Summary:


NtAdjustPrivilegesToken(>) 
 1 
NtOpenMutant(>) 
 2 
NtGdiCreateDIBitmapInternal(>) 
 7 
NtCreateFile(>) 
 15 

NtCallbackReturn(>) 
 1 
NtOpenSymbolicLinkObject(>) 
 2 
NtGdiGetDCObject(>) 
 7 
NtCreateEvent(>) 
 16 

NtCreateMutant(>) 
 1 
NtQuerySymbolicLinkObject(>) 
 2 
NtGdiGetDCforBitmap(>) 
 7 
NtQueryDirectoryFile(>) 
 16 

NtCreateProcessEx(>) 
 1 
NtReadVirtualMemory(>) 
 2 
NtGdiGetStockObject(>) 
 7 
NtGdiDeleteObjectApp(>) 
 18 

NtDelayExecution(>) 
 1 
NtRegisterThreadTerminatePort(>) 
 2 
NtGdiRestoreDC(>) 
 7 
NtReadFile(>) 
 20 

NtEnumerateValueKey(>) 
 1 
NtReleaseMutant(>) 
 2 
NtGdiSaveDC(>) 
 7 
NtUserCallOneParam(>) 
 20 

NtGdiCreatePaletteInternal(>) 
 1 
NtResumeThread(>) 
 2 
NtGdiSetDIBitsToDeviceInternal(>) 
 7 
NtCreateSection(>) 
 21 

NtGdiInit(>) 
 1 
NtSetEventBoostPriority(>) 
 2 
NtQueryVolumeInformationFile(>) 
 7 
NtQueryInformationProcess(>) 
 21 

NtGdiQueryFontAssocInfo(>) 
 1 
NtTestAlert(>) 
 2 
NtSetInformationProcess(>) 
 7 
NtWriteFile(>) 
 24 

NtNotifyChangeKey(>) 
 1 
NtUserWaitForInputIdle(>) 
 2 
NtUserDestroyCursor(>) 
 7 
NtOpenSection(>) 
 25 

NtOpenEvent(>) 
 1 
NtAddAtom(>) 
 3 
NtUserSetCursorIconData(>) 
 7 
NtOpenProcessTokenEx(>) 
 27 

NtOpenKeyedEvent(>) 
 1 
NtContinue(>) 
 3 
NtEnumerateKey(>) 
 8 
NtOpenThreadTokenEx(>) 
 27 

NtOpenProcess(>) 
 1 
NtGdiHfontCreate(>) 
 3 
NtGdiCreateBitmap(>) 
 8 
NtQuerySystemInformation(>) 
 31 

NtQueryInformationJobObject(>) 
 1 
NtQueryPerformanceCounter(>) 
 3 
NtQueryDefaultUILanguage(>) 
 8 
NtQueryAttributesFile(>) 
 33 

NtQueryInformationThread(>) 
 1 
NtSetInformationObject(>) 
 3 
NtQuerySection(>) 
 9 
NtQueryInformationToken(>) 
 34 

NtQueryInstallUILanguage(>) 
 1 
NtTerminateProcess(>) 
 3 
NtSetInformationThread(>) 
 9 
NtOpenFile(>) 
 38 

NtQueryObject(>) 
 1 
NtWaitForMultipleObjects(>) 
 3 
NtGdiCreateCompatibleDC(>) 
 10 
NtMapViewOfSection(>) 
 41 

NtQuerySystemTime(>) 
 1 
NtCreateSemaphore(>) 
 4 
NtGdiExtGetObjectW(>) 
 10 
NtUserGetAtomName(>) 
 47 

NtSecureConnectPort(>) 
 1 
NtDuplicateObject(>) 
 4 
NtOpenProcessToken(>) 
 10 
NtUserUnregisterClass(>) 
 47 

NtUserCallNoParam(>) 
 1 
NtFreeVirtualMemory(>) 
 4 
NtQueryDebugFilterState(>) 
 10 
NtAllocateVirtualMemory(>) 
 51 

NtUserEnumDisplayMonitors(>) 
 1 
NtFsControlFile(>) 
 4 
NtQueryVirtualMemory(>) 
 10 
NtGdiSelectBitmap(>) 
 57 

NtUserGetKeyboardLayoutList(>) 
 1 
NtSetEvent(>) 
 4 
NtRequestWaitReplyPort(>) 
 11 
NtUserRegisterClassExWOW(>) 
 61 

NtUserGetThreadDesktop(>) 
 1 
NtWaitForSingleObject(>) 
 4 
NtUserGetDC(>) 
 11 
NtUserFindExistingCursorIcon(>) 
 74 

NtUserSetWindowsHookEx(>) 
 1 
NtWriteVirtualMemory(>) 
 4 
NtDeviceIoControlFile(>) 
 12 
NtQueryValueKey(>) 
 77 

NtCreateIoCompletion(>) 
 2 
NtAccessCheck(>) 
 5 
NtSetInformationFile(>) 
 12 
NtFlushInstructionCache(>) 
 87 

NtCreateThread(>) 
 2 
NtOpenThreadToken(>) 
 5 
NtQueryDefaultLocale(>) 
 14 
NtOpenKey(>) 
 147 

NtDeleteAtom(>) 
 2 
NtUserRegisterWindowMessage(>) 
 5 
NtQueryInformationFile(>) 
 14 
NtProtectVirtualMemory(>) 
 174 

NtDuplicateToken(>) 
 2 
NtCreateKey(>) 
 6 
NtUnmapViewOfSection(>) 
 14 
NtClose(>) 
 207 

