (0xc0100080, {24, 0, 0x40, 0, 1233960, "\??\PIPE\lsarpc"}, 0x0, 0, 3, 1, 64, 0, 0, ... 160, {status=0x0, info=1}, ) }, 0x0, 0, 3, 1, 64, 0, 0, ... 160, {status=0x0, info=1}, ) == 0x0
 01694   860   NtSetInformationFile  (160, 1234016, 8, Pipe, ... {status=0x0, info=0}, ) == 0x0
 01695   860   NtSetInformationFile  (160, 1234004, 8, Completion, ... {status=0x0, info=0}, ) == 0x0
 01696   860   NtSetInformationThread  (-2, ImpersonationToken, {ImpToken=0,}, 4, ... ) == 0x0
 01697   860   NtWriteFile  (160, 77, 0, 0,  (160, 77, 0, 0, "\5\0\13\3\20\0\0\0H\0\0\0\1\0\0\0\270\20\270\20\0\0\0\0\1\0\0\0\0\0\1\0xW4\224\22\315\253\357\0\1#Eg\211\253\0\0\0\0\4]\210\212\353\34\311\21\237\350\10\0+\20H`\2\0\0\0", 72, {0, 0}, 0, ... {status=0x0, info=72}, ) , 72, {0, 0}, 0, ... {status=0x0, info=72}, ) == 0x0
 01698   860   NtReadFile  (160, 77, 0, 0, 1024, {0, 0}, 0, ... {status=0x0, info=68},  (160, 77, 0, 0, 1024, {0, 0}, 0, ... {status=0x0, info=68}, "\5\0\14\3\20\0\0\0D\0\0\0\1\0\0\0\270\20\270\20.+\0\0\14\0\PIPE\lsass\0\0\0\1\0\0\0\0\0\0\0\4]\210\212\353\34\311\21\237\350\10\0+\20H`\2\0\0\0", ) , ) == 0x0
 01699   860   NtFsControlFile  (160, 77, 0x0, 0x0, 0x11c017,  (160, 77, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0@\0\0\0\1\0\0\0(\0\0\0\0\0,\0\0\0\0\0\30\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\360\332\22\0\14\0\0\0\2\0\1\0\0\10\0\0", 64, 1024, ... {status=0x103, info=68}, "\5\0\14\3\20\0\0\0D\0\0\0\1\0\0\0\270\20\270\20.+\0\0\14\0\PIPE\lsass\0\0\0\1\0\0\0\0\0\0\0\4]\210\212\353\34\311\21\237\350\10\0+\20H`\2\0\0\0", ) , 64, 1024, ... {status=0x103, info=68},  (160, 77, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0@\0\0\0\1\0\0\0(\0\0\0\0\0,\0\0\0\0\0\30\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\360\332\22\0\14\0\0\0\2\0\1\0\0\10\0\0", 64, 1024, ... {status=0x103, info=68}, "\5\0\14\3\20\0\0\0D\0\0\0\1\0\0\0\270\20\270\20.+\0\0\14\0\PIPE\lsass\0\0\0\1\0\0\0\0\0\0\0\4]\210\212\353\34\311\21\237\350\10\0+\20H`\2\0\0\0", ) , ) == 0x103
 01700   860   NtFsControlFile  (160, 77, 0x0, 0x0, 0x11c017,  (160, 77, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0\214\0\0\0\2\0\0\0t\0\0\0\0\0D\0\0\0\0\0\240\334\14R<\222\375E\267\317\273\254bV\241I\1\0\0\0\1\0\0\0,\0.\0\244\335\22\0\27\0\0\0\0\0\0\0\26\0\0\0V\0I\0R\0T\0U\0A\0L\0\\0M\0a\0r\0t\0i\0m\0 \0C\0a\0r\0b\0o\0n\0e\0\0\0\0\0\0\0\0\0\1\0na\0\0\0\0\0\0\0\0\2\0\0\0", 140, 1024, ... {status=0x103, info=48}, "\5\0\2\3\20\0\0\00\0\0\0\1\0\0\0\30\0\0\0\0\0\0\0\0\0\0\0\240\334\14R<\222\375E\267\317\273\254bV\241I\0\0\0\0", ) , 140, 1024, ... {status=0x103, info=48},  (160, 77, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0\214\0\0\0\2\0\0\0t\0\0\0\0\0D\0\0\0\0\0\240\334\14R<\222\375E\267\317\273\254bV\241I\1\0\0\0\1\0\0\0,\0.\0\244\335\22\0\27\0\0\0\0\0\0\0\26\0\0\0V\0I\0R\0T\0U\0A\0L\0\\0M\0a\0r\0t\0i\0m\0 \0C\0a\0r\0b\0o\0n\0e\0\0\0\0\0\0\0\0\0\1\0na\0\0\0\0\0\0\0\0\2\0\0\0", 140, 1024, ... {status=0x103, info=48}, "\5\0\2\3\20\0\0\00\0\0\0\1\0\0\0\30\0\0\0\0\0\0\0\0\0\0\0\240\334\14R<\222\375E\267\317\273\254bV\241I\0\0\0\0", ) , ) == 0x103
 01701   860   NtFsControlFile  (160, 77, 0x0, 0x0, 0x11c017,  (160, 77, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0,\0\0\0\3\0\0\0\24\0\0\0\0\0\0\0\0\0\0\0\240\334\14R<\222\375E\267\317\273\254bV\241I", 44, 1024, ... {status=0x103, info=180}, "\5\0\2\3\20\0\0\0\264\0\0\0\2\0\0\0\234\0\0\0\0\0\0\0\210\215\24\0\1\0\0\0\224\215\24\0 \0\0\0\1\0\0\0\16\0\20\0\240\215\24\0\260\215\24\0\10\0\0\0\0\0\0\0\7\0\0\0V\0I\0R\0T\0U\0A\0L\0O\0\4\0\0\0\1\4\0\0\0\0\0\5\25\0\0\0=\343\10MB\307tR\7\345;+\1\0\0\0\360\215\24\0\1\0\0\0\1\0\15\0\0\216\24\0\0\0\0\0\0\0\0\0\5\0\0\0\1\5\0\0\0\0\0\5\25\0\0\0=\343\10MB\307tR\7\345;+\353\3\0\0\1\0\0\0\0\0\0\0", ) , 44, 1024, ... {status=0x103, info=180},  (160, 77, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0,\0\0\0\3\0\0\0\24\0\0\0\0\0\0\0\0\0\0\0\240\334\14R<\222\375E\267\317\273\254bV\241I", 44, 1024, ... {status=0x103, info=180}, "\5\0\2\3\20\0\0\0\264\0\0\0\2\0\0\0\234\0\0\0\0\0\0\0\210\215\24\0\1\0\0\0\224\215\24\0 \0\0\0\1\0\0\0\16\0\20\0\240\215\24\0\260\215\24\0\10\0\0\0\0\0\0\0\7\0\0\0V\0I\0R\0T\0U\0A\0L\0O\0\4\0\0\0\1\4\0\0\0\0\0\5\25\0\0\0=\343\10MB\307tR\7\345;+\1\0\0\0\360\215\24\0\1\0\0\0\1\0\15\0\0\216\24\0\0\0\0\0\0\0\0\0\5\0\0\0\1\5\0\0\0\0\0\5\25\0\0\0=\343\10MB\307tR\7\345;+\353\3\0\0\1\0\0\0\0\0\0\0", ) , ) == 0x103
 01702   860   NtClose  (156, ... ) == 0x0
 01703   860   NtClose  (160, ... ) == 0x0
 01704   860   NtOpenThreadToken  (-2, 0xc, 1, ... ) == STATUS_NO_TOKEN
 01705   860   NtCreateEvent  (0x1f0003, 0x0, 1, 0, ... 160, ) == 0x0
 01706   860   NtOpenThreadToken  (-2, 0xc, 1, ... ) == STATUS_NO_TOKEN
 01707   860   NtSetInformationThread  (-2, ImpersonationToken, {ImpToken=0,}, 4, ... ) == 0x0
 01708   860   NtCreateFile  (0xc0100080, {24, 0, 0x40, 0, 1233932,  (0xc0100080, {24, 0, 0x40, 0, 1233932, "\??\PIPE\lsarpc"}, 0x0, 0, 3, 1, 64, 0, 0, ... 156, {status=0x0, info=1}, ) }, 0x0, 0, 3, 1, 64, 0, 0, ... 156, {status=0x0, info=1}, ) == 0x0
 01709   860   NtSetInformationFile  (156, 1233988, 8, Pipe, ... {status=0x0, info=0}, ) == 0x0
 01710   860   NtSetInformationFile  (156, 1233976, 8, Completion, ... {status=0x0, info=0}, ) == 0x0
 01711   860   NtSetInformationThread  (-2, ImpersonationToken, {ImpToken=0,}, 4, ... ) == 0x0
 01712   860   NtWriteFile  (156, 77, 0, 0,  (156, 77, 0, 0, "\5\0\13\3\20\0\0\0H\0\0\0\1\0\0\0\270\20\270\20\0\0\0\0\1\0\0\0\0\0\1\0xW4\224\22\315\253\357\0\1#Eg\211\253\0\0\0\0\4]\210\212\353\34\311\21\237\350\10\0+\20H`\2\0\0\0", 72, {0, 0}, 0, ... {status=0x0, info=72}, ) , 72, {0, 0}, 0, ... {status=0x0, info=72}, ) == 0x0
 01713   860   NtReadFile  (156, 77, 0, 0, 1024, {0, 0}, 0, ... {status=0x0, info=68},  (156, 77, 0, 0, 1024, {0, 0}, 0, ... {status=0x0, info=68}, "\5\0\14\3\20\0\0\0D\0\0\0\1\0\0\0\270\20\270\20/+\0\0\14\0\PIPE\lsass\0\0\0\1\0\0\0\0\0\0\0\4]\210\212\353\34\311\21\237\350\10\0+\20H`\2\0\0\0", ) , ) == 0x0
 01714   860   NtFsControlFile  (156, 77, 0x0, 0x0, 0x11c017,  (156, 77, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0@\0\0\0\1\0\0\0(\0\0\0\0\0,\0\0\0\0\0\30\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\324\332\22\0\14\0\0\0\2\0\1\0\0\10\0\0", 64, 1024, ... {status=0x103, info=68}, "\5\0\14\3\20\0\0\0D\0\0\0\1\0\0\0\270\20\270\20/+\0\0\14\0\PIPE\lsass\0\0\0\1\0\0\0\0\0\0\0\4]\210\212\353\34\311\21\237\350\10\0+\20H`\2\0\0\0", ) , 64, 1024, ... {status=0x103, info=68},  (156, 77, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0@\0\0\0\1\0\0\0(\0\0\0\0\0,\0\0\0\0\0\30\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\324\332\22\0\14\0\0\0\2\0\1\0\0\10\0\0", 64, 1024, ... {status=0x103, info=68}, "\5\0\14\3\20\0\0\0D\0\0\0\1\0\0\0\270\20\270\20/+\0\0\14\0\PIPE\lsass\0\0\0\1\0\0\0\0\0\0\0\4]\210\212\353\34\311\21\237\350\10\0+\20H`\2\0\0\0", ) , ) == 0x103
 01715   860   NtFsControlFile  (156, 77, 0x0, 0x0, 0x11c017,  (156, 77, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0\214\0\0\0\2\0\0\0t\0\0\0\0\0D\0\0\0\0\0<\337g|1\306\316M\211\31\304\323\27\253\324\325\1\0\0\0\1\0\0\0,\0.\0\244\335\22\0\27\0\0\0\0\0\0\0\26\0\0\0V\0I\0R\0T\0U\0A\0L\0\\0M\0a\0r\0t\0i\0m\0 \0C\0a\0r\0b\0o\0n\0e\0\0\0\0\0\0\0\0\0\1\0na\0\0\0\0\0\0\0\0\2\0\0\0", 140, 1024, ... {status=0x103, info=48}, "\5\0\2\3\20\0\0\00\0\0\0\1\0\0\0\30\0\0\0\0\0\0\0\0\0\0\0<\337g|1\306\316M\211\31\304\323\27\253\324\325\0\0\0\0", ) , 140, 1024, ... {status=0x103, info=48},  (156, 77, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0\214\0\0\0\2\0\0\0t\0\0\0\0\0D\0\0\0\0\0<\337g|1\306\316M\211\31\304\323\27\253\324\325\1\0\0\0\1\0\0\0,\0.\0\244\335\22\0\27\0\0\0\0\0\0\0\26\0\0\0V\0I\0R\0T\0U\0A\0L\0\\0M\0a\0r\0t\0i\0m\0 \0C\0a\0r\0b\0o\0n\0e\0\0\0\0\0\0\0\0\0\1\0na\0\0\0\0\0\0\0\0\2\0\0\0", 140, 1024, ... {status=0x103, info=48}, "\5\0\2\3\20\0\0\00\0\0\0\1\0\0\0\30\0\0\0\0\0\0\0\0\0\0\0<\337g|1\306\316M\211\31\304\323\27\253\324\325\0\0\0\0", ) , ) == 0x103
 01716   860   NtFsControlFile  (156, 77, 0x0, 0x0, 0x11c017,  (156, 77, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0,\0\0\0\3\0\0\0\24\0\0\0\0\0\0\0\0\0\0\0<\337g|1\306\316M\211\31\304\323\27\253\324\325", 44, 1024, ... {status=0x103, info=180}, "\5\0\2\3\20\0\0\0\264\0\0\0\2\0\0\0\234\0\0\0\0\0\0\0\210\215\24\0\1\0\0\0\224\215\24\0 \0\0\0\1\0\0\0\16\0\20\0\240\215\24\0\260\215\24\0\10\0\0\0\0\0\0\0\7\0\0\0V\0I\0R\0T\0U\0A\0L\0O\0\4\0\0\0\1\4\0\0\0\0\0\5\25\0\0\0=\343\10MB\307tR\7\345;+\1\0\0\0\360\215\24\0\1\0\0\0\1\0\15\0\0\216\24\0\0\0\0\0\0\0\0\0\5\0\0\0\1\5\0\0\0\0\0\5\25\0\0\0=\343\10MB\307tR\7\345;+\353\3\0\0\1\0\0\0\0\0\0\0", ) , 44, 1024, ... {status=0x103, info=180},  (156, 77, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0,\0\0\0\3\0\0\0\24\0\0\0\0\0\0\0\0\0\0\0<\337g|1\306\316M\211\31\304\323\27\253\324\325", 44, 1024, ... {status=0x103, info=180}, "\5\0\2\3\20\0\0\0\264\0\0\0\2\0\0\0\234\0\0\0\0\0\0\0\210\215\24\0\1\0\0\0\224\215\24\0 \0\0\0\1\0\0\0\16\0\20\0\240\215\24\0\260\215\24\0\10\0\0\0\0\0\0\0\7\0\0\0V\0I\0R\0T\0U\0A\0L\0O\0\4\0\0\0\1\4\0\0\0\0\0\5\25\0\0\0=\343\10MB\307tR\7\345;+\1\0\0\0\360\215\24\0\1\0\0\0\1\0\15\0\0\216\24\0\0\0\0\0\0\0\0\0\5\0\0\0\1\5\0\0\0\0\0\5\25\0\0\0=\343\10MB\307tR\7\345;+\353\3\0\0\1\0\0\0\0\0\0\0", ) , ) == 0x103
 01717   860   NtClose  (160, ... ) == 0x0
 01718   860   NtClose  (156, ... ) == 0x0
 01719   860   NtOpenProcessToken  (-1, 0x20008, ... 156, ) == 0x0
 01720   860   NtQueryInformationToken  (156, User, 0, ... ) == STATUS_BUFFER_TOO_SMALL
 01721   860   NtQueryInformationToken  (156, User, 36, ... {token info, class 1, size 36}, 36, ) == 0x0
 01722   860   NtOpenDirectoryObject  (0x2, {24, 0, 0x40, 0, 0,  (0x2, {24, 0, 0x40, 0, 0, "\Windows\WindowStations"}, ... 160, ) }, ... 160, ) == 0x0
 01723   860   NtUserOpenWindowStation  ({24, 160, 0x40, 0, 0,  ({24, 160, 0x40, 0, 0, "winsta0"}, 0x37f, ... ) }, 0x37f, ... ) == 0xa4
 01724   860   NtClose  (160, ... ) == 0x0
 01725   860   NtUserCloseWindowStation  (164, ...
 01726   860   NtClose  (164, ... ) == 0x0
 01725   860   NtUserCloseWindowStation  ... ) == 0x1
 01727   860   NtClose  (156, ... ) == 0x0
 01728   860   NtCreateEvent  (0x1f0003, {24, 0, 0x2, 0, 0, 0x0}, 1, 0, ... 156, ) == 0x0
 01729   860   NtCreateEvent  (0x1f0003, {24, 0, 0x2, 0, 0, 0x0}, 1, 0, ... 164, ) == 0x0
 01730   860   NtCreateMutant  (0x1f0001, {24, 0, 0x2, 0, 0, 0x0}, 0, ... 160, ) == 0x0
 01731   860   NtDuplicateObject  (-1, -1, -1, 0x1f0fff, 2, 0, ... 168, ) == 0x0
 01732   860   NtCreateSection  (0xf0007, {24, 0, 0x2, 0, 0, 0x0}, {7248, 0}, 4, 134217728, 0, ... 172, ) == 0x0
 01733   860   NtMapViewOfSection  (172, -1, (0x0), 0, 0, {0, 0}, 0, 1, 0, 4, ... (0x370000), {0, 0}, 8192, ) == 0x0
 01734   860   NtQueryDefaultUILanguage  (1234624, ...
 01735   860   NtOpenThreadTokenEx  (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN
 01736   860   NtOpenProcessTokenEx  (-1, 0x20008, 512, ... -2147482740, ) == 0x0
 01737   860   NtQueryInformationToken  (-2147482740, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0
 01738   860   NtClose  (-2147482740, ... ) == 0x0
 01739   860   NtOpenKey  (0x2000000, {24, 0, 0x640, 0, 0,  (0x2000000, {24, 0, 0x640, 0, 0, "\REGISTRY\USER\S-1-5-21-1292428093-1383384898-725345543-1003"}, ... -2147482740, ) }, ... -2147482740, ) == 0x0
 01740   860   NtOpenKey  (0x80000000, {24, -2147482740, 0x240, 0, 0,  (0x80000000, {24, -2147482740, 0x240, 0, 0, "Software\Policies\Microsoft\Control Panel\Desktop"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01741   860   NtOpenKey  (0x80000000, {24, -2147482740, 0x640, 0, 0,  (0x80000000, {24, -2147482740, 0x640, 0, 0, "Control Panel\Desktop"}, ... -2147481328, ) }, ... -2147481328, ) == 0x0
 01742   860   NtQueryValueKey  (-2147481328,  (-2147481328, "MultiUILanguageId", Partial, 256, ... ) , Partial, 256, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01743   860   NtClose  (-2147481328, ... ) == 0x0
 01744   860   NtClose  (-2147482740, ... ) == 0x0
 01734   860   NtQueryDefaultUILanguage  ... ) == 0x0
 01745   860   NtQueryInformationProcess  (-1, DefaultHardErrorMode, 4, ... {process info, class 12, size 4}, 0x0, ) == 0x0
 01746   860   NtSetInformationProcess  (-1, DefaultHardErrorMode, {process info, class 12, size 4}, 4, ... ) == 0x0
 01747   860   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\u:\work\packed.exe"}, 1232868, ... ) }, 1232868, ... ) == 0x0
 01748   860   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\u:\work\packed.exe"}, 1231640, ... ) }, 1231640, ... ) == 0x0
 01749   860   NtQueryInformationProcess  (-1, DefaultHardErrorMode, 4, ... {process info, class 12, size 4}, 0x0, ) == 0x0
 01750   860   NtSetInformationProcess  (-1, DefaultHardErrorMode, {process info, class 12, size 4}, 4, ... ) == 0x0
 01751   860   NtCreateFile  (0x10100080, {24, 0, 0x40, 0, 1233976,  (0x10100080, {24, 0, 0x40, 0, 1233976, "\??\C:\DOCUME~1\MARTIM~1\LOCALS~1\Temp\bd4_appcompat.txt"}, 0x0, 128, 0, 2, 96, 0, 0, ... }, 0x0, 128, 0, 2, 96, 0, 0, ...
 01752   860   NtQueryDirectoryFile  (-2147482740, 0, 0, 0, -519819264, 4096, Names, 1,  (-2147482740, 0, 0, 0, -519819264, 4096, Names, 1, "DOCUME~1", 1, ... {status=0x0, info=56}, ) , 1, ... {status=0x0, info=56}, ) == 0x0
 01753   860   NtClose  (-2147482740, ... ) == 0x0
 01754   860   NtQueryDirectoryFile  (-2147482740, 0, 0, 0, -519819264, 4096, Names, 1,  (-2147482740, 0, 0, 0, -519819264, 4096, Names, 1, "MARTIM~1", 1, ... {status=0x0, info=40}, ) , 1, ... {status=0x0, info=40}, ) == 0x0
 01755   860   NtClose  (-2147482740, ... ) == 0x0
 01756   860   NtQueryDirectoryFile  (-2147482740, 0, 0, 0, -519819264, 4096, Names, 1,  (-2147482740, 0, 0, 0, -519819264, 4096, Names, 1, "LOCALS~1", 1, ... {status=0x0, info=40}, ) , 1, ... {status=0x0, info=40}, ) == 0x0
 01757   860   NtClose  (-2147482740, ... ) == 0x0
 01751   860   NtCreateFile  ... 176, {status=0x0, info=2}, ) == 0x0
 01758   860   NtClose  (176, ... ) == 0x0
 01759   860   NtCreateSection  (0xf001f, 0x0, {4194304, 0}, 4, 67108864, 0, ... 176, ) == 0x0
 01760   860   NtMapViewOfSection  (176, -1, (0x0), 0, 0, 0x0, 4194304, 2, 0, 4, ... (0xac0000), 0x0, 4194304, ) == 0x0
 01761   860   NtAllocateVirtualMemory  (-1, 11272192, 0, 1, 4096, 4, ... 11272192, 4096, ) == 0x0
 01762   860   NtAllocateVirtualMemory  (-1, 11276288, 0, 2536, 4096, 4, ... 11276288, 4096, ) == 0x0
 01763   860   NtCreateSection  (0xf0007, 0x0, {24524, 0}, 4, 134217728, 0, ... 180, ) == 0x0
 01764   860   NtMapViewOfSection  (180, -1, (0x0), 0, 0, {0, 0}, 0, 1, 0, 4, ... (0x380000), {0, 0}, 24576, ) == 0x0
 01765   860   NtUnmapViewOfSection  (-1, 0x380000, ... ) == 0x0
 01766   860   NtMapViewOfSection  (180, -1, (0x0), 0, 0, {0, 0}, 0, 1, 0, 4, ... (0x380000), {0, 0}, 24576, ) == 0x0
 01767   860   NtClose  (176, ... ) == 0x0
 01768   860   NtUnmapViewOfSection  (-1, 0xac0000, ... ) == 0x0
 01769   860   NtUnmapViewOfSection  (-1, 0x380000, ... ) == 0x0
 01770   860   NtMapViewOfSection  (180, -1, (0x0), 0, 0, {0, 0}, 0, 1, 0, 4, ... (0x380000), {0, 0}, 24576, ) == 0x0
 01771   860   NtUnmapViewOfSection  (-1, 0x380000, ... ) == 0x0
 01772   860   NtMapViewOfSection  (180, -1, (0x0), 0, 0, {0, 0}, 0, 1, 0, 4, ... (0x380000), {0, 0}, 24576, ) == 0x0
 01773   860   NtUnmapViewOfSection  (-1, 0x380000, ... ) == 0x0
 01774   860   NtMapViewOfSection  (180, -1, (0x0), 0, 0, {0, 0}, 0, 1, 0, 4, ... (0x380000), {0, 0}, 24576, ) == 0x0
 01775   860   NtUnmapViewOfSection  (-1, 0x380000, ... ) == 0x0
 01776   860   NtMapViewOfSection  (180, -1, (0x0), 0, 0, {0, 0}, 0, 1, 0, 4, ... (0x380000), {0, 0}, 24576, ) == 0x0
 01777   860   NtUnmapViewOfSection  (-1, 0x380000, ... ) == 0x0
 01778   860   NtMapViewOfSection  (180, -1, (0x0), 0, 0, {0, 0}, 0, 1, 0, 4, ... (0x380000), {0, 0}, 24576, ) == 0x0
 01779   860   NtUnmapViewOfSection  (-1, 0x380000, ... ) == 0x0
 01780   860   NtMapViewOfSection  (180, -1, (0x0), 0, 0, {0, 0}, 0, 1, 0, 4, ... (0x380000), {0, 0}, 24576, ) == 0x0
 01781   860   NtUnmapViewOfSection  (-1, 0x380000, ... ) == 0x0
 01782   860   NtMapViewOfSection  (180, -1, (0x0), 0, 0, {0, 0}, 0, 1, 0, 4, ... (0x380000), {0, 0}, 24576, ) == 0x0
 01783   860   NtUnmapViewOfSection  (-1, 0x380000, ... ) == 0x0
 01784   860   NtMapViewOfSection  (180, -1, (0x0), 0, 0, {0, 0}, 0, 1, 0, 4, ... (0x380000), {0, 0}, 24576, ) == 0x0
 01785   860   NtUnmapViewOfSection  (-1, 0x380000, ... ) == 0x0
 01786   860   NtMapViewOfSection  (180, -1, (0x0), 0, 0, {0, 0}, 0, 1, 0, 4, ... (0x380000), {0, 0}, 24576, ) == 0x0
 01787   860   NtUnmapViewOfSection  (-1, 0x380000, ... ) == 0x0
 01788   860   NtMapViewOfSection  (180, -1, (0x0), 0, 0, {0, 0}, 0, 1, 0, 4, ... (0x380000), {0, 0}, 24576, ) == 0x0
 01789   860   NtUnmapViewOfSection  (-1, 0x380000, ... ) == 0x0
 01790   860   NtMapViewOfSection  (180, -1, (0x0), 0, 0, {0, 0}, 0, 1, 0, 4, ... (0x380000), {0, 0}, 24576, ) == 0x0
 01791   860   NtUnmapViewOfSection  (-1, 0x380000, ... ) == 0x0
 01792   860   NtMapViewOfSection  (180, -1, (0x0), 0, 0, {0, 0}, 0, 1, 0, 4, ... (0x380000), {0, 0}, 24576, ) == 0x0
 01793   860   NtUnmapViewOfSection  (-1, 0x380000, ... ) == 0x0
 01794   860   NtMapViewOfSection  (180, -1, (0x0), 0, 0, {0, 0}, 0, 1, 0, 4, ... (0x380000), {0, 0}, 24576, ) == 0x0
 01795   860   NtUnmapViewOfSection  (-1, 0x380000, ... ) == 0x0
 01796   860   NtMapViewOfSection  (180, -1, (0x0), 0, 0, {0, 0}, 0, 1, 0, 4, ... (0x380000), {0, 0}, 24576, ) == 0x0
 01797   860   NtUnmapViewOfSection  (-1, 0x380000, ... ) == 0x0
 01798   860   NtMapViewOfSection  (180, -1, (0x0), 0, 0, {0, 0}, 0, 1, 0, 4, ... (0x380000), {0, 0}, 24576, ) == 0x0
 01799   860   NtUnmapViewOfSection  (-1, 0x380000, ... ) == 0x0
 01800   860   NtMapViewOfSection  (180, -1, (0x0), 0, 0, {0, 0}, 0, 1, 0, 4, ... (0x380000), {0, 0}, 24576, ) == 0x0
 01801   860   NtUnmapViewOfSection  (-1, 0x380000, ... ) == 0x0
 01802   860   NtMapViewOfSection  (180, -1, (0x0), 0, 0, {0, 0}, 0, 1, 0, 4, ... (0x380000), {0, 0}, 24576, ) == 0x0
 01803   860   NtUnmapViewOfSection  (-1, 0x380000, ... ) == 0x0
 01804   860   NtMapViewOfSection  (180, -1, (0x0), 0, 0, {0, 0}, 0, 1, 0, 4, ... (0x380000), {0, 0}, 24576, ) == 0x0
 01805   860   NtUnmapViewOfSection  (-1, 0x380000, ... ) == 0x0
 01806   860   NtMapViewOfSection  (180, -1, (0x0), 0, 0, {0, 0}, 0, 1, 0, 4, ... (0x380000), {0, 0}, 24576, ) == 0x0
 01807   860   NtUnmapViewOfSection  (-1, 0x380000, ... ) == 0x0
 01808   860   NtMapViewOfSection  (180, -1, (0x0), 0, 0, {0, 0}, 0, 1, 0, 4, ... (0x380000), {0, 0}, 24576, ) == 0x0
 01809   860   NtUnmapViewOfSection  (-1, 0x380000, ... ) == 0x0
 01810   860   NtMapViewOfSection  (180, -1, (0x0), 0, 0, {0, 0}, 0, 1, 0, 4, ... (0x380000), {0, 0}, 24576, ) == 0x0
 01811   860   NtUnmapViewOfSection  (-1, 0x380000, ... ) == 0x0
 01812   860   NtMapViewOfSection  (180, -1, (0x0), 0, 0, {0, 0}, 0, 1, 0, 4, ... (0x380000), {0, 0}, 24576, ) == 0x0
 01813   860   NtUnmapViewOfSection  (-1, 0x380000, ... ) == 0x0
 01814   860   NtMapViewOfSection  (180, -1, (0x0), 0, 0, {0, 0}, 0, 1, 0, 4, ... (0x380000), {0, 0}, 24576, ) == 0x0
 01815   860   NtUnmapViewOfSection  (-1, 0x380000, ... ) == 0x0
 01816   860   NtMapViewOfSection  (180, -1, (0x0), 0, 0, {0, 0}, 0, 1, 0, 4, ... (0x380000), {0, 0}, 24576, ) == 0x0
 01817   860   NtUnmapViewOfSection  (-1, 0x380000, ... ) == 0x0
 01818   860   NtClose  (180, ... ) == 0x0
 01819   860   NtQueryInformationProcess  (-1, DeviceMap, 36, ... {process info, class 23, size 36}, 0x0, ) == 0x0
 01820   860   NtOpenFile  (0x100080, {24, 0, 0x40, 0, 0,  (0x100080, {24, 0, 0x40, 0, 0, "\??\u:"}, 3, 96, ... 180, {status=0x0, info=1}, ) }, 3, 96, ... 180, {status=0x0, info=1}, ) == 0x0
 01821   860   NtOpenSymbolicLinkObject  (0x1, {24, 0, 0x40, 0, 0,  (0x1, {24, 0, 0x40, 0, 0, "\??\u:"}, ... 176, ) }, ... 176, ) == 0x0
 01822   860   NtQuerySymbolicLinkObject  (176, ...  (176, ... "\Device\WinDfs\U:0000000000009f43", 66, ) , 66, ) == 0x0
 01823   860   NtClose  (176, ... ) == 0x0
 01824   860   NtQueryVolumeInformationFile  (180, 1233192, 8, Device, ... {status=0x0, info=8}, ) == 0x0
 01825   860   NtClose  (180, ... ) == 0x0
 01826   860   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\apphelp.dll"}, 1231988, ... ) }, 1231988, ... ) == 0x0
 01827   860   NtOpenFile  (0x100020, {24, 0, 0x40, 0, 0,  (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\apphelp.dll"}, 5, 96, ... 180, {status=0x0, info=1}, ) }, 5, 96, ... 180, {status=0x0, info=1}, ) == 0x0
 01828   860   NtCreateSection  (0xe, 0x0, 0x0, 16, 134217728, 180, ... 176, ) == 0x0
 01829   860   NtClose  (180, ... ) == 0x0
 01830   860   NtMapViewOfSection  (176, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 16, ... (0x380000), 0x0, 126976, ) == 0x0
 01831   860   NtClose  (176, ... ) == 0x0
 01832   860   NtUnmapViewOfSection  (-1, 0x380000, ... ) == 0x0
 01833   860   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\apphelp.dll"}, 1232296, ... ) }, 1232296, ... ) == 0x0
 01834   860   NtOpenFile  (0x100020, {24, 0, 0x40, 0, 0,  (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\apphelp.dll"}, 5, 96, ... 176, {status=0x0, info=1}, ) }, 5, 96, ... 176, {status=0x0, info=1}, ) == 0x0
 01835   860   NtCreateSection  (0xf, 0x0, 0x0, 16, 16777216, 176, ... 180, ) == 0x0
 01836   860   NtQuerySection  (180, Image, 48, ... {section info, class 1, size 48}, 0x0, ) == 0x0
 01837   860   NtClose  (176, ... ) == 0x0
 01838   860   NtMapViewOfSection  (180, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x77b40000), 0x0, 139264, ) == 0x0
 01839   860   NtClose  (180, ... ) == 0x0
 01840   860   NtProtectVirtualMemory  (-1, (0x77b41000), 524, 4, ... (0x77b41000), 4096, 32, ) == 0x0
 01841   860   NtProtectVirtualMemory  (-1, (0x77b41000), 4096, 32, ... (0x77b41000), 4096, 4, ) == 0x0
 01842   860   NtFlushInstructionCache  (-1, 2008289280, 524, ... ) == 0x0
 01843   860   NtOpenKey  (0x80000000, {24, 0, 0x40, 0, 0,  (0x80000000, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\apphelp.dll"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01844   860   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\u:\work\packed.exe"}, 1233684, ... ) }, 1233684, ... ) == 0x0
 01845   860   NtCreateFile  (0x40100080, {24, 0, 0x40, 0, 1233692,  (0x40100080, {24, 0, 0x40, 0, 1233692, "\??\C:\DOCUME~1\MARTIM~1\LOCALS~1\Temp\bd4_appcompat.txt"}, 0x0, 128, 0, 5, 96, 0, 0, ... }, 0x0, 128, 0, 5, 96, 0, 0, ...
 01846   860   NtClose  (-2147482740, ... ) == 0x0
 01847   860   NtQueryDirectoryFile  (-2147482740, 0, 0, 0, -519819264, 4096, Names, 1,  (-2147482740, 0, 0, 0, -519819264, 4096, Names, 1, "DOCUME~1", 1, ... {status=0x0, info=56}, ) , 1, ... {status=0x0, info=56}, ) == 0x0
 01848   860   NtClose  (-2147482740, ... ) == 0x0
 01849   860   NtQueryDirectoryFile  (-2147482740, 0, 0, 0, -519819264, 4096, Names, 1,  (-2147482740, 0, 0, 0, -519819264, 4096, Names, 1, "MARTIM~1", 1, ... {status=0x0, info=40}, ) , 1, ... {status=0x0, info=40}, ) == 0x0
 01850   860   NtClose  (-2147482740, ... ) == 0x0
 01851   860   NtQueryDirectoryFile  (-2147482740, 0, 0, 0, -519819264, 4096, Names, 1,  (-2147482740, 0, 0, 0, -519819264, 4096, Names, 1, "LOCALS~1", 1, ... {status=0x0, info=40}, ) , 1, ... {status=0x0, info=40}, ) == 0x0
 01852   860   NtClose  (-2147482740, ... ) == 0x0
 01845   860   NtCreateFile  ... 180, {status=0x0, info=3}, ) == 0x0
 01853   860   NtOpenFile  (0x100001, {24, 0, 0x40, 0, 0,  (0x100001, {24, 0, 0x40, 0, 0, "\??\u:\work\"}, 3, 16417, ... 176, {status=0x0, info=1}, ) }, 3, 16417, ... 176, {status=0x0, info=1}, ) == 0x0
 01854   860   NtQueryDirectoryFile  (176, 0, 0, 0, 1232396, 616, BothDirectory, 1,  (176, 0, 0, 0, 1232396, 616, BothDirectory, 1, "packed.exe", 0, ... {status=0x0, info=116}, ) , 0, ... {status=0x0, info=116}, ) == 0x0
 01855   860   NtWriteFile  (180, 0, 0, 0,  (180, 0, 0, 0, "\377\376", 2, 0x0, 0, ... {status=0x0, info=2}, ) , 2, 0x0, 0, ... {status=0x0, info=2}, ) == 0x0
 01856   860   NtWriteFile  (180, 0, 0, 0,  (180, 0, 0, 0, "<\0?\0x\0m\0l\0 \0v\0e\0r\0s\0i\0o\0n\0=\0"\01\0.\00\0"\0 \0e\0n\0c\0o\0d\0i\0n\0g\0=\0"\0U\0T\0F\0-\01\06\0"\0?\0>\0\15\0\12\0<\0D\0A\0T\0A\0B\0A\0S\0E\0>\0\15\0\12\0", 106, 0x0, 0, ... {status=0x0, info=106}, ) \01\0.\00\0 (180, 0, 0, 0, "<\0?\0x\0m\0l\0 \0v\0e\0r\0s\0i\0o\0n\0=\0"\01\0.\00\0"\0 \0e\0n\0c\0o\0d\0i\0n\0g\0=\0"\0U\0T\0F\0-\01\06\0"\0?\0>\0\15\0\12\0<\0D\0A\0T\0A\0B\0A\0S\0E\0>\0\15\0\12\0", 106, 0x0, 0, ... {status=0x0, info=106}, ) \0U\0T\0F\0-\01\06\0 (180, 0, 0, 0, "<\0?\0x\0m\0l\0 \0v\0e\0r\0s\0i\0o\0n\0=\0"\01\0.\00\0"\0 \0e\0n\0c\0o\0d\0i\0n\0g\0=\0"\0U\0T\0F\0-\01\06\0"\0?\0>\0\15\0\12\0<\0D\0A\0T\0A\0B\0A\0S\0E\0>\0\15\0\12\0", 106, 0x0, 0, ... {status=0x0, info=106}, ) , 106, 0x0, 0, ... {status=0x0, info=106}, ) == 0x0
 01857   860   NtWriteFile  (180, 0, 0, 0,  (180, 0, 0, 0, "<\0E\0X\0E\0 \0N\0A\0M\0E\0=\0"\0p\0a\0c\0k\0e\0d\0.\0e\0x\0e\0"\0 \0F\0I\0L\0T\0E\0R\0=\0"\0G\0R\0A\0B\0M\0I\0_\0F\0I\0L\0T\0E\0R\0_\0T\0H\0I\0S\0F\0I\0L\0E\0O\0N\0L\0Y\0"\0>\0\15\0\12\0", 122, 0x0, 0, ... {status=0x0, info=122}, ) \0p\0a\0c\0k\0e\0d\0.\0e\0x\0e\0 (180, 0, 0, 0, "<\0E\0X\0E\0 \0N\0A\0M\0E\0=\0"\0p\0a\0c\0k\0e\0d\0.\0e\0x\0e\0"\0 \0F\0I\0L\0T\0E\0R\0=\0"\0G\0R\0A\0B\0M\0I\0_\0F\0I\0L\0T\0E\0R\0_\0T\0H\0I\0S\0F\0I\0L\0E\0O\0N\0L\0Y\0"\0>\0\15\0\12\0", 122, 0x0, 0, ... {status=0x0, info=122}, ) \0G\0R\0A\0B\0M\0I\0_\0F\0I\0L\0T\0E\0R\0_\0T\0H\0I\0S\0F\0I\0L\0E\0O\0N\0L\0Y\0 (180, 0, 0, 0, "<\0E\0X\0E\0 \0N\0A\0M\0E\0=\0"\0p\0a\0c\0k\0e\0d\0.\0e\0x\0e\0"\0 \0F\0I\0L\0T\0E\0R\0=\0"\0G\0R\0A\0B\0M\0I\0_\0F\0I\0L\0T\0E\0R\0_\0T\0H\0I\0S\0F\0I\0L\0E\0O\0N\0L\0Y\0"\0>\0\15\0\12\0", 122, 0x0, 0, ... {status=0x0, info=122}, ) , 122, 0x0, 0, ... {status=0x0, info=122}, ) == 0x0
 01858   860   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\u:\work\packed.exe"}, 1232776, ... ) }, 1232776, ... ) == 0x0
 01859   860   NtOpenFile  (0x100001, {24, 0, 0x40, 0, 0,  (0x100001, {24, 0, 0x40, 0, 0, "\??\u:\work"}, 3, 16417, ... 184, {status=0x0, info=1}, ) }, 3, 16417, ... 184, {status=0x0, info=1}, ) == 0x0
 01860   860   NtQueryDirectoryFile  (184, 0, 0, 0, 1232388, 592, Directory, 1,  (184, 0, 0, 0, 1232388, 592, Directory, 1, "packed.exe", 0, ... {status=0x0, info=84}, ) , 0, ... {status=0x0, info=84}, ) == 0x0
 01861   860   NtClose  (184, ... ) == 0x0
 01862   860   NtQueryInformationProcess  (-1, DefaultHardErrorMode, 4, ... {process info, class 12, size 4}, 0x0, ) == 0x0
 01863   860   NtSetInformationProcess  (-1, DefaultHardErrorMode, {process info, class 12, size 4}, 4, ... ) == 0x0
 01864   860   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\u:\work\packed.exe"}, 1231308, ... ) }, 1231308, ... ) == 0x0
 01865   860   NtAllocateVirtualMemory  (-1, 1220608, 0, 4096, 4096, 260, ... 1220608, 4096, ) == 0x0
 01866   860   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\u:\work\packed.exe"}, 1230080, ... ) }, 1230080, ... ) == 0x0
 01867   860   NtQueryInformationProcess  (-1, DefaultHardErrorMode, 4, ... {process info, class 12, size 4}, 0x0, ) == 0x0
 01868   860   NtSetInformationProcess  (-1, DefaultHardErrorMode, {process info, class 12, size 4}, 4, ... ) == 0x0
 01869   860   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\U:\WORK\PACKED.EXE"}, 1232644, ... ) }, 1232644, ... ) == 0x0
 01870   860   NtOpenFile  (0x100100, {24, 0, 0x40, 0, 0,  (0x100100, {24, 0, 0x40, 0, 0, "\??\U:\WORK\PACKED.EXE"}, 7, 2113568, ... 184, {status=0x0, info=1}, ) }, 7, 2113568, ... 184, {status=0x0, info=1}, ) == 0x0
 01871   860   NtSetInformationFile  (184, 1232620, 40, Basic, ... ) == STATUS_ACCESS_DENIED
 01872   860   NtClose  (184, ... ) == 0x0
 01873   860   NtCreateFile  (0x80100080, {24, 0, 0x40, 0, 0,  (0x80100080, {24, 0, 0x40, 0, 0, "\??\u:\work\packed.exe"}, 0x0, 128, 1, 1, 96, 0, 0, ... 184, {status=0x0, info=1}, ) }, 0x0, 128, 1, 1, 96, 0, 0, ... 184, {status=0x0, info=1}, ) == 0x0
 01874   860   NtQueryInformationFile  (184, 1232864, 24, Standard, ... {status=0x0, info=24}, ) == 0x0
 01875   860   NtCreateSection  (0x4, 0x0, 0x0, 2, 134217728, 184, ... 188, ) == 0x0
 01876   860   NtMapViewOfSection  (188, -1, (0x0), 0, 0, 0x0, 0, 2, 0, 2, ... (0x970000), 0x0, 204800, ) == 0x0
 01877   860   NtUnmapViewOfSection  (-1, 0x970000, ... ) == 0x0
 01878   860   NtClose  (188, ... ) == 0x0
 01879   860   NtClose  (184, ... ) == 0x0
 01880   860   NtWriteFile  (180, 0, 0, 0,  (180, 0, 0, 0, " \0 \0 \0 \0<\0M\0A\0T\0C\0H\0I\0N\0G\0_\0F\0I\0L\0E\0 \0N\0A\0M\0E\0=\0"\0p\0a\0c\0k\0e\0d\0.\0e\0x\0e\0"\0 \0S\0I\0Z\0E\0=\0"\02\00\03\07\07\06\0"\0 \0C\0H\0E\0C\0K\0S\0U\0M\0=\0"\00\0x\0E\08\0A\0E\07\01\0B\06\0"\0 \0M\0O\0D\0U\0L\0E\0_\0T\0Y\0P\0E\0=\0"\0W\0I\0N\03\02\0"\0 \0P\0E\0_\0C\0H\0E\0C\0K\0S\0U\0M\0=\0"\00\0x\00\0"\0 \0L\0I\0N\0K\0E\0R\0_\0V\0E\0R\0S\0I\0O\0N\0=\0"\00\0x\00\0"\0 \0L\0I\0N\0K\0_\0D\0A\0T\0E\0=\0"\00\02\0/\02\00\0/\02\00\00\08\0 \00\06\0:\00\07\0:\05\03\0"\0 \0U\0P\0T\0O\0_\0L\0I\0N\0K\0_\0D\0A\0T\0E\0=\0"\00\02\0/\02\00\0/\02\00\00\08\0 \00\06\0:\00\07\0:\05\03\0"\0 \0/\0>\0\15\0\12\0", 410, 0x0, 0, ... \0p\0a\0c\0k\0e\0d\0.\0e\0x\0e\0 (180, 0, 0, 0, " \0 \0 \0 \0<\0M\0A\0T\0C\0H\0I\0N\0G\0_\0F\0I\0L\0E\0 \0N\0A\0M\0E\0=\0"\0p\0a\0c\0k\0e\0d\0.\0e\0x\0e\0"\0 \0S\0I\0Z\0E\0=\0"\02\00\03\07\07\06\0"\0 \0C\0H\0E\0C\0K\0S\0U\0M\0=\0"\00\0x\0E\08\0A\0E\07\01\0B\06\0"\0 \0M\0O\0D\0U\0L\0E\0_\0T\0Y\0P\0E\0=\0"\0W\0I\0N\03\02\0"\0 \0P\0E\0_\0C\0H\0E\0C\0K\0S\0U\0M\0=\0"\00\0x\00\0"\0 \0L\0I\0N\0K\0E\0R\0_\0V\0E\0R\0S\0I\0O\0N\0=\0"\00\0x\00\0"\0 \0L\0I\0N\0K\0_\0D\0A\0T\0E\0=\0"\00\02\0/\02\00\0/\02\00\00\08\0 \00\06\0:\00\07\0:\05\03\0"\0 \0U\0P\0T\0O\0_\0L\0I\0N\0K\0_\0D\0A\0T\0E\0=\0"\00\02\0/\02\00\0/\02\00\00\08\0 \00\06\0:\00\07\0:\05\03\0"\0 \0/\0>\0\15\0\12\0", 410, 0x0, 0, ... \02\00\03\07\07\06\0 (180, 0, 0, 0, " \0 \0 \0 \0<\0M\0A\0T\0C\0H\0I\0N\0G\0_\0F\0I\0L\0E\0 \0N\0A\0M\0E\0=\0"\0p\0a\0c\0k\0e\0d\0.\0e\0x\0e\0"\0 \0S\0I\0Z\0E\0=\0"\02\00\03\07\07\06\0"\0 \0C\0H\0E\0C\0K\0S\0U\0M\0=\0"\00\0x\0E\08\0A\0E\07\01\0B\06\0"\0 \0M\0O\0D\0U\0L\0E\0_\0T\0Y\0P\0E\0=\0"\0W\0I\0N\03\02\0"\0 \0P\0E\0_\0C\0H\0E\0C\0K\0S\0U\0M\0=\0"\00\0x\00\0"\0 \0L\0I\0N\0K\0E\0R\0_\0V\0E\0R\0S\0I\0O\0N\0=\0"\00\0x\00\0"\0 \0L\0I\0N\0K\0_\0D\0A\0T\0E\0=\0"\00\02\0/\02\00\0/\02\00\00\08\0 \00\06\0:\00\07\0:\05\03\0"\0 \0U\0P\0T\0O\0_\0L\0I\0N\0K\0_\0D\0A\0T\0E\0=\0"\00\02\0/\02\00\0/\02\00\00\08\0 \00\06\0:\00\07\0:\05\03\0"\0 \0/\0>\0\15\0\12\0", 410, 0x0, 0, ... \00\0x\0E\08\0A\0E\07\01\0B\06\0 (180, 0, 0, 0, " \0 \0 \0 \0<\0M\0A\0T\0C\0H\0I\0N\0G\0_\0F\0I\0L\0E\0 \0N\0A\0M\0E\0=\0"\0p\0a\0c\0k\0e\0d\0.\0e\0x\0e\0"\0 \0S\0I\0Z\0E\0=\0"\02\00\03\07\07\06\0"\0 \0C\0H\0E\0C\0K\0S\0U\0M\0=\0"\00\0x\0E\08\0A\0E\07\01\0B\06\0"\0 \0M\0O\0D\0U\0L\0E\0_\0T\0Y\0P\0E\0=\0"\0W\0I\0N\03\02\0"\0 \0P\0E\0_\0C\0H\0E\0C\0K\0S\0U\0M\0=\0"\00\0x\00\0"\0 \0L\0I\0N\0K\0E\0R\0_\0V\0E\0R\0S\0I\0O\0N\0=\0"\00\0x\00\0"\0 \0L\0I\0N\0K\0_\0D\0A\0T\0E\0=\0"\00\02\0/\02\00\0/\02\00\00\08\0 \00\06\0:\00\07\0:\05\03\0"\0 \0U\0P\0T\0O\0_\0L\0I\0N\0K\0_\0D\0A\0T\0E\0=\0"\00\02\0/\02\00\0/\02\00\00\08\0 \00\06\0:\00\07\0:\05\03\0"\0 \0/\0>\0\15\0\12\0", 410, 0x0, 0, ... \0W\0I\0N\03\02\0 (180, 0, 0, 0, " \0 \0 \0 \0<\0M\0A\0T\0C\0H\0I\0N\0G\0_\0F\0I\0L\0E\0 \0N\0A\0M\0E\0=\0"\0p\0a\0c\0k\0e\0d\0.\0e\0x\0e\0"\0 \0S\0I\0Z\0E\0=\0"\02\00\03\07\07\06\0"\0 \0C\0H\0E\0C\0K\0S\0U\0M\0=\0"\00\0x\0E\08\0A\0E\07\01\0B\06\0"\0 \0M\0O\0D\0U\0L\0E\0_\0T\0Y\0P\0E\0=\0"\0W\0I\0N\03\02\0"\0 \0P\0E\0_\0C\0H\0E\0C\0K\0S\0U\0M\0=\0"\00\0x\00\0"\0 \0L\0I\0N\0K\0E\0R\0_\0V\0E\0R\0S\0I\0O\0N\0=\0"\00\0x\00\0"\0 \0L\0I\0N\0K\0_\0D\0A\0T\0E\0=\0"\00\02\0/\02\00\0/\02\00\00\08\0 \00\06\0:\00\07\0:\05\03\0"\0 \0U\0P\0T\0O\0_\0L\0I\0N\0K\0_\0D\0A\0T\0E\0=\0"\00\02\0/\02\00\0/\02\00\00\08\0 \00\06\0:\00\07\0:\05\03\0"\0 \0/\0>\0\15\0\12\0", 410, 0x0, 0, ... \00\0x\00\0 (180, 0, 0, 0, " \0 \0 \0 \0<\0M\0A\0T\0C\0H\0I\0N\0G\0_\0F\0I\0L\0E\0 \0N\0A\0M\0E\0=\0"\0p\0a\0c\0k\0e\0d\0.\0e\0x\0e\0"\0 \0S\0I\0Z\0E\0=\0"\02\00\03\07\07\06\0"\0 \0C\0H\0E\0C\0K\0S\0U\0M\0=\0"\00\0x\0E\08\0A\0E\07\01\0B\06\0"\0 \0M\0O\0D\0U\0L\0E\0_\0T\0Y\0P\0E\0=\0"\0W\0I\0N\03\02\0"\0 \0P\0E\0_\0C\0H\0E\0C\0K\0S\0U\0M\0=\0"\00\0x\00\0"\0 \0L\0I\0N\0K\0E\0R\0_\0V\0E\0R\0S\0I\0O\0N\0=\0"\00\0x\00\0"\0 \0L\0I\0N\0K\0_\0D\0A\0T\0E\0=\0"\00\02\0/\02\00\0/\02\00\00\08\0 \00\06\0:\00\07\0:\05\03\0"\0 \0U\0P\0T\0O\0_\0L\0I\0N\0K\0_\0D\0A\0T\0E\0=\0"\00\02\0/\02\00\0/\02\00\00\08\0 \00\06\0:\00\07\0:\05\03\0"\0 \0/\0>\0\15\0\12\0", 410, 0x0, 0, ... \00\0x\00\0 (180, 0, 0, 0, " \0 \0 \0 \0<\0M\0A\0T\0C\0H\0I\0N\0G\0_\0F\0I\0L\0E\0 \0N\0A\0M\0E\0=\0"\0p\0a\0c\0k\0e\0d\0.\0e\0x\0e\0"\0 \0S\0I\0Z\0E\0=\0"\02\00\03\07\07\06\0"\0 \0C\0H\0E\0C\0K\0S\0U\0M\0=\0"\00\0x\0E\08\0A\0E\07\01\0B\06\0"\0 \0M\0O\0D\0U\0L\0E\0_\0T\0Y\0P\0E\0=\0"\0W\0I\0N\03\02\0"\0 \0P\0E\0_\0C\0H\0E\0C\0K\0S\0U\0M\0=\0"\00\0x\00\0"\0 \0L\0I\0N\0K\0E\0R\0_\0V\0E\0R\0S\0I\0O\0N\0=\0"\00\0x\00\0"\0 \0L\0I\0N\0K\0_\0D\0A\0T\0E\0=\0"\00\02\0/\02\00\0/\02\00\00\08\0 \00\06\0:\00\07\0:\05\03\0"\0 \0U\0P\0T\0O\0_\0L\0I\0N\0K\0_\0D\0A\0T\0E\0=\0"\00\02\0/\02\00\0/\02\00\00\08\0 \00\06\0:\00\07\0:\05\03\0"\0 \0/\0>\0\15\0\12\0", 410, 0x0, 0, ... \00\02\0/\02\00\0/\02\00\00\08\0 \00\06\0:\00\07\0:\05\03\0 (180, 0, 0, 0, " \0 \0 \0 \0<\0M\0A\0T\0C\0H\0I\0N\0G\0_\0F\0I\0L\0E\0 \0N\0A\0M\0E\0=\0"\0p\0a\0c\0k\0e\0d\0.\0e\0x\0e\0"\0 \0S\0I\0Z\0E\0=\0"\02\00\03\07\07\06\0"\0 \0C\0H\0E\0C\0K\0S\0U\0M\0=\0"\00\0x\0E\08\0A\0E\07\01\0B\06\0"\0 \0M\0O\0D\0U\0L\0E\0_\0T\0Y\0P\0E\0=\0"\0W\0I\0N\03\02\0"\0 \0P\0E\0_\0C\0H\0E\0C\0K\0S\0U\0M\0=\0"\00\0x\00\0"\0 \0L\0I\0N\0K\0E\0R\0_\0V\0E\0R\0S\0I\0O\0N\0=\0"\00\0x\00\0"\0 \0L\0I\0N\0K\0_\0D\0A\0T\0E\0=\0"\00\02\0/\02\00\0/\02\00\00\08\0 \00\06\0:\00\07\0:\05\03\0"\0 \0U\0P\0T\0O\0_\0L\0I\0N\0K\0_\0D\0A\0T\0E\0=\0"\00\02\0/\02\00\0/\02\00\00\08\0 \00\06\0:\00\07\0:\05\03\0"\0 \0/\0>\0\15\0\12\0", 410, 0x0, 0, ... \00\02\0/\02\00\0/\02\00\00\08\0 \00\06\0:\00\07\0:\05\03\0 (180, 0, 0, 0, " \0 \0 \0 \0<\0M\0A\0T\0C\0H\0I\0N\0G\0_\0F\0I\0L\0E\0 \0N\0A\0M\0E\0=\0"\0p\0a\0c\0k\0e\0d\0.\0e\0x\0e\0"\0 \0S\0I\0Z\0E\0=\0"\02\00\03\07\07\06\0"\0 \0C\0H\0E\0C\0K\0S\0U\0M\0=\0"\00\0x\0E\08\0A\0E\07\01\0B\06\0"\0 \0M\0O\0D\0U\0L\0E\0_\0T\0Y\0P\0E\0=\0"\0W\0I\0N\03\02\0"\0 \0P\0E\0_\0C\0H\0E\0C\0K\0S\0U\0M\0=\0"\00\0x\00\0"\0 \0L\0I\0N\0K\0E\0R\0_\0V\0E\0R\0S\0I\0O\0N\0=\0"\00\0x\00\0"\0 \0L\0I\0N\0K\0_\0D\0A\0T\0E\0=\0"\00\02\0/\02\00\0/\02\00\00\08\0 \00\06\0:\00\07\0:\05\03\0"\0 \0U\0P\0T\0O\0_\0L\0I\0N\0K\0_\0D\0A\0T\0E\0=\0"\00\02\0/\02\00\0/\02\00\00\08\0 \00\06\0:\00\07\0:\05\03\0"\0 \0/\0>\0\15\0\12\0", 410, 0x0, 0, ... , 410, 0x0, 0, ...
 01881   860   NtContinue  (-139612716, 0, ...
 01880   860   NtWriteFile  ... {status=0x0, info=410}, ) == 0x0
 01882   860   NtAllocateVirtualMemory  (-1, 1376256, 0, 8192, 4096, 4, ... 1376256, 8192, ) == 0x0
 01883   860   NtQueryDirectoryFile  (176, 0, 0, 0, 1376264, 4096, BothDirectory, 0, 0x0, 0, ... ) == STATUS_NO_MORE_FILES
 01884   860   NtClose  (176, ... ) == 0x0
 01885   860   NtWriteFile  (180, 0, 0, 0,  (180, 0, 0, 0, "<\0/\0E\0X\0E\0>\0\15\0\12\0", 16, 0x0, 0, ... {status=0x0, info=16}, ) , 16, 0x0, 0, ... {status=0x0, info=16}, ) == 0x0
 01886   860   NtClose  (180, ... ) == 0x0
 01887   860   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\kernel32.dll"}, 1233684, ... ) }, 1233684, ... ) == 0x0
 01888   860   NtCreateFile  (0x40100080, {24, 0, 0x40, 0, 1233692,  (0x40100080, {24, 0, 0x40, 0, 1233692, "\??\C:\DOCUME~1\MARTIM~1\LOCALS~1\Temp\bd4_appcompat.txt"}, 0x0, 128, 0, 3, 96, 0, 0, ... 180, {status=0x0, info=1}, ) }, 0x0, 128, 0, 3, 96, 0, 0, ... 180, {status=0x0, info=1}, ) == 0x0
 01889   860   NtQueryInformationFile  (180, 1233716, 24, Standard, ... {status=0x0, info=24}, ) == 0x0
 01890   860   NtSetInformationFile  (180, 1233748, 8, Position, ... {status=0x0, info=0}, ) == 0x0
 01891   860   NtOpenFile  (0x100001, {24, 0, 0x40, 0, 0,  (0x100001, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\"}, 3, 16417, ... 176, {status=0x0, info=1}, ) }, 3, 16417, ... 176, {status=0x0, info=1}, ) == 0x0
 01892   860   NtQueryDirectoryFile  (176, 0, 0, 0, 1232396, 616, BothDirectory, 1,  (176, 0, 0, 0, 1232396, 616, BothDirectory, 1, "kernel32.dll", 0, ... {status=0x0, info=118}, ) , 0, ... {status=0x0, info=118}, ) == 0x0
 01893   860   NtWriteFile  (180, 0, 0, 0,  (180, 0, 0, 0, "<\0E\0X\0E\0 \0N\0A\0M\0E\0=\0"\0k\0e\0r\0n\0e\0l\03\02\0.\0d\0l\0l\0"\0 \0F\0I\0L\0T\0E\0R\0=\0"\0G\0R\0A\0B\0M\0I\0_\0F\0I\0L\0T\0E\0R\0_\0T\0H\0I\0S\0F\0I\0L\0E\0O\0N\0L\0Y\0"\0>\0\15\0\12\0", 126, 0x0, 0, ... {status=0x0, info=126}, ) \0k\0e\0r\0n\0e\0l\03\02\0.\0d\0l\0l\0 (180, 0, 0, 0, "<\0E\0X\0E\0 \0N\0A\0M\0E\0=\0"\0k\0e\0r\0n\0e\0l\03\02\0.\0d\0l\0l\0"\0 \0F\0I\0L\0T\0E\0R\0=\0"\0G\0R\0A\0B\0M\0I\0_\0F\0I\0L\0T\0E\0R\0_\0T\0H\0I\0S\0F\0I\0L\0E\0O\0N\0L\0Y\0"\0>\0\15\0\12\0", 126, 0x0, 0, ... {status=0x0, info=126}, ) \0G\0R\0A\0B\0M\0I\0_\0F\0I\0L\0T\0E\0R\0_\0T\0H\0I\0S\0F\0I\0L\0E\0O\0N\0L\0Y\0 (180, 0, 0, 0, "<\0E\0X\0E\0 \0N\0A\0M\0E\0=\0"\0k\0e\0r\0n\0e\0l\03\02\0.\0d\0l\0l\0"\0 \0F\0I\0L\0T\0E\0R\0=\0"\0G\0R\0A\0B\0M\0I\0_\0F\0I\0L\0T\0E\0R\0_\0T\0H\0I\0S\0F\0I\0L\0E\0O\0N\0L\0Y\0"\0>\0\15\0\12\0", 126, 0x0, 0, ... {status=0x0, info=126}, ) , 126, 0x0, 0, ... {status=0x0, info=126}, ) == 0x0
 01894   860   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\kernel32.dll"}, 1232748, ... ) }, 1232748, ... ) == 0x0
 01895   860   NtOpenFile  (0x100001, {24, 0, 0x40, 0, 0,  (0x100001, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32"}, 3, 16417, ... 184, {status=0x0, info=1}, ) }, 3, 16417, ... 184, {status=0x0, info=1}, ) == 0x0
 01896   860   NtQueryDirectoryFile  (184, 0, 0, 0, 1232388, 592, Directory, 1,  (184, 0, 0, 0, 1232388, 592, Directory, 1, "kernel32.dll", 0, ... {status=0x0, info=88}, ) , 0, ... {status=0x0, info=88}, ) == 0x0
 01897   860   NtClose  (184, ... ) == 0x0
 01898   860   NtQueryInformationProcess  (-1, DefaultHardErrorMode, 4, ... {process info, class 12, size 4}, 0x0, ) == 0x0
 01899   860   NtSetInformationProcess  (-1, DefaultHardErrorMode, {process info, class 12, size 4}, 4, ... ) == 0x0
 01900   860   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\kernel32.dll"}, 1231308, ... ) }, 1231308, ... ) == 0x0
 01901   860   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\kernel32.dll"}, 1230080, ... ) }, 1230080, ... ) == 0x0
 01902   860   NtQueryInformationProcess  (-1, DefaultHardErrorMode, 4, ... {process info, class 12, size 4}, 0x0, ) == 0x0
 01903   860   NtSetInformationProcess  (-1, DefaultHardErrorMode, {process info, class 12, size 4}, 4, ... ) == 0x0
 01904   860   NtQueryDefaultLocale  (1, 1232268, ... ) == 0x0
 01905   860   NtQueryInformationProcess  (-1, DefaultHardErrorMode, 4, ... {process info, class 12, size 4}, 0x0, ) == 0x0
 01906   860   NtSetInformationProcess  (-1, DefaultHardErrorMode, {process info, class 12, size 4}, 4, ... ) == 0x0
 01907   860   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\kernel32.dll"}, 1231300, ... ) }, 1231300, ... ) == 0x0
 01908   860   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\kernel32.dll"}, 1230072, ... ) }, 1230072, ... ) == 0x0
 01909   860   NtQueryInformationProcess  (-1, DefaultHardErrorMode, 4, ... {process info, class 12, size 4}, 0x0, ) == 0x0
 01910   860   NtSetInformationProcess  (-1, DefaultHardErrorMode, {process info, class 12, size 4}, 4, ... ) == 0x0
 01911   860   NtQueryDefaultLocale  (1, 1232260, ... ) == 0x0
 01912   860   NtCreateFile  (0x80100080, {24, 0, 0x40, 0, 0,  (0x80100080, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\kernel32.dll"}, 0x0, 128, 1, 1, 96, 0, 0, ... 184, {status=0x0, info=1}, ) }, 0x0, 128, 1, 1, 96, 0, 0, ... 184, {status=0x0, info=1}, ) == 0x0
 01913   860   NtQueryInformationFile  (184, 1232864, 24, Standard, ... {status=0x0, info=24}, ) == 0x0
 01914   860   NtCreateSection  (0x4, 0x0, 0x0, 2, 134217728, 184, ... 188, ) == 0x0
 01915   860   NtMapViewOfSection  (188, -1, (0x0), 0, 0, 0x0, 0, 2, 0, 2, ... (0x970000), 0x0, 987136, ) == 0x0
 01916   860   NtUnmapViewOfSection  (-1, 0x970000, ... ) == 0x0
 01917   860   NtClose  (188, ... ) == 0x0
 01918   860   NtClose  (184, ... ) == 0x0
 01919   860   NtQueryDefaultUILanguage  (1232220, ...
 01920   860   NtOpenThreadTokenEx  (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN
 01921   860   NtOpenProcessTokenEx  (-1, 0x20008, 512, ... -2147482740, ) == 0x0
 01922   860   NtQueryInformationToken  (-2147482740, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0
 01923   860   NtClose  (-2147482740, ... ) == 0x0
 01924   860   NtOpenKey  (0x2000000, {24, 0, 0x640, 0, 0,  (0x2000000, {24, 0, 0x640, 0, 0, "\REGISTRY\USER\S-1-5-21-1292428093-1383384898-725345543-1003"}, ... -2147482740, ) }, ... -2147482740, ) == 0x0
 01925   860   NtOpenKey  (0x80000000, {24, -2147482740, 0x240, 0, 0,  (0x80000000, {24, -2147482740, 0x240, 0, 0, "Software\Policies\Microsoft\Control Panel\Desktop"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01926   860   NtOpenKey  (0x80000000, {24, -2147482740, 0x640, 0, 0,  (0x80000000, {24, -2147482740, 0x640, 0, 0, "Control Panel\Desktop"}, ... -2147481328, ) }, ... -2147481328, ) == 0x0
 01927   860   NtQueryValueKey  (-2147481328,  (-2147481328, "MultiUILanguageId", Partial, 256, ... ) , Partial, 256, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01928   860   NtClose  (-2147481328, ... ) == 0x0
 01929   860   NtClose  (-2147482740, ... ) == 0x0
 01919   860   NtQueryDefaultUILanguage  ... ) == 0x0
 01930   860   NtWriteFile  (180, 0, 0, 0,  (180, 0, 0, 0, " \0 \0 \0 \0<\0M\0A\0T\0C\0H\0I\0N\0G\0_\0F\0I\0L\0E\0 \0N\0A\0M\0E\0=\0"\0k\0e\0r\0n\0e\0l\03\02\0.\0d\0l\0l\0"\0 \0S\0I\0Z\0E\0=\0"\09\08\04\05\07\06\0"\0 \0C\0H\0E\0C\0K\0S\0U\0M\0=\0"\00\0x\0F\00\0B\03\03\01\0F\06\0"\0 \0B\0I\0N\0_\0F\0I\0L\0E\0_\0V\0E\0R\0S\0I\0O\0N\0=\0"\05\0.\01\0.\02\06\00\00\0.\03\01\01\09\0"\0 \0B\0I\0N\0_\0P\0R\0O\0D\0U\0C\0T\0_\0V\0E\0R\0S\0I\0O\0N\0=\0"\05\0.\01\0.\02\06\00\00\0.\03\01\01\09\0"\0 \0P\0R\0O\0D\0U\0C\0T\0_\0V\0E\0R\0S\0I\0O\0N\0=\0"\05\0.\01\0.\02\06\00\00\0.\03\01\01\09\0"\0 \0F\0I\0L\0E\0_\0D\0E\0S\0C\0R\0I\0P\0T\0I\0O\0N\0=\0"\0W\0i\0n\0d\0o\0w\0s\0 \0N\0T\0 \0B\0A\0S\0E\0 \0A\0P\0I\0 \0C\0l\0i\0e\0n\0t\0 \0D\0L\0L\0"\0 \0C\0O\0M\0P\0A\0N\0Y\0_\0N\0A\0M\0E\0=\0"\0M\0i\0c\0r\0o\0s\0o\0f\0t\0 \0", 1666, 0x0, 0, ... {status=0x0, info=1666}, ) \0k\0e\0r\0n\0e\0l\03\02\0.\0d\0l\0l\0 (180, 0, 0, 0, " \0 \0 \0 \0<\0M\0A\0T\0C\0H\0I\0N\0G\0_\0F\0I\0L\0E\0 \0N\0A\0M\0E\0=\0"\0k\0e\0r\0n\0e\0l\03\02\0.\0d\0l\0l\0"\0 \0S\0I\0Z\0E\0=\0"\09\08\04\05\07\06\0"\0 \0C\0H\0E\0C\0K\0S\0U\0M\0=\0"\00\0x\0F\00\0B\03\03\01\0F\06\0"\0 \0B\0I\0N\0_\0F\0I\0L\0E\0_\0V\0E\0R\0S\0I\0O\0N\0=\0"\05\0.\01\0.\02\06\00\00\0.\03\01\01\09\0"\0 \0B\0I\0N\0_\0P\0R\0O\0D\0U\0C\0T\0_\0V\0E\0R\0S\0I\0O\0N\0=\0"\05\0.\01\0.\02\06\00\00\0.\03\01\01\09\0"\0 \0P\0R\0O\0D\0U\0C\0T\0_\0V\0E\0R\0S\0I\0O\0N\0=\0"\05\0.\01\0.\02\06\00\00\0.\03\01\01\09\0"\0 \0F\0I\0L\0E\0_\0D\0E\0S\0C\0R\0I\0P\0T\0I\0O\0N\0=\0"\0W\0i\0n\0d\0o\0w\0s\0 \0N\0T\0 \0B\0A\0S\0E\0 \0A\0P\0I\0 \0C\0l\0i\0e\0n\0t\0 \0D\0L\0L\0"\0 \0C\0O\0M\0P\0A\0N\0Y\0_\0N\0A\0M\0E\0=\0"\0M\0i\0c\0r\0o\0s\0o\0f\0t\0 \0", 1666, 0x0, 0, ... {status=0x0, info=1666}, ) \09\08\04\05\07\06\0 (180, 0, 0, 0, " \0 \0 \0 \0<\0M\0A\0T\0C\0H\0I\0N\0G\0_\0F\0I\0L\0E\0 \0N\0A\0M\0E\0=\0"\0k\0e\0r\0n\0e\0l\03\02\0.\0d\0l\0l\0"\0 \0S\0I\0Z\0E\0=\0"\09\08\04\05\07\06\0"\0 \0C\0H\0E\0C\0K\0S\0U\0M\0=\0"\00\0x\0F\00\0B\03\03\01\0F\06\0"\0 \0B\0I\0N\0_\0F\0I\0L\0E\0_\0V\0E\0R\0S\0I\0O\0N\0=\0"\05\0.\01\0.\02\06\00\00\0.\03\01\01\09\0"\0 \0B\0I\0N\0_\0P\0R\0O\0D\0U\0C\0T\0_\0V\0E\0R\0S\0I\0O\0N\0=\0"\05\0.\01\0.\02\06\00\00\0.\03\01\01\09\0"\0 \0P\0R\0O\0D\0U\0C\0T\0_\0V\0E\0R\0S\0I\0O\0N\0=\0"\05\0.\01\0.\02\06\00\00\0.\03\01\01\09\0"\0 \0F\0I\0L\0E\0_\0D\0E\0S\0C\0R\0I\0P\0T\0I\0O\0N\0=\0"\0W\0i\0n\0d\0o\0w\0s\0 \0N\0T\0 \0B\0A\0S\0E\0 \0A\0P\0I\0 \0C\0l\0i\0e\0n\0t\0 \0D\0L\0L\0"\0 \0C\0O\0M\0P\0A\0N\0Y\0_\0N\0A\0M\0E\0=\0"\0M\0i\0c\0r\0o\0s\0o\0f\0t\0 \0", 1666, 0x0, 0, ... {status=0x0, info=1666}, ) \00\0x\0F\00\0B\03\03\01\0F\06\0 (180, 0, 0, 0, " \0 \0 \0 \0<\0M\0A\0T\0C\0H\0I\0N\0G\0_\0F\0I\0L\0E\0 \0N\0A\0M\0E\0=\0"\0k\0e\0r\0n\0e\0l\03\02\0.\0d\0l\0l\0"\0 \0S\0I\0Z\0E\0=\0"\09\08\04\05\07\06\0"\0 \0C\0H\0E\0C\0K\0S\0U\0M\0=\0"\00\0x\0F\00\0B\03\03\01\0F\06\0"\0 \0B\0I\0N\0_\0F\0I\0L\0E\0_\0V\0E\0R\0S\0I\0O\0N\0=\0"\05\0.\01\0.\02\06\00\00\0.\03\01\01\09\0"\0 \0B\0I\0N\0_\0P\0R\0O\0D\0U\0C\0T\0_\0V\0E\0R\0S\0I\0O\0N\0=\0"\05\0.\01\0.\02\06\00\00\0.\03\01\01\09\0"\0 \0P\0R\0O\0D\0U\0C\0T\0_\0V\0E\0R\0S\0I\0O\0N\0=\0"\05\0.\01\0.\02\06\00\00\0.\03\01\01\09\0"\0 \0F\0I\0L\0E\0_\0D\0E\0S\0C\0R\0I\0P\0T\0I\0O\0N\0=\0"\0W\0i\0n\0d\0o\0w\0s\0 \0N\0T\0 \0B\0A\0S\0E\0 \0A\0P\0I\0 \0C\0l\0i\0e\0n\0t\0 \0D\0L\0L\0"\0 \0C\0O\0M\0P\0A\0N\0Y\0_\0N\0A\0M\0E\0=\0"\0M\0i\0c\0r\0o\0s\0o\0f\0t\0 \0", 1666, 0x0, 0, ... {status=0x0, info=1666}, ) \05\0.\01\0.\02\06\00\00\0.\03\01\01\09\0 (180, 0, 0, 0, " \0 \0 \0 \0<\0M\0A\0T\0C\0H\0I\0N\0G\0_\0F\0I\0L\0E\0 \0N\0A\0M\0E\0=\0"\0k\0e\0r\0n\0e\0l\03\02\0.\0d\0l\0l\0"\0 \0S\0I\0Z\0E\0=\0"\09\08\04\05\07\06\0"\0 \0C\0H\0E\0C\0K\0S\0U\0M\0=\0"\00\0x\0F\00\0B\03\03\01\0F\06\0"\0 \0B\0I\0N\0_\0F\0I\0L\0E\0_\0V\0E\0R\0S\0I\0O\0N\0=\0"\05\0.\01\0.\02\06\00\00\0.\03\01\01\09\0"\0 \0B\0I\0N\0_\0P\0R\0O\0D\0U\0C\0T\0_\0V\0E\0R\0S\0I\0O\0N\0=\0"\05\0.\01\0.\02\06\00\00\0.\03\01\01\09\0"\0 \0P\0R\0O\0D\0U\0C\0T\0_\0V\0E\0R\0S\0I\0O\0N\0=\0"\05\0.\01\0.\02\06\00\00\0.\03\01\01\09\0"\0 \0F\0I\0L\0E\0_\0D\0E\0S\0C\0R\0I\0P\0T\0I\0O\0N\0=\0"\0W\0i\0n\0d\0o\0w\0s\0 \0N\0T\0 \0B\0A\0S\0E\0 \0A\0P\0I\0 \0C\0l\0i\0e\0n\0t\0 \0D\0L\0L\0"\0 \0C\0O\0M\0P\0A\0N\0Y\0_\0N\0A\0M\0E\0=\0"\0M\0i\0c\0r\0o\0s\0o\0f\0t\0 \0", 1666, 0x0, 0, ... {status=0x0, info=1666}, ) \05\0.\01\0.\02\06\00\00\0.\03\01\01\09\0 (180, 0, 0, 0, " \0 \0 \0 \0<\0M\0A\0T\0C\0H\0I\0N\0G\0_\0F\0I\0L\0E\0 \0N\0A\0M\0E\0=\0"\0k\0e\0r\0n\0e\0l\03\02\0.\0d\0l\0l\0"\0 \0S\0I\0Z\0E\0=\0"\09\08\04\05\07\06\0"\0 \0C\0H\0E\0C\0K\0S\0U\0M\0=\0"\00\0x\0F\00\0B\03\03\01\0F\06\0"\0 \0B\0I\0N\0_\0F\0I\0L\0E\0_\0V\0E\0R\0S\0I\0O\0N\0=\0"\05\0.\01\0.\02\06\00\00\0.\03\01\01\09\0"\0 \0B\0I\0N\0_\0P\0R\0O\0D\0U\0C\0T\0_\0V\0E\0R\0S\0I\0O\0N\0=\0"\05\0.\01\0.\02\06\00\00\0.\03\01\01\09\0"\0 \0P\0R\0O\0D\0U\0C\0T\0_\0V\0E\0R\0S\0I\0O\0N\0=\0"\05\0.\01\0.\02\06\00\00\0.\03\01\01\09\0"\0 \0F\0I\0L\0E\0_\0D\0E\0S\0C\0R\0I\0P\0T\0I\0O\0N\0=\0"\0W\0i\0n\0d\0o\0w\0s\0 \0N\0T\0 \0B\0A\0S\0E\0 \0A\0P\0I\0 \0C\0l\0i\0e\0n\0t\0 \0D\0L\0L\0"\0 \0C\0O\0M\0P\0A\0N\0Y\0_\0N\0A\0M\0E\0=\0"\0M\0i\0c\0r\0o\0s\0o\0f\0t\0 \0", 1666, 0x0, 0, ... {status=0x0, info=1666}, ) \05\0.\01\0.\02\06\00\00\0.\03\01\01\09\0 (180, 0, 0, 0, " \0 \0 \0 \0<\0M\0A\0T\0C\0H\0I\0N\0G\0_\0F\0I\0L\0E\0 \0N\0A\0M\0E\0=\0"\0k\0e\0r\0n\0e\0l\03\02\0.\0d\0l\0l\0"\0 \0S\0I\0Z\0E\0=\0"\09\08\04\05\07\06\0"\0 \0C\0H\0E\0C\0K\0S\0U\0M\0=\0"\00\0x\0F\00\0B\03\03\01\0F\06\0"\0 \0B\0I\0N\0_\0F\0I\0L\0E\0_\0V\0E\0R\0S\0I\0O\0N\0=\0"\05\0.\01\0.\02\06\00\00\0.\03\01\01\09\0"\0 \0B\0I\0N\0_\0P\0R\0O\0D\0U\0C\0T\0_\0V\0E\0R\0S\0I\0O\0N\0=\0"\05\0.\01\0.\02\06\00\00\0.\03\01\01\09\0"\0 \0P\0R\0O\0D\0U\0C\0T\0_\0V\0E\0R\0S\0I\0O\0N\0=\0"\05\0.\01\0.\02\06\00\00\0.\03\01\01\09\0"\0 \0F\0I\0L\0E\0_\0D\0E\0S\0C\0R\0I\0P\0T\0I\0O\0N\0=\0"\0W\0i\0n\0d\0o\0w\0s\0 \0N\0T\0 \0B\0A\0S\0E\0 \0A\0P\0I\0 \0C\0l\0i\0e\0n\0t\0 \0D\0L\0L\0"\0 \0C\0O\0M\0P\0A\0N\0Y\0_\0N\0A\0M\0E\0=\0"\0M\0i\0c\0r\0o\0s\0o\0f\0t\0 \0", 1666, 0x0, 0, ... {status=0x0, info=1666}, ) \0W\0i\0n\0d\0o\0w\0s\0 \0N\0T\0 \0B\0A\0S\0E\0 \0A\0P\0I\0 \0C\0l\0i\0e\0n\0t\0 \0D\0L\0L\0 (180, 0, 0, 0, " \0 \0 \0 \0<\0M\0A\0T\0C\0H\0I\0N\0G\0_\0F\0I\0L\0E\0 \0N\0A\0M\0E\0=\0"\0k\0e\0r\0n\0e\0l\03\02\0.\0d\0l\0l\0"\0 \0S\0I\0Z\0E\0=\0"\09\08\04\05\07\06\0"\0 \0C\0H\0E\0C\0K\0S\0U\0M\0=\0"\00\0x\0F\00\0B\03\03\01\0F\06\0"\0 \0B\0I\0N\0_\0F\0I\0L\0E\0_\0V\0E\0R\0S\0I\0O\0N\0=\0"\05\0.\01\0.\02\06\00\00\0.\03\01\01\09\0"\0 \0B\0I\0N\0_\0P\0R\0O\0D\0U\0C\0T\0_\0V\0E\0R\0S\0I\0O\0N\0=\0"\05\0.\01\0.\02\06\00\00\0.\03\01\01\09\0"\0 \0P\0R\0O\0D\0U\0C\0T\0_\0V\0E\0R\0S\0I\0O\0N\0=\0"\05\0.\01\0.\02\06\00\00\0.\03\01\01\09\0"\0 \0F\0I\0L\0E\0_\0D\0E\0S\0C\0R\0I\0P\0T\0I\0O\0N\0=\0"\0W\0i\0n\0d\0o\0w\0s\0 \0N\0T\0 \0B\0A\0S\0E\0 \0A\0P\0I\0 \0C\0l\0i\0e\0n\0t\0 \0D\0L\0L\0"\0 \0C\0O\0M\0P\0A\0N\0Y\0_\0N\0A\0M\0E\0=\0"\0M\0i\0c\0r\0o\0s\0o\0f\0t\0 \0", 1666, 0x0, 0, ... {status=0x0, info=1666}, ) \0M\0i\0c\0r\0o\0s\0o\0f\0t\0 \0", 1666, 0x0, 0, ... {status=0x0, info=1666}, ) == 0x0
 01931   860   NtQueryDirectoryFile  (176, 0, 0, 0, 1376264, 4096, BothDirectory, 0, 0x0, 0, ... ) == STATUS_NO_MORE_FILES
 01932   860   NtClose  (176, ... ) == 0x0
 01933   860   NtWriteFile  (180, 0, 0, 0,  (180, 0, 0, 0, "<\0/\0E\0X\0E\0>\0\15\0\12\0<\0/\0D\0A\0T\0A\0B\0A\0S\0E\0>\0\15\0\12\0", 42, 0x0, 0, ... {status=0x0, info=42}, ) , 42, 0x0, 0, ... {status=0x0, info=42}, ) == 0x0
 01934   860   NtClose  (180, ... ) == 0x0
 01935   860   NtUnmapViewOfSection  (-1, 0x77b40000, ... ) == 0x0
 01936   860   NtQueryInformationJobObject  (0, BasicUIRestrictions, 4, ... ) == STATUS_ACCESS_DENIED
 01937   860   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\dwwin.exe"}, 1230956, ... ) }, 1230956, ... ) == 0x0
 01938   860   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\dwwin.exe"}, 1231692, ... ) }, 1231692, ... ) == 0x0
 01939   860   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\SYSTEM32\DWWIN.EXE"}, 1231608, ... ) }, 1231608, ... ) == 0x0
 01940   860   NtOpenFile  (0x100100, {24, 0, 0x40, 0, 0,  (0x100100, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\SYSTEM32\DWWIN.EXE"}, 7, 2113568, ... 180, {status=0x0, info=1}, ) }, 7, 2113568, ... 180, {status=0x0, info=1}, ) == 0x0
 01941   860   NtSetInformationFile  (180, 1231584, 40, Basic, ... {status=0x0, info=0}, ) == 0x0
 01942   860   NtClose  (180, ... ) == 0x0
 01943   860   NtCreateFile  (0xc0100080, {24, 0, 0x40, 0, 1231592,  (0xc0100080, {24, 0, 0x40, 0, 1231592, "\??\C:\WINDOWS\SYSTEM32\DWWIN.EXE"}, 0x0, 0, 1, 1, 96, 0, 0, ... 180, {status=0x0, info=1}, ) }, 0x0, 0, 1, 1, 96, 0, 0, ... 180, {status=0x0, info=1}, ) == 0x0
 01944   860   NtQueryInformationFile  (180, 1231644, 40, Basic, ... {status=0x0, info=40}, ) == 0x0
 01945   860   NtQueryInformationFile  (180, 1231644, 24, Standard, ... {status=0x0, info=24}, ) == 0x0
 01946   860   NtCreateSection  (0xf0007, 0x0, {180224, 0}, 4, 134217728, 180, ...
