Summary:


NtAccessCheck(>) 
 1 
NtGdiCreateSolidBrush(>) 
 2 
NtFlushInstructionCache(>) 
 10 
NtQueryInformationFile(>) 
 44 

NtAddAtom(>) 
 1 
NtGdiHfontCreate(>) 
 2 
NtUserGetWindowDC(>) 
 10 
NtFsControlFile(>) 
 45 

NtCallbackReturn(>) 
 1 
NtOpenDirectoryObject(>) 
 2 
NtClearEvent(>) 
 11 
NtOpenSection(>) 
 45 

NtCreateThread(>) 
 1 
NtQueryInstallUILanguage(>) 
 2 
NtQueryVolumeInformationFile(>) 
 11 
NtOpenThreadToken(>) 
 45 

NtGdiCreateBitmap(>) 
 1 
NtRegisterThreadTerminatePort(>) 
 2 
NtUserCallOneParam(>) 
 11 
NtQueryInformationToken(>) 
 48 

NtGdiCreatePatternBrushInternal(>) 
 1 
NtTestAlert(>) 
 2 
NtUserSystemParametersInfo(>) 
 11 
NtUserFindExistingCursorIcon(>) 
 48 

NtGdiInit(>) 
 1 
NtUserCreateWindowEx(>) 
 2 
NtCreateSemaphore(>) 
 12 
NtSetInformationProcess(>) 
 51 

NtGdiQueryFontAssocInfo(>) 
 1 
NtUserGetObjectInformation(>) 
 2 
NtEnumerateKey(>) 
 12 
NtSetInformationFile(>) 
 53 

NtGdiSelectBitmap(>) 
 1 
NtUserMessageCall(>) 
 2 
NtOpenProcessToken(>) 
 12 
NtQueryInformationProcess(>) 
 54 

NtOpenKeyedEvent(>) 
 1 
NtGdiCreateCompatibleDC(>) 
 3 
NtQueryDefaultUILanguage(>) 
 12 
NtRequestWaitReplyPort(>) 
 54 

NtOpenProcess(>) 
 1 
NtQuerySystemTime(>) 
 3 
NtSetEvent(>) 
 12 
NtAllocateVirtualMemory(>) 
 55 

NtOpenSymbolicLinkObject(>) 
 1 
NtUserGetMessage(>) 
 3 
NtOpenProcessTokenEx(>) 
 16 
NtReleaseMutant(>) 
 57 

NtQueryEvent(>) 
 1 
NtUserRegisterWindowMessage(>) 
 4 
NtOpenThreadTokenEx(>) 
 16 
NtUserRegisterClassExWOW(>) 
 64 

NtQueryInformationThread(>) 
 1 
NtDuplicateToken(>) 
 5 
NtWriteFile(>) 
 16 
NtMapViewOfSection(>) 
 65 

NtQueryObject(>) 
 1 
NtGdiGetStockObject(>) 
 5 
NtConnectPort(>) 
 18 
NtCreateEvent(>) 
 66 

NtQuerySymbolicLinkObject(>) 
 1 
NtNotifyChangeKey(>) 
 5 
NtQuerySection(>) 
 19 
NtCreateKey(>) 
 79 

NtQueryTimerResolution(>) 
 1 
NtQuerySecurityObject(>) 
 5 
NtReadFile(>) 
 19 
NtQueryDefaultLocale(>) 
 99 

NtResumeThread(>) 
 1 
NtSetInformationObject(>) 
 5 
NtUnmapViewOfSection(>) 
 21 
NtOpenFile(>) 
 108 

NtSecureConnectPort(>) 
 1 
NtCreateMutant(>) 
 6 
NtProtectVirtualMemory(>) 
 25 
NtQueryAttributesFile(>) 
 134 

NtUserGetDC(>) 
 1 
NtDuplicateObject(>) 
 6 
NtQuerySystemInformation(>) 
 25 
NtQueryVirtualMemory(>) 
 147 

NtUserGetGUIThreadInfo(>) 
 1 
NtFreeVirtualMemory(>) 
 6 
NtQueryDirectoryFile(>) 
 28 
NtEnumerateValueKey(>) 
 231 

NtUserGetProcessWindowStation(>) 
 1 
NtOpenEvent(>) 
 7 
NtQueryDebugFilterState(>) 
 29 
NtOpenKey(>) 
 326 

NtUserGetThreadDesktop(>) 
 1 
NtReleaseSemaphore(>) 
 7 
NtSetInformationThread(>) 
 29 
NtQueryValueKey(>) 
 525 

NtUserSetProp(>) 
 1 
NtUserCallNoParam(>) 
 7 
NtCreateSection(>) 
 34 
NtWaitForSingleObject(>) 
 552 

NtUserSetTimer(>) 
 1 
NtQueryKey(>) 
 8 
NtUserGetClassInfo(>) 
 37 
NtClose(>) 
 567 

NtContinue(>) 
 2 
NtDeleteValueKey(>) 
 9 
NtSetValueKey(>) 
 41 
NtDeviceIoControlFile(>) 
 749 

