Summary:

NtAccessCheck(>) 1 NtSetInformationThread(>) 1 NtQueryInformationProcess(>) 3 NtQueryInformationToken(>) 15
NtAddAtom(>) 1 NtTestAlert(>) 1 NtSetInformationFile(>) 3 NtFlushInstructionCache(>) 16
NtCallbackReturn(>) 1 NtUserGetDC(>) 1 NtUserRegisterWindowMessage(>) 3 NtQuerySystemInformation(>) 17
NtConnectPort(>) 1 NtUserGetGUIThreadInfo(>) 1 NtOpenProcessToken(>) 4 NtOpenFile(>) 19
NtDeviceIoControlFile(>) 1 NtUserGetProcessWindowStation(>) 1 NtQueryKey(>) 4 NtOpenSection(>) 22
NtEnumerateValueKey(>) 1 NtUserGetThreadDesktop(>) 1 NtSetInformationObject(>) 4 NtQueryAttributesFile(>) 22
NtFsControlFile(>) 1 NtCreateFile(>) 2 NtGdiGetStockObject(>) 5 NtWaitForSingleObject(>) 25
NtGdiCreateBitmap(>) 1 NtCreateKey(>) 2 NtQueryDefaultUILanguage(>) 6 NtMapViewOfSection(>) 30
NtGdiCreatePatternBrushInternal(>) 1 NtDuplicateObject(>) 2 NtQuerySection(>) 6 NtProtectVirtualMemory(>) 32
NtGdiInit(>) 1 NtGdiCreateSolidBrush(>) 2 NtQueryVolumeInformationFile(>) 7 NtUserGetClassInfo(>) 37
NtGdiQueryFontAssocInfo(>) 1 NtGdiHfontCreate(>) 2 NtQueryDebugFilterState(>) 8 NtAllocateVirtualMemory(>) 46
NtGdiSelectBitmap(>) 1 NtNotifyChangeKey(>) 2 NtRequestWaitReplyPort(>) 8 NtReleaseMutant(>) 46
NtOpenEvent(>) 1 NtOpenDirectoryObject(>) 2 NtUnmapViewOfSection(>) 8 NtUserFindExistingCursorIcon(>) 48
NtOpenKeyedEvent(>) 1 NtQueryInstallUILanguage(>) 2 NtUserCallNoParam(>) 9 NtUserRegisterClassExWOW(>) 63
NtOpenMutant(>) 1 NtQueryVirtualMemory(>) 2 NtUserGetWindowDC(>) 10 NtOpenKey(>) 79
NtOpenProcess(>) 1 NtSetValueKey(>) 2 NtOpenProcessTokenEx(>) 11 NtQueryValueKey(>) 105
NtOpenSymbolicLinkObject(>) 1 NtUserGetObjectInformation(>) 2 NtOpenThreadTokenEx(>) 11 NtClose(>) 111
NtQueryObject(>) 1 NtCreateEvent(>) 3 NtUserSystemParametersInfo(>) 11 NtContinue(>) 4047
NtQuerySymbolicLinkObject(>) 1 NtGdiCreateCompatibleDC(>) 3 NtCreateSection(>) 12
NtRegisterThreadTerminatePort(>) 1 NtQueryDefaultLocale(>) 3 NtFreeVirtualMemory(>) 13
NtSecureConnectPort(>) 1

Trace:

00001 452 NtOpenKey (0x80000000, {24, 0, 0x40, 0, 0, (0x80000000, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\packed.exe"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 00002 452 NtOpenKeyedEvent (0x2000000, {24, 0, 0x0, 0, 0, (0x2000000, {24, 0, 0x0, 0, 0, "\KernelObjects\CritSecOutOfMemoryEvent"}, ... 4, ) }, ... 4, ) == 0x0 00003 452 NtQuerySystemInformation (Basic, 44, ... {Unknown=0,MaximumIncrement=156250,PhysicalPageSize=0x1000,NumberOfPhysicalPages=0xff7c,LowestPhysicalPage=0x1,HighestPhysicalPage=0xffff,AllocationGranularity=0x10000,LowestUserAddress=0x10000,HighestUserAddress=0x7ffeffff,ActiveProcessors=1,NumberProcessors=1,}, 0x0, ) == 0x0 00004 452 NtAllocateVirtualMemory (-1, 0, 0, 1048576, 8192, 4, ... 1310720, 1048576, ) == 0x0 00005 452 NtAllocateVirtualMemory (-1, 1310720, 0, 4096, 4096, 4, ... 1310720, 4096, ) == 0x0 00006 452 NtAllocateVirtualMemory (-1, 1314816, 0, 8192, 4096, 4, ... 1314816, 8192, ) == 0x0 00007 452 NtQuerySystemInformation (Basic, 44, ... {Unknown=0,MaximumIncrement=156250,PhysicalPageSize=0x1000,NumberOfPhysicalPages=0xff7c,LowestPhysicalPage=0x1,HighestPhysicalPage=0xffff,AllocationGranularity=0x10000,LowestUserAddress=0x10000,HighestUserAddress=0x7ffeffff,ActiveProcessors=1,NumberProcessors=1,}, 0x0, ) == 0x0 00008 452 NtAllocateVirtualMemory (-1, 0, 0, 65536, 8192, 4, ... 2359296, 65536, ) == 0x0 00009 452 NtAllocateVirtualMemory (-1, 2359296, 0, 24576, 4096, 4, ... 2359296, 24576, ) == 0x0 00010 452 NtOpenDirectoryObject (0x3, {24, 0, 0x40, 0, 0, (0x3, {24, 0, 0x40, 0, 0, "\KnownDlls"}, ... 8, ) }, ... 8, ) == 0x0 00011 452 NtOpenSymbolicLinkObject (0x1, {24, 8, 0x40, 0, 0, (0x1, {24, 8, 0x40, 0, 0, "KnownDllPath"}, ... 12, ) }, ... 12, ) == 0x0 00012 452 NtQuerySymbolicLinkObject (12, ... (12, ... "C:\WINDOWS\system32", 0x0, ) , 0x0, ) == 0x0 00013 452 NtClose (12, ... ) == 0x0 00014 452 NtOpenFile (0x100020, {24, 0, 0x42, 0, 0, (0x100020, {24, 0, 0x42, 0, 0, "\??\U:\startupscripts\"}, 3, 33, ... 12, {status=0x0, info=1}, ) }, 3, 33, ... 12, {status=0x0, info=1}, ) == 0x0 00015 452 NtQueryVolumeInformationFile (12, 1243848, 8, Device, ... {status=0x0, info=8}, ) == 0x0 00016 452 NtFsControlFile (12, 0, 0x0, 0x0, 0x90028, 0x0, 0, 0, ... ) == STATUS_INVALID_PARAMETER 00017 452 NtQueryAttributesFile ({24, 0, 0x40, 0, 0, ({24, 0, 0x40, 0, 0, "\??\u:\work\packed.exe.Local"}, 1243832, ... ) }, 1243832, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 00018 452 NtOpenSection (0xe, {24, 8, 0x40, 0, 0, (0xe, {24, 8, 0x40, 0, 0, "kernel32.dll"}, ... 16, ) }, ... 16, ) == 0x0 00019 452 NtMapViewOfSection (16, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x77e60000), 0x0, 937984, ) == 0x0 00020 452 NtClose (16, ... ) == 0x0 00021 452 NtQuerySystemInformation (RangeStart, 4, ... {system info, class 50, size 4}, 0x0, ) == 0x0 00022 452 NtQuerySystemInformation (Basic, 44, ... {Unknown=0,MaximumIncrement=156250,PhysicalPageSize=0x1000,NumberOfPhysicalPages=0xff7c,LowestPhysicalPage=0x1,HighestPhysicalPage=0xffff,AllocationGranularity=0x10000,LowestUserAddress=0x10000,HighestUserAddress=0x7ffeffff,ActiveProcessors=1,NumberProcessors=1,}, 0x0, ) == 0x0 00023 452 NtCreateSection (0xf001f, 0x0, {65536, 0}, 4, 67108864, 0, ... 16, ) == 0x0 00024 452 NtSecureConnectPort ( ("\Windows\ApiPort", {0, 2, 1, 1}, {24, 16, 0, 65536, 0, 0}, 1319736, {12, 0, 0}, 1242016, 44, ... 24, {24, 16, 0, 65536, 2424832, 18481152}, {0, 0, 0}, 200, 44, ) , {0, 2, 1, 1}, {24, 16, 0, 65536, 0, 0}, 1319736, {12, 0, 0}, 1242016, 44, ... 24, {24, 16, 0, 65536, 2424832, 18481152}, {0, 0, 0}, 200, 44, ) == 0x0 00025 452 NtClose (16, ... ) == 0x0 00026 452 NtQueryObject (24, Handle, 2, ... {Inherit=0,ProtectFromClose=0,}, -1, ) == 0x0 00027 452 NtSetInformationObject (24, Handle, {Inherit=0,ProtectFromClose=1,}, 256, ... ) == 0x0 00028 452 NtQuerySystemInformation (Basic, 44, ... {Unknown=0,MaximumIncrement=156250,PhysicalPageSize=0x1000,NumberOfPhysicalPages=0xff7c,LowestPhysicalPage=0x1,HighestPhysicalPage=0xffff,AllocationGranularity=0x10000,LowestUserAddress=0x10000,HighestUserAddress=0x7ffeffff,ActiveProcessors=1,NumberProcessors=1,}, 0x0, ) == 0x0 00029 452 NtQueryVirtualMemory (-1, 0x250000, Basic, 28, ... {BaseAddress=0x250000,AllocationBase=0x250000,AllocationProtect=0x4,RegionSize=0x10000,State=0x2000,Protect=0x0,Type=0x40000,}, 0x0, ) == 0x0 00030 452 NtAllocateVirtualMemory (-1, 2424832, 0, 4096, 4096, 4, ... 2424832, 4096, ) == 0x0 00031 452 NtRequestWaitReplyPort (24, {28, 56, new_msg, 0, 0, 0, 0, 0} (24, {28, 56, new_msg, 0, 0, 0, 0, 0} "\210\6\32\1\0\0\0\0\0\0\0\0\0\0\0\0\1\0\0\0\234\6\32\1\4\0\0\0" ... {28, 56, reply, 0, 448, 452, 1529, 0} "\330\375\26\0\0\0\0\0\0\0\0\0\0\0\0\0\1\0\0\0\234\6\32\1\4\0\0\0" ) ... {28, 56, reply, 0, 448, 452, 1529, 0} (24, {28, 56, new_msg, 0, 0, 0, 0, 0} "\210\6\32\1\0\0\0\0\0\0\0\0\0\0\0\0\1\0\0\0\234\6\32\1\4\0\0\0" ... {28, 56, reply, 0, 448, 452, 1529, 0} "\330\375\26\0\0\0\0\0\0\0\0\0\0\0\0\0\1\0\0\0\234\6\32\1\4\0\0\0" ) ) == 0x0 00032 452 NtRegisterThreadTerminatePort (24, ... ) == 0x0 00033 452 NtOpenKey (0x20019, {24, 0, 0x40, 0, 0, (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\System\CurrentControlSet\Control\Terminal Server"}, ... 16, ) }, ... 16, ) == 0x0 00034 452 NtQueryValueKey (16, (16, "TSAppCompat", Partial, 548, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) , Partial, 548, ... TitleIdx=0, Type=4, Data= (16, "TSAppCompat", Partial, 548, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) }, 16, ) == 0x0 00035 452 NtClose (16, ... ) == 0x0 00036 452 NtAllocateVirtualMemory (-1, 1232896, 0, 4096, 4096, 260, ... 1232896, 4096, ) == 0x0 00037 452 NtOpenMutant (0x1, {24, 0, 0x40, 0, 0, (0x1, {24, 0, 0x40, 0, 0, "\NlsCacheMutant"}, ... 16, ) }, ... 16, ) == 0x0 00038 452 NtOpenSection (0x4, {24, 0, 0x40, 0, 0, (0x4, {24, 0, 0x40, 0, 0, "\NLS\NlsSectionUnicode"}, ... 28, ) }, ... 28, ) == 0x0 00039 452 NtMapViewOfSection (28, -1, (0x0), 0, 0, 0x0, 0, 2, 0, 2, ... (0x260000), 0x0, 90112, ) == 0x0 00040 452 NtClose (28, ... ) == 0x0 00041 452 NtQueryDefaultLocale (0, 2012046252, ... ) == 0x0 00042 452 NtOpenSection (0x4, {24, 0, 0x40, 0, 0, (0x4, {24, 0, 0x40, 0, 0, "\NLS\NlsSectionLocale"}, ... 28, ) }, ... 28, ) == 0x0 00043 452 NtMapViewOfSection (28, -1, (0x0), 0, 0, 0x0, 0, 2, 0, 2, ... (0x280000), 0x0, 212992, ) == 0x0 00044 452 NtClose (28, ... ) == 0x0 00045 452 NtOpenSection (0x5, {24, 0, 0x40, 0, 0, (0x5, {24, 0, 0x40, 0, 0, "\NLS\NlsSectionSortkey"}, ... 28, ) }, ... 28, ) == 0x0 00046 452 NtMapViewOfSection (28, -1, (0x0), 0, 0, 0x0, 0, 2, 0, 2, ... (0x2c0000), 0x0, 266240, ) == 0x0 00047 452 NtQuerySection (28, Basic, 16, ... {BaseAddress=0x0,Attributes=0x800000,Size={0x40004, 0x0},}, 0x0, ) == 0x0 00048 452 NtClose (28, ... ) == 0x0 00049 452 NtOpenSection (0x4, {24, 0, 0x40, 0, 0, (0x4, {24, 0, 0x40, 0, 0, "\NLS\NlsSectionSortTbls"}, ... 28, ) }, ... 28, ) == 0x0 00050 452 NtMapViewOfSection (28, -1, (0x0), 0, 0, 0x0, 0, 2, 0, 2, ... (0x310000), 0x0, 24576, ) == 0x0 00051 452 NtClose (28, ... ) == 0x0 00052 452 NtQueryVirtualMemory (-1, 0x7ffd2000, Basic, 28, ... {BaseAddress=0x7ffd2000,AllocationBase=0x7ffb0000,AllocationProtect=0x2,RegionSize=0x2000,State=0x1000,Protect=0x2,Type=0x40000,}, 0x0, ) == 0x0 00053 452 NtOpenSection (0x4, {24, 0, 0x40, 0, 0, (0x4, {24, 0, 0x40, 0, 0, "\NLS\NlsSectionSortkey00000409"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 00054 452 NtOpenSection (0x4, {24, 0, 0x40, 0, 0, (0x4, {24, 0, 0x40, 0, 0, "\NLS\NlsSectionSortkey00000409"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 00055 452 NtRequestWaitReplyPort (24, {28, 56, new_msg, 0, 2012558373, 2012047104, 2013025280, 0} (24, {28, 56, new_msg, 0, 2012558373, 2012047104, 2013025280, 0} "\210\6\32\1\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\234\6\32\18\6\0\0" ... {28, 56, reply, 0, 448, 452, 1532, 0} "(\261\26\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\234\6\32\18\6\0\0" ) ... {28, 56, reply, 0, 448, 452, 1532, 0} (24, {28, 56, new_msg, 0, 2012558373, 2012047104, 2013025280, 0} "\210\6\32\1\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\234\6\32\18\6\0\0" ... {28, 56, reply, 0, 448, 452, 1532, 0} "(\261\26\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\234\6\32\18\6\0\0" ) ) == 0x0 00056 452 NtProtectVirtualMemory (-1, (0x480000), 94208, 4, ... (0x480000), 94208, 128, ) == 0x0 00057 452 NtProtectVirtualMemory (-1, (0x480000), 94208, 128, ... (0x480000), 94208, 4, ) == 0x0 00058 452 NtFlushInstructionCache (-1, 4718592, 94208, ... ) == 0x0 00059 452 NtOpenSection (0xe, {24, 8, 0x40, 0, 0, (0xe, {24, 8, 0x40, 0, 0, "user32.dll"}, ... 28, ) }, ... 28, ) == 0x0 00060 452 NtMapViewOfSection (28, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x77d40000), 0x0, 577536, ) == 0x0 00061 452 NtClose (28, ... ) == 0x0 00062 452 NtOpenSection (0xe, {24, 8, 0x40, 0, 0, (0xe, {24, 8, 0x40, 0, 0, "GDI32.dll"}, ... 28, ) }, ... 28, ) == 0x0 00063 452 NtMapViewOfSection (28, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x77c70000), 0x0, 262144, ) == 0x0 00064 452 NtClose (28, ... ) == 0x0 00065 452 NtOpenSection (0xe, {24, 8, 0x40, 0, 0, (0xe, {24, 8, 0x40, 0, 0, "ADVAPI32.dll"}, ... 28, ) }, ... 28, ) == 0x0 00066 452 NtMapViewOfSection (28, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x77dd0000), 0x0, 569344, ) == 0x0 00067 452 NtClose (28, ... ) == 0x0 00068 452 NtOpenSection (0xe, {24, 8, 0x40, 0, 0, (0xe, {24, 8, 0x40, 0, 0, "RPCRT4.dll"}, ... 28, ) }, ... 28, ) == 0x0 00069 452 NtMapViewOfSection (28, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x77cc0000), 0x0, 479232, ) == 0x0 00070 452 NtClose (28, ... ) == 0x0 00071 452 NtProtectVirtualMemory (-1, (0x480000), 94208, 4, ... (0x480000), 94208, 64, ) == 0x0 00072 452 NtProtectVirtualMemory (-1, (0x480000), 94208, 64, ... (0x480000), 94208, 4, ) == 0x0 00073 452 NtFlushInstructionCache (-1, 4718592, 94208, ... ) == 0x0 00074 452 NtProtectVirtualMemory (-1, (0x480000), 94208, 4, ... (0x480000), 94208, 64, ) == 0x0 00075 452 NtProtectVirtualMemory (-1, (0x480000), 94208, 64, ... (0x480000), 94208, 4, ) == 0x0 00076 452 NtFlushInstructionCache (-1, 4718592, 94208, ... ) == 0x0 00077 452 NtOpenSection (0xe, {24, 8, 0x40, 0, 0, (0xe, {24, 8, 0x40, 0, 0, "oleaut32.dll"}, ... 28, ) }, ... 28, ) == 0x0 00078 452 NtMapViewOfSection (28, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x77120000), 0x0, 569344, ) == 0x0 00079 452 NtClose (28, ... ) == 0x0 00080 452 NtOpenSection (0xe, {24, 8, 0x40, 0, 0, (0xe, {24, 8, 0x40, 0, 0, "MSVCRT.DLL"}, ... 28, ) }, ... 28, ) == 0x0 00081 452 NtMapViewOfSection (28, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x77c10000), 0x0, 339968, ) == 0x0 00082 452 NtClose (28, ... ) == 0x0 00083 452 NtOpenSection (0xe, {24, 8, 0x40, 0, 0, (0xe, {24, 8, 0x40, 0, 0, "OLE32.DLL"}, ... 28, ) }, ... 28, ) == 0x0 00084 452 NtMapViewOfSection (28, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x771b0000), 0x0, 1155072, ) == 0x0 00085 452 NtClose (28, ... ) == 0x0 00086 452 NtProtectVirtualMemory (-1, (0x480000), 94208, 4, ... (0x480000), 94208, 64, ) == 0x0 00087 452 NtProtectVirtualMemory (-1, (0x480000), 94208, 64, ... (0x480000), 94208, 4, ) == 0x0 00088 452 NtFlushInstructionCache (-1, 4718592, 94208, ... ) == 0x0 00089 452 NtProtectVirtualMemory (-1, (0x480000), 94208, 4, ... (0x480000), 94208, 64, ) == 0x0 00090 452 NtProtectVirtualMemory (-1, (0x480000), 94208, 64, ... (0x480000), 94208, 4, ) == 0x0 00091 452 NtFlushInstructionCache (-1, 4718592, 94208, ... ) == 0x0 00092 452 NtOpenSection (0xe, {24, 8, 0x40, 0, 0, (0xe, {24, 8, 0x40, 0, 0, "shell32.dll"}, ... 28, ) }, ... 28, ) == 0x0 00093 452 NtMapViewOfSection (28, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x773d0000), 0x0, 8339456, ) == 0x0 00094 452 NtClose (28, ... ) == 0x0 00095 452 NtOpenSection (0xe, {24, 8, 0x40, 0, 0, (0xe, {24, 8, 0x40, 0, 0, "SHLWAPI.dll"}, ... 28, ) }, ... 28, ) == 0x0 00096 452 NtMapViewOfSection (28, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x772d0000), 0x0, 405504, ) == 0x0 00097 452 NtClose (28, ... ) == 0x0 00098 452 NtProtectVirtualMemory (-1, (0x480000), 94208, 4, ... (0x480000), 94208, 64, ) == 0x0 00099 452 NtProtectVirtualMemory (-1, (0x480000), 94208, 64, ... (0x480000), 94208, 4, ) == 0x0 00100 452 NtFlushInstructionCache (-1, 4718592, 94208, ... ) == 0x0 00101 452 NtOpenSection (0xe, {24, 8, 0x40, 0, 0, (0xe, {24, 8, 0x40, 0, 0, "ws2_32.dll"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 00102 452 NtAllocateVirtualMemory (-1, 1323008, 0, 4096, 4096, 4, ... 1323008, 4096, ) == 0x0 00103 452 NtQueryAttributesFile ({24, 0, 0x40, 0, 0, ({24, 0, 0x40, 0, 0, "\??\u:\work\ws2_32.dll"}, 1242624, ... ) }, 1242624, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 00104 452 NtQueryAttributesFile ({24, 12, 0x40, 0, 0, ({24, 12, 0x40, 0, 0, "ws2_32.dll"}, 1242624, ... ) }, 1242624, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 00105 452 NtQueryAttributesFile ({24, 0, 0x40, 0, 0, ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\System32\ws2_32.dll"}, 1242624, ... ) }, 1242624, ... ) == 0x0 00106 452 NtOpenFile (0x100020, {24, 0, 0x40, 0, 0, (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\System32\ws2_32.dll"}, 5, 96, ... 28, {status=0x0, info=1}, ) }, 5, 96, ... 28, {status=0x0, info=1}, ) == 0x0 00107 452 NtCreateSection (0xf, 0x0, 0x0, 16, 16777216, 28, ... 32, ) == 0x0 00108 452 NtQuerySection (32, Image, 48, ... {section info, class 1, size 48}, 0x0, ) == 0x0 00109 452 NtOpenProcessToken (-1, 0x8, ... 36, ) == 0x0 00110 452 NtQueryInformationToken (36, User, 136, ... {token info, class 1, size 36}, 36, ) == 0x0 00111 452 NtOpenKey (0x3, {24, 0, 0x40, 0, 0, (0x3, {24, 0, 0x40, 0, 0, "\Registry\MACHINE\System\CurrentControlSet\Control\SafeBoot\Option"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 00112 452 NtOpenKey (0x1, {24, 0, 0x40, 0, 0, (0x1, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers"}, ... 40, ) }, ... 40, ) == 0x0 00113 452 NtQueryValueKey (40, (40, "TransparentEnabled", Partial, 80, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) , Partial, 80, ... TitleIdx=0, Type=4, Data= (40, "TransparentEnabled", Partial, 80, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) }, 16, ) == 0x0 00114 452 NtClose (40, ... ) == 0x0 00115 452 NtOpenThreadTokenEx (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN 00116 452 NtOpenProcessTokenEx (-1, 0x20008, 512, ... 40, ) == 0x0 00117 452 NtQueryInformationToken (40, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0 00118 452 NtClose (40, ... ) == 0x0 00119 452 NtOpenKey (0x1, {24, 0, 0x40, 0, 0, (0x1, {24, 0, 0x40, 0, 0, "\REGISTRY\USER\S-1-5-21-1078081533-484763869-839522115-1003\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 00120 452 NtClose (36, ... ) == 0x0 00121 452 NtClose (28, ... ) == 0x0 00122 452 NtMapViewOfSection (32, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x71ab0000), 0x0, 86016, ) == 0x0 00123 452 NtClose (32, ... ) == 0x0 00124 452 NtOpenSection (0xe, {24, 8, 0x40, 0, 0, (0xe, {24, 8, 0x40, 0, 0, "WS2HELP.dll"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 00125 452 NtQueryAttributesFile ({24, 0, 0x40, 0, 0, ({24, 0, 0x40, 0, 0, "\??\u:\work\WS2HELP.dll"}, 1241820, ... ) }, 1241820, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 00126 452 NtQueryAttributesFile ({24, 12, 0x40, 0, 0, ({24, 12, 0x40, 0, 0, "WS2HELP.dll"}, 1241820, ... ) }, 1241820, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 00127 452 NtQueryAttributesFile ({24, 0, 0x40, 0, 0, ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\System32\WS2HELP.dll"}, 1241820, ... ) }, 1241820, ... ) == 0x0 00128 452 NtOpenFile (0x100020, {24, 0, 0x40, 0, 0, (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\System32\WS2HELP.dll"}, 5, 96, ... 32, {status=0x0, info=1}, ) }, 5, 96, ... 32, {status=0x0, info=1}, ) == 0x0 00129 452 NtCreateSection (0xf, 0x0, 0x0, 16, 16777216, 32, ... 28, ) == 0x0 00130 452 NtQuerySection (28, Image, 48, ... {section info, class 1, size 48}, 0x0, ) == 0x0 00131 452 NtClose (32, ... ) == 0x0 00132 452 NtMapViewOfSection (28, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x71aa0000), 0x0, 32768, ) == 0x0 00133 452 NtClose (28, ... ) == 0x0 00134 452 NtProtectVirtualMemory (-1, (0x480000), 94208, 4, ... (0x480000), 94208, 64, ) == 0x0 00135 452 NtProtectVirtualMemory (-1, (0x480000), 94208, 64, ... (0x480000), 94208, 4, ) == 0x0 00136 452 NtFlushInstructionCache (-1, 4718592, 94208, ... ) == 0x0 00137 452 NtProtectVirtualMemory (-1, (0x480000), 94208, 4, ... (0x480000), 94208, 64, ) == 0x0 00138 452 NtProtectVirtualMemory (-1, (0x480000), 94208, 64, ... (0x480000), 94208, 4, ) == 0x0 00139 452 NtFlushInstructionCache (-1, 4718592, 94208, ... ) == 0x0 00140 452 NtProtectVirtualMemory (-1, (0x480000), 94208, 4, ... (0x480000), 94208, 64, ) == 0x0 00141 452 NtProtectVirtualMemory (-1, (0x480000), 94208, 64, ... (0x480000), 94208, 4, ) == 0x0 00142 452 NtFlushInstructionCache (-1, 4718592, 94208, ... ) == 0x0 00143 452 NtOpenProcessToken (-1, 0x8, ... 28, ) == 0x0 00144 452 NtQueryInformationToken (28, Statistics, 56, ... {token info, class 10, size 56}, 56, ) == 0x0 00145 452 NtClose (28, ... ) == 0x0 00146 452 NtOpenKey (0x20019, {24, 0, 0x40, 0, 0, (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\System\CurrentControlSet\Control\Terminal Server"}, ... 28, ) }, ... 28, ) == 0x0 00147 452 NtQueryValueKey (28, (28, "TSAppCompat", Partial, 548, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) , Partial, 548, ... TitleIdx=0, Type=4, Data= (28, "TSAppCompat", Partial, 548, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) }, 16, ) == 0x0 00148 452 NtClose (28, ... ) == 0x0 00149 452 NtOpenKey (0x20019, {24, 0, 0x40, 0, 0, (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\System\CurrentControlSet\Control\Terminal Server"}, ... 28, ) }, ... 28, ) == 0x0 00150 452 NtQueryValueKey (28, (28, "TSAppCompat", Partial, 548, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) , Partial, 548, ... TitleIdx=0, Type=4, Data= (28, "TSAppCompat", Partial, 548, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) }, 16, ) == 0x0 00151 452 NtQueryValueKey (28, (28, "TSUserEnabled", Partial, 548, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) , Partial, 548, ... TitleIdx=0, Type=4, Data= (28, "TSUserEnabled", Partial, 548, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) }, 16, ) == 0x0 00152 452 NtClose (28, ... ) == 0x0 00153 452 NtOpenKey (0x20019, {24, 0, 0x40, 0, 0, (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon"}, ... 28, ) }, ... 28, ) == 0x0 00154 452 NtQueryValueKey (28, (28, "LeakTrack", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 00155 452 NtClose (28, ... ) == 0x0 00156 452 NtOpenKey (0x2000000, {24, 0, 0x40, 0, 0, (0x2000000, {24, 0, 0x40, 0, 0, "\REGISTRY\MACHINE"}, ... 28, ) }, ... 28, ) == 0x0 00157 452 NtSetInformationObject (28, Handle, {Inherit=0,ProtectFromClose=1,}, 2011365632, ... ) == 0x0 00158 452 NtOpenKey (0x20019, {24, 28, 0x40, 0, 0, (0x20019, {24, 28, 0x40, 0, 0, "Software\Microsoft\Windows NT\CurrentVersion\Diagnostics"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 00159 452 NtQuerySystemInformation (Basic, 44, ... {Unknown=0,MaximumIncrement=156250,PhysicalPageSize=0x1000,NumberOfPhysicalPages=0xff7c,LowestPhysicalPage=0x1,HighestPhysicalPage=0xffff,AllocationGranularity=0x10000,LowestUserAddress=0x10000,HighestUserAddress=0x7ffeffff,ActiveProcessors=1,NumberProcessors=1,}, 0x0, ) == 0x0 00160 452 NtRequestWaitReplyPort (24, {28, 56, new_msg, 0, 1246456, 1, 24, 2012568566} (24, {28, 56, new_msg, 0, 1246456, 1, 24, 2012568566} "\210\6\32\1\0\0\0\0\314\4\23\0\324Wh\364\3\0\0\0\234\6\32\1$\1\0\0" ... {28, 56, reply, 0, 448, 452, 1570, 0} "XQ\26\0\0\0\0\0\0\0\0\0\324Wh\364\3\0\0\0\234\6\32\1$\1\0\0" ) ... {28, 56, reply, 0, 448, 452, 1570, 0} (24, {28, 56, new_msg, 0, 1246456, 1, 24, 2012568566} "\210\6\32\1\0\0\0\0\314\4\23\0\324Wh\364\3\0\0\0\234\6\32\1$\1\0\0" ... {28, 56, reply, 0, 448, 452, 1570, 0} "XQ\26\0\0\0\0\0\0\0\0\0\324Wh\364\3\0\0\0\234\6\32\1$\1\0\0" ) ) == 0x0 00161 452 NtOpenKey (0x20019, {24, 0, 0x40, 0, 0, (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\System\CurrentControlSet\Control\Error Message Instrument\"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 00162 452 NtMapViewOfSection (32, -1, (0x0), 0, 0, 0x0, 0, 2, 0, 2, ... (0x4a0000), 0x0, 1060864, ) == 0x0 00163 452 NtCreateEvent (0x1f0003, 0x0, 1, 0, ... 36, ) == 0x0 00164 452 NtOpenThreadTokenEx (-2, 0x8, 1, 512, ... ) == STATUS_NO_TOKEN 00165 452 NtOpenProcessTokenEx (-1, 0x8, 512, ... -2147482012, ) == 0x0 00166 452 NtQueryInformationToken (-2147482012, Statistics, 0, ... ) == STATUS_BUFFER_TOO_SMALL 00167 452 NtQueryInformationToken (-2147482012, Statistics, 56, ... {token info, class 10, size 56}, 56, ) == 0x0 00168 452 NtClose (-2147482012, ... ) == 0x0 00169 452 NtAllocateVirtualMemory (-1, 0, 0, 32, 4096, 4, ... 4128768, 4096, ) == 0x0 00170 452 NtFreeVirtualMemory (-1, (0x3f0000), 4096, 32768, ... (0x3f0000), 4096, ) == 0x0 00171 452 NtDuplicateObject (-1, 40, -1, 0x0, 0, 2, ... 48, ) == 0x0 00172 452 NtOpenKey (0x20019, {24, 0, 0x240, 0, 0, (0x20019, {24, 0, 0x240, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Compatibility32"}, ... -2147482012, ) }, ... -2147482012, ) == 0x0 00173 452 NtQueryValueKey (-2147482012, (-2147482012, "packed", Partial, 172, ... ) , Partial, 172, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 00174 452 NtClose (-2147482012, ... ) == 0x0 00175 452 NtOpenKey (0x20019, {24, 0, 0x240, 0, 0, (0x20019, {24, 0, 0x240, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\IME Compatibility"}, ... -2147482012, ) }, ... -2147482012, ) == 0x0 00176 452 NtQueryValueKey (-2147482012, (-2147482012, "packed", Partial, 172, ... ) , Partial, 172, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 00177 452 NtClose (-2147482012, ... ) == 0x0 00178 452 NtQueryDefaultLocale (0, -136148468, ... ) == 0x0 00179 452 NtGdiQueryFontAssocInfo (0, ... ) == 0x0 00180 452 NtUserCallNoParam (24, ... ) == 0x0 00181 452 NtGdiCreateCompatibleDC (0, ... 00182 452 NtAllocateVirtualMemory (-1, 0, 0, 4096, 12288, 4, ... 4128768, 4096, ) == 0x0 00181 452 NtGdiCreateCompatibleDC ... ) == 0xe010451 00183 452 NtGdiGetStockObject (0, ... ) == 0x1900010 00184 452 NtGdiGetStockObject (4, ... ) == 0x1900011 00185 452 NtGdiCreateBitmap (8, 8, 1, 1, 2010393708, ... ) == 0xb050458 00186 452 NtGdiCreateSolidBrush (0, 0, ... 00187 452 NtAllocateVirtualMemory (-1, 0, 0, 4096, 12288, 4, ... 9109504, 4096, ) == 0x0 00186 452 NtGdiCreateSolidBrush ... ) == 0x810045b 00188 452 NtGdiGetStockObject (13, ... ) == 0x18a0021 00189 452 NtGdiCreateCompatibleDC (0, ... ) == 0x601045c 00190 452 NtGdiSelectBitmap (100729948, 184878168, ... ) == 0x185000f 00191 452 NtUserGetThreadDesktop (452, 0, ... ) == 0x2c 00192 452 NtOpenKey (0x20019, {24, 0, 0x40, 0, 0, (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Windows"}, ... 52, ) }, ... 52, ) == 0x0 00193 452 NtQueryValueKey (52, (52, "AppInit_DLLs", Partial, 64, ... TitleIdx=0, Type=1, Data="\0\0"}, 14, ) , Partial, 64, ... TitleIdx=0, Type=1, Data= (52, "AppInit_DLLs", Partial, 64, ... TitleIdx=0, Type=1, Data="\0\0"}, 14, ) }, 14, ) == 0x0 00194 452 NtClose (52, ... ) == 0x0 00195 452 NtUserFindExistingCursorIcon (1241204, 1241220, 1241788, ... ) == 0x10011 00196 452 NtUserRegisterClassExWOW (1241724, 1241804, 1241788, 1241820, 673, 128, 0, ... ) == 0x810cc017 00197 452 NtUserFindExistingCursorIcon (1241204, 1241220, 1241788, ... ) == 0x10011 00198 452 NtUserRegisterClassExWOW (1241724, 1241804, 1241788, 1241820, 674, 128, 0, ... ) == 0x810cc01c 00199 452 NtUserFindExistingCursorIcon (1241204, 1241220, 1241788, ... ) == 0x10011 00200 452 NtUserRegisterClassExWOW (1241724, 1241804, 1241788, 1241820, 675, 128, 0, ... ) == 0x810cc01e 00201 452 NtUserFindExistingCursorIcon (1241204, 1241220, 1241788, ... ) == 0x10011 00202 452 NtUserRegisterClassExWOW (1241724, 1241804, 1241788, 1241820, 676, 128, 0, ... ) == 0x810c8002 00203 452 NtUserFindExistingCursorIcon (1241204, 1241220, 1241788, ... ) == 0x10013 00204 452 NtUserRegisterClassExWOW (1241724, 1241804, 1241788, 1241820, 677, 128, 0, ... ) == 0x810cc018 00205 452 NtUserFindExistingCursorIcon (1241204, 1241220, 1241788, ... ) == 0x10011 00206 452 NtUserRegisterClassExWOW (1241724, 1241804, 1241788, 1241820, 678, 128, 0, ... ) == 0x810cc01a 00207 452 NtUserFindExistingCursorIcon (1241204, 1241220, 1241788, ... ) == 0x10011 00208 452 NtUserRegisterClassExWOW (1241724, 1241804, 1241788, 1241820, 679, 128, 0, ... ) == 0x810cc01d 00209 452 NtUserFindExistingCursorIcon (1241204, 1241220, 1241788, ... ) == 0x10011 00210 452 NtUserRegisterClassExWOW (1241724, 1241804, 1241788, 1241820, 681, 128, 0, ... ) == 0x810cc026 00211 452 NtUserFindExistingCursorIcon (1241204, 1241220, 1241788, ... ) == 0x10011 00212 452 NtUserRegisterClassExWOW (1241724, 1241804, 1241788, 1241820, 680, 128, 0, ... ) == 0x810cc019 00213 452 NtUserRegisterClassExWOW (1241676, 1241756, 1241740, 1241772, 0, 128, 0, ... ) == 0x810cc020 00214 452 NtUserRegisterClassExWOW (1241676, 1241752, 1241768, 1241740, 0, 130, 0, ... ) == 0x810cc022 00215 452 NtUserRegisterClassExWOW (1241676, 1241756, 1241740, 1241772, 0, 128, 0, ... ) == 0x810cc023 00216 452 NtUserRegisterClassExWOW (1241676, 1241752, 1241768, 1241740, 0, 130, 0, ... ) == 0x810cc024 00217 452 NtUserRegisterClassExWOW (1241676, 1241756, 1241740, 1241772, 0, 128, 0, ... 00218 452 NtAllocateVirtualMemory (-1, 6074368, 0, 4096, 4096, 32, ... 6074368, 4096, ) == 0x0 00217 452 NtUserRegisterClassExWOW ... ) == 0x810cc025 00219 452 NtCallbackReturn (0, 0, 0, ... 00220 452 NtGdiInit (... ) == 0x1 00221 452 NtGdiGetStockObject (18, ... ) == 0x290001c 00222 452 NtGdiGetStockObject (19, ... ) == 0x1b00019 00223 452 NtQuerySystemInformation (Basic, 44, ... {Unknown=0,MaximumIncrement=156250,PhysicalPageSize=0x1000,NumberOfPhysicalPages=0xff7c,LowestPhysicalPage=0x1,HighestPhysicalPage=0xffff,AllocationGranularity=0x10000,LowestUserAddress=0x10000,HighestUserAddress=0x7ffeffff,ActiveProcessors=1,NumberProcessors=1,}, 0x0, ) == 0x0 00224 452 NtAllocateVirtualMemory (-1, 0, 0, 65536, 8192, 4, ... 9175040, 65536, ) == 0x0 00225 452 NtAllocateVirtualMemory (-1, 9175040, 0, 4096, 4096, 4, ... 9175040, 4096, ) == 0x0 00226 452 NtAllocateVirtualMemory (-1, 9179136, 0, 8192, 4096, 4, ... 9179136, 8192, ) == 0x0 00227 452 NtOpenSection (0x4, {24, 0, 0x40, 0, 0, (0x4, {24, 0, 0x40, 0, 0, "\NLS\NlsSectionCType"}, ... 52, ) }, ... 52, ) == 0x0 00228 452 NtMapViewOfSection (52, -1, (0x0), 0, 0, 0x0, 0, 2, 0, 2, ... (0x8d0000), 0x0, 12288, ) == 0x0 00229 452 NtClose (52, ... ) == 0x0 00230 452 NtAllocateVirtualMemory (-1, 9187328, 0, 4096, 4096, 4, ... 9187328, 4096, ) == 0x0 00231 452 NtQuerySystemInformation (Basic, 44, ... {Unknown=0,MaximumIncrement=156250,PhysicalPageSize=0x1000,NumberOfPhysicalPages=0xff7c,LowestPhysicalPage=0x1,HighestPhysicalPage=0xffff,AllocationGranularity=0x10000,LowestUserAddress=0x10000,HighestUserAddress=0x7ffeffff,ActiveProcessors=1,NumberProcessors=1,}, 0x0, ) == 0x0 00232 452 NtQuerySystemInformation (Processor, 12, ... {system info, class 1, size 12}, 0x0, ) == 0x0 00233 452 NtOpenKey (0x20019, {24, 28, 0x40, 0, 0, (0x20019, {24, 28, 0x40, 0, 0, "SYSTEM\CurrentControlSet\Control\Session Manager"}, ... 52, ) }, ... 52, ) == 0x0 00234 452 NtQueryValueKey (52, (52, "CriticalSectionTimeout", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\215'\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (52, "CriticalSectionTimeout", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\215'\0"}, 16, ) }, 16, ) == 0x0 00235 452 NtClose (52, ... ) == 0x0 00236 452 NtQuerySystemInformation (Basic, 44, ... {Unknown=0,MaximumIncrement=156250,PhysicalPageSize=0x1000,NumberOfPhysicalPages=0xff7c,LowestPhysicalPage=0x1,HighestPhysicalPage=0xffff,AllocationGranularity=0x10000,LowestUserAddress=0x10000,HighestUserAddress=0x7ffeffff,ActiveProcessors=1,NumberProcessors=1,}, 0x0, ) == 0x0 00237 452 NtQuerySystemInformation (Processor, 12, ... {system info, class 1, size 12}, 0x0, ) == 0x0 00238 452 NtAllocateVirtualMemory (-1, 1327104, 0, 4096, 4096, 4, ... 1327104, 4096, ) == 0x0 00239 452 NtQuerySystemInformation (Basic, 44, ... {Unknown=0,MaximumIncrement=156250,PhysicalPageSize=0x1000,NumberOfPhysicalPages=0xff7c,LowestPhysicalPage=0x1,HighestPhysicalPage=0xffff,AllocationGranularity=0x10000,LowestUserAddress=0x10000,HighestUserAddress=0x7ffeffff,ActiveProcessors=1,NumberProcessors=1,}, 0x0, ) == 0x0 00240 452 NtQuerySystemInformation (Processor, 12, ... {system info, class 1, size 12}, 0x0, ) == 0x0 00241 452 NtOpenKey (0x20019, {24, 0, 0x40, 0, 0, (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Classes\Interface"}, ... 52, ) }, ... 52, ) == 0x0 00242 452 NtQueryValueKey (52, (52, "InterfaceHelperDisableAll", Full, 0, ... ) , Full, 0, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 00243 452 NtQueryValueKey (52, (52, "InterfaceHelperDisableAllForOle32", Full, 0, ... ) , Full, 0, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 00244 452 NtQueryValueKey (52, (52, "InterfaceHelperDisableTypeLib", Full, 0, ... ) , Full, 0, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 00245 452 NtClose (52, ... ) == 0x0 00246 452 NtOpenKey (0x20019, {24, 0, 0x40, 0, 0, (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Classes\Interface\{00020400-0000-0000-C000-000000000046}"}, ... 52, ) }, ... 52, ) == 0x0 00247 452 NtQueryValueKey (52, (52, "InterfaceHelperDisableAll", Full, 0, ... ) , Full, 0, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 00248 452 NtQueryValueKey (52, (52, "InterfaceHelperDisableAllForOle32", Full, 0, ... ) , Full, 0, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 00249 452 NtClose (52, ... ) == 0x0 00250 452 NtOpenDirectoryObject (0x2000f, {24, 0, 0x40, 0, 0, (0x2000f, {24, 0, 0x40, 0, 0, "\BaseNamedObjects"}, ... 52, ) }, ... 52, ) == 0x0 00251 452 NtOpenEvent (0x1f0003, {24, 52, 0x0, 0, 0, (0x1f0003, {24, 52, 0x0, 0, 0, "HookSwitchHookEnabledEvent"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 00252 452 NtUserRegisterWindowMessage ( ("{FB8F0821-0164-101B-84ED-08002B2EC713}", ... ) , ... ) == 0xc07b 00253 452 NtOpenKey (0x1, {24, 28, 0x40, 0, 0, (0x1, {24, 28, 0x40, 0, 0, "SOFTWARE\Microsoft\OLEAUT"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 00254 452 NtOpenKey (0x9, {24, 28, 0x40, 0, 0, (0x9, {24, 28, 0x40, 0, 0, "SOFTWARE\Microsoft\OLEAUT\UserEra"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 00255 452 NtOpenKey (0x1, {24, 0, 0x40, 0, 0, (0x1, {24, 0, 0x40, 0, 0, "\Registry\MACHINE\System\CurrentControlSet\Control\Session Manager"}, ... 56, ) }, ... 56, ) == 0x0 00256 452 NtQueryValueKey (56, (56, "SafeDllSearchMode", Partial, 16, ... ) , Partial, 16, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 00257 452 NtClose (56, ... ) == 0x0 00258 452 NtOpenKey (0x1, {24, 28, 0x40, 0, 0, (0x1, {24, 28, 0x40, 0, 0, "SOFTWARE\Microsoft\OLEAUT"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 00259 452 NtOpenKey (0x2000000, {24, 28, 0x40, 0, 0, (0x2000000, {24, 28, 0x40, 0, 0, "Software\Microsoft\Windows\CurrentVersion\Explorer\Performance"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 00260 452 NtOpenKey (0x1, {24, 28, 0x40, 0, 0, (0x1, {24, 28, 0x40, 0, 0, "SYSTEM\Setup"}, ... 56, ) }, ... 56, ) == 0x0 00261 452 NtQueryValueKey (56, (56, "SystemSetupInProgress", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (56, "SystemSetupInProgress", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) }, 16, ) == 0x0 00262 452 NtClose (56, ... ) == 0x0 00263 452 NtQueryDefaultUILanguage (1241756, ... 00264 452 NtOpenThreadTokenEx (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN 00265 452 NtOpenProcessTokenEx (-1, 0x20008, 512, ... -2147482012, ) == 0x0 00266 452 NtQueryInformationToken (-2147482012, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0 00267 452 NtClose (-2147482012, ... ) == 0x0 00268 452 NtOpenKey (0x2000000, {24, 0, 0x640, 0, 0, (0x2000000, {24, 0, 0x640, 0, 0, "\REGISTRY\USER\S-1-5-21-1078081533-484763869-839522115-1003"}, ... -2147482012, ) }, ... -2147482012, ) == 0x0 00269 452 NtOpenKey (0x80000000, {24, 0, 0x240, 0, 0, (0x80000000, {24, 0, 0x240, 0, 0, "\Registry\Machine\System\CurrentControlSet\Control\Nls\MUILanguages"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 00270 452 NtOpenKey (0x80000000, {24, -2147482012, 0x640, 0, 0, (0x80000000, {24, -2147482012, 0x640, 0, 0, "Control Panel\Desktop"}, ... -2147482024, ) }, ... -2147482024, ) == 0x0 00271 452 NtQueryValueKey (-2147482024, (-2147482024, "MultiUILanguageId", Partial, 256, ... ) , Partial, 256, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 00272 452 NtClose (-2147482024, ... ) == 0x0 00273 452 NtClose (-2147482012, ... ) == 0x0 00263 452 NtQueryDefaultUILanguage ... ) == 0x0 00274 452 NtOpenKey (0x20019, {24, 0, 0x40, 0, 0, (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\System\CurrentControlSet\Control\Nls\MUILanguages"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 00275 452 NtQueryInstallUILanguage (2012047340, ... ) == 0x0 00276 452 NtOpenFile (0x1200a9, {24, 0, 0x40, 0, 0, (0x1200a9, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\shell32.dll"}, 1, 96, ... 56, {status=0x0, info=1}, ) }, 1, 96, ... 56, {status=0x0, info=1}, ) == 0x0 00277 452 NtCreateSection (0x4, 0x0, 0x0, 2, 134217728, 56, ... 60, ) == 0x0 00278 452 NtMapViewOfSection (60, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 2, ... (0x8e0000), 0x0, 8323072, ) == 0x0 00279 452 NtOpenFile (0x1200a9, {24, 0, 0x40, 0, 0, (0x1200a9, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\shell32.dll.124.Manifest"}, 1, 96, ... ) }, 1, 96, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 00280 452 NtQueryDefaultUILanguage (2013024600, ... 00281 452 NtOpenThreadTokenEx (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN 00282 452 NtOpenProcessTokenEx (-1, 0x20008, 512, ... -2147482012, ) == 0x0 00283 452 NtQueryInformationToken (-2147482012, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0 00284 452 NtClose (-2147482012, ... ) == 0x0 00285 452 NtOpenKey (0x2000000, {24, 0, 0x640, 0, 0, (0x2000000, {24, 0, 0x640, 0, 0, "\REGISTRY\USER\S-1-5-21-1078081533-484763869-839522115-1003"}, ... -2147482012, ) }, ... -2147482012, ) == 0x0 00286 452 NtOpenKey (0x80000000, {24, 0, 0x240, 0, 0, (0x80000000, {24, 0, 0x240, 0, 0, "\Registry\Machine\System\CurrentControlSet\Control\Nls\MUILanguages"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 00287 452 NtOpenKey (0x80000000, {24, -2147482012, 0x640, 0, 0, (0x80000000, {24, -2147482012, 0x640, 0, 0, "Control Panel\Desktop"}, ... -2147482024, ) }, ... -2147482024, ) == 0x0 00288 452 NtQueryValueKey (-2147482024, (-2147482024, "MultiUILanguageId", Partial, 256, ... ) , Partial, 256, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 00289 452 NtClose (-2147482024, ... ) == 0x0 00290 452 NtClose (-2147482012, ... ) == 0x0 00280 452 NtQueryDefaultUILanguage ... ) == 0x0 00291 452 NtAllocateVirtualMemory (-1, 1228800, 0, 4096, 4096, 260, ... 1228800, 4096, ) == 0x0 00292 452 NtQueryInstallUILanguage (2013024602, ... ) == 0x0 00293 452 NtQueryDefaultLocale (1, 1239792, ... ) == 0x0 00294 452 NtOpenFile (0x1200a9, {24, 0, 0x40, 0, 0, (0x1200a9, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\shell32.dll.124.Config"}, 1, 96, ... ) }, 1, 96, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 00295 452 NtRequestWaitReplyPort (24, {128, 156, new_msg, 0, 1240648, 1, 96, 0} (24, {128, 156, new_msg, 0, 1240648, 1, 96, 0} "\210\6\32\1\33\0\1\0\0\0\0\0\1\361\22\0\1\0\0\0\0\0\11\4\1\1\1\0>\0@\0\250\6\32\18\0\0\0\377\377\377\377\0\0\0\0\20\311\305\0\0\0\0\0\236\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0(\0,\0\350\6\32\1\0\0\0\0\0\0\0\0H\365\22\0\0\0\0\0" ... {128, 156, reply, 0, 448, 452, 1571, 0} " S\26\0\33\0\1\0\0\0\0\0\1\361\22\0\1\0\0\0\0\0\11\4\1\1\1\0>\0@\0\250\6\32\18\0\0\0\377\377\377\377\0\0\0\0\20\311\305\0\0\0\0\0\236\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0(\0,\0\350\6\32\1\0\0\0\0\0\0\0\0H\365\22\0\0\0\0\0" ) ... {128, 156, reply, 0, 448, 452, 1571, 0} (24, {128, 156, new_msg, 0, 1240648, 1, 96, 0} "\210\6\32\1\33\0\1\0\0\0\0\0\1\361\22\0\1\0\0\0\0\0\11\4\1\1\1\0>\0@\0\250\6\32\18\0\0\0\377\377\377\377\0\0\0\0\20\311\305\0\0\0\0\0\236\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0(\0,\0\350\6\32\1\0\0\0\0\0\0\0\0H\365\22\0\0\0\0\0" ... {128, 156, reply, 0, 448, 452, 1571, 0} " S\26\0\33\0\1\0\0\0\0\0\1\361\22\0\1\0\0\0\0\0\11\4\1\1\1\0>\0@\0\250\6\32\18\0\0\0\377\377\377\377\0\0\0\0\20\311\305\0\0\0\0\0\236\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0(\0,\0\350\6\32\1\0\0\0\0\0\0\0\0H\365\22\0\0\0\0\0" ) ) == 0x0 00296 452 NtClose (56, ... ) == 0x0 00297 452 NtClose (60, ... ) == 0x0 00298 452 NtUnmapViewOfSection (-1, 0x8e0000, ... ) == 0x0 00299 452 NtUnmapViewOfSection (-1, 0x12f548, ... ) == STATUS_NOT_MAPPED_VIEW 00300 452 NtQueryDebugFilterState (53, 2, ... ) == 0x0 00301 452 NtOpenKey (0x8, {24, 0, 0x40, 0, 0, (0x8, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows\CurrentVersion\SideBySide\AssemblyStorageRoots"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 00302 452 NtQueryDebugFilterState (53, 2, ... ) == 0x0 00303 452 NtQueryDebugFilterState (53, 2, ... ) == 0x0 00304 452 NtQueryAttributesFile ({24, 0, 0x40, 0, 0, ({24, 0, 0x40, 0, 0, "\??\u:\work\packed.exe.Local\"}, 1238876, ... ) }, 1238876, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 00305 452 NtQueryDebugFilterState (53, 2, ... ) == 0x0 00306 452 NtQueryDebugFilterState (53, 2, ... ) == 0x0 00307 452 NtQueryDebugFilterState (53, 2, ... ) == 0x0 00308 452 NtQueryAttributesFile ({24, 0, 0x40, 0, 0, ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.0.0_x-ww_1382d70a"}, 1239468, ... ) }, 1239468, ... ) == 0x0 00309 452 NtOpenFile (0x100020, {24, 0, 0x40, 0, 0, (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.0.0_x-ww_1382d70a"}, 3, 33, ... 60, {status=0x0, info=1}, ) }, 3, 33, ... 60, {status=0x0, info=1}, ) == 0x0 00310 452 NtQueryDebugFilterState (53, 2, ... ) == 0x0 00311 452 NtOpenFile (0x100020, {24, 0, 0x40, 0, 0, (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.0.0_x-ww_1382d70a\comctl32.dll"}, 5, 96, ... 