 01947   860   NtQueryVolumeInformationFile  (-2147482740, -139611280, 32, FullSize, ... {status=0x0, info=32}, ) == 0x0
 01948   860   NtQueryInformationFile  (-2147482740, -139611212, 24, Standard, ... {status=0x0, info=24}, ) == 0x0
 01949   860   NtQueryInformationFile  (-2147482740, -139611188, 40, Basic, ... {status=0x0, info=40}, ) == 0x0
 01950   860   NtQueryInformationFile  (-2147482740, -519819264, 4096, Stream, ... {status=0x0, info=38}, ) == 0x0
 01951   860   NtQueryInformationFile  (-2147482740, -139611356, 40, Basic, ... {status=0x0, info=40}, ) == 0x0
 01952   860   NtQueryInformationFile  (-2147481328, -139611396, 40, Basic, ... {status=0x0, info=40}, ) == 0x0
 01953   860   NtSetInformationFile  (-2147481328, -139611316, 8, EndOfFile, ... {status=0x0, info=0}, ) == 0x0
 01954   860   NtCreateSection  (0x5, {24, 0, 0x200, 0, 0, 0x0}, {180224, 0}, 2, 134217728, -2147482740, ... -2147482584, ) == 0x0
 01955   860   NtMapViewOfSection  (-2147482584, -1, (0x0), 0, 0, {0, 0}, 65536, 2, 0, 2, ... (0x380000), {0, 0}, 65536, ) == 0x0
 01956   860   NtWriteFile  (-2147481328, 0, 0, 0,  (-2147481328, 0, 0, 0, "MZ\220\0\3\0\0\0\4\0\0\0\377\377\0\0\270\0\0\0\0\0\0\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\360\0\0\0\16\37\272\16\0\264\11\315!\270\1L\315!This program cannot be run in DOS mode.\15\15\12$\0\0\0\0\0\0\0$\206\244\23`\347\312@`\347\312@`\347\312@9\304\331@b\347\312@`\347\313@d\347\312@\210\370\301@a\347\312@\343\373\304@j\347\312@\210\370\300@I\347\312@6\370\331@h\347\312@\272\304\326@i\347\312@\220\370\301@p\347\312@`\347\312@H\346\312@Rich`\347\312@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0PE\0\0L\1\3\0N\23\216?\0\0\0\0\0\0\0\0\340\0\17\1\13\1\6\24\0\220\2\0\0\240\0\0\0\0\0\0\232t\0\0\0\20\0\0\0\320\3\0\0\0\00\0\20\0\0\0\20\0\0\4\0\0\0\0\0\0\0\4\0\0\0\0\0\0\0\0@\3\0\0\20\0\0\237*\3\0\2\0\0\0\0\0\20\0\0\20\0\0\0\0\20\0\0\20\0\0\0\0\0\0\20\0\0\0\0\0\0\0\0\0\0\0\327\211\2\0z\1\0\0\00\3\0\244\12\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0Z\236\2\08\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0`\2\0\0\370\0\0\0\0\20\0\0\270\3\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0.text\0\0\0\222\216\2\0", 65536, {0, 0}, 0, ... {status=0x0, info=65536}, ) , 65536, {0, 0}, 0, ... {status=0x0, info=65536}, ) == 0x0
 01957   860   NtUnmapViewOfSection  (-1, 0x380000, ... ) == 0x0
 01958   860   NtMapViewOfSection  (-2147482584, -1, (0x0), 0, 0, {65536, 0}, 65536, 2, 0, 2, ... (0x380000), {65536, 0}, 65536, ) == 0x0
 01959   860   NtWriteFile  (-2147481328, 0, 0, 0,  (-2147481328, 0, 0, 0, "0\0Vt\13\377u\10\377\25\354\20\00\353d\276\4\1\0\0\215\205\374\376\377\377VP\377\25\220\21\00\205\300tKW\377u\10\350\200V\1\0\213\370\215\205\374\376\377\377P\350rV\1\0\215D\7\2_;\306\177+\215\205\374\376\377\377VPh\360\377\00\3506\363\377\377\215\205\374\376\377\377VP\377u\10\350&\363\377\377\215\205\374\376\377\377P\353\2263\300^\311\302\4\0\241\30\254\20\205\300t\13\5\270\0\0\0f\2038\0u\33\300\303P\350\200\353\377\377f\2038\t\4j\1X\303VW\277\4\1\0\0\276(\255\20W\203\300\2VP\350\301U\1\0Wh$\254\20V\350K\334\377\377j\1X_^\303\241\30\254\20j\1\377p$\377\25\240\20\00\205\300t\21\241\30\254\20\377p,\377p$\377\25\320\20\003\300\302\4\0j\0j\0h\311\0\10\350p\376\377\377\205\300t\14h\270\13\0\0P\377\25\240\20\00\303U\213\354\203\354\SVW3\3663\300\215}\354\211u\350h\240\17\0\0\253\253\253\241\30\254\20\211u\374\377p$\377\25\240\20\0095\364\352\20\17\204\217\0\0\0j\203\3009u\10Y\215}\250\307E\244D\0\0\0\363\253t@VVj\377\213\35\210\20\00\377u\10V\3775\314\352\20\377\323\213\370G\215\4?P\215E\374P\350%C\1\0\205\300\17\204\345\0\0\0W\377u\374j\377\377u\10V\3775\314\352\20\377\323\215E\350P\215E\244P\241\30\254\20VVh\0\0\0\4VVV\377u\374\5\270\0\0\0P\377\25\250\21\009u\374\213\370\17\204\216\0\0\0\377u\374\351\201\0\0\0j\203\300Y\215}\250\307E\244D\0\0\0V\363\253\241\30\254\20V\213\35\344", 65536, {65536, 0}, 0, ... {status=0x0, info=65536}, ) , 65536, {65536, 0}, 0, ... {status=0x0, info=65536}, ) == 0x0
 01960   860   NtUnmapViewOfSection  (-1, 0x380000, ... ) == 0x0
 01961   860   NtMapViewOfSection  (-2147482584, -1, (0x0), 0, 0, {131072, 0}, 49152, 2, 0, 2, ... (0x380000), {131072, 0}, 49152, ) == 0x0
 01962   860   NtWriteFile  (-2147481328, 0, 0, 0,  (-2147481328, 0, 0, 0, "\350N"\0\0\213\205L\377\377\377\213\345]\302\34\0U\213\354\203\354\20\350\353!\0\0\205\300u\73\300\351\364\0\0\0\213E\30P\213M\24Q\213U\20R\213E\14P\213M\10Q\377\25D!\30\205\300t\12\270\1\0\0\0\351\314\0\0\0\307E\370\0\0\0\0\213U\10\211U\360\213E\360\2018MDMPu\24\213M\360\213Q\4\201\342\377\377\0\0\201\372\223\247\0\0t\73\300\351\231\0\0\0\213E\360\213M\360\3H\14\211M\364\307E\374\0\0\0\0\353\11\213U\374\203\302\1\211U\374\213E\360\213M\374;H\10s\30\213U\374k\322\14\213E\364\213\14\20;M\14u\333\307E\370\1\0\0\0\203}\370\0u\43\300\353N\203}\20\0t\20\213U\374k\322\14\213E\364\3\302\213M\20\211\1\203}\24\0t\25\213U\374k\322\14\213E\364\213M\10\3L\20\10\213U\24\211\12\203}\30\0t\22\213E\374k\300\14\213M\30\213U\364\213D\2\4\211\1\270\1\0\0\0\213\345]\302\24\0U\213\354\213E\10Pj\10\377\25\10\21\00P\377\25\350\21\00]\302\4\0U\213\354\203}\10\0t\23\213E\10Pj\0\377\25\10\21\00P\377\25\20\22\00]\302\4\0U\213\354Q\213E\20\307\0\34\0\0\0\213M\20Q\213U\10R\377\25\34!\30\211E\374\203}\374\0t\13\213E\20\213H\14;M\14u\325\213E\374\213\345]\302\14\0U\213\354Q\213E\20\307\0\34\0\0\0\213M\20Q\213U\10R\377\25 !\30\211E\374\203}\374\0t\37\213E\20\213H\14;M\14t\24\213U\20R\213E\14P\213M\10Q\350\210\377\377\377\211E\374\213E\374\213\345]\302\14\0U\213\354\213E\14\307\0\15\0\0\0\213M\10\203\341\1\205\311t", 49152, {131072, 0}, 0, ... {status=0x0, info=49152}, ) \0\0\213\205L\377\377\377\213\345]\302\34\0U\213\354\203\354\20\350\353!\0\0\205\300u\73\300\351\364\0\0\0\213E\30P\213M\24Q\213U\20R\213E\14P\213M\10Q\377\25D!\30\205\300t\12\270\1\0\0\0\351\314\0\0\0\307E\370\0\0\0\0\213U\10\211U\360\213E\360\2018MDMPu\24\213M\360\213Q\4\201\342\377\377\0\0\201\372\223\247\0\0t\73\300\351\231\0\0\0\213E\360\213M\360\3H\14\211M\364\307E\374\0\0\0\0\353\11\213U\374\203\302\1\211U\374\213E\360\213M\374;H\10s\30\213U\374k\322\14\213E\364\213\14\20;M\14u\333\307E\370\1\0\0\0\203}\370\0u\43\300\353N\203}\20\0t\20\213U\374k\322\14\213E\364\3\302\213M\20\211\1\203}\24\0t\25\213U\374k\322\14\213E\364\213M\10\3L\20\10\213U\24\211\12\203}\30\0t\22\213E\374k\300\14\213M\30\213U\364\213D\2\4\211\1\270\1\0\0\0\213\345]\302\24\0U\213\354\213E\10Pj\10\377\25\10\21\00P\377\25\350\21\00]\302\4\0U\213\354\203}\10\0t\23\213E\10Pj\0\377\25\10\21\00P\377\25\20\22\00]\302\4\0U\213\354Q\213E\20\307\0\34\0\0\0\213M\20Q\213U\10R\377\25\34!\30\211E\374\203}\374\0t\13\213E\20\213H\14;M\14u\325\213E\374\213\345]\302\14\0U\213\354Q\213E\20\307\0\34\0\0\0\213M\20Q\213U\10R\377\25 !\30\211E\374\203}\374\0t\37\213E\20\213H\14;M\14t\24\213U\20R\213E\14P\213M\10Q\350\210\377\377\377\211E\374\213E\374\213\345]\302\14\0U\213\354\213E\14\307\0\15\0\0\0\213M\10\203\341\1\205\311t", 49152, {131072, 0}, 0, ... {status=0x0, info=49152}, ) == 0x0
 01963   860   NtUnmapViewOfSection  (-1, 0x380000, ... ) == 0x0
 01964   860   NtClose  (-2147482584, ... ) == 0x0
 01965   860   NtQueryVolumeInformationFile  (-2147482740, -139611020, 116, Attribute, ... {status=0x0, info=20}, ) == 0x0
 01966   860   NtSetInformationFile  (-2147481328, -139611188, 40, Basic, ... {status=0x0, info=0}, ) == 0x0
 01967   860   NtClose  (-2147481328, ... ) == 0x0
 01968   860   NtClose  (-2147482740, ... ) == 0x0
 01946   860   NtCreateSection  ... 176, ) == 0x0
 01969   860   NtMapViewOfSection  (176, -1, (0x0), 0, 0, {0, 0}, 0, 1, 0, 4, ... (0x3d0000), {0, 0}, 180224, ) == 0x0
 01970   860   NtUnmapViewOfSection  (-1, 0x3d0000, ... ) == 0x0
 01971   860   NtClose  (176, ... ) == 0x0
 01972   860   NtSetInformationFile  (180, 1231636, 40, Basic, ... {status=0x0, info=0}, ) == 0x0
 01973   860   NtClose  (180, ... ) == 0x0
 01974   860   NtOpenFile  (0x100100, {24, 0, 0x40, 0, 0,  (0x100100, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\SYSTEM32\DWWIN.EXE"}, 7, 2113568, ... 180, {status=0x0, info=1}, ) }, 7, 2113568, ... 180, {status=0x0, info=1}, ) == 0x0
 01975   860   NtSetInformationFile  (180, 1231576, 40, Basic, ... {status=0x0, info=0}, ) == 0x0
 01976   860   NtClose  (180, ... ) == 0x0
 01977   860   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\SYSTEM32\DWWIN.EXE"}, 1231600, ... ) }, 1231600, ... ) == 0x0
 01978   860   NtOpenFile  (0x100100, {24, 0, 0x40, 0, 0,  (0x100100, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\SYSTEM32\DWWIN.EXE"}, 7, 2113568, ... 180, {status=0x0, info=1}, ) }, 7, 2113568, ... 180, {status=0x0, info=1}, ) == 0x0
 01979   860   NtSetInformationFile  (180, 1231576, 40, Basic, ... {status=0x0, info=0}, ) == 0x0
 01980   860   NtClose  (180, ... ) == 0x0
 01981   860   NtCreateFile  (0xc0100080, {24, 0, 0x40, 0, 1231584,  (0xc0100080, {24, 0, 0x40, 0, 1231584, "\??\C:\WINDOWS\SYSTEM32\DWWIN.EXE"}, 0x0, 0, 1, 1, 96, 0, 0, ... 180, {status=0x0, info=1}, ) }, 0x0, 0, 1, 1, 96, 0, 0, ... 180, {status=0x0, info=1}, ) == 0x0
 01982   860   NtQueryInformationFile  (180, 1231636, 40, Basic, ... {status=0x0, info=40}, ) == 0x0
 01983   860   NtQueryInformationFile  (180, 1231636, 24, Standard, ... {status=0x0, info=24}, ) == 0x0
 01984   860   NtCreateSection  (0xf0007, 0x0, {192512, 0}, 4, 134217728, 180, ... 176, ) == 0x0
 01985   860   NtMapViewOfSection  (176, -1, (0x0), 0, 0, {0, 0}, 0, 1, 0, 4, ... (0x3d0000), {0, 0}, 192512, ) == 0x0
 01986   860   NtUnmapViewOfSection  (-1, 0x3d0000, ... ) == 0x0
 01987   860   NtClose  (176, ... ) == 0x0
 01988   860   NtSetInformationFile  (180, 1231648, 40, Basic, ... {status=0x0, info=0}, ) == 0x0
 01989   860   NtClose  (180, ... ) == 0x0
 01990   860   NtOpenFile  (0x100100, {24, 0, 0x40, 0, 0,  (0x100100, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\SYSTEM32\DWWIN.EXE"}, 7, 2113568, ... 180, {status=0x0, info=1}, ) }, 7, 2113568, ... 180, {status=0x0, info=1}, ) == 0x0
 01991   860   NtSetInformationFile  (180, 1231588, 40, Basic, ... {status=0x0, info=0}, ) == 0x0
 01992   860   NtClose  (180, ... ) == 0x0
 01993   860   NtOpenFile  (0x1000a1, {24, 0, 0x40, 0, 0,  (0x1000a1, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\dwwin.exe"}, 5, 96, ... 180, {status=0x0, info=1}, ) }, 5, 96, ... 180, {status=0x0, info=1}, ) == 0x0
 01994   860   NtCreateSection  (0xf001f, 0x0, 0x0, 16, 16777216, 180, ... 176, ) == 0x0
 01995   860   NtOpenKey  (0x1, {24, 0, 0x40, 0, 0,  (0x1, {24, 0, 0x40, 0, 0, "\Registry\MACHINE\System\CurrentControlSet\Control\Session Manager\AppCertDlls"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01996   860   NtOpenKey  (0x1, {24, 0, 0x40, 0, 0,  (0x1, {24, 0, 0x40, 0, 0, "\Registry\MACHINE\System\CurrentControlSet\Control\Session Manager\AppCompatibility"}, ... 184, ) }, ... 184, ) == 0x0
 01997   860   NtQueryValueKey  (184,  (184, "DisableAppCompat", Partial, 20, ... ) , Partial, 20, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01998   860   NtClose  (184, ... ) == 0x0
 01999   860   NtQueryVolumeInformationFile  (180, 1230968, 8, Device, ... {status=0x0, info=8}, ) == 0x0
 02000   860   NtOpenMutant  (0x120001, {24, 48, 0x0, 0, 0,  (0x120001, {24, 48, 0x0, 0, 0, "ShimCacheMutex"}, ... 184, ) }, ... 184, ) == 0x0
 02001   860   NtWaitForSingleObject  (184, 0, {-1000000, -1}, ... ) == 0x0
 02002   860   NtOpenSection  (0x2, {24, 48, 0x0, 0, 0,  (0x2, {24, 48, 0x0, 0, 0, "ShimSharedMemory"}, ... 188, ) }, ... 188, ) == 0x0
 02003   860   NtMapViewOfSection  (188, -1, (0x0), 0, 0, {0, 0}, 0, 1, 0, 4, ... (0x380000), {0, 0}, 57344, ) == 0x0
 02004   860   NtReleaseMutant  (184, ... 0x0, ) == 0x0
 02005   860   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\Apphelp.dll"}, 1228900, ... ) }, 1228900, ... ) == 0x0
 02006   860   NtOpenFile  (0x100020, {24, 0, 0x40, 0, 0,  (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\Apphelp.dll"}, 5, 96, ... 192, {status=0x0, info=1}, ) }, 5, 96, ... 192, {status=0x0, info=1}, ) == 0x0
 02007   860   NtCreateSection  (0xe, 0x0, 0x0, 16, 134217728, 192, ... 196, ) == 0x0
 02008   860   NtClose  (192, ... ) == 0x0
 02009   860   NtMapViewOfSection  (196, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 16, ... (0x3d0000), 0x0, 126976, ) == 0x0
 02010   860   NtClose  (196, ... ) == 0x0
 02011   860   NtUnmapViewOfSection  (-1, 0x3d0000, ... ) == 0x0
 02012   860   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\Apphelp.dll"}, 1229208, ... ) }, 1229208, ... ) == 0x0
 02013   860   NtOpenFile  (0x100020, {24, 0, 0x40, 0, 0,  (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\Apphelp.dll"}, 5, 96, ... 196, {status=0x0, info=1}, ) }, 5, 96, ... 196, {status=0x0, info=1}, ) == 0x0
 02014   860   NtCreateSection  (0xf, 0x0, 0x0, 16, 16777216, 196, ... 192, ) == 0x0
 02015   860   NtQuerySection  (192, Image, 48, ... {section info, class 1, size 48}, 0x0, ) == 0x0
 02016   860   NtClose  (196, ... ) == 0x0
 02017   860   NtMapViewOfSection  (192, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x77b40000), 0x0, 139264, ) == 0x0
 02018   860   NtClose  (192, ... ) == 0x0
 02019   860   NtProtectVirtualMemory  (-1, (0x77b41000), 524, 4, ... (0x77b41000), 4096, 32, ) == 0x0
 02020   860   NtProtectVirtualMemory  (-1, (0x77b41000), 4096, 32, ... (0x77b41000), 4096, 4, ) == 0x0
 02021   860   NtFlushInstructionCache  (-1, 2008289280, 524, ... ) == 0x0
 02022   860   NtOpenKey  (0x80000000, {24, 0, 0x40, 0, 0,  (0x80000000, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Apphelp.dll"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02023   860   NtCreateFile  (0x80100080, {24, 0, 0x40, 0, 0,  (0x80100080, {24, 0, 0x40, 0, 0, "\SystemRoot\AppPatch\sysmain.sdb"}, 0x0, 128, 1, 1, 96, 0, 0, ... 192, {status=0x0, info=1}, ) }, 0x0, 128, 1, 1, 96, 0, 0, ... 192, {status=0x0, info=1}, ) == 0x0
 02024   860   NtQueryInformationFile  (192, 1229224, 24, Standard, ... {status=0x0, info=24}, ) == 0x0
 02025   860   NtCreateSection  (0x4, 0x0, 0x0, 2, 134217728, 192, ... 196, ) == 0x0
 02026   860   NtMapViewOfSection  (196, -1, (0x0), 0, 0, 0x0, 0, 2, 0, 2, ... (0xac0000), 0x0, 1191936, ) == 0x0
 02027   860   NtQueryInformationFile  (192, 1229324, 24, Standard, ... {status=0x0, info=24}, ) == 0x0
 02028   860   NtCreateFile  (0x80100080, {24, 0, 0x40, 0, 0,  (0x80100080, {24, 0, 0x40, 0, 0, "\SystemRoot\AppPatch\systest.sdb"}, 0x0, 128, 1, 1, 96, 0, 0, ... ) }, 0x0, 128, 1, 1, 96, 0, 0, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02029   860   NtQuerySystemInformation  (Processor, 12, ... {system info, class 1, size 12}, 0x0, ) == 0x0
 02030   860   NtQueryInformationProcess  (-1, Wow64, 4, ... {process info, class 26, size 4}, 0x0, ) == 0x0
 02031   860   NtOpenKey  (0x101, {24, 0, 0x40, 0, 0,  (0x101, {24, 0, 0x40, 0, 0, "\Registry\Machine\System\WPA\TabletPC"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02032   860   NtOpenKey  (0x101, {24, 0, 0x40, 0, 0,  (0x101, {24, 0, 0x40, 0, 0, "\Registry\Machine\SYSTEM\WPA\MediaCenter"}, ... 200, ) }, ... 200, ) == 0x0
 02033   860   NtQueryValueKey  (200,  (200, "Installed", Partial, 256, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) , Partial, 256, ... TitleIdx=0, Type=4, Data= (200, "Installed", Partial, 256, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) }, 16, ) == 0x0
 02034   860   NtClose  (200, ... ) == 0x0
 02035   860   NtCreateFile  (0x120116, {24, 0, 0x40, 0, 0,  (0x120116, {24, 0, 0x40, 0, 0, "\Device\NamedPipe\ShimViewer"}, 0x0, 128, 0, 1, 0, 0, 0, ... ) }, 0x0, 128, 0, 1, 0, 0, 0, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02036   860   NtOpenFile  (0x100001, {24, 0, 0x40, 0, 0,  (0x100001, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\"}, 3, 16417, ... 200, {status=0x0, info=1}, ) }, 3, 16417, ... 200, {status=0x0, info=1}, ) == 0x0
 02037   860   NtQueryDirectoryFile  (200, 0, 0, 0, 1226920, 616, BothDirectory, 1,  (200, 0, 0, 0, 1226920, 616, BothDirectory, 1, "dwwin.exe", 0, ... {status=0x0, info=112}, ) , 0, ... {status=0x0, info=112}, ) == 0x0
 02038   860   NtClose  (200, ... ) == 0x0
 02039   860   NtQueryInformationProcess  (-1, DefaultHardErrorMode, 4, ... {process info, class 12, size 4}, 0x0, ) == 0x0
 02040   860   NtSetInformationProcess  (-1, DefaultHardErrorMode, {process info, class 12, size 4}, 4, ... ) == 0x0
 02041   860   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\dwwin.exe"}, 1227296, ... ) }, 1227296, ... ) == 0x0
 02042   860   NtOpenFile  (0x100001, {24, 0, 0x40, 0, 0,  (0x100001, {24, 0, 0x40, 0, 0, "\??\C:\"}, 3, 16417, ... 200, {status=0x0, info=1}, ) }, 3, 16417, ... 200, {status=0x0, info=1}, ) == 0x0
 02043   860   NtQueryDirectoryFile  (200, 0, 0, 0, 1226724, 616, BothDirectory, 1,  (200, 0, 0, 0, 1226724, 616, BothDirectory, 1, "WINDOWS", 0, ... {status=0x0, info=108}, ) , 0, ... {status=0x0, info=108}, ) == 0x0
 02044   860   NtClose  (200, ... ) == 0x0
 02045   860   NtOpenFile  (0x100001, {24, 0, 0x40, 0, 0,  (0x100001, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\"}, 3, 16417, ... 200, {status=0x0, info=1}, ) }, 3, 16417, ... 200, {status=0x0, info=1}, ) == 0x0
 02046   860   NtQueryDirectoryFile  (200, 0, 0, 0, 1226724, 616, BothDirectory, 1,  (200, 0, 0, 0, 1226724, 616, BothDirectory, 1, "system32", 0, ... {status=0x0, info=110}, ) , 0, ... {status=0x0, info=110}, ) == 0x0
 02047   860   NtClose  (200, ... ) == 0x0
 02048   860   NtOpenFile  (0x100001, {24, 0, 0x40, 0, 0,  (0x100001, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\"}, 3, 16417, ... 200, {status=0x0, info=1}, ) }, 3, 16417, ... 200, {status=0x0, info=1}, ) == 0x0
 02049   860   NtQueryDirectoryFile  (200, 0, 0, 0, 1226724, 616, BothDirectory, 1,  (200, 0, 0, 0, 1226724, 616, BothDirectory, 1, "dwwin.exe", 0, ... {status=0x0, info=112}, ) , 0, ... {status=0x0, info=112}, ) == 0x0
 02050   860   NtClose  (200, ... ) == 0x0
 02051   860   NtQueryInformationProcess  (-1, DefaultHardErrorMode, 4, ... {process info, class 12, size 4}, 0x0, ) == 0x0
 02052   860   NtSetInformationProcess  (-1, DefaultHardErrorMode, {process info, class 12, size 4}, 4, ... ) == 0x0
 02053   860   NtQueryInformationProcess  (-1, DeviceMap, 36, ... {process info, class 23, size 36}, 0x0, ) == 0x0
 02054   860   NtOpenKey  (0x80000100, {24, 0, 0x40, 0, 0,  (0x80000100, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Layers"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02055   860   NtOpenThreadTokenEx  (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN
 02056   860   NtOpenProcessTokenEx  (-1, 0x20008, 512, ... 200, ) == 0x0
 02057   860   NtQueryInformationToken  (200, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0
 02058   860   NtClose  (200, ... ) == 0x0
 02059   860   NtOpenKey  (0x80000100, {24, 0, 0x40, 0, 0,  (0x80000100, {24, 0, 0x40, 0, 0, "\REGISTRY\USER\S-1-5-21-1292428093-1383384898-725345543-1003\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Layers"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02060   860   NtOpenKey  (0x80000100, {24, 0, 0x40, 0, 0,  (0x80000100, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Custom\dwwin.exe"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02061   860   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\dwwin.exe"}, 1228128, ... ) }, 1228128, ... ) == 0x0
 02062   860   NtQueryInformationProcess  (-1, DefaultHardErrorMode, 4, ... {process info, class 12, size 4}, 0x0, ) == 0x0
 02063   860   NtSetInformationProcess  (-1, DefaultHardErrorMode, {process info, class 12, size 4}, 4, ... ) == 0x0
 02064   860   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\dwwin.exe"}, 1226996, ... ) }, 1226996, ... ) == 0x0
 02065   860   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\SYSTEM32\DWWIN.EXE"}, 1226988, ... ) }, 1226988, ... ) == 0x0
 02066   860   NtOpenFile  (0x100100, {24, 0, 0x40, 0, 0,  (0x100100, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\SYSTEM32\DWWIN.EXE"}, 7, 2113568, ... 200, {status=0x0, info=1}, ) }, 7, 2113568, ... 200, {status=0x0, info=1}, ) == 0x0
 02067   860   NtSetInformationFile  (200, 1226964, 40, Basic, ... {status=0x0, info=0}, ) == 0x0
 02068   860   NtClose  (200, ... ) == 0x0
 02069   860   NtCreateFile  (0xc0100080, {24, 0, 0x40, 0, 1226972,  (0xc0100080, {24, 0, 0x40, 0, 1226972, "\??\C:\WINDOWS\SYSTEM32\DWWIN.EXE"}, 0x0, 0, 1, 1, 96, 0, 0, ... ) }, 0x0, 0, 1, 1, 96, 0, 0, ... ) == STATUS_SHARING_VIOLATION
 02070   860   NtOpenFile  (0x100100, {24, 0, 0x40, 0, 0,  (0x100100, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\SYSTEM32\DWWIN.EXE"}, 7, 2113568, ... 200, {status=0x0, info=1}, ) }, 7, 2113568, ... 200, {status=0x0, info=1}, ) == 0x0
 02071   860   NtSetInformationFile  (200, 1226964, 40, Basic, ... {status=0x0, info=0}, ) == 0x0
 02072   860   NtClose  (200, ... ) == 0x0
 02073   860   NtOpenFile  (0x100020, {24, 0, 0x40, 0, 0,  (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\dwwin.exe"}, 5, 96, ... 200, {status=0x0, info=1}, ) }, 5, 96, ... 200, {status=0x0, info=1}, ) == 0x0
 02074   860   NtCreateSection  (0xe, 0x0, 0x0, 16, 134217728, 200, ... 204, ) == 0x0
 02075   860   NtClose  (200, ... ) == 0x0
 02076   860   NtMapViewOfSection  (204, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 16, ... (0x3d0000), 0x0, 192512, ) == 0x0
 02077   860   NtClose  (204, ... ) == 0x0
 02078   860   NtUnmapViewOfSection  (-1, 0x3d0000, ... ) == 0x0
 02079   860   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\dwwin.exe"}, 1226592, ... ) }, 1226592, ... ) == 0x0
 02080   860   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\SYSTEM32\DWWIN.EXE"}, 1227088, ... ) }, 1227088, ... ) == 0x0
 02081   860   NtOpenFile  (0x100100, {24, 0, 0x40, 0, 0,  (0x100100, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\SYSTEM32\DWWIN.EXE"}, 7, 2113568, ... 204, {status=0x0, info=1}, ) }, 7, 2113568, ... 204, {status=0x0, info=1}, ) == 0x0
 02082   860   NtSetInformationFile  (204, 1227064, 40, Basic, ... {status=0x0, info=0}, ) == 0x0
 02083   860   NtClose  (204, ... ) == 0x0
 02084   860   NtCreateFile  (0xc0100080, {24, 0, 0x40, 0, 1227072,  (0xc0100080, {24, 0, 0x40, 0, 1227072, "\??\C:\WINDOWS\SYSTEM32\DWWIN.EXE"}, 0x0, 0, 1, 1, 96, 0, 0, ... ) }, 0x0, 0, 1, 1, 96, 0, 0, ... ) == STATUS_SHARING_VIOLATION
 02085   860   NtOpenFile  (0x100100, {24, 0, 0x40, 0, 0,  (0x100100, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\SYSTEM32\DWWIN.EXE"}, 7, 2113568, ... 204, {status=0x0, info=1}, ) }, 7, 2113568, ... 204, {status=0x0, info=1}, ) == 0x0
 02086   860   NtSetInformationFile  (204, 1227064, 40, Basic, ... {status=0x0, info=0}, ) == 0x0
 02087   860   NtClose  (204, ... ) == 0x0
 02088   860   NtCreateFile  (0x80100080, {24, 0, 0x40, 0, 1227336,  (0x80100080, {24, 0, 0x40, 0, 1227336, "\??\C:\WINDOWS\system32\dwwin.exe"}, 0x0, 0, 5, 1, 96, 0, 0, ... 204, {status=0x0, info=1}, ) }, 0x0, 0, 5, 1, 96, 0, 0, ... 204, {status=0x0, info=1}, ) == 0x0
 02089   860   NtCreateSection  (0xf0005, 0x0, 0x0, 2, 134217728, 204, ... 200, ) == 0x0
 02090   860   NtClose  (204, ... ) == 0x0
 02091   860   NtMapViewOfSection  (200, -1, (0x0), 0, 0, {0, 0}, 0, 1, 0, 2, ... (0x3d0000), {0, 0}, 192512, ) == 0x0
 02092   860   NtClose  (200, ... ) == 0x0
 02093   860   NtAllocateVirtualMemory  (-1, 1216512, 0, 4096, 4096, 260, ... 1216512, 4096, ) == 0x0
 02094   860   NtQueryInformationProcess  (-1, DefaultHardErrorMode, 4, ... {process info, class 12, size 4}, 0x0, ) == 0x0
 02095   860   NtSetInformationProcess  (-1, DefaultHardErrorMode, {process info, class 12, size 4}, 4, ... ) == 0x0
 02096   860   NtQueryDefaultLocale  (1, 1227956, ... ) == 0x0
 02097   860   NtQueryVirtualMemory  (-1, 0x3d0000, Basic, 28, ... {BaseAddress=0x3d0000,AllocationBase=0x3d0000,AllocationProtect=0x2,RegionSize=0x2f000,State=0x1000,Protect=0x2,Type=0x40000,}, 0x0, ) == 0x0
 02098   860   NtQueryVirtualMemory  (-1, 0x3d0000, Basic, 28, ... {BaseAddress=0x3d0000,AllocationBase=0x3d0000,AllocationProtect=0x2,RegionSize=0x2f000,State=0x1000,Protect=0x2,Type=0x40000,}, 0x0, ) == 0x0
 02099   860   NtUnmapViewOfSection  (-1, 0x3d0000, ... ) == 0x0
 02100   860   NtQueryInformationProcess  (-1, DefaultHardErrorMode, 4, ... {process info, class 12, size 4}, 0x0, ) == 0x0
 02101   860   NtSetInformationProcess  (-1, DefaultHardErrorMode, {process info, class 12, size 4}, 4, ... ) == 0x0
 02102   860   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\dwwin.exe"}, 1226988, ... ) }, 1226988, ... ) == 0x0
 02103   860   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\SYSTEM32\DWWIN.EXE"}, 1226980, ... ) }, 1226980, ... ) == 0x0
 02104   860   NtOpenFile  (0x100100, {24, 0, 0x40, 0, 0,  (0x100100, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\SYSTEM32\DWWIN.EXE"}, 7, 2113568, ... 200, {status=0x0, info=1}, ) }, 7, 2113568, ... 200, {status=0x0, info=1}, ) == 0x0
 02105   860   NtSetInformationFile  (200, 1226956, 40, Basic, ... {status=0x0, info=0}, ) == 0x0
 02106   860   NtClose  (200, ... ) == 0x0
 02107   860   NtCreateFile  (0xc0100080, {24, 0, 0x40, 0, 1226964,  (0xc0100080, {24, 0, 0x40, 0, 1226964, "\??\C:\WINDOWS\SYSTEM32\DWWIN.EXE"}, 0x0, 0, 1, 1, 96, 0, 0, ... ) }, 0x0, 0, 1, 1, 96, 0, 0, ... ) == STATUS_SHARING_VIOLATION
 02108   860   NtOpenFile  (0x100100, {24, 0, 0x40, 0, 0,  (0x100100, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\SYSTEM32\DWWIN.EXE"}, 7, 2113568, ... 200, {status=0x0, info=1}, ) }, 7, 2113568, ... 200, {status=0x0, info=1}, ) == 0x0
 02109   860   NtSetInformationFile  (200, 1226956, 40, Basic, ... {status=0x0, info=0}, ) == 0x0
 02110   860   NtClose  (200, ... ) == 0x0
 02111   860   NtOpenFile  (0x100020, {24, 0, 0x40, 0, 0,  (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\dwwin.exe"}, 5, 96, ... 200, {status=0x0, info=1}, ) }, 5, 96, ... 200, {status=0x0, info=1}, ) == 0x0
 02112   860   NtCreateSection  (0xe, 0x0, 0x0, 16, 134217728, 200, ... 204, ) == 0x0
 02113   860   NtClose  (200, ... ) == 0x0
 02114   860   NtMapViewOfSection  (204, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 16, ... (0x3d0000), 0x0, 192512, ) == 0x0
 02115   860   NtClose  (204, ... ) == 0x0
 02116   860   NtUnmapViewOfSection  (-1, 0x3d0000, ... ) == 0x0
 02117   860   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\dwwin.exe"}, 1226584, ... ) }, 1226584, ... ) == 0x0
 02118   860   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\SYSTEM32\DWWIN.EXE"}, 1227080, ... ) }, 1227080, ... ) == 0x0
 02119   860   NtOpenFile  (0x100100, {24, 0, 0x40, 0, 0,  (0x100100, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\SYSTEM32\DWWIN.EXE"}, 7, 2113568, ... 204, {status=0x0, info=1}, ) }, 7, 2113568, ... 204, {status=0x0, info=1}, ) == 0x0
 02120   860   NtSetInformationFile  (204, 1227056, 40, Basic, ... {status=0x0, info=0}, ) == 0x0
 02121   860   NtClose  (204, ... ) == 0x0
 02122   860   NtCreateFile  (0xc0100080, {24, 0, 0x40, 0, 1227064,  (0xc0100080, {24, 0, 0x40, 0, 1227064, "\??\C:\WINDOWS\SYSTEM32\DWWIN.EXE"}, 0x0, 0, 1, 1, 96, 0, 0, ... ) }, 0x0, 0, 1, 1, 96, 0, 0, ... ) == STATUS_SHARING_VIOLATION
 02123   860   NtOpenFile  (0x100100, {24, 0, 0x40, 0, 0,  (0x100100, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\SYSTEM32\DWWIN.EXE"}, 7, 2113568, ... 204, {status=0x0, info=1}, ) }, 7, 2113568, ... 204, {status=0x0, info=1}, ) == 0x0
 02124   860   NtSetInformationFile  (204, 1227056, 40, Basic, ... {status=0x0, info=0}, ) == 0x0
 02125   860   NtClose  (204, ... ) == 0x0
 02126   860   NtCreateFile  (0x80100080, {24, 0, 0x40, 0, 1227328,  (0x80100080, {24, 0, 0x40, 0, 1227328, "\??\C:\WINDOWS\system32\dwwin.exe"}, 0x0, 0, 5, 1, 96, 0, 0, ... 204, {status=0x0, info=1}, ) }, 0x0, 0, 5, 1, 96, 0, 0, ... 204, {status=0x0, info=1}, ) == 0x0
 02127   860   NtCreateSection  (0xf0005, 0x0, 0x0, 2, 134217728, 204, ... 200, ) == 0x0
 02128   860   NtClose  (204, ... ) == 0x0
 02129   860   NtMapViewOfSection  (200, -1, (0x0), 0, 0, {0, 0}, 0, 1, 0, 2, ... (0x3d0000), {0, 0}, 192512, ) == 0x0
 02130   860   NtClose  (200, ... ) == 0x0
 02131   860   NtQueryInformationProcess  (-1, DefaultHardErrorMode, 4, ... {process info, class 12, size 4}, 0x0, ) == 0x0
 02132   860   NtSetInformationProcess  (-1, DefaultHardErrorMode, {process info, class 12, size 4}, 4, ... ) == 0x0
 02133   860   NtQueryDefaultLocale  (1, 1227948, ... ) == 0x0
 02134   860   NtQueryVirtualMemory  (-1, 0x3d0000, Basic, 28, ... {BaseAddress=0x3d0000,AllocationBase=0x3d0000,AllocationProtect=0x2,RegionSize=0x2f000,State=0x1000,Protect=0x2,Type=0x40000,}, 0x0, ) == 0x0
 02135   860   NtUnmapViewOfSection  (-1, 0x3d0000, ... ) == 0x0
 02136   860   NtOpenKey  (0x80000100, {24, 0, 0x40, 0, 0,  (0x80000100, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02137   860   NtOpenThreadTokenEx  (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN
 02138   860   NtOpenProcessTokenEx  (-1, 0x20008, 512, ... 200, ) == 0x0
 02139   860   NtQueryInformationToken  (200, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0
 02140   860   NtClose  (200, ... ) == 0x0
 02141   860   NtOpenKey  (0x80000100, {24, 0, 0x40, 0, 0,  (0x80000100, {24, 0, 0x40, 0, 0, "\REGISTRY\USER\S-1-5-21-1292428093-1383384898-725345543-1003\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02142   860   NtQueryInformationProcess  (-1, DefaultHardErrorMode, 4, ... {process info, class 12, size 4}, 0x0, ) == 0x0
 02143   860   NtSetInformationProcess  (-1, DefaultHardErrorMode, {process info, class 12, size 4}, 4, ... ) == 0x0
 02144   860   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\dwwin.exe"}, 1228548, ... ) }, 1228548, ... ) == 0x0
 02145   860   NtOpenFile  (0x100001, {24, 0, 0x40, 0, 0,  (0x100001, {24, 0, 0x40, 0, 0, "\??\C:\"}, 3, 16417, ... 200, {status=0x0, info=1}, ) }, 3, 16417, ... 200, {status=0x0, info=1}, ) == 0x0
 02146   860   NtQueryDirectoryFile  (200, 0, 0, 0, 1227976, 616, BothDirectory, 1,  (200, 0, 0, 0, 1227976, 616, BothDirectory, 1, "WINDOWS", 0, ... {status=0x0, info=108}, ) , 0, ... {status=0x0, info=108}, ) == 0x0
 02147   860   NtClose  (200, ... ) == 0x0
 02148   860   NtOpenFile  (0x100001, {24, 0, 0x40, 0, 0,  (0x100001, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\"}, 3, 16417, ... 200, {status=0x0, info=1}, ) }, 3, 16417, ... 200, {status=0x0, info=1}, ) == 0x0
 02149   860   NtQueryDirectoryFile  (200, 0, 0, 0, 1227976, 616, BothDirectory, 1,  (200, 0, 0, 0, 1227976, 616, BothDirectory, 1, "system32", 0, ... {status=0x0, info=110}, ) , 0, ... {status=0x0, info=110}, ) == 0x0
 02150   860   NtClose  (200, ... ) == 0x0
 02151   860   NtOpenFile  (0x100001, {24, 0, 0x40, 0, 0,  (0x100001, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\"}, 3, 16417, ... 200, {status=0x0, info=1}, ) }, 3, 16417, ... 200, {status=0x0, info=1}, ) == 0x0
 02152   860   NtQueryDirectoryFile  (200, 0, 0, 0, 1227976, 616, BothDirectory, 1,  (200, 0, 0, 0, 1227976, 616, BothDirectory, 1, "dwwin.exe", 0, ... {status=0x0, info=112}, ) , 0, ... {status=0x0, info=112}, ) == 0x0
 02153   860   NtClose  (200, ... ) == 0x0
 02154   860   NtQueryInformationProcess  (-1, DefaultHardErrorMode, 4, ... {process info, class 12, size 4}, 0x0, ) == 0x0
 02155   860   NtSetInformationProcess  (-1, DefaultHardErrorMode, {process info, class 12, size 4}, 4, ... ) == 0x0
 02156   860   NtWaitForSingleObject  (184, 0, {-1000000, -1}, ... ) == 0x0
 02157   860   NtReleaseMutant  (184, ... 0x0, ) == 0x0
 02158   860   NtUnmapViewOfSection  (-1, 0xac0000, ... ) == 0x0
 02159   860   NtClose  (196, ... ) == 0x0
 02160   860   NtClose  (192, ... ) == 0x0
 02161   860   NtOpenThreadToken  (-2, 0x2000000, 1, ... ) == STATUS_NO_TOKEN
 02162   860   NtOpenProcessToken  (-1, 0xa, ... 192, ) == 0x0
 02163   860   NtQueryInformationToken  (192, User, 136, ... {token info, class 1, size 36}, 36, ) == 0x0
 02164   860   NtOpenKey  (0x3, {24, 0, 0x40, 0, 0,  (0x3, {24, 0, 0x40, 0, 0, "\Registry\MACHINE\System\CurrentControlSet\Control\SafeBoot\Option"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02165   860   NtOpenKey  (0x1, {24, 0, 0x40, 0, 0,  (0x1, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers"}, ... 196, ) }, ... 196, ) == 0x0
 02166   860   NtQueryValueKey  (196,  (196, "TransparentEnabled", Partial, 80, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) , Partial, 80, ... TitleIdx=0, Type=4, Data= (196, "TransparentEnabled", Partial, 80, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) }, 16, ) == 0x0
 02167   860   NtQueryValueKey  (196,  (196, "AuthenticodeEnabled", Partial, 80, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) , Partial, 80, ... TitleIdx=0, Type=4, Data= (196, "AuthenticodeEnabled", Partial, 80, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) }, 16, ) == 0x0
 02168   860   NtClose  (196, ... ) == 0x0
 02169   860   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Policies\Microsoft\Windows\Safer\LevelObjects"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02170   860   NtOpenKey  (0x1, {24, 0, 0x40, 0, 0,  (0x1, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers"}, ... 196, ) }, ... 196, ) == 0x0
 02171   860   NtQueryValueKey  (196,  (196, "Levels", Partial, 536, ... ) , Partial, 536, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02172   860   NtClose  (196, ... ) == 0x0
 02173   860   NtQueryDefaultLocale  (1, 1230396, ... ) == 0x0
 02174   860   NtQueryDefaultLocale  (1, 1230396, ... ) == 0x0
 02175   860   NtQueryDefaultLocale  (1, 1230396, ... ) == 0x0
 02176   860   NtQueryDefaultLocale  (1, 1230396, ... ) == 0x0
 02177   860   NtQueryDefaultLocale  (1, 1230396, ... ) == 0x0
 02178   860   NtQueryDefaultLocale  (1, 1230396, ... ) == 0x0
 02179   860   NtQueryDefaultLocale  (1, 1230396, ... ) == 0x0
 02180   860   NtQueryDefaultLocale  (1, 1230396, ... ) == 0x0
 02181   860   NtQueryDefaultLocale  (1, 1230396, ... ) == 0x0
 02182   860   NtQueryDefaultLocale  (1, 1230396, ... ) == 0x0
 02183   860   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\0\Paths"}, ... 196, ) }, ... 196, ) == 0x0
 02184   860   NtEnumerateKey  (196, 0, Basic, 280, ... {LastWrite={0x3a5edea,0x1c74da9}, TitleIdx=0, Name= (196, 0, Basic, 280, ... {LastWrite={0x3a5edea,0x1c74da9}, TitleIdx=0, Name="{dda3f824-d8cb-441b-834d-be2efd2c1a33}"}, 92, ) }, 92, ) == 0x0
 02185   860   NtOpenKey  (0x20019, {24, 196, 0x40, 0, 0,  (0x20019, {24, 196, 0x40, 0, 0, "{dda3f824-d8cb-441b-834d-be2efd2c1a33}"}, ... 200, ) }, ... 200, ) == 0x0
 02186   860   NtQueryValueKey  (200,  (200, "ItemData", Partial, 280, ... TitleIdx=0, Type=2, Data="%\0H\0K\0E\0Y\0_\0C\0U\0R\0R\0E\0N\0T\0_\0U\0S\0E\0R\0\\0S\0o\0f\0t\0w\0a\0r\0e\0\\0M\0i\0c\0r\0o\0s\0o\0f\0t\0\\0W\0i\0n\0d\0o\0w\0s\0\\0C\0u\0r\0r\0e\0n\0t\0V\0e\0r\0s\0i\0o\0n\0\\0E\0x\0p\0l\0o\0r\0e\0r\0\\0S\0h\0e\0l\0l\0 \0F\0o\0l\0d\0e\0r\0s\0\\0C\0a\0c\0h\0e\0%\0O\0L\0K\0*\0\0\0"}, 202, ) , Partial, 280, ... TitleIdx=0, Type=2, Data= (200, "ItemData", Partial, 280, ... TitleIdx=0, Type=2, Data="%\0H\0K\0E\0Y\0_\0C\0U\0R\0R\0E\0N\0T\0_\0U\0S\0E\0R\0\\0S\0o\0f\0t\0w\0a\0r\0e\0\\0M\0i\0c\0r\0o\0s\0o\0f\0t\0\\0W\0i\0n\0d\0o\0w\0s\0\\0C\0u\0r\0r\0e\0n\0t\0V\0e\0r\0s\0i\0o\0n\0\\0E\0x\0p\0l\0o\0r\0e\0r\0\\0S\0h\0e\0l\0l\0 \0F\0o\0l\0d\0e\0r\0s\0\\0C\0a\0c\0h\0e\0%\0O\0L\0K\0*\0\0\0"}, 202, ) }, 202, ) == 0x0
 02187   860   NtQueryValueKey  (200,  (200, "SaferFlags", Partial, 280, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) , Partial, 280, ... TitleIdx=0, Type=4, Data= (200, "SaferFlags", Partial, 280, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) }, 16, ) == 0x0
 02188   860   NtClose  (200, ... ) == 0x0
 02189   860   NtEnumerateKey  (196, 1, Basic, 280, ... ) == STATUS_NO_MORE_ENTRIES
 02190   860   NtClose  (196, ... ) == 0x0
 02191   860   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\0\Hashes"}, ... 196, ) }, ... 196, ) == 0x0
 02192   860   NtEnumerateKey  (196, 0, Basic, 280, ... {LastWrite={0x38ab3b74,0x1c74d7e}, TitleIdx=0, Name= (196, 0, Basic, 280, ... {LastWrite={0x38ab3b74,0x1c74d7e}, TitleIdx=0, Name="{349d35ab-37b5-462f-9b89-edd5fbde1328}"}, 92, ) }, 92, ) == 0x0
 02193   860   NtOpenKey  (0x20019, {24, 196, 0x40, 0, 0,  (0x20019, {24, 196, 0x40, 0, 0, "{349d35ab-37b5-462f-9b89-edd5fbde1328}"}, ... 200, ) }, ... 200, ) == 0x0
 02194   860   NtQueryValueKey  (200,  (200, "ItemData", Partial, 280, ... TitleIdx=0, Type=3, Data="^\2530O\225zI\211j\0l\341\25@\25"}, 28, ) , Partial, 280, ... TitleIdx=0, Type=3, Data= (200, "ItemData", Partial, 280, ... TitleIdx=0, Type=3, Data="^\2530O\225zI\211j\0l\341\25@\25"}, 28, ) }, 28, ) == 0x0
 02195   860   NtQueryValueKey  (200,  (200, "HashAlg", Partial, 280, ... TitleIdx=0, Type=4, Data="\3\200\0\0"}, 16, ) , Partial, 280, ... TitleIdx=0, Type=4, Data= (200, "HashAlg", Partial, 280, ... TitleIdx=0, Type=4, Data="\3\200\0\0"}, 16, ) }, 16, ) == 0x0
 02196   860   NtQueryValueKey  (200,  (200, "ItemSize", Partial, 280, ... TitleIdx=0, Type=11, Data="\13\3\0\0\0\0\0\0"}, 20, ) , Partial, 280, ... TitleIdx=0, Type=11, Data= (200, "ItemSize", Partial, 280, ... TitleIdx=0, Type=11, Data="\13\3\0\0\0\0\0\0"}, 20, ) }, 20, ) == 0x0
 02197   860   NtQueryValueKey  (200,  (200, "SaferFlags", Partial, 280, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) , Partial, 280, ... TitleIdx=0, Type=4, Data= (200, "SaferFlags", Partial, 280, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) }, 16, ) == 0x0
 02198   860   NtClose  (200, ... ) == 0x0
 02199   860   NtEnumerateKey  (196, 1, Basic, 280, ... {LastWrite={0x38ab3b74,0x1c74d7e}, TitleIdx=0, Name= (196, 1, Basic, 280, ... {LastWrite={0x38ab3b74,0x1c74d7e}, TitleIdx=0, Name="{7fb9cd2e-3076-4df9-a57b-b813f72dbb91}"}, 92, ) }, 92, ) == 0x0
 02200   860   NtOpenKey  (0x20019, {24, 196, 0x40, 0, 0,  (0x20019, {24, 196, 0x40, 0, 0, "{7fb9cd2e-3076-4df9-a57b-b813f72dbb91}"}, ... 200, ) }, ... 200, ) == 0x0
 02201   860   NtQueryValueKey  (200,  (200, "ItemData", Partial, 280, ... TitleIdx=0, Type=3, Data="g\260\324\2134:?\323\274\351\334dg\4\363\224"}, 28, ) , Partial, 280, ... TitleIdx=0, Type=3, Data= (200, "ItemData", Partial, 280, ... TitleIdx=0, Type=3, Data="g\260\324\2134:?\323\274\351\334dg\4\363\224"}, 28, ) }, 28, ) == 0x0
 02202   860   NtQueryValueKey  (200,  (200, "HashAlg", Partial, 280, ... TitleIdx=0, Type=4, Data="\3\200\0\0"}, 16, ) , Partial, 280, ... TitleIdx=0, Type=4, Data= (200, "HashAlg", Partial, 280, ... TitleIdx=0, Type=4, Data="\3\200\0\0"}, 16, ) }, 16, ) == 0x0
 02203   860   NtQueryValueKey  (200,  (200, "ItemSize", Partial, 280, ... TitleIdx=0, Type=11, Data="\5\2\0\0\0\0\0\0"}, 20, ) , Partial, 280, ... TitleIdx=0, Type=11, Data= (200, "ItemSize", Partial, 280, ... TitleIdx=0, Type=11, Data="\5\2\0\0\0\0\0\0"}, 20, ) }, 20, ) == 0x0
 02204   860   NtQueryValueKey  (200,  (200, "SaferFlags", Partial, 280, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) , Partial, 280, ... TitleIdx=0, Type=4, Data= (200, "SaferFlags", Partial, 280, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) }, 16, ) == 0x0
 02205   860   NtClose  (200, ... ) == 0x0
 02206   860   NtEnumerateKey  (196, 2, Basic, 280, ... {LastWrite={0x38ab3b74,0x1c74d7e}, TitleIdx=0, Name= (196, 2, Basic, 280, ... {LastWrite={0x38ab3b74,0x1c74d7e}, TitleIdx=0, Name="{81d1fe15-dd9d-4762-b16d-7c29ddecae3f}"}, 92, ) }, 92, ) == 0x0
 02207   860   NtOpenKey  (0x20019, {24, 196, 0x40, 0, 0,  (0x20019, {24, 196, 0x40, 0, 0, "{81d1fe15-dd9d-4762-b16d-7c29ddecae3f}"}, ... 200, ) }, ... 200, ) == 0x0
 02208   860   NtQueryValueKey  (200,  (200, "ItemData", Partial, 280, ... TitleIdx=0, Type=3, Data="2x\2\334\376\370\310\223\334\212\260\6\335\204}\35"}, 28, ) , Partial, 280, ... TitleIdx=0, Type=3, Data= (200, "ItemData", Partial, 280, ... TitleIdx=0, Type=3, Data="2x\2\334\376\370\310\223\334\212\260\6\335\204}\35"}, 28, ) }, 28, ) == 0x0
 02209   860   NtQueryValueKey  (200,  (200, "HashAlg", Partial, 280, ... TitleIdx=0, Type=4, Data="\3\200\0\0"}, 16, ) , Partial, 280, ... TitleIdx=0, Type=4, Data= (200, "HashAlg", Partial, 280, ... TitleIdx=0, Type=4, Data="\3\200\0\0"}, 16, ) }, 16, ) == 0x0
 02210   860   NtQueryValueKey  (200,  (200, "ItemSize", Partial, 280, ... TitleIdx=0, Type=11, Data="\226\3\0\0\0\0\0\0"}, 20, ) , Partial, 280, ... TitleIdx=0, Type=11, Data= (200, "ItemSize", Partial, 280, ... TitleIdx=0, Type=11, Data="\226\3\0\0\0\0\0\0"}, 20, ) }, 20, ) == 0x0
 02211   860   NtQueryValueKey  (200,  (200, "SaferFlags", Partial, 280, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) , Partial, 280, ... TitleIdx=0, Type=4, Data= (200, "SaferFlags", Partial, 280, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) }, 16, ) == 0x0
 02212   860   NtClose  (200, ... ) == 0x0
 02213   860   NtEnumerateKey  (196, 3, Basic, 280, ... {LastWrite={0x38ab3b74,0x1c74d7e}, TitleIdx=0, Name= (196, 3, Basic, 280, ... {LastWrite={0x38ab3b74,0x1c74d7e}, TitleIdx=0, Name="{94e3e076-8f53-42a5-8411-085bcc18a68d}"}, 92, ) }, 92, ) == 0x0
 02214   860   NtOpenKey  (0x20019, {24, 196, 0x40, 0, 0,  (0x20019, {24, 196, 0x40, 0, 0, "{94e3e076-8f53-42a5-8411-085bcc18a68d}"}, ... 200, ) }, ... 200, ) == 0x0
 02215   860   NtQueryValueKey  (200,  (200, "ItemData", Partial, 280, ... TitleIdx=0, Type=3, Data="\275\232*\333B\353\330V\16%\16M\370\26/g"}, 28, ) , Partial, 280, ... TitleIdx=0, Type=3, Data= (200, "ItemData", Partial, 280, ... TitleIdx=0, Type=3, Data="\275\232*\333B\353\330V\16%\16M\370\26/g"}, 28, ) }, 28, ) == 0x0
 02216   860   NtQueryValueKey  (200,  (200, "HashAlg", Partial, 280, ... TitleIdx=0, Type=4, Data="\3\200\0\0"}, 16, ) , Partial, 280, ... TitleIdx=0, Type=4, Data= (200, "HashAlg", Partial, 280, ... TitleIdx=0, Type=4, Data="\3\200\0\0"}, 16, ) }, 16, ) == 0x0
 02217   860   NtQueryValueKey  (200,  (200, "ItemSize", Partial, 280, ... TitleIdx=0, Type=11, Data="\345\0\0\0\0\0\0\0"}, 20, ) , Partial, 280, ... TitleIdx=0, Type=11, Data= (200, "ItemSize", Partial, 280, ... TitleIdx=0, Type=11, Data="\345\0\0\0\0\0\0\0"}, 20, ) }, 20, ) == 0x0
 02218   860   NtQueryValueKey  (200,  (200, "SaferFlags", Partial, 280, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) , Partial, 280, ... TitleIdx=0, Type=4, Data= (200, "SaferFlags", Partial, 280, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) }, 16, ) == 0x0
 02219   860   NtClose  (200, ... ) == 0x0
 02220   860   NtEnumerateKey  (196, 4, Basic, 280, ... {LastWrite={0x38ab3b74,0x1c74d7e}, TitleIdx=0, Name= (196, 4, Basic, 280, ... {LastWrite={0x38ab3b74,0x1c74d7e}, TitleIdx=0, Name="{dc971ee5-44eb-4fe4-ae2e-b91490411bfc}"}, 92, ) }, 92, ) == 0x0
 02221   860   NtOpenKey  (0x20019, {24, 196, 0x40, 0, 0,  (0x20019, {24, 196, 0x40, 0, 0, "{dc971ee5-44eb-4fe4-ae2e-b91490411bfc}"}, ... 200, ) }, ... 200, ) == 0x0
 02222   860   NtQueryValueKey  (200,  (200, "ItemData", Partial, 280, ... TitleIdx=0, Type=3, Data="8k\10_\204\354\366i\323k\225j"\300\36\200"}, 28, ) , Partial, 280, ... TitleIdx=0, Type=3, Data= (200, "ItemData", Partial, 280, ... TitleIdx=0, Type=3, Data="8k\10_\204\354\366i\323k\225j"\300\36\200"}, 28, ) \300\36\200"}, 28, ) == 0x0
 02223   860   NtQueryValueKey  (200,  (200, "HashAlg", Partial, 280, ... TitleIdx=0, Type=4, Data="\3\200\0\0"}, 16, ) , Partial, 280, ... TitleIdx=0, Type=4, Data= (200, "HashAlg", Partial, 280, ... TitleIdx=0, Type=4, Data="\3\200\0\0"}, 16, ) }, 16, ) == 0x0
 02224   860   NtQueryValueKey  (200,  (200, "ItemSize", Partial, 280, ... TitleIdx=0, Type=11, Data="r\1\0\0\0\0\0\0"}, 20, ) , Partial, 280, ... TitleIdx=0, Type=11, Data= (200, "ItemSize", Partial, 280, ... TitleIdx=0, Type=11, Data="r\1\0\0\0\0\0\0"}, 20, ) }, 20, ) == 0x0
 02225   860   NtQueryValueKey  (200,  (200, "SaferFlags", Partial, 280, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) , Partial, 280, ... TitleIdx=0, Type=4, Data= (200, "SaferFlags", Partial, 280, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) }, 16, ) == 0x0
 02226   860   NtClose  (200, ... ) == 0x0
 02227   860   NtEnumerateKey  (196, 5, Basic, 280, ... ) == STATUS_NO_MORE_ENTRIES
 02228   860   NtClose  (196, ... ) == 0x0
 02229   860   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\0\UrlZones"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02230   860   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\4096\Paths"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02231   860   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\4096\Hashes"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02232   860   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\4096\UrlZones"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02233   860   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\65536\Paths"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02234   860   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\65536\Hashes"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02235   860   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\65536\UrlZones"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02236   860   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\131072\Paths"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02237   860   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\131072\Hashes"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02238   860   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\131072\UrlZones"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02239   860   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\262144\Paths"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02240   860   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\262144\Hashes"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02241   860   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\262144\UrlZones"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02242   860   NtOpenThreadTokenEx  (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN
 02243   860   NtOpenProcessTokenEx  (-1, 0x20008, 512, ... 196, ) == 0x0
 02244   860   NtQueryInformationToken  (196, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0
 02245   860   NtClose  (196, ... ) == 0x0
 02246   860   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\REGISTRY\USER\S-1-5-21-1292428093-1383384898-725345543-1003\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\0\Paths"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02247   860   NtOpenThreadTokenEx  (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN
 02248   860   NtOpenProcessTokenEx  (-1, 0x20008, 512, ... 196, ) == 0x0
 02249   860   NtQueryInformationToken  (196, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0
 02250   860   NtClose  (196, ... ) == 0x0
 02251   860   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\REGISTRY\USER\S-1-5-21-1292428093-1383384898-725345543-1003\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\0\Hashes"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02252   860   NtOpenThreadTokenEx  (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN
 02253   860   NtOpenProcessTokenEx  (-1, 0x20008, 512, ... 196, ) == 0x0
 02254   860   NtQueryInformationToken  (196, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0
 02255   860   NtClose  (196, ... ) == 0x0
 02256   860   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\REGISTRY\USER\S-1-5-21-1292428093-1383384898-725345543-1003\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\0\UrlZones"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02257   860   NtOpenThreadTokenEx  (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN
 02258   860   NtOpenProcessTokenEx  (-1, 0x20008, 512, ... 196, ) == 0x0
 02259   860   NtQueryInformationToken  (196, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0
 02260   860   NtClose  (196, ... ) == 0x0
 02261   860   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\REGISTRY\USER\S-1-5-21-1292428093-1383384898-725345543-1003\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\4096\Paths"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02262   860   NtOpenThreadTokenEx  (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN
 02263   860   NtOpenProcessTokenEx  (-1, 0x20008, 512, ... 196, ) == 0x0
 02264   860   NtQueryInformationToken  (196, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0
 02265   860   NtClose  (196, ... ) == 0x0
 02266   860   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\REGISTRY\USER\S-1-5-21-1292428093-1383384898-725345543-1003\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\4096\Hashes"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02267   860   NtOpenThreadTokenEx  (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN
 02268   860   NtOpenProcessTokenEx  (-1, 0x20008, 512, ... 196, ) == 0x0
 02269   860   NtQueryInformationToken  (196, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0
 02270   860   NtClose  (196, ... ) == 0x0
 02271   860   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\REGISTRY\USER\S-1-5-21-1292428093-1383384898-725345543-1003\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\4096\UrlZones"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02272   860   NtOpenThreadTokenEx  (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN
 02273   860   NtOpenProcessTokenEx  (-1, 0x20008, 512, ... 196, ) == 0x0
 02274   860   NtQueryInformationToken  (196, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0
 02275   860   NtClose  (196, ... ) == 0x0
 02276   860   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\REGISTRY\USER\S-1-5-21-1292428093-1383384898-725345543-1003\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\65536\Paths"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02277   860   NtOpenThreadTokenEx  (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN
 02278   860   NtOpenProcessTokenEx  (-1, 0x20008, 512, ... 196, ) == 0x0
 02279   860   NtQueryInformationToken  (196, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0
 02280   860   NtClose  (196, ... ) == 0x0
 02281   860   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\REGISTRY\USER\S-1-5-21-1292428093-1383384898-725345543-1003\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\65536\Hashes"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02282   860   NtOpenThreadTokenEx  (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN
 02283   860   NtOpenProcessTokenEx  (-1, 0x20008, 512, ... 196, ) == 0x0
 02284   860   NtQueryInformationToken  (196, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0
 02285   860   NtClose  (196, ... ) == 0x0
 02286   860   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\REGISTRY\USER\S-1-5-21-1292428093-1383384898-725345543-1003\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\65536\UrlZones"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02287   860   NtOpenThreadTokenEx  (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN
 02288   860   NtOpenProcessTokenEx  (-1, 0x20008, 512, ... 196, ) == 0x0
 02289   860   NtQueryInformationToken  (196, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0
 02290   860   NtClose  (196, ... ) == 0x0
 02291   860   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\REGISTRY\USER\S-1-5-21-1292428093-1383384898-725345543-1003\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\131072\Paths"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02292   860   NtOpenThreadTokenEx  (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN
 02293   860   NtOpenProcessTokenEx  (-1, 0x20008, 512, ... 196, ) == 0x0
 02294   860   NtQueryInformationToken  (196, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0
 02295   860   NtClose  (196, ... ) == 0x0
 02296   860   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\REGISTRY\USER\S-1-5-21-1292428093-1383384898-725345543-1003\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\131072\Hashes"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02297   860   NtOpenThreadTokenEx  (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN
 02298   860   NtOpenProcessTokenEx  (-1, 0x20008, 512, ... 196, ) == 0x0
 02299   860   NtQueryInformationToken  (196, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0
 02300   860   NtClose  (196, ... ) == 0x0
 02301   860   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\REGISTRY\USER\S-1-5-21-1292428093-1383384898-725345543-1003\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\131072\UrlZones"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02302   860   NtOpenThreadTokenEx  (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN
 02303   860   NtOpenProcessTokenEx  (-1, 0x20008, 512, ... 196, ) == 0x0
 02304   860   NtQueryInformationToken  (196, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0
 02305   860   NtClose  (196, ... ) == 0x0
 02306   860   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\REGISTRY\USER\S-1-5-21-1292428093-1383384898-725345543-1003\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\262144\Paths"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02307   860   NtOpenThreadTokenEx  (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN
 02308   860   NtOpenProcessTokenEx  (-1, 0x20008, 512, ... 196, ) == 0x0
 02309   860   NtQueryInformationToken  (196, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0
 02310   860   NtClose  (196, ... ) == 0x0
 02311   860   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\REGISTRY\USER\S-1-5-21-1292428093-1383384898-725345543-1003\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\262144\Hashes"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02312   860   NtOpenThreadTokenEx  (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN
 02313   860   NtOpenProcessTokenEx  (-1, 0x20008, 512, ... 196, ) == 0x0
 02314   860   NtQueryInformationToken  (196, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0
 02315   860   NtClose  (196, ... ) == 0x0
 02316   860   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\REGISTRY\USER\S-1-5-21-1292428093-1383384898-725345543-1003\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\262144\UrlZones"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02317   860   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers"}, ... 196, ) }, ... 196, ) == 0x0
 02318   860   NtQueryValueKey  (196,  (196, "DefaultLevel", Full, 524, ... TitleIdx=0, Type=4, Name="DefaultLevel", Data="\0\0\4\0"}, 48, ) , Full, 524, ... TitleIdx=0, Type=4, Name= (196, "DefaultLevel", Full, 524, ... TitleIdx=0, Type=4, Name="DefaultLevel", Data="\0\0\4\0"}, 48, ) , Data= (196, "DefaultLevel", Full, 524, ... TitleIdx=0, Type=4, Name="DefaultLevel", Data="\0\0\4\0"}, 48, ) }, 48, ) == 0x0
 02319   860   NtClose  (196, ... ) == 0x0
 02320   860   NtOpenThreadTokenEx  (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN
 02321   860   NtOpenProcessTokenEx  (-1, 0x20008, 512, ... 196, ) == 0x0
 02322   860   NtQueryInformationToken  (196, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0
 02323   860   NtClose  (196, ... ) == 0x0
 02324   860   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\REGISTRY\USER\S-1-5-21-1292428093-1383384898-725345543-1003\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02325   860   NtOpenThreadToken  (-2, 0x8, 0, ... ) == STATUS_NO_TOKEN
 02326   860   NtOpenProcessToken  (-1, 0xa, ... 196, ) == 0x0
 02327   860   NtDuplicateToken  (196, 0xc, {24, 0, 0x0, 0, 1230828, 0x0}, 0, 2, ... 200, ) == 0x0
 02328   860   NtClose  (196, ... ) == 0x0
 02329   860   NtAccessCheck  (1372024, 200, 0x1, 1230904, 1230956, 56, 1230936, ... (0x1), ) == 0x0
 02330   860   NtClose  (200, ... ) == 0x0
 02331   860   NtOpenKey  (0x1, {24, 0, 0x40, 0, 0,  (0x1, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers"}, ... 200, ) }, ... 200, ) == 0x0
 02332   860   NtQueryValueKey  (200,  (200, "PolicyScope", Partial, 80, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) , Partial, 80, ... TitleIdx=0, Type=4, Data= (200, "PolicyScope", Partial, 80, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) }, 16, ) == 0x0
 02333   860   NtClose  (200, ... ) == 0x0
 02334   860   NtOpenSymbolicLinkObject  (0x1, {24, 0, 0x40, 0, 0,  (0x1, {24, 0, 0x40, 0, 0, "\??\C:"}, ... 200, ) }, ... 200, ) == 0x0
 02335   860   NtQuerySymbolicLinkObject  (200, ...  (200, ... "\Device\HarddiskVolume1", 48, ) , 48, ) == 0x0
 02336   860   NtClose  (200, ... ) == 0x0
 02337   860   NtQueryVolumeInformationFile  (180, 1228660, 8, Device, ... {status=0x0, info=8}, ) == 0x0
 02338   860   NtQueryInformationFile  (180, 1228776, 528, Name, ... {status=0x0, info=58}, ) == 0x0
 02339   860   NtQueryInformationProcess  (-1, DefaultHardErrorMode, 4, ... {process info, class 12, size 4}, 0x0, ) == 0x0
 02340   860   NtSetInformationProcess  (-1, DefaultHardErrorMode, {process info, class 12, size 4}, 4, ... ) == 0x0
 02341   860   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\dwwin.exe"}, 1227948, ... ) }, 1227948, ... ) == 0x0
 02342   860   NtOpenFile  (0x100001, {24, 0, 0x40, 0, 0,  (0x100001, {24, 0, 0x40, 0, 0, "\??\C:\"}, 3, 16417, ... 200, {status=0x0, info=1}, ) }, 3, 16417, ... 200, {status=0x0, info=1}, ) == 0x0
 02343   860   NtQueryDirectoryFile  (200, 0, 0, 0, 1227376, 616, BothDirectory, 1,  (200, 0, 0, 0, 1227376, 616, BothDirectory, 1, "WINDOWS", 0, ... {status=0x0, info=108}, ) , 0, ... {status=0x0, info=108}, ) == 0x0
 02344   860   NtClose  (200, ... ) == 0x0
 02345   860   NtOpenFile  (0x100001, {24, 0, 0x40, 0, 0,  (0x100001, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\"}, 3, 16417, ... 200, {status=0x0, info=1}, ) }, 3, 16417, ... 200, {status=0x0, info=1}, ) == 0x0
 02346   860   NtQueryDirectoryFile  (200, 0, 0, 0, 1227376, 616, BothDirectory, 1,  (200, 0, 0, 0, 1227376, 616, BothDirectory, 1, "system32", 0, ... {status=0x0, info=110}, ) , 0, ... {status=0x0, info=110}, ) == 0x0
 02347   860   NtClose  (200, ... ) == 0x0
 02348   860   NtOpenFile  (0x100001, {24, 0, 0x40, 0, 0,  (0x100001, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\"}, 3, 16417, ... 200, {status=0x0, info=1}, ) }, 3, 16417, ... 200, {status=0x0, info=1}, ) == 0x0
 02349   860   NtQueryDirectoryFile  (200, 0, 0, 0, 1227376, 616, BothDirectory, 1,  (200, 0, 0, 0, 1227376, 616, BothDirectory, 1, "dwwin.exe", 0, ... {status=0x0, info=112}, ) , 0, ... {status=0x0, info=112}, ) == 0x0
 02350   860   NtClose  (200, ... ) == 0x0
 02351   860   NtQueryInformationProcess  (-1, DefaultHardErrorMode, 4, ... {process info, class 12, size 4}, 0x0, ) == 0x0
 02352   860   NtSetInformationProcess  (-1, DefaultHardErrorMode, {process info, class 12, size 4}, 4, ... ) == 0x0
 02353   860   NtQueryInformationFile  (180, 1230816, 24, Standard, ... {status=0x0, info=24}, ) == 0x0
 02354   860   NtCreateSection  (0xf0005, 0x0, {192512, 0}, 2, 134217728, 180, ... 200, ) == 0x0
 02355   860   NtMapViewOfSection  (200, -1, (0x0), 0, 0, {0, 0}, 192512, 1, 0, 2, ... (0x3d0000), {0, 0}, 192512, ) == 0x0
 02356   860   NtClose  (200, ... ) == 0x0
 02357   860   NtOpenThreadTokenEx  (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN
 02358   860   NtOpenProcessTokenEx  (-1, 0x20008, 512, ... 200, ) == 0x0
 02359   860   NtQueryInformationToken  (200, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0
 02360   860   NtClose  (200, ... ) == 0x0
 02361   860   NtOpenKey  (0x20019, {24, 0, 0x640, 0, 0,  (0x20019, {24, 0, 0x640, 0, 0, "\REGISTRY\USER\S-1-5-21-1292428093-1383384898-725345543-1003"}, ... 200, ) }, ... 200, ) == 0x0
 02362   860   NtOpenKey  (0x20019, {24, 200, 0x40, 0, 0,  (0x20019, {24, 200, 0x40, 0, 0, "Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders"}, ... 196, ) }, ... 196, ) == 0x0
 02363   860   NtClose  (200, ... ) == 0x0
 02364   860   NtQueryValueKey  (196,  (196, "Cache", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 02365   860   NtQueryValueKey  (196,  (196, "Cache", Partial, 174, ... TitleIdx=0, Type=1, Data="C\0:\0\\0D\0o\0c\0u\0m\0e\0n\0t\0s\0 \0a\0n\0d\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0M\0a\0r\0t\0i\0m\0 \0C\0a\0r\0b\0o\0n\0e\0\\0L\0o\0c\0a\0l\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0T\0e\0m\0p\0o\0r\0a\0r\0y\0 \0I\0n\0t\0e\0r\0n\0e\0t\0 \0F\0i\0l\0e\0s\0\0\0"}, 174, ) , Partial, 174, ... TitleIdx=0, Type=1, Data= (196, "Cache", Partial, 174, ... TitleIdx=0, Type=1, Data="C\0:\0\\0D\0o\0c\0u\0m\0e\0n\0t\0s\0 \0a\0n\0d\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0M\0a\0r\0t\0i\0m\0 \0C\0a\0r\0b\0o\0n\0e\0\\0L\0o\0c\0a\0l\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0T\0e\0m\0p\0o\0r\0a\0r\0y\0 \0I\0n\0t\0e\0r\0n\0e\0t\0 \0F\0i\0l\0e\0s\0\0\0"}, 174, ) }, 174, ) == 0x0
 02366   860   NtClose  (196, ... ) == 0x0
 02367   860   NtUnmapViewOfSection  (-1, 0x3d0000, ... ) == 0x0
 02368   860   NtAllocateVirtualMemory  (-1, 0, 0, 4096, 8192, 4, ... 3735552, 4096, ) == 0x0
 02369   860   NtAllocateVirtualMemory  (-1, 3735552, 0, 4096, 4096, 4, ... 3735552, 4096, ) == 0x0
 02370   860   NtOpenKey  (0x1, {24, 0, 0x40, 0, 0,  (0x1, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers"}, ... 196, ) }, ... 196, ) == 0x0
 02371   860   NtQueryValueKey  (196,  (196, "LogFileName", Partial, 536, ... ) , Partial, 536, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02372   860   NtClose  (196, ... ) == 0x0
 02373   860   NtOpenKey  (0x3, {24, 0, 0x40, 0, 0,  (0x3, {24, 0, 0x40, 0, 0, "\Registry\MACHINE\System\CurrentControlSet\Control\SafeBoot\Option"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02374   860   NtQueryInformationToken  (192, User, 128, ... {token info, class 1, size 36}, 36, ) == 0x0
 02375   860   NtQueryInformationToken  (192, 15, 4, ... {token info, class 15, size 4}, 4, ) == 0x0
 02376   860   NtClose  (192, ... ) == 0x0
 02377   860   NtQuerySection  (176, Image, 48, ... {section info, class 1, size 48}, 0x0, ) == 0x0
 02378   860   NtOpenKey  (0x80000000, {24, 0, 0x40, 0, 0,  (0x80000000, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\dwwin.exe"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02379   860   NtQuerySystemInformation  (71, 4, ... {system info, class 71, size 4}, 0x0, ) == 0x0
 02380   860   NtCreateProcessEx  (1232740, 2035711, 0, -1, 4, 176, 0, 0, 0, ... ) == 0x0
 02381   860   NtOpenSection  (0xe, {24, 48, 0x0, 0, 0,  (0xe, {24, 48, 0x0, 0, 0, "W32_Virtu"}, ... 196, ) }, ... 196, ) == 0x0
 02382   860   NtMapViewOfSection  (196, 192, (0x0), 0, 27086, 0x0, 27086, 2, 1048576, 64, ... (0x7ffa0000), 0x0, 28672, ) == 0x0
 02383   860   NtClose  (196, ... ) == 0x0
 02384   860   NtProtectVirtualMemory  (192, (0x7c90d682), 5, 64, ... (0x7c90d000), 4096, 32, ) == 0x0
 02385   860   NtWriteVirtualMemory  (192, 0x7c90d682,  (192, 0x7c90d682, "\350\15Mi\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 02386   860   NtProtectVirtualMemory  (192, (0x7c90dcfd), 5, 64, ... (0x7c90d000), 4096, 64, ) == 0x0
 02387   860   NtWriteVirtualMemory  (192, 0x7c90dcfd,  (192, 0x7c90dcfd, "\350\337Fi\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 02388   860   NtProtectVirtualMemory  (192, (0x7c90d754), 5, 64, ... (0x7c90d000), 4096, 64, ) == 0x0
 02389   860   NtWriteVirtualMemory  (192, 0x7c90d754,  (192, 0x7c90d754, "\350\217Li\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 02390   860   NtProtectVirtualMemory  (192, (0x7c90d769), 5, 64, ... (0x7c90d000), 4096, 64, ) == 0x0
 02391   860   NtWriteVirtualMemory  (192, 0x7c90d769,  (192, 0x7c90d769, "\350\207Li\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 02392   860   NtSetInformationProcess  (192, PriorityClass, {process info, class 18, size 2}, 512, ... ) == 0x0
 02393   860   NtSetInformationProcess  (192, DefaultHardErrorMode, {process info, class 12, size 4}, 4, ... ) == 0x0
 02394   860   NtQueryInformationProcess  (192, Basic, 24, ... {ExitStatus=0x103,PebBaseAddress=0x7ffdd000,AffinityMask=0x1,BasePriority=8,Pid=1676,ParentPid=464,}, 0x0, ) == 0x0
 02395   860   NtReadVirtualMemory  (192, 0x7ffdd008, 4, ...  (192, 0x7ffdd008, 4, ... "\0\0\00", 0x0, ) , 0x0, ) == 0x0
 02396   860   NtOpenFile  (0x1200a9, {24, 0, 0x40, 0, 0,  (0x1200a9, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\dwwin.exe.Manifest"}, 1, 96, ... ) }, 1, 96, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02397   860   NtReadVirtualMemory  (192, 0x30000000, 4096, ...  (192, 0x30000000, 4096, ... "MZ\220\0\3\0\0\0\4\0\0\0\377\377\0\0\270\0\0\0\0\0\0\0@\0\0\0\0\0\0\0\201\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\360\0\0\0\16\37\272\16\0\264\11\315!\270\1L\315!This program cannot be run in DOS mode.\15\15\12$\0\0\0\0\0\0\0$\206\244\23`\347\312@`\347\312@`\347\312@9\304\331@b\347\312@`\347\313@d\347\312@\210\370\301@a\347\312@\343\373\304@j\347\312@\210\370\300@I\347\312@6\370\331@h\347\312@\272\304\326@i\347\312@\220\370\301@p\347\312@`\347\312@H\346\312@Rich`\347\312@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0PE\0\0L\1\3\0N\23\216?\0\0\0\0\0\0\0\0\340\0\17\1\13\1\6\24\0\220\2\0\0\240\0\0\0\0\0\0\222\236\2\0\0\20\0\0\0\320\3\0\0\0\00\0\20\0\0\0\20\0\0\4\0\0\0\0\0\0\0\4\0\0\0\0\0\0\0\0\260\3\0\0\20\0\0\0\0\0\0\2\0\0\0\0\0\20\0\0\20\0\0\0\0\20\0\0\20\0\0\0\0\0\0\20\0\0\0\0\0\0\0\0\0\0\0\327\211\2\0z\1\0\0\00\3\0\244\12\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0Z\236\2\08\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0`\2\0\0\370\0\0\0\0\20\0\0\270\3\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0.text\0\0\0O\217\2\0", 4096, ) , 4096, ) == 0x0
 02398   860   NtReadVirtualMemory  (192, 0x30033000, 256, ...  (192, 0x30033000, 256, ... "\0\0\0\0J\23\216?\0\0\0\0\0\0\3\0\5\0\0\0(\0\0\200\13\0\0\0@\0\0\200\20\0\0\0X\0\0\200\0\0\0\0J\23\216?\0\0\0\0\0\0\1\0e\0\0\0p\0\0\200\0\0\0\0J\23\216?\0\0\0\0\0\0\1\0\1\0\0\0\210\0\0\200\0\0\0\0J\23\216?\0\0\0\0\0\0\1\0\1\0\0\0\240\0\0\200\0\0\0\0J\23\216?\0\0\0\0\0\0\1\0\11\4\0\0\270\0\0\0\0\0\0\0J\23\216?\0\0\0\0\0\0\1\0\11\4\0\0\310\0\0\0\0\0\0\0J\23\216?\0\0\0\0\0\0\1\0\11\4\0\0\330\0\0\0\3600\3\0\26\3\0\0\0\0\0\0\0\0\0\0\104\3\0\254\1\0\0\0\0\0\0\0\0\0\0\2645\3\0\360\4\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\300\0\310\200\0\0\0\0\14\0\0\0\0\0f\1", 256, ) , 256, ) == 0x0
 02399   860   NtQueryDebugFilterState  (53, 2, ... ) == 0x0
 02400   860   NtQueryInformationProcess  (192, Basic, 24, ... {ExitStatus=0x103,PebBaseAddress=0x7ffdd000,AffinityMask=0x1,BasePriority=8,Pid=1676,ParentPid=464,}, 0x0, ) == 0x0
 02401   860   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32"}, 1231692, ... ) }, 1231692, ... ) == 0x0
 02402   860   NtAllocateVirtualMemory  (-1, 0, 0, 2428, 4096, 4, ... 3997696, 4096, ) == 0x0
 02403   860   NtAllocateVirtualMemory  (192, 0, 0, 6432, 4096, 4, ... 65536, 8192, ) == 0x0
 02404   860   NtWriteVirtualMemory  (192, 0x10000,  (192, 0x10000, "=\0A\0:\0=\0A\0:\0\\0\0\0=\0C\0:\0=\0C\0:\0\\0s\0c\0r\0i\0p\0t\0s\0\0\0=\0U\0:\0=\0U\0:\0\\0\0\0A\0L\0L\0U\0S\0E\0R\0S\0P\0R\0O\0F\0I\0L\0E\0=\0C\0:\0\\0D\0o\0c\0u\0m\0e\0n\0t\0s\0 \0a\0n\0d\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0A\0l\0l\0 \0U\0s\0e\0r\0s\0\0\0A\0P\0P\0D\0A\0T\0A\0=\0C\0:\0\\0D\0o\0c\0u\0m\0e\0n\0t\0s\0 \0a\0n\0d\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0M\0a\0r\0t\0i\0m\0 \0C\0a\0r\0b\0o\0n\0e\0\\0A\0p\0p\0l\0i\0c\0a\0t\0i\0o\0n\0 \0D\0a\0t\0a\0\0\0A\0T\0L\0_\0I\0N\0C\0_\0P\0A\0T\0H\0=\0C\0:\0\\0W\0I\0N\0D\0D\0K\0\\03\07\09\00\0~\01\0.\01\08\03\0\\0i\0n\0c\0\0\0A\0T\0L\0_\0I\0N\0C\0_\0R\0O\0O\0T\0=\0C\0:\0\\0W\0I\0N\0D\0D\0K\0\\03\07\09\00\0~\01\0.\01\08\03\0\\0i\0n\0c\0\0\0A\0T\0L\0_\0L\0I\0B\0_\0P\0A\0T\0H\0=\0C\0:\0\\0W\0I\0N\0D\0D\0K\0\\03\07\0", 6432, ... 0x0, ) , 6432, ... 0x0, ) == 0x0
 02405   860   NtAllocateVirtualMemory  (192, 0, 0, 2428, 4096, 4, ... 131072, 4096, ) == 0x0
 02406   860   NtWriteVirtualMemory  (192, 0x20000,  (192, 0x20000, "\0\20\0\0|\11\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\3\0\0\0\0\0\0\0\13\0\0\0&\0\10\2\220\2\0\0\16\0\0\0\364\3\366\3\230\4\0\0:\0<\0\220\10\0\0N\0P\0\314\10\0\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0:\0<\0\34\11\0\0\36\0 \0X\11\0\0\0\0\2\0x\11\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0", 2428, ... 0x0, ) , 2428, ... 0x0, ) == 0x0
 02407   860   NtWriteVirtualMemory  (192, 0x7ffdd010,  (192, 0x7ffdd010, "\0\0\2\0", 4, ... 0x0, ) , 4, ... 0x0, ) == 0x0
 02408   860   NtAllocateVirtualMemory  (192, 0, 0, 388, 4096, 4, ... 196608, 4096, ) == 0x0
 02409   860   NtWriteVirtualMemory  (192, 0x30000,  (192, 0x30000, "S\0h\0i\0m\0E\0n\0g\0.\0d\0l\0l\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\204\1\0\0\253\355\15\254\210\255\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\1\0\0\0\21\21\21\21\21\21\21\21\21\21\21\21\21\21\21\21\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0", 388, ... 0x0, ) , 388, ... 0x0, ) == 0x0
 02410   860   NtWriteVirtualMemory  (192, 0x7ffdd1e8,  (192, 0x7ffdd1e8, "\0\0\3\0", 4, ... 0x0, ) , 4, ... 0x0, ) == 0x0
 02411   860   NtFreeVirtualMemory  (-1, (0x3d0000), 0, 32768, ... (0x3d0000), 4096, ) == 0x0
 02412   860   NtAllocateVirtualMemory  (192, 0, 0, 1048576, 8192, 4, ... 262144, 1048576, ) == 0x0
 02413   860   NtAllocateVirtualMemory  (192, 1302528, 0, 8192, 4096, 4, ... 1302528, 8192, ) == 0x0
 02414   860   NtProtectVirtualMemory  (192, (0x13e000), 4096, 260, ... (0x13e000), 4096, 4, ) == 0x0
 02415   860   NtCreateThread  (0x1f03ff, 0x0, 192, 1232748, 1232412, 1, ... 196, {1676, 496}, ) == 0x0
 02416   860   NtRequestWaitReplyPort  (24, {168, 196, new_msg, 0, 16, 2147348480, 2008285840, 0}  (24, {168, 196, new_msg, 0, 16, 2147348480, 2008285840, 0} "\0\0\0\0\0\0\1\0\0(\372\177x\2\264w\303\0\0\0\304\0\0\0\214\6\0\0\360\1\0\0\0\0\0\0\0\0\0\0\0\0\0\4\0\0\0\0T\323\22\0x\1\24\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\320\375\177\0\0\0\0\0\0\24\0\10 \0\0" ... {168, 196, reply, 0, 464, 860, 58033, 0} "\0\0\0\0\0\0\1\0\0\0\0\0x\2\264w\300\0\0\0\304\0\0\0\214\6\0\0\360\1\0\0\0\0\0\0\0\0\0\0\0\0\0\4\0\0\0\0T\323\22\0x\1\24\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\320\375\177\0\0\0\0\0\0\24\0\10 \0\0" )  ... {168, 196, reply, 0, 464, 860, 58033, 0}  (24, {168, 196, new_msg, 0, 16, 2147348480, 2008285840, 0} "\0\0\0\0\0\0\1\0\0(\372\177x\2\264w\303\0\0\0\304\0\0\0\214\6\0\0\360\1\0\0\0\0\0\0\0\0\0\0\0\0\0\4\0\0\0\0T\323\22\0x\1\24\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\320\375\177\0\0\0\0\0\0\24\0\10 \0\0" ... {168, 196, reply, 0, 464, 860, 58033, 0} "\0\0\0\0\0\0\1\0\0\0\0\0x\2\264w\300\0\0\0\304\0\0\0\214\6\0\0\360\1\0\0\0\0\0\0\0\0\0\0\0\0\0\4\0\0\0\0T\323\22\0x\1\24\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\320\375\177\0\0\0\0\0\0\24\0\10 \0\0" )  ) == 0x0
 02417   860   NtResumeThread  (196, ... 1, ) == 0x0
 02418   860   NtClose  (180, ... ) == 0x0
 02419   860   NtClose  (176, ... ) == 0x0
 02420   860   NtClose  (196, ... ) == 0x0
 02421   860   NtWaitForMultipleObjects  (2, (164, 192, ), 1, 0, {1294967296, -1}, ... ) == 0x0
 02422   860   NtWaitForSingleObject  (156, 0, {0, 0}, ... ) == 0x102
 02423   860   NtWaitForMultipleObjects  (2, (164, 192, ), 1, 0, {1294967296, -1}, ... ) == 0x0
 02424   860   NtWaitForSingleObject  (156, 0, {0, 0}, ... ) == 0x102
 02425   860   NtWaitForMultipleObjects  (2, (164, 192, ), 1, 0, {1294967296, -1}, ... ) == 0x0
 02426   860   NtWaitForSingleObject  (156, 0, {0, 0}, ... ) == 0x0
 02427   860   NtClose  (192, ... ) == 0x0
 02428   860   NtUnmapViewOfSection  (-1, 0x370000, ... ) == 0x0
 02429   860   NtClose  (172, ... ) == 0x0
 02430   860   NtClose  (156, ... ) == 0x0
 02431   860   NtClose  (164, ... ) == 0x0
 02432   860   NtClose  (160, ... ) == 0x0
 02433   860   NtClose  (168, ... ) == 0x0
 02434   860   NtClose  (144, ... ) == 0x0
 02435   860   NtClose  (148, ... ) == 0x0
 02436   860   NtSetInformationThread  (-2, ZeroTlsCell, {ZeroTlsCell=0x8,}, 4, ... ) == 0x0
 02437   860   NtWaitForMultipleObjects  (2, (116, 108, ), 1, 0, 0x0, ... ) == 0x1
 02438   860   NtClose  (108, ... ) == 0x0
 02439   860   NtSetEvent  (116, ... 0x0, ) == 0x0
 02440   860   NtClose  (116, ... ) == 0x0
 02441   860   NtWaitForMultipleObjects  (2, (112, 124, ), 1, 0, 0x0, ... ) == 0x1
 02442   860   NtClose  (124, ... ) == 0x0
 02443   860   NtSetEvent  (112, ... 0x0, ) == 0x0
 02444   860   NtClose  (112, ... ) == 0x0
 02445   860   NtWaitForMultipleObjects  (2, (128, 132, ), 1, 0, 0x0, ... ) == 0x1
 02446   860   NtClose  (132, ... ) == 0x0
 02447   860   NtSetEvent  (128, ... 0x0, ) == 0x0
 02448   860   NtClose  (128, ... ) == 0x0
 02449   860   NtRequestWaitReplyPort  (152, {88, 112, new_msg, 0, 464, 860, 58030, 0}  (152, {88, 112, new_msg, 0, 464, 860, 58030, 0} "\1\376\0\0A\2<\0\200Y\274\201V\347\340\341\264\311\275\201:\332R\200\377\377\377\377\324\376\255\201\0\0\0\0)%\25E?>\A\250\245\22\360\331E\16S\331E\16S\10\210\300\310\0\0\0\3\1\0\0\3\1\0\0\10A\210\300\0@\250\300\220\276u\201\264;\350\371" ... {124, 148, reply, 0, 464, 860, 58146, 0} "\2\31\221|\1\0\221|\200\300\227|p\31\221|\250$\12\0\330\0\0\0d\365\11\0\0\300\372\177\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\1\0\0\0\0\0\0\0\4\0\0\0\1\365\11\0\1\0\0\0d\365\11\0\0\0\0\0\0\0\0\0\1\0\0\0\10\376\257\0\0\0\0\0\334\377\257\0\30\356\220|p\5\221|\377\377\377\377m\5\221|\344f\347w" )  ... {124, 148, reply, 0, 464, 860, 58146, 0}  (152, {88, 112, new_msg, 0, 464, 860, 58030, 0} "\1\376\0\0A\2<\0\200Y\274\201V\347\340\341\264\311\275\201:\332R\200\377\377\377\377\324\376\255\201\0\0\0\0)%\25E?>\A\250\245\22\360\331E\16S\331E\16S\10\210\300\310\0\0\0\3\1\0\0\3\1\0\0\10A\210\300\0@\250\300\220\276u\201\264;\350\371" ... {124, 148, reply, 0, 464, 860, 58146, 0} "\2\31\221|\1\0\221|\200\300\227|p\31\221|\250$\12\0\330\0\0\0d\365\11\0\0\300\372\177\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\1\0\0\0\0\0\0\0\4\0\0\0\1\365\11\0\1\0\0\0d\365\11\0\0\0\0\0\0\0\0\0\1\0\0\0\10\376\257\0\0\0\0\0\334\377\257\0\30\356\220|p\5\221|\377\377\377\377m\5\221|\344f\347w" )  ) == 0x0
 02450   860   NtClose  (140, ... ) == 0x0
 02451   860   NtClose  (152, ... ) == 0x0
 02452   860   NtClose  (120, ... ) == 0x0
 02453   860   NtUnmapViewOfSection  (-1, 0x69450000, ... ) == 0x0
 02454   860   NtUnmapViewOfSection  (-1, 0x77920000, ... ) == 0x0
 02455   860   NtUnmapViewOfSection  (-1, 0x76f50000, ... ) == 0x0
 02456   860   NtUnmapViewOfSection  (-1, 0x76360000, ... ) == 0x0
 02457   860   NtUnmapViewOfSection  (-1, 0x5b860000, ... ) == 0x0
 02458   860   NtUnmapViewOfSection  (-1, 0x769c0000, ... ) == 0x0
 02459   860   NtContinue  (1242092, 0, ...