NtCreateIoCompletion(>) 
 2 
NtOpenMutant(>) 
 9 
NtCreateFile(>) 
 42 

Trace:
 00001   436   NtOpenKey  (0x80000000, {24, 0, 0x40, 0, 0,  (0x80000000, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\packed.exe"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00002   436   NtOpenKeyedEvent  (0x2000000, {24, 0, 0x0, 0, 0,  (0x2000000, {24, 0, 0x0, 0, 0, "\KernelObjects\CritSecOutOfMemoryEvent"}, ... 4, ) }, ... 4, ) == 0x0
 00003   436   NtQuerySystemInformation  (Basic, 44, ... {Unknown=0,MaximumIncrement=156250,PhysicalPageSize=0x1000,NumberOfPhysicalPages=0xff7c,LowestPhysicalPage=0x1,HighestPhysicalPage=0xffff,AllocationGranularity=0x10000,LowestUserAddress=0x10000,HighestUserAddress=0x7ffeffff,ActiveProcessors=1,NumberProcessors=1,}, 0x0, ) == 0x0
 00004   436   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ... 1310720, 1048576, ) == 0x0
 00005   436   NtAllocateVirtualMemory  (-1, 1310720, 0, 4096, 4096, 4, ... 1310720, 4096, ) == 0x0
 00006   436   NtAllocateVirtualMemory  (-1, 1314816, 0, 8192, 4096, 4, ... 1314816, 8192, ) == 0x0
 00007   436   NtQuerySystemInformation  (Basic, 44, ... {Unknown=0,MaximumIncrement=156250,PhysicalPageSize=0x1000,NumberOfPhysicalPages=0xff7c,LowestPhysicalPage=0x1,HighestPhysicalPage=0xffff,AllocationGranularity=0x10000,LowestUserAddress=0x10000,HighestUserAddress=0x7ffeffff,ActiveProcessors=1,NumberProcessors=1,}, 0x0, ) == 0x0
 00008   436   NtAllocateVirtualMemory  (-1, 0, 0, 65536, 8192, 4, ... 2359296, 65536, ) == 0x0
 00009   436   NtAllocateVirtualMemory  (-1, 2359296, 0, 24576, 4096, 4, ... 2359296, 24576, ) == 0x0
 00010   436   NtOpenDirectoryObject  (0x3, {24, 0, 0x40, 0, 0,  (0x3, {24, 0, 0x40, 0, 0, "\KnownDlls"}, ... 8, ) }, ... 8, ) == 0x0
 00011   436   NtOpenSymbolicLinkObject  (0x1, {24, 8, 0x40, 0, 0,  (0x1, {24, 8, 0x40, 0, 0, "KnownDllPath"}, ... 12, ) }, ... 12, ) == 0x0
 00012   436   NtQuerySymbolicLinkObject  (12, ...  (12, ... "C:\WINDOWS\system32", 0x0, ) , 0x0, ) == 0x0
 00013   436   NtClose  (12, ... ) == 0x0
 00014   436   NtOpenFile  (0x100020, {24, 0, 0x42, 0, 0,  (0x100020, {24, 0, 0x42, 0, 0, "\??\U:\startupscripts\"}, 3, 33, ... 12, {status=0x0, info=1}, ) }, 3, 33, ... 12, {status=0x0, info=1}, ) == 0x0
 00015   436   NtQueryVolumeInformationFile  (12, 1243848, 8, Device, ... {status=0x0, info=8}, ) == 0x0
 00016   436   NtFsControlFile  (12, 0, 0x0, 0x0, 0x90028, 0x0, 0, 0, ... ) == STATUS_INVALID_PARAMETER
 00017   436   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\u:\work\packed.exe.Local"}, 1243832, ... ) }, 1243832, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00018   436   NtOpenSection  (0xe, {24, 8, 0x40, 0, 0,  (0xe, {24, 8, 0x40, 0, 0, "kernel32.dll"}, ... 16, ) }, ... 16, ) == 0x0
 00019   436   NtMapViewOfSection  (16, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x77e60000), 0x0, 937984, ) == 0x0
 00020   436   NtClose  (16, ... ) == 0x0
 00021   436   NtQuerySystemInformation  (RangeStart, 4, ... {system info, class 50, size 4}, 0x0, ) == 0x0
 00022   436   NtQuerySystemInformation  (Basic, 44, ... {Unknown=0,MaximumIncrement=156250,PhysicalPageSize=0x1000,NumberOfPhysicalPages=0xff7c,LowestPhysicalPage=0x1,HighestPhysicalPage=0xffff,AllocationGranularity=0x10000,LowestUserAddress=0x10000,HighestUserAddress=0x7ffeffff,ActiveProcessors=1,NumberProcessors=1,}, 0x0, ) == 0x0
 00023   436   NtCreateSection  (0xf001f, 0x0, {65536, 0}, 4, 67108864, 0, ... 16, ) == 0x0
 00024   436   NtSecureConnectPort  ( ("\Windows\ApiPort", {0, 2, 1, 1}, {24, 16, 0, 65536, 0, 0}, 1319736, {12, 0, 0}, 1242016, 44, ... 24, {24, 16, 0, 65536, 2424832, 18415616}, {0, 0, 0}, 200, 44, ) , {0, 2, 1, 1}, {24, 16, 0, 65536, 0, 0}, 1319736, {12, 0, 0}, 1242016, 44, ... 24, {24, 16, 0, 65536, 2424832, 18415616}, {0, 0, 0}, 200, 44, ) == 0x0
 00025   436   NtClose  (16, ... ) == 0x0
 00026   436   NtQueryObject  (24, Handle, 2, ... {Inherit=0,ProtectFromClose=0,}, -1, ) == 0x0
 00027   436   NtSetInformationObject  (24, Handle, {Inherit=0,ProtectFromClose=1,}, 256, ... ) == 0x0
 00028   436   NtQuerySystemInformation  (Basic, 44, ... {Unknown=0,MaximumIncrement=156250,PhysicalPageSize=0x1000,NumberOfPhysicalPages=0xff7c,LowestPhysicalPage=0x1,HighestPhysicalPage=0xffff,AllocationGranularity=0x10000,LowestUserAddress=0x10000,HighestUserAddress=0x7ffeffff,ActiveProcessors=1,NumberProcessors=1,}, 0x0, ) == 0x0
 00029   436   NtQueryVirtualMemory  (-1, 0x250000, Basic, 28, ... {BaseAddress=0x250000,AllocationBase=0x250000,AllocationProtect=0x4,RegionSize=0x10000,State=0x2000,Protect=0x0,Type=0x40000,}, 0x0, ) == 0x0
 00030   436   NtAllocateVirtualMemory  (-1, 2424832, 0, 4096, 4096, 4, ... 2424832, 4096, ) == 0x0
 00031   436   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 0, 0, 0, 0}  (24, {28, 56, new_msg, 0, 0, 0, 0, 0} "\210\6\31\1\0\0\0\0\0\0\0\0\0\0\0\0\1\0\0\0\234\6\31\1\4\0\0\0" ... {28, 56, reply, 0, 424, 436, 1478, 0} "h\30\30\0\0\0\0\0\0\0\0\0\0\0\0\0\1\0\0\0\234\6\31\1\4\0\0\0" )  ... {28, 56, reply, 0, 424, 436, 1478, 0}  (24, {28, 56, new_msg, 0, 0, 0, 0, 0} "\210\6\31\1\0\0\0\0\0\0\0\0\0\0\0\0\1\0\0\0\234\6\31\1\4\0\0\0" ... {28, 56, reply, 0, 424, 436, 1478, 0} "h\30\30\0\0\0\0\0\0\0\0\0\0\0\0\0\1\0\0\0\234\6\31\1\4\0\0\0" )  ) == 0x0
 00032   436   NtRegisterThreadTerminatePort  (24, ... ) == 0x0
 00033   436   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\System\CurrentControlSet\Control\Terminal Server"}, ... 16, ) }, ... 16, ) == 0x0
 00034   436   NtQueryValueKey  (16,  (16, "TSAppCompat", Partial, 548, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) , Partial, 548, ... TitleIdx=0, Type=4, Data= (16, "TSAppCompat", Partial, 548, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) }, 16, ) == 0x0
 00035   436   NtClose  (16, ... ) == 0x0
 00036   436   NtAllocateVirtualMemory  (-1, 1232896, 0, 4096, 4096, 260, ... 1232896, 4096, ) == 0x0
 00037   436   NtOpenMutant  (0x1, {24, 0, 0x40, 0, 0,  (0x1, {24, 0, 0x40, 0, 0, "\NlsCacheMutant"}, ... 16, ) }, ... 16, ) == 0x0
 00038   436   NtOpenSection  (0x4, {24, 0, 0x40, 0, 0,  (0x4, {24, 0, 0x40, 0, 0, "\NLS\NlsSectionUnicode"}, ... 28, ) }, ... 28, ) == 0x0
 00039   436   NtMapViewOfSection  (28, -1, (0x0), 0, 0, 0x0, 0, 2, 0, 2, ... (0x260000), 0x0, 90112, ) == 0x0
 00040   436   NtClose  (28, ... ) == 0x0
 00041   436   NtQueryDefaultLocale  (0, 2012046252, ... ) == 0x0
 00042   436   NtOpenSection  (0x4, {24, 0, 0x40, 0, 0,  (0x4, {24, 0, 0x40, 0, 0, "\NLS\NlsSectionLocale"}, ... 28, ) }, ... 28, ) == 0x0
 00043   436   NtMapViewOfSection  (28, -1, (0x0), 0, 0, 0x0, 0, 2, 0, 2, ... (0x280000), 0x0, 212992, ) == 0x0
 00044   436   NtClose  (28, ... ) == 0x0
 00045   436   NtOpenSection  (0x5, {24, 0, 0x40, 0, 0,  (0x5, {24, 0, 0x40, 0, 0, "\NLS\NlsSectionSortkey"}, ... 28, ) }, ... 28, ) == 0x0
 00046   436   NtMapViewOfSection  (28, -1, (0x0), 0, 0, 0x0, 0, 2, 0, 2, ... (0x2c0000), 0x0, 266240, ) == 0x0
 00047   436   NtQuerySection  (28, Basic, 16, ... {BaseAddress=0x0,Attributes=0x800000,Size={0x40004, 0x0},}, 0x0, ) == 0x0
 00048   436   NtClose  (28, ... ) == 0x0
 00049   436   NtOpenSection  (0x4, {24, 0, 0x40, 0, 0,  (0x4, {24, 0, 0x40, 0, 0, "\NLS\NlsSectionSortTbls"}, ... 28, ) }, ... 28, ) == 0x0
 00050   436   NtMapViewOfSection  (28, -1, (0x0), 0, 0, 0x0, 0, 2, 0, 2, ... (0x310000), 0x0, 24576, ) == 0x0
 00051   436   NtClose  (28, ... ) == 0x0
 00052   436   NtQueryVirtualMemory  (-1, 0x7ffd2000, Basic, 28, ... {BaseAddress=0x7ffd2000,AllocationBase=0x7ffb0000,AllocationProtect=0x2,RegionSize=0x2000,State=0x1000,Protect=0x2,Type=0x40000,}, 0x0, ) == 0x0
 00053   436   NtOpenSection  (0x4, {24, 0, 0x40, 0, 0,  (0x4, {24, 0, 0x40, 0, 0, "\NLS\NlsSectionSortkey00000409"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00054   436   NtOpenSection  (0x4, {24, 0, 0x40, 0, 0,  (0x4, {24, 0, 0x40, 0, 0, "\NLS\NlsSectionSortkey00000409"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00055   436   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 2012558373, 2012047104, 2013025280, 0}  (24, {28, 56, new_msg, 0, 2012558373, 2012047104, 2013025280, 0} "\210\6\31\1\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\234\6\31\18\6\0\0" ... {28, 56, reply, 0, 424, 436, 1481, 0} "8\244\26\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\234\6\31\18\6\0\0" )  ... {28, 56, reply, 0, 424, 436, 1481, 0}  (24, {28, 56, new_msg, 0, 2012558373, 2012047104, 2013025280, 0} "\210\6\31\1\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\234\6\31\18\6\0\0" ... {28, 56, reply, 0, 424, 436, 1481, 0} "8\244\26\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\234\6\31\18\6\0\0" )  ) == 0x0
 00056   436   NtOpenSection  (0xe, {24, 8, 0x40, 0, 0,  (0xe, {24, 8, 0x40, 0, 0, "SHLWAPI.dll"}, ... 28, ) }, ... 28, ) == 0x0
 00057   436   NtMapViewOfSection  (28, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x772d0000), 0x0, 405504, ) == 0x0
 00058   436   NtClose  (28, ... ) == 0x0
 00059   436   NtOpenSection  (0xe, {24, 8, 0x40, 0, 0,  (0xe, {24, 8, 0x40, 0, 0, "msvcrt.dll"}, ... 28, ) }, ... 28, ) == 0x0
 00060   436   NtMapViewOfSection  (28, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x77c10000), 0x0, 339968, ) == 0x0
 00061   436   NtClose  (28, ... ) == 0x0
 00062   436   NtOpenSection  (0xe, {24, 8, 0x40, 0, 0,  (0xe, {24, 8, 0x40, 0, 0, "GDI32.dll"}, ... 28, ) }, ... 28, ) == 0x0
 00063   436   NtMapViewOfSection  (28, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x77c70000), 0x0, 262144, ) == 0x0
 00064   436   NtClose  (28, ... ) == 0x0
 00065   436   NtOpenSection  (0xe, {24, 8, 0x40, 0, 0,  (0xe, {24, 8, 0x40, 0, 0, "USER32.dll"}, ... 28, ) }, ... 28, ) == 0x0
 00066   436   NtMapViewOfSection  (28, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x77d40000), 0x0, 577536, ) == 0x0
 00067   436   NtClose  (28, ... ) == 0x0
 00068   436   NtOpenSection  (0xe, {24, 8, 0x40, 0, 0,  (0xe, {24, 8, 0x40, 0, 0, "ADVAPI32.dll"}, ... 28, ) }, ... 28, ) == 0x0
 00069   436   NtMapViewOfSection  (28, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x77dd0000), 0x0, 569344, ) == 0x0
 00070   436   NtClose  (28, ... ) == 0x0
 00071   436   NtOpenSection  (0xe, {24, 8, 0x40, 0, 0,  (0xe, {24, 8, 0x40, 0, 0, "RPCRT4.dll"}, ... 28, ) }, ... 28, ) == 0x0
 00072   436   NtMapViewOfSection  (28, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x77cc0000), 0x0, 479232, ) == 0x0
 00073   436   NtClose  (28, ... ) == 0x0
 00074   436   NtProtectVirtualMemory  (-1, (0x407000), 204, 4, ... (0x407000), 4096, 2, ) == 0x0
 00075   436   NtProtectVirtualMemory  (-1, (0x407000), 4096, 2, ... (0x407000), 4096, 4, ) == 0x0
 00076   436   NtFlushInstructionCache  (-1, 4222976, 204, ... ) == 0x0
 00077   436   NtProtectVirtualMemory  (-1, (0x407000), 204, 4, ... (0x407000), 4096, 2, ) == 0x0
 00078   436   NtProtectVirtualMemory  (-1, (0x407000), 4096, 2, ... (0x407000), 4096, 4, ) == 0x0
 00079   436   NtFlushInstructionCache  (-1, 4222976, 204, ... ) == 0x0
 00080   436   NtProtectVirtualMemory  (-1, (0x407000), 204, 4, ... (0x407000), 4096, 2, ) == 0x0
 00081   436   NtProtectVirtualMemory  (-1, (0x407000), 4096, 2, ... (0x407000), 4096, 4, ) == 0x0
 00082   436   NtFlushInstructionCache  (-1, 4222976, 204, ... ) == 0x0
 00083   436   NtOpenProcessToken  (-1, 0x8, ... 28, ) == 0x0
 00084   436   NtQueryInformationToken  (28, Statistics, 56, ... {token info, class 10, size 56}, 56, ) == 0x0
 00085   436   NtClose  (28, ... ) == 0x0
 00086   436   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\System\CurrentControlSet\Control\Terminal Server"}, ... 28, ) }, ... 28, ) == 0x0
 00087   436   NtQueryValueKey  (28,  (28, "TSAppCompat", Partial, 548, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) , Partial, 548, ... TitleIdx=0, Type=4, Data= (28, "TSAppCompat", Partial, 548, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) }, 16, ) == 0x0
 00088   436   NtClose  (28, ... ) == 0x0
 00089   436   NtQuerySystemInformation  (Basic, 44, ... {Unknown=0,MaximumIncrement=156250,PhysicalPageSize=0x1000,NumberOfPhysicalPages=0xff7c,LowestPhysicalPage=0x1,HighestPhysicalPage=0xffff,AllocationGranularity=0x10000,LowestUserAddress=0x10000,HighestUserAddress=0x7ffeffff,ActiveProcessors=1,NumberProcessors=1,}, 0x0, ) == 0x0
 00090   436   NtAllocateVirtualMemory  (-1, 0, 0, 65536, 8192, 4, ... 3276800, 65536, ) == 0x0
 00091   436   NtAllocateVirtualMemory  (-1, 3276800, 0, 4096, 4096, 4, ... 3276800, 4096, ) == 0x0
 00092   436   NtAllocateVirtualMemory  (-1, 3280896, 0, 8192, 4096, 4, ... 3280896, 8192, ) == 0x0
 00093   436   NtAllocateVirtualMemory  (-1, 1323008, 0, 4096, 4096, 4, ... 1323008, 4096, ) == 0x0
 00094   436   NtOpenSection  (0x4, {24, 0, 0x40, 0, 0,  (0x4, {24, 0, 0x40, 0, 0, "\NLS\NlsSectionCType"}, ... 28, ) }, ... 28, ) == 0x0
 00095   436   NtMapViewOfSection  (28, -1, (0x0), 0, 0, 0x0, 0, 2, 0, 2, ... (0x330000), 0x0, 12288, ) == 0x0
 00096   436   NtClose  (28, ... ) == 0x0
 00097   436   NtAllocateVirtualMemory  (-1, 3289088, 0, 4096, 4096, 4, ... 3289088, 4096, ) == 0x0
 00098   436   NtQuerySystemInformation  (Basic, 44, ... {Unknown=0,MaximumIncrement=156250,PhysicalPageSize=0x1000,NumberOfPhysicalPages=0xff7c,LowestPhysicalPage=0x1,HighestPhysicalPage=0xffff,AllocationGranularity=0x10000,LowestUserAddress=0x10000,HighestUserAddress=0x7ffeffff,ActiveProcessors=1,NumberProcessors=1,}, 0x0, ) == 0x0
 00099   436   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1243120, 256, 1242864, 256}  (24, {28, 56, new_msg, 0, 1243120, 256, 1242864, 256} "\210\6\31\1\0\0\0\0\1\0\0\0\360\367\22\0\3\0\0\0\234\6\31\1$\1\0\0" ... {28, 56, reply, 0, 424, 436, 1483, 0} "XQ\26\0\0\0\0\0\0\0\0\0\360\367\22\0\3\0\0\0\234\6\31\1$\1\0\0" )  ... {28, 56, reply, 0, 424, 436, 1483, 0}  (24, {28, 56, new_msg, 0, 1243120, 256, 1242864, 256} "\210\6\31\1\0\0\0\0\1\0\0\0\360\367\22\0\3\0\0\0\234\6\31\1$\1\0\0" ... {28, 56, reply, 0, 424, 436, 1483, 0} "XQ\26\0\0\0\0\0\0\0\0\0\360\367\22\0\3\0\0\0\234\6\31\1$\1\0\0" )  ) == 0x0
 00100   436   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\System\CurrentControlSet\Control\Error Message Instrument\"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00101   436   NtMapViewOfSection  (28, -1, (0x0), 0, 0, 0x0, 0, 2, 0, 2, ... (0x4e0000), 0x0, 1060864, ) == 0x0
 00102   436   NtCreateEvent  (0x1f0003, 0x0, 1, 0, ... 32, ) == 0x0
 00103   436   NtOpenThreadTokenEx  (-2, 0x8, 1, 512, ... ) == STATUS_NO_TOKEN
 00104   436   NtOpenProcessTokenEx  (-1, 0x8, 512, ... -2147482208, ) == 0x0
 00105   436   NtQueryInformationToken  (-2147482208, Statistics, 0, ... ) == STATUS_BUFFER_TOO_SMALL
 00106   436   NtQueryInformationToken  (-2147482208, Statistics, 56, ... {token info, class 10, size 56}, 56, ) == 0x0
 00107   436   NtClose  (-2147482208, ... ) == 0x0
 00108   436   NtAllocateVirtualMemory  (-1, 0, 0, 32, 4096, 4, ... 3407872, 4096, ) == 0x0
 00109   436   NtFreeVirtualMemory  (-1, (0x340000), 4096, 32768, ... (0x340000), 4096, ) == 0x0
 00110   436   NtDuplicateObject  (-1, 36, -1, 0x0, 0, 2, ... 44, ) == 0x0
 00111   436   NtOpenKey  (0x20019, {24, 0, 0x240, 0, 0,  (0x20019, {24, 0, 0x240, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Compatibility32"}, ... -2147482208, ) }, ... -2147482208, ) == 0x0
 00112   436   NtQueryValueKey  (-2147482208,  (-2147482208, "packed", Partial, 172, ... ) , Partial, 172, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00113   436   NtClose  (-2147482208, ... ) == 0x0
 00114   436   NtOpenKey  (0x20019, {24, 0, 0x240, 0, 0,  (0x20019, {24, 0, 0x240, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\IME Compatibility"}, ... -2147482208, ) }, ... -2147482208, ) == 0x0
 00115   436   NtQueryValueKey  (-2147482208,  (-2147482208, "packed", Partial, 172, ... ) , Partial, 172, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00116   436   NtClose  (-2147482208, ... ) == 0x0
 00117   436   NtQueryDefaultLocale  (0, -136377844, ... ) == 0x0
 00118   436   NtGdiQueryFontAssocInfo  (0, ... ) == 0x0
 00119   436   NtUserCallNoParam  (24, ... ) == 0x0
 00120   436   NtGdiCreateCompatibleDC  (0, ...
 00121   436   NtAllocateVirtualMemory  (-1, 0, 0, 4096, 12288, 4, ... 3407872, 4096, ) == 0x0
 00120   436   NtGdiCreateCompatibleDC  ... ) == 0x100103de
 00122   436   NtGdiGetStockObject  (0, ... ) == 0x1900010
 00123   436   NtGdiGetStockObject  (4, ... ) == 0x1900011
 00124   436   NtGdiCreateBitmap  (8, 8, 1, 1, 2010393708, ... ) == 0x13050402
 00125   436   NtGdiCreateSolidBrush  (0, 0, ...
 00126   436   NtAllocateVirtualMemory  (-1, 0, 0, 4096, 12288, 4, ... 3473408, 4096, ) == 0x0
 00125   436   NtGdiCreateSolidBrush  ... ) == 0xe100408
 00127   436   NtGdiGetStockObject  (13, ... ) == 0x18a0021
 00128   436   NtGdiCreateCompatibleDC  (0, ... ) == 0x39010412
 00129   436   NtGdiSelectBitmap  (956367890, 319095810, ... ) == 0x185000f
 00130   436   NtUserGetThreadDesktop  (436, 0, ... ) == 0x28
 00131   436   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Windows"}, ... 48, ) }, ... 48, ) == 0x0
 00132   436   NtQueryValueKey  (48,  (48, "AppInit_DLLs", Partial, 64, ... TitleIdx=0, Type=1, Data="\0\0"}, 14, ) , Partial, 64, ... TitleIdx=0, Type=1, Data= (48, "AppInit_DLLs", Partial, 64, ... TitleIdx=0, Type=1, Data="\0\0"}, 14, ) }, 14, ) == 0x0
 00133   436   NtClose  (48, ... ) == 0x0
 00134   436   NtUserFindExistingCursorIcon  (1241204, 1241220, 1241788, ... ) == 0x10011
 00135   436   NtUserRegisterClassExWOW  (1241724, 1241804, 1241788, 1241820, 673, 128, 0, ... ) == 0x810dc017
 00136   436   NtUserFindExistingCursorIcon  (1241204, 1241220, 1241788, ... ) == 0x10011
 00137   436   NtUserRegisterClassExWOW  (1241724, 1241804, 1241788, 1241820, 674, 128, 0, ... ) == 0x810dc01c
 00138   436   NtUserFindExistingCursorIcon  (1241204, 1241220, 1241788, ... ) == 0x10011
 00139   436   NtUserRegisterClassExWOW  (1241724, 1241804, 1241788, 1241820, 675, 128, 0, ... ) == 0x810dc01e
 00140   436   NtUserFindExistingCursorIcon  (1241204, 1241220, 1241788, ... ) == 0x10011
 00141   436   NtUserRegisterClassExWOW  (1241724, 1241804, 1241788, 1241820, 676, 128, 0, ... ) == 0x810d8002
 00142   436   NtUserFindExistingCursorIcon  (1241204, 1241220, 1241788, ... ) == 0x10013
 00143   436   NtUserRegisterClassExWOW  (1241724, 1241804, 1241788, 1241820, 677, 128, 0, ... ) == 0x810dc018
 00144   436   NtUserFindExistingCursorIcon  (1241204, 1241220, 1241788, ... ) == 0x10011
 00145   436   NtUserRegisterClassExWOW  (1241724, 1241804, 1241788, 1241820, 678, 128, 0, ... ) == 0x810dc01a
 00146   436   NtUserFindExistingCursorIcon  (1241204, 1241220, 1241788, ... ) == 0x10011
 00147   436   NtUserRegisterClassExWOW  (1241724, 1241804, 1241788, 1241820, 679, 128, 0, ... ) == 0x810dc01d
 00148   436   NtUserFindExistingCursorIcon  (1241204, 1241220, 1241788, ... ) == 0x10011
 00149   436   NtUserRegisterClassExWOW  (1241724, 1241804, 1241788, 1241820, 681, 128, 0, ...
 00150   436   NtAllocateVirtualMemory  (-1, 6320128, 0, 4096, 4096, 32, ... 6320128, 4096, ) == 0x0
 00149   436   NtUserRegisterClassExWOW  ... ) == 0x810dc026
 00151   436   NtUserFindExistingCursorIcon  (1241204, 1241220, 1241788, ... ) == 0x10011
 00152   436   NtUserRegisterClassExWOW  (1241724, 1241804, 1241788, 1241820, 680, 128, 0, ... ) == 0x810dc019
 00153   436   NtUserRegisterClassExWOW  (1241676, 1241756, 1241740, 1241772, 0, 128, 0, ... ) == 0x810dc020
 00154   436   NtUserRegisterClassExWOW  (1241676, 1241752, 1241768, 1241740, 0, 130, 0, ... ) == 0x810dc022
 00155   436   NtUserRegisterClassExWOW  (1241676, 1241756, 1241740, 1241772, 0, 128, 0, ... ) == 0x810dc023
 00156   436   NtUserRegisterClassExWOW  (1241676, 1241752, 1241768, 1241740, 0, 130, 0, ... ) == 0x810dc024
 00157   436   NtUserRegisterClassExWOW  (1241676, 1241756, 1241740, 1241772, 0, 128, 0, ... ) == 0x810dc025
 00158   436   NtCallbackReturn  (0, 0, 0, ...
 00159   436   NtGdiInit  (... ) == 0x1
 00160   436   NtGdiGetStockObject  (18, ... ) == 0x290001c
 00161   436   NtGdiGetStockObject  (19, ... ) == 0x1b00019
 00162   436   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\System\CurrentControlSet\Control\Terminal Server"}, ... 48, ) }, ... 48, ) == 0x0
 00163   436   NtQueryValueKey  (48,  (48, "TSAppCompat", Partial, 548, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) , Partial, 548, ... TitleIdx=0, Type=4, Data= (48, "TSAppCompat", Partial, 548, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) }, 16, ) == 0x0
 00164   436   NtQueryValueKey  (48,  (48, "TSUserEnabled", Partial, 548, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) , Partial, 548, ... TitleIdx=0, Type=4, Data= (48, "TSUserEnabled", Partial, 548, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) }, 16, ) == 0x0
 00165   436   NtClose  (48, ... ) == 0x0
 00166   436   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon"}, ... 48, ) }, ... 48, ) == 0x0
 00167   436   NtQueryValueKey  (48,  (48, "LeakTrack", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00168   436   NtClose  (48, ... ) == 0x0
 00169   436   NtOpenKey  (0x2000000, {24, 0, 0x40, 0, 0,  (0x2000000, {24, 0, 0x40, 0, 0, "\REGISTRY\MACHINE"}, ... 48, ) }, ... 48, ) == 0x0
 00170   436   NtSetInformationObject  (48, Handle, {Inherit=0,ProtectFromClose=1,}, 2011365632, ... ) == 0x0
 00171   436   NtOpenKey  (0x20019, {24, 48, 0x40, 0, 0,  (0x20019, {24, 48, 0x40, 0, 0, "Software\Microsoft\Windows NT\CurrentVersion\Diagnostics"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00172   436   NtOpenKey  (0x2000000, {24, 48, 0x40, 0, 0,  (0x2000000, {24, 48, 0x40, 0, 0, "Software\Microsoft\Windows\CurrentVersion\Explorer\Performance"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00173   436   NtTestAlert  (... ) == 0x0
 00174   436   NtContinue  (1244464, 1, ...
 00175   436   NtSetInformationThread  (-2, Win32StartAddress(LpcReceivedMessageId), {StartAddress(LpcReceivedMsgId)=0x401440,}, 4, ... ) == 0x0
 00176   436   NtCreateFile  (0x80100080, {24, 0, 0x40, 0, 1244716,  (0x80100080, {24, 0, 0x40, 0, 1244716, "\??\u:\work\packed.exe"}, 0x0, 0, 1, 1, 96, 0, 0, ... 52, {status=0x0, info=1}, ) }, 0x0, 0, 1, 1, 96, 0, 0, ... 52, {status=0x0, info=1}, ) == 0x0
 00177   436   NtClose  (52, ... ) == 0x0
 00178   436   NtProtectVirtualMemory  (-1, (0x402000), 19456, 64, ... (0x402000), 20480, 32, ) == 0x0
 00179   436   NtProtectVirtualMemory  (-1, (0x402000), 19456, 32, ... (0x402000), 20480, 64, ) == 0x0
 00180   436   NtProtectVirtualMemory  (-1, (0x408000), 25088, 64, ... (0x408000), 28672, 8, ) == 0x0
 00181   436   NtProtectVirtualMemory  (-1, (0x408000), 25088, 8, ... (0x408000), 28672, 64, ) == 0x0
 00182   436   NtOpenKey  (0x1, {24, 0, 0x40, 0, 0,  (0x1, {24, 0, 0x40, 0, 0, "\Registry\MACHINE\System\CurrentControlSet\Control\Session Manager"}, ... 52, ) }, ... 52, ) == 0x0
 00183   436   NtQueryValueKey  (52,  (52, "SafeDllSearchMode", Partial, 16, ... ) , Partial, 16, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00184   436   NtClose  (52, ... ) == 0x0
 00185   436   NtOpenSection  (0xe, {24, 8, 0x40, 0, 0,  (0xe, {24, 8, 0x40, 0, 0, "wininet.dll"}, ... 52, ) }, ... 52, ) == 0x0
 00186   436   NtMapViewOfSection  (52, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x76200000), 0x0, 618496, ) == 0x0
 00187   436   NtClose  (52, ... ) == 0x0
 00188   436   NtOpenSection  (0xe, {24, 8, 0x40, 0, 0,  (0xe, {24, 8, 0x40, 0, 0, "CRYPT32.dll"}, ... 52, ) }, ... 52, ) == 0x0
 00189   436   NtMapViewOfSection  (52, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x762c0000), 0x0, 565248, ) == 0x0
 00190   436   NtClose  (52, ... ) == 0x0
 00191   436   NtOpenSection  (0xe, {24, 8, 0x40, 0, 0,  (0xe, {24, 8, 0x40, 0, 0, "MSASN1.dll"}, ... 52, ) }, ... 52, ) == 0x0
 00192   436   NtMapViewOfSection  (52, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x762a0000), 0x0, 61440, ) == 0x0
 00193   436   NtClose  (52, ... ) == 0x0
 00194   436   NtOpenSection  (0xe, {24, 8, 0x40, 0, 0,  (0xe, {24, 8, 0x40, 0, 0, "OLEAUT32.dll"}, ... 52, ) }, ... 52, ) == 0x0
 00195   436   NtMapViewOfSection  (52, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x77120000), 0x0, 569344, ) == 0x0
 00196   436   NtClose  (52, ... ) == 0x0
 00197   436   NtOpenSection  (0xe, {24, 8, 0x40, 0, 0,  (0xe, {24, 8, 0x40, 0, 0, "OLE32.DLL"}, ... 52, ) }, ... 52, ) == 0x0
 00198   436   NtMapViewOfSection  (52, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x771b0000), 0x0, 1155072, ) == 0x0
 00199   436   NtClose  (52, ... ) == 0x0
 00200   436   NtOpenKey  (0x20019, {24, 48, 0x40, 0, 0,  (0x20019, {24, 48, 0x40, 0, 0, "SYSTEM\CurrentControlSet\Services\crypt32\Performance"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00201   436   NtAllocateVirtualMemory  (-1, 1327104, 0, 4096, 4096, 4, ... 1327104, 4096, ) == 0x0
 00202   436   NtAllocateVirtualMemory  (-1, 1331200, 0, 4096, 4096, 4, ... 1331200, 4096, ) == 0x0
 00203   436   NtAllocateVirtualMemory  (-1, 1335296, 0, 4096, 4096, 4, ... 1335296, 4096, ) == 0x0
 00204   436   NtAllocateVirtualMemory  (-1, 1339392, 0, 4096, 4096, 4, ... 1339392, 4096, ) == 0x0
 00205   436   NtOpenDirectoryObject  (0x2000f, {24, 0, 0x40, 0, 0,  (0x2000f, {24, 0, 0x40, 0, 0, "\BaseNamedObjects"}, ... 52, ) }, ... 52, ) == 0x0
 00206   436   NtCreateEvent  (0x1f0003, {24, 52, 0x80, 1240840, 0,  (0x1f0003, {24, 52, 0x80, 1240840, 0, "Global\crypt32LogoffEvent"}, 0, 0, ... ) }, 0, 0, ... ) == STATUS_ACCESS_DENIED
 00207   436   NtOpenEvent  (0x100000, {24, 52, 0x0, 0, 0,  (0x100000, {24, 52, 0x0, 0, 0, "Global\crypt32LogoffEvent"}, ... 56, ) }, ... 56, ) == 0x0
 00208   436   NtQuerySystemInformation  (Basic, 44, ... {Unknown=0,MaximumIncrement=156250,PhysicalPageSize=0x1000,NumberOfPhysicalPages=0xff7c,LowestPhysicalPage=0x1,HighestPhysicalPage=0xffff,AllocationGranularity=0x10000,LowestUserAddress=0x10000,HighestUserAddress=0x7ffeffff,ActiveProcessors=1,NumberProcessors=1,}, 0x0, ) == 0x0
 00209   436   NtQuerySystemInformation  (Processor, 12, ... {system info, class 1, size 12}, 0x0, ) == 0x0
 00210   436   NtOpenKey  (0x20019, {24, 48, 0x40, 0, 0,  (0x20019, {24, 48, 0x40, 0, 0, "SYSTEM\CurrentControlSet\Control\Session Manager"}, ... 60, ) }, ... 60, ) == 0x0
 00211   436   NtQueryValueKey  (60,  (60, "CriticalSectionTimeout", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\215'\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (60, "CriticalSectionTimeout", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\215'\0"}, 16, ) }, 16, ) == 0x0
 00212   436   NtClose  (60, ... ) == 0x0
 00213   436   NtQuerySystemInformation  (Basic, 44, ... {Unknown=0,MaximumIncrement=156250,PhysicalPageSize=0x1000,NumberOfPhysicalPages=0xff7c,LowestPhysicalPage=0x1,HighestPhysicalPage=0xffff,AllocationGranularity=0x10000,LowestUserAddress=0x10000,HighestUserAddress=0x7ffeffff,ActiveProcessors=1,NumberProcessors=1,}, 0x0, ) == 0x0
 00214   436   NtQuerySystemInformation  (Processor, 12, ... {system info, class 1, size 12}, 0x0, ) == 0x0
 00215   436   NtAllocateVirtualMemory  (-1, 1343488, 0, 4096, 4096, 4, ... 1343488, 4096, ) == 0x0
 00216   436   NtQuerySystemInformation  (Basic, 44, ... {Unknown=0,MaximumIncrement=156250,PhysicalPageSize=0x1000,NumberOfPhysicalPages=0xff7c,LowestPhysicalPage=0x1,HighestPhysicalPage=0xffff,AllocationGranularity=0x10000,LowestUserAddress=0x10000,HighestUserAddress=0x7ffeffff,ActiveProcessors=1,NumberProcessors=1,}, 0x0, ) == 0x0
 00217   436   NtQuerySystemInformation  (Processor, 12, ... {system info, class 1, size 12}, 0x0, ) == 0x0
 00218   436   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Classes\Interface"}, ... 60, ) }, ... 60, ) == 0x0
 00219   436   NtQueryValueKey  (60,  (60, "InterfaceHelperDisableAll", Full, 0, ... ) , Full, 0, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00220   436   NtQueryValueKey  (60,  (60, "InterfaceHelperDisableAllForOle32", Full, 0, ... ) , Full, 0, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00221   436   NtQueryValueKey  (60,  (60, "InterfaceHelperDisableTypeLib", Full, 0, ... ) , Full, 0, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00222   436   NtClose  (60, ... ) == 0x0
 00223   436   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Classes\Interface\{00020400-0000-0000-C000-000000000046}"}, ... 60, ) }, ... 60, ) == 0x0
 00224   436   NtQueryValueKey  (60,  (60, "InterfaceHelperDisableAll", Full, 0, ... ) , Full, 0, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00225   436   NtQueryValueKey  (60,  (60, "InterfaceHelperDisableAllForOle32", Full, 0, ... ) , Full, 0, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00226   436   NtClose  (60, ... ) == 0x0
 00227   436   NtOpenEvent  (0x1f0003, {24, 52, 0x0, 0, 0,  (0x1f0003, {24, 52, 0x0, 0, 0, "HookSwitchHookEnabledEvent"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00228   436   NtUserRegisterWindowMessage  ( ("{FB8F0821-0164-101B-84ED-08002B2EC713}", ... ) , ... ) == 0xc07b
 00229   436   NtOpenKey  (0x1, {24, 48, 0x40, 0, 0,  (0x1, {24, 48, 0x40, 0, 0, "SOFTWARE\Microsoft\OLEAUT"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00230   436   NtOpenKey  (0x9, {24, 48, 0x40, 0, 0,  (0x9, {24, 48, 0x40, 0, 0, "SOFTWARE\Microsoft\OLEAUT\UserEra"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00231   436   NtAllocateVirtualMemory  (-1, 1228800, 0, 4096, 4096, 260, ... 1228800, 4096, ) == 0x0
 00232   436   NtOpenKey  (0x1, {24, 48, 0x40, 0, 0,  (0x1, {24, 48, 0x40, 0, 0, "SOFTWARE\Microsoft\OLEAUT"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00233   436   NtAllocateVirtualMemory  (-1, 1347584, 0, 8192, 4096, 4, ... 1347584, 8192, ) == 0x0
 00234   436   NtOpenThreadTokenEx  (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN
 00235   436   NtOpenProcessTokenEx  (-1, 0x20008, 512, ... 60, ) == 0x0
 00236   436   NtQueryInformationToken  (60, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0
 00237   436   NtClose  (60, ... ) == 0x0
 00238   436   NtOpenKey  (0x2000000, {24, 0, 0x640, 0, 0,  (0x2000000, {24, 0, 0x640, 0, 0, "\REGISTRY\USER\S-1-5-21-1078081533-484763869-839522115-1003"}, ... 60, ) }, ... 60, ) == 0x0
 00239   436   NtSetInformationObject  (60, Handle, {Inherit=0,ProtectFromClose=1,}, 1179904, ... ) == 0x0
 00240   436   NtCreateKey  (0xf003f, {24, 60, 0x40, 0, 0,  (0xf003f, {24, 60, 0x40, 0, 0, "SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\P3P\History"}, 0, 0x0, 0, ... 64, 2, ) }, 0, 0x0, 0, ... 64, 2, ) == 0x0
 00241   436   NtQueryDefaultUILanguage  (1239076, ...
 00242   436   NtOpenThreadTokenEx  (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN
 00243   436   NtOpenProcessTokenEx  (-1, 0x20008, 512, ... -2147482208, ) == 0x0
 00244   436   NtQueryInformationToken  (-2147482208, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0
 00245   436   NtClose  (-2147482208, ... ) == 0x0
 00246   436   NtOpenKey  (0x2000000, {24, 0, 0x640, 0, 0,  (0x2000000, {24, 0, 0x640, 0, 0, "\REGISTRY\USER\S-1-5-21-1078081533-484763869-839522115-1003"}, ... -2147482208, ) }, ... -2147482208, ) == 0x0
 00247   436   NtOpenKey  (0x80000000, {24, 0, 0x240, 0, 0,  (0x80000000, {24, 0, 0x240, 0, 0, "\Registry\Machine\System\CurrentControlSet\Control\Nls\MUILanguages"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00248   436   NtOpenKey  (0x80000000, {24, -2147482208, 0x640, 0, 0,  (0x80000000, {24, -2147482208, 0x640, 0, 0, "Control Panel\Desktop"}, ... -2147482196, ) }, ... -2147482196, ) == 0x0
 00249   436   NtQueryValueKey  (-2147482196,  (-2147482196, "MultiUILanguageId", Partial, 256, ... ) , Partial, 256, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00250   436   NtClose  (-2147482196, ... ) == 0x0
 00251   436   NtClose  (-2147482208, ... ) == 0x0
 00241   436   NtQueryDefaultUILanguage  ... ) == 0x0
 00252   436   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\System\CurrentControlSet\Control\Nls\MUILanguages"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00253   436   NtQueryInstallUILanguage  (2012047340, ... ) == 0x0
 00254   436   NtOpenFile  (0x1200a9, {24, 0, 0x40, 0, 0,  (0x1200a9, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\wininet.dll"}, 1, 96, ... 68, {status=0x0, info=1}, ) }, 1, 96, ... 68, {status=0x0, info=1}, ) == 0x0
 00255   436   NtCreateSection  (0x4, 0x0, 0x0, 2, 134217728, 68, ... 72, ) == 0x0
 00256   436   NtMapViewOfSection  (72, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 2, ... (0x360000), 0x0, 593920, ) == 0x0
 00257   436   NtOpenFile  (0x1200a9, {24, 0, 0x40, 0, 0,  (0x1200a9, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\wininet.dll.123.Manifest"}, 1, 96, ... ) }, 1, 96, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00258   436   NtQueryDefaultUILanguage  (2013024600, ...
 00259   436   NtOpenThreadTokenEx  (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN
 00260   436   NtOpenProcessTokenEx  (-1, 0x20008, 512, ... -2147482208, ) == 0x0
 00261   436   NtQueryInformationToken  (-2147482208, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0
 00262   436   NtClose  (-2147482208, ... ) == 0x0
 00263   436   NtOpenKey  (0x2000000, {24, 0, 0x640, 0, 0,  (0x2000000, {24, 0, 0x640, 0, 0, "\REGISTRY\USER\S-1-5-21-1078081533-484763869-839522115-1003"}, ... -2147482208, ) }, ... -2147482208, ) == 0x0
 00264   436   NtOpenKey  (0x80000000, {24, 0, 0x240, 0, 0,  (0x80000000, {24, 0, 0x240, 0, 0, "\Registry\Machine\System\CurrentControlSet\Control\Nls\MUILanguages"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00265   436   NtOpenKey  (0x80000000, {24, -2147482208, 0x640, 0, 0,  (0x80000000, {24, -2147482208, 0x640, 0, 0, "Control Panel\Desktop"}, ... -2147482196, ) }, ... -2147482196, ) == 0x0
 00266   436   NtQueryValueKey  (-2147482196,  (-2147482196, "MultiUILanguageId", Partial, 256, ... ) , Partial, 256, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00267   436   NtClose  (-2147482196, ... ) == 0x0
 00268   436   NtClose  (-2147482208, ... ) == 0x0
 00258   436   NtQueryDefaultUILanguage  ... ) == 0x0
 00269   436   NtQueryInstallUILanguage  (2013024602, ... ) == 0x0
 00270   436   NtQueryDefaultLocale  (1, 1237112, ... ) == 0x0
 00271   436   NtOpenFile  (0x1200a9, {24, 0, 0x40, 0, 0,  (0x1200a9, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\wininet.dll.123.Config"}, 1, 96, ... ) }, 1, 96, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00272   436   NtRequestWaitReplyPort  (24, {128, 156, new_msg, 0, 1237968, 1, 96, 0}  (24, {128, 156, new_msg, 0, 1237968, 1, 96, 0} "\210\6\31\1\33\0\1\0\0\0\0\0\1\347\22\0\1\0\0\0\0\0\11\4\1\1\1\0>\0@\0\250\6\31\1D\0\0\0\377\377\377\377\0\0\0\0P\275=\0\0\0\0\0\312\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0(\0,\0\350\6\31\1\0\0\0\0\0\0\0\0\320\352\22\0\0\0\0\0" ... {128, 156, reply, 0, 424, 436, 1495, 0} "(\350\26\0\33\0\1\0\0\0\0\0\1\347\22\0\1\0\0\0\0\0\11\4\1\1\1\0>\0@\0\250\6\31\1D\0\0\0\377\377\377\377\0\0\0\0P\275=\0\0\0\0\0\312\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0(\0,\0\350\6\31\1\0\0\0\0\0\0\0\0\320\352\22\0\0\0\0\0" )  ... {128, 156, reply, 0, 424, 436, 1495, 0}  (24, {128, 156, new_msg, 0, 1237968, 1, 96, 0} "\210\6\31\1\33\0\1\0\0\0\0\0\1\347\22\0\1\0\0\0\0\0\11\4\1\1\1\0>\0@\0\250\6\31\1D\0\0\0\377\377\377\377\0\0\0\0P\275=\0\0\0\0\0\312\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0(\0,\0\350\6\31\1\0\0\0\0\0\0\0\0\320\352\22\0\0\0\0\0" ... {128, 156, reply, 0, 424, 436, 1495, 0} "(\350\26\0\33\0\1\0\0\0\0\0\1\347\22\0\1\0\0\0\0\0\11\4\1\1\1\0>\0@\0\250\6\31\1D\0\0\0\377\377\377\377\0\0\0\0P\275=\0\0\0\0\0\312\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0(\0,\0\350\6\31\1\0\0\0\0\0\0\0\0\320\352\22\0\0\0\0\0" )  ) == 0x0
 00273   436   NtClose  (68, ... ) == 0x0
 00274   436   NtClose  (72, ... ) == 0x0
 00275   436   NtUnmapViewOfSection  (-1, 0x360000, ... ) == 0x0
 00276   436   NtUnmapViewOfSection  (-1, 0x12ead0, ... ) == STATUS_NOT_MAPPED_VIEW
 00277   436   NtQueryDebugFilterState  (53, 2, ... ) == 0x0
 00278   436   NtOpenKey  (0x8, {24, 0, 0x40, 0, 0,  (0x8, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows\CurrentVersion\SideBySide\AssemblyStorageRoots"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00279   436   NtQueryDebugFilterState  (53, 2, ... ) == 0x0
 00280   436   NtQueryDebugFilterState  (53, 2, ... ) == 0x0
 00281   436   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\u:\work\packed.exe.Local\"}, 1235652, ... ) }, 1235652, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00282   436   NtQueryDebugFilterState  (53, 2, ... ) == 0x0
 00283   436   NtQueryDebugFilterState  (53, 2, ... ) == 0x0
 00284   436   NtQueryDebugFilterState  (53, 2, ... ) == 0x0
 00285   436   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.0.0_x-ww_1382d70a"}, 1236244, ... ) }, 1236244, ... ) == 0x0
 00286   436   NtOpenFile  (0x100020, {24, 0, 0x40, 0, 0,  (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.0.0_x-ww_1382d70a"}, 3, 33, ... 72, {status=0x0, info=1}, ) }, 3, 33, ... 72, {status=0x0, info=1}, ) == 0x0
 00287   436   NtQueryDebugFilterState  (53, 2, ... ) == 0x0
 00288   436   NtOpenFile  (0x100020, {24, 0, 0x40, 0, 0,  (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.0.0_x-ww_1382d70a\comctl32.dll"}, 5, 96, ... 68, {status=0x0, info=1}, ) }, 5, 96, ... 68, {status=0x0, info=1}, ) == 0x0
 00289   436   NtCreateSection  (0xe, 0x0, 0x0, 16, 134217728, 68, ... 76, ) == 0x0
 00290   436   NtClose  (68, ... ) == 0x0
 00291   436   NtMapViewOfSection  (76, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 16, ... (0x900000), 0x0, 921600, ) == 0x0
 00292   436   NtClose  (76, ... ) == 0x0
 00293   436   NtUnmapViewOfSection  (-1, 0x900000, ... ) == 0x0
 00294   436   NtOpenFile  (0x100020, {24, 0, 0x40, 0, 0,  (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.0.0_x-ww_1382d70a\comctl32.dll"}, 5, 96, ... 76, {status=0x0, info=1}, ) }, 5, 96, ... 76, {status=0x0, info=1}, ) == 0x0
 00295   436   NtCreateSection  (0xf, 0x0, 0x0, 16, 16777216, 76, ... 68, ) == 0x0
 00296   436   NtQuerySection  (68, Image, 48, ... {section info, class 1, size 48}, 0x0, ) == 0x0
 00297   436   NtOpenProcessToken  (-1, 0x8, ... 80, ) == 0x0
 00298   436   NtQueryInformationToken  (80, User, 136, ... {token info, class 1, size 36}, 36, ) == 0x0
 00299   436   NtOpenKey  (0x3, {24, 0, 0x40, 0, 0,  (0x3, {24, 0, 0x40, 0, 0, "\Registry\MACHINE\System\CurrentControlSet\Control\SafeBoot\Option"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00300   436   NtOpenKey  (0x1, {24, 0, 0x40, 0, 0,  (0x1, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers"}, ... 84, ) }, ... 84, ) == 0x0
 00301   436   NtQueryValueKey  (84,  (84, "TransparentEnabled", Partial, 80, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) , Partial, 80, ... TitleIdx=0, Type=4, Data= (84, "TransparentEnabled", Partial, 80, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) }, 16, ) == 0x0
 00302   436   NtClose  (84, ... ) == 0x0
 00303   436   NtOpenThreadTokenEx  (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN
 00304   436   NtOpenProcessTokenEx  (-1, 0x20008, 512, ... 84, ) == 0x0
 00305   436   NtQueryInformationToken  (84, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0
 00306   436   NtClose  (84, ... ) == 0x0
 00307   436   NtOpenKey  (0x1, {24, 0, 0x40, 0, 0,  (0x1, {24, 0, 0x40, 0, 0, "\REGISTRY\USER\S-1-5-21-1078081533-484763869-839522115-1003\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00308   436   NtClose  (80, ... ) == 0x0
 00309   436   NtClose  (76, ... ) == 0x0
 00310   436   NtMapViewOfSection  (68, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x71950000), 0x0, 933888, ) == 0x0
 00311   436   NtClose  (68, ... ) == 0x0
 00312   436   NtProtectVirtualMemory  (-1, (0x71951000), 1952, 4, ... (0x71951000), 4096, 32, ) == 0x0
 00313   436   NtProtectVirtualMemory  (-1, (0x71951000), 4096, 32, ... (0x71951000), 4096, 4, ) == 0x0
 00314   436   NtFlushInstructionCache  (-1, 1905594368, 1952, ... ) == 0x0
 00315   436   NtProtectVirtualMemory  (-1, (0x71951000), 1952, 4, ... (0x71951000), 4096, 32, ) == 0x0
 00316   436   NtProtectVirtualMemory  (-1, (0x71951000), 4096, 32, ... (0x71951000), 4096, 4, ) == 0x0
 00317   436   NtFlushInstructionCache  (-1, 1905594368, 1952, ... ) == 0x0
 00318   436   NtProtectVirtualMemory  (-1, (0x71951000), 1952, 4, ... (0x71951000), 4096, 32, ) == 0x0
 00319   436   NtProtectVirtualMemory  (-1, (0x71951000), 4096, 32, ... (0x71951000), 4096, 4, ) == 0x0
 00320   436   NtFlushInstructionCache  (-1, 1905594368, 1952, ... ) == 0x0
 00321   436   NtProtectVirtualMemory  (-1, (0x71951000), 1952, 4, ... (0x71951000), 4096, 32, ) == 0x0
 00322   436   NtProtectVirtualMemory  (-1, (0x71951000), 4096, 32, ... (0x71951000), 4096, 4, ) == 0x0
 00323   436   NtFlushInstructionCache  (-1, 1905594368, 1952, ... ) == 0x0
 00324   436   NtProtectVirtualMemory  (-1, (0x71951000), 1952, 4, ... (0x71951000), 4096, 32, ) == 0x0
 00325   436   NtProtectVirtualMemory  (-1, (0x71951000), 4096, 32, ... (0x71951000), 4096, 4, ) == 0x0
 00326   436   NtFlushInstructionCache  (-1, 1905594368, 1952, ... ) == 0x0
 00327   436   NtProtectVirtualMemory  (-1, (0x71951000), 1952, 4, ... (0x71951000), 4096, 32, ) == 0x0
 00328   436   NtProtectVirtualMemory  (-1, (0x71951000), 4096, 32, ... (0x71951000), 4096, 4, ) == 0x0
 00329   436   NtFlushInstructionCache  (-1, 1905594368, 1952, ... ) == 0x0
 00330   436   NtProtectVirtualMemory  (-1, (0x71951000), 1952, 4, ... (0x71951000), 4096, 32, ) == 0x0
 00331   436   NtProtectVirtualMemory  (-1, (0x71951000), 4096, 32, ... (0x71951000), 4096, 4, ) == 0x0
 00332   436   NtFlushInstructionCache  (-1, 1905594368, 1952, ... ) == 0x0
 00333   436   NtAddAtom  ( ("T\0h\0e\0m\0e\0P\0r\0o\0p\0S\0c\0r\0o\0l\0l\0B\0a\0r\0C\0t\0l\0", 42, 1237428, ... ) , 42, 1237428, ... ) == 0x0
 00334   436   NtQueryDefaultUILanguage  (1236144, ...
 00335   436   NtOpenThreadTokenEx  (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN
 00336   436   NtOpenProcessTokenEx  (-1, 0x20008, 512, ... -2147482208, ) == 0x0
 00337   436   NtQueryInformationToken  (-2147482208, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0
 00338   436   NtClose  (-2147482208, ... ) == 0x0
 00339   436   NtOpenKey  (0x2000000, {24, 0, 0x640, 0, 0,  (0x2000000, {24, 0, 0x640, 0, 0, "\REGISTRY\USER\S-1-5-21-1078081533-484763869-839522115-1003"}, ... -2147482208, ) }, ... -2147482208, ) == 0x0
 00340   436   NtOpenKey  (0x80000000, {24, 0, 0x240, 0, 0,  (0x80000000, {24, 0, 0x240, 0, 0, "\Registry\Machine\System\CurrentControlSet\Control\Nls\MUILanguages"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00341   436   NtOpenKey  (0x80000000, {24, -2147482208, 0x640, 0, 0,  (0x80000000, {24, -2147482208, 0x640, 0, 0, "Control Panel\Desktop"}, ... -2147482196, ) }, ... -2147482196, ) == 0x0
 00342   436   NtQueryValueKey  (-2147482196,  (-2147482196, "MultiUILanguageId", Partial, 256, ... ) , Partial, 256, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00343   436   NtClose  (-2147482196, ... ) == 0x0
 00344   436   NtClose  (-2147482208, ... ) == 0x0
 00334   436   NtQueryDefaultUILanguage  ... ) == 0x0
 00345   436   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\System\CurrentControlSet\Control\Nls\MUILanguages"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00346   436   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\WindowsShell.Manifest"}, 1234996, ... ) }, 1234996, ... ) == 0x0
 00347   436   NtOpenFile  (0x100020, {24, 0, 0x40, 0, 0,  (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\WindowsShell.Manifest"}, 5, 96, ... 68, {status=0x0, info=1}, ) }, 5, 96, ... 68, {status=0x0, info=1}, ) == 0x0
 00348   436   NtCreateSection  (0xe, 0x0, 0x0, 16, 134217728, 68, ... 76, ) == 0x0
 00349   436   NtClose  (68, ... ) == 0x0
 00350   436   NtMapViewOfSection  (76, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 16, ... (0x360000), 0x0, 4096, ) == 0x0
 00351   436   NtClose  (76, ... ) == 0x0
 00352   436   NtUnmapViewOfSection  (-1, 0x360000, ... ) == 0x0
 00353   436   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\WindowsShell.Manifest"}, 1234636, ... ) }, 1234636, ... ) == 0x0
 00354   436   NtCreateFile  (0x80100080, {24, 0, 0x40, 0, 1235336,  (0x80100080, {24, 0, 0x40, 0, 1235336, "\??\C:\WINDOWS\WindowsShell.Manifest"}, 0x0, 0, 5, 1, 96, 0, 0, ... 76, {status=0x0, info=1}, ) }, 0x0, 0, 5, 1, 96, 0, 0, ... 76, {status=0x0, info=1}, ) == 0x0
 00355   436   NtCreateSection  (0xf0005, 0x0, 0x0, 2, 134217728, 76, ... 68, ) == 0x0
 00356   436   NtClose  (76, ... ) == 0x0
 00357   436   NtMapViewOfSection  (68, -1, (0x0), 0, 0, {0, 0}, 0, 1, 0, 2, ... (0x360000), {0, 0}, 4096, ) == 0x0
 00358   436   NtClose  (68, ... ) == 0x0
 00359   436   NtUnmapViewOfSection  (-1, 0x360000, ... ) == 0x0
 00360   436   NtOpenFile  (0x1200a9, {24, 0, 0x40, 0, 0,  (0x1200a9, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\WindowsShell.Manifest"}, 1, 96, ... 68, {status=0x0, info=1}, ) }, 1, 96, ... 68, {status=0x0, info=1}, ) == 0x0
 00361   436   NtCreateSection  (0x4, 0x0, 0x0, 2, 134217728, 68, ... 76, ) == 0x0
 00362   436   NtMapViewOfSection  (76, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 2, ... (0x360000), 0x0, 4096, ) == 0x0
 00363   436   NtQueryInformationFile  (68, 1234956, 56, NetworkOpen, ... {status=0x0, info=56}, ) == 0x0
 00364   436   NtOpenFile  (0x1200a9, {24, 0, 0x40, 0, 0,  (0x1200a9, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\WindowsShell.Config"}, 1, 96, ... ) }, 1, 96, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00365   436   NtRequestWaitReplyPort  (24, {128, 156, new_msg, 0, 1235036, 1, 96, 0}  (24, {128, 156, new_msg, 0, 1235036, 1, 96, 0} "\210\6\31\1\33\0\1\0\240\315Z\371\2209\307\1\1\0\0\0\0\0\11\4\1\1\3\0@\0D\0\250\6\31\1D\0\0\0L\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\355\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\26\0\30\0\354\6\31\1\0\0\0\0\0\0\0\0\\337\22\0\0\0\0\0" ... {128, 156, reply, 0, 424, 436, 1496, 0} "h\334\26\0\33\0\1\0\0\0\0\0\2209\307\1\1\0\0\0\0\0\11\4\1\1\3\0@\0D\0\250\6\31\1D\0\0\0L\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\355\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\26\0\30\0\354\6\31\1\0\0\0\0\0\0\0\0\\337\22\0\0\0\0\0" )  ... {128, 156, reply, 0, 424, 436, 1496, 0}  (24, {128, 156, new_msg, 0, 1235036, 1, 96, 0} "\210\6\31\1\33\0\1\0\240\315Z\371\2209\307\1\1\0\0\0\0\0\11\4\1\1\3\0@\0D\0\250\6\31\1D\0\0\0L\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\355\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\26\0\30\0\354\6\31\1\0\0\0\0\0\0\0\0\\337\22\0\0\0\0\0" ... {128, 156, reply, 0, 424, 436, 1496, 0} "h\334\26\0\33\0\1\0\0\0\0\0\2209\307\1\1\0\0\0\0\0\11\4\1\1\3\0@\0D\0\250\6\31\1D\0\0\0L\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\355\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\26\0\30\0\354\6\31\1\0\0\0\0\0\0\0\0\\337\22\0\0\0\0\0" )  ) == 0x0
 00366   436   NtClose  (68, ... ) == 0x0
 00367   436   NtClose  (76, ... ) == 0x0
 00368   436   NtUnmapViewOfSection  (-1, 0x360000, ... ) == 0x0
 00369   436   NtUnmapViewOfSection  (-1, 0x12df5c, ... ) == STATUS_NOT_MAPPED_VIEW
 00370   436   NtQueryDebugFilterState  (53, 2, ... ) == 0x0
 00371   436   NtUserRegisterWindowMessage  ( ("ShellGetDragImage", ... ) , ... ) == 0xc03a
 00372   436   NtUserSystemParametersInfo  (104, 0, 1906151468, 0, ... ) == 0x1
 00373   436   NtUserGetDC  (0, ... ) == 0x1010054
 00374   436   NtUserCallOneParam  (16842836, 56, ... ) == 0x1
 00375   436   NtUserSystemParametersInfo  (38, 4, 1906153440, 0, ... ) == 0x1
 00376   436   NtUserSystemParametersInfo  (66, 12, 1237448, 0, ... ) == 0x1
 00377   436   NtOpenProcessToken  (-1, 0x8, ... 76, ) == 0x0
 00378   436   NtAccessCheck  (1343968, 76, 0x1, 1236852, 1236796, 56, 1236880, ... ) == STATUS_NO_IMPERSONATION_TOKEN
 00379   436   NtClose  (76, ... ) == 0x0
 00380   436   NtOpenKey  (0x20019, {24, 60, 0x40, 0, 0,  (0x20019, {24, 60, 0x40, 0, 0, "Control Panel\Desktop"}, ... 76, ) }, ... 76, ) == 0x0
 00381   436   NtQueryValueKey  (76,  (76, "SmoothScroll", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00382   436   NtClose  (76, ... ) == 0x0
 00383   436   NtUserSystemParametersInfo  (41, 500, 1236948, 0, ... ) == 0x1
 00384   436   NtOpenKey  (0x1, {24, 60, 0x40, 0, 0,  (0x1, {24, 60, 0x40, 0, 0, "software\Microsoft\Windows\CurrentVersion\Explorer\Advanced"}, ... 76, ) }, ... 76, ) == 0x0
 00385   436   NtQueryValueKey  (76,  (76, "EnableBalloonTips", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00386   436   NtOpenKey  (0x1, {24, 48, 0x40, 0, 0,  (0x1, {24, 48, 0x40, 0, 0, "software\Microsoft\Windows\CurrentVersion\Explorer\Advanced"}, ... 68, ) }, ... 68, ) == 0x0
 00387   436   NtQueryValueKey  (68,  (68, "EnableBalloonTips", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00388   436   NtClose  (68, ... ) == 0x0
 00389   436   NtClose  (76, ... ) == 0x0
 00390   436   NtUserSystemParametersInfo  (102, 0, 1906153328, 0, ... ) == 0x1
 00391   436   NtUserSystemParametersInfo  (4130, 0, 1237472, 0, ... ) == 0x1
 00392   436   NtOpenKey  (0x1, {24, 48, 0x40, 0, 0,  (0x1, {24, 48, 0x40, 0, 0, "Software\Microsoft\Windows NT\CurrentVersion\LanguagePack"}, ... 76, ) }, ... 76, ) == 0x0
 00393   436   NtEnumerateValueKey  (76, 0, Full, 220, ... ) == STATUS_NO_MORE_ENTRIES
 00394   436   NtClose  (76, ... ) == 0x0
 00395   436   NtUserFindExistingCursorIcon  (1236756, 1236772, 1237340, ... ) == 0x10011
 00396   436   NtUserRegisterClassExWOW  (1237208, 1237288, 1237272, 1237304, 0, 384, 0, ... ) == 0x810dc03b
 00397   436   NtUserRegisterClassExWOW  (1237208, 1237288, 1237272, 1237304, 0, 384, 0, ... ) == 0x810dc03d
 00398   436   NtUserFindExistingCursorIcon  (1236752, 1236768, 1237336, ... ) == 0x10011
 00399   436   NtUserRegisterClassExWOW  (1237204, 1237284, 1237268, 1237300, 0, 384, 0, ... ) == 0x810dc03f
 00400   436   NtUserFindExistingCursorIcon  (1236756, 1236772, 1237340, ... ) == 0x10011
 00401   436   NtUserRegisterClassExWOW  (1237208, 1237288, 1237272, 1237304, 0, 384, 0, ... ) == 0x810dc041
 00402   436   NtUserFindExistingCursorIcon  (1236756, 1236772, 1237340, ... ) == 0x10011
 00403   436   NtUserRegisterClassExWOW  (1237208, 1237288, 1237272, 1237304, 0, 384, 0, ... ) == 0x810dc043
 00404   436   NtUserRegisterClassExWOW  (1237208, 1237288, 1237272, 1237304, 0, 384, 0, ... ) == 0x810dc045
 00405   436   NtUserFindExistingCursorIcon  (1236756, 1236772, 1237340, ... ) == 0x10011
 00406   436   NtUserRegisterClassExWOW  (1237208, 1237288, 1237272, 1237304, 0, 384, 0, ... ) == 0x810dc047
 00407   436   NtUserFindExistingCursorIcon  (1236752, 1236768, 1237336, ... ) == 0x10011
 00408   436   NtUserRegisterClassExWOW  (1237204, 1237284, 1237268, 1237300, 0, 384, 0, ... ) == 0x810dc049
 00409   436   NtUserGetClassInfo  (1905590272, 1237368, 1237320, 1237396, 0, ... ) == 0xc049
 00410   436   NtUserFindExistingCursorIcon  (1236756, 1236772, 1237340, ... ) == 0x10011
 00411   436   NtUserRegisterClassExWOW  (1237208, 1237288, 1237272, 1237304, 0, 384, 0, ... ) == 0x810dc04b
 00412   436   NtUserFindExistingCursorIcon  (1236756, 1236772, 1237340, ... ) == 0x10011
 00413   436   NtUserRegisterClassExWOW  (1237208, 1237288, 1237272, 1237304, 0, 384, 0, ... ) == 0x810dc04d
 00414   436   NtUserFindExistingCursorIcon  (1236756, 1236772, 1237340, ... ) == 0x10011
 00415   436   NtUserRegisterClassExWOW  (1237208, 1237288, 1237272, 1237304, 0, 384, 0, ... ) == 0x810dc04f
 00416   436   NtUserRegisterClassExWOW  (1237208, 1237288, 1237272, 1237304, 0, 384, 0, ... ) == 0x810dc051
 00417   436   NtUserFindExistingCursorIcon  (1236756, 1236772, 1237340, ... ) == 0x10011
 00418   436   NtUserRegisterClassExWOW  (1237208, 1237288, 1237272, 1237304, 0, 384, 0, ... ) == 0x810dc053
 00419   436   NtUserFindExistingCursorIcon  (1236752, 1236768, 1237336, ... ) == 0x10011
 00420   436   NtUserRegisterClassExWOW  (1237204, 1237284, 1237268, 1237300, 0, 384, 0, ... ) == 0x810dc055
 00421   436   NtUserRegisterClassExWOW  (1237204, 1237284, 1237268, 1237300, 0, 384, 0, ... ) == 0x810dc057
 00422   436   NtUserFindExistingCursorIcon  (1236756, 1236772, 1237340, ... ) == 0x10011
 00423   436   NtUserRegisterClassExWOW  (1237208, 1237288, 1237272, 1237304, 0, 384, 0, ... ) == 0x810dc059
 00424   436   NtUserFindExistingCursorIcon  (1236756, 1236772, 1237340, ... ) == 0x10013
 00425   436   NtUserRegisterClassExWOW  (1237208, 1237288, 1237272, 1237304, 0, 384, 0, ... ) == 0x810dc05b
 00426   436   NtUserFindExistingCursorIcon  (1236756, 1236772, 1237340, ... ) == 0x10011
 00427   436   NtUserRegisterClassExWOW  (1237208, 1237288, 1237272, 1237304, 0, 384, 0, ... ) == 0x810dc05d
 00428   436   NtUserFindExistingCursorIcon  (1236756, 1236772, 1237340, ... ) == 0x10011
 00429   436   NtUserRegisterClassExWOW  (1237208, 1237288, 1237272, 1237304, 0, 384, 0, ... ) == 0x810dc05f
 00430   436   NtUserFindExistingCursorIcon  (1236752, 1236768, 1237336, ... ) == 0x10011
 00431   436   NtUserRegisterClassExWOW  (1237204, 1237284, 1237268, 1237300, 0, 384, 0, ... ) == 0x810dc017
 00432   436   NtUserFindExistingCursorIcon  (1236752, 1236768, 1237336, ... ) == 0x10011
 00433   436   NtUserRegisterClassExWOW  (1237204, 1237284, 1237268, 1237300, 0, 384, 0, ... ) == 0x810dc019
 00434   436   NtUserFindExistingCursorIcon  (1236752, 1236768, 1237336, ... ) == 0x10013
 00435   436   NtUserRegisterClassExWOW  (1237204, 1237284, 1237268, 1237300, 0, 384, 0, ... ) == 0x810dc018
 00436   436   NtUserFindExistingCursorIcon  (1236756, 1236772, 1237340, ... ) == 0x10011
 00437   436   NtUserRegisterClassExWOW  (1237208, 1237288, 1237272, 1237304, 0, 384, 0, ... ) == 0x810dc01a
 00438   436   NtUserFindExistingCursorIcon  (1236752, 1236768, 1237336, ... ) == 0x10011
 00439   436   NtUserRegisterClassExWOW  (1237204, 1237284, 1237268, 1237300, 0, 384, 0, ... ) == 0x810dc01c
 00440   436   NtUserFindExistingCursorIcon  (1236756, 1236772, 1237340, ... ) == 0x10011
 00441   436   NtUserRegisterClassExWOW  (1237208, 1237288, 1237272, 1237304, 0, 384, 0, ...
 00442   436   NtAllocateVirtualMemory  (-1, 6324224, 0, 4096, 4096, 32, ... 6324224, 4096, ) == 0x0
 00441   436   NtUserRegisterClassExWOW  ... ) == 0x810dc01e
 00443   436   NtUserFindExistingCursorIcon  (1236752, 1236768, 1237336, ... ) == 0x10011
 00444   436   NtUserRegisterClassExWOW  (1237264, 1237344, 1237328, 1237360, 0, 384, 0, ... ) == 0x810dc01b
 00445   436   NtUserFindExistingCursorIcon  (1236748, 1236764, 1237332, ... ) == 0x10011
 00446   436   NtUserRegisterClassExWOW  (1237260, 1237340, 1237324, 1237356, 0, 384, 0, ... ) == 0x810dc068
 00447   436   NtUserFindExistingCursorIcon  (1236756, 1236772, 1237340, ... ) == 0x10011
 00448   436   NtUserRegisterClassExWOW  (1237208, 1237288, 1237272, 1237304, 0, 384, 0, ... ) == 0x810dc06a
 00449   436   NtCreateKey  (0x2001f, {24, 60, 0x40, 0, 0,  (0x2001f, {24, 60, 0x40, 0, 0, "SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings"}, 0, 0x0, 0, ... 76, 2, ) }, 0, 0x0, 0, ... 76, 2, ) == 0x0
 00450   436   NtOpenSection  (0xe, {24, 8, 0x40, 0, 0,  (0xe, {24, 8, 0x40, 0, 0, "mpr.dll"}, ... 68, ) }, ... 68, ) == 0x0
 00451   436   NtMapViewOfSection  (68, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x71b20000), 0x0, 69632, ) == 0x0
 00452   436   NtClose  (68, ... ) == 0x0
 00453   436   NtCreateSemaphore  (0x1f0003, 0x0, 1, 1, ... 68, ) == 0x0
 00454   436   NtCreateEvent  (0x1f0003, 0x0, 0, 0, ... 80, ) == 0x0
 00455   436   NtOpenKey  (0x20019, {24, 48, 0x40, 0, 0,  (0x20019, {24, 48, 0x40, 0, 0, "system\CurrentControlSet\control\NetworkProvider\HwOrder"}, ... 84, ) }, ... 84, ) == 0x0
 00456   436   NtNotifyChangeKey  (84, 80, 0, 0, 2011390432, 4, 0, 0, 0, 1, ... ) == 0x103
 00457   436   NtQueryInformationProcess  (-1, 28, 4, ... {process info, class 28, size 4}, 0x0, ) == 0x0
 00458   436   NtCreateSemaphore  (0x100003, 0x0, 0, 2147483647, ... 88, ) == 0x0
 00459   436   NtCreateSemaphore  (0x100003, 0x0, 0, 2147483647, ... 92, ) == 0x0
 00460   436   NtOpenSection  (0xe, {24, 8, 0x40, 0, 0,  (0xe, {24, 8, 0x40, 0, 0, "shell32.dll"}, ... 96, ) }, ... 96, ) == 0x0
 00461   436   NtMapViewOfSection  (96, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x773d0000), 0x0, 8339456, ) == 0x0
 00462   436   NtClose  (96, ... ) == 0x0
 00463   436   NtOpenKey  (0x1, {24, 48, 0x40, 0, 0,  (0x1, {24, 48, 0x40, 0, 0, "SYSTEM\Setup"}, ... 96, ) }, ... 96, ) == 0x0
 00464   436   NtQueryValueKey  (96,  (96, "SystemSetupInProgress", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (96, "SystemSetupInProgress", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) }, 16, ) == 0x0
 00465   436   NtClose  (96, ... ) == 0x0
 00466   436   NtQueryDefaultUILanguage  (1239064, ...
 00467   436   NtOpenThreadTokenEx  (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN
 00468   436   NtOpenProcessTokenEx  (-1, 0x20008, 512, ... -2147482208, ) == 0x0
 00469   436   NtQueryInformationToken  (-2147482208, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0
 00470   436   NtClose  (-2147482208, ... ) == 0x0
 00471   436   NtOpenKey  (0x2000000, {24, 0, 0x640, 0, 0,  (0x2000000, {24, 0, 0x640, 0, 0, "\REGISTRY\USER\S-1-5-21-1078081533-484763869-839522115-1003"}, ... -2147482208, ) }, ... -2147482208, ) == 0x0
 00472   436   NtOpenKey  (0x80000000, {24, 0, 0x240, 0, 0,  (0x80000000, {24, 0, 0x240, 0, 0, "\Registry\Machine\System\CurrentControlSet\Control\Nls\MUILanguages"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00473   436   NtOpenKey  (0x80000000, {24, -2147482208, 0x640, 0, 0,  (0x80000000, {24, -2147482208, 0x640, 0, 0, "Control Panel\Desktop"}, ... -2147482196, ) }, ... -2147482196, ) == 0x0
 00474   436   NtQueryValueKey  (-2147482196,  (-2147482196, "MultiUILanguageId", Partial, 256, ... ) , Partial, 256, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00475   436   NtClose  (-2147482196, ... ) == 0x0
 00476   436   NtClose  (-2147482208, ... ) == 0x0
 00466   436   NtQueryDefaultUILanguage  ... ) == 0x0
 00477   436   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\System\CurrentControlSet\Control\Nls\MUILanguages"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00478   436   NtOpenFile  (0x1200a9, {24, 0, 0x40, 0, 0,  (0x1200a9, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\shell32.dll"}, 1, 96, ... 96, {status=0x0, info=1}, ) }, 1, 96, ... 96, {status=0x0, info=1}, ) == 0x0
 00479   436   NtCreateSection  (0x4, 0x0, 0x0, 2, 134217728, 96, ... 100, ) == 0x0
 00480   436   NtMapViewOfSection  (100, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 2, ... (0x900000), 0x0, 8323072, ) == 0x0
 00481   436   NtOpenFile  (0x1200a9, {24, 0, 0x40, 0, 0,  (0x1200a9, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\shell32.dll.124.Manifest"}, 1, 96, ... ) }, 1, 96, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00482   436   NtQueryDefaultLocale  (1, 1237100, ... ) == 0x0
 00483   436   NtOpenFile  (0x1200a9, {24, 0, 0x40, 0, 0,  (0x1200a9, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\shell32.dll.124.Config"}, 1, 96, ... ) }, 1, 96, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00484   436   NtRequestWaitReplyPort  (24, {128, 156, new_msg, 0, 1237956, 1, 96, 0}  (24, {128, 156, new_msg, 0, 1237956, 1, 96, 0} "\210\6\31\1\33\0\1\0\0\0\0\0\1\347\22\0\1\0\0\0\0\0\11\4\1\1\1\0>\0@\0\250\6\31\1`\0\0\0\377\377\377\377\0\0\0\0\20\311\307\0\0\0\0\0\236\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0(\0,\0\350\6\31\1\0\0\0\0\0\0\0\0\304\352\22\0\0\0\0\0" ... {128, 156, reply, 0, 424, 436, 1497, 0} "\210\347\26\0\33\0\1\0\0\0\0\0\1\347\22\0\1\0\0\0\0\0\11\4\1\1\1\0>\0@\0\250\6\31\1`\0\0\0\377\377\377\377\0\0\0\0\20\311\307\0\0\0\0\0\236\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0(\0,\0\350\6\31\1\0\0\0\0\0\0\0\0\304\352\22\0\0\0\0\0" )  ... {128, 156, reply, 0, 424, 436, 1497, 0}  (24, {128, 156, new_msg, 0, 1237956, 1, 96, 0} "\210\6\31\1\33\0\1\0\0\0\0\0\1\347\22\0\1\0\0\0\0\0\11\4\1\1\1\0>\0@\0\250\6\31\1`\0\0\0\377\377\377\377\0\0\0\0\20\311\307\0\0\0\0\0\236\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0(\0,\0\350\6\31\1\0\0\0\0\0\0\0\0\304\352\22\0\0\0\0\0" ... {128, 156, reply, 0, 424, 436, 1497, 0} "\210\347\26\0\33\0\1\0\0\0\0\0\1\347\22\0\1\0\0\0\0\0\11\4\1\1\1\0>\0@\0\250\6\31\1`\0\0\0\377\377\377\377\0\0\0\0\20\311\307\0\0\0\0\0\236\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0(\0,\0\350\6\31\1\0\0\0\0\0\0\0\0\304\352\22\0\0\0\0\0" )  ) == 0x0
 00485   436   NtClose  (96, ... ) == 0x0
 00486   436   NtClose  (100, ... ) == 0x0
 00487   436   NtUnmapViewOfSection  (-1, 0x900000, ... ) == 0x0
 00488   436   NtUnmapViewOfSection  (-1, 0x12eac4, ... ) == STATUS_NOT_MAPPED_VIEW
 00489   436   NtQueryDebugFilterState  (53, 2, ... ) == 0x0
 00490   436   NtOpenKey  (0x8, {24, 0, 0x40, 0, 0,  (0x8, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows\CurrentVersion\SideBySide\AssemblyStorageRoots"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00491   436   NtQueryDebugFilterState  (53, 2, ... ) == 0x0
 00492   436   NtQueryDebugFilterState  (53, 2, ... ) == 0x0
 00493   436   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\u:\work\packed.exe.Local\"}, 1236184, ... ) }, 1236184, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00494   436   NtQueryDebugFilterState  (53, 2, ... ) == 0x0
 00495   436   NtQueryDebugFilterState  (53, 2, ... ) == 0x0
 00496   436   NtQueryDebugFilterState  (53, 2, ... ) == 0x0
 00497   436   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.0.0_x-ww_1382d70a"}, 1236776, ... ) }, 1236776, ... ) == 0x0
 00498   436   NtOpenFile  (0x100020, {24, 0, 0x40, 0, 0,  (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.0.0_x-ww_1382d70a"}, 3, 33, ... 100, {status=0x0, info=1}, ) }, 3, 33, ... 100, {status=0x0, info=1}, ) == 0x0
 00499   436   NtQueryDebugFilterState  (53, 2, ... ) == 0x0
 00500   436   NtOpenSection  (0xe, {24, 8, 0x40, 0, 0,  (0xe, {24, 8, 0x40, 0, 0, "comctl32.dll"}, ... 96, ) }, ... 96, ) == 0x0
 00501   436   NtMapViewOfSection  (96, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x77340000), 0x0, 569344, ) == 0x0
 00502   436   NtClose  (96, ... ) == 0x0
 00503   436   NtOpenProcess  (0x400, {24, 0, 0x0, 0, 0, 0x0}, {424, 0}, ... 96, ) == 0x0
 00504   436   NtQueryInformationProcess  (96, Session, 4, ... {SessionId=0,}, 0x0, ) == 0x0
 00505   436   NtClose  (96, ... ) == 0x0
 00506   436   NtUserRegisterWindowMessage  ( ("ShellGetDragImage", ... ) , ... ) == 0xc03a
 00507   436   NtUserSystemParametersInfo  (104, 0, 2000318720, 0, ... ) == 0x1
 00508   436   NtUserSystemParametersInfo  (38, 4, 2000318708, 0, ... ) == 0x1
 00509   436   NtOpenKey  (0x20019, {24, 60, 0x40, 0, 0,  (0x20019, {24, 60, 0x40, 0, 0, "Control Panel\Desktop"}, ... 96, ) }, ... 96, ) == 0x0
 00510   436   NtQueryValueKey  (96,  (96, "SmoothScroll", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00511   436   NtClose  (96, ... ) == 0x0
 00512   436   NtUserSystemParametersInfo  (41, 500, 1238640, 0, ... ) == 0x1
 00513   436   NtUserSystemParametersInfo  (102, 0, 2000318732, 0, ... ) == 0x1
 00514   436   NtUserGetClassInfo  (1999896576, 1239048, 1239000, 1239076, 0, ... ) == 0x0
 00515   436   NtUserFindExistingCursorIcon  (1238432, 1238448, 1239016, ... ) == 0x10011
 00516   436   NtUserRegisterClassExWOW  (1238884, 1238964, 1238948, 1238980, 0, 384, 0, ... ) == 0x810dc03b
 00517   436   NtUserGetClassInfo  (1999896576, 1239048, 1239000, 1239076, 0, ... ) == 0x0
 00518   436   NtUserRegisterClassExWOW  (1238884, 1238964, 1238948, 1238980, 0, 384, 0, ... ) == 0x810dc03d
 00519   436   NtUserGetClassInfo  (1999896576, 1239048, 1239000, 1239076, 0, ... ) == 0x0
 00520   436   NtUserFindExistingCursorIcon  (1238432, 1238448, 1239016, ... ) == 0x10011
 00521   436   NtUserRegisterClassExWOW  (1238884, 1238964, 1238948, 1238980, 0, 384, 0, ... ) == 0x810dc03f
 00522   436   NtUserGetClassInfo  (1999896576, 1239048, 1239000, 1239076, 0, ... ) == 0x0
 00523   436   NtUserFindExistingCursorIcon  (1238432, 1238448, 1239016, ... ) == 0x10011
 00524   436   NtUserRegisterClassExWOW  (1238884, 1238964, 1238948, 1238980, 0, 384, 0, ... ) == 0x810dc041
 00525   436   NtUserGetClassInfo  (1999896576, 1239048, 1239000, 1239076, 0, ... ) == 0x0
 00526   436   NtUserFindExistingCursorIcon  (1238432, 1238448, 1239016, ... ) == 0x10011
 00527   436   NtUserRegisterClassExWOW  (1238884, 1238964, 1238948, 1238980, 0, 384, 0, ... ) == 0x810dc043
 00528   436   NtUserGetClassInfo  (1999896576, 1239048, 1239000, 1239076, 0, ... ) == 0x0
 00529   436   NtUserRegisterClassExWOW  (1238884, 1238964, 1238948, 1238980, 0, 384, 0, ... ) == 0x810dc045
 00530   436   NtUserGetClassInfo  (1999896576, 1239048, 1239000, 1239076, 0, ... ) == 0x0
 00531   436   NtUserFindExistingCursorIcon  (1238432, 1238448, 1239016, ... ) == 0x10011
 00532   436   NtUserRegisterClassExWOW  (1238884, 1238964, 1238948, 1238980, 0, 384, 0, ... ) == 0x810dc047
 00533   436   NtUserGetClassInfo  (1999896576, 1239048, 1239000, 1239076, 0, ... ) == 0x0
 00534   436   NtUserFindExistingCursorIcon  (1238428, 1238444, 1239012, ... ) == 0x10011
 00535   436   NtUserRegisterClassExWOW  (1238880, 1238960, 1238944, 1238976, 0, 384, 0, ... ) == 0x810dc049
 00536   436   NtUserGetClassInfo  (1999896576, 1239048, 1239000, 1239076, 0, ... ) == 0x0
 00537   436   NtUserFindExistingCursorIcon  (1238432, 1238448, 1239016, ... ) == 0x10011
 00538   436   NtUserRegisterClassExWOW  (1238884, 1238964, 1238948, 1238980, 0, 384, 0, ... ) == 0x810dc04b
 00539   436   NtUserGetClassInfo  (1999896576, 1239048, 1239000, 1239076, 0, ... ) == 0x0
 00540   436   NtUserFindExistingCursorIcon  (1238432, 1238448, 1239016, ... ) == 0x10011
 00541   436   NtUserRegisterClassExWOW  (1238884, 1238964, 1238948, 1238980, 0, 384, 0, ... ) == 0x810dc04d
 00542   436   NtUserGetClassInfo  (1999896576, 1239048, 1239000, 1239076, 0, ... ) == 0x0
 00543   436   NtUserFindExistingCursorIcon  (1238432, 1238448, 1239016, ... ) == 0x10011
 00544   436   NtUserRegisterClassExWOW  (1238884, 1238964, 1238948, 1238980, 0, 384, 0, ... ) == 0x810dc04f
 00545   436   NtUserGetClassInfo  (1999896576, 1239052, 1239004, 1239080, 0, ... ) == 0x0
 00546   436   NtUserRegisterClassExWOW  (1238888, 1238968, 1238952, 1238984, 0, 384, 0, ... ) == 0x810dc051
 00547   436   NtUserGetClassInfo  (1999896576, 1239048, 1239000, 1239076, 0, ... ) == 0x0
 00548   436   NtUserFindExistingCursorIcon  (1238432, 1238448, 1239016, ... ) == 0x10011
 00549   436   NtUserRegisterClassExWOW  (1238884, 1238964, 1238948, 1238980, 0, 384, 0, ... ) == 0x810dc053
 00550   436   NtUserGetClassInfo  (1999896576, 1239048, 1239000, 1239076, 0, ... ) == 0x0
 00551   436   NtUserFindExistingCursorIcon  (1238432, 1238448, 1239016, ... ) == 0x10011
 00552   436   NtUserRegisterClassExWOW  (1238884, 1238964, 1238948, 1238980, 0, 384, 0, ... ) == 0x810dc055
 00553   436   NtUserRegisterClassExWOW  (1238884, 1238964, 1238948, 1238980, 0, 384, 0, ... ) == 0x810dc057
 00554   436   NtUserGetClassInfo  (1999896576, 1239048, 1239000, 1239076, 0, ... ) == 0x0
 00555   436   NtUserFindExistingCursorIcon  (1238432, 1238448, 1239016, ... ) == 0x10011
 00556   436   NtUserRegisterClassExWOW  (1238884, 1238964, 1238948, 1238980, 0, 384, 0, ... ) == 0x810dc059
 00557   436   NtUserGetClassInfo  (1999896576, 1239048, 1239000, 1239076, 0, ... ) == 0x0
 00558   436   NtUserFindExistingCursorIcon  (1238432, 1238448, 1239016, ... ) == 0x10013
 00559   436   NtUserRegisterClassExWOW  (1238884, 1238964, 1238948, 1238980, 0, 384, 0, ... ) == 0x810dc05b
 00560   436   NtUserGetClassInfo  (1999896576, 1239048, 1239000, 1239076, 0, ... ) == 0x0
 00561   436   NtUserFindExistingCursorIcon  (1238432, 1238448, 1239016, ... ) == 0x10011
 00562   436   NtUserRegisterClassExWOW  (1238884, 1238964, 1238948, 1238980, 0, 384, 0, ... ) == 0x810dc05d
 00563   436   NtUserGetClassInfo  (1999896576, 1239048, 1239000, 1239076, 0, ... ) == 0x0
 00564   436   NtUserFindExistingCursorIcon  (1238432, 1238448, 1239016, ... ) == 0x10011
 00565   436   NtUserRegisterClassExWOW  (1238884, 1238964, 1238948, 1238980, 0, 384, 0, ... ) == 0x810dc05f
 00566   436   NtUserGetClassInfo  (1999896576, 1240800, 1240752, 1240828, 0, ... ) == 0xc03b
 00567   436   NtUserGetClassInfo  (1999896576, 1240800, 1240752, 1240828, 0, ... ) == 0xc03d
 00568   436   NtUserGetClassInfo  (1999896576, 1240800, 1240752, 1240828, 0, ... ) == 0xc03f
 00569   436   NtUserGetClassInfo  (1999896576, 1240800, 1240752, 1240828, 0, ... ) == 0xc041
 00570   436   NtUserGetClassInfo  (1999896576, 1240800, 1240752, 1240828, 0, ... ) == 0xc043
 00571   436   NtUserGetClassInfo  (1999896576, 1240800, 1240752, 1240828, 0, ... ) == 0xc045
 00572   436   NtUserGetClassInfo  (1999896576, 1240800, 1240752, 1240828, 0, ... ) == 0xc047
 00573   436   NtUserGetClassInfo  (1999896576, 1240800, 1240752, 1240828, 0, ... ) == 0xc049
 00574   436   NtUserGetClassInfo  (1999896576, 1240800, 1240752, 1240828, 0, ... ) == 0xc04b
 00575   436   NtUserGetClassInfo  (1999896576, 1240800, 1240752, 1240828, 0, ... ) == 0xc04d
 00576   436   NtUserGetClassInfo  (1999896576, 1240800, 1240752, 1240828, 0, ... ) == 0xc04f
 00577   436   NtUserGetClassInfo  (1999896576, 1240804, 1240756, 1240832, 0, ... ) == 0xc051
 00578   436   NtUserGetClassInfo  (1999896576, 1240800, 1240752, 1240828, 0, ... ) == 0xc053
 00579   436   NtUserGetClassInfo  (1999896576, 1240800, 1240752, 1240828, 0, ... ) == 0xc055
 00580   436   NtUserGetClassInfo  (1999896576, 1240800, 1240752, 1240828, 0, ... ) == 0xc059
 00581   436   NtUserGetClassInfo  (1999896576, 1240800, 1240752, 1240828, 0, ... ) == 0xc05b
 00582   436   NtUserGetClassInfo  (1999896576, 1240800, 1240752, 1240828, 0, ... ) == 0xc05d
 00583   436   NtUserGetClassInfo  (1999896576, 1240800, 1240752, 1240828, 0, ... ) == 0xc05f
 00584   436   NtOpenSection  (0xe, {24, 8, 0x40, 0, 0,  (0xe, {24, 8, 0x40, 0, 0, "ws2_32.dll"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00585   436   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\u:\work\ws2_32.dll"}, 1240708, ... ) }, 1240708, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00586   436   NtQueryAttributesFile  ({24, 12, 0x40, 0, 0,  ({24, 12, 0x40, 0, 0, "ws2_32.dll"}, 1240708, ... ) }, 1240708, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00587   436   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\System32\ws2_32.dll"}, 1240708, ... ) }, 1240708, ... ) == 0x0
 00588   436   NtOpenFile  (0x100020, {24, 0, 0x40, 0, 0,  (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\System32\ws2_32.dll"}, 5, 96, ... 96, {status=0x0, info=1}, ) }, 5, 96, ... 96, {status=0x0, info=1}, ) == 0x0
 00589   436   NtCreateSection  (0xf, 0x0, 0x0, 16, 16777216, 96, ... 104, ) == 0x0
 00590   436   NtQuerySection  (104, Image, 48, ... {section info, class 1, size 48}, 0x0, ) == 0x0
 00591   436   NtClose  (96, ... ) == 0x0
 00592   436   NtMapViewOfSection  (104, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x71ab0000), 0x0, 86016, ) == 0x0
 00593   436   NtClose  (104, ... ) == 0x0
 00594   436   NtOpenSection  (0xe, {24, 8, 0x40, 0, 0,  (0xe, {24, 8, 0x40, 0, 0, "WS2HELP.dll"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00595   436   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\u:\work\WS2HELP.dll"}, 1239904, ... ) }, 1239904, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00596   436   NtQueryAttributesFile  ({24, 12, 0x40, 0, 0,  ({24, 12, 0x40, 0, 0, "WS2HELP.dll"}, 1239904, ... ) }, 1239904, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00597   436   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\System32\WS2HELP.dll"}, 1239904, ... ) }, 1239904, ... ) == 0x0
 00598   436   NtOpenFile  (0x100020, {24, 0, 0x40, 0, 0,  (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\System32\WS2HELP.dll"}, 5, 96, ... 104, {status=0x0, info=1}, ) }, 5, 96, ... 104, {status=0x0, info=1}, ) == 0x0
 00599   436   NtCreateSection  (0xf, 0x0, 0x0, 16, 16777216, 104, ... 96, ) == 0x0
 00600   436   NtQuerySection  (96, Image, 48, ... {section info, class 1, size 48}, 0x0, ) == 0x0
 00601   436   NtClose  (104, ... ) == 0x0
 00602   436   NtMapViewOfSection  (96, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x71aa0000), 0x0, 32768, ) == 0x0
 00603   436   NtClose  (96, ... ) == 0x0
 00604   436   NtQuerySystemInformation  (Basic, 44, ... {Unknown=0,MaximumIncrement=156250,PhysicalPageSize=0x1000,NumberOfPhysicalPages=0xff7c,LowestPhysicalPage=0x1,HighestPhysicalPage=0xffff,AllocationGranularity=0x10000,LowestUserAddress=0x10000,HighestUserAddress=0x7ffeffff,ActiveProcessors=1,NumberProcessors=1,}, 0x0, ) == 0x0
 00605   436   NtQuerySystemInformation  (Processor, 12, ... {system info, class 1, size 12}, 0x0, ) == 0x0
 00606   436   NtOpenKey  (0x2000000, {24, 48, 0x40, 0, 0,  (0x2000000, {24, 48, 0x40, 0, 0, "System\CurrentControlSet\Services\WinSock2\Parameters"}, ... 96, ) }, ... 96, ) == 0x0
 00607   436   NtQueryValueKey  (96,  (96, "WinSock_Registry_Version", Partial, 144, ... TitleIdx=0, Type=1, Data="2\0.\00\0\0\0"}, 20, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (96, "WinSock_Registry_Version", Partial, 144, ... TitleIdx=0, Type=1, Data="2\0.\00\0\0\0"}, 20, ) }, 20, ) == 0x0
 00608   436   NtQueryValueKey  (96,  (96, "WinSock_Registry_Version", Partial, 144, ... TitleIdx=0, Type=1, Data="2\0.\00\0\0\0"}, 20, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (96, "WinSock_Registry_Version", Partial, 144, ... TitleIdx=0, Type=1, Data="2\0.\00\0\0\0"}, 20, ) }, 20, ) == 0x0
 00609   436   NtCreateEvent  (0x1f0003, 0x0, 0, 0, ... 104, ) == 0x0
 00610   436   NtOpenKey  (0x2000000, {24, 96, 0x40, 0, 0,  (0x2000000, {24, 96, 0x40, 0, 0, "Protocol_Catalog9"}, ... 108, ) }, ... 108, ) == 0x0
 00611   436   NtQueryValueKey  (108,  (108, "Serial_Access_Num", Partial, 144, ... TitleIdx=0, Type=4, Data="\31\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (108, "Serial_Access_Num", Partial, 144, ... TitleIdx=0, Type=4, Data="\31\0\0\0"}, 16, ) }, 16, ) == 0x0
 00612   436   NtNotifyChangeKey  (108, 104, 0, 0, 2011390432, 1, 0, 0, 0, 1, ... ) == 0x103
 00613   436   NtQueryValueKey  (108,  (108, "Serial_Access_Num", Partial, 144, ... TitleIdx=0, Type=4, Data="\31\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (108, "Serial_Access_Num", Partial, 144, ... TitleIdx=0, Type=4, Data="\31\0\0\0"}, 16, ) }, 16, ) == 0x0
 00614   436   NtOpenKey  (0x2000000, {24, 108, 0x40, 0, 0,  (0x2000000, {24, 108, 0x40, 0, 0, "00000019"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00615   436   NtQueryValueKey  (108,  (108, "Next_Catalog_Entry_ID", Partial, 144, ... TitleIdx=0, Type=4, Data="\376\3\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (108, "Next_Catalog_Entry_ID", Partial, 144, ... TitleIdx=0, Type=4, Data="\376\3\0\0"}, 16, ) }, 16, ) == 0x0
 00616   436   NtQueryValueKey  (108,  (108, "Num_Catalog_Entries", Partial, 144, ... TitleIdx=0, Type=4, Data="\13\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (108, "Num_Catalog_Entries", Partial, 144, ... TitleIdx=0, Type=4, Data="\13\0\0\0"}, 16, ) }, 16, ) == 0x0
 00617   436   NtOpenKey  (0x2000000, {24, 108, 0x40, 0, 0,  (0x2000000, {24, 108, 0x40, 0, 0, "Catalog_Entries"}, ... 112, ) }, ... 112, ) == 0x0
 00618   436   NtAllocateVirtualMemory  (-1, 1355776, 0, 4096, 4096, 4, ... 1355776, 4096, ) == 0x0
 00619   436   NtOpenKey  (0x20019, {24, 112, 0x40, 0, 0,  (0x20019, {24, 112, 0x40, 0, 0, "000000000001"}, ... 116, ) }, ... 116, ) == 0x0
 00620   436   NtQueryValueKey  (116,  (116, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 00621   436   NtQueryValueKey  (116,  (116, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 00622   436   NtQueryValueKey  (116,  (116, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0gram\FSLSP.DLL\0\00\0\0\0\10\0\2\0\10\0\4\1\10\0h\220\354\28\220\354\2\2\0\12\0\4\1\12\00\00\0\0\0\10\0\2\0\14\0\4\1\10\0\210\220\354\2X\220\354\2\2\0\16\0\4\1\12\00\00\0\0\0\10\0\2\0\20\0\4\1\10\0\250\220\354\2x\220\354\2\2\0\22\0\4\1\12\00\00\0\0\0\10\0\2\0\24\0\4\1\10\0\310\220\354\2\230\220\354\2\2\0\26\0\4\1\12\00\00\0\0\0\10\0\2\0\30\0\4\1\10\0\0\0\0\0\270\220\354\2\2\0\32\0\4\1\10\0H\0K\0R\0\0\0\3\0\34\0\4\1\10\0\360\222\354\2\0\0\0\0\0\221\354\2\16\0\0\0<\0\37\0\4\0\10\0X\3\10\0X\3\10\0\4\0\2\0f\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\10\0\0\0\240\32\17\347\213\253\317\21\214\243\0\200_H\241\222\351\3\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\2\0\0\0\20\0\0\0\20\0\0\0\1\0\0\0\6\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0T\0c\0p\0i\0p\0 \0[\0T\0C\0P\0/\0I\0P\0]\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\204\3\0\0o\2\0\0\250\1\0\0\264\1\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0t\0\0\0o\2\0\0\250\1\0\0\264\1\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0p\2\0\0\250\1\0\0\264\1\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0p\0\0\0(\373\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\370\237\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\00\02\0p\2\0\0\250\1\0\0\264\1\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0t\0\0\0q\2\0\0\250\1\0\0\264\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0t\0\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0q\2\0\0\250\1\0\0\264\1\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0r\2\0\0\250\1\0\0\264\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0t\0\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) , Partial, 900, ... TitleIdx=0, Type=3, Data= (116, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0gram\FSLSP.DLL\0\00\0\0\0\10\0\2\0\10\0\4\1\10\0h\220\354\28\220\354\2\2\0\12\0\4\1\12\00\00\0\0\0\10\0\2\0\14\0\4\1\10\0\210\220\354\2X\220\354\2\2\0\16\0\4\1\12\00\00\0\0\0\10\0\2\0\20\0\4\1\10\0\250\220\354\2x\220\354\2\2\0\22\0\4\1\12\00\00\0\0\0\10\0\2\0\24\0\4\1\10\0\310\220\354\2\230\220\354\2\2\0\26\0\4\1\12\00\00\0\0\0\10\0\2\0\30\0\4\1\10\0\0\0\0\0\270\220\354\2\2\0\32\0\4\1\10\0H\0K\0R\0\0\0\3\0\34\0\4\1\10\0\360\222\354\2\0\0\0\0\0\221\354\2\16\0\0\0<\0\37\0\4\0\10\0X\3\10\0X\3\10\0\4\0\2\0f\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\10\0\0\0\240\32\17\347\213\253\317\21\214\243\0\200_H\241\222\351\3\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\2\0\0\0\20\0\0\0\20\0\0\0\1\0\0\0\6\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0T\0c\0p\0i\0p\0 \0[\0T\0C\0P\0/\0I\0P\0]\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\204\3\0\0o\2\0\0\250\1\0\0\264\1\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0t\0\0\0o\2\0\0\250\1\0\0\264\1\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0p\2\0\0\250\1\0\0\264\1\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0p\0\0\0(\373\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\370\237\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\00\02\0p\2\0\0\250\1\0\0\264\1\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0t\0\0\0q\2\0\0\250\1\0\0\264\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0t\0\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0q\2\0\0\250\1\0\0\264\1\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0r\2\0\0\250\1\0\0\264\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0t\0\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) \0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0q\2\0\0\250\1\0\0\264\1\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0r\2\0\0\250\1\0\0\264\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0t\0\0\0\0\0\0\0 (116, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0gram\FSLSP.DLL\0\00\0\0\0\10\0\2\0\10\0\4\1\10\0h\220\354\28\220\354\2\2\0\12\0\4\1\12\00\00\0\0\0\10\0\2\0\14\0\4\1\10\0\210\220\354\2X\220\354\2\2\0\16\0\4\1\12\00\00\0\0\0\10\0\2\0\20\0\4\1\10\0\250\220\354\2x\220\354\2\2\0\22\0\4\1\12\00\00\0\0\0\10\0\2\0\24\0\4\1\10\0\310\220\354\2\230\220\354\2\2\0\26\0\4\1\12\00\00\0\0\0\10\0\2\0\30\0\4\1\10\0\0\0\0\0\270\220\354\2\2\0\32\0\4\1\10\0H\0K\0R\0\0\0\3\0\34\0\4\1\10\0\360\222\354\2\0\0\0\0\0\221\354\2\16\0\0\0<\0\37\0\4\0\10\0X\3\10\0X\3\10\0\4\0\2\0f\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\10\0\0\0\240\32\17\347\213\253\317\21\214\243\0\200_H\241\222\351\3\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\2\0\0\0\20\0\0\0\20\0\0\0\1\0\0\0\6\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0T\0c\0p\0i\0p\0 \0[\0T\0C\0P\0/\0I\0P\0]\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\204\3\0\0o\2\0\0\250\1\0\0\264\1\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0t\0\0\0o\2\0\0\250\1\0\0\264\1\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0p\2\0\0\250\1\0\0\264\1\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0p\0\0\0(\373\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\370\237\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\00\02\0p\2\0\0\250\1\0\0\264\1\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0t\0\0\0q\2\0\0\250\1\0\0\264\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0t\0\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0q\2\0\0\250\1\0\0\264\1\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0r\2\0\0\250\1\0\0\264\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0t\0\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) }, 900, ) == 0x0
 00623   436   NtClose  (116, ... ) == 0x0
 00624   436   NtOpenKey  (0x20019, {24, 112, 0x40, 0, 0,  (0x20019, {24, 112, 0x40, 0, 0, "000000000002"}, ... 116, ) }, ... 116, ) == 0x0
 00625   436   NtQueryValueKey  (116,  (116, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 00626   436   NtQueryValueKey  (116,  (116, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 00627   436   NtQueryValueKey  (116,  (116, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0gram\FSLSP.DLL\0\00\0\0\0\10\0\2\0\10\0\4\1\10\0h\220\354\28\220\354\2\2\0\12\0\4\1\12\00\00\0\0\0\10\0\2\0\14\0\4\1\10\0\210\220\354\2X\220\354\2\2\0\16\0\4\1\12\00\00\0\0\0\10\0\2\0\20\0\4\1\10\0\250\220\354\2x\220\354\2\2\0\22\0\4\1\12\00\00\0\0\0\10\0\2\0\24\0\4\1\10\0\310\220\354\2\230\220\354\2\2\0\26\0\4\1\12\00\00\0\0\0\10\0\2\0\30\0\4\1\10\0\0\0\0\0\270\220\354\2\2\0\32\0\4\1\10\0H\0K\0R\0\0\0\3\0\34\0\4\1\10\0\360\222\354\2\0\0\0\0\0\221\354\2\16\0\0\0<\0\37\0\4\0\10\0X\3\10\0X\3\10\0\4\0\2\0\11\6\2\0\0\0\0\0\0\0\0\0\0\0\0\0\10\0\0\0\240\32\17\347\213\253\317\21\214\243\0\200_H\241\222\352\3\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\2\0\0\0\20\0\0\0\20\0\0\0\2\0\0\0\21\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\273\377\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0T\0c\0p\0i\0p\0 \0[\0U\0D\0P\0/\0I\0P\0]\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\204\3\0\0t\2\0\0\250\1\0\0\264\1\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0t\0\0\0t\2\0\0\250\1\0\0\264\1\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0u\2\0\0\250\1\0\0\264\1\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0p\0\0\0(\373\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\370\237\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\00\03\0u\2\0\0\250\1\0\0\264\1\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0t\0\0\0v\2\0\0\250\1\0\0\264\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0t\0\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0v\2\0\0\250\1\0\0\264\1\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0w\2\0\0\250\1\0\0\264\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0t\0\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) , Partial, 900, ... TitleIdx=0, Type=3, Data= (116, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0gram\FSLSP.DLL\0\00\0\0\0\10\0\2\0\10\0\4\1\10\0h\220\354\28\220\354\2\2\0\12\0\4\1\12\00\00\0\0\0\10\0\2\0\14\0\4\1\10\0\210\220\354\2X\220\354\2\2\0\16\0\4\1\12\00\00\0\0\0\10\0\2\0\20\0\4\1\10\0\250\220\354\2x\220\354\2\2\0\22\0\4\1\12\00\00\0\0\0\10\0\2\0\24\0\4\1\10\0\310\220\354\2\230\220\354\2\2\0\26\0\4\1\12\00\00\0\0\0\10\0\2\0\30\0\4\1\10\0\0\0\0\0\270\220\354\2\2\0\32\0\4\1\10\0H\0K\0R\0\0\0\3\0\34\0\4\1\10\0\360\222\354\2\0\0\0\0\0\221\354\2\16\0\0\0<\0\37\0\4\0\10\0X\3\10\0X\3\10\0\4\0\2\0\11\6\2\0\0\0\0\0\0\0\0\0\0\0\0\0\10\0\0\0\240\32\17\347\213\253\317\21\214\243\0\200_H\241\222\352\3\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\2\0\0\0\20\0\0\0\20\0\0\0\2\0\0\0\21\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\273\377\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0T\0c\0p\0i\0p\0 \0[\0U\0D\0P\0/\0I\0P\0]\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\204\3\0\0t\2\0\0\250\1\0\0\264\1\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0t\0\0\0t\2\0\0\250\1\0\0\264\1\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0u\2\0\0\250\1\0\0\264\1\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0p\0\0\0(\373\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\370\237\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\00\03\0u\2\0\0\250\1\0\0\264\1\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0t\0\0\0v\2\0\0\250\1\0\0\264\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0t\0\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0v\2\0\0\250\1\0\0\264\1\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0w\2\0\0\250\1\0\0\264\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0t\0\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) \0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0v\2\0\0\250\1\0\0\264\1\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0w\2\0\0\250\1\0\0\264\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0t\0\0\0\0\0\0\0 (116, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0gram\FSLSP.DLL\0\00\0\0\0\10\0\2\0\10\0\4\1\10\0h\220\354\28\220\354\2\2\0\12\0\4\1\12\00\00\0\0\0\10\0\2\0\14\0\4\1\10\0\210\220\354\2X\220\354\2\2\0\16\0\4\1\12\00\00\0\0\0\10\0\2\0\20\0\4\1\10\0\250\220\354\2x\220\354\2\2\0\22\0\4\1\12\00\00\0\0\0\10\0\2\0\24\0\4\1\10\0\310\220\354\2\230\220\354\2\2\0\26\0\4\1\12\00\00\0\0\0\10\0\2\0\30\0\4\1\10\0\0\0\0\0\270\220\354\2\2\0\32\0\4\1\10\0H\0K\0R\0\0\0\3\0\34\0\4\1\10\0\360\222\354\2\0\0\0\0\0\221\354\2\16\0\0\0<\0\37\0\4\0\10\0X\3\10\0X\3\10\0\4\0\2\0\11\6\2\0\0\0\0\0\0\0\0\0\0\0\0\0\10\0\0\0\240\32\17\347\213\253\317\21\214\243\0\200_H\241\222\352\3\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\2\0\0\0\20\0\0\0\20\0\0\0\2\0\0\0\21\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\273\377\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0T\0c\0p\0i\0p\0 \0[\0U\0D\0P\0/\0I\0P\0]\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\204\3\0\0t\2\0\0\250\1\0\0\264\1\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0t\0\0\0t\2\0\0\250\1\0\0\264\1\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0u\2\0\0\250\1\0\0\264\1\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0p\0\0\0(\373\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\370\237\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\00\03\0u\2\0\0\250\1\0\0\264\1\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0t\0\0\0v\2\0\0\250\1\0\0\264\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0t\0\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0v\2\0\0\250\1\0\0\264\1\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0w\2\0\0\250\1\0\0\264\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0t\0\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) }, 900, ) == 0x0
 00628   436   NtClose  (116, ... ) == 0x0
 00629   436   NtOpenKey  (0x20019, {24, 112, 0x40, 0, 0,  (0x20019, {24, 112, 0x40, 0, 0, "000000000003"}, ... 116, ) }, ... 116, ) == 0x0
 00630   436   NtQueryValueKey  (116,  (116, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 00631   436   NtQueryValueKey  (116,  (116, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 00632   436   NtAllocateVirtualMemory  (-1, 1359872, 0, 4096, 4096, 4, ... 1359872, 4096, ) == 0x0
 00633   436   NtQueryValueKey  (116,  (116, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0gram\FSLSP.DLL\0\00\0\0\0\10\0\2\0\10\0\4\1\10\0h\220\354\28\220\354\2\2\0\12\0\4\1\12\00\00\0\0\0\10\0\2\0\14\0\4\1\10\0\210\220\354\2X\220\354\2\2\0\16\0\4\1\12\00\00\0\0\0\10\0\2\0\20\0\4\1\10\0\250\220\354\2x\220\354\2\2\0\22\0\4\1\12\00\00\0\0\0\10\0\2\0\24\0\4\1\10\0\310\220\354\2\230\220\354\2\2\0\26\0\4\1\12\00\00\0\0\0\10\0\2\0\30\0\4\1\10\0\0\0\0\0\270\220\354\2\2\0\32\0\4\1\10\0H\0K\0R\0\0\0\3\0\34\0\4\1\10\0\360\222\354\2\0\0\0\0\0\221\354\2\16\0\0\0<\0\37\0\4\0\10\0X\3\10\0X\3\10\0\4\0\2\0\11\6\2\0\0\0\0\0\0\0\0\0\0\0\0\0\14\0\0\0\240\32\17\347\213\253\317\21\214\243\0\200_H\241\222\353\3\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\2\0\0\0\20\0\0\0\20\0\0\0\3\0\0\0\0\0\0\0\377\0\0\0\0\0\0\0\0\0\0\0\273\377\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0T\0c\0p\0i\0p\0 \0[\0R\0A\0W\0/\0I\0P\0]\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\204\3\0\0z\2\0\0\250\1\0\0\264\1\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0t\0\0\0z\2\0\0\250\1\0\0\264\1\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0{\2\0\0\250\1\0\0\264\1\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0p\0\0\0(\373\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\370\237\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\00\04\0{\2\0\0\250\1\0\0\264\1\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0t\0\0\0|\2\0\0\250\1\0\0\264\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0t\0\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0|\2\0\0\250\1\0\0\264\1\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0}\2\0\0\250\1\0\0\264\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0t\0\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) , Partial, 900, ... TitleIdx=0, Type=3, Data= (116, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0gram\FSLSP.DLL\0\00\0\0\0\10\0\2\0\10\0\4\1\10\0h\220\354\28\220\354\2\2\0\12\0\4\1\12\00\00\0\0\0\10\0\2\0\14\0\4\1\10\0\210\220\354\2X\220\354\2\2\0\16\0\4\1\12\00\00\0\0\0\10\0\2\0\20\0\4\1\10\0\250\220\354\2x\220\354\2\2\0\22\0\4\1\12\00\00\0\0\0\10\0\2\0\24\0\4\1\10\0\310\220\354\2\230\220\354\2\2\0\26\0\4\1\12\00\00\0\0\0\10\0\2\0\30\0\4\1\10\0\0\0\0\0\270\220\354\2\2\0\32\0\4\1\10\0H\0K\0R\0\0\0\3\0\34\0\4\1\10\0\360\222\354\2\0\0\0\0\0\221\354\2\16\0\0\0<\0\37\0\4\0\10\0X\3\10\0X\3\10\0\4\0\2\0\11\6\2\0\0\0\0\0\0\0\0\0\0\0\0\0\14\0\0\0\240\32\17\347\213\253\317\21\214\243\0\200_H\241\222\353\3\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\2\0\0\0\20\0\0\0\20\0\0\0\3\0\0\0\0\0\0\0\377\0\0\0\0\0\0\0\0\0\0\0\273\377\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0T\0c\0p\0i\0p\0 \0[\0R\0A\0W\0/\0I\0P\0]\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\204\3\0\0z\2\0\0\250\1\0\0\264\1\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0t\0\0\0z\2\0\0\250\1\0\0\264\1\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0{\2\0\0\250\1\0\0\264\1\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0p\0\0\0(\373\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\370\237\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\00\04\0{\2\0\0\250\1\0\0\264\1\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0t\0\0\0|\2\0\0\250\1\0\0\264\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0t\0\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0|\2\0\0\250\1\0\0\264\1\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0}\2\0\0\250\1\0\0\264\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0t\0\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) \0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0|\2\0\0\250\1\0\0\264\1\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0}\2\0\0\250\1\0\0\264\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0t\0\0\0\0\0\0\0 (116, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0gram\FSLSP.DLL\0\00\0\0\0\10\0\2\0\10\0\4\1\10\0h\220\354\28\220\354\2\2\0\12\0\4\1\12\00\00\0\0\0\10\0\2\0\14\0\4\1\10\0\210\220\354\2X\220\354\2\2\0\16\0\4\1\12\00\00\0\0\0\10\0\2\0\20\0\4\1\10\0\250\220\354\2x\220\354\2\2\0\22\0\4\1\12\00\00\0\0\0\10\0\2\0\24\0\4\1\10\0\310\220\354\2\230\220\354\2\2\0\26\0\4\1\12\00\00\0\0\0\10\0\2\0\30\0\4\1\10\0\0\0\0\0\270\220\354\2\2\0\32\0\4\1\10\0H\0K\0R\0\0\0\3\0\34\0\4\1\10\0\360\222\354\2\0\0\0\0\0\221\354\2\16\0\0\0<\0\37\0\4\0\10\0X\3\10\0X\3\10\0\4\0\2\0\11\6\2\0\0\0\0\0\0\0\0\0\0\0\0\0\14\0\0\0\240\32\17\347\213\253\317\21\214\243\0\200_H\241\222\353\3\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\2\0\0\0\20\0\0\0\20\0\0\0\3\0\0\0\0\0\0\0\377\0\0\0\0\0\0\0\0\0\0\0\273\377\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0T\0c\0p\0i\0p\0 \0[\0R\0A\0W\0/\0I\0P\0]\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\204\3\0\0z\2\0\0\250\1\0\0\264\1\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0t\0\0\0z\2\0\0\250\1\0\0\264\1\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0{\2\0\0\250\1\0\0\264\1\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0p\0\0\0(\373\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\370\237\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\00\04\0{\2\0\0\250\1\0\0\264\1\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0t\0\0\0|\2\0\0\250\1\0\0\264\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0t\0\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0|\2\0\0\250\1\0\0\264\1\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0}\2\0\0\250\1\0\0\264\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0t\0\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) }, 900, ) == 0x0
 00634   436   NtClose  (116, ... ) == 0x0
 00635   436   NtOpenKey  (0x20019, {24, 112, 0x40, 0, 0,  (0x20019, {24, 112, 0x40, 0, 0, "000000000004"}, ... 116, ) }, ... 116, ) == 0x0
 00636   436   NtQueryValueKey  (116,  (116, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 00637   436   NtQueryValueKey  (116,  (116, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 00638   436   NtQueryValueKey  (116,  (116, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\rsvpsp.dll\0\0gram\FSLSP.DLL\0\00\0\0\0\10\0\2\0\10\0\4\1\10\0h\220\354\28\220\354\2\2\0\12\0\4\1\12\00\00\0\0\0\10\0\2\0\14\0\4\1\10\0\210\220\354\2X\220\354\2\2\0\16\0\4\1\12\00\00\0\0\0\10\0\2\0\20\0\4\1\10\0\250\220\354\2x\220\354\2\2\0\22\0\4\1\12\00\00\0\0\0\10\0\2\0\24\0\4\1\10\0\310\220\354\2\230\220\354\2\2\0\26\0\4\1\12\00\00\0\0\0\10\0\2\0\30\0\4\1\10\0\0\0\0\0\270\220\354\2\2\0\32\0\4\1\10\0H\0K\0R\0\0\0\3\0\34\0\4\1\10\0\360\222\354\2\0\0\0\0\0\221\354\2\16\0\0\0<\0\37\0\4\0\10\0X\3\10\0X\3\10\0\4\0\2\0\11&\2\0\0\0\0\0\0\0\0\0\0\0\0\0\10\0\0\0\340\251`\235z3\320\21\275\210\0\0\300\202\346\232\354\3\0\0\1\0\0\0\310\371\252\1\26\0\30\0\10<_u\0\0\0\0|\370\252\1\27\207`u\0\0\0\0\6\0\0\0\2\0\0\0\20\0\0\0\20\0\0\0\2\0\0\0\21\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\273\377\0\0\0\0\0\0R\0S\0V\0P\0 \0U\0D\0P\0 \0S\0e\0r\0v\0i\0c\0e\0 \0P\0r\0o\0v\0i\0d\0e\0r\0\0\0\30\371\252\1\17.\365w\13\30\365w\1\0\0\0\0\374\252\1\4\0\0\0\0\0\0\0\0\0\0\0\1\0\0\0\17.\365w\0\0\0\0\250\371\252\1 \22\365wO\22\365wT\22\365w\0\0\0\0\204\3\0\0\177\2\0\0\250\1\0\0\264\1\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0t\0\0\0\177\2\0\0\250\1\0\0\264\1\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\200\2\0\0\250\1\0\0\264\1\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0p\0\0\0(\373\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\370\237\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\00\05\0\200\2\0\0\250\1\0\0\264\1\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0t\0\0\0\201\2\0\0\250\1\0\0\264\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0t\0\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\201\2\0\0\250\1\0\0\264\1\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\202\2\0\0\250\1\0\0\264\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0t\0\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) , Partial, 900, ... TitleIdx=0, Type=3, Data= (116, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\rsvpsp.dll\0\0gram\FSLSP.DLL\0\00\0\0\0\10\0\2\0\10\0\4\1\10\0h\220\354\28\220\354\2\2\0\12\0\4\1\12\00\00\0\0\0\10\0\2\0\14\0\4\1\10\0\210\220\354\2X\220\354\2\2\0\16\0\4\1\12\00\00\0\0\0\10\0\2\0\20\0\4\1\10\0\250\220\354\2x\220\354\2\2\0\22\0\4\1\12\00\00\0\0\0\10\0\2\0\24\0\4\1\10\0\310\220\354\2\230\220\354\2\2\0\26\0\4\1\12\00\00\0\0\0\10\0\2\0\30\0\4\1\10\0\0\0\0\0\270\220\354\2\2\0\32\0\4\1\10\0H\0K\0R\0\0\0\3\0\34\0\4\1\10\0\360\222\354\2\0\0\0\0\0\221\354\2\16\0\0\0<\0\37\0\4\0\10\0X\3\10\0X\3\10\0\4\0\2\0\11&\2\0\0\0\0\0\0\0\0\0\0\0\0\0\10\0\0\0\340\251`\235z3\320\21\275\210\0\0\300\202\346\232\354\3\0\0\1\0\0\0\310\371\252\1\26\0\30\0\10<_u\0\0\0\0|\370\252\1\27\207`u\0\0\0\0\6\0\0\0\2\0\0\0\20\0\0\0\20\0\0\0\2\0\0\0\21\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\273\377\0\0\0\0\0\0R\0S\0V\0P\0 \0U\0D\0P\0 \0S\0e\0r\0v\0i\0c\0e\0 \0P\0r\0o\0v\0i\0d\0e\0r\0\0\0\30\371\252\1\17.\365w\13\30\365w\1\0\0\0\0\374\252\1\4\0\0\0\0\0\0\0\0\0\0\0\1\0\0\0\17.\365w\0\0\0\0\250\371\252\1 \22\365wO\22\365wT\22\365w\0\0\0\0\204\3\0\0\177\2\0\0\250\1\0\0\264\1\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0t\0\0\0\177\2\0\0\250\1\0\0\264\1\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\200\2\0\0\250\1\0\0\264\1\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0p\0\0\0(\373\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\370\237\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\00\05\0\200\2\0\0\250\1\0\0\264\1\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0t\0\0\0\201\2\0\0\250\1\0\0\264\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0t\0\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\201\2\0\0\250\1\0\0\264\1\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\202\2\0\0\250\1\0\0\264\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0t\0\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) \0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\201\2\0\0\250\1\0\0\264\1\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\202\2\0\0\250\1\0\0\264\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0t\0\0\0\0\0\0\0 (116, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\rsvpsp.dll\0\0gram\FSLSP.DLL\0\00\0\0\0\10\0\2\0\10\0\4\1\10\0h\220\354\28\220\354\2\2\0\12\0\4\1\12\00\00\0\0\0\10\0\2\0\14\0\4\1\10\0\210\220\354\2X\220\354\2\2\0\16\0\4\1\12\00\00\0\0\0\10\0\2\0\20\0\4\1\10\0\250\220\354\2x\220\354\2\2\0\22\0\4\1\12\00\00\0\0\0\10\0\2\0\24\0\4\1\10\0\310\220\354\2\230\220\354\2\2\0\26\0\4\1\12\00\00\0\0\0\10\0\2\0\30\0\4\1\10\0\0\0\0\0\270\220\354\2\2\0\32\0\4\1\10\0H\0K\0R\0\0\0\3\0\34\0\4\1\10\0\360\222\354\2\0\0\0\0\0\221\354\2\16\0\0\0<\0\37\0\4\0\10\0X\3\10\0X\3\10\0\4\0\2\0\11&\2\0\0\0\0\0\0\0\0\0\0\0\0\0\10\0\0\0\340\251`\235z3\320\21\275\210\0\0\300\202\346\232\354\3\0\0\1\0\0\0\310\371\252\1\26\0\30\0\10<_u\0\0\0\0|\370\252\1\27\207`u\0\0\0\0\6\0\0\0\2\0\0\0\20\0\0\0\20\0\0\0\2\0\0\0\21\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\273\377\0\0\0\0\0\0R\0S\0V\0P\0 \0U\0D\0P\0 \0S\0e\0r\0v\0i\0c\0e\0 \0P\0r\0o\0v\0i\0d\0e\0r\0\0\0\30\371\252\1\17.\365w\13\30\365w\1\0\0\0\0\374\252\1\4\0\0\0\0\0\0\0\0\0\0\0\1\0\0\0\17.\365w\0\0\0\0\250\371\252\1 \22\365wO\22\365wT\22\365w\0\0\0\0\204\3\0\0\177\2\0\0\250\1\0\0\264\1\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0t\0\0\0\177\2\0\0\250\1\0\0\264\1\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\200\2\0\0\250\1\0\0\264\1\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0p\0\0\0(\373\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\370\237\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\00\05\0\200\2\0\0\250\1\0\0\264\1\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0t\0\0\0\201\2\0\0\250\1\0\0\264\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0t\0\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\201\2\0\0\250\1\0\0\264\1\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\202\2\0\0\250\1\0\0\264\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0t\0\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) }, 900, ) == 0x0
 00639   436   NtClose  (116, ... ) == 0x0
 00640   436   NtOpenKey  (0x20019, {24, 112, 0x40, 0, 0,  (0x20019, {24, 112, 0x40, 0, 0, "000000000005"}, ... 116, ) }, ... 116, ) == 0x0
 00641   436   NtQueryValueKey  (116,  (116, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 00642   436   NtQueryValueKey  (116,  (116, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 00643   436   NtQueryValueKey  (116,  (116, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\rsvpsp.dll\0\0gram\FSLSP.DLL\0\00\0\0\0\10\0\2\0\10\0\4\1\10\0h\220\354\28\220\354\2\2\0\12\0\4\1\12\00\00\0\0\0\10\0\2\0\14\0\4\1\10\0\210\220\354\2X\220\354\2\2\0\16\0\4\1\12\00\00\0\0\0\10\0\2\0\20\0\4\1\10\0\250\220\354\2x\220\354\2\2\0\22\0\4\1\12\00\00\0\0\0\10\0\2\0\24\0\4\1\10\0\310\220\354\2\230\220\354\2\2\0\26\0\4\1\12\00\00\0\0\0\10\0\2\0\30\0\4\1\10\0\0\0\0\0\270\220\354\2\2\0\32\0\4\1\10\0H\0K\0R\0\0\0\3\0\34\0\4\1\10\0\360\222\354\2\0\0\0\0\0\221\354\2\16\0\0\0<\0\37\0\4\0\10\0X\3\10\0X\3\10\0\4\0\2\0f \2\0\0\0\0\0\0\0\0\0\0\0\0\0\10\0\0\0\340\251`\235z3\320\21\275\210\0\0\300\202\346\232\355\3\0\0\1\0\0\0\17.\365w\13\30\365w\0\0\0\0\4+Y\1\2\0\0\0\1\0\0\0\17.\365w\6\0\0\0\2\0\0\0\20\0\0\0\20\0\0\0\1\0\0\0\6\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0R\0S\0V\0P\0 \0T\0C\0P\0 \0S\0e\0r\0v\0i\0c\0e\0 \0P\0r\0o\0v\0i\0d\0e\0r\0\0\0\0\0\0\0\362_du\3`du\240\1\10\0\250\5N\1 \0\0\0\0\0\0\0\240\1\10\0\310\5N\1H\344\301\0\0\0\0\0\0\0\0\0\0\0\245\0\0\0\10\0@\5N\1\0\0\0\0\204\3\0\0\204\2\0\0\250\1\0\0\264\1\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0t\0\0\0\204\2\0\0\250\1\0\0\264\1\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\205\2\0\0\250\1\0\0\264\1\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0p\0\0\0(\373\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\370\237\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\00\06\0\205\2\0\0\250\1\0\0\264\1\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0t\0\0\0\206\2\0\0\250\1\0\0\264\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0t\0\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\206\2\0\0\250\1\0\0\264\1\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\207\2\0\0\250\1\0\0\264\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0t\0\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) , Partial, 900, ... TitleIdx=0, Type=3, Data= (116, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\rsvpsp.dll\0\0gram\FSLSP.DLL\0\00\0\0\0\10\0\2\0\10\0\4\1\10\0h\220\354\28\220\354\2\2\0\12\0\4\1\12\00\00\0\0\0\10\0\2\0\14\0\4\1\10\0\210\220\354\2X\220\354\2\2\0\16\0\4\1\12\00\00\0\0\0\10\0\2\0\20\0\4\1\10\0\250\220\354\2x\220\354\2\2\0\22\0\4\1\12\00\00\0\0\0\10\0\2\0\24\0\4\1\10\0\310\220\354\2\230\220\354\2\2\0\26\0\4\1\12\00\00\0\0\0\10\0\2\0\30\0\4\1\10\0\0\0\0\0\270\220\354\2\2\0\32\0\4\1\10\0H\0K\0R\0\0\0\3\0\34\0\4\1\10\0\360\222\354\2\0\0\0\0\0\221\354\2\16\0\0\0<\0\37\0\4\0\10\0X\3\10\0X\3\10\0\4\0\2\0f \2\0\0\0\0\0\0\0\0\0\0\0\0\0\10\0\0\0\340\251`\235z3\320\21\275\210\0\0\300\202\346\232\355\3\0\0\1\0\0\0\17.\365w\13\30\365w\0\0\0\0\4+Y\1\2\0\0\0\1\0\0\0\17.\365w\6\0\0\0\2\0\0\0\20\0\0\0\20\0\0\0\1\0\0\0\6\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0R\0S\0V\0P\0 \0T\0C\0P\0 \0S\0e\0r\0v\0i\0c\0e\0 \0P\0r\0o\0v\0i\0d\0e\0r\0\0\0\0\0\0\0\362_du\3`du\240\1\10\0\250\5N\1 \0\0\0\0\0\0\0\240\1\10\0\310\5N\1H\344\301\0\0\0\0\0\0\0\0\0\0\0\245\0\0\0\10\0@\5N\1\0\0\0\0\204\3\0\0\204\2\0\0\250\1\0\0\264\1\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0t\0\0\0\204\2\0\0\250\1\0\0\264\1\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\205\2\0\0\250\1\0\0\264\1\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0p\0\0\0(\373\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\370\237\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\00\06\0\205\2\0\0\250\1\0\0\264\1\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0t\0\0\0\206\2\0\0\250\1\0\0\264\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0t\0\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\206\2\0\0\250\1\0\0\264\1\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\207\2\0\0\250\1\0\0\264\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0t\0\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) \0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\206\2\0\0\250\1\0\0\264\1\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\207\2\0\0\250\1\0\0\264\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0t\0\0\0\0\0\0\0 (116, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\rsvpsp.dll\0\0gram\FSLSP.DLL\0\00\0\0\0\10\0\2\0\10\0\4\1\10\0h\220\354\28\220\354\2\2\0\12\0\4\1\12\00\00\0\0\0\10\0\2\0\14\0\4\1\10\0\210\220\354\2X\220\354\2\2\0\16\0\4\1\12\00\00\0\0\0\10\0\2\0\20\0\4\1\10\0\250\220\354\2x\220\354\2\2\0\22\0\4\1\12\00\00\0\0\0\10\0\2\0\24\0\4\1\10\0\310\220\354\2\230\220\354\2\2\0\26\0\4\1\12\00\00\0\0\0\10\0\2\0\30\0\4\1\10\0\0\0\0\0\270\220\354\2\2\0\32\0\4\1\10\0H\0K\0R\0\0\0\3\0\34\0\4\1\10\0\360\222\354\2\0\0\0\0\0\221\354\2\16\0\0\0<\0\37\0\4\0\10\0X\3\10\0X\3\10\0\4\0\2\0f \2\0\0\0\0\0\0\0\0\0\0\0\0\0\10\0\0\0\340\251`\235z3\320\21\275\210\0\0\300\202\346\232\355\3\0\0\1\0\0\0\17.\365w\13\30\365w\0\0\0\0\4+Y\1\2\0\0\0\1\0\0\0\17.\365w\6\0\0\0\2\0\0\0\20\0\0\0\20\0\0\0\1\0\0\0\6\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0R\0S\0V\0P\0 \0T\0C\0P\0 \0S\0e\0r\0v\0i\0c\0e\0 \0P\0r\0o\0v\0i\0d\0e\0r\0\0\0\0\0\0\0\362_du\3`du\240\1\10\0\250\5N\1 \0\0\0\0\0\0\0\240\1\10\0\310\5N\1H\344\301\0\0\0\0\0\0\0\0\0\0\0\245\0\0\0\10\0@\5N\1\0\0\0\0\204\3\0\0\204\2\0\0\250\1\0\0\264\1\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0t\0\0\0\204\2\0\0\250\1\0\0\264\1\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\205\2\0\0\250\1\0\0\264\1\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0p\0\0\0(\373\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\370\237\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\00\06\0\205\2\0\0\250\1\0\0\264\1\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0t\0\0\0\206\2\0\0\250\1\0\0\264\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0t\0\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\206\2\0\0\250\1\0\0\264\1\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\207\2\0\0\250\1\0\0\264\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0t\0\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) }, 900, ) == 0x0
 00644   436   NtClose  (116, ... ) == 0x0
 00645   436   NtOpenKey  (0x20019, {24, 112, 0x40, 0, 0,  (0x20019, {24, 112, 0x40, 0, 0, "000000000006"}, ... 116, ) }, ... 116, ) == 0x0
 00646   436   NtQueryValueKey  (116,  (116, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 00647   436   NtQueryValueKey  (116,  (116, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 00648   436   NtQueryValueKey  (116,  (116, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0gram\FSLSP.DLL\0\00\0\0\0\10\0\2\0\10\0\4\1\10\0h\220\354\28\220\354\2\2\0\12\0\4\1\12\00\00\0\0\0\10\0\2\0\14\0\4\1\10\0\210\220\354\2X\220\354\2\2\0\16\0\4\1\12\00\00\0\0\0\10\0\2\0\20\0\4\1\10\0\250\220\354\2x\220\354\2\2\0\22\0\4\1\12\00\00\0\0\0\10\0\2\0\24\0\4\1\10\0\310\220\354\2\230\220\354\2\2\0\26\0\4\1\12\00\00\0\0\0\10\0\2\0\30\0\4\1\10\0\0\0\0\0\270\220\354\2\2\0\32\0\4\1\10\0H\0K\0R\0\0\0\3\0\34\0\4\1\10\0\360\222\354\2\0\0\0\0\0\221\354\2\16\0\0\0<\0\37\0\4\0\10\0X\3\10\0X\3\10\0\4\0\2\0\16\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\10\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\356\3\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\5\0\0\0\0\0\0\200\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\04\0F\0E\05\07\0D\07\0B\0-\00\03\0A\05\0-\04\08\0B\02\0-\08\0\0\0\0\0\204\3\0\0\211\2\0\0\250\1\0\0\264\1\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0t\0\0\0\211\2\0\0\250\1\0\0\264\1\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\212\2\0\0\250\1\0\0\264\1\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0p\0\0\0(\373\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\370\237\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\00\07\0\212\2\0\0\250\1\0\0\264\1\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0t\0\0\0\213\2\0\0\250\1\0\0\264\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0t\0\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\213\2\0\0\250\1\0\0\264\1\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\214\2\0\0\250\1\0\0\264\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0t\0\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) , Partial, 900, ... TitleIdx=0, Type=3, Data= (116, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0gram\FSLSP.DLL\0\00\0\0\0\10\0\2\0\10\0\4\1\10\0h\220\354\28\220\354\2\2\0\12\0\4\1\12\00\00\0\0\0\10\0\2\0\14\0\4\1\10\0\210\220\354\2X\220\354\2\2\0\16\0\4\1\12\00\00\0\0\0\10\0\2\0\20\0\4\1\10\0\250\220\354\2x\220\354\2\2\0\22\0\4\1\12\00\00\0\0\0\10\0\2\0\24\0\4\1\10\0\310\220\354\2\230\220\354\2\2\0\26\0\4\1\12\00\00\0\0\0\10\0\2\0\30\0\4\1\10\0\0\0\0\0\270\220\354\2\2\0\32\0\4\1\10\0H\0K\0R\0\0\0\3\0\34\0\4\1\10\0\360\222\354\2\0\0\0\0\0\221\354\2\16\0\0\0<\0\37\0\4\0\10\0X\3\10\0X\3\10\0\4\0\2\0\16\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\10\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\356\3\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\5\0\0\0\0\0\0\200\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\04\0F\0E\05\07\0D\07\0B\0-\00\03\0A\05\0-\04\08\0B\02\0-\08\0\0\0\0\0\204\3\0\0\211\2\0\0\250\1\0\0\264\1\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0t\0\0\0\211\2\0\0\250\1\0\0\264\1\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\212\2\0\0\250\1\0\0\264\1\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0p\0\0\0(\373\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\370\237\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\00\07\0\212\2\0\0\250\1\0\0\264\1\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0t\0\0\0\213\2\0\0\250\1\0\0\264\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0t\0\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\213\2\0\0\250\1\0\0\264\1\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\214\2\0\0\250\1\0\0\264\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0t\0\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) \0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\213\2\0\0\250\1\0\0\264\1\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\214\2\0\0\250\1\0\0\264\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0t\0\0\0\0\0\0\0 (116, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0gram\FSLSP.DLL\0\00\0\0\0\10\0\2\0\10\0\4\1\10\0h\220\354\28\220\354\2\2\0\12\0\4\1\12\00\00\0\0\0\10\0\2\0\14\0\4\1\10\0\210\220\354\2X\220\354\2\2\0\16\0\4\1\12\00\00\0\0\0\10\0\2\0\20\0\4\1\10\0\250\220\354\2x\220\354\2\2\0\22\0\4\1\12\00\00\0\0\0\10\0\2\0\24\0\4\1\10\0\310\220\354\2\230\220\354\2\2\0\26\0\4\1\12\00\00\0\0\0\10\0\2\0\30\0\4\1\10\0\0\0\0\0\270\220\354\2\2\0\32\0\4\1\10\0H\0K\0R\0\0\0\3\0\34\0\4\1\10\0\360\222\354\2\0\0\0\0\0\221\354\2\16\0\0\0<\0\37\0\4\0\10\0X\3\10\0X\3\10\0\4\0\2\0\16\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\10\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\356\3\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\5\0\0\0\0\0\0\200\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\04\0F\0E\05\07\0D\07\0B\0-\00\03\0A\05\0-\04\08\0B\02\0-\08\0\0\0\0\0\204\3\0\0\211\2\0\0\250\1\0\0\264\1\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0t\0\0\0\211\2\0\0\250\1\0\0\264\1\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\212\2\0\0\250\1\0\0\264\1\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0p\0\0\0(\373\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\370\237\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\00\07\0\212\2\0\0\250\1\0\0\264\1\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0t\0\0\0\213\2\0\0\250\1\0\0\264\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0t\0\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\213\2\0\0\250\1\0\0\264\1\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\214\2\0\0\250\1\0\0\264\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0t\0\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) }, 900, ) == 0x0