NtGdiCreateSolidBrush(>) 
 2 
NtSetValueKey(>) 
 6 
NtUserSelectPalette(>) 
 14 

NtOpenDirectoryObject(>) 
 2 
NtGdiBitBlt(>) 
 7 

Trace:
 00001  1036   NtOpenFile  (0x80100000, {24, 0, 0x240, 0, 0,  (0x80100000, {24, 0, 0x240, 0, 0, "\SystemRoot\Prefetch\PACKED.EXE-09ED06A1.pf"}, 0, 32, ... ) }, 0, 32, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00002  1036   NtOpenKey  (0x80000000, {24, 0, 0x40, 0, 0,  (0x80000000, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\packed.exe"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00003  1036   NtOpenKeyedEvent  (0x2000000, {24, 0, 0x0, 0, 0,  (0x2000000, {24, 0, 0x0, 0, 0, "\KernelObjects\CritSecOutOfMemoryEvent"}, ... 4, ) }, ... 4, ) == 0x0
 00004  1036   NtQuerySystemInformation  (Basic, 44, ... {Unknown=0,MaximumIncrement=156250,PhysicalPageSize=0x1000,NumberOfPhysicalPages=0xff7c,LowestPhysicalPage=0x1,HighestPhysicalPage=0xffff,AllocationGranularity=0x10000,LowestUserAddress=0x10000,HighestUserAddress=0x7ffeffff,ActiveProcessors=1,NumberProcessors=1,}, 0x0, ) == 0x0
 00005  1036   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ... 1310720, 1048576, ) == 0x0
 00006  1036   NtAllocateVirtualMemory  (-1, 1310720, 0, 4096, 4096, 4, ... 1310720, 4096, ) == 0x0
 00007  1036   NtAllocateVirtualMemory  (-1, 1314816, 0, 8192, 4096, 4, ... 1314816, 8192, ) == 0x0
 00008  1036   NtQuerySystemInformation  (Basic, 44, ... {Unknown=0,MaximumIncrement=156250,PhysicalPageSize=0x1000,NumberOfPhysicalPages=0xff7c,LowestPhysicalPage=0x1,HighestPhysicalPage=0xffff,AllocationGranularity=0x10000,LowestUserAddress=0x10000,HighestUserAddress=0x7ffeffff,ActiveProcessors=1,NumberProcessors=1,}, 0x0, ) == 0x0
 00009  1036   NtAllocateVirtualMemory  (-1, 0, 0, 65536, 8192, 4, ... 2359296, 65536, ) == 0x0
 00010  1036   NtAllocateVirtualMemory  (-1, 2359296, 0, 24576, 4096, 4, ... 2359296, 24576, ) == 0x0
 00011  1036   NtOpenDirectoryObject  (0x3, {24, 0, 0x40, 0, 0,  (0x3, {24, 0, 0x40, 0, 0, "\KnownDlls"}, ... 8, ) }, ... 8, ) == 0x0
 00012  1036   NtOpenSymbolicLinkObject  (0x1, {24, 8, 0x40, 0, 0,  (0x1, {24, 8, 0x40, 0, 0, "KnownDllPath"}, ... 12, ) }, ... 12, ) == 0x0
 00013  1036   NtQuerySymbolicLinkObject  (12, ...  (12, ... "C:\WINDOWS\system32", 0x0, ) , 0x0, ) == 0x0
 00014  1036   NtClose  (12, ... ) == 0x0
 00015  1036   NtOpenFile  (0x100020, {24, 0, 0x42, 0, 0,  (0x100020, {24, 0, 0x42, 0, 0, "\??\C:\scripts\"}, 3, 33, ... 12, {status=0x0, info=1}, ) }, 3, 33, ... 12, {status=0x0, info=1}, ) == 0x0
 00016  1036   NtQueryVolumeInformationFile  (12, 1243852, 8, Device, ... {status=0x0, info=8}, ) == 0x0
 00017  1036   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\u:\work\packed.exe.Local"}, 1243804, ... ) }, 1243804, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00018  1036   NtOpenSection  (0xe, {24, 8, 0x40, 0, 0,  (0xe, {24, 8, 0x40, 0, 0, "kernel32.dll"}, ... 16, ) }, ... 16, ) == 0x0
 00019  1036   NtMapViewOfSection  (16, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x7c800000), 0x0, 1003520, ) == 0x0
 00020  1036   NtClose  (16, ... ) == 0x0
 00021  1036   NtProtectVirtualMemory  (-1, (0x7c801000), 1568, 4, ... (0x7c801000), 4096, 32, ) == 0x0
 00022  1036   NtProtectVirtualMemory  (-1, (0x7c801000), 4096, 32, ... (0x7c801000), 4096, 4, ) == 0x0
 00023  1036   NtFlushInstructionCache  (-1, 2088767488, 1568, ... ) == 0x0
 00024  1036   NtQueryInformationProcess  (-1, 36, 4, ... {process info, class 36, size 4}, 0x0, ) == 0x0
 00025  1036   NtQuerySystemInformation  (RangeStart, 4, ... {system info, class 50, size 4}, 0x0, ) == 0x0
 00026  1036   NtQuerySystemInformation  (Basic, 44, ... {Unknown=0,MaximumIncrement=156250,PhysicalPageSize=0x1000,NumberOfPhysicalPages=0xff7c,LowestPhysicalPage=0x1,HighestPhysicalPage=0xffff,AllocationGranularity=0x10000,LowestUserAddress=0x10000,HighestUserAddress=0x7ffeffff,ActiveProcessors=1,NumberProcessors=1,}, 0x0, ) == 0x0
 00027  1036   NtCreateSection  (0xf001f, 0x0, {65536, 0}, 4, 67108864, 0, ... 16, ) == 0x0
 00028  1036   NtSecureConnectPort  ( ("\Windows\ApiPort", {0, 2, 1, 1}, {24, 16, 0, 65536, 0, 0}, 1319736, {12, 0, 0}, 1241944, 44, ... 24, {24, 16, 0, 65536, 2424832, 18415616}, {0, 0, 0}, 200, 44, ) , {0, 2, 1, 1}, {24, 16, 0, 65536, 0, 0}, 1319736, {12, 0, 0}, 1241944, 44, ... 24, {24, 16, 0, 65536, 2424832, 18415616}, {0, 0, 0}, 200, 44, ) == 0x0
 00029  1036   NtClose  (16, ... ) == 0x0
 00030  1036   NtQueryObject  (24, Handle, 2, ... {Inherit=0,ProtectFromClose=0,}, -1, ) == 0x0
 00031  1036   NtSetInformationObject  (24, Handle, {Inherit=0,ProtectFromClose=1,}, 256, ... ) == 0x0
 00032  1036   NtQuerySystemInformation  (Basic, 44, ... {Unknown=0,MaximumIncrement=156250,PhysicalPageSize=0x1000,NumberOfPhysicalPages=0xff7c,LowestPhysicalPage=0x1,HighestPhysicalPage=0xffff,AllocationGranularity=0x10000,LowestUserAddress=0x10000,HighestUserAddress=0x7ffeffff,ActiveProcessors=1,NumberProcessors=1,}, 0x0, ) == 0x0
 00033  1036   NtQueryVirtualMemory  (-1, 0x250000, Basic, 28, ... {BaseAddress=0x250000,AllocationBase=0x250000,AllocationProtect=0x4,RegionSize=0x10000,State=0x2000,Protect=0x0,Type=0x40000,}, 0x0, ) == 0x0
 00034  1036   NtAllocateVirtualMemory  (-1, 2424832, 0, 4096, 4096, 4, ... 2424832, 4096, ) == 0x0
 00035  1036   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1242260, 1242460, 2089900544, 1242184}  (24, {28, 56, new_msg, 0, 1242260, 1242460, 2089900544, 1242184} "\210\6\31\1\0\0\0\0eZ\221|\0\0\0\0\1\0\0\0\234\6\31\1\4\0\0\0" ... {28, 56, reply, 0, 1248, 1036, 57957, 0} "`\375\27\0\0\0\0\0\0\0\0\0\0\0\0\0\1\0\0\0\234\6\31\1\4\0\0\0" )  ... {28, 56, reply, 0, 1248, 1036, 57957, 0}  (24, {28, 56, new_msg, 0, 1242260, 1242460, 2089900544, 1242184} "\210\6\31\1\0\0\0\0eZ\221|\0\0\0\0\1\0\0\0\234\6\31\1\4\0\0\0" ... {28, 56, reply, 0, 1248, 1036, 57957, 0} "`\375\27\0\0\0\0\0\0\0\0\0\0\0\0\0\1\0\0\0\234\6\31\1\4\0\0\0" )  ) == 0x0
 00036  1036   NtRegisterThreadTerminatePort  (24, ... ) == 0x0
 00037  1036   NtAllocateVirtualMemory  (-1, 1232896, 0, 4096, 4096, 260, ... 1232896, 4096, ) == 0x0
 00038  1036   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\System\CurrentControlSet\Control\Terminal Server"}, ... 16, ) }, ... 16, ) == 0x0
 00039  1036   NtQueryValueKey  (16,  (16, "TSAppCompat", Partial, 548, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) , Partial, 548, ... TitleIdx=0, Type=4, Data= (16, "TSAppCompat", Partial, 548, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) }, 16, ) == 0x0
 00040  1036   NtClose  (16, ... ) == 0x0
 00041  1036   NtOpenSection  (0x4, {24, 0, 0x40, 0, 0,  (0x4, {24, 0, 0x40, 0, 0, "\NLS\NlsSectionUnicode"}, ... 16, ) }, ... 16, ) == 0x0
 00042  1036   NtMapViewOfSection  (16, -1, (0x0), 0, 0, 0x0, 0, 2, 0, 2, ... (0x260000), 0x0, 90112, ) == 0x0
 00043  1036   NtClose  (16, ... ) == 0x0
 00044  1036   NtQueryDefaultLocale  (0, 2089305000, ... ) == 0x0
 00045  1036   NtOpenSection  (0x4, {24, 0, 0x40, 0, 0,  (0x4, {24, 0, 0x40, 0, 0, "\NLS\NlsSectionLocale"}, ... 16, ) }, ... 16, ) == 0x0
 00046  1036   NtMapViewOfSection  (16, -1, (0x0), 0, 0, 0x0, 0, 2, 0, 2, ... (0x280000), 0x0, 249856, ) == 0x0
 00047  1036   NtClose  (16, ... ) == 0x0
 00048  1036   NtOpenSection  (0x5, {24, 0, 0x40, 0, 0,  (0x5, {24, 0, 0x40, 0, 0, "\NLS\NlsSectionSortkey"}, ... 16, ) }, ... 16, ) == 0x0
 00049  1036   NtMapViewOfSection  (16, -1, (0x0), 0, 0, 0x0, 0, 2, 0, 2, ... (0x2c0000), 0x0, 266240, ) == 0x0
 00050  1036   NtQuerySection  (16, Basic, 16, ... {BaseAddress=0x0,Attributes=0x800000,Size={0x40004, 0x0},}, 0x0, ) == 0x0
 00051  1036   NtClose  (16, ... ) == 0x0
 00052  1036   NtOpenSection  (0x4, {24, 0, 0x40, 0, 0,  (0x4, {24, 0, 0x40, 0, 0, "\NLS\NlsSectionSortTbls"}, ... 16, ) }, ... 16, ) == 0x0
 00053  1036   NtMapViewOfSection  (16, -1, (0x0), 0, 0, 0x0, 0, 2, 0, 2, ... (0x310000), 0x0, 24576, ) == 0x0
 00054  1036   NtClose  (16, ... ) == 0x0
 00055  1036   NtQueryVirtualMemory  (-1, 0x7ffd2000, Basic, 28, ... {BaseAddress=0x7ffd2000,AllocationBase=0x7ffb0000,AllocationProtect=0x2,RegionSize=0x2000,State=0x1000,Protect=0x2,Type=0x40000,}, 0x0, ) == 0x0
 00056  1036   NtOpenSection  (0x4, {24, 0, 0x40, 0, 0,  (0x4, {24, 0, 0x40, 0, 0, "\NLS\NlsSectionSortkey00000409"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00057  1036   NtOpenSection  (0x4, {24, 0, 0x40, 0, 0,  (0x4, {24, 0, 0x40, 0, 0, "\NLS\NlsSectionSortkey00000409"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00058  1036   NtAllocateVirtualMemory  (-1, 2428928, 0, 8192, 4096, 4, ... 2428928, 8192, ) == 0x0
 00059  1036   NtRequestWaitReplyPort  (24, {24, 52, new_msg, 0, 7012468, 7929957, 3145776, 3145776}  (24, {24, 52, new_msg, 0, 7012468, 7929957, 3145776, 3145776} "\210\6\31\1\36\0\1\0\0\0\0\0\377\377\377\377\234\6\31\1p\30\0\0" ... {24, 52, reply, 0, 1248, 1036, 57958, 0} "\10P\30\0\36\0\1\0\0\0\0\0\377\377\377\377\234\6\31\1p\30\0\0" )  ... {24, 52, reply, 0, 1248, 1036, 57958, 0}  (24, {24, 52, new_msg, 0, 7012468, 7929957, 3145776, 3145776} "\210\6\31\1\36\0\1\0\0\0\0\0\377\377\377\377\234\6\31\1p\30\0\0" ... {24, 52, reply, 0, 1248, 1036, 57958, 0} "\10P\30\0\36\0\1\0\0\0\0\0\377\377\377\377\234\6\31\1p\30\0\0" )  ) == 0x0
 00060  1036   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 2089305760, 2090321376, 0, 0}  (24, {28, 56, new_msg, 0, 2089305760, 2090321376, 0, 0} "\210\6\31\1\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\234\6\31\18\6\0\0" ... {28, 56, reply, 0, 1248, 1036, 57959, 0} "\250\202\26\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\234\6\31\18\6\0\0" )  ... {28, 56, reply, 0, 1248, 1036, 57959, 0}  (24, {28, 56, new_msg, 0, 2089305760, 2090321376, 0, 0} "\210\6\31\1\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\234\6\31\18\6\0\0" ... {28, 56, reply, 0, 1248, 1036, 57959, 0} "\250\202\26\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\234\6\31\18\6\0\0" )  ) == 0x0
 00061  1036   NtProtectVirtualMemory  (-1, (0x31428000), 8192, 4, ... (0x31428000), 8192, 128, ) == 0x0
 00062  1036   NtProtectVirtualMemory  (-1, (0x31428000), 8192, 128, ... (0x31428000), 8192, 4, ) == 0x0
 00063  1036   NtFlushInstructionCache  (-1, 826441728, 8192, ... ) == 0x0
 00064  1036   NtOpenSection  (0xe, {24, 8, 0x40, 0, 0,  (0xe, {24, 8, 0x40, 0, 0, "ADVAPI32.dll"}, ... 16, ) }, ... 16, ) == 0x0
 00065  1036   NtMapViewOfSection  (16, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x77dd0000), 0x0, 634880, ) == 0x0
 00066  1036   NtClose  (16, ... ) == 0x0
 00067  1036   NtProtectVirtualMemory  (-1, (0x77dd1000), 1700, 4, ... (0x77dd1000), 4096, 32, ) == 0x0
 00068  1036   NtProtectVirtualMemory  (-1, (0x77dd1000), 4096, 32, ... (0x77dd1000), 4096, 4, ) == 0x0
 00069  1036   NtFlushInstructionCache  (-1, 2010976256, 1700, ... ) == 0x0
 00070  1036   NtOpenSection  (0xe, {24, 8, 0x40, 0, 0,  (0xe, {24, 8, 0x40, 0, 0, "RPCRT4.dll"}, ... 16, ) }, ... 16, ) == 0x0
 00071  1036   NtMapViewOfSection  (16, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x77e70000), 0x0, 593920, ) == 0x0
 00072  1036   NtClose  (16, ... ) == 0x0
 00073  1036   NtProtectVirtualMemory  (-1, (0x77e71000), 868, 4, ... (0x77e71000), 4096, 32, ) == 0x0
 00074  1036   NtProtectVirtualMemory  (-1, (0x77e71000), 4096, 32, ... (0x77e71000), 4096, 4, ) == 0x0
 00075  1036   NtFlushInstructionCache  (-1, 2011631616, 868, ... ) == 0x0
 00076  1036   NtProtectVirtualMemory  (-1, (0x77e71000), 868, 4, ... (0x77e71000), 4096, 32, ) == 0x0
 00077  1036   NtProtectVirtualMemory  (-1, (0x77e71000), 4096, 32, ... (0x77e71000), 4096, 4, ) == 0x0
 00078  1036   NtFlushInstructionCache  (-1, 2011631616, 868, ... ) == 0x0
 00079  1036   NtProtectVirtualMemory  (-1, (0x77e71000), 868, 4, ... (0x77e71000), 4096, 32, ) == 0x0
 00080  1036   NtProtectVirtualMemory  (-1, (0x77e71000), 4096, 32, ... (0x77e71000), 4096, 4, ) == 0x0
 00081  1036   NtFlushInstructionCache  (-1, 2011631616, 868, ... ) == 0x0
 00082  1036   NtProtectVirtualMemory  (-1, (0x77dd1000), 1700, 4, ... (0x77dd1000), 4096, 32, ) == 0x0
 00083  1036   NtProtectVirtualMemory  (-1, (0x77dd1000), 4096, 32, ... (0x77dd1000), 4096, 4, ) == 0x0
 00084  1036   NtFlushInstructionCache  (-1, 2010976256, 1700, ... ) == 0x0
 00085  1036   NtProtectVirtualMemory  (-1, (0x31428000), 8192, 4, ... (0x31428000), 8192, 64, ) == 0x0
 00086  1036   NtProtectVirtualMemory  (-1, (0x31428000), 8192, 64, ... (0x31428000), 8192, 4, ) == 0x0
 00087  1036   NtFlushInstructionCache  (-1, 826441728, 8192, ... ) == 0x0
 00088  1036   NtOpenSection  (0xe, {24, 8, 0x40, 0, 0,  (0xe, {24, 8, 0x40, 0, 0, "MSVCRT.dll"}, ... 16, ) }, ... 16, ) == 0x0
 00089  1036   NtMapViewOfSection  (16, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x77c10000), 0x0, 360448, ) == 0x0
 00090  1036   NtClose  (16, ... ) == 0x0
 00091  1036   NtProtectVirtualMemory  (-1, (0x77c11000), 632, 4, ... (0x77c11000), 4096, 32, ) == 0x0
 00092  1036   NtProtectVirtualMemory  (-1, (0x77c11000), 4096, 32, ... (0x77c11000), 4096, 4, ) == 0x0
 00093  1036   NtFlushInstructionCache  (-1, 2009141248, 632, ... ) == 0x0
 00094  1036   NtProtectVirtualMemory  (-1, (0x31428000), 8192, 4, ... (0x31428000), 8192, 64, ) == 0x0
 00095  1036   NtProtectVirtualMemory  (-1, (0x31428000), 8192, 64, ... (0x31428000), 8192, 4, ) == 0x0
 00096  1036   NtFlushInstructionCache  (-1, 826441728, 8192, ... ) == 0x0
 00097  1036   NtOpenSection  (0xe, {24, 8, 0x40, 0, 0,  (0xe, {24, 8, 0x40, 0, 0, "USER32.dll"}, ... 16, ) }, ... 16, ) == 0x0
 00098  1036   NtMapViewOfSection  (16, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x7e410000), 0x0, 589824, ) == 0x0
 00099  1036   NtClose  (16, ... ) == 0x0
 00100  1036   NtOpenSection  (0xe, {24, 8, 0x40, 0, 0,  (0xe, {24, 8, 0x40, 0, 0, "GDI32.dll"}, ... 16, ) }, ... 16, ) == 0x0
 00101  1036   NtMapViewOfSection  (16, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x77f10000), 0x0, 290816, ) == 0x0
 00102  1036   NtClose  (16, ... ) == 0x0
 00103  1036   NtProtectVirtualMemory  (-1, (0x77f11000), 508, 4, ... (0x77f11000), 4096, 32, ) == 0x0
 00104  1036   NtProtectVirtualMemory  (-1, (0x77f11000), 4096, 32, ... (0x77f11000), 4096, 4, ) == 0x0
 00105  1036   NtFlushInstructionCache  (-1, 2012286976, 508, ... ) == 0x0
 00106  1036   NtProtectVirtualMemory  (-1, (0x77f11000), 508, 4, ... (0x77f11000), 4096, 32, ) == 0x0
 00107  1036   NtProtectVirtualMemory  (-1, (0x77f11000), 4096, 32, ... (0x77f11000), 4096, 4, ) == 0x0
 00108  1036   NtFlushInstructionCache  (-1, 2012286976, 508, ... ) == 0x0
 00109  1036   NtProtectVirtualMemory  (-1, (0x77f11000), 508, 4, ... (0x77f11000), 4096, 32, ) == 0x0
 00110  1036   NtProtectVirtualMemory  (-1, (0x77f11000), 4096, 32, ... (0x77f11000), 4096, 4, ) == 0x0
 00111  1036   NtFlushInstructionCache  (-1, 2012286976, 508, ... ) == 0x0
 00112  1036   NtProtectVirtualMemory  (-1, (0x7e411000), 1252, 4, ... (0x7e411000), 4096, 32, ) == 0x0
 00113  1036   NtProtectVirtualMemory  (-1, (0x7e411000), 4096, 32, ... (0x7e411000), 4096, 4, ) == 0x0
 00114  1036   NtFlushInstructionCache  (-1, 2118193152, 1252, ... ) == 0x0
 00115  1036   NtProtectVirtualMemory  (-1, (0x7e411000), 1252, 4, ... (0x7e411000), 4096, 32, ) == 0x0
 00116  1036   NtProtectVirtualMemory  (-1, (0x7e411000), 4096, 32, ... (0x7e411000), 4096, 4, ) == 0x0
 00117  1036   NtFlushInstructionCache  (-1, 2118193152, 1252, ... ) == 0x0
 00118  1036   NtProtectVirtualMemory  (-1, (0x7e411000), 1252, 4, ... (0x7e411000), 4096, 32, ) == 0x0
 00119  1036   NtProtectVirtualMemory  (-1, (0x7e411000), 4096, 32, ... (0x7e411000), 4096, 4, ) == 0x0
 00120  1036   NtFlushInstructionCache  (-1, 2118193152, 1252, ... ) == 0x0
 00121  1036   NtProtectVirtualMemory  (-1, (0x31428000), 8192, 4, ... (0x31428000), 8192, 64, ) == 0x0
 00122  1036   NtProtectVirtualMemory  (-1, (0x31428000), 8192, 64, ... (0x31428000), 8192, 4, ) == 0x0
 00123  1036   NtFlushInstructionCache  (-1, 826441728, 8192, ... ) == 0x0
 00124  1036   NtOpenSection  (0xe, {24, 8, 0x40, 0, 0,  (0xe, {24, 8, 0x40, 0, 0, "WININET.dll"}, ... 16, ) }, ... 16, ) == 0x0
 00125  1036   NtMapViewOfSection  (16, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x42c10000), 0x0, 847872, ) == 0x0
 00126  1036   NtClose  (16, ... ) == 0x0
 00127  1036   NtProtectVirtualMemory  (-1, (0x42c11000), 1452, 4, ... (0x42c11000), 4096, 32, ) == 0x0
 00128  1036   NtProtectVirtualMemory  (-1, (0x42c11000), 4096, 32, ... (0x42c11000), 4096, 4, ) == 0x0
 00129  1036   NtFlushInstructionCache  (-1, 1119948800, 1452, ... ) == 0x0
 00130  1036   NtProtectVirtualMemory  (-1, (0x42c11000), 1452, 4, ... (0x42c11000), 4096, 32, ) == 0x0
 00131  1036   NtProtectVirtualMemory  (-1, (0x42c11000), 4096, 32, ... (0x42c11000), 4096, 4, ) == 0x0
 00132  1036   NtFlushInstructionCache  (-1, 1119948800, 1452, ... ) == 0x0
 00133  1036   NtOpenSection  (0xe, {24, 8, 0x40, 0, 0,  (0xe, {24, 8, 0x40, 0, 0, "SHLWAPI.dll"}, ... 16, ) }, ... 16, ) == 0x0
 00134  1036   NtMapViewOfSection  (16, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x77f60000), 0x0, 483328, ) == 0x0
 00135  1036   NtClose  (16, ... ) == 0x0
 00136  1036   NtProtectVirtualMemory  (-1, (0x77f61000), 2076, 4, ... (0x77f61000), 4096, 32, ) == 0x0
 00137  1036   NtProtectVirtualMemory  (-1, (0x77f61000), 4096, 32, ... (0x77f61000), 4096, 4, ) == 0x0
 00138  1036   NtFlushInstructionCache  (-1, 2012614656, 2076, ... ) == 0x0
 00139  1036   NtProtectVirtualMemory  (-1, (0x77f61000), 2076, 4, ... (0x77f61000), 4096, 32, ) == 0x0
 00140  1036   NtProtectVirtualMemory  (-1, (0x77f61000), 4096, 32, ... (0x77f61000), 4096, 4, ) == 0x0
 00141  1036   NtFlushInstructionCache  (-1, 2012614656, 2076, ... ) == 0x0
 00142  1036   NtProtectVirtualMemory  (-1, (0x77f61000), 2076, 4, ... (0x77f61000), 4096, 32, ) == 0x0
 00143  1036   NtProtectVirtualMemory  (-1, (0x77f61000), 4096, 32, ... (0x77f61000), 4096, 4, ) == 0x0
 00144  1036   NtFlushInstructionCache  (-1, 2012614656, 2076, ... ) == 0x0
 00145  1036   NtProtectVirtualMemory  (-1, (0x77f61000), 2076, 4, ... (0x77f61000), 4096, 32, ) == 0x0
 00146  1036   NtProtectVirtualMemory  (-1, (0x77f61000), 4096, 32, ... (0x77f61000), 4096, 4, ) == 0x0
 00147  1036   NtFlushInstructionCache  (-1, 2012614656, 2076, ... ) == 0x0
 00148  1036   NtProtectVirtualMemory  (-1, (0x77f61000), 2076, 4, ... (0x77f61000), 4096, 32, ) == 0x0
 00149  1036   NtProtectVirtualMemory  (-1, (0x77f61000), 4096, 32, ... (0x77f61000), 4096, 4, ) == 0x0
 00150  1036   NtFlushInstructionCache  (-1, 2012614656, 2076, ... ) == 0x0
 00151  1036   NtProtectVirtualMemory  (-1, (0x42c11000), 1452, 4, ... (0x42c11000), 4096, 32, ) == 0x0
 00152  1036   NtProtectVirtualMemory  (-1, (0x42c11000), 4096, 32, ... (0x42c11000), 4096, 4, ) == 0x0
 00153  1036   NtFlushInstructionCache  (-1, 1119948800, 1452, ... ) == 0x0
 00154  1036   NtProtectVirtualMemory  (-1, (0x42c11000), 1452, 4, ... (0x42c11000), 4096, 32, ) == 0x0
 00155  1036   NtProtectVirtualMemory  (-1, (0x42c11000), 4096, 32, ... (0x42c11000), 4096, 4, ) == 0x0
 00156  1036   NtFlushInstructionCache  (-1, 1119948800, 1452, ... ) == 0x0
 00157  1036   NtProtectVirtualMemory  (-1, (0x42c11000), 1452, 4, ... (0x42c11000), 4096, 32, ) == 0x0
 00158  1036   NtProtectVirtualMemory  (-1, (0x42c11000), 4096, 32, ... (0x42c11000), 4096, 4, ) == 0x0
 00159  1036   NtFlushInstructionCache  (-1, 1119948800, 1452, ... ) == 0x0
 00160  1036   NtProtectVirtualMemory  (-1, (0x42c11000), 1452, 4, ... (0x42c11000), 4096, 32, ) == 0x0
 00161  1036   NtProtectVirtualMemory  (-1, (0x42c11000), 4096, 32, ... (0x42c11000), 4096, 4, ) == 0x0
 00162  1036   NtFlushInstructionCache  (-1, 1119948800, 1452, ... ) == 0x0
 00163  1036   NtOpenSection  (0xe, {24, 8, 0x40, 0, 0,  (0xe, {24, 8, 0x40, 0, 0, "Normaliz.dll"}, ... 16, ) }, ... 16, ) == 0x0
 00164  1036   NtMapViewOfSection  (16, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x400000), 0x0, 36864, ) == 0x0
 00165  1036   NtClose  (16, ... ) == 0x0
 00166  1036   NtProtectVirtualMemory  (-1, (0x401000), 160, 4, ... (0x401000), 4096, 32, ) == 0x0
 00167  1036   NtProtectVirtualMemory  (-1, (0x401000), 4096, 32, ... (0x401000), 4096, 4, ) == 0x0
 00168  1036   NtFlushInstructionCache  (-1, 4198400, 160, ... ) == 0x0
 00169  1036   NtProtectVirtualMemory  (-1, (0x401000), 160, 4, ... (0x401000), 4096, 32, ) == 0x0
 00170  1036   NtProtectVirtualMemory  (-1, (0x401000), 4096, 32, ... (0x401000), 4096, 4, ) == 0x0
 00171  1036   NtFlushInstructionCache  (-1, 4198400, 160, ... ) == 0x0
 00172  1036   NtProtectVirtualMemory  (-1, (0x401000), 160, 4, ... (0x401000), 4096, 32, ) == 0x0
 00173  1036   NtProtectVirtualMemory  (-1, (0x401000), 4096, 32, ... (0x401000), 4096, 4, ) == 0x0
 00174  1036   NtFlushInstructionCache  (-1, 4198400, 160, ... ) == 0x0
 00175  1036   NtProtectVirtualMemory  (-1, (0x42c11000), 1452, 4, ... (0x42c11000), 4096, 32, ) == 0x0
 00176  1036   NtProtectVirtualMemory  (-1, (0x42c11000), 4096, 32, ... (0x42c11000), 4096, 4, ) == 0x0
 00177  1036   NtFlushInstructionCache  (-1, 1119948800, 1452, ... ) == 0x0
 00178  1036   NtOpenSection  (0xe, {24, 8, 0x40, 0, 0,  (0xe, {24, 8, 0x40, 0, 0, "iertutil.dll"}, ... 16, ) }, ... 16, ) == 0x0
 00179  1036   NtMapViewOfSection  (16, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x42990000), 0x0, 282624, ) == 0x0
 00180  1036   NtClose  (16, ... ) == 0x0
 00181  1036   NtProtectVirtualMemory  (-1, (0x42991000), 616, 4, ... (0x42991000), 4096, 32, ) == 0x0
 00182  1036   NtProtectVirtualMemory  (-1, (0x42991000), 4096, 32, ... (0x42991000), 4096, 4, ) == 0x0
 00183  1036   NtFlushInstructionCache  (-1, 1117327360, 616, ... ) == 0x0
 00184  1036   NtProtectVirtualMemory  (-1, (0x42991000), 616, 4, ... (0x42991000), 4096, 32, ) == 0x0
 00185  1036   NtProtectVirtualMemory  (-1, (0x42991000), 4096, 32, ... (0x42991000), 4096, 4, ) == 0x0
 00186  1036   NtFlushInstructionCache  (-1, 1117327360, 616, ... ) == 0x0
 00187  1036   NtProtectVirtualMemory  (-1, (0x42991000), 616, 4, ... (0x42991000), 4096, 32, ) == 0x0
 00188  1036   NtProtectVirtualMemory  (-1, (0x42991000), 4096, 32, ... (0x42991000), 4096, 4, ) == 0x0
 00189  1036   NtFlushInstructionCache  (-1, 1117327360, 616, ... ) == 0x0
 00190  1036   NtProtectVirtualMemory  (-1, (0x42991000), 616, 4, ... (0x42991000), 4096, 32, ) == 0x0
 00191  1036   NtProtectVirtualMemory  (-1, (0x42991000), 4096, 32, ... (0x42991000), 4096, 4, ) == 0x0
 00192  1036   NtFlushInstructionCache  (-1, 1117327360, 616, ... ) == 0x0
 00193  1036   NtProtectVirtualMemory  (-1, (0x42991000), 616, 4, ... (0x42991000), 4096, 32, ) == 0x0
 00194  1036   NtProtectVirtualMemory  (-1, (0x42991000), 4096, 32, ... (0x42991000), 4096, 4, ) == 0x0
 00195  1036   NtFlushInstructionCache  (-1, 1117327360, 616, ... ) == 0x0
 00196  1036   NtProtectVirtualMemory  (-1, (0x42991000), 616, 4, ... (0x42991000), 4096, 32, ) == 0x0
 00197  1036   NtProtectVirtualMemory  (-1, (0x42991000), 4096, 32, ... (0x42991000), 4096, 4, ) == 0x0
 00198  1036   NtFlushInstructionCache  (-1, 1117327360, 616, ... ) == 0x0
 00199  1036   NtProtectVirtualMemory  (-1, (0x42c11000), 1452, 4, ... (0x42c11000), 4096, 32, ) == 0x0
 00200  1036   NtProtectVirtualMemory  (-1, (0x42c11000), 4096, 32, ... (0x42c11000), 4096, 4, ) == 0x0
 00201  1036   NtFlushInstructionCache  (-1, 1119948800, 1452, ... ) == 0x0
 00202  1036   NtProtectVirtualMemory  (-1, (0x31428000), 8192, 4, ... (0x31428000), 8192, 64, ) == 0x0
 00203  1036   NtProtectVirtualMemory  (-1, (0x31428000), 8192, 64, ... (0x31428000), 8192, 4, ) == 0x0
 00204  1036   NtFlushInstructionCache  (-1, 826441728, 8192, ... ) == 0x0
 00205  1036   NtOpenSection  (0xe, {24, 8, 0x40, 0, 0,  (0xe, {24, 8, 0x40, 0, 0, "WS2_32.dll"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00206  1036   NtAllocateVirtualMemory  (-1, 1323008, 0, 4096, 4096, 4, ... 1323008, 4096, ) == 0x0
 00207  1036   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\u:\work\WS2_32.dll"}, 1242572, ... ) }, 1242572, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00208  1036   NtFsControlFile  (12, 0, 0x0, 0x0, 0x90028, 0x0, 0, 0, ... {status=0x0, info=0}, 0x0, ) == 0x0
 00209  1036   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\WS2_32.dll"}, 1242572, ... ) }, 1242572, ... ) == 0x0
 00210  1036   NtOpenFile  (0x100020, {24, 0, 0x40, 0, 0,  (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\WS2_32.dll"}, 5, 96, ... 16, {status=0x0, info=1}, ) }, 5, 96, ... 16, {status=0x0, info=1}, ) == 0x0
 00211  1036   NtCreateSection  (0xf, 0x0, 0x0, 16, 16777216, 16, ... 28, ) == 0x0
 00212  1036   NtQuerySection  (28, Image, 48, ... {section info, class 1, size 48}, 0x0, ) == 0x0
 00213  1036   NtOpenProcessToken  (-1, 0x8, ... 32, ) == 0x0
 00214  1036   NtQueryInformationToken  (32, User, 136, ... {token info, class 1, size 36}, 36, ) == 0x0
 00215  1036   NtOpenKey  (0x3, {24, 0, 0x40, 0, 0,  (0x3, {24, 0, 0x40, 0, 0, "\Registry\MACHINE\System\CurrentControlSet\Control\SafeBoot\Option"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00216  1036   NtOpenKey  (0x1, {24, 0, 0x40, 0, 0,  (0x1, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers"}, ... 36, ) }, ... 36, ) == 0x0
 00217  1036   NtQueryValueKey  (36,  (36, "TransparentEnabled", Partial, 80, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) , Partial, 80, ... TitleIdx=0, Type=4, Data= (36, "TransparentEnabled", Partial, 80, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) }, 16, ) == 0x0
 00218  1036   NtClose  (36, ... ) == 0x0
 00219  1036   NtOpenThreadTokenEx  (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN
 00220  1036   NtOpenProcessTokenEx  (-1, 0x20008, 512, ... 36, ) == 0x0
 00221  1036   NtQueryInformationToken  (36, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0
 00222  1036   NtClose  (36, ... ) == 0x0
 00223  1036   NtOpenKey  (0x1, {24, 0, 0x40, 0, 0,  (0x1, {24, 0, 0x40, 0, 0, "\REGISTRY\USER\S-1-5-21-1292428093-1383384898-725345543-1003\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00224  1036   NtClose  (32, ... ) == 0x0
 00225  1036   NtClose  (16, ... ) == 0x0
 00226  1036   NtMapViewOfSection  (28, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x71ab0000), 0x0, 94208, ) == 0x0
 00227  1036   NtClose  (28, ... ) == 0x0
 00228  1036   NtProtectVirtualMemory  (-1, (0x71ab1000), 468, 4, ... (0x71ab1000), 4096, 32, ) == 0x0
 00229  1036   NtProtectVirtualMemory  (-1, (0x71ab1000), 4096, 32, ... (0x71ab1000), 4096, 4, ) == 0x0
 00230  1036   NtFlushInstructionCache  (-1, 1907036160, 468, ... ) == 0x0
 00231  1036   NtOpenSection  (0xe, {24, 8, 0x40, 0, 0,  (0xe, {24, 8, 0x40, 0, 0, "WS2HELP.dll"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00232  1036   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\u:\work\WS2HELP.dll"}, 1241756, ... ) }, 1241756, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00233  1036   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\WS2HELP.dll"}, 1241756, ... ) }, 1241756, ... ) == 0x0
 00234  1036   NtOpenFile  (0x100020, {24, 0, 0x40, 0, 0,  (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\WS2HELP.dll"}, 5, 96, ... 28, {status=0x0, info=1}, ) }, 5, 96, ... 28, {status=0x0, info=1}, ) == 0x0
 00235  1036   NtCreateSection  (0xf, 0x0, 0x0, 16, 16777216, 28, ... 16, ) == 0x0
 00236  1036   NtQuerySection  (16, Image, 48, ... {section info, class 1, size 48}, 0x0, ) == 0x0
 00237  1036   NtClose  (28, ... ) == 0x0
 00238  1036   NtMapViewOfSection  (16, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x71aa0000), 0x0, 32768, ) == 0x0
 00239  1036   NtClose  (16, ... ) == 0x0
 00240  1036   NtProtectVirtualMemory  (-1, (0x71aa1000), 352, 4, ... (0x71aa1000), 4096, 32, ) == 0x0
 00241  1036   NtProtectVirtualMemory  (-1, (0x71aa1000), 4096, 32, ... (0x71aa1000), 4096, 4, ) == 0x0
 00242  1036   NtFlushInstructionCache  (-1, 1906970624, 352, ... ) == 0x0
 00243  1036   NtProtectVirtualMemory  (-1, (0x71ab1000), 468, 4, ... (0x71ab1000), 4096, 32, ) == 0x0
 00244  1036   NtProtectVirtualMemory  (-1, (0x71ab1000), 4096, 32, ... (0x71ab1000), 4096, 4, ) == 0x0
 00245  1036   NtFlushInstructionCache  (-1, 1907036160, 468, ... ) == 0x0
 00246  1036   NtProtectVirtualMemory  (-1, (0x31428000), 8192, 4, ... (0x31428000), 8192, 64, ) == 0x0
 00247  1036   NtProtectVirtualMemory  (-1, (0x31428000), 8192, 64, ... (0x31428000), 8192, 4, ) == 0x0
 00248  1036   NtFlushInstructionCache  (-1, 826441728, 8192, ... ) == 0x0
 00249  1036   NtQueryInformationProcess  (-1, 37, 48, ... {process info, class 37, size 48}, 0x0, ) == 0x0
 00250  1036   NtOpenFile  (0x100001, {24, 0, 0x40, 0, 0,  (0x100001, {24, 0, 0x40, 0, 0, "\??\u:\work\packed.exe"}, 5, 96, ... 16, {status=0x0, info=1}, ) }, 5, 96, ... 16, {status=0x0, info=1}, ) == 0x0
 00251  1036   NtReadFile  (16, 0, 0, 0, 4, {187356, 0}, 0, ... {status=0x0, info=4},  (16, 0, 0, 0, 4, {187356, 0}, 0, ... {status=0x0, info=4}, "\337`>\0", ) , ) == 0x0
 00252  1036   NtClose  (16, ... ) == 0x0
 00253  1036   NtSetInformationProcess  (-1, 34, {process info, class 34, size 4}, 4, ... ) == 0x0
 00254  1036   NtOpenProcessToken  (-1, 0x8, ... 16, ) == 0x0
 00255  1036   NtQueryInformationToken  (16, Statistics, 56, ... {token info, class 10, size 56}, 56, ) == 0x0
 00256  1036   NtClose  (16, ... ) == 0x0
 00257  1036   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\System\CurrentControlSet\Control\Terminal Server"}, ... 16, ) }, ... 16, ) == 0x0
 00258  1036   NtQueryValueKey  (16,  (16, "TSAppCompat", Partial, 548, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) , Partial, 548, ... TitleIdx=0, Type=4, Data= (16, "TSAppCompat", Partial, 548, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) }, 16, ) == 0x0
 00259  1036   NtClose  (16, ... ) == 0x0
 00260  1036   NtOpenKey  (0x80000000, {24, 0, 0x40, 0, 0,  (0x80000000, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RPCRT4.dll"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00261  1036   NtOpenKey  (0x80000000, {24, 0, 0x40, 0, 0,  (0x80000000, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ADVAPI32.dll"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00262  1036   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\System\CurrentControlSet\Control\Terminal Server"}, ... 16, ) }, ... 16, ) == 0x0
 00263  1036   NtQueryValueKey  (16,  (16, "TSAppCompat", Partial, 548, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) , Partial, 548, ... TitleIdx=0, Type=4, Data= (16, "TSAppCompat", Partial, 548, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) }, 16, ) == 0x0
 00264  1036   NtQueryValueKey  (16,  (16, "TSUserEnabled", Partial, 548, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) , Partial, 548, ... TitleIdx=0, Type=4, Data= (16, "TSUserEnabled", Partial, 548, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) }, 16, ) == 0x0
 00265  1036   NtClose  (16, ... ) == 0x0
 00266  1036   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon"}, ... 16, ) }, ... 16, ) == 0x0
 00267  1036   NtQueryValueKey  (16,  (16, "LeakTrack", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00268  1036   NtClose  (16, ... ) == 0x0
 00269  1036   NtOpenKey  (0x2000000, {24, 0, 0x40, 0, 0,  (0x2000000, {24, 0, 0x40, 0, 0, "\REGISTRY\MACHINE"}, ... 16, ) }, ... 16, ) == 0x0
 00270  1036   NtSetInformationObject  (16, Handle, {Inherit=0,ProtectFromClose=1,}, 2011431168, ... ) == 0x0
 00271  1036   NtOpenKey  (0x20019, {24, 16, 0x40, 0, 0,  (0x20019, {24, 16, 0x40, 0, 0, "Software\Microsoft\Windows NT\CurrentVersion\Diagnostics"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00272  1036   NtOpenKey  (0x80000000, {24, 0, 0x40, 0, 0,  (0x80000000, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MSVCRT.dll"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00273  1036   NtQuerySystemInformation  (Basic, 44, ... {Unknown=0,MaximumIncrement=156250,PhysicalPageSize=0x1000,NumberOfPhysicalPages=0xff7c,LowestPhysicalPage=0x1,HighestPhysicalPage=0xffff,AllocationGranularity=0x10000,LowestUserAddress=0x10000,HighestUserAddress=0x7ffeffff,ActiveProcessors=1,NumberProcessors=1,}, 0x0, ) == 0x0
 00274  1036   NtAllocateVirtualMemory  (-1, 0, 0, 65536, 8192, 4, ... 3276800, 65536, ) == 0x0
 00275  1036   NtAllocateVirtualMemory  (-1, 3276800, 0, 4096, 4096, 4, ... 3276800, 4096, ) == 0x0
 00276  1036   NtAllocateVirtualMemory  (-1, 3280896, 0, 8192, 4096, 4, ... 3280896, 8192, ) == 0x0
 00277  1036   NtAllocateVirtualMemory  (-1, 3289088, 0, 4096, 4096, 4, ... 3289088, 4096, ) == 0x0
 00278  1036   NtOpenSection  (0x4, {24, 0, 0x40, 0, 0,  (0x4, {24, 0, 0x40, 0, 0, "\NLS\NlsSectionCType"}, ... 28, ) }, ... 28, ) == 0x0
 00279  1036   NtMapViewOfSection  (28, -1, (0x0), 0, 0, 0x0, 0, 2, 0, 2, ... (0x330000), 0x0, 12288, ) == 0x0
 00280  1036   NtClose  (28, ... ) == 0x0
 00281  1036   NtAllocateVirtualMemory  (-1, 3293184, 0, 4096, 4096, 4, ... 3293184, 4096, ) == 0x0
 00282  1036   NtQueryVirtualMemory  (-1, 0x77c2807c, Basic, 28, ... {BaseAddress=0x77c28000,AllocationBase=0x77c10000,AllocationProtect=0x80,RegionSize=0x35000,State=0x1000,Protect=0x20,Type=0x1000000,}, 28, ) == 0x0
 00283  1036   NtQueryInformationProcess  (-1, 36, 4, ... {process info, class 36, size 4}, 0x0, ) == 0x0
 00284  1036   NtQueryInformationProcess  (-1, 36, 4, ... {process info, class 36, size 4}, 0x0, ) == 0x0
 00285  1036   NtQueryVirtualMemory  (-1, 0x0, Basic, 28, ... {BaseAddress=0x0,AllocationBase=0x0,AllocationProtect=0x0,RegionSize=0x10000,State=0x10000,Protect=0x1,Type=0x0,}, 28, ) == 0x0
 00286  1036   NtOpenKey  (0x80000000, {24, 0, 0x40, 0, 0,  (0x80000000, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\GDI32.dll"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00287  1036   NtOpenKey  (0x80000000, {24, 0, 0x40, 0, 0,  (0x80000000, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\USER32.dll"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00288  1036   NtQuerySystemInformation  (Basic, 44, ... {Unknown=0,MaximumIncrement=156250,PhysicalPageSize=0x1000,NumberOfPhysicalPages=0xff7c,LowestPhysicalPage=0x1,HighestPhysicalPage=0xffff,AllocationGranularity=0x10000,LowestUserAddress=0x10000,HighestUserAddress=0x7ffeffff,ActiveProcessors=1,NumberProcessors=1,}, 0x0, ) == 0x0
 00289  1036   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 256, 1243092, 256, 1242836}  (24, {28, 56, new_msg, 0, 256, 1243092, 256, 1242836} "\210\6\31\1\0\0\0\0\0\0\0\0\1\0\0\0\3\0\0\0\234\6\31\1$\1\0\0" ... {28, 56, reply, 0, 1248, 1036, 57960, 0} "\320G\26\0\0\0\0\0\0\0\0\0\1\0\0\0\3\0\0\0\234\6\31\1$\1\0\0" )  ... {28, 56, reply, 0, 1248, 1036, 57960, 0}  (24, {28, 56, new_msg, 0, 256, 1243092, 256, 1242836} "\210\6\31\1\0\0\0\0\0\0\0\0\1\0\0\0\3\0\0\0\234\6\31\1$\1\0\0" ... {28, 56, reply, 0, 1248, 1036, 57960, 0} "\320G\26\0\0\0\0\0\0\0\0\0\1\0\0\0\3\0\0\0\234\6\31\1$\1\0\0" )  ) == 0x0
 00290  1036   NtOpenKey  (0x1, {24, 0, 0x40, 0, 0,  (0x1, {24, 0, 0x40, 0, 0, "\Registry\MACHINE\System\CurrentControlSet\Control\Session Manager"}, ... 28, ) }, ... 28, ) == 0x0
 00291  1036   NtQueryValueKey  (28,  (28, "SafeDllSearchMode", Partial, 16, ... ) , Partial, 16, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00292  1036   NtClose  (28, ... ) == 0x0
 00293  1036   NtAllocateVirtualMemory  (-1, 1327104, 0, 4096, 4096, 4, ... 1327104, 4096, ) == 0x0
 00294  1036   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\IMM32.DLL"}, 1239420, ... ) }, 1239420, ... ) == 0x0
 00295  1036   NtOpenFile  (0x100020, {24, 0, 0x40, 0, 0,  (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\IMM32.DLL"}, 5, 96, ... 28, {status=0x0, info=1}, ) }, 5, 96, ... 28, {status=0x0, info=1}, ) == 0x0
 00296  1036   NtCreateSection  (0xe, 0x0, 0x0, 16, 134217728, 28, ... 32, ) == 0x0
 00297  1036   NtClose  (28, ... ) == 0x0
 00298  1036   NtMapViewOfSection  (32, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 16, ... (0x340000), 0x0, 110592, ) == 0x0
 00299  1036   NtClose  (32, ... ) == 0x0
 00300  1036   NtUnmapViewOfSection  (-1, 0x340000, ... ) == 0x0
 00301  1036   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\IMM32.DLL"}, 1239328, ... ) }, 1239328, ... ) == 0x0
 00302  1036   NtOpenFile  (0x100020, {24, 0, 0x40, 0, 0,  (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\IMM32.DLL"}, 5, 96, ... 32, {status=0x0, info=1}, ) }, 5, 96, ... 32, {status=0x0, info=1}, ) == 0x0
 00303  1036   NtCreateSection  (0xe, 0x0, 0x0, 16, 134217728, 32, ... 28, ) == 0x0
 00304  1036   NtClose  (32, ... ) == 0x0
 00305  1036   NtMapViewOfSection  (28, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 16, ... (0x340000), 0x0, 110592, ) == 0x0
 00306  1036   NtClose  (28, ... ) == 0x0
 00307  1036   NtUnmapViewOfSection  (-1, 0x340000, ... ) == 0x0
 00308  1036   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\IMM32.DLL"}, 1239636, ... ) }, 1239636, ... ) == 0x0
 00309  1036   NtOpenFile  (0x100020, {24, 0, 0x40, 0, 0,  (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\IMM32.DLL"}, 5, 96, ... 28, {status=0x0, info=1}, ) }, 5, 96, ... 28, {status=0x0, info=1}, ) == 0x0
 00310  1036   NtCreateSection  (0xf, 0x0, 0x0, 16, 16777216, 28, ... 32, ) == 0x0
 00311  1036   NtQuerySection  (32, Image, 48, ... {section info, class 1, size 48}, 0x0, ) == 0x0
 00312  1036   NtClose  (28, ... ) == 0x0
 00313  1036   NtMapViewOfSection  (32, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x76390000), 0x0, 118784, ) == 0x0
 00314  1036   NtClose  (32, ... ) == 0x0
 00315  1036   NtProtectVirtualMemory  (-1, (0x76391000), 696, 4, ... (0x76391000), 4096, 32, ) == 0x0
 00316  1036   NtProtectVirtualMemory  (-1, (0x76391000), 4096, 32, ... (0x76391000), 4096, 4, ) == 0x0
 00317  1036   NtFlushInstructionCache  (-1, 1983451136, 696, ... ) == 0x0
 00318  1036   NtProtectVirtualMemory  (-1, (0x76391000), 696, 4, ... (0x76391000), 4096, 32, ) == 0x0
 00319  1036   NtProtectVirtualMemory  (-1, (0x76391000), 4096, 32, ... (0x76391000), 4096, 4, ) == 0x0
 00320  1036   NtFlushInstructionCache  (-1, 1983451136, 696, ... ) == 0x0
 00321  1036   NtProtectVirtualMemory  (-1, (0x76391000), 696, 4, ... (0x76391000), 4096, 32, ) == 0x0
 00322  1036   NtProtectVirtualMemory  (-1, (0x76391000), 4096, 32, ... (0x76391000), 4096, 4, ) == 0x0
 00323  1036   NtFlushInstructionCache  (-1, 1983451136, 696, ... ) == 0x0
 00324  1036   NtOpenKey  (0x80000000, {24, 0, 0x40, 0, 0,  (0x80000000, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\IMM32.DLL"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00325  1036   NtQuerySystemInformation  (Basic, 44, ... {Unknown=0,MaximumIncrement=156250,PhysicalPageSize=0x1000,NumberOfPhysicalPages=0xff7c,LowestPhysicalPage=0x1,HighestPhysicalPage=0xffff,AllocationGranularity=0x10000,LowestUserAddress=0x10000,HighestUserAddress=0x7ffeffff,ActiveProcessors=1,NumberProcessors=1,}, 0x0, ) == 0x0
 00326  1036   NtAllocateVirtualMemory  (-1, 1228800, 0, 4096, 4096, 260, ... 1228800, 4096, ) == 0x0
 00327  1036   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\IMM32.DLL"}, 1236552, ... ) }, 1236552, ... ) == 0x0
 00328  1036   NtOpenKey  (0x80000000, {24, 0, 0x40, 0, 0,  (0x80000000, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ntdll.dll"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00329  1036   NtOpenKey  (0x80000000, {24, 0, 0x40, 0, 0,  (0x80000000, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kernel32.dll"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00330  1036   NtOpenKey  (0x80000000, {24, 0, 0x40, 0, 0,  (0x80000000, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SHLWAPI.dll"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00331  1036   NtOpenKey  (0x80000000, {24, 0, 0x40, 0, 0,  (0x80000000, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Normaliz.dll"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00332  1036   NtOpenKey  (0x80000000, {24, 0, 0x40, 0, 0,  (0x80000000, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\iertutil.dll"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00333  1036   NtOpenKey  (0x80000000, {24, 0, 0x40, 0, 0,  (0x80000000, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\WININET.dll"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00334  1036   NtOpenKey  (0x80000000, {24, 0, 0x40, 0, 0,  (0x80000000, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\WS2HELP.dll"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00335  1036   NtOpenKey  (0x80000000, {24, 0, 0x40, 0, 0,  (0x80000000, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\WS2_32.dll"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00336  1036   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\IMM32.DLL"}, 1239956, ... ) }, 1239956, ... ) == 0x0
 00337  1036   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\System\CurrentControlSet\Control\Error Message Instrument\"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00338  1036   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\GRE_Initialize"}, ... 32, ) }, ... 32, ) == 0x0
 00339  1036   NtQueryValueKey  (32,  (32, "DisableMetaFiles", Partial, 20, ... ) , Partial, 20, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00340  1036   NtClose  (32, ... ) == 0x0
 00341  1036   NtMapViewOfSection  (-2147482740, -1, (0x0), 0, 0, 0x0, 0, 2, 0, 2, ... (0x4e0000), 0x0, 1060864, ) == 0x0
 00342  1036   NtClose  (-2147482740, ... ) == 0x0
 00343  1036   NtCreateEvent  (0x1f0003, 0x0, 1, 0, ... 32, ) == 0x0
 00344  1036   NtOpenThreadTokenEx  (-2, 0x8, 1, 512, ... ) == STATUS_NO_TOKEN
 00345  1036   NtOpenProcessTokenEx  (-1, 0x8, 512, ... -2147482740, ) == 0x0
 00346  1036   NtQueryInformationToken  (-2147482740, Statistics, 0, ... ) == STATUS_BUFFER_TOO_SMALL
 00347  1036   NtQueryInformationToken  (-2147482740, Statistics, 56, ... {token info, class 10, size 56}, 56, ) == 0x0
 00348  1036   NtClose  (-2147482740, ... ) == 0x0
 00349  1036   NtAllocateVirtualMemory  (-1, 0, 0, 32, 4096, 4, ... 3407872, 4096, ) == 0x0
 00350  1036   NtFreeVirtualMemory  (-1, (0x340000), 4096, 32768, ... (0x340000), 4096, ) == 0x0
 00351  1036   NtDuplicateObject  (-1, 28, -1, 0x0, 0, 2, ... 40, ) == 0x0
 00352  1036   NtOpenKey  (0x20019, {24, 0, 0x240, 0, 0,  (0x20019, {24, 0, 0x240, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Compatibility32"}, ... -2147482740, ) }, ... -2147482740, ) == 0x0
 00353  1036   NtQueryValueKey  (-2147482740,  (-2147482740, "packed", Partial, 172, ... ) , Partial, 172, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00354  1036   NtClose  (-2147482740, ... ) == 0x0
 00355  1036   NtOpenKey  (0x20019, {24, 0, 0x240, 0, 0,  (0x20019, {24, 0, 0x240, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\IME Compatibility"}, ... -2147482740, ) }, ... -2147482740, ) == 0x0
 00356  1036   NtQueryValueKey  (-2147482740,  (-2147482740, "packed", Partial, 172, ... ) , Partial, 172, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00357  1036   NtClose  (-2147482740, ... ) == 0x0
 00358  1036   NtQueryDefaultLocale  (0, -139609780, ... ) == 0x0
 00359  1036   NtGdiQueryFontAssocInfo  (0, ... ) == 0x0
 00360  1036   NtUserCallNoParam  (24, ... ) == 0x0
 00361  1036   NtGdiCreateCompatibleDC  (0, ...
 00362  1036   NtAllocateVirtualMemory  (-1, 0, 0, 4096, 12288, 4, ... 3407872, 4096, ) == 0x0
 00361  1036   NtGdiCreateCompatibleDC  ... ) == 0xee0105b0
 00363  1036   NtGdiGetStockObject  (0, ... ) == 0x1900010
 00364  1036   NtGdiGetStockObject  (4, ... ) == 0x1900011
 00365  1036   NtGdiCreateBitmap  (8, 8, 1, 1, 2118200212, ... ) == 0x76050581
 00366  1036   NtGdiCreateSolidBrush  (0, 0, ...
 00367  1036   NtAllocateVirtualMemory  (-1, 0, 0, 4096, 12288, 4, ... 3473408, 4096, ) == 0x0
 00366  1036   NtGdiCreateSolidBrush  ... ) == 0xa51003d2
 00368  1036   NtGdiGetStockObject  (13, ... ) == 0x18a0021
 00369  1036   NtGdiCreateCompatibleDC  (0, ... ) == 0x5201039b
 00370  1036   NtGdiSelectBitmap  (1375798171, 1980040577, ... ) == 0x185000f
 00371  1036   NtUserGetThreadDesktop  (1036, 0, ... ) == 0x24
 00372  1036   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Windows"}, ... 44, ) }, ... 44, ) == 0x0
 00373  1036   NtQueryValueKey  (44,  (44, "AppInit_DLLs", Partial, 64, ... TitleIdx=0, Type=1, Data="\0\0"}, 14, ) , Partial, 64, ... TitleIdx=0, Type=1, Data= (44, "AppInit_DLLs", Partial, 64, ... TitleIdx=0, Type=1, Data="\0\0"}, 14, ) }, 14, ) == 0x0
 00374  1036   NtClose  (44, ... ) == 0x0
 00375  1036   NtUserFindExistingCursorIcon  (1241132, 1241148, 1241196, ... ) == 0x10011
 00376  1036   NtUserRegisterClassExWOW  (1241144, 1241212, 1241228, 1241244, 673, 128, 0, ... ) == 0x8173c017
 00377  1036   NtUserFindExistingCursorIcon  (1241132, 1241148, 1241196, ... ) == 0x10011
 00378  1036   NtUserRegisterClassExWOW  (1241144, 1241212, 1241228, 1241244, 674, 128, 0, ... ) == 0x8173c01c
 00379  1036   NtUserFindExistingCursorIcon  (1241132, 1241148, 1241196, ... ) == 0x10011
 00380  1036   NtUserRegisterClassExWOW  (1241144, 1241212, 1241228, 1241244, 675, 128, 0, ... ) == 0x8173c01e
 00381  1036   NtUserFindExistingCursorIcon  (1241132, 1241148, 1241196, ... ) == 0x10011
 00382  1036   NtUserRegisterClassExWOW  (1241144, 1241212, 1241228, 1241244, 676, 128, 0, ... ) == 0x81738002