 02460   860   NtQueryVirtualMemory  (-1, 0x3a2bf4, Basic, 28, ... {BaseAddress=0x3a2000,AllocationBase=0x3a0000,AllocationProtect=0x40,RegionSize=0x2e000,State=0x1000,Protect=0x40,Type=0x20000,}, 28, ) == 0x0
 02461   860   NtUserModifyUserStartupInfoFlags  (1, 0, ... ) == 0x816e5658
 02462   860   NtUserGetDCEx  (0, 0, 3, ... ) == 0x1010054
 02463   860   NtUserGetForegroundWindow  (... ) == 0xa0102
 02464   860   NtUserQueryWindow  (655618, 0, ... ) == 0x68c
 02465   860   NtUserQueryWindow  (655618, 1, ... ) == 0x1f0
 02466   860   NtGdiGetTextCharsetInfo  (16842836, 0, 0, ... ) == 0x0
 02467   860   NtGdiCreateRectRgn  (0, 0, 1, 1, ... ) == 0xaa0406b2
 02468   860   NtGdiGetRandomRgn  (16842836, -1442576718, 1, ... ) == 0x0
 02469   860   NtGdiIntersectClipRect  (16842836, 0, 0, 612, 738, ... ) == 0x3
 02470   860   NtGdiExtSelectClipRgn  (16842836, 0, 5, ... ) == 0x2
 02471   860   NtGdiGetTextCharsetInfo  (16842836, 0, 0, ... ) == 0x0
 02472   860   NtGdiGetRandomRgn  (16842836, -1425799502, 1, ... ) == 0x0
 02473   860   NtGdiIntersectClipRect  (16842836, 0, 0, 151, 738, ... ) == 0x3
 02474   860   NtGdiExtSelectClipRgn  (16842836, 0, 5, ... ) == 0x2
 02475   860   NtUserCallOneParam  (16842836, 57, ... ) == 0x1
 02476   860   NtUserFindExistingCursorIcon  (1240916, 1240932, 1240980, ... ) == 0x10011
 02477   860   NtUserSetCursor  (65553, ... ) == 0x10015
 02478   860   NtUserCallOneParam  (0, 50, ... ) == 0x1
 02479   860   NtUserFindExistingCursorIcon  (1240868, 1240884, 1240932, ... ) == 0x10015
 02480   860   NtUserSetCursor  (65557, ... ) == 0x10011
 02481   860   NtGdiCreateCompatibleDC  (0, ... ) == 0x9d010551
 02482   860   NtGdiExtGetObjectW  (50987262, 92, 1241156, ... ) == 0x5c
 02483   860   NtGdiHfontCreate  (1240628, 356, 0, 0, 1333032, ... ) == 0xe0a05d6
 02484   860   NtGdiGetTextMetricsW  (-1660877487, 1241152, 68, ... ) == 0x1
 02485   860   NtGdiGetWidthTable  (-1660877487, 52, 1353304, 308, 1353920, 1352672, 1352688, ... ) == 0x1
 02486   860   NtGdiDeleteObjectApp  (-1660877487, ... ) == 0x1
 02487   860   NtUserGetForegroundWindow  (... ) == 0xa0102
 02488   860   NtUserQueryWindow  (655618, 0, ... ) == 0x68c
 02489   860   NtUserQueryWindow  (655618, 1, ... ) == 0x1f0
 02490   860   NtUserGetAtomName  (32770, 1240128, ... ) == 0x6
 02491   860   NtUserCreateWindowEx  (65793, 32770, 32770,  (65793, 32770, 32770, "Error", -2134375995, 425, 345, 179, 107, 0, 0, 2118189056, 0, 1073742848, 0, ... , -2134375995, 425, 345, 179, 107, 0, 0, 2118189056, 0, 1073742848, 0, ...
 02492   860   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\MSCTF.dll"}, 1237604, ... ) }, 1237604, ... ) == 0x0
 02493   860   NtOpenFile  (0x100020, {24, 0, 0x40, 0, 0,  (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\MSCTF.dll"}, 5, 96, ... 120, {status=0x0, info=1}, ) }, 5, 96, ... 120, {status=0x0, info=1}, ) == 0x0
 02494   860   NtCreateSection  (0xe, 0x0, 0x0, 16, 134217728, 120, ... 152, ) == 0x0
 02495   860   NtClose  (120, ... ) == 0x0
 02496   860   NtMapViewOfSection  (152, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 16, ... (0x970000), 0x0, 294912, ) == 0x0
 02497   860   NtClose  (152, ... ) == 0x0
 02498   860   NtUnmapViewOfSection  (-1, 0x970000, ... ) == 0x0
 02499   860   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\MSCTF.dll"}, 1237912, ... ) }, 1237912, ... ) == 0x0
 02500   860   NtOpenFile  (0x100020, {24, 0, 0x40, 0, 0,  (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\MSCTF.dll"}, 5, 96, ... 152, {status=0x0, info=1}, ) }, 5, 96, ... 152, {status=0x0, info=1}, ) == 0x0
 02501   860   NtCreateSection  (0xf, 0x0, 0x0, 16, 16777216, 152, ... 120, ) == 0x0
 02502   860   NtQuerySection  (120, Image, 48, ... {section info, class 1, size 48}, 0x0, ) == 0x0
 02503   860   NtClose  (152, ... ) == 0x0
 02504   860   NtMapViewOfSection  (120, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x74720000), 0x0, 307200, ) == 0x0
 02505   860   NtClose  (120, ... ) == 0x0
 02506   860   NtProtectVirtualMemory  (-1, (0x74721000), 928, 4, ... (0x74721000), 4096, 32, ) == 0x0
 02507   860   NtProtectVirtualMemory  (-1, (0x74721000), 4096, 32, ... (0x74721000), 4096, 4, ) == 0x0
 02508   860   NtFlushInstructionCache  (-1, 1953632256, 928, ... ) == 0x0
 02509   860   NtProtectVirtualMemory  (-1, (0x74721000), 928, 4, ... (0x74721000), 4096, 32, ) == 0x0
 02510   860   NtProtectVirtualMemory  (-1, (0x74721000), 4096, 32, ... (0x74721000), 4096, 4, ) == 0x0
 02511   860   NtFlushInstructionCache  (-1, 1953632256, 928, ... ) == 0x0
 02512   860   NtProtectVirtualMemory  (-1, (0x74721000), 928, 4, ... (0x74721000), 4096, 32, ) == 0x0
 02513   860   NtProtectVirtualMemory  (-1, (0x74721000), 4096, 32, ... (0x74721000), 4096, 4, ) == 0x0
 02514   860   NtFlushInstructionCache  (-1, 1953632256, 928, ... ) == 0x0
 02515   860   NtProtectVirtualMemory  (-1, (0x74721000), 928, 4, ... (0x74721000), 4096, 32, ) == 0x0
 02516   860   NtProtectVirtualMemory  (-1, (0x74721000), 4096, 32, ... (0x74721000), 4096, 4, ) == 0x0
 02517   860   NtFlushInstructionCache  (-1, 1953632256, 928, ... ) == 0x0
 02518   860   NtOpenKey  (0x80000000, {24, 0, 0x40, 0, 0,  (0x80000000, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MSCTF.dll"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02519   860   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\ntdll.dll"}, 1235268, ... ) }, 1235268, ... ) == 0x0
 02520   860   NtQueryInformationProcess  (-1, Wow64, 4, ... {process info, class 26, size 4}, 0x0, ) == 0x0
 02521   860   NtUserCallOneParam  (0, 40, ... ) == 0x4090409
 02522   860   NtUserRegisterWindowMessage  ( ("MSUIM.Msg.Private", ... ) , ... ) == 0xc0a1
 02523   860   NtUserRegisterWindowMessage  ( ("MSUIM.Msg.SetFocus", ... ) , ... ) == 0xc0a2
 02524   860   NtUserRegisterWindowMessage  ( ("MSUIM.Msg.ThreadTerminate", ... ) , ... ) == 0xc0a3
 02525   860   NtUserRegisterWindowMessage  ( ("MSUIM.Msg.ThreadItemChange", ... ) , ... ) == 0xc0a4
 02526   860   NtUserRegisterWindowMessage  ( ("MSUIM.Msg.LangBarModal", ... ) , ... ) == 0xc0a5
 02527   860   NtUserRegisterWindowMessage  ( ("MSUIM.Msg.RpcSendReceive", ... ) , ... ) == 0xc0a6
 02528   860   NtUserRegisterWindowMessage  ( ("MSUIM.Msg.ThreadMarshal", ... ) , ... ) == 0xc0a7
 02529   860   NtUserRegisterWindowMessage  ( ("MSUIM.Msg.CheckThreadInputIdel", ... ) , ... ) == 0xc0a8
 02530   860   NtUserRegisterWindowMessage  ( ("MSUIM.Msg.StubCleanUp", ... ) , ... ) == 0xc0a9
 02531   860   NtUserRegisterWindowMessage  ( ("MSUIM.Msg.ShowFloating", ... ) , ... ) == 0xc0aa
 02532   860   NtUserRegisterWindowMessage  ( ("MSUIM.Msg.LBUpdate", ... ) , ... ) == 0xc0ab
 02533   860   NtUserRegisterWindowMessage  ( ("MSUIM.Msg.MuiMgrDirtyUpdate", ... ) , ... ) == 0xc0ac
 02534   860   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\imm32.dll"}, 1235276, ... ) }, 1235276, ... ) == 0x0
 02535   860   NtRequestWaitReplyPort  (24, {24, 52, new_msg, 0, 3998, 1237668, 0, 0}  (24, {24, 52, new_msg, 0, 3998, 1237668, 0, 0} "\0\0\0\0\5\4\3\0\0\0\0\0\1\0\0\0\\3\0\0\0\0\0\0" ... {24, 52, reply, 0, 464, 860, 58151, 0} "\0\0\0\0\5\4\3\0\0\0\0\0\1\0\0\0\\3\0\0\0\0\0\0" )  ... {24, 52, reply, 0, 464, 860, 58151, 0}  (24, {24, 52, new_msg, 0, 3998, 1237668, 0, 0} "\0\0\0\0\5\4\3\0\0\0\0\0\1\0\0\0\\3\0\0\0\0\0\0" ... {24, 52, reply, 0, 464, 860, 58151, 0} "\0\0\0\0\5\4\3\0\0\0\0\0\1\0\0\0\\3\0\0\0\0\0\0" )  ) == 0x0
 02536   860   NtUserGetThreadDesktop  (860, 0, ... ) == 0x24
 02537   860   NtUserGetObjectInformation  (36, 2, 1375248, 520, 1237576, ... ) == 0x1
 02538   860   NtOpenProcessToken  (-1, 0x8, ... 120, ) == 0x0
 02539   860   NtQueryInformationToken  (120, User, 0, ... ) == STATUS_BUFFER_TOO_SMALL
 02540   860   NtQueryInformationToken  (120, User, 36, ... {token info, class 1, size 36}, 36, ) == 0x0
 02541   860   NtClose  (120, ... ) == 0x0
 02542   860   NtCreateSection  (0xf0007, {24, 48, 0x80, 0, 0,  (0xf0007, {24, 48, 0x80, 0, 0, "CiceroSharedMemDefaultS-1-5-21-1292428093-1383384898-725345543-1003"}, {3240, 0}, 4, 134217728, 0, ... 120, ) }, {3240, 0}, 4, 134217728, 0, ... 120, ) == STATUS_OBJECT_NAME_EXISTS
 02543   860   NtMapViewOfSection  (120, -1, (0x0), 0, 0, {0, 0}, 0, 1, 0, 4, ... (0x370000), {0, 0}, 4096, ) == 0x0
 02544   860   NtOpenKey  (0x20019, {24, 16, 0x40, 0, 0,  (0x20019, {24, 16, 0x40, 0, 0, "SOFTWARE\Microsoft\CTF\Compatibility\packed.exe"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02545   860   NtOpenKey  (0x20019, {24, 16, 0x40, 0, 0,  (0x20019, {24, 16, 0x40, 0, 0, "SOFTWARE\Microsoft\CTF\SystemShared\"}, ... 152, ) }, ... 152, ) == 0x0
 02546   860   NtQueryValueKey  (152,  (152, "CUAS", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (152, "CUAS", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) }, 16, ) == 0x0
 02547   860   NtClose  (152, ... ) == 0x0
 02548   860   NtUserFindExistingCursorIcon  (1237108, 1237124, 1237172, ... ) == 0x10011
 02549   860   NtUserRegisterClassExWOW  (1237380, 1237476, 1237460, 1237448, 0, 386, 0, ... ) == 0x816ec0ad
 02550   860   NtCreateMutant  (0x1f0001, {24, 48, 0x80, 0, 0,  (0x1f0001, {24, 48, 0x80, 0, 0, "CTF.LBES.MutexDefaultS-1-5-21-1292428093-1383384898-725345543-1003"}, 0, ... 152, ) }, 0, ... 152, ) == STATUS_OBJECT_NAME_EXISTS
 02551   860   NtCreateMutant  (0x1f0001, {24, 48, 0x80, 0, 0,  (0x1f0001, {24, 48, 0x80, 0, 0, "CTF.Compart.MutexDefaultS-1-5-21-1292428093-1383384898-725345543-1003"}, 0, ... 140, ) }, 0, ... 140, ) == STATUS_OBJECT_NAME_EXISTS
 02552   860   NtCreateMutant  (0x1f0001, {24, 48, 0x80, 0, 0,  (0x1f0001, {24, 48, 0x80, 0, 0, "CTF.Asm.MutexDefaultS-1-5-21-1292428093-1383384898-725345543-1003"}, 0, ... 128, ) }, 0, ... 128, ) == STATUS_OBJECT_NAME_EXISTS
 02553   860   NtCreateMutant  (0x1f0001, {24, 48, 0x80, 0, 0,  (0x1f0001, {24, 48, 0x80, 0, 0, "CTF.Layouts.MutexDefaultS-1-5-21-1292428093-1383384898-725345543-1003"}, 0, ... 132, ) }, 0, ... 132, ) == STATUS_OBJECT_NAME_EXISTS
 02554   860   NtCreateMutant  (0x1f0001, {24, 48, 0x80, 0, 0,  (0x1f0001, {24, 48, 0x80, 0, 0, "CTF.TMD.MutexDefaultS-1-5-21-1292428093-1383384898-725345543-1003"}, 0, ... 112, ) }, 0, ... 112, ) == STATUS_OBJECT_NAME_EXISTS
 02555   860   NtOpenKey  (0x20019, {24, 60, 0x40, 0, 0,  (0x20019, {24, 60, 0x40, 0, 0, "Keyboard Layout\Toggle"}, ... 124, ) }, ... 124, ) == 0x0
 02556   860   NtQueryValueKey  (124,  (124, "Language Hotkey", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02557   860   NtQueryValueKey  (124,  (124, "Hotkey", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02558   860   NtQueryValueKey  (124,  (124, "Layout Hotkey", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02559   860   NtClose  (124, ... ) == 0x0
 02560   860   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\KERNEL32.dll"}, 1235096, ... ) }, 1235096, ... ) == 0x0
 02561   860   NtQueryDefaultUILanguage  (1237656, ...
 02562   860   NtOpenThreadTokenEx  (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN
 02563   860   NtOpenProcessTokenEx  (-1, 0x20008, 512, ... -2147482740, ) == 0x0
 02564   860   NtQueryInformationToken  (-2147482740, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0
 02565   860   NtClose  (-2147482740, ... ) == 0x0
 02566   860   NtOpenKey  (0x2000000, {24, 0, 0x640, 0, 0,  (0x2000000, {24, 0, 0x640, 0, 0, "\REGISTRY\USER\S-1-5-21-1292428093-1383384898-725345543-1003"}, ... -2147482740, ) }, ... -2147482740, ) == 0x0
 02567   860   NtOpenKey  (0x80000000, {24, -2147482740, 0x240, 0, 0,  (0x80000000, {24, -2147482740, 0x240, 0, 0, "Software\Policies\Microsoft\Control Panel\Desktop"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02568   860   NtOpenKey  (0x80000000, {24, -2147482740, 0x640, 0, 0,  (0x80000000, {24, -2147482740, 0x640, 0, 0, "Control Panel\Desktop"}, ... -2147482656, ) }, ... -2147482656, ) == 0x0
 02569   860   NtQueryValueKey  (-2147482656,  (-2147482656, "MultiUILanguageId", Partial, 256, ... ) , Partial, 256, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02570   860   NtClose  (-2147482656, ... ) == 0x0
 02571   860   NtClose  (-2147482740, ... ) == 0x0
 02561   860   NtQueryDefaultUILanguage  ... ) == 0x0
 02572   860   NtOpenKey  (0x20019, {24, 16, 0x40, 0, 0,  (0x20019, {24, 16, 0x40, 0, 0, "SOFTWARE\Microsoft\CTF\"}, ... 124, ) }, ... 124, ) == 0x0
 02573   860   NtQueryValueKey  (124,  (124, "EnableAnchorContext", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02574   860   NtClose  (124, ... ) == 0x0
 02575   860   NtCreateMutant  (0x1f0001, {24, 48, 0x80, 0, 0,  (0x1f0001, {24, 48, 0x80, 0, 0, "CTF.TimListCache.FMPDefaultS-1-5-21-1292428093-1383384898-725345543-1003MUTEX.DefaultS-1-5-21-1292428093-1383384898-725345543-1003"}, 0, ... 124, ) }, 0, ... 124, ) == STATUS_OBJECT_NAME_EXISTS
 02576   860   NtOpenSection  (0xf001f, {24, 48, 0x0, 0, 0,  (0xf001f, {24, 48, 0x0, 0, 0, "CTF.TimListCache.FMPDefaultS-1-5-21-1292428093-1383384898-725345543-1003SFM.DefaultS-1-5-21-1292428093-1383384898-725345543-1003"}, ... 116, ) }, ... 116, ) == 0x0
 02577   860   NtMapViewOfSection  (116, -1, (0x0), 0, 0, {0, 0}, 0, 1, 0, 4, ... (0x970000), {0, 0}, 262144, ) == 0x0
 02578   860   NtWaitForSingleObject  (124, 0, {-50000000, -1}, ... ) == 0x0
 02579   860   NtReleaseMutant  (124, ... 0x0, ) == 0x0
 02580   860   NtWaitForSingleObject  (124, 0, {-50000000, -1}, ... ) == 0x0
 02581   860   NtReleaseMutant  (124, ... 0x0, ) == 0x0
 02582   860   NtWaitForSingleObject  (124, 0, {-50000000, -1}, ... ) == 0x0
 02583   860   NtReleaseMutant  (124, ... 0x0, ) == 0x0
 02584   860   NtUserSetWindowsHookEx  (1953628160, 1239132, 860, 2, 1953694283, 2, ... ) == 0x602a3
 02585   860   NtUserSetWindowsHookEx  (1953628160, 1239132, 860, 7, 1953693577, 2, ... ) == 0x601e3
 02586   860   NtUserSetWindowFNID  (1638670, 676, ... ) == 0x1
 02587   860   NtUserCallHwndParam  (1638670, 1375860, 79, ... ) == 0x14fe74
 02588   860   NtUserMessageCall  (0x19010e, WM_NCCREATE, 0x0, 0x12ebec, 0, 670, 0, ... ) == 0x1
 02589   860   NtUserSetWindowFNID  (459088, 681, ... ) == 0x1
 02590   860   NtUserSetWindowLong  (459088, 0, 1339224, 0, ... ) == 0x0
 02591   860   NtOpenKey  (0x2000000, {24, 16, 0x40, 0, 0,  (0x2000000, {24, 16, 0x40, 0, 0, "Software\Microsoft\Windows NT\CurrentVersion\IMM"}, ... 108, ) }, ... 108, ) == 0x0
 02592   860   NtQueryValueKey  (108,  (108, "Ime File", Partial, 144, ... TitleIdx=0, Type=1, Data="m\0s\0c\0t\0f\0i\0m\0e\0.\0i\0m\0e\0\0\0"}, 38, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (108, "Ime File", Partial, 144, ... TitleIdx=0, Type=1, Data="m\0s\0c\0t\0f\0i\0m\0e\0.\0i\0m\0e\0\0\0"}, 38, ) }, 38, ) == 0x0
 02593   860   NtClose  (108, ... ) == 0x0
 02594   860   NtQueryInformationProcess  (-1, DefaultHardErrorMode, 4, ... {process info, class 12, size 4}, 0x0, ) == 0x0
 02595   860   NtSetInformationProcess  (-1, DefaultHardErrorMode, {process info, class 12, size 4}, 4, ... ) == 0x0
 02596   860   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\msctfime.ime"}, 1236396, ... ) }, 1236396, ... ) == 0x0
 02597   860   NtOpenFile  (0x100020, {24, 0, 0x40, 0, 0,  (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\msctfime.ime"}, 5, 96, ... 108, {status=0x0, info=1}, ) }, 5, 96, ... 108, {status=0x0, info=1}, ) == 0x0
 02598   860   NtCreateSection  (0xe, 0x0, 0x0, 16, 134217728, 108, ... 148, ) == 0x0
 02599   860   NtClose  (108, ... ) == 0x0
 02600   860   NtMapViewOfSection  (148, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 16, ... (0x3d0000), 0x0, 180224, ) == 0x0
 02601   860   NtClose  (148, ... ) == 0x0
 02602   860   NtUnmapViewOfSection  (-1, 0x3d0000, ... ) == 0x0
 02603   860   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\msctfime.ime"}, 1235992, ... ) }, 1235992, ... ) == 0x0
 02604   860   NtCreateFile  (0x80100080, {24, 0, 0x40, 0, 1236736,  (0x80100080, {24, 0, 0x40, 0, 1236736, "\??\C:\WINDOWS\system32\msctfime.ime"}, 0x0, 0, 5, 1, 96, 0, 0, ... 148, {status=0x0, info=1}, ) }, 0x0, 0, 5, 1, 96, 0, 0, ... 148, {status=0x0, info=1}, ) == 0x0
 02605   860   NtCreateSection  (0xf0005, 0x0, 0x0, 2, 134217728, 148, ... 108, ) == 0x0
 02606   860   NtClose  (148, ... ) == 0x0
 02607   860   NtMapViewOfSection  (108, -1, (0x0), 0, 0, {0, 0}, 0, 1, 0, 2, ... (0x3d0000), {0, 0}, 180224, ) == 0x0
 02608   860   NtClose  (108, ... ) == 0x0
 02609   860   NtQueryInformationProcess  (-1, DefaultHardErrorMode, 4, ... {process info, class 12, size 4}, 0x0, ) == 0x0
 02610   860   NtSetInformationProcess  (-1, DefaultHardErrorMode, {process info, class 12, size 4}, 4, ... ) == 0x0
 02611   860   NtQueryDefaultLocale  (1, 1237356, ... ) == 0x0
 02612   860   NtQueryVirtualMemory  (-1, 0x3d0000, Basic, 28, ... {BaseAddress=0x3d0000,AllocationBase=0x3d0000,AllocationProtect=0x2,RegionSize=0x2c000,State=0x1000,Protect=0x2,Type=0x40000,}, 0x0, ) == 0x0
 02613   860   NtQueryVirtualMemory  (-1, 0x3d0000, Basic, 28, ... {BaseAddress=0x3d0000,AllocationBase=0x3d0000,AllocationProtect=0x2,RegionSize=0x2c000,State=0x1000,Protect=0x2,Type=0x40000,}, 0x0, ) == 0x0
 02614   860   NtUnmapViewOfSection  (-1, 0x3d0000, ... ) == 0x0
 02615   860   NtQueryInformationProcess  (-1, DefaultHardErrorMode, 4, ... {process info, class 12, size 4}, 0x0, ) == 0x0
 02616   860   NtSetInformationProcess  (-1, DefaultHardErrorMode, {process info, class 12, size 4}, 4, ... ) == 0x0
 02617   860   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\msctfime.ime"}, 1236388, ... ) }, 1236388, ... ) == 0x0
 02618   860   NtOpenFile  (0x100020, {24, 0, 0x40, 0, 0,  (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\msctfime.ime"}, 5, 96, ... 108, {status=0x0, info=1}, ) }, 5, 96, ... 108, {status=0x0, info=1}, ) == 0x0
 02619   860   NtCreateSection  (0xe, 0x0, 0x0, 16, 134217728, 108, ... 148, ) == 0x0
 02620   860   NtClose  (108, ... ) == 0x0
 02621   860   NtMapViewOfSection  (148, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 16, ... (0x3d0000), 0x0, 180224, ) == 0x0
 02622   860   NtClose  (148, ... ) == 0x0
 02623   860   NtUnmapViewOfSection  (-1, 0x3d0000, ... ) == 0x0
 02624   860   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\msctfime.ime"}, 1235984, ... ) }, 1235984, ... ) == 0x0
 02625   860   NtCreateFile  (0x80100080, {24, 0, 0x40, 0, 1236728,  (0x80100080, {24, 0, 0x40, 0, 1236728, "\??\C:\WINDOWS\system32\msctfime.ime"}, 0x0, 0, 5, 1, 96, 0, 0, ... 148, {status=0x0, info=1}, ) }, 0x0, 0, 5, 1, 96, 0, 0, ... 148, {status=0x0, info=1}, ) == 0x0
 02626   860   NtCreateSection  (0xf0005, 0x0, 0x0, 2, 134217728, 148, ... 108, ) == 0x0
 02627   860   NtClose  (148, ... ) == 0x0
 02628   860   NtMapViewOfSection  (108, -1, (0x0), 0, 0, {0, 0}, 0, 1, 0, 2, ... (0x3d0000), {0, 0}, 180224, ) == 0x0
 02629   860   NtClose  (108, ... ) == 0x0
 02630   860   NtQueryInformationProcess  (-1, DefaultHardErrorMode, 4, ... {process info, class 12, size 4}, 0x0, ) == 0x0
 02631   860   NtSetInformationProcess  (-1, DefaultHardErrorMode, {process info, class 12, size 4}, 4, ... ) == 0x0
 02632   860   NtQueryDefaultLocale  (1, 1237348, ... ) == 0x0
 02633   860   NtQueryVirtualMemory  (-1, 0x3d0000, Basic, 28, ... {BaseAddress=0x3d0000,AllocationBase=0x3d0000,AllocationProtect=0x2,RegionSize=0x2c000,State=0x1000,Protect=0x2,Type=0x40000,}, 0x0, ) == 0x0
 02634   860   NtUnmapViewOfSection  (-1, 0x3d0000, ... ) == 0x0
 02635   860   NtWaitForSingleObject  (184, 0, {-1000000, -1}, ... ) == 0x0
 02636   860   NtOpenThreadTokenEx  (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN
 02637   860   NtOpenProcessTokenEx  (-1, 0x20008, 512, ... 108, ) == 0x0
 02638   860   NtQueryInformationToken  (108, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0
 02639   860   NtClose  (108, ... ) == 0x0
 02640   860   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\REGISTRY\USER\S-1-5-21-1292428093-1383384898-725345543-1003\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Layers"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02641   860   NtReleaseMutant  (184, ... 0x0, ) == 0x0
 02642   860   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\msctfime.ime"}, 1236368, ... ) }, 1236368, ... ) == 0x0
 02643   860   NtOpenFile  (0x100020, {24, 0, 0x40, 0, 0,  (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\msctfime.ime"}, 5, 96, ... 108, {status=0x0, info=1}, ) }, 5, 96, ... 108, {status=0x0, info=1}, ) == 0x0
 02644   860   NtCreateSection  (0xe, 0x0, 0x0, 16, 134217728, 108, ... 148, ) == 0x0
 02645   860   NtClose  (108, ... ) == 0x0
 02646   860   NtMapViewOfSection  (148, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 16, ... (0x3d0000), 0x0, 180224, ) == 0x0
 02647   860   NtClose  (148, ... ) == 0x0
 02648   860   NtUnmapViewOfSection  (-1, 0x3d0000, ... ) == 0x0
 02649   860   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\msctfime.ime"}, 1236676, ... ) }, 1236676, ... ) == 0x0
 02650   860   NtOpenFile  (0x100020, {24, 0, 0x40, 0, 0,  (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\msctfime.ime"}, 5, 96, ... 148, {status=0x0, info=1}, ) }, 5, 96, ... 148, {status=0x0, info=1}, ) == 0x0
 02651   860   NtCreateSection  (0xf, 0x0, 0x0, 16, 16777216, 148, ... 108, ) == 0x0
 02652   860   NtQuerySection  (108, Image, 48, ... {section info, class 1, size 48}, 0x0, ) == 0x0
 02653   860   NtClose  (148, ... ) == 0x0
 02654   860   NtMapViewOfSection  (108, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x755c0000), 0x0, 188416, ) == 0x0
 02655   860   NtClose  (108, ... ) == 0x0
 02656   860   NtProtectVirtualMemory  (-1, (0x755c1000), 860, 4, ... (0x755c1000), 4096, 32, ) == 0x0
 02657   860   NtProtectVirtualMemory  (-1, (0x755c1000), 4096, 32, ... (0x755c1000), 4096, 4, ) == 0x0
 02658   860   NtFlushInstructionCache  (-1, 1968967680, 860, ... ) == 0x0
 02659   860   NtProtectVirtualMemory  (-1, (0x755c1000), 860, 4, ... (0x755c1000), 4096, 32, ) == 0x0
 02660   860   NtProtectVirtualMemory  (-1, (0x755c1000), 4096, 32, ... (0x755c1000), 4096, 4, ) == 0x0
 02661   860   NtFlushInstructionCache  (-1, 1968967680, 860, ... ) == 0x0
 02662   860   NtProtectVirtualMemory  (-1, (0x755c1000), 860, 4, ... (0x755c1000), 4096, 32, ) == 0x0
 02663   860   NtProtectVirtualMemory  (-1, (0x755c1000), 4096, 32, ... (0x755c1000), 4096, 4, ) == 0x0
 02664   860   NtFlushInstructionCache  (-1, 1968967680, 860, ... ) == 0x0
 02665   860   NtProtectVirtualMemory  (-1, (0x755c1000), 860, 4, ... (0x755c1000), 4096, 32, ) == 0x0
 02666   860   NtProtectVirtualMemory  (-1, (0x755c1000), 4096, 32, ... (0x755c1000), 4096, 4, ) == 0x0
 02667   860   NtFlushInstructionCache  (-1, 1968967680, 860, ... ) == 0x0
 02668   860   NtProtectVirtualMemory  (-1, (0x755c1000), 860, 4, ... (0x755c1000), 4096, 32, ) == 0x0
 02669   860   NtProtectVirtualMemory  (-1, (0x755c1000), 4096, 32, ... (0x755c1000), 4096, 4, ) == 0x0
 02670   860   NtFlushInstructionCache  (-1, 1968967680, 860, ... ) == 0x0
 02671   860   NtProtectVirtualMemory  (-1, (0x755c1000), 860, 4, ... (0x755c1000), 4096, 32, ) == 0x0
 02672   860   NtProtectVirtualMemory  (-1, (0x755c1000), 4096, 32, ... (0x755c1000), 4096, 4, ) == 0x0
 02673   860   NtFlushInstructionCache  (-1, 1968967680, 860, ... ) == 0x0
 02674   860   NtOpenKey  (0x80000000, {24, 0, 0x40, 0, 0,  (0x80000000, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msctfime.ime"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02675   860   NtUserGetDC  (0, ... ) == 0x1010054
 02676   860   NtUserSystemParametersInfo  (66, 12, 1236864, 0, ... ) == 0x1
 02677   860   NtUserCallOneParam  (16842836, 57, ... ) == 0x1
 02678   860   NtQueryVirtualMemory  (-1, 0x7c91ca50, Basic, 28, ... {BaseAddress=0x7c91c000,AllocationBase=0x7c900000,AllocationProtect=0x80,RegionSize=0x60000,State=0x1000,Protect=0x20,Type=0x1000000,}, 28, ) == 0x0
 02679   860   NtQueryVirtualMemory  (-1, 0x7c9163a8, Basic, 28, ... {BaseAddress=0x7c916000,AllocationBase=0x7c900000,AllocationProtect=0x80,RegionSize=0x66000,State=0x1000,Protect=0x20,Type=0x1000000,}, 28, ) == 0x0
 02680   860   NtQueryDebugFilterState  (87, 3, ... ) == 0x0
 02681   860   NtQueryDebugFilterState  (87, 3, ... ) == 0x0
 02682   860   NtContinue  (1235068, 0, ...
 02683   860   NtQueryDebugFilterState  (87, 3, ... ) == 0x0
 02684   860   NtUnmapViewOfSection  (-1, 0x755c0000, ... ) == 0x0
 02685   860   NtQueryDebugFilterState  (87, 3, ... ) == 0x0
 02686   860   NtUserMessageCall  (0x70150, WM_NCCREATE, 0x0, 0x12ebd0, 0, 670, 0, ... ) == 0x1
 02687   860   NtOpenKey  (0x2000000, {24, 16, 0x40, 0, 0,  (0x2000000, {24, 16, 0x40, 0, 0, "Software\Microsoft\Windows NT\CurrentVersion\IMM"}, ... 108, ) }, ... 108, ) == 0x0
 02688   860   NtQueryValueKey  (108,  (108, "Ime File", Partial, 144, ... TitleIdx=0, Type=1, Data="m\0s\0c\0t\0f\0i\0m\0e\0.\0i\0m\0e\0\0\0"}, 38, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (108, "Ime File", Partial, 144, ... TitleIdx=0, Type=1, Data="m\0s\0c\0t\0f\0i\0m\0e\0.\0i\0m\0e\0\0\0"}, 38, ) }, 38, ) == 0x0
 02689   860   NtClose  (108, ... ) == 0x0
 02690   860   NtQueryInformationProcess  (-1, DefaultHardErrorMode, 4, ... {process info, class 12, size 4}, 0x0, ) == 0x0
 02691   860   NtSetInformationProcess  (-1, DefaultHardErrorMode, {process info, class 12, size 4}, 4, ... ) == 0x0
 02692   860   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\msctfime.ime"}, 1236492, ... ) }, 1236492, ... ) == 0x0
 02693   860   NtOpenFile  (0x100020, {24, 0, 0x40, 0, 0,  (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\msctfime.ime"}, 5, 96, ... 108, {status=0x0, info=1}, ) }, 5, 96, ... 108, {status=0x0, info=1}, ) == 0x0
 02694   860   NtCreateSection  (0xe, 0x0, 0x0, 16, 134217728, 108, ... 148, ) == 0x0
 02695   860   NtClose  (108, ... ) == 0x0
 02696   860   NtMapViewOfSection  (148, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 16, ... (0x3d0000), 0x0, 180224, ) == 0x0
 02697   860   NtClose  (148, ... ) == 0x0
 02698   860   NtUnmapViewOfSection  (-1, 0x3d0000, ... ) == 0x0
 02699   860   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\msctfime.ime"}, 1236088, ... ) }, 1236088, ... ) == 0x0
 02700   860   NtCreateFile  (0x80100080, {24, 0, 0x40, 0, 1236832,  (0x80100080, {24, 0, 0x40, 0, 1236832, "\??\C:\WINDOWS\system32\msctfime.ime"}, 0x0, 0, 5, 1, 96, 0, 0, ... 148, {status=0x0, info=1}, ) }, 0x0, 0, 5, 1, 96, 0, 0, ... 148, {status=0x0, info=1}, ) == 0x0
 02701   860   NtCreateSection  (0xf0005, 0x0, 0x0, 2, 134217728, 148, ... 108, ) == 0x0
 02702   860   NtClose  (148, ... ) == 0x0
 02703   860   NtMapViewOfSection  (108, -1, (0x0), 0, 0, {0, 0}, 0, 1, 0, 2, ... (0x3d0000), {0, 0}, 180224, ) == 0x0
 02704   860   NtClose  (108, ... ) == 0x0
 02705   860   NtQueryInformationProcess  (-1, DefaultHardErrorMode, 4, ... {process info, class 12, size 4}, 0x0, ) == 0x0
 02706   860   NtSetInformationProcess  (-1, DefaultHardErrorMode, {process info, class 12, size 4}, 4, ... ) == 0x0
 02707   860   NtQueryDefaultLocale  (1, 1237452, ... ) == 0x0
 02708   860   NtQueryVirtualMemory  (-1, 0x3d0000, Basic, 28, ... {BaseAddress=0x3d0000,AllocationBase=0x3d0000,AllocationProtect=0x2,RegionSize=0x2c000,State=0x1000,Protect=0x2,Type=0x40000,}, 0x0, ) == 0x0
 02709   860   NtQueryVirtualMemory  (-1, 0x3d0000, Basic, 28, ... {BaseAddress=0x3d0000,AllocationBase=0x3d0000,AllocationProtect=0x2,RegionSize=0x2c000,State=0x1000,Protect=0x2,Type=0x40000,}, 0x0, ) == 0x0
 02710   860   NtUnmapViewOfSection  (-1, 0x3d0000, ... ) == 0x0
 02711   860   NtQueryInformationProcess  (-1, DefaultHardErrorMode, 4, ... {process info, class 12, size 4}, 0x0, ) == 0x0
 02712   860   NtSetInformationProcess  (-1, DefaultHardErrorMode, {process info, class 12, size 4}, 4, ... ) == 0x0
 02713   860   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\msctfime.ime"}, 1236484, ... ) }, 1236484, ... ) == 0x0
 02714   860   NtOpenFile  (0x100020, {24, 0, 0x40, 0, 0,  (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\msctfime.ime"}, 5, 96, ... 108, {status=0x0, info=1}, ) }, 5, 96, ... 108, {status=0x0, info=1}, ) == 0x0
 02715   860   NtCreateSection  (0xe, 0x0, 0x0, 16, 134217728, 108, ... 148, ) == 0x0
 02716   860   NtClose  (108, ... ) == 0x0
 02717   860   NtMapViewOfSection  (148, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 16, ... (0x3d0000), 0x0, 180224, ) == 0x0
 02718   860   NtClose  (148, ... ) == 0x0
 02719   860   NtUnmapViewOfSection  (-1, 0x3d0000, ... ) == 0x0
 02720   860   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\msctfime.ime"}, 1236080, ... ) }, 1236080, ... ) == 0x0
 02721   860   NtCreateFile  (0x80100080, {24, 0, 0x40, 0, 1236824,  (0x80100080, {24, 0, 0x40, 0, 1236824, "\??\C:\WINDOWS\system32\msctfime.ime"}, 0x0, 0, 5, 1, 96, 0, 0, ... 148, {status=0x0, info=1}, ) }, 0x0, 0, 5, 1, 96, 0, 0, ... 148, {status=0x0, info=1}, ) == 0x0
 02722   860   NtCreateSection  (0xf0005, 0x0, 0x0, 2, 134217728, 148, ... 108, ) == 0x0
 02723   860   NtClose  (148, ... ) == 0x0
 02724   860   NtMapViewOfSection  (108, -1, (0x0), 0, 0, {0, 0}, 0, 1, 0, 2, ... (0x3d0000), {0, 0}, 180224, ) == 0x0
 02725   860   NtClose  (108, ... ) == 0x0
 02726   860   NtQueryInformationProcess  (-1, DefaultHardErrorMode, 4, ... {process info, class 12, size 4}, 0x0, ) == 0x0
 02727   860   NtSetInformationProcess  (-1, DefaultHardErrorMode, {process info, class 12, size 4}, 4, ... ) == 0x0
 02728   860   NtQueryDefaultLocale  (1, 1237444, ... ) == 0x0
 02729   860   NtQueryVirtualMemory  (-1, 0x3d0000, Basic, 28, ... {BaseAddress=0x3d0000,AllocationBase=0x3d0000,AllocationProtect=0x2,RegionSize=0x2c000,State=0x1000,Protect=0x2,Type=0x40000,}, 0x0, ) == 0x0
 02730   860   NtUnmapViewOfSection  (-1, 0x3d0000, ... ) == 0x0
 02731   860   NtWaitForSingleObject  (184, 0, {-1000000, -1}, ... ) == 0x0
 02732   860   NtOpenThreadTokenEx  (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN
 02733   860   NtOpenProcessTokenEx  (-1, 0x20008, 512, ... 108, ) == 0x0
 02734   860   NtQueryInformationToken  (108, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0
 02735   860   NtClose  (108, ... ) == 0x0
 02736   860   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\REGISTRY\USER\S-1-5-21-1292428093-1383384898-725345543-1003\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Layers"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02737   860   NtReleaseMutant  (184, ... 0x0, ) == 0x0
 02738   860   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\msctfime.ime"}, 1236464, ... ) }, 1236464, ... ) == 0x0
 02739   860   NtOpenFile  (0x100020, {24, 0, 0x40, 0, 0,  (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\msctfime.ime"}, 5, 96, ... 108, {status=0x0, info=1}, ) }, 5, 96, ... 108, {status=0x0, info=1}, ) == 0x0
 02740   860   NtCreateSection  (0xe, 0x0, 0x0, 16, 134217728, 108, ... 148, ) == 0x0
 02741   860   NtClose  (108, ... ) == 0x0
 02742   860   NtMapViewOfSection  (148, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 16, ... (0x3d0000), 0x0, 180224, ) == 0x0
 02743   860   NtClose  (148, ... ) == 0x0
 02744   860   NtUnmapViewOfSection  (-1, 0x3d0000, ... ) == 0x0
 02745   860   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\msctfime.ime"}, 1236772, ... ) }, 1236772, ... ) == 0x0
 02746   860   NtOpenFile  (0x100020, {24, 0, 0x40, 0, 0,  (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\msctfime.ime"}, 5, 96, ... 148, {status=0x0, info=1}, ) }, 5, 96, ... 148, {status=0x0, info=1}, ) == 0x0
 02747   860   NtCreateSection  (0xf, 0x0, 0x0, 16, 16777216, 148, ... 108, ) == 0x0
 02748   860   NtQuerySection  (108, Image, 48, ... {section info, class 1, size 48}, 0x0, ) == 0x0
 02749   860   NtClose  (148, ... ) == 0x0
 02750   860   NtMapViewOfSection  (108, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x755c0000), 0x0, 188416, ) == 0x0
 02751   860   NtClose  (108, ... ) == 0x0
 02752   860   NtProtectVirtualMemory  (-1, (0x755c1000), 860, 4, ... (0x755c1000), 4096, 32, ) == 0x0
 02753   860   NtProtectVirtualMemory  (-1, (0x755c1000), 4096, 32, ... (0x755c1000), 4096, 4, ) == 0x0
 02754   860   NtFlushInstructionCache  (-1, 1968967680, 860, ... ) == 0x0
 02755   860   NtProtectVirtualMemory  (-1, (0x755c1000), 860, 4, ... (0x755c1000), 4096, 32, ) == 0x0
 02756   860   NtProtectVirtualMemory  (-1, (0x755c1000), 4096, 32, ... (0x755c1000), 4096, 4, ) == 0x0
 02757   860   NtFlushInstructionCache  (-1, 1968967680, 860, ... ) == 0x0
 02758   860   NtProtectVirtualMemory  (-1, (0x755c1000), 860, 4, ... (0x755c1000), 4096, 32, ) == 0x0
 02759   860   NtProtectVirtualMemory  (-1, (0x755c1000), 4096, 32, ... (0x755c1000), 4096, 4, ) == 0x0
 02760   860   NtFlushInstructionCache  (-1, 1968967680, 860, ... ) == 0x0
 02761   860   NtProtectVirtualMemory  (-1, (0x755c1000), 860, 4, ... (0x755c1000), 4096, 32, ) == 0x0
 02762   860   NtProtectVirtualMemory  (-1, (0x755c1000), 4096, 32, ... (0x755c1000), 4096, 4, ) == 0x0
 02763   860   NtFlushInstructionCache  (-1, 1968967680, 860, ... ) == 0x0
 02764   860   NtProtectVirtualMemory  (-1, (0x755c1000), 860, 4, ... (0x755c1000), 4096, 32, ) == 0x0
 02765   860   NtProtectVirtualMemory  (-1, (0x755c1000), 4096, 32, ... (0x755c1000), 4096, 4, ) == 0x0
 02766   860   NtFlushInstructionCache  (-1, 1968967680, 860, ... ) == 0x0
 02767   860   NtProtectVirtualMemory  (-1, (0x755c1000), 860, 4, ... (0x755c1000), 4096, 32, ) == 0x0
 02768   860   NtProtectVirtualMemory  (-1, (0x755c1000), 4096, 32, ... (0x755c1000), 4096, 4, ) == 0x0
 02769   860   NtFlushInstructionCache  (-1, 1968967680, 860, ... ) == 0x0
 02770   860   NtOpenKey  (0x80000000, {24, 0, 0x40, 0, 0,  (0x80000000, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msctfime.ime"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02771   860   NtUserGetDC  (0, ... ) == 0x1010054
 02772   860   NtUserSystemParametersInfo  (66, 12, 1236960, 0, ... ) == 0x1
 02773   860   NtUserCallOneParam  (16842836, 57, ... ) == 0x1
 02774   860   NtQueryDebugFilterState  (87, 3, ... ) == 0x0
 02775   860   NtQueryDebugFilterState  (87, 3, ... ) == 0x0
 02776   860   NtContinue  (1235164, 0, ...
 02777   860   NtQueryDebugFilterState  (87, 3, ... ) == 0x0
 02778   860   NtUnmapViewOfSection  (-1, 0x755c0000, ... ) == 0x0
 02779   860   NtQueryDebugFilterState  (87, 3, ... ) == 0x0
 02780   860   NtUserMessageCall  (0x70150, WM_NCCALCSIZE, 0x0, 0x12ec14, 0, 670, 0, ... ) == 0x0
 02781   860   NtUserSetProp  (459088, 43288, -1, ... ) == 0x1
 02782   860   NtOpenKey  (0x2000000, {24, 16, 0x40, 0, 0,  (0x2000000, {24, 16, 0x40, 0, 0, "Software\Microsoft\Windows NT\CurrentVersion\IMM"}, ... 108, ) }, ... 108, ) == 0x0
 02783   860   NtQueryValueKey  (108,  (108, "Ime File", Partial, 144, ... TitleIdx=0, Type=1, Data="m\0s\0c\0t\0f\0i\0m\0e\0.\0i\0m\0e\0\0\0"}, 38, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (108, "Ime File", Partial, 144, ... TitleIdx=0, Type=1, Data="m\0s\0c\0t\0f\0i\0m\0e\0.\0i\0m\0e\0\0\0"}, 38, ) }, 38, ) == 0x0
 02784   860   NtClose  (108, ... ) == 0x0
 02785   860   NtQueryInformationProcess  (-1, DefaultHardErrorMode, 4, ... {process info, class 12, size 4}, 0x0, ) == 0x0
 02786   860   NtSetInformationProcess  (-1, DefaultHardErrorMode, {process info, class 12, size 4}, 4, ... ) == 0x0
 02787   860   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\msctfime.ime"}, 1236396, ... ) }, 1236396, ... ) == 0x0
 02788   860   NtOpenFile  (0x100020, {24, 0, 0x40, 0, 0,  (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\msctfime.ime"}, 5, 96, ... 108, {status=0x0, info=1}, ) }, 5, 96, ... 108, {status=0x0, info=1}, ) == 0x0
 02789   860   NtCreateSection  (0xe, 0x0, 0x0, 16, 134217728, 108, ... 148, ) == 0x0
 02790   860   NtClose  (108, ... ) == 0x0
 02791   860   NtMapViewOfSection  (148, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 16, ... (0x3d0000), 0x0, 180224, ) == 0x0
 02792   860   NtClose  (148, ... ) == 0x0
 02793   860   NtUnmapViewOfSection  (-1, 0x3d0000, ... ) == 0x0
 02794   860   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\msctfime.ime"}, 1235992, ... ) }, 1235992, ... ) == 0x0
 02795   860   NtCreateFile  (0x80100080, {24, 0, 0x40, 0, 1236736,  (0x80100080, {24, 0, 0x40, 0, 1236736, "\??\C:\WINDOWS\system32\msctfime.ime"}, 0x0, 0, 5, 1, 96, 0, 0, ... 148, {status=0x0, info=1}, ) }, 0x0, 0, 5, 1, 96, 0, 0, ... 148, {status=0x0, info=1}, ) == 0x0
 02796   860   NtCreateSection  (0xf0005, 0x0, 0x0, 2, 134217728, 148, ... 108, ) == 0x0
 02797   860   NtClose  (148, ... ) == 0x0
 02798   860   NtMapViewOfSection  (108, -1, (0x0), 0, 0, {0, 0}, 0, 1, 0, 2, ... (0x3d0000), {0, 0}, 180224, ) == 0x0
 02799   860   NtClose  (108, ... ) == 0x0
 02800   860   NtQueryInformationProcess  (-1, DefaultHardErrorMode, 4, ... {process info, class 12, size 4}, 0x0, ) == 0x0
 02801   860   NtSetInformationProcess  (-1, DefaultHardErrorMode, {process info, class 12, size 4}, 4, ... ) == 0x0
 02802   860   NtQueryDefaultLocale  (1, 1237356, ... ) == 0x0
 02803   860   NtQueryVirtualMemory  (-1, 0x3d0000, Basic, 28, ... {BaseAddress=0x3d0000,AllocationBase=0x3d0000,AllocationProtect=0x2,RegionSize=0x2c000,State=0x1000,Protect=0x2,Type=0x40000,}, 0x0, ) == 0x0
 02804   860   NtQueryVirtualMemory  (-1, 0x3d0000, Basic, 28, ... {BaseAddress=0x3d0000,AllocationBase=0x3d0000,AllocationProtect=0x2,RegionSize=0x2c000,State=0x1000,Protect=0x2,Type=0x40000,}, 0x0, ) == 0x0
 02805   860   NtUnmapViewOfSection  (-1, 0x3d0000, ... ) == 0x0
 02806   860   NtQueryInformationProcess  (-1, DefaultHardErrorMode, 4, ... {process info, class 12, size 4}, 0x0, ) == 0x0
 02807   860   NtSetInformationProcess  (-1, DefaultHardErrorMode, {process info, class 12, size 4}, 4, ... ) == 0x0
 02808   860   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\msctfime.ime"}, 1236388, ... ) }, 1236388, ... ) == 0x0
 02809   860   NtOpenFile  (0x100020, {24, 0, 0x40, 0, 0,  (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\msctfime.ime"}, 5, 96, ... 108, {status=0x0, info=1}, ) }, 5, 96, ... 108, {status=0x0, info=1}, ) == 0x0
 02810   860   NtCreateSection  (0xe, 0x0, 0x0, 16, 134217728, 108, ... 148, ) == 0x0
 02811   860   NtClose  (108, ... ) == 0x0
 02812   860   NtMapViewOfSection  (148, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 16, ... (0x3d0000), 0x0, 180224, ) == 0x0
 02813   860   NtClose  (148, ... ) == 0x0
 02814   860   NtUnmapViewOfSection  (-1, 0x3d0000, ... ) == 0x0
 02815   860   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\msctfime.ime"}, 1235984, ... ) }, 1235984, ... ) == 0x0
 02816   860   NtCreateFile  (0x80100080, {24, 0, 0x40, 0, 1236728,  (0x80100080, {24, 0, 0x40, 0, 1236728, "\??\C:\WINDOWS\system32\msctfime.ime"}, 0x0, 0, 5, 1, 96, 0, 0, ... 148, {status=0x0, info=1}, ) }, 0x0, 0, 5, 1, 96, 0, 0, ... 148, {status=0x0, info=1}, ) == 0x0
 02817   860   NtCreateSection  (0xf0005, 0x0, 0x0, 2, 134217728, 148, ... 108, ) == 0x0
 02818   860   NtClose  (148, ... ) == 0x0
 02819   860   NtMapViewOfSection  (108, -1, (0x0), 0, 0, {0, 0}, 0, 1, 0, 2, ... (0x3d0000), {0, 0}, 180224, ) == 0x0
 02820   860   NtClose  (108, ... ) == 0x0
 02821   860   NtQueryInformationProcess  (-1, DefaultHardErrorMode, 4, ... {process info, class 12, size 4}, 0x0, ) == 0x0
 02822   860   NtSetInformationProcess  (-1, DefaultHardErrorMode, {process info, class 12, size 4}, 4, ... ) == 0x0
 02823   860   NtQueryDefaultLocale  (1, 1237348, ... ) == 0x0
 02824   860   NtQueryVirtualMemory  (-1, 0x3d0000, Basic, 28, ... {BaseAddress=0x3d0000,AllocationBase=0x3d0000,AllocationProtect=0x2,RegionSize=0x2c000,State=0x1000,Protect=0x2,Type=0x40000,}, 0x0, ) == 0x0
 02825   860   NtUnmapViewOfSection  (-1, 0x3d0000, ... ) == 0x0
 02826   860   NtWaitForSingleObject  (184, 0, {-1000000, -1}, ... ) == 0x0
 02827   860   NtOpenThreadTokenEx  (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN
 02828   860   NtOpenProcessTokenEx  (-1, 0x20008, 512, ... 108, ) == 0x0
 02829   860   NtQueryInformationToken  (108, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0
 02830   860   NtClose  (108, ... ) == 0x0
 02831   860   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\REGISTRY\USER\S-1-5-21-1292428093-1383384898-725345543-1003\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Layers"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02832   860   NtReleaseMutant  (184, ... 0x0, ) == 0x0
 02833   860   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\msctfime.ime"}, 1236368, ... ) }, 1236368, ... ) == 0x0
 02834   860   NtOpenFile  (0x100020, {24, 0, 0x40, 0, 0,  (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\msctfime.ime"}, 5, 96, ... 108, {status=0x0, info=1}, ) }, 5, 96, ... 108, {status=0x0, info=1}, ) == 0x0
 02835   860   NtCreateSection  (0xe, 0x0, 0x0, 16, 134217728, 108, ... 148, ) == 0x0
 02836   860   NtClose  (108, ... ) == 0x0
 02837   860   NtMapViewOfSection  (148, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 16, ... (0x3d0000), 0x0, 180224, ) == 0x0
 02838   860   NtClose  (148, ... ) == 0x0
 02839   860   NtUnmapViewOfSection  (-1, 0x3d0000, ... ) == 0x0
 02840   860   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\msctfime.ime"}, 1236676, ... ) }, 1236676, ... ) == 0x0
 02841   860   NtOpenFile  (0x100020, {24, 0, 0x40, 0, 0,  (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\msctfime.ime"}, 5, 96, ... 148, {status=0x0, info=1}, ) }, 5, 96, ... 148, {status=0x0, info=1}, ) == 0x0
 02842   860   NtCreateSection  (0xf, 0x0, 0x0, 16, 16777216, 148, ... 108, ) == 0x0
 02843   860   NtQuerySection  (108, Image, 48, ... {section info, class 1, size 48}, 0x0, ) == 0x0
 02844   860   NtClose  (148, ... ) == 0x0
 02845   860   NtMapViewOfSection  (108, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x755c0000), 0x0, 188416, ) == 0x0
 02846   860   NtClose  (108, ... ) == 0x0
 02847   860   NtProtectVirtualMemory  (-1, (0x755c1000), 860, 4, ... (0x755c1000), 4096, 32, ) == 0x0
 02848   860   NtProtectVirtualMemory  (-1, (0x755c1000), 4096, 32, ... (0x755c1000), 4096, 4, ) == 0x0
 02849   860   NtFlushInstructionCache  (-1, 1968967680, 860, ... ) == 0x0
 02850   860   NtProtectVirtualMemory  (-1, (0x755c1000), 860, 4, ... (0x755c1000), 4096, 32, ) == 0x0
 02851   860   NtProtectVirtualMemory  (-1, (0x755c1000), 4096, 32, ... (0x755c1000), 4096, 4, ) == 0x0
 02852   860   NtFlushInstructionCache  (-1, 1968967680, 860, ... ) == 0x0
 02853   860   NtProtectVirtualMemory  (-1, (0x755c1000), 860, 4, ... (0x755c1000), 4096, 32, ) == 0x0
 02854   860   NtProtectVirtualMemory  (-1, (0x755c1000), 4096, 32, ... (0x755c1000), 4096, 4, ) == 0x0
 02855   860   NtFlushInstructionCache  (-1, 1968967680, 860, ... ) == 0x0
 02856   860   NtProtectVirtualMemory  (-1, (0x755c1000), 860, 4, ... (0x755c1000), 4096, 32, ) == 0x0
 02857   860   NtProtectVirtualMemory  (-1, (0x755c1000), 4096, 32, ... (0x755c1000), 4096, 4, ) == 0x0
 02858   860   NtFlushInstructionCache  (-1, 1968967680, 860, ... ) == 0x0
 02859   860   NtProtectVirtualMemory  (-1, (0x755c1000), 860, 4, ... (0x755c1000), 4096, 32, ) == 0x0
 02860   860   NtProtectVirtualMemory  (-1, (0x755c1000), 4096, 32, ... (0x755c1000), 4096, 4, ) == 0x0
 02861   860   NtFlushInstructionCache  (-1, 1968967680, 860, ... ) == 0x0
 02862   860   NtProtectVirtualMemory  (-1, (0x755c1000), 860, 4, ... (0x755c1000), 4096, 32, ) == 0x0
 02863   860   NtProtectVirtualMemory  (-1, (0x755c1000), 4096, 32, ... (0x755c1000), 4096, 4, ) == 0x0
 02864   860   NtFlushInstructionCache  (-1, 1968967680, 860, ... ) == 0x0
 02865   860   NtOpenKey  (0x80000000, {24, 0, 0x40, 0, 0,  (0x80000000, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msctfime.ime"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02866   860   NtUserGetDC  (0, ... ) == 0x1010054
 02867   860   NtUserSystemParametersInfo  (66, 12, 1236864, 0, ... ) == 0x1
 02868   860   NtUserCallOneParam  (16842836, 57, ... ) == 0x1
 02869   860   NtQueryDebugFilterState  (87, 3, ... ) == 0x0
 02870   860   NtQueryDebugFilterState  (87, 3, ... ) == 0x0
 02871   860   NtContinue  (1235068, 0, ...
 02872   860   NtQueryDebugFilterState  (87, 3, ... ) == 0x0
 02873   860   NtUnmapViewOfSection  (-1, 0x755c0000, ... ) == 0x0
 02874   860   NtQueryDebugFilterState  (87, 3, ... ) == 0x0
 02875   860   NtUserValidateHandleSecure  (1638670, ... ) == 0x1
 02876   860   NtUserValidateHandleSecure  (7536899, ... ) == 0x1
 02877   860   NtUserValidateHandleSecure  (7536899, ... ) == 0x1
 02878   860   NtUserUpdateInputContext  (7536899, 1, 459088, ... ) == 0x1
 02879   860   NtOpenKey  (0x2000000, {24, 16, 0x40, 0, 0,  (0x2000000, {24, 16, 0x40, 0, 0, "Software\Microsoft\Windows NT\CurrentVersion\IMM"}, ... 108, ) }, ... 108, ) == 0x0
 02880   860   NtQueryValueKey  (108,  (108, "Ime File", Partial, 144, ... TitleIdx=0, Type=1, Data="m\0s\0c\0t\0f\0i\0m\0e\0.\0i\0m\0e\0\0\0"}, 38, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (108, "Ime File", Partial, 144, ... TitleIdx=0, Type=1, Data="m\0s\0c\0t\0f\0i\0m\0e\0.\0i\0m\0e\0\0\0"}, 38, ) }, 38, ) == 0x0
 02881   860   NtClose  (108, ... ) == 0x0
 02882   860   NtQueryInformationProcess  (-1, DefaultHardErrorMode, 4, ... {process info, class 12, size 4}, 0x0, ) == 0x0
 02883   860   NtSetInformationProcess  (-1, DefaultHardErrorMode, {process info, class 12, size 4}, 4, ... ) == 0x0
 02884   860   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\msctfime.ime"}, 1236504, ... ) }, 1236504, ... ) == 0x0
 02885   860   NtOpenFile  (0x100020, {24, 0, 0x40, 0, 0,  (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\msctfime.ime"}, 5, 96, ... 108, {status=0x0, info=1}, ) }, 5, 96, ... 108, {status=0x0, info=1}, ) == 0x0
 02886   860   NtCreateSection  (0xe, 0x0, 0x0, 16, 134217728, 108, ... 148, ) == 0x0
 02887   860   NtClose  (108, ... ) == 0x0
 02888   860   NtMapViewOfSection  (148, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 16, ... (0x3d0000), 0x0, 180224, ) == 0x0
 02889   860   NtClose  (148, ... ) == 0x0
 02890   860   NtUnmapViewOfSection  (-1, 0x3d0000, ... ) == 0x0
 02891   860   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\msctfime.ime"}, 1236100, ... ) }, 1236100, ... ) == 0x0
 02892   860   NtCreateFile  (0x80100080, {24, 0, 0x40, 0, 1236844,  (0x80100080, {24, 0, 0x40, 0, 1236844, "\??\C:\WINDOWS\system32\msctfime.ime"}, 0x0, 0, 5, 1, 96, 0, 0, ... 148, {status=0x0, info=1}, ) }, 0x0, 0, 5, 1, 96, 0, 0, ... 148, {status=0x0, info=1}, ) == 0x0
 02893   860   NtCreateSection  (0xf0005, 0x0, 0x0, 2, 134217728, 148, ... 108, ) == 0x0
 02894   860   NtClose  (148, ... ) == 0x0
 02895   860   NtMapViewOfSection  (108, -1, (0x0), 0, 0, {0, 0}, 0, 1, 0, 2, ... (0x3d0000), {0, 0}, 180224, ) == 0x0
 02896   860   NtClose  (108, ... ) == 0x0
 02897   860   NtQueryInformationProcess  (-1, DefaultHardErrorMode, 4, ... {process info, class 12, size 4}, 0x0, ) == 0x0
 02898   860   NtSetInformationProcess  (-1, DefaultHardErrorMode, {process info, class 12, size 4}, 4, ... ) == 0x0
 02899   860   NtQueryDefaultLocale  (1, 1237464, ... ) == 0x0
 02900   860   NtQueryVirtualMemory  (-1, 0x3d0000, Basic, 28, ... {BaseAddress=0x3d0000,AllocationBase=0x3d0000,AllocationProtect=0x2,RegionSize=0x2c000,State=0x1000,Protect=0x2,Type=0x40000,}, 0x0, ) == 0x0
 02901   860   NtQueryVirtualMemory  (-1, 0x3d0000, Basic, 28, ... {BaseAddress=0x3d0000,AllocationBase=0x3d0000,AllocationProtect=0x2,RegionSize=0x2c000,State=0x1000,Protect=0x2,Type=0x40000,}, 0x0, ) == 0x0
 02902   860   NtUnmapViewOfSection  (-1, 0x3d0000, ... ) == 0x0
 02903   860   NtQueryInformationProcess  (-1, DefaultHardErrorMode, 4, ... {process info, class 12, size 4}, 0x0, ) == 0x0
 02904   860   NtSetInformationProcess  (-1, DefaultHardErrorMode, {process info, class 12, size 4}, 4, ... ) == 0x0
 02905   860   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\msctfime.ime"}, 1236496, ... ) }, 1236496, ... ) == 0x0
 02906   860   NtOpenFile  (0x100020, {24, 0, 0x40, 0, 0,  (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\msctfime.ime"}, 5, 96, ... 108, {status=0x0, info=1}, ) }, 5, 96, ... 108, {status=0x0, info=1}, ) == 0x0
 02907   860   NtCreateSection  (0xe, 0x0, 0x0, 16, 134217728, 108, ... 148, ) == 0x0
 02908   860   NtClose  (108, ... ) == 0x0
 02909   860   NtMapViewOfSection  (148, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 16, ... (0x3d0000), 0x0, 180224, ) == 0x0
 02910   860   NtClose  (148, ... ) == 0x0
 02911   860   NtUnmapViewOfSection  (-1, 0x3d0000, ... ) == 0x0
 02912   860   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\msctfime.ime"}, 1236092, ... ) }, 1236092, ... ) == 0x0
 02913   860   NtCreateFile  (0x80100080, {24, 0, 0x40, 0, 1236836,  (0x80100080, {24, 0, 0x40, 0, 1236836, "\??\C:\WINDOWS\system32\msctfime.ime"}, 0x0, 0, 5, 1, 96, 0, 0, ... 148, {status=0x0, info=1}, ) }, 0x0, 0, 5, 1, 96, 0, 0, ... 148, {status=0x0, info=1}, ) == 0x0
 02914   860   NtCreateSection  (0xf0005, 0x0, 0x0, 2, 134217728, 148, ... 108, ) == 0x0
 02915   860   NtClose  (148, ... ) == 0x0
 02916   860   NtMapViewOfSection  (108, -1, (0x0), 0, 0, {0, 0}, 0, 1, 0, 2, ... (0x3d0000), {0, 0}, 180224, ) == 0x0
 02917   860   NtClose  (108, ... ) == 0x0
 02918   860   NtQueryInformationProcess  (-1, DefaultHardErrorMode, 4, ... {process info, class 12, size 4}, 0x0, ) == 0x0
 02919   860   NtSetInformationProcess  (-1, DefaultHardErrorMode, {process info, class 12, size 4}, 4, ... ) == 0x0
 02920   860   NtQueryDefaultLocale  (1, 1237456, ... ) == 0x0
 02921   860   NtQueryVirtualMemory  (-1, 0x3d0000, Basic, 28, ... {BaseAddress=0x3d0000,AllocationBase=0x3d0000,AllocationProtect=0x2,RegionSize=0x2c000,State=0x1000,Protect=0x2,Type=0x40000,}, 0x0, ) == 0x0
 02922   860   NtUnmapViewOfSection  (-1, 0x3d0000, ... ) == 0x0
 02923   860   NtWaitForSingleObject  (184, 0, {-1000000, -1}, ... ) == 0x0
 02924   860   NtOpenThreadTokenEx  (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN
 02925   860   NtOpenProcessTokenEx  (-1, 0x20008, 512, ... 108, ) == 0x0
 02926   860   NtQueryInformationToken  (108, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0
 02927   860   NtClose  (108, ... ) == 0x0
 02928   860   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\REGISTRY\USER\S-1-5-21-1292428093-1383384898-725345543-1003\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Layers"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02929   860   NtReleaseMutant  (184, ... 0x0, ) == 0x0
 02930   860   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\msctfime.ime"}, 1236476, ... ) }, 1236476, ... ) == 0x0
 02931   860   NtOpenFile  (0x100020, {24, 0, 0x40, 0, 0,  (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\msctfime.ime"}, 5, 96, ... 108, {status=0x0, info=1}, ) }, 5, 96, ... 108, {status=0x0, info=1}, ) == 0x0
 02932   860   NtCreateSection  (0xe, 0x0, 0x0, 16, 134217728, 108, ... 148, ) == 0x0
 02933   860   NtClose  (108, ... ) == 0x0
 02934   860   NtMapViewOfSection  (148, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 16, ... (0x3d0000), 0x0, 180224, ) == 0x0
 02935   860   NtClose  (148, ... ) == 0x0
 02936   860   NtUnmapViewOfSection  (-1, 0x3d0000, ... ) == 0x0
 02937   860   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\msctfime.ime"}, 1236784, ... ) }, 1236784, ... ) == 0x0
 02938   860   NtOpenFile  (0x100020, {24, 0, 0x40, 0, 0,  (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\msctfime.ime"}, 5, 96, ... 148, {status=0x0, info=1}, ) }, 5, 96, ... 148, {status=0x0, info=1}, ) == 0x0
 02939   860   NtCreateSection  (0xf, 0x0, 0x0, 16, 16777216, 148, ... 108, ) == 0x0
 02940   860   NtQuerySection  (108, Image, 48, ... {section info, class 1, size 48}, 0x0, ) == 0x0
 02941   860   NtClose  (148, ... ) == 0x0
 02942   860   NtMapViewOfSection  (108, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x755c0000), 0x0, 188416, ) == 0x0
 02943   860   NtClose  (108, ... ) == 0x0
 02944   860   NtProtectVirtualMemory  (-1, (0x755c1000), 860, 4, ... (0x755c1000), 4096, 32, ) == 0x0
 02945   860   NtProtectVirtualMemory  (-1, (0x755c1000), 4096, 32, ... (0x755c1000), 4096, 4, ) == 0x0
 02946   860   NtFlushInstructionCache  (-1, 1968967680, 860, ... ) == 0x0
 02947   860   NtProtectVirtualMemory  (-1, (0x755c1000), 860, 4, ... (0x755c1000), 4096, 32, ) == 0x0
 02948   860   NtProtectVirtualMemory  (-1, (0x755c1000), 4096, 32, ... (0x755c1000), 4096, 4, ) == 0x0
 02949   860   NtFlushInstructionCache  (-1, 1968967680, 860, ... ) == 0x0
 02950   860   NtProtectVirtualMemory  (-1, (0x755c1000), 860, 4, ... (0x755c1000), 4096, 32, ) == 0x0
 02951   860   NtProtectVirtualMemory  (-1, (0x755c1000), 4096, 32, ... (0x755c1000), 4096, 4, ) == 0x0
 02952   860   NtFlushInstructionCache  (-1, 1968967680, 860, ... ) == 0x0
 02953   860   NtProtectVirtualMemory  (-1, (0x755c1000), 860, 4, ... (0x755c1000), 4096, 32, ) == 0x0
 02954   860   NtProtectVirtualMemory  (-1, (0x755c1000), 4096, 32, ... (0x755c1000), 4096, 4, ) == 0x0
 02955   860   NtFlushInstructionCache  (-1, 1968967680, 860, ... ) == 0x0
 02956   860   NtProtectVirtualMemory  (-1, (0x755c1000), 860, 4, ... (0x755c1000), 4096, 32, ) == 0x0
 02957   860   NtProtectVirtualMemory  (-1, (0x755c1000), 4096, 32, ... (0x755c1000), 4096, 4, ) == 0x0
 02958   860   NtFlushInstructionCache  (-1, 1968967680, 860, ... ) == 0x0
 02959   860   NtProtectVirtualMemory  (-1, (0x755c1000), 860, 4, ... (0x755c1000), 4096, 32, ) == 0x0
 02960   860   NtProtectVirtualMemory  (-1, (0x755c1000), 4096, 32, ... (0x755c1000), 4096, 4, ) == 0x0
 02961   860   NtFlushInstructionCache  (-1, 1968967680, 860, ... ) == 0x0
 02962   860   NtOpenKey  (0x80000000, {24, 0, 0x40, 0, 0,  (0x80000000, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msctfime.ime"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02963   860   NtUserGetDC  (0, ... ) == 0x1010054
 02964   860   NtUserSystemParametersInfo  (66, 12, 1236972, 0, ... ) == 0x1
 02965   860   NtUserCallOneParam  (16842836, 57, ... ) == 0x1
 02966   860   NtQueryDebugFilterState  (87, 3, ... ) == 0x0
 02967   860   NtQueryDebugFilterState  (87, 3, ... ) == 0x0
 02968   860   NtContinue  (1235176, 0, ...