 00649   436   NtClose  (116, ... ) == 0x0
 00650   436   NtOpenKey  (0x20019, {24, 112, 0x40, 0, 0,  (0x20019, {24, 112, 0x40, 0, 0, "000000000007"}, ... 116, ) }, ... 116, ) == 0x0
 00651   436   NtQueryValueKey  (116,  (116, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 00652   436   NtQueryValueKey  (116,  (116, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 00653   436   NtQueryValueKey  (116,  (116, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0gram\FSLSP.DLL\0\00\0\0\0\10\0\2\0\10\0\4\1\10\0h\220\354\28\220\354\2\2\0\12\0\4\1\12\00\00\0\0\0\10\0\2\0\14\0\4\1\10\0\210\220\354\2X\220\354\2\2\0\16\0\4\1\12\00\00\0\0\0\10\0\2\0\20\0\4\1\10\0\250\220\354\2x\220\354\2\2\0\22\0\4\1\12\00\00\0\0\0\10\0\2\0\24\0\4\1\10\0\310\220\354\2\230\220\354\2\2\0\26\0\4\1\12\00\00\0\0\0\10\0\2\0\30\0\4\1\10\0\0\0\0\0\270\220\354\2\2\0\32\0\4\1\10\0H\0K\0R\0\0\0\3\0\34\0\4\1\10\0\360\222\354\2\0\0\0\0\0\221\354\2\16\0\0\0<\0\37\0\4\0\10\0X\3\10\0X\3\10\0\4\0\2\0\11\2\2\0\0\0\0\0\0\0\0\0\0\0\0\0\10\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\357\3\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\2\0\0\0\0\0\0\200\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\04\0F\0E\05\07\0D\07\0B\0-\00\03\0A\05\0-\04\08\0B\02\0-\08\0\0\0\0\0\204\3\0\0\216\2\0\0\250\1\0\0\264\1\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0t\0\0\0\216\2\0\0\250\1\0\0\264\1\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\217\2\0\0\250\1\0\0\264\1\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0p\0\0\0(\373\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\370\237\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\00\08\0\217\2\0\0\250\1\0\0\264\1\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0t\0\0\0\220\2\0\0\250\1\0\0\264\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0t\0\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\220\2\0\0\250\1\0\0\264\1\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\221\2\0\0\250\1\0\0\264\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0t\0\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) , Partial, 900, ... TitleIdx=0, Type=3, Data= (116, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0gram\FSLSP.DLL\0\00\0\0\0\10\0\2\0\10\0\4\1\10\0h\220\354\28\220\354\2\2\0\12\0\4\1\12\00\00\0\0\0\10\0\2\0\14\0\4\1\10\0\210\220\354\2X\220\354\2\2\0\16\0\4\1\12\00\00\0\0\0\10\0\2\0\20\0\4\1\10\0\250\220\354\2x\220\354\2\2\0\22\0\4\1\12\00\00\0\0\0\10\0\2\0\24\0\4\1\10\0\310\220\354\2\230\220\354\2\2\0\26\0\4\1\12\00\00\0\0\0\10\0\2\0\30\0\4\1\10\0\0\0\0\0\270\220\354\2\2\0\32\0\4\1\10\0H\0K\0R\0\0\0\3\0\34\0\4\1\10\0\360\222\354\2\0\0\0\0\0\221\354\2\16\0\0\0<\0\37\0\4\0\10\0X\3\10\0X\3\10\0\4\0\2\0\11\2\2\0\0\0\0\0\0\0\0\0\0\0\0\0\10\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\357\3\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\2\0\0\0\0\0\0\200\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\04\0F\0E\05\07\0D\07\0B\0-\00\03\0A\05\0-\04\08\0B\02\0-\08\0\0\0\0\0\204\3\0\0\216\2\0\0\250\1\0\0\264\1\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0t\0\0\0\216\2\0\0\250\1\0\0\264\1\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\217\2\0\0\250\1\0\0\264\1\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0p\0\0\0(\373\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\370\237\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\00\08\0\217\2\0\0\250\1\0\0\264\1\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0t\0\0\0\220\2\0\0\250\1\0\0\264\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0t\0\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\220\2\0\0\250\1\0\0\264\1\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\221\2\0\0\250\1\0\0\264\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0t\0\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) \0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\220\2\0\0\250\1\0\0\264\1\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\221\2\0\0\250\1\0\0\264\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0t\0\0\0\0\0\0\0 (116, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0gram\FSLSP.DLL\0\00\0\0\0\10\0\2\0\10\0\4\1\10\0h\220\354\28\220\354\2\2\0\12\0\4\1\12\00\00\0\0\0\10\0\2\0\14\0\4\1\10\0\210\220\354\2X\220\354\2\2\0\16\0\4\1\12\00\00\0\0\0\10\0\2\0\20\0\4\1\10\0\250\220\354\2x\220\354\2\2\0\22\0\4\1\12\00\00\0\0\0\10\0\2\0\24\0\4\1\10\0\310\220\354\2\230\220\354\2\2\0\26\0\4\1\12\00\00\0\0\0\10\0\2\0\30\0\4\1\10\0\0\0\0\0\270\220\354\2\2\0\32\0\4\1\10\0H\0K\0R\0\0\0\3\0\34\0\4\1\10\0\360\222\354\2\0\0\0\0\0\221\354\2\16\0\0\0<\0\37\0\4\0\10\0X\3\10\0X\3\10\0\4\0\2\0\11\2\2\0\0\0\0\0\0\0\0\0\0\0\0\0\10\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\357\3\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\2\0\0\0\0\0\0\200\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\04\0F\0E\05\07\0D\07\0B\0-\00\03\0A\05\0-\04\08\0B\02\0-\08\0\0\0\0\0\204\3\0\0\216\2\0\0\250\1\0\0\264\1\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0t\0\0\0\216\2\0\0\250\1\0\0\264\1\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\217\2\0\0\250\1\0\0\264\1\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0p\0\0\0(\373\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\370\237\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\00\08\0\217\2\0\0\250\1\0\0\264\1\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0t\0\0\0\220\2\0\0\250\1\0\0\264\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0t\0\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\220\2\0\0\250\1\0\0\264\1\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\221\2\0\0\250\1\0\0\264\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0t\0\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) }, 900, ) == 0x0
 00654   436   NtClose  (116, ... ) == 0x0
 00655   436   NtOpenKey  (0x20019, {24, 112, 0x40, 0, 0,  (0x20019, {24, 112, 0x40, 0, 0, "000000000008"}, ... 116, ) }, ... 116, ) == 0x0
 00656   436   NtQueryValueKey  (116,  (116, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 00657   436   NtQueryValueKey  (116,  (116, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 00658   436   NtAllocateVirtualMemory  (-1, 1363968, 0, 4096, 4096, 4, ... 1363968, 4096, ) == 0x0
 00659   436   NtQueryValueKey  (116,  (116, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0gram\FSLSP.DLL\0\00\0\0\0\10\0\2\0\10\0\4\1\10\0h\220\354\28\220\354\2\2\0\12\0\4\1\12\00\00\0\0\0\10\0\2\0\14\0\4\1\10\0\210\220\354\2X\220\354\2\2\0\16\0\4\1\12\00\00\0\0\0\10\0\2\0\20\0\4\1\10\0\250\220\354\2x\220\354\2\2\0\22\0\4\1\12\00\00\0\0\0\10\0\2\0\24\0\4\1\10\0\310\220\354\2\230\220\354\2\2\0\26\0\4\1\12\00\00\0\0\0\10\0\2\0\30\0\4\1\10\0\0\0\0\0\270\220\354\2\2\0\32\0\4\1\10\0H\0K\0R\0\0\0\3\0\34\0\4\1\10\0\360\222\354\2\0\0\0\0\0\221\354\2\16\0\0\0<\0\37\0\4\0\10\0X\3\10\0X\3\10\0\4\0\2\0\16\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\360\3\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\5\0\0\0\377\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\0A\0B\0E\07\0E\00\06\0F\0-\06\02\00\0F\0-\04\0E\0A\0A\0-\0A\0\0\0\0\0\204\3\0\0\224\2\0\0\250\1\0\0\264\1\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0t\0\0\0\224\2\0\0\250\1\0\0\264\1\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\225\2\0\0\250\1\0\0\264\1\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0p\0\0\0(\373\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\370\237\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\00\09\0\225\2\0\0\250\1\0\0\264\1\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0t\0\0\0\226\2\0\0\250\1\0\0\264\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0t\0\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\226\2\0\0\250\1\0\0\264\1\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\227\2\0\0\250\1\0\0\264\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0t\0\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) , Partial, 900, ... TitleIdx=0, Type=3, Data= (116, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0gram\FSLSP.DLL\0\00\0\0\0\10\0\2\0\10\0\4\1\10\0h\220\354\28\220\354\2\2\0\12\0\4\1\12\00\00\0\0\0\10\0\2\0\14\0\4\1\10\0\210\220\354\2X\220\354\2\2\0\16\0\4\1\12\00\00\0\0\0\10\0\2\0\20\0\4\1\10\0\250\220\354\2x\220\354\2\2\0\22\0\4\1\12\00\00\0\0\0\10\0\2\0\24\0\4\1\10\0\310\220\354\2\230\220\354\2\2\0\26\0\4\1\12\00\00\0\0\0\10\0\2\0\30\0\4\1\10\0\0\0\0\0\270\220\354\2\2\0\32\0\4\1\10\0H\0K\0R\0\0\0\3\0\34\0\4\1\10\0\360\222\354\2\0\0\0\0\0\221\354\2\16\0\0\0<\0\37\0\4\0\10\0X\3\10\0X\3\10\0\4\0\2\0\16\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\360\3\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\5\0\0\0\377\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\0A\0B\0E\07\0E\00\06\0F\0-\06\02\00\0F\0-\04\0E\0A\0A\0-\0A\0\0\0\0\0\204\3\0\0\224\2\0\0\250\1\0\0\264\1\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0t\0\0\0\224\2\0\0\250\1\0\0\264\1\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\225\2\0\0\250\1\0\0\264\1\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0p\0\0\0(\373\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\370\237\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\00\09\0\225\2\0\0\250\1\0\0\264\1\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0t\0\0\0\226\2\0\0\250\1\0\0\264\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0t\0\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\226\2\0\0\250\1\0\0\264\1\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\227\2\0\0\250\1\0\0\264\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0t\0\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) \0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\226\2\0\0\250\1\0\0\264\1\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\227\2\0\0\250\1\0\0\264\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0t\0\0\0\0\0\0\0 (116, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0gram\FSLSP.DLL\0\00\0\0\0\10\0\2\0\10\0\4\1\10\0h\220\354\28\220\354\2\2\0\12\0\4\1\12\00\00\0\0\0\10\0\2\0\14\0\4\1\10\0\210\220\354\2X\220\354\2\2\0\16\0\4\1\12\00\00\0\0\0\10\0\2\0\20\0\4\1\10\0\250\220\354\2x\220\354\2\2\0\22\0\4\1\12\00\00\0\0\0\10\0\2\0\24\0\4\1\10\0\310\220\354\2\230\220\354\2\2\0\26\0\4\1\12\00\00\0\0\0\10\0\2\0\30\0\4\1\10\0\0\0\0\0\270\220\354\2\2\0\32\0\4\1\10\0H\0K\0R\0\0\0\3\0\34\0\4\1\10\0\360\222\354\2\0\0\0\0\0\221\354\2\16\0\0\0<\0\37\0\4\0\10\0X\3\10\0X\3\10\0\4\0\2\0\16\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\360\3\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\5\0\0\0\377\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\0A\0B\0E\07\0E\00\06\0F\0-\06\02\00\0F\0-\04\0E\0A\0A\0-\0A\0\0\0\0\0\204\3\0\0\224\2\0\0\250\1\0\0\264\1\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0t\0\0\0\224\2\0\0\250\1\0\0\264\1\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\225\2\0\0\250\1\0\0\264\1\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0p\0\0\0(\373\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\370\237\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\00\09\0\225\2\0\0\250\1\0\0\264\1\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0t\0\0\0\226\2\0\0\250\1\0\0\264\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0t\0\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\226\2\0\0\250\1\0\0\264\1\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\227\2\0\0\250\1\0\0\264\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0t\0\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) }, 900, ) == 0x0
 00660   436   NtClose  (116, ... ) == 0x0
 00661   436   NtOpenKey  (0x20019, {24, 112, 0x40, 0, 0,  (0x20019, {24, 112, 0x40, 0, 0, "000000000009"}, ... 116, ) }, ... 116, ) == 0x0
 00662   436   NtQueryValueKey  (116,  (116, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 00663   436   NtQueryValueKey  (116,  (116, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 00664   436   NtQueryValueKey  (116,  (116, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0gram\FSLSP.DLL\0\00\0\0\0\10\0\2\0\10\0\4\1\10\0h\220\354\28\220\354\2\2\0\12\0\4\1\12\00\00\0\0\0\10\0\2\0\14\0\4\1\10\0\210\220\354\2X\220\354\2\2\0\16\0\4\1\12\00\00\0\0\0\10\0\2\0\20\0\4\1\10\0\250\220\354\2x\220\354\2\2\0\22\0\4\1\12\00\00\0\0\0\10\0\2\0\24\0\4\1\10\0\310\220\354\2\230\220\354\2\2\0\26\0\4\1\12\00\00\0\0\0\10\0\2\0\30\0\4\1\10\0\0\0\0\0\270\220\354\2\2\0\32\0\4\1\10\0H\0K\0R\0\0\0\3\0\34\0\4\1\10\0\360\222\354\2\0\0\0\0\0\221\354\2\16\0\0\0<\0\37\0\4\0\10\0X\3\10\0X\3\10\0\4\0\2\0\11\2\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\361\3\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\2\0\0\0\377\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\0A\0B\0E\07\0E\00\06\0F\0-\06\02\00\0F\0-\04\0E\0A\0A\0-\0A\0\0\0\0\0\204\3\0\0\231\2\0\0\250\1\0\0\264\1\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0t\0\0\0\231\2\0\0\250\1\0\0\264\1\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\232\2\0\0\250\1\0\0\264\1\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0p\0\0\0(\373\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\370\237\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\01\00\0\232\2\0\0\250\1\0\0\264\1\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0t\0\0\0\233\2\0\0\250\1\0\0\264\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0t\0\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\233\2\0\0\250\1\0\0\264\1\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\234\2\0\0\250\1\0\0\264\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0t\0\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) , Partial, 900, ... TitleIdx=0, Type=3, Data= (116, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0gram\FSLSP.DLL\0\00\0\0\0\10\0\2\0\10\0\4\1\10\0h\220\354\28\220\354\2\2\0\12\0\4\1\12\00\00\0\0\0\10\0\2\0\14\0\4\1\10\0\210\220\354\2X\220\354\2\2\0\16\0\4\1\12\00\00\0\0\0\10\0\2\0\20\0\4\1\10\0\250\220\354\2x\220\354\2\2\0\22\0\4\1\12\00\00\0\0\0\10\0\2\0\24\0\4\1\10\0\310\220\354\2\230\220\354\2\2\0\26\0\4\1\12\00\00\0\0\0\10\0\2\0\30\0\4\1\10\0\0\0\0\0\270\220\354\2\2\0\32\0\4\1\10\0H\0K\0R\0\0\0\3\0\34\0\4\1\10\0\360\222\354\2\0\0\0\0\0\221\354\2\16\0\0\0<\0\37\0\4\0\10\0X\3\10\0X\3\10\0\4\0\2\0\11\2\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\361\3\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\2\0\0\0\377\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\0A\0B\0E\07\0E\00\06\0F\0-\06\02\00\0F\0-\04\0E\0A\0A\0-\0A\0\0\0\0\0\204\3\0\0\231\2\0\0\250\1\0\0\264\1\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0t\0\0\0\231\2\0\0\250\1\0\0\264\1\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\232\2\0\0\250\1\0\0\264\1\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0p\0\0\0(\373\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\370\237\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\01\00\0\232\2\0\0\250\1\0\0\264\1\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0t\0\0\0\233\2\0\0\250\1\0\0\264\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0t\0\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\233\2\0\0\250\1\0\0\264\1\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\234\2\0\0\250\1\0\0\264\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0t\0\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) \0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\233\2\0\0\250\1\0\0\264\1\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\234\2\0\0\250\1\0\0\264\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0t\0\0\0\0\0\0\0 (116, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0gram\FSLSP.DLL\0\00\0\0\0\10\0\2\0\10\0\4\1\10\0h\220\354\28\220\354\2\2\0\12\0\4\1\12\00\00\0\0\0\10\0\2\0\14\0\4\1\10\0\210\220\354\2X\220\354\2\2\0\16\0\4\1\12\00\00\0\0\0\10\0\2\0\20\0\4\1\10\0\250\220\354\2x\220\354\2\2\0\22\0\4\1\12\00\00\0\0\0\10\0\2\0\24\0\4\1\10\0\310\220\354\2\230\220\354\2\2\0\26\0\4\1\12\00\00\0\0\0\10\0\2\0\30\0\4\1\10\0\0\0\0\0\270\220\354\2\2\0\32\0\4\1\10\0H\0K\0R\0\0\0\3\0\34\0\4\1\10\0\360\222\354\2\0\0\0\0\0\221\354\2\16\0\0\0<\0\37\0\4\0\10\0X\3\10\0X\3\10\0\4\0\2\0\11\2\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\361\3\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\2\0\0\0\377\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\0A\0B\0E\07\0E\00\06\0F\0-\06\02\00\0F\0-\04\0E\0A\0A\0-\0A\0\0\0\0\0\204\3\0\0\231\2\0\0\250\1\0\0\264\1\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0t\0\0\0\231\2\0\0\250\1\0\0\264\1\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\232\2\0\0\250\1\0\0\264\1\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0p\0\0\0(\373\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\370\237\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\01\00\0\232\2\0\0\250\1\0\0\264\1\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0t\0\0\0\233\2\0\0\250\1\0\0\264\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0t\0\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\233\2\0\0\250\1\0\0\264\1\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\234\2\0\0\250\1\0\0\264\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0t\0\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) }, 900, ) == 0x0
 00665   436   NtClose  (116, ... ) == 0x0
 00666   436   NtOpenKey  (0x20019, {24, 112, 0x40, 0, 0,  (0x20019, {24, 112, 0x40, 0, 0, "000000000010"}, ... 116, ) }, ... 116, ) == 0x0
 00667   436   NtQueryValueKey  (116,  (116, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 00668   436   NtQueryValueKey  (116,  (116, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 00669   436   NtQueryValueKey  (116,  (116, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0gram\FSLSP.DLL\0\00\0\0\0\10\0\2\0\10\0\4\1\10\0h\220\354\28\220\354\2\2\0\12\0\4\1\12\00\00\0\0\0\10\0\2\0\14\0\4\1\10\0\210\220\354\2X\220\354\2\2\0\16\0\4\1\12\00\00\0\0\0\10\0\2\0\20\0\4\1\10\0\250\220\354\2x\220\354\2\2\0\22\0\4\1\12\00\00\0\0\0\10\0\2\0\24\0\4\1\10\0\310\220\354\2\230\220\354\2\2\0\26\0\4\1\12\00\00\0\0\0\10\0\2\0\30\0\4\1\10\0\0\0\0\0\270\220\354\2\2\0\32\0\4\1\10\0H\0K\0R\0\0\0\3\0\34\0\4\1\10\0\360\222\354\2\0\0\0\0\0\221\354\2\16\0\0\0<\0\37\0\4\0\10\0X\3\10\0X\3\10\0\4\0\2\0\16\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\362\3\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\5\0\0\0\376\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\0D\01\09\0D\0F\08\08\02\0-\0A\09\0C\0B\0-\04\01\04\04\0-\08\0\0\0\0\0\204\3\0\0\236\2\0\0\250\1\0\0\264\1\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0t\0\0\0\236\2\0\0\250\1\0\0\264\1\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\237\2\0\0\250\1\0\0\264\1\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0p\0\0\0(\373\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\370\237\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\01\01\0\237\2\0\0\250\1\0\0\264\1\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0t\0\0\0\240\2\0\0\250\1\0\0\264\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0t\0\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\240\2\0\0\250\1\0\0\264\1\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\241\2\0\0\250\1\0\0\264\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0t\0\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) , Partial, 900, ... TitleIdx=0, Type=3, Data= (116, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0gram\FSLSP.DLL\0\00\0\0\0\10\0\2\0\10\0\4\1\10\0h\220\354\28\220\354\2\2\0\12\0\4\1\12\00\00\0\0\0\10\0\2\0\14\0\4\1\10\0\210\220\354\2X\220\354\2\2\0\16\0\4\1\12\00\00\0\0\0\10\0\2\0\20\0\4\1\10\0\250\220\354\2x\220\354\2\2\0\22\0\4\1\12\00\00\0\0\0\10\0\2\0\24\0\4\1\10\0\310\220\354\2\230\220\354\2\2\0\26\0\4\1\12\00\00\0\0\0\10\0\2\0\30\0\4\1\10\0\0\0\0\0\270\220\354\2\2\0\32\0\4\1\10\0H\0K\0R\0\0\0\3\0\34\0\4\1\10\0\360\222\354\2\0\0\0\0\0\221\354\2\16\0\0\0<\0\37\0\4\0\10\0X\3\10\0X\3\10\0\4\0\2\0\16\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\362\3\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\5\0\0\0\376\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\0D\01\09\0D\0F\08\08\02\0-\0A\09\0C\0B\0-\04\01\04\04\0-\08\0\0\0\0\0\204\3\0\0\236\2\0\0\250\1\0\0\264\1\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0t\0\0\0\236\2\0\0\250\1\0\0\264\1\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\237\2\0\0\250\1\0\0\264\1\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0p\0\0\0(\373\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\370\237\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\01\01\0\237\2\0\0\250\1\0\0\264\1\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0t\0\0\0\240\2\0\0\250\1\0\0\264\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0t\0\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\240\2\0\0\250\1\0\0\264\1\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\241\2\0\0\250\1\0\0\264\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0t\0\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) \0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\240\2\0\0\250\1\0\0\264\1\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\241\2\0\0\250\1\0\0\264\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0t\0\0\0\0\0\0\0 (116, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0gram\FSLSP.DLL\0\00\0\0\0\10\0\2\0\10\0\4\1\10\0h\220\354\28\220\354\2\2\0\12\0\4\1\12\00\00\0\0\0\10\0\2\0\14\0\4\1\10\0\210\220\354\2X\220\354\2\2\0\16\0\4\1\12\00\00\0\0\0\10\0\2\0\20\0\4\1\10\0\250\220\354\2x\220\354\2\2\0\22\0\4\1\12\00\00\0\0\0\10\0\2\0\24\0\4\1\10\0\310\220\354\2\230\220\354\2\2\0\26\0\4\1\12\00\00\0\0\0\10\0\2\0\30\0\4\1\10\0\0\0\0\0\270\220\354\2\2\0\32\0\4\1\10\0H\0K\0R\0\0\0\3\0\34\0\4\1\10\0\360\222\354\2\0\0\0\0\0\221\354\2\16\0\0\0<\0\37\0\4\0\10\0X\3\10\0X\3\10\0\4\0\2\0\16\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\362\3\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\5\0\0\0\376\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\0D\01\09\0D\0F\08\08\02\0-\0A\09\0C\0B\0-\04\01\04\04\0-\08\0\0\0\0\0\204\3\0\0\236\2\0\0\250\1\0\0\264\1\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0t\0\0\0\236\2\0\0\250\1\0\0\264\1\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\237\2\0\0\250\1\0\0\264\1\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0p\0\0\0(\373\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\370\237\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\01\01\0\237\2\0\0\250\1\0\0\264\1\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0t\0\0\0\240\2\0\0\250\1\0\0\264\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0t\0\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\240\2\0\0\250\1\0\0\264\1\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\241\2\0\0\250\1\0\0\264\1\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0t\0\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) }, 900, ) == 0x0
 00670   436   NtClose  (116, ... ) == 0x0
 00671   436   NtOpenKey  (0x20019, {24, 112, 0x40, 0, 0,  (0x20019, {24, 112, 0x40, 0, 0, "000000000011"}, ... 116, ) }, ... 116, ) == 0x0
 00672   436   NtQueryValueKey  (116,  (116, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 00673   436   NtQueryValueKey  (116,  (116, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 00674   436   NtQueryValueKey  (116,  (116, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0gram\FSLSP.DLL\0\00\0\0\0\10\0\2\0\10\0\4\1\10\0h\220\354\28\220\354\2\2\0\12\0\4\1\12\00\00\0\0\0\10\0\2\0\14\0\4\1\10\0\210\220\354\2X\220\354\2\2\0\16\0\4\1\12\00\00\0\0\0\10\0\2\0\20\0\4\1\10\0\250\220\354\2x\220\354\2\2\0\22\0\4\1\12\00\00\0\0\0\10\0\2\0\24\0\4\1\10\0\310\220\354\2\230\220\354\2\2\0\26\0\4\1\12\00\00\0\0\0\10\0\2\0\30\0\4\1\10\0\0\0\0\0\270\220\354\2\2\0\32\0\4\1\10\0H\0K\0R\0\0\0\3\0\34\0\4\1\10\0\360\222\354\2\0\0\0\0\0\221\354\2\16\0\0\0<\0\37\0\4\0\10\0X\3\10\0X\3\10\0\4\0\2\0\11\2\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\363\3\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\2\0\0\0\376\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\0D\01\09\0D\0F\08\08\02\0-\0A\09\0C\0B\0-\04\01\04\04\0-\08\0\0\0\0\0\204\3\0\0\243\2\0\0\250\1\0\0\264\1\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0t\0\0\0\243\2\0\0\250\1\0\0\264\1\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\244\2\0\0\250\1\0\0\264\1\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0p\0\0\0\244\2\0\0\250\1\0\0\264\1\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\245\2\0\0\250\1\0\0\264\1\0\0\305\0\0\0\0\0\1\0\0\0\0\0\24\0\0\0h\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\245\2\0\0\250\1\0\0\264\1\0\0\305\0\0\0\1\0\1\0\2\1\0\0\0\0\0\0\246\2\0\0\250\1\0\0\264\1\0\0\25\0\0\0\0\0\1\0\0\0\0\0\24\0\0\0\3\0\37\0\377\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\246\2\0\0\250\1\0\0\264\1\0\0\25\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0p\0\0\0\247\2\0\0\250\1\0\0\264\1\0\0Q\0\0\0\0\0\1\0\0\0\0\0T\0\0\0\0\0\0\2\0\0\0\0\30\0\0\0`\0\0\0D\373\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0$\0&\0\250\237\24\0\0\0\0\0N\0a\0m\0e\0S\0p\0a\0c\0e\0_\0C\0a\0t\0a\0l\0o\0g\05\0"}, 900, ) , Partial, 900, ... TitleIdx=0, Type=3, Data= (116, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0gram\FSLSP.DLL\0\00\0\0\0\10\0\2\0\10\0\4\1\10\0h\220\354\28\220\354\2\2\0\12\0\4\1\12\00\00\0\0\0\10\0\2\0\14\0\4\1\10\0\210\220\354\2X\220\354\2\2\0\16\0\4\1\12\00\00\0\0\0\10\0\2\0\20\0\4\1\10\0\250\220\354\2x\220\354\2\2\0\22\0\4\1\12\00\00\0\0\0\10\0\2\0\24\0\4\1\10\0\310\220\354\2\230\220\354\2\2\0\26\0\4\1\12\00\00\0\0\0\10\0\2\0\30\0\4\1\10\0\0\0\0\0\270\220\354\2\2\0\32\0\4\1\10\0H\0K\0R\0\0\0\3\0\34\0\4\1\10\0\360\222\354\2\0\0\0\0\0\221\354\2\16\0\0\0<\0\37\0\4\0\10\0X\3\10\0X\3\10\0\4\0\2\0\11\2\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\363\3\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\2\0\0\0\376\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\0D\01\09\0D\0F\08\08\02\0-\0A\09\0C\0B\0-\04\01\04\04\0-\08\0\0\0\0\0\204\3\0\0\243\2\0\0\250\1\0\0\264\1\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0t\0\0\0\243\2\0\0\250\1\0\0\264\1\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\244\2\0\0\250\1\0\0\264\1\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0p\0\0\0\244\2\0\0\250\1\0\0\264\1\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\245\2\0\0\250\1\0\0\264\1\0\0\305\0\0\0\0\0\1\0\0\0\0\0\24\0\0\0h\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\245\2\0\0\250\1\0\0\264\1\0\0\305\0\0\0\1\0\1\0\2\1\0\0\0\0\0\0\246\2\0\0\250\1\0\0\264\1\0\0\25\0\0\0\0\0\1\0\0\0\0\0\24\0\0\0\3\0\37\0\377\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\246\2\0\0\250\1\0\0\264\1\0\0\25\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0p\0\0\0\247\2\0\0\250\1\0\0\264\1\0\0Q\0\0\0\0\0\1\0\0\0\0\0T\0\0\0\0\0\0\2\0\0\0\0\30\0\0\0`\0\0\0D\373\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0$\0&\0\250\237\24\0\0\0\0\0N\0a\0m\0e\0S\0p\0a\0c\0e\0_\0C\0a\0t\0a\0l\0o\0g\05\0"}, 900, ) }, 900, ) == 0x0
 00675   436   NtClose  (116, ... ) == 0x0
 00676   436   NtClose  (112, ... ) == 0x0
 00677   436   NtWaitForSingleObject  (104, 0, {0, 0}, ... ) == 0x102
 00678   436   NtCreateEvent  (0x1f0003, 0x0, 0, 0, ... 112, ) == 0x0
 00679   436   NtOpenKey  (0x2000000, {24, 96, 0x40, 0, 0,  (0x2000000, {24, 96, 0x40, 0, 0, "NameSpace_Catalog5"}, ... 116, ) }, ... 116, ) == 0x0
 00680   436   NtQueryValueKey  (116,  (116, "Serial_Access_Num", Partial, 144, ... TitleIdx=0, Type=4, Data="\4\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (116, "Serial_Access_Num", Partial, 144, ... TitleIdx=0, Type=4, Data="\4\0\0\0"}, 16, ) }, 16, ) == 0x0
 00681   436   NtNotifyChangeKey  (116, 112, 0, 0, 2011390432, 1, 0, 0, 0, 1, ... ) == 0x103
 00682   436   NtQueryValueKey  (116,  (116, "Serial_Access_Num", Partial, 144, ... TitleIdx=0, Type=4, Data="\4\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (116, "Serial_Access_Num", Partial, 144, ... TitleIdx=0, Type=4, Data="\4\0\0\0"}, 16, ) }, 16, ) == 0x0
 00683   436   NtOpenKey  (0x2000000, {24, 116, 0x40, 0, 0,  (0x2000000, {24, 116, 0x40, 0, 0, "00000004"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00684   436   NtQueryValueKey  (116,  (116, "Num_Catalog_Entries", Partial, 144, ... TitleIdx=0, Type=4, Data="\3\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (116, "Num_Catalog_Entries", Partial, 144, ... TitleIdx=0, Type=4, Data="\3\0\0\0"}, 16, ) }, 16, ) == 0x0
 00685   436   NtOpenKey  (0x2000000, {24, 116, 0x40, 0, 0,  (0x2000000, {24, 116, 0x40, 0, 0, "Catalog_Entries"}, ... 120, ) }, ... 120, ) == 0x0
 00686   436   NtAllocateVirtualMemory  (-1, 1368064, 0, 4096, 4096, 4, ... 1368064, 4096, ) == 0x0
 00687   436   NtOpenKey  (0x20019, {24, 120, 0x40, 0, 0,  (0x20019, {24, 120, 0x40, 0, 0, "000000000001"}, ... 124, ) }, ... 124, ) == 0x0
 00688   436   NtQueryValueKey  (124,  (124, "LibraryPath", Partial, 144, ... TitleIdx=0, Type=1, Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0m\0s\0w\0s\0o\0c\0k\0.\0d\0l\0l\0\0\0"}, 80, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (124, "LibraryPath", Partial, 144, ... TitleIdx=0, Type=1, Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0m\0s\0w\0s\0o\0c\0k\0.\0d\0l\0l\0\0\0"}, 80, ) }, 80, ) == 0x0
 00689   436   NtQueryValueKey  (124,  (124, "LibraryPath", Partial, 144, ... TitleIdx=0, Type=1, Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0m\0s\0w\0s\0o\0c\0k\0.\0d\0l\0l\0\0\0"}, 80, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (124, "LibraryPath", Partial, 144, ... TitleIdx=0, Type=1, Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0m\0s\0w\0s\0o\0c\0k\0.\0d\0l\0l\0\0\0"}, 80, ) }, 80, ) == 0x0
 00690   436   NtQueryValueKey  (124,  (124, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="T\0c\0p\0i\0p\0\0\0"}, 24, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (124, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="T\0c\0p\0i\0p\0\0\0"}, 24, ) }, 24, ) == 0x0
 00691   436   NtQueryValueKey  (124,  (124, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="T\0c\0p\0i\0p\0\0\0"}, 24, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (124, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="T\0c\0p\0i\0p\0\0\0"}, 24, ) }, 24, ) == 0x0
 00692   436   NtQueryValueKey  (124,  (124, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="T\0c\0p\0i\0p\0\0\0"}, 24, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (124, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="T\0c\0p\0i\0p\0\0\0"}, 24, ) }, 24, ) == 0x0
 00693   436   NtQueryValueKey  (124,  (124, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="T\0c\0p\0i\0p\0\0\0"}, 24, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (124, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="T\0c\0p\0i\0p\0\0\0"}, 24, ) }, 24, ) == 0x0
 00694   436   NtQueryValueKey  (124,  (124, "ProviderId", Partial, 144, ... TitleIdx=0, Type=3, Data="@\235\5"\236~\317\21\256Z\0\252\0\247\21+"}, 28, ) , Partial, 144, ... TitleIdx=0, Type=3, Data= (124, "ProviderId", Partial, 144, ... TitleIdx=0, Type=3, Data="@\235\5"\236~\317\21\256Z\0\252\0\247\21+"}, 28, ) \236~\317\21\256Z\0\252\0\247\21+"}, 28, ) == 0x0
 00695   436   NtQueryValueKey  (124,  (124, "AddressFamily", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00696   436   NtQueryValueKey  (124,  (124, "SupportedNameSpace", Partial, 144, ... TitleIdx=0, Type=4, Data="\14\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (124, "SupportedNameSpace", Partial, 144, ... TitleIdx=0, Type=4, Data="\14\0\0\0"}, 16, ) }, 16, ) == 0x0
 00697   436   NtQueryValueKey  (124,  (124, "Enabled", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (124, "Enabled", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) }, 16, ) == 0x0
 00698   436   NtQueryValueKey  (124,  (124, "Version", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (124, "Version", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) }, 16, ) == 0x0
 00699   436   NtQueryValueKey  (124,  (124, "StoresServiceClassInfo", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (124, "StoresServiceClassInfo", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) }, 16, ) == 0x0
 00700   436   NtClose  (124, ... ) == 0x0
 00701   436   NtOpenKey  (0x20019, {24, 120, 0x40, 0, 0,  (0x20019, {24, 120, 0x40, 0, 0, "000000000002"}, ... 124, ) }, ... 124, ) == 0x0
 00702   436   NtQueryValueKey  (124,  (124, "LibraryPath", Partial, 144, ... TitleIdx=0, Type=1, Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0w\0i\0n\0r\0n\0r\0.\0d\0l\0l\0\0\0"}, 78, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (124, "LibraryPath", Partial, 144, ... TitleIdx=0, Type=1, Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0w\0i\0n\0r\0n\0r\0.\0d\0l\0l\0\0\0"}, 78, ) }, 78, ) == 0x0
 00703   436   NtQueryValueKey  (124,  (124, "LibraryPath", Partial, 144, ... TitleIdx=0, Type=1, Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0w\0i\0n\0r\0n\0r\0.\0d\0l\0l\0\0\0"}, 78, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (124, "LibraryPath", Partial, 144, ... TitleIdx=0, Type=1, Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0w\0i\0n\0r\0n\0r\0.\0d\0l\0l\0\0\0"}, 78, ) }, 78, ) == 0x0
 00704   436   NtQueryValueKey  (124,  (124, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="N\0T\0D\0S\0\0\0"}, 22, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (124, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="N\0T\0D\0S\0\0\0"}, 22, ) }, 22, ) == 0x0
 00705   436   NtQueryValueKey  (124,  (124, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="N\0T\0D\0S\0\0\0"}, 22, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (124, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="N\0T\0D\0S\0\0\0"}, 22, ) }, 22, ) == 0x0
 00706   436   NtQueryValueKey  (124,  (124, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="N\0T\0D\0S\0\0\0"}, 22, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (124, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="N\0T\0D\0S\0\0\0"}, 22, ) }, 22, ) == 0x0
 00707   436   NtQueryValueKey  (124,  (124, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="N\0T\0D\0S\0\0\0"}, 22, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (124, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="N\0T\0D\0S\0\0\0"}, 22, ) }, 22, ) == 0x0
 00708   436   NtQueryValueKey  (124,  (124, "ProviderId", Partial, 144, ... TitleIdx=0, Type=3, Data="\3567&;\200\345\317\21\245U\0\300O\330\324\254"}, 28, ) , Partial, 144, ... TitleIdx=0, Type=3, Data= (124, "ProviderId", Partial, 144, ... TitleIdx=0, Type=3, Data="\3567&;\200\345\317\21\245U\0\300O\330\324\254"}, 28, ) }, 28, ) == 0x0
 00709   436   NtQueryValueKey  (124,  (124, "AddressFamily", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00710   436   NtQueryValueKey  (124,  (124, "SupportedNameSpace", Partial, 144, ... TitleIdx=0, Type=4, Data=" \0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (124, "SupportedNameSpace", Partial, 144, ... TitleIdx=0, Type=4, Data=" \0\0\0"}, 16, ) }, 16, ) == 0x0
 00711   436   NtQueryValueKey  (124,  (124, "Enabled", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (124, "Enabled", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) }, 16, ) == 0x0
 00712   436   NtQueryValueKey  (124,  (124, "Version", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (124, "Version", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) }, 16, ) == 0x0
 00713   436   NtQueryValueKey  (124,  (124, "StoresServiceClassInfo", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (124, "StoresServiceClassInfo", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) }, 16, ) == 0x0
 00714   436   NtClose  (124, ... ) == 0x0
 00715   436   NtOpenKey  (0x20019, {24, 120, 0x40, 0, 0,  (0x20019, {24, 120, 0x40, 0, 0, "000000000003"}, ... 124, ) }, ... 124, ) == 0x0
 00716   436   NtQueryValueKey  (124,  (124, "LibraryPath", Partial, 144, ... TitleIdx=0, Type=1, Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0m\0s\0w\0s\0o\0c\0k\0.\0d\0l\0l\0\0\0"}, 80, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (124, "LibraryPath", Partial, 144, ... TitleIdx=0, Type=1, Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0m\0s\0w\0s\0o\0c\0k\0.\0d\0l\0l\0\0\0"}, 80, ) }, 80, ) == 0x0
 00717   436   NtQueryValueKey  (124,  (124, "LibraryPath", Partial, 144, ... TitleIdx=0, Type=1, Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0m\0s\0w\0s\0o\0c\0k\0.\0d\0l\0l\0\0\0"}, 80, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (124, "LibraryPath", Partial, 144, ... TitleIdx=0, Type=1, Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0m\0s\0w\0s\0o\0c\0k\0.\0d\0l\0l\0\0\0"}, 80, ) }, 80, ) == 0x0
 00718   436   NtQueryValueKey  (124,  (124, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="N\0e\0t\0w\0o\0r\0k\0 \0L\0o\0c\0a\0t\0i\0o\0n\0 \0A\0w\0a\0r\0e\0n\0e\0s\0s\0 \0(\0N\0L\0A\0)\0 \0N\0a\0m\0e\0s\0p\0a\0c\0e\0\0\0"}, 98, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (124, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="N\0e\0t\0w\0o\0r\0k\0 \0L\0o\0c\0a\0t\0i\0o\0n\0 \0A\0w\0a\0r\0e\0n\0e\0s\0s\0 \0(\0N\0L\0A\0)\0 \0N\0a\0m\0e\0s\0p\0a\0c\0e\0\0\0"}, 98, ) }, 98, ) == 0x0
 00719   436   NtQueryValueKey  (124,  (124, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="N\0e\0t\0w\0o\0r\0k\0 \0L\0o\0c\0a\0t\0i\0o\0n\0 \0A\0w\0a\0r\0e\0n\0e\0s\0s\0 \0(\0N\0L\0A\0)\0 \0N\0a\0m\0e\0s\0p\0a\0c\0e\0\0\0"}, 98, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (124, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="N\0e\0t\0w\0o\0r\0k\0 \0L\0o\0c\0a\0t\0i\0o\0n\0 \0A\0w\0a\0r\0e\0n\0e\0s\0s\0 \0(\0N\0L\0A\0)\0 \0N\0a\0m\0e\0s\0p\0a\0c\0e\0\0\0"}, 98, ) }, 98, ) == 0x0
 00720   436   NtQueryValueKey  (124,  (124, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="N\0e\0t\0w\0o\0r\0k\0 \0L\0o\0c\0a\0t\0i\0o\0n\0 \0A\0w\0a\0r\0e\0n\0e\0s\0s\0 \0(\0N\0L\0A\0)\0 \0N\0a\0m\0e\0s\0p\0a\0c\0e\0\0\0"}, 98, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (124, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="N\0e\0t\0w\0o\0r\0k\0 \0L\0o\0c\0a\0t\0i\0o\0n\0 \0A\0w\0a\0r\0e\0n\0e\0s\0s\0 \0(\0N\0L\0A\0)\0 \0N\0a\0m\0e\0s\0p\0a\0c\0e\0\0\0"}, 98, ) }, 98, ) == 0x0
 00721   436   NtQueryValueKey  (124,  (124, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="N\0e\0t\0w\0o\0r\0k\0 \0L\0o\0c\0a\0t\0i\0o\0n\0 \0A\0w\0a\0r\0e\0n\0e\0s\0s\0 \0(\0N\0L\0A\0)\0 \0N\0a\0m\0e\0s\0p\0a\0c\0e\0\0\0"}, 98, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (124, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="N\0e\0t\0w\0o\0r\0k\0 \0L\0o\0c\0a\0t\0i\0o\0n\0 \0A\0w\0a\0r\0e\0n\0e\0s\0s\0 \0(\0N\0L\0A\0)\0 \0N\0a\0m\0e\0s\0p\0a\0c\0e\0\0\0"}, 98, ) }, 98, ) == 0x0
 00722   436   NtQueryValueKey  (124,  (124, "ProviderId", Partial, 144, ... TitleIdx=0, Type=3, Data=":$Bf\250;\246J\272\245.\13\327\37\335\203"}, 28, ) , Partial, 144, ... TitleIdx=0, Type=3, Data= (124, "ProviderId", Partial, 144, ... TitleIdx=0, Type=3, Data=":$Bf\250;\246J\272\245.\13\327\37\335\203"}, 28, ) }, 28, ) == 0x0
 00723   436   NtQueryValueKey  (124,  (124, "AddressFamily", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00724   436   NtQueryValueKey  (124,  (124, "SupportedNameSpace", Partial, 144, ... TitleIdx=0, Type=4, Data="\17\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (124, "SupportedNameSpace", Partial, 144, ... TitleIdx=0, Type=4, Data="\17\0\0\0"}, 16, ) }, 16, ) == 0x0
 00725   436   NtQueryValueKey  (124,  (124, "Enabled", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (124, "Enabled", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) }, 16, ) == 0x0
 00726   436   NtQueryValueKey  (124,  (124, "Version", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (124, "Version", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) }, 16, ) == 0x0
 00727   436   NtQueryValueKey  (124,  (124, "StoresServiceClassInfo", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (124, "StoresServiceClassInfo", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) }, 16, ) == 0x0
 00728   436   NtClose  (124, ... ) == 0x0
 00729   436   NtClose  (120, ... ) == 0x0
 00730   436   NtWaitForSingleObject  (112, 0, {0, 0}, ... ) == 0x102
 00731   436   NtClose  (96, ... ) == 0x0
 00732   436   NtQuerySystemInformation  (Basic, 44, ... {Unknown=0,MaximumIncrement=156250,PhysicalPageSize=0x1000,NumberOfPhysicalPages=0xff7c,LowestPhysicalPage=0x1,HighestPhysicalPage=0xffff,AllocationGranularity=0x10000,LowestUserAddress=0x10000,HighestUserAddress=0x7ffeffff,ActiveProcessors=1,NumberProcessors=1,}, 0x0, ) == 0x0
 00733   436   NtQuerySystemInformation  (Processor, 12, ... {system info, class 1, size 12}, 0x0, ) == 0x0
 00734   436   NtOpenKey  (0x1, {24, 48, 0x40, 0, 0,  (0x1, {24, 48, 0x40, 0, 0, "System\CurrentControlSet\Services\Winsock2\Parameters"}, ... 96, ) }, ... 96, ) == 0x0
 00735   436   NtQueryValueKey  (96,  (96, "Ws2_32NumHandleBuckets", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00736   436   NtClose  (96, ... ) == 0x0
 00737   436   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ... 96, ) == 0x0
 00738   436   NtSetInformationProcess  (-1, PriorityClass, {process info, class 18, size 2}, 3277056, ... ) == 0x0
 00739   436   NtCreateMutant  (0x1f0001, {24, 52, 0x80, 0, 0,  (0x1f0001, {24, 52, 0x80, 0, 0, "mtx_cv_cv_v2.0"}, 0, ... 120, ) }, 0, ... 120, ) == 0x0
 00740   436   NtOpenFile  (0x10080, {24, 0, 0x40, 0, 0,  (0x10080, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\System32\cvrss.exe"}, 7, 2113600, ... ) }, 7, 2113600, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00741   436   NtOpenFile  (0x110080, {24, 0, 0x40, 0, 0,  (0x110080, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\System32\cvrss.exe"}, 7, 2113568, ... ) }, 7, 2113568, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00742   436   NtCreateKey  (0xc0000000, {24, 0, 0xc0, 0, 0,  (0xc0000000, {24, 0, 0xc0, 0, 0, "\Registry\Machine\System\CurrentControlSet\Control\Session Manager"}, 0, 0x0, 0, ... 124, 0x0, ) }, 0, 0x0, 0, ... 124, 0x0, ) == 0x0
 00743   436   NtQueryValueKey  (124,  (124, "PendingFileRenameOperations2", Partial, 1024, ... ) , Partial, 1024, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00744   436   NtClose  (124, ... ) == 0x0
 00745   436   NtCreateKey  (0xc0000000, {24, 0, 0xc0, 0, 0,  (0xc0000000, {24, 0, 0xc0, 0, 0, "\Registry\Machine\System\CurrentControlSet\Control\Session Manager"}, 0, 0x0, 0, ... 124, 0x0, ) }, 0, 0x0, 0, ... 124, 0x0, ) == 0x0
 00746   436   NtQueryValueKey  (124,  (124, "PendingFileRenameOperations", Partial, 1024, ... ) , Partial, 1024, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00747   436   NtSetValueKey  (124,  (124, "PendingFileRenameOperations", 0, 7, "\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0c\0v\0r\0s\0s\0.\0e\0x\0e\0\0\0\0\0\0\0", 72, ... , 0, 7,  (124, "PendingFileRenameOperations", 0, 7, "\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0c\0v\0r\0s\0s\0.\0e\0x\0e\0\0\0\0\0\0\0", 72, ... , 72, ...
 00748   436   NtSetInformationFile  (-2147482844, -136378572, 8, EndOfFile, ... {status=0x0, info=0}, ) == 0x0
 00747   436   NtSetValueKey  ... ) == 0x0
 00749   436   NtClose  (124, ... ) == 0x0
 00750   436   NtOpenFile  (0x10080, {24, 0, 0x40, 0, 0,  (0x10080, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\System32\acrmon32.exe"}, 7, 2113600, ... ) }, 7, 2113600, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00751   436   NtOpenFile  (0x110080, {24, 0, 0x40, 0, 0,  (0x110080, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\System32\acrmon32.exe"}, 7, 2113568, ... ) }, 7, 2113568, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00752   436   NtCreateKey  (0xc0000000, {24, 0, 0xc0, 0, 0,  (0xc0000000, {24, 0, 0xc0, 0, 0, "\Registry\Machine\System\CurrentControlSet\Control\Session Manager"}, 0, 0x0, 0, ... 124, 0x0, ) }, 0, 0x0, 0, ... 124, 0x0, ) == 0x0
 00753   436   NtQueryValueKey  (124,  (124, "PendingFileRenameOperations2", Partial, 1024, ... ) , Partial, 1024, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00754   436   NtClose  (124, ... ) == 0x0
 00755   436   NtCreateKey  (0xc0000000, {24, 0, 0xc0, 0, 0,  (0xc0000000, {24, 0, 0xc0, 0, 0, "\Registry\Machine\System\CurrentControlSet\Control\Session Manager"}, 0, 0x0, 0, ... 124, 0x0, ) }, 0, 0x0, 0, ... 124, 0x0, ) == 0x0
 00756   436   NtQueryValueKey  (124,  (124, "PendingFileRenameOperations", Partial, 1024, ... TitleIdx=0, Type=7, Data="\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0c\0v\0r\0s\0s\0.\0e\0x\0e\0\0\0\0\0\0\0"}, 84, ) , Partial, 1024, ... TitleIdx=0, Type=7, Data= (124, "PendingFileRenameOperations", Partial, 1024, ... TitleIdx=0, Type=7, Data="\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0c\0v\0r\0s\0s\0.\0e\0x\0e\0\0\0\0\0\0\0"}, 84, ) }, 84, ) == 0x0
 00757   436   NtSetValueKey  (124,  (124, "PendingFileRenameOperations", 0, 7, "\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0c\0v\0r\0s\0s\0.\0e\0x\0e\0\0\0\0\0\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0a\0c\0r\0m\0o\0n\03\02\0.\0e\0x\0e\0\0\0\0\0\0\0", 148, ... ) , 0, 7,  (124, "PendingFileRenameOperations", 0, 7, "\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0c\0v\0r\0s\0s\0.\0e\0x\0e\0\0\0\0\0\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0a\0c\0r\0m\0o\0n\03\02\0.\0e\0x\0e\0\0\0\0\0\0\0", 148, ... ) , 148, ... ) == 0x0
 00758   436   NtClose  (124, ... ) == 0x0
 00759   436   NtOpenFile  (0x10080, {24, 0, 0x40, 0, 0,  (0x10080, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\System32\acroup.exe"}, 7, 2113600, ... ) }, 7, 2113600, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00760   436   NtOpenFile  (0x110080, {24, 0, 0x40, 0, 0,  (0x110080, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\System32\acroup.exe"}, 7, 2113568, ... ) }, 7, 2113568, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00761   436   NtCreateKey  (0xc0000000, {24, 0, 0xc0, 0, 0,  (0xc0000000, {24, 0, 0xc0, 0, 0, "\Registry\Machine\System\CurrentControlSet\Control\Session Manager"}, 0, 0x0, 0, ... 124, 0x0, ) }, 0, 0x0, 0, ... 124, 0x0, ) == 0x0
 00762   436   NtQueryValueKey  (124,  (124, "PendingFileRenameOperations2", Partial, 1024, ... ) , Partial, 1024, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00763   436   NtClose  (124, ... ) == 0x0
 00764   436   NtCreateKey  (0xc0000000, {24, 0, 0xc0, 0, 0,  (0xc0000000, {24, 0, 0xc0, 0, 0, "\Registry\Machine\System\CurrentControlSet\Control\Session Manager"}, 0, 0x0, 0, ... 124, 0x0, ) }, 0, 0x0, 0, ... 124, 0x0, ) == 0x0
 00765   436   NtQueryValueKey  (124,  (124, "PendingFileRenameOperations", Partial, 1024, ... TitleIdx=0, Type=7, Data="\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0c\0v\0r\0s\0s\0.\0e\0x\0e\0\0\0\0\0\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0a\0c\0r\0m\0o\0n\03\02\0.\0e\0x\0e\0\0\0\0\0\0\0"}, 160, ) , Partial, 1024, ... TitleIdx=0, Type=7, Data= (124, "PendingFileRenameOperations", Partial, 1024, ... TitleIdx=0, Type=7, Data="\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0c\0v\0r\0s\0s\0.\0e\0x\0e\0\0\0\0\0\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0a\0c\0r\0m\0o\0n\03\02\0.\0e\0x\0e\0\0\0\0\0\0\0"}, 160, ) }, 160, ) == 0x0
 00766   436   NtSetValueKey  (124,  (124, "PendingFileRenameOperations", 0, 7, "\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0c\0v\0r\0s\0s\0.\0e\0x\0e\0\0\0\0\0\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0a\0c\0r\0m\0o\0n\03\02\0.\0e\0x\0e\0\0\0\0\0\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0a\0c\0r\0o\0u\0p\0.\0e\0x\0e\0\0\0\0\0\0\0", 220, ... ) , 0, 7,  (124, "PendingFileRenameOperations", 0, 7, "\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0c\0v\0r\0s\0s\0.\0e\0x\0e\0\0\0\0\0\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0a\0c\0r\0m\0o\0n\03\02\0.\0e\0x\0e\0\0\0\0\0\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0a\0c\0r\0o\0u\0p\0.\0e\0x\0e\0\0\0\0\0\0\0", 220, ... ) , 220, ... ) == 0x0
 00767   436   NtClose  (124, ... ) == 0x0
 00768   436   NtOpenFile  (0x10080, {24, 0, 0x40, 0, 0,  (0x10080, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\System32\acroup32.exe"}, 7, 2113600, ... ) }, 7, 2113600, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00769   436   NtOpenFile  (0x110080, {24, 0, 0x40, 0, 0,  (0x110080, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\System32\acroup32.exe"}, 7, 2113568, ... ) }, 7, 2113568, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00770   436   NtCreateKey  (0xc0000000, {24, 0, 0xc0, 0, 0,  (0xc0000000, {24, 0, 0xc0, 0, 0, "\Registry\Machine\System\CurrentControlSet\Control\Session Manager"}, 0, 0x0, 0, ... 124, 0x0, ) }, 0, 0x0, 0, ... 124, 0x0, ) == 0x0
 00771   436   NtQueryValueKey  (124,  (124, "PendingFileRenameOperations2", Partial, 1024, ... ) , Partial, 1024, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00772   436   NtClose  (124, ... ) == 0x0
 00773   436   NtCreateKey  (0xc0000000, {24, 0, 0xc0, 0, 0,  (0xc0000000, {24, 0, 0xc0, 0, 0, "\Registry\Machine\System\CurrentControlSet\Control\Session Manager"}, 0, 0x0, 0, ... 124, 0x0, ) }, 0, 0x0, 0, ... 124, 0x0, ) == 0x0
 00774   436   NtQueryValueKey  (124,  (124, "PendingFileRenameOperations", Partial, 1024, ... TitleIdx=0, Type=7, Data="\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0c\0v\0r\0s\0s\0.\0e\0x\0e\0\0\0\0\0\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0a\0c\0r\0m\0o\0n\03\02\0.\0e\0x\0e\0\0\0\0\0\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0a\0c\0r\0o\0u\0p\0.\0e\0x\0e\0\0\0\0\0\0\0"}, 232, ) , Partial, 1024, ... TitleIdx=0, Type=7, Data= (124, "PendingFileRenameOperations", Partial, 1024, ... TitleIdx=0, Type=7, Data="\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0c\0v\0r\0s\0s\0.\0e\0x\0e\0\0\0\0\0\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0a\0c\0r\0m\0o\0n\03\02\0.\0e\0x\0e\0\0\0\0\0\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0a\0c\0r\0o\0u\0p\0.\0e\0x\0e\0\0\0\0\0\0\0"}, 232, ) }, 232, ) == 0x0
 00775   436   NtSetValueKey  (124,  (124, "PendingFileRenameOperations", 0, 7, "\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0c\0v\0r\0s\0s\0.\0e\0x\0e\0\0\0\0\0\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0a\0c\0r\0m\0o\0n\03\02\0.\0e\0x\0e\0\0\0\0\0\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0a\0c\0r\0o\0u\0p\0.\0e\0x\0e\0\0\0\0\0\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0a\0c\0r\0o\0u\0p\03\02\0.\0e\0x\0e\0\0\0\0\0\0\0", 296, ... ) , 0, 7,  (124, "PendingFileRenameOperations", 0, 7, "\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0c\0v\0r\0s\0s\0.\0e\0x\0e\0\0\0\0\0\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0a\0c\0r\0m\0o\0n\03\02\0.\0e\0x\0e\0\0\0\0\0\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0a\0c\0r\0o\0u\0p\0.\0e\0x\0e\0\0\0\0\0\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0a\0c\0r\0o\0u\0p\03\02\0.\0e\0x\0e\0\0\0\0\0\0\0", 296, ... ) , 296, ... ) == 0x0
 00776   436   NtClose  (124, ... ) == 0x0
 00777   436   NtOpenFile  (0x10080, {24, 0, 0x40, 0, 0,  (0x10080, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\System32\rasman32.exe"}, 7, 2113600, ... ) }, 7, 2113600, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00778   436   NtOpenFile  (0x110080, {24, 0, 0x40, 0, 0,  (0x110080, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\System32\rasman32.exe"}, 7, 2113568, ... ) }, 7, 2113568, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00779   436   NtCreateKey  (0xc0000000, {24, 0, 0xc0, 0, 0,  (0xc0000000, {24, 0, 0xc0, 0, 0, "\Registry\Machine\System\CurrentControlSet\Control\Session Manager"}, 0, 0x0, 0, ... 124, 0x0, ) }, 0, 0x0, 0, ... 124, 0x0, ) == 0x0
 00780   436   NtQueryValueKey  (124,  (124, "PendingFileRenameOperations2", Partial, 1024, ... ) , Partial, 1024, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00781   436   NtClose  (124, ... ) == 0x0
 00782   436   NtCreateKey  (0xc0000000, {24, 0, 0xc0, 0, 0,  (0xc0000000, {24, 0, 0xc0, 0, 0, "\Registry\Machine\System\CurrentControlSet\Control\Session Manager"}, 0, 0x0, 0, ... 124, 0x0, ) }, 0, 0x0, 0, ... 124, 0x0, ) == 0x0
 00783   436   NtQueryValueKey  (124,  (124, "PendingFileRenameOperations", Partial, 1024, ... TitleIdx=0, Type=7, Data="\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0c\0v\0r\0s\0s\0.\0e\0x\0e\0\0\0\0\0\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0a\0c\0r\0m\0o\0n\03\02\0.\0e\0x\0e\0\0\0\0\0\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0a\0c\0r\0o\0u\0p\0.\0e\0x\0e\0\0\0\0\0\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0a\0c\0r\0o\0u\0p\03\02\0.\0e\0x\0e\0\0\0\0\0\0\0"}, 308, ) , Partial, 1024, ... TitleIdx=0, Type=7, Data= (124, "PendingFileRenameOperations", Partial, 1024, ... TitleIdx=0, Type=7, Data="\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0c\0v\0r\0s\0s\0.\0e\0x\0e\0\0\0\0\0\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0a\0c\0r\0m\0o\0n\03\02\0.\0e\0x\0e\0\0\0\0\0\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0a\0c\0r\0o\0u\0p\0.\0e\0x\0e\0\0\0\0\0\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0a\0c\0r\0o\0u\0p\03\02\0.\0e\0x\0e\0\0\0\0\0\0\0"}, 308, ) }, 308, ) == 0x0
 00784   436   NtSetValueKey  (124,  (124, "PendingFileRenameOperations", 0, 7, "\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0c\0v\0r\0s\0s\0.\0e\0x\0e\0\0\0\0\0\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0a\0c\0r\0m\0o\0n\03\02\0.\0e\0x\0e\0\0\0\0\0\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0a\0c\0r\0o\0u\0p\0.\0e\0x\0e\0\0\0\0\0\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0a\0c\0r\0o\0u\0p\03\02\0.\0e\0x\0e\0\0\0\0\0\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0r\0a\0s\0m\0a\0n\03\02\0.\0e\0x\0e\0\0\0\0\0\0\0", 372, ... ) , 0, 7,  (124, "PendingFileRenameOperations", 0, 7, "\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0c\0v\0r\0s\0s\0.\0e\0x\0e\0\0\0\0\0\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0a\0c\0r\0m\0o\0n\03\02\0.\0e\0x\0e\0\0\0\0\0\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0a\0c\0r\0o\0u\0p\0.\0e\0x\0e\0\0\0\0\0\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0a\0c\0r\0o\0u\0p\03\02\0.\0e\0x\0e\0\0\0\0\0\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0r\0a\0s\0m\0a\0n\03\02\0.\0e\0x\0e\0\0\0\0\0\0\0", 372, ... ) , 372, ... ) == 0x0
 00785   436   NtClose  (124, ... ) == 0x0
 00786   436   NtOpenFile  (0x10080, {24, 0, 0x40, 0, 0,  (0x10080, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\System32\wcescom32.exe"}, 7, 2113600, ... ) }, 7, 2113600, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00787   436   NtOpenFile  (0x110080, {24, 0, 0x40, 0, 0,  (0x110080, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\System32\wcescom32.exe"}, 7, 2113568, ... ) }, 7, 2113568, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00788   436   NtCreateKey  (0xc0000000, {24, 0, 0xc0, 0, 0,  (0xc0000000, {24, 0, 0xc0, 0, 0, "\Registry\Machine\System\CurrentControlSet\Control\Session Manager"}, 0, 0x0, 0, ... 124, 0x0, ) }, 0, 0x0, 0, ... 124, 0x0, ) == 0x0
 00789   436   NtQueryValueKey  (124,  (124, "PendingFileRenameOperations2", Partial, 1024, ... ) , Partial, 1024, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00790   436   NtClose  (124, ... ) == 0x0
 00791   436   NtCreateKey  (0xc0000000, {24, 0, 0xc0, 0, 0,  (0xc0000000, {24, 0, 0xc0, 0, 0, "\Registry\Machine\System\CurrentControlSet\Control\Session Manager"}, 0, 0x0, 0, ... 124, 0x0, ) }, 0, 0x0, 0, ... 124, 0x0, ) == 0x0
 00792   436   NtQueryValueKey  (124,  (124, "PendingFileRenameOperations", Partial, 1024, ... TitleIdx=0, Type=7, Data="\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0c\0v\0r\0s\0s\0.\0e\0x\0e\0\0\0\0\0\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0a\0c\0r\0m\0o\0n\03\02\0.\0e\0x\0e\0\0\0\0\0\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0a\0c\0r\0o\0u\0p\0.\0e\0x\0e\0\0\0\0\0\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0a\0c\0r\0o\0u\0p\03\02\0.\0e\0x\0e\0\0\0\0\0\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0r\0a\0s\0m\0a\0n\03\02\0.\0e\0x\0e\0\0\0\0\0\0\0"}, 384, ) , Partial, 1024, ... TitleIdx=0, Type=7, Data= (124, "PendingFileRenameOperations", Partial, 1024, ... TitleIdx=0, Type=7, Data="\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0c\0v\0r\0s\0s\0.\0e\0x\0e\0\0\0\0\0\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0a\0c\0r\0m\0o\0n\03\02\0.\0e\0x\0e\0\0\0\0\0\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0a\0c\0r\0o\0u\0p\0.\0e\0x\0e\0\0\0\0\0\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0a\0c\0r\0o\0u\0p\03\02\0.\0e\0x\0e\0\0\0\0\0\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0r\0a\0s\0m\0a\0n\03\02\0.\0e\0x\0e\0\0\0\0\0\0\0"}, 384, ) }, 384, ) == 0x0
 00793   436   NtSetValueKey  (124,  (124, "PendingFileRenameOperations", 0, 7, "\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0c\0v\0r\0s\0s\0.\0e\0x\0e\0\0\0\0\0\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0a\0c\0r\0m\0o\0n\03\02\0.\0e\0x\0e\0\0\0\0\0\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0a\0c\0r\0o\0u\0p\0.\0e\0x\0e\0\0\0\0\0\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0a\0c\0r\0o\0u\0p\03\02\0.\0e\0x\0e\0\0\0\0\0\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0r\0a\0s\0m\0a\0n\03\02\0.\0e\0x\0e\0\0\0\0\0\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0w\0c\0e\0s\0c\0o\0m\03\02\0.\0e\0x\0e\0\0\0\0\0\0\0", 450, ... ) , 0, 7,  (124, "PendingFileRenameOperations", 0, 7, "\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0c\0v\0r\0s\0s\0.\0e\0x\0e\0\0\0\0\0\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0a\0c\0r\0m\0o\0n\03\02\0.\0e\0x\0e\0\0\0\0\0\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0a\0c\0r\0o\0u\0p\0.\0e\0x\0e\0\0\0\0\0\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0a\0c\0r\0o\0u\0p\03\02\0.\0e\0x\0e\0\0\0\0\0\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0r\0a\0s\0m\0a\0n\03\02\0.\0e\0x\0e\0\0\0\0\0\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0w\0c\0e\0s\0c\0o\0m\03\02\0.\0e\0x\0e\0\0\0\0\0\0\0", 450, ... ) , 450, ... ) == 0x0
 00794   436   NtClose  (124, ... ) == 0x0
 00795   436   NtOpenSection  (0xe, {24, 8, 0x40, 0, 0,  (0xe, {24, 8, 0x40, 0, 0, "Userenv.dll"}, ... 124, ) }, ... 124, ) == 0x0
 00796   436   NtMapViewOfSection  (124, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x75a70000), 0x0, 667648, ) == 0x0
 00797   436   NtClose  (124, ... ) == 0x0
 00798   436   NtOpenKey  (0x2000000, {24, 48, 0x40, 0, 0,  (0x2000000, {24, 48, 0x40, 0, 0, "Software\Microsoft\Windows NT\CurrentVersion\winlogon"}, ... 124, ) }, ... 124, ) == 0x0
 00799   436   NtQueryValueKey  (124,  (124, "UserEnvDebugLevel", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00800   436   NtClose  (124, ... ) == 0x0
 00801   436   NtOpenKey  (0x2000000, {24, 48, 0x40, 0, 0,  (0x2000000, {24, 48, 0x40, 0, 0, "Software\Microsoft\Windows NT\CurrentVersion\winlogon"}, ... 124, ) }, ... 124, ) == 0x0
 00802   436   NtQueryValueKey  (124,  (124, "ChkAccDebugLevel", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00803   436   NtClose  (124, ... ) == 0x0
 00804   436   NtOpenKey  (0x20019, {24, 48, 0x40, 0, 0,  (0x20019, {24, 48, 0x40, 0, 0, "System\CurrentControlSet\Control\ProductOptions"}, ... 124, ) }, ... 124, ) == 0x0
 00805   436   NtQueryValueKey  (124,  (124, "ProductType", Partial, 144, ... TitleIdx=0, Type=1, Data="W\0i\0n\0N\0T\0\0\0"}, 24, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (124, "ProductType", Partial, 144, ... TitleIdx=0, Type=1, Data="W\0i\0n\0N\0T\0\0\0"}, 24, ) }, 24, ) == 0x0
 00806   436   NtClose  (124, ... ) == 0x0
 00807   436   NtCreateEvent  (0x1f0003, {24, 52, 0x80, 1240992, 0,  (0x1f0003, {24, 52, 0x80, 1240992, 0, "Global\userenv:  User Profile setup event"}, 0, 1, ... 124, ) }, 0, 1, ... 124, ) == STATUS_OBJECT_NAME_EXISTS
 00808   436   NtQueryDefaultLocale  (1, 1238828, ... ) == 0x0
 00809   436   NtQueryDefaultLocale  (1, 1238828, ... ) == 0x0
 00810   436   NtQueryDefaultLocale  (1, 1238828, ... ) == 0x0
 00811   436   NtQueryDefaultLocale  (1, 1238828, ... ) == 0x0
 00812   436   NtQueryDefaultLocale  (1, 1238828, ... ) == 0x0
 00813   436   NtQueryDefaultLocale  (1, 1238828, ... ) == 0x0
 00814   436   NtQueryDefaultLocale  (1, 1238828, ... ) == 0x0
 00815   436   NtQueryDefaultLocale  (1, 1238828, ... ) == 0x0
 00816   436   NtQueryDefaultLocale  (1, 1238828, ... ) == 0x0
 00817   436   NtQueryDefaultLocale  (1, 1238828, ... ) == 0x0
 00818   436   NtQueryDefaultLocale  (1, 1238828, ... ) == 0x0
 00819   436   NtQueryDefaultLocale  (1, 1238828, ... ) == 0x0
 00820   436   NtQueryDefaultLocale  (1, 1238828, ... ) == 0x0
 00821   436   NtQueryDefaultLocale  (1, 1238828, ... ) == 0x0
 00822   436   NtQueryDefaultLocale  (1, 1238828, ... ) == 0x0
 00823   436   NtQueryDefaultLocale  (1, 1238828, ... ) == 0x0
 00824   436   NtQueryDefaultLocale  (1, 1238828, ... ) == 0x0
 00825   436   NtQueryDefaultLocale  (1, 1238828, ... ) == 0x0
 00826   436   NtQueryDefaultLocale  (1, 1238828, ... ) == 0x0
 00827   436   NtQueryDefaultLocale  (1, 1238828, ... ) == 0x0
 00828   436   NtQueryDefaultLocale  (1, 1238828, ... ) == 0x0
 00829   436   NtQueryDefaultLocale  (1, 1238828, ... ) == 0x0
 00830   436   NtQueryDefaultLocale  (1, 1238828, ... ) == 0x0
 00831   436   NtQueryDefaultLocale  (1, 1238828, ... ) == 0x0
 00832   436   NtQueryDefaultLocale  (1, 1238828, ... ) == 0x0
 00833   436   NtQueryDefaultLocale  (1, 1238828, ... ) == 0x0
 00834   436   NtOpenThreadTokenEx  (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN
 00835   436   NtOpenProcessTokenEx  (-1, 0x20008, 512, ... 128, ) == 0x0
 00836   436   NtQueryInformationToken  (128, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0
 00837   436   NtClose  (128, ... ) == 0x0
 00838   436   NtOpenKey  (0x20019, {24, 0, 0x640, 0, 0,  (0x20019, {24, 0, 0x640, 0, 0, "\REGISTRY\USER\S-1-5-21-1078081533-484763869-839522115-1003"}, ... 128, ) }, ... 128, ) == 0x0
 00839   436   NtOpenKey  (0x20019, {24, 128, 0x40, 0, 0,  (0x20019, {24, 128, 0x40, 0, 0, "Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders"}, ... 132, ) }, ... 132, ) == 0x0
 00840   436   NtQueryValueKey  (132,  (132, "Personal", Partial, 144, ... TitleIdx=0, Type=2, Data="%\0U\0S\0E\0R\0P\0R\0O\0F\0I\0L\0E\0%\0\\0M\0y\0 \0D\0o\0c\0u\0m\0e\0n\0t\0s\0\0\0"}, 66, ) , Partial, 144, ... TitleIdx=0, Type=2, Data= (132, "Personal", Partial, 144, ... TitleIdx=0, Type=2, Data="%\0U\0S\0E\0R\0P\0R\0O\0F\0I\0L\0E\0%\0\\0M\0y\0 \0D\0o\0c\0u\0m\0e\0n\0t\0s\0\0\0"}, 66, ) }, 66, ) == 0x0
 00841   436   NtQueryDefaultLocale  (1, 1238828, ... ) == 0x0
 00842   436   NtQueryValueKey  (132,  (132, "Local Settings", Partial, 144, ... TitleIdx=0, Type=2, Data="%\0U\0S\0E\0R\0P\0R\0O\0F\0I\0L\0E\0%\0\\0L\0o\0c\0a\0l\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\0\0"}, 70, ) , Partial, 144, ... TitleIdx=0, Type=2, Data= (132, "Local Settings", Partial, 144, ... TitleIdx=0, Type=2, Data="%\0U\0S\0E\0R\0P\0R\0O\0F\0I\0L\0E\0%\0\\0L\0o\0c\0a\0l\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\0\0"}, 70, ) }, 70, ) == 0x0
 00843   436   NtQueryDefaultLocale  (1, 1238828, ... ) == 0x0
 00844   436   NtQueryDefaultLocale  (1, 1238828, ... ) == 0x0
 00845   436   NtQueryDefaultLocale  (1, 1238828, ... ) == 0x0
 00846   436   NtQueryDefaultLocale  (1, 1238828, ... ) == 0x0
 00847   436   NtClose  (132, ... ) == 0x0
 00848   436   NtClose  (128, ... ) == 0x0
 00849   436   NtOpenKey  (0x2000000, {24, 48, 0x40, 0, 0,  (0x2000000, {24, 48, 0x40, 0, 0, "Software\Microsoft\Windows NT\CurrentVersion\winlogon"}, ... 128, ) }, ... 128, ) == 0x0
 00850   436   NtQueryValueKey  (128,  (128, "RsopDebugLevel", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00851   436   NtClose  (128, ... ) == 0x0
 00852   436   NtOpenKey  (0x2000000, {24, 48, 0x40, 0, 0,  (0x2000000, {24, 48, 0x40, 0, 0, "Software\Microsoft\Windows NT\CurrentVersion\winlogon"}, ... 128, ) }, ... 128, ) == 0x0
 00853   436   NtQueryValueKey  (128,  (128, "UserEnvDebugLevel", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00854   436   NtQueryValueKey  (128,  (128, "RsopLogging", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00855   436   NtClose  (128, ... ) == 0x0
 00856   436   NtOpenKey  (0x2000000, {24, 48, 0x40, 0, 0,  (0x2000000, {24, 48, 0x40, 0, 0, "Software\Policies\Microsoft\Windows\System"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00857   436   NtOpenKey  (0x2000000, {24, 48, 0x40, 0, 0,  (0x2000000, {24, 48, 0x40, 0, 0, "Software\Microsoft\Windows NT\CurrentVersion\winlogon"}, ... 128, ) }, ... 128, ) == 0x0
 00858   436   NtQueryValueKey  (128,  (128, "UserEnvDebugLevel", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00859   436   NtClose  (128, ... ) == 0x0
 00860   436   NtOpenKey  (0x2000000, {24, 48, 0x40, 0, 0,  (0x2000000, {24, 48, 0x40, 0, 0, "Software\Policies\Microsoft\Windows\System"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00861   436   NtOpenKey  (0x20019, {24, 48, 0x40, 0, 0,  (0x20019, {24, 48, 0x40, 0, 0, "Software\Microsoft\Windows NT\CurrentVersion\ProfileList"}, ... 128, ) }, ... 128, ) == 0x0
 00862   436   NtQueryValueKey  (128,  (128, "ProfilesDirectory", Partial, 144, ... TitleIdx=0, Type=2, Data="%\0S\0y\0s\0t\0e\0m\0D\0r\0i\0v\0e\0%\0\\0D\0o\0c\0u\0m\0e\0n\0t\0s\0 \0a\0n\0d\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\0\0"}, 86, ) , Partial, 144, ... TitleIdx=0, Type=2, Data= (128, "ProfilesDirectory", Partial, 144, ... TitleIdx=0, Type=2, Data="%\0S\0y\0s\0t\0e\0m\0D\0r\0i\0v\0e\0%\0\\0D\0o\0c\0u\0m\0e\0n\0t\0s\0 \0a\0n\0d\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\0\0"}, 86, ) }, 86, ) == 0x0
 00863   436   NtClose  (128, ... ) == 0x0
 00864   436   NtOpenKey  (0x20019, {24, 48, 0x40, 0, 0,  (0x20019, {24, 48, 0x40, 0, 0, "Software\Microsoft\Windows NT\CurrentVersion\ProfileList"}, ... 128, ) }, ... 128, ) == 0x0
 00865   436   NtQueryValueKey  (128,  (128, "AllUsersProfile", Partial, 144, ... TitleIdx=0, Type=1, Data="A\0l\0l\0 \0U\0s\0e\0r\0s\0\0\0"}, 32, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (128, "AllUsersProfile", Partial, 144, ... TitleIdx=0, Type=1, Data="A\0l\0l\0 \0U\0s\0e\0r\0s\0\0\0"}, 32, ) }, 32, ) == 0x0
 00866   436   NtClose  (128, ... ) == 0x0
 00867   436   NtClose  (124, ... ) == 0x0
 00868   436   NtUnmapViewOfSection  (-1, 0x75a70000, ... ) == 0x0
 00869   436   NtOpenFile  (0x10080, {24, 0, 0x40, 0, 0,  (0x10080, {24, 0, 0x40, 0, 0, "\??\C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Task Manager.exe"}, 7, 2113600, ... ) }, 7, 2113600, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00870   436   NtOpenFile  (0x110080, {24, 0, 0x40, 0, 0,  (0x110080, {24, 0, 0x40, 0, 0, "\??\C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Task Manager.exe"}, 7, 2113568, ... ) }, 7, 2113568, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00871   436   NtCreateKey  (0xc0000000, {24, 0, 0xc0, 0, 0,  (0xc0000000, {24, 0, 0xc0, 0, 0, "\Registry\Machine\System\CurrentControlSet\Control\Session Manager"}, 0, 0x0, 0, ... 124, 0x0, ) }, 0, 0x0, 0, ... 124, 0x0, ) == 0x0
 00872   436   NtQueryValueKey  (124,  (124, "PendingFileRenameOperations2", Partial, 1024, ... ) , Partial, 1024, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00873   436   NtClose  (124, ... ) == 0x0
 00874   436   NtCreateKey  (0xc0000000, {24, 0, 0xc0, 0, 0,  (0xc0000000, {24, 0, 0xc0, 0, 0, "\Registry\Machine\System\CurrentControlSet\Control\Session Manager"}, 0, 0x0, 0, ... 124, 0x0, ) }, 0, 0x0, 0, ... 124, 0x0, ) == 0x0
 00875   436   NtQueryValueKey  (124,  (124, "PendingFileRenameOperations", Partial, 1024, ... TitleIdx=0, Type=7, Data="\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0c\0v\0r\0s\0s\0.\0e\0x\0e\0\0\0\0\0\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0a\0c\0r\0m\0o\0n\03\02\0.\0e\0x\0e\0\0\0\0\0\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0a\0c\0r\0o\0u\0p\0.\0e\0x\0e\0\0\0\0\0\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0a\0c\0r\0o\0u\0p\03\02\0.\0e\0x\0e\0\0\0\0\0\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0r\0a\0s\0m\0a\0n\03\02\0.\0e\0x\0e\0\0\0\0\0\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0w\0c\0e\0s\0c\0o\0m\03\02\0.\0e\0x\0e\0\0\0\0\0\0\0"}, 462, ) , Partial, 1024, ... TitleIdx=0, Type=7, Data= (124, "PendingFileRenameOperations", Partial, 1024, ... TitleIdx=0, Type=7, Data="\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0c\0v\0r\0s\0s\0.\0e\0x\0e\0\0\0\0\0\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0a\0c\0r\0m\0o\0n\03\02\0.\0e\0x\0e\0\0\0\0\0\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0a\0c\0r\0o\0u\0p\0.\0e\0x\0e\0\0\0\0\0\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0a\0c\0r\0o\0u\0p\03\02\0.\0e\0x\0e\0\0\0\0\0\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0r\0a\0s\0m\0a\0n\03\02\0.\0e\0x\0e\0\0\0\0\0\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0w\0c\0e\0s\0c\0o\0m\03\02\0.\0e\0x\0e\0\0\0\0\0\0\0"}, 462, ) }, 462, ) == 0x0
 00876   436   NtSetValueKey  (124,  (124, "PendingFileRenameOperations", 0, 7, "\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0c\0v\0r\0s\0s\0.\0e\0x\0e\0\0\0\0\0\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0a\0c\0r\0m\0o\0n\03\02\0.\0e\0x\0e\0\0\0\0\0\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0a\0c\0r\0o\0u\0p\0.\0e\0x\0e\0\0\0\0\0\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0a\0c\0r\0o\0u\0p\03\02\0.\0e\0x\0e\0\0\0\0\0\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0r\0a\0s\0m\0a\0n\03\02\0.\0e\0x\0e\0\0\0\0\0\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0w\0c\0e\0s\0c\0o\0m\03\02\0.\0e\0x\0e\0\0\0\0\0\\0?\0?\0\\0C\0:\0\\0D\0o\0c\0u\0m\0e\0n\0t\0s\0 \0a\0n\0d\0 \0S\0e\0t\0t\0i\0", 622, ... ) , 0, 7,  (124, "PendingFileRenameOperations", 0, 7, "\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0c\0v\0r\0s\0s\0.\0e\0x\0e\0\0\0\0\0\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0a\0c\0r\0m\0o\0n\03\02\0.\0e\0x\0e\0\0\0\0\0\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0a\0c\0r\0o\0u\0p\0.\0e\0x\0e\0\0\0\0\0\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0a\0c\0r\0o\0u\0p\03\02\0.\0e\0x\0e\0\0\0\0\0\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0r\0a\0s\0m\0a\0n\03\02\0.\0e\0x\0e\0\0\0\0\0\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0w\0c\0e\0s\0c\0o\0m\03\02\0.\0e\0x\0e\0\0\0\0\0\\0?\0?\0\\0C\0:\0\\0D\0o\0c\0u\0m\0e\0n\0t\0s\0 \0a\0n\0d\0 \0S\0e\0t\0t\0i\0", 622, ... ) , 622, ... ) == 0x0
 00877   436   NtClose  (124, ... ) == 0x0
 00878   436   NtOpenFile  (0x10080, {24, 0, 0x40, 0, 0,  (0x10080, {24, 0, 0x40, 0, 0, "\??\C:\Documents and Settings\All Users\Start Menu\Programs\Startup\taskman.exe"}, 7, 2113600, ... ) }, 7, 2113600, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00879   436   NtOpenFile  (0x110080, {24, 0, 0x40, 0, 0,  (0x110080, {24, 0, 0x40, 0, 0, "\??\C:\Documents and Settings\All Users\Start Menu\Programs\Startup\taskman.exe"}, 7, 2113568, ... ) }, 7, 2113568, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00880   436   NtCreateKey  (0xc0000000, {24, 0, 0xc0, 0, 0,  (0xc0000000, {24, 0, 0xc0, 0, 0, "\Registry\Machine\System\CurrentControlSet\Control\Session Manager"}, 0, 0x0, 0, ... 124, 0x0, ) }, 0, 0x0, 0, ... 124, 0x0, ) == 0x0
 00881   436   NtQueryValueKey  (124,  (124, "PendingFileRenameOperations2", Partial, 1024, ... ) , Partial, 1024, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00882   436   NtClose  (124, ... ) == 0x0
 00883   436   NtCreateKey  (0xc0000000, {24, 0, 0xc0, 0, 0,  (0xc0000000, {24, 0, 0xc0, 0, 0, "\Registry\Machine\System\CurrentControlSet\Control\Session Manager"}, 0, 0x0, 0, ... 124, 0x0, ) }, 0, 0x0, 0, ... 124, 0x0, ) == 0x0
 00884   436   NtQueryValueKey  (124,  (124, "PendingFileRenameOperations", Partial, 1024, ... TitleIdx=0, Type=7, Data="\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0c\0v\0r\0s\0s\0.\0e\0x\0e\0\0\0\0\0\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0a\0c\0r\0m\0o\0n\03\02\0.\0e\0x\0e\0\0\0\0\0\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0a\0c\0r\0o\0u\0p\0.\0e\0x\0e\0\0\0\0\0\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0a\0c\0r\0o\0u\0p\03\02\0.\0e\0x\0e\0\0\0\0\0\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0r\0a\0s\0m\0a\0n\03\02\0.\0e\0x\0e\0\0\0\0\0\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0w\0c\0e\0s\0c\0o\0m\03\02\0.\0e\0x\0e\0\0\0\0\0\\0?\0?\0\\0C\0:\0\\0D\0o\0c\0u\0m\0e\0n\0t\0s\0 \0a\0n\0d\0\0\0\0\0z\2\0\0u\3\0\0\250\1\0\0\264\1\0\0\263\0\0\0\0\0\1\0\0\0\0\0T\2\0\0|\0\0\0\0\0\0\06\08\0\210\13\355w\0\0\0\0P\0e\0n\0d\0i\0n\0g\0F\0i\0l\0e\0R\0e\0n\0a\0m\0e\0O\0p\0e\0r\0a\0t\0i\0o\0n\0s\0v\0\0\0\0\0\7\0\0\0\0\0\0\0\364\1\0\0\\0?\0?\0"}, 634, ) , Partial, 1024, ... TitleIdx=0, Type=7, Data= (124, "PendingFileRenameOperations", Partial, 1024, ... TitleIdx=0, Type=7, Data="\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0c\0v\0r\0s\0s\0.\0e\0x\0e\0\0\0\0\0\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0a\0c\0r\0m\0o\0n\03\02\0.\0e\0x\0e\0\0\0\0\0\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0a\0c\0r\0o\0u\0p\0.\0e\0x\0e\0\0\0\0\0\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0a\0c\0r\0o\0u\0p\03\02\0.\0e\0x\0e\0\0\0\0\0\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0r\0a\0s\0m\0a\0n\03\02\0.\0e\0x\0e\0\0\0\0\0\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0w\0c\0e\0s\0c\0o\0m\03\02\0.\0e\0x\0e\0\0\0\0\0\\0?\0?\0\\0C\0:\0\\0D\0o\0c\0u\0m\0e\0n\0t\0s\0 \0a\0n\0d\0\0\0\0\0z\2\0\0u\3\0\0\250\1\0\0\264\1\0\0\263\0\0\0\0\0\1\0\0\0\0\0T\2\0\0|\0\0\0\0\0\0\06\08\0\210\13\355w\0\0\0\0P\0e\0n\0d\0i\0n\0g\0F\0i\0l\0e\0R\0e\0n\0a\0m\0e\0O\0p\0e\0r\0a\0t\0i\0o\0n\0s\0v\0\0\0\0\0\7\0\0\0\0\0\0\0\364\1\0\0\\0?\0?\0"}, 634, ) }, 634, ) == 0x0
 00885   436   NtSetValueKey  (124,  (124, "PendingFileRenameOperations", 0, 7, "\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0c\0v\0r\0s\0s\0.\0e\0x\0e\0\0\0\0\0\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0a\0c\0r\0m\0o\0n\03\02\0.\0e\0x\0e\0\0\0\0\0\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0a\0c\0r\0o\0u\0p\0.\0e\0x\0e\0\0\0\0\0\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0a\0c\0r\0o\0u\0p\03\02\0.\0e\0x\0e\0\0\0\0\0\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0r\0a\0s\0m\0a\0n\03\02\0.\0e\0x\0e\0\0\0\0\0\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0w\0c\0e\0s\0c\0o\0m\03\02\0.\0e\0x\0e\0\0\0\0\0\\0?\0?\0\\0C\0:\0\\0D\0o\0c\0u\0m\0e\0n\0t\0s\0 \0a\0n\0d\0 \0S\0e\0t\0t\0i\0", 784, ... ) , 0, 7,  (124, "PendingFileRenameOperations", 0, 7, "\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0c\0v\0r\0s\0s\0.\0e\0x\0e\0\0\0\0\0\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0a\0c\0r\0m\0o\0n\03\02\0.\0e\0x\0e\0\0\0\0\0\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0a\0c\0r\0o\0u\0p\0.\0e\0x\0e\0\0\0\0\0\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0a\0c\0r\0o\0u\0p\03\02\0.\0e\0x\0e\0\0\0\0\0\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0r\0a\0s\0m\0a\0n\03\02\0.\0e\0x\0e\0\0\0\0\0\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0w\0c\0e\0s\0c\0o\0m\03\02\0.\0e\0x\0e\0\0\0\0\0\\0?\0?\0\\0C\0:\0\\0D\0o\0c\0u\0m\0e\0n\0t\0s\0 \0a\0n\0d\0 \0S\0e\0t\0t\0i\0", 784, ... ) , 784, ... ) == 0x0
 00886   436   NtClose  (124, ... ) == 0x0
 00887   436   NtOpenFile  (0x10080, {24, 0, 0x40, 0, 0,  (0x10080, {24, 0, 0x40, 0, 0, "\??\C:\Documents and Settings\All Users\Start Menu\Programs\Startup\mmedia.exe"}, 7, 2113600, ... ) }, 7, 2113600, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00888   436   NtOpenFile  (0x110080, {24, 0, 0x40, 0, 0,  (0x110080, {24, 0, 0x40, 0, 0, "\??\C:\Documents and Settings\All Users\Start Menu\Programs\Startup\mmedia.exe"}, 7, 2113568, ... ) }, 7, 2113568, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00889   436   NtCreateKey  (0xc0000000, {24, 0, 0xc0, 0, 0,  (0xc0000000, {24, 0, 0xc0, 0, 0, "\Registry\Machine\System\CurrentControlSet\Control\Session Manager"}, 0, 0x0, 0, ... 124, 0x0, ) }, 0, 0x0, 0, ... 124, 0x0, ) == 0x0
 00890   436   NtQueryValueKey  (124,  (124, "PendingFileRenameOperations2", Partial, 1024, ... ) , Partial, 1024, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00891   436   NtClose  (124, ... ) == 0x0
 00892   436   NtCreateKey  (0xc0000000, {24, 0, 0xc0, 0, 0,  (0xc0000000, {24, 0, 0xc0, 0, 0, "\Registry\Machine\System\CurrentControlSet\Control\Session Manager"}, 0, 0x0, 0, ... 124, 0x0, ) }, 0, 0x0, 0, ... 124, 0x0, ) == 0x0
 00893   436   NtQueryValueKey  (124,  (124, "PendingFileRenameOperations", Partial, 1024, ... TitleIdx=0, Type=7, Data="\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0c\0v\0r\0s\0s\0.\0e\0x\0e\0\0\0\0\0\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0a\0c\0r\0m\0o\0n\03\02\0.\0e\0x\0e\0\0\0\0\0\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0a\0c\0r\0o\0u\0p\0.\0e\0x\0e\0\0\0\0\0\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0a\0c\0r\0o\0u\0p\03\02\0.\0e\0x\0e\0\0\0\0\0\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0r\0a\0s\0m\0a\0n\03\02\0.\0e\0x\0e\0\0\0\0\0\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0w\0c\0e\0s\0c\0o\0m\03\02\0.\0e\0x\0e\0\0\0\0\0\\0?\0?\0\\0C\0:\0\\0D\0o\0c\0u\0m\0e\0n\0t\0s\0 \0a\0n\0d\0\0\0\0\0\34\3\0\0~\3\0\0\250\1\0\0\264\1\0\0\263\0\0\0\0\0\1\0\0\0\0\0T\2\0\0|\0\0\0\0\0\0\06\08\0\210\13\355w\0\0\0\0P\0e\0n\0d\0i\0n\0g\0F\0i\0l\0e\0R\0e\0n\0a\0m\0e\0O\0p\0e\0r\0a\0t\0i\0o\0n\0s\0v\0\0\0\0\0\7\0\0\0\0\0\0\0\364\1\0\0\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0c\0v\0r\0s\0s\0.\0e\0x\0e\0\0\0\0\0\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0a\0c\0r\0m\0o\0n\03\02\0.\0e\0x\0e\0\0\0\0\0\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0"}, 796, ) , Partial, 1024, ... TitleIdx=0, Type=7, Data= (124, "PendingFileRenameOperations", Partial, 1024, ... TitleIdx=0, Type=7, Data="\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0c\0v\0r\0s\0s\0.\0e\0x\0e\0\0\0\0\0\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0a\0c\0r\0m\0o\0n\03\02\0.\0e\0x\0e\0\0\0\0\0\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0a\0c\0r\0o\0u\0p\0.\0e\0x\0e\0\0\0\0\0\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0a\0c\0r\0o\0u\0p\03\02\0.\0e\0x\0e\0\0\0\0\0\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0r\0a\0s\0m\0a\0n\03\02\0.\0e\0x\0e\0\0\0\0\0\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0w\0c\0e\0s\0c\0o\0m\03\02\0.\0e\0x\0e\0\0\0\0\0\\0?\0?\0\\0C\0:\0\\0D\0o\0c\0u\0m\0e\0n\0t\0s\0 \0a\0n\0d\0\0\0\0\0\34\3\0\0~\3\0\0\250\1\0\0\264\1\0\0\263\0\0\0\0\0\1\0\0\0\0\0T\2\0\0|\0\0\0\0\0\0\06\08\0\210\13\355w\0\0\0\0P\0e\0n\0d\0i\0n\0g\0F\0i\0l\0e\0R\0e\0n\0a\0m\0e\0O\0p\0e\0r\0a\0t\0i\0o\0n\0s\0v\0\0\0\0\0\7\0\0\0\0\0\0\0\364\1\0\0\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0c\0v\0r\0s\0s\0.\0e\0x\0e\0\0\0\0\0\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0a\0c\0r\0m\0o\0n\03\02\0.\0e\0x\0e\0\0\0\0\0\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0"}, 796, ) }, 796, ) == 0x0
 00894   436   NtSetValueKey  (124,  (124, "PendingFileRenameOperations", 0, 7, "\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0c\0v\0r\0s\0s\0.\0e\0x\0e\0\0\0\0\0\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0a\0c\0r\0m\0o\0n\03\02\0.\0e\0x\0e\0\0\0\0\0\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0a\0c\0r\0o\0u\0p\0.\0e\0x\0e\0\0\0\0\0\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0a\0c\0r\0o\0u\0p\03\02\0.\0e\0x\0e\0\0\0\0\0\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0r\0a\0s\0m\0a\0n\03\02\0.\0e\0x\0e\0\0\0\0\0\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0w\0c\0e\0s\0c\0o\0m\03\02\0.\0e\0x\0e\0\0\0\0\0\\0?\0?\0\\0C\0:\0\\0D\0o\0c\0u\0m\0e\0n\0t\0s\0 \0a\0n\0d\0 \0S\0e\0t\0t\0i\0", 944, ... ) , 0, 7,  (124, "PendingFileRenameOperations", 0, 7, "\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0c\0v\0r\0s\0s\0.\0e\0x\0e\0\0\0\0\0\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0a\0c\0r\0m\0o\0n\03\02\0.\0e\0x\0e\0\0\0\0\0\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0a\0c\0r\0o\0u\0p\0.\0e\0x\0e\0\0\0\0\0\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0a\0c\0r\0o\0u\0p\03\02\0.\0e\0x\0e\0\0\0\0\0\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0r\0a\0s\0m\0a\0n\03\02\0.\0e\0x\0e\0\0\0\0\0\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0w\0c\0e\0s\0c\0o\0m\03\02\0.\0e\0x\0e\0\0\0\0\0\\0?\0?\0\\0C\0:\0\\0D\0o\0c\0u\0m\0e\0n\0t\0s\0 \0a\0n\0d\0 \0S\0e\0t\0t\0i\0", 944, ... ) , 944, ... ) == 0x0
 00895   436   NtClose  (124, ... ) == 0x0
 00896   436   NtOpenFile  (0x10080, {24, 0, 0x40, 0, 0,  (0x10080, {24, 0, 0x40, 0, 0, "\??\C:\Documents and Settings\All Users\Start Menu\Programs\Startup\winamp.exe"}, 7, 2113600, ... ) }, 7, 2113600, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00897   436   NtOpenFile  (0x110080, {24, 0, 0x40, 0, 0,  (0x110080, {24, 0, 0x40, 0, 0, "\??\C:\Documents and Settings\All Users\Start Menu\Programs\Startup\winamp.exe"}, 7, 2113568, ... ) }, 7, 2113568, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00898   436   NtCreateKey  (0xc0000000, {24, 0, 0xc0, 0, 0,  (0xc0000000, {24, 0, 0xc0, 0, 0, "\Registry\Machine\System\CurrentControlSet\Control\Session Manager"}, 0, 0x0, 0, ... 124, 0x0, ) }, 0, 0x0, 0, ... 124, 0x0, ) == 0x0
 00899   436   NtQueryValueKey  (124,  (124, "PendingFileRenameOperations2", Partial, 1024, ... ) , Partial, 1024, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00900   436   NtClose  (124, ... ) == 0x0
 00901   436   NtCreateKey  (0xc0000000, {24, 0, 0xc0, 0, 0,  (0xc0000000, {24, 0, 0xc0, 0, 0, "\Registry\Machine\System\CurrentControlSet\Control\Session Manager"}, 0, 0x0, 0, ... 124, 0x0, ) }, 0, 0x0, 0, ... 124, 0x0, ) == 0x0
 00902   436   NtQueryValueKey  (124,  (124, "PendingFileRenameOperations", Partial, 1024, ... TitleIdx=0, Type=7, Data="\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0c\0v\0r\0s\0s\0.\0e\0x\0e\0\0\0\0\0\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0a\0c\0r\0m\0o\0n\03\02\0.\0e\0x\0e\0\0\0\0\0\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0a\0c\0r\0o\0u\0p\0.\0e\0x\0e\0\0\0\0\0\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0a\0c\0r\0o\0u\0p\03\02\0.\0e\0x\0e\0\0\0\0\0\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0r\0a\0s\0m\0a\0n\03\02\0.\0e\0x\0e\0\0\0\0\0\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0w\0c\0e\0s\0c\0o\0m\03\02\0.\0e\0x\0e\0\0\0\0\0\\0?\0?\0\\0C\0:\0\\0D\0o\0c\0u\0m\0e\0n\0t\0s\0 \0a\0n\0d\0\0\0\0\0\274\3\0\0\207\3\0\0\250\1\0\0\264\1\0\0\263\0\0\0\0\0\1\0\0\0\0\0T\2\0\0|\0\0\0\0\0\0\06\08\0\210\13\355w\0\0\0\0P\0e\0n\0d\0i\0n\0g\0F\0i\0l\0e\0R\0e\0n\0a\0m\0e\0O\0p\0e\0r\0a\0t\0i\0o\0n\0s\0v\0\0\0\0\0\7\0\0\0\0\0\0\0\364\1\0\0\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0c\0v\0r\0s\0s\0.\0e\0x\0e\0\0\0\0\0\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0a\0c\0r\0m\0o\0n\03\02\0.\0e\0x\0e\0\0\0\0\0\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0a\0c\0r\0o\0u\0p\0.\0e\0x\0e\0\0\0\0\0\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0a\0c\0r\0o\0u\0p\03\02\0.\0e\0x\0e\0\0\0\0\0\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0"}, 956, ) , Partial, 1024, ... TitleIdx=0, Type=7, Data= (124, "PendingFileRenameOperations", Partial, 1024, ... TitleIdx=0, Type=7, Data="\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0c\0v\0r\0s\0s\0.\0e\0x\0e\0\0\0\0\0\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0a\0c\0r\0m\0o\0n\03\02\0.\0e\0x\0e\0\0\0\0\0\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0a\0c\0r\0o\0u\0p\0.\0e\0x\0e\0\0\0\0\0\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0a\0c\0r\0o\0u\0p\03\02\0.\0e\0x\0e\0\0\0\0\0\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0r\0a\0s\0m\0a\0n\03\02\0.\0e\0x\0e\0\0\0\0\0\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0w\0c\0e\0s\0c\0o\0m\03\02\0.\0e\0x\0e\0\0\0\0\0\\0?\0?\0\\0C\0:\0\\0D\0o\0c\0u\0m\0e\0n\0t\0s\0 \0a\0n\0d\0\0\0\0\0\274\3\0\0\207\3\0\0\250\1\0\0\264\1\0\0\263\0\0\0\0\0\1\0\0\0\0\0T\2\0\0|\0\0\0\0\0\0\06\08\0\210\13\355w\0\0\0\0P\0e\0n\0d\0i\0n\0g\0F\0i\0l\0e\0R\0e\0n\0a\0m\0e\0O\0p\0e\0r\0a\0t\0i\0o\0n\0s\0v\0\0\0\0\0\7\0\0\0\0\0\0\0\364\1\0\0\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0c\0v\0r\0s\0s\0.\0e\0x\0e\0\0\0\0\0\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0a\0c\0r\0m\0o\0n\03\02\0.\0e\0x\0e\0\0\0\0\0\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0a\0c\0r\0o\0u\0p\0.\0e\0x\0e\0\0\0\0\0\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0a\0c\0r\0o\0u\0p\03\02\0.\0e\0x\0e\0\0\0\0\0\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0"}, 956, ) }, 956, ) == 0x0
 00903   436   NtSetValueKey  (124,  (124, "PendingFileRenameOperations", 0, 7, "\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0c\0v\0r\0s\0s\0.\0e\0x\0e\0\0\0\0\0\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0a\0c\0r\0m\0o\0n\03\02\0.\0e\0x\0e\0\0\0\0\0\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0a\0c\0r\0o\0u\0p\0.\0e\0x\0e\0\0\0\0\0\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0a\0c\0r\0o\0u\0p\03\02\0.\0e\0x\0e\0\0\0\0\0\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0r\0a\0s\0m\0a\0n\03\02\0.\0e\0x\0e\0\0\0\0\0\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0w\0c\0e\0s\0c\0o\0m\03\02\0.\0e\0x\0e\0\0\0\0\0\\0?\0?\0\\0C\0:\0\\0D\0o\0c\0u\0m\0e\0n\0t\0s\0 \0a\0n\0d\0 \0S\0e\0t\0t\0i\0", 1104, ... ) , 0, 7,  (124, "PendingFileRenameOperations", 0, 7, "\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0c\0v\0r\0s\0s\0.\0e\0x\0e\0\0\0\0\0\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0a\0c\0r\0m\0o\0n\03\02\0.\0e\0x\0e\0\0\0\0\0\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0a\0c\0r\0o\0u\0p\0.\0e\0x\0e\0\0\0\0\0\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0a\0c\0r\0o\0u\0p\03\02\0.\0e\0x\0e\0\0\0\0\0\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0r\0a\0s\0m\0a\0n\03\02\0.\0e\0x\0e\0\0\0\0\0\\0?\0?\0\\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0w\0c\0e\0s\0c\0o\0m\03\02\0.\0e\0x\0e\0\0\0\0\0\\0?\0?\0\\0C\0:\0\\0D\0o\0c\0u\0m\0e\0n\0t\0s\0 \0a\0n\0d\0 \0S\0e\0t\0t\0i\0", 1104, ... ) , 1104, ... ) == 0x0
 00904   436   NtClose  (124, ... ) == 0x0
 00905   436   NtCreateKey  (0x2000000, {24, 48, 0x40, 0, 0,  (0x2000000, {24, 48, 0x40, 0, 0, "Software\Microsoft\Windows\CurrentVersion\Run"}, 0, 0x0, 0, ... 124, 2, ) }, 0, 0x0, 0, ... 124, 2, ) == 0x0
 00906   436   NtDeleteValueKey  (124,  (124, "ATI", ... ) , ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00907   436   NtDeleteValueKey  (124,  (124, "Acrobat", ... ) , ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00908   436   NtDeleteValueKey  (124,  (124, "Acrobat Update", ... ) , ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00909   436   NtDeleteValueKey  (124,  (124, "Acrobat Read", ... ) , ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00910   436   NtDeleteValueKey  (124,  (124, "rasman", ... ) , ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00911   436   NtDeleteValueKey  (124,  (124, "ActiveSync", ... ) , ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00912   436   NtClose  (124, ... ) == 0x0
 00913   436   NtUserRegisterClassExWOW  (1244088, 1244164, 1244180, 1244152, 0, 386, 0, ... ) == 0x810dc0cb
 00914   436   NtUserCreateWindowEx  (-2147483648, 1244072, 1243884, "-2147483648, 0, 0, 1, 1, 0, 0, 0, 0, 1073742848, 0, ...
 00915   436   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\uxtheme.dll"}, 1240268, ... ) }, 1240268, ... ) == 0x0
 00916   436   NtOpenFile  (0x100020, {24, 0, 0x40, 0, 0,  (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\uxtheme.dll"}, 5, 96, ... 124, {status=0x0, info=1}, ) }, 5, 96, ... 124, {status=0x0, info=1}, ) == 0x0
 00917   436   NtCreateSection  (0xe, 0x0, 0x0, 16, 134217728, 124, ... 128, ) == 0x0
 00918   436   NtClose  (124, ... ) == 0x0
 00919   436   NtMapViewOfSection  (128, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 16, ... (0x380000), 0x0, 204800, ) == 0x0
 00920   436   NtClose  (128, ... ) == 0x0
 00921   436   NtUnmapViewOfSection  (-1, 0x380000, ... ) == 0x0
 00922   436   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\uxtheme.dll"}, 1240584, ... ) }, 1240584, ... ) == 0x0
 00923   436   NtOpenFile  (0x100020, {24, 0, 0x40, 0, 0,  (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\uxtheme.dll"}, 5, 96, ... 128, {status=0x0, info=1}, ) }, 5, 96, ... 128, {status=0x0, info=1}, ) == 0x0
 00924   436   NtCreateSection  (0xf, 0x0, 0x0, 16, 16777216, 128, ... 124, ) == 0x0
 00925   436   NtQuerySection  (124, Image, 48, ... {section info, class 1, size 48}, 0x0, ) == 0x0
 00926   436   NtClose  (128, ... ) == 0x0
 00927   436   NtMapViewOfSection  (124, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x5ad70000), 0x0, 212992, ) == 0x0
 00928   436   NtClose  (124, ... ) == 0x0
 00929   436   NtUserGetWindowDC  (0, ... ) == 0x1010052
 00930   436   NtUserCallOneParam  (16842834, 56, ... ) == 0x1
 00931   436   NtOpenThreadTokenEx  (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN
 00932   436   NtOpenProcessTokenEx  (-1, 0x20008, 512, ... 124, ) == 0x0
 00933   436   NtQueryInformationToken  (124, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0
 00934   436   NtClose  (124, ... ) == 0x0
 00935   436   NtOpenKey  (0x2001f, {24, 0, 0x640, 0, 0,  (0x2001f, {24, 0, 0x640, 0, 0, "\REGISTRY\USER\S-1-5-21-1078081533-484763869-839522115-1003"}, ... 124, ) }, ... 124, ) == 0x0
 00936   436   NtOpenKey  (0x1, {24, 124, 0x40, 0, 0,  (0x1, {24, 124, 0x40, 0, 0, "Software\Microsoft\Windows\CurrentVersion\ThemeManager"}, ... 128, ) }, ... 128, ) == 0x0
 00937   436   NtQueryValueKey  (128,  (128, "Compositing", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00938   436   NtClose  (128, ... ) == 0x0
 00939   436   NtClose  (124, ... ) == 0x0
 00940   436   NtOpenThreadTokenEx  (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN
 00941   436   NtOpenProcessTokenEx  (-1, 0x20008, 512, ... 124, ) == 0x0
 00942   436   NtQueryInformationToken  (124, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0
 00943   436   NtClose  (124, ... ) == 0x0
 00944   436   NtOpenKey  (0x20019, {24, 0, 0x640, 0, 0,  (0x20019, {24, 0, 0x640, 0, 0, "\REGISTRY\USER\S-1-5-21-1078081533-484763869-839522115-1003"}, ... 124, ) }, ... 124, ) == 0x0
 00945   436   NtOpenKey  (0x1, {24, 124, 0x40, 0, 0,  (0x1, {24, 124, 0x40, 0, 0, "Control Panel\Desktop"}, ... 128, ) }, ... 128, ) == 0x0
 00946   436   NtQueryValueKey  (128,  (128, "LameButtonText", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00947   436   NtClose  (128, ... ) == 0x0
 00948   436   NtClose  (124, ... ) == 0x0
 00949   436   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\u:\work\UxTheme.dll"}, 1240084, ... ) }, 1240084, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00950   436   NtQueryAttributesFile  ({24, 12, 0x40, 0, 0,  ({24, 12, 0x40, 0, 0, "UxTheme.dll"}, 1240084, ... ) }, 1240084, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00951   436   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\System32\UxTheme.dll"}, 1240084, ... ) }, 1240084, ... ) == 0x0
 00952   436   NtUserGetProcessWindowStation  (... ) == 0x24
 00953   436   NtUserGetObjectInformation  (36, 2, 0, 0, 1242380, ... ) == 0x0
 00954   436   NtUserGetObjectInformation  (36, 2, 1370248, 16, 1242380, ... ) == 0x1
 00955   436   NtUserGetGUIThreadInfo  (436, 1242336, ... ) == 0x1
 00956   436   NtConnectPort  ( ("\ThemeApiPort", {12, 2, 1, 1}, 0x0, 0x0, 1242156, 64, ... 124, 0x0, 0x0, 0x0, 64, ) , {12, 2, 1, 1}, 0x0, 0x0, 1242156, 64, ... 124, 0x0, 0x0, 0x0, 64, ) == 0x0
 00957   436   NtRequestWaitReplyPort  (124, {32, 56, new_msg, 0, 0, 0, 0, 0}  (124, {32, 56, new_msg, 0, 0, 0, 0, 0} "\4\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0" ... {32, 56, reply, 0, 424, 436, 1499, 0} "\0\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0" )  ... {32, 56, reply, 0, 424, 436, 1499, 0}  (124, {32, 56, new_msg, 0, 0, 0, 0, 0} "\4\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0" ... {32, 56, reply, 0, 424, 436, 1499, 0} "\0\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0" )  ) == 0x0
 00958   436   NtRequestWaitReplyPort  (124, {32, 56, new_msg, 0, 0, 0, 0, 0}  (124, {32, 56, new_msg, 0, 0, 0, 0, 0} "\355\3\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0" ... {32, 56, reply, 0, 424, 436, 1500, 0} "\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0" )  ... {32, 56, reply, 0, 424, 436, 1500, 0}  (124, {32, 56, new_msg, 0, 0, 0, 0, 0} "\355\3\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0" ... {32, 56, reply, 0, 424, 436, 1500, 0} "\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0" )  ) == 0x0
 00959   436   NtUserCallNoParam  (29, ...
 00960   436   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\uxtheme.dll"}, 1239628, ... ) }, 1239628, ... ) == 0x0
 00959   436   NtUserCallNoParam  ... ) == 0x0
 00961   436   NtUserSystemParametersInfo  (41, 0, 1524225160, 0, ... ) == 0x1
 00962   436   NtGdiHfontCreate  (1241708, 356, 0, 0, 1344040, ... ) == 0x120a0418
 00963   436   NtGdiHfontCreate  (1241708, 356, 0, 0, 1344032, ... ) == 0x90a0409
 00964   436   NtRequestWaitReplyPort  (124, {32, 56, new_msg, 0, 0, 0, 0, 0}  (124, {32, 56, new_msg, 0, 0, 0, 0, 0} "\7\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0" ... {32, 56, reply, 0, 424, 436, 1501, 0} "\0\0\0\0\0\0\0\0\200\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0" )  ... {32, 56, reply, 0, 424, 436, 1501, 0}  (124, {32, 56, new_msg, 0, 0, 0, 0, 0} "\7\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0" ... {32, 56, reply, 0, 424, 436, 1501, 0} "\0\0\0\0\0\0\0\0\200\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0" )  ) == 0x0
 00965   436   NtMapViewOfSection  (128, -1, (0x0), 0, 0, {0, 0}, 0, 1, 0, 2, ... (0x380000), {0, 0}, 331776, ) == 0x0
 00966   436   NtAllocateVirtualMemory  (-1, 3293184, 0, 4096, 4096, 4, ... 3293184, 4096, ) == 0x0
 00967   436   NtUserGetWindowDC  (0, ... ) == 0x1010052
 00968   436   NtUserCallOneParam  (16842834, 56, ... ) == 0x1
 00969   436   NtUserGetWindowDC  (0, ... ) == 0x1010052
 00970   436   NtUserCallOneParam  (16842834, 56, ... ) == 0x1
 00971   436   NtUserGetWindowDC  (0, ... ) == 0x1010052
 00972   436   NtUserCallOneParam  (16842834, 56, ... ) == 0x1
 00973   436   NtUserGetWindowDC  (0, ... ) == 0x1010052
 00974   436   NtUserCallOneParam  (16842834, 56, ... ) == 0x1
 00975   436   NtUserGetWindowDC  (0, ... ) == 0x1010052
 00976   436   NtUserCallOneParam  (16842834, 56, ... ) == 0x1
 00977   436   NtUserGetWindowDC  (0, ... ) == 0x1010052
 00978   436   NtUserCallOneParam  (16842834, 56, ... ) == 0x1
 00979   436   NtUserGetWindowDC  (0, ... ) == 0x1010052
 00980   436   NtUserCallOneParam  (16842834, 56, ... ) == 0x1
 00981   436   NtUserGetWindowDC  (0, ... ) == 0x1010052
 00982   436   NtUserCallOneParam  (16842834, 56, ... ) == 0x1
 00983   436   NtUserGetWindowDC  (0, ... ) == 0x1010052
 00984   436   NtGdiCreatePatternBrushInternal  (59048369, 0, 0, ... ) == 0xc1003fd
 00985   436   NtUserCallOneParam  (16842834, 56, ... ) == 0x1
 00986   436   NtUserCallNoParam  (29, ...
 00987   436   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\uxtheme.dll"}, 1239072, ... ) }, 1239072, ... ) == 0x0
 00986   436   NtUserCallNoParam  ... ) == 0x0
 00988   436   NtUserCallNoParam  (29, ...
 00989   436   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\uxtheme.dll"}, 1239068, ... ) }, 1239068, ... ) == 0x0
 00988   436   NtUserCallNoParam  ... ) == 0x0
 00990   436   NtUserMessageCall  (0x200b2, WM_NCCREATE, 0x0, 0x12f618, 0, 670, 1, ... ) == 0x1
 00991   436   NtUserMessageCall  (0x200b2, WM_NCCALCSIZE, 0x0, 0x12f64c, 0, 670, 1, ... ) == 0x0
 00992   436   NtUserSetProp  (131250, 43288, -1, ... ) == 0x1
 00993   436   NtCreateFile  (0x80100080, {24, 0, 0x40, 0, 1240540,  (0x80100080, {24, 0, 0x40, 0, 1240540, "\??\u:\work\packed.exe"}, 0x0, 0, 1, 1, 2097252, 0, 0, ... 132, {status=0x0, info=1}, ) }, 0x0, 0, 1, 1, 2097252, 0, 0, ... 132, {status=0x0, info=1}, ) == 0x0
 00994   436   NtQueryInformationFile  (132, 1241476, 8, AttributeFlag, ... {status=0x0, info=8}, ) == 0x0
 00995   436   NtQueryInformationFile  (132, 1241448, 24, Standard, ... {status=0x0, info=24}, ) == 0x0
 00996   436   NtQueryInformationFile  (132, 1241400, 40, Basic, ... {status=0x0, info=40}, ) == 0x0
 00997   436   NtAllocateVirtualMemory  (-1, 1372160, 0, 8192, 4096, 4, ... 1372160, 8192, ) == 0x0
 00998   436   NtQueryInformationFile  (132, 1371280, 4094, Stream, ... {status=0x0, info=38}, ) == 0x0
 00999   436   NtQueryInformationFile  (132, 1239944, 40, Basic, ... {status=0x0, info=40}, ) == 0x0
 01000   436   NtQueryInformationFile  (132, 1239788, 4, Ea, ... {status=0x0, info=4}, ) == 0x0
 01001   436   NtCreateFile  (0x40110080, {24, 0, 0x40, 0, 1239796,  (0x40110080, {24, 0, 0x40, 0, 1239796, "\??\C:\WINDOWS\System32\qmedia.exe"}, 0x0, 32, 0, 2, 100, 0, 0, ... 136, {status=0x0, info=2}, ) }, 0x0, 32, 0, 2, 100, 0, 0, ... 136, {status=0x0, info=2}, ) == 0x0
 01002   436   NtQueryVolumeInformationFile  (136, 1239168, 536, Attribute, ... {status=0x0, info=22}, ) == 0x0
 01003   436   NtQueryInformationFile  (136, 1239128, 40, Basic, ... {status=0x0, info=40}, ) == 0x0
 01004   436   NtQueryVolumeInformationFile  (132, 1239168, 536, Attribute, ... {status=0x0, info=20}, ) == 0x0
 01005   436   NtSetInformationFile  (136, 1238956, 8, EndOfFile, ... {status=0x0, info=0}, ) == 0x0
 01006   436   NtCreateSection  (0xf001f, 0x0, 0x0, 2, 134217728, 132, ... 140, ) == 0x0
 01007   436   NtMapViewOfSection  (140, -1, (0x0), 0, 0, {0, 0}, 0, 1, 0, 2, ... (0x3e0000), {0, 0}, 49152, ) == 0x0
 01008   436   NtClose  (140, ... ) == 0x0
 01009   436   NtWriteFile  (136, 0, 0, 0,  (136, 0, 0, 0, "MZ\220\0\3\0\0\0\4\0\0\0\377\377\0\0\270\0\0\0\0\0\0\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\340\0\0\0\16\37\272\16\0\264\11\315!\270\1L\315!This program cannot be run in DOS mode.\15\15\12$\0\0\0\0\0\0\0\23\267z\336W\326\24\215W\326\24\215W\326\24\215D\336I\215U\326\24\215\324\336I\215U\326\24\215\255\365\15\215T\326\24\215W\326\25\215g\326\24\215R\332t\215\\326\24\215R\332N\215V\326\24\215RichW\326\24\215\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0PE\0\0L\1\4\0\204v$F\0\0\0\0\0\0\0\0\340\0\17\1\13\1\7\12\0R\0\0\0|\0\0\0\0\0\0@\24\0\0\0\20\0\0\0p\0\0\0\0@\0\0\20\0\0\0\2\0\0\4\0\0\0\0\0\0\0\4\0\0\0\0\0\0\0\0\0\1\0\0\4\0\0\0\0\0\0\2\0\0\4\0\0\20\0\0\20\0\0\0\0\20\0\0\20\0\0\0\0\0\0\20\0\0\0\0\0\0\0\0\0\0\0\340q\0\0P\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0p\0\0\314\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0CODE\0\0\0\0\301\4\0\0\0\20\0\0\0\6\0\0\0\4\0\0\0\0\0\0", 48640, 0x0, 0, ... {status=0x0, info=48640}, ) , 48640, 0x0, 0, ... {status=0x0, info=48640}, ) == 0x0
 01010   436   NtUnmapViewOfSection  (-1, 0x3e0000, ... ) == 0x0
 01011   436   NtSetInformationFile  (136, 1241400, 40, Basic, ... {status=0x0, info=0}, ) == 0x0
 01012   436   NtClose  (132, ... ) == 0x0
 01013   436   NtClose  (136, ... ) == 0x0
 01014   436   NtOpenSection  (0xe, {24, 8, 0x40, 0, 0,  (0xe, {24, 8, 0x40, 0, 0, "Userenv.dll"}, ... 136, ) }, ... 136, ) == 0x0
 01015   436   NtMapViewOfSection  (136, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x75a70000), 0x0, 667648, ) == 0x0
 01016   436   NtClose  (136, ... ) == 0x0
 01017   436   NtOpenKey  (0x2000000, {24, 48, 0x40, 0, 0,  (0x2000000, {24, 48, 0x40, 0, 0, "Software\Microsoft\Windows NT\CurrentVersion\winlogon"}, ... 136, ) }, ... 136, ) == 0x0
 01018   436   NtQueryValueKey  (136,  (136, "UserEnvDebugLevel", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01019   436   NtClose  (136, ... ) == 0x0
 01020   436   NtOpenKey  (0x2000000, {24, 48, 0x40, 0, 0,  (0x2000000, {24, 48, 0x40, 0, 0, "Software\Microsoft\Windows NT\CurrentVersion\winlogon"}, ... 136, ) }, ... 136, ) == 0x0
 01021   436   NtQueryValueKey  (136,  (136, "ChkAccDebugLevel", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01022   436   NtClose  (136, ... ) == 0x0
 01023   436   NtOpenKey  (0x20019, {24, 48, 0x40, 0, 0,  (0x20019, {24, 48, 0x40, 0, 0, "System\CurrentControlSet\Control\ProductOptions"}, ... 136, ) }, ... 136, ) == 0x0
 01024   436   NtQueryValueKey  (136,  (136, "ProductType", Partial, 144, ... TitleIdx=0, Type=1, Data="W\0i\0n\0N\0T\0\0\0"}, 24, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (136, "ProductType", Partial, 144, ... TitleIdx=0, Type=1, Data="W\0i\0n\0N\0T\0\0\0"}, 24, ) }, 24, ) == 0x0
 01025   436   NtClose  (136, ... ) == 0x0
 01026   436   NtCreateEvent  (0x1f0003, {24, 52, 0x80, 1238492, 0,  (0x1f0003, {24, 52, 0x80, 1238492, 0, "Global\userenv:  User Profile setup event"}, 0, 1, ... 136, ) }, 0, 1, ... 136, ) == STATUS_OBJECT_NAME_EXISTS
 01027   436   NtAllocateVirtualMemory  (-1, 1224704, 0, 4096, 4096, 260, ... 1224704, 4096, ) == 0x0
 01028   436   NtQueryDefaultLocale  (1, 1236328, ... ) == 0x0
 01029   436   NtQueryDefaultLocale  (1, 1236328, ... ) == 0x0
 01030   436   NtQueryDefaultLocale  (1, 1236328, ... ) == 0x0
 01031   436   NtQueryDefaultLocale  (1, 1236328, ... ) == 0x0
 01032   436   NtQueryDefaultLocale  (1, 1236328, ... ) == 0x0
 01033   436   NtQueryDefaultLocale  (1, 1236328, ... ) == 0x0
 01034   436   NtQueryDefaultLocale  (1, 1236328, ... ) == 0x0
 01035   436   NtQueryDefaultLocale  (1, 1236328, ... ) == 0x0
 01036   436   NtQueryDefaultLocale  (1, 1236328, ... ) == 0x0
 01037   436   NtQueryDefaultLocale  (1, 1236328, ... ) == 0x0
 01038   436   NtQueryDefaultLocale  (1, 1236328, ... ) == 0x0
 01039   436   NtQueryDefaultLocale  (1, 1236328, ... ) == 0x0
 01040   436   NtQueryDefaultLocale  (1, 1236328, ... ) == 0x0
 01041   436   NtQueryDefaultLocale  (1, 1236328, ... ) == 0x0
 01042   436   NtQueryDefaultLocale  (1, 1236328, ... ) == 0x0
 01043   436   NtQueryDefaultLocale  (1, 1236328, ... ) == 0x0
 01044   436   NtQueryDefaultLocale  (1, 1236328, ... ) == 0x0
 01045   436   NtQueryDefaultLocale  (1, 1236328, ... ) == 0x0
 01046   436   NtQueryDefaultLocale  (1, 1236328, ... ) == 0x0
 01047   436   NtQueryDefaultLocale  (1, 1236328, ... ) == 0x0
 01048   436   NtQueryDefaultLocale  (1, 1236328, ... ) == 0x0
 01049   436   NtQueryDefaultLocale  (1, 1236328, ... ) == 0x0
 01050   436   NtQueryDefaultLocale  (1, 1236328, ... ) == 0x0
 01051   436   NtQueryDefaultLocale  (1, 1236328, ... ) == 0x0
 01052   436   NtQueryDefaultLocale  (1, 1236328, ... ) == 0x0
 01053   436   NtQueryDefaultLocale  (1, 1236328, ... ) == 0x0
 01054   436   NtOpenThreadTokenEx  (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN
 01055   436   NtOpenProcessTokenEx  (-1, 0x20008, 512, ... 132, ) == 0x0
 01056   436   NtQueryInformationToken  (132, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0
 01057   436   NtClose  (132, ... ) == 0x0
 01058   436   NtOpenKey  (0x20019, {24, 0, 0x640, 0, 0,  (0x20019, {24, 0, 0x640, 0, 0, "\REGISTRY\USER\S-1-5-21-1078081533-484763869-839522115-1003"}, ... 132, ) }, ... 132, ) == 0x0
 01059   436   NtOpenKey  (0x20019, {24, 132, 0x40, 0, 0,  (0x20019, {24, 132, 0x40, 0, 0, "Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders"}, ... 140, ) }, ... 140, ) == 0x0
 01060   436   NtQueryValueKey  (140,  (140, "Personal", Partial, 144, ... TitleIdx=0, Type=2, Data="%\0U\0S\0E\0R\0P\0R\0O\0F\0I\0L\0E\0%\0\\0M\0y\0 \0D\0o\0c\0u\0m\0e\0n\0t\0s\0\0\0"}, 66, ) , Partial, 144, ... TitleIdx=0, Type=2, Data= (140, "Personal", Partial, 144, ... TitleIdx=0, Type=2, Data="%\0U\0S\0E\0R\0P\0R\0O\0F\0I\0L\0E\0%\0\\0M\0y\0 \0D\0o\0c\0u\0m\0e\0n\0t\0s\0\0\0"}, 66, ) }, 66, ) == 0x0
 01061   436   NtQueryDefaultLocale  (1, 1236328, ... ) == 0x0
 01062   436   NtQueryValueKey  (140,  (140, "Local Settings", Partial, 144, ... TitleIdx=0, Type=2, Data="%\0U\0S\0E\0R\0P\0R\0O\0F\0I\0L\0E\0%\0\\0L\0o\0c\0a\0l\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\0\0"}, 70, ) , Partial, 144, ... TitleIdx=0, Type=2, Data= (140, "Local Settings", Partial, 144, ... TitleIdx=0, Type=2, Data="%\0U\0S\0E\0R\0P\0R\0O\0F\0I\0L\0E\0%\0\\0L\0o\0c\0a\0l\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\0\0"}, 70, ) }, 70, ) == 0x0
 01063   436   NtQueryDefaultLocale  (1, 1236328, ... ) == 0x0
 01064   436   NtQueryDefaultLocale  (1, 1236328, ... ) == 0x0
 01065   436   NtQueryDefaultLocale  (1, 1236328, ... ) == 0x0
 01066   436   NtQueryDefaultLocale  (1, 1236328, ... ) == 0x0
 01067   436   NtClose  (140, ... ) == 0x0
 01068   436   NtClose  (132, ... ) == 0x0
 01069   436   NtOpenKey  (0x2000000, {24, 48, 0x40, 0, 0,  (0x2000000, {24, 48, 0x40, 0, 0, "Software\Microsoft\Windows NT\CurrentVersion\winlogon"}, ... 132, ) }, ... 132, ) == 0x0
 01070   436   NtQueryValueKey  (132,  (132, "RsopDebugLevel", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01071   436   NtClose  (132, ... ) == 0x0
 01072   436   NtOpenKey  (0x2000000, {24, 48, 0x40, 0, 0,  (0x2000000, {24, 48, 0x40, 0, 0, "Software\Microsoft\Windows NT\CurrentVersion\winlogon"}, ... 132, ) }, ... 132, ) == 0x0
 01073   436   NtQueryValueKey  (132,  (132, "UserEnvDebugLevel", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01074   436   NtQueryValueKey  (132,  (132, "RsopLogging", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01075   436   NtClose  (132, ... ) == 0x0
 01076   436   NtOpenKey  (0x2000000, {24, 48, 0x40, 0, 0,  (0x2000000, {24, 48, 0x40, 0, 0, "Software\Policies\Microsoft\Windows\System"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01077   436   NtOpenKey  (0x2000000, {24, 48, 0x40, 0, 0,  (0x2000000, {24, 48, 0x40, 0, 0, "Software\Microsoft\Windows NT\CurrentVersion\winlogon"}, ... 132, ) }, ... 132, ) == 0x0
 01078   436   NtQueryValueKey  (132,  (132, "UserEnvDebugLevel", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01079   436   NtClose  (132, ... ) == 0x0
 01080   436   NtOpenKey  (0x2000000, {24, 48, 0x40, 0, 0,  (0x2000000, {24, 48, 0x40, 0, 0, "Software\Policies\Microsoft\Windows\System"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01081   436   NtOpenKey  (0x20019, {24, 48, 0x40, 0, 0,  (0x20019, {24, 48, 0x40, 0, 0, "Software\Microsoft\Windows NT\CurrentVersion\ProfileList"}, ... 132, ) }, ... 132, ) == 0x0
 01082   436   NtQueryValueKey  (132,  (132, "ProfilesDirectory", Partial, 144, ... TitleIdx=0, Type=2, Data="%\0S\0y\0s\0t\0e\0m\0D\0r\0i\0v\0e\0%\0\\0D\0o\0c\0u\0m\0e\0n\0t\0s\0 \0a\0n\0d\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\0\0"}, 86, ) , Partial, 144, ... TitleIdx=0, Type=2, Data= (132, "ProfilesDirectory", Partial, 144, ... TitleIdx=0, Type=2, Data="%\0S\0y\0s\0t\0e\0m\0D\0r\0i\0v\0e\0%\0\\0D\0o\0c\0u\0m\0e\0n\0t\0s\0 \0a\0n\0d\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\0\0"}, 86, ) }, 86, ) == 0x0
 01083   436   NtClose  (132, ... ) == 0x0
 01084   436   NtOpenKey  (0x20019, {24, 48, 0x40, 0, 0,  (0x20019, {24, 48, 0x40, 0, 0, "Software\Microsoft\Windows NT\CurrentVersion\ProfileList"}, ... 132, ) }, ... 132, ) == 0x0
 01085   436   NtQueryValueKey  (132,  (132, "AllUsersProfile", Partial, 144, ... TitleIdx=0, Type=1, Data="A\0l\0l\0 \0U\0s\0e\0r\0s\0\0\0"}, 32, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (132, "AllUsersProfile", Partial, 144, ... TitleIdx=0, Type=1, Data="A\0l\0l\0 \0U\0s\0e\0r\0s\0\0\0"}, 32, ) }, 32, ) == 0x0
 01086   436   NtClose  (132, ... ) == 0x0
 01087   436   NtClose  (136, ... ) == 0x0
 01088   436   NtUnmapViewOfSection  (-1, 0x75a70000, ... ) == 0x0
 01089   436   NtCreateFile  (0x80100080, {24, 0, 0x40, 0, 1239732,  (0x80100080, {24, 0, 0x40, 0, 1239732, "\??\u:\work\packed.exe"}, 0x0, 0, 1, 1, 2097252, 0, 0, ... 136, {status=0x0, info=1}, ) }, 0x0, 0, 1, 1, 2097252, 0, 0, ... 136, {status=0x0, info=1}, ) == 0x0
 01090   436   NtQueryInformationFile  (136, 1240668, 8, AttributeFlag, ... {status=0x0, info=8}, ) == 0x0
 01091   436   NtQueryInformationFile  (136, 1240640, 24, Standard, ... {status=0x0, info=24}, ) == 0x0
 01092   436   NtQueryInformationFile  (136, 1240592, 40, Basic, ... {status=0x0, info=40}, ) == 0x0
 01093   436   NtQueryInformationFile  (136, 1371584, 4094, Stream, ... {status=0x0, info=38}, ) == 0x0
 01094   436   NtQueryInformationFile  (136, 1239136, 40, Basic, ... {status=0x0, info=40}, ) == 0x0
 01095   436   NtQueryInformationFile  (136, 1238980, 4, Ea, ... {status=0x0, info=4}, ) == 0x0
 01096   436   NtCreateFile  (0x40110080, {24, 0, 0x40, 0, 1238988,  (0x40110080, {24, 0, 0x40, 0, 1238988, "\??\C:\Documents and Settings\All Users\Start Menu\Programs\Startup\icq.exe"}, 0x0, 32, 0, 2, 100, 0, 0, ... 132, {status=0x0, info=2}, ) }, 0x0, 32, 0, 2, 100, 0, 0, ... 132, {status=0x0, info=2}, ) == 0x0