56, {status=0x0, info=1}, ) }, 5, 96, ... 56, {status=0x0, info=1}, ) == 0x0 00312 452 NtCreateSection (0xe, 0x0, 0x0, 16, 134217728, 56, ... 64, ) == 0x0 00313 452 NtClose (56, ... ) == 0x0 00314 452 NtMapViewOfSection (64, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 16, ... (0x8e0000), 0x0, 921600, ) == 0x0 00315 452 NtClose (64, ... ) == 0x0 00316 452 NtUnmapViewOfSection (-1, 0x8e0000, ... ) == 0x0 00317 452 NtOpenFile (0x100020, {24, 0, 0x40, 0, 0, (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.0.0_x-ww_1382d70a\comctl32.dll"}, 5, 96, ... 64, {status=0x0, info=1}, ) }, 5, 96, ... 64, {status=0x0, info=1}, ) == 0x0 00318 452 NtCreateSection (0xf, 0x0, 0x0, 16, 16777216, 64, ... 56, ) == 0x0 00319 452 NtQuerySection (56, Image, 48, ... {section info, class 1, size 48}, 0x0, ) == 0x0 00320 452 NtClose (64, ... ) == 0x0 00321 452 NtMapViewOfSection (56, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x71950000), 0x0, 933888, ) == 0x0 00322 452 NtClose (56, ... ) == 0x0 00323 452 NtProtectVirtualMemory (-1, (0x71951000), 1952, 4, ... (0x71951000), 4096, 32, ) == 0x0 00324 452 NtProtectVirtualMemory (-1, (0x71951000), 4096, 32, ... (0x71951000), 4096, 4, ) == 0x0 00325 452 NtFlushInstructionCache (-1, 1905594368, 1952, ... ) == 0x0 00326 452 NtProtectVirtualMemory (-1, (0x71951000), 1952, 4, ... (0x71951000), 4096, 32, ) == 0x0 00327 452 NtProtectVirtualMemory (-1, (0x71951000), 4096, 32, ... (0x71951000), 4096, 4, ) == 0x0 00328 452 NtFlushInstructionCache (-1, 1905594368, 1952, ... ) == 0x0 00329 452 NtProtectVirtualMemory (-1, (0x71951000), 1952, 4, ... (0x71951000), 4096, 32, ) == 0x0 00330 452 NtProtectVirtualMemory (-1, (0x71951000), 4096, 32, ... (0x71951000), 4096, 4, ) == 0x0 00331 452 NtFlushInstructionCache (-1, 1905594368, 1952, ... ) == 0x0 00332 452 NtProtectVirtualMemory (-1, (0x71951000), 1952, 4, ... (0x71951000), 4096, 32, ) == 0x0 00333 452 NtProtectVirtualMemory (-1, (0x71951000), 4096, 32, ... (0x71951000), 4096, 4, ) == 0x0 00334 452 NtFlushInstructionCache (-1, 1905594368, 1952, ... ) == 0x0 00335 452 NtProtectVirtualMemory (-1, (0x71951000), 1952, 4, ... (0x71951000), 4096, 32, ) == 0x0 00336 452 NtProtectVirtualMemory (-1, (0x71951000), 4096, 32, ... (0x71951000), 4096, 4, ) == 0x0 00337 452 NtFlushInstructionCache (-1, 1905594368, 1952, ... ) == 0x0 00338 452 NtProtectVirtualMemory (-1, (0x71951000), 1952, 4, ... (0x71951000), 4096, 32, ) == 0x0 00339 452 NtProtectVirtualMemory (-1, (0x71951000), 4096, 32, ... (0x71951000), 4096, 4, ) == 0x0 00340 452 NtFlushInstructionCache (-1, 1905594368, 1952, ... ) == 0x0 00341 452 NtProtectVirtualMemory (-1, (0x71951000), 1952, 4, ... (0x71951000), 4096, 32, ) == 0x0 00342 452 NtProtectVirtualMemory (-1, (0x71951000), 4096, 32, ... (0x71951000), 4096, 4, ) == 0x0 00343 452 NtFlushInstructionCache (-1, 1905594368, 1952, ... ) == 0x0 00344 452 NtAddAtom ( ("T\0h\0e\0m\0e\0P\0r\0o\0p\0S\0c\0r\0o\0l\0l\0B\0a\0r\0C\0t\0l\0", 42, 1240652, ... ) , 42, 1240652, ... ) == 0x0 00345 452 NtQueryDefaultUILanguage (1239368, ... 00346 452 NtOpenThreadTokenEx (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN 00347 452 NtOpenProcessTokenEx (-1, 0x20008, 512, ... -2147482012, ) == 0x0 00348 452 NtQueryInformationToken (-2147482012, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0 00349 452 NtClose (-2147482012, ... ) == 0x0 00350 452 NtOpenKey (0x2000000, {24, 0, 0x640, 0, 0, (0x2000000, {24, 0, 0x640, 0, 0, "\REGISTRY\USER\S-1-5-21-1078081533-484763869-839522115-1003"}, ... -2147482012, ) }, ... -2147482012, ) == 0x0 00351 452 NtOpenKey (0x80000000, {24, 0, 0x240, 0, 0, (0x80000000, {24, 0, 0x240, 0, 0, "\Registry\Machine\System\CurrentControlSet\Control\Nls\MUILanguages"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 00352 452 NtOpenKey (0x80000000, {24, -2147482012, 0x640, 0, 0, (0x80000000, {24, -2147482012, 0x640, 0, 0, "Control Panel\Desktop"}, ... -2147482024, ) }, ... -2147482024, ) == 0x0 00353 452 NtQueryValueKey (-2147482024, (-2147482024, "MultiUILanguageId", Partial, 256, ... ) , Partial, 256, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 00354 452 NtClose (-2147482024, ... ) == 0x0 00355 452 NtClose (-2147482012, ... ) == 0x0 00345 452 NtQueryDefaultUILanguage ... ) == 0x0 00356 452 NtOpenKey (0x20019, {24, 0, 0x40, 0, 0, (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\System\CurrentControlSet\Control\Nls\MUILanguages"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 00357 452 NtQueryAttributesFile ({24, 0, 0x40, 0, 0, ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\WindowsShell.Manifest"}, 1238220, ... ) }, 1238220, ... ) == 0x0 00358 452 NtOpenFile (0x100020, {24, 0, 0x40, 0, 0, (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\WindowsShell.Manifest"}, 5, 96, ... 56, {status=0x0, info=1}, ) }, 5, 96, ... 56, {status=0x0, info=1}, ) == 0x0 00359 452 NtCreateSection (0xe, 0x0, 0x0, 16, 134217728, 56, ... 64, ) == 0x0 00360 452 NtClose (56, ... ) == 0x0 00361 452 NtMapViewOfSection (64, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 16, ... (0x8e0000), 0x0, 4096, ) == 0x0 00362 452 NtClose (64, ... ) == 0x0 00363 452 NtUnmapViewOfSection (-1, 0x8e0000, ... ) == 0x0 00364 452 NtQueryAttributesFile ({24, 0, 0x40, 0, 0, ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\WindowsShell.Manifest"}, 1237860, ... ) }, 1237860, ... ) == 0x0 00365 452 NtCreateFile (0x80100080, {24, 0, 0x40, 0, 1238560, (0x80100080, {24, 0, 0x40, 0, 1238560, "\??\C:\WINDOWS\WindowsShell.Manifest"}, 0x0, 0, 5, 1, 96, 0, 0, ... 64, {status=0x0, info=1}, ) }, 0x0, 0, 5, 1, 96, 0, 0, ... 64, {status=0x0, info=1}, ) == 0x0 00366 452 NtCreateSection (0xf0005, 0x0, 0x0, 2, 134217728, 64, ... 56, ) == 0x0 00367 452 NtClose (64, ... ) == 0x0 00368 452 NtMapViewOfSection (56, -1, (0x0), 0, 0, {0, 0}, 0, 1, 0, 2, ... (0x8e0000), {0, 0}, 4096, ) == 0x0 00369 452 NtClose (56, ... ) == 0x0 00370 452 NtUnmapViewOfSection (-1, 0x8e0000, ... ) == 0x0 00371 452 NtOpenFile (0x1200a9, {24, 0, 0x40, 0, 0, (0x1200a9, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\WindowsShell.Manifest"}, 1, 96, ... 56, {status=0x0, info=1}, ) }, 1, 96, ... 56, {status=0x0, info=1}, ) == 0x0 00372 452 NtCreateSection (0x4, 0x0, 0x0, 2, 134217728, 56, ... 64, ) == 0x0 00373 452 NtMapViewOfSection (64, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 2, ... (0x8e0000), 0x0, 4096, ) == 0x0 00374 452 NtQueryInformationFile (56, 1238180, 56, NetworkOpen, ... {status=0x0, info=56}, ) == 0x0 00375 452 NtOpenFile (0x1200a9, {24, 0, 0x40, 0, 0, (0x1200a9, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\WindowsShell.Config"}, 1, 96, ... ) }, 1, 96, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 00376 452 NtRequestWaitReplyPort (24, {128, 156, new_msg, 0, 1238260, 1, 96, 0} (24, {128, 156, new_msg, 0, 1238260, 1, 96, 0} "\210\6\32\1\33\0\1\0\240\315Z\371\2209\307\1\1\0\0\0\0\0\11\4\1\1\3\0@\0D\0\250\6\32\18\0\0\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\355\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\26\0\30\0\354\6\32\1\0\0\0\0\0\0\0\0\364\353\22\0\0\0\0\0" ... {128, 156, reply, 0, 448, 452, 1572, 0} "h\334\26\0\33\0\1\0\0\0\0\0\2209\307\1\1\0\0\0\0\0\11\4\1\1\3\0@\0D\0\250\6\32\18\0\0\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\355\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\26\0\30\0\354\6\32\1\0\0\0\0\0\0\0\0\364\353\22\0\0\0\0\0" ) ... {128, 156, reply, 0, 448, 452, 1572, 0} (24, {128, 156, new_msg, 0, 1238260, 1, 96, 0} "\210\6\32\1\33\0\1\0\240\315Z\371\2209\307\1\1\0\0\0\0\0\11\4\1\1\3\0@\0D\0\250\6\32\18\0\0\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\355\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\26\0\30\0\354\6\32\1\0\0\0\0\0\0\0\0\364\353\22\0\0\0\0\0" ... {128, 156, reply, 0, 448, 452, 1572, 0} "h\334\26\0\33\0\1\0\0\0\0\0\2209\307\1\1\0\0\0\0\0\11\4\1\1\3\0@\0D\0\250\6\32\18\0\0\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\355\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\26\0\30\0\354\6\32\1\0\0\0\0\0\0\0\0\364\353\22\0\0\0\0\0" ) ) == 0x0 00377 452 NtClose (56, ... ) == 0x0 00378 452 NtClose (64, ... ) == 0x0 00379 452 NtUnmapViewOfSection (-1, 0x8e0000, ... ) == 0x0 00380 452 NtUnmapViewOfSection (-1, 0x12ebf4, ... ) == STATUS_NOT_MAPPED_VIEW 00381 452 NtQueryDebugFilterState (53, 2, ... ) == 0x0 00382 452 NtUserRegisterWindowMessage ( ("ShellGetDragImage", ... ) , ... ) == 0xc03a 00383 452 NtUserSystemParametersInfo (104, 0, 1906151468, 0, ... ) == 0x1 00384 452 NtUserGetDC (0, ... ) == 0x1010051 00385 452 NtUserCallOneParam (16842833, 56, ... ) == 0x1 00386 452 NtUserSystemParametersInfo (38, 4, 1906153440, 0, ... ) == 0x1 00387 452 NtUserSystemParametersInfo (66, 12, 1240672, 0, ... ) == 0x1 00388 452 NtOpenProcessToken (-1, 0x8, ... 64, ) == 0x0 00389 452 NtAccessCheck (1327448, 64, 0x1, 1240076, 1240020, 56, 1240104, ... ) == STATUS_NO_IMPERSONATION_TOKEN 00390 452 NtClose (64, ... ) == 0x0 00391 452 NtOpenThreadTokenEx (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN 00392 452 NtOpenProcessTokenEx (-1, 0x20008, 512, ... 64, ) == 0x0 00393 452 NtQueryInformationToken (64, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0 00394 452 NtClose (64, ... ) == 0x0 00395 452 NtOpenKey (0x2000000, {24, 0, 0x640, 0, 0, (0x2000000, {24, 0, 0x640, 0, 0, "\REGISTRY\USER\S-1-5-21-1078081533-484763869-839522115-1003"}, ... 64, ) }, ... 64, ) == 0x0 00396 452 NtSetInformationObject (64, Handle, {Inherit=0,ProtectFromClose=1,}, 1179904, ... ) == 0x0 00397 452 NtOpenKey (0x20019, {24, 64, 0x40, 0, 0, (0x20019, {24, 64, 0x40, 0, 0, "Control Panel\Desktop"}, ... 56, ) }, ... 56, ) == 0x0 00398 452 NtQueryValueKey (56, (56, "SmoothScroll", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 00399 452 NtClose (56, ... ) == 0x0 00400 452 NtUserSystemParametersInfo (41, 500, 1240172, 0, ... ) == 0x1 00401 452 NtAllocateVirtualMemory (-1, 1331200, 0, 4096, 4096, 4, ... 1331200, 4096, ) == 0x0 00402 452 NtOpenKey (0x1, {24, 64, 0x40, 0, 0, (0x1, {24, 64, 0x40, 0, 0, "software\Microsoft\Windows\CurrentVersion\Explorer\Advanced"}, ... 56, ) }, ... 56, ) == 0x0 00403 452 NtQueryValueKey (56, (56, "EnableBalloonTips", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 00404 452 NtOpenKey (0x1, {24, 28, 0x40, 0, 0, (0x1, {24, 28, 0x40, 0, 0, "software\Microsoft\Windows\CurrentVersion\Explorer\Advanced"}, ... 68, ) }, ... 68, ) == 0x0 00405 452 NtQueryValueKey (68, (68, "EnableBalloonTips", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 00406 452 NtClose (68, ... ) == 0x0 00407 452 NtClose (56, ... ) == 0x0 00408 452 NtUserSystemParametersInfo (102, 0, 1906153328, 0, ... ) == 0x1 00409 452 NtUserSystemParametersInfo (4130, 0, 1240696, 0, ... ) == 0x1 00410 452 NtOpenKey (0x1, {24, 28, 0x40, 0, 0, (0x1, {24, 28, 0x40, 0, 0, "Software\Microsoft\Windows NT\CurrentVersion\LanguagePack"}, ... 56, ) }, ... 56, ) == 0x0 00411 452 NtEnumerateValueKey (56, 0, Full, 220, ... ) == STATUS_NO_MORE_ENTRIES 00412 452 NtClose (56, ... ) == 0x0 00413 452 NtUserFindExistingCursorIcon (1239980, 1239996, 1240564, ... ) == 0x10011 00414 452 NtUserRegisterClassExWOW (1240432, 1240512, 1240496, 1240528, 0, 384, 0, ... ) == 0x810cc03b 00415 452 NtUserRegisterClassExWOW (1240432, 1240512, 1240496, 1240528, 0, 384, 0, ... ) == 0x810cc03d 00416 452 NtUserFindExistingCursorIcon (1239976, 1239992, 1240560, ... ) == 0x10011 00417 452 NtUserRegisterClassExWOW (1240428, 1240508, 1240492, 1240524, 0, 384, 0, ... ) == 0x810cc03f 00418 452 NtUserFindExistingCursorIcon (1239980, 1239996, 1240564, ... ) == 0x10011 00419 452 NtUserRegisterClassExWOW (1240432, 1240512, 1240496, 1240528, 0, 384, 0, ... ) == 0x810cc041 00420 452 NtUserFindExistingCursorIcon (1239980, 1239996, 1240564, ... ) == 0x10011 00421 452 NtUserRegisterClassExWOW (1240432, 1240512, 1240496, 1240528, 0, 384, 0, ... ) == 0x810cc043 00422 452 NtUserRegisterClassExWOW (1240432, 1240512, 1240496, 1240528, 0, 384, 0, ... ) == 0x810cc045 00423 452 NtUserFindExistingCursorIcon (1239980, 1239996, 1240564, ... ) == 0x10011 00424 452 NtUserRegisterClassExWOW (1240432, 1240512, 1240496, 1240528, 0, 384, 0, ... ) == 0x810cc047 00425 452 NtUserFindExistingCursorIcon (1239976, 1239992, 1240560, ... ) == 0x10011 00426 452 NtUserRegisterClassExWOW (1240428, 1240508, 1240492, 1240524, 0, 384, 0, ... ) == 0x810cc049 00427 452 NtUserGetClassInfo (1905590272, 1240592, 1240544, 1240620, 0, ... ) == 0xc049 00428 452 NtUserFindExistingCursorIcon (1239980, 1239996, 1240564, ... ) == 0x10011 00429 452 NtUserRegisterClassExWOW (1240432, 1240512, 1240496, 1240528, 0, 384, 0, ... ) == 0x810cc04b 00430 452 NtUserFindExistingCursorIcon (1239980, 1239996, 1240564, ... ) == 0x10011 00431 452 NtUserRegisterClassExWOW (1240432, 1240512, 1240496, 1240528, 0, 384, 0, ... ) == 0x810cc04d 00432 452 NtUserFindExistingCursorIcon (1239980, 1239996, 1240564, ... ) == 0x10011 00433 452 NtUserRegisterClassExWOW (1240432, 1240512, 1240496, 1240528, 0, 384, 0, ... ) == 0x810cc04f 00434 452 NtUserRegisterClassExWOW (1240432, 1240512, 1240496, 1240528, 0, 384, 0, ... ) == 0x810cc051 00435 452 NtUserFindExistingCursorIcon (1239980, 1239996, 1240564, ... ) == 0x10011 00436 452 NtUserRegisterClassExWOW (1240432, 1240512, 1240496, 1240528, 0, 384, 0, ... ) == 0x810cc053 00437 452 NtUserFindExistingCursorIcon (1239976, 1239992, 1240560, ... ) == 0x10011 00438 452 NtUserRegisterClassExWOW (1240428, 1240508, 1240492, 1240524, 0, 384, 0, ... ) == 0x810cc055 00439 452 NtUserRegisterClassExWOW (1240428, 1240508, 1240492, 1240524, 0, 384, 0, ... ) == 0x810cc057 00440 452 NtUserFindExistingCursorIcon (1239980, 1239996, 1240564, ... ) == 0x10011 00441 452 NtUserRegisterClassExWOW (1240432, 1240512, 1240496, 1240528, 0, 384, 0, ... ) == 0x810cc059 00442 452 NtUserFindExistingCursorIcon (1239980, 1239996, 1240564, ... ) == 0x10013 00443 452 NtUserRegisterClassExWOW (1240432, 1240512, 1240496, 1240528, 0, 384, 0, ... ) == 0x810cc05b 00444 452 NtUserFindExistingCursorIcon (1239980, 1239996, 1240564, ... ) == 0x10011 00445 452 NtUserRegisterClassExWOW (1240432, 1240512, 1240496, 1240528, 0, 384, 0, ... ) == 0x810cc05d 00446 452 NtUserFindExistingCursorIcon (1239980, 1239996, 1240564, ... ) == 0x10011 00447 452 NtUserRegisterClassExWOW (1240432, 1240512, 1240496, 1240528, 0, 384, 0, ... ) == 0x810cc05f 00448 452 NtUserFindExistingCursorIcon (1239976, 1239992, 1240560, ... ) == 0x10011 00449 452 NtUserRegisterClassExWOW (1240428, 1240508, 1240492, 1240524, 0, 384, 0, ... ) == 0x810cc017 00450 452 NtUserFindExistingCursorIcon (1239976, 1239992, 1240560, ... ) == 0x10011 00451 452 NtUserRegisterClassExWOW (1240428, 1240508, 1240492, 1240524, 0, 384, 0, ... ) == 0x810cc019 00452 452 NtUserFindExistingCursorIcon (1239976, 1239992, 1240560, ... ) == 0x10013 00453 452 NtUserRegisterClassExWOW (1240428, 1240508, 1240492, 1240524, 0, 384, 0, ... ) == 0x810cc018 00454 452 NtUserFindExistingCursorIcon (1239980, 1239996, 1240564, ... ) == 0x10011 00455 452 NtUserRegisterClassExWOW (1240432, 1240512, 1240496, 1240528, 0, 384, 0, ... ) == 0x810cc01a 00456 452 NtUserFindExistingCursorIcon (1239976, 1239992, 1240560, ... ) == 0x10011 00457 452 NtUserRegisterClassExWOW (1240428, 1240508, 1240492, 1240524, 0, 384, 0, ... ) == 0x810cc01c 00458 452 NtUserFindExistingCursorIcon (1239980, 1239996, 1240564, ... ) == 0x10011 00459 452 NtUserRegisterClassExWOW (1240432, 1240512, 1240496, 1240528, 0, 384, 0, ... ) == 0x810cc01e 00460 452 NtUserFindExistingCursorIcon (1239976, 1239992, 1240560, ... ) == 0x10011 00461 452 NtUserRegisterClassExWOW (1240488, 1240568, 1240552, 1240584, 0, 384, 0, ... ) == 0x810cc01b 00462 452 NtUserFindExistingCursorIcon (1239972, 1239988, 1240556, ... ) == 0x10011 00463 452 NtUserRegisterClassExWOW (1240484, 1240564, 1240548, 1240580, 0, 384, 0, ... ) == 0x810cc068 00464 452 NtUserFindExistingCursorIcon (1239980, 1239996, 1240564, ... ) == 0x10011 00465 452 NtUserRegisterClassExWOW (1240432, 1240512, 1240496, 1240528, 0, 384, 0, ... 00466 452 NtAllocateVirtualMemory (-1, 6078464, 0, 4096, 4096, 32, ... 6078464, 4096, ) == 0x0 00465 452 NtUserRegisterClassExWOW ... ) == 0x810cc06a 00467 452 NtOpenSection (0xe, {24, 8, 0x40, 0, 0, (0xe, {24, 8, 0x40, 0, 0, "comctl32.dll"}, ... 56, ) }, ... 56, ) == 0x0 00468 452 NtMapViewOfSection (56, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x77340000), 0x0, 569344, ) == 0x0 00469 452 NtClose (56, ... ) == 0x0 00470 452 NtOpenProcess (0x400, {24, 0, 0x0, 0, 0, 0x0}, {448, 0}, ... 56, ) == 0x0 00471 452 NtQueryInformationProcess (56, Session, 4, ... {SessionId=0,}, 0x0, ) == 0x0 00472 452 NtClose (56, ... ) == 0x0 00473 452 NtUserRegisterWindowMessage ( ("ShellGetDragImage", ... ) , ... ) == 0xc03a 00474 452 NtUserSystemParametersInfo (104, 0, 2000318720, 0, ... ) == 0x1 00475 452 NtUserSystemParametersInfo (38, 4, 2000318708, 0, ... ) == 0x1 00476 452 NtOpenKey (0x20019, {24, 64, 0x40, 0, 0, (0x20019, {24, 64, 0x40, 0, 0, "Control Panel\Desktop"}, ... 56, ) }, ... 56, ) == 0x0 00477 452 NtQueryValueKey (56, (56, "SmoothScroll", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 00478 452 NtClose (56, ... ) == 0x0 00479 452 NtUserSystemParametersInfo (41, 500, 1241332, 0, ... ) == 0x1 00480 452 NtUserSystemParametersInfo (102, 0, 2000318732, 0, ... ) == 0x1 00481 452 NtUserGetClassInfo (1999896576, 1241740, 1241692, 1241768, 0, ... ) == 0x0 00482 452 NtUserFindExistingCursorIcon (1241124, 1241140, 1241708, ... ) == 0x10011 00483 452 NtUserRegisterClassExWOW (1241576, 1241656, 1241640, 1241672, 0, 384, 0, ... ) == 0x810cc03b 00484 452 NtUserGetClassInfo (1999896576, 1241740, 1241692, 1241768, 0, ... ) == 0x0 00485 452 NtUserRegisterClassExWOW (1241576, 1241656, 1241640, 1241672, 0, 384, 0, ... ) == 0x810cc03d 00486 452 NtUserGetClassInfo (1999896576, 1241740, 1241692, 1241768, 0, ... ) == 0x0 00487 452 NtUserFindExistingCursorIcon (1241124, 1241140, 1241708, ... ) == 0x10011 00488 452 NtUserRegisterClassExWOW (1241576, 1241656, 1241640, 1241672, 0, 384, 0, ... ) == 0x810cc03f 00489 452 NtUserGetClassInfo (1999896576, 1241740, 1241692, 1241768, 0, ... ) == 0x0 00490 452 NtUserFindExistingCursorIcon (1241124, 1241140, 1241708, ... ) == 0x10011 00491 452 NtUserRegisterClassExWOW (1241576, 1241656, 1241640, 1241672, 0, 384, 0, ... ) == 0x810cc041 00492 452 NtUserGetClassInfo (1999896576, 1241740, 1241692, 1241768, 0, ... ) == 0x0 00493 452 NtUserFindExistingCursorIcon (1241124, 1241140, 1241708, ... ) == 0x10011 00494 452 NtUserRegisterClassExWOW (1241576, 1241656, 1241640, 1241672, 0, 384, 0, ... ) == 0x810cc043 00495 452 NtUserGetClassInfo (1999896576, 1241740, 1241692, 1241768, 0, ... ) == 0x0 00496 452 NtUserRegisterClassExWOW (1241576, 1241656, 1241640, 1241672, 0, 384, 0, ... ) == 0x810cc045 00497 452 NtUserGetClassInfo (1999896576, 1241740, 1241692, 1241768, 0, ... ) == 0x0 00498 452 NtUserFindExistingCursorIcon (1241124, 1241140, 1241708, ... ) == 0x10011 00499 452 NtUserRegisterClassExWOW (1241576, 1241656, 1241640, 1241672, 0, 384, 0, ... ) == 0x810cc047 00500 452 NtUserGetClassInfo (1999896576, 1241740, 1241692, 1241768, 0, ... ) == 0x0 00501 452 NtUserFindExistingCursorIcon (1241120, 1241136, 1241704, ... ) == 0x10011 00502 452 NtUserRegisterClassExWOW (1241572, 1241652, 1241636, 1241668, 0, 384, 0, ... ) == 0x810cc049 00503 452 NtUserGetClassInfo (1999896576, 1241740, 1241692, 1241768, 0, ... ) == 0x0 00504 452 NtUserFindExistingCursorIcon (1241124, 1241140, 1241708, ... ) == 0x10011 00505 452 NtUserRegisterClassExWOW (1241576, 1241656, 1241640, 1241672, 0, 384, 0, ... ) == 0x810cc04b 00506 452 NtUserGetClassInfo (1999896576, 1241740, 1241692, 1241768, 0, ... ) == 0x0 00507 452 NtUserFindExistingCursorIcon (1241124, 1241140, 1241708, ... ) == 0x10011 00508 452 NtUserRegisterClassExWOW (1241576, 1241656, 1241640, 1241672, 0, 384, 0, ... ) == 0x810cc04d 00509 452 NtUserGetClassInfo (1999896576, 1241740, 1241692, 1241768, 0, ... ) == 0x0 00510 452 NtUserFindExistingCursorIcon (1241124, 1241140, 1241708, ... ) == 0x10011 00511 452 NtUserRegisterClassExWOW (1241576, 1241656, 1241640, 1241672, 0, 384, 0, ... ) == 0x810cc04f 00512 452 NtUserGetClassInfo (1999896576, 1241744, 1241696, 1241772, 0, ... ) == 0x0 00513 452 NtUserRegisterClassExWOW (1241580, 1241660, 1241644, 1241676, 0, 384, 0, ... ) == 0x810cc051 00514 452 NtUserGetClassInfo (1999896576, 1241740, 1241692, 1241768, 0, ... ) == 0x0 00515 452 NtUserFindExistingCursorIcon (1241124, 1241140, 1241708, ... ) == 0x10011 00516 452 NtUserRegisterClassExWOW (1241576, 1241656, 1241640, 1241672, 0, 384, 0, ... ) == 0x810cc053 00517 452 NtUserGetClassInfo (1999896576, 1241740, 1241692, 1241768, 0, ... ) == 0x0 00518 452 NtUserFindExistingCursorIcon (1241124, 1241140, 1241708, ... ) == 0x10011 00519 452 NtUserRegisterClassExWOW (1241576, 1241656, 1241640, 1241672, 0, 384, 0, ... ) == 0x810cc055 00520 452 NtUserRegisterClassExWOW (1241576, 1241656, 1241640, 1241672, 0, 384, 0, ... ) == 0x810cc057 00521 452 NtUserGetClassInfo (1999896576, 1241740, 1241692, 1241768, 0, ... ) == 0x0 00522 452 NtUserFindExistingCursorIcon (1241124, 1241140, 1241708, ... ) == 0x10011 00523 452 NtUserRegisterClassExWOW (1241576, 1241656, 1241640, 1241672, 0, 384, 0, ... ) == 0x810cc059 00524 452 NtUserGetClassInfo (1999896576, 1241740, 1241692, 1241768, 0, ... ) == 0x0 00525 452 NtUserFindExistingCursorIcon (1241124, 1241140, 1241708, ... ) == 0x10013 00526 452 NtUserRegisterClassExWOW (1241576, 1241656, 1241640, 1241672, 0, 384, 0, ... ) == 0x810cc05b 00527 452 NtUserGetClassInfo (1999896576, 1241740, 1241692, 1241768, 0, ... ) == 0x0 00528 452 NtUserFindExistingCursorIcon (1241124, 1241140, 1241708, ... ) == 0x10011 00529 452 NtUserRegisterClassExWOW (1241576, 1241656, 1241640, 1241672, 0, 384, 0, ... ) == 0x810cc05d 00530 452 NtUserGetClassInfo (1999896576, 1241740, 1241692, 1241768, 0, ... ) == 0x0 00531 452 NtUserFindExistingCursorIcon (1241124, 1241140, 1241708, ... ) == 0x10011 00532 452 NtUserRegisterClassExWOW (1241576, 1241656, 1241640, 1241672, 0, 384, 0, ... ) == 0x810cc05f 00533 452 NtUserGetClassInfo (1999896576, 1243492, 1243444, 1243520, 0, ... ) == 0xc03b 00534 452 NtUserGetClassInfo (1999896576, 1243492, 1243444, 1243520, 0, ... ) == 0xc03d 00535 452 NtUserGetClassInfo (1999896576, 1243492, 1243444, 1243520, 0, ... ) == 0xc03f 00536 452 NtUserGetClassInfo (1999896576, 1243492, 1243444, 1243520, 0, ... ) == 0xc041 00537 452 NtUserGetClassInfo (1999896576, 1243492, 1243444, 1243520, 0, ... ) == 0xc043 00538 452 NtUserGetClassInfo (1999896576, 1243492, 1243444, 1243520, 0, ... ) == 0xc045 00539 452 NtUserGetClassInfo (1999896576, 1243492, 1243444, 1243520, 0, ... ) == 0xc047 00540 452 NtUserGetClassInfo (1999896576, 1243492, 1243444, 1243520, 0, ... ) == 0xc049 00541 452 NtUserGetClassInfo (1999896576, 1243492, 1243444, 1243520, 0, ... ) == 0xc04b 00542 452 NtUserGetClassInfo (1999896576, 1243492, 1243444, 1243520, 0, ... ) == 0xc04d 00543 452 NtUserGetClassInfo (1999896576, 1243492, 1243444, 1243520, 0, ... ) == 0xc04f 00544 452 NtUserGetClassInfo (1999896576, 1243496, 1243448, 1243524, 0, ... ) == 0xc051 00545 452 NtUserGetClassInfo (1999896576, 1243492, 1243444, 1243520, 0, ... ) == 0xc053 00546 452 NtUserGetClassInfo (1999896576, 1243492, 1243444, 1243520, 0, ... ) == 0xc055 00547 452 NtUserGetClassInfo (1999896576, 1243492, 1243444, 1243520, 0, ... ) == 0xc059 00548 452 NtUserGetClassInfo (1999896576, 1243492, 1243444, 1243520, 0, ... ) == 0xc05b 00549 452 NtUserGetClassInfo (1999896576, 1243492, 1243444, 1243520, 0, ... ) == 0xc05d 00550 452 NtUserGetClassInfo (1999896576, 1243492, 1243444, 1243520, 0, ... ) == 0xc05f 00551 452 NtQuerySystemInformation (Basic, 44, ... {Unknown=0,MaximumIncrement=156250,PhysicalPageSize=0x1000,NumberOfPhysicalPages=0xff7c,LowestPhysicalPage=0x1,HighestPhysicalPage=0xffff,AllocationGranularity=0x10000,LowestUserAddress=0x10000,HighestUserAddress=0x7ffeffff,ActiveProcessors=1,NumberProcessors=1,}, 0x0, ) == 0x0 00552 452 NtQuerySystemInformation (Processor, 12, ... {system info, class 1, size 12}, 0x0, ) == 0x0 00553 452 NtTestAlert (... ) == 0x0 00554 452 NtContinue (1244464, 1, ... 00555 452 NtSetInformationThread (-2, Win32StartAddress(LpcReceivedMessageId), {StartAddress(LpcReceivedMsgId)=0x401000,}, 4, ... ) == 0x0 00556 452 NtAllocateVirtualMemory (-1, 0, 0, 196608, 4096, 64, ... 9437184, 196608, ) == 0x0 00557 452 NtAllocateVirtualMemory (-1, 0, 0, 196608, 4096, 64, ... 9633792, 196608, ) == 0x0 00558 452 NtFreeVirtualMemory (-1, (0x900000), 0, 32768, ... (0x900000), 196608, ) == 0x0 00559 452 NtAllocateVirtualMemory (-1, 0, 0, 1350, 4096, 4, ... 9306112, 4096, ) == 0x0 00560 452 NtFreeVirtualMemory (-1, (0x8e0000), 0, 32768, ... (0x8e0000), 4096, ) == 0x0 00561 452 NtAllocateVirtualMemory (-1, 0, 0, 148480, 4096, 4, ... 9437184, 151552, ) == 0x0 00562 452 NtFreeVirtualMemory (-1, (0x900000), 0, 32768, ... (0x900000), 151552, ) == 0x0 00563 452 NtAllocateVirtualMemory (-1, 0, 0, 2560, 4096, 4, ... 9306112, 4096, ) == 0x0 00564 452 NtFreeVirtualMemory (-1, (0x8e0000), 0, 32768, ... (0x8e0000), 4096, ) == 0x0 00565 452 NtAllocateVirtualMemory (-1, 0, 0, 3584, 4096, 4, ... 9306112, 4096, ) == 0x0 00566 452 NtFreeVirtualMemory (-1, (0x8e0000), 0, 32768, ... (0x8e0000), 4096, ) == 0x0 00567 452 NtAllocateVirtualMemory (-1, 0, 0, 8704, 4096, 4, ... 9306112, 12288, ) == 0x0 00568 452 NtFreeVirtualMemory (-1, (0x8e0000), 0, 32768, ... (0x8e0000), 12288, ) == 0x0 00569 452 NtOpenSection (0xe, {24, 8, 0x40, 0, 0, (0xe, {24, 8, 0x40, 0, 0, "version.dll"}, ... 56, ) }, ... 56, ) == 0x0 00570 452 NtMapViewOfSection (56, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x77c00000), 0x0, 28672, ) == 0x0 00571 452 NtClose (56, ... ) == 0x0 00572 452 NtOpenSection (0xe, {24, 8, 0x40, 0, 0, (0xe, {24, 8, 0x40, 0, 0, "wsock32.dll"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 00573 452 NtQueryAttributesFile ({24, 0, 0x40, 0, 0, ({24, 0, 0x40, 0, 0, "\??\u:\work\wsock32.dll"}, 1243008, ... ) }, 1243008, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 00574 452 NtQueryAttributesFile ({24, 12, 0x40, 0, 0, ({24, 12, 0x40, 0, 0, "wsock32.dll"}, 1243008, ... ) }, 1243008, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 00575 452 NtQueryAttributesFile ({24, 0, 0x40, 0, 0, ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\System32\wsock32.dll"}, 1243008, ... ) }, 1243008, ... ) == 0x0 00576 452 NtOpenFile (0x100020, {24, 0, 0x40, 0, 0, (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\System32\wsock32.dll"}, 5, 96, ... 56, {status=0x0, info=1}, ) }, 5, 96, ... 56, {status=0x0, info=1}, ) == 0x0 00577 452 NtCreateSection (0xf, 0x0, 0x0, 16, 16777216, 56, ... 68, ) == 0x0 00578 452 NtQuerySection (68, Image, 48, ... {section info, class 1, size 48}, 0x0, ) == 0x0 00579 452 NtClose (56, ... ) == 0x0 00580 452 NtMapViewOfSection (68, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x71ad0000), 0x0, 32768, ) == 0x0 00581 452 NtClose (68, ... ) == 0x0 00582 452 NtOpenKey (0xf003f, {24, 64, 0x40, 0, 0, (0xf003f, {24, 64, 0x40, 0, 0, "Software\Borland\Locales"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 00583 452 NtOpenKey (0xf003f, {24, 64, 0x40, 0, 0, (0xf003f, {24, 64, 0x40, 0, 0, "Software\Borland\Delphi\Locales"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 00584 452 NtOpenProcessToken (-1, 0x8, ... 68, ) == 0x0 00585 452 NtQueryInformationToken (68, Statistics, 56, ... {token info, class 10, size 56}, 56, ) == 0x0 00586 452 NtClose (68, ... ) == 0x0 00587 452 NtWaitForSingleObject (16, 0, 0x0, ... ) == STATUS_ACCESS_DENIED 00588 452 NtReleaseMutant (16, ... 00589 452 NtContinue (-136150904, 0, ... 00588 452 NtReleaseMutant ... ) == STATUS_MUTANT_NOT_OWNED 00590 452 NtUserCallOneParam (0, 40, ... ) == 0x4 00591 452 NtAllocateVirtualMemory (-1, 1335296, 0, 4096, 4096, 4, ... 1335296, 4096, ) == 0x0 00592 452 NtAllocateVirtualMemory (-1, 0, 0, 1048576, 8192, 1, ... 9830400, 1048576, ) == 0x0 00593 452 NtAllocateVirtualMemory (-1, 9830400, 0, 16384, 4096, 4, ... 9830400, 16384, ) == 0x0 00594 452 NtUserCallNoParam (29, ... 00595 452 NtQueryAttributesFile ({24, 0, 0x40, 0, 0, ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\uxtheme.dll"}, 1242276, ... ) }, 1242276, ... ) == 0x0 00596 452 NtOpenFile (0x100020, {24, 0, 0x40, 0, 0, (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\uxtheme.dll"}, 5, 96, ... 68, {status=0x0, info=1}, ) }, 5, 96, ... 68, {status=0x0, info=1}, ) == 0x0 00597 452 NtCreateSection (0xe, 0x0, 0x0, 16, 134217728, 68, ... 56, ) == 0x0 00598 452 NtClose (68, ... ) == 0x0 00599 452 NtMapViewOfSection (56, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 16, ... (0xa60000), 0x0, 204800, ) == 0x0 00600 452 NtClose (56, ... ) == 0x0 00601 452 NtUnmapViewOfSection (-1, 0xa60000, ... ) == 0x0 00602 452 NtQueryAttributesFile ({24, 0, 0x40, 0, 0, ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\uxtheme.dll"}, 1242592, ... ) }, 1242592, ... ) == 0x0 00603 452 NtOpenFile (0x100020, {24, 0, 0x40, 0, 0, (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\uxtheme.dll"}, 5, 96, ... 56, {status=0x0, info=1}, ) }, 5, 96, ... 56, {status=0x0, info=1}, ) == 0x0 00604 452 NtCreateSection (0xf, 0x0, 0x0, 16, 16777216, 56, ... 68, ) == 0x0 00605 452 NtQuerySection (68, Image, 48, ... {section info, class 1, size 48}, 0x0, ) == 0x0 00606 452 NtClose (56, ... ) == 0x0 00607 452 NtMapViewOfSection (68, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x5ad70000), 0x0, 212992, ) == 0x0 00608 452 NtClose (68, ... ) == 0x0 00609 452 NtUserGetWindowDC (0, ... ) == 0x1010052 00610 452 NtUserCallOneParam (16842834, 56, ... ) == 0x1 00611 452 NtOpenThreadTokenEx (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN 00612 452 NtOpenProcessTokenEx (-1, 0x20008, 512, ... 68, ) == 0x0 00613 452 NtQueryInformationToken (68, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0 00614 452 NtClose (68, ... ) == 0x0 00615 452 NtOpenKey (0x2001f, {24, 0, 0x640, 0, 0, (0x2001f, {24, 0, 0x640, 0, 0, "\REGISTRY\USER\S-1-5-21-1078081533-484763869-839522115-1003"}, ... 68, ) }, ... 68, ) == 0x0 00616 452 NtOpenKey (0x1, {24, 68, 0x40, 0, 0, (0x1, {24, 68, 0x40, 0, 0, "Software\Microsoft\Windows\CurrentVersion\ThemeManager"}, ... 56, ) }, ... 56, ) == 0x0 00617 452 NtQueryValueKey (56, (56, "Compositing", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 00618 452 NtClose (56, ... ) == 0x0 00619 452 NtClose (68, ... ) == 0x0 00620 452 NtOpenThreadTokenEx (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN 00621 452 NtOpenProcessTokenEx (-1, 0x20008, 512, ... 68, ) == 0x0 00622 452 NtQueryInformationToken (68, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0 00623 452 NtClose (68, ... ) == 0x0 00624 452 NtOpenKey (0x20019, {24, 0, 0x640, 0, 0, (0x20019, {24, 0, 0x640, 0, 0, "\REGISTRY\USER\S-1-5-21-1078081533-484763869-839522115-1003"}, ... 68, ) }, ... 68, ) == 0x0 00625 452 NtOpenKey (0x1, {24, 68, 0x40, 0, 0, (0x1, {24, 68, 0x40, 0, 0, "Control Panel\Desktop"}, ... 56, ) }, ... 56, ) == 0x0 00626 452 NtQueryValueKey (56, (56, "LameButtonText", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 00627 452 NtClose (56, ... ) == 0x0 00628 452 NtClose (68, ... ) == 0x0 00629 452 NtQueryAttributesFile ({24, 0, 0x40, 0, 0, ({24, 0, 0x40, 0, 0, "\??\u:\work\UxTheme.dll"}, 1242092, ... ) }, 1242092, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 00630 452 NtQueryAttributesFile ({24, 12, 0x40, 0, 0, ({24, 12, 0x40, 0, 0, "UxTheme.dll"}, 1242092, ... ) }, 1242092, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 00631 452 NtQueryAttributesFile ({24, 0, 0x40, 0, 0, ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\System32\UxTheme.dll"}, 1242092, ... ) }, 1242092, ... ) == 0x0 00632 452 NtUserGetProcessWindowStation (... ) == 0x28 00633 452 NtUserGetObjectInformation (40, 2, 0, 0, 1244388, ... ) == 0x0 00634 452 NtUserGetObjectInformation (40, 2, 1330792, 16, 1244388, ... ) == 0x1 00635 452 NtUserGetGUIThreadInfo (452, 1244344, ... ) == 0x1 00636 452 NtConnectPort ( ("\ThemeApiPort", {12, 2, 1, 1}, 0x0, 0x0, 1244164, 64, ... 68, 0x0, 0x0, 0x0, 64, ) , {12, 2, 1, 1}, 0x0, 0x0, 1244164, 64, ... 68, 0x0, 0x0, 0x0, 64, ) == 0x0 00637 452 NtRequestWaitReplyPort (68, {32, 56, new_msg, 0, 0, 0, 0, 0} (68, {32, 56, new_msg, 0, 0, 0, 0, 0} "\4\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0" ... {32, 56, reply, 0, 448, 452, 1574, 0} "\0\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0" ) ... {32, 56, reply, 0, 448, 452, 1574, 0} (68, {32, 56, new_msg, 0, 0, 0, 0, 0} "\4\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0" ... {32, 56, reply, 0, 448, 452, 1574, 0} "\0\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0" ) ) == 0x0 00638 452 NtRequestWaitReplyPort (68, {32, 56, new_msg, 0, 0, 0, 0, 0} (68, {32, 56, new_msg, 0, 0, 0, 0, 0} "\355\3\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0" ... {32, 56, reply, 0, 448, 452, 1575, 0} "\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0" ) ... {32, 56, reply, 0, 448, 452, 1575, 0} (68, {32, 56, new_msg, 0, 0, 0, 0, 0} "\355\3\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0" ... {32, 56, reply, 0, 448, 452, 1575, 0} "\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0" ) ) == 0x0 00639 452 NtUserCallNoParam (29, ... 00640 452 NtQueryAttributesFile ({24, 0, 0x40, 0, 0, ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\uxtheme.dll"}, 1241636, ... ) }, 1241636, ... ) == 0x0 00639 452 NtUserCallNoParam ... ) == 0x0 00641 452 NtUserSystemParametersInfo (41, 0, 1524225160, 0, ... ) == 0x1 00642 452 NtGdiHfontCreate (1243716, 356, 0, 0, 1327520, ... ) == 0x70a045d 00643 452 NtGdiHfontCreate (1243716, 356, 0, 0, 1327512, ... ) == 0x60a045e 00644 452 NtRequestWaitReplyPort (68, {32, 56, new_msg, 0, 0, 0, 0, 0} (68, {32, 56, new_msg, 0, 0, 0, 0, 0} "\7\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0" ... {32, 56, reply, 0, 448, 452, 1576, 0} "\0\0\0\0\0\0\0\08\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0" ) ... {32, 56, reply, 0, 448, 452, 1576, 0} (68, {32, 56, new_msg, 0, 0, 0, 0, 0} "\7\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0" ... {32, 56, reply, 0, 448, 452, 1576, 0} "\0\0\0\0\0\0\0\08\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0" ) ) == 0x0 00645 452 NtMapViewOfSection (56, -1, (0x0), 0, 0, {0, 0}, 0, 1, 0, 2, ... (0xa60000), {0, 0}, 331776, ) == 0x0 00646 452 NtUserGetWindowDC (0, ... ) == 0x1010052 00647 452 NtUserCallOneParam (16842834, 56, ... ) == 0x1 00648 452 NtUserGetWindowDC (0, ... ) == 0x1010052 00649 452 NtUserCallOneParam (16842834, 56, ... ) == 0x1 00650 452 NtUserGetWindowDC (0, ... ) == 0x1010052 00651 452 NtUserCallOneParam (16842834, 56, ... ) == 0x1 00652 452 NtUserGetWindowDC (0, ... ) == 0x1010052 00653 452 NtUserCallOneParam (16842834, 56, ... ) == 0x1 00654 452 NtUserGetWindowDC (0, ... ) == 0x1010052 00655 452 NtUserCallOneParam (16842834, 56, ... ) == 0x1 00656 452 NtUserGetWindowDC (0, ... ) == 0x1010052 00657 452 NtUserCallOneParam (16842834, 56, ... ) == 0x1 00658 452 NtUserGetWindowDC (0, ... ) == 0x1010052 00659 452 NtUserCallOneParam (16842834, 56, ... ) == 0x1 00660 452 NtUserGetWindowDC (0, ... ) == 0x1010052 00661 452 NtUserCallOneParam (16842834, 56, ... ) == 0x1 00662 452 NtUserGetWindowDC (0, ... ) == 0x1010052 00663 452 NtGdiCreatePatternBrushInternal (59048369, 0, 0, ... ) == 0x1100460 00664 452 NtUserCallOneParam (16842834, 56, ... ) == 0x1 00665 452 NtUserCallNoParam (29, ... 00666 452 NtQueryAttributesFile ({24, 0, 0x40, 0, 0, ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\uxtheme.dll"}, 1241080, ... ) }, 1241080, ... ) == 0x0 00665 452 NtUserCallNoParam ... ) == 0x0 00667 452 NtUserCallNoParam (29, ... 00668 452 NtQueryAttributesFile ({24, 0, 0x40, 0, 0, ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\uxtheme.dll"}, 1241076, ... ) }, 1241076, ... ) == 0x0 00667 452 NtUserCallNoParam ... ) == 0x0 00594 452 NtUserCallNoParam ... ) == 0x1 00669 452 NtWaitForSingleObject (16, 0, 0x0, ... ) == STATUS_ACCESS_DENIED 00670 452 NtReleaseMutant (16, ... 00671 452 NtContinue (-136150904, 0, ... 00670 452 NtReleaseMutant ... ) == STATUS_MUTANT_NOT_OWNED 00672 452 NtWaitForSingleObject (16, 0, 0x0, ... ) == STATUS_ACCESS_DENIED 00673 452 NtReleaseMutant (16, ... 00674 452 NtContinue (-136150904, 0, ... 00673 452 NtReleaseMutant ... ) == STATUS_MUTANT_NOT_OWNED 00675 452 NtWaitForSingleObject (16, 0, 0x0, ... ) == STATUS_ACCESS_DENIED 00676 452 NtReleaseMutant (16, ... 00677 452 NtContinue (-136150904, 0, ... 00676 452 NtReleaseMutant ... ) == STATUS_MUTANT_NOT_OWNED 00678 452 NtWaitForSingleObject (16, 0, 0x0, ... ) == STATUS_ACCESS_DENIED 00679 452 NtReleaseMutant (16, ... 00680 452 NtContinue (-136150904, 0, ... 00679 452 NtReleaseMutant ... ) == STATUS_MUTANT_NOT_OWNED 00681 452 NtWaitForSingleObject (16, 0, 0x0, ... ) == STATUS_ACCESS_DENIED 00682 452 NtReleaseMutant (16, ... 00683 452 NtContinue (-136150904, 0, ... 00682 452 NtReleaseMutant ... ) == STATUS_MUTANT_NOT_OWNED 00684 452 NtWaitForSingleObject (16, 0, 0x0, ... ) == STATUS_ACCESS_DENIED 00685 452 NtReleaseMutant (16, ... 00686 452 NtContinue (-136150904, 0, ... 00685 452 NtReleaseMutant ... ) == STATUS_MUTANT_NOT_OWNED 00687 452 NtWaitForSingleObject (16, 0, 0x0, ... ) == STATUS_ACCESS_DENIED 00688 452 NtReleaseMutant (16, ... 00689 452 NtContinue (-136150904, 0, ... 00688 452 NtReleaseMutant ... ) == STATUS_MUTANT_NOT_OWNED 00690 452 NtWaitForSingleObject (16, 0, 0x0, ... ) == STATUS_ACCESS_DENIED 00691 452 NtReleaseMutant (16, ... 00692 452 NtContinue (-136150904, 0, ... 00691 452 NtReleaseMutant ... ) == STATUS_MUTANT_NOT_OWNED 00693 452 NtWaitForSingleObject (16, 0, 0x0, ... ) == STATUS_ACCESS_DENIED 00694 452 NtReleaseMutant (16, ... 00695 452 NtContinue (-136150904, 0, ... 00694 452 NtReleaseMutant ... ) == STATUS_MUTANT_NOT_OWNED 00696 452 NtWaitForSingleObject (16, 0, 0x0, ... ) == STATUS_ACCESS_DENIED 00697 452 NtReleaseMutant (16, ... 00698 452 NtContinue (-136150904, 0, ... 00697 452 NtReleaseMutant ... ) == STATUS_MUTANT_NOT_OWNED 00699 452 NtWaitForSingleObject (16, 0, 0x0, ... ) == STATUS_ACCESS_DENIED 00700 452 NtReleaseMutant (16, ... 00701 452 NtContinue (-136150904, 0, ... 00700 452 NtReleaseMutant ... ) == STATUS_MUTANT_NOT_OWNED 00702 452 NtWaitForSingleObject (16, 0, 0x0, ... ) == STATUS_ACCESS_DENIED 00703 452 NtReleaseMutant (16, ... 00704 452 NtContinue (-136150904, 0, ... 00703 452 NtReleaseMutant ... ) == STATUS_MUTANT_NOT_OWNED 00705 452 NtWaitForSingleObject (16, 0, 0x0, ... ) == STATUS_ACCESS_DENIED 00706 452 NtReleaseMutant (16, ... 00707 452 NtContinue (-136150904, 0, ... 00706 452 NtReleaseMutant ... ) == STATUS_MUTANT_NOT_OWNED 00708 452 NtWaitForSingleObject (16, 0, 0x0, ... ) == STATUS_ACCESS_DENIED 00709 452 NtReleaseMutant (16, ... 00710 452 NtContinue (-136150904, 0, ... 00709 452 NtReleaseMutant ... ) == STATUS_MUTANT_NOT_OWNED 00711 452 NtWaitForSingleObject (16, 0, 0x0, ... ) == STATUS_ACCESS_DENIED 00712 452 NtReleaseMutant (16, ... 00713 452 NtContinue (-136150904, 0, ... 00712 452 NtReleaseMutant ... ) == STATUS_MUTANT_NOT_OWNED 00714 452 NtWaitForSingleObject (16, 0, 0x0, ... ) == STATUS_ACCESS_DENIED 00715 452 NtReleaseMutant (16, ... 00716 452 NtContinue (-136150904, 0, ... 00715 452 NtReleaseMutant ... ) == STATUS_MUTANT_NOT_OWNED 00717 452 NtWaitForSingleObject (16, 0, 0x0, ... ) == STATUS_ACCESS_DENIED 00718 452 NtReleaseMutant (16, ... 00719 452 NtContinue (-136150904, 0, ... 00718 452 NtReleaseMutant ... ) == STATUS_MUTANT_NOT_OWNED 00720 452 NtWaitForSingleObject (16, 0, 0x0, ... ) == STATUS_ACCESS_DENIED 00721 452 NtReleaseMutant (16, ... 00722 452 NtContinue (-136150904, 0, ... 00721 452 NtReleaseMutant ... ) == STATUS_MUTANT_NOT_OWNED 00723 452 NtOpenKey (0x2000000, {24, 28, 0x40, 0, 0, (0x2000000, {24, 28, 0x40, 0, 0, "System\CurrentControlSet\Services\WinSock2\Parameters"}, ... 72, ) }, ... 72, ) == 0x0 00724 452 NtQueryValueKey (72, (72, "WinSock_Registry_Version", Partial, 144, ... TitleIdx=0, Type=1, Data="2\0.\00\0\0\0"}, 20, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (72, "WinSock_Registry_Version", Partial, 144, ... TitleIdx=0, Type=1, Data="2\0.\00\0\0\0"}, 20, ) }, 20, ) == 0x0 00725 452 NtQueryValueKey (72, (72, "WinSock_Registry_Version", Partial, 144, ... TitleIdx=0, Type=1, Data="2\0.