 02969   860   NtQueryDebugFilterState  (87, 3, ... ) == 0x0
 02970   860   NtUnmapViewOfSection  (-1, 0x755c0000, ... ) == 0x0
 02971   860   NtQueryDebugFilterState  (87, 3, ... ) == 0x0
 02972   860   NtOpenKey  (0x2000000, {24, 16, 0x40, 0, 0,  (0x2000000, {24, 16, 0x40, 0, 0, "Software\Microsoft\Windows NT\CurrentVersion\IMM"}, ... 108, ) }, ... 108, ) == 0x0
 02973   860   NtQueryValueKey  (108,  (108, "Ime File", Partial, 144, ... TitleIdx=0, Type=1, Data="m\0s\0c\0t\0f\0i\0m\0e\0.\0i\0m\0e\0\0\0"}, 38, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (108, "Ime File", Partial, 144, ... TitleIdx=0, Type=1, Data="m\0s\0c\0t\0f\0i\0m\0e\0.\0i\0m\0e\0\0\0"}, 38, ) }, 38, ) == 0x0
 02974   860   NtClose  (108, ... ) == 0x0
 02975   860   NtQueryInformationProcess  (-1, DefaultHardErrorMode, 4, ... {process info, class 12, size 4}, 0x0, ) == 0x0
 02976   860   NtSetInformationProcess  (-1, DefaultHardErrorMode, {process info, class 12, size 4}, 4, ... ) == 0x0
 02977   860   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\msctfime.ime"}, 1236504, ... ) }, 1236504, ... ) == 0x0
 02978   860   NtOpenFile  (0x100020, {24, 0, 0x40, 0, 0,  (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\msctfime.ime"}, 5, 96, ... 108, {status=0x0, info=1}, ) }, 5, 96, ... 108, {status=0x0, info=1}, ) == 0x0
 02979   860   NtCreateSection  (0xe, 0x0, 0x0, 16, 134217728, 108, ... 148, ) == 0x0
 02980   860   NtClose  (108, ... ) == 0x0
 02981   860   NtMapViewOfSection  (148, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 16, ... (0x3d0000), 0x0, 180224, ) == 0x0
 02982   860   NtClose  (148, ... ) == 0x0
 02983   860   NtUnmapViewOfSection  (-1, 0x3d0000, ... ) == 0x0
 02984   860   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\msctfime.ime"}, 1236100, ... ) }, 1236100, ... ) == 0x0
 02985   860   NtCreateFile  (0x80100080, {24, 0, 0x40, 0, 1236844,  (0x80100080, {24, 0, 0x40, 0, 1236844, "\??\C:\WINDOWS\system32\msctfime.ime"}, 0x0, 0, 5, 1, 96, 0, 0, ... 148, {status=0x0, info=1}, ) }, 0x0, 0, 5, 1, 96, 0, 0, ... 148, {status=0x0, info=1}, ) == 0x0
 02986   860   NtCreateSection  (0xf0005, 0x0, 0x0, 2, 134217728, 148, ... 108, ) == 0x0
 02987   860   NtClose  (148, ... ) == 0x0
 02988   860   NtMapViewOfSection  (108, -1, (0x0), 0, 0, {0, 0}, 0, 1, 0, 2, ... (0x3d0000), {0, 0}, 180224, ) == 0x0
 02989   860   NtClose  (108, ... ) == 0x0
 02990   860   NtQueryInformationProcess  (-1, DefaultHardErrorMode, 4, ... {process info, class 12, size 4}, 0x0, ) == 0x0
 02991   860   NtSetInformationProcess  (-1, DefaultHardErrorMode, {process info, class 12, size 4}, 4, ... ) == 0x0
 02992   860   NtQueryDefaultLocale  (1, 1237464, ... ) == 0x0
 02993   860   NtQueryVirtualMemory  (-1, 0x3d0000, Basic, 28, ... {BaseAddress=0x3d0000,AllocationBase=0x3d0000,AllocationProtect=0x2,RegionSize=0x2c000,State=0x1000,Protect=0x2,Type=0x40000,}, 0x0, ) == 0x0
 02994   860   NtQueryVirtualMemory  (-1, 0x3d0000, Basic, 28, ... {BaseAddress=0x3d0000,AllocationBase=0x3d0000,AllocationProtect=0x2,RegionSize=0x2c000,State=0x1000,Protect=0x2,Type=0x40000,}, 0x0, ) == 0x0
 02995   860   NtUnmapViewOfSection  (-1, 0x3d0000, ... ) == 0x0
 02996   860   NtQueryInformationProcess  (-1, DefaultHardErrorMode, 4, ... {process info, class 12, size 4}, 0x0, ) == 0x0
 02997   860   NtSetInformationProcess  (-1, DefaultHardErrorMode, {process info, class 12, size 4}, 4, ... ) == 0x0
 02998   860   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\msctfime.ime"}, 1236496, ... ) }, 1236496, ... ) == 0x0
 02999   860   NtOpenFile  (0x100020, {24, 0, 0x40, 0, 0,  (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\msctfime.ime"}, 5, 96, ... 108, {status=0x0, info=1}, ) }, 5, 96, ... 108, {status=0x0, info=1}, ) == 0x0
 03000   860   NtCreateSection  (0xe, 0x0, 0x0, 16, 134217728, 108, ... 148, ) == 0x0
 03001   860   NtClose  (108, ... ) == 0x0
 03002   860   NtMapViewOfSection  (148, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 16, ... (0x3d0000), 0x0, 180224, ) == 0x0
 03003   860   NtClose  (148, ... ) == 0x0
 03004   860   NtUnmapViewOfSection  (-1, 0x3d0000, ... ) == 0x0
 03005   860   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\msctfime.ime"}, 1236092, ... ) }, 1236092, ... ) == 0x0
 03006   860   NtCreateFile  (0x80100080, {24, 0, 0x40, 0, 1236836,  (0x80100080, {24, 0, 0x40, 0, 1236836, "\??\C:\WINDOWS\system32\msctfime.ime"}, 0x0, 0, 5, 1, 96, 0, 0, ... 148, {status=0x0, info=1}, ) }, 0x0, 0, 5, 1, 96, 0, 0, ... 148, {status=0x0, info=1}, ) == 0x0
 03007   860   NtCreateSection  (0xf0005, 0x0, 0x0, 2, 134217728, 148, ... 108, ) == 0x0
 03008   860   NtClose  (148, ... ) == 0x0
 03009   860   NtMapViewOfSection  (108, -1, (0x0), 0, 0, {0, 0}, 0, 1, 0, 2, ... (0x3d0000), {0, 0}, 180224, ) == 0x0
 03010   860   NtClose  (108, ... ) == 0x0
 03011   860   NtQueryInformationProcess  (-1, DefaultHardErrorMode, 4, ... {process info, class 12, size 4}, 0x0, ) == 0x0
 03012   860   NtSetInformationProcess  (-1, DefaultHardErrorMode, {process info, class 12, size 4}, 4, ... ) == 0x0
 03013   860   NtQueryDefaultLocale  (1, 1237456, ... ) == 0x0
 03014   860   NtQueryVirtualMemory  (-1, 0x3d0000, Basic, 28, ... {BaseAddress=0x3d0000,AllocationBase=0x3d0000,AllocationProtect=0x2,RegionSize=0x2c000,State=0x1000,Protect=0x2,Type=0x40000,}, 0x0, ) == 0x0
 03015   860   NtUnmapViewOfSection  (-1, 0x3d0000, ... ) == 0x0
 03016   860   NtWaitForSingleObject  (184, 0, {-1000000, -1}, ... ) == 0x0
 03017   860   NtOpenThreadTokenEx  (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN
 03018   860   NtOpenProcessTokenEx  (-1, 0x20008, 512, ... 108, ) == 0x0
 03019   860   NtQueryInformationToken  (108, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0
 03020   860   NtClose  (108, ... ) == 0x0
 03021   860   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\REGISTRY\USER\S-1-5-21-1292428093-1383384898-725345543-1003\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Layers"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 03022   860   NtReleaseMutant  (184, ... 0x0, ) == 0x0
 03023   860   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\msctfime.ime"}, 1236476, ... ) }, 1236476, ... ) == 0x0
 03024   860   NtOpenFile  (0x100020, {24, 0, 0x40, 0, 0,  (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\msctfime.ime"}, 5, 96, ... 108, {status=0x0, info=1}, ) }, 5, 96, ... 108, {status=0x0, info=1}, ) == 0x0
 03025   860   NtCreateSection  (0xe, 0x0, 0x0, 16, 134217728, 108, ... 148, ) == 0x0
 03026   860   NtClose  (108, ... ) == 0x0
 03027   860   NtMapViewOfSection  (148, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 16, ... (0x3d0000), 0x0, 180224, ) == 0x0
 03028   860   NtClose  (148, ... ) == 0x0
 03029   860   NtUnmapViewOfSection  (-1, 0x3d0000, ... ) == 0x0
 03030   860   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\msctfime.ime"}, 1236784, ... ) }, 1236784, ... ) == 0x0
 03031   860   NtOpenFile  (0x100020, {24, 0, 0x40, 0, 0,  (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\msctfime.ime"}, 5, 96, ... 148, {status=0x0, info=1}, ) }, 5, 96, ... 148, {status=0x0, info=1}, ) == 0x0
 03032   860   NtCreateSection  (0xf, 0x0, 0x0, 16, 16777216, 148, ... 108, ) == 0x0
 03033   860   NtQuerySection  (108, Image, 48, ... {section info, class 1, size 48}, 0x0, ) == 0x0
 03034   860   NtClose  (148, ... ) == 0x0
 03035   860   NtMapViewOfSection  (108, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x755c0000), 0x0, 188416, ) == 0x0
 03036   860   NtClose  (108, ... ) == 0x0
 03037   860   NtProtectVirtualMemory  (-1, (0x755c1000), 860, 4, ... (0x755c1000), 4096, 32, ) == 0x0
 03038   860   NtProtectVirtualMemory  (-1, (0x755c1000), 4096, 32, ... (0x755c1000), 4096, 4, ) == 0x0
 03039   860   NtFlushInstructionCache  (-1, 1968967680, 860, ... ) == 0x0
 03040   860   NtProtectVirtualMemory  (-1, (0x755c1000), 860, 4, ... (0x755c1000), 4096, 32, ) == 0x0
 03041   860   NtProtectVirtualMemory  (-1, (0x755c1000), 4096, 32, ... (0x755c1000), 4096, 4, ) == 0x0
 03042   860   NtFlushInstructionCache  (-1, 1968967680, 860, ... ) == 0x0
 03043   860   NtProtectVirtualMemory  (-1, (0x755c1000), 860, 4, ... (0x755c1000), 4096, 32, ) == 0x0
 03044   860   NtProtectVirtualMemory  (-1, (0x755c1000), 4096, 32, ... (0x755c1000), 4096, 4, ) == 0x0
 03045   860   NtFlushInstructionCache  (-1, 1968967680, 860, ... ) == 0x0
 03046   860   NtProtectVirtualMemory  (-1, (0x755c1000), 860, 4, ... (0x755c1000), 4096, 32, ) == 0x0
 03047   860   NtProtectVirtualMemory  (-1, (0x755c1000), 4096, 32, ... (0x755c1000), 4096, 4, ) == 0x0
 03048   860   NtFlushInstructionCache  (-1, 1968967680, 860, ... ) == 0x0
 03049   860   NtProtectVirtualMemory  (-1, (0x755c1000), 860, 4, ... (0x755c1000), 4096, 32, ) == 0x0
 03050   860   NtProtectVirtualMemory  (-1, (0x755c1000), 4096, 32, ... (0x755c1000), 4096, 4, ) == 0x0
 03051   860   NtFlushInstructionCache  (-1, 1968967680, 860, ... ) == 0x0
 03052   860   NtProtectVirtualMemory  (-1, (0x755c1000), 860, 4, ... (0x755c1000), 4096, 32, ) == 0x0
 03053   860   NtProtectVirtualMemory  (-1, (0x755c1000), 4096, 32, ... (0x755c1000), 4096, 4, ) == 0x0
 03054   860   NtFlushInstructionCache  (-1, 1968967680, 860, ... ) == 0x0
 03055   860   NtOpenKey  (0x80000000, {24, 0, 0x40, 0, 0,  (0x80000000, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msctfime.ime"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 03056   860   NtAllocateVirtualMemory  (-1, 3297280, 0, 4096, 4096, 4, ... 3297280, 4096, ) == 0x0
 03057   860   NtUserGetDC  (0, ... ) == 0x1010054
 03058   860   NtUserSystemParametersInfo  (66, 12, 1236972, 0, ... ) == 0x1
 03059   860   NtUserCallOneParam  (16842836, 57, ... ) == 0x1
 03060   860   NtQueryDebugFilterState  (87, 3, ... ) == 0x0
 03061   860   NtQueryDebugFilterState  (87, 3, ... ) == 0x0
 03062   860   NtContinue  (1235176, 0, ...
 03063   860   NtQueryDebugFilterState  (87, 3, ... ) == 0x0
 03064   860   NtUnmapViewOfSection  (-1, 0x755c0000, ... ) == 0x0
 03065   860   NtQueryDebugFilterState  (87, 3, ... ) == 0x0
 03066   860   NtOpenKey  (0x2000000, {24, 16, 0x40, 0, 0,  (0x2000000, {24, 16, 0x40, 0, 0, "Software\Microsoft\Windows NT\CurrentVersion\IMM"}, ... 108, ) }, ... 108, ) == 0x0
 03067   860   NtQueryValueKey  (108,  (108, "Ime File", Partial, 144, ... TitleIdx=0, Type=1, Data="m\0s\0c\0t\0f\0i\0m\0e\0.\0i\0m\0e\0\0\0"}, 38, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (108, "Ime File", Partial, 144, ... TitleIdx=0, Type=1, Data="m\0s\0c\0t\0f\0i\0m\0e\0.\0i\0m\0e\0\0\0"}, 38, ) }, 38, ) == 0x0
 03068   860   NtClose  (108, ... ) == 0x0
 03069   860   NtQueryInformationProcess  (-1, DefaultHardErrorMode, 4, ... {process info, class 12, size 4}, 0x0, ) == 0x0
 03070   860   NtSetInformationProcess  (-1, DefaultHardErrorMode, {process info, class 12, size 4}, 4, ... ) == 0x0
 03071   860   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\msctfime.ime"}, 1236504, ... ) }, 1236504, ... ) == 0x0
 03072   860   NtOpenFile  (0x100020, {24, 0, 0x40, 0, 0,  (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\msctfime.ime"}, 5, 96, ... 108, {status=0x0, info=1}, ) }, 5, 96, ... 108, {status=0x0, info=1}, ) == 0x0
 03073   860   NtCreateSection  (0xe, 0x0, 0x0, 16, 134217728, 108, ... 148, ) == 0x0
 03074   860   NtClose  (108, ... ) == 0x0
 03075   860   NtMapViewOfSection  (148, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 16, ... (0x3d0000), 0x0, 180224, ) == 0x0
 03076   860   NtClose  (148, ... ) == 0x0
 03077   860   NtUnmapViewOfSection  (-1, 0x3d0000, ... ) == 0x0
 03078   860   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\msctfime.ime"}, 1236100, ... ) }, 1236100, ... ) == 0x0
 03079   860   NtCreateFile  (0x80100080, {24, 0, 0x40, 0, 1236844,  (0x80100080, {24, 0, 0x40, 0, 1236844, "\??\C:\WINDOWS\system32\msctfime.ime"}, 0x0, 0, 5, 1, 96, 0, 0, ... 148, {status=0x0, info=1}, ) }, 0x0, 0, 5, 1, 96, 0, 0, ... 148, {status=0x0, info=1}, ) == 0x0
 03080   860   NtCreateSection  (0xf0005, 0x0, 0x0, 2, 134217728, 148, ... 108, ) == 0x0
 03081   860   NtClose  (148, ... ) == 0x0
 03082   860   NtMapViewOfSection  (108, -1, (0x0), 0, 0, {0, 0}, 0, 1, 0, 2, ... (0x3d0000), {0, 0}, 180224, ) == 0x0
 03083   860   NtClose  (108, ... ) == 0x0
 03084   860   NtQueryInformationProcess  (-1, DefaultHardErrorMode, 4, ... {process info, class 12, size 4}, 0x0, ) == 0x0
 03085   860   NtSetInformationProcess  (-1, DefaultHardErrorMode, {process info, class 12, size 4}, 4, ... ) == 0x0
 03086   860   NtQueryDefaultLocale  (1, 1237464, ... ) == 0x0
 03087   860   NtQueryVirtualMemory  (-1, 0x3d0000, Basic, 28, ... {BaseAddress=0x3d0000,AllocationBase=0x3d0000,AllocationProtect=0x2,RegionSize=0x2c000,State=0x1000,Protect=0x2,Type=0x40000,}, 0x0, ) == 0x0
 03088   860   NtQueryVirtualMemory  (-1, 0x3d0000, Basic, 28, ... {BaseAddress=0x3d0000,AllocationBase=0x3d0000,AllocationProtect=0x2,RegionSize=0x2c000,State=0x1000,Protect=0x2,Type=0x40000,}, 0x0, ) == 0x0
 03089   860   NtUnmapViewOfSection  (-1, 0x3d0000, ... ) == 0x0
 03090   860   NtQueryInformationProcess  (-1, DefaultHardErrorMode, 4, ... {process info, class 12, size 4}, 0x0, ) == 0x0
 03091   860   NtSetInformationProcess  (-1, DefaultHardErrorMode, {process info, class 12, size 4}, 4, ... ) == 0x0
 03092   860   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\msctfime.ime"}, 1236496, ... ) }, 1236496, ... ) == 0x0
 03093   860   NtOpenFile  (0x100020, {24, 0, 0x40, 0, 0,  (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\msctfime.ime"}, 5, 96, ... 108, {status=0x0, info=1}, ) }, 5, 96, ... 108, {status=0x0, info=1}, ) == 0x0
 03094   860   NtCreateSection  (0xe, 0x0, 0x0, 16, 134217728, 108, ... 148, ) == 0x0
 03095   860   NtClose  (108, ... ) == 0x0
 03096   860   NtMapViewOfSection  (148, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 16, ... (0x3d0000), 0x0, 180224, ) == 0x0
 03097   860   NtClose  (148, ... ) == 0x0
 03098   860   NtUnmapViewOfSection  (-1, 0x3d0000, ... ) == 0x0
 03099   860   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\msctfime.ime"}, 1236092, ... ) }, 1236092, ... ) == 0x0
 03100   860   NtCreateFile  (0x80100080, {24, 0, 0x40, 0, 1236836,  (0x80100080, {24, 0, 0x40, 0, 1236836, "\??\C:\WINDOWS\system32\msctfime.ime"}, 0x0, 0, 5, 1, 96, 0, 0, ... 148, {status=0x0, info=1}, ) }, 0x0, 0, 5, 1, 96, 0, 0, ... 148, {status=0x0, info=1}, ) == 0x0
 03101   860   NtCreateSection  (0xf0005, 0x0, 0x0, 2, 134217728, 148, ... 108, ) == 0x0
 03102   860   NtClose  (148, ... ) == 0x0
 03103   860   NtMapViewOfSection  (108, -1, (0x0), 0, 0, {0, 0}, 0, 1, 0, 2, ... (0x3d0000), {0, 0}, 180224, ) == 0x0
 03104   860   NtClose  (108, ... ) == 0x0
 03105   860   NtQueryInformationProcess  (-1, DefaultHardErrorMode, 4, ... {process info, class 12, size 4}, 0x0, ) == 0x0
 03106   860   NtSetInformationProcess  (-1, DefaultHardErrorMode, {process info, class 12, size 4}, 4, ... ) == 0x0
 03107   860   NtQueryDefaultLocale  (1, 1237456, ... ) == 0x0
 03108   860   NtQueryVirtualMemory  (-1, 0x3d0000, Basic, 28, ... {BaseAddress=0x3d0000,AllocationBase=0x3d0000,AllocationProtect=0x2,RegionSize=0x2c000,State=0x1000,Protect=0x2,Type=0x40000,}, 0x0, ) == 0x0
 03109   860   NtUnmapViewOfSection  (-1, 0x3d0000, ... ) == 0x0
 03110   860   NtWaitForSingleObject  (184, 0, {-1000000, -1}, ... ) == 0x0
 03111   860   NtOpenThreadTokenEx  (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN
 03112   860   NtOpenProcessTokenEx  (-1, 0x20008, 512, ... 108, ) == 0x0
 03113   860   NtQueryInformationToken  (108, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0
 03114   860   NtClose  (108, ... ) == 0x0
 03115   860   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\REGISTRY\USER\S-1-5-21-1292428093-1383384898-725345543-1003\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Layers"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 03116   860   NtReleaseMutant  (184, ... 0x0, ) == 0x0
 03117   860   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\msctfime.ime"}, 1236476, ... ) }, 1236476, ... ) == 0x0
 03118   860   NtOpenFile  (0x100020, {24, 0, 0x40, 0, 0,  (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\msctfime.ime"}, 5, 96, ... 108, {status=0x0, info=1}, ) }, 5, 96, ... 108, {status=0x0, info=1}, ) == 0x0
 03119   860   NtCreateSection  (0xe, 0x0, 0x0, 16, 134217728, 108, ... 148, ) == 0x0
 03120   860   NtClose  (108, ... ) == 0x0
 03121   860   NtMapViewOfSection  (148, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 16, ... (0x3d0000), 0x0, 180224, ) == 0x0
 03122   860   NtClose  (148, ... ) == 0x0
 03123   860   NtUnmapViewOfSection  (-1, 0x3d0000, ... ) == 0x0
 03124   860   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\msctfime.ime"}, 1236784, ... ) }, 1236784, ... ) == 0x0
 03125   860   NtOpenFile  (0x100020, {24, 0, 0x40, 0, 0,  (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\msctfime.ime"}, 5, 96, ... 148, {status=0x0, info=1}, ) }, 5, 96, ... 148, {status=0x0, info=1}, ) == 0x0
 03126   860   NtCreateSection  (0xf, 0x0, 0x0, 16, 16777216, 148, ... 108, ) == 0x0
 03127   860   NtQuerySection  (108, Image, 48, ... {section info, class 1, size 48}, 0x0, ) == 0x0
 03128   860   NtClose  (148, ... ) == 0x0
 03129   860   NtMapViewOfSection  (108, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x755c0000), 0x0, 188416, ) == 0x0
 03130   860   NtClose  (108, ... ) == 0x0
 03131   860   NtProtectVirtualMemory  (-1, (0x755c1000), 860, 4, ... (0x755c1000), 4096, 32, ) == 0x0
 03132   860   NtProtectVirtualMemory  (-1, (0x755c1000), 4096, 32, ... (0x755c1000), 4096, 4, ) == 0x0
 03133   860   NtFlushInstructionCache  (-1, 1968967680, 860, ... ) == 0x0
 03134   860   NtProtectVirtualMemory  (-1, (0x755c1000), 860, 4, ... (0x755c1000), 4096, 32, ) == 0x0
 03135   860   NtProtectVirtualMemory  (-1, (0x755c1000), 4096, 32, ... (0x755c1000), 4096, 4, ) == 0x0
 03136   860   NtFlushInstructionCache  (-1, 1968967680, 860, ... ) == 0x0
 03137   860   NtProtectVirtualMemory  (-1, (0x755c1000), 860, 4, ... (0x755c1000), 4096, 32, ) == 0x0
 03138   860   NtProtectVirtualMemory  (-1, (0x755c1000), 4096, 32, ... (0x755c1000), 4096, 4, ) == 0x0
 03139   860   NtFlushInstructionCache  (-1, 1968967680, 860, ... ) == 0x0
 03140   860   NtProtectVirtualMemory  (-1, (0x755c1000), 860, 4, ... (0x755c1000), 4096, 32, ) == 0x0
 03141   860   NtProtectVirtualMemory  (-1, (0x755c1000), 4096, 32, ... (0x755c1000), 4096, 4, ) == 0x0
 03142   860   NtFlushInstructionCache  (-1, 1968967680, 860, ... ) == 0x0
 03143   860   NtProtectVirtualMemory  (-1, (0x755c1000), 860, 4, ... (0x755c1000), 4096, 32, ) == 0x0
 03144   860   NtProtectVirtualMemory  (-1, (0x755c1000), 4096, 32, ... (0x755c1000), 4096, 4, ) == 0x0
 03145   860   NtFlushInstructionCache  (-1, 1968967680, 860, ... ) == 0x0
 03146   860   NtProtectVirtualMemory  (-1, (0x755c1000), 860, 4, ... (0x755c1000), 4096, 32, ) == 0x0
 03147   860   NtProtectVirtualMemory  (-1, (0x755c1000), 4096, 32, ... (0x755c1000), 4096, 4, ) == 0x0
 03148   860   NtFlushInstructionCache  (-1, 1968967680, 860, ... ) == 0x0
 03149   860   NtOpenKey  (0x80000000, {24, 0, 0x40, 0, 0,  (0x80000000, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msctfime.ime"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 03150   860   NtUserGetDC  (0, ... ) == 0x1010054
 03151   860   NtUserSystemParametersInfo  (66, 12, 1236972, 0, ... ) == 0x1
 03152   860   NtUserCallOneParam  (16842836, 57, ... ) == 0x1
 03153   860   NtQueryDebugFilterState  (87, 3, ... ) == 0x0
 03154   860   NtQueryDebugFilterState  (87, 3, ... ) == 0x0
 03155   860   NtContinue  (1235176, 0, ...
 03156   860   NtQueryDebugFilterState  (87, 3, ... ) == 0x0
 03157   860   NtUnmapViewOfSection  (-1, 0x755c0000, ... ) == 0x0
 03158   860   NtQueryDebugFilterState  (87, 3, ... ) == 0x0
 03159   860   NtOpenKey  (0x2000000, {24, 60, 0x40, 0, 0,  (0x2000000, {24, 60, 0x40, 0, 0, "SOFTWARE\Microsoft\CTF"}, ... 108, ) }, ... 108, ) == 0x0
 03160   860   NtQueryValueKey  (108,  (108, "Disable Thread Input Manager", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 03161   860   NtClose  (108, ... ) == 0x0
 03162   860   NtOpenThreadToken  (-2, 0x8, 0, ... ) == STATUS_NO_TOKEN
 03163   860   NtOpenProcessToken  (-1, 0xa, ... 108, ) == 0x0
 03164   860   NtDuplicateToken  (108, 0xc, {24, 0, 0x0, 0, 1238860, 0x0}, 0, 2, ... 148, ) == 0x0
 03165   860   NtClose  (108, ... ) == 0x0
 03166   860   NtAccessCheck  (1339360, 148, 0x1, 1238936, 1238988, 56, 1238968, ... (0x1), ) == 0x0
 03167   860   NtClose  (148, ... ) == 0x0
 03168   860   NtOpenKey  (0x2000000, {24, 16, 0x40, 0, 0,  (0x2000000, {24, 16, 0x40, 0, 0, "Software\Microsoft\CTF\SystemShared"}, ... 148, ) }, ... 148, ) == 0x0
 03169   860   NtQueryValueKey  (148,  (148, "CUAS", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (148, "CUAS", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) }, 16, ) == 0x0
 03170   860   NtClose  (148, ... ) == 0x0
 03171   860   NtUserGetImeInfoEx  (1238752, 0, ... ) == 0x1
 03172   860   NtWaitForSingleObject  (184, 0, {-1000000, -1}, ... ) == 0x0
 03173   860   NtOpenThreadTokenEx  (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN
 03174   860   NtOpenProcessTokenEx  (-1, 0x20008, 512, ... 148, ) == 0x0
 03175   860   NtQueryInformationToken  (148, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0
 03176   860   NtClose  (148, ... ) == 0x0
 03177   860   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\REGISTRY\USER\S-1-5-21-1292428093-1383384898-725345543-1003\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Layers"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 03178   860   NtReleaseMutant  (184, ... 0x0, ) == 0x0
 03179   860   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\msctfime.ime"}, 1235784, ... ) }, 1235784, ... ) == 0x0
 03180   860   NtOpenFile  (0x100020, {24, 0, 0x40, 0, 0,  (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\msctfime.ime"}, 5, 96, ... 148, {status=0x0, info=1}, ) }, 5, 96, ... 148, {status=0x0, info=1}, ) == 0x0
 03181   860   NtCreateSection  (0xe, 0x0, 0x0, 16, 134217728, 148, ... 108, ) == 0x0
 03182   860   NtClose  (148, ... ) == 0x0
 03183   860   NtMapViewOfSection  (108, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 16, ... (0x3d0000), 0x0, 180224, ) == 0x0
 03184   860   NtClose  (108, ... ) == 0x0
 03185   860   NtUnmapViewOfSection  (-1, 0x3d0000, ... ) == 0x0
 03186   860   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\msctfime.ime"}, 1236092, ... ) }, 1236092, ... ) == 0x0
 03187   860   NtOpenFile  (0x100020, {24, 0, 0x40, 0, 0,  (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\msctfime.ime"}, 5, 96, ... 108, {status=0x0, info=1}, ) }, 5, 96, ... 108, {status=0x0, info=1}, ) == 0x0
 03188   860   NtCreateSection  (0xf, 0x0, 0x0, 16, 16777216, 108, ... 148, ) == 0x0
 03189   860   NtQuerySection  (148, Image, 48, ... {section info, class 1, size 48}, 0x0, ) == 0x0
 03190   860   NtClose  (108, ... ) == 0x0
 03191   860   NtMapViewOfSection  (148, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x755c0000), 0x0, 188416, ) == 0x0
 03192   860   NtClose  (148, ... ) == 0x0
 03193   860   NtProtectVirtualMemory  (-1, (0x755c1000), 860, 4, ... (0x755c1000), 4096, 32, ) == 0x0
 03194   860   NtProtectVirtualMemory  (-1, (0x755c1000), 4096, 32, ... (0x755c1000), 4096, 4, ) == 0x0
 03195   860   NtFlushInstructionCache  (-1, 1968967680, 860, ... ) == 0x0
 03196   860   NtProtectVirtualMemory  (-1, (0x755c1000), 860, 4, ... (0x755c1000), 4096, 32, ) == 0x0
 03197   860   NtProtectVirtualMemory  (-1, (0x755c1000), 4096, 32, ... (0x755c1000), 4096, 4, ) == 0x0
 03198   860   NtFlushInstructionCache  (-1, 1968967680, 860, ... ) == 0x0
 03199   860   NtProtectVirtualMemory  (-1, (0x755c1000), 860, 4, ... (0x755c1000), 4096, 32, ) == 0x0
 03200   860   NtProtectVirtualMemory  (-1, (0x755c1000), 4096, 32, ... (0x755c1000), 4096, 4, ) == 0x0
 03201   860   NtFlushInstructionCache  (-1, 1968967680, 860, ... ) == 0x0
 03202   860   NtProtectVirtualMemory  (-1, (0x755c1000), 860, 4, ... (0x755c1000), 4096, 32, ) == 0x0
 03203   860   NtProtectVirtualMemory  (-1, (0x755c1000), 4096, 32, ... (0x755c1000), 4096, 4, ) == 0x0
 03204   860   NtFlushInstructionCache  (-1, 1968967680, 860, ... ) == 0x0
 03205   860   NtProtectVirtualMemory  (-1, (0x755c1000), 860, 4, ... (0x755c1000), 4096, 32, ) == 0x0
 03206   860   NtProtectVirtualMemory  (-1, (0x755c1000), 4096, 32, ... (0x755c1000), 4096, 4, ) == 0x0
 03207   860   NtFlushInstructionCache  (-1, 1968967680, 860, ... ) == 0x0
 03208   860   NtProtectVirtualMemory  (-1, (0x755c1000), 860, 4, ... (0x755c1000), 4096, 32, ) == 0x0
 03209   860   NtProtectVirtualMemory  (-1, (0x755c1000), 4096, 32, ... (0x755c1000), 4096, 4, ) == 0x0
 03210   860   NtFlushInstructionCache  (-1, 1968967680, 860, ... ) == 0x0
 03211   860   NtOpenKey  (0x80000000, {24, 0, 0x40, 0, 0,  (0x80000000, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msctfime.ime"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 03212   860   NtUserGetDC  (0, ... ) == 0x1010054
 03213   860   NtUserSystemParametersInfo  (66, 12, 1236280, 0, ... ) == 0x1
 03214   860   NtUserCallOneParam  (16842836, 57, ... ) == 0x1
 03215   860   NtQueryDebugFilterState  (87, 3, ... ) == 0x0
 03216   860   NtQueryDebugFilterState  (87, 3, ... ) == 0x0
 03217   860   NtContinue  (1234484, 0, ...
 03218   860   NtQueryDebugFilterState  (87, 3, ... ) == 0x0
 03219   860   NtUnmapViewOfSection  (-1, 0x755c0000, ... ) == 0x0
 03220   860   NtQueryDebugFilterState  (87, 3, ... ) == 0x0
 03221   860   NtUserMessageCall  (0x19010e, WM_NCCALCSIZE, 0x0, 0x12ec14, 0, 670, 0, ... ) == 0x0
 03222   860   NtUserGetClassName  (1638670, 0, 1239252, ... ) == 0x6
 03223   860   NtUserRemoveProp  (1638670, 43282, ... ) == 0x0
 03224   860   NtRequestWaitReplyPort  (24, {24, 52, new_msg, 0, 2, 327681, 262144, 6881357}  (24, {24, 52, new_msg, 0, 2, 327681, 262144, 6881357} "\0\0\0\0\5\4\3\0o\0f\0t\0 \0\\3\0\0\\347\22\0" ... {24, 52, reply, 0, 464, 860, 58152, 0} "\0\0\0\0\5\4\3\0\0\0\0\0t\0 \0\\3\0\0\0\0\0\0" )  ... {24, 52, reply, 0, 464, 860, 58152, 0}  (24, {24, 52, new_msg, 0, 2, 327681, 262144, 6881357} "\0\0\0\0\5\4\3\0o\0f\0t\0 \0\\3\0\0\\347\22\0" ... {24, 52, reply, 0, 464, 860, 58152, 0} "\0\0\0\0\5\4\3\0\0\0\0\0t\0 \0\\3\0\0\0\0\0\0" )  ) == 0x0
 03225   860   NtUserGetThreadDesktop  (860, 0, ... ) == 0x24
 03226   860   NtUserGetObjectInformation  (36, 2, 1238936, 520, 0, ... ) == 0x1
 03227   860   NtGdiDeleteObjectApp  (1913653144, ... ) == 0x1
 03228   860   NtUserGetWindowDC  (0, ... ) == 0x1010052
 03229   860   NtUserCallOneParam  (16842834, 57, ... ) == 0x1
 03230   860   NtUserGetWindowDC  (0, ... ) == 0x1010052
 03231   860   NtQueryVirtualMemory  (-1, 0x7e418830, Basic, 28, ... {BaseAddress=0x7e418000,AllocationBase=0x7e410000,AllocationProtect=0x80,RegionSize=0x58000,State=0x1000,Protect=0x20,Type=0x1000000,}, 28, ) == 0x0
 03232   860   NtQueryVirtualMemory  (-1, 0x3a3294, Basic, 28, ... {BaseAddress=0x3a3000,AllocationBase=0x3a0000,AllocationProtect=0x40,RegionSize=0x2d000,State=0x1000,Protect=0x40,Type=0x20000,}, 28, ) == 0x0
 03233   860   NtQueryInformationProcess  (-1, DebugPort, 4, ... {process info, class 7, size 4}, 0x0, ) == 0x0
 03234   860   NtQueryInformationProcess  (-1, 36, 4, ... {process info, class 36, size 4}, 0x0, ) == 0x0
 03235   860   NtQueryVirtualMemory  (-1, 0x77c2807c, Basic, 28, ... {BaseAddress=0x77c28000,AllocationBase=0x77c10000,AllocationProtect=0x80,RegionSize=0x35000,State=0x1000,Protect=0x20,Type=0x1000000,}, 28, ) == 0x0
 03236   860   NtQueryInformationProcess  (-1, DefaultHardErrorMode, 4, ... {process info, class 12, size 4}, 0x0, ) == 0x0
 03237   860   NtQueryInformationJobObject  (0, BasicLimit, 48, ... ) == STATUS_ACCESS_DENIED
 03238   860   NtOpenKey  (0x1, {24, 0, 0x40, 0, 0,  (0x1, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\AeDebug"}, ... 148, ) }, ... 148, ) == 0x0
 03239   860   NtQueryValueKey  (148,  (148, "Auto", Partial, 526, ... TitleIdx=0, Type=1, Data="0\0\0\0"}, 16, ) , Partial, 526, ... TitleIdx=0, Type=1, Data= (148, "Auto", Partial, 526, ... TitleIdx=0, Type=1, Data="0\0\0\0"}, 16, ) }, 16, ) == 0x0
 03240   860   NtQueryValueKey  (148,  (148, "Debugger", Partial, 526, ... TitleIdx=0, Type=1, Data=""\0C\0:\0\\0P\0r\0o\0g\0r\0a\0m\0 \0F\0i\0l\0e\0s\0\\0M\0i\0c\0r\0o\0s\0o\0f\0t\0 \0V\0i\0s\0u\0a\0l\0 \0S\0t\0u\0d\0i\0o\0\\0C\0o\0m\0m\0o\0n\0\\0M\0S\0D\0e\0v\09\08\0\\0B\0i\0n\0\\0m\0s\0d\0e\0v\0.\0e\0x\0e\0"\0 \0-\0p\0 \0%\0l\0d\0 \0-\0e\0 \0%\0l\0d\0\0\0"}, 184, ) , Partial, 526, ... TitleIdx=0, Type=1, Data=" (148, "Debugger", Partial, 526, ... TitleIdx=0, Type=1, Data=""\0C\0:\0\\0P\0r\0o\0g\0r\0a\0m\0 \0F\0i\0l\0e\0s\0\\0M\0i\0c\0r\0o\0s\0o\0f\0t\0 \0V\0i\0s\0u\0a\0l\0 \0S\0t\0u\0d\0i\0o\0\\0C\0o\0m\0m\0o\0n\0\\0M\0S\0D\0e\0v\09\08\0\\0B\0i\0n\0\\0m\0s\0d\0e\0v\0.\0e\0x\0e\0"\0 \0-\0p\0 \0%\0l\0d\0 \0-\0e\0 \0%\0l\0d\0\0\0"}, 184, ) \0 \0-\0p\0 \0%\0l\0d\0 \0-\0e\0 \0%\0l\0d\0\0\0"}, 184, ) == 0x0
 03241   860   NtClose  (148, ... ) == 0x0
 03242   860   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\faultrep.dll"}, 1234476, ... ) }, 1234476, ... ) == 0x0
 03243   860   NtOpenFile  (0x100020, {24, 0, 0x40, 0, 0,  (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\faultrep.dll"}, 5, 96, ... 148, {status=0x0, info=1}, ) }, 5, 96, ... 148, {status=0x0, info=1}, ) == 0x0
 03244   860   NtCreateSection  (0xe, 0x0, 0x0, 16, 134217728, 148, ... 108, ) == 0x0
 03245   860   NtClose  (148, ... ) == 0x0
 03246   860   NtMapViewOfSection  (108, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 16, ... (0x3d0000), 0x0, 81920, ) == 0x0
 03247   860   NtClose  (108, ... ) == 0x0
 03248   860   NtUnmapViewOfSection  (-1, 0x3d0000, ... ) == 0x0
 03249   860   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\faultrep.dll"}, 1234784, ... ) }, 1234784, ... ) == 0x0
 03250   860   NtOpenFile  (0x100020, {24, 0, 0x40, 0, 0,  (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\faultrep.dll"}, 5, 96, ... 108, {status=0x0, info=1}, ) }, 5, 96, ... 108, {status=0x0, info=1}, ) == 0x0
 03251   860   NtCreateSection  (0xf, 0x0, 0x0, 16, 16777216, 108, ... 148, ) == 0x0
 03252   860   NtQuerySection  (148, Image, 48, ... {section info, class 1, size 48}, 0x0, ) == 0x0
 03253   860   NtClose  (108, ... ) == 0x0
 03254   860   NtMapViewOfSection  (148, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x69450000), 0x0, 90112, ) == 0x0
 03255   860   NtClose  (148, ... ) == 0x0
 03256   860   NtOpenSection  (0xe, {24, 8, 0x40, 0, 0,  (0xe, {24, 8, 0x40, 0, 0, "USERENV.dll"}, ... 148, ) }, ... 148, ) == 0x0
 03257   860   NtMapViewOfSection  (148, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x769c0000), 0x0, 733184, ) == 0x0
 03258   860   NtClose  (148, ... ) == 0x0
 03259   860   NtProtectVirtualMemory  (-1, (0x769c1000), 1244, 4, ... (0x769c1000), 4096, 32, ) == 0x0
 03260   860   NtProtectVirtualMemory  (-1, (0x769c1000), 4096, 32, ... (0x769c1000), 4096, 4, ) == 0x0
 03261   860   NtFlushInstructionCache  (-1, 1989939200, 1244, ... ) == 0x0
 03262   860   NtProtectVirtualMemory  (-1, (0x769c1000), 1244, 4, ... (0x769c1000), 4096, 32, ) == 0x0
 03263   860   NtProtectVirtualMemory  (-1, (0x769c1000), 4096, 32, ... (0x769c1000), 4096, 4, ) == 0x0
 03264   860   NtFlushInstructionCache  (-1, 1989939200, 1244, ... ) == 0x0
 03265   860   NtProtectVirtualMemory  (-1, (0x769c1000), 1244, 4, ... (0x769c1000), 4096, 32, ) == 0x0
 03266   860   NtProtectVirtualMemory  (-1, (0x769c1000), 4096, 32, ... (0x769c1000), 4096, 4, ) == 0x0
 03267   860   NtFlushInstructionCache  (-1, 1989939200, 1244, ... ) == 0x0
 03268   860   NtProtectVirtualMemory  (-1, (0x769c1000), 1244, 4, ... (0x769c1000), 4096, 32, ) == 0x0
 03269   860   NtProtectVirtualMemory  (-1, (0x769c1000), 4096, 32, ... (0x769c1000), 4096, 4, ) == 0x0
 03270   860   NtFlushInstructionCache  (-1, 1989939200, 1244, ... ) == 0x0
 03271   860   NtOpenSection  (0xe, {24, 8, 0x40, 0, 0,  (0xe, {24, 8, 0x40, 0, 0, "WINSTA.dll"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 03272   860   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\u:\work\WINSTA.dll"}, 1233960, ... ) }, 1233960, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 03273   860   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\WINSTA.dll"}, 1233960, ... ) }, 1233960, ... ) == 0x0
 03274   860   NtOpenFile  (0x100020, {24, 0, 0x40, 0, 0,  (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\WINSTA.dll"}, 5, 96, ... 148, {status=0x0, info=1}, ) }, 5, 96, ... 148, {status=0x0, info=1}, ) == 0x0
 03275   860   NtCreateSection  (0xf, 0x0, 0x0, 16, 16777216, 148, ... 108, ) == 0x0
 03276   860   NtQuerySection  (108, Image, 48, ... {section info, class 1, size 48}, 0x0, ) == 0x0
 03277   860   NtClose  (148, ... ) == 0x0
 03278   860   NtMapViewOfSection  (108, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x76360000), 0x0, 65536, ) == 0x0
 03279   860   NtClose  (108, ... ) == 0x0
 03280   860   NtProtectVirtualMemory  (-1, (0x76361000), 212, 4, ... (0x76361000), 4096, 32, ) == 0x0
 03281   860   NtProtectVirtualMemory  (-1, (0x76361000), 4096, 32, ... (0x76361000), 4096, 4, ) == 0x0
 03282   860   NtFlushInstructionCache  (-1, 1983254528, 212, ... ) == 0x0
 03283   860   NtProtectVirtualMemory  (-1, (0x76361000), 212, 4, ... (0x76361000), 4096, 32, ) == 0x0
 03284   860   NtProtectVirtualMemory  (-1, (0x76361000), 4096, 32, ... (0x76361000), 4096, 4, ) == 0x0
 03285   860   NtFlushInstructionCache  (-1, 1983254528, 212, ... ) == 0x0
 03286   860   NtOpenSection  (0xe, {24, 8, 0x40, 0, 0,  (0xe, {24, 8, 0x40, 0, 0, "NETAPI32.dll"}, ... 108, ) }, ... 108, ) == 0x0
 03287   860   NtMapViewOfSection  (108, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x5b860000), 0x0, 344064, ) == 0x0
 03288   860   NtClose  (108, ... ) == 0x0
 03289   860   NtProtectVirtualMemory  (-1, (0x5b861000), 1168, 4, ... (0x5b861000), 4096, 32, ) == 0x0
 03290   860   NtProtectVirtualMemory  (-1, (0x5b861000), 4096, 32, ... (0x5b861000), 4096, 4, ) == 0x0
 03291   860   NtFlushInstructionCache  (-1, 1535512576, 1168, ... ) == 0x0
 03292   860   NtProtectVirtualMemory  (-1, (0x5b861000), 1168, 4, ... (0x5b861000), 4096, 32, ) == 0x0
 03293   860   NtProtectVirtualMemory  (-1, (0x5b861000), 4096, 32, ... (0x5b861000), 4096, 4, ) == 0x0
 03294   860   NtFlushInstructionCache  (-1, 1535512576, 1168, ... ) == 0x0
 03295   860   NtProtectVirtualMemory  (-1, (0x5b861000), 1168, 4, ... (0x5b861000), 4096, 32, ) == 0x0
 03296   860   NtProtectVirtualMemory  (-1, (0x5b861000), 4096, 32, ... (0x5b861000), 4096, 4, ) == 0x0
 03297   860   NtFlushInstructionCache  (-1, 1535512576, 1168, ... ) == 0x0
 03298   860   NtProtectVirtualMemory  (-1, (0x5b861000), 1168, 4, ... (0x5b861000), 4096, 32, ) == 0x0
 03299   860   NtProtectVirtualMemory  (-1, (0x5b861000), 4096, 32, ... (0x5b861000), 4096, 4, ) == 0x0
 03300   860   NtFlushInstructionCache  (-1, 1535512576, 1168, ... ) == 0x0
 03301   860   NtProtectVirtualMemory  (-1, (0x5b861000), 1168, 4, ... (0x5b861000), 4096, 32, ) == 0x0
 03302   860   NtProtectVirtualMemory  (-1, (0x5b861000), 4096, 32, ... (0x5b861000), 4096, 4, ) == 0x0
 03303   860   NtFlushInstructionCache  (-1, 1535512576, 1168, ... ) == 0x0
 03304   860   NtProtectVirtualMemory  (-1, (0x76361000), 212, 4, ... (0x76361000), 4096, 32, ) == 0x0
 03305   860   NtProtectVirtualMemory  (-1, (0x76361000), 4096, 32, ... (0x76361000), 4096, 4, ) == 0x0
 03306   860   NtFlushInstructionCache  (-1, 1983254528, 212, ... ) == 0x0
 03307   860   NtProtectVirtualMemory  (-1, (0x76361000), 212, 4, ... (0x76361000), 4096, 32, ) == 0x0
 03308   860   NtProtectVirtualMemory  (-1, (0x76361000), 4096, 32, ... (0x76361000), 4096, 4, ) == 0x0
 03309   860   NtFlushInstructionCache  (-1, 1983254528, 212, ... ) == 0x0
 03310   860   NtOpenSection  (0xe, {24, 8, 0x40, 0, 0,  (0xe, {24, 8, 0x40, 0, 0, "WTSAPI32.dll"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 03311   860   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\u:\work\WTSAPI32.dll"}, 1233960, ... ) }, 1233960, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 03312   860   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\WTSAPI32.dll"}, 1233960, ... ) }, 1233960, ... ) == 0x0
 03313   860   NtOpenFile  (0x100020, {24, 0, 0x40, 0, 0,  (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\WTSAPI32.dll"}, 5, 96, ... 108, {status=0x0, info=1}, ) }, 5, 96, ... 108, {status=0x0, info=1}, ) == 0x0
 03314   860   NtCreateSection  (0xf, 0x0, 0x0, 16, 16777216, 108, ... 148, ) == 0x0
 03315   860   NtQuerySection  (148, Image, 48, ... {section info, class 1, size 48}, 0x0, ) == 0x0
 03316   860   NtClose  (108, ... ) == 0x0
 03317   860   NtMapViewOfSection  (148, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x76f50000), 0x0, 32768, ) == 0x0
 03318   860   NtClose  (148, ... ) == 0x0
 03319   860   NtProtectVirtualMemory  (-1, (0x76f51000), 332, 4, ... (0x76f51000), 4096, 32, ) == 0x0
 03320   860   NtProtectVirtualMemory  (-1, (0x76f51000), 4096, 32, ... (0x76f51000), 4096, 4, ) == 0x0
 03321   860   NtFlushInstructionCache  (-1, 1995771904, 332, ... ) == 0x0
 03322   860   NtProtectVirtualMemory  (-1, (0x76f51000), 332, 4, ... (0x76f51000), 4096, 32, ) == 0x0
 03323   860   NtProtectVirtualMemory  (-1, (0x76f51000), 4096, 32, ... (0x76f51000), 4096, 4, ) == 0x0
 03324   860   NtFlushInstructionCache  (-1, 1995771904, 332, ... ) == 0x0
 03325   860   NtProtectVirtualMemory  (-1, (0x76f51000), 332, 4, ... (0x76f51000), 4096, 32, ) == 0x0
 03326   860   NtProtectVirtualMemory  (-1, (0x76f51000), 4096, 32, ... (0x76f51000), 4096, 4, ) == 0x0
 03327   860   NtFlushInstructionCache  (-1, 1995771904, 332, ... ) == 0x0
 03328   860   NtProtectVirtualMemory  (-1, (0x76f51000), 332, 4, ... (0x76f51000), 4096, 32, ) == 0x0
 03329   860   NtProtectVirtualMemory  (-1, (0x76f51000), 4096, 32, ... (0x76f51000), 4096, 4, ) == 0x0
 03330   860   NtFlushInstructionCache  (-1, 1995771904, 332, ... ) == 0x0
 03331   860   NtOpenSection  (0xe, {24, 8, 0x40, 0, 0,  (0xe, {24, 8, 0x40, 0, 0, "SETUPAPI.dll"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 03332   860   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\u:\work\SETUPAPI.dll"}, 1233960, ... ) }, 1233960, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 03333   860   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\SETUPAPI.dll"}, 1233960, ... ) }, 1233960, ... ) == 0x0
 03334   860   NtOpenFile  (0x100020, {24, 0, 0x40, 0, 0,  (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\SETUPAPI.dll"}, 5, 96, ... 148, {status=0x0, info=1}, ) }, 5, 96, ... 148, {status=0x0, info=1}, ) == 0x0
 03335   860   NtCreateSection  (0xf, 0x0, 0x0, 16, 16777216, 148, ... 108, ) == 0x0
 03336   860   NtQuerySection  (108, Image, 48, ... {section info, class 1, size 48}, 0x0, ) == 0x0
 03337   860   NtClose  (148, ... ) == 0x0
 03338   860   NtMapViewOfSection  (108, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x77920000), 0x0, 995328, ) == 0x0
 03339   860   NtClose  (108, ... ) == 0x0
 03340   860   NtProtectVirtualMemory  (-1, (0x77921000), 1368, 4, ... (0x77921000), 4096, 32, ) == 0x0
 03341   860   NtProtectVirtualMemory  (-1, (0x77921000), 4096, 32, ... (0x77921000), 4096, 4, ) == 0x0
 03342   860   NtFlushInstructionCache  (-1, 2006061056, 1368, ... ) == 0x0
 03343   860   NtProtectVirtualMemory  (-1, (0x77921000), 1368, 4, ... (0x77921000), 4096, 32, ) == 0x0
 03344   860   NtProtectVirtualMemory  (-1, (0x77921000), 4096, 32, ... (0x77921000), 4096, 4, ) == 0x0
 03345   860   NtFlushInstructionCache  (-1, 2006061056, 1368, ... ) == 0x0
 03346   860   NtProtectVirtualMemory  (-1, (0x77921000), 1368, 4, ... (0x77921000), 4096, 32, ) == 0x0
 03347   860   NtProtectVirtualMemory  (-1, (0x77921000), 4096, 32, ... (0x77921000), 4096, 4, ) == 0x0
 03348   860   NtFlushInstructionCache  (-1, 2006061056, 1368, ... ) == 0x0
 03349   860   NtProtectVirtualMemory  (-1, (0x77921000), 1368, 4, ... (0x77921000), 4096, 32, ) == 0x0
 03350   860   NtProtectVirtualMemory  (-1, (0x77921000), 4096, 32, ... (0x77921000), 4096, 4, ) == 0x0
 03351   860   NtFlushInstructionCache  (-1, 2006061056, 1368, ... ) == 0x0
 03352   860   NtProtectVirtualMemory  (-1, (0x77921000), 1368, 4, ... (0x77921000), 4096, 32, ) == 0x0
 03353   860   NtProtectVirtualMemory  (-1, (0x77921000), 4096, 32, ... (0x77921000), 4096, 4, ) == 0x0
 03354   860   NtFlushInstructionCache  (-1, 2006061056, 1368, ... ) == 0x0
 03355   860   NtProtectVirtualMemory  (-1, (0x69451000), 736, 4, ... (0x69451000), 4096, 32, ) == 0x0
 03356   860   NtProtectVirtualMemory  (-1, (0x69451000), 4096, 32, ... (0x69451000), 4096, 4, ) == 0x0
 03357   860   NtFlushInstructionCache  (-1, 1766133760, 736, ... ) == 0x0
 03358   860   NtProtectVirtualMemory  (-1, (0x69451000), 736, 4, ... (0x69451000), 4096, 32, ) == 0x0
 03359   860   NtProtectVirtualMemory  (-1, (0x69451000), 4096, 32, ... (0x69451000), 4096, 4, ) == 0x0
 03360   860   NtFlushInstructionCache  (-1, 1766133760, 736, ... ) == 0x0
 03361   860   NtProtectVirtualMemory  (-1, (0x69451000), 736, 4, ... (0x69451000), 4096, 32, ) == 0x0
 03362   860   NtProtectVirtualMemory  (-1, (0x69451000), 4096, 32, ... (0x69451000), 4096, 4, ) == 0x0
 03363   860   NtFlushInstructionCache  (-1, 1766133760, 736, ... ) == 0x0
 03364   860   NtOpenKey  (0x80000000, {24, 0, 0x40, 0, 0,  (0x80000000, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\USERENV.dll"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 03365   860   NtOpenKey  (0x2000000, {24, 16, 0x40, 0, 0,  (0x2000000, {24, 16, 0x40, 0, 0, "Software\Microsoft\Windows NT\CurrentVersion\winlogon"}, ... 108, ) }, ... 108, ) == 0x0
 03366   860   NtQueryValueKey  (108,  (108, "UserEnvDebugLevel", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 03367   860   NtClose  (108, ... ) == 0x0
 03368   860   NtOpenKey  (0x2000000, {24, 16, 0x40, 0, 0,  (0x2000000, {24, 16, 0x40, 0, 0, "Software\Microsoft\Windows NT\CurrentVersion\winlogon"}, ... 108, ) }, ... 108, ) == 0x0
 03369   860   NtQueryValueKey  (108,  (108, "ChkAccDebugLevel", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 03370   860   NtClose  (108, ... ) == 0x0
 03371   860   NtOpenKey  (0x20019, {24, 16, 0x40, 0, 0,  (0x20019, {24, 16, 0x40, 0, 0, "System\CurrentControlSet\Control\ProductOptions"}, ... 108, ) }, ... 108, ) == 0x0
 03372   860   NtQueryValueKey  (108,  (108, "ProductType", Partial, 144, ... TitleIdx=0, Type=1, Data="W\0i\0n\0N\0T\0\0\0"}, 24, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (108, "ProductType", Partial, 144, ... TitleIdx=0, Type=1, Data="W\0i\0n\0N\0T\0\0\0"}, 24, ) }, 24, ) == 0x0
 03373   860   NtClose  (108, ... ) == 0x0
 03374   860   NtCreateEvent  (0x1f0003, {24, 48, 0x80, 1232552, 0,  (0x1f0003, {24, 48, 0x80, 1232552, 0, "Global\userenv:  User Profile setup event"}, 0, 1, ... 108, ) }, 0, 1, ... 108, ) == STATUS_OBJECT_NAME_EXISTS
 03375   860   NtQueryDefaultLocale  (1, 1232304, ... ) == 0x0
 03376   860   NtQueryDefaultLocale  (1, 1232304, ... ) == 0x0
 03377   860   NtQueryDefaultLocale  (1, 1232304, ... ) == 0x0
 03378   860   NtQueryDefaultLocale  (1, 1232304, ... ) == 0x0
 03379   860   NtQueryDefaultLocale  (1, 1232304, ... ) == 0x0
 03380   860   NtQueryDefaultLocale  (1, 1232304, ... ) == 0x0
 03381   860   NtQueryDefaultLocale  (1, 1232304, ... ) == 0x0
 03382   860   NtQueryDefaultLocale  (1, 1232304, ... ) == 0x0
 03383   860   NtQueryDefaultLocale  (1, 1232304, ... ) == 0x0
 03384   860   NtQueryDefaultLocale  (1, 1232304, ... ) == 0x0
 03385   860   NtQueryDefaultLocale  (1, 1232304, ... ) == 0x0
 03386   860   NtQueryDefaultLocale  (1, 1232304, ... ) == 0x0
 03387   860   NtQueryDefaultLocale  (1, 1232304, ... ) == 0x0
 03388   860   NtQueryDefaultLocale  (1, 1232304, ... ) == 0x0
 03389   860   NtQueryDefaultLocale  (1, 1232304, ... ) == 0x0
 03390   860   NtQueryDefaultLocale  (1, 1232304, ... ) == 0x0
 03391   860   NtQueryDefaultLocale  (1, 1232304, ... ) == 0x0
 03392   860   NtQueryDefaultLocale  (1, 1232304, ... ) == 0x0
 03393   860   NtQueryDefaultLocale  (1, 1232304, ... ) == 0x0
 03394   860   NtQueryDefaultLocale  (1, 1232304, ... ) == 0x0
 03395   860   NtQueryDefaultLocale  (1, 1232304, ... ) == 0x0
 03396   860   NtQueryDefaultLocale  (1, 1232304, ... ) == 0x0
 03397   860   NtQueryDefaultLocale  (1, 1232304, ... ) == 0x0
 03398   860   NtQueryDefaultLocale  (1, 1232304, ... ) == 0x0
 03399   860   NtQueryDefaultLocale  (1, 1232304, ... ) == 0x0
 03400   860   NtQueryDefaultLocale  (1, 1232304, ... ) == 0x0
 03401   860   NtOpenThreadTokenEx  (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN
 03402   860   NtOpenProcessTokenEx  (-1, 0x20008, 512, ... 148, ) == 0x0
 03403   860   NtQueryInformationToken  (148, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0
 03404   860   NtClose  (148, ... ) == 0x0
 03405   860   NtOpenKey  (0x20019, {24, 0, 0x640, 0, 0,  (0x20019, {24, 0, 0x640, 0, 0, "\REGISTRY\USER\S-1-5-21-1292428093-1383384898-725345543-1003"}, ... 148, ) }, ... 148, ) == 0x0
 03406   860   NtOpenKey  (0x20019, {24, 148, 0x40, 0, 0,  (0x20019, {24, 148, 0x40, 0, 0, "Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders"}, ... 144, ) }, ... 144, ) == 0x0
 03407   860   NtQueryValueKey  (144,  (144, "Personal", Partial, 144, ... TitleIdx=0, Type=2, Data="%\0U\0S\0E\0R\0P\0R\0O\0F\0I\0L\0E\0%\0\\0M\0y\0 \0D\0o\0c\0u\0m\0e\0n\0t\0s\0\0\0"}, 66, ) , Partial, 144, ... TitleIdx=0, Type=2, Data= (144, "Personal", Partial, 144, ... TitleIdx=0, Type=2, Data="%\0U\0S\0E\0R\0P\0R\0O\0F\0I\0L\0E\0%\0\\0M\0y\0 \0D\0o\0c\0u\0m\0e\0n\0t\0s\0\0\0"}, 66, ) }, 66, ) == 0x0
 03408   860   NtQueryDefaultLocale  (1, 1232304, ... ) == 0x0
 03409   860   NtQueryValueKey  (144,  (144, "Local Settings", Partial, 144, ... TitleIdx=0, Type=2, Data="%\0U\0S\0E\0R\0P\0R\0O\0F\0I\0L\0E\0%\0\\0L\0o\0c\0a\0l\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\0\0"}, 70, ) , Partial, 144, ... TitleIdx=0, Type=2, Data= (144, "Local Settings", Partial, 144, ... TitleIdx=0, Type=2, Data="%\0U\0S\0E\0R\0P\0R\0O\0F\0I\0L\0E\0%\0\\0L\0o\0c\0a\0l\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\0\0"}, 70, ) }, 70, ) == 0x0
 03410   860   NtQueryDefaultLocale  (1, 1232304, ... ) == 0x0
 03411   860   NtQueryDefaultLocale  (1, 1232304, ... ) == 0x0
 03412   860   NtQueryDefaultLocale  (1, 1232304, ... ) == 0x0
 03413   860   NtQueryDefaultLocale  (1, 1232304, ... ) == 0x0
 03414   860   NtClose  (144, ... ) == 0x0
 03415   860   NtClose  (148, ... ) == 0x0
 03416   860   NtOpenKey  (0x2000000, {24, 16, 0x40, 0, 0,  (0x2000000, {24, 16, 0x40, 0, 0, "Software\Microsoft\Windows NT\CurrentVersion\winlogon"}, ... 148, ) }, ... 148, ) == 0x0
 03417   860   NtQueryValueKey  (148,  (148, "RsopDebugLevel", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 03418   860   NtClose  (148, ... ) == 0x0
 03419   860   NtOpenKey  (0x2000000, {24, 16, 0x40, 0, 0,  (0x2000000, {24, 16, 0x40, 0, 0, "Software\Microsoft\Windows NT\CurrentVersion\winlogon"}, ... 148, ) }, ... 148, ) == 0x0
 03420   860   NtQueryValueKey  (148,  (148, "UserEnvDebugLevel", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 03421   860   NtQueryValueKey  (148,  (148, "RsopLogging", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 03422   860   NtClose  (148, ... ) == 0x0
 03423   860   NtOpenKey  (0x2000000, {24, 16, 0x40, 0, 0,  (0x2000000, {24, 16, 0x40, 0, 0, "Software\Policies\Microsoft\Windows\System"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 03424   860   NtOpenKey  (0x2000000, {24, 16, 0x40, 0, 0,  (0x2000000, {24, 16, 0x40, 0, 0, "Software\Microsoft\Windows NT\CurrentVersion\winlogon"}, ... 148, ) }, ... 148, ) == 0x0
 03425   860   NtQueryValueKey  (148,  (148, "UserEnvDebugLevel", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 03426   860   NtClose  (148, ... ) == 0x0
 03427   860   NtOpenKey  (0x2000000, {24, 16, 0x40, 0, 0,  (0x2000000, {24, 16, 0x40, 0, 0, "Software\Policies\Microsoft\Windows\System"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 03428   860   NtOpenKey  (0x80000000, {24, 0, 0x40, 0, 0,  (0x80000000, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\NETAPI32.dll"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 03429   860   NtOpenKey  (0x80000000, {24, 0, 0x40, 0, 0,  (0x80000000, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\WINSTA.dll"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 03430   860   NtOpenKey  (0x80000000, {24, 0, 0x40, 0, 0,  (0x80000000, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\WTSAPI32.dll"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 03431   860   NtQueryPerformanceCounter  (... {932654128, 10}, {3579545, 0}, ) == 0x0
 03432   860   NtOpenKey  (0x80000000, {24, 0, 0x40, 0, 0,  (0x80000000, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SETUPAPI.dll"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 03433   860   NtQueryDefaultLocale  (1, 1234680, ... ) == 0x0
 03434   860   NtQueryInformationProcess  (-1, Wow64, 4, ... {process info, class 26, size 4}, 0x0, ) == 0x0
 03435   860   NtOpenKey  (0x20019, {24, 16, 0x40, 0, 0,  (0x20019, {24, 16, 0x40, 0, 0, "System\Setup"}, ... 148, ) }, ... 148, ) == 0x0
 03436   860   NtQueryValueKey  (148,  (148, "SystemSetupInProgress", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (148, "SystemSetupInProgress", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) }, 16, ) == 0x0
 03437   860   NtClose  (148, ... ) == 0x0
 03438   860   NtUserGetProcessWindowStation  (... ) == 0x1c
 03439   860   NtUserGetObjectInformation  (28, 1, 1234276, 12, 1234288, ... ) == 0x1
 03440   860   NtOpenKey  (0xf003f, {24, 16, 0x40, 0, 0,  (0xf003f, {24, 16, 0x40, 0, 0, "SYSTEM\CurrentControlSet\Control\MiniNT"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 03441   860   NtOpenKey  (0x20019, {24, 16, 0x40, 0, 0,  (0x20019, {24, 16, 0x40, 0, 0, "System\WPA\PnP"}, ... 148, ) }, ... 148, ) == 0x0
 03442   860   NtQueryValueKey  (148,  (148, "seed", Partial, 144, ... TitleIdx=0, Type=4, Data="\240d\351\211"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (148, "seed", Partial, 144, ... TitleIdx=0, Type=4, Data="\240d\351\211"}, 16, ) }, 16, ) == 0x0
 03443   860   NtClose  (148, ... ) == 0x0
 03444   860   NtOpenKey  (0x20019, {24, 16, 0x40, 0, 0,  (0x20019, {24, 16, 0x40, 0, 0, "SYSTEM\Setup"}, ... 148, ) }, ... 148, ) == 0x0
 03445   860   NtQueryValueKey  (148,  (148, "OsLoaderPath", Partial, 144, ... TitleIdx=0, Type=1, Data="\\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (148, "OsLoaderPath", Partial, 144, ... TitleIdx=0, Type=1, Data="\\0\0\0"}, 16, ) }, 16, ) == 0x0
 03446   860   NtQueryValueKey  (148,  (148, "OsLoaderPath", Partial, 144, ... TitleIdx=0, Type=1, Data="\\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (148, "OsLoaderPath", Partial, 144, ... TitleIdx=0, Type=1, Data="\\0\0\0"}, 16, ) }, 16, ) == 0x0
 03447   860   NtClose  (148, ... ) == 0x0
 03448   860   NtOpenKey  (0x20019, {24, 16, 0x40, 0, 0,  (0x20019, {24, 16, 0x40, 0, 0, "SYSTEM\Setup"}, ... 148, ) }, ... 148, ) == 0x0
 03449   860   NtQueryValueKey  (148,  (148, "SystemPartition", Partial, 144, ... TitleIdx=0, Type=1, Data="\\0D\0e\0v\0i\0c\0e\0\\0H\0a\0r\0d\0d\0i\0s\0k\0V\0o\0l\0u\0m\0e\01\0\0\0"}, 60, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (148, "SystemPartition", Partial, 144, ... TitleIdx=0, Type=1, Data="\\0D\0e\0v\0i\0c\0e\0\\0H\0a\0r\0d\0d\0i\0s\0k\0V\0o\0l\0u\0m\0e\01\0\0\0"}, 60, ) }, 60, ) == 0x0
 03450   860   NtQueryValueKey  (148,  (148, "SystemPartition", Partial, 144, ... TitleIdx=0, Type=1, Data="\\0D\0e\0v\0i\0c\0e\0\\0H\0a\0r\0d\0d\0i\0s\0k\0V\0o\0l\0u\0m\0e\01\0\0\0"}, 60, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (148, "SystemPartition", Partial, 144, ... TitleIdx=0, Type=1, Data="\\0D\0e\0v\0i\0c\0e\0\\0H\0a\0r\0d\0d\0i\0s\0k\0V\0o\0l\0u\0m\0e\01\0\0\0"}, 60, ) }, 60, ) == 0x0
 03451   860   NtClose  (148, ... ) == 0x0
 03452   860   NtOpenKey  (0x20019, {24, 16, 0x40, 0, 0,  (0x20019, {24, 16, 0x40, 0, 0, "Software\Microsoft\Windows\CurrentVersion\Setup"}, ... 148, ) }, ... 148, ) == 0x0
 03453   860   NtQueryValueKey  (148,  (148, "SourcePath", Partial, 144, ... TitleIdx=0, Type=1, Data="D\0:\0\\0\0\0"}, 20, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (148, "SourcePath", Partial, 144, ... TitleIdx=0, Type=1, Data="D\0:\0\\0\0\0"}, 20, ) }, 20, ) == 0x0
 03454   860   NtQueryValueKey  (148,  (148, "SourcePath", Partial, 144, ... TitleIdx=0, Type=1, Data="D\0:\0\\0\0\0"}, 20, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (148, "SourcePath", Partial, 144, ... TitleIdx=0, Type=1, Data="D\0:\0\\0\0\0"}, 20, ) }, 20, ) == 0x0
 03455   860   NtClose  (148, ... ) == 0x0
 03456   860   NtOpenKey  (0x20019, {24, 16, 0x40, 0, 0,  (0x20019, {24, 16, 0x40, 0, 0, "Software\Microsoft\Windows\CurrentVersion\Setup"}, ... 148, ) }, ... 148, ) == 0x0
 03457   860   NtQueryValueKey  (148,  (148, "ServicePackSourcePath", Partial, 144, ... TitleIdx=0, Type=1, Data="D\0:\0\\0\0\0"}, 20, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (148, "ServicePackSourcePath", Partial, 144, ... TitleIdx=0, Type=1, Data="D\0:\0\\0\0\0"}, 20, ) }, 20, ) == 0x0
 03458   860   NtQueryValueKey  (148,  (148, "ServicePackSourcePath", Partial, 144, ... TitleIdx=0, Type=1, Data="D\0:\0\\0\0\0"}, 20, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (148, "ServicePackSourcePath", Partial, 144, ... TitleIdx=0, Type=1, Data="D\0:\0\\0\0\0"}, 20, ) }, 20, ) == 0x0
 03459   860   NtClose  (148, ... ) == 0x0
 03460   860   NtOpenKey  (0x20019, {24, 16, 0x40, 0, 0,  (0x20019, {24, 16, 0x40, 0, 0, "Software\Microsoft\Windows\CurrentVersion\Setup"}, ... 148, ) }, ... 148, ) == 0x0
 03461   860   NtQueryValueKey  (148,  (148, "ServicePackCachePath", Partial, 144, ... TitleIdx=0, Type=1, Data="c\0:\0\\0w\0i\0n\0d\0o\0w\0s\0\\0S\0e\0r\0v\0i\0c\0e\0P\0a\0c\0k\0F\0i\0l\0e\0s\0\\0S\0e\0r\0v\0i\0c\0e\0P\0a\0c\0k\0C\0a\0c\0h\0e\0\0\0"}, 102, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (148, "ServicePackCachePath", Partial, 144, ... TitleIdx=0, Type=1, Data="c\0:\0\\0w\0i\0n\0d\0o\0w\0s\0\\0S\0e\0r\0v\0i\0c\0e\0P\0a\0c\0k\0F\0i\0l\0e\0s\0\\0S\0e\0r\0v\0i\0c\0e\0P\0a\0c\0k\0C\0a\0c\0h\0e\0\0\0"}, 102, ) }, 102, ) == 0x0
 03462   860   NtQueryValueKey  (148,  (148, "ServicePackCachePath", Partial, 144, ... TitleIdx=0, Type=1, Data="c\0:\0\\0w\0i\0n\0d\0o\0w\0s\0\\0S\0e\0r\0v\0i\0c\0e\0P\0a\0c\0k\0F\0i\0l\0e\0s\0\\0S\0e\0r\0v\0i\0c\0e\0P\0a\0c\0k\0C\0a\0c\0h\0e\0\0\0"}, 102, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (148, "ServicePackCachePath", Partial, 144, ... TitleIdx=0, Type=1, Data="c\0:\0\\0w\0i\0n\0d\0o\0w\0s\0\\0S\0e\0r\0v\0i\0c\0e\0P\0a\0c\0k\0F\0i\0l\0e\0s\0\\0S\0e\0r\0v\0i\0c\0e\0P\0a\0c\0k\0C\0a\0c\0h\0e\0\0\0"}, 102, ) }, 102, ) == 0x0
 03463   860   NtClose  (148, ... ) == 0x0
 03464   860   NtOpenKey  (0x20019, {24, 16, 0x40, 0, 0,  (0x20019, {24, 16, 0x40, 0, 0, "Software\Microsoft\Windows\CurrentVersion\Setup"}, ... 148, ) }, ... 148, ) == 0x0
 03465   860   NtQueryValueKey  (148,  (148, "DriverCachePath", Partial, 144, ... TitleIdx=0, Type=2, Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0D\0r\0i\0v\0e\0r\0 \0C\0a\0c\0h\0e\0\0\0"}, 64, ) , Partial, 144, ... TitleIdx=0, Type=2, Data= (148, "DriverCachePath", Partial, 144, ... TitleIdx=0, Type=2, Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0D\0r\0i\0v\0e\0r\0 \0C\0a\0c\0h\0e\0\0\0"}, 64, ) }, 64, ) == 0x0
 03466   860   NtQueryValueKey  (148,  (148, "DriverCachePath", Partial, 144, ... TitleIdx=0, Type=2, Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0D\0r\0i\0v\0e\0r\0 \0C\0a\0c\0h\0e\0\0\0"}, 64, ) , Partial, 144, ... TitleIdx=0, Type=2, Data= (148, "DriverCachePath", Partial, 144, ... TitleIdx=0, Type=2, Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0D\0r\0i\0v\0e\0r\0 \0C\0a\0c\0h\0e\0\0\0"}, 64, ) }, 64, ) == 0x0
 03467   860   NtClose  (148, ... ) == 0x0
 03468   860   NtOpenKey  (0x20019, {24, 16, 0x40, 0, 0,  (0x20019, {24, 16, 0x40, 0, 0, "Software\Microsoft\Windows\CurrentVersion"}, ... 148, ) }, ... 148, ) == 0x0
 03469   860   NtQueryValueKey  (148,  (148, "DevicePath", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 03470   860   NtQueryValueKey  (148,  (148, "DevicePath", Partial, 346, ... TitleIdx=0, Type=2, Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0i\0n\0f\0;\0%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0d\0e\0l\0l\0\\0a\0a\0c\0;\0%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0d\0e\0l\0l\0\\0a\0a\0r\0i\0c\0h\0;\0%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0d\0e\0l\0l\0\\0c\0e\0r\0c\0s\0r\06\0;\0%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0d\0e\0l\0l\0\\0a\03\02\00\0r\0a\0i\0d\0;\0%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0d\0e\0l\0l\0\\0i\0a\0s\0t\0o\0r\0;\0%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0d\0e\0l\0l\0\\0n\0v\0r\0a\0i\0d\0\0\0"}, 346, ) , Partial, 346, ... TitleIdx=0, Type=2, Data= (148, "DevicePath", Partial, 346, ... TitleIdx=0, Type=2, Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0i\0n\0f\0;\0%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0d\0e\0l\0l\0\\0a\0a\0c\0;\0%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0d\0e\0l\0l\0\\0a\0a\0r\0i\0c\0h\0;\0%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0d\0e\0l\0l\0\\0c\0e\0r\0c\0s\0r\06\0;\0%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0d\0e\0l\0l\0\\0a\03\02\00\0r\0a\0i\0d\0;\0%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0d\0e\0l\0l\0\\0i\0a\0s\0t\0o\0r\0;\0%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0d\0e\0l\0l\0\\0n\0v\0r\0a\0i\0d\0\0\0"}, 346, ) }, 346, ) == 0x0
 03471   860   NtClose  (148, ... ) == 0x0
 03472   860   NtCreateEvent  (0x1f0003, 0x0, 0, 0, ... 148, ) == 0x0
 03473   860   NtCreateMutant  (0x1f0001, 0x0, 0, ... 144, ) == 0x0
 03474   860   NtCreateEvent  (0x1f0003, 0x0, 0, 0, ... 168, ) == 0x0
 03475   860   NtCreateMutant  (0x1f0001, 0x0, 0, ... 160, ) == 0x0
 03476   860   NtCreateEvent  (0x1f0003, 0x0, 0, 0, ... 164, ) == 0x0
 03477   860   NtCreateMutant  (0x1f0001, 0x0, 0, ... 156, ) == 0x0
 03478   860   NtOpenKey  (0x1, {24, 16, 0x40, 0, 0,  (0x1, {24, 16, 0x40, 0, 0, "Software\Microsoft\Windows\CurrentVersion\Setup"}, ... 172, ) }, ... 172, ) == 0x0
 03479   860   NtQueryValueKey  (172,  (172, "LogLevel", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (172, "LogLevel", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) }, 16, ) == 0x0
 03480   860   NtQueryValueKey  (172,  (172, "LogLevel", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (172, "LogLevel", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) }, 16, ) == 0x0
 03481   860   NtQueryValueKey  (172,  (172, "LogPath", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 03482   860   NtOpenKey  (0x1, {24, 172, 0x40, 0, 0,  (0x1, {24, 172, 0x40, 0, 0, "AppLogLevels"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 03483   860   NtClose  (172, ... ) == 0x0
 03484   860   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\"}, 1234192, ... ) }, 1234192, ... ) == 0x0
 03485   860   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\System\CurrentControlSet\Control\ComputerName\ActiveComputerName"}, ... 172, ) }, ... 172, ) == 0x0
 03486   860   NtQueryValueKey  (172,  (172, "ComputerName", Full, 128, ... TitleIdx=0, Type=1, Name="ComputerName", Data="V\0I\0R\0T\0U\0A\0L\0\0\0"}, 60, ) , Full, 128, ... TitleIdx=0, Type=1, Name= (172, "ComputerName", Full, 128, ... TitleIdx=0, Type=1, Name="ComputerName", Data="V\0I\0R\0T\0U\0A\0L\0\0\0"}, 60, ) , Data= (172, "ComputerName", Full, 128, ... TitleIdx=0, Type=1, Name="ComputerName", Data="V\0I\0R\0T\0U\0A\0L\0\0\0"}, 60, ) }, 60, ) == 0x0
 03487   860   NtClose  (172, ... ) == 0x0
 03488   860   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\System\CurrentControlSet\Services\Tcpip\Parameters"}, ... 172, ) }, ... 172, ) == 0x0
 03489   860   NtQueryValueKey  (172,  (172, "Hostname", Full, 128, ... TitleIdx=0, Type=1, Name="Hostname", Data="v\0i\0r\0t\0u\0a\0l\0\0\0"}, 52, ) , Full, 128, ... TitleIdx=0, Type=1, Name= (172, "Hostname", Full, 128, ... TitleIdx=0, Type=1, Name="Hostname", Data="v\0i\0r\0t\0u\0a\0l\0\0\0"}, 52, ) , Data= (172, "Hostname", Full, 128, ... TitleIdx=0, Type=1, Name="Hostname", Data="v\0i\0r\0t\0u\0a\0l\0\0\0"}, 52, ) }, 52, ) == 0x0
 03490   860   NtClose  (172, ... ) == 0x0
 03491   860   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Policies\Microsoft\System\DNSclient"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 03492   860   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\System\CurrentControlSet\Services\Tcpip\Parameters"}, ... 172, ) }, ... 172, ) == 0x0
 03493   860   NtQueryValueKey  (172,  (172, "Domain", Full, 128, ... TitleIdx=0, Type=1, Name="Domain", Data="\0\0"}, 34, ) , Full, 128, ... TitleIdx=0, Type=1, Name= (172, "Domain", Full, 128, ... TitleIdx=0, Type=1, Name="Domain", Data="\0\0"}, 34, ) , Data= (172, "Domain", Full, 128, ... TitleIdx=0, Type=1, Name="Domain", Data="\0\0"}, 34, ) }, 34, ) == 0x0
 03494   860   NtClose  (172, ... ) == 0x0
 03495   860   NtOpenKey  (0x80000000, {24, 0, 0x40, 0, 0,  (0x80000000, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\faultrep.dll"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 03496   860   NtOpenKey  (0x20119, {24, 16, 0x40, 0, 0,  (0x20119, {24, 16, 0x40, 0, 0, "Software\Policies\Microsoft\PCHealth\ErrorReporting"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 03497   860   NtCreateKey  (0x20119, {24, 16, 0x40, 0, 0,  (0x20119, {24, 16, 0x40, 0, 0, "Software\Microsoft\PCHealth\ErrorReporting"}, 0, 0x0, 0, ... 172, 2, ) }, 0, 0x0, 0, ... 172, 2, ) == 0x0
 03498   860   NtOpenKey  (0x10000, {24, 172, 0x40, 0, 0,  (0x10000, {24, 172, 0x40, 0, 0, "DW"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 03499   860   NtQueryValueKey  (172,  (172, "DoReport", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (172, "DoReport", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) }, 16, ) == 0x0
 03500   860   NtQueryValueKey  (172,  (172, "ShowUI", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (172, "ShowUI", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) }, 16, ) == 0x0
 03501   860   NtQueryValueKey  (172,  (172, "AllOrNone", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (172, "AllOrNone", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) }, 16, ) == 0x0
 03502   860   NtQueryValueKey  (172,  (172, "IncludeMicrosoftApps", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (172, "IncludeMicrosoftApps", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) }, 16, ) == 0x0
 03503   860   NtQueryValueKey  (172,  (172, "IncludeWindowsApps", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (172, "IncludeWindowsApps", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) }, 16, ) == 0x0
 03504   860   NtQueryValueKey  (172,  (172, "DoTextLog", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 03505   860   NtQueryValueKey  (172,  (172, "IncludeKernelFaults", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (172, "IncludeKernelFaults", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) }, 16, ) == 0x0
 03506   860   NtQueryValueKey  (172,  (172, "IncludeShutdownErrs", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 03507   860   NtQueryValueKey  (172,  (172, "NumberOfFaultPipes", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 03508   860   NtQueryValueKey  (172,  (172, "NumberOfHangPipes", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 03509   860   NtQueryValueKey  (172,  (172, "MaxUserQueueSize", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 03510   860   NtQueryValueKey  (172,  (172, "ForceQueueMode", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 03511   860   NtCreateKey  (0x20119, {24, 172, 0x40, 0, 0,  (0x20119, {24, 172, 0x40, 0, 0, "ExclusionList"}, 0, 0x0, 0, ... 192, 2, ) }, 0, 0x0, 0, ... 192, 2, ) == 0x0
 03512   860   NtCreateKey  (0x20119, {24, 172, 0x40, 0, 0,  (0x20119, {24, 172, 0x40, 0, 0, "InclusionList"}, 0, 0x0, 0, ... 196, 2, ) }, 0, 0x0, 0, ... 196, 2, ) == 0x0
 03513   860   NtClose  (172, ... ) == 0x0
 03514   860   NtOpenKey  (0x20019, {24, 16, 0x40, 0, 0,  (0x20019, {24, 16, 0x40, 0, 0, "System\Setup"}, ... 172, ) }, ... 172, ) == 0x0
 03515   860   NtQueryValueKey  (172,  (172, "SystemSetupInProgress", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (172, "SystemSetupInProgress", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) }, 16, ) == 0x0
 03516   860   NtClose  (172, ... ) == 0x0
 03517   860   NtQueryInformationProcess  (-1, DefaultHardErrorMode, 4, ... {process info, class 12, size 4}, 0x0, ) == 0x0
 03518   860   NtSetInformationProcess  (-1, DefaultHardErrorMode, {process info, class 12, size 4}, 4, ... ) == 0x0
 03519   860   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\u:\work\packed.exe"}, 1231720, ... ) }, 1231720, ... ) == 0x0
 03520   860   NtOpenFile  (0x100001, {24, 0, 0x40, 0, 0,  (0x100001, {24, 0, 0x40, 0, 0, "\??\u:\"}, 3, 16417, ... 172, {status=0x0, info=1}, ) }, 3, 16417, ... 172, {status=0x0, info=1}, ) == 0x0
 03521   860   NtQueryDirectoryFile  (172, 0, 0, 0, 1231148, 616, BothDirectory, 1,  (172, 0, 0, 0, 1231148, 616, BothDirectory, 1, "work", 0, ... {status=0x0, info=108}, ) , 0, ... {status=0x0, info=108}, ) == 0x0
 03522   860   NtClose  (172, ... ) == 0x0
 03523   860   NtOpenFile  (0x100001, {24, 0, 0x40, 0, 0,  (0x100001, {24, 0, 0x40, 0, 0, "\??\u:\work\"}, 3, 16417, ... 172, {status=0x0, info=1}, ) }, 3, 16417, ... 172, {status=0x0, info=1}, ) == 0x0
 03524   860   NtQueryDirectoryFile  (172, 0, 0, 0, 1231148, 616, BothDirectory, 1,  (172, 0, 0, 0, 1231148, 616, BothDirectory, 1, "packed.exe", 0, ... {status=0x0, info=116}, ) , 0, ... {status=0x0, info=116}, ) == 0x0
 03525   860   NtClose  (172, ... ) == 0x0
 03526   860   NtQueryInformationProcess  (-1, DefaultHardErrorMode, 4, ... {process info, class 12, size 4}, 0x0, ) == 0x0
 03527   860   NtSetInformationProcess  (-1, DefaultHardErrorMode, {process info, class 12, size 4}, 4, ... ) == 0x0
 03528   860   NtQueryInformationProcess  (-1, DefaultHardErrorMode, 4, ... {process info, class 12, size 4}, 0x0, ) == 0x0
 03529   860   NtSetInformationProcess  (-1, DefaultHardErrorMode, {process info, class 12, size 4}, 4, ... ) == 0x0
 03530   860   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\u:\work\packed.exe"}, 1230368, ... ) }, 1230368, ... ) == 0x0
 03531   860   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\u:\work\packed.exe"}, 1229140, ... ) }, 1229140, ... ) == 0x0
 03532   860   NtQueryInformationProcess  (-1, DefaultHardErrorMode, 4, ... {process info, class 12, size 4}, 0x0, ) == 0x0
 03533   860   NtSetInformationProcess  (-1, DefaultHardErrorMode, {process info, class 12, size 4}, 4, ... ) == 0x0
 03534   860   NtQueryValueKey  (192,  (192, "packed.exe", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 03535   860   NtOpenThreadToken  (-2, 0x2000c, 1, ... ) == STATUS_NO_TOKEN
 03536   860   NtSetInformationThread  (-2, ImpersonationToken, {ImpToken=0,}, 4, ... ) == 0x0
 03537   860   NtCreateEvent  (0x1f0003, 0x0, 1, 0, ... 172, ) == 0x0
 03538   860   NtConnectPort  ( ("\RPC Control\IcaApi", {12, 2, 1, 0}, 0x0, 0x0, 1229512, 188, ... 176, 0x0, 0x0, 0x0, 188, ) , {12, 2, 1, 0}, 0x0, 0x0, 1229512, 188, ... 176, 0x0, 0x0, 0x0, 188, ) == 0x0
 03539   860   NtRequestWaitReplyPort  (176, {200, 224, new_msg, 0, 2621478, 1377496, 12, 2}  (176, {200, 224, new_msg, 0, 2621478, 1377496, 12, 2} "\0\0\24\0\360\1\24\0\274\0\0\0`\247\244\\261\353\317\21\206\21\0\240$T \355\1\0\0\0\1\0\0\0\0\0\3\0\4\0\0\002\24\0\3\0\0\0\10\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\377\377\3\0\0\0\360\5\25\0K\13{Tx\5\25\0\\1\24\0\12\0\0\0\0\0\0\0x\5\25\0(\0\0\0\200\5\25\0\332\376:\267\360\1\24\0(\0\0\0\21\275\0\0\0\0\24\0$\301\22\0&\13\230a\0\0\0\0P\221\24\0\360\6\221|\377\377\377\377P\0\0\0\346\31\0|\0\0\24\0H\301\22\0\372\31\221|\334\310\22\0\30\356\220|\0\0\0\0\0\0\0\0\0\0\0\0\351\201\347w" ... {200, 224, reply, 0, 464, 860, 58154, 0} "\7\0\24\0\360\1\24\0\274\0\0\0`\247\244\\261\353\317\21\206\21\0\240$T \355\1\0\0\0\1\0\0\0\0\0\0\0\4\0\0\002\24\0\377\377\377\377\10\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\377\377\3\0\0\0\360\5\25\0K\13{Tx\5\25\0\\1\24\0\12\0\0\0\0\0\0\0x\5\25\0(\0\0\0\200\5\25\0\332\376:\267\360\1\24\0(\0\0\0\21\275\0\0\0\0\24\0$\301\22\0&\13\230a\0\0\0\0P\221\24\0\360\6\221|\377\377\377\377P\0\0\0\346\31\0|\0\0\24\0H\301\22\0\372\31\221|\334\310\22\0\30\356\220|\0\0\0\0\0\0\0\0\0\0\0\0\351\201\347w" )  ... {200, 224, reply, 0, 464, 860, 58154, 0}  (176, {200, 224, new_msg, 0, 2621478, 1377496, 12, 2} "\0\0\24\0\360\1\24\0\274\0\0\0`\247\244\\261\353\317\21\206\21\0\240$T \355\1\0\0\0\1\0\0\0\0\0\3\0\4\0\0\002\24\0\3\0\0\0\10\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\377\377\3\0\0\0\360\5\25\0K\13{Tx\5\25\0\\1\24\0\12\0\0\0\0\0\0\0x\5\25\0(\0\0\0\200\5\25\0\332\376:\267\360\1\24\0(\0\0\0\21\275\0\0\0\0\24\0$\301\22\0&\13\230a\0\0\0\0P\221\24\0\360\6\221|\377\377\377\377P\0\0\0\346\31\0|\0\0\24\0H\301\22\0\372\31\221|\334\310\22\0\30\356\220|\0\0\0\0\0\0\0\0\0\0\0\0\351\201\347w" ... {200, 224, reply, 0, 464, 860, 58154, 0} "\7\0\24\0\360\1\24\0\274\0\0\0`\247\244\\261\353\317\21\206\21\0\240$T \355\1\0\0\0\1\0\0\0\0\0\0\0\4\0\0\002\24\0\377\377\377\377\10\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\377\377\3\0\0\0\360\5\25\0K\13{Tx\5\25\0\\1\24\0\12\0\0\0\0\0\0\0x\5\25\0(\0\0\0\200\5\25\0\332\376:\267\360\1\24\0(\0\0\0\21\275\0\0\0\0\24\0$\301\22\0&\13\230a\0\0\0\0P\221\24\0\360\6\221|\377\377\377\377P\0\0\0\346\31\0|\0\0\24\0H\301\22\0\372\31\221|\334\310\22\0\30\356\220|\0\0\0\0\0\0\0\0\0\0\0\0\351\201\347w" )  ) == 0x0
 03540   860   NtRequestWaitReplyPort  (176, {32, 56, new_msg, 0, 464, 860, 58146, 0}  (176, {32, 56, new_msg, 0, 464, 860, 58146, 0} "\1\31\0\0A\3\0\0`\247\244\\261\353\317\21\206\21\0\240$T \355\377\377\377\377\0\300\372\177" ... {124, 148, reply, 0, 464, 860, 58155, 0} "\2\356Q\200\1\0\0\0\30b\202\201\0\260\375\177\220k\364\367\370\37`\300lk\364\367X\353Q\200\0\0\0\0\0\0\0\0\206\252\254\3274US@\267\317oF\2\345 \230\1\300\375\177(l\364\367\253\362Q\200\324k\364\367\300\250U\200aFT\200\0\0\0\0h\242\250\201\0;\251\201\1`\202\201\0\0\0\0\0\376?\300\344\243n\371\20W\271\201\2\0\0\0\240V\271\201\240V\271\201" )  ... {124, 148, reply, 0, 464, 860, 58155, 0}  (176, {32, 56, new_msg, 0, 464, 860, 58146, 0} "\1\31\0\0A\3\0\0`\247\244\\261\353\317\21\206\21\0\240$T \355\377\377\377\377\0\300\372\177" ... {124, 148, reply, 0, 464, 860, 58155, 0} "\2\356Q\200\1\0\0\0\30b\202\201\0\260\375\177\220k\364\367\370\37`\300lk\364\367X\353Q\200\0\0\0\0\0\0\0\0\206\252\254\3274US@\267\317oF\2\345 \230\1\300\375\177(l\364\367\253\362Q\200\324k\364\367\300\250U\200aFT\200\0\0\0\0h\242\250\201\0;\251\201\1`\202\201\0\0\0\0\0\376?\300\344\243n\371\20W\271\201\2\0\0\0\240V\271\201\240V\271\201" )  ) == 0x0
 03541   860   NtRequestWaitReplyPort  (176, {44, 68, new_msg, 56, 464, 860, 58155, 0}  (176, {44, 68, new_msg, 56, 464, 860, 58155, 0} "\1\356\0\0B\2\5\0\30b\202\201\0\260\375\177\220k\364\367\370\37`\300\377\377\377\377X\353Q\200\1\0\0\0X\304\24\0\10\5\0\0" ... {40, 64, reply, 0, 464, 860, 58156, 0} "\2\376\255\201\4\0\0\0\200Y\274\201V\347\340\341\264\311\275\201:\332R\200X;\350\371\324\376\255\201\14\5\0\0\320\371\15\0" )  ... {40, 64, reply, 0, 464, 860, 58156, 0}  (176, {44, 68, new_msg, 56, 464, 860, 58155, 0} "\1\356\0\0B\2\5\0\30b\202\201\0\260\375\177\220k\364\367\370\37`\300\377\377\377\377X\353Q\200\1\0\0\0X\304\24\0\10\5\0\0" ... {40, 64, reply, 0, 464, 860, 58156, 0} "\2\376\255\201\4\0\0\0\200Y\274\201V\347\340\341\264\311\275\201:\332R\200X;\350\371\324\376\255\201\14\5\0\0\320\371\15\0" )  ) == 0x0
 03542   860   NtRequestWaitReplyPort  (176, {64, 88, new_msg, 56, 1369008, 1230088, 1360976, 0}  (176, {64, 88, new_msg, 56, 1369008, 1230088, 1360976, 0} "\10\0\0\0@\0\1\1\354\3\0\0\0\304\22\0X\304\24\0\34\311\22\0\30\356\220|p\5\221|\1\0\0\0X\304\24\0\14\5\0\0\14\5\0\0\320\371\15\0\0\0\0\0\0\0\0\0\273f\347w" ... {64, 88, reply, 56, 464, 860, 58157, 0} "\10\0\0\0@\0\1\1\354\3\0\0\0\304\22\0X\304\24\0\34\311\22\0\30\356\220|p\5\221|\1\0\0\0X\304\24\0\14\5\0\0\14\5\0\0\320\371\15\0\0\0\0\0\0\0\0\0\273f\347w" )  ... {64, 88, reply, 56, 464, 860, 58157, 0}  (176, {64, 88, new_msg, 56, 1369008, 1230088, 1360976, 0} "\10\0\0\0@\0\1\1\354\3\0\0\0\304\22\0X\304\24\0\34\311\22\0\30\356\220|p\5\221|\1\0\0\0X\304\24\0\14\5\0\0\14\5\0\0\320\371\15\0\0\0\0\0\0\0\0\0\273f\347w" ... {64, 88, reply, 56, 464, 860, 58157, 0} "\10\0\0\0@\0\1\1\354\3\0\0\0\304\22\0X\304\24\0\34\311\22\0\30\356\220|p\5\221|\1\0\0\0X\304\24\0\14\5\0\0\14\5\0\0\320\371\15\0\0\0\0\0\0\0\0\0\273f\347w" )  ) == 0x0
 03543   860   NtRequestWaitReplyPort  (176, {44, 68, new_msg, 56, 464, 860, 58156, 0}  (176, {44, 68, new_msg, 56, 464, 860, 58156, 0} "\1\376\0\0B\2\5\0\200Y\274\201V\347\340\341\264\311\275\201:\332R\200\377\377\377\377\324\376\255\201\1\0\0\0X\304\24\0\10\5\0\0" ... {40, 64, reply, 0, 464, 860, 58158, 0} "\2\356Q\200\4\0\0\0\30b\202\201\0\260\375\177\220k\364\367\370\37`\300lk\364\367X\353Q\200\14\5\0\0\320\371\15\0" )  ... {40, 64, reply, 0, 464, 860, 58158, 0}  (176, {44, 68, new_msg, 56, 464, 860, 58156, 0} "\1\376\0\0B\2\5\0\200Y\274\201V\347\340\341\264\311\275\201:\332R\200\377\377\377\377\324\376\255\201\1\0\0\0X\304\24\0\10\5\0\0" ... {40, 64, reply, 0, 464, 860, 58158, 0} "\2\356Q\200\4\0\0\0\30b\202\201\0\260\375\177\220k\364\367\370\37`\300lk\364\367X\353Q\200\14\5\0\0\320\371\15\0" )  ) == 0x0
 03544   860   NtRequestWaitReplyPort  (176, {64, 88, new_msg, 56, 1369008, 1230088, 1360976, 0}  (176, {64, 88, new_msg, 56, 1369008, 1230088, 1360976, 0} "\10\0\0\0@\0\1\1\354\3\0\0\0\304\22\0X\304\24\0\34\311\22\0\30\356\220|p\5\221|\1\0\0\0X\304\24\0\14\5\0\0\14\5\0\0\320\371\15\0\0\0\0\0\0\0\0\0\273f\347w" ... {64, 88, reply, 56, 464, 860, 58159, 0} "\10\0\0\0@\0\1\1\354\3\0\0\0\304\22\0X\304\24\0\34\311\22\0\30\356\220|p\5\221|\1\0\0\0X\304\24\0\14\5\0\0\14\5\0\0\320\371\15\0\0\0\0\0\0\0\0\0\273f\347w" )  ... {64, 88, reply, 56, 464, 860, 58159, 0}  (176, {64, 88, new_msg, 56, 1369008, 1230088, 1360976, 0} "\10\0\0\0@\0\1\1\354\3\0\0\0\304\22\0X\304\24\0\34\311\22\0\30\356\220|p\5\221|\1\0\0\0X\304\24\0\14\5\0\0\14\5\0\0\320\371\15\0\0\0\0\0\0\0\0\0\273f\347w" ... {64, 88, reply, 56, 464, 860, 58159, 0} "\10\0\0\0@\0\1\1\354\3\0\0\0\304\22\0X\304\24\0\34\311\22\0\30\356\220|p\5\221|\1\0\0\0X\304\24\0\14\5\0\0\14\5\0\0\320\371\15\0\0\0\0\0\0\0\0\0\273f\347w" )  ) == 0x0
 03545   860   NtOpenThreadToken  (-2, 0xc, 1, ... ) == STATUS_NO_TOKEN
 03546   860   NtCreateEvent  (0x1f0003, 0x0, 1, 0, ... 180, ) == 0x0
 03547   860   NtOpenThreadToken  (-2, 0xc, 1, ... ) == STATUS_NO_TOKEN
 03548   860   NtSetInformationThread  (-2, ImpersonationToken, {ImpToken=0,}, 4, ... ) == 0x0
 03549   860   NtCreateFile  (0xc0100080, {24, 0, 0x40, 0, 1229548,  (0xc0100080, {24, 0, 0x40, 0, 1229548, "\??\PIPE\lsarpc"}, 0x0, 0, 3, 1, 64, 0, 0, ... 200, {status=0x0, info=1}, ) }, 0x0, 0, 3, 1, 64, 0, 0, ... 200, {status=0x0, info=1}, ) == 0x0
 03550   860   NtSetInformationFile  (200, 1229604, 8, Pipe, ... {status=0x0, info=0}, ) == 0x0
 03551   860   NtSetInformationFile  (200, 1229592, 8, Completion, ... {status=0x0, info=0}, ) == 0x0
 03552   860   NtSetInformationThread  (-2, ImpersonationToken, {ImpToken=0,}, 4, ... ) == 0x0
 03553   860   NtWriteFile  (200, 77, 0, 0,  (200, 77, 0, 0, "\5\0\13\3\20\0\0\0H\0\0\0\1\0\0\0\270\20\270\20\0\0\0\0\1\0\0\0\0\0\1\0xW4\224\22\315\253\357\0\1#Eg\211\253\0\0\0\0\4]\210\212\353\34\311\21\237\350\10\0+\20H`\2\0\0\0", 72, {0, 0}, 0, ... {status=0x0, info=72}, ) , 72, {0, 0}, 0, ... {status=0x0, info=72}, ) == 0x0
 03554   860   NtReadFile  (200, 77, 0, 0, 1024, {0, 0}, 0, ... {status=0x0, info=68},  (200, 77, 0, 0, 1024, {0, 0}, 0, ... {status=0x0, info=68}, "\5\0\14\3\20\0\0\0D\0\0\0\1\0\0\0\270\20\270\20:+\0\0\14\0\PIPE\lsass\0\0\0\1\0\0\0\0\0\0\0\4]\210\212\353\34\311\21\237\350\10\0+\20H`\2\0\0\0", ) , ) == 0x0
 03555   860   NtFsControlFile  (200, 77, 0x0, 0x0, 0x11c017,  (200, 77, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0@\0\0\0\1\0\0\0(\0\0\0\0\0,\0\0\0\0\0\30\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\264\311\22\0\14\0\0\0\2\0\1\0\0\10\0\0", 64, 1024, ... {status=0x103, info=68}, "\5\0\14\3\20\0\0\0D\0\0\0\1\0\0\0\270\20\270\20:+\0\0\14\0\PIPE\lsass\0\0\0\1\0\0\0\0\0\0\0\4]\210\212\353\34\311\21\237\350\10\0+\20H`\2\0\0\0", ) , 64, 1024, ... {status=0x103, info=68},  (200, 77, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0@\0\0\0\1\0\0\0(\0\0\0\0\0,\0\0\0\0\0\30\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\264\311\22\0\14\0\0\0\2\0\1\0\0\10\0\0", 64, 1024, ... {status=0x103, info=68}, "\5\0\14\3\20\0\0\0D\0\0\0\1\0\0\0\270\20\270\20:+\0\0\14\0\PIPE\lsass\0\0\0\1\0\0\0\0\0\0\0\4]\210\212\353\34\311\21\237\350\10\0+\20H`\2\0\0\0", ) , ) == 0x103
 03556   860   NtFsControlFile  (200, 77, 0x0, 0x0, 0x11c017,  (200, 77, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0\214\0\0\0\2\0\0\0t\0\0\0\0\0D\0\0\0\0\0\34\303\247\343>\250^I\215m\0\251\33\26\11\333\1\0\0\0\1\0\0\0,\0.\0h\314\22\0\27\0\0\0\0\0\0\0\26\0\0\0V\0I\0R\0T\0U\0A\0L\0\\0M\0a\0r\0t\0i\0m\0 \0C\0a\0r\0b\0o\0n\0e\0\0\0\0\0\0\0\0\0\1\0na\0\0\0\0\0\0\0\0\2\0\0\0", 140, 1024, ... {status=0x103, info=48}, "\5\0\2\3\20\0\0\00\0\0\0\1\0\0\0\30\0\0\0\0\0\0\0\0\0\0\0\34\303\247\343>\250^I\215m\0\251\33\26\11\333\0\0\0\0", ) , 140, 1024, ... {status=0x103, info=48},  (200, 77, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0\214\0\0\0\2\0\0\0t\0\0\0\0\0D\0\0\0\0\0\34\303\247\343>\250^I\215m\0\251\33\26\11\333\1\0\0\0\1\0\0\0,\0.\0h\314\22\0\27\0\0\0\0\0\0\0\26\0\0\0V\0I\0R\0T\0U\0A\0L\0\\0M\0a\0r\0t\0i\0m\0 \0C\0a\0r\0b\0o\0n\0e\0\0\0\0\0\0\0\0\0\1\0na\0\0\0\0\0\0\0\0\2\0\0\0", 140, 1024, ... {status=0x103, info=48}, "\5\0\2\3\20\0\0\00\0\0\0\1\0\0\0\30\0\0\0\0\0\0\0\0\0\0\0\34\303\247\343>\250^I\215m\0\251\33\26\11\333\0\0\0\0", ) , ) == 0x103
 03557   860   NtFsControlFile  (200, 77, 0x0, 0x0, 0x11c017,  (200, 77, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0,\0\0\0\3\0\0\0\24\0\0\0\0\0\0\0\0\0\0\0\34\303\247\343>\250^I\215m\0\251\33\26\11\333", 44, 1024, ... {status=0x103, info=180}, "\5\0\2\3\20\0\0\0\264\0\0\0\2\0\0\0\234\0\0\0\0\0\0\0\270\37\24\0\1\0\0\0\304\37\24\0 \0\0\0\1\0\0\0\16\0\20\0\320\37\24\0\340\37\24\0\10\0\0\0\0\0\0\0\7\0\0\0V\0I\0R\0T\0U\0A\0L\0O\0\4\0\0\0\1\4\0\0\0\0\0\5\25\0\0\0=\343\10MB\307tR\7\345;+\1\0\0\0p\276\24\0\1\0\0\0\1\0\0\0\200\276\24\0\0\0\0\0\0\0\0\0\5\0\0\0\1\5\0\0\0\0\0\5\25\0\0\0=\343\10MB\307tR\7\345;+\353\3\0\0\1\0\0\0\0\0\0\0", ) , 44, 1024, ... {status=0x103, info=180},  (200, 77, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0,\0\0\0\3\0\0\0\24\0\0\0\0\0\0\0\0\0\0\0\34\303\247\343>\250^I\215m\0\251\33\26\11\333", 44, 1024, ... {status=0x103, info=180}, "\5\0\2\3\20\0\0\0\264\0\0\0\2\0\0\0\234\0\0\0\0\0\0\0\270\37\24\0\1\0\0\0\304\37\24\0 \0\0\0\1\0\0\0\16\0\20\0\320\37\24\0\340\37\24\0\10\0\0\0\0\0\0\0\7\0\0\0V\0I\0R\0T\0U\0A\0L\0O\0\4\0\0\0\1\4\0\0\0\0\0\5\25\0\0\0=\343\10MB\307tR\7\345;+\1\0\0\0p\276\24\0\1\0\0\0\1\0\0\0\200\276\24\0\0\0\0\0\0\0\0\0\5\0\0\0\1\5\0\0\0\0\0\5\25\0\0\0=\343\10MB\307tR\7\345;+\353\3\0\0\1\0\0\0\0\0\0\0", ) , ) == 0x103
 03558   860   NtClose  (180, ... ) == 0x0
 03559   860   NtClose  (200, ... ) == 0x0
 03560   860   NtOpenThreadToken  (-2, 0xc, 1, ... ) == STATUS_NO_TOKEN
 03561   860   NtCreateEvent  (0x1f0003, 0x0, 1, 0, ... 200, ) == 0x0
 03562   860   NtOpenThreadToken  (-2, 0xc, 1, ... ) == STATUS_NO_TOKEN
 03563   860   NtSetInformationThread  (-2, ImpersonationToken, {ImpToken=0,}, 4, ... ) == 0x0
 03564   860   NtCreateFile  (0xc0100080, {24, 0, 0x40, 0, 1229520,  (0xc0100080, {24, 0, 0x40, 0, 1229520, "\??\PIPE\lsarpc"}, 0x0, 0, 3, 1, 64, 0, 0, ... 180, {status=0x0, info=1}, ) }, 0x0, 0, 3, 1, 64, 0, 0, ... 180, {status=0x0, info=1}, ) == 0x0
 03565   860   NtSetInformationFile  (180, 1229576, 8, Pipe, ... {status=0x0, info=0}, ) == 0x0
 03566   860   NtSetInformationFile  (180, 1229564, 8, Completion, ... {status=0x0, info=0}, ) == 0x0
 03567   860   NtSetInformationThread  (-2, ImpersonationToken, {ImpToken=0,}, 4, ... ) == 0x0
 03568   860   NtWriteFile  (180, 77, 0, 0,  (180, 77, 0, 0, "\5\0\13\3\20\0\0\0H\0\0\0\1\0\0\0\270\20\270\20\0\0\0\0\1\0\0\0\0\0\1\0xW4\224\22\315\253\357\0\1#Eg\211\253\0\0\0\0\4]\210\212\353\34\311\21\237\350\10\0+\20H`\2\0\0\0", 72, {0, 0}, 0, ... {status=0x0, info=72}, ) , 72, {0, 0}, 0, ... {status=0x0, info=72}, ) == 0x0
 03569   860   NtReadFile  (180, 77, 0, 0, 1024, {0, 0}, 0, ... {status=0x0, info=68},  (180, 77, 0, 0, 1024, {0, 0}, 0, ... {status=0x0, info=68}, "\5\0\14\3\20\0\0\0D\0\0\0\1\0\0\0\270\20\270\20;+\0\0\14\0\PIPE\lsass\0\0\0\1\0\0\0\0\0\0\0\4]\210\212\353\34\311\21\237\350\10\0+\20H`\2\0\0\0", ) , ) == 0x0
 03570   860   NtFsControlFile  (180, 77, 0x0, 0x0, 0x11c017,  (180, 77, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0@\0\0\0\1\0\0\0(\0\0\0\0\0,\0\0\0\0\0\30\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\230\311\22\0\14\0\0\0\2\0\1\0\0\10\0\0", 64, 1024, ... {status=0x103, info=68}, "\5\0\14\3\20\0\0\0D\0\0\0\1\0\0\0\270\20\270\20;+\0\0\14\0\PIPE\lsass\0\0\0\1\0\0\0\0\0\0\0\4]\210\212\353\34\311\21\237\350\10\0+\20H`\2\0\0\0", ) , 64, 1024, ... {status=0x103, info=68},  (180, 77, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0@\0\0\0\1\0\0\0(\0\0\0\0\0,\0\0\0\0\0\30\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\230\311\22\0\14\0\0\0\2\0\1\0\0\10\0\0", 64, 1024, ... {status=0x103, info=68}, "\5\0\14\3\20\0\0\0D\0\0\0\1\0\0\0\270\20\270\20;+\0\0\14\0\PIPE\lsass\0\0\0\1\0\0\0\0\0\0\0\4]\210\212\353\34\311\21\237\350\10\0+\20H`\2\0\0\0", ) , ) == 0x103
 03571   860   NtFsControlFile  (180, 77, 0x0, 0x0, 0x11c017,  (180, 77, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0\214\0\0\0\2\0\0\0t\0\0\0\0\0D\0\0\0\0\0\331\220R\0\344\220\250N\261{\227NMG\317'\1\0\0\0\1\0\0\0,\0.\0h\314\22\0\27\0\0\0\0\0\0\0\26\0\0\0V\0I\0R\0T\0U\0A\0L\0\\0M\0a\0r\0t\0i\0m\0 \0C\0a\0r\0b\0o\0n\0e\0\0\0\0\0\0\0\0\0\1\0na\0\0\0\0\0\0\0\0\2\0\0\0", 140, 1024, ... {status=0x103, info=48}, "\5\0\2\3\20\0\0\00\0\0\0\1\0\0\0\30\0\0\0\0\0\0\0\0\0\0\0\331\220R\0\344\220\250N\261{\227NMG\317'\0\0\0\0", ) , 140, 1024, ... {status=0x103, info=48},  (180, 77, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0\214\0\0\0\2\0\0\0t\0\0\0\0\0D\0\0\0\0\0\331\220R\0\344\220\250N\261{\227NMG\317'\1\0\0\0\1\0\0\0,\0.\0h\314\22\0\27\0\0\0\0\0\0\0\26\0\0\0V\0I\0R\0T\0U\0A\0L\0\\0M\0a\0r\0t\0i\0m\0 \0C\0a\0r\0b\0o\0n\0e\0\0\0\0\0\0\0\0\0\1\0na\0\0\0\0\0\0\0\0\2\0\0\0", 140, 1024, ... {status=0x103, info=48}, "\5\0\2\3\20\0\0\00\0\0\0\1\0\0\0\30\0\0\0\0\0\0\0\0\0\0\0\331\220R\0\344\220\250N\261{\227NMG\317'\0\0\0\0", ) , ) == 0x103
 03572   860   NtFsControlFile  (180, 77, 0x0, 0x0, 0x11c017,  (180, 77, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0,\0\0\0\3\0\0\0\24\0\0\0\0\0\0\0\0\0\0\0\331\220R\0\344\220\250N\261{\227NMG\317'", 44, 1024, ... {status=0x103, info=180}, "\5\0\2\3\20\0\0\0\264\0\0\0\2\0\0\0\234\0\0\0\0\0\0\0\270\37\24\0\1\0\0\0\304\37\24\0 \0\0\0\1\0\0\0\16\0\20\0\320\37\24\0\340\37\24\0\10\0\0\0\0\0\0\0\7\0\0\0V\0I\0R\0T\0U\0A\0L\0O\0\4\0\0\0\1\4\0\0\0\0\0\5\25\0\0\0=\343\10MB\307tR\7\345;+\1\0\0\0p\276\24\0\1\0\0\0\1\0\0\0\200\276\24\0\0\0\0\0\0\0\0\0\5\0\0\0\1\5\0\0\0\0\0\5\25\0\0\0=\343\10MB\307tR\7\345;+\353\3\0\0\1\0\0\0\0\0\0\0", ) , 44, 1024, ... {status=0x103, info=180},  (180, 77, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0,\0\0\0\3\0\0\0\24\0\0\0\0\0\0\0\0\0\0\0\331\220R\0\344\220\250N\261{\227NMG\317'", 44, 1024, ... {status=0x103, info=180}, "\5\0\2\3\20\0\0\0\264\0\0\0\2\0\0\0\234\0\0\0\0\0\0\0\270\37\24\0\1\0\0\0\304\37\24\0 \0\0\0\1\0\0\0\16\0\20\0\320\37\24\0\340\37\24\0\10\0\0\0\0\0\0\0\7\0\0\0V\0I\0R\0T\0U\0A\0L\0O\0\4\0\0\0\1\4\0\0\0\0\0\5\25\0\0\0=\343\10MB\307tR\7\345;+\1\0\0\0p\276\24\0\1\0\0\0\1\0\0\0\200\276\24\0\0\0\0\0\0\0\0\0\5\0\0\0\1\5\0\0\0\0\0\5\25\0\0\0=\343\10MB\307tR\7\345;+\353\3\0\0\1\0\0\0\0\0\0\0", ) , ) == 0x103
 03573   860   NtClose  (200, ... ) == 0x0
 03574   860   NtClose  (180, ... ) == 0x0
 03575   860   NtOpenProcessToken  (-1, 0x20008, ... 180, ) == 0x0
 03576   860   NtQueryInformationToken  (180, User, 0, ... ) == STATUS_BUFFER_TOO_SMALL
 03577   860   NtQueryInformationToken  (180, User, 36, ... {token info, class 1, size 36}, 36, ) == 0x0
 03578   860   NtOpenDirectoryObject  (0x2, {24, 0, 0x40, 0, 0,  (0x2, {24, 0, 0x40, 0, 0, "\Windows\WindowStations"}, ... 200, ) }, ... 200, ) == 0x0
 03579   860   NtUserOpenWindowStation  ({24, 200, 0x40, 0, 0,  ({24, 200, 0x40, 0, 0, "winsta0"}, 0x37f, ... ) }, 0x37f, ... ) == 0xcc
 03580   860   NtClose  (200, ... ) == 0x0
 03581   860   NtUserCloseWindowStation  (204, ...