 01097   436   NtQueryVolumeInformationFile  (132, 1238360, 536, Attribute, ... {status=0x0, info=22}, ) == 0x0
 01098   436   NtQueryInformationFile  (132, 1238320, 40, Basic, ... {status=0x0, info=40}, ) == 0x0
 01099   436   NtQueryVolumeInformationFile  (136, 1238360, 536, Attribute, ... {status=0x0, info=20}, ) == 0x0
 01100   436   NtSetInformationFile  (132, 1238148, 8, EndOfFile, ... {status=0x0, info=0}, ) == 0x0
 01101   436   NtCreateSection  (0xf001f, 0x0, 0x0, 2, 134217728, 136, ... 140, ) == 0x0
 01102   436   NtMapViewOfSection  (140, -1, (0x0), 0, 0, {0, 0}, 0, 1, 0, 2, ... (0x3e0000), {0, 0}, 49152, ) == 0x0
 01103   436   NtClose  (140, ... ) == 0x0
 01104   436   NtWriteFile  (132, 0, 0, 0,  (132, 0, 0, 0, "MZ\220\0\3\0\0\0\4\0\0\0\377\377\0\0\270\0\0\0\0\0\0\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\340\0\0\0\16\37\272\16\0\264\11\315!\270\1L\315!This program cannot be run in DOS mode.\15\15\12$\0\0\0\0\0\0\0\23\267z\336W\326\24\215W\326\24\215W\326\24\215D\336I\215U\326\24\215\324\336I\215U\326\24\215\255\365\15\215T\326\24\215W\326\25\215g\326\24\215R\332t\215\\326\24\215R\332N\215V\326\24\215RichW\326\24\215\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0PE\0\0L\1\4\0\204v$F\0\0\0\0\0\0\0\0\340\0\17\1\13\1\7\12\0R\0\0\0|\0\0\0\0\0\0@\24\0\0\0\20\0\0\0p\0\0\0\0@\0\0\20\0\0\0\2\0\0\4\0\0\0\0\0\0\0\4\0\0\0\0\0\0\0\0\0\1\0\0\4\0\0\0\0\0\0\2\0\0\4\0\0\20\0\0\20\0\0\0\0\20\0\0\20\0\0\0\0\0\0\20\0\0\0\0\0\0\0\0\0\0\0\340q\0\0P\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0p\0\0\314\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0CODE\0\0\0\0\301\4\0\0\0\20\0\0\0\6\0\0\0\4\0\0\0\0\0\0", 48640, 0x0, 0, ... {status=0x0, info=48640}, ) , 48640, 0x0, 0, ... {status=0x0, info=48640}, ) == 0x0
 01105   436   NtUnmapViewOfSection  (-1, 0x3e0000, ... ) == 0x0
 01106   436   NtSetInformationFile  (132, 1240592, 40, Basic, ... {status=0x0, info=0}, ) == 0x0
 01107   436   NtClose  (136, ... ) == 0x0
 01108   436   NtClose  (132, ... ) == 0x0
 01109   436   NtCreateKey  (0x2000000, {24, 48, 0x40, 0, 0,  (0x2000000, {24, 48, 0x40, 0, 0, "Software\Microsoft\Windows\CurrentVersion\Run"}, 0, 0x0, 0, ... 132, 2, ) }, 0, 0x0, 0, ... 132, 2, ) == 0x0
 01110   436   NtSetValueKey  (132,  (132, "Winamp Media", 0, 1, "C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0q\0m\0e\0d\0i\0a\0.\0e\0x\0e\0\0\0\0\0\0\0\0\0\0\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\254 \1\0\0\0\0\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0 \0\10\0\0\0\0\0\0\0\254 \6\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\220\0\354\0\24\0\0\0\0\0\0\0\0\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\1\0\0\0\0\0\0\0\306\2\0\0\0\0\0\0\36 \0\0\0\0\0\04\0\356\0\22\0\0\0\11\0\0\0\0\0\0\00\0\362\0\22\0\0\0  \273\0\351\0w\0 \0\23\0\350\0w\0\377\0\377\0\377\0\377\0M\0\263\0\346\0w\00 \263\0\346\0w\0\0\0\354\0\375\0\177\0\240\0\347\0\24\0\0\0\0\0\0\0\0\0\0\0O\0\345\0\367\0w\0\243\0y\0\347\0w\0\306\2\0\0\0\0\0\0\11\0\0\0\0\0\0\0H\0\0\0\0\0\0\0\235\0\263\0\346\0w\0\4\0\366\0\22\0\0\0\370\0\353\0\375\0\177\0\0\0\0\0\1\0\0\0\0\0\0\0\24\0\0\0|\0\361\0\22\0\0\0\36 \0\0\0\0\0\08\0\365\0\22\0\0\0\2\0$\0\370\0w\0\370\0T\0\367\0w\0\377\0\377\0\377\0\377\0\215\0\26\0\365\0w\0\313\0%\0\365\0w\0\0\0\0\0\24\0\0\0\0\0\0\0\0\0\0\0\240\0\347\0\24\0\0\0\254\0%\0\365\0w\0\240\0\347\0\24\0\0\0\4\0\366\0\22\0\0\0]\0\275\0\346\0w\0d\0\362\0\22\0\0\0\220\0!\0", 520, ... , 0, 1,  (132, "Winamp Media", 0, 1, "C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0q\0m\0e\0d\0i\0a\0.\0e\0x\0e\0\0\0\0\0\0\0\0\0\0\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\254 \1\0\0\0\0\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0 \0\10\0\0\0\0\0\0\0\254 \6\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\220\0\354\0\24\0\0\0\0\0\0\0\0\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\1\0\0\0\0\0\0\0\306\2\0\0\0\0\0\0\36 \0\0\0\0\0\04\0\356\0\22\0\0\0\11\0\0\0\0\0\0\00\0\362\0\22\0\0\0  \273\0\351\0w\0 \0\23\0\350\0w\0\377\0\377\0\377\0\377\0M\0\263\0\346\0w\00 \263\0\346\0w\0\0\0\354\0\375\0\177\0\240\0\347\0\24\0\0\0\0\0\0\0\0\0\0\0O\0\345\0\367\0w\0\243\0y\0\347\0w\0\306\2\0\0\0\0\0\0\11\0\0\0\0\0\0\0H\0\0\0\0\0\0\0\235\0\263\0\346\0w\0\4\0\366\0\22\0\0\0\370\0\353\0\375\0\177\0\0\0\0\0\1\0\0\0\0\0\0\0\24\0\0\0|\0\361\0\22\0\0\0\36 \0\0\0\0\0\08\0\365\0\22\0\0\0\2\0$\0\370\0w\0\370\0T\0\367\0w\0\377\0\377\0\377\0\377\0\215\0\26\0\365\0w\0\313\0%\0\365\0w\0\0\0\0\0\24\0\0\0\0\0\0\0\0\0\0\0\240\0\347\0\24\0\0\0\254\0%\0\365\0w\0\240\0\347\0\24\0\0\0\4\0\366\0\22\0\0\0]\0\275\0\346\0w\0d\0\362\0\22\0\0\0\220\0!\0", 520, ... , 520, ...
 01111   436   NtSetInformationFile  (-2147482808, -136382012, 8, EndOfFile, ... {status=0x0, info=0}, ) == 0x0
 01112   436   NtSetInformationFile  (-2147482808, -136382104, 8, EndOfFile, ... {status=0x0, info=0}, ) == 0x0
 01113   436   NtSetInformationFile  (-2147482808, -136382412, 8, EndOfFile, ... {status=0x0, info=0}, ) == 0x0
 01110   436   NtSetValueKey  ... ) == 0x0
 01114   436   NtClose  (132, ... ) == 0x0
 01115   436   NtCreateKey  (0x2000000, {24, 60, 0x40, 0, 0,  (0x2000000, {24, 60, 0x40, 0, 0, "Software\Microsoft\Windows\CurrentVersion\Run"}, 0, 0x0, 0, ... 132, 2, ) }, 0, 0x0, 0, ... 132, 2, ) == 0x0
 01116   436   NtSetValueKey  (132,  (132, "Winamp Media", 0, 1, "C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0q\0m\0e\0d\0i\0a\0.\0e\0x\0e\0\0\0\0\0\0\0\0\0\0\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\254 \1\0\0\0\0\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0 \0\10\0\0\0\0\0\0\0\254 \6\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\220\0\354\0\24\0\0\0\0\0\0\0\0\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\1\0\0\0\0\0\0\0\306\2\0\0\0\0\0\0\36 \0\0\0\0\0\04\0\356\0\22\0\0\0\11\0\0\0\0\0\0\00\0\362\0\22\0\0\0  \273\0\351\0w\0 \0\23\0\350\0w\0\377\0\377\0\377\0\377\0M\0\263\0\346\0w\00 \263\0\346\0w\0\0\0\354\0\375\0\177\0\240\0\347\0\24\0\0\0\0\0\0\0\0\0\0\0O\0\345\0\367\0w\0\243\0y\0\347\0w\0\306\2\0\0\0\0\0\0\11\0\0\0\0\0\0\0H\0\0\0\0\0\0\0\235\0\263\0\346\0w\0\4\0\366\0\22\0\0\0\370\0\353\0\375\0\177\0\0\0\0\0\1\0\0\0\0\0\0\0\24\0\0\0|\0\361\0\22\0\0\0\36 \0\0\0\0\0\08\0\365\0\22\0\0\0\2\0$\0\370\0w\0\370\0T\0\367\0w\0\377\0\377\0\377\0\377\0\215\0\26\0\365\0w\0\313\0%\0\365\0w\0\0\0\0\0\24\0\0\0\0\0\0\0\0\0\0\0\240\0\347\0\24\0\0\0\254\0%\0\365\0w\0\240\0\347\0\24\0\0\0\4\0\366\0\22\0\0\0]\0\275\0\346\0w\0d\0\362\0\22\0\0\0\220\0!\0", 520, ... , 0, 1,  (132, "Winamp Media", 0, 1, "C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0q\0m\0e\0d\0i\0a\0.\0e\0x\0e\0\0\0\0\0\0\0\0\0\0\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\254 \1\0\0\0\0\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0 \0\10\0\0\0\0\0\0\0\254 \6\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\220\0\354\0\24\0\0\0\0\0\0\0\0\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\1\0\0\0\0\0\0\0\306\2\0\0\0\0\0\0\36 \0\0\0\0\0\04\0\356\0\22\0\0\0\11\0\0\0\0\0\0\00\0\362\0\22\0\0\0  \273\0\351\0w\0 \0\23\0\350\0w\0\377\0\377\0\377\0\377\0M\0\263\0\346\0w\00 \263\0\346\0w\0\0\0\354\0\375\0\177\0\240\0\347\0\24\0\0\0\0\0\0\0\0\0\0\0O\0\345\0\367\0w\0\243\0y\0\347\0w\0\306\2\0\0\0\0\0\0\11\0\0\0\0\0\0\0H\0\0\0\0\0\0\0\235\0\263\0\346\0w\0\4\0\366\0\22\0\0\0\370\0\353\0\375\0\177\0\0\0\0\0\1\0\0\0\0\0\0\0\24\0\0\0|\0\361\0\22\0\0\0\36 \0\0\0\0\0\08\0\365\0\22\0\0\0\2\0$\0\370\0w\0\370\0T\0\367\0w\0\377\0\377\0\377\0\377\0\215\0\26\0\365\0w\0\313\0%\0\365\0w\0\0\0\0\0\24\0\0\0\0\0\0\0\0\0\0\0\240\0\347\0\24\0\0\0\254\0%\0\365\0w\0\240\0\347\0\24\0\0\0\4\0\366\0\22\0\0\0]\0\275\0\346\0w\0d\0\362\0\22\0\0\0\220\0!\0", 520, ... , 520, ...
 01117   436   NtSetInformationFile  (-2147482700, -136382012, 8, EndOfFile, ... {status=0x0, info=0}, ) == 0x0
 01118   436   NtSetInformationFile  (-2147482700, -136382048, 8, EndOfFile, ... {status=0x0, info=0}, ) == 0x0
 01119   436   NtSetInformationFile  (-2147482700, -136382104, 8, EndOfFile, ... {status=0x0, info=0}, ) == 0x0
 01120   436   NtSetInformationFile  (-2147482700, -136382412, 8, EndOfFile, ... {status=0x0, info=0}, ) == 0x0
 01121   436   NtSetInformationFile  (-2147482700, -136382460, 8, EndOfFile, ... {status=0x0, info=0}, ) == 0x0
 01116   436   NtSetValueKey  ... ) == 0x0
 01122   436   NtClose  (132, ... ) == 0x0
 01123   436   NtUserSetTimer  (131250, 101, 2000, 0, ... ) == 0x65
 01124   436   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ... 9437184, 1048576, ) == 0x0
 01125   436   NtAllocateVirtualMemory  (-1, 10477568, 0, 8192, 4096, 4, ... 10477568, 8192, ) == 0x0
 01126   436   NtProtectVirtualMemory  (-1, (0x9fe000), 4096, 260, ... (0x9fe000), 4096, 4, ) == 0x0
 01127   436   NtCreateThread  (0x1f03ff, 0x0, -1, 1240860, 1241576, 1, ... 132, {424, 568}, ) == 0x0
 01128   436   NtQueryInformationThread  (132, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ffdd000,Pid=424,Tid=568,}, 0x0, ) == 0x0
 01129   436   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 2012550797, 0, 520, 132}  (24, {28, 56, new_msg, 0, 2012550797, 0, 520, 132} "\0\0\0\0\1\0\1\0\0\0\0\0\20\357\22\0\204\0\0\0\250\1\0\08\2\0\0" ... {28, 56, reply, 0, 424, 436, 1502, 0} "\0\0\0\0\1\0\1\0\0\0\0\0\20\357\22\0\204\0\0\0\250\1\0\08\2\0\0" )  ... {28, 56, reply, 0, 424, 436, 1502, 0}  (24, {28, 56, new_msg, 0, 2012550797, 0, 520, 132} "\0\0\0\0\1\0\1\0\0\0\0\0\20\357\22\0\204\0\0\0\250\1\0\08\2\0\0" ... {28, 56, reply, 0, 424, 436, 1502, 0} "\0\0\0\0\1\0\1\0\0\0\0\0\20\357\22\0\204\0\0\0\250\1\0\08\2\0\0" )  ) == 0x0
 01130   436   NtResumeThread  (132, ... 1, ) == 0x0
 00914   436   NtUserCreateWindowEx  ... ) == 0x200b2
 01131   436   NtUserGetMessage  (0, 0, 0, ...
 01132   568   NtTestAlert  (... ) == 0x0
 01133   568   NtContinue  (10485040, 1, ...
 01134   568   NtRegisterThreadTerminatePort  (24, ... ) == 0x0
 01135   568   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ... 136, ) == 0x0
 01136   568   NtWaitForSingleObject  (104, 0, {0, 0}, ... ) == 0x102
 01137   568   NtAllocateVirtualMemory  (-1, 10473472, 0, 4096, 4096, 260, ... 10473472, 4096, ) == 0x0
 01138   568   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\mswsock.dll"}, 10481004, ... ) }, 10481004, ... ) == 0x0
 01139   568   NtOpenFile  (0x100020, {24, 0, 0x40, 0, 0,  (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\mswsock.dll"}, 5, 96, ... 140, {status=0x0, info=1}, ) }, 5, 96, ... 140, {status=0x0, info=1}, ) == 0x0
 01140   568   NtCreateSection  (0xe, 0x0, 0x0, 16, 134217728, 140, ... 144, ) == 0x0
 01141   568   NtClose  (140, ... ) == 0x0
 01142   568   NtMapViewOfSection  (144, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 16, ... (0xa00000), 0x0, 229376, ) == 0x0
 01143   568   NtClose  (144, ... ) == 0x0
 01144   568   NtUnmapViewOfSection  (-1, 0xa00000, ... ) == 0x0
 01145   568   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\mswsock.dll"}, 10481320, ... ) }, 10481320, ... ) == 0x0
 01146   568   NtOpenFile  (0x100020, {24, 0, 0x40, 0, 0,  (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\mswsock.dll"}, 5, 96, ... 144, {status=0x0, info=1}, ) }, 5, 96, ... 144, {status=0x0, info=1}, ) == 0x0
 01147   568   NtCreateSection  (0xf, 0x0, 0x0, 16, 16777216, 144, ... 140, ) == 0x0
 01148   568   NtQuerySection  (140, Image, 48, ... {section info, class 1, size 48}, 0x0, ) == 0x0
 01149   568   NtClose  (144, ... ) == 0x0
 01150   568   NtMapViewOfSection  (140, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x71a50000), 0x0, 241664, ) == 0x0
 01151   568   NtClose  (140, ... ) == 0x0
 01152   568   NtQuerySystemInformation  (Basic, 44, ... {Unknown=0,MaximumIncrement=156250,PhysicalPageSize=0x1000,NumberOfPhysicalPages=0xff7c,LowestPhysicalPage=0x1,HighestPhysicalPage=0xffff,AllocationGranularity=0x10000,LowestUserAddress=0x10000,HighestUserAddress=0x7ffeffff,ActiveProcessors=1,NumberProcessors=1,}, 0x0, ) == 0x0
 01153   568   NtQuerySystemInformation  (Processor, 12, ... {system info, class 1, size 12}, 0x0, ) == 0x0
 01154   568   NtCreateEvent  (0x1f0003, 0x0, 0, 0, ... 140, ) == 0x0
 01155   568   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\mswsock.dll"}, 10480648, ... ) }, 10480648, ... ) == 0x0
 01156   568   NtOpenKey  (0x20019, {24, 48, 0x40, 0, 0,  (0x20019, {24, 48, 0x40, 0, 0, "SYSTEM\CurrentControlSet\Services\Winsock\Parameters"}, ... 144, ) }, ... 144, ) == 0x0
 01157   568   NtQueryValueKey  (144,  (144, "Transports", Partial, 144, ... TitleIdx=0, Type=7, Data="T\0c\0p\0i\0p\0\0\0N\0e\0t\0B\0I\0O\0S\0\0\0\0\0"}, 42, ) , Partial, 144, ... TitleIdx=0, Type=7, Data= (144, "Transports", Partial, 144, ... TitleIdx=0, Type=7, Data="T\0c\0p\0i\0p\0\0\0N\0e\0t\0B\0I\0O\0S\0\0\0\0\0"}, 42, ) }, 42, ) == 0x0
 01158   568   NtQueryValueKey  (144,  (144, "Transports", Partial, 144, ... TitleIdx=0, Type=7, Data="T\0c\0p\0i\0p\0\0\0N\0e\0t\0B\0I\0O\0S\0\0\0\0\0"}, 42, ) , Partial, 144, ... TitleIdx=0, Type=7, Data= (144, "Transports", Partial, 144, ... TitleIdx=0, Type=7, Data="T\0c\0p\0i\0p\0\0\0N\0e\0t\0B\0I\0O\0S\0\0\0\0\0"}, 42, ) }, 42, ) == 0x0
 01159   568   NtClose  (144, ... ) == 0x0
 01160   568   NtOpenKey  (0x20019, {24, 48, 0x40, 0, 0,  (0x20019, {24, 48, 0x40, 0, 0, "System\CurrentControlSet\Services\Tcpip\Parameters\Winsock"}, ... 144, ) }, ... 144, ) == 0x0
 01161   568   NtQueryValueKey  (144,  (144, "Mapping", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 01162   568   NtQueryValueKey  (144,  (144, "Mapping", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 01163   568   NtQueryValueKey  (144,  (144, "Mapping", Partial, 152, ... TitleIdx=0, Type=3, Data="\13\0\0\0\3\0\0\0\2\0\0\0\1\0\0\0\6\0\0\0\2\0\0\0\1\0\0\0\0\0\0\0\2\0\0\0\0\0\0\0\6\0\0\0\0\0\0\0\0\0\0\0\6\0\0\0\0\0\0\0\1\0\0\0\6\0\0\0\2\0\0\0\2\0\0\0\21\0\0\0\2\0\0\0\2\0\0\0\0\0\0\0\2\0\0\0\0\0\0\0\21\0\0\0\0\0\0\0\0\0\0\0\21\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\2\0\0\0\3\0\0\0\0\0\0\0"}, 152, ) , Partial, 152, ... TitleIdx=0, Type=3, Data= (144, "Mapping", Partial, 152, ... TitleIdx=0, Type=3, Data="\13\0\0\0\3\0\0\0\2\0\0\0\1\0\0\0\6\0\0\0\2\0\0\0\1\0\0\0\0\0\0\0\2\0\0\0\0\0\0\0\6\0\0\0\0\0\0\0\0\0\0\0\6\0\0\0\0\0\0\0\1\0\0\0\6\0\0\0\2\0\0\0\2\0\0\0\21\0\0\0\2\0\0\0\2\0\0\0\0\0\0\0\2\0\0\0\0\0\0\0\21\0\0\0\0\0\0\0\0\0\0\0\21\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\2\0\0\0\3\0\0\0\0\0\0\0"}, 152, ) }, 152, ) == 0x0
 01164   568   NtClose  (144, ... ) == 0x0
 01165   568   NtOpenKey  (0x20019, {24, 48, 0x40, 0, 0,  (0x20019, {24, 48, 0x40, 0, 0, "System\CurrentControlSet\Services\Tcpip\Parameters\Winsock"}, ... 144, ) }, ... 144, ) == 0x0
 01166   568   NtQueryValueKey  (144,  (144, "MinSockaddrLength", Partial, 144, ... TitleIdx=0, Type=4, Data="\20\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (144, "MinSockaddrLength", Partial, 144, ... TitleIdx=0, Type=4, Data="\20\0\0\0"}, 16, ) }, 16, ) == 0x0
 01167   568   NtQueryValueKey  (144,  (144, "MaxSockaddrLength", Partial, 144, ... TitleIdx=0, Type=4, Data="\20\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (144, "MaxSockaddrLength", Partial, 144, ... TitleIdx=0, Type=4, Data="\20\0\0\0"}, 16, ) }, 16, ) == 0x0
 01168   568   NtQueryValueKey  (144,  (144, "UseDelayedAcceptance", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (144, "UseDelayedAcceptance", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) }, 16, ) == 0x0
 01169   568   NtQueryValueKey  (144,  (144, "HelperDllName", Partial, 144, ... TitleIdx=0, Type=2, Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0w\0s\0h\0t\0c\0p\0i\0p\0.\0d\0l\0l\0\0\0"}, 82, ) , Partial, 144, ... TitleIdx=0, Type=2, Data= (144, "HelperDllName", Partial, 144, ... TitleIdx=0, Type=2, Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0w\0s\0h\0t\0c\0p\0i\0p\0.\0d\0l\0l\0\0\0"}, 82, ) }, 82, ) == 0x0
 01170   568   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\System32\wshtcpip.dll"}, 10481568, ... ) }, 10481568, ... ) == 0x0
 01171   568   NtOpenFile  (0x100020, {24, 0, 0x40, 0, 0,  (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\System32\wshtcpip.dll"}, 5, 96, ... 148, {status=0x0, info=1}, ) }, 5, 96, ... 148, {status=0x0, info=1}, ) == 0x0
 01172   568   NtCreateSection  (0xe, 0x0, 0x0, 16, 134217728, 148, ... 152, ) == 0x0
 01173   568   NtClose  (148, ... ) == 0x0
 01174   568   NtMapViewOfSection  (152, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 16, ... (0x3e0000), 0x0, 20480, ) == 0x0
 01175   568   NtClose  (152, ... ) == 0x0
 01176   568   NtUnmapViewOfSection  (-1, 0x3e0000, ... ) == 0x0
 01177   568   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\System32\wshtcpip.dll"}, 10481884, ... ) }, 10481884, ... ) == 0x0
 01178   568   NtOpenFile  (0x100020, {24, 0, 0x40, 0, 0,  (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\System32\wshtcpip.dll"}, 5, 96, ... 152, {status=0x0, info=1}, ) }, 5, 96, ... 152, {status=0x0, info=1}, ) == 0x0
 01179   568   NtCreateSection  (0xf, 0x0, 0x0, 16, 16777216, 152, ... 148, ) == 0x0
 01180   568   NtQuerySection  (148, Image, 48, ... {section info, class 1, size 48}, 0x0, ) == 0x0
 01181   568   NtClose  (152, ... ) == 0x0
 01182   568   NtMapViewOfSection  (148, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x71a90000), 0x0, 32768, ) == 0x0
 01183   568   NtClose  (148, ... ) == 0x0
 01184   568   NtClose  (144, ... ) == 0x0
 01185   568   NtCreateFile  (0xc0100000, {24, 0, 0x42, 0, 0,  (0xc0100000, {24, 0, 0x42, 0, 0, "\Device\Afd\Endpoint"}, 0x0, 0, 3, 3, 0, 10484084, 75, ... }, 0x0, 0, 3, 3, 0, 10484084, 75, ...
 01186   568   NtClose  (-2147482208, ... ) == 0x0
 01185   568   NtCreateFile  ... 144, {status=0x0, info=0}, ) == 0x0
 01187   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x1207b,  (144, 140, 0x0, 0x0, 0x1207b, "\7\0\0\0\340\0\0\0\30\361\24\0\17\346\367w", 16, 16, ... {status=0x0, info=16}, "\7\0\0\0B\0\0\0\0 \0\0\270\302\14\201", ) , 16, 16, ... {status=0x0, info=16},  (144, 140, 0x0, 0x0, 0x1207b, "\7\0\0\0\340\0\0\0\30\361\24\0\17\346\367w", 16, 16, ... {status=0x0, info=16}, "\7\0\0\0B\0\0\0\0 \0\0\270\302\14\201", ) , ) == 0x0
 01188   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x1207b,  (144, 140, 0x0, 0x0, 0x1207b, "\6\0\0\0B\0\0\0\0 \0\0\270\302\14\201", 16, 16, ... {status=0x0, info=16}, "\6\0\0\0B\0\0\0\0 \0\0\270\302\14\201", ) , 16, 16, ... {status=0x0, info=16},  (144, 140, 0x0, 0x0, 0x1207b, "\6\0\0\0B\0\0\0\0 \0\0\270\302\14\201", 16, 16, ... {status=0x0, info=16}, "\6\0\0\0B\0\0\0\0 \0\0\270\302\14\201", ) , ) == 0x0
 01189   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12047,  (144, 140, 0x0, 0x0, 0x12047, "\0\0\0\0\2\0\0\0\3\0\0\0\0\0\0\0\20\0\0\0\20\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0 \0\0\0 \0\0\0\0\0\0\1\0\0\0\353\3\0\0\11\6\2\0\14\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0h\0\0\0\30\361\24\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\3\0\0\0\0\0\0\0\0 \0\0\1\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\1\0\0\0\1\0\0\0\0\0\0 \0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0", 248, 16, ... {status=0x0, info=0}, "", ) , 248, 16, ... {status=0x0, info=0}, "", ) == 0x0
 01190   568   NtWaitForSingleObject  (104, 0, {0, 0}, ... ) == 0x102
 01191   568   NtWaitForSingleObject  (112, 0, {0, 0}, ... ) == 0x102
 01192   568   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\System32\mswsock.dll"}, 10480824, ... ) }, 10480824, ... ) == 0x0
 01193   568   NtOpenSection  (0xe, {24, 8, 0x40, 0, 0,  (0xe, {24, 8, 0x40, 0, 0, "DNSAPI.dll"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01194   568   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\u:\work\DNSAPI.dll"}, 10480940, ... ) }, 10480940, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01195   568   NtQueryAttributesFile  ({24, 12, 0x40, 0, 0,  ({24, 12, 0x40, 0, 0, "DNSAPI.dll"}, 10480940, ... ) }, 10480940, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01196   568   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\System32\DNSAPI.dll"}, 10480940, ... ) }, 10480940, ... ) == 0x0
 01197   568   NtOpenFile  (0x100020, {24, 0, 0x40, 0, 0,  (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\System32\DNSAPI.dll"}, 5, 96, ... 148, {status=0x0, info=1}, ) }, 5, 96, ... 148, {status=0x0, info=1}, ) == 0x0
 01198   568   NtCreateSection  (0xf, 0x0, 0x0, 16, 16777216, 148, ... 152, ) == 0x0
 01199   568   NtQuerySection  (152, Image, 48, ... {section info, class 1, size 48}, 0x0, ) == 0x0
 01200   568   NtClose  (148, ... ) == 0x0
 01201   568   NtMapViewOfSection  (152, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x76f20000), 0x0, 151552, ) == 0x0
 01202   568   NtClose  (152, ... ) == 0x0
 01203   568   NtCreateKey  (0x20019, {24, 48, 0x40, 0, 0,  (0x20019, {24, 48, 0x40, 0, 0, "System\CurrentControlSet\Services\Tcpip\Parameters"}, 0, "Class", 0, ... 152, 2, ) }, 0,  (0x20019, {24, 48, 0x40, 0, 0, "System\CurrentControlSet\Services\Tcpip\Parameters"}, 0, "Class", 0, ... 152, 2, ) , 0, ... 152, 2, ) == 0x0
 01204   568   NtOpenKey  (0x20019, {24, 48, 0x40, 0, 0,  (0x20019, {24, 48, 0x40, 0, 0, "System\CurrentControlSet\Services\DnsCache\Parameters"}, ... 148, ) }, ... 148, ) == 0x0
 01205   568   NtOpenKey  (0x20019, {24, 48, 0x40, 0, 0,  (0x20019, {24, 48, 0x40, 0, 0, "Software\Policies\Microsoft\Windows NT\DnsClient"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01206   568   NtOpenKey  (0x1, {24, 48, 0x40, 0, 0,  (0x1, {24, 48, 0x40, 0, 0, "System\CurrentControlSet\Services\DNS"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01207   568   NtQueryValueKey  (148,  (148, "QueryAdapterName", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01208   568   NtQueryValueKey  (152,  (152, "DisableAdapterDomainName", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01209   568   NtQueryValueKey  (148,  (148, "UseDomainNameDevolution", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01210   568   NtQueryValueKey  (152,  (152, "UseDomainNameDevolution", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (152, "UseDomainNameDevolution", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) }, 16, ) == 0x0
 01211   568   NtQueryValueKey  (148,  (148, "PrioritizeRecordData", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01212   568   NtQueryValueKey  (152,  (152, "PrioritizeRecordData", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01213   568   NtQueryValueKey  (148,  (148, "AllowUnqualifiedQuery", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01214   568   NtQueryValueKey  (152,  (152, "AllowUnqualifiedQuery", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01215   568   NtQueryValueKey  (148,  (148, "AppendToMultiLabelName", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01216   568   NtQueryValueKey  (148,  (148, "ScreenBadTlds", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01217   568   NtQueryValueKey  (148,  (148, "ScreenUnreachableServers", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01218   568   NtQueryValueKey  (148,  (148, "FilterClusterIp", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01219   568   NtQueryValueKey  (148,  (148, "WaitForNameErrorOnAll", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01220   568   NtQueryValueKey  (148,  (148, "UseEdns", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01221   568   NtQueryValueKey  (148,  (148, "RegistrationEnabled", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01222   568   NtQueryValueKey  (152,  (152, "DisableDynamicUpdate", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01223   568   NtQueryValueKey  (148,  (148, "RegisterPrimaryName", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01224   568   NtQueryValueKey  (148,  (148, "RegisterAdapterName", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01225   568   NtQueryValueKey  (152,  (152, "EnableAdapterDomainNameRegistration", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01226   568   NtQueryValueKey  (148,  (148, "RegisterReverseLookup", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01227   568   NtQueryValueKey  (152,  (152, "DisableReverseAddressRegistrations", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01228   568   NtQueryValueKey  (148,  (148, "RegisterWanAdapters", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01229   568   NtQueryValueKey  (152,  (152, "DisableWanDynamicUpdate", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01230   568   NtQueryValueKey  (148,  (148, "RegistrationOverwritesInConflict", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01231   568   NtQueryValueKey  (152,  (152, "DisableReplaceAddressesInConflicts", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01232   568   NtQueryValueKey  (148,  (148, "RegistrationTtl", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01233   568   NtQueryValueKey  (152,  (152, "DefaultRegistrationTTL", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01234   568   NtQueryValueKey  (148,  (148, "RegistrationRefreshInterval", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01235   568   NtQueryValueKey  (152,  (152, "DefaultRegistrationRefreshInterval", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01236   568   NtQueryValueKey  (148,  (148, "RegistrationMaxAddressCount", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01237   568   NtQueryValueKey  (152,  (152, "MaxNumberOfAddressesToRegister", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01238   568   NtQueryValueKey  (148,  (148, "UpdateSecurityLevel", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01239   568   NtQueryValueKey  (152,  (152, "UpdateSecurityLevel", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01240   568   NtQueryValueKey  (148,  (148, "UpdateZoneExcludeFile", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01241   568   NtQueryValueKey  (148,  (148, "UpdateTopLevelDomainZones", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01242   568   NtQueryValueKey  (148,  (148, "DnsTest", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01243   568   NtQueryValueKey  (148,  (148, "MaxCacheSize", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01244   568   NtQueryValueKey  (148,  (148, "MaxCacheTtl", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01245   568   NtQueryValueKey  (148,  (148, "MaxNegativeCacheTtl", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01246   568   NtQueryValueKey  (148,  (148, "AdapterTimeoutLimit", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01247   568   NtQueryValueKey  (148,  (148, "ServerPriorityTimeLimit", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01248   568   NtQueryValueKey  (148,  (148, "MaxCachedSockets", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01249   568   NtQueryValueKey  (148,  (148, "UseMulticast", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01250   568   NtQueryValueKey  (148,  (148, "MulticastOnNameError", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01251   568   NtQueryValueKey  (148,  (148, "UseDotLocalDomain", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01252   568   NtQueryValueKey  (148,  (148, "ListenOnMulticast", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01253   568   NtOpenKey  (0x1, {24, 48, 0x40, 0, 0,  (0x1, {24, 48, 0x40, 0, 0, "System\Setup"}, ... 156, ) }, ... 156, ) == 0x0
 01254   568   NtQueryValueKey  (156,  (156, "SystemSetupInProgress", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (156, "SystemSetupInProgress", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) }, 16, ) == 0x0
 01255   568   NtClose  (156, ... ) == 0x0
 01256   568   NtClose  (152, ... ) == 0x0
 01257   568   NtClose  (148, ... ) == 0x0
 01258   568   NtOpenKey  (0x1, {24, 48, 0x40, 0, 0,  (0x1, {24, 48, 0x40, 0, 0, "System\CurrentControlSet\Services\Tcpip\Parameters"}, ... 148, ) }, ... 148, ) == 0x0
 01259   568   NtQueryValueKey  (148,  (148, "DnsQueryTimeouts", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01260   568   NtQueryValueKey  (148,  (148, "DnsQuickQueryTimeouts", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01261   568   NtQueryValueKey  (148,  (148, "DnsMulticastQueryTimeouts", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01262   568   NtClose  (148, ... ) == 0x0
 01263   568   NtQuerySystemInformation  (Basic, 44, ... {Unknown=0,MaximumIncrement=156250,PhysicalPageSize=0x1000,NumberOfPhysicalPages=0xff7c,LowestPhysicalPage=0x1,HighestPhysicalPage=0xffff,AllocationGranularity=0x10000,LowestUserAddress=0x10000,HighestUserAddress=0x7ffeffff,ActiveProcessors=1,NumberProcessors=1,}, 0x0, ) == 0x0
 01264   568   NtOpenKey  (0x20019, {24, 48, 0x40, 0, 0,  (0x20019, {24, 48, 0x40, 0, 0, "Software\Microsoft\Rpc\PagedBuffers"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01265   568   NtOpenKey  (0x20019, {24, 48, 0x40, 0, 0,  (0x20019, {24, 48, 0x40, 0, 0, "Software\Microsoft\Rpc"}, ... 148, ) }, ... 148, ) == 0x0
 01266   568   NtQueryValueKey  (148,  (148, "MaxRpcSize", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01267   568   NtClose  (148, ... ) == 0x0
 01268   568   NtOpenKey  (0x20019, {24, 48, 0x40, 0, 0,  (0x20019, {24, 48, 0x40, 0, 0, "Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\packed.exe\RpcThreadPoolThrottle"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01269   568   NtCreateEvent  (0x1f0003, 0x0, 1, 0, ... 148, ) == 0x0
 01270   568   NtCreateEvent  (0x1f0003, 0x0, 1, 0, ... 152, ) == 0x0
 01271   568   NtQuerySystemTime  (... {-1630616298, 29868087}, ) == 0x0
 01272   568   NtCreateEvent  (0x1f0003, 0x0, 0, 0, ... 156, ) == 0x0
 01273   568   NtOpenKey  (0x20019, {24, 48, 0x40, 0, 0,  (0x20019, {24, 48, 0x40, 0, 0, "Software\Policies\Microsoft\Windows NT\Rpc"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01274   568   NtQuerySystemInformation  (Performance, 312, ... {system info, class 2, size 312}, 0x0, ) == 0x0
 01275   568   NtQueryInformationProcess  (-1, QuotaLimits, 32, ... {process info, class 1, size 32}, 0x0, ) == 0x0
 01276   568   NtQueryInformationProcess  (-1, VmCounters, 44, ... {process info, class 3, size 44}, 0x0, ) == 0x0
 01277   568   NtCreateEvent  (0x1f0003, 0x0, 0, 0, ... 160, ) == 0x0
 01278   568   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ... 164, ) == 0x0
 01279   568   NtCreateEvent  (0x1f0003, 0x0, 1, 0, ... 168, ) == 0x0
 01280   568   NtConnectPort  ( ("\RPC Control\DNSResolver", {12, 2, 1, 1}, 0x0, 0x0, 10481416, 112, ... 172, 0x0, 0x0, 0x0, 112, ) , {12, 2, 1, 1}, 0x0, 0x0, 10481416, 112, ... 172, 0x0, 0x0, 0x0, 112, ) == 0x0
 01281   568   NtRequestWaitReplyPort  (172, {128, 152, new_msg, 0, 126172, 1310720, 10481180, 2012750850}  (172, {128, 152, new_msg, 0, 126172, 1310720, 10481180, 2012750850} "\0\364\237\0\2$\370w\370T\367w\1kwEVY\205D\237\200\364(\367\326\1)\2\0\0\0\1\0\0\0k\23\314w\4\0\0\0\20\344\314w`\17\25\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0(\15\25\0\240\15\25\0H\2\24\08\17\25\0\4\0\0\00\17\25\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\340\3\24\0\0\0\0\0\32\0\0\0\5\0\0\0" ... {128, 152, reply, 0, 424, 568, 1504, 0} "\7\364\237\0\2$\370w\370T\367w\1kwEVY\205D\237\200\364(\367\326\1)\2\0\0\0\1\0\0\0\0\0\0\0\4\0\0\0\20\344\314w\377\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0(\15\25\0\240\15\25\0H\2\24\08\17\25\0\4\0\0\00\17\25\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\340\3\24\0\0\0\0\0\32\0\0\0\5\0\0\0" )  ... {128, 152, reply, 0, 424, 568, 1504, 0}  (172, {128, 152, new_msg, 0, 126172, 1310720, 10481180, 2012750850} "\0\364\237\0\2$\370w\370T\367w\1kwEVY\205D\237\200\364(\367\326\1)\2\0\0\0\1\0\0\0k\23\314w\4\0\0\0\20\344\314w`\17\25\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0(\15\25\0\240\15\25\0H\2\24\08\17\25\0\4\0\0\00\17\25\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\340\3\24\0\0\0\0\0\32\0\0\0\5\0\0\0" ... {128, 152, reply, 0, 424, 568, 1504, 0} "\7\364\237\0\2$\370w\370T\367w\1kwEVY\205D\237\200\364(\367\326\1)\2\0\0\0\1\0\0\0\0\0\0\0\4\0\0\0\20\344\314w\377\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0(\15\25\0\240\15\25\0H\2\24\08\17\25\0\4\0\0\00\17\25\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\340\3\24\0\0\0\0\0\32\0\0\0\5\0\0\0" )  ) == 0x0
 01282   568   NtAllocateVirtualMemory  (-1, 1380352, 0, 4096, 4096, 4, ... 1380352, 4096, ) == 0x0
 01283   568   NtRequestWaitReplyPort  (172, {64, 88, new_msg, 0, 0, 0, 0, 0}  (172, {64, 88, new_msg, 0, 0, 0, 0, 0} "\1\0\0\0A\2\10\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\377\377\377\377\0\0\0\0\0\0\0\0\21\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0" ... {52, 76, reply, 0, 424, 568, 1505, 0} "\2\240\372\177\1\00\300\0\0\0\0G\3\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\200W\12\0\1\0\0\0\1\0\0\0\300\250|\201\377\377\377\0" )  ... {52, 76, reply, 0, 424, 568, 1505, 0}  (172, {64, 88, new_msg, 0, 0, 0, 0, 0} "\1\0\0\0A\2\10\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\377\377\377\377\0\0\0\0\0\0\0\0\21\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0" ... {52, 76, reply, 0, 424, 568, 1505, 0} "\2\240\372\177\1\00\300\0\0\0\0G\3\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\200W\12\0\1\0\0\0\1\0\0\0\300\250|\201\377\377\377\0" )  ) == 0x0
 01284   568   NtClose  (168, ... ) == 0x0
 01285   568   NtClose  (172, ... ) == 0x0
 01286   568   NtCreateKey  (0x20019, {24, 48, 0x40, 0, 0,  (0x20019, {24, 48, 0x40, 0, 0, "System\CurrentControlSet\Services\Tcpip\Parameters"}, 0, "Class", 0, ... 172, 2, ) }, 0,  (0x20019, {24, 48, 0x40, 0, 0, "System\CurrentControlSet\Services\Tcpip\Parameters"}, 0, "Class", 0, ... 172, 2, ) , 0, ... 172, 2, ) == 0x0
 01287   568   NtOpenKey  (0x20019, {24, 48, 0x40, 0, 0,  (0x20019, {24, 48, 0x40, 0, 0, "System\CurrentControlSet\Services\DnsCache\Parameters"}, ... 168, ) }, ... 168, ) == 0x0
 01288   568   NtOpenKey  (0x20019, {24, 48, 0x40, 0, 0,  (0x20019, {24, 48, 0x40, 0, 0, "Software\Policies\Microsoft\Windows NT\DnsClient"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01289   568   NtQueryValueKey  (172,  (172, "Hostname", Partial, 144, ... TitleIdx=0, Type=1, Data="M\0Y\0W\0O\0R\0L\0D\0\0\0"}, 28, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (172, "Hostname", Partial, 144, ... TitleIdx=0, Type=1, Data="M\0Y\0W\0O\0R\0L\0D\0\0\0"}, 28, ) }, 28, ) == 0x0
 01290   568   NtQueryValueKey  (172,  (172, "Hostname", Partial, 144, ... TitleIdx=0, Type=1, Data="M\0Y\0W\0O\0R\0L\0D\0\0\0"}, 28, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (172, "Hostname", Partial, 144, ... TitleIdx=0, Type=1, Data="M\0Y\0W\0O\0R\0L\0D\0\0\0"}, 28, ) }, 28, ) == 0x0
 01291   568   NtClose  (172, ... ) == 0x0
 01292   568   NtClose  (168, ... ) == 0x0
 01293   568   NtCreateEvent  (0x1f0003, 0x0, 1, 0, ... 168, ) == 0x0
 01294   568   NtConnectPort  ( ("\RPC Control\DNSResolver", {12, 2, 1, 1}, 0x0, 0x0, 10481280, 112, ... 172, 0x0, 0x0, 0x0, 112, ) , {12, 2, 1, 1}, 0x0, 0x0, 10481280, 112, ... 172, 0x0, 0x0, 0x0, 112, ) == 0x0
 01295   568   NtRequestWaitReplyPort  (172, {128, 152, new_msg, 0, 126036, 1310720, 10481044, 2012750850}  (172, {128, 152, new_msg, 0, 126036, 1310720, 10481044, 2012750850} "\0\364\237\0\2$\370w\370T\367w\1kwEVY\205D\237\200\364(\367\326\1)\2\0\0\0\1\0\0\0k\23\314w\4\0\0\0\20\344\314w`\17\25\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\3\0(\15\25\0\310\15\25\0\0\0\0\0\10\0\0\0?\360\367w\221\337\314w\0\0\0\0\0\0\237\0\200\357\237\0\0\0\0\0\263\26\365w\0\0\0\0\5\0\0\0\5\0\0\0" ... {128, 152, reply, 0, 424, 568, 1508, 0} "\7\364\237\0\2$\370w\370T\367w\1kwEVY\205D\237\200\364(\367\326\1)\2\0\0\0\1\0\0\0\0\0\0\0\4\0\0\0\20\344\314w\377\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\3\0(\15\25\0\310\15\25\0\0\0\0\0\10\0\0\0?\360\367w\221\337\314w\0\0\0\0\0\0\237\0\200\357\237\0\0\0\0\0\263\26\365w\0\0\0\0\5\0\0\0\5\0\0\0" )  ... {128, 152, reply, 0, 424, 568, 1508, 0}  (172, {128, 152, new_msg, 0, 126036, 1310720, 10481044, 2012750850} "\0\364\237\0\2$\370w\370T\367w\1kwEVY\205D\237\200\364(\367\326\1)\2\0\0\0\1\0\0\0k\23\314w\4\0\0\0\20\344\314w`\17\25\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\3\0(\15\25\0\310\15\25\0\0\0\0\0\10\0\0\0?\360\367w\221\337\314w\0\0\0\0\0\0\237\0\200\357\237\0\0\0\0\0\263\26\365w\0\0\0\0\5\0\0\0\5\0\0\0" ... {128, 152, reply, 0, 424, 568, 1508, 0} "\7\364\237\0\2$\370w\370T\367w\1kwEVY\205D\237\200\364(\367\326\1)\2\0\0\0\1\0\0\0\0\0\0\0\4\0\0\0\20\344\314w\377\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\3\0(\15\25\0\310\15\25\0\0\0\0\0\10\0\0\0?\360\367w\221\337\314w\0\0\0\0\0\0\237\0\200\357\237\0\0\0\0\0\263\26\365w\0\0\0\0\5\0\0\0\5\0\0\0" )  ) == 0x0
 01296   568   NtRequestWaitReplyPort  (172, {44, 68, new_msg, 0, 424, 568, 1505, 0}  (172, {44, 68, new_msg, 0, 424, 568, 1505, 0} "\1\240\0\0A\2\4\0\0\0\0\0G\3\0\0\0\0\0\0\0\0\0\0\377\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\1\0\0\0" ... {40, 64, reply, 0, 424, 568, 1509, 0} "\2\240\372\177\4\00\300\0\0\0\0G\3\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\324\1\0\0\240,\11\0" )  ... {40, 64, reply, 0, 424, 568, 1509, 0}  (172, {44, 68, new_msg, 0, 424, 568, 1505, 0} "\1\240\0\0A\2\4\0\0\0\0\0G\3\0\0\0\0\0\0\0\0\0\0\377\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\1\0\0\0" ... {40, 64, reply, 0, 424, 568, 1509, 0} "\2\240\372\177\4\00\300\0\0\0\0G\3\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\324\1\0\0\240,\11\0" )  ) == 0x0
 01297   568   NtRequestWaitReplyPort  (172, {64, 88, new_msg, 56, 0, 1, 0, 0}  (172, {64, 88, new_msg, 56, 0, 1, 0, 0} "\10\360\237\0@\0\314w\300\14\25\0H\360\237\0\260\360\237\0\0\267\362v\260\360\237\0\300\14\25\0\1\0\0\0\260\20\25\0\324\1\0\0\324\1\0\0\240,\11\0\0\0\0\0\0\0\0\0\0\0\0\0" ... {64, 88, reply, 56, 424, 568, 1510, 0} "\10\360\237\0@\0\314w\300\14\25\0H\360\237\0\260\360\237\0\0\267\362v\260\360\237\0\300\14\25\0\1\0\0\0\260\20\25\0\324\1\0\0\324\1\0\0\240,\11\0\0\0\0\0\0\0\0\0\0\0\0\0" )  ... {64, 88, reply, 56, 424, 568, 1510, 0}  (172, {64, 88, new_msg, 56, 0, 1, 0, 0} "\10\360\237\0@\0\314w\300\14\25\0H\360\237\0\260\360\237\0\0\267\362v\260\360\237\0\300\14\25\0\1\0\0\0\260\20\25\0\324\1\0\0\324\1\0\0\240,\11\0\0\0\0\0\0\0\0\0\0\0\0\0" ... {64, 88, reply, 56, 424, 568, 1510, 0} "\10\360\237\0@\0\314w\300\14\25\0H\360\237\0\260\360\237\0\0\267\362v\260\360\237\0\300\14\25\0\1\0\0\0\260\20\25\0\324\1\0\0\324\1\0\0\240,\11\0\0\0\0\0\0\0\0\0\0\0\0\0" )  ) == 0x0
 01298   568   NtClose  (168, ... ) == 0x0
 01299   568   NtClose  (172, ... ) == 0x0
 01300   568   NtCreateKey  (0x20019, {24, 48, 0x40, 0, 0,  (0x20019, {24, 48, 0x40, 0, 0, "System\CurrentControlSet\Services\Tcpip\Parameters"}, 0, "Class", 0, ... 172, 2, ) }, 0,  (0x20019, {24, 48, 0x40, 0, 0, "System\CurrentControlSet\Services\Tcpip\Parameters"}, 0, "Class", 0, ... 172, 2, ) , 0, ... 172, 2, ) == 0x0
 01301   568   NtOpenKey  (0x20019, {24, 48, 0x40, 0, 0,  (0x20019, {24, 48, 0x40, 0, 0, "System\CurrentControlSet\Services\DnsCache\Parameters"}, ... 168, ) }, ... 168, ) == 0x0
 01302   568   NtOpenKey  (0x20019, {24, 48, 0x40, 0, 0,  (0x20019, {24, 48, 0x40, 0, 0, "Software\Policies\Microsoft\Windows NT\DnsClient"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01303   568   NtQueryValueKey  (172,  (172, "Domain", Partial, 144, ... TitleIdx=0, Type=1, Data="\0\0"}, 14, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (172, "Domain", Partial, 144, ... TitleIdx=0, Type=1, Data="\0\0"}, 14, ) }, 14, ) == 0x0
 01304   568   NtQueryValueKey  (172,  (172, "Domain", Partial, 144, ... TitleIdx=0, Type=1, Data="\0\0"}, 14, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (172, "Domain", Partial, 144, ... TitleIdx=0, Type=1, Data="\0\0"}, 14, ) }, 14, ) == 0x0
 01305   568   NtClose  (172, ... ) == 0x0
 01306   568   NtClose  (168, ... ) == 0x0
 01307   568   NtOpenKey  (0x1, {24, 48, 0x40, 0, 0,  (0x1, {24, 48, 0x40, 0, 0, "System\CurrentControlSet\Services\Tcpip\Parameters"}, ... 168, ) }, ... 168, ) == 0x0
 01308   568   NtQueryValueKey  (168,  (168, "DnsNbtLookupOrder", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01309   568   NtClose  (168, ... ) == 0x0
 01310   568   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\System32\winrnr.dll"}, 10480824, ... ) }, 10480824, ... ) == 0x0
 01311   568   NtOpenFile  (0x100020, {24, 0, 0x40, 0, 0,  (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\System32\winrnr.dll"}, 5, 96, ... 168, {status=0x0, info=1}, ) }, 5, 96, ... 168, {status=0x0, info=1}, ) == 0x0
 01312   568   NtCreateSection  (0xe, 0x0, 0x0, 16, 134217728, 168, ... 172, ) == 0x0
 01313   568   NtClose  (168, ... ) == 0x0
 01314   568   NtMapViewOfSection  (172, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 16, ... (0x3e0000), 0x0, 16384, ) == 0x0
 01315   568   NtClose  (172, ... ) == 0x0
 01316   568   NtUnmapViewOfSection  (-1, 0x3e0000, ... ) == 0x0
 01317   568   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\System32\winrnr.dll"}, 10481140, ... ) }, 10481140, ... ) == 0x0
 01318   568   NtOpenFile  (0x100020, {24, 0, 0x40, 0, 0,  (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\System32\winrnr.dll"}, 5, 96, ... 172, {status=0x0, info=1}, ) }, 5, 96, ... 172, {status=0x0, info=1}, ) == 0x0
 01319   568   NtCreateSection  (0xf, 0x0, 0x0, 16, 16777216, 172, ... 168, ) == 0x0
 01320   568   NtQuerySection  (168, Image, 48, ... {section info, class 1, size 48}, 0x0, ) == 0x0
 01321   568   NtClose  (172, ... ) == 0x0
 01322   568   NtMapViewOfSection  (168, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x76fb0000), 0x0, 28672, ) == 0x0
 01323   568   NtClose  (168, ... ) == 0x0
 01324   568   NtOpenSection  (0xe, {24, 8, 0x40, 0, 0,  (0xe, {24, 8, 0x40, 0, 0, "WLDAP32.dll"}, ... 168, ) }, ... 168, ) == 0x0
 01325   568   NtMapViewOfSection  (168, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x76f60000), 0x0, 180224, ) == 0x0
 01326   568   NtClose  (168, ... ) == 0x0
 01327   568   NtCreateEvent  (0x1f0003, 0x0, 1, 0, ... 168, ) == 0x0
 01328   568   NtOpenKey  (0x20019, {24, 48, 0x40, 0, 0,  (0x20019, {24, 48, 0x40, 0, 0, "System\CurrentControlSet\Services\LDAP"}, ... 172, ) }, ... 172, ) == 0x0
 01329   568   NtQueryValueKey  (172,  (172, "LdapClientIntegrity", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (172, "LdapClientIntegrity", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) }, 16, ) == 0x0
 01330   568   NtClose  (172, ... ) == 0x0
 01331   568   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\System32\mswsock.dll"}, 10480824, ... ) }, 10480824, ... ) == 0x0
 01332   568   NtQuerySystemInformation  (Basic, 44, ... {Unknown=0,MaximumIncrement=156250,PhysicalPageSize=0x1000,NumberOfPhysicalPages=0xff7c,LowestPhysicalPage=0x1,HighestPhysicalPage=0xffff,AllocationGranularity=0x10000,LowestUserAddress=0x10000,HighestUserAddress=0x7ffeffff,ActiveProcessors=1,NumberProcessors=1,}, 0x0, ) == 0x0
 01333   568   NtAllocateVirtualMemory  (-1, 0, 0, 65536, 8192, 4, ... 4063232, 65536, ) == 0x0
 01334   568   NtAllocateVirtualMemory  (-1, 4063232, 0, 4096, 4096, 4, ... 4063232, 4096, ) == 0x0
 01335   568   NtAllocateVirtualMemory  (-1, 4067328, 0, 8192, 4096, 4, ... 4067328, 8192, ) == 0x0
 01336   568   NtCreateEvent  (0x1f0003, 0x0, 1, 0, ... 172, ) == 0x0
 01337   568   NtConnectPort  ( ("\RPC Control\DNSResolver", {12, 2, 1, 1}, 0x0, 0x0, 10481112, 112, ... 176, 0x0, 0x0, 0x0, 112, ) , {12, 2, 1, 1}, 0x0, 0x0, 10481112, 112, ... 176, 0x0, 0x0, 0x0, 112, ) == 0x0
 01338   568   NtRequestWaitReplyPort  (176, {128, 152, new_msg, 0, 125868, 1310720, 10480876, 2012750850}  (176, {128, 152, new_msg, 0, 125868, 1310720, 10480876, 2012750850} "\0\363\237\0\2$\370w\370T\367w\1kwEVY\205D\237\200\364(\367\326\1)\2\0\0\0\1\0\0\0k\23\314w\4\0\0\0\20\344\314w`\17\25\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\4\0x\1\24\0x\1\24\0\0\0\0\0X\27\25\0\200\27\25\0\360\30\25\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0x\1\24\0\0\0\0\0\342\0\0\0\5\0\0\0" ... {128, 152, reply, 0, 424, 568, 1513, 0} "\7\363\237\0\2$\370w\370T\367w\1kwEVY\205D\237\200\364(\367\326\1)\2\0\0\0\1\0\0\0\0\0\0\0\4\0\0\0\20\344\314w\377\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\4\0x\1\24\0x\1\24\0\0\0\0\0X\27\25\0\200\27\25\0\360\30\25\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0x\1\24\0\0\0\0\0\342\0\0\0\5\0\0\0" )  ... {128, 152, reply, 0, 424, 568, 1513, 0}  (176, {128, 152, new_msg, 0, 125868, 1310720, 10480876, 2012750850} "\0\363\237\0\2$\370w\370T\367w\1kwEVY\205D\237\200\364(\367\326\1)\2\0\0\0\1\0\0\0k\23\314w\4\0\0\0\20\344\314w`\17\25\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\4\0x\1\24\0x\1\24\0\0\0\0\0X\27\25\0\200\27\25\0\360\30\25\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0x\1\24\0\0\0\0\0\342\0\0\0\5\0\0\0" ... {128, 152, reply, 0, 424, 568, 1513, 0} "\7\363\237\0\2$\370w\370T\367w\1kwEVY\205D\237\200\364(\367\326\1)\2\0\0\0\1\0\0\0\0\0\0\0\4\0\0\0\20\344\314w\377\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\4\0x\1\24\0x\1\24\0\0\0\0\0X\27\25\0\200\27\25\0\360\30\25\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0x\1\24\0\0\0\0\0\342\0\0\0\5\0\0\0" )  ) == 0x0
 01339   568   NtRequestWaitReplyPort  (176, {64, 88, new_msg, 0, 424, 568, 1509, 0}  (176, {64, 88, new_msg, 0, 424, 568, 1509, 0} "\1\240\0\0A\2\10\0\0\0\0\0G\3\0\0\0\0\0\0\0\0\0\0\377\377\377\377\0\0\0\0\0\0\0\0\21\0\0\0\0\0\0\0\0\0\0\0\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0" ... {52, 76, reply, 0, 424, 568, 1514, 0} "\2\213+\370\1\0+\370B\271\325\371(\273\325\371\377\377\377\377\325\316\325\371\13\353\325\371\0\0\0\0\200]\12\0\1\0\0\0\1\0\0\0\300\250|\201\377\377\377\0" )  ... {52, 76, reply, 0, 424, 568, 1514, 0}  (176, {64, 88, new_msg, 0, 424, 568, 1509, 0} "\1\240\0\0A\2\10\0\0\0\0\0G\3\0\0\0\0\0\0\0\0\0\0\377\377\377\377\0\0\0\0\0\0\0\0\21\0\0\0\0\0\0\0\0\0\0\0\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0" ... {52, 76, reply, 0, 424, 568, 1514, 0} "\2\213+\370\1\0+\370B\271\325\371(\273\325\371\377\377\377\377\325\316\325\371\13\353\325\371\0\0\0\0\200]\12\0\1\0\0\0\1\0\0\0\300\250|\201\377\377\377\0" )  ) == 0x0
 01340   568   NtClose  (172, ... ) == 0x0
 01341   568   NtClose  (176, ... ) == 0x0
 01342   568   NtCreateKey  (0x20019, {24, 48, 0x40, 0, 0,  (0x20019, {24, 48, 0x40, 0, 0, "System\CurrentControlSet\Services\Tcpip\Parameters"}, 0, "Class", 0, ... 176, 2, ) }, 0,  (0x20019, {24, 48, 0x40, 0, 0, "System\CurrentControlSet\Services\Tcpip\Parameters"}, 0, "Class", 0, ... 176, 2, ) , 0, ... 176, 2, ) == 0x0
 01343   568   NtOpenKey  (0x20019, {24, 48, 0x40, 0, 0,  (0x20019, {24, 48, 0x40, 0, 0, "System\CurrentControlSet\Services\DnsCache\Parameters"}, ... 172, ) }, ... 172, ) == 0x0
 01344   568   NtOpenKey  (0x20019, {24, 48, 0x40, 0, 0,  (0x20019, {24, 48, 0x40, 0, 0, "Software\Policies\Microsoft\Windows NT\DnsClient"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01345   568   NtQueryValueKey  (176,  (176, "Hostname", Partial, 144, ... TitleIdx=0, Type=1, Data="M\0Y\0W\0O\0R\0L\0D\0\0\0"}, 28, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (176, "Hostname", Partial, 144, ... TitleIdx=0, Type=1, Data="M\0Y\0W\0O\0R\0L\0D\0\0\0"}, 28, ) }, 28, ) == 0x0
 01346   568   NtQueryValueKey  (176,  (176, "Hostname", Partial, 144, ... TitleIdx=0, Type=1, Data="M\0Y\0W\0O\0R\0L\0D\0\0\0"}, 28, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (176, "Hostname", Partial, 144, ... TitleIdx=0, Type=1, Data="M\0Y\0W\0O\0R\0L\0D\0\0\0"}, 28, ) }, 28, ) == 0x0
 01347   568   NtClose  (176, ... ) == 0x0
 01348   568   NtClose  (172, ... ) == 0x0
 01349   568   NtCreateKey  (0x20019, {24, 48, 0x40, 0, 0,  (0x20019, {24, 48, 0x40, 0, 0, "System\CurrentControlSet\Services\Tcpip\Parameters"}, 0, "Class", 0, ... 172, 2, ) }, 0,  (0x20019, {24, 48, 0x40, 0, 0, "System\CurrentControlSet\Services\Tcpip\Parameters"}, 0, "Class", 0, ... 172, 2, ) , 0, ... 172, 2, ) == 0x0
 01350   568   NtOpenKey  (0x20019, {24, 48, 0x40, 0, 0,  (0x20019, {24, 48, 0x40, 0, 0, "System\CurrentControlSet\Services\DnsCache\Parameters"}, ... 176, ) }, ... 176, ) == 0x0
 01351   568   NtOpenKey  (0x20019, {24, 48, 0x40, 0, 0,  (0x20019, {24, 48, 0x40, 0, 0, "Software\Policies\Microsoft\Windows NT\DnsClient"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01352   568   NtQueryValueKey  (172,  (172, "Domain", Partial, 144, ... TitleIdx=0, Type=1, Data="\0\0"}, 14, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (172, "Domain", Partial, 144, ... TitleIdx=0, Type=1, Data="\0\0"}, 14, ) }, 14, ) == 0x0
 01353   568   NtQueryValueKey  (172,  (172, "Domain", Partial, 144, ... TitleIdx=0, Type=1, Data="\0\0"}, 14, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (172, "Domain", Partial, 144, ... TitleIdx=0, Type=1, Data="\0\0"}, 14, ) }, 14, ) == 0x0
 01354   568   NtClose  (172, ... ) == 0x0
 01355   568   NtClose  (176, ... ) == 0x0
 01356   568   NtWaitForSingleObject  (112, 0, {0, 0}, ... ) == 0x102
 01357   568   NtAllocateVirtualMemory  (-1, 1384448, 0, 4096, 4096, 4, ... 1384448, 4096, ) == 0x0
 01358   568   NtCreateEvent  (0x1f0003, 0x0, 1, 0, ... 176, ) == 0x0
 01359   568   NtConnectPort  ( ("\RPC Control\DNSResolver", {12, 2, 1, 1}, 0x0, 0x0, 10480912, 112, ... 172, 0x0, 0x0, 0x0, 112, ) , {12, 2, 1, 1}, 0x0, 0x0, 10480912, 112, ... 172, 0x0, 0x0, 0x0, 112, ) == 0x0
 01360   568   NtRequestWaitReplyPort  (172, {128, 152, new_msg, 0, 125668, 1310720, 10480676, 2012750850}  (172, {128, 152, new_msg, 0, 125668, 1310720, 10480676, 2012750850} "\0\362\237\0\2$\370w\370T\367w\1kwEVY\205D\237\200\364(\367\326\1)\2\0\0\0\1\0\0\0k\23\314w\4\0\0\0\20\344\314w`\17\25\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\5\0\0\0\0\0\240\1\24\0\240\1\24\0\224\357\237\0\370\370\24\0 \33\25\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\17.\365w\0\0\0\0\5\0\0\0\5\0\0\0" ... {128, 152, reply, 0, 424, 568, 1517, 0} "\7\362\237\0\2$\370w\370T\367w\1kwEVY\205D\237\200\364(\367\326\1)\2\0\0\0\1\0\0\0\0\0\0\0\4\0\0\0\20\344\314w\377\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\5\0\0\0\0\0\240\1\24\0\240\1\24\0\224\357\237\0\370\370\24\0 \33\25\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\17.\365w\0\0\0\0\5\0\0\0\5\0\0\0" )  ... {128, 152, reply, 0, 424, 568, 1517, 0}  (172, {128, 152, new_msg, 0, 125668, 1310720, 10480676, 2012750850} "\0\362\237\0\2$\370w\370T\367w\1kwEVY\205D\237\200\364(\367\326\1)\2\0\0\0\1\0\0\0k\23\314w\4\0\0\0\20\344\314w`\17\25\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\5\0\0\0\0\0\240\1\24\0\240\1\24\0\224\357\237\0\370\370\24\0 \33\25\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\17.\365w\0\0\0\0\5\0\0\0\5\0\0\0" ... {128, 152, reply, 0, 424, 568, 1517, 0} "\7\362\237\0\2$\370w\370T\367w\1kwEVY\205D\237\200\364(\367\326\1)\2\0\0\0\1\0\0\0\0\0\0\0\4\0\0\0\20\344\314w\377\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\5\0\0\0\0\0\240\1\24\0\240\1\24\0\224\357\237\0\370\370\24\0 \33\25\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\17.\365w\0\0\0\0\5\0\0\0\5\0\0\0" )  ) == 0x0
 01361   568   NtRequestWaitReplyPort  (172, {64, 88, new_msg, 0, 424, 568, 1514, 0}  (172, {64, 88, new_msg, 0, 424, 568, 1514, 0} "\1\213\0\0A\2\10\0B\271\325\371(\273\325\371\377\377\377\377\325\316\325\371\377\377\377\377\0\0\0\0\0\0\0\0\21\0\0\0\0\0\0\0\0\0\0\0\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0" ... {52, 76, reply, 0, 424, 568, 1518, 0} "\2\213+\370\1\0+\370B\271\325\371(\273\325\371\377\377\377\377\325\316\325\371\13\353\325\371\0\0\0\0\200]\12\0\1\0\0\0\1\0\0\0\300\250|\201\377\377\377\0" )  ... {52, 76, reply, 0, 424, 568, 1518, 0}  (172, {64, 88, new_msg, 0, 424, 568, 1514, 0} "\1\213\0\0A\2\10\0B\271\325\371(\273\325\371\377\377\377\377\325\316\325\371\377\377\377\377\0\0\0\0\0\0\0\0\21\0\0\0\0\0\0\0\0\0\0\0\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0" ... {52, 76, reply, 0, 424, 568, 1518, 0} "\2\213+\370\1\0+\370B\271\325\371(\273\325\371\377\377\377\377\325\316\325\371\13\353\325\371\0\0\0\0\200]\12\0\1\0\0\0\1\0\0\0\300\250|\201\377\377\377\0" )  ) == 0x0
 01362   568   NtClose  (176, ... ) == 0x0
 01363   568   NtClose  (172, ... ) == 0x0
 01364   568   NtCreateKey  (0x20019, {24, 48, 0x40, 0, 0,  (0x20019, {24, 48, 0x40, 0, 0, "System\CurrentControlSet\Services\Tcpip\Parameters"}, 0, "Class", 0, ... 172, 2, ) }, 0,  (0x20019, {24, 48, 0x40, 0, 0, "System\CurrentControlSet\Services\Tcpip\Parameters"}, 0, "Class", 0, ... 172, 2, ) , 0, ... 172, 2, ) == 0x0
 01365   568   NtOpenKey  (0x20019, {24, 48, 0x40, 0, 0,  (0x20019, {24, 48, 0x40, 0, 0, "System\CurrentControlSet\Services\DnsCache\Parameters"}, ... 176, ) }, ... 176, ) == 0x0
 01366   568   NtOpenKey  (0x20019, {24, 48, 0x40, 0, 0,  (0x20019, {24, 48, 0x40, 0, 0, "Software\Policies\Microsoft\Windows NT\DnsClient"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01367   568   NtQueryValueKey  (172,  (172, "Hostname", Partial, 144, ... TitleIdx=0, Type=1, Data="M\0Y\0W\0O\0R\0L\0D\0\0\0"}, 28, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (172, "Hostname", Partial, 144, ... TitleIdx=0, Type=1, Data="M\0Y\0W\0O\0R\0L\0D\0\0\0"}, 28, ) }, 28, ) == 0x0
 01368   568   NtQueryValueKey  (172,  (172, "Hostname", Partial, 144, ... TitleIdx=0, Type=1, Data="M\0Y\0W\0O\0R\0L\0D\0\0\0"}, 28, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (172, "Hostname", Partial, 144, ... TitleIdx=0, Type=1, Data="M\0Y\0W\0O\0R\0L\0D\0\0\0"}, 28, ) }, 28, ) == 0x0
 01369   568   NtClose  (172, ... ) == 0x0
 01370   568   NtClose  (176, ... ) == 0x0
 01371   568   NtCreateKey  (0x20019, {24, 48, 0x40, 0, 0,  (0x20019, {24, 48, 0x40, 0, 0, "System\CurrentControlSet\Services\Tcpip\Parameters"}, 0, "Class", 0, ... 176, 2, ) }, 0,  (0x20019, {24, 48, 0x40, 0, 0, "System\CurrentControlSet\Services\Tcpip\Parameters"}, 0, "Class", 0, ... 176, 2, ) , 0, ... 176, 2, ) == 0x0
 01372   568   NtOpenKey  (0x20019, {24, 48, 0x40, 0, 0,  (0x20019, {24, 48, 0x40, 0, 0, "System\CurrentControlSet\Services\DnsCache\Parameters"}, ... 172, ) }, ... 172, ) == 0x0
 01373   568   NtOpenKey  (0x20019, {24, 48, 0x40, 0, 0,  (0x20019, {24, 48, 0x40, 0, 0, "Software\Policies\Microsoft\Windows NT\DnsClient"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01374   568   NtQueryValueKey  (176,  (176, "Domain", Partial, 144, ... TitleIdx=0, Type=1, Data="\0\0"}, 14, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (176, "Domain", Partial, 144, ... TitleIdx=0, Type=1, Data="\0\0"}, 14, ) }, 14, ) == 0x0
 01375   568   NtQueryValueKey  (176,  (176, "Domain", Partial, 144, ... TitleIdx=0, Type=1, Data="\0\0"}, 14, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (176, "Domain", Partial, 144, ... TitleIdx=0, Type=1, Data="\0\0"}, 14, ) }, 14, ) == 0x0
 01376   568   NtClose  (176, ... ) == 0x0
 01377   568   NtClose  (172, ... ) == 0x0
 01378   568   NtOpenKey  (0x2000000, {24, 48, 0x40, 0, 0,  (0x2000000, {24, 48, 0x40, 0, 0, "System\CurrentControlSet\Services\WinSock2\Parameters"}, ... 172, ) }, ... 172, ) == 0x0
 01379   568   NtQueryValueKey  (172,  (172, "WinSock_Registry_Version", Partial, 144, ... TitleIdx=0, Type=1, Data="2\0.\00\0\0\0"}, 20, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (172, "WinSock_Registry_Version", Partial, 144, ... TitleIdx=0, Type=1, Data="2\0.\00\0\0\0"}, 20, ) }, 20, ) == 0x0
 01380   568   NtQueryValueKey  (172,  (172, "WinSock_Registry_Version", Partial, 144, ... TitleIdx=0, Type=1, Data="2\0.\00\0\0\0"}, 20, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (172, "WinSock_Registry_Version", Partial, 144, ... TitleIdx=0, Type=1, Data="2\0.\00\0\0\0"}, 20, ) }, 20, ) == 0x0
 01381   568   NtQueryValueKey  (172,  (172, "AutodialDLL", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01382   568   NtClose  (172, ... ) == 0x0
 01383   568   NtOpenSection  (0xe, {24, 8, 0x40, 0, 0,  (0xe, {24, 8, 0x40, 0, 0, "rasadhlp.dll"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01384   568   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\u:\work\rasadhlp.dll"}, 10481816, ... ) }, 10481816, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01385   568   NtQueryAttributesFile  ({24, 12, 0x40, 0, 0,  ({24, 12, 0x40, 0, 0, "rasadhlp.dll"}, 10481816, ... ) }, 10481816, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01386   568   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\System32\rasadhlp.dll"}, 10481816, ... ) }, 10481816, ... ) == 0x0
 01387   568   NtOpenFile  (0x100020, {24, 0, 0x40, 0, 0,  (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\System32\rasadhlp.dll"}, 5, 96, ... 172, {status=0x0, info=1}, ) }, 5, 96, ... 172, {status=0x0, info=1}, ) == 0x0
 01388   568   NtCreateSection  (0xf, 0x0, 0x0, 16, 16777216, 172, ... 176, ) == 0x0
 01389   568   NtQuerySection  (176, Image, 48, ... {section info, class 1, size 48}, 0x0, ) == 0x0
 01390   568   NtClose  (172, ... ) == 0x0
 01391   568   NtMapViewOfSection  (176, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x76fc0000), 0x0, 20480, ) == 0x0
 01392   568   NtClose  (176, ... ) == 0x0
 01393   568   NtCreateFile  (0x3, {24, 0, 0x40, 0, 0,  (0x3, {24, 0, 0x40, 0, 0, "\Device\RasAcd"}, 0x0, 128, 3, 3, 0, 0, 0, ... 176, {status=0x0, info=0}, ) }, 0x0, 128, 3, 3, 0, 0, 0, ... 176, {status=0x0, info=0}, ) == 0x0
 01394   568   NtCreateEvent  (0x1f0003, 0x0, 1, 0, ... 172, ) == 0x0
 01395   568   NtDeviceIoControlFile  (176, 172, 0x0, 0x0, 0xf14014,  (176, 172, 0x0, 0x0, 0xf14014, "\3\0\0\0MYWORLD\0\20\0\0\0\0\360\375\177h\2\374v\1\0\0\0\340\361\237\0D\365\237\0D\365\237\0\2$\370w\310j\367w\377\377\377\377\364j\365w$P\374w`i\365w\0\0\0\0\10\0\25\300\0\0\0\0\10\6\24\0@.$\0\254\36$\0\210/$\0\0\320\375\177\24\232\347wS\16\26\0\200\17\25\0\216\17\25\0T\16\25\0x/$\0\30\0\26\2\20\363\237\0\20\363\237\0r\0a\0s\0a\0d\0h\0l\0p\0.\0d\0l\0l\0\0\0\0\0T\16\25\0\377\377\0\0\1\0\0\0\370\24\25\0\240\31\25\0 \0\0\0\0\0\0\0\210\1\24\0\230\31\25\0\0\0\0\0\0\0\0\0\0\0\0\0\365<\245qH\16\25\04\16\25\0\2\0\0\0\20\0\0\0\0\0\0\0\0\0\0\0\20\0\0\0\260\31\1\1\0\0\24\0\340\362\237\0\300\367\237\0\334\377\237\0\2$\370w\370T\367wa/\245q\2642\250q\0\0\0\0\0\0\0\0:/\245q\260\31\25\0\210\350\24\0@\203\24\0X\203\24\0\200\17\25\0\216\17\25\0T\16\25\0\377\377\0\0\0\0\0\0T\16\25\0\7\0\0\0\200\17\25\0\20\364\237\0\177;\245q\0\0\0\0\0\0\0\0\200\17\25\0\0\0\0\0T\16\25\0\377\377\0\0\1\0\0\0\230\1\24\0\350\24\25\0\20\0\0\0\0\0\0\0\230\1\24\0\340\24\25\0\0\0\0\0\0\0\0\0\0\0\0\0\365<\245qH\16\25\04\16\25\0\4\0\0\0\20\0\0\0\0\0\0\0\0\0\0\0\20\0\0\0\240\247\1\1\0\0\24\0\250\363\237\0\210\370\237\0\334\377\237\0\2$\370w\370T\367wa/\245q\2642\250q\0\0\0\0\0\0\0\0:/\245q\240\247\24\0\210\350\24\0@\203\24\0", 1552, 0, ... {status=0x0, info=0}, 0x0, ) , 1552, 0, ... {status=0x0, info=0}, 0x0, ) == 0x0
 01396   568   NtClose  (172, ... ) == 0x0
 01397   568   NtClose  (176, ... ) == 0x0
 01398   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12003,  (144, 140, 0x0, 0x0, 0x12003, "\0\0\0\0\1\0\0\0\16\0\2\0,\354\300\250|\201\0\0\0\0\0\0\0\0", 26, 26, ... {status=0x0, info=176}, "\1\0\0\0\1\0\0\0\16\0\2\0\0\0\300\250|\201\0\0\0\0\0\0\0\0", ) , 26, 26, ... {status=0x0, info=176},  (144, 140, 0x0, 0x0, 0x12003, "\0\0\0\0\1\0\0\0\16\0\2\0,\354\300\250|\201\0\0\0\0\0\0\0\0", 26, 26, ... {status=0x0, info=176}, "\1\0\0\0\1\0\0\0\16\0\2\0\0\0\300\250|\201\0\0\0\0\0\0\0\0", ) , ) == 0x0
 01399   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12037,  (144, 140, 0x0, 0x0, 0x12037, "\2\0\0\0", 4, 8, ... {status=0x0, info=8}, "\0\0\0\0\0\0\0\0", ) , 4, 8, ... {status=0x0, info=8},  (144, 140, 0x0, 0x0, 0x12037, "\2\0\0\0", 4, 8, ... {status=0x0, info=8}, "\0\0\0\0\0\0\0\0", ) , ) == 0x0
 01400   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12047,  (144, 140, 0x0, 0x0, 0x12047, "\1\0\0\0\2\0\0\0\3\0\0\0\0\0\0\0\20\0\0\0\20\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0 \0\0\0 \0\0\0\0\0\0\1\0\0\0\353\3\0\0\11\6\2\0\14\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0h\0\0\0\0\0\0\0\2\0\0\0\300\250|\201\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\3\0\0\0\0\0\0\0\0 \0\0\1\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\1\0\0\0\1\0\0\0\0\0\0 \0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0", 248, 0, ... {status=0x0, info=0}, 0x0, ) , 248, 0, ... {status=0x0, info=0}, 0x0, ) == 0x0
 01401   568   NtDeviceIoControlFile  (176, 0, 0x0, 0x0, 0x120028,  (176, 0, 0x0, 0x0, 0x120028, "\1\4\0\0\0\0\0\0\0\2\0\0\0\2\0\0\15\0\0\0\4\0\0\0\1\0\0\00}\0\0", 32, 0, ... {status=0x0, info=0}, 0x0, ) , 32, 0, ... {status=0x0, info=0}, 0x0, ) == 0x0
 01402   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=0}, 0x0, ) , 16, 0, ... {status=0x103, info=0}, 0x0, ) == 0x103
 01403   568   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 01404   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=78}, 0x0, ) , 16, 0, ... {status=0x103, info=78}, 0x0, ) == 0x103
 01405   568   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 01406   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=40}, 0x0, ) , 16, 0, ... {status=0x103, info=40}, 0x0, ) == 0x103
 01407   568   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 01408   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=96}, 0x0, ) , 16, 0, ... {status=0x103, info=96}, 0x0, ) == 0x103
 01409   568   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 01410   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=81}, 0x0, ) , 16, 0, ... {status=0x0, info=81}, 0x0, ) == 0x0
 01411   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 01412   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 01413   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 01414   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=128}, 0x0, ) , 16, 0, ... {status=0x0, info=128}, 0x0, ) == 0x0
 01415   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 01416   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 01417   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 01418   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 01419   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 01420   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 01421   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 01422   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 01423   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 01424   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 01425   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 01426   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 01427   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 01428   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 01429   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 01430   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 01431   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 01432   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 01433   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 01434   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 01435   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 01436   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 01437   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 01438   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 01439   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 01440   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 01441   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 01442   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 01443   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 01444   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 01445   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 01446   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 01447   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 01448   568   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 01449   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 01450   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 01451   568   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 01452   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 01453   568   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 01454   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 01455   568   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 01456   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 01457   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 01458   568   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 01459   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 01460   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 01461   568   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 01462   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 01463   568   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 01464   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 01465   568   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 01466   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 01467   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 01468   568   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 01469   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 01470   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 01471   568   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 01472   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 01473   568   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 01474   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 01475   568   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 01476   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 01477   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 01478   568   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 01479   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 01480   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 01481   568   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 01482   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 01483   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 01484   568   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 01485   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 01486   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 01487   568   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 01488   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 01489   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 01490   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 01491   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 01492   568   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 01493   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 01494   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 01495   568   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 01496   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 01497   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 01498   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 01499   568   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 01500   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 01501   568   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 01502   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 01503   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 01504   568   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 01505   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 01506   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 01507   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 01508   568   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 01509   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 01510   568   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 01511   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 01512   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 01513   568   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 01514   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 01515   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 01516   568   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 01517   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 01518   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 01519   568   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 01520   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 01521   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 01522   568   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 01523   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 01524   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 01525   568   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 01526   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 01527   568   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 01528   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 01529   568   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 01530   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 01531   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 01532   568   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 01533   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 01534   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 01535   568   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 01536   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 01537   568   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 01538   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 01539   568   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 01540   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 01541   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 01542   568   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 01543   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 01544   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 01545   568   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 01546   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 01547   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 01548   568   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 01549   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 01550   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 01551   568   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 01552   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 01553   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 01554   568   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 01555   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 01556   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 01557   568   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 01558   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 01559   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 01560   568   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 01561   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 01562   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 01563   568   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 01564   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 01565   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 01566   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 01567   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 01568   568   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 01569   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 01570   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 01571   568   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 01572   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 01573   568   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 01574   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 01575   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 01576   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 01577   568   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 01578   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 01579   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 01580   568   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 01581   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 01582   568   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 01583   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 01584   568   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 01585   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 01586   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 01587   568   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 01588   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 01589   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 01590   568   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 01591   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 01592   568   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 01593   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 01594   568   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 01595   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 01596   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 01597   568   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 01598   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 01599   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 01600   568   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 01601   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 01602   568   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 01603   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 01604   568   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 01605   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 01606   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 01607   568   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 01608   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 01609   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 01610   568   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 01611   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 01612   568   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 01613   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 01614   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 01615   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 01616   568   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 01617   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 01618   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 01619   568   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 01620   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 01621   568   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 01622   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 01623   568   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 01624   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 01625   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 01626   568   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 01627   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 01628   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 01629   568   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 01630   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 01631   568   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 01632   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 01633   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 01634   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 01635   568   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 01636   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 01637   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 01638   568   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 01639   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 01640   568   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 01641   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 01642   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 01643   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 01644   568   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 01645   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 01646   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 01647   568   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 01648   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 01649   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 01650   568   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 01651   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 01652   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 01653   568   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 01654   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 01655   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 01656   568   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 01657   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 01658   568   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 01659   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 01660   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 01661   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 01662   568   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 01663   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 01664   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 01665   568   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 01666   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 01667   568   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 01668   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 01669   568   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 01670   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 01671   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 01672   568   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 01673   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 01674   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 01675   568   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 01676   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 01677   568   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 01678   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 01679   568   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 01680   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 01681   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 01682   568   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 01683   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 01684   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 01685   568   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 01686   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 01687   568   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 01688   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 01689   568   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 01690   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 01691   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 01692   568   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 01693   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 01694   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 01695   568   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 01696   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 01697   568   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 01698   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 01699   568   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 01700   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 01701   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 01702   568   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 01703   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 01704   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 01705   568   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 01706   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 01707   568   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 01708   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 01709   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 01710   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 01711   568   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 01712   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 01713   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 01714   568   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 01715   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 01716   568   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 01717   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 01718   568   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 01719   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 01720   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 01721   568   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 01722   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 01723   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 01724   568   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 01725   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 01726   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 01727   568   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 01728   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 01729   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 01730   568   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 01731   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 01732   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 01733   568   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 01734   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 01735   568   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 01736   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 01737   568   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 01738   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 01739   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 01740   568   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 01741   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 01742   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 01743   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 01744   568   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 01745   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 01746   568   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 01747   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 01748   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 01749   568   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 01750   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 01751   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 01752   568   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 01753   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 01754   568   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 01755   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 01756   568   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 01757   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 01758   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 01759   568   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 01760   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 01761   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 01762   568   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 01763   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 01764   568   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 01765   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 01766   568   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 01767   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 01768   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 01769   568   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 01770   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 01771   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 01772   568   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 01773   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 01774   568   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 01775   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 01776   568   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 01777   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 01778   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 01779   568   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 01780   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 01781   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 01782   568   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 01783   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 01784   568   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 01785   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 01786   568   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 01787   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 01788   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 01789   568   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 01790   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 01791   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 01792   568   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 01793   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 01794   568   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 01795   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 01796   568   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 01797   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 01798   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 01799   568   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 01800   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 01801   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 01802   568   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 01803   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 01804   568   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 01805   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 01806   568   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 01807   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 01808   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 01809   568   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 01810   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 01811   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 01812   568   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 01813   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 01814   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 01815   568   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 01816   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 01817   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 01818   568   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 01819   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 01820   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 01821   568   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 01822   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 01823   568   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 01824   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 01825   568   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 01826   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 01827   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 01828   568   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 01829   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 01830   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 01831   568   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 01832   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 01833   568   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 01834   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 01835   568   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 01836   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 01837   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 01838   568   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 01839   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 01840   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 01841   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 01842   568   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 01843   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 01844   568   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 01845   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 01846   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 01847   568   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 01848   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 01849   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 01850   568   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 01851   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 01852   568   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 01853   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 01854   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 01855   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 01856   568   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 01857   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 01858   568   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 01859   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=78}, 0x0, ) , 16, 0, ... {status=0x103, info=78}, 0x0, ) == 0x103
 01860   568   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x102
 01861   568   NtQuerySystemTime  (... {-1616085048, 29868087}, ) == 0x0
 01862   568   NtWaitForSingleObject  (140, 1, {-1, 2147483647}, ... ) == 0x0
 01863   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=78}, 0x0, ) , 16, 0, ... {status=0x103, info=78}, 0x0, ) == 0x103
 01864   568   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 01865   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 01866   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 01867   568   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ...
 01131   436   NtUserGetMessage  ... {0x200b2, WM_TIMER, 0x65, 0x0, 0x6dec, {512, 384}}, ) == 0x1
 01868   436   NtQueryValueKey  (76,  (76, "FromCacheTimeout", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01869   436   NtQueryValueKey  (76,  (76, "SecureProtocols", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01870   436   NtQueryValueKey  (76,  (76, "CertificateRevocation", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01871   436   NtQueryValueKey  (76,  (76, "DisableKeepAlive", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01872   436   NtQueryValueKey  (76,  (76, "DisablePassport", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01873   436   NtQueryValueKey  (76,  (76, "CacheMode", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01874   436   NtQueryValueKey  (76,  (76, "EnableHttp1_1", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (76, "EnableHttp1_1", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) }, 16, ) == 0x0
 01875   436   NtQueryValueKey  (76,  (76, "ProxyHttp1.1", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01876   436   NtQueryValueKey  (76,  (76, "EnableNegotiate", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (76, "EnableNegotiate", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) }, 16, ) == 0x0
 01877   436   NtOpenSection  (0xe, {24, 8, 0x40, 0, 0,  (0xe, {24, 8, 0x40, 0, 0, "Secur32.dll"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01878   436   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\u:\work\Secur32.dll"}, 1239992, ... }, 1239992, ...
 01867   568   NtWaitForSingleObject  ... ) == 0x0
 01879   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=79}, 0x0, ) , 16, 0, ... {status=0x103, info=79}, 0x0, ) == 0x103
 01880   568   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ...
 01878   436   NtQueryAttributesFile  ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01881   436   NtQueryAttributesFile  ({24, 12, 0x40, 0, 0,  ({24, 12, 0x40, 0, 0, "Secur32.dll"}, 1239992, ... }, 1239992, ...
 01880   568   NtWaitForSingleObject  ... ) == 0x0
 01882   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=79}, 0x0, ) , 16, 0, ... {status=0x103, info=79}, 0x0, ) == 0x103
 01883   568   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ...
 01881   436   NtQueryAttributesFile  ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01884   436   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\System32\Secur32.dll"}, 1239992, ... ) }, 1239992, ... ) == 0x0
 01885   436   NtOpenFile  (0x100020, {24, 0, 0x40, 0, 0,  (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\System32\Secur32.dll"}, 5, 96, ... 172, {status=0x0, info=1}, ) }, 5, 96, ... 172, {status=0x0, info=1}, ) == 0x0
 01886   436   NtCreateSection  (0xf, 0x0, 0x0, 16, 16777216, 172, ... 180, ) == 0x0
 01887   436   NtQuerySection  (180, Image, 48, ... {section info, class 1, size 48}, 0x0, ) == 0x0
 01888   436   NtClose  (172, ... ) == 0x0
 01889   436   NtMapViewOfSection  (180, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x76f90000), 0x0, 65536, ) == 0x0
 01890   436   NtClose  (180, ... ) == 0x0
 01891   436   NtCreateSemaphore  (0x100003, 0x0, 0, 2147483647, ... 180, ) == 0x0
 01892   436   NtCreateSemaphore  (0x100003, 0x0, 0, 2147483647, ... 172, ) == 0x0
 01893   436   NtOpenEvent  (0x1, {24, 0, 0x40, 0, 0,  (0x1, {24, 0, 0x40, 0, 0, "\SECURITY\LSA_AUTHENTICATION_INITIALIZED"}, ... 184, ) }, ... 184, ) == 0x0
 01894   436   NtQueryEvent  (184, Basic, 8, ... {EventType=0,SignalState=1,}, 0x0, ) == 0x0
 01895   436   NtClose  (184, ... ) == 0x0
 01896   436   NtConnectPort  ( ("\LsaAuthenticationPort", {12, 2, 1, 0}, 0x0, 0x0, 1241476, 140, ... 184, 0x0, 0x0, 256, 140, ) , {12, 2, 1, 0}, 0x0, 0x0, 1241476, 140, ... 184, 0x0, 0x0, 256, 140, ) == 0x0
 01897   436   NtRequestWaitReplyPort  (184, {28, 52, new_msg, 0, 0, 0, 0, 0}  (184, {28, 52, new_msg, 0, 0, 0, 0, 0} "\37\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\1\0\13\30\10\2\260\361\24\0" ... {176, 200, reply, 0, 424, 436, 1522, 0} "\37\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\1\0\20\0\10\2\220\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0S\0R\0I\0-\0u\0s\0e\0r\0" )  ... {176, 200, reply, 0, 424, 436, 1522, 0}  (184, {28, 52, new_msg, 0, 0, 0, 0, 0} "\37\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\1\0\13\30\10\2\260\361\24\0" ... {176, 200, reply, 0, 424, 436, 1522, 0} "\37\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\1\0\20\0\10\2\220\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0S\0R\0I\0-\0u\0s\0e\0r\0" )  ) == 0x0
 01898   436   NtQueryValueKey  (76,  (76, "SyncMode5", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01899   436   NtOpenKey  (0xf, {24, 48, 0x40, 0, 0,  (0xf, {24, 48, 0x40, 0, 0, "Software\Microsoft\Windows\CurrentVersion\Internet Settings\Cache"}, ... 188, ) }, ... 188, ) == 0x0
 01900   436   NtQueryValueKey  (188,  (188, "FixupKey", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01901   436   NtClose  (188, ... ) == 0x0
 01902   436   NtOpenKey  (0xf, {24, 48, 0x40, 0, 0,  (0xf, {24, 48, 0x40, 0, 0, "Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache"}, ... 188, ) }, ... 188, ) == 0x0
 01903   436   NtQueryValueKey  (188,  (188, "SessionStartTimeDefaultDeltaSecs", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01904   436   NtClose  (188, ... ) == 0x0
 01905   436   NtOpenKey  (0xf, {24, 48, 0x40, 0, 0,  (0xf, {24, 48, 0x40, 0, 0, "Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache"}, ... 188, ) }, ... 188, ) == 0x0
 01906   436   NtOpenKey  (0x20019, {24, 48, 0x40, 0, 0,  (0x20019, {24, 48, 0x40, 0, 0, "System\Setup"}, ... 192, ) }, ... 192, ) == 0x0
 01907   436   NtQueryValueKey  (192,  (192, "SystemSetupInProgress", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (192, "SystemSetupInProgress", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) }, 16, ) == 0x0
 01908   436   NtClose  (192, ... ) == 0x0
 01909   436   NtOpenKey  (0xf, {24, 60, 0x40, 0, 0,  (0xf, {24, 60, 0x40, 0, 0, "Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders"}, ... 192, ) }, ... 192, ) == 0x0
 01910   436   NtOpenKey  (0xf, {24, 60, 0x40, 0, 0,  (0xf, {24, 60, 0x40, 0, 0, "Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache"}, ... 196, ) }, ... 196, ) == 0x0
 01911   436   NtOpenKey  (0xf, {24, 60, 0x40, 0, 0,  (0xf, {24, 60, 0x40, 0, 0, "Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders"}, ... 200, ) }, ... 200, ) == 0x0
 01912   436   NtOpenKey  (0xf, {24, 60, 0x40, 0, 0,  (0xf, {24, 60, 0x40, 0, 0, "Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache"}, ... 204, ) }, ... 204, ) == 0x0
 01913   436   NtQueryValueKey  (204,  (204, "Signature", Partial, 144, ... TitleIdx=0, Type=1, Data="C\0l\0i\0e\0n\0t\0 \0U\0r\0l\0C\0a\0c\0h\0e\0 \0M\0M\0F\0 \0V\0e\0r\0 \05\0.\02\0\0\0"}, 68, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (204, "Signature", Partial, 144, ... TitleIdx=0, Type=1, Data="C\0l\0i\0e\0n\0t\0 \0U\0r\0l\0C\0a\0c\0h\0e\0 \0M\0M\0F\0 \0V\0e\0r\0 \05\0.\02\0\0\0"}, 68, ) }, 68, ) == 0x0
 01914   436   NtQueryValueKey  (204,  (204, "Signature", Partial, 144, ... TitleIdx=0, Type=1, Data="C\0l\0i\0e\0n\0t\0 \0U\0r\0l\0C\0a\0c\0h\0e\0 \0M\0M\0F\0 \0V\0e\0r\0 \05\0.\02\0\0\0"}, 68, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (204, "Signature", Partial, 144, ... TitleIdx=0, Type=1, Data="C\0l\0i\0e\0n\0t\0 \0U\0r\0l\0C\0a\0c\0h\0e\0 \0M\0M\0F\0 \0V\0e\0r\0 \05\0.\02\0\0\0"}, 68, ) }, 68, ) == 0x0
 01915   436   NtClose  (204, ... ) == 0x0
 01916   436   NtOpenKey  (0xf, {24, 60, 0x40, 0, 0,  (0xf, {24, 60, 0x40, 0, 0, "Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders"}, ... 204, ) }, ... 204, ) == 0x0
 01917   436   NtQueryValueKey  (204,  (204, "Cache", Partial, 144, ... TitleIdx=0, Type=2, Data="%\0U\0S\0E\0R\0P\0R\0O\0F\0I\0L\0E\0%\0\\0L\0o\0c\0a\0l\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0T\0e\0m\0p\0o\0r\0a\0r\0y\0 \0I\0n\0t\0e\0r\0n\0e\0t\0 \0F\0i\0l\0e\0s\0\0\0"}, 120, ) , Partial, 144, ... TitleIdx=0, Type=2, Data= (204, "Cache", Partial, 144, ... TitleIdx=0, Type=2, Data="%\0U\0S\0E\0R\0P\0R\0O\0F\0I\0L\0E\0%\0\\0L\0o\0c\0a\0l\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0T\0e\0m\0p\0o\0r\0a\0r\0y\0 \0I\0n\0t\0e\0r\0n\0e\0t\0 \0F\0i\0l\0e\0s\0\0\0"}, 120, ) }, 120, ) == 0x0
 01918   436   NtQueryValueKey  (204,  (204, "Cache", Partial, 144, ... TitleIdx=0, Type=2, Data="%\0U\0S\0E\0R\0P\0R\0O\0F\0I\0L\0E\0%\0\\0L\0o\0c\0a\0l\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0T\0e\0m\0p\0o\0r\0a\0r\0y\0 \0I\0n\0t\0e\0r\0n\0e\0t\0 \0F\0i\0l\0e\0s\0\0\0"}, 120, ) , Partial, 144, ... TitleIdx=0, Type=2, Data= (204, "Cache", Partial, 144, ... TitleIdx=0, Type=2, Data="%\0U\0S\0E\0R\0P\0R\0O\0F\0I\0L\0E\0%\0\\0L\0o\0c\0a\0l\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0T\0e\0m\0p\0o\0r\0a\0r\0y\0 \0I\0n\0t\0e\0r\0n\0e\0t\0 \0F\0i\0l\0e\0s\0\0\0"}, 120, ) }, 120, ) == 0x0
 01919   436   NtQueryValueKey  (204,  (204, "Cookies", Partial, 144, ... TitleIdx=0, Type=2, Data="%\0U\0S\0E\0R\0P\0R\0O\0F\0I\0L\0E\0%\0\\0C\0o\0o\0k\0i\0e\0s\0\0\0"}, 56, ) , Partial, 144, ... TitleIdx=0, Type=2, Data= (204, "Cookies", Partial, 144, ... TitleIdx=0, Type=2, Data="%\0U\0S\0E\0R\0P\0R\0O\0F\0I\0L\0E\0%\0\\0C\0o\0o\0k\0i\0e\0s\0\0\0"}, 56, ) }, 56, ) == 0x0
 01920   436   NtQueryValueKey  (204,  (204, "Cookies", Partial, 144, ... TitleIdx=0, Type=2, Data="%\0U\0S\0E\0R\0P\0R\0O\0F\0I\0L\0E\0%\0\\0C\0o\0o\0k\0i\0e\0s\0\0\0"}, 56, ) , Partial, 144, ... TitleIdx=0, Type=2, Data= (204, "Cookies", Partial, 144, ... TitleIdx=0, Type=2, Data="%\0U\0S\0E\0R\0P\0R\0O\0F\0I\0L\0E\0%\0\\0C\0o\0o\0k\0i\0e\0s\0\0\0"}, 56, ) }, 56, ) == 0x0
 01921   436   NtQueryValueKey  (204,  (204, "History", Partial, 144, ... TitleIdx=0, Type=2, Data="%\0U\0S\0E\0R\0P\0R\0O\0F\0I\0L\0E\0%\0\\0L\0o\0c\0a\0l\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0H\0i\0s\0t\0o\0r\0y\0\0\0"}, 86, ) , Partial, 144, ... TitleIdx=0, Type=2, Data= (204, "History", Partial, 144, ... TitleIdx=0, Type=2, Data="%\0U\0S\0E\0R\0P\0R\0O\0F\0I\0L\0E\0%\0\\0L\0o\0c\0a\0l\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0H\0i\0s\0t\0o\0r\0y\0\0\0"}, 86, ) }, 86, ) == 0x0
 01922   436   NtQueryValueKey  (204,  (204, "History", Partial, 144, ... TitleIdx=0, Type=2, Data="%\0U\0S\0E\0R\0P\0R\0O\0F\0I\0L\0E\0%\0\\0L\0o\0c\0a\0l\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0H\0i\0s\0t\0o\0r\0y\0\0\0"}, 86, ) , Partial, 144, ... TitleIdx=0, Type=2, Data= (204, "History", Partial, 144, ... TitleIdx=0, Type=2, Data="%\0U\0S\0E\0R\0P\0R\0O\0F\0I\0L\0E\0%\0\\0L\0o\0c\0a\0l\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0H\0i\0s\0t\0o\0r\0y\0\0\0"}, 86, ) }, 86, ) == 0x0
 01923   436   NtClose  (204, ... ) == 0x0
 01924   436   NtOpenKey  (0xf, {24, 196, 0x40, 0, 0,  (0xf, {24, 196, 0x40, 0, 0, "Content"}, ... 204, ) }, ... 204, ) == 0x0
 01925   436   NtQueryValueKey  (204,  (204, "PerUserItem", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (204, "PerUserItem", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) }, 16, ) == 0x0
 01926   436   NtClose  (204, ... ) == 0x0
 01927   436   NtOpenKey  (0xf, {24, 196, 0x40, 0, 0,  (0xf, {24, 196, 0x40, 0, 0, "Content"}, ... 204, ) }, ... 204, ) == 0x0
 01928   436   NtOpenThreadToken  (-2, 0xc, 1, ... ) == STATUS_NO_TOKEN
 01929   436   NtCreateSemaphore  (0x1f0003, {24, 52, 0x80, 1374360, 0,  (0x1f0003, {24, 52, 0x80, 1374360, 0, "shell.{210A4BA0-3AEA-1069-A2D9-08002B30309D}"}, 0, 2147483647, ... 208, ) }, 0, 2147483647, ... 208, ) == STATUS_OBJECT_NAME_EXISTS
 01930   436   NtReleaseSemaphore  (208, 1, ... 0, ) == 0x0
 01931   436   NtWaitForSingleObject  (208, 0, {0, 0}, ... ) == 0x0
 01932   436   NtCreateKey  (0x2000000, {24, 60, 0x40, 0, 0,  (0x2000000, {24, 60, 0x40, 0, 0, "Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders"}, 0, 0x0, 0, ... 212, 2, ) }, 0, 0x0, 0, ... 212, 2, ) == 0x0
 01933   436   NtQueryValueKey  (212,  (212, "Cache", Partial, 144, ... TitleIdx=0, Type=2, Data="%\0U\0S\0E\0R\0P\0R\0O\0F\0I\0L\0E\0%\0\\0L\0o\0c\0a\0l\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0T\0e\0m\0p\0o\0r\0a\0r\0y\0 \0I\0n\0t\0e\0r\0n\0e\0t\0 \0F\0i\0l\0e\0s\0\0\0"}, 120, ) , Partial, 144, ... TitleIdx=0, Type=2, Data= (212, "Cache", Partial, 144, ... TitleIdx=0, Type=2, Data="%\0U\0S\0E\0R\0P\0R\0O\0F\0I\0L\0E\0%\0\\0L\0o\0c\0a\0l\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0T\0e\0m\0p\0o\0r\0a\0r\0y\0 \0I\0n\0t\0e\0r\0n\0e\0t\0 \0F\0i\0l\0e\0s\0\0\0"}, 120, ) }, 120, ) == 0x0
 01934   436   NtClose  (212, ... ) == 0x0
 01935   436   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\Documents and Settings\SRI-user\Local Settings\Temporary Internet Files"}, 1238704, ... ) }, 1238704, ... ) == 0x0
 01936   436   NtCreateKey  (0x2000000, {24, 60, 0x40, 0, 0,  (0x2000000, {24, 60, 0x40, 0, 0, "Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders"}, 0, 0x0, 0, ... 212, 2, ) }, 0, 0x0, 0, ... 212, 2, ) == 0x0
 01937   436   NtSetValueKey  (212,  (212, "Cache", 0, 1, "C\0:\0\\0D\0o\0c\0u\0m\0e\0n\0t\0s\0 \0a\0n\0d\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0S\0R\0I\0-\0u\0s\0e\0r\0\\0L\0o\0c\0a\0l\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0T\0e\0m\0p\0o\0r\0a\0r\0y\0 \0I\0n\0t\0e\0r\0n\0e\0t\0 \0F\0i\0l\0e\0s\0\0\0", 150, ... ) , 0, 1,  (212, "Cache", 0, 1, "C\0:\0\\0D\0o\0c\0u\0m\0e\0n\0t\0s\0 \0a\0n\0d\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0S\0R\0I\0-\0u\0s\0e\0r\0\\0L\0o\0c\0a\0l\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0T\0e\0m\0p\0o\0r\0a\0r\0y\0 \0I\0n\0t\0e\0r\0n\0e\0t\0 \0F\0i\0l\0e\0s\0\0\0", 150, ... ) , 150, ... ) == 0x0
 01938   436   NtClose  (212, ... ) == 0x0
 01939   436   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\Documents and Settings\SRI-user\Local Settings\Temporary Internet Files"}, 1240036, ... ) }, 1240036, ... ) == 0x0
 01940   436   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\Documents and Settings\SRI-user\Local Settings\Temporary Internet Files"}, 1239768, ... ) }, 1239768, ... ) == 0x0
 01941   436   NtOpenFile  (0x100100, {24, 0, 0x40, 0, 0,  (0x100100, {24, 0, 0x40, 0, 0, "\??\C:\Documents and Settings\SRI-user\Local Settings\Temporary Internet Files"}, 7, 2113568, ... 212, {status=0x0, info=1}, ) }, 7, 2113568, ... 212, {status=0x0, info=1}, ) == 0x0
 01942   436   NtSetInformationFile  (212, 1239744, 40, Basic, ... {status=0x0, info=0}, ) == 0x0
 01943   436   NtClose  (212, ... ) == 0x0
 01944   436   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\Documents and Settings\SRI-user\Local Settings\Temporary Internet Files\desktop.ini"}, 1239768, ... ) }, 1239768, ... ) == 0x0
 01945   436   NtQueryValueKey  (204,  (204, "CachePrefix", Partial, 144, ... TitleIdx=0, Type=1, Data="\0\0"}, 14, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (204, "CachePrefix", Partial, 144, ... TitleIdx=0, Type=1, Data="\0\0"}, 14, ) }, 14, ) == 0x0
 01946   436   NtQueryValueKey  (204,  (204, "CachePrefix", Partial, 144, ... TitleIdx=0, Type=1, Data="\0\0"}, 14, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (204, "CachePrefix", Partial, 144, ... TitleIdx=0, Type=1, Data="\0\0"}, 14, ) }, 14, ) == 0x0
 01947   436   NtQueryValueKey  (204,  (204, "CacheLimit", Partial, 144, ... TitleIdx=0, Type=4, Data="\251~\1\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (204, "CacheLimit", Partial, 144, ... TitleIdx=0, Type=4, Data="\251~\1\0"}, 16, ) }, 16, ) == 0x0
 01948   436   NtOpenKey  (0xf, {24, 48, 0x40, 0, 0,  (0xf, {24, 48, 0x40, 0, 0, "Software\Microsoft\Windows\CurrentVersion\Internet Settings\Cache"}, ... 212, ) }, ... 212, ) == 0x0
 01949   436   NtOpenKey  (0xf, {24, 212, 0x40, 0, 0,  (0xf, {24, 212, 0x40, 0, 0, "Paths"}, ... 216, ) }, ... 216, ) == 0x0
 01950   436   NtOpenKey  (0xf, {24, 216, 0x40, 0, 0,  (0xf, {24, 216, 0x40, 0, 0, "Path1"}, ... 220, ) }, ... 220, ) == 0x0
 01951   436   NtOpenKey  (0xf, {24, 216, 0x40, 0, 0,  (0xf, {24, 216, 0x40, 0, 0, "Path2"}, ... 224, ) }, ... 224, ) == 0x0
 01952   436   NtOpenKey  (0xf, {24, 216, 0x40, 0, 0,  (0xf, {24, 216, 0x40, 0, 0, "Path3"}, ... 228, ) }, ... 228, ) == 0x0
 01953   436   NtOpenKey  (0xf, {24, 216, 0x40, 0, 0,  (0xf, {24, 216, 0x40, 0, 0, "Path4"}, ... 232, ) }, ... 232, ) == 0x0
 01954   436   NtOpenKey  (0xf, {24, 212, 0x40, 0, 0,  (0xf, {24, 212, 0x40, 0, 0, "Special Paths"}, ... 236, ) }, ... 236, ) == 0x0
 01955   436   NtSetValueKey  (216,  (216, "Directory", 0, 1, "C\0:\0\\0D\0o\0c\0u\0m\0e\0n\0t\0s\0 \0a\0n\0d\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0S\0R\0I\0-\0u\0s\0e\0r\0\\0L\0o\0c\0a\0l\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0T\0e\0m\0p\0o\0r\0a\0r\0y\0 \0I\0n\0t\0e\0r\0n\0e\0t\0 \0F\0i\0l\0e\0s\0\\0C\0o\0n\0t\0e\0n\0t\0.\0I\0E\05\0\0\0", 174, ... ) , 0, 1,  (216, "Directory", 0, 1, "C\0:\0\\0D\0o\0c\0u\0m\0e\0n\0t\0s\0 \0a\0n\0d\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0S\0R\0I\0-\0u\0s\0e\0r\0\\0L\0o\0c\0a\0l\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0T\0e\0m\0p\0o\0r\0a\0r\0y\0 \0I\0n\0t\0e\0r\0n\0e\0t\0 \0F\0i\0l\0e\0s\0\\0C\0o\0n\0t\0e\0n\0t\0.\0I\0E\05\0\0\0", 174, ... ) , 174, ... ) == 0x0
 01956   436   NtSetValueKey  (216,  (216, "Paths", 0, 4, "\4\0\0\0", 4, ... ) , 0, 4,  (216, "Paths", 0, 4, "\4\0\0\0", 4, ... ) , 4, ... ) == 0x0
 01957   436   NtSetValueKey  (220,  (220, "CachePath", 0, 1, "C\0:\0\\0D\0o\0c\0u\0m\0e\0n\0t\0s\0 \0a\0n\0d\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0S\0R\0I\0-\0u\0s\0e\0r\0\\0L\0o\0c\0a\0l\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0T\0e\0m\0p\0o\0r\0a\0r\0y\0 \0I\0n\0t\0e\0r\0n\0e\0t\0 \0F\0i\0l\0e\0s\0\\0C\0o\0n\0t\0e\0n\0t\0.\0I\0E\05\0\\0C\0a\0c\0h\0e\01\0\0\0", 188, ... ) , 0, 1,  (220, "CachePath", 0, 1, "C\0:\0\\0D\0o\0c\0u\0m\0e\0n\0t\0s\0 \0a\0n\0d\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0S\0R\0I\0-\0u\0s\0e\0r\0\\0L\0o\0c\0a\0l\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0T\0e\0m\0p\0o\0r\0a\0r\0y\0 \0I\0n\0t\0e\0r\0n\0e\0t\0 \0F\0i\0l\0e\0s\0\\0C\0o\0n\0t\0e\0n\0t\0.\0I\0E\05\0\\0C\0a\0c\0h\0e\01\0\0\0", 188, ... ) , 188, ... ) == 0x0
 01958   436   NtSetValueKey  (224,  (224, "CachePath", 0, 1, "C\0:\0\\0D\0o\0c\0u\0m\0e\0n\0t\0s\0 \0a\0n\0d\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0S\0R\0I\0-\0u\0s\0e\0r\0\\0L\0o\0c\0a\0l\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0T\0e\0m\0p\0o\0r\0a\0r\0y\0 \0I\0n\0t\0e\0r\0n\0e\0t\0 \0F\0i\0l\0e\0s\0\\0C\0o\0n\0t\0e\0n\0t\0.\0I\0E\05\0\\0C\0a\0c\0h\0e\02\0\0\0", 188, ... ) , 0, 1,  (224, "CachePath", 0, 1, "C\0:\0\\0D\0o\0c\0u\0m\0e\0n\0t\0s\0 \0a\0n\0d\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0S\0R\0I\0-\0u\0s\0e\0r\0\\0L\0o\0c\0a\0l\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0T\0e\0m\0p\0o\0r\0a\0r\0y\0 \0I\0n\0t\0e\0r\0n\0e\0t\0 \0F\0i\0l\0e\0s\0\\0C\0o\0n\0t\0e\0n\0t\0.\0I\0E\05\0\\0C\0a\0c\0h\0e\02\0\0\0", 188, ... ) , 188, ... ) == 0x0
 01959   436   NtSetValueKey  (228,  (228, "CachePath", 0, 1, "C\0:\0\\0D\0o\0c\0u\0m\0e\0n\0t\0s\0 \0a\0n\0d\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0S\0R\0I\0-\0u\0s\0e\0r\0\\0L\0o\0c\0a\0l\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0T\0e\0m\0p\0o\0r\0a\0r\0y\0 \0I\0n\0t\0e\0r\0n\0e\0t\0 \0F\0i\0l\0e\0s\0\\0C\0o\0n\0t\0e\0n\0t\0.\0I\0E\05\0\\0C\0a\0c\0h\0e\03\0\0\0", 188, ... ) , 0, 1,  (228, "CachePath", 0, 1, "C\0:\0\\0D\0o\0c\0u\0m\0e\0n\0t\0s\0 \0a\0n\0d\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0S\0R\0I\0-\0u\0s\0e\0r\0\\0L\0o\0c\0a\0l\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0T\0e\0m\0p\0o\0r\0a\0r\0y\0 \0I\0n\0t\0e\0r\0n\0e\0t\0 \0F\0i\0l\0e\0s\0\\0C\0o\0n\0t\0e\0n\0t\0.\0I\0E\05\0\\0C\0a\0c\0h\0e\03\0\0\0", 188, ... ) , 188, ... ) == 0x0