\00\0\0\0"}, 20, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (72, "WinSock_Registry_Version", Partial, 144, ... TitleIdx=0, Type=1, Data="2\0.\00\0\0\0"}, 20, ) }, 20, ) == 0x0 00726 452 NtCreateEvent (0x1f0003, 0x0, 0, 0, ... 76, ) == 0x0 00727 452 NtOpenKey (0x2000000, {24, 72, 0x40, 0, 0, (0x2000000, {24, 72, 0x40, 0, 0, "Protocol_Catalog9"}, ... 80, ) }, ... 80, ) == 0x0 00728 452 NtQueryValueKey (80, (80, "Serial_Access_Num", Partial, 144, ... TitleIdx=0, Type=4, Data="\31\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (80, "Serial_Access_Num", Partial, 144, ... TitleIdx=0, Type=4, Data="\31\0\0\0"}, 16, ) }, 16, ) == 0x0 00729 452 NtNotifyChangeKey (80, 76, 0, 0, 2011390432, 1, 0, 0, 0, 1, ... ) == 0x103 00730 452 NtQueryValueKey (80, (80, "Serial_Access_Num", Partial, 144, ... TitleIdx=0, Type=4, Data="\31\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (80, "Serial_Access_Num", Partial, 144, ... TitleIdx=0, Type=4, Data="\31\0\0\0"}, 16, ) }, 16, ) == 0x0 00731 452 NtOpenKey (0x2000000, {24, 80, 0x40, 0, 0, (0x2000000, {24, 80, 0x40, 0, 0, "00000019"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 00732 452 NtQueryValueKey (80, (80, "Next_Catalog_Entry_ID", Partial, 144, ... TitleIdx=0, Type=4, Data="\376\3\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (80, "Next_Catalog_Entry_ID", Partial, 144, ... TitleIdx=0, Type=4, Data="\376\3\0\0"}, 16, ) }, 16, ) == 0x0 00733 452 NtQueryValueKey (80, (80, "Num_Catalog_Entries", Partial, 144, ... TitleIdx=0, Type=4, Data="\13\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (80, "Num_Catalog_Entries", Partial, 144, ... TitleIdx=0, Type=4, Data="\13\0\0\0"}, 16, ) }, 16, ) == 0x0 00734 452 NtOpenKey (0x2000000, {24, 80, 0x40, 0, 0, (0x2000000, {24, 80, 0x40, 0, 0, "Catalog_Entries"}, ... 84, ) }, ... 84, ) == 0x0 00735 452 NtOpenKey (0x20019, {24, 84, 0x40, 0, 0, (0x20019, {24, 84, 0x40, 0, 0, "000000000001"}, ... 88, ) }, ... 88, ) == 0x0 00736 452 NtQueryValueKey (88, (88, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW 00737 452 NtAllocateVirtualMemory (-1, 1339392, 0, 4096, 4096, 4, ... 1339392, 4096, ) == 0x0 00738 452 NtQueryValueKey (88, (88, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW 00739 452 NtQueryValueKey (88, (88, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0gram\FSLSP.DLL\0\00\0\0\0\10\0\2\0\10\0\4\1\10\0h\220\354\28\220\354\2\2\0\12\0\4\1\12\00\00\0\0\0\10\0\2\0\14\0\4\1\10\0\210\220\354\2X\220\354\2\2\0\16\0\4\1\12\00\00\0\0\0\10\0\2\0\20\0\4\1\10\0\250\220\354\2x\220\354\2\2\0\22\0\4\1\12\00\00\0\0\0\10\0\2\0\24\0\4\1\10\0\310\220\354\2\230\220\354\2\2\0\26\0\4\1\12\00\00\0\0\0\10\0\2\0\30\0\4\1\10\0\0\0\0\0\270\220\354\2\2\0\32\0\4\1\10\0H\0K\0R\0\0\0\3\0\34\0\4\1\10\0\360\222\354\2\0\0\0\0\0\221\354\2\16\0\0\0<\0\37\0\4\0\10\0X\3\10\0X\3\10\0\4\0\2\0f\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\10\0\0\0\240\32\17\347\213\253\317\21\214\243\0\200_H\241\222\351\3\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\2\0\0\0\20\0\0\0\20\0\0\0\1\0\0\0\6\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0T\0c\0p\0i\0p\0 \0[\0T\0C\0P\0/\0I\0P\0]\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\204\3\0\0\344\2\0\0\300\1\0\0\304\1\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0X\0\0\0\344\2\0\0\300\1\0\0\304\1\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\345\2\0\0\300\1\0\0\304\1\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0T\0\0\0\\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0Hl\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\00\02\0\345\2\0\0\300\1\0\0\304\1\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0X\0\0\0\346\2\0\0\300\1\0\0\304\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0X\0\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\346\2\0\0\300\1\0\0\304\1\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\347\2\0\0\300\1\0\0\304\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0X\0\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) , Partial, 900, ... TitleIdx=0, Type=3, Data= (88, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0gram\FSLSP.DLL\0\00\0\0\0\10\0\2\0\10\0\4\1\10\0h\220\354\28\220\354\2\2\0\12\0\4\1\12\00\00\0\0\0\10\0\2\0\14\0\4\1\10\0\210\220\354\2X\220\354\2\2\0\16\0\4\1\12\00\00\0\0\0\10\0\2\0\20\0\4\1\10\0\250\220\354\2x\220\354\2\2\0\22\0\4\1\12\00\00\0\0\0\10\0\2\0\24\0\4\1\10\0\310\220\354\2\230\220\354\2\2\0\26\0\4\1\12\00\00\0\0\0\10\0\2\0\30\0\4\1\10\0\0\0\0\0\270\220\354\2\2\0\32\0\4\1\10\0H\0K\0R\0\0\0\3\0\34\0\4\1\10\0\360\222\354\2\0\0\0\0\0\221\354\2\16\0\0\0<\0\37\0\4\0\10\0X\3\10\0X\3\10\0\4\0\2\0f\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\10\0\0\0\240\32\17\347\213\253\317\21\214\243\0\200_H\241\222\351\3\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\2\0\0\0\20\0\0\0\20\0\0\0\1\0\0\0\6\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0T\0c\0p\0i\0p\0 \0[\0T\0C\0P\0/\0I\0P\0]\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\204\3\0\0\344\2\0\0\300\1\0\0\304\1\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0X\0\0\0\344\2\0\0\300\1\0\0\304\1\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\345\2\0\0\300\1\0\0\304\1\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0T\0\0\0\\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0Hl\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\00\02\0\345\2\0\0\300\1\0\0\304\1\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0X\0\0\0\346\2\0\0\300\1\0\0\304\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0X\0\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\346\2\0\0\300\1\0\0\304\1\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\347\2\0\0\300\1\0\0\304\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0X\0\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) \0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\346\2\0\0\300\1\0\0\304\1\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\347\2\0\0\300\1\0\0\304\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0X\0\0\0\0\0\0\0 (88, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0gram\FSLSP.DLL\0\00\0\0\0\10\0\2\0\10\0\4\1\10\0h\220\354\28\220\354\2\2\0\12\0\4\1\12\00\00\0\0\0\10\0\2\0\14\0\4\1\10\0\210\220\354\2X\220\354\2\2\0\16\0\4\1\12\00\00\0\0\0\10\0\2\0\20\0\4\1\10\0\250\220\354\2x\220\354\2\2\0\22\0\4\1\12\00\00\0\0\0\10\0\2\0\24\0\4\1\10\0\310\220\354\2\230\220\354\2\2\0\26\0\4\1\12\00\00\0\0\0\10\0\2\0\30\0\4\1\10\0\0\0\0\0\270\220\354\2\2\0\32\0\4\1\10\0H\0K\0R\0\0\0\3\0\34\0\4\1\10\0\360\222\354\2\0\0\0\0\0\221\354\2\16\0\0\0<\0\37\0\4\0\10\0X\3\10\0X\3\10\0\4\0\2\0f\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\10\0\0\0\240\32\17\347\213\253\317\21\214\243\0\200_H\241\222\351\3\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\2\0\0\0\20\0\0\0\20\0\0\0\1\0\0\0\6\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0T\0c\0p\0i\0p\0 \0[\0T\0C\0P\0/\0I\0P\0]\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\204\3\0\0\344\2\0\0\300\1\0\0\304\1\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0X\0\0\0\344\2\0\0\300\1\0\0\304\1\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\345\2\0\0\300\1\0\0\304\1\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0T\0\0\0\\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0Hl\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\00\02\0\345\2\0\0\300\1\0\0\304\1\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0X\0\0\0\346\2\0\0\300\1\0\0\304\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0X\0\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\346\2\0\0\300\1\0\0\304\1\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\347\2\0\0\300\1\0\0\304\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0X\0\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) }, 900, ) == 0x0 00740 452 NtClose (88, ... ) == 0x0 00741 452 NtOpenKey (0x20019, {24, 84, 0x40, 0, 0, (0x20019, {24, 84, 0x40, 0, 0, "000000000002"}, ... 88, ) }, ... 88, ) == 0x0 00742 452 NtQueryValueKey (88, (88, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW 00743 452 NtQueryValueKey (88, (88, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW 00744 452 NtQueryValueKey (88, (88, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0gram\FSLSP.DLL\0\00\0\0\0\10\0\2\0\10\0\4\1\10\0h\220\354\28\220\354\2\2\0\12\0\4\1\12\00\00\0\0\0\10\0\2\0\14\0\4\1\10\0\210\220\354\2X\220\354\2\2\0\16\0\4\1\12\00\00\0\0\0\10\0\2\0\20\0\4\1\10\0\250\220\354\2x\220\354\2\2\0\22\0\4\1\12\00\00\0\0\0\10\0\2\0\24\0\4\1\10\0\310\220\354\2\230\220\354\2\2\0\26\0\4\1\12\00\00\0\0\0\10\0\2\0\30\0\4\1\10\0\0\0\0\0\270\220\354\2\2\0\32\0\4\1\10\0H\0K\0R\0\0\0\3\0\34\0\4\1\10\0\360\222\354\2\0\0\0\0\0\221\354\2\16\0\0\0<\0\37\0\4\0\10\0X\3\10\0X\3\10\0\4\0\2\0\11\6\2\0\0\0\0\0\0\0\0\0\0\0\0\0\10\0\0\0\240\32\17\347\213\253\317\21\214\243\0\200_H\241\222\352\3\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\2\0\0\0\20\0\0\0\20\0\0\0\2\0\0\0\21\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\273\377\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0T\0c\0p\0i\0p\0 \0[\0U\0D\0P\0/\0I\0P\0]\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\204\3\0\0\351\2\0\0\300\1\0\0\304\1\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0X\0\0\0\351\2\0\0\300\1\0\0\304\1\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\352\2\0\0\300\1\0\0\304\1\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0T\0\0\0\\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0Hl\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\00\03\0\352\2\0\0\300\1\0\0\304\1\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0X\0\0\0\353\2\0\0\300\1\0\0\304\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0X\0\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\353\2\0\0\300\1\0\0\304\1\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\354\2\0\0\300\1\0\0\304\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0X\0\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) , Partial, 900, ... TitleIdx=0, Type=3, Data= (88, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0gram\FSLSP.DLL\0\00\0\0\0\10\0\2\0\10\0\4\1\10\0h\220\354\28\220\354\2\2\0\12\0\4\1\12\00\00\0\0\0\10\0\2\0\14\0\4\1\10\0\210\220\354\2X\220\354\2\2\0\16\0\4\1\12\00\00\0\0\0\10\0\2\0\20\0\4\1\10\0\250\220\354\2x\220\354\2\2\0\22\0\4\1\12\00\00\0\0\0\10\0\2\0\24\0\4\1\10\0\310\220\354\2\230\220\354\2\2\0\26\0\4\1\12\00\00\0\0\0\10\0\2\0\30\0\4\1\10\0\0\0\0\0\270\220\354\2\2\0\32\0\4\1\10\0H\0K\0R\0\0\0\3\0\34\0\4\1\10\0\360\222\354\2\0\0\0\0\0\221\354\2\16\0\0\0<\0\37\0\4\0\10\0X\3\10\0X\3\10\0\4\0\2\0\11\6\2\0\0\0\0\0\0\0\0\0\0\0\0\0\10\0\0\0\240\32\17\347\213\253\317\21\214\243\0\200_H\241\222\352\3\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\2\0\0\0\20\0\0\0\20\0\0\0\2\0\0\0\21\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\273\377\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0T\0c\0p\0i\0p\0 \0[\0U\0D\0P\0/\0I\0P\0]\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\204\3\0\0\351\2\0\0\300\1\0\0\304\1\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0X\0\0\0\351\2\0\0\300\1\0\0\304\1\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\352\2\0\0\300\1\0\0\304\1\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0T\0\0\0\\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0Hl\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\00\03\0\352\2\0\0\300\1\0\0\304\1\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0X\0\0\0\353\2\0\0\300\1\0\0\304\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0X\0\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\353\2\0\0\300\1\0\0\304\1\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\354\2\0\0\300\1\0\0\304\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0X\0\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) \0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\353\2\0\0\300\1\0\0\304\1\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\354\2\0\0\300\1\0\0\304\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0X\0\0\0\0\0\0\0 (88, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0gram\FSLSP.DLL\0\00\0\0\0\10\0\2\0\10\0\4\1\10\0h\220\354\28\220\354\2\2\0\12\0\4\1\12\00\00\0\0\0\10\0\2\0\14\0\4\1\10\0\210\220\354\2X\220\354\2\2\0\16\0\4\1\12\00\00\0\0\0\10\0\2\0\20\0\4\1\10\0\250\220\354\2x\220\354\2\2\0\22\0\4\1\12\00\00\0\0\0\10\0\2\0\24\0\4\1\10\0\310\220\354\2\230\220\354\2\2\0\26\0\4\1\12\00\00\0\0\0\10\0\2\0\30\0\4\1\10\0\0\0\0\0\270\220\354\2\2\0\32\0\4\1\10\0H\0K\0R\0\0\0\3\0\34\0\4\1\10\0\360\222\354\2\0\0\0\0\0\221\354\2\16\0\0\0<\0\37\0\4\0\10\0X\3\10\0X\3\10\0\4\0\2\0\11\6\2\0\0\0\0\0\0\0\0\0\0\0\0\0\10\0\0\0\240\32\17\347\213\253\317\21\214\243\0\200_H\241\222\352\3\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\2\0\0\0\20\0\0\0\20\0\0\0\2\0\0\0\21\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\273\377\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0T\0c\0p\0i\0p\0 \0[\0U\0D\0P\0/\0I\0P\0]\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\204\3\0\0\351\2\0\0\300\1\0\0\304\1\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0X\0\0\0\351\2\0\0\300\1\0\0\304\1\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\352\2\0\0\300\1\0\0\304\1\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0T\0\0\0\\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0Hl\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\00\03\0\352\2\0\0\300\1\0\0\304\1\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0X\0\0\0\353\2\0\0\300\1\0\0\304\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0X\0\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\353\2\0\0\300\1\0\0\304\1\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\354\2\0\0\300\1\0\0\304\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0X\0\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) }, 900, ) == 0x0 00745 452 NtClose (88, ... ) == 0x0 00746 452 NtOpenKey (0x20019, {24, 84, 0x40, 0, 0, (0x20019, {24, 84, 0x40, 0, 0, "000000000003"}, ... 88, ) }, ... 88, ) == 0x0 00747 452 NtQueryValueKey (88, (88, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW 00748 452 NtQueryValueKey (88, (88, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW 00749 452 NtQueryValueKey (88, (88, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0gram\FSLSP.DLL\0\00\0\0\0\10\0\2\0\10\0\4\1\10\0h\220\354\28\220\354\2\2\0\12\0\4\1\12\00\00\0\0\0\10\0\2\0\14\0\4\1\10\0\210\220\354\2X\220\354\2\2\0\16\0\4\1\12\00\00\0\0\0\10\0\2\0\20\0\4\1\10\0\250\220\354\2x\220\354\2\2\0\22\0\4\1\12\00\00\0\0\0\10\0\2\0\24\0\4\1\10\0\310\220\354\2\230\220\354\2\2\0\26\0\4\1\12\00\00\0\0\0\10\0\2\0\30\0\4\1\10\0\0\0\0\0\270\220\354\2\2\0\32\0\4\1\10\0H\0K\0R\0\0\0\3\0\34\0\4\1\10\0\360\222\354\2\0\0\0\0\0\221\354\2\16\0\0\0<\0\37\0\4\0\10\0X\3\10\0X\3\10\0\4\0\2\0\11\6\2\0\0\0\0\0\0\0\0\0\0\0\0\0\14\0\0\0\240\32\17\347\213\253\317\21\214\243\0\200_H\241\222\353\3\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\2\0\0\0\20\0\0\0\20\0\0\0\3\0\0\0\0\0\0\0\377\0\0\0\0\0\0\0\0\0\0\0\273\377\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0T\0c\0p\0i\0p\0 \0[\0R\0A\0W\0/\0I\0P\0]\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\204\3\0\0\356\2\0\0\300\1\0\0\304\1\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0X\0\0\0\356\2\0\0\300\1\0\0\304\1\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\357\2\0\0\300\1\0\0\304\1\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0T\0\0\0\\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0Hl\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\00\04\0\357\2\0\0\300\1\0\0\304\1\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0X\0\0\0\360\2\0\0\300\1\0\0\304\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0X\0\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\360\2\0\0\300\1\0\0\304\1\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\361\2\0\0\300\1\0\0\304\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0X\0\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) , Partial, 900, ... TitleIdx=0, Type=3, Data= (88, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0gram\FSLSP.DLL\0\00\0\0\0\10\0\2\0\10\0\4\1\10\0h\220\354\28\220\354\2\2\0\12\0\4\1\12\00\00\0\0\0\10\0\2\0\14\0\4\1\10\0\210\220\354\2X\220\354\2\2\0\16\0\4\1\12\00\00\0\0\0\10\0\2\0\20\0\4\1\10\0\250\220\354\2x\220\354\2\2\0\22\0\4\1\12\00\00\0\0\0\10\0\2\0\24\0\4\1\10\0\310\220\354\2\230\220\354\2\2\0\26\0\4\1\12\00\00\0\0\0\10\0\2\0\30\0\4\1\10\0\0\0\0\0\270\220\354\2\2\0\32\0\4\1\10\0H\0K\0R\0\0\0\3\0\34\0\4\1\10\0\360\222\354\2\0\0\0\0\0\221\354\2\16\0\0\0<\0\37\0\4\0\10\0X\3\10\0X\3\10\0\4\0\2\0\11\6\2\0\0\0\0\0\0\0\0\0\0\0\0\0\14\0\0\0\240\32\17\347\213\253\317\21\214\243\0\200_H\241\222\353\3\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\2\0\0\0\20\0\0\0\20\0\0\0\3\0\0\0\0\0\0\0\377\0\0\0\0\0\0\0\0\0\0\0\273\377\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0T\0c\0p\0i\0p\0 \0[\0R\0A\0W\0/\0I\0P\0]\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\204\3\0\0\356\2\0\0\300\1\0\0\304\1\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0X\0\0\0\356\2\0\0\300\1\0\0\304\1\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\357\2\0\0\300\1\0\0\304\1\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0T\0\0\0\\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0Hl\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\00\04\0\357\2\0\0\300\1\0\0\304\1\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0X\0\0\0\360\2\0\0\300\1\0\0\304\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0X\0\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\360\2\0\0\300\1\0\0\304\1\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\361\2\0\0\300\1\0\0\304\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0X\0\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) \0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\360\2\0\0\300\1\0\0\304\1\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\361\2\0\0\300\1\0\0\304\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0X\0\0\0\0\0\0\0 (88, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0gram\FSLSP.DLL\0\00\0\0\0\10\0\2\0\10\0\4\1\10\0h\220\354\28\220\354\2\2\0\12\0\4\1\12\00\00\0\0\0\10\0\2\0\14\0\4\1\10\0\210\220\354\2X\220\354\2\2\0\16\0\4\1\12\00\00\0\0\0\10\0\2\0\20\0\4\1\10\0\250\220\354\2x\220\354\2\2\0\22\0\4\1\12\00\00\0\0\0\10\0\2\0\24\0\4\1\10\0\310\220\354\2\230\220\354\2\2\0\26\0\4\1\12\00\00\0\0\0\10\0\2\0\30\0\4\1\10\0\0\0\0\0\270\220\354\2\2\0\32\0\4\1\10\0H\0K\0R\0\0\0\3\0\34\0\4\1\10\0\360\222\354\2\0\0\0\0\0\221\354\2\16\0\0\0<\0\37\0\4\0\10\0X\3\10\0X\3\10\0\4\0\2\0\11\6\2\0\0\0\0\0\0\0\0\0\0\0\0\0\14\0\0\0\240\32\17\347\213\253\317\21\214\243\0\200_H\241\222\353\3\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\2\0\0\0\20\0\0\0\20\0\0\0\3\0\0\0\0\0\0\0\377\0\0\0\0\0\0\0\0\0\0\0\273\377\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0T\0c\0p\0i\0p\0 \0[\0R\0A\0W\0/\0I\0P\0]\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\204\3\0\0\356\2\0\0\300\1\0\0\304\1\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0X\0\0\0\356\2\0\0\300\1\0\0\304\1\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\357\2\0\0\300\1\0\0\304\1\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0T\0\0\0\\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0Hl\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\00\04\0\357\2\0\0\300\1\0\0\304\1\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0X\0\0\0\360\2\0\0\300\1\0\0\304\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0X\0\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\360\2\0\0\300\1\0\0\304\1\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\361\2\0\0\300\1\0\0\304\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0X\0\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) }, 900, ) == 0x0 00750 452 NtClose (88, ... ) == 0x0 00751 452 NtOpenKey (0x20019, {24, 84, 0x40, 0, 0, (0x20019, {24, 84, 0x40, 0, 0, "000000000004"}, ... 88, ) }, ... 88, ) == 0x0 00752 452 NtQueryValueKey (88, (88, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW 00753 452 NtQueryValueKey (88, (88, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW 00754 452 NtAllocateVirtualMemory (-1, 1343488, 0, 4096, 4096, 4, ... 1343488, 4096, ) == 0x0 00755 452 NtQueryValueKey (88, (88, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\rsvpsp.dll\0\0gram\FSLSP.DLL\0\00\0\0\0\10\0\2\0\10\0\4\1\10\0h\220\354\28\220\354\2\2\0\12\0\4\1\12\00\00\0\0\0\10\0\2\0\14\0\4\1\10\0\210\220\354\2X\220\354\2\2\0\16\0\4\1\12\00\00\0\0\0\10\0\2\0\20\0\4\1\10\0\250\220\354\2x\220\354\2\2\0\22\0\4\1\12\00\00\0\0\0\10\0\2\0\24\0\4\1\10\0\310\220\354\2\230\220\354\2\2\0\26\0\4\1\12\00\00\0\0\0\10\0\2\0\30\0\4\1\10\0\0\0\0\0\270\220\354\2\2\0\32\0\4\1\10\0H\0K\0R\0\0\0\3\0\34\0\4\1\10\0\360\222\354\2\0\0\0\0\0\221\354\2\16\0\0\0<\0\37\0\4\0\10\0X\3\10\0X\3\10\0\4\0\2\0\11&\2\0\0\0\0\0\0\0\0\0\0\0\0\0\10\0\0\0\340\251`\235z3\320\21\275\210\0\0\300\202\346\232\354\3\0\0\1\0\0\0\310\371\252\1\26\0\30\0\10<_u\0\0\0\0|\370\252\1\27\207`u\0\0\0\0\6\0\0\0\2\0\0\0\20\0\0\0\20\0\0\0\2\0\0\0\21\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\273\377\0\0\0\0\0\0R\0S\0V\0P\0 \0U\0D\0P\0 \0S\0e\0r\0v\0i\0c\0e\0 \0P\0r\0o\0v\0i\0d\0e\0r\0\0\0\30\371\252\1\17.\365w\13\30\365w\1\0\0\0\0\374\252\1\4\0\0\0\0\0\0\0\0\0\0\0\1\0\0\0\17.\365w\0\0\0\0\250\371\252\1 \22\365wO\22\365wT\22\365w\0\0\0\0\204\3\0\0\364\2\0\0\300\1\0\0\304\1\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0X\0\0\0\364\2\0\0\300\1\0\0\304\1\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\365\2\0\0\300\1\0\0\304\1\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0T\0\0\0\\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0Hl\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\00\05\0\365\2\0\0\300\1\0\0\304\1\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0X\0\0\0\366\2\0\0\300\1\0\0\304\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0X\0\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\366\2\0\0\300\1\0\0\304\1\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\367\2\0\0\300\1\0\0\304\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0X\0\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) , Partial, 900, ... TitleIdx=0, Type=3, Data= (88, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\rsvpsp.dll\0\0gram\FSLSP.DLL\0\00\0\0\0\10\0\2\0\10\0\4\1\10\0h\220\354\28\220\354\2\2\0\12\0\4\1\12\00\00\0\0\0\10\0\2\0\14\0\4\1\10\0\210\220\354\2X\220\354\2\2\0\16\0\4\1\12\00\00\0\0\0\10\0\2\0\20\0\4\1\10\0\250\220\354\2x\220\354\2\2\0\22\0\4\1\12\00\00\0\0\0\10\0\2\0\24\0\4\1\10\0\310\220\354\2\230\220\354\2\2\0\26\0\4\1\12\00\00\0\0\0\10\0\2\0\30\0\4\1\10\0\0\0\0\0\270\220\354\2\2\0\32\0\4\1\10\0H\0K\0R\0\0\0\3\0\34\0\4\1\10\0\360\222\354\2\0\0\0\0\0\221\354\2\16\0\0\0<\0\37\0\4\0\10\0X\3\10\0X\3\10\0\4\0\2\0\11&\2\0\0\0\0\0\0\0\0\0\0\0\0\0\10\0\0\0\340\251`\235z3\320\21\275\210\0\0\300\202\346\232\354\3\0\0\1\0\0\0\310\371\252\1\26\0\30\0\10<_u\0\0\0\0|\370\252\1\27\207`u\0\0\0\0\6\0\0\0\2\0\0\0\20\0\0\0\20\0\0\0\2\0\0\0\21\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\273\377\0\0\0\0\0\0R\0S\0V\0P\0 \0U\0D\0P\0 \0S\0e\0r\0v\0i\0c\0e\0 \0P\0r\0o\0v\0i\0d\0e\0r\0\0\0\30\371\252\1\17.\365w\13\30\365w\1\0\0\0\0\374\252\1\4\0\0\0\0\0\0\0\0\0\0\0\1\0\0\0\17.\365w\0\0\0\0\250\371\252\1 \22\365wO\22\365wT\22\365w\0\0\0\0\204\3\0\0\364\2\0\0\300\1\0\0\304\1\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0X\0\0\0\364\2\0\0\300\1\0\0\304\1\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\365\2\0\0\300\1\0\0\304\1\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0T\0\0\0\\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0Hl\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\00\05\0\365\2\0\0\300\1\0\0\304\1\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0X\0\0\0\366\2\0\0\300\1\0\0\304\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0X\0\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\366\2\0\0\300\1\0\0\304\1\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\367\2\0\0\300\1\0\0\304\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0X\0\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) \0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\366\2\0\0\300\1\0\0\304\1\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\367\2\0\0\300\1\0\0\304\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0X\0\0\0\0\0\0\0 (88, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\rsvpsp.dll\0\0gram\FSLSP.DLL\0\00\0\0\0\10\0\2\0\10\0\4\1\10\0h\220\354\28\220\354\2\2\0\12\0\4\1\12\00\00\0\0\0\10\0\2\0\14\0\4\1\10\0\210\220\354\2X\220\354\2\2\0\16\0\4\1\12\00\00\0\0\0\10\0\2\0\20\0\4\1\10\0\250\220\354\2x\220\354\2\2\0\22\0\4\1\12\00\00\0\0\0\10\0\2\0\24\0\4\1\10\0\310\220\354\2\230\220\354\2\2\0\26\0\4\1\12\00\00\0\0\0\10\0\2\0\30\0\4\1\10\0\0\0\0\0\270\220\354\2\2\0\32\0\4\1\10\0H\0K\0R\0\0\0\3\0\34\0\4\1\10\0\360\222\354\2\0\0\0\0\0\221\354\2\16\0\0\0<\0\37\0\4\0\10\0X\3\10\0X\3\10\0\4\0\2\0\11&\2\0\0\0\0\0\0\0\0\0\0\0\0\0\10\0\0\0\340\251`\235z3\320\21\275\210\0\0\300\202\346\232\354\3\0\0\1\0\0\0\310\371\252\1\26\0\30\0\10<_u\0\0\0\0|\370\252\1\27\207`u\0\0\0\0\6\0\0\0\2\0\0\0\20\0\0\0\20\0\0\0\2\0\0\0\21\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\273\377\0\0\0\0\0\0R\0S\0V\0P\0 \0U\0D\0P\0 \0S\0e\0r\0v\0i\0c\0e\0 \0P\0r\0o\0v\0i\0d\0e\0r\0\0\0\30\371\252\1\17.\365w\13\30\365w\1\0\0\0\0\374\252\1\4\0\0\0\0\0\0\0\0\0\0\0\1\0\0\0\17.\365w\0\0\0\0\250\371\252\1 \22\365wO\22\365wT\22\365w\0\0\0\0\204\3\0\0\364\2\0\0\300\1\0\0\304\1\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0X\0\0\0\364\2\0\0\300\1\0\0\304\1\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\365\2\0\0\300\1\0\0\304\1\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0T\0\0\0\\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0Hl\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\00\05\0\365\2\0\0\300\1\0\0\304\1\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0X\0\0\0\366\2\0\0\300\1\0\0\304\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0X\0\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\366\2\0\0\300\1\0\0\304\1\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\367\2\0\0\300\1\0\0\304\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0X\0\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) }, 900, ) == 0x0 00756 452 NtClose (88, ... ) == 0x0 00757 452 NtOpenKey (0x20019, {24, 84, 0x40, 0, 0, (0x20019, {24, 84, 0x40, 0, 0, "000000000005"}, ... 88, ) }, ... 88, ) == 0x0 00758 452 NtQueryValueKey (88, (88, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW 00759 452 NtQueryValueKey (88, (88, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW 00760 452 NtQueryValueKey (88, (88, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\rsvpsp.dll\0\0gram\FSLSP.DLL\0\00\0\0\0\10\0\2\0\10\0\4\1\10\0h\220\354\28\220\354\2\2\0\12\0\4\1\12\00\00\0\0\0\10\0\2\0\14\0\4\1\10\0\210\220\354\2X\220\354\2\2\0\16\0\4\1\12\00\00\0\0\0\10\0\2\0\20\0\4\1\10\0\250\220\354\2x\220\354\2\2\0\22\0\4\1\12\00\00\0\0\0\10\0\2\0\24\0\4\1\10\0\310\220\354\2\230\220\354\2\2\0\26\0\4\1\12\00\00\0\0\0\10\0\2\0\30\0\4\1\10\0\0\0\0\0\270\220\354\2\2\0\32\0\4\1\10\0H\0K\0R\0\0\0\3\0\34\0\4\1\10\0\360\222\354\2\0\0\0\0\0\221\354\2\16\0\0\0<\0\37\0\4\0\10\0X\3\10\0X\3\10\0\4\0\2\0f \2\0\0\0\0\0\0\0\0\0\0\0\0\0\10\0\0\0\340\251`\235z3\320\21\275\210\0\0\300\202\346\232\355\3\0\0\1\0\0\0\17.\365w\13\30\365w\0\0\0\0\4+Y\1\2\0\0\0\1\0\0\0\17.\365w\6\0\0\0\2\0\0\0\20\0\0\0\20\0\0\0\1\0\0\0\6\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0R\0S\0V\0P\0 \0T\0C\0P\0 \0S\0e\0r\0v\0i\0c\0e\0 \0P\0r\0o\0v\0i\0d\0e\0r\0\0\0\0\0\0\0\362_du\3`du\240\1\10\0\250\5N\1 \0\0\0\0\0\0\0\240\1\10\0\310\5N\1H\344\301\0\0\0\0\0\0\0\0\0\0\0\245\0\0\0\10\0@\5N\1\0\0\0\0\204\3\0\0\371\2\0\0\300\1\0\0\304\1\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0X\0\0\0\371\2\0\0\300\1\0\0\304\1\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\372\2\0\0\300\1\0\0\304\1\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0T\0\0\0\\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0Hl\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\00\06\0\372\2\0\0\300\1\0\0\304\1\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0X\0\0\0\373\2\0\0\300\1\0\0\304\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0X\0\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\373\2\0\0\300\1\0\0\304\1\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\374\2\0\0\300\1\0\0\304\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0X\0\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) , Partial, 900, ... TitleIdx=0, Type=3, Data= (88, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\rsvpsp.dll\0\0gram\FSLSP.DLL\0\00\0\0\0\10\0\2\0\10\0\4\1\10\0h\220\354\28\220\354\2\2\0\12\0\4\1\12\00\00\0\0\0\10\0\2\0\14\0\4\1\10\0\210\220\354\2X\220\354\2\2\0\16\0\4\1\12\00\00\0\0\0\10\0\2\0\20\0\4\1\10\0\250\220\354\2x\220\354\2\2\0\22\0\4\1\12\00\00\0\0\0\10\0\2\0\24\0\4\1\10\0\310\220\354\2\230\220\354\2\2\0\26\0\4\1\12\00\00\0\0\0\10\0\2\0\30\0\4\1\10\0\0\0\0\0\270\220\354\2\2\0\32\0\4\1\10\0H\0K\0R\0\0\0\3\0\34\0\4\1\10\0\360\222\354\2\0\0\0\0\0\221\354\2\16\0\0\0<\0\37\0\4\0\10\0X\3\10\0X\3\10\0\4\0\2\0f \2\0\0\0\0\0\0\0\0\0\0\0\0\0\10\0\0\0\340\251`\235z3\320\21\275\210\0\0\300\202\346\232\355\3\0\0\1\0\0\0\17.\365w\13\30\365w\0\0\0\0\4+Y\1\2\0\0\0\1\0\0\0\17.\365w\6\0\0\0\2\0\0\0\20\0\0\0\20\0\0\0\1\0\0\0\6\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0R\0S\0V\0P\0 \0T\0C\0P\0 \0S\0e\0r\0v\0i\0c\0e\0 \0P\0r\0o\0v\0i\0d\0e\0r\0\0\0\0\0\0\0\362_du\3`du\240\1\10\0\250\5N\1 \0\0\0\0\0\0\0\240\1\10\0\310\5N\1H\344\301\0\0\0\0\0\0\0\0\0\0\0\245\0\0\0\10\0@\5N\1\0\0\0\0\204\3\0\0\371\2\0\0\300\1\0\0\304\1\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0X\0\0\0\371\2\0\0\300\1\0\0\304\1\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\372\2\0\0\300\1\0\0\304\1\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0T\0\0\0\\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0Hl\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\00\06\0\372\2\0\0\300\1\0\0\304\1\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0X\0\0\0\373\2\0\0\300\1\0\0\304\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0X\0\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\373\2\0\0\300\1\0\0\304\1\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\374\2\0\0\300\1\0\0\304\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0X\0\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) \0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\373\2\0\0\300\1\0\0\304\1\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\374\2\0\0\300\1\0\0\304\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0X\0\0\0\0\0\0\0 (88, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\rsvpsp.dll\0\0gram\FSLSP.DLL\0\00\0\0\0\10\0\2\0\10\0\4\1\10\0h\220\354\28\220\354\2\2\0\12\0\4\1\12\00\00\0\0\0\10\0\2\0\14\0\4\1\10\0\210\220\354\2X\220\354\2\2\0\16\0\4\1\12\00\00\0\0\0\10\0\2\0\20\0\4\1\10\0\250\220\354\2x\220\354\2\2\0\22\0\4\1\12\00\00\0\0\0\10\0\2\0\24\0\4\1\10\0\310\220\354\2\230\220\354\2\2\0\26\0\4\1\12\00\00\0\0\0\10\0\2\0\30\0\4\1\10\0\0\0\0\0\270\220\354\2\2\0\32\0\4\1\10\0H\0K\0R\0\0\0\3\0\34\0\4\1\10\0\360\222\354\2\0\0\0\0\0\221\354\2\16\0\0\0<\0\37\0\4\0\10\0X\3\10\0X\3\10\0\4\0\2\0f \2\0\0\0\0\0\0\0\0\0\0\0\0\0\10\0\0\0\340\251`\235z3\320\21\275\210\0\0\300\202\346\232\355\3\0\0\1\0\0\0\17.\365w\13\30\365w\0\0\0\0\4+Y\1\2\0\0\0\1\0\0\0\17.\365w\6\0\0\0\2\0\0\0\20\0\0\0\20\0\0\0\1\0\0\0\6\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0R\0S\0V\0P\0 \0T\0C\0P\0 \0S\0e\0r\0v\0i\0c\0e\0 \0P\0r\0o\0v\0i\0d\0e\0r\0\0\0\0\0\0\0\362_du\3`du\240\1\10\0\250\5N\1 \0\0\0\0\0\0\0\240\1\10\0\310\5N\1H\344\301\0\0\0\0\0\0\0\0\0\0\0\245\0\0\0\10\0@\5N\1\0\0\0\0\204\3\0\0\371\2\0\0\300\1\0\0\304\1\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0X\0\0\0\371\2\0\0\300\1\0\0\304\1\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\372\2\0\0\300\1\0\0\304\1\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0T\0\0\0\\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0Hl\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\00\06\0\372\2\0\0\300\1\0\0\304\1\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0X\0\0\0\373\2\0\0\300\1\0\0\304\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0X\0\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\373\2\0\0\300\1\0\0\304\1\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\374\2\0\0\300\1\0\0\304\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0X\0\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) }, 900, ) == 0x0 00761 452 NtClose (88, ... ) == 0x0 00762 452 NtOpenKey (0x20019, {24, 84, 0x40, 0, 0, (0x20019, {24, 84, 0x40, 0, 0, "000000000006"}, ... 88, ) }, ... 88, ) == 0x0 00763 452 NtQueryValueKey (88, (88, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW 00764 452 NtQueryValueKey (88, (88, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW 00765 452 NtQueryValueKey (88, (88, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0gram\FSLSP.DLL\0\00\0\0\0\10\0\2\0\10\0\4\1\10\0h\220\354\28\220\354\2\2\0\12\0\4\1\12\00\00\0\0\0\10\0\2\0\14\0\4\1\10\0\210\220\354\2X\220\354\2\2\0\16\0\4\1\12\00\00\0\0\0\10\0\2\0\20\0\4\1\10\0\250\220\354\2x\220\354\2\2\0\22\0\4\1\12\00\00\0\0\0\10\0\2\0\24\0\4\1\10\0\310\220\354\2\230\220\354\2\2\0\26\0\4\1\12\00\00\0\0\0\10\0\2\0\30\0\4\1\10\0\0\0\0\0\270\220\354\2\2\0\32\0\4\1\10\0H\0K\0R\0\0\0\3\0\34\0\4\1\10\0\360\222\354\2\0\0\0\0\0\221\354\2\16\0\0\0<\0\37\0\4\0\10\0X\3\10\0X\3\10\0\4\0\2\0\16\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\10\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\356\3\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\5\0\0\0\0\0\0\200\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\04\0F\0E\05\07\0D\07\0B\0-\00\03\0A\05\0-\04\08\0B\02\0-\08\0\0\0\0\0\204\3\0\0\376\2\0\0\300\1\0\0\304\1\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0X\0\0\0\376\2\0\0\300\1\0\0\304\1\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\377\2\0\0\300\1\0\0\304\1\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0T\0\0\0\\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0Hl\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\00\07\0\377\2\0\0\300\1\0\0\304\1\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0X\0\0\0\0\3\0\0\300\1\0\0\304\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0X\0\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\0\3\0\0\300\1\0\0\304\1\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\1\3\0\0\300\1\0\0\304\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0X\0\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) , Partial, 900, ... TitleIdx=0, Type=3, Data= (88, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0gram\FSLSP.DLL\0\00\0\0\0\10\0\2\0\10\0\4\1\10\0h\220\354\28\220\354\2\2\0\12\0\4\1\12\00\00\0\0\0\10\0\2\0\14\0\4\1\10\0\210\220\354\2X\220\354\2\2\0\16\0\4\1\12\00\00\0\0\0\10\0\2\0\20\0\4\1\10\0\250\220\354\2x\220\354\2\2\0\22\0\4\1\12\00\00\0\0\0\10\0\2\0\24\0\4\1\10\0\310\220\354\2\230\220\354\2\2\0\26\0\4\1\12\00\00\0\0\0\10\0\2\0\30\0\4\1\10\0\0\0\0\0\270\220\354\2\2\0\32\0\4\1\10\0H\0K\0R\0\0\0\3\0\34\0\4\1\10\0\360\222\354\2\0\0\0\0\0\221\354\2\16\0\0\0<\0\37\0\4\0\10\0X\3\10\0X\3\10\0\4\0\2\0\16\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\10\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\356\3\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\5\0\0\0\0\0\0\200\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\04\0F\0E\05\07\0D\07\0B\0-\00\03\0A\05\0-\04\08\0B\02\0-\08\0\0\0\0\0\204\3\0\0\376\2\0\0\300\1\0\0\304\1\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0X\0\0\0\376\2\0\0\300\1\0\0\304\1\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\377\2\0\0\300\1\0\0\304\1\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0T\0\0\0\\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0Hl\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\00\07\0\377\2\0\0\300\1\0\0\304\1\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0X\0\0\0\0\3\0\0\300\1\0\0\304\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0X\0\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\0\3\0\0\300\1\0\0\304\1\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\1\3\0\0\300\1\0\0\304\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0X\0\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) \0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\0\3\0\0\300\1\0\0\304\1\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\1\3\0\0\300\1\0\0\304\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0X\0\0\0\0\0\0\0 (88, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0gram\FSLSP.DLL\0\00\0\0\0\10\0\2\0\10\0\4\1\10\0h\220\354\28\220\354\2\2\0\12\0\4\1\12\00\00\0\0\0\10\0\2\0\14\0\4\1\10\0\210\220\354\2X\220\354\2\2\0\16\0\4\1\12\00\00\0\0\0\10\0\2\0\20\0\4\1\10\0\250\220\354\2x\220\354\2\2\0\22\0\4\1\12\00\00\0\0\0\10\0\2\0\24\0\4\1\10\0\310\220\354\2\230\220\354\2\2\0\26\0\4\1\12\00\00\0\0\0\10\0\2\0\30\0\4\1\10\0\0\0\0\0\270\220\354\2\2\0\32\0\4\1\10\0H\0K\0R\0\0\0\3\0\34\0\4\1\10\0\360\222\354\2\0\0\0\0\0\221\354\2\16\0\0\0<\0\37\0\4\0\10\0X\3\10\0X\3\10\0\4\0\2\0\16\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\10\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\356\3\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\5\0\0\0\0\0\0\200\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\04\0F\0E\05\07\0D\07\0B\0-\00\03\0A\05\0-\04\08\0B\02\0-\08\0\0\0\0\0\204\3\0\0\376\2\0\0\300\1\0\0\304\1\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0X\0\0\0\376\2\0\0\300\1\0\0\304\1\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\377\2\0\0\300\1\0\0\304\1\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0T\0\0\0\\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0Hl\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\00\07\0\377\2\0\0\300\1\0\0\304\1\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0X\0\0\0\0\3\0\0\300\1\0\0\304\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0X\0\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\0\3\0\0\300\1\0\0\304\1\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\1\3\0\0\300\1\0\0\304\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0X\0\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) }, 900, ) == 0x0 00766 452 NtClose (88, ... ) == 0x0 00767 452 NtOpenKey (0x20019, {24, 84, 0x40, 0, 0, (0x20019, {24, 84, 0x40, 0, 0, "000000000007"}, ... 88, ) }, ... 