 03582   860   NtClose  (204, ... ) == 0x0
 03581   860   NtUserCloseWindowStation  ... ) == 0x1
 03583   860   NtClose  (180, ... ) == 0x0
 03584   860   NtCreateEvent  (0x1f0003, {24, 0, 0x2, 0, 0, 0x0}, 1, 0, ... 180, ) == 0x0
 03585   860   NtCreateEvent  (0x1f0003, {24, 0, 0x2, 0, 0, 0x0}, 1, 0, ... 204, ) == 0x0
 03586   860   NtCreateMutant  (0x1f0001, {24, 0, 0x2, 0, 0, 0x0}, 0, ... 200, ) == 0x0
 03587   860   NtDuplicateObject  (-1, -1, -1, 0x1f0fff, 2, 0, ... 208, ) == 0x0
 03588   860   NtCreateSection  (0xf0007, {24, 0, 0x2, 0, 0, 0x0}, {7248, 0}, 4, 134217728, 0, ... 212, ) == 0x0
 03589   860   NtMapViewOfSection  (212, -1, (0x0), 0, 0, {0, 0}, 0, 1, 0, 4, ... (0x3d0000), {0, 0}, 8192, ) == 0x0
 03590   860   NtQueryDefaultUILanguage  (1230212, ...
 03591   860   NtOpenThreadTokenEx  (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN
 03592   860   NtOpenProcessTokenEx  (-1, 0x20008, 512, ... -2147482740, ) == 0x0
 03593   860   NtQueryInformationToken  (-2147482740, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0
 03594   860   NtClose  (-2147482740, ... ) == 0x0
 03595   860   NtOpenKey  (0x2000000, {24, 0, 0x640, 0, 0,  (0x2000000, {24, 0, 0x640, 0, 0, "\REGISTRY\USER\S-1-5-21-1292428093-1383384898-725345543-1003"}, ... -2147482740, ) }, ... -2147482740, ) == 0x0
 03596   860   NtOpenKey  (0x80000000, {24, -2147482740, 0x240, 0, 0,  (0x80000000, {24, -2147482740, 0x240, 0, 0, "Software\Policies\Microsoft\Control Panel\Desktop"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 03597   860   NtOpenKey  (0x80000000, {24, -2147482740, 0x640, 0, 0,  (0x80000000, {24, -2147482740, 0x640, 0, 0, "Control Panel\Desktop"}, ... -2147482656, ) }, ... -2147482656, ) == 0x0
 03598   860   NtQueryValueKey  (-2147482656,  (-2147482656, "MultiUILanguageId", Partial, 256, ... ) , Partial, 256, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 03599   860   NtClose  (-2147482656, ... ) == 0x0
 03600   860   NtClose  (-2147482740, ... ) == 0x0
 03590   860   NtQueryDefaultUILanguage  ... ) == 0x0
 03601   860   NtQueryInformationProcess  (-1, DefaultHardErrorMode, 4, ... {process info, class 12, size 4}, 0x0, ) == 0x0
 03602   860   NtSetInformationProcess  (-1, DefaultHardErrorMode, {process info, class 12, size 4}, 4, ... ) == 0x0
 03603   860   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\u:\work\packed.exe"}, 1228456, ... ) }, 1228456, ... ) == 0x0
 03604   860   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\u:\work\packed.exe"}, 1227228, ... ) }, 1227228, ... ) == 0x0
 03605   860   NtQueryInformationProcess  (-1, DefaultHardErrorMode, 4, ... {process info, class 12, size 4}, 0x0, ) == 0x0
 03606   860   NtSetInformationProcess  (-1, DefaultHardErrorMode, {process info, class 12, size 4}, 4, ... ) == 0x0
 03607   860   NtCreateFile  (0x10100080, {24, 0, 0x40, 0, 1229564,  (0x10100080, {24, 0, 0x40, 0, 1229564, "\??\C:\DOCUME~1\MARTIM~1\LOCALS~1\Temp\10e8_appcompat.txt"}, 0x0, 128, 0, 2, 96, 0, 0, ... }, 0x0, 128, 0, 2, 96, 0, 0, ...
 03608   860   NtQueryDirectoryFile  (-2147482740, 0, 0, 0, -518316032, 4096, Names, 1,  (-2147482740, 0, 0, 0, -518316032, 4096, Names, 1, "DOCUME~1", 1, ... {status=0x0, info=56}, ) , 1, ... {status=0x0, info=56}, ) == 0x0
 03609   860   NtClose  (-2147482740, ... ) == 0x0
 03610   860   NtQueryDirectoryFile  (-2147482740, 0, 0, 0, -518316032, 4096, Names, 1,  (-2147482740, 0, 0, 0, -518316032, 4096, Names, 1, "MARTIM~1", 1, ... {status=0x0, info=40}, ) , 1, ... {status=0x0, info=40}, ) == 0x0
 03611   860   NtClose  (-2147482740, ... ) == 0x0
 03612   860   NtQueryDirectoryFile  (-2147482740, 0, 0, 0, -518316032, 4096, Names, 1,  (-2147482740, 0, 0, 0, -518316032, 4096, Names, 1, "LOCALS~1", 1, ... {status=0x0, info=40}, ) , 1, ... {status=0x0, info=40}, ) == 0x0
 03613   860   NtClose  (-2147482740, ... ) == 0x0
 03607   860   NtCreateFile  ... 216, {status=0x0, info=2}, ) == 0x0
 03614   860   NtClose  (216, ... ) == 0x0
 03615   860   NtCreateSection  (0xf001f, 0x0, {4194304, 0}, 4, 67108864, 0, ... 216, ) == 0x0
 03616   860   NtMapViewOfSection  (216, -1, (0x0), 0, 0, 0x0, 4194304, 2, 0, 4, ... (0xac0000), 0x0, 4194304, ) == 0x0
 03617   860   NtAllocateVirtualMemory  (-1, 11272192, 0, 1, 4096, 4, ... 11272192, 4096, ) == 0x0
 03618   860   NtAllocateVirtualMemory  (-1, 11276288, 0, 3104, 4096, 4, ... 11276288, 4096, ) == 0x0
 03619   860   NtCreateSection  (0xf0007, 0x0, {26652, 0}, 4, 134217728, 0, ... 220, ) == 0x0
 03620   860   NtMapViewOfSection  (220, -1, (0x0), 0, 0, {0, 0}, 0, 1, 0, 4, ... (0x3e0000), {0, 0}, 28672, ) == 0x0
 03621   860   NtUnmapViewOfSection  (-1, 0x3e0000, ... ) == 0x0
 03622   860   NtMapViewOfSection  (220, -1, (0x0), 0, 0, {0, 0}, 0, 1, 0, 4, ... (0x3e0000), {0, 0}, 28672, ) == 0x0
 03623   860   NtClose  (216, ... ) == 0x0
 03624   860   NtUnmapViewOfSection  (-1, 0xac0000, ... ) == 0x0
 03625   860   NtUnmapViewOfSection  (-1, 0x3e0000, ... ) == 0x0
 03626   860   NtMapViewOfSection  (220, -1, (0x0), 0, 0, {0, 0}, 0, 1, 0, 4, ... (0x3e0000), {0, 0}, 28672, ) == 0x0
 03627   860   NtUnmapViewOfSection  (-1, 0x3e0000, ... ) == 0x0
 03628   860   NtMapViewOfSection  (220, -1, (0x0), 0, 0, {0, 0}, 0, 1, 0, 4, ... (0x3e0000), {0, 0}, 28672, ) == 0x0
 03629   860   NtUnmapViewOfSection  (-1, 0x3e0000, ... ) == 0x0
 03630   860   NtMapViewOfSection  (220, -1, (0x0), 0, 0, {0, 0}, 0, 1, 0, 4, ... (0x3e0000), {0, 0}, 28672, ) == 0x0
 03631   860   NtUnmapViewOfSection  (-1, 0x3e0000, ... ) == 0x0
 03632   860   NtMapViewOfSection  (220, -1, (0x0), 0, 0, {0, 0}, 0, 1, 0, 4, ... (0x3e0000), {0, 0}, 28672, ) == 0x0
 03633   860   NtUnmapViewOfSection  (-1, 0x3e0000, ... ) == 0x0
 03634   860   NtMapViewOfSection  (220, -1, (0x0), 0, 0, {0, 0}, 0, 1, 0, 4, ... (0x3e0000), {0, 0}, 28672, ) == 0x0
 03635   860   NtUnmapViewOfSection  (-1, 0x3e0000, ... ) == 0x0
 03636   860   NtMapViewOfSection  (220, -1, (0x0), 0, 0, {0, 0}, 0, 1, 0, 4, ... (0x3e0000), {0, 0}, 28672, ) == 0x0
 03637   860   NtUnmapViewOfSection  (-1, 0x3e0000, ... ) == 0x0
 03638   860   NtMapViewOfSection  (220, -1, (0x0), 0, 0, {0, 0}, 0, 1, 0, 4, ... (0x3e0000), {0, 0}, 28672, ) == 0x0
 03639   860   NtUnmapViewOfSection  (-1, 0x3e0000, ... ) == 0x0
 03640   860   NtMapViewOfSection  (220, -1, (0x0), 0, 0, {0, 0}, 0, 1, 0, 4, ... (0x3e0000), {0, 0}, 28672, ) == 0x0
 03641   860   NtUnmapViewOfSection  (-1, 0x3e0000, ... ) == 0x0
 03642   860   NtMapViewOfSection  (220, -1, (0x0), 0, 0, {0, 0}, 0, 1, 0, 4, ... (0x3e0000), {0, 0}, 28672, ) == 0x0
 03643   860   NtUnmapViewOfSection  (-1, 0x3e0000, ... ) == 0x0
 03644   860   NtMapViewOfSection  (220, -1, (0x0), 0, 0, {0, 0}, 0, 1, 0, 4, ... (0x3e0000), {0, 0}, 28672, ) == 0x0
 03645   860   NtUnmapViewOfSection  (-1, 0x3e0000, ... ) == 0x0
 03646   860   NtMapViewOfSection  (220, -1, (0x0), 0, 0, {0, 0}, 0, 1, 0, 4, ... (0x3e0000), {0, 0}, 28672, ) == 0x0
 03647   860   NtUnmapViewOfSection  (-1, 0x3e0000, ... ) == 0x0
 03648   860   NtMapViewOfSection  (220, -1, (0x0), 0, 0, {0, 0}, 0, 1, 0, 4, ... (0x3e0000), {0, 0}, 28672, ) == 0x0
 03649   860   NtUnmapViewOfSection  (-1, 0x3e0000, ... ) == 0x0
 03650   860   NtMapViewOfSection  (220, -1, (0x0), 0, 0, {0, 0}, 0, 1, 0, 4, ... (0x3e0000), {0, 0}, 28672, ) == 0x0
 03651   860   NtUnmapViewOfSection  (-1, 0x3e0000, ... ) == 0x0
 03652   860   NtMapViewOfSection  (220, -1, (0x0), 0, 0, {0, 0}, 0, 1, 0, 4, ... (0x3e0000), {0, 0}, 28672, ) == 0x0
 03653   860   NtUnmapViewOfSection  (-1, 0x3e0000, ... ) == 0x0
 03654   860   NtMapViewOfSection  (220, -1, (0x0), 0, 0, {0, 0}, 0, 1, 0, 4, ... (0x3e0000), {0, 0}, 28672, ) == 0x0
 03655   860   NtUnmapViewOfSection  (-1, 0x3e0000, ... ) == 0x0
 03656   860   NtMapViewOfSection  (220, -1, (0x0), 0, 0, {0, 0}, 0, 1, 0, 4, ... (0x3e0000), {0, 0}, 28672, ) == 0x0
 03657   860   NtUnmapViewOfSection  (-1, 0x3e0000, ... ) == 0x0
 03658   860   NtMapViewOfSection  (220, -1, (0x0), 0, 0, {0, 0}, 0, 1, 0, 4, ... (0x3e0000), {0, 0}, 28672, ) == 0x0
 03659   860   NtUnmapViewOfSection  (-1, 0x3e0000, ... ) == 0x0
 03660   860   NtMapViewOfSection  (220, -1, (0x0), 0, 0, {0, 0}, 0, 1, 0, 4, ... (0x3e0000), {0, 0}, 28672, ) == 0x0
 03661   860   NtUnmapViewOfSection  (-1, 0x3e0000, ... ) == 0x0
 03662   860   NtMapViewOfSection  (220, -1, (0x0), 0, 0, {0, 0}, 0, 1, 0, 4, ... (0x3e0000), {0, 0}, 28672, ) == 0x0
 03663   860   NtUnmapViewOfSection  (-1, 0x3e0000, ... ) == 0x0
 03664   860   NtMapViewOfSection  (220, -1, (0x0), 0, 0, {0, 0}, 0, 1, 0, 4, ... (0x3e0000), {0, 0}, 28672, ) == 0x0
 03665   860   NtUnmapViewOfSection  (-1, 0x3e0000, ... ) == 0x0
 03666   860   NtMapViewOfSection  (220, -1, (0x0), 0, 0, {0, 0}, 0, 1, 0, 4, ... (0x3e0000), {0, 0}, 28672, ) == 0x0
 03667   860   NtUnmapViewOfSection  (-1, 0x3e0000, ... ) == 0x0
 03668   860   NtMapViewOfSection  (220, -1, (0x0), 0, 0, {0, 0}, 0, 1, 0, 4, ... (0x3e0000), {0, 0}, 28672, ) == 0x0
 03669   860   NtUnmapViewOfSection  (-1, 0x3e0000, ... ) == 0x0
 03670   860   NtMapViewOfSection  (220, -1, (0x0), 0, 0, {0, 0}, 0, 1, 0, 4, ... (0x3e0000), {0, 0}, 28672, ) == 0x0
 03671   860   NtUnmapViewOfSection  (-1, 0x3e0000, ... ) == 0x0
 03672   860   NtMapViewOfSection  (220, -1, (0x0), 0, 0, {0, 0}, 0, 1, 0, 4, ... (0x3e0000), {0, 0}, 28672, ) == 0x0
 03673   860   NtUnmapViewOfSection  (-1, 0x3e0000, ... ) == 0x0
 03674   860   NtMapViewOfSection  (220, -1, (0x0), 0, 0, {0, 0}, 0, 1, 0, 4, ... (0x3e0000), {0, 0}, 28672, ) == 0x0
 03675   860   NtUnmapViewOfSection  (-1, 0x3e0000, ... ) == 0x0
 03676   860   NtMapViewOfSection  (220, -1, (0x0), 0, 0, {0, 0}, 0, 1, 0, 4, ... (0x3e0000), {0, 0}, 28672, ) == 0x0
 03677   860   NtUnmapViewOfSection  (-1, 0x3e0000, ... ) == 0x0
 03678   860   NtClose  (220, ... ) == 0x0
 03679   860   NtQueryInformationProcess  (-1, DeviceMap, 36, ... {process info, class 23, size 36}, 0x0, ) == 0x0
 03680   860   NtOpenFile  (0x100080, {24, 0, 0x40, 0, 0,  (0x100080, {24, 0, 0x40, 0, 0, "\??\u:"}, 3, 96, ... 220, {status=0x0, info=1}, ) }, 3, 96, ... 220, {status=0x0, info=1}, ) == 0x0
 03681   860   NtOpenSymbolicLinkObject  (0x1, {24, 0, 0x40, 0, 0,  (0x1, {24, 0, 0x40, 0, 0, "\??\u:"}, ... 216, ) }, ... 216, ) == 0x0
 03682   860   NtQuerySymbolicLinkObject  (216, ...  (216, ... "\Device\WinDfs\U:0000000000009f43", 66, ) , 66, ) == 0x0
 03683   860   NtClose  (216, ... ) == 0x0
 03684   860   NtQueryVolumeInformationFile  (220, 1228780, 8, Device, ... {status=0x0, info=8}, ) == 0x0
 03685   860   NtClose  (220, ... ) == 0x0
 03686   860   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\apphelp.dll"}, 1227576, ... ) }, 1227576, ... ) == 0x0
 03687   860   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\u:\work\packed.exe"}, 1229272, ... ) }, 1229272, ... ) == 0x0
 03688   860   NtCreateFile  (0x40100080, {24, 0, 0x40, 0, 1229280,  (0x40100080, {24, 0, 0x40, 0, 1229280, "\??\C:\DOCUME~1\MARTIM~1\LOCALS~1\Temp\10e8_appcompat.txt"}, 0x0, 128, 0, 5, 96, 0, 0, ... }, 0x0, 128, 0, 5, 96, 0, 0, ...
 03689   860   NtClose  (-2147482740, ... ) == 0x0
 03690   860   NtQueryDirectoryFile  (-2147482740, 0, 0, 0, -518316032, 4096, Names, 1,  (-2147482740, 0, 0, 0, -518316032, 4096, Names, 1, "DOCUME~1", 1, ... {status=0x0, info=56}, ) , 1, ... {status=0x0, info=56}, ) == 0x0
 03691   860   NtClose  (-2147482740, ... ) == 0x0
 03692   860   NtQueryDirectoryFile  (-2147482740, 0, 0, 0, -518316032, 4096, Names, 1,  (-2147482740, 0, 0, 0, -518316032, 4096, Names, 1, "MARTIM~1", 1, ... {status=0x0, info=40}, ) , 1, ... {status=0x0, info=40}, ) == 0x0
 03693   860   NtClose  (-2147482740, ... ) == 0x0
 03694   860   NtQueryDirectoryFile  (-2147482740, 0, 0, 0, -518316032, 4096, Names, 1,  (-2147482740, 0, 0, 0, -518316032, 4096, Names, 1, "LOCALS~1", 1, ... {status=0x0, info=40}, ) , 1, ... {status=0x0, info=40}, ) == 0x0
 03695   860   NtClose  (-2147482740, ... ) == 0x0
 03688   860   NtCreateFile  ... 220, {status=0x0, info=3}, ) == 0x0
 03696   860   NtAllocateVirtualMemory  (-1, 1384448, 0, 12288, 4096, 4, ... 1384448, 12288, ) == 0x0
 03697   860   NtOpenFile  (0x100001, {24, 0, 0x40, 0, 0,  (0x100001, {24, 0, 0x40, 0, 0, "\??\u:\work\"}, 3, 16417, ... 216, {status=0x0, info=1}, ) }, 3, 16417, ... 216, {status=0x0, info=1}, ) == 0x0
 03698   860   NtQueryDirectoryFile  (216, 0, 0, 0, 1227984, 616, BothDirectory, 1,  (216, 0, 0, 0, 1227984, 616, BothDirectory, 1, "packed.exe", 0, ... {status=0x0, info=120}, ) , 0, ... {status=0x0, info=120}, ) == 0x0
 03699   860   NtWriteFile  (220, 0, 0, 0,  (220, 0, 0, 0, "\377\376", 2, 0x0, 0, ... {status=0x0, info=2}, ) , 2, 0x0, 0, ... {status=0x0, info=2}, ) == 0x0
 03700   860   NtWriteFile  (220, 0, 0, 0,  (220, 0, 0, 0, "<\0?\0x\0m\0l\0 \0v\0e\0r\0s\0i\0o\0n\0=\0"\01\0.\00\0"\0 \0e\0n\0c\0o\0d\0i\0n\0g\0=\0"\0U\0T\0F\0-\01\06\0"\0?\0>\0\15\0\12\0<\0D\0A\0T\0A\0B\0A\0S\0E\0>\0\15\0\12\0", 106, 0x0, 0, ... {status=0x0, info=106}, ) \01\0.\00\0 (220, 0, 0, 0, "<\0?\0x\0m\0l\0 \0v\0e\0r\0s\0i\0o\0n\0=\0"\01\0.\00\0"\0 \0e\0n\0c\0o\0d\0i\0n\0g\0=\0"\0U\0T\0F\0-\01\06\0"\0?\0>\0\15\0\12\0<\0D\0A\0T\0A\0B\0A\0S\0E\0>\0\15\0\12\0", 106, 0x0, 0, ... {status=0x0, info=106}, ) \0U\0T\0F\0-\01\06\0 (220, 0, 0, 0, "<\0?\0x\0m\0l\0 \0v\0e\0r\0s\0i\0o\0n\0=\0"\01\0.\00\0"\0 \0e\0n\0c\0o\0d\0i\0n\0g\0=\0"\0U\0T\0F\0-\01\06\0"\0?\0>\0\15\0\12\0<\0D\0A\0T\0A\0B\0A\0S\0E\0>\0\15\0\12\0", 106, 0x0, 0, ... {status=0x0, info=106}, ) , 106, 0x0, 0, ... {status=0x0, info=106}, ) == 0x0
 03701   860   NtWriteFile  (220, 0, 0, 0,  (220, 0, 0, 0, "<\0E\0X\0E\0 \0N\0A\0M\0E\0=\0"\0p\0a\0c\0k\0e\0d\0.\0e\0x\0e\0"\0 \0F\0I\0L\0T\0E\0R\0=\0"\0G\0R\0A\0B\0M\0I\0_\0F\0I\0L\0T\0E\0R\0_\0T\0H\0I\0S\0F\0I\0L\0E\0O\0N\0L\0Y\0"\0>\0\15\0\12\0", 122, 0x0, 0, ... {status=0x0, info=122}, ) \0p\0a\0c\0k\0e\0d\0.\0e\0x\0e\0 (220, 0, 0, 0, "<\0E\0X\0E\0 \0N\0A\0M\0E\0=\0"\0p\0a\0c\0k\0e\0d\0.\0e\0x\0e\0"\0 \0F\0I\0L\0T\0E\0R\0=\0"\0G\0R\0A\0B\0M\0I\0_\0F\0I\0L\0T\0E\0R\0_\0T\0H\0I\0S\0F\0I\0L\0E\0O\0N\0L\0Y\0"\0>\0\15\0\12\0", 122, 0x0, 0, ... {status=0x0, info=122}, ) \0G\0R\0A\0B\0M\0I\0_\0F\0I\0L\0T\0E\0R\0_\0T\0H\0I\0S\0F\0I\0L\0E\0O\0N\0L\0Y\0 (220, 0, 0, 0, "<\0E\0X\0E\0 \0N\0A\0M\0E\0=\0"\0p\0a\0c\0k\0e\0d\0.\0e\0x\0e\0"\0 \0F\0I\0L\0T\0E\0R\0=\0"\0G\0R\0A\0B\0M\0I\0_\0F\0I\0L\0T\0E\0R\0_\0T\0H\0I\0S\0F\0I\0L\0E\0O\0N\0L\0Y\0"\0>\0\15\0\12\0", 122, 0x0, 0, ... {status=0x0, info=122}, ) , 122, 0x0, 0, ... {status=0x0, info=122}, ) == 0x0
 03702   860   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\u:\work\packed.exe"}, 1228364, ... ) }, 1228364, ... ) == 0x0
 03703   860   NtOpenFile  (0x100001, {24, 0, 0x40, 0, 0,  (0x100001, {24, 0, 0x40, 0, 0, "\??\u:\work"}, 3, 16417, ... 224, {status=0x0, info=1}, ) }, 3, 16417, ... 224, {status=0x0, info=1}, ) == 0x0
 03704   860   NtQueryDirectoryFile  (224, 0, 0, 0, 1227976, 592, Directory, 1,  (224, 0, 0, 0, 1227976, 592, Directory, 1, "packed.exe", 0, ... {status=0x0, info=84}, ) , 0, ... {status=0x0, info=84}, ) == 0x0
 03705   860   NtClose  (224, ... ) == 0x0
 03706   860   NtQueryInformationProcess  (-1, DefaultHardErrorMode, 4, ... {process info, class 12, size 4}, 0x0, ) == 0x0
 03707   860   NtSetInformationProcess  (-1, DefaultHardErrorMode, {process info, class 12, size 4}, 4, ... ) == 0x0
 03708   860   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\u:\work\packed.exe"}, 1226896, ... ) }, 1226896, ... ) == 0x0
 03709   860   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\u:\work\packed.exe"}, 1225668, ... ) }, 1225668, ... ) == 0x0
 03710   860   NtQueryInformationProcess  (-1, DefaultHardErrorMode, 4, ... {process info, class 12, size 4}, 0x0, ) == 0x0
 03711   860   NtSetInformationProcess  (-1, DefaultHardErrorMode, {process info, class 12, size 4}, 4, ... ) == 0x0
 03712   860   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\U:\WORK\PACKED.EXE"}, 1228232, ... ) }, 1228232, ... ) == 0x0
 03713   860   NtOpenFile  (0x100100, {24, 0, 0x40, 0, 0,  (0x100100, {24, 0, 0x40, 0, 0, "\??\U:\WORK\PACKED.EXE"}, 7, 2113568, ... 224, {status=0x0, info=1}, ) }, 7, 2113568, ... 224, {status=0x0, info=1}, ) == 0x0
 03714   860   NtSetInformationFile  (224, 1228208, 40, Basic, ... ) == STATUS_ACCESS_DENIED
 03715   860   NtClose  (224, ... ) == 0x0
 03716   860   NtCreateFile  (0x80100080, {24, 0, 0x40, 0, 0,  (0x80100080, {24, 0, 0x40, 0, 0, "\??\u:\work\packed.exe"}, 0x0, 128, 1, 1, 96, 0, 0, ... 224, {status=0x0, info=1}, ) }, 0x0, 128, 1, 1, 96, 0, 0, ... 224, {status=0x0, info=1}, ) == 0x0
 03717   860   NtQueryInformationFile  (224, 1228452, 24, Standard, ... {status=0x0, info=24}, ) == 0x0
 03718   860   NtCreateSection  (0x4, 0x0, 0x0, 2, 134217728, 224, ... 228, ) == 0x0
 03719   860   NtMapViewOfSection  (228, -1, (0x0), 0, 0, 0x0, 0, 2, 0, 2, ... (0x9b0000), 0x0, 204800, ) == 0x0
 03720   860   NtUnmapViewOfSection  (-1, 0x9b0000, ... ) == 0x0
 03721   860   NtClose  (228, ... ) == 0x0
 03722   860   NtClose  (224, ... ) == 0x0
 03723   860   NtWriteFile  (220, 0, 0, 0,  (220, 0, 0, 0, " \0 \0 \0 \0<\0M\0A\0T\0C\0H\0I\0N\0G\0_\0F\0I\0L\0E\0 \0N\0A\0M\0E\0=\0"\0p\0a\0c\0k\0e\0d\0.\0e\0x\0e\0"\0 \0S\0I\0Z\0E\0=\0"\02\00\03\07\07\06\0"\0 \0C\0H\0E\0C\0K\0S\0U\0M\0=\0"\00\0x\0E\08\0A\0E\07\01\0B\06\0"\0 \0M\0O\0D\0U\0L\0E\0_\0T\0Y\0P\0E\0=\0"\0W\0I\0N\03\02\0"\0 \0P\0E\0_\0C\0H\0E\0C\0K\0S\0U\0M\0=\0"\00\0x\00\0"\0 \0L\0I\0N\0K\0E\0R\0_\0V\0E\0R\0S\0I\0O\0N\0=\0"\00\0x\00\0"\0 \0L\0I\0N\0K\0_\0D\0A\0T\0E\0=\0"\00\02\0/\02\00\0/\02\00\00\08\0 \00\06\0:\00\07\0:\05\03\0"\0 \0U\0P\0T\0O\0_\0L\0I\0N\0K\0_\0D\0A\0T\0E\0=\0"\00\02\0/\02\00\0/\02\00\00\08\0 \00\06\0:\00\07\0:\05\03\0"\0 \0/\0>\0\15\0\12\0", 410, 0x0, 0, ... \0p\0a\0c\0k\0e\0d\0.\0e\0x\0e\0 (220, 0, 0, 0, " \0 \0 \0 \0<\0M\0A\0T\0C\0H\0I\0N\0G\0_\0F\0I\0L\0E\0 \0N\0A\0M\0E\0=\0"\0p\0a\0c\0k\0e\0d\0.\0e\0x\0e\0"\0 \0S\0I\0Z\0E\0=\0"\02\00\03\07\07\06\0"\0 \0C\0H\0E\0C\0K\0S\0U\0M\0=\0"\00\0x\0E\08\0A\0E\07\01\0B\06\0"\0 \0M\0O\0D\0U\0L\0E\0_\0T\0Y\0P\0E\0=\0"\0W\0I\0N\03\02\0"\0 \0P\0E\0_\0C\0H\0E\0C\0K\0S\0U\0M\0=\0"\00\0x\00\0"\0 \0L\0I\0N\0K\0E\0R\0_\0V\0E\0R\0S\0I\0O\0N\0=\0"\00\0x\00\0"\0 \0L\0I\0N\0K\0_\0D\0A\0T\0E\0=\0"\00\02\0/\02\00\0/\02\00\00\08\0 \00\06\0:\00\07\0:\05\03\0"\0 \0U\0P\0T\0O\0_\0L\0I\0N\0K\0_\0D\0A\0T\0E\0=\0"\00\02\0/\02\00\0/\02\00\00\08\0 \00\06\0:\00\07\0:\05\03\0"\0 \0/\0>\0\15\0\12\0", 410, 0x0, 0, ... \02\00\03\07\07\06\0 (220, 0, 0, 0, " \0 \0 \0 \0<\0M\0A\0T\0C\0H\0I\0N\0G\0_\0F\0I\0L\0E\0 \0N\0A\0M\0E\0=\0"\0p\0a\0c\0k\0e\0d\0.\0e\0x\0e\0"\0 \0S\0I\0Z\0E\0=\0"\02\00\03\07\07\06\0"\0 \0C\0H\0E\0C\0K\0S\0U\0M\0=\0"\00\0x\0E\08\0A\0E\07\01\0B\06\0"\0 \0M\0O\0D\0U\0L\0E\0_\0T\0Y\0P\0E\0=\0"\0W\0I\0N\03\02\0"\0 \0P\0E\0_\0C\0H\0E\0C\0K\0S\0U\0M\0=\0"\00\0x\00\0"\0 \0L\0I\0N\0K\0E\0R\0_\0V\0E\0R\0S\0I\0O\0N\0=\0"\00\0x\00\0"\0 \0L\0I\0N\0K\0_\0D\0A\0T\0E\0=\0"\00\02\0/\02\00\0/\02\00\00\08\0 \00\06\0:\00\07\0:\05\03\0"\0 \0U\0P\0T\0O\0_\0L\0I\0N\0K\0_\0D\0A\0T\0E\0=\0"\00\02\0/\02\00\0/\02\00\00\08\0 \00\06\0:\00\07\0:\05\03\0"\0 \0/\0>\0\15\0\12\0", 410, 0x0, 0, ... \00\0x\0E\08\0A\0E\07\01\0B\06\0 (220, 0, 0, 0, " \0 \0 \0 \0<\0M\0A\0T\0C\0H\0I\0N\0G\0_\0F\0I\0L\0E\0 \0N\0A\0M\0E\0=\0"\0p\0a\0c\0k\0e\0d\0.\0e\0x\0e\0"\0 \0S\0I\0Z\0E\0=\0"\02\00\03\07\07\06\0"\0 \0C\0H\0E\0C\0K\0S\0U\0M\0=\0"\00\0x\0E\08\0A\0E\07\01\0B\06\0"\0 \0M\0O\0D\0U\0L\0E\0_\0T\0Y\0P\0E\0=\0"\0W\0I\0N\03\02\0"\0 \0P\0E\0_\0C\0H\0E\0C\0K\0S\0U\0M\0=\0"\00\0x\00\0"\0 \0L\0I\0N\0K\0E\0R\0_\0V\0E\0R\0S\0I\0O\0N\0=\0"\00\0x\00\0"\0 \0L\0I\0N\0K\0_\0D\0A\0T\0E\0=\0"\00\02\0/\02\00\0/\02\00\00\08\0 \00\06\0:\00\07\0:\05\03\0"\0 \0U\0P\0T\0O\0_\0L\0I\0N\0K\0_\0D\0A\0T\0E\0=\0"\00\02\0/\02\00\0/\02\00\00\08\0 \00\06\0:\00\07\0:\05\03\0"\0 \0/\0>\0\15\0\12\0", 410, 0x0, 0, ... \0W\0I\0N\03\02\0 (220, 0, 0, 0, " \0 \0 \0 \0<\0M\0A\0T\0C\0H\0I\0N\0G\0_\0F\0I\0L\0E\0 \0N\0A\0M\0E\0=\0"\0p\0a\0c\0k\0e\0d\0.\0e\0x\0e\0"\0 \0S\0I\0Z\0E\0=\0"\02\00\03\07\07\06\0"\0 \0C\0H\0E\0C\0K\0S\0U\0M\0=\0"\00\0x\0E\08\0A\0E\07\01\0B\06\0"\0 \0M\0O\0D\0U\0L\0E\0_\0T\0Y\0P\0E\0=\0"\0W\0I\0N\03\02\0"\0 \0P\0E\0_\0C\0H\0E\0C\0K\0S\0U\0M\0=\0"\00\0x\00\0"\0 \0L\0I\0N\0K\0E\0R\0_\0V\0E\0R\0S\0I\0O\0N\0=\0"\00\0x\00\0"\0 \0L\0I\0N\0K\0_\0D\0A\0T\0E\0=\0"\00\02\0/\02\00\0/\02\00\00\08\0 \00\06\0:\00\07\0:\05\03\0"\0 \0U\0P\0T\0O\0_\0L\0I\0N\0K\0_\0D\0A\0T\0E\0=\0"\00\02\0/\02\00\0/\02\00\00\08\0 \00\06\0:\00\07\0:\05\03\0"\0 \0/\0>\0\15\0\12\0", 410, 0x0, 0, ... \00\0x\00\0 (220, 0, 0, 0, " \0 \0 \0 \0<\0M\0A\0T\0C\0H\0I\0N\0G\0_\0F\0I\0L\0E\0 \0N\0A\0M\0E\0=\0"\0p\0a\0c\0k\0e\0d\0.\0e\0x\0e\0"\0 \0S\0I\0Z\0E\0=\0"\02\00\03\07\07\06\0"\0 \0C\0H\0E\0C\0K\0S\0U\0M\0=\0"\00\0x\0E\08\0A\0E\07\01\0B\06\0"\0 \0M\0O\0D\0U\0L\0E\0_\0T\0Y\0P\0E\0=\0"\0W\0I\0N\03\02\0"\0 \0P\0E\0_\0C\0H\0E\0C\0K\0S\0U\0M\0=\0"\00\0x\00\0"\0 \0L\0I\0N\0K\0E\0R\0_\0V\0E\0R\0S\0I\0O\0N\0=\0"\00\0x\00\0"\0 \0L\0I\0N\0K\0_\0D\0A\0T\0E\0=\0"\00\02\0/\02\00\0/\02\00\00\08\0 \00\06\0:\00\07\0:\05\03\0"\0 \0U\0P\0T\0O\0_\0L\0I\0N\0K\0_\0D\0A\0T\0E\0=\0"\00\02\0/\02\00\0/\02\00\00\08\0 \00\06\0:\00\07\0:\05\03\0"\0 \0/\0>\0\15\0\12\0", 410, 0x0, 0, ... \00\0x\00\0 (220, 0, 0, 0, " \0 \0 \0 \0<\0M\0A\0T\0C\0H\0I\0N\0G\0_\0F\0I\0L\0E\0 \0N\0A\0M\0E\0=\0"\0p\0a\0c\0k\0e\0d\0.\0e\0x\0e\0"\0 \0S\0I\0Z\0E\0=\0"\02\00\03\07\07\06\0"\0 \0C\0H\0E\0C\0K\0S\0U\0M\0=\0"\00\0x\0E\08\0A\0E\07\01\0B\06\0"\0 \0M\0O\0D\0U\0L\0E\0_\0T\0Y\0P\0E\0=\0"\0W\0I\0N\03\02\0"\0 \0P\0E\0_\0C\0H\0E\0C\0K\0S\0U\0M\0=\0"\00\0x\00\0"\0 \0L\0I\0N\0K\0E\0R\0_\0V\0E\0R\0S\0I\0O\0N\0=\0"\00\0x\00\0"\0 \0L\0I\0N\0K\0_\0D\0A\0T\0E\0=\0"\00\02\0/\02\00\0/\02\00\00\08\0 \00\06\0:\00\07\0:\05\03\0"\0 \0U\0P\0T\0O\0_\0L\0I\0N\0K\0_\0D\0A\0T\0E\0=\0"\00\02\0/\02\00\0/\02\00\00\08\0 \00\06\0:\00\07\0:\05\03\0"\0 \0/\0>\0\15\0\12\0", 410, 0x0, 0, ... \00\02\0/\02\00\0/\02\00\00\08\0 \00\06\0:\00\07\0:\05\03\0 (220, 0, 0, 0, " \0 \0 \0 \0<\0M\0A\0T\0C\0H\0I\0N\0G\0_\0F\0I\0L\0E\0 \0N\0A\0M\0E\0=\0"\0p\0a\0c\0k\0e\0d\0.\0e\0x\0e\0"\0 \0S\0I\0Z\0E\0=\0"\02\00\03\07\07\06\0"\0 \0C\0H\0E\0C\0K\0S\0U\0M\0=\0"\00\0x\0E\08\0A\0E\07\01\0B\06\0"\0 \0M\0O\0D\0U\0L\0E\0_\0T\0Y\0P\0E\0=\0"\0W\0I\0N\03\02\0"\0 \0P\0E\0_\0C\0H\0E\0C\0K\0S\0U\0M\0=\0"\00\0x\00\0"\0 \0L\0I\0N\0K\0E\0R\0_\0V\0E\0R\0S\0I\0O\0N\0=\0"\00\0x\00\0"\0 \0L\0I\0N\0K\0_\0D\0A\0T\0E\0=\0"\00\02\0/\02\00\0/\02\00\00\08\0 \00\06\0:\00\07\0:\05\03\0"\0 \0U\0P\0T\0O\0_\0L\0I\0N\0K\0_\0D\0A\0T\0E\0=\0"\00\02\0/\02\00\0/\02\00\00\08\0 \00\06\0:\00\07\0:\05\03\0"\0 \0/\0>\0\15\0\12\0", 410, 0x0, 0, ... \00\02\0/\02\00\0/\02\00\00\08\0 \00\06\0:\00\07\0:\05\03\0 (220, 0, 0, 0, " \0 \0 \0 \0<\0M\0A\0T\0C\0H\0I\0N\0G\0_\0F\0I\0L\0E\0 \0N\0A\0M\0E\0=\0"\0p\0a\0c\0k\0e\0d\0.\0e\0x\0e\0"\0 \0S\0I\0Z\0E\0=\0"\02\00\03\07\07\06\0"\0 \0C\0H\0E\0C\0K\0S\0U\0M\0=\0"\00\0x\0E\08\0A\0E\07\01\0B\06\0"\0 \0M\0O\0D\0U\0L\0E\0_\0T\0Y\0P\0E\0=\0"\0W\0I\0N\03\02\0"\0 \0P\0E\0_\0C\0H\0E\0C\0K\0S\0U\0M\0=\0"\00\0x\00\0"\0 \0L\0I\0N\0K\0E\0R\0_\0V\0E\0R\0S\0I\0O\0N\0=\0"\00\0x\00\0"\0 \0L\0I\0N\0K\0_\0D\0A\0T\0E\0=\0"\00\02\0/\02\00\0/\02\00\00\08\0 \00\06\0:\00\07\0:\05\03\0"\0 \0U\0P\0T\0O\0_\0L\0I\0N\0K\0_\0D\0A\0T\0E\0=\0"\00\02\0/\02\00\0/\02\00\00\08\0 \00\06\0:\00\07\0:\05\03\0"\0 \0/\0>\0\15\0\12\0", 410, 0x0, 0, ... , 410, 0x0, 0, ...
 03724   860   NtContinue  (-139616172, 0, ...
 03723   860   NtWriteFile  ... {status=0x0, info=410}, ) == 0x0
 03725   860   NtQueryDirectoryFile  (216, 0, 0, 0, 1392640, 4096, BothDirectory, 0, 0x0, 0, ... ) == STATUS_NO_MORE_FILES
 03726   860   NtClose  (216, ... ) == 0x0
 03727   860   NtWriteFile  (220, 0, 0, 0,  (220, 0, 0, 0, "<\0/\0E\0X\0E\0>\0\15\0\12\0", 16, 0x0, 0, ... {status=0x0, info=16}, ) , 16, 0x0, 0, ... {status=0x0, info=16}, ) == 0x0
 03728   860   NtClose  (220, ... ) == 0x0
 03729   860   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\kernel32.dll"}, 1229272, ... ) }, 1229272, ... ) == 0x0
 03730   860   NtCreateFile  (0x40100080, {24, 0, 0x40, 0, 1229280,  (0x40100080, {24, 0, 0x40, 0, 1229280, "\??\C:\DOCUME~1\MARTIM~1\LOCALS~1\Temp\10e8_appcompat.txt"}, 0x0, 128, 0, 3, 96, 0, 0, ... 220, {status=0x0, info=1}, ) }, 0x0, 128, 0, 3, 96, 0, 0, ... 220, {status=0x0, info=1}, ) == 0x0
 03731   860   NtQueryInformationFile  (220, 1229304, 24, Standard, ... {status=0x0, info=24}, ) == 0x0
 03732   860   NtSetInformationFile  (220, 1229336, 8, Position, ... {status=0x0, info=0}, ) == 0x0
 03733   860   NtOpenFile  (0x100001, {24, 0, 0x40, 0, 0,  (0x100001, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\"}, 3, 16417, ... 216, {status=0x0, info=1}, ) }, 3, 16417, ... 216, {status=0x0, info=1}, ) == 0x0
 03734   860   NtQueryDirectoryFile  (216, 0, 0, 0, 1227984, 616, BothDirectory, 1,  (216, 0, 0, 0, 1227984, 616, BothDirectory, 1, "kernel32.dll", 0, ... {status=0x0, info=118}, ) , 0, ... {status=0x0, info=118}, ) == 0x0
 03735   860   NtWriteFile  (220, 0, 0, 0,  (220, 0, 0, 0, "<\0E\0X\0E\0 \0N\0A\0M\0E\0=\0"\0k\0e\0r\0n\0e\0l\03\02\0.\0d\0l\0l\0"\0 \0F\0I\0L\0T\0E\0R\0=\0"\0G\0R\0A\0B\0M\0I\0_\0F\0I\0L\0T\0E\0R\0_\0T\0H\0I\0S\0F\0I\0L\0E\0O\0N\0L\0Y\0"\0>\0\15\0\12\0", 126, 0x0, 0, ... {status=0x0, info=126}, ) \0k\0e\0r\0n\0e\0l\03\02\0.\0d\0l\0l\0 (220, 0, 0, 0, "<\0E\0X\0E\0 \0N\0A\0M\0E\0=\0"\0k\0e\0r\0n\0e\0l\03\02\0.\0d\0l\0l\0"\0 \0F\0I\0L\0T\0E\0R\0=\0"\0G\0R\0A\0B\0M\0I\0_\0F\0I\0L\0T\0E\0R\0_\0T\0H\0I\0S\0F\0I\0L\0E\0O\0N\0L\0Y\0"\0>\0\15\0\12\0", 126, 0x0, 0, ... {status=0x0, info=126}, ) \0G\0R\0A\0B\0M\0I\0_\0F\0I\0L\0T\0E\0R\0_\0T\0H\0I\0S\0F\0I\0L\0E\0O\0N\0L\0Y\0 (220, 0, 0, 0, "<\0E\0X\0E\0 \0N\0A\0M\0E\0=\0"\0k\0e\0r\0n\0e\0l\03\02\0.\0d\0l\0l\0"\0 \0F\0I\0L\0T\0E\0R\0=\0"\0G\0R\0A\0B\0M\0I\0_\0F\0I\0L\0T\0E\0R\0_\0T\0H\0I\0S\0F\0I\0L\0E\0O\0N\0L\0Y\0"\0>\0\15\0\12\0", 126, 0x0, 0, ... {status=0x0, info=126}, ) , 126, 0x0, 0, ... {status=0x0, info=126}, ) == 0x0
 03736   860   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\kernel32.dll"}, 1228336, ... ) }, 1228336, ... ) == 0x0
 03737   860   NtOpenFile  (0x100001, {24, 0, 0x40, 0, 0,  (0x100001, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32"}, 3, 16417, ... 224, {status=0x0, info=1}, ) }, 3, 16417, ... 224, {status=0x0, info=1}, ) == 0x0
 03738   860   NtQueryDirectoryFile  (224, 0, 0, 0, 1227976, 592, Directory, 1,  (224, 0, 0, 0, 1227976, 592, Directory, 1, "kernel32.dll", 0, ... {status=0x0, info=88}, ) , 0, ... {status=0x0, info=88}, ) == 0x0
 03739   860   NtClose  (224, ... ) == 0x0
 03740   860   NtQueryInformationProcess  (-1, DefaultHardErrorMode, 4, ... {process info, class 12, size 4}, 0x0, ) == 0x0
 03741   860   NtSetInformationProcess  (-1, DefaultHardErrorMode, {process info, class 12, size 4}, 4, ... ) == 0x0
 03742   860   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\kernel32.dll"}, 1226896, ... ) }, 1226896, ... ) == 0x0
 03743   860   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\kernel32.dll"}, 1225668, ... ) }, 1225668, ... ) == 0x0
 03744   860   NtQueryInformationProcess  (-1, DefaultHardErrorMode, 4, ... {process info, class 12, size 4}, 0x0, ) == 0x0
 03745   860   NtSetInformationProcess  (-1, DefaultHardErrorMode, {process info, class 12, size 4}, 4, ... ) == 0x0
 03746   860   NtQueryDefaultLocale  (1, 1227856, ... ) == 0x0
 03747   860   NtQueryInformationProcess  (-1, DefaultHardErrorMode, 4, ... {process info, class 12, size 4}, 0x0, ) == 0x0
 03748   860   NtSetInformationProcess  (-1, DefaultHardErrorMode, {process info, class 12, size 4}, 4, ... ) == 0x0
 03749   860   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\kernel32.dll"}, 1226888, ... ) }, 1226888, ... ) == 0x0
 03750   860   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\kernel32.dll"}, 1225660, ... ) }, 1225660, ... ) == 0x0
 03751   860   NtQueryInformationProcess  (-1, DefaultHardErrorMode, 4, ... {process info, class 12, size 4}, 0x0, ) == 0x0
 03752   860   NtSetInformationProcess  (-1, DefaultHardErrorMode, {process info, class 12, size 4}, 4, ... ) == 0x0
 03753   860   NtQueryDefaultLocale  (1, 1227848, ... ) == 0x0
 03754   860   NtCreateFile  (0x80100080, {24, 0, 0x40, 0, 0,  (0x80100080, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\kernel32.dll"}, 0x0, 128, 1, 1, 96, 0, 0, ... 224, {status=0x0, info=1}, ) }, 0x0, 128, 1, 1, 96, 0, 0, ... 224, {status=0x0, info=1}, ) == 0x0
 03755   860   NtQueryInformationFile  (224, 1228452, 24, Standard, ... {status=0x0, info=24}, ) == 0x0
 03756   860   NtCreateSection  (0x4, 0x0, 0x0, 2, 134217728, 224, ... 228, ) == 0x0
 03757   860   NtMapViewOfSection  (228, -1, (0x0), 0, 0, 0x0, 0, 2, 0, 2, ... (0xac0000), 0x0, 987136, ) == 0x0
 03758   860   NtUnmapViewOfSection  (-1, 0xac0000, ... ) == 0x0
 03759   860   NtClose  (228, ... ) == 0x0
 03760   860   NtClose  (224, ... ) == 0x0
 03761   860   NtQueryDefaultUILanguage  (1227808, ...