 01960   436   NtSetValueKey  (232,  (232, "CachePath", 0, 1, "C\0:\0\\0D\0o\0c\0u\0m\0e\0n\0t\0s\0 \0a\0n\0d\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0S\0R\0I\0-\0u\0s\0e\0r\0\\0L\0o\0c\0a\0l\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0T\0e\0m\0p\0o\0r\0a\0r\0y\0 \0I\0n\0t\0e\0r\0n\0e\0t\0 \0F\0i\0l\0e\0s\0\\0C\0o\0n\0t\0e\0n\0t\0.\0I\0E\05\0\\0C\0a\0c\0h\0e\04\0\0\0", 188, ... ) , 0, 1,  (232, "CachePath", 0, 1, "C\0:\0\\0D\0o\0c\0u\0m\0e\0n\0t\0s\0 \0a\0n\0d\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0S\0R\0I\0-\0u\0s\0e\0r\0\\0L\0o\0c\0a\0l\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0T\0e\0m\0p\0o\0r\0a\0r\0y\0 \0I\0n\0t\0e\0r\0n\0e\0t\0 \0F\0i\0l\0e\0s\0\\0C\0o\0n\0t\0e\0n\0t\0.\0I\0E\05\0\\0C\0a\0c\0h\0e\04\0\0\0", 188, ... ) , 188, ... ) == 0x0
 01961   436   NtSetValueKey  (220,  (220, "CacheLimit", 0, 4, "\252_\0\0", 4, ... ) , 0, 4,  (220, "CacheLimit", 0, 4, "\252_\0\0", 4, ... ) , 4, ... ) == 0x0
 01962   436   NtSetValueKey  (224,  (224, "CacheLimit", 0, 4, "\252_\0\0", 4, ... ) , 0, 4,  (224, "CacheLimit", 0, 4, "\252_\0\0", 4, ... ) , 4, ... ) == 0x0
 01963   436   NtSetValueKey  (228,  (228, "CacheLimit", 0, 4, "\252_\0\0", 4, ... ) , 0, 4,  (228, "CacheLimit", 0, 4, "\252_\0\0", 4, ... ) , 4, ... ) == 0x0
 01964   436   NtSetValueKey  (232,  (232, "CacheLimit", 0, 4, "\252_\0\0", 4, ... ) , 0, 4,  (232, "CacheLimit", 0, 4, "\252_\0\0", 4, ... ) , 4, ... ) == 0x0
 01965   436   NtClose  (232, ... ) == 0x0
 01966   436   NtClose  (228, ... ) == 0x0
 01967   436   NtClose  (224, ... ) == 0x0
 01968   436   NtClose  (220, ... ) == 0x0
 01969   436   NtClose  (216, ... ) == 0x0
 01970   436   NtClose  (236, ... ) == 0x0
 01971   436   NtClose  (212, ... ) == 0x0
 01972   436   NtOpenKey  (0xf, {24, 196, 0x40, 0, 0,  (0xf, {24, 196, 0x40, 0, 0, "Cookies"}, ... 212, ) }, ... 212, ) == 0x0
 01973   436   NtQueryValueKey  (212,  (212, "PerUserItem", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (212, "PerUserItem", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) }, 16, ) == 0x0
 01974   436   NtClose  (212, ... ) == 0x0
 01975   436   NtClose  (204, ... ) == 0x0
 01976   436   NtOpenKey  (0xf, {24, 196, 0x40, 0, 0,  (0xf, {24, 196, 0x40, 0, 0, "Cookies"}, ... 204, ) }, ... 204, ) == 0x0
 01977   436   NtOpenThreadToken  (-2, 0xc, 1, ... ) == STATUS_NO_TOKEN
 01978   436   NtReleaseSemaphore  (208, 1, ... 0, ) == 0x0
 01979   436   NtWaitForSingleObject  (208, 0, {0, 0}, ... ) == 0x0
 01980   436   NtCreateKey  (0x2000000, {24, 60, 0x40, 0, 0,  (0x2000000, {24, 60, 0x40, 0, 0, "Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders"}, 0, 0x0, 0, ... 212, 2, ) }, 0, 0x0, 0, ... 212, 2, ) == 0x0
 01981   436   NtQueryValueKey  (212,  (212, "Cookies", Partial, 144, ... TitleIdx=0, Type=2, Data="%\0U\0S\0E\0R\0P\0R\0O\0F\0I\0L\0E\0%\0\\0C\0o\0o\0k\0i\0e\0s\0\0\0"}, 56, ) , Partial, 144, ... TitleIdx=0, Type=2, Data= (212, "Cookies", Partial, 144, ... TitleIdx=0, Type=2, Data="%\0U\0S\0E\0R\0P\0R\0O\0F\0I\0L\0E\0%\0\\0C\0o\0o\0k\0i\0e\0s\0\0\0"}, 56, ) }, 56, ) == 0x0
 01982   436   NtClose  (212, ... ) == 0x0
 01983   436   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\Documents and Settings\SRI-user\Cookies"}, 1238704, ... ) }, 1238704, ... ) == 0x0
 01984   436   NtCreateKey  (0x2000000, {24, 60, 0x40, 0, 0,  (0x2000000, {24, 60, 0x40, 0, 0, "Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders"}, 0, 0x0, 0, ... 212, 2, ) }, 0, 0x0, 0, ... 212, 2, ) == 0x0
 01985   436   NtSetValueKey  (212,  (212, "Cookies", 0, 1, "C\0:\0\\0D\0o\0c\0u\0m\0e\0n\0t\0s\0 \0a\0n\0d\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0S\0R\0I\0-\0u\0s\0e\0r\0\\0C\0o\0o\0k\0i\0e\0s\0\0\0", 86, ... ) , 0, 1,  (212, "Cookies", 0, 1, "C\0:\0\\0D\0o\0c\0u\0m\0e\0n\0t\0s\0 \0a\0n\0d\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0S\0R\0I\0-\0u\0s\0e\0r\0\\0C\0o\0o\0k\0i\0e\0s\0\0\0", 86, ... ) , 86, ... ) == 0x0
 01986   436   NtClose  (212, ... ) == 0x0
 01987   436   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\Documents and Settings\SRI-user\Cookies"}, 1240036, ... ) }, 1240036, ... ) == 0x0
 01988   436   NtQueryValueKey  (204,  (204, "CachePrefix", Partial, 144, ... TitleIdx=0, Type=1, Data="C\0o\0o\0k\0i\0e\0:\0\0\0"}, 28, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (204, "CachePrefix", Partial, 144, ... TitleIdx=0, Type=1, Data="C\0o\0o\0k\0i\0e\0:\0\0\0"}, 28, ) }, 28, ) == 0x0
 01989   436   NtQueryValueKey  (204,  (204, "CachePrefix", Partial, 144, ... TitleIdx=0, Type=1, Data="C\0o\0o\0k\0i\0e\0:\0\0\0"}, 28, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (204, "CachePrefix", Partial, 144, ... TitleIdx=0, Type=1, Data="C\0o\0o\0k\0i\0e\0:\0\0\0"}, 28, ) }, 28, ) == 0x0
 01990   436   NtQueryValueKey  (204,  (204, "CacheLimit", Partial, 144, ... TitleIdx=0, Type=4, Data="\0 \0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (204, "CacheLimit", Partial, 144, ... TitleIdx=0, Type=4, Data="\0 \0\0"}, 16, ) }, 16, ) == 0x0
 01991   436   NtOpenKey  (0xf, {24, 196, 0x40, 0, 0,  (0xf, {24, 196, 0x40, 0, 0, "History"}, ... 212, ) }, ... 212, ) == 0x0
 01992   436   NtQueryValueKey  (212,  (212, "PerUserItem", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (212, "PerUserItem", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) }, 16, ) == 0x0
 01993   436   NtClose  (212, ... ) == 0x0
 01994   436   NtClose  (204, ... ) == 0x0
 01995   436   NtOpenKey  (0xf, {24, 196, 0x40, 0, 0,  (0xf, {24, 196, 0x40, 0, 0, "History"}, ... 204, ) }, ... 204, ) == 0x0
 01996   436   NtOpenThreadToken  (-2, 0xc, 1, ... ) == STATUS_NO_TOKEN
 01997   436   NtReleaseSemaphore  (208, 1, ... 0, ) == 0x0
 01998   436   NtWaitForSingleObject  (208, 0, {0, 0}, ... ) == 0x0
 01999   436   NtCreateKey  (0x2000000, {24, 60, 0x40, 0, 0,  (0x2000000, {24, 60, 0x40, 0, 0, "Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders"}, 0, 0x0, 0, ... 212, 2, ) }, 0, 0x0, 0, ... 212, 2, ) == 0x0
 02000   436   NtQueryValueKey  (212,  (212, "History", Partial, 144, ... TitleIdx=0, Type=2, Data="%\0U\0S\0E\0R\0P\0R\0O\0F\0I\0L\0E\0%\0\\0L\0o\0c\0a\0l\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0H\0i\0s\0t\0o\0r\0y\0\0\0"}, 86, ) , Partial, 144, ... TitleIdx=0, Type=2, Data= (212, "History", Partial, 144, ... TitleIdx=0, Type=2, Data="%\0U\0S\0E\0R\0P\0R\0O\0F\0I\0L\0E\0%\0\\0L\0o\0c\0a\0l\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0H\0i\0s\0t\0o\0r\0y\0\0\0"}, 86, ) }, 86, ) == 0x0
 02001   436   NtClose  (212, ... ) == 0x0
 02002   436   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\Documents and Settings\SRI-user\Local Settings\History"}, 1238704, ... ) }, 1238704, ... ) == 0x0
 02003   436   NtCreateKey  (0x2000000, {24, 60, 0x40, 0, 0,  (0x2000000, {24, 60, 0x40, 0, 0, "Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders"}, 0, 0x0, 0, ... 212, 2, ) }, 0, 0x0, 0, ... 212, 2, ) == 0x0
 02004   436   NtSetValueKey  (212,  (212, "History", 0, 1, "C\0:\0\\0D\0o\0c\0u\0m\0e\0n\0t\0s\0 \0a\0n\0d\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0S\0R\0I\0-\0u\0s\0e\0r\0\\0L\0o\0c\0a\0l\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0H\0i\0s\0t\0o\0r\0y\0\0\0", 116, ... ) , 0, 1,  (212, "History", 0, 1, "C\0:\0\\0D\0o\0c\0u\0m\0e\0n\0t\0s\0 \0a\0n\0d\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0S\0R\0I\0-\0u\0s\0e\0r\0\\0L\0o\0c\0a\0l\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0H\0i\0s\0t\0o\0r\0y\0\0\0", 116, ... ) , 116, ... ) == 0x0
 02005   436   NtClose  (212, ... ) == 0x0
 02006   436   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\Documents and Settings\SRI-user\Local Settings\History"}, 1240036, ... ) }, 1240036, ... ) == 0x0
 02007   436   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\Documents and Settings\SRI-user\Local Settings\History"}, 1239768, ... ) }, 1239768, ... ) == 0x0
 02008   436   NtOpenFile  (0x100100, {24, 0, 0x40, 0, 0,  (0x100100, {24, 0, 0x40, 0, 0, "\??\C:\Documents and Settings\SRI-user\Local Settings\History"}, 7, 2113568, ... 212, {status=0x0, info=1}, ) }, 7, 2113568, ... 212, {status=0x0, info=1}, ) == 0x0
 02009   436   NtSetInformationFile  (212, 1239744, 40, Basic, ... {status=0x0, info=0}, ) == 0x0
 02010   436   NtClose  (212, ... ) == 0x0
 02011   436   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\Documents and Settings\SRI-user\Local Settings\History\desktop.ini"}, 1239768, ... ) }, 1239768, ... ) == 0x0
 02012   436   NtQueryValueKey  (204,  (204, "CachePrefix", Partial, 144, ... TitleIdx=0, Type=1, Data="V\0i\0s\0i\0t\0e\0d\0:\0\0\0"}, 30, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (204, "CachePrefix", Partial, 144, ... TitleIdx=0, Type=1, Data="V\0i\0s\0i\0t\0e\0d\0:\0\0\0"}, 30, ) }, 30, ) == 0x0
 02013   436   NtQueryValueKey  (204,  (204, "CachePrefix", Partial, 144, ... TitleIdx=0, Type=1, Data="V\0i\0s\0i\0t\0e\0d\0:\0\0\0"}, 30, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (204, "CachePrefix", Partial, 144, ... TitleIdx=0, Type=1, Data="V\0i\0s\0i\0t\0e\0d\0:\0\0\0"}, 30, ) }, 30, ) == 0x0
 02014   436   NtQueryValueKey  (204,  (204, "CacheLimit", Partial, 144, ... TitleIdx=0, Type=4, Data="\0 \0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (204, "CacheLimit", Partial, 144, ... TitleIdx=0, Type=4, Data="\0 \0\0"}, 16, ) }, 16, ) == 0x0
 02015   436   NtClose  (204, ... ) == 0x0
 02016   436   NtClose  (200, ... ) == 0x0
 02017   436   NtClose  (192, ... ) == 0x0
 02018   436   NtClose  (196, ... ) == 0x0
 02019   436   NtClose  (188, ... ) == 0x0
 02020   436   NtOpenMutant  (0x100000, {24, 52, 0x0, 0, 0,  (0x100000, {24, 52, 0x0, 0, 0, "_!MSFTHISTORY!_"}, ... 188, ) }, ... 188, ) == 0x0
 02021   436   NtOpenMutant  (0x100000, {24, 52, 0x0, 0, 0,  (0x100000, {24, 52, 0x0, 0, 0, "c:!documents and settings!sri-user!local settings!temporary internet files!content.ie5!"}, ... 196, ) }, ... 196, ) == 0x0
 02022   436   NtWaitForSingleObject  (196, 0, 0x0, ... ) == 0x0
 02023   436   NtOpenFile  (0x100001, {24, 0, 0x40, 0, 0,  (0x100001, {24, 0, 0x40, 0, 0, "\??\C:\Documents and Settings\SRI-user\Local Settings\Temporary Internet Files\Content.IE5\"}, 3, 8388641, ... 192, {status=0x0, info=1}, ) }, 3, 8388641, ... 192, {status=0x0, info=1}, ) == 0x0
 02024   436   NtQueryVolumeInformationFile  (192, 1241288, 24, Size, ... {status=0x0, info=24}, ) == 0x0
 02025   436   NtClose  (192, ... ) == 0x0
 02026   436   NtOpenFile  (0x100001, {24, 0, 0x40, 0, 0,  (0x100001, {24, 0, 0x40, 0, 0, "\??\C:\"}, 3, 8388641, ... 192, {status=0x0, info=1}, ) }, 3, 8388641, ... 192, {status=0x0, info=1}, ) == 0x0
 02027   436   NtQueryVolumeInformationFile  (192, 1241312, 24, Size, ... {status=0x0, info=24}, ) == 0x0
 02028   436   NtClose  (192, ... ) == 0x0
 02029   436   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\Documents and Settings\SRI-user\Local Settings\Temporary Internet Files\Content.IE5\"}, 1241640, ... ) }, 1241640, ... ) == 0x0
 02030   436   NtOpenFile  (0x100100, {24, 0, 0x40, 0, 0,  (0x100100, {24, 0, 0x40, 0, 0, "\??\C:\Documents and Settings\SRI-user\Local Settings\Temporary Internet Files\Content.IE5\"}, 7, 2113568, ... 192, {status=0x0, info=1}, ) }, 7, 2113568, ... 192, {status=0x0, info=1}, ) == 0x0
 02031   436   NtSetInformationFile  (192, 1241616, 40, Basic, ... {status=0x0, info=0}, ) == 0x0
 02032   436   NtClose  (192, ... ) == 0x0
 02033   436   NtCreateFile  (0xc0100080, {24, 0, 0x40, 1374360, 1241632,  (0xc0100080, {24, 0, 0x40, 1374360, 1241632, "\??\C:\Documents and Settings\SRI-user\Local Settings\Temporary Internet Files\Content.IE5\index.dat"}, 0x0, 0, 3, 3, 2144, 0, 0, ... 192, {status=0x0, info=1}, ) }, 0x0, 0, 3, 3, 2144, 0, 0, ... 192, {status=0x0, info=1}, ) == 0x0
 02034   436   NtSetInformationFile  (192, 1241684, 40, Basic, ... {status=0x0, info=0}, ) == 0x0
 02035   436   NtQueryInformationFile  (192, 1241684, 24, Standard, ... {status=0x0, info=24}, ) == 0x0
 02036   436   NtClose  (192, ... ) == 0x0
 02037   436   NtCreateFile  (0xc0100080, {24, 0, 0x40, 1374360, 1241616,  (0xc0100080, {24, 0, 0x40, 1374360, 1241616, "\??\C:\Documents and Settings\SRI-user\Local Settings\Temporary Internet Files\Content.IE5\index.dat"}, 0x0, 0, 3, 3, 2144, 0, 0, ... 192, {status=0x0, info=1}, ) }, 0x0, 0, 3, 3, 2144, 0, 0, ... 192, {status=0x0, info=1}, ) == 0x0
 02038   436   NtOpenSection  (0x2, {24, 52, 0x0, 0, 0,  (0x2, {24, 52, 0x0, 0, 0, "C:_Documents and Settings_SRI-user_Local Settings_Temporary Internet Files_Content.IE5_index.dat_32768"}, ... 200, ) }, ... 200, ) == 0x0
 02039   436   NtMapViewOfSection  (200, -1, (0x0), 0, 0, {0, 0}, 0, 1, 0, 4, ... (0x3f0000), {0, 0}, 32768, ) == 0x0
 02040   436   NtReleaseMutant  (196, ... 0x0, ) == 0x0
 02041   436   NtOpenMutant  (0x100000, {24, 52, 0x0, 0, 0,  (0x100000, {24, 52, 0x0, 0, 0, "c:!documents and settings!sri-user!cookies!"}, ... 204, ) }, ... 204, ) == 0x0
 02042   436   NtWaitForSingleObject  (204, 0, 0x0, ... ) == 0x0
 02043   436   NtOpenFile  (0x100001, {24, 0, 0x40, 0, 0,  (0x100001, {24, 0, 0x40, 0, 0, "\??\C:\Documents and Settings\SRI-user\Cookies\"}, 3, 8388641, ... 212, {status=0x0, info=1}, ) }, 3, 8388641, ... 212, {status=0x0, info=1}, ) == 0x0
 02044   436   NtQueryVolumeInformationFile  (212, 1241288, 24, Size, ... {status=0x0, info=24}, ) == 0x0
 02045   436   NtClose  (212, ... ) == 0x0
 02046   436   NtOpenFile  (0x100001, {24, 0, 0x40, 0, 0,  (0x100001, {24, 0, 0x40, 0, 0, "\??\C:\"}, 3, 8388641, ... 212, {status=0x0, info=1}, ) }, 3, 8388641, ... 212, {status=0x0, info=1}, ) == 0x0
 02047   436   NtQueryVolumeInformationFile  (212, 1241312, 24, Size, ... {status=0x0, info=24}, ) == 0x0
 02048   436   NtClose  (212, ... ) == 0x0
 02049   436   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\Documents and Settings\SRI-user\Cookies\"}, 1241640, ... ) }, 1241640, ... ) == 0x0
 02050   436   NtOpenFile  (0x100100, {24, 0, 0x40, 0, 0,  (0x100100, {24, 0, 0x40, 0, 0, "\??\C:\Documents and Settings\SRI-user\Cookies\"}, 7, 2113568, ... 212, {status=0x0, info=1}, ) }, 7, 2113568, ... 212, {status=0x0, info=1}, ) == 0x0
 02051   436   NtSetInformationFile  (212, 1241616, 40, Basic, ... {status=0x0, info=0}, ) == 0x0
 02052   436   NtClose  (212, ... ) == 0x0
 02053   436   NtCreateFile  (0xc0100080, {24, 0, 0x40, 1374360, 1241632,  (0xc0100080, {24, 0, 0x40, 1374360, 1241632, "\??\C:\Documents and Settings\SRI-user\Cookies\index.dat"}, 0x0, 0, 3, 3, 2144, 0, 0, ... 212, {status=0x0, info=1}, ) }, 0x0, 0, 3, 3, 2144, 0, 0, ... 212, {status=0x0, info=1}, ) == 0x0
 02054   436   NtSetInformationFile  (212, 1241684, 40, Basic, ... {status=0x0, info=0}, ) == 0x0
 02055   436   NtQueryInformationFile  (212, 1241684, 24, Standard, ... {status=0x0, info=24}, ) == 0x0
 02056   436   NtClose  (212, ... ) == 0x0
 02057   436   NtCreateFile  (0xc0100080, {24, 0, 0x40, 1374360, 1241616,  (0xc0100080, {24, 0, 0x40, 1374360, 1241616, "\??\C:\Documents and Settings\SRI-user\Cookies\index.dat"}, 0x0, 0, 3, 3, 2144, 0, 0, ... 212, {status=0x0, info=1}, ) }, 0x0, 0, 3, 3, 2144, 0, 0, ... 212, {status=0x0, info=1}, ) == 0x0
 02058   436   NtOpenSection  (0x2, {24, 52, 0x0, 0, 0,  (0x2, {24, 52, 0x0, 0, 0, "C:_Documents and Settings_SRI-user_Cookies_index.dat_16384"}, ... 236, ) }, ... 236, ) == 0x0
 02059   436   NtMapViewOfSection  (236, -1, (0x0), 0, 0, {0, 0}, 0, 1, 0, 4, ... (0xa00000), {0, 0}, 16384, ) == 0x0
 02060   436   NtReleaseMutant  (204, ... 0x0, ) == 0x0
 02061   436   NtOpenMutant  (0x100000, {24, 52, 0x0, 0, 0,  (0x100000, {24, 52, 0x0, 0, 0, "c:!documents and settings!sri-user!local settings!history!history.ie5!"}, ... 216, ) }, ... 216, ) == 0x0
 02062   436   NtWaitForSingleObject  (216, 0, 0x0, ... ) == 0x0
 02063   436   NtOpenFile  (0x100001, {24, 0, 0x40, 0, 0,  (0x100001, {24, 0, 0x40, 0, 0, "\??\C:\Documents and Settings\SRI-user\Local Settings\History\History.IE5\"}, 3, 8388641, ... 220, {status=0x0, info=1}, ) }, 3, 8388641, ... 220, {status=0x0, info=1}, ) == 0x0
 02064   436   NtQueryVolumeInformationFile  (220, 1241288, 24, Size, ... {status=0x0, info=24}, ) == 0x0
 02065   436   NtClose  (220, ... ) == 0x0
 02066   436   NtOpenFile  (0x100001, {24, 0, 0x40, 0, 0,  (0x100001, {24, 0, 0x40, 0, 0, "\??\C:\"}, 3, 8388641, ... 220, {status=0x0, info=1}, ) }, 3, 8388641, ... 220, {status=0x0, info=1}, ) == 0x0
 02067   436   NtQueryVolumeInformationFile  (220, 1241312, 24, Size, ... {status=0x0, info=24}, ) == 0x0
 02068   436   NtClose  (220, ... ) == 0x0
 02069   436   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\Documents and Settings\SRI-user\Local Settings\History\History.IE5\"}, 1241640, ... ) }, 1241640, ... ) == 0x0
 02070   436   NtOpenFile  (0x100100, {24, 0, 0x40, 0, 0,  (0x100100, {24, 0, 0x40, 0, 0, "\??\C:\Documents and Settings\SRI-user\Local Settings\History\History.IE5\"}, 7, 2113568, ... 220, {status=0x0, info=1}, ) }, 7, 2113568, ... 220, {status=0x0, info=1}, ) == 0x0
 02071   436   NtSetInformationFile  (220, 1241616, 40, Basic, ... {status=0x0, info=0}, ) == 0x0
 02072   436   NtClose  (220, ... ) == 0x0
 02073   436   NtCreateFile  (0xc0100080, {24, 0, 0x40, 1374360, 1241632,  (0xc0100080, {24, 0, 0x40, 1374360, 1241632, "\??\C:\Documents and Settings\SRI-user\Local Settings\History\History.IE5\index.dat"}, 0x0, 0, 3, 3, 2144, 0, 0, ... 220, {status=0x0, info=1}, ) }, 0x0, 0, 3, 3, 2144, 0, 0, ... 220, {status=0x0, info=1}, ) == 0x0
 02074   436   NtSetInformationFile  (220, 1241684, 40, Basic, ... {status=0x0, info=0}, ) == 0x0
 02075   436   NtQueryInformationFile  (220, 1241684, 24, Standard, ... {status=0x0, info=24}, ) == 0x0
 02076   436   NtClose  (220, ... ) == 0x0
 02077   436   NtCreateFile  (0xc0100080, {24, 0, 0x40, 1374360, 1241616,  (0xc0100080, {24, 0, 0x40, 1374360, 1241616, "\??\C:\Documents and Settings\SRI-user\Local Settings\History\History.IE5\index.dat"}, 0x0, 0, 3, 3, 2144, 0, 0, ... 220, {status=0x0, info=1}, ) }, 0x0, 0, 3, 3, 2144, 0, 0, ... 220, {status=0x0, info=1}, ) == 0x0
 02078   436   NtOpenSection  (0x2, {24, 52, 0x0, 0, 0,  (0x2, {24, 52, 0x0, 0, 0, "C:_Documents and Settings_SRI-user_Local Settings_History_History.IE5_index.dat_32768"}, ... 224, ) }, ... 224, ) == 0x0
 02079   436   NtMapViewOfSection  (224, -1, (0x0), 0, 0, {0, 0}, 0, 1, 0, 4, ... (0xa10000), {0, 0}, 32768, ) == 0x0
 02080   436   NtReleaseMutant  (216, ... 0x0, ) == 0x0
 02081   436   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\Documents and Settings\SRI-user\Local Settings\Temporary Internet Files\Content.IE5\"}, 1241696, ... ) }, 1241696, ... ) == 0x0
 02082   436   NtOpenFile  (0x100100, {24, 0, 0x40, 0, 0,  (0x100100, {24, 0, 0x40, 0, 0, "\??\C:\Documents and Settings\SRI-user\Local Settings\Temporary Internet Files\Content.IE5\"}, 7, 2113568, ... 228, {status=0x0, info=1}, ) }, 7, 2113568, ... 228, {status=0x0, info=1}, ) == 0x0
 02083   436   NtSetInformationFile  (228, 1241672, 40, Basic, ... {status=0x0, info=0}, ) == 0x0
 02084   436   NtClose  (228, ... ) == 0x0
 02085   436   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\Documents and Settings\SRI-user\Local Settings\Temporary Internet Files\Content.IE5\desktop.ini"}, 1241696, ... ) }, 1241696, ... ) == 0x0
 02086   436   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\Documents and Settings\SRI-user\Local Settings\History\History.IE5\"}, 1241696, ... ) }, 1241696, ... ) == 0x0
 02087   436   NtOpenFile  (0x100100, {24, 0, 0x40, 0, 0,  (0x100100, {24, 0, 0x40, 0, 0, "\??\C:\Documents and Settings\SRI-user\Local Settings\History\History.IE5\"}, 7, 2113568, ... 228, {status=0x0, info=1}, ) }, 7, 2113568, ... 228, {status=0x0, info=1}, ) == 0x0
 02088   436   NtSetInformationFile  (228, 1241672, 40, Basic, ... {status=0x0, info=0}, ) == 0x0
 02089   436   NtClose  (228, ... ) == 0x0
 02090   436   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\Documents and Settings\SRI-user\Local Settings\History\History.IE5\desktop.ini"}, 1241696, ... ) }, 1241696, ... ) == 0x0
 02091   436   NtWaitForSingleObject  (196, 0, 0x0, ... ) == 0x0
 02092   436   NtQueryInformationFile  (192, 1240080, 24, Standard, ... {status=0x0, info=24}, ) == 0x0
 02093   436   NtReleaseMutant  (196, ... 0x0, ) == 0x0
 02094   436   NtOpenKey  (0xf, {24, 60, 0x40, 0, 0,  (0xf, {24, 60, 0x40, 0, 0, "Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache"}, ... 228, ) }, ... 228, ) == 0x0
 02095   436   NtOpenKey  (0xf, {24, 228, 0x40, 0, 0,  (0xf, {24, 228, 0x40, 0, 0, "Extensible Cache"}, ... 232, ) }, ... 232, ) == 0x0
 02096   436   NtClose  (228, ... ) == 0x0
 02097   436   NtWaitForSingleObject  (188, 0, {-600000000, -1}, ... ) == 0x0
 02098   436   NtEnumerateKey  (232, 0, Basic, 288, ... {LastWrite={0x89210de2,0x1c79d95}, TitleIdx=0, Name= (232, 0, Basic, 288, ... {LastWrite={0x89210de2,0x1c79d95}, TitleIdx=0, Name="MSHist012007051420070521"}, 64, ) }, 64, ) == 0x0
 02099   436   NtOpenKey  (0xf, {24, 232, 0x40, 0, 0,  (0xf, {24, 232, 0x40, 0, 0, "MSHist012007051420070521"}, ... 228, ) }, ... 228, ) == 0x0
 02100   436   NtQueryValueKey  (228,  (228, "CacheRepair", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (228, "CacheRepair", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) }, 16, ) == 0x0
 02101   436   NtQueryValueKey  (228,  (228, "CachePath", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 02102   436   NtQueryValueKey  (228,  (228, "CachePath", Partial, 162, ... TitleIdx=0, Type=2, Data="%\0U\0S\0E\0R\0P\0R\0O\0F\0I\0L\0E\0%\0\\0L\0o\0c\0a\0l\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0H\0i\0s\0t\0o\0r\0y\0\\0H\0i\0s\0t\0o\0r\0y\0.\0I\0E\05\0\\0M\0S\0H\0i\0s\0t\00\01\02\00\00\07\00\05\01\04\02\00\00\07\00\05\02\01\0\\0\0\0"}, 162, ) , Partial, 162, ... TitleIdx=0, Type=2, Data= (228, "CachePath", Partial, 162, ... TitleIdx=0, Type=2, Data="%\0U\0S\0E\0R\0P\0R\0O\0F\0I\0L\0E\0%\0\\0L\0o\0c\0a\0l\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0H\0i\0s\0t\0o\0r\0y\0\\0H\0i\0s\0t\0o\0r\0y\0.\0I\0E\05\0\\0M\0S\0H\0i\0s\0t\00\01\02\00\00\07\00\05\01\04\02\00\00\07\00\05\02\01\0\\0\0\0"}, 162, ) }, 162, ) == 0x0
 02103   436   NtQueryValueKey  (228,  (228, "CachePath", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 02104   436   NtQueryValueKey  (228,  (228, "CachePath", Partial, 162, ... TitleIdx=0, Type=2, Data="%\0U\0S\0E\0R\0P\0R\0O\0F\0I\0L\0E\0%\0\\0L\0o\0c\0a\0l\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0H\0i\0s\0t\0o\0r\0y\0\\0H\0i\0s\0t\0o\0r\0y\0.\0I\0E\05\0\\0M\0S\0H\0i\0s\0t\00\01\02\00\00\07\00\05\01\04\02\00\00\07\00\05\02\01\0\\0\0\0"}, 162, ) , Partial, 162, ... TitleIdx=0, Type=2, Data= (228, "CachePath", Partial, 162, ... TitleIdx=0, Type=2, Data="%\0U\0S\0E\0R\0P\0R\0O\0F\0I\0L\0E\0%\0\\0L\0o\0c\0a\0l\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0H\0i\0s\0t\0o\0r\0y\0\\0H\0i\0s\0t\0o\0r\0y\0.\0I\0E\05\0\\0M\0S\0H\0i\0s\0t\00\01\02\00\00\07\00\05\01\04\02\00\00\07\00\05\02\01\0\\0\0\0"}, 162, ) }, 162, ) == 0x0
 02105   436   NtQueryValueKey  (228,  (228, "CachePrefix", Partial, 144, ... TitleIdx=0, Type=1, Data=":\02\00\00\07\00\05\01\04\02\00\00\07\00\05\02\01\0:\0 \0\0\0"}, 52, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (228, "CachePrefix", Partial, 144, ... TitleIdx=0, Type=1, Data=":\02\00\00\07\00\05\01\04\02\00\00\07\00\05\02\01\0:\0 \0\0\0"}, 52, ) }, 52, ) == 0x0
 02106   436   NtQueryValueKey  (228,  (228, "CachePrefix", Partial, 144, ... TitleIdx=0, Type=1, Data=":\02\00\00\07\00\05\01\04\02\00\00\07\00\05\02\01\0:\0 \0\0\0"}, 52, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (228, "CachePrefix", Partial, 144, ... TitleIdx=0, Type=1, Data=":\02\00\00\07\00\05\01\04\02\00\00\07\00\05\02\01\0:\0 \0\0\0"}, 52, ) }, 52, ) == 0x0
 02107   436   NtQueryValueKey  (228,  (228, "CacheLimit", Partial, 144, ... TitleIdx=0, Type=4, Data="\0 \0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (228, "CacheLimit", Partial, 144, ... TitleIdx=0, Type=4, Data="\0 \0\0"}, 16, ) }, 16, ) == 0x0
 02108   436   NtQueryValueKey  (228,  (228, "CacheOptions", Partial, 144, ... TitleIdx=0, Type=4, Data="\13\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (228, "CacheOptions", Partial, 144, ... TitleIdx=0, Type=4, Data="\13\0\0\0"}, 16, ) }, 16, ) == 0x0
 02109   436   NtClose  (228, ... ) == 0x0
 02110   436   NtEnumerateKey  (232, 1, Basic, 288, ... {LastWrite={0xfe4bb184,0x1c7a3a9}, TitleIdx=0, Name= (232, 1, Basic, 288, ... {LastWrite={0xfe4bb184,0x1c7a3a9}, TitleIdx=0, Name="MSHist012007052120070528"}, 64, ) }, 64, ) == 0x0
 02111   436   NtOpenKey  (0xf, {24, 232, 0x40, 0, 0,  (0xf, {24, 232, 0x40, 0, 0, "MSHist012007052120070528"}, ... 228, ) }, ... 228, ) == 0x0
 02112   436   NtQueryValueKey  (228,  (228, "CacheRepair", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (228, "CacheRepair", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) }, 16, ) == 0x0
 02113   436   NtQueryValueKey  (228,  (228, "CachePath", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 02114   436   NtQueryValueKey  (228,  (228, "CachePath", Partial, 162, ... TitleIdx=0, Type=2, Data="%\0U\0S\0E\0R\0P\0R\0O\0F\0I\0L\0E\0%\0\\0L\0o\0c\0a\0l\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0H\0i\0s\0t\0o\0r\0y\0\\0H\0i\0s\0t\0o\0r\0y\0.\0I\0E\05\0\\0M\0S\0H\0i\0s\0t\00\01\02\00\00\07\00\05\02\01\02\00\00\07\00\05\02\08\0\\0\0\0"}, 162, ) , Partial, 162, ... TitleIdx=0, Type=2, Data= (228, "CachePath", Partial, 162, ... TitleIdx=0, Type=2, Data="%\0U\0S\0E\0R\0P\0R\0O\0F\0I\0L\0E\0%\0\\0L\0o\0c\0a\0l\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0H\0i\0s\0t\0o\0r\0y\0\\0H\0i\0s\0t\0o\0r\0y\0.\0I\0E\05\0\\0M\0S\0H\0i\0s\0t\00\01\02\00\00\07\00\05\02\01\02\00\00\07\00\05\02\08\0\\0\0\0"}, 162, ) }, 162, ) == 0x0
 02115   436   NtQueryValueKey  (228,  (228, "CachePath", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 02116   436   NtQueryValueKey  (228,  (228, "CachePath", Partial, 162, ... TitleIdx=0, Type=2, Data="%\0U\0S\0E\0R\0P\0R\0O\0F\0I\0L\0E\0%\0\\0L\0o\0c\0a\0l\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0H\0i\0s\0t\0o\0r\0y\0\\0H\0i\0s\0t\0o\0r\0y\0.\0I\0E\05\0\\0M\0S\0H\0i\0s\0t\00\01\02\00\00\07\00\05\02\01\02\00\00\07\00\05\02\08\0\\0\0\0"}, 162, ) , Partial, 162, ... TitleIdx=0, Type=2, Data= (228, "CachePath", Partial, 162, ... TitleIdx=0, Type=2, Data="%\0U\0S\0E\0R\0P\0R\0O\0F\0I\0L\0E\0%\0\\0L\0o\0c\0a\0l\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0H\0i\0s\0t\0o\0r\0y\0\\0H\0i\0s\0t\0o\0r\0y\0.\0I\0E\05\0\\0M\0S\0H\0i\0s\0t\00\01\02\00\00\07\00\05\02\01\02\00\00\07\00\05\02\08\0\\0\0\0"}, 162, ) }, 162, ) == 0x0
 02117   436   NtQueryValueKey  (228,  (228, "CachePrefix", Partial, 144, ... TitleIdx=0, Type=1, Data=":\02\00\00\07\00\05\02\01\02\00\00\07\00\05\02\08\0:\0 \0\0\0"}, 52, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (228, "CachePrefix", Partial, 144, ... TitleIdx=0, Type=1, Data=":\02\00\00\07\00\05\02\01\02\00\00\07\00\05\02\08\0:\0 \0\0\0"}, 52, ) }, 52, ) == 0x0
 02118   436   NtQueryValueKey  (228,  (228, "CachePrefix", Partial, 144, ... TitleIdx=0, Type=1, Data=":\02\00\00\07\00\05\02\01\02\00\00\07\00\05\02\08\0:\0 \0\0\0"}, 52, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (228, "CachePrefix", Partial, 144, ... TitleIdx=0, Type=1, Data=":\02\00\00\07\00\05\02\01\02\00\00\07\00\05\02\08\0:\0 \0\0\0"}, 52, ) }, 52, ) == 0x0
 02119   436   NtQueryValueKey  (228,  (228, "CacheLimit", Partial, 144, ... TitleIdx=0, Type=4, Data="\0 \0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (228, "CacheLimit", Partial, 144, ... TitleIdx=0, Type=4, Data="\0 \0\0"}, 16, ) }, 16, ) == 0x0
 02120   436   NtQueryValueKey  (228,  (228, "CacheOptions", Partial, 144, ... TitleIdx=0, Type=4, Data="\13\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (228, "CacheOptions", Partial, 144, ... TitleIdx=0, Type=4, Data="\13\0\0\0"}, 16, ) }, 16, ) == 0x0
 02121   436   NtClose  (228, ... ) == 0x0
 02122   436   NtEnumerateKey  (232, 2, Basic, 288, ... {LastWrite={0xfe4e13de,0x1c7a3a9}, TitleIdx=0, Name= (232, 2, Basic, 288, ... {LastWrite={0xfe4e13de,0x1c7a3a9}, TitleIdx=0, Name="MSHist012007053120070601"}, 64, ) }, 64, ) == 0x0
 02123   436   NtOpenKey  (0xf, {24, 232, 0x40, 0, 0,  (0xf, {24, 232, 0x40, 0, 0, "MSHist012007053120070601"}, ... 228, ) }, ... 228, ) == 0x0
 02124   436   NtQueryValueKey  (228,  (228, "CacheRepair", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (228, "CacheRepair", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) }, 16, ) == 0x0
 02125   436   NtQueryValueKey  (228,  (228, "CachePath", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 02126   436   NtQueryValueKey  (228,  (228, "CachePath", Partial, 162, ... TitleIdx=0, Type=2, Data="%\0U\0S\0E\0R\0P\0R\0O\0F\0I\0L\0E\0%\0\\0L\0o\0c\0a\0l\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0H\0i\0s\0t\0o\0r\0y\0\\0H\0i\0s\0t\0o\0r\0y\0.\0I\0E\05\0\\0M\0S\0H\0i\0s\0t\00\01\02\00\00\07\00\05\03\01\02\00\00\07\00\06\00\01\0\\0\0\0"}, 162, ) , Partial, 162, ... TitleIdx=0, Type=2, Data= (228, "CachePath", Partial, 162, ... TitleIdx=0, Type=2, Data="%\0U\0S\0E\0R\0P\0R\0O\0F\0I\0L\0E\0%\0\\0L\0o\0c\0a\0l\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0H\0i\0s\0t\0o\0r\0y\0\\0H\0i\0s\0t\0o\0r\0y\0.\0I\0E\05\0\\0M\0S\0H\0i\0s\0t\00\01\02\00\00\07\00\05\03\01\02\00\00\07\00\06\00\01\0\\0\0\0"}, 162, ) }, 162, ) == 0x0
 02127   436   NtQueryValueKey  (228,  (228, "CachePath", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 02128   436   NtQueryValueKey  (228,  (228, "CachePath", Partial, 162, ... TitleIdx=0, Type=2, Data="%\0U\0S\0E\0R\0P\0R\0O\0F\0I\0L\0E\0%\0\\0L\0o\0c\0a\0l\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0H\0i\0s\0t\0o\0r\0y\0\\0H\0i\0s\0t\0o\0r\0y\0.\0I\0E\05\0\\0M\0S\0H\0i\0s\0t\00\01\02\00\00\07\00\05\03\01\02\00\00\07\00\06\00\01\0\\0\0\0"}, 162, ) , Partial, 162, ... TitleIdx=0, Type=2, Data= (228, "CachePath", Partial, 162, ... TitleIdx=0, Type=2, Data="%\0U\0S\0E\0R\0P\0R\0O\0F\0I\0L\0E\0%\0\\0L\0o\0c\0a\0l\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0H\0i\0s\0t\0o\0r\0y\0\\0H\0i\0s\0t\0o\0r\0y\0.\0I\0E\05\0\\0M\0S\0H\0i\0s\0t\00\01\02\00\00\07\00\05\03\01\02\00\00\07\00\06\00\01\0\\0\0\0"}, 162, ) }, 162, ) == 0x0
 02129   436   NtQueryValueKey  (228,  (228, "CachePrefix", Partial, 144, ... TitleIdx=0, Type=1, Data=":\02\00\00\07\00\05\03\01\02\00\00\07\00\06\00\01\0:\0 \0\0\0"}, 52, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (228, "CachePrefix", Partial, 144, ... TitleIdx=0, Type=1, Data=":\02\00\00\07\00\05\03\01\02\00\00\07\00\06\00\01\0:\0 \0\0\0"}, 52, ) }, 52, ) == 0x0
 02130   436   NtQueryValueKey  (228,  (228, "CachePrefix", Partial, 144, ... TitleIdx=0, Type=1, Data=":\02\00\00\07\00\05\03\01\02\00\00\07\00\06\00\01\0:\0 \0\0\0"}, 52, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (228, "CachePrefix", Partial, 144, ... TitleIdx=0, Type=1, Data=":\02\00\00\07\00\05\03\01\02\00\00\07\00\06\00\01\0:\0 \0\0\0"}, 52, ) }, 52, ) == 0x0
 02131   436   NtQueryValueKey  (228,  (228, "CacheLimit", Partial, 144, ... TitleIdx=0, Type=4, Data="\0 \0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (228, "CacheLimit", Partial, 144, ... TitleIdx=0, Type=4, Data="\0 \0\0"}, 16, ) }, 16, ) == 0x0
 02132   436   NtQueryValueKey  (228,  (228, "CacheOptions", Partial, 144, ... TitleIdx=0, Type=4, Data="\13\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (228, "CacheOptions", Partial, 144, ... TitleIdx=0, Type=4, Data="\13\0\0\0"}, 16, ) }, 16, ) == 0x0
 02133   436   NtClose  (228, ... ) == 0x0
 02134   436   NtEnumerateKey  (232, 3, Basic, 288, ... ) == STATUS_NO_MORE_ENTRIES
 02135   436   NtReleaseMutant  (188, ... 0x0, ) == 0x0
 02136   436   NtClose  (232, ... ) == 0x0
 02137   436   NtWaitForSingleObject  (196, 0, 0x0, ... ) == 0x0
 02138   436   NtQueryInformationFile  (192, 1242008, 24, Standard, ... {status=0x0, info=24}, ) == 0x0
 02139   436   NtReleaseMutant  (196, ... 0x0, ) == 0x0
 02140   436   NtWaitForSingleObject  (196, 0, 0x0, ... ) == 0x0
 02141   436   NtQueryInformationFile  (192, 1242080, 24, Standard, ... {status=0x0, info=24}, ) == 0x0
 02142   436   NtReleaseMutant  (196, ... 0x0, ) == 0x0
 02143   436   NtOpenKey  (0x1, {24, 60, 0x40, 0, 0,  (0x1, {24, 60, 0x40, 0, 0, "SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02144   436   NtOpenKey  (0x1, {24, 60, 0x40, 0, 0,  (0x1, {24, 60, 0x40, 0, 0, "SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02145   436   NtOpenKey  (0x1, {24, 60, 0x40, 0, 0,  (0x1, {24, 60, 0x40, 0, 0, "SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02146   436   NtOpenKey  (0x1, {24, 60, 0x40, 0, 0,  (0x1, {24, 60, 0x40, 0, 0, "SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02147   436   NtOpenKey  (0x1, {24, 60, 0x40, 0, 0,  (0x1, {24, 60, 0x40, 0, 0, "SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02148   436   NtOpenKey  (0x1, {24, 48, 0x40, 0, 0,  (0x1, {24, 48, 0x40, 0, 0, "SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings"}, ... 232, ) }, ... 232, ) == 0x0
 02149   436   NtQueryValueKey  (232,  (232, "DisableWorkerThreadHibernation", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02150   436   NtClose  (232, ... ) == 0x0
 02151   436   NtQueryValueKey  (76,  (76, "DisableWorkerThreadHibernation", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02152   436   NtQueryValueKey  (76,  (76, "DisableReadRange", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02153   436   NtQueryValueKey  (76,  (76, "SocketSendBufferLength", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02154   436   NtQueryValueKey  (76,  (76, "SocketReceiveBufferLength", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02155   436   NtQueryValueKey  (76,  (76, "KeepAliveTimeout", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02156   436   NtQueryValueKey  (76,  (76, "MaxHttpRedirects", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02157   436   NtQueryValueKey  (76,  (76, "MaxConnectionsPerServer", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02158   436   NtQueryValueKey  (76,  (76, "MaxConnectionsPer1_0Server", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02159   436   NtQueryValueKey  (76,  (76, "ServerInfoTimeout", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02160   436   NtQueryValueKey  (76,  (76, "ReceiveTimeOut", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02161   436   NtQueryValueKey  (76,  (76, "DisableNTLMPreAuth", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02162   436   NtQueryValueKey  (76,  (76, "ScavengeCacheLowerBound", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02163   436   NtOpenKey  (0x1, {24, 60, 0x40, 0, 0,  (0x1, {24, 60, 0x40, 0, 0, "SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache"}, ... 232, ) }, ... 232, ) == 0x0
 02164   436   NtQueryValueKey  (232,  (232, "ScavengeCacheFileLifeTime", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02165   436   NtClose  (232, ... ) == 0x0
 02166   436   NtQueryValueKey  (76,  (76, "HttpDefaultExpiryTimeSecs", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02167   436   NtQueryValueKey  (76,  (76, "FtpDefaultExpiryTimeSecs", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02168   436   NtQueryValueKey  (76,  (76, "GopherDefaultExpiryTimeSecs", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02169   436   NtQueryValueKey  (76,  (76, "DisableCachingOfSSLPages", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02170   436   NtQueryValueKey  (76,  (76, "PerUserCookies", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02171   436   NtQueryValueKey  (76,  (76, "LeashLegacyCookies", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02172   436   NtQueryValueKey  (76,  (76, "DisableNT4RasCheck", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02173   436   NtQueryValueKey  (76,  (76, "DialupUseLanSettings", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02174   436   NtQueryValueKey  (76,  (76, "SendExtraCRLF", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02175   436   NtOpenKey  (0x1, {24, 48, 0x40, 0, 0,  (0x1, {24, 48, 0x40, 0, 0, "SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings"}, ... 232, ) }, ... 232, ) == 0x0
 02176   436   NtQueryValueKey  (232,  (232, "DontUseDNSLoadBalancing", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02177   436   NtClose  (232, ... ) == 0x0
 02178   436   NtQueryValueKey  (76,  (76, "DontUseDNSLoadBalancing", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02179   436   NtQueryValueKey  (76,  (76, "NonBlockingClient32", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02180   436   NtQueryValueKey  (76,  (76, "MimeExclusionListForCache", Partial, 144, ... TitleIdx=0, Type=1, Data="m\0u\0l\0t\0i\0p\0a\0r\0t\0/\0m\0i\0x\0e\0d\0 \0m\0u\0l\0t\0i\0p\0a\0r\0t\0/\0x\0-\0m\0i\0x\0e\0d\0-\0r\0e\0p\0l\0a\0c\0e\0 \0m\0u\0l\0t\0i\0p\0a\0r\0t\0/\0x\0-\0b\0y\0t\0e\0r\0a\0n\0g\0e\0s\0 \0\0\0"}, 144, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (76, "MimeExclusionListForCache", Partial, 144, ... TitleIdx=0, Type=1, Data="m\0u\0l\0t\0i\0p\0a\0r\0t\0/\0m\0i\0x\0e\0d\0 \0m\0u\0l\0t\0i\0p\0a\0r\0t\0/\0x\0-\0m\0i\0x\0e\0d\0-\0r\0e\0p\0l\0a\0c\0e\0 \0m\0u\0l\0t\0i\0p\0a\0r\0t\0/\0x\0-\0b\0y\0t\0e\0r\0a\0n\0g\0e\0s\0 \0\0\0"}, 144, ) }, 144, ) == 0x0
 02181   436   NtQueryValueKey  (76,  (76, "MimeExclusionListForCache", Partial, 144, ... TitleIdx=0, Type=1, Data="m\0u\0l\0t\0i\0p\0a\0r\0t\0/\0m\0i\0x\0e\0d\0 \0m\0u\0l\0t\0i\0p\0a\0r\0t\0/\0x\0-\0m\0i\0x\0e\0d\0-\0r\0e\0p\0l\0a\0c\0e\0 \0m\0u\0l\0t\0i\0p\0a\0r\0t\0/\0x\0-\0b\0y\0t\0e\0r\0a\0n\0g\0e\0s\0 \0\0\0"}, 144, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (76, "MimeExclusionListForCache", Partial, 144, ... TitleIdx=0, Type=1, Data="m\0u\0l\0t\0i\0p\0a\0r\0t\0/\0m\0i\0x\0e\0d\0 \0m\0u\0l\0t\0i\0p\0a\0r\0t\0/\0x\0-\0m\0i\0x\0e\0d\0-\0r\0e\0p\0l\0a\0c\0e\0 \0m\0u\0l\0t\0i\0p\0a\0r\0t\0/\0x\0-\0b\0y\0t\0e\0r\0a\0n\0g\0e\0s\0 \0\0\0"}, 144, ) }, 144, ) == 0x0
 02182   436   NtQueryValueKey  (76,  (76, "MimeExclusionListForCache", Partial, 144, ... TitleIdx=0, Type=1, Data="m\0u\0l\0t\0i\0p\0a\0r\0t\0/\0m\0i\0x\0e\0d\0 \0m\0u\0l\0t\0i\0p\0a\0r\0t\0/\0x\0-\0m\0i\0x\0e\0d\0-\0r\0e\0p\0l\0a\0c\0e\0 \0m\0u\0l\0t\0i\0p\0a\0r\0t\0/\0x\0-\0b\0y\0t\0e\0r\0a\0n\0g\0e\0s\0 \0\0\0"}, 144, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (76, "MimeExclusionListForCache", Partial, 144, ... TitleIdx=0, Type=1, Data="m\0u\0l\0t\0i\0p\0a\0r\0t\0/\0m\0i\0x\0e\0d\0 \0m\0u\0l\0t\0i\0p\0a\0r\0t\0/\0x\0-\0m\0i\0x\0e\0d\0-\0r\0e\0p\0l\0a\0c\0e\0 \0m\0u\0l\0t\0i\0p\0a\0r\0t\0/\0x\0-\0b\0y\0t\0e\0r\0a\0n\0g\0e\0s\0 \0\0\0"}, 144, ) }, 144, ) == 0x0
 02183   436   NtQueryValueKey  (76,  (76, "MimeExclusionListForCache", Partial, 144, ... TitleIdx=0, Type=1, Data="m\0u\0l\0t\0i\0p\0a\0r\0t\0/\0m\0i\0x\0e\0d\0 \0m\0u\0l\0t\0i\0p\0a\0r\0t\0/\0x\0-\0m\0i\0x\0e\0d\0-\0r\0e\0p\0l\0a\0c\0e\0 \0m\0u\0l\0t\0i\0p\0a\0r\0t\0/\0x\0-\0b\0y\0t\0e\0r\0a\0n\0g\0e\0s\0 \0\0\0"}, 144, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (76, "MimeExclusionListForCache", Partial, 144, ... TitleIdx=0, Type=1, Data="m\0u\0l\0t\0i\0p\0a\0r\0t\0/\0m\0i\0x\0e\0d\0 \0m\0u\0l\0t\0i\0p\0a\0r\0t\0/\0x\0-\0m\0i\0x\0e\0d\0-\0r\0e\0p\0l\0a\0c\0e\0 \0m\0u\0l\0t\0i\0p\0a\0r\0t\0/\0x\0-\0b\0y\0t\0e\0r\0a\0n\0g\0e\0s\0 \0\0\0"}, 144, ) }, 144, ) == 0x0
 02184   436   NtQueryValueKey  (76,  (76, "HeaderExclusionListForCache", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02185   436   NtQueryValueKey  (76,  (76, "DnsCacheEnabled", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02186   436   NtQueryValueKey  (76,  (76, "DnsCacheEntries", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02187   436   NtQueryValueKey  (76,  (76, "DnsCacheTimeout", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02188   436   NtQueryValueKey  (76,  (76, "WarnOnPost", Partial, 144, ... TitleIdx=0, Type=3, Data="\1\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=3, Data= (76, "WarnOnPost", Partial, 144, ... TitleIdx=0, Type=3, Data="\1\0\0\0"}, 16, ) }, 16, ) == 0x0
 02189   436   NtQueryValueKey  (76,  (76, "WarnAlwaysOnPost", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02190   436   NtQueryValueKey  (76,  (76, "WarnOnZoneCrossing", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02191   436   NtQueryValueKey  (76,  (76, "WarnOnBadCertSending", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02192   436   NtQueryValueKey  (76,  (76, "WarnOnBadCertRecving", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02193   436   NtQueryValueKey  (76,  (76, "WarnOnPostRedirect", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02194   436   NtQueryValueKey  (76,  (76, "AlwaysDrainOnRedirect", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02195   436   NtOpenMutant  (0x100000, {24, 52, 0x0, 0, 0,  (0x100000, {24, 52, 0x0, 0, 0, "WininetStartupMutex"}, ... 232, ) }, ... 232, ) == 0x0
 02196   436   NtCreateEvent  (0x1f0003, 0x0, 1, 1, ... 228, ) == 0x0
 02197   436   NtQueryValueKey  (76,  (76, "GlobalUserOffline", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02198   436   NtWaitForSingleObject  (196, 0, 0x0, ... ) == 0x0
 02199   436   NtQueryInformationFile  (192, 1242056, 24, Standard, ... {status=0x0, info=24}, ) == 0x0
 02200   436   NtReleaseMutant  (196, ... 0x0, ) == 0x0
 02201   436   NtOpenMutant  (0x100000, {24, 52, 0x0, 0, 0,  (0x100000, {24, 52, 0x0, 0, 0, "WininetConnectionMutex"}, ... 240, ) }, ... 240, ) == 0x0
 02202   436   NtCreateMutant  (0x1f0001, 0x0, 0, ... 244, ) == 0x0
 02203   436   NtOpenMutant  (0x100000, {24, 52, 0x0, 0, 0,  (0x100000, {24, 52, 0x0, 0, 0, "WininetProxyRegistryMutex"}, ... 248, ) }, ... 248, ) == 0x0
 02204   436   NtQueryValueKey  (76,  (76, "EnableAutodial", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (76, "EnableAutodial", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) }, 16, ) == 0x0
 02205   436   NtQueryValueKey  (76,  (76, "NoNetAutodial", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (76, "NoNetAutodial", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) }, 16, ) == 0x0
 02206   436   NtOpenKey  (0x1, {24, 48, 0x40, 0, 0,  (0x1, {24, 48, 0x40, 0, 0, "SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings"}, ... 252, ) }, ... 252, ) == 0x0
 02207   436   NtQueryValueKey  (252,  (252, "UrlEncoding", Partial, 144, ... TitleIdx=0, Type=1, Data="0\0x\00\00\00\00\00\00\00\00\0\0\0"}, 34, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (252, "UrlEncoding", Partial, 144, ... TitleIdx=0, Type=1, Data="0\0x\00\00\00\00\00\00\00\00\0\0\0"}, 34, ) }, 34, ) == 0x0
 02208   436   NtQueryValueKey  (252,  (252, "UrlEncoding", Partial, 144, ... TitleIdx=0, Type=1, Data="0\0x\00\00\00\00\00\00\00\00\0\0\0"}, 34, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (252, "UrlEncoding", Partial, 144, ... TitleIdx=0, Type=1, Data="0\0x\00\00\00\00\00\00\00\00\0\0\0"}, 34, ) }, 34, ) == 0x0
 02209   436   NtClose  (252, ... ) == 0x0
 02210   436   NtAllocateVirtualMemory  (-1, 1388544, 0, 4096, 4096, 4, ... 1388544, 4096, ) == 0x0
 02211   436   NtWaitForSingleObject  (240, 0, 0x0, ... ) == 0x0
 02212   436   NtWaitForSingleObject  (244, 0, 0x0, ... ) == 0x0
 02213   436   NtOpenSection  (0xe, {24, 8, 0x40, 0, 0,  (0xe, {24, 8, 0x40, 0, 0, "RASAPI32.DLL"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02214   436   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\u:\work\RASAPI32.DLL"}, 1240444, ... }, 1240444, ...
 01883   568   NtWaitForSingleObject  ... ) == 0x0
 02215   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=79}, 0x0, ) , 16, 0, ... {status=0x103, info=79}, 0x0, ) == 0x103
 02216   568   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ...
 02214   436   NtQueryAttributesFile  ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02217   436   NtQueryAttributesFile  ({24, 12, 0x40, 0, 0,  ({24, 12, 0x40, 0, 0, "RASAPI32.DLL"}, 1240444, ... }, 1240444, ...
 02216   568   NtWaitForSingleObject  ... ) == 0x0
 02218   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=79}, 0x0, ) , 16, 0, ... {status=0x103, info=79}, 0x0, ) == 0x103
 02219   568   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ...
 02217   436   NtQueryAttributesFile  ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02220   436   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\System32\RASAPI32.DLL"}, 1240444, ... ) }, 1240444, ... ) == 0x0
 02221   436   NtOpenFile  (0x100020, {24, 0, 0x40, 0, 0,  (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\System32\RASAPI32.DLL"}, 5, 96, ... 252, {status=0x0, info=1}, ) }, 5, 96, ... 252, {status=0x0, info=1}, ) == 0x0
 02222   436   NtCreateSection  (0xf, 0x0, 0x0, 16, 16777216, 252, ... 256, ) == 0x0
 02223   436   NtQuerySection  (256, Image, 48, ... {section info, class 1, size 48}, 0x0, ) == 0x0
 02224   436   NtClose  (252, ... ) == 0x0
 02225   436   NtMapViewOfSection  (256, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x76ee0000), 0x0, 225280, ) == 0x0
 02226   436   NtClose  (256, ... ) == 0x0
 02227   436   NtOpenSection  (0xe, {24, 8, 0x40, 0, 0,  (0xe, {24, 8, 0x40, 0, 0, "rasman.dll"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02228   436   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\u:\work\rasman.dll"}, 1239640, ... }, 1239640, ...
 02219   568   NtWaitForSingleObject  ... ) == 0x0
 02229   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=79}, 0x0, ) , 16, 0, ... {status=0x103, info=79}, 0x0, ) == 0x103
 02230   568   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ...
 02228   436   NtQueryAttributesFile  ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02231   436   NtQueryAttributesFile  ({24, 12, 0x40, 0, 0,  ({24, 12, 0x40, 0, 0, "rasman.dll"}, 1239640, ... }, 1239640, ...
 02230   568   NtWaitForSingleObject  ... ) == 0x0
 02232   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=79}, 0x0, ) , 16, 0, ... {status=0x103, info=79}, 0x0, ) == 0x103
 02233   568   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ...
 02231   436   NtQueryAttributesFile  ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02234   436   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\System32\rasman.dll"}, 1239640, ... ) }, 1239640, ... ) == 0x0
 02235   436   NtOpenFile  (0x100020, {24, 0, 0x40, 0, 0,  (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\System32\rasman.dll"}, 5, 96, ... 256, {status=0x0, info=1}, ) }, 5, 96, ... 256, {status=0x0, info=1}, ) == 0x0
 02236   436   NtCreateSection  (0xf, 0x0, 0x0, 16, 16777216, 256, ... 252, ) == 0x0
 02237   436   NtQuerySection  (252, Image, 48, ... {section info, class 1, size 48}, 0x0, ) == 0x0
 02238   436   NtClose  (256, ... ) == 0x0
 02239   436   NtMapViewOfSection  (252, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x76e90000), 0x0, 69632, ) == 0x0
 02240   436   NtClose  (252, ... ) == 0x0
 02241   436   NtOpenSection  (0xe, {24, 8, 0x40, 0, 0,  (0xe, {24, 8, 0x40, 0, 0, "NETAPI32.dll"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02242   436   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\u:\work\NETAPI32.dll"}, 1238836, ... }, 1238836, ...
 02233   568   NtWaitForSingleObject  ... ) == 0x0
 02243   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=79}, 0x0, ) , 16, 0, ... {status=0x103, info=79}, 0x0, ) == 0x103
 02244   568   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ...
 02242   436   NtQueryAttributesFile  ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02245   436   NtQueryAttributesFile  ({24, 12, 0x40, 0, 0,  ({24, 12, 0x40, 0, 0, "NETAPI32.dll"}, 1238836, ... }, 1238836, ...
 02244   568   NtWaitForSingleObject  ... ) == 0x0
 02246   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=79}, 0x0, ) , 16, 0, ... {status=0x103, info=79}, 0x0, ) == 0x103
 02247   568   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ...
 02245   436   NtQueryAttributesFile  ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02248   436   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\System32\NETAPI32.dll"}, 1238836, ... ) }, 1238836, ... ) == 0x0
 02249   436   NtOpenFile  (0x100020, {24, 0, 0x40, 0, 0,  (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\System32\NETAPI32.dll"}, 5, 96, ... 252, {status=0x0, info=1}, ) }, 5, 96, ... 252, {status=0x0, info=1}, ) == 0x0
 02250   436   NtCreateSection  (0xf, 0x0, 0x0, 16, 16777216, 252, ... 256, ) == 0x0
 02251   436   NtQuerySection  (256, Image, 48, ... {section info, class 1, size 48}, 0x0, ) == 0x0
 02252   436   NtClose  (252, ... ) == 0x0
 02253   436   NtMapViewOfSection  (256, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x71c20000), 0x0, 323584, ) == 0x0
 02254   436   NtClose  (256, ... ) == 0x0
 02255   436   NtOpenSection  (0xe, {24, 8, 0x40, 0, 0,  (0xe, {24, 8, 0x40, 0, 0, "TAPI32.dll"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02256   436   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\u:\work\TAPI32.dll"}, 1239640, ... }, 1239640, ...
 02247   568   NtWaitForSingleObject  ... ) == 0x0
 02257   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=79}, 0x0, ) , 16, 0, ... {status=0x103, info=79}, 0x0, ) == 0x103
 02258   568   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ...
 02256   436   NtQueryAttributesFile  ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02259   436   NtQueryAttributesFile  ({24, 12, 0x40, 0, 0,  ({24, 12, 0x40, 0, 0, "TAPI32.dll"}, 1239640, ... }, 1239640, ...
 02258   568   NtWaitForSingleObject  ... ) == 0x0
 02260   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=79}, 0x0, ) , 16, 0, ... {status=0x103, info=79}, 0x0, ) == 0x103
 02261   568   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ...
 02259   436   NtQueryAttributesFile  ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02262   436   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\System32\TAPI32.dll"}, 1239640, ... ) }, 1239640, ... ) == 0x0
 02263   436   NtOpenFile  (0x100020, {24, 0, 0x40, 0, 0,  (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\System32\TAPI32.dll"}, 5, 96, ... 256, {status=0x0, info=1}, ) }, 5, 96, ... 256, {status=0x0, info=1}, ) == 0x0
 02264   436   NtCreateSection  (0xf, 0x0, 0x0, 16, 16777216, 256, ... 252, ) == 0x0
 02265   436   NtQuerySection  (252, Image, 48, ... {section info, class 1, size 48}, 0x0, ) == 0x0
 02266   436   NtClose  (256, ... ) == 0x0
 02267   436   NtMapViewOfSection  (252, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x76eb0000), 0x0, 172032, ) == 0x0
 02268   436   NtClose  (252, ... ) == 0x0
 02269   436   NtOpenSection  (0xe, {24, 8, 0x40, 0, 0,  (0xe, {24, 8, 0x40, 0, 0, "rtutils.dll"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02270   436   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\u:\work\rtutils.dll"}, 1238836, ... }, 1238836, ...
 02261   568   NtWaitForSingleObject  ... ) == 0x0
 02271   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=79}, 0x0, ) , 16, 0, ... {status=0x103, info=79}, 0x0, ) == 0x103
 02272   568   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ...
 02270   436   NtQueryAttributesFile  ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02273   436   NtQueryAttributesFile  ({24, 12, 0x40, 0, 0,  ({24, 12, 0x40, 0, 0, "rtutils.dll"}, 1238836, ... }, 1238836, ...
 02272   568   NtWaitForSingleObject  ... ) == 0x0
 02274   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=79}, 0x0, ) , 16, 0, ... {status=0x103, info=79}, 0x0, ) == 0x103
 02275   568   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ...
 02273   436   NtQueryAttributesFile  ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02276   436   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\System32\rtutils.dll"}, 1238836, ... ) }, 1238836, ... ) == 0x0
 02277   436   NtOpenFile  (0x100020, {24, 0, 0x40, 0, 0,  (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\System32\rtutils.dll"}, 5, 96, ... 252, {status=0x0, info=1}, ) }, 5, 96, ... 252, {status=0x0, info=1}, ) == 0x0
 02278   436   NtCreateSection  (0xf, 0x0, 0x0, 16, 16777216, 252, ... 256, ) == 0x0
 02279   436   NtQuerySection  (256, Image, 48, ... {section info, class 1, size 48}, 0x0, ) == 0x0
 02280   436   NtClose  (252, ... ) == 0x0
 02281   436   NtMapViewOfSection  (256, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x76e80000), 0x0, 53248, ) == 0x0
 02282   436   NtClose  (256, ... ) == 0x0
 02283   436   NtOpenSection  (0xe, {24, 8, 0x40, 0, 0,  (0xe, {24, 8, 0x40, 0, 0, "WINMM.dll"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02284   436   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\u:\work\WINMM.dll"}, 1238836, ... }, 1238836, ...
 02275   568   NtWaitForSingleObject  ... ) == 0x0
 02285   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=79}, 0x0, ) , 16, 0, ... {status=0x103, info=79}, 0x0, ) == 0x103
 02286   568   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ...
 02284   436   NtQueryAttributesFile  ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02287   436   NtQueryAttributesFile  ({24, 12, 0x40, 0, 0,  ({24, 12, 0x40, 0, 0, "WINMM.dll"}, 1238836, ... }, 1238836, ...
 02286   568   NtWaitForSingleObject  ... ) == 0x0
 02288   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=79}, 0x0, ) , 16, 0, ... {status=0x103, info=79}, 0x0, ) == 0x103
 02289   568   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ...
 02287   436   NtQueryAttributesFile  ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02290   436   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\System32\WINMM.dll"}, 1238836, ... ) }, 1238836, ... ) == 0x0
 02291   436   NtOpenFile  (0x100020, {24, 0, 0x40, 0, 0,  (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\System32\WINMM.dll"}, 5, 96, ... 256, {status=0x0, info=1}, ) }, 5, 96, ... 256, {status=0x0, info=1}, ) == 0x0
 02292   436   NtCreateSection  (0xf, 0x0, 0x0, 16, 16777216, 256, ... 252, ) == 0x0
 02293   436   NtQuerySection  (252, Image, 48, ... {section info, class 1, size 48}, 0x0, ) == 0x0
 02294   436   NtClose  (256, ... ) == 0x0
 02295   436   NtMapViewOfSection  (252, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x76b40000), 0x0, 180224, ) == 0x0
 02296   436   NtClose  (252, ... ) == 0x0
 02297   436   NtCreateEvent  (0x1f0003, 0x0, 0, 0, ... 252, ) == 0x0
 02298   436   NtCreateSemaphore  (0x100003, 0x0, 0, 2147483647, ... 256, ) == 0x0
 02299   436   NtCreateSemaphore  (0x100003, 0x0, 0, 2147483647, ... 260, ) == 0x0
 02300   436   NtOpenKey  (0x80000000, {24, 0, 0x40, 0, 0,  (0x80000000, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\DRIVERS32"}, ... 264, ) }, ... 264, ) == 0x0
 02301   436   NtQueryValueKey  (264,  (264, "wave", Partial, 536, ... ) , Partial, 536, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02302   436   NtQueryValueKey  (264,  (264, "wave1", Partial, 536, ... ) , Partial, 536, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02303   436   NtQueryValueKey  (264,  (264, "wave2", Partial, 536, ... ) , Partial, 536, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02304   436   NtQueryValueKey  (264,  (264, "wave3", Partial, 536, ... ) , Partial, 536, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02305   436   NtQueryValueKey  (264,  (264, "wave4", Partial, 536, ... ) , Partial, 536, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02306   436   NtQueryValueKey  (264,  (264, "wave5", Partial, 536, ... ) , Partial, 536, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02307   436   NtQueryValueKey  (264,  (264, "wave6", Partial, 536, ... ) , Partial, 536, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02308   436   NtQueryValueKey  (264,  (264, "wave7", Partial, 536, ... ) , Partial, 536, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02309   436   NtQueryValueKey  (264,  (264, "wave8", Partial, 536, ... ) , Partial, 536, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02310   436   NtQueryValueKey  (264,  (264, "wave9", Partial, 536, ... ) , Partial, 536, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02311   436   NtQueryValueKey  (264,  (264, "midi", Partial, 536, ... ) , Partial, 536, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02312   436   NtQueryValueKey  (264,  (264, "midi1", Partial, 536, ... ) , Partial, 536, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02313   436   NtQueryValueKey  (264,  (264, "midi2", Partial, 536, ... ) , Partial, 536, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02314   436   NtQueryValueKey  (264,  (264, "midi3", Partial, 536, ... ) , Partial, 536, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02315   436   NtQueryValueKey  (264,  (264, "midi4", Partial, 536, ... ) , Partial, 536, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02316   436   NtQueryValueKey  (264,  (264, "midi5", Partial, 536, ... ) , Partial, 536, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02317   436   NtQueryValueKey  (264,  (264, "midi6", Partial, 536, ... ) , Partial, 536, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02318   436   NtQueryValueKey  (264,  (264, "midi7", Partial, 536, ... ) , Partial, 536, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02319   436   NtQueryValueKey  (264,  (264, "midi8", Partial, 536, ... ) , Partial, 536, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02320   436   NtQueryValueKey  (264,  (264, "midi9", Partial, 536, ... ) , Partial, 536, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02321   436   NtQueryTimerResolution  (... 156250, 10000, 156250, ) == 0x0
 02322   436   NtQueryValueKey  (264,  (264, "aux", Partial, 536, ... ) , Partial, 536, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02323   436   NtQueryValueKey  (264,  (264, "aux1", Partial, 536, ... ) , Partial, 536, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02324   436   NtQueryValueKey  (264,  (264, "aux2", Partial, 536, ... ) , Partial, 536, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02325   436   NtQueryValueKey  (264,  (264, "aux3", Partial, 536, ... ) , Partial, 536, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02326   436   NtQueryValueKey  (264,  (264, "aux4", Partial, 536, ... ) , Partial, 536, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02327   436   NtQueryValueKey  (264,  (264, "aux5", Partial, 536, ... ) , Partial, 536, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02328   436   NtQueryValueKey  (264,  (264, "aux6", Partial, 536, ... ) , Partial, 536, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02329   436   NtQueryValueKey  (264,  (264, "aux7", Partial, 536, ... ) , Partial, 536, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02330   436   NtQueryValueKey  (264,  (264, "aux8", Partial, 536, ... ) , Partial, 536, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02331   436   NtQueryValueKey  (264,  (264, "aux9", Partial, 536, ... ) , Partial, 536, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02332   436   NtUserRegisterWindowMessage  ( ("MSJSTICK_VJOYD_MSGSTR", ... ) , ... ) == 0xc07c
 02333   436   NtOpenKey  (0xf003f, {24, 48, 0x40, 0, 0,  (0xf003f, {24, 48, 0x40, 0, 0, "System\CurrentControlSet\Control\MediaProperties\PrivateProperties\Joystick\Winmm"}, ... 268, ) }, ... 268, ) == 0x0
 02334   436   NtQueryValueKey  (268,  (268, "wheel", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (268, "wheel", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) }, 16, ) == 0x0
 02335   436   NtClose  (268, ... ) == 0x0
 02336   436   NtCreateEvent  (0x1f0003, {24, 52, 0x80, 0, 0,  (0x1f0003, {24, 52, 0x80, 0, 0, "DINPUTWINMM"}, 0, 0, ... ) }, 0, 0, ... ) == STATUS_ACCESS_DENIED
 02337   436   NtQueryValueKey  (264,  (264, "mixer", Partial, 536, ... ) , Partial, 536, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02338   436   NtQueryValueKey  (264,  (264, "mixer1", Partial, 536, ... ) , Partial, 536, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02339   436   NtQueryValueKey  (264,  (264, "mixer2", Partial, 536, ... ) , Partial, 536, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02340   436   NtQueryValueKey  (264,  (264, "mixer3", Partial, 536, ... ) , Partial, 536, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02341   436   NtQueryValueKey  (264,  (264, "mixer4", Partial, 536, ... ) , Partial, 536, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02342   436   NtQueryValueKey  (264,  (264, "mixer5", Partial, 536, ... ) , Partial, 536, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02343   436   NtQueryValueKey  (264,  (264, "mixer6", Partial, 536, ... ) , Partial, 536, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02344   436   NtQueryValueKey  (264,  (264, "mixer7", Partial, 536, ... ) , Partial, 536, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02345   436   NtQueryValueKey  (264,  (264, "mixer8", Partial, 536, ... ) , Partial, 536, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02346   436   NtQueryValueKey  (264,  (264, "mixer9", Partial, 536, ... ) , Partial, 536, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02347   436   NtQueryDefaultUILanguage  (1238836, ...
 02348   436   NtOpenThreadTokenEx  (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN
 02349   436   NtOpenProcessTokenEx  (-1, 0x20008, 512, ... -2147482184, ) == 0x0
 02350   436   NtQueryInformationToken  (-2147482184, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0
 02351   436   NtClose  (-2147482184, ... ) == 0x0
 02352   436   NtOpenKey  (0x2000000, {24, 0, 0x640, 0, 0,  (0x2000000, {24, 0, 0x640, 0, 0, "\REGISTRY\USER\S-1-5-21-1078081533-484763869-839522115-1003"}, ... -2147482184, ) }, ... -2147482184, ) == 0x0
 02353   436   NtOpenKey  (0x80000000, {24, 0, 0x240, 0, 0,  (0x80000000, {24, 0, 0x240, 0, 0, "\Registry\Machine\System\CurrentControlSet\Control\Nls\MUILanguages"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02354   436   NtOpenKey  (0x80000000, {24, -2147482184, 0x640, 0, 0,  (0x80000000, {24, -2147482184, 0x640, 0, 0, "Control Panel\Desktop"}, ... -2147482180, ) }, ... -2147482180, ) == 0x0
 02355   436   NtQueryValueKey  (-2147482180,  (-2147482180, "MultiUILanguageId", Partial, 256, ... ) , Partial, 256, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02356   436   NtClose  (-2147482180, ... ) == 0x0
 02357   436   NtClose  (-2147482184, ... ) == 0x0
 02347   436   NtQueryDefaultUILanguage  ... ) == 0x0
 02358   436   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\System\CurrentControlSet\Control\Nls\MUILanguages"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02359   436   NtOpenFile  (0x1200a9, {24, 0, 0x40, 0, 0,  (0x1200a9, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\System32\TAPI32.dll"}, 1, 96, ... 268, {status=0x0, info=1}, ) }, 1, 96, ... 268, {status=0x0, info=1}, ) == 0x0
 02360   436   NtCreateSection  (0x4, 0x0, 0x0, 2, 134217728, 268, ... 272, ) == 0x0
 02361   436   NtMapViewOfSection  (272, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 2, ... (0xa20000), 0x0, 163840, ) == 0x0
 02362   436   NtOpenFile  (0x1200a9, {24, 0, 0x40, 0, 0,  (0x1200a9, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\System32\TAPI32.dll.124.Manifest"}, 1, 96, ... ) }, 1, 96, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02363   436   NtQueryDefaultLocale  (1, 1236872, ... ) == 0x0
 02364   436   NtOpenFile  (0x1200a9, {24, 0, 0x40, 0, 0,  (0x1200a9, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\System32\TAPI32.dll.124.Config"}, 1, 96, ... ) }, 1, 96, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02365   436   NtRequestWaitReplyPort  (24, {128, 156, new_msg, 0, 1237728, 1, 96, 0}  (24, {128, 156, new_msg, 0, 1237728, 1, 96, 0} "\210\6\31\1\33\0\1\0\0\0\0\0\1\346\22\0\1\0\0\0\0\0\11\4\1\1\1\0<\0@\0\250\6\31\1\14\1\0\0\377\377\377\377\0\0\0\0\360Z\244\0\0\0\0\0\251\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0(\0,\0\350\6\31\1\0\0\0\0\0\0\0\0\340\351\22\0\0\0\0\0" ... {128, 156, reply, 0, 424, 436, 1523, 0} "\210\347\26\0\33\0\1\0\0\0\0\0\1\346\22\0\1\0\0\0\0\0\11\4\1\1\1\0<\0@\0\250\6\31\1\14\1\0\0\377\377\377\377\0\0\0\0\360Z\244\0\0\0\0\0\251\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0(\0,\0\350\6\31\1\0\0\0\0\0\0\0\0\340\351\22\0\0\0\0\0" )  ... {128, 156, reply, 0, 424, 436, 1523, 0}  (24, {128, 156, new_msg, 0, 1237728, 1, 96, 0} "\210\6\31\1\33\0\1\0\0\0\0\0\1\346\22\0\1\0\0\0\0\0\11\4\1\1\1\0<\0@\0\250\6\31\1\14\1\0\0\377\377\377\377\0\0\0\0\360Z\244\0\0\0\0\0\251\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0(\0,\0\350\6\31\1\0\0\0\0\0\0\0\0\340\351\22\0\0\0\0\0" ... {128, 156, reply, 0, 424, 436, 1523, 0} "\210\347\26\0\33\0\1\0\0\0\0\0\1\346\22\0\1\0\0\0\0\0\11\4\1\1\1\0<\0@\0\250\6\31\1\14\1\0\0\377\377\377\377\0\0\0\0\360Z\244\0\0\0\0\0\251\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0(\0,\0\350\6\31\1\0\0\0\0\0\0\0\0\340\351\22\0\0\0\0\0" )  ) == 0x0
 02366   436   NtClose  (268, ... ) == 0x0
 02367   436   NtClose  (272, ... ) == 0x0
 02368   436   NtUnmapViewOfSection  (-1, 0xa20000, ... ) == 0x0
 02369   436   NtUnmapViewOfSection  (-1, 0x12e9e0, ... ) == STATUS_NOT_MAPPED_VIEW
 02370   436   NtQueryDebugFilterState  (53, 2, ... ) == 0x0
 02371   436   NtOpenKey  (0x8, {24, 0, 0x40, 0, 0,  (0x8, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows\CurrentVersion\SideBySide\AssemblyStorageRoots"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02372   436   NtQueryDebugFilterState  (53, 2, ... ) == 0x0
 02373   436   NtQueryDebugFilterState  (53, 2, ... ) == 0x0
 02374   436   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\u:\work\packed.exe.Local\"}, 1235956, ... }, 1235956, ...
 02289   568   NtWaitForSingleObject  ... ) == 0x0
 02375   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=79}, 0x0, ) , 16, 0, ... {status=0x103, info=79}, 0x0, ) == 0x103
 02376   568   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ...
 02374   436   NtQueryAttributesFile  ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02377   436   NtQueryDebugFilterState  (53, 2, ... ) == 0x0
 02378   436   NtQueryDebugFilterState  (53, 2, ... ) == 0x0
 02379   436   NtQueryDebugFilterState  (53, 2, ... ) == 0x0
 02380   436   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.0.0_x-ww_1382d70a"}, 1236548, ... ) }, 1236548, ... ) == 0x0
 02381   436   NtOpenFile  (0x100020, {24, 0, 0x40, 0, 0,  (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.0.0_x-ww_1382d70a"}, 3, 33, ... 272, {status=0x0, info=1}, ) }, 3, 33, ... 272, {status=0x0, info=1}, ) == 0x0
 02382   436   NtQueryDebugFilterState  (53, 2, ... ) == 0x0
 02383   436   NtOpenKey  (0x20019, {24, 48, 0x40, 0, 0,  (0x20019, {24, 48, 0x40, 0, 0, "Software\Microsoft\Windows\CurrentVersion\Telephony"}, ... 268, ) }, ... 268, ) == 0x0
 02384   436   NtQueryValueKey  (268,  (268, "Tapi32MaxNumRequestRetries", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02385   436   NtQueryValueKey  (268,  (268, "Tapi32RequestRetryTimeout", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02386   436   NtClose  (268, ... ) == 0x0
 02387   436   NtCreateMutant  (0x1f0001, 0x0, 0, ... 268, ) == 0x0
 02388   436   NtCreateMutant  (0x1f0001, {24, 52, 0x80, 1392200, 0,  (0x1f0001, {24, 52, 0x80, 1392200, 0, "RasPbFile"}, 0, ... ) }, 0, ... ) == STATUS_ACCESS_DENIED
 02389   436   NtOpenMutant  (0x100000, {24, 52, 0x0, 0, 0,  (0x100000, {24, 52, 0x0, 0, 0, "RasPbFile"}, ... 276, ) }, ... 276, ) == 0x0
 02390   436   NtCreateEvent  (0x1f0003, 0x0, 0, 1, ... 280, ) == 0x0
 02391   436   NtCreateEvent  (0x1f0003, 0x0, 1, 0, ... 284, ) == 0x0
 02392   436   NtCreateEvent  (0x1f0003, 0x0, 0, 1, ... 288, ) == 0x0
 02393   436   NtAllocateVirtualMemory  (-1, 1392640, 0, 4096, 4096, 4, ... 1392640, 4096, ) == 0x0
 02394   436   NtCreateSemaphore  (0x100003, 0x0, 0, 2147483647, ... 292, ) == 0x0
 02395   436   NtCreateSemaphore  (0x100003, 0x0, 0, 2147483647, ... 296, ) == 0x0
 02396   436   NtCreateEvent  (0x1f0003, 0x0, 1, 0, ... 300, ) == 0x0
 02397   436   NtCreateEvent  (0x1f0003, 0x0, 1, 0, ... 304, ) == 0x0
 02398   436   NtCreateKey  (0xf003f, {24, 48, 0x40, 0, 0,  (0xf003f, {24, 48, 0x40, 0, 0, "Software\Microsoft\Tracing"}, 0, 0x0, 0, ... 308, 2, ) }, 0, 0x0, 0, ... 308, 2, ) == 0x0
 02399   436   NtQueryValueKey  (308,  (308, "EnableConsoleTracing", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (308, "EnableConsoleTracing", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) }, 16, ) == 0x0
 02400   436   NtClose  (308, ... ) == 0x0
 02401   436   NtCreateSemaphore  (0x100003, 0x0, 0, 2147483647, ... 308, ) == 0x0
 02402   436   NtCreateSemaphore  (0x100003, 0x0, 0, 2147483647, ... 312, ) == 0x0
 02403   436   NtOpenKey  (0x20019, {24, 48, 0x40, 0, 0,  (0x20019, {24, 48, 0x40, 0, 0, "Software\Microsoft\Tracing\RASAPI32"}, ... 316, ) }, ... 316, ) == 0x0
 02404   436   NtQueryValueKey  (316,  (316, "EnableFileTracing", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (316, "EnableFileTracing", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) }, 16, ) == 0x0
 02405   436   NtQueryValueKey  (316,  (316, "FileTracingMask", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\377\377"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (316, "FileTracingMask", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\377\377"}, 16, ) }, 16, ) == 0x0
 02406   436   NtQueryValueKey  (316,  (316, "EnableConsoleTracing", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (316, "EnableConsoleTracing", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) }, 16, ) == 0x0
 02407   436   NtQueryValueKey  (316,  (316, "ConsoleTracingMask", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\377\377"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (316, "ConsoleTracingMask", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\377\377"}, 16, ) }, 16, ) == 0x0
 02408   436   NtQueryValueKey  (316,  (316, "MaxFileSize", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\20\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (316, "MaxFileSize", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\20\0"}, 16, ) }, 16, ) == 0x0
 02409   436   NtQueryValueKey  (316,  (316, "FileDirectory", Partial, 144, ... TitleIdx=0, Type=2, Data="%\0w\0i\0n\0d\0i\0r\0%\0\\0t\0r\0a\0c\0i\0n\0g\0\0\0"}, 46, ) , Partial, 144, ... TitleIdx=0, Type=2, Data= (316, "FileDirectory", Partial, 144, ... TitleIdx=0, Type=2, Data="%\0w\0i\0n\0d\0i\0r\0%\0\\0t\0r\0a\0c\0i\0n\0g\0\0\0"}, 46, ) }, 46, ) == 0x0
 02410   436   NtQueryValueKey  (316,  (316, "FileDirectory", Partial, 144, ... TitleIdx=0, Type=2, Data="%\0w\0i\0n\0d\0i\0r\0%\0\\0t\0r\0a\0c\0i\0n\0g\0\0\0"}, 46, ) , Partial, 144, ... TitleIdx=0, Type=2, Data= (316, "FileDirectory", Partial, 144, ... TitleIdx=0, Type=2, Data="%\0w\0i\0n\0d\0i\0r\0%\0\\0t\0r\0a\0c\0i\0n\0g\0\0\0"}, 46, ) }, 46, ) == 0x0
 02411   436   NtCreateEvent  (0x1f0003, 0x0, 1, 0, ... 320, ) == 0x0
 02412   436   NtNotifyChangeKey  (316, 320, 0, 0, 2011390432, 14, 0, 0, 0, 1, ... ) == 0x103
 02413   436   NtQueryValueKey  (316,  (316, "EnableFileTracing", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (316, "EnableFileTracing", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) }, 16, ) == 0x0
 02414   436   NtQueryValueKey  (316,  (316, "FileTracingMask", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\377\377"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (316, "FileTracingMask", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\377\377"}, 16, ) }, 16, ) == 0x0
 02415   436   NtQueryValueKey  (316,  (316, "EnableConsoleTracing", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (316, "EnableConsoleTracing", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) }, 16, ) == 0x0
 02416   436   NtQueryValueKey  (316,  (316, "ConsoleTracingMask", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\377\377"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (316, "ConsoleTracingMask", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\377\377"}, 16, ) }, 16, ) == 0x0
 02417   436   NtQueryValueKey  (316,  (316, "MaxFileSize", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\20\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (316, "MaxFileSize", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\20\0"}, 16, ) }, 16, ) == 0x0
 02418   436   NtQueryValueKey  (316,  (316, "FileDirectory", Partial, 144, ... TitleIdx=0, Type=2, Data="%\0w\0i\0n\0d\0i\0r\0%\0\\0t\0r\0a\0c\0i\0n\0g\0\0\0"}, 46, ) , Partial, 144, ... TitleIdx=0, Type=2, Data= (316, "FileDirectory", Partial, 144, ... TitleIdx=0, Type=2, Data="%\0w\0i\0n\0d\0i\0r\0%\0\\0t\0r\0a\0c\0i\0n\0g\0\0\0"}, 46, ) }, 46, ) == 0x0
 02419   436   NtQueryValueKey  (316,  (316, "FileDirectory", Partial, 144, ... TitleIdx=0, Type=2, Data="%\0w\0i\0n\0d\0i\0r\0%\0\\0t\0r\0a\0c\0i\0n\0g\0\0\0"}, 46, ) , Partial, 144, ... TitleIdx=0, Type=2, Data= (316, "FileDirectory", Partial, 144, ... TitleIdx=0, Type=2, Data="%\0w\0i\0n\0d\0i\0r\0%\0\\0t\0r\0a\0c\0i\0n\0g\0\0\0"}, 46, ) }, 46, ) == 0x0
 02420   436   NtNotifyChangeKey  (316, 320, 0, 0, 2011390432, 14, 0, 0, 0, 1, ... ) == 0x103
 02421   436   NtSetEvent  (304, ... 0x0, ) == 0x0
 02422   436   NtOpenEvent  (0x100000, {24, 52, 0x0, 0, 0,  (0x100000, {24, 52, 0x0, 0, 0, "Global\SvcctrlStartEvent_A3752DX"}, ... 324, ) }, ... 324, ) == 0x0
 02423   436   NtWaitForSingleObject  (324, 0, {-1800000000, -1}, ... ) == 0x0
 02424   436   NtClose  (324, ... ) == 0x0
 02425   436   NtCreateEvent  (0x1f0003, 0x0, 0, 0, ... 324, ) == 0x0
 02426   436   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ... 328, ) == 0x0
 02427   436   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\System\CurrentControlSet\Control\ComputerName"}, ... 332, ) }, ... 332, ) == 0x0
 02428   436   NtOpenKey  (0x20019, {24, 332, 0x40, 0, 0,  (0x20019, {24, 332, 0x40, 0, 0, "ActiveComputerName"}, ... 336, ) }, ... 336, ) == 0x0
 02429   436   NtQueryValueKey  (336,  (336, "ComputerName", Full, 108, ... TitleIdx=0, Type=1, Name="ComputerName", Data="M\0Y\0W\0O\0R\0L\0D\0\0\0"}, 60, ) , Full, 108, ... TitleIdx=0, Type=1, Name= (336, "ComputerName", Full, 108, ... TitleIdx=0, Type=1, Name="ComputerName", Data="M\0Y\0W\0O\0R\0L\0D\0\0\0"}, 60, ) , Data= (336, "ComputerName", Full, 108, ... TitleIdx=0, Type=1, Name="ComputerName", Data="M\0Y\0W\0O\0R\0L\0D\0\0\0"}, 60, ) }, 60, ) == 0x0
 02430   436   NtClose  (336, ... ) == 0x0
 02431   436   NtClose  (332, ... ) == 0x0
 02432   436   NtCreateIoCompletion  (0x1f0003, 0x0, 0, ... 332, ) == 0x0
 02433   436   NtCreateIoCompletion  (0x1f0003, 0x0, -1, ... 336, ) == 0x0
 02434   436   NtDuplicateObject  (-1, 332, -1, 0x0, 0, 2, ... 340, ) == 0x0
 02435   436   NtOpenThreadToken  (-2, 0xc, 1, ... ) == STATUS_NO_TOKEN
 02436   436   NtAllocateVirtualMemory  (-1, 1396736, 0, 4096, 4096, 4, ... 1396736, 4096, ) == 0x0
 02437   436   NtCreateEvent  (0x1f0003, 0x0, 1, 0, ... 344, ) == 0x0
 02438   436   NtOpenThreadToken  (-2, 0xc, 1, ... ) == STATUS_NO_TOKEN
 02439   436   NtSetInformationThread  (-2, ImpersonationToken, {ImpToken=0,}, 4, ... ) == 0x0
 02440   436   NtCreateFile  (0xc0100080, {24, 0, 0x40, 0, 1240604,  (0xc0100080, {24, 0, 0x40, 0, 1240604, "\??\PIPE\svcctl"}, 0x0, 0, 3, 1, 4194368, 0, 0, ... 348, {status=0x0, info=1}, ) }, 0x0, 0, 3, 1, 4194368, 0, 0, ... 348, {status=0x0, info=1}, ) == 0x0
 02441   436   NtSetInformationFile  (348, 1240660, 8, Pipe, ... {status=0x0, info=0}, ) == 0x0
 02442   436   NtSetInformationFile  (348, 1240652, 8, Completion, ... {status=0x0, info=0}, ) == 0x0
 02443   436   NtSetInformationThread  (-2, ImpersonationToken, {ImpToken=0,}, 4, ... ) == 0x0
 02444   436   NtWriteFile  (348, 325, 0, 0,  (348, 325, 0, 0, "\5\0\13\3\20\0\0\0H\0\0\0\1\0\0\0\270\20\270\20\0\0\0\0\1\0\0\0\0\0\1\0\201\273z6D\230\3615\2552\230\3608\0\20\3\2\0\0\0\4]\210\212\353\34\311\21\237\350\10\0+\20H`\2\0\0\0", 72, {0, 0}, 0, ... {status=0x0, info=72}, ) , 72, {0, 0}, 0, ... {status=0x0, info=72}, ) == 0x0
 02445   436   NtReadFile  (348, 325, 0, 0, 1024, {0, 0}, 0, ... {status=0x0, info=68},  (348, 325, 0, 0, 1024, {0, 0}, 0, ... {status=0x0, info=68}, "\5\0\14\3\20\0\0\0D\0\0\0\1\0\0\0\270\20\270\20\273 \0\0\15\0\PIPE\ntsvcs\0\0\1\0\0\0\0\0\0\0\4]\210\212\353\34\311\21\237\350\10\0+\20H`\2\0\0\0", ) , ) == 0x0
 02446   436   NtFsControlFile  (348, 325, 0x0, 0x0, 0x11c017,  (348, 325, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0$\0\0\0\1\0\0\0\14\0\0\0\0\0\17\0\0\0\0\0\0\0\0\0\0\0\0\200", 36, 1024, ... {status=0x103, info=68}, "\5\0\14\3\20\0\0\0D\0\0\0\1\0\0\0\270\20\270\20\273 \0\0\15\0\PIPE\ntsvcs\0\0\1\0\0\0\0\0\0\0\4]\210\212\353\34\311\21\237\350\10\0+\20H`\2\0\0\0", ) , 36, 1024, ... {status=0x103, info=68},  (348, 325, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0$\0\0\0\1\0\0\0\14\0\0\0\0\0\17\0\0\0\0\0\0\0\0\0\0\0\0\200", 36, 1024, ... {status=0x103, info=68}, "\5\0\14\3\20\0\0\0D\0\0\0\1\0\0\0\270\20\270\20\273 \0\0\15\0\PIPE\ntsvcs\0\0\1\0\0\0\0\0\0\0\4]\210\212\353\34\311\21\237\350\10\0+\20H`\2\0\0\0", ) , ) == 0x103
 02447   436   NtFsControlFile  (348, 325, 0x0, 0x0, 0x11c017,  (348, 325, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0L\0\0\0\2\0\0\04\0\0\0\0\0\20\0\0\0\0\0\330\224\26\332*,\334\21\261\306\0\14)\371\246\305\7\0\0\0\0\0\0\0\7\0\0\0R\0A\0S\0M\0A\0N\0\0\0\0\0\4\0\0\0", 76, 1024, ... {status=0x103, info=48}, "\5\0\2\3\20\0\0\00\0\0\0\1\0\0\0\30\0\0\0\0\0\0\0\0\0\0\0\330\224\26\332*,\334\21\261\306\0\14)\371\246\305\0\0\0\0", ) , 76, 1024, ... {status=0x103, info=48},  (348, 325, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0L\0\0\0\2\0\0\04\0\0\0\0\0\20\0\0\0\0\0\330\224\26\332*,\334\21\261\306\0\14)\371\246\305\7\0\0\0\0\0\0\0\7\0\0\0R\0A\0S\0M\0A\0N\0\0\0\0\0\4\0\0\0", 76, 1024, ... {status=0x103, info=48}, "\5\0\2\3\20\0\0\00\0\0\0\1\0\0\0\30\0\0\0\0\0\0\0\0\0\0\0\330\224\26\332*,\334\21\261\306\0\14)\371\246\305\0\0\0\0", ) , ) == 0x103
 02448   436   NtFsControlFile  (348, 325, 0x0, 0x0, 0x11c017,  (348, 325, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0,\0\0\0\3\0\0\0\24\0\0\0\0\0\6\0\0\0\0\0\331\224\26\332*,\334\21\261\306\0\14)\371\246\305", 44, 1024, ... {status=0x103, info=48}, "\5\0\2\3\20\0\0\00\0\0\0\2\0\0\0\30\0\0\0\0\0\0\0\0\0\0\0\331\224\26\332*,\334\21\261\306\0\14)\371\246\305\0\0\0\0", ) , 44, 1024, ... {status=0x103, info=48},  (348, 325, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0,\0\0\0\3\0\0\0\24\0\0\0\0\0\6\0\0\0\0\0\331\224\26\332*,\334\21\261\306\0\14)\371\246\305", 44, 1024, ... {status=0x103, info=48}, "\5\0\2\3\20\0\0\00\0\0\0\2\0\0\0\30\0\0\0\0\0\0\0\0\0\0\0\331\224\26\332*,\334\21\261\306\0\14)\371\246\305\0\0\0\0", ) , ) == 0x103
 02449   436   NtFsControlFile  (348, 325, 0x0, 0x0, 0x11c017,  (348, 325, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0,\0\0\0\4\0\0\0\24\0\0\0\0\0\0\0\0\0\0\0\331\224\26\332*,\334\21\261\306\0\14)\371\246\305", 44, 1024, ... {status=0x103, info=56}, "\5\0\2\3\20\0\0\08\0\0\0\3\0\0\0 \0\0\0\0\0\0\0 \0\0\0\1\0\0\0\0\0\0\05\4\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0", ) , 44, 1024, ... {status=0x103, info=56},  (348, 325, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0,\0\0\0\4\0\0\0\24\0\0\0\0\0\0\0\0\0\0\0\331\224\26\332*,\334\21\261\306\0\14)\371\246\305", 44, 1024, ... {status=0x103, info=56}, "\5\0\2\3\20\0\0\08\0\0\0\3\0\0\0 \0\0\0\0\0\0\0 \0\0\0\1\0\0\0\0\0\0\05\4\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0", ) , ) == 0x103
 02450   436   NtFsControlFile  (348, 325, 0x0, 0x0, 0x11c017,  (348, 325, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0,\0\0\0\5\0\0\0\24\0\0\0\0\0\0\0\0\0\0\0\330\224\26\332*,\334\21\261\306\0\14)\371\246\305", 44, 1024, ... {status=0x103, info=48}, "\5\0\2\3\20\0\0\00\0\0\0\4\0\0\0\30\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0", ) , 44, 1024, ... {status=0x103, info=48},  (348, 325, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0,\0\0\0\5\0\0\0\24\0\0\0\0\0\0\0\0\0\0\0\330\224\26\332*,\334\21\261\306\0\14)\371\246\305", 44, 1024, ... {status=0x103, info=48}, "\5\0\2\3\20\0\0\00\0\0\0\4\0\0\0\30\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0", ) , ) == 0x103
 02451   436   NtClose  (344, ... ) == 0x0
 02452   436   NtClose  (348, ... ) == 0x0
 02453   436   NtReleaseMutant  (244, ... 0x0, ) == 0x0
 02454   436   NtQueryValueKey  (76,  (76, "EnableAutodial", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (76, "EnableAutodial", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) }, 16, ) == 0x0
 02455   436   NtQueryValueKey  (76,  (76, "NoNetAutodial", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (76, "NoNetAutodial", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) }, 16, ) == 0x0
 02456   436   NtOpenEvent  (0x100000, {24, 0, 0x0, 0, 0,  (0x100000, {24, 0, 0x0, 0, 0, "\INSTALLATION_SECURITY_HOLD"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02457   436   NtOpenThreadToken  (-2, 0xc, 1, ... ) == STATUS_NO_TOKEN
 02458   436   NtCreateEvent  (0x1f0003, 0x0, 1, 0, ... 348, ) == 0x0
 02459   436   NtOpenThreadToken  (-2, 0xc, 1, ... ) == STATUS_NO_TOKEN
 02460   436   NtSetInformationThread  (-2, ImpersonationToken, {ImpToken=0,}, 4, ... ) == 0x0
 02461   436   NtCreateFile  (0xc0100080, {24, 0, 0x40, 0, 1238108,  (0xc0100080, {24, 0, 0x40, 0, 1238108, "\??\PIPE\lsarpc"}, 0x0, 0, 3, 1, 64, 0, 0, ... 344, {status=0x0, info=1}, ) }, 0x0, 0, 3, 1, 64, 0, 0, ... 344, {status=0x0, info=1}, ) == 0x0
 02462   436   NtSetInformationFile  (344, 1238164, 8, Pipe, ... {status=0x0, info=0}, ) == 0x0
 02463   436   NtSetInformationFile  (344, 1238156, 8, Completion, ... {status=0x0, info=0}, ) == 0x0
 02464   436   NtSetInformationThread  (-2, ImpersonationToken, {ImpToken=0,}, 4, ... ) == 0x0
 02465   436   NtWriteFile  (344, 325, 0, 0,  (344, 325, 0, 0, "\5\0\13\3\20\0\0\0H\0\0\0\1\0\0\0\270\20\270\20\0\0\0\0\1\0\0\0\0\0\1\0j(\319\14\261\320\21\233\250\0\300O\331.\365\0\0\0\0\4]\210\212\353\34\311\21\237\350\10\0+\20H`\2\0\0\0", 72, {0, 0}, 0, ... {status=0x0, info=72}, ) , 72, {0, 0}, 0, ... {status=0x0, info=72}, ) == 0x0
 02466   436   NtReadFile  (344, 325, 0, 0, 1024, {0, 0}, 0, ... {status=0x0, info=68},  (344, 325, 0, 0, 1024, {0, 0}, 0, ... {status=0x0, info=68}, "\5\0\14\3\20\0\0\0D\0\0\0\1\0\0\0\270\20\270\20\351\36\0\0\14\0\PIPE\lsass\0\0\0\1\0\0\0\0\0\0\0\4]\210\212\353\34\311\21\237\350\10\0+\20H`\2\0\0\0", ) , ) == 0x0
 02467   436   NtFsControlFile  (344, 325, 0x0, 0x0, 0x11c017,  (344, 325, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0\32\0\0\0\1\0\0\0\2\0\0\0\0\0\0\0\1\0", 26, 1024, ... {status=0x103, info=68}, "\5\0\14\3\20\0\0\0D\0\0\0\1\0\0\0\270\20\270\20\351\36\0\0\14\0\PIPE\lsass\0\0\0\1\0\0\0\0\0\0\0\4]\210\212\353\34\311\21\237\350\10\0+\20H`\2\0\0\0", ) , 26, 1024, ... {status=0x103, info=68},  (344, 325, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0\32\0\0\0\1\0\0\0\2\0\0\0\0\0\0\0\1\0", 26, 1024, ... {status=0x103, info=68}, "\5\0\14\3\20\0\0\0D\0\0\0\1\0\0\0\270\20\270\20\351\36\0\0\14\0\PIPE\lsass\0\0\0\1\0\0\0\0\0\0\0\4]\210\212\353\34\311\21\237\350\10\0+\20H`\2\0\0\0", ) , ) == 0x103
 02468   436   NtClose  (348, ... ) == 0x0
 02469   436   NtClose  (344, ... ) == 0x0
 02470   436   NtCreateKey  (0x2001d, {24, 48, 0x40, 0, 0,  (0x2001d, {24, 48, 0x40, 0, 0, "Software\Microsoft\RAS AutoDial"}, 0, 0x0, 0, ... 344, 2, ) }, 0, 0x0, 0, ... 344, 2, ) == 0x0
 02471   436   NtCreateKey  (0x20019, {24, 344, 0x40, 0, 0,  (0x20019, {24, 344, 0x40, 0, 0, "Default"}, 0, 0x0, 0, ... 348, 2, ) }, 0, 0x0, 0, ... 348, 2, ) == 0x0
 02472   436   NtClose  (344, ... ) == 0x0
 02473   436   NtQueryValueKey  (348,  (348, "DefaultInternet", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02474   436   NtClose  (348, ... ) == 0x0
 02475   436   NtOpenEvent  (0x100000, {24, 52, 0x0, 0, 0,  (0x100000, {24, 52, 0x0, 0, 0, "Global\SvcctrlStartEvent_A3752DX"}, ... 348, ) }, ... 348, ) == 0x0
 02476   436   NtWaitForSingleObject  (348, 0, {-1800000000, -1}, ... ) == 0x0
 02477   436   NtClose  (348, ... ) == 0x0
 02478   436   NtOpenThreadToken  (-2, 0xc, 1, ... ) == STATUS_NO_TOKEN
 02479   436   NtCreateEvent  (0x1f0003, 0x0, 1, 0, ... 348, ) == 0x0
 02480   436   NtOpenThreadToken  (-2, 0xc, 1, ... ) == STATUS_NO_TOKEN
 02481   436   NtSetInformationThread  (-2, ImpersonationToken, {ImpToken=0,}, 4, ... ) == 0x0
 02482   436   NtCreateFile  (0xc0100080, {24, 0, 0x40, 0, 1240192,  (0xc0100080, {24, 0, 0x40, 0, 1240192, "\??\PIPE\svcctl"}, 0x0, 0, 3, 1, 4194368, 0, 0, ... 344, {status=0x0, info=1}, ) }, 0x0, 0, 3, 1, 4194368, 0, 0, ... 344, {status=0x0, info=1}, ) == 0x0
 02483   436   NtSetInformationFile  (344, 1240248, 8, Pipe, ... {status=0x0, info=0}, ) == 0x0
 02484   436   NtSetInformationFile  (344, 1240240, 8, Completion, ... {status=0x0, info=0}, ) == 0x0
 02485   436   NtSetInformationThread  (-2, ImpersonationToken, {ImpToken=0,}, 4, ... ) == 0x0
 02486   436   NtWriteFile  (344, 325, 0, 0,  (344, 325, 0, 0, "\5\0\13\3\20\0\0\0H\0\0\0\1\0\0\0\270\20\270\20\0\0\0\0\1\0\0\0\0\0\1\0\201\273z6D\230\3615\2552\230\3608\0\20\3\2\0\0\0\4]\210\212\353\34\311\21\237\350\10\0+\20H`\2\0\0\0", 72, {0, 0}, 0, ... {status=0x0, info=72}, ) , 72, {0, 0}, 0, ... {status=0x0, info=72}, ) == 0x0
 02487   436   NtReadFile  (344, 325, 0, 0, 1024, {0, 0}, 0, ... {status=0x0, info=68},  (344, 325, 0, 0, 1024, {0, 0}, 0, ... {status=0x0, info=68}, "\5\0\14\3\20\0\0\0D\0\0\0\1\0\0\0\270\20\270\20\274 \0\0\15\0\PIPE\ntsvcs\0\0\1\0\0\0\0\0\0\0\4]\210\212\353\34\311\21\237\350\10\0+\20H`\2\0\0\0", ) , ) == 0x0
 02488   436   NtFsControlFile  (344, 325, 0x0, 0x0, 0x11c017,  (344, 325, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0$\0\0\0\1\0\0\0\14\0\0\0\0\0\33\0\0\0\0\0\0\0\0\0\0\0\0\200", 36, 1024, ... {status=0x103, info=68}, "\5\0\14\3\20\0\0\0D\0\0\0\1\0\0\0\270\20\270\20\274 \0\0\15\0\PIPE\ntsvcs\0\0\1\0\0\0\0\0\0\0\4]\210\212\353\34\311\21\237\350\10\0+\20H`\2\0\0\0", ) , 36, 1024, ... {status=0x103, info=68},  (344, 325, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0$\0\0\0\1\0\0\0\14\0\0\0\0\0\33\0\0\0\0\0\0\0\0\0\0\0\0\200", 36, 1024, ... {status=0x103, info=68}, "\5\0\14\3\20\0\0\0D\0\0\0\1\0\0\0\270\20\270\20\274 \0\0\15\0\PIPE\ntsvcs\0\0\1\0\0\0\0\0\0\0\4]\210\212\353\34\311\21\237\350\10\0+\20H`\2\0\0\0", ) , ) == 0x103
 02489   436   NtFsControlFile  (344, 325, 0x0, 0x0, 0x11c017,  (344, 325, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0@\0\0\0\2\0\0\0(\0\0\0\0\0\32\0\0\0\0\0\332\224\26\332*,\334\21\261\306\0\14)\371\246\3050\0\0\0\1\0\0\0@\2\0\0L\365\22\0\0\0\0\0", 64, 1024, ... {status=0x103, info=48}, "\5\0\2\3\20\0\0\00\0\0\0\1\0\0\0\30\0\0\0\0\0\0\0\0\0\0\0\332\224\26\332*,\334\21\261\306\0\14)\371\246\305\0\0\0\0", ) , 64, 1024, ... {status=0x103, info=48},  (344, 325, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0@\0\0\0\2\0\0\0(\0\0\0\0\0\32\0\0\0\0\0\332\224\26\332*,\334\21\261\306\0\14)\371\246\3050\0\0\0\1\0\0\0@\2\0\0L\365\22\0\0\0\0\0", 64, 1024, ... {status=0x103, info=48}, "\5\0\2\3\20\0\0\00\0\0\0\1\0\0\0\30\0\0\0\0\0\0\0\0\0\0\0\332\224\26\332*,\334\21\261\306\0\14)\371\246\305\0\0\0\0", ) , ) == 0x103
 02490   436   NtFsControlFile  (344, 325, 0x0, 0x0, 0x11c017,  (344, 325, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0@\0\0\0\3\0\0\0(\0\0\0\0\0\32\0\0\0\0\0\332\224\26\332*,\334\21\261\306\0\14)\371\246\3050\0\0\0\1\0\0\0@\2\0\0L\365\22\02\0\0\0", 64, 1024, ... {status=0x103, info=624}, "\5\0\2\3\20\0\0\0p\2\0\0\2\0\0\0X\2\0\0\0\0\0\0@\2\0\0.\2\0\0\22\2\0\0 \0\0\0\4\0\0\0\200\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\2\0\0\340\1\0\0 \0\0\0\4\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\316\1\0\0\240\1\0\0 \0\0\0\4\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\226\1\0\0~\1\0\0 \0\0\0\4\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0l\1\0\0B\1\0\0 \0\0\0\4\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\1\0\0\32\1\0\0 \0\0\0\4\0\0\0\31\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\16\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0E\0R\0S\0v\0c\0\0\0DNS Client\0\0i\0e\0n\0t\0\0\0Dnscache\0\0c\0h\0e\0\0\0Logical Disk Manager\0\0k\0 \0M\0a\0n\0a\0g\0e\0r\0\0\0dmserver\0\0v\0e\0r\0\0\0DHCP Client\0l\0i\0e\0n\0t\0\0\0Dhcp\0\0p\0\0\0Cryptographic Services\0\0c\0 \0S\0e\0r\0v\0i\0c\0e\0s\0\0\0CryptSvc\0\0", ) , 64, 1024, ... {status=0x103, info=624},  (344, 325, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0@\0\0\0\3\0\0\0(\0\0\0\0\0\32\0\0\0\0\0\332\224\26\332*,\334\21\261\306\0\14)\371\246\3050\0\0\0\1\0\0\0@\2\0\0L\365\22\02\0\0\0", 64, 1024, ... {status=0x103, info=624}, "\5\0\2\3\20\0\0\0p\2\0\0\2\0\0\0X\2\0\0\0\0\0\0@\2\0\0.\2\0\0\22\2\0\0 \0\0\0\4\0\0\0\200\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\2\0\0\340\1\0\0 \0\0\0\4\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\316\1\0\0\240\1\0\0 \0\0\0\4\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\226\1\0\0~\1\0\0 \0\0\0\4\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0l\1\0\0B\1\0\0 \0\0\0\4\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\1\0\0\32\1\0\0 \0\0\0\4\0\0\0\31\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\16\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0E\0R\0S\0v\0c\0\0\0DNS Client\0\0i\0e\0n\0t\0\0\0Dnscache\0\0c\0h\0e\0\0\0Logical Disk Manager\0\0k\0 \0M\0a\0n\0a\0g\0e\0r\0\0\0dmserver\0\0v\0e\0r\0\0\0DHCP Client\0l\0i\0e\0n\0t\0\0\0Dhcp\0\0p\0\0\0Cryptographic Services\0\0c\0 \0S\0e\0r\0v\0i\0c\0e\0s\0\0\0CryptSvc\0\0", ) , ) == 0x103
 02491   436   NtFsControlFile  (344, 325, 0x0, 0x0, 0x11c017,  (344, 325, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0@\0\0\0\4\0\0\0(\0\0\0\0\0\32\0\0\0\0\0\332\224\26\332*,\334\21\261\306\0\14)\371\246\3050\0\0\0\1\0\0\0@\2\0\0L\365\22\0>\0\0\0", 64, 1024, ... {status=0x103, info=624}, "\5\0\2\3\20\0\0\0p\2\0\0\3\0\0\0X\2\0\0\0\0\0\0@\2\0\04\2\0\0\4\2\0\0 \0\0\0\4\0\0\0\4\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\362\1\0\0\336\1\0\0 \0\0\0\4\0\0\0\4\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\306\1\0\0\242\1\0\0 \0\0\0\4\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0d\1\0\0 \1\0\0 \0\0\0\4\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\20\1\0\0\356\0\0\0 \0\0\0\4\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0Help and Support\0\0S\0u\0p\0p\0o\0r\0t\0\0\0helpsvc\0s\0v\0c\0\0\0Fast User Switching Compatibility\0n\0g\0 \0C\0o\0m\0p\0a\0t\0i\0b\0i\0l\0i\0t\0y\0\0\0FastUserSwitchingCompatibility\0\0g\0C\0o\0m\0p\0a\0t\0i\0b\0i\0l\0i\0t\0y\0\0\0COM+ Event System\0t\0 \0S\0y\0s\0t\0e\0m\0\0\0EventSystem\0y\0s\0t\0", ) , 64, 1024, ... {status=0x103, info=624},  (344, 325, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0@\0\0\0\4\0\0\0(\0\0\0\0\0\32\0\0\0\0\0\332\224\26\332*,\334\21\261\306\0\14)\371\246\3050\0\0\0\1\0\0\0@\2\0\0L\365\22\0>\0\0\0", 64, 1024, ... {status=0x103, info=624}, "\5\0\2\3\20\0\0\0p\2\0\0\3\0\0\0X\2\0\0\0\0\0\0@\2\0\04\2\0\0\4\2\0\0 \0\0\0\4\0\0\0\4\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\362\1\0\0\336\1\0\0 \0\0\0\4\0\0\0\4\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\306\1\0\0\242\1\0\0 \0\0\0\4\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0d\1\0\0 \1\0\0 \0\0\0\4\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\20\1\0\0\356\0\0\0 \0\0\0\4\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0Help and Support\0\0S\0u\0p\0p\0o\0r\0t\0\0\0helpsvc\0s\0v\0c\0\0\0Fast User Switching Compatibility\0n\0g\0 \0C\0o\0m\0p\0a\0t\0i\0b\0i\0l\0i\0t\0y\0\0\0FastUserSwitchingCompatibility\0\0g\0C\0o\0m\0p\0a\0t\0i\0b\0i\0l\0i\0t\0y\0\0\0COM+ Event System\0t\0 \0S\0y\0s\0t\0e\0m\0\0\0EventSystem\0y\0s\0t\0", ) , ) == 0x103
 02492   436   NtFsControlFile  (344, 325, 0x0, 0x0, 0x11c017,  (344, 325, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0@\0\0\0\5\0\0\0(\0\0\0\0\0\32\0\0\0\0\0\332\224\26\332*,\334\21\261\306\0\14)\371\246\3050\0\0\0\1\0\0\0@\2\0\0L\365\22\0p\0\0\0", 64, 1024, ... {status=0x103, info=624}, "\5\0\2\3\20\0\0\0p\2\0\0\4\0\0\0X\2\0\0\0\0\0\0@\2\0\0&\2\0\0\30\2\0\0 \0\0\0\4\0\0\0\7\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\364\1\0\0\334\1\0\0 \0\0\0\4\0\0\0\7\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\314\1\0\0\240\1\0\0 \0\0\0\4\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\214\1\0\0x\1\0\0 \0\0\0\4\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0j\1\0\0B\1\0\0 \1\0\0\4\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0:\1\0\0\370\0\0\0 \0\0\0\4\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0Network Location Awareness (NLA)\0\0A\0w\0a\0r\0e\0n\0e\0s\0s\0 \0(\0N\0L\0A\0)\0\0\0Nla\0a\0\0\0Network Connections\0n\0n\0e\0c\0t\0i\0o\0n\0s\0\0\0Netman\0\0a\0n\0\0\0Messenger\0n\0g\0e\0r\0\0\0Messenger\0n\0g\0e\0r\0\0\0TCP/IP NetBIOS Helper\0I\0O\0S\0 \0H\0e\0l\0p\0e\0r\0\0\0LmHosts\0s\0t\0", ) , 64, 1024, ... {status=0x103, info=624},  (344, 325, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0@\0\0\0\5\0\0\0(\0\0\0\0\0\32\0\0\0\0\0\332\224\26\332*,\334\21\261\306\0\14)\371\246\3050\0\0\0\1\0\0\0@\2\0\0L\365\22\0p\0\0\0", 64, 1024, ... {status=0x103, info=624}, "\5\0\2\3\20\0\0\0p\2\0\0\4\0\0\0X\2\0\0\0\0\0\0@\2\0\0&\2\0\0\30\2\0\0 \0\0\0\4\0\0\0\7\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\364\1\0\0\334\1\0\0 \0\0\0\4\0\0\0\7\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\314\1\0\0\240\1\0\0 \0\0\0\4\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\214\1\0\0x\1\0\0 \0\0\0\4\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0j\1\0\0B\1\0\0 \1\0\0\4\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0:\1\0\0\370\0\0\0 \0\0\0\4\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0Network Location Awareness (NLA)\0\0A\0w\0a\0r\0e\0n\0e\0s\0s\0 \0(\0N\0L\0A\0)\0\0\0Nla\0a\0\0\0Network Connections\0n\0n\0e\0c\0t\0i\0o\0n\0s\0\0\0Netman\0\0a\0n\0\0\0Messenger\0n\0g\0e\0r\0\0\0Messenger\0n\0g\0e\0r\0\0\0TCP/IP NetBIOS Helper\0I\0O\0S\0 \0H\0e\0l\0p\0e\0r\0\0\0LmHosts\0s\0t\0", ) , ) == 0x103
 02493   436   NtFsControlFile  (344, 325, 0x0, 0x0, 0x11c017,  (344, 325, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0@\0\0\0\6\0\0\0(\0\0\0\0\0\32\0\0\0\0\0\332\224\26\332*,\334\21\261\306\0\14)\371\246\3050\0\0\0\1\0\0\0@\2\0\0L\365\22\0\242\0\0\0", 64, 1024, ... {status=0x103, info=624}, "\5\0\2\3\20\0\0\0p\2\0\0\5\0\0\0X\2\0\0\0\0\0\0@\2\0\0.\2\0\0\22\2\0\0 \0\0\0\4\0\0\0\204\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\372\1\0\0\334\1\0\0 \0\0\0\4\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\272\1\0\0\226\1\0\0 \1\0\0\4\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0x\1\0\0X\1\0\0 \0\0\0\4\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0L\1\0\0\24\1\0\0 \0\0\0\4\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\10\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0S\0a\0m\0S\0s\0\0\0Remote Procedure Call (RPC)\0r\0e\0 \0C\0a\0l\0l\0 \0(\0R\0P\0C\0)\0\0\0RpcSs\0S\0s\0\0\0Remote Registry\0e\0g\0i\0s\0t\0r\0y\0\0\0RemoteRegistry\0\0g\0i\0s\0t\0r\0y\0\0\0Protected Storage\0 \0S\0t\0o\0r\0a\0g\0e\0\0\0ProtectedStorage\0\0S\0t\0o\0r\0a\0g\0", ) , 64, 1024, ... {status=0x103, info=624},  (344, 325, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0@\0\0\0\6\0\0\0(\0\0\0\0\0\32\0\0\0\0\0\332\224\26\332*,\334\21\261\306\0\14)\371\246\3050\0\0\0\1\0\0\0@\2\0\0L\365\22\0\242\0\0\0", 64, 1024, ... {status=0x103, info=624}, "\5\0\2\3\20\0\0\0p\2\0\0\5\0\0\0X\2\0\0\0\0\0\0@\2\0\0.\2\0\0\22\2\0\0 \0\0\0\4\0\0\0\204\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\372\1\0\0\334\1\0\0 \0\0\0\4\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\272\1\0\0\226\1\0\0 \1\0\0\4\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0x\1\0\0X\1\0\0 \0\0\0\4\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0L\1\0\0\24\1\0\0 \0\0\0\4\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\10\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0S\0a\0m\0S\0s\0\0\0Remote Procedure Call (RPC)\0r\0e\0 \0C\0a\0l\0l\0 \0(\0R\0P\0C\0)\0\0\0RpcSs\0S\0s\0\0\0Remote Registry\0e\0g\0i\0s\0t\0r\0y\0\0\0RemoteRegistry\0\0g\0i\0s\0t\0r\0y\0\0\0Protected Storage\0 \0S\0t\0o\0r\0a\0g\0e\0\0\0ProtectedStorage\0\0S\0t\0o\0r\0a\0g\0", ) , ) == 0x103
 02494   436   NtFsControlFile  (344, 325, 0x0, 0x0, 0x11c017,  (344, 325, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0,\0\0\0\7\0\0\0\24\0\0\0\0\0\0\0\0\0\0\0\332\224\26\332*,\334\21\261\306\0\14)\371\246\305", 44, 1024, ... {status=0x103, info=624}, "\5\0\2\3\20\0\0\0p\2\0\0\6\0\0\0X\2\0\0\0\0\0\0@\2\0\04\2\0\0\0\2\0\0 \0\0\0\4\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\356\1\0\0\320\1\0\0 \1\0\0\4\0\0\0G\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\276\1\0\0\236\1\0\0 \1\0\0\4\0\0\0\3\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\224\1\0\0`\1\0\0 \0\0\0\4\0\0\0A\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0>\1\0\0\14\1\0\0 \0\0\0\4\0\0\0\207\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\374\0\0\0\340\0\0\0\20\1\0\0\4\0\0\0E\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0Print Spooler\0p\0o\0o\0l\0e\0r\0\0\0Spooler\0l\0e\0r\0\0\0Shell Hardware Detection\0\0e\0 \0D\0e\0t\0e\0c\0t\0i\0o\0n\0\0\0ShellHWDetection\0\0t\0e\0c\0t\0i\0o\0n\0\0\0System Event Notification\0N\0o\0t\0i\0f\0i\0c\0a\0t\0i\0o\0n\0\0\0SENS\0\0S\0\0\0Secondary Logon\0y\0 \0L\0o\0g\0o\0n\0\0\0seclogon\0\0g\0o\0n\0\0\0Task Sch", ) , 44, 1024, ... {status=0x103, info=624},  (344, 325, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0,\0\0\0\7\0\0\0\24\0\0\0\0\0\0\0\0\0\0\0\332\224\26\332*,\334\21\261\306\0\14)\371\246\305", 44, 1024, ... {status=0x103, info=624}, "\5\0\2\3\20\0\0\0p\2\0\0\6\0\0\0X\2\0\0\0\0\0\0@\2\0\04\2\0\0\0\2\0\0 \0\0\0\4\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\356\1\0\0\320\1\0\0 \1\0\0\4\0\0\0G\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\276\1\0\0\236\1\0\0 \1\0\0\4\0\0\0\3\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\224\1\0\0`\1\0\0 \0\0\0\4\0\0\0A\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0>\1\0\0\14\1\0\0 \0\0\0\4\0\0\0\207\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\374\0\0\0\340\0\0\0\20\1\0\0\4\0\0\0E\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0Print Spooler\0p\0o\0o\0l\0e\0r\0\0\0Spooler\0l\0e\0r\0\0\0Shell Hardware Detection\0\0e\0 \0D\0e\0t\0e\0c\0t\0i\0o\0n\0\0\0ShellHWDetection\0\0t\0e\0c\0t\0i\0o\0n\0\0\0System Event Notification\0N\0o\0t\0i\0f\0i\0c\0a\0t\0i\0o\0n\0\0\0SENS\0\0S\0\0\0Secondary Logon\0y\0 \0L\0o\0g\0o\0n\0\0\0seclogon\0\0g\0o\0n\0\0\0Task Sch", ) , ) == 0x103
 02495   436   NtClose  (348, ... ) == 0x0
 02496   436   NtClose  (344, ... ) == 0x0
 02497   436   NtOpenSection  (0xe, {24, 8, 0x40, 0, 0,  (0xe, {24, 8, 0x40, 0, 0, "sensapi.dll"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02498   436   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\u:\work\sensapi.dll"}, 1240452, ... }, 1240452, ...
 02376   568   NtWaitForSingleObject  ... ) == 0x0
 02499   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=79}, 0x0, ) , 16, 0, ... {status=0x103, info=79}, 0x0, ) == 0x103
 02500   568   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ...
 02498   436   NtQueryAttributesFile  ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02501   436   NtQueryAttributesFile  ({24, 12, 0x40, 0, 0,  ({24, 12, 0x40, 0, 0, "sensapi.dll"}, 1240452, ... }, 1240452, ...
 02500   568   NtWaitForSingleObject  ... ) == 0x0
 02502   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=79}, 0x0, ) , 16, 0, ... {status=0x103, info=79}, 0x0, ) == 0x103
 02503   568   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ...
 02501   436   NtQueryAttributesFile  ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02504   436   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\System32\sensapi.dll"}, 1240452, ... ) }, 1240452, ... ) == 0x0
 02505   436   NtOpenFile  (0x100020, {24, 0, 0x40, 0, 0,  (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\System32\sensapi.dll"}, 5, 96, ... 344, {status=0x0, info=1}, ) }, 5, 96, ... 344, {status=0x0, info=1}, ) == 0x0
 02506   436   NtCreateSection  (0xf, 0x0, 0x0, 16, 16777216, 344, ... 348, ) == 0x0
 02507   436   NtQuerySection  (348, Image, 48, ... {section info, class 1, size 48}, 0x0, ) == 0x0
 02508   436   NtClose  (344, ... ) == 0x0
 02509   436   NtMapViewOfSection  (348, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x722b0000), 0x0, 20480, ) == 0x0
 02510   436   NtClose  (348, ... ) == 0x0
 02511   436   NtOpenSection  (0x4, {24, 52, 0x0, 0, 0,  (0x4, {24, 52, 0x0, 0, 0, "SENS Information Cache"}, ... 348, ) }, ... 348, ) == 0x0
 02512   436   NtMapViewOfSection  (348, -1, (0x0), 0, 0, {0, 0}, 0, 1, 0, 2, ... (0xa20000), {0, 0}, 4096, ) == 0x0
 02513   436   NtCreateEvent  (0x1f0003, 0x0, 1, 0, ... 344, ) == 0x0
 02514   436   NtConnectPort  ( ("\RPC Control\senssvc", {12, 2, 1, 1}, 0x0, 0x0, 1240916, 112, ... 352, 0x0, 0x0, 0x0, 112, ) , {12, 2, 1, 1}, 0x0, 0x0, 1240916, 112, ... 352, 0x0, 0x0, 0x0, 112, ) == 0x0
 02515   436   NtRequestWaitReplyPort  (352, {128, 152, new_msg, 0, 1310720, 126248, 1310720, 1240680}  (352, {128, 152, new_msg, 0, 1310720, 126248, 1310720, 1240680} "\0$\370w\30\365\22\0\2$\370w$\344\373c) \321\21\215\270\0\252\0J\275^\1\0\0\0\1\0\0\0 H\25\0\4\0\0\0 H\25\0\20\344\314w H\25\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\6\0 \0\0\0\0\0\0\0\240\1\24\0\240\1\24\0\0\0+\0\320V\25\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\360\375\177\5\0\0\0" ... {128, 152, reply, 0, 424, 436, 1525, 0} "\7$\370w\30\365\22\0\2$\370w$\344\373c) \321\21\215\270\0\252\0J\275^\1\0\0\0\1\0\0\0\0\0\0\0\4\0\0\0 H\25\0\377\377\377\377 H\25\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\6\0 \0\0\0\0\0\0\0\240\1\24\0\240\1\24\0\0\0+\0\320V\25\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\360\375\177\5\0\0\0" )  ... {128, 152, reply, 0, 424, 436, 1525, 0}  (352, {128, 152, new_msg, 0, 1310720, 126248, 1310720, 1240680} "\0$\370w\30\365\22\0\2$\370w$\344\373c) \321\21\215\270\0\252\0J\275^\1\0\0\0\1\0\0\0 H\25\0\4\0\0\0 H\25\0\20\344\314w H\25\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\6\0 \0\0\0\0\0\0\0\240\1\24\0\240\1\24\0\0\0+\0\320V\25\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\360\375\177\5\0\0\0" ... {128, 152, reply, 0, 424, 436, 1525, 0} "\7$\370w\30\365\22\0\2$\370w$\344\373c) \321\21\215\270\0\252\0J\275^\1\0\0\0\1\0\0\0\0\0\0\0\4\0\0\0 H\25\0\377\377\377\377 H\25\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\6\0 \0\0\0\0\0\0\0\240\1\24\0\240\1\24\0\0\0+\0\320V\25\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\360\375\177\5\0\0\0" )  ) == 0x0
 02516   436   NtRequestWaitReplyPort  (352, {32, 56, new_msg, 0, 44, 7, 20, 0}  (352, {32, 56, new_msg, 0, 44, 7, 20, 0} "\1\0\0\0A\2\0\0*,\334\21\261\306\0\14)\371\246\3050\0\0\0\377\377\377\377@\2\0\0" ... {124, 148, reply, 0, 424, 436, 1526, 0} "\2\3778\5\1\0\1\0\17\205!\375\377\377\242\330\4\2\0\351\301\224\377\377\270L \1\0;\370\17\1\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\17\204?\3\0\0\203\357\10\17\204\27\3\0\0\203\357\7\17\204\320\374\377\377O\17\205\21\11\0\0\377\25\240\325\1\0\211\205$\377\377\377\200=4\354\1\0\0\17\204\306\374\377\377\200=\\353\1\0\0\17\205\271\374\377\377\241\340\352\1\0\215" )  ... {124, 148, reply, 0, 424, 436, 1526, 0}  (352, {32, 56, new_msg, 0, 44, 7, 20, 0} "\1\0\0\0A\2\0\0*,\334\21\261\306\0\14)\371\246\3050\0\0\0\377\377\377\377@\2\0\0" ... {124, 148, reply, 0, 424, 436, 1526, 0} "\2\3778\5\1\0\1\0\17\205!\375\377\377\242\330\4\2\0\351\301\224\377\377\270L \1\0;\370\17\1\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\17\204?\3\0\0\203\357\10\17\204\27\3\0\0\203\357\7\17\204\320\374\377\377O\17\205\21\11\0\0\377\25\240\325\1\0\211\205$\377\377\377\200=4\354\1\0\0\17\204\306\374\377\377\200=\\353\1\0\0\17\205\271\374\377\377\241\340\352\1\0\215" )  ) == 0x0
 02517   436   NtWaitForSingleObject  (196, 0, 0x0, ... ) == 0x0
 02518   436   NtQueryInformationFile  (192, 1242024, 24, Standard, ... {status=0x0, info=24}, ) == 0x0
 02519   436   NtReleaseMutant  (196, ... 0x0, ) == 0x0
 02520   436   NtRequestWaitReplyPort  (184, {28, 52, new_msg, 0, 0, 0, 0, 0}  (184, {28, 52, new_msg, 0, 0, 0, 0, 0} "\37\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\1\0\13\30\0\20Z\25\0" ... {176, 200, reply, 0, 424, 436, 1527, 0} "\37\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\1\0\20\0\0\2\220\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0S\0R\0I\0-\0u\0s\0e\0r\0" )  ... {176, 200, reply, 0, 424, 436, 1527, 0}  (184, {28, 52, new_msg, 0, 0, 0, 0, 0} "\37\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\1\0\13\30\0\20Z\25\0" ... {176, 200, reply, 0, 424, 436, 1527, 0} "\37\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\1\0\20\0\0\2\220\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0S\0R\0I\0-\0u\0s\0e\0r\0" )  ) == 0x0
 02521   436   NtOpenKey  (0x1, {24, 48, 0x40, 0, 0,  (0x1, {24, 48, 0x40, 0, 0, "SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02522   436   NtOpenThreadToken  (-2, 0x20008, 1, ... ) == STATUS_NO_TOKEN
 02523   436   NtOpenProcessToken  (-1, 0x20008, ... 356, ) == 0x0
 02524   436   NtQueryInformationToken  (356, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0
 02525   436   NtClose  (356, ... ) == 0x0
 02526   436   NtOpenKey  (0x2000000, {24, 0, 0x40, 0, 0,  (0x2000000, {24, 0, 0x40, 0, 0, "\REGISTRY\USER"}, ... 356, ) }, ... 356, ) == 0x0
 02527   436   NtSetInformationObject  (356, Handle, {Inherit=0,ProtectFromClose=1,}, 2011365632, ... ) == 0x0
 02528   436   NtOpenKey  (0x3, {24, 356, 0x40, 0, 0,  (0x3, {24, 356, 0x40, 0, 0, "S-1-5-21-1078081533-484763869-839522115-1003"}, ... 360, ) }, ... 360, ) == 0x0
 02529   436   NtOpenKey  (0x1, {24, 360, 0x40, 0, 0,  (0x1, {24, 360, 0x40, 0, 0, "Software\Microsoft\windows\CurrentVersion\Internet Settings"}, ... 364, ) }, ... 364, ) == 0x0
 02530   436   NtQueryValueKey  (364,  (364, "MigrateProxy", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (364, "MigrateProxy", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) }, 16, ) == 0x0
 02531   436   NtClose  (364, ... ) == 0x0
 02532   436   NtAllocateVirtualMemory  (-1, 1400832, 0, 20480, 4096, 4, ... 1400832, 20480, ) == 0x0
 02533   436   NtOpenThreadToken  (-2, 0xc, 1, ... ) == STATUS_NO_TOKEN
 02534   436   NtOpenProcessToken  (-1, 0xc, ... 364, ) == 0x0
 02535   436   NtReleaseSemaphore  (208, 1, ... 0, ) == 0x0
 02536   436   NtWaitForSingleObject  (208, 0, {0, 0}, ... ) == 0x0
 02537   436   NtCreateKey  (0x2000000, {24, 48, 0x40, 0, 0,  (0x2000000, {24, 48, 0x40, 0, 0, "Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders"}, 0, 0x0, 0, ... 368, 2, ) }, 0, 0x0, 0, ... 368, 2, ) == 0x0
 02538   436   NtQueryValueKey  (368,  (368, "Common AppData", Partial, 144, ... TitleIdx=0, Type=2, Data="%\0A\0L\0L\0U\0S\0E\0R\0S\0P\0R\0O\0F\0I\0L\0E\0%\0\\0A\0p\0p\0l\0i\0c\0a\0t\0i\0o\0n\0 \0D\0a\0t\0a\0\0\0"}, 82, ) , Partial, 144, ... TitleIdx=0, Type=2, Data= (368, "Common AppData", Partial, 144, ... TitleIdx=0, Type=2, Data="%\0A\0L\0L\0U\0S\0E\0R\0S\0P\0R\0O\0F\0I\0L\0E\0%\0\\0A\0p\0p\0l\0i\0c\0a\0t\0i\0o\0n\0 \0D\0a\0t\0a\0\0\0"}, 82, ) }, 82, ) == 0x0
 02539   436   NtOpenSection  (0xe, {24, 8, 0x40, 0, 0,  (0xe, {24, 8, 0x40, 0, 0, "USERENV.dll"}, ... 372, ) }, ... 372, ) == 0x0
 02540   436   NtMapViewOfSection  (372, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x75a70000), 0x0, 667648, ) == 0x0
 02541   436   NtClose  (372, ... ) == 0x0
 02542   436   NtOpenKey  (0x2000000, {24, 48, 0x40, 0, 0,  (0x2000000, {24, 48, 0x40, 0, 0, "Software\Microsoft\Windows NT\CurrentVersion\winlogon"}, ... 372, ) }, ... 372, ) == 0x0
 02543   436   NtQueryValueKey  (372,  (372, "UserEnvDebugLevel", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02544   436   NtClose  (372, ... ) == 0x0
 02545   436   NtOpenKey  (0x2000000, {24, 48, 0x40, 0, 0,  (0x2000000, {24, 48, 0x40, 0, 0, "Software\Microsoft\Windows NT\CurrentVersion\winlogon"}, ... 372, ) }, ... 372, ) == 0x0
 02546   436   NtQueryValueKey  (372,  (372, "ChkAccDebugLevel", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02547   436   NtClose  (372, ... ) == 0x0
 02548   436   NtOpenKey  (0x20019, {24, 48, 0x40, 0, 0,  (0x20019, {24, 48, 0x40, 0, 0, "System\CurrentControlSet\Control\ProductOptions"}, ... 372, ) }, ... 372, ) == 0x0
 02549   436   NtQueryValueKey  (372,  (372, "ProductType", Partial, 144, ... TitleIdx=0, Type=1, Data="W\0i\0n\0N\0T\0\0\0"}, 24, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (372, "ProductType", Partial, 144, ... TitleIdx=0, Type=1, Data="W\0i\0n\0N\0T\0\0\0"}, 24, ) }, 24, ) == 0x0
 02550   436   NtClose  (372, ... ) == 0x0
 02551   436   NtCreateEvent  (0x1f0003, {24, 52, 0x80, 1237236, 0,  (0x1f0003, {24, 52, 0x80, 1237236, 0, "Global\userenv:  User Profile setup event"}, 0, 1, ... 372, ) }, 0, 1, ... 372, ) == STATUS_OBJECT_NAME_EXISTS
 02552   436   NtQueryDefaultLocale  (1, 1235072, ... ) == 0x0
 02553   436   NtQueryDefaultLocale  (1, 1235072, ... ) == 0x0
 02554   436   NtQueryDefaultLocale  (1, 1235072, ... ) == 0x0
 02555   436   NtQueryDefaultLocale  (1, 1235072, ... ) == 0x0
 02556   436   NtQueryDefaultLocale  (1, 1235072, ... ) == 0x0
 02557   436   NtQueryDefaultLocale  (1, 1235072, ... ) == 0x0
 02558   436   NtQueryDefaultLocale  (1, 1235072, ... ) == 0x0
 02559   436   NtQueryDefaultLocale  (1, 1235072, ... ) == 0x0
 02560   436   NtQueryDefaultLocale  (1, 1235072, ... ) == 0x0
 02561   436   NtQueryDefaultLocale  (1, 1235072, ... ) == 0x0
 02562   436   NtQueryDefaultLocale  (1, 1235072, ... ) == 0x0
 02563   436   NtQueryDefaultLocale  (1, 1235072, ... ) == 0x0
 02564   436   NtQueryDefaultLocale  (1, 1235072, ... ) == 0x0
 02565   436   NtQueryDefaultLocale  (1, 1235072, ... ) == 0x0
 02566   436   NtQueryDefaultLocale  (1, 1235072, ... ) == 0x0
 02567   436   NtQueryDefaultLocale  (1, 1235072, ... ) == 0x0
 02568   436   NtQueryDefaultLocale  (1, 1235072, ... ) == 0x0
 02569   436   NtQueryDefaultLocale  (1, 1235072, ... ) == 0x0
 02570   436   NtQueryDefaultLocale  (1, 1235072, ... ) == 0x0
 02571   436   NtQueryDefaultLocale  (1, 1235072, ... ) == 0x0
 02572   436   NtQueryDefaultLocale  (1, 1235072, ... ) == 0x0
 02573   436   NtQueryDefaultLocale  (1, 1235072, ... ) == 0x0
 02574   436   NtQueryDefaultLocale  (1, 1235072, ... ) == 0x0
 02575   436   NtQueryDefaultLocale  (1, 1235072, ... ) == 0x0