 00383  1036   NtUserFindExistingCursorIcon  (1241132, 1241148, 1241196, ... ) == 0x10013
 00384  1036   NtUserRegisterClassExWOW  (1241144, 1241212, 1241228, 1241244, 677, 128, 0, ... ) == 0x8173c018
 00385  1036   NtUserFindExistingCursorIcon  (1241132, 1241148, 1241196, ... ) == 0x10011
 00386  1036   NtUserRegisterClassExWOW  (1241144, 1241212, 1241228, 1241244, 678, 128, 0, ... ) == 0x8173c01a
 00387  1036   NtUserFindExistingCursorIcon  (1241132, 1241148, 1241196, ... ) == 0x10011
 00388  1036   NtUserRegisterClassExWOW  (1241144, 1241212, 1241228, 1241244, 679, 128, 0, ... ) == 0x8173c01d
 00389  1036   NtUserFindExistingCursorIcon  (1241132, 1241148, 1241196, ... ) == 0x10011
 00390  1036   NtUserRegisterClassExWOW  (1241144, 1241212, 1241228, 1241244, 681, 128, 0, ... ) == 0x8173c026
 00391  1036   NtUserFindExistingCursorIcon  (1241132, 1241148, 1241196, ... ) == 0x10011
 00392  1036   NtUserRegisterClassExWOW  (1241144, 1241212, 1241228, 1241244, 680, 128, 0, ... ) == 0x8173c019
 00393  1036   NtUserRegisterClassExWOW  (1241096, 1241164, 1241180, 1241196, 0, 128, 0, ... ) == 0x8173c020
 00394  1036   NtUserRegisterClassExWOW  (1241352, 1241448, 1241432, 1241420, 0, 130, 0, ... ) == 0x8173c022
 00395  1036   NtUserRegisterClassExWOW  (1241096, 1241164, 1241180, 1241196, 0, 128, 0, ... ) == 0x8173c023
 00396  1036   NtUserRegisterClassExWOW  (1241352, 1241448, 1241432, 1241420, 0, 130, 0, ... ) == 0x8173c024
 00397  1036   NtUserRegisterClassExWOW  (1241096, 1241164, 1241180, 1241196, 0, 128, 0, ... ) == 0x8173c025
 00398  1036   NtCallbackReturn  (0, 0, 0, ...
 00399  1036   NtGdiInit  (... ) == 0x1
 00400  1036   NtGdiGetStockObject  (18, ... ) == 0x290001c
 00401  1036   NtGdiGetStockObject  (19, ... ) == 0x1b00019
 00402  1036   NtOpenKey  (0x2000000, {24, 16, 0x40, 0, 0,  (0x2000000, {24, 16, 0x40, 0, 0, "Software\Microsoft\Windows\CurrentVersion\Explorer\Performance"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00403  1036   NtOpenDirectoryObject  (0x2000f, {24, 0, 0x40, 0, 0,  (0x2000f, {24, 0, 0x40, 0, 0, "\BaseNamedObjects"}, ... 44, ) }, ... 44, ) == 0x0
 00404  1036   NtCreateSemaphore  (0x1f0003, {24, 44, 0x80, 1329368, 0,  (0x1f0003, {24, 44, 0x80, 1329368, 0, "shell.{A48F1A32-A340-11D1-BC6B-00A0C90312E1}"}, 0, 2147483647, ... 48, ) }, 0, 2147483647, ... 48, ) == STATUS_OBJECT_NAME_EXISTS
 00405  1036   NtQueryPerformanceCounter  (... {923632607, 10}, {3579545, 0}, ) == 0x0
 00406  1036   NtQueryPerformanceCounter  (... {923634109, 10}, {3579545, 0}, ) == 0x0
 00407  1036   NtAllocateVirtualMemory  (-1, 1331200, 0, 8192, 4096, 4, ... 1331200, 8192, ) == 0x0
 00408  1036   NtQuerySystemInformation  (Basic, 44, ... {Unknown=0,MaximumIncrement=156250,PhysicalPageSize=0x1000,NumberOfPhysicalPages=0xff7c,LowestPhysicalPage=0x1,HighestPhysicalPage=0xffff,AllocationGranularity=0x10000,LowestUserAddress=0x10000,HighestUserAddress=0x7ffeffff,ActiveProcessors=1,NumberProcessors=1,}, 0x0, ) == 0x0
 00409  1036   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ... 9371648, 1048576, ) == 0x0
 00410  1036   NtAllocateVirtualMemory  (-1, 9371648, 0, 4096, 4096, 4, ... 9371648, 4096, ) == 0x0
 00411  1036   NtAllocateVirtualMemory  (-1, 9375744, 0, 8192, 4096, 4, ... 9375744, 8192, ) == 0x0
 00412  1036   NtCreateEvent  (0x1f0003, 0x0, 0, 0, ... 52, ) == 0x0
 00413  1036   NtCreateFile  (0xc0100080, {24, 0, 0x40, 0, 1242800,  (0xc0100080, {24, 0, 0x40, 0, 1242800, "\??\WMIDataDevice"}, 0x0, 128, 0, 1, 64, 0, 0, ... 56, {status=0x0, info=0}, ) }, 0x0, 128, 0, 1, 64, 0, 0, ... 56, {status=0x0, info=0}, ) == 0x0
 00414  1036   NtCreateEvent  (0x1f0003, 0x0, 1, 0, ... 60, ) == 0x0
 00415  1036   NtDeviceIoControlFile  (56, 60, 0x0, 0x12f710, 0x22414c,  (56, 60, 0x0, 0x12f710, 0x22414c, "X\367\22\0\0\0\0\0\1\0\0\0\2\0\0\0\24\0\0\0\34\0\0\0P\0\0\0\0\0\0\0L\0\0\0\0\0\0\0\2\0\0\0U\4\376\14\272\223\15D\243\376U9s\320\267#\0\20\10\0\0\0\0\0\0\0\0\0U\4\376\14\272\223\15D\243\376U9s\320\267#\0\0\10\0\0\0\0\0\0\0\0\0\2\0\0\0", 104, 80, ... , 104, 80, ...
 00416  1036   NtOpenKey  (0x82000000, {24, 0, 0x240, 0, 0,  (0x82000000, {24, 0, 0x240, 0, 0, "\Registry\Machine\System\CurrentControlSet\Control\WMI\Security"}, ... -2147482740, ) }, ... -2147482740, ) == 0x0
 00417  1036   NtQueryValueKey  (-2147482740,  (-2147482740, "DF8480A1-7492-4F45-AB78-1084642581FB", Full, 130, ... ) , Full, 130, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00418  1036   NtQueryValueKey  (-2147482740,  (-2147482740, "00000000-0000-0000-0000-000000000000", Full, 130, ... ) , Full, 130, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00419  1036   NtClose  (-2147482740, ... ) == 0x0
 00420  1036   NtClose  (908, ... ) == 0x0
 00415  1036   NtDeviceIoControlFile  ... {status=0x0, info=80},  ... {status=0x0, info=80}, "\350\16\37\341\0\0\0\0U\4\376\14\272\223\15D\243\376U9s\320\267#e\0r\02\0-\0\0\0\0\0\0\0\0\0\2\0\0\0U\4\376\14\272\223\15D\243\376U9s\320\267#\0\20\10\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0", ) , ) == 0x0
 00421  1036   NtCreateFile  (0xc0100080, {24, 0, 0x40, 0, 1243016,  (0xc0100080, {24, 0, 0x40, 0, 1243016, "\??\WMIDataDevice"}, 0x0, 128, 0, 1, 64, 0, 0, ... 68, {status=0x0, info=0}, ) }, 0x0, 128, 0, 1, 64, 0, 0, ... 68, {status=0x0, info=0}, ) == 0x0
 00422  1036   NtCreateEvent  (0x1f0003, 0x0, 1, 0, ... 72, ) == 0x0
 00423  1036   NtDuplicateObject  (-1, -1, -1, 0x0, 0, 2, ... 76, ) == 0x0
 00424  1036   NtCreateEvent  (0x1f0003, 0x0, 1, 0, ... 80, ) == 0x0
 00425  1036   NtCreateEvent  (0x1f0003, 0x0, 1, 0, ... 84, ) == 0x0
 00426  1036   NtAllocateVirtualMemory  (-1, 9383936, 0, 8192, 4096, 4, ... 9383936, 8192, ) == 0x0
 00427  1036   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ... 10420224, 1048576, ) == 0x0
 00428  1036   NtAllocateVirtualMemory  (-1, 11460608, 0, 8192, 4096, 4, ... 11460608, 8192, ) == 0x0
 00429  1036   NtProtectVirtualMemory  (-1, (0xaee000), 4096, 260, ... (0xaee000), 4096, 4, ) == 0x0
 00430  1036   NtCreateThread  (0x1f03ff, 0x0, -1, 1242100, 1242044, 1, ... 88, {1248, 1756}, ) == 0x0
 00431  1036   NtQueryInformationThread  (88, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ffdd000,Pid=1248,Tid=1756,}, 0x0, ) == 0x0
 00432  1036   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 0, 0, 0, 9372024}  (24, {28, 56, new_msg, 0, 0, 0, 0, 9372024} "\0\0\0\0\1\0\1\0\0\0\0\0(\2\0\0X\0\0\0\340\4\0\0\334\6\0\0" ... {28, 56, reply, 0, 1248, 1036, 57968, 0} "\0\0\0\0\1\0\1\0\0\0\0\0(\2\0\0X\0\0\0\340\4\0\0\334\6\0\0" )  ... {28, 56, reply, 0, 1248, 1036, 57968, 0}  (24, {28, 56, new_msg, 0, 0, 0, 0, 9372024} "\0\0\0\0\1\0\1\0\0\0\0\0(\2\0\0X\0\0\0\340\4\0\0\334\6\0\0" ... {28, 56, reply, 0, 1248, 1036, 57968, 0} "\0\0\0\0\1\0\1\0\0\0\0\0(\2\0\0X\0\0\0\340\4\0\0\334\6\0\0" )  ) == 0x0
 00433  1036   NtResumeThread  (88, ... 1, ) == 0x0
 00434  1036   NtClose  (88, ... ) == 0x0
 00435  1756   NtCreateEvent  (0x100003, 0x0, 1, 0, ... 88, ) == 0x0
 00436  1756   NtWaitForSingleObject  (88, 0, 0x0, ...
 00437  1036   NtSetEvent  (72, ... 0x0, ) == 0x0
 00438  1036   NtSetEvent  (52, ... 0x0, ) == 0x0
 00439  1036   NtClose  (52, ... ) == 0x0
 00440  1036   NtCreateEvent  (0x1f0003, 0x0, 0, 0, ... 52, ) == 0x0
 00441  1036   NtAllocateVirtualMemory  (-1, 9392128, 0, 4096, 4096, 4, ... 9392128, 4096, ) == 0x0
 00442  1036   NtDeviceIoControlFile  (56, 60, 0x0, 0x12f710, 0x22414c,  (56, 60, 0x0, 0x12f710, 0x22414c, "X\367\22\0\0\0\0\0\2\0\0\0\2\0\0\0\24\0\0\0\34\0\0\0P\0\0\0\0\0\0\0L\0\0\0\0\0\0\0\2\0\0\0\254\253\177yX{\226G\271$\325\21x\245\234\344\0\20\10\0\0\0\0\0\0\0\0\0\254\253\177yX{\226G\271$\325\21x\245\234\344\0\0\10\0\0\0\0\0\0\0\0\0\2\0\0\0", 104, 80, ... , 104, 80, ...
 00443  1036   NtOpenKey  (0x82000000, {24, 0, 0x240, 0, 0,  (0x82000000, {24, 0, 0x240, 0, 0, "\Registry\Machine\System\CurrentControlSet\Control\WMI\Security"}, ... -2147482740, ) }, ... -2147482740, ) == 0x0
 00444  1036   NtQueryValueKey  (-2147482740,  (-2147482740, "DF8480A1-7492-4F45-AB78-1084642581FB", Full, 130, ... ) , Full, 130, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00445  1036   NtQueryValueKey  (-2147482740,  (-2147482740, "00000000-0000-0000-0000-000000000000", Full, 130, ... ) , Full, 130, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00446  1036   NtClose  (-2147482740, ... ) == 0x0
 00447  1036   NtClose  (908, ... ) == 0x0
 00442  1036   NtDeviceIoControlFile  ... {status=0x0, info=80},  ... {status=0x0, info=80}, "\250\33\257\341\0\0\0\0\254\253\177yX{\226G\271$\325\21x\245\234\344e\0r\0IoNm\0\0\0\0\0\0\0\0\2\0\0\0\254\253\177yX{\226G\271$\325\21x\245\234\344\0\20\10\0\\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0", ) , ) == 0x0
 00448  1036   NtSetEvent  (72, ... 0x0, ) == 0x0
 00449  1036   NtSetEvent  (52, ... 0x0, ) == 0x0
 00450  1036   NtClose  (52, ... ) == 0x0
 00451  1036   NtOpenThreadToken  (-2, 0x8, 0, ... ) == STATUS_NO_TOKEN
 00452  1036   NtOpenProcessToken  (-1, 0xa, ... 52, ) == 0x0
 00453  1036   NtDuplicateToken  (52, 0xc, {24, 0, 0x0, 0, 1243284, 0x0}, 0, 2, ... 96, ) == 0x0
 00454  1036   NtClose  (52, ... ) == 0x0
 00455  1036   NtAccessCheck  (1335152, 96, 0x1, 1243360, 1243412, 56, 1243392, ... (0x1), ) == 0x0
 00456  1036   NtClose  (96, ... ) == 0x0
 00457  1036   NtQueryDefaultUILanguage  (1242164, ...
 00458  1036   NtOpenThreadTokenEx  (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN
 00459  1036   NtOpenProcessTokenEx  (-1, 0x20008, 512, ... -2147482740, ) == 0x0
 00460  1036   NtQueryInformationToken  (-2147482740, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0
 00461  1036   NtClose  (-2147482740, ... ) == 0x0
 00462  1036   NtOpenKey  (0x2000000, {24, 0, 0x640, 0, 0,  (0x2000000, {24, 0, 0x640, 0, 0, "\REGISTRY\USER\S-1-5-21-1292428093-1383384898-725345543-1003"}, ... -2147482740, ) }, ... -2147482740, ) == 0x0
 00463  1036   NtOpenKey  (0x80000000, {24, -2147482740, 0x240, 0, 0,  (0x80000000, {24, -2147482740, 0x240, 0, 0, "Software\Policies\Microsoft\Control Panel\Desktop"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00464  1036   NtOpenKey  (0x80000000, {24, -2147482740, 0x640, 0, 0,  (0x80000000, {24, -2147482740, 0x640, 0, 0, "Control Panel\Desktop"}, ... -2147481328, ) }, ... -2147481328, ) == 0x0
 00465  1036   NtQueryValueKey  (-2147481328,  (-2147481328, "MultiUILanguageId", Partial, 256, ... ) , Partial, 256, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00466  1036   NtClose  (-2147481328, ... ) == 0x0
 00467  1036   NtClose  (-2147482740, ... ) == 0x0
 00457  1036   NtQueryDefaultUILanguage  ... ) == 0x0
 00468  1036   NtOpenFile  (0x1200a9, {24, 0, 0x40, 0, 0,  (0x1200a9, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\WININET.dll.123.Manifest"}, 1, 96, ... ) }, 1, 96, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00469  1036   NtQueryDefaultUILanguage  (2090319928, ...
 00470  1036   NtOpenThreadTokenEx  (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN
 00471  1036   NtOpenProcessTokenEx  (-1, 0x20008, 512, ... -2147482740, ) == 0x0
 00472  1036   NtQueryInformationToken  (-2147482740, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0
 00473  1036   NtClose  (-2147482740, ... ) == 0x0
 00474  1036   NtOpenKey  (0x2000000, {24, 0, 0x640, 0, 0,  (0x2000000, {24, 0, 0x640, 0, 0, "\REGISTRY\USER\S-1-5-21-1292428093-1383384898-725345543-1003"}, ... -2147482740, ) }, ... -2147482740, ) == 0x0
 00475  1036   NtOpenKey  (0x80000000, {24, -2147482740, 0x240, 0, 0,  (0x80000000, {24, -2147482740, 0x240, 0, 0, "Software\Policies\Microsoft\Control Panel\Desktop"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00476  1036   NtOpenKey  (0x80000000, {24, -2147482740, 0x640, 0, 0,  (0x80000000, {24, -2147482740, 0x640, 0, 0, "Control Panel\Desktop"}, ... -2147481328, ) }, ... -2147481328, ) == 0x0
 00477  1036   NtQueryValueKey  (-2147481328,  (-2147481328, "MultiUILanguageId", Partial, 256, ... ) , Partial, 256, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00478  1036   NtClose  (-2147481328, ... ) == 0x0
 00479  1036   NtClose  (-2147482740, ... ) == 0x0
 00469  1036   NtQueryDefaultUILanguage  ... ) == 0x0
 00480  1036   NtQueryInstallUILanguage  (2090319930, ... ) == 0x0
 00481  1036   NtQueryDefaultLocale  (1, 1240260, ... ) == 0x0
 00482  1036   NtOpenFile  (0x1200a9, {24, 0, 0x40, 0, 0,  (0x1200a9, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\WININET.dll.123.Config"}, 1, 96, ... ) }, 1, 96, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00483  1036   NtRequestWaitReplyPort  (24, {128, 156, new_msg, 0, 2088850039, 1241296, 1179817, 1241020}  (24, {128, 156, new_msg, 0, 2088850039, 1241296, 1179817, 1241020} "\210\6\31\1\33\0\1\0`\0\0\0\0\0\0\0\1\0\0\0\0\0\11\4\1\1\1\0>\0@\0\250\6\31\1\0\0\0\0\377\377\377\377\0\0\0\0PR\313B\0\0\0\0\370\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0(\0,\0\350\6\31\1\0\0\0\0\0\0\0\0\304\364\22\0\0\0\0\0" ... {128, 156, reply, 0, 1248, 1036, 57969, 0} "\300\270\26\0\33\0\1\0\0\0\0\0\0\0\0\0\1\0\0\0\0\0\11\4\1\1\1\0>\0@\0\250\6\31\1\0\0\0\0\377\377\377\377\0\0\0\0PR\313B\0\0\0\0\370\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0(\0,\0\350\6\31\1\0\0\0\0\0\0\0\0\304\364\22\0\0\0\0\0" )  ... {128, 156, reply, 0, 1248, 1036, 57969, 0}  (24, {128, 156, new_msg, 0, 2088850039, 1241296, 1179817, 1241020} "\210\6\31\1\33\0\1\0`\0\0\0\0\0\0\0\1\0\0\0\0\0\11\4\1\1\1\0>\0@\0\250\6\31\1\0\0\0\0\377\377\377\377\0\0\0\0PR\313B\0\0\0\0\370\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0(\0,\0\350\6\31\1\0\0\0\0\0\0\0\0\304\364\22\0\0\0\0\0" ... {128, 156, reply, 0, 1248, 1036, 57969, 0} "\300\270\26\0\33\0\1\0\0\0\0\0\0\0\0\0\1\0\0\0\0\0\11\4\1\1\1\0>\0@\0\250\6\31\1\0\0\0\0\377\377\377\377\0\0\0\0PR\313B\0\0\0\0\370\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0(\0,\0\350\6\31\1\0\0\0\0\0\0\0\0\304\364\22\0\0\0\0\0" )  ) == 0x0
 00484  1036   NtQueryDebugFilterState  (53, 2, ... ) == 0x0
 00485  1036   NtOpenKey  (0x8, {24, 0, 0x40, 0, 0,  (0x8, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows\CurrentVersion\SideBySide\AssemblyStorageRoots"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00486  1036   NtQueryDebugFilterState  (53, 2, ... ) == 0x0
 00487  1036   NtQueryDebugFilterState  (53, 2, ... ) == 0x0
 00488  1036   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\u:\work\packed.exe.Local\"}, 1239488, ... ) }, 1239488, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00489  1036   NtQueryDebugFilterState  (53, 2, ... ) == 0x0
 00490  1036   NtQueryDebugFilterState  (53, 2, ... ) == 0x0
 00491  1036   NtQueryDebugFilterState  (53, 2, ... ) == 0x0
 00492  1036   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.2982_x-ww_ac3f9c03"}, 1239552, ... ) }, 1239552, ... ) == 0x0
 00493  1036   NtOpenFile  (0x100020, {24, 0, 0x40, 0, 0,  (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.2982_x-ww_ac3f9c03"}, 3, 33, ... 96, {status=0x0, info=1}, ) }, 3, 33, ... 96, {status=0x0, info=1}, ) == 0x0
 00494  1036   NtQueryDebugFilterState  (53, 2, ... ) == 0x0
 00495  1036   NtOpenFile  (0x100020, {24, 0, 0x40, 0, 0,  (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.2982_x-ww_ac3f9c03\comctl32.dll"}, 5, 96, ... 52, {status=0x0, info=1}, ) }, 5, 96, ... 52, {status=0x0, info=1}, ) == 0x0
 00496  1036   NtCreateSection  (0xe, 0x0, 0x0, 16, 134217728, 52, ... 100, ) == 0x0
 00497  1036   NtClose  (52, ... ) == 0x0
 00498  1036   NtMapViewOfSection  (100, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 16, ... (0xaf0000), 0x0, 1056768, ) == 0x0
 00499  1036   NtClose  (100, ... ) == 0x0
 00500  1036   NtUnmapViewOfSection  (-1, 0xaf0000, ... ) == 0x0
 00501  1036   NtOpenFile  (0x100020, {24, 0, 0x40, 0, 0,  (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.2982_x-ww_ac3f9c03\comctl32.dll"}, 5, 96, ... 100, {status=0x0, info=1}, ) }, 5, 96, ... 100, {status=0x0, info=1}, ) == 0x0
 00502  1036   NtCreateSection  (0xf, 0x0, 0x0, 16, 16777216, 100, ... 52, ) == 0x0
 00503  1036   NtQuerySection  (52, Image, 48, ... {section info, class 1, size 48}, 0x0, ) == 0x0
 00504  1036   NtClose  (100, ... ) == 0x0
 00505  1036   NtMapViewOfSection  (52, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x773d0000), 0x0, 1060864, ) == 0x0
 00506  1036   NtClose  (52, ... ) == 0x0
 00507  1036   NtProtectVirtualMemory  (-1, (0x773d1000), 1924, 4, ... (0x773d1000), 4096, 32, ) == 0x0
 00508  1036   NtProtectVirtualMemory  (-1, (0x773d1000), 4096, 32, ... (0x773d1000), 4096, 4, ) == 0x0
 00509  1036   NtFlushInstructionCache  (-1, 2000490496, 1924, ... ) == 0x0
 00510  1036   NtProtectVirtualMemory  (-1, (0x773d1000), 1924, 4, ... (0x773d1000), 4096, 32, ) == 0x0
 00511  1036   NtProtectVirtualMemory  (-1, (0x773d1000), 4096, 32, ... (0x773d1000), 4096, 4, ) == 0x0
 00512  1036   NtFlushInstructionCache  (-1, 2000490496, 1924, ... ) == 0x0
 00513  1036   NtProtectVirtualMemory  (-1, (0x773d1000), 1924, 4, ... (0x773d1000), 4096, 32, ) == 0x0
 00514  1036   NtProtectVirtualMemory  (-1, (0x773d1000), 4096, 32, ... (0x773d1000), 4096, 4, ) == 0x0
 00515  1036   NtFlushInstructionCache  (-1, 2000490496, 1924, ... ) == 0x0
 00516  1036   NtProtectVirtualMemory  (-1, (0x773d1000), 1924, 4, ... (0x773d1000), 4096, 32, ) == 0x0
 00517  1036   NtProtectVirtualMemory  (-1, (0x773d1000), 4096, 32, ... (0x773d1000), 4096, 4, ) == 0x0
 00518  1036   NtFlushInstructionCache  (-1, 2000490496, 1924, ... ) == 0x0
 00519  1036   NtProtectVirtualMemory  (-1, (0x773d1000), 1924, 4, ... (0x773d1000), 4096, 32, ) == 0x0
 00520  1036   NtProtectVirtualMemory  (-1, (0x773d1000), 4096, 32, ... (0x773d1000), 4096, 4, ) == 0x0
 00521  1036   NtFlushInstructionCache  (-1, 2000490496, 1924, ... ) == 0x0
 00522  1036   NtProtectVirtualMemory  (-1, (0x773d1000), 1924, 4, ... (0x773d1000), 4096, 32, ) == 0x0
 00523  1036   NtProtectVirtualMemory  (-1, (0x773d1000), 4096, 32, ... (0x773d1000), 4096, 4, ) == 0x0
 00524  1036   NtFlushInstructionCache  (-1, 2000490496, 1924, ... ) == 0x0
 00525  1036   NtProtectVirtualMemory  (-1, (0x773d1000), 1924, 4, ... (0x773d1000), 4096, 32, ) == 0x0
 00526  1036   NtProtectVirtualMemory  (-1, (0x773d1000), 4096, 32, ... (0x773d1000), 4096, 4, ) == 0x0
 00527  1036   NtFlushInstructionCache  (-1, 2000490496, 1924, ... ) == 0x0
 00528  1036   NtOpenKey  (0x80000000, {24, 0, 0x40, 0, 0,  (0x80000000, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\comctl32.dll"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00529  1036   NtAddAtom  ( ("T\0h\0e\0m\0e\0P\0r\0o\0p\0S\0c\0r\0o\0l\0l\0B\0a\0r\0C\0t\0l\0", 42, 1241032, ... ) , 42, 1241032, ... ) == 0x0
 00530  1036   NtQueryDefaultUILanguage  (1239716, ...
 00531  1036   NtOpenThreadTokenEx  (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN
 00532  1036   NtOpenProcessTokenEx  (-1, 0x20008, 512, ... -2147482740, ) == 0x0
 00533  1036   NtQueryInformationToken  (-2147482740, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0
 00534  1036   NtClose  (-2147482740, ... ) == 0x0
 00535  1036   NtOpenKey  (0x2000000, {24, 0, 0x640, 0, 0,  (0x2000000, {24, 0, 0x640, 0, 0, "\REGISTRY\USER\S-1-5-21-1292428093-1383384898-725345543-1003"}, ... -2147482740, ) }, ... -2147482740, ) == 0x0
 00536  1036   NtOpenKey  (0x80000000, {24, -2147482740, 0x240, 0, 0,  (0x80000000, {24, -2147482740, 0x240, 0, 0, "Software\Policies\Microsoft\Control Panel\Desktop"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00537  1036   NtOpenKey  (0x80000000, {24, -2147482740, 0x640, 0, 0,  (0x80000000, {24, -2147482740, 0x640, 0, 0, "Control Panel\Desktop"}, ... -2147481328, ) }, ... -2147481328, ) == 0x0
 00538  1036   NtQueryValueKey  (-2147481328,  (-2147481328, "MultiUILanguageId", Partial, 256, ... ) , Partial, 256, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00539  1036   NtClose  (-2147481328, ... ) == 0x0
 00540  1036   NtClose  (-2147482740, ... ) == 0x0
 00530  1036   NtQueryDefaultUILanguage  ... ) == 0x0
 00541  1036   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\WindowsShell.Manifest"}, 1238556, ... ) }, 1238556, ... ) == 0x0
 00542  1036   NtOpenFile  (0x100020, {24, 0, 0x40, 0, 0,  (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\WindowsShell.Manifest"}, 5, 96, ... 52, {status=0x0, info=1}, ) }, 5, 96, ... 52, {status=0x0, info=1}, ) == 0x0
 00543  1036   NtCreateSection  (0xe, 0x0, 0x0, 16, 134217728, 52, ... 100, ) == 0x0
 00544  1036   NtClose  (52, ... ) == 0x0
 00545  1036   NtMapViewOfSection  (100, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 16, ... (0x370000), 0x0, 4096, ) == 0x0
 00546  1036   NtClose  (100, ... ) == 0x0
 00547  1036   NtUnmapViewOfSection  (-1, 0x370000, ... ) == 0x0
 00548  1036   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\WindowsShell.Manifest"}, 1238152, ... ) }, 1238152, ... ) == 0x0
 00549  1036   NtCreateFile  (0x80100080, {24, 0, 0x40, 0, 1238896,  (0x80100080, {24, 0, 0x40, 0, 1238896, "\??\C:\WINDOWS\WindowsShell.Manifest"}, 0x0, 0, 5, 1, 96, 0, 0, ... 100, {status=0x0, info=1}, ) }, 0x0, 0, 5, 1, 96, 0, 0, ... 100, {status=0x0, info=1}, ) == 0x0
 00550  1036   NtCreateSection  (0xf0005, 0x0, 0x0, 2, 134217728, 100, ... 52, ) == 0x0
 00551  1036   NtClose  (100, ... ) == 0x0
 00552  1036   NtMapViewOfSection  (52, -1, (0x0), 0, 0, {0, 0}, 0, 1, 0, 2, ... (0x370000), {0, 0}, 4096, ) == 0x0
 00553  1036   NtClose  (52, ... ) == 0x0
 00554  1036   NtUnmapViewOfSection  (-1, 0x370000, ... ) == 0x0
 00555  1036   NtOpenFile  (0x1200a9, {24, 0, 0x40, 0, 0,  (0x1200a9, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\WindowsShell.Manifest"}, 1, 96, ... 52, {status=0x0, info=1}, ) }, 1, 96, ... 52, {status=0x0, info=1}, ) == 0x0
 00556  1036   NtCreateSection  (0x4, 0x0, 0x0, 2, 134217728, 52, ... 100, ) == 0x0
 00557  1036   NtMapViewOfSection  (100, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 2, ... (0x370000), 0x0, 4096, ) == 0x0
 00558  1036   NtQueryInformationFile  (52, 1238548, 24, Standard, ... {status=0x0, info=24}, ) == 0x0
 00559  1036   NtOpenFile  (0x1200a9, {24, 0, 0x40, 0, 0,  (0x1200a9, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\WindowsShell.Config"}, 1, 96, ... ) }, 1, 96, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00560  1036   NtRequestWaitReplyPort  (24, {128, 156, new_msg, 0, 2088850039, 1238848, 1179817, 1238572}  (24, {128, 156, new_msg, 0, 2088850039, 1238848, 1179817, 1238572} "\210\6\31\1\33\0\1\0`\0\0\0\0\0\0\0\1\0\0\0\0\0\11\4\1\1\3\0@\0D\0\250\6\31\14\0\0\0d\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\355\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\26\0\30\0\354\6\31\1\0\0\0\0\0\0\0\04\353\22\0\0\0\0\0" ... {128, 156, reply, 0, 1248, 1036, 57972, 0} "\260d\27\0\33\0\1\0\0\0\0\0\0\0\0\0\1\0\0\0\0\0\11\4\1\1\3\0@\0D\0\250\6\31\14\0\0\0d\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\355\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\26\0\30\0\354\6\31\1\0\0\0\0\0\0\0\04\353\22\0\0\0\0\0" )  ... {128, 156, reply, 0, 1248, 1036, 57972, 0}  (24, {128, 156, new_msg, 0, 2088850039, 1238848, 1179817, 1238572} "\210\6\31\1\33\0\1\0`\0\0\0\0\0\0\0\1\0\0\0\0\0\11\4\1\1\3\0@\0D\0\250\6\31\14\0\0\0d\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\355\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\26\0\30\0\354\6\31\1\0\0\0\0\0\0\0\04\353\22\0\0\0\0\0" ... {128, 156, reply, 0, 1248, 1036, 57972, 0} "\260d\27\0\33\0\1\0\0\0\0\0\0\0\0\0\1\0\0\0\0\0\11\4\1\1\3\0@\0D\0\250\6\31\14\0\0\0d\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\355\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\26\0\30\0\354\6\31\1\0\0\0\0\0\0\0\04\353\22\0\0\0\0\0" )  ) == 0x0
 00561  1036   NtClose  (52, ... ) == 0x0
 00562  1036   NtClose  (100, ... ) == 0x0
 00563  1036   NtUnmapViewOfSection  (-1, 0x370000, ... ) == 0x0
 00564  1036   NtQueryDebugFilterState  (53, 2, ... ) == 0x0
 00565  1036   NtUserRegisterWindowMessage  ( ("ShellGetDragImage", ... ) , ... ) == 0xc03a
 00566  1036   NtUserSystemParametersInfo  (104, 0, 2001084812, 0, ... ) == 0x1
 00567  1036   NtUserGetDC  (0, ... ) == 0x1010051
 00568  1036   NtUserCallOneParam  (16842833, 57, ... ) == 0x1
 00569  1036   NtUserSystemParametersInfo  (38, 4, 2001086940, 0, ... ) == 0x1
 00570  1036   NtUserSystemParametersInfo  (66, 12, 1240548, 0, ... ) == 0x1
 00571  1036   NtOpenThreadTokenEx  (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN
 00572  1036   NtOpenProcessTokenEx  (-1, 0x20008, 512, ... 100, ) == 0x0
 00573  1036   NtQueryInformationToken  (100, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0
 00574  1036   NtClose  (100, ... ) == 0x0
 00575  1036   NtOpenKey  (0x20019, {24, 0, 0x640, 0, 0,  (0x20019, {24, 0, 0x640, 0, 0, "\REGISTRY\USER\S-1-5-21-1292428093-1383384898-725345543-1003"}, ... 100, ) }, ... 100, ) == 0x0
 00576  1036   NtOpenProcessToken  (-1, 0x8, ... 52, ) == 0x0
 00577  1036   NtAccessCheck  (1335152, 52, 0x1, 1240380, 1240432, 56, 1240412, ... ) == STATUS_NO_IMPERSONATION_TOKEN
 00578  1036   NtClose  (52, ... ) == 0x0
 00579  1036   NtOpenKey  (0x20019, {24, 100, 0x40, 0, 0,  (0x20019, {24, 100, 0x40, 0, 0, "Control Panel\Desktop"}, ... 52, ) }, ... 52, ) == 0x0
 00580  1036   NtQueryValueKey  (52,  (52, "SmoothScroll", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00581  1036   NtClose  (52, ... ) == 0x0
 00582  1036   NtUserSystemParametersInfo  (41, 500, 1240576, 0, ... ) == 0x1
 00583  1036   NtOpenProcessToken  (-1, 0x8, ... 52, ) == 0x0
 00584  1036   NtAccessCheck  (1335152, 52, 0x1, 1240380, 1240432, 56, 1240412, ... ) == STATUS_NO_IMPERSONATION_TOKEN
 00585  1036   NtClose  (52, ... ) == 0x0
 00586  1036   NtOpenKey  (0x20019, {24, 100, 0x40, 0, 0,  (0x20019, {24, 100, 0x40, 0, 0, "software\Microsoft\Windows\CurrentVersion\Explorer\Advanced"}, ... 52, ) }, ... 52, ) == 0x0
 00587  1036   NtQueryValueKey  (52,  (52, "EnableBalloonTips", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00588  1036   NtClose  (52, ... ) == 0x0
 00589  1036   NtUserSystemParametersInfo  (27, 0, 2001085788, 0, ... ) == 0x1
 00590  1036   NtUserSystemParametersInfo  (102, 0, 2001086828, 0, ... ) == 0x1
 00591  1036   NtClose  (100, ... ) == 0x0
 00592  1036   NtUserSystemParametersInfo  (4130, 0, 1241080, 0, ... ) == 0x1
 00593  1036   NtOpenKey  (0x1, {24, 16, 0x40, 0, 0,  (0x1, {24, 16, 0x40, 0, 0, "Software\Microsoft\Windows NT\CurrentVersion\LanguagePack"}, ... 100, ) }, ... 100, ) == 0x0
 00594  1036   NtEnumerateValueKey  (100, 0, Full, 220, ... ) == STATUS_NO_MORE_ENTRIES
 00595  1036   NtClose  (100, ... ) == 0x0
 00596  1036   NtUserFindExistingCursorIcon  (1240328, 1240344, 1240392, ... ) == 0x10011
 00597  1036   NtUserRegisterClassExWOW  (1240272, 1240340, 1240356, 1240372, 0, 384, 0, ... ) == 0x8173c03b
 00598  1036   NtUserRegisterClassExWOW  (1240272, 1240340, 1240356, 1240372, 0, 384, 0, ... ) == 0x8173c03d
 00599  1036   NtUserFindExistingCursorIcon  (1240328, 1240344, 1240392, ... ) == 0x10011
 00600  1036   NtUserRegisterClassExWOW  (1240272, 1240340, 1240356, 1240372, 0, 384, 0, ... ) == 0x8173c03f
 00601  1036   NtUserFindExistingCursorIcon  (1240328, 1240344, 1240392, ... ) == 0x10011
 00602  1036   NtUserRegisterClassExWOW  (1240272, 1240340, 1240356, 1240372, 0, 384, 0, ... ) == 0x8173c041
 00603  1036   NtUserFindExistingCursorIcon  (1240328, 1240344, 1240392, ... ) == 0x10011
 00604  1036   NtUserRegisterClassExWOW  (1240272, 1240340, 1240356, 1240372, 0, 384, 0, ... ) == 0x8173c043
 00605  1036   NtUserRegisterClassExWOW  (1240272, 1240340, 1240356, 1240372, 0, 384, 0, ... ) == 0x8173c045
 00606  1036   NtUserFindExistingCursorIcon  (1240328, 1240344, 1240392, ... ) == 0x10011
 00607  1036   NtUserRegisterClassExWOW  (1240272, 1240340, 1240356, 1240372, 0, 384, 0, ... ) == 0x8173c047
 00608  1036   NtUserFindExistingCursorIcon  (1240328, 1240344, 1240392, ... ) == 0x10011
 00609  1036   NtUserRegisterClassExWOW  (1240272, 1240340, 1240356, 1240372, 0, 384, 0, ... ) == 0x8173c049
 00610  1036   NtUserFindExistingCursorIcon  (1240328, 1240344, 1240392, ... ) == 0x10011
 00611  1036   NtUserRegisterClassExWOW  (1240272, 1240340, 1240356, 1240372, 0, 384, 0, ... ) == 0x8173c04b
 00612  1036   NtUserFindExistingCursorIcon  (1240328, 1240344, 1240392, ... ) == 0x10011
 00613  1036   NtUserRegisterClassExWOW  (1240272, 1240340, 1240356, 1240372, 0, 384, 0, ... ) == 0x8173c04d
 00614  1036   NtUserFindExistingCursorIcon  (1240328, 1240344, 1240392, ... ) == 0x10011
 00615  1036   NtUserRegisterClassExWOW  (1240272, 1240340, 1240356, 1240372, 0, 384, 0, ... ) == 0x8173c04f
 00616  1036   NtUserRegisterClassExWOW  (1240272, 1240340, 1240356, 1240372, 0, 384, 0, ... ) == 0x8173c051
 00617  1036   NtUserFindExistingCursorIcon  (1240328, 1240344, 1240392, ... ) == 0x10011
 00618  1036   NtUserRegisterClassExWOW  (1240272, 1240340, 1240356, 1240372, 0, 384, 0, ... ) == 0x8173c053
 00619  1036   NtUserFindExistingCursorIcon  (1240324, 1240340, 1240388, ... ) == 0x10011
 00620  1036   NtUserRegisterClassExWOW  (1240268, 1240336, 1240352, 1240368, 0, 384, 0, ... ) == 0x8173c055
 00621  1036   NtUserFindExistingCursorIcon  (1240324, 1240340, 1240388, ... ) == 0x10011
 00622  1036   NtUserRegisterClassExWOW  (1240268, 1240336, 1240352, 1240368, 0, 384, 0, ... ) == 0x8173c057
 00623  1036   NtUserFindExistingCursorIcon  (1240328, 1240344, 1240392, ... ) == 0x10011
 00624  1036   NtUserRegisterClassExWOW  (1240272, 1240340, 1240356, 1240372, 0, 384, 0, ... ) == 0x8173c059
 00625  1036   NtUserFindExistingCursorIcon  (1240328, 1240344, 1240392, ... ) == 0x10013
 00626  1036   NtUserRegisterClassExWOW  (1240272, 1240340, 1240356, 1240372, 0, 384, 0, ... ) == 0x8173c05b
 00627  1036   NtUserFindExistingCursorIcon  (1240328, 1240344, 1240392, ... ) == 0x10011
 00628  1036   NtUserRegisterClassExWOW  (1240272, 1240340, 1240356, 1240372, 0, 384, 0, ... ) == 0x8173c05d
 00629  1036   NtUserFindExistingCursorIcon  (1240328, 1240344, 1240392, ... ) == 0x10011
 00630  1036   NtUserRegisterClassExWOW  (1240272, 1240340, 1240356, 1240372, 0, 384, 0, ... ) == 0x8173c05f
 00631  1036   NtUserFindExistingCursorIcon  (1240328, 1240344, 1240392, ... ) == 0x10011
 00632  1036   NtUserRegisterClassExWOW  (1240272, 1240340, 1240356, 1240372, 0, 384, 0, ... ) == 0x8173c017
 00633  1036   NtUserFindExistingCursorIcon  (1240328, 1240344, 1240392, ... ) == 0x10011
 00634  1036   NtUserRegisterClassExWOW  (1240272, 1240340, 1240356, 1240372, 0, 384, 0, ... ) == 0x8173c019
 00635  1036   NtUserFindExistingCursorIcon  (1240328, 1240344, 1240392, ... ) == 0x10013
 00636  1036   NtUserRegisterClassExWOW  (1240272, 1240340, 1240356, 1240372, 0, 384, 0, ... ) == 0x8173c018
 00637  1036   NtUserFindExistingCursorIcon  (1240328, 1240344, 1240392, ... ) == 0x10011
 00638  1036   NtUserRegisterClassExWOW  (1240272, 1240340, 1240356, 1240372, 0, 384, 0, ... ) == 0x8173c01a
 00639  1036   NtUserFindExistingCursorIcon  (1240328, 1240344, 1240392, ... ) == 0x10011
 00640  1036   NtUserRegisterClassExWOW  (1240272, 1240340, 1240356, 1240372, 0, 384, 0, ... ) == 0x8173c01c
 00641  1036   NtUserFindExistingCursorIcon  (1240328, 1240344, 1240392, ... ) == 0x10011
 00642  1036   NtUserRegisterClassExWOW  (1240272, 1240340, 1240356, 1240372, 0, 384, 0, ... ) == 0x8173c01e
 00643  1036   NtUserFindExistingCursorIcon  (1240320, 1240336, 1240384, ... ) == 0x10011
 00644  1036   NtUserRegisterClassExWOW  (1240320, 1240388, 1240404, 1240420, 0, 384, 0, ... ) == 0x8173c01b
 00645  1036   NtUserFindExistingCursorIcon  (1240328, 1240344, 1240392, ... ) == 0x10011
 00646  1036   NtUserRegisterClassExWOW  (1240272, 1240340, 1240356, 1240372, 0, 384, 0, ... ) == 0x8173c068
 00647  1036   NtUserFindExistingCursorIcon  (1240328, 1240344, 1240392, ... ) == 0x10011
 00648  1036   NtUserRegisterClassExWOW  (1240272, 1240340, 1240356, 1240372, 0, 384, 0, ... ) == 0x8173c06a
 00649  1036   NtOpenThreadTokenEx  (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN
 00650  1036   NtOpenProcessTokenEx  (-1, 0x20008, 512, ... 100, ) == 0x0
 00651  1036   NtQueryInformationToken  (100, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0
 00652  1036   NtClose  (100, ... ) == 0x0
 00653  1036   NtOpenKey  (0x2000000, {24, 0, 0x640, 0, 0,  (0x2000000, {24, 0, 0x640, 0, 0, "\REGISTRY\USER\S-1-5-21-1292428093-1383384898-725345543-1003"}, ... 100, ) }, ... 100, ) == 0x0
 00654  1036   NtSetInformationObject  (100, Handle, {Inherit=0,ProtectFromClose=1,}, 1179904, ... ) == 0x0
 00655  1036   NtCreateKey  (0x2001f, {24, 100, 0x40, 0, 0,  (0x2001f, {24, 100, 0x40, 0, 0, "SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings"}, 0, 0x0, 0, ... 52, 2, ) }, 0, 0x0, 0, ... 52, 2, ) == 0x0
 00656  1036   NtQuerySystemInformation  (Basic, 44, ... {Unknown=0,MaximumIncrement=156250,PhysicalPageSize=0x1000,NumberOfPhysicalPages=0xff7c,LowestPhysicalPage=0x1,HighestPhysicalPage=0xffff,AllocationGranularity=0x10000,LowestUserAddress=0x10000,HighestUserAddress=0x7ffeffff,ActiveProcessors=1,NumberProcessors=1,}, 0x0, ) == 0x0
 00657  1036   NtQuerySystemInformation  (Processor, 12, ... {system info, class 1, size 12}, 0x0, ) == 0x0
 00658  1036   NtSetEventBoostPriority  (88, ...
 00436  1756   NtWaitForSingleObject  ... ) == 0x0
 00659  1756   NtTestAlert  (... ) == 0x0
 00660  1756   NtContinue  (11468080, 1, ...
 00661  1756   NtRegisterThreadTerminatePort  (24, ... ) == 0x0
 00662  1756   NtDeviceIoControlFile  (68, 80, 0x0, 0x77e466a0, 0x228144,  (68, 80, 0x0, 0x77e466a0, 0x228144, "\2\0\0\0\1\0\0\0\\370\342w\0\0\0\0L\0\0\0\0\0\0\0\\0\0\0\0\0\0\0@\0\0\0\0\0\0\0", 40, 4096, ... {status=0x103, info=0}, "", ) , 40, 4096, ... {status=0x103, info=0}, "", ) == 0x103
 00658  1036   NtSetEventBoostPriority  ... ) == 0x0
 00663  1036   NtTestAlert  (... ) == 0x0
 00664  1036   NtContinue  (1244464, 1, ...
 00665  1036   NtSetInformationThread  (-2, Win32StartAddress(LpcReceivedMessageId), {StartAddress(LpcReceivedMsgId)=0x3142a000,}, 4, ... ) == 0x0
 00666  1036   NtOpenKey  (0x20019, {24, 100, 0x40, 0, 0,  (0x20019, {24, 100, 0x40, 0, 0, "Software\Microsoft\Windows\CurrentVersion\Explorer"}, ... 104, ) }, ... 104, ) == 0x0
 00667  1036   NtQueryValueKey  (104,  (104, "PINF", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00668  1036   NtClose  (104, ... ) == 0x0
 00669  1756   NtWaitForMultipleObjects  (2, (72, 80, ), 1, 1, {1294967296, -1}, ... ) == 0x0
 00670  1756   NtDeviceIoControlFile  (68, 84, 0x0, 0x77e46680, 0x228144,  (68, 84, 0x0, 0x77e46680, 0x228144, "\2\0\0\0\1\0\0\0\\370\342w\0\0\0\0L\0\0\0\0\0\0\0\\0\0\0\0\0\0\0@\0\0\0\0\0\0\0", 40, 4096, ... {status=0x103, info=0}, "", ) , 40, 4096, ... {status=0x103, info=0}, "", ) == 0x103
 00671  1756   NtWaitForMultipleObjects  (2, (72, 84, ), 1, 1, {1294967296, -1}, ...
 00672  1036   NtAllocateVirtualMemory  (-1, 1224704, 0, 4096, 4096, 260, ... 1224704, 4096, ) == 0x0
 00673  1036   NtCreateFile  (0x80100080, {24, 0, 0x40, 0, 1234112,  (0x80100080, {24, 0, 0x40, 0, 1234112, "\??\u:\work\packed.exe"}, 0x0, 1, 1, 1, 96, 0, 0, ... 104, {status=0x0, info=1}, ) }, 0x0, 1, 1, 1, 96, 0, 0, ... 104, {status=0x0, info=1}, ) == 0x0
 00674  1036   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\DOCUME~1\MARTIM~1\LOCALS~1\Temp"}, 1233816, ... ) }, 1233816, ... ) == 0x0
 00675  1036   NtRequestWaitReplyPort  (24, {20, 48, new_msg, 0, 1234168, 2089878865, 1315608, 2089878893}  (24, {20, 48, new_msg, 0, 1234168, 2089878865, 1315608, 2089878893} "\0\0\0\0\2\0\1\0\0\0\0\0\10\221\0\0\2\0\0\0" ... {20, 48, reply, 0, 1248, 1036, 57973, 0} "\0\0\0\0\2\0\1\0\2\0\0\0\10\221\0\0\2\0\0\0" )  ... {20, 48, reply, 0, 1248, 1036, 57973, 0}  (24, {20, 48, new_msg, 0, 1234168, 2089878865, 1315608, 2089878893} "\0\0\0\0\2\0\1\0\0\0\0\0\10\221\0\0\2\0\0\0" ... {20, 48, reply, 0, 1248, 1036, 57973, 0} "\0\0\0\0\2\0\1\0\2\0\0\0\10\221\0\0\2\0\0\0" )  ) == 0x0
 00676  1036   NtCreateFile  (0x80100080, {24, 0, 0x40, 0, 1233824,  (0x80100080, {24, 0, 0x40, 0, 1233824, "\??\C:\DOCUME~1\MARTIM~1\LOCALS~1\Temp\bas2.tmp"}, 0x0, 128, 0, 2, 96, 0, 0, ... }, 0x0, 128, 0, 2, 96, 0, 0, ...
 00677  1036   NtQueryDirectoryFile  (-2147482740, 0, 0, 0, -519819264, 4096, Names, 1,  (-2147482740, 0, 0, 0, -519819264, 4096, Names, 1, "DOCUME~1", 1, ... {status=0x0, info=56}, ) , 1, ... {status=0x0, info=56}, ) == 0x0
 00678  1036   NtClose  (-2147482740, ... ) == 0x0
 00679  1036   NtQueryDirectoryFile  (-2147482740, 0, 0, 0, -519819264, 4096, Names, 1,  (-2147482740, 0, 0, 0, -519819264, 4096, Names, 1, "MARTIM~1", 1, ... {status=0x0, info=40}, ) , 1, ... {status=0x0, info=40}, ) == 0x0
 00680  1036   NtClose  (-2147482740, ... ) == 0x0
 00681  1036   NtQueryDirectoryFile  (-2147482740, 0, 0, 0, -519819264, 4096, Names, 1,  (-2147482740, 0, 0, 0, -519819264, 4096, Names, 1, "LOCALS~1", 1, ... {status=0x0, info=40}, ) , 1, ... {status=0x0, info=40}, ) == 0x0
 00682  1036   NtClose  (-2147482740, ... ) == 0x0
 00676  1036   NtCreateFile  ... 108, {status=0x0, info=2}, ) == 0x0
 00683  1036   NtClose  (108, ... ) == 0x0
 00684  1036   NtCreateFile  (0xc0100080, {24, 0, 0x40, 0, 1234112,  (0xc0100080, {24, 0, 0x40, 0, 1234112, "\??\C:\DOCUME~1\MARTIM~1\LOCALS~1\Temp\bas2.tmp"}, 0x0, 128, 1, 5, 96, 0, 0, ... }, 0x0, 128, 1, 5, 96, 0, 0, ...
 00685  1036   NtClose  (-2147482740, ... ) == 0x0
 00686  1036   NtQueryDirectoryFile  (-2147482740, 0, 0, 0, -519819264, 4096, Names, 1,  (-2147482740, 0, 0, 0, -519819264, 4096, Names, 1, "DOCUME~1", 1, ... {status=0x0, info=56}, ) , 1, ... {status=0x0, info=56}, ) == 0x0
 00687  1036   NtClose  (-2147482740, ... ) == 0x0
 00688  1036   NtQueryDirectoryFile  (-2147482740, 0, 0, 0, -519819264, 4096, Names, 1,  (-2147482740, 0, 0, 0, -519819264, 4096, Names, 1, "MARTIM~1", 1, ... {status=0x0, info=40}, ) , 1, ... {status=0x0, info=40}, ) == 0x0
 00689  1036   NtClose  (-2147482740, ... ) == 0x0
 00690  1036   NtQueryDirectoryFile  (-2147482740, 0, 0, 0, -519819264, 4096, Names, 1,  (-2147482740, 0, 0, 0, -519819264, 4096, Names, 1, "LOCALS~1", 1, ... {status=0x0, info=40}, ) , 1, ... {status=0x0, info=40}, ) == 0x0
 00691  1036   NtClose  (-2147482740, ... ) == 0x0
 00684  1036   NtCreateFile  ... 108, {status=0x0, info=3}, ) == 0x0
 00692  1036   NtSetInformationFile  (104, 1234204, 8, Position, ... {status=0x0, info=0}, ) == 0x0
 00693  1036   NtReadFile  (104, 0, 0, 0, 10240, 0x0, 0, ... {status=0x0, info=10240},  (104, 0, 0, 0, 10240, 0x0, 0, ... {status=0x0, info=10240}, "\222:n\0\335`>\0\333`1\0 \237>\0g`>\0\337`>\0\237`$\0\337`>\0\337`>\0\337`>\0\337`>\0\337`>\0\337`>\0\337`>\0\337`>\0\337b>\0ep>\16\300\3247\315\376\330?L\22A\256\220\213\10Ws\377\20Lo\270\22_m\377\15Ks\253@\e\377\22Kn\377\25Pd\272\22\36W\266\16\152\322j\327\337`>\0\337`>\0\337`>\0\337`>\0\337`>\0\337`>\0\337`>\0\337`>\0\337`>\0\337`>\0\337`>\0\337`>\0\337`>\0\337`>\0\337`>\0\337`>\0\337`>\0\337`>\0\337`>\0\337`>\0\337`>\0\337`>\0\337`>\0\337`>\0\337`>\0\337`>\0\337`>\0\337`>\0\337`>\0\337`>\0\337`>\0\337`>\0\337`>\0\337`>\0\337`>\0\337`>\0\337`>\0\337`>\0\337`>\0\337`>\0\337`>\0\337`>\0\337`>\0\337`>\0\337`>\0\337`>\0\337`>\0\337`>\0\337`>\0\337`>\0\337`>\0\337`>\0\337`>\0\337`>\0\337`>\0\337`>\0\337`>\0\337`>\0\337`>\0\337`>\0\337`>\0\337`>\0\337`>\0\337`>\0\337`>\0\337`>\0\337`>\0\337`>\0\337`>\0\337`>\0\337`>\0\337`>\0\337`>\0\337`>\0\337`>\0\337`>\0\337`>\0\337`>\0\337`>\0\337`>\0\337`>\0\337`>\0\337`>\0\337`>\0\337`>\0\337`>\0\337`>\0\337`>\0\337`>\0\337`>\0\337`>\0\337`>\0\337`>\0\337`>\0\337`>\0", ) , ) == 0x0
 00694  1036   NtWriteFile  (108, 0, 0, 0,  (108, 0, 0, 0, "MZP\0\2\0\0\0\4\0\17\0\377\377\0\0\270\0\0\0\0\0\0\0@\0\32\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\272\20\0\16\37\264\11\315!\270\1L\315!\220\220This program must be run under Win32\15\12$7\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0", 10240, 0x0, 0, ... , 10240, 0x0, 0, ...
 00695  1036   NtContinue  (-139612716, 0, ...
 00694  1036   NtWriteFile  ... {status=0x0, info=10240}, ) == 0x0
 00696  1036   NtReadFile  (104, 0, 0, 0, 10240, 0x0, 0, ... {status=0x0, info=10240},  (104, 0, 0, 0, 10240, 0x0, 0, ... {status=0x0, info=10240}, "\212h\10\34\260\sE\260\22G,\177\15_\10\357c\277\7\27\250X\331\275\240\177\304\27#\366<\335,L\3347\221TD\265\0o\271\333{B\377\371\242f}Z\3170D\204\310\366\270W1A\300\271\353n\1\217\366Ug\276b~\315\243_?\2a$\23\32\\242;R*Uo\21U\271\15e\377\320\224K\241\10},7\302\354\305\334Y\326\353\2017\342\200\330\347\276\302\10kIC\363q\34\301\316`4^\202\3408\222\361\3471\202{(\31O\360\346\225d\322n\12sw\265Q\220hZ\203Od6#\23\262\22\210\357\246E\22\236n\337\311'&\26I;V%\37\333\257\316f\17\234\2123\331\243\337\15\356\342\3064\1\14|\266\217\4\316X\341V\354 \33RyW\27\344\366\257\223NOP6$>(\336\274\276\24\Z\24\12\257e;\34\264\313\350\1270\354<\371\20\220\10\211\24K\310\232\346+\212\2\255\322\10\31`Y)\Y\306\251$D\364\232\235#\7R\305 i\344OV\17\15T!\12\324v\311\363\\226u;-\23D\246\365\237ml\314\217\363\276\221r\362\320\334F\261\32\370z\35ku\37\353c\304\249\250\357S\243\226\306s\320\212F\217n\337\224\347\250m\1A\310\11\225\371\264\26\217l\323\373\223)Z\31\250~`\200m\260X\275x\207\15\16\213k\353tX\362D9\220\240\250\36^\306\203\25\227\313\237\301\12\363\30\2\231\376xZ\360\13\361F]\342N\235\261\13\5\331\354\336\2732p\325\276\315P\270\3\366\266\301"\35\350\246\21055\266\326\332&;81\11\2\275\16\2\335\0~\3M(\226\211\2358\52\373;\331\324\133\235\17[q\214\13\177\217\22\273(\366\324\330\244d\274\272\311\331$\324k%aY\254\270[s\220\343\17", ) \35\350\246\21055\266\326\332&;81\11\2\275\16\2\335\0~\3M(\226\211\2358\52\373;\331\324\133\235\17[q\214\13\177\217\22\273(\366\324\330\244d\274\272\311\331$\324k%aY\254\270[s\220\343\17", ) == 0x0
 00697  1036   NtWriteFile  (108, 0, 0, 0,  (108, 0, 0, 0, "U\106\34o\301\21\0\12^]|\168M\221\3311]\33\26\31\220\220\330\225\273\262P\12\254\27\213QO\10d\203\220\4\10#\314\322,\2100\306{\22A\16\341\311\370F(I\3446\33\37\4\317\360f\320\374\2643\6\303\341\151\202\3704\336lB\266Pd\360X>6\322 \3042GW\310\204\310\257L.qP\351D\0(\1\334\200\24\203:*\12p\5\5\34k\253\326\12\350P\322<&p\256\10Vtu\310E\206\25\212\335\315\354\10\306\0g)\2039\370\251\373$\312\232BC9R\32@W\344\22061\15\213A4\324\251\251\315\I\25\5-\314$\230\365@\15R\314P\223\200\221\255\222\356\334\231\321$\370\245}Uu\300\213]\304\313Y\226\357\214\303\250\306\254\260\264FP\16\341\2248\310S\1\236\2507\225&\324(\217\263\263\305\223\366:'\250\241\0\276mo8\203xXm0\213\264\213JX-$\7\220\177\310 ^\31\343+\227\24\377\377\12,x<\231!\30d\360\324\221x]=.\243\261\324e\347\354\1\333\14p\12\336\363Pgc\310\266\36B#\350y\350\135i\266\344&\344X\17\11\335\3350\2\2`@\3\222H\250\211BX;2$[\347\324\324S\243\17\204\21\262\1\354\37\261\22dH\310\324\7\304Z\274e\251\347$\13\13\33a\206\314\206[\254\360\335\17", 10240, 0x0, 0, ... {status=0x0, info=10240}, ) \301\21\0\12^]|\168M\221\3311]\33\26\31\220\220\330\225\273\262P\12\254\27\213QO\10d\203\220\4\10#\314\322,\2100\306{\22A\16\341\311\370F(I\3446\33\37\4\317\360f\320\374\2643\6\303\341\151\202\3704\336lB\266Pd\360X>6\322 \3042GW\310\204\310\257L.qP\351D\0(\1\334\200\24\203:*\12p\5\5\34k\253\326\12\350P\322<&p\256\10Vtu\310E\206\25\212\335\315\354\10\306\0g)\2039\370\251\373$\312\232BC9R\32@W\344\22061\15\213A4\324\251\251\315\I\25\5-\314$\230\365@\15R\314P\223\200\221\255\222\356\334\231\321$\370\245}Uu\300\213]\304\313Y\226\357\214\303\250\306\254\260\264FP\16\341\2248\310S\1\236\2507\225&\324(\217\263\263\305\223\366:'\250\241\0\276mo8\203xXm0\213\264\213JX-$\7\220\177\310 ^\31\343+\227\24\377\377\12,x<\231!\30d\360\324\221x]=.\243\261\324e\347\354\1\333\14p\12\336\363Pgc\310\266\36B#\350y\350\135i\266\344&\344X\17\11\335\3350\2\2`@\3\222H\250\211BX;2$[\347\324\324S\243\17\204\21\262\1\354\37\261\22dH\310\324\7\304Z\274e\251\347$\13\13\33a\206\314\206[\254\360\335\17", 10240, 0x0, 0, ... {status=0x0, info=10240}, ) == 0x0
 00698  1036   NtReadFile  (104, 0, 0, 0, 10240, 0x0, 0, ... {status=0x0, info=10240},  (104, 0, 0, 0, 10240, 0x0, 0, ... {status=0x0, info=10240}, "\10\2425Xgr+w\356j2H\14-\375\30\225\366r\340\212\305\214H\337\313\254\345o\345\211}\307$~\221:\360[Z\273*\270q\214*\5\323.;>\333\367tV\357\26\234\3105\346\3\366\332k\276K\2378\375\13M\347k?\324\20\375kpM\325\221c\204\366\257\353\250?\367\336N\306\27;&_l\254\347P\31;\343mT\255\25[\1\361c\266\4\260\225\17\322U0(D\317b\11\304Z\36\265w\344Q\367\212\227#z\10#\237|\267\200`6\215\252o\265|\327g\17\300Un\5J#\25\211~~;\260\\325\222"\16)\243\341\237\226\25\334o\204\313\317\371\310 \32\16\336Y\306~\2\305Y\5\362\244\5\200\347G1M\333;\305\302\255\204\273\257\260\327\201\202\253\317\267\321\326\15\212\230\352\24\201/2\320\356>\237\341\177\4\352fcK\352`\12Z;mo\263\34 \13\311x\261\36\322Y\312\355\322\236f\32_\207\3419\24\234\211\0\220q&\33\252\214\323\355\351b\217 H\213\366?_\205\341:i\240\323\355\305\213\334\35U\14$\221\263x|\305M\237\374\11'\207uu/\357\235:T_\215\4__;\266\202\3039\203\16/?\267\320\222\301\255u\327t\20\245g\300\261\255kI\15\320\337\367\3\225\274\224\5\343\247\301\321Q\272\301B:\356\7\1", ) *\270q\214*\5\323.;>\333\367tV\357\26\234\3105\346\3\366\332k\276K\2378\375\13M\347k?\324\20\375kpM\325\221c\204\366\257\353\250?\367\336N\306\27;&_l\254\347P\31;\343mT\255\25[\1\361c\266\4\260\225\17\322U0(D\317b\11\304Z\36\265w\344Q\367\212\227#z\10#\237|\267\200`6\215\252o\265|\327g\17\300Un\5J#\25\211~~;\260\\325\222 (104, 0, 0, 0, 10240, 0x0, 0, ... {status=0x0, info=10240}, "\10\2425Xgr+w\356j2H\14-\375\30\225\366r\340\212\305\214H\337\313\254\345o\345\211}\307$~\221:\360[Z\273*\270q\214*\5\323.;>\333\367tV\357\26\234\3105\346\3\366\332k\276K\2378\375\13M\347k?\324\20\375kpM\325\221c\204\366\257\353\250?\367\336N\306\27;&_l\254\347P\31;\343mT\255\25[\1\361c\266\4\260\225\17\322U0(D\317b\11\304Z\36\265w\344Q\367\212\227#z\10#\237|\267\200`6\215\252o\265|\327g\17\300Un\5J#\25\211~~;\260\\325\222"\16)\243\341\237\226\25\334o\204\313\317\371\310 \32\16\336Y\306~\2\305Y\5\362\244\5\200\347G1M\333;\305\302\255\204\273\257\260\327\201\202\253\317\267\321\326\15\212\230\352\24\201/2\320\356>\237\341\177\4\352fcK\352`\12Z;mo\263\34 \13\311x\261\36\322Y\312\355\322\236f\32_\207\3419\24\234\211\0\220q&\33\252\214\323\355\351b\217 H\213\366?_\205\341:i\240\323\355\305\213\334\35U\14$\221\263x|\305M\237\374\11'\207uu/\357\235:T_\215\4__;\266\202\3039\203\16/?\267\320\222\301\255u\327t\20\245g\300\261\255kI\15\320\337\367\3\225\274\224\5\343\247\301\321Q\272\301B:\356\7\1", ) , ) == 0x0