 03762   860   NtOpenThreadTokenEx  (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN
 03763   860   NtOpenProcessTokenEx  (-1, 0x20008, 512, ... -2147482740, ) == 0x0
 03764   860   NtQueryInformationToken  (-2147482740, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0
 03765   860   NtClose  (-2147482740, ... ) == 0x0
 03766   860   NtOpenKey  (0x2000000, {24, 0, 0x640, 0, 0,  (0x2000000, {24, 0, 0x640, 0, 0, "\REGISTRY\USER\S-1-5-21-1292428093-1383384898-725345543-1003"}, ... -2147482740, ) }, ... -2147482740, ) == 0x0
 03767   860   NtOpenKey  (0x80000000, {24, -2147482740, 0x240, 0, 0,  (0x80000000, {24, -2147482740, 0x240, 0, 0, "Software\Policies\Microsoft\Control Panel\Desktop"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 03768   860   NtOpenKey  (0x80000000, {24, -2147482740, 0x640, 0, 0,  (0x80000000, {24, -2147482740, 0x640, 0, 0, "Control Panel\Desktop"}, ... -2147482656, ) }, ... -2147482656, ) == 0x0
 03769   860   NtQueryValueKey  (-2147482656,  (-2147482656, "MultiUILanguageId", Partial, 256, ... ) , Partial, 256, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 03770   860   NtClose  (-2147482656, ... ) == 0x0
 03771   860   NtClose  (-2147482740, ... ) == 0x0
 03761   860   NtQueryDefaultUILanguage  ... ) == 0x0
 03772   860   NtWriteFile  (220, 0, 0, 0,  (220, 0, 0, 0, " \0 \0 \0 \0<\0M\0A\0T\0C\0H\0I\0N\0G\0_\0F\0I\0L\0E\0 \0N\0A\0M\0E\0=\0"\0k\0e\0r\0n\0e\0l\03\02\0.\0d\0l\0l\0"\0 \0S\0I\0Z\0E\0=\0"\09\08\04\05\07\06\0"\0 \0C\0H\0E\0C\0K\0S\0U\0M\0=\0"\00\0x\0F\00\0B\03\03\01\0F\06\0"\0 \0B\0I\0N\0_\0F\0I\0L\0E\0_\0V\0E\0R\0S\0I\0O\0N\0=\0"\05\0.\01\0.\02\06\00\00\0.\03\01\01\09\0"\0 \0B\0I\0N\0_\0P\0R\0O\0D\0U\0C\0T\0_\0V\0E\0R\0S\0I\0O\0N\0=\0"\05\0.\01\0.\02\06\00\00\0.\03\01\01\09\0"\0 \0P\0R\0O\0D\0U\0C\0T\0_\0V\0E\0R\0S\0I\0O\0N\0=\0"\05\0.\01\0.\02\06\00\00\0.\03\01\01\09\0"\0 \0F\0I\0L\0E\0_\0D\0E\0S\0C\0R\0I\0P\0T\0I\0O\0N\0=\0"\0W\0i\0n\0d\0o\0w\0s\0 \0N\0T\0 \0B\0A\0S\0E\0 \0A\0P\0I\0 \0C\0l\0i\0e\0n\0t\0 \0D\0L\0L\0"\0 \0C\0O\0M\0P\0A\0N\0Y\0_\0N\0A\0M\0E\0=\0"\0M\0i\0c\0r\0o\0s\0o\0f\0t\0 \0", 1666, 0x0, 0, ... {status=0x0, info=1666}, ) \0k\0e\0r\0n\0e\0l\03\02\0.\0d\0l\0l\0 (220, 0, 0, 0, " \0 \0 \0 \0<\0M\0A\0T\0C\0H\0I\0N\0G\0_\0F\0I\0L\0E\0 \0N\0A\0M\0E\0=\0"\0k\0e\0r\0n\0e\0l\03\02\0.\0d\0l\0l\0"\0 \0S\0I\0Z\0E\0=\0"\09\08\04\05\07\06\0"\0 \0C\0H\0E\0C\0K\0S\0U\0M\0=\0"\00\0x\0F\00\0B\03\03\01\0F\06\0"\0 \0B\0I\0N\0_\0F\0I\0L\0E\0_\0V\0E\0R\0S\0I\0O\0N\0=\0"\05\0.\01\0.\02\06\00\00\0.\03\01\01\09\0"\0 \0B\0I\0N\0_\0P\0R\0O\0D\0U\0C\0T\0_\0V\0E\0R\0S\0I\0O\0N\0=\0"\05\0.\01\0.\02\06\00\00\0.\03\01\01\09\0"\0 \0P\0R\0O\0D\0U\0C\0T\0_\0V\0E\0R\0S\0I\0O\0N\0=\0"\05\0.\01\0.\02\06\00\00\0.\03\01\01\09\0"\0 \0F\0I\0L\0E\0_\0D\0E\0S\0C\0R\0I\0P\0T\0I\0O\0N\0=\0"\0W\0i\0n\0d\0o\0w\0s\0 \0N\0T\0 \0B\0A\0S\0E\0 \0A\0P\0I\0 \0C\0l\0i\0e\0n\0t\0 \0D\0L\0L\0"\0 \0C\0O\0M\0P\0A\0N\0Y\0_\0N\0A\0M\0E\0=\0"\0M\0i\0c\0r\0o\0s\0o\0f\0t\0 \0", 1666, 0x0, 0, ... {status=0x0, info=1666}, ) \09\08\04\05\07\06\0 (220, 0, 0, 0, " \0 \0 \0 \0<\0M\0A\0T\0C\0H\0I\0N\0G\0_\0F\0I\0L\0E\0 \0N\0A\0M\0E\0=\0"\0k\0e\0r\0n\0e\0l\03\02\0.\0d\0l\0l\0"\0 \0S\0I\0Z\0E\0=\0"\09\08\04\05\07\06\0"\0 \0C\0H\0E\0C\0K\0S\0U\0M\0=\0"\00\0x\0F\00\0B\03\03\01\0F\06\0"\0 \0B\0I\0N\0_\0F\0I\0L\0E\0_\0V\0E\0R\0S\0I\0O\0N\0=\0"\05\0.\01\0.\02\06\00\00\0.\03\01\01\09\0"\0 \0B\0I\0N\0_\0P\0R\0O\0D\0U\0C\0T\0_\0V\0E\0R\0S\0I\0O\0N\0=\0"\05\0.\01\0.\02\06\00\00\0.\03\01\01\09\0"\0 \0P\0R\0O\0D\0U\0C\0T\0_\0V\0E\0R\0S\0I\0O\0N\0=\0"\05\0.\01\0.\02\06\00\00\0.\03\01\01\09\0"\0 \0F\0I\0L\0E\0_\0D\0E\0S\0C\0R\0I\0P\0T\0I\0O\0N\0=\0"\0W\0i\0n\0d\0o\0w\0s\0 \0N\0T\0 \0B\0A\0S\0E\0 \0A\0P\0I\0 \0C\0l\0i\0e\0n\0t\0 \0D\0L\0L\0"\0 \0C\0O\0M\0P\0A\0N\0Y\0_\0N\0A\0M\0E\0=\0"\0M\0i\0c\0r\0o\0s\0o\0f\0t\0 \0", 1666, 0x0, 0, ... {status=0x0, info=1666}, ) \00\0x\0F\00\0B\03\03\01\0F\06\0 (220, 0, 0, 0, " \0 \0 \0 \0<\0M\0A\0T\0C\0H\0I\0N\0G\0_\0F\0I\0L\0E\0 \0N\0A\0M\0E\0=\0"\0k\0e\0r\0n\0e\0l\03\02\0.\0d\0l\0l\0"\0 \0S\0I\0Z\0E\0=\0"\09\08\04\05\07\06\0"\0 \0C\0H\0E\0C\0K\0S\0U\0M\0=\0"\00\0x\0F\00\0B\03\03\01\0F\06\0"\0 \0B\0I\0N\0_\0F\0I\0L\0E\0_\0V\0E\0R\0S\0I\0O\0N\0=\0"\05\0.\01\0.\02\06\00\00\0.\03\01\01\09\0"\0 \0B\0I\0N\0_\0P\0R\0O\0D\0U\0C\0T\0_\0V\0E\0R\0S\0I\0O\0N\0=\0"\05\0.\01\0.\02\06\00\00\0.\03\01\01\09\0"\0 \0P\0R\0O\0D\0U\0C\0T\0_\0V\0E\0R\0S\0I\0O\0N\0=\0"\05\0.\01\0.\02\06\00\00\0.\03\01\01\09\0"\0 \0F\0I\0L\0E\0_\0D\0E\0S\0C\0R\0I\0P\0T\0I\0O\0N\0=\0"\0W\0i\0n\0d\0o\0w\0s\0 \0N\0T\0 \0B\0A\0S\0E\0 \0A\0P\0I\0 \0C\0l\0i\0e\0n\0t\0 \0D\0L\0L\0"\0 \0C\0O\0M\0P\0A\0N\0Y\0_\0N\0A\0M\0E\0=\0"\0M\0i\0c\0r\0o\0s\0o\0f\0t\0 \0", 1666, 0x0, 0, ... {status=0x0, info=1666}, ) \05\0.\01\0.\02\06\00\00\0.\03\01\01\09\0 (220, 0, 0, 0, " \0 \0 \0 \0<\0M\0A\0T\0C\0H\0I\0N\0G\0_\0F\0I\0L\0E\0 \0N\0A\0M\0E\0=\0"\0k\0e\0r\0n\0e\0l\03\02\0.\0d\0l\0l\0"\0 \0S\0I\0Z\0E\0=\0"\09\08\04\05\07\06\0"\0 \0C\0H\0E\0C\0K\0S\0U\0M\0=\0"\00\0x\0F\00\0B\03\03\01\0F\06\0"\0 \0B\0I\0N\0_\0F\0I\0L\0E\0_\0V\0E\0R\0S\0I\0O\0N\0=\0"\05\0.\01\0.\02\06\00\00\0.\03\01\01\09\0"\0 \0B\0I\0N\0_\0P\0R\0O\0D\0U\0C\0T\0_\0V\0E\0R\0S\0I\0O\0N\0=\0"\05\0.\01\0.\02\06\00\00\0.\03\01\01\09\0"\0 \0P\0R\0O\0D\0U\0C\0T\0_\0V\0E\0R\0S\0I\0O\0N\0=\0"\05\0.\01\0.\02\06\00\00\0.\03\01\01\09\0"\0 \0F\0I\0L\0E\0_\0D\0E\0S\0C\0R\0I\0P\0T\0I\0O\0N\0=\0"\0W\0i\0n\0d\0o\0w\0s\0 \0N\0T\0 \0B\0A\0S\0E\0 \0A\0P\0I\0 \0C\0l\0i\0e\0n\0t\0 \0D\0L\0L\0"\0 \0C\0O\0M\0P\0A\0N\0Y\0_\0N\0A\0M\0E\0=\0"\0M\0i\0c\0r\0o\0s\0o\0f\0t\0 \0", 1666, 0x0, 0, ... {status=0x0, info=1666}, ) \05\0.\01\0.\02\06\00\00\0.\03\01\01\09\0 (220, 0, 0, 0, " \0 \0 \0 \0<\0M\0A\0T\0C\0H\0I\0N\0G\0_\0F\0I\0L\0E\0 \0N\0A\0M\0E\0=\0"\0k\0e\0r\0n\0e\0l\03\02\0.\0d\0l\0l\0"\0 \0S\0I\0Z\0E\0=\0"\09\08\04\05\07\06\0"\0 \0C\0H\0E\0C\0K\0S\0U\0M\0=\0"\00\0x\0F\00\0B\03\03\01\0F\06\0"\0 \0B\0I\0N\0_\0F\0I\0L\0E\0_\0V\0E\0R\0S\0I\0O\0N\0=\0"\05\0.\01\0.\02\06\00\00\0.\03\01\01\09\0"\0 \0B\0I\0N\0_\0P\0R\0O\0D\0U\0C\0T\0_\0V\0E\0R\0S\0I\0O\0N\0=\0"\05\0.\01\0.\02\06\00\00\0.\03\01\01\09\0"\0 \0P\0R\0O\0D\0U\0C\0T\0_\0V\0E\0R\0S\0I\0O\0N\0=\0"\05\0.\01\0.\02\06\00\00\0.\03\01\01\09\0"\0 \0F\0I\0L\0E\0_\0D\0E\0S\0C\0R\0I\0P\0T\0I\0O\0N\0=\0"\0W\0i\0n\0d\0o\0w\0s\0 \0N\0T\0 \0B\0A\0S\0E\0 \0A\0P\0I\0 \0C\0l\0i\0e\0n\0t\0 \0D\0L\0L\0"\0 \0C\0O\0M\0P\0A\0N\0Y\0_\0N\0A\0M\0E\0=\0"\0M\0i\0c\0r\0o\0s\0o\0f\0t\0 \0", 1666, 0x0, 0, ... {status=0x0, info=1666}, ) \05\0.\01\0.\02\06\00\00\0.\03\01\01\09\0 (220, 0, 0, 0, " \0 \0 \0 \0<\0M\0A\0T\0C\0H\0I\0N\0G\0_\0F\0I\0L\0E\0 \0N\0A\0M\0E\0=\0"\0k\0e\0r\0n\0e\0l\03\02\0.\0d\0l\0l\0"\0 \0S\0I\0Z\0E\0=\0"\09\08\04\05\07\06\0"\0 \0C\0H\0E\0C\0K\0S\0U\0M\0=\0"\00\0x\0F\00\0B\03\03\01\0F\06\0"\0 \0B\0I\0N\0_\0F\0I\0L\0E\0_\0V\0E\0R\0S\0I\0O\0N\0=\0"\05\0.\01\0.\02\06\00\00\0.\03\01\01\09\0"\0 \0B\0I\0N\0_\0P\0R\0O\0D\0U\0C\0T\0_\0V\0E\0R\0S\0I\0O\0N\0=\0"\05\0.\01\0.\02\06\00\00\0.\03\01\01\09\0"\0 \0P\0R\0O\0D\0U\0C\0T\0_\0V\0E\0R\0S\0I\0O\0N\0=\0"\05\0.\01\0.\02\06\00\00\0.\03\01\01\09\0"\0 \0F\0I\0L\0E\0_\0D\0E\0S\0C\0R\0I\0P\0T\0I\0O\0N\0=\0"\0W\0i\0n\0d\0o\0w\0s\0 \0N\0T\0 \0B\0A\0S\0E\0 \0A\0P\0I\0 \0C\0l\0i\0e\0n\0t\0 \0D\0L\0L\0"\0 \0C\0O\0M\0P\0A\0N\0Y\0_\0N\0A\0M\0E\0=\0"\0M\0i\0c\0r\0o\0s\0o\0f\0t\0 \0", 1666, 0x0, 0, ... {status=0x0, info=1666}, ) \0W\0i\0n\0d\0o\0w\0s\0 \0N\0T\0 \0B\0A\0S\0E\0 \0A\0P\0I\0 \0C\0l\0i\0e\0n\0t\0 \0D\0L\0L\0 (220, 0, 0, 0, " \0 \0 \0 \0<\0M\0A\0T\0C\0H\0I\0N\0G\0_\0F\0I\0L\0E\0 \0N\0A\0M\0E\0=\0"\0k\0e\0r\0n\0e\0l\03\02\0.\0d\0l\0l\0"\0 \0S\0I\0Z\0E\0=\0"\09\08\04\05\07\06\0"\0 \0C\0H\0E\0C\0K\0S\0U\0M\0=\0"\00\0x\0F\00\0B\03\03\01\0F\06\0"\0 \0B\0I\0N\0_\0F\0I\0L\0E\0_\0V\0E\0R\0S\0I\0O\0N\0=\0"\05\0.\01\0.\02\06\00\00\0.\03\01\01\09\0"\0 \0B\0I\0N\0_\0P\0R\0O\0D\0U\0C\0T\0_\0V\0E\0R\0S\0I\0O\0N\0=\0"\05\0.\01\0.\02\06\00\00\0.\03\01\01\09\0"\0 \0P\0R\0O\0D\0U\0C\0T\0_\0V\0E\0R\0S\0I\0O\0N\0=\0"\05\0.\01\0.\02\06\00\00\0.\03\01\01\09\0"\0 \0F\0I\0L\0E\0_\0D\0E\0S\0C\0R\0I\0P\0T\0I\0O\0N\0=\0"\0W\0i\0n\0d\0o\0w\0s\0 \0N\0T\0 \0B\0A\0S\0E\0 \0A\0P\0I\0 \0C\0l\0i\0e\0n\0t\0 \0D\0L\0L\0"\0 \0C\0O\0M\0P\0A\0N\0Y\0_\0N\0A\0M\0E\0=\0"\0M\0i\0c\0r\0o\0s\0o\0f\0t\0 \0", 1666, 0x0, 0, ... {status=0x0, info=1666}, ) \0M\0i\0c\0r\0o\0s\0o\0f\0t\0 \0", 1666, 0x0, 0, ... {status=0x0, info=1666}, ) == 0x0
 03773   860   NtQueryDirectoryFile  (216, 0, 0, 0, 1392640, 4096, BothDirectory, 0, 0x0, 0, ... ) == STATUS_NO_MORE_FILES
 03774   860   NtClose  (216, ... ) == 0x0
 03775   860   NtWriteFile  (220, 0, 0, 0,  (220, 0, 0, 0, "<\0/\0E\0X\0E\0>\0\15\0\12\0<\0/\0D\0A\0T\0A\0B\0A\0S\0E\0>\0\15\0\12\0", 42, 0x0, 0, ... {status=0x0, info=42}, ) , 42, 0x0, 0, ... {status=0x0, info=42}, ) == 0x0
 03776   860   NtClose  (220, ... ) == 0x0
 03777   860   NtQueryInformationJobObject  (0, BasicUIRestrictions, 4, ... ) == STATUS_ACCESS_DENIED
 03778   860   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\dwwin.exe"}, 1226544, ... ) }, 1226544, ... ) == 0x0
 03779   860   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\dwwin.exe"}, 1227280, ... ) }, 1227280, ... ) == 0x0
 03780   860   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\SYSTEM32\DWWIN.EXE"}, 1227196, ... ) }, 1227196, ... ) == 0x0
 03781   860   NtOpenFile  (0x100100, {24, 0, 0x40, 0, 0,  (0x100100, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\SYSTEM32\DWWIN.EXE"}, 7, 2113568, ... 220, {status=0x0, info=1}, ) }, 7, 2113568, ... 220, {status=0x0, info=1}, ) == 0x0
 03782   860   NtSetInformationFile  (220, 1227172, 40, Basic, ... {status=0x0, info=0}, ) == 0x0
 03783   860   NtClose  (220, ... ) == 0x0
 03784   860   NtCreateFile  (0xc0100080, {24, 0, 0x40, 0, 1227180,  (0xc0100080, {24, 0, 0x40, 0, 1227180, "\??\C:\WINDOWS\SYSTEM32\DWWIN.EXE"}, 0x0, 0, 1, 1, 96, 0, 0, ... ) }, 0x0, 0, 1, 1, 96, 0, 0, ... ) == STATUS_SHARING_VIOLATION
 03785   860   NtOpenFile  (0x100100, {24, 0, 0x40, 0, 0,  (0x100100, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\SYSTEM32\DWWIN.EXE"}, 7, 2113568, ... 220, {status=0x0, info=1}, ) }, 7, 2113568, ... 220, {status=0x0, info=1}, ) == 0x0
 03786   860   NtSetInformationFile  (220, 1227172, 40, Basic, ... {status=0x0, info=0}, ) == 0x0
 03787   860   NtClose  (220, ... ) == 0x0
 03788   860   NtOpenFile  (0x1000a1, {24, 0, 0x40, 0, 0,  (0x1000a1, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\dwwin.exe"}, 5, 96, ... 220, {status=0x0, info=1}, ) }, 5, 96, ... 220, {status=0x0, info=1}, ) == 0x0
 03789   860   NtCreateSection  (0xf001f, 0x0, 0x0, 16, 16777216, 220, ... 216, ) == 0x0
 03790   860   NtQueryVolumeInformationFile  (220, 1226556, 8, Device, ... {status=0x0, info=8}, ) == 0x0
 03791   860   NtWaitForSingleObject  (184, 0, {-1000000, -1}, ... ) == 0x0
 03792   860   NtReleaseMutant  (184, ... 0x0, ) == 0x0
 03793   860   NtCreateFile  (0x80100080, {24, 0, 0x40, 0, 0,  (0x80100080, {24, 0, 0x40, 0, 0, "\SystemRoot\AppPatch\sysmain.sdb"}, 0x0, 128, 1, 1, 96, 0, 0, ... 224, {status=0x0, info=1}, ) }, 0x0, 128, 1, 1, 96, 0, 0, ... 224, {status=0x0, info=1}, ) == 0x0
 03794   860   NtQueryInformationFile  (224, 1224812, 24, Standard, ... {status=0x0, info=24}, ) == 0x0
 03795   860   NtCreateSection  (0x4, 0x0, 0x0, 2, 134217728, 224, ... 228, ) == 0x0
 03796   860   NtMapViewOfSection  (228, -1, (0x0), 0, 0, 0x0, 0, 2, 0, 2, ... (0xac0000), 0x0, 1191936, ) == 0x0
 03797   860   NtQueryInformationFile  (224, 1224912, 24, Standard, ... {status=0x0, info=24}, ) == 0x0
 03798   860   NtCreateFile  (0x80100080, {24, 0, 0x40, 0, 0,  (0x80100080, {24, 0, 0x40, 0, 0, "\SystemRoot\AppPatch\systest.sdb"}, 0x0, 128, 1, 1, 96, 0, 0, ... ) }, 0x0, 128, 1, 1, 96, 0, 0, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 03799   860   NtOpenKey  (0x101, {24, 0, 0x40, 0, 0,  (0x101, {24, 0, 0x40, 0, 0, "\Registry\Machine\System\WPA\TabletPC"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 03800   860   NtOpenKey  (0x101, {24, 0, 0x40, 0, 0,  (0x101, {24, 0, 0x40, 0, 0, "\Registry\Machine\SYSTEM\WPA\MediaCenter"}, ... 232, ) }, ... 232, ) == 0x0
 03801   860   NtQueryValueKey  (232,  (232, "Installed", Partial, 256, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) , Partial, 256, ... TitleIdx=0, Type=4, Data= (232, "Installed", Partial, 256, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) }, 16, ) == 0x0
 03802   860   NtClose  (232, ... ) == 0x0
 03803   860   NtCreateFile  (0x120116, {24, 0, 0x40, 0, 0,  (0x120116, {24, 0, 0x40, 0, 0, "\Device\NamedPipe\ShimViewer"}, 0x0, 128, 0, 1, 0, 0, 0, ... ) }, 0x0, 128, 0, 1, 0, 0, 0, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 03804   860   NtOpenFile  (0x100001, {24, 0, 0x40, 0, 0,  (0x100001, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\"}, 3, 16417, ... 232, {status=0x0, info=1}, ) }, 3, 16417, ... 232, {status=0x0, info=1}, ) == 0x0
 03805   860   NtQueryDirectoryFile  (232, 0, 0, 0, 1222508, 616, BothDirectory, 1,  (232, 0, 0, 0, 1222508, 616, BothDirectory, 1, "dwwin.exe", 0, ... {status=0x0, info=112}, ) , 0, ... {status=0x0, info=112}, ) == 0x0
 03806   860   NtClose  (232, ... ) == 0x0
 03807   860   NtQueryInformationProcess  (-1, DefaultHardErrorMode, 4, ... {process info, class 12, size 4}, 0x0, ) == 0x0
 03808   860   NtSetInformationProcess  (-1, DefaultHardErrorMode, {process info, class 12, size 4}, 4, ... ) == 0x0
 03809   860   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\dwwin.exe"}, 1222884, ... ) }, 1222884, ... ) == 0x0
 03810   860   NtOpenFile  (0x100001, {24, 0, 0x40, 0, 0,  (0x100001, {24, 0, 0x40, 0, 0, "\??\C:\"}, 3, 16417, ... 232, {status=0x0, info=1}, ) }, 3, 16417, ... 232, {status=0x0, info=1}, ) == 0x0
 03811   860   NtQueryDirectoryFile  (232, 0, 0, 0, 1222312, 616, BothDirectory, 1,  (232, 0, 0, 0, 1222312, 616, BothDirectory, 1, "WINDOWS", 0, ... {status=0x0, info=108}, ) , 0, ... {status=0x0, info=108}, ) == 0x0
 03812   860   NtClose  (232, ... ) == 0x0
 03813   860   NtOpenFile  (0x100001, {24, 0, 0x40, 0, 0,  (0x100001, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\"}, 3, 16417, ... 232, {status=0x0, info=1}, ) }, 3, 16417, ... 232, {status=0x0, info=1}, ) == 0x0
 03814   860   NtQueryDirectoryFile  (232, 0, 0, 0, 1222312, 616, BothDirectory, 1,  (232, 0, 0, 0, 1222312, 616, BothDirectory, 1, "system32", 0, ... {status=0x0, info=110}, ) , 0, ... {status=0x0, info=110}, ) == 0x0
 03815   860   NtClose  (232, ... ) == 0x0
 03816   860   NtOpenFile  (0x100001, {24, 0, 0x40, 0, 0,  (0x100001, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\"}, 3, 16417, ... 232, {status=0x0, info=1}, ) }, 3, 16417, ... 232, {status=0x0, info=1}, ) == 0x0
 03817   860   NtQueryDirectoryFile  (232, 0, 0, 0, 1222312, 616, BothDirectory, 1,  (232, 0, 0, 0, 1222312, 616, BothDirectory, 1, "dwwin.exe", 0, ... {status=0x0, info=112}, ) , 0, ... {status=0x0, info=112}, ) == 0x0
 03818   860   NtClose  (232, ... ) == 0x0
 03819   860   NtQueryInformationProcess  (-1, DefaultHardErrorMode, 4, ... {process info, class 12, size 4}, 0x0, ) == 0x0
 03820   860   NtSetInformationProcess  (-1, DefaultHardErrorMode, {process info, class 12, size 4}, 4, ... ) == 0x0
 03821   860   NtQueryInformationProcess  (-1, DeviceMap, 36, ... {process info, class 23, size 36}, 0x0, ) == 0x0
 03822   860   NtOpenKey  (0x80000100, {24, 0, 0x40, 0, 0,  (0x80000100, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Layers"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 03823   860   NtOpenThreadTokenEx  (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN
 03824   860   NtOpenProcessTokenEx  (-1, 0x20008, 512, ... 232, ) == 0x0
 03825   860   NtQueryInformationToken  (232, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0
 03826   860   NtClose  (232, ... ) == 0x0
 03827   860   NtOpenKey  (0x80000100, {24, 0, 0x40, 0, 0,  (0x80000100, {24, 0, 0x40, 0, 0, "\REGISTRY\USER\S-1-5-21-1292428093-1383384898-725345543-1003\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Layers"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 03828   860   NtOpenKey  (0x80000100, {24, 0, 0x40, 0, 0,  (0x80000100, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Custom\dwwin.exe"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 03829   860   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\dwwin.exe"}, 1223716, ... ) }, 1223716, ... ) == 0x0
 03830   860   NtQueryInformationProcess  (-1, DefaultHardErrorMode, 4, ... {process info, class 12, size 4}, 0x0, ) == 0x0
 03831   860   NtSetInformationProcess  (-1, DefaultHardErrorMode, {process info, class 12, size 4}, 4, ... ) == 0x0
 03832   860   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\dwwin.exe"}, 1222584, ... ) }, 1222584, ... ) == 0x0
 03833   860   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\SYSTEM32\DWWIN.EXE"}, 1222576, ... ) }, 1222576, ... ) == 0x0
 03834   860   NtOpenFile  (0x100100, {24, 0, 0x40, 0, 0,  (0x100100, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\SYSTEM32\DWWIN.EXE"}, 7, 2113568, ... 232, {status=0x0, info=1}, ) }, 7, 2113568, ... 232, {status=0x0, info=1}, ) == 0x0
 03835   860   NtSetInformationFile  (232, 1222552, 40, Basic, ... {status=0x0, info=0}, ) == 0x0
 03836   860   NtClose  (232, ... ) == 0x0
 03837   860   NtCreateFile  (0xc0100080, {24, 0, 0x40, 0, 1222560,  (0xc0100080, {24, 0, 0x40, 0, 1222560, "\??\C:\WINDOWS\SYSTEM32\DWWIN.EXE"}, 0x0, 0, 1, 1, 96, 0, 0, ... ) }, 0x0, 0, 1, 1, 96, 0, 0, ... ) == STATUS_SHARING_VIOLATION
 03838   860   NtOpenFile  (0x100100, {24, 0, 0x40, 0, 0,  (0x100100, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\SYSTEM32\DWWIN.EXE"}, 7, 2113568, ... 232, {status=0x0, info=1}, ) }, 7, 2113568, ... 232, {status=0x0, info=1}, ) == 0x0
 03839   860   NtSetInformationFile  (232, 1222552, 40, Basic, ... {status=0x0, info=0}, ) == 0x0
 03840   860   NtClose  (232, ... ) == 0x0
 03841   860   NtOpenFile  (0x100020, {24, 0, 0x40, 0, 0,  (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\dwwin.exe"}, 5, 96, ... 232, {status=0x0, info=1}, ) }, 5, 96, ... 232, {status=0x0, info=1}, ) == 0x0
 03842   860   NtCreateSection  (0xe, 0x0, 0x0, 16, 134217728, 232, ... 236, ) == 0x0
 03843   860   NtClose  (232, ... ) == 0x0
 03844   860   NtMapViewOfSection  (236, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 16, ... (0x9b0000), 0x0, 192512, ) == 0x0
 03845   860   NtClose  (236, ... ) == 0x0
 03846   860   NtUnmapViewOfSection  (-1, 0x9b0000, ... ) == 0x0
 03847   860   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\dwwin.exe"}, 1222180, ... ) }, 1222180, ... ) == 0x0
 03848   860   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\SYSTEM32\DWWIN.EXE"}, 1222676, ... ) }, 1222676, ... ) == 0x0
 03849   860   NtOpenFile  (0x100100, {24, 0, 0x40, 0, 0,  (0x100100, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\SYSTEM32\DWWIN.EXE"}, 7, 2113568, ... 236, {status=0x0, info=1}, ) }, 7, 2113568, ... 236, {status=0x0, info=1}, ) == 0x0
 03850   860   NtSetInformationFile  (236, 1222652, 40, Basic, ... {status=0x0, info=0}, ) == 0x0
 03851   860   NtClose  (236, ... ) == 0x0
 03852   860   NtCreateFile  (0xc0100080, {24, 0, 0x40, 0, 1222660,  (0xc0100080, {24, 0, 0x40, 0, 1222660, "\??\C:\WINDOWS\SYSTEM32\DWWIN.EXE"}, 0x0, 0, 1, 1, 96, 0, 0, ... ) }, 0x0, 0, 1, 1, 96, 0, 0, ... ) == STATUS_SHARING_VIOLATION
 03853   860   NtOpenFile  (0x100100, {24, 0, 0x40, 0, 0,  (0x100100, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\SYSTEM32\DWWIN.EXE"}, 7, 2113568, ... 236, {status=0x0, info=1}, ) }, 7, 2113568, ... 236, {status=0x0, info=1}, ) == 0x0
 03854   860   NtSetInformationFile  (236, 1222652, 40, Basic, ... {status=0x0, info=0}, ) == 0x0
 03855   860   NtClose  (236, ... ) == 0x0
 03856   860   NtCreateFile  (0x80100080, {24, 0, 0x40, 0, 1222924,  (0x80100080, {24, 0, 0x40, 0, 1222924, "\??\C:\WINDOWS\system32\dwwin.exe"}, 0x0, 0, 5, 1, 96, 0, 0, ... 236, {status=0x0, info=1}, ) }, 0x0, 0, 5, 1, 96, 0, 0, ... 236, {status=0x0, info=1}, ) == 0x0
 03857   860   NtCreateSection  (0xf0005, 0x0, 0x0, 2, 134217728, 236, ... 232, ) == 0x0
 03858   860   NtClose  (236, ... ) == 0x0
 03859   860   NtMapViewOfSection  (232, -1, (0x0), 0, 0, {0, 0}, 0, 1, 0, 2, ... (0x9b0000), {0, 0}, 192512, ) == 0x0
 03860   860   NtClose  (232, ... ) == 0x0
 03861   860   NtAllocateVirtualMemory  (-1, 1212416, 0, 4096, 4096, 260, ... 1212416, 4096, ) == 0x0
 03862   860   NtQueryInformationProcess  (-1, DefaultHardErrorMode, 4, ... {process info, class 12, size 4}, 0x0, ) == 0x0
 03863   860   NtSetInformationProcess  (-1, DefaultHardErrorMode, {process info, class 12, size 4}, 4, ... ) == 0x0
 03864   860   NtQueryDefaultLocale  (1, 1223544, ... ) == 0x0
 03865   860   NtQueryVirtualMemory  (-1, 0x9b0000, Basic, 28, ... {BaseAddress=0x9b0000,AllocationBase=0x9b0000,AllocationProtect=0x2,RegionSize=0x2f000,State=0x1000,Protect=0x2,Type=0x40000,}, 0x0, ) == 0x0
 03866   860   NtQueryVirtualMemory  (-1, 0x9b0000, Basic, 28, ... {BaseAddress=0x9b0000,AllocationBase=0x9b0000,AllocationProtect=0x2,RegionSize=0x2f000,State=0x1000,Protect=0x2,Type=0x40000,}, 0x0, ) == 0x0
 03867   860   NtUnmapViewOfSection  (-1, 0x9b0000, ... ) == 0x0
 03868   860   NtQueryInformationProcess  (-1, DefaultHardErrorMode, 4, ... {process info, class 12, size 4}, 0x0, ) == 0x0
 03869   860   NtSetInformationProcess  (-1, DefaultHardErrorMode, {process info, class 12, size 4}, 4, ... ) == 0x0
 03870   860   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\dwwin.exe"}, 1222576, ... ) }, 1222576, ... ) == 0x0
 03871   860   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\SYSTEM32\DWWIN.EXE"}, 1222568, ... ) }, 1222568, ... ) == 0x0
 03872   860   NtOpenFile  (0x100100, {24, 0, 0x40, 0, 0,  (0x100100, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\SYSTEM32\DWWIN.EXE"}, 7, 2113568, ... 232, {status=0x0, info=1}, ) }, 7, 2113568, ... 232, {status=0x0, info=1}, ) == 0x0
 03873   860   NtSetInformationFile  (232, 1222544, 40, Basic, ... {status=0x0, info=0}, ) == 0x0
 03874   860   NtClose  (232, ... ) == 0x0
 03875   860   NtCreateFile  (0xc0100080, {24, 0, 0x40, 0, 1222552,  (0xc0100080, {24, 0, 0x40, 0, 1222552, "\??\C:\WINDOWS\SYSTEM32\DWWIN.EXE"}, 0x0, 0, 1, 1, 96, 0, 0, ... ) }, 0x0, 0, 1, 1, 96, 0, 0, ... ) == STATUS_SHARING_VIOLATION
 03876   860   NtOpenFile  (0x100100, {24, 0, 0x40, 0, 0,  (0x100100, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\SYSTEM32\DWWIN.EXE"}, 7, 2113568, ... 232, {status=0x0, info=1}, ) }, 7, 2113568, ... 232, {status=0x0, info=1}, ) == 0x0
 03877   860   NtSetInformationFile  (232, 1222544, 40, Basic, ... {status=0x0, info=0}, ) == 0x0
 03878   860   NtClose  (232, ... ) == 0x0
 03879   860   NtOpenFile  (0x100020, {24, 0, 0x40, 0, 0,  (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\dwwin.exe"}, 5, 96, ... 232, {status=0x0, info=1}, ) }, 5, 96, ... 232, {status=0x0, info=1}, ) == 0x0
 03880   860   NtCreateSection  (0xe, 0x0, 0x0, 16, 134217728, 232, ... 236, ) == 0x0
 03881   860   NtClose  (232, ... ) == 0x0
 03882   860   NtMapViewOfSection  (236, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 16, ... (0x9b0000), 0x0, 192512, ) == 0x0
 03883   860   NtClose  (236, ... ) == 0x0
 03884   860   NtUnmapViewOfSection  (-1, 0x9b0000, ... ) == 0x0
 03885   860   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\dwwin.exe"}, 1222172, ... ) }, 1222172, ... ) == 0x0
 03886   860   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\SYSTEM32\DWWIN.EXE"}, 1222668, ... ) }, 1222668, ... ) == 0x0
 03887   860   NtOpenFile  (0x100100, {24, 0, 0x40, 0, 0,  (0x100100, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\SYSTEM32\DWWIN.EXE"}, 7, 2113568, ... 236, {status=0x0, info=1}, ) }, 7, 2113568, ... 236, {status=0x0, info=1}, ) == 0x0
 03888   860   NtSetInformationFile  (236, 1222644, 40, Basic, ... {status=0x0, info=0}, ) == 0x0
 03889   860   NtClose  (236, ... ) == 0x0
 03890   860   NtCreateFile  (0xc0100080, {24, 0, 0x40, 0, 1222652,  (0xc0100080, {24, 0, 0x40, 0, 1222652, "\??\C:\WINDOWS\SYSTEM32\DWWIN.EXE"}, 0x0, 0, 1, 1, 96, 0, 0, ... ) }, 0x0, 0, 1, 1, 96, 0, 0, ... ) == STATUS_SHARING_VIOLATION
 03891   860   NtOpenFile  (0x100100, {24, 0, 0x40, 0, 0,  (0x100100, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\SYSTEM32\DWWIN.EXE"}, 7, 2113568, ... 236, {status=0x0, info=1}, ) }, 7, 2113568, ... 236, {status=0x0, info=1}, ) == 0x0
 03892   860   NtSetInformationFile  (236, 1222644, 40, Basic, ... {status=0x0, info=0}, ) == 0x0
 03893   860   NtClose  (236, ... ) == 0x0
 03894   860   NtCreateFile  (0x80100080, {24, 0, 0x40, 0, 1222916,  (0x80100080, {24, 0, 0x40, 0, 1222916, "\??\C:\WINDOWS\system32\dwwin.exe"}, 0x0, 0, 5, 1, 96, 0, 0, ... 236, {status=0x0, info=1}, ) }, 0x0, 0, 5, 1, 96, 0, 0, ... 236, {status=0x0, info=1}, ) == 0x0
 03895   860   NtCreateSection  (0xf0005, 0x0, 0x0, 2, 134217728, 236, ... 232, ) == 0x0
 03896   860   NtClose  (236, ... ) == 0x0
 03897   860   NtMapViewOfSection  (232, -1, (0x0), 0, 0, {0, 0}, 0, 1, 0, 2, ... (0x9b0000), {0, 0}, 192512, ) == 0x0
 03898   860   NtClose  (232, ... ) == 0x0
 03899   860   NtQueryInformationProcess  (-1, DefaultHardErrorMode, 4, ... {process info, class 12, size 4}, 0x0, ) == 0x0
 03900   860   NtSetInformationProcess  (-1, DefaultHardErrorMode, {process info, class 12, size 4}, 4, ... ) == 0x0
 03901   860   NtQueryDefaultLocale  (1, 1223536, ... ) == 0x0
 03902   860   NtQueryVirtualMemory  (-1, 0x9b0000, Basic, 28, ... {BaseAddress=0x9b0000,AllocationBase=0x9b0000,AllocationProtect=0x2,RegionSize=0x2f000,State=0x1000,Protect=0x2,Type=0x40000,}, 0x0, ) == 0x0
 03903   860   NtUnmapViewOfSection  (-1, 0x9b0000, ... ) == 0x0
 03904   860   NtOpenKey  (0x80000100, {24, 0, 0x40, 0, 0,  (0x80000100, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 03905   860   NtOpenThreadTokenEx  (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN
 03906   860   NtOpenProcessTokenEx  (-1, 0x20008, 512, ... 232, ) == 0x0
 03907   860   NtQueryInformationToken  (232, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0
 03908   860   NtClose  (232, ... ) == 0x0
 03909   860   NtOpenKey  (0x80000100, {24, 0, 0x40, 0, 0,  (0x80000100, {24, 0, 0x40, 0, 0, "\REGISTRY\USER\S-1-5-21-1292428093-1383384898-725345543-1003\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 03910   860   NtQueryInformationProcess  (-1, DefaultHardErrorMode, 4, ... {process info, class 12, size 4}, 0x0, ) == 0x0
 03911   860   NtSetInformationProcess  (-1, DefaultHardErrorMode, {process info, class 12, size 4}, 4, ... ) == 0x0
 03912   860   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\dwwin.exe"}, 1224136, ... ) }, 1224136, ... ) == 0x0
 03913   860   NtOpenFile  (0x100001, {24, 0, 0x40, 0, 0,  (0x100001, {24, 0, 0x40, 0, 0, "\??\C:\"}, 3, 16417, ... 232, {status=0x0, info=1}, ) }, 3, 16417, ... 232, {status=0x0, info=1}, ) == 0x0
 03914   860   NtQueryDirectoryFile  (232, 0, 0, 0, 1223564, 616, BothDirectory, 1,  (232, 0, 0, 0, 1223564, 616, BothDirectory, 1, "WINDOWS", 0, ... {status=0x0, info=108}, ) , 0, ... {status=0x0, info=108}, ) == 0x0
 03915   860   NtClose  (232, ... ) == 0x0
 03916   860   NtOpenFile  (0x100001, {24, 0, 0x40, 0, 0,  (0x100001, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\"}, 3, 16417, ... 232, {status=0x0, info=1}, ) }, 3, 16417, ... 232, {status=0x0, info=1}, ) == 0x0
 03917   860   NtQueryDirectoryFile  (232, 0, 0, 0, 1223564, 616, BothDirectory, 1,  (232, 0, 0, 0, 1223564, 616, BothDirectory, 1, "system32", 0, ... {status=0x0, info=110}, ) , 0, ... {status=0x0, info=110}, ) == 0x0
 03918   860   NtClose  (232, ... ) == 0x0
 03919   860   NtOpenFile  (0x100001, {24, 0, 0x40, 0, 0,  (0x100001, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\"}, 3, 16417, ... 232, {status=0x0, info=1}, ) }, 3, 16417, ... 232, {status=0x0, info=1}, ) == 0x0
 03920   860   NtQueryDirectoryFile  (232, 0, 0, 0, 1223564, 616, BothDirectory, 1,  (232, 0, 0, 0, 1223564, 616, BothDirectory, 1, "dwwin.exe", 0, ... {status=0x0, info=112}, ) , 0, ... {status=0x0, info=112}, ) == 0x0
 03921   860   NtClose  (232, ... ) == 0x0
 03922   860   NtQueryInformationProcess  (-1, DefaultHardErrorMode, 4, ... {process info, class 12, size 4}, 0x0, ) == 0x0
 03923   860   NtSetInformationProcess  (-1, DefaultHardErrorMode, {process info, class 12, size 4}, 4, ... ) == 0x0
 03924   860   NtWaitForSingleObject  (184, 0, {-1000000, -1}, ... ) == 0x0
 03925   860   NtReleaseMutant  (184, ... 0x0, ) == 0x0
 03926   860   NtUnmapViewOfSection  (-1, 0xac0000, ... ) == 0x0
 03927   860   NtClose  (228, ... ) == 0x0
 03928   860   NtClose  (224, ... ) == 0x0
 03929   860   NtOpenThreadToken  (-2, 0x2000000, 1, ... ) == STATUS_NO_TOKEN
 03930   860   NtOpenProcessToken  (-1, 0xa, ... 224, ) == 0x0
 03931   860   NtOpenKey  (0x2000000, {24, 16, 0x40, 0, 0,  (0x2000000, {24, 16, 0x40, 0, 0, "Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers"}, ... 228, ) }, ... 228, ) == 0x0
 03932   860   NtQueryKey  (228, Basic, 520, ... {LastWrite={0x3a5edea,0x1c74da9}, TitleIdx=0, Name= (228, Basic, 520, ... {LastWrite={0x3a5edea,0x1c74da9}, TitleIdx=0, Name="CodeIdentifierso"}, 46, ) }, 46, ) == 0x0
 03933   860   NtClose  (228, ... ) == 0x0
 03934   860   NtOpenKey  (0x2000000, {24, 60, 0x40, 0, 0,  (0x2000000, {24, 60, 0x40, 0, 0, "Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 03935   860   NtOpenSymbolicLinkObject  (0x1, {24, 0, 0x40, 0, 0,  (0x1, {24, 0, 0x40, 0, 0, "\??\C:"}, ... 228, ) }, ... 228, ) == 0x0
 03936   860   NtQuerySymbolicLinkObject  (228, ...  (228, ... "\Device\HarddiskVolume1", 48, ) , 48, ) == 0x0
 03937   860   NtClose  (228, ... ) == 0x0
 03938   860   NtQueryVolumeInformationFile  (220, 1224248, 8, Device, ... {status=0x0, info=8}, ) == 0x0
 03939   860   NtQueryInformationFile  (220, 1224364, 528, Name, ... {status=0x0, info=58}, ) == 0x0
 03940   860   NtQueryInformationProcess  (-1, DefaultHardErrorMode, 4, ... {process info, class 12, size 4}, 0x0, ) == 0x0
 03941   860   NtSetInformationProcess  (-1, DefaultHardErrorMode, {process info, class 12, size 4}, 4, ... ) == 0x0
 03942   860   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\dwwin.exe"}, 1223536, ... ) }, 1223536, ... ) == 0x0
 03943   860   NtOpenFile  (0x100001, {24, 0, 0x40, 0, 0,  (0x100001, {24, 0, 0x40, 0, 0, "\??\C:\"}, 3, 16417, ... 228, {status=0x0, info=1}, ) }, 3, 16417, ... 228, {status=0x0, info=1}, ) == 0x0
 03944   860   NtQueryDirectoryFile  (228, 0, 0, 0, 1222964, 616, BothDirectory, 1,  (228, 0, 0, 0, 1222964, 616, BothDirectory, 1, "WINDOWS", 0, ... {status=0x0, info=108}, ) , 0, ... {status=0x0, info=108}, ) == 0x0
 03945   860   NtClose  (228, ... ) == 0x0
 03946   860   NtOpenFile  (0x100001, {24, 0, 0x40, 0, 0,  (0x100001, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\"}, 3, 16417, ... 228, {status=0x0, info=1}, ) }, 3, 16417, ... 228, {status=0x0, info=1}, ) == 0x0
 03947   860   NtQueryDirectoryFile  (228, 0, 0, 0, 1222964, 616, BothDirectory, 1,  (228, 0, 0, 0, 1222964, 616, BothDirectory, 1, "system32", 0, ... {status=0x0, info=110}, ) , 0, ... {status=0x0, info=110}, ) == 0x0
 03948   860   NtClose  (228, ... ) == 0x0
 03949   860   NtOpenFile  (0x100001, {24, 0, 0x40, 0, 0,  (0x100001, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\"}, 3, 16417, ... 228, {status=0x0, info=1}, ) }, 3, 16417, ... 228, {status=0x0, info=1}, ) == 0x0
 03950   860   NtQueryDirectoryFile  (228, 0, 0, 0, 1222964, 616, BothDirectory, 1,  (228, 0, 0, 0, 1222964, 616, BothDirectory, 1, "dwwin.exe", 0, ... {status=0x0, info=112}, ) , 0, ... {status=0x0, info=112}, ) == 0x0
 03951   860   NtClose  (228, ... ) == 0x0
 03952   860   NtQueryInformationProcess  (-1, DefaultHardErrorMode, 4, ... {process info, class 12, size 4}, 0x0, ) == 0x0
 03953   860   NtSetInformationProcess  (-1, DefaultHardErrorMode, {process info, class 12, size 4}, 4, ... ) == 0x0
 03954   860   NtQueryInformationFile  (220, 1226404, 24, Standard, ... {status=0x0, info=24}, ) == 0x0
 03955   860   NtCreateSection  (0xf0005, 0x0, {192512, 0}, 2, 134217728, 220, ... 228, ) == 0x0
 03956   860   NtMapViewOfSection  (228, -1, (0x0), 0, 0, {0, 0}, 192512, 1, 0, 2, ... (0x9b0000), {0, 0}, 192512, ) == 0x0
 03957   860   NtClose  (228, ... ) == 0x0
 03958   860   NtUnmapViewOfSection  (-1, 0x9b0000, ... ) == 0x0
 03959   860   NtOpenKey  (0x1, {24, 0, 0x40, 0, 0,  (0x1, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers"}, ... 228, ) }, ... 228, ) == 0x0
 03960   860   NtQueryValueKey  (228,  (228, "LogFileName", Partial, 536, ... ) , Partial, 536, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 03961   860   NtClose  (228, ... ) == 0x0
 03962   860   NtQueryInformationToken  (224, User, 128, ... {token info, class 1, size 36}, 36, ) == 0x0
 03963   860   NtQueryInformationToken  (224, 15, 4, ... {token info, class 15, size 4}, 4, ) == 0x0
 03964   860   NtClose  (224, ... ) == 0x0
 03965   860   NtQuerySection  (216, Image, 48, ... {section info, class 1, size 48}, 0x0, ) == 0x0
 03966   860   NtOpenKey  (0x80000000, {24, 0, 0x40, 0, 0,  (0x80000000, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\dwwin.exe"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 03967   860   NtQuerySystemInformation  (71, 4, ... {system info, class 71, size 4}, 0x0, ) == 0x0
 03968   860   NtCreateProcessEx  (1228328, 2035711, 0, -1, 4, 216, 0, 0, 0, ... ) == 0x0
 03969   860   NtOpenSection  (0xe, {24, 48, 0x0, 0, 0,  (0xe, {24, 48, 0x0, 0, 0, "W32_Virtu"}, ... 228, ) }, ... 228, ) == 0x0
 03970   860   NtMapViewOfSection  (228, 224, (0x0), 0, 27086, 0x0, 27086, 2, 1048576, 64, ... (0x7ffa0000), 0x0, 28672, ) == 0x0
 03971   860   NtClose  (228, ... ) == 0x0
 03972   860   NtProtectVirtualMemory  (224, (0x7c90d682), 5, 64, ... (0x7c90d000), 4096, 32, ) == 0x0
 03973   860   NtWriteVirtualMemory  (224, 0x7c90d682,  (224, 0x7c90d682, "\350\15Mi\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 03974   860   NtProtectVirtualMemory  (224, (0x7c90dcfd), 5, 64, ... (0x7c90d000), 4096, 64, ) == 0x0
 03975   860   NtWriteVirtualMemory  (224, 0x7c90dcfd,  (224, 0x7c90dcfd, "\350\337Fi\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 03976   860   NtProtectVirtualMemory  (224, (0x7c90d754), 5, 64, ... (0x7c90d000), 4096, 64, ) == 0x0
 03977   860   NtWriteVirtualMemory  (224, 0x7c90d754,  (224, 0x7c90d754, "\350\217Li\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 03978   860   NtProtectVirtualMemory  (224, (0x7c90d769), 5, 64, ... (0x7c90d000), 4096, 64, ) == 0x0
 03979   860   NtWriteVirtualMemory  (224, 0x7c90d769,  (224, 0x7c90d769, "\350\207Li\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 03980   860   NtSetInformationProcess  (224, PriorityClass, {process info, class 18, size 2}, 512, ... ) == 0x0
 03981   860   NtSetInformationProcess  (224, DefaultHardErrorMode, {process info, class 12, size 4}, 4, ... ) == 0x0
 03982   860   NtQueryInformationProcess  (224, Basic, 24, ... {ExitStatus=0x103,PebBaseAddress=0x7ffd5000,AffinityMask=0x1,BasePriority=8,Pid=704,ParentPid=464,}, 0x0, ) == 0x0
 03983   860   NtReadVirtualMemory  (224, 0x7ffd5008, 4, ...  (224, 0x7ffd5008, 4, ... "\0\0\00", 0x0, ) , 0x0, ) == 0x0
 03984   860   NtOpenFile  (0x1200a9, {24, 0, 0x40, 0, 0,  (0x1200a9, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\dwwin.exe.Manifest"}, 1, 96, ... ) }, 1, 96, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 03985   860   NtReadVirtualMemory  (224, 0x30000000, 4096, ...  (224, 0x30000000, 4096, ... "MZ\220\0\3\0\0\0\4\0\0\0\377\377\0\0\270\0\0\0\0\0\0\0@\0\0\0\0\0\0\0\201\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\360\0\0\0\16\37\272\16\0\264\11\315!\270\1L\315!This program cannot be run in DOS mode.\15\15\12$\0\0\0\0\0\0\0$\206\244\23`\347\312@`\347\312@`\347\312@9\304\331@b\347\312@`\347\313@d\347\312@\210\370\301@a\347\312@\343\373\304@j\347\312@\210\370\300@I\347\312@6\370\331@h\347\312@\272\304\326@i\347\312@\220\370\301@p\347\312@`\347\312@H\346\312@Rich`\347\312@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0PE\0\0L\1\3\0N\23\216?\0\0\0\0\0\0\0\0\340\0\17\1\13\1\6\24\0\220\2\0\0\240\0\0\0\0\0\0\222\236\2\0\0\20\0\0\0\320\3\0\0\0\00\0\20\0\0\0\20\0\0\4\0\0\0\0\0\0\0\4\0\0\0\0\0\0\0\0\260\3\0\0\20\0\0\0\0\0\0\2\0\0\0\0\0\20\0\0\20\0\0\0\0\20\0\0\20\0\0\0\0\0\0\20\0\0\0\0\0\0\0\0\0\0\0\327\211\2\0z\1\0\0\00\3\0\244\12\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0Z\236\2\08\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0`\2\0\0\370\0\0\0\0\20\0\0\270\3\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0.text\0\0\0O\217\2\0", 4096, ) , 4096, ) == 0x0
 03986   860   NtReadVirtualMemory  (224, 0x30033000, 256, ...  (224, 0x30033000, 256, ... "\0\0\0\0J\23\216?\0\0\0\0\0\0\3\0\5\0\0\0(\0\0\200\13\0\0\0@\0\0\200\20\0\0\0X\0\0\200\0\0\0\0J\23\216?\0\0\0\0\0\0\1\0e\0\0\0p\0\0\200\0\0\0\0J\23\216?\0\0\0\0\0\0\1\0\1\0\0\0\210\0\0\200\0\0\0\0J\23\216?\0\0\0\0\0\0\1\0\1\0\0\0\240\0\0\200\0\0\0\0J\23\216?\0\0\0\0\0\0\1\0\11\4\0\0\270\0\0\0\0\0\0\0J\23\216?\0\0\0\0\0\0\1\0\11\4\0\0\310\0\0\0\0\0\0\0J\23\216?\0\0\0\0\0\0\1\0\11\4\0\0\330\0\0\0\3600\3\0\26\3\0\0\0\0\0\0\0\0\0\0\104\3\0\254\1\0\0\0\0\0\0\0\0\0\0\2645\3\0\360\4\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\300\0\310\200\0\0\0\0\14\0\0\0\0\0f\1", 256, ) , 256, ) == 0x0
 03987   860   NtQueryDebugFilterState  (53, 2, ... ) == 0x0
 03988   860   NtQueryInformationProcess  (224, Basic, 24, ... {ExitStatus=0x103,PebBaseAddress=0x7ffd5000,AffinityMask=0x1,BasePriority=8,Pid=704,ParentPid=464,}, 0x0, ) == 0x0
 03989   860   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32"}, 1227280, ... ) }, 1227280, ... ) == 0x0
 03990   860   NtAllocateVirtualMemory  (-1, 0, 0, 2428, 4096, 4, ... 4063232, 4096, ) == 0x0
 03991   860   NtAllocateVirtualMemory  (224, 0, 0, 6432, 4096, 4, ... 65536, 8192, ) == 0x0
 03992   860   NtWriteVirtualMemory  (224, 0x10000,  (224, 0x10000, "=\0A\0:\0=\0A\0:\0\\0\0\0=\0C\0:\0=\0C\0:\0\\0s\0c\0r\0i\0p\0t\0s\0\0\0=\0U\0:\0=\0U\0:\0\\0\0\0A\0L\0L\0U\0S\0E\0R\0S\0P\0R\0O\0F\0I\0L\0E\0=\0C\0:\0\\0D\0o\0c\0u\0m\0e\0n\0t\0s\0 \0a\0n\0d\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0A\0l\0l\0 \0U\0s\0e\0r\0s\0\0\0A\0P\0P\0D\0A\0T\0A\0=\0C\0:\0\\0D\0o\0c\0u\0m\0e\0n\0t\0s\0 \0a\0n\0d\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0M\0a\0r\0t\0i\0m\0 \0C\0a\0r\0b\0o\0n\0e\0\\0A\0p\0p\0l\0i\0c\0a\0t\0i\0o\0n\0 \0D\0a\0t\0a\0\0\0A\0T\0L\0_\0I\0N\0C\0_\0P\0A\0T\0H\0=\0C\0:\0\\0W\0I\0N\0D\0D\0K\0\\03\07\09\00\0~\01\0.\01\08\03\0\\0i\0n\0c\0\0\0A\0T\0L\0_\0I\0N\0C\0_\0R\0O\0O\0T\0=\0C\0:\0\\0W\0I\0N\0D\0D\0K\0\\03\07\09\00\0~\01\0.\01\08\03\0\\0i\0n\0c\0\0\0A\0T\0L\0_\0L\0I\0B\0_\0P\0A\0T\0H\0=\0C\0:\0\\0W\0I\0N\0D\0D\0K\0\\03\07\0", 6432, ... 0x0, ) , 6432, ... 0x0, ) == 0x0
 03993   860   NtAllocateVirtualMemory  (224, 0, 0, 2428, 4096, 4, ... 131072, 4096, ) == 0x0
 03994   860   NtWriteVirtualMemory  (224, 0x20000,  (224, 0x20000, "\0\20\0\0|\11\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\3\0\0\0\0\0\0\0\13\0\0\0&\0\10\2\220\2\0\0\16\0\0\0\364\3\366\3\230\4\0\0:\0<\0\220\10\0\0N\0P\0\314\10\0\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0:\0<\0\34\11\0\0\36\0 \0X\11\0\0\0\0\2\0x\11\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0", 2428, ... 0x0, ) , 2428, ... 0x0, ) == 0x0
 03995   860   NtWriteVirtualMemory  (224, 0x7ffd5010,  (224, 0x7ffd5010, "\0\0\2\0", 4, ... 0x0, ) , 4, ... 0x0, ) == 0x0
 03996   860   NtAllocateVirtualMemory  (224, 0, 0, 388, 4096, 4, ... 196608, 4096, ) == 0x0
 03997   860   NtWriteVirtualMemory  (224, 0x30000,  (224, 0x30000, "S\0h\0i\0m\0E\0n\0g\0.\0d\0l\0l\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\204\1\0\0\253\355\15\254\210\255\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\1\0\0\0\21\21\21\21\21\21\21\21\21\21\21\21\21\21\21\21\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0", 388, ... 0x0, ) , 388, ... 0x0, ) == 0x0
 03998   860   NtWriteVirtualMemory  (224, 0x7ffd51e8,  (224, 0x7ffd51e8, "\0\0\3\0", 4, ... 0x0, ) , 4, ... 0x0, ) == 0x0
 03999   860   NtFreeVirtualMemory  (-1, (0x3e0000), 0, 32768, ... (0x3e0000), 4096, ) == 0x0
 04000   860   NtAllocateVirtualMemory  (224, 0, 0, 1048576, 8192, 4, ... 262144, 1048576, ) == 0x0
 04001   860   NtAllocateVirtualMemory  (224, 1302528, 0, 8192, 4096, 4, ... 1302528, 8192, ) == 0x0
 04002   860   NtProtectVirtualMemory  (224, (0x13e000), 4096, 260, ... (0x13e000), 4096, 4, ) == 0x0
 04003   860   NtCreateThread  (0x1f03ff, 0x0, 224, 1228336, 1228000, 1, ... 228, {704, 1568}, ) == 0x0
 04004   860   NtRequestWaitReplyPort  (24, {168, 196, new_msg, 0, 16, 2147348480, 2008285840, 0}  (24, {168, 196, new_msg, 0, 16, 2147348480, 2008285840, 0} "\0\0\0\0\0\0\1\0\0(\372\177x\2\264w\343\0\0\0\344\0\0\0\300\2\0\0 \6\0\0\0\0\0\0\0\0\0\0\0\0\0\4\0\0\0\0\30\302\22\0x\1\24\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0P\375\177\0\0\0\0\0\0\25\0\10 \0\0" ... {168, 196, reply, 0, 464, 860, 58160, 0} "\0\0\0\0\0\0\1\0\0\0\0\0x\2\264w\340\0\0\0\344\0\0\0\300\2\0\0 \6\0\0\0\0\0\0\0\0\0\0\0\0\0\4\0\0\0\0\30\302\22\0x\1\24\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0P\375\177\0\0\0\0\0\0\25\0\10 \0\0" )  ... {168, 196, reply, 0, 464, 860, 58160, 0}  (24, {168, 196, new_msg, 0, 16, 2147348480, 2008285840, 0} "\0\0\0\0\0\0\1\0\0(\372\177x\2\264w\343\0\0\0\344\0\0\0\300\2\0\0 \6\0\0\0\0\0\0\0\0\0\0\0\0\0\4\0\0\0\0\30\302\22\0x\1\24\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0P\375\177\0\0\0\0\0\0\25\0\10 \0\0" ... {168, 196, reply, 0, 464, 860, 58160, 0} "\0\0\0\0\0\0\1\0\0\0\0\0x\2\264w\340\0\0\0\344\0\0\0\300\2\0\0 \6\0\0\0\0\0\0\0\0\0\0\0\0\0\4\0\0\0\0\30\302\22\0x\1\24\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0P\375\177\0\0\0\0\0\0\25\0\10 \0\0" )  ) == 0x0
 04005   860   NtResumeThread  (228, ... 1, ) == 0x0
 04006   860   NtClose  (220, ... ) == 0x0
 04007   860   NtClose  (216, ... ) == 0x0
 04008   860   NtClose  (228, ... ) == 0x0
 04009   860   NtWaitForMultipleObjects  (2, (204, 224, ), 1, 0, {1294967296, -1}, ... ) == 0x0
 04010   860   NtWaitForSingleObject  (180, 0, {0, 0}, ... ) == 0x102
 04011   860   NtWaitForMultipleObjects  (2, (204, 224, ), 1, 0, {1294967296, -1}, ... ) == 0x0
 04012   860   NtWaitForSingleObject  (180, 0, {0, 0}, ... ) == 0x102
 04013   860   NtWaitForMultipleObjects  (2, (204, 224, ), 1, 0, {1294967296, -1}, ... ) == 0x0
 04014   860   NtWaitForSingleObject  (180, 0, {0, 0}, ... ) == 0x102
 04015   860   NtWaitForMultipleObjects  (2, (204, 224, ), 1, 0, {1294967296, -1}, ... ) == 0x0
 04016   860   NtWaitForSingleObject  (180, 0, {0, 0}, ... ) == 0x0
 04017   860   NtClose  (224, ... ) == 0x0
 04018   860   NtUnmapViewOfSection  (-1, 0x3d0000, ... ) == 0x0
 04019   860   NtClose  (212, ... ) == 0x0
 04020   860   NtClose  (180, ... ) == 0x0
 04021   860   NtClose  (204, ... ) == 0x0
 04022   860   NtClose  (200, ... ) == 0x0
 04023   860   NtClose  (208, ... ) == 0x0
 04024   860   NtClose  (192, ... ) == 0x0
 04025   860   NtClose  (196, ... ) == 0x0
 04026   860   NtSetInformationThread  (-2, ZeroTlsCell, {ZeroTlsCell=0x13,}, 4, ... ) == 0x0
 04027   860   NtWaitForMultipleObjects  (2, (148, 144, ), 1, 0, 0x0, ... ) == 0x1
 04028   860   NtClose  (144, ... ) == 0x0
 04029   860   NtSetEvent  (148, ... 0x0, ) == 0x0
 04030   860   NtClose  (148, ... ) == 0x0
 04031   860   NtWaitForMultipleObjects  (2, (168, 160, ), 1, 0, 0x0, ... ) == 0x1
 04032   860   NtClose  (160, ... ) == 0x0
 04033   860   NtSetEvent  (168, ... 0x0, ) == 0x0
 04034   860   NtClose  (168, ... ) == 0x0
 04035   860   NtWaitForMultipleObjects  (2, (164, 156, ), 1, 0, 0x0, ... ) == 0x1
 04036   860   NtClose  (156, ... ) == 0x0
 04037   860   NtSetEvent  (164, ... 0x0, ) == 0x0
 04038   860   NtClose  (164, ... ) == 0x0
 04039   860   NtRequestWaitReplyPort  (176, {88, 112, new_msg, 0, 464, 860, 58158, 0}  (176, {88, 112, new_msg, 0, 464, 860, 58158, 0} "\1\356\0\0A\2<\0\30b\202\201\0\260\375\177\220k\364\367\370\37`\300\377\377\377\377X\353Q\200\0\0\0\0\206\252\254\3274US@\267\317oF\2\345 \230\2\345 \230\1\300\375\177(l\364\367\253\362Q\200\324k\364\367\300\250U\200aFT\200\0\0\0\0h\242\250\201" ... {124, 148, reply, 0, 464, 860, 58280, 0} "\2\31\221|\1\0\221|\200\300\227|p\31\221|\250$\12\0\330\0\0\0d\365\11\0\0\300\372\177\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\1\0\0\0\0\0\0\0\4\0\0\0\1\365\11\0\1\0\0\0d\365\11\0\0\0\0\0\0\0\0\0\1\0\0\0\10\376\257\0\0\0\0\0\334\377\257\0\30\356\220|p\5\221|\377\377\377\377m\5\221|\344f\347w" )  ... {124, 148, reply, 0, 464, 860, 58280, 0}  (176, {88, 112, new_msg, 0, 464, 860, 58158, 0} "\1\356\0\0A\2<\0\30b\202\201\0\260\375\177\220k\364\367\370\37`\300\377\377\377\377X\353Q\200\0\0\0\0\206\252\254\3274US@\267\317oF\2\345 \230\2\345 \230\1\300\375\177(l\364\367\253\362Q\200\324k\364\367\300\250U\200aFT\200\0\0\0\0h\242\250\201" ... {124, 148, reply, 0, 464, 860, 58280, 0} "\2\31\221|\1\0\221|\200\300\227|p\31\221|\250$\12\0\330\0\0\0d\365\11\0\0\300\372\177\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\1\0\0\0\0\0\0\0\4\0\0\0\1\365\11\0\1\0\0\0d\365\11\0\0\0\0\0\0\0\0\0\1\0\0\0\10\376\257\0\0\0\0\0\334\377\257\0\30\356\220|p\5\221|\377\377\377\377m\5\221|\344f\347w" )  ) == 0x0
 04040   860   NtClose  (172, ... ) == 0x0
 04041   860   NtClose  (176, ... ) == 0x0
 04042   860   NtClose  (108, ... ) == 0x0
 04043   860   NtUnmapViewOfSection  (-1, 0x69450000, ... ) == 0x0
 04044   860   NtUnmapViewOfSection  (-1, 0x77920000, ... ) == 0x0
 04045   860   NtUnmapViewOfSection  (-1, 0x76f50000, ... ) == 0x0
 04046   860   NtUnmapViewOfSection  (-1, 0x76360000, ... ) == 0x0
 04047   860   NtUnmapViewOfSection  (-1, 0x5b860000, ... ) == 0x0
 04048   860   NtUnmapViewOfSection  (-1, 0x769c0000, ... ) == 0x0
 04049   860   NtContinue  (1237680, 0, ...
 04050   860   NtQueryVirtualMemory  (-1, 0x3a71ad, Basic, 28, ... {BaseAddress=0x3a7000,AllocationBase=0x3a0000,AllocationProtect=0x40,RegionSize=0x29000,State=0x1000,Protect=0x40,Type=0x20000,}, 28, ) == 0x0
 04051   860   NtUserModifyUserStartupInfoFlags  (1, 0, ... ) == 0x816e5658
 04052   860   NtUserGetDCEx  (0, 0, 3, ... ) == 0x1010051
 04053   860   NtUserGetForegroundWindow  (... ) == 0x70104
 04054   860   NtUserQueryWindow  (459012, 0, ... ) == 0x49c
 04055   860   NtUserQueryWindow  (459012, 1, ... ) == 0x180
 04056   860   NtGdiGetTextCharsetInfo  (16842833, 0, 0, ... ) == 0x0
 04057   860   NtGdiGetRandomRgn  (16842833, -1409022286, 1, ... ) == 0x0
 04058   860   NtGdiIntersectClipRect  (16842833, 0, 0, 612, 738, ... ) == 0x3
 04059   860   NtGdiExtSelectClipRgn  (16842833, 0, 5, ... ) == 0x2
 04060   860   NtGdiGetTextCharsetInfo  (16842833, 0, 0, ... ) == 0x0
 04061   860   NtGdiGetRandomRgn  (16842833, -1392245070, 1, ... ) == 0x0
 04062   860   NtGdiIntersectClipRect  (16842833, 0, 0, 153, 738, ... ) == 0x3
 04063   860   NtGdiExtSelectClipRgn  (16842833, 0, 5, ... ) == 0x2
 04064   860   NtUserCallOneParam  (16842833, 57, ... ) == 0x1
 04065   860   NtUserFindExistingCursorIcon  (1236504, 1236520, 1236568, ... ) == 0x10011
 04066   860   NtUserSetCursor  (65553, ... ) == 0x10015
 04067   860   NtUserCallOneParam  (0, 50, ... ) == 0x1
 04068   860   NtUserFindExistingCursorIcon  (1236456, 1236472, 1236520, ... ) == 0x10015
 04069   860   NtUserSetCursor  (65557, ... ) == 0x10011
 04070   860   NtGdiCreateCompatibleDC  (0, ... ) == 0x750107bb
 04071   860   NtGdiExtGetObjectW  (50987262, 92, 1236744, ... ) == 0x5c
 04072   860   NtGdiHfontCreate  (1236216, 356, 0, 0, 1333024, ... ) == 0x7b0a0798
 04073   860   NtGdiGetTextMetricsW  (1963001787, 1236740, 68, ... ) == 0x1
 04074   860   NtGdiGetWidthTable  (1963001787, 52, 1360992, 308, 1361608, 1360360, 1360376, ... ) == 0x1
 04075   860   NtGdiDeleteObjectApp  (1963001787, ... ) == 0x1
 04076   860   NtUserGetForegroundWindow  (... ) == 0x70104
 04077   860   NtUserQueryWindow  (459012, 0, ... ) == 0x49c
 04078   860   NtUserQueryWindow  (459012, 1, ... ) == 0x180
 04079   860   NtUserGetAtomName  (32770, 1235716, ... ) == 0x6
 04080   860   NtUserCreateWindowEx  (65793, 32770, 32770,  (65793, 32770, 32770, "Error", -2134375995, 425, 345, 182, 107, 0, 0, 2118189056, 0, 1073742848, 0, ... , -2134375995, 425, 345, 182, 107, 0, 0, 2118189056, 0, 1073742848, 0, ...
 04081   860   NtUserSetWindowFNID  (524608, 676, ... ) == 0x1
 04082   860   NtUserCallHwndParam  (524608, 1375824, 79, ... ) == 0x14fe50
 04083   860   NtUserMessageCall  (0x80140, WM_NCCREATE, 0x0, 0x12dab0, 0, 670, 0, ... ) == 0x1
 04084   860   NtUserMessageCall  (0x80140, WM_NCCALCSIZE, 0x0, 0x12dad8, 0, 670, 0, ... ) == 0x0
 04085   860   NtUserGetClassName  (524608, 0, 1234840, ... ) == 0x6
 04086   860   NtUserRemoveProp  (524608, 43282, ... ) == 0x0
 04087   860   NtRequestWaitReplyPort  (24, {24, 52, new_msg, 0, 1245396, 0, 16, 0}  (24, {24, 52, new_msg, 0, 1245396, 0, 16, 0} "\0\0\0\0\5\4\3\0`\10\260\15X\326\22\0\\3\0\0 \326\22\0" ... {24, 52, reply, 0, 464, 860, 58285, 0} "\0\0\0\0\5\4\3\0\0\0\0\0X\326\22\0\\3\0\0\0\0\0\0" )  ... {24, 52, reply, 0, 464, 860, 58285, 0}  (24, {24, 52, new_msg, 0, 1245396, 0, 16, 0} "\0\0\0\0\5\4\3\0`\10\260\15X\326\22\0\\3\0\0 \326\22\0" ... {24, 52, reply, 0, 464, 860, 58285, 0} "\0\0\0\0\5\4\3\0\0\0\0\0X\326\22\0\\3\0\0\0\0\0\0" )  ) == 0x0
 04088   860   NtUserGetThreadDesktop  (860, 0, ... ) == 0x24
 04089   860   NtUserGetObjectInformation  (36, 2, 1234524, 520, 0, ... ) == 0x1
 04090   860   NtUserSetProp  (524608, 43288, 3298104, ... ) == 0x1
 04080   860   NtUserCreateWindowEx  ... ) == 0x80140
 04091   860   NtUserValidateHandleSecure  (524608, ... ) == 0x1
 04092   860   NtUserCallHwndLock  (524608, 90, ... ) == 0x1
 04093   860   NtUserValidateHandleSecure  (524608, ... ) == 0x1
 04094   860   NtUserValidateHandleSecure  (524608, ... ) == 0x1
 04095   860   NtUserGetAtomName  (49175, 1235716, ... ) == 0x6
 04096   860   NtUserCreateWindowEx  (4, 49175, 49175,  (4, 49175, 49175, "OK", 1342373889, 50, 41, 75, 23, 524608, 1, 2118189056, 0, 1073742848, 0, ... , 1342373889, 50, 41, 75, 23, 524608, 1, 2118189056, 0, 1073742848, 0, ...
 04097   860   NtUserSetWindowFNID  (786708, 673, ... ) == 0x1
 04098   860   NtUserSetWindowLong  (786708, 0, 1356788, 0, ... ) == 0x0
 04099   860   NtUserMessageCall  (0xc0114, WM_NCCREATE, 0x0, 0x12dab0, 0, 670, 0, ... ) == 0x1
 04100   860   NtUserMessageCall  (0xc0114, WM_NCCALCSIZE, 0x0, 0x12dad8, 0, 670, 0, ... ) == 0x0
 04101   860   NtUserSetProp  (786708, 43288, -1, ... ) == 0x1
 04096   860   NtUserCreateWindowEx  ... ) == 0xc0114
 04102   860   NtUserValidateHandleSecure  (786708, ... ) == 0x1
 04103   860   NtUserValidateHandleSecure  (786708, ... ) == 0x1
 04104   860   NtUserValidateHandleSecure  (786708, ... ) == 0x1
 04105   860   NtUserValidateHandleSecure  (786708, ... ) == 0x1
 04106   860   NtUserGetAtomName  (49177, 1235716, ... ) == 0x6
 04107   860   NtUserCreateWindowEx  (4, 49177, 49177,  (4, 49177, 49177, "Runtime error 207 at 000071AD", 1342316672, 15, 11, 155, 15, 524608, 65535, 2118189056, 0, 1073742848, 0, ... , 1342316672, 15, 11, 155, 15, 524608, 65535, 2118189056, 0, 1073742848, 0, ...
 04108   860   NtUserSetWindowFNID  (786690, 680, ... ) == 0x1
 04109   860   NtUserSetWindowLong  (786690, 0, 1368952, 0, ... ) == 0x0
 04110   860   NtUserMessageCall  (0xc0102, WM_NCCREATE, 0x0, 0x12dab0, 0, 670, 0, ... ) == 0x1
 04111   860   NtUserMessageCall  (0xc0102, WM_NCCALCSIZE, 0x0, 0x12dad8, 0, 670, 0, ... ) == 0x0
 04112   860   NtUserSetProp  (786690, 43288, -1, ... ) == 0x1
 04107   860   NtUserCreateWindowEx  ... ) == 0xc0102
 04113   860   NtUserValidateHandleSecure  (786690, ... ) == 0x1
 04114   860   NtUserValidateHandleSecure  (786690, ... ) == 0x1
 04115   860   NtUserValidateHandleSecure  (786690, ... ) == 0x1
 04116   860   NtUserValidateHandleSecure  (786690, ... ) == 0x1
 04117   860   NtUserValidateHandleSecure  (524608, ... ) == 0x1
 04118   860   NtUserValidateHandleSecure  (524608, ... ) == 0x1
 04119   860   NtUserValidateHandleSecure  (524608, ... ) == 0x1
 04120   860   NtUserValidateHandleSecure  (524608, ... ) == 0x1
 04121   860   NtUserSetWindowLong  (524608, -21, 1238192, 0, ... ) == 0x0
 04122   860   NtUserCallHwnd  (524608, 73, ... ) == 0xbc66a7f8
 04123   860   NtUserValidateHandleSecure  (524608, ... ) == 0x1
 04124   860   NtUserSetFocus  (786708, ...
 04125   860   NtUserPostThreadMessage  (860, 49313, 17, 786708, ... ) == 0x1
 04126   860   NtUserGetForegroundWindow  (... ) == 0x0
 04127   860   NtOpenKey  (0x2000000, {24, 16, 0x40, 0, 0,  (0x2000000, {24, 16, 0x40, 0, 0, "Software\Microsoft\Windows NT\CurrentVersion\IMM"}, ... 108, ) }, ... 108, ) == 0x0
 04128   860   NtQueryValueKey  (108,  (108, "Ime File", Partial, 144, ... TitleIdx=0, Type=1, Data="m\0s\0c\0t\0f\0i\0m\0e\0.\0i\0m\0e\0\0\0"}, 38, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (108, "Ime File", Partial, 144, ... TitleIdx=0, Type=1, Data="m\0s\0c\0t\0f\0i\0m\0e\0.\0i\0m\0e\0\0\0"}, 38, ) }, 38, ) == 0x0
 04129   860   NtClose  (108, ... ) == 0x0
 04130   860   NtQueryInformationProcess  (-1, DefaultHardErrorMode, 4, ... {process info, class 12, size 4}, 0x0, ) == 0x0
 04131   860   NtSetInformationProcess  (-1, DefaultHardErrorMode, {process info, class 12, size 4}, 4, ... ) == 0x0
 04132   860   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\msctfime.ime"}, 1232824, ... ) }, 1232824, ... ) == 0x0
 04133   860   NtOpenFile  (0x100020, {24, 0, 0x40, 0, 0,  (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\msctfime.ime"}, 5, 96, ... 108, {status=0x0, info=1}, ) }, 5, 96, ... 108, {status=0x0, info=1}, ) == 0x0
 04134   860   NtCreateSection  (0xe, 0x0, 0x0, 16, 134217728, 108, ... 176, ) == 0x0
 04135   860   NtClose  (108, ... ) == 0x0
 04136   860   NtMapViewOfSection  (176, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 16, ... (0x3d0000), 0x0, 180224, ) == 0x0
 04137   860   NtClose  (176, ... ) == 0x0
 04138   860   NtUnmapViewOfSection  (-1, 0x3d0000, ... ) == 0x0
 04139   860   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\msctfime.ime"}, 1232420, ... ) }, 1232420, ... ) == 0x0
 04140   860   NtCreateFile  (0x80100080, {24, 0, 0x40, 0, 1233164,  (0x80100080, {24, 0, 0x40, 0, 1233164, "\??\C:\WINDOWS\system32\msctfime.ime"}, 0x0, 0, 5, 1, 96, 0, 0, ... 176, {status=0x0, info=1}, ) }, 0x0, 0, 5, 1, 96, 0, 0, ... 176, {status=0x0, info=1}, ) == 0x0
 04141   860   NtCreateSection  (0xf0005, 0x0, 0x0, 2, 134217728, 176, ... 108, ) == 0x0
 04142   860   NtClose  (176, ... ) == 0x0
 04143   860   NtMapViewOfSection  (108, -1, (0x0), 0, 0, {0, 0}, 0, 1, 0, 2, ... (0x3d0000), {0, 0}, 180224, ) == 0x0
 04144   860   NtClose  (108, ... ) == 0x0
 04145   860   NtQueryInformationProcess  (-1, DefaultHardErrorMode, 4, ... {process info, class 12, size 4}, 0x0, ) == 0x0
 04146   860   NtSetInformationProcess  (-1, DefaultHardErrorMode, {process info, class 12, size 4}, 4, ... ) == 0x0
 04147   860   NtQueryDefaultLocale  (1, 1233784, ... ) == 0x0
 04148   860   NtQueryVirtualMemory  (-1, 0x3d0000, Basic, 28, ... {BaseAddress=0x3d0000,AllocationBase=0x3d0000,AllocationProtect=0x2,RegionSize=0x2c000,State=0x1000,Protect=0x2,Type=0x40000,}, 0x0, ) == 0x0
 04149   860   NtQueryVirtualMemory  (-1, 0x3d0000, Basic, 28, ... {BaseAddress=0x3d0000,AllocationBase=0x3d0000,AllocationProtect=0x2,RegionSize=0x2c000,State=0x1000,Protect=0x2,Type=0x40000,}, 0x0, ) == 0x0
 04150   860   NtUnmapViewOfSection  (-1, 0x3d0000, ... ) == 0x0
 04151   860   NtQueryInformationProcess  (-1, DefaultHardErrorMode, 4, ... {process info, class 12, size 4}, 0x0, ) == 0x0
 04152   860   NtSetInformationProcess  (-1, DefaultHardErrorMode, {process info, class 12, size 4}, 4, ... ) == 0x0
 04153   860   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\msctfime.ime"}, 1232816, ... ) }, 1232816, ... ) == 0x0
 04154   860   NtOpenFile  (0x100020, {24, 0, 0x40, 0, 0,  (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\msctfime.ime"}, 5, 96, ... 108, {status=0x0, info=1}, ) }, 5, 96, ... 108, {status=0x0, info=1}, ) == 0x0
 04155   860   NtCreateSection  (0xe, 0x0, 0x0, 16, 134217728, 108, ... 176, ) == 0x0
 04156   860   NtClose  (108, ... ) == 0x0
 04157   860   NtMapViewOfSection  (176, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 16, ... (0x3d0000), 0x0, 180224, ) == 0x0
 04158   860   NtClose  (176, ... ) == 0x0
 04159   860   NtUnmapViewOfSection  (-1, 0x3d0000, ... ) == 0x0
 04160   860   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\msctfime.ime"}, 1232412, ... ) }, 1232412, ... ) == 0x0
 04161   860   NtCreateFile  (0x80100080, {24, 0, 0x40, 0, 1233156,  (0x80100080, {24, 0, 0x40, 0, 1233156, "\??\C:\WINDOWS\system32\msctfime.ime"}, 0x0, 0, 5, 1, 96, 0, 0, ... 176, {status=0x0, info=1}, ) }, 0x0, 0, 5, 1, 96, 0, 0, ... 176, {status=0x0, info=1}, ) == 0x0
 04162   860   NtCreateSection  (0xf0005, 0x0, 0x0, 2, 134217728, 176, ... 108, ) == 0x0
 04163   860   NtClose  (176, ... ) == 0x0
 04164   860   NtMapViewOfSection  (108, -1, (0x0), 0, 0, {0, 0}, 0, 1, 0, 2, ... (0x3d0000), {0, 0}, 180224, ) == 0x0
 04165   860   NtClose  (108, ... ) == 0x0
 04166   860   NtQueryInformationProcess  (-1, DefaultHardErrorMode, 4, ... {process info, class 12, size 4}, 0x0, ) == 0x0
 04167   860   NtSetInformationProcess  (-1, DefaultHardErrorMode, {process info, class 12, size 4}, 4, ... ) == 0x0
 04168   860   NtQueryDefaultLocale  (1, 1233776, ... ) == 0x0
 04169   860   NtQueryVirtualMemory  (-1, 0x3d0000, Basic, 28, ... {BaseAddress=0x3d0000,AllocationBase=0x3d0000,AllocationProtect=0x2,RegionSize=0x2c000,State=0x1000,Protect=0x2,Type=0x40000,}, 0x0, ) == 0x0
 04170   860   NtUnmapViewOfSection  (-1, 0x3d0000, ... ) == 0x0
 04171   860   NtWaitForSingleObject  (184, 0, {-1000000, -1}, ... ) == 0x0
 04172   860   NtOpenThreadTokenEx  (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN
 04173   860   NtOpenProcessTokenEx  (-1, 0x20008, 512, ... 108, ) == 0x0
 04174   860   NtQueryInformationToken  (108, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0
 04175   860   NtClose  (108, ... ) == 0x0
 04176   860   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\REGISTRY\USER\S-1-5-21-1292428093-1383384898-725345543-1003\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Layers"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 04177   860   NtReleaseMutant  (184, ... 0x0, ) == 0x0
 04178   860   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\msctfime.ime"}, 1232796, ... ) }, 1232796, ... ) == 0x0
 04179   860   NtOpenFile  (0x100020, {24, 0, 0x40, 0, 0,  (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\msctfime.ime"}, 5, 96, ... 108, {status=0x0, info=1}, ) }, 5, 96, ... 108, {status=0x0, info=1}, ) == 0x0
 04180   860   NtCreateSection  (0xe, 0x0, 0x0, 16, 134217728, 108, ... 176, ) == 0x0
 04181   860   NtClose  (108, ... ) == 0x0
 04182   860   NtMapViewOfSection  (176, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 16, ... (0x3d0000), 0x0, 180224, ) == 0x0
 04183   860   NtClose  (176, ... ) == 0x0
 04184   860   NtUnmapViewOfSection  (-1, 0x3d0000, ... ) == 0x0
 04185   860   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\msctfime.ime"}, 1233104, ... ) }, 1233104, ... ) == 0x0
 04186   860   NtOpenFile  (0x100020, {24, 0, 0x40, 0, 0,  (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\msctfime.ime"}, 5, 96, ... 176, {status=0x0, info=1}, ) }, 5, 96, ... 176, {status=0x0, info=1}, ) == 0x0
 04187   860   NtCreateSection  (0xf, 0x0, 0x0, 16, 16777216, 176, ... 108, ) == 0x0
 04188   860   NtQuerySection  (108, Image, 48, ... {section info, class 1, size 48}, 0x0, ) == 0x0
 04189   860   NtClose  (176, ... ) == 0x0
 04190   860   NtMapViewOfSection  (108, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x755c0000), 0x0, 188416, ) == 0x0
 04191   860   NtClose  (108, ... ) == 0x0
 04192   860   NtProtectVirtualMemory  (-1, (0x755c1000), 860, 4, ... (0x755c1000), 4096, 32, ) == 0x0
 04193   860   NtProtectVirtualMemory  (-1, (0x755c1000), 4096, 32, ... (0x755c1000), 4096, 4, ) == 0x0
 04194   860   NtFlushInstructionCache  (-1, 1968967680, 860, ... ) == 0x0
 04195   860   NtProtectVirtualMemory  (-1, (0x755c1000), 860, 4, ... (0x755c1000), 4096, 32, ) == 0x0
 04196   860   NtProtectVirtualMemory  (-1, (0x755c1000), 4096, 32, ... (0x755c1000), 4096, 4, ) == 0x0
 04197   860   NtFlushInstructionCache  (-1, 1968967680, 860, ... ) == 0x0
 04198   860   NtProtectVirtualMemory  (-1, (0x755c1000), 860, 4, ... (0x755c1000), 4096, 32, ) == 0x0
 04199   860   NtProtectVirtualMemory  (-1, (0x755c1000), 4096, 32, ... (0x755c1000), 4096, 4, ) == 0x0
 04200   860   NtFlushInstructionCache  (-1, 1968967680, 860, ... ) == 0x0
 04201   860   NtProtectVirtualMemory  (-1, (0x755c1000), 860, 4, ... (0x755c1000), 4096, 32, ) == 0x0
 04202   860   NtProtectVirtualMemory  (-1, (0x755c1000), 4096, 32, ... (0x755c1000), 4096, 4, ) == 0x0
 04203   860   NtFlushInstructionCache  (-1, 1968967680, 860, ... ) == 0x0
 04204   860   NtProtectVirtualMemory  (-1, (0x755c1000), 860, 4, ... (0x755c1000), 4096, 32, ) == 0x0
 04205   860   NtProtectVirtualMemory  (-1, (0x755c1000), 4096, 32, ... (0x755c1000), 4096, 4, ) == 0x0
 04206   860   NtFlushInstructionCache  (-1, 1968967680, 860, ... ) == 0x0
 04207   860   NtProtectVirtualMemory  (-1, (0x755c1000), 860, 4, ... (0x755c1000), 4096, 32, ) == 0x0
 04208   860   NtProtectVirtualMemory  (-1, (0x755c1000), 4096, 32, ... (0x755c1000), 4096, 4, ) == 0x0
 04209   860   NtFlushInstructionCache  (-1, 1968967680, 860, ... ) == 0x0
 04210   860   NtOpenKey  (0x80000000, {24, 0, 0x40, 0, 0,  (0x80000000, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msctfime.ime"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 04211   860   NtUserGetDC  (0, ... ) == 0x1010051
 04212   860   NtUserSystemParametersInfo  (66, 12, 1233292, 0, ... ) == 0x1
 04213   860   NtUserCallOneParam  (16842833, 57, ... ) == 0x1
 04214   860   NtQueryDebugFilterState  (87, 3, ... ) == 0x0
 04215   860   NtQueryDebugFilterState  (87, 3, ... ) == 0x0
 04216   860   NtContinue  (1231496, 0, ...
 04217   860   NtQueryDebugFilterState  (87, 3, ... ) == 0x0
 04218   860   NtUnmapViewOfSection  (-1, 0x755c0000, ... ) == 0x0
 04219   860   NtQueryDebugFilterState  (87, 3, ... ) == 0x0
 04220   860   NtUserMessageCall  (0x80140, WM_NCACTIVATE, 0x1, 0xffffffff, 0, 670, 0, ... ) == 0x1
 04221   860   NtUserInternalGetWindowText  (0x80140, 260, ...  (0x80140, 260, ... "Error", ) , ) == 0x5
 04222   860   NtUserGetWindowDC  (524608, ... ) == 0x1010053
 04223   860   NtGdiGetTextMetricsW  (16842835, 1234724, 68, ... ) == 0x1
 04224   860   NtGdiGetRandomRgn  (16842835, -1375467854, 1, ... ) == 0x0
 04225   860   NtGdiIntersectClipRect  (16842835, 0, 0, 0, 0, ... ) == 0x3
 04226   860   NtGdiGetWidthTable  (16842835, 5, 1361952, 261, 1362474, 1361320, 1361336, ... ) == 0x1
 04227   860   NtGdiExtSelectClipRgn  (16842835, 0, 5, ... ) == 0x1
 04228   860   NtUserCallOneParam  (16842835, 57, ... ) == 0x1
 04229   860   NtUserCalcMenuBar  (524608, 3, 3, 29, 3298288, ... ) == 0x0
 04230   860   NtUserMessageCall  (0x80140, WM_GETICON, 0x2, 0x0, 1234684, 690, 0, ...
 04231   860   NtUserMessageCall  (0x80140, WM_GETICON, 0x2, 0x0, 0, 670, 0, ... ) == 0x0
 04230   860   NtUserMessageCall  ... ) == 0x0
 04232   860   NtUserMessageCall  (0x80140, WM_GETICON, 0x0, 0x0, 1234684, 690, 0, ...
 04233   860   NtUserMessageCall  (0x80140, WM_GETICON, 0x0, 0x0, 0, 670, 0, ... ) == 0x0
 04232   860   NtUserMessageCall  ... ) == 0x0
 04234   860   NtUserMessageCall  (0x80140, WM_GETICON, 0x1, 0x0, 1234684, 690, 0, ...