 02576   436   NtQueryDefaultLocale  (1, 1235072, ... ) == 0x0
 02577   436   NtQueryDefaultLocale  (1, 1235072, ... ) == 0x0
 02578   436   NtOpenThreadTokenEx  (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN
 02579   436   NtOpenProcessTokenEx  (-1, 0x20008, 512, ... 376, ) == 0x0
 02580   436   NtQueryInformationToken  (376, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0
 02581   436   NtClose  (376, ... ) == 0x0
 02582   436   NtOpenKey  (0x20019, {24, 0, 0x640, 0, 0,  (0x20019, {24, 0, 0x640, 0, 0, "\REGISTRY\USER\S-1-5-21-1078081533-484763869-839522115-1003"}, ... 376, ) }, ... 376, ) == 0x0
 02583   436   NtOpenKey  (0x20019, {24, 376, 0x40, 0, 0,  (0x20019, {24, 376, 0x40, 0, 0, "Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders"}, ... 380, ) }, ... 380, ) == 0x0
 02584   436   NtQueryValueKey  (380,  (380, "Personal", Partial, 144, ... TitleIdx=0, Type=2, Data="%\0U\0S\0E\0R\0P\0R\0O\0F\0I\0L\0E\0%\0\\0M\0y\0 \0D\0o\0c\0u\0m\0e\0n\0t\0s\0\0\0"}, 66, ) , Partial, 144, ... TitleIdx=0, Type=2, Data= (380, "Personal", Partial, 144, ... TitleIdx=0, Type=2, Data="%\0U\0S\0E\0R\0P\0R\0O\0F\0I\0L\0E\0%\0\\0M\0y\0 \0D\0o\0c\0u\0m\0e\0n\0t\0s\0\0\0"}, 66, ) }, 66, ) == 0x0
 02585   436   NtQueryDefaultLocale  (1, 1235072, ... ) == 0x0
 02586   436   NtQueryValueKey  (380,  (380, "Local Settings", Partial, 144, ... TitleIdx=0, Type=2, Data="%\0U\0S\0E\0R\0P\0R\0O\0F\0I\0L\0E\0%\0\\0L\0o\0c\0a\0l\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\0\0"}, 70, ) , Partial, 144, ... TitleIdx=0, Type=2, Data= (380, "Local Settings", Partial, 144, ... TitleIdx=0, Type=2, Data="%\0U\0S\0E\0R\0P\0R\0O\0F\0I\0L\0E\0%\0\\0L\0o\0c\0a\0l\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\0\0"}, 70, ) }, 70, ) == 0x0
 02587   436   NtQueryDefaultLocale  (1, 1235072, ... ) == 0x0
 02588   436   NtQueryDefaultLocale  (1, 1235072, ... ) == 0x0
 02589   436   NtQueryDefaultLocale  (1, 1235072, ... ) == 0x0
 02590   436   NtQueryDefaultLocale  (1, 1235072, ... ) == 0x0
 02591   436   NtClose  (380, ... ) == 0x0
 02592   436   NtClose  (376, ... ) == 0x0
 02593   436   NtOpenKey  (0x2000000, {24, 48, 0x40, 0, 0,  (0x2000000, {24, 48, 0x40, 0, 0, "Software\Microsoft\Windows NT\CurrentVersion\winlogon"}, ... 376, ) }, ... 376, ) == 0x0
 02594   436   NtQueryValueKey  (376,  (376, "RsopDebugLevel", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02595   436   NtClose  (376, ... ) == 0x0
 02596   436   NtOpenKey  (0x2000000, {24, 48, 0x40, 0, 0,  (0x2000000, {24, 48, 0x40, 0, 0, "Software\Microsoft\Windows NT\CurrentVersion\winlogon"}, ... 376, ) }, ... 376, ) == 0x0
 02597   436   NtQueryValueKey  (376,  (376, "UserEnvDebugLevel", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02598   436   NtQueryValueKey  (376,  (376, "RsopLogging", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02599   436   NtClose  (376, ... ) == 0x0
 02600   436   NtOpenKey  (0x2000000, {24, 48, 0x40, 0, 0,  (0x2000000, {24, 48, 0x40, 0, 0, "Software\Policies\Microsoft\Windows\System"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02601   436   NtOpenKey  (0x2000000, {24, 48, 0x40, 0, 0,  (0x2000000, {24, 48, 0x40, 0, 0, "Software\Microsoft\Windows NT\CurrentVersion\winlogon"}, ... 376, ) }, ... 376, ) == 0x0
 02602   436   NtQueryValueKey  (376,  (376, "UserEnvDebugLevel", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02603   436   NtClose  (376, ... ) == 0x0
 02604   436   NtOpenKey  (0x2000000, {24, 48, 0x40, 0, 0,  (0x2000000, {24, 48, 0x40, 0, 0, "Software\Policies\Microsoft\Windows\System"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02605   436   NtAllocateVirtualMemory  (-1, 0, 0, 1, 4096, 4, ... 10682368, 4096, ) == 0x0
 02606   436   NtAllocateVirtualMemory  (-1, 1421312, 0, 4096, 4096, 4, ... 1421312, 4096, ) == 0x0
 02607   436   NtQueryVirtualMemory  (-1, 0xa30000, Basic, 28, ... {BaseAddress=0xa30000,AllocationBase=0xa30000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 0x0, ) == 0x0
 02608   436   NtQueryVirtualMemory  (-1, 0xa30000, Basic, 28, ... {BaseAddress=0xa30000,AllocationBase=0xa30000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 0x0, ) == 0x0
 02609   436   NtOpenKey  (0x20019, {24, 48, 0x40, 0, 0,  (0x20019, {24, 48, 0x40, 0, 0, "Software\Microsoft\Windows NT\CurrentVersion\ProfileList"}, ... 376, ) }, ... 376, ) == 0x0
 02610   436   NtQueryValueKey  (376,  (376, "ProfilesDirectory", Partial, 144, ... TitleIdx=0, Type=2, Data="%\0S\0y\0s\0t\0e\0m\0D\0r\0i\0v\0e\0%\0\\0D\0o\0c\0u\0m\0e\0n\0t\0s\0 \0a\0n\0d\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\0\0"}, 86, ) , Partial, 144, ... TitleIdx=0, Type=2, Data= (376, "ProfilesDirectory", Partial, 144, ... TitleIdx=0, Type=2, Data="%\0S\0y\0s\0t\0e\0m\0D\0r\0i\0v\0e\0%\0\\0D\0o\0c\0u\0m\0e\0n\0t\0s\0 \0a\0n\0d\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\0\0"}, 86, ) }, 86, ) == 0x0
 02611   436   NtClose  (376, ... ) == 0x0
 02612   436   NtOpenKey  (0x20019, {24, 48, 0x40, 0, 0,  (0x20019, {24, 48, 0x40, 0, 0, "Software\Microsoft\Windows NT\CurrentVersion\ProfileList"}, ... 376, ) }, ... 376, ) == 0x0
 02613   436   NtQueryValueKey  (376,  (376, "AllUsersProfile", Partial, 144, ... TitleIdx=0, Type=1, Data="A\0l\0l\0 \0U\0s\0e\0r\0s\0\0\0"}, 32, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (376, "AllUsersProfile", Partial, 144, ... TitleIdx=0, Type=1, Data="A\0l\0l\0 \0U\0s\0e\0r\0s\0\0\0"}, 32, ) }, 32, ) == 0x0
 02614   436   NtClose  (376, ... ) == 0x0
 02615   436   NtQueryVirtualMemory  (-1, 0xa30000, Basic, 28, ... {BaseAddress=0xa30000,AllocationBase=0xa30000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 0x0, ) == 0x0
 02616   436   NtOpenKey  (0x1, {24, 48, 0x40, 0, 0,  (0x1, {24, 48, 0x40, 0, 0, "System\CurrentControlSet\Control\Session Manager\Environment"}, ... 376, ) }, ... 376, ) == 0x0
 02617   436   NtQueryKey  (376, Full, 176, ... {LastWrite={0x7838d13c,0x1c73999}, TitleIdx=0, Subkeys=0, Values=12, Class=""}, 44, ) == 0x0
 02618   436   NtQuerySecurityObject  (376, 7, 0, ... ) == STATUS_ACCESS_DENIED
 02619   436   NtEnumerateValueKey  (376, 0, Full, 220, ... TitleIdx=0, Type=2, Name= (376, 0, Full, 220, ... TitleIdx=0, Type=2, Name="ComSpec", Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0s\0y\0s\0t\0e\0m\03\02\0\\0c\0m\0d\0.\0e\0x\0e\0\0\0"}, 96, ) , Data= (376, 0, Full, 220, ... TitleIdx=0, Type=2, Name="ComSpec", Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0s\0y\0s\0t\0e\0m\03\02\0\\0c\0m\0d\0.\0e\0x\0e\0\0\0"}, 96, ) }, 96, ) == 0x0
 02620   436   NtEnumerateValueKey  (376, 1, Full, 220, ... TitleIdx=0, Type=2, Name= (376, 1, Full, 220, ... TitleIdx=0, Type=2, Name="Path", Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0s\0y\0s\0t\0e\0m\03\02\0;\0%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0;\0%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0W\0b\0e\0m\0\0\0"}, 152, ) , Data= (376, 1, Full, 220, ... TitleIdx=0, Type=2, Name="Path", Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0s\0y\0s\0t\0e\0m\03\02\0;\0%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0;\0%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0W\0b\0e\0m\0\0\0"}, 152, ) }, 152, ) == 0x0
 02621   436   NtEnumerateValueKey  (376, 2, Full, 220, ... TitleIdx=0, Type=2, Name= (376, 2, Full, 220, ... TitleIdx=0, Type=2, Name="windir", Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\0\0"}, 58, ) , Data= (376, 2, Full, 220, ... TitleIdx=0, Type=2, Name="windir", Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\0\0"}, 58, ) }, 58, ) == 0x0
 02622   436   NtEnumerateValueKey  (376, 3, Full, 220, ... TitleIdx=0, Type=1, Name= (376, 3, Full, 220, ... TitleIdx=0, Type=1, Name="OS", Data="W\0i\0n\0d\0o\0w\0s\0_\0N\0T\0\0\0"}, 46, ) , Data= (376, 3, Full, 220, ... TitleIdx=0, Type=1, Name="OS", Data="W\0i\0n\0d\0o\0w\0s\0_\0N\0T\0\0\0"}, 46, ) }, 46, ) == 0x0
 02623   436   NtQueryVirtualMemory  (-1, 0xa30000, Basic, 28, ... {BaseAddress=0xa30000,AllocationBase=0xa30000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 0x0, ) == 0x0
 02624   436   NtEnumerateValueKey  (376, 4, Full, 220, ... TitleIdx=0, Type=1, Name= (376, 4, Full, 220, ... TitleIdx=0, Type=1, Name="PROCESSOR_ARCHITECTURE", Data="x\08\06\0\0\0"}, 72, ) , Data= (376, 4, Full, 220, ... TitleIdx=0, Type=1, Name="PROCESSOR_ARCHITECTURE", Data="x\08\06\0\0\0"}, 72, ) }, 72, ) == 0x0
 02625   436   NtQueryVirtualMemory  (-1, 0xa30000, Basic, 28, ... {BaseAddress=0xa30000,AllocationBase=0xa30000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 0x0, ) == 0x0
 02626   436   NtEnumerateValueKey  (376, 5, Full, 220, ... TitleIdx=0, Type=1, Name= (376, 5, Full, 220, ... TitleIdx=0, Type=1, Name="PROCESSOR_LEVEL", Data="1\05\0\0\0"}, 58, ) , Data= (376, 5, Full, 220, ... TitleIdx=0, Type=1, Name="PROCESSOR_LEVEL", Data="1\05\0\0\0"}, 58, ) }, 58, ) == 0x0
 02627   436   NtQueryVirtualMemory  (-1, 0xa30000, Basic, 28, ... {BaseAddress=0xa30000,AllocationBase=0xa30000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 0x0, ) == 0x0
 02628   436   NtEnumerateValueKey  (376, 6, Full, 220, ... TitleIdx=0, Type=1, Name= (376, 6, Full, 220, ... TitleIdx=0, Type=1, Name="PROCESSOR_IDENTIFIER", Data="x\08\06\0 \0F\0a\0m\0i\0l\0y\0 \01\05\0 \0M\0o\0d\0e\0l\0 \04\0 \0S\0t\0e\0p\0p\0i\0n\0g\0 \08\0,\0 \0G\0e\0n\0u\0i\0n\0e\0I\0n\0t\0e\0l\0\0\0"}, 154, ) , Data= (376, 6, Full, 220, ... TitleIdx=0, Type=1, Name="PROCESSOR_IDENTIFIER", Data="x\08\06\0 \0F\0a\0m\0i\0l\0y\0 \01\05\0 \0M\0o\0d\0e\0l\0 \04\0 \0S\0t\0e\0p\0p\0i\0n\0g\0 \08\0,\0 \0G\0e\0n\0u\0i\0n\0e\0I\0n\0t\0e\0l\0\0\0"}, 154, ) }, 154, ) == 0x0
 02629   436   NtQueryVirtualMemory  (-1, 0xa30000, Basic, 28, ... {BaseAddress=0xa30000,AllocationBase=0xa30000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 0x0, ) == 0x0
 02630   436   NtEnumerateValueKey  (376, 7, Full, 220, ... TitleIdx=0, Type=1, Name= (376, 7, Full, 220, ... TitleIdx=0, Type=1, Name="PROCESSOR_REVISION", Data="0\04\00\08\0\0\0"}, 66, ) , Data= (376, 7, Full, 220, ... TitleIdx=0, Type=1, Name="PROCESSOR_REVISION", Data="0\04\00\08\0\0\0"}, 66, ) }, 66, ) == 0x0
 02631   436   NtQueryVirtualMemory  (-1, 0xa30000, Basic, 28, ... {BaseAddress=0xa30000,AllocationBase=0xa30000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 0x0, ) == 0x0
 02632   436   NtEnumerateValueKey  (376, 8, Full, 220, ... TitleIdx=0, Type=1, Name= (376, 8, Full, 220, ... TitleIdx=0, Type=1, Name="NUMBER_OF_PROCESSORS", Data="1\0\0\0"}, 64, ) , Data= (376, 8, Full, 220, ... TitleIdx=0, Type=1, Name="NUMBER_OF_PROCESSORS", Data="1\0\0\0"}, 64, ) }, 64, ) == 0x0
 02633   436   NtQueryVirtualMemory  (-1, 0xa30000, Basic, 28, ... {BaseAddress=0xa30000,AllocationBase=0xa30000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 0x0, ) == 0x0
 02634   436   NtEnumerateValueKey  (376, 9, Full, 220, ... TitleIdx=0, Type=1, Name= (376, 9, Full, 220, ... TitleIdx=0, Type=1, Name="PATHEXT", Data=".\0C\0O\0M\0;\0.\0E\0X\0E\0;\0.\0B\0A\0T\0;\0.\0C\0M\0D\0;\0.\0V\0B\0S\0;\0.\0V\0B\0E\0;\0.\0J\0S\0;\0.\0J\0S\0E\0;\0.\0W\0S\0F\0;\0.\0W\0S\0H\0\0\0"}, 134, ) , Data= (376, 9, Full, 220, ... TitleIdx=0, Type=1, Name="PATHEXT", Data=".\0C\0O\0M\0;\0.\0E\0X\0E\0;\0.\0B\0A\0T\0;\0.\0C\0M\0D\0;\0.\0V\0B\0S\0;\0.\0V\0B\0E\0;\0.\0J\0S\0;\0.\0J\0S\0E\0;\0.\0W\0S\0F\0;\0.\0W\0S\0H\0\0\0"}, 134, ) }, 134, ) == 0x0
 02635   436   NtQueryVirtualMemory  (-1, 0xa30000, Basic, 28, ... {BaseAddress=0xa30000,AllocationBase=0xa30000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 0x0, ) == 0x0
 02636   436   NtEnumerateValueKey  (376, 10, Full, 220, ... TitleIdx=0, Type=2, Name= (376, 10, Full, 220, ... TitleIdx=0, Type=2, Name="TEMP", Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0T\0E\0M\0P\0\0\0"}, 64, ) , Data= (376, 10, Full, 220, ... TitleIdx=0, Type=2, Name="TEMP", Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0T\0E\0M\0P\0\0\0"}, 64, ) }, 64, ) == 0x0
 02637   436   NtEnumerateValueKey  (376, 11, Full, 220, ... TitleIdx=0, Type=2, Name= (376, 11, Full, 220, ... TitleIdx=0, Type=2, Name="TMP", Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0T\0E\0M\0P\0\0\0"}, 64, ) , Data= (376, 11, Full, 220, ... TitleIdx=0, Type=2, Name="TMP", Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0T\0E\0M\0P\0\0\0"}, 64, ) }, 64, ) == 0x0
 02638   436   NtEnumerateValueKey  (376, 0, Full, 220, ... TitleIdx=0, Type=2, Name= (376, 0, Full, 220, ... TitleIdx=0, Type=2, Name="ComSpec", Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0s\0y\0s\0t\0e\0m\03\02\0\\0c\0m\0d\0.\0e\0x\0e\0\0\0"}, 96, ) , Data= (376, 0, Full, 220, ... TitleIdx=0, Type=2, Name="ComSpec", Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0s\0y\0s\0t\0e\0m\03\02\0\\0c\0m\0d\0.\0e\0x\0e\0\0\0"}, 96, ) }, 96, ) == 0x0
 02639   436   NtQueryVirtualMemory  (-1, 0xa30000, Basic, 28, ... {BaseAddress=0xa30000,AllocationBase=0xa30000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 0x0, ) == 0x0
 02640   436   NtEnumerateValueKey  (376, 1, Full, 220, ... TitleIdx=0, Type=2, Name= (376, 1, Full, 220, ... TitleIdx=0, Type=2, Name="Path", Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0s\0y\0s\0t\0e\0m\03\02\0;\0%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0;\0%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0W\0b\0e\0m\0\0\0"}, 152, ) , Data= (376, 1, Full, 220, ... TitleIdx=0, Type=2, Name="Path", Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0s\0y\0s\0t\0e\0m\03\02\0;\0%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0;\0%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0W\0b\0e\0m\0\0\0"}, 152, ) }, 152, ) == 0x0
 02641   436   NtQueryVirtualMemory  (-1, 0xa30000, Basic, 28, ... {BaseAddress=0xa30000,AllocationBase=0xa30000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 0x0, ) == 0x0
 02642   436   NtEnumerateValueKey  (376, 2, Full, 220, ... TitleIdx=0, Type=2, Name= (376, 2, Full, 220, ... TitleIdx=0, Type=2, Name="windir", Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\0\0"}, 58, ) , Data= (376, 2, Full, 220, ... TitleIdx=0, Type=2, Name="windir", Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\0\0"}, 58, ) }, 58, ) == 0x0
 02643   436   NtQueryVirtualMemory  (-1, 0xa30000, Basic, 28, ... {BaseAddress=0xa30000,AllocationBase=0xa30000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 0x0, ) == 0x0
 02644   436   NtEnumerateValueKey  (376, 3, Full, 220, ... TitleIdx=0, Type=1, Name= (376, 3, Full, 220, ... TitleIdx=0, Type=1, Name="OS", Data="W\0i\0n\0d\0o\0w\0s\0_\0N\0T\0\0\0"}, 46, ) , Data= (376, 3, Full, 220, ... TitleIdx=0, Type=1, Name="OS", Data="W\0i\0n\0d\0o\0w\0s\0_\0N\0T\0\0\0"}, 46, ) }, 46, ) == 0x0
 02645   436   NtEnumerateValueKey  (376, 4, Full, 220, ... TitleIdx=0, Type=1, Name= (376, 4, Full, 220, ... TitleIdx=0, Type=1, Name="PROCESSOR_ARCHITECTURE", Data="x\08\06\0\0\0"}, 72, ) , Data= (376, 4, Full, 220, ... TitleIdx=0, Type=1, Name="PROCESSOR_ARCHITECTURE", Data="x\08\06\0\0\0"}, 72, ) }, 72, ) == 0x0
 02646   436   NtEnumerateValueKey  (376, 5, Full, 220, ... TitleIdx=0, Type=1, Name= (376, 5, Full, 220, ... TitleIdx=0, Type=1, Name="PROCESSOR_LEVEL", Data="1\05\0\0\0"}, 58, ) , Data= (376, 5, Full, 220, ... TitleIdx=0, Type=1, Name="PROCESSOR_LEVEL", Data="1\05\0\0\0"}, 58, ) }, 58, ) == 0x0
 02647   436   NtEnumerateValueKey  (376, 6, Full, 220, ... TitleIdx=0, Type=1, Name= (376, 6, Full, 220, ... TitleIdx=0, Type=1, Name="PROCESSOR_IDENTIFIER", Data="x\08\06\0 \0F\0a\0m\0i\0l\0y\0 \01\05\0 \0M\0o\0d\0e\0l\0 \04\0 \0S\0t\0e\0p\0p\0i\0n\0g\0 \08\0,\0 \0G\0e\0n\0u\0i\0n\0e\0I\0n\0t\0e\0l\0\0\0"}, 154, ) , Data= (376, 6, Full, 220, ... TitleIdx=0, Type=1, Name="PROCESSOR_IDENTIFIER", Data="x\08\06\0 \0F\0a\0m\0i\0l\0y\0 \01\05\0 \0M\0o\0d\0e\0l\0 \04\0 \0S\0t\0e\0p\0p\0i\0n\0g\0 \08\0,\0 \0G\0e\0n\0u\0i\0n\0e\0I\0n\0t\0e\0l\0\0\0"}, 154, ) }, 154, ) == 0x0
 02648   436   NtEnumerateValueKey  (376, 7, Full, 220, ... TitleIdx=0, Type=1, Name= (376, 7, Full, 220, ... TitleIdx=0, Type=1, Name="PROCESSOR_REVISION", Data="0\04\00\08\0\0\0"}, 66, ) , Data= (376, 7, Full, 220, ... TitleIdx=0, Type=1, Name="PROCESSOR_REVISION", Data="0\04\00\08\0\0\0"}, 66, ) }, 66, ) == 0x0
 02649   436   NtEnumerateValueKey  (376, 8, Full, 220, ... TitleIdx=0, Type=1, Name= (376, 8, Full, 220, ... TitleIdx=0, Type=1, Name="NUMBER_OF_PROCESSORS", Data="1\0\0\0"}, 64, ) , Data= (376, 8, Full, 220, ... TitleIdx=0, Type=1, Name="NUMBER_OF_PROCESSORS", Data="1\0\0\0"}, 64, ) }, 64, ) == 0x0
 02650   436   NtEnumerateValueKey  (376, 9, Full, 220, ... TitleIdx=0, Type=1, Name= (376, 9, Full, 220, ... TitleIdx=0, Type=1, Name="PATHEXT", Data=".\0C\0O\0M\0;\0.\0E\0X\0E\0;\0.\0B\0A\0T\0;\0.\0C\0M\0D\0;\0.\0V\0B\0S\0;\0.\0V\0B\0E\0;\0.\0J\0S\0;\0.\0J\0S\0E\0;\0.\0W\0S\0F\0;\0.\0W\0S\0H\0\0\0"}, 134, ) , Data= (376, 9, Full, 220, ... TitleIdx=0, Type=1, Name="PATHEXT", Data=".\0C\0O\0M\0;\0.\0E\0X\0E\0;\0.\0B\0A\0T\0;\0.\0C\0M\0D\0;\0.\0V\0B\0S\0;\0.\0V\0B\0E\0;\0.\0J\0S\0;\0.\0J\0S\0E\0;\0.\0W\0S\0F\0;\0.\0W\0S\0H\0\0\0"}, 134, ) }, 134, ) == 0x0
 02651   436   NtEnumerateValueKey  (376, 10, Full, 220, ... TitleIdx=0, Type=2, Name= (376, 10, Full, 220, ... TitleIdx=0, Type=2, Name="TEMP", Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0T\0E\0M\0P\0\0\0"}, 64, ) , Data= (376, 10, Full, 220, ... TitleIdx=0, Type=2, Name="TEMP", Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0T\0E\0M\0P\0\0\0"}, 64, ) }, 64, ) == 0x0
 02652   436   NtQueryInformationProcess  (-1, DefaultHardErrorMode, 4, ... {process info, class 12, size 4}, 0x0, ) == 0x0
 02653   436   NtSetInformationProcess  (-1, DefaultHardErrorMode, {process info, class 12, size 4}, 4, ... ) == 0x0
 02654   436   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\TEMP"}, 1238160, ... ) }, 1238160, ... ) == 0x0
 02655   436   NtQueryInformationProcess  (-1, DefaultHardErrorMode, 4, ... {process info, class 12, size 4}, 0x0, ) == 0x0
 02656   436   NtSetInformationProcess  (-1, DefaultHardErrorMode, {process info, class 12, size 4}, 4, ... ) == 0x0
 02657   436   NtQueryVirtualMemory  (-1, 0xa30000, Basic, 28, ... {BaseAddress=0xa30000,AllocationBase=0xa30000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 0x0, ) == 0x0
 02658   436   NtEnumerateValueKey  (376, 11, Full, 220, ... TitleIdx=0, Type=2, Name= (376, 11, Full, 220, ... TitleIdx=0, Type=2, Name="TMP", Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0T\0E\0M\0P\0\0\0"}, 64, ) , Data= (376, 11, Full, 220, ... TitleIdx=0, Type=2, Name="TMP", Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0T\0E\0M\0P\0\0\0"}, 64, ) }, 64, ) == 0x0
 02659   436   NtQueryInformationProcess  (-1, DefaultHardErrorMode, 4, ... {process info, class 12, size 4}, 0x0, ) == 0x0
 02660   436   NtSetInformationProcess  (-1, DefaultHardErrorMode, {process info, class 12, size 4}, 4, ... ) == 0x0
 02661   436   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\TEMP"}, 1238160, ... ) }, 1238160, ... ) == 0x0
 02662   436   NtQueryInformationProcess  (-1, DefaultHardErrorMode, 4, ... {process info, class 12, size 4}, 0x0, ) == 0x0
 02663   436   NtSetInformationProcess  (-1, DefaultHardErrorMode, {process info, class 12, size 4}, 4, ... ) == 0x0
 02664   436   NtQueryVirtualMemory  (-1, 0xa30000, Basic, 28, ... {BaseAddress=0xa30000,AllocationBase=0xa30000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 0x0, ) == 0x0
 02665   436   NtClose  (376, ... ) == 0x0
 02666   436   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\System\CurrentControlSet\Control\ComputerName"}, ... 376, ) }, ... 376, ) == 0x0
 02667   436   NtOpenKey  (0x20019, {24, 376, 0x40, 0, 0,  (0x20019, {24, 376, 0x40, 0, 0, "ActiveComputerName"}, ... 380, ) }, ... 380, ) == 0x0
 02668   436   NtQueryValueKey  (380,  (380, "ComputerName", Full, 108, ... TitleIdx=0, Type=1, Name="ComputerName", Data="M\0Y\0W\0O\0R\0L\0D\0\0\0"}, 60, ) , Full, 108, ... TitleIdx=0, Type=1, Name= (380, "ComputerName", Full, 108, ... TitleIdx=0, Type=1, Name="ComputerName", Data="M\0Y\0W\0O\0R\0L\0D\0\0\0"}, 60, ) , Data= (380, "ComputerName", Full, 108, ... TitleIdx=0, Type=1, Name="ComputerName", Data="M\0Y\0W\0O\0R\0L\0D\0\0\0"}, 60, ) }, 60, ) == 0x0
 02669   436   NtClose  (380, ... ) == 0x0
 02670   436   NtClose  (376, ... ) == 0x0
 02671   436   NtQueryVirtualMemory  (-1, 0xa30000, Basic, 28, ... {BaseAddress=0xa30000,AllocationBase=0xa30000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 0x0, ) == 0x0
 02672   436   NtOpenKey  (0x20019, {24, 48, 0x40, 0, 0,  (0x20019, {24, 48, 0x40, 0, 0, "Software\Microsoft\Windows NT\CurrentVersion\ProfileList"}, ... 376, ) }, ... 376, ) == 0x0
 02673   436   NtQueryValueKey  (376,  (376, "ProfilesDirectory", Partial, 144, ... TitleIdx=0, Type=2, Data="%\0S\0y\0s\0t\0e\0m\0D\0r\0i\0v\0e\0%\0\\0D\0o\0c\0u\0m\0e\0n\0t\0s\0 \0a\0n\0d\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\0\0"}, 86, ) , Partial, 144, ... TitleIdx=0, Type=2, Data= (376, "ProfilesDirectory", Partial, 144, ... TitleIdx=0, Type=2, Data="%\0S\0y\0s\0t\0e\0m\0D\0r\0i\0v\0e\0%\0\\0D\0o\0c\0u\0m\0e\0n\0t\0s\0 \0a\0n\0d\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\0\0"}, 86, ) }, 86, ) == 0x0
 02674   436   NtClose  (376, ... ) == 0x0
 02675   436   NtOpenKey  (0x20019, {24, 48, 0x40, 0, 0,  (0x20019, {24, 48, 0x40, 0, 0, "Software\Microsoft\Windows NT\CurrentVersion\ProfileList"}, ... 376, ) }, ... 376, ) == 0x0
 02676   436   NtQueryValueKey  (376,  (376, "DefaultUserProfile", Partial, 144, ... TitleIdx=0, Type=1, Data="D\0e\0f\0a\0u\0l\0t\0 \0U\0s\0e\0r\0\0\0"}, 38, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (376, "DefaultUserProfile", Partial, 144, ... TitleIdx=0, Type=1, Data="D\0e\0f\0a\0u\0l\0t\0 \0U\0s\0e\0r\0\0\0"}, 38, ) }, 38, ) == 0x0
 02677   436   NtClose  (376, ... ) == 0x0
 02678   436   NtQueryVirtualMemory  (-1, 0xa30000, Basic, 28, ... {BaseAddress=0xa30000,AllocationBase=0xa30000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 0x0, ) == 0x0
 02679   436   NtOpenKey  (0x20019, {24, 48, 0x40, 0, 0,  (0x20019, {24, 48, 0x40, 0, 0, "Software\Microsoft\Windows\CurrentVersion"}, ... 376, ) }, ... 376, ) == 0x0
 02680   436   NtQueryValueKey  (376,  (376, "ProgramFilesDir", Partial, 144, ... TitleIdx=0, Type=1, Data="C\0:\0\\0P\0r\0o\0g\0r\0a\0m\0 \0F\0i\0l\0e\0s\0\0\0"}, 46, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (376, "ProgramFilesDir", Partial, 144, ... TitleIdx=0, Type=1, Data="C\0:\0\\0P\0r\0o\0g\0r\0a\0m\0 \0F\0i\0l\0e\0s\0\0\0"}, 46, ) }, 46, ) == 0x0
 02681   436   NtQueryVirtualMemory  (-1, 0xa30000, Basic, 28, ... {BaseAddress=0xa30000,AllocationBase=0xa30000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 0x0, ) == 0x0
 02682   436   NtQueryValueKey  (376,  (376, "CommonFilesDir", Partial, 144, ... TitleIdx=0, Type=1, Data="C\0:\0\\0P\0r\0o\0g\0r\0a\0m\0 \0F\0i\0l\0e\0s\0\\0C\0o\0m\0m\0o\0n\0 \0F\0i\0l\0e\0s\0\0\0"}, 72, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (376, "CommonFilesDir", Partial, 144, ... TitleIdx=0, Type=1, Data="C\0:\0\\0P\0r\0o\0g\0r\0a\0m\0 \0F\0i\0l\0e\0s\0\\0C\0o\0m\0m\0o\0n\0 \0F\0i\0l\0e\0s\0\0\0"}, 72, ) }, 72, ) == 0x0
 02683   436   NtQueryVirtualMemory  (-1, 0xa30000, Basic, 28, ... {BaseAddress=0xa30000,AllocationBase=0xa30000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 0x0, ) == 0x0
 02684   436   NtClose  (376, ... ) == 0x0
 02685   436   NtQueryInformationToken  (364, User, 200, ... {token info, class 1, size 36}, 36, ) == 0x0
 02686   436   NtOpenKey  (0x20019, {24, 356, 0x40, 0, 0,  (0x20019, {24, 356, 0x40, 0, 0, "S-1-5-21-1078081533-484763869-839522115-1003"}, ... 376, ) }, ... 376, ) == 0x0
 02687   436   NtOpenThreadToken  (-2, 0x2000c, 1, ... ) == STATUS_NO_TOKEN
 02688   436   NtQueryInformationToken  (364, Type, 4, ... {token info, class 8, size 4}, 4, ) == 0x0
 02689   436   NtDuplicateToken  (364, 0xc, {24, 0, 0x0, 0, 1239544, 0x0}, 0, 2, ... ) == STATUS_ACCESS_DENIED
 02690   436   NtQueryInformationToken  (364, User, 200, ... {token info, class 1, size 36}, 36, ) == 0x0
 02691   436   NtOpenThreadToken  (-2, 0xc, 1, ... ) == STATUS_NO_TOKEN
 02692   436   NtCreateEvent  (0x1f0003, 0x0, 1, 0, ... 380, ) == 0x0
 02693   436   NtOpenThreadToken  (-2, 0xc, 1, ... ) == STATUS_NO_TOKEN
 02694   436   NtSetInformationThread  (-2, ImpersonationToken, {ImpToken=0,}, 4, ... ) == 0x0
 02695   436   NtCreateFile  (0xc0100080, {24, 0, 0x40, 0, 1237748,  (0xc0100080, {24, 0, 0x40, 0, 1237748, "\??\PIPE\lsarpc"}, 0x0, 0, 3, 1, 64, 0, 0, ... 384, {status=0x0, info=1}, ) }, 0x0, 0, 3, 1, 64, 0, 0, ... 384, {status=0x0, info=1}, ) == 0x0
 02696   436   NtSetInformationFile  (384, 1237804, 8, Pipe, ... {status=0x0, info=0}, ) == 0x0
 02697   436   NtSetInformationFile  (384, 1237796, 8, Completion, ... {status=0x0, info=0}, ) == 0x0
 02698   436   NtSetInformationThread  (-2, ImpersonationToken, {ImpToken=0,}, 4, ... ) == 0x0
 02699   436   NtWriteFile  (384, 325, 0, 0,  (384, 325, 0, 0, "\5\0\13\3\20\0\0\0H\0\0\0\1\0\0\0\270\20\270\20\0\0\0\0\1\0\0\0\0\0\1\0xW4\224\22\315\253\357\0\1#Eg\211\253\0\0\0\0\4]\210\212\353\34\311\21\237\350\10\0+\20H`\2\0\0\0", 72, {0, 0}, 0, ... {status=0x0, info=72}, ) , 72, {0, 0}, 0, ... {status=0x0, info=72}, ) == 0x0
 02700   436   NtReadFile  (384, 325, 0, 0, 1024, {0, 0}, 0, ... {status=0x0, info=68},  (384, 325, 0, 0, 1024, {0, 0}, 0, ... {status=0x0, info=68}, "\5\0\14\3\20\0\0\0D\0\0\0\1\0\0\0\270\20\270\20\352\36\0\0\14\0\PIPE\lsass\0\0\0\1\0\0\0\0\0\0\0\4]\210\212\353\34\311\21\237\350\10\0+\20H`\2\0\0\0", ) , ) == 0x0
 02701   436   NtFsControlFile  (384, 325, 0x0, 0x0, 0x11c017,  (384, 325, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0@\0\0\0\1\0\0\0(\0\0\0\0\0,\0\0\0\0\0\30\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\250\351\22\0\14\0\0\0\2\0\1\0\0\10\0\0", 64, 1024, ... {status=0x103, info=68}, "\5\0\14\3\20\0\0\0D\0\0\0\1\0\0\0\270\20\270\20\352\36\0\0\14\0\PIPE\lsass\0\0\0\1\0\0\0\0\0\0\0\4]\210\212\353\34\311\21\237\350\10\0+\20H`\2\0\0\0", ) , 64, 1024, ... {status=0x103, info=68},  (384, 325, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0@\0\0\0\1\0\0\0(\0\0\0\0\0,\0\0\0\0\0\30\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\250\351\22\0\14\0\0\0\2\0\1\0\0\10\0\0", 64, 1024, ... {status=0x103, info=68}, "\5\0\14\3\20\0\0\0D\0\0\0\1\0\0\0\270\20\270\20\352\36\0\0\14\0\PIPE\lsass\0\0\0\1\0\0\0\0\0\0\0\4]\210\212\353\34\311\21\237\350\10\0+\20H`\2\0\0\0", ) , ) == 0x103
 02702   436   NtFsControlFile  (384, 325, 0x0, 0x0, 0x11c017,  (384, 325, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0t\0\0\0\2\0\0\0\\0\0\0\0\09\0\0\0\0\0\235\350\250\331*,\334\21\261\306\0\14)\371\246\305\1\0\0\0\340\351\22\0\1\0\0\0\350\263\25\0\5\0\0\0\1\5\0\0\0\0\0\5\25\0\0\0\3757B@\335\350\344\34C\27\122\353\3\0\0\0\0\0\0\0\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0", 116, 1024, ... {status=0x103, info=48}, "\5\0\2\3\20\0\0\00\0\0\0\1\0\0\0\30\0\0\0\0\0\0\0\0\0\0\0\235\350\250\331*,\334\21\261\306\0\14)\371\246\305\0\0\0\0", ) , 116, 1024, ... {status=0x103, info=48},  (384, 325, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0t\0\0\0\2\0\0\0\\0\0\0\0\09\0\0\0\0\0\235\350\250\331*,\334\21\261\306\0\14)\371\246\305\1\0\0\0\340\351\22\0\1\0\0\0\350\263\25\0\5\0\0\0\1\5\0\0\0\0\0\5\25\0\0\0\3757B@\335\350\344\34C\27\122\353\3\0\0\0\0\0\0\0\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0", 116, 1024, ... {status=0x103, info=48}, "\5\0\2\3\20\0\0\00\0\0\0\1\0\0\0\30\0\0\0\0\0\0\0\0\0\0\0\235\350\250\331*,\334\21\261\306\0\14)\371\246\305\0\0\0\0", ) , ) == 0x103
 02703   436   NtFsControlFile  (384, 325, 0x0, 0x0, 0x11c017,  (384, 325, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0,\0\0\0\3\0\0\0\24\0\0\0\0\0\0\0\0\0\0\0\235\350\250\331*,\334\21\261\306\0\14)\371\246\305", 44, 1024, ... {status=0x103, info=180}, "\5\0\2\3\20\0\0\0\264\0\0\0\2\0\0\0\234\0\0\0\0\0\0\0\20\264\25\0\1\0\0\0\34\264\25\0 \0\0\0\1\0\0\0\16\0\20\0(\264\25\08\264\25\0\10\0\0\0\0\0\0\0\7\0\0\0M\0Y\0W\0O\0R\0L\0D\0O\0\4\0\0\0\1\4\0\0\0\0\0\5\25\0\0\0\3757B@\335\350\344\34C\27\122\1\0\0\0\310\266\25\0\1\0\0\0\1\0\0\0\20\0\22\0\334\266\25\0\0\0\0\0\0\0\0\0\11\0\0\0\0\0\0\0\10\0\0\0S\0R\0I\0-\0u\0s\0e\0r\0\1\0\0\0\0\0\0\0", ) , 44, 1024, ... {status=0x103, info=180},  (384, 325, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0,\0\0\0\3\0\0\0\24\0\0\0\0\0\0\0\0\0\0\0\235\350\250\331*,\334\21\261\306\0\14)\371\246\305", 44, 1024, ... {status=0x103, info=180}, "\5\0\2\3\20\0\0\0\264\0\0\0\2\0\0\0\234\0\0\0\0\0\0\0\20\264\25\0\1\0\0\0\34\264\25\0 \0\0\0\1\0\0\0\16\0\20\0(\264\25\08\264\25\0\10\0\0\0\0\0\0\0\7\0\0\0M\0Y\0W\0O\0R\0L\0D\0O\0\4\0\0\0\1\4\0\0\0\0\0\5\25\0\0\0\3757B@\335\350\344\34C\27\122\1\0\0\0\310\266\25\0\1\0\0\0\1\0\0\0\20\0\22\0\334\266\25\0\0\0\0\0\0\0\0\0\11\0\0\0\0\0\0\0\10\0\0\0S\0R\0I\0-\0u\0s\0e\0r\0\1\0\0\0\0\0\0\0", ) , ) == 0x103
 02704   436   NtClose  (380, ... ) == 0x0
 02705   436   NtClose  (384, ... ) == 0x0
 02706   436   NtOpenThreadToken  (-2, 0xc, 1, ... ) == STATUS_NO_TOKEN
 02707   436   NtCreateEvent  (0x1f0003, 0x0, 1, 0, ... 384, ) == 0x0
 02708   436   NtOpenThreadToken  (-2, 0xc, 1, ... ) == STATUS_NO_TOKEN
 02709   436   NtSetInformationThread  (-2, ImpersonationToken, {ImpToken=0,}, 4, ... ) == 0x0
 02710   436   NtCreateFile  (0xc0100080, {24, 0, 0x40, 0, 1237744,  (0xc0100080, {24, 0, 0x40, 0, 1237744, "\??\PIPE\lsarpc"}, 0x0, 0, 3, 1, 64, 0, 0, ... 380, {status=0x0, info=1}, ) }, 0x0, 0, 3, 1, 64, 0, 0, ... 380, {status=0x0, info=1}, ) == 0x0
 02711   436   NtSetInformationFile  (380, 1237800, 8, Pipe, ... {status=0x0, info=0}, ) == 0x0
 02712   436   NtSetInformationFile  (380, 1237792, 8, Completion, ... {status=0x0, info=0}, ) == 0x0
 02713   436   NtSetInformationThread  (-2, ImpersonationToken, {ImpToken=0,}, 4, ... ) == 0x0
 02714   436   NtWriteFile  (380, 325, 0, 0,  (380, 325, 0, 0, "\5\0\13\3\20\0\0\0H\0\0\0\1\0\0\0\270\20\270\20\0\0\0\0\1\0\0\0\0\0\1\0xW4\224\22\315\253\357\0\1#Eg\211\253\0\0\0\0\4]\210\212\353\34\311\21\237\350\10\0+\20H`\2\0\0\0", 72, {0, 0}, 0, ... {status=0x0, info=72}, ) , 72, {0, 0}, 0, ... {status=0x0, info=72}, ) == 0x0
 02715   436   NtReadFile  (380, 325, 0, 0, 1024, {0, 0}, 0, ... {status=0x0, info=68},  (380, 325, 0, 0, 1024, {0, 0}, 0, ... {status=0x0, info=68}, "\5\0\14\3\20\0\0\0D\0\0\0\1\0\0\0\270\20\270\20\353\36\0\0\14\0\PIPE\lsass\0\0\0\1\0\0\0\0\0\0\0\4]\210\212\353\34\311\21\237\350\10\0+\20H`\2\0\0\0", ) , ) == 0x0
 02716   436   NtFsControlFile  (380, 325, 0x0, 0x0, 0x11c017,  (380, 325, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0@\0\0\0\1\0\0\0(\0\0\0\0\0,\0\0\0\0\0\30\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\244\351\22\0\14\0\0\0\2\0\1\0\0\10\0\0", 64, 1024, ... {status=0x103, info=68}, "\5\0\14\3\20\0\0\0D\0\0\0\1\0\0\0\270\20\270\20\353\36\0\0\14\0\PIPE\lsass\0\0\0\1\0\0\0\0\0\0\0\4]\210\212\353\34\311\21\237\350\10\0+\20H`\2\0\0\0", ) , 64, 1024, ... {status=0x103, info=68},  (380, 325, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0@\0\0\0\1\0\0\0(\0\0\0\0\0,\0\0\0\0\0\30\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\244\351\22\0\14\0\0\0\2\0\1\0\0\10\0\0", 64, 1024, ... {status=0x103, info=68}, "\5\0\14\3\20\0\0\0D\0\0\0\1\0\0\0\270\20\270\20\353\36\0\0\14\0\PIPE\lsass\0\0\0\1\0\0\0\0\0\0\0\4]\210\212\353\34\311\21\237\350\10\0+\20H`\2\0\0\0", ) , ) == 0x103
 02717   436   NtFsControlFile  (380, 325, 0x0, 0x0, 0x11c017,  (380, 325, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0t\0\0\0\2\0\0\0\\0\0\0\0\09\0\0\0\0\0\236\350\250\331*,\334\21\261\306\0\14)\371\246\305\1\0\0\0\334\351\22\0\1\0\0\0\350\263\25\0\5\0\0\0\1\5\0\0\0\0\0\5\25\0\0\0\3757B@\335\350\344\34C\27\122\353\3\0\0\0\0\0\0\0\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0", 116, 1024, ... {status=0x103, info=48}, "\5\0\2\3\20\0\0\00\0\0\0\1\0\0\0\30\0\0\0\0\0\0\0\0\0\0\0\236\350\250\331*,\334\21\261\306\0\14)\371\246\305\0\0\0\0", ) , 116, 1024, ... {status=0x103, info=48},  (380, 325, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0t\0\0\0\2\0\0\0\\0\0\0\0\09\0\0\0\0\0\236\350\250\331*,\334\21\261\306\0\14)\371\246\305\1\0\0\0\334\351\22\0\1\0\0\0\350\263\25\0\5\0\0\0\1\5\0\0\0\0\0\5\25\0\0\0\3757B@\335\350\344\34C\27\122\353\3\0\0\0\0\0\0\0\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0", 116, 1024, ... {status=0x103, info=48}, "\5\0\2\3\20\0\0\00\0\0\0\1\0\0\0\30\0\0\0\0\0\0\0\0\0\0\0\236\350\250\331*,\334\21\261\306\0\14)\371\246\305\0\0\0\0", ) , ) == 0x103
 02718   436   NtFsControlFile  (380, 325, 0x0, 0x0, 0x11c017,  (380, 325, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0,\0\0\0\3\0\0\0\24\0\0\0\0\0\0\0\0\0\0\0\236\350\250\331*,\334\21\261\306\0\14)\371\246\305", 44, 1024, ... {status=0x103, info=180}, "\5\0\2\3\20\0\0\0\264\0\0\0\2\0\0\0\234\0\0\0\0\0\0\0\20\264\25\0\1\0\0\0\34\264\25\0 \0\0\0\1\0\0\0\16\0\20\0(\264\25\08\264\25\0\10\0\0\0\0\0\0\0\7\0\0\0M\0Y\0W\0O\0R\0L\0D\0O\0\4\0\0\0\1\4\0\0\0\0\0\5\25\0\0\0\3757B@\335\350\344\34C\27\122\1\0\0\0\310\266\25\0\1\0\0\0\1\0\0\0\20\0\22\0\334\266\25\0\0\0\0\0\0\0\0\0\11\0\0\0\0\0\0\0\10\0\0\0S\0R\0I\0-\0u\0s\0e\0r\0\1\0\0\0\0\0\0\0", ) , 44, 1024, ... {status=0x103, info=180},  (380, 325, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0,\0\0\0\3\0\0\0\24\0\0\0\0\0\0\0\0\0\0\0\236\350\250\331*,\334\21\261\306\0\14)\371\246\305", 44, 1024, ... {status=0x103, info=180}, "\5\0\2\3\20\0\0\0\264\0\0\0\2\0\0\0\234\0\0\0\0\0\0\0\20\264\25\0\1\0\0\0\34\264\25\0 \0\0\0\1\0\0\0\16\0\20\0(\264\25\08\264\25\0\10\0\0\0\0\0\0\0\7\0\0\0M\0Y\0W\0O\0R\0L\0D\0O\0\4\0\0\0\1\4\0\0\0\0\0\5\25\0\0\0\3757B@\335\350\344\34C\27\122\1\0\0\0\310\266\25\0\1\0\0\0\1\0\0\0\20\0\22\0\334\266\25\0\0\0\0\0\0\0\0\0\11\0\0\0\0\0\0\0\10\0\0\0S\0R\0I\0-\0u\0s\0e\0r\0\1\0\0\0\0\0\0\0", ) , ) == 0x103
 02719   436   NtClose  (384, ... ) == 0x0
 02720   436   NtClose  (380, ... ) == 0x0
 02721   436   NtOpenEvent  (0x100000, {24, 0, 0x0, 0, 0,  (0x100000, {24, 0, 0x0, 0, 0, "\INSTALLATION_SECURITY_HOLD"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02722   436   NtOpenThreadToken  (-2, 0xc, 1, ... ) == STATUS_NO_TOKEN
 02723   436   NtCreateEvent  (0x1f0003, 0x0, 1, 0, ... 380, ) == 0x0
 02724   436   NtOpenThreadToken  (-2, 0xc, 1, ... ) == STATUS_NO_TOKEN
 02725   436   NtSetInformationThread  (-2, ImpersonationToken, {ImpToken=0,}, 4, ... ) == 0x0
 02726   436   NtCreateFile  (0xc0100080, {24, 0, 0x40, 0, 1237376,  (0xc0100080, {24, 0, 0x40, 0, 1237376, "\??\PIPE\lsarpc"}, 0x0, 0, 3, 1, 64, 0, 0, ... 384, {status=0x0, info=1}, ) }, 0x0, 0, 3, 1, 64, 0, 0, ... 384, {status=0x0, info=1}, ) == 0x0
 02727   436   NtSetInformationFile  (384, 1237432, 8, Pipe, ... {status=0x0, info=0}, ) == 0x0
 02728   436   NtSetInformationFile  (384, 1237424, 8, Completion, ... {status=0x0, info=0}, ) == 0x0
 02729   436   NtSetInformationThread  (-2, ImpersonationToken, {ImpToken=0,}, 4, ... ) == 0x0
 02730   436   NtWriteFile  (384, 325, 0, 0,  (384, 325, 0, 0, "\5\0\13\3\20\0\0\0H\0\0\0\1\0\0\0\270\20\270\20\0\0\0\0\1\0\0\0\0\0\1\0j(\319\14\261\320\21\233\250\0\300O\331.\365\0\0\0\0\4]\210\212\353\34\311\21\237\350\10\0+\20H`\2\0\0\0", 72, {0, 0}, 0, ... {status=0x0, info=72}, ) , 72, {0, 0}, 0, ... {status=0x0, info=72}, ) == 0x0
 02731   436   NtReadFile  (384, 325, 0, 0, 1024, {0, 0}, 0, ... {status=0x0, info=68},  (384, 325, 0, 0, 1024, {0, 0}, 0, ... {status=0x0, info=68}, "\5\0\14\3\20\0\0\0D\0\0\0\1\0\0\0\270\20\270\20\354\36\0\0\14\0\PIPE\lsass\0\0\0\1\0\0\0\0\0\0\0\4]\210\212\353\34\311\21\237\350\10\0+\20H`\2\0\0\0", ) , ) == 0x0
 02732   436   NtFsControlFile  (384, 325, 0x0, 0x0, 0x11c017,  (384, 325, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0\32\0\0\0\1\0\0\0\2\0\0\0\0\0\0\0\1\0", 26, 1024, ... {status=0x103, info=68}, "\5\0\14\3\20\0\0\0D\0\0\0\1\0\0\0\270\20\270\20\354\36\0\0\14\0\PIPE\lsass\0\0\0\1\0\0\0\0\0\0\0\4]\210\212\353\34\311\21\237\350\10\0+\20H`\2\0\0\0", ) , 26, 1024, ... {status=0x103, info=68},  (384, 325, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0\32\0\0\0\1\0\0\0\2\0\0\0\0\0\0\0\1\0", 26, 1024, ... {status=0x103, info=68}, "\5\0\14\3\20\0\0\0D\0\0\0\1\0\0\0\270\20\270\20\354\36\0\0\14\0\PIPE\lsass\0\0\0\1\0\0\0\0\0\0\0\4]\210\212\353\34\311\21\237\350\10\0+\20H`\2\0\0\0", ) , ) == 0x103
 02733   436   NtClose  (380, ... ) == 0x0
 02734   436   NtClose  (384, ... ) == 0x0
 02735   436   NtQueryVirtualMemory  (-1, 0xa30000, Basic, 28, ... {BaseAddress=0xa30000,AllocationBase=0xa30000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 0x0, ) == 0x0
 02736   436   NtQueryVirtualMemory  (-1, 0xa30000, Basic, 28, ... {BaseAddress=0xa30000,AllocationBase=0xa30000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 0x0, ) == 0x0
 02737   436   NtQueryInformationToken  (364, User, 200, ... {token info, class 1, size 36}, 36, ) == 0x0
 02738   436   NtOpenKey  (0x20019, {24, 48, 0x40, 0, 0,  (0x20019, {24, 48, 0x40, 0, 0, "Software\Microsoft\Windows NT\CurrentVersion\ProfileList\S-1-5-21-1078081533-484763869-839522115-1003"}, ... 384, ) }, ... 384, ) == 0x0
 02739   436   NtQueryValueKey  (384,  (384, "ProfileImagePath", Partial, 144, ... TitleIdx=0, Type=2, Data="%\0S\0y\0s\0t\0e\0m\0D\0r\0i\0v\0e\0%\0\\0D\0o\0c\0u\0m\0e\0n\0t\0s\0 \0a\0n\0d\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0S\0R\0I\0-\0u\0s\0e\0r\0\0\0"}, 104, ) , Partial, 144, ... TitleIdx=0, Type=2, Data= (384, "ProfileImagePath", Partial, 144, ... TitleIdx=0, Type=2, Data="%\0S\0y\0s\0t\0e\0m\0D\0r\0i\0v\0e\0%\0\\0D\0o\0c\0u\0m\0e\0n\0t\0s\0 \0a\0n\0d\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0S\0R\0I\0-\0u\0s\0e\0r\0\0\0"}, 104, ) }, 104, ) == 0x0
 02740   436   NtClose  (384, ... ) == 0x0
 02741   436   NtCreateKey  (0x2001f, {24, 376, 0x40, 0, 0,  (0x2001f, {24, 376, 0x40, 0, 0, "Software\Microsoft\Windows NT\CurrentVersion\Winlogon"}, 0, 0x0, 0, ... 384, 2, ) }, 0, 0x0, 0, ... 384, 2, ) == 0x0
 02742   436   NtQueryValueKey  (384,  (384, "ParseAutoexec", Partial, 144, ... TitleIdx=0, Type=1, Data="1\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (384, "ParseAutoexec", Partial, 144, ... TitleIdx=0, Type=1, Data="1\0\0\0"}, 16, ) }, 16, ) == 0x0
 02743   436   NtClose  (384, ... ) == 0x0
 02744   436   NtQueryInformationProcess  (-1, DefaultHardErrorMode, 4, ... {process info, class 12, size 4}, 0x0, ) == 0x0
 02745   436   NtSetInformationProcess  (-1, DefaultHardErrorMode, {process info, class 12, size 4}, 4, ... ) == 0x0
 02746   436   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\c:\autoexec.bat"}, 1239448, ... ) }, 1239448, ... ) == 0x0
 02747   436   NtCreateFile  (0x80100080, {24, 0, 0x40, 0, 1239456,  (0x80100080, {24, 0, 0x40, 0, 1239456, "\??\c:\autoexec.bat"}, 0x0, 128, 1, 1, 96, 0, 0, ... 384, {status=0x0, info=1}, ) }, 0x0, 128, 1, 1, 96, 0, 0, ... 384, {status=0x0, info=1}, ) == 0x0
 02748   436   NtQueryInformationProcess  (-1, DefaultHardErrorMode, 4, ... {process info, class 12, size 4}, 0x0, ) == 0x0
 02749   436   NtSetInformationProcess  (-1, DefaultHardErrorMode, {process info, class 12, size 4}, 4, ... ) == 0x0
 02750   436   NtQueryInformationFile  (384, 1239472, 24, Standard, ... {status=0x0, info=24}, ) == 0x0
 02751   436   NtReadFile  (384, 0, 0, 0, 0, 0x0, 0, ... {status=0x0, info=0}, "", ) == 0x0
 02752   436   NtClose  (384, ... ) == 0x0
 02753   436   NtOpenKey  (0x20019, {24, 376, 0x40, 0, 0,  (0x20019, {24, 376, 0x40, 0, 0, "Environment"}, ... 384, ) }, ... 384, ) == 0x0
 02754   436   NtAllocateVirtualMemory  (-1, 1425408, 0, 12288, 4096, 4, ... 1425408, 12288, ) == 0x0
 02755   436   NtEnumerateValueKey  (384, 0, Full, 220, ... TitleIdx=0, Type=2, Name= (384, 0, Full, 220, ... TitleIdx=0, Type=2, Name="TEMP", Data="%\0U\0S\0E\0R\0P\0R\0O\0F\0I\0L\0E\0%\0\\0L\0o\0c\0a\0l\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0T\0e\0m\0p\0\0\0"}, 96, ) , Data= (384, 0, Full, 220, ... TitleIdx=0, Type=2, Name="TEMP", Data="%\0U\0S\0E\0R\0P\0R\0O\0F\0I\0L\0E\0%\0\\0L\0o\0c\0a\0l\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0T\0e\0m\0p\0\0\0"}, 96, ) }, 96, ) == 0x0
 02756   436   NtEnumerateValueKey  (384, 1, Full, 220, ... TitleIdx=0, Type=2, Name= (384, 1, Full, 220, ... TitleIdx=0, Type=2, Name="TMP", Data="%\0U\0S\0E\0R\0P\0R\0O\0F\0I\0L\0E\0%\0\\0L\0o\0c\0a\0l\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0T\0e\0m\0p\0\0\0"}, 96, ) , Data= (384, 1, Full, 220, ... TitleIdx=0, Type=2, Name="TMP", Data="%\0U\0S\0E\0R\0P\0R\0O\0F\0I\0L\0E\0%\0\\0L\0o\0c\0a\0l\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0T\0e\0m\0p\0\0\0"}, 96, ) }, 96, ) == 0x0
 02757   436   NtEnumerateValueKey  (384, 2, Full, 220, ... ) == STATUS_NO_MORE_ENTRIES
 02758   436   NtEnumerateValueKey  (384, 0, Full, 220, ... TitleIdx=0, Type=2, Name= (384, 0, Full, 220, ... TitleIdx=0, Type=2, Name="TEMP", Data="%\0U\0S\0E\0R\0P\0R\0O\0F\0I\0L\0E\0%\0\\0L\0o\0c\0a\0l\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0T\0e\0m\0p\0\0\0"}, 96, ) , Data= (384, 0, Full, 220, ... TitleIdx=0, Type=2, Name="TEMP", Data="%\0U\0S\0E\0R\0P\0R\0O\0F\0I\0L\0E\0%\0\\0L\0o\0c\0a\0l\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0T\0e\0m\0p\0\0\0"}, 96, ) }, 96, ) == 0x0
 02759   436   NtQueryInformationProcess  (-1, DefaultHardErrorMode, 4, ... {process info, class 12, size 4}, 0x0, ) == 0x0
 02760   436   NtSetInformationProcess  (-1, DefaultHardErrorMode, {process info, class 12, size 4}, 4, ... ) == 0x0
 02761   436   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\Documents and Settings\SRI-user\Local Settings\Temp"}, 1238188, ... ) }, 1238188, ... ) == 0x0
 02762   436   NtOpenFile  (0x100001, {24, 0, 0x40, 0, 0,  (0x100001, {24, 0, 0x40, 0, 0, "\??\C:\"}, 3, 16417, ... 380, {status=0x0, info=1}, ) }, 3, 16417, ... 380, {status=0x0, info=1}, ) == 0x0
 02763   436   NtQueryDirectoryFile  (380, 0, 0, 0, 1237548, 616, BothDirectory, 1,  (380, 0, 0, 0, 1237548, 616, BothDirectory, 1, "Documents and Settings", 0, ... {status=0x0, info=138}, ) , 0, ... {status=0x0, info=138}, ) == 0x0
 02764   436   NtClose  (380, ... ) == 0x0
 02765   436   NtOpenFile  (0x100001, {24, 0, 0x40, 0, 0,  (0x100001, {24, 0, 0x40, 0, 0, "\??\C:\Documents and Settings\SRI-user\"}, 3, 16417, ... 380, {status=0x0, info=1}, ) }, 3, 16417, ... 380, {status=0x0, info=1}, ) == 0x0
 02766   436   NtQueryDirectoryFile  (380, 0, 0, 0, 1237548, 616, BothDirectory, 1,  (380, 0, 0, 0, 1237548, 616, BothDirectory, 1, "Local Settings", 0, ... {status=0x0, info=122}, ) , 0, ... {status=0x0, info=122}, ) == 0x0
 02767   436   NtClose  (380, ... ) == 0x0
 02768   436   NtQueryInformationProcess  (-1, DefaultHardErrorMode, 4, ... {process info, class 12, size 4}, 0x0, ) == 0x0
 02769   436   NtSetInformationProcess  (-1, DefaultHardErrorMode, {process info, class 12, size 4}, 4, ... ) == 0x0
 02770   436   NtQueryVirtualMemory  (-1, 0xa30000, Basic, 28, ... {BaseAddress=0xa30000,AllocationBase=0xa30000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 0x0, ) == 0x0
 02771   436   NtEnumerateValueKey  (384, 1, Full, 220, ... TitleIdx=0, Type=2, Name= (384, 1, Full, 220, ... TitleIdx=0, Type=2, Name="TMP", Data="%\0U\0S\0E\0R\0P\0R\0O\0F\0I\0L\0E\0%\0\\0L\0o\0c\0a\0l\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0T\0e\0m\0p\0\0\0"}, 96, ) , Data= (384, 1, Full, 220, ... TitleIdx=0, Type=2, Name="TMP", Data="%\0U\0S\0E\0R\0P\0R\0O\0F\0I\0L\0E\0%\0\\0L\0o\0c\0a\0l\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0T\0e\0m\0p\0\0\0"}, 96, ) }, 96, ) == 0x0
 02772   436   NtQueryInformationProcess  (-1, DefaultHardErrorMode, 4, ... {process info, class 12, size 4}, 0x0, ) == 0x0
 02773   436   NtSetInformationProcess  (-1, DefaultHardErrorMode, {process info, class 12, size 4}, 4, ... ) == 0x0
 02774   436   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\Documents and Settings\SRI-user\Local Settings\Temp"}, 1238188, ... ) }, 1238188, ... ) == 0x0
 02775   436   NtOpenFile  (0x100001, {24, 0, 0x40, 0, 0,  (0x100001, {24, 0, 0x40, 0, 0, "\??\C:\"}, 3, 16417, ... 380, {status=0x0, info=1}, ) }, 3, 16417, ... 380, {status=0x0, info=1}, ) == 0x0
 02776   436   NtQueryDirectoryFile  (380, 0, 0, 0, 1237548, 616, BothDirectory, 1,  (380, 0, 0, 0, 1237548, 616, BothDirectory, 1, "Documents and Settings", 0, ... {status=0x0, info=138}, ) , 0, ... {status=0x0, info=138}, ) == 0x0
 02777   436   NtClose  (380, ... ) == 0x0
 02778   436   NtOpenFile  (0x100001, {24, 0, 0x40, 0, 0,  (0x100001, {24, 0, 0x40, 0, 0, "\??\C:\Documents and Settings\SRI-user\"}, 3, 16417, ... 380, {status=0x0, info=1}, ) }, 3, 16417, ... 380, {status=0x0, info=1}, ) == 0x0
 02779   436   NtQueryDirectoryFile  (380, 0, 0, 0, 1237548, 616, BothDirectory, 1,  (380, 0, 0, 0, 1237548, 616, BothDirectory, 1, "Local Settings", 0, ... {status=0x0, info=122}, ) , 0, ... {status=0x0, info=122}, ) == 0x0
 02780   436   NtClose  (380, ... ) == 0x0
 02781   436   NtQueryInformationProcess  (-1, DefaultHardErrorMode, 4, ... {process info, class 12, size 4}, 0x0, ) == 0x0
 02782   436   NtSetInformationProcess  (-1, DefaultHardErrorMode, {process info, class 12, size 4}, 4, ... ) == 0x0
 02783   436   NtQueryVirtualMemory  (-1, 0xa30000, Basic, 28, ... {BaseAddress=0xa30000,AllocationBase=0xa30000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 0x0, ) == 0x0
 02784   436   NtEnumerateValueKey  (384, 2, Full, 220, ... ) == STATUS_NO_MORE_ENTRIES
 02785   436   NtClose  (384, ... ) == 0x0
 02786   436   NtOpenKey  (0x20019, {24, 376, 0x40, 0, 0,  (0x20019, {24, 376, 0x40, 0, 0, "Volatile Environment"}, ... 384, ) }, ... 384, ) == 0x0
 02787   436   NtEnumerateValueKey  (384, 0, Full, 220, ... TitleIdx=0, Type=1, Name= (384, 0, Full, 220, ... TitleIdx=0, Type=1, Name="LOGONSERVER", Data="\\0\\0M\0Y\0W\0O\0R\0L\0D\0\0\0"}, 64, ) , Data= (384, 0, Full, 220, ... TitleIdx=0, Type=1, Name="LOGONSERVER", Data="\\0\\0M\0Y\0W\0O\0R\0L\0D\0\0\0"}, 64, ) }, 64, ) == 0x0
 02788   436   NtQueryVirtualMemory  (-1, 0xa30000, Basic, 28, ... {BaseAddress=0xa30000,AllocationBase=0xa30000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 0x0, ) == 0x0
 02789   436   NtEnumerateValueKey  (384, 1, Full, 220, ... TitleIdx=0, Type=1, Name= (384, 1, Full, 220, ... TitleIdx=0, Type=1, Name="HOMEDRIVE", Data="C\0:\0\0\0"}, 46, ) , Data= (384, 1, Full, 220, ... TitleIdx=0, Type=1, Name="HOMEDRIVE", Data="C\0:\0\0\0"}, 46, ) }, 46, ) == 0x0
 02790   436   NtQueryVirtualMemory  (-1, 0xa30000, Basic, 28, ... {BaseAddress=0xa30000,AllocationBase=0xa30000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 0x0, ) == 0x0
 02791   436   NtEnumerateValueKey  (384, 2, Full, 220, ... TitleIdx=0, Type=1, Name= (384, 2, Full, 220, ... TitleIdx=0, Type=1, Name="HOMEPATH", Data="\\0D\0o\0c\0u\0m\0e\0n\0t\0s\0 \0a\0n\0d\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0S\0R\0I\0-\0u\0s\0e\0r\0\0\0"}, 102, ) , Data= (384, 2, Full, 220, ... TitleIdx=0, Type=1, Name="HOMEPATH", Data="\\0D\0o\0c\0u\0m\0e\0n\0t\0s\0 \0a\0n\0d\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0S\0R\0I\0-\0u\0s\0e\0r\0\0\0"}, 102, ) }, 102, ) == 0x0
 02792   436   NtQueryVirtualMemory  (-1, 0xa30000, Basic, 28, ... {BaseAddress=0xa30000,AllocationBase=0xa30000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 0x0, ) == 0x0
 02793   436   NtEnumerateValueKey  (384, 3, Full, 220, ... TitleIdx=0, Type=1, Name= (384, 3, Full, 220, ... TitleIdx=0, Type=1, Name="CLIENTNAME", Data="C\0o\0n\0s\0o\0l\0e\0\0\0"}, 56, ) , Data= (384, 3, Full, 220, ... TitleIdx=0, Type=1, Name="CLIENTNAME", Data="C\0o\0n\0s\0o\0l\0e\0\0\0"}, 56, ) }, 56, ) == 0x0
 02794   436   NtQueryVirtualMemory  (-1, 0xa30000, Basic, 28, ... {BaseAddress=0xa30000,AllocationBase=0xa30000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 0x0, ) == 0x0
 02795   436   NtEnumerateValueKey  (384, 4, Full, 220, ... TitleIdx=0, Type=1, Name= (384, 4, Full, 220, ... TitleIdx=0, Type=1, Name="SESSIONNAME", Data="C\0o\0n\0s\0o\0l\0e\0\0\0"}, 60, ) , Data= (384, 4, Full, 220, ... TitleIdx=0, Type=1, Name="SESSIONNAME", Data="C\0o\0n\0s\0o\0l\0e\0\0\0"}, 60, ) }, 60, ) == 0x0
 02796   436   NtQueryVirtualMemory  (-1, 0xa30000, Basic, 28, ... {BaseAddress=0xa30000,AllocationBase=0xa30000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 0x0, ) == 0x0
 02797   436   NtEnumerateValueKey  (384, 5, Full, 220, ... TitleIdx=0, Type=1, Name= (384, 5, Full, 220, ... TitleIdx=0, Type=1, Name="APPDATA", Data="C\0:\0\\0D\0o\0c\0u\0m\0e\0n\0t\0s\0 \0a\0n\0d\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0S\0R\0I\0-\0u\0s\0e\0r\0\\0A\0p\0p\0l\0i\0c\0a\0t\0i\0o\0n\0 \0D\0a\0t\0a\0\0\0"}, 140, ) , Data= (384, 5, Full, 220, ... TitleIdx=0, Type=1, Name="APPDATA", Data="C\0:\0\\0D\0o\0c\0u\0m\0e\0n\0t\0s\0 \0a\0n\0d\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0S\0R\0I\0-\0u\0s\0e\0r\0\\0A\0p\0p\0l\0i\0c\0a\0t\0i\0o\0n\0 \0D\0a\0t\0a\0\0\0"}, 140, ) }, 140, ) == 0x0
 02798   436   NtQueryVirtualMemory  (-1, 0xa30000, Basic, 28, ... {BaseAddress=0xa30000,AllocationBase=0xa30000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 0x0, ) == 0x0
 02799   436   NtEnumerateValueKey  (384, 6, Full, 220, ... TitleIdx=0, Type=1, Name= (384, 6, Full, 220, ... TitleIdx=0, Type=1, Name="HOMESHARE", Data="\0\0"}, 42, ) , Data= (384, 6, Full, 220, ... TitleIdx=0, Type=1, Name="HOMESHARE", Data="\0\0"}, 42, ) }, 42, ) == 0x0
 02800   436   NtEnumerateValueKey  (384, 7, Full, 220, ... ) == STATUS_NO_MORE_ENTRIES
 02801   436   NtEnumerateValueKey  (384, 0, Full, 220, ... TitleIdx=0, Type=1, Name= (384, 0, Full, 220, ... TitleIdx=0, Type=1, Name="LOGONSERVER", Data="\\0\\0M\0Y\0W\0O\0R\0L\0D\0\0\0"}, 64, ) , Data= (384, 0, Full, 220, ... TitleIdx=0, Type=1, Name="LOGONSERVER", Data="\\0\\0M\0Y\0W\0O\0R\0L\0D\0\0\0"}, 64, ) }, 64, ) == 0x0
 02802   436   NtEnumerateValueKey  (384, 1, Full, 220, ... TitleIdx=0, Type=1, Name= (384, 1, Full, 220, ... TitleIdx=0, Type=1, Name="HOMEDRIVE", Data="C\0:\0\0\0"}, 46, ) , Data= (384, 1, Full, 220, ... TitleIdx=0, Type=1, Name="HOMEDRIVE", Data="C\0:\0\0\0"}, 46, ) }, 46, ) == 0x0
 02803   436   NtEnumerateValueKey  (384, 2, Full, 220, ... TitleIdx=0, Type=1, Name= (384, 2, Full, 220, ... TitleIdx=0, Type=1, Name="HOMEPATH", Data="\\0D\0o\0c\0u\0m\0e\0n\0t\0s\0 \0a\0n\0d\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0S\0R\0I\0-\0u\0s\0e\0r\0\0\0"}, 102, ) , Data= (384, 2, Full, 220, ... TitleIdx=0, Type=1, Name="HOMEPATH", Data="\\0D\0o\0c\0u\0m\0e\0n\0t\0s\0 \0a\0n\0d\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0S\0R\0I\0-\0u\0s\0e\0r\0\0\0"}, 102, ) }, 102, ) == 0x0
 02804   436   NtEnumerateValueKey  (384, 3, Full, 220, ... TitleIdx=0, Type=1, Name= (384, 3, Full, 220, ... TitleIdx=0, Type=1, Name="CLIENTNAME", Data="C\0o\0n\0s\0o\0l\0e\0\0\0"}, 56, ) , Data= (384, 3, Full, 220, ... TitleIdx=0, Type=1, Name="CLIENTNAME", Data="C\0o\0n\0s\0o\0l\0e\0\0\0"}, 56, ) }, 56, ) == 0x0
 02805   436   NtEnumerateValueKey  (384, 4, Full, 220, ... TitleIdx=0, Type=1, Name= (384, 4, Full, 220, ... TitleIdx=0, Type=1, Name="SESSIONNAME", Data="C\0o\0n\0s\0o\0l\0e\0\0\0"}, 60, ) , Data= (384, 4, Full, 220, ... TitleIdx=0, Type=1, Name="SESSIONNAME", Data="C\0o\0n\0s\0o\0l\0e\0\0\0"}, 60, ) }, 60, ) == 0x0
 02806   436   NtEnumerateValueKey  (384, 5, Full, 220, ... TitleIdx=0, Type=1, Name= (384, 5, Full, 220, ... TitleIdx=0, Type=1, Name="APPDATA", Data="C\0:\0\\0D\0o\0c\0u\0m\0e\0n\0t\0s\0 \0a\0n\0d\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0S\0R\0I\0-\0u\0s\0e\0r\0\\0A\0p\0p\0l\0i\0c\0a\0t\0i\0o\0n\0 \0D\0a\0t\0a\0\0\0"}, 140, ) , Data= (384, 5, Full, 220, ... TitleIdx=0, Type=1, Name="APPDATA", Data="C\0:\0\\0D\0o\0c\0u\0m\0e\0n\0t\0s\0 \0a\0n\0d\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0S\0R\0I\0-\0u\0s\0e\0r\0\\0A\0p\0p\0l\0i\0c\0a\0t\0i\0o\0n\0 \0D\0a\0t\0a\0\0\0"}, 140, ) }, 140, ) == 0x0
 02807   436   NtEnumerateValueKey  (384, 6, Full, 220, ... TitleIdx=0, Type=1, Name= (384, 6, Full, 220, ... TitleIdx=0, Type=1, Name="HOMESHARE", Data="\0\0"}, 42, ) , Data= (384, 6, Full, 220, ... TitleIdx=0, Type=1, Name="HOMESHARE", Data="\0\0"}, 42, ) }, 42, ) == 0x0
 02808   436   NtEnumerateValueKey  (384, 7, Full, 220, ... ) == STATUS_NO_MORE_ENTRIES
 02809   436   NtClose  (384, ... ) == 0x0
 02810   436   NtClose  (376, ... ) == 0x0
 02811   436   NtFreeVirtualMemory  (-1, (0xa30000), 0, 32768, ... (0xa30000), 4096, ) == 0x0
 02812   436   NtClose  (368, ... ) == 0x0
 02813   436   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\Documents and Settings\All Users\Application Data"}, 1240112, ... ) }, 1240112, ... ) == 0x0
 02814   436   NtCreateKey  (0x2000000, {24, 48, 0x40, 0, 0,  (0x2000000, {24, 48, 0x40, 0, 0, "Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders"}, 0, 0x0, 0, ... 368, 2, ) }, 0, 0x0, 0, ... 368, 2, ) == 0x0
 02815   436   NtSetValueKey  (368,  (368, "Common AppData", 0, 1, "C\0:\0\\0D\0o\0c\0u\0m\0e\0n\0t\0s\0 \0a\0n\0d\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0A\0l\0l\0 \0U\0s\0e\0r\0s\0\\0A\0p\0p\0l\0i\0c\0a\0t\0i\0o\0n\0 \0D\0a\0t\0a\0\0\0", 106, ... ) , 0, 1,  (368, "Common AppData", 0, 1, "C\0:\0\\0D\0o\0c\0u\0m\0e\0n\0t\0s\0 \0a\0n\0d\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0A\0l\0l\0 \0U\0s\0e\0r\0s\0\\0A\0p\0p\0l\0i\0c\0a\0t\0i\0o\0n\0 \0D\0a\0t\0a\0\0\0", 106, ... ) , 106, ... ) == 0x0
 02816   436   NtClose  (368, ... ) == 0x0
 02817   436   NtClose  (364, ... ) == 0x0
 02818   436   NtOpenFile  (0x100001, {24, 0, 0x40, 0, 0,  (0x100001, {24, 0, 0x40, 0, 0, "\??\C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Connections\Pbk\"}, 3, 16417, ... 364, {status=0x0, info=1}, ) }, 3, 16417, ... 364, {status=0x0, info=1}, ) == 0x0
 02819   436   NtQueryDirectoryFile  (364, 0, 0, 0, 1239088, 616, BothDirectory, 1,  (364, 0, 0, 0, 1239088, 616, BothDirectory, 1, "<.pbk", 0, ... ) , 0, ... ) == STATUS_NO_SUCH_FILE
 02820   436   NtClose  (364, ... ) == 0x0
 02821   436   NtOpenFile  (0x100001, {24, 0, 0x40, 0, 0,  (0x100001, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\System32\Ras\"}, 3, 16417, ... 364, {status=0x0, info=1}, ) }, 3, 16417, ... 364, {status=0x0, info=1}, ) == 0x0
 02822   436   NtQueryDirectoryFile  (364, 0, 0, 0, 1239088, 616, BothDirectory, 1,  (364, 0, 0, 0, 1239088, 616, BothDirectory, 1, "<.pbk", 0, ... ) , 0, ... ) == STATUS_NO_SUCH_FILE
 02823   436   NtClose  (364, ... ) == 0x0
 02824   436   NtOpenThreadToken  (-2, 0xc, 1, ... ) == STATUS_NO_TOKEN
 02825   436   NtOpenProcessToken  (-1, 0xc, ... 364, ) == 0x0
 02826   436   NtQueryInformationToken  (364, User, 64, ... {token info, class 1, size 36}, 36, ) == 0x0
 02827   436   NtOpenKey  (0x2001f, {24, 356, 0x40, 0, 0,  (0x2001f, {24, 356, 0x40, 0, 0, "S-1-5-21-1078081533-484763869-839522115-1003"}, ... 368, ) }, ... 368, ) == 0x0
 02828   436   NtCreateKey  (0x2000000, {24, 368, 0x40, 0, 0,  (0x2000000, {24, 368, 0x40, 0, 0, "Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders"}, 0, 0x0, 0, ... 376, 2, ) }, 0, 0x0, 0, ... 376, 2, ) == 0x0
 02829   436   NtClose  (368, ... ) == 0x0
 02830   436   NtQueryValueKey  (376,  (376, "AppData", Partial, 144, ... TitleIdx=0, Type=2, Data="%\0U\0S\0E\0R\0P\0R\0O\0F\0I\0L\0E\0%\0\\0A\0p\0p\0l\0i\0c\0a\0t\0i\0o\0n\0 \0D\0a\0t\0a\0\0\0"}, 74, ) , Partial, 144, ... TitleIdx=0, Type=2, Data= (376, "AppData", Partial, 144, ... TitleIdx=0, Type=2, Data="%\0U\0S\0E\0R\0P\0R\0O\0F\0I\0L\0E\0%\0\\0A\0p\0p\0l\0i\0c\0a\0t\0i\0o\0n\0 \0D\0a\0t\0a\0\0\0"}, 74, ) }, 74, ) == 0x0
 02831   436   NtAllocateVirtualMemory  (-1, 0, 0, 1, 4096, 4, ... 10682368, 4096, ) == 0x0
 02832   436   NtQueryVirtualMemory  (-1, 0xa30000, Basic, 28, ... {BaseAddress=0xa30000,AllocationBase=0xa30000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 0x0, ) == 0x0
 02833   436   NtQueryVirtualMemory  (-1, 0xa30000, Basic, 28, ... {BaseAddress=0xa30000,AllocationBase=0xa30000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 0x0, ) == 0x0
 02834   436   NtOpenKey  (0x20019, {24, 48, 0x40, 0, 0,  (0x20019, {24, 48, 0x40, 0, 0, "Software\Microsoft\Windows NT\CurrentVersion\ProfileList"}, ... 368, ) }, ... 368, ) == 0x0
 02835   436   NtQueryValueKey  (368,  (368, "ProfilesDirectory", Partial, 144, ... TitleIdx=0, Type=2, Data="%\0S\0y\0s\0t\0e\0m\0D\0r\0i\0v\0e\0%\0\\0D\0o\0c\0u\0m\0e\0n\0t\0s\0 \0a\0n\0d\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\0\0"}, 86, ) , Partial, 144, ... TitleIdx=0, Type=2, Data= (368, "ProfilesDirectory", Partial, 144, ... TitleIdx=0, Type=2, Data="%\0S\0y\0s\0t\0e\0m\0D\0r\0i\0v\0e\0%\0\\0D\0o\0c\0u\0m\0e\0n\0t\0s\0 \0a\0n\0d\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\0\0"}, 86, ) }, 86, ) == 0x0
 02836   436   NtClose  (368, ... ) == 0x0
 02837   436   NtOpenKey  (0x20019, {24, 48, 0x40, 0, 0,  (0x20019, {24, 48, 0x40, 0, 0, "Software\Microsoft\Windows NT\CurrentVersion\ProfileList"}, ... 368, ) }, ... 368, ) == 0x0
 02838   436   NtQueryValueKey  (368,  (368, "AllUsersProfile", Partial, 144, ... TitleIdx=0, Type=1, Data="A\0l\0l\0 \0U\0s\0e\0r\0s\0\0\0"}, 32, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (368, "AllUsersProfile", Partial, 144, ... TitleIdx=0, Type=1, Data="A\0l\0l\0 \0U\0s\0e\0r\0s\0\0\0"}, 32, ) }, 32, ) == 0x0
 02839   436   NtClose  (368, ... ) == 0x0
 02840   436   NtQueryVirtualMemory  (-1, 0xa30000, Basic, 28, ... {BaseAddress=0xa30000,AllocationBase=0xa30000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 0x0, ) == 0x0
 02841   436   NtOpenKey  (0x1, {24, 48, 0x40, 0, 0,  (0x1, {24, 48, 0x40, 0, 0, "System\CurrentControlSet\Control\Session Manager\Environment"}, ... 368, ) }, ... 368, ) == 0x0
 02842   436   NtQueryKey  (368, Full, 176, ... {LastWrite={0x7838d13c,0x1c73999}, TitleIdx=0, Subkeys=0, Values=12, Class=""}, 44, ) == 0x0
 02843   436   NtQuerySecurityObject  (368, 7, 0, ... ) == STATUS_ACCESS_DENIED
 02844   436   NtEnumerateValueKey  (368, 0, Full, 220, ... TitleIdx=0, Type=2, Name= (368, 0, Full, 220, ... TitleIdx=0, Type=2, Name="ComSpec", Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0s\0y\0s\0t\0e\0m\03\02\0\\0c\0m\0d\0.\0e\0x\0e\0\0\0"}, 96, ) , Data= (368, 0, Full, 220, ... TitleIdx=0, Type=2, Name="ComSpec", Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0s\0y\0s\0t\0e\0m\03\02\0\\0c\0m\0d\0.\0e\0x\0e\0\0\0"}, 96, ) }, 96, ) == 0x0
 02845   436   NtEnumerateValueKey  (368, 1, Full, 220, ... TitleIdx=0, Type=2, Name= (368, 1, Full, 220, ... TitleIdx=0, Type=2, Name="Path", Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0s\0y\0s\0t\0e\0m\03\02\0;\0%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0;\0%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0W\0b\0e\0m\0\0\0"}, 152, ) , Data= (368, 1, Full, 220, ... TitleIdx=0, Type=2, Name="Path", Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0s\0y\0s\0t\0e\0m\03\02\0;\0%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0;\0%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0W\0b\0e\0m\0\0\0"}, 152, ) }, 152, ) == 0x0
 02846   436   NtEnumerateValueKey  (368, 2, Full, 220, ... TitleIdx=0, Type=2, Name= (368, 2, Full, 220, ... TitleIdx=0, Type=2, Name="windir", Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\0\0"}, 58, ) , Data= (368, 2, Full, 220, ... TitleIdx=0, Type=2, Name="windir", Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\0\0"}, 58, ) }, 58, ) == 0x0
 02847   436   NtEnumerateValueKey  (368, 3, Full, 220, ... TitleIdx=0, Type=1, Name= (368, 3, Full, 220, ... TitleIdx=0, Type=1, Name="OS", Data="W\0i\0n\0d\0o\0w\0s\0_\0N\0T\0\0\0"}, 46, ) , Data= (368, 3, Full, 220, ... TitleIdx=0, Type=1, Name="OS", Data="W\0i\0n\0d\0o\0w\0s\0_\0N\0T\0\0\0"}, 46, ) }, 46, ) == 0x0
 02848   436   NtQueryVirtualMemory  (-1, 0xa30000, Basic, 28, ... {BaseAddress=0xa30000,AllocationBase=0xa30000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 0x0, ) == 0x0
 02849   436   NtEnumerateValueKey  (368, 4, Full, 220, ... TitleIdx=0, Type=1, Name= (368, 4, Full, 220, ... TitleIdx=0, Type=1, Name="PROCESSOR_ARCHITECTURE", Data="x\08\06\0\0\0"}, 72, ) , Data= (368, 4, Full, 220, ... TitleIdx=0, Type=1, Name="PROCESSOR_ARCHITECTURE", Data="x\08\06\0\0\0"}, 72, ) }, 72, ) == 0x0
 02850   436   NtQueryVirtualMemory  (-1, 0xa30000, Basic, 28, ... {BaseAddress=0xa30000,AllocationBase=0xa30000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 0x0, ) == 0x0
 02851   436   NtEnumerateValueKey  (368, 5, Full, 220, ... TitleIdx=0, Type=1, Name= (368, 5, Full, 220, ... TitleIdx=0, Type=1, Name="PROCESSOR_LEVEL", Data="1\05\0\0\0"}, 58, ) , Data= (368, 5, Full, 220, ... TitleIdx=0, Type=1, Name="PROCESSOR_LEVEL", Data="1\05\0\0\0"}, 58, ) }, 58, ) == 0x0
 02852   436   NtQueryVirtualMemory  (-1, 0xa30000, Basic, 28, ... {BaseAddress=0xa30000,AllocationBase=0xa30000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 0x0, ) == 0x0
 02853   436   NtEnumerateValueKey  (368, 6, Full, 220, ... TitleIdx=0, Type=1, Name= (368, 6, Full, 220, ... TitleIdx=0, Type=1, Name="PROCESSOR_IDENTIFIER", Data="x\08\06\0 \0F\0a\0m\0i\0l\0y\0 \01\05\0 \0M\0o\0d\0e\0l\0 \04\0 \0S\0t\0e\0p\0p\0i\0n\0g\0 \08\0,\0 \0G\0e\0n\0u\0i\0n\0e\0I\0n\0t\0e\0l\0\0\0"}, 154, ) , Data= (368, 6, Full, 220, ... TitleIdx=0, Type=1, Name="PROCESSOR_IDENTIFIER", Data="x\08\06\0 \0F\0a\0m\0i\0l\0y\0 \01\05\0 \0M\0o\0d\0e\0l\0 \04\0 \0S\0t\0e\0p\0p\0i\0n\0g\0 \08\0,\0 \0G\0e\0n\0u\0i\0n\0e\0I\0n\0t\0e\0l\0\0\0"}, 154, ) }, 154, ) == 0x0
 02854   436   NtQueryVirtualMemory  (-1, 0xa30000, Basic, 28, ... {BaseAddress=0xa30000,AllocationBase=0xa30000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 0x0, ) == 0x0
 02855   436   NtEnumerateValueKey  (368, 7, Full, 220, ... TitleIdx=0, Type=1, Name= (368, 7, Full, 220, ... TitleIdx=0, Type=1, Name="PROCESSOR_REVISION", Data="0\04\00\08\0\0\0"}, 66, ) , Data= (368, 7, Full, 220, ... TitleIdx=0, Type=1, Name="PROCESSOR_REVISION", Data="0\04\00\08\0\0\0"}, 66, ) }, 66, ) == 0x0
 02856   436   NtQueryVirtualMemory  (-1, 0xa30000, Basic, 28, ... {BaseAddress=0xa30000,AllocationBase=0xa30000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 0x0, ) == 0x0
 02857   436   NtEnumerateValueKey  (368, 8, Full, 220, ... TitleIdx=0, Type=1, Name= (368, 8, Full, 220, ... TitleIdx=0, Type=1, Name="NUMBER_OF_PROCESSORS", Data="1\0\0\0"}, 64, ) , Data= (368, 8, Full, 220, ... TitleIdx=0, Type=1, Name="NUMBER_OF_PROCESSORS", Data="1\0\0\0"}, 64, ) }, 64, ) == 0x0
 02858   436   NtQueryVirtualMemory  (-1, 0xa30000, Basic, 28, ... {BaseAddress=0xa30000,AllocationBase=0xa30000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 0x0, ) == 0x0
 02859   436   NtEnumerateValueKey  (368, 9, Full, 220, ... TitleIdx=0, Type=1, Name= (368, 9, Full, 220, ... TitleIdx=0, Type=1, Name="PATHEXT", Data=".\0C\0O\0M\0;\0.\0E\0X\0E\0;\0.\0B\0A\0T\0;\0.\0C\0M\0D\0;\0.\0V\0B\0S\0;\0.\0V\0B\0E\0;\0.\0J\0S\0;\0.\0J\0S\0E\0;\0.\0W\0S\0F\0;\0.\0W\0S\0H\0\0\0"}, 134, ) , Data= (368, 9, Full, 220, ... TitleIdx=0, Type=1, Name="PATHEXT", Data=".\0C\0O\0M\0;\0.\0E\0X\0E\0;\0.\0B\0A\0T\0;\0.\0C\0M\0D\0;\0.\0V\0B\0S\0;\0.\0V\0B\0E\0;\0.\0J\0S\0;\0.\0J\0S\0E\0;\0.\0W\0S\0F\0;\0.\0W\0S\0H\0\0\0"}, 134, ) }, 134, ) == 0x0
 02860   436   NtQueryVirtualMemory  (-1, 0xa30000, Basic, 28, ... {BaseAddress=0xa30000,AllocationBase=0xa30000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 0x0, ) == 0x0
 02861   436   NtEnumerateValueKey  (368, 10, Full, 220, ... TitleIdx=0, Type=2, Name= (368, 10, Full, 220, ... TitleIdx=0, Type=2, Name="TEMP", Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0T\0E\0M\0P\0\0\0"}, 64, ) , Data= (368, 10, Full, 220, ... TitleIdx=0, Type=2, Name="TEMP", Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0T\0E\0M\0P\0\0\0"}, 64, ) }, 64, ) == 0x0
 02862   436   NtEnumerateValueKey  (368, 11, Full, 220, ... TitleIdx=0, Type=2, Name= (368, 11, Full, 220, ... TitleIdx=0, Type=2, Name="TMP", Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0T\0E\0M\0P\0\0\0"}, 64, ) , Data= (368, 11, Full, 220, ... TitleIdx=0, Type=2, Name="TMP", Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0T\0E\0M\0P\0\0\0"}, 64, ) }, 64, ) == 0x0
 02863   436   NtEnumerateValueKey  (368, 0, Full, 220, ... TitleIdx=0, Type=2, Name= (368, 0, Full, 220, ... TitleIdx=0, Type=2, Name="ComSpec", Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0s\0y\0s\0t\0e\0m\03\02\0\\0c\0m\0d\0.\0e\0x\0e\0\0\0"}, 96, ) , Data= (368, 0, Full, 220, ... TitleIdx=0, Type=2, Name="ComSpec", Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0s\0y\0s\0t\0e\0m\03\02\0\\0c\0m\0d\0.\0e\0x\0e\0\0\0"}, 96, ) }, 96, ) == 0x0
 02864   436   NtQueryVirtualMemory  (-1, 0xa30000, Basic, 28, ... {BaseAddress=0xa30000,AllocationBase=0xa30000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 0x0, ) == 0x0
 02865   436   NtEnumerateValueKey  (368, 1, Full, 220, ... TitleIdx=0, Type=2, Name= (368, 1, Full, 220, ... TitleIdx=0, Type=2, Name="Path", Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0s\0y\0s\0t\0e\0m\03\02\0;\0%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0;\0%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0W\0b\0e\0m\0\0\0"}, 152, ) , Data= (368, 1, Full, 220, ... TitleIdx=0, Type=2, Name="Path", Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0s\0y\0s\0t\0e\0m\03\02\0;\0%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0;\0%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0W\0b\0e\0m\0\0\0"}, 152, ) }, 152, ) == 0x0
 02866   436   NtQueryVirtualMemory  (-1, 0xa30000, Basic, 28, ... {BaseAddress=0xa30000,AllocationBase=0xa30000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 0x0, ) == 0x0
 02867   436   NtEnumerateValueKey  (368, 2, Full, 220, ... TitleIdx=0, Type=2, Name= (368, 2, Full, 220, ... TitleIdx=0, Type=2, Name="windir", Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\0\0"}, 58, ) , Data= (368, 2, Full, 220, ... TitleIdx=0, Type=2, Name="windir", Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\0\0"}, 58, ) }, 58, ) == 0x0
 02868   436   NtQueryVirtualMemory  (-1, 0xa30000, Basic, 28, ... {BaseAddress=0xa30000,AllocationBase=0xa30000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 0x0, ) == 0x0
 02869   436   NtEnumerateValueKey  (368, 3, Full, 220, ... TitleIdx=0, Type=1, Name= (368, 3, Full, 220, ... TitleIdx=0, Type=1, Name="OS", Data="W\0i\0n\0d\0o\0w\0s\0_\0N\0T\0\0\0"}, 46, ) , Data= (368, 3, Full, 220, ... TitleIdx=0, Type=1, Name="OS", Data="W\0i\0n\0d\0o\0w\0s\0_\0N\0T\0\0\0"}, 46, ) }, 46, ) == 0x0
 02870   436   NtEnumerateValueKey  (368, 4, Full, 220, ... TitleIdx=0, Type=1, Name= (368, 4, Full, 220, ... TitleIdx=0, Type=1, Name="PROCESSOR_ARCHITECTURE", Data="x\08\06\0\0\0"}, 72, ) , Data= (368, 4, Full, 220, ... TitleIdx=0, Type=1, Name="PROCESSOR_ARCHITECTURE", Data="x\08\06\0\0\0"}, 72, ) }, 72, ) == 0x0
 02871   436   NtEnumerateValueKey  (368, 5, Full, 220, ... TitleIdx=0, Type=1, Name= (368, 5, Full, 220, ... TitleIdx=0, Type=1, Name="PROCESSOR_LEVEL", Data="1\05\0\0\0"}, 58, ) , Data= (368, 5, Full, 220, ... TitleIdx=0, Type=1, Name="PROCESSOR_LEVEL", Data="1\05\0\0\0"}, 58, ) }, 58, ) == 0x0
 02872   436   NtEnumerateValueKey  (368, 6, Full, 220, ... TitleIdx=0, Type=1, Name= (368, 6, Full, 220, ... TitleIdx=0, Type=1, Name="PROCESSOR_IDENTIFIER", Data="x\08\06\0 \0F\0a\0m\0i\0l\0y\0 \01\05\0 \0M\0o\0d\0e\0l\0 \04\0 \0S\0t\0e\0p\0p\0i\0n\0g\0 \08\0,\0 \0G\0e\0n\0u\0i\0n\0e\0I\0n\0t\0e\0l\0\0\0"}, 154, ) , Data= (368, 6, Full, 220, ... TitleIdx=0, Type=1, Name="PROCESSOR_IDENTIFIER", Data="x\08\06\0 \0F\0a\0m\0i\0l\0y\0 \01\05\0 \0M\0o\0d\0e\0l\0 \04\0 \0S\0t\0e\0p\0p\0i\0n\0g\0 \08\0,\0 \0G\0e\0n\0u\0i\0n\0e\0I\0n\0t\0e\0l\0\0\0"}, 154, ) }, 154, ) == 0x0
 02873   436   NtEnumerateValueKey  (368, 7, Full, 220, ... TitleIdx=0, Type=1, Name= (368, 7, Full, 220, ... TitleIdx=0, Type=1, Name="PROCESSOR_REVISION", Data="0\04\00\08\0\0\0"}, 66, ) , Data= (368, 7, Full, 220, ... TitleIdx=0, Type=1, Name="PROCESSOR_REVISION", Data="0\04\00\08\0\0\0"}, 66, ) }, 66, ) == 0x0
 02874   436   NtEnumerateValueKey  (368, 8, Full, 220, ... TitleIdx=0, Type=1, Name= (368, 8, Full, 220, ... TitleIdx=0, Type=1, Name="NUMBER_OF_PROCESSORS", Data="1\0\0\0"}, 64, ) , Data= (368, 8, Full, 220, ... TitleIdx=0, Type=1, Name="NUMBER_OF_PROCESSORS", Data="1\0\0\0"}, 64, ) }, 64, ) == 0x0
 02875   436   NtEnumerateValueKey  (368, 9, Full, 220, ... TitleIdx=0, Type=1, Name= (368, 9, Full, 220, ... TitleIdx=0, Type=1, Name="PATHEXT", Data=".\0C\0O\0M\0;\0.\0E\0X\0E\0;\0.\0B\0A\0T\0;\0.\0C\0M\0D\0;\0.\0V\0B\0S\0;\0.\0V\0B\0E\0;\0.\0J\0S\0;\0.\0J\0S\0E\0;\0.\0W\0S\0F\0;\0.\0W\0S\0H\0\0\0"}, 134, ) , Data= (368, 9, Full, 220, ... TitleIdx=0, Type=1, Name="PATHEXT", Data=".\0C\0O\0M\0;\0.\0E\0X\0E\0;\0.\0B\0A\0T\0;\0.\0C\0M\0D\0;\0.\0V\0B\0S\0;\0.\0V\0B\0E\0;\0.\0J\0S\0;\0.\0J\0S\0E\0;\0.\0W\0S\0F\0;\0.\0W\0S\0H\0\0\0"}, 134, ) }, 134, ) == 0x0
 02876   436   NtEnumerateValueKey  (368, 10, Full, 220, ... TitleIdx=0, Type=2, Name= (368, 10, Full, 220, ... TitleIdx=0, Type=2, Name="TEMP", Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0T\0E\0M\0P\0\0\0"}, 64, ) , Data= (368, 10, Full, 220, ... TitleIdx=0, Type=2, Name="TEMP", Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0T\0E\0M\0P\0\0\0"}, 64, ) }, 64, ) == 0x0
 02877   436   NtQueryInformationProcess  (-1, DefaultHardErrorMode, 4, ... {process info, class 12, size 4}, 0x0, ) == 0x0
 02878   436   NtSetInformationProcess  (-1, DefaultHardErrorMode, {process info, class 12, size 4}, 4, ... ) == 0x0
 02879   436   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\TEMP"}, 1238160, ... ) }, 1238160, ... ) == 0x0
 02880   436   NtQueryInformationProcess  (-1, DefaultHardErrorMode, 4, ... {process info, class 12, size 4}, 0x0, ) == 0x0
 02881   436   NtSetInformationProcess  (-1, DefaultHardErrorMode, {process info, class 12, size 4}, 4, ... ) == 0x0
 02882   436   NtQueryVirtualMemory  (-1, 0xa30000, Basic, 28, ... {BaseAddress=0xa30000,AllocationBase=0xa30000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 0x0, ) == 0x0
 02883   436   NtEnumerateValueKey  (368, 11, Full, 220, ... TitleIdx=0, Type=2, Name= (368, 11, Full, 220, ... TitleIdx=0, Type=2, Name="TMP", Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0T\0E\0M\0P\0\0\0"}, 64, ) , Data= (368, 11, Full, 220, ... TitleIdx=0, Type=2, Name="TMP", Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0T\0E\0M\0P\0\0\0"}, 64, ) }, 64, ) == 0x0
 02884   436   NtQueryInformationProcess  (-1, DefaultHardErrorMode, 4, ... {process info, class 12, size 4}, 0x0, ) == 0x0
 02885   436   NtSetInformationProcess  (-1, DefaultHardErrorMode, {process info, class 12, size 4}, 4, ... ) == 0x0
 02886   436   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\TEMP"}, 1238160, ... ) }, 1238160, ... ) == 0x0
 02887   436   NtQueryInformationProcess  (-1, DefaultHardErrorMode, 4, ... {process info, class 12, size 4}, 0x0, ) == 0x0
 02888   436   NtSetInformationProcess  (-1, DefaultHardErrorMode, {process info, class 12, size 4}, 4, ... ) == 0x0
 02889   436   NtQueryVirtualMemory  (-1, 0xa30000, Basic, 28, ... {BaseAddress=0xa30000,AllocationBase=0xa30000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 0x0, ) == 0x0
 02890   436   NtClose  (368, ... ) == 0x0
 02891   436   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\System\CurrentControlSet\Control\ComputerName"}, ... 368, ) }, ... 368, ) == 0x0
 02892   436   NtOpenKey  (0x20019, {24, 368, 0x40, 0, 0,  (0x20019, {24, 368, 0x40, 0, 0, "ActiveComputerName"}, ... 384, ) }, ... 384, ) == 0x0
 02893   436   NtQueryValueKey  (384,  (384, "ComputerName", Full, 108, ... TitleIdx=0, Type=1, Name="ComputerName", Data="M\0Y\0W\0O\0R\0L\0D\0\0\0"}, 60, ) , Full, 108, ... TitleIdx=0, Type=1, Name= (384, "ComputerName", Full, 108, ... TitleIdx=0, Type=1, Name="ComputerName", Data="M\0Y\0W\0O\0R\0L\0D\0\0\0"}, 60, ) , Data= (384, "ComputerName", Full, 108, ... TitleIdx=0, Type=1, Name="ComputerName", Data="M\0Y\0W\0O\0R\0L\0D\0\0\0"}, 60, ) }, 60, ) == 0x0
 02894   436   NtClose  (384, ... ) == 0x0
 02895   436   NtClose  (368, ... ) == 0x0
 02896   436   NtQueryVirtualMemory  (-1, 0xa30000, Basic, 28, ... {BaseAddress=0xa30000,AllocationBase=0xa30000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 0x0, ) == 0x0
 02897   436   NtOpenKey  (0x20019, {24, 48, 0x40, 0, 0,  (0x20019, {24, 48, 0x40, 0, 0, "Software\Microsoft\Windows NT\CurrentVersion\ProfileList"}, ... 368, ) }, ... 368, ) == 0x0
 02898   436   NtQueryValueKey  (368,  (368, "ProfilesDirectory", Partial, 144, ... TitleIdx=0, Type=2, Data="%\0S\0y\0s\0t\0e\0m\0D\0r\0i\0v\0e\0%\0\\0D\0o\0c\0u\0m\0e\0n\0t\0s\0 \0a\0n\0d\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\0\0"}, 86, ) , Partial, 144, ... TitleIdx=0, Type=2, Data= (368, "ProfilesDirectory", Partial, 144, ... TitleIdx=0, Type=2, Data="%\0S\0y\0s\0t\0e\0m\0D\0r\0i\0v\0e\0%\0\\0D\0o\0c\0u\0m\0e\0n\0t\0s\0 \0a\0n\0d\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\0\0"}, 86, ) }, 86, ) == 0x0
 02899   436   NtClose  (368, ... ) == 0x0
 02900   436   NtOpenKey  (0x20019, {24, 48, 0x40, 0, 0,  (0x20019, {24, 48, 0x40, 0, 0, "Software\Microsoft\Windows NT\CurrentVersion\ProfileList"}, ... 368, ) }, ... 368, ) == 0x0
 02901   436   NtQueryValueKey  (368,  (368, "DefaultUserProfile", Partial, 144, ... TitleIdx=0, Type=1, Data="D\0e\0f\0a\0u\0l\0t\0 \0U\0s\0e\0r\0\0\0"}, 38, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (368, "DefaultUserProfile", Partial, 144, ... TitleIdx=0, Type=1, Data="D\0e\0f\0a\0u\0l\0t\0 \0U\0s\0e\0r\0\0\0"}, 38, ) }, 38, ) == 0x0
 02902   436   NtClose  (368, ... ) == 0x0
 02903   436   NtQueryVirtualMemory  (-1, 0xa30000, Basic, 28, ... {BaseAddress=0xa30000,AllocationBase=0xa30000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 0x0, ) == 0x0
 02904   436   NtOpenKey  (0x20019, {24, 48, 0x40, 0, 0,  (0x20019, {24, 48, 0x40, 0, 0, "Software\Microsoft\Windows\CurrentVersion"}, ... 368, ) }, ... 368, ) == 0x0
 02905   436   NtQueryValueKey  (368,  (368, "ProgramFilesDir", Partial, 144, ... TitleIdx=0, Type=1, Data="C\0:\0\\0P\0r\0o\0g\0r\0a\0m\0 \0F\0i\0l\0e\0s\0\0\0"}, 46, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (368, "ProgramFilesDir", Partial, 144, ... TitleIdx=0, Type=1, Data="C\0:\0\\0P\0r\0o\0g\0r\0a\0m\0 \0F\0i\0l\0e\0s\0\0\0"}, 46, ) }, 46, ) == 0x0
 02906   436   NtQueryVirtualMemory  (-1, 0xa30000, Basic, 28, ... {BaseAddress=0xa30000,AllocationBase=0xa30000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 0x0, ) == 0x0
 02907   436   NtQueryValueKey  (368,  (368, "CommonFilesDir", Partial, 144, ... TitleIdx=0, Type=1, Data="C\0:\0\\0P\0r\0o\0g\0r\0a\0m\0 \0F\0i\0l\0e\0s\0\\0C\0o\0m\0m\0o\0n\0 \0F\0i\0l\0e\0s\0\0\0"}, 72, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (368, "CommonFilesDir", Partial, 144, ... TitleIdx=0, Type=1, Data="C\0:\0\\0P\0r\0o\0g\0r\0a\0m\0 \0F\0i\0l\0e\0s\0\\0C\0o\0m\0m\0o\0n\0 \0F\0i\0l\0e\0s\0\0\0"}, 72, ) }, 72, ) == 0x0
 02908   436   NtQueryVirtualMemory  (-1, 0xa30000, Basic, 28, ... {BaseAddress=0xa30000,AllocationBase=0xa30000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 0x0, ) == 0x0
 02909   436   NtClose  (368, ... ) == 0x0
 02910   436   NtQueryInformationToken  (364, User, 200, ... {token info, class 1, size 36}, 36, ) == 0x0
 02911   436   NtOpenKey  (0x20019, {24, 356, 0x40, 0, 0,  (0x20019, {24, 356, 0x40, 0, 0, "S-1-5-21-1078081533-484763869-839522115-1003"}, ... 368, ) }, ... 368, ) == 0x0
 02912   436   NtOpenThreadToken  (-2, 0x2000c, 1, ... ) == STATUS_NO_TOKEN
 02913   436   NtQueryInformationToken  (364, Type, 4, ... {token info, class 8, size 4}, 4, ) == 0x0
 02914   436   NtDuplicateToken  (364, 0xc, {24, 0, 0x0, 0, 1239544, 0x0}, 0, 2, ... ) == STATUS_ACCESS_DENIED
 02915   436   NtQueryInformationToken  (364, User, 200, ... {token info, class 1, size 36}, 36, ) == 0x0
 02916   436   NtOpenThreadToken  (-2, 0xc, 1, ... ) == STATUS_NO_TOKEN
 02917   436   NtCreateEvent  (0x1f0003, 0x0, 1, 0, ... 384, ) == 0x0
 02918   436   NtOpenThreadToken  (-2, 0xc, 1, ... ) == STATUS_NO_TOKEN
 02919   436   NtSetInformationThread  (-2, ImpersonationToken, {ImpToken=0,}, 4, ... ) == 0x0
 02920   436   NtCreateFile  (0xc0100080, {24, 0, 0x40, 0, 1237748,  (0xc0100080, {24, 0, 0x40, 0, 1237748, "\??\PIPE\lsarpc"}, 0x0, 0, 3, 1, 64, 0, 0, ... 380, {status=0x0, info=1}, ) }, 0x0, 0, 3, 1, 64, 0, 0, ... 380, {status=0x0, info=1}, ) == 0x0
 02921   436   NtSetInformationFile  (380, 1237804, 8, Pipe, ... {status=0x0, info=0}, ) == 0x0
 02922   436   NtSetInformationFile  (380, 1237796, 8, Completion, ... {status=0x0, info=0}, ) == 0x0
 02923   436   NtSetInformationThread  (-2, ImpersonationToken, {ImpToken=0,}, 4, ... ) == 0x0
 02924   436   NtWriteFile  (380, 325, 0, 0,  (380, 325, 0, 0, "\5\0\13\3\20\0\0\0H\0\0\0\1\0\0\0\270\20\270\20\0\0\0\0\1\0\0\0\0\0\1\0xW4\224\22\315\253\357\0\1#Eg\211\253\0\0\0\0\4]\210\212\353\34\311\21\237\350\10\0+\20H`\2\0\0\0", 72, {0, 0}, 0, ... {status=0x0, info=72}, ) , 72, {0, 0}, 0, ... {status=0x0, info=72}, ) == 0x0
 02925   436   NtReadFile  (380, 325, 0, 0, 1024, {0, 0}, 0, ... {status=0x0, info=68},  (380, 325, 0, 0, 1024, {0, 0}, 0, ... {status=0x0, info=68}, "\5\0\14\3\20\0\0\0D\0\0\0\1\0\0\0\270\20\270\20\355\36\0\0\14\0\PIPE\lsass\0\0\0\1\0\0\0\0\0\0\0\4]\210\212\353\34\311\21\237\350\10\0+\20H`\2\0\0\0", ) , ) == 0x0
 02926   436   NtFsControlFile  (380, 325, 0x0, 0x0, 0x11c017,  (380, 325, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0@\0\0\0\1\0\0\0(\0\0\0\0\0,\0\0\0\0\0\30\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\250\351\22\0\14\0\0\0\2\0\1\0\0\10\0\0", 64, 1024, ... {status=0x103, info=68}, "\5\0\14\3\20\0\0\0D\0\0\0\1\0\0\0\270\20\270\20\355\36\0\0\14\0\PIPE\lsass\0\0\0\1\0\0\0\0\0\0\0\4]\210\212\353\34\311\21\237\350\10\0+\20H`\2\0\0\0", ) , 64, 1024, ... {status=0x103, info=68},  (380, 325, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0@\0\0\0\1\0\0\0(\0\0\0\0\0,\0\0\0\0\0\30\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\250\351\22\0\14\0\0\0\2\0\1\0\0\10\0\0", 64, 1024, ... {status=0x103, info=68}, "\5\0\14\3\20\0\0\0D\0\0\0\1\0\0\0\270\20\270\20\355\36\0\0\14\0\PIPE\lsass\0\0\0\1\0\0\0\0\0\0\0\4]\210\212\353\34\311\21\237\350\10\0+\20H`\2\0\0\0", ) , ) == 0x103
 02927   436   NtFsControlFile  (380, 325, 0x0, 0x0, 0x11c017,  (380, 325, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0t\0\0\0\2\0\0\0\\0\0\0\0\09\0\0\0\0\0\237\350\250\331*,\334\21\261\306\0\14)\371\246\305\1\0\0\0\340\351\22\0\1\0\0\0x\264\25\0\5\0\0\0\1\5\0\0\0\0\0\5\25\0\0\0\3757B@\335\350\344\34C\27\122\353\3\0\0\0\0\0\0\0\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0", 116, 1024, ... {status=0x103, info=48}, "\5\0\2\3\20\0\0\00\0\0\0\1\0\0\0\30\0\0\0\0\0\0\0\0\0\0\0\237\350\250\331*,\334\21\261\306\0\14)\371\246\305\0\0\0\0", ) , 116, 1024, ... {status=0x103, info=48},  (380, 325, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0t\0\0\0\2\0\0\0\\0\0\0\0\09\0\0\0\0\0\237\350\250\331*,\334\21\261\306\0\14)\371\246\305\1\0\0\0\340\351\22\0\1\0\0\0x\264\25\0\5\0\0\0\1\5\0\0\0\0\0\5\25\0\0\0\3757B@\335\350\344\34C\27\122\353\3\0\0\0\0\0\0\0\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0", 116, 1024, ... {status=0x103, info=48}, "\5\0\2\3\20\0\0\00\0\0\0\1\0\0\0\30\0\0\0\0\0\0\0\0\0\0\0\237\350\250\331*,\334\21\261\306\0\14)\371\246\305\0\0\0\0", ) , ) == 0x103
 02928   436   NtFsControlFile  (380, 325, 0x0, 0x0, 0x11c017,  (380, 325, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0,\0\0\0\3\0\0\0\24\0\0\0\0\0\0\0\0\0\0\0\237\350\250\331*,\334\21\261\306\0\14)\371\246\305", 44, 1024, ... {status=0x103, info=180}, "\5\0\2\3\20\0\0\0\264\0\0\0\2\0\0\0\234\0\0\0\0\0\0\0 \242\25\0\1\0\0\0,\242\25\0 \0\0\0\1\0\0\0\16\0\20\08\242\25\0H\242\25\0\10\0\0\0\0\0\0\0\7\0\0\0M\0Y\0W\0O\0R\0L\0D\0O\0\4\0\0\0\1\4\0\0\0\0\0\5\25\0\0\0\3757B@\335\350\344\34C\27\122\1\0\0\0\310\266\25\0\1\0\0\0\1\0\0\0\20\0\22\0\334\266\25\0\0\0\0\0\0\0\0\0\11\0\0\0\0\0\0\0\10\0\0\0S\0R\0I\0-\0u\0s\0e\0r\0\1\0\0\0\0\0\0\0", ) , 44, 1024, ... {status=0x103, info=180},  (380, 325, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0,\0\0\0\3\0\0\0\24\0\0\0\0\0\0\0\0\0\0\0\237\350\250\331*,\334\21\261\306\0\14)\371\246\305", 44, 1024, ... {status=0x103, info=180}, "\5\0\2\3\20\0\0\0\264\0\0\0\2\0\0\0\234\0\0\0\0\0\0\0 \242\25\0\1\0\0\0,\242\25\0 \0\0\0\1\0\0\0\16\0\20\08\242\25\0H\242\25\0\10\0\0\0\0\0\0\0\7\0\0\0M\0Y\0W\0O\0R\0L\0D\0O\0\4\0\0\0\1\4\0\0\0\0\0\5\25\0\0\0\3757B@\335\350\344\34C\27\122\1\0\0\0\310\266\25\0\1\0\0\0\1\0\0\0\20\0\22\0\334\266\25\0\0\0\0\0\0\0\0\0\11\0\0\0\0\0\0\0\10\0\0\0S\0R\0I\0-\0u\0s\0e\0r\0\1\0\0\0\0\0\0\0", ) , ) == 0x103
 02929   436   NtClose  (384, ... ) == 0x0
 02930   436   NtClose  (380, ... ) == 0x0
 02931   436   NtOpenThreadToken  (-2, 0xc, 1, ... ) == STATUS_NO_TOKEN
 02932   436   NtCreateEvent  (0x1f0003, 0x0, 1, 0, ... 380, ) == 0x0
 02933   436   NtOpenThreadToken  (-2, 0xc, 1, ... ) == STATUS_NO_TOKEN
 02934   436   NtSetInformationThread  (-2, ImpersonationToken, {ImpToken=0,}, 4, ... ) == 0x0
 02935   436   NtCreateFile  (0xc0100080, {24, 0, 0x40, 0, 1237744,  (0xc0100080, {24, 0, 0x40, 0, 1237744, "\??\PIPE\lsarpc"}, 0x0, 0, 3, 1, 64, 0, 0, ... 384, {status=0x0, info=1}, ) }, 0x0, 0, 3, 1, 64, 0, 0, ... 384, {status=0x0, info=1}, ) == 0x0
 02936   436   NtSetInformationFile  (384, 1237800, 8, Pipe, ... {status=0x0, info=0}, ) == 0x0
 02937   436   NtSetInformationFile  (384, 1237792, 8, Completion, ... {status=0x0, info=0}, ) == 0x0
 02938   436   NtSetInformationThread  (-2, ImpersonationToken, {ImpToken=0,}, 4, ... ) == 0x0
 02939   436   NtWriteFile  (384, 325, 0, 0,  (384, 325, 0, 0, "\5\0\13\3\20\0\0\0H\0\0\0\1\0\0\0\270\20\270\20\0\0\0\0\1\0\0\0\0\0\1\0xW4\224\22\315\253\357\0\1#Eg\211\253\0\0\0\0\4]\210\212\353\34\311\21\237\350\10\0+\20H`\2\0\0\0", 72, {0, 0}, 0, ... {status=0x0, info=72}, ) , 72, {0, 0}, 0, ... {status=0x0, info=72}, ) == 0x0
 02940   436   NtReadFile  (384, 325, 0, 0, 1024, {0, 0}, 0, ... {status=0x0, info=68},  (384, 325, 0, 0, 1024, {0, 0}, 0, ... {status=0x0, info=68}, "\5\0\14\3\20\0\0\0D\0\0\0\1\0\0\0\270\20\270\20\356\36\0\0\14\0\PIPE\lsass\0\0\0\1\0\0\0\0\0\0\0\4]\210\212\353\34\311\21\237\350\10\0+\20H`\2\0\0\0", ) , ) == 0x0
 02941   436   NtFsControlFile  (384, 325, 0x0, 0x0, 0x11c017,  (384, 325, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0@\0\0\0\1\0\0\0(\0\0\0\0\0,\0\0\0\0\0\30\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\244\351\22\0\14\0\0\0\2\0\1\0\0\10\0\0", 64, 1024, ... {status=0x103, info=68}, "\5\0\14\3\20\0\0\0D\0\0\0\1\0\0\0\270\20\270\20\356\36\0\0\14\0\PIPE\lsass\0\0\0\1\0\0\0\0\0\0\0\4]\210\212\353\34\311\21\237\350\10\0+\20H`\2\0\0\0", ) , 64, 1024, ... {status=0x103, info=68},  (384, 325, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0@\0\0\0\1\0\0\0(\0\0\0\0\0,\0\0\0\0\0\30\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\244\351\22\0\14\0\0\0\2\0\1\0\0\10\0\0", 64, 1024, ... {status=0x103, info=68}, "\5\0\14\3\20\0\0\0D\0\0\0\1\0\0\0\270\20\270\20\356\36\0\0\14\0\PIPE\lsass\0\0\0\1\0\0\0\0\0\0\0\4]\210\212\353\34\311\21\237\350\10\0+\20H`\2\0\0\0", ) , ) == 0x103
 02942   436   NtFsControlFile  (384, 325, 0x0, 0x0, 0x11c017,  (384, 325, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0t\0\0\0\2\0\0\0\\0\0\0\0\09\0\0\0\0\0\240\350\250\331*,\334\21\261\306\0\14)\371\246\305\1\0\0\0\334\351\22\0\1\0\0\0x\264\25\0\5\0\0\0\1\5\0\0\0\0\0\5\25\0\0\0\3757B@\335\350\344\34C\27\122\353\3\0\0\0\0\0\0\0\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0", 116, 1024, ... {status=0x103, info=48}, "\5\0\2\3\20\0\0\00\0\0\0\1\0\0\0\30\0\0\0\0\0\0\0\0\0\0\0\240\350\250\331*,\334\21\261\306\0\14)\371\246\305\0\0\0\0", ) , 116, 1024, ... {status=0x103, info=48},  (384, 325, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0t\0\0\0\2\0\0\0\\0\0\0\0\09\0\0\0\0\0\240\350\250\331*,\334\21\261\306\0\14)\371\246\305\1\0\0\0\334\351\22\0\1\0\0\0x\264\25\0\5\0\0\0\1\5\0\0\0\0\0\5\25\0\0\0\3757B@\335\350\344\34C\27\122\353\3\0\0\0\0\0\0\0\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0", 116, 1024, ... {status=0x103, info=48}, "\5\0\2\3\20\0\0\00\0\0\0\1\0\0\0\30\0\0\0\0\0\0\0\0\0\0\0\240\350\250\331*,\334\21\261\306\0\14)\371\246\305\0\0\0\0", ) , ) == 0x103
 02943   436   NtFsControlFile  (384, 325, 0x0, 0x0, 0x11c017,  (384, 325, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0,\0\0\0\3\0\0\0\24\0\0\0\0\0\0\0\0\0\0\0\240\350\250\331*,\334\21\261\306\0\14)\371\246\305", 44, 1024, ... {status=0x103, info=180}, "\5\0\2\3\20\0\0\0\264\0\0\0\2\0\0\0\234\0\0\0\0\0\0\0 \242\25\0\1\0\0\0,\242\25\0 \0\0\0\1\0\0\0\16\0\20\08\242\25\0H\242\25\0\10\0\0\0\0\0\0\0\7\0\0\0M\0Y\0W\0O\0R\0L\0D\0O\0\4\0\0\0\1\4\0\0\0\0\0\5\25\0\0\0\3757B@\335\350\344\34C\27\122\1\0\0\0\310\266\25\0\1\0\0\0\1\0\0\0\20\0\22\0\334\266\25\0\0\0\0\0\0\0\0\0\11\0\0\0\0\0\0\0\10\0\0\0S\0R\0I\0-\0u\0s\0e\0r\0\1\0\0\0\0\0\0\0", ) , 44, 1024, ... {status=0x103, info=180},  (384, 325, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0,\0\0\0\3\0\0\0\24\0\0\0\0\0\0\0\0\0\0\0\240\350\250\331*,\334\21\261\306\0\14)\371\246\305", 44, 1024, ... {status=0x103, info=180}, "\5\0\2\3\20\0\0\0\264\0\0\0\2\0\0\0\234\0\0\0\0\0\0\0 \242\25\0\1\0\0\0,\242\25\0 \0\0\0\1\0\0\0\16\0\20\08\242\25\0H\242\25\0\10\0\0\0\0\0\0\0\7\0\0\0M\0Y\0W\0O\0R\0L\0D\0O\0\4\0\0\0\1\4\0\0\0\0\0\5\25\0\0\0\3757B@\335\350\344\34C\27\122\1\0\0\0\310\266\25\0\1\0\0\0\1\0\0\0\20\0\22\0\334\266\25\0\0\0\0\0\0\0\0\0\11\0\0\0\0\0\0\0\10\0\0\0S\0R\0I\0-\0u\0s\0e\0r\0\1\0\0\0\0\0\0\0", ) , ) == 0x103
 02944   436   NtClose  (380, ... ) == 0x0
 02945   436   NtClose  (384, ... ) == 0x0
 02946   436   NtQueryVirtualMemory  (-1, 0xa30000, Basic, 28, ... {BaseAddress=0xa30000,AllocationBase=0xa30000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 0x0, ) == 0x0
 02947   436   NtQueryVirtualMemory  (-1, 0xa30000, Basic, 28, ... {BaseAddress=0xa30000,AllocationBase=0xa30000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 0x0, ) == 0x0
 02948   436   NtQueryInformationToken  (364, User, 200, ... {token info, class 1, size 36}, 36, ) == 0x0
 02949   436   NtOpenKey  (0x20019, {24, 48, 0x40, 0, 0,  (0x20019, {24, 48, 0x40, 0, 0, "Software\Microsoft\Windows NT\CurrentVersion\ProfileList\S-1-5-21-1078081533-484763869-839522115-1003"}, ... 384, ) }, ... 384, ) == 0x0
 02950   436   NtQueryValueKey  (384,  (384, "ProfileImagePath", Partial, 144, ... TitleIdx=0, Type=2, Data="%\0S\0y\0s\0t\0e\0m\0D\0r\0i\0v\0e\0%\0\\0D\0o\0c\0u\0m\0e\0n\0t\0s\0 \0a\0n\0d\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0S\0R\0I\0-\0u\0s\0e\0r\0\0\0"}, 104, ) , Partial, 144, ... TitleIdx=0, Type=2, Data= (384, "ProfileImagePath", Partial, 144, ... TitleIdx=0, Type=2, Data="%\0S\0y\0s\0t\0e\0m\0D\0r\0i\0v\0e\0%\0\\0D\0o\0c\0u\0m\0e\0n\0t\0s\0 \0a\0n\0d\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0S\0R\0I\0-\0u\0s\0e\0r\0\0\0"}, 104, ) }, 104, ) == 0x0
 02951   436   NtClose  (384, ... ) == 0x0
 02952   436   NtCreateKey  (0x2001f, {24, 368, 0x40, 0, 0,  (0x2001f, {24, 368, 0x40, 0, 0, "Software\Microsoft\Windows NT\CurrentVersion\Winlogon"}, 0, 0x0, 0, ... 384, 2, ) }, 0, 0x0, 0, ... 384, 2, ) == 0x0
 02953   436   NtQueryValueKey  (384,  (384, "ParseAutoexec", Partial, 144, ... TitleIdx=0, Type=1, Data="1\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (384, "ParseAutoexec", Partial, 144, ... TitleIdx=0, Type=1, Data="1\0\0\0"}, 16, ) }, 16, ) == 0x0
 02954   436   NtClose  (384, ... ) == 0x0
 02955   436   NtQueryInformationProcess  (-1, DefaultHardErrorMode, 4, ... {process info, class 12, size 4}, 0x0, ) == 0x0
 02956   436   NtSetInformationProcess  (-1, DefaultHardErrorMode, {process info, class 12, size 4}, 4, ... ) == 0x0
 02957   436   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\c:\autoexec.bat"}, 1239448, ... ) }, 1239448, ... ) == 0x0
 02958   436   NtCreateFile  (0x80100080, {24, 0, 0x40, 0, 1239456,  (0x80100080, {24, 0, 0x40, 0, 1239456, "\??\c:\autoexec.bat"}, 0x0, 128, 1, 1, 96, 0, 0, ... 384, {status=0x0, info=1}, ) }, 0x0, 128, 1, 1, 96, 0, 0, ... 384, {status=0x0, info=1}, ) == 0x0
 02959   436   NtQueryInformationProcess  (-1, DefaultHardErrorMode, 4, ... {process info, class 12, size 4}, 0x0, ) == 0x0
 02960   436   NtSetInformationProcess  (-1, DefaultHardErrorMode, {process info, class 12, size 4}, 4, ... ) == 0x0
 02961   436   NtQueryInformationFile  (384, 1239472, 24, Standard, ... {status=0x0, info=24}, ) == 0x0
 02962   436   NtReadFile  (384, 0, 0, 0, 0, 0x0, 0, ... {status=0x0, info=0}, "", ) == 0x0
 02963   436   NtClose  (384, ... ) == 0x0
 02964   436   NtOpenKey  (0x20019, {24, 368, 0x40, 0, 0,  (0x20019, {24, 368, 0x40, 0, 0, "Environment"}, ... 384, ) }, ... 384, ) == 0x0
 02965   436   NtEnumerateValueKey  (384, 0, Full, 220, ... TitleIdx=0, Type=2, Name= (384, 0, Full, 220, ... TitleIdx=0, Type=2, Name="TEMP", Data="%\0U\0S\0E\0R\0P\0R\0O\0F\0I\0L\0E\0%\0\\0L\0o\0c\0a\0l\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0T\0e\0m\0p\0\0\0"}, 96, ) , Data= (384, 0, Full, 220, ... TitleIdx=0, Type=2, Name="TEMP", Data="%\0U\0S\0E\0R\0P\0R\0O\0F\0I\0L\0E\0%\0\\0L\0o\0c\0a\0l\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0T\0e\0m\0p\0\0\0"}, 96, ) }, 96, ) == 0x0
 02966   436   NtEnumerateValueKey  (384, 1, Full, 220, ... TitleIdx=0, Type=2, Name= (384, 1, Full, 220, ... TitleIdx=0, Type=2, Name="TMP", Data="%\0U\0S\0E\0R\0P\0R\0O\0F\0I\0L\0E\0%\0\\0L\0o\0c\0a\0l\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0T\0e\0m\0p\0\0\0"}, 96, ) , Data= (384, 1, Full, 220, ... TitleIdx=0, Type=2, Name="TMP", Data="%\0U\0S\0E\0R\0P\0R\0O\0F\0I\0L\0E\0%\0\\0L\0o\0c\0a\0l\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0T\0e\0m\0p\0\0\0"}, 96, ) }, 96, ) == 0x0
 02967   436   NtEnumerateValueKey  (384, 2, Full, 220, ... ) == STATUS_NO_MORE_ENTRIES
 02968   436   NtEnumerateValueKey  (384, 0, Full, 220, ... TitleIdx=0, Type=2, Name= (384, 0, Full, 220, ... TitleIdx=0, Type=2, Name="TEMP", Data="%\0U\0S\0E\0R\0P\0R\0O\0F\0I\0L\0E\0%\0\\0L\0o\0c\0a\0l\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0T\0e\0m\0p\0\0\0"}, 96, ) , Data= (384, 0, Full, 220, ... TitleIdx=0, Type=2, Name="TEMP", Data="%\0U\0S\0E\0R\0P\0R\0O\0F\0I\0L\0E\0%\0\\0L\0o\0c\0a\0l\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0T\0e\0m\0p\0\0\0"}, 96, ) }, 96, ) == 0x0
 02969   436   NtQueryInformationProcess  (-1, DefaultHardErrorMode, 4, ... {process info, class 12, size 4}, 0x0, ) == 0x0
 02970   436   NtSetInformationProcess  (-1, DefaultHardErrorMode, {process info, class 12, size 4}, 4, ... ) == 0x0
 02971   436   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\Documents and Settings\SRI-user\Local Settings\Temp"}, 1238188, ... ) }, 1238188, ... ) == 0x0
 02972   436   NtOpenFile  (0x100001, {24, 0, 0x40, 0, 0,  (0x100001, {24, 0, 0x40, 0, 0, "\??\C:\"}, 3, 16417, ... 380, {status=0x0, info=1}, ) }, 3, 16417, ... 380, {status=0x0, info=1}, ) == 0x0
 02973   436   NtQueryDirectoryFile  (380, 0, 0, 0, 1237548, 616, BothDirectory, 1,  (380, 0, 0, 0, 1237548, 616, BothDirectory, 1, "Documents and Settings", 0, ... {status=0x0, info=138}, ) , 0, ... {status=0x0, info=138}, ) == 0x0
 02974   436   NtClose  (380, ... ) == 0x0
 02975   436   NtOpenFile  (0x100001, {24, 0, 0x40, 0, 0,  (0x100001, {24, 0, 0x40, 0, 0, "\??\C:\Documents and Settings\SRI-user\"}, 3, 16417, ... 380, {status=0x0, info=1}, ) }, 3, 16417, ... 380, {status=0x0, info=1}, ) == 0x0
 02976   436   NtQueryDirectoryFile  (380, 0, 0, 0, 1237548, 616, BothDirectory, 1,  (380, 0, 0, 0, 1237548, 616, BothDirectory, 1, "Local Settings", 0, ... {status=0x0, info=122}, ) , 0, ... {status=0x0, info=122}, ) == 0x0
 02977   436   NtClose  (380, ... ) == 0x0
 02978   436   NtQueryInformationProcess  (-1, DefaultHardErrorMode, 4, ... {process info, class 12, size 4}, 0x0, ) == 0x0
 02979   436   NtSetInformationProcess  (-1, DefaultHardErrorMode, {process info, class 12, size 4}, 4, ... ) == 0x0
 02980   436   NtQueryVirtualMemory  (-1, 0xa30000, Basic, 28, ... {BaseAddress=0xa30000,AllocationBase=0xa30000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 0x0, ) == 0x0
 02981   436   NtEnumerateValueKey  (384, 1, Full, 220, ... TitleIdx=0, Type=2, Name= (384, 1, Full, 220, ... TitleIdx=0, Type=2, Name="TMP", Data="%\0U\0S\0E\0R\0P\0R\0O\0F\0I\0L\0E\0%\0\\0L\0o\0c\0a\0l\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0T\0e\0m\0p\0\0\0"}, 96, ) , Data= (384, 1, Full, 220, ... TitleIdx=0, Type=2, Name="TMP", Data="%\0U\0S\0E\0R\0P\0R\0O\0F\0I\0L\0E\0%\0\\0L\0o\0c\0a\0l\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0T\0e\0m\0p\0\0\0"}, 96, ) }, 96, ) == 0x0
 02982   436   NtQueryInformationProcess  (-1, DefaultHardErrorMode, 4, ... {process info, class 12, size 4}, 0x0, ) == 0x0
 02983   436   NtSetInformationProcess  (-1, DefaultHardErrorMode, {process info, class 12, size 4}, 4, ... ) == 0x0
 02984   436   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\Documents and Settings\SRI-user\Local Settings\Temp"}, 1238188, ... ) }, 1238188, ... ) == 0x0
 02985   436   NtOpenFile  (0x100001, {24, 0, 0x40, 0, 0,  (0x100001, {24, 0, 0x40, 0, 0, "\??\C:\"}, 3, 16417, ... 380, {status=0x0, info=1}, ) }, 3, 16417, ... 380, {status=0x0, info=1}, ) == 0x0
 02986   436   NtQueryDirectoryFile  (380, 0, 0, 0, 1237548, 616, BothDirectory, 1,  (380, 0, 0, 0, 1237548, 616, BothDirectory, 1, "Documents and Settings", 0, ... {status=0x0, info=138}, ) , 0, ... {status=0x0, info=138}, ) == 0x0
 02987   436   NtClose  (380, ... ) == 0x0
 02988   436   NtOpenFile  (0x100001, {24, 0, 0x40, 0, 0,  (0x100001, {24, 0, 0x40, 0, 0, "\??\C:\Documents and Settings\SRI-user\"}, 3, 16417, ... 380, {status=0x0, info=1}, ) }, 3, 16417, ... 380, {status=0x0, info=1}, ) == 0x0
 02989   436   NtQueryDirectoryFile  (380, 0, 0, 0, 1237548, 616, BothDirectory, 1,  (380, 0, 0, 0, 1237548, 616, BothDirectory, 1, "Local Settings", 0, ... {status=0x0, info=122}, ) , 0, ... {status=0x0, info=122}, ) == 0x0
 02990   436   NtClose  (380, ... ) == 0x0
 02991   436   NtQueryInformationProcess  (-1, DefaultHardErrorMode, 4, ... {process info, class 12, size 4}, 0x0, ) == 0x0
 02992   436   NtSetInformationProcess  (-1, DefaultHardErrorMode, {process info, class 12, size 4}, 4, ... ) == 0x0
 02993   436   NtQueryVirtualMemory  (-1, 0xa30000, Basic, 28, ... {BaseAddress=0xa30000,AllocationBase=0xa30000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 0x0, ) == 0x0
 02994   436   NtEnumerateValueKey  (384, 2, Full, 220, ... ) == STATUS_NO_MORE_ENTRIES
 02995   436   NtClose  (384, ... ) == 0x0
 02996   436   NtOpenKey  (0x20019, {24, 368, 0x40, 0, 0,  (0x20019, {24, 368, 0x40, 0, 0, "Volatile Environment"}, ... 384, ) }, ... 384, ) == 0x0
 02997   436   NtEnumerateValueKey  (384, 0, Full, 220, ... TitleIdx=0, Type=1, Name= (384, 0, Full, 220, ... TitleIdx=0, Type=1, Name="LOGONSERVER", Data="\\0\\0M\0Y\0W\0O\0R\0L\0D\0\0\0"}, 64, ) , Data= (384, 0, Full, 220, ... TitleIdx=0, Type=1, Name="LOGONSERVER", Data="\\0\\0M\0Y\0W\0O\0R\0L\0D\0\0\0"}, 64, ) }, 64, ) == 0x0
 02998   436   NtQueryVirtualMemory  (-1, 0xa30000, Basic, 28, ... {BaseAddress=0xa30000,AllocationBase=0xa30000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 0x0, ) == 0x0
 02999   436   NtEnumerateValueKey  (384, 1, Full, 220, ... TitleIdx=0, Type=1, Name= (384, 1, Full, 220, ... TitleIdx=0, Type=1, Name="HOMEDRIVE", Data="C\0:\0\0\0"}, 46, ) , Data= (384, 1, Full, 220, ... TitleIdx=0, Type=1, Name="HOMEDRIVE", Data="C\0:\0\0\0"}, 46, ) }, 46, ) == 0x0
 03000   436   NtQueryVirtualMemory  (-1, 0xa30000, Basic, 28, ... {BaseAddress=0xa30000,AllocationBase=0xa30000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 0x0, ) == 0x0
 03001   436   NtEnumerateValueKey  (384, 2, Full, 220, ... TitleIdx=0, Type=1, Name= (384, 2, Full, 220, ... TitleIdx=0, Type=1, Name="HOMEPATH", Data="\\0D\0o\0c\0u\0m\0e\0n\0t\0s\0 \0a\0n\0d\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0S\0R\0I\0-\0u\0s\0e\0r\0\0\0"}, 102, ) , Data= (384, 2, Full, 220, ... TitleIdx=0, Type=1, Name="HOMEPATH", Data="\\0D\0o\0c\0u\0m\0e\0n\0t\0s\0 \0a\0n\0d\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0S\0R\0I\0-\0u\0s\0e\0r\0\0\0"}, 102, ) }, 102, ) == 0x0
 03002   436   NtQueryVirtualMemory  (-1, 0xa30000, Basic, 28, ... {BaseAddress=0xa30000,AllocationBase=0xa30000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 0x0, ) == 0x0
 03003   436   NtEnumerateValueKey  (384, 3, Full, 220, ... TitleIdx=0, Type=1, Name= (384, 3, Full, 220, ... TitleIdx=0, Type=1, Name="CLIENTNAME", Data="C\0o\0n\0s\0o\0l\0e\0\0\0"}, 56, ) , Data= (384, 3, Full, 220, ... TitleIdx=0, Type=1, Name="CLIENTNAME", Data="C\0o\0n\0s\0o\0l\0e\0\0\0"}, 56, ) }, 56, ) == 0x0
 03004   436   NtQueryVirtualMemory  (-1, 0xa30000, Basic, 28, ... {BaseAddress=0xa30000,AllocationBase=0xa30000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 0x0, ) == 0x0
 03005   436   NtEnumerateValueKey  (384, 4, Full, 220, ... TitleIdx=0, Type=1, Name= (384, 4, Full, 220, ... TitleIdx=0, Type=1, Name="SESSIONNAME", Data="C\0o\0n\0s\0o\0l\0e\0\0\0"}, 60, ) , Data= (384, 4, Full, 220, ... TitleIdx=0, Type=1, Name="SESSIONNAME", Data="C\0o\0n\0s\0o\0l\0e\0\0\0"}, 60, ) }, 60, ) == 0x0
 03006   436   NtQueryVirtualMemory  (-1, 0xa30000, Basic, 28, ... {BaseAddress=0xa30000,AllocationBase=0xa30000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 0x0, ) == 0x0
 03007   436   NtEnumerateValueKey  (384, 5, Full, 220, ... TitleIdx=0, Type=1, Name= (384, 5, Full, 220, ... TitleIdx=0, Type=1, Name="APPDATA", Data="C\0:\0\\0D\0o\0c\0u\0m\0e\0n\0t\0s\0 \0a\0n\0d\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0S\0R\0I\0-\0u\0s\0e\0r\0\\0A\0p\0p\0l\0i\0c\0a\0t\0i\0o\0n\0 \0D\0a\0t\0a\0\0\0"}, 140, ) , Data= (384, 5, Full, 220, ... TitleIdx=0, Type=1, Name="APPDATA", Data="C\0:\0\\0D\0o\0c\0u\0m\0e\0n\0t\0s\0 \0a\0n\0d\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0S\0R\0I\0-\0u\0s\0e\0r\0\\0A\0p\0p\0l\0i\0c\0a\0t\0i\0o\0n\0 \0D\0a\0t\0a\0\0\0"}, 140, ) }, 140, ) == 0x0
 03008   436   NtQueryVirtualMemory  (-1, 0xa30000, Basic, 28, ... {BaseAddress=0xa30000,AllocationBase=0xa30000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 0x0, ) == 0x0
 03009   436   NtEnumerateValueKey  (384, 6, Full, 220, ... TitleIdx=0, Type=1, Name= (384, 6, Full, 220, ... TitleIdx=0, Type=1, Name="HOMESHARE", Data="\0\0"}, 42, ) , Data= (384, 6, Full, 220, ... TitleIdx=0, Type=1, Name="HOMESHARE", Data="\0\0"}, 42, ) }, 42, ) == 0x0
 03010   436   NtEnumerateValueKey  (384, 7, Full, 220, ... ) == STATUS_NO_MORE_ENTRIES
 03011   436   NtEnumerateValueKey  (384, 0, Full, 220, ... TitleIdx=0, Type=1, Name= (384, 0, Full, 220, ... TitleIdx=0, Type=1, Name="LOGONSERVER", Data="\\0\\0M\0Y\0W\0O\0R\0L\0D\0\0\0"}, 64, ) , Data= (384, 0, Full, 220, ... TitleIdx=0, Type=1, Name="LOGONSERVER", Data="\\0\\0M\0Y\0W\0O\0R\0L\0D\0\0\0"}, 64, ) }, 64, ) == 0x0
 03012   436   NtEnumerateValueKey  (384, 1, Full, 220, ... TitleIdx=0, Type=1, Name= (384, 1, Full, 220, ... TitleIdx=0, Type=1, Name="HOMEDRIVE", Data="C\0:\0\0\0"}, 46, ) , Data= (384, 1, Full, 220, ... TitleIdx=0, Type=1, Name="HOMEDRIVE", Data="C\0:\0\0\0"}, 46, ) }, 46, ) == 0x0
 03013   436   NtEnumerateValueKey  (384, 2, Full, 220, ... TitleIdx=0, Type=1, Name= (384, 2, Full, 220, ... TitleIdx=0, Type=1, Name="HOMEPATH", Data="\\0D\0o\0c\0u\0m\0e\0n\0t\0s\0 \0a\0n\0d\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0S\0R\0I\0-\0u\0s\0e\0r\0\0\0"}, 102, ) , Data= (384, 2, Full, 220, ... TitleIdx=0, Type=1, Name="HOMEPATH", Data="\\0D\0o\0c\0u\0m\0e\0n\0t\0s\0 \0a\0n\0d\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0S\0R\0I\0-\0u\0s\0e\0r\0\0\0"}, 102, ) }, 102, ) == 0x0
 03014   436   NtEnumerateValueKey  (384, 3, Full, 220, ... TitleIdx=0, Type=1, Name= (384, 3, Full, 220, ... TitleIdx=0, Type=1, Name="CLIENTNAME", Data="C\0o\0n\0s\0o\0l\0e\0\0\0"}, 56, ) , Data= (384, 3, Full, 220, ... TitleIdx=0, Type=1, Name="CLIENTNAME", Data="C\0o\0n\0s\0o\0l\0e\0\0\0"}, 56, ) }, 56, ) == 0x0
 03015   436   NtEnumerateValueKey  (384, 4, Full, 220, ... TitleIdx=0, Type=1, Name= (384, 4, Full, 220, ... TitleIdx=0, Type=1, Name="SESSIONNAME", Data="C\0o\0n\0s\0o\0l\0e\0\0\0"}, 60, ) , Data= (384, 4, Full, 220, ... TitleIdx=0, Type=1, Name="SESSIONNAME", Data="C\0o\0n\0s\0o\0l\0e\0\0\0"}, 60, ) }, 60, ) == 0x0
 03016   436   NtEnumerateValueKey  (384, 5, Full, 220, ... TitleIdx=0, Type=1, Name= (384, 5, Full, 220, ... TitleIdx=0, Type=1, Name="APPDATA", Data="C\0:\0\\0D\0o\0c\0u\0m\0e\0n\0t\0s\0 \0a\0n\0d\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0S\0R\0I\0-\0u\0s\0e\0r\0\\0A\0p\0p\0l\0i\0c\0a\0t\0i\0o\0n\0 \0D\0a\0t\0a\0\0\0"}, 140, ) , Data= (384, 5, Full, 220, ... TitleIdx=0, Type=1, Name="APPDATA", Data="C\0:\0\\0D\0o\0c\0u\0m\0e\0n\0t\0s\0 \0a\0n\0d\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0S\0R\0I\0-\0u\0s\0e\0r\0\\0A\0p\0p\0l\0i\0c\0a\0t\0i\0o\0n\0 \0D\0a\0t\0a\0\0\0"}, 140, ) }, 140, ) == 0x0
 03017   436   NtEnumerateValueKey  (384, 6, Full, 220, ... TitleIdx=0, Type=1, Name= (384, 6, Full, 220, ... TitleIdx=0, Type=1, Name="HOMESHARE", Data="\0\0"}, 42, ) , Data= (384, 6, Full, 220, ... TitleIdx=0, Type=1, Name="HOMESHARE", Data="\0\0"}, 42, ) }, 42, ) == 0x0
 03018   436   NtEnumerateValueKey  (384, 7, Full, 220, ... ) == STATUS_NO_MORE_ENTRIES
 03019   436   NtClose  (384, ... ) == 0x0
 03020   436   NtClose  (368, ... ) == 0x0
 03021   436   NtFreeVirtualMemory  (-1, (0xa30000), 0, 32768, ... (0xa30000), 4096, ) == 0x0
 03022   436   NtClose  (376, ... ) == 0x0
 03023   436   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\Documents and Settings\SRI-user\Application Data"}, 1240112, ... ) }, 1240112, ... ) == 0x0
 03024   436   NtQueryInformationToken  (364, User, 64, ... {token info, class 1, size 36}, 36, ) == 0x0
 03025   436   NtOpenKey  (0x2001f, {24, 356, 0x40, 0, 0,  (0x2001f, {24, 356, 0x40, 0, 0, "S-1-5-21-1078081533-484763869-839522115-1003"}, ... 376, ) }, ... 376, ) == 0x0
 03026   436   NtCreateKey  (0x2000000, {24, 376, 0x40, 0, 0,  (0x2000000, {24, 376, 0x40, 0, 0, "Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders"}, 0, 0x0, 0, ... 368, 2, ) }, 0, 0x0, 0, ... 368, 2, ) == 0x0
 03027   436   NtClose  (376, ... ) == 0x0
 03028   436   NtSetValueKey  (368,  (368, "AppData", 0, 1, "C\0:\0\\0D\0o\0c\0u\0m\0e\0n\0t\0s\0 \0a\0n\0d\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0S\0R\0I\0-\0u\0s\0e\0r\0\\0A\0p\0p\0l\0i\0c\0a\0t\0i\0o\0n\0 \0D\0a\0t\0a\0\0\0", 104, ... ) , 0, 1,  (368, "AppData", 0, 1, "C\0:\0\\0D\0o\0c\0u\0m\0e\0n\0t\0s\0 \0a\0n\0d\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0S\0R\0I\0-\0u\0s\0e\0r\0\\0A\0p\0p\0l\0i\0c\0a\0t\0i\0o\0n\0 \0D\0a\0t\0a\0\0\0", 104, ... ) , 104, ... ) == 0x0
 03029   436   NtClose  (368, ... ) == 0x0
 03030   436   NtClose  (364, ... ) == 0x0
 03031   436   NtOpenFile  (0x100001, {24, 0, 0x40, 0, 0,  (0x100001, {24, 0, 0x40, 0, 0, "\??\C:\Documents and Settings\SRI-user\Application Data\Microsoft\Network\Connections\Pbk\"}, 3, 16417, ... ) }, 3, 16417, ... ) == STATUS_OBJECT_PATH_NOT_FOUND
 03032   436   NtCreateKey  (0x2, {24, 360, 0x40, 0, 0,  (0x2, {24, 360, 0x40, 0, 0, "Software\Microsoft\windows\CurrentVersion\Internet Settings"}, 0, "", 0, ... 364, 2, ) }, 0, "", 0, ... 364, 2, ) == 0x0
 03033   436   NtSetValueKey  (364,  (364, "MigrateProxy", 0, 4, "\1\0\0\0", 4, ... ) , 0, 4,  (364, "MigrateProxy", 0, 4, "\1\0\0\0", 4, ... ) , 4, ... ) == 0x0
 03034   436   NtClose  (364, ... ) == 0x0
 03035   436   NtOpenKey  (0x20019, {24, 360, 0x40, 0, 0,  (0x20019, {24, 360, 0x40, 0, 0, "Software\Microsoft\windows\CurrentVersion\Internet Settings"}, ... 364, ) }, ... 364, ) == 0x0
 03036   436   NtQueryValueKey  (364,  (364, "ProxyEnable", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (364, "ProxyEnable", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) }, 16, ) == 0x0
 03037   436   NtQueryValueKey  (364,  (364, "ProxyServer", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 03038   436   NtQueryValueKey  (364,  (364, "ProxyOverride", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 03039   436   NtQueryValueKey  (364,  (364, "AutoConfigURL", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 03040   436   NtClose  (364, ... ) == 0x0
 03041   436   NtWaitForSingleObject  (248, 0, 0x0, ... ) == 0x0
 03042   436   NtCreateKey  (0x1, {24, 360, 0x40, 0, 0,  (0x1, {24, 360, 0x40, 0, 0, "Software\Microsoft\windows\CurrentVersion\Internet Settings\Connections"}, 0, "", 0, ... 364, 2, ) }, 0, "", 0, ... 364, 2, ) == 0x0
 03043   436   NtQueryValueKey  (364,  (364, "SavedLegacySettings", Partial, 144, ... TitleIdx=0, Type=3, Data="<\0\0\0\26\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\4\0\0\0\0\0\0\00f\32\27\250\231\307\1\1\0\0\0\300\250|\200\0\0\0\0\0\0\0\0"}, 68, ) , Partial, 144, ... TitleIdx=0, Type=3, Data= (364, "SavedLegacySettings", Partial, 144, ... TitleIdx=0, Type=3, Data="<\0\0\0\26\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\4\0\0\0\0\0\0\00f\32\27\250\231\307\1\1\0\0\0\300\250|\200\0\0\0\0\0\0\0\0"}, 68, ) }, 68, ) == 0x0
 03044   436   NtQueryValueKey  (364,  (364, "SavedLegacySettings", Partial, 144, ... TitleIdx=0, Type=3, Data="<\0\0\0\26\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\4\0\0\0\0\0\0\00f\32\27\250\231\307\1\1\0\0\0\300\250|\200\0\0\0\0\0\0\0\0"}, 68, ) , Partial, 144, ... TitleIdx=0, Type=3, Data= (364, "SavedLegacySettings", Partial, 144, ... TitleIdx=0, Type=3, Data="<\0\0\0\26\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\4\0\0\0\0\0\0\00f\32\27\250\231\307\1\1\0\0\0\300\250|\200\0\0\0\0\0\0\0\0"}, 68, ) }, 68, ) == 0x0
 03045   436   NtReleaseMutant  (248, ... 0x0, ) == 0x0
 03046   436   NtClose  (364, ... ) == 0x0
 03047   436   NtWaitForSingleObject  (248, 0, 0x0, ... ) == 0x0
 03048   436   NtCreateKey  (0x1, {24, 360, 0x40, 0, 0,  (0x1, {24, 360, 0x40, 0, 0, "Software\Microsoft\windows\CurrentVersion\Internet Settings\Connections"}, 0, "", 0, ... 364, 2, ) }, 0, "", 0, ... 364, 2, ) == 0x0
 03049   436   NtQueryValueKey  (364,  (364, "DefaultConnectionSettings", Partial, 144, ... TitleIdx=0, Type=3, Data="<\0\0\0\3\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\4\0\0\0\0\0\0\00f\32\27\250\231\307\1\1\0\0\0\300\250|\200\0\0\0\0\0\0\0\0"}, 68, ) , Partial, 144, ... TitleIdx=0, Type=3, Data= (364, "DefaultConnectionSettings", Partial, 144, ... TitleIdx=0, Type=3, Data="<\0\0\0\3\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\4\0\0\0\0\0\0\00f\32\27\250\231\307\1\1\0\0\0\300\250|\200\0\0\0\0\0\0\0\0"}, 68, ) }, 68, ) == 0x0
 03050   436   NtQueryValueKey  (364,  (364, "DefaultConnectionSettings", Partial, 144, ... TitleIdx=0, Type=3, Data="<\0\0\0\3\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\4\0\0\0\0\0\0\00f\32\27\250\231\307\1\1\0\0\0\300\250|\200\0\0\0\0\0\0\0\0"}, 68, ) , Partial, 144, ... TitleIdx=0, Type=3, Data= (364, "DefaultConnectionSettings", Partial, 144, ... TitleIdx=0, Type=3, Data="<\0\0\0\3\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\4\0\0\0\0\0\0\00f\32\27\250\231\307\1\1\0\0\0\300\250|\200\0\0\0\0\0\0\0\0"}, 68, ) }, 68, ) == 0x0
 03051   436   NtReleaseMutant  (248, ... 0x0, ) == 0x0
 03052   436   NtClose  (364, ... ) == 0x0
 03053   436   NtWaitForSingleObject  (228, 0, 0x0, ... ) == 0x0
 03054   436   NtClearEvent  (228, ... ) == 0x0
 03055   436   NtSetEvent  (228, ... 0x0, ) == 0x0
 03056   436   NtCreateKey  (0x20006, {24, 360, 0x40, 0, 0,  (0x20006, {24, 360, 0x40, 0, 0, "Software\Microsoft\windows\CurrentVersion\Internet Settings"}, 0, "", 0, ... 364, 2, ) }, 0, "", 0, ... 364, 2, ) == 0x0
 03057   436   NtSetValueKey  (364,  (364, "ProxyEnable", 0, 4, "\0\0\0\0", 4, ... ) , 0, 4,  (364, "ProxyEnable", 0, 4, "\0\0\0\0", 4, ... ) , 4, ... ) == 0x0
 03058   436   NtDeleteValueKey  (364,  (364, "ProxyServer", ... ) , ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 03059   436   NtDeleteValueKey  (364,  (364, "ProxyOverride", ... ) , ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 03060   436   NtDeleteValueKey  (364,  (364, "AutoConfigURL", ... ) , ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 03061   436   NtClose  (364, ... ) == 0x0
 03062   436   NtOpenKey  (0x2000000, {24, 0, 0x40, 0, 0,  (0x2000000, {24, 0, 0x40, 0, 0, "\REGISTRY\MACHINE\SYSTEM\CURRENTCONTROLSET\HARDWARE PROFILES\CURRENT"}, ... 364, ) }, ... 364, ) == 0x0
 03063   436   NtCreateKey  (0x2, {24, 364, 0x40, 0, 0,  (0x2, {24, 364, 0x40, 0, 0, "Software\Microsoft\windows\CurrentVersion\Internet Settings"}, 0, "", 0, ... 368, 2, ) }, 0, "", 0, ... 368, 2, ) == 0x0
 03064   436   NtSetValueKey  (368,  (368, "ProxyEnable", 0, 4, "\0\0\0\0", 4, ... ) , 0, 4,  (368, "ProxyEnable", 0, 4, "\0\0\0\0", 4, ... ) , 4, ... ) == 0x0
 03065   436   NtClose  (368, ... ) == 0x0
 03066   436   NtWaitForSingleObject  (248, 0, 0x0, ... ) == 0x0
 03067   436   NtCreateKey  (0x1, {24, 360, 0x40, 0, 0,  (0x1, {24, 360, 0x40, 0, 0, "Software\Microsoft\windows\CurrentVersion\Internet Settings\Connections"}, 0, "", 0, ... 368, 2, ) }, 0, "", 0, ... 368, 2, ) == 0x0
 03068   436   NtQueryValueKey  (368,  (368, "SavedLegacySettings", Partial, 144, ... TitleIdx=0, Type=3, Data="<\0\0\0\26\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\4\0\0\0\0\0\0\00f\32\27\250\231\307\1\1\0\0\0\300\250|\200\0\0\0\0\0\0\0\0"}, 68, ) , Partial, 144, ... TitleIdx=0, Type=3, Data= (368, "SavedLegacySettings", Partial, 144, ... TitleIdx=0, Type=3, Data="<\0\0\0\26\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\4\0\0\0\0\0\0\00f\32\27\250\231\307\1\1\0\0\0\300\250|\200\0\0\0\0\0\0\0\0"}, 68, ) }, 68, ) == 0x0
 03069   436   NtQueryValueKey  (368,  (368, "SavedLegacySettings", Partial, 144, ... TitleIdx=0, Type=3, Data="<\0\0\0\26\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\4\0\0\0\0\0\0\00f\32\27\250\231\307\1\1\0\0\0\300\250|\200\0\0\0\0\0\0\0\0"}, 68, ) , Partial, 144, ... TitleIdx=0, Type=3, Data= (368, "SavedLegacySettings", Partial, 144, ... TitleIdx=0, Type=3, Data="<\0\0\0\26\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\4\0\0\0\0\0\0\00f\32\27\250\231\307\1\1\0\0\0\300\250|\200\0\0\0\0\0\0\0\0"}, 68, ) }, 68, ) == 0x0
 03070   436   NtCreateKey  (0x2, {24, 360, 0x40, 0, 0,  (0x2, {24, 360, 0x40, 0, 0, "Software\Microsoft\windows\CurrentVersion\Internet Settings\Connections"}, 0, "", 0, ... 376, 2, ) }, 0, "", 0, ... 376, 2, ) == 0x0
 03071   436   NtReleaseMutant  (248, ... 0x0, ) == 0x0
 03072   436   NtClose  (368, ... ) == 0x0
 03073   436   NtSetValueKey  (376,  (376, "SavedLegacySettings", 0, 3, "<\0\0\0\27\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\4\0\0\0\0\0\0\00f\32\27\250\231\307\1\1\0\0\0\300\250|\200\0\0\0\0\0\0\0\0", 56, ... , 0, 3,  (376, "SavedLegacySettings", 0, 3, "<\0\0\0\27\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\4\0\0\0\0\0\0\00f\32\27\250\231\307\1\1\0\0\0\300\250|\200\0\0\0\0\0\0\0\0", 56, ... , 56, ...