88, ) == 0x0 00768 452 NtQueryValueKey (88, (88, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW 00769 452 NtQueryValueKey (88, (88, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW 00770 452 NtQueryValueKey (88, (88, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0gram\FSLSP.DLL\0\00\0\0\0\10\0\2\0\10\0\4\1\10\0h\220\354\28\220\354\2\2\0\12\0\4\1\12\00\00\0\0\0\10\0\2\0\14\0\4\1\10\0\210\220\354\2X\220\354\2\2\0\16\0\4\1\12\00\00\0\0\0\10\0\2\0\20\0\4\1\10\0\250\220\354\2x\220\354\2\2\0\22\0\4\1\12\00\00\0\0\0\10\0\2\0\24\0\4\1\10\0\310\220\354\2\230\220\354\2\2\0\26\0\4\1\12\00\00\0\0\0\10\0\2\0\30\0\4\1\10\0\0\0\0\0\270\220\354\2\2\0\32\0\4\1\10\0H\0K\0R\0\0\0\3\0\34\0\4\1\10\0\360\222\354\2\0\0\0\0\0\221\354\2\16\0\0\0<\0\37\0\4\0\10\0X\3\10\0X\3\10\0\4\0\2\0\11\2\2\0\0\0\0\0\0\0\0\0\0\0\0\0\10\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\357\3\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\2\0\0\0\0\0\0\200\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\04\0F\0E\05\07\0D\07\0B\0-\00\03\0A\05\0-\04\08\0B\02\0-\08\0\0\0\0\0\204\3\0\0\3\3\0\0\300\1\0\0\304\1\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0X\0\0\0\3\3\0\0\300\1\0\0\304\1\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\4\3\0\0\300\1\0\0\304\1\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0T\0\0\0\\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0Hl\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\00\08\0\4\3\0\0\300\1\0\0\304\1\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0X\0\0\0\5\3\0\0\300\1\0\0\304\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0X\0\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\5\3\0\0\300\1\0\0\304\1\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\6\3\0\0\300\1\0\0\304\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0X\0\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) , Partial, 900, ... TitleIdx=0, Type=3, Data= (88, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0gram\FSLSP.DLL\0\00\0\0\0\10\0\2\0\10\0\4\1\10\0h\220\354\28\220\354\2\2\0\12\0\4\1\12\00\00\0\0\0\10\0\2\0\14\0\4\1\10\0\210\220\354\2X\220\354\2\2\0\16\0\4\1\12\00\00\0\0\0\10\0\2\0\20\0\4\1\10\0\250\220\354\2x\220\354\2\2\0\22\0\4\1\12\00\00\0\0\0\10\0\2\0\24\0\4\1\10\0\310\220\354\2\230\220\354\2\2\0\26\0\4\1\12\00\00\0\0\0\10\0\2\0\30\0\4\1\10\0\0\0\0\0\270\220\354\2\2\0\32\0\4\1\10\0H\0K\0R\0\0\0\3\0\34\0\4\1\10\0\360\222\354\2\0\0\0\0\0\221\354\2\16\0\0\0<\0\37\0\4\0\10\0X\3\10\0X\3\10\0\4\0\2\0\11\2\2\0\0\0\0\0\0\0\0\0\0\0\0\0\10\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\357\3\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\2\0\0\0\0\0\0\200\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\04\0F\0E\05\07\0D\07\0B\0-\00\03\0A\05\0-\04\08\0B\02\0-\08\0\0\0\0\0\204\3\0\0\3\3\0\0\300\1\0\0\304\1\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0X\0\0\0\3\3\0\0\300\1\0\0\304\1\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\4\3\0\0\300\1\0\0\304\1\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0T\0\0\0\\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0Hl\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\00\08\0\4\3\0\0\300\1\0\0\304\1\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0X\0\0\0\5\3\0\0\300\1\0\0\304\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0X\0\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\5\3\0\0\300\1\0\0\304\1\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\6\3\0\0\300\1\0\0\304\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0X\0\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) \0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\5\3\0\0\300\1\0\0\304\1\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\6\3\0\0\300\1\0\0\304\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0X\0\0\0\0\0\0\0 (88, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0gram\FSLSP.DLL\0\00\0\0\0\10\0\2\0\10\0\4\1\10\0h\220\354\28\220\354\2\2\0\12\0\4\1\12\00\00\0\0\0\10\0\2\0\14\0\4\1\10\0\210\220\354\2X\220\354\2\2\0\16\0\4\1\12\00\00\0\0\0\10\0\2\0\20\0\4\1\10\0\250\220\354\2x\220\354\2\2\0\22\0\4\1\12\00\00\0\0\0\10\0\2\0\24\0\4\1\10\0\310\220\354\2\230\220\354\2\2\0\26\0\4\1\12\00\00\0\0\0\10\0\2\0\30\0\4\1\10\0\0\0\0\0\270\220\354\2\2\0\32\0\4\1\10\0H\0K\0R\0\0\0\3\0\34\0\4\1\10\0\360\222\354\2\0\0\0\0\0\221\354\2\16\0\0\0<\0\37\0\4\0\10\0X\3\10\0X\3\10\0\4\0\2\0\11\2\2\0\0\0\0\0\0\0\0\0\0\0\0\0\10\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\357\3\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\2\0\0\0\0\0\0\200\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\04\0F\0E\05\07\0D\07\0B\0-\00\03\0A\05\0-\04\08\0B\02\0-\08\0\0\0\0\0\204\3\0\0\3\3\0\0\300\1\0\0\304\1\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0X\0\0\0\3\3\0\0\300\1\0\0\304\1\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\4\3\0\0\300\1\0\0\304\1\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0T\0\0\0\\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0Hl\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\00\08\0\4\3\0\0\300\1\0\0\304\1\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0X\0\0\0\5\3\0\0\300\1\0\0\304\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0X\0\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\5\3\0\0\300\1\0\0\304\1\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\6\3\0\0\300\1\0\0\304\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0X\0\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) }, 900, ) == 0x0 00771 452 NtClose (88, ... ) == 0x0 00772 452 NtOpenKey (0x20019, {24, 84, 0x40, 0, 0, (0x20019, {24, 84, 0x40, 0, 0, "000000000008"}, ... 88, ) }, ... 88, ) == 0x0 00773 452 NtQueryValueKey (88, (88, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW 00774 452 NtQueryValueKey (88, (88, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW 00775 452 NtQueryValueKey (88, (88, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0gram\FSLSP.DLL\0\00\0\0\0\10\0\2\0\10\0\4\1\10\0h\220\354\28\220\354\2\2\0\12\0\4\1\12\00\00\0\0\0\10\0\2\0\14\0\4\1\10\0\210\220\354\2X\220\354\2\2\0\16\0\4\1\12\00\00\0\0\0\10\0\2\0\20\0\4\1\10\0\250\220\354\2x\220\354\2\2\0\22\0\4\1\12\00\00\0\0\0\10\0\2\0\24\0\4\1\10\0\310\220\354\2\230\220\354\2\2\0\26\0\4\1\12\00\00\0\0\0\10\0\2\0\30\0\4\1\10\0\0\0\0\0\270\220\354\2\2\0\32\0\4\1\10\0H\0K\0R\0\0\0\3\0\34\0\4\1\10\0\360\222\354\2\0\0\0\0\0\221\354\2\16\0\0\0<\0\37\0\4\0\10\0X\3\10\0X\3\10\0\4\0\2\0\16\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\360\3\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\5\0\0\0\377\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\0A\0B\0E\07\0E\00\06\0F\0-\06\02\00\0F\0-\04\0E\0A\0A\0-\0A\0\0\0\0\0\204\3\0\0\10\3\0\0\300\1\0\0\304\1\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0X\0\0\0\10\3\0\0\300\1\0\0\304\1\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\11\3\0\0\300\1\0\0\304\1\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0T\0\0\0\\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0Hl\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\00\09\0\11\3\0\0\300\1\0\0\304\1\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0X\0\0\0\12\3\0\0\300\1\0\0\304\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0X\0\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\12\3\0\0\300\1\0\0\304\1\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\13\3\0\0\300\1\0\0\304\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0X\0\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) , Partial, 900, ... TitleIdx=0, Type=3, Data= (88, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0gram\FSLSP.DLL\0\00\0\0\0\10\0\2\0\10\0\4\1\10\0h\220\354\28\220\354\2\2\0\12\0\4\1\12\00\00\0\0\0\10\0\2\0\14\0\4\1\10\0\210\220\354\2X\220\354\2\2\0\16\0\4\1\12\00\00\0\0\0\10\0\2\0\20\0\4\1\10\0\250\220\354\2x\220\354\2\2\0\22\0\4\1\12\00\00\0\0\0\10\0\2\0\24\0\4\1\10\0\310\220\354\2\230\220\354\2\2\0\26\0\4\1\12\00\00\0\0\0\10\0\2\0\30\0\4\1\10\0\0\0\0\0\270\220\354\2\2\0\32\0\4\1\10\0H\0K\0R\0\0\0\3\0\34\0\4\1\10\0\360\222\354\2\0\0\0\0\0\221\354\2\16\0\0\0<\0\37\0\4\0\10\0X\3\10\0X\3\10\0\4\0\2\0\16\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\360\3\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\5\0\0\0\377\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\0A\0B\0E\07\0E\00\06\0F\0-\06\02\00\0F\0-\04\0E\0A\0A\0-\0A\0\0\0\0\0\204\3\0\0\10\3\0\0\300\1\0\0\304\1\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0X\0\0\0\10\3\0\0\300\1\0\0\304\1\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\11\3\0\0\300\1\0\0\304\1\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0T\0\0\0\\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0Hl\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\00\09\0\11\3\0\0\300\1\0\0\304\1\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0X\0\0\0\12\3\0\0\300\1\0\0\304\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0X\0\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\12\3\0\0\300\1\0\0\304\1\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\13\3\0\0\300\1\0\0\304\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0X\0\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) \0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\12\3\0\0\300\1\0\0\304\1\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\13\3\0\0\300\1\0\0\304\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0X\0\0\0\0\0\0\0 (88, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0gram\FSLSP.DLL\0\00\0\0\0\10\0\2\0\10\0\4\1\10\0h\220\354\28\220\354\2\2\0\12\0\4\1\12\00\00\0\0\0\10\0\2\0\14\0\4\1\10\0\210\220\354\2X\220\354\2\2\0\16\0\4\1\12\00\00\0\0\0\10\0\2\0\20\0\4\1\10\0\250\220\354\2x\220\354\2\2\0\22\0\4\1\12\00\00\0\0\0\10\0\2\0\24\0\4\1\10\0\310\220\354\2\230\220\354\2\2\0\26\0\4\1\12\00\00\0\0\0\10\0\2\0\30\0\4\1\10\0\0\0\0\0\270\220\354\2\2\0\32\0\4\1\10\0H\0K\0R\0\0\0\3\0\34\0\4\1\10\0\360\222\354\2\0\0\0\0\0\221\354\2\16\0\0\0<\0\37\0\4\0\10\0X\3\10\0X\3\10\0\4\0\2\0\16\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\360\3\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\5\0\0\0\377\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\0A\0B\0E\07\0E\00\06\0F\0-\06\02\00\0F\0-\04\0E\0A\0A\0-\0A\0\0\0\0\0\204\3\0\0\10\3\0\0\300\1\0\0\304\1\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0X\0\0\0\10\3\0\0\300\1\0\0\304\1\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\11\3\0\0\300\1\0\0\304\1\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0T\0\0\0\\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0Hl\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\00\09\0\11\3\0\0\300\1\0\0\304\1\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0X\0\0\0\12\3\0\0\300\1\0\0\304\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0X\0\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\12\3\0\0\300\1\0\0\304\1\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\13\3\0\0\300\1\0\0\304\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0X\0\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) }, 900, ) == 0x0 00776 452 NtClose (88, ... ) == 0x0 00777 452 NtOpenKey (0x20019, {24, 84, 0x40, 0, 0, (0x20019, {24, 84, 0x40, 0, 0, "000000000009"}, ... 88, ) }, ... 88, ) == 0x0 00778 452 NtQueryValueKey (88, (88, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW 00779 452 NtQueryValueKey (88, (88, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW 00780 452 NtAllocateVirtualMemory (-1, 1347584, 0, 4096, 4096, 4, ... 1347584, 4096, ) == 0x0 00781 452 NtQueryValueKey (88, (88, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0gram\FSLSP.DLL\0\00\0\0\0\10\0\2\0\10\0\4\1\10\0h\220\354\28\220\354\2\2\0\12\0\4\1\12\00\00\0\0\0\10\0\2\0\14\0\4\1\10\0\210\220\354\2X\220\354\2\2\0\16\0\4\1\12\00\00\0\0\0\10\0\2\0\20\0\4\1\10\0\250\220\354\2x\220\354\2\2\0\22\0\4\1\12\00\00\0\0\0\10\0\2\0\24\0\4\1\10\0\310\220\354\2\230\220\354\2\2\0\26\0\4\1\12\00\00\0\0\0\10\0\2\0\30\0\4\1\10\0\0\0\0\0\270\220\354\2\2\0\32\0\4\1\10\0H\0K\0R\0\0\0\3\0\34\0\4\1\10\0\360\222\354\2\0\0\0\0\0\221\354\2\16\0\0\0<\0\37\0\4\0\10\0X\3\10\0X\3\10\0\4\0\2\0\11\2\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\361\3\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\2\0\0\0\377\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\0A\0B\0E\07\0E\00\06\0F\0-\06\02\00\0F\0-\04\0E\0A\0A\0-\0A\0\0\0\0\0\204\3\0\0\16\3\0\0\300\1\0\0\304\1\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0X\0\0\0\16\3\0\0\300\1\0\0\304\1\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\17\3\0\0\300\1\0\0\304\1\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0T\0\0\0\\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0Hl\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\01\00\0\17\3\0\0\300\1\0\0\304\1\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0X\0\0\0\20\3\0\0\300\1\0\0\304\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0X\0\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\20\3\0\0\300\1\0\0\304\1\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\21\3\0\0\300\1\0\0\304\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0X\0\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) , Partial, 900, ... TitleIdx=0, Type=3, Data= (88, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0gram\FSLSP.DLL\0\00\0\0\0\10\0\2\0\10\0\4\1\10\0h\220\354\28\220\354\2\2\0\12\0\4\1\12\00\00\0\0\0\10\0\2\0\14\0\4\1\10\0\210\220\354\2X\220\354\2\2\0\16\0\4\1\12\00\00\0\0\0\10\0\2\0\20\0\4\1\10\0\250\220\354\2x\220\354\2\2\0\22\0\4\1\12\00\00\0\0\0\10\0\2\0\24\0\4\1\10\0\310\220\354\2\230\220\354\2\2\0\26\0\4\1\12\00\00\0\0\0\10\0\2\0\30\0\4\1\10\0\0\0\0\0\270\220\354\2\2\0\32\0\4\1\10\0H\0K\0R\0\0\0\3\0\34\0\4\1\10\0\360\222\354\2\0\0\0\0\0\221\354\2\16\0\0\0<\0\37\0\4\0\10\0X\3\10\0X\3\10\0\4\0\2\0\11\2\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\361\3\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\2\0\0\0\377\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\0A\0B\0E\07\0E\00\06\0F\0-\06\02\00\0F\0-\04\0E\0A\0A\0-\0A\0\0\0\0\0\204\3\0\0\16\3\0\0\300\1\0\0\304\1\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0X\0\0\0\16\3\0\0\300\1\0\0\304\1\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\17\3\0\0\300\1\0\0\304\1\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0T\0\0\0\\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0Hl\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\01\00\0\17\3\0\0\300\1\0\0\304\1\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0X\0\0\0\20\3\0\0\300\1\0\0\304\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0X\0\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\20\3\0\0\300\1\0\0\304\1\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\21\3\0\0\300\1\0\0\304\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0X\0\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) \0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\20\3\0\0\300\1\0\0\304\1\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\21\3\0\0\300\1\0\0\304\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0X\0\0\0\0\0\0\0 (88, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0gram\FSLSP.DLL\0\00\0\0\0\10\0\2\0\10\0\4\1\10\0h\220\354\28\220\354\2\2\0\12\0\4\1\12\00\00\0\0\0\10\0\2\0\14\0\4\1\10\0\210\220\354\2X\220\354\2\2\0\16\0\4\1\12\00\00\0\0\0\10\0\2\0\20\0\4\1\10\0\250\220\354\2x\220\354\2\2\0\22\0\4\1\12\00\00\0\0\0\10\0\2\0\24\0\4\1\10\0\310\220\354\2\230\220\354\2\2\0\26\0\4\1\12\00\00\0\0\0\10\0\2\0\30\0\4\1\10\0\0\0\0\0\270\220\354\2\2\0\32\0\4\1\10\0H\0K\0R\0\0\0\3\0\34\0\4\1\10\0\360\222\354\2\0\0\0\0\0\221\354\2\16\0\0\0<\0\37\0\4\0\10\0X\3\10\0X\3\10\0\4\0\2\0\11\2\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\361\3\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\2\0\0\0\377\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\0A\0B\0E\07\0E\00\06\0F\0-\06\02\00\0F\0-\04\0E\0A\0A\0-\0A\0\0\0\0\0\204\3\0\0\16\3\0\0\300\1\0\0\304\1\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0X\0\0\0\16\3\0\0\300\1\0\0\304\1\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\17\3\0\0\300\1\0\0\304\1\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0T\0\0\0\\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0Hl\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\01\00\0\17\3\0\0\300\1\0\0\304\1\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0X\0\0\0\20\3\0\0\300\1\0\0\304\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0X\0\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\20\3\0\0\300\1\0\0\304\1\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\21\3\0\0\300\1\0\0\304\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0X\0\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) }, 900, ) == 0x0 00782 452 NtClose (88, ... ) == 0x0 00783 452 NtOpenKey (0x20019, {24, 84, 0x40, 0, 0, (0x20019, {24, 84, 0x40, 0, 0, "000000000010"}, ... 88, ) }, ... 88, ) == 0x0 00784 452 NtQueryValueKey (88, (88, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW 00785 452 NtQueryValueKey (88, (88, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW 00786 452 NtQueryValueKey (88, (88, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0gram\FSLSP.DLL\0\00\0\0\0\10\0\2\0\10\0\4\1\10\0h\220\354\28\220\354\2\2\0\12\0\4\1\12\00\00\0\0\0\10\0\2\0\14\0\4\1\10\0\210\220\354\2X\220\354\2\2\0\16\0\4\1\12\00\00\0\0\0\10\0\2\0\20\0\4\1\10\0\250\220\354\2x\220\354\2\2\0\22\0\4\1\12\00\00\0\0\0\10\0\2\0\24\0\4\1\10\0\310\220\354\2\230\220\354\2\2\0\26\0\4\1\12\00\00\0\0\0\10\0\2\0\30\0\4\1\10\0\0\0\0\0\270\220\354\2\2\0\32\0\4\1\10\0H\0K\0R\0\0\0\3\0\34\0\4\1\10\0\360\222\354\2\0\0\0\0\0\221\354\2\16\0\0\0<\0\37\0\4\0\10\0X\3\10\0X\3\10\0\4\0\2\0\16\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\362\3\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\5\0\0\0\376\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\0D\01\09\0D\0F\08\08\02\0-\0A\09\0C\0B\0-\04\01\04\04\0-\08\0\0\0\0\0\204\3\0\0\23\3\0\0\300\1\0\0\304\1\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0X\0\0\0\23\3\0\0\300\1\0\0\304\1\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\24\3\0\0\300\1\0\0\304\1\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0T\0\0\0\\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0Hl\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\01\01\0\24\3\0\0\300\1\0\0\304\1\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0X\0\0\0\25\3\0\0\300\1\0\0\304\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0X\0\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\25\3\0\0\300\1\0\0\304\1\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\26\3\0\0\300\1\0\0\304\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0X\0\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) , Partial, 900, ... TitleIdx=0, Type=3, Data= (88, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0gram\FSLSP.DLL\0\00\0\0\0\10\0\2\0\10\0\4\1\10\0h\220\354\28\220\354\2\2\0\12\0\4\1\12\00\00\0\0\0\10\0\2\0\14\0\4\1\10\0\210\220\354\2X\220\354\2\2\0\16\0\4\1\12\00\00\0\0\0\10\0\2\0\20\0\4\1\10\0\250\220\354\2x\220\354\2\2\0\22\0\4\1\12\00\00\0\0\0\10\0\2\0\24\0\4\1\10\0\310\220\354\2\230\220\354\2\2\0\26\0\4\1\12\00\00\0\0\0\10\0\2\0\30\0\4\1\10\0\0\0\0\0\270\220\354\2\2\0\32\0\4\1\10\0H\0K\0R\0\0\0\3\0\34\0\4\1\10\0\360\222\354\2\0\0\0\0\0\221\354\2\16\0\0\0<\0\37\0\4\0\10\0X\3\10\0X\3\10\0\4\0\2\0\16\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\362\3\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\5\0\0\0\376\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\0D\01\09\0D\0F\08\08\02\0-\0A\09\0C\0B\0-\04\01\04\04\0-\08\0\0\0\0\0\204\3\0\0\23\3\0\0\300\1\0\0\304\1\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0X\0\0\0\23\3\0\0\300\1\0\0\304\1\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\24\3\0\0\300\1\0\0\304\1\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0T\0\0\0\\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0Hl\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\01\01\0\24\3\0\0\300\1\0\0\304\1\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0X\0\0\0\25\3\0\0\300\1\0\0\304\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0X\0\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\25\3\0\0\300\1\0\0\304\1\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\26\3\0\0\300\1\0\0\304\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0X\0\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) \0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\25\3\0\0\300\1\0\0\304\1\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\26\3\0\0\300\1\0\0\304\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0X\0\0\0\0\0\0\0 (88, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0gram\FSLSP.DLL\0\00\0\0\0\10\0\2\0\10\0\4\1\10\0h\220\354\28\220\354\2\2\0\12\0\4\1\12\00\00\0\0\0\10\0\2\0\14\0\4\1\10\0\210\220\354\2X\220\354\2\2\0\16\0\4\1\12\00\00\0\0\0\10\0\2\0\20\0\4\1\10\0\250\220\354\2x\220\354\2\2\0\22\0\4\1\12\00\00\0\0\0\10\0\2\0\24\0\4\1\10\0\310\220\354\2\230\220\354\2\2\0\26\0\4\1\12\00\00\0\0\0\10\0\2\0\30\0\4\1\10\0\0\0\0\0\270\220\354\2\2\0\32\0\4\1\10\0H\0K\0R\0\0\0\3\0\34\0\4\1\10\0\360\222\354\2\0\0\0\0\0\221\354\2\16\0\0\0<\0\37\0\4\0\10\0X\3\10\0X\3\10\0\4\0\2\0\16\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\362\3\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\5\0\0\0\376\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\0D\01\09\0D\0F\08\08\02\0-\0A\09\0C\0B\0-\04\01\04\04\0-\08\0\0\0\0\0\204\3\0\0\23\3\0\0\300\1\0\0\304\1\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0X\0\0\0\23\3\0\0\300\1\0\0\304\1\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\24\3\0\0\300\1\0\0\304\1\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0T\0\0\0\\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0Hl\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\01\01\0\24\3\0\0\300\1\0\0\304\1\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0X\0\0\0\25\3\0\0\300\1\0\0\304\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0X\0\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\25\3\0\0\300\1\0\0\304\1\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\26\3\0\0\300\1\0\0\304\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0X\0\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) }, 900, ) == 0x0 00787 452 NtClose (88, ... ) == 0x0 00788 452 NtOpenKey (0x20019, {24, 84, 0x40, 0, 0, (0x20019, {24, 84, 0x40, 0, 0, "000000000011"}, ... 88, ) }, ... 88, ) == 0x0 00789 452 NtQueryValueKey (88, (88, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW 00790 452 NtQueryValueKey (88, (88, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW 00791 452 NtQueryValueKey (88, (88, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0gram\FSLSP.DLL\0\00\0\0\0\10\0\2\0\10\0\4\1\10\0h\220\354\28\220\354\2\2\0\12\0\4\1\12\00\00\0\0\0\10\0\2\0\14\0\4\1\10\0\210\220\354\2X\220\354\2\2\0\16\0\4\1\12\00\00\0\0\0\10\0\2\0\20\0\4\1\10\0\250\220\354\2x\220\354\2\2\0\22\0\4\1\12\00\00\0\0\0\10\0\2\0\24\0\4\1\10\0\310\220\354\2\230\220\354\2\2\0\26\0\4\1\12\00\00\0\0\0\10\0\2\0\30\0\4\1\10\0\0\0\0\0\270\220\354\2\2\0\32\0\4\1\10\0H\0K\0R\0\0\0\3\0\34\0\4\1\10\0\360\222\354\2\0\0\0\0\0\221\354\2\16\0\0\0<\0\37\0\4\0\10\0X\3\10\0X\3\10\0\4\0\2\0\11\2\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\363\3\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\2\0\0\0\376\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\0D\01\09\0D\0F\08\08\02\0-\0A\09\0C\0B\0-\04\01\04\04\0-\08\0\0\0\0\0\204\3\0\0\30\3\0\0\300\1\0\0\304\1\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0X\0\0\0\30\3\0\0\300\1\0\0\304\1\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\31\3\0\0\300\1\0\0\304\1\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0T\0\0\0\31\3\0\0\300\1\0\0\304\1\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\32\3\0\0\300\1\0\0\304\1\0\0\305\0\0\0\0\0\1\0\0\0\0\0\24\0\0\0L\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\32\3\0\0\300\1\0\0\304\1\0\0\305\0\0\0\1\0\1\0\2\1\0\0\0\0\0\0\33\3\0\0\300\1\0\0\304\1\0\0\25\0\0\0\0\0\1\0\0\0\0\0\24\0\0\0\3\0\37\0\377\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\33\3\0\0\300\1\0\0\304\1\0\0\25\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0T\0\0\0\34\3\0\0\300\1\0\0\304\1\0\0Q\0\0\0\0\0\1\0\0\0\0\0T\0\0\0\0\0\0\2\0\0\0\0\30\0\0\0H\0\0\0x\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0$\0&\0\30l\24\0\0\0\0\0N\0a\0m\0e\0S\0p\0a\0c\0e\0_\0C\0a\0t\0a\0l\0o\0g\05\0"}, 900, ) , Partial, 900, ... TitleIdx=0, Type=3, Data= (88, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0gram\FSLSP.DLL\0\00\0\0\0\10\0\2\0\10\0\4\1\10\0h\220\354\28\220\354\2\2\0\12\0\4\1\12\00\00\0\0\0\10\0\2\0\14\0\4\1\10\0\210\220\354\2X\220\354\2\2\0\16\0\4\1\12\00\00\0\0\0\10\0\2\0\20\0\4\1\10\0\250\220\354\2x\220\354\2\2\0\22\0\4\1\12\00\00\0\0\0\10\0\2\0\24\0\4\1\10\0\310\220\354\2\230\220\354\2\2\0\26\0\4\1\12\00\00\0\0\0\10\0\2\0\30\0\4\1\10\0\0\0\0\0\270\220\354\2\2\0\32\0\4\1\10\0H\0K\0R\0\0\0\3\0\34\0\4\1\10\0\360\222\354\2\0\0\0\0\0\221\354\2\16\0\0\0<\0\37\0\4\0\10\0X\3\10\0X\3\10\0\4\0\2\0\11\2\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\363\3\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\2\0\0\0\376\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\0D\01\09\0D\0F\08\08\02\0-\0A\09\0C\0B\0-\04\01\04\04\0-\08\0\0\0\0\0\204\3\0\0\30\3\0\0\300\1\0\0\304\1\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0X\0\0\0\30\3\0\0\300\1\0\0\304\1\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\31\3\0\0\300\1\0\0\304\1\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0T\0\0\0\31\3\0\0\300\1\0\0\304\1\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\32\3\0\0\300\1\0\0\304\1\0\0\305\0\0\0\0\0\1\0\0\0\0\0\24\0\0\0L\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\32\3\0\0\300\1\0\0\304\1\0\0\305\0\0\0\1\0\1\0\2\1\0\0\0\0\0\0\33\3\0\0\300\1\0\0\304\1\0\0\25\0\0\0\0\0\1\0\0\0\0\0\24\0\0\0\3\0\37\0\377\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\33\3\0\0\300\1\0\0\304\1\0\0\25\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0T\0\0\0\34\3\0\0\300\1\0\0\304\1\0\0Q\0\0\0\0\0\1\0\0\0\0\0T\0\0\0\0\0\0\2\0\0\0\0\30\0\0\0H\0\0\0x\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0$\0&\0\30l\24\0\0\0\0\0N\0a\0m\0e\0S\0p\0a\0c\0e\0_\0C\0a\0t\0a\0l\0o\0g\05\0"}, 900, ) }, 900, ) == 0x0 00792 452 NtClose (88, ... ) == 0x0 00793 452 NtClose (84, ... ) == 0x0 00794 452 NtWaitForSingleObject (76, 0, {0, 0}, ... ) == 0x102 00795 452 NtCreateEvent (0x1f0003, 0x0, 0, 0, ... 84, ) == 0x0 00796 452 NtOpenKey (0x2000000, {24, 72, 0x40, 0, 0, (0x2000000, {24, 72, 0x40, 0, 0, "NameSpace_Catalog5"}, ... 88, ) }, ... 88, ) == 0x0 00797 452 NtQueryValueKey (88, (88, "Serial_Access_Num", Partial, 144, ... TitleIdx=0, Type=4, Data="\4\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (88, "Serial_Access_Num", Partial, 144, ... TitleIdx=0, Type=4, Data="\4\0\0\0"}, 16, ) }, 16, ) == 0x0 00798 452 NtNotifyChangeKey (88, 84, 0, 0, 2011390432, 1, 0, 0, 0, 1, ... ) == 0x103 00799 452 NtQueryValueKey (88, (88, "Serial_Access_Num", Partial, 144, ... TitleIdx=0, Type=4, Data="\4\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (88, "Serial_Access_Num", Partial, 144, ... TitleIdx=0, Type=4, Data="\4\0\0\0"}, 16, ) }, 16, ) == 0x0 00800 452 NtOpenKey (0x2000000, {24, 88, 0x40, 0, 0, (0x2000000, {24, 88, 0x40, 0, 0, "00000004"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 00801 452 NtQueryValueKey (88, (88, "Num_Catalog_Entries", Partial, 144, ... TitleIdx=0, Type=4, Data="\3\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (88, "Num_Catalog_Entries", Partial, 144, ... TitleIdx=0, Type=4, Data="\3\0\0\0"}, 16, ) }, 16, ) == 0x0 00802 452 NtOpenKey (0x2000000, {24, 88, 0x40, 0, 0, (0x2000000, {24, 88, 0x40, 0, 0, "Catalog_Entries"}, ... 92, ) }, ... 92, ) == 0x0 00803 452 NtOpenKey (0x20019, {24, 92, 0x40, 0, 0, (0x20019, {24, 92, 0x40, 0, 0, "000000000001"}, ... 96, ) }, ... 96, ) == 0x0 00804 452 NtQueryValueKey (96, (96, "LibraryPath", Partial, 144, ... TitleIdx=0, Type=1, Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0m\0s\0w\0s\0o\0c\0k\0.\0d\0l\0l\0\0\0"}, 80, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (96, "LibraryPath", Partial, 144, ... TitleIdx=0, Type=1, Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0m\0s\0w\0s\0o\0c\0k\0.\0d\0l\0l\0\0\0"}, 80, ) }, 80, ) == 0x0 00805 452 NtQueryValueKey (96, (96, "LibraryPath", Partial, 144, ... TitleIdx=0, Type=1, Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0m\0s\0w\0s\0o\0c\0k\0.\0d\0l\0l\0\0\0"}, 80, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (96, "LibraryPath", Partial, 144, ... TitleIdx=0, Type=1, Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0m\0s\0w\0s\0o\0c\0k\0.\0d\0l\0l\0\0\0"}, 80, ) }, 80, ) == 0x0 00806 452 NtQueryValueKey (96, (96, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="T\0c\0p\0i\0p\0\0\0"}, 24, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (96, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="T\0c\0p\0i\0p\0\0\0"}, 24, ) }, 24, ) == 0x0 00807 452 NtQueryValueKey (96, (96, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="T\0c\0p\0i\0p\0\0\0"}, 24, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (96, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="T\0c\0p\0i\0p\0\0\0"}, 24, ) }, 24, ) == 0x0 00808 452 NtQueryValueKey (96, (96, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="T\0c\0p\0i\0p\0\0\0"}, 24, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (96, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="T\0c\0p\0i\0p\0\0\0"}, 24, ) }, 24, ) == 0x0 00809 452 NtQueryValueKey (96, (96, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="T\0c\0p\0i\0p\0\0\0"}, 24, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (96, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="T\0c\0p\0i\0p\0\0\0"}, 24, ) }, 24, ) == 0x0 00810 452 NtQueryValueKey (96, (96, "ProviderId", Partial, 144, ... TitleIdx=0, Type=3, Data="@\235\5"\236~\317\21\256Z\0\252\0\247\21+"}, 28, ) , Partial, 144, ... TitleIdx=0, Type=3, Data= (96, "ProviderId", Partial, 144, ... TitleIdx=0, Type=3, Data="@\235\5"\236~\317\21\256Z\0\252\0\247\21+"}, 28, ) \236~\317\21\256Z\0\252\0\247\21+"}, 28, ) == 0x0 00811 452 NtQueryValueKey (96, (96, "AddressFamily", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 00812 452 NtQueryValueKey (96, (96, "SupportedNameSpace", Partial, 144, ... TitleIdx=0, Type=4, Data="\14\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (96, "SupportedNameSpace", Partial, 144, ... TitleIdx=0, Type=4, Data="\14\0\0\0"}, 16, ) }, 16, ) == 0x0 00813 452 NtQueryValueKey (96, (96, "Enabled", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (96, "Enabled", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) }, 16, ) == 0x0 00814 452 NtQueryValueKey (96, (96, "Version", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (96, "Version", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) }, 16, ) == 0x0 00815 452 NtQueryValueKey (96, (96, "StoresServiceClassInfo", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (96, "StoresServiceClassInfo", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) }, 16, ) == 0x0 00816 452 NtClose (96, ... ) == 0x0 00817 452 NtOpenKey (0x20019, {24, 92, 0x40, 0, 0, (0x20019, {24, 92, 0x40, 0, 0, "000000000002"}, ... 96, ) }, ... 96, ) == 0x0 00818 452 NtQueryValueKey (96, (96, "LibraryPath", Partial, 144, ... TitleIdx=0, Type=1, Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0w\0i\0n\0r\0n\0r\0.\0d\0l\0l\0\0\0"}, 78, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (96, "LibraryPath", Partial, 144, ... TitleIdx=0, Type=1, Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0w\0i\0n\0r\0n\0r\0.\0d\0l\0l\0\0\0"}, 78, ) }, 78, ) == 0x0 00819 452 NtQueryValueKey (96, (96, "LibraryPath", Partial, 144, ... TitleIdx=0, Type=1, Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0w\0i\0n\0r\0n\0r\0.\0d\0l\0l\0\0\0"}, 78, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (96, "LibraryPath", Partial, 144, ... TitleIdx=0, Type=1, Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0w\0i\0n\0r\0n\0r\0.\0d\0l\0l\0\0\0"}, 78, ) }, 78, ) == 0x0 00820 452 NtQueryValueKey (96, (96, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="N\0T\0D\0S\0\0\0"}, 22, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (96, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="N\0T\0D\0S\0\0\0"}, 22, ) }, 22, ) == 0x0 00821 452 NtQueryValueKey (96, (96, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="N\0T\0D\0S\0\0\0"}, 22, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (96, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="N\0T\0D\0S\0\0\0"}, 22, ) }, 22, ) == 0x0 00822 452 NtQueryValueKey (96, (96, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="N\0T\0D\0S\0\0\0"}, 22, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (96, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="N\0T\0D\0S\0\0\0"}, 22, ) }, 22, ) == 0x0 00823 452 NtQueryValueKey (96, (96, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="N\0T\0D\0S\0\0\0"}, 22, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (96, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="N\0T\0D\0S\0\0\0"}, 22, ) }, 22, ) == 0x0 00824 452 NtQueryValueKey (96, (96, "ProviderId", Partial, 144, ... TitleIdx=0, Type=3, Data="\3567&;\200\345\317\21\245U\0\300O\330\324\254"}, 28, ) , Partial, 144, ... TitleIdx=0, Type=3, Data= (96, "ProviderId", Partial, 144, ... TitleIdx=0, Type=3, Data="\3567&;\200\345\317\21\245U\0\300O\330\324\254"}, 28, ) }, 28, ) == 0x0 00825 452 NtQueryValueKey (96, (96, "AddressFamily", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 00826 452 NtQueryValueKey (96, (96, "SupportedNameSpace", Partial, 144, ... TitleIdx=0, Type=4, Data=" \0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (96, "SupportedNameSpace", Partial, 144, ... TitleIdx=0, Type=4, Data=" \0\0\0"}, 16, ) }, 16, ) == 0x0 00827 452 NtQueryValueKey (96, (96, "Enabled", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (96, "Enabled", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) }, 16, ) == 0x0 00828 452 NtQueryValueKey (96, (96, "Version", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (96, "Version", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) }, 16, ) == 0x0 00829 452 NtQueryValueKey (96, (96, "StoresServiceClassInfo", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (96, "StoresServiceClassInfo", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) }, 16, ) == 0x0 00830 452 NtClose (96, ... ) == 0x0 00831 452 NtAllocateVirtualMemory (-1, 1351680, 0, 4096, 4096, 4, ... 1351680, 4096, ) == 0x0 00832 452 NtOpenKey (0x20019, {24, 92, 0x40, 0, 0, (0x20019, {24, 92, 0x40, 0, 0, "000000000003"}, ... 96, ) }, ... 96, ) == 0x0 00833 452 NtQueryValueKey (96, (96, "LibraryPath", Partial, 144, ... TitleIdx=0, Type=1, Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0m\0s\0w\0s\0o\0c\0k\0.\0d\0l\0l\0\0\0"}, 80, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (96, "LibraryPath", Partial, 144, ... TitleIdx=0, Type=1, Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0m\0s\0w\0s\0o\0c\0k\0.\0d\0l\0l\0\0\0"}, 80, ) }, 80, ) == 0x0 00834 452 NtQueryValueKey (96, (96, "LibraryPath", Partial, 144, ... TitleIdx=0, Type=1, Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0m\0s\0w\0s\0o\0c\0k\0.\0d\0l\0l\0\0\0"}, 80, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (96, "LibraryPath", Partial, 144, ... TitleIdx=0, Type=1, Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0m\0s\0w\0s\0o\0c\0k\0.\0d\0l\0l\0\0\0"}, 80, ) }, 80, ) == 0x0 00835 452 NtQueryValueKey (96, (96, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="N\0e\0t\0w\0o\0r\0k\0 \0L\0o\0c\0a\0t\0i\0o\0n\0 \0A\0w\0a\0r\0e\0n\0e\0s\0s\0 \0(\0N\0L\0A\0)\0 \0N\0a\0m\0e\0s\0p\0a\0c\0e\0\0\0"}, 98, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (96, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="N\0e\0t\0w\0o\0r\0k\0 \0L\0o\0c\0a\0t\0i\0o\0n\0 \0A\0w\0a\0r\0e\0n\0e\0s\0s\0 \0(\0N\0L\0A\0)\0 \0N\0a\0m\0e\0s\0p\0a\0c\0e\0\0\0"}, 98, ) }, 98, ) == 0x0 00836 452 NtQueryValueKey (96, (96, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="N\0e\0t\0w\0o\0r\0k\0 \0L\0o\0c\0a\0t\0i\0o\0n\0 \0A\0w\0a\0r\0e\0n\0e\0s\0s\0 \0(\0N\0L\0A\0)\0 \0N\0a\0m\0e\0s\0p\0a\0c\0e\0\0\0"}, 98, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (96, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="N\0e\0t\0w\0o\0r\0k\0 \0L\0o\0c\0a\0t\0i\0o\0n\0 \0A\0w\0a\0r\0e\0n\0e\0s\0s\0 \0(\0N\0L\0A\0)\0 \0N\0a\0m\0e\0s\0p\0a\0c\0e\0\0\0"}, 98, ) }, 98, ) == 0x0 00837 452 NtQueryValueKey (96, (96, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="N\0e\0t\0w\0o\0r\0k\0 \0L\0o\0c\0a\0t\0i\0o\0n\0 \0A\0w\0a\0r\0e\0n\0e\0s\0s\0 \0(\0N\0L\0A\0)\0 \0N\0a\0m\0e\0s\0p\0a\0c\0e\0\0\0"}, 98, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (96, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="N\0e\0t\0w\0o\0r\0k\0 \0L\0o\0c\0a\0t\0i\0o\0n\0 \0A\0w\0a\0r\0e\0n\0e\0s\0s\0 \0(\0N\0L\0A\0)\0 \0N\0a\0m\0e\0s\0p\0a\0c\0e\0\0\0"}, 98, ) }, 98, ) == 0x0 00838 452 NtQueryValueKey (96, (96, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="N\0e\0t\0w\0o\0r\0k\0 \0L\0o\0c\0a\0t\0i\0o\0n\0 \0A\0w\0a\0r\0e\0n\0e\0s\0s\0 \0(\0N\0L\0A\0)\0 \0N\0a\0m\0e\0s\0p\0a\0c\0e\0\0\0"}, 98, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (96, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="N\0e\0t\0w\0o\0r\0k\0 \0L\0o\0c\0a\0t\0i\0o\0n\0 \0A\0w\0a\0r\0e\0n\0e\0s\0s\0 \0(\0N\0L\0A\0)\0 \0N\0a\0m\0e\0s\0p\0a\0c\0e\0\0\0"}, 98, ) }, 98, ) == 0x0 00839 452 NtQueryValueKey (96, (96, "ProviderId", Partial, 144, ... TitleIdx=0, Type=3, Data=":$Bf\250;\246J\272\245.\13\327\37\335\203"}, 28, ) , Partial, 144, ... TitleIdx=0, Type=3, Data= (96, "ProviderId", Partial, 144, ... TitleIdx=0, Type=3, Data=":$Bf\250;\246J\272\245.\13\327\37\335\203"}, 28, ) }, 28, ) == 0x0 00840 452 NtQueryValueKey (96, (96, "AddressFamily", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 00841 452 NtQueryValueKey (96, (96, "SupportedNameSpace", Partial, 144, ... TitleIdx=0, Type=4, Data="\17\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (96, "SupportedNameSpace", Partial, 144, ... TitleIdx=0, Type=4, Data="\17\0\0\0"}, 16, ) }, 16, ) == 0x0 00842 452 NtQueryValueKey (96, (96, "Enabled", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (96, "Enabled", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) }, 16, ) == 0x0 00843 452 NtQueryValueKey (96, (96, "Version", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (96, "Version", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) }, 16, ) == 0x0 00844 452 NtQueryValueKey (96, (96, "StoresServiceClassInfo", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (96, "StoresServiceClassInfo", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) }, 16, ) == 0x0 00845 452 NtClose (96, ... ) == 0x0 00846 452 NtClose (92, ... ) == 0x0 00847 452 NtWaitForSingleObject (84, 0, {0, 0}, ... ) == 0x102 00848 452 NtClose (72, ... ) == 0x0 00849 452 NtQuerySystemInformation (Basic, 44, ... {Unknown=0,MaximumIncrement=156250,PhysicalPageSize=0x1000,NumberOfPhysicalPages=0xff7c,LowestPhysicalPage=0x1,HighestPhysicalPage=0xffff,AllocationGranularity=0x10000,LowestUserAddress=0x10000,HighestUserAddress=0x7ffeffff,ActiveProcessors=1,NumberProcessors=1,}, 0x0, ) == 0x0 00850 452 NtQuerySystemInformation (Processor, 12, ... {system info, class 1, size 12}, 0x0, ) == 0x0 00851 452 NtOpenKey (0x1, {24, 28, 0x40, 0, 0, (0x1, {24, 28, 0x40, 0, 0, "System\CurrentControlSet\Services\Winsock2\Parameters"}, ... 72, ) }, ... 72, ) == 0x0 00852 452 NtQueryValueKey (72, (72, "Ws2_32NumHandleBuckets", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 00853 452 NtClose (72, ... ) == 0x0 00854 452 NtDuplicateObject (-1, -2, -1, 0x0, 0, 2, ... 72, ) == 0x0 00855 452 NtAllocateVirtualMemory (-1, 0, 0, 17, 4096, 64, ... 9306112, 4096, ) == 0x0 00856 452 NtAllocateVirtualMemory (-1, 0, 0, 21, 4096, 64, ... 9437184, 4096, ) == 0x0 00857 452 NtAllocateVirtualMemory (-1, 9846784, 0, 16384, 4096, 4, ... 9846784, 16384, ) == 0x0 00858 452 NtAllocateVirtualMemory (-1, 0, 0, 326, 4096, 64, ... 9502720, 4096, ) == 0x0 00859 452 NtFreeVirtualMemory (-1, (0x964000), 16384, 16384, ... (0x964000), 16384, ) == 0x0 00860 452 NtAllocateVirtualMemory (-1, 9846784, 0, 81920, 4096, 4, ... 9846784, 81920, ) == 0x0 00861 452 NtFreeVirtualMemory (-1, (0x974000), 16384, 16384, ... (0x974000), 16384, ) == 0x0 00862 452 NtFreeVirtualMemory (-1, (0x964000), 65536, 16384, ... (0x964000), 65536, ) == 0x0 00863 452 NtAllocateVirtualMemory (-1, 9846784, 0, 32768, 4096, 4, ... 9846784, 32768, ) == 0x0 00864 452 NtFreeVirtualMemory (-1, (0x964000), 32768, 16384, ... (0x964000), 32768, ) == 0x0 00865 452 NtAllocateVirtualMemory (-1, 9846784, 0, 81920, 4096, 4, ... 9846784, 81920, ) == 0x0 00866 452 NtFreeVirtualMemory (-1, (0x964000), 81920, 16384, ... (0x964000), 81920, ) == 0x0 00867 452 NtCreateFile (0xc0100080, {24, 0, 0x40, 0, 1243880, (0xc0100080, {24, 0, 0x40, 0, 1243880, "\??\Scsi0:"}, 0x0, 0, 3, 1, 96, 0, 0, ... 92, {status=0x0, info=0}, ) }, 0x0, 0, 3, 1, 96, 0, 0, ... 92, {status=0x0, info=0}, ) == 0x0 00868 452 NtDeviceIoControlFile (92, 0, 0x0, 0x0, 0x4d008, (92, 0, 0x0, 0x0, 0x4d008, "\34\0\0\0SCSIDISK\2\0\0\0\1\5\33\0\0\0\0\0 \2\0\0\0\2\0\0\0\1\1\0\0\240\354\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0", 572, 572, ... {status=0x0, info=572}, "\34\0\0\0SCSIDISK\2\0\0\0\1\5\33\0\0\0\0\0 \2\0\0\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0zBa\30\0\0\20\0\0\0\0\0?\0\0\0\0\0\0\000000000000000000010\0\0@\0\0\000000010MVawerV riutlaI EDH ra drDvi e @\200\0\0\0/\0\0\0\2\0\0\7\0a\30\20\0?