 04235   860   NtUserMessageCall  (0x80140, WM_GETICON, 0x1, 0x0, 0, 670, 0, ... ) == 0x0
 04234   860   NtUserMessageCall  ... ) == 0x0
 04236   860   NtUserGetTitleBarInfo  (524608, 1235316, ... ) == 0x1
 04237   860   NtUserGetDCEx  (524608, 0, 66561, ... ) == 0x1010050
 04238   860   NtGdiExcludeClipRect  (16842832, 3, 29, 179, 104, ... ) == 0x3
 04239   860   NtQueryVirtualMemory  (-1, 0x7e41b3b0, Basic, 28, ... {BaseAddress=0x7e41b000,AllocationBase=0x7e410000,AllocationProtect=0x80,RegionSize=0x55000,State=0x1000,Protect=0x20,Type=0x1000000,}, 28, ) == 0x0
 04240   860   NtQueryVirtualMemory  (-1, 0x7e423768, Basic, 28, ... {BaseAddress=0x7e423000,AllocationBase=0x7e410000,AllocationProtect=0x80,RegionSize=0x4d000,State=0x1000,Protect=0x20,Type=0x1000000,}, 28, ) == 0x0
 04241   860   NtQueryVirtualMemory  (-1, 0x3a3294, Basic, 28, ... {BaseAddress=0x3a3000,AllocationBase=0x3a0000,AllocationProtect=0x40,RegionSize=0x2d000,State=0x1000,Protect=0x40,Type=0x20000,}, 28, ) == 0x0
 04242   860   NtQueryInformationProcess  (-1, DebugPort, 4, ... {process info, class 7, size 4}, 0x0, ) == 0x0
 04243   860   NtQueryInformationProcess  (-1, 36, 4, ... {process info, class 36, size 4}, 0x0, ) == 0x0
 04244   860   NtQueryVirtualMemory  (-1, 0x77c2807c, Basic, 28, ... {BaseAddress=0x77c28000,AllocationBase=0x77c10000,AllocationProtect=0x80,RegionSize=0x35000,State=0x1000,Protect=0x20,Type=0x1000000,}, 28, ) == 0x0
 04245   860   NtQueryInformationProcess  (-1, DefaultHardErrorMode, 4, ... {process info, class 12, size 4}, 0x0, ) == 0x0
 04246   860   NtQueryInformationJobObject  (0, BasicLimit, 48, ... ) == STATUS_ACCESS_DENIED
 04247   860   NtOpenKey  (0x1, {24, 0, 0x40, 0, 0,  (0x1, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\AeDebug"}, ... 108, ) }, ... 108, ) == 0x0
 04248   860   NtQueryValueKey  (108,  (108, "Auto", Partial, 526, ... TitleIdx=0, Type=1, Data="0\0\0\0"}, 16, ) , Partial, 526, ... TitleIdx=0, Type=1, Data= (108, "Auto", Partial, 526, ... TitleIdx=0, Type=1, Data="0\0\0\0"}, 16, ) }, 16, ) == 0x0
 04249   860   NtQueryValueKey  (108,  (108, "Debugger", Partial, 526, ... TitleIdx=0, Type=1, Data=""\0C\0:\0\\0P\0r\0o\0g\0r\0a\0m\0 \0F\0i\0l\0e\0s\0\\0M\0i\0c\0r\0o\0s\0o\0f\0t\0 \0V\0i\0s\0u\0a\0l\0 \0S\0t\0u\0d\0i\0o\0\\0C\0o\0m\0m\0o\0n\0\\0M\0S\0D\0e\0v\09\08\0\\0B\0i\0n\0\\0m\0s\0d\0e\0v\0.\0e\0x\0e\0"\0 \0-\0p\0 \0%\0l\0d\0 \0-\0e\0 \0%\0l\0d\0\0\0"}, 184, ) , Partial, 526, ... TitleIdx=0, Type=1, Data=" (108, "Debugger", Partial, 526, ... TitleIdx=0, Type=1, Data=""\0C\0:\0\\0P\0r\0o\0g\0r\0a\0m\0 \0F\0i\0l\0e\0s\0\\0M\0i\0c\0r\0o\0s\0o\0f\0t\0 \0V\0i\0s\0u\0a\0l\0 \0S\0t\0u\0d\0i\0o\0\\0C\0o\0m\0m\0o\0n\0\\0M\0S\0D\0e\0v\09\08\0\\0B\0i\0n\0\\0m\0s\0d\0e\0v\0.\0e\0x\0e\0"\0 \0-\0p\0 \0%\0l\0d\0 \0-\0e\0 \0%\0l\0d\0\0\0"}, 184, ) \0 \0-\0p\0 \0%\0l\0d\0 \0-\0e\0 \0%\0l\0d\0\0\0"}, 184, ) == 0x0
 04250   860   NtClose  (108, ... ) == 0x0
 04251   860   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\faultrep.dll"}, 1230372, ... ) }, 1230372, ... ) == 0x0
 04252   860   NtOpenFile  (0x100020, {24, 0, 0x40, 0, 0,  (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\faultrep.dll"}, 5, 96, ... 108, {status=0x0, info=1}, ) }, 5, 96, ... 108, {status=0x0, info=1}, ) == 0x0
 04253   860   NtCreateSection  (0xe, 0x0, 0x0, 16, 134217728, 108, ... 176, ) == 0x0
 04254   860   NtClose  (108, ... ) == 0x0
 04255   860   NtMapViewOfSection  (176, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 16, ... (0x3d0000), 0x0, 81920, ) == 0x0
 04256   860   NtClose  (176, ... ) == 0x0
 04257   860   NtUnmapViewOfSection  (-1, 0x3d0000, ... ) == 0x0
 04258   860   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\faultrep.dll"}, 1230680, ... ) }, 1230680, ... ) == 0x0
 04259   860   NtOpenFile  (0x100020, {24, 0, 0x40, 0, 0,  (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\faultrep.dll"}, 5, 96, ... 176, {status=0x0, info=1}, ) }, 5, 96, ... 176, {status=0x0, info=1}, ) == 0x0
 04260   860   NtCreateSection  (0xf, 0x0, 0x0, 16, 16777216, 176, ... 108, ) == 0x0
 04261   860   NtQuerySection  (108, Image, 48, ... {section info, class 1, size 48}, 0x0, ) == 0x0
 04262   860   NtClose  (176, ... ) == 0x0
 04263   860   NtMapViewOfSection  (108, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x69450000), 0x0, 90112, ) == 0x0
 04264   860   NtClose  (108, ... ) == 0x0
 04265   860   NtOpenSection  (0xe, {24, 8, 0x40, 0, 0,  (0xe, {24, 8, 0x40, 0, 0, "USERENV.dll"}, ... 108, ) }, ... 108, ) == 0x0
 04266   860   NtMapViewOfSection  (108, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x769c0000), 0x0, 733184, ) == 0x0
 04267   860   NtClose  (108, ... ) == 0x0
 04268   860   NtProtectVirtualMemory  (-1, (0x769c1000), 1244, 4, ... (0x769c1000), 4096, 32, ) == 0x0
 04269   860   NtProtectVirtualMemory  (-1, (0x769c1000), 4096, 32, ... (0x769c1000), 4096, 4, ) == 0x0
 04270   860   NtFlushInstructionCache  (-1, 1989939200, 1244, ... ) == 0x0
 04271   860   NtProtectVirtualMemory  (-1, (0x769c1000), 1244, 4, ... (0x769c1000), 4096, 32, ) == 0x0
 04272   860   NtProtectVirtualMemory  (-1, (0x769c1000), 4096, 32, ... (0x769c1000), 4096, 4, ) == 0x0
 04273   860   NtFlushInstructionCache  (-1, 1989939200, 1244, ... ) == 0x0
 04274   860   NtProtectVirtualMemory  (-1, (0x769c1000), 1244, 4, ... (0x769c1000), 4096, 32, ) == 0x0
 04275   860   NtProtectVirtualMemory  (-1, (0x769c1000), 4096, 32, ... (0x769c1000), 4096, 4, ) == 0x0
 04276   860   NtFlushInstructionCache  (-1, 1989939200, 1244, ... ) == 0x0
 04277   860   NtProtectVirtualMemory  (-1, (0x769c1000), 1244, 4, ... (0x769c1000), 4096, 32, ) == 0x0
 04278   860   NtProtectVirtualMemory  (-1, (0x769c1000), 4096, 32, ... (0x769c1000), 4096, 4, ) == 0x0
 04279   860   NtFlushInstructionCache  (-1, 1989939200, 1244, ... ) == 0x0
 04280   860   NtOpenSection  (0xe, {24, 8, 0x40, 0, 0,  (0xe, {24, 8, 0x40, 0, 0, "WINSTA.dll"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 04281   860   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\u:\work\WINSTA.dll"}, 1229856, ... ) }, 1229856, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 04282   860   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\WINSTA.dll"}, 1229856, ... ) }, 1229856, ... ) == 0x0
 04283   860   NtOpenFile  (0x100020, {24, 0, 0x40, 0, 0,  (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\WINSTA.dll"}, 5, 96, ... 108, {status=0x0, info=1}, ) }, 5, 96, ... 108, {status=0x0, info=1}, ) == 0x0
 04284   860   NtCreateSection  (0xf, 0x0, 0x0, 16, 16777216, 108, ... 176, ) == 0x0
 04285   860   NtQuerySection  (176, Image, 48, ... {section info, class 1, size 48}, 0x0, ) == 0x0
 04286   860   NtClose  (108, ... ) == 0x0
 04287   860   NtMapViewOfSection  (176, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x76360000), 0x0, 65536, ) == 0x0
 04288   860   NtClose  (176, ... ) == 0x0
 04289   860   NtProtectVirtualMemory  (-1, (0x76361000), 212, 4, ... (0x76361000), 4096, 32, ) == 0x0
 04290   860   NtProtectVirtualMemory  (-1, (0x76361000), 4096, 32, ... (0x76361000), 4096, 4, ) == 0x0
 04291   860   NtFlushInstructionCache  (-1, 1983254528, 212, ... ) == 0x0
 04292   860   NtProtectVirtualMemory  (-1, (0x76361000), 212, 4, ... (0x76361000), 4096, 32, ) == 0x0
 04293   860   NtProtectVirtualMemory  (-1, (0x76361000), 4096, 32, ... (0x76361000), 4096, 4, ) == 0x0
 04294   860   NtFlushInstructionCache  (-1, 1983254528, 212, ... ) == 0x0
 04295   860   NtOpenSection  (0xe, {24, 8, 0x40, 0, 0,  (0xe, {24, 8, 0x40, 0, 0, "NETAPI32.dll"}, ... 176, ) }, ... 176, ) == 0x0
 04296   860   NtMapViewOfSection  (176, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x5b860000), 0x0, 344064, ) == 0x0
 04297   860   NtClose  (176, ... ) == 0x0
 04298   860   NtProtectVirtualMemory  (-1, (0x5b861000), 1168, 4, ... (0x5b861000), 4096, 32, ) == 0x0
 04299   860   NtProtectVirtualMemory  (-1, (0x5b861000), 4096, 32, ... (0x5b861000), 4096, 4, ) == 0x0
 04300   860   NtFlushInstructionCache  (-1, 1535512576, 1168, ... ) == 0x0
 04301   860   NtProtectVirtualMemory  (-1, (0x5b861000), 1168, 4, ... (0x5b861000), 4096, 32, ) == 0x0
 04302   860   NtProtectVirtualMemory  (-1, (0x5b861000), 4096, 32, ... (0x5b861000), 4096, 4, ) == 0x0
 04303   860   NtFlushInstructionCache  (-1, 1535512576, 1168, ... ) == 0x0
 04304   860   NtProtectVirtualMemory  (-1, (0x5b861000), 1168, 4, ... (0x5b861000), 4096, 32, ) == 0x0
 04305   860   NtProtectVirtualMemory  (-1, (0x5b861000), 4096, 32, ... (0x5b861000), 4096, 4, ) == 0x0
 04306   860   NtFlushInstructionCache  (-1, 1535512576, 1168, ... ) == 0x0
 04307   860   NtProtectVirtualMemory  (-1, (0x5b861000), 1168, 4, ... (0x5b861000), 4096, 32, ) == 0x0
 04308   860   NtProtectVirtualMemory  (-1, (0x5b861000), 4096, 32, ... (0x5b861000), 4096, 4, ) == 0x0
 04309   860   NtFlushInstructionCache  (-1, 1535512576, 1168, ... ) == 0x0
 04310   860   NtProtectVirtualMemory  (-1, (0x5b861000), 1168, 4, ... (0x5b861000), 4096, 32, ) == 0x0
 04311   860   NtProtectVirtualMemory  (-1, (0x5b861000), 4096, 32, ... (0x5b861000), 4096, 4, ) == 0x0
 04312   860   NtFlushInstructionCache  (-1, 1535512576, 1168, ... ) == 0x0
 04313   860   NtProtectVirtualMemory  (-1, (0x76361000), 212, 4, ... (0x76361000), 4096, 32, ) == 0x0
 04314   860   NtProtectVirtualMemory  (-1, (0x76361000), 4096, 32, ... (0x76361000), 4096, 4, ) == 0x0
 04315   860   NtFlushInstructionCache  (-1, 1983254528, 212, ... ) == 0x0
 04316   860   NtProtectVirtualMemory  (-1, (0x76361000), 212, 4, ... (0x76361000), 4096, 32, ) == 0x0
 04317   860   NtProtectVirtualMemory  (-1, (0x76361000), 4096, 32, ... (0x76361000), 4096, 4, ) == 0x0
 04318   860   NtFlushInstructionCache  (-1, 1983254528, 212, ... ) == 0x0
 04319   860   NtOpenSection  (0xe, {24, 8, 0x40, 0, 0,  (0xe, {24, 8, 0x40, 0, 0, "WTSAPI32.dll"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 04320   860   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\u:\work\WTSAPI32.dll"}, 1229856, ... ) }, 1229856, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 04321   860   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\WTSAPI32.dll"}, 1229856, ... ) }, 1229856, ... ) == 0x0
 04322   860   NtOpenFile  (0x100020, {24, 0, 0x40, 0, 0,  (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\WTSAPI32.dll"}, 5, 96, ... 176, {status=0x0, info=1}, ) }, 5, 96, ... 176, {status=0x0, info=1}, ) == 0x0
 04323   860   NtCreateSection  (0xf, 0x0, 0x0, 16, 16777216, 176, ... 108, ) == 0x0
 04324   860   NtQuerySection  (108, Image, 48, ... {section info, class 1, size 48}, 0x0, ) == 0x0
 04325   860   NtClose  (176, ... ) == 0x0
 04326   860   NtMapViewOfSection  (108, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x76f50000), 0x0, 32768, ) == 0x0
 04327   860   NtClose  (108, ... ) == 0x0
 04328   860   NtProtectVirtualMemory  (-1, (0x76f51000), 332, 4, ... (0x76f51000), 4096, 32, ) == 0x0
 04329   860   NtProtectVirtualMemory  (-1, (0x76f51000), 4096, 32, ... (0x76f51000), 4096, 4, ) == 0x0
 04330   860   NtFlushInstructionCache  (-1, 1995771904, 332, ... ) == 0x0
 04331   860   NtProtectVirtualMemory  (-1, (0x76f51000), 332, 4, ... (0x76f51000), 4096, 32, ) == 0x0
 04332   860   NtProtectVirtualMemory  (-1, (0x76f51000), 4096, 32, ... (0x76f51000), 4096, 4, ) == 0x0
 04333   860   NtFlushInstructionCache  (-1, 1995771904, 332, ... ) == 0x0
 04334   860   NtProtectVirtualMemory  (-1, (0x76f51000), 332, 4, ... (0x76f51000), 4096, 32, ) == 0x0
 04335   860   NtProtectVirtualMemory  (-1, (0x76f51000), 4096, 32, ... (0x76f51000), 4096, 4, ) == 0x0
 04336   860   NtFlushInstructionCache  (-1, 1995771904, 332, ... ) == 0x0
 04337   860   NtProtectVirtualMemory  (-1, (0x76f51000), 332, 4, ... (0x76f51000), 4096, 32, ) == 0x0
 04338   860   NtProtectVirtualMemory  (-1, (0x76f51000), 4096, 32, ... (0x76f51000), 4096, 4, ) == 0x0
 04339   860   NtFlushInstructionCache  (-1, 1995771904, 332, ... ) == 0x0
 04340   860   NtOpenSection  (0xe, {24, 8, 0x40, 0, 0,  (0xe, {24, 8, 0x40, 0, 0, "SETUPAPI.dll"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 04341   860   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\u:\work\SETUPAPI.dll"}, 1229856, ... ) }, 1229856, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 04342   860   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\SETUPAPI.dll"}, 1229856, ... ) }, 1229856, ... ) == 0x0
 04343   860   NtOpenFile  (0x100020, {24, 0, 0x40, 0, 0,  (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\SETUPAPI.dll"}, 5, 96, ... 108, {status=0x0, info=1}, ) }, 5, 96, ... 108, {status=0x0, info=1}, ) == 0x0
 04344   860   NtCreateSection  (0xf, 0x0, 0x0, 16, 16777216, 108, ... 176, ) == 0x0
 04345   860   NtQuerySection  (176, Image, 48, ... {section info, class 1, size 48}, 0x0, ) == 0x0
 04346   860   NtClose  (108, ... ) == 0x0
 04347   860   NtMapViewOfSection  (176, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x77920000), 0x0, 995328, ) == 0x0
 04348   860   NtClose  (176, ... ) == 0x0
 04349   860   NtProtectVirtualMemory  (-1, (0x77921000), 1368, 4, ... (0x77921000), 4096, 32, ) == 0x0
 04350   860   NtProtectVirtualMemory  (-1, (0x77921000), 4096, 32, ... (0x77921000), 4096, 4, ) == 0x0
 04351   860   NtFlushInstructionCache  (-1, 2006061056, 1368, ... ) == 0x0
 04352   860   NtProtectVirtualMemory  (-1, (0x77921000), 1368, 4, ... (0x77921000), 4096, 32, ) == 0x0
 04353   860   NtProtectVirtualMemory  (-1, (0x77921000), 4096, 32, ... (0x77921000), 4096, 4, ) == 0x0
 04354   860   NtFlushInstructionCache  (-1, 2006061056, 1368, ... ) == 0x0
 04355   860   NtProtectVirtualMemory  (-1, (0x77921000), 1368, 4, ... (0x77921000), 4096, 32, ) == 0x0
 04356   860   NtProtectVirtualMemory  (-1, (0x77921000), 4096, 32, ... (0x77921000), 4096, 4, ) == 0x0
 04357   860   NtFlushInstructionCache  (-1, 2006061056, 1368, ... ) == 0x0
 04358   860   NtProtectVirtualMemory  (-1, (0x77921000), 1368, 4, ... (0x77921000), 4096, 32, ) == 0x0
 04359   860   NtProtectVirtualMemory  (-1, (0x77921000), 4096, 32, ... (0x77921000), 4096, 4, ) == 0x0
 04360   860   NtFlushInstructionCache  (-1, 2006061056, 1368, ... ) == 0x0
 04361   860   NtProtectVirtualMemory  (-1, (0x77921000), 1368, 4, ... (0x77921000), 4096, 32, ) == 0x0
 04362   860   NtProtectVirtualMemory  (-1, (0x77921000), 4096, 32, ... (0x77921000), 4096, 4, ) == 0x0
 04363   860   NtFlushInstructionCache  (-1, 2006061056, 1368, ... ) == 0x0
 04364   860   NtProtectVirtualMemory  (-1, (0x69451000), 736, 4, ... (0x69451000), 4096, 32, ) == 0x0
 04365   860   NtProtectVirtualMemory  (-1, (0x69451000), 4096, 32, ... (0x69451000), 4096, 4, ) == 0x0
 04366   860   NtFlushInstructionCache  (-1, 1766133760, 736, ... ) == 0x0
 04367   860   NtProtectVirtualMemory  (-1, (0x69451000), 736, 4, ... (0x69451000), 4096, 32, ) == 0x0
 04368   860   NtProtectVirtualMemory  (-1, (0x69451000), 4096, 32, ... (0x69451000), 4096, 4, ) == 0x0
 04369   860   NtFlushInstructionCache  (-1, 1766133760, 736, ... ) == 0x0
 04370   860   NtProtectVirtualMemory  (-1, (0x69451000), 736, 4, ... (0x69451000), 4096, 32, ) == 0x0
 04371   860   NtProtectVirtualMemory  (-1, (0x69451000), 4096, 32, ... (0x69451000), 4096, 4, ) == 0x0
 04372   860   NtFlushInstructionCache  (-1, 1766133760, 736, ... ) == 0x0
 04373   860   NtOpenKey  (0x80000000, {24, 0, 0x40, 0, 0,  (0x80000000, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\USERENV.dll"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 04374   860   NtOpenKey  (0x2000000, {24, 16, 0x40, 0, 0,  (0x2000000, {24, 16, 0x40, 0, 0, "Software\Microsoft\Windows NT\CurrentVersion\winlogon"}, ... 176, ) }, ... 176, ) == 0x0
 04375   860   NtQueryValueKey  (176,  (176, "UserEnvDebugLevel", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 04376   860   NtClose  (176, ... ) == 0x0
 04377   860   NtOpenKey  (0x2000000, {24, 16, 0x40, 0, 0,  (0x2000000, {24, 16, 0x40, 0, 0, "Software\Microsoft\Windows NT\CurrentVersion\winlogon"}, ... 176, ) }, ... 176, ) == 0x0
 04378   860   NtQueryValueKey  (176,  (176, "ChkAccDebugLevel", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 04379   860   NtClose  (176, ... ) == 0x0
 04380   860   NtOpenKey  (0x20019, {24, 16, 0x40, 0, 0,  (0x20019, {24, 16, 0x40, 0, 0, "System\CurrentControlSet\Control\ProductOptions"}, ... 176, ) }, ... 176, ) == 0x0
 04381   860   NtQueryValueKey  (176,  (176, "ProductType", Partial, 144, ... TitleIdx=0, Type=1, Data="W\0i\0n\0N\0T\0\0\0"}, 24, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (176, "ProductType", Partial, 144, ... TitleIdx=0, Type=1, Data="W\0i\0n\0N\0T\0\0\0"}, 24, ) }, 24, ) == 0x0
 04382   860   NtClose  (176, ... ) == 0x0
 04383   860   NtCreateEvent  (0x1f0003, {24, 48, 0x80, 1228448, 0,  (0x1f0003, {24, 48, 0x80, 1228448, 0, "Global\userenv:  User Profile setup event"}, 0, 1, ... 176, ) }, 0, 1, ... 176, ) == STATUS_OBJECT_NAME_EXISTS
 04384   860   NtQueryDefaultLocale  (1, 1228200, ... ) == 0x0
 04385   860   NtQueryDefaultLocale  (1, 1228200, ... ) == 0x0
 04386   860   NtQueryDefaultLocale  (1, 1228200, ... ) == 0x0
 04387   860   NtQueryDefaultLocale  (1, 1228200, ... ) == 0x0
 04388   860   NtQueryDefaultLocale  (1, 1228200, ... ) == 0x0
 04389   860   NtQueryDefaultLocale  (1, 1228200, ... ) == 0x0
 04390   860   NtQueryDefaultLocale  (1, 1228200, ... ) == 0x0
 04391   860   NtQueryDefaultLocale  (1, 1228200, ... ) == 0x0
 04392   860   NtQueryDefaultLocale  (1, 1228200, ... ) == 0x0
 04393   860   NtQueryDefaultLocale  (1, 1228200, ... ) == 0x0
 04394   860   NtQueryDefaultLocale  (1, 1228200, ... ) == 0x0
 04395   860   NtQueryDefaultLocale  (1, 1228200, ... ) == 0x0
 04396   860   NtQueryDefaultLocale  (1, 1228200, ... ) == 0x0
 04397   860   NtQueryDefaultLocale  (1, 1228200, ... ) == 0x0
 04398   860   NtQueryDefaultLocale  (1, 1228200, ... ) == 0x0
 04399   860   NtQueryDefaultLocale  (1, 1228200, ... ) == 0x0
 04400   860   NtQueryDefaultLocale  (1, 1228200, ... ) == 0x0
 04401   860   NtQueryDefaultLocale  (1, 1228200, ... ) == 0x0
 04402   860   NtQueryDefaultLocale  (1, 1228200, ... ) == 0x0
 04403   860   NtQueryDefaultLocale  (1, 1228200, ... ) == 0x0
 04404   860   NtQueryDefaultLocale  (1, 1228200, ... ) == 0x0
 04405   860   NtQueryDefaultLocale  (1, 1228200, ... ) == 0x0
 04406   860   NtQueryDefaultLocale  (1, 1228200, ... ) == 0x0
 04407   860   NtQueryDefaultLocale  (1, 1228200, ... ) == 0x0
 04408   860   NtQueryDefaultLocale  (1, 1228200, ... ) == 0x0
 04409   860   NtQueryDefaultLocale  (1, 1228200, ... ) == 0x0
 04410   860   NtOpenThreadTokenEx  (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN
 04411   860   NtOpenProcessTokenEx  (-1, 0x20008, 512, ... 108, ) == 0x0
 04412   860   NtQueryInformationToken  (108, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0
 04413   860   NtClose  (108, ... ) == 0x0
 04414   860   NtOpenKey  (0x20019, {24, 0, 0x640, 0, 0,  (0x20019, {24, 0, 0x640, 0, 0, "\REGISTRY\USER\S-1-5-21-1292428093-1383384898-725345543-1003"}, ... 108, ) }, ... 108, ) == 0x0
 04415   860   NtOpenKey  (0x20019, {24, 108, 0x40, 0, 0,  (0x20019, {24, 108, 0x40, 0, 0, "Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders"}, ... 172, ) }, ... 172, ) == 0x0
 04416   860   NtQueryValueKey  (172,  (172, "Personal", Partial, 144, ... TitleIdx=0, Type=2, Data="%\0U\0S\0E\0R\0P\0R\0O\0F\0I\0L\0E\0%\0\\0M\0y\0 \0D\0o\0c\0u\0m\0e\0n\0t\0s\0\0\0"}, 66, ) , Partial, 144, ... TitleIdx=0, Type=2, Data= (172, "Personal", Partial, 144, ... TitleIdx=0, Type=2, Data="%\0U\0S\0E\0R\0P\0R\0O\0F\0I\0L\0E\0%\0\\0M\0y\0 \0D\0o\0c\0u\0m\0e\0n\0t\0s\0\0\0"}, 66, ) }, 66, ) == 0x0
 04417   860   NtQueryDefaultLocale  (1, 1228200, ... ) == 0x0
 04418   860   NtQueryValueKey  (172,  (172, "Local Settings", Partial, 144, ... TitleIdx=0, Type=2, Data="%\0U\0S\0E\0R\0P\0R\0O\0F\0I\0L\0E\0%\0\\0L\0o\0c\0a\0l\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\0\0"}, 70, ) , Partial, 144, ... TitleIdx=0, Type=2, Data= (172, "Local Settings", Partial, 144, ... TitleIdx=0, Type=2, Data="%\0U\0S\0E\0R\0P\0R\0O\0F\0I\0L\0E\0%\0\\0L\0o\0c\0a\0l\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\0\0"}, 70, ) }, 70, ) == 0x0
 04419   860   NtQueryDefaultLocale  (1, 1228200, ... ) == 0x0
 04420   860   NtQueryDefaultLocale  (1, 1228200, ... ) == 0x0
 04421   860   NtQueryDefaultLocale  (1, 1228200, ... ) == 0x0
 04422   860   NtQueryDefaultLocale  (1, 1228200, ... ) == 0x0
 04423   860   NtClose  (172, ... ) == 0x0
 04424   860   NtClose  (108, ... ) == 0x0
 04425   860   NtOpenKey  (0x2000000, {24, 16, 0x40, 0, 0,  (0x2000000, {24, 16, 0x40, 0, 0, "Software\Microsoft\Windows NT\CurrentVersion\winlogon"}, ... 108, ) }, ... 108, ) == 0x0
 04426   860   NtQueryValueKey  (108,  (108, "RsopDebugLevel", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 04427   860   NtClose  (108, ... ) == 0x0
 04428   860   NtOpenKey  (0x2000000, {24, 16, 0x40, 0, 0,  (0x2000000, {24, 16, 0x40, 0, 0, "Software\Microsoft\Windows NT\CurrentVersion\winlogon"}, ... 108, ) }, ... 108, ) == 0x0
 04429   860   NtQueryValueKey  (108,  (108, "UserEnvDebugLevel", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 04430   860   NtQueryValueKey  (108,  (108, "RsopLogging", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 04431   860   NtClose  (108, ... ) == 0x0
 04432   860   NtOpenKey  (0x2000000, {24, 16, 0x40, 0, 0,  (0x2000000, {24, 16, 0x40, 0, 0, "Software\Policies\Microsoft\Windows\System"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 04433   860   NtOpenKey  (0x2000000, {24, 16, 0x40, 0, 0,  (0x2000000, {24, 16, 0x40, 0, 0, "Software\Microsoft\Windows NT\CurrentVersion\winlogon"}, ... 108, ) }, ... 108, ) == 0x0
 04434   860   NtQueryValueKey  (108,  (108, "UserEnvDebugLevel", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 04435   860   NtClose  (108, ... ) == 0x0
 04436   860   NtOpenKey  (0x2000000, {24, 16, 0x40, 0, 0,  (0x2000000, {24, 16, 0x40, 0, 0, "Software\Policies\Microsoft\Windows\System"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 04437   860   NtOpenKey  (0x80000000, {24, 0, 0x40, 0, 0,  (0x80000000, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\NETAPI32.dll"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 04438   860   NtOpenKey  (0x80000000, {24, 0, 0x40, 0, 0,  (0x80000000, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\WINSTA.dll"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 04439   860   NtOpenKey  (0x80000000, {24, 0, 0x40, 0, 0,  (0x80000000, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\WTSAPI32.dll"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 04440   860   NtQueryPerformanceCounter  (... {936260615, 10}, {3579545, 0}, ) == 0x0
 04441   860   NtOpenKey  (0x80000000, {24, 0, 0x40, 0, 0,  (0x80000000, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SETUPAPI.dll"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 04442   860   NtQueryDefaultLocale  (1, 1230576, ... ) == 0x0
 04443   860   NtQueryInformationProcess  (-1, Wow64, 4, ... {process info, class 26, size 4}, 0x0, ) == 0x0
 04444   860   NtOpenKey  (0x20019, {24, 16, 0x40, 0, 0,  (0x20019, {24, 16, 0x40, 0, 0, "System\Setup"}, ... 108, ) }, ... 108, ) == 0x0
 04445   860   NtQueryValueKey  (108,  (108, "SystemSetupInProgress", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (108, "SystemSetupInProgress", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) }, 16, ) == 0x0
 04446   860   NtClose  (108, ... ) == 0x0
 04447   860   NtUserGetProcessWindowStation  (... ) == 0x1c
 04448   860   NtUserGetObjectInformation  (28, 1, 1230172, 12, 1230184, ... ) == 0x1
 04449   860   NtOpenKey  (0xf003f, {24, 16, 0x40, 0, 0,  (0xf003f, {24, 16, 0x40, 0, 0, "SYSTEM\CurrentControlSet\Control\MiniNT"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 04450   860   NtOpenKey  (0x20019, {24, 16, 0x40, 0, 0,  (0x20019, {24, 16, 0x40, 0, 0, "System\WPA\PnP"}, ... 108, ) }, ... 108, ) == 0x0
 04451   860   NtQueryValueKey  (108,  (108, "seed", Partial, 144, ... TitleIdx=0, Type=4, Data="\240d\351\211"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (108, "seed", Partial, 144, ... TitleIdx=0, Type=4, Data="\240d\351\211"}, 16, ) }, 16, ) == 0x0
 04452   860   NtClose  (108, ... ) == 0x0
 04453   860   NtOpenKey  (0x20019, {24, 16, 0x40, 0, 0,  (0x20019, {24, 16, 0x40, 0, 0, "SYSTEM\Setup"}, ... 108, ) }, ... 108, ) == 0x0
 04454   860   NtQueryValueKey  (108,  (108, "OsLoaderPath", Partial, 144, ... TitleIdx=0, Type=1, Data="\\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (108, "OsLoaderPath", Partial, 144, ... TitleIdx=0, Type=1, Data="\\0\0\0"}, 16, ) }, 16, ) == 0x0
 04455   860   NtQueryValueKey  (108,  (108, "OsLoaderPath", Partial, 144, ... TitleIdx=0, Type=1, Data="\\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (108, "OsLoaderPath", Partial, 144, ... TitleIdx=0, Type=1, Data="\\0\0\0"}, 16, ) }, 16, ) == 0x0
 04456   860   NtClose  (108, ... ) == 0x0
 04457   860   NtOpenKey  (0x20019, {24, 16, 0x40, 0, 0,  (0x20019, {24, 16, 0x40, 0, 0, "SYSTEM\Setup"}, ... 108, ) }, ... 108, ) == 0x0
 04458   860   NtQueryValueKey  (108,  (108, "SystemPartition", Partial, 144, ... TitleIdx=0, Type=1, Data="\\0D\0e\0v\0i\0c\0e\0\\0H\0a\0r\0d\0d\0i\0s\0k\0V\0o\0l\0u\0m\0e\01\0\0\0"}, 60, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (108, "SystemPartition", Partial, 144, ... TitleIdx=0, Type=1, Data="\\0D\0e\0v\0i\0c\0e\0\\0H\0a\0r\0d\0d\0i\0s\0k\0V\0o\0l\0u\0m\0e\01\0\0\0"}, 60, ) }, 60, ) == 0x0
 04459   860   NtQueryValueKey  (108,  (108, "SystemPartition", Partial, 144, ... TitleIdx=0, Type=1, Data="\\0D\0e\0v\0i\0c\0e\0\\0H\0a\0r\0d\0d\0i\0s\0k\0V\0o\0l\0u\0m\0e\01\0\0\0"}, 60, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (108, "SystemPartition", Partial, 144, ... TitleIdx=0, Type=1, Data="\\0D\0e\0v\0i\0c\0e\0\\0H\0a\0r\0d\0d\0i\0s\0k\0V\0o\0l\0u\0m\0e\01\0\0\0"}, 60, ) }, 60, ) == 0x0
 04460   860   NtClose  (108, ... ) == 0x0
 04461   860   NtOpenKey  (0x20019, {24, 16, 0x40, 0, 0,  (0x20019, {24, 16, 0x40, 0, 0, "Software\Microsoft\Windows\CurrentVersion\Setup"}, ... 108, ) }, ... 108, ) == 0x0
 04462   860   NtQueryValueKey  (108,  (108, "SourcePath", Partial, 144, ... TitleIdx=0, Type=1, Data="D\0:\0\\0\0\0"}, 20, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (108, "SourcePath", Partial, 144, ... TitleIdx=0, Type=1, Data="D\0:\0\\0\0\0"}, 20, ) }, 20, ) == 0x0
 04463   860   NtQueryValueKey  (108,  (108, "SourcePath", Partial, 144, ... TitleIdx=0, Type=1, Data="D\0:\0\\0\0\0"}, 20, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (108, "SourcePath", Partial, 144, ... TitleIdx=0, Type=1, Data="D\0:\0\\0\0\0"}, 20, ) }, 20, ) == 0x0
 04464   860   NtClose  (108, ... ) == 0x0
 04465   860   NtOpenKey  (0x20019, {24, 16, 0x40, 0, 0,  (0x20019, {24, 16, 0x40, 0, 0, "Software\Microsoft\Windows\CurrentVersion\Setup"}, ... 108, ) }, ... 108, ) == 0x0
 04466   860   NtQueryValueKey  (108,  (108, "ServicePackSourcePath", Partial, 144, ... TitleIdx=0, Type=1, Data="D\0:\0\\0\0\0"}, 20, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (108, "ServicePackSourcePath", Partial, 144, ... TitleIdx=0, Type=1, Data="D\0:\0\\0\0\0"}, 20, ) }, 20, ) == 0x0
 04467   860   NtQueryValueKey  (108,  (108, "ServicePackSourcePath", Partial, 144, ... TitleIdx=0, Type=1, Data="D\0:\0\\0\0\0"}, 20, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (108, "ServicePackSourcePath", Partial, 144, ... TitleIdx=0, Type=1, Data="D\0:\0\\0\0\0"}, 20, ) }, 20, ) == 0x0
 04468   860   NtClose  (108, ... ) == 0x0
 04469   860   NtOpenKey  (0x20019, {24, 16, 0x40, 0, 0,  (0x20019, {24, 16, 0x40, 0, 0, "Software\Microsoft\Windows\CurrentVersion\Setup"}, ... 108, ) }, ... 108, ) == 0x0
 04470   860   NtQueryValueKey  (108,  (108, "ServicePackCachePath", Partial, 144, ... TitleIdx=0, Type=1, Data="c\0:\0\\0w\0i\0n\0d\0o\0w\0s\0\\0S\0e\0r\0v\0i\0c\0e\0P\0a\0c\0k\0F\0i\0l\0e\0s\0\\0S\0e\0r\0v\0i\0c\0e\0P\0a\0c\0k\0C\0a\0c\0h\0e\0\0\0"}, 102, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (108, "ServicePackCachePath", Partial, 144, ... TitleIdx=0, Type=1, Data="c\0:\0\\0w\0i\0n\0d\0o\0w\0s\0\\0S\0e\0r\0v\0i\0c\0e\0P\0a\0c\0k\0F\0i\0l\0e\0s\0\\0S\0e\0r\0v\0i\0c\0e\0P\0a\0c\0k\0C\0a\0c\0h\0e\0\0\0"}, 102, ) }, 102, ) == 0x0
 04471   860   NtQueryValueKey  (108,  (108, "ServicePackCachePath", Partial, 144, ... TitleIdx=0, Type=1, Data="c\0:\0\\0w\0i\0n\0d\0o\0w\0s\0\\0S\0e\0r\0v\0i\0c\0e\0P\0a\0c\0k\0F\0i\0l\0e\0s\0\\0S\0e\0r\0v\0i\0c\0e\0P\0a\0c\0k\0C\0a\0c\0h\0e\0\0\0"}, 102, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (108, "ServicePackCachePath", Partial, 144, ... TitleIdx=0, Type=1, Data="c\0:\0\\0w\0i\0n\0d\0o\0w\0s\0\\0S\0e\0r\0v\0i\0c\0e\0P\0a\0c\0k\0F\0i\0l\0e\0s\0\\0S\0e\0r\0v\0i\0c\0e\0P\0a\0c\0k\0C\0a\0c\0h\0e\0\0\0"}, 102, ) }, 102, ) == 0x0
 04472   860   NtClose  (108, ... ) == 0x0
 04473   860   NtOpenKey  (0x20019, {24, 16, 0x40, 0, 0,  (0x20019, {24, 16, 0x40, 0, 0, "Software\Microsoft\Windows\CurrentVersion\Setup"}, ... 108, ) }, ... 108, ) == 0x0
 04474   860   NtQueryValueKey  (108,  (108, "DriverCachePath", Partial, 144, ... TitleIdx=0, Type=2, Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0D\0r\0i\0v\0e\0r\0 \0C\0a\0c\0h\0e\0\0\0"}, 64, ) , Partial, 144, ... TitleIdx=0, Type=2, Data= (108, "DriverCachePath", Partial, 144, ... TitleIdx=0, Type=2, Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0D\0r\0i\0v\0e\0r\0 \0C\0a\0c\0h\0e\0\0\0"}, 64, ) }, 64, ) == 0x0
 04475   860   NtQueryValueKey  (108,  (108, "DriverCachePath", Partial, 144, ... TitleIdx=0, Type=2, Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0D\0r\0i\0v\0e\0r\0 \0C\0a\0c\0h\0e\0\0\0"}, 64, ) , Partial, 144, ... TitleIdx=0, Type=2, Data= (108, "DriverCachePath", Partial, 144, ... TitleIdx=0, Type=2, Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0D\0r\0i\0v\0e\0r\0 \0C\0a\0c\0h\0e\0\0\0"}, 64, ) }, 64, ) == 0x0
 04476   860   NtClose  (108, ... ) == 0x0
 04477   860   NtOpenKey  (0x20019, {24, 16, 0x40, 0, 0,  (0x20019, {24, 16, 0x40, 0, 0, "Software\Microsoft\Windows\CurrentVersion"}, ... 108, ) }, ... 108, ) == 0x0
 04478   860   NtQueryValueKey  (108,  (108, "DevicePath", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 04479   860   NtQueryValueKey  (108,  (108, "DevicePath", Partial, 346, ... TitleIdx=0, Type=2, Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0i\0n\0f\0;\0%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0d\0e\0l\0l\0\\0a\0a\0c\0;\0%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0d\0e\0l\0l\0\\0a\0a\0r\0i\0c\0h\0;\0%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0d\0e\0l\0l\0\\0c\0e\0r\0c\0s\0r\06\0;\0%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0d\0e\0l\0l\0\\0a\03\02\00\0r\0a\0i\0d\0;\0%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0d\0e\0l\0l\0\\0i\0a\0s\0t\0o\0r\0;\0%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0d\0e\0l\0l\0\\0n\0v\0r\0a\0i\0d\0\0\0"}, 346, ) , Partial, 346, ... TitleIdx=0, Type=2, Data= (108, "DevicePath", Partial, 346, ... TitleIdx=0, Type=2, Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0i\0n\0f\0;\0%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0d\0e\0l\0l\0\\0a\0a\0c\0;\0%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0d\0e\0l\0l\0\\0a\0a\0r\0i\0c\0h\0;\0%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0d\0e\0l\0l\0\\0c\0e\0r\0c\0s\0r\06\0;\0%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0d\0e\0l\0l\0\\0a\03\02\00\0r\0a\0i\0d\0;\0%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0d\0e\0l\0l\0\\0i\0a\0s\0t\0o\0r\0;\0%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0d\0e\0l\0l\0\\0n\0v\0r\0a\0i\0d\0\0\0"}, 346, ) }, 346, ) == 0x0
 04480   860   NtClose  (108, ... ) == 0x0
 04481   860   NtCreateEvent  (0x1f0003, 0x0, 0, 0, ... 108, ) == 0x0
 04482   860   NtCreateMutant  (0x1f0001, 0x0, 0, ... 172, ) == 0x0
 04483   860   NtCreateEvent  (0x1f0003, 0x0, 0, 0, ... 164, ) == 0x0
 04484   860   NtCreateMutant  (0x1f0001, 0x0, 0, ... 156, ) == 0x0
 04485   860   NtCreateEvent  (0x1f0003, 0x0, 0, 0, ... 168, ) == 0x0
 04486   860   NtCreateMutant  (0x1f0001, 0x0, 0, ... 160, ) == 0x0
 04487   860   NtOpenKey  (0x1, {24, 16, 0x40, 0, 0,  (0x1, {24, 16, 0x40, 0, 0, "Software\Microsoft\Windows\CurrentVersion\Setup"}, ... 148, ) }, ... 148, ) == 0x0
 04488   860   NtQueryValueKey  (148,  (148, "LogLevel", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (148, "LogLevel", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) }, 16, ) == 0x0
 04489   860   NtQueryValueKey  (148,  (148, "LogLevel", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (148, "LogLevel", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) }, 16, ) == 0x0
 04490   860   NtQueryValueKey  (148,  (148, "LogPath", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 04491   860   NtOpenKey  (0x1, {24, 148, 0x40, 0, 0,  (0x1, {24, 148, 0x40, 0, 0, "AppLogLevels"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 04492   860   NtClose  (148, ... ) == 0x0
 04493   860   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\"}, 1230088, ... ) }, 1230088, ... ) == 0x0
 04494   860   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\System\CurrentControlSet\Control\ComputerName\ActiveComputerName"}, ... 148, ) }, ... 148, ) == 0x0
 04495   860   NtQueryValueKey  (148,  (148, "ComputerName", Full, 128, ... TitleIdx=0, Type=1, Name="ComputerName", Data="V\0I\0R\0T\0U\0A\0L\0\0\0"}, 60, ) , Full, 128, ... TitleIdx=0, Type=1, Name= (148, "ComputerName", Full, 128, ... TitleIdx=0, Type=1, Name="ComputerName", Data="V\0I\0R\0T\0U\0A\0L\0\0\0"}, 60, ) , Data= (148, "ComputerName", Full, 128, ... TitleIdx=0, Type=1, Name="ComputerName", Data="V\0I\0R\0T\0U\0A\0L\0\0\0"}, 60, ) }, 60, ) == 0x0
 04496   860   NtClose  (148, ... ) == 0x0
 04497   860   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\System\CurrentControlSet\Services\Tcpip\Parameters"}, ... 148, ) }, ... 148, ) == 0x0
 04498   860   NtQueryValueKey  (148,  (148, "Hostname", Full, 128, ... TitleIdx=0, Type=1, Name="Hostname", Data="v\0i\0r\0t\0u\0a\0l\0\0\0"}, 52, ) , Full, 128, ... TitleIdx=0, Type=1, Name= (148, "Hostname", Full, 128, ... TitleIdx=0, Type=1, Name="Hostname", Data="v\0i\0r\0t\0u\0a\0l\0\0\0"}, 52, ) , Data= (148, "Hostname", Full, 128, ... TitleIdx=0, Type=1, Name="Hostname", Data="v\0i\0r\0t\0u\0a\0l\0\0\0"}, 52, ) }, 52, ) == 0x0
 04499   860   NtClose  (148, ... ) == 0x0
 04500   860   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Policies\Microsoft\System\DNSclient"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 04501   860   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\System\CurrentControlSet\Services\Tcpip\Parameters"}, ... 148, ) }, ... 148, ) == 0x0
 04502   860   NtQueryValueKey  (148,  (148, "Domain", Full, 128, ... TitleIdx=0, Type=1, Name="Domain", Data="\0\0"}, 34, ) , Full, 128, ... TitleIdx=0, Type=1, Name= (148, "Domain", Full, 128, ... TitleIdx=0, Type=1, Name="Domain", Data="\0\0"}, 34, ) , Data= (148, "Domain", Full, 128, ... TitleIdx=0, Type=1, Name="Domain", Data="\0\0"}, 34, ) }, 34, ) == 0x0
 04503   860   NtClose  (148, ... ) == 0x0
 04504   860   NtOpenKey  (0x80000000, {24, 0, 0x40, 0, 0,  (0x80000000, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\faultrep.dll"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 04505   860   NtOpenKey  (0x20119, {24, 16, 0x40, 0, 0,  (0x20119, {24, 16, 0x40, 0, 0, "Software\Policies\Microsoft\PCHealth\ErrorReporting"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 04506   860   NtCreateKey  (0x20119, {24, 16, 0x40, 0, 0,  (0x20119, {24, 16, 0x40, 0, 0, "Software\Microsoft\PCHealth\ErrorReporting"}, 0, 0x0, 0, ... 148, 2, ) }, 0, 0x0, 0, ... 148, 2, ) == 0x0
 04507   860   NtOpenKey  (0x10000, {24, 148, 0x40, 0, 0,  (0x10000, {24, 148, 0x40, 0, 0, "DW"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 04508   860   NtQueryValueKey  (148,  (148, "DoReport", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (148, "DoReport", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) }, 16, ) == 0x0
 04509   860   NtQueryValueKey  (148,  (148, "ShowUI", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (148, "ShowUI", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) }, 16, ) == 0x0
 04510   860   NtQueryValueKey  (148,  (148, "AllOrNone", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (148, "AllOrNone", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) }, 16, ) == 0x0
 04511   860   NtQueryValueKey  (148,  (148, "IncludeMicrosoftApps", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (148, "IncludeMicrosoftApps", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) }, 16, ) == 0x0
 04512   860   NtQueryValueKey  (148,  (148, "IncludeWindowsApps", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (148, "IncludeWindowsApps", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) }, 16, ) == 0x0
 04513   860   NtQueryValueKey  (148,  (148, "DoTextLog", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 04514   860   NtQueryValueKey  (148,  (148, "IncludeKernelFaults", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (148, "IncludeKernelFaults", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) }, 16, ) == 0x0
 04515   860   NtQueryValueKey  (148,  (148, "IncludeShutdownErrs", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 04516   860   NtQueryValueKey  (148,  (148, "NumberOfFaultPipes", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 04517   860   NtQueryValueKey  (148,  (148, "NumberOfHangPipes", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 04518   860   NtQueryValueKey  (148,  (148, "MaxUserQueueSize", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 04519   860   NtQueryValueKey  (148,  (148, "ForceQueueMode", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 04520   860   NtCreateKey  (0x20119, {24, 148, 0x40, 0, 0,  (0x20119, {24, 148, 0x40, 0, 0, "ExclusionList"}, 0, 0x0, 0, ... 144, 2, ) }, 0, 0x0, 0, ... 144, 2, ) == 0x0
 04521   860   NtCreateKey  (0x20119, {24, 148, 0x40, 0, 0,  (0x20119, {24, 148, 0x40, 0, 0, "InclusionList"}, 0, 0x0, 0, ... 196, 2, ) }, 0, 0x0, 0, ... 196, 2, ) == 0x0
 04522   860   NtClose  (148, ... ) == 0x0
 04523   860   NtOpenKey  (0x20019, {24, 16, 0x40, 0, 0,  (0x20019, {24, 16, 0x40, 0, 0, "System\Setup"}, ... 148, ) }, ... 148, ) == 0x0
 04524   860   NtQueryValueKey  (148,  (148, "SystemSetupInProgress", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (148, "SystemSetupInProgress", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) }, 16, ) == 0x0
 04525   860   NtClose  (148, ... ) == 0x0
 04526   860   NtQueryInformationProcess  (-1, DefaultHardErrorMode, 4, ... {process info, class 12, size 4}, 0x0, ) == 0x0
 04527   860   NtSetInformationProcess  (-1, DefaultHardErrorMode, {process info, class 12, size 4}, 4, ... ) == 0x0
 04528   860   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\u:\work\packed.exe"}, 1227616, ... ) }, 1227616, ... ) == 0x0
 04529   860   NtOpenFile  (0x100001, {24, 0, 0x40, 0, 0,  (0x100001, {24, 0, 0x40, 0, 0, "\??\u:\"}, 3, 16417, ... 148, {status=0x0, info=1}, ) }, 3, 16417, ... 148, {status=0x0, info=1}, ) == 0x0
 04530   860   NtQueryDirectoryFile  (148, 0, 0, 0, 1227044, 616, BothDirectory, 1,  (148, 0, 0, 0, 1227044, 616, BothDirectory, 1, "work", 0, ... {status=0x0, info=108}, ) , 0, ... {status=0x0, info=108}, ) == 0x0
 04531   860   NtClose  (148, ... ) == 0x0
 04532   860   NtOpenFile  (0x100001, {24, 0, 0x40, 0, 0,  (0x100001, {24, 0, 0x40, 0, 0, "\??\u:\work\"}, 3, 16417, ... 148, {status=0x0, info=1}, ) }, 3, 16417, ... 148, {status=0x0, info=1}, ) == 0x0
 04533   860   NtQueryDirectoryFile  (148, 0, 0, 0, 1227044, 616, BothDirectory, 1,  (148, 0, 0, 0, 1227044, 616, BothDirectory, 1, "packed.exe", 0, ... {status=0x0, info=116}, ) , 0, ... {status=0x0, info=116}, ) == 0x0
 04534   860   NtClose  (148, ... ) == 0x0
 04535   860   NtQueryInformationProcess  (-1, DefaultHardErrorMode, 4, ... {process info, class 12, size 4}, 0x0, ) == 0x0
 04536   860   NtSetInformationProcess  (-1, DefaultHardErrorMode, {process info, class 12, size 4}, 4, ... ) == 0x0
 04537   860   NtQueryInformationProcess  (-1, DefaultHardErrorMode, 4, ... {process info, class 12, size 4}, 0x0, ) == 0x0
 04538   860   NtSetInformationProcess  (-1, DefaultHardErrorMode, {process info, class 12, size 4}, 4, ... ) == 0x0
 04539   860   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\u:\work\packed.exe"}, 1226264, ... ) }, 1226264, ... ) == 0x0
 04540   860   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\u:\work\packed.exe"}, 1225036, ... ) }, 1225036, ... ) == 0x0
 04541   860   NtQueryInformationProcess  (-1, DefaultHardErrorMode, 4, ... {process info, class 12, size 4}, 0x0, ) == 0x0
 04542   860   NtSetInformationProcess  (-1, DefaultHardErrorMode, {process info, class 12, size 4}, 4, ... ) == 0x0
 04543   860   NtQueryValueKey  (144,  (144, "packed.exe", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 04544   860   NtOpenThreadToken  (-2, 0x2000c, 1, ... ) == STATUS_NO_TOKEN
 04545   860   NtSetInformationThread  (-2, ImpersonationToken, {ImpToken=0,}, 4, ... ) == 0x0
 04546   860   NtCreateEvent  (0x1f0003, 0x0, 1, 0, ... 148, ) == 0x0
 04547   860   NtConnectPort  ( ("\RPC Control\IcaApi", {12, 2, 1, 0}, 0x0, 0x0, 1225408, 188, ... 192, 0x0, 0x0, 0x0, 188, ) , {12, 2, 1, 0}, 0x0, 0x0, 1225408, 188, ... 192, 0x0, 0x0, 0x0, 188, ) == 0x0
 04548   860   NtRequestWaitReplyPort  (192, {200, 224, new_msg, 0, 2621478, 1377496, 12, 2}  (192, {200, 224, new_msg, 0, 2621478, 1377496, 12, 2} "\0\0\24\0(\3\24\0\274\0\0\0`\247\244\\261\353\317\21\206\21\0\240$T \355\1\0\0\0\1\0\0\0\0\0\4\0\4\0\0\002\24\0\4\0\0\0\10\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\377\377\4\0\0\0\310\275\24\0\244N\210\223\30\274\24\0`\1\24\0\12\0\0\0\0\0\0\0\30\274\24\0(\0\0\0 \274\24\0\246\33\267\335(\3\24\0(\0\0\0I_\0\0\0\0\24\0\34\261\22\0\273\35T\250\0\0\0\0\350\272\24\0\360\6\221|\377\377\377\377P\0\0\0\346\31\0|\0\0\24\0@\261\22\0\372\31\221|\324\270\22\0\30\356\220|\0\0\0\0\0\0\0\0\0\0\0\0\351\201\347w" ... {200, 224, reply, 0, 464, 860, 58287, 0} "\7\0\24\0(\3\24\0\274\0\0\0`\247\244\\261\353\317\21\206\21\0\240$T \355\1\0\0\0\1\0\0\0\0\0\0\0\4\0\0\002\24\0\377\377\377\377\10\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\377\377\4\0\0\0\310\275\24\0\244N\210\223\30\274\24\0`\1\24\0\12\0\0\0\0\0\0\0\30\274\24\0(\0\0\0 \274\24\0\246\33\267\335(\3\24\0(\0\0\0I_\0\0\0\0\24\0\34\261\22\0\273\35T\250\0\0\0\0\350\272\24\0\360\6\221|\377\377\377\377P\0\0\0\346\31\0|\0\0\24\0@\261\22\0\372\31\221|\324\270\22\0\30\356\220|\0\0\0\0\0\0\0\0\0\0\0\0\351\201\347w" )  ... {200, 224, reply, 0, 464, 860, 58287, 0}  (192, {200, 224, new_msg, 0, 2621478, 1377496, 12, 2} "\0\0\24\0(\3\24\0\274\0\0\0`\247\244\\261\353\317\21\206\21\0\240$T \355\1\0\0\0\1\0\0\0\0\0\4\0\4\0\0\002\24\0\4\0\0\0\10\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\377\377\4\0\0\0\310\275\24\0\244N\210\223\30\274\24\0`\1\24\0\12\0\0\0\0\0\0\0\30\274\24\0(\0\0\0 \274\24\0\246\33\267\335(\3\24\0(\0\0\0I_\0\0\0\0\24\0\34\261\22\0\273\35T\250\0\0\0\0\350\272\24\0\360\6\221|\377\377\377\377P\0\0\0\346\31\0|\0\0\24\0@\261\22\0\372\31\221|\324\270\22\0\30\356\220|\0\0\0\0\0\0\0\0\0\0\0\0\351\201\347w" ... {200, 224, reply, 0, 464, 860, 58287, 0} "\7\0\24\0(\3\24\0\274\0\0\0`\247\244\\261\353\317\21\206\21\0\240$T \355\1\0\0\0\1\0\0\0\0\0\0\0\4\0\0\002\24\0\377\377\377\377\10\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\377\377\4\0\0\0\310\275\24\0\244N\210\223\30\274\24\0`\1\24\0\12\0\0\0\0\0\0\0\30\274\24\0(\0\0\0 \274\24\0\246\33\267\335(\3\24\0(\0\0\0I_\0\0\0\0\24\0\34\261\22\0\273\35T\250\0\0\0\0\350\272\24\0\360\6\221|\377\377\377\377P\0\0\0\346\31\0|\0\0\24\0@\261\22\0\372\31\221|\324\270\22\0\30\356\220|\0\0\0\0\0\0\0\0\0\0\0\0\351\201\347w" )  ) == 0x0
 04549   860   NtRequestWaitReplyPort  (192, {32, 56, new_msg, 0, 464, 860, 58280, 0}  (192, {32, 56, new_msg, 0, 464, 860, 58280, 0} "\1\31\0\0A\3\0\0`\247\244\\261\353\317\21\206\21\0\240$T \355\377\377\377\377\0\300\372\177" ... {124, 148, reply, 0, 464, 860, 58288, 0} "\2\376\255\201\1\0\0\0\200Y\274\201V\347\340\341\264\311\275\201:\332R\200X;\350\371\324\376\255\201\0\0\0\0\0\0\0\0\216~\0I*}\335D\235\266\354\254!\360c/\10\210\300\310\0\0\0\3\1\0\0\3\1\0\0\10A\210\300\0@\250\300\220\276u\201\264;\350\371R\250S\200\304;\350\371\4\0\0\0\0\0\0\0\220\276u\201<(\255\201\7\0\0\0\304\277u\201]\0\0\0" )  ... {124, 148, reply, 0, 464, 860, 58288, 0}  (192, {32, 56, new_msg, 0, 464, 860, 58280, 0} "\1\31\0\0A\3\0\0`\247\244\\261\353\317\21\206\21\0\240$T \355\377\377\377\377\0\300\372\177" ... {124, 148, reply, 0, 464, 860, 58288, 0} "\2\376\255\201\1\0\0\0\200Y\274\201V\347\340\341\264\311\275\201:\332R\200X;\350\371\324\376\255\201\0\0\0\0\0\0\0\0\216~\0I*}\335D\235\266\354\254!\360c/\10\210\300\310\0\0\0\3\1\0\0\3\1\0\0\10A\210\300\0@\250\300\220\276u\201\264;\350\371R\250S\200\304;\350\371\4\0\0\0\0\0\0\0\220\276u\201<(\255\201\7\0\0\0\304\277u\201]\0\0\0" )  ) == 0x0
 04550   860   NtRequestWaitReplyPort  (192, {44, 68, new_msg, 56, 464, 860, 58288, 0}  (192, {44, 68, new_msg, 56, 464, 860, 58288, 0} "\1\376\0\0B\2\5\0\200Y\274\201V\347\340\341\264\311\275\201:\332R\200\377\377\377\377\324\376\255\201\1\0\0\0\370\322\24\0\10\5\0\0" ... {40, 64, reply, 0, 464, 860, 58289, 0} "\2\31\221|\4\0\221|\200\300\227|p\31\221|\250$\12\0\330\0\0\0d\365\11\0\0\300\372\177\14\5\0\0\320\371\15\0" )  ... {40, 64, reply, 0, 464, 860, 58289, 0}  (192, {44, 68, new_msg, 56, 464, 860, 58288, 0} "\1\376\0\0B\2\5\0\200Y\274\201V\347\340\341\264\311\275\201:\332R\200\377\377\377\377\324\376\255\201\1\0\0\0\370\322\24\0\10\5\0\0" ... {40, 64, reply, 0, 464, 860, 58289, 0} "\2\31\221|\4\0\221|\200\300\227|p\31\221|\250$\12\0\330\0\0\0d\365\11\0\0\300\372\177\14\5\0\0\320\371\15\0" )  ) == 0x0
 04551   860   NtRequestWaitReplyPort  (192, {64, 88, new_msg, 56, 1367968, 1225984, 1364720, 0}  (192, {64, 88, new_msg, 56, 1367968, 1225984, 1364720, 0} "\10\0\0\0@\0\1\1\226\1\0\0\370\263\22\0\370\322\24\0\24\271\22\0\30\356\220|p\5\221|\1\0\0\0\370\322\24\0\14\5\0\0\14\5\0\0\320\371\15\0\0\0\0\0\0\0\0\0\273f\347w" ... {64, 88, reply, 56, 464, 860, 58290, 0} "\10\0\0\0@\0\1\1\226\1\0\0\370\263\22\0\370\322\24\0\24\271\22\0\30\356\220|p\5\221|\1\0\0\0\370\322\24\0\14\5\0\0\14\5\0\0\320\371\15\0\0\0\0\0\0\0\0\0\273f\347w" )  ... {64, 88, reply, 56, 464, 860, 58290, 0}  (192, {64, 88, new_msg, 56, 1367968, 1225984, 1364720, 0} "\10\0\0\0@\0\1\1\226\1\0\0\370\263\22\0\370\322\24\0\24\271\22\0\30\356\220|p\5\221|\1\0\0\0\370\322\24\0\14\5\0\0\14\5\0\0\320\371\15\0\0\0\0\0\0\0\0\0\273f\347w" ... {64, 88, reply, 56, 464, 860, 58290, 0} "\10\0\0\0@\0\1\1\226\1\0\0\370\263\22\0\370\322\24\0\24\271\22\0\30\356\220|p\5\221|\1\0\0\0\370\322\24\0\14\5\0\0\14\5\0\0\320\371\15\0\0\0\0\0\0\0\0\0\273f\347w" )  ) == 0x0
 04552   860   NtRequestWaitReplyPort  (192, {44, 68, new_msg, 56, 464, 860, 58289, 0}  (192, {44, 68, new_msg, 56, 464, 860, 58289, 0} "\1\31\0\0B\2\5\0\200\300\227|p\31\221|\250$\12\0\330\0\0\0\377\377\377\377\0\300\372\177\1\0\0\0\370\322\24\0\10\5\0\0" ... {40, 64, reply, 0, 464, 860, 58291, 0} "\2\376\255\201\4\0\0\0\200Y\274\201V\347\340\341\264\311\275\201:\332R\200X;\350\371\324\376\255\201\14\5\0\0\320\371\15\0" )  ... {40, 64, reply, 0, 464, 860, 58291, 0}  (192, {44, 68, new_msg, 56, 464, 860, 58289, 0} "\1\31\0\0B\2\5\0\200\300\227|p\31\221|\250$\12\0\330\0\0\0\377\377\377\377\0\300\372\177\1\0\0\0\370\322\24\0\10\5\0\0" ... {40, 64, reply, 0, 464, 860, 58291, 0} "\2\376\255\201\4\0\0\0\200Y\274\201V\347\340\341\264\311\275\201:\332R\200X;\350\371\324\376\255\201\14\5\0\0\320\371\15\0" )  ) == 0x0
 04553   860   NtRequestWaitReplyPort  (192, {64, 88, new_msg, 56, 1367968, 1225984, 1364720, 0}  (192, {64, 88, new_msg, 56, 1367968, 1225984, 1364720, 0} "\10\0\0\0@\0\1\1\226\1\0\0\370\263\22\0\370\322\24\0\24\271\22\0\30\356\220|p\5\221|\1\0\0\0\370\322\24\0\14\5\0\0\14\5\0\0\320\371\15\0\0\0\0\0\0\0\0\0\273f\347w" ... {64, 88, reply, 56, 464, 860, 58292, 0} "\10\0\0\0@\0\1\1\226\1\0\0\370\263\22\0\370\322\24\0\24\271\22\0\30\356\220|p\5\221|\1\0\0\0\370\322\24\0\14\5\0\0\14\5\0\0\320\371\15\0\0\0\0\0\0\0\0\0\273f\347w" )  ... {64, 88, reply, 56, 464, 860, 58292, 0}  (192, {64, 88, new_msg, 56, 1367968, 1225984, 1364720, 0} "\10\0\0\0@\0\1\1\226\1\0\0\370\263\22\0\370\322\24\0\24\271\22\0\30\356\220|p\5\221|\1\0\0\0\370\322\24\0\14\5\0\0\14\5\0\0\320\371\15\0\0\0\0\0\0\0\0\0\273f\347w" ... {64, 88, reply, 56, 464, 860, 58292, 0} "\10\0\0\0@\0\1\1\226\1\0\0\370\263\22\0\370\322\24\0\24\271\22\0\30\356\220|p\5\221|\1\0\0\0\370\322\24\0\14\5\0\0\14\5\0\0\320\371\15\0\0\0\0\0\0\0\0\0\273f\347w" )  ) == 0x0
 04554   860   NtOpenThreadToken  (-2, 0xc, 1, ... ) == STATUS_NO_TOKEN
 04555   860   NtCreateEvent  (0x1f0003, 0x0, 1, 0, ... 208, ) == 0x0
 04556   860   NtOpenThreadToken  (-2, 0xc, 1, ... ) == STATUS_NO_TOKEN
 04557   860   NtSetInformationThread  (-2, ImpersonationToken, {ImpToken=0,}, 4, ... ) == 0x0
 04558   860   NtCreateFile  (0xc0100080, {24, 0, 0x40, 0, 1225444,  (0xc0100080, {24, 0, 0x40, 0, 1225444, "\??\PIPE\lsarpc"}, 0x0, 0, 3, 1, 64, 0, 0, ... 200, {status=0x0, info=1}, ) }, 0x0, 0, 3, 1, 64, 0, 0, ... 200, {status=0x0, info=1}, ) == 0x0
 04559   860   NtSetInformationFile  (200, 1225500, 8, Pipe, ... {status=0x0, info=0}, ) == 0x0
 04560   860   NtSetInformationFile  (200, 1225488, 8, Completion, ... {status=0x0, info=0}, ) == 0x0
 04561   860   NtSetInformationThread  (-2, ImpersonationToken, {ImpToken=0,}, 4, ... ) == 0x0
 04562   860   NtWriteFile  (200, 77, 0, 0,  (200, 77, 0, 0, "\5\0\13\3\20\0\0\0H\0\0\0\1\0\0\0\270\20\270\20\0\0\0\0\1\0\0\0\0\0\1\0xW4\224\22\315\253\357\0\1#Eg\211\253\0\0\0\0\4]\210\212\353\34\311\21\237\350\10\0+\20H`\2\0\0\0", 72, {0, 0}, 0, ... {status=0x0, info=72}, ) , 72, {0, 0}, 0, ... {status=0x0, info=72}, ) == 0x0
 04563   860   NtReadFile  (200, 77, 0, 0, 1024, {0, 0}, 0, ... {status=0x0, info=68},  (200, 77, 0, 0, 1024, {0, 0}, 0, ... {status=0x0, info=68}, "\5\0\14\3\20\0\0\0D\0\0\0\1\0\0\0\270\20\270\20E+\0\0\14\0\PIPE\lsass\0\0\0\1\0\0\0\0\0\0\0\4]\210\212\353\34\311\21\237\350\10\0+\20H`\2\0\0\0", ) , ) == 0x0
 04564   860   NtFsControlFile  (200, 77, 0x0, 0x0, 0x11c017,  (200, 77, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0@\0\0\0\1\0\0\0(\0\0\0\0\0,\0\0\0\0\0\30\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\254\271\22\0\14\0\0\0\2\0\1\0\0\10\0\0", 64, 1024, ... {status=0x103, info=68}, "\5\0\14\3\20\0\0\0D\0\0\0\1\0\0\0\270\20\270\20E+\0\0\14\0\PIPE\lsass\0\0\0\1\0\0\0\0\0\0\0\4]\210\212\353\34\311\21\237\350\10\0+\20H`\2\0\0\0", ) , 64, 1024, ... {status=0x103, info=68},  (200, 77, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0@\0\0\0\1\0\0\0(\0\0\0\0\0,\0\0\0\0\0\30\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\254\271\22\0\14\0\0\0\2\0\1\0\0\10\0\0", 64, 1024, ... {status=0x103, info=68}, "\5\0\14\3\20\0\0\0D\0\0\0\1\0\0\0\270\20\270\20E+\0\0\14\0\PIPE\lsass\0\0\0\1\0\0\0\0\0\0\0\4]\210\212\353\34\311\21\237\350\10\0+\20H`\2\0\0\0", ) , ) == 0x103
 04565   860   NtFsControlFile  (200, 77, 0x0, 0x0, 0x11c017,  (200, 77, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0\214\0\0\0\2\0\0\0t\0\0\0\0\0D\0\0\0\0\0\320\367Y@d\312\264C\245\1CGX\305 \7\1\0\0\0\1\0\0\0,\0.\0`\274\22\0\27\0\0\0\0\0\0\0\26\0\0\0V\0I\0R\0T\0U\0A\0L\0\\0M\0a\0r\0t\0i\0m\0 \0C\0a\0r\0b\0o\0n\0e\0\0\0\0\0\0\0\0\0\1\0na\0\0\0\0\0\0\0\0\2\0\0\0", 140, 1024, ... {status=0x103, info=48}, "\5\0\2\3\20\0\0\00\0\0\0\1\0\0\0\30\0\0\0\0\0\0\0\0\0\0\0\320\367Y@d\312\264C\245\1CGX\305 \7\0\0\0\0", ) , 140, 1024, ... {status=0x103, info=48},  (200, 77, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0\214\0\0\0\2\0\0\0t\0\0\0\0\0D\0\0\0\0\0\320\367Y@d\312\264C\245\1CGX\305 \7\1\0\0\0\1\0\0\0,\0.\0`\274\22\0\27\0\0\0\0\0\0\0\26\0\0\0V\0I\0R\0T\0U\0A\0L\0\\0M\0a\0r\0t\0i\0m\0 \0C\0a\0r\0b\0o\0n\0e\0\0\0\0\0\0\0\0\0\1\0na\0\0\0\0\0\0\0\0\2\0\0\0", 140, 1024, ... {status=0x103, info=48}, "\5\0\2\3\20\0\0\00\0\0\0\1\0\0\0\30\0\0\0\0\0\0\0\0\0\0\0\320\367Y@d\312\264C\245\1CGX\305 \7\0\0\0\0", ) , ) == 0x103
 04566   860   NtFsControlFile  (200, 77, 0x0, 0x0, 0x11c017,  (200, 77, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0,\0\0\0\3\0\0\0\24\0\0\0\0\0\0\0\0\0\0\0\320\367Y@d\312\264C\245\1CGX\305 \7", 44, 1024, ... {status=0x103, info=180}, "\5\0\2\3\20\0\0\0\264\0\0\0\2\0\0\0\234\0\0\0\0\0\0\0\270\37\24\0\1\0\0\0\304\37\24\0 \0\0\0\1\0\0\0\16\0\20\0\320\37\24\0\340\37\24\0\10\0\0\0\0\0\0\0\7\0\0\0V\0I\0R\0T\0U\0A\0L\0O\0\4\0\0\0\1\4\0\0\0\0\0\5\25\0\0\0=\343\10MB\307tR\7\345;+\1\0\0\0p\276\24\0\1\0\0\0\1\0\0\0\200\276\24\0\0\0\0\0\0\0\0\0\5\0\0\0\1\5\0\0\0\0\0\5\25\0\0\0=\343\10MB\307tR\7\345;+\353\3\0\0\1\0\0\0\0\0\0\0", ) , 44, 1024, ... {status=0x103, info=180},  (200, 77, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0,\0\0\0\3\0\0\0\24\0\0\0\0\0\0\0\0\0\0\0\320\367Y@d\312\264C\245\1CGX\305 \7", 44, 1024, ... {status=0x103, info=180}, "\5\0\2\3\20\0\0\0\264\0\0\0\2\0\0\0\234\0\0\0\0\0\0\0\270\37\24\0\1\0\0\0\304\37\24\0 \0\0\0\1\0\0\0\16\0\20\0\320\37\24\0\340\37\24\0\10\0\0\0\0\0\0\0\7\0\0\0V\0I\0R\0T\0U\0A\0L\0O\0\4\0\0\0\1\4\0\0\0\0\0\5\25\0\0\0=\343\10MB\307tR\7\345;+\1\0\0\0p\276\24\0\1\0\0\0\1\0\0\0\200\276\24\0\0\0\0\0\0\0\0\0\5\0\0\0\1\5\0\0\0\0\0\5\25\0\0\0=\343\10MB\307tR\7\345;+\353\3\0\0\1\0\0\0\0\0\0\0", ) , ) == 0x103
 04567   860   NtClose  (208, ... ) == 0x0
 04568   860   NtClose  (200, ... ) == 0x0
 04569   860   NtOpenThreadToken  (-2, 0xc, 1, ... ) == STATUS_NO_TOKEN
 04570   860   NtCreateEvent  (0x1f0003, 0x0, 1, 0, ... 200, ) == 0x0
 04571   860   NtOpenThreadToken  (-2, 0xc, 1, ... ) == STATUS_NO_TOKEN
 04572   860   NtSetInformationThread  (-2, ImpersonationToken, {ImpToken=0,}, 4, ... ) == 0x0
 04573   860   NtCreateFile  (0xc0100080, {24, 0, 0x40, 0, 1225416,  (0xc0100080, {24, 0, 0x40, 0, 1225416, "\??\PIPE\lsarpc"}, 0x0, 0, 3, 1, 64, 0, 0, ... 208, {status=0x0, info=1}, ) }, 0x0, 0, 3, 1, 64, 0, 0, ... 208, {status=0x0, info=1}, ) == 0x0
 04574   860   NtSetInformationFile  (208, 1225472, 8, Pipe, ... {status=0x0, info=0}, ) == 0x0
 04575   860   NtSetInformationFile  (208, 1225460, 8, Completion, ... {status=0x0, info=0}, ) == 0x0
 04576   860   NtSetInformationThread  (-2, ImpersonationToken, {ImpToken=0,}, 4, ... ) == 0x0
 04577   860   NtWriteFile  (208, 77, 0, 0,  (208, 77, 0, 0, "\5\0\13\3\20\0\0\0H\0\0\0\1\0\0\0\270\20\270\20\0\0\0\0\1\0\0\0\0\0\1\0xW4\224\22\315\253\357\0\1#Eg\211\253\0\0\0\0\4]\210\212\353\34\311\21\237\350\10\0+\20H`\2\0\0\0", 72, {0, 0}, 0, ... {status=0x0, info=72}, ) , 72, {0, 0}, 0, ... {status=0x0, info=72}, ) == 0x0
 04578   860   NtReadFile  (208, 77, 0, 0, 1024, {0, 0}, 0, ... {status=0x0, info=68},  (208, 77, 0, 0, 1024, {0, 0}, 0, ... {status=0x0, info=68}, "\5\0\14\3\20\0\0\0D\0\0\0\1\0\0\0\270\20\270\20F+\0\0\14\0\PIPE\lsass\0\0\0\1\0\0\0\0\0\0\0\4]\210\212\353\34\311\21\237\350\10\0+\20H`\2\0\0\0", ) , ) == 0x0
 04579   860   NtFsControlFile  (208, 77, 0x0, 0x0, 0x11c017,  (208, 77, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0@\0\0\0\1\0\0\0(\0\0\0\0\0,\0\0\0\0\0\30\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\220\271\22\0\14\0\0\0\2\0\1\0\0\10\0\0", 64, 1024, ... {status=0x103, info=68}, "\5\0\14\3\20\0\0\0D\0\0\0\1\0\0\0\270\20\270\20F+\0\0\14\0\PIPE\lsass\0\0\0\1\0\0\0\0\0\0\0\4]\210\212\353\34\311\21\237\350\10\0+\20H`\2\0\0\0", ) , 64, 1024, ... {status=0x103, info=68},  (208, 77, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0@\0\0\0\1\0\0\0(\0\0\0\0\0,\0\0\0\0\0\30\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\220\271\22\0\14\0\0\0\2\0\1\0\0\10\0\0", 64, 1024, ... {status=0x103, info=68}, "\5\0\14\3\20\0\0\0D\0\0\0\1\0\0\0\270\20\270\20F+\0\0\14\0\PIPE\lsass\0\0\0\1\0\0\0\0\0\0\0\4]\210\212\353\34\311\21\237\350\10\0+\20H`\2\0\0\0", ) , ) == 0x103
 04580   860   NtFsControlFile  (208, 77, 0x0, 0x0, 0x11c017,  (208, 77, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0\214\0\0\0\2\0\0\0t\0\0\0\0\0D\0\0\0\0\0\35\325\21]\300%\353F\201\7\276\221\202\21=\23\1\0\0\0\1\0\0\0,\0.\0`\274\22\0\27\0\0\0\0\0\0\0\26\0\0\0V\0I\0R\0T\0U\0A\0L\0\\0M\0a\0r\0t\0i\0m\0 \0C\0a\0r\0b\0o\0n\0e\0\0\0\0\0\0\0\0\0\1\0na\0\0\0\0\0\0\0\0\2\0\0\0", 140, 1024, ... {status=0x103, info=48}, "\5\0\2\3\20\0\0\00\0\0\0\1\0\0\0\30\0\0\0\0\0\0\0\0\0\0\0\35\325\21]\300%\353F\201\7\276\221\202\21=\23\0\0\0\0", ) , 140, 1024, ... {status=0x103, info=48},  (208, 77, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0\214\0\0\0\2\0\0\0t\0\0\0\0\0D\0\0\0\0\0\35\325\21]\300%\353F\201\7\276\221\202\21=\23\1\0\0\0\1\0\0\0,\0.\0`\274\22\0\27\0\0\0\0\0\0\0\26\0\0\0V\0I\0R\0T\0U\0A\0L\0\\0M\0a\0r\0t\0i\0m\0 \0C\0a\0r\0b\0o\0n\0e\0\0\0\0\0\0\0\0\0\1\0na\0\0\0\0\0\0\0\0\2\0\0\0", 140, 1024, ... {status=0x103, info=48}, "\5\0\2\3\20\0\0\00\0\0\0\1\0\0\0\30\0\0\0\0\0\0\0\0\0\0\0\35\325\21]\300%\353F\201\7\276\221\202\21=\23\0\0\0\0", ) , ) == 0x103
 04581   860   NtFsControlFile  (208, 77, 0x0, 0x0, 0x11c017,  (208, 77, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0,\0\0\0\3\0\0\0\24\0\0\0\0\0\0\0\0\0\0\0\35\325\21]\300%\353F\201\7\276\221\202\21=\23", 44, 1024, ... {status=0x103, info=180}, "\5\0\2\3\20\0\0\0\264\0\0\0\2\0\0\0\234\0\0\0\0\0\0\0\270\37\24\0\1\0\0\0\304\37\24\0 \0\0\0\1\0\0\0\16\0\20\0\320\37\24\0\340\37\24\0\10\0\0\0\0\0\0\0\7\0\0\0V\0I\0R\0T\0U\0A\0L\0O\0\4\0\0\0\1\4\0\0\0\0\0\5\25\0\0\0=\343\10MB\307tR\7\345;+\1\0\0\0p\276\24\0\1\0\0\0\1\0\0\0\200\276\24\0\0\0\0\0\0\0\0\0\5\0\0\0\1\5\0\0\0\0\0\5\25\0\0\0=\343\10MB\307tR\7\345;+\353\3\0\0\1\0\0\0\0\0\0\0", ) , 44, 1024, ... {status=0x103, info=180},  (208, 77, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0,\0\0\0\3\0\0\0\24\0\0\0\0\0\0\0\0\0\0\0\35\325\21]\300%\353F\201\7\276\221\202\21=\23", 44, 1024, ... {status=0x103, info=180}, "\5\0\2\3\20\0\0\0\264\0\0\0\2\0\0\0\234\0\0\0\0\0\0\0\270\37\24\0\1\0\0\0\304\37\24\0 \0\0\0\1\0\0\0\16\0\20\0\320\37\24\0\340\37\24\0\10\0\0\0\0\0\0\0\7\0\0\0V\0I\0R\0T\0U\0A\0L\0O\0\4\0\0\0\1\4\0\0\0\0\0\5\25\0\0\0=\343\10MB\307tR\7\345;+\1\0\0\0p\276\24\0\1\0\0\0\1\0\0\0\200\276\24\0\0\0\0\0\0\0\0\0\5\0\0\0\1\5\0\0\0\0\0\5\25\0\0\0=\343\10MB\307tR\7\345;+\353\3\0\0\1\0\0\0\0\0\0\0", ) , ) == 0x103
 04582   860   NtClose  (200, ... ) == 0x0
 04583   860   NtClose  (208, ... ) == 0x0
 04584   860   NtOpenProcessToken  (-1, 0x20008, ... 208, ) == 0x0
 04585   860   NtQueryInformationToken  (208, User, 0, ... ) == STATUS_BUFFER_TOO_SMALL
 04586   860   NtQueryInformationToken  (208, User, 36, ... {token info, class 1, size 36}, 36, ) == 0x0
 04587   860   NtOpenDirectoryObject  (0x2, {24, 0, 0x40, 0, 0,  (0x2, {24, 0, 0x40, 0, 0, "\Windows\WindowStations"}, ... 200, ) }, ... 200, ) == 0x0
 04588   860   NtUserOpenWindowStation  ({24, 200, 0x40, 0, 0,  ({24, 200, 0x40, 0, 0, "winsta0"}, 0x37f, ... ) }, 0x37f, ... ) == 0xcc
 04589   860   NtClose  (200, ... ) == 0x0
 04590   860   NtUserCloseWindowStation  (204, ...
 04591   860   NtClose  (204, ... ) == 0x0
 04590   860   NtUserCloseWindowStation  ... ) == 0x1
 04592   860   NtClose  (208, ... ) == 0x0
 04593   860   NtCreateEvent  (0x1f0003, {24, 0, 0x2, 0, 0, 0x0}, 1, 0, ... 208, ) == 0x0
 04594   860   NtCreateEvent  (0x1f0003, {24, 0, 0x2, 0, 0, 0x0}, 1, 0, ... 204, ) == 0x0
 04595   860   NtCreateMutant  (0x1f0001, {24, 0, 0x2, 0, 0, 0x0}, 0, ... 200, ) == 0x0
 04596   860   NtDuplicateObject  (-1, -1, -1, 0x1f0fff, 2, 0, ... 180, ) == 0x0
 04597   860   NtCreateSection  (0xf0007, {24, 0, 0x2, 0, 0, 0x0}, {7248, 0}, 4, 134217728, 0, ... 212, ) == 0x0
 04598   860   NtMapViewOfSection  (212, -1, (0x0), 0, 0, {0, 0}, 0, 1, 0, 4, ... (0x3d0000), {0, 0}, 8192, ) == 0x0
 04599   860   NtQueryDefaultUILanguage  (1226108, ...
 04600   860   NtOpenThreadTokenEx  (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN
 04601   860   NtOpenProcessTokenEx  (-1, 0x20008, 512, ... -2147482740, ) == 0x0
 04602   860   NtQueryInformationToken  (-2147482740, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0
 04603   860   NtClose  (-2147482740, ... ) == 0x0
 04604   860   NtOpenKey  (0x2000000, {24, 0, 0x640, 0, 0,  (0x2000000, {24, 0, 0x640, 0, 0, "\REGISTRY\USER\S-1-5-21-1292428093-1383384898-725345543-1003"}, ... -2147482740, ) }, ... -2147482740, ) == 0x0
 04605   860   NtOpenKey  (0x80000000, {24, -2147482740, 0x240, 0, 0,  (0x80000000, {24, -2147482740, 0x240, 0, 0, "Software\Policies\Microsoft\Control Panel\Desktop"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 04606   860   NtOpenKey  (0x80000000, {24, -2147482740, 0x640, 0, 0,  (0x80000000, {24, -2147482740, 0x640, 0, 0, "Control Panel\Desktop"}, ... -2147482712, ) }, ... -2147482712, ) == 0x0
 04607   860   NtQueryValueKey  (-2147482712,  (-2147482712, "MultiUILanguageId", Partial, 256, ... ) , Partial, 256, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 04608   860   NtClose  (-2147482712, ... ) == 0x0
 04609   860   NtClose  (-2147482740, ... ) == 0x0
 04599   860   NtQueryDefaultUILanguage  ... ) == 0x0
 04610   860   NtQueryInformationProcess  (-1, DefaultHardErrorMode, 4, ... {process info, class 12, size 4}, 0x0, ) == 0x0
 04611   860   NtSetInformationProcess  (-1, DefaultHardErrorMode, {process info, class 12, size 4}, 4, ... ) == 0x0
 04612   860   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\u:\work\packed.exe"}, 1224352, ... ) }, 1224352, ... ) == 0x0
 04613   860   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\u:\work\packed.exe"}, 1223124, ... ) }, 1223124, ... ) == 0x0
 04614   860   NtQueryInformationProcess  (-1, DefaultHardErrorMode, 4, ... {process info, class 12, size 4}, 0x0, ) == 0x0
 04615   860   NtSetInformationProcess  (-1, DefaultHardErrorMode, {process info, class 12, size 4}, 4, ... ) == 0x0
 04616   860   NtCreateFile  (0x10100080, {24, 0, 0x40, 0, 1225460,  (0x10100080, {24, 0, 0x40, 0, 1225460, "\??\C:\DOCUME~1\MARTIM~1\LOCALS~1\Temp\14e0_appcompat.txt"}, 0x0, 128, 0, 2, 96, 0, 0, ... }, 0x0, 128, 0, 2, 96, 0, 0, ...