 03074   436   NtSetInformationFile  (-2147482700, -136378572, 8, EndOfFile, ... {status=0x0, info=0}, ) == 0x0
 03075   436   NtSetInformationFile  (-2147482700, -136378672, 8, EndOfFile, ... {status=0x0, info=0}, ) == 0x0
 03073   436   NtSetValueKey  ... ) == 0x0
 03076   436   NtClose  (376, ... ) == 0x0
 03077   436   NtWaitForSingleObject  (196, 0, 0x0, ... ) == 0x0
 03078   436   NtQueryInformationFile  (192, 1242180, 24, Standard, ... {status=0x0, info=24}, ) == 0x0
 03079   436   NtReleaseMutant  (196, ... 0x0, ) == 0x0
 03080   436   NtReleaseMutant  (240, ... 0x0, ) == 0x0
 03081   436   NtCreateEvent  (0x1f0003, 0x0, 1, 1, ... 376, ) == 0x0
 03082   436   NtWaitForSingleObject  (376, 0, 0x0, ... ) == 0x0
 03083   436   NtClearEvent  (376, ... ) == 0x0
 03084   436   NtSetEvent  (376, ... 0x0, ) == 0x0
 03085   436   NtOpenSection  (0xe, {24, 8, 0x40, 0, 0,  (0xe, {24, 8, 0x40, 0, 0, "wsock32.dll"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 03086   436   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\u:\work\wsock32.dll"}, 1239760, ... }, 1239760, ...
 02503   568   NtWaitForSingleObject  ... ) == 0x0
 03087   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=79}, 0x0, ) , 16, 0, ... {status=0x103, info=79}, 0x0, ) == 0x103
 03088   568   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ...
 03086   436   NtQueryAttributesFile  ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 03089   436   NtQueryAttributesFile  ({24, 12, 0x40, 0, 0,  ({24, 12, 0x40, 0, 0, "wsock32.dll"}, 1239760, ... }, 1239760, ...
 03088   568   NtWaitForSingleObject  ... ) == 0x0
 03090   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=79}, 0x0, ) , 16, 0, ... {status=0x103, info=79}, 0x0, ) == 0x103
 03091   568   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ...
 03089   436   NtQueryAttributesFile  ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 03092   436   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\System32\wsock32.dll"}, 1239760, ... ) }, 1239760, ... ) == 0x0
 03093   436   NtOpenFile  (0x100020, {24, 0, 0x40, 0, 0,  (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\System32\wsock32.dll"}, 5, 96, ... 368, {status=0x0, info=1}, ) }, 5, 96, ... 368, {status=0x0, info=1}, ) == 0x0
 03094   436   NtCreateSection  (0xf, 0x0, 0x0, 16, 16777216, 368, ... 384, ) == 0x0
 03095   436   NtQuerySection  (384, Image, 48, ... {section info, class 1, size 48}, 0x0, ) == 0x0
 03096   436   NtClose  (368, ... ) == 0x0
 03097   436   NtMapViewOfSection  (384, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x71ad0000), 0x0, 32768, ) == 0x0
 03098   436   NtClose  (384, ... ) == 0x0
 03099   436   NtClearEvent  (228, ... ) == 0x0
 03100   436   NtSetEvent  (228, ... 0x0, ) == 0x0
 03101   436   NtWaitForSingleObject  (196, 0, 0x0, ... ) == 0x0
 03102   436   NtQueryInformationFile  (192, 1241452, 24, Standard, ... {status=0x0, info=24}, ) == 0x0
 03103   436   NtReleaseMutant  (196, ... 0x0, ) == 0x0
 03104   436   NtOpenKey  (0x20019, {24, 60, 0x40, 0, 0,  (0x20019, {24, 60, 0x40, 0, 0, "SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Http Filters\RPA"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 03105   436   NtOpenKey  (0x20019, {24, 48, 0x40, 0, 0,  (0x20019, {24, 48, 0x40, 0, 0, "SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Http Filters\RPA"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 03106   436   NtWaitForSingleObject  (240, 0, 0x0, ... ) == 0x0
 03107   436   NtWaitForSingleObject  (244, 0, 0x0, ... ) == 0x0
 03108   436   NtReleaseMutant  (244, ... 0x0, ) == 0x0
 03109   436   NtQueryValueKey  (76,  (76, "EnableAutodial", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (76, "EnableAutodial", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) }, 16, ) == 0x0
 03110   436   NtQueryValueKey  (76,  (76, "NoNetAutodial", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (76, "NoNetAutodial", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) }, 16, ) == 0x0
 03111   436   NtWaitForSingleObject  (196, 0, 0x0, ... ) == 0x0
 03112   436   NtQueryInformationFile  (192, 1241648, 24, Standard, ... {status=0x0, info=24}, ) == 0x0
 03113   436   NtReleaseMutant  (196, ... 0x0, ) == 0x0
 03114   436   NtReleaseMutant  (240, ... 0x0, ) == 0x0
 03115   436   NtOpenSection  (0xe, {24, 8, 0x40, 0, 0,  (0xe, {24, 8, 0x40, 0, 0, "urlmon.dll"}, ... 384, ) }, ... 384, ) == 0x0
 03116   436   NtMapViewOfSection  (384, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x760f0000), 0x0, 491520, ) == 0x0
 03117   436   NtClose  (384, ... ) == 0x0
 03118   436   NtOpenSection  (0xe, {24, 8, 0x40, 0, 0,  (0xe, {24, 8, 0x40, 0, 0, "VERSION.dll"}, ... 384, ) }, ... 384, ) == 0x0
 03119   436   NtMapViewOfSection  (384, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x77c00000), 0x0, 28672, ) == 0x0
 03120   436   NtClose  (384, ... ) == 0x0
 03121   436   NtQuerySystemInformation  (Basic, 44, ... {Unknown=0,MaximumIncrement=156250,PhysicalPageSize=0x1000,NumberOfPhysicalPages=0xff7c,LowestPhysicalPage=0x1,HighestPhysicalPage=0xffff,AllocationGranularity=0x10000,LowestUserAddress=0x10000,HighestUserAddress=0x7ffeffff,ActiveProcessors=1,NumberProcessors=1,}, 0x0, ) == 0x0
 03122   436   NtAllocateVirtualMemory  (-1, 0, 0, 65536, 8192, 4, ... 10682368, 65536, ) == 0x0
 03123   436   NtAllocateVirtualMemory  (-1, 10682368, 0, 4096, 4096, 4, ... 10682368, 4096, ) == 0x0
 03124   436   NtAllocateVirtualMemory  (-1, 10686464, 0, 8192, 4096, 4, ... 10686464, 8192, ) == 0x0
 03125   436   NtCreateMutant  (0x1f0001, {24, 52, 0x80, 0, 0,  (0x1f0001, {24, 52, 0x80, 0, 0, "ZonesCounterMutex"}, 0, ... 384, ) }, 0, ... 384, ) == 0x0
 03126   436   NtCreateMutant  (0x1f0001, {24, 52, 0x80, 0, 0,  (0x1f0001, {24, 52, 0x80, 0, 0, "ZonesCacheCounterMutex"}, 0, ... 368, ) }, 0, ... 368, ) == 0x0
 03127   436   NtQueryDefaultUILanguage  (1237672, ...
 03128   436   NtOpenThreadTokenEx  (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN
 03129   436   NtOpenProcessTokenEx  (-1, 0x20008, 512, ... -2147482184, ) == 0x0
 03130   436   NtQueryInformationToken  (-2147482184, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0
 03131   436   NtClose  (-2147482184, ... ) == 0x0
 03132   436   NtOpenKey  (0x2000000, {24, 0, 0x640, 0, 0,  (0x2000000, {24, 0, 0x640, 0, 0, "\REGISTRY\USER\S-1-5-21-1078081533-484763869-839522115-1003"}, ... -2147482184, ) }, ... -2147482184, ) == 0x0
 03133   436   NtOpenKey  (0x80000000, {24, 0, 0x240, 0, 0,  (0x80000000, {24, 0, 0x240, 0, 0, "\Registry\Machine\System\CurrentControlSet\Control\Nls\MUILanguages"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 03134   436   NtOpenKey  (0x80000000, {24, -2147482184, 0x640, 0, 0,  (0x80000000, {24, -2147482184, 0x640, 0, 0, "Control Panel\Desktop"}, ... -2147482180, ) }, ... -2147482180, ) == 0x0
 03135   436   NtQueryValueKey  (-2147482180,  (-2147482180, "MultiUILanguageId", Partial, 256, ... ) , Partial, 256, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 03136   436   NtClose  (-2147482180, ... ) == 0x0
 03137   436   NtClose  (-2147482184, ... ) == 0x0
 03127   436   NtQueryDefaultUILanguage  ... ) == 0x0
 03138   436   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\System\CurrentControlSet\Control\Nls\MUILanguages"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 03139   436   NtOpenFile  (0x1200a9, {24, 0, 0x40, 0, 0,  (0x1200a9, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\urlmon.dll"}, 1, 96, ... 380, {status=0x0, info=1}, ) }, 1, 96, ... 380, {status=0x0, info=1}, ) == 0x0
 03140   436   NtCreateSection  (0x4, 0x0, 0x0, 2, 134217728, 380, ... 388, ) == 0x0
 03141   436   NtMapViewOfSection  (388, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 2, ... (0xa60000), 0x0, 454656, ) == 0x0
 03142   436   NtOpenFile  (0x1200a9, {24, 0, 0x40, 0, 0,  (0x1200a9, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\urlmon.dll.123.Manifest"}, 1, 96, ... ) }, 1, 96, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 03143   436   NtQueryDefaultLocale  (1, 1235708, ... ) == 0x0
 03144   436   NtOpenFile  (0x1200a9, {24, 0, 0x40, 0, 0,  (0x1200a9, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\urlmon.dll.123.Config"}, 1, 96, ... ) }, 1, 96, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 03145   436   NtRequestWaitReplyPort  (24, {128, 156, new_msg, 0, 1236564, 1, 96, 0}  (24, {128, 156, new_msg, 0, 1236564, 1, 96, 0} "\210\6\31\1\33\0\1\0\0\0\0\0\1\341\22\0\1\0\0\0\0\0\11\4\1\1\1\0<\0@\0\250\6\31\1|\1\0\0\377\377\377\377\0\0\0\0\240\302\253\0\0\0\0\0\303\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0(\0,\0\350\6\31\1\0\0\0\0\0\0\0\0T\345\22\0\0\0\0\0" ... {128, 156, reply, 0, 424, 436, 1528, 0} "\210\347\26\0\33\0\1\0\0\0\0\0\1\341\22\0\1\0\0\0\0\0\11\4\1\1\1\0<\0@\0\250\6\31\1|\1\0\0\377\377\377\377\0\0\0\0\240\302\253\0\0\0\0\0\303\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0(\0,\0\350\6\31\1\0\0\0\0\0\0\0\0T\345\22\0\0\0\0\0" )  ... {128, 156, reply, 0, 424, 436, 1528, 0}  (24, {128, 156, new_msg, 0, 1236564, 1, 96, 0} "\210\6\31\1\33\0\1\0\0\0\0\0\1\341\22\0\1\0\0\0\0\0\11\4\1\1\1\0<\0@\0\250\6\31\1|\1\0\0\377\377\377\377\0\0\0\0\240\302\253\0\0\0\0\0\303\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0(\0,\0\350\6\31\1\0\0\0\0\0\0\0\0T\345\22\0\0\0\0\0" ... {128, 156, reply, 0, 424, 436, 1528, 0} "\210\347\26\0\33\0\1\0\0\0\0\0\1\341\22\0\1\0\0\0\0\0\11\4\1\1\1\0<\0@\0\250\6\31\1|\1\0\0\377\377\377\377\0\0\0\0\240\302\253\0\0\0\0\0\303\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0(\0,\0\350\6\31\1\0\0\0\0\0\0\0\0T\345\22\0\0\0\0\0" )  ) == 0x0
 03146   436   NtClose  (380, ... ) == 0x0
 03147   436   NtClose  (388, ... ) == 0x0
 03148   436   NtUnmapViewOfSection  (-1, 0xa60000, ... ) == 0x0
 03149   436   NtUnmapViewOfSection  (-1, 0x12e554, ... ) == STATUS_NOT_MAPPED_VIEW
 03150   436   NtQueryDebugFilterState  (53, 2, ... ) == 0x0
 03151   436   NtOpenKey  (0x8, {24, 0, 0x40, 0, 0,  (0x8, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows\CurrentVersion\SideBySide\AssemblyStorageRoots"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 03152   436   NtQueryDebugFilterState  (53, 2, ... ) == 0x0
 03153   436   NtQueryDebugFilterState  (53, 2, ... ) == 0x0
 03154   436   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\u:\work\packed.exe.Local\"}, 1234248, ... }, 1234248, ...
 03091   568   NtWaitForSingleObject  ... ) == 0x0
 03155   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=79}, 0x0, ) , 16, 0, ... {status=0x103, info=79}, 0x0, ) == 0x103
 03156   568   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ...
 03154   436   NtQueryAttributesFile  ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 03157   436   NtQueryDebugFilterState  (53, 2, ... ) == 0x0
 03158   436   NtQueryDebugFilterState  (53, 2, ... ) == 0x0
 03159   436   NtQueryDebugFilterState  (53, 2, ... ) == 0x0
 03160   436   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.0.0_x-ww_1382d70a"}, 1234840, ... ) }, 1234840, ... ) == 0x0
 03161   436   NtOpenFile  (0x100020, {24, 0, 0x40, 0, 0,  (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.0.0_x-ww_1382d70a"}, 3, 33, ... 388, {status=0x0, info=1}, ) }, 3, 33, ... 388, {status=0x0, info=1}, ) == 0x0
 03162   436   NtQueryDebugFilterState  (53, 2, ... ) == 0x0
 03163   436   NtQuerySystemInformation  (Basic, 44, ... {Unknown=0,MaximumIncrement=156250,PhysicalPageSize=0x1000,NumberOfPhysicalPages=0xff7c,LowestPhysicalPage=0x1,HighestPhysicalPage=0xffff,AllocationGranularity=0x10000,LowestUserAddress=0x10000,HighestUserAddress=0x7ffeffff,ActiveProcessors=1,NumberProcessors=1,}, 0x0, ) == 0x0
 03164   436   NtQuerySystemInformation  (Processor, 12, ... {system info, class 1, size 12}, 0x0, ) == 0x0
 03165   436   NtOpenKey  (0x1, {24, 48, 0x40, 0, 0,  (0x1, {24, 48, 0x40, 0, 0, "Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 03166   436   NtOpenThreadTokenEx  (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN
 03167   436   NtOpenProcessTokenEx  (-1, 0x20008, 512, ... 380, ) == 0x0
 03168   436   NtQueryInformationToken  (380, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0
 03169   436   NtClose  (380, ... ) == 0x0
 03170   436   NtOpenKey  (0x2000000, {24, 0, 0x40, 0, 0,  (0x2000000, {24, 0, 0x40, 0, 0, "\REGISTRY\USER\S-1-5-21-1078081533-484763869-839522115-1003_Classes"}, ... 380, ) }, ... 380, ) == 0x0
 03171   436   NtSetInformationObject  (382, Handle, {Inherit=0,ProtectFromClose=1,}, 1179904, ... ) == 0x0
 03172   436   NtQueryKey  (382, Name, 384, ... {Name= (382, Name, 384, ... {Name="\REGISTRY\USER\S-1-5-21-1078081533-484763869-839522115-1003_CLASSES9"}, 138, ) }, 138, ) == 0x0
 03173   436   NtOpenKey  (0x2000000, {24, 382, 0x40, 0, 0,  (0x2000000, {24, 382, 0x40, 0, 0, "PROTOCOLS\Name-Space Handler\"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 03174   436   NtOpenKey  (0x2000000, {24, 0, 0x40, 0, 0,  (0x2000000, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Classes\PROTOCOLS\Name-Space Handler"}, ... 392, ) }, ... 392, ) == 0x0
 03175   436   NtQueryKey  (394, Name, 392, ... {Name= (394, Name, 392, ... {Name="\REGISTRY\MACHINE\SOFTWARE\Classes\PROTOCOLS\Name-Space HandlerS"}, 130, ) }, 130, ) == 0x0
 03176   436   NtOpenThreadTokenEx  (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN
 03177   436   NtOpenProcessTokenEx  (-1, 0x20008, 512, ... 396, ) == 0x0
 03178   436   NtQueryInformationToken  (396, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0
 03179   436   NtClose  (396, ... ) == 0x0
 03180   436   NtOpenKey  (0x2000000, {24, 0, 0x40, 0, 0,  (0x2000000, {24, 0, 0x40, 0, 0, "\REGISTRY\USER\S-1-5-21-1078081533-484763869-839522115-1003_Classes\PROTOCOLS\Name-Space Handler"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 03181   436   NtEnumerateKey  (394, 0, Node, 288, ... {LastWrite={0x5d796f8c,0x1c73999}, TitleIdx=0, Name= (394, 0, Node, 288, ... {LastWrite={0x5d796f8c,0x1c73999}, TitleIdx=0, Name="mk", Class=""}, 28, ) , Class=""}, 28, ) == 0x0
 03182   436   NtEnumerateKey  (394, 1, Node, 288, ... ) == STATUS_NO_MORE_ENTRIES
 03183   436   NtClose  (394, ... ) == 0x0
 03184   436   NtOpenKey  (0x1, {24, 60, 0x40, 0, 0,  (0x1, {24, 60, 0x40, 0, 0, "SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 03185   436   NtOpenKey  (0x1, {24, 60, 0x40, 0, 0,  (0x1, {24, 60, 0x40, 0, 0, "SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 03186   436   NtOpenKey  (0x20019, {24, 60, 0x40, 0, 0,  (0x20019, {24, 60, 0x40, 0, 0, "Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\"}, ... 392, ) }, ... 392, ) == 0x0
 03187   436   NtOpenKey  (0x20019, {24, 392, 0x40, 0, 0,  (0x20019, {24, 392, 0x40, 0, 0, "Ranges\"}, ... 396, ) }, ... 396, ) == 0x0
 03188   436   NtQueryKey  (396, 4, 176, ... {key info, class 4, size 40}, 40, ) == 0x0
 03189   436   NtClose  (396, ... ) == 0x0
 03190   436   NtRequestWaitReplyPort  (184, {28, 52, new_msg, 0, 0, 0, 0, 0}  (184, {28, 52, new_msg, 0, 0, 0, 0, 0} "\37\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\1\0\13\30\10\2\260\361\24\0" ... {176, 200, reply, 0, 424, 436, 1529, 0} "\37\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\1\0\20\0\10\2\220\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0S\0R\0I\0-\0u\0s\0e\0r\0" )  ... {176, 200, reply, 0, 424, 436, 1529, 0}  (184, {28, 52, new_msg, 0, 0, 0, 0, 0} "\37\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\1\0\13\30\10\2\260\361\24\0" ... {176, 200, reply, 0, 424, 436, 1529, 0} "\37\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\1\0\20\0\10\2\220\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0S\0R\0I\0-\0u\0s\0e\0r\0" )  ) == 0x0
 03191   436   NtCreateSection  (0xf0007, {24, 52, 0x80, 0, 0,  (0xf0007, {24, 52, 0x80, 0, 0, "UrlZonesSM_SRI-user"}, {8, 0}, 4, 134217728, 0, ... 396, ) }, {8, 0}, 4, 134217728, 0, ... 396, ) == 0x0
 03192   436   NtMapViewOfSection  (396, -1, (0x0), 0, 0, {0, 0}, 0, 1, 0, 4, ... (0xa60000), {0, 0}, 4096, ) == 0x0
 03193   436   NtOpenKey  (0x20019, {24, 48, 0x40, 0, 0,  (0x20019, {24, 48, 0x40, 0, 0, "System\Setup"}, ... 400, ) }, ... 400, ) == 0x0
 03194   436   NtQueryValueKey  (400,  (400, "SystemSetupInProgress", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (400, "SystemSetupInProgress", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) }, 16, ) == 0x0
 03195   436   NtClose  (400, ... ) == 0x0
 03196   436   NtOpenKey  (0x20019, {24, 60, 0x40, 0, 0,  (0x20019, {24, 60, 0x40, 0, 0, "Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\"}, ... 400, ) }, ... 400, ) == 0x0
 03197   436   NtOpenKey  (0x20019, {24, 400, 0x40, 0, 0,  (0x20019, {24, 400, 0x40, 0, 0, "0"}, ... 404, ) }, ... 404, ) == 0x0
 03198   436   NtClose  (404, ... ) == 0x0
 03199   436   NtOpenKey  (0x20019, {24, 400, 0x40, 0, 0,  (0x20019, {24, 400, 0x40, 0, 0, "1"}, ... 404, ) }, ... 404, ) == 0x0
 03200   436   NtClose  (404, ... ) == 0x0
 03201   436   NtOpenKey  (0x20019, {24, 400, 0x40, 0, 0,  (0x20019, {24, 400, 0x40, 0, 0, "2"}, ... 404, ) }, ... 404, ) == 0x0
 03202   436   NtClose  (404, ... ) == 0x0
 03203   436   NtOpenKey  (0x20019, {24, 400, 0x40, 0, 0,  (0x20019, {24, 400, 0x40, 0, 0, "3"}, ... 404, ) }, ... 404, ) == 0x0
 03204   436   NtClose  (404, ... ) == 0x0
 03205   436   NtOpenKey  (0x20019, {24, 400, 0x40, 0, 0,  (0x20019, {24, 400, 0x40, 0, 0, "4"}, ... 404, ) }, ... 404, ) == 0x0
 03206   436   NtClose  (404, ... ) == 0x0
 03207   436   NtClose  (400, ... ) == 0x0
 03208   436   NtOpenKey  (0x20019, {24, 60, 0x40, 0, 0,  (0x20019, {24, 60, 0x40, 0, 0, "Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\"}, ... 400, ) }, ... 400, ) == 0x0
 03209   436   NtEnumerateKey  (400, 0, Basic, 288, ... {LastWrite={0x8db90da8,0x1c7399c}, TitleIdx=0, Name= (400, 0, Basic, 288, ... {LastWrite={0x8db90da8,0x1c7399c}, TitleIdx=0, Name="0"}, 18, ) }, 18, ) == 0x0
 03210   436   NtOpenKey  (0x20019, {24, 60, 0x40, 0, 0,  (0x20019, {24, 60, 0x40, 0, 0, "Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0"}, ... 404, ) }, ... 404, ) == 0x0
 03211   436   NtQueryValueKey  (404,  (404, "Flags", Partial, 144, ... TitleIdx=0, Type=4, Data="!\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (404, "Flags", Partial, 144, ... TitleIdx=0, Type=4, Data="!\0\0\0"}, 16, ) }, 16, ) == 0x0
 03212   436   NtClose  (404, ... ) == 0x0
 03213   436   NtEnumerateKey  (400, 1, Basic, 288, ... {LastWrite={0x8f7e0c74,0x1c7399c}, TitleIdx=0, Name= (400, 1, Basic, 288, ... {LastWrite={0x8f7e0c74,0x1c7399c}, TitleIdx=0, Name="1"}, 18, ) }, 18, ) == 0x0
 03214   436   NtOpenKey  (0x20019, {24, 60, 0x40, 0, 0,  (0x20019, {24, 60, 0x40, 0, 0, "Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1"}, ... 404, ) }, ... 404, ) == 0x0
 03215   436   NtQueryValueKey  (404,  (404, "Flags", Partial, 144, ... TitleIdx=0, Type=4, Data="\333\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (404, "Flags", Partial, 144, ... TitleIdx=0, Type=4, Data="\333\0\0\0"}, 16, ) }, 16, ) == 0x0
 03216   436   NtWaitForSingleObject  (384, 0, 0x0, ... ) == 0x0
 03217   436   NtReleaseMutant  (384, ... 0x0, ) == 0x0
 03218   436   NtOpenKey  (0x2001f, {24, 60, 0x40, 0, 0,  (0x2001f, {24, 60, 0x40, 0, 0, "Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\"}, ... 408, ) }, ... 408, ) == 0x0
 03219   436   NtSetValueKey  (408,  (408, "ProxyBypass", 0, 4, "\1\0\0\0", 4, ... ) , 0, 4,  (408, "ProxyBypass", 0, 4, "\1\0\0\0", 4, ... ) , 4, ... ) == 0x0
 03220   436   NtSetValueKey  (408,  (408, "IntranetName", 0, 4, "\1\0\0\0", 4, ... ) , 0, 4,  (408, "IntranetName", 0, 4, "\1\0\0\0", 4, ... ) , 4, ... ) == 0x0
 03221   436   NtSetValueKey  (408,  (408, "UNCAsIntranet", 0, 4, "\1\0\0\0", 4, ... ) , 0, 4,  (408, "UNCAsIntranet", 0, 4, "\1\0\0\0", 4, ... ) , 4, ... ) == 0x0
 03222   436   NtClose  (408, ... ) == 0x0
 03223   436   NtClose  (404, ... ) == 0x0
 03224   436   NtEnumerateKey  (400, 2, Basic, 288, ... {LastWrite={0x8f7e0c74,0x1c7399c}, TitleIdx=0, Name= (400, 2, Basic, 288, ... {LastWrite={0x8f7e0c74,0x1c7399c}, TitleIdx=0, Name="2I"}, 18, ) }, 18, ) == 0x0
 03225   436   NtOpenKey  (0x20019, {24, 60, 0x40, 0, 0,  (0x20019, {24, 60, 0x40, 0, 0, "Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2"}, ... 404, ) }, ... 404, ) == 0x0
 03226   436   NtQueryValueKey  (404,  (404, "Flags", Partial, 144, ... TitleIdx=0, Type=4, Data="G\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (404, "Flags", Partial, 144, ... TitleIdx=0, Type=4, Data="G\0\0\0"}, 16, ) }, 16, ) == 0x0
 03227   436   NtClose  (404, ... ) == 0x0
 03228   436   NtEnumerateKey  (400, 3, Basic, 288, ... {LastWrite={0x8f7e0c74,0x1c7399c}, TitleIdx=0, Name= (400, 3, Basic, 288, ... {LastWrite={0x8f7e0c74,0x1c7399c}, TitleIdx=0, Name="3"}, 18, ) }, 18, ) == 0x0
 03229   436   NtOpenKey  (0x20019, {24, 60, 0x40, 0, 0,  (0x20019, {24, 60, 0x40, 0, 0, "Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3"}, ... 404, ) }, ... 404, ) == 0x0
 03230   436   NtQueryValueKey  (404,  (404, "Flags", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (404, "Flags", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) }, 16, ) == 0x0
 03231   436   NtClose  (404, ... ) == 0x0
 03232   436   NtEnumerateKey  (400, 4, Basic, 288, ... {LastWrite={0x8f7e0c74,0x1c7399c}, TitleIdx=0, Name= (400, 4, Basic, 288, ... {LastWrite={0x8f7e0c74,0x1c7399c}, TitleIdx=0, Name="4"}, 18, ) }, 18, ) == 0x0
 03233   436   NtOpenKey  (0x20019, {24, 60, 0x40, 0, 0,  (0x20019, {24, 60, 0x40, 0, 0, "Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4"}, ... 404, ) }, ... 404, ) == 0x0
 03234   436   NtQueryValueKey  (404,  (404, "Flags", Partial, 144, ... TitleIdx=0, Type=4, Data="\3\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (404, "Flags", Partial, 144, ... TitleIdx=0, Type=4, Data="\3\0\0\0"}, 16, ) }, 16, ) == 0x0
 03235   436   NtClose  (404, ... ) == 0x0
 03236   436   NtEnumerateKey  (400, 5, Basic, 288, ... ) == STATUS_NO_MORE_ENTRIES
 03237   436   NtClose  (400, ... ) == 0x0
 03238   436   NtWaitForSingleObject  (384, 0, 0x0, ... ) == 0x0
 03239   436   NtReleaseMutant  (384, ... 0x0, ) == 0x0
 03240   436   NtOpenKey  (0x20019, {24, 392, 0x40, 0, 0,  (0x20019, {24, 392, 0x40, 0, 0, "Domains\bashchelik.com"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 03241   436   NtOpenKey  (0x20019, {24, 48, 0x40, 0, 0,  (0x20019, {24, 48, 0x40, 0, 0, "Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\bashchelik.com"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 03242   436   NtQueryValueKey  (392,  (392, "IntranetName", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (392, "IntranetName", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) }, 16, ) == 0x0
 03243   436   NtQueryValueKey  (392,  (392, "ProxyBypass", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (392, "ProxyBypass", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) }, 16, ) == 0x0
 03244   436   NtClearEvent  (228, ... ) == 0x0
 03245   436   NtSetEvent  (228, ... 0x0, ) == 0x0
 03246   436   NtOpenKey  (0x20019, {24, 392, 0x40, 0, 0,  (0x20019, {24, 392, 0x40, 0, 0, "ProtocolDefaults\"}, ... 400, ) }, ... 400, ) == 0x0
 03247   436   NtQueryValueKey  (400,  (400, "http", Partial, 144, ... TitleIdx=0, Type=4, Data="\3\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (400, "http", Partial, 144, ... TitleIdx=0, Type=4, Data="\3\0\0\0"}, 16, ) }, 16, ) == 0x0
 03248   436   NtClose  (400, ... ) == 0x0
 03249   436   NtWaitForSingleObject  (384, 0, 0x0, ... ) == 0x0
 03250   436   NtReleaseMutant  (384, ... 0x0, ) == 0x0
 03251   436   NtWaitForSingleObject  (384, 0, 0x0, ... ) == 0x0
 03252   436   NtReleaseMutant  (384, ... 0x0, ) == 0x0
 03253   436   NtWaitForSingleObject  (368, 0, 0x0, ... ) == 0x0
 03254   436   NtReleaseMutant  (368, ... 0x0, ) == 0x0
 03255   436   NtOpenKey  (0x20019, {24, 60, 0x40, 0, 0,  (0x20019, {24, 60, 0x40, 0, 0, "Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3"}, ... 400, ) }, ... 400, ) == 0x0
 03256   436   NtQueryValueKey  (400,  (400, "1A10", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (400, "1A10", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) }, 16, ) == 0x0
 03257   436   NtWaitForSingleObject  (368, 0, 0x0, ... ) == 0x0
 03258   436   NtReleaseMutant  (368, ... 0x0, ) == 0x0
 03259   436   NtWaitForSingleObject  (368, 0, 0x0, ... ) == 0x0
 03260   436   NtReleaseMutant  (368, ... 0x0, ) == 0x0
 03261   436   NtClose  (400, ... ) == 0x0
 03262   436   NtWaitForSingleObject  (196, 0, 0x0, ... ) == 0x0
 03263   436   NtQueryInformationFile  (192, 1241900, 24, Standard, ... {status=0x0, info=24}, ) == 0x0
 03264   436   NtReleaseMutant  (196, ... 0x0, ) == 0x0
 03265   436   NtWaitForSingleObject  (196, 0, 0x0, ... ) == 0x0
 03266   436   NtQueryInformationFile  (192, 1239516, 24, Standard, ... {status=0x0, info=24}, ) == 0x0
 03267   436   NtReleaseMutant  (196, ... 0x0, ) == 0x0
 03268   436   NtWaitForSingleObject  (204, 0, 0x0, ... ) == 0x0
 03269   436   NtQueryInformationFile  (212, 1241480, 24, Standard, ... {status=0x0, info=24}, ) == 0x0
 03270   436   NtReleaseMutant  (204, ... 0x0, ) == 0x0
 03271   436   NtWaitForSingleObject  (204, 0, 0x0, ... ) == 0x0
 03272   436   NtQueryInformationFile  (212, 1241440, 24, Standard, ... {status=0x0, info=24}, ) == 0x0
 03273   436   NtReleaseMutant  (204, ... 0x0, ) == 0x0
 03274   436   NtWaitForSingleObject  (112, 0, {0, 0}, ... ) == 0x102
 03275   436   NtCreateEvent  (0x1f0003, 0x0, 0, 0, ... 400, ) == 0x0
 03276   436   NtCreateEvent  (0x1f0003, 0x0, 1, 0, ... 404, ) == 0x0
 03277   436   NtConnectPort  ( ("\RPC Control\DNSResolver", {12, 2, 1, 1}, 0x0, 0x0, 1238356, 112, ... 408, 0x0, 0x0, 0x0, 112, ) , {12, 2, 1, 1}, 0x0, 0x0, 1238356, 112, ... 408, 0x0, 0x0, 0x0, 112, ) == 0x0
 03278   436   NtRequestWaitReplyPort  (408, {128, 152, new_msg, 0, 1310720, 123688, 1310720, 1238120}  (408, {128, 152, new_msg, 0, 1310720, 123688, 1310720, 1238120} "\0$\370w\30\353\22\0\2$\370w\1kwEVY\205D\237\200\364(\367\326\1)\2\0\0\0\1\0\0\0\0\355\25\0\4\0\0\0\0\355\25\0\20\344\314w\0\355\25\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\1\0\7\0\0\0\0\0\360\352\25\0\370\4\24\0\250\354\25\0\1\0\0\0\200\354\25\0\0\0\0\0\0\0\0\0\0\0\0\0\250\354\25\0\0\0\0\0\0\0\0\0\0\0\0\0" ... {128, 152, reply, 0, 424, 436, 1531, 0} "\7$\370w\30\353\22\0\2$\370w\1kwEVY\205D\237\200\364(\367\326\1)\2\0\0\0\1\0\0\0\0\0\0\0\4\0\0\0\0\355\25\0\377\377\377\377\0\355\25\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\1\0\7\0\0\0\0\0\360\352\25\0\370\4\24\0\250\354\25\0\1\0\0\0\200\354\25\0\0\0\0\0\0\0\0\0\0\0\0\0\250\354\25\0\0\0\0\0\0\0\0\0\0\0\0\0" )  ... {128, 152, reply, 0, 424, 436, 1531, 0}  (408, {128, 152, new_msg, 0, 1310720, 123688, 1310720, 1238120} "\0$\370w\30\353\22\0\2$\370w\1kwEVY\205D\237\200\364(\367\326\1)\2\0\0\0\1\0\0\0\0\355\25\0\4\0\0\0\0\355\25\0\20\344\314w\0\355\25\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\1\0\7\0\0\0\0\0\360\352\25\0\370\4\24\0\250\354\25\0\1\0\0\0\200\354\25\0\0\0\0\0\0\0\0\0\0\0\0\0\250\354\25\0\0\0\0\0\0\0\0\0\0\0\0\0" ... {128, 152, reply, 0, 424, 436, 1531, 0} "\7$\370w\30\353\22\0\2$\370w\1kwEVY\205D\237\200\364(\367\326\1)\2\0\0\0\1\0\0\0\0\0\0\0\4\0\0\0\0\355\25\0\377\377\377\377\0\355\25\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\1\0\7\0\0\0\0\0\360\352\25\0\370\4\24\0\250\354\25\0\1\0\0\0\200\354\25\0\0\0\0\0\0\0\0\0\0\0\0\0\250\354\25\0\0\0\0\0\0\0\0\0\0\0\0\0" )  ) == 0x0
 03279   436   NtRequestWaitReplyPort  (408, {64, 88, new_msg, 0, 44, 3, 20, 0}  (408, {64, 88, new_msg, 0, 44, 3, 20, 0} "\1\0\0\0A\2\10\0*,\334\21\261\306\0\14)\371\246\305\1\0\0\0\377\377\377\377\1\0\0\0\0\0\0\0\21\0\0\0\0\0\0\0\0\0\0\0\25\0\0\0\3757B@\335\350\344\34C\27\122" ... {52, 76, reply, 0, 424, 436, 1532, 0} "\2\213+\370\1\0+\370B\271\325\371(\273\325\371\377\377\377\377\325\316\325\371\13\353\325\371\0\0\0\0\200]\12\0\1\0\0\0\1\0\0\0\300\250|\201\377\377\377\0" )  ... {52, 76, reply, 0, 424, 436, 1532, 0}  (408, {64, 88, new_msg, 0, 44, 3, 20, 0} "\1\0\0\0A\2\10\0*,\334\21\261\306\0\14)\371\246\305\1\0\0\0\377\377\377\377\1\0\0\0\0\0\0\0\21\0\0\0\0\0\0\0\0\0\0\0\25\0\0\0\3757B@\335\350\344\34C\27\122" ... {52, 76, reply, 0, 424, 436, 1532, 0} "\2\213+\370\1\0+\370B\271\325\371(\273\325\371\377\377\377\377\325\316\325\371\13\353\325\371\0\0\0\0\200]\12\0\1\0\0\0\1\0\0\0\300\250|\201\377\377\377\0" )  ) == 0x0
 03280   436   NtClose  (404, ... ) == 0x0
 03281   436   NtClose  (408, ... ) == 0x0
 03282   436   NtCreateKey  (0x20019, {24, 48, 0x40, 0, 0,  (0x20019, {24, 48, 0x40, 0, 0, "System\CurrentControlSet\Services\Tcpip\Parameters"}, 0, "Class", 0, ... 408, 2, ) }, 0,  (0x20019, {24, 48, 0x40, 0, 0, "System\CurrentControlSet\Services\Tcpip\Parameters"}, 0, "Class", 0, ... 408, 2, ) , 0, ... 408, 2, ) == 0x0
 03283   436   NtOpenKey  (0x20019, {24, 48, 0x40, 0, 0,  (0x20019, {24, 48, 0x40, 0, 0, "System\CurrentControlSet\Services\DnsCache\Parameters"}, ... 404, ) }, ... 404, ) == 0x0
 03284   436   NtOpenKey  (0x20019, {24, 48, 0x40, 0, 0,  (0x20019, {24, 48, 0x40, 0, 0, "Software\Policies\Microsoft\Windows NT\DnsClient"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 03285   436   NtQueryValueKey  (408,  (408, "Hostname", Partial, 144, ... TitleIdx=0, Type=1, Data="M\0Y\0W\0O\0R\0L\0D\0\0\0"}, 28, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (408, "Hostname", Partial, 144, ... TitleIdx=0, Type=1, Data="M\0Y\0W\0O\0R\0L\0D\0\0\0"}, 28, ) }, 28, ) == 0x0
 03286   436   NtQueryValueKey  (408,  (408, "Hostname", Partial, 144, ... TitleIdx=0, Type=1, Data="M\0Y\0W\0O\0R\0L\0D\0\0\0"}, 28, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (408, "Hostname", Partial, 144, ... TitleIdx=0, Type=1, Data="M\0Y\0W\0O\0R\0L\0D\0\0\0"}, 28, ) }, 28, ) == 0x0
 03287   436   NtClose  (408, ... ) == 0x0
 03288   436   NtClose  (404, ... ) == 0x0
 03289   436   NtCreateKey  (0x20019, {24, 48, 0x40, 0, 0,  (0x20019, {24, 48, 0x40, 0, 0, "System\CurrentControlSet\Services\Tcpip\Parameters"}, 0, "Class", 0, ... 404, 2, ) }, 0,  (0x20019, {24, 48, 0x40, 0, 0, "System\CurrentControlSet\Services\Tcpip\Parameters"}, 0, "Class", 0, ... 404, 2, ) , 0, ... 404, 2, ) == 0x0
 03290   436   NtOpenKey  (0x20019, {24, 48, 0x40, 0, 0,  (0x20019, {24, 48, 0x40, 0, 0, "System\CurrentControlSet\Services\DnsCache\Parameters"}, ... 408, ) }, ... 408, ) == 0x0
 03291   436   NtOpenKey  (0x20019, {24, 48, 0x40, 0, 0,  (0x20019, {24, 48, 0x40, 0, 0, "Software\Policies\Microsoft\Windows NT\DnsClient"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 03292   436   NtQueryValueKey  (404,  (404, "Domain", Partial, 144, ... TitleIdx=0, Type=1, Data="\0\0"}, 14, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (404, "Domain", Partial, 144, ... TitleIdx=0, Type=1, Data="\0\0"}, 14, ) }, 14, ) == 0x0
 03293   436   NtQueryValueKey  (404,  (404, "Domain", Partial, 144, ... TitleIdx=0, Type=1, Data="\0\0"}, 14, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (404, "Domain", Partial, 144, ... TitleIdx=0, Type=1, Data="\0\0"}, 14, ) }, 14, ) == 0x0
 03294   436   NtClose  (404, ... ) == 0x0
 03295   436   NtClose  (408, ... ) == 0x0
 03296   436   NtOpenKey  (0x1, {24, 48, 0x40, 0, 0,  (0x1, {24, 48, 0x40, 0, 0, "System\CurrentControlSet\Services\VxD\MSTCP"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 03297   436   NtOpenKey  (0x1, {24, 48, 0x40, 0, 0,  (0x1, {24, 48, 0x40, 0, 0, "System\CurrentControlSet\Control\ComputerName\ComputerName"}, ... 408, ) }, ... 408, ) == 0x0
 03298   436   NtQueryValueKey  (408,  (408, "ComputerName", Partial, 144, ... TitleIdx=0, Type=1, Data="M\0Y\0W\0O\0R\0L\0D\0\0\0"}, 28, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (408, "ComputerName", Partial, 144, ... TitleIdx=0, Type=1, Data="M\0Y\0W\0O\0R\0L\0D\0\0\0"}, 28, ) }, 28, ) == 0x0
 03299   436   NtQueryValueKey  (408,  (408, "ComputerName", Partial, 144, ... TitleIdx=0, Type=1, Data="M\0Y\0W\0O\0R\0L\0D\0\0\0"}, 28, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (408, "ComputerName", Partial, 144, ... TitleIdx=0, Type=1, Data="M\0Y\0W\0O\0R\0L\0D\0\0\0"}, 28, ) }, 28, ) == 0x0
 03300   436   NtClose  (408, ... ) == 0x0
 03301   436   NtWaitForSingleObject  (104, 0, {0, 0}, ... ) == 0x102
 03302   436   NtWaitForSingleObject  (104, 0, {0, 0}, ... ) == 0x102
 03303   436   NtWaitForSingleObject  (104, 0, {0, 0}, ... ) == 0x102
 03304   436   NtWaitForSingleObject  (112, 0, {0, 0}, ... ) == 0x102
 03305   436   NtCreateEvent  (0x1f0003, 0x0, 1, 0, ... 408, ) == 0x0
 03306   436   NtConnectPort  ( ("\RPC Control\DNSResolver", {12, 2, 1, 1}, 0x0, 0x0, 1237692, 112, ... 404, 0x0, 0x0, 0x0, 112, ) , {12, 2, 1, 1}, 0x0, 0x0, 1237692, 112, ... 404, 0x0, 0x0, 0x0, 112, ) == 0x0
 03307   436   NtRequestWaitReplyPort  (404, {128, 152, new_msg, 0, 1310720, 123024, 1310720, 1237456}  (404, {128, 152, new_msg, 0, 1310720, 123024, 1310720, 1237456} "\0$\370w\200\350\22\0\2$\370w\1kwEVY\205D\237\200\364(\367\326\1)\2\0\0\0\1\0\0\0\0\355\25\0\4\0\0\0\0\355\25\0\20\344\314w\0\355\25\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\1\0\10\0x\352\25\0\330\335\25\0\0\0\0\0\0\0\0\0\24\0\0\0\1\0\0\0\0\0\0\0\0\0\25\0\370\357\25\0\34\343\22\0\0\0\0\0\210\1\24\0\5\0\0\0" ... {128, 152, reply, 0, 424, 436, 1535, 0} "\7$\370w\200\350\22\0\2$\370w\1kwEVY\205D\237\200\364(\367\326\1)\2\0\0\0\1\0\0\0\0\0\0\0\4\0\0\0\0\355\25\0\377\377\377\377\0\355\25\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\1\0\10\0x\352\25\0\330\335\25\0\0\0\0\0\0\0\0\0\24\0\0\0\1\0\0\0\0\0\0\0\0\0\25\0\370\357\25\0\34\343\22\0\0\0\0\0\210\1\24\0\5\0\0\0" )  ... {128, 152, reply, 0, 424, 436, 1535, 0}  (404, {128, 152, new_msg, 0, 1310720, 123024, 1310720, 1237456} "\0$\370w\200\350\22\0\2$\370w\1kwEVY\205D\237\200\364(\367\326\1)\2\0\0\0\1\0\0\0\0\355\25\0\4\0\0\0\0\355\25\0\20\344\314w\0\355\25\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\1\0\10\0x\352\25\0\330\335\25\0\0\0\0\0\0\0\0\0\24\0\0\0\1\0\0\0\0\0\0\0\0\0\25\0\370\357\25\0\34\343\22\0\0\0\0\0\210\1\24\0\5\0\0\0" ... {128, 152, reply, 0, 424, 436, 1535, 0} "\7$\370w\200\350\22\0\2$\370w\1kwEVY\205D\237\200\364(\367\326\1)\2\0\0\0\1\0\0\0\0\0\0\0\4\0\0\0\0\355\25\0\377\377\377\377\0\355\25\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\1\0\10\0x\352\25\0\330\335\25\0\0\0\0\0\0\0\0\0\24\0\0\0\1\0\0\0\0\0\0\0\0\0\25\0\370\357\25\0\34\343\22\0\0\0\0\0\210\1\24\0\5\0\0\0" )  ) == 0x0
 03308   436   NtRequestWaitReplyPort  (404, {112, 136, new_msg, 0, 424, 436, 1532, 0}  (404, {112, 136, new_msg, 0, 424, 436, 1532, 0} "\1\213\0\0A\2\11\0B\271\325\371(\273\325\371\377\377\377\377\325\316\325\371\377\377\377\377\0\0\0\0\0\0\0\0\254\263\25\0\25\0\0\0\0\0\0\0\25\0\0\0s\0r\0v\00\01\0.\0b\0a\0s\0h\0c\0h\0e\0l\0i\0k\0.\0c\0o\0m\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0" ...  ...
 03156   568   NtWaitForSingleObject  ... ) == 0x0
 03309   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=94}, 0x0, ) , 16, 0, ... {status=0x103, info=94}, 0x0, ) == 0x103
 03310   568   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ...
 03308   436   NtRequestWaitReplyPort  ... {44, 68, reply, 0, 424, 436, 1536, 0}  ... {44, 68, reply, 0, 424, 436, 1536, 0} "\2\213+\370\1\0+\370B\271\325\371(\273\325\371\377\377\377\377\325\316\325\371\13\353\325\371\0\0\0\0\0\0\0\0\264\5\0\0\1\0\0\0" )  ) == 0x0
 03311   436   NtClose  (408, ... ) == 0x0
 03312   436   NtClose  (404, ... ) == 0x0
 03313   436   NtCreateFile  (0x3, {24, 0, 0x40, 0, 0,  (0x3, {24, 0, 0x40, 0, 0, "\Device\RasAcd"}, 0x0, 128, 3, 3, 0, 0, 0, ... 404, {status=0x0, info=0}, ) }, 0x0, 128, 3, 3, 0, 0, 0, ... 404, {status=0x0, info=0}, ) == 0x0
 03314   436   NtCreateEvent  (0x1f0003, 0x0, 1, 0, ... 408, ) == 0x0
 03315   436   NtDeviceIoControlFile  (404, 408, 0x0, 0x0, 0xf14014,  (404, 408, 0x0, 0x0, 0xf14014, "\3\0\0\0srv01.bashchelik.com\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0", 1552, 0, ... ) , 1552, 0, ... ) == STATUS_UNSUCCESSFUL
 03316   436   NtClose  (408, ... ) == 0x0
 03317   436   NtClose  (404, ... ) == 0x0
 03318   436   NtWaitForSingleObject  (240, 0, 0x0, ... ) == 0x0
 03319   436   NtWaitForSingleObject  (244, 0, 0x0, ... ) == 0x0
 03320   436   NtReleaseMutant  (244, ... 0x0, ) == 0x0
 03321   436   NtQueryValueKey  (76,  (76, "EnableAutodial", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (76, "EnableAutodial", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) }, 16, ) == 0x0
 03322   436   NtQueryValueKey  (76,  (76, "NoNetAutodial", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (76, "NoNetAutodial", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) }, 16, ) == 0x0
 03323   436   NtCreateKey  (0x2001d, {24, 48, 0x40, 0, 0,  (0x2001d, {24, 48, 0x40, 0, 0, "Software\Microsoft\RAS AutoDial"}, 0, 0x0, 0, ... 404, 2, ) }, 0, 0x0, 0, ... 404, 2, ) == 0x0
 03324   436   NtCreateKey  (0x20019, {24, 404, 0x40, 0, 0,  (0x20019, {24, 404, 0x40, 0, 0, "Default"}, 0, 0x0, 0, ... 408, 2, ) }, 0, 0x0, 0, ... 408, 2, ) == 0x0
 03325   436   NtClose  (404, ... ) == 0x0
 03326   436   NtQueryValueKey  (408,  (408, "DefaultInternet", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 03327   436   NtClose  (408, ... ) == 0x0
 03328   436   NtOpenThreadToken  (-2, 0xc, 1, ... ) == STATUS_NO_TOKEN
 03329   436   NtOpenProcessToken  (-1, 0xc, ... 408, ) == 0x0
 03330   436   NtReleaseSemaphore  (208, 1, ... 0, ) == 0x0
 03331   436   NtWaitForSingleObject  (208, 0, {0, 0}, ... ) == 0x0
 03332   436   NtClose  (408, ... ) == 0x0
 03333   436   NtOpenFile  (0x100001, {24, 0, 0x40, 0, 0,  (0x100001, {24, 0, 0x40, 0, 0, "\??\C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Connections\Pbk\"}, 3, 16417, ... 408, {status=0x0, info=1}, ) }, 3, 16417, ... 408, {status=0x0, info=1}, ) == 0x0
 03334   436   NtQueryDirectoryFile  (408, 0, 0, 0, 1237476, 616, BothDirectory, 1,  (408, 0, 0, 0, 1237476, 616, BothDirectory, 1, "<.pbk", 0, ... ) , 0, ... ) == STATUS_NO_SUCH_FILE
 03335   436   NtClose  (408, ... ) == 0x0
 03336   436   NtOpenFile  (0x100001, {24, 0, 0x40, 0, 0,  (0x100001, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\System32\Ras\"}, 3, 16417, ... 408, {status=0x0, info=1}, ) }, 3, 16417, ... 408, {status=0x0, info=1}, ) == 0x0
 03337   436   NtQueryDirectoryFile  (408, 0, 0, 0, 1237476, 616, BothDirectory, 1,  (408, 0, 0, 0, 1237476, 616, BothDirectory, 1, "<.pbk", 0, ... ) , 0, ... ) == STATUS_NO_SUCH_FILE
 03338   436   NtClose  (408, ... ) == 0x0
 03339   436   NtOpenThreadToken  (-2, 0xc, 1, ... ) == STATUS_NO_TOKEN
 03340   436   NtOpenProcessToken  (-1, 0xc, ... 408, ) == 0x0
 03341   436   NtQueryInformationToken  (408, User, 64, ... {token info, class 1, size 36}, 36, ) == 0x0
 03342   436   NtOpenKey  (0x2001f, {24, 356, 0x40, 0, 0,  (0x2001f, {24, 356, 0x40, 0, 0, "S-1-5-21-1078081533-484763869-839522115-1003"}, ... 404, ) }, ... 404, ) == 0x0
 03343   436   NtCreateKey  (0x2000000, {24, 404, 0x40, 0, 0,  (0x2000000, {24, 404, 0x40, 0, 0, "Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders"}, 0, 0x0, 0, ... 412, 2, ) }, 0, 0x0, 0, ... 412, 2, ) == 0x0
 03344   436   NtClose  (404, ... ) == 0x0
 03345   436   NtQueryValueKey  (412,  (412, "AppData", Partial, 144, ... TitleIdx=0, Type=2, Data="%\0U\0S\0E\0R\0P\0R\0O\0F\0I\0L\0E\0%\0\\0A\0p\0p\0l\0i\0c\0a\0t\0i\0o\0n\0 \0D\0a\0t\0a\0\0\0"}, 74, ) , Partial, 144, ... TitleIdx=0, Type=2, Data= (412, "AppData", Partial, 144, ... TitleIdx=0, Type=2, Data="%\0U\0S\0E\0R\0P\0R\0O\0F\0I\0L\0E\0%\0\\0A\0p\0p\0l\0i\0c\0a\0t\0i\0o\0n\0 \0D\0a\0t\0a\0\0\0"}, 74, ) }, 74, ) == 0x0
 03346   436   NtAllocateVirtualMemory  (-1, 0, 0, 1, 4096, 4, ... 10944512, 4096, ) == 0x0
 03347   436   NtAllocateVirtualMemory  (-1, 1437696, 0, 4096, 4096, 4, ... 1437696, 4096, ) == 0x0
 03348   436   NtQueryVirtualMemory  (-1, 0xa70000, Basic, 28, ... {BaseAddress=0xa70000,AllocationBase=0xa70000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 0x0, ) == 0x0
 03349   436   NtQueryVirtualMemory  (-1, 0xa70000, Basic, 28, ... {BaseAddress=0xa70000,AllocationBase=0xa70000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 0x0, ) == 0x0
 03350   436   NtOpenKey  (0x20019, {24, 48, 0x40, 0, 0,  (0x20019, {24, 48, 0x40, 0, 0, "Software\Microsoft\Windows NT\CurrentVersion\ProfileList"}, ... 404, ) }, ... 404, ) == 0x0
 03351   436   NtQueryValueKey  (404,  (404, "ProfilesDirectory", Partial, 144, ... TitleIdx=0, Type=2, Data="%\0S\0y\0s\0t\0e\0m\0D\0r\0i\0v\0e\0%\0\\0D\0o\0c\0u\0m\0e\0n\0t\0s\0 \0a\0n\0d\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\0\0"}, 86, ) , Partial, 144, ... TitleIdx=0, Type=2, Data= (404, "ProfilesDirectory", Partial, 144, ... TitleIdx=0, Type=2, Data="%\0S\0y\0s\0t\0e\0m\0D\0r\0i\0v\0e\0%\0\\0D\0o\0c\0u\0m\0e\0n\0t\0s\0 \0a\0n\0d\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\0\0"}, 86, ) }, 86, ) == 0x0
 03352   436   NtClose  (404, ... ) == 0x0
 03353   436   NtOpenKey  (0x20019, {24, 48, 0x40, 0, 0,  (0x20019, {24, 48, 0x40, 0, 0, "Software\Microsoft\Windows NT\CurrentVersion\ProfileList"}, ... 404, ) }, ... 404, ) == 0x0
 03354   436   NtQueryValueKey  (404,  (404, "AllUsersProfile", Partial, 144, ... TitleIdx=0, Type=1, Data="A\0l\0l\0 \0U\0s\0e\0r\0s\0\0\0"}, 32, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (404, "AllUsersProfile", Partial, 144, ... TitleIdx=0, Type=1, Data="A\0l\0l\0 \0U\0s\0e\0r\0s\0\0\0"}, 32, ) }, 32, ) == 0x0
 03355   436   NtClose  (404, ... ) == 0x0
 03356   436   NtQueryVirtualMemory  (-1, 0xa70000, Basic, 28, ... {BaseAddress=0xa70000,AllocationBase=0xa70000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 0x0, ) == 0x0
 03357   436   NtOpenKey  (0x1, {24, 48, 0x40, 0, 0,  (0x1, {24, 48, 0x40, 0, 0, "System\CurrentControlSet\Control\Session Manager\Environment"}, ... 404, ) }, ... 404, ) == 0x0
 03358   436   NtQueryKey  (404, Full, 176, ... {LastWrite={0x7838d13c,0x1c73999}, TitleIdx=0, Subkeys=0, Values=12, Class=""}, 44, ) == 0x0
 03359   436   NtQuerySecurityObject  (404, 7, 0, ... ) == STATUS_ACCESS_DENIED
 03360   436   NtEnumerateValueKey  (404, 0, Full, 220, ... TitleIdx=0, Type=2, Name= (404, 0, Full, 220, ... TitleIdx=0, Type=2, Name="ComSpec", Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0s\0y\0s\0t\0e\0m\03\02\0\\0c\0m\0d\0.\0e\0x\0e\0\0\0"}, 96, ) , Data= (404, 0, Full, 220, ... TitleIdx=0, Type=2, Name="ComSpec", Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0s\0y\0s\0t\0e\0m\03\02\0\\0c\0m\0d\0.\0e\0x\0e\0\0\0"}, 96, ) }, 96, ) == 0x0
 03361   436   NtEnumerateValueKey  (404, 1, Full, 220, ... TitleIdx=0, Type=2, Name= (404, 1, Full, 220, ... TitleIdx=0, Type=2, Name="Path", Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0s\0y\0s\0t\0e\0m\03\02\0;\0%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0;\0%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0W\0b\0e\0m\0\0\0"}, 152, ) , Data= (404, 1, Full, 220, ... TitleIdx=0, Type=2, Name="Path", Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0s\0y\0s\0t\0e\0m\03\02\0;\0%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0;\0%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0W\0b\0e\0m\0\0\0"}, 152, ) }, 152, ) == 0x0
 03362   436   NtEnumerateValueKey  (404, 2, Full, 220, ... TitleIdx=0, Type=2, Name= (404, 2, Full, 220, ... TitleIdx=0, Type=2, Name="windir", Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\0\0"}, 58, ) , Data= (404, 2, Full, 220, ... TitleIdx=0, Type=2, Name="windir", Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\0\0"}, 58, ) }, 58, ) == 0x0
 03363   436   NtEnumerateValueKey  (404, 3, Full, 220, ... TitleIdx=0, Type=1, Name= (404, 3, Full, 220, ... TitleIdx=0, Type=1, Name="OS", Data="W\0i\0n\0d\0o\0w\0s\0_\0N\0T\0\0\0"}, 46, ) , Data= (404, 3, Full, 220, ... TitleIdx=0, Type=1, Name="OS", Data="W\0i\0n\0d\0o\0w\0s\0_\0N\0T\0\0\0"}, 46, ) }, 46, ) == 0x0
 03364   436   NtQueryVirtualMemory  (-1, 0xa70000, Basic, 28, ... {BaseAddress=0xa70000,AllocationBase=0xa70000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 0x0, ) == 0x0
 03365   436   NtEnumerateValueKey  (404, 4, Full, 220, ... TitleIdx=0, Type=1, Name= (404, 4, Full, 220, ... TitleIdx=0, Type=1, Name="PROCESSOR_ARCHITECTURE", Data="x\08\06\0\0\0"}, 72, ) , Data= (404, 4, Full, 220, ... TitleIdx=0, Type=1, Name="PROCESSOR_ARCHITECTURE", Data="x\08\06\0\0\0"}, 72, ) }, 72, ) == 0x0
 03366   436   NtQueryVirtualMemory  (-1, 0xa70000, Basic, 28, ... {BaseAddress=0xa70000,AllocationBase=0xa70000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 0x0, ) == 0x0
 03367   436   NtEnumerateValueKey  (404, 5, Full, 220, ... TitleIdx=0, Type=1, Name= (404, 5, Full, 220, ... TitleIdx=0, Type=1, Name="PROCESSOR_LEVEL", Data="1\05\0\0\0"}, 58, ) , Data= (404, 5, Full, 220, ... TitleIdx=0, Type=1, Name="PROCESSOR_LEVEL", Data="1\05\0\0\0"}, 58, ) }, 58, ) == 0x0
 03368   436   NtQueryVirtualMemory  (-1, 0xa70000, Basic, 28, ... {BaseAddress=0xa70000,AllocationBase=0xa70000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 0x0, ) == 0x0
 03369   436   NtEnumerateValueKey  (404, 6, Full, 220, ... TitleIdx=0, Type=1, Name= (404, 6, Full, 220, ... TitleIdx=0, Type=1, Name="PROCESSOR_IDENTIFIER", Data="x\08\06\0 \0F\0a\0m\0i\0l\0y\0 \01\05\0 \0M\0o\0d\0e\0l\0 \04\0 \0S\0t\0e\0p\0p\0i\0n\0g\0 \08\0,\0 \0G\0e\0n\0u\0i\0n\0e\0I\0n\0t\0e\0l\0\0\0"}, 154, ) , Data= (404, 6, Full, 220, ... TitleIdx=0, Type=1, Name="PROCESSOR_IDENTIFIER", Data="x\08\06\0 \0F\0a\0m\0i\0l\0y\0 \01\05\0 \0M\0o\0d\0e\0l\0 \04\0 \0S\0t\0e\0p\0p\0i\0n\0g\0 \08\0,\0 \0G\0e\0n\0u\0i\0n\0e\0I\0n\0t\0e\0l\0\0\0"}, 154, ) }, 154, ) == 0x0
 03370   436   NtQueryVirtualMemory  (-1, 0xa70000, Basic, 28, ... {BaseAddress=0xa70000,AllocationBase=0xa70000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 0x0, ) == 0x0
 03371   436   NtEnumerateValueKey  (404, 7, Full, 220, ... TitleIdx=0, Type=1, Name= (404, 7, Full, 220, ... TitleIdx=0, Type=1, Name="PROCESSOR_REVISION", Data="0\04\00\08\0\0\0"}, 66, ) , Data= (404, 7, Full, 220, ... TitleIdx=0, Type=1, Name="PROCESSOR_REVISION", Data="0\04\00\08\0\0\0"}, 66, ) }, 66, ) == 0x0
 03372   436   NtQueryVirtualMemory  (-1, 0xa70000, Basic, 28, ... {BaseAddress=0xa70000,AllocationBase=0xa70000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 0x0, ) == 0x0
 03373   436   NtEnumerateValueKey  (404, 8, Full, 220, ... TitleIdx=0, Type=1, Name= (404, 8, Full, 220, ... TitleIdx=0, Type=1, Name="NUMBER_OF_PROCESSORS", Data="1\0\0\0"}, 64, ) , Data= (404, 8, Full, 220, ... TitleIdx=0, Type=1, Name="NUMBER_OF_PROCESSORS", Data="1\0\0\0"}, 64, ) }, 64, ) == 0x0
 03374   436   NtQueryVirtualMemory  (-1, 0xa70000, Basic, 28, ... {BaseAddress=0xa70000,AllocationBase=0xa70000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 0x0, ) == 0x0
 03375   436   NtEnumerateValueKey  (404, 9, Full, 220, ... TitleIdx=0, Type=1, Name= (404, 9, Full, 220, ... TitleIdx=0, Type=1, Name="PATHEXT", Data=".\0C\0O\0M\0;\0.\0E\0X\0E\0;\0.\0B\0A\0T\0;\0.\0C\0M\0D\0;\0.\0V\0B\0S\0;\0.\0V\0B\0E\0;\0.\0J\0S\0;\0.\0J\0S\0E\0;\0.\0W\0S\0F\0;\0.\0W\0S\0H\0\0\0"}, 134, ) , Data= (404, 9, Full, 220, ... TitleIdx=0, Type=1, Name="PATHEXT", Data=".\0C\0O\0M\0;\0.\0E\0X\0E\0;\0.\0B\0A\0T\0;\0.\0C\0M\0D\0;\0.\0V\0B\0S\0;\0.\0V\0B\0E\0;\0.\0J\0S\0;\0.\0J\0S\0E\0;\0.\0W\0S\0F\0;\0.\0W\0S\0H\0\0\0"}, 134, ) }, 134, ) == 0x0
 03376   436   NtQueryVirtualMemory  (-1, 0xa70000, Basic, 28, ... {BaseAddress=0xa70000,AllocationBase=0xa70000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 0x0, ) == 0x0
 03377   436   NtEnumerateValueKey  (404, 10, Full, 220, ... TitleIdx=0, Type=2, Name= (404, 10, Full, 220, ... TitleIdx=0, Type=2, Name="TEMP", Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0T\0E\0M\0P\0\0\0"}, 64, ) , Data= (404, 10, Full, 220, ... TitleIdx=0, Type=2, Name="TEMP", Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0T\0E\0M\0P\0\0\0"}, 64, ) }, 64, ) == 0x0
 03378   436   NtEnumerateValueKey  (404, 11, Full, 220, ... TitleIdx=0, Type=2, Name= (404, 11, Full, 220, ... TitleIdx=0, Type=2, Name="TMP", Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0T\0E\0M\0P\0\0\0"}, 64, ) , Data= (404, 11, Full, 220, ... TitleIdx=0, Type=2, Name="TMP", Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0T\0E\0M\0P\0\0\0"}, 64, ) }, 64, ) == 0x0
 03379   436   NtEnumerateValueKey  (404, 0, Full, 220, ... TitleIdx=0, Type=2, Name= (404, 0, Full, 220, ... TitleIdx=0, Type=2, Name="ComSpec", Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0s\0y\0s\0t\0e\0m\03\02\0\\0c\0m\0d\0.\0e\0x\0e\0\0\0"}, 96, ) , Data= (404, 0, Full, 220, ... TitleIdx=0, Type=2, Name="ComSpec", Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0s\0y\0s\0t\0e\0m\03\02\0\\0c\0m\0d\0.\0e\0x\0e\0\0\0"}, 96, ) }, 96, ) == 0x0
 03380   436   NtQueryVirtualMemory  (-1, 0xa70000, Basic, 28, ... {BaseAddress=0xa70000,AllocationBase=0xa70000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 0x0, ) == 0x0
 03381   436   NtEnumerateValueKey  (404, 1, Full, 220, ... TitleIdx=0, Type=2, Name= (404, 1, Full, 220, ... TitleIdx=0, Type=2, Name="Path", Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0s\0y\0s\0t\0e\0m\03\02\0;\0%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0;\0%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0W\0b\0e\0m\0\0\0"}, 152, ) , Data= (404, 1, Full, 220, ... TitleIdx=0, Type=2, Name="Path", Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0s\0y\0s\0t\0e\0m\03\02\0;\0%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0;\0%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0W\0b\0e\0m\0\0\0"}, 152, ) }, 152, ) == 0x0
 03382   436   NtQueryVirtualMemory  (-1, 0xa70000, Basic, 28, ... {BaseAddress=0xa70000,AllocationBase=0xa70000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 0x0, ) == 0x0
 03383   436   NtEnumerateValueKey  (404, 2, Full, 220, ... TitleIdx=0, Type=2, Name= (404, 2, Full, 220, ... TitleIdx=0, Type=2, Name="windir", Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\0\0"}, 58, ) , Data= (404, 2, Full, 220, ... TitleIdx=0, Type=2, Name="windir", Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\0\0"}, 58, ) }, 58, ) == 0x0
 03384   436   NtQueryVirtualMemory  (-1, 0xa70000, Basic, 28, ... {BaseAddress=0xa70000,AllocationBase=0xa70000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 0x0, ) == 0x0
 03385   436   NtEnumerateValueKey  (404, 3, Full, 220, ... TitleIdx=0, Type=1, Name= (404, 3, Full, 220, ... TitleIdx=0, Type=1, Name="OS", Data="W\0i\0n\0d\0o\0w\0s\0_\0N\0T\0\0\0"}, 46, ) , Data= (404, 3, Full, 220, ... TitleIdx=0, Type=1, Name="OS", Data="W\0i\0n\0d\0o\0w\0s\0_\0N\0T\0\0\0"}, 46, ) }, 46, ) == 0x0
 03386   436   NtEnumerateValueKey  (404, 4, Full, 220, ... TitleIdx=0, Type=1, Name= (404, 4, Full, 220, ... TitleIdx=0, Type=1, Name="PROCESSOR_ARCHITECTURE", Data="x\08\06\0\0\0"}, 72, ) , Data= (404, 4, Full, 220, ... TitleIdx=0, Type=1, Name="PROCESSOR_ARCHITECTURE", Data="x\08\06\0\0\0"}, 72, ) }, 72, ) == 0x0
 03387   436   NtEnumerateValueKey  (404, 5, Full, 220, ... TitleIdx=0, Type=1, Name= (404, 5, Full, 220, ... TitleIdx=0, Type=1, Name="PROCESSOR_LEVEL", Data="1\05\0\0\0"}, 58, ) , Data= (404, 5, Full, 220, ... TitleIdx=0, Type=1, Name="PROCESSOR_LEVEL", Data="1\05\0\0\0"}, 58, ) }, 58, ) == 0x0
 03388   436   NtEnumerateValueKey  (404, 6, Full, 220, ... TitleIdx=0, Type=1, Name= (404, 6, Full, 220, ... TitleIdx=0, Type=1, Name="PROCESSOR_IDENTIFIER", Data="x\08\06\0 \0F\0a\0m\0i\0l\0y\0 \01\05\0 \0M\0o\0d\0e\0l\0 \04\0 \0S\0t\0e\0p\0p\0i\0n\0g\0 \08\0,\0 \0G\0e\0n\0u\0i\0n\0e\0I\0n\0t\0e\0l\0\0\0"}, 154, ) , Data= (404, 6, Full, 220, ... TitleIdx=0, Type=1, Name="PROCESSOR_IDENTIFIER", Data="x\08\06\0 \0F\0a\0m\0i\0l\0y\0 \01\05\0 \0M\0o\0d\0e\0l\0 \04\0 \0S\0t\0e\0p\0p\0i\0n\0g\0 \08\0,\0 \0G\0e\0n\0u\0i\0n\0e\0I\0n\0t\0e\0l\0\0\0"}, 154, ) }, 154, ) == 0x0
 03389   436   NtEnumerateValueKey  (404, 7, Full, 220, ... TitleIdx=0, Type=1, Name= (404, 7, Full, 220, ... TitleIdx=0, Type=1, Name="PROCESSOR_REVISION", Data="0\04\00\08\0\0\0"}, 66, ) , Data= (404, 7, Full, 220, ... TitleIdx=0, Type=1, Name="PROCESSOR_REVISION", Data="0\04\00\08\0\0\0"}, 66, ) }, 66, ) == 0x0
 03390   436   NtEnumerateValueKey  (404, 8, Full, 220, ... TitleIdx=0, Type=1, Name= (404, 8, Full, 220, ... TitleIdx=0, Type=1, Name="NUMBER_OF_PROCESSORS", Data="1\0\0\0"}, 64, ) , Data= (404, 8, Full, 220, ... TitleIdx=0, Type=1, Name="NUMBER_OF_PROCESSORS", Data="1\0\0\0"}, 64, ) }, 64, ) == 0x0
 03391   436   NtEnumerateValueKey  (404, 9, Full, 220, ... TitleIdx=0, Type=1, Name= (404, 9, Full, 220, ... TitleIdx=0, Type=1, Name="PATHEXT", Data=".\0C\0O\0M\0;\0.\0E\0X\0E\0;\0.\0B\0A\0T\0;\0.\0C\0M\0D\0;\0.\0V\0B\0S\0;\0.\0V\0B\0E\0;\0.\0J\0S\0;\0.\0J\0S\0E\0;\0.\0W\0S\0F\0;\0.\0W\0S\0H\0\0\0"}, 134, ) , Data= (404, 9, Full, 220, ... TitleIdx=0, Type=1, Name="PATHEXT", Data=".\0C\0O\0M\0;\0.\0E\0X\0E\0;\0.\0B\0A\0T\0;\0.\0C\0M\0D\0;\0.\0V\0B\0S\0;\0.\0V\0B\0E\0;\0.\0J\0S\0;\0.\0J\0S\0E\0;\0.\0W\0S\0F\0;\0.\0W\0S\0H\0\0\0"}, 134, ) }, 134, ) == 0x0
 03392   436   NtEnumerateValueKey  (404, 10, Full, 220, ... TitleIdx=0, Type=2, Name= (404, 10, Full, 220, ... TitleIdx=0, Type=2, Name="TEMP", Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0T\0E\0M\0P\0\0\0"}, 64, ) , Data= (404, 10, Full, 220, ... TitleIdx=0, Type=2, Name="TEMP", Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0T\0E\0M\0P\0\0\0"}, 64, ) }, 64, ) == 0x0
 03393   436   NtQueryInformationProcess  (-1, DefaultHardErrorMode, 4, ... {process info, class 12, size 4}, 0x0, ) == 0x0
 03394   436   NtSetInformationProcess  (-1, DefaultHardErrorMode, {process info, class 12, size 4}, 4, ... ) == 0x0
 03395   436   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\TEMP"}, 1236548, ... ) }, 1236548, ... ) == 0x0
 03396   436   NtQueryInformationProcess  (-1, DefaultHardErrorMode, 4, ... {process info, class 12, size 4}, 0x0, ) == 0x0
 03397   436   NtSetInformationProcess  (-1, DefaultHardErrorMode, {process info, class 12, size 4}, 4, ... ) == 0x0
 03398   436   NtQueryVirtualMemory  (-1, 0xa70000, Basic, 28, ... {BaseAddress=0xa70000,AllocationBase=0xa70000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 0x0, ) == 0x0
 03399   436   NtEnumerateValueKey  (404, 11, Full, 220, ... TitleIdx=0, Type=2, Name= (404, 11, Full, 220, ... TitleIdx=0, Type=2, Name="TMP", Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0T\0E\0M\0P\0\0\0"}, 64, ) , Data= (404, 11, Full, 220, ... TitleIdx=0, Type=2, Name="TMP", Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0T\0E\0M\0P\0\0\0"}, 64, ) }, 64, ) == 0x0
 03400   436   NtQueryInformationProcess  (-1, DefaultHardErrorMode, 4, ... {process info, class 12, size 4}, 0x0, ) == 0x0
 03401   436   NtSetInformationProcess  (-1, DefaultHardErrorMode, {process info, class 12, size 4}, 4, ... ) == 0x0
 03402   436   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\TEMP"}, 1236548, ... ) }, 1236548, ... ) == 0x0
 03403   436   NtQueryInformationProcess  (-1, DefaultHardErrorMode, 4, ... {process info, class 12, size 4}, 0x0, ) == 0x0
 03404   436   NtSetInformationProcess  (-1, DefaultHardErrorMode, {process info, class 12, size 4}, 4, ... ) == 0x0
 03405   436   NtQueryVirtualMemory  (-1, 0xa70000, Basic, 28, ... {BaseAddress=0xa70000,AllocationBase=0xa70000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 0x0, ) == 0x0
 03406   436   NtClose  (404, ... ) == 0x0
 03407   436   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\System\CurrentControlSet\Control\ComputerName"}, ... 404, ) }, ... 404, ) == 0x0
 03408   436   NtOpenKey  (0x20019, {24, 404, 0x40, 0, 0,  (0x20019, {24, 404, 0x40, 0, 0, "ActiveComputerName"}, ... 416, ) }, ... 416, ) == 0x0
 03409   436   NtQueryValueKey  (416,  (416, "ComputerName", Full, 108, ... TitleIdx=0, Type=1, Name="ComputerName", Data="M\0Y\0W\0O\0R\0L\0D\0\0\0"}, 60, ) , Full, 108, ... TitleIdx=0, Type=1, Name= (416, "ComputerName", Full, 108, ... TitleIdx=0, Type=1, Name="ComputerName", Data="M\0Y\0W\0O\0R\0L\0D\0\0\0"}, 60, ) , Data= (416, "ComputerName", Full, 108, ... TitleIdx=0, Type=1, Name="ComputerName", Data="M\0Y\0W\0O\0R\0L\0D\0\0\0"}, 60, ) }, 60, ) == 0x0
 03410   436   NtClose  (416, ... ) == 0x0
 03411   436   NtClose  (404, ... ) == 0x0
 03412   436   NtQueryVirtualMemory  (-1, 0xa70000, Basic, 28, ... {BaseAddress=0xa70000,AllocationBase=0xa70000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 0x0, ) == 0x0
 03413   436   NtOpenKey  (0x20019, {24, 48, 0x40, 0, 0,  (0x20019, {24, 48, 0x40, 0, 0, "Software\Microsoft\Windows NT\CurrentVersion\ProfileList"}, ... 404, ) }, ... 404, ) == 0x0
 03414   436   NtQueryValueKey  (404,  (404, "ProfilesDirectory", Partial, 144, ... TitleIdx=0, Type=2, Data="%\0S\0y\0s\0t\0e\0m\0D\0r\0i\0v\0e\0%\0\\0D\0o\0c\0u\0m\0e\0n\0t\0s\0 \0a\0n\0d\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\0\0"}, 86, ) , Partial, 144, ... TitleIdx=0, Type=2, Data= (404, "ProfilesDirectory", Partial, 144, ... TitleIdx=0, Type=2, Data="%\0S\0y\0s\0t\0e\0m\0D\0r\0i\0v\0e\0%\0\\0D\0o\0c\0u\0m\0e\0n\0t\0s\0 \0a\0n\0d\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\0\0"}, 86, ) }, 86, ) == 0x0
 03415   436   NtClose  (404, ... ) == 0x0
 03416   436   NtOpenKey  (0x20019, {24, 48, 0x40, 0, 0,  (0x20019, {24, 48, 0x40, 0, 0, "Software\Microsoft\Windows NT\CurrentVersion\ProfileList"}, ... 404, ) }, ... 404, ) == 0x0
 03417   436   NtQueryValueKey  (404,  (404, "DefaultUserProfile", Partial, 144, ... TitleIdx=0, Type=1, Data="D\0e\0f\0a\0u\0l\0t\0 \0U\0s\0e\0r\0\0\0"}, 38, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (404, "DefaultUserProfile", Partial, 144, ... TitleIdx=0, Type=1, Data="D\0e\0f\0a\0u\0l\0t\0 \0U\0s\0e\0r\0\0\0"}, 38, ) }, 38, ) == 0x0
 03418   436   NtClose  (404, ... ) == 0x0
 03419   436   NtQueryVirtualMemory  (-1, 0xa70000, Basic, 28, ... {BaseAddress=0xa70000,AllocationBase=0xa70000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 0x0, ) == 0x0
 03420   436   NtOpenKey  (0x20019, {24, 48, 0x40, 0, 0,  (0x20019, {24, 48, 0x40, 0, 0, "Software\Microsoft\Windows\CurrentVersion"}, ... 404, ) }, ... 404, ) == 0x0
 03421   436   NtQueryValueKey  (404,  (404, "ProgramFilesDir", Partial, 144, ... TitleIdx=0, Type=1, Data="C\0:\0\\0P\0r\0o\0g\0r\0a\0m\0 \0F\0i\0l\0e\0s\0\0\0"}, 46, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (404, "ProgramFilesDir", Partial, 144, ... TitleIdx=0, Type=1, Data="C\0:\0\\0P\0r\0o\0g\0r\0a\0m\0 \0F\0i\0l\0e\0s\0\0\0"}, 46, ) }, 46, ) == 0x0
 03422   436   NtQueryVirtualMemory  (-1, 0xa70000, Basic, 28, ... {BaseAddress=0xa70000,AllocationBase=0xa70000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 0x0, ) == 0x0
 03423   436   NtQueryValueKey  (404,  (404, "CommonFilesDir", Partial, 144, ... TitleIdx=0, Type=1, Data="C\0:\0\\0P\0r\0o\0g\0r\0a\0m\0 \0F\0i\0l\0e\0s\0\\0C\0o\0m\0m\0o\0n\0 \0F\0i\0l\0e\0s\0\0\0"}, 72, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (404, "CommonFilesDir", Partial, 144, ... TitleIdx=0, Type=1, Data="C\0:\0\\0P\0r\0o\0g\0r\0a\0m\0 \0F\0i\0l\0e\0s\0\\0C\0o\0m\0m\0o\0n\0 \0F\0i\0l\0e\0s\0\0\0"}, 72, ) }, 72, ) == 0x0
 03424   436   NtQueryVirtualMemory  (-1, 0xa70000, Basic, 28, ... {BaseAddress=0xa70000,AllocationBase=0xa70000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 0x0, ) == 0x0
 03425   436   NtClose  (404, ... ) == 0x0
 03426   436   NtQueryInformationToken  (408, User, 200, ... {token info, class 1, size 36}, 36, ) == 0x0
 03427   436   NtOpenKey  (0x20019, {24, 356, 0x40, 0, 0,  (0x20019, {24, 356, 0x40, 0, 0, "S-1-5-21-1078081533-484763869-839522115-1003"}, ... 404, ) }, ... 404, ) == 0x0
 03428   436   NtOpenThreadToken  (-2, 0x2000c, 1, ... ) == STATUS_NO_TOKEN
 03429   436   NtQueryInformationToken  (408, Type, 4, ... {token info, class 8, size 4}, 4, ) == 0x0
 03430   436   NtDuplicateToken  (408, 0xc, {24, 0, 0x0, 0, 1237932, 0x0}, 0, 2, ... ) == STATUS_ACCESS_DENIED
 03431   436   NtQueryInformationToken  (408, User, 200, ... {token info, class 1, size 36}, 36, ) == 0x0
 03432   436   NtOpenThreadToken  (-2, 0xc, 1, ... ) == STATUS_NO_TOKEN
 03433   436   NtCreateEvent  (0x1f0003, 0x0, 1, 0, ... 416, ) == 0x0
 03434   436   NtOpenThreadToken  (-2, 0xc, 1, ... ) == STATUS_NO_TOKEN
 03435   436   NtSetInformationThread  (-2, ImpersonationToken, {ImpToken=0,}, 4, ... ) == 0x0
 03436   436   NtCreateFile  (0xc0100080, {24, 0, 0x40, 0, 1236136,  (0xc0100080, {24, 0, 0x40, 0, 1236136, "\??\PIPE\lsarpc"}, 0x0, 0, 3, 1, 64, 0, 0, ... 420, {status=0x0, info=1}, ) }, 0x0, 0, 3, 1, 64, 0, 0, ... 420, {status=0x0, info=1}, ) == 0x0
 03437   436   NtSetInformationFile  (420, 1236192, 8, Pipe, ... {status=0x0, info=0}, ) == 0x0
 03438   436   NtSetInformationFile  (420, 1236184, 8, Completion, ... {status=0x0, info=0}, ) == 0x0
 03439   436   NtSetInformationThread  (-2, ImpersonationToken, {ImpToken=0,}, 4, ... ) == 0x0
 03440   436   NtWriteFile  (420, 325, 0, 0,  (420, 325, 0, 0, "\5\0\13\3\20\0\0\0H\0\0\0\1\0\0\0\270\20\270\20\0\0\0\0\1\0\0\0\0\0\1\0xW4\224\22\315\253\357\0\1#Eg\211\253\0\0\0\0\4]\210\212\353\34\311\21\237\350\10\0+\20H`\2\0\0\0", 72, {0, 0}, 0, ... {status=0x0, info=72}, ) , 72, {0, 0}, 0, ... {status=0x0, info=72}, ) == 0x0
 03441   436   NtReadFile  (420, 325, 0, 0, 1024, {0, 0}, 0, ... {status=0x0, info=68},  (420, 325, 0, 0, 1024, {0, 0}, 0, ... {status=0x0, info=68}, "\5\0\14\3\20\0\0\0D\0\0\0\1\0\0\0\270\20\270\20\357\36\0\0\14\0\PIPE\lsass\0\0\0\1\0\0\0\0\0\0\0\4]\210\212\353\34\311\21\237\350\10\0+\20H`\2\0\0\0", ) , ) == 0x0
 03442   436   NtFsControlFile  (420, 325, 0x0, 0x0, 0x11c017,  (420, 325, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0@\0\0\0\1\0\0\0(\0\0\0\0\0,\0\0\0\0\0\30\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\\343\22\0\14\0\0\0\2\0\1\0\0\10\0\0", 64, 1024, ... {status=0x103, info=68}, "\5\0\14\3\20\0\0\0D\0\0\0\1\0\0\0\270\20\270\20\357\36\0\0\14\0\PIPE\lsass\0\0\0\1\0\0\0\0\0\0\0\4]\210\212\353\34\311\21\237\350\10\0+\20H`\2\0\0\0", ) , 64, 1024, ... {status=0x103, info=68},  (420, 325, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0@\0\0\0\1\0\0\0(\0\0\0\0\0,\0\0\0\0\0\30\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\\343\22\0\14\0\0\0\2\0\1\0\0\10\0\0", 64, 1024, ... {status=0x103, info=68}, "\5\0\14\3\20\0\0\0D\0\0\0\1\0\0\0\270\20\270\20\357\36\0\0\14\0\PIPE\lsass\0\0\0\1\0\0\0\0\0\0\0\4]\210\212\353\34\311\21\237\350\10\0+\20H`\2\0\0\0", ) , ) == 0x103
 03443   436   NtFsControlFile  (420, 325, 0x0, 0x0, 0x11c017,  (420, 325, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0t\0\0\0\2\0\0\0\\0\0\0\0\09\0\0\0\0\0\241\350\250\331*,\334\21\261\306\0\14)\371\246\305\1\0\0\0\224\343\22\0\1\0\0\0\330\335\25\0\5\0\0\0\1\5\0\0\0\0\0\5\25\0\0\0\3757B@\335\350\344\34C\27\122\353\3\0\0\0\0\0\0\0\0\0\0\1\0l\0\0\0\0\0\0\0\0\0\2\0\0\0", 116, 1024, ... {status=0x103, info=48}, "\5\0\2\3\20\0\0\00\0\0\0\1\0\0\0\30\0\0\0\0\0\0\0\0\0\0\0\241\350\250\331*,\334\21\261\306\0\14)\371\246\305\0\0\0\0", ) , 116, 1024, ... {status=0x103, info=48},  (420, 325, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0t\0\0\0\2\0\0\0\\0\0\0\0\09\0\0\0\0\0\241\350\250\331*,\334\21\261\306\0\14)\371\246\305\1\0\0\0\224\343\22\0\1\0\0\0\330\335\25\0\5\0\0\0\1\5\0\0\0\0\0\5\25\0\0\0\3757B@\335\350\344\34C\27\122\353\3\0\0\0\0\0\0\0\0\0\0\1\0l\0\0\0\0\0\0\0\0\0\2\0\0\0", 116, 1024, ... {status=0x103, info=48}, "\5\0\2\3\20\0\0\00\0\0\0\1\0\0\0\30\0\0\0\0\0\0\0\0\0\0\0\241\350\250\331*,\334\21\261\306\0\14)\371\246\305\0\0\0\0", ) , ) == 0x103
 03444   436   NtFsControlFile  (420, 325, 0x0, 0x0, 0x11c017,  (420, 325, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0,\0\0\0\3\0\0\0\24\0\0\0\0\0\0\0\0\0\0\0\241\350\250\331*,\334\21\261\306\0\14)\371\246\305", 44, 1024, ... {status=0x103, info=180}, "\5\0\2\3\20\0\0\0\264\0\0\0\2\0\0\0\234\0\0\0\0\0\0\0\20\264\25\0\1\0\0\0\34\264\25\0 \0\0\0\1\0\0\0\16\0\20\0(\264\25\08\264\25\0\10\0\0\0\0\0\0\0\7\0\0\0M\0Y\0W\0O\0R\0L\0D\0O\0\4\0\0\0\1\4\0\0\0\0\0\5\25\0\0\0\3757B@\335\350\344\34C\27\122\1\0\0\0\310\266\25\0\1\0\0\0\1\0\0\0\20\0\22\0\334\266\25\0\0\0\0\0\0\0\0\0\11\0\0\0\0\0\0\0\10\0\0\0S\0R\0I\0-\0u\0s\0e\0r\0\1\0\0\0\0\0\0\0", ) , 44, 1024, ... {status=0x103, info=180},  (420, 325, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0,\0\0\0\3\0\0\0\24\0\0\0\0\0\0\0\0\0\0\0\241\350\250\331*,\334\21\261\306\0\14)\371\246\305", 44, 1024, ... {status=0x103, info=180}, "\5\0\2\3\20\0\0\0\264\0\0\0\2\0\0\0\234\0\0\0\0\0\0\0\20\264\25\0\1\0\0\0\34\264\25\0 \0\0\0\1\0\0\0\16\0\20\0(\264\25\08\264\25\0\10\0\0\0\0\0\0\0\7\0\0\0M\0Y\0W\0O\0R\0L\0D\0O\0\4\0\0\0\1\4\0\0\0\0\0\5\25\0\0\0\3757B@\335\350\344\34C\27\122\1\0\0\0\310\266\25\0\1\0\0\0\1\0\0\0\20\0\22\0\334\266\25\0\0\0\0\0\0\0\0\0\11\0\0\0\0\0\0\0\10\0\0\0S\0R\0I\0-\0u\0s\0e\0r\0\1\0\0\0\0\0\0\0", ) , ) == 0x103
 03445   436   NtClose  (416, ... ) == 0x0
 03446   436   NtClose  (420, ... ) == 0x0
 03447   436   NtOpenThreadToken  (-2, 0xc, 1, ... ) == STATUS_NO_TOKEN
 03448   436   NtCreateEvent  (0x1f0003, 0x0, 1, 0, ... 420, ) == 0x0
 03449   436   NtOpenThreadToken  (-2, 0xc, 1, ... ) == STATUS_NO_TOKEN
 03450   436   NtSetInformationThread  (-2, ImpersonationToken, {ImpToken=0,}, 4, ... ) == 0x0
 03451   436   NtCreateFile  (0xc0100080, {24, 0, 0x40, 0, 1236132,  (0xc0100080, {24, 0, 0x40, 0, 1236132, "\??\PIPE\lsarpc"}, 0x0, 0, 3, 1, 64, 0, 0, ... 416, {status=0x0, info=1}, ) }, 0x0, 0, 3, 1, 64, 0, 0, ... 416, {status=0x0, info=1}, ) == 0x0
 03452   436   NtSetInformationFile  (416, 1236188, 8, Pipe, ... {status=0x0, info=0}, ) == 0x0
 03453   436   NtSetInformationFile  (416, 1236180, 8, Completion, ... {status=0x0, info=0}, ) == 0x0
 03454   436   NtSetInformationThread  (-2, ImpersonationToken, {ImpToken=0,}, 4, ... ) == 0x0
 03455   436   NtWriteFile  (416, 325, 0, 0,  (416, 325, 0, 0, "\5\0\13\3\20\0\0\0H\0\0\0\1\0\0\0\270\20\270\20\0\0\0\0\1\0\0\0\0\0\1\0xW4\224\22\315\253\357\0\1#Eg\211\253\0\0\0\0\4]\210\212\353\34\311\21\237\350\10\0+\20H`\2\0\0\0", 72, {0, 0}, 0, ... {status=0x0, info=72}, ) , 72, {0, 0}, 0, ... {status=0x0, info=72}, ) == 0x0
 03456   436   NtReadFile  (416, 325, 0, 0, 1024, {0, 0}, 0, ... {status=0x0, info=68},  (416, 325, 0, 0, 1024, {0, 0}, 0, ... {status=0x0, info=68}, "\5\0\14\3\20\0\0\0D\0\0\0\1\0\0\0\270\20\270\20\360\36\0\0\14\0\PIPE\lsass\0\0\0\1\0\0\0\0\0\0\0\4]\210\212\353\34\311\21\237\350\10\0+\20H`\2\0\0\0", ) , ) == 0x0
 03457   436   NtFsControlFile  (416, 325, 0x0, 0x0, 0x11c017,  (416, 325, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0@\0\0\0\1\0\0\0(\0\0\0\0\0,\0\0\0\0\0\30\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0X\343\22\0\14\0\0\0\2\0\1\0\0\10\0\0", 64, 1024, ... {status=0x103, info=68}, "\5\0\14\3\20\0\0\0D\0\0\0\1\0\0\0\270\20\270\20\360\36\0\0\14\0\PIPE\lsass\0\0\0\1\0\0\0\0\0\0\0\4]\210\212\353\34\311\21\237\350\10\0+\20H`\2\0\0\0", ) , 64, 1024, ... {status=0x103, info=68},  (416, 325, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0@\0\0\0\1\0\0\0(\0\0\0\0\0,\0\0\0\0\0\30\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0X\343\22\0\14\0\0\0\2\0\1\0\0\10\0\0", 64, 1024, ... {status=0x103, info=68}, "\5\0\14\3\20\0\0\0D\0\0\0\1\0\0\0\270\20\270\20\360\36\0\0\14\0\PIPE\lsass\0\0\0\1\0\0\0\0\0\0\0\4]\210\212\353\34\311\21\237\350\10\0+\20H`\2\0\0\0", ) , ) == 0x103
 03458   436   NtFsControlFile  (416, 325, 0x0, 0x0, 0x11c017,  (416, 325, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0t\0\0\0\2\0\0\0\\0\0\0\0\09\0\0\0\0\0\242\350\250\331*,\334\21\261\306\0\14)\371\246\305\1\0\0\0\220\343\22\0\1\0\0\0\330\335\25\0\5\0\0\0\1\5\0\0\0\0\0\5\25\0\0\0\3757B@\335\350\344\34C\27\122\353\3\0\0\0\0\0\0\0\0\0\0\1\0l\0\0\0\0\0\0\0\0\0\2\0\0\0", 116, 1024, ... {status=0x103, info=48}, "\5\0\2\3\20\0\0\00\0\0\0\1\0\0\0\30\0\0\0\0\0\0\0\0\0\0\0\242\350\250\331*,\334\21\261\306\0\14)\371\246\305\0\0\0\0", ) , 116, 1024, ... {status=0x103, info=48},  (416, 325, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0t\0\0\0\2\0\0\0\\0\0\0\0\09\0\0\0\0\0\242\350\250\331*,\334\21\261\306\0\14)\371\246\305\1\0\0\0\220\343\22\0\1\0\0\0\330\335\25\0\5\0\0\0\1\5\0\0\0\0\0\5\25\0\0\0\3757B@\335\350\344\34C\27\122\353\3\0\0\0\0\0\0\0\0\0\0\1\0l\0\0\0\0\0\0\0\0\0\2\0\0\0", 116, 1024, ... {status=0x103, info=48}, "\5\0\2\3\20\0\0\00\0\0\0\1\0\0\0\30\0\0\0\0\0\0\0\0\0\0\0\242\350\250\331*,\334\21\261\306\0\14)\371\246\305\0\0\0\0", ) , ) == 0x103
 03459   436   NtFsControlFile  (416, 325, 0x0, 0x0, 0x11c017,  (416, 325, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0,\0\0\0\3\0\0\0\24\0\0\0\0\0\0\0\0\0\0\0\242\350\250\331*,\334\21\261\306\0\14)\371\246\305", 44, 1024, ... {status=0x103, info=180}, "\5\0\2\3\20\0\0\0\264\0\0\0\2\0\0\0\234\0\0\0\0\0\0\0\20\264\25\0\1\0\0\0\34\264\25\0 \0\0\0\1\0\0\0\16\0\20\0(\264\25\08\264\25\0\10\0\0\0\0\0\0\0\7\0\0\0M\0Y\0W\0O\0R\0L\0D\0O\0\4\0\0\0\1\4\0\0\0\0\0\5\25\0\0\0\3757B@\335\350\344\34C\27\122\1\0\0\0\310\266\25\0\1\0\0\0\1\0\0\0\20\0\22\0\334\266\25\0\0\0\0\0\0\0\0\0\11\0\0\0\0\0\0\0\10\0\0\0S\0R\0I\0-\0u\0s\0e\0r\0\1\0\0\0\0\0\0\0", ) , 44, 1024, ... {status=0x103, info=180},  (416, 325, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0,\0\0\0\3\0\0\0\24\0\0\0\0\0\0\0\0\0\0\0\242\350\250\331*,\334\21\261\306\0\14)\371\246\305", 44, 1024, ... {status=0x103, info=180}, "\5\0\2\3\20\0\0\0\264\0\0\0\2\0\0\0\234\0\0\0\0\0\0\0\20\264\25\0\1\0\0\0\34\264\25\0 \0\0\0\1\0\0\0\16\0\20\0(\264\25\08\264\25\0\10\0\0\0\0\0\0\0\7\0\0\0M\0Y\0W\0O\0R\0L\0D\0O\0\4\0\0\0\1\4\0\0\0\0\0\5\25\0\0\0\3757B@\335\350\344\34C\27\122\1\0\0\0\310\266\25\0\1\0\0\0\1\0\0\0\20\0\22\0\334\266\25\0\0\0\0\0\0\0\0\0\11\0\0\0\0\0\0\0\10\0\0\0S\0R\0I\0-\0u\0s\0e\0r\0\1\0\0\0\0\0\0\0", ) , ) == 0x103
 03460   436   NtClose  (420, ... ) == 0x0
 03461   436   NtClose  (416, ... ) == 0x0
 03462   436   NtQueryVirtualMemory  (-1, 0xa70000, Basic, 28, ... {BaseAddress=0xa70000,AllocationBase=0xa70000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 0x0, ) == 0x0
 03463   436   NtQueryVirtualMemory  (-1, 0xa70000, Basic, 28, ... {BaseAddress=0xa70000,AllocationBase=0xa70000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 0x0, ) == 0x0
 03464   436   NtQueryInformationToken  (408, User, 200, ... {token info, class 1, size 36}, 36, ) == 0x0
 03465   436   NtOpenKey  (0x20019, {24, 48, 0x40, 0, 0,  (0x20019, {24, 48, 0x40, 0, 0, "Software\Microsoft\Windows NT\CurrentVersion\ProfileList\S-1-5-21-1078081533-484763869-839522115-1003"}, ... 416, ) }, ... 416, ) == 0x0
 03466   436   NtQueryValueKey  (416,  (416, "ProfileImagePath", Partial, 144, ... TitleIdx=0, Type=2, Data="%\0S\0y\0s\0t\0e\0m\0D\0r\0i\0v\0e\0%\0\\0D\0o\0c\0u\0m\0e\0n\0t\0s\0 \0a\0n\0d\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0S\0R\0I\0-\0u\0s\0e\0r\0\0\0"}, 104, ) , Partial, 144, ... TitleIdx=0, Type=2, Data= (416, "ProfileImagePath", Partial, 144, ... TitleIdx=0, Type=2, Data="%\0S\0y\0s\0t\0e\0m\0D\0r\0i\0v\0e\0%\0\\0D\0o\0c\0u\0m\0e\0n\0t\0s\0 \0a\0n\0d\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0S\0R\0I\0-\0u\0s\0e\0r\0\0\0"}, 104, ) }, 104, ) == 0x0
 03467   436   NtClose  (416, ... ) == 0x0
 03468   436   NtCreateKey  (0x2001f, {24, 404, 0x40, 0, 0,  (0x2001f, {24, 404, 0x40, 0, 0, "Software\Microsoft\Windows NT\CurrentVersion\Winlogon"}, 0, 0x0, 0, ... 416, 2, ) }, 0, 0x0, 0, ... 416, 2, ) == 0x0
 03469   436   NtQueryValueKey  (416,  (416, "ParseAutoexec", Partial, 144, ... TitleIdx=0, Type=1, Data="1\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (416, "ParseAutoexec", Partial, 144, ... TitleIdx=0, Type=1, Data="1\0\0\0"}, 16, ) }, 16, ) == 0x0
 03470   436   NtClose  (416, ... ) == 0x0
 03471   436   NtQueryInformationProcess  (-1, DefaultHardErrorMode, 4, ... {process info, class 12, size 4}, 0x0, ) == 0x0
 03472   436   NtSetInformationProcess  (-1, DefaultHardErrorMode, {process info, class 12, size 4}, 4, ... ) == 0x0
 03473   436   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\c:\autoexec.bat"}, 1237836, ... ) }, 1237836, ... ) == 0x0
 03474   436   NtCreateFile  (0x80100080, {24, 0, 0x40, 0, 1237844,  (0x80100080, {24, 0, 0x40, 0, 1237844, "\??\c:\autoexec.bat"}, 0x0, 128, 1, 1, 96, 0, 0, ... 416, {status=0x0, info=1}, ) }, 0x0, 128, 1, 1, 96, 0, 0, ... 416, {status=0x0, info=1}, ) == 0x0
 03475   436   NtQueryInformationProcess  (-1, DefaultHardErrorMode, 4, ... {process info, class 12, size 4}, 0x0, ) == 0x0
 03476   436   NtSetInformationProcess  (-1, DefaultHardErrorMode, {process info, class 12, size 4}, 4, ... ) == 0x0
 03477   436   NtQueryInformationFile  (416, 1237860, 24, Standard, ... {status=0x0, info=24}, ) == 0x0
 03478   436   NtReadFile  (416, 0, 0, 0, 0, 0x0, 0, ... {status=0x0, info=0}, "", ) == 0x0
 03479   436   NtClose  (416, ... ) == 0x0
 03480   436   NtOpenKey  (0x20019, {24, 404, 0x40, 0, 0,  (0x20019, {24, 404, 0x40, 0, 0, "Environment"}, ... 416, ) }, ... 416, ) == 0x0
 03481   436   NtAllocateVirtualMemory  (-1, 1441792, 0, 12288, 4096, 4, ... 1441792, 12288, ) == 0x0
 03482   436   NtEnumerateValueKey  (416, 0, Full, 220, ... TitleIdx=0, Type=2, Name= (416, 0, Full, 220, ... TitleIdx=0, Type=2, Name="TEMP", Data="%\0U\0S\0E\0R\0P\0R\0O\0F\0I\0L\0E\0%\0\\0L\0o\0c\0a\0l\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0T\0e\0m\0p\0\0\0"}, 96, ) , Data= (416, 0, Full, 220, ... TitleIdx=0, Type=2, Name="TEMP", Data="%\0U\0S\0E\0R\0P\0R\0O\0F\0I\0L\0E\0%\0\\0L\0o\0c\0a\0l\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0T\0e\0m\0p\0\0\0"}, 96, ) }, 96, ) == 0x0
 03483   436   NtEnumerateValueKey  (416, 1, Full, 220, ... TitleIdx=0, Type=2, Name= (416, 1, Full, 220, ... TitleIdx=0, Type=2, Name="TMP", Data="%\0U\0S\0E\0R\0P\0R\0O\0F\0I\0L\0E\0%\0\\0L\0o\0c\0a\0l\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0T\0e\0m\0p\0\0\0"}, 96, ) , Data= (416, 1, Full, 220, ... TitleIdx=0, Type=2, Name="TMP", Data="%\0U\0S\0E\0R\0P\0R\0O\0F\0I\0L\0E\0%\0\\0L\0o\0c\0a\0l\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0T\0e\0m\0p\0\0\0"}, 96, ) }, 96, ) == 0x0
 03484   436   NtEnumerateValueKey  (416, 2, Full, 220, ... ) == STATUS_NO_MORE_ENTRIES
 03485   436   NtEnumerateValueKey  (416, 0, Full, 220, ... TitleIdx=0, Type=2, Name= (416, 0, Full, 220, ... TitleIdx=0, Type=2, Name="TEMP", Data="%\0U\0S\0E\0R\0P\0R\0O\0F\0I\0L\0E\0%\0\\0L\0o\0c\0a\0l\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0T\0e\0m\0p\0\0\0"}, 96, ) , Data= (416, 0, Full, 220, ... TitleIdx=0, Type=2, Name="TEMP", Data="%\0U\0S\0E\0R\0P\0R\0O\0F\0I\0L\0E\0%\0\\0L\0o\0c\0a\0l\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0T\0e\0m\0p\0\0\0"}, 96, ) }, 96, ) == 0x0
 03486   436   NtQueryInformationProcess  (-1, DefaultHardErrorMode, 4, ... {process info, class 12, size 4}, 0x0, ) == 0x0
 03487   436   NtSetInformationProcess  (-1, DefaultHardErrorMode, {process info, class 12, size 4}, 4, ... ) == 0x0
 03488   436   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\Documents and Settings\SRI-user\Local Settings\Temp"}, 1236576, ... ) }, 1236576, ... ) == 0x0
 03489   436   NtOpenFile  (0x100001, {24, 0, 0x40, 0, 0,  (0x100001, {24, 0, 0x40, 0, 0, "\??\C:\"}, 3, 16417, ... 420, {status=0x0, info=1}, ) }, 3, 16417, ... 420, {status=0x0, info=1}, ) == 0x0
 03490   436   NtQueryDirectoryFile  (420, 0, 0, 0, 1235936, 616, BothDirectory, 1,  (420, 0, 0, 0, 1235936, 616, BothDirectory, 1, "Documents and Settings", 0, ... {status=0x0, info=138}, ) , 0, ... {status=0x0, info=138}, ) == 0x0
 03491   436   NtClose  (420, ... ) == 0x0
 03492   436   NtOpenFile  (0x100001, {24, 0, 0x40, 0, 0,  (0x100001, {24, 0, 0x40, 0, 0, "\??\C:\Documents and Settings\SRI-user\"}, 3, 16417, ... 420, {status=0x0, info=1}, ) }, 3, 16417, ... 420, {status=0x0, info=1}, ) == 0x0
 03493   436   NtQueryDirectoryFile  (420, 0, 0, 0, 1235936, 616, BothDirectory, 1,  (420, 0, 0, 0, 1235936, 616, BothDirectory, 1, "Local Settings", 0, ... {status=0x0, info=122}, ) , 0, ... {status=0x0, info=122}, ) == 0x0
 03494   436   NtClose  (420, ... ) == 0x0
 03495   436   NtQueryInformationProcess  (-1, DefaultHardErrorMode, 4, ... {process info, class 12, size 4}, 0x0, ) == 0x0
 03496   436   NtSetInformationProcess  (-1, DefaultHardErrorMode, {process info, class 12, size 4}, 4, ... ) == 0x0
 03497   436   NtQueryVirtualMemory  (-1, 0xa70000, Basic, 28, ... {BaseAddress=0xa70000,AllocationBase=0xa70000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 0x0, ) == 0x0
 03498   436   NtEnumerateValueKey  (416, 1, Full, 220, ... TitleIdx=0, Type=2, Name= (416, 1, Full, 220, ... TitleIdx=0, Type=2, Name="TMP", Data="%\0U\0S\0E\0R\0P\0R\0O\0F\0I\0L\0E\0%\0\\0L\0o\0c\0a\0l\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0T\0e\0m\0p\0\0\0"}, 96, ) , Data= (416, 1, Full, 220, ... TitleIdx=0, Type=2, Name="TMP", Data="%\0U\0S\0E\0R\0P\0R\0O\0F\0I\0L\0E\0%\0\\0L\0o\0c\0a\0l\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0T\0e\0m\0p\0\0\0"}, 96, ) }, 96, ) == 0x0
 03499   436   NtQueryInformationProcess  (-1, DefaultHardErrorMode, 4, ... {process info, class 12, size 4}, 0x0, ) == 0x0
 03500   436   NtSetInformationProcess  (-1, DefaultHardErrorMode, {process info, class 12, size 4}, 4, ... ) == 0x0
 03501   436   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\Documents and Settings\SRI-user\Local Settings\Temp"}, 1236576, ... ) }, 1236576, ... ) == 0x0
 03502   436   NtOpenFile  (0x100001, {24, 0, 0x40, 0, 0,  (0x100001, {24, 0, 0x40, 0, 0, "\??\C:\"}, 3, 16417, ... 420, {status=0x0, info=1}, ) }, 3, 16417, ... 420, {status=0x0, info=1}, ) == 0x0
 03503   436   NtQueryDirectoryFile  (420, 0, 0, 0, 1235936, 616, BothDirectory, 1,  (420, 0, 0, 0, 1235936, 616, BothDirectory, 1, "Documents and Settings", 0, ... {status=0x0, info=138}, ) , 0, ... {status=0x0, info=138}, ) == 0x0
 03504   436   NtClose  (420, ... ) == 0x0
 03505   436   NtOpenFile  (0x100001, {24, 0, 0x40, 0, 0,  (0x100001, {24, 0, 0x40, 0, 0, "\??\C:\Documents and Settings\SRI-user\"}, 3, 16417, ... 420, {status=0x0, info=1}, ) }, 3, 16417, ... 420, {status=0x0, info=1}, ) == 0x0
 03506   436   NtQueryDirectoryFile  (420, 0, 0, 0, 1235936, 616, BothDirectory, 1,  (420, 0, 0, 0, 1235936, 616, BothDirectory, 1, "Local Settings", 0, ... {status=0x0, info=122}, ) , 0, ... {status=0x0, info=122}, ) == 0x0
 03507   436   NtClose  (420, ... ) == 0x0
 03508   436   NtQueryInformationProcess  (-1, DefaultHardErrorMode, 4, ... {process info, class 12, size 4}, 0x0, ) == 0x0
 03509   436   NtSetInformationProcess  (-1, DefaultHardErrorMode, {process info, class 12, size 4}, 4, ... ) == 0x0
 03510   436   NtQueryVirtualMemory  (-1, 0xa70000, Basic, 28, ... {BaseAddress=0xa70000,AllocationBase=0xa70000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 0x0, ) == 0x0
 03511   436   NtEnumerateValueKey  (416, 2, Full, 220, ... ) == STATUS_NO_MORE_ENTRIES
 03512   436   NtClose  (416, ... ) == 0x0
 03513   436   NtOpenKey  (0x20019, {24, 404, 0x40, 0, 0,  (0x20019, {24, 404, 0x40, 0, 0, "Volatile Environment"}, ... 416, ) }, ... 416, ) == 0x0
 03514   436   NtEnumerateValueKey  (416, 0, Full, 220, ... TitleIdx=0, Type=1, Name= (416, 0, Full, 220, ... TitleIdx=0, Type=1, Name="LOGONSERVER", Data="\\0\\0M\0Y\0W\0O\0R\0L\0D\0\0\0"}, 64, ) , Data= (416, 0, Full, 220, ... TitleIdx=0, Type=1, Name="LOGONSERVER", Data="\\0\\0M\0Y\0W\0O\0R\0L\0D\0\0\0"}, 64, ) }, 64, ) == 0x0
 03515   436   NtQueryVirtualMemory  (-1, 0xa70000, Basic, 28, ... {BaseAddress=0xa70000,AllocationBase=0xa70000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 0x0, ) == 0x0
 03516   436   NtEnumerateValueKey  (416, 1, Full, 220, ... TitleIdx=0, Type=1, Name= (416, 1, Full, 220, ... TitleIdx=0, Type=1, Name="HOMEDRIVE", Data="C\0:\0\0\0"}, 46, ) , Data= (416, 1, Full, 220, ... TitleIdx=0, Type=1, Name="HOMEDRIVE", Data="C\0:\0\0\0"}, 46, ) }, 46, ) == 0x0
 03517   436   NtQueryVirtualMemory  (-1, 0xa70000, Basic, 28, ... {BaseAddress=0xa70000,AllocationBase=0xa70000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 0x0, ) == 0x0
 03518   436   NtEnumerateValueKey  (416, 2, Full, 220, ... TitleIdx=0, Type=1, Name= (416, 2, Full, 220, ... TitleIdx=0, Type=1, Name="HOMEPATH", Data="\\0D\0o\0c\0u\0m\0e\0n\0t\0s\0 \0a\0n\0d\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0S\0R\0I\0-\0u\0s\0e\0r\0\0\0"}, 102, ) , Data= (416, 2, Full, 220, ... TitleIdx=0, Type=1, Name="HOMEPATH", Data="\\0D\0o\0c\0u\0m\0e\0n\0t\0s\0 \0a\0n\0d\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0S\0R\0I\0-\0u\0s\0e\0r\0\0\0"}, 102, ) }, 102, ) == 0x0
 03519   436   NtQueryVirtualMemory  (-1, 0xa70000, Basic, 28, ... {BaseAddress=0xa70000,AllocationBase=0xa70000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 0x0, ) == 0x0
 03520   436   NtEnumerateValueKey  (416, 3, Full, 220, ... TitleIdx=0, Type=1, Name= (416, 3, Full, 220, ... TitleIdx=0, Type=1, Name="CLIENTNAME", Data="C\0o\0n\0s\0o\0l\0e\0\0\0"}, 56, ) , Data= (416, 3, Full, 220, ... TitleIdx=0, Type=1, Name="CLIENTNAME", Data="C\0o\0n\0s\0o\0l\0e\0\0\0"}, 56, ) }, 56, ) == 0x0
 03521   436   NtQueryVirtualMemory  (-1, 0xa70000, Basic, 28, ... {BaseAddress=0xa70000,AllocationBase=0xa70000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 0x0, ) == 0x0
 03522   436   NtEnumerateValueKey  (416, 4, Full, 220, ... TitleIdx=0, Type=1, Name= (416, 4, Full, 220, ... TitleIdx=0, Type=1, Name="SESSIONNAME", Data="C\0o\0n\0s\0o\0l\0e\0\0\0"}, 60, ) , Data= (416, 4, Full, 220, ... TitleIdx=0, Type=1, Name="SESSIONNAME", Data="C\0o\0n\0s\0o\0l\0e\0\0\0"}, 60, ) }, 60, ) == 0x0
 03523   436   NtQueryVirtualMemory  (-1, 0xa70000, Basic, 28, ... {BaseAddress=0xa70000,AllocationBase=0xa70000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 0x0, ) == 0x0
 03524   436   NtEnumerateValueKey  (416, 5, Full, 220, ... TitleIdx=0, Type=1, Name= (416, 5, Full, 220, ... TitleIdx=0, Type=1, Name="APPDATA", Data="C\0:\0\\0D\0o\0c\0u\0m\0e\0n\0t\0s\0 \0a\0n\0d\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0S\0R\0I\0-\0u\0s\0e\0r\0\\0A\0p\0p\0l\0i\0c\0a\0t\0i\0o\0n\0 \0D\0a\0t\0a\0\0\0"}, 140, ) , Data= (416, 5, Full, 220, ... TitleIdx=0, Type=1, Name="APPDATA", Data="C\0:\0\\0D\0o\0c\0u\0m\0e\0n\0t\0s\0 \0a\0n\0d\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0S\0R\0I\0-\0u\0s\0e\0r\0\\0A\0p\0p\0l\0i\0c\0a\0t\0i\0o\0n\0 \0D\0a\0t\0a\0\0\0"}, 140, ) }, 140, ) == 0x0
 03525   436   NtQueryVirtualMemory  (-1, 0xa70000, Basic, 28, ... {BaseAddress=0xa70000,AllocationBase=0xa70000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 0x0, ) == 0x0
 03526   436   NtEnumerateValueKey  (416, 6, Full, 220, ... TitleIdx=0, Type=1, Name= (416, 6, Full, 220, ... TitleIdx=0, Type=1, Name="HOMESHARE", Data="\0\0"}, 42, ) , Data= (416, 6, Full, 220, ... TitleIdx=0, Type=1, Name="HOMESHARE", Data="\0\0"}, 42, ) }, 42, ) == 0x0
 03527   436   NtEnumerateValueKey  (416, 7, Full, 220, ... ) == STATUS_NO_MORE_ENTRIES
 03528   436   NtEnumerateValueKey  (416, 0, Full, 220, ... TitleIdx=0, Type=1, Name= (416, 0, Full, 220, ... TitleIdx=0, Type=1, Name="LOGONSERVER", Data="\\0\\0M\0Y\0W\0O\0R\0L\0D\0\0\0"}, 64, ) , Data= (416, 0, Full, 220, ... TitleIdx=0, Type=1, Name="LOGONSERVER", Data="\\0\\0M\0Y\0W\0O\0R\0L\0D\0\0\0"}, 64, ) }, 64, ) == 0x0
 03529   436   NtEnumerateValueKey  (416, 1, Full, 220, ... TitleIdx=0, Type=1, Name= (416, 1, Full, 220, ... TitleIdx=0, Type=1, Name="HOMEDRIVE", Data="C\0:\0\0\0"}, 46, ) , Data= (416, 1, Full, 220, ... TitleIdx=0, Type=1, Name="HOMEDRIVE", Data="C\0:\0\0\0"}, 46, ) }, 46, ) == 0x0
 03530   436   NtEnumerateValueKey  (416, 2, Full, 220, ... TitleIdx=0, Type=1, Name= (416, 2, Full, 220, ... TitleIdx=0, Type=1, Name="HOMEPATH", Data="\\0D\0o\0c\0u\0m\0e\0n\0t\0s\0 \0a\0n\0d\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0S\0R\0I\0-\0u\0s\0e\0r\0\0\0"}, 102, ) , Data= (416, 2, Full, 220, ... TitleIdx=0, Type=1, Name="HOMEPATH", Data="\\0D\0o\0c\0u\0m\0e\0n\0t\0s\0 \0a\0n\0d\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0S\0R\0I\0-\0u\0s\0e\0r\0\0\0"}, 102, ) }, 102, ) == 0x0
 03531   436   NtEnumerateValueKey  (416, 3, Full, 220, ... TitleIdx=0, Type=1, Name= (416, 3, Full, 220, ... TitleIdx=0, Type=1, Name="CLIENTNAME", Data="C\0o\0n\0s\0o\0l\0e\0\0\0"}, 56, ) , Data= (416, 3, Full, 220, ... TitleIdx=0, Type=1, Name="CLIENTNAME", Data="C\0o\0n\0s\0o\0l\0e\0\0\0"}, 56, ) }, 56, ) == 0x0
 03532   436   NtEnumerateValueKey  (416, 4, Full, 220, ... TitleIdx=0, Type=1, Name= (416, 4, Full, 220, ... TitleIdx=0, Type=1, Name="SESSIONNAME", Data="C\0o\0n\0s\0o\0l\0e\0\0\0"}, 60, ) , Data= (416, 4, Full, 220, ... TitleIdx=0, Type=1, Name="SESSIONNAME", Data="C\0o\0n\0s\0o\0l\0e\0\0\0"}, 60, ) }, 60, ) == 0x0
 03533   436   NtEnumerateValueKey  (416, 5, Full, 220, ... TitleIdx=0, Type=1, Name= (416, 5, Full, 220, ... TitleIdx=0, Type=1, Name="APPDATA", Data="C\0:\0\\0D\0o\0c\0u\0m\0e\0n\0t\0s\0 \0a\0n\0d\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0S\0R\0I\0-\0u\0s\0e\0r\0\\0A\0p\0p\0l\0i\0c\0a\0t\0i\0o\0n\0 \0D\0a\0t\0a\0\0\0"}, 140, ) , Data= (416, 5, Full, 220, ... TitleIdx=0, Type=1, Name="APPDATA", Data="C\0:\0\\0D\0o\0c\0u\0m\0e\0n\0t\0s\0 \0a\0n\0d\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0S\0R\0I\0-\0u\0s\0e\0r\0\\0A\0p\0p\0l\0i\0c\0a\0t\0i\0o\0n\0 \0D\0a\0t\0a\0\0\0"}, 140, ) }, 140, ) == 0x0
 03534   436   NtEnumerateValueKey  (416, 6, Full, 220, ... TitleIdx=0, Type=1, Name= (416, 6, Full, 220, ... TitleIdx=0, Type=1, Name="HOMESHARE", Data="\0\0"}, 42, ) , Data= (416, 6, Full, 220, ... TitleIdx=0, Type=1, Name="HOMESHARE", Data="\0\0"}, 42, ) }, 42, ) == 0x0
 03535   436   NtEnumerateValueKey  (416, 7, Full, 220, ... ) == STATUS_NO_MORE_ENTRIES
 03536   436   NtClose  (416, ... ) == 0x0
 03537   436   NtClose  (404, ... ) == 0x0
 03538   436   NtFreeVirtualMemory  (-1, (0xa70000), 0, 32768, ... (0xa70000), 4096, ) == 0x0
 03539   436   NtClose  (412, ... ) == 0x0
 03540   436   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\Documents and Settings\SRI-user\Application Data"}, 1238500, ... ) }, 1238500, ... ) == 0x0
 03541   436   NtQueryInformationToken  (408, User, 64, ... {token info, class 1, size 36}, 36, ) == 0x0
 03542   436   NtOpenKey  (0x2001f, {24, 356, 0x40, 0, 0,  (0x2001f, {24, 356, 0x40, 0, 0, "S-1-5-21-1078081533-484763869-839522115-1003"}, ... 412, ) }, ... 412, ) == 0x0
 03543   436   NtCreateKey  (0x2000000, {24, 412, 0x40, 0, 0,  (0x2000000, {24, 412, 0x40, 0, 0, "Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders"}, 0, 0x0, 0, ... 404, 2, ) }, 0, 0x0, 0, ... 404, 2, ) == 0x0
 03544   436   NtClose  (412, ... ) == 0x0
 03545   436   NtSetValueKey  (404,  (404, "AppData", 0, 1, "C\0:\0\\0D\0o\0c\0u\0m\0e\0n\0t\0s\0 \0a\0n\0d\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0S\0R\0I\0-\0u\0s\0e\0r\0\\0A\0p\0p\0l\0i\0c\0a\0t\0i\0o\0n\0 \0D\0a\0t\0a\0\0\0", 104, ... ) , 0, 1,  (404, "AppData", 0, 1, "C\0:\0\\0D\0o\0c\0u\0m\0e\0n\0t\0s\0 \0a\0n\0d\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0S\0R\0I\0-\0u\0s\0e\0r\0\\0A\0p\0p\0l\0i\0c\0a\0t\0i\0o\0n\0 \0D\0a\0t\0a\0\0\0", 104, ... ) , 104, ... ) == 0x0
 03546   436   NtClose  (404, ... ) == 0x0
 03547   436   NtClose  (408, ... ) == 0x0
 03548   436   NtOpenFile  (0x100001, {24, 0, 0x40, 0, 0,  (0x100001, {24, 0, 0x40, 0, 0, "\??\C:\Documents and Settings\SRI-user\Application Data\Microsoft\Network\Connections\Pbk\"}, 3, 16417, ... ) }, 3, 16417, ... ) == STATUS_OBJECT_PATH_NOT_FOUND
 03549   436   NtWaitForSingleObject  (196, 0, 0x0, ... ) == 0x0
 03550   436   NtQueryInformationFile  (192, 1239548, 24, Standard, ... {status=0x0, info=24}, ) == 0x0
 03551   436   NtReleaseMutant  (196, ... 0x0, ) == 0x0
 03552   436   NtReleaseMutant  (240, ... 0x0, ) == 0x0
 03553   436   NtWaitForSingleObject  (104, 0, {0, 0}, ... ) == 0x102
 03554   436   NtWaitForSingleObject  (104, 0, {0, 0}, ... ) == 0x102
 03555   436   NtWaitForSingleObject  (104, 0, {0, 0}, ... ) == 0x102
 03556   436   NtWaitForSingleObject  (112, 0, {0, 0}, ... ) == 0x102
 03557   436   NtCreateEvent  (0x1f0003, 0x0, 1, 0, ... 408, ) == 0x0
 03558   436   NtConnectPort  ( ("\RPC Control\DNSResolver", {12, 2, 1, 1}, 0x0, 0x0, 1237688, 112, ... 404, 0x0, 0x0, 0x0, 112, ) , {12, 2, 1, 1}, 0x0, 0x0, 1237688, 112, ... 404, 0x0, 0x0, 0x0, 112, ) == 0x0
 03559   436   NtRequestWaitReplyPort  (404, {128, 152, new_msg, 0, 123020, 1310720, 1237452, 2012750850}  (404, {128, 152, new_msg, 0, 123020, 1310720, 1237452, 2012750850} "\0\350\22\0\2$\370w\370T\367w\1kwEVY\205D\237\200\364(\367\326\1)\2\0\0\0\1\0\0\0k\23\314w\4\0\0\0\20\344\314w\0\355\25\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\1\0\11\0x\352\25\0\350\351\25\0\0\0\0\0f\0\0\03\0\0\0l\351\22\0\0\0\0\0\0\0\22\0h\342\22\0\240P\25\0\224\345\22\0\0\0\0\0\5\0\0\0\5\0\0\0" ... {128, 152, reply, 0, 424, 436, 1539, 0} "\7\350\22\0\2$\370w\370T\367w\1kwEVY\205D\237\200\364(\367\326\1)\2\0\0\0\1\0\0\0\0\0\0\0\4\0\0\0\20\344\314w\377\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\1\0\11\0x\352\25\0\350\351\25\0\0\0\0\0f\0\0\03\0\0\0l\351\22\0\0\0\0\0\0\0\22\0h\342\22\0\240P\25\0\224\345\22\0\0\0\0\0\5\0\0\0\5\0\0\0" )  ... {128, 152, reply, 0, 424, 436, 1539, 0}  (404, {128, 152, new_msg, 0, 123020, 1310720, 1237452, 2012750850} "\0\350\22\0\2$\370w\370T\367w\1kwEVY\205D\237\200\364(\367\326\1)\2\0\0\0\1\0\0\0k\23\314w\4\0\0\0\20\344\314w\0\355\25\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\1\0\11\0x\352\25\0\350\351\25\0\0\0\0\0f\0\0\03\0\0\0l\351\22\0\0\0\0\0\0\0\22\0h\342\22\0\240P\25\0\224\345\22\0\0\0\0\0\5\0\0\0\5\0\0\0" ... {128, 152, reply, 0, 424, 436, 1539, 0} "\7\350\22\0\2$\370w\370T\367w\1kwEVY\205D\237\200\364(\367\326\1)\2\0\0\0\1\0\0\0\0\0\0\0\4\0\0\0\20\344\314w\377\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\1\0\11\0x\352\25\0\350\351\25\0\0\0\0\0f\0\0\03\0\0\0l\351\22\0\0\0\0\0\0\0\22\0h\342\22\0\240P\25\0\224\345\22\0\0\0\0\0\5\0\0\0\5\0\0\0" )  ) == 0x0
 03560   436   NtRequestWaitReplyPort  (404, {112, 136, new_msg, 0, 44, 3, 20, 0}  (404, {112, 136, new_msg, 0, 44, 3, 20, 0} "\1\0\0\0A\2\11\0*,\334\21\261\306\0\14)\371\246\305\1\0\0\0\377\377\377\377\1\0\0\0\0\0\0\0\254\263\25\0\25\0\0\0\0\0\0\0\25\0\0\0s\0r\0v\00\01\0.\0b\0a\0s\0h\0c\0h\0e\0l\0i\0k\0.\0c\0o\0m\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0" ...  ...
 03310   568   NtWaitForSingleObject  ... ) == 0x0
 03561   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=94}, 0x0, ) , 16, 0, ... {status=0x103, info=94}, 0x0, ) == 0x103
 03562   568   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ...
 03560   436   NtRequestWaitReplyPort  ... {44, 68, reply, 0, 424, 436, 1540, 0}  ... {44, 68, reply, 0, 424, 436, 1540, 0} "\2\213+\370\1\0+\370B\271\325\371(\273\325\371\377\377\377\377\325\316\325\371\13\353\325\371\0\0\0\0\0\0\0\0\264\5\0\0\1\0\0\0" )  ) == 0x0
 03563   436   NtClose  (408, ... ) == 0x0
 03564   436   NtClose  (404, ... ) == 0x0
 03565   436   NtCreateFile  (0x3, {24, 0, 0x40, 0, 0,  (0x3, {24, 0, 0x40, 0, 0, "\Device\RasAcd"}, 0x0, 128, 3, 3, 0, 0, 0, ... 404, {status=0x0, info=0}, ) }, 0x0, 128, 3, 3, 0, 0, 0, ... 404, {status=0x0, info=0}, ) == 0x0
 03566   436   NtCreateEvent  (0x1f0003, 0x0, 1, 0, ... 408, ) == 0x0
 03567   436   NtDeviceIoControlFile  (404, 408, 0x0, 0x0, 0xf14014,  (404, 408, 0x0, 0x0, 0xf14014, "\3\0\0\0srv01.bashchelik.com\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0", 1552, 0, ... ) , 1552, 0, ... ) == STATUS_UNSUCCESSFUL
 03568   436   NtClose  (408, ... ) == 0x0
 03569   436   NtClose  (404, ... ) == 0x0
 03570   436   NtClearEvent  (376, ... ) == 0x0
 03571   436   NtSetEvent  (376, ... 0x0, ) == 0x0
 03572   436   NtClose  (376, ... ) == 0x0
 03573   436   NtCreateEvent  (0x1f0003, 0x0, 1, 1, ... 376, ) == 0x0
 03574   436   NtWaitForSingleObject  (376, 0, 0x0, ... ) == 0x0
 03575   436   NtClearEvent  (376, ... ) == 0x0
 03576   436   NtSetEvent  (376, ... 0x0, ) == 0x0
 03577   436   NtWaitForSingleObject  (196, 0, 0x0, ... ) == 0x0
 03578   436   NtQueryInformationFile  (192, 1241452, 24, Standard, ... {status=0x0, info=24}, ) == 0x0
 03579   436   NtReleaseMutant  (196, ... 0x0, ) == 0x0
 03580   436   NtOpenKey  (0x20019, {24, 60, 0x40, 0, 0,  (0x20019, {24, 60, 0x40, 0, 0, "SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Http Filters\RPA"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 03581   436   NtOpenKey  (0x20019, {24, 48, 0x40, 0, 0,  (0x20019, {24, 48, 0x40, 0, 0, "SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Http Filters\RPA"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 03582   436   NtWaitForSingleObject  (240, 0, 0x0, ... ) == 0x0
 03583   436   NtWaitForSingleObject  (244, 0, 0x0, ... ) == 0x0
 03584   436   NtReleaseMutant  (244, ... 0x0, ) == 0x0
 03585   436   NtQueryValueKey  (76,  (76, "EnableAutodial", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (76, "EnableAutodial", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) }, 16, ) == 0x0
 03586   436   NtQueryValueKey  (76,  (76, "NoNetAutodial", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (76, "NoNetAutodial", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) }, 16, ) == 0x0
 03587   436   NtWaitForSingleObject  (196, 0, 0x0, ... ) == 0x0
 03588   436   NtQueryInformationFile  (192, 1241648, 24, Standard, ... {status=0x0, info=24}, ) == 0x0
 03589   436   NtReleaseMutant  (196, ... 0x0, ) == 0x0
 03590   436   NtReleaseMutant  (240, ... 0x0, ) == 0x0
 03591   436   NtWaitForSingleObject  (384, 0, 0x0, ... ) == 0x0
 03592   436   NtReleaseMutant  (384, ... 0x0, ) == 0x0
 03593   436   NtOpenKey  (0x20019, {24, 392, 0x40, 0, 0,  (0x20019, {24, 392, 0x40, 0, 0, "Domains\bashchelik.com"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 03594   436   NtOpenKey  (0x20019, {24, 48, 0x40, 0, 0,  (0x20019, {24, 48, 0x40, 0, 0, "Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\bashchelik.com"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 03595   436   NtQueryValueKey  (392,  (392, "IntranetName", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (392, "IntranetName", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) }, 16, ) == 0x0
 03596   436   NtQueryValueKey  (392,  (392, "ProxyBypass", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (392, "ProxyBypass", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) }, 16, ) == 0x0
 03597   436   NtClearEvent  (228, ... ) == 0x0
 03598   436   NtSetEvent  (228, ... 0x0, ) == 0x0
 03599   436   NtOpenKey  (0x20019, {24, 392, 0x40, 0, 0,  (0x20019, {24, 392, 0x40, 0, 0, "ProtocolDefaults\"}, ... 404, ) }, ... 404, ) == 0x0
 03600   436   NtQueryValueKey  (404,  (404, "http", Partial, 144, ... TitleIdx=0, Type=4, Data="\3\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (404, "http", Partial, 144, ... TitleIdx=0, Type=4, Data="\3\0\0\0"}, 16, ) }, 16, ) == 0x0
 03601   436   NtClose  (404, ... ) == 0x0
 03602   436   NtWaitForSingleObject  (384, 0, 0x0, ... ) == 0x0
 03603   436   NtReleaseMutant  (384, ... 0x0, ) == 0x0
 03604   436   NtWaitForSingleObject  (384, 0, 0x0, ... ) == 0x0
 03605   436   NtReleaseMutant  (384, ... 0x0, ) == 0x0
 03606   436   NtWaitForSingleObject  (368, 0, 0x0, ... ) == 0x0
 03607   436   NtReleaseMutant  (368, ... 0x0, ) == 0x0
 03608   436   NtWaitForSingleObject  (196, 0, 0x0, ... ) == 0x0
 03609   436   NtQueryInformationFile  (192, 1241896, 24, Standard, ... {status=0x0, info=24}, ) == 0x0
 03610   436   NtReleaseMutant  (196, ... 0x0, ) == 0x0
 03611   436   NtWaitForSingleObject  (112, 0, {0, 0}, ... ) == 0x102
 03612   436   NtCreateEvent  (0x1f0003, 0x0, 1, 0, ... 404, ) == 0x0
 03613   436   NtConnectPort  ( ("\RPC Control\DNSResolver", {12, 2, 1, 1}, 0x0, 0x0, 1238356, 112, ... 408, 0x0, 0x0, 0x0, 112, ) , {12, 2, 1, 1}, 0x0, 0x0, 1238356, 112, ... 408, 0x0, 0x0, 0x0, 112, ) == 0x0
 03614   436   NtRequestWaitReplyPort  (408, {128, 152, new_msg, 0, 1310720, 123688, 1310720, 1238120}  (408, {128, 152, new_msg, 0, 1310720, 123688, 1310720, 1238120} "\0$\370w\30\353\22\0\2$\370w\1kwEVY\205D\237\200\364(\367\326\1)\2\0\0\0\1\0\0\0\0\355\25\0\4\0\0\0\0\355\25\0\20\344\314w\0\355\25\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\1\0\12\0x\352\25\0\350\334\25\0\0\0\0\0\0\0\0\0\0\0\0\0\244\363\22\0\0\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\0\0\0\0\0\0\0\0\5\0\0\0" ... {128, 152, reply, 0, 424, 436, 1543, 0} "\7$\370w\30\353\22\0\2$\370w\1kwEVY\205D\237\200\364(\367\326\1)\2\0\0\0\1\0\0\0\0\0\0\0\4\0\0\0\0\355\25\0\377\377\377\377\0\355\25\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\1\0\12\0x\352\25\0\350\334\25\0\0\0\0\0\0\0\0\0\0\0\0\0\244\363\22\0\0\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\0\0\0\0\0\0\0\0\5\0\0\0" )  ... {128, 152, reply, 0, 424, 436, 1543, 0}  (408, {128, 152, new_msg, 0, 1310720, 123688, 1310720, 1238120} "\0$\370w\30\353\22\0\2$\370w\1kwEVY\205D\237\200\364(\367\326\1)\2\0\0\0\1\0\0\0\0\355\25\0\4\0\0\0\0\355\25\0\20\344\314w\0\355\25\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\1\0\12\0x\352\25\0\350\334\25\0\0\0\0\0\0\0\0\0\0\0\0\0\244\363\22\0\0\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\0\0\0\0\0\0\0\0\5\0\0\0" ... {128, 152, reply, 0, 424, 436, 1543, 0} "\7$\370w\30\353\22\0\2$\370w\1kwEVY\205D\237\200\364(\367\326\1)\2\0\0\0\1\0\0\0\0\0\0\0\4\0\0\0\0\355\25\0\377\377\377\377\0\355\25\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\1\0\12\0x\352\25\0\350\334\25\0\0\0\0\0\0\0\0\0\0\0\0\0\244\363\22\0\0\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\0\0\0\0\0\0\0\0\5\0\0\0" )  ) == 0x0
 03615   436   NtRequestWaitReplyPort  (408, {64, 88, new_msg, 0, 424, 436, 1540, 0}  (408, {64, 88, new_msg, 0, 424, 436, 1540, 0} "\1\213\0\0A\2\10\0B\271\325\371(\273\325\371\377\377\377\377\325\316\325\371\377\377\377\377\0\0\0\0\0\0\0\0\21\0\0\0\0\0\0\0\0\0\0\0\25\0\0\0s\0r\0v\00\01\0.\0" ... {52, 76, reply, 0, 424, 436, 1544, 0} "\2\213+\370\1\0+\370B\271\325\371(\273\325\371\377\377\377\377\325\316\325\371\13\353\325\371\0\0\0\0\200]\12\0\1\0\0\0\1\0\0\0\300\250|\201\377\377\377\0" )  ... {52, 76, reply, 0, 424, 436, 1544, 0}  (408, {64, 88, new_msg, 0, 424, 436, 1540, 0} "\1\213\0\0A\2\10\0B\271\325\371(\273\325\371\377\377\377\377\325\316\325\371\377\377\377\377\0\0\0\0\0\0\0\0\21\0\0\0\0\0\0\0\0\0\0\0\25\0\0\0s\0r\0v\00\01\0.\0" ... {52, 76, reply, 0, 424, 436, 1544, 0} "\2\213+\370\1\0+\370B\271\325\371(\273\325\371\377\377\377\377\325\316\325\371\13\353\325\371\0\0\0\0\200]\12\0\1\0\0\0\1\0\0\0\300\250|\201\377\377\377\0" )  ) == 0x0
 03616   436   NtClose  (404, ... ) == 0x0
 03617   436   NtClose  (408, ... ) == 0x0
 03618   436   NtCreateKey  (0x20019, {24, 48, 0x40, 0, 0,  (0x20019, {24, 48, 0x40, 0, 0, "System\CurrentControlSet\Services\Tcpip\Parameters"}, 0, "Class", 0, ... 408, 2, ) }, 0,  (0x20019, {24, 48, 0x40, 0, 0, "System\CurrentControlSet\Services\Tcpip\Parameters"}, 0, "Class", 0, ... 408, 2, ) , 0, ... 408, 2, ) == 0x0
 03619   436   NtOpenKey  (0x20019, {24, 48, 0x40, 0, 0,  (0x20019, {24, 48, 0x40, 0, 0, "System\CurrentControlSet\Services\DnsCache\Parameters"}, ... 404, ) }, ... 404, ) == 0x0
 03620   436   NtOpenKey  (0x20019, {24, 48, 0x40, 0, 0,  (0x20019, {24, 48, 0x40, 0, 0, "Software\Policies\Microsoft\Windows NT\DnsClient"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 03621   436   NtQueryValueKey  (408,  (408, "Hostname", Partial, 144, ... TitleIdx=0, Type=1, Data="M\0Y\0W\0O\0R\0L\0D\0\0\0"}, 28, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (408, "Hostname", Partial, 144, ... TitleIdx=0, Type=1, Data="M\0Y\0W\0O\0R\0L\0D\0\0\0"}, 28, ) }, 28, ) == 0x0
 03622   436   NtQueryValueKey  (408,  (408, "Hostname", Partial, 144, ... TitleIdx=0, Type=1, Data="M\0Y\0W\0O\0R\0L\0D\0\0\0"}, 28, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (408, "Hostname", Partial, 144, ... TitleIdx=0, Type=1, Data="M\0Y\0W\0O\0R\0L\0D\0\0\0"}, 28, ) }, 28, ) == 0x0
 03623   436   NtClose  (408, ... ) == 0x0
 03624   436   NtClose  (404, ... ) == 0x0
 03625   436   NtCreateKey  (0x20019, {24, 48, 0x40, 0, 0,  (0x20019, {24, 48, 0x40, 0, 0, "System\CurrentControlSet\Services\Tcpip\Parameters"}, 0, "Class", 0, ... 404, 2, ) }, 0,  (0x20019, {24, 48, 0x40, 0, 0, "System\CurrentControlSet\Services\Tcpip\Parameters"}, 0, "Class", 0, ... 404, 2, ) , 0, ... 404, 2, ) == 0x0
 03626   436   NtOpenKey  (0x20019, {24, 48, 0x40, 0, 0,  (0x20019, {24, 48, 0x40, 0, 0, "System\CurrentControlSet\Services\DnsCache\Parameters"}, ... 408, ) }, ... 408, ) == 0x0
 03627   436   NtOpenKey  (0x20019, {24, 48, 0x40, 0, 0,  (0x20019, {24, 48, 0x40, 0, 0, "Software\Policies\Microsoft\Windows NT\DnsClient"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 03628   436   NtQueryValueKey  (404,  (404, "Domain", Partial, 144, ... TitleIdx=0, Type=1, Data="\0\0"}, 14, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (404, "Domain", Partial, 144, ... TitleIdx=0, Type=1, Data="\0\0"}, 14, ) }, 14, ) == 0x0
 03629   436   NtQueryValueKey  (404,  (404, "Domain", Partial, 144, ... TitleIdx=0, Type=1, Data="\0\0"}, 14, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (404, "Domain", Partial, 144, ... TitleIdx=0, Type=1, Data="\0\0"}, 14, ) }, 14, ) == 0x0
 03630   436   NtClose  (404, ... ) == 0x0
 03631   436   NtClose  (408, ... ) == 0x0
 03632   436   NtOpenKey  (0x1, {24, 48, 0x40, 0, 0,  (0x1, {24, 48, 0x40, 0, 0, "System\CurrentControlSet\Services\VxD\MSTCP"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 03633   436   NtOpenKey  (0x1, {24, 48, 0x40, 0, 0,  (0x1, {24, 48, 0x40, 0, 0, "System\CurrentControlSet\Control\ComputerName\ComputerName"}, ... 408, ) }, ... 408, ) == 0x0
 03634   436   NtQueryValueKey  (408,  (408, "ComputerName", Partial, 144, ... TitleIdx=0, Type=1, Data="M\0Y\0W\0O\0R\0L\0D\0\0\0"}, 28, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (408, "ComputerName", Partial, 144, ... TitleIdx=0, Type=1, Data="M\0Y\0W\0O\0R\0L\0D\0\0\0"}, 28, ) }, 28, ) == 0x0
 03635   436   NtQueryValueKey  (408,  (408, "ComputerName", Partial, 144, ... TitleIdx=0, Type=1, Data="M\0Y\0W\0O\0R\0L\0D\0\0\0"}, 28, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (408, "ComputerName", Partial, 144, ... TitleIdx=0, Type=1, Data="M\0Y\0W\0O\0R\0L\0D\0\0\0"}, 28, ) }, 28, ) == 0x0
 03636   436   NtClose  (408, ... ) == 0x0
 03637   436   NtWaitForSingleObject  (104, 0, {0, 0}, ... ) == 0x102
 03638   436   NtWaitForSingleObject  (104, 0, {0, 0}, ... ) == 0x102
 03639   436   NtWaitForSingleObject  (104, 0, {0, 0}, ... ) == 0x102
 03640   436   NtWaitForSingleObject  (112, 0, {0, 0}, ... ) == 0x102
 03641   436   NtCreateEvent  (0x1f0003, 0x0, 1, 0, ... 408, ) == 0x0
 03642   436   NtConnectPort  ( ("\RPC Control\DNSResolver", {12, 2, 1, 1}, 0x0, 0x0, 1237692, 112, ... 404, 0x0, 0x0, 0x0, 112, ) , {12, 2, 1, 1}, 0x0, 0x0, 1237692, 112, ... 404, 0x0, 0x0, 0x0, 112, ) == 0x0
 03643   436   NtRequestWaitReplyPort  (404, {128, 152, new_msg, 0, 1310720, 123024, 1310720, 1237456}  (404, {128, 152, new_msg, 0, 1310720, 123024, 1310720, 1237456} "\0$\370w\200\350\22\0\2$\370w\1kwEVY\205D\237\200\364(\367\326\1)\2\0\0\0\1\0\0\0\0\355\25\0\4\0\0\0\0\355\25\0\20\344\314w\0\355\25\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\1\0\13\0x\352\25\0\350\334\25\0\0\0\0\0\0\0\0\0$1\347w\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\34\343\22\0\0\0\0\0\365\26\365w\5\0\0\0" ... {128, 152, reply, 0, 424, 436, 1547, 0} "\7$\370w\200\350\22\0\2$\370w\1kwEVY\205D\237\200\364(\367\326\1)\2\0\0\0\1\0\0\0\0\0\0\0\4\0\0\0\0\355\25\0\377\377\377\377\0\355\25\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\1\0\13\0x\352\25\0\350\334\25\0\0\0\0\0\0\0\0\0$1\347w\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\34\343\22\0\0\0\0\0\365\26\365w\5\0\0\0" )  ... {128, 152, reply, 0, 424, 436, 1547, 0}  (404, {128, 152, new_msg, 0, 1310720, 123024, 1310720, 1237456} "\0$\370w\200\350\22\0\2$\370w\1kwEVY\205D\237\200\364(\367\326\1)\2\0\0\0\1\0\0\0\0\355\25\0\4\0\0\0\0\355\25\0\20\344\314w\0\355\25\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\1\0\13\0x\352\25\0\350\334\25\0\0\0\0\0\0\0\0\0$1\347w\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\34\343\22\0\0\0\0\0\365\26\365w\5\0\0\0" ... {128, 152, reply, 0, 424, 436, 1547, 0} "\7$\370w\200\350\22\0\2$\370w\1kwEVY\205D\237\200\364(\367\326\1)\2\0\0\0\1\0\0\0\0\0\0\0\4\0\0\0\0\355\25\0\377\377\377\377\0\355\25\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\1\0\13\0x\352\25\0\350\334\25\0\0\0\0\0\0\0\0\0$1\347w\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\34\343\22\0\0\0\0\0\365\26\365w\5\0\0\0" )  ) == 0x0
 03644   436   NtRequestWaitReplyPort  (404, {112, 136, new_msg, 0, 424, 436, 1544, 0}  (404, {112, 136, new_msg, 0, 424, 436, 1544, 0} "\1\213\0\0A\2\11\0B\271\325\371(\273\325\371\377\377\377\377\325\316\325\371\377\377\377\377\0\0\0\0\0\0\0\0\254\263\25\0\25\0\0\0\0\0\0\0\25\0\0\0s\0r\0v\00\02\0.\0b\0a\0s\0h\0c\0h\0e\0l\0i\0k\0.\0c\0o\0m\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0" ...  ...
 03562   568   NtWaitForSingleObject  ... ) == 0x0
 03645   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=94}, 0x0, ) , 16, 0, ... {status=0x103, info=94}, 0x0, ) == 0x103
 03646   568   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ...
 03644   436   NtRequestWaitReplyPort  ... {44, 68, reply, 0, 424, 436, 1548, 0}  ... {44, 68, reply, 0, 424, 436, 1548, 0} "\2\213+\370\1\0+\370B\271\325\371(\273\325\371\377\377\377\377\325\316\325\371\13\353\325\371\0\0\0\0\0\0\0\0\264\5\0\0\1\0\0\0" )  ) == 0x0
 03647   436   NtClose  (408, ... ) == 0x0
 03648   436   NtClose  (404, ... ) == 0x0
 03649   436   NtCreateFile  (0x3, {24, 0, 0x40, 0, 0,  (0x3, {24, 0, 0x40, 0, 0, "\Device\RasAcd"}, 0x0, 128, 3, 3, 0, 0, 0, ... 404, {status=0x0, info=0}, ) }, 0x0, 128, 3, 3, 0, 0, 0, ... 404, {status=0x0, info=0}, ) == 0x0
 03650   436   NtCreateEvent  (0x1f0003, 0x0, 1, 0, ... 408, ) == 0x0
 03651   436   NtDeviceIoControlFile  (404, 408, 0x0, 0x0, 0xf14014,  (404, 408, 0x0, 0x0, 0xf14014, "\3\0\0\0srv02.bashchelik.com\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0", 1552, 0, ... ) , 1552, 0, ... ) == STATUS_UNSUCCESSFUL
 03652   436   NtClose  (408, ... ) == 0x0
 03653   436   NtClose  (404, ... ) == 0x0
 03654   436   NtWaitForSingleObject  (240, 0, 0x0, ... ) == 0x0
 03655   436   NtWaitForSingleObject  (244, 0, 0x0, ... ) == 0x0
 03656   436   NtReleaseMutant  (244, ... 0x0, ) == 0x0
 03657   436   NtQueryValueKey  (76,  (76, "EnableAutodial", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (76, "EnableAutodial", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) }, 16, ) == 0x0
 03658   436   NtQueryValueKey  (76,  (76, "NoNetAutodial", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (76, "NoNetAutodial", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) }, 16, ) == 0x0
 03659   436   NtCreateKey  (0x2001d, {24, 48, 0x40, 0, 0,  (0x2001d, {24, 48, 0x40, 0, 0, "Software\Microsoft\RAS AutoDial"}, 0, 0x0, 0, ... 404, 2, ) }, 0, 0x0, 0, ... 404, 2, ) == 0x0
 03660   436   NtCreateKey  (0x20019, {24, 404, 0x40, 0, 0,  (0x20019, {24, 404, 0x40, 0, 0, "Default"}, 0, 0x0, 0, ... 408, 2, ) }, 0, 0x0, 0, ... 408, 2, ) == 0x0
 03661   436   NtClose  (404, ... ) == 0x0
 03662   436   NtQueryValueKey  (408,  (408, "DefaultInternet", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 03663   436   NtClose  (408, ... ) == 0x0
 03664   436   NtOpenThreadToken  (-2, 0xc, 1, ... ) == STATUS_NO_TOKEN
 03665   436   NtOpenProcessToken  (-1, 0xc, ... 408, ) == 0x0
 03666   436   NtReleaseSemaphore  (208, 1, ... 0, ) == 0x0
 03667   436   NtWaitForSingleObject  (208, 0, {0, 0}, ... ) == 0x0
 03668   436   NtClose  (408, ... ) == 0x0
 03669   436   NtOpenFile  (0x100001, {24, 0, 0x40, 0, 0,  (0x100001, {24, 0, 0x40, 0, 0, "\??\C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Connections\Pbk\"}, 3, 16417, ... 408, {status=0x0, info=1}, ) }, 3, 16417, ... 408, {status=0x0, info=1}, ) == 0x0
 03670   436   NtQueryDirectoryFile  (408, 0, 0, 0, 1237476, 616, BothDirectory, 1,  (408, 0, 0, 0, 1237476, 616, BothDirectory, 1, "<.pbk", 0, ... ) , 0, ... ) == STATUS_NO_SUCH_FILE
 03671   436   NtClose  (408, ... ) == 0x0
 03672   436   NtOpenFile  (0x100001, {24, 0, 0x40, 0, 0,  (0x100001, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\System32\Ras\"}, 3, 16417, ... 408, {status=0x0, info=1}, ) }, 3, 16417, ... 408, {status=0x0, info=1}, ) == 0x0
 03673   436   NtQueryDirectoryFile  (408, 0, 0, 0, 1237476, 616, BothDirectory, 1,  (408, 0, 0, 0, 1237476, 616, BothDirectory, 1, "<.pbk", 0, ... ) , 0, ... ) == STATUS_NO_SUCH_FILE
 03674   436   NtClose  (408, ... ) == 0x0
 03675   436   NtOpenThreadToken  (-2, 0xc, 1, ... ) == STATUS_NO_TOKEN
 03676   436   NtOpenProcessToken  (-1, 0xc, ... 408, ) == 0x0
 03677   436   NtQueryInformationToken  (408, User, 64, ... {token info, class 1, size 36}, 36, ) == 0x0
 03678   436   NtOpenKey  (0x2001f, {24, 356, 0x40, 0, 0,  (0x2001f, {24, 356, 0x40, 0, 0, "S-1-5-21-1078081533-484763869-839522115-1003"}, ... 404, ) }, ... 404, ) == 0x0
 03679   436   NtCreateKey  (0x2000000, {24, 404, 0x40, 0, 0,  (0x2000000, {24, 404, 0x40, 0, 0, "Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders"}, 0, 0x0, 0, ... 412, 2, ) }, 0, 0x0, 0, ... 412, 2, ) == 0x0
 03680   436   NtClose  (404, ... ) == 0x0
 03681   436   NtQueryValueKey  (412,  (412, "AppData", Partial, 144, ... TitleIdx=0, Type=2, Data="%\0U\0S\0E\0R\0P\0R\0O\0F\0I\0L\0E\0%\0\\0A\0p\0p\0l\0i\0c\0a\0t\0i\0o\0n\0 \0D\0a\0t\0a\0\0\0"}, 74, ) , Partial, 144, ... TitleIdx=0, Type=2, Data= (412, "AppData", Partial, 144, ... TitleIdx=0, Type=2, Data="%\0U\0S\0E\0R\0P\0R\0O\0F\0I\0L\0E\0%\0\\0A\0p\0p\0l\0i\0c\0a\0t\0i\0o\0n\0 \0D\0a\0t\0a\0\0\0"}, 74, ) }, 74, ) == 0x0
 03682   436   NtAllocateVirtualMemory  (-1, 0, 0, 1, 4096, 4, ... 10944512, 4096, ) == 0x0
 03683   436   NtQueryVirtualMemory  (-1, 0xa70000, Basic, 28, ... {BaseAddress=0xa70000,AllocationBase=0xa70000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 0x0, ) == 0x0
 03684   436   NtQueryVirtualMemory  (-1, 0xa70000, Basic, 28, ... {BaseAddress=0xa70000,AllocationBase=0xa70000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 0x0, ) == 0x0
 03685   436   NtOpenKey  (0x20019, {24, 48, 0x40, 0, 0,  (0x20019, {24, 48, 0x40, 0, 0, "Software\Microsoft\Windows NT\CurrentVersion\ProfileList"}, ... 404, ) }, ... 404, ) == 0x0
 03686   436   NtQueryValueKey  (404,  (404, "ProfilesDirectory", Partial, 144, ... TitleIdx=0, Type=2, Data="%\0S\0y\0s\0t\0e\0m\0D\0r\0i\0v\0e\0%\0\\0D\0o\0c\0u\0m\0e\0n\0t\0s\0 \0a\0n\0d\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\0\0"}, 86, ) , Partial, 144, ... TitleIdx=0, Type=2, Data= (404, "ProfilesDirectory", Partial, 144, ... TitleIdx=0, Type=2, Data="%\0S\0y\0s\0t\0e\0m\0D\0r\0i\0v\0e\0%\0\\0D\0o\0c\0u\0m\0e\0n\0t\0s\0 \0a\0n\0d\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\0\0"}, 86, ) }, 86, ) == 0x0