\0\360\375_\0@\1\0\0`\0\0\0\7\0\3\0x\0x\0\240\0x\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\36\0\27\0\10@\10@\0@\10@\0@\0@\7\4\0\0\0\0\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0", ) , 572, 572, ... {status=0x0, info=572}, (92, 0, 0x0, 0x0, 0x4d008, "\34\0\0\0SCSIDISK\2\0\0\0\1\5\33\0\0\0\0\0 \2\0\0\0\2\0\0\0\1\1\0\0\240\354\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0", 572, 572, ... {status=0x0, info=572}, "\34\0\0\0SCSIDISK\2\0\0\0\1\5\33\0\0\0\0\0 \2\0\0\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0zBa\30\0\0\20\0\0\0\0\0?\0\0\0\0\0\0\000000000000000000010\0\0@\0\0\000000010MVawerV riutlaI EDH ra drDvi e @\200\0\0\0/\0\0\0\2\0\0\7\0a\30\20\0?\0\360\375_\0@\1\0\0`\0\0\0\7\0\3\0x\0x\0\240\0x\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\36\0\27\0\10@\10@\0@\10@\0@\0@\7\4\0\0\0\0\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0", ) , ) == 0x0 00869 452 NtClose (92, ... ) == 0x0 00870 452 NtQueryInformationProcess (-1, DeviceMap, 36, ... {process info, class 23, size 36}, 0x0, ) == 0x0 00871 452 NtOpenFile (0x100001, {24, 0, 0x40, 0, 0, (0x100001, {24, 0, 0x40, 0, 0, "\??\C:\"}, 3, 16417, ... 92, {status=0x0, info=1}, ) }, 3, 16417, ... 92, {status=0x0, info=1}, ) == 0x0 00872 452 NtQueryInformationFile (92, 1243996, 528, Name, ... {status=0x0, info=6}, ) == 0x0 00873 452 NtQueryVolumeInformationFile (92, 1353096, 284, Volume, ... {status=0x0, info=18}, ) == 0x0 00874 452 NtQueryVolumeInformationFile (92, 1330816, 276, Attribute, ... {status=0x0, info=22}, ) == 0x0 00875 452 NtClose (92, ... ) == 0x0 00876 452 NtOpenFile (0x100001, {24, 0, 0x40, 0, 0, (0x100001, {24, 0, 0x40, 0, 0, "\??\C:\"}, 3, 8388641, ... 92, {status=0x0, info=1}, ) }, 3, 8388641, ... 92, {status=0x0, info=1}, ) == 0x0 00877 452 NtQueryVolumeInformationFile (92, 1244780, 24, Size, ... {status=0x0, info=24}, ) == 0x0 00878 452 NtClose (92, ... ) == 0x0 00879 452 NtQueryInformationProcess (-1, DeviceMap, 36, ... {process info, class 23, size 36}, 0x0, ) == 0x0 00880 452 NtOpenFile (0x100001, {24, 0, 0x40, 0, 0, (0x100001, {24, 0, 0x40, 0, 0, "\??\C:\"}, 3, 16417, ... 92, {status=0x0, info=1}, ) }, 3, 16417, ... 92, {status=0x0, info=1}, ) == 0x0 00881 452 NtQueryInformationFile (92, 1244000, 528, Name, ... {status=0x0, info=6}, ) == 0x0 00882 452 NtQueryVolumeInformationFile (92, 1353096, 284, Volume, ... {status=0x0, info=18}, ) == 0x0 00883 452 NtQueryVolumeInformationFile (92, 1330816, 276, Attribute, ... {status=0x0, info=22}, ) == 0x0 00884 452 NtClose (92, ... ) == 0x0 00885 452 NtOpenFile (0x100001, {24, 0, 0x40, 0, 0, (0x100001, {24, 0, 0x40, 0, 0, "\??\C:\"}, 3, 8388641, ... 92, {status=0x0, info=1}, ) }, 3, 8388641, ... 92, {status=0x0, info=1}, ) == 0x0 00886 452 NtQueryVolumeInformationFile (92, 1244784, 24, Size, ... {status=0x0, info=24}, ) == 0x0 00887 452 NtClose (92, ... ) == 0x0 00888 452 NtOpenThreadTokenEx (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN 00889 452 NtOpenProcessTokenEx (-1, 0x20008, 512, ... 92, ) == 0x0 00890 452 NtQueryInformationToken (92, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0 00891 452 NtClose (92, ... ) == 0x0 00892 452 NtOpenKey (0x2000000, {24, 0, 0x40, 0, 0, (0x2000000, {24, 0, 0x40, 0, 0, "\REGISTRY\USER\S-1-5-21-1078081533-484763869-839522115-1003_Classes"}, ... 92, ) }, ... 92, ) == 0x0 00893 452 NtSetInformationObject (94, Handle, {Inherit=0,ProtectFromClose=1,}, 1179904, ... ) == 0x0 00894 452 NtQueryKey (94, Name, 382, ... {Name= (94, Name, 382, ... {Name="\REGISTRY\USER\S-1-5-21-1078081533-484763869-839522115-1003_CLASSES9"}, 138, ) }, 138, ) == 0x0 00895 452 NtOpenKey (0x2000000, {24, 94, 0x40, 0, 0, (0x2000000, {24, 94, 0x40, 0, 0, ".key"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 00896 452 NtOpenKey (0x2000000, {24, 0, 0x40, 0, 0, (0x2000000, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Classes"}, ... 96, ) }, ... 96, ) == 0x0 00897 452 NtCreateKey (0x2, {24, 96, 0x40, 0, 0, (0x2, {24, 96, 0x40, 0, 0, ".key"}, 0, 0x0, 0, ... }, 0, 0x0, 0, ... 00898 452 NtSetInformationFile (-2147482808, -136150452, 8, EndOfFile, ... {status=0x0, info=0}, ) == 0x0 00899 452 NtSetInformationFile (-2147482808, -136150084, 8, EndOfFile, ... {status=0x0, info=0}, ) == 0x0 00900 452 NtSetInformationFile (-2147482808, -136150076, 8, EndOfFile, ... {status=0x0, info=0}, ) == 0x0 00897 452 NtCreateKey ... 100, 1, ) == 0x0 00901 452 NtClose (96, ... ) == 0x0 00902 452 NtQueryKey (102, Name, 392, ... {Name= (102, Name, 392, ... {Name="\REGISTRY\MACHINE\SOFTWARE\Classes\.keyo"}, 82, ) }, 82, ) == 0x0 00903 452 NtOpenThreadTokenEx (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN 00904 452 NtOpenProcessTokenEx (-1, 0x20008, 512, ... 96, ) == 0x0 00905 452 NtQueryInformationToken (96, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0 00906 452 NtClose (96, ... ) == 0x0 00907 452 NtOpenKey (0x2000000, {24, 0, 0x40, 0, 0, (0x2000000, {24, 0, 0x40, 0, 0, "\REGISTRY\USER\S-1-5-21-1078081533-484763869-839522115-1003_Classes\.key"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 00908 452 NtSetValueKey (102, 0x0, 0, 1, (102, 0x0, 0, 1, "\0\0", 2, ... ) , 2, ... ) == 0x0 00909 452 NtClose (102, ... ) == 0x0 00910 452 NtQueryKey (94, Name, 384, ... {Name= (94, Name, 384, ... {Name="\REGISTRY\USER\S-1-5-21-1078081533-484763869-839522115-1003_CLASSES9"}, 138, ) }, 138, ) == 0x0 00911 452 NtOpenKey (0x2, {24, 94, 0x40, 0, 0, (0x2, {24, 94, 0x40, 0, 0, ".key"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 00912 452 NtOpenKey (0x2, {24, 0, 0x40, 0, 0, (0x2, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Classes\.key"}, ... 100, ) }, ... 100, ) == 0x0 00913 452 NtQueryKey (102, Name, 392, ... {Name= (102, Name, 392, ... {Name="\REGISTRY\MACHINE\SOFTWARE\Classes\.keyo"}, 82, ) }, 82, ) == 0x0 00914 452 NtOpenThreadTokenEx (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN 00915 452 NtOpenProcessTokenEx (-1, 0x20008, 512, ... 96, ) == 0x0 00916 452 NtQueryInformationToken (96, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0 00917 452 NtClose (96, ... ) == 0x0 00918 452 NtOpenKey (0x2000000, {24, 0, 0x40, 0, 0, (0x2000000, {24, 0, 0x40, 0, 0, "\REGISTRY\USER\S-1-5-21-1078081533-484763869-839522115-1003_Classes\.key"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 00919 452 NtSetValueKey (102, " (102, "", 0, 1, "r\0e\0g\0f\0i\0l\0e\0\0\0", 16, ... ) r\0e\0g\0f\0i\0l\0e\0\0\0", 16, ... ) == 0x0 00920 452 NtClose (102, ... ) == 0x0 00921 452 NtContinue (1244264, 0, ... 00922 452 NtAllocateVirtualMemory (-1, 0, 0, 122368, 4096, 4, ... 11272192, 122880, ) == 0x0 00923 452 NtContinue (1244248, 0, ... 00924 452 NtAllocateVirtualMemory (-1, 0, 0, 147456, 4096, 4, ... 11403264, 147456, ) == 0x0 00925 452 NtContinue (1244248, 0, ... 00926 452 NtContinue (1244256, 0, ... 00927 452 NtContinue (1244244, 0, ... 00928 452 NtContinue (1244256, 0, ... 00929 452 NtContinue (1244264, 0, ... 00930 452 NtContinue (1244256, 0, ... 00931 452 NtContinue (1244256, 0, ... 00932 452 NtContinue (1244256, 0, ... 00933 452 NtContinue (1244256, 0, ... 00934 452 NtContinue (1244256, 0, ... 00935 452 NtContinue (1244256, 0, ... 00936 452 NtContinue (1244256, 0, ... 00937 452 NtFreeVirtualMemory (-1, (0xac0000), 122368, 16384, ... (0xac0000), 122880, ) == 0x0 00938 452 NtContinue (1244264, 0, ... 00939 452 NtContinue (1244264, 0, ... 00940 452 NtContinue (1244264, 0, ... 00941 452 NtContinue (1244264, 0, ... 00942 452 NtContinue (1244264, 0, ... 00943 452 NtContinue (1244264, 0, ... 00944 452 NtContinue (1244264, 0, ... 00945 452 NtContinue (1244264, 0, ... 00946 452 NtContinue (1244264, 0, ... 00947 452 NtContinue (1244264, 0, ... 00948 452 NtContinue (1244264, 0, ... 00949 452 NtContinue (1244264, 0, ... 00950 452 NtContinue (1244264, 0, ... 00951 452 NtContinue (1244264, 0, ... 00952 452 NtContinue (1244264, 0, ... 00953 452 NtContinue (1244264, 0, ... 00954 452 NtContinue (1244264, 0, ... 00955 452 NtContinue (1244264, 0, ... 00956 452 NtContinue (1244264, 0, ... 00957 452 NtContinue (1244264, 0, ... 00958 452 NtContinue (1244264, 0, ... 00959 452 NtContinue (1244264, 0, ... 00960 452 NtContinue (1244264, 0, ... 00961 452 NtContinue (1244264, 0, ... 00962 452 NtContinue (1244264, 0, ... 00963 452 NtContinue (1244264, 0, ... 00964 452 NtContinue (1244264, 0, ... 00965 452 NtContinue (1244264, 0, ... 00966 452 NtContinue (1244264, 0, ... 00967 452 NtContinue (1244264, 0, ... 00968 452 NtContinue (1244264, 0, ... 00969 452 NtContinue (1244264, 0, ... 00970 452 NtContinue (1244264, 0, ... 00971 452 NtContinue (1244264, 0, ... 00972 452 NtContinue (1244264, 0, ... 00973 452 NtContinue (1244264, 0, ... 00974 452 NtContinue (1244264, 0, ... 00975 452 NtContinue (1244264, 0, ... 00976 452 NtContinue (1244264, 0, ... 00977 452 NtContinue (1244264, 0, ... 00978 452 NtContinue (1244264, 0, ... 00979 452 NtContinue (1244264, 0, ... 00980 452 NtContinue (1244264, 0, ... 00981 452 NtContinue (1244264, 0, ... 00982 452 NtContinue (1244264, 0, ... 00983 452 NtContinue (1244264, 0, ... 00984 452 NtContinue (1244264, 0, ... 00985 452 NtContinue (1244264, 0, ... 00986 452 NtContinue (1244264, 0, ... 00987 452 NtContinue (1244264, 0, ... 00988 452 NtContinue (1244264, 0, ... 00989 452 NtContinue (1244264, 0, ... 00990 452 NtContinue (1244264, 0, ... 00991 452 NtContinue (1244264, 0, ... 00992 452 NtContinue (1244264, 0, ... 00993 452 NtContinue (1244264, 0, ... 00994 452 NtContinue (1244264, 0, ... 00995 452 NtContinue (1244264, 0, ... 00996 452 NtContinue (1244264, 0, ... 00997 452 NtContinue (1244264, 0, ... 00998 452 NtContinue (1244264, 0, ... 00999 452 NtContinue (1244264, 0, ... 01000 452 NtContinue (1244264, 0, ... 01001 452 NtContinue (1244264, 0, ... 01002 452 NtContinue (1244264, 0, ... 01003 452 NtContinue (1244264, 0, ... 01004 452 NtContinue (1244264, 0, ... 01005 452 NtContinue (1244264, 0, ... 01006 452 NtContinue (1244264, 0, ... 01007 452 NtContinue (1244264, 0, ... 01008 452 NtContinue (1244264, 0, ... 01009 452 NtContinue (1244264, 0, ... 01010 452 NtContinue (1244264, 0, ... 01011 452 NtContinue (1244264, 0, ... 01012 452 NtContinue (1244264, 0, ... 01013 452 NtContinue (1244264, 0, ... 01014 452 NtContinue (1244264, 0, ... 01015 452 NtContinue (1244264, 0, ... 01016 452 NtContinue (1244264, 0, ... 01017 452 NtContinue (1244264, 0, ... 01018 452 NtContinue (1244264, 0, ... 01019 452 NtContinue (1244264, 0, ... 01020 452 NtContinue (1244264, 0, ... 01021 452 NtContinue (1244264, 0, ... 01022 452 NtContinue (1244264, 0, ... 01023 452 NtContinue (1244264, 0, ... 01024 452 NtContinue (1244264, 0, ... 01025 452 NtContinue (1244264, 0, ... 01026 452 NtContinue (1244264, 0, ... 01027 452 NtContinue (1244264, 0, ... 01028 452 NtContinue (1244264, 0, ... 01029 452 NtContinue (1244264, 0, ... 01030 452 NtContinue (1244264, 0, ... 01031 452 NtContinue (1244264, 0, ... 01032 452 NtContinue (1244264, 0, ... 01033 452 NtContinue (1244264, 0, ... 01034 452 NtContinue (1244264, 0, ... 01035 452 NtContinue (1244264, 0, ... 01036 452 NtContinue (1244264, 0, ... 01037 452 NtContinue (1244264, 0, ... 01038 452 NtContinue (1244264, 0, ... 01039 452 NtContinue (1244264, 0, ... 01040 452 NtContinue (1244264, 0, ... 01041 452 NtContinue (1244264, 0, ... 01042 452 NtContinue (1244264, 0, ... 01043 452 NtContinue (1244264, 0, ... 01044 452 NtContinue (1244264, 0, ... 01045 452 NtContinue (1244264, 0, ... 01046 452 NtContinue (1244264, 0, ... 01047 452 NtContinue (1244264, 0, ... 01048 452 NtContinue (1244264, 0, ... 01049 452 NtContinue (1244264, 0, ... 01050 452 NtContinue (1244264, 0, ... 01051 452 NtContinue (1244264, 0, ... 01052 452 NtContinue (1244264, 0, ... 01053 452 NtContinue (1244264, 0, ... 01054 452 NtContinue (1244264, 0, ... 01055 452 NtContinue (1244264, 0, ... 01056 452 NtContinue (1244264, 0, ... 01057 452 NtContinue (1244264, 0, ... 01058 452 NtContinue (1244264, 0, ... 01059 452 NtContinue (1244264, 0, ... 01060 452 NtContinue (1244264, 0, ... 01061 452 NtContinue (1244264, 0, ... 01062 452 NtContinue (1244264, 0, ... 01063 452 NtContinue (1244264, 0, ... 01064 452 NtContinue (1244264, 0, ... 01065 452 NtContinue (1244264, 0, ... 01066 452 NtContinue (1244264, 0, ... 01067 452 NtContinue (1244264, 0, ... 01068 452 NtContinue (1244264, 0, ... 01069 452 NtContinue (1244264, 0, ... 01070 452 NtContinue (1244264, 0, ... 01071 452 NtContinue (1244264, 0, ... 01072 452 NtContinue (1244264, 0, ... 01073 452 NtContinue (1244264, 0, ... 01074 452 NtContinue (1244264, 0, ... 01075 452 NtContinue (1244264, 0, ... 01076 452 NtContinue (1244264, 0, ... 01077 452 NtContinue (1244264, 0, ... 01078 452 NtContinue (1244264, 0, ... 01079 452 NtContinue (1244264, 0, ... 01080 452 NtContinue (1244264, 0, ... 01081 452 NtContinue (1244264, 0, ... 01082 452 NtContinue (1244264, 0, ... 01083 452 NtContinue (1244264, 0, ... 01084 452 NtContinue (1244264, 0, ... 01085 452 NtContinue (1244264, 0, ... 01086 452 NtContinue (1244264, 0, ... 01087 452 NtContinue (1244264, 0, ... 01088 452 NtContinue (1244264, 0, ... 01089 452 NtContinue (1244264, 0, ... 01090 452 NtContinue (1244264, 0, ... 01091 452 NtContinue (1244264, 0, ... 01092 452 NtContinue (1244264, 0, ... 01093 452 NtContinue (1244264, 0, ... 01094 452 NtContinue (1244264, 0, ... 01095 452 NtContinue (1244264, 0, ... 01096 452 NtContinue (1244264, 0, ... 01097 452 NtContinue (1244264, 0, ... 01098 452 NtContinue (1244264, 0, ... 01099 452 NtContinue (1244264, 0, ... 01100 452 NtContinue (1244264, 0, ... 01101 452 NtContinue (1244264, 0, ... 01102 452 NtContinue (1244264, 0, ... 01103 452 NtContinue (1244264, 0, ... 01104 452 NtContinue (1244264, 0, ... 01105 452 NtContinue (1244264, 0, ... 01106 452 NtContinue (1244264, 0, ... 01107 452 NtContinue (1244264, 0, ... 01108 452 NtContinue (1244264, 0, ... 01109 452 NtContinue (1244264, 0, ... 01110 452 NtContinue (1244264, 0, ... 01111 452 NtContinue (1244264, 0, ... 01112 452 NtContinue (1244264, 0, ... 01113 452 NtContinue (1244264, 0, ... 01114 452 NtContinue (1244264, 0, ... 01115 452 NtContinue (1244264, 0, ... 01116 452 NtContinue (1244264, 0, ... 01117 452 NtContinue (1244264, 0, ... 01118 452 NtContinue (1244264, 0, ... 01119 452 NtContinue (1244264, 0, ... 01120 452 NtContinue (1244264, 0, ... 01121 452 NtContinue (1244264, 0, ... 01122 452 NtContinue (1244264, 0, ... 01123 452 NtContinue (1244264, 0, ... 01124 452 NtContinue (1244264, 0, ... 01125 452 NtContinue (1244264, 0, ... 01126 452 NtContinue (1244264, 0, ... 01127 452 NtContinue (1244264, 0, ... 01128 452 NtContinue (1244264, 0, ... 01129 452 NtContinue (1244264, 0, ... 01130 452 NtContinue (1244264, 0, ... 01131 452 NtContinue (1244264, 0, ... 01132 452 NtContinue (1244264, 0, ... 01133 452 NtContinue (1244264, 0, ... 01134 452 NtContinue (1244264, 0, ... 01135 452 NtContinue (1244264, 0, ... 01136 452 NtContinue (1244264, 0, ... 01137 452 NtContinue (1244264, 0, ... 01138 452 NtContinue (1244264, 0, ... 01139 452 NtContinue (1244264, 0, ... 01140 452 NtContinue (1244264, 0, ... 01141 452 NtContinue (1244264, 0, ... 01142 452 NtContinue (1244264, 0, ... 01143 452 NtContinue (1244264, 0, ... 01144 452 NtContinue (1244264, 0, ... 01145 452 NtContinue (1244264, 0, ... 01146 452 NtContinue (1244264, 0, ... 01147 452 NtContinue (1244264, 0, ... 01148 452 NtContinue (1244264, 0, ... 01149 452 NtContinue (1244264, 0, ... 01150 452 NtContinue (1244264, 0, ... 01151 452 NtContinue (1244264, 0, ... 01152 452 NtContinue (1244264, 0, ... 01153 452 NtContinue (1244264, 0, ... 01154 452 NtContinue (1244264, 0, ... 01155 452 NtContinue (1244264, 0, ... 01156 452 NtContinue (1244264, 0, ... 01157 452 NtContinue (1244264, 0, ... 01158 452 NtContinue (1244264, 0, ... 01159 452 NtContinue (1244264, 0, ... 01160 452 NtContinue (1244264, 0, ... 01161 452 NtContinue (1244264, 0, ... 01162 452 NtContinue (1244264, 0, ... 01163 452 NtContinue (1244264, 0, ... 01164 452 NtContinue (1244264, 0, ... 01165 452 NtContinue (1244264, 0, ... 01166 452 NtContinue (1244264, 0, ... 01167 452 NtContinue (1244264, 0, ... 01168 452 NtContinue (1244264, 0, ... 01169 452 NtContinue (1244264, 0, ... 01170 452 NtContinue (1244264, 0, ... 01171 452 NtContinue (1244264, 0, ... 01172 452 NtContinue (1244264, 0, ... 01173 452 NtContinue (1244264, 0, ... 01174 452 NtContinue (1244264, 0, ... 01175 452 NtContinue (1244264, 0, ... 01176 452 NtContinue (1244264, 0, ... 01177 452 NtContinue (1244264, 0, ... 01178 452 NtContinue (1244264, 0, ... 01179 452 NtContinue (1244264, 0, ... 01180 452 NtContinue (1244264, 0, ... 01181 452 NtContinue (1244264, 0, ... 01182 452 NtContinue (1244264, 0, ... 01183 452 NtContinue (1244264, 0, ... 01184 452 NtContinue (1244264, 0, ... 01185 452 NtContinue (1244264, 0, ... 01186 452 NtContinue (1244264, 0, ... 01187 452 NtContinue (1244264, 0, ... 01188 452 NtContinue (1244264, 0, ... 01189 452 NtContinue (1244264, 0, ... 01190 452 NtContinue (1244264, 0, ... 01191 452 NtContinue (1244264, 0, ... 01192 452 NtContinue (1244264, 0, ... 01193 452 NtContinue (1244264, 0, ... 01194 452 NtContinue (1244264, 0, ... 01195 452 NtContinue (1244264, 0, ... 01196 452 NtContinue (1244264, 0, ... 01197 452 NtContinue (1244264, 0, ... 01198 452 NtContinue (1244264, 0, ... 01199 452 NtContinue (1244264, 0, ... 01200 452 NtContinue (1244264, 0, ... 01201 452 NtContinue (1244264, 0, ... 01202 452 NtContinue (1244264, 0, ... 01203 452 NtContinue (1244264, 0, ... 01204 452 NtContinue (1244264, 0, ... 01205 452 NtContinue (1244264, 0, ... 01206 452 NtContinue (1244264, 0, ... 01207 452 NtContinue (1244264, 0, ... 01208 452 NtContinue (1244264, 0, ... 01209 452 NtContinue (1244264, 0, ... 01210 452 NtContinue (1244264, 0, ... 01211 452 NtContinue (1244264, 0, ... 01212 452 NtContinue (1244264, 0, ... 01213 452 NtContinue (1244264, 0, ... 01214 452 NtContinue (1244264, 0, ... 01215 452 NtContinue (1244264, 0, ... 01216 452 NtContinue (1244264, 0, ... 01217 452 NtContinue (1244264, 0, ... 01218 452 NtContinue (1244264, 0, ... 01219 452 NtContinue (1244264, 0, ... 01220 452 NtContinue (1244264, 0, ... 01221 452 NtContinue (1244264, 0, ... 01222 452 NtContinue (1244264, 0, ... 01223 452 NtContinue (1244264, 0, ... 01224 452 NtContinue (1244264, 0, ... 01225 452 NtContinue (1244264, 0, ... 01226 452 NtContinue (1244264, 0, ... 01227 452 NtContinue (1244264, 0, ... 01228 452 NtContinue (1244264, 0, ... 01229 452 NtContinue (1244264, 0, ... 01230 452 NtContinue (1244264, 0, ... 01231 452 NtContinue (1244264, 0, ... 01232 452 NtContinue (1244264, 0, ... 01233 452 NtContinue (1244264, 0, ... 01234 452 NtContinue (1244264, 0, ... 01235 452 NtContinue (1244264, 0, ... 01236 452 NtContinue (1244264, 0, ... 01237 452 NtContinue (1244264, 0, ... 01238 452 NtContinue (1244264, 0, ... 01239 452 NtContinue (1244264, 0, ... 01240 452 NtContinue (1244264, 0, ... 01241 452 NtContinue (1244264, 0, ... 01242 452 NtContinue (1244264, 0, ... 01243 452 NtContinue (1244264, 0, ... 01244 452 NtContinue (1244264, 0, ... 01245 452 NtContinue (1244264, 0, ... 01246 452 NtContinue (1244264, 0, ... 01247 452 NtContinue (1244264, 0, ... 01248 452 NtContinue (1244264, 0, ... 01249 452 NtContinue (1244264, 0, ... 01250 452 NtContinue (1244264, 0, ... 01251 452 NtContinue (1244264, 0, ... 01252 452 NtContinue (1244264, 0, ... 01253 452 NtContinue (1244264, 0, ... 01254 452 NtContinue (1244264, 0, ... 01255 452 NtContinue (1244264, 0, ... 01256 452 NtContinue (1244264, 0, ... 01257 452 NtContinue (1244264, 0, ... 01258 452 NtContinue (1244264, 0, ... 01259 452 NtContinue (1244264, 0, ... 01260 452 NtContinue (1244264, 0, ... 01261 452 NtContinue (1244264, 0, ... 01262 452 NtContinue (1244264, 0, ... 01263 452 NtContinue (1244264, 0, ... 01264 452 NtContinue (1244264, 0, ... 01265 452 NtContinue (1244264, 0, ... 01266 452 NtContinue (1244264, 0, ... 01267 452 NtContinue (1244264, 0, ... 01268 452 NtContinue (1244264, 0, ... 01269 452 NtContinue (1244264, 0, ... 01270 452 NtContinue (1244264, 0, ... 01271 452 NtContinue (1244264, 0, ... 01272 452 NtContinue (1244264, 0, ... 01273 452 NtContinue (1244264, 0, ... 01274 452 NtContinue (1244264, 0, ... 01275 452 NtContinue (1244264, 0, ... 01276 452 NtContinue (1244264, 0, ... 01277 452 NtContinue (1244264, 0, ... 01278 452 NtContinue (1244264, 0, ... 01279 452 NtContinue (1244264, 0, ... 01280 452 NtContinue (1244264, 0, ... 01281 452 NtContinue (1244264, 0, ... 01282 452 NtContinue (1244264, 0, ... 01283 452 NtContinue (1244264, 0, ... 01284 452 NtContinue (1244264, 0, ... 01285 452 NtContinue (1244264, 0, ... 01286 452 NtContinue (1244264, 0, ... 01287 452 NtContinue (1244264, 0, ... 01288 452 NtContinue (1244264, 0, ... 01289 452 NtContinue (1244264, 0, ... 01290 452 NtContinue (1244264, 0, ... 01291 452 NtContinue (1244264, 0, ... 01292 452 NtContinue (1244264, 0, ... 01293 452 NtContinue (1244264, 0, ... 01294 452 NtContinue (1244264, 0, ... 01295 452 NtContinue (1244264, 0, ... 01296 452 NtContinue (1244264, 0, ... 01297 452 NtContinue (1244264, 0, ... 01298 452 NtContinue (1244264, 0, ... 01299 452 NtContinue (1244264, 0, ... 01300 452 NtContinue (1244264, 0, ... 01301 452 NtContinue (1244264, 0, ... 01302 452 NtContinue (1244264, 0, ... 01303 452 NtContinue (1244264, 0, ... 01304 452 NtContinue (1244264, 0, ... 01305 452 NtContinue (1244264, 0, ... 01306 452 NtContinue (1244264, 0, ... 01307 452 NtContinue (1244264, 0, ... 01308 452 NtContinue (1244264, 0, ... 01309 452 NtContinue (1244264, 0, ... 01310 452 NtContinue (1244264, 0, ... 01311 452 NtContinue (1244264, 0, ... 01312 452 NtContinue (1244264, 0, ... 01313 452 NtContinue (1244264, 0, ... 01314 452 NtContinue (1244264, 0, ... 01315 452 NtContinue (1244264, 0, ... 01316 452 NtContinue (1244264, 0, ... 01317 452 NtContinue (1244264, 0, ... 01318 452 NtContinue (1244264, 0, ... 01319 452 NtContinue (1244264, 0, ... 01320 452 NtContinue (1244264, 0, ... 01321 452 NtContinue (1244264, 0, ... 01322 452 NtContinue (1244264, 0, ... 01323 452 NtContinue (1244264, 0, ... 01324 452 NtContinue (1244264, 0, ... 01325 452 NtContinue (1244264, 0, ... 01326 452 NtContinue (1244264, 0, ... 01327 452 NtContinue (1244264, 0, ... 01328 452 NtContinue (1244264, 0, ... 01329 452 NtContinue (1244264, 0, ... 01330 452 NtContinue (1244264, 0, ... 01331 452 NtContinue (1244264, 0, ... 01332 452 NtContinue (1244264, 0, ... 01333 452 NtContinue (1244264, 0, ... 01334 452 NtContinue (1244264, 0, ... 01335 452 NtContinue (1244264, 0, ... 01336 452 NtContinue (1244264, 0, ... 01337 452 NtContinue (1244264, 0, ... 01338 452 NtContinue (1244264, 0, ... 01339 452 NtContinue (1244264, 0, ... 01340 452 NtContinue (1244264, 0, ... 01341 452 NtContinue (1244264, 0, ... 01342 452 NtContinue (1244264, 0, ... 01343 452 NtContinue (1244264, 0, ... 01344 452 NtContinue (1244264, 0, ... 01345 452 NtContinue (1244264, 0, ... 01346 452 NtContinue (1244264, 0, ... 01347 452 NtContinue (1244264, 0, ... 01348 452 NtContinue (1244264, 0, ... 01349 452 NtContinue (1244264, 0, ... 01350 452 NtContinue (1244264, 0, ... 01351 452 NtContinue (1244264, 0, ... 01352 452 NtContinue (1244264, 0, ... 01353 452 NtContinue (1244264, 0, ... 01354 452 NtContinue (1244264, 0, ... 01355 452 NtContinue (1244264, 0, ... 01356 452 NtContinue (1244264, 0, ... 01357 452 NtContinue (1244264, 0, ... 01358 452 NtContinue (1244264, 0, ... 01359 452 NtContinue (1244264, 0, ... 01360 452 NtContinue (1244264, 0, ... 01361 452 NtContinue (1244264, 0, ... 01362 452 NtContinue (1244264, 0, ... 01363 452 NtContinue (1244264, 0, ... 01364 452 NtContinue (1244264, 0, ... 01365 452 NtContinue (1244264, 0, ... 01366 452 NtContinue (1244264, 0, ... 01367 452 NtContinue (1244264, 0, ... 01368 452 NtContinue (1244264, 0, ... 01369 452 NtContinue (1244264, 0, ... 01370 452 NtContinue (1244264, 0, ... 01371 452 NtContinue (1244264, 0, ... 01372 452 NtContinue (1244264, 0, ... 01373 452 NtContinue (1244264, 0, ... 01374 452 NtContinue (1244264, 0, ... 01375 452 NtContinue (1244264, 0, ... 01376 452 NtContinue (1244264, 0, ... 01377 452 NtContinue (1244264, 0, ... 01378 452 NtContinue (1244264, 0, ... 01379 452 NtContinue (1244264, 0, ... 01380 452 NtContinue (1244264, 0, ... 01381 452 NtContinue (1244264, 0, ... 01382 452 NtContinue (1244264, 0, ... 01383 452 NtContinue (1244264, 0, ... 01384 452 NtContinue (1244264, 0, ... 01385 452 NtContinue (1244264, 0, ... 01386 452 NtContinue (1244264, 0, ... 01387 452 NtContinue (1244264, 0, ... 01388 452 NtContinue (1244264, 0, ... 01389 452 NtContinue (1244264, 0, ... 01390 452 NtContinue (1244264, 0, ... 01391 452 NtContinue (1244264, 0, ... 01392 452 NtContinue (1244264, 0, ... 01393 452 NtContinue (1244264, 0, ... 01394 452 NtContinue (1244264, 0, ... 01395 452 NtContinue (1244264, 0, ... 01396 452 NtContinue (1244264, 0, ... 01397 452 NtContinue (1244264, 0, ... 01398 452 NtContinue (1244264, 0, ... 01399 452 NtContinue (1244264, 0, ... 01400 452 NtContinue (1244264, 0, ... 01401 452 NtContinue (1244264, 0, ... 01402 452 NtContinue (1244264, 0, ... 01403 452 NtContinue (1244264, 0, ... 01404 452 NtContinue (1244264, 0, ... 01405 452 NtContinue (1244264, 0, ... 01406 452 NtContinue (1244264, 0, ... 01407 452 NtContinue (1244264, 0, ... 01408 452 NtContinue (1244264, 0, ... 01409 452 NtContinue (1244264, 0, ... 01410 452 NtContinue (1244264, 0, ... 01411 452 NtContinue (1244264, 0, ... 01412 452 NtContinue (1244264, 0, ... 01413 452 NtContinue (1244264, 0, ... 01414 452 NtContinue (1244264, 0, ... 01415 452 NtContinue (1244264, 0, ... 01416 452 NtContinue (1244264, 0, ... 01417 452 NtContinue (1244264, 0, ... 01418 452 NtContinue (1244264, 0, ... 01419 452 NtContinue (1244264, 0, ... 01420 452 NtContinue (1244264, 0, ... 01421 452 NtContinue (1244264, 0, ... 01422 452 NtContinue (1244264, 0, ... 01423 452 NtContinue (1244264, 0, ... 01424 452 NtContinue (1244264, 0, ... 01425 452 NtContinue (1244264, 0, ... 01426 452 NtContinue (1244264, 0, ... 01427 452 NtContinue (1244264, 0, ... 01428 452 NtContinue (1244264, 0, ... 01429 452 NtContinue (1244264, 0, ... 01430 452 NtContinue (1244264, 0, ... 01431 452 NtContinue (1244264, 0, ... 01432 452 NtContinue (1244264, 0, ... 01433 452 NtContinue (1244264, 0, ... 01434 452 NtContinue (1244264, 0, ... 01435 452 NtContinue (1244264, 0, ... 01436 452 NtContinue (1244264, 0, ... 01437 452 NtContinue (1244264, 0, ... 01438 452 NtContinue (1244264, 0, ... 01439 452 NtContinue (1244264, 0, ... 01440 452 NtContinue (1244264, 0, ... 01441 452 NtContinue (1244264, 0, ... 01442 452 NtContinue (1244264, 0, ... 01443 452 NtContinue (1244264, 0, ... 01444 452 NtContinue (1244264, 0, ... 01445 452 NtContinue (1244264, 0, ... 01446 452 NtContinue (1244264, 0, ... 01447 452 NtContinue (1244264, 0, ... 01448 452 NtContinue (1244264, 0, ... 01449 452 NtContinue (1244264, 0, ... 01450 452 NtContinue (1244264, 0, ... 01451 452 NtContinue (1244264, 0, ... 01452 452 NtContinue (1244264, 0, ... 01453 452 NtContinue (1244264, 0, ... 01454 452 NtContinue (1244264, 0, ... 01455 452 NtContinue (1244264, 0, ... 01456 452 NtContinue (1244264, 0, ... 01457 452 NtContinue (1244264, 0, ... 01458 452 NtContinue (1244264, 0, ... 01459 452 NtContinue (1244264, 0, ... 01460 452 NtContinue (1244264, 0, ... 01461 452 NtContinue (1244264, 0, ... 01462 452 NtContinue (1244264, 0, ... 01463 452 NtContinue (1244264, 0, ... 01464 452 NtContinue (1244264, 0, ... 01465 452 NtContinue (1244264, 0, ... 01466 452 NtContinue (1244264, 0, ... 01467 452 NtContinue (1244264, 0, ... 01468 452 NtContinue (1244264, 0, ... 01469 452 NtContinue (1244264, 0, ... 01470 452 NtContinue (1244264, 0, ... 01471 452 NtContinue (1244264, 0, ... 01472 452 NtContinue (1244264, 0, ... 01473 452 NtContinue (1244264, 0, ... 01474 452 NtContinue (1244264, 0, ... 01475 452 NtContinue (1244264, 0, ... 01476 452 NtContinue (1244264, 0, ... 01477 452 NtContinue (1244264, 0, ... 01478 452 NtContinue (1244264, 0, ... 01479 452 NtContinue (1244264, 0, ... 01480 452 NtContinue (1244264, 0, ... 01481 452 NtContinue (1244264, 0, ... 01482 452 NtContinue (1244264, 0, ... 01483 452 NtContinue (1244264, 0, ... 01484 452 NtContinue (1244264, 0, ... 01485 452 NtContinue (1244264, 0, ... 01486 452 NtContinue (1244264, 0, ... 01487 452 NtContinue (1244264, 0, ... 01488 452 NtContinue (1244264, 0, ... 01489 452 NtContinue (1244264, 0, ... 01490 452 NtContinue (1244264, 0, ... 01491 452 NtContinue (1244264, 0, ... 01492 452 NtContinue (1244264, 0, ... 01493 452 NtContinue (1244264, 0, ... 01494 452 NtContinue (1244264, 0, ... 01495 452 NtContinue (1244264, 0, ... 01496 452 NtContinue (1244264, 0, ... 01497 452 NtContinue (1244264, 0, ... 01498 452 NtContinue (1244264, 0, ... 01499 452 NtContinue (1244264, 0, ... 01500 452 NtContinue (1244264, 0, ... 01501 452 NtContinue (1244264, 0, ... 01502 452 NtContinue (1244264, 0, ... 01503 452 NtContinue (1244264, 0, ... 01504 452 NtContinue (1244264, 0, ... 01505 452 NtContinue (1244264, 0, ... 01506 452 NtContinue (1244264, 0, ... 01507 452 NtContinue (1244264, 0, ... 01508 452 NtContinue (1244264, 0, ... 01509 452 NtContinue (1244264, 0, ... 01510 452 NtContinue (1244264, 0, ... 01511 452 NtContinue (1244264, 0, ... 01512 452 NtContinue (1244264, 0, ... 01513 452 NtContinue (1244264, 0, ... 01514 452 NtContinue (1244264, 0, ... 01515 452 NtContinue (1244264, 0, ... 01516 452 NtContinue (1244264, 0, ... 01517 452 NtContinue (1244264, 0, ... 01518 452 NtContinue (1244264, 0, ... 01519 452 NtContinue (1244264, 0, ... 01520 452 NtContinue (1244264, 0, ... 01521 452 NtContinue (1244264, 0, ... 01522 452 NtContinue (1244264, 0, ... 01523 452 NtContinue (1244264, 0, ... 01524 452 NtContinue (1244264, 0, ... 01525 452 NtContinue (1244264, 0, ... 01526 452 NtContinue (1244264, 0, ... 01527 452 NtContinue (1244264, 0, ... 01528 452 NtContinue (1244264, 0, ... 01529 452 NtContinue (1244264, 0, ... 01530 452 NtContinue (1244264, 0, ... 01531 452 NtContinue (1244264, 0, ... 01532 452 NtContinue (1244264, 0, ... 01533 452 NtContinue (1244264, 0, ... 01534 452 NtContinue (1244264, 0, ... 01535 452 NtContinue (1244264, 0, ... 01536 452 NtContinue (1244264, 0, ... 01537 452 NtContinue (1244264, 0, ... 01538 452 NtContinue (1244264, 0, ... 01539 452 NtContinue (1244264, 0, ... 01540 452 NtContinue (1244264, 0, ... 01541 452 NtContinue (1244264, 0, ... 01542 452 NtContinue (1244264, 0, ... 01543 452 NtContinue (1244264, 0, ... 01544 452 NtContinue (1244264, 0, ... 01545 452 NtContinue (1244264, 0, ... 01546 452 NtContinue (1244264, 0, ... 01547 452 NtContinue (1244264, 0, ... 01548 452 NtContinue (1244264, 0, ... 01549 452 NtContinue (1244264, 0, ... 01550 452 NtContinue (1244264, 0, ... 01551 452 NtContinue (1244264, 0, ... 01552 452 NtContinue (1244264, 0, ... 01553 452 NtContinue (1244264, 0, ... 01554 452 NtContinue (1244264, 0, ... 01555 452 NtContinue (1244264, 0, ... 01556 452 NtContinue (1244264, 0, ... 01557 452 NtContinue (1244264, 0, ... 01558 452 NtContinue (1244264, 0, ... 01559 452 NtContinue (1244264, 0, ... 01560 452 NtContinue (1244264, 0, ... 01561 452 NtContinue (1244264, 0, ... 01562 452 NtContinue (1244264, 0, ... 01563 452 NtContinue (1244264, 0, ... 01564 452 NtContinue (1244264, 0, ... 01565 452 NtContinue (1244264, 0, ... 01566 452 NtContinue (1244264, 0, ... 01567 452 NtContinue (1244264, 0, ... 01568 452 NtContinue (1244264, 0, ... 01569 452 NtContinue (1244264, 0, ... 01570 452 NtContinue (1244264, 0, ... 01571 452 NtContinue (1244264, 0, ... 01572 452 NtContinue (1244264, 0, ... 01573 452 NtContinue (1244264, 0, ... 01574 452 NtContinue (1244264, 0, ... 01575 452 NtContinue (1244264, 0, ... 01576 452 NtContinue (1244264, 0, ... 01577 452 NtContinue (1244264, 0, ... 01578 452 NtContinue (1244264, 0, ... 01579 452 NtContinue (1244264, 0, ... 01580 452 NtContinue (1244264, 0, ... 01581 452 NtContinue (1244264, 0, ... 01582 452 NtContinue (1244264, 0, ... 01583 452 NtContinue (1244264, 0, ... 01584 452 NtContinue (1244264, 0, ... 01585 452 NtContinue (1244264, 0, ... 01586 452 NtContinue (1244264, 0, ... 01587 452 NtContinue (1244264, 0, ... 01588 452 NtContinue (1244264, 0, ... 01589 452 NtContinue (1244264, 0, ... 01590 452 NtContinue (1244264, 0, ... 01591 452 NtContinue (1244264, 0, ... 01592 452 NtContinue (1244264, 0, ... 01593 452 NtContinue (1244264, 0, ... 01594 452 NtContinue (1244264, 0, ... 01595 452 NtContinue (1244264, 0, ... 01596 452 NtContinue (1244264, 0, ... 01597 452 NtContinue (1244264, 0, ... 01598 452 NtContinue (1244264, 0, ... 01599 452 NtContinue (1244264, 0, ... 01600 452 NtContinue (1244264, 0, ... 01601 452 NtContinue (1244264, 0, ... 01602 452 NtContinue (1244264, 0, ... 01603 452 NtContinue (1244264, 0, ... 01604 452 NtContinue (1244264, 0, ... 01605 452 NtContinue (1244264, 0, ... 01606 452 NtContinue (1244264, 0, ... 01607 452 NtContinue (1244264, 0, ... 01608 452 NtContinue (1244264, 0, ... 01609 452 NtContinue (1244264, 0, ... 01610 452 NtContinue (1244264, 0, ... 01611 452 NtContinue (1244264, 0, ... 01612 452 NtContinue (1244264, 0, ... 01613 452 NtContinue (1244264, 0, ... 01614 452 NtContinue (1244264, 0, ... 01615 452 NtContinue (1244264, 0, ... 01616 452 NtContinue (1244264, 0, ... 01617 452 NtContinue (1244264, 0, ... 01618 452 NtContinue (1244264, 0, ... 01619 452 NtContinue (1244264, 0, ... 01620 452 NtContinue (1244264, 0, ... 01621 452 NtContinue (1244264, 0, ... 01622 452 NtContinue (1244264, 0, ... 01623 452 NtContinue (1244264, 0, ... 01624 452 NtContinue (1244264, 0, ... 01625 452 NtContinue (1244264, 0, ... 01626 452 NtContinue (1244264, 0, ... 01627 452 NtContinue (1244264, 0, ... 01628 452 NtContinue (1244264, 0, ... 01629 452 NtContinue (1244264, 0, ... 01630 452 NtContinue (1244264, 0, ... 01631 452 NtContinue (1244264, 0, ... 01632 452 NtContinue (1244264, 0, ... 01633 452 NtContinue (1244264, 0, ... 01634 452 NtContinue (1244264, 0, ... 01635 452 NtContinue (1244264, 0, ... 01636 452 NtContinue (1244264, 0, ... 01637 452 NtContinue (1244264, 0, ... 01638 452 NtContinue (1244264, 0, ... 01639 452 NtContinue (1244264, 0, ... 01640 452 NtContinue (1244264, 0, ... 01641 452 NtContinue (1244264, 0, ... 01642 452 NtContinue (1244264, 0, ... 01643 452 NtContinue (1244264, 0, ... 01644 452 NtContinue (1244264, 0, ... 01645 452 NtContinue (1244264, 0, ... 01646 452 NtContinue (1244264, 0, ... 01647 452 NtContinue (1244264, 0, ... 01648 452 NtContinue (1244264, 0, ... 01649 452 NtContinue (1244264, 0, ... 01650 452 NtContinue (1244264, 0, ... 01651 452 NtContinue (1244264, 0, ... 01652 452 NtContinue (1244264, 0, ... 01653 452 NtContinue (1244264, 0, ... 01654 452 NtContinue (1244264, 0, ... 01655 452 NtContinue (1244264, 0, ... 01656 452 NtContinue (1244264, 0, ... 01657 452 NtContinue (1244264, 0, ... 01658 452 NtContinue (1244264, 0, ... 01659 452 NtContinue (1244264, 0, ... 01660 452 NtContinue (1244264, 0, ... 01661 452 NtContinue (1244264, 0, ... 01662 452 NtContinue (1244264, 0, ... 01663 452 NtContinue (1244264, 0, ... 01664 452 NtContinue (1244264, 0, ... 01665 452 NtContinue (1244264, 0, ... 01666 452 NtContinue (1244264, 0, ... 01667 452 NtContinue (1244264, 0, ... 01668 452 NtContinue (1244264, 0, ... 01669 452 NtContinue (1244264, 0, ... 01670 452 NtContinue (1244264, 0, ... 01671 452 NtContinue (1244264, 0, ... 01672 452 NtContinue (1244264, 0, ... 01673 452 NtContinue (1244264, 0, ... 01674 452 NtContinue (1244264, 0, ... 01675 452 NtContinue (1244264, 0, ... 01676 452 NtContinue (1244264, 0, ... 01677 452 NtContinue (1244264, 0, ... 01678 452 NtContinue (1244264, 0, ... 01679 452 NtContinue (1244264, 0, ... 01680 452 NtContinue (1244264, 0, ... 01681 452 NtContinue (1244264, 0, ... 01682 452 NtContinue (1244264, 0, ... 01683 452 NtContinue (1244264, 0, ... 01684 452 NtContinue (1244264, 0, ... 01685 452 NtContinue (1244264, 0, ... 01686 452 NtContinue (1244264, 0, ... 01687 452 NtContinue (1244264, 0, ... 01688 452 NtContinue (1244264, 0, ... 01689 452 NtContinue (1244264, 0, ... 01690 452 NtContinue (1244264, 0, ... 01691 452 NtContinue (1244264, 0, ... 01692 452 NtContinue (1244264, 0, ... 01693 452 NtContinue (1244264, 0, ... 01694 452 NtContinue (1244264, 0, ... 01695 452 NtContinue (1244264, 0, ... 01696 452 NtContinue (1244264, 0, ... 01697 452 NtContinue (1244264, 0, ... 01698 452 NtContinue (1244264, 0, ... 01699 452 NtContinue (1244264, 0, ... 01700 452 NtContinue (1244264, 0, ... 01701 452 NtContinue (1244264, 0, ... 01702 452 NtContinue (1244264, 0, ... 01703 452 NtContinue (1244264, 0, ... 01704 452 NtContinue (1244264, 0, ... 01705 452 NtContinue (1244264, 0, ... 01706 452 NtContinue (1244264, 0, ... 01707 452 NtContinue (1244264, 0, ... 01708 452 NtContinue (1244264, 0, ... 01709 452 NtContinue (1244264, 0, ... 01710 452 NtContinue (1244264, 0, ... 01711 452 NtContinue (1244264, 0, ... 01712 452 NtContinue (1244264, 0, ... 01713 452 NtContinue (1244264, 0, ... 01714 452 NtContinue (1244264, 0, ... 01715 452 NtContinue (1244264, 0, ... 01716 452 NtContinue (1244264, 0, ... 01717 452 NtContinue (1244264, 0, ... 01718 452 NtContinue (1244264, 0, ... 01719 452 NtContinue (1244264, 0, ... 01720 452 NtContinue (1244264, 0, ... 01721 452 NtContinue (1244264, 0, ... 01722 452 NtContinue (1244264, 0, ... 01723 452 NtContinue (1244264, 0, ... 01724 452 NtContinue (1244264, 0, ... 01725 452 NtContinue (1244264, 0, ... 01726 452 NtContinue (1244264, 0, ... 01727 452 NtContinue (1244264, 0, ... 01728 452 NtContinue (1244264, 0, ... 01729 452 NtContinue (1244264, 0, ... 01730 452 NtContinue (1244264, 0, ... 01731 452 NtContinue (1244264, 0, ... 01732 452 NtContinue (1244264, 0, ... 01733 452 NtContinue (1244264, 0, ... 01734 452 NtContinue (1244264, 0, ... 01735 452 NtContinue (1244264, 0, ... 01736 452 NtContinue (1244264, 0, ... 01737 452 NtContinue (1244264, 0, ... 01738 452 NtContinue (1244264, 0, ... 01739 452 NtContinue (1244264, 0, ... 01740 452 NtContinue (1244264, 0, ... 01741 452 NtContinue (1244264, 0, ... 01742 452 NtContinue (1244264, 0, ... 01743 452 NtContinue (1244264, 0, ... 01744 452 NtContinue (1244264, 0, ... 01745 452 NtContinue (1244264, 0, ... 01746 452 NtContinue (1244264, 0, ... 01747 452 NtContinue (1244264, 0, ... 01748 452 NtContinue (1244264, 0, ... 01749 452 NtContinue (1244264, 0, ... 01750 452 NtContinue (1244264, 0, ... 01751 452 NtContinue (1244264, 0, ... 01752 452 NtContinue (1244264, 0, ... 01753 452 NtContinue (1244264, 0, ... 01754 452 NtContinue (1244264, 0, ... 01755 452 NtContinue (1244264, 0, ... 01756 452 NtContinue (1244264, 0, ... 01757 452 NtContinue (1244264, 0, ... 01758 452 NtContinue (1244264, 0, ... 01759 452 NtContinue (1244264, 0, ... 01760 452 NtContinue (1244264, 0, ... 01761 452 NtContinue (1244264, 0, ... 01762 452 NtContinue (1244264, 0, ... 01763 452 NtContinue (1244264, 0, ... 01764 452 NtContinue (1244264, 0, ... 01765 452 NtContinue (1244264, 0, ... 01766 452 NtContinue (1244264, 0, ... 01767 452 NtContinue (1244264, 0, ... 01768 452 NtContinue (1244264, 0, ... 01769 452 NtContinue (1244264, 0, ... 01770 452 NtContinue (1244264, 0, ... 01771 452 NtContinue (1244264, 0, ... 01772 452 NtContinue (1244264, 0, ... 01773 452 NtContinue (1244264, 0, ... 01774 452 NtContinue (1244264, 0, ... 01775 452 NtContinue (1244264, 0, ... 01776 452 NtContinue (1244264, 0, ... 01777 452 NtContinue (1244264, 0, ... 01778 452 NtContinue (1244264, 0, ... 01779 452 NtContinue (1244264, 0, ... 01780 452 NtContinue (1244264, 0, ... 01781 452 NtContinue (1244264, 0, ... 01782 452 NtContinue (1244264, 0, ... 01783 452 NtContinue (1244264, 0, ... 01784 452 NtContinue (1244264, 0, ... 01785 452 NtContinue (1244264, 0, ... 01786 452 NtContinue (1244264, 0, ... 01787 452 NtContinue (1244264, 0, ... 01788 452 NtContinue (1244264, 0, ... 01789 452 NtContinue (1244264, 0, ... 01790 452 NtContinue (1244264, 0, ... 01791 452 NtContinue (1244264, 0, ... 01792 452 NtContinue (1244264, 0, ... 01793 452 NtContinue (1244264, 0, ... 01794 452 NtContinue (1244264, 0, ... 01795 452 NtContinue (1244264, 0, ... 01796 452 NtContinue (1244264, 0, ... 01797 452 NtContinue (1244264, 0, ... 01798 452 NtContinue (1244264, 0, ... 01799 452 NtContinue (1244264, 0, ... 01800 452 NtContinue (1244264, 0, ... 01801 452 NtContinue (1244264, 0, ... 01802 452 NtContinue (1244264, 0, ... 01803 452 NtContinue (1244264, 0, ... 01804 452 NtContinue (1244264, 0, ... 01805 452 NtContinue (1244264, 0, ... 01806 452 NtContinue (1244264, 0, ... 01807 452 NtContinue (1244264, 0, ... 01808 452 NtContinue (1244264, 0, ... 01809 452 NtContinue (1244264, 0, ... 