 00699  1036   NtWriteFile  (108, 0, 0, 0,  (108, 0, 0, 0, "\327\302\13X\270\22\25w1\12\14H\323M\303\30J\226L\340U\245\262H\0\253\222\345\260\205\267}\30D@\221\345\220eZd\XY\16[\232\0RKcTPd9d\33b\246d`\221\345\220ej!lhQ\226C\226r\14tp,\35\311`\313z|5x@*\201\230C\20|\32\301\177\205\224\235\233`g\20\256p\273\3639\253V%\22\210\149+\204\20\274\7\213\2069\232A\214\14\210o@\323\377\367*\276(\212G\10:\320t9\366F\2733\252I\325\256\230\334W\4\371lE]\267\4F4\363F\37\306\266B\24\270\256\354\24\5\14N\5>\4\227JV0v\242\310\352\206=\366\5\13\200K@X\303\13\222\207U?\13p\303k\257-\353\221\274\344\310\2574\310\1\367\1.\370\27\344Fals\207n\31\344\203STrue\1.\3\210\4o\3651\322\212P\26D\20\27\304\205~\213w;1\311\212HCD\10\374\377B\267_\0\10\215u\17\213|\10\71\300\212\16;J\374u\267~\241[\216\\12\362\34\16\366\303\337\237Iu\342o[\253\361\371\27@$\16\19\370~\335\245g\5-\304;\2008'\17M\4[\373\302r\344\205\257o\267\277\202t\257\211\321\11a\13\212G\212*\201\360R\356\356\341\377\337\177\333\212Xc\224\212^\12\205[Sol|\36\13\26\30\217\36\159\364\355\15\376X\32\200\347\3379\313\374\267\0O\21\30\33u\354\355\3556\2\261 \227\353\310?\200\345\337:\266\300\355\355\32\353\342\35\212l\32\221l\30B\305\222\377\302\11\370\347Ku\360\217\243:\213?\263\4\200?\5\266]\243\7\203\321O\1\267\17\362\377\255\252\267J\20z\7\376\261r\13w\15\17\277\311\3J\334\252\5<\307\377\321\216\332\377B\345\2169\1", 10240, 0x0, 0, ... {status=0x0, info=10240}, ) , 10240, 0x0, 0, ... {status=0x0, info=10240}, ) == 0x0
 00700  1036   NtReadFile  (104, 0, 0, 0, 10240, 0x0, 0, ... {status=0x0, info=10240},  (104, 0, 0, 0, 10240, 0x0, 0, ... {status=0x0, info=10240}, "I\213\303\265_\267\222f\214\351\273\6\311\340\264\265\250\246\273\227\240nI\21\271\337\212\22\212l[\211\326\300g\6l\247_\35\357\334"\210k\33\241\240U\355\253>\325`\212\274\270Ny\263\256J\3760\3069\2454\336\247<\316[\302a\271V\367\12t\327::\310B\344\250\244\364\276\317t\274;m\364\2122\32\361\212hl"\230\340\3705W\354{\13\227\342\225\200q\3522&\366\340\17\254\342\204\325\12\302kI\266)\346\303\13\220\352k\373\3101{v\352\6\377i\357\341\3321\30\31!\2679~{Lb\263\5\313\206\375\377\362M\322N\271\301\251\360\271\307\36\364\312\346\236\266\13j\312\364\17\252.\240\3750\216\326\362\2719C#-Q\0\3440\2/\363A\35\207\317\27\28\304\22\366\310\343X\28\366A\30\205x\207q\210\330\273\5w\204n\252\341\336l\236\346\36\375>\233\327\328\243\304b\20,\32\247h\272uQ(z)\242.\360\216\355\254`\v*\310;<\254\246\177\323qX/\213"\30\203\300\225a\27\323.\35\354\251j\17H\352%\0X\214&\1\35\20\347\22}n\375^\340a\314\204\204\347\25\271\212\236\312\15j\226:\322\242\226{\376\2506\346\353\365q\22\332\335&\302\26\1\35\15:\343\355`Kyt\33\321\372VON$c\25\327D\34\16\336|\177\340\277\367\\364\234\352,\20+:\230\266\331iQ\21'\220\222\0\307\200:U\361i\27*\326d\231\26\3270R\253c\224-\4\24\350\31\247\235f\24H7\370\3159\6.\213j*f\316\3541\13l\321\14 \306\234\35b\12\0\214\27@\350\240\20U\330sp!\322'5c8", ) \210k\33\241\240U\355\253>\325`\212\274\270Ny\263\256J\3760\3069\2454\336\247<\316[\302a\271V\367\12t\327::\310B\344\250\244\364\276\317t\274;m\364\2122\32\361\212hl (104, 0, 0, 0, 10240, 0x0, 0, ... {status=0x0, info=10240}, "I\213\303\265_\267\222f\214\351\273\6\311\340\264\265\250\246\273\227\240nI\21\271\337\212\22\212l[\211\326\300g\6l\247_\35\357\334"\210k\33\241\240U\355\253>\325`\212\274\270Ny\263\256J\3760\3069\2454\336\247<\316[\302a\271V\367\12t\327::\310B\344\250\244\364\276\317t\274;m\364\2122\32\361\212hl"\230\340\3705W\354{\13\227\342\225\200q\3522&\366\340\17\254\342\204\325\12\302kI\266)\346\303\13\220\352k\373\3101{v\352\6\377i\357\341\3321\30\31!\2679~{Lb\263\5\313\206\375\377\362M\322N\271\301\251\360\271\307\36\364\312\346\236\266\13j\312\364\17\252.\240\3750\216\326\362\2719C#-Q\0\3440\2/\363A\35\207\317\27\28\304\22\366\310\343X\28\366A\30\205x\207q\210\330\273\5w\204n\252\341\336l\236\346\36\375>\233\327\328\243\304b\20,\32\247h\272uQ(z)\242.\360\216\355\254`\v*\310;<\254\246\177\323qX/\213"\30\203\300\225a\27\323.\35\354\251j\17H\352%\0X\214&\1\35\20\347\22}n\375^\340a\314\204\204\347\25\271\212\236\312\15j\226:\322\242\226{\376\2506\346\353\365q\22\332\335&\302\26\1\35\15:\343\355`Kyt\33\321\372VON$c\25\327D\34\16\336|\177\340\277\367\\364\234\352,\20+:\230\266\331iQ\21'\220\222\0\307\200:U\361i\27*\326d\231\26\3270R\253c\224-\4\24\350\31\247\235f\24H7\370\3159\6.\213j*f\316\3541\13l\321\14 \306\234\35b\12\0\214\27@\350\240\20U\330sp!\322'5c8", ) \31!\2679~{Lb\263\5\313\206\375\377\362M\322N\271\301\251\360\271\307\36\364\312\346\236\266\13j\312\364\17\252.\240\3750\216\326\362\2719C#-Q\0\3440\2/\363A\35\207\317\27\28\304\22\366\310\343X\28\366A\30\205x\207q\210\330\273\5w\204n\252\341\336l\236\346\36\375>\233\327\328\243\304b\20,\32\247h\272uQ(z)\242.\360\216\355\254`\v*\310;<\254\246\177\323qX/\213 (104, 0, 0, 0, 10240, 0x0, 0, ... {status=0x0, info=10240}, "I\213\303\265_\267\222f\214\351\273\6\311\340\264\265\250\246\273\227\240nI\21\271\337\212\22\212l[\211\326\300g\6l\247_\35\357\334"\210k\33\241\240U\355\253>\325`\212\274\270Ny\263\256J\3760\3069\2454\336\247<\316[\302a\271V\367\12t\327::\310B\344\250\244\364\276\317t\274;m\364\2122\32\361\212hl"\230\340\3705W\354{\13\227\342\225\200q\3522&\366\340\17\254\342\204\325\12\302kI\266)\346\303\13\220\352k\373\3101{v\352\6\377i\357\341\3321\30\31!\2679~{Lb\263\5\313\206\375\377\362M\322N\271\301\251\360\271\307\36\364\312\346\236\266\13j\312\364\17\252.\240\3750\216\326\362\2719C#-Q\0\3440\2/\363A\35\207\317\27\28\304\22\366\310\343X\28\366A\30\205x\207q\210\330\273\5w\204n\252\341\336l\236\346\36\375>\233\327\328\243\304b\20,\32\247h\272uQ(z)\242.\360\216\355\254`\v*\310;<\254\246\177\323qX/\213"\30\203\300\225a\27\323.\35\354\251j\17H\352%\0X\214&\1\35\20\347\22}n\375^\340a\314\204\204\347\25\271\212\236\312\15j\226:\322\242\226{\376\2506\346\353\365q\22\332\335&\302\26\1\35\15:\343\355`Kyt\33\321\372VON$c\25\327D\34\16\336|\177\340\277\367\\364\234\352,\20+:\230\266\331iQ\21'\220\222\0\307\200:U\361i\27*\326d\231\26\3270R\253c\224-\4\24\350\31\247\235f\24H7\370\3159\6.\213j*f\316\3541\13l\321\14 \306\234\35b\12\0\214\27@\350\240\20U\330sp!\322'5c8", ) , ) == 0x0
 00701  1036   NtWriteFile  (108, 0, 0, 0,  (108, 0, 0, 0, "\226\353\375\265\200\327\254fS\211\205\6\26\200\212\265w\306\205\227\177\16w\21f\277\264\22U\14e\211\11\240Y\6\263\307a\350\274\34\210\264{\237\240\212\215\225>\12\0\264\274g.G\263q*\3000\31Y\2334\1\307\2\316\204\242_\271\211\2274t\10Z\4\310\235\204\226\244+\336\361tc[S\364UR$\361U\10R"G\200\3065\210\214E\13H\202\253\200\256\212\14&)\2001\254=\344\353\12\35\13w\266\366\206\375\13O\212U\373\27QEv5f\301i0\201\3441\307\v\214%x,\2\12@\202\32\204\13\370B\247\26\200{5\266\20\31\316\236p\353\7$\324\3503\200\226t\203B'!hY@{\223\2\215\5\24\346\303\377--\354Nf\241\227\360f\247 \364\25\206\240\266\324\12\364\364\320\312\20\240"P\260\326-\331\7C\374Mo\0;P\16\1\34A\340`\227b\364C\212\22\20\364Z\246\266\6\11o\21\370\360\254\0\30\340\4U.\11)*\11\4\247\26\10Pl\253\274\364\23\4\313\210'\247B\6*H\350\230\3639\331N\265j\365\6\360\354\356kR\321\323@\370\234\302\24\0Sw~\350\177pk\330\254\20\37\322\370U]8", 10240, 0x0, 0, ... {status=0x0, info=10240}, ) G\200\3065\210\214E\13H\202\253\200\256\212\14&)\2001\254=\344\353\12\35\13w\266\366\206\375\13O\212U\373\27QEv5f\301i0\201\3441\307\v\214%x,\2\12@\202\32\204\13\370B\247\26\200{5\266\20\31\316\236p\353\7$\324\3503\200\226t\203B'!hY@{\223\2\215\5\24\346\303\377--\354Nf\241\227\360f\247 \364\25\206\240\266\324\12\364\364\320\312\20\240 (108, 0, 0, 0, "\226\353\375\265\200\327\254fS\211\205\6\26\200\212\265w\306\205\227\177\16w\21f\277\264\22U\14e\211\11\240Y\6\263\307a\350\274\34\210\264{\237\240\212\215\225>\12\0\264\274g.G\263q*\3000\31Y\2334\1\307\2\316\204\242_\271\211\2274t\10Z\4\310\235\204\226\244+\336\361tc[S\364UR$\361U\10R"G\200\3065\210\214E\13H\202\253\200\256\212\14&)\2001\254=\344\353\12\35\13w\266\366\206\375\13O\212U\373\27QEv5f\301i0\201\3441\307\v\214%x,\2\12@\202\32\204\13\370B\247\26\200{5\266\20\31\316\236p\353\7$\324\3503\200\226t\203B'!hY@{\223\2\215\5\24\346\303\377--\354Nf\241\227\360f\247 \364\25\206\240\266\324\12\364\364\320\312\20\240"P\260\326-\331\7C\374Mo\0;P\16\1\34A\340`\227b\364C\212\22\20\364Z\246\266\6\11o\21\370\360\254\0\30\340\4U.\11)*\11\4\247\26\10Pl\253\274\364\23\4\313\210'\247B\6*H\350\230\3639\331N\265j\365\6\360\354\356kR\321\323@\370\234\302\24\0Sw~\350\177pk\330\254\20\37\322\370U]8", 10240, 0x0, 0, ... {status=0x0, info=10240}, ) \16\1\34A\340`\227b\364C\212\22\20\364Z\246\266\6\11o\21\370\360\254\0\30\340\4U.\11)*\11\4\247\26\10Pl\253\274\364\23\4\313\210'\247B\6*H\350\230\3639\331N\265j\365\6\360\354\356kR\321\323@\370\234\302\24\0Sw~\350\177pk\330\254\20\37\322\370U]8", 10240, 0x0, 0, ... {status=0x0, info=10240}, ) == 0x0
 00702  1036   NtReadFile  (104, 0, 0, 0, 10240, 0x0, 0, ... {status=0x0, info=10240},  (104, 0, 0, 0, 10240, 0x0, 0, ... {status=0x0, info=10240}, "\300\17\374#\376p\376\11gL\354\345\273o\227y\271\242\277\307\237\2%\341\301B\274|\336h\274.\207v+&\374\313\326{\236\322\375\270\321l\206%\236\334\357\273V8\30w\11\355N\30\310\330\217\263\30j\267\34\26rC\314\231\3325 \3276\245\301I\310\344\233\262m\330{S`\320Y\5\12"\334\3H9\361\252\265\223\210\335d\371]\337\336\37\2649\210/x\345\6!ao\250^\315+}\302\252\212\362\24\262u`k\315\241\367\6\322\352\26\33_\253\177i\307\321k\273\15\346C\213\26\12J\213\243\266=\337j\324\4oZ\36m\345\11\205\303\271\251V*\351y\353\241/\357\26\30\352\320\225\366\355\270Z$A\113X\350\242\31hSS\345\265\304\340\3220\350\251\312\246\306k\2665u\307\10\31\351NO\265\327v.\2145w\267\342\363\255\343q\267\310\216$\233\325w\4\337u\266\367\325>n\345\347\373R\362\315\20{\344\217\330'FE\3545\254Z\0\267\24\11\340\272\35\265$\12=\331\0\35F\4\355\230Hq\337\262\2\231\336\325 \267\2\251\213Sa?Xg\342\233I\3239\331\362\315\200]\2\15\360\332i\323\16\336\14-e;\333\336z\336\262\320\347\243\330\325\350\5t\355\236\200j\325\371\336\340\215\314\5\205b\27\230\21cA\216\177o\251\250\30\323\366m|\211\302\177\357_\321vi\314z)\217\210\262e\370\266](\311\355\270\254\215\311\254\27\343\324*v\7", ) \334\3H9\361\252\265\223\210\335d\371]\337\336\37\2649\210/x\345\6!ao\250^\315+}\302\252\212\362\24\262u`k\315\241\367\6\322\352\26\33_\253\177i\307\321k321\305}CP\5o\251HY3\153P\361=\322\271\250,F\353\342\321\204\370\317\247F\3xP\303\327\306\31\25\3~6D\240\370\323\242\274@\213\347\37 \207\14\354!\353\222\243a\200vWA\2710k\256N\302\306\251wq\2103\5\370l?*\237\252)\232;\232\340K>\273\15\346C\213\26\12J\213\243\266=\337j\324\4oZ\36m\345\11\205\303\271\251V*\351y\353\241/\357\26\30\352\320\225\366\355\270Z$A\113X\350\242\31hSS\345\265\304\340\3220\350\251\312\246\306k\2665u\307\10\31\351NO\265\327v.\2145w\267\342\363\255\343q\267\310\216$\233\325w\4\337u\266\367\325>n\345\347\373R\362\315\20{\344\217\330'FE\3545\254Z\0\267\24\11\340\272\35\265$\12=\331\0\35F\4\355\230Hq\337\262\2\231\336\325 \267\2\251\213Sa?Xg\342\233I\3239\331\362\315\200]\2\15\360\332i\323\16\336\14-e;\333\336z\336\262\320\347\243\330\325\350\5t\355\236\200j\325\371\336\340\215\314\5\205b\27\230\21cA\216\177o\251\250\30\323\366m|\211\302\177\357_\321vi\314z)\217\210\262e\370\266](\311\355\270\254\215\311\254\27\343\324*v\7", ) == 0x0
 00703  1036   NtWriteFile  (108, 0, 0, 0,  (108, 0, 0, 0, "\37o\302#!\20\300\11\270,\322\345d\17\251yf\302\201\307@b\33\341\36"\202|\1\10\202.X\26\25&#\253\350{A\262\303\270\16\14\270%A\274\321\273\211X&w\326\215p\30\27\270\261\263\307\12\211\34\311\22}\314F\272\13 \10V\233\301\226\250\332\233m\15\346{\214\0\356Y\332j\34\334\334(\7\361u\325\255\210\2\4\307]\0\276!\264\346\350\21x:f\37a\260\310`\315\364\35\374\252U\222*\262\252\0U\315~\2278\3225v%_t\37W\307\16\13\2C%(\2328\353\1\357\305\242#n\5\260\311vY\354m\15P.]\354\271wLx\353=\261\272\370\20t\11F\334\30n\303\10\246'\25\334\36\10D\177\230\355\242c \265\347\300@\271\143A\325\222|\1\276v\210!\2070\264\316p\302\31\311IqWS;\370\263_\24\237uI\244;E\200u>dm\330CTv4JT\303\210=\0\12\352\4\260: m:i\273\303f\311h*6\31\325\241\360\217(\305\260\253\3662\330d$\236i\15X7\302'h\2143\333\265\33\200\35407\311\364\246\31\13\2105\252\2476\316.q\265\10\26\20\214\352\27\211\342,\315\335qh\250\260$D\265I\4\0\25\210\367\12^P\3458\233l\362\22pE\344P\270\31F\232\214\13\254\205`\211\24\326\200\204\35jD4=\6`#F\333\215\246H\256\277\214\2F\276\353 hb\227\213\214\1\1X\270\202\245I\14Y\347\362\22\340c\2\322\220\344i\14n\340\14\362\5\5\333\1\32\340\262\17\207\235\330\12\210;t2\376\276j\12\231\340\340R\254;\205\275w\246\21\274!\260\177\260\311\226\30\14\226S|V\242A\357\200\261Hi\23\32\27\217W\322[\370i=\26\3112\330\222\215\26\314)\343\13JH\7", 10240, 0x0, 0, ... {status=0x0, info=10240}, ) \202|\1\10\202.X\26\25&#\253\350{A\262\303\270\16\14\270%A\274\321\273\211X&w\326\215p\30\27\270\261\263\307\12\211\34\311\22}\314F\272\13 \10V\233\301\226\250\332\233m\15\346{\214\0\356Y\332j\34\334\334(\7\361u\325\255\210\2\4\307]\0\276!\264\346\350\21x:f\37a\260\310`\315\364\35\374\252U\222*\262\252\0U\315~\2278\3225v%_t\37W\307\16\13\2C%(\2328\353\1\357\305\242#n\5\260\311vY\354m\15P.]\354\271wLx\353=\261\272\370\20t\11F\334\30n\303\10\246'\25\334\36\10D\177\230\355\242c \265\347\300@\271\143A\325\222|\1\276v\210!\2070\264\316p\302\31\311IqWS;\370\263_\24\237uI\244;E\200u>dm\330CTv4JT\303\210=\0\12\352\4\260: m:i\273\303f\311h*6\31\325\241\360\217(\305\260\253\3662\330d$\236i\15X7\302'h\2143\333\265\33\200\35407\311\364\246\31\13\2105\252\2476\316.q\265\10\26\20\214\352\27\211\342,\315\335qh\250\260$D\265I\4\0\25\210\367\12^P\3458\233l\362\22pE\344P\270\31F\232\214\13\254\205`\211\24\326\200\204\35jD4=\6`#F\333\215\246H\256\277\214\2F\276\353 hb\227\213\214\1\1X\270\202\245I\14Y\347\362\22\340c\2\322\220\344i\14n\340\14\362\5\5\333\1\32\340\262\17\207\235\330\12\210;t2\376\276j\12\231\340\340R\254;\205\275w\246\21\274!\260\177\260\311\226\30\14\226S|V\242A\357\200\261Hi\23\32\27\217W\322[\370i=\26\3112\330\222\215\26\314)\343\13JH\7", 10240, 0x0, 0, ... {status=0x0, info=10240}, ) == 0x0
 00704  1036   NtReadFile  (104, 0, 0, 0, 10240, 0x0, 0, ... {status=0x0, info=10240},  (104, 0, 0, 0, 10240, 0x0, 0, ... {status=0x0, info=10240}, "\355\376n\20\30@~\12m(\2\350\1kh\34\327M\33\14\353\262?\324\24G\312\377_=\207A\375\356\245\275\0(5\250\0F\314+\30>l \303\253\300\342\235\325\356RC~\265\373O\17\325\22\204w0\332\271\237(-\333\7\203K0[\325J\264\372\25U\2538\11W\351@Y\22\334D\33\21,T\37%p\364\276\341\232\260cNE\357[\377;GG\336\315\22\260\252ZqJ%\351\250_\267='\270\3121\2\316\330\225fR\25\334KnjY \323u\201\327\244[\312\244\32\1Z\371\367\325E\306\207t\334\225\364\21\362.Q\11l\306W\237\7\204r\223\346\14[\206\226\10%\3\20`n\13\274p\36k\316~\240\212y@\326\13\244?$\3\225=\277x\313\244d\357\361X@\23\212F\237'\223\326U'\250\4j\317\215f.S\203\4ucT}\307J\347KR\260\10\361$\304\324n\354 \212UR\24\320\177\220\32\313\36\346;\214D\226\345\31\301\234]\332\367}\30Q\244\323\200*,\222#\17\351\34\306\234g\273\373\24S\327\1\16\244\24e\337!\272\12\211\304U\337\241\237-\211\333\246~,\337c\33@\262T<\324LLX\210B\10Z\242\333\261E~\377\200/\360\240\\331:\205\310D\237)%J\371\323\273s\21\304z\362-\353\260@\4\260\213\22\215\233\2338\205\15\35<\300\364d-\353\246\234j\212} \14\253n:\217f-\23\27\317K\374\263\352\27I\4\241f\346\344\27K\364\15\351\2\22>Toc\20\253}\212\205O!\204\0\6\330\2763\206\217\374\342!7\177\36\353\345S\200\4[Wt\306\2202P\302R7'\21X\367;\357\340b\310\337\324\16\366\376\300M0lo\266\4cM\262\204\3503\6\27V0\6\221^\312\257&mc*\275", ) , ) == 0x0
 00705  1036   NtWriteFile  (108, 0, 0, 0,  (108, 0, 0, 0, "2\236P\20\307 @\12\262H<\350\336\13V\34\10-%\144\322\1\324\313'\364\377\200]\271A"\216\233\275\337H\13\250\337&\362+\307^R \34\313\376\342B\265\320R\234\36\213\373\220o\353\22[\27\16\332f\377\26-\4g\275K\357;\353Jk\232+UtX7W6 g\22\3$%\21\3634!%\257\224\200\341E\320]N\232\217e\377\344'y\336\22r\216\252\205\21t%6\310a\267\342G\206\312\356b\360\330J\6l\25\3+Pj\206@\355u^\267\232[\25\304$\1\205\231\311\325\232\246\271t\3\365\312\21-No\11\263\246i\237\330\344L\2239le\206Ih\33\3\317\0P\13c\20 k\21\36\236\212\246 \350\13{_\32\3J]\201x\24\304Z\357.8~\23U&\241'L\266k'wdT\317R\6\20S\dKc\213\35\371J8+l\260\327\221\32\304\13\16\322 U5l\24\17\37\256\32\24~\330;S$\250\345\306\241\242]\5\227C\30\216\304\355\200\365L\254#\320\211"\306C\7\205\373\3133\351\1\321\304*e\0A\204\12V\244k\337~\377\23\211\4\306@,\0\3%@m4\2\324\223,f\210\235hd\242\4\321{~ \340\21\360\177<\347:Z\250z\237\366Et\371\14\333M\21\33\32\314-4\320~\4o\353,\215D\373\6\205\322}\2\300+\4\23\353\313V\242jU\35\36\14t\16\4\217\271M-\27\20+\302\2635ww\4~\6\330\344\310+\312\156b,>\213\17]\20t\35\264\205\220A\272\0\331\270\2003Y\357\302\342\376WA\364\205m\200\333;it\31\360\14P\352\11'\3168\311;0\200\\310\0\2640\366!\240s0\263\17\210\4\274-\214\2047S8\27\211P8\221\201\252\221&\262\3\24\275", 10240, 0x0, 0, ... {status=0x0, info=10240}, ) \216\233\275\337H\13\250\337&\362+\307^R \34\313\376\342B\265\320R\234\36\213\373\220o\353\22[\27\16\332f\377\26-\4g\275K\357;\353Jk\232+UtX7W6 g\22\3$%\21\3634!%\257\224\200\341E\320]N\232\217e\377\344'y\336\22r\216\252\205\21t%6\310a\267\342G\206\312\356b\360\330J\6l\25\3+Pj\206@\355u^\267\232[\25\304$\1\205\231\311\325\232\246\271t\3\365\312\21-No\11\263\246i\237\330\344L\2239le\206Ih\33\3\317\0P\13c\20 k\21\36\236\212\246 \350\13{_\32\3J]\201x\24\304Z\357.8~\23U&\241'L\266k'wdT\317R\6\20S\dKc\213\35\371J8+l\260\327\221\32\304\13\16\322 U5l\24\17\37\256\32\24~\330;S$\250\345\306\241\242]\5\227C\30\216\304\355\200\365L\254#\320\211 (108, 0, 0, 0, "2\236P\20\307 @\12\262H<\350\336\13V\34\10-%\144\322\1\324\313'\364\377\200]\271A"\216\233\275\337H\13\250\337&\362+\307^R \34\313\376\342B\265\320R\234\36\213\373\220o\353\22[\27\16\332f\377\26-\4g\275K\357;\353Jk\232+UtX7W6 g\22\3$%\21\3634!%\257\224\200\341E\320]N\232\217e\377\344'y\336\22r\216\252\205\21t%6\310a\267\342G\206\312\356b\360\330J\6l\25\3+Pj\206@\355u^\267\232[\25\304$\1\205\231\311\325\232\246\271t\3\365\312\21-No\11\263\246i\237\330\344L\2239le\206Ih\33\3\317\0P\13c\20 k\21\36\236\212\246 \350\13{_\32\3J]\201x\24\304Z\357.8~\23U&\241'L\266k'wdT\317R\6\20S\dKc\213\35\371J8+l\260\327\221\32\304\13\16\322 U5l\24\17\37\256\32\24~\330;S$\250\345\306\241\242]\5\227C\30\216\304\355\200\365L\254#\320\211"\306C\7\205\373\3133\351\1\321\304*e\0A\204\12V\244k\337~\377\23\211\4\306@,\0\3%@m4\2\324\223,f\210\235hd\242\4\321{~ \340\21\360\177<\347:Z\250z\237\366Et\371\14\333M\21\33\32\314-4\320~\4o\353,\215D\373\6\205\322}\2\300+\4\23\353\313V\242jU\35\36\14t\16\4\217\271M-\27\20+\302\2635ww\4~\6\330\344\310+\312\156b,>\213\17]\20t\35\264\205\220A\272\0\331\270\2003Y\357\302\342\376WA\364\205m\200\333;it\31\360\14P\352\11'\3168\311;0\200\\310\0\2640\366!\240s0\263\17\210\4\274-\214\2047S8\27\211P8\221\201\252\221&\262\3\24\275", 10240, 0x0, 0, ... {status=0x0, info=10240}, ) , 10240, 0x0, 0, ... {status=0x0, info=10240}, ) == 0x0
 00706  1036   NtReadFile  (104, 0, 0, 0, 10240, 0x0, 0, ... {status=0x0, info=10240},  (104, 0, 0, 0, 10240, 0x0, 0, ... {status=0x0, info=10240}, "\335\223\346H\252\312\224\277\27!\34\210\2\343\263\327\214?\216\337\310\240\366d\3159\26`\211e\212a\304r\203\377\311\260\335'g:\7\212\223a\301\2006j\260\375\5:\206\4\334\377t\215\371\4\12?\330\225\263I\237*K\336\200\22\225\14\3\17<\25\257l\314L\205\31\231\205p5-#\360W\327rJhU\203\266N\345\5W\325r\230m=\345\353\1\355\7B\344\370+\326\7\325\303\326\350Y\252\261#;\363B\255\335W\200F\0/\312l*\3223\312-MC\214\215\242\230\233v\265\341\3440\253\243\266\0\245i2\254<\347\300 \377\302/\3=\275\340\201\305\201M\365\376\361\223\336\303=}\253\24P\243\221V\32]\263\36l\16\13\227\206"\300=v\354\327\202|n\324\322?\125\2510I\350V\375\3\335\350\367\26/~\2066\203\260\70\243\224\10\213c[\241\220Uym\32\233-\303\372{\224\255\307Pr,D\315-\35<_3*C\336\332\256jO\7\255&V\263\177"\241s\313C\327\02t\304M\301\257\333\342Q\272\315\341}\4U0y\351\226N\375\354\211\270'\347\2\344O\230\306C\333\230\366\0\255E\306\370\272\240\335M'\22\207k\373e\273\344\371\360\215<\250l\264\343)\330\372\224\277 \377p\4\353\377 \243 \372\30;F\3577\373Y\225\362\307\373\264S\230\3470\16\337\3042\353\346\222+H\332\323<(\327\343l\362\332b\31\350\303\352aR\236\320\207h\253\26\366\246]\241\266mO\331V\214\31J\177\24\227\263\255T/\245\3260\264b>\311\314\251\31\357\335H1a\331p\203o\337/fa\216\261\H\317G\225\360\357\364Z\24\343`x`\34Hv`\370x\17\30", ) \205\31\231\205p5-#\360W\327rJhU\203\266N\345\5W\325r\230m=\345\353\1\355\7B\344\370+\326\7\325\303\326\350Y\252\261#;\363B\255\335W\200F\0/\312l*\3223\312-MC\214\215\242\230\233v\265\341\3440\253\243\266\0\245i2\254<\347\300 \377\302/\3=\275\340\201\305\201M\365\376\361\223\336\303=}\253\24P\243\221V\32]\263\36l\16\13\227\206 (104, 0, 0, 0, 10240, 0x0, 0, ... {status=0x0, info=10240}, "\335\223\346H\252\312\224\277\27!\34\210\2\343\263\327\214?\216\337\310\240\366d\3159\26`\211e\212a\304r\203\377\311\260\335'g:\7\212\223a\301\2006j\260\375\5:\206\4\334\377t\215\371\4\12?\330\225\263I\237*K\336\200\22\225\14\3\17<\25\257l\314L\205\31\231\205p5-#\360W\327rJhU\203\266N\345\5W\325r\230m=\345\353\1\355\7B\344\370+\326\7\325\303\326\350Y\252\261#;\363B\255\335W\200F\0/\312l*\3223\312-MC\214\215\242\230\233v\265\341\3440\253\243\266\0\245i2\254<\347\300 \377\302/\3=\275\340\201\305\201M\365\376\361\223\336\303=}\253\24P\243\221V\32]\263\36l\16\13\227\206"\300=v\354\327\202|n\324\322?\125\2510I\350V\375\3\335\350\367\26/~\2066\203\260\70\243\224\10\213c[\241\220Uym\32\233-\303\372{\224\255\307Pr,D\315-\35<_3*C\336\332\256jO\7\255&V\263\177"\241s\313C\327\02t\304M\301\257\333\342Q\272\315\341}\4U0y\351\226N\375\354\211\270'\347\2\344O\230\306C\333\230\366\0\255E\306\370\272\240\335M'\22\207k\373e\273\344\371\360\215<\250l\264\343)\330\372\224\277 \377p\4\353\377 \243 \372\30;F\3577\373Y\225\362\307\373\264S\230\3470\16\337\3042\353\346\222+H\332\323<(\327\343l\362\332b\31\350\303\352aR\236\320\207h\253\26\366\246]\241\266mO\331V\214\31J\177\24\227\263\255T/\245\3260\264b>\311\314\251\31\357\335H1a\331p\203o\337/fa\216\261\H\317G\225\360\357\364Z\24\343`x`\34Hv`\370x\17\30", ) \241s\313C\327\02t\304M\301\257\333\342Q\272\315\341}\4U0y\351\226N\375\354\211\270'\347\2\344O\230\306C\333\230\366\0\255E\306\370\272\240\335M'\22\207k\373e\273\344\371\360\215<\250l\264\343)\330\372\224\277 \377p\4\353\377 \243 \372\30;F\3577\373Y\225\362\307\373\264S\230\3470\16\337\3042\353\346\222+H\332\323<(\327\343l\362\332b\31\350\303\352aR\236\320\207h\253\26\366\246]\241\266mO\331V\214\31J\177\24\227\263\255T/\245\3260\264b>\311\314\251\31\357\335H1a\331p\203o\337/fa\216\261\H\317G\225\360\357\364Z\24\343`x`\34Hv`\370x\17\30", ) == 0x0
 00707  1036   NtWriteFile  (108, 0, 0, 0,  (108, 0, 0, 0, "\2\363\330Hu\252\252\277\310A"\210\335\203\215\327S_\260\337\27\300\310d\22Y(`V\5\264a\33\22\275\377\26\320\343'\270Z9\212L\1\377\200\351\12\216\375\332Z\270\4\3\237J\215&d4?\7\365\215I@Ju\336_r\253\14\334o\2\25p\14\362L\343\11z\4\307~\241\4\252\243\362d\1%w\2#\374\3022"B\273\31F\345N5\362C\316W\10\22th\212\343\210N:ei\325\255\370S=:\213?\355\330"\332\370\364\2669\325\34\266\326Yu\321\35;,"\223\335\210\340x\0\360\252R*\15S\364-\222#\262\215}\370\245vj\201\3320t\303\210\0z\11\14\254\343\207\376  \242\21\3\342\335\336\201\32\341s\36\352\236\317\223\1\243\3}ttn\243N6$]l~R\16\324\367\270"\37]H\354\10\342Bn\13\262\1\12\352\311\16I76\303\3\2\210\311\26\360\36\2706\\32090|\3646\213\274;\237\220\212\31S\32DM\375\372\244\364\223\307\217\22\22D\22M#<\200S\24C\1\272\220j\220g\223&\211\323A"~\23\365C\10`\14t\33-\377\257\4\202o\272\22\201C\4\212PG\351I.\303\35\353q\17\270\370\207<\344\220\370\370C\4\370\310\0r%\370\370e\300\343M\370r\271k$\5\205\344&\220\263, 10240, 0x0, 0, ... {status=0x0, info=10240}, ) \210\335\203\215\327S_\260\337\27\300\310d\22Y(`V\5\264a\33\22\275\377\26\320\343'\270Z9\212L\1\377\200\351\12\216\375\332Z\270\4\3\237J\215&d4?\7\365\215I@Ju\336_r\253\14\334o\2\25p\14\362L\343\11z\4\307~\241\4\252\243\362d\1%w\2#\374\3022 (108, 0, 0, 0, "\2\363\330Hu\252\252\277\310A"\210\335\203\215\327S_\260\337\27\300\310d\22Y(`V\5\264a\33\22\275\377\26\320\343'\270Z9\212L\1\377\200\351\12\216\375\332Z\270\4\3\237J\215&d4?\7\365\215I@Ju\336_r\253\14\334o\2\25p\14\362L\343\11z\4\307~\241\4\252\243\362d\1%w\2#\374\3022"B\273\31F\345N5\362C\316W\10\22th\212\343\210N:ei\325\255\370S=:\213?\355\330"\332\370\364\2669\325\34\266\326Yu\321\35;,"\223\335\210\340x\0\360\252R*\15S\364-\222#\262\215}\370\245vj\201\3320t\303\210\0z\11\14\254\343\207\376  \242\21\3\342\335\336\201\32\341s\36\352\236\317\223\1\243\3}ttn\243N6$]l~R\16\324\367\270"\37]H\354\10\342Bn\13\262\1\12\352\311\16I76\303\3\2\210\311\26\360\36\2706\\32090|\3646\213\274;\237\220\212\31S\32DM\375\372\244\364\223\307\217\22\22D\22M#<\200S\24C\1\272\220j\220g\223&\211\323A"~\23\365C\10`\14t\33-\377\257\4\202o\272\22\201C\4\212PG\351I.\303\35\353q\17\270\370\207<\344\220\370\370C\4\370\310\0r%\370\370e\300\343M\370r\271k$\5\205\344&\220\263, 10240, 0x0, 0, ... {status=0x0, info=10240}, ) \332\370\364\2669\325\34\266\326Yu\321\35;, (108, 0, 0, 0, "\2\363\330Hu\252\252\277\310A"\210\335\203\215\327S_\260\337\27\300\310d\22Y(`V\5\264a\33\22\275\377\26\320\343'\270Z9\212L\1\377\200\351\12\216\375\332Z\270\4\3\237J\215&d4?\7\365\215I@Ju\336_r\253\14\334o\2\25p\14\362L\343\11z\4\307~\241\4\252\243\362d\1%w\2#\374\3022"B\273\31F\345N5\362C\316W\10\22th\212\343\210N:ei\325\255\370S=:\213?\355\330"\332\370\364\2669\325\34\266\326Yu\321\35;,"\223\335\210\340x\0\360\252R*\15S\364-\222#\262\215}\370\245vj\201\3320t\303\210\0z\11\14\254\343\207\376  \242\21\3\342\335\336\201\32\341s\36\352\236\317\223\1\243\3}ttn\243N6$]l~R\16\324\367\270"\37]H\354\10\342Bn\13\262\1\12\352\311\16I76\303\3\2\210\311\26\360\36\2706\\32090|\3646\213\274;\237\220\212\31S\32DM\375\372\244\364\223\307\217\22\22D\22M#<\200S\24C\1\272\220j\220g\223&\211\323A"~\23\365C\10`\14t\33-\377\257\4\202o\272\22\201C\4\212PG\351I.\303\35\353q\17\270\370\207<\344\220\370\370C\4\370\310\0r%\370\370e\300\343M\370r\271k$\5\205\344&\220\263, 10240, 0x0, 0, ... {status=0x0, info=10240}, ) \37]H\354\10\342Bn\13\262\1\12\352\311\16I76\303\3\2\210\311\26\360\36\2706\\32090|\3646\213\274;\237\220\212\31S\32DM\375\372\244\364\223\307\217\22\22D\22M#<\200S\24C\1\272\220j\220g\223&\211\323A (108, 0, 0, 0, "\2\363\330Hu\252\252\277\310A"\210\335\203\215\327S_\260\337\27\300\310d\22Y(`V\5\264a\33\22\275\377\26\320\343'\270Z9\212L\1\377\200\351\12\216\375\332Z\270\4\3\237J\215&d4?\7\365\215I@Ju\336_r\253\14\334o\2\25p\14\362L\343\11z\4\307~\241\4\252\243\362d\1%w\2#\374\3022"B\273\31F\345N5\362C\316W\10\22th\212\343\210N:ei\325\255\370S=:\213?\355\330"\332\370\364\2669\325\34\266\326Yu\321\35;,"\223\335\210\340x\0\360\252R*\15S\364-\222#\262\215}\370\245vj\201\3320t\303\210\0z\11\14\254\343\207\376  \242\21\3\342\335\336\201\32\341s\36\352\236\317\223\1\243\3}ttn\243N6$]l~R\16\324\367\270"\37]H\354\10\342Bn\13\262\1\12\352\311\16I76\303\3\2\210\311\26\360\36\2706\\32090|\3646\213\274;\237\220\212\31S\32DM\375\372\244\364\223\307\217\22\22D\22M#<\200S\24C\1\272\220j\220g\223&\211\323A"~\23\365C\10`\14t\33-\377\257\4\202o\272\22\201C\4\212PG\351I.\303\35\353q\17\270\370\207<\344\220\370\370C\4\370\310\0r%\370\370e\300\343M\370r\271k$\5\205\344&\220\263, 10240, 0x0, 0, ... {status=0x0, info=10240}, ) , 10240, 0x0, 0, ... {status=0x0, info=10240}, ) == 0x0
 00708  1036   NtReadFile  (104, 0, 0, 0, 10240, 0x0, 0, ... {status=0x0, info=10240},  (104, 0, 0, 0, 10240, 0x0, 0, ... {status=0x0, info=10240}, "\247\0\20\230\224.Q\374\310\222\21{\224svS\257\14Wt\211\314\337,\376?s\4\2660\307b\2409\271S\216,ia\367\3:\205_\345;\323kG<\366\317->\227\333g\12 \276\333\362\327\204h\11\260\204\227\245\0\350\2\25z\334s\15\25mD\11\12D-\216\17\334O\35\340\3377\265\326\226t\2\0\267\37vS\226$?\340\322\30\347\220]\202\323\353\317A\365Ie\230f\305\336\202]\262\354h\247\260\355\34}\214\313\242`}R3?\271\336#\177\202Us\34|\252`\5\200\306\342p`\5u\266\267\334\2006*\332\3017\12\347e\7\327uP\274\216\251\171\271\362\5\1\242}\324\3\215\311\351\227(\317\334# La\252\325s\2\213\252\333\264\262\325\332zJ\364OO\226\11\240\233\306\207\265io-\307\352\266;wc\251\200K9\274'\233\17\356\4R-\306\346_\0\377\117A6\313\374o\225\252\310\33\252qGk\34X\333)1\244|\3400\10\352z{\22\375W\210\24\213\323]\33\242\211*q\23\330<\0Cp1\377\23p\203\2\341-vu\3225\273")\235g84]\200\16\33\\215 \337\244\325&w\361!*\267u\313\205\333\360>|\232\27\24\12\265b\211\252h\315\234G\3\236KG\30:?\3\335\2Z\236\363\253\214l\332l2\20\317t\214,\24\322*\30\307@\36\313mL\365$\373H\26,\363t\245\0\275\267\317\202\217!\262\355\213`\225S\320\225\266f\216\337u\242\374:<\213\16c\324\11\13\303\233v\277\2142\3", ) \325s\2\213\252\333\264\262\325\332zJ\364OO\226\11\240\233\306\207\265io-\307\352\266;wc\251\200K9\274'\233\17\356\4R-\306\346_\0\377\117A6\313\374o\225\252\310\33\252qGk\34X\333)1\244|\3400\10\352z{\22\375W\210\24\213\323]\33\242\211*q\23\330<\0Cp1\377\23p\203\2\341-vu\3225\273 (104, 0, 0, 0, 10240, 0x0, 0, ... {status=0x0, info=10240}, "\247\0\20\230\224.Q\374\310\222\21{\224svS\257\14Wt\211\314\337,\376?s\4\2660\307b\2409\271S\216,ia\367\3:\205_\345;\323kG<\366\317->\227\333g\12 \276\333\362\327\204h\11\260\204\227\245\0\350\2\25z\334s\15\25mD\11\12D-\216\17\334O\35\340\3377\265\326\226t\2\0\267\37vS\226$?\340\322\30\347\220]\202\323\353\317A\365Ie\230f\305\336\202]\262\354h\247\260\355\34}\214\313\242`}R3?\271\336#\177\202Us\34|\252`\5\200\306\342p`\5u\266\267\334\2006*\332\3017\12\347e\7\327uP\274\216\251\171\271\362\5\1\242}\324\3\215\311\351\227(\317\334# La\252\325s\2\213\252\333\264\262\325\332zJ\364OO\226\11\240\233\306\207\265io-\307\352\266;wc\251\200K9\274'\233\17\356\4R-\306\346_\0\377\117A6\313\374o\225\252\310\33\252qGk\34X\333)1\244|\3400\10\352z{\22\375W\210\24\213\323]\33\242\211*q\23\330<\0Cp1\377\23p\203\2\341-vu\3225\273")\235g84]\200\16\33\\215 \337\244\325&w\361!*\267u\313\205\333\360>|\232\27\24\12\265b\211\252h\315\234G\3\236KG\30:?\3\335\2Z\236\363\253\214l\332l2\20\317t\214,\24\322*\30\307@\36\313mL\365$\373H\26,\363t\245\0\275\267\317\202\217!\262\355\213`\225S\320\225\266f\216\337u\242\374:<\213\16c\324\11\13\303\233v\277\2142\3", ) , ) == 0x0
 00709  1036   NtWriteFile  (108, 0, 0, 0,  (108, 0, 0, 0, "x`.\230KNo\374\27\362/{K\23HSplitV\254\341,!_M\4iP\371b\177Y\207SQLWa(c\4\205\200\205\5\323\264'\2\366\20M\0\227\4\74 a\273\314\327[\107\260[\367\233\07b+z\3\233\25\262$7\12\233M\260\17\3/#\340\0W\213\326I\24<\0h\177HSID\1\340\15x\331\220\202\342\355\353\20!\313I\272\370X\305\1\342c\2623\10\231\2602|C\214\24\302^}\215S\1\271\1CA\202\212\23"|u\0;\200\31\202N`\332\25\210\267\3\340\10*\5\241\11\128\59\327\2520\202\216vo\17\271-e?\242\242\264=\215\26\211\251(\20\274\35 \223\1\224<\265\1\304u\377\200\24\6\25=\200X\20\3479\242U>\2\201\34\0g\307"\240\7\25\342\16(h\311\263\254\221\17Q\13\5\300\23zro\33\242\362\364;x\4,\377\3\24;V\10IT\23\212|\313\7\34\325\254b\265\252\4\324\214\325\5\32t\364\220/\250\11\177\373\370\207j\11Q-\30\212\210;\250\3\227\200\224Y\202'Do\320\4\215M\370\346\200`\301\11\350!\10\313#\17\253\252\27{\224q\230\13"X\4I\17\244\243\200\16\105\32E\22"7\266\24T\263c\33}\351\24q\314\270\2\0\234\20\17\377\314\20\275\2>MHu\15U\205"\366\375Y8\353=\276\16\304<\263 \0\304\353&\250\221\37*h\25\365\205\4\220\0|Ew*\12j\2\267\252\267\255\242G\334\376uG\307Z\1\3\2bd\236,\313\262l\5\14\14\20\20\24\262,\313\262\24\30\30  \313\262,\313$$((,,\24\233\0b\327\361\202PA\214\355T\0\253S\17\365\210fQ\277K\242#Z\2\213\321\3\352\11\324\243\245v`\354\14\3", 10240, 0x0, 0, ... {status=0x0, info=10240}, ) |u\0;\200\31\202N`\332\25\210\267\3\340\10*\5\241\11\128\59\327\2520\202\216vo\17\271-e?\242\242\264=\215\26\211\251(\20\274\35 \223\1\224<\265\1\304u\377\200\24\6\25=\200X\20\3479\242U>\2\201\34\0g\307 (108, 0, 0, 0, "x`.\230KNo\374\27\362/{K\23HSplitV\254\341,!_M\4iP\371b\177Y\207SQLWa(c\4\205\200\205\5\323\264'\2\366\20M\0\227\4\74 a\273\314\327[\107\260[\367\233\07b+z\3\233\25\262$7\12\233M\260\17\3/#\340\0W\213\326I\24<\0h\177HSID\1\340\15x\331\220\202\342\355\353\20!\313I\272\370X\305\1\342c\2623\10\231\2602|C\214\24\302^}\215S\1\271\1CA\202\212\23"|u\0;\200\31\202N`\332\25\210\267\3\340\10*\5\241\11\128\59\327\2520\202\216vo\17\271-e?\242\242\264=\215\26\211\251(\20\274\35 \223\1\224<\265\1\304u\377\200\24\6\25=\200X\20\3479\242U>\2\201\34\0g\307"\240\7\25\342\16(h\311\263\254\221\17Q\13\5\300\23zro\33\242\362\364;x\4,\377\3\24;V\10IT\23\212|\313\7\34\325\254b\265\252\4\324\214\325\5\32t\364\220/\250\11\177\373\370\207j\11Q-\30\212\210;\250\3\227\200\224Y\202'Do\320\4\215M\370\346\200`\301\11\350!\10\313#\17\253\252\27{\224q\230\13"X\4I\17\244\243\200\16\105\32E\22"7\266\24T\263c\33}\351\24q\314\270\2\0\234\20\17\377\314\20\275\2>MHu\15U\205"\366\375Y8\353=\276\16\304<\263 \0\304\353&\250\221\37*h\25\365\205\4\220\0|Ew*\12j\2\267\252\267\255\242G\334\376uG\307Z\1\3\2bd\236,\313\262l\5\14\14\20\20\24\262,\313\262\24\30\30  \313\262,\313$$((,,\24\233\0b\327\361\202PA\214\355T\0\253S\17\365\210fQ\277K\242#Z\2\213\321\3\352\11\324\243\245v`\354\14\3", 10240, 0x0, 0, ... {status=0x0, info=10240}, ) X\4I\17\244\243\200\16\105\32E\22 (108, 0, 0, 0, "x`.\230KNo\374\27\362/{K\23HSplitV\254\341,!_M\4iP\371b\177Y\207SQLWa(c\4\205\200\205\5\323\264'\2\366\20M\0\227\4\74 a\273\314\327[\107\260[\367\233\07b+z\3\233\25\262$7\12\233M\260\17\3/#\340\0W\213\326I\24<\0h\177HSID\1\340\15x\331\220\202\342\355\353\20!\313I\272\370X\305\1\342c\2623\10\231\2602|C\214\24\302^}\215S\1\271\1CA\202\212\23"|u\0;\200\31\202N`\332\25\210\267\3\340\10*\5\241\11\128\59\327\2520\202\216vo\17\271-e?\242\242\264=\215\26\211\251(\20\274\35 \223\1\224<\265\1\304u\377\200\24\6\25=\200X\20\3479\242U>\2\201\34\0g\307"\240\7\25\342\16(h\311\263\254\221\17Q\13\5\300\23zro\33\242\362\364;x\4,\377\3\24;V\10IT\23\212|\313\7\34\325\254b\265\252\4\324\214\325\5\32t\364\220/\250\11\177\373\370\207j\11Q-\30\212\210;\250\3\227\200\224Y\202'Do\320\4\215M\370\346\200`\301\11\350!\10\313#\17\253\252\27{\224q\230\13"X\4I\17\244\243\200\16\105\32E\22"7\266\24T\263c\33}\351\24q\314\270\2\0\234\20\17\377\314\20\275\2>MHu\15U\205"\366\375Y8\353=\276\16\304<\263 \0\304\353&\250\221\37*h\25\365\205\4\220\0|Ew*\12j\2\267\252\267\255\242G\334\376uG\307Z\1\3\2bd\236,\313\262l\5\14\14\20\20\24\262,\313\262\24\30\30  \313\262,\313$$((,,\24\233\0b\327\361\202PA\214\355T\0\253S\17\365\210fQ\277K\242#Z\2\213\321\3\352\11\324\243\245v`\354\14\3", 10240, 0x0, 0, ... {status=0x0, info=10240}, ) \366\375Y8\353=\276\16\304<\263 \0\304\353&\250\221\37*h\25\365\205\4\220\0|Ew*\12j\2\267\252\267\255\242G\334\376uG\307Z\1\3\2bd\236,\313\262l\5\14\14\20\20\24\262,\313\262\24\30\30  \313\262,\313$$((,,\24\233\0b\327\361\202PA\214\355T\0\253S\17\365\210fQ\277K\242#Z\2\213\321\3\352\11\324\243\245v`\354\14\3", 10240, 0x0, 0, ... {status=0x0, info=10240}, ) == 0x0
 00710  1036   NtReadFile  (104, 0, 0, 0, 10240, 0x0, 0, ... {status=0x0, info=10240},  (104, 0, 0, 0, 10240, 0x0, 0, ... {status=0x0, info=10240}, "\312\207\361oZB/1\4\213>\314\3034-\32\260\26_'\14M\232P\303\310\316\354\360\32j\36\208g>\252\276,\234=iR\1\333\337r i42\360\356g\304\17\225,\224~\377{\245l\206\30\327P\224|0\212\0\252w\25#\374\4P\216\23\351\16\316a<\216P)+\4|CF\203\312`\231\322CH=0\374\35|\303\34618\21g.\213\232\220\276\0\363\376U6\317\35\352H\241\245# \212\220\344\25NR\204d\244  \325\271\262\312Y\327b\256C\321Y=\4\332+\224`\255S\376\303\271\214%\311\12\15\216h{l+j\27\321p*h\212I~\0\24V\313$\311\316\265\1\15\220\312z\36{5\200\230d\2339\315h\336%\362\220\332\200\253q\232\344\10|\321\276\355\25\364\30\22\237\322o\316\24{\306aoE\3152\263H\216L\307\332\7k\5\203\212cE.\230\203I\24Ih&`\0\7\353#\326\30\264\206\30\277\3574\263\267\346\22 \263t\333\207c5\372\367%\304\232~\177\221\300\376\26\214\3\327k6$\361,F\24\250z'\177\3182\11\34\215\311\336y\310\272\\7$\2215\216L\245\220-u&5[N\354\251e\326\360?[K"E\242q|P2&Iu*g\5\271ab|\242\326\312\276\200c4\321\2\336\10)\13\366:\317='\275\214\375U1\270\246X\365\246\14", ) j\27\321p*h\212I~\0\24V\313$\311\316\265\1\15\220\312z\36{5\200\230d\2339\315h\336%\362\220\332\200\253q\232\344\10|\321\276\355\25\364\30\22\237\322o\316\24{\306aoE\3152\263H\216L\307\332\7k\5\203\212cE.\230\203I\24Ih&`\0\7\353#\326\30\264\206\30\277\3574\263\267\346\22 \263t\333\207c5\372\367%\304\232~\177\221\300\376\26\214\3\327k6$\361,F\24\250z'\177\3182\11\34\215\311\336y\310\272\\7$\2215\216L\245\220-u&5[N\354\251e\326\360?[K (104, 0, 0, 0, 10240, 0x0, 0, ... {status=0x0, info=10240}, "\312\207\361oZB/1\4\213>\314\3034-\32\260\26_'\14M\232P\303\310\316\354\360\32j\36\208g>\252\276,\234=iR\1\333\337r i42\360\356g\304\17\225,\224~\377{\245l\206\30\327P\224|0\212\0\252w\25#\374\4P\216\23\351\16\316a<\216P)+\4|CF\203\312`\231\322CH=0\374\35|\303\34618\21g.\213\232\220\276\0\363\376U6\317\35\352H\241\245# \212\220\344\25NR\204d\244  \325\271\262\312Y\327b\256C\321Y=\4\332+\224`\255S\376\303\271\214%\311\12\15\216h{l+j\27\321p*h\212I~\0\24V\313$\311\316\265\1\15\220\312z\36{5\200\230d\2339\315h\336%\362\220\332\200\253q\232\344\10|\321\276\355\25\364\30\22\237\322o\316\24{\306aoE\3152\263H\216L\307\332\7k\5\203\212cE.\230\203I\24Ih&`\0\7\353#\326\30\264\206\30\277\3574\263\267\346\22 \263t\333\207c5\372\367%\304\232~\177\221\300\376\26\214\3\327k6$\361,F\24\250z'\177\3182\11\34\215\311\336y\310\272\\7$\2215\216L\245\220-u&5[N\354\251e\326\360?[K"E\242q|P2&Iu*g\5\271ab|\242\326\312\276\200c4\321\2\336\10)\13\366:\317='\275\214\375U1\270\246X\365\246\14", ) , ) == 0x0
 00711  1036   NtWriteFile  (108, 0, 0, 0,  (108, 0, 0, 0, "\25\347\317o\205"\211\333\353\0\314\34T\23\32ova'\323-\244P\34\250\360\354/zT\36\317XY>u\336\22\234\342\11l\1\4\277L \266T\14\3601\7\372\17JL\252~ \33\233lYx\351PK\34\16\212\337\312I\25\374\234:PQs\327\16\21\1\2\216\217I\25\4\243#x\203\25\0\247\322\234(\30#c\13|\34\206\178\316\7\20\213E\360\200\0,\236k6\20}\324H~\305\35 U\360\332\25\2212\272d{@\36\325f\322\364Y\10\2\220C\169\3\4\5K\252`r3\300\303f\354\33\311\325m\260h\244\14\25<\222U\336\222\342\20\30I\333\316v\11\200\301*\336m\242\245_\260\30 \206\14HD\3\210\311\13\211V9\326\23CzR1\220\211M\354\313x\354\205\320\223\210\\326\32G`D\357\11\33\222R\350\2240\354En\333 \1\7~{\321L\1nz\2701\344\27qbDKw\325\210L\31\40\37\364  \200\374\2\327\25H\301\342\262\322BT\27\16\20\24hU)@\0\3136\365$\26\256\213\1\322\360\364z\301\33\13\200G\4\2459\22\10\340%-\360\344\200t\21\244\344\327\34$1a\215+\364\307r\241\322\260\256*{\31\1QE\22R\215HQ,\371\332\330\13;\203U\3{.G\343w\24\226\10\30`\337g\325#\11x\212\206\307\337\3214l\327\330\22\377\323J\333X\3\13\372(E\372\232\241\37\257\300!v\262\3\10\13\10$.Lx\24w\32\31\177\306X\14\11\303\355\367\336\246\250\204\\330D\2575Q,\233\220\362\25\305\204.\322\251\272\266\316?\204+\34E}\21BP\355Fwu\365\7;\271\276\2B\242\11\252\200\200\274T\357\2\1h\27\13)Z\361=\370\335\262\375\212Q\206\246\207\225\230\14", 10240, 0x0, 0, ... {status=0x0, info=10240}, ) \211\333\353\0\314\34T\23\32ova'\323-\244P\34\250\360\354/zT\36\317XY>u\336\22\234\342\11l\1\4\277L \266T\14\3601\7\372\17JL\252~ \33\233lYx\351PK\34\16\212\337\312I\25\374\234:PQs\327\16\21\1\2\216\217I\25\4\243#x\203\25\0\247\322\234(\30#c\13|\34\206\178\316\7\20\213E\360\200\0,\236k6\20}\324H~\305\35 U\360\332\25\2212\272d{@\36\325f\322\364Y\10\2\220C\169\3\4\5K\252`r3\300\303f\354\33\311\325m\260h\244\14\25<\222U\336\222\342\20\30I\333\316v\11\200\301*\336m\242\245_\260\30 \206\14HD\3\210\311\13\211V9\326\23CzR1\220\211M\354\313x\354\205\320\223\210\\326\32G`D\357\11\33\222R\350\2240\354En\333 \1\7~{\321L\1nz\2701\344\27qbDKw\325\210L\31\40\37\364  \200\374\2\327\25H\301\342\262\322BT\27\16\20\24hU)@\0\3136\365$\26\256\213\1\322\360\364z\301\33\13\200G\4\2459\22\10\340%-\360\344\200t\21\244\344\327\34$1a\215+\364\307r\241\322\260\256*{\31\1QE\22R\215HQ,\371\332\330\13;\203U\3{.G\343w\24\226\10\30`\337g\325#\11x\212\206\307\337\3214l\327\330\22\377\323J\333X\3\13\372(E\372\232\241\37\257\300!v\262\3\10\13\10$.Lx\24w\32\31\177\306X\14\11\303\355\367\336\246\250\204\\330D\2575Q,\233\220\362\25\305\204.\322\251\272\266\316?\204+\34E}\21BP\355Fwu\365\7;\271\276\2B\242\11\252\200\200\274T\357\2\1h\27\13)Z\361=\370\335\262\375\212Q\206\246\207\225\230\14", 10240, 0x0, 0, ... {status=0x0, info=10240}, ) == 0x0
 00712  1036   NtReadFile  (104, 0, 0, 0, 10240, 0x0, 0, ... {status=0x0, info=10240},  (104, 0, 0, 0, 10240, 0x0, 0, ... {status=0x0, info=10240}, "\336\301\301N{\2656\22\200}Z\262\3\344\25q\364!'\367WW;4}\355\274:P.\214C\261\14g\205\241@\15\31\372*\22\13tf\276\1F \200&\370a<\20\217\16_\315\33\23q6W\3476\3704f\4\7d\225n\201\262c\337\367\345b\245\315\213\21K\32\266\322\254\254\215:"\254\236\347\351/KLNx^\275)\367\215}\20\14m$\212\254\223f\15\204n\12w\23\27\256e\251\1\310\30\3301\350}\20)X\317E\257\345\361\300\267\231\264\276ia\24 Vk"F\334\330\303\11\250 \371F\233~\336?C\374\313m1S\36&\327efs\323\32\265\300\327X&*=>ZVD~\357\352\35^}\270\302\0\325F\361\254+\32\355x2\320\363\340r\204\376\337S\23\340r\37\236\34\222\360\304ku \375"\246\33\253L\245[\347\15\236 \21e*\24?%\372\262\307xMK\370\253\350\257\323l2\30\335t]\74\366\5u\325h\263_\313\207(\212R\25\223\211\270\234y\327\230\312\310\276\277WZ\353\310\252-\30\301x\274\220B\242\301/\344\244\20\312)\322O\237\330\250\252pu\265D\307\352d\31\207\315K\346\204W\366\213\236l0\33\325\34\345Y\254\327|\2\225x-\10\1770\211QmL\345\22\264A*\14\307xC\266\7\222\30\362\333vP\327$\22a\23m\276[(5\363\22\374:u\270\246Z\320\12\305"\211\232\35\37\24[\344\326=~\226\234;\370\364\2,|\245\200\317\261\310B\312\307\337r5\222/\270\36\237\262\21\17\316\235bK9\337!\362\326v4\25\204\354c\2251o\200\260\341\3371\371Z\236\\306\200b\224^\366\365\356~ \355o\261\370 t\313\222\321\240\372\3\255x\5\306\37\14\251m\306\276\268\322\260\367N", ) \254\236\347\351/KLNx^\275)\367\215}\20\14m$\212\254\223f\15\204n\12w\23\27\256e\251\1\310\30\3301\350}\20)X\317E\257\345\361\300\267\231\264\276ia\24 Vk (104, 0, 0, 0, 10240, 0x0, 0, ... {status=0x0, info=10240}, "\336\301\301N{\2656\22\200}Z\262\3\344\25q\364!'\367WW;4}\355\274:P.\214C\261\14g\205\241@\15\31\372*\22\13tf\276\1F \200&\370a<\20\217\16_\315\33\23q6W\3476\3704f\4\7d\225n\201\262c\337\367\345b\245\315\213\21K\32\266\322\254\254\215:"\254\236\347\351/KLNx^\275)\367\215}\20\14m$\212\254\223f\15\204n\12w\23\27\256e\251\1\310\30\3301\350}\20)X\317E\257\345\361\300\267\231\264\276ia\24 Vk"F\334\330\303\11\250 \371F\233~\336?C\374\313m1S\36&\327efs\323\32\265\300\327X&*=>ZVD~\357\352\35^}\270\302\0\325F\361\254+\32\355x2\320\363\340r\204\376\337S\23\340r\37\236\34\222\360\304ku \375"\246\33\253L\245[\347\15\236 \21e*\24?%\372\262\307xMK\370\253\350\257\323l2\30\335t]\74\366\5u\325h\263_\313\207(\212R\25\223\211\270\234y\327\230\312\310\276\277WZ\353\310\252-\30\301x\274\220B\242\301/\344\244\20\312)\322O\237\330\250\252pu\265D\307\352d\31\207\315K\346\204W\366\213\236l0\33\325\34\345Y\254\327|\2\225x-\10\1770\211QmL\345\22\264A*\14\307xC\266\7\222\30\362\333vP\327$\22a\23m\276[(5\363\22\374:u\270\246Z\320\12\305"\211\232\35\37\24[\344\326=~\226\234;\370\364\2,|\245\200\317\261\310B\312\307\337r5\222/\270\36\237\262\21\17\316\235bK9\337!\362\326v4\25\204\354c\2251o\200\260\341\3371\371Z\236\\306\200b\224^\366\365\356~ \355o\261\370 t\313\222\321\240\372\3\255x\5\306\37\14\251m\306\276\268\322\260\367N", ) \246\33\253L\245[\347\15\236 \21e*\24?%\372\262\307xMK\370\253\350\257\323l2\30\335t]\74\366\5u\325h\263_\313\207(\212R\25\223\211\270\234y\327\230\312\310\276\277WZ\353\310\252-\30\301x\274\220B\242\301/\344\244\20\312)\322O\237\330\250\252pu\265D\307\352d\31\207\315K\346\204W\366\213\236l0\33\325\34\345Y\254\327|\2\225x-\10\1770\211QmL\345\22\264A*\14\307xC\266\7\222\30\362\333vP\327$\22a\23m\276[(5\363\22\374:u\270\246Z\320\12\305 (104, 0, 0, 0, 10240, 0x0, 0, ... {status=0x0, info=10240}, "\336\301\301N{\2656\22\200}Z\262\3\344\25q\364!'\367WW;4}\355\274:P.\214C\261\14g\205\241@\15\31\372*\22\13tf\276\1F \200&\370a<\20\217\16_\315\33\23q6W\3476\3704f\4\7d\225n\201\262c\337\367\345b\245\315\213\21K\32\266\322\254\254\215:"\254\236\347\351/KLNx^\275)\367\215}\20\14m$\212\254\223f\15\204n\12w\23\27\256e\251\1\310\30\3301\350}\20)X\317E\257\345\361\300\267\231\264\276ia\24 Vk"F\334\330\303\11\250 \371F\233~\336?C\374\313m1S\36&\327efs\323\32\265\300\327X&*=>ZVD~\357\352\35^}\270\302\0\325F\361\254+\32\355x2\320\363\340r\204\376\337S\23\340r\37\236\34\222\360\304ku \375"\246\33\253L\245[\347\15\236 \21e*\24?%\372\262\307xMK\370\253\350\257\323l2\30\335t]\74\366\5u\325h\263_\313\207(\212R\25\223\211\270\234y\327\230\312\310\276\277WZ\353\310\252-\30\301x\274\220B\242\301/\344\244\20\312)\322O\237\330\250\252pu\265D\307\352d\31\207\315K\346\204W\366\213\236l0\33\325\34\345Y\254\327|\2\225x-\10\1770\211QmL\345\22\264A*\14\307xC\266\7\222\30\362\333vP\327$\22a\23m\276[(5\363\22\374:u\270\246Z\320\12\305"\211\232\35\37\24[\344\326=~\226\234;\370\364\2,|\245\200\317\261\310B\312\307\337r5\222/\270\36\237\262\21\17\316\235bK9\337!\362\326v4\25\204\354c\2251o\200\260\341\3371\371Z\236\\306\200b\224^\366\365\356~ \355o\261\370 t\313\222\321\240\372\3\255x\5\306\37\14\251m\306\276\268\322\260\367N", ) , ) == 0x0