 04617   860   NtQueryDirectoryFile  (-2147482740, 0, 0, 0, -518950912, 4096, Names, 1,  (-2147482740, 0, 0, 0, -518950912, 4096, Names, 1, "DOCUME~1", 1, ... {status=0x0, info=56}, ) , 1, ... {status=0x0, info=56}, ) == 0x0
 04618   860   NtClose  (-2147482740, ... ) == 0x0
 04619   860   NtQueryDirectoryFile  (-2147482740, 0, 0, 0, -518950912, 4096, Names, 1,  (-2147482740, 0, 0, 0, -518950912, 4096, Names, 1, "MARTIM~1", 1, ... {status=0x0, info=40}, ) , 1, ... {status=0x0, info=40}, ) == 0x0
 04620   860   NtClose  (-2147482740, ... ) == 0x0
 04621   860   NtQueryDirectoryFile  (-2147482740, 0, 0, 0, -518950912, 4096, Names, 1,  (-2147482740, 0, 0, 0, -518950912, 4096, Names, 1, "LOCALS~1", 1, ... {status=0x0, info=40}, ) , 1, ... {status=0x0, info=40}, ) == 0x0
 04622   860   NtClose  (-2147482740, ... ) == 0x0
 04616   860   NtCreateFile  ... 224, {status=0x0, info=2}, ) == 0x0
 04623   860   NtClose  (224, ... ) == 0x0
 04624   860   NtCreateSection  (0xf001f, 0x0, {4194304, 0}, 4, 67108864, 0, ... 224, ) == 0x0
 04625   860   NtMapViewOfSection  (224, -1, (0x0), 0, 0, 0x0, 4194304, 2, 0, 4, ... (0xac0000), 0x0, 4194304, ) == 0x0
 04626   860   NtAllocateVirtualMemory  (-1, 11272192, 0, 1, 4096, 4, ... 11272192, 4096, ) == 0x0
 04627   860   NtAllocateVirtualMemory  (-1, 11276288, 0, 3104, 4096, 4, ... 11276288, 4096, ) == 0x0
 04628   860   NtCreateSection  (0xf0007, 0x0, {26652, 0}, 4, 134217728, 0, ... 228, ) == 0x0
 04629   860   NtMapViewOfSection  (228, -1, (0x0), 0, 0, {0, 0}, 0, 1, 0, 4, ... (0x3e0000), {0, 0}, 28672, ) == 0x0
 04630   860   NtUnmapViewOfSection  (-1, 0x3e0000, ... ) == 0x0
 04631   860   NtMapViewOfSection  (228, -1, (0x0), 0, 0, {0, 0}, 0, 1, 0, 4, ... (0x3e0000), {0, 0}, 28672, ) == 0x0
 04632   860   NtClose  (224, ... ) == 0x0
 04633   860   NtUnmapViewOfSection  (-1, 0xac0000, ... ) == 0x0
 04634   860   NtUnmapViewOfSection  (-1, 0x3e0000, ... ) == 0x0
 04635   860   NtMapViewOfSection  (228, -1, (0x0), 0, 0, {0, 0}, 0, 1, 0, 4, ... (0x3e0000), {0, 0}, 28672, ) == 0x0
 04636   860   NtUnmapViewOfSection  (-1, 0x3e0000, ... ) == 0x0
 04637   860   NtMapViewOfSection  (228, -1, (0x0), 0, 0, {0, 0}, 0, 1, 0, 4, ... (0x3e0000), {0, 0}, 28672, ) == 0x0
 04638   860   NtUnmapViewOfSection  (-1, 0x3e0000, ... ) == 0x0
 04639   860   NtMapViewOfSection  (228, -1, (0x0), 0, 0, {0, 0}, 0, 1, 0, 4, ... (0x3e0000), {0, 0}, 28672, ) == 0x0
 04640   860   NtUnmapViewOfSection  (-1, 0x3e0000, ... ) == 0x0
 04641   860   NtMapViewOfSection  (228, -1, (0x0), 0, 0, {0, 0}, 0, 1, 0, 4, ... (0x3e0000), {0, 0}, 28672, ) == 0x0
 04642   860   NtUnmapViewOfSection  (-1, 0x3e0000, ... ) == 0x0
 04643   860   NtMapViewOfSection  (228, -1, (0x0), 0, 0, {0, 0}, 0, 1, 0, 4, ... (0x3e0000), {0, 0}, 28672, ) == 0x0
 04644   860   NtUnmapViewOfSection  (-1, 0x3e0000, ... ) == 0x0
 04645   860   NtMapViewOfSection  (228, -1, (0x0), 0, 0, {0, 0}, 0, 1, 0, 4, ... (0x3e0000), {0, 0}, 28672, ) == 0x0
 04646   860   NtUnmapViewOfSection  (-1, 0x3e0000, ... ) == 0x0
 04647   860   NtMapViewOfSection  (228, -1, (0x0), 0, 0, {0, 0}, 0, 1, 0, 4, ... (0x3e0000), {0, 0}, 28672, ) == 0x0
 04648   860   NtUnmapViewOfSection  (-1, 0x3e0000, ... ) == 0x0
 04649   860   NtMapViewOfSection  (228, -1, (0x0), 0, 0, {0, 0}, 0, 1, 0, 4, ... (0x3e0000), {0, 0}, 28672, ) == 0x0
 04650   860   NtUnmapViewOfSection  (-1, 0x3e0000, ... ) == 0x0
 04651   860   NtMapViewOfSection  (228, -1, (0x0), 0, 0, {0, 0}, 0, 1, 0, 4, ... (0x3e0000), {0, 0}, 28672, ) == 0x0
 04652   860   NtUnmapViewOfSection  (-1, 0x3e0000, ... ) == 0x0
 04653   860   NtMapViewOfSection  (228, -1, (0x0), 0, 0, {0, 0}, 0, 1, 0, 4, ... (0x3e0000), {0, 0}, 28672, ) == 0x0
 04654   860   NtUnmapViewOfSection  (-1, 0x3e0000, ... ) == 0x0
 04655   860   NtMapViewOfSection  (228, -1, (0x0), 0, 0, {0, 0}, 0, 1, 0, 4, ... (0x3e0000), {0, 0}, 28672, ) == 0x0
 04656   860   NtUnmapViewOfSection  (-1, 0x3e0000, ... ) == 0x0
 04657   860   NtMapViewOfSection  (228, -1, (0x0), 0, 0, {0, 0}, 0, 1, 0, 4, ... (0x3e0000), {0, 0}, 28672, ) == 0x0
 04658   860   NtUnmapViewOfSection  (-1, 0x3e0000, ... ) == 0x0
 04659   860   NtMapViewOfSection  (228, -1, (0x0), 0, 0, {0, 0}, 0, 1, 0, 4, ... (0x3e0000), {0, 0}, 28672, ) == 0x0
 04660   860   NtUnmapViewOfSection  (-1, 0x3e0000, ... ) == 0x0
 04661   860   NtMapViewOfSection  (228, -1, (0x0), 0, 0, {0, 0}, 0, 1, 0, 4, ... (0x3e0000), {0, 0}, 28672, ) == 0x0
 04662   860   NtUnmapViewOfSection  (-1, 0x3e0000, ... ) == 0x0
 04663   860   NtMapViewOfSection  (228, -1, (0x0), 0, 0, {0, 0}, 0, 1, 0, 4, ... (0x3e0000), {0, 0}, 28672, ) == 0x0
 04664   860   NtUnmapViewOfSection  (-1, 0x3e0000, ... ) == 0x0
 04665   860   NtMapViewOfSection  (228, -1, (0x0), 0, 0, {0, 0}, 0, 1, 0, 4, ... (0x3e0000), {0, 0}, 28672, ) == 0x0
 04666   860   NtUnmapViewOfSection  (-1, 0x3e0000, ... ) == 0x0
 04667   860   NtMapViewOfSection  (228, -1, (0x0), 0, 0, {0, 0}, 0, 1, 0, 4, ... (0x3e0000), {0, 0}, 28672, ) == 0x0
 04668   860   NtUnmapViewOfSection  (-1, 0x3e0000, ... ) == 0x0
 04669   860   NtMapViewOfSection  (228, -1, (0x0), 0, 0, {0, 0}, 0, 1, 0, 4, ... (0x3e0000), {0, 0}, 28672, ) == 0x0
 04670   860   NtUnmapViewOfSection  (-1, 0x3e0000, ... ) == 0x0
 04671   860   NtMapViewOfSection  (228, -1, (0x0), 0, 0, {0, 0}, 0, 1, 0, 4, ... (0x3e0000), {0, 0}, 28672, ) == 0x0
 04672   860   NtUnmapViewOfSection  (-1, 0x3e0000, ... ) == 0x0
 04673   860   NtMapViewOfSection  (228, -1, (0x0), 0, 0, {0, 0}, 0, 1, 0, 4, ... (0x3e0000), {0, 0}, 28672, ) == 0x0
 04674   860   NtUnmapViewOfSection  (-1, 0x3e0000, ... ) == 0x0
 04675   860   NtMapViewOfSection  (228, -1, (0x0), 0, 0, {0, 0}, 0, 1, 0, 4, ... (0x3e0000), {0, 0}, 28672, ) == 0x0
 04676   860   NtUnmapViewOfSection  (-1, 0x3e0000, ... ) == 0x0
 04677   860   NtMapViewOfSection  (228, -1, (0x0), 0, 0, {0, 0}, 0, 1, 0, 4, ... (0x3e0000), {0, 0}, 28672, ) == 0x0
 04678   860   NtUnmapViewOfSection  (-1, 0x3e0000, ... ) == 0x0
 04679   860   NtMapViewOfSection  (228, -1, (0x0), 0, 0, {0, 0}, 0, 1, 0, 4, ... (0x3e0000), {0, 0}, 28672, ) == 0x0
 04680   860   NtUnmapViewOfSection  (-1, 0x3e0000, ... ) == 0x0
 04681   860   NtMapViewOfSection  (228, -1, (0x0), 0, 0, {0, 0}, 0, 1, 0, 4, ... (0x3e0000), {0, 0}, 28672, ) == 0x0
 04682   860   NtUnmapViewOfSection  (-1, 0x3e0000, ... ) == 0x0
 04683   860   NtMapViewOfSection  (228, -1, (0x0), 0, 0, {0, 0}, 0, 1, 0, 4, ... (0x3e0000), {0, 0}, 28672, ) == 0x0
 04684   860   NtUnmapViewOfSection  (-1, 0x3e0000, ... ) == 0x0
 04685   860   NtMapViewOfSection  (228, -1, (0x0), 0, 0, {0, 0}, 0, 1, 0, 4, ... (0x3e0000), {0, 0}, 28672, ) == 0x0
 04686   860   NtUnmapViewOfSection  (-1, 0x3e0000, ... ) == 0x0
 04687   860   NtClose  (228, ... ) == 0x0
 04688   860   NtQueryInformationProcess  (-1, DeviceMap, 36, ... {process info, class 23, size 36}, 0x0, ) == 0x0
 04689   860   NtOpenFile  (0x100080, {24, 0, 0x40, 0, 0,  (0x100080, {24, 0, 0x40, 0, 0, "\??\u:"}, 3, 96, ... 228, {status=0x0, info=1}, ) }, 3, 96, ... 228, {status=0x0, info=1}, ) == 0x0
 04690   860   NtOpenSymbolicLinkObject  (0x1, {24, 0, 0x40, 0, 0,  (0x1, {24, 0, 0x40, 0, 0, "\??\u:"}, ... 224, ) }, ... 224, ) == 0x0
 04691   860   NtQuerySymbolicLinkObject  (224, ...  (224, ... "\Device\WinDfs\U:0000000000009f43", 66, ) , 66, ) == 0x0
 04692   860   NtClose  (224, ... ) == 0x0
 04693   860   NtQueryVolumeInformationFile  (228, 1224676, 8, Device, ... {status=0x0, info=8}, ) == 0x0
 04694   860   NtClose  (228, ... ) == 0x0
 04695   860   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\apphelp.dll"}, 1223472, ... ) }, 1223472, ... ) == 0x0
 04696   860   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\u:\work\packed.exe"}, 1225168, ... ) }, 1225168, ... ) == 0x0
 04697   860   NtCreateFile  (0x40100080, {24, 0, 0x40, 0, 1225176,  (0x40100080, {24, 0, 0x40, 0, 1225176, "\??\C:\DOCUME~1\MARTIM~1\LOCALS~1\Temp\14e0_appcompat.txt"}, 0x0, 128, 0, 5, 96, 0, 0, ... }, 0x0, 128, 0, 5, 96, 0, 0, ...
 04698   860   NtClose  (-2147482740, ... ) == 0x0
 04699   860   NtQueryDirectoryFile  (-2147482740, 0, 0, 0, -518950912, 4096, Names, 1,  (-2147482740, 0, 0, 0, -518950912, 4096, Names, 1, "DOCUME~1", 1, ... {status=0x0, info=56}, ) , 1, ... {status=0x0, info=56}, ) == 0x0
 04700   860   NtClose  (-2147482740, ... ) == 0x0
 04701   860   NtQueryDirectoryFile  (-2147482740, 0, 0, 0, -518950912, 4096, Names, 1,  (-2147482740, 0, 0, 0, -518950912, 4096, Names, 1, "MARTIM~1", 1, ... {status=0x0, info=40}, ) , 1, ... {status=0x0, info=40}, ) == 0x0
 04702   860   NtClose  (-2147482740, ... ) == 0x0
 04703   860   NtQueryDirectoryFile  (-2147482740, 0, 0, 0, -518950912, 4096, Names, 1,  (-2147482740, 0, 0, 0, -518950912, 4096, Names, 1, "LOCALS~1", 1, ... {status=0x0, info=40}, ) , 1, ... {status=0x0, info=40}, ) == 0x0
 04704   860   NtClose  (-2147482740, ... ) == 0x0
 04697   860   NtCreateFile  ... 228, {status=0x0, info=3}, ) == 0x0
 04705   860   NtAllocateVirtualMemory  (-1, 1396736, 0, 12288, 4096, 4, ... 1396736, 12288, ) == 0x0
 04706   860   NtOpenFile  (0x100001, {24, 0, 0x40, 0, 0,  (0x100001, {24, 0, 0x40, 0, 0, "\??\u:\work\"}, 3, 16417, ... 224, {status=0x0, info=1}, ) }, 3, 16417, ... 224, {status=0x0, info=1}, ) == 0x0
 04707   860   NtQueryDirectoryFile  (224, 0, 0, 0, 1223880, 616, BothDirectory, 1,  (224, 0, 0, 0, 1223880, 616, BothDirectory, 1, "packed.exe", 0, ... {status=0x0, info=120}, ) , 0, ... {status=0x0, info=120}, ) == 0x0
 04708   860   NtWriteFile  (228, 0, 0, 0,  (228, 0, 0, 0, "\377\376", 2, 0x0, 0, ... {status=0x0, info=2}, ) , 2, 0x0, 0, ... {status=0x0, info=2}, ) == 0x0
 04709   860   NtWriteFile  (228, 0, 0, 0,  (228, 0, 0, 0, "<\0?\0x\0m\0l\0 \0v\0e\0r\0s\0i\0o\0n\0=\0"\01\0.\00\0"\0 \0e\0n\0c\0o\0d\0i\0n\0g\0=\0"\0U\0T\0F\0-\01\06\0"\0?\0>\0\15\0\12\0<\0D\0A\0T\0A\0B\0A\0S\0E\0>\0\15\0\12\0", 106, 0x0, 0, ... {status=0x0, info=106}, ) \01\0.\00\0 (228, 0, 0, 0, "<\0?\0x\0m\0l\0 \0v\0e\0r\0s\0i\0o\0n\0=\0"\01\0.\00\0"\0 \0e\0n\0c\0o\0d\0i\0n\0g\0=\0"\0U\0T\0F\0-\01\06\0"\0?\0>\0\15\0\12\0<\0D\0A\0T\0A\0B\0A\0S\0E\0>\0\15\0\12\0", 106, 0x0, 0, ... {status=0x0, info=106}, ) \0U\0T\0F\0-\01\06\0 (228, 0, 0, 0, "<\0?\0x\0m\0l\0 \0v\0e\0r\0s\0i\0o\0n\0=\0"\01\0.\00\0"\0 \0e\0n\0c\0o\0d\0i\0n\0g\0=\0"\0U\0T\0F\0-\01\06\0"\0?\0>\0\15\0\12\0<\0D\0A\0T\0A\0B\0A\0S\0E\0>\0\15\0\12\0", 106, 0x0, 0, ... {status=0x0, info=106}, ) , 106, 0x0, 0, ... {status=0x0, info=106}, ) == 0x0
 04710   860   NtWriteFile  (228, 0, 0, 0,  (228, 0, 0, 0, "<\0E\0X\0E\0 \0N\0A\0M\0E\0=\0"\0p\0a\0c\0k\0e\0d\0.\0e\0x\0e\0"\0 \0F\0I\0L\0T\0E\0R\0=\0"\0G\0R\0A\0B\0M\0I\0_\0F\0I\0L\0T\0E\0R\0_\0T\0H\0I\0S\0F\0I\0L\0E\0O\0N\0L\0Y\0"\0>\0\15\0\12\0", 122, 0x0, 0, ... {status=0x0, info=122}, ) \0p\0a\0c\0k\0e\0d\0.\0e\0x\0e\0 (228, 0, 0, 0, "<\0E\0X\0E\0 \0N\0A\0M\0E\0=\0"\0p\0a\0c\0k\0e\0d\0.\0e\0x\0e\0"\0 \0F\0I\0L\0T\0E\0R\0=\0"\0G\0R\0A\0B\0M\0I\0_\0F\0I\0L\0T\0E\0R\0_\0T\0H\0I\0S\0F\0I\0L\0E\0O\0N\0L\0Y\0"\0>\0\15\0\12\0", 122, 0x0, 0, ... {status=0x0, info=122}, ) \0G\0R\0A\0B\0M\0I\0_\0F\0I\0L\0T\0E\0R\0_\0T\0H\0I\0S\0F\0I\0L\0E\0O\0N\0L\0Y\0 (228, 0, 0, 0, "<\0E\0X\0E\0 \0N\0A\0M\0E\0=\0"\0p\0a\0c\0k\0e\0d\0.\0e\0x\0e\0"\0 \0F\0I\0L\0T\0E\0R\0=\0"\0G\0R\0A\0B\0M\0I\0_\0F\0I\0L\0T\0E\0R\0_\0T\0H\0I\0S\0F\0I\0L\0E\0O\0N\0L\0Y\0"\0>\0\15\0\12\0", 122, 0x0, 0, ... {status=0x0, info=122}, ) , 122, 0x0, 0, ... {status=0x0, info=122}, ) == 0x0
 04711   860   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\u:\work\packed.exe"}, 1224260, ... ) }, 1224260, ... ) == 0x0
 04712   860   NtOpenFile  (0x100001, {24, 0, 0x40, 0, 0,  (0x100001, {24, 0, 0x40, 0, 0, "\??\u:\work"}, 3, 16417, ... 216, {status=0x0, info=1}, ) }, 3, 16417, ... 216, {status=0x0, info=1}, ) == 0x0
 04713   860   NtQueryDirectoryFile  (216, 0, 0, 0, 1223872, 592, Directory, 1,  (216, 0, 0, 0, 1223872, 592, Directory, 1, "packed.exe", 0, ... {status=0x0, info=84}, ) , 0, ... {status=0x0, info=84}, ) == 0x0
 04714   860   NtClose  (216, ... ) == 0x0
 04715   860   NtQueryInformationProcess  (-1, DefaultHardErrorMode, 4, ... {process info, class 12, size 4}, 0x0, ) == 0x0
 04716   860   NtSetInformationProcess  (-1, DefaultHardErrorMode, {process info, class 12, size 4}, 4, ... ) == 0x0
 04717   860   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\u:\work\packed.exe"}, 1222792, ... ) }, 1222792, ... ) == 0x0
 04718   860   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\u:\work\packed.exe"}, 1221564, ... ) }, 1221564, ... ) == 0x0
 04719   860   NtQueryInformationProcess  (-1, DefaultHardErrorMode, 4, ... {process info, class 12, size 4}, 0x0, ) == 0x0
 04720   860   NtSetInformationProcess  (-1, DefaultHardErrorMode, {process info, class 12, size 4}, 4, ... ) == 0x0
 04721   860   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\U:\WORK\PACKED.EXE"}, 1224128, ... ) }, 1224128, ... ) == 0x0
 04722   860   NtOpenFile  (0x100100, {24, 0, 0x40, 0, 0,  (0x100100, {24, 0, 0x40, 0, 0, "\??\U:\WORK\PACKED.EXE"}, 7, 2113568, ... 216, {status=0x0, info=1}, ) }, 7, 2113568, ... 216, {status=0x0, info=1}, ) == 0x0
 04723   860   NtSetInformationFile  (216, 1224104, 40, Basic, ... ) == STATUS_ACCESS_DENIED
 04724   860   NtClose  (216, ... ) == 0x0
 04725   860   NtCreateFile  (0x80100080, {24, 0, 0x40, 0, 0,  (0x80100080, {24, 0, 0x40, 0, 0, "\??\u:\work\packed.exe"}, 0x0, 128, 1, 1, 96, 0, 0, ... 216, {status=0x0, info=1}, ) }, 0x0, 128, 1, 1, 96, 0, 0, ... 216, {status=0x0, info=1}, ) == 0x0
 04726   860   NtQueryInformationFile  (216, 1224348, 24, Standard, ... {status=0x0, info=24}, ) == 0x0
 04727   860   NtCreateSection  (0x4, 0x0, 0x0, 2, 134217728, 216, ... 220, ) == 0x0
 04728   860   NtMapViewOfSection  (220, -1, (0x0), 0, 0, 0x0, 0, 2, 0, 2, ... (0x9b0000), 0x0, 204800, ) == 0x0
 04729   860   NtUnmapViewOfSection  (-1, 0x9b0000, ... ) == 0x0
 04730   860   NtClose  (220, ... ) == 0x0
 04731   860   NtClose  (216, ... ) == 0x0
 04732   860   NtWriteFile  (228, 0, 0, 0,  (228, 0, 0, 0, " \0 \0 \0 \0<\0M\0A\0T\0C\0H\0I\0N\0G\0_\0F\0I\0L\0E\0 \0N\0A\0M\0E\0=\0"\0p\0a\0c\0k\0e\0d\0.\0e\0x\0e\0"\0 \0S\0I\0Z\0E\0=\0"\02\00\03\07\07\06\0"\0 \0C\0H\0E\0C\0K\0S\0U\0M\0=\0"\00\0x\0E\08\0A\0E\07\01\0B\06\0"\0 \0M\0O\0D\0U\0L\0E\0_\0T\0Y\0P\0E\0=\0"\0W\0I\0N\03\02\0"\0 \0P\0E\0_\0C\0H\0E\0C\0K\0S\0U\0M\0=\0"\00\0x\00\0"\0 \0L\0I\0N\0K\0E\0R\0_\0V\0E\0R\0S\0I\0O\0N\0=\0"\00\0x\00\0"\0 \0L\0I\0N\0K\0_\0D\0A\0T\0E\0=\0"\00\02\0/\02\00\0/\02\00\00\08\0 \00\06\0:\00\07\0:\05\03\0"\0 \0U\0P\0T\0O\0_\0L\0I\0N\0K\0_\0D\0A\0T\0E\0=\0"\00\02\0/\02\00\0/\02\00\00\08\0 \00\06\0:\00\07\0:\05\03\0"\0 \0/\0>\0\15\0\12\0", 410, 0x0, 0, ... \0p\0a\0c\0k\0e\0d\0.\0e\0x\0e\0 (228, 0, 0, 0, " \0 \0 \0 \0<\0M\0A\0T\0C\0H\0I\0N\0G\0_\0F\0I\0L\0E\0 \0N\0A\0M\0E\0=\0"\0p\0a\0c\0k\0e\0d\0.\0e\0x\0e\0"\0 \0S\0I\0Z\0E\0=\0"\02\00\03\07\07\06\0"\0 \0C\0H\0E\0C\0K\0S\0U\0M\0=\0"\00\0x\0E\08\0A\0E\07\01\0B\06\0"\0 \0M\0O\0D\0U\0L\0E\0_\0T\0Y\0P\0E\0=\0"\0W\0I\0N\03\02\0"\0 \0P\0E\0_\0C\0H\0E\0C\0K\0S\0U\0M\0=\0"\00\0x\00\0"\0 \0L\0I\0N\0K\0E\0R\0_\0V\0E\0R\0S\0I\0O\0N\0=\0"\00\0x\00\0"\0 \0L\0I\0N\0K\0_\0D\0A\0T\0E\0=\0"\00\02\0/\02\00\0/\02\00\00\08\0 \00\06\0:\00\07\0:\05\03\0"\0 \0U\0P\0T\0O\0_\0L\0I\0N\0K\0_\0D\0A\0T\0E\0=\0"\00\02\0/\02\00\0/\02\00\00\08\0 \00\06\0:\00\07\0:\05\03\0"\0 \0/\0>\0\15\0\12\0", 410, 0x0, 0, ... \02\00\03\07\07\06\0 (228, 0, 0, 0, " \0 \0 \0 \0<\0M\0A\0T\0C\0H\0I\0N\0G\0_\0F\0I\0L\0E\0 \0N\0A\0M\0E\0=\0"\0p\0a\0c\0k\0e\0d\0.\0e\0x\0e\0"\0 \0S\0I\0Z\0E\0=\0"\02\00\03\07\07\06\0"\0 \0C\0H\0E\0C\0K\0S\0U\0M\0=\0"\00\0x\0E\08\0A\0E\07\01\0B\06\0"\0 \0M\0O\0D\0U\0L\0E\0_\0T\0Y\0P\0E\0=\0"\0W\0I\0N\03\02\0"\0 \0P\0E\0_\0C\0H\0E\0C\0K\0S\0U\0M\0=\0"\00\0x\00\0"\0 \0L\0I\0N\0K\0E\0R\0_\0V\0E\0R\0S\0I\0O\0N\0=\0"\00\0x\00\0"\0 \0L\0I\0N\0K\0_\0D\0A\0T\0E\0=\0"\00\02\0/\02\00\0/\02\00\00\08\0 \00\06\0:\00\07\0:\05\03\0"\0 \0U\0P\0T\0O\0_\0L\0I\0N\0K\0_\0D\0A\0T\0E\0=\0"\00\02\0/\02\00\0/\02\00\00\08\0 \00\06\0:\00\07\0:\05\03\0"\0 \0/\0>\0\15\0\12\0", 410, 0x0, 0, ... \00\0x\0E\08\0A\0E\07\01\0B\06\0 (228, 0, 0, 0, " \0 \0 \0 \0<\0M\0A\0T\0C\0H\0I\0N\0G\0_\0F\0I\0L\0E\0 \0N\0A\0M\0E\0=\0"\0p\0a\0c\0k\0e\0d\0.\0e\0x\0e\0"\0 \0S\0I\0Z\0E\0=\0"\02\00\03\07\07\06\0"\0 \0C\0H\0E\0C\0K\0S\0U\0M\0=\0"\00\0x\0E\08\0A\0E\07\01\0B\06\0"\0 \0M\0O\0D\0U\0L\0E\0_\0T\0Y\0P\0E\0=\0"\0W\0I\0N\03\02\0"\0 \0P\0E\0_\0C\0H\0E\0C\0K\0S\0U\0M\0=\0"\00\0x\00\0"\0 \0L\0I\0N\0K\0E\0R\0_\0V\0E\0R\0S\0I\0O\0N\0=\0"\00\0x\00\0"\0 \0L\0I\0N\0K\0_\0D\0A\0T\0E\0=\0"\00\02\0/\02\00\0/\02\00\00\08\0 \00\06\0:\00\07\0:\05\03\0"\0 \0U\0P\0T\0O\0_\0L\0I\0N\0K\0_\0D\0A\0T\0E\0=\0"\00\02\0/\02\00\0/\02\00\00\08\0 \00\06\0:\00\07\0:\05\03\0"\0 \0/\0>\0\15\0\12\0", 410, 0x0, 0, ... \0W\0I\0N\03\02\0 (228, 0, 0, 0, " \0 \0 \0 \0<\0M\0A\0T\0C\0H\0I\0N\0G\0_\0F\0I\0L\0E\0 \0N\0A\0M\0E\0=\0"\0p\0a\0c\0k\0e\0d\0.\0e\0x\0e\0"\0 \0S\0I\0Z\0E\0=\0"\02\00\03\07\07\06\0"\0 \0C\0H\0E\0C\0K\0S\0U\0M\0=\0"\00\0x\0E\08\0A\0E\07\01\0B\06\0"\0 \0M\0O\0D\0U\0L\0E\0_\0T\0Y\0P\0E\0=\0"\0W\0I\0N\03\02\0"\0 \0P\0E\0_\0C\0H\0E\0C\0K\0S\0U\0M\0=\0"\00\0x\00\0"\0 \0L\0I\0N\0K\0E\0R\0_\0V\0E\0R\0S\0I\0O\0N\0=\0"\00\0x\00\0"\0 \0L\0I\0N\0K\0_\0D\0A\0T\0E\0=\0"\00\02\0/\02\00\0/\02\00\00\08\0 \00\06\0:\00\07\0:\05\03\0"\0 \0U\0P\0T\0O\0_\0L\0I\0N\0K\0_\0D\0A\0T\0E\0=\0"\00\02\0/\02\00\0/\02\00\00\08\0 \00\06\0:\00\07\0:\05\03\0"\0 \0/\0>\0\15\0\12\0", 410, 0x0, 0, ... \00\0x\00\0 (228, 0, 0, 0, " \0 \0 \0 \0<\0M\0A\0T\0C\0H\0I\0N\0G\0_\0F\0I\0L\0E\0 \0N\0A\0M\0E\0=\0"\0p\0a\0c\0k\0e\0d\0.\0e\0x\0e\0"\0 \0S\0I\0Z\0E\0=\0"\02\00\03\07\07\06\0"\0 \0C\0H\0E\0C\0K\0S\0U\0M\0=\0"\00\0x\0E\08\0A\0E\07\01\0B\06\0"\0 \0M\0O\0D\0U\0L\0E\0_\0T\0Y\0P\0E\0=\0"\0W\0I\0N\03\02\0"\0 \0P\0E\0_\0C\0H\0E\0C\0K\0S\0U\0M\0=\0"\00\0x\00\0"\0 \0L\0I\0N\0K\0E\0R\0_\0V\0E\0R\0S\0I\0O\0N\0=\0"\00\0x\00\0"\0 \0L\0I\0N\0K\0_\0D\0A\0T\0E\0=\0"\00\02\0/\02\00\0/\02\00\00\08\0 \00\06\0:\00\07\0:\05\03\0"\0 \0U\0P\0T\0O\0_\0L\0I\0N\0K\0_\0D\0A\0T\0E\0=\0"\00\02\0/\02\00\0/\02\00\00\08\0 \00\06\0:\00\07\0:\05\03\0"\0 \0/\0>\0\15\0\12\0", 410, 0x0, 0, ... \00\0x\00\0 (228, 0, 0, 0, " \0 \0 \0 \0<\0M\0A\0T\0C\0H\0I\0N\0G\0_\0F\0I\0L\0E\0 \0N\0A\0M\0E\0=\0"\0p\0a\0c\0k\0e\0d\0.\0e\0x\0e\0"\0 \0S\0I\0Z\0E\0=\0"\02\00\03\07\07\06\0"\0 \0C\0H\0E\0C\0K\0S\0U\0M\0=\0"\00\0x\0E\08\0A\0E\07\01\0B\06\0"\0 \0M\0O\0D\0U\0L\0E\0_\0T\0Y\0P\0E\0=\0"\0W\0I\0N\03\02\0"\0 \0P\0E\0_\0C\0H\0E\0C\0K\0S\0U\0M\0=\0"\00\0x\00\0"\0 \0L\0I\0N\0K\0E\0R\0_\0V\0E\0R\0S\0I\0O\0N\0=\0"\00\0x\00\0"\0 \0L\0I\0N\0K\0_\0D\0A\0T\0E\0=\0"\00\02\0/\02\00\0/\02\00\00\08\0 \00\06\0:\00\07\0:\05\03\0"\0 \0U\0P\0T\0O\0_\0L\0I\0N\0K\0_\0D\0A\0T\0E\0=\0"\00\02\0/\02\00\0/\02\00\00\08\0 \00\06\0:\00\07\0:\05\03\0"\0 \0/\0>\0\15\0\12\0", 410, 0x0, 0, ... \00\02\0/\02\00\0/\02\00\00\08\0 \00\06\0:\00\07\0:\05\03\0 (228, 0, 0, 0, " \0 \0 \0 \0<\0M\0A\0T\0C\0H\0I\0N\0G\0_\0F\0I\0L\0E\0 \0N\0A\0M\0E\0=\0"\0p\0a\0c\0k\0e\0d\0.\0e\0x\0e\0"\0 \0S\0I\0Z\0E\0=\0"\02\00\03\07\07\06\0"\0 \0C\0H\0E\0C\0K\0S\0U\0M\0=\0"\00\0x\0E\08\0A\0E\07\01\0B\06\0"\0 \0M\0O\0D\0U\0L\0E\0_\0T\0Y\0P\0E\0=\0"\0W\0I\0N\03\02\0"\0 \0P\0E\0_\0C\0H\0E\0C\0K\0S\0U\0M\0=\0"\00\0x\00\0"\0 \0L\0I\0N\0K\0E\0R\0_\0V\0E\0R\0S\0I\0O\0N\0=\0"\00\0x\00\0"\0 \0L\0I\0N\0K\0_\0D\0A\0T\0E\0=\0"\00\02\0/\02\00\0/\02\00\00\08\0 \00\06\0:\00\07\0:\05\03\0"\0 \0U\0P\0T\0O\0_\0L\0I\0N\0K\0_\0D\0A\0T\0E\0=\0"\00\02\0/\02\00\0/\02\00\00\08\0 \00\06\0:\00\07\0:\05\03\0"\0 \0/\0>\0\15\0\12\0", 410, 0x0, 0, ... \00\02\0/\02\00\0/\02\00\00\08\0 \00\06\0:\00\07\0:\05\03\0 (228, 0, 0, 0, " \0 \0 \0 \0<\0M\0A\0T\0C\0H\0I\0N\0G\0_\0F\0I\0L\0E\0 \0N\0A\0M\0E\0=\0"\0p\0a\0c\0k\0e\0d\0.\0e\0x\0e\0"\0 \0S\0I\0Z\0E\0=\0"\02\00\03\07\07\06\0"\0 \0C\0H\0E\0C\0K\0S\0U\0M\0=\0"\00\0x\0E\08\0A\0E\07\01\0B\06\0"\0 \0M\0O\0D\0U\0L\0E\0_\0T\0Y\0P\0E\0=\0"\0W\0I\0N\03\02\0"\0 \0P\0E\0_\0C\0H\0E\0C\0K\0S\0U\0M\0=\0"\00\0x\00\0"\0 \0L\0I\0N\0K\0E\0R\0_\0V\0E\0R\0S\0I\0O\0N\0=\0"\00\0x\00\0"\0 \0L\0I\0N\0K\0_\0D\0A\0T\0E\0=\0"\00\02\0/\02\00\0/\02\00\00\08\0 \00\06\0:\00\07\0:\05\03\0"\0 \0U\0P\0T\0O\0_\0L\0I\0N\0K\0_\0D\0A\0T\0E\0=\0"\00\02\0/\02\00\0/\02\00\00\08\0 \00\06\0:\00\07\0:\05\03\0"\0 \0/\0>\0\15\0\12\0", 410, 0x0, 0, ... , 410, 0x0, 0, ...
 04733   860   NtContinue  (-139618732, 0, ...
 04732   860   NtWriteFile  ... {status=0x0, info=410}, ) == 0x0
 04734   860   NtQueryDirectoryFile  (224, 0, 0, 0, 1362792, 4096, BothDirectory, 0, 0x0, 0, ... ) == STATUS_NO_MORE_FILES
 04735   860   NtClose  (224, ... ) == 0x0
 04736   860   NtWriteFile  (228, 0, 0, 0,  (228, 0, 0, 0, "<\0/\0E\0X\0E\0>\0\15\0\12\0", 16, 0x0, 0, ... {status=0x0, info=16}, ) , 16, 0x0, 0, ... {status=0x0, info=16}, ) == 0x0
 04737   860   NtClose  (228, ... ) == 0x0
 04738   860   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\kernel32.dll"}, 1225168, ... ) }, 1225168, ... ) == 0x0
 04739   860   NtCreateFile  (0x40100080, {24, 0, 0x40, 0, 1225176,  (0x40100080, {24, 0, 0x40, 0, 1225176, "\??\C:\DOCUME~1\MARTIM~1\LOCALS~1\Temp\14e0_appcompat.txt"}, 0x0, 128, 0, 3, 96, 0, 0, ... 228, {status=0x0, info=1}, ) }, 0x0, 128, 0, 3, 96, 0, 0, ... 228, {status=0x0, info=1}, ) == 0x0
 04740   860   NtQueryInformationFile  (228, 1225200, 24, Standard, ... {status=0x0, info=24}, ) == 0x0
 04741   860   NtSetInformationFile  (228, 1225232, 8, Position, ... {status=0x0, info=0}, ) == 0x0
 04742   860   NtOpenFile  (0x100001, {24, 0, 0x40, 0, 0,  (0x100001, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\"}, 3, 16417, ... 224, {status=0x0, info=1}, ) }, 3, 16417, ... 224, {status=0x0, info=1}, ) == 0x0
 04743   860   NtQueryDirectoryFile  (224, 0, 0, 0, 1223880, 616, BothDirectory, 1,  (224, 0, 0, 0, 1223880, 616, BothDirectory, 1, "kernel32.dll", 0, ... {status=0x0, info=118}, ) , 0, ... {status=0x0, info=118}, ) == 0x0
 04744   860   NtWriteFile  (228, 0, 0, 0,  (228, 0, 0, 0, "<\0E\0X\0E\0 \0N\0A\0M\0E\0=\0"\0k\0e\0r\0n\0e\0l\03\02\0.\0d\0l\0l\0"\0 \0F\0I\0L\0T\0E\0R\0=\0"\0G\0R\0A\0B\0M\0I\0_\0F\0I\0L\0T\0E\0R\0_\0T\0H\0I\0S\0F\0I\0L\0E\0O\0N\0L\0Y\0"\0>\0\15\0\12\0", 126, 0x0, 0, ... {status=0x0, info=126}, ) \0k\0e\0r\0n\0e\0l\03\02\0.\0d\0l\0l\0 (228, 0, 0, 0, "<\0E\0X\0E\0 \0N\0A\0M\0E\0=\0"\0k\0e\0r\0n\0e\0l\03\02\0.\0d\0l\0l\0"\0 \0F\0I\0L\0T\0E\0R\0=\0"\0G\0R\0A\0B\0M\0I\0_\0F\0I\0L\0T\0E\0R\0_\0T\0H\0I\0S\0F\0I\0L\0E\0O\0N\0L\0Y\0"\0>\0\15\0\12\0", 126, 0x0, 0, ... {status=0x0, info=126}, ) \0G\0R\0A\0B\0M\0I\0_\0F\0I\0L\0T\0E\0R\0_\0T\0H\0I\0S\0F\0I\0L\0E\0O\0N\0L\0Y\0 (228, 0, 0, 0, "<\0E\0X\0E\0 \0N\0A\0M\0E\0=\0"\0k\0e\0r\0n\0e\0l\03\02\0.\0d\0l\0l\0"\0 \0F\0I\0L\0T\0E\0R\0=\0"\0G\0R\0A\0B\0M\0I\0_\0F\0I\0L\0T\0E\0R\0_\0T\0H\0I\0S\0F\0I\0L\0E\0O\0N\0L\0Y\0"\0>\0\15\0\12\0", 126, 0x0, 0, ... {status=0x0, info=126}, ) , 126, 0x0, 0, ... {status=0x0, info=126}, ) == 0x0
 04745   860   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\kernel32.dll"}, 1224232, ... ) }, 1224232, ... ) == 0x0
 04746   860   NtOpenFile  (0x100001, {24, 0, 0x40, 0, 0,  (0x100001, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32"}, 3, 16417, ... 216, {status=0x0, info=1}, ) }, 3, 16417, ... 216, {status=0x0, info=1}, ) == 0x0
 04747   860   NtQueryDirectoryFile  (216, 0, 0, 0, 1223872, 592, Directory, 1,  (216, 0, 0, 0, 1223872, 592, Directory, 1, "kernel32.dll", 0, ... {status=0x0, info=88}, ) , 0, ... {status=0x0, info=88}, ) == 0x0
 04748   860   NtClose  (216, ... ) == 0x0
 04749   860   NtQueryInformationProcess  (-1, DefaultHardErrorMode, 4, ... {process info, class 12, size 4}, 0x0, ) == 0x0
 04750   860   NtSetInformationProcess  (-1, DefaultHardErrorMode, {process info, class 12, size 4}, 4, ... ) == 0x0
 04751   860   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\kernel32.dll"}, 1222792, ... ) }, 1222792, ... ) == 0x0
 04752   860   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\kernel32.dll"}, 1221564, ... ) }, 1221564, ... ) == 0x0
 04753   860   NtQueryInformationProcess  (-1, DefaultHardErrorMode, 4, ... {process info, class 12, size 4}, 0x0, ) == 0x0
 04754   860   NtSetInformationProcess  (-1, DefaultHardErrorMode, {process info, class 12, size 4}, 4, ... ) == 0x0
 04755   860   NtQueryDefaultLocale  (1, 1223752, ... ) == 0x0
 04756   860   NtQueryInformationProcess  (-1, DefaultHardErrorMode, 4, ... {process info, class 12, size 4}, 0x0, ) == 0x0
 04757   860   NtSetInformationProcess  (-1, DefaultHardErrorMode, {process info, class 12, size 4}, 4, ... ) == 0x0
 04758   860   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\kernel32.dll"}, 1222784, ... ) }, 1222784, ... ) == 0x0
 04759   860   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\kernel32.dll"}, 1221556, ... ) }, 1221556, ... ) == 0x0
 04760   860   NtQueryInformationProcess  (-1, DefaultHardErrorMode, 4, ... {process info, class 12, size 4}, 0x0, ) == 0x0
 04761   860   NtSetInformationProcess  (-1, DefaultHardErrorMode, {process info, class 12, size 4}, 4, ... ) == 0x0
 04762   860   NtQueryDefaultLocale  (1, 1223744, ... ) == 0x0
 04763   860   NtCreateFile  (0x80100080, {24, 0, 0x40, 0, 0,  (0x80100080, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\kernel32.dll"}, 0x0, 128, 1, 1, 96, 0, 0, ... 216, {status=0x0, info=1}, ) }, 0x0, 128, 1, 1, 96, 0, 0, ... 216, {status=0x0, info=1}, ) == 0x0
 04764   860   NtQueryInformationFile  (216, 1224348, 24, Standard, ... {status=0x0, info=24}, ) == 0x0
 04765   860   NtCreateSection  (0x4, 0x0, 0x0, 2, 134217728, 216, ... 220, ) == 0x0
 04766   860   NtMapViewOfSection  (220, -1, (0x0), 0, 0, 0x0, 0, 2, 0, 2, ... (0xac0000), 0x0, 987136, ) == 0x0
 04767   860   NtUnmapViewOfSection  (-1, 0xac0000, ... ) == 0x0
 04768   860   NtClose  (220, ... ) == 0x0
 04769   860   NtClose  (216, ... ) == 0x0
 04770   860   NtQueryDefaultUILanguage  (1223704, ...
 04771   860   NtOpenThreadTokenEx  (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN
 04772   860   NtOpenProcessTokenEx  (-1, 0x20008, 512, ... -2147482740, ) == 0x0
 04773   860   NtQueryInformationToken  (-2147482740, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0
 04774   860   NtClose  (-2147482740, ... ) == 0x0
 04775   860   NtOpenKey  (0x2000000, {24, 0, 0x640, 0, 0,  (0x2000000, {24, 0, 0x640, 0, 0, "\REGISTRY\USER\S-1-5-21-1292428093-1383384898-725345543-1003"}, ... -2147482740, ) }, ... -2147482740, ) == 0x0
 04776   860   NtOpenKey  (0x80000000, {24, -2147482740, 0x240, 0, 0,  (0x80000000, {24, -2147482740, 0x240, 0, 0, "Software\Policies\Microsoft\Control Panel\Desktop"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 04777   860   NtOpenKey  (0x80000000, {24, -2147482740, 0x640, 0, 0,  (0x80000000, {24, -2147482740, 0x640, 0, 0, "Control Panel\Desktop"}, ... -2147482712, ) }, ... -2147482712, ) == 0x0
 04778   860   NtQueryValueKey  (-2147482712,  (-2147482712, "MultiUILanguageId", Partial, 256, ... ) , Partial, 256, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 04779   860   NtClose  (-2147482712, ... ) == 0x0
 04780   860   NtClose  (-2147482740, ... ) == 0x0
 04770   860   NtQueryDefaultUILanguage  ... ) == 0x0
 04781   860   NtWriteFile  (228, 0, 0, 0,  (228, 0, 0, 0, " \0 \0 \0 \0<\0M\0A\0T\0C\0H\0I\0N\0G\0_\0F\0I\0L\0E\0 \0N\0A\0M\0E\0=\0"\0k\0e\0r\0n\0e\0l\03\02\0.\0d\0l\0l\0"\0 \0S\0I\0Z\0E\0=\0"\09\08\04\05\07\06\0"\0 \0C\0H\0E\0C\0K\0S\0U\0M\0=\0"\00\0x\0F\00\0B\03\03\01\0F\06\0"\0 \0B\0I\0N\0_\0F\0I\0L\0E\0_\0V\0E\0R\0S\0I\0O\0N\0=\0"\05\0.\01\0.\02\06\00\00\0.\03\01\01\09\0"\0 \0B\0I\0N\0_\0P\0R\0O\0D\0U\0C\0T\0_\0V\0E\0R\0S\0I\0O\0N\0=\0"\05\0.\01\0.\02\06\00\00\0.\03\01\01\09\0"\0 \0P\0R\0O\0D\0U\0C\0T\0_\0V\0E\0R\0S\0I\0O\0N\0=\0"\05\0.\01\0.\02\06\00\00\0.\03\01\01\09\0"\0 \0F\0I\0L\0E\0_\0D\0E\0S\0C\0R\0I\0P\0T\0I\0O\0N\0=\0"\0W\0i\0n\0d\0o\0w\0s\0 \0N\0T\0 \0B\0A\0S\0E\0 \0A\0P\0I\0 \0C\0l\0i\0e\0n\0t\0 \0D\0L\0L\0"\0 \0C\0O\0M\0P\0A\0N\0Y\0_\0N\0A\0M\0E\0=\0"\0M\0i\0c\0r\0o\0s\0o\0f\0t\0 \0", 1666, 0x0, 0, ... {status=0x0, info=1666}, ) \0k\0e\0r\0n\0e\0l\03\02\0.\0d\0l\0l\0 (228, 0, 0, 0, " \0 \0 \0 \0<\0M\0A\0T\0C\0H\0I\0N\0G\0_\0F\0I\0L\0E\0 \0N\0A\0M\0E\0=\0"\0k\0e\0r\0n\0e\0l\03\02\0.\0d\0l\0l\0"\0 \0S\0I\0Z\0E\0=\0"\09\08\04\05\07\06\0"\0 \0C\0H\0E\0C\0K\0S\0U\0M\0=\0"\00\0x\0F\00\0B\03\03\01\0F\06\0"\0 \0B\0I\0N\0_\0F\0I\0L\0E\0_\0V\0E\0R\0S\0I\0O\0N\0=\0"\05\0.\01\0.\02\06\00\00\0.\03\01\01\09\0"\0 \0B\0I\0N\0_\0P\0R\0O\0D\0U\0C\0T\0_\0V\0E\0R\0S\0I\0O\0N\0=\0"\05\0.\01\0.\02\06\00\00\0.\03\01\01\09\0"\0 \0P\0R\0O\0D\0U\0C\0T\0_\0V\0E\0R\0S\0I\0O\0N\0=\0"\05\0.\01\0.\02\06\00\00\0.\03\01\01\09\0"\0 \0F\0I\0L\0E\0_\0D\0E\0S\0C\0R\0I\0P\0T\0I\0O\0N\0=\0"\0W\0i\0n\0d\0o\0w\0s\0 \0N\0T\0 \0B\0A\0S\0E\0 \0A\0P\0I\0 \0C\0l\0i\0e\0n\0t\0 \0D\0L\0L\0"\0 \0C\0O\0M\0P\0A\0N\0Y\0_\0N\0A\0M\0E\0=\0"\0M\0i\0c\0r\0o\0s\0o\0f\0t\0 \0", 1666, 0x0, 0, ... {status=0x0, info=1666}, ) \09\08\04\05\07\06\0 (228, 0, 0, 0, " \0 \0 \0 \0<\0M\0A\0T\0C\0H\0I\0N\0G\0_\0F\0I\0L\0E\0 \0N\0A\0M\0E\0=\0"\0k\0e\0r\0n\0e\0l\03\02\0.\0d\0l\0l\0"\0 \0S\0I\0Z\0E\0=\0"\09\08\04\05\07\06\0"\0 \0C\0H\0E\0C\0K\0S\0U\0M\0=\0"\00\0x\0F\00\0B\03\03\01\0F\06\0"\0 \0B\0I\0N\0_\0F\0I\0L\0E\0_\0V\0E\0R\0S\0I\0O\0N\0=\0"\05\0.\01\0.\02\06\00\00\0.\03\01\01\09\0"\0 \0B\0I\0N\0_\0P\0R\0O\0D\0U\0C\0T\0_\0V\0E\0R\0S\0I\0O\0N\0=\0"\05\0.\01\0.\02\06\00\00\0.\03\01\01\09\0"\0 \0P\0R\0O\0D\0U\0C\0T\0_\0V\0E\0R\0S\0I\0O\0N\0=\0"\05\0.\01\0.\02\06\00\00\0.\03\01\01\09\0"\0 \0F\0I\0L\0E\0_\0D\0E\0S\0C\0R\0I\0P\0T\0I\0O\0N\0=\0"\0W\0i\0n\0d\0o\0w\0s\0 \0N\0T\0 \0B\0A\0S\0E\0 \0A\0P\0I\0 \0C\0l\0i\0e\0n\0t\0 \0D\0L\0L\0"\0 \0C\0O\0M\0P\0A\0N\0Y\0_\0N\0A\0M\0E\0=\0"\0M\0i\0c\0r\0o\0s\0o\0f\0t\0 \0", 1666, 0x0, 0, ... {status=0x0, info=1666}, ) \00\0x\0F\00\0B\03\03\01\0F\06\0 (228, 0, 0, 0, " \0 \0 \0 \0<\0M\0A\0T\0C\0H\0I\0N\0G\0_\0F\0I\0L\0E\0 \0N\0A\0M\0E\0=\0"\0k\0e\0r\0n\0e\0l\03\02\0.\0d\0l\0l\0"\0 \0S\0I\0Z\0E\0=\0"\09\08\04\05\07\06\0"\0 \0C\0H\0E\0C\0K\0S\0U\0M\0=\0"\00\0x\0F\00\0B\03\03\01\0F\06\0"\0 \0B\0I\0N\0_\0F\0I\0L\0E\0_\0V\0E\0R\0S\0I\0O\0N\0=\0"\05\0.\01\0.\02\06\00\00\0.\03\01\01\09\0"\0 \0B\0I\0N\0_\0P\0R\0O\0D\0U\0C\0T\0_\0V\0E\0R\0S\0I\0O\0N\0=\0"\05\0.\01\0.\02\06\00\00\0.\03\01\01\09\0"\0 \0P\0R\0O\0D\0U\0C\0T\0_\0V\0E\0R\0S\0I\0O\0N\0=\0"\05\0.\01\0.\02\06\00\00\0.\03\01\01\09\0"\0 \0F\0I\0L\0E\0_\0D\0E\0S\0C\0R\0I\0P\0T\0I\0O\0N\0=\0"\0W\0i\0n\0d\0o\0w\0s\0 \0N\0T\0 \0B\0A\0S\0E\0 \0A\0P\0I\0 \0C\0l\0i\0e\0n\0t\0 \0D\0L\0L\0"\0 \0C\0O\0M\0P\0A\0N\0Y\0_\0N\0A\0M\0E\0=\0"\0M\0i\0c\0r\0o\0s\0o\0f\0t\0 \0", 1666, 0x0, 0, ... {status=0x0, info=1666}, ) \05\0.\01\0.\02\06\00\00\0.\03\01\01\09\0 (228, 0, 0, 0, " \0 \0 \0 \0<\0M\0A\0T\0C\0H\0I\0N\0G\0_\0F\0I\0L\0E\0 \0N\0A\0M\0E\0=\0"\0k\0e\0r\0n\0e\0l\03\02\0.\0d\0l\0l\0"\0 \0S\0I\0Z\0E\0=\0"\09\08\04\05\07\06\0"\0 \0C\0H\0E\0C\0K\0S\0U\0M\0=\0"\00\0x\0F\00\0B\03\03\01\0F\06\0"\0 \0B\0I\0N\0_\0F\0I\0L\0E\0_\0V\0E\0R\0S\0I\0O\0N\0=\0"\05\0.\01\0.\02\06\00\00\0.\03\01\01\09\0"\0 \0B\0I\0N\0_\0P\0R\0O\0D\0U\0C\0T\0_\0V\0E\0R\0S\0I\0O\0N\0=\0"\05\0.\01\0.\02\06\00\00\0.\03\01\01\09\0"\0 \0P\0R\0O\0D\0U\0C\0T\0_\0V\0E\0R\0S\0I\0O\0N\0=\0"\05\0.\01\0.\02\06\00\00\0.\03\01\01\09\0"\0 \0F\0I\0L\0E\0_\0D\0E\0S\0C\0R\0I\0P\0T\0I\0O\0N\0=\0"\0W\0i\0n\0d\0o\0w\0s\0 \0N\0T\0 \0B\0A\0S\0E\0 \0A\0P\0I\0 \0C\0l\0i\0e\0n\0t\0 \0D\0L\0L\0"\0 \0C\0O\0M\0P\0A\0N\0Y\0_\0N\0A\0M\0E\0=\0"\0M\0i\0c\0r\0o\0s\0o\0f\0t\0 \0", 1666, 0x0, 0, ... {status=0x0, info=1666}, ) \05\0.\01\0.\02\06\00\00\0.\03\01\01\09\0 (228, 0, 0, 0, " \0 \0 \0 \0<\0M\0A\0T\0C\0H\0I\0N\0G\0_\0F\0I\0L\0E\0 \0N\0A\0M\0E\0=\0"\0k\0e\0r\0n\0e\0l\03\02\0.\0d\0l\0l\0"\0 \0S\0I\0Z\0E\0=\0"\09\08\04\05\07\06\0"\0 \0C\0H\0E\0C\0K\0S\0U\0M\0=\0"\00\0x\0F\00\0B\03\03\01\0F\06\0"\0 \0B\0I\0N\0_\0F\0I\0L\0E\0_\0V\0E\0R\0S\0I\0O\0N\0=\0"\05\0.\01\0.\02\06\00\00\0.\03\01\01\09\0"\0 \0B\0I\0N\0_\0P\0R\0O\0D\0U\0C\0T\0_\0V\0E\0R\0S\0I\0O\0N\0=\0"\05\0.\01\0.\02\06\00\00\0.\03\01\01\09\0"\0 \0P\0R\0O\0D\0U\0C\0T\0_\0V\0E\0R\0S\0I\0O\0N\0=\0"\05\0.\01\0.\02\06\00\00\0.\03\01\01\09\0"\0 \0F\0I\0L\0E\0_\0D\0E\0S\0C\0R\0I\0P\0T\0I\0O\0N\0=\0"\0W\0i\0n\0d\0o\0w\0s\0 \0N\0T\0 \0B\0A\0S\0E\0 \0A\0P\0I\0 \0C\0l\0i\0e\0n\0t\0 \0D\0L\0L\0"\0 \0C\0O\0M\0P\0A\0N\0Y\0_\0N\0A\0M\0E\0=\0"\0M\0i\0c\0r\0o\0s\0o\0f\0t\0 \0", 1666, 0x0, 0, ... {status=0x0, info=1666}, ) \05\0.\01\0.\02\06\00\00\0.\03\01\01\09\0 (228, 0, 0, 0, " \0 \0 \0 \0<\0M\0A\0T\0C\0H\0I\0N\0G\0_\0F\0I\0L\0E\0 \0N\0A\0M\0E\0=\0"\0k\0e\0r\0n\0e\0l\03\02\0.\0d\0l\0l\0"\0 \0S\0I\0Z\0E\0=\0"\09\08\04\05\07\06\0"\0 \0C\0H\0E\0C\0K\0S\0U\0M\0=\0"\00\0x\0F\00\0B\03\03\01\0F\06\0"\0 \0B\0I\0N\0_\0F\0I\0L\0E\0_\0V\0E\0R\0S\0I\0O\0N\0=\0"\05\0.\01\0.\02\06\00\00\0.\03\01\01\09\0"\0 \0B\0I\0N\0_\0P\0R\0O\0D\0U\0C\0T\0_\0V\0E\0R\0S\0I\0O\0N\0=\0"\05\0.\01\0.\02\06\00\00\0.\03\01\01\09\0"\0 \0P\0R\0O\0D\0U\0C\0T\0_\0V\0E\0R\0S\0I\0O\0N\0=\0"\05\0.\01\0.\02\06\00\00\0.\03\01\01\09\0"\0 \0F\0I\0L\0E\0_\0D\0E\0S\0C\0R\0I\0P\0T\0I\0O\0N\0=\0"\0W\0i\0n\0d\0o\0w\0s\0 \0N\0T\0 \0B\0A\0S\0E\0 \0A\0P\0I\0 \0C\0l\0i\0e\0n\0t\0 \0D\0L\0L\0"\0 \0C\0O\0M\0P\0A\0N\0Y\0_\0N\0A\0M\0E\0=\0"\0M\0i\0c\0r\0o\0s\0o\0f\0t\0 \0", 1666, 0x0, 0, ... {status=0x0, info=1666}, ) \0W\0i\0n\0d\0o\0w\0s\0 \0N\0T\0 \0B\0A\0S\0E\0 \0A\0P\0I\0 \0C\0l\0i\0e\0n\0t\0 \0D\0L\0L\0 (228, 0, 0, 0, " \0 \0 \0 \0<\0M\0A\0T\0C\0H\0I\0N\0G\0_\0F\0I\0L\0E\0 \0N\0A\0M\0E\0=\0"\0k\0e\0r\0n\0e\0l\03\02\0.\0d\0l\0l\0"\0 \0S\0I\0Z\0E\0=\0"\09\08\04\05\07\06\0"\0 \0C\0H\0E\0C\0K\0S\0U\0M\0=\0"\00\0x\0F\00\0B\03\03\01\0F\06\0"\0 \0B\0I\0N\0_\0F\0I\0L\0E\0_\0V\0E\0R\0S\0I\0O\0N\0=\0"\05\0.\01\0.\02\06\00\00\0.\03\01\01\09\0"\0 \0B\0I\0N\0_\0P\0R\0O\0D\0U\0C\0T\0_\0V\0E\0R\0S\0I\0O\0N\0=\0"\05\0.\01\0.\02\06\00\00\0.\03\01\01\09\0"\0 \0P\0R\0O\0D\0U\0C\0T\0_\0V\0E\0R\0S\0I\0O\0N\0=\0"\05\0.\01\0.\02\06\00\00\0.\03\01\01\09\0"\0 \0F\0I\0L\0E\0_\0D\0E\0S\0C\0R\0I\0P\0T\0I\0O\0N\0=\0"\0W\0i\0n\0d\0o\0w\0s\0 \0N\0T\0 \0B\0A\0S\0E\0 \0A\0P\0I\0 \0C\0l\0i\0e\0n\0t\0 \0D\0L\0L\0"\0 \0C\0O\0M\0P\0A\0N\0Y\0_\0N\0A\0M\0E\0=\0"\0M\0i\0c\0r\0o\0s\0o\0f\0t\0 \0", 1666, 0x0, 0, ... {status=0x0, info=1666}, ) \0M\0i\0c\0r\0o\0s\0o\0f\0t\0 \0", 1666, 0x0, 0, ... {status=0x0, info=1666}, ) == 0x0
 04782   860   NtQueryDirectoryFile  (224, 0, 0, 0, 1363328, 4096, BothDirectory, 0, 0x0, 0, ... ) == STATUS_NO_MORE_FILES
 04783   860   NtClose  (224, ... ) == 0x0
 04784   860   NtWriteFile  (228, 0, 0, 0,  (228, 0, 0, 0, "<\0/\0E\0X\0E\0>\0\15\0\12\0<\0/\0D\0A\0T\0A\0B\0A\0S\0E\0>\0\15\0\12\0", 42, 0x0, 0, ... {status=0x0, info=42}, ) , 42, 0x0, 0, ... {status=0x0, info=42}, ) == 0x0
 04785   860   NtClose  (228, ... ) == 0x0
 04786   860   NtQueryInformationJobObject  (0, BasicUIRestrictions, 4, ... ) == STATUS_ACCESS_DENIED
 04787   860   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\dwwin.exe"}, 1222440, ... ) }, 1222440, ... ) == 0x0
 04788   860   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\dwwin.exe"}, 1223176, ... ) }, 1223176, ... ) == 0x0
 04789   860   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\SYSTEM32\DWWIN.EXE"}, 1223092, ... ) }, 1223092, ... ) == 0x0
 04790   860   NtOpenFile  (0x100100, {24, 0, 0x40, 0, 0,  (0x100100, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\SYSTEM32\DWWIN.EXE"}, 7, 2113568, ... 228, {status=0x0, info=1}, ) }, 7, 2113568, ... 228, {status=0x0, info=1}, ) == 0x0
 04791   860   NtSetInformationFile  (228, 1223068, 40, Basic, ... {status=0x0, info=0}, ) == 0x0
 04792   860   NtClose  (228, ... ) == 0x0
 04793   860   NtCreateFile  (0xc0100080, {24, 0, 0x40, 0, 1223076,  (0xc0100080, {24, 0, 0x40, 0, 1223076, "\??\C:\WINDOWS\SYSTEM32\DWWIN.EXE"}, 0x0, 0, 1, 1, 96, 0, 0, ... 228, {status=0x0, info=1}, ) }, 0x0, 0, 1, 1, 96, 0, 0, ... 228, {status=0x0, info=1}, ) == 0x0
 04794   860   NtQueryInformationFile  (228, 1223128, 40, Basic, ... {status=0x0, info=40}, ) == 0x0
 04795   860   NtQueryInformationFile  (228, 1223128, 24, Standard, ... {status=0x0, info=24}, ) == 0x0
 04796   860   NtCreateSection  (0xf0007, 0x0, {192512, 0}, 4, 134217728, 228, ... 224, ) == 0x0
 04797   860   NtMapViewOfSection  (224, -1, (0x0), 0, 0, {0, 0}, 0, 1, 0, 4, ... (0x9b0000), {0, 0}, 192512, ) == 0x0
 04798   860   NtUnmapViewOfSection  (-1, 0x9b0000, ... ) == 0x0
 04799   860   NtClose  (224, ... ) == 0x0
 04800   860   NtSetInformationFile  (228, 1223132, 40, Basic, ... {status=0x0, info=0}, ) == 0x0
 04801   860   NtClose  (228, ... ) == 0x0
 04802   860   NtOpenFile  (0x100100, {24, 0, 0x40, 0, 0,  (0x100100, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\SYSTEM32\DWWIN.EXE"}, 7, 2113568, ... 228, {status=0x0, info=1}, ) }, 7, 2113568, ... 228, {status=0x0, info=1}, ) == 0x0
 04803   860   NtSetInformationFile  (228, 1223072, 40, Basic, ... {status=0x0, info=0}, ) == 0x0
 04804   860   NtClose  (228, ... ) == 0x0
 04805   860   NtOpenFile  (0x1000a1, {24, 0, 0x40, 0, 0,  (0x1000a1, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\dwwin.exe"}, 5, 96, ... 228, {status=0x0, info=1}, ) }, 5, 96, ... 228, {status=0x0, info=1}, ) == 0x0
 04806   860   NtCreateSection  (0xf001f, 0x0, 0x0, 16, 16777216, 228, ... 224, ) == 0x0
 04807   860   NtQueryVolumeInformationFile  (228, 1222452, 8, Device, ... {status=0x0, info=8}, ) == 0x0
 04808   860   NtWaitForSingleObject  (184, 0, {-1000000, -1}, ... ) == 0x0
 04809   860   NtReleaseMutant  (184, ... 0x0, ) == 0x0
 04810   860   NtCreateFile  (0x80100080, {24, 0, 0x40, 0, 0,  (0x80100080, {24, 0, 0x40, 0, 0, "\SystemRoot\AppPatch\sysmain.sdb"}, 0x0, 128, 1, 1, 96, 0, 0, ... 216, {status=0x0, info=1}, ) }, 0x0, 128, 1, 1, 96, 0, 0, ... 216, {status=0x0, info=1}, ) == 0x0
 04811   860   NtQueryInformationFile  (216, 1220708, 24, Standard, ... {status=0x0, info=24}, ) == 0x0
 04812   860   NtCreateSection  (0x4, 0x0, 0x0, 2, 134217728, 216, ... 220, ) == 0x0
 04813   860   NtMapViewOfSection  (220, -1, (0x0), 0, 0, 0x0, 0, 2, 0, 2, ... (0xac0000), 0x0, 1191936, ) == 0x0
 04814   860   NtQueryInformationFile  (216, 1220808, 24, Standard, ... {status=0x0, info=24}, ) == 0x0
 04815   860   NtCreateFile  (0x80100080, {24, 0, 0x40, 0, 0,  (0x80100080, {24, 0, 0x40, 0, 0, "\SystemRoot\AppPatch\systest.sdb"}, 0x0, 128, 1, 1, 96, 0, 0, ... ) }, 0x0, 128, 1, 1, 96, 0, 0, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 04816   860   NtOpenKey  (0x101, {24, 0, 0x40, 0, 0,  (0x101, {24, 0, 0x40, 0, 0, "\Registry\Machine\System\WPA\TabletPC"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 04817   860   NtOpenKey  (0x101, {24, 0, 0x40, 0, 0,  (0x101, {24, 0, 0x40, 0, 0, "\Registry\Machine\SYSTEM\WPA\MediaCenter"}, ... 232, ) }, ... 232, ) == 0x0
 04818   860   NtQueryValueKey  (232,  (232, "Installed", Partial, 256, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) , Partial, 256, ... TitleIdx=0, Type=4, Data= (232, "Installed", Partial, 256, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) }, 16, ) == 0x0
 04819   860   NtClose  (232, ... ) == 0x0
 04820   860   NtCreateFile  (0x120116, {24, 0, 0x40, 0, 0,  (0x120116, {24, 0, 0x40, 0, 0, "\Device\NamedPipe\ShimViewer"}, 0x0, 128, 0, 1, 0, 0, 0, ... ) }, 0x0, 128, 0, 1, 0, 0, 0, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 04821   860   NtOpenFile  (0x100001, {24, 0, 0x40, 0, 0,  (0x100001, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\"}, 3, 16417, ... 232, {status=0x0, info=1}, ) }, 3, 16417, ... 232, {status=0x0, info=1}, ) == 0x0
 04822   860   NtQueryDirectoryFile  (232, 0, 0, 0, 1218404, 616, BothDirectory, 1,  (232, 0, 0, 0, 1218404, 616, BothDirectory, 1, "dwwin.exe", 0, ... {status=0x0, info=112}, ) , 0, ... {status=0x0, info=112}, ) == 0x0
 04823   860   NtClose  (232, ... ) == 0x0
 04824   860   NtQueryInformationProcess  (-1, DefaultHardErrorMode, 4, ... {process info, class 12, size 4}, 0x0, ) == 0x0
 04825   860   NtSetInformationProcess  (-1, DefaultHardErrorMode, {process info, class 12, size 4}, 4, ... ) == 0x0
 04826   860   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\dwwin.exe"}, 1218780, ... ) }, 1218780, ... ) == 0x0
 04827   860   NtOpenFile  (0x100001, {24, 0, 0x40, 0, 0,  (0x100001, {24, 0, 0x40, 0, 0, "\??\C:\"}, 3, 16417, ... 232, {status=0x0, info=1}, ) }, 3, 16417, ... 232, {status=0x0, info=1}, ) == 0x0
 04828   860   NtQueryDirectoryFile  (232, 0, 0, 0, 1218208, 616, BothDirectory, 1,  (232, 0, 0, 0, 1218208, 616, BothDirectory, 1, "WINDOWS", 0, ... {status=0x0, info=108}, ) , 0, ... {status=0x0, info=108}, ) == 0x0
 04829   860   NtClose  (232, ... ) == 0x0
 04830   860   NtOpenFile  (0x100001, {24, 0, 0x40, 0, 0,  (0x100001, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\"}, 3, 16417, ... 232, {status=0x0, info=1}, ) }, 3, 16417, ... 232, {status=0x0, info=1}, ) == 0x0
 04831   860   NtQueryDirectoryFile  (232, 0, 0, 0, 1218208, 616, BothDirectory, 1,  (232, 0, 0, 0, 1218208, 616, BothDirectory, 1, "system32", 0, ... {status=0x0, info=110}, ) , 0, ... {status=0x0, info=110}, ) == 0x0
 04832   860   NtClose  (232, ... ) == 0x0
 04833   860   NtOpenFile  (0x100001, {24, 0, 0x40, 0, 0,  (0x100001, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\"}, 3, 16417, ... 232, {status=0x0, info=1}, ) }, 3, 16417, ... 232, {status=0x0, info=1}, ) == 0x0
 04834   860   NtQueryDirectoryFile  (232, 0, 0, 0, 1218208, 616, BothDirectory, 1,  (232, 0, 0, 0, 1218208, 616, BothDirectory, 1, "dwwin.exe", 0, ... {status=0x0, info=112}, ) , 0, ... {status=0x0, info=112}, ) == 0x0
 04835   860   NtClose  (232, ... ) == 0x0
 04836   860   NtQueryInformationProcess  (-1, DefaultHardErrorMode, 4, ... {process info, class 12, size 4}, 0x0, ) == 0x0
 04837   860   NtSetInformationProcess  (-1, DefaultHardErrorMode, {process info, class 12, size 4}, 4, ... ) == 0x0
 04838   860   NtQueryInformationProcess  (-1, DeviceMap, 36, ... {process info, class 23, size 36}, 0x0, ) == 0x0
 04839   860   NtOpenKey  (0x80000100, {24, 0, 0x40, 0, 0,  (0x80000100, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Layers"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 04840   860   NtOpenThreadTokenEx  (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN
 04841   860   NtOpenProcessTokenEx  (-1, 0x20008, 512, ... 232, ) == 0x0
 04842   860   NtQueryInformationToken  (232, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0
 04843   860   NtClose  (232, ... ) == 0x0
 04844   860   NtOpenKey  (0x80000100, {24, 0, 0x40, 0, 0,  (0x80000100, {24, 0, 0x40, 0, 0, "\REGISTRY\USER\S-1-5-21-1292428093-1383384898-725345543-1003\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Layers"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 04845   860   NtOpenKey  (0x80000100, {24, 0, 0x40, 0, 0,  (0x80000100, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Custom\dwwin.exe"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 04846   860   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\dwwin.exe"}, 1219612, ... ) }, 1219612, ... ) == 0x0
 04847   860   NtQueryInformationProcess  (-1, DefaultHardErrorMode, 4, ... {process info, class 12, size 4}, 0x0, ) == 0x0
 04848   860   NtSetInformationProcess  (-1, DefaultHardErrorMode, {process info, class 12, size 4}, 4, ... ) == 0x0
 04849   860   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\dwwin.exe"}, 1218480, ... ) }, 1218480, ... ) == 0x0
 04850   860   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\SYSTEM32\DWWIN.EXE"}, 1218472, ... ) }, 1218472, ... ) == 0x0
 04851   860   NtOpenFile  (0x100100, {24, 0, 0x40, 0, 0,  (0x100100, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\SYSTEM32\DWWIN.EXE"}, 7, 2113568, ... 232, {status=0x0, info=1}, ) }, 7, 2113568, ... 232, {status=0x0, info=1}, ) == 0x0
 04852   860   NtSetInformationFile  (232, 1218448, 40, Basic, ... {status=0x0, info=0}, ) == 0x0
 04853   860   NtClose  (232, ... ) == 0x0
 04854   860   NtCreateFile  (0xc0100080, {24, 0, 0x40, 0, 1218456,  (0xc0100080, {24, 0, 0x40, 0, 1218456, "\??\C:\WINDOWS\SYSTEM32\DWWIN.EXE"}, 0x0, 0, 1, 1, 96, 0, 0, ... ) }, 0x0, 0, 1, 1, 96, 0, 0, ... ) == STATUS_SHARING_VIOLATION
 04855   860   NtOpenFile  (0x100100, {24, 0, 0x40, 0, 0,  (0x100100, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\SYSTEM32\DWWIN.EXE"}, 7, 2113568, ... 232, {status=0x0, info=1}, ) }, 7, 2113568, ... 232, {status=0x0, info=1}, ) == 0x0
 04856   860   NtSetInformationFile  (232, 1218448, 40, Basic, ... {status=0x0, info=0}, ) == 0x0
 04857   860   NtClose  (232, ... ) == 0x0
 04858   860   NtOpenFile  (0x100020, {24, 0, 0x40, 0, 0,  (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\dwwin.exe"}, 5, 96, ... 232, {status=0x0, info=1}, ) }, 5, 96, ... 232, {status=0x0, info=1}, ) == 0x0
 04859   860   NtCreateSection  (0xe, 0x0, 0x0, 16, 134217728, 232, ... 236, ) == 0x0
 04860   860   NtClose  (232, ... ) == 0x0
 04861   860   NtMapViewOfSection  (236, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 16, ... (0x9b0000), 0x0, 192512, ) == 0x0
 04862   860   NtClose  (236, ... ) == 0x0
 04863   860   NtUnmapViewOfSection  (-1, 0x9b0000, ... ) == 0x0
 04864   860   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\dwwin.exe"}, 1218076, ... ) }, 1218076, ... ) == 0x0
 04865   860   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\SYSTEM32\DWWIN.EXE"}, 1218572, ... ) }, 1218572, ... ) == 0x0
 04866   860   NtOpenFile  (0x100100, {24, 0, 0x40, 0, 0,  (0x100100, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\SYSTEM32\DWWIN.EXE"}, 7, 2113568, ... 236, {status=0x0, info=1}, ) }, 7, 2113568, ... 236, {status=0x0, info=1}, ) == 0x0
 04867   860   NtSetInformationFile  (236, 1218548, 40, Basic, ... {status=0x0, info=0}, ) == 0x0
 04868   860   NtClose  (236, ... ) == 0x0
 04869   860   NtCreateFile  (0xc0100080, {24, 0, 0x40, 0, 1218556,  (0xc0100080, {24, 0, 0x40, 0, 1218556, "\??\C:\WINDOWS\SYSTEM32\DWWIN.EXE"}, 0x0, 0, 1, 1, 96, 0, 0, ... ) }, 0x0, 0, 1, 1, 96, 0, 0, ... ) == STATUS_SHARING_VIOLATION
 04870   860   NtOpenFile  (0x100100, {24, 0, 0x40, 0, 0,  (0x100100, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\SYSTEM32\DWWIN.EXE"}, 7, 2113568, ... 236, {status=0x0, info=1}, ) }, 7, 2113568, ... 236, {status=0x0, info=1}, ) == 0x0
 04871   860   NtSetInformationFile  (236, 1218548, 40, Basic, ... {status=0x0, info=0}, ) == 0x0
 04872   860   NtClose  (236, ... ) == 0x0
 04873   860   NtCreateFile  (0x80100080, {24, 0, 0x40, 0, 1218820,  (0x80100080, {24, 0, 0x40, 0, 1218820, "\??\C:\WINDOWS\system32\dwwin.exe"}, 0x0, 0, 5, 1, 96, 0, 0, ... 236, {status=0x0, info=1}, ) }, 0x0, 0, 5, 1, 96, 0, 0, ... 236, {status=0x0, info=1}, ) == 0x0
 04874   860   NtCreateSection  (0xf0005, 0x0, 0x0, 2, 134217728, 236, ... 232, ) == 0x0
 04875   860   NtClose  (236, ... ) == 0x0
 04876   860   NtMapViewOfSection  (232, -1, (0x0), 0, 0, {0, 0}, 0, 1, 0, 2, ... (0x9b0000), {0, 0}, 192512, ) == 0x0
 04877   860   NtClose  (232, ... ) == 0x0
 04878   860   NtAllocateVirtualMemory  (-1, 1208320, 0, 4096, 4096, 260, ... 1208320, 4096, ) == 0x0
 04879   860   NtQueryInformationProcess  (-1, DefaultHardErrorMode, 4, ... {process info, class 12, size 4}, 0x0, ) == 0x0
 04880   860   NtSetInformationProcess  (-1, DefaultHardErrorMode, {process info, class 12, size 4}, 4, ... ) == 0x0
 04881   860   NtQueryDefaultLocale  (1, 1219440, ... ) == 0x0
 04882   860   NtQueryVirtualMemory  (-1, 0x9b0000, Basic, 28, ... {BaseAddress=0x9b0000,AllocationBase=0x9b0000,AllocationProtect=0x2,RegionSize=0x2f000,State=0x1000,Protect=0x2,Type=0x40000,}, 0x0, ) == 0x0
 04883   860   NtQueryVirtualMemory  (-1, 0x9b0000, Basic, 28, ... {BaseAddress=0x9b0000,AllocationBase=0x9b0000,AllocationProtect=0x2,RegionSize=0x2f000,State=0x1000,Protect=0x2,Type=0x40000,}, 0x0, ) == 0x0
 04884   860   NtUnmapViewOfSection  (-1, 0x9b0000, ... ) == 0x0
 04885   860   NtQueryInformationProcess  (-1, DefaultHardErrorMode, 4, ... {process info, class 12, size 4}, 0x0, ) == 0x0
 04886   860   NtSetInformationProcess  (-1, DefaultHardErrorMode, {process info, class 12, size 4}, 4, ... ) == 0x0
 04887   860   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\dwwin.exe"}, 1218472, ... ) }, 1218472, ... ) == 0x0
 04888   860   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\SYSTEM32\DWWIN.EXE"}, 1218464, ... ) }, 1218464, ... ) == 0x0
 04889   860   NtOpenFile  (0x100100, {24, 0, 0x40, 0, 0,  (0x100100, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\SYSTEM32\DWWIN.EXE"}, 7, 2113568, ... 232, {status=0x0, info=1}, ) }, 7, 2113568, ... 232, {status=0x0, info=1}, ) == 0x0
 04890   860   NtSetInformationFile  (232, 1218440, 40, Basic, ... {status=0x0, info=0}, ) == 0x0
 04891   860   NtClose  (232, ... ) == 0x0
 04892   860   NtCreateFile  (0xc0100080, {24, 0, 0x40, 0, 1218448,  (0xc0100080, {24, 0, 0x40, 0, 1218448, "\??\C:\WINDOWS\SYSTEM32\DWWIN.EXE"}, 0x0, 0, 1, 1, 96, 0, 0, ... ) }, 0x0, 0, 1, 1, 96, 0, 0, ... ) == STATUS_SHARING_VIOLATION
 04893   860   NtOpenFile  (0x100100, {24, 0, 0x40, 0, 0,  (0x100100, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\SYSTEM32\DWWIN.EXE"}, 7, 2113568, ... 232, {status=0x0, info=1}, ) }, 7, 2113568, ... 232, {status=0x0, info=1}, ) == 0x0
 04894   860   NtSetInformationFile  (232, 1218440, 40, Basic, ... {status=0x0, info=0}, ) == 0x0
 04895   860   NtClose  (232, ... ) == 0x0
 04896   860   NtOpenFile  (0x100020, {24, 0, 0x40, 0, 0,  (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\dwwin.exe"}, 5, 96, ... 232, {status=0x0, info=1}, ) }, 5, 96, ... 232, {status=0x0, info=1}, ) == 0x0
 04897   860   NtCreateSection  (0xe, 0x0, 0x0, 16, 134217728, 232, ... 236, ) == 0x0
 04898   860   NtClose  (232, ... ) == 0x0
 04899   860   NtMapViewOfSection  (236, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 16, ... (0x9b0000), 0x0, 192512, ) == 0x0
 04900   860   NtClose  (236, ... ) == 0x0
 04901   860   NtUnmapViewOfSection  (-1, 0x9b0000, ... ) == 0x0
 04902   860   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\dwwin.exe"}, 1218068, ... ) }, 1218068, ... ) == 0x0
 04903   860   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\SYSTEM32\DWWIN.EXE"}, 1218564, ... ) }, 1218564, ... ) == 0x0
 04904   860   NtOpenFile  (0x100100, {24, 0, 0x40, 0, 0,  (0x100100, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\SYSTEM32\DWWIN.EXE"}, 7, 2113568, ... 236, {status=0x0, info=1}, ) }, 7, 2113568, ... 236, {status=0x0, info=1}, ) == 0x0
 04905   860   NtSetInformationFile  (236, 1218540, 40, Basic, ... {status=0x0, info=0}, ) == 0x0
 04906   860   NtClose  (236, ... ) == 0x0
 04907   860   NtCreateFile  (0xc0100080, {24, 0, 0x40, 0, 1218548,  (0xc0100080, {24, 0, 0x40, 0, 1218548, "\??\C:\WINDOWS\SYSTEM32\DWWIN.EXE"}, 0x0, 0, 1, 1, 96, 0, 0, ... ) }, 0x0, 0, 1, 1, 96, 0, 0, ... ) == STATUS_SHARING_VIOLATION
 04908   860   NtOpenFile  (0x100100, {24, 0, 0x40, 0, 0,  (0x100100, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\SYSTEM32\DWWIN.EXE"}, 7, 2113568, ... 236, {status=0x0, info=1}, ) }, 7, 2113568, ... 236, {status=0x0, info=1}, ) == 0x0
 04909   860   NtSetInformationFile  (236, 1218540, 40, Basic, ... {status=0x0, info=0}, ) == 0x0
 04910   860   NtClose  (236, ... ) == 0x0
 04911   860   NtCreateFile  (0x80100080, {24, 0, 0x40, 0, 1218812,  (0x80100080, {24, 0, 0x40, 0, 1218812, "\??\C:\WINDOWS\system32\dwwin.exe"}, 0x0, 0, 5, 1, 96, 0, 0, ... 236, {status=0x0, info=1}, ) }, 0x0, 0, 5, 1, 96, 0, 0, ... 236, {status=0x0, info=1}, ) == 0x0
 04912   860   NtCreateSection  (0xf0005, 0x0, 0x0, 2, 134217728, 236, ... 232, ) == 0x0
 04913   860   NtClose  (236, ... ) == 0x0
 04914   860   NtMapViewOfSection  (232, -1, (0x0), 0, 0, {0, 0}, 0, 1, 0, 2, ... (0x9b0000), {0, 0}, 192512, ) == 0x0
 04915   860   NtClose  (232, ... ) == 0x0
 04916   860   NtQueryInformationProcess  (-1, DefaultHardErrorMode, 4, ... {process info, class 12, size 4}, 0x0, ) == 0x0
 04917   860   NtSetInformationProcess  (-1, DefaultHardErrorMode, {process info, class 12, size 4}, 4, ... ) == 0x0
 04918   860   NtQueryDefaultLocale  (1, 1219432, ... ) == 0x0
 04919   860   NtQueryVirtualMemory  (-1, 0x9b0000, Basic, 28, ... {BaseAddress=0x9b0000,AllocationBase=0x9b0000,AllocationProtect=0x2,RegionSize=0x2f000,State=0x1000,Protect=0x2,Type=0x40000,}, 0x0, ) == 0x0
 04920   860   NtUnmapViewOfSection  (-1, 0x9b0000, ... ) == 0x0
 04921   860   NtOpenKey  (0x80000100, {24, 0, 0x40, 0, 0,  (0x80000100, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 04922   860   NtOpenThreadTokenEx  (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN
 04923   860   NtOpenProcessTokenEx  (-1, 0x20008, 512, ... 232, ) == 0x0
 04924   860   NtQueryInformationToken  (232, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0
 04925   860   NtClose  (232, ... ) == 0x0
 04926   860   NtOpenKey  (0x80000100, {24, 0, 0x40, 0, 0,  (0x80000100, {24, 0, 0x40, 0, 0, "\REGISTRY\USER\S-1-5-21-1292428093-1383384898-725345543-1003\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 04927   860   NtQueryInformationProcess  (-1, DefaultHardErrorMode, 4, ... {process info, class 12, size 4}, 0x0, ) == 0x0
 04928   860   NtSetInformationProcess  (-1, DefaultHardErrorMode, {process info, class 12, size 4}, 4, ... ) == 0x0
 04929   860   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\dwwin.exe"}, 1220032, ... ) }, 1220032, ... ) == 0x0
 04930   860   NtOpenFile  (0x100001, {24, 0, 0x40, 0, 0,  (0x100001, {24, 0, 0x40, 0, 0, "\??\C:\"}, 3, 16417, ... 232, {status=0x0, info=1}, ) }, 3, 16417, ... 232, {status=0x0, info=1}, ) == 0x0
 04931   860   NtQueryDirectoryFile  (232, 0, 0, 0, 1219460, 616, BothDirectory, 1,  (232, 0, 0, 0, 1219460, 616, BothDirectory, 1, "WINDOWS", 0, ... {status=0x0, info=108}, ) , 0, ... {status=0x0, info=108}, ) == 0x0
 04932   860   NtClose  (232, ... ) == 0x0
 04933   860   NtOpenFile  (0x100001, {24, 0, 0x40, 0, 0,  (0x100001, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\"}, 3, 16417, ... 232, {status=0x0, info=1}, ) }, 3, 16417, ... 232, {status=0x0, info=1}, ) == 0x0
 04934   860   NtQueryDirectoryFile  (232, 0, 0, 0, 1219460, 616, BothDirectory, 1,  (232, 0, 0, 0, 1219460, 616, BothDirectory, 1, "system32", 0, ... {status=0x0, info=110}, ) , 0, ... {status=0x0, info=110}, ) == 0x0
 04935   860   NtClose  (232, ... ) == 0x0
 04936   860   NtOpenFile  (0x100001, {24, 0, 0x40, 0, 0,  (0x100001, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\"}, 3, 16417, ... 232, {status=0x0, info=1}, ) }, 3, 16417, ... 232, {status=0x0, info=1}, ) == 0x0
 04937   860   NtQueryDirectoryFile  (232, 0, 0, 0, 1219460, 616, BothDirectory, 1,  (232, 0, 0, 0, 1219460, 616, BothDirectory, 1, "dwwin.exe", 0, ... {status=0x0, info=112}, ) , 0, ... {status=0x0, info=112}, ) == 0x0
 04938   860   NtClose  (232, ... ) == 0x0
 04939   860   NtQueryInformationProcess  (-1, DefaultHardErrorMode, 4, ... {process info, class 12, size 4}, 0x0, ) == 0x0
 04940   860   NtSetInformationProcess  (-1, DefaultHardErrorMode, {process info, class 12, size 4}, 4, ... ) == 0x0
 04941   860   NtWaitForSingleObject  (184, 0, {-1000000, -1}, ... ) == 0x0
 04942   860   NtReleaseMutant  (184, ... 0x0, ) == 0x0
 04943   860   NtUnmapViewOfSection  (-1, 0xac0000, ... ) == 0x0
 04944   860   NtClose  (220, ... ) == 0x0
 04945   860   NtClose  (216, ... ) == 0x0
 04946   860   NtOpenThreadToken  (-2, 0x2000000, 1, ... ) == STATUS_NO_TOKEN
 04947   860   NtOpenProcessToken  (-1, 0xa, ... 216, ) == 0x0
 04948   860   NtOpenKey  (0x2000000, {24, 16, 0x40, 0, 0,  (0x2000000, {24, 16, 0x40, 0, 0, "Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers"}, ... 220, ) }, ... 220, ) == 0x0
 04949   860   NtQueryKey  (220, Basic, 520, ... {LastWrite={0x3a5edea,0x1c74da9}, TitleIdx=0, Name= (220, Basic, 520, ... {LastWrite={0x3a5edea,0x1c74da9}, TitleIdx=0, Name="CodeIdentifierso"}, 46, ) }, 46, ) == 0x0
 04950   860   NtClose  (220, ... ) == 0x0
 04951   860   NtOpenKey  (0x2000000, {24, 60, 0x40, 0, 0,  (0x2000000, {24, 60, 0x40, 0, 0, "Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 04952   860   NtOpenSymbolicLinkObject  (0x1, {24, 0, 0x40, 0, 0,  (0x1, {24, 0, 0x40, 0, 0, "\??\C:"}, ... 220, ) }, ... 220, ) == 0x0
 04953   860   NtQuerySymbolicLinkObject  (220, ...  (220, ... "\Device\HarddiskVolume1", 48, ) , 48, ) == 0x0
 04954   860   NtClose  (220, ... ) == 0x0
 04955   860   NtQueryVolumeInformationFile  (228, 1220144, 8, Device, ... {status=0x0, info=8}, ) == 0x0
 04956   860   NtQueryInformationFile  (228, 1220260, 528, Name, ... {status=0x0, info=58}, ) == 0x0
 04957   860   NtQueryInformationProcess  (-1, DefaultHardErrorMode, 4, ... {process info, class 12, size 4}, 0x0, ) == 0x0
 04958   860   NtSetInformationProcess  (-1, DefaultHardErrorMode, {process info, class 12, size 4}, 4, ... ) == 0x0
 04959   860   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\dwwin.exe"}, 1219432, ... ) }, 1219432, ... ) == 0x0