01810 452 NtContinue (1244264, 0, ... 01811 452 NtContinue (1244264, 0, ... 01812 452 NtContinue (1244264, 0, ... 01813 452 NtContinue (1244264, 0, ... 01814 452 NtContinue (1244264, 0, ... 01815 452 NtContinue (1244264, 0, ... 01816 452 NtContinue (1244264, 0, ... 01817 452 NtContinue (1244264, 0, ... 01818 452 NtContinue (1244264, 0, ... 01819 452 NtContinue (1244264, 0, ... 01820 452 NtContinue (1244264, 0, ... 01821 452 NtContinue (1244264, 0, ... 01822 452 NtContinue (1244264, 0, ... 01823 452 NtContinue (1244264, 0, ... 01824 452 NtContinue (1244264, 0, ... 01825 452 NtContinue (1244264, 0, ... 01826 452 NtContinue (1244264, 0, ... 01827 452 NtContinue (1244264, 0, ... 01828 452 NtContinue (1244264, 0, ... 01829 452 NtContinue (1244264, 0, ... 01830 452 NtContinue (1244264, 0, ... 01831 452 NtContinue (1244264, 0, ... 01832 452 NtContinue (1244264, 0, ... 01833 452 NtContinue (1244264, 0, ... 01834 452 NtContinue (1244264, 0, ... 01835 452 NtContinue (1244264, 0, ... 01836 452 NtContinue (1244264, 0, ... 01837 452 NtContinue (1244264, 0, ... 01838 452 NtContinue (1244264, 0, ... 01839 452 NtContinue (1244264, 0, ... 01840 452 NtContinue (1244264, 0, ... 01841 452 NtContinue (1244264, 0, ... 01842 452 NtContinue (1244264, 0, ... 01843 452 NtContinue (1244264, 0, ... 01844 452 NtContinue (1244264, 0, ... 01845 452 NtContinue (1244264, 0, ... 01846 452 NtContinue (1244264, 0, ... 01847 452 NtContinue (1244264, 0, ... 01848 452 NtContinue (1244264, 0, ... 01849 452 NtContinue (1244264, 0, ... 01850 452 NtContinue (1244264, 0, ... 01851 452 NtContinue (1244264, 0, ... 01852 452 NtContinue (1244264, 0, ... 01853 452 NtContinue (1244264, 0, ... 01854 452 NtContinue (1244264, 0, ... 01855 452 NtContinue (1244264, 0, ... 01856 452 NtContinue (1244264, 0, ... 01857 452 NtContinue (1244264, 0, ... 01858 452 NtContinue (1244264, 0, ... 01859 452 NtContinue (1244264, 0, ... 01860 452 NtContinue (1244264, 0, ... 01861 452 NtContinue (1244264, 0, ... 01862 452 NtContinue (1244264, 0, ... 01863 452 NtContinue (1244264, 0, ... 01864 452 NtContinue (1244264, 0, ... 01865 452 NtContinue (1244264, 0, ... 01866 452 NtContinue (1244264, 0, ... 01867 452 NtContinue (1244264, 0, ... 01868 452 NtContinue (1244264, 0, ... 01869 452 NtContinue (1244264, 0, ... 01870 452 NtContinue (1244264, 0, ... 01871 452 NtContinue (1244264, 0, ... 01872 452 NtContinue (1244264, 0, ... 01873 452 NtContinue (1244264, 0, ... 01874 452 NtContinue (1244264, 0, ... 01875 452 NtContinue (1244264, 0, ... 01876 452 NtContinue (1244264, 0, ... 01877 452 NtContinue (1244264, 0, ... 01878 452 NtContinue (1244264, 0, ... 01879 452 NtContinue (1244264, 0, ... 01880 452 NtContinue (1244264, 0, ... 01881 452 NtContinue (1244264, 0, ... 01882 452 NtContinue (1244264, 0, ... 01883 452 NtContinue (1244264, 0, ... 01884 452 NtContinue (1244264, 0, ... 01885 452 NtContinue (1244264, 0, ... 01886 452 NtContinue (1244264, 0, ... 01887 452 NtContinue (1244264, 0, ... 01888 452 NtContinue (1244264, 0, ... 01889 452 NtContinue (1244264, 0, ... 01890 452 NtContinue (1244264, 0, ... 01891 452 NtContinue (1244264, 0, ... 01892 452 NtContinue (1244264, 0, ... 01893 452 NtContinue (1244264, 0, ... 01894 452 NtContinue (1244264, 0, ... 01895 452 NtContinue (1244264, 0, ... 01896 452 NtContinue (1244264, 0, ... 01897 452 NtContinue (1244264, 0, ... 01898 452 NtContinue (1244264, 0, ... 01899 452 NtContinue (1244264, 0, ... 01900 452 NtContinue (1244264, 0, ... 01901 452 NtContinue (1244264, 0, ... 01902 452 NtContinue (1244264, 0, ... 01903 452 NtContinue (1244264, 0, ... 01904 452 NtContinue (1244264, 0, ... 01905 452 NtContinue (1244264, 0, ... 01906 452 NtContinue (1244264, 0, ... 01907 452 NtContinue (1244264, 0, ... 01908 452 NtContinue (1244264, 0, ... 01909 452 NtContinue (1244264, 0, ... 01910 452 NtContinue (1244264, 0, ... 01911 452 NtContinue (1244264, 0, ... 01912 452 NtContinue (1244264, 0, ... 01913 452 NtContinue (1244264, 0, ... 01914 452 NtContinue (1244264, 0, ... 01915 452 NtContinue (1244264, 0, ... 01916 452 NtContinue (1244264, 0, ... 01917 452 NtContinue (1244264, 0, ... 01918 452 NtContinue (1244264, 0, ... 01919 452 NtContinue (1244264, 0, ... 01920 452 NtContinue (1244264, 0, ... 01921 452 NtContinue (1244264, 0, ... 01922 452 NtContinue (1244264, 0, ... 01923 452 NtContinue (1244264, 0, ... 01924 452 NtContinue (1244264, 0, ... 01925 452 NtContinue (1244264, 0, ... 01926 452 NtContinue (1244264, 0, ... 01927 452 NtContinue (1244264, 0, ... 01928 452 NtContinue (1244264, 0, ... 01929 452 NtContinue (1244264, 0, ... 01930 452 NtContinue (1244264, 0, ... 01931 452 NtContinue (1244264, 0, ... 01932 452 NtContinue (1244264, 0, ... 01933 452 NtContinue (1244264, 0, ... 01934 452 NtContinue (1244264, 0, ... 01935 452 NtContinue (1244264, 0, ... 01936 452 NtContinue (1244264, 0, ... 01937 452 NtContinue (1244264, 0, ... 01938 452 NtContinue (1244264, 0, ... 01939 452 NtContinue (1244264, 0, ... 01940 452 NtContinue (1244264, 0, ... 01941 452 NtContinue (1244264, 0, ... 01942 452 NtContinue (1244264, 0, ... 01943 452 NtContinue (1244264, 0, ... 01944 452 NtContinue (1244264, 0, ... 01945 452 NtContinue (1244264, 0, ... 01946 452 NtContinue (1244264, 0, ... 01947 452 NtContinue (1244264, 0, ... 01948 452 NtContinue (1244264, 0, ... 01949 452 NtContinue (1244264, 0, ... 01950 452 NtContinue (1244264, 0, ... 01951 452 NtContinue (1244264, 0, ... 01952 452 NtContinue (1244264, 0, ... 01953 452 NtContinue (1244264, 0, ... 01954 452 NtContinue (1244264, 0, ... 01955 452 NtContinue (1244264, 0, ... 01956 452 NtContinue (1244264, 0, ... 01957 452 NtContinue (1244264, 0, ... 01958 452 NtContinue (1244264, 0, ... 01959 452 NtContinue (1244264, 0, ... 01960 452 NtContinue (1244264, 0, ... 01961 452 NtContinue (1244264, 0, ... 01962 452 NtContinue (1244264, 0, ... 01963 452 NtContinue (1244264, 0, ... 01964 452 NtContinue (1244264, 0, ... 01965 452 NtContinue (1244264, 0, ... 01966 452 NtContinue (1244264, 0, ... 01967 452 NtContinue (1244264, 0, ... 01968 452 NtContinue (1244264, 0, ... 01969 452 NtContinue (1244264, 0, ... 01970 452 NtContinue (1244264, 0, ... 01971 452 NtContinue (1244264, 0, ... 01972 452 NtContinue (1244264, 0, ... 01973 452 NtContinue (1244264, 0, ... 01974 452 NtContinue (1244264, 0, ... 01975 452 NtContinue (1244264, 0, ... 01976 452 NtContinue (1244264, 0, ... 01977 452 NtContinue (1244264, 0, ... 01978 452 NtContinue (1244264, 0, ... 01979 452 NtContinue (1244264, 0, ... 01980 452 NtContinue (1244264, 0, ... 01981 452 NtContinue (1244264, 0, ... 01982 452 NtContinue (1244264, 0, ... 01983 452 NtContinue (1244264, 0, ... 01984 452 NtContinue (1244264, 0, ... 01985 452 NtContinue (1244264, 0, ... 01986 452 NtContinue (1244264, 0, ... 01987 452 NtContinue (1244264, 0, ... 01988 452 NtContinue (1244264, 0, ... 01989 452 NtContinue (1244264, 0, ... 01990 452 NtContinue (1244264, 0, ... 01991 452 NtContinue (1244264, 0, ... 01992 452 NtContinue (1244264, 0, ... 01993 452 NtContinue (1244264, 0, ... 01994 452 NtContinue (1244264, 0, ... 01995 452 NtContinue (1244264, 0, ... 01996 452 NtContinue (1244264, 0, ... 01997 452 NtContinue (1244264, 0, ... 01998 452 NtContinue (1244264, 0, ... 01999 452 NtContinue (1244264, 0, ... 02000 452 NtContinue (1244264, 0, ... 02001 452 NtContinue (1244264, 0, ... 02002 452 NtContinue (1244264, 0, ... 02003 452 NtContinue (1244264, 0, ... 02004 452 NtContinue (1244264, 0, ... 02005 452 NtContinue (1244264, 0, ... 02006 452 NtContinue (1244264, 0, ... 02007 452 NtContinue (1244264, 0, ... 02008 452 NtContinue (1244264, 0, ... 02009 452 NtContinue (1244264, 0, ... 02010 452 NtContinue (1244264, 0, ... 02011 452 NtContinue (1244264, 0, ... 02012 452 NtContinue (1244264, 0, ... 02013 452 NtContinue (1244264, 0, ... 02014 452 NtContinue (1244264, 0, ... 02015 452 NtContinue (1244264, 0, ... 02016 452 NtContinue (1244264, 0, ... 02017 452 NtContinue (1244264, 0, ... 02018 452 NtContinue (1244264, 0, ... 02019 452 NtContinue (1244264, 0, ... 02020 452 NtContinue (1244264, 0, ... 02021 452 NtContinue (1244264, 0, ... 02022 452 NtContinue (1244264, 0, ... 02023 452 NtContinue (1244264, 0, ... 02024 452 NtContinue (1244264, 0, ... 02025 452 NtContinue (1244264, 0, ... 02026 452 NtContinue (1244264, 0, ... 02027 452 NtContinue (1244264, 0, ... 02028 452 NtContinue (1244264, 0, ... 02029 452 NtContinue (1244264, 0, ... 02030 452 NtContinue (1244264, 0, ... 02031 452 NtContinue (1244264, 0, ... 02032 452 NtContinue (1244264, 0, ... 02033 452 NtContinue (1244264, 0, ... 02034 452 NtContinue (1244264, 0, ... 02035 452 NtContinue (1244264, 0, ... 02036 452 NtContinue (1244264, 0, ... 02037 452 NtContinue (1244264, 0, ... 02038 452 NtContinue (1244264, 0, ... 02039 452 NtContinue (1244264, 0, ... 02040 452 NtContinue (1244264, 0, ... 02041 452 NtContinue (1244264, 0, ... 02042 452 NtContinue (1244264, 0, ... 02043 452 NtContinue (1244264, 0, ... 02044 452 NtContinue (1244264, 0, ... 02045 452 NtContinue (1244264, 0, ... 02046 452 NtContinue (1244264, 0, ... 02047 452 NtContinue (1244264, 0, ... 02048 452 NtContinue (1244264, 0, ... 02049 452 NtContinue (1244264, 0, ... 02050 452 NtContinue (1244264, 0, ... 02051 452 NtContinue (1244264, 0, ... 02052 452 NtContinue (1244264, 0, ... 02053 452 NtContinue (1244264, 0, ... 02054 452 NtContinue (1244264, 0, ... 02055 452 NtContinue (1244264, 0, ... 02056 452 NtContinue (1244264, 0, ... 02057 452 NtContinue (1244264, 0, ... 02058 452 NtContinue (1244264, 0, ... 02059 452 NtContinue (1244264, 0, ... 02060 452 NtContinue (1244264, 0, ... 02061 452 NtContinue (1244264, 0, ... 02062 452 NtContinue (1244264, 0, ... 02063 452 NtContinue (1244264, 0, ... 02064 452 NtContinue (1244264, 0, ... 02065 452 NtContinue (1244264, 0, ... 02066 452 NtContinue (1244264, 0, ... 02067 452 NtContinue (1244264, 0, ... 02068 452 NtContinue (1244264, 0, ... 02069 452 NtContinue (1244264, 0, ... 02070 452 NtContinue (1244264, 0, ... 02071 452 NtContinue (1244264, 0, ... 02072 452 NtContinue (1244264, 0, ... 02073 452 NtContinue (1244264, 0, ... 02074 452 NtContinue (1244264, 0, ... 02075 452 NtContinue (1244264, 0, ... 02076 452 NtContinue (1244264, 0, ... 02077 452 NtContinue (1244264, 0, ... 02078 452 NtContinue (1244264, 0, ... 02079 452 NtContinue (1244264, 0, ... 02080 452 NtContinue (1244264, 0, ... 02081 452 NtContinue (1244264, 0, ... 02082 452 NtContinue (1244264, 0, ... 02083 452 NtContinue (1244264, 0, ... 02084 452 NtContinue (1244264, 0, ... 02085 452 NtContinue (1244264, 0, ... 02086 452 NtContinue (1244264, 0, ... 02087 452 NtContinue (1244264, 0, ... 02088 452 NtContinue (1244264, 0, ... 02089 452 NtContinue (1244264, 0, ... 02090 452 NtContinue (1244264, 0, ... 02091 452 NtContinue (1244264, 0, ... 02092 452 NtContinue (1244264, 0, ... 02093 452 NtContinue (1244264, 0, ... 02094 452 NtContinue (1244264, 0, ... 02095 452 NtContinue (1244264, 0, ... 02096 452 NtContinue (1244264, 0, ... 02097 452 NtContinue (1244264, 0, ... 02098 452 NtContinue (1244264, 0, ... 02099 452 NtContinue (1244264, 0, ... 02100 452 NtContinue (1244264, 0, ... 02101 452 NtContinue (1244264, 0, ... 02102 452 NtContinue (1244264, 0, ... 02103 452 NtContinue (1244264, 0, ... 02104 452 NtContinue (1244264, 0, ... 02105 452 NtContinue (1244264, 0, ... 02106 452 NtContinue (1244264, 0, ... 02107 452 NtContinue (1244264, 0, ... 02108 452 NtContinue (1244264, 0, ... 02109 452 NtContinue (1244264, 0, ... 02110 452 NtContinue (1244264, 0, ... 02111 452 NtContinue (1244264, 0, ... 02112 452 NtContinue (1244264, 0, ... 02113 452 NtContinue (1244264, 0, ... 02114 452 NtContinue (1244264, 0, ... 02115 452 NtContinue (1244264, 0, ... 02116 452 NtContinue (1244264, 0, ... 02117 452 NtContinue (1244264, 0, ... 02118 452 NtContinue (1244264, 0, ... 02119 452 NtContinue (1244264, 0, ... 02120 452 NtContinue (1244264, 0, ... 02121 452 NtContinue (1244264, 0, ... 02122 452 NtContinue (1244264, 0, ... 02123 452 NtContinue (1244264, 0, ... 02124 452 NtContinue (1244264, 0, ... 02125 452 NtContinue (1244264, 0, ... 02126 452 NtContinue (1244264, 0, ... 02127 452 NtContinue (1244264, 0, ... 02128 452 NtContinue (1244264, 0, ... 02129 452 NtContinue (1244264, 0, ... 02130 452 NtContinue (1244264, 0, ... 02131 452 NtContinue (1244264, 0, ... 02132 452 NtContinue (1244264, 0, ... 02133 452 NtContinue (1244264, 0, ... 02134 452 NtContinue (1244264, 0, ... 02135 452 NtContinue (1244264, 0, ... 02136 452 NtContinue (1244264, 0, ... 02137 452 NtContinue (1244264, 0, ... 02138 452 NtContinue (1244264, 0, ... 02139 452 NtContinue (1244264, 0, ... 02140 452 NtContinue (1244264, 0, ... 02141 452 NtContinue (1244264, 0, ... 02142 452 NtContinue (1244264, 0, ... 02143 452 NtContinue (1244264, 0, ... 02144 452 NtContinue (1244264, 0, ... 02145 452 NtContinue (1244264, 0, ... 02146 452 NtContinue (1244264, 0, ... 02147 452 NtContinue (1244264, 0, ... 02148 452 NtContinue (1244264, 0, ... 02149 452 NtContinue (1244264, 0, ... 02150 452 NtContinue (1244264, 0, ... 02151 452 NtContinue (1244264, 0, ... 02152 452 NtContinue (1244264, 0, ... 02153 452 NtContinue (1244264, 0, ... 02154 452 NtContinue (1244264, 0, ... 02155 452 NtContinue (1244264, 0, ... 02156 452 NtContinue (1244264, 0, ... 02157 452 NtContinue (1244264, 0, ... 02158 452 NtContinue (1244264, 0, ... 02159 452 NtContinue (1244264, 0, ... 02160 452 NtContinue (1244264, 0, ... 02161 452 NtContinue (1244264, 0, ... 02162 452 NtContinue (1244264, 0, ... 02163 452 NtContinue (1244264, 0, ... 02164 452 NtContinue (1244264, 0, ... 02165 452 NtContinue (1244264, 0, ... 02166 452 NtContinue (1244264, 0, ... 02167 452 NtContinue (1244264, 0, ... 02168 452 NtContinue (1244264, 0, ... 02169 452 NtContinue (1244264, 0, ... 02170 452 NtContinue (1244264, 0, ... 02171 452 NtContinue (1244264, 0, ... 02172 452 NtContinue (1244264, 0, ... 02173 452 NtContinue (1244264, 0, ... 02174 452 NtContinue (1244264, 0, ... 02175 452 NtContinue (1244264, 0, ... 02176 452 NtContinue (1244264, 0, ... 02177 452 NtContinue (1244264, 0, ... 02178 452 NtContinue (1244264, 0, ... 02179 452 NtContinue (1244264, 0, ... 02180 452 NtContinue (1244264, 0, ... 02181 452 NtContinue (1244264, 0, ... 02182 452 NtContinue (1244264, 0, ... 02183 452 NtContinue (1244264, 0, ... 02184 452 NtContinue (1244264, 0, ... 02185 452 NtContinue (1244264, 0, ... 02186 452 NtContinue (1244264, 0, ... 02187 452 NtContinue (1244264, 0, ... 02188 452 NtContinue (1244264, 0, ... 02189 452 NtContinue (1244264, 0, ... 02190 452 NtContinue (1244264, 0, ... 02191 452 NtContinue (1244264, 0, ... 02192 452 NtContinue (1244264, 0, ... 02193 452 NtContinue (1244264, 0, ... 02194 452 NtContinue (1244264, 0, ... 02195 452 NtContinue (1244264, 0, ... 02196 452 NtContinue (1244264, 0, ... 02197 452 NtContinue (1244264, 0, ... 02198 452 NtContinue (1244264, 0, ... 02199 452 NtContinue (1244264, 0, ... 02200 452 NtContinue (1244264, 0, ... 02201 452 NtContinue (1244264, 0, ... 02202 452 NtContinue (1244264, 0, ... 02203 452 NtContinue (1244264, 0, ... 02204 452 NtContinue (1244264, 0, ... 02205 452 NtContinue (1244264, 0, ... 02206 452 NtContinue (1244264, 0, ... 02207 452 NtContinue (1244264, 0, ... 02208 452 NtContinue (1244264, 0, ... 02209 452 NtContinue (1244264, 0, ... 02210 452 NtContinue (1244264, 0, ... 02211 452 NtContinue (1244264, 0, ... 02212 452 NtContinue (1244264, 0, ... 02213 452 NtContinue (1244264, 0, ... 02214 452 NtContinue (1244264, 0, ... 02215 452 NtContinue (1244264, 0, ... 02216 452 NtContinue (1244264, 0, ... 02217 452 NtContinue (1244264, 0, ... 02218 452 NtContinue (1244264, 0, ... 02219 452 NtContinue (1244264, 0, ... 02220 452 NtContinue (1244264, 0, ... 02221 452 NtContinue (1244264, 0, ... 02222 452 NtContinue (1244264, 0, ... 02223 452 NtContinue (1244264, 0, ... 02224 452 NtContinue (1244264, 0, ... 02225 452 NtContinue (1244264, 0, ... 02226 452 NtContinue (1244264, 0, ... 02227 452 NtContinue (1244264, 0, ... 02228 452 NtContinue (1244264, 0, ... 02229 452 NtContinue (1244264, 0, ... 02230 452 NtContinue (1244264, 0, ... 02231 452 NtContinue (1244264, 0, ... 02232 452 NtContinue (1244264, 0, ... 02233 452 NtContinue (1244264, 0, ... 02234 452 NtContinue (1244264, 0, ... 02235 452 NtContinue (1244264, 0, ... 02236 452 NtContinue (1244264, 0, ... 02237 452 NtContinue (1244264, 0, ... 02238 452 NtContinue (1244264, 0, ... 02239 452 NtContinue (1244264, 0, ... 02240 452 NtContinue (1244264, 0, ... 02241 452 NtContinue (1244264, 0, ... 02242 452 NtContinue (1244264, 0, ... 02243 452 NtContinue (1244264, 0, ... 02244 452 NtContinue (1244264, 0, ... 02245 452 NtContinue (1244264, 0, ... 02246 452 NtContinue (1244264, 0, ... 02247 452 NtContinue (1244264, 0, ... 02248 452 NtContinue (1244264, 0, ... 02249 452 NtContinue (1244264, 0, ... 02250 452 NtContinue (1244264, 0, ... 02251 452 NtContinue (1244264, 0, ... 02252 452 NtContinue (1244264, 0, ... 02253 452 NtContinue (1244264, 0, ... 02254 452 NtContinue (1244264, 0, ... 02255 452 NtContinue (1244264, 0, ... 02256 452 NtContinue (1244264, 0, ... 02257 452 NtContinue (1244264, 0, ... 02258 452 NtContinue (1244264, 0, ... 02259 452 NtContinue (1244264, 0, ... 02260 452 NtContinue (1244264, 0, ... 02261 452 NtContinue (1244264, 0, ... 02262 452 NtContinue (1244264, 0, ... 02263 452 NtContinue (1244264, 0, ... 02264 452 NtContinue (1244264, 0, ... 02265 452 NtContinue (1244264, 0, ... 02266 452 NtContinue (1244264, 0, ... 02267 452 NtContinue (1244264, 0, ... 02268 452 NtContinue (1244264, 0, ... 02269 452 NtContinue (1244264, 0, ... 02270 452 NtContinue (1244264, 0, ... 02271 452 NtContinue (1244264, 0, ... 02272 452 NtContinue (1244264, 0, ... 02273 452 NtContinue (1244264, 0, ... 02274 452 NtContinue (1244264, 0, ... 02275 452 NtContinue (1244264, 0, ... 02276 452 NtContinue (1244264, 0, ... 02277 452 NtContinue (1244264, 0, ... 02278 452 NtContinue (1244264, 0, ... 02279 452 NtContinue (1244264, 0, ... 02280 452 NtContinue (1244264, 0, ... 02281 452 NtContinue (1244264, 0, ... 02282 452 NtContinue (1244264, 0, ... 02283 452 NtContinue (1244264, 0, ... 02284 452 NtContinue (1244264, 0, ... 02285 452 NtContinue (1244264, 0, ... 02286 452 NtContinue (1244264, 0, ... 02287 452 NtContinue (1244264, 0, ... 02288 452 NtContinue (1244264, 0, ... 02289 452 NtContinue (1244264, 0, ... 02290 452 NtContinue (1244264, 0, ... 02291 452 NtContinue (1244264, 0, ... 02292 452 NtContinue (1244264, 0, ... 02293 452 NtContinue (1244264, 0, ... 02294 452 NtContinue (1244264, 0, ... 02295 452 NtContinue (1244264, 0, ... 02296 452 NtContinue (1244264, 0, ... 02297 452 NtContinue (1244264, 0, ... 02298 452 NtContinue (1244264, 0, ... 02299 452 NtContinue (1244264, 0, ... 02300 452 NtContinue (1244264, 0, ... 02301 452 NtContinue (1244264, 0, ... 02302 452 NtContinue (1244264, 0, ... 02303 452 NtContinue (1244264, 0, ... 02304 452 NtContinue (1244264, 0, ... 02305 452 NtContinue (1244264, 0, ... 02306 452 NtContinue (1244264, 0, ... 02307 452 NtContinue (1244264, 0, ... 02308 452 NtContinue (1244264, 0, ... 02309 452 NtContinue (1244264, 0, ... 02310 452 NtContinue (1244264, 0, ... 02311 452 NtContinue (1244264, 0, ... 02312 452 NtContinue (1244264, 0, ... 02313 452 NtContinue (1244264, 0, ... 02314 452 NtContinue (1244264, 0, ... 02315 452 NtContinue (1244264, 0, ... 02316 452 NtContinue (1244264, 0, ... 02317 452 NtContinue (1244264, 0, ... 02318 452 NtContinue (1244264, 0, ... 02319 452 NtContinue (1244264, 0, ... 02320 452 NtContinue (1244264, 0, ... 02321 452 NtContinue (1244264, 0, ... 02322 452 NtContinue (1244264, 0, ... 02323 452 NtContinue (1244264, 0, ... 02324 452 NtContinue (1244264, 0, ... 02325 452 NtContinue (1244264, 0, ... 02326 452 NtContinue (1244264, 0, ... 02327 452 NtContinue (1244264, 0, ... 02328 452 NtContinue (1244264, 0, ... 02329 452 NtContinue (1244264, 0, ... 02330 452 NtContinue (1244264, 0, ... 02331 452 NtContinue (1244264, 0, ... 02332 452 NtContinue (1244264, 0, ... 02333 452 NtContinue (1244264, 0, ... 02334 452 NtContinue (1244264, 0, ... 02335 452 NtContinue (1244264, 0, ... 02336 452 NtContinue (1244264, 0, ... 02337 452 NtContinue (1244264, 0, ... 02338 452 NtContinue (1244264, 0, ... 02339 452 NtContinue (1244264, 0, ... 02340 452 NtContinue (1244264, 0, ... 02341 452 NtContinue (1244264, 0, ... 02342 452 NtContinue (1244264, 0, ... 02343 452 NtContinue (1244264, 0, ... 02344 452 NtContinue (1244264, 0, ... 02345 452 NtContinue (1244264, 0, ... 02346 452 NtContinue (1244264, 0, ... 02347 452 NtContinue (1244264, 0, ... 02348 452 NtContinue (1244264, 0, ... 02349 452 NtContinue (1244264, 0, ... 02350 452 NtContinue (1244264, 0, ... 02351 452 NtContinue (1244264, 0, ... 02352 452 NtContinue (1244264, 0, ... 02353 452 NtContinue (1244264, 0, ... 02354 452 NtContinue (1244264, 0, ... 02355 452 NtContinue (1244264, 0, ... 02356 452 NtContinue (1244264, 0, ... 02357 452 NtContinue (1244264, 0, ... 02358 452 NtContinue (1244264, 0, ... 02359 452 NtContinue (1244264, 0, ... 02360 452 NtContinue (1244264, 0, ... 02361 452 NtContinue (1244264, 0, ... 02362 452 NtContinue (1244264, 0, ... 02363 452 NtContinue (1244264, 0, ... 02364 452 NtContinue (1244264, 0, ... 02365 452 NtContinue (1244264, 0, ... 02366 452 NtContinue (1244264, 0, ... 02367 452 NtContinue (1244264, 0, ... 02368 452 NtContinue (1244264, 0, ... 02369 452 NtContinue (1244264, 0, ... 02370 452 NtContinue (1244264, 0, ... 02371 452 NtContinue (1244264, 0, ... 02372 452 NtContinue (1244264, 0, ... 02373 452 NtContinue (1244264, 0, ... 02374 452 NtContinue (1244264, 0, ... 02375 452 NtContinue (1244264, 0, ... 02376 452 NtContinue (1244264, 0, ... 02377 452 NtContinue (1244264, 0, ... 02378 452 NtContinue (1244264, 0, ... 02379 452 NtContinue (1244264, 0, ... 02380 452 NtContinue (1244264, 0, ... 02381 452 NtContinue (1244264, 0, ... 02382 452 NtContinue (1244264, 0, ... 02383 452 NtContinue (1244264, 0, ... 02384 452 NtContinue (1244264, 0, ... 02385 452 NtContinue (1244264, 0, ... 02386 452 NtContinue (1244264, 0, ... 02387 452 NtContinue (1244264, 0, ... 02388 452 NtContinue (1244264, 0, ... 02389 452 NtContinue (1244264, 0, ... 02390 452 NtContinue (1244264, 0, ... 02391 452 NtContinue (1244264, 0, ... 02392 452 NtContinue (1244264, 0, ... 02393 452 NtContinue (1244264, 0, ... 02394 452 NtContinue (1244264, 0, ... 02395 452 NtContinue (1244264, 0, ... 02396 452 NtContinue (1244264, 0, ... 02397 452 NtContinue (1244264, 0, ... 02398 452 NtContinue (1244264, 0, ... 02399 452 NtContinue (1244264, 0, ... 02400 452 NtContinue (1244264, 0, ... 02401 452 NtContinue (1244264, 0, ... 02402 452 NtContinue (1244264, 0, ... 02403 452 NtContinue (1244264, 0, ... 02404 452 NtContinue (1244264, 0, ... 02405 452 NtContinue (1244264, 0, ... 02406 452 NtContinue (1244264, 0, ... 02407 452 NtContinue (1244264, 0, ... 02408 452 NtContinue (1244264, 0, ... 02409 452 NtContinue (1244264, 0, ... 02410 452 NtContinue (1244264, 0, ... 02411 452 NtContinue (1244264, 0, ... 02412 452 NtContinue (1244264, 0, ... 02413 452 NtContinue (1244264, 0, ... 02414 452 NtContinue (1244264, 0, ... 02415 452 NtContinue (1244264, 0, ... 02416 452 NtContinue (1244264, 0, ... 02417 452 NtContinue (1244264, 0, ... 02418 452 NtContinue (1244264, 0, ... 02419 452 NtContinue (1244264, 0, ... 02420 452 NtContinue (1244264, 0, ... 02421 452 NtContinue (1244264, 0, ... 02422 452 NtContinue (1244264, 0, ... 02423 452 NtContinue (1244264, 0, ... 02424 452 NtContinue (1244264, 0, ... 02425 452 NtContinue (1244264, 0, ... 02426 452 NtContinue (1244264, 0, ... 02427 452 NtContinue (1244264, 0, ... 02428 452 NtContinue (1244264, 0, ... 02429 452 NtContinue (1244264, 0, ... 02430 452 NtContinue (1244264, 0, ... 02431 452 NtContinue (1244264, 0, ... 02432 452 NtContinue (1244264, 0, ... 02433 452 NtContinue (1244264, 0, ... 02434 452 NtContinue (1244264, 0, ... 02435 452 NtContinue (1244264, 0, ... 02436 452 NtContinue (1244264, 0, ... 02437 452 NtContinue (1244264, 0, ... 02438 452 NtContinue (1244264, 0, ... 02439 452 NtContinue (1244264, 0, ... 02440 452 NtContinue (1244264, 0, ... 02441 452 NtContinue (1244264, 0, ... 02442 452 NtContinue (1244264, 0, ... 02443 452 NtContinue (1244264, 0, ... 02444 452 NtContinue (1244264, 0, ... 02445 452 NtContinue (1244264, 0, ... 02446 452 NtContinue (1244264, 0, ... 02447 452 NtContinue (1244264, 0, ... 02448 452 NtContinue (1244264, 0, ... 02449 452 NtContinue (1244264, 0, ... 02450 452 NtContinue (1244264, 0, ... 02451 452 NtContinue (1244264, 0, ... 02452 452 NtContinue (1244264, 0, ... 02453 452 NtContinue (1244264, 0, ... 02454 452 NtContinue (1244264, 0, ... 02455 452 NtContinue (1244264, 0, ... 02456 452 NtContinue (1244264, 0, ... 02457 452 NtContinue (1244264, 0, ... 02458 452 NtContinue (1244264, 0, ... 02459 452 NtContinue (1244264, 0, ... 02460 452 NtContinue (1244264, 0, ... 02461 452 NtContinue (1244264, 0, ... 02462 452 NtContinue (1244264, 0, ... 02463 452 NtContinue (1244264, 0, ... 02464 452 NtContinue (1244264, 0, ... 02465 452 NtContinue (1244264, 0, ... 02466 452 NtContinue (1244264, 0, ... 02467 452 NtContinue (1244264, 0, ... 02468 452 NtContinue (1244264, 0, ... 02469 452 NtContinue (1244264, 0, ... 02470 452 NtContinue (1244264, 0, ... 02471 452 NtContinue (1244264, 0, ... 02472 452 NtContinue (1244264, 0, ... 02473 452 NtContinue (1244264, 0, ... 02474 452 NtContinue (1244264, 0, ... 02475 452 NtContinue (1244264, 0, ... 02476 452 NtContinue (1244264, 0, ... 02477 452 NtContinue (1244264, 0, ... 02478 452 NtContinue (1244264, 0, ... 02479 452 NtContinue (1244264, 0, ... 02480 452 NtContinue (1244264, 0, ... 02481 452 NtContinue (1244264, 0, ... 02482 452 NtContinue (1244264, 0, ... 02483 452 NtContinue (1244264, 0, ... 02484 452 NtContinue (1244264, 0, ... 02485 452 NtContinue (1244264, 0, ... 02486 452 NtContinue (1244264, 0, ... 02487 452 NtContinue (1244264, 0, ... 02488 452 NtContinue (1244264, 0, ... 02489 452 NtContinue (1244264, 0, ... 02490 452 NtContinue (1244264, 0, ... 02491 452 NtContinue (1244264, 0, ... 02492 452 NtContinue (1244264, 0, ... 02493 452 NtContinue (1244264, 0, ... 02494 452 NtContinue (1244264, 0, ... 02495 452 NtContinue (1244264, 0, ... 02496 452 NtContinue (1244264, 0, ... 02497 452 NtContinue (1244264, 0, ... 02498 452 NtContinue (1244264, 0, ... 02499 452 NtContinue (1244264, 0, ... 02500 452 NtContinue (1244264, 0, ... 02501 452 NtContinue (1244264, 0, ... 02502 452 NtContinue (1244264, 0, ... 02503 452 NtContinue (1244264, 0, ... 02504 452 NtContinue (1244264, 0, ... 02505 452 NtContinue (1244264, 0, ... 02506 452 NtContinue (1244264, 0, ... 02507 452 NtContinue (1244264, 0, ... 02508 452 NtContinue (1244264, 0, ... 02509 452 NtContinue (1244264, 0, ... 02510 452 NtContinue (1244264, 0, ... 02511 452 NtContinue (1244264, 0, ... 02512 452 NtContinue (1244264, 0, ... 02513 452 NtContinue (1244264, 0, ... 02514 452 NtContinue (1244264, 0, ... 02515 452 NtContinue (1244264, 0, ... 02516 452 NtContinue (1244264, 0, ... 02517 452 NtContinue (1244264, 0, ... 02518 452 NtContinue (1244264, 0, ... 02519 452 NtContinue (1244264, 0, ... 02520 452 NtContinue (1244264, 0, ... 02521 452 NtContinue (1244264, 0, ... 02522 452 NtContinue (1244264, 0, ... 02523 452 NtContinue (1244264, 0, ... 02524 452 NtContinue (1244264, 0, ... 02525 452 NtContinue (1244264, 0, ... 02526 452 NtContinue (1244264, 0, ... 02527 452 NtContinue (1244264, 0, ... 02528 452 NtContinue (1244264, 0, ... 02529 452 NtContinue (1244264, 0, ... 02530 452 NtContinue (1244264, 0, ... 02531 452 NtContinue (1244264, 0, ... 02532 452 NtContinue (1244264, 0, ... 02533 452 NtContinue (1244264, 0, ... 02534 452 NtContinue (1244264, 0, ... 02535 452 NtContinue (1244264, 0, ... 02536 452 NtContinue (1244264, 0, ... 02537 452 NtContinue (1244264, 0, ... 02538 452 NtContinue (1244264, 0, ... 02539 452 NtContinue (1244264, 0, ... 02540 452 NtContinue (1244264, 0, ... 02541 452 NtContinue (1244264, 0, ... 02542 452 NtContinue (1244264, 0, ... 02543 452 NtContinue (1244264, 0, ... 02544 452 NtContinue (1244264, 0, ... 02545 452 NtContinue (1244264, 0, ... 02546 452 NtContinue (1244264, 0, ... 02547 452 NtContinue (1244264, 0, ... 02548 452 NtContinue (1244264, 0, ... 02549 452 NtContinue (1244264, 0, ... 02550 452 NtContinue (1244264, 0, ... 02551 452 NtContinue (1244264, 0, ... 02552 452 NtContinue (1244264, 0, ... 02553 452 NtContinue (1244264, 0, ... 02554 452 NtContinue (1244264, 0, ... 02555 452 NtContinue (1244264, 0, ... 02556 452 NtContinue (1244264, 0, ... 02557 452 NtContinue (1244264, 0, ... 02558 452 NtContinue (1244264, 0, ... 02559 452 NtContinue (1244264, 0, ... 02560 452 NtContinue (1244264, 0, ... 02561 452 NtContinue (1244264, 0, ... 02562 452 NtContinue (1244264, 0, ... 02563 452 NtContinue (1244264, 0, ... 02564 452 NtContinue (1244264, 0, ... 02565 452 NtContinue (1244264, 0, ... 02566 452 NtContinue (1244264, 0, ... 02567 452 NtContinue (1244264, 0, ... 02568 452 NtContinue (1244264, 0, ... 02569 452 NtContinue (1244264, 0, ... 02570 452 NtContinue (1244264, 0, ... 02571 452 NtContinue (1244264, 0, ... 02572 452 NtContinue (1244264, 0, ... 02573 452 NtContinue (1244264, 0, ... 02574 452 NtContinue (1244264, 0, ... 02575 452 NtContinue (1244264, 0, ... 02576 452 NtContinue (1244264, 0, ... 02577 452 NtContinue (1244264, 0, ... 02578 452 NtContinue (1244264, 0, ... 02579 452 NtContinue (1244264, 0, ... 02580 452 NtContinue (1244264, 0, ... 02581 452 NtContinue (1244264, 0, ... 02582 452 NtContinue (1244264, 0, ... 02583 452 NtContinue (1244264, 0, ... 02584 452 NtContinue (1244264, 0, ... 02585 452 NtContinue (1244264, 0, ... 02586 452 NtContinue (1244264, 0, ... 02587 452 NtContinue (1244264, 0, ... 02588 452 NtContinue (1244264, 0, ... 02589 452 NtContinue (1244264, 0, ... 02590 452 NtContinue (1244264, 0, ... 02591 452 NtContinue (1244264, 0, ... 02592 452 NtContinue (1244264, 0, ... 02593 452 NtContinue (1244264, 0, ... 02594 452 NtContinue (1244264, 0, ... 02595 452 NtContinue (1244264, 0, ... 02596 452 NtContinue (1244264, 0, ... 02597 452 NtContinue (1244264, 0, ... 02598 452 NtContinue (1244264, 0, ... 02599 452 NtContinue (1244264, 0, ... 02600 452 NtContinue (1244264, 0, ... 02601 452 NtContinue (1244264, 0, ... 02602 452 NtContinue (1244264, 0, ... 02603 452 NtContinue (1244264, 0, ... 02604 452 NtContinue (1244264, 0, ... 02605 452 NtContinue (1244264, 0, ... 02606 452 NtContinue (1244264, 0, ... 02607 452 NtContinue (1244264, 0, ... 02608 452 NtContinue (1244264, 0, ... 02609 452 NtContinue (1244264, 0, ... 02610 452 NtContinue (1244264, 0, ... 02611 452 NtContinue (1244264, 0, ... 02612 452 NtContinue (1244264, 0, ... 02613 452 NtContinue (1244264, 0, ... 02614 452 NtContinue (1244264, 0, ... 02615 452 NtContinue (1244264, 0, ... 02616 452 NtContinue (1244264, 0, ... 02617 452 NtContinue (1244264, 0, ... 02618 452 NtContinue (1244264, 0, ... 02619 452 NtContinue (1244264, 0, ... 02620 452 NtContinue (1244264, 0, ... 02621 452 NtContinue (1244264, 0, ... 02622 452 NtContinue (1244264, 0, ... 02623 452 NtContinue (1244264, 0, ... 02624 452 NtContinue (1244264, 0, ... 02625 452 NtContinue (1244264, 0, ... 02626 452 NtContinue (1244264, 0, ... 02627 452 NtContinue (1244264, 0, ... 02628 452 NtContinue (1244264, 0, ... 02629 452 NtContinue (1244264, 0, ... 02630 452 NtContinue (1244264, 0, ... 02631 452 NtContinue (1244264, 0, ... 02632 452 NtContinue (1244264, 0, ... 02633 452 NtContinue (1244264, 0, ... 02634 452 NtContinue (1244264, 0, ... 02635 452 NtContinue (1244264, 0, ... 02636 452 NtContinue (1244264, 0, ... 02637 452 NtContinue (1244264, 0, ... 02638 452 NtContinue (1244264, 0, ... 02639 452 NtContinue (1244264, 0, ... 02640 452 NtContinue (1244264, 0, ... 02641 452 NtContinue (1244264, 0, ... 02642 452 NtContinue (1244264, 0, ... 02643 452 NtContinue (1244264, 0, ... 02644 452 NtContinue (1244264, 0, ... 02645 452 NtContinue (1244264, 0, ... 02646 452 NtContinue (1244264, 0, ... 02647 452 NtContinue (1244264, 0, ... 02648 452 NtContinue (1244264, 0, ... 02649 452 NtContinue (1244264, 0, ... 02650 452 NtContinue (1244264, 0, ... 02651 452 NtContinue (1244264, 0, ... 02652 452 NtContinue (1244264, 0, ... 02653 452 NtContinue (1244264, 0, ... 02654 452 NtContinue (1244264, 0, ... 02655 452 NtContinue (1244264, 0, ... 02656 452 NtContinue (1244264, 0, ... 02657 452 NtContinue (1244264, 0, ... 02658 452 NtContinue (1244264, 0, ... 02659 452 NtContinue (1244264, 0, ... 02660 452 NtContinue (1244264, 0, ... 02661 452 NtContinue (1244264, 0, ... 02662 452 NtContinue (1244264, 0, ... 02663 452 NtContinue (1244264, 0, ... 02664 452 NtContinue (1244264, 0, ... 02665 452 NtContinue (1244264, 0, ... 02666 452 NtContinue (1244264, 0, ... 02667 452 NtContinue (1244264, 0, ... 02668 452 NtContinue (1244264, 0, ... 02669 452 NtContinue (1244264, 0, ... 02670 452 NtContinue (1244264, 0, ... 02671 452 NtContinue (1244264, 0, ... 02672 452 NtContinue (1244264, 0, ... 02673 452 NtContinue (1244264, 0, ... 02674 452 NtContinue (1244264, 0, ... 02675 452 NtContinue (1244264, 0, ... 02676 452 NtContinue (1244264, 0, ... 02677 452 NtContinue (1244264, 0, ... 02678 452 NtContinue (1244264, 0, ... 02679 452 NtContinue (1244264, 0, ... 02680 452 NtContinue (1244264, 0, ... 02681 452 NtContinue (1244264, 0, ... 02682 452 NtContinue (1244264, 0, ... 02683 452 NtContinue (1244264, 0, ... 02684 452 NtContinue (1244264, 0, ... 02685 452 NtContinue (1244264, 0, ... 02686 452 NtContinue (1244264, 0, ... 02687 452 NtContinue (1244264, 0, ... 02688 452 NtContinue (1244264, 0, ... 02689 452 NtContinue (1244264, 0, ... 02690 452 NtContinue (1244264, 0, ... 02691 452 NtContinue (1244264, 0, ... 02692 452 NtContinue (1244264, 0, ... 02693 452 NtContinue (1244264, 0, ... 02694 452 NtContinue (1244264, 0, ... 02695 452 NtContinue (1244264, 0, ... 02696 452 NtContinue (1244264, 0, ... 02697 452 NtContinue (1244264, 0, ... 02698 452 NtContinue (1244264, 0, ... 02699 452 NtContinue (1244264, 0, ... 02700 452 NtContinue (1244264, 0, ... 02701 452 NtContinue (1244264, 0, ... 02702 452 NtContinue (1244264, 0, ... 02703 452 NtContinue (1244264, 0, ... 02704 452 NtContinue (1244264, 0, ... 02705 452 NtContinue (1244264, 0, ... 02706 452 NtContinue (1244264, 0, ... 02707 452 NtContinue (1244264, 0, ... 02708 452 NtContinue (1244264, 0, ... 02709 452 NtContinue (1244264, 0, ... 02710 452 NtContinue (1244264, 0, ... 02711 452 NtContinue (1244264, 0, ... 02712 452 NtContinue (1244264, 0, ... 02713 452 NtContinue (1244264, 0, ... 02714 452 NtContinue (1244264, 0, ... 02715 452 NtContinue (1244264, 0, ... 02716 452 NtContinue (1244264, 0, ... 02717 452 NtContinue (1244264, 0, ... 02718 452 NtContinue (1244264, 0, ... 02719 452 NtContinue (1244264, 0, ... 02720 452 NtContinue (1244264, 0, ... 02721 452 NtContinue (1244264, 0, ... 02722 452 NtContinue (1244264, 0, ... 02723 452 NtContinue (1244264, 0, ... 02724 452 NtContinue (1244264, 0, ... 02725 452 NtContinue (1244264, 0, ... 02726 452 NtContinue (1244264, 0, ... 02727 452 NtContinue (1244264, 0, ... 02728 452 NtContinue (1244264, 0, ... 02729 452 NtContinue (1244264, 0, ... 02730 452 NtContinue (1244264, 0, ... 02731 452 NtContinue (1244264, 0, ... 02732 452 NtContinue (1244264, 0, ... 02733 452 NtContinue (1244264, 0, ... 02734 452 NtContinue (1244264, 0, ... 02735 452 NtContinue (1244264, 0, ... 02736 452 NtContinue (1244264, 0, ... 02737 452 NtContinue (1244264, 0, ... 02738 452 NtContinue (1244264, 0, ... 02739 452 NtContinue (1244264, 0, ... 02740 452 NtContinue (1244264, 0, ... 02741 452 NtContinue (1244264, 0, ... 02742 452 NtContinue (1244264, 0, ... 02743 452 NtContinue (1244264, 0, ... 02744 452 NtContinue (1244264, 0, ... 02745 452 NtContinue (1244264, 0, ... 02746 452 NtContinue (1244264, 0, ... 02747 452 NtContinue (1244264, 0, ... 02748 452 NtContinue (1244264, 0, ... 02749 452 NtContinue (1244264, 0, ... 02750 452 NtContinue (1244264, 0, ... 02751 452 NtContinue (1244264, 0, ... 02752 452 NtContinue (1244264, 0, ... 02753 452 NtContinue (1244264, 0, ... 02754 452 NtContinue (1244264, 0, ... 02755 452 NtContinue (1244264, 0, ... 02756 452 NtContinue (1244264, 0, ... 02757 452 NtContinue (1244264, 0, ... 02758 452 NtContinue (1244264, 0, ... 02759 452 NtContinue (1244264, 0, ... 02760 452 NtContinue (1244264, 0, ... 02761 452 NtContinue (1244264, 0, ... 02762 452 NtContinue (1244264, 0, ... 02763 452 NtContinue (1244264, 0, ... 02764 452 NtContinue (1244264, 0, ... 02765 452 NtContinue (1244264, 0, ... 02766 452 NtContinue (1244264, 0, ... 02767 452 NtContinue (1244264, 0, ... 02768 452 NtContinue (1244264, 0, ... 02769 452 NtContinue (1244264, 0, ... 02770 452 NtContinue (1244264, 0, ... 02771 452 NtContinue (1244264, 0, ... 02772 452 NtContinue (1244264, 0, ... 02773 452 NtContinue (1244264, 0, ... 02774 452 NtContinue (1244264, 0, ... 02775 452 NtContinue (1244264, 0, ... 02776 452 NtContinue (1244264, 0, ... 02777 452 NtContinue (1244264, 0, ... 02778 452 NtContinue (1244264, 0, ... 02779 452 NtContinue (1244264, 0, ... 02780 452 NtContinue (1244264, 0, ... 02781 452 NtContinue (1244264, 0, ... 02782 452 NtContinue (1244264, 0, ... 02783 452 NtContinue (1244264, 0, ... 02784 452 NtContinue (1244264, 0, ... 02785 452 NtContinue (1244264, 0, ... 02786 452 NtContinue (1244264, 0, ... 02787 452 NtContinue (1244264, 0, ... 02788 452 NtContinue (1244264, 0, ... 02789 452 NtContinue (1244264, 0, ... 02790 452 NtContinue (1244264, 0, ... 02791 452 NtContinue (1244264, 0, ... 02792 452 NtContinue (1244264, 0, ... 02793 452 NtContinue (1244264, 0, ... 02794 452 NtContinue (1244264, 0, ... 02795 452 NtContinue (1244264, 0, ... 02796 452 NtContinue (1244264, 0, ... 02797 452 NtContinue (1244264, 0, ... 02798 452 NtContinue (1244264, 0, ... 02799 452 NtContinue (1244264, 0, ... 02800 452 NtContinue (1244264, 0, ... 02801 452 NtContinue (1244264, 0, ... 02802 452 NtContinue (1244264, 0, ... 02803 452 NtContinue (1244264, 0, ... 02804 452 NtContinue (1244264, 0, ... 02805 452 NtContinue (1244264, 0, ... 02806 452 NtContinue (1244264, 0, ... 02807 452 NtContinue (1244264, 0, ... 02808 452 NtContinue (1244264, 0, ... 02809 452 NtContinue (1244264, 0, ... 02810 452 NtContinue (1244264, 0, ... 02811 452 NtContinue (1244264, 0, ... 02812 452 NtContinue (1244264, 0, ... 02813 452 NtContinue (1244264, 0, ... 02814 452 NtContinue (1244264, 0, ... 02815 452 NtContinue (1244264, 0, ... 02816 452 NtContinue (1244264, 0, ... 02817 452 NtContinue (1244264, 0, ... 02818 452 NtContinue (1244264, 0, ... 02819 452 NtContinue (1244264, 0, ... 02820 452 NtContinue (1244264, 0, ... 02821 452 NtContinue (1244264, 0, ... 02822 452 NtContinue (1244264, 0, ... 02823 452 NtContinue (1244264, 0, ... 02824 452 NtContinue (1244264, 0, ... 02825 452 NtContinue (1244264, 0, ... 02826 452 NtContinue (1244264, 0, ... 02827 452 NtContinue (1244264, 0, ... 02828 452 NtContinue (1244264, 0, ... 02829 452 NtContinue (1244264, 0, ... 02830 452 NtContinue (1244264, 0, ... 02831 452 NtContinue (1244264, 0, ... 02832 452 NtContinue (1244264, 0, ... 02833 452 NtContinue (1244264, 0, ... 02834 452 NtContinue (1244264, 0, ... 02835 452 NtContinue (1244264, 0, ... 02836 452 NtContinue (1244264, 0, ... 02837 452 NtContinue (1244264, 0, ... 02838 452 NtContinue (1244264, 0, ... 02839 452 NtContinue (1244264, 0, ... 02840 452 NtContinue (1244264, 0, ... 02841 452 NtContinue (1244264, 0, ... 02842 452 NtContinue (1244264, 0, ... 02843 452 NtContinue (1244264, 0, ... 02844 452 NtContinue (1244264, 0, ... 02845 452 NtContinue (1244264, 0, ... 02846 452 NtContinue (1244264, 0, ... 02847 452 NtContinue (1244264, 0, ... 02848 452 NtContinue (1244264, 0, ... 02849 452 NtContinue (1244264, 0, ... 02850 452 NtContinue (1244264, 0, ... 02851 452 NtContinue (1244264, 0, ... 02852 452 NtContinue (1244264, 0, ... 02853 452 NtContinue (1244264, 0, ... 02854 452 NtContinue (1244264, 0, ... 02855 452 NtContinue (1244264, 0, ... 02856 452 NtContinue (1244264, 0, ... 02857 452 NtContinue (1244264, 0, ... 02858 452 NtContinue (1244264, 0, ... 02859 452 NtContinue (1244264, 0, ... 02860 452 NtContinue (1244264, 0, ... 02861 452 NtContinue (1244264, 0, ... 02862 452 NtContinue (1244264, 0, ... 02863 452 NtContinue (1244264, 0, ... 02864 452 NtContinue (1244264, 0, ... 02865 452 NtContinue (1244264, 0, ... 02866 452 NtContinue (1244264, 0, ... 02867 452 NtContinue (1244264, 0, ... 02868 452 NtContinue (1244264, 0, ... 02869 452 NtContinue (1244264, 0, ... 