 00713  1036   NtWriteFile  (108, 0, 0, 0,  (108, 0, 0, 0, "\1\241\377N\244\325\10\22_\35d\262\334\204+q+A\31\367\2107\54\242\215\202:\217N\262CnlY\205~ 3\31%J,\13\253\6\200\1\231@\276&'\1\2\20Pna\315\304sO6\210\207\10\370\353\6:\7\273\365P\201m\3\341\367:\2\233\315Tqu\32i\262\222\254RZ\34\254A\207\327/\224,px\201\335\27\367R\35.\14\262D\264\254L\63\204\261jI\23\310\316[\251\336\250&\330\356\210C\20\3668\361Ep\205\317\300h\371\212\276\266\1* \211\13\34F\3\270\375\11w@\307FD\36\340?\234\234\365m\3563 &\10\5Xs\14z\213\300\108\30*\342^dV\233\36\321\352\302>C\270\35`\353F.\314\25\322\30\14\320,\200L\204!\277m\2\354\200L\37A|\254\360\33\13K "B\230\33t,\233[8m\240 \316\5\24\24\340E\304\262\30\30sK'\313\326\257\14\14\14\30\2\24c\7\353\226;u\12\10\215_\24\347\26\212\215u\255\211g\374G\327G\252\366\276`7d\353\27\312\23\30\36\30\202\220\235t\14\301\360\204\232\20\25I\354O@\270\226\252\257\25\213D\30\212Z\31X\255u\346[7\310\213A\14\16\33\12|\333Ys\267B\2J\30\23\10\240P\267Q\262,\333\22k!\24\14\30\30}\266\330r\14\30-\273HP\10D,a\314\15\200[\367U\315\22#ZK\270y:\356\12\32B\267\232\302\177*[;\266\3~I\374\5\370+b\22|z\340\361\261\27"\364\307\0\22\13\222\360\330 \237mq1\316B\2u9\0A\314\326\251T+\2043\3\2531\260\340\216\341\0Q\307ZA<\370\200\275\364`\366*\216@ 2\17\217\370\377\24\365\222\16\300\304\3r\30;\306\300l\227m\31\336(8\15\320\311N", 10240, 0x0, 0, ... {status=0x0, info=10240}, ) B\230\33t,\233[8m\240 \316\5\24\24\340E\304\262\30\30sK'\313\326\257\14\14\14\30\2\24c\7\353\226;u\12\10\215_\24\347\26\212\215u\255\211g\374G\327G\252\366\276`7d\353\27\312\23\30\36\30\202\220\235t\14\301\360\204\232\20\25I\354O@\270\226\252\257\25\213D\30\212Z\31X\255u\346[7\310\213A\14\16\33\12|\333Ys\267B\2J\30\23\10\240P\267Q\262,\333\22k!\24\14\30\30}\266\330r\14\30-\273HP\10D,a\314\15\200[\367U\315\22#ZK\270y:\356\12\32B\267\232\302\177*[;\266\3~I\374\5\370+b\22|z\340\361\261\27 (108, 0, 0, 0, "\1\241\377N\244\325\10\22_\35d\262\334\204+q+A\31\367\2107\54\242\215\202:\217N\262CnlY\205~ 3\31%J,\13\253\6\200\1\231@\276&'\1\2\20Pna\315\304sO6\210\207\10\370\353\6:\7\273\365P\201m\3\341\367:\2\233\315Tqu\32i\262\222\254RZ\34\254A\207\327/\224,px\201\335\27\367R\35.\14\262D\264\254L\63\204\261jI\23\310\316[\251\336\250&\330\356\210C\20\3668\361Ep\205\317\300h\371\212\276\266\1* \211\13\34F\3\270\375\11w@\307FD\36\340?\234\234\365m\3563 &\10\5Xs\14z\213\300\108\30*\342^dV\233\36\321\352\302>C\270\35`\353F.\314\25\322\30\14\320,\200L\204!\277m\2\354\200L\37A|\254\360\33\13K "B\230\33t,\233[8m\240 \316\5\24\24\340E\304\262\30\30sK'\313\326\257\14\14\14\30\2\24c\7\353\226;u\12\10\215_\24\347\26\212\215u\255\211g\374G\327G\252\366\276`7d\353\27\312\23\30\36\30\202\220\235t\14\301\360\204\232\20\25I\354O@\270\226\252\257\25\213D\30\212Z\31X\255u\346[7\310\213A\14\16\33\12|\333Ys\267B\2J\30\23\10\240P\267Q\262,\333\22k!\24\14\30\30}\266\330r\14\30-\273HP\10D,a\314\15\200[\367U\315\22#ZK\270y:\356\12\32B\267\232\302\177*[;\266\3~I\374\5\370+b\22|z\340\361\261\27"\364\307\0\22\13\222\360\330 \237mq1\316B\2u9\0A\314\326\251T+\2043\3\2531\260\340\216\341\0Q\307ZA<\370\200\275\364`\366*\216@ 2\17\217\370\377\24\365\222\16\300\304\3r\30;\306\300l\227m\31\336(8\15\320\311N", 10240, 0x0, 0, ... {status=0x0, info=10240}, ) , 10240, 0x0, 0, ... {status=0x0, info=10240}, ) == 0x0
 00714  1036   NtReadFile  (104, 0, 0, 0, 10240, 0x0, 0, ... {status=0x0, info=10240},  (104, 0, 0, 0, 10240, 0x0, 0, ... {status=0x0, info=10240}, "\265d\314\30\241\216\275\332\236\300\352|Wo\215\237\21\2[\2047\200\375{Tl{\332\265\370\3650Y\261\7\35\316\367\336D\314\357\362]_\267ZD\367\367@"\177\33K\15\255a@\34\211\376w\217y\315\306\226\312M\271f\202\254\372\353\257z\247\14\317i5\25\23e\2128\300\241Z\333\221\270A\360\321bj\5\34\355\21\370\362\267=\11u)M\267u\255j\23\300F}\271\31\340dQ/v]\275N\34\274\233V\204\4\234\223\22\2727\327\210\262\341\222\342\256\343\342\233\2773\313Qe\244\26\352<\216a\360\12\262\361\350\206\1\35\341\305W\325na\343\241i\371\20\327\213\3550\335X\277mku\330\216\361\222\257\217XM<~\332\353;\340i<\257\3113\366\217\30\224v\252\13#\224\276\3\315\275\25\336\253\263\27\221I4;D\375\230\17!_\341%\234\316\265v\26\260d\205\235^n\257\35\6\4\266KI\34\322\250\247q7EN\220"\330$\362L\263\3\3\311\31\2229k\211#\227\24*!\312\37\3"\374\377L\313\1\335|\320d:\373O\2501\267\26r\266!k\202\15\5=\2628\32\364J!b\300|e\30\3265c\364V\20C\254U\345C\10\271\341\364\265\35;\276\16\31-*\243}H\10\257\35cd\373\2t\365/&\26D\244\326\243\353\350\347\3518\347\351F\344;\252Hy\242D\6\364[%l\24kw\204\222\377\340\225\4\27\2}`.\264\300\0\201jz\211=\360\13\375\333FP3\240\260E\14\375a\312\256\311\3177s\327K\311a\342\2038\310[\360\302.y=\307.4*\217\237L?s\323f\236\350\376\341\375fG\274b\276"iJ\14\271\237\367\44p\267P\324a8\3\217J\177=\216o~S\227A\271\214l\363\206D\336G\37\353", ) \177\33K\15\255a@\34\211\376w\217y\315\306\226\312M\271f\202\254\372\353\257z\247\14\317i5\25\23e\2128\300\241Z\333\221\270A\360\321bj\5\34\355\21\370\362\267=\11u)M\267u\255j\23\300F}\271\31\340dQ/v]\275N\34\274\233V\204\4\234\223\22\2727\327\210\262\341\222\342\256\343\342\233\2773\313Qe\244\26\352<\216a\360\12\262\361\350\206\1\35\341\305W\325na\343\241i\371\20\327\213\3550\335X\277mku\330\216\361\222\257\217XM<~\332\353;\340i<\257\3113\366\217\30\224v\252\13#\224\276\3\315\275\25\336\253\263\27\221I4;D\375\230\17!_\341%\234\316\265v\26\260d\205\235^n\257\35\6\4\266KI\34\322\250\247q7EN\220 (104, 0, 0, 0, 10240, 0x0, 0, ... {status=0x0, info=10240}, "\265d\314\30\241\216\275\332\236\300\352|Wo\215\237\21\2[\2047\200\375{Tl{\332\265\370\3650Y\261\7\35\316\367\336D\314\357\362]_\267ZD\367\367@"\177\33K\15\255a@\34\211\376w\217y\315\306\226\312M\271f\202\254\372\353\257z\247\14\317i5\25\23e\2128\300\241Z\333\221\270A\360\321bj\5\34\355\21\370\362\267=\11u)M\267u\255j\23\300F}\271\31\340dQ/v]\275N\34\274\233V\204\4\234\223\22\2727\327\210\262\341\222\342\256\343\342\233\2773\313Qe\244\26\352<\216a\360\12\262\361\350\206\1\35\341\305W\325na\343\241i\371\20\327\213\3550\335X\277mku\330\216\361\222\257\217XM<~\332\353;\340i<\257\3113\366\217\30\224v\252\13#\224\276\3\315\275\25\336\253\263\27\221I4;D\375\230\17!_\341%\234\316\265v\26\260d\205\235^n\257\35\6\4\266KI\34\322\250\247q7EN\220"\330$\362L\263\3\3\311\31\2229k\211#\227\24*!\312\37\3"\374\377L\313\1\335|\320d:\373O\2501\267\26r\266!k\202\15\5=\2628\32\364J!b\300|e\30\3265c\364V\20C\254U\345C\10\271\341\364\265\35;\276\16\31-*\243}H\10\257\35cd\373\2t\365/&\26D\244\326\243\353\350\347\3518\347\351F\344;\252Hy\242D\6\364[%l\24kw\204\222\377\340\225\4\27\2}`.\264\300\0\201jz\211=\360\13\375\333FP3\240\260E\14\375a\312\256\311\3177s\327K\311a\342\2038\310[\360\302.y=\307.4*\217\237L?s\323f\236\350\376\341\375fG\274b\276"iJ\14\271\237\367\44p\267P\324a8\3\217J\177=\216o~S\227A\271\214l\363\206D\336G\37\353", ) \374\377L\313\1\335|\320d:\373O\2501\267\26r\266!k\202\15\5=\2628\32\364J!b\300|e\30\3265c\364V\20C\254U\345C\10\271\341\364\265\35;\276\16\31-*\243}H\10\257\35cd\373\2t\365/&\26D\244\326\243\353\350\347\3518\347\351F\344;\252Hy\242D\6\364[%l\24kw\204\222\377\340\225\4\27\2}`.\264\300\0\201jz\211=\360\13\375\333FP3\240\260E\14\375a\312\256\311\3177s\327K\311a\342\2038\310[\360\302.y=\307.4*\217\237L?s\323f\236\350\376\341\375fG\274b\276 (104, 0, 0, 0, 10240, 0x0, 0, ... {status=0x0, info=10240}, "\265d\314\30\241\216\275\332\236\300\352|Wo\215\237\21\2[\2047\200\375{Tl{\332\265\370\3650Y\261\7\35\316\367\336D\314\357\362]_\267ZD\367\367@"\177\33K\15\255a@\34\211\376w\217y\315\306\226\312M\271f\202\254\372\353\257z\247\14\317i5\25\23e\2128\300\241Z\333\221\270A\360\321bj\5\34\355\21\370\362\267=\11u)M\267u\255j\23\300F}\271\31\340dQ/v]\275N\34\274\233V\204\4\234\223\22\2727\327\210\262\341\222\342\256\343\342\233\2773\313Qe\244\26\352<\216a\360\12\262\361\350\206\1\35\341\305W\325na\343\241i\371\20\327\213\3550\335X\277mku\330\216\361\222\257\217XM<~\332\353;\340i<\257\3113\366\217\30\224v\252\13#\224\276\3\315\275\25\336\253\263\27\221I4;D\375\230\17!_\341%\234\316\265v\26\260d\205\235^n\257\35\6\4\266KI\34\322\250\247q7EN\220"\330$\362L\263\3\3\311\31\2229k\211#\227\24*!\312\37\3"\374\377L\313\1\335|\320d:\373O\2501\267\26r\266!k\202\15\5=\2628\32\364J!b\300|e\30\3265c\364V\20C\254U\345C\10\271\341\364\265\35;\276\16\31-*\243}H\10\257\35cd\373\2t\365/&\26D\244\326\243\353\350\347\3518\347\351F\344;\252Hy\242D\6\364[%l\24kw\204\222\377\340\225\4\27\2}`.\264\300\0\201jz\211=\360\13\375\333FP3\240\260E\14\375a\312\256\311\3177s\327K\311a\342\2038\310[\360\302.y=\307.4*\217\237L?s\323f\236\350\376\341\375fG\274b\276"iJ\14\271\237\367\44p\267P\324a8\3\217J\177=\216o~S\227A\271\214l\363\206D\336G\37\353", ) , ) == 0x0
 00715  1036   NtWriteFile  (108, 0, 0, 0,  (108, 0, 0, 0, "j\4\362\30~\356\203\332A\240\324|\210\17\263\237\316be\204\350\340\303{\213\14E\332j\230\3130\206\3219\35\21\227\340D\23\217\314]\200\327dD(\227~"\240{u\15r\1~\34V\236I\217\246\255\370\226\25-\207f]\314\304\353p\32\231\14\20\11\13\25\314\5\2648\37\301d\333N\330\177\360\16\2T\5\303\215/\370-\327\3\11\252Is\267\252\315T\23\37&C\271\306\200ZQ\360\26c\275\221|\202\233\211\344:\234Lr\2047\10\350\214\341M\202\220\343=\373\2013\241[\244\311\212\2\216\276\2204\262.\210\270\1\302\201\373W\12\16_\343~\11\307\20\10\353\3230\28\201m\264\25\346\216.\362\221\217\207-\2~\5\213\5\340\266\\221\311\354\226\261\30K\26\224\13\374\364\200\3\22\335+\336t\323)\221\226T\5D"\3701!\200\201\33\234\21\325H\26o\4\273\235\201\16\221\35\331d\210K\226|\354\250x\21\11E\221\360\34\330\373\222r\263\334c\367\31MYU\211\374\367**\376\252!\3\375\234\301L\24a\343|\17\4\4\373\220\310\17\267\311\22\210!\264\3423\5\342\322\6\32+*\37b\37\34[\30\11U]\364\211p}\254\212\205}\10f\201\312\265\302[\200\16\306M\24\243\242(6\25\350}]d$bJ\365\360F(D{\266\235\3537\207\32788\211x\344\344\312vy}$8\364\204ER\24\264\27\272\222 \200\253\4\310bC`\361\324\376\0^\12D\211\342\2205\375\4&n3\177\320{\14"\1\364\256\26\257\11s\10+\367a\303R\2758\27;\316\302\361\31\3\307\361T\24\217@,\1s\14\6\240\350!\201\303f\230\334\\276\375\11t\14f\377\311\4\353\20\211P\13\1\6\3P*A=Q\17@SH!\207\214\263\223\270D\1'!\353", 10240, 0x0, 0, ... {status=0x0, info=10240}, ) \240{u\15r\1~\34V\236I\217\246\255\370\226\25-\207f]\314\304\353p\32\231\14\20\11\13\25\314\5\2648\37\301d\333N\330\177\360\16\2T\5\303\215/\370-\327\3\11\252Is\267\252\315T\23\37&C\271\306\200ZQ\360\26c\275\221|\202\233\211\344:\234Lr\2047\10\350\214\341M\202\220\343=\373\2013\241[\244\311\212\2\216\276\2204\262.\210\270\1\302\201\373W\12\16_\343~\11\307\20\10\353\3230\28\201m\264\25\346\216.\362\221\217\207-\2~\5\213\5\340\266\\221\311\354\226\261\30K\26\224\13\374\364\200\3\22\335+\336t\323)\221\226T\5D (108, 0, 0, 0, "j\4\362\30~\356\203\332A\240\324|\210\17\263\237\316be\204\350\340\303{\213\14E\332j\230\3130\206\3219\35\21\227\340D\23\217\314]\200\327dD(\227~"\240{u\15r\1~\34V\236I\217\246\255\370\226\25-\207f]\314\304\353p\32\231\14\20\11\13\25\314\5\2648\37\301d\333N\330\177\360\16\2T\5\303\215/\370-\327\3\11\252Is\267\252\315T\23\37&C\271\306\200ZQ\360\26c\275\221|\202\233\211\344:\234Lr\2047\10\350\214\341M\202\220\343=\373\2013\241[\244\311\212\2\216\276\2204\262.\210\270\1\302\201\373W\12\16_\343~\11\307\20\10\353\3230\28\201m\264\25\346\216.\362\221\217\207-\2~\5\213\5\340\266\\221\311\354\226\261\30K\26\224\13\374\364\200\3\22\335+\336t\323)\221\226T\5D"\3701!\200\201\33\234\21\325H\26o\4\273\235\201\16\221\35\331d\210K\226|\354\250x\21\11E\221\360\34\330\373\222r\263\334c\367\31MYU\211\374\367**\376\252!\3\375\234\301L\24a\343|\17\4\4\373\220\310\17\267\311\22\210!\264\3423\5\342\322\6\32+*\37b\37\34[\30\11U]\364\211p}\254\212\205}\10f\201\312\265\302[\200\16\306M\24\243\242(6\25\350}]d$bJ\365\360F(D{\266\235\3537\207\32788\211x\344\344\312vy}$8\364\204ER\24\264\27\272\222 \200\253\4\310bC`\361\324\376\0^\12D\211\342\2205\375\4&n3\177\320{\14"\1\364\256\26\257\11s\10+\367a\303R\2758\27;\316\302\361\31\3\307\361T\24\217@,\1s\14\6\240\350!\201\303f\230\334\\276\375\11t\14f\377\311\4\353\20\211P\13\1\6\3P*A=Q\17@SH!\207\214\263\223\270D\1'!\353", 10240, 0x0, 0, ... {status=0x0, info=10240}, ) \1\364\256\26\257\11s\10+\367a\303R\2758\27;\316\302\361\31\3\307\361T\24\217@,\1s\14\6\240\350!\201\303f\230\334\\276\375\11t\14f\377\311\4\353\20\211P\13\1\6\3P*A=Q\17@SH!\207\214\263\223\270D\1'!\353", 10240, 0x0, 0, ... {status=0x0, info=10240}, ) == 0x0
 00716  1036   NtReadFile  (104, 0, 0, 0, 10240, 0x0, 0, ... {status=0x0, info=10240},  (104, 0, 0, 0, 10240, 0x0, 0, ... {status=0x0, info=10240}, "\314G-\223\244Ib\15%\210A\3\320!\233\240\262\15\376+\346D\342?\226\332\23\335q\220\\215\202N\374\10$hK\323\353\255I\367\22G\35\3630#\3554\222~$$\3773\36w)\243xO}\264b\2734\255\210\306\313\230e\373\224Z\312\212\371\340\302+\241d\23u\3R\332\271B\326\350.w!x0\216\231\362\232j\3o^\214\352H\214\31\32\265-\204v\301[4\350\235\303 \36\266\12\31{B\14\206\274\301M\7\36U\245%\25\310\353\322\2373\261\34\204@\224!\354c\304\366\26C\301ku\21?\36\17}m~\236\212kkU\271\331\312K\353\301\3754\27\376;\344\25\217\2031\262\27\222\262M\265pk.ah\15Fv4v\322\305\250\30\303\2113%\371\363\14\323Op\3128\3433(\23\10i\237(\16\304\305\33\364\335]8u\375\6\311\240\255\371F\331\376/\35\253\201X\226\332\363\3\237\11\370CaLN\2673\211{@\4N\214?\266\240.MY\353<\336\332\241\306\20\242\211\313\2277M\341\370\6\201\3641\227\271\302\333\362\353T\13\0\306N\330\6\373\343\202D3\314\350\0\2CA\253i\344\2731\230\341u9\355E\3 \215!\202\373\373\264D\312\205\342\3007d\276\344\320\6;\3602\327\3440\357\201_\353\355\240\224\213;cC\10\246\301\330\340\202\222\274;\242l\5\4'\36\305\27\245rM'\351[=5\255E\370D\331`qx\322\236\337n \2079\22\346\27\323\353\300\6\371\245\356`_\13\260\320\211^`\362\32\31\377\300\317\333\344\300V\360\304\230X\3015\12\267\7\317\200\306\3W3<\303\236\251<\340rb\7\310\324\252C\201\204\361*\373\246gH\367\7\343\344\12_\315\16\12\271ks|'\226\5z\333\34!\277\321!\23!", ) , ) == 0x0
 00717  1036   NtWriteFile  (108, 0, 0, 0,  (108, 0, 0, 0, "\23'\23\223{)\\15\372\350\177\3\17A\245\240mm\300+9$\334?I\272-\335\256\360b\215].\302\10\373\10u\3234\315w\367\315'#\363\357C\3234M\36\32$ S w\366\303FO\242\324\\273\353\315\266\306\24\370[\373K:\364\212&\200\374+~\4-u\3342\344\271\235\266\326.\250AF0Q\371\314\232\265cQ^S\212v\214\306z\213-[\26\377[\353\210\243\303\377~\210\12\306\33|\14Y\334\377M\330~k\245\372u\366\353\15\377\15\261\303\344~\22\353A\322c\33\226(C\36\13K\21\340~1}\262\36\240\212\264\13k\271\6\252u\353\36\235\12\27![\332\25P\343\17\262\310\362\214Mj\20U.\276\103F\251TH\322\32\310&\303VS\33\371,l\355O\257\252\6\343\354H-\10\266\377\26\16\33\245%\364\2=\6u"f\367\240\312U\307F\6\236\21\35t\341f\226\5~\15\3@i\306C\276,p\267\354\351E@\333.\262?i\300\20M\206\213\2\336\5\301\370\20}\351\365\227\350-\337\370\331\341\3121H\331\374\333-\213j\13\337\246p\330\331\233\335\202\233S\362\350\337b}At\11\332\273\356\370\337u\346\215{\3\377\355\37\202$\233\212D\25\345\334\300\350\4\200\344\17f\5\360\355\267\33200\341a\3532\300\252\213\344\3}\10y\241\346\340]\362\202;}\14;\4\370~\373\27z\22s'6;\35r%\306D\6\0Ox\15\376\341n\377\347\7\229w\355\353\37f\307\2451\0a\13o\260\267^\277\222$\31 \240\361\333;\240h\360\33\370f\301\352j\211\7\20\340\370\3\210S\2\303A\311\2\340\255\29\310\13\312}\201[\221\24\373y\7v\367\330\203\332\12\200\2550\12f\13M|\370\366;z\4|\37\277\16A-!", 10240, 0x0, 0, ... {status=0x0, info=10240}, ) f\367\240\312U\307F\6\236\21\35t\341f\226\5~\15\3@i\306C\276,p\267\354\351E@\333.\262?i\300\20M\206\213\2\336\5\301\370\20}\351\365\227\350-\337\370\331\341\3121H\331\374\333-\213j\13\337\246p\330\331\233\335\202\233S\362\350\337b}At\11\332\273\356\370\337u\346\215{\3\377\355\37\202$\233\212D\25\345\334\300\350\4\200\344\17f\5\360\355\267\33200\341a\3532\300\252\213\344\3}\10y\241\346\340]\362\202;}\14;\4\370~\373\27z\22s'6;\35r%\306D\6\0Ox\15\376\341n\377\347\7\229w\355\353\37f\307\2451\0a\13o\260\267^\277\222$\31 \240\361\333;\240h\360\33\370f\301\352j\211\7\20\340\370\3\210S\2\303A\311\2\340\255\29\310\13\312}\201[\221\24\373y\7v\367\330\203\332\12\200\2550\12f\13M|\370\366;z\4|\37\277\16A-!", 10240, 0x0, 0, ... {status=0x0, info=10240}, ) == 0x0
 00718  1036   NtReadFile  (104, 0, 0, 0, 10240, 0x0, 0, ... {status=0x0, info=10240},  (104, 0, 0, 0, 10240, 0x0, 0, ... {status=0x0, info=10240}, "\357A\26\336Il\325'\311ch\15Y\236\251\254\322|)\213\0[\325u\35\365(\13\365\336\373\2373F\127\3259\376Z\204\260\305\213\260\224\25\240\355\373Ll\221ct\4\244S?\4\340\13\363w\201q\207\255\2335f\273\336\36\346\31\237\320;)g$Z\20\256\203\10\353Ij\265\377\334\256\177\304\251K\14\27\344\257\303)\311`\207\266BF*Ae\25\357(}\345\360\2134\340h\24\315\310\3524\211J\6\331[\2132n\214 \216F#{\5\373\252\345\352\221v6\221Y\374=\267\30B^\343\236\331I\277\306\353\341\330<\346`$\1\357\177&U\36roV\223\201iQ\342\230\267;\310\263\206G\341\2\5\254\23\3-$_Y=\350\337\216\237\272\227\227\305_\336\376\260_\212\210\335`\265\26\376\276ndqh\3245lu\300\30;\315\371':$\206b\322\24\250\26\3450\6\340\34\2433\3506R\233d\5\270>\354c\3501c\373\211*\353#T\310z@N41\314sP\216I\14\3M\22\200\334\26\5\31\250[\5cw\32\246\333Y\351;\24\323\26\5b\\335\22t\211\22\273\12\30\265_\234ee{\250Go\341\251=\244\221\252\207\25\231Q\346%Qk\36\305\201\31\321i>\360\336$.\344\311a\3\334\327m\220[`\360\236\10\204\260\265\352^\342P[\16\205>\376\334l\277\302\352\373E\233\322\341\334\16\31Yz(3\0aTN\245{\213\352\256\267\216\375\0\2\316\241\334\210\335\265\3\305\217\251j\343;\244h\207/\320w\342\213\332\237H\36\210p\25\373\210\321#va3\376Bz\21376\372i\264\317\321\331\202\210-y\10&\364\325\315\241^\206\367\20;V\12\2354cq\310\26\1\343F)K8A[X\350m\260_"$\254c\265\4\344\217M\214", ) $\254c\265\4\344\217M\214", ) == 0x0
 00719  1036   NtWriteFile  (108, 0, 0, 0,  (108, 0, 0, 0, "0!(\336\226\14\353'\26\3V\15\206\376\227\254\15\34\27\213\337;\353u\302\225\26\13*\276\305\237\354&47\12Y\300Z[\320\373\213o\364+\2402\233rlN\3J\4{3\1\4?k\315w^\21\271\255DUX\273\1~\330\31@\260\5)\270Dd\20q\3436\353\226\12\213\377\3\316A\304v+2\27;\317\375)\26\0\271\266\235&\24A\272u\321(\242\205\316\213\353\200V\24\22\250\3244V*8\331\204\353\14nS@\260F\374\33;\373u\205\324\221\251V\257Y#]\211\30\235>\335\236\6)\201\3064\201\346<9\0\32\10\37\30U\301\22QVL\341WQ=\370\211;\27\323\270G>b;\254\314c\23$\2009\3\350\0\356\241\272H\367\373_\1\236\216_U\350\343`jv\300\276\261\4Oh\13URu\37x\5\315&G\4$Y\2\354\24wv\3330\331\200"\243\354\210\10RD\4;\270\341\214]\350\356\3\305\211\365\213\35T\27\32~N\353Q\362s\217\356w\14\334-,\200\3v;\31w;;c\250z\230\333\206\211\5\24\14v;b\203\275,tVr\205\12\307\325a\234\272\5E\250\230\17\337\251\342\304\257\252Xu\247Q9Eok\301\245\277\31\16\11\0\360\1D\20\344\26\1=\334\10\15\256[\277\220\240\10[\320\213\352\201\202n[\321\345\0\376\3\14\201\3025\233{\233\15\201\342\16\3069D(\354`_T\221\305E\2135\316\211\216"`<\316~\274\266\335jc\373\217v\12\335;{\10\271/\17\27\334\213\5\377v\36W\20+\373W\261\35v\276S\300B\245\353\116%\11\212\317\16\271\274\210\362\316&+\265\363\241\201\346\311\20\34464\235\353\3O\310\311a\335F\366+\6A\2048\326mo?\34$s\3\213\4;\357s\214", 10240, 0x0, 0, ... {status=0x0, info=10240}, ) \243\354\210\10RD\4;\270\341\214]\350\356\3\305\211\365\213\35T\27\32~N\353Q\362s\217\356w\14\334-,\200\3v;\31w;;c\250z\230\333\206\211\5\24\14v;b\203\275,tVr\205\12\307\325a\234\272\5E\250\230\17\337\251\342\304\257\252Xu\247Q9Eok\301\245\277\31\16\11\0\360\1D\20\344\26\1=\334\10\15\256[\277\220\240\10[\320\213\352\201\202n[\321\345\0\376\3\14\201\3025\233{\233\15\201\342\16\3069D(\354`_T\221\305E\2135\316\211\216 (108, 0, 0, 0, "0!(\336\226\14\353'\26\3V\15\206\376\227\254\15\34\27\213\337;\353u\302\225\26\13*\276\305\237\354&47\12Y\300Z[\320\373\213o\364+\2402\233rlN\3J\4{3\1\4?k\315w^\21\271\255DUX\273\1~\330\31@\260\5)\270Dd\20q\3436\353\226\12\213\377\3\316A\304v+2\27;\317\375)\26\0\271\266\235&\24A\272u\321(\242\205\316\213\353\200V\24\22\250\3244V*8\331\204\353\14nS@\260F\374\33;\373u\205\324\221\251V\257Y#]\211\30\235>\335\236\6)\201\3064\201\346<9\0\32\10\37\30U\301\22QVL\341WQ=\370\211;\27\323\270G>b;\254\314c\23$\2009\3\350\0\356\241\272H\367\373_\1\236\216_U\350\343`jv\300\276\261\4Oh\13URu\37x\5\315&G\4$Y\2\354\24wv\3330\331\200"\243\354\210\10RD\4;\270\341\214]\350\356\3\305\211\365\213\35T\27\32~N\353Q\362s\217\356w\14\334-,\200\3v;\31w;;c\250z\230\333\206\211\5\24\14v;b\203\275,tVr\205\12\307\325a\234\272\5E\250\230\17\337\251\342\304\257\252Xu\247Q9Eok\301\245\277\31\16\11\0\360\1D\20\344\26\1=\334\10\15\256[\277\220\240\10[\320\213\352\201\202n[\321\345\0\376\3\14\201\3025\233{\233\15\201\342\16\3069D(\354`_T\221\305E\2135\316\211\216"`<\316~\274\266\335jc\373\217v\12\335;{\10\271/\17\27\334\213\5\377v\36W\20+\373W\261\35v\276S\300B\245\353\116%\11\212\317\16\271\274\210\362\316&+\265\363\241\201\346\311\20\34464\235\353\3O\310\311a\335F\366+\6A\2048\326mo?\34$s\3\213\4;\357s\214", 10240, 0x0, 0, ... {status=0x0, info=10240}, ) , 10240, 0x0, 0, ... {status=0x0, info=10240}, ) == 0x0
 00720  1036   NtReadFile  (104, 0, 0, 0, 10240, 0x0, 0, ... {status=0x0, info=10240},  (104, 0, 0, 0, 10240, 0x0, 0, ... {status=0x0, info=10240}, "\314M\265\274\Z\0\334"Us\15\325\351?\241\331\274\370\0\321\31B\364\271\253\24\263`\357i\2\10e\253\32\30i\372\231EA6\17[\363\31\353\364%\332\35\217K:\202&\372#\257\217\211C\217\3270/0MyH\11\327\356\252c\200C\36 `\257jpG\322\360\207\254\366Z\177I\34\362-W<\210;[\205 \0\36(k|tX:\270(#\23\17\2734|\0\377\243\321T\356v!\20\13s\220\265\225f\231~\325oe\25\223\1!t\342\11iP\37vY\34\220\305\225\255M\234\222D\306TF\353\2157m\246\222\25J_\210`*\360\307X\200\240\357\355N\30(\304m\300\237!\373\261\5\203\211\325\342\325.\306\362u+c\360\226\222\326Yt\320w9?d\273\360\226\33CY\165\314\247]\227\217t\376\3D;kPu\340<\22x\346\205\220\247~\16\310\273\275\230&\300\267\312\216\15fL\36\252\250\320\325g\211Srb\316Z\327\333A\331\377\310\253\202\333a\347\233\236\275\15\213\25\367\241#\364\340\301\260\376[\300r\376\24\23\375\306bF\255\362G\2073\15S\261\301\\302\261#ox\257\274\\251\177\226\357i\212/\320\35\340dpn\212?\227\374\374\222=X\253'\327Q\231R,)\374\331'<\213\330\241\324\3\315\5\345\332\262g5\4\225\277;\10\327l\250e\206\366\31\20\313~&\34\206\366[Y\312@\32\14\367+;\277\232jA0\225\25\366\350\236hX\255b\234Pm\325g\347[|\2171\13Wg\300\312m\0z\27 uP\257\252\323\265\205\271o\351\363\271\313\241\2\207\226'\357AR\376$#\360\301\374-\316\263w \353C\14\364\231\271\367\367\220s\21\263\201{\250\334\25\23\213\26\363\1\323z\366\1\337\341`\340h\255\334\200", ) Us\15\325\351?\241\331\274\370\0\321\31B\364\271\253\24\263`\357i\2\10e\253\32\30i\372\231EA6\17[\363\31\353\364%\332\35\217K:\202&\372#\257\217\211C\217\3270/0MyH\11\327\356\252c\200C\36 `\257jpG\322\360\207\254\366Z\177I\34\362-W<\210;[\205 \0\36(k|tX:\270(#\23\17\2734|\0\377\243\321T\356v!\20\13s\220\265\225f\231~\325oe\25\223\1!t\342\11iP\37vY\34\220\305\225\255M\234\222D\306TF\353\2157m\246\222\25J_\210`*\360\307X\200\240\357\355N\30(\304m\300\237!\373\261\5\203\211\325\342\325.\306\362u+c\360\226\222\326Yt\320w9?d\273\360\226\33CY\165\314\247]\227\217t\376\3D;kPu\340<\22x\346\205\220\247~\16\310\273\275\230&\300\267\312\216\15fL\36\252\250\320\325g\211Srb\316Z\327\333A\331\377\310\253\202\333a\347\233\236\275\15\213\25\367\241#\364\340\301\260\376[\300r\376\24\23\375\306bF\255\362G\2073\15S\261\301\\302\261#ox\257\274\\251\177\226\357i\212/\320\35\340dpn\212?\227\374\374\222=X\253'\327Q\231R,)\374\331'<\213\330\241\324\3\315\5\345\332\262g5\4\225\277;\10\327l\250e\206\366\31\20\313~&\34\206\366[Y\312@\32\14\367+;\277\232jA0\225\25\366\350\236hX\255b\234Pm\325g\347[|\2171\13Wg\300\312m\0z\27 uP\257\252\323\265\205\271o\351\363\271\313\241\2\207\226'\357AR\376$#\360\301\374-\316\263w \353C\14\364\231\271\367\367\220s\21\263\201{\250\334\25\23\213\26\363\1\323z\366\1\337\341`\340h\255\334\200", ) == 0x0
 00721  1036   NtWriteFile  (108, 0, 0, 0,  (108, 0, 0, 0, "\23-\213\274\203:>\334\3755M\15\12\211\1\241\6\334\306\0\16y|\364f\313*\263\277\217W\2\327\5\225\32\307\11\304\231\232!\10\17\204\223'\353+E\344\35P+\4\202\371\232\35\257P\351}\217\10P\210\222\31v\11\10\216\224c_#  \277\317Tp\230\262\316\207s\226d\177\226|\314-\210\\266;\204\345\36\0\301HU|\2538\4\270\367C-\17dTB\0 \303\357T1\26\37\20\324\23\256\265J\6\247~\12\17[\25La\37t=iWP\300\26g\34O\245\253\255\222\374\254D\314x\353RWS\246Mut_W\0\24\360\308\276\2400\215p\30\367\244S\300@A\305\261\332p\15\211\12\202\353.\31\222K+\274\220\250\222\119J\320\250Y\1dd\220\250\33\234905\23\307c\227P\24\300\3\233[UP\252\200\2\22\247\206\273\220x\360\310dw\13\230\371\240\211\312QmXL\301\312\226\320\12\7\267S\255\2\360Z\10\273\177\331 \250\225\202\4\1\331\233A\3353\213\312\227\237#+\200\377\260!;\376r!t-\375\31\2x\255-'.7\354mm\261\36<\374\261\374\17F\257c<\227\177I\217W\212\360\260#\340\273\20P\212\340\367\302\374M]f\253\370\267o\231\215L\27\374\6G\2\213\7\301\352\3\22e\333\332m\7\13\4J\337\5\10\10\14\226eY\226'\20\24\36\30\34Y\226eY\25 $\14(K\5\277E\12\1770Ju\310\350A\10f\255\275\374nm\12\7\331[\243\357\17\13\210\7\376\312\262`D\27\377\25n\257u\263\213\205f\17\327\363f\253\237\2X\366\31\357\2362\300$\374\220\377\374\362\256\215w\377\213}\14+\371\207\367(\360M\21l\341E\250\3u-\213\335V\315\1\14\32\310\1\0\201^\340\267\315\342\200", 10240, 0x0, 0, ... {status=0x0, info=10240}, ) , 10240, 0x0, 0, ... {status=0x0, info=10240}, ) == 0x0
 00722  1036   NtReadFile  (104, 0, 0, 0, 10240, 0x0, 0, ... {status=0x0, info=10240},  (104, 0, 0, 0, 10240, 0x0, 0, ... {status=0x0, info=10240}, "\374\225+\205\271&\302\6\304\24\265\22\332\2736s\360\273\240\242\261T\4CAb\334\6\316\217>2k\22\320/r\232\5\373\250\302C\31oq#\353$\26\321\377\263\2379\16\377\302\253\12\344-\306\177Oc\6\0\337\321K\213k2\305x\268\3630\3\7\177`4\221\340\5\327\327\23\227;\346\242\231z\210\356\16\33x\210\375'g\326\13\253H'W\312=\225\200\310$\263_\333.\204\24?V\24\32\255&\24\26y\206?\355[\11|5\17\221\3308\341\276\14\7p\336\202\277\261\254\330$\128\304\323\324\330o>\15\251\267\\237\323h\236\35;\5g:8\15%9\233\32'\211,\17TS`N\233\342\247\350\206\221\306\226N\340\212\36o\204\216\17\365\340I\30\314\343B\223\206]\201\235\37\327t\231`#\247\367\340\277\21|\2655\14\244M\345\213\3071i\341\341%!\237\211\247\355\364\340Q\225wh\361i\3\373\2373~\12\245&_\354Kj\224c]\0\301Io\275%c\2\240\360\371\344\177\13\336*\247\3\315`\3676\313\230onx\310\257\12\225\17\303\336\230\323<\316\314\3353\22\317x\4\237aM\35\367\252\253\321\363z*Q\370\227\332\253\34|o\317k\302\302/mC\224o\303\260b;\346\3030ma\220\220\276n\257\235\27\376}\231.\1\252\177\301!\254\227"\277q\306\273[\1>,W\363=\370\252Q\314\243\2020o\351t\0\375\202\314\4\6\213\25\332&O\327x?\346\2068j2_\311\360\370\213\322\356\262\315\330\354\22\310T)(\310K\316\323;9\376c\211d]\17\331S\251D\34\3245\260w\346fx\214un\376\4a\277{H\355"\224\232g?\1\242v\243|\373L\326\0\253\353\14]\265|x\354\316\224\24\361\4#\371k0\26=\", ) \277q\306\273[\1>,W\363=\370\252Q\314\243\2020o\351t\0\375\202\314\4\6\213\25\332&O\327x?\346\2068j2_\311\360\370\213\322\356\262\315\330\354\22\310T)(\310K\316\323;9\376c\211d]\17\331S\251D\34\3245\260w\346fx\214un\376\4a\277{H\355 (104, 0, 0, 0, 10240, 0x0, 0, ... {status=0x0, info=10240}, "\374\225+\205\271&\302\6\304\24\265\22\332\2736s\360\273\240\242\261T\4CAb\334\6\316\217>2k\22\320/r\232\5\373\250\302C\31oq#\353$\26\321\377\263\2379\16\377\302\253\12\344-\306\177Oc\6\0\337\321K\213k2\305x\268\3630\3\7\177`4\221\340\5\327\327\23\227;\346\242\231z\210\356\16\33x\210\375'g\326\13\253H'W\312=\225\200\310$\263_\333.\204\24?V\24\32\255&\24\26y\206?\355[\11|5\17\221\3308\341\276\14\7p\336\202\277\261\254\330$\128\304\323\324\330o>\15\251\267\\237\323h\236\35;\5g:8\15%9\233\32'\211,\17TS`N\233\342\247\350\206\221\306\226N\340\212\36o\204\216\17\365\340I\30\314\343B\223\206]\201\235\37\327t\231`#\247\367\340\277\21|\2655\14\244M\345\213\3071i\341\341%!\237\211\247\355\364\340Q\225wh\361i\3\373\2373~\12\245&_\354Kj\224c]\0\301Io\275%c\2\240\360\371\344\177\13\336*\247\3\315`\3676\313\230onx\310\257\12\225\17\303\336\230\323<\316\314\3353\22\317x\4\237aM\35\367\252\253\321\363z*Q\370\227\332\253\34|o\317k\302\302/mC\224o\303\260b;\346\3030ma\220\220\276n\257\235\27\376}\231.\1\252\177\301!\254\227"\277q\306\273[\1>,W\363=\370\252Q\314\243\2020o\351t\0\375\202\314\4\6\213\25\332&O\327x?\346\2068j2_\311\360\370\213\322\356\262\315\330\354\22\310T)(\310K\316\323;9\376c\211d]\17\331S\251D\34\3245\260w\346fx\214un\376\4a\277{H\355"\224\232g?\1\242v\243|\373L\326\0\253\353\14]\265|x\354\316\224\24\361\4#\371k0\26=\", ) , ) == 0x0
 00723  1036   NtWriteFile  (108, 0, 0, 0,  (108, 0, 0, 0, "#\365\25\205fF\374\6\33t\213\22\5\333\10s/\333\236\242n4:C\236\2\342\6\21\357\02\264r\356/\255\372;\373w\242}\31\260\21\35\353\373v\357\377l\377\7\16 \242\225\12;M\370\177\220\38\0\0\261u\213\264R\373x\311X\3150\334gA`\353\361\336\5\10\267-\227\344\206\234\231\245\350\320\16\304\30\266\375\370\7\350\13t(\31W\25]\253\200\27D\215_\4N\272\24\3406*\32\312U\30\24\311\31\270?2;7|\352o\257\330\347\201\200\14\330\20\340\202`\321\222\330\373j\6\304\14\264\346o\341m\227\267\203\377\355hA}\5\5\270Z\6\15\372Y\245\32\370\351\22\17\2133^ND\202\231\350Y\361\370\226\221\200\264\36\260\344\260\17*\200w\30\23\203|\223\317Vc\201B\177\351tF\0\35\247(\200\201\21\243\325\13\14{-\333\213\30QW\341>E\37\237V\307\323\364?1\253w\267\221W\3$\377\15~\325\305\30_3+T\224\274=>\301\226\17\203%\274b\236\360&\204A\13\1J\231\3\22\0\3116\24\370Qn\247\250\221\12Jo\375\336G\263\2\316\23\275\15\22\20\30:\237\276-#\367u\313\357\363\245Jo\370H\272\225\34\243\17\361k\35\242\21m\234\364Q\303o\2\5\346\34PSaO\360\200np\375)\376\242\371\20\1\312RA\301\376\314\251"`\21\370\273\204a\0,\210\223\3\370u1\362\243]PQ\351\253`\303\202\23d8\213\312\272\30O\10\30\1\346YXT2\200\251\316\370T\262\320\262\22\270\322\22\274\27(\27+\360\323\344Y\300cV\4c\17\63\227D\303\264\13\260\250\206XxS\25P\376\333\1\201{\227\215\34\224E\7\1\1}\26\235|$,\350\0t\2132]j\34F\354\21\364*\361\333C\307k\357v\3\", 10240, 0x0, 0, ... {status=0x0, info=10240}, ) `\21\370\273\204a\0,\210\223\3\370u1\362\243]PQ\351\253`\303\202\23d8\213\312\272\30O\10\30\1\346YXT2\200\251\316\370T\262\320\262\22\270\322\22\274\27(\27+\360\323\344Y\300cV\4c\17\63\227D\303\264\13\260\250\206XxS\25P\376\333\1\201{\227\215\34\224E\7\1\1}\26\235|$,\350\0t\2132]j\34F\354\21\364*\361\333C\307k\357v\3\", 10240, 0x0, 0, ... {status=0x0, info=10240}, ) == 0x0
 00724  1036   NtReadFile  (104, 0, 0, 0, 10240, 0x0, 0, ... {status=0x0, info=10240},  (104, 0, 0, 0, 10240, 0x0, 0, ... {status=0x0, info=10240}, "\274.&!\363[\35\264EcHB\23645D\313a]t\237.Zt\313\7\177\14\27\5\363\4\313X\35\220s+\251<\Db\310\340(\327^\276\374\266\233\2358\35\364\234\251[(\243)2\240w>j\5\254\177\366\3\336\313tD\332#&\316\330\251\365H\336c[\30\337^\32\313}J\346\7\17\262\264A\365\340\256\204\233\232:\231_\2537:\377%h\7\6\213\20M\363\27:\306\324\204r\201\234 \11\3)\250d+\234\3545|\267 p\232\313a\242\254O\367\317J\330/\230\357\216=\350*\244Oo\274,\367=%o\14>O`/\37\233\277\277z\24\233T6K\331\214[\13\233p\358lw\367\215[#,\24\233\204\355\14\247d,S\232h\205\11\346\365\242S\352%\6\35\350\346S\303\17F3\323\367\3\204K?\365Ew?jac\250H/\212h\315E\7\17\357\267\23\24k\303Po\12t\360Y\257_\232\234x\30\260\364t\232\362\361\35Hg\347\276\220\304\14=w1\332spD7y\30\334\79\246\277@\207\1]G?\271\267c\307 &`-4\3377\6\217"f\332\0\216\200\10\303c\364\226\353c~ \314\335\273M", ) f\332\0\216\2003\212\4XT\313\257NT\337@\274*g\271\220\27\215X.\344\2506\367&\330x(P\316\27h\1j\256/\27$\23\376\354sj\3\347\3403^\20\317\362?E\357\364nT?\236\1S\27qQ\351e\214\272\346\3244l\2\0<\365\30\377\321\250\334\4c\260p\336r\325\2\24'\202\367\365\231B\4\337'\346H\313Ct.\234)\2068\206\2508\244\325xb\242\333\2332\2\222\25.\257\227cZ\2}\306fh\264\205Yp\304y\332\3pL\367\360\346\227:\4\314\360<\3\15m:\266\323`>\10\303c\364\226\353c~ \314\335\273M", ) == 0x0
 00725  1036   NtWriteFile  (108, 0, 0, 0,  (108, 0, 0, 0, "cN\30!,;#\264\232\3vBAT\13D\24\1ct@Ndt\24gA\14\310e\315\4\248#\220\254K\227<\203$\\310?H\351^a\234\210\233BX#\364C\311e(|I\14\240\250^T\5s\37\310\3\1\253JD\5C\30\316\7\311\313H\1\3e\30\0>$\313\242*\330\7\320\322\212A*\200\220\204D\372\4\231\200\313\11: EV\7\331\353.M,w\4\306\13\344L\201C@7\3\366\310Z+C\214\13|h@N\232\24\1\234\254\220\227\361J\7O\246\357Q]\326*{/Q\274\363\227\3%\260l\0O\277O!\233`\337D\24D4\10K\6\354e\13D\20#8\263\27\311\215\204C\22\24D\344\323\14x\4\22SE\10\273\119\225\234S5E8\35\302P\330S\34ox3\14\227=\204\224_\313E\250_Ta\274\310v/U\10\363E\330o\321\267\314tU\303\217\174t/9\221_E\374F\30o\224J\232-\221#H\270\207\200\220\33l\3w\356\272Mp\233WG\30\3g\7\246` \271\1\202'\1\271h\3\371 \371\0\234\0W8\217\375\6\344\0Q\340\2i\262Pr\3UdfT\24\317pT\0 \202*\270\331\256\27R8\20\344wV\311&\7\30\26P\21wV\1\265\316\21\27\373s\300\354\254\12=\347?S`\20\20\222\1E0\224PT\340\376?S\310\21o\351\272\354\204\346\13TR\2\337\\313\30 \261\226\334\333\3\216p\1\22\353\2\313G\274\367*\371|\4\0G\330H\24#J.CI\2708Y\310\6\244\12\30\\242\4\373\14\2Mu\20\257H\3d\2\242\246Xhk\345gp\33\31\344\3\257,\311\3609\367\4\4\23\220\2\3\322\15\4\266\14\0\0\10\34\3\312\2264\3@ \23\275\205M", 10240, 0x0, 0, ... {status=0x0, info=10240}, ) , 10240, 0x0, 0, ... {status=0x0, info=10240}, ) == 0x0
 00726  1036   NtReadFile  (104, 0, 0, 0, 10240, 0x0, 0, ... {status=0x0, info=10240},  (104, 0, 0, 0, 10240, 0x0, 0, ... {status=0x0, info=10240}, "E .\214\335|.\205T1%\27\37[r8\216A\333R\262\307h\210/\336=|\25\14\240\11\377>\256\346\304\240\373h)o\23\330\317Q\216F4\234r\15\273kE\301\323`\346\17\343jx\21\33vbk%@XA\302a\352k\227\3634\345<\206\266a\260\2705+\324\14\210\214\375\336.\201\335\302\325\301`aX@c\271\25vQn\346\262\377 1\21oP\246\315\225Rs\2633E\245@\247n\270\14\26\255,\226\367(0\13\373 \375@\317%\264\261\206{\277|\273j7\221\350\373;\20xqm\360b\243\214\11\226kbB\30c \357hl\370\217!"n\261[Jb\203\276\241|\20U\233\30\364\327\342\224\211\345\321R\26{\356,\14\371\23\17\353Hb\245\11\261D.s\36ND\266\346=\20YSRY\20\4\24n\5lj\27\370mi\365\352\310\324\361:\323D%B\217jj\20\327v:M\3311\22\2\333\244Ad\332\13*\6\231\304\256\11\311k\274\242\264F #\206}<=7\254\246\5>\365\3358\317{'\263\332/J\2425r\250\260\314I\13\26\344x8\234\211\5\5;\33\2r\20Ss\235\10\277\323\6$sG/I\227\370U\4\321PN\232\362\33/n\322\210^\300\\1\16\211\360L\347\214\6\20*\2#n\35\250\307\242f\337\203\251\240-\320\25\\236\2326o\21\333~1\22\235lx@\2402\214C\25j\214\14\2\3366\322o\302m\344\262dRY\34\313x\16]y\215%Bo\234\336\354\24\365F\16\1466\323\0\241)\375\235\204A\3238\376\340\276\\177\315\363\367\203\2\2751\2s\313d\317N'2\310h\224\372f\237\316Y\314\1\367\2\203\118W\255\226\22\2742\224\326=\346\222\36\322Z\20(pdxi\232(\4", ) n\261[Jb\203\276\241|\20U\233\30\364\327\342\224\211\345\321R\26{\356,\14\371\23\17\353Hb\245\11\261D.s\36ND\266\346=\20YSRY\20\4\24n\5lj\27\370mi\365\352\310\324\361:\323D%B\217jj\20\327v:M\3311\22\2\333\244Ad\332\13*\6\231\304\256\11\311k\274\242\264F #\206}<=7\254\246\5>\365\3358\317{'\263\332/J\2425r\250\260\314I\13\26\344x8\234\211\5\5;\33\2r\20Ss\235\10\277\323\6$sG/I\227\370U\4\321PN\232\362\33/n\322\210^\300\\1\16\211\360L\347\214\6\20*\2#n\35\250\307\242f\337\203\251\240-\320\25\\236\2326o\21\333~1\22\235lx@\2402\214C\25j\214\14\2\3366\322o\302m\344\262dRY\34\313x\16]y\215%Bo\234\336\354\24\365F\16\1466\323\0\241)\375\235\204A\3238\376\340\276\\177\315\363\367\203\2\2751\2s\313d\317N'2\310h\224\372f\237\316Y\314\1\367\2\203\118W\255\226\22\2742\224\326=\346\222\36\322Z\20(pdxi\232(\4", ) == 0x0
 00727  1036   NtWriteFile  (108, 0, 0, 0,  (108, 0, 0, 0, "\232@\20\214\2\34\20\205\213Q\33\27\300;L8Q!\345Rm\247V\210\360\276\3|\312l\236\11 ^\220\346\33\300\305h\366\17-\330\201\260F\353\374L\15d\13{\301\14\0\330\17<\12F\21\304\26\k\372 fA\35\1\324kH\223\12\345\343\346\210ao\330\13+\13l\266\214"\276\20\201\2\242\353\301\277\1f@\274\331+v\216\16\330\262 @\17\21\2600\230\315J2M\263\354%\233@x\16\206\14\311\315\22\226(H\16\13$@\303@\20E\212\261Y\33\201|d\12\11\2217\233\5\20\247\21S\360\275\303\262\11I\13\B\307\3\36\357\267\14\306\217\376BP\261\204*\\203a\301B\20\212\373&\364\10\202\252\211:\261l\26\244\216\22\14&s1\353\227\2\233\11n$\20s\301.z\2669].Y\2142g\20\333tP\5\263\12)\370\262\11\313\352\27\264\317:\14$\33BP\12T\20\10\26\4M\6Q,\2\4\304\177d\5k\24\6F\244\220\11\26\13\202\242k&\36#Y\35\2=\350\314\230\5\341\225\3438\20\33\31\263\5Ot\242\352\22\226\260\23)5\26;\30\6\234Ve;;\304bL\20\214\23\243\10`\2638$\254'\21IH\230k\4\160p\232-{\21n\15\350`\300\203a0\211/,\331\214\331p\24\2\374\16#\250\30\302X\337\\311\236-\17ub\236EVQ\21\4\36\17\22B\14F@\177R\262C\312\12\262\14\335\276\10\322\260\242S\344m\4lY\303\253F\16\202\31\263%\235\17\242\3363t\313F\321l\106\14`\237)"\375\272A\14X\300\340a, 10240, 0x0, 0, ... {status=0x0, info=10240}, ) \276\20\201\2\242\353\301\277\1f@\274\331+v\216\16\330\262 @\17\21\2600\230\315J2M\263\354%\233@x\16\206\14\311\315\22\226(H\16\13$@\303@\20E\212\261Y\33\201|d\12\11\2217\233\5\20\247\21S\360\275\303\262\11I\13\B\307\3\36\357\267\14\306\217\376BP\261\204*\\203a\301B\20\212\373&\364\10\202\252\211:\261l\26\244\216\22\14&s1\353\227\2\233\11n$\20s\301.z\2669].Y\2142g\20\333tP\5\263\12)\370\262\11\313\352\27\264\317:\14$\33BP\12T\20\10\26\4M\6Q,\2\4\304\177d\5k\24\6F\244\220\11\26\13\202\242k&\36#Y\35\2=\350\314\230\5\341\225\3438\20\33\31\263\5Ot\242\352\22\226\260\23)5\26;\30\6\234Ve;;\304bL\20\214\23\243\10`\2638$\254'\21IH\230k\4\160p\232-{\21n\15\350`\300\203a0\211/,\331\214\331p\24\2\374\16#\250\30\302X\337\\311\236-\17ub\236EVQ\21\4\36\17\22B\14F@\177R\262C\312\12\262\14\335\276\10\322\260\242S\344m\4lY\303\253F\16\202\31\263%\235\17\242\3363t\313F\321l\106\14`\237) (108, 0, 0, 0, "\232@\20\214\2\34\20\205\213Q\33\27\300;L8Q!\345Rm\247V\210\360\276\3|\312l\236\11 ^\220\346\33\300\305h\366\17-\330\201\260F\353\374L\15d\13{\301\14\0\330\17<\12F\21\304\26\k\372 fA\35\1\324kH\223\12\345\343\346\210ao\330\13+\13l\266\214"\276\20\201\2\242\353\301\277\1f@\274\331+v\216\16\330\262 @\17\21\2600\230\315J2M\263\354%\233@x\16\206\14\311\315\22\226(H\16\13$@\303@\20E\212\261Y\33\201|d\12\11\2217\233\5\20\247\21S\360\275\303\262\11I\13\B\307\3\36\357\267\14\306\217\376BP\261\204*\\203a\301B\20\212\373&\364\10\202\252\211:\261l\26\244\216\22\14&s1\353\227\2\233\11n$\20s\301.z\2669].Y\2142g\20\333tP\5\263\12)\370\262\11\313\352\27\264\317:\14$\33BP\12T\20\10\26\4M\6Q,\2\4\304\177d\5k\24\6F\244\220\11\26\13\202\242k&\36#Y\35\2=\350\314\230\5\341\225\3438\20\33\31\263\5Ot\242\352\22\226\260\23)5\26;\30\6\234Ve;;\304bL\20\214\23\243\10`\2638$\254'\21IH\230k\4\160p\232-{\21n\15\350`\300\203a0\211/,\331\214\331p\24\2\374\16#\250\30\302X\337\\311\236-\17ub\236EVQ\21\4\36\17\22B\14F@\177R\262C\312\12\262\14\335\276\10\322\260\242S\344m\4lY\303\253F\16\202\31\263%\235\17\242\3363t\313F\321l\106\14`\237)"\375\272A\14X\300\340a, 10240, 0x0, 0, ... {status=0x0, info=10240}, ) , 10240, 0x0, 0, ... {status=0x0, info=10240}, ) == 0x0
 00728  1036   NtReadFile  (104, 0, 0, 0, 2048, 0x0, 0, ... {status=0x0, info=2048},  (104, 0, 0, 0, 2048, 0x0, 0, ... {status=0x0, info=2048}, "\237+>\0\217+>\0\273;>\0\253;>\0;\11>\0+\11>\0\333\12>\0\323\12>\0\313\12>\0\303\12>\0\373\12>\0\363\12>\0\353\12>\0\343\12>\0\233\12>\0\223\12>\0\177\12>\0k\12>\0\7\12>\0\303\13>\0\217\13>\0w\13>\0\17\13>\0\317\14>\0O\14>\07\14>\0[\16>\0/\17>\0\357\20>\0\313\21>\0\177\21>\0\253\23>\0\243\25>\0\233\27>\0\367\30>\0\27\30>\0\227\31>\0W\31>\0\243\32>\0C\32>\0\37\32>\0/\32>\0G#;\0?#;\0\10I9\04I9\0\335J9\0\305J9\0\353J9\0\221J9\0\266J9\0[J9\0\177J9\0fJ9\0\13J9\07J9\0!J9\0\315K9\0\367K9\0\236K9\0\217K9\0\242K9\0IK9\0hK9\0\16K9\0'K9\0\304L9\0\225L9\0\260L9\0ML9\0\36L9\0>L9\0\333M9\0\346M9\0\270M9\0\243M9\0MM9\0uM9\0\37M9\0\11M9\03M9\0\336N9\0\305N9\0\360N9\0\233N9\0\201N9\0\246N9\0[N9\0UN9\0LN9\0@N9\0\303`(\0\310`'\0\313`&\0\312`$\0\333`=\0\327`9\0\331`;\0\364`%\0\302` \0\373`\36\0\367`\24\0\366`\37\0\374`\34\0\300`\33\0\371`\31\0\314`/\0\315`2\0\317`0\0\320`3\0\324`4\0\326`\22\0\337`<\0\336`\20\0\362`>\0\337`>\0\337`>\0\337`>@\373\30N$\356Rpm\252\4N@\213.sU\2330>@\373\30N$\356Upm", ) , ) == 0x0
 00729  1036   NtWriteFile  (108, 0, 0, 0,  (108, 0, 0, 0, "@K\0\0PK\0\0d[\0\0t[\0\0\344i\0\0\364i\0\0\4j\0\0\14j\0\0\24j\0\0\34j\0\0$j\0\0,j\0\04j\0\0\0\37\0%\0&\0'\0\23\0\21\0\22\0\14\0\20\0\16\0\17\0\15\0\13\0\12\0\11\0,\0\0\0\2\0\1\0.\0-\0\0\0\0\0\0\0\0\0\0\0\0\0\0@$xp$12Nmudp@TNMUDP\0@$xp$15Nm", 2048, 0x0, 0, ... {status=0x0, info=2048}, ) \0\37\0%\0&\0'\0\23\0\21\0\22\0\14\0\20\0\16\0\17\0\15\0\13\0\12\0\11\0,\0\0\0\2\0\1\0.\0-\0\0\0\0\0\0\0\0\0\0\0\0\0\0@$xp$12Nmudp@TNMUDP\0@$xp$15Nm", 2048, 0x0, 0, ... {status=0x0, info=2048}, ) == 0x0
 00730  1036   NtClose  (108, ... ) == 0x0
 00731  1036   NtClose  (104, ... ) == 0x0
 00732  1036   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\DOCUME~1\MARTIM~1\LOCALS~1\Temp\bas2.tmp"}, 1242360, ... ) }, 1242360, ... ) == 0x0
 00733  1036   NtOpenFile  (0x100020, {24, 0, 0x40, 0, 0,  (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\DOCUME~1\MARTIM~1\LOCALS~1\Temp\bas2.tmp"}, 5, 96, ... 104, {status=0x0, info=1}, ) }, 5, 96, ... 104, {status=0x0, info=1}, ) == 0x0
 00734  1036   NtCreateSection  (0xe, 0x0, 0x0, 16, 134217728, 104, ... 108, ) == 0x0
 00735  1036   NtClose  (104, ... ) == 0x0
 00736  1036   NtMapViewOfSection  (108, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 16, ... (0x390000), 0x0, 176128, ) == 0x0
 00737  1036   NtClose  (108, ... ) == 0x0
 00738  1036   NtUnmapViewOfSection  (-1, 0x390000, ... ) == 0x0
 00739  1036   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\DOCUME~1\MARTIM~1\LOCALS~1\Temp\bas2.tmp"}, 1242668, ... ) }, 1242668, ... ) == 0x0
 00740  1036   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\DOCUME~1\MARTIM~1\LOCALS~1\Temp\bas2.tmp"}, 1242668, ... ) }, 1242668, ... ) == 0x0
 00741  1036   NtOpenFile  (0x100020, {24, 0, 0x40, 0, 0,  (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\DOCUME~1\MARTIM~1\LOCALS~1\Temp\bas2.tmp"}, 5, 96, ... 108, {status=0x0, info=1}, ) }, 5, 96, ... 108, {status=0x0, info=1}, ) == 0x0
 00742  1036   NtCreateSection  (0xf, 0x0, 0x0, 16, 16777216, 108, ... 104, ) == 0x0
 00743  1036   NtQuerySection  (104, Image, 48, ... {section info, class 1, size 48}, 0x0, ) == 0x0
 00744  1036   NtClose  (108, ... ) == 0x0
 00745  1036   NtMapViewOfSection  (104, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0xaf0000), 0x0, 471040, ) == STATUS_IMAGE_NOT_AT_BASE
 00746  1036   NtMapViewOfSection  (104, -1, (0xaf0000), 0, 0, 0x0, 471040, 1, 0, 4, ... ) == STATUS_CONFLICTING_ADDRESSES
 00747  1036   NtFlushInstructionCache  (-1, 0, 0, ... ) == 0x0
 00748  1036   NtClose  (104, ... ) == 0x0
 00749  1036   NtProtectVirtualMemory  (-1, (0xb62000), 4096, 4, ... (0xb62000), 4096, 8, ) == 0x0
 00750  1036   NtProtectVirtualMemory  (-1, (0xb62000), 4096, 8, ... (0xb62000), 4096, 4, ) == 0x0
 00751  1036   NtFlushInstructionCache  (-1, 11935744, 4096, ... ) == 0x0
 00752  1036   NtProtectVirtualMemory  (-1, (0xb62000), 4096, 4, ... (0xb62000), 4096, 4, ) == 0x0
 00753  1036   NtProtectVirtualMemory  (-1, (0xb62000), 4096, 4, ... (0xb62000), 4096, 4, ) == 0x0
 00754  1036   NtFlushInstructionCache  (-1, 11935744, 4096, ... ) == 0x0
 00755  1036   NtOpenSection  (0xe, {24, 8, 0x40, 0, 0,  (0xe, {24, 8, 0x40, 0, 0, "COMCTL32.DLL"}, ... 104, ) }, ... 104, ) == 0x0
 00756  1036   NtMapViewOfSection  (104, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x5d090000), 0x0, 630784, ) == 0x0
 00757  1036   NtClose  (104, ... ) == 0x0
 00758  1036   NtProtectVirtualMemory  (-1, (0x5d091000), 1656, 4, ... (0x5d091000), 4096, 32, ) == 0x0
 00759  1036   NtProtectVirtualMemory  (-1, (0x5d091000), 4096, 32, ... (0x5d091000), 4096, 4, ) == 0x0
 00760  1036   NtFlushInstructionCache  (-1, 1560875008, 1656, ... ) == 0x0
 00761  1036   NtProtectVirtualMemory  (-1, (0x5d091000), 1656, 4, ... (0x5d091000), 4096, 32, ) == 0x0
 00762  1036   NtProtectVirtualMemory  (-1, (0x5d091000), 4096, 32, ... (0x5d091000), 4096, 4, ) == 0x0
 00763  1036   NtFlushInstructionCache  (-1, 1560875008, 1656, ... ) == 0x0
 00764  1036   NtProtectVirtualMemory  (-1, (0x5d091000), 1656, 4, ... (0x5d091000), 4096, 32, ) == 0x0
 00765  1036   NtProtectVirtualMemory  (-1, (0x5d091000), 4096, 32, ... (0x5d091000), 4096, 4, ) == 0x0
 00766  1036   NtFlushInstructionCache  (-1, 1560875008, 1656, ... ) == 0x0
 00767  1036   NtProtectVirtualMemory  (-1, (0x5d091000), 1656, 4, ... (0x5d091000), 4096, 32, ) == 0x0
 00768  1036   NtProtectVirtualMemory  (-1, (0x5d091000), 4096, 32, ... (0x5d091000), 4096, 4, ) == 0x0
 00769  1036   NtFlushInstructionCache  (-1, 1560875008, 1656, ... ) == 0x0
 00770  1036   NtProtectVirtualMemory  (-1, (0x5d091000), 1656, 4, ... (0x5d091000), 4096, 32, ) == 0x0
 00771  1036   NtProtectVirtualMemory  (-1, (0x5d091000), 4096, 32, ... (0x5d091000), 4096, 4, ) == 0x0
 00772  1036   NtFlushInstructionCache  (-1, 1560875008, 1656, ... ) == 0x0
 00773  1036   NtProtectVirtualMemory  (-1, (0xb62000), 4096, 4, ... (0xb62000), 4096, 4, ) == 0x0
 00774  1036   NtProtectVirtualMemory  (-1, (0xb62000), 4096, 4, ... (0xb62000), 4096, 4, ) == 0x0
 00775  1036   NtFlushInstructionCache  (-1, 11935744, 4096, ... ) == 0x0
 00776  1036   NtProtectVirtualMemory  (-1, (0xb62000), 4096, 4, ... (0xb62000), 4096, 4, ) == 0x0
 00777  1036   NtProtectVirtualMemory  (-1, (0xb62000), 4096, 4, ... (0xb62000), 4096, 4, ) == 0x0
 00778  1036   NtFlushInstructionCache  (-1, 11935744, 4096, ... ) == 0x0
 00779  1036   NtOpenSection  (0xe, {24, 8, 0x40, 0, 0,  (0xe, {24, 8, 0x40, 0, 0, "MPR.DLL"}, ... 104, ) }, ... 104, ) == 0x0
 00780  1036   NtMapViewOfSection  (104, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x71b20000), 0x0, 73728, ) == 0x0
 00781  1036   NtClose  (104, ... ) == 0x0
 00782  1036   NtProtectVirtualMemory  (-1, (0x71b21000), 440, 4, ... (0x71b21000), 4096, 32, ) == 0x0
 00783  1036   NtProtectVirtualMemory  (-1, (0x71b21000), 4096, 32, ... (0x71b21000), 4096, 4, ) == 0x0
 00784  1036   NtFlushInstructionCache  (-1, 1907494912, 440, ... ) == 0x0
 00785  1036   NtProtectVirtualMemory  (-1, (0x71b21000), 440, 4, ... (0x71b21000), 4096, 32, ) == 0x0
 00786  1036   NtProtectVirtualMemory  (-1, (0x71b21000), 4096, 32, ... (0x71b21000), 4096, 4, ) == 0x0
 00787  1036   NtFlushInstructionCache  (-1, 1907494912, 440, ... ) == 0x0
 00788  1036   NtProtectVirtualMemory  (-1, (0xb62000), 4096, 4, ... (0xb62000), 4096, 4, ) == 0x0
 00789  1036   NtProtectVirtualMemory  (-1, (0xb62000), 4096, 4, ... (0xb62000), 4096, 4, ) == 0x0
 00790  1036   NtFlushInstructionCache  (-1, 11935744, 4096, ... ) == 0x0
 00791  1036   NtOpenSection  (0xe, {24, 8, 0x40, 0, 0,  (0xe, {24, 8, 0x40, 0, 0, "OLE32.DLL"}, ... 104, ) }, ... 104, ) == 0x0
 00792  1036   NtMapViewOfSection  (104, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x774e0000), 0x0, 1298432, ) == 0x0
 00793  1036   NtClose  (104, ... ) == 0x0
 00794  1036   NtProtectVirtualMemory  (-1, (0x774e1000), 2352, 4, ... (0x774e1000), 4096, 32, ) == 0x0
 00795  1036   NtProtectVirtualMemory  (-1, (0x774e1000), 4096, 32, ... (0x774e1000), 4096, 4, ) == 0x0
 00796  1036   NtFlushInstructionCache  (-1, 2001604608, 2352, ... ) == 0x0
 00797  1036   NtProtectVirtualMemory  (-1, (0x774e1000), 2352, 4, ... (0x774e1000), 4096, 32, ) == 0x0
 00798  1036   NtProtectVirtualMemory  (-1, (0x774e1000), 4096, 32, ... (0x774e1000), 4096, 4, ) == 0x0
 00799  1036   NtFlushInstructionCache  (-1, 2001604608, 2352, ... ) == 0x0
 00800  1036   NtProtectVirtualMemory  (-1, (0x774e1000), 2352, 4, ... (0x774e1000), 4096, 32, ) == 0x0
 00801  1036   NtProtectVirtualMemory  (-1, (0x774e1000), 4096, 32, ... (0x774e1000), 4096, 4, ) == 0x0
 00802  1036   NtFlushInstructionCache  (-1, 2001604608, 2352, ... ) == 0x0
 00803  1036   NtProtectVirtualMemory  (-1, (0x774e1000), 2352, 4, ... (0x774e1000), 4096, 32, ) == 0x0
 00804  1036   NtProtectVirtualMemory  (-1, (0x774e1000), 4096, 32, ... (0x774e1000), 4096, 4, ) == 0x0
 00805  1036   NtFlushInstructionCache  (-1, 2001604608, 2352, ... ) == 0x0
 00806  1036   NtProtectVirtualMemory  (-1, (0x774e1000), 2352, 4, ... (0x774e1000), 4096, 32, ) == 0x0
 00807  1036   NtProtectVirtualMemory  (-1, (0x774e1000), 4096, 32, ... (0x774e1000), 4096, 4, ) == 0x0
 00808  1036   NtFlushInstructionCache  (-1, 2001604608, 2352, ... ) == 0x0
 00809  1036   NtProtectVirtualMemory  (-1, (0x774e1000), 2352, 4, ... (0x774e1000), 4096, 32, ) == 0x0
 00810  1036   NtProtectVirtualMemory  (-1, (0x774e1000), 4096, 32, ... (0x774e1000), 4096, 4, ) == 0x0
 00811  1036   NtFlushInstructionCache  (-1, 2001604608, 2352, ... ) == 0x0
 00812  1036   NtProtectVirtualMemory  (-1, (0x774e1000), 2352, 4, ... (0x774e1000), 4096, 32, ) == 0x0
 00813  1036   NtProtectVirtualMemory  (-1, (0x774e1000), 4096, 32, ... (0x774e1000), 4096, 4, ) == 0x0
 00814  1036   NtFlushInstructionCache  (-1, 2001604608, 2352, ... ) == 0x0
 00815  1036   NtProtectVirtualMemory  (-1, (0xb62000), 4096, 4, ... (0xb62000), 4096, 4, ) == 0x0
 00816  1036   NtProtectVirtualMemory  (-1, (0xb62000), 4096, 4, ... (0xb62000), 4096, 4, ) == 0x0
 00817  1036   NtFlushInstructionCache  (-1, 11935744, 4096, ... ) == 0x0
 00818  1036   NtOpenSection  (0xe, {24, 8, 0x40, 0, 0,  (0xe, {24, 8, 0x40, 0, 0, "OLEAUT32.DLL"}, ... 104, ) }, ... 104, ) == 0x0
 00819  1036   NtMapViewOfSection  (104, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x77120000), 0x0, 569344, ) == 0x0
 00820  1036   NtClose  (104, ... ) == 0x0
 00821  1036   NtProtectVirtualMemory  (-1, (0x77121000), 1272, 4, ... (0x77121000), 4096, 32, ) == 0x0
 00822  1036   NtProtectVirtualMemory  (-1, (0x77121000), 4096, 32, ... (0x77121000), 4096, 4, ) == 0x0
 00823  1036   NtFlushInstructionCache  (-1, 1997672448, 1272, ... ) == 0x0
 00824  1036   NtProtectVirtualMemory  (-1, (0x77121000), 1272, 4, ... (0x77121000), 4096, 32, ) == 0x0
 00825  1036   NtProtectVirtualMemory  (-1, (0x77121000), 4096, 32, ... (0x77121000), 4096, 4, ) == 0x0
 00826  1036   NtFlushInstructionCache  (-1, 1997672448, 1272, ... ) == 0x0
 00827  1036   NtProtectVirtualMemory  (-1, (0x77121000), 1272, 4, ... (0x77121000), 4096, 32, ) == 0x0
 00828  1036   NtProtectVirtualMemory  (-1, (0x77121000), 4096, 32, ... (0x77121000), 4096, 4, ) == 0x0
 00829  1036   NtFlushInstructionCache  (-1, 1997672448, 1272, ... ) == 0x0
 00830  1036   NtProtectVirtualMemory  (-1, (0x77121000), 1272, 4, ... (0x77121000), 4096, 32, ) == 0x0
 00831  1036   NtProtectVirtualMemory  (-1, (0x77121000), 4096, 32, ... (0x77121000), 4096, 4, ) == 0x0
 00832  1036   NtFlushInstructionCache  (-1, 1997672448, 1272, ... ) == 0x0
 00833  1036   NtProtectVirtualMemory  (-1, (0x77121000), 1272, 4, ... (0x77121000), 4096, 32, ) == 0x0
 00834  1036   NtProtectVirtualMemory  (-1, (0x77121000), 4096, 32, ... (0x77121000), 4096, 4, ) == 0x0
 00835  1036   NtFlushInstructionCache  (-1, 1997672448, 1272, ... ) == 0x0
 00836  1036   NtProtectVirtualMemory  (-1, (0x77121000), 1272, 4, ... (0x77121000), 4096, 32, ) == 0x0
 00837  1036   NtProtectVirtualMemory  (-1, (0x77121000), 4096, 32, ... (0x77121000), 4096, 4, ) == 0x0
 00838  1036   NtFlushInstructionCache  (-1, 1997672448, 1272, ... ) == 0x0
 00839  1036   NtProtectVirtualMemory  (-1, (0x77121000), 1272, 4, ... (0x77121000), 4096, 32, ) == 0x0
 00840  1036   NtProtectVirtualMemory  (-1, (0x77121000), 4096, 32, ... (0x77121000), 4096, 4, ) == 0x0
 00841  1036   NtFlushInstructionCache  (-1, 1997672448, 1272, ... ) == 0x0
 00842  1036   NtProtectVirtualMemory  (-1, (0xb62000), 4096, 4, ... (0xb62000), 4096, 4, ) == 0x0
 00843  1036   NtProtectVirtualMemory  (-1, (0xb62000), 4096, 4, ... (0xb62000), 4096, 4, ) == 0x0
 00844  1036   NtFlushInstructionCache  (-1, 11935744, 4096, ... ) == 0x0
 00845  1036   NtProtectVirtualMemory  (-1, (0xb62000), 4096, 4, ... (0xb62000), 4096, 4, ) == 0x0
 00846  1036   NtProtectVirtualMemory  (-1, (0xb62000), 4096, 4, ... (0xb62000), 4096, 4, ) == 0x0
 00847  1036   NtFlushInstructionCache  (-1, 11935744, 4096, ... ) == 0x0
 00848  1036   NtOpenSection  (0xe, {24, 8, 0x40, 0, 0,  (0xe, {24, 8, 0x40, 0, 0, "WSOCK32.DLL"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00849  1036   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\u:\work\WSOCK32.DLL"}, 1241872, ... ) }, 1241872, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00850  1036   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\WSOCK32.DLL"}, 1241872, ... ) }, 1241872, ... ) == 0x0
 00851  1036   NtOpenFile  (0x100020, {24, 0, 0x40, 0, 0,  (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\WSOCK32.DLL"}, 5, 96, ... 104, {status=0x0, info=1}, ) }, 5, 96, ... 104, {status=0x0, info=1}, ) == 0x0
 00852  1036   NtCreateSection  (0xf, 0x0, 0x0, 16, 16777216, 104, ... 108, ) == 0x0
 00853  1036   NtQuerySection  (108, Image, 48, ... {section info, class 1, size 48}, 0x0, ) == 0x0
 00854  1036   NtClose  (104, ... ) == 0x0
 00855  1036   NtMapViewOfSection  (108, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x71ad0000), 0x0, 36864, ) == 0x0
 00856  1036   NtClose  (108, ... ) == 0x0
 00857  1036   NtProtectVirtualMemory  (-1, (0x71ad1000), 52, 4, ... (0x71ad1000), 4096, 32, ) == 0x0
 00858  1036   NtProtectVirtualMemory  (-1, (0x71ad1000), 4096, 32, ... (0x71ad1000), 4096, 4, ) == 0x0
 00859  1036   NtFlushInstructionCache  (-1, 1907167232, 52, ... ) == 0x0
 00860  1036   NtProtectVirtualMemory  (-1, (0xb62000), 4096, 4, ... (0xb62000), 4096, 4, ) == 0x0
 00861  1036   NtProtectVirtualMemory  (-1, (0xb62000), 4096, 4, ... (0xb62000), 4096, 4, ) == 0x0
 00862  1036   NtFlushInstructionCache  (-1, 11935744, 4096, ... ) == 0x0
 00863  1036   NtOpenKey  (0x80000000, {24, 0, 0x40, 0, 0,  (0x80000000, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\COMCTL32.DLL"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00864  1036   NtQuerySystemInformation  (Basic, 44, ... {Unknown=0,MaximumIncrement=156250,PhysicalPageSize=0x1000,NumberOfPhysicalPages=0xff7c,LowestPhysicalPage=0x1,HighestPhysicalPage=0xffff,AllocationGranularity=0x10000,LowestUserAddress=0x10000,HighestUserAddress=0x7ffeffff,ActiveProcessors=1,NumberProcessors=1,}, 0x0, ) == 0x0
 00865  1036   NtAllocateVirtualMemory  (-1, 0, 0, 65536, 8192, 4, ... 3604480, 65536, ) == 0x0
 00866  1036   NtAllocateVirtualMemory  (-1, 3604480, 0, 4096, 4096, 4, ... 3604480, 4096, ) == 0x0
 00867  1036   NtAllocateVirtualMemory  (-1, 3608576, 0, 8192, 4096, 4, ... 3608576, 8192, ) == 0x0
 00868  1036   NtAllocateVirtualMemory  (-1, 3616768, 0, 4096, 4096, 4, ... 3616768, 4096, ) == 0x0
 00869  1036   NtAllocateVirtualMemory  (-1, 3620864, 0, 4096, 4096, 4, ... 3620864, 4096, ) == 0x0
 00870  1036   NtQueryDefaultUILanguage  (1240988, ...
 00871  1036   NtOpenThreadTokenEx  (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN
 00872  1036   NtOpenProcessTokenEx  (-1, 0x20008, 512, ... -2147482740, ) == 0x0
 00873  1036   NtQueryInformationToken  (-2147482740, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0
 00874  1036   NtClose  (-2147482740, ... ) == 0x0
 00875  1036   NtOpenKey  (0x2000000, {24, 0, 0x640, 0, 0,  (0x2000000, {24, 0, 0x640, 0, 0, "\REGISTRY\USER\S-1-5-21-1292428093-1383384898-725345543-1003"}, ... -2147482740, ) }, ... -2147482740, ) == 0x0
 00876  1036   NtOpenKey  (0x80000000, {24, -2147482740, 0x240, 0, 0,  (0x80000000, {24, -2147482740, 0x240, 0, 0, "Software\Policies\Microsoft\Control Panel\Desktop"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00877  1036   NtOpenKey  (0x80000000, {24, -2147482740, 0x640, 0, 0,  (0x80000000, {24, -2147482740, 0x640, 0, 0, "Control Panel\Desktop"}, ... -2147481328, ) }, ... -2147481328, ) == 0x0
 00878  1036   NtQueryValueKey  (-2147481328,  (-2147481328, "MultiUILanguageId", Partial, 256, ... ) , Partial, 256, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00879  1036   NtClose  (-2147481328, ... ) == 0x0
 00880  1036   NtClose  (-2147482740, ... ) == 0x0
 00870  1036   NtQueryDefaultUILanguage  ... ) == 0x0
 00881  1036   NtOpenFile  (0x1200a9, {24, 0, 0x40, 0, 0,  (0x1200a9, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\COMCTL32.DLL"}, 1, 96, ... 108, {status=0x0, info=1}, ) }, 1, 96, ... 108, {status=0x0, info=1}, ) == 0x0
 00882  1036   NtCreateSection  (0x4, 0x0, 0x0, 2, 134217728, 108, ... 104, ) == 0x0
 00883  1036   NtMapViewOfSection  (104, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 2, ... (0xb70000), 0x0, 618496, ) == 0x0
 00884  1036   NtOpenFile  (0x1200a9, {24, 0, 0x40, 0, 0,  (0x1200a9, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\COMCTL32.DLL.124.Manifest"}, 1, 96, ... ) }, 1, 96, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00885  1036   NtQueryDefaultLocale  (1, 1239084, ... ) == 0x0
 00886  1036   NtOpenFile  (0x1200a9, {24, 0, 0x40, 0, 0,  (0x1200a9, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\COMCTL32.DLL.124.Config"}, 1, 96, ... ) }, 1, 96, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00887  1036   NtRequestWaitReplyPort  (24, {128, 156, new_msg, 0, 2088850039, 1240120, 1179817, 1239844}  (24, {128, 156, new_msg, 0, 2088850039, 1240120, 1179817, 1239844} "\210\6\31\1\33\0\1\0`\0\0\0\0\0\0\0\1\0\0\0\0\0\11\4\1\1\1\0@\0D\0\250\6\31\1l\0\0\0\377\377\377\377\0\0\0\0\340q\276\0\0\0\0\0k\10\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0(\0,\0\354\6\31\1\0\0\0\0\0\0\0\0,\360\22\0\0\0\0\0" ... {128, 156, reply, 0, 1248, 1036, 57974, 0} "\300\270\26\0\33\0\1\0\0\0\0\0\0\0\0\0\1\0\0\0\0\0\11\4\1\1\1\0@\0D\0\250\6\31\1l\0\0\0\377\377\377\377\0\0\0\0\340q\276\0\0\0\0\0k\10\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0(\0,\0\354\6\31\1\0\0\0\0\0\0\0\0,\360\22\0\0\0\0\0" )  ... {128, 156, reply, 0, 1248, 1036, 57974, 0}  (24, {128, 156, new_msg, 0, 2088850039, 1240120, 1179817, 1239844} "\210\6\31\1\33\0\1\0`\0\0\0\0\0\0\0\1\0\0\0\0\0\11\4\1\1\1\0@\0D\0\250\6\31\1l\0\0\0\377\377\377\377\0\0\0\0\340q\276\0\0\0\0\0k\10\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0(\0,\0\354\6\31\1\0\0\0\0\0\0\0\0,\360\22\0\0\0\0\0" ... {128, 156, reply, 0, 1248, 1036, 57974, 0} "\300\270\26\0\33\0\1\0\0\0\0\0\0\0\0\0\1\0\0\0\0\0\11\4\1\1\1\0@\0D\0\250\6\31\1l\0\0\0\377\377\377\377\0\0\0\0\340q\276\0\0\0\0\0k\10\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0(\0,\0\354\6\31\1\0\0\0\0\0\0\0\0,\360\22\0\0\0\0\0" )  ) == 0x0
 00888  1036   NtClose  (108, ... ) == 0x0
 00889  1036   NtClose  (104, ... ) == 0x0
 00890  1036   NtUnmapViewOfSection  (-1, 0xb70000, ... ) == 0x0
 00891  1036   NtQueryDebugFilterState  (53, 2, ... ) == 0x0
 00892  1036   NtOpenProcess  (0x400, {24, 0, 0x0, 0, 0, 0x0}, {1248, 0}, ... 104, ) == 0x0
 00893  1036   NtQueryInformationProcess  (104, Session, 4, ... {SessionId=0,}, 0x0, ) == 0x0
 00894  1036   NtClose  (104, ... ) == 0x0
 00895  1036   NtUserRegisterWindowMessage  ( ("ShellGetDragImage", ... ) , ... ) == 0xc03a
 00896  1036   NtUserSystemParametersInfo  (104, 0, 1561338260, 0, ... ) == 0x1
 00897  1036   NtUserSystemParametersInfo  (38, 4, 1561337988, 0, ... ) == 0x1
 00898  1036   NtOpenThreadTokenEx  (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN
 00899  1036   NtOpenProcessTokenEx  (-1, 0x20008, 512, ... 104, ) == 0x0
 00900  1036   NtQueryInformationToken  (104, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0
 00901  1036   NtClose  (104, ... ) == 0x0
 00902  1036   NtOpenKey  (0x20019, {24, 0, 0x640, 0, 0,  (0x20019, {24, 0, 0x640, 0, 0, "\REGISTRY\USER\S-1-5-21-1292428093-1383384898-725345543-1003"}, ... 104, ) }, ... 104, ) == 0x0
 00903  1036   NtOpenProcessToken  (-1, 0x8, ... 108, ) == 0x0
 00904  1036   NtAccessCheck  (1335152, 108, 0x1, 1242180, 1242232, 56, 1242212, ... ) == STATUS_NO_IMPERSONATION_TOKEN
 00905  1036   NtClose  (108, ... ) == 0x0
 00906  1036   NtOpenKey  (0x20019, {24, 104, 0x40, 0, 0,  (0x20019, {24, 104, 0x40, 0, 0, "Control Panel\Desktop"}, ... 108, ) }, ... 108, ) == 0x0
 00907  1036   NtQueryValueKey  (108,  (108, "SmoothScroll", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00908  1036   NtClose  (108, ... ) == 0x0
 00909  1036   NtUserSystemParametersInfo  (41, 500, 1242360, 0, ... ) == 0x1
 00910  1036   NtUserSystemParametersInfo  (102, 0, 1561338280, 0, ... ) == 0x1
 00911  1036   NtClose  (104, ... ) == 0x0
 00912  1036   NtAllocateVirtualMemory  (-1, 1339392, 0, 4096, 4096, 4, ... 1339392, 4096, ) == 0x0
 00913  1036   NtUserFindExistingCursorIcon  (1242112, 1242128, 1242176, ... ) == 0x10011
 00914  1036   NtUserRegisterClassExWOW  (1242056, 1242124, 1242140, 1242156, 0, 384, 0, ... ) == 0x8173c03b
 00915  1036   NtUserRegisterClassExWOW  (1242056, 1242124, 1242140, 1242156, 0, 384, 0, ... ) == 0x8173c03d
 00916  1036   NtUserFindExistingCursorIcon  (1242112, 1242128, 1242176, ... ) == 0x10011
 00917  1036   NtUserRegisterClassExWOW  (1242056, 1242124, 1242140, 1242156, 0, 384, 0, ... ) == 0x8173c03f
 00918  1036   NtUserFindExistingCursorIcon  (1242112, 1242128, 1242176, ... ) == 0x10011
 00919  1036   NtUserRegisterClassExWOW  (1242056, 1242124, 1242140, 1242156, 0, 384, 0, ... ) == 0x8173c041
 00920  1036   NtUserFindExistingCursorIcon  (1242112, 1242128, 1242176, ... ) == 0x10011
 00921  1036   NtUserRegisterClassExWOW  (1242056, 1242124, 1242140, 1242156, 0, 384, 0, ... ) == 0x8173c043
 00922  1036   NtUserRegisterClassExWOW  (1242056, 1242124, 1242140, 1242156, 0, 384, 0, ... ) == 0x8173c045
 00923  1036   NtUserFindExistingCursorIcon  (1242112, 1242128, 1242176, ... ) == 0x10011
 00924  1036   NtUserRegisterClassExWOW  (1242056, 1242124, 1242140, 1242156, 0, 384, 0, ... ) == 0x8173c047
 00925  1036   NtUserFindExistingCursorIcon  (1242112, 1242128, 1242176, ... ) == 0x10011
 00926  1036   NtUserRegisterClassExWOW  (1242056, 1242124, 1242140, 1242156, 0, 384, 0, ... ) == 0x8173c049
 00927  1036   NtUserFindExistingCursorIcon  (1242112, 1242128, 1242176, ... ) == 0x10011
 00928  1036   NtUserRegisterClassExWOW  (1242056, 1242124, 1242140, 1242156, 0, 384, 0, ... ) == 0x8173c04b
 00929  1036   NtUserFindExistingCursorIcon  (1242112, 1242128, 1242176, ... ) == 0x10011
 00930  1036   NtUserRegisterClassExWOW  (1242056, 1242124, 1242140, 1242156, 0, 384, 0, ... ) == 0x8173c04d
 00931  1036   NtUserFindExistingCursorIcon  (1242112, 1242128, 1242176, ... ) == 0x10011
 00932  1036   NtUserRegisterClassExWOW  (1242056, 1242124, 1242140, 1242156, 0, 384, 0, ... ) == 0x8173c04f
 00933  1036   NtUserRegisterClassExWOW  (1242056, 1242124, 1242140, 1242156, 0, 384, 0, ... ) == 0x8173c051
 00934  1036   NtUserFindExistingCursorIcon  (1242112, 1242128, 1242176, ... ) == 0x10011
 00935  1036   NtUserRegisterClassExWOW  (1242056, 1242124, 1242140, 1242156, 0, 384, 0, ... ) == 0x8173c053
 00936  1036   NtUserFindExistingCursorIcon  (1242108, 1242124, 1242172, ... ) == 0x10011
 00937  1036   NtUserRegisterClassExWOW  (1242052, 1242120, 1242136, 1242152, 0, 384, 0, ... ) == 0x8173c055
 00938  1036   NtUserFindExistingCursorIcon  (1242108, 1242124, 1242172, ... ) == 0x10011
 00939  1036   NtUserRegisterClassExWOW  (1242052, 1242120, 1242136, 1242152, 0, 384, 0, ... ) == 0x8173c057
 00940  1036   NtUserFindExistingCursorIcon  (1242112, 1242128, 1242176, ... ) == 0x10011
 00941  1036   NtUserRegisterClassExWOW  (1242056, 1242124, 1242140, 1242156, 0, 384, 0, ... ) == 0x8173c059
 00942  1036   NtUserFindExistingCursorIcon  (1242112, 1242128, 1242176, ... ) == 0x10013
 00943  1036   NtUserRegisterClassExWOW  (1242056, 1242124, 1242140, 1242156, 0, 384, 0, ... ) == 0x8173c05b
 00944  1036   NtUserFindExistingCursorIcon  (1242112, 1242128, 1242176, ... ) == 0x10011
 00945  1036   NtUserRegisterClassExWOW  (1242056, 1242124, 1242140, 1242156, 0, 384, 0, ... ) == 0x8173c05d
 00946  1036   NtUserFindExistingCursorIcon  (1242112, 1242128, 1242176, ... ) == 0x10011
 00947  1036   NtUserRegisterClassExWOW  (1242056, 1242124, 1242140, 1242156, 0, 384, 0, ... ) == 0x8173c05f
 00948  1036   NtOpenKey  (0x80000000, {24, 0, 0x40, 0, 0,  (0x80000000, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MPR.DLL"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00949  1036   NtCreateSemaphore  (0x1f0003, 0x0, 1, 1, ... 104, ) == 0x0
 00950  1036   NtCreateEvent  (0x1f0003, 0x0, 0, 0, ... 108, ) == 0x0
 00951  1036   NtOpenKey  (0x20019, {24, 16, 0x40, 0, 0,  (0x20019, {24, 16, 0x40, 0, 0, "system\CurrentControlSet\control\NetworkProvider\HwOrder"}, ... 112, ) }, ... 112, ) == 0x0
 00952  1036   NtNotifyChangeKey  (112, 108, 0, 0, 2011455960, 4, 0, 0, 0, 1, ... ) == 0x103
 00953  1036   NtQueryInformationProcess  (-1, 28, 4, ... {process info, class 28, size 4}, 0x0, ) == 0x0
 00954  1036   NtCreateSemaphore  (0x100003, 0x0, 0, 2147483647, ... 116, ) == 0x0
 00955  1036   NtCreateSemaphore  (0x100003, 0x0, 0, 2147483647, ... 120, ) == 0x0
 00956  1036   NtOpenKey  (0x80000000, {24, 0, 0x40, 0, 0,  (0x80000000, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\OLE32.DLL"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00957  1036   NtOpenFile  (0x100001, {24, 0, 0x40, 0, 0,  (0x100001, {24, 0, 0x40, 0, 0, "\Device\KsecDD"}, 7, 16, ... 124, {status=0x0, info=0}, ) }, 7, 16, ... 124, {status=0x0, info=0}, ) == 0x0
 00958  1036   NtDeviceIoControlFile  (124, 0, 0x0, 0x0, 0x390008,  (124, 0, 0x0, 0x0, 0x390008, "TX#\355\211@\260\217\305\3358\273\253"*\204\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0", 256, 256, ... *\204\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0", 256, 256, ...
 00959  1036   NtQuerySystemInformation  (TimeOfDay, 48, ... {system info, class 3, size 48}, 48, ) == 0x0
 00960  1036   NtQuerySystemInformation  (ProcessorTimes, 48, ... {system info, class 8, size 48}, 48, ) == 0x0
 00961  1036   NtQuerySystemInformation  (Performance, 312, ... {system info, class 2, size 312}, 312, ) == 0x0
 00962  1036   NtQuerySystemInformation  (Exception, 16, ... {system info, class 33, size 16}, 16, ) == 0x0
 00963  1036   NtQuerySystemInformation  (Lookaside, 32, ... {system info, class 45, size 32}, 32, ) == 0x0
 00964  1036   NtQuerySystemInformation  (ProcessorStatistics, 3016, ... {system info, class 23, size 0}, 0, ) == 0x0
 00965  1036   NtQuerySystemInformation  (ProcessesAndThreads, 3008, ... ) == STATUS_INFO_LENGTH_MISMATCH
 00966  1036   NtCreateKey  (0x2, {24, 0, 0x240, 0, 0,  (0x2, {24, 0, 0x240, 0, 0, "\Registry\Machine\SOFTWARE\Microsoft\Cryptography\RNG"}, 0, 0x0, 0, ... -2147482740, 2, ) }, 0, 0x0, 0, ... -2147482740, 2, ) == 0x0
 00967  1036   NtSetValueKey  (-2147482740,  (-2147482740, "Seed", 0, 3, "\270\262\324z\36\306\256\31\214\313#\326"QI\3473\346\205\1X\204A{\204/,\375F`\257'\376\211\265f\222\220J\5\317\224\6x\274\324\3338\344\376\330 w\227X\246\3609\15\250r\212\246\207#/\207\233\316Q,\262\232i\3\210\237t\\326", 80, ... ) , 0, 3,  (-2147482740, "Seed", 0, 3, "\270\262\324z\36\306\256\31\214\313#\326"QI\3473\346\205\1X\204A{\204/,\375F`\257'\376\211\265f\222\220J\5\317\224\6x\274\324\3338\344\376\330 w\227X\246\3609\15\250r\212\246\207#/\207\233\316Q,\262\232i\3\210\237t\\326", 80, ... ) QI\3473\346\205\1X\204A{\204/,\375F`\257'\376\211\265f\222\220J\5\317\224\6x\274\324\3338\344\376\330 w\227X\246\3609\15\250r\212\246\207#/\207\233\316Q,\262\232i\3\210\237t\\326", 80, ... ) == 0x0
 00968  1036   NtClose  (-2147482740, ... ) == 0x0
 00958  1036   NtDeviceIoControlFile  ... {status=0x0, info=256},  ... {status=0x0, info=256}, "#/\354\322%|1\210J\222\240h\203\307E\215\272t3f\272\177\332\274\233\307R>?3\202c\250\262\363*\223s\77`X\313 \225\11\220j\334\256\240/0D\364\313\233\17\274\202\363A\346\340\16\252>\356\276\253[3\20\261\277\244\203\227T\362J\2\3\331C\376M\12\243\343I\300\264\303\370V\342^\363R\323\31\370\204\11\335e\22\203c\233\307\206ZQ)\24b\2\24\27\215\346S:\3572\301L}>@\17\341a\353&\1Q\37U\263\27\300V\220)\230\271p\201\253$\333V\276p\324\210@\y\263\373\340\370n\327#\256\251\235\255\255-\300kE\264d{k\320\216I\27fX\13\335Xk\273\3_\23\236\20367jV\3431\370'\352l\237\361C\350?\26\14\350\14\32S\241\1\34\345(q\214E\351}\243NC\237\b\263\246'\207-\323\306\343M\\351[X{\336\11\253\214}\16", ) , ) == 0x0
 00969  1036   NtQuerySystemInformation  (Basic, 44, ... {Unknown=0,MaximumIncrement=156250,PhysicalPageSize=0x1000,NumberOfPhysicalPages=0xff7c,LowestPhysicalPage=0x1,HighestPhysicalPage=0xffff,AllocationGranularity=0x10000,LowestUserAddress=0x10000,HighestUserAddress=0x7ffeffff,ActiveProcessors=1,NumberProcessors=1,}, 0x0, ) == 0x0
 00970  1036   NtQuerySystemInformation  (Processor, 12, ... {system info, class 1, size 12}, 0x0, ) == 0x0
 00971  1036   NtOpenKey  (0x20019, {24, 16, 0x40, 0, 0,  (0x20019, {24, 16, 0x40, 0, 0, "SYSTEM\CurrentControlSet\Control\Session Manager"}, ... 128, ) }, ... 128, ) == 0x0
 00972  1036   NtQueryValueKey  (128,  (128, "CriticalSectionTimeout", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\215'\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (128, "CriticalSectionTimeout", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\215'\0"}, 16, ) }, 16, ) == 0x0
 00973  1036   NtClose  (128, ... ) == 0x0
 00974  1036   NtOpenKey  (0x20019, {24, 16, 0x40, 0, 0,  (0x20019, {24, 16, 0x40, 0, 0, "Software\Microsoft\Ole"}, ... 128, ) }, ... 128, ) == 0x0
 00975  1036   NtQueryValueKey  (128,  (128, "RWLockResourceTimeOut", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00976  1036   NtClose  (128, ... ) == 0x0
 00977  1036   NtQuerySystemInformation  (Basic, 44, ... {Unknown=0,MaximumIncrement=156250,PhysicalPageSize=0x1000,NumberOfPhysicalPages=0xff7c,LowestPhysicalPage=0x1,HighestPhysicalPage=0xffff,AllocationGranularity=0x10000,LowestUserAddress=0x10000,HighestUserAddress=0x7ffeffff,ActiveProcessors=1,NumberProcessors=1,}, 0x0, ) == 0x0
 00978  1036   NtQuerySystemInformation  (Processor, 12, ... {system info, class 1, size 12}, 0x0, ) == 0x0
 00979  1036   NtQuerySystemInformation  (Basic, 44, ... {Unknown=0,MaximumIncrement=156250,PhysicalPageSize=0x1000,NumberOfPhysicalPages=0xff7c,LowestPhysicalPage=0x1,HighestPhysicalPage=0xffff,AllocationGranularity=0x10000,LowestUserAddress=0x10000,HighestUserAddress=0x7ffeffff,ActiveProcessors=1,NumberProcessors=1,}, 0x0, ) == 0x0
 00980  1036   NtQuerySystemInformation  (Processor, 12, ... {system info, class 1, size 12}, 0x0, ) == 0x0
 00981  1036   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Classes\Interface"}, ... 128, ) }, ... 128, ) == 0x0
 00982  1036   NtQueryValueKey  (128,  (128, "InterfaceHelperDisableAll", Full, 0, ... ) , Full, 0, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00983  1036   NtQueryValueKey  (128,  (128, "InterfaceHelperDisableAllForOle32", Full, 0, ... ) , Full, 0, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00984  1036   NtQueryValueKey  (128,  (128, "InterfaceHelperDisableTypeLib", Full, 0, ... ) , Full, 0, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00985  1036   NtClose  (128, ... ) == 0x0
 00986  1036   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Classes\Interface\{00020400-0000-0000-C000-000000000046}"}, ... 128, ) }, ... 128, ) == 0x0
 00987  1036   NtQueryValueKey  (128,  (128, "InterfaceHelperDisableAll", Full, 0, ... ) , Full, 0, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00988  1036   NtQueryValueKey  (128,  (128, "InterfaceHelperDisableAllForOle32", Full, 0, ... ) , Full, 0, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00989  1036   NtClose  (128, ... ) == 0x0
 00990  1036   NtOpenEvent  (0x1f0003, {24, 44, 0x0, 0, 0,  (0x1f0003, {24, 44, 0x0, 0, 0, "HookSwitchHookEnabledEvent"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00991  1036   NtOpenKey  (0x80000000, {24, 0, 0x40, 0, 0,  (0x80000000, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\OLEAUT32.DLL"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00992  1036   NtUserRegisterWindowMessage  ( ("{FB8F0821-0164-101B-84ED-08002B2EC713}", ... ) , ... ) == 0xc077
 00993  1036   NtOpenKey  (0x1, {24, 16, 0x40, 0, 0,  (0x1, {24, 16, 0x40, 0, 0, "SOFTWARE\Microsoft\OLEAUT"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00994  1036   NtOpenKey  (0x9, {24, 16, 0x40, 0, 0,  (0x9, {24, 16, 0x40, 0, 0, "SOFTWARE\Microsoft\OLEAUT\UserEra"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00995  1036   NtAllocateVirtualMemory  (-1, 1343488, 0, 4096, 4096, 4, ... 1343488, 4096, ) == 0x0
 00996  1036   NtOpenKey  (0x1, {24, 16, 0x40, 0, 0,  (0x1, {24, 16, 0x40, 0, 0, "SOFTWARE\Microsoft\OLEAUT"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00997  1036   NtOpenKey  (0x80000000, {24, 0, 0x40, 0, 0,  (0x80000000, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\WSOCK32.DLL"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00998  1036   NtQueryPerformanceCounter  (... {926204966, 10}, {3579545, 0}, ) == 0x0
 00999  1036   NtOpenKey  (0x80000000, {24, 0, 0x40, 0, 0,  (0x80000000, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\bas2.tmp"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01000  1036   NtUserCallOneParam  (0, 41, ... ) == 0x4
 01001  1036   NtAllocateVirtualMemory  (-1, 1347584, 0, 8192, 4096, 4, ... 1347584, 8192, ) == 0x0
 01002  1036   NtQueryVirtualMemory  (-1, 0x12f630, Basic, 28, ... {BaseAddress=0x12f000,AllocationBase=0x30000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 28, ) == 0x0
 01003  1036   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 1, ... 11993088, 1048576, ) == 0x0
 01004  1036   NtAllocateVirtualMemory  (-1, 1355776, 0, 4096, 4096, 4, ... 1355776, 4096, ) == 0x0
 01005  1036   NtAllocateVirtualMemory  (-1, 11993088, 0, 16384, 4096, 4, ... 11993088, 16384, ) == 0x0
 01006  1036   NtQuerySystemInformation  (TimeZone, 172, ... {system info, class 44, size 172}, 0x0, ) == 0x0
 01007  1036   NtQuerySystemInformation  (TimeZone, 172, ... {system info, class 44, size 172}, 0x0, ) == 0x0
 01008  1036   NtOpenKey  (0xf003f, {24, 100, 0x40, 0, 0,  (0xf003f, {24, 100, 0x40, 0, 0, "Software\Borland\Locales"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01009  1036   NtOpenKey  (0xf003f, {24, 100, 0x40, 0, 0,  (0xf003f, {24, 100, 0x40, 0, 0, "Software\Borland\Delphi\Locales"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01010  1036   NtOpenProcessToken  (-1, 0x8, ... 128, ) == 0x0
 01011  1036   NtQueryInformationToken  (128, Statistics, 56, ... {token info, class 10, size 56}, 56, ) == 0x0
 01012  1036   NtClose  (128, ... ) == 0x0
 01013  1036   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\DOCUME~1\MARTIM~1\LOCALS~1\Temp\bas2.ENU"}, 1241100, ... ) }, 1241100, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01014  1036   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\DOCUME~1\MARTIM~1\LOCALS~1\Temp\bas2.ENU"}, 1240696, ... ) }, 1240696, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01015  1036   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\DOCUME~1\MARTIM~1\LOCALS~1\Temp\bas2.ENU.DLL"}, 1240696, ... ) }, 1240696, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01016  1036   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\DOCUME~1\MARTIM~1\LOCALS~1\Temp\bas2.EN"}, 1241100, ... ) }, 1241100, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01017  1036   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\DOCUME~1\MARTIM~1\LOCALS~1\Temp\bas2.EN"}, 1240696, ... ) }, 1240696, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01018  1036   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\DOCUME~1\MARTIM~1\LOCALS~1\Temp\bas2.EN.DLL"}, 1240696, ... ) }, 1240696, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01019  1036   NtCreateEvent  (0x1f0003, 0x0, 0, -1, ... 128, ) == 0x0
 01020  1036   NtUserGetDC  (0, ... ) == 0x1010051
 01021  1036   NtUserCallOneParam  (16842833, 57, ... ) == 0x1
 01022  1036   NtUserGetDC  (0, ... ) == 0x1010051
 01023  1036   NtUserCallOneParam  (16842833, 57, ... ) == 0x1
 01024  1036   NtGdiCreatePaletteInternal  (1241804, 16, ... ) == 0x330804e1
 01025  1036   NtGdiGetStockObject  (7, ... ) == 0x1b00017
 01026  1036   NtGdiGetStockObject  (5, ... ) == 0x1900015
 01027  1036   NtUserFindExistingCursorIcon  (1242168, 1242184, 1242232, ... ) == 0x10003
 01028  1036   NtAddAtom  ( ("D\0e\0l\0p\0h\0i\00\00\00\00\00\04\0E\00\0", 28, 1242732, ... ) , 28, 1242732, ... ) == 0x0
 01029  1036   NtAddAtom  ( ("C\0o\0n\0t\0r\0o\0l\0O\0f\0s\00\00\0A\0F\00\00\00\00\00\00\00\00\00\04\00\0C\0", 52, 1242732, ... ) , 52, 1242732, ... ) == 0x0
 01030  1036   NtUserSystemParametersInfo  (104, 0, 12000836, 0, ... ) == 0x1
 01031  1036   NtUserFindExistingCursorIcon  (1242052, 1242068, 1242116, ... ) == 0x10011
 01032  1036   NtUserFindExistingCursorIcon  (1242052, 1242068, 1242116, ... ) == 0x10023
 01033  1036   NtUserFindExistingCursorIcon  (1242052, 1242068, 1242116, ... ) == 0x0
 01034  1036   NtUserGetDC  (0, ... ) == 0x1010051
 01035  1036   NtGdiCreateDIBitmapInternal  (16842833, 32, 64, 2, 0, 2118583256, 0, 48, 0, 0, 0, ... ) == 0x2a050697
 01036  1036   NtUserCallOneParam  (16842833, 57, ... ) == 0x1
 01037  1036   NtGdiSelectBitmap  (-301922896, 704972439, ... ) == 0x185000f
 01038  1036   NtGdiGetDCforBitmap  (704972439, ... ) == 0xee0105b0
 01039  1036   NtGdiSaveDC  (-301922896, ... ) == 0x1
 01040  1036   NtGdiSelectBitmap  (-301922896, 704972439, ... ) == 0x2a050697
 01041  1036   NtGdiGetDCObject  (-301922896, 524288, ... ) == 0x188000b
 01042  1036   NtUserSelectPalette  (-301922896, 25690123, 0, ... ) == 0x188000b
 01043  1036   NtGdiSetDIBitsToDeviceInternal  (-301922896, 0, 0, 32, 64, 0, 0, 0, 64, 11875852, 1343256, 0, 256, 48, 1, 0, ... ) == 0x40
 01044  1036   NtUserSelectPalette  (-301922896, 25690123, 0, ... ) == 0x188000b
 01045  1036   NtGdiSelectBitmap  (-301922896, 704972439, ... ) == 0x2a050697
 01046  1036   NtGdiRestoreDC  (-301922896, -1, ... ) == 0x1
 01047  1036   NtGdiSelectBitmap  (-301922896, 25493519, ... ) == 0x2a050697
 01048  1036   NtGdiCreateCompatibleDC  (-301922896, ... ) == 0x73010798
 01049  1036   NtGdiExtGetObjectW  (704972439, 24, 1241212, ... ) == 0x18
 01050  1036   NtGdiCreateBitmap  (32, 64, 1, 1, 0, ... ) == 0x6f0506ed
 01051  1036   NtGdiSelectBitmap  (-301922896, 704972439, ... ) == 0x185000f
 01052  1036   NtGdiSelectBitmap  (1929447320, 1862600429, ... ) == 0x185000f
 01053  1036   NtGdiBitBlt  (1929447320, 0, 0, 32, 64, -301922896, 0, 0, 13369376, -1, 0, ... ) == 0x1
 01054  1036   NtGdiSelectBitmap  (-301922896, 25493519, ... ) == 0x2a050697
 01055  1036   NtGdiSelectBitmap  (1929447320, 25493519, ... ) == 0x6f0506ed
 01056  1036   NtGdiDeleteObjectApp  (704972439, ... ) == 0x1
 01057  1036   NtGdiDeleteObjectApp  (1929447320, ... ) == 0x1
 01058  1036   NtUserCallOneParam  (0, 33, ... ) == 0x601df
 01059  1036   NtUserSetCursorIconData  (393695, 1241316, 1241332, 1241396, ... ) == 0x1
 01060  1036   NtUserFindExistingCursorIcon  (1242052, 1242068, 1242116, ... ) == 0x10029
 01061  1036   NtUserFindExistingCursorIcon  (1242052, 1242068, 1242116, ... ) == 0x10027
 01062  1036   NtUserFindExistingCursorIcon  (1242052, 1242068, 1242116, ... ) == 0x10025
 01063  1036   NtUserFindExistingCursorIcon  (1242052, 1242068, 1242116, ... ) == 0x0
 01064  1036   NtUserGetDC  (0, ... ) == 0x1010051
 01065  1036   NtGdiCreateDIBitmapInternal  (16842833, 32, 64, 2, 0, 2118583256, 0, 48, 0, 0, 0, ... ) == 0x53050634
 01066  1036   NtUserCallOneParam  (16842833, 57, ... ) == 0x1
 01067  1036   NtGdiSelectBitmap  (-301922896, 1392838196, ... ) == 0x185000f
 01068  1036   NtGdiGetDCforBitmap  (1392838196, ... ) == 0xee0105b0
 01069  1036   NtGdiSaveDC  (-301922896, ... ) == 0x1
 01070  1036   NtGdiSelectBitmap  (-301922896, 1392838196, ... ) == 0x53050634
 01071  1036   NtGdiGetDCObject  (-301922896, 524288, ... ) == 0x188000b
 01072  1036   NtUserSelectPalette  (-301922896, 25690123, 0, ... ) == 0x188000b
 01073  1036   NtGdiSetDIBitsToDeviceInternal  (-301922896, 0, 0, 32, 64, 0, 0, 0, 64, 11876160, 1343256, 0, 256, 48, 1, 0, ... ) == 0x40
 01074  1036   NtUserSelectPalette  (-301922896, 25690123, 0, ... ) == 0x188000b
 01075  1036   NtGdiSelectBitmap  (-301922896, 1392838196, ... ) == 0x53050634
 01076  1036   NtGdiRestoreDC  (-301922896, -1, ... ) == 0x1
 01077  1036   NtGdiSelectBitmap  (-301922896, 25493519, ... ) == 0x53050634
 01078  1036   NtGdiCreateCompatibleDC  (-301922896, ... ) == 0x2c010697
 01079  1036   NtGdiExtGetObjectW  (1392838196, 24, 1241212, ... ) == 0x18
 01080  1036   NtGdiCreateBitmap  (32, 64, 1, 1, 0, ... ) == 0x3e05056c
 01081  1036   NtGdiSelectBitmap  (-301922896, 1392838196, ... ) == 0x185000f
 01082  1036   NtGdiSelectBitmap  (738264727, 1040516460, ... ) == 0x185000f
 01083  1036   NtGdiBitBlt  (738264727, 0, 0, 32, 64, -301922896, 0, 0, 13369376, -1, 0, ... ) == 0x1
 01084  1036   NtGdiSelectBitmap  (-301922896, 25493519, ... ) == 0x53050634
 01085  1036   NtGdiSelectBitmap  (738264727, 25493519, ... ) == 0x3e05056c
 01086  1036   NtGdiDeleteObjectApp  (1392838196, ... ) == 0x1
 01087  1036   NtGdiDeleteObjectApp  (738264727, ... ) == 0x1
 01088  1036   NtUserCallOneParam  (0, 33, ... ) == 0x18022f
 01089  1036   NtUserSetCursorIconData  (1573423, 1241316, 1241332, 1241396, ... ) == 0x1
 01090  1036   NtUserFindExistingCursorIcon  (1242052, 1242068, 1242116, ... ) == 0x0
 01091  1036   NtUserGetDC  (0, ... ) == 0x1010051
 01092  1036   NtGdiCreateDIBitmapInternal  (16842833, 32, 64, 2, 0, 2118583256, 0, 48, 0, 0, 0, ... ) == 0x75050798
 01093  1036   NtUserCallOneParam  (16842833, 57, ... ) == 0x1
 01094  1036   NtGdiSelectBitmap  (-301922896, 1963263896, ... ) == 0x185000f
 01095  1036   NtGdiGetDCforBitmap  (1963263896, ... ) == 0xee0105b0
 01096  1036   NtGdiSaveDC  (-301922896, ... ) == 0x1
 01097  1036   NtGdiSelectBitmap  (-301922896, 1963263896, ... ) == 0x75050798
 01098  1036   NtGdiGetDCObject  (-301922896, 524288, ... ) == 0x188000b
 01099  1036   NtUserSelectPalette  (-301922896, 25690123, 0, ... ) == 0x188000b
 01100  1036   NtGdiSetDIBitsToDeviceInternal  (-301922896, 0, 0, 32, 64, 0, 0, 0, 64, 11876468, 1343256, 0, 256, 48, 1, 0, ... ) == 0x40
 01101  1036   NtUserSelectPalette  (-301922896, 25690123, 0, ... ) == 0x188000b
 01102  1036   NtGdiSelectBitmap  (-301922896, 1963263896, ... ) == 0x75050798
 01103  1036   NtGdiRestoreDC  (-301922896, -1, ... ) == 0x1
 01104  1036   NtGdiSelectBitmap  (-301922896, 25493519, ... ) == 0x75050798
 01105  1036   NtGdiCreateCompatibleDC  (-301922896, ... ) == 0x55010634
 01106  1036   NtGdiExtGetObjectW  (1963263896, 24, 1241212, ... ) == 0x18
 01107  1036   NtGdiCreateBitmap  (32, 64, 1, 1, 0, ... ) == 0x9f05066e
 01108  1036   NtGdiSelectBitmap  (-301922896, 1963263896, ... ) == 0x185000f
 01109  1036   NtGdiSelectBitmap  (1426130484, -1627060626, ... ) == 0x185000f
 01110  1036   NtGdiBitBlt  (1426130484, 0, 0, 32, 64, -301922896, 0, 0, 13369376, -1, 0, ... ) == 0x1
 01111  1036   NtGdiSelectBitmap  (-301922896, 25493519, ... ) == 0x75050798
 01112  1036   NtGdiSelectBitmap  (1426130484, 25493519, ... ) == 0x9f05066e
 01113  1036   NtGdiDeleteObjectApp  (1963263896, ... ) == 0x1
 01114  1036   NtGdiDeleteObjectApp  (1426130484, ... ) == 0x1
 01115  1036   NtUserCallOneParam  (0, 33, ... ) == 0x501e3
 01116  1036   NtUserSetCursorIconData  (328163, 1241316, 1241332, 1241396, ... ) == 0x1
 01117  1036   NtUserFindExistingCursorIcon  (1242052, 1242068, 1242116, ... ) == 0x0
 01118  1036   NtUserGetDC  (0, ... ) == 0x1010051
 01119  1036   NtGdiCreateDIBitmapInternal  (16842833, 32, 64, 2, 0, 2118583256, 0, 48, 0, 0, 0, ... ) == 0x2e050697
 01120  1036   NtUserCallOneParam  (16842833, 57, ... ) == 0x1
 01121  1036   NtGdiSelectBitmap  (-301922896, 772081303, ... ) == 0x185000f
 01122  1036   NtGdiGetDCforBitmap  (772081303, ... ) == 0xee0105b0
 01123  1036   NtGdiSaveDC  (-301922896, ... ) == 0x1
 01124  1036   NtGdiSelectBitmap  (-301922896, 772081303, ... ) == 0x2e050697
 01125  1036   NtGdiGetDCObject  (-301922896, 524288, ... ) == 0x188000b
 01126  1036   NtUserSelectPalette  (-301922896, 25690123, 0, ... ) == 0x188000b
 01127  1036   NtGdiSetDIBitsToDeviceInternal  (-301922896, 0, 0, 32, 64, 0, 0, 0, 64, 11876776, 1343256, 0, 256, 48, 1, 0, ... ) == 0x40
 01128  1036   NtUserSelectPalette  (-301922896, 25690123, 0, ... ) == 0x188000b
 01129  1036   NtGdiSelectBitmap  (-301922896, 772081303, ... ) == 0x2e050697
 01130  1036   NtGdiRestoreDC  (-301922896, -1, ... ) == 0x1
 01131  1036   NtGdiSelectBitmap  (-301922896, 25493519, ... ) == 0x2e050697
 01132  1036   NtGdiCreateCompatibleDC  (-301922896, ... ) == 0x77010798
 01133  1036   NtGdiExtGetObjectW  (772081303, 24, 1241212, ... ) == 0x18
 01134  1036   NtGdiCreateBitmap  (32, 64, 1, 1, 0, ... ) == 0xc90504aa
 01135  1036   NtGdiSelectBitmap  (-301922896, 772081303, ... ) == 0x185000f
 01136  1036   NtGdiSelectBitmap  (1996556184, -922418006, ... ) == 0x185000f
 01137  1036   NtGdiBitBlt  (1996556184, 0, 0, 32, 64, -301922896, 0, 0, 13369376, -1, 0, ... ) == 0x1
 01138  1036   NtGdiSelectBitmap  (-301922896, 25493519, ... ) == 0x2e050697
 01139  1036   NtGdiSelectBitmap  (1996556184, 25493519, ... ) == 0xc90504aa
 01140  1036   NtGdiDeleteObjectApp  (772081303, ... ) == 0x1
 01141  1036   NtGdiDeleteObjectApp  (1996556184, ... ) == 0x1
 01142  1036   NtUserCallOneParam  (0, 33, ... ) == 0xc029d
 01143  1036   NtUserSetCursorIconData  (787101, 1241316, 1241332, 1241396, ... ) == 0x1
 01144  1036   NtUserFindExistingCursorIcon  (1242052, 1242068, 1242116, ... ) == 0x0
 01145  1036   NtUserGetDC  (0, ... ) == 0x1010051
 01146  1036   NtGdiCreateDIBitmapInternal  (16842833, 32, 64, 2, 0, 2118583256, 0, 48, 0, 0, 0, ... ) == 0x57050634
 01147  1036   NtUserCallOneParam  (16842833, 57, ... ) == 0x1
 01148  1036   NtGdiSelectBitmap  (-301922896, 1459947060, ... ) == 0x185000f
 01149  1036   NtGdiGetDCforBitmap  (1459947060, ... ) == 0xee0105b0
 01150  1036   NtGdiSaveDC  (-301922896, ... ) == 0x1
 01151  1036   NtGdiSelectBitmap  (-301922896, 1459947060, ... ) == 0x57050634
 01152  1036   NtGdiGetDCObject  (-301922896, 524288, ... ) == 0x188000b
 01153  1036   NtUserSelectPalette  (-301922896, 25690123, 0, ... ) == 0x188000b
 01154  1036   NtGdiSetDIBitsToDeviceInternal  (-301922896, 0, 0, 32, 64, 0, 0, 0, 64, 11877084, 1343256, 0, 256, 48, 1, 0, ... ) == 0x40
 01155  1036   NtUserSelectPalette  (-301922896, 25690123, 0, ... ) == 0x188000b
 01156  1036   NtGdiSelectBitmap  (-301922896, 1459947060, ... ) == 0x57050634
 01157  1036   NtGdiRestoreDC  (-301922896, -1, ... ) == 0x1
 01158  1036   NtGdiSelectBitmap  (-301922896, 25493519, ... ) == 0x57050634
 01159  1036   NtGdiCreateCompatibleDC  (-301922896, ... ) == 0x30010697
 01160  1036   NtGdiExtGetObjectW  (1459947060, 24, 1241212, ... ) == 0x18
 01161  1036   NtGdiCreateBitmap  (32, 64, 1, 1, 0, ... ) == 0x9d050551
 01162  1036   NtGdiSelectBitmap  (-301922896, 1459947060, ... ) == 0x185000f
 01163  1036   NtGdiSelectBitmap  (805373591, -1660615343, ... ) == 0x185000f
 01164  1036   NtGdiBitBlt  (805373591, 0, 0, 32, 64, -301922896, 0, 0, 13369376, -1, 0, ... ) == 0x1
 01165  1036   NtGdiSelectBitmap  (-301922896, 25493519, ... ) == 0x57050634
 01166  1036   NtGdiSelectBitmap  (805373591, 25493519, ... ) == 0x9d050551
 01167  1036   NtGdiDeleteObjectApp  (1459947060, ... ) == 0x1
 01168  1036   NtGdiDeleteObjectApp  (805373591, ... ) == 0x1
 01169  1036   NtUserCallOneParam  (0, 33, ... ) == 0x9024b
 01170  1036   NtUserSetCursorIconData  (590411, 1241316, 1241332, 1241396, ... ) == 0x1
 01171  1036   NtUserFindExistingCursorIcon  (1242052, 1242068, 1242116, ... ) == 0x0
 01172  1036   NtUserGetDC  (0, ... ) == 0x1010051
 01173  1036   NtGdiCreateDIBitmapInternal  (16842833, 32, 64, 2, 0, 2118583256, 0, 48, 0, 0, 0, ... ) == 0x79050798
 01174  1036   NtUserCallOneParam  (16842833, 57, ... ) == 0x1
 01175  1036   NtGdiSelectBitmap  (-301922896, 2030372760, ... ) == 0x185000f
 01176  1036   NtGdiGetDCforBitmap  (2030372760, ... ) == 0xee0105b0
 01177  1036   NtGdiSaveDC  (-301922896, ... ) == 0x1
 01178  1036   NtGdiSelectBitmap  (-301922896, 2030372760, ... ) == 0x79050798
 01179  1036   NtGdiGetDCObject  (-301922896, 524288, ... ) == 0x188000b
 01180  1036   NtUserSelectPalette  (-301922896, 25690123, 0, ... ) == 0x188000b
 01181  1036   NtGdiSetDIBitsToDeviceInternal  (-301922896, 0, 0, 32, 64, 0, 0, 0, 64, 11877700, 1343256, 0, 256, 48, 1, 0, ... ) == 0x40
 01182  1036   NtUserSelectPalette  (-301922896, 25690123, 0, ... ) == 0x188000b
 01183  1036   NtGdiSelectBitmap  (-301922896, 2030372760, ... ) == 0x79050798
 01184  1036   NtGdiRestoreDC  (-301922896, -1, ... ) == 0x1
 01185  1036   NtGdiSelectBitmap  (-301922896, 25493519, ... ) == 0x79050798
 01186  1036   NtGdiCreateCompatibleDC  (-301922896, ... ) == 0x59010634
 01187  1036   NtGdiExtGetObjectW  (2030372760, 24, 1241212, ... ) == 0x18
 01188  1036   NtGdiCreateBitmap  (32, 64, 1, 1, 0, ... ) == 0xab0506b2
 01189  1036   NtGdiSelectBitmap  (-301922896, 2030372760, ... ) == 0x185000f
 01190  1036   NtGdiSelectBitmap  (1493239348, -1425733966, ... ) == 0x185000f
 01191  1036   NtGdiBitBlt  (1493239348, 0, 0, 32, 64, -301922896, 0, 0, 13369376, -1, 0, ... ) == 0x1
 01192  1036   NtGdiSelectBitmap  (-301922896, 25493519, ... ) == 0x79050798
 01193  1036   NtGdiSelectBitmap  (1493239348, 25493519, ... ) == 0xab0506b2
 01194  1036   NtGdiDeleteObjectApp  (2030372760, ... ) == 0x1
 01195  1036   NtGdiDeleteObjectApp  (1493239348, ... ) == 0x1
 01196  1036   NtUserCallOneParam  (0, 33, ... ) == 0x1201a7
 01197  1036   NtUserSetCursorIconData  (1180071, 1241316, 1241332, 1241396, ... ) == 0x1
 01198  1036   NtUserFindExistingCursorIcon  (1242052, 1242068, 1242116, ... ) == 0x0
 01199  1036   NtUserGetDC  (0, ... ) == 0x1010051
 01200  1036   NtGdiCreateDIBitmapInternal  (16842833, 32, 64, 2, 0, 2118583256, 0, 48, 0, 0, 0, ... ) == 0x32050697
 01201  1036   NtUserCallOneParam  (16842833, 57, ... ) == 0x1
 01202  1036   NtGdiSelectBitmap  (-301922896, 839190167, ... ) == 0x185000f
 01203  1036   NtGdiGetDCforBitmap  (839190167, ... ) == 0xee0105b0
 01204  1036   NtGdiSaveDC  (-301922896, ... ) == 0x1
 01205  1036   NtGdiSelectBitmap  (-301922896, 839190167, ... ) == 0x32050697
 01206  1036   NtGdiGetDCObject  (-301922896, 524288, ... ) == 0x188000b
 01207  1036   NtUserSelectPalette  (-301922896, 25690123, 0, ... ) == 0x188000b
 01208  1036   NtGdiSetDIBitsToDeviceInternal  (-301922896, 0, 0, 32, 64, 0, 0, 0, 64, 11877392, 1343256, 0, 256, 48, 1, 0, ... ) == 0x40