02870 452 NtContinue (1244264, 0, ... 02871 452 NtContinue (1244264, 0, ... 02872 452 NtContinue (1244264, 0, ... 02873 452 NtContinue (1244264, 0, ... 02874 452 NtContinue (1244264, 0, ... 02875 452 NtContinue (1244264, 0, ... 02876 452 NtContinue (1244264, 0, ... 02877 452 NtContinue (1244264, 0, ... 02878 452 NtContinue (1244264, 0, ... 02879 452 NtContinue (1244264, 0, ... 02880 452 NtContinue (1244264, 0, ... 02881 452 NtContinue (1244264, 0, ... 02882 452 NtContinue (1244264, 0, ... 02883 452 NtContinue (1244264, 0, ... 02884 452 NtContinue (1244264, 0, ... 02885 452 NtContinue (1244264, 0, ... 02886 452 NtContinue (1244264, 0, ... 02887 452 NtContinue (1244264, 0, ... 02888 452 NtContinue (1244264, 0, ... 02889 452 NtContinue (1244264, 0, ... 02890 452 NtContinue (1244264, 0, ... 02891 452 NtContinue (1244264, 0, ... 02892 452 NtContinue (1244264, 0, ... 02893 452 NtContinue (1244264, 0, ... 02894 452 NtContinue (1244264, 0, ... 02895 452 NtContinue (1244264, 0, ... 02896 452 NtContinue (1244264, 0, ... 02897 452 NtContinue (1244264, 0, ... 02898 452 NtContinue (1244264, 0, ... 02899 452 NtContinue (1244264, 0, ... 02900 452 NtContinue (1244264, 0, ... 02901 452 NtContinue (1244264, 0, ... 02902 452 NtContinue (1244264, 0, ... 02903 452 NtContinue (1244264, 0, ... 02904 452 NtContinue (1244264, 0, ... 02905 452 NtContinue (1244264, 0, ... 02906 452 NtContinue (1244264, 0, ... 02907 452 NtContinue (1244264, 0, ... 02908 452 NtContinue (1244264, 0, ... 02909 452 NtContinue (1244264, 0, ... 02910 452 NtContinue (1244264, 0, ... 02911 452 NtContinue (1244264, 0, ... 02912 452 NtContinue (1244264, 0, ... 02913 452 NtContinue (1244264, 0, ... 02914 452 NtContinue (1244264, 0, ... 02915 452 NtContinue (1244264, 0, ... 02916 452 NtContinue (1244264, 0, ... 02917 452 NtContinue (1244264, 0, ... 02918 452 NtContinue (1244264, 0, ... 02919 452 NtContinue (1244264, 0, ... 02920 452 NtContinue (1244264, 0, ... 02921 452 NtContinue (1244264, 0, ... 02922 452 NtContinue (1244264, 0, ... 02923 452 NtContinue (1244264, 0, ... 02924 452 NtContinue (1244264, 0, ... 02925 452 NtContinue (1244264, 0, ... 02926 452 NtContinue (1244264, 0, ... 02927 452 NtContinue (1244264, 0, ... 02928 452 NtContinue (1244264, 0, ... 02929 452 NtContinue (1244264, 0, ... 02930 452 NtContinue (1244264, 0, ... 02931 452 NtContinue (1244264, 0, ... 02932 452 NtContinue (1244264, 0, ... 02933 452 NtContinue (1244264, 0, ... 02934 452 NtContinue (1244264, 0, ... 02935 452 NtContinue (1244264, 0, ... 02936 452 NtContinue (1244264, 0, ... 02937 452 NtContinue (1244264, 0, ... 02938 452 NtContinue (1244264, 0, ... 02939 452 NtContinue (1244264, 0, ... 02940 452 NtContinue (1244264, 0, ... 02941 452 NtContinue (1244264, 0, ... 02942 452 NtContinue (1244264, 0, ... 02943 452 NtContinue (1244264, 0, ... 02944 452 NtContinue (1244264, 0, ... 02945 452 NtContinue (1244264, 0, ... 02946 452 NtContinue (1244264, 0, ... 02947 452 NtContinue (1244264, 0, ... 02948 452 NtContinue (1244264, 0, ... 02949 452 NtContinue (1244264, 0, ... 02950 452 NtContinue (1244264, 0, ... 02951 452 NtContinue (1244264, 0, ... 02952 452 NtContinue (1244264, 0, ... 02953 452 NtContinue (1244264, 0, ... 02954 452 NtContinue (1244264, 0, ... 02955 452 NtContinue (1244264, 0, ... 02956 452 NtContinue (1244264, 0, ... 02957 452 NtContinue (1244264, 0, ... 02958 452 NtContinue (1244264, 0, ... 02959 452 NtContinue (1244264, 0, ... 02960 452 NtContinue (1244264, 0, ... 02961 452 NtContinue (1244264, 0, ... 02962 452 NtContinue (1244264, 0, ... 02963 452 NtContinue (1244264, 0, ... 02964 452 NtContinue (1244264, 0, ... 02965 452 NtContinue (1244264, 0, ... 02966 452 NtContinue (1244264, 0, ... 02967 452 NtContinue (1244264, 0, ... 02968 452 NtContinue (1244264, 0, ... 02969 452 NtContinue (1244264, 0, ... 02970 452 NtContinue (1244264, 0, ... 02971 452 NtContinue (1244264, 0, ... 02972 452 NtContinue (1244264, 0, ... 02973 452 NtContinue (1244264, 0, ... 02974 452 NtContinue (1244264, 0, ... 02975 452 NtContinue (1244264, 0, ... 02976 452 NtContinue (1244264, 0, ... 02977 452 NtContinue (1244264, 0, ... 02978 452 NtContinue (1244264, 0, ... 02979 452 NtContinue (1244264, 0, ... 02980 452 NtContinue (1244264, 0, ... 02981 452 NtContinue (1244264, 0, ... 02982 452 NtContinue (1244264, 0, ... 02983 452 NtContinue (1244264, 0, ... 02984 452 NtContinue (1244264, 0, ... 02985 452 NtContinue (1244264, 0, ... 02986 452 NtContinue (1244264, 0, ... 02987 452 NtContinue (1244264, 0, ... 02988 452 NtContinue (1244264, 0, ... 02989 452 NtContinue (1244264, 0, ... 02990 452 NtContinue (1244264, 0, ... 02991 452 NtContinue (1244264, 0, ... 02992 452 NtContinue (1244264, 0, ... 02993 452 NtContinue (1244264, 0, ... 02994 452 NtContinue (1244264, 0, ... 02995 452 NtContinue (1244264, 0, ... 02996 452 NtContinue (1244264, 0, ... 02997 452 NtContinue (1244264, 0, ... 02998 452 NtContinue (1244264, 0, ... 02999 452 NtContinue (1244264, 0, ... 03000 452 NtContinue (1244264, 0, ... 03001 452 NtContinue (1244264, 0, ... 03002 452 NtContinue (1244264, 0, ... 03003 452 NtContinue (1244264, 0, ... 03004 452 NtContinue (1244264, 0, ... 03005 452 NtContinue (1244264, 0, ... 03006 452 NtContinue (1244264, 0, ... 03007 452 NtContinue (1244264, 0, ... 03008 452 NtContinue (1244264, 0, ... 03009 452 NtContinue (1244264, 0, ... 03010 452 NtContinue (1244264, 0, ... 03011 452 NtContinue (1244264, 0, ... 03012 452 NtContinue (1244264, 0, ... 03013 452 NtContinue (1244264, 0, ... 03014 452 NtContinue (1244264, 0, ... 03015 452 NtContinue (1244264, 0, ... 03016 452 NtContinue (1244264, 0, ... 03017 452 NtContinue (1244264, 0, ... 03018 452 NtContinue (1244264, 0, ... 03019 452 NtContinue (1244264, 0, ... 03020 452 NtContinue (1244264, 0, ... 03021 452 NtContinue (1244264, 0, ... 03022 452 NtContinue (1244264, 0, ... 03023 452 NtContinue (1244264, 0, ... 03024 452 NtContinue (1244264, 0, ... 03025 452 NtContinue (1244264, 0, ... 03026 452 NtContinue (1244264, 0, ... 03027 452 NtContinue (1244264, 0, ... 03028 452 NtContinue (1244264, 0, ... 03029 452 NtContinue (1244264, 0, ... 03030 452 NtContinue (1244264, 0, ... 03031 452 NtContinue (1244264, 0, ... 03032 452 NtContinue (1244264, 0, ... 03033 452 NtContinue (1244264, 0, ... 03034 452 NtContinue (1244264, 0, ... 03035 452 NtContinue (1244264, 0, ... 03036 452 NtContinue (1244264, 0, ... 03037 452 NtContinue (1244264, 0, ... 03038 452 NtContinue (1244264, 0, ... 03039 452 NtContinue (1244264, 0, ... 03040 452 NtContinue (1244264, 0, ... 03041 452 NtContinue (1244264, 0, ... 03042 452 NtContinue (1244264, 0, ... 03043 452 NtContinue (1244264, 0, ... 03044 452 NtContinue (1244264, 0, ... 03045 452 NtContinue (1244264, 0, ... 03046 452 NtContinue (1244264, 0, ... 03047 452 NtContinue (1244264, 0, ... 03048 452 NtContinue (1244264, 0, ... 03049 452 NtContinue (1244264, 0, ... 03050 452 NtContinue (1244264, 0, ... 03051 452 NtContinue (1244264, 0, ... 03052 452 NtContinue (1244264, 0, ... 03053 452 NtContinue (1244264, 0, ... 03054 452 NtContinue (1244264, 0, ... 03055 452 NtContinue (1244264, 0, ... 03056 452 NtContinue (1244264, 0, ... 03057 452 NtContinue (1244264, 0, ... 03058 452 NtContinue (1244264, 0, ... 03059 452 NtContinue (1244264, 0, ... 03060 452 NtContinue (1244264, 0, ... 03061 452 NtContinue (1244264, 0, ... 03062 452 NtContinue (1244264, 0, ... 03063 452 NtContinue (1244264, 0, ... 03064 452 NtContinue (1244264, 0, ... 03065 452 NtContinue (1244264, 0, ... 03066 452 NtContinue (1244264, 0, ... 03067 452 NtContinue (1244264, 0, ... 03068 452 NtContinue (1244264, 0, ... 03069 452 NtContinue (1244264, 0, ... 03070 452 NtContinue (1244264, 0, ... 03071 452 NtContinue (1244264, 0, ... 03072 452 NtContinue (1244264, 0, ... 03073 452 NtContinue (1244264, 0, ... 03074 452 NtContinue (1244264, 0, ... 03075 452 NtContinue (1244264, 0, ... 03076 452 NtContinue (1244264, 0, ... 03077 452 NtContinue (1244264, 0, ... 03078 452 NtContinue (1244264, 0, ... 03079 452 NtContinue (1244264, 0, ... 03080 452 NtContinue (1244264, 0, ... 03081 452 NtContinue (1244264, 0, ... 03082 452 NtContinue (1244264, 0, ... 03083 452 NtContinue (1244264, 0, ... 03084 452 NtContinue (1244264, 0, ... 03085 452 NtContinue (1244264, 0, ... 03086 452 NtContinue (1244264, 0, ... 03087 452 NtContinue (1244264, 0, ... 03088 452 NtContinue (1244264, 0, ... 03089 452 NtContinue (1244264, 0, ... 03090 452 NtContinue (1244264, 0, ... 03091 452 NtContinue (1244264, 0, ... 03092 452 NtContinue (1244264, 0, ... 03093 452 NtContinue (1244264, 0, ... 03094 452 NtContinue (1244264, 0, ... 03095 452 NtContinue (1244264, 0, ... 03096 452 NtContinue (1244264, 0, ... 03097 452 NtContinue (1244264, 0, ... 03098 452 NtContinue (1244264, 0, ... 03099 452 NtContinue (1244264, 0, ... 03100 452 NtContinue (1244264, 0, ... 03101 452 NtContinue (1244264, 0, ... 03102 452 NtContinue (1244264, 0, ... 03103 452 NtContinue (1244264, 0, ... 03104 452 NtContinue (1244264, 0, ... 03105 452 NtContinue (1244264, 0, ... 03106 452 NtContinue (1244264, 0, ... 03107 452 NtContinue (1244264, 0, ... 03108 452 NtContinue (1244264, 0, ... 03109 452 NtContinue (1244264, 0, ... 03110 452 NtContinue (1244264, 0, ... 03111 452 NtContinue (1244264, 0, ... 03112 452 NtContinue (1244264, 0, ... 03113 452 NtContinue (1244264, 0, ... 03114 452 NtContinue (1244264, 0, ... 03115 452 NtContinue (1244264, 0, ... 03116 452 NtContinue (1244264, 0, ... 03117 452 NtContinue (1244264, 0, ... 03118 452 NtContinue (1244264, 0, ... 03119 452 NtContinue (1244264, 0, ... 03120 452 NtContinue (1244264, 0, ... 03121 452 NtContinue (1244264, 0, ... 03122 452 NtContinue (1244264, 0, ... 03123 452 NtContinue (1244264, 0, ... 03124 452 NtContinue (1244264, 0, ... 03125 452 NtContinue (1244264, 0, ... 03126 452 NtContinue (1244264, 0, ... 03127 452 NtContinue (1244264, 0, ... 03128 452 NtContinue (1244264, 0, ... 03129 452 NtContinue (1244264, 0, ... 03130 452 NtContinue (1244264, 0, ... 03131 452 NtContinue (1244264, 0, ... 03132 452 NtContinue (1244264, 0, ... 03133 452 NtContinue (1244264, 0, ... 03134 452 NtContinue (1244264, 0, ... 03135 452 NtContinue (1244264, 0, ... 03136 452 NtContinue (1244264, 0, ... 03137 452 NtContinue (1244264, 0, ... 03138 452 NtContinue (1244264, 0, ... 03139 452 NtContinue (1244264, 0, ... 03140 452 NtContinue (1244264, 0, ... 03141 452 NtContinue (1244264, 0, ... 03142 452 NtContinue (1244264, 0, ... 03143 452 NtContinue (1244264, 0, ... 03144 452 NtContinue (1244264, 0, ... 03145 452 NtContinue (1244264, 0, ... 03146 452 NtContinue (1244264, 0, ... 03147 452 NtContinue (1244264, 0, ... 03148 452 NtContinue (1244264, 0, ... 03149 452 NtContinue (1244264, 0, ... 03150 452 NtContinue (1244264, 0, ... 03151 452 NtContinue (1244264, 0, ... 03152 452 NtContinue (1244264, 0, ... 03153 452 NtContinue (1244264, 0, ... 03154 452 NtContinue (1244264, 0, ... 03155 452 NtContinue (1244264, 0, ... 03156 452 NtContinue (1244264, 0, ... 03157 452 NtContinue (1244264, 0, ... 03158 452 NtContinue (1244264, 0, ... 03159 452 NtContinue (1244264, 0, ... 03160 452 NtContinue (1244264, 0, ... 03161 452 NtContinue (1244264, 0, ... 03162 452 NtContinue (1244264, 0, ... 03163 452 NtContinue (1244264, 0, ... 03164 452 NtContinue (1244264, 0, ... 03165 452 NtContinue (1244264, 0, ... 03166 452 NtContinue (1244264, 0, ... 03167 452 NtContinue (1244264, 0, ... 03168 452 NtContinue (1244264, 0, ... 03169 452 NtContinue (1244264, 0, ... 03170 452 NtContinue (1244264, 0, ... 03171 452 NtContinue (1244264, 0, ... 03172 452 NtContinue (1244264, 0, ... 03173 452 NtContinue (1244264, 0, ... 03174 452 NtContinue (1244264, 0, ... 03175 452 NtContinue (1244264, 0, ... 03176 452 NtContinue (1244264, 0, ... 03177 452 NtContinue (1244264, 0, ... 03178 452 NtContinue (1244264, 0, ... 03179 452 NtContinue (1244264, 0, ... 03180 452 NtContinue (1244264, 0, ... 03181 452 NtContinue (1244264, 0, ... 03182 452 NtContinue (1244264, 0, ... 03183 452 NtContinue (1244264, 0, ... 03184 452 NtContinue (1244264, 0, ... 03185 452 NtContinue (1244264, 0, ... 03186 452 NtContinue (1244264, 0, ... 03187 452 NtContinue (1244264, 0, ... 03188 452 NtContinue (1244264, 0, ... 03189 452 NtContinue (1244264, 0, ... 03190 452 NtContinue (1244264, 0, ... 03191 452 NtContinue (1244264, 0, ... 03192 452 NtContinue (1244264, 0, ... 03193 452 NtContinue (1244264, 0, ... 03194 452 NtContinue (1244264, 0, ... 03195 452 NtContinue (1244264, 0, ... 03196 452 NtContinue (1244264, 0, ... 03197 452 NtContinue (1244264, 0, ... 03198 452 NtContinue (1244264, 0, ... 03199 452 NtContinue (1244264, 0, ... 03200 452 NtContinue (1244264, 0, ... 03201 452 NtContinue (1244264, 0, ... 03202 452 NtContinue (1244264, 0, ... 03203 452 NtContinue (1244264, 0, ... 03204 452 NtContinue (1244264, 0, ... 03205 452 NtContinue (1244264, 0, ... 03206 452 NtContinue (1244264, 0, ... 03207 452 NtContinue (1244264, 0, ... 03208 452 NtContinue (1244264, 0, ... 03209 452 NtContinue (1244264, 0, ... 03210 452 NtContinue (1244264, 0, ... 03211 452 NtContinue (1244264, 0, ... 03212 452 NtContinue (1244264, 0, ... 03213 452 NtContinue (1244264, 0, ... 03214 452 NtContinue (1244264, 0, ... 03215 452 NtContinue (1244264, 0, ... 03216 452 NtContinue (1244264, 0, ... 03217 452 NtContinue (1244264, 0, ... 03218 452 NtContinue (1244264, 0, ... 03219 452 NtContinue (1244264, 0, ... 03220 452 NtContinue (1244264, 0, ... 03221 452 NtContinue (1244264, 0, ... 03222 452 NtContinue (1244264, 0, ... 03223 452 NtContinue (1244264, 0, ... 03224 452 NtContinue (1244264, 0, ... 03225 452 NtContinue (1244264, 0, ... 03226 452 NtContinue (1244264, 0, ... 03227 452 NtContinue (1244264, 0, ... 03228 452 NtContinue (1244264, 0, ... 03229 452 NtContinue (1244264, 0, ... 03230 452 NtContinue (1244264, 0, ... 03231 452 NtContinue (1244264, 0, ... 03232 452 NtContinue (1244264, 0, ... 03233 452 NtContinue (1244264, 0, ... 03234 452 NtContinue (1244264, 0, ... 03235 452 NtContinue (1244264, 0, ... 03236 452 NtContinue (1244264, 0, ... 03237 452 NtContinue (1244264, 0, ... 03238 452 NtContinue (1244264, 0, ... 03239 452 NtContinue (1244264, 0, ... 03240 452 NtContinue (1244264, 0, ... 03241 452 NtContinue (1244264, 0, ... 03242 452 NtContinue (1244264, 0, ... 03243 452 NtContinue (1244264, 0, ... 03244 452 NtContinue (1244264, 0, ... 03245 452 NtContinue (1244264, 0, ... 03246 452 NtContinue (1244264, 0, ... 03247 452 NtContinue (1244264, 0, ... 03248 452 NtContinue (1244264, 0, ... 03249 452 NtContinue (1244264, 0, ... 03250 452 NtContinue (1244264, 0, ... 03251 452 NtContinue (1244264, 0, ... 03252 452 NtContinue (1244264, 0, ... 03253 452 NtContinue (1244264, 0, ... 03254 452 NtContinue (1244264, 0, ... 03255 452 NtContinue (1244264, 0, ... 03256 452 NtContinue (1244264, 0, ... 03257 452 NtContinue (1244264, 0, ... 03258 452 NtContinue (1244264, 0, ... 03259 452 NtContinue (1244264, 0, ... 03260 452 NtContinue (1244264, 0, ... 03261 452 NtContinue (1244264, 0, ... 03262 452 NtContinue (1244264, 0, ... 03263 452 NtContinue (1244264, 0, ... 03264 452 NtContinue (1244264, 0, ... 03265 452 NtContinue (1244264, 0, ... 03266 452 NtContinue (1244264, 0, ... 03267 452 NtContinue (1244264, 0, ... 03268 452 NtContinue (1244264, 0, ... 03269 452 NtContinue (1244264, 0, ... 03270 452 NtContinue (1244264, 0, ... 03271 452 NtContinue (1244264, 0, ... 03272 452 NtContinue (1244264, 0, ... 03273 452 NtContinue (1244264, 0, ... 03274 452 NtContinue (1244264, 0, ... 03275 452 NtContinue (1244264, 0, ... 03276 452 NtContinue (1244264, 0, ... 03277 452 NtContinue (1244264, 0, ... 03278 452 NtContinue (1244264, 0, ... 03279 452 NtContinue (1244264, 0, ... 03280 452 NtContinue (1244264, 0, ... 03281 452 NtContinue (1244264, 0, ... 03282 452 NtContinue (1244264, 0, ... 03283 452 NtContinue (1244264, 0, ... 03284 452 NtContinue (1244264, 0, ... 03285 452 NtContinue (1244264, 0, ... 03286 452 NtContinue (1244264, 0, ... 03287 452 NtContinue (1244264, 0, ... 03288 452 NtContinue (1244264, 0, ... 03289 452 NtContinue (1244264, 0, ... 03290 452 NtContinue (1244264, 0, ... 03291 452 NtContinue (1244264, 0, ... 03292 452 NtContinue (1244264, 0, ... 03293 452 NtContinue (1244264, 0, ... 03294 452 NtContinue (1244264, 0, ... 03295 452 NtContinue (1244264, 0, ... 03296 452 NtContinue (1244264, 0, ... 03297 452 NtContinue (1244264, 0, ... 03298 452 NtContinue (1244264, 0, ... 03299 452 NtContinue (1244264, 0, ... 03300 452 NtContinue (1244264, 0, ... 03301 452 NtContinue (1244264, 0, ... 03302 452 NtContinue (1244264, 0, ... 03303 452 NtContinue (1244264, 0, ... 03304 452 NtContinue (1244264, 0, ... 03305 452 NtContinue (1244264, 0, ... 03306 452 NtContinue (1244264, 0, ... 03307 452 NtContinue (1244264, 0, ... 03308 452 NtContinue (1244264, 0, ... 03309 452 NtContinue (1244264, 0, ... 03310 452 NtContinue (1244264, 0, ... 03311 452 NtContinue (1244264, 0, ... 03312 452 NtContinue (1244264, 0, ... 03313 452 NtContinue (1244264, 0, ... 03314 452 NtContinue (1244264, 0, ... 03315 452 NtContinue (1244264, 0, ... 03316 452 NtContinue (1244264, 0, ... 03317 452 NtContinue (1244264, 0, ... 03318 452 NtContinue (1244264, 0, ... 03319 452 NtContinue (1244264, 0, ... 03320 452 NtContinue (1244264, 0, ... 03321 452 NtContinue (1244264, 0, ... 03322 452 NtContinue (1244264, 0, ... 03323 452 NtContinue (1244264, 0, ... 03324 452 NtContinue (1244264, 0, ... 03325 452 NtContinue (1244264, 0, ... 03326 452 NtContinue (1244264, 0, ... 03327 452 NtContinue (1244264, 0, ... 03328 452 NtContinue (1244264, 0, ... 03329 452 NtContinue (1244264, 0, ... 03330 452 NtContinue (1244264, 0, ... 03331 452 NtContinue (1244264, 0, ... 03332 452 NtContinue (1244264, 0, ... 03333 452 NtContinue (1244264, 0, ... 03334 452 NtContinue (1244264, 0, ... 03335 452 NtContinue (1244264, 0, ... 03336 452 NtContinue (1244264, 0, ... 03337 452 NtContinue (1244264, 0, ... 03338 452 NtContinue (1244264, 0, ... 03339 452 NtContinue (1244264, 0, ... 03340 452 NtContinue (1244264, 0, ... 03341 452 NtContinue (1244264, 0, ... 03342 452 NtContinue (1244264, 0, ... 03343 452 NtContinue (1244264, 0, ... 03344 452 NtContinue (1244264, 0, ... 03345 452 NtContinue (1244264, 0, ... 03346 452 NtContinue (1244264, 0, ... 03347 452 NtContinue (1244264, 0, ... 03348 452 NtContinue (1244264, 0, ... 03349 452 NtContinue (1244264, 0, ... 03350 452 NtContinue (1244264, 0, ... 03351 452 NtContinue (1244264, 0, ... 03352 452 NtContinue (1244264, 0, ... 03353 452 NtContinue (1244264, 0, ... 03354 452 NtContinue (1244264, 0, ... 03355 452 NtContinue (1244264, 0, ... 03356 452 NtContinue (1244264, 0, ... 03357 452 NtContinue (1244264, 0, ... 03358 452 NtContinue (1244264, 0, ... 03359 452 NtContinue (1244264, 0, ... 03360 452 NtContinue (1244264, 0, ... 03361 452 NtContinue (1244264, 0, ... 03362 452 NtContinue (1244264, 0, ... 03363 452 NtContinue (1244264, 0, ... 03364 452 NtContinue (1244264, 0, ... 03365 452 NtContinue (1244264, 0, ... 03366 452 NtContinue (1244264, 0, ... 03367 452 NtContinue (1244264, 0, ... 03368 452 NtContinue (1244264, 0, ... 03369 452 NtContinue (1244264, 0, ... 03370 452 NtContinue (1244264, 0, ... 03371 452 NtContinue (1244264, 0, ... 03372 452 NtContinue (1244264, 0, ... 03373 452 NtContinue (1244264, 0, ... 03374 452 NtContinue (1244264, 0, ... 03375 452 NtContinue (1244264, 0, ... 03376 452 NtContinue (1244264, 0, ... 03377 452 NtContinue (1244264, 0, ... 03378 452 NtContinue (1244264, 0, ... 03379 452 NtContinue (1244264, 0, ... 03380 452 NtContinue (1244264, 0, ... 03381 452 NtContinue (1244264, 0, ... 03382 452 NtContinue (1244264, 0, ... 03383 452 NtContinue (1244264, 0, ... 03384 452 NtContinue (1244264, 0, ... 03385 452 NtContinue (1244264, 0, ... 03386 452 NtContinue (1244264, 0, ... 03387 452 NtContinue (1244264, 0, ... 03388 452 NtContinue (1244264, 0, ... 03389 452 NtContinue (1244264, 0, ... 03390 452 NtContinue (1244264, 0, ... 03391 452 NtContinue (1244264, 0, ... 03392 452 NtContinue (1244264, 0, ... 03393 452 NtContinue (1244264, 0, ... 03394 452 NtContinue (1244264, 0, ... 03395 452 NtContinue (1244264, 0, ... 03396 452 NtContinue (1244264, 0, ... 03397 452 NtContinue (1244264, 0, ... 03398 452 NtContinue (1244264, 0, ... 03399 452 NtContinue (1244264, 0, ... 03400 452 NtContinue (1244264, 0, ... 03401 452 NtContinue (1244264, 0, ... 03402 452 NtContinue (1244264, 0, ... 03403 452 NtContinue (1244264, 0, ... 03404 452 NtContinue (1244264, 0, ... 03405 452 NtContinue (1244264, 0, ... 03406 452 NtContinue (1244264, 0, ... 03407 452 NtContinue (1244264, 0, ... 03408 452 NtContinue (1244264, 0, ... 03409 452 NtContinue (1244264, 0, ... 03410 452 NtContinue (1244264, 0, ... 03411 452 NtContinue (1244264, 0, ... 03412 452 NtContinue (1244264, 0, ... 03413 452 NtContinue (1244264, 0, ... 03414 452 NtContinue (1244264, 0, ... 03415 452 NtContinue (1244264, 0, ... 03416 452 NtContinue (1244264, 0, ... 03417 452 NtContinue (1244264, 0, ... 03418 452 NtContinue (1244264, 0, ... 03419 452 NtContinue (1244264, 0, ... 03420 452 NtContinue (1244264, 0, ... 03421 452 NtContinue (1244264, 0, ... 03422 452 NtContinue (1244264, 0, ... 03423 452 NtContinue (1244264, 0, ... 03424 452 NtContinue (1244264, 0, ... 03425 452 NtContinue (1244264, 0, ... 03426 452 NtContinue (1244264, 0, ... 03427 452 NtContinue (1244264, 0, ... 03428 452 NtContinue (1244264, 0, ... 03429 452 NtContinue (1244264, 0, ... 03430 452 NtContinue (1244264, 0, ... 03431 452 NtContinue (1244264, 0, ... 03432 452 NtContinue (1244264, 0, ... 03433 452 NtContinue (1244264, 0, ... 03434 452 NtContinue (1244264, 0, ... 03435 452 NtContinue (1244264, 0, ... 03436 452 NtContinue (1244264, 0, ... 03437 452 NtContinue (1244264, 0, ... 03438 452 NtContinue (1244264, 0, ... 03439 452 NtContinue (1244264, 0, ... 03440 452 NtContinue (1244264, 0, ... 03441 452 NtContinue (1244264, 0, ... 03442 452 NtContinue (1244264, 0, ... 03443 452 NtContinue (1244264, 0, ... 03444 452 NtContinue (1244264, 0, ... 03445 452 NtContinue (1244264, 0, ... 03446 452 NtContinue (1244264, 0, ... 03447 452 NtContinue (1244264, 0, ... 03448 452 NtContinue (1244264, 0, ... 03449 452 NtContinue (1244264, 0, ... 03450 452 NtContinue (1244264, 0, ... 03451 452 NtContinue (1244264, 0, ... 03452 452 NtContinue (1244264, 0, ... 03453 452 NtContinue (1244264, 0, ... 03454 452 NtContinue (1244264, 0, ... 03455 452 NtContinue (1244264, 0, ... 03456 452 NtContinue (1244264, 0, ... 03457 452 NtContinue (1244264, 0, ... 03458 452 NtContinue (1244264, 0, ... 03459 452 NtContinue (1244264, 0, ... 03460 452 NtContinue (1244264, 0, ... 03461 452 NtContinue (1244264, 0, ... 03462 452 NtContinue (1244264, 0, ... 03463 452 NtContinue (1244264, 0, ... 03464 452 NtContinue (1244264, 0, ... 03465 452 NtContinue (1244264, 0, ... 03466 452 NtContinue (1244264, 0, ... 03467 452 NtContinue (1244264, 0, ... 03468 452 NtContinue (1244264, 0, ... 03469 452 NtContinue (1244264, 0, ... 03470 452 NtContinue (1244264, 0, ... 03471 452 NtContinue (1244264, 0, ... 03472 452 NtContinue (1244264, 0, ... 03473 452 NtContinue (1244264, 0, ... 03474 452 NtContinue (1244264, 0, ... 03475 452 NtContinue (1244264, 0, ... 03476 452 NtContinue (1244264, 0, ... 03477 452 NtContinue (1244264, 0, ... 03478 452 NtContinue (1244264, 0, ... 03479 452 NtContinue (1244264, 0, ... 03480 452 NtContinue (1244264, 0, ... 03481 452 NtContinue (1244264, 0, ... 03482 452 NtContinue (1244264, 0, ... 03483 452 NtContinue (1244264, 0, ... 03484 452 NtContinue (1244264, 0, ... 03485 452 NtContinue (1244264, 0, ... 03486 452 NtContinue (1244264, 0, ... 03487 452 NtContinue (1244264, 0, ... 03488 452 NtContinue (1244264, 0, ... 03489 452 NtContinue (1244264, 0, ... 03490 452 NtContinue (1244264, 0, ... 03491 452 NtContinue (1244264, 0, ... 03492 452 NtContinue (1244264, 0, ... 03493 452 NtContinue (1244264, 0, ... 03494 452 NtContinue (1244264, 0, ... 03495 452 NtContinue (1244264, 0, ... 03496 452 NtContinue (1244264, 0, ... 03497 452 NtContinue (1244264, 0, ... 03498 452 NtContinue (1244264, 0, ... 03499 452 NtContinue (1244264, 0, ... 03500 452 NtContinue (1244264, 0, ... 03501 452 NtContinue (1244264, 0, ... 03502 452 NtContinue (1244264, 0, ... 03503 452 NtContinue (1244264, 0, ... 03504 452 NtContinue (1244264, 0, ... 03505 452 NtContinue (1244264, 0, ... 03506 452 NtContinue (1244264, 0, ... 03507 452 NtContinue (1244264, 0, ... 03508 452 NtContinue (1244264, 0, ... 03509 452 NtContinue (1244264, 0, ... 03510 452 NtContinue (1244264, 0, ... 03511 452 NtContinue (1244264, 0, ... 03512 452 NtContinue (1244264, 0, ... 03513 452 NtContinue (1244264, 0, ... 03514 452 NtContinue (1244264, 0, ... 03515 452 NtContinue (1244264, 0, ... 03516 452 NtContinue (1244264, 0, ... 03517 452 NtContinue (1244264, 0, ... 03518 452 NtContinue (1244264, 0, ... 03519 452 NtContinue (1244264, 0, ... 03520 452 NtContinue (1244264, 0, ... 03521 452 NtContinue (1244264, 0, ... 03522 452 NtContinue (1244264, 0, ... 03523 452 NtContinue (1244264, 0, ... 03524 452 NtContinue (1244264, 0, ... 03525 452 NtContinue (1244264, 0, ... 03526 452 NtContinue (1244264, 0, ... 03527 452 NtContinue (1244264, 0, ... 03528 452 NtContinue (1244264, 0, ... 03529 452 NtContinue (1244264, 0, ... 03530 452 NtContinue (1244264, 0, ... 03531 452 NtContinue (1244264, 0, ... 03532 452 NtContinue (1244264, 0, ... 03533 452 NtContinue (1244264, 0, ... 03534 452 NtContinue (1244264, 0, ... 03535 452 NtContinue (1244264, 0, ... 03536 452 NtContinue (1244264, 0, ... 03537 452 NtContinue (1244264, 0, ... 03538 452 NtContinue (1244264, 0, ... 03539 452 NtContinue (1244264, 0, ... 03540 452 NtContinue (1244264, 0, ... 03541 452 NtContinue (1244264, 0, ... 03542 452 NtContinue (1244264, 0, ... 03543 452 NtContinue (1244264, 0, ... 03544 452 NtContinue (1244264, 0, ... 03545 452 NtContinue (1244264, 0, ... 03546 452 NtContinue (1244264, 0, ... 03547 452 NtContinue (1244264, 0, ... 03548 452 NtContinue (1244264, 0, ... 03549 452 NtContinue (1244264, 0, ... 03550 452 NtContinue (1244264, 0, ... 03551 452 NtContinue (1244264, 0, ... 03552 452 NtContinue (1244264, 0, ... 03553 452 NtContinue (1244264, 0, ... 03554 452 NtContinue (1244264, 0, ... 03555 452 NtContinue (1244264, 0, ... 03556 452 NtContinue (1244264, 0, ... 03557 452 NtContinue (1244264, 0, ... 03558 452 NtContinue (1244264, 0, ... 03559 452 NtContinue (1244264, 0, ... 03560 452 NtContinue (1244264, 0, ... 03561 452 NtContinue (1244264, 0, ... 03562 452 NtContinue (1244264, 0, ... 03563 452 NtContinue (1244264, 0, ... 03564 452 NtContinue (1244264, 0, ... 03565 452 NtContinue (1244264, 0, ... 03566 452 NtContinue (1244264, 0, ... 03567 452 NtContinue (1244264, 0, ... 03568 452 NtContinue (1244264, 0, ... 03569 452 NtContinue (1244264, 0, ... 03570 452 NtContinue (1244264, 0, ... 03571 452 NtContinue (1244264, 0, ... 03572 452 NtContinue (1244264, 0, ... 03573 452 NtContinue (1244264, 0, ... 03574 452 NtContinue (1244264, 0, ... 03575 452 NtContinue (1244264, 0, ... 03576 452 NtContinue (1244264, 0, ... 03577 452 NtContinue (1244264, 0, ... 03578 452 NtContinue (1244264, 0, ... 03579 452 NtContinue (1244264, 0, ... 03580 452 NtContinue (1244264, 0, ... 03581 452 NtContinue (1244264, 0, ... 03582 452 NtContinue (1244264, 0, ... 03583 452 NtContinue (1244264, 0, ... 03584 452 NtContinue (1244264, 0, ... 03585 452 NtContinue (1244264, 0, ... 03586 452 NtContinue (1244264, 0, ... 03587 452 NtContinue (1244264, 0, ... 03588 452 NtContinue (1244264, 0, ... 03589 452 NtContinue (1244264, 0, ... 03590 452 NtContinue (1244264, 0, ... 03591 452 NtContinue (1244264, 0, ... 03592 452 NtContinue (1244264, 0, ... 03593 452 NtContinue (1244264, 0, ... 03594 452 NtContinue (1244264, 0, ... 03595 452 NtContinue (1244264, 0, ... 03596 452 NtContinue (1244264, 0, ... 03597 452 NtContinue (1244264, 0, ... 03598 452 NtContinue (1244264, 0, ... 03599 452 NtContinue (1244264, 0, ... 03600 452 NtContinue (1244264, 0, ... 03601 452 NtContinue (1244264, 0, ... 03602 452 NtContinue (1244264, 0, ... 03603 452 NtContinue (1244264, 0, ... 03604 452 NtContinue (1244264, 0, ... 03605 452 NtContinue (1244264, 0, ... 03606 452 NtContinue (1244264, 0, ... 03607 452 NtContinue (1244264, 0, ... 03608 452 NtContinue (1244264, 0, ... 03609 452 NtContinue (1244264, 0, ... 03610 452 NtContinue (1244264, 0, ... 03611 452 NtContinue (1244264, 0, ... 03612 452 NtContinue (1244264, 0, ... 03613 452 NtContinue (1244264, 0, ... 03614 452 NtContinue (1244264, 0, ... 03615 452 NtContinue (1244264, 0, ... 03616 452 NtContinue (1244264, 0, ... 03617 452 NtContinue (1244264, 0, ... 03618 452 NtContinue (1244264, 0, ... 03619 452 NtContinue (1244264, 0, ... 03620 452 NtContinue (1244264, 0, ... 03621 452 NtContinue (1244264, 0, ... 03622 452 NtContinue (1244264, 0, ... 03623 452 NtContinue (1244264, 0, ... 03624 452 NtContinue (1244264, 0, ... 03625 452 NtContinue (1244264, 0, ... 03626 452 NtContinue (1244264, 0, ... 03627 452 NtContinue (1244264, 0, ... 03628 452 NtContinue (1244264, 0, ... 03629 452 NtContinue (1244264, 0, ... 03630 452 NtContinue (1244264, 0, ... 03631 452 NtContinue (1244264, 0, ... 03632 452 NtContinue (1244264, 0, ... 03633 452 NtContinue (1244264, 0, ... 03634 452 NtContinue (1244264, 0, ... 03635 452 NtContinue (1244264, 0, ... 03636 452 NtContinue (1244264, 0, ... 03637 452 NtContinue (1244264, 0, ... 03638 452 NtContinue (1244264, 0, ... 03639 452 NtContinue (1244264, 0, ... 03640 452 NtContinue (1244264, 0, ... 03641 452 NtContinue (1244264, 0, ... 03642 452 NtContinue (1244264, 0, ... 03643 452 NtContinue (1244264, 0, ... 03644 452 NtContinue (1244264, 0, ... 03645 452 NtContinue (1244264, 0, ... 03646 452 NtContinue (1244264, 0, ... 03647 452 NtContinue (1244264, 0, ... 03648 452 NtContinue (1244264, 0, ... 03649 452 NtContinue (1244264, 0, ... 03650 452 NtContinue (1244264, 0, ... 03651 452 NtContinue (1244264, 0, ... 03652 452 NtContinue (1244264, 0, ... 03653 452 NtContinue (1244264, 0, ... 03654 452 NtContinue (1244264, 0, ... 03655 452 NtContinue (1244264, 0, ... 03656 452 NtContinue (1244264, 0, ... 03657 452 NtContinue (1244264, 0, ... 03658 452 NtContinue (1244264, 0, ... 03659 452 NtContinue (1244264, 0, ... 03660 452 NtContinue (1244264, 0, ... 03661 452 NtContinue (1244264, 0, ... 03662 452 NtContinue (1244264, 0, ... 03663 452 NtContinue (1244264, 0, ... 03664 452 NtContinue (1244264, 0, ... 03665 452 NtContinue (1244264, 0, ... 03666 452 NtContinue (1244264, 0, ... 03667 452 NtContinue (1244264, 0, ... 03668 452 NtContinue (1244264, 0, ... 03669 452 NtContinue (1244264, 0, ... 03670 452 NtContinue (1244264, 0, ... 03671 452 NtContinue (1244264, 0, ... 03672 452 NtContinue (1244264, 0, ... 03673 452 NtContinue (1244264, 0, ... 03674 452 NtContinue (1244264, 0, ... 03675 452 NtContinue (1244264, 0, ... 03676 452 NtContinue (1244264, 0, ... 03677 452 NtContinue (1244264, 0, ... 03678 452 NtContinue (1244264, 0, ... 03679 452 NtContinue (1244264, 0, ... 03680 452 NtContinue (1244264, 0, ... 03681 452 NtContinue (1244264, 0, ... 03682 452 NtContinue (1244264, 0, ... 03683 452 NtContinue (1244264, 0, ... 03684 452 NtContinue (1244264, 0, ... 03685 452 NtContinue (1244264, 0, ... 03686 452 NtContinue (1244264, 0, ... 03687 452 NtContinue (1244264, 0, ... 03688 452 NtContinue (1244264, 0, ... 03689 452 NtContinue (1244264, 0, ... 03690 452 NtContinue (1244264, 0, ... 03691 452 NtContinue (1244264, 0, ... 03692 452 NtContinue (1244264, 0, ... 03693 452 NtContinue (1244264, 0, ... 03694 452 NtContinue (1244264, 0, ... 03695 452 NtContinue (1244264, 0, ... 03696 452 NtContinue (1244264, 0, ... 03697 452 NtContinue (1244264, 0, ... 03698 452 NtContinue (1244264, 0, ... 03699 452 NtContinue (1244264, 0, ... 03700 452 NtContinue (1244264, 0, ... 03701 452 NtContinue (1244264, 0, ... 03702 452 NtContinue (1244264, 0, ... 03703 452 NtContinue (1244264, 0, ... 03704 452 NtContinue (1244264, 0, ... 03705 452 NtContinue (1244264, 0, ... 03706 452 NtContinue (1244264, 0, ... 03707 452 NtContinue (1244264, 0, ... 03708 452 NtContinue (1244264, 0, ... 03709 452 NtContinue (1244264, 0, ... 03710 452 NtContinue (1244264, 0, ... 03711 452 NtContinue (1244264, 0, ... 03712 452 NtContinue (1244264, 0, ... 03713 452 NtContinue (1244264, 0, ... 03714 452 NtContinue (1244264, 0, ... 03715 452 NtContinue (1244264, 0, ... 03716 452 NtContinue (1244264, 0, ... 03717 452 NtContinue (1244264, 0, ... 03718 452 NtContinue (1244264, 0, ... 03719 452 NtContinue (1244264, 0, ... 03720 452 NtContinue (1244264, 0, ... 03721 452 NtContinue (1244264, 0, ... 03722 452 NtContinue (1244264, 0, ... 03723 452 NtContinue (1244264, 0, ... 03724 452 NtContinue (1244264, 0, ... 03725 452 NtContinue (1244264, 0, ... 03726 452 NtContinue (1244264, 0, ... 03727 452 NtContinue (1244264, 0, ... 03728 452 NtContinue (1244264, 0, ... 03729 452 NtContinue (1244264, 0, ... 03730 452 NtContinue (1244264, 0, ... 03731 452 NtContinue (1244264, 0, ... 03732 452 NtContinue (1244264, 0, ... 03733 452 NtContinue (1244264, 0, ... 03734 452 NtContinue (1244264, 0, ... 03735 452 NtContinue (1244264, 0, ... 03736 452 NtContinue (1244264, 0, ... 03737 452 NtContinue (1244264, 0, ... 03738 452 NtContinue (1244264, 0, ... 03739 452 NtContinue (1244264, 0, ... 03740 452 NtContinue (1244264, 0, ... 03741 452 NtContinue (1244264, 0, ... 03742 452 NtContinue (1244264, 0, ... 03743 452 NtContinue (1244264, 0, ... 03744 452 NtContinue (1244264, 0, ... 03745 452 NtContinue (1244264, 0, ... 03746 452 NtContinue (1244264, 0, ... 03747 452 NtContinue (1244264, 0, ... 03748 452 NtContinue (1244264, 0, ... 03749 452 NtContinue (1244264, 0, ... 03750 452 NtContinue (1244264, 0, ... 03751 452 NtContinue (1244264, 0, ... 03752 452 NtContinue (1244264, 0, ... 03753 452 NtContinue (1244264, 0, ... 03754 452 NtContinue (1244264, 0, ... 03755 452 NtContinue (1244264, 0, ... 03756 452 NtContinue (1244264, 0, ... 03757 452 NtContinue (1244264, 0, ... 03758 452 NtContinue (1244264, 0, ... 03759 452 NtContinue (1244264, 0, ... 03760 452 NtContinue (1244264, 0, ... 03761 452 NtContinue (1244264, 0, ... 03762 452 NtContinue (1244264, 0, ... 03763 452 NtContinue (1244264, 0, ... 03764 452 NtContinue (1244264, 0, ... 03765 452 NtContinue (1244264, 0, ... 03766 452 NtContinue (1244264, 0, ... 03767 452 NtContinue (1244264, 0, ... 03768 452 NtContinue (1244264, 0, ... 03769 452 NtContinue (1244264, 0, ... 03770 452 NtContinue (1244264, 0, ... 03771 452 NtContinue (1244264, 0, ... 03772 452 NtContinue (1244264, 0, ... 03773 452 NtContinue (1244264, 0, ... 03774 452 NtContinue (1244264, 0, ... 03775 452 NtContinue (1244264, 0, ... 03776 452 NtContinue (1244264, 0, ... 03777 452 NtContinue (1244264, 0, ... 03778 452 NtContinue (1244264, 0, ... 03779 452 NtContinue (1244264, 0, ... 03780 452 NtContinue (1244264, 0, ... 03781 452 NtContinue (1244264, 0, ... 03782 452 NtContinue (1244264, 0, ... 03783 452 NtContinue (1244264, 0, ... 03784 452 NtContinue (1244264, 0, ... 03785 452 NtContinue (1244264, 0, ... 03786 452 NtContinue (1244264, 0, ... 03787 452 NtContinue (1244264, 0, ... 03788 452 NtContinue (1244264, 0, ... 03789 452 NtContinue (1244264, 0, ... 03790 452 NtContinue (1244264, 0, ... 03791 452 NtContinue (1244264, 0, ... 03792 452 NtContinue (1244264, 0, ... 03793 452 NtContinue (1244264, 0, ... 03794 452 NtContinue (1244264, 0, ... 03795 452 NtContinue (1244264, 0, ... 03796 452 NtContinue (1244264, 0, ... 03797 452 NtContinue (1244264, 0, ... 03798 452 NtContinue (1244264, 0, ... 03799 452 NtContinue (1244264, 0, ... 03800 452 NtContinue (1244264, 0, ... 03801 452 NtContinue (1244264, 0, ... 03802 452 NtContinue (1244264, 0, ... 03803 452 NtContinue (1244264, 0, ... 03804 452 NtContinue (1244264, 0, ... 03805 452 NtContinue (1244264, 0, ... 03806 452 NtContinue (1244264, 0, ... 03807 452 NtContinue (1244264, 0, ... 03808 452 NtContinue (1244264, 0, ... 03809 452 NtContinue (1244264, 0, ... 03810 452 NtContinue (1244264, 0, ... 03811 452 NtContinue (1244264, 0, ... 03812 452 NtContinue (1244264, 0, ... 03813 452 NtContinue (1244264, 0, ... 03814 452 NtContinue (1244264, 0, ... 03815 452 NtContinue (1244264, 0, ... 03816 452 NtContinue (1244264, 0, ... 03817 452 NtContinue (1244264, 0, ... 03818 452 NtContinue (1244264, 0, ... 03819 452 NtContinue (1244264, 0, ... 03820 452 NtContinue (1244264, 0, ... 03821 452 NtContinue (1244264, 0, ... 03822 452 NtContinue (1244264, 0, ... 03823 452 NtContinue (1244264, 0, ... 03824 452 NtContinue (1244264, 0, ... 03825 452 NtContinue (1244264, 0, ... 03826 452 NtContinue (1244264, 0, ... 03827 452 NtContinue (1244264, 0, ... 03828 452 NtContinue (1244264, 0, ... 03829 452 NtContinue (1244264, 0, ... 03830 452 NtContinue (1244264, 0, ... 03831 452 NtContinue (1244264, 0, ... 03832 452 NtContinue (1244264, 0, ... 03833 452 NtContinue (1244264, 0, ... 03834 452 NtContinue (1244264, 0, ... 03835 452 NtContinue (1244264, 0, ... 03836 452 NtContinue (1244264, 0, ... 03837 452 NtContinue (1244264, 0, ... 03838 452 NtContinue (1244264, 0, ... 03839 452 NtContinue (1244264, 0, ... 03840 452 NtContinue (1244264, 0, ... 03841 452 NtContinue (1244264, 0, ... 03842 452 NtContinue (1244264, 0, ... 03843 452 NtContinue (1244264, 0, ... 03844 452 NtContinue (1244264, 0, ... 03845 452 NtContinue (1244264, 0, ... 03846 452 NtContinue (1244264, 0, ... 03847 452 NtContinue (1244264, 0, ... 03848 452 NtContinue (1244264, 0, ... 03849 452 NtContinue (1244264, 0, ... 03850 452 NtContinue (1244264, 0, ... 03851 452 NtContinue (1244264, 0, ... 03852 452 NtContinue (1244264, 0, ... 03853 452 NtContinue (1244264, 0, ... 03854 452 NtContinue (1244264, 0, ... 03855 452 NtContinue (1244264, 0, ... 03856 452 NtContinue (1244264, 0, ... 03857 452 NtContinue (1244264, 0, ... 03858 452 NtContinue (1244264, 0, ... 03859 452 NtContinue (1244264, 0, ... 03860 452 NtContinue (1244264, 0, ... 03861 452 NtContinue (1244264, 0, ... 03862 452 NtContinue (1244264, 0, ... 03863 452 NtContinue (1244264, 0, ... 03864 452 NtContinue (1244264, 0, ... 03865 452 NtContinue (1244264, 0, ... 03866 452 NtContinue (1244264, 0, ... 03867 452 NtContinue (1244264, 0, ... 03868 452 NtContinue (1244264, 0, ... 03869 452 NtContinue (1244264, 0, ... 03870 452 NtContinue (1244264, 0, ... 03871 452 NtContinue (1244264, 0, ... 03872 452 NtContinue (1244264, 0, ... 03873 452 NtContinue (1244264, 0, ... 03874 452 NtContinue (1244264, 0, ... 03875 452 NtContinue (1244264, 0, ... 03876 452 NtContinue (1244264, 0, ... 03877 452 NtContinue (1244264, 0, ... 03878 452 NtContinue (1244264, 0, ... 03879 452 NtContinue (1244264, 0, ... 03880 452 NtContinue (1244264, 0, ... 03881 452 NtContinue (1244264, 0, ... 03882 452 NtContinue (1244264, 0, ... 03883 452 NtContinue (1244264, 0, ... 03884 452 NtContinue (1244264, 0, ... 03885 452 NtContinue (1244264, 0, ... 03886 452 NtContinue (1244264, 0, ... 03887 452 NtContinue (1244264, 0, ... 03888 452 NtContinue (1244264, 0, ... 03889 452 NtContinue (1244264, 0, ... 03890 452 NtContinue (1244264, 0, ... 03891 452 NtContinue (1244264, 0, ... 03892 452 NtContinue (1244264, 0, ... 03893 452 NtContinue (1244264, 0, ... 03894 452 NtContinue (1244264, 0, ... 03895 452 NtContinue (1244264, 0, ... 03896 452 NtContinue (1244264, 0, ... 03897 452 NtContinue (1244264, 0, ... 03898 452 NtContinue (1244264, 0, ... 03899 452 NtContinue (1244264, 0, ... 03900 452 NtContinue (1244264, 0, ... 03901 452 NtContinue (1244264, 0, ... 03902 452 NtContinue (1244264, 0, ... 03903 452 NtContinue (1244264, 0, ... 03904 452 NtContinue (1244264, 0, ... 03905 452 NtContinue (1244264, 0, ... 03906 452 NtContinue (1244264, 0, ... 03907 452 NtContinue (1244264, 0, ... 03908 452 NtContinue (1244264, 0, ... 03909 452 NtContinue (1244264, 0, ... 03910 452 NtContinue (1244264, 0, ... 03911 452 NtContinue (1244264, 0, ... 03912 452 NtContinue (1244264, 0, ... 03913 452 NtContinue (1244264, 0, ... 03914 452 NtContinue (1244264, 0, ... 03915 452 NtContinue (1244264, 0, ... 03916 452 NtContinue (1244264, 0, ... 03917 452 NtContinue (1244264, 0, ... 03918 452 NtContinue (1244264, 0, ... 03919 452 NtContinue (1244264, 0, ... 03920 452 NtContinue (1244264, 0, ... 03921 452 NtContinue (1244264, 0, ... 03922 452 NtContinue (1244264, 0, ... 03923 452 NtContinue (1244264, 0, ... 03924 452 NtContinue (1244264, 0, ... 03925 452 NtContinue (1244264, 0, ... 03926 452 NtContinue (1244264, 0, ... 03927 452 NtContinue (1244264, 0, ... 03928 452 NtContinue (1244264, 0, ... 03929 452 NtContinue (1244264, 0, ... 03930 452 NtContinue (1244264, 0, ... 