 01209  1036   NtUserSelectPalette  (-301922896, 25690123, 0, ... ) == 0x188000b
 01210  1036   NtGdiSelectBitmap  (-301922896, 839190167, ... ) == 0x32050697
 01211  1036   NtGdiRestoreDC  (-301922896, -1, ... ) == 0x1
 01212  1036   NtGdiSelectBitmap  (-301922896, 25493519, ... ) == 0x32050697
 01213  1036   NtGdiCreateCompatibleDC  (-301922896, ... ) == 0x7b010798
 01214  1036   NtGdiExtGetObjectW  (839190167, 24, 1241212, ... ) == 0x18
 01215  1036   NtGdiCreateBitmap  (32, 64, 1, 1, 0, ... ) == 0xe0505d6
 01216  1036   NtGdiSelectBitmap  (-301922896, 839190167, ... ) == 0x185000f
 01217  1036   NtGdiSelectBitmap  (2063665048, 235210198, ... ) == 0x185000f
 01218  1036   NtGdiBitBlt  (2063665048, 0, 0, 32, 64, -301922896, 0, 0, 13369376, -1, 0, ... ) == 0x1
 01219  1036   NtGdiSelectBitmap  (-301922896, 25493519, ... ) == 0x32050697
 01220  1036   NtGdiSelectBitmap  (2063665048, 25493519, ... ) == 0xe0505d6
 01221  1036   NtGdiDeleteObjectApp  (839190167, ... ) == 0x1
 01222  1036   NtGdiDeleteObjectApp  (2063665048, ... ) == 0x1
 01223  1036   NtUserCallOneParam  (0, 33, ... ) == 0x402a3
 01224  1036   NtUserSetCursorIconData  (262819, 1241316, 1241332, 1241396, ... ) == 0x1
 01225  1036   NtUserFindExistingCursorIcon  (1242052, 1242068, 1242116, ... ) == 0x10015
 01226  1036   NtUserFindExistingCursorIcon  (1242052, 1242068, 1242116, ... ) == 0x10019
 01227  1036   NtUserFindExistingCursorIcon  (1242052, 1242068, 1242116, ... ) == 0x1001f
 01228  1036   NtUserFindExistingCursorIcon  (1242052, 1242068, 1242116, ... ) == 0x1001b
 01229  1036   NtUserFindExistingCursorIcon  (1242052, 1242068, 1242116, ... ) == 0x10021
 01230  1036   NtUserFindExistingCursorIcon  (1242052, 1242068, 1242116, ... ) == 0x1001d
 01231  1036   NtUserFindExistingCursorIcon  (1242052, 1242068, 1242116, ... ) == 0x10013
 01232  1036   NtUserFindExistingCursorIcon  (1242052, 1242068, 1242116, ... ) == 0x10017
 01233  1036   NtUserFindExistingCursorIcon  (1242052, 1242068, 1242116, ... ) == 0x10011
 01234  1036   NtUserCallOneParam  (0, 40, ... ) == 0x4090409
 01235  1036   NtUserGetDC  (0, ... ) == 0x1010051
 01236  1036   NtUserCallOneParam  (16842833, 57, ... ) == 0x1
 01237  1036   NtUserEnumDisplayMonitors  (0, 0, 11600484, 12001416, ... ) == 0x1
 01238  1036   NtUserSystemParametersInfo  (31, 60, 1241032, 0, ... ) == 0x1
 01239  1036   NtGdiHfontCreate  (1241912, 356, 0, 0, 1335224, ... ) == 0x7c0a0798
 01240  1036   NtGdiExtGetObjectW  (2081032088, 420, 1241736, ... ) == 0x164
 01241  1036   NtUserSystemParametersInfo  (41, 0, 1241232, 0, ... ) == 0x1
 01242  1036   NtGdiHfontCreate  (1241912, 356, 0, 0, 1335216, ... ) == 0x5b0a0634
 01243  1036   NtGdiExtGetObjectW  (1527383604, 420, 1241736, ... ) == 0x164
 01244  1036   NtGdiHfontCreate  (1241912, 356, 0, 0, 1335208, ... ) == 0x330a0697
 01245  1036   NtGdiExtGetObjectW  (856295063, 420, 1241736, ... ) == 0x164
 01246  1036   NtUserFindExistingCursorIcon  (1241812, 1241828, 1241876, ... ) == 0x0
 01247  1036   NtAllocateVirtualMemory  (-1, 0, 0, 4096, 4096, 64, ... 3801088, 4096, ) == 0x0
 01248  1036   NtUserGetKeyboardLayoutList  (64, 1242400, ... ) == 0x1
 01249  1036   NtUserRegisterWindowMessage  ( ("Delphi Picture", ... ) , ... ) == 0xc13a
 01250  1036   NtUserRegisterWindowMessage  ( ("Delphi Component", ... ) , ... ) == 0xc13b
 01251  1036   NtOpenMutant  (0x1f0001, {24, 44, 0x0, 0, 0,  (0x1f0001, {24, 44, 0x0, 0, 0, "Residented"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01252  1036   NtUserSetWindowsHookEx  (11468800, 1243784, 0, 4, 11476668, 2, ... ) == 0x90299
 01253  1036   NtQueryVirtualMemory  (-1, 0x31428210, Basic, 28, ... {BaseAddress=0x31428000,AllocationBase=0x31420000,AllocationProtect=0x80,RegionSize=0x1000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 01254  1036   NtOpenFile  (0x10080, {24, 12, 0x40, 0, 0,  (0x10080, {24, 12, 0x40, 0, 0, "ftpupd.exe"}, 7, 2113600, ... ) }, 7, 2113600, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01255  1036   NtCreateMutant  (0x1f0001, {24, 44, 0x80, 0, 0,  (0x1f0001, {24, 44, 0x80, 0, 0, "uterm19"}, 1, ... 132, ) }, 1, ... 132, ) == 0x0
 01256  1036   NtOpenProcessToken  (-1, 0x20, ... 136, ) == 0x0
 01257  1036   NtQuerySystemInformation  (Basic, 44, ... {Unknown=0,MaximumIncrement=156250,PhysicalPageSize=0x1000,NumberOfPhysicalPages=0xff7c,LowestPhysicalPage=0x1,HighestPhysicalPage=0xffff,AllocationGranularity=0x10000,LowestUserAddress=0x10000,HighestUserAddress=0x7ffeffff,ActiveProcessors=1,NumberProcessors=1,}, 0x0, ) == 0x0
 01258  1036   NtOpenKey  (0x20019, {24, 16, 0x40, 0, 0,  (0x20019, {24, 16, 0x40, 0, 0, "Software\Microsoft\Rpc\PagedBuffers"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01259  1036   NtOpenKey  (0x20019, {24, 16, 0x40, 0, 0,  (0x20019, {24, 16, 0x40, 0, 0, "Software\Microsoft\Rpc"}, ... 140, ) }, ... 140, ) == 0x0
 01260  1036   NtQueryValueKey  (140,  (140, "MaxRpcSize", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01261  1036   NtClose  (140, ... ) == 0x0
 01262  1036   NtOpenKey  (0x20019, {24, 16, 0x40, 0, 0,  (0x20019, {24, 16, 0x40, 0, 0, "Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\packed.exe\RpcThreadPoolThrottle"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01263  1036   NtCreateEvent  (0x1f0003, 0x0, 1, 0, ... 140, ) == 0x0
 01264  1036   NtCreateEvent  (0x1f0003, 0x0, 1, 0, ... 144, ) == 0x0
 01265  1036   NtQuerySystemTime  (... {-596869278, 29915842}, ) == 0x0
 01266  1036   NtCreateEvent  (0x1f0003, 0x0, 0, 0, ... 148, ) == 0x0
 01267  1036   NtOpenKey  (0x20019, {24, 16, 0x40, 0, 0,  (0x20019, {24, 16, 0x40, 0, 0, "Software\Policies\Microsoft\Windows NT\Rpc"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01268  1036   NtQuerySystemInformation  (Performance, 312, ... {system info, class 2, size 312}, 0x0, ) == 0x0
 01269  1036   NtQueryInformationProcess  (-1, QuotaLimits, 32, ... {process info, class 1, size 32}, 0x0, ) == 0x0
 01270  1036   NtQueryInformationProcess  (-1, VmCounters, 44, ... {process info, class 3, size 44}, 0x0, ) == 0x0
 01271  1036   NtCreateEvent  (0x1f0003, 0x0, 0, 0, ... 152, ) == 0x0
 01272  1036   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ... 156, ) == 0x0
 01273  1036   NtAllocateVirtualMemory  (-1, 1359872, 0, 4096, 4096, 4, ... 1359872, 4096, ) == 0x0
 01274  1036   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\System\CurrentControlSet\Control\ComputerName"}, ... 160, ) }, ... 160, ) == 0x0
 01275  1036   NtOpenKey  (0x20019, {24, 160, 0x40, 0, 0,  (0x20019, {24, 160, 0x40, 0, 0, "ActiveComputerName"}, ... 164, ) }, ... 164, ) == 0x0
 01276  1036   NtQueryValueKey  (164,  (164, "ComputerName", Full, 108, ... TitleIdx=0, Type=1, Name="ComputerName", Data="V\0I\0R\0T\0U\0A\0L\0\0\0"}, 60, ) , Full, 108, ... TitleIdx=0, Type=1, Name= (164, "ComputerName", Full, 108, ... TitleIdx=0, Type=1, Name="ComputerName", Data="V\0I\0R\0T\0U\0A\0L\0\0\0"}, 60, ) , Data= (164, "ComputerName", Full, 108, ... TitleIdx=0, Type=1, Name="ComputerName", Data="V\0I\0R\0T\0U\0A\0L\0\0\0"}, 60, ) }, 60, ) == 0x0
 01277  1036   NtClose  (164, ... ) == 0x0
 01278  1036   NtClose  (160, ... ) == 0x0
 01279  1036   NtCreateIoCompletion  (0x1f0003, 0x0, 0, ... 160, ) == 0x0
 01280  1036   NtCreateIoCompletion  (0x1f0003, 0x0, -1, ... 164, ) == 0x0
 01281  1036   NtDuplicateObject  (-1, 160, -1, 0x0, 0, 2, ... 168, ) == 0x0
 01282  1036   NtOpenThreadToken  (-2, 0xc, 1, ... ) == STATUS_NO_TOKEN
 01283  1036   NtCreateEvent  (0x1f0003, 0x0, 1, 0, ... 172, ) == 0x0
 01284  1036   NtOpenThreadToken  (-2, 0xc, 1, ... ) == STATUS_NO_TOKEN
 01285  1036   NtSetInformationThread  (-2, ImpersonationToken, {ImpToken=0,}, 4, ... ) == 0x0
 01286  1036   NtCreateFile  (0xc0100080, {24, 0, 0x40, 0, 1243228,  (0xc0100080, {24, 0, 0x40, 0, 1243228, "\??\PIPE\lsarpc"}, 0x0, 0, 3, 1, 64, 0, 0, ... 176, {status=0x0, info=1}, ) }, 0x0, 0, 3, 1, 64, 0, 0, ... 176, {status=0x0, info=1}, ) == 0x0
 01287  1036   NtSetInformationFile  (176, 1243284, 8, Pipe, ... {status=0x0, info=0}, ) == 0x0
 01288  1036   NtSetInformationFile  (176, 1243272, 8, Completion, ... {status=0x0, info=0}, ) == 0x0
 01289  1036   NtSetInformationThread  (-2, ImpersonationToken, {ImpToken=0,}, 4, ... ) == 0x0
 01290  1036   NtWriteFile  (176, 153, 0, 0,  (176, 153, 0, 0, "\5\0\13\3\20\0\0\0H\0\0\0\1\0\0\0\270\20\270\20\0\0\0\0\1\0\0\0\0\0\1\0xW4\224\22\315\253\357\0\1#Eg\211\253\0\0\0\0\4]\210\212\353\34\311\21\237\350\10\0+\20H`\2\0\0\0", 72, {0, 0}, 0, ... {status=0x0, info=72}, ) , 72, {0, 0}, 0, ... {status=0x0, info=72}, ) == 0x0
 01291  1036   NtReadFile  (176, 153, 0, 0, 1024, {0, 0}, 0, ... {status=0x0, info=68},  (176, 153, 0, 0, 1024, {0, 0}, 0, ... {status=0x0, info=68}, "\5\0\14\3\20\0\0\0D\0\0\0\1\0\0\0\270\20\270\20++\0\0\14\0\PIPE\lsass\0\0\0\1\0\0\0\0\0\0\0\4]\210\212\353\34\311\21\237\350\10\0+\20H`\2\0\0\0", ) , ) == 0x0
 01292  1036   NtFsControlFile  (176, 153, 0x0, 0x0, 0x11c017,  (176, 153, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0@\0\0\0\1\0\0\0(\0\0\0\0\0,\0\0\0\0\0\30\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0$\377\22\0\14\0\0\0\2\0\1\0\0\10\0\0", 64, 1024, ... {status=0x103, info=68}, "\5\0\14\3\20\0\0\0D\0\0\0\1\0\0\0\270\20\270\20++\0\0\14\0\PIPE\lsass\0\0\0\1\0\0\0\0\0\0\0\4]\210\212\353\34\311\21\237\350\10\0+\20H`\2\0\0\0", ) , 64, 1024, ... {status=0x103, info=68},  (176, 153, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0@\0\0\0\1\0\0\0(\0\0\0\0\0,\0\0\0\0\0\30\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0$\377\22\0\14\0\0\0\2\0\1\0\0\10\0\0", 64, 1024, ... {status=0x103, info=68}, "\5\0\14\3\20\0\0\0D\0\0\0\1\0\0\0\270\20\270\20++\0\0\14\0\PIPE\lsass\0\0\0\1\0\0\0\0\0\0\0\4]\210\212\353\34\311\21\237\350\10\0+\20H`\2\0\0\0", ) , ) == 0x103
 01293  1036   NtFsControlFile  (176, 153, 0x0, 0x0, 0x11c017,  (176, 153, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0`\0\0\0\2\0\0\0H\0\0\0\0\0\37\0\0\0\0\0\266\275.l\215\373FC\227[\347p\214Nse \0"\0\200\264\24\0\21\0\0\0\0\0\0\0\20\0\0\0S\0e\0D\0e\0b\0u\0g\0P\0r\0i\0v\0i\0l\0e\0g\0e\0", 96, 1024, ... {status=0x103, info=48}, "\5\0\2\3\20\0\0\00\0\0\0\1\0\0\0\30\0\0\0\0\0\0\0\0\0\0\0\266\275.l\215\373FC\227[\347p\214Nse\0\0\0\0", ) \0\200\264\24\0\21\0\0\0\0\0\0\0\20\0\0\0S\0e\0D\0e\0b\0u\0g\0P\0r\0i\0v\0i\0l\0e\0g\0e\0 (176, 153, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0`\0\0\0\2\0\0\0H\0\0\0\0\0\37\0\0\0\0\0\266\275.l\215\373FC\227[\347p\214Nse \0"\0\200\264\24\0\21\0\0\0\0\0\0\0\20\0\0\0S\0e\0D\0e\0b\0u\0g\0P\0r\0i\0v\0i\0l\0e\0g\0e\0", 96, 1024, ... {status=0x103, info=48}, "\5\0\2\3\20\0\0\00\0\0\0\1\0\0\0\30\0\0\0\0\0\0\0\0\0\0\0\266\275.l\215\373FC\227[\347p\214Nse\0\0\0\0", ) \5\0\2\3\20\0\0\00\0\0\0\1\0\0\0\30\0\0\0\0\0\0\0\0\0\0\0\266\275.l\215\373FC\227[\347p\214Nse\0\0\0\0", ) == 0x103
 01294  1036   NtFsControlFile  (176, 153, 0x0, 0x0, 0x11c017,  (176, 153, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0,\0\0\0\3\0\0\0\24\0\0\0\0\0\0\0\0\0\0\0\266\275.l\215\373FC\227[\347p\214Nse", 44, 1024, ... {status=0x103, info=36}, "\5\0\2\3\20\0\0\0$\0\0\0\2\0\0\0\14\0\0\0\0\0\0\0\24\0\0\0\0\0\0\0\0\0\0\0", ) , 44, 1024, ... {status=0x103, info=36},  (176, 153, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0,\0\0\0\3\0\0\0\24\0\0\0\0\0\0\0\0\0\0\0\266\275.l\215\373FC\227[\347p\214Nse", 44, 1024, ... {status=0x103, info=36}, "\5\0\2\3\20\0\0\0$\0\0\0\2\0\0\0\14\0\0\0\0\0\0\0\24\0\0\0\0\0\0\0\0\0\0\0", ) , ) == 0x103
 01295  1036   NtClose  (172, ... ) == 0x0
 01296  1036   NtClose  (176, ... ) == 0x0
 01297  1036   NtAdjustPrivilegesToken  (136, 0, 1245080, 16, 0, 0, ... ) == 0x0
 01298  1036   NtOpenKey  (0xf003f, {24, 16, 0x40, 0, 0,  (0xf003f, {24, 16, 0x40, 0, 0, "SOFTWARE\Microsoft\Windows\CurrentVersion\Run"}, ... 176, ) }, ... 176, ) == 0x0
 01299  1036   NtQueryValueKey  (176,  (176, "Windows Security Manager", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01300  1036   NtClose  (176, ... ) == 0x0
 01301  1036   NtOpenKey  (0xf003f, {24, 16, 0x40, 0, 0,  (0xf003f, {24, 16, 0x40, 0, 0, "SOFTWARE\Microsoft\Windows\CurrentVersion\Run"}, ... 176, ) }, ... 176, ) == 0x0
 01302  1036   NtQueryValueKey  (176,  (176, "Disk Defragmenter", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01303  1036   NtClose  (176, ... ) == 0x0
 01304  1036   NtOpenKey  (0xf003f, {24, 16, 0x40, 0, 0,  (0xf003f, {24, 16, 0x40, 0, 0, "SOFTWARE\Microsoft\Windows\CurrentVersion\Run"}, ... 176, ) }, ... 176, ) == 0x0
 01305  1036   NtQueryValueKey  (176,  (176, "System Restore Service", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01306  1036   NtClose  (176, ... ) == 0x0
 01307  1036   NtOpenKey  (0xf003f, {24, 16, 0x40, 0, 0,  (0xf003f, {24, 16, 0x40, 0, 0, "SOFTWARE\Microsoft\Windows\CurrentVersion\Run"}, ... 176, ) }, ... 176, ) == 0x0
 01308  1036   NtQueryValueKey  (176,  (176, "Bot Loader", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01309  1036   NtClose  (176, ... ) == 0x0
 01310  1036   NtOpenKey  (0xf003f, {24, 16, 0x40, 0, 0,  (0xf003f, {24, 16, 0x40, 0, 0, "SOFTWARE\Microsoft\Windows\CurrentVersion\Run"}, ... 176, ) }, ... 176, ) == 0x0
 01311  1036   NtQueryValueKey  (176,  (176, "SysTray", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01312  1036   NtClose  (176, ... ) == 0x0
 01313  1036   NtOpenKey  (0xf003f, {24, 16, 0x40, 0, 0,  (0xf003f, {24, 16, 0x40, 0, 0, "SOFTWARE\Microsoft\Windows\CurrentVersion\Run"}, ... 176, ) }, ... 176, ) == 0x0
 01314  1036   NtQueryValueKey  (176,  (176, "WinUpdate", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01315  1036   NtClose  (176, ... ) == 0x0
 01316  1036   NtOpenKey  (0xf003f, {24, 16, 0x40, 0, 0,  (0xf003f, {24, 16, 0x40, 0, 0, "SOFTWARE\Microsoft\Windows\CurrentVersion\Run"}, ... 176, ) }, ... 176, ) == 0x0
 01317  1036   NtQueryValueKey  (176,  (176, "Windows Update Service", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01318  1036   NtClose  (176, ... ) == 0x0
 01319  1036   NtOpenKey  (0xf003f, {24, 16, 0x40, 0, 0,  (0xf003f, {24, 16, 0x40, 0, 0, "SOFTWARE\Microsoft\Windows\CurrentVersion\Run"}, ... 176, ) }, ... 176, ) == 0x0
 01320  1036   NtQueryValueKey  (176,  (176, "avserve.exe", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01321  1036   NtClose  (176, ... ) == 0x0
 01322  1036   NtOpenKey  (0xf003f, {24, 16, 0x40, 0, 0,  (0xf003f, {24, 16, 0x40, 0, 0, "SOFTWARE\Microsoft\Windows\CurrentVersion\Run"}, ... 176, ) }, ... 176, ) == 0x0
 01323  1036   NtQueryValueKey  (176,  (176, "avserve2.exeUpdate Service", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01324  1036   NtClose  (176, ... ) == 0x0
 01325  1036   NtOpenKey  (0xf003f, {24, 16, 0x40, 0, 0,  (0xf003f, {24, 16, 0x40, 0, 0, "SOFTWARE\Microsoft\Windows\CurrentVersion\Run"}, ... 176, ) }, ... 176, ) == 0x0
 01326  1036   NtQueryValueKey  (176,  (176, "MS Config v13", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01327  1036   NtClose  (176, ... ) == 0x0
 01328  1036   NtOpenKey  (0xf003f, {24, 16, 0x40, 0, 0,  (0xf003f, {24, 16, 0x40, 0, 0, "SOFTWARE\Microsoft\Windows\CurrentVersion\Run"}, ... 176, ) }, ... 176, ) == 0x0
 01329  1036   NtQueryValueKey  (176,  (176, "Windows Update", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01330  1036   NtClose  (176, ... ) == 0x0
 01331  1036   NtAllocateVirtualMemory  (-1, 1363968, 0, 4096, 4096, 4, ... 1363968, 4096, ) == 0x0
 01332  1036   NtOpenKey  (0xf003f, {24, 16, 0x40, 0, 0,  (0xf003f, {24, 16, 0x40, 0, 0, "Software\Microsoft\Wireless"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01333  1036   NtCreateKey  (0xf003f, {24, 16, 0x40, 0, 0,  (0xf003f, {24, 16, 0x40, 0, 0, "Software\Microsoft\Wireless"}, 0, 0x0, 0, ... }, 0, 0x0, 0, ...
 01334  1036   NtSetInformationFile  (-2147482448, -139611120, 8, EndOfFile, ... {status=0x0, info=0}, ) == 0x0
 01335  1036   NtSetInformationFile  (-2147482448, -139611588, 8, EndOfFile, ... {status=0x0, info=0}, ) == 0x0
 01336  1036   NtSetInformationFile  (-2147482448, -139611404, 8, EndOfFile, ... {status=0x0, info=0}, ) == 0x0
 01337  1036   NtSetInformationFile  (-2147482448, -139611216, 8, EndOfFile, ... {status=0x0, info=0}, ) == 0x0
 01333  1036   NtCreateKey  ... 176, 1, ) == 0x0
 01338  1036   NtSetValueKey  (176,  (176, "ID", 0, 1, "l\0e\0t\0t\0p\0j\0x\0h\0j\0l\0d\0n\0s\0b\0a\0z\0v\0v\0o\0\0\0", 40, ... ) , 0, 1,  (176, "ID", 0, 1, "l\0e\0t\0t\0p\0j\0x\0h\0j\0l\0d\0n\0s\0b\0a\0z\0v\0v\0o\0\0\0", 40, ... ) , 40, ... ) == 0x0
 01339  1036   NtClose  (176, ... ) == 0x0
 01340  1036   NtOpenKey  (0xf003f, {24, 16, 0x40, 0, 0,  (0xf003f, {24, 16, 0x40, 0, 0, "SOFTWARE\Microsoft\Windows\CurrentVersion\Run"}, ... 176, ) }, ... 176, ) == 0x0
 01341  1036   NtQueryValueKey  (176,  (176, "Cryptographic Service", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01342  1036   NtClose  (176, ... ) == 0x0
 01343  1036   NtCreateKey  (0xf003f, {24, 16, 0x40, 0, 0,  (0xf003f, {24, 16, 0x40, 0, 0, "Software\Microsoft\Wireless"}, 0, 0x0, 0, ... 176, 2, ) }, 0, 0x0, 0, ... 176, 2, ) == 0x0
 01344  1036   NtSetValueKey  (176,  (176, "Client", 0, 1, "1\0\0\0", 4, ... , 0, 1,  (176, "Client", 0, 1, "1\0\0\0", 4, ... , 4, ...
 01345  1036   NtSetInformationFile  (-2147482448, -139610768, 8, EndOfFile, ... {status=0x0, info=0}, ) == 0x0
 01344  1036   NtSetValueKey  ... ) == 0x0
 01346  1036   NtClose  (176, ... ) == 0x0
 01347  1036   NtCreateFile  (0x80100080, {24, 0, 0x40, 0, 1243484,  (0x80100080, {24, 0, 0x40, 0, 1243484, "\??\u:\work\packed.exe"}, 0x0, 0, 1, 1, 2097252, 0, 0, ... 176, {status=0x0, info=1}, ) }, 0x0, 0, 1, 1, 2097252, 0, 0, ... 176, {status=0x0, info=1}, ) == 0x0
 01348  1036   NtQueryInformationFile  (176, 1243920, 8, AttributeFlag, ... {status=0x0, info=8}, ) == 0x0
 01349  1036   NtQueryInformationFile  (176, 1243836, 24, Standard, ... {status=0x0, info=24}, ) == 0x0
 01350  1036   NtQueryInformationFile  (176, 1243652, 40, Basic, ... {status=0x0, info=40}, ) == 0x0
 01351  1036   NtAllocateVirtualMemory  (-1, 1368064, 0, 8192, 4096, 4, ... 1368064, 8192, ) == 0x0
 01352  1036   NtQueryInformationFile  (176, 1364160, 4094, Stream, ... {status=0x0, info=38}, ) == 0x0
 01353  1036   NtQueryInformationFile  (176, 1242100, 40, Basic, ... {status=0x0, info=40}, ) == 0x0
 01354  1036   NtQueryInformationFile  (176, 1242376, 4, Ea, ... {status=0x0, info=4}, ) == 0x0
 01355  1036   NtCreateFile  (0x40110080, {24, 0, 0x40, 0, 1242252,  (0x40110080, {24, 0, 0x40, 0, 1242252, "\??\C:\WINDOWS\system32\clxhwd.exe"}, 0x0, 32, 0, 5, 100, 0, 0, ... }, 0x0, 32, 0, 5, 100, 0, 0, ...
 01356  1036   NtClose  (-2147482740, ... ) == 0x0
 01355  1036   NtCreateFile  ... 172, {status=0x0, info=2}, ) == 0x0
 01357  1036   NtQueryVolumeInformationFile  (172, 1242404, 536, Attribute, ... {status=0x0, info=20}, ) == 0x0
 01358  1036   NtQueryInformationFile  (172, 1241988, 40, Basic, ... {status=0x0, info=40}, ) == 0x0
 01359  1036   NtQueryVolumeInformationFile  (176, 1242404, 536, Attribute, ... {status=0x0, info=20}, ) == 0x0
 01360  1036   NtQueryVolumeInformationFile  (176, 1241748, 8, Device, ... {status=0x0, info=8}, ) == 0x0
 01361  1036   NtSetInformationFile  (172, 1242304, 8, EndOfFile, ... {status=0x0, info=0}, ) == 0x0
 01362  1036   NtCreateSection  (0xf001f, 0x0, 0x0, 2, 134217728, 176, ... 180, ) == 0x0
 01363  1036   NtMapViewOfSection  (180, -1, (0x0), 0, 0, {0, 0}, 0, 1, 0, 2, ... (0x3b0000), {0, 0}, 188416, ) == 0x0
 01364  1036   NtClose  (180, ... ) == 0x0
 01365  1036   NtWriteFile  (172, 0, 0, 0,  (172, 0, 0, 0, "MZ\220\0\3\0\0\0\4\0\0\0\377\377\0\0\270\0\0\0\0\0\0\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0fn\0\0\330\0\0\0\16\37\272\16\0\264\11\315!\270\1L\315!This program cannot be run in DOS mode.\15\15\12$\0\0\0\0\0\0\0I\3538\210\15\212V\333\15\212V\333\15\212V\333\216\226X\333\17\212V\333\345\225R\333\17\212V\333\15\212V\333\12\212V\333\15\212W\333[\212V\333o\225E\333\4\212V\333\345\225]\333\7\212V\333Rich\15\212V\333\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0PE\0\0L\1\4\0\310Y\330@\0\0\0\0\0\0\0\0\340\0\17\1\13\1\6\0\0 \0\0\0\20\0\0\0P\0\0\0\240\0\0\0`\0\0\0\200\0\0\0\0B1\0\20\0\0\0\2\0\0\4\0\0\0\0\0\0\0\4\0\0\0\0\0\0\0\0\260\0\0\0\20\0\0\0\0\0\0\2\0\0\0\0\0\20\0\0\20\0\0\0\0\20\0\0\20\0\0\0\0\0\0\20\0\0\0\0\0\0\0\0\0\0\0\0\200\0\0h\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0UPX0\0\0\0\0\0P\0\0\0\20\0\0\0\0\0\0\0\4\0\0\0\0\0\0\0\0\0\0\0\0\0\0", 61440, 0x0, 0, ... {status=0x0, info=61440}, ) , 61440, 0x0, 0, ... {status=0x0, info=61440}, ) == 0x0
 01366  1036   NtWriteFile  (172, 0, 0, 0,  (172, 0, 0, 0, "$\212\311\330\304\240=\240r\6\215\356\260nf;\212\274J\37\322q\34.s\35J\277\375\0V\12[w\274\370\303\20\316X\11=Y\242'~\242m-\241R2\267\323^B\322\3020*\240\35]\326\310\313\264\24\0\230\302\2420%~\344#3\371\320\22\12\231`\337?%\341[\350\311\257\347g\35r^\233\246\250\242\227\265\360\37\364\372'U}P\350\271\227\370\4\354\262\203U\12\340\365\1\326h:4\374\255v\1\327b.\20\317\312\346\212\360r\266\260\334 \343\16\335|E-~\352\341S\35D\202{\224\310\334Xf=v_\277=n\227\253[N\366\2319x\266\7p\276\216\327q:\22N\5Z\31\335a6\2>\362B\227\317d\276H\377`7y\272p\331\302\15\310f\242\21{\32\5\14P;c\317'd\357q\360\20W\214\374\331\336}=`\330\213<\0\7\3000\27-\227\34\34L\247\374\263o\210\225\240\376P=apq>\332\336\352\320X\247\310D\311\34\35\374\340-Q|\5\343\300,\235\212\373\267b\377\326\312.\20\363%\362V<\312\262\273p\36d\316\25v\303[-6&\216O\224\377\316!\34\213\365\225\11\242\267n\345\210\230xX\271\217`\344\272\317\314q\12\25\241\352L\336\224\370\261\320t\376[\332\347y\34\336CynpU,\6\237d\2\14\367\200Hs\316\373!,\336cz\1\20254\13\302f\264\204\233e\323@\300T\230\23\303\2031\362\336\372\276*T\236\264W\303\314\362\340\273yM\20Ai\376\14\337f6z\24\20X\351\362\303\36\32\14L\372\257\367\2\247_\307`\333`\246"\345\306\377Ah38B\344\323o\204\204\347\237\242EK\333dmV\324\367\200}\274\14\4G\14\264C\224\242L\12\363b\312\355pb\260<4#(K", 61440, 0x0, 0, ... {status=0x0, info=61440}, ) \345\306\377Ah38B\344\323o\204\204\347\237\242EK\333dmV\324\367\200}\274\14\4G\14\264C\224\242L\12\363b\312\355pb\260<4#(K", 61440, 0x0, 0, ... {status=0x0, info=61440}, ) == 0x0
 01367  1036   NtWriteFile  (172, 0, 0, 0,  (172, 0, 0, 0, "\375\240\263\211\327\276T\200\311d\201s\224\206\32[$\14g\11\320\3\351\346\377n\234\264\306!o$\362A\36j\202\320/\12Pc\236\370r\11\241s\217\1]k\370U{S\316\261Z\10\334O\316\377fX.'\237\26\4k\324\276\4@\340s\265F\221!\26j*\303p\2353|BD\332\377T\331g\302\276\371\32F\264\342\342\353C\5\216\323\342^\356i,~\315\351n\301Y\273\324\270\320'\332\20\351\21\250*\36\2246\3733A\210\22\322\340\372\211\324MI[8B\242:\254"\366\278\\263\342 \343\343\264\226\314B\271\206\223\232\353\374\355K\347\320\326I\33\3331' \253d:w\326\2-\264\3154\13\354\335\323e\24k=S\24BK\331\264\364F+@\260\353e^\200\203\3\310z\273/J\334\314\326\37Z\3144\267Z\226u=\334\320\16N\34\347}t\326M\224\27w\12\217\303\263+\30\322\344VO\373 -2\177\300\343\307\375\243z5\311\240|\30\252_{~\240\360\202\345;\236;\224\367\6o\315\2524|\250w3\217\205B\230\24'\252=\2309\25U\200\34ftm\26Q\243\2739#'I5\344\260\326*\321J,\25a\333\26\217\3553S\264%\367\353VI\317"\212+`\35E\333\322hJ\4\255b\22\260\232\352c\345`5\332Ju\273\223\2537j\345uajy}\331\306\311n\204\35\305\3324f4\344o\352\372\252MS\342\30(U\201\333!{"`_\242\16\210\314#w\13\13\215\217\351\224\352=\252\344\243Qb)\274K\370\207\22\241\203%rL\5e\341\216P\14\335\337\325\332\213h\333\20\236\11\352X\235\377Hlc\310\363U\274}\215\226\24Y\3352\2273K\252\224\363Zux\325\352\33z\300\343\2\36\310\273\326Xtt\323!K\371", 61440, 0x0, 0, ... {status=0x0, info=61440}, ) \366\278\\263\342 \343\343\264\226\314B\271\206\223\232\353\374\355K\347\320\326I\33\3331' \253d:w\326\2-\264\3154\13\354\335\323e\24k=S\24BK\331\264\364F+@\260\353e^\200\203\3\310z\273/J\334\314\326\37Z\3144\267Z\226u=\334\320\16N\34\347}t\326M\224\27w\12\217\303\263+\30\322\344VO\373 -2\177\300\343\307\375\243z5\311\240|\30\252_{~\240\360\202\345;\236;\224\367\6o\315\2524|\250w3\217\205B\230\24'\252=\2309\25U\200\34ftm\26Q\243\2739#'I5\344\260\326*\321J,\25a\333\26\217\3553S\264%\367\353VI\317 (172, 0, 0, 0, "\375\240\263\211\327\276T\200\311d\201s\224\206\32[$\14g\11\320\3\351\346\377n\234\264\306!o$\362A\36j\202\320/\12Pc\236\370r\11\241s\217\1]k\370U{S\316\261Z\10\334O\316\377fX.'\237\26\4k\324\276\4@\340s\265F\221!\26j*\303p\2353|BD\332\377T\331g\302\276\371\32F\264\342\342\353C\5\216\323\342^\356i,~\315\351n\301Y\273\324\270\320'\332\20\351\21\250*\36\2246\3733A\210\22\322\340\372\211\324MI[8B\242:\254"\366\278\\263\342 \343\343\264\226\314B\271\206\223\232\353\374\355K\347\320\326I\33\3331' \253d:w\326\2-\264\3154\13\354\335\323e\24k=S\24BK\331\264\364F+@\260\353e^\200\203\3\310z\273/J\334\314\326\37Z\3144\267Z\226u=\334\320\16N\34\347}t\326M\224\27w\12\217\303\263+\30\322\344VO\373 -2\177\300\343\307\375\243z5\311\240|\30\252_{~\240\360\202\345;\236;\224\367\6o\315\2524|\250w3\217\205B\230\24'\252=\2309\25U\200\34ftm\26Q\243\2739#'I5\344\260\326*\321J,\25a\333\26\217\3553S\264%\367\353VI\317"\212+`\35E\333\322hJ\4\255b\22\260\232\352c\345`5\332Ju\273\223\2537j\345uajy}\331\306\311n\204\35\305\3324f4\344o\352\372\252MS\342\30(U\201\333!{"`_\242\16\210\314#w\13\13\215\217\351\224\352=\252\344\243Qb)\274K\370\207\22\241\203%rL\5e\341\216P\14\335\337\325\332\213h\333\20\236\11\352X\235\377Hlc\310\363U\274}\215\226\24Y\3352\2273K\252\224\363Zux\325\352\33z\300\343\2\36\310\273\326Xtt\323!K\371", 61440, 0x0, 0, ... {status=0x0, info=61440}, ) `_\242\16\210\314#w\13\13\215\217\351\224\352=\252\344\243Qb)\274K\370\207\22\241\203%rL\5e\341\216P\14\335\337\325\332\213h\333\20\236\11\352X\235\377Hlc\310\363U\274}\215\226\24Y\3352\2273K\252\224\363Zux\325\352\33z\300\343\2\36\310\273\326Xtt\323!K\371", 61440, 0x0, 0, ... {status=0x0, info=61440}, ) == 0x0
 01368  1036   NtWriteFile  (172, 0, 0, 0,  (172, 0, 0, 0, "\337`>\0\337`>\0\337`>\0f)y+\337`>\0\337`?\0\337`>\0\237d>\0\353<8\0\264a>\0\337`>\0\337`>\0\337`>\0f)y+\337`>\0\337`9\0&\37>\0Gd>\200%\37>\0\37d>\200$\37>\07d>\200#\37>\0\317e>\200"\37>\0\347e>\200!\37>\0\277e>\200 \37>\0We>\200\337`>\0f)y+\337`>\0\337`?\0\337`>\0od>\0\177=8\0\313`>\0\337`>\0\337`>\0\337`>\0f)y+\337`>\0\337`?\0\337`>\0\7d>\0k=8\0\313`>\0\337`>\0\337`>\0\337`>\0f)y+\337`>\0\337`?\0\337`>\0\337e>\0\27=8\0\313`>\0\337`>\0\337`>\0\337`>\0f)y+\337`>\0\337`?\0\337`>\0\367e>\0\3=8\0\313`>\0\337`>\0\337`>\0\337`>\0f)y+\337`>\0\337`?\0\337`>\0\217e>\0/=8\0\313`>\0\337`>\0\337`>\0\337`>\0f)y+\337`>\0\337`?\0\337`>\0\247e>\0\333>8\0\313`>\0\337`>\0\337`>\0\337`>\0f)y+\337`>\0\337`?\0\337`>\0\177e>\0\307>8\0\313`>\0\337`>\0\337`>\0\331`z\0\211`}\0\223`\177\0\223`5\0\213`x\0\212`p\0\234`s\0\220`z\0\212`r\0\232`>\0\337`>\0\337`>\0\337`>\03F9\0\177F9\0\337`>\0\337`>\0\337`>\0&F9\0sF9\0\337`>\0\337`>\0\337`>\0\331G9\0kF9\0", 3040, 0x0, 0, ... {status=0x0, info=3040}, ) \37>\0\347e>\200!\37>\0\277e>\200 \37>\0We>\200\337`>\0f)y+\337`>\0\337`?\0\337`>\0od>\0\177=8\0\313`>\0\337`>\0\337`>\0\337`>\0f)y+\337`>\0\337`?\0\337`>\0\7d>\0k=8\0\313`>\0\337`>\0\337`>\0\337`>\0f)y+\337`>\0\337`?\0\337`>\0\337e>\0\27=8\0\313`>\0\337`>\0\337`>\0\337`>\0f)y+\337`>\0\337`?\0\337`>\0\367e>\0\3=8\0\313`>\0\337`>\0\337`>\0\337`>\0f)y+\337`>\0\337`?\0\337`>\0\217e>\0/=8\0\313`>\0\337`>\0\337`>\0\337`>\0f)y+\337`>\0\337`?\0\337`>\0\247e>\0\333>8\0\313`>\0\337`>\0\337`>\0\337`>\0f)y+\337`>\0\337`?\0\337`>\0\177e>\0\307>8\0\313`>\0\337`>\0\337`>\0\331`z\0\211`}\0\223`\177\0\223`5\0\213`x\0\212`p\0\234`s\0\220`z\0\212`r\0\232`>\0\337`>\0\337`>\0\337`>\03F9\0\177F9\0\337`>\0\337`>\0\337`>\0&F9\0sF9\0\337`>\0\337`>\0\337`>\0\331G9\0kF9\0", 3040, 0x0, 0, ... {status=0x0, info=3040}, ) == 0x0
 01369  1036   NtUnmapViewOfSection  (-1, 0x3b0000, ... ) == 0x0
 01370  1036   NtSetInformationFile  (172, 1243652, 40, Basic, ... {status=0x0, info=0}, ) == 0x0
 01371  1036   NtClose  (176, ... ) == 0x0
 01372  1036   NtClose  (172, ... ) == 0x0
 01373  1036   NtCreateKey  (0xf003f, {24, 16, 0x40, 0, 0,  (0xf003f, {24, 16, 0x40, 0, 0, "SOFTWARE\Microsoft\Windows\CurrentVersion\Run"}, 0, 0x0, 0, ... 172, 2, ) }, 0, 0x0, 0, ... 172, 2, ) == 0x0
 01374  1036   NtSetValueKey  (172,  (172, "Cryptographic Service", 0, 1, "C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0s\0y\0s\0t\0e\0m\03\02\0\\0c\0l\0x\0h\0w\0d\0.\0e\0x\0e\0\0\0", 62, ... , 0, 1,  (172, "Cryptographic Service", 0, 1, "C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0s\0y\0s\0t\0e\0m\03\02\0\\0c\0l\0x\0h\0w\0d\0.\0e\0x\0e\0\0\0", 62, ... , 62, ...
 01375  1036   NtSetInformationFile  (-2147482448, -139610320, 8, EndOfFile, ... {status=0x0, info=0}, ) == 0x0
 01376  1036   NtSetInformationFile  (-2147482448, -139610412, 8, EndOfFile, ... {status=0x0, info=0}, ) == 0x0
 01374  1036   NtSetValueKey  ... ) == 0x0
 01377  1036   NtClose  (172, ... ) == 0x0
 01378  1036   NtClose  (132, ... ) == 0x0
 01379  1036   NtQueryInformationJobObject  (0, BasicUIRestrictions, 4, ... ) == STATUS_ACCESS_DENIED
 01380  1036   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\clxhwd.exe"}, 1240872, ... ) }, 1240872, ... ) == 0x0
 01381  1036   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\clxhwd.exe"}, 1241608, ... ) }, 1241608, ... ) == 0x0
 01382  1036   NtOpenFile  (0x1000a1, {24, 0, 0x40, 0, 0,  (0x1000a1, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\clxhwd.exe"}, 5, 96, ... 132, {status=0x0, info=1}, ) }, 5, 96, ... 132, {status=0x0, info=1}, ) == 0x0
 01383  1036   NtCreateSection  (0xf001f, 0x0, 0x0, 16, 16777216, 132, ... 172, ) == 0x0
 01384  1036   NtOpenKey  (0x1, {24, 0, 0x40, 0, 0,  (0x1, {24, 0, 0x40, 0, 0, "\Registry\MACHINE\System\CurrentControlSet\Control\Session Manager\AppCertDlls"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01385  1036   NtOpenKey  (0x1, {24, 0, 0x40, 0, 0,  (0x1, {24, 0, 0x40, 0, 0, "\Registry\MACHINE\System\CurrentControlSet\Control\Session Manager\AppCompatibility"}, ... 176, ) }, ... 176, ) == 0x0
 01386  1036   NtQueryValueKey  (176,  (176, "DisableAppCompat", Partial, 20, ... ) , Partial, 20, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01387  1036   NtClose  (176, ... ) == 0x0
 01388  1036   NtQueryVolumeInformationFile  (132, 1240884, 8, Device, ... {status=0x0, info=8}, ) == 0x0
 01389  1036   NtOpenMutant  (0x120001, {24, 44, 0x0, 0, 0,  (0x120001, {24, 44, 0x0, 0, 0, "ShimCacheMutex"}, ... 176, ) }, ... 176, ) == 0x0
 01390  1036   NtWaitForSingleObject  (176, 0, {-1000000, -1}, ... ) == 0x0
 01391  1036   NtOpenSection  (0x2, {24, 44, 0x0, 0, 0,  (0x2, {24, 44, 0x0, 0, 0, "ShimSharedMemory"}, ... 180, ) }, ... 180, ) == 0x0
 01392  1036   NtMapViewOfSection  (180, -1, (0x0), 0, 0, {0, 0}, 0, 1, 0, 4, ... (0x3b0000), {0, 0}, 57344, ) == 0x0
 01393  1036   NtReleaseMutant  (176, ... 0x0, ) == 0x0
 01394  1036   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\Apphelp.dll"}, 1238816, ... ) }, 1238816, ... ) == 0x0
 01395  1036   NtOpenFile  (0x100020, {24, 0, 0x40, 0, 0,  (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\Apphelp.dll"}, 5, 96, ... 184, {status=0x0, info=1}, ) }, 5, 96, ... 184, {status=0x0, info=1}, ) == 0x0
 01396  1036   NtCreateSection  (0xe, 0x0, 0x0, 16, 134217728, 184, ... 188, ) == 0x0
 01397  1036   NtClose  (184, ... ) == 0x0
 01398  1036   NtMapViewOfSection  (188, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 16, ... (0x3c0000), 0x0, 126976, ) == 0x0
 01399  1036   NtClose  (188, ... ) == 0x0
 01400  1036   NtUnmapViewOfSection  (-1, 0x3c0000, ... ) == 0x0
 01401  1036   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\Apphelp.dll"}, 1239124, ... ) }, 1239124, ... ) == 0x0
 01402  1036   NtOpenFile  (0x100020, {24, 0, 0x40, 0, 0,  (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\Apphelp.dll"}, 5, 96, ... 188, {status=0x0, info=1}, ) }, 5, 96, ... 188, {status=0x0, info=1}, ) == 0x0
 01403  1036   NtCreateSection  (0xf, 0x0, 0x0, 16, 16777216, 188, ... 184, ) == 0x0
 01404  1036   NtQuerySection  (184, Image, 48, ... {section info, class 1, size 48}, 0x0, ) == 0x0
 01405  1036   NtClose  (188, ... ) == 0x0
 01406  1036   NtMapViewOfSection  (184, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x77b40000), 0x0, 139264, ) == 0x0
 01407  1036   NtClose  (184, ... ) == 0x0
 01408  1036   NtProtectVirtualMemory  (-1, (0x77b41000), 524, 4, ... (0x77b41000), 4096, 32, ) == 0x0
 01409  1036   NtProtectVirtualMemory  (-1, (0x77b41000), 4096, 32, ... (0x77b41000), 4096, 4, ) == 0x0
 01410  1036   NtFlushInstructionCache  (-1, 2008289280, 524, ... ) == 0x0
 01411  1036   NtOpenKey  (0x80000000, {24, 0, 0x40, 0, 0,  (0x80000000, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Apphelp.dll"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01412  1036   NtCreateFile  (0x80100080, {24, 0, 0x40, 0, 0,  (0x80100080, {24, 0, 0x40, 0, 0, "\SystemRoot\AppPatch\sysmain.sdb"}, 0x0, 128, 1, 1, 96, 0, 0, ... 184, {status=0x0, info=1}, ) }, 0x0, 128, 1, 1, 96, 0, 0, ... 184, {status=0x0, info=1}, ) == 0x0
 01413  1036   NtQueryInformationFile  (184, 1239140, 24, Standard, ... {status=0x0, info=24}, ) == 0x0
 01414  1036   NtCreateSection  (0x4, 0x0, 0x0, 2, 134217728, 184, ... 188, ) == 0x0
 01415  1036   NtMapViewOfSection  (188, -1, (0x0), 0, 0, 0x0, 0, 2, 0, 2, ... (0xc70000), 0x0, 1191936, ) == 0x0
 01416  1036   NtQueryInformationFile  (184, 1239240, 24, Standard, ... {status=0x0, info=24}, ) == 0x0
 01417  1036   NtCreateFile  (0x80100080, {24, 0, 0x40, 0, 0,  (0x80100080, {24, 0, 0x40, 0, 0, "\SystemRoot\AppPatch\systest.sdb"}, 0x0, 128, 1, 1, 96, 0, 0, ... ) }, 0x0, 128, 1, 1, 96, 0, 0, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01418  1036   NtQuerySystemInformation  (Processor, 12, ... {system info, class 1, size 12}, 0x0, ) == 0x0
 01419  1036   NtQueryInformationProcess  (-1, Wow64, 4, ... {process info, class 26, size 4}, 0x0, ) == 0x0
 01420  1036   NtOpenKey  (0x101, {24, 0, 0x40, 0, 0,  (0x101, {24, 0, 0x40, 0, 0, "\Registry\Machine\System\WPA\TabletPC"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01421  1036   NtOpenKey  (0x101, {24, 0, 0x40, 0, 0,  (0x101, {24, 0, 0x40, 0, 0, "\Registry\Machine\SYSTEM\WPA\MediaCenter"}, ... 192, ) }, ... 192, ) == 0x0
 01422  1036   NtQueryValueKey  (192,  (192, "Installed", Partial, 256, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) , Partial, 256, ... TitleIdx=0, Type=4, Data= (192, "Installed", Partial, 256, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) }, 16, ) == 0x0
 01423  1036   NtClose  (192, ... ) == 0x0
 01424  1036   NtCreateFile  (0x120116, {24, 0, 0x40, 0, 0,  (0x120116, {24, 0, 0x40, 0, 0, "\Device\NamedPipe\ShimViewer"}, 0x0, 128, 0, 1, 0, 0, 0, ... ) }, 0x0, 128, 0, 1, 0, 0, 0, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01425  1036   NtOpenFile  (0x100001, {24, 0, 0x40, 0, 0,  (0x100001, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\"}, 3, 16417, ... 192, {status=0x0, info=1}, ) }, 3, 16417, ... 192, {status=0x0, info=1}, ) == 0x0
 01426  1036   NtQueryDirectoryFile  (192, 0, 0, 0, 1236836, 616, BothDirectory, 1,  (192, 0, 0, 0, 1236836, 616, BothDirectory, 1, "clxhwd.exe", 0, ... {status=0x0, info=114}, ) , 0, ... {status=0x0, info=114}, ) == 0x0
 01427  1036   NtClose  (192, ... ) == 0x0
 01428  1036   NtQueryInformationProcess  (-1, DefaultHardErrorMode, 4, ... {process info, class 12, size 4}, 0x0, ) == 0x0
 01429  1036   NtSetInformationProcess  (-1, DefaultHardErrorMode, {process info, class 12, size 4}, 4, ... ) == 0x0
 01430  1036   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\clxhwd.exe"}, 1237212, ... ) }, 1237212, ... ) == 0x0
 01431  1036   NtOpenFile  (0x100001, {24, 0, 0x40, 0, 0,  (0x100001, {24, 0, 0x40, 0, 0, "\??\C:\"}, 3, 16417, ... 192, {status=0x0, info=1}, ) }, 3, 16417, ... 192, {status=0x0, info=1}, ) == 0x0
 01432  1036   NtQueryDirectoryFile  (192, 0, 0, 0, 1236640, 616, BothDirectory, 1,  (192, 0, 0, 0, 1236640, 616, BothDirectory, 1, "WINDOWS", 0, ... {status=0x0, info=108}, ) , 0, ... {status=0x0, info=108}, ) == 0x0
 01433  1036   NtClose  (192, ... ) == 0x0
 01434  1036   NtOpenFile  (0x100001, {24, 0, 0x40, 0, 0,  (0x100001, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\"}, 3, 16417, ... 192, {status=0x0, info=1}, ) }, 3, 16417, ... 192, {status=0x0, info=1}, ) == 0x0
 01435  1036   NtQueryDirectoryFile  (192, 0, 0, 0, 1236640, 616, BothDirectory, 1,  (192, 0, 0, 0, 1236640, 616, BothDirectory, 1, "system32", 0, ... {status=0x0, info=110}, ) , 0, ... {status=0x0, info=110}, ) == 0x0
 01436  1036   NtClose  (192, ... ) == 0x0
 01437  1036   NtOpenFile  (0x100001, {24, 0, 0x40, 0, 0,  (0x100001, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\"}, 3, 16417, ... 192, {status=0x0, info=1}, ) }, 3, 16417, ... 192, {status=0x0, info=1}, ) == 0x0
 01438  1036   NtQueryDirectoryFile  (192, 0, 0, 0, 1236640, 616, BothDirectory, 1,  (192, 0, 0, 0, 1236640, 616, BothDirectory, 1, "clxhwd.exe", 0, ... {status=0x0, info=114}, ) , 0, ... {status=0x0, info=114}, ) == 0x0
 01439  1036   NtClose  (192, ... ) == 0x0
 01440  1036   NtQueryInformationProcess  (-1, DefaultHardErrorMode, 4, ... {process info, class 12, size 4}, 0x0, ) == 0x0
 01441  1036   NtSetInformationProcess  (-1, DefaultHardErrorMode, {process info, class 12, size 4}, 4, ... ) == 0x0
 01442  1036   NtQueryInformationProcess  (-1, DeviceMap, 36, ... {process info, class 23, size 36}, 0x0, ) == 0x0
 01443  1036   NtOpenKey  (0x80000100, {24, 0, 0x40, 0, 0,  (0x80000100, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Layers"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01444  1036   NtOpenThreadTokenEx  (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN
 01445  1036   NtOpenProcessTokenEx  (-1, 0x20008, 512, ... 192, ) == 0x0
 01446  1036   NtQueryInformationToken  (192, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0
 01447  1036   NtClose  (192, ... ) == 0x0
 01448  1036   NtOpenKey  (0x80000100, {24, 0, 0x40, 0, 0,  (0x80000100, {24, 0, 0x40, 0, 0, "\REGISTRY\USER\S-1-5-21-1292428093-1383384898-725345543-1003\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Layers"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01449  1036   NtOpenKey  (0x80000100, {24, 0, 0x40, 0, 0,  (0x80000100, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Custom\clxhwd.exe"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01450  1036   NtQueryInformationProcess  (-1, DefaultHardErrorMode, 4, ... {process info, class 12, size 4}, 0x0, ) == 0x0
 01451  1036   NtSetInformationProcess  (-1, DefaultHardErrorMode, {process info, class 12, size 4}, 4, ... ) == 0x0
 01452  1036   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\clxhwd.exe"}, 1238464, ... ) }, 1238464, ... ) == 0x0
 01453  1036   NtOpenFile  (0x100001, {24, 0, 0x40, 0, 0,  (0x100001, {24, 0, 0x40, 0, 0, "\??\C:\"}, 3, 16417, ... 192, {status=0x0, info=1}, ) }, 3, 16417, ... 192, {status=0x0, info=1}, ) == 0x0
 01454  1036   NtQueryDirectoryFile  (192, 0, 0, 0, 1237892, 616, BothDirectory, 1,  (192, 0, 0, 0, 1237892, 616, BothDirectory, 1, "WINDOWS", 0, ... {status=0x0, info=108}, ) , 0, ... {status=0x0, info=108}, ) == 0x0
 01455  1036   NtClose  (192, ... ) == 0x0
 01456  1036   NtOpenFile  (0x100001, {24, 0, 0x40, 0, 0,  (0x100001, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\"}, 3, 16417, ... 192, {status=0x0, info=1}, ) }, 3, 16417, ... 192, {status=0x0, info=1}, ) == 0x0
 01457  1036   NtQueryDirectoryFile  (192, 0, 0, 0, 1237892, 616, BothDirectory, 1,  (192, 0, 0, 0, 1237892, 616, BothDirectory, 1, "system32", 0, ... {status=0x0, info=110}, ) , 0, ... {status=0x0, info=110}, ) == 0x0
 01458  1036   NtClose  (192, ... ) == 0x0
 01459  1036   NtOpenFile  (0x100001, {24, 0, 0x40, 0, 0,  (0x100001, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\"}, 3, 16417, ... 192, {status=0x0, info=1}, ) }, 3, 16417, ... 192, {status=0x0, info=1}, ) == 0x0
 01460  1036   NtQueryDirectoryFile  (192, 0, 0, 0, 1237892, 616, BothDirectory, 1,  (192, 0, 0, 0, 1237892, 616, BothDirectory, 1, "clxhwd.exe", 0, ... {status=0x0, info=114}, ) , 0, ... {status=0x0, info=114}, ) == 0x0
 01461  1036   NtClose  (192, ... ) == 0x0
 01462  1036   NtQueryInformationProcess  (-1, DefaultHardErrorMode, 4, ... {process info, class 12, size 4}, 0x0, ) == 0x0
 01463  1036   NtSetInformationProcess  (-1, DefaultHardErrorMode, {process info, class 12, size 4}, 4, ... ) == 0x0
 01464  1036   NtWaitForSingleObject  (176, 0, {-1000000, -1}, ... ) == 0x0
 01465  1036   NtQueryVolumeInformationFile  (132, 1239120, 8, Device, ... {status=0x0, info=8}, ) == 0x0
 01466  1036   NtQueryInformationFile  (132, 1239100, 40, Basic, ... {status=0x0, info=40}, ) == 0x0
 01467  1036   NtQueryInformationFile  (132, 1239140, 24, Standard, ... {status=0x0, info=24}, ) == 0x0
 01468  1036   NtReleaseMutant  (176, ... 0x0, ) == 0x0
 01469  1036   NtUnmapViewOfSection  (-1, 0xc70000, ... ) == 0x0
 01470  1036   NtClose  (188, ... ) == 0x0
 01471  1036   NtClose  (184, ... ) == 0x0
 01472  1036   NtOpenThreadToken  (-2, 0x2000000, 1, ... ) == STATUS_NO_TOKEN
 01473  1036   NtOpenProcessToken  (-1, 0xa, ... 184, ) == 0x0
 01474  1036   NtQueryInformationToken  (184, User, 136, ... {token info, class 1, size 36}, 36, ) == 0x0
 01475  1036   NtOpenKey  (0x3, {24, 0, 0x40, 0, 0,  (0x3, {24, 0, 0x40, 0, 0, "\Registry\MACHINE\System\CurrentControlSet\Control\SafeBoot\Option"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01476  1036   NtOpenKey  (0x1, {24, 0, 0x40, 0, 0,  (0x1, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers"}, ... 188, ) }, ... 188, ) == 0x0
 01477  1036   NtQueryValueKey  (188,  (188, "TransparentEnabled", Partial, 80, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) , Partial, 80, ... TitleIdx=0, Type=4, Data= (188, "TransparentEnabled", Partial, 80, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) }, 16, ) == 0x0
 01478  1036   NtQueryValueKey  (188,  (188, "AuthenticodeEnabled", Partial, 80, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) , Partial, 80, ... TitleIdx=0, Type=4, Data= (188, "AuthenticodeEnabled", Partial, 80, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) }, 16, ) == 0x0
 01479  1036   NtClose  (188, ... ) == 0x0
 01480  1036   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Policies\Microsoft\Windows\Safer\LevelObjects"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01481  1036   NtOpenKey  (0x1, {24, 0, 0x40, 0, 0,  (0x1, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers"}, ... 188, ) }, ... 188, ) == 0x0
 01482  1036   NtQueryValueKey  (188,  (188, "Levels", Partial, 536, ... ) , Partial, 536, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01483  1036   NtClose  (188, ... ) == 0x0
 01484  1036   NtQueryDefaultLocale  (1, 1240312, ... ) == 0x0
 01485  1036   NtQueryDefaultLocale  (1, 1240312, ... ) == 0x0
 01486  1036   NtQueryDefaultLocale  (1, 1240312, ... ) == 0x0
 01487  1036   NtQueryDefaultLocale  (1, 1240312, ... ) == 0x0
 01488  1036   NtQueryDefaultLocale  (1, 1240312, ... ) == 0x0
 01489  1036   NtQueryDefaultLocale  (1, 1240312, ... ) == 0x0
 01490  1036   NtQueryDefaultLocale  (1, 1240312, ... ) == 0x0
 01491  1036   NtQueryDefaultLocale  (1, 1240312, ... ) == 0x0
 01492  1036   NtQueryDefaultLocale  (1, 1240312, ... ) == 0x0
 01493  1036   NtQueryDefaultLocale  (1, 1240312, ... ) == 0x0
 01494  1036   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\0\Paths"}, ... 188, ) }, ... 188, ) == 0x0
 01495  1036   NtEnumerateKey  (188, 0, Basic, 280, ... {LastWrite={0x3a5edea,0x1c74da9}, TitleIdx=0, Name= (188, 0, Basic, 280, ... {LastWrite={0x3a5edea,0x1c74da9}, TitleIdx=0, Name="{dda3f824-d8cb-441b-834d-be2efd2c1a33}"}, 92, ) }, 92, ) == 0x0
 01496  1036   NtOpenKey  (0x20019, {24, 188, 0x40, 0, 0,  (0x20019, {24, 188, 0x40, 0, 0, "{dda3f824-d8cb-441b-834d-be2efd2c1a33}"}, ... 192, ) }, ... 192, ) == 0x0
 01497  1036   NtQueryValueKey  (192,  (192, "ItemData", Partial, 280, ... TitleIdx=0, Type=2, Data="%\0H\0K\0E\0Y\0_\0C\0U\0R\0R\0E\0N\0T\0_\0U\0S\0E\0R\0\\0S\0o\0f\0t\0w\0a\0r\0e\0\\0M\0i\0c\0r\0o\0s\0o\0f\0t\0\\0W\0i\0n\0d\0o\0w\0s\0\\0C\0u\0r\0r\0e\0n\0t\0V\0e\0r\0s\0i\0o\0n\0\\0E\0x\0p\0l\0o\0r\0e\0r\0\\0S\0h\0e\0l\0l\0 \0F\0o\0l\0d\0e\0r\0s\0\\0C\0a\0c\0h\0e\0%\0O\0L\0K\0*\0\0\0"}, 202, ) , Partial, 280, ... TitleIdx=0, Type=2, Data= (192, "ItemData", Partial, 280, ... TitleIdx=0, Type=2, Data="%\0H\0K\0E\0Y\0_\0C\0U\0R\0R\0E\0N\0T\0_\0U\0S\0E\0R\0\\0S\0o\0f\0t\0w\0a\0r\0e\0\\0M\0i\0c\0r\0o\0s\0o\0f\0t\0\\0W\0i\0n\0d\0o\0w\0s\0\\0C\0u\0r\0r\0e\0n\0t\0V\0e\0r\0s\0i\0o\0n\0\\0E\0x\0p\0l\0o\0r\0e\0r\0\\0S\0h\0e\0l\0l\0 \0F\0o\0l\0d\0e\0r\0s\0\\0C\0a\0c\0h\0e\0%\0O\0L\0K\0*\0\0\0"}, 202, ) }, 202, ) == 0x0
 01498  1036   NtQueryValueKey  (192,  (192, "SaferFlags", Partial, 280, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) , Partial, 280, ... TitleIdx=0, Type=4, Data= (192, "SaferFlags", Partial, 280, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) }, 16, ) == 0x0
 01499  1036   NtClose  (192, ... ) == 0x0
 01500  1036   NtEnumerateKey  (188, 1, Basic, 280, ... ) == STATUS_NO_MORE_ENTRIES
 01501  1036   NtClose  (188, ... ) == 0x0
 01502  1036   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\0\Hashes"}, ... 188, ) }, ... 188, ) == 0x0
 01503  1036   NtEnumerateKey  (188, 0, Basic, 280, ... {LastWrite={0x38ab3b74,0x1c74d7e}, TitleIdx=0, Name= (188, 0, Basic, 280, ... {LastWrite={0x38ab3b74,0x1c74d7e}, TitleIdx=0, Name="{349d35ab-37b5-462f-9b89-edd5fbde1328}"}, 92, ) }, 92, ) == 0x0