03931 452 NtContinue (1244264, 0, ... 03932 452 NtContinue (1244264, 0, ... 03933 452 NtContinue (1244264, 0, ... 03934 452 NtContinue (1244264, 0, ... 03935 452 NtContinue (1244264, 0, ... 03936 452 NtContinue (1244264, 0, ... 03937 452 NtContinue (1244264, 0, ... 03938 452 NtContinue (1244264, 0, ... 03939 452 NtContinue (1244264, 0, ... 03940 452 NtContinue (1244264, 0, ... 03941 452 NtContinue (1244264, 0, ... 03942 452 NtContinue (1244264, 0, ... 03943 452 NtContinue (1244264, 0, ... 03944 452 NtContinue (1244264, 0, ... 03945 452 NtContinue (1244264, 0, ... 03946 452 NtContinue (1244264, 0, ... 03947 452 NtContinue (1244264, 0, ... 03948 452 NtContinue (1244264, 0, ... 03949 452 NtContinue (1244264, 0, ... 03950 452 NtContinue (1244264, 0, ... 03951 452 NtContinue (1244264, 0, ... 03952 452 NtContinue (1244264, 0, ... 03953 452 NtContinue (1244264, 0, ... 03954 452 NtContinue (1244264, 0, ... 03955 452 NtContinue (1244264, 0, ... 03956 452 NtContinue (1244264, 0, ... 03957 452 NtContinue (1244264, 0, ... 03958 452 NtContinue (1244264, 0, ... 03959 452 NtContinue (1244264, 0, ... 03960 452 NtContinue (1244264, 0, ... 03961 452 NtContinue (1244264, 0, ... 03962 452 NtContinue (1244264, 0, ... 03963 452 NtContinue (1244264, 0, ... 03964 452 NtContinue (1244264, 0, ... 03965 452 NtContinue (1244264, 0, ... 03966 452 NtContinue (1244264, 0, ... 03967 452 NtContinue (1244264, 0, ... 03968 452 NtContinue (1244264, 0, ... 03969 452 NtContinue (1244264, 0, ... 03970 452 NtContinue (1244264, 0, ... 03971 452 NtContinue (1244264, 0, ... 03972 452 NtContinue (1244264, 0, ... 03973 452 NtContinue (1244264, 0, ... 03974 452 NtContinue (1244264, 0, ... 03975 452 NtContinue (1244264, 0, ... 03976 452 NtContinue (1244264, 0, ... 03977 452 NtContinue (1244264, 0, ... 03978 452 NtContinue (1244264, 0, ... 03979 452 NtContinue (1244264, 0, ... 03980 452 NtContinue (1244264, 0, ... 03981 452 NtContinue (1244264, 0, ... 03982 452 NtContinue (1244264, 0, ... 03983 452 NtContinue (1244264, 0, ... 03984 452 NtContinue (1244264, 0, ... 03985 452 NtContinue (1244264, 0, ... 03986 452 NtContinue (1244264, 0, ... 03987 452 NtContinue (1244264, 0, ... 03988 452 NtContinue (1244264, 0, ... 03989 452 NtContinue (1244264, 0, ... 03990 452 NtContinue (1244264, 0, ... 03991 452 NtContinue (1244264, 0, ... 03992 452 NtContinue (1244264, 0, ... 03993 452 NtContinue (1244264, 0, ... 03994 452 NtContinue (1244264, 0, ... 03995 452 NtContinue (1244264, 0, ... 03996 452 NtContinue (1244264, 0, ... 03997 452 NtContinue (1244264, 0, ... 03998 452 NtContinue (1244264, 0, ... 03999 452 NtContinue (1244264, 0, ... 04000 452 NtContinue (1244264, 0, ... 04001 452 NtContinue (1244264, 0, ... 04002 452 NtContinue (1244264, 0, ... 04003 452 NtContinue (1244264, 0, ... 04004 452 NtContinue (1244264, 0, ... 04005 452 NtContinue (1244264, 0, ... 04006 452 NtContinue (1244264, 0, ... 04007 452 NtContinue (1244264, 0, ... 04008 452 NtContinue (1244264, 0, ... 04009 452 NtContinue (1244264, 0, ... 04010 452 NtContinue (1244264, 0, ... 04011 452 NtContinue (1244264, 0, ... 04012 452 NtContinue (1244264, 0, ... 04013 452 NtContinue (1244264, 0, ... 04014 452 NtContinue (1244264, 0, ... 04015 452 NtContinue (1244264, 0, ... 04016 452 NtContinue (1244264, 0, ... 04017 452 NtContinue (1244264, 0, ... 04018 452 NtContinue (1244264, 0, ... 04019 452 NtContinue (1244264, 0, ... 04020 452 NtContinue (1244264, 0, ... 04021 452 NtContinue (1244264, 0, ... 04022 452 NtContinue (1244264, 0, ... 04023 452 NtContinue (1244264, 0, ... 04024 452 NtContinue (1244264, 0, ... 04025 452 NtContinue (1244264, 0, ... 04026 452 NtContinue (1244264, 0, ... 04027 452 NtContinue (1244264, 0, ... 04028 452 NtContinue (1244264, 0, ... 04029 452 NtContinue (1244264, 0, ... 04030 452 NtContinue (1244264, 0, ... 04031 452 NtContinue (1244264, 0, ... 04032 452 NtContinue (1244264, 0, ... 04033 452 NtContinue (1244264, 0, ... 04034 452 NtContinue (1244264, 0, ... 04035 452 NtContinue (1244264, 0, ... 04036 452 NtContinue (1244264, 0, ... 04037 452 NtContinue (1244264, 0, ... 04038 452 NtContinue (1244264, 0, ... 04039 452 NtContinue (1244264, 0, ... 04040 452 NtContinue (1244264, 0, ... 04041 452 NtContinue (1244264, 0, ... 04042 452 NtContinue (1244264, 0, ... 04043 452 NtContinue (1244264, 0, ... 04044 452 NtContinue (1244264, 0, ... 04045 452 NtContinue (1244264, 0, ... 04046 452 NtContinue (1244264, 0, ... 04047 452 NtContinue (1244264, 0, ... 04048 452 NtContinue (1244264, 0, ... 04049 452 NtContinue (1244264, 0, ... 04050 452 NtContinue (1244264, 0, ... 04051 452 NtContinue (1244264, 0, ... 04052 452 NtContinue (1244264, 0, ... 04053 452 NtContinue (1244264, 0, ... 04054 452 NtContinue (1244264, 0, ... 04055 452 NtContinue (1244264, 0, ... 04056 452 NtContinue (1244264, 0, ... 04057 452 NtContinue (1244264, 0, ... 04058 452 NtContinue (1244264, 0, ... 04059 452 NtContinue (1244264, 0, ... 04060 452 NtContinue (1244264, 0, ... 04061 452 NtContinue (1244264, 0, ... 04062 452 NtContinue (1244264, 0, ... 04063 452 NtContinue (1244264, 0, ... 04064 452 NtContinue (1244264, 0, ... 04065 452 NtContinue (1244264, 0, ... 04066 452 NtContinue (1244264, 0, ... 04067 452 NtContinue (1244264, 0, ... 04068 452 NtContinue (1244264, 0, ... 04069 452 NtContinue (1244264, 0, ... 04070 452 NtContinue (1244264, 0, ... 04071 452 NtContinue (1244264, 0, ... 04072 452 NtContinue (1244264, 0, ... 04073 452 NtContinue (1244264, 0, ... 04074 452 NtContinue (1244264, 0, ... 04075 452 NtContinue (1244264, 0, ... 04076 452 NtContinue (1244264, 0, ... 04077 452 NtContinue (1244264, 0, ... 04078 452 NtContinue (1244264, 0, ... 04079 452 NtContinue (1244264, 0, ... 04080 452 NtContinue (1244264, 0, ... 04081 452 NtContinue (1244264, 0, ... 04082 452 NtContinue (1244264, 0, ... 04083 452 NtContinue (1244264, 0, ... 04084 452 NtContinue (1244264, 0, ... 04085 452 NtContinue (1244264, 0, ... 04086 452 NtContinue (1244264, 0, ... 04087 452 NtContinue (1244264, 0, ... 04088 452 NtContinue (1244264, 0, ... 04089 452 NtContinue (1244264, 0, ... 04090 452 NtContinue (1244264, 0, ... 04091 452 NtContinue (1244264, 0, ... 04092 452 NtContinue (1244264, 0, ... 04093 452 NtContinue (1244264, 0, ... 04094 452 NtContinue (1244264, 0, ... 04095 452 NtContinue (1244264, 0, ... 04096 452 NtContinue (1244264, 0, ... 04097 452 NtContinue (1244264, 0, ... 04098 452 NtContinue (1244264, 0, ... 04099 452 NtContinue (1244264, 0, ... 04100 452 NtContinue (1244264, 0, ... 04101 452 NtContinue (1244264, 0, ... 04102 452 NtContinue (1244264, 0, ... 04103 452 NtContinue (1244264, 0, ... 04104 452 NtContinue (1244264, 0, ... 04105 452 NtContinue (1244264, 0, ... 04106 452 NtContinue (1244264, 0, ... 04107 452 NtContinue (1244264, 0, ... 04108 452 NtContinue (1244264, 0, ... 04109 452 NtContinue (1244264, 0, ... 04110 452 NtContinue (1244264, 0, ... 04111 452 NtContinue (1244264, 0, ... 04112 452 NtContinue (1244264, 0, ... 04113 452 NtContinue (1244264, 0, ... 04114 452 NtContinue (1244264, 0, ... 04115 452 NtContinue (1244264, 0, ... 04116 452 NtContinue (1244264, 0, ... 04117 452 NtContinue (1244264, 0, ... 04118 452 NtContinue (1244264, 0, ... 04119 452 NtContinue (1244264, 0, ... 04120 452 NtContinue (1244264, 0, ... 04121 452 NtContinue (1244264, 0, ... 04122 452 NtContinue (1244264, 0, ... 04123 452 NtContinue (1244264, 0, ... 04124 452 NtContinue (1244264, 0, ... 04125 452 NtContinue (1244264, 0, ... 04126 452 NtContinue (1244264, 0, ... 04127 452 NtContinue (1244264, 0, ... 04128 452 NtContinue (1244264, 0, ... 04129 452 NtContinue (1244264, 0, ... 04130 452 NtContinue (1244264, 0, ... 04131 452 NtContinue (1244264, 0, ... 04132 452 NtContinue (1244264, 0, ... 04133 452 NtContinue (1244264, 0, ... 04134 452 NtContinue (1244264, 0, ... 04135 452 NtContinue (1244264, 0, ... 04136 452 NtContinue (1244264, 0, ... 04137 452 NtContinue (1244264, 0, ... 04138 452 NtContinue (1244264, 0, ... 04139 452 NtContinue (1244264, 0, ... 04140 452 NtContinue (1244264, 0, ... 04141 452 NtContinue (1244264, 0, ... 04142 452 NtContinue (1244264, 0, ... 04143 452 NtContinue (1244264, 0, ... 04144 452 NtContinue (1244264, 0, ... 04145 452 NtContinue (1244264, 0, ... 04146 452 NtContinue (1244264, 0, ... 04147 452 NtContinue (1244264, 0, ... 04148 452 NtContinue (1244264, 0, ... 04149 452 NtContinue (1244264, 0, ... 04150 452 NtContinue (1244264, 0, ... 04151 452 NtContinue (1244264, 0, ... 04152 452 NtContinue (1244264, 0, ... 04153 452 NtContinue (1244264, 0, ... 04154 452 NtContinue (1244264, 0, ... 04155 452 NtContinue (1244264, 0, ... 04156 452 NtContinue (1244264, 0, ... 04157 452 NtContinue (1244264, 0, ... 04158 452 NtContinue (1244264, 0, ... 04159 452 NtContinue (1244264, 0, ... 04160 452 NtContinue (1244264, 0, ... 04161 452 NtContinue (1244264, 0, ... 04162 452 NtContinue (1244264, 0, ... 04163 452 NtContinue (1244264, 0, ... 04164 452 NtContinue (1244264, 0, ... 04165 452 NtContinue (1244264, 0, ... 04166 452 NtContinue (1244264, 0, ... 04167 452 NtContinue (1244264, 0, ... 04168 452 NtContinue (1244264, 0, ... 04169 452 NtContinue (1244264, 0, ... 04170 452 NtContinue (1244264, 0, ... 04171 452 NtContinue (1244264, 0, ... 04172 452 NtContinue (1244264, 0, ... 04173 452 NtContinue (1244264, 0, ... 04174 452 NtContinue (1244264, 0, ... 04175 452 NtContinue (1244264, 0, ... 04176 452 NtContinue (1244264, 0, ... 04177 452 NtContinue (1244264, 0, ... 04178 452 NtContinue (1244264, 0, ... 04179 452 NtContinue (1244264, 0, ... 04180 452 NtContinue (1244264, 0, ... 04181 452 NtContinue (1244264, 0, ... 04182 452 NtContinue (1244264, 0, ... 04183 452 NtContinue (1244264, 0, ... 04184 452 NtContinue (1244264, 0, ... 04185 452 NtContinue (1244264, 0, ... 04186 452 NtContinue (1244264, 0, ... 04187 452 NtContinue (1244264, 0, ... 04188 452 NtContinue (1244264, 0, ... 04189 452 NtContinue (1244264, 0, ... 04190 452 NtContinue (1244264, 0, ... 04191 452 NtContinue (1244264, 0, ... 04192 452 NtContinue (1244264, 0, ... 04193 452 NtContinue (1244264, 0, ... 04194 452 NtContinue (1244264, 0, ... 04195 452 NtContinue (1244264, 0, ... 04196 452 NtContinue (1244264, 0, ... 04197 452 NtContinue (1244264, 0, ... 04198 452 NtContinue (1244264, 0, ... 04199 452 NtContinue (1244264, 0, ... 04200 452 NtContinue (1244264, 0, ... 04201 452 NtContinue (1244264, 0, ... 04202 452 NtContinue (1244264, 0, ... 04203 452 NtContinue (1244264, 0, ... 04204 452 NtContinue (1244264, 0, ... 04205 452 NtContinue (1244264, 0, ... 04206 452 NtContinue (1244264, 0, ... 04207 452 NtContinue (1244264, 0, ... 04208 452 NtContinue (1244264, 0, ... 04209 452 NtContinue (1244264, 0, ... 04210 452 NtContinue (1244264, 0, ... 04211 452 NtContinue (1244264, 0, ... 04212 452 NtContinue (1244264, 0, ... 04213 452 NtContinue (1244264, 0, ... 04214 452 NtContinue (1244264, 0, ... 04215 452 NtContinue (1244264, 0, ... 04216 452 NtContinue (1244264, 0, ... 04217 452 NtContinue (1244264, 0, ... 04218 452 NtContinue (1244264, 0, ... 04219 452 NtContinue (1244264, 0, ... 04220 452 NtContinue (1244264, 0, ... 04221 452 NtContinue (1244264, 0, ... 04222 452 NtContinue (1244264, 0, ... 04223 452 NtContinue (1244264, 0, ... 04224 452 NtContinue (1244264, 0, ... 04225 452 NtContinue (1244264, 0, ... 04226 452 NtContinue (1244264, 0, ... 04227 452 NtContinue (1244264, 0, ... 04228 452 NtContinue (1244264, 0, ... 04229 452 NtContinue (1244264, 0, ... 04230 452 NtContinue (1244264, 0, ... 04231 452 NtContinue (1244264, 0, ... 04232 452 NtContinue (1244264, 0, ... 04233 452 NtContinue (1244264, 0, ... 04234 452 NtContinue (1244264, 0, ... 04235 452 NtContinue (1244264, 0, ... 04236 452 NtContinue (1244264, 0, ... 04237 452 NtContinue (1244264, 0, ... 04238 452 NtContinue (1244264, 0, ... 04239 452 NtContinue (1244264, 0, ... 04240 452 NtContinue (1244264, 0, ... 04241 452 NtContinue (1244264, 0, ... 04242 452 NtContinue (1244264, 0, ... 04243 452 NtContinue (1244264, 0, ... 04244 452 NtContinue (1244264, 0, ... 04245 452 NtContinue (1244264, 0, ... 04246 452 NtContinue (1244264, 0, ... 04247 452 NtContinue (1244264, 0, ... 04248 452 NtContinue (1244264, 0, ... 04249 452 NtContinue (1244264, 0, ... 04250 452 NtContinue (1244264, 0, ... 04251 452 NtContinue (1244264, 0, ... 04252 452 NtContinue (1244264, 0, ... 04253 452 NtContinue (1244264, 0, ... 04254 452 NtContinue (1244264, 0, ... 04255 452 NtContinue (1244264, 0, ... 04256 452 NtContinue (1244264, 0, ... 04257 452 NtContinue (1244264, 0, ... 04258 452 NtContinue (1244264, 0, ... 04259 452 NtContinue (1244264, 0, ... 04260 452 NtContinue (1244264, 0, ... 04261 452 NtContinue (1244264, 0, ... 04262 452 NtContinue (1244264, 0, ... 04263 452 NtContinue (1244264, 0, ... 04264 452 NtContinue (1244264, 0, ... 04265 452 NtContinue (1244264, 0, ... 04266 452 NtContinue (1244264, 0, ... 04267 452 NtContinue (1244264, 0, ... 04268 452 NtContinue (1244264, 0, ... 04269 452 NtContinue (1244264, 0, ... 04270 452 NtContinue (1244264, 0, ... 04271 452 NtContinue (1244264, 0, ... 04272 452 NtContinue (1244264, 0, ... 04273 452 NtContinue (1244264, 0, ... 04274 452 NtContinue (1244264, 0, ... 04275 452 NtContinue (1244264, 0, ... 04276 452 NtContinue (1244264, 0, ... 04277 452 NtContinue (1244264, 0, ... 04278 452 NtContinue (1244264, 0, ... 04279 452 NtContinue (1244264, 0, ... 04280 452 NtContinue (1244264, 0, ... 04281 452 NtContinue (1244264, 0, ... 04282 452 NtContinue (1244264, 0, ... 04283 452 NtContinue (1244264, 0, ... 04284 452 NtContinue (1244264, 0, ... 04285 452 NtContinue (1244264, 0, ... 04286 452 NtContinue (1244264, 0, ... 04287 452 NtContinue (1244264, 0, ... 04288 452 NtContinue (1244264, 0, ... 04289 452 NtContinue (1244264, 0, ... 04290 452 NtContinue (1244264, 0, ... 04291 452 NtContinue (1244264, 0, ... 04292 452 NtContinue (1244264, 0, ... 04293 452 NtContinue (1244264, 0, ... 04294 452 NtContinue (1244264, 0, ... 04295 452 NtContinue (1244264, 0, ... 04296 452 NtContinue (1244264, 0, ... 04297 452 NtContinue (1244264, 0, ... 04298 452 NtContinue (1244264, 0, ... 04299 452 NtContinue (1244264, 0, ... 04300 452 NtContinue (1244264, 0, ... 04301 452 NtContinue (1244264, 0, ... 04302 452 NtContinue (1244264, 0, ... 04303 452 NtContinue (1244264, 0, ... 04304 452 NtContinue (1244264, 0, ... 04305 452 NtContinue (1244264, 0, ... 04306 452 NtContinue (1244264, 0, ... 04307 452 NtContinue (1244264, 0, ... 04308 452 NtContinue (1244264, 0, ... 04309 452 NtContinue (1244264, 0, ... 04310 452 NtContinue (1244264, 0, ... 04311 452 NtContinue (1244264, 0, ... 04312 452 NtContinue (1244264, 0, ... 04313 452 NtContinue (1244264, 0, ... 04314 452 NtContinue (1244264, 0, ... 04315 452 NtContinue (1244264, 0, ... 04316 452 NtContinue (1244264, 0, ... 04317 452 NtContinue (1244264, 0, ... 04318 452 NtContinue (1244264, 0, ... 04319 452 NtContinue (1244264, 0, ... 04320 452 NtContinue (1244264, 0, ... 04321 452 NtContinue (1244264, 0, ... 04322 452 NtContinue (1244264, 0, ... 04323 452 NtContinue (1244264, 0, ... 04324 452 NtContinue (1244264, 0, ... 04325 452 NtContinue (1244264, 0, ... 04326 452 NtContinue (1244264, 0, ... 04327 452 NtContinue (1244264, 0, ... 04328 452 NtContinue (1244264, 0, ... 04329 452 NtContinue (1244264, 0, ... 04330 452 NtContinue (1244264, 0, ... 04331 452 NtContinue (1244264, 0, ... 04332 452 NtContinue (1244264, 0, ... 04333 452 NtContinue (1244264, 0, ... 04334 452 NtContinue (1244264, 0, ... 04335 452 NtContinue (1244264, 0, ... 04336 452 NtContinue (1244264, 0, ... 04337 452 NtContinue (1244264, 0, ... 04338 452 NtContinue (1244264, 0, ... 04339 452 NtContinue (1244264, 0, ... 04340 452 NtContinue (1244264, 0, ... 04341 452 NtContinue (1244264, 0, ... 04342 452 NtContinue (1244264, 0, ... 04343 452 NtContinue (1244264, 0, ... 04344 452 NtContinue (1244264, 0, ... 04345 452 NtContinue (1244264, 0, ... 04346 452 NtContinue (1244264, 0, ... 04347 452 NtContinue (1244264, 0, ... 04348 452 NtContinue (1244264, 0, ... 04349 452 NtContinue (1244264, 0, ... 04350 452 NtContinue (1244264, 0, ... 04351 452 NtContinue (1244264, 0, ... 04352 452 NtContinue (1244264, 0, ... 04353 452 NtContinue (1244264, 0, ... 04354 452 NtContinue (1244264, 0, ... 04355 452 NtContinue (1244264, 0, ... 04356 452 NtContinue (1244264, 0, ... 04357 452 NtContinue (1244264, 0, ... 04358 452 NtContinue (1244264, 0, ... 04359 452 NtContinue (1244264, 0, ... 04360 452 NtContinue (1244264, 0, ... 04361 452 NtContinue (1244264, 0, ... 04362 452 NtContinue (1244264, 0, ... 04363 452 NtContinue (1244264, 0, ... 04364 452 NtContinue (1244264, 0, ... 04365 452 NtContinue (1244264, 0, ... 04366 452 NtContinue (1244264, 0, ... 04367 452 NtContinue (1244264, 0, ... 04368 452 NtContinue (1244264, 0, ... 04369 452 NtContinue (1244264, 0, ... 04370 452 NtContinue (1244264, 0, ... 04371 452 NtContinue (1244264, 0, ... 04372 452 NtContinue (1244264, 0, ... 04373 452 NtContinue (1244264, 0, ... 04374 452 NtContinue (1244264, 0, ... 04375 452 NtContinue (1244264, 0, ... 04376 452 NtContinue (1244264, 0, ... 04377 452 NtContinue (1244264, 0, ... 04378 452 NtContinue (1244264, 0, ... 04379 452 NtContinue (1244264, 0, ... 04380 452 NtContinue (1244264, 0, ... 04381 452 NtContinue (1244264, 0, ... 04382 452 NtContinue (1244264, 0, ... 04383 452 NtContinue (1244264, 0, ... 04384 452 NtContinue (1244264, 0, ... 04385 452 NtContinue (1244264, 0, ... 04386 452 NtContinue (1244264, 0, ... 04387 452 NtContinue (1244264, 0, ... 04388 452 NtContinue (1244264, 0, ... 04389 452 NtContinue (1244264, 0, ... 04390 452 NtContinue (1244264, 0, ... 04391 452 NtContinue (1244264, 0, ... 04392 452 NtContinue (1244264, 0, ... 04393 452 NtContinue (1244264, 0, ... 04394 452 NtContinue (1244264, 0, ... 04395 452 NtContinue (1244264, 0, ... 04396 452 NtContinue (1244264, 0, ... 04397 452 NtContinue (1244264, 0, ... 04398 452 NtContinue (1244264, 0, ... 04399 452 NtContinue (1244264, 0, ... 04400 452 NtContinue (1244264, 0, ... 04401 452 NtContinue (1244264, 0, ... 04402 452 NtContinue (1244264, 0, ... 04403 452 NtContinue (1244264, 0, ... 04404 452 NtContinue (1244264, 0, ... 04405 452 NtContinue (1244264, 0, ... 04406 452 NtContinue (1244264, 0, ... 04407 452 NtContinue (1244264, 0, ... 04408 452 NtContinue (1244264, 0, ... 04409 452 NtContinue (1244264, 0, ... 04410 452 NtContinue (1244264, 0, ... 04411 452 NtContinue (1244264, 0, ... 04412 452 NtContinue (1244264, 0, ... 04413 452 NtContinue (1244264, 0, ... 04414 452 NtContinue (1244264, 0, ... 04415 452 NtContinue (1244264, 0, ... 04416 452 NtContinue (1244264, 0, ... 04417 452 NtContinue (1244264, 0, ... 04418 452 NtContinue (1244264, 0, ... 04419 452 NtContinue (1244264, 0, ... 04420 452 NtContinue (1244264, 0, ... 04421 452 NtContinue (1244264, 0, ... 04422 452 NtContinue (1244264, 0, ... 04423 452 NtContinue (1244264, 0, ... 04424 452 NtContinue (1244264, 0, ... 04425 452 NtContinue (1244264, 0, ... 04426 452 NtContinue (1244264, 0, ... 04427 452 NtContinue (1244264, 0, ... 04428 452 NtContinue (1244264, 0, ... 04429 452 NtContinue (1244264, 0, ... 04430 452 NtContinue (1244264, 0, ... 04431 452 NtContinue (1244264, 0, ... 04432 452 NtContinue (1244264, 0, ... 04433 452 NtContinue (1244264, 0, ... 04434 452 NtContinue (1244264, 0, ... 04435 452 NtContinue (1244264, 0, ... 04436 452 NtContinue (1244264, 0, ... 04437 452 NtContinue (1244264, 0, ... 04438 452 NtContinue (1244264, 0, ... 04439 452 NtContinue (1244264, 0, ... 04440 452 NtContinue (1244264, 0, ... 04441 452 NtContinue (1244264, 0, ... 04442 452 NtContinue (1244264, 0, ... 04443 452 NtContinue (1244264, 0, ... 04444 452 NtContinue (1244264, 0, ... 04445 452 NtContinue (1244264, 0, ... 04446 452 NtContinue (1244264, 0, ... 04447 452 NtContinue (1244264, 0, ... 04448 452 NtContinue (1244264, 0, ... 04449 452 NtContinue (1244264, 0, ... 04450 452 NtContinue (1244264, 0, ... 04451 452 NtContinue (1244264, 0, ... 04452 452 NtContinue (1244264, 0, ... 04453 452 NtContinue (1244264, 0, ... 04454 452 NtContinue (1244264, 0, ... 04455 452 NtContinue (1244264, 0, ... 04456 452 NtContinue (1244264, 0, ... 04457 452 NtContinue (1244264, 0, ... 04458 452 NtContinue (1244264, 0, ... 04459 452 NtContinue (1244264, 0, ... 04460 452 NtContinue (1244264, 0, ... 04461 452 NtContinue (1244264, 0, ... 04462 452 NtContinue (1244264, 0, ... 04463 452 NtContinue (1244264, 0, ... 04464 452 NtContinue (1244264, 0, ... 04465 452 NtContinue (1244264, 0, ... 04466 452 NtContinue (1244264, 0, ... 04467 452 NtContinue (1244264, 0, ... 04468 452 NtContinue (1244264, 0, ... 04469 452 NtContinue (1244264, 0, ... 04470 452 NtContinue (1244264, 0, ... 04471 452 NtContinue (1244264, 0, ... 04472 452 NtContinue (1244264, 0, ... 04473 452 NtContinue (1244264, 0, ... 04474 452 NtContinue (1244264, 0, ... 04475 452 NtContinue (1244264, 0, ... 04476 452 NtContinue (1244264, 0, ... 04477 452 NtContinue (1244264, 0, ... 04478 452 NtContinue (1244264, 0, ... 04479 452 NtContinue (1244264, 0, ... 04480 452 NtContinue (1244264, 0, ... 04481 452 NtContinue (1244264, 0, ... 04482 452 NtContinue (1244264, 0, ... 04483 452 NtContinue (1244264, 0, ... 04484 452 NtContinue (1244264, 0, ... 04485 452 NtContinue (1244264, 0, ... 04486 452 NtContinue (1244264, 0, ... 04487 452 NtContinue (1244264, 0, ... 04488 452 NtContinue (1244264, 0, ... 04489 452 NtContinue (1244264, 0, ... 04490 452 NtContinue (1244264, 0, ... 04491 452 NtContinue (1244264, 0, ... 04492 452 NtContinue (1244264, 0, ... 04493 452 NtContinue (1244264, 0, ... 04494 452 NtContinue (1244264, 0, ... 04495 452 NtContinue (1244264, 0, ... 04496 452 NtContinue (1244264, 0, ... 04497 452 NtContinue (1244264, 0, ... 04498 452 NtContinue (1244264, 0, ... 04499 452 NtContinue (1244264, 0, ... 04500 452 NtContinue (1244264, 0, ... 04501 452 NtContinue (1244264, 0, ... 04502 452 NtContinue (1244264, 0, ... 04503 452 NtContinue (1244264, 0, ... 04504 452 NtContinue (1244264, 0, ... 04505 452 NtContinue (1244264, 0, ... 04506 452 NtContinue (1244264, 0, ... 04507 452 NtContinue (1244264, 0, ... 04508 452 NtContinue (1244264, 0, ... 04509 452 NtContinue (1244264, 0, ... 04510 452 NtContinue (1244264, 0, ... 04511 452 NtContinue (1244264, 0, ... 04512 452 NtContinue (1244264, 0, ... 04513 452 NtContinue (1244264, 0, ... 04514 452 NtContinue (1244264, 0, ... 04515 452 NtContinue (1244264, 0, ... 04516 452 NtContinue (1244264, 0, ... 04517 452 NtContinue (1244264, 0, ... 04518 452 NtContinue (1244264, 0, ... 04519 452 NtContinue (1244264, 0, ... 04520 452 NtContinue (1244264, 0, ... 04521 452 NtContinue (1244264, 0, ... 04522 452 NtContinue (1244264, 0, ... 04523 452 NtContinue (1244264, 0, ... 04524 452 NtContinue (1244264, 0, ... 04525 452 NtContinue (1244264, 0, ... 04526 452 NtContinue (1244264, 0, ... 04527 452 NtContinue (1244264, 0, ... 04528 452 NtContinue (1244264, 0, ... 04529 452 NtContinue (1244264, 0, ... 04530 452 NtContinue (1244264, 0, ... 04531 452 NtContinue (1244264, 0, ... 04532 452 NtContinue (1244264, 0, ... 04533 452 NtContinue (1244264, 0, ... 04534 452 NtContinue (1244264, 0, ... 04535 452 NtContinue (1244264, 0, ... 04536 452 NtContinue (1244264, 0, ... 04537 452 NtContinue (1244264, 0, ... 04538 452 NtContinue (1244264, 0, ... 04539 452 NtContinue (1244264, 0, ... 04540 452 NtContinue (1244264, 0, ... 04541 452 NtContinue (1244264, 0, ... 04542 452 NtContinue (1244264, 0, ... 04543 452 NtContinue (1244264, 0, ... 04544 452 NtContinue (1244264, 0, ... 04545 452 NtContinue (1244264, 0, ... 04546 452 NtContinue (1244264, 0, ... 04547 452 NtContinue (1244264, 0, ... 04548 452 NtContinue (1244264, 0, ... 04549 452 NtContinue (1244264, 0, ... 04550 452 NtContinue (1244264, 0, ... 04551 452 NtContinue (1244264, 0, ... 04552 452 NtContinue (1244264, 0, ... 04553 452 NtContinue (1244264, 0, ... 04554 452 NtContinue (1244264, 0, ... 04555 452 NtContinue (1244264, 0, ... 04556 452 NtContinue (1244264, 0, ... 04557 452 NtContinue (1244264, 0, ... 04558 452 NtContinue (1244264, 0, ... 04559 452 NtContinue (1244264, 0, ... 04560 452 NtContinue (1244264, 0, ... 04561 452 NtContinue (1244264, 0, ... 04562 452 NtContinue (1244264, 0, ... 04563 452 NtContinue (1244264, 0, ... 04564 452 NtContinue (1244264, 0, ... 04565 452 NtContinue (1244264, 0, ... 04566 452 NtContinue (1244264, 0, ... 04567 452 NtContinue (1244264, 0, ... 04568 452 NtContinue (1244264, 0, ... 04569 452 NtContinue (1244264, 0, ... 04570 452 NtContinue (1244264, 0, ... 04571 452 NtContinue (1244264, 0, ... 04572 452 NtContinue (1244264, 0, ... 04573 452 NtContinue (1244264, 0, ... 04574 452 NtContinue (1244264, 0, ... 04575 452 NtContinue (1244264, 0, ... 04576 452 NtContinue (1244264, 0, ... 04577 452 NtContinue (1244264, 0, ... 04578 452 NtContinue (1244264, 0, ... 04579 452 NtContinue (1244264, 0, ... 04580 452 NtContinue (1244264, 0, ... 04581 452 NtContinue (1244264, 0, ... 04582 452 NtContinue (1244264, 0, ... 04583 452 NtContinue (1244264, 0, ... 04584 452 NtContinue (1244264, 0, ... 04585 452 NtContinue (1244264, 0, ... 04586 452 NtContinue (1244264, 0, ... 04587 452 NtContinue (1244264, 0, ... 04588 452 NtContinue (1244264, 0, ... 04589 452 NtContinue (1244264, 0, ... 04590 452 NtContinue (1244264, 0, ... 04591 452 NtContinue (1244264, 0, ... 04592 452 NtContinue (1244264, 0, ... 04593 452 NtContinue (1244264, 0, ... 04594 452 NtContinue (1244264, 0, ... 04595 452 NtContinue (1244264, 0, ... 04596 452 NtContinue (1244264, 0, ... 04597 452 NtContinue (1244264, 0, ... 04598 452 NtContinue (1244264, 0, ... 04599 452 NtContinue (1244264, 0, ... 04600 452 NtContinue (1244264, 0, ... 04601 452 NtContinue (1244264, 0, ... 04602 452 NtContinue (1244264, 0, ... 04603 452 NtContinue (1244264, 0, ... 04604 452 NtContinue (1244264, 0, ... 04605 452 NtContinue (1244264, 0, ... 04606 452 NtContinue (1244264, 0, ... 04607 452 NtContinue (1244264, 0, ... 04608 452 NtContinue (1244264, 0, ... 04609 452 NtContinue (1244264, 0, ... 04610 452 NtContinue (1244264, 0, ... 04611 452 NtContinue (1244264, 0, ... 04612 452 NtContinue (1244264, 0, ... 04613 452 NtContinue (1244264, 0, ... 04614 452 NtContinue (1244264, 0, ... 04615 452 NtContinue (1244264, 0, ... 04616 452 NtContinue (1244264, 0, ... 04617 452 NtContinue (1244264, 0, ... 04618 452 NtContinue (1244264, 0, ... 04619 452 NtContinue (1244264, 0, ... 04620 452 NtContinue (1244264, 0, ... 04621 452 NtContinue (1244264, 0, ... 04622 452 NtContinue (1244264, 0, ... 04623 452 NtContinue (1244264, 0, ... 04624 452 NtContinue (1244264, 0, ... 04625 452 NtContinue (1244264, 0, ... 04626 452 NtContinue (1244264, 0, ... 04627 452 NtContinue (1244264, 0, ... 04628 452 NtContinue (1244264, 0, ... 04629 452 NtContinue (1244264, 0, ... 04630 452 NtContinue (1244264, 0, ... 04631 452 NtContinue (1244264, 0, ... 04632 452 NtContinue (1244264, 0, ... 04633 452 NtContinue (1244264, 0, ... 04634 452 NtContinue (1244264, 0, ... 04635 452 NtContinue (1244264, 0, ... 04636 452 NtContinue (1244264, 0, ... 04637 452 NtContinue (1244264, 0, ... 04638 452 NtContinue (1244264, 0, ... 04639 452 NtContinue (1244264, 0, ... 04640 452 NtContinue (1244264, 0, ... 04641 452 NtContinue (1244264, 0, ... 04642 452 NtContinue (1244264, 0, ... 04643 452 NtContinue (1244264, 0, ... 04644 452 NtContinue (1244264, 0, ... 04645 452 NtContinue (1244264, 0, ... 04646 452 NtContinue (1244264, 0, ... 04647 452 NtContinue (1244264, 0, ... 04648 452 NtContinue (1244264, 0, ... 04649 452 NtContinue (1244264, 0, ... 04650 452 NtContinue (1244264, 0, ... 04651 452 NtContinue (1244264, 0, ... 04652 452 NtContinue (1244264, 0, ... 04653 452 NtContinue (1244264, 0, ... 04654 452 NtContinue (1244264, 0, ... 04655 452 NtContinue (1244264, 0, ... 04656 452 NtContinue (1244264, 0, ... 04657 452 NtContinue (1244264, 0, ... 04658 452 NtContinue (1244264, 0, ... 04659 452 NtContinue (1244264, 0, ... 04660 452 NtContinue (1244264, 0, ... 04661 452 NtContinue (1244264, 0, ... 04662 452 NtContinue (1244264, 0, ... 04663 452 NtContinue (1244264, 0, ... 04664 452 NtContinue (1244264, 0, ... 04665 452 NtContinue (1244264, 0, ... 04666 452 NtContinue (1244264, 0, ... 04667 452 NtContinue (1244264, 0, ... 04668 452 NtContinue (1244264, 0, ... 04669 452 NtContinue (1244264, 0, ... 04670 452 NtContinue (1244264, 0, ... 04671 452 NtContinue (1244264, 0, ... 04672 452 NtContinue (1244264, 0, ... 04673 452 NtContinue (1244264, 0, ... 04674 452 NtContinue (1244264, 0, ... 04675 452 NtContinue (1244264, 0, ... 04676 452 NtContinue (1244264, 0, ... 04677 452 NtContinue (1244264, 0, ... 04678 452 NtContinue (1244264, 0, ... 04679 452 NtContinue (1244264, 0, ... 04680 452 NtContinue (1244264, 0, ... 04681 452 NtContinue (1244264, 0, ... 04682 452 NtContinue (1244264, 0, ... 04683 452 NtContinue (1244264, 0, ... 04684 452 NtContinue (1244264, 0, ... 04685 452 NtContinue (1244264, 0, ... 04686 452 NtContinue (1244264, 0, ... 04687 452 NtContinue (1244264, 0, ... 04688 452 NtContinue (1244264, 0, ... 04689 452 NtContinue (1244264, 0, ... 04690 452 NtContinue (1244264, 0, ... 04691 452 NtContinue (1244264, 0, ... 04692 452 NtContinue (1244264, 0, ... 04693 452 NtContinue (1244264, 0, ... 04694 452 NtContinue (1244264, 0, ... 04695 452 NtContinue (1244264, 0, ... 04696 452 NtContinue (1244264, 0, ... 04697 452 NtContinue (1244264, 0, ... 04698 452 NtContinue (1244264, 0, ... 04699 452 NtContinue (1244264, 0, ... 04700 452 NtContinue (1244264, 0, ... 04701 452 NtContinue (1244264, 0, ... 04702 452 NtContinue (1244264, 0, ... 04703 452 NtContinue (1244264, 0, ... 04704 452 NtContinue (1244264, 0, ... 04705 452 NtContinue (1244264, 0, ... 04706 452 NtContinue (1244264, 0, ... 04707 452 NtContinue (1244264, 0, ... 04708 452 NtContinue (1244264, 0, ... 04709 452 NtContinue (1244264, 0, ... 04710 452 NtContinue (1244264, 0, ... 04711 452 NtContinue (1244264, 0, ... 04712 452 NtContinue (1244264, 0, ... 04713 452 NtContinue (1244264, 0, ... 04714 452 NtContinue (1244264, 0, ... 04715 452 NtContinue (1244264, 0, ... 04716 452 NtContinue (1244264, 0, ... 04717 452 NtContinue (1244264, 0, ... 04718 452 NtContinue (1244264, 0, ... 04719 452 NtContinue (1244264, 0, ... 04720 452 NtContinue (1244264, 0, ... 04721 452 NtContinue (1244264, 0, ... 04722 452 NtContinue (1244264, 0, ... 04723 452 NtContinue (1244264, 0, ... 04724 452 NtContinue (1244264, 0, ... 04725 452 NtContinue (1244264, 0, ... 04726 452 NtContinue (1244264, 0, ... 04727 452 NtContinue (1244264, 0, ... 04728 452 NtContinue (1244264, 0, ... 04729 452 NtContinue (1244260, 0, ... 04730 452 NtContinue (1244260, 0, ... 04731 452 NtContinue (1244260, 0, ... 04732 452 NtContinue (1244260, 0, ... 04733 452 NtContinue (1244260, 0, ... 04734 452 NtContinue (1244260, 0, ... 04735 452 NtContinue (1244260, 0, ... 04736 452 NtContinue (1244260, 0, ... 04737 452 NtContinue (1244260, 0, ... 04738 452 NtContinue (1244260, 0, ... 04739 452 NtContinue (1244260, 0, ... 04740 452 NtContinue (1244260, 0, ... 04741 452 NtContinue (1244260, 0, ... 04742 452 NtContinue (1244260, 0, ... 04743 452 NtContinue (1244260, 0, ... 04744 452 NtContinue (1244260, 0, ... 04745 452 NtContinue (1244260, 0, ... 04746 452 NtContinue (1244260, 0, ... 04747 452 NtContinue (1244260, 0, ... 04748 452 NtContinue (1244260, 0, ... 04749 452 NtContinue (1244260, 0, ... 04750 452 NtContinue (1244260, 0, ... 04751 452 NtContinue (1244260, 0, ... 04752 452 NtContinue (1244260, 0, ... 04753 452 NtContinue (1244260, 0, ... 04754 452 NtContinue (1244260, 0, ... 04755 452 NtContinue (1244260, 0, ... 04756 452 NtContinue (1244260, 0, ... 04757 452 NtContinue (1244260, 0, ... 04758 452 NtContinue (1244260, 0, ... 04759 452 NtContinue (1244260, 0, ... 04760 452 NtContinue (1244260, 0, ... 04761 452 NtContinue (1244264, 0, ... 04762 452 NtContinue (1244260, 0, ... 04763 452 NtContinue (1244260, 0, ... 04764 452 NtContinue (1244260, 0, ... 04765 452 NtContinue (1244260, 0, ... 04766 452 NtContinue (1244264, 0, ... 04767 452 NtContinue (1244260, 0, ... 04768 452 NtContinue (1244260, 0, ... 04769 452 NtContinue (1244260, 0, ... 04770 452 NtContinue (1244264, 0, ... 04771 452 NtContinue (1244260, 0, ... 04772 452 NtContinue (1244260, 0, ... 04773 452 NtContinue (1244264, 0, ... 04774 452 NtContinue (1244260, 0, ... 04775 452 NtContinue (1244260, 0, ... 04776 452 NtContinue (1244260, 0, ... 04777 452 NtContinue (1244260, 0, ... 04778 452 NtContinue (1244260, 0, ... 04779 452 NtContinue (1244260, 0, ... 04780 452 NtContinue (1244264, 0, ... 04781 452 NtContinue (1244260, 0, ... 04782 452 NtContinue (1244260, 0, ... 04783 452 NtContinue (1244260, 0, ... 04784 452 NtContinue (1244260, 0, ... 04785 452 NtContinue (1244260, 0, ... 04786 452 NtContinue (1244260, 0, ... 04787 452 NtContinue (1244264, 0, ... 04788 452 NtContinue (1244260, 0, ... 04789 452 NtContinue (1244260, 0, ... 04790 452 NtContinue (1244260, 0, ... 04791 452 NtContinue (1244260, 0, ... 04792 452 NtContinue (1244260, 0, ... 04793 452 NtContinue (1244260, 0, ... 04794 452 NtContinue (1244260, 0, ... 04795 452 NtContinue (1244260, 0, ... 04796 452 NtContinue (1244260, 0, ... 04797 452 NtContinue (1244260, 0, ... 04798 452 NtContinue (1244260, 0, ... 04799 452 NtContinue (1244260, 0, ... 04800 452 NtContinue (1244260, 0, ... 04801 452 NtContinue (1244260, 0, ... 04802 452 NtContinue (1244260, 0, ... 04803 452 NtContinue (1244260, 0, ... 04804 452 NtContinue (1244260, 0, ... 04805 452 NtContinue (1244260, 0, ... 04806 452 NtContinue (1244260, 0, ... 04807 452 NtContinue (1244260, 0, ... 04808 452 NtContinue (1244260, 0, ... 04809 452 NtContinue (1244260, 0, ... 04810 452 NtContinue (1244260, 0, ... 04811 452 NtContinue (1244260, 0, ... 04812 452 NtContinue (1244260, 0, ... 04813 452 NtContinue (1244260, 0, ... 04814 452 NtContinue (1244260, 0, ... 04815 452 NtContinue (1244260, 0, ... 04816 452 NtContinue (1244260, 0, ... 04817 452 NtContinue (1244260, 0, ... 04818 452 NtContinue (1244260, 0, ... 04819 452 NtContinue (1244260, 0, ... 04820 452 NtContinue (1244260, 0, ... 04821 452 NtContinue (1244260, 0, ... 04822 452 NtContinue (1244260, 0, ... 04823 452 NtContinue (1244260, 0, ... 04824 452 NtContinue (1244260, 0, ... 04825 452 NtContinue (1244260, 0, ... 04826 452 NtContinue (1244260, 0, ... 04827 452 NtContinue (1244260, 0, ... 04828 452 NtContinue (1244260, 0, ... 04829 452 NtContinue (1244260, 0, ... 04830 452 NtContinue (1244260, 0, ... 04831 452 NtContinue (1244260, 0, ... 04832 452 NtContinue (1244260, 0, ... 04833 452 NtContinue (1244260, 0, ... 04834 452 NtContinue (1244260, 0, ... 04835 452 NtContinue (1244264, 0, ... 04836 452 NtContinue (1244260, 0, ... 04837 452 NtContinue (1244264, 0, ... 04838 452 NtContinue (1244260, 0, ... 04839 452 NtContinue (1244260, 0, ... 04840 452 NtContinue (1244260, 0, ... 04841 452 NtContinue (1244260, 0, ... 04842 452 NtContinue (1244260, 0, ... 04843 452 NtContinue (1244260, 0, ... 04844 452 NtContinue (1244260, 0, ... 04845 452 NtContinue (1244260, 0, ... 04846 452 NtContinue (1244260, 0, ... 04847 452 NtContinue (1244260, 0, ... 04848 452 NtContinue (1244260, 0, ... 04849 452 NtContinue (1244260, 0, ... 04850 452 NtContinue (1244260, 0, ... 04851 452 NtContinue (1244260, 0, ... 04852 452 NtContinue (1244260, 0, ... 04853 452 NtContinue (1244260, 0, ... 04854 452 NtContinue (1244260, 0, ... 04855 452 NtContinue (1244260, 0, ... 04856 452 NtContinue (1244260, 0, ... 04857 452 NtContinue (1244260, 0, ... 04858 452 NtContinue (1244260, 0, ... 04859 452 NtContinue (1244260, 0, ... 04860 452 NtContinue (1244260, 0, ... 04861 452 NtContinue (1244264, 0, ... 04862 452 NtContinue (1244260, 0, ... 04863 452 NtContinue (1244260, 0, ... 04864 452 NtContinue (1244260, 0, ... 04865 452 NtContinue (1244260, 0, ... 04866 452 NtContinue (1244260, 0, ... 04867 452 NtContinue (1244260, 0, ... 04868 452 NtContinue (1244260, 0, ... 04869 452 NtContinue (1244260, 0, ... 04870 452 NtContinue (1244260, 0, ... 04871 452 NtContinue (1244260, 0, ... 04872 452 NtContinue (1244264, 0, ... 04873 452 NtContinue (1244260, 0, ... 04874 452 NtContinue (1244260, 0, ... 04875 452 NtContinue (1244264, 0, ... 04876 452 NtContinue (1244260, 0, ... 04877 452 NtContinue (1244260, 0, ... 04878 452 NtContinue (1244260, 0, ... 04879 452 NtContinue (1244260, 0, ... 04880 452 NtContinue (1244260, 0, ... 04881 452 NtContinue (1244260, 0, ... 04882 452 NtContinue (1244260, 0, ... 04883 452 NtContinue (1244260, 0, ... 04884 452 NtContinue (1244260, 0, ... 04885 452 NtContinue (1244260, 0, ... 04886 452 NtContinue (1244260, 0, ... 04887 452 NtContinue (1244260, 0, ... 04888 452 NtContinue (1244260, 0, ... 04889 452 NtContinue (1244260, 0, ... 04890 452 NtContinue (1244260, 0, ... 04891 452 NtContinue (1244260, 0, ... 04892 452 NtContinue (1244260, 0, ... 04893 452 NtContinue (1244260, 0, ... 04894 452 NtContinue (1244260, 0, ... 04895 452 NtContinue (1244260, 0, ... 04896 452 NtContinue (1244260, 0, ... 04897 452 NtContinue (1244260, 0, ... 04898 452 NtContinue (1244260, 0, ... 04899 452 NtContinue (1244260, 0, ... 04900 452 NtContinue (1244260, 0, ... 04901 452 NtContinue (1244260, 0, ... 04902 452 NtContinue (1244260, 0, ... 04903 452 NtContinue (1244264, 0, ... 04904 452 NtContinue (1244260, 0, ... 04905 452 NtContinue (1244260, 0, ... 04906 452 NtContinue (1244264, 0, ... 04907 452 NtContinue (1244260, 0, ... 04908 452 NtContinue (1244260, 0, ... 04909 452 NtContinue (1244260, 0, ... 04910 452 NtContinue (1244260, 0, ... 04911 452 NtContinue (1244260, 0, ... 04912 452 NtContinue (1244260, 0, ... 04913 452 NtContinue (1244260, 0, ... 04914 452 NtContinue (1244260, 0, ... 04915 452 NtContinue (1244260, 0, ... 04916 452 NtContinue (1244260, 0, ... 04917 452 NtContinue (1244260, 0, ... 04918 452 NtContinue (1244260, 0, ... 04919 452 NtContinue (1244260, 0, ... 04920 452 NtContinue (1244260, 0, ... 04921 452 NtContinue (1244260, 0, ... 04922 452 NtContinue (1244260, 0, ... 04923 452 NtContinue (1244260, 0, ... 04924 452 NtContinue (1244260, 0, ... 04925 452 NtContinue (1244260, 0, ... 04926 452 NtContinue (1244260, 0, ... 04927 452 NtContinue (1244260, 0, ... 04928 452 NtContinue (1244260, 0, ... 04929 452 NtContinue (1244260, 0, ... 04930 452 NtContinue (1244260, 0, ... 04931 452 NtContinue (1244260, 0, ... 04932 452 NtContinue (1244260, 0, ... 04933 452 NtContinue (1244260, 0, ... 04934 452 NtContinue (1244260, 0, ... 04935 452 NtContinue (1244260, 0, ... 04936 452 NtContinue (1244260, 0, ... 04937 452 NtContinue (1244260, 0, ... 04938 452 NtContinue (1244260, 0, ... 04939 452 NtContinue (1244260, 0, ... 04940 452 NtContinue (1244260, 0, ... 04941 452 NtContinue (1244260, 0, ... 04942 452 NtContinue (1244264, 0, ... 04943 452 NtContinue (1244260, 0, ... 04944 452 NtContinue (1244260, 0, ... 04945 452 NtContinue (1244248, 0, ... 04946 452 NtContinue (1244228, 0, ... 04947 452 NtUserCallOneParam (0, 40, ... ) == 0x4 04948 452 NtOpenKey (0xf0019, {24, 64, 0x40, 0, 0, (0xf0019, {24, 64, 0x40, 0, 0, "Software\Borland\Locales"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 04949 452 NtOpenKey (0xf0019, {24, 28, 0x40, 0, 0, (0xf0019, {24, 28, 0x40, 0, 0, "Software\Borland\Locales"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 04950 452 NtOpenKey (0xf0019, {24, 64, 0x40, 0, 0, (0xf0019, {24, 64, 0x40, 0, 0, "Software\Borland\Delphi\Locales"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND 04951 452 NtWaitForSingleObject (16, 0, 0x0, ... ) == STATUS_ACCESS_DENIED 04952 452 NtReleaseMutant (16, ... 04953 452 NtContinue (-136150904, 0, ... 04952 452 NtReleaseMutant ... ) == STATUS_MUTANT_NOT_OWNED 04954 452 NtAllocateVirtualMemory (-1, 1355776, 0, 4096, 4096, 4, ... 1355776, 4096, ) == 0x0 04955 452 NtAllocateVirtualMemory (-1, 0, 0, 1048576, 8192, 1, ... 11599872, 1048576, ) == 0x0 04956 452 NtAllocateVirtualMemory (-1, 11599872, 0, 16384, 4096, 4, ... 11599872, 16384, ) == 0x0 04957 452 NtWaitForSingleObject (16, 0, 0x0, ... ) == STATUS_ACCESS_DENIED 04958 452 NtReleaseMutant (16, ... 04959 452 NtContinue (-136150904, 0, ... 04958 452 NtReleaseMutant ... ) == STATUS_MUTANT_NOT_OWNED 04960 452 NtWaitForSingleObject (16, 0, 0x0, ... ) == STATUS_ACCESS_DENIED 04961 452 NtReleaseMutant (16, ... 04962 452 NtContinue (-136150904, 0, ... 04961 452 NtReleaseMutant ... ) == STATUS_MUTANT_NOT_OWNED 04963 452 NtWaitForSingleObject (16, 0, 0x0, ... ) == STATUS_ACCESS_DENIED 04964 452 NtReleaseMutant (16, ... 04965 452 NtContinue (-136150904, 0, ... 04964 452 NtReleaseMutant ... ) == STATUS_MUTANT_NOT_OWNED