 01504  1036   NtOpenKey  (0x20019, {24, 188, 0x40, 0, 0,  (0x20019, {24, 188, 0x40, 0, 0, "{349d35ab-37b5-462f-9b89-edd5fbde1328}"}, ... 192, ) }, ... 192, ) == 0x0
 01505  1036   NtQueryValueKey  (192,  (192, "ItemData", Partial, 280, ... TitleIdx=0, Type=3, Data="^\2530O\225zI\211j\0l\341\25@\25"}, 28, ) , Partial, 280, ... TitleIdx=0, Type=3, Data= (192, "ItemData", Partial, 280, ... TitleIdx=0, Type=3, Data="^\2530O\225zI\211j\0l\341\25@\25"}, 28, ) }, 28, ) == 0x0
 01506  1036   NtQueryValueKey  (192,  (192, "HashAlg", Partial, 280, ... TitleIdx=0, Type=4, Data="\3\200\0\0"}, 16, ) , Partial, 280, ... TitleIdx=0, Type=4, Data= (192, "HashAlg", Partial, 280, ... TitleIdx=0, Type=4, Data="\3\200\0\0"}, 16, ) }, 16, ) == 0x0
 01507  1036   NtQueryValueKey  (192,  (192, "ItemSize", Partial, 280, ... TitleIdx=0, Type=11, Data="\13\3\0\0\0\0\0\0"}, 20, ) , Partial, 280, ... TitleIdx=0, Type=11, Data= (192, "ItemSize", Partial, 280, ... TitleIdx=0, Type=11, Data="\13\3\0\0\0\0\0\0"}, 20, ) }, 20, ) == 0x0
 01508  1036   NtQueryValueKey  (192,  (192, "SaferFlags", Partial, 280, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) , Partial, 280, ... TitleIdx=0, Type=4, Data= (192, "SaferFlags", Partial, 280, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) }, 16, ) == 0x0
 01509  1036   NtClose  (192, ... ) == 0x0
 01510  1036   NtEnumerateKey  (188, 1, Basic, 280, ... {LastWrite={0x38ab3b74,0x1c74d7e}, TitleIdx=0, Name= (188, 1, Basic, 280, ... {LastWrite={0x38ab3b74,0x1c74d7e}, TitleIdx=0, Name="{7fb9cd2e-3076-4df9-a57b-b813f72dbb91}"}, 92, ) }, 92, ) == 0x0
 01511  1036   NtOpenKey  (0x20019, {24, 188, 0x40, 0, 0,  (0x20019, {24, 188, 0x40, 0, 0, "{7fb9cd2e-3076-4df9-a57b-b813f72dbb91}"}, ... 192, ) }, ... 192, ) == 0x0
 01512  1036   NtQueryValueKey  (192,  (192, "ItemData", Partial, 280, ... TitleIdx=0, Type=3, Data="g\260\324\2134:?\323\274\351\334dg\4\363\224"}, 28, ) , Partial, 280, ... TitleIdx=0, Type=3, Data= (192, "ItemData", Partial, 280, ... TitleIdx=0, Type=3, Data="g\260\324\2134:?\323\274\351\334dg\4\363\224"}, 28, ) }, 28, ) == 0x0
 01513  1036   NtQueryValueKey  (192,  (192, "HashAlg", Partial, 280, ... TitleIdx=0, Type=4, Data="\3\200\0\0"}, 16, ) , Partial, 280, ... TitleIdx=0, Type=4, Data= (192, "HashAlg", Partial, 280, ... TitleIdx=0, Type=4, Data="\3\200\0\0"}, 16, ) }, 16, ) == 0x0
 01514  1036   NtQueryValueKey  (192,  (192, "ItemSize", Partial, 280, ... TitleIdx=0, Type=11, Data="\5\2\0\0\0\0\0\0"}, 20, ) , Partial, 280, ... TitleIdx=0, Type=11, Data= (192, "ItemSize", Partial, 280, ... TitleIdx=0, Type=11, Data="\5\2\0\0\0\0\0\0"}, 20, ) }, 20, ) == 0x0
 01515  1036   NtQueryValueKey  (192,  (192, "SaferFlags", Partial, 280, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) , Partial, 280, ... TitleIdx=0, Type=4, Data= (192, "SaferFlags", Partial, 280, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) }, 16, ) == 0x0
 01516  1036   NtClose  (192, ... ) == 0x0
 01517  1036   NtEnumerateKey  (188, 2, Basic, 280, ... {LastWrite={0x38ab3b74,0x1c74d7e}, TitleIdx=0, Name= (188, 2, Basic, 280, ... {LastWrite={0x38ab3b74,0x1c74d7e}, TitleIdx=0, Name="{81d1fe15-dd9d-4762-b16d-7c29ddecae3f}"}, 92, ) }, 92, ) == 0x0
 01518  1036   NtOpenKey  (0x20019, {24, 188, 0x40, 0, 0,  (0x20019, {24, 188, 0x40, 0, 0, "{81d1fe15-dd9d-4762-b16d-7c29ddecae3f}"}, ... 192, ) }, ... 192, ) == 0x0
 01519  1036   NtQueryValueKey  (192,  (192, "ItemData", Partial, 280, ... TitleIdx=0, Type=3, Data="2x\2\334\376\370\310\223\334\212\260\6\335\204}\35"}, 28, ) , Partial, 280, ... TitleIdx=0, Type=3, Data= (192, "ItemData", Partial, 280, ... TitleIdx=0, Type=3, Data="2x\2\334\376\370\310\223\334\212\260\6\335\204}\35"}, 28, ) }, 28, ) == 0x0
 01520  1036   NtQueryValueKey  (192,  (192, "HashAlg", Partial, 280, ... TitleIdx=0, Type=4, Data="\3\200\0\0"}, 16, ) , Partial, 280, ... TitleIdx=0, Type=4, Data= (192, "HashAlg", Partial, 280, ... TitleIdx=0, Type=4, Data="\3\200\0\0"}, 16, ) }, 16, ) == 0x0
 01521  1036   NtQueryValueKey  (192,  (192, "ItemSize", Partial, 280, ... TitleIdx=0, Type=11, Data="\226\3\0\0\0\0\0\0"}, 20, ) , Partial, 280, ... TitleIdx=0, Type=11, Data= (192, "ItemSize", Partial, 280, ... TitleIdx=0, Type=11, Data="\226\3\0\0\0\0\0\0"}, 20, ) }, 20, ) == 0x0
 01522  1036   NtQueryValueKey  (192,  (192, "SaferFlags", Partial, 280, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) , Partial, 280, ... TitleIdx=0, Type=4, Data= (192, "SaferFlags", Partial, 280, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) }, 16, ) == 0x0
 01523  1036   NtClose  (192, ... ) == 0x0
 01524  1036   NtEnumerateKey  (188, 3, Basic, 280, ... {LastWrite={0x38ab3b74,0x1c74d7e}, TitleIdx=0, Name= (188, 3, Basic, 280, ... {LastWrite={0x38ab3b74,0x1c74d7e}, TitleIdx=0, Name="{94e3e076-8f53-42a5-8411-085bcc18a68d}"}, 92, ) }, 92, ) == 0x0
 01525  1036   NtOpenKey  (0x20019, {24, 188, 0x40, 0, 0,  (0x20019, {24, 188, 0x40, 0, 0, "{94e3e076-8f53-42a5-8411-085bcc18a68d}"}, ... 192, ) }, ... 192, ) == 0x0
 01526  1036   NtQueryValueKey  (192,  (192, "ItemData", Partial, 280, ... TitleIdx=0, Type=3, Data="\275\232*\333B\353\330V\16%\16M\370\26/g"}, 28, ) , Partial, 280, ... TitleIdx=0, Type=3, Data= (192, "ItemData", Partial, 280, ... TitleIdx=0, Type=3, Data="\275\232*\333B\353\330V\16%\16M\370\26/g"}, 28, ) }, 28, ) == 0x0
 01527  1036   NtQueryValueKey  (192,  (192, "HashAlg", Partial, 280, ... TitleIdx=0, Type=4, Data="\3\200\0\0"}, 16, ) , Partial, 280, ... TitleIdx=0, Type=4, Data= (192, "HashAlg", Partial, 280, ... TitleIdx=0, Type=4, Data="\3\200\0\0"}, 16, ) }, 16, ) == 0x0
 01528  1036   NtQueryValueKey  (192,  (192, "ItemSize", Partial, 280, ... TitleIdx=0, Type=11, Data="\345\0\0\0\0\0\0\0"}, 20, ) , Partial, 280, ... TitleIdx=0, Type=11, Data= (192, "ItemSize", Partial, 280, ... TitleIdx=0, Type=11, Data="\345\0\0\0\0\0\0\0"}, 20, ) }, 20, ) == 0x0
 01529  1036   NtQueryValueKey  (192,  (192, "SaferFlags", Partial, 280, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) , Partial, 280, ... TitleIdx=0, Type=4, Data= (192, "SaferFlags", Partial, 280, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) }, 16, ) == 0x0
 01530  1036   NtClose  (192, ... ) == 0x0
 01531  1036   NtEnumerateKey  (188, 4, Basic, 280, ... {LastWrite={0x38ab3b74,0x1c74d7e}, TitleIdx=0, Name= (188, 4, Basic, 280, ... {LastWrite={0x38ab3b74,0x1c74d7e}, TitleIdx=0, Name="{dc971ee5-44eb-4fe4-ae2e-b91490411bfc}"}, 92, ) }, 92, ) == 0x0
 01532  1036   NtOpenKey  (0x20019, {24, 188, 0x40, 0, 0,  (0x20019, {24, 188, 0x40, 0, 0, "{dc971ee5-44eb-4fe4-ae2e-b91490411bfc}"}, ... 192, ) }, ... 192, ) == 0x0
 01533  1036   NtQueryValueKey  (192,  (192, "ItemData", Partial, 280, ... TitleIdx=0, Type=3, Data="8k\10_\204\354\366i\323k\225j"\300\36\200"}, 28, ) , Partial, 280, ... TitleIdx=0, Type=3, Data= (192, "ItemData", Partial, 280, ... TitleIdx=0, Type=3, Data="8k\10_\204\354\366i\323k\225j"\300\36\200"}, 28, ) \300\36\200"}, 28, ) == 0x0
 01534  1036   NtQueryValueKey  (192,  (192, "HashAlg", Partial, 280, ... TitleIdx=0, Type=4, Data="\3\200\0\0"}, 16, ) , Partial, 280, ... TitleIdx=0, Type=4, Data= (192, "HashAlg", Partial, 280, ... TitleIdx=0, Type=4, Data="\3\200\0\0"}, 16, ) }, 16, ) == 0x0
 01535  1036   NtQueryValueKey  (192,  (192, "ItemSize", Partial, 280, ... TitleIdx=0, Type=11, Data="r\1\0\0\0\0\0\0"}, 20, ) , Partial, 280, ... TitleIdx=0, Type=11, Data= (192, "ItemSize", Partial, 280, ... TitleIdx=0, Type=11, Data="r\1\0\0\0\0\0\0"}, 20, ) }, 20, ) == 0x0
 01536  1036   NtQueryValueKey  (192,  (192, "SaferFlags", Partial, 280, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) , Partial, 280, ... TitleIdx=0, Type=4, Data= (192, "SaferFlags", Partial, 280, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) }, 16, ) == 0x0
 01537  1036   NtClose  (192, ... ) == 0x0
 01538  1036   NtEnumerateKey  (188, 5, Basic, 280, ... ) == STATUS_NO_MORE_ENTRIES
 01539  1036   NtClose  (188, ... ) == 0x0
 01540  1036   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\0\UrlZones"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01541  1036   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\4096\Paths"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01542  1036   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\4096\Hashes"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01543  1036   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\4096\UrlZones"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01544  1036   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\65536\Paths"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01545  1036   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\65536\Hashes"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01546  1036   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\65536\UrlZones"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01547  1036   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\131072\Paths"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01548  1036   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\131072\Hashes"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01549  1036   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\131072\UrlZones"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01550  1036   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\262144\Paths"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01551  1036   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\262144\Hashes"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01552  1036   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\262144\UrlZones"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01553  1036   NtOpenThreadTokenEx  (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN
 01554  1036   NtOpenProcessTokenEx  (-1, 0x20008, 512, ... 188, ) == 0x0
 01555  1036   NtQueryInformationToken  (188, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0
 01556  1036   NtClose  (188, ... ) == 0x0
 01557  1036   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\REGISTRY\USER\S-1-5-21-1292428093-1383384898-725345543-1003\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\0\Paths"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01558  1036   NtOpenThreadTokenEx  (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN
 01559  1036   NtOpenProcessTokenEx  (-1, 0x20008, 512, ... 188, ) == 0x0
 01560  1036   NtQueryInformationToken  (188, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0
 01561  1036   NtClose  (188, ... ) == 0x0
 01562  1036   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\REGISTRY\USER\S-1-5-21-1292428093-1383384898-725345543-1003\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\0\Hashes"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01563  1036   NtOpenThreadTokenEx  (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN
 01564  1036   NtOpenProcessTokenEx  (-1, 0x20008, 512, ... 188, ) == 0x0
 01565  1036   NtQueryInformationToken  (188, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0
 01566  1036   NtClose  (188, ... ) == 0x0
 01567  1036   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\REGISTRY\USER\S-1-5-21-1292428093-1383384898-725345543-1003\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\0\UrlZones"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01568  1036   NtOpenThreadTokenEx  (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN
 01569  1036   NtOpenProcessTokenEx  (-1, 0x20008, 512, ... 188, ) == 0x0
 01570  1036   NtQueryInformationToken  (188, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0
 01571  1036   NtClose  (188, ... ) == 0x0
 01572  1036   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\REGISTRY\USER\S-1-5-21-1292428093-1383384898-725345543-1003\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\4096\Paths"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01573  1036   NtOpenThreadTokenEx  (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN
 01574  1036   NtOpenProcessTokenEx  (-1, 0x20008, 512, ... 188, ) == 0x0
 01575  1036   NtQueryInformationToken  (188, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0
 01576  1036   NtClose  (188, ... ) == 0x0
 01577  1036   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\REGISTRY\USER\S-1-5-21-1292428093-1383384898-725345543-1003\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\4096\Hashes"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01578  1036   NtOpenThreadTokenEx  (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN
 01579  1036   NtOpenProcessTokenEx  (-1, 0x20008, 512, ... 188, ) == 0x0
 01580  1036   NtQueryInformationToken  (188, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0
 01581  1036   NtClose  (188, ... ) == 0x0
 01582  1036   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\REGISTRY\USER\S-1-5-21-1292428093-1383384898-725345543-1003\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\4096\UrlZones"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01583  1036   NtOpenThreadTokenEx  (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN
 01584  1036   NtOpenProcessTokenEx  (-1, 0x20008, 512, ... 188, ) == 0x0
 01585  1036   NtQueryInformationToken  (188, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0
 01586  1036   NtClose  (188, ... ) == 0x0
 01587  1036   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\REGISTRY\USER\S-1-5-21-1292428093-1383384898-725345543-1003\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\65536\Paths"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01588  1036   NtOpenThreadTokenEx  (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN
 01589  1036   NtOpenProcessTokenEx  (-1, 0x20008, 512, ... 188, ) == 0x0
 01590  1036   NtQueryInformationToken  (188, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0
 01591  1036   NtClose  (188, ... ) == 0x0
 01592  1036   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\REGISTRY\USER\S-1-5-21-1292428093-1383384898-725345543-1003\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\65536\Hashes"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01593  1036   NtOpenThreadTokenEx  (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN
 01594  1036   NtOpenProcessTokenEx  (-1, 0x20008, 512, ... 188, ) == 0x0
 01595  1036   NtQueryInformationToken  (188, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0
 01596  1036   NtClose  (188, ... ) == 0x0
 01597  1036   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\REGISTRY\USER\S-1-5-21-1292428093-1383384898-725345543-1003\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\65536\UrlZones"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01598  1036   NtOpenThreadTokenEx  (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN
 01599  1036   NtOpenProcessTokenEx  (-1, 0x20008, 512, ... 188, ) == 0x0
 01600  1036   NtQueryInformationToken  (188, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0
 01601  1036   NtClose  (188, ... ) == 0x0
 01602  1036   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\REGISTRY\USER\S-1-5-21-1292428093-1383384898-725345543-1003\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\131072\Paths"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01603  1036   NtOpenThreadTokenEx  (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN
 01604  1036   NtOpenProcessTokenEx  (-1, 0x20008, 512, ... 188, ) == 0x0
 01605  1036   NtQueryInformationToken  (188, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0
 01606  1036   NtClose  (188, ... ) == 0x0
 01607  1036   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\REGISTRY\USER\S-1-5-21-1292428093-1383384898-725345543-1003\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\131072\Hashes"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01608  1036   NtOpenThreadTokenEx  (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN
 01609  1036   NtOpenProcessTokenEx  (-1, 0x20008, 512, ... 188, ) == 0x0
 01610  1036   NtQueryInformationToken  (188, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0
 01611  1036   NtClose  (188, ... ) == 0x0
 01612  1036   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\REGISTRY\USER\S-1-5-21-1292428093-1383384898-725345543-1003\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\131072\UrlZones"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01613  1036   NtOpenThreadTokenEx  (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN
 01614  1036   NtOpenProcessTokenEx  (-1, 0x20008, 512, ... 188, ) == 0x0
 01615  1036   NtQueryInformationToken  (188, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0
 01616  1036   NtClose  (188, ... ) == 0x0
 01617  1036   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\REGISTRY\USER\S-1-5-21-1292428093-1383384898-725345543-1003\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\262144\Paths"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01618  1036   NtOpenThreadTokenEx  (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN
 01619  1036   NtOpenProcessTokenEx  (-1, 0x20008, 512, ... 188, ) == 0x0
 01620  1036   NtQueryInformationToken  (188, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0
 01621  1036   NtClose  (188, ... ) == 0x0
 01622  1036   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\REGISTRY\USER\S-1-5-21-1292428093-1383384898-725345543-1003\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\262144\Hashes"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01623  1036   NtOpenThreadTokenEx  (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN
 01624  1036   NtOpenProcessTokenEx  (-1, 0x20008, 512, ... 188, ) == 0x0
 01625  1036   NtQueryInformationToken  (188, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0
 01626  1036   NtClose  (188, ... ) == 0x0
 01627  1036   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\REGISTRY\USER\S-1-5-21-1292428093-1383384898-725345543-1003\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\262144\UrlZones"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01628  1036   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers"}, ... 188, ) }, ... 188, ) == 0x0
 01629  1036   NtQueryValueKey  (188,  (188, "DefaultLevel", Full, 524, ... TitleIdx=0, Type=4, Name="DefaultLevel", Data="\0\0\4\0"}, 48, ) , Full, 524, ... TitleIdx=0, Type=4, Name= (188, "DefaultLevel", Full, 524, ... TitleIdx=0, Type=4, Name="DefaultLevel", Data="\0\0\4\0"}, 48, ) , Data= (188, "DefaultLevel", Full, 524, ... TitleIdx=0, Type=4, Name="DefaultLevel", Data="\0\0\4\0"}, 48, ) }, 48, ) == 0x0
 01630  1036   NtClose  (188, ... ) == 0x0
 01631  1036   NtOpenThreadTokenEx  (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN
 01632  1036   NtOpenProcessTokenEx  (-1, 0x20008, 512, ... 188, ) == 0x0
 01633  1036   NtQueryInformationToken  (188, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0
 01634  1036   NtClose  (188, ... ) == 0x0
 01635  1036   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\REGISTRY\USER\S-1-5-21-1292428093-1383384898-725345543-1003\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01636  1036   NtOpenThreadToken  (-2, 0x8, 0, ... ) == STATUS_NO_TOKEN
 01637  1036   NtOpenProcessToken  (-1, 0xa, ... 188, ) == 0x0
 01638  1036   NtDuplicateToken  (188, 0xc, {24, 0, 0x0, 0, 1240744, 0x0}, 0, 2, ... 192, ) == 0x0
 01639  1036   NtClose  (188, ... ) == 0x0
 01640  1036   NtAccessCheck  (1372592, 192, 0x1, 1240820, 1240872, 56, 1240852, ... (0x1), ) == 0x0
 01641  1036   NtClose  (192, ... ) == 0x0
 01642  1036   NtOpenKey  (0x1, {24, 0, 0x40, 0, 0,  (0x1, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers"}, ... 192, ) }, ... 192, ) == 0x0
 01643  1036   NtQueryValueKey  (192,  (192, "PolicyScope", Partial, 80, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) , Partial, 80, ... TitleIdx=0, Type=4, Data= (192, "PolicyScope", Partial, 80, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) }, 16, ) == 0x0
 01644  1036   NtClose  (192, ... ) == 0x0
 01645  1036   NtOpenSymbolicLinkObject  (0x1, {24, 0, 0x40, 0, 0,  (0x1, {24, 0, 0x40, 0, 0, "\??\C:"}, ... 192, ) }, ... 192, ) == 0x0
 01646  1036   NtQuerySymbolicLinkObject  (192, ...  (192, ... "\Device\HarddiskVolume1", 48, ) , 48, ) == 0x0
 01647  1036   NtClose  (192, ... ) == 0x0
 01648  1036   NtQueryVolumeInformationFile  (132, 1238576, 8, Device, ... {status=0x0, info=8}, ) == 0x0
 01649  1036   NtQueryInformationFile  (132, 1238692, 528, Name, ... {status=0x0, info=60}, ) == 0x0
 01650  1036   NtQueryInformationProcess  (-1, DefaultHardErrorMode, 4, ... {process info, class 12, size 4}, 0x0, ) == 0x0
 01651  1036   NtSetInformationProcess  (-1, DefaultHardErrorMode, {process info, class 12, size 4}, 4, ... ) == 0x0
 01652  1036   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\clxhwd.exe"}, 1237864, ... ) }, 1237864, ... ) == 0x0
 01653  1036   NtOpenFile  (0x100001, {24, 0, 0x40, 0, 0,  (0x100001, {24, 0, 0x40, 0, 0, "\??\C:\"}, 3, 16417, ... 192, {status=0x0, info=1}, ) }, 3, 16417, ... 192, {status=0x0, info=1}, ) == 0x0
 01654  1036   NtQueryDirectoryFile  (192, 0, 0, 0, 1237292, 616, BothDirectory, 1,  (192, 0, 0, 0, 1237292, 616, BothDirectory, 1, "WINDOWS", 0, ... {status=0x0, info=108}, ) , 0, ... {status=0x0, info=108}, ) == 0x0
 01655  1036   NtClose  (192, ... ) == 0x0
 01656  1036   NtOpenFile  (0x100001, {24, 0, 0x40, 0, 0,  (0x100001, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\"}, 3, 16417, ... 192, {status=0x0, info=1}, ) }, 3, 16417, ... 192, {status=0x0, info=1}, ) == 0x0
 01657  1036   NtQueryDirectoryFile  (192, 0, 0, 0, 1237292, 616, BothDirectory, 1,  (192, 0, 0, 0, 1237292, 616, BothDirectory, 1, "system32", 0, ... {status=0x0, info=110}, ) , 0, ... {status=0x0, info=110}, ) == 0x0
 01658  1036   NtClose  (192, ... ) == 0x0
 01659  1036   NtOpenFile  (0x100001, {24, 0, 0x40, 0, 0,  (0x100001, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\"}, 3, 16417, ... 192, {status=0x0, info=1}, ) }, 3, 16417, ... 192, {status=0x0, info=1}, ) == 0x0
 01660  1036   NtQueryDirectoryFile  (192, 0, 0, 0, 1237292, 616, BothDirectory, 1,  (192, 0, 0, 0, 1237292, 616, BothDirectory, 1, "clxhwd.exe", 0, ... {status=0x0, info=114}, ) , 0, ... {status=0x0, info=114}, ) == 0x0
 01661  1036   NtClose  (192, ... ) == 0x0
 01662  1036   NtQueryInformationProcess  (-1, DefaultHardErrorMode, 4, ... {process info, class 12, size 4}, 0x0, ) == 0x0
 01663  1036   NtSetInformationProcess  (-1, DefaultHardErrorMode, {process info, class 12, size 4}, 4, ... ) == 0x0
 01664  1036   NtQueryInformationFile  (132, 1240732, 24, Standard, ... {status=0x0, info=24}, ) == 0x0
 01665  1036   NtCreateSection  (0xf0005, 0x0, {187360, 0}, 2, 134217728, 132, ... 192, ) == 0x0
 01666  1036   NtMapViewOfSection  (192, -1, (0x0), 0, 0, {0, 0}, 187360, 1, 0, 2, ... (0x3c0000), {0, 0}, 188416, ) == 0x0
 01667  1036   NtClose  (192, ... ) == 0x0
 01668  1036   NtOpenThreadTokenEx  (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN
 01669  1036   NtOpenProcessTokenEx  (-1, 0x20008, 512, ... 192, ) == 0x0
 01670  1036   NtQueryInformationToken  (192, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0
 01671  1036   NtClose  (192, ... ) == 0x0
 01672  1036   NtOpenKey  (0x20019, {24, 0, 0x640, 0, 0,  (0x20019, {24, 0, 0x640, 0, 0, "\REGISTRY\USER\S-1-5-21-1292428093-1383384898-725345543-1003"}, ... 192, ) }, ... 192, ) == 0x0
 01673  1036   NtOpenKey  (0x20019, {24, 192, 0x40, 0, 0,  (0x20019, {24, 192, 0x40, 0, 0, "Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders"}, ... 188, ) }, ... 188, ) == 0x0
 01674  1036   NtClose  (192, ... ) == 0x0
 01675  1036   NtQueryValueKey  (188,  (188, "Cache", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 01676  1036   NtQueryValueKey  (188,  (188, "Cache", Partial, 174, ... TitleIdx=0, Type=1, Data="C\0:\0\\0D\0o\0c\0u\0m\0e\0n\0t\0s\0 \0a\0n\0d\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0M\0a\0r\0t\0i\0m\0 \0C\0a\0r\0b\0o\0n\0e\0\\0L\0o\0c\0a\0l\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0T\0e\0m\0p\0o\0r\0a\0r\0y\0 \0I\0n\0t\0e\0r\0n\0e\0t\0 \0F\0i\0l\0e\0s\0\0\0"}, 174, ) , Partial, 174, ... TitleIdx=0, Type=1, Data= (188, "Cache", Partial, 174, ... TitleIdx=0, Type=1, Data="C\0:\0\\0D\0o\0c\0u\0m\0e\0n\0t\0s\0 \0a\0n\0d\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0M\0a\0r\0t\0i\0m\0 \0C\0a\0r\0b\0o\0n\0e\0\\0L\0o\0c\0a\0l\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0T\0e\0m\0p\0o\0r\0a\0r\0y\0 \0I\0n\0t\0e\0r\0n\0e\0t\0 \0F\0i\0l\0e\0s\0\0\0"}, 174, ) }, 174, ) == 0x0
 01677  1036   NtClose  (188, ... ) == 0x0
 01678  1036   NtUnmapViewOfSection  (-1, 0x3c0000, ... ) == 0x0
 01679  1036   NtAllocateVirtualMemory  (-1, 0, 0, 4096, 8192, 4, ... 3932160, 4096, ) == 0x0
 01680  1036   NtAllocateVirtualMemory  (-1, 3932160, 0, 4096, 4096, 4, ... 3932160, 4096, ) == 0x0
 01681  1036   NtOpenKey  (0x1, {24, 0, 0x40, 0, 0,  (0x1, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers"}, ... 188, ) }, ... 188, ) == 0x0
 01682  1036   NtQueryValueKey  (188,  (188, "LogFileName", Partial, 536, ... ) , Partial, 536, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01683  1036   NtClose  (188, ... ) == 0x0
 01684  1036   NtOpenKey  (0x3, {24, 0, 0x40, 0, 0,  (0x3, {24, 0, 0x40, 0, 0, "\Registry\MACHINE\System\CurrentControlSet\Control\SafeBoot\Option"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01685  1036   NtQueryInformationToken  (184, User, 128, ... {token info, class 1, size 36}, 36, ) == 0x0
 01686  1036   NtQueryInformationToken  (184, 15, 4, ... {token info, class 15, size 4}, 4, ) == 0x0
 01687  1036   NtClose  (184, ... ) == 0x0
 01688  1036   NtQuerySection  (172, Image, 48, ... {section info, class 1, size 48}, 0x0, ) == 0x0
 01689  1036   NtOpenKey  (0x80000000, {24, 0, 0x40, 0, 0,  (0x80000000, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\clxhwd.exe"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01690  1036   NtQuerySystemInformation  (71, 4, ... {system info, class 71, size 4}, 0x0, ) == 0x0
 01691  1036   NtCreateProcessEx  (1242656, 2035711, 0, -1, 0, 172, 0, 0, 0, ... ) == 0x0
 01692  1036   NtQueryInformationProcess  (184, Basic, 24, ... {ExitStatus=0x103,PebBaseAddress=0x7ffdf000,AffinityMask=0x1,BasePriority=8,Pid=1480,ParentPid=1248,}, 0x0, ) == 0x0
 01693  1036   NtReadVirtualMemory  (184, 0x7ffdf008, 4, ...  (184, 0x7ffdf008, 4, ... "\0\0B1", 0x0, ) , 0x0, ) == 0x0
 01694  1036   NtOpenFile  (0x1200a9, {24, 0, 0x40, 0, 0,  (0x1200a9, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\clxhwd.exe.Manifest"}, 1, 96, ... ) }, 1, 96, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01695  1036   NtAllocateVirtualMemory  (-1, 1376256, 0, 8192, 4096, 4, ... 1376256, 8192, ) == 0x0
 01696  1036   NtReadVirtualMemory  (184, 0x31420000, 4096, ...  (184, 0x31420000, 4096, ... "MZ\220\0\3\0\0\0\4\0\0\0\377\377\0\0\270\0\0\0\0\0\0\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0fn\0\0\330\0\0\0\16\37\272\16\0\264\11\315!\270\1L\315!This program cannot be run in DOS mode.\15\15\12$\0\0\0\0\0\0\0I\3538\210\15\212V\333\15\212V\333\15\212V\333\216\226X\333\17\212V\333\345\225R\333\17\212V\333\15\212V\333\12\212V\333\15\212W\333[\212V\333o\225E\333\4\212V\333\345\225]\333\7\212V\333Rich\15\212V\333\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0PE\0\0L\1\4\0\310Y\330@\0\0\0\0\0\0\0\0\340\0\17\1\13\1\6\0\0 \0\0\0\20\0\0\0P\0\0\0\240\0\0\0`\0\0\0\200\0\0\0\0B1\0\20\0\0\0\2\0\0\4\0\0\0\0\0\0\0\4\0\0\0\0\0\0\0\0\260\0\0\0\20\0\0\0\0\0\0\2\0\0\0\0\0\20\0\0\20\0\0\0\0\20\0\0\20\0\0\0\0\0\0\20\0\0\0\0\0\0\0\0\0\0\0\0\200\0\0h\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0UPX0\0\0\0\0\0P\0\0\0\20\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0", 4096, ) , 4096, ) == 0x0
 01697  1036   NtQueryDebugFilterState  (53, 2, ... ) == 0x0
 01698  1036   NtQueryInformationProcess  (184, Basic, 24, ... {ExitStatus=0x103,PebBaseAddress=0x7ffdf000,AffinityMask=0x1,BasePriority=8,Pid=1480,ParentPid=1248,}, 0x0, ) == 0x0
 01699  1036   NtAllocateVirtualMemory  (-1, 0, 0, 2420, 4096, 4, ... 3997696, 4096, ) == 0x0
 01700  1036   NtAllocateVirtualMemory  (184, 0, 0, 6432, 4096, 4, ... 65536, 8192, ) == 0x0
 01701  1036   NtWriteVirtualMemory  (184, 0x10000,  (184, 0x10000, "=\0A\0:\0=\0A\0:\0\\0\0\0=\0C\0:\0=\0C\0:\0\\0s\0c\0r\0i\0p\0t\0s\0\0\0=\0U\0:\0=\0U\0:\0\\0\0\0A\0L\0L\0U\0S\0E\0R\0S\0P\0R\0O\0F\0I\0L\0E\0=\0C\0:\0\\0D\0o\0c\0u\0m\0e\0n\0t\0s\0 \0a\0n\0d\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0A\0l\0l\0 \0U\0s\0e\0r\0s\0\0\0A\0P\0P\0D\0A\0T\0A\0=\0C\0:\0\\0D\0o\0c\0u\0m\0e\0n\0t\0s\0 \0a\0n\0d\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0M\0a\0r\0t\0i\0m\0 \0C\0a\0r\0b\0o\0n\0e\0\\0A\0p\0p\0l\0i\0c\0a\0t\0i\0o\0n\0 \0D\0a\0t\0a\0\0\0A\0T\0L\0_\0I\0N\0C\0_\0P\0A\0T\0H\0=\0C\0:\0\\0W\0I\0N\0D\0D\0K\0\\03\07\09\00\0~\01\0.\01\08\03\0\\0i\0n\0c\0\0\0A\0T\0L\0_\0I\0N\0C\0_\0R\0O\0O\0T\0=\0C\0:\0\\0W\0I\0N\0D\0D\0K\0\\03\07\09\00\0~\01\0.\01\08\03\0\\0i\0n\0c\0\0\0A\0T\0L\0_\0L\0I\0B\0_\0P\0A\0T\0H\0=\0C\0:\0\\0W\0I\0N\0D\0D\0K\0\\03\07\0", 6432, ... 0x0, ) , 6432, ... 0x0, ) == 0x0
 01702  1036   NtAllocateVirtualMemory  (184, 0, 0, 2420, 4096, 4, ... 131072, 4096, ) == 0x0
 01703  1036   NtWriteVirtualMemory  (184, 0x20000,  (184, 0x20000, "\0\20\0\0t\11\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\3\0\0\0\0\0\0\0\13\0\0\0\26\0\10\2\220\2\0\0\0\0\0\0\364\3\366\3\230\4\0\0<\0>\0\220\10\0\0<\0>\0\320\10\0\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\1\0\0\0\0\0\0\0<\0>\0\20\11\0\0\36\0 \0P\11\0\0\0\0\2\0p\11\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0", 2420, ... 0x0, ) , 2420, ... 0x0, ) == 0x0
 01704  1036   NtWriteVirtualMemory  (184, 0x7ffdf010,  (184, 0x7ffdf010, "\0\0\2\0", 4, ... 0x0, ) , 4, ... 0x0, ) == 0x0
 01705  1036   NtWriteVirtualMemory  (184, 0x7ffdf1e8,  (184, 0x7ffdf1e8, "\0\0\0\0", 4, ... 0x0, ) , 4, ... 0x0, ) == 0x0
 01706  1036   NtFreeVirtualMemory  (-1, (0x3d0000), 0, 32768, ... (0x3d0000), 4096, ) == 0x0
 01707  1036   NtAllocateVirtualMemory  (184, 0, 0, 1048576, 8192, 4, ... 196608, 1048576, ) == 0x0
 01708  1036   NtAllocateVirtualMemory  (184, 1236992, 0, 8192, 4096, 4, ... 1236992, 8192, ) == 0x0
 01709  1036   NtProtectVirtualMemory  (184, (0x12e000), 4096, 260, ... (0x12e000), 4096, 4, ) == 0x0
 01710  1036   NtCreateThread  (0x1f03ff, 0x0, 184, 1242664, 1242328, 1, ... 188, {1480, 1556}, ) == 0x0
 01711  1036   NtRequestWaitReplyPort  (24, {168, 196, new_msg, 0, 69, 1364160, -2146434944, 1244532}  (24, {168, 196, new_msg, 0, 69, 1364160, -2146434944, 1244532} "\0\0\0\0\0\0\1\0\377\377\377\377\0\0\0\0\273\0\0\0\274\0\0\0\310\5\0\0\24\6\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\10\20\0\0x\371\22\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\360\375\177\0\0\0\0\0\0\24\0\326z\202|" ... {168, 196, reply, 0, 1248, 1036, 57975, 0} "\0\0\0\0\0\0\1\0\0\0\0\0\0\0\0\0\270\0\0\0\274\0\0\0\310\5\0\0\24\6\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\10\20\0\0x\371\22\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\360\375\177\0\0\0\0\0\0\24\0\326z\202|" )  ... {168, 196, reply, 0, 1248, 1036, 57975, 0}  (24, {168, 196, new_msg, 0, 69, 1364160, -2146434944, 1244532} "\0\0\0\0\0\0\1\0\377\377\377\377\0\0\0\0\273\0\0\0\274\0\0\0\310\5\0\0\24\6\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\10\20\0\0x\371\22\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\360\375\177\0\0\0\0\0\0\24\0\326z\202|" ... {168, 196, reply, 0, 1248, 1036, 57975, 0} "\0\0\0\0\0\0\1\0\0\0\0\0\0\0\0\0\270\0\0\0\274\0\0\0\310\5\0\0\24\6\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\10\20\0\0x\371\22\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\360\375\177\0\0\0\0\0\0\24\0\326z\202|" )  ) == 0x0
 01712  1036   NtResumeThread  (188, ... 1, ) == 0x0
 01713  1036   NtClose  (132, ... ) == 0x0
 01714  1036   NtClose  (172, ... ) == 0x0
 01715  1036   NtQueryInformationProcess  (184, Basic, 24, ... {ExitStatus=0x103,PebBaseAddress=0x7ffdf000,AffinityMask=0x1,BasePriority=8,Pid=1480,ParentPid=1248,}, 0x0, ) == 0x0
 01716  1036   NtUserWaitForInputIdle  (1480, 30000, 0, ...
 01717  1036   NtCreateEvent  (0x1f0003, 0x0, 0, 0, ... 172, ) == 0x0
 01718  1036   NtClose  (172, ... ) == 0x0
 01716  1036   NtUserWaitForInputIdle  ... ) == 0x0
 01719  1036   NtClose  (184, ... ) == 0x0
 01720  1036   NtClose  (188, ... ) == 0x0
 01721  1036   NtDelayExecution  (0, {-5000000, -1}, ... ) == 0x0
 01722  1036   NtTerminateProcess  (0, 0, ...
 00671  1756   NtWaitForMultipleObjects  ... ) == 0xc0
 01722  1036   NtTerminateProcess  ... ) == 0x0
 01723  1036   NtQueryVirtualMemory  (-1, 0xb26d20, Basic, 28, ... {BaseAddress=0xb26000,AllocationBase=0xaf0000,AllocationProtect=0x80,RegionSize=0x3c000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 01724  1036   NtQueryVirtualMemory  (-1, 0xb2762c, Basic, 28, ... {BaseAddress=0xb27000,AllocationBase=0xaf0000,AllocationProtect=0x80,RegionSize=0x3b000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 01725  1036   NtQueryVirtualMemory  (-1, 0xafcef4, Basic, 28, ... {BaseAddress=0xafc000,AllocationBase=0xaf0000,AllocationProtect=0x80,RegionSize=0x66000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 01726  1036   NtGdiDeleteObjectApp  (1527383604, ... ) == 0x1
 01727  1036   NtGdiDeleteObjectApp  (856295063, ... ) == 0x1
 01728  1036   NtGdiDeleteObjectApp  (2081032088, ... ) == 0x1
 01729  1036   NtUserDestroyCursor  (262819, 1, ... ) == 0x1
 01730  1036   NtUserDestroyCursor  (1180071, 1, ... ) == 0x1
 01731  1036   NtUserDestroyCursor  (590411, 1, ... ) == 0x1
 01732  1036   NtUserDestroyCursor  (787101, 1, ... ) == 0x1
 01733  1036   NtUserDestroyCursor  (328163, 1, ... ) == 0x1
 01734  1036   NtUserDestroyCursor  (1573423, 1, ... ) == 0x1
 01735  1036   NtUserDestroyCursor  (393695, 1, ... ) == 0x1
 01736  1036   NtUserFindExistingCursorIcon  (1243440, 1243456, 1243504, ... ) == 0x10011
 01737  1036   NtDeleteAtom  (49188, ... ) == 0x0
 01738  1036   NtDeleteAtom  (49195, ... ) == 0x0
 01739  1036   NtGdiDeleteObjectApp  (856163553, ... ) == 0x1
 01740  1036   NtClose  (128, ... ) == 0x0
 01741  1036   NtSetInformationThread  (-2, ZeroTlsCell, {ZeroTlsCell=0x9,}, 4, ... ) == 0x0
 01742  1036   NtSetInformationThread  (-2, ZeroTlsCell, {ZeroTlsCell=0x8,}, 4, ... ) == 0x0
 01743  1036   NtUserGetAtomName  (49211, 1243528, ... ) == 0xf
 01744  1036   NtUserUnregisterClass  (1243588, 1560870912, 1243576, ... ) == 0x1
 01745  1036   NtUserGetAtomName  (49213, 1243528, ... ) == 0xd
 01746  1036   NtUserUnregisterClass  (1243588, 1560870912, 1243576, ... ) == 0x1
 01747  1036   NtUserGetAtomName  (49215, 1243528, ... ) == 0x10
 01748  1036   NtUserUnregisterClass  (1243588, 1560870912, 1243576, ... ) == 0x1
 01749  1036   NtUserGetAtomName  (49217, 1243528, ... ) == 0x12
 01750  1036   NtUserUnregisterClass  (1243588, 1560870912, 1243576, ... ) == 0x1
 01751  1036   NtUserGetAtomName  (49219, 1243528, ... ) == 0xd
 01752  1036   NtUserUnregisterClass  (1243588, 1560870912, 1243576, ... ) == 0x1
 01753  1036   NtUserGetAtomName  (49221, 1243528, ... ) == 0xb
 01754  1036   NtUserUnregisterClass  (1243588, 1560870912, 1243576, ... ) == 0x1
 01755  1036   NtUserGetAtomName  (49223, 1243528, ... ) == 0xf
 01756  1036   NtUserUnregisterClass  (1243588, 1560870912, 1243576, ... ) == 0x1
 01757  1036   NtUserGetAtomName  (49225, 1243528, ... ) == 0xd
 01758  1036   NtUserUnregisterClass  (1243588, 1560870912, 1243576, ... ) == 0x1
 01759  1036   NtUserGetAtomName  (49227, 1243528, ... ) == 0x11
 01760  1036   NtUserUnregisterClass  (1243588, 1560870912, 1243576, ... ) == 0x1
 01761  1036   NtUserGetAtomName  (49229, 1243528, ... ) == 0xf
 01762  1036   NtUserUnregisterClass  (1243588, 1560870912, 1243576, ... ) == 0x1
 01763  1036   NtUserGetAtomName  (49231, 1243528, ... ) == 0x11
 01764  1036   NtUserUnregisterClass  (1243588, 1560870912, 1243576, ... ) == 0x1
 01765  1036   NtUserGetAtomName  (49233, 1243528, ... ) == 0xf
 01766  1036   NtUserUnregisterClass  (1243588, 1560870912, 1243576, ... ) == 0x1
 01767  1036   NtUserGetAtomName  (49235, 1243528, ... ) == 0xc
 01768  1036   NtUserUnregisterClass  (1243588, 1560870912, 1243576, ... ) == 0x1
 01769  1036   NtUserGetAtomName  (49237, 1243520, ... ) == 0xd
 01770  1036   NtUserUnregisterClass  (1243580, 1560870912, 1243568, ... ) == 0x1
 01771  1036   NtUserGetAtomName  (49239, 1243520, ... ) == 0x11
 01772  1036   NtUserUnregisterClass  (1243580, 1560870912, 1243568, ... ) == 0x1
 01773  1036   NtUserGetAtomName  (49241, 1243528, ... ) == 0xc
 01774  1036   NtUserUnregisterClass  (1243588, 1560870912, 1243576, ... ) == 0x1
 01775  1036   NtUserGetAtomName  (49243, 1243528, ... ) == 0xe
 01776  1036   NtUserUnregisterClass  (1243588, 1560870912, 1243576, ... ) == 0x1
 01777  1036   NtUserGetAtomName  (49245, 1243528, ... ) == 0x8
 01778  1036   NtUserUnregisterClass  (1243588, 1560870912, 1243576, ... ) == 0x1
 01779  1036   NtUserGetAtomName  (49247, 1243528, ... ) == 0xd
 01780  1036   NtUserUnregisterClass  (1243588, 1560870912, 1243576, ... ) == 0x1
 01781  1036   NtUnmapViewOfSection  (-1, 0x390000, ... ) == 0x0
 01782  1036   NtSetInformationThread  (-2, ZeroTlsCell, {ZeroTlsCell=0x7,}, 4, ... ) == 0x0
 01783  1036   NtFreeVirtualMemory  (-1, (0x370000), 0, 32768, ... (0x370000), 65536, ) == 0x0
 01784  1036   NtUserGetAtomName  (49211, 1243560, ... ) == 0xf
 01785  1036   NtUserUnregisterClass  (1243620, 2000486400, 1243608, ... ) == 0x1
 01786  1036   NtUserGetAtomName  (49213, 1243560, ... ) == 0xd
 01787  1036   NtUserUnregisterClass  (1243620, 2000486400, 1243608, ... ) == 0x1
 01788  1036   NtUserGetAtomName  (49215, 1243560, ... ) == 0x10
 01789  1036   NtUserUnregisterClass  (1243620, 2000486400, 1243608, ... ) == 0x1
 01790  1036   NtUserGetAtomName  (49217, 1243560, ... ) == 0x12
 01791  1036   NtUserUnregisterClass  (1243620, 2000486400, 1243608, ... ) == 0x1
 01792  1036   NtUserGetAtomName  (49219, 1243560, ... ) == 0xd
 01793  1036   NtUserUnregisterClass  (1243620, 2000486400, 1243608, ... ) == 0x1
 01794  1036   NtUserGetAtomName  (49221, 1243560, ... ) == 0xb
 01795  1036   NtUserUnregisterClass  (1243620, 2000486400, 1243608, ... ) == 0x1
 01796  1036   NtUserGetAtomName  (49223, 1243560, ... ) == 0xf
 01797  1036   NtUserUnregisterClass  (1243620, 2000486400, 1243608, ... ) == 0x1
 01798  1036   NtUserGetAtomName  (49225, 1243560, ... ) == 0xd
 01799  1036   NtUserUnregisterClass  (1243620, 2000486400, 1243608, ... ) == 0x1
 01800  1036   NtUserGetAtomName  (49227, 1243560, ... ) == 0x11
 01801  1036   NtUserUnregisterClass  (1243620, 2000486400, 1243608, ... ) == 0x1
 01802  1036   NtUserGetAtomName  (49229, 1243560, ... ) == 0xf
 01803  1036   NtUserUnregisterClass  (1243620, 2000486400, 1243608, ... ) == 0x1
 01804  1036   NtUserGetAtomName  (49231, 1243560, ... ) == 0x11
 01805  1036   NtUserUnregisterClass  (1243620, 2000486400, 1243608, ... ) == 0x1
 01806  1036   NtUserGetAtomName  (49233, 1243560, ... ) == 0xf
 01807  1036   NtUserUnregisterClass  (1243620, 2000486400, 1243608, ... ) == 0x1
 01808  1036   NtUserGetAtomName  (49235, 1243560, ... ) == 0xc
 01809  1036   NtUserUnregisterClass  (1243620, 2000486400, 1243608, ... ) == 0x1
 01810  1036   NtUserGetAtomName  (49237, 1243552, ... ) == 0xd
 01811  1036   NtUserUnregisterClass  (1243612, 2000486400, 1243600, ... ) == 0x1
 01812  1036   NtUserGetAtomName  (49239, 1243552, ... ) == 0x11
 01813  1036   NtUserUnregisterClass  (1243612, 2000486400, 1243600, ... ) == 0x1
 01814  1036   NtUserGetAtomName  (49241, 1243560, ... ) == 0xc
 01815  1036   NtUserUnregisterClass  (1243620, 2000486400, 1243608, ... ) == 0x1
 01816  1036   NtUserGetAtomName  (49243, 1243560, ... ) == 0xe
 01817  1036   NtUserUnregisterClass  (1243620, 2000486400, 1243608, ... ) == 0x1
 01818  1036   NtUserGetAtomName  (49245, 1243560, ... ) == 0x8
 01819  1036   NtUserUnregisterClass  (1243620, 2000486400, 1243608, ... ) == 0x1
 01820  1036   NtUserGetAtomName  (49247, 1243560, ... ) == 0xd
 01821  1036   NtUserUnregisterClass  (1243620, 2000486400, 1243608, ... ) == 0x1
 01822  1036   NtUserGetAtomName  (49175, 1243560, ... ) == 0x6
 01823  1036   NtUserUnregisterClass  (1243620, 2000486400, 1243608, ... ) == 0x1
 01824  1036   NtUserGetAtomName  (49177, 1243560, ... ) == 0x6
 01825  1036   NtUserUnregisterClass  (1243620, 2000486400, 1243608, ... ) == 0x1
 01826  1036   NtUserGetAtomName  (49176, 1243560, ... ) == 0x4
 01827  1036   NtUserUnregisterClass  (1243620, 2000486400, 1243608, ... ) == 0x1
 01828  1036   NtUserGetAtomName  (49178, 1243560, ... ) == 0x7
 01829  1036   NtUserUnregisterClass  (1243620, 2000486400, 1243608, ... ) == 0x1
 01830  1036   NtUserGetAtomName  (49180, 1243560, ... ) == 0x8
 01831  1036   NtUserUnregisterClass  (1243620, 2000486400, 1243608, ... ) == 0x1
 01832  1036   NtUserGetAtomName  (49182, 1243560, ... ) == 0x9
 01833  1036   NtUserUnregisterClass  (1243620, 2000486400, 1243608, ... ) == 0x1
 01834  1036   NtUserGetAtomName  (49179, 1243552, ... ) == 0x9
 01835  1036   NtUserUnregisterClass  (1243612, 2000486400, 1243600, ... ) == 0x1
 01836  1036   NtUserGetAtomName  (49256, 1243560, ... ) == 0x7
 01837  1036   NtUserUnregisterClass  (1243620, 2000486400, 1243608, ... ) == 0x1
 01838  1036   NtUserGetAtomName  (49258, 1243560, ... ) == 0xd
 01839  1036   NtUserUnregisterClass  (1243620, 2000486400, 1243608, ... ) == 0x1
 01840  1036   NtUnmapViewOfSection  (-1, 0x380000, ... ) == 0x0
 01841  1036   NtDeviceIoControlFile  (56, 60, 0x0, 0x12facc, 0x22415c,  (56, 60, 0x0, 0x12facc, 0x22415c, "U\4\376\14\272\223\15D\243\376U9s\320\267#@\0\0\0\0\0\0\0\10 \217\0\306\205\337w", 32, 32, ... {status=0x0, info=32}, "U\4\376\14\272\223\15D\243\376U9s\320\267#@\0\0\0\0\0\0\0\10 \217\0\306\205\337w", ) , 32, 32, ... {status=0x0, info=32},  (56, 60, 0x0, 0x12facc, 0x22415c, "U\4\376\14\272\223\15D\243\376U9s\320\267#@\0\0\0\0\0\0\0\10 \217\0\306\205\337w", 32, 32, ... {status=0x0, info=32}, "U\4\376\14\272\223\15D\243\376U9s\320\267#@\0\0\0\0\0\0\0\10 \217\0\306\205\337w", ) , ) == 0x0
 01842  1036   NtDeviceIoControlFile  (56, 60, 0x0, 0x12fa94, 0x228168,  (56, 60, 0x0, 0x12fa94, 0x228168, "@\0\0\0\0\0\0\0", 8, 0, ... {status=0x0, info=0}, 0x0, ) , 8, 0, ... {status=0x0, info=0}, 0x0, ) == 0x0
 01843  1036   NtDeviceIoControlFile  (56, 60, 0x0, 0x12facc, 0x22415c,  (56, 60, 0x0, 0x12facc, 0x22415c, "\254\253\177yX{\226G\271$\325\21x\245\234\344\\0\0\0\0\0\0\0\10 \217\0\306\205\337w", 32, 32, ... {status=0x0, info=32}, "\254\253\177yX{\226G\271$\325\21x\245\234\344\\0\0\0\0\0\0\0\10 \217\0\306\205\337w", ) , 32, 32, ... {status=0x0, info=32},  (56, 60, 0x0, 0x12facc, 0x22415c, "\254\253\177yX{\226G\271$\325\21x\245\234\344\\0\0\0\0\0\0\0\10 \217\0\306\205\337w", 32, 32, ... {status=0x0, info=32}, "\254\253\177yX{\226G\271$\325\21x\245\234\344\\0\0\0\0\0\0\0\10 \217\0\306\205\337w", ) , ) == 0x0
 01844  1036   NtDeviceIoControlFile  (56, 60, 0x0, 0x12fa94, 0x228168,  (56, 60, 0x0, 0x12fa94, 0x228168, "\\0\0\0\0\0\0\0", 8, 0, ... {status=0x0, info=0}, 0x0, ) , 8, 0, ... {status=0x0, info=0}, 0x0, ) == 0x0
 01845  1036   NtSetInformationThread  (-2, ZeroTlsCell, {ZeroTlsCell=0x2,}, 4, ... ) == 0x0
 01846  1036   NtSetInformationThread  (-2, ZeroTlsCell, {ZeroTlsCell=0x3,}, 4, ... ) == 0x0
 01847  1036   NtSetInformationThread  (-2, ZeroTlsCell, {ZeroTlsCell=0x4,}, 4, ... ) == 0x0
 01848  1036   NtClose  (48, ... ) == 0x0
 01849  1036   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\GRE_Initialize"}, ... 48, ) }, ... 48, ) == 0x0
 01850  1036   NtQueryValueKey  (48,  (48, "DisableMetaFiles", Partial, 20, ... ) , Partial, 20, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01851  1036   NtClose  (48, ... ) == 0x0
 01852  1036   NtQueryInformationProcess  (-1, 36, 4, ... {process info, class 36, size 4}, 0x0, ) == 0x0
 01853  1036   NtQueryInformationProcess  (-1, 36, 4, ... {process info, class 36, size 4}, 0x0, ) == 0x0
 01854  1036   NtQueryVirtualMemory  (-1, 0x77c2807c, Basic, 28, ... {BaseAddress=0x77c28000,AllocationBase=0x77c10000,AllocationProtect=0x80,RegionSize=0x35000,State=0x1000,Protect=0x20,Type=0x1000000,}, 28, ) == 0x0
 01855  1036   NtClose  (124, ... ) == 0x0
 01856  1036   NtClose  (56, ... ) == 0x0
 01857  1036   NtFreeVirtualMemory  (-1, (0x3c0000), 4096, 32768, ... (0x3c0000), 4096, ) == 0x0
 01858  1036   NtRequestWaitReplyPort  (24, {20, 48, new_msg, 0, 2089871292, 1310720, 1244456, 0}  (24, {20, 48, new_msg, 0, 2089871292, 1310720, 1244456, 0} "\0\0\0\0\3\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0" ... {20, 48, reply, 0, 1248, 1036, 58017, 0} "\0\0\0\0\3\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0" )  ... {20, 48, reply, 0, 1248, 1036, 58017, 0}  (24, {20, 48, new_msg, 0, 2089871292, 1310720, 1244456, 0} "\0\0\0\0\3\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0" ... {20, 48, reply, 0, 1248, 1036, 58017, 0} "\0\0\0\0\3\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0" )  ) == 0x0
 01859  1036   NtTerminateProcess  (-1, 0, ...