 03687   436   NtClose  (404, ... ) == 0x0
 03688   436   NtOpenKey  (0x20019, {24, 48, 0x40, 0, 0,  (0x20019, {24, 48, 0x40, 0, 0, "Software\Microsoft\Windows NT\CurrentVersion\ProfileList"}, ... 404, ) }, ... 404, ) == 0x0
 03689   436   NtQueryValueKey  (404,  (404, "AllUsersProfile", Partial, 144, ... TitleIdx=0, Type=1, Data="A\0l\0l\0 \0U\0s\0e\0r\0s\0\0\0"}, 32, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (404, "AllUsersProfile", Partial, 144, ... TitleIdx=0, Type=1, Data="A\0l\0l\0 \0U\0s\0e\0r\0s\0\0\0"}, 32, ) }, 32, ) == 0x0
 03690   436   NtClose  (404, ... ) == 0x0
 03691   436   NtQueryVirtualMemory  (-1, 0xa70000, Basic, 28, ... {BaseAddress=0xa70000,AllocationBase=0xa70000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 0x0, ) == 0x0
 03692   436   NtOpenKey  (0x1, {24, 48, 0x40, 0, 0,  (0x1, {24, 48, 0x40, 0, 0, "System\CurrentControlSet\Control\Session Manager\Environment"}, ... 404, ) }, ... 404, ) == 0x0
 03693   436   NtQueryKey  (404, Full, 176, ... {LastWrite={0x7838d13c,0x1c73999}, TitleIdx=0, Subkeys=0, Values=12, Class=""}, 44, ) == 0x0
 03694   436   NtQuerySecurityObject  (404, 7, 0, ... ) == STATUS_ACCESS_DENIED
 03695   436   NtEnumerateValueKey  (404, 0, Full, 220, ... TitleIdx=0, Type=2, Name= (404, 0, Full, 220, ... TitleIdx=0, Type=2, Name="ComSpec", Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0s\0y\0s\0t\0e\0m\03\02\0\\0c\0m\0d\0.\0e\0x\0e\0\0\0"}, 96, ) , Data= (404, 0, Full, 220, ... TitleIdx=0, Type=2, Name="ComSpec", Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0s\0y\0s\0t\0e\0m\03\02\0\\0c\0m\0d\0.\0e\0x\0e\0\0\0"}, 96, ) }, 96, ) == 0x0
 03696   436   NtEnumerateValueKey  (404, 1, Full, 220, ... TitleIdx=0, Type=2, Name= (404, 1, Full, 220, ... TitleIdx=0, Type=2, Name="Path", Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0s\0y\0s\0t\0e\0m\03\02\0;\0%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0;\0%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0W\0b\0e\0m\0\0\0"}, 152, ) , Data= (404, 1, Full, 220, ... TitleIdx=0, Type=2, Name="Path", Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0s\0y\0s\0t\0e\0m\03\02\0;\0%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0;\0%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0W\0b\0e\0m\0\0\0"}, 152, ) }, 152, ) == 0x0
 03697   436   NtEnumerateValueKey  (404, 2, Full, 220, ... TitleIdx=0, Type=2, Name= (404, 2, Full, 220, ... TitleIdx=0, Type=2, Name="windir", Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\0\0"}, 58, ) , Data= (404, 2, Full, 220, ... TitleIdx=0, Type=2, Name="windir", Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\0\0"}, 58, ) }, 58, ) == 0x0
 03698   436   NtEnumerateValueKey  (404, 3, Full, 220, ... TitleIdx=0, Type=1, Name= (404, 3, Full, 220, ... TitleIdx=0, Type=1, Name="OS", Data="W\0i\0n\0d\0o\0w\0s\0_\0N\0T\0\0\0"}, 46, ) , Data= (404, 3, Full, 220, ... TitleIdx=0, Type=1, Name="OS", Data="W\0i\0n\0d\0o\0w\0s\0_\0N\0T\0\0\0"}, 46, ) }, 46, ) == 0x0
 03699   436   NtQueryVirtualMemory  (-1, 0xa70000, Basic, 28, ... {BaseAddress=0xa70000,AllocationBase=0xa70000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 0x0, ) == 0x0
 03700   436   NtEnumerateValueKey  (404, 4, Full, 220, ... TitleIdx=0, Type=1, Name= (404, 4, Full, 220, ... TitleIdx=0, Type=1, Name="PROCESSOR_ARCHITECTURE", Data="x\08\06\0\0\0"}, 72, ) , Data= (404, 4, Full, 220, ... TitleIdx=0, Type=1, Name="PROCESSOR_ARCHITECTURE", Data="x\08\06\0\0\0"}, 72, ) }, 72, ) == 0x0
 03701   436   NtQueryVirtualMemory  (-1, 0xa70000, Basic, 28, ... {BaseAddress=0xa70000,AllocationBase=0xa70000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 0x0, ) == 0x0
 03702   436   NtEnumerateValueKey  (404, 5, Full, 220, ... TitleIdx=0, Type=1, Name= (404, 5, Full, 220, ... TitleIdx=0, Type=1, Name="PROCESSOR_LEVEL", Data="1\05\0\0\0"}, 58, ) , Data= (404, 5, Full, 220, ... TitleIdx=0, Type=1, Name="PROCESSOR_LEVEL", Data="1\05\0\0\0"}, 58, ) }, 58, ) == 0x0
 03703   436   NtQueryVirtualMemory  (-1, 0xa70000, Basic, 28, ... {BaseAddress=0xa70000,AllocationBase=0xa70000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 0x0, ) == 0x0
 03704   436   NtEnumerateValueKey  (404, 6, Full, 220, ... TitleIdx=0, Type=1, Name= (404, 6, Full, 220, ... TitleIdx=0, Type=1, Name="PROCESSOR_IDENTIFIER", Data="x\08\06\0 \0F\0a\0m\0i\0l\0y\0 \01\05\0 \0M\0o\0d\0e\0l\0 \04\0 \0S\0t\0e\0p\0p\0i\0n\0g\0 \08\0,\0 \0G\0e\0n\0u\0i\0n\0e\0I\0n\0t\0e\0l\0\0\0"}, 154, ) , Data= (404, 6, Full, 220, ... TitleIdx=0, Type=1, Name="PROCESSOR_IDENTIFIER", Data="x\08\06\0 \0F\0a\0m\0i\0l\0y\0 \01\05\0 \0M\0o\0d\0e\0l\0 \04\0 \0S\0t\0e\0p\0p\0i\0n\0g\0 \08\0,\0 \0G\0e\0n\0u\0i\0n\0e\0I\0n\0t\0e\0l\0\0\0"}, 154, ) }, 154, ) == 0x0
 03705   436   NtQueryVirtualMemory  (-1, 0xa70000, Basic, 28, ... {BaseAddress=0xa70000,AllocationBase=0xa70000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 0x0, ) == 0x0
 03706   436   NtEnumerateValueKey  (404, 7, Full, 220, ... TitleIdx=0, Type=1, Name= (404, 7, Full, 220, ... TitleIdx=0, Type=1, Name="PROCESSOR_REVISION", Data="0\04\00\08\0\0\0"}, 66, ) , Data= (404, 7, Full, 220, ... TitleIdx=0, Type=1, Name="PROCESSOR_REVISION", Data="0\04\00\08\0\0\0"}, 66, ) }, 66, ) == 0x0
 03707   436   NtQueryVirtualMemory  (-1, 0xa70000, Basic, 28, ... {BaseAddress=0xa70000,AllocationBase=0xa70000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 0x0, ) == 0x0
 03708   436   NtEnumerateValueKey  (404, 8, Full, 220, ... TitleIdx=0, Type=1, Name= (404, 8, Full, 220, ... TitleIdx=0, Type=1, Name="NUMBER_OF_PROCESSORS", Data="1\0\0\0"}, 64, ) , Data= (404, 8, Full, 220, ... TitleIdx=0, Type=1, Name="NUMBER_OF_PROCESSORS", Data="1\0\0\0"}, 64, ) }, 64, ) == 0x0
 03709   436   NtQueryVirtualMemory  (-1, 0xa70000, Basic, 28, ... {BaseAddress=0xa70000,AllocationBase=0xa70000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 0x0, ) == 0x0
 03710   436   NtEnumerateValueKey  (404, 9, Full, 220, ... TitleIdx=0, Type=1, Name= (404, 9, Full, 220, ... TitleIdx=0, Type=1, Name="PATHEXT", Data=".\0C\0O\0M\0;\0.\0E\0X\0E\0;\0.\0B\0A\0T\0;\0.\0C\0M\0D\0;\0.\0V\0B\0S\0;\0.\0V\0B\0E\0;\0.\0J\0S\0;\0.\0J\0S\0E\0;\0.\0W\0S\0F\0;\0.\0W\0S\0H\0\0\0"}, 134, ) , Data= (404, 9, Full, 220, ... TitleIdx=0, Type=1, Name="PATHEXT", Data=".\0C\0O\0M\0;\0.\0E\0X\0E\0;\0.\0B\0A\0T\0;\0.\0C\0M\0D\0;\0.\0V\0B\0S\0;\0.\0V\0B\0E\0;\0.\0J\0S\0;\0.\0J\0S\0E\0;\0.\0W\0S\0F\0;\0.\0W\0S\0H\0\0\0"}, 134, ) }, 134, ) == 0x0
 03711   436   NtQueryVirtualMemory  (-1, 0xa70000, Basic, 28, ... {BaseAddress=0xa70000,AllocationBase=0xa70000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 0x0, ) == 0x0
 03712   436   NtEnumerateValueKey  (404, 10, Full, 220, ... TitleIdx=0, Type=2, Name= (404, 10, Full, 220, ... TitleIdx=0, Type=2, Name="TEMP", Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0T\0E\0M\0P\0\0\0"}, 64, ) , Data= (404, 10, Full, 220, ... TitleIdx=0, Type=2, Name="TEMP", Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0T\0E\0M\0P\0\0\0"}, 64, ) }, 64, ) == 0x0
 03713   436   NtEnumerateValueKey  (404, 11, Full, 220, ... TitleIdx=0, Type=2, Name= (404, 11, Full, 220, ... TitleIdx=0, Type=2, Name="TMP", Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0T\0E\0M\0P\0\0\0"}, 64, ) , Data= (404, 11, Full, 220, ... TitleIdx=0, Type=2, Name="TMP", Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0T\0E\0M\0P\0\0\0"}, 64, ) }, 64, ) == 0x0
 03714   436   NtEnumerateValueKey  (404, 0, Full, 220, ... TitleIdx=0, Type=2, Name= (404, 0, Full, 220, ... TitleIdx=0, Type=2, Name="ComSpec", Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0s\0y\0s\0t\0e\0m\03\02\0\\0c\0m\0d\0.\0e\0x\0e\0\0\0"}, 96, ) , Data= (404, 0, Full, 220, ... TitleIdx=0, Type=2, Name="ComSpec", Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0s\0y\0s\0t\0e\0m\03\02\0\\0c\0m\0d\0.\0e\0x\0e\0\0\0"}, 96, ) }, 96, ) == 0x0
 03715   436   NtQueryVirtualMemory  (-1, 0xa70000, Basic, 28, ... {BaseAddress=0xa70000,AllocationBase=0xa70000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 0x0, ) == 0x0
 03716   436   NtEnumerateValueKey  (404, 1, Full, 220, ... TitleIdx=0, Type=2, Name= (404, 1, Full, 220, ... TitleIdx=0, Type=2, Name="Path", Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0s\0y\0s\0t\0e\0m\03\02\0;\0%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0;\0%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0W\0b\0e\0m\0\0\0"}, 152, ) , Data= (404, 1, Full, 220, ... TitleIdx=0, Type=2, Name="Path", Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0s\0y\0s\0t\0e\0m\03\02\0;\0%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0;\0%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0W\0b\0e\0m\0\0\0"}, 152, ) }, 152, ) == 0x0
 03717   436   NtQueryVirtualMemory  (-1, 0xa70000, Basic, 28, ... {BaseAddress=0xa70000,AllocationBase=0xa70000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 0x0, ) == 0x0
 03718   436   NtEnumerateValueKey  (404, 2, Full, 220, ... TitleIdx=0, Type=2, Name= (404, 2, Full, 220, ... TitleIdx=0, Type=2, Name="windir", Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\0\0"}, 58, ) , Data= (404, 2, Full, 220, ... TitleIdx=0, Type=2, Name="windir", Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\0\0"}, 58, ) }, 58, ) == 0x0
 03719   436   NtQueryVirtualMemory  (-1, 0xa70000, Basic, 28, ... {BaseAddress=0xa70000,AllocationBase=0xa70000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 0x0, ) == 0x0
 03720   436   NtEnumerateValueKey  (404, 3, Full, 220, ... TitleIdx=0, Type=1, Name= (404, 3, Full, 220, ... TitleIdx=0, Type=1, Name="OS", Data="W\0i\0n\0d\0o\0w\0s\0_\0N\0T\0\0\0"}, 46, ) , Data= (404, 3, Full, 220, ... TitleIdx=0, Type=1, Name="OS", Data="W\0i\0n\0d\0o\0w\0s\0_\0N\0T\0\0\0"}, 46, ) }, 46, ) == 0x0
 03721   436   NtEnumerateValueKey  (404, 4, Full, 220, ... TitleIdx=0, Type=1, Name= (404, 4, Full, 220, ... TitleIdx=0, Type=1, Name="PROCESSOR_ARCHITECTURE", Data="x\08\06\0\0\0"}, 72, ) , Data= (404, 4, Full, 220, ... TitleIdx=0, Type=1, Name="PROCESSOR_ARCHITECTURE", Data="x\08\06\0\0\0"}, 72, ) }, 72, ) == 0x0
 03722   436   NtEnumerateValueKey  (404, 5, Full, 220, ... TitleIdx=0, Type=1, Name= (404, 5, Full, 220, ... TitleIdx=0, Type=1, Name="PROCESSOR_LEVEL", Data="1\05\0\0\0"}, 58, ) , Data= (404, 5, Full, 220, ... TitleIdx=0, Type=1, Name="PROCESSOR_LEVEL", Data="1\05\0\0\0"}, 58, ) }, 58, ) == 0x0
 03723   436   NtEnumerateValueKey  (404, 6, Full, 220, ... TitleIdx=0, Type=1, Name= (404, 6, Full, 220, ... TitleIdx=0, Type=1, Name="PROCESSOR_IDENTIFIER", Data="x\08\06\0 \0F\0a\0m\0i\0l\0y\0 \01\05\0 \0M\0o\0d\0e\0l\0 \04\0 \0S\0t\0e\0p\0p\0i\0n\0g\0 \08\0,\0 \0G\0e\0n\0u\0i\0n\0e\0I\0n\0t\0e\0l\0\0\0"}, 154, ) , Data= (404, 6, Full, 220, ... TitleIdx=0, Type=1, Name="PROCESSOR_IDENTIFIER", Data="x\08\06\0 \0F\0a\0m\0i\0l\0y\0 \01\05\0 \0M\0o\0d\0e\0l\0 \04\0 \0S\0t\0e\0p\0p\0i\0n\0g\0 \08\0,\0 \0G\0e\0n\0u\0i\0n\0e\0I\0n\0t\0e\0l\0\0\0"}, 154, ) }, 154, ) == 0x0
 03724   436   NtEnumerateValueKey  (404, 7, Full, 220, ... TitleIdx=0, Type=1, Name= (404, 7, Full, 220, ... TitleIdx=0, Type=1, Name="PROCESSOR_REVISION", Data="0\04\00\08\0\0\0"}, 66, ) , Data= (404, 7, Full, 220, ... TitleIdx=0, Type=1, Name="PROCESSOR_REVISION", Data="0\04\00\08\0\0\0"}, 66, ) }, 66, ) == 0x0
 03725   436   NtEnumerateValueKey  (404, 8, Full, 220, ... TitleIdx=0, Type=1, Name= (404, 8, Full, 220, ... TitleIdx=0, Type=1, Name="NUMBER_OF_PROCESSORS", Data="1\0\0\0"}, 64, ) , Data= (404, 8, Full, 220, ... TitleIdx=0, Type=1, Name="NUMBER_OF_PROCESSORS", Data="1\0\0\0"}, 64, ) }, 64, ) == 0x0
 03726   436   NtEnumerateValueKey  (404, 9, Full, 220, ... TitleIdx=0, Type=1, Name= (404, 9, Full, 220, ... TitleIdx=0, Type=1, Name="PATHEXT", Data=".\0C\0O\0M\0;\0.\0E\0X\0E\0;\0.\0B\0A\0T\0;\0.\0C\0M\0D\0;\0.\0V\0B\0S\0;\0.\0V\0B\0E\0;\0.\0J\0S\0;\0.\0J\0S\0E\0;\0.\0W\0S\0F\0;\0.\0W\0S\0H\0\0\0"}, 134, ) , Data= (404, 9, Full, 220, ... TitleIdx=0, Type=1, Name="PATHEXT", Data=".\0C\0O\0M\0;\0.\0E\0X\0E\0;\0.\0B\0A\0T\0;\0.\0C\0M\0D\0;\0.\0V\0B\0S\0;\0.\0V\0B\0E\0;\0.\0J\0S\0;\0.\0J\0S\0E\0;\0.\0W\0S\0F\0;\0.\0W\0S\0H\0\0\0"}, 134, ) }, 134, ) == 0x0
 03727   436   NtEnumerateValueKey  (404, 10, Full, 220, ... TitleIdx=0, Type=2, Name= (404, 10, Full, 220, ... TitleIdx=0, Type=2, Name="TEMP", Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0T\0E\0M\0P\0\0\0"}, 64, ) , Data= (404, 10, Full, 220, ... TitleIdx=0, Type=2, Name="TEMP", Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0T\0E\0M\0P\0\0\0"}, 64, ) }, 64, ) == 0x0
 03728   436   NtQueryInformationProcess  (-1, DefaultHardErrorMode, 4, ... {process info, class 12, size 4}, 0x0, ) == 0x0
 03729   436   NtSetInformationProcess  (-1, DefaultHardErrorMode, {process info, class 12, size 4}, 4, ... ) == 0x0
 03730   436   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\TEMP"}, 1236548, ... ) }, 1236548, ... ) == 0x0
 03731   436   NtQueryInformationProcess  (-1, DefaultHardErrorMode, 4, ... {process info, class 12, size 4}, 0x0, ) == 0x0
 03732   436   NtSetInformationProcess  (-1, DefaultHardErrorMode, {process info, class 12, size 4}, 4, ... ) == 0x0
 03733   436   NtQueryVirtualMemory  (-1, 0xa70000, Basic, 28, ... {BaseAddress=0xa70000,AllocationBase=0xa70000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 0x0, ) == 0x0
 03734   436   NtEnumerateValueKey  (404, 11, Full, 220, ... TitleIdx=0, Type=2, Name= (404, 11, Full, 220, ... TitleIdx=0, Type=2, Name="TMP", Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0T\0E\0M\0P\0\0\0"}, 64, ) , Data= (404, 11, Full, 220, ... TitleIdx=0, Type=2, Name="TMP", Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0T\0E\0M\0P\0\0\0"}, 64, ) }, 64, ) == 0x0
 03735   436   NtQueryInformationProcess  (-1, DefaultHardErrorMode, 4, ... {process info, class 12, size 4}, 0x0, ) == 0x0
 03736   436   NtSetInformationProcess  (-1, DefaultHardErrorMode, {process info, class 12, size 4}, 4, ... ) == 0x0
 03737   436   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\TEMP"}, 1236548, ... ) }, 1236548, ... ) == 0x0
 03738   436   NtQueryInformationProcess  (-1, DefaultHardErrorMode, 4, ... {process info, class 12, size 4}, 0x0, ) == 0x0
 03739   436   NtSetInformationProcess  (-1, DefaultHardErrorMode, {process info, class 12, size 4}, 4, ... ) == 0x0
 03740   436   NtQueryVirtualMemory  (-1, 0xa70000, Basic, 28, ... {BaseAddress=0xa70000,AllocationBase=0xa70000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 0x0, ) == 0x0
 03741   436   NtClose  (404, ... ) == 0x0
 03742   436   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\System\CurrentControlSet\Control\ComputerName"}, ... 404, ) }, ... 404, ) == 0x0
 03743   436   NtOpenKey  (0x20019, {24, 404, 0x40, 0, 0,  (0x20019, {24, 404, 0x40, 0, 0, "ActiveComputerName"}, ... 416, ) }, ... 416, ) == 0x0
 03744   436   NtQueryValueKey  (416,  (416, "ComputerName", Full, 108, ... TitleIdx=0, Type=1, Name="ComputerName", Data="M\0Y\0W\0O\0R\0L\0D\0\0\0"}, 60, ) , Full, 108, ... TitleIdx=0, Type=1, Name= (416, "ComputerName", Full, 108, ... TitleIdx=0, Type=1, Name="ComputerName", Data="M\0Y\0W\0O\0R\0L\0D\0\0\0"}, 60, ) , Data= (416, "ComputerName", Full, 108, ... TitleIdx=0, Type=1, Name="ComputerName", Data="M\0Y\0W\0O\0R\0L\0D\0\0\0"}, 60, ) }, 60, ) == 0x0
 03745   436   NtClose  (416, ... ) == 0x0
 03746   436   NtClose  (404, ... ) == 0x0
 03747   436   NtQueryVirtualMemory  (-1, 0xa70000, Basic, 28, ... {BaseAddress=0xa70000,AllocationBase=0xa70000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 0x0, ) == 0x0
 03748   436   NtOpenKey  (0x20019, {24, 48, 0x40, 0, 0,  (0x20019, {24, 48, 0x40, 0, 0, "Software\Microsoft\Windows NT\CurrentVersion\ProfileList"}, ... 404, ) }, ... 404, ) == 0x0
 03749   436   NtQueryValueKey  (404,  (404, "ProfilesDirectory", Partial, 144, ... TitleIdx=0, Type=2, Data="%\0S\0y\0s\0t\0e\0m\0D\0r\0i\0v\0e\0%\0\\0D\0o\0c\0u\0m\0e\0n\0t\0s\0 \0a\0n\0d\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\0\0"}, 86, ) , Partial, 144, ... TitleIdx=0, Type=2, Data= (404, "ProfilesDirectory", Partial, 144, ... TitleIdx=0, Type=2, Data="%\0S\0y\0s\0t\0e\0m\0D\0r\0i\0v\0e\0%\0\\0D\0o\0c\0u\0m\0e\0n\0t\0s\0 \0a\0n\0d\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\0\0"}, 86, ) }, 86, ) == 0x0
 03750   436   NtClose  (404, ... ) == 0x0
 03751   436   NtOpenKey  (0x20019, {24, 48, 0x40, 0, 0,  (0x20019, {24, 48, 0x40, 0, 0, "Software\Microsoft\Windows NT\CurrentVersion\ProfileList"}, ... 404, ) }, ... 404, ) == 0x0
 03752   436   NtQueryValueKey  (404,  (404, "DefaultUserProfile", Partial, 144, ... TitleIdx=0, Type=1, Data="D\0e\0f\0a\0u\0l\0t\0 \0U\0s\0e\0r\0\0\0"}, 38, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (404, "DefaultUserProfile", Partial, 144, ... TitleIdx=0, Type=1, Data="D\0e\0f\0a\0u\0l\0t\0 \0U\0s\0e\0r\0\0\0"}, 38, ) }, 38, ) == 0x0
 03753   436   NtClose  (404, ... ) == 0x0
 03754   436   NtQueryVirtualMemory  (-1, 0xa70000, Basic, 28, ... {BaseAddress=0xa70000,AllocationBase=0xa70000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 0x0, ) == 0x0
 03755   436   NtOpenKey  (0x20019, {24, 48, 0x40, 0, 0,  (0x20019, {24, 48, 0x40, 0, 0, "Software\Microsoft\Windows\CurrentVersion"}, ... 404, ) }, ... 404, ) == 0x0
 03756   436   NtQueryValueKey  (404,  (404, "ProgramFilesDir", Partial, 144, ... TitleIdx=0, Type=1, Data="C\0:\0\\0P\0r\0o\0g\0r\0a\0m\0 \0F\0i\0l\0e\0s\0\0\0"}, 46, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (404, "ProgramFilesDir", Partial, 144, ... TitleIdx=0, Type=1, Data="C\0:\0\\0P\0r\0o\0g\0r\0a\0m\0 \0F\0i\0l\0e\0s\0\0\0"}, 46, ) }, 46, ) == 0x0
 03757   436   NtQueryVirtualMemory  (-1, 0xa70000, Basic, 28, ... {BaseAddress=0xa70000,AllocationBase=0xa70000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 0x0, ) == 0x0
 03758   436   NtQueryValueKey  (404,  (404, "CommonFilesDir", Partial, 144, ... TitleIdx=0, Type=1, Data="C\0:\0\\0P\0r\0o\0g\0r\0a\0m\0 \0F\0i\0l\0e\0s\0\\0C\0o\0m\0m\0o\0n\0 \0F\0i\0l\0e\0s\0\0\0"}, 72, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (404, "CommonFilesDir", Partial, 144, ... TitleIdx=0, Type=1, Data="C\0:\0\\0P\0r\0o\0g\0r\0a\0m\0 \0F\0i\0l\0e\0s\0\\0C\0o\0m\0m\0o\0n\0 \0F\0i\0l\0e\0s\0\0\0"}, 72, ) }, 72, ) == 0x0
 03759   436   NtQueryVirtualMemory  (-1, 0xa70000, Basic, 28, ... {BaseAddress=0xa70000,AllocationBase=0xa70000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 0x0, ) == 0x0
 03760   436   NtClose  (404, ... ) == 0x0
 03761   436   NtQueryInformationToken  (408, User, 200, ... {token info, class 1, size 36}, 36, ) == 0x0
 03762   436   NtOpenKey  (0x20019, {24, 356, 0x40, 0, 0,  (0x20019, {24, 356, 0x40, 0, 0, "S-1-5-21-1078081533-484763869-839522115-1003"}, ... 404, ) }, ... 404, ) == 0x0
 03763   436   NtOpenThreadToken  (-2, 0x2000c, 1, ... ) == STATUS_NO_TOKEN
 03764   436   NtQueryInformationToken  (408, Type, 4, ... {token info, class 8, size 4}, 4, ) == 0x0
 03765   436   NtDuplicateToken  (408, 0xc, {24, 0, 0x0, 0, 1237932, 0x0}, 0, 2, ... ) == STATUS_ACCESS_DENIED
 03766   436   NtQueryInformationToken  (408, User, 200, ... {token info, class 1, size 36}, 36, ) == 0x0
 03767   436   NtOpenThreadToken  (-2, 0xc, 1, ... ) == STATUS_NO_TOKEN
 03768   436   NtCreateEvent  (0x1f0003, 0x0, 1, 0, ... 416, ) == 0x0
 03769   436   NtOpenThreadToken  (-2, 0xc, 1, ... ) == STATUS_NO_TOKEN
 03770   436   NtSetInformationThread  (-2, ImpersonationToken, {ImpToken=0,}, 4, ... ) == 0x0
 03771   436   NtCreateFile  (0xc0100080, {24, 0, 0x40, 0, 1236136,  (0xc0100080, {24, 0, 0x40, 0, 1236136, "\??\PIPE\lsarpc"}, 0x0, 0, 3, 1, 64, 0, 0, ... 420, {status=0x0, info=1}, ) }, 0x0, 0, 3, 1, 64, 0, 0, ... 420, {status=0x0, info=1}, ) == 0x0
 03772   436   NtSetInformationFile  (420, 1236192, 8, Pipe, ... {status=0x0, info=0}, ) == 0x0
 03773   436   NtSetInformationFile  (420, 1236184, 8, Completion, ... {status=0x0, info=0}, ) == 0x0
 03774   436   NtSetInformationThread  (-2, ImpersonationToken, {ImpToken=0,}, 4, ... ) == 0x0
 03775   436   NtWriteFile  (420, 325, 0, 0,  (420, 325, 0, 0, "\5\0\13\3\20\0\0\0H\0\0\0\1\0\0\0\270\20\270\20\0\0\0\0\1\0\0\0\0\0\1\0xW4\224\22\315\253\357\0\1#Eg\211\253\0\0\0\0\4]\210\212\353\34\311\21\237\350\10\0+\20H`\2\0\0\0", 72, {0, 0}, 0, ... {status=0x0, info=72}, ) , 72, {0, 0}, 0, ... {status=0x0, info=72}, ) == 0x0
 03776   436   NtReadFile  (420, 325, 0, 0, 1024, {0, 0}, 0, ... {status=0x0, info=68},  (420, 325, 0, 0, 1024, {0, 0}, 0, ... {status=0x0, info=68}, "\5\0\14\3\20\0\0\0D\0\0\0\1\0\0\0\270\20\270\20\361\36\0\0\14\0\PIPE\lsass\0\0\0\1\0\0\0\0\0\0\0\4]\210\212\353\34\311\21\237\350\10\0+\20H`\2\0\0\0", ) , ) == 0x0
 03777   436   NtFsControlFile  (420, 325, 0x0, 0x0, 0x11c017,  (420, 325, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0@\0\0\0\1\0\0\0(\0\0\0\0\0,\0\0\0\0\0\30\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\\343\22\0\14\0\0\0\2\0\1\0\0\10\0\0", 64, 1024, ... {status=0x103, info=68}, "\5\0\14\3\20\0\0\0D\0\0\0\1\0\0\0\270\20\270\20\361\36\0\0\14\0\PIPE\lsass\0\0\0\1\0\0\0\0\0\0\0\4]\210\212\353\34\311\21\237\350\10\0+\20H`\2\0\0\0", ) , 64, 1024, ... {status=0x103, info=68},  (420, 325, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0@\0\0\0\1\0\0\0(\0\0\0\0\0,\0\0\0\0\0\30\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\\343\22\0\14\0\0\0\2\0\1\0\0\10\0\0", 64, 1024, ... {status=0x103, info=68}, "\5\0\14\3\20\0\0\0D\0\0\0\1\0\0\0\270\20\270\20\361\36\0\0\14\0\PIPE\lsass\0\0\0\1\0\0\0\0\0\0\0\4]\210\212\353\34\311\21\237\350\10\0+\20H`\2\0\0\0", ) , ) == 0x103
 03778   436   NtFsControlFile  (420, 325, 0x0, 0x0, 0x11c017,  (420, 325, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0t\0\0\0\2\0\0\0\\0\0\0\0\09\0\0\0\0\0\243\350\250\331*,\334\21\261\306\0\14)\371\246\305\1\0\0\0\224\343\22\0\1\0\0\0\30\353\25\0\5\0\0\0\1\5\0\0\0\0\0\5\25\0\0\0\3757B@\335\350\344\34C\27\122\353\3\0\0\0\0\0\0\0\0\0\0\1\0l\0\0\0\0\0\0\0\0\0\2\0\0\0", 116, 1024, ... {status=0x103, info=48}, "\5\0\2\3\20\0\0\00\0\0\0\1\0\0\0\30\0\0\0\0\0\0\0\0\0\0\0\243\350\250\331*,\334\21\261\306\0\14)\371\246\305\0\0\0\0", ) , 116, 1024, ... {status=0x103, info=48},  (420, 325, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0t\0\0\0\2\0\0\0\\0\0\0\0\09\0\0\0\0\0\243\350\250\331*,\334\21\261\306\0\14)\371\246\305\1\0\0\0\224\343\22\0\1\0\0\0\30\353\25\0\5\0\0\0\1\5\0\0\0\0\0\5\25\0\0\0\3757B@\335\350\344\34C\27\122\353\3\0\0\0\0\0\0\0\0\0\0\1\0l\0\0\0\0\0\0\0\0\0\2\0\0\0", 116, 1024, ... {status=0x103, info=48}, "\5\0\2\3\20\0\0\00\0\0\0\1\0\0\0\30\0\0\0\0\0\0\0\0\0\0\0\243\350\250\331*,\334\21\261\306\0\14)\371\246\305\0\0\0\0", ) , ) == 0x103
 03779   436   NtFsControlFile  (420, 325, 0x0, 0x0, 0x11c017,  (420, 325, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0,\0\0\0\3\0\0\0\24\0\0\0\0\0\0\0\0\0\0\0\243\350\250\331*,\334\21\261\306\0\14)\371\246\305", 44, 1024, ... {status=0x103, info=180}, "\5\0\2\3\20\0\0\0\264\0\0\0\2\0\0\0\234\0\0\0\0\0\0\0 \242\25\0\1\0\0\0,\242\25\0 \0\0\0\1\0\0\0\16\0\20\08\242\25\0H\242\25\0\10\0\0\0\0\0\0\0\7\0\0\0M\0Y\0W\0O\0R\0L\0D\0O\0\4\0\0\0\1\4\0\0\0\0\0\5\25\0\0\0\3757B@\335\350\344\34C\27\122\1\0\0\0\310\266\25\0\1\0\0\0\1\0\0\0\20\0\22\0\334\266\25\0\0\0\0\0\0\0\0\0\11\0\0\0\0\0\0\0\10\0\0\0S\0R\0I\0-\0u\0s\0e\0r\0\1\0\0\0\0\0\0\0", ) , 44, 1024, ... {status=0x103, info=180},  (420, 325, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0,\0\0\0\3\0\0\0\24\0\0\0\0\0\0\0\0\0\0\0\243\350\250\331*,\334\21\261\306\0\14)\371\246\305", 44, 1024, ... {status=0x103, info=180}, "\5\0\2\3\20\0\0\0\264\0\0\0\2\0\0\0\234\0\0\0\0\0\0\0 \242\25\0\1\0\0\0,\242\25\0 \0\0\0\1\0\0\0\16\0\20\08\242\25\0H\242\25\0\10\0\0\0\0\0\0\0\7\0\0\0M\0Y\0W\0O\0R\0L\0D\0O\0\4\0\0\0\1\4\0\0\0\0\0\5\25\0\0\0\3757B@\335\350\344\34C\27\122\1\0\0\0\310\266\25\0\1\0\0\0\1\0\0\0\20\0\22\0\334\266\25\0\0\0\0\0\0\0\0\0\11\0\0\0\0\0\0\0\10\0\0\0S\0R\0I\0-\0u\0s\0e\0r\0\1\0\0\0\0\0\0\0", ) , ) == 0x103
 03780   436   NtClose  (416, ... ) == 0x0
 03781   436   NtClose  (420, ... ) == 0x0
 03782   436   NtOpenThreadToken  (-2, 0xc, 1, ... ) == STATUS_NO_TOKEN
 03783   436   NtCreateEvent  (0x1f0003, 0x0, 1, 0, ... 420, ) == 0x0
 03784   436   NtOpenThreadToken  (-2, 0xc, 1, ... ) == STATUS_NO_TOKEN
 03785   436   NtSetInformationThread  (-2, ImpersonationToken, {ImpToken=0,}, 4, ... ) == 0x0
 03786   436   NtCreateFile  (0xc0100080, {24, 0, 0x40, 0, 1236132,  (0xc0100080, {24, 0, 0x40, 0, 1236132, "\??\PIPE\lsarpc"}, 0x0, 0, 3, 1, 64, 0, 0, ... 416, {status=0x0, info=1}, ) }, 0x0, 0, 3, 1, 64, 0, 0, ... 416, {status=0x0, info=1}, ) == 0x0
 03787   436   NtSetInformationFile  (416, 1236188, 8, Pipe, ... {status=0x0, info=0}, ) == 0x0
 03788   436   NtSetInformationFile  (416, 1236180, 8, Completion, ... {status=0x0, info=0}, ) == 0x0
 03789   436   NtSetInformationThread  (-2, ImpersonationToken, {ImpToken=0,}, 4, ... ) == 0x0
 03790   436   NtWriteFile  (416, 325, 0, 0,  (416, 325, 0, 0, "\5\0\13\3\20\0\0\0H\0\0\0\1\0\0\0\270\20\270\20\0\0\0\0\1\0\0\0\0\0\1\0xW4\224\22\315\253\357\0\1#Eg\211\253\0\0\0\0\4]\210\212\353\34\311\21\237\350\10\0+\20H`\2\0\0\0", 72, {0, 0}, 0, ... {status=0x0, info=72}, ) , 72, {0, 0}, 0, ... {status=0x0, info=72}, ) == 0x0
 03791   436   NtReadFile  (416, 325, 0, 0, 1024, {0, 0}, 0, ... {status=0x0, info=68},  (416, 325, 0, 0, 1024, {0, 0}, 0, ... {status=0x0, info=68}, "\5\0\14\3\20\0\0\0D\0\0\0\1\0\0\0\270\20\270\20\362\36\0\0\14\0\PIPE\lsass\0\0\0\1\0\0\0\0\0\0\0\4]\210\212\353\34\311\21\237\350\10\0+\20H`\2\0\0\0", ) , ) == 0x0
 03792   436   NtFsControlFile  (416, 325, 0x0, 0x0, 0x11c017,  (416, 325, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0@\0\0\0\1\0\0\0(\0\0\0\0\0,\0\0\0\0\0\30\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0X\343\22\0\14\0\0\0\2\0\1\0\0\10\0\0", 64, 1024, ... {status=0x103, info=68}, "\5\0\14\3\20\0\0\0D\0\0\0\1\0\0\0\270\20\270\20\362\36\0\0\14\0\PIPE\lsass\0\0\0\1\0\0\0\0\0\0\0\4]\210\212\353\34\311\21\237\350\10\0+\20H`\2\0\0\0", ) , 64, 1024, ... {status=0x103, info=68},  (416, 325, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0@\0\0\0\1\0\0\0(\0\0\0\0\0,\0\0\0\0\0\30\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0X\343\22\0\14\0\0\0\2\0\1\0\0\10\0\0", 64, 1024, ... {status=0x103, info=68}, "\5\0\14\3\20\0\0\0D\0\0\0\1\0\0\0\270\20\270\20\362\36\0\0\14\0\PIPE\lsass\0\0\0\1\0\0\0\0\0\0\0\4]\210\212\353\34\311\21\237\350\10\0+\20H`\2\0\0\0", ) , ) == 0x103
 03793   436   NtFsControlFile  (416, 325, 0x0, 0x0, 0x11c017,  (416, 325, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0t\0\0\0\2\0\0\0\\0\0\0\0\09\0\0\0\0\0\244\350\250\331*,\334\21\261\306\0\14)\371\246\305\1\0\0\0\220\343\22\0\1\0\0\0\30\353\25\0\5\0\0\0\1\5\0\0\0\0\0\5\25\0\0\0\3757B@\335\350\344\34C\27\122\353\3\0\0\0\0\0\0\0\0\0\0\1\0l\0\0\0\0\0\0\0\0\0\2\0\0\0", 116, 1024, ... {status=0x103, info=48}, "\5\0\2\3\20\0\0\00\0\0\0\1\0\0\0\30\0\0\0\0\0\0\0\0\0\0\0\244\350\250\331*,\334\21\261\306\0\14)\371\246\305\0\0\0\0", ) , 116, 1024, ... {status=0x103, info=48},  (416, 325, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0t\0\0\0\2\0\0\0\\0\0\0\0\09\0\0\0\0\0\244\350\250\331*,\334\21\261\306\0\14)\371\246\305\1\0\0\0\220\343\22\0\1\0\0\0\30\353\25\0\5\0\0\0\1\5\0\0\0\0\0\5\25\0\0\0\3757B@\335\350\344\34C\27\122\353\3\0\0\0\0\0\0\0\0\0\0\1\0l\0\0\0\0\0\0\0\0\0\2\0\0\0", 116, 1024, ... {status=0x103, info=48}, "\5\0\2\3\20\0\0\00\0\0\0\1\0\0\0\30\0\0\0\0\0\0\0\0\0\0\0\244\350\250\331*,\334\21\261\306\0\14)\371\246\305\0\0\0\0", ) , ) == 0x103
 03794   436   NtFsControlFile  (416, 325, 0x0, 0x0, 0x11c017,  (416, 325, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0,\0\0\0\3\0\0\0\24\0\0\0\0\0\0\0\0\0\0\0\244\350\250\331*,\334\21\261\306\0\14)\371\246\305", 44, 1024, ... {status=0x103, info=180}, "\5\0\2\3\20\0\0\0\264\0\0\0\2\0\0\0\234\0\0\0\0\0\0\0 \242\25\0\1\0\0\0,\242\25\0 \0\0\0\1\0\0\0\16\0\20\08\242\25\0H\242\25\0\10\0\0\0\0\0\0\0\7\0\0\0M\0Y\0W\0O\0R\0L\0D\0O\0\4\0\0\0\1\4\0\0\0\0\0\5\25\0\0\0\3757B@\335\350\344\34C\27\122\1\0\0\0\310\266\25\0\1\0\0\0\1\0\0\0\20\0\22\0\334\266\25\0\0\0\0\0\0\0\0\0\11\0\0\0\0\0\0\0\10\0\0\0S\0R\0I\0-\0u\0s\0e\0r\0\1\0\0\0\0\0\0\0", ) , 44, 1024, ... {status=0x103, info=180},  (416, 325, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0,\0\0\0\3\0\0\0\24\0\0\0\0\0\0\0\0\0\0\0\244\350\250\331*,\334\21\261\306\0\14)\371\246\305", 44, 1024, ... {status=0x103, info=180}, "\5\0\2\3\20\0\0\0\264\0\0\0\2\0\0\0\234\0\0\0\0\0\0\0 \242\25\0\1\0\0\0,\242\25\0 \0\0\0\1\0\0\0\16\0\20\08\242\25\0H\242\25\0\10\0\0\0\0\0\0\0\7\0\0\0M\0Y\0W\0O\0R\0L\0D\0O\0\4\0\0\0\1\4\0\0\0\0\0\5\25\0\0\0\3757B@\335\350\344\34C\27\122\1\0\0\0\310\266\25\0\1\0\0\0\1\0\0\0\20\0\22\0\334\266\25\0\0\0\0\0\0\0\0\0\11\0\0\0\0\0\0\0\10\0\0\0S\0R\0I\0-\0u\0s\0e\0r\0\1\0\0\0\0\0\0\0", ) , ) == 0x103
 03795   436   NtClose  (420, ... ) == 0x0
 03796   436   NtClose  (416, ... ) == 0x0
 03797   436   NtQueryVirtualMemory  (-1, 0xa70000, Basic, 28, ... {BaseAddress=0xa70000,AllocationBase=0xa70000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 0x0, ) == 0x0
 03798   436   NtQueryVirtualMemory  (-1, 0xa70000, Basic, 28, ... {BaseAddress=0xa70000,AllocationBase=0xa70000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 0x0, ) == 0x0
 03799   436   NtQueryInformationToken  (408, User, 200, ... {token info, class 1, size 36}, 36, ) == 0x0
 03800   436   NtOpenKey  (0x20019, {24, 48, 0x40, 0, 0,  (0x20019, {24, 48, 0x40, 0, 0, "Software\Microsoft\Windows NT\CurrentVersion\ProfileList\S-1-5-21-1078081533-484763869-839522115-1003"}, ... 416, ) }, ... 416, ) == 0x0
 03801   436   NtQueryValueKey  (416,  (416, "ProfileImagePath", Partial, 144, ... TitleIdx=0, Type=2, Data="%\0S\0y\0s\0t\0e\0m\0D\0r\0i\0v\0e\0%\0\\0D\0o\0c\0u\0m\0e\0n\0t\0s\0 \0a\0n\0d\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0S\0R\0I\0-\0u\0s\0e\0r\0\0\0"}, 104, ) , Partial, 144, ... TitleIdx=0, Type=2, Data= (416, "ProfileImagePath", Partial, 144, ... TitleIdx=0, Type=2, Data="%\0S\0y\0s\0t\0e\0m\0D\0r\0i\0v\0e\0%\0\\0D\0o\0c\0u\0m\0e\0n\0t\0s\0 \0a\0n\0d\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0S\0R\0I\0-\0u\0s\0e\0r\0\0\0"}, 104, ) }, 104, ) == 0x0
 03802   436   NtClose  (416, ... ) == 0x0
 03803   436   NtCreateKey  (0x2001f, {24, 404, 0x40, 0, 0,  (0x2001f, {24, 404, 0x40, 0, 0, "Software\Microsoft\Windows NT\CurrentVersion\Winlogon"}, 0, 0x0, 0, ... 416, 2, ) }, 0, 0x0, 0, ... 416, 2, ) == 0x0
 03804   436   NtQueryValueKey  (416,  (416, "ParseAutoexec", Partial, 144, ... TitleIdx=0, Type=1, Data="1\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (416, "ParseAutoexec", Partial, 144, ... TitleIdx=0, Type=1, Data="1\0\0\0"}, 16, ) }, 16, ) == 0x0
 03805   436   NtClose  (416, ... ) == 0x0
 03806   436   NtQueryInformationProcess  (-1, DefaultHardErrorMode, 4, ... {process info, class 12, size 4}, 0x0, ) == 0x0
 03807   436   NtSetInformationProcess  (-1, DefaultHardErrorMode, {process info, class 12, size 4}, 4, ... ) == 0x0
 03808   436   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\c:\autoexec.bat"}, 1237836, ... ) }, 1237836, ... ) == 0x0
 03809   436   NtCreateFile  (0x80100080, {24, 0, 0x40, 0, 1237844,  (0x80100080, {24, 0, 0x40, 0, 1237844, "\??\c:\autoexec.bat"}, 0x0, 128, 1, 1, 96, 0, 0, ... 416, {status=0x0, info=1}, ) }, 0x0, 128, 1, 1, 96, 0, 0, ... 416, {status=0x0, info=1}, ) == 0x0
 03810   436   NtQueryInformationProcess  (-1, DefaultHardErrorMode, 4, ... {process info, class 12, size 4}, 0x0, ) == 0x0
 03811   436   NtSetInformationProcess  (-1, DefaultHardErrorMode, {process info, class 12, size 4}, 4, ... ) == 0x0
 03812   436   NtQueryInformationFile  (416, 1237860, 24, Standard, ... {status=0x0, info=24}, ) == 0x0
 03813   436   NtReadFile  (416, 0, 0, 0, 0, 0x0, 0, ... {status=0x0, info=0}, "", ) == 0x0
 03814   436   NtClose  (416, ... ) == 0x0
 03815   436   NtOpenKey  (0x20019, {24, 404, 0x40, 0, 0,  (0x20019, {24, 404, 0x40, 0, 0, "Environment"}, ... 416, ) }, ... 416, ) == 0x0
 03816   436   NtEnumerateValueKey  (416, 0, Full, 220, ... TitleIdx=0, Type=2, Name= (416, 0, Full, 220, ... TitleIdx=0, Type=2, Name="TEMP", Data="%\0U\0S\0E\0R\0P\0R\0O\0F\0I\0L\0E\0%\0\\0L\0o\0c\0a\0l\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0T\0e\0m\0p\0\0\0"}, 96, ) , Data= (416, 0, Full, 220, ... TitleIdx=0, Type=2, Name="TEMP", Data="%\0U\0S\0E\0R\0P\0R\0O\0F\0I\0L\0E\0%\0\\0L\0o\0c\0a\0l\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0T\0e\0m\0p\0\0\0"}, 96, ) }, 96, ) == 0x0
 03817   436   NtEnumerateValueKey  (416, 1, Full, 220, ... TitleIdx=0, Type=2, Name= (416, 1, Full, 220, ... TitleIdx=0, Type=2, Name="TMP", Data="%\0U\0S\0E\0R\0P\0R\0O\0F\0I\0L\0E\0%\0\\0L\0o\0c\0a\0l\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0T\0e\0m\0p\0\0\0"}, 96, ) , Data= (416, 1, Full, 220, ... TitleIdx=0, Type=2, Name="TMP", Data="%\0U\0S\0E\0R\0P\0R\0O\0F\0I\0L\0E\0%\0\\0L\0o\0c\0a\0l\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0T\0e\0m\0p\0\0\0"}, 96, ) }, 96, ) == 0x0
 03818   436   NtEnumerateValueKey  (416, 2, Full, 220, ... ) == STATUS_NO_MORE_ENTRIES
 03819   436   NtEnumerateValueKey  (416, 0, Full, 220, ... TitleIdx=0, Type=2, Name= (416, 0, Full, 220, ... TitleIdx=0, Type=2, Name="TEMP", Data="%\0U\0S\0E\0R\0P\0R\0O\0F\0I\0L\0E\0%\0\\0L\0o\0c\0a\0l\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0T\0e\0m\0p\0\0\0"}, 96, ) , Data= (416, 0, Full, 220, ... TitleIdx=0, Type=2, Name="TEMP", Data="%\0U\0S\0E\0R\0P\0R\0O\0F\0I\0L\0E\0%\0\\0L\0o\0c\0a\0l\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0T\0e\0m\0p\0\0\0"}, 96, ) }, 96, ) == 0x0
 03820   436   NtQueryInformationProcess  (-1, DefaultHardErrorMode, 4, ... {process info, class 12, size 4}, 0x0, ) == 0x0
 03821   436   NtSetInformationProcess  (-1, DefaultHardErrorMode, {process info, class 12, size 4}, 4, ... ) == 0x0
 03822   436   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\Documents and Settings\SRI-user\Local Settings\Temp"}, 1236576, ... ) }, 1236576, ... ) == 0x0
 03823   436   NtOpenFile  (0x100001, {24, 0, 0x40, 0, 0,  (0x100001, {24, 0, 0x40, 0, 0, "\??\C:\"}, 3, 16417, ... 420, {status=0x0, info=1}, ) }, 3, 16417, ... 420, {status=0x0, info=1}, ) == 0x0
 03824   436   NtQueryDirectoryFile  (420, 0, 0, 0, 1235936, 616, BothDirectory, 1,  (420, 0, 0, 0, 1235936, 616, BothDirectory, 1, "Documents and Settings", 0, ... {status=0x0, info=138}, ) , 0, ... {status=0x0, info=138}, ) == 0x0
 03825   436   NtClose  (420, ... ) == 0x0
 03826   436   NtOpenFile  (0x100001, {24, 0, 0x40, 0, 0,  (0x100001, {24, 0, 0x40, 0, 0, "\??\C:\Documents and Settings\SRI-user\"}, 3, 16417, ... 420, {status=0x0, info=1}, ) }, 3, 16417, ... 420, {status=0x0, info=1}, ) == 0x0
 03827   436   NtQueryDirectoryFile  (420, 0, 0, 0, 1235936, 616, BothDirectory, 1,  (420, 0, 0, 0, 1235936, 616, BothDirectory, 1, "Local Settings", 0, ... {status=0x0, info=122}, ) , 0, ... {status=0x0, info=122}, ) == 0x0
 03828   436   NtClose  (420, ... ) == 0x0
 03829   436   NtQueryInformationProcess  (-1, DefaultHardErrorMode, 4, ... {process info, class 12, size 4}, 0x0, ) == 0x0
 03830   436   NtSetInformationProcess  (-1, DefaultHardErrorMode, {process info, class 12, size 4}, 4, ... ) == 0x0
 03831   436   NtQueryVirtualMemory  (-1, 0xa70000, Basic, 28, ... {BaseAddress=0xa70000,AllocationBase=0xa70000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 0x0, ) == 0x0
 03832   436   NtEnumerateValueKey  (416, 1, Full, 220, ... TitleIdx=0, Type=2, Name= (416, 1, Full, 220, ... TitleIdx=0, Type=2, Name="TMP", Data="%\0U\0S\0E\0R\0P\0R\0O\0F\0I\0L\0E\0%\0\\0L\0o\0c\0a\0l\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0T\0e\0m\0p\0\0\0"}, 96, ) , Data= (416, 1, Full, 220, ... TitleIdx=0, Type=2, Name="TMP", Data="%\0U\0S\0E\0R\0P\0R\0O\0F\0I\0L\0E\0%\0\\0L\0o\0c\0a\0l\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0T\0e\0m\0p\0\0\0"}, 96, ) }, 96, ) == 0x0
 03833   436   NtQueryInformationProcess  (-1, DefaultHardErrorMode, 4, ... {process info, class 12, size 4}, 0x0, ) == 0x0
 03834   436   NtSetInformationProcess  (-1, DefaultHardErrorMode, {process info, class 12, size 4}, 4, ... ) == 0x0
 03835   436   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\Documents and Settings\SRI-user\Local Settings\Temp"}, 1236576, ... ) }, 1236576, ... ) == 0x0
 03836   436   NtOpenFile  (0x100001, {24, 0, 0x40, 0, 0,  (0x100001, {24, 0, 0x40, 0, 0, "\??\C:\"}, 3, 16417, ... 420, {status=0x0, info=1}, ) }, 3, 16417, ... 420, {status=0x0, info=1}, ) == 0x0
 03837   436   NtQueryDirectoryFile  (420, 0, 0, 0, 1235936, 616, BothDirectory, 1,  (420, 0, 0, 0, 1235936, 616, BothDirectory, 1, "Documents and Settings", 0, ... {status=0x0, info=138}, ) , 0, ... {status=0x0, info=138}, ) == 0x0
 03838   436   NtClose  (420, ... ) == 0x0
 03839   436   NtOpenFile  (0x100001, {24, 0, 0x40, 0, 0,  (0x100001, {24, 0, 0x40, 0, 0, "\??\C:\Documents and Settings\SRI-user\"}, 3, 16417, ... 420, {status=0x0, info=1}, ) }, 3, 16417, ... 420, {status=0x0, info=1}, ) == 0x0
 03840   436   NtQueryDirectoryFile  (420, 0, 0, 0, 1235936, 616, BothDirectory, 1,  (420, 0, 0, 0, 1235936, 616, BothDirectory, 1, "Local Settings", 0, ... {status=0x0, info=122}, ) , 0, ... {status=0x0, info=122}, ) == 0x0
 03841   436   NtClose  (420, ... ) == 0x0
 03842   436   NtQueryInformationProcess  (-1, DefaultHardErrorMode, 4, ... {process info, class 12, size 4}, 0x0, ) == 0x0
 03843   436   NtSetInformationProcess  (-1, DefaultHardErrorMode, {process info, class 12, size 4}, 4, ... ) == 0x0
 03844   436   NtQueryVirtualMemory  (-1, 0xa70000, Basic, 28, ... {BaseAddress=0xa70000,AllocationBase=0xa70000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 0x0, ) == 0x0
 03845   436   NtEnumerateValueKey  (416, 2, Full, 220, ... ) == STATUS_NO_MORE_ENTRIES
 03846   436   NtClose  (416, ... ) == 0x0
 03847   436   NtOpenKey  (0x20019, {24, 404, 0x40, 0, 0,  (0x20019, {24, 404, 0x40, 0, 0, "Volatile Environment"}, ... 416, ) }, ... 416, ) == 0x0
 03848   436   NtEnumerateValueKey  (416, 0, Full, 220, ... TitleIdx=0, Type=1, Name= (416, 0, Full, 220, ... TitleIdx=0, Type=1, Name="LOGONSERVER", Data="\\0\\0M\0Y\0W\0O\0R\0L\0D\0\0\0"}, 64, ) , Data= (416, 0, Full, 220, ... TitleIdx=0, Type=1, Name="LOGONSERVER", Data="\\0\\0M\0Y\0W\0O\0R\0L\0D\0\0\0"}, 64, ) }, 64, ) == 0x0
 03849   436   NtQueryVirtualMemory  (-1, 0xa70000, Basic, 28, ... {BaseAddress=0xa70000,AllocationBase=0xa70000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 0x0, ) == 0x0
 03850   436   NtEnumerateValueKey  (416, 1, Full, 220, ... TitleIdx=0, Type=1, Name= (416, 1, Full, 220, ... TitleIdx=0, Type=1, Name="HOMEDRIVE", Data="C\0:\0\0\0"}, 46, ) , Data= (416, 1, Full, 220, ... TitleIdx=0, Type=1, Name="HOMEDRIVE", Data="C\0:\0\0\0"}, 46, ) }, 46, ) == 0x0
 03851   436   NtQueryVirtualMemory  (-1, 0xa70000, Basic, 28, ... {BaseAddress=0xa70000,AllocationBase=0xa70000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 0x0, ) == 0x0
 03852   436   NtEnumerateValueKey  (416, 2, Full, 220, ... TitleIdx=0, Type=1, Name= (416, 2, Full, 220, ... TitleIdx=0, Type=1, Name="HOMEPATH", Data="\\0D\0o\0c\0u\0m\0e\0n\0t\0s\0 \0a\0n\0d\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0S\0R\0I\0-\0u\0s\0e\0r\0\0\0"}, 102, ) , Data= (416, 2, Full, 220, ... TitleIdx=0, Type=1, Name="HOMEPATH", Data="\\0D\0o\0c\0u\0m\0e\0n\0t\0s\0 \0a\0n\0d\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0S\0R\0I\0-\0u\0s\0e\0r\0\0\0"}, 102, ) }, 102, ) == 0x0
 03853   436   NtQueryVirtualMemory  (-1, 0xa70000, Basic, 28, ... {BaseAddress=0xa70000,AllocationBase=0xa70000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 0x0, ) == 0x0
 03854   436   NtEnumerateValueKey  (416, 3, Full, 220, ... TitleIdx=0, Type=1, Name= (416, 3, Full, 220, ... TitleIdx=0, Type=1, Name="CLIENTNAME", Data="C\0o\0n\0s\0o\0l\0e\0\0\0"}, 56, ) , Data= (416, 3, Full, 220, ... TitleIdx=0, Type=1, Name="CLIENTNAME", Data="C\0o\0n\0s\0o\0l\0e\0\0\0"}, 56, ) }, 56, ) == 0x0
 03855   436   NtQueryVirtualMemory  (-1, 0xa70000, Basic, 28, ... {BaseAddress=0xa70000,AllocationBase=0xa70000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 0x0, ) == 0x0
 03856   436   NtEnumerateValueKey  (416, 4, Full, 220, ... TitleIdx=0, Type=1, Name= (416, 4, Full, 220, ... TitleIdx=0, Type=1, Name="SESSIONNAME", Data="C\0o\0n\0s\0o\0l\0e\0\0\0"}, 60, ) , Data= (416, 4, Full, 220, ... TitleIdx=0, Type=1, Name="SESSIONNAME", Data="C\0o\0n\0s\0o\0l\0e\0\0\0"}, 60, ) }, 60, ) == 0x0
 03857   436   NtQueryVirtualMemory  (-1, 0xa70000, Basic, 28, ... {BaseAddress=0xa70000,AllocationBase=0xa70000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 0x0, ) == 0x0
 03858   436   NtEnumerateValueKey  (416, 5, Full, 220, ... TitleIdx=0, Type=1, Name= (416, 5, Full, 220, ... TitleIdx=0, Type=1, Name="APPDATA", Data="C\0:\0\\0D\0o\0c\0u\0m\0e\0n\0t\0s\0 \0a\0n\0d\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0S\0R\0I\0-\0u\0s\0e\0r\0\\0A\0p\0p\0l\0i\0c\0a\0t\0i\0o\0n\0 \0D\0a\0t\0a\0\0\0"}, 140, ) , Data= (416, 5, Full, 220, ... TitleIdx=0, Type=1, Name="APPDATA", Data="C\0:\0\\0D\0o\0c\0u\0m\0e\0n\0t\0s\0 \0a\0n\0d\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0S\0R\0I\0-\0u\0s\0e\0r\0\\0A\0p\0p\0l\0i\0c\0a\0t\0i\0o\0n\0 \0D\0a\0t\0a\0\0\0"}, 140, ) }, 140, ) == 0x0
 03859   436   NtQueryVirtualMemory  (-1, 0xa70000, Basic, 28, ... {BaseAddress=0xa70000,AllocationBase=0xa70000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 0x0, ) == 0x0
 03860   436   NtEnumerateValueKey  (416, 6, Full, 220, ... TitleIdx=0, Type=1, Name= (416, 6, Full, 220, ... TitleIdx=0, Type=1, Name="HOMESHARE", Data="\0\0"}, 42, ) , Data= (416, 6, Full, 220, ... TitleIdx=0, Type=1, Name="HOMESHARE", Data="\0\0"}, 42, ) }, 42, ) == 0x0
 03861   436   NtEnumerateValueKey  (416, 7, Full, 220, ... ) == STATUS_NO_MORE_ENTRIES
 03862   436   NtEnumerateValueKey  (416, 0, Full, 220, ... TitleIdx=0, Type=1, Name= (416, 0, Full, 220, ... TitleIdx=0, Type=1, Name="LOGONSERVER", Data="\\0\\0M\0Y\0W\0O\0R\0L\0D\0\0\0"}, 64, ) , Data= (416, 0, Full, 220, ... TitleIdx=0, Type=1, Name="LOGONSERVER", Data="\\0\\0M\0Y\0W\0O\0R\0L\0D\0\0\0"}, 64, ) }, 64, ) == 0x0
 03863   436   NtEnumerateValueKey  (416, 1, Full, 220, ... TitleIdx=0, Type=1, Name= (416, 1, Full, 220, ... TitleIdx=0, Type=1, Name="HOMEDRIVE", Data="C\0:\0\0\0"}, 46, ) , Data= (416, 1, Full, 220, ... TitleIdx=0, Type=1, Name="HOMEDRIVE", Data="C\0:\0\0\0"}, 46, ) }, 46, ) == 0x0
 03864   436   NtEnumerateValueKey  (416, 2, Full, 220, ... TitleIdx=0, Type=1, Name= (416, 2, Full, 220, ... TitleIdx=0, Type=1, Name="HOMEPATH", Data="\\0D\0o\0c\0u\0m\0e\0n\0t\0s\0 \0a\0n\0d\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0S\0R\0I\0-\0u\0s\0e\0r\0\0\0"}, 102, ) , Data= (416, 2, Full, 220, ... TitleIdx=0, Type=1, Name="HOMEPATH", Data="\\0D\0o\0c\0u\0m\0e\0n\0t\0s\0 \0a\0n\0d\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0S\0R\0I\0-\0u\0s\0e\0r\0\0\0"}, 102, ) }, 102, ) == 0x0
 03865   436   NtEnumerateValueKey  (416, 3, Full, 220, ... TitleIdx=0, Type=1, Name= (416, 3, Full, 220, ... TitleIdx=0, Type=1, Name="CLIENTNAME", Data="C\0o\0n\0s\0o\0l\0e\0\0\0"}, 56, ) , Data= (416, 3, Full, 220, ... TitleIdx=0, Type=1, Name="CLIENTNAME", Data="C\0o\0n\0s\0o\0l\0e\0\0\0"}, 56, ) }, 56, ) == 0x0
 03866   436   NtEnumerateValueKey  (416, 4, Full, 220, ... TitleIdx=0, Type=1, Name= (416, 4, Full, 220, ... TitleIdx=0, Type=1, Name="SESSIONNAME", Data="C\0o\0n\0s\0o\0l\0e\0\0\0"}, 60, ) , Data= (416, 4, Full, 220, ... TitleIdx=0, Type=1, Name="SESSIONNAME", Data="C\0o\0n\0s\0o\0l\0e\0\0\0"}, 60, ) }, 60, ) == 0x0
 03867   436   NtEnumerateValueKey  (416, 5, Full, 220, ... TitleIdx=0, Type=1, Name= (416, 5, Full, 220, ... TitleIdx=0, Type=1, Name="APPDATA", Data="C\0:\0\\0D\0o\0c\0u\0m\0e\0n\0t\0s\0 \0a\0n\0d\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0S\0R\0I\0-\0u\0s\0e\0r\0\\0A\0p\0p\0l\0i\0c\0a\0t\0i\0o\0n\0 \0D\0a\0t\0a\0\0\0"}, 140, ) , Data= (416, 5, Full, 220, ... TitleIdx=0, Type=1, Name="APPDATA", Data="C\0:\0\\0D\0o\0c\0u\0m\0e\0n\0t\0s\0 \0a\0n\0d\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0S\0R\0I\0-\0u\0s\0e\0r\0\\0A\0p\0p\0l\0i\0c\0a\0t\0i\0o\0n\0 \0D\0a\0t\0a\0\0\0"}, 140, ) }, 140, ) == 0x0
 03868   436   NtEnumerateValueKey  (416, 6, Full, 220, ... TitleIdx=0, Type=1, Name= (416, 6, Full, 220, ... TitleIdx=0, Type=1, Name="HOMESHARE", Data="\0\0"}, 42, ) , Data= (416, 6, Full, 220, ... TitleIdx=0, Type=1, Name="HOMESHARE", Data="\0\0"}, 42, ) }, 42, ) == 0x0
 03869   436   NtEnumerateValueKey  (416, 7, Full, 220, ... ) == STATUS_NO_MORE_ENTRIES
 03870   436   NtClose  (416, ... ) == 0x0
 03871   436   NtClose  (404, ... ) == 0x0
 03872   436   NtFreeVirtualMemory  (-1, (0xa70000), 0, 32768, ... (0xa70000), 4096, ) == 0x0
 03873   436   NtClose  (412, ... ) == 0x0
 03874   436   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\Documents and Settings\SRI-user\Application Data"}, 1238500, ... ) }, 1238500, ... ) == 0x0
 03875   436   NtQueryInformationToken  (408, User, 64, ... {token info, class 1, size 36}, 36, ) == 0x0
 03876   436   NtOpenKey  (0x2001f, {24, 356, 0x40, 0, 0,  (0x2001f, {24, 356, 0x40, 0, 0, "S-1-5-21-1078081533-484763869-839522115-1003"}, ... 412, ) }, ... 412, ) == 0x0
 03877   436   NtCreateKey  (0x2000000, {24, 412, 0x40, 0, 0,  (0x2000000, {24, 412, 0x40, 0, 0, "Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders"}, 0, 0x0, 0, ... 404, 2, ) }, 0, 0x0, 0, ... 404, 2, ) == 0x0
 03878   436   NtClose  (412, ... ) == 0x0
 03879   436   NtSetValueKey  (404,  (404, "AppData", 0, 1, "C\0:\0\\0D\0o\0c\0u\0m\0e\0n\0t\0s\0 \0a\0n\0d\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0S\0R\0I\0-\0u\0s\0e\0r\0\\0A\0p\0p\0l\0i\0c\0a\0t\0i\0o\0n\0 \0D\0a\0t\0a\0\0\0", 104, ... ) , 0, 1,  (404, "AppData", 0, 1, "C\0:\0\\0D\0o\0c\0u\0m\0e\0n\0t\0s\0 \0a\0n\0d\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0S\0R\0I\0-\0u\0s\0e\0r\0\\0A\0p\0p\0l\0i\0c\0a\0t\0i\0o\0n\0 \0D\0a\0t\0a\0\0\0", 104, ... ) , 104, ... ) == 0x0
 03880   436   NtClose  (404, ... ) == 0x0
 03881   436   NtClose  (408, ... ) == 0x0
 03882   436   NtOpenFile  (0x100001, {24, 0, 0x40, 0, 0,  (0x100001, {24, 0, 0x40, 0, 0, "\??\C:\Documents and Settings\SRI-user\Application Data\Microsoft\Network\Connections\Pbk\"}, 3, 16417, ... ) }, 3, 16417, ... ) == STATUS_OBJECT_PATH_NOT_FOUND
 03883   436   NtWaitForSingleObject  (196, 0, 0x0, ... ) == 0x0
 03884   436   NtQueryInformationFile  (192, 1239548, 24, Standard, ... {status=0x0, info=24}, ) == 0x0
 03885   436   NtReleaseMutant  (196, ... 0x0, ) == 0x0
 03886   436   NtReleaseMutant  (240, ... 0x0, ) == 0x0
 03887   436   NtWaitForSingleObject  (104, 0, {0, 0}, ... ) == 0x102
 03888   436   NtWaitForSingleObject  (104, 0, {0, 0}, ... ) == 0x102
 03889   436   NtWaitForSingleObject  (104, 0, {0, 0}, ... ) == 0x102
 03890   436   NtWaitForSingleObject  (112, 0, {0, 0}, ... ) == 0x102
 03891   436   NtCreateEvent  (0x1f0003, 0x0, 1, 0, ... 408, ) == 0x0
 03892   436   NtConnectPort  ( ("\RPC Control\DNSResolver", {12, 2, 1, 1}, 0x0, 0x0, 1237688, 112, ... 404, 0x0, 0x0, 0x0, 112, ) , {12, 2, 1, 1}, 0x0, 0x0, 1237688, 112, ... 404, 0x0, 0x0, 0x0, 112, ) == 0x0
 03893   436   NtRequestWaitReplyPort  (404, {128, 152, new_msg, 0, 123020, 1310720, 1237452, 2012750850}  (404, {128, 152, new_msg, 0, 123020, 1310720, 1237452, 2012750850} "\0\350\22\0\2$\370w\370T\367w\1kwEVY\205D\237\200\364(\367\326\1)\2\0\0\0\1\0\0\0k\23\314w\4\0\0\0\20\344\314w\0\355\25\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\1\0\14\0x\352\25\0\20\335\25\0\0\0\0\0f\0\0\03\0\0\0l\351\22\0\0\0\0\0\0\0\22\0h\342\22\0\240P\25\0\224\345\22\0\0\0\0\0\5\0\0\0\5\0\0\0" ... {128, 152, reply, 0, 424, 436, 1551, 0} "\7\350\22\0\2$\370w\370T\367w\1kwEVY\205D\237\200\364(\367\326\1)\2\0\0\0\1\0\0\0\0\0\0\0\4\0\0\0\20\344\314w\377\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\1\0\14\0x\352\25\0\20\335\25\0\0\0\0\0f\0\0\03\0\0\0l\351\22\0\0\0\0\0\0\0\22\0h\342\22\0\240P\25\0\224\345\22\0\0\0\0\0\5\0\0\0\5\0\0\0" )  ... {128, 152, reply, 0, 424, 436, 1551, 0}  (404, {128, 152, new_msg, 0, 123020, 1310720, 1237452, 2012750850} "\0\350\22\0\2$\370w\370T\367w\1kwEVY\205D\237\200\364(\367\326\1)\2\0\0\0\1\0\0\0k\23\314w\4\0\0\0\20\344\314w\0\355\25\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\1\0\14\0x\352\25\0\20\335\25\0\0\0\0\0f\0\0\03\0\0\0l\351\22\0\0\0\0\0\0\0\22\0h\342\22\0\240P\25\0\224\345\22\0\0\0\0\0\5\0\0\0\5\0\0\0" ... {128, 152, reply, 0, 424, 436, 1551, 0} "\7\350\22\0\2$\370w\370T\367w\1kwEVY\205D\237\200\364(\367\326\1)\2\0\0\0\1\0\0\0\0\0\0\0\4\0\0\0\20\344\314w\377\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\1\0\14\0x\352\25\0\20\335\25\0\0\0\0\0f\0\0\03\0\0\0l\351\22\0\0\0\0\0\0\0\22\0h\342\22\0\240P\25\0\224\345\22\0\0\0\0\0\5\0\0\0\5\0\0\0" )  ) == 0x0
 03894   436   NtRequestWaitReplyPort  (404, {112, 136, new_msg, 0, 44, 3, 20, 0}  (404, {112, 136, new_msg, 0, 44, 3, 20, 0} "\1\0\0\0A\2\11\0*,\334\21\261\306\0\14)\371\246\305\1\0\0\0\377\377\377\377\1\0\0\0\0\0\0\0\254\263\25\0\25\0\0\0\0\0\0\0\25\0\0\0s\0r\0v\00\02\0.\0b\0a\0s\0h\0c\0h\0e\0l\0i\0k\0.\0c\0o\0m\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0" ...  ...
 03646   568   NtWaitForSingleObject  ... ) == 0x0
 03895   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=94}, 0x0, ) , 16, 0, ... {status=0x103, info=94}, 0x0, ) == 0x103
 03896   568   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ...
 03894   436   NtRequestWaitReplyPort  ... {44, 68, reply, 0, 424, 436, 1552, 0}  ... {44, 68, reply, 0, 424, 436, 1552, 0} "\2\213+\370\1\0+\370B\271\325\371(\273\325\371\377\377\377\377\325\316\325\371\13\353\325\371\0\0\0\0\0\0\0\0\264\5\0\0\1\0\0\0" )  ) == 0x0
 03897   436   NtClose  (408, ... ) == 0x0
 03898   436   NtClose  (404, ... ) == 0x0
 03899   436   NtCreateFile  (0x3, {24, 0, 0x40, 0, 0,  (0x3, {24, 0, 0x40, 0, 0, "\Device\RasAcd"}, 0x0, 128, 3, 3, 0, 0, 0, ... 404, {status=0x0, info=0}, ) }, 0x0, 128, 3, 3, 0, 0, 0, ... 404, {status=0x0, info=0}, ) == 0x0
 03900   436   NtCreateEvent  (0x1f0003, 0x0, 1, 0, ... 408, ) == 0x0
 03901   436   NtDeviceIoControlFile  (404, 408, 0x0, 0x0, 0xf14014,  (404, 408, 0x0, 0x0, 0xf14014, "\3\0\0\0srv02.bashchelik.com\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0", 1552, 0, ... ) , 1552, 0, ... ) == STATUS_UNSUCCESSFUL
 03902   436   NtClose  (408, ... ) == 0x0
 03903   436   NtClose  (404, ... ) == 0x0
 03904   436   NtClearEvent  (376, ... ) == 0x0
 03905   436   NtSetEvent  (376, ... 0x0, ) == 0x0
 03906   436   NtClose  (376, ... ) == 0x0
 03907   436   NtCreateEvent  (0x1f0003, 0x0, 1, 1, ... 376, ) == 0x0
 03908   436   NtWaitForSingleObject  (376, 0, 0x0, ... ) == 0x0
 03909   436   NtClearEvent  (376, ... ) == 0x0
 03910   436   NtSetEvent  (376, ... 0x0, ) == 0x0
 03911   436   NtWaitForSingleObject  (196, 0, 0x0, ... ) == 0x0
 03912   436   NtQueryInformationFile  (192, 1241452, 24, Standard, ... {status=0x0, info=24}, ) == 0x0
 03913   436   NtReleaseMutant  (196, ... 0x0, ) == 0x0
 03914   436   NtOpenKey  (0x20019, {24, 60, 0x40, 0, 0,  (0x20019, {24, 60, 0x40, 0, 0, "SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Http Filters\RPA"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 03915   436   NtOpenKey  (0x20019, {24, 48, 0x40, 0, 0,  (0x20019, {24, 48, 0x40, 0, 0, "SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Http Filters\RPA"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 03916   436   NtWaitForSingleObject  (240, 0, 0x0, ... ) == 0x0
 03917   436   NtWaitForSingleObject  (244, 0, 0x0, ... ) == 0x0
 03918   436   NtReleaseMutant  (244, ... 0x0, ) == 0x0
 03919   436   NtQueryValueKey  (76,  (76, "EnableAutodial", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (76, "EnableAutodial", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) }, 16, ) == 0x0
 03920   436   NtQueryValueKey  (76,  (76, "NoNetAutodial", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (76, "NoNetAutodial", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) }, 16, ) == 0x0
 03921   436   NtWaitForSingleObject  (196, 0, 0x0, ... ) == 0x0
 03922   436   NtQueryInformationFile  (192, 1241648, 24, Standard, ... {status=0x0, info=24}, ) == 0x0
 03923   436   NtReleaseMutant  (196, ... 0x0, ) == 0x0
 03924   436   NtReleaseMutant  (240, ... 0x0, ) == 0x0
 03925   436   NtWaitForSingleObject  (384, 0, 0x0, ... ) == 0x0
 03926   436   NtReleaseMutant  (384, ... 0x0, ) == 0x0
 03927   436   NtOpenKey  (0x20019, {24, 392, 0x40, 0, 0,  (0x20019, {24, 392, 0x40, 0, 0, "Domains\debelizombi.com"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 03928   436   NtOpenKey  (0x20019, {24, 48, 0x40, 0, 0,  (0x20019, {24, 48, 0x40, 0, 0, "Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\debelizombi.com"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 03929   436   NtQueryValueKey  (392,  (392, "IntranetName", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (392, "IntranetName", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) }, 16, ) == 0x0
 03930   436   NtQueryValueKey  (392,  (392, "ProxyBypass", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (392, "ProxyBypass", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) }, 16, ) == 0x0
 03931   436   NtClearEvent  (228, ... ) == 0x0
 03932   436   NtSetEvent  (228, ... 0x0, ) == 0x0
 03933   436   NtOpenKey  (0x20019, {24, 392, 0x40, 0, 0,  (0x20019, {24, 392, 0x40, 0, 0, "ProtocolDefaults\"}, ... 404, ) }, ... 404, ) == 0x0
 03934   436   NtQueryValueKey  (404,  (404, "http", Partial, 144, ... TitleIdx=0, Type=4, Data="\3\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (404, "http", Partial, 144, ... TitleIdx=0, Type=4, Data="\3\0\0\0"}, 16, ) }, 16, ) == 0x0
 03935   436   NtClose  (404, ... ) == 0x0
 03936   436   NtWaitForSingleObject  (384, 0, 0x0, ... ) == 0x0
 03937   436   NtReleaseMutant  (384, ... 0x0, ) == 0x0
 03938   436   NtWaitForSingleObject  (384, 0, 0x0, ... ) == 0x0
 03939   436   NtReleaseMutant  (384, ... 0x0, ) == 0x0
 03940   436   NtWaitForSingleObject  (368, 0, 0x0, ... ) == 0x0
 03941   436   NtReleaseMutant  (368, ... 0x0, ) == 0x0
 03942   436   NtWaitForSingleObject  (196, 0, 0x0, ... ) == 0x0
 03943   436   NtQueryInformationFile  (192, 1241896, 24, Standard, ... {status=0x0, info=24}, ) == 0x0
 03944   436   NtReleaseMutant  (196, ... 0x0, ) == 0x0
 03945   436   NtWaitForSingleObject  (112, 0, {0, 0}, ... ) == 0x102
 03946   436   NtCreateEvent  (0x1f0003, 0x0, 1, 0, ... 404, ) == 0x0
 03947   436   NtConnectPort  ( ("\RPC Control\DNSResolver", {12, 2, 1, 1}, 0x0, 0x0, 1238356, 112, ... 408, 0x0, 0x0, 0x0, 112, ) , {12, 2, 1, 1}, 0x0, 0x0, 1238356, 112, ... 408, 0x0, 0x0, 0x0, 112, ) == 0x0
 03948   436   NtRequestWaitReplyPort  (408, {128, 152, new_msg, 0, 1310720, 123688, 1310720, 1238120}  (408, {128, 152, new_msg, 0, 1310720, 123688, 1310720, 1238120} "\0$\370w\30\353\22\0\2$\370w\1kwEVY\205D\237\200\364(\367\326\1)\2\0\0\0\1\0\0\0\0\355\25\0\4\0\0\0\0\355\25\0\20\344\314w\0\355\25\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\1\0\15\0x\352\25\00\324\25\0\0\0\0\0\0\0\0\0\0\0\0\0\244\363\22\0\0\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\0\0\0\0\0\0\0\0\5\0\0\0" ... {128, 152, reply, 0, 424, 436, 1555, 0} "\7$\370w\30\353\22\0\2$\370w\1kwEVY\205D\237\200\364(\367\326\1)\2\0\0\0\1\0\0\0\0\0\0\0\4\0\0\0\0\355\25\0\377\377\377\377\0\355\25\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\1\0\15\0x\352\25\00\324\25\0\0\0\0\0\0\0\0\0\0\0\0\0\244\363\22\0\0\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\0\0\0\0\0\0\0\0\5\0\0\0" )  ... {128, 152, reply, 0, 424, 436, 1555, 0}  (408, {128, 152, new_msg, 0, 1310720, 123688, 1310720, 1238120} "\0$\370w\30\353\22\0\2$\370w\1kwEVY\205D\237\200\364(\367\326\1)\2\0\0\0\1\0\0\0\0\355\25\0\4\0\0\0\0\355\25\0\20\344\314w\0\355\25\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\1\0\15\0x\352\25\00\324\25\0\0\0\0\0\0\0\0\0\0\0\0\0\244\363\22\0\0\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\0\0\0\0\0\0\0\0\5\0\0\0" ... {128, 152, reply, 0, 424, 436, 1555, 0} "\7$\370w\30\353\22\0\2$\370w\1kwEVY\205D\237\200\364(\367\326\1)\2\0\0\0\1\0\0\0\0\0\0\0\4\0\0\0\0\355\25\0\377\377\377\377\0\355\25\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\1\0\15\0x\352\25\00\324\25\0\0\0\0\0\0\0\0\0\0\0\0\0\244\363\22\0\0\0\0\0\0\0\0\0\4\0\0\0\4\0\0\0\0\0\0\0\0\0\0\0\5\0\0\0" )  ) == 0x0
 03949   436   NtRequestWaitReplyPort  (408, {64, 88, new_msg, 0, 424, 436, 1552, 0}  (408, {64, 88, new_msg, 0, 424, 436, 1552, 0} "\1\213\0\0A\2\10\0B\271\325\371(\273\325\371\377\377\377\377\325\316\325\371\377\377\377\377\0\0\0\0\0\0\0\0\21\0\0\0\0\0\0\0\0\0\0\0\25\0\0\0s\0r\0v\00\02\0.\0" ... {52, 76, reply, 0, 424, 436, 1556, 0} "\2\213+\370\1\0+\370B\271\325\371(\273\325\371\377\377\377\377\325\316\325\371\13\353\325\371\0\0\0\0\200]\12\0\1\0\0\0\1\0\0\0\300\250|\201\377\377\377\0" )  ... {52, 76, reply, 0, 424, 436, 1556, 0}  (408, {64, 88, new_msg, 0, 424, 436, 1552, 0} "\1\213\0\0A\2\10\0B\271\325\371(\273\325\371\377\377\377\377\325\316\325\371\377\377\377\377\0\0\0\0\0\0\0\0\21\0\0\0\0\0\0\0\0\0\0\0\25\0\0\0s\0r\0v\00\02\0.\0" ... {52, 76, reply, 0, 424, 436, 1556, 0} "\2\213+\370\1\0+\370B\271\325\371(\273\325\371\377\377\377\377\325\316\325\371\13\353\325\371\0\0\0\0\200]\12\0\1\0\0\0\1\0\0\0\300\250|\201\377\377\377\0" )  ) == 0x0
 03950   436   NtClose  (404, ... ) == 0x0
 03951   436   NtClose  (408, ... ) == 0x0
 03952   436   NtCreateKey  (0x20019, {24, 48, 0x40, 0, 0,  (0x20019, {24, 48, 0x40, 0, 0, "System\CurrentControlSet\Services\Tcpip\Parameters"}, 0, "Class", 0, ... 408, 2, ) }, 0,  (0x20019, {24, 48, 0x40, 0, 0, "System\CurrentControlSet\Services\Tcpip\Parameters"}, 0, "Class", 0, ... 408, 2, ) , 0, ... 408, 2, ) == 0x0
 03953   436   NtOpenKey  (0x20019, {24, 48, 0x40, 0, 0,  (0x20019, {24, 48, 0x40, 0, 0, "System\CurrentControlSet\Services\DnsCache\Parameters"}, ... 404, ) }, ... 404, ) == 0x0
 03954   436   NtOpenKey  (0x20019, {24, 48, 0x40, 0, 0,  (0x20019, {24, 48, 0x40, 0, 0, "Software\Policies\Microsoft\Windows NT\DnsClient"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 03955   436   NtQueryValueKey  (408,  (408, "Hostname", Partial, 144, ... TitleIdx=0, Type=1, Data="M\0Y\0W\0O\0R\0L\0D\0\0\0"}, 28, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (408, "Hostname", Partial, 144, ... TitleIdx=0, Type=1, Data="M\0Y\0W\0O\0R\0L\0D\0\0\0"}, 28, ) }, 28, ) == 0x0
 03956   436   NtQueryValueKey  (408,  (408, "Hostname", Partial, 144, ... TitleIdx=0, Type=1, Data="M\0Y\0W\0O\0R\0L\0D\0\0\0"}, 28, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (408, "Hostname", Partial, 144, ... TitleIdx=0, Type=1, Data="M\0Y\0W\0O\0R\0L\0D\0\0\0"}, 28, ) }, 28, ) == 0x0
 03957   436   NtClose  (408, ... ) == 0x0
 03958   436   NtClose  (404, ... ) == 0x0
 03959   436   NtCreateKey  (0x20019, {24, 48, 0x40, 0, 0,  (0x20019, {24, 48, 0x40, 0, 0, "System\CurrentControlSet\Services\Tcpip\Parameters"}, 0, "Class", 0, ... 404, 2, ) }, 0,  (0x20019, {24, 48, 0x40, 0, 0, "System\CurrentControlSet\Services\Tcpip\Parameters"}, 0, "Class", 0, ... 404, 2, ) , 0, ... 404, 2, ) == 0x0
 03960   436   NtOpenKey  (0x20019, {24, 48, 0x40, 0, 0,  (0x20019, {24, 48, 0x40, 0, 0, "System\CurrentControlSet\Services\DnsCache\Parameters"}, ... 408, ) }, ... 408, ) == 0x0
 03961   436   NtOpenKey  (0x20019, {24, 48, 0x40, 0, 0,  (0x20019, {24, 48, 0x40, 0, 0, "Software\Policies\Microsoft\Windows NT\DnsClient"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 03962   436   NtQueryValueKey  (404,  (404, "Domain", Partial, 144, ... TitleIdx=0, Type=1, Data="\0\0"}, 14, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (404, "Domain", Partial, 144, ... TitleIdx=0, Type=1, Data="\0\0"}, 14, ) }, 14, ) == 0x0
 03963   436   NtQueryValueKey  (404,  (404, "Domain", Partial, 144, ... TitleIdx=0, Type=1, Data="\0\0"}, 14, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (404, "Domain", Partial, 144, ... TitleIdx=0, Type=1, Data="\0\0"}, 14, ) }, 14, ) == 0x0
 03964   436   NtClose  (404, ... ) == 0x0
 03965   436   NtClose  (408, ... ) == 0x0
 03966   436   NtOpenKey  (0x1, {24, 48, 0x40, 0, 0,  (0x1, {24, 48, 0x40, 0, 0, "System\CurrentControlSet\Services\VxD\MSTCP"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 03967   436   NtOpenKey  (0x1, {24, 48, 0x40, 0, 0,  (0x1, {24, 48, 0x40, 0, 0, "System\CurrentControlSet\Control\ComputerName\ComputerName"}, ... 408, ) }, ... 408, ) == 0x0
 03968   436   NtQueryValueKey  (408,  (408, "ComputerName", Partial, 144, ... TitleIdx=0, Type=1, Data="M\0Y\0W\0O\0R\0L\0D\0\0\0"}, 28, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (408, "ComputerName", Partial, 144, ... TitleIdx=0, Type=1, Data="M\0Y\0W\0O\0R\0L\0D\0\0\0"}, 28, ) }, 28, ) == 0x0
 03969   436   NtQueryValueKey  (408,  (408, "ComputerName", Partial, 144, ... TitleIdx=0, Type=1, Data="M\0Y\0W\0O\0R\0L\0D\0\0\0"}, 28, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (408, "ComputerName", Partial, 144, ... TitleIdx=0, Type=1, Data="M\0Y\0W\0O\0R\0L\0D\0\0\0"}, 28, ) }, 28, ) == 0x0
 03970   436   NtClose  (408, ... ) == 0x0
 03971   436   NtWaitForSingleObject  (104, 0, {0, 0}, ... ) == 0x102
 03972   436   NtWaitForSingleObject  (104, 0, {0, 0}, ... ) == 0x102
 03973   436   NtWaitForSingleObject  (104, 0, {0, 0}, ... ) == 0x102
 03974   436   NtWaitForSingleObject  (112, 0, {0, 0}, ... ) == 0x102
 03975   436   NtCreateEvent  (0x1f0003, 0x0, 1, 0, ... 408, ) == 0x0
 03976   436   NtConnectPort  ( ("\RPC Control\DNSResolver", {12, 2, 1, 1}, 0x0, 0x0, 1237692, 112, ... 404, 0x0, 0x0, 0x0, 112, ) , {12, 2, 1, 1}, 0x0, 0x0, 1237692, 112, ... 404, 0x0, 0x0, 0x0, 112, ) == 0x0
 03977   436   NtRequestWaitReplyPort  (404, {128, 152, new_msg, 0, 1310720, 123024, 1310720, 1237456}  (404, {128, 152, new_msg, 0, 1310720, 123024, 1310720, 1237456} "\0$\370w\200\350\22\0\2$\370w\1kwEVY\205D\237\200\364(\367\326\1)\2\0\0\0\1\0\0\0\0\355\25\0\4\0\0\0\0\355\25\0\20\344\314w\0\355\25\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\1\0\16\0x\352\25\00\324\25\0\0\0\0\0\0\0\0\0$1\347w\0\0\0\0\0\0\0\0\0\0\0\0\340\333\25\0\34\343\22\0\0\0\0\0\365\26\365w\5\0\0\0" ... {128, 152, reply, 0, 424, 436, 1559, 0} "\7$\370w\200\350\22\0\2$\370w\1kwEVY\205D\237\200\364(\367\326\1)\2\0\0\0\1\0\0\0\0\0\0\0\4\0\0\0\0\355\25\0\377\377\377\377\0\355\25\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\1\0\16\0x\352\25\00\324\25\0\0\0\0\0\0\0\0\0$1\347w\0\0\0\0\0\0\0\0\0\0\0\0\340\333\25\0\34\343\22\0\0\0\0\0\365\26\365w\5\0\0\0" )  ... {128, 152, reply, 0, 424, 436, 1559, 0}  (404, {128, 152, new_msg, 0, 1310720, 123024, 1310720, 1237456} "\0$\370w\200\350\22\0\2$\370w\1kwEVY\205D\237\200\364(\367\326\1)\2\0\0\0\1\0\0\0\0\355\25\0\4\0\0\0\0\355\25\0\20\344\314w\0\355\25\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\1\0\16\0x\352\25\00\324\25\0\0\0\0\0\0\0\0\0$1\347w\0\0\0\0\0\0\0\0\0\0\0\0\340\333\25\0\34\343\22\0\0\0\0\0\365\26\365w\5\0\0\0" ... {128, 152, reply, 0, 424, 436, 1559, 0} "\7$\370w\200\350\22\0\2$\370w\1kwEVY\205D\237\200\364(\367\326\1)\2\0\0\0\1\0\0\0\0\0\0\0\4\0\0\0\0\355\25\0\377\377\377\377\0\355\25\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\1\0\16\0x\352\25\00\324\25\0\0\0\0\0\0\0\0\0$1\347w\0\0\0\0\0\0\0\0\0\0\0\0\340\333\25\0\34\343\22\0\0\0\0\0\365\26\365w\5\0\0\0" )  ) == 0x0
 03978   436   NtRequestWaitReplyPort  (404, {112, 136, new_msg, 0, 424, 436, 1556, 0}  (404, {112, 136, new_msg, 0, 424, 436, 1556, 0} "\1\213\0\0A\2\11\0B\271\325\371(\273\325\371\377\377\377\377\325\316\325\371\377\377\377\377\0\0\0\0\0\0\0\0\254\263\25\0\26\0\0\0\0\0\0\0\26\0\0\0s\0r\0v\00\01\0.\0d\0e\0b\0e\0l\0i\0z\0o\0m\0b\0i\0.\0c\0o\0m\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0" ...  ...
 03896   568   NtWaitForSingleObject  ... ) == 0x0
 03979   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=95}, 0x0, ) , 16, 0, ... {status=0x103, info=95}, 0x0, ) == 0x103
 03980   568   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ...
 03978   436   NtRequestWaitReplyPort  ... {44, 68, reply, 0, 424, 436, 1560, 0}  ... {44, 68, reply, 0, 424, 436, 1560, 0} "\2\213+\370\1\0+\370B\271\325\371(\273\325\371\377\377\377\377\325\316\325\371\13\353\325\371\0\0\0\0\0\0\0\0\264\5\0\0\1\0\0\0" )  ) == 0x0
 03981   436   NtClose  (408, ... ) == 0x0
 03982   436   NtClose  (404, ... ) == 0x0
 03983   436   NtCreateFile  (0x3, {24, 0, 0x40, 0, 0,  (0x3, {24, 0, 0x40, 0, 0, "\Device\RasAcd"}, 0x0, 128, 3, 3, 0, 0, 0, ... 404, {status=0x0, info=0}, ) }, 0x0, 128, 3, 3, 0, 0, 0, ... 404, {status=0x0, info=0}, ) == 0x0
 03984   436   NtCreateEvent  (0x1f0003, 0x0, 1, 0, ... 408, ) == 0x0
 03985   436   NtDeviceIoControlFile  (404, 408, 0x0, 0x0, 0xf14014,  (404, 408, 0x0, 0x0, 0xf14014, "\3\0\0\0srv01.debelizombi.com\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0", 1552, 0, ... ) , 1552, 0, ... ) == STATUS_UNSUCCESSFUL
 03986   436   NtClose  (408, ... ) == 0x0
 03987   436   NtClose  (404, ... ) == 0x0
 03988   436   NtWaitForSingleObject  (240, 0, 0x0, ... ) == 0x0
 03989   436   NtWaitForSingleObject  (244, 0, 0x0, ... ) == 0x0
 03990   436   NtReleaseMutant  (244, ... 0x0, ) == 0x0
 03991   436   NtQueryValueKey  (76,  (76, "EnableAutodial", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (76, "EnableAutodial", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) }, 16, ) == 0x0
 03992   436   NtQueryValueKey  (76,  (76, "NoNetAutodial", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (76, "NoNetAutodial", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) }, 16, ) == 0x0
 03993   436   NtCreateKey  (0x2001d, {24, 48, 0x40, 0, 0,  (0x2001d, {24, 48, 0x40, 0, 0, "Software\Microsoft\RAS AutoDial"}, 0, 0x0, 0, ... 404, 2, ) }, 0, 0x0, 0, ... 404, 2, ) == 0x0
 03994   436   NtCreateKey  (0x20019, {24, 404, 0x40, 0, 0,  (0x20019, {24, 404, 0x40, 0, 0, "Default"}, 0, 0x0, 0, ... 408, 2, ) }, 0, 0x0, 0, ... 408, 2, ) == 0x0
 03995   436   NtClose  (404, ... ) == 0x0
 03996   436   NtQueryValueKey  (408,  (408, "DefaultInternet", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 03997   436   NtClose  (408, ... ) == 0x0
 03998   436   NtOpenThreadToken  (-2, 0xc, 1, ... ) == STATUS_NO_TOKEN
 03999   436   NtOpenProcessToken  (-1, 0xc, ... 408, ) == 0x0
 04000   436   NtReleaseSemaphore  (208, 1, ... 0, ) == 0x0
 04001   436   NtWaitForSingleObject  (208, 0, {0, 0}, ... ) == 0x0
 04002   436   NtClose  (408, ... ) == 0x0
 04003   436   NtOpenFile  (0x100001, {24, 0, 0x40, 0, 0,  (0x100001, {24, 0, 0x40, 0, 0, "\??\C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Connections\Pbk\"}, 3, 16417, ... 408, {status=0x0, info=1}, ) }, 3, 16417, ... 408, {status=0x0, info=1}, ) == 0x0
 04004   436   NtQueryDirectoryFile  (408, 0, 0, 0, 1237476, 616, BothDirectory, 1,  (408, 0, 0, 0, 1237476, 616, BothDirectory, 1, "<.pbk", 0, ... ) , 0, ... ) == STATUS_NO_SUCH_FILE
 04005   436   NtClose  (408, ... ) == 0x0
 04006   436   NtOpenFile  (0x100001, {24, 0, 0x40, 0, 0,  (0x100001, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\System32\Ras\"}, 3, 16417, ... 408, {status=0x0, info=1}, ) }, 3, 16417, ... 408, {status=0x0, info=1}, ) == 0x0
 04007   436   NtQueryDirectoryFile  (408, 0, 0, 0, 1237476, 616, BothDirectory, 1,  (408, 0, 0, 0, 1237476, 616, BothDirectory, 1, "<.pbk", 0, ... ) , 0, ... ) == STATUS_NO_SUCH_FILE
 04008   436   NtClose  (408, ... ) == 0x0
 04009   436   NtOpenThreadToken  (-2, 0xc, 1, ... ) == STATUS_NO_TOKEN
 04010   436   NtOpenProcessToken  (-1, 0xc, ... 408, ) == 0x0
 04011   436   NtQueryInformationToken  (408, User, 64, ... {token info, class 1, size 36}, 36, ) == 0x0
 04012   436   NtOpenKey  (0x2001f, {24, 356, 0x40, 0, 0,  (0x2001f, {24, 356, 0x40, 0, 0, "S-1-5-21-1078081533-484763869-839522115-1003"}, ... 404, ) }, ... 404, ) == 0x0
 04013   436   NtCreateKey  (0x2000000, {24, 404, 0x40, 0, 0,  (0x2000000, {24, 404, 0x40, 0, 0, "Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders"}, 0, 0x0, 0, ... 412, 2, ) }, 0, 0x0, 0, ... 412, 2, ) == 0x0
 04014   436   NtClose  (404, ... ) == 0x0
 04015   436   NtQueryValueKey  (412,  (412, "AppData", Partial, 144, ... TitleIdx=0, Type=2, Data="%\0U\0S\0E\0R\0P\0R\0O\0F\0I\0L\0E\0%\0\\0A\0p\0p\0l\0i\0c\0a\0t\0i\0o\0n\0 \0D\0a\0t\0a\0\0\0"}, 74, ) , Partial, 144, ... TitleIdx=0, Type=2, Data= (412, "AppData", Partial, 144, ... TitleIdx=0, Type=2, Data="%\0U\0S\0E\0R\0P\0R\0O\0F\0I\0L\0E\0%\0\\0A\0p\0p\0l\0i\0c\0a\0t\0i\0o\0n\0 \0D\0a\0t\0a\0\0\0"}, 74, ) }, 74, ) == 0x0
 04016   436   NtAllocateVirtualMemory  (-1, 0, 0, 1, 4096, 4, ... 10944512, 4096, ) == 0x0
 04017   436   NtQueryVirtualMemory  (-1, 0xa70000, Basic, 28, ... {BaseAddress=0xa70000,AllocationBase=0xa70000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 0x0, ) == 0x0
 04018   436   NtQueryVirtualMemory  (-1, 0xa70000, Basic, 28, ... {BaseAddress=0xa70000,AllocationBase=0xa70000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 0x0, ) == 0x0
 04019   436   NtOpenKey  (0x20019, {24, 48, 0x40, 0, 0,  (0x20019, {24, 48, 0x40, 0, 0, "Software\Microsoft\Windows NT\CurrentVersion\ProfileList"}, ... 404, ) }, ... 404, ) == 0x0
 04020   436   NtQueryValueKey  (404,  (404, "ProfilesDirectory", Partial, 144, ... TitleIdx=0, Type=2, Data="%\0S\0y\0s\0t\0e\0m\0D\0r\0i\0v\0e\0%\0\\0D\0o\0c\0u\0m\0e\0n\0t\0s\0 \0a\0n\0d\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\0\0"}, 86, ) , Partial, 144, ... TitleIdx=0, Type=2, Data= (404, "ProfilesDirectory", Partial, 144, ... TitleIdx=0, Type=2, Data="%\0S\0y\0s\0t\0e\0m\0D\0r\0i\0v\0e\0%\0\\0D\0o\0c\0u\0m\0e\0n\0t\0s\0 \0a\0n\0d\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\0\0"}, 86, ) }, 86, ) == 0x0
 04021   436   NtClose  (404, ... ) == 0x0
 04022   436   NtOpenKey  (0x20019, {24, 48, 0x40, 0, 0,  (0x20019, {24, 48, 0x40, 0, 0, "Software\Microsoft\Windows NT\CurrentVersion\ProfileList"}, ... 404, ) }, ... 404, ) == 0x0
 04023   436   NtQueryValueKey  (404,  (404, "AllUsersProfile", Partial, 144, ... TitleIdx=0, Type=1, Data="A\0l\0l\0 \0U\0s\0e\0r\0s\0\0\0"}, 32, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (404, "AllUsersProfile", Partial, 144, ... TitleIdx=0, Type=1, Data="A\0l\0l\0 \0U\0s\0e\0r\0s\0\0\0"}, 32, ) }, 32, ) == 0x0
 04024   436   NtClose  (404, ... ) == 0x0
 04025   436   NtQueryVirtualMemory  (-1, 0xa70000, Basic, 28, ... {BaseAddress=0xa70000,AllocationBase=0xa70000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 0x0, ) == 0x0
 04026   436   NtOpenKey  (0x1, {24, 48, 0x40, 0, 0,  (0x1, {24, 48, 0x40, 0, 0, "System\CurrentControlSet\Control\Session Manager\Environment"}, ... 404, ) }, ... 404, ) == 0x0
 04027   436   NtQueryKey  (404, Full, 176, ... {LastWrite={0x7838d13c,0x1c73999}, TitleIdx=0, Subkeys=0, Values=12, Class=""}, 44, ) == 0x0
 04028   436   NtQuerySecurityObject  (404, 7, 0, ... ) == STATUS_ACCESS_DENIED
 04029   436   NtEnumerateValueKey  (404, 0, Full, 220, ... TitleIdx=0, Type=2, Name= (404, 0, Full, 220, ... TitleIdx=0, Type=2, Name="ComSpec", Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0s\0y\0s\0t\0e\0m\03\02\0\\0c\0m\0d\0.\0e\0x\0e\0\0\0"}, 96, ) , Data= (404, 0, Full, 220, ... TitleIdx=0, Type=2, Name="ComSpec", Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0s\0y\0s\0t\0e\0m\03\02\0\\0c\0m\0d\0.\0e\0x\0e\0\0\0"}, 96, ) }, 96, ) == 0x0
 04030   436   NtEnumerateValueKey  (404, 1, Full, 220, ... TitleIdx=0, Type=2, Name= (404, 1, Full, 220, ... TitleIdx=0, Type=2, Name="Path", Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0s\0y\0s\0t\0e\0m\03\02\0;\0%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0;\0%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0W\0b\0e\0m\0\0\0"}, 152, ) , Data= (404, 1, Full, 220, ... TitleIdx=0, Type=2, Name="Path", Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0s\0y\0s\0t\0e\0m\03\02\0;\0%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0;\0%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0W\0b\0e\0m\0\0\0"}, 152, ) }, 152, ) == 0x0
 04031   436   NtEnumerateValueKey  (404, 2, Full, 220, ... TitleIdx=0, Type=2, Name= (404, 2, Full, 220, ... TitleIdx=0, Type=2, Name="windir", Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\0\0"}, 58, ) , Data= (404, 2, Full, 220, ... TitleIdx=0, Type=2, Name="windir", Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\0\0"}, 58, ) }, 58, ) == 0x0
 04032   436   NtEnumerateValueKey  (404, 3, Full, 220, ... TitleIdx=0, Type=1, Name= (404, 3, Full, 220, ... TitleIdx=0, Type=1, Name="OS", Data="W\0i\0n\0d\0o\0w\0s\0_\0N\0T\0\0\0"}, 46, ) , Data= (404, 3, Full, 220, ... TitleIdx=0, Type=1, Name="OS", Data="W\0i\0n\0d\0o\0w\0s\0_\0N\0T\0\0\0"}, 46, ) }, 46, ) == 0x0
 04033   436   NtQueryVirtualMemory  (-1, 0xa70000, Basic, 28, ... {BaseAddress=0xa70000,AllocationBase=0xa70000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 0x0, ) == 0x0
 04034   436   NtEnumerateValueKey  (404, 4, Full, 220, ... TitleIdx=0, Type=1, Name= (404, 4, Full, 220, ... TitleIdx=0, Type=1, Name="PROCESSOR_ARCHITECTURE", Data="x\08\06\0\0\0"}, 72, ) , Data= (404, 4, Full, 220, ... TitleIdx=0, Type=1, Name="PROCESSOR_ARCHITECTURE", Data="x\08\06\0\0\0"}, 72, ) }, 72, ) == 0x0
 04035   436   NtQueryVirtualMemory  (-1, 0xa70000, Basic, 28, ... {BaseAddress=0xa70000,AllocationBase=0xa70000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 0x0, ) == 0x0
 04036   436   NtEnumerateValueKey  (404, 5, Full, 220, ... TitleIdx=0, Type=1, Name= (404, 5, Full, 220, ... TitleIdx=0, Type=1, Name="PROCESSOR_LEVEL", Data="1\05\0\0\0"}, 58, ) , Data= (404, 5, Full, 220, ... TitleIdx=0, Type=1, Name="PROCESSOR_LEVEL", Data="1\05\0\0\0"}, 58, ) }, 58, ) == 0x0
 04037   436   NtQueryVirtualMemory  (-1, 0xa70000, Basic, 28, ... {BaseAddress=0xa70000,AllocationBase=0xa70000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 0x0, ) == 0x0
 04038   436   NtEnumerateValueKey  (404, 6, Full, 220, ... TitleIdx=0, Type=1, Name= (404, 6, Full, 220, ... TitleIdx=0, Type=1, Name="PROCESSOR_IDENTIFIER", Data="x\08\06\0 \0F\0a\0m\0i\0l\0y\0 \01\05\0 \0M\0o\0d\0e\0l\0 \04\0 \0S\0t\0e\0p\0p\0i\0n\0g\0 \08\0,\0 \0G\0e\0n\0u\0i\0n\0e\0I\0n\0t\0e\0l\0\0\0"}, 154, ) , Data= (404, 6, Full, 220, ... TitleIdx=0, Type=1, Name="PROCESSOR_IDENTIFIER", Data="x\08\06\0 \0F\0a\0m\0i\0l\0y\0 \01\05\0 \0M\0o\0d\0e\0l\0 \04\0 \0S\0t\0e\0p\0p\0i\0n\0g\0 \08\0,\0 \0G\0e\0n\0u\0i\0n\0e\0I\0n\0t\0e\0l\0\0\0"}, 154, ) }, 154, ) == 0x0
 04039   436   NtQueryVirtualMemory  (-1, 0xa70000, Basic, 28, ... {BaseAddress=0xa70000,AllocationBase=0xa70000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 0x0, ) == 0x0
 04040   436   NtEnumerateValueKey  (404, 7, Full, 220, ... TitleIdx=0, Type=1, Name= (404, 7, Full, 220, ... TitleIdx=0, Type=1, Name="PROCESSOR_REVISION", Data="0\04\00\08\0\0\0"}, 66, ) , Data= (404, 7, Full, 220, ... TitleIdx=0, Type=1, Name="PROCESSOR_REVISION", Data="0\04\00\08\0\0\0"}, 66, ) }, 66, ) == 0x0
 04041   436   NtQueryVirtualMemory  (-1, 0xa70000, Basic, 28, ... {BaseAddress=0xa70000,AllocationBase=0xa70000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 0x0, ) == 0x0
 04042   436   NtEnumerateValueKey  (404, 8, Full, 220, ... TitleIdx=0, Type=1, Name= (404, 8, Full, 220, ... TitleIdx=0, Type=1, Name="NUMBER_OF_PROCESSORS", Data="1\0\0\0"}, 64, ) , Data= (404, 8, Full, 220, ... TitleIdx=0, Type=1, Name="NUMBER_OF_PROCESSORS", Data="1\0\0\0"}, 64, ) }, 64, ) == 0x0
 04043   436   NtQueryVirtualMemory  (-1, 0xa70000, Basic, 28, ... {BaseAddress=0xa70000,AllocationBase=0xa70000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 0x0, ) == 0x0
 04044   436   NtEnumerateValueKey  (404, 9, Full, 220, ... TitleIdx=0, Type=1, Name= (404, 9, Full, 220, ... TitleIdx=0, Type=1, Name="PATHEXT", Data=".\0C\0O\0M\0;\0.\0E\0X\0E\0;\0.\0B\0A\0T\0;\0.\0C\0M\0D\0;\0.\0V\0B\0S\0;\0.\0V\0B\0E\0;\0.\0J\0S\0;\0.\0J\0S\0E\0;\0.\0W\0S\0F\0;\0.\0W\0S\0H\0\0\0"}, 134, ) , Data= (404, 9, Full, 220, ... TitleIdx=0, Type=1, Name="PATHEXT", Data=".\0C\0O\0M\0;\0.\0E\0X\0E\0;\0.\0B\0A\0T\0;\0.\0C\0M\0D\0;\0.\0V\0B\0S\0;\0.\0V\0B\0E\0;\0.\0J\0S\0;\0.\0J\0S\0E\0;\0.\0W\0S\0F\0;\0.\0W\0S\0H\0\0\0"}, 134, ) }, 134, ) == 0x0
 04045   436   NtQueryVirtualMemory  (-1, 0xa70000, Basic, 28, ... {BaseAddress=0xa70000,AllocationBase=0xa70000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 0x0, ) == 0x0
 04046   436   NtEnumerateValueKey  (404, 10, Full, 220, ... TitleIdx=0, Type=2, Name= (404, 10, Full, 220, ... TitleIdx=0, Type=2, Name="TEMP", Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0T\0E\0M\0P\0\0\0"}, 64, ) , Data= (404, 10, Full, 220, ... TitleIdx=0, Type=2, Name="TEMP", Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0T\0E\0M\0P\0\0\0"}, 64, ) }, 64, ) == 0x0
 04047   436   NtEnumerateValueKey  (404, 11, Full, 220, ... TitleIdx=0, Type=2, Name= (404, 11, Full, 220, ... TitleIdx=0, Type=2, Name="TMP", Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0T\0E\0M\0P\0\0\0"}, 64, ) , Data= (404, 11, Full, 220, ... TitleIdx=0, Type=2, Name="TMP", Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0T\0E\0M\0P\0\0\0"}, 64, ) }, 64, ) == 0x0
 04048   436   NtEnumerateValueKey  (404, 0, Full, 220, ... TitleIdx=0, Type=2, Name= (404, 0, Full, 220, ... TitleIdx=0, Type=2, Name="ComSpec", Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0s\0y\0s\0t\0e\0m\03\02\0\\0c\0m\0d\0.\0e\0x\0e\0\0\0"}, 96, ) , Data= (404, 0, Full, 220, ... TitleIdx=0, Type=2, Name="ComSpec", Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0s\0y\0s\0t\0e\0m\03\02\0\\0c\0m\0d\0.\0e\0x\0e\0\0\0"}, 96, ) }, 96, ) == 0x0
 04049   436   NtQueryVirtualMemory  (-1, 0xa70000, Basic, 28, ... {BaseAddress=0xa70000,AllocationBase=0xa70000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 0x0, ) == 0x0
 04050   436   NtEnumerateValueKey  (404, 1, Full, 220, ... TitleIdx=0, Type=2, Name= (404, 1, Full, 220, ... TitleIdx=0, Type=2, Name="Path", Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0s\0y\0s\0t\0e\0m\03\02\0;\0%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0;\0%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0W\0b\0e\0m\0\0\0"}, 152, ) , Data= (404, 1, Full, 220, ... TitleIdx=0, Type=2, Name="Path", Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0s\0y\0s\0t\0e\0m\03\02\0;\0%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0;\0%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0W\0b\0e\0m\0\0\0"}, 152, ) }, 152, ) == 0x0
 04051   436   NtQueryVirtualMemory  (-1, 0xa70000, Basic, 28, ... {BaseAddress=0xa70000,AllocationBase=0xa70000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 0x0, ) == 0x0
 04052   436   NtEnumerateValueKey  (404, 2, Full, 220, ... TitleIdx=0, Type=2, Name= (404, 2, Full, 220, ... TitleIdx=0, Type=2, Name="windir", Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\0\0"}, 58, ) , Data= (404, 2, Full, 220, ... TitleIdx=0, Type=2, Name="windir", Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\0\0"}, 58, ) }, 58, ) == 0x0
 04053   436   NtQueryVirtualMemory  (-1, 0xa70000, Basic, 28, ... {BaseAddress=0xa70000,AllocationBase=0xa70000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 0x0, ) == 0x0
 04054   436   NtEnumerateValueKey  (404, 3, Full, 220, ... TitleIdx=0, Type=1, Name= (404, 3, Full, 220, ... TitleIdx=0, Type=1, Name="OS", Data="W\0i\0n\0d\0o\0w\0s\0_\0N\0T\0\0\0"}, 46, ) , Data= (404, 3, Full, 220, ... TitleIdx=0, Type=1, Name="OS", Data="W\0i\0n\0d\0o\0w\0s\0_\0N\0T\0\0\0"}, 46, ) }, 46, ) == 0x0
 04055   436   NtEnumerateValueKey  (404, 4, Full, 220, ... TitleIdx=0, Type=1, Name= (404, 4, Full, 220, ... TitleIdx=0, Type=1, Name="PROCESSOR_ARCHITECTURE", Data="x\08\06\0\0\0"}, 72, ) , Data= (404, 4, Full, 220, ... TitleIdx=0, Type=1, Name="PROCESSOR_ARCHITECTURE", Data="x\08\06\0\0\0"}, 72, ) }, 72, ) == 0x0
 04056   436   NtEnumerateValueKey  (404, 5, Full, 220, ... TitleIdx=0, Type=1, Name= (404, 5, Full, 220, ... TitleIdx=0, Type=1, Name="PROCESSOR_LEVEL", Data="1\05\0\0\0"}, 58, ) , Data= (404, 5, Full, 220, ... TitleIdx=0, Type=1, Name="PROCESSOR_LEVEL", Data="1\05\0\0\0"}, 58, ) }, 58, ) == 0x0
 04057   436   NtEnumerateValueKey  (404, 6, Full, 220, ... TitleIdx=0, Type=1, Name= (404, 6, Full, 220, ... TitleIdx=0, Type=1, Name="PROCESSOR_IDENTIFIER", Data="x\08\06\0 \0F\0a\0m\0i\0l\0y\0 \01\05\0 \0M\0o\0d\0e\0l\0 \04\0 \0S\0t\0e\0p\0p\0i\0n\0g\0 \08\0,\0 \0G\0e\0n\0u\0i\0n\0e\0I\0n\0t\0e\0l\0\0\0"}, 154, ) , Data= (404, 6, Full, 220, ... TitleIdx=0, Type=1, Name="PROCESSOR_IDENTIFIER", Data="x\08\06\0 \0F\0a\0m\0i\0l\0y\0 \01\05\0 \0M\0o\0d\0e\0l\0 \04\0 \0S\0t\0e\0p\0p\0i\0n\0g\0 \08\0,\0 \0G\0e\0n\0u\0i\0n\0e\0I\0n\0t\0e\0l\0\0\0"}, 154, ) }, 154, ) == 0x0
 04058   436   NtEnumerateValueKey  (404, 7, Full, 220, ... TitleIdx=0, Type=1, Name= (404, 7, Full, 220, ... TitleIdx=0, Type=1, Name="PROCESSOR_REVISION", Data="0\04\00\08\0\0\0"}, 66, ) , Data= (404, 7, Full, 220, ... TitleIdx=0, Type=1, Name="PROCESSOR_REVISION", Data="0\04\00\08\0\0\0"}, 66, ) }, 66, ) == 0x0
 04059   436   NtEnumerateValueKey  (404, 8, Full, 220, ... TitleIdx=0, Type=1, Name= (404, 8, Full, 220, ... TitleIdx=0, Type=1, Name="NUMBER_OF_PROCESSORS", Data="1\0\0\0"}, 64, ) , Data= (404, 8, Full, 220, ... TitleIdx=0, Type=1, Name="NUMBER_OF_PROCESSORS", Data="1\0\0\0"}, 64, ) }, 64, ) == 0x0
 04060   436   NtEnumerateValueKey  (404, 9, Full, 220, ... TitleIdx=0, Type=1, Name= (404, 9, Full, 220, ... TitleIdx=0, Type=1, Name="PATHEXT", Data=".\0C\0O\0M\0;\0.\0E\0X\0E\0;\0.\0B\0A\0T\0;\0.\0C\0M\0D\0;\0.\0V\0B\0S\0;\0.\0V\0B\0E\0;\0.\0J\0S\0;\0.\0J\0S\0E\0;\0.\0W\0S\0F\0;\0.\0W\0S\0H\0\0\0"}, 134, ) , Data= (404, 9, Full, 220, ... TitleIdx=0, Type=1, Name="PATHEXT", Data=".\0C\0O\0M\0;\0.\0E\0X\0E\0;\0.\0B\0A\0T\0;\0.\0C\0M\0D\0;\0.\0V\0B\0S\0;\0.\0V\0B\0E\0;\0.\0J\0S\0;\0.\0J\0S\0E\0;\0.\0W\0S\0F\0;\0.\0W\0S\0H\0\0\0"}, 134, ) }, 134, ) == 0x0
 04061   436   NtEnumerateValueKey  (404, 10, Full, 220, ... TitleIdx=0, Type=2, Name= (404, 10, Full, 220, ... TitleIdx=0, Type=2, Name="TEMP", Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0T\0E\0M\0P\0\0\0"}, 64, ) , Data= (404, 10, Full, 220, ... TitleIdx=0, Type=2, Name="TEMP", Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0T\0E\0M\0P\0\0\0"}, 64, ) }, 64, ) == 0x0
 04062   436   NtQueryInformationProcess  (-1, DefaultHardErrorMode, 4, ... {process info, class 12, size 4}, 0x0, ) == 0x0
 04063   436   NtSetInformationProcess  (-1, DefaultHardErrorMode, {process info, class 12, size 4}, 4, ... ) == 0x0
 04064   436   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\TEMP"}, 1236548, ... ) }, 1236548, ... ) == 0x0
 04065   436   NtQueryInformationProcess  (-1, DefaultHardErrorMode, 4, ... {process info, class 12, size 4}, 0x0, ) == 0x0
 04066   436   NtSetInformationProcess  (-1, DefaultHardErrorMode, {process info, class 12, size 4}, 4, ... ) == 0x0
 04067   436   NtQueryVirtualMemory  (-1, 0xa70000, Basic, 28, ... {BaseAddress=0xa70000,AllocationBase=0xa70000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 0x0, ) == 0x0
 04068   436   NtEnumerateValueKey  (404, 11, Full, 220, ... TitleIdx=0, Type=2, Name= (404, 11, Full, 220, ... TitleIdx=0, Type=2, Name="TMP", Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0T\0E\0M\0P\0\0\0"}, 64, ) , Data= (404, 11, Full, 220, ... TitleIdx=0, Type=2, Name="TMP", Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0T\0E\0M\0P\0\0\0"}, 64, ) }, 64, ) == 0x0
 04069   436   NtQueryInformationProcess  (-1, DefaultHardErrorMode, 4, ... {process info, class 12, size 4}, 0x0, ) == 0x0
 04070   436   NtSetInformationProcess  (-1, DefaultHardErrorMode, {process info, class 12, size 4}, 4, ... ) == 0x0
 04071   436   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\TEMP"}, 1236548, ... ) }, 1236548, ... ) == 0x0
 04072   436   NtQueryInformationProcess  (-1, DefaultHardErrorMode, 4, ... {process info, class 12, size 4}, 0x0, ) == 0x0
 04073   436   NtSetInformationProcess  (-1, DefaultHardErrorMode, {process info, class 12, size 4}, 4, ... ) == 0x0
 04074   436   NtQueryVirtualMemory  (-1, 0xa70000, Basic, 28, ... {BaseAddress=0xa70000,AllocationBase=0xa70000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 0x0, ) == 0x0
 04075   436   NtClose  (404, ... ) == 0x0
 04076   436   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\System\CurrentControlSet\Control\ComputerName"}, ... 404, ) }, ... 404, ) == 0x0
 04077   436   NtOpenKey  (0x20019, {24, 404, 0x40, 0, 0,  (0x20019, {24, 404, 0x40, 0, 0, "ActiveComputerName"}, ... 416, ) }, ... 416, ) == 0x0
 04078   436   NtQueryValueKey  (416,  (416, "ComputerName", Full, 108, ... TitleIdx=0, Type=1, Name="ComputerName", Data="M\0Y\0W\0O\0R\0L\0D\0\0\0"}, 60, ) , Full, 108, ... TitleIdx=0, Type=1, Name= (416, "ComputerName", Full, 108, ... TitleIdx=0, Type=1, Name="ComputerName", Data="M\0Y\0W\0O\0R\0L\0D\0\0\0"}, 60, ) , Data= (416, "ComputerName", Full, 108, ... TitleIdx=0, Type=1, Name="ComputerName", Data="M\0Y\0W\0O\0R\0L\0D\0\0\0"}, 60, ) }, 60, ) == 0x0
 04079   436   NtClose  (416, ... ) == 0x0
 04080   436   NtClose  (404, ... ) == 0x0
 04081   436   NtQueryVirtualMemory  (-1, 0xa70000, Basic, 28, ... {BaseAddress=0xa70000,AllocationBase=0xa70000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 0x0, ) == 0x0
 04082   436   NtOpenKey  (0x20019, {24, 48, 0x40, 0, 0,  (0x20019, {24, 48, 0x40, 0, 0, "Software\Microsoft\Windows NT\CurrentVersion\ProfileList"}, ... 404, ) }, ... 404, ) == 0x0
 04083   436   NtQueryValueKey  (404,  (404, "ProfilesDirectory", Partial, 144, ... TitleIdx=0, Type=2, Data="%\0S\0y\0s\0t\0e\0m\0D\0r\0i\0v\0e\0%\0\\0D\0o\0c\0u\0m\0e\0n\0t\0s\0 \0a\0n\0d\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\0\0"}, 86, ) , Partial, 144, ... TitleIdx=0, Type=2, Data= (404, "ProfilesDirectory", Partial, 144, ... TitleIdx=0, Type=2, Data="%\0S\0y\0s\0t\0e\0m\0D\0r\0i\0v\0e\0%\0\\0D\0o\0c\0u\0m\0e\0n\0t\0s\0 \0a\0n\0d\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\0\0"}, 86, ) }, 86, ) == 0x0
 04084   436   NtClose  (404, ... ) == 0x0
 04085   436   NtOpenKey  (0x20019, {24, 48, 0x40, 0, 0,  (0x20019, {24, 48, 0x40, 0, 0, "Software\Microsoft\Windows NT\CurrentVersion\ProfileList"}, ... 404, ) }, ... 404, ) == 0x0
 04086   436   NtQueryValueKey  (404,  (404, "DefaultUserProfile", Partial, 144, ... TitleIdx=0, Type=1, Data="D\0e\0f\0a\0u\0l\0t\0 \0U\0s\0e\0r\0\0\0"}, 38, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (404, "DefaultUserProfile", Partial, 144, ... TitleIdx=0, Type=1, Data="D\0e\0f\0a\0u\0l\0t\0 \0U\0s\0e\0r\0\0\0"}, 38, ) }, 38, ) == 0x0
 04087   436   NtClose  (404, ... ) == 0x0
 04088   436   NtQueryVirtualMemory  (-1, 0xa70000, Basic, 28, ... {BaseAddress=0xa70000,AllocationBase=0xa70000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 0x0, ) == 0x0
 04089   436   NtOpenKey  (0x20019, {24, 48, 0x40, 0, 0,  (0x20019, {24, 48, 0x40, 0, 0, "Software\Microsoft\Windows\CurrentVersion"}, ... 404, ) }, ... 404, ) == 0x0
 04090   436   NtQueryValueKey  (404,  (404, "ProgramFilesDir", Partial, 144, ... TitleIdx=0, Type=1, Data="C\0:\0\\0P\0r\0o\0g\0r\0a\0m\0 \0F\0i\0l\0e\0s\0\0\0"}, 46, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (404, "ProgramFilesDir", Partial, 144, ... TitleIdx=0, Type=1, Data="C\0:\0\\0P\0r\0o\0g\0r\0a\0m\0 \0F\0i\0l\0e\0s\0\0\0"}, 46, ) }, 46, ) == 0x0
 04091   436   NtQueryVirtualMemory  (-1, 0xa70000, Basic, 28, ... {BaseAddress=0xa70000,AllocationBase=0xa70000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 0x0, ) == 0x0
 04092   436   NtQueryValueKey  (404,  (404, "CommonFilesDir", Partial, 144, ... TitleIdx=0, Type=1, Data="C\0:\0\\0P\0r\0o\0g\0r\0a\0m\0 \0F\0i\0l\0e\0s\0\\0C\0o\0m\0m\0o\0n\0 \0F\0i\0l\0e\0s\0\0\0"}, 72, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (404, "CommonFilesDir", Partial, 144, ... TitleIdx=0, Type=1, Data="C\0:\0\\0P\0r\0o\0g\0r\0a\0m\0 \0F\0i\0l\0e\0s\0\\0C\0o\0m\0m\0o\0n\0 \0F\0i\0l\0e\0s\0\0\0"}, 72, ) }, 72, ) == 0x0
 04093   436   NtQueryVirtualMemory  (-1, 0xa70000, Basic, 28, ... {BaseAddress=0xa70000,AllocationBase=0xa70000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 0x0, ) == 0x0
 04094   436   NtClose  (404, ... ) == 0x0
 04095   436   NtQueryInformationToken  (408, User, 200, ... {token info, class 1, size 36}, 36, ) == 0x0
 04096   436   NtOpenKey  (0x20019, {24, 356, 0x40, 0, 0,  (0x20019, {24, 356, 0x40, 0, 0, "S-1-5-21-1078081533-484763869-839522115-1003"}, ... 404, ) }, ... 404, ) == 0x0
 04097   436   NtOpenThreadToken  (-2, 0x2000c, 1, ... ) == STATUS_NO_TOKEN
 04098   436   NtQueryInformationToken  (408, Type, 4, ... {token info, class 8, size 4}, 4, ) == 0x0
 04099   436   NtDuplicateToken  (408, 0xc, {24, 0, 0x0, 0, 1237932, 0x0}, 0, 2, ... ) == STATUS_ACCESS_DENIED
 04100   436   NtQueryInformationToken  (408, User, 200, ... {token info, class 1, size 36}, 36, ) == 0x0
 04101   436   NtOpenThreadToken  (-2, 0xc, 1, ... ) == STATUS_NO_TOKEN
 04102   436   NtCreateEvent  (0x1f0003, 0x0, 1, 0, ... 416, ) == 0x0
 04103   436   NtOpenThreadToken  (-2, 0xc, 1, ... ) == STATUS_NO_TOKEN
 04104   436   NtSetInformationThread  (-2, ImpersonationToken, {ImpToken=0,}, 4, ... ) == 0x0
 04105   436   NtCreateFile  (0xc0100080, {24, 0, 0x40, 0, 1236136,  (0xc0100080, {24, 0, 0x40, 0, 1236136, "\??\PIPE\lsarpc"}, 0x0, 0, 3, 1, 64, 0, 0, ... 420, {status=0x0, info=1}, ) }, 0x0, 0, 3, 1, 64, 0, 0, ... 420, {status=0x0, info=1}, ) == 0x0
 04106   436   NtSetInformationFile  (420, 1236192, 8, Pipe, ... {status=0x0, info=0}, ) == 0x0
 04107   436   NtSetInformationFile  (420, 1236184, 8, Completion, ... {status=0x0, info=0}, ) == 0x0
 04108   436   NtSetInformationThread  (-2, ImpersonationToken, {ImpToken=0,}, 4, ... ) == 0x0
 04109   436   NtWriteFile  (420, 325, 0, 0,  (420, 325, 0, 0, "\5\0\13\3\20\0\0\0H\0\0\0\1\0\0\0\270\20\270\20\0\0\0\0\1\0\0\0\0\0\1\0xW4\224\22\315\253\357\0\1#Eg\211\253\0\0\0\0\4]\210\212\353\34\311\21\237\350\10\0+\20H`\2\0\0\0", 72, {0, 0}, 0, ... {status=0x0, info=72}, ) , 72, {0, 0}, 0, ... {status=0x0, info=72}, ) == 0x0
 04110   436   NtReadFile  (420, 325, 0, 0, 1024, {0, 0}, 0, ... {status=0x0, info=68},  (420, 325, 0, 0, 1024, {0, 0}, 0, ... {status=0x0, info=68}, "\5\0\14\3\20\0\0\0D\0\0\0\1\0\0\0\270\20\270\20\363\36\0\0\14\0\PIPE\lsass\0\0\0\1\0\0\0\0\0\0\0\4]\210\212\353\34\311\21\237\350\10\0+\20H`\2\0\0\0", ) , ) == 0x0
 04111   436   NtFsControlFile  (420, 325, 0x0, 0x0, 0x11c017,  (420, 325, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0@\0\0\0\1\0\0\0(\0\0\0\0\0,\0\0\0\0\0\30\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\\343\22\0\14\0\0\0\2\0\1\0\0\10\0\0", 64, 1024, ... {status=0x103, info=68}, "\5\0\14\3\20\0\0\0D\0\0\0\1\0\0\0\270\20\270\20\363\36\0\0\14\0\PIPE\lsass\0\0\0\1\0\0\0\0\0\0\0\4]\210\212\353\34\311\21\237\350\10\0+\20H`\2\0\0\0", ) , 64, 1024, ... {status=0x103, info=68},  (420, 325, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0@\0\0\0\1\0\0\0(\0\0\0\0\0,\0\0\0\0\0\30\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\\343\22\0\14\0\0\0\2\0\1\0\0\10\0\0", 64, 1024, ... {status=0x103, info=68}, "\5\0\14\3\20\0\0\0D\0\0\0\1\0\0\0\270\20\270\20\363\36\0\0\14\0\PIPE\lsass\0\0\0\1\0\0\0\0\0\0\0\4]\210\212\353\34\311\21\237\350\10\0+\20H`\2\0\0\0", ) , ) == 0x103
 04112   436   NtFsControlFile  (420, 325, 0x0, 0x0, 0x11c017,  (420, 325, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0t\0\0\0\2\0\0\0\\0\0\0\0\09\0\0\0\0\0\245\350\250\331*,\334\21\261\306\0\14)\371\246\305\1\0\0\0\224\343\22\0\1\0\0\0\210\354\25\0\5\0\0\0\1\5\0\0\0\0\0\5\25\0\0\0\3757B@\335\350\344\34C\27\122\353\3\0\0\0\0\0\0\0\0\0\0\1\0o\0\0\0\0\0\0\0\0\0\2\0\0\0", 116, 1024, ... {status=0x103, info=48}, "\5\0\2\3\20\0\0\00\0\0\0\1\0\0\0\30\0\0\0\0\0\0\0\0\0\0\0\245\350\250\331*,\334\21\261\306\0\14)\371\246\305\0\0\0\0", ) , 116, 1024, ... {status=0x103, info=48},  (420, 325, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0t\0\0\0\2\0\0\0\\0\0\0\0\09\0\0\0\0\0\245\350\250\331*,\334\21\261\306\0\14)\371\246\305\1\0\0\0\224\343\22\0\1\0\0\0\210\354\25\0\5\0\0\0\1\5\0\0\0\0\0\5\25\0\0\0\3757B@\335\350\344\34C\27\122\353\3\0\0\0\0\0\0\0\0\0\0\1\0o\0\0\0\0\0\0\0\0\0\2\0\0\0", 116, 1024, ... {status=0x103, info=48}, "\5\0\2\3\20\0\0\00\0\0\0\1\0\0\0\30\0\0\0\0\0\0\0\0\0\0\0\245\350\250\331*,\334\21\261\306\0\14)\371\246\305\0\0\0\0", ) , ) == 0x103
 04113   436   NtFsControlFile  (420, 325, 0x0, 0x0, 0x11c017,  (420, 325, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0,\0\0\0\3\0\0\0\24\0\0\0\0\0\0\0\0\0\0\0\245\350\250\331*,\334\21\261\306\0\14)\371\246\305", 44, 1024, ... {status=0x103, info=180}, "\5\0\2\3\20\0\0\0\264\0\0\0\2\0\0\0\234\0\0\0\0\0\0\0\20\264\25\0\1\0\0\0\34\264\25\0 \0\0\0\1\0\0\0\16\0\20\0(\264\25\08\264\25\0\10\0\0\0\0\0\0\0\7\0\0\0M\0Y\0W\0O\0R\0L\0D\0O\0\4\0\0\0\1\4\0\0\0\0\0\5\25\0\0\0\3757B@\335\350\344\34C\27\122\1\0\0\0\310\266\25\0\1\0\0\0\1\0\0\0\20\0\22\0\334\266\25\0\0\0\0\0\0\0\0\0\11\0\0\0\0\0\0\0\10\0\0\0S\0R\0I\0-\0u\0s\0e\0r\0\1\0\0\0\0\0\0\0", ) , 44, 1024, ... {status=0x103, info=180},  (420, 325, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0,\0\0\0\3\0\0\0\24\0\0\0\0\0\0\0\0\0\0\0\245\350\250\331*,\334\21\261\306\0\14)\371\246\305", 44, 1024, ... {status=0x103, info=180}, "\5\0\2\3\20\0\0\0\264\0\0\0\2\0\0\0\234\0\0\0\0\0\0\0\20\264\25\0\1\0\0\0\34\264\25\0 \0\0\0\1\0\0\0\16\0\20\0(\264\25\08\264\25\0\10\0\0\0\0\0\0\0\7\0\0\0M\0Y\0W\0O\0R\0L\0D\0O\0\4\0\0\0\1\4\0\0\0\0\0\5\25\0\0\0\3757B@\335\350\344\34C\27\122\1\0\0\0\310\266\25\0\1\0\0\0\1\0\0\0\20\0\22\0\334\266\25\0\0\0\0\0\0\0\0\0\11\0\0\0\0\0\0\0\10\0\0\0S\0R\0I\0-\0u\0s\0e\0r\0\1\0\0\0\0\0\0\0", ) , ) == 0x103
 04114   436   NtClose  (416, ... ) == 0x0
 04115   436   NtClose  (420, ... ) == 0x0
 04116   436   NtOpenThreadToken  (-2, 0xc, 1, ... ) == STATUS_NO_TOKEN
 04117   436   NtCreateEvent  (0x1f0003, 0x0, 1, 0, ... 420, ) == 0x0
 04118   436   NtOpenThreadToken  (-2, 0xc, 1, ... ) == STATUS_NO_TOKEN
 04119   436   NtSetInformationThread  (-2, ImpersonationToken, {ImpToken=0,}, 4, ... ) == 0x0
 04120   436   NtCreateFile  (0xc0100080, {24, 0, 0x40, 0, 1236132,  (0xc0100080, {24, 0, 0x40, 0, 1236132, "\??\PIPE\lsarpc"}, 0x0, 0, 3, 1, 64, 0, 0, ... 416, {status=0x0, info=1}, ) }, 0x0, 0, 3, 1, 64, 0, 0, ... 416, {status=0x0, info=1}, ) == 0x0
 04121   436   NtSetInformationFile  (416, 1236188, 8, Pipe, ... {status=0x0, info=0}, ) == 0x0
 04122   436   NtSetInformationFile  (416, 1236180, 8, Completion, ... {status=0x0, info=0}, ) == 0x0
 04123   436   NtSetInformationThread  (-2, ImpersonationToken, {ImpToken=0,}, 4, ... ) == 0x0
 04124   436   NtWriteFile  (416, 325, 0, 0,  (416, 325, 0, 0, "\5\0\13\3\20\0\0\0H\0\0\0\1\0\0\0\270\20\270\20\0\0\0\0\1\0\0\0\0\0\1\0xW4\224\22\315\253\357\0\1#Eg\211\253\0\0\0\0\4]\210\212\353\34\311\21\237\350\10\0+\20H`\2\0\0\0", 72, {0, 0}, 0, ... {status=0x0, info=72}, ) , 72, {0, 0}, 0, ... {status=0x0, info=72}, ) == 0x0
 04125   436   NtReadFile  (416, 325, 0, 0, 1024, {0, 0}, 0, ... {status=0x0, info=68},  (416, 325, 0, 0, 1024, {0, 0}, 0, ... {status=0x0, info=68}, "\5\0\14\3\20\0\0\0D\0\0\0\1\0\0\0\270\20\270\20\364\36\0\0\14\0\PIPE\lsass\0\0\0\1\0\0\0\0\0\0\0\4]\210\212\353\34\311\21\237\350\10\0+\20H`\2\0\0\0", ) , ) == 0x0
 04126   436   NtFsControlFile  (416, 325, 0x0, 0x0, 0x11c017,  (416, 325, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0@\0\0\0\1\0\0\0(\0\0\0\0\0,\0\0\0\0\0\30\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0X\343\22\0\14\0\0\0\2\0\1\0\0\10\0\0", 64, 1024, ... {status=0x103, info=68}, "\5\0\14\3\20\0\0\0D\0\0\0\1\0\0\0\270\20\270\20\364\36\0\0\14\0\PIPE\lsass\0\0\0\1\0\0\0\0\0\0\0\4]\210\212\353\34\311\21\237\350\10\0+\20H`\2\0\0\0", ) , 64, 1024, ... {status=0x103, info=68},  (416, 325, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0@\0\0\0\1\0\0\0(\0\0\0\0\0,\0\0\0\0\0\30\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0X\343\22\0\14\0\0\0\2\0\1\0\0\10\0\0", 64, 1024, ... {status=0x103, info=68}, "\5\0\14\3\20\0\0\0D\0\0\0\1\0\0\0\270\20\270\20\364\36\0\0\14\0\PIPE\lsass\0\0\0\1\0\0\0\0\0\0\0\4]\210\212\353\34\311\21\237\350\10\0+\20H`\2\0\0\0", ) , ) == 0x103
 04127   436   NtFsControlFile  (416, 325, 0x0, 0x0, 0x11c017,  (416, 325, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0t\0\0\0\2\0\0\0\\0\0\0\0\09\0\0\0\0\0\246\350\250\331*,\334\21\261\306\0\14)\371\246\305\1\0\0\0\220\343\22\0\1\0\0\0\210\354\25\0\5\0\0\0\1\5\0\0\0\0\0\5\25\0\0\0\3757B@\335\350\344\34C\27\122\353\3\0\0\0\0\0\0\0\0\0\0\1\0o\0\0\0\0\0\0\0\0\0\2\0\0\0", 116, 1024, ... {status=0x103, info=48}, "\5\0\2\3\20\0\0\00\0\0\0\1\0\0\0\30\0\0\0\0\0\0\0\0\0\0\0\246\350\250\331*,\334\21\261\306\0\14)\371\246\305\0\0\0\0", ) , 116, 1024, ... {status=0x103, info=48},  (416, 325, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0t\0\0\0\2\0\0\0\\0\0\0\0\09\0\0\0\0\0\246\350\250\331*,\334\21\261\306\0\14)\371\246\305\1\0\0\0\220\343\22\0\1\0\0\0\210\354\25\0\5\0\0\0\1\5\0\0\0\0\0\5\25\0\0\0\3757B@\335\350\344\34C\27\122\353\3\0\0\0\0\0\0\0\0\0\0\1\0o\0\0\0\0\0\0\0\0\0\2\0\0\0", 116, 1024, ... {status=0x103, info=48}, "\5\0\2\3\20\0\0\00\0\0\0\1\0\0\0\30\0\0\0\0\0\0\0\0\0\0\0\246\350\250\331*,\334\21\261\306\0\14)\371\246\305\0\0\0\0", ) , ) == 0x103
 04128   436   NtFsControlFile  (416, 325, 0x0, 0x0, 0x11c017,  (416, 325, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0,\0\0\0\3\0\0\0\24\0\0\0\0\0\0\0\0\0\0\0\246\350\250\331*,\334\21\261\306\0\14)\371\246\305", 44, 1024, ... {status=0x103, info=180}, "\5\0\2\3\20\0\0\0\264\0\0\0\2\0\0\0\234\0\0\0\0\0\0\0\20\264\25\0\1\0\0\0\34\264\25\0 \0\0\0\1\0\0\0\16\0\20\0(\264\25\08\264\25\0\10\0\0\0\0\0\0\0\7\0\0\0M\0Y\0W\0O\0R\0L\0D\0O\0\4\0\0\0\1\4\0\0\0\0\0\5\25\0\0\0\3757B@\335\350\344\34C\27\122\1\0\0\0\310\266\25\0\1\0\0\0\1\0\0\0\20\0\22\0\334\266\25\0\0\0\0\0\0\0\0\0\11\0\0\0\0\0\0\0\10\0\0\0S\0R\0I\0-\0u\0s\0e\0r\0\1\0\0\0\0\0\0\0", ) , 44, 1024, ... {status=0x103, info=180},  (416, 325, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0,\0\0\0\3\0\0\0\24\0\0\0\0\0\0\0\0\0\0\0\246\350\250\331*,\334\21\261\306\0\14)\371\246\305", 44, 1024, ... {status=0x103, info=180}, "\5\0\2\3\20\0\0\0\264\0\0\0\2\0\0\0\234\0\0\0\0\0\0\0\20\264\25\0\1\0\0\0\34\264\25\0 \0\0\0\1\0\0\0\16\0\20\0(\264\25\08\264\25\0\10\0\0\0\0\0\0\0\7\0\0\0M\0Y\0W\0O\0R\0L\0D\0O\0\4\0\0\0\1\4\0\0\0\0\0\5\25\0\0\0\3757B@\335\350\344\34C\27\122\1\0\0\0\310\266\25\0\1\0\0\0\1\0\0\0\20\0\22\0\334\266\25\0\0\0\0\0\0\0\0\0\11\0\0\0\0\0\0\0\10\0\0\0S\0R\0I\0-\0u\0s\0e\0r\0\1\0\0\0\0\0\0\0", ) , ) == 0x103
 04129   436   NtClose  (420, ... ) == 0x0
 04130   436   NtClose  (416, ... ) == 0x0
 04131   436   NtQueryVirtualMemory  (-1, 0xa70000, Basic, 28, ... {BaseAddress=0xa70000,AllocationBase=0xa70000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 0x0, ) == 0x0
 04132   436   NtQueryVirtualMemory  (-1, 0xa70000, Basic, 28, ... {BaseAddress=0xa70000,AllocationBase=0xa70000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 0x0, ) == 0x0
 04133   436   NtQueryInformationToken  (408, User, 200, ... {token info, class 1, size 36}, 36, ) == 0x0
 04134   436   NtOpenKey  (0x20019, {24, 48, 0x40, 0, 0,  (0x20019, {24, 48, 0x40, 0, 0, "Software\Microsoft\Windows NT\CurrentVersion\ProfileList\S-1-5-21-1078081533-484763869-839522115-1003"}, ... 416, ) }, ... 416, ) == 0x0
 04135   436   NtQueryValueKey  (416,  (416, "ProfileImagePath", Partial, 144, ... TitleIdx=0, Type=2, Data="%\0S\0y\0s\0t\0e\0m\0D\0r\0i\0v\0e\0%\0\\0D\0o\0c\0u\0m\0e\0n\0t\0s\0 \0a\0n\0d\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0S\0R\0I\0-\0u\0s\0e\0r\0\0\0"}, 104, ) , Partial, 144, ... TitleIdx=0, Type=2, Data= (416, "ProfileImagePath", Partial, 144, ... TitleIdx=0, Type=2, Data="%\0S\0y\0s\0t\0e\0m\0D\0r\0i\0v\0e\0%\0\\0D\0o\0c\0u\0m\0e\0n\0t\0s\0 \0a\0n\0d\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0S\0R\0I\0-\0u\0s\0e\0r\0\0\0"}, 104, ) }, 104, ) == 0x0
 04136   436   NtClose  (416, ... ) == 0x0
 04137   436   NtCreateKey  (0x2001f, {24, 404, 0x40, 0, 0,  (0x2001f, {24, 404, 0x40, 0, 0, "Software\Microsoft\Windows NT\CurrentVersion\Winlogon"}, 0, 0x0, 0, ... 416, 2, ) }, 0, 0x0, 0, ... 416, 2, ) == 0x0
 04138   436   NtQueryValueKey  (416,  (416, "ParseAutoexec", Partial, 144, ... TitleIdx=0, Type=1, Data="1\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (416, "ParseAutoexec", Partial, 144, ... TitleIdx=0, Type=1, Data="1\0\0\0"}, 16, ) }, 16, ) == 0x0
 04139   436   NtClose  (416, ... ) == 0x0
 04140   436   NtQueryInformationProcess  (-1, DefaultHardErrorMode, 4, ... {process info, class 12, size 4}, 0x0, ) == 0x0
 04141   436   NtSetInformationProcess  (-1, DefaultHardErrorMode, {process info, class 12, size 4}, 4, ... ) == 0x0
 04142   436   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\c:\autoexec.bat"}, 1237836, ... ) }, 1237836, ... ) == 0x0
 04143   436   NtCreateFile  (0x80100080, {24, 0, 0x40, 0, 1237844,  (0x80100080, {24, 0, 0x40, 0, 1237844, "\??\c:\autoexec.bat"}, 0x0, 128, 1, 1, 96, 0, 0, ... 416, {status=0x0, info=1}, ) }, 0x0, 128, 1, 1, 96, 0, 0, ... 416, {status=0x0, info=1}, ) == 0x0
 04144   436   NtQueryInformationProcess  (-1, DefaultHardErrorMode, 4, ... {process info, class 12, size 4}, 0x0, ) == 0x0
 04145   436   NtSetInformationProcess  (-1, DefaultHardErrorMode, {process info, class 12, size 4}, 4, ... ) == 0x0
 04146   436   NtQueryInformationFile  (416, 1237860, 24, Standard, ... {status=0x0, info=24}, ) == 0x0
 04147   436   NtReadFile  (416, 0, 0, 0, 0, 0x0, 0, ... {status=0x0, info=0}, "", ) == 0x0
 04148   436   NtClose  (416, ... ) == 0x0
 04149   436   NtOpenKey  (0x20019, {24, 404, 0x40, 0, 0,  (0x20019, {24, 404, 0x40, 0, 0, "Environment"}, ... 416, ) }, ... 416, ) == 0x0
 04150   436   NtEnumerateValueKey  (416, 0, Full, 220, ... TitleIdx=0, Type=2, Name= (416, 0, Full, 220, ... TitleIdx=0, Type=2, Name="TEMP", Data="%\0U\0S\0E\0R\0P\0R\0O\0F\0I\0L\0E\0%\0\\0L\0o\0c\0a\0l\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0T\0e\0m\0p\0\0\0"}, 96, ) , Data= (416, 0, Full, 220, ... TitleIdx=0, Type=2, Name="TEMP", Data="%\0U\0S\0E\0R\0P\0R\0O\0F\0I\0L\0E\0%\0\\0L\0o\0c\0a\0l\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0T\0e\0m\0p\0\0\0"}, 96, ) }, 96, ) == 0x0
 04151   436   NtEnumerateValueKey  (416, 1, Full, 220, ... TitleIdx=0, Type=2, Name= (416, 1, Full, 220, ... TitleIdx=0, Type=2, Name="TMP", Data="%\0U\0S\0E\0R\0P\0R\0O\0F\0I\0L\0E\0%\0\\0L\0o\0c\0a\0l\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0T\0e\0m\0p\0\0\0"}, 96, ) , Data= (416, 1, Full, 220, ... TitleIdx=0, Type=2, Name="TMP", Data="%\0U\0S\0E\0R\0P\0R\0O\0F\0I\0L\0E\0%\0\\0L\0o\0c\0a\0l\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0T\0e\0m\0p\0\0\0"}, 96, ) }, 96, ) == 0x0
 04152   436   NtEnumerateValueKey  (416, 2, Full, 220, ... ) == STATUS_NO_MORE_ENTRIES
 04153   436   NtEnumerateValueKey  (416, 0, Full, 220, ... TitleIdx=0, Type=2, Name= (416, 0, Full, 220, ... TitleIdx=0, Type=2, Name="TEMP", Data="%\0U\0S\0E\0R\0P\0R\0O\0F\0I\0L\0E\0%\0\\0L\0o\0c\0a\0l\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0T\0e\0m\0p\0\0\0"}, 96, ) , Data= (416, 0, Full, 220, ... TitleIdx=0, Type=2, Name="TEMP", Data="%\0U\0S\0E\0R\0P\0R\0O\0F\0I\0L\0E\0%\0\\0L\0o\0c\0a\0l\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0T\0e\0m\0p\0\0\0"}, 96, ) }, 96, ) == 0x0
 04154   436   NtQueryInformationProcess  (-1, DefaultHardErrorMode, 4, ... {process info, class 12, size 4}, 0x0, ) == 0x0
 04155   436   NtSetInformationProcess  (-1, DefaultHardErrorMode, {process info, class 12, size 4}, 4, ... ) == 0x0
 04156   436   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\Documents and Settings\SRI-user\Local Settings\Temp"}, 1236576, ... ) }, 1236576, ... ) == 0x0
 04157   436   NtOpenFile  (0x100001, {24, 0, 0x40, 0, 0,  (0x100001, {24, 0, 0x40, 0, 0, "\??\C:\"}, 3, 16417, ... 420, {status=0x0, info=1}, ) }, 3, 16417, ... 420, {status=0x0, info=1}, ) == 0x0
 04158   436   NtQueryDirectoryFile  (420, 0, 0, 0, 1235936, 616, BothDirectory, 1,  (420, 0, 0, 0, 1235936, 616, BothDirectory, 1, "Documents and Settings", 0, ... {status=0x0, info=138}, ) , 0, ... {status=0x0, info=138}, ) == 0x0
 04159   436   NtClose  (420, ... ) == 0x0
 04160   436   NtOpenFile  (0x100001, {24, 0, 0x40, 0, 0,  (0x100001, {24, 0, 0x40, 0, 0, "\??\C:\Documents and Settings\SRI-user\"}, 3, 16417, ... 420, {status=0x0, info=1}, ) }, 3, 16417, ... 420, {status=0x0, info=1}, ) == 0x0
 04161   436   NtQueryDirectoryFile  (420, 0, 0, 0, 1235936, 616, BothDirectory, 1,  (420, 0, 0, 0, 1235936, 616, BothDirectory, 1, "Local Settings", 0, ... {status=0x0, info=122}, ) , 0, ... {status=0x0, info=122}, ) == 0x0
 04162   436   NtClose  (420, ... ) == 0x0
 04163   436   NtQueryInformationProcess  (-1, DefaultHardErrorMode, 4, ... {process info, class 12, size 4}, 0x0, ) == 0x0
 04164   436   NtSetInformationProcess  (-1, DefaultHardErrorMode, {process info, class 12, size 4}, 4, ... ) == 0x0
 04165   436   NtQueryVirtualMemory  (-1, 0xa70000, Basic, 28, ... {BaseAddress=0xa70000,AllocationBase=0xa70000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 0x0, ) == 0x0
 04166   436   NtEnumerateValueKey  (416, 1, Full, 220, ... TitleIdx=0, Type=2, Name= (416, 1, Full, 220, ... TitleIdx=0, Type=2, Name="TMP", Data="%\0U\0S\0E\0R\0P\0R\0O\0F\0I\0L\0E\0%\0\\0L\0o\0c\0a\0l\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0T\0e\0m\0p\0\0\0"}, 96, ) , Data= (416, 1, Full, 220, ... TitleIdx=0, Type=2, Name="TMP", Data="%\0U\0S\0E\0R\0P\0R\0O\0F\0I\0L\0E\0%\0\\0L\0o\0c\0a\0l\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0T\0e\0m\0p\0\0\0"}, 96, ) }, 96, ) == 0x0
 04167   436   NtQueryInformationProcess  (-1, DefaultHardErrorMode, 4, ... {process info, class 12, size 4}, 0x0, ) == 0x0
 04168   436   NtSetInformationProcess  (-1, DefaultHardErrorMode, {process info, class 12, size 4}, 4, ... ) == 0x0
 04169   436   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\Documents and Settings\SRI-user\Local Settings\Temp"}, 1236576, ... ) }, 1236576, ... ) == 0x0
 04170   436   NtOpenFile  (0x100001, {24, 0, 0x40, 0, 0,  (0x100001, {24, 0, 0x40, 0, 0, "\??\C:\"}, 3, 16417, ... 420, {status=0x0, info=1}, ) }, 3, 16417, ... 420, {status=0x0, info=1}, ) == 0x0
 04171   436   NtQueryDirectoryFile  (420, 0, 0, 0, 1235936, 616, BothDirectory, 1,  (420, 0, 0, 0, 1235936, 616, BothDirectory, 1, "Documents and Settings", 0, ... {status=0x0, info=138}, ) , 0, ... {status=0x0, info=138}, ) == 0x0
 04172   436   NtClose  (420, ... ) == 0x0
 04173   436   NtOpenFile  (0x100001, {24, 0, 0x40, 0, 0,  (0x100001, {24, 0, 0x40, 0, 0, "\??\C:\Documents and Settings\SRI-user\"}, 3, 16417, ... 420, {status=0x0, info=1}, ) }, 3, 16417, ... 420, {status=0x0, info=1}, ) == 0x0
 04174   436   NtQueryDirectoryFile  (420, 0, 0, 0, 1235936, 616, BothDirectory, 1,  (420, 0, 0, 0, 1235936, 616, BothDirectory, 1, "Local Settings", 0, ... {status=0x0, info=122}, ) , 0, ... {status=0x0, info=122}, ) == 0x0
 04175   436   NtClose  (420, ... ) == 0x0
 04176   436   NtQueryInformationProcess  (-1, DefaultHardErrorMode, 4, ... {process info, class 12, size 4}, 0x0, ) == 0x0
 04177   436   NtSetInformationProcess  (-1, DefaultHardErrorMode, {process info, class 12, size 4}, 4, ... ) == 0x0
 04178   436   NtQueryVirtualMemory  (-1, 0xa70000, Basic, 28, ... {BaseAddress=0xa70000,AllocationBase=0xa70000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 0x0, ) == 0x0
 04179   436   NtEnumerateValueKey  (416, 2, Full, 220, ... ) == STATUS_NO_MORE_ENTRIES
 04180   436   NtClose  (416, ... ) == 0x0
 04181   436   NtOpenKey  (0x20019, {24, 404, 0x40, 0, 0,  (0x20019, {24, 404, 0x40, 0, 0, "Volatile Environment"}, ... 416, ) }, ... 416, ) == 0x0
 04182   436   NtEnumerateValueKey  (416, 0, Full, 220, ... TitleIdx=0, Type=1, Name= (416, 0, Full, 220, ... TitleIdx=0, Type=1, Name="LOGONSERVER", Data="\\0\\0M\0Y\0W\0O\0R\0L\0D\0\0\0"}, 64, ) , Data= (416, 0, Full, 220, ... TitleIdx=0, Type=1, Name="LOGONSERVER", Data="\\0\\0M\0Y\0W\0O\0R\0L\0D\0\0\0"}, 64, ) }, 64, ) == 0x0
 04183   436   NtQueryVirtualMemory  (-1, 0xa70000, Basic, 28, ... {BaseAddress=0xa70000,AllocationBase=0xa70000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 0x0, ) == 0x0
 04184   436   NtEnumerateValueKey  (416, 1, Full, 220, ... TitleIdx=0, Type=1, Name= (416, 1, Full, 220, ... TitleIdx=0, Type=1, Name="HOMEDRIVE", Data="C\0:\0\0\0"}, 46, ) , Data= (416, 1, Full, 220, ... TitleIdx=0, Type=1, Name="HOMEDRIVE", Data="C\0:\0\0\0"}, 46, ) }, 46, ) == 0x0
 04185   436   NtQueryVirtualMemory  (-1, 0xa70000, Basic, 28, ... {BaseAddress=0xa70000,AllocationBase=0xa70000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 0x0, ) == 0x0
 04186   436   NtEnumerateValueKey  (416, 2, Full, 220, ... TitleIdx=0, Type=1, Name= (416, 2, Full, 220, ... TitleIdx=0, Type=1, Name="HOMEPATH", Data="\\0D\0o\0c\0u\0m\0e\0n\0t\0s\0 \0a\0n\0d\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0S\0R\0I\0-\0u\0s\0e\0r\0\0\0"}, 102, ) , Data= (416, 2, Full, 220, ... TitleIdx=0, Type=1, Name="HOMEPATH", Data="\\0D\0o\0c\0u\0m\0e\0n\0t\0s\0 \0a\0n\0d\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0S\0R\0I\0-\0u\0s\0e\0r\0\0\0"}, 102, ) }, 102, ) == 0x0
 04187   436   NtQueryVirtualMemory  (-1, 0xa70000, Basic, 28, ... {BaseAddress=0xa70000,AllocationBase=0xa70000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 0x0, ) == 0x0
 04188   436   NtEnumerateValueKey  (416, 3, Full, 220, ... TitleIdx=0, Type=1, Name= (416, 3, Full, 220, ... TitleIdx=0, Type=1, Name="CLIENTNAME", Data="C\0o\0n\0s\0o\0l\0e\0\0\0"}, 56, ) , Data= (416, 3, Full, 220, ... TitleIdx=0, Type=1, Name="CLIENTNAME", Data="C\0o\0n\0s\0o\0l\0e\0\0\0"}, 56, ) }, 56, ) == 0x0
 04189   436   NtQueryVirtualMemory  (-1, 0xa70000, Basic, 28, ... {BaseAddress=0xa70000,AllocationBase=0xa70000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 0x0, ) == 0x0
 04190   436   NtEnumerateValueKey  (416, 4, Full, 220, ... TitleIdx=0, Type=1, Name= (416, 4, Full, 220, ... TitleIdx=0, Type=1, Name="SESSIONNAME", Data="C\0o\0n\0s\0o\0l\0e\0\0\0"}, 60, ) , Data= (416, 4, Full, 220, ... TitleIdx=0, Type=1, Name="SESSIONNAME", Data="C\0o\0n\0s\0o\0l\0e\0\0\0"}, 60, ) }, 60, ) == 0x0
 04191   436   NtQueryVirtualMemory  (-1, 0xa70000, Basic, 28, ... {BaseAddress=0xa70000,AllocationBase=0xa70000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 0x0, ) == 0x0
 04192   436   NtEnumerateValueKey  (416, 5, Full, 220, ... TitleIdx=0, Type=1, Name= (416, 5, Full, 220, ... TitleIdx=0, Type=1, Name="APPDATA", Data="C\0:\0\\0D\0o\0c\0u\0m\0e\0n\0t\0s\0 \0a\0n\0d\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0S\0R\0I\0-\0u\0s\0e\0r\0\\0A\0p\0p\0l\0i\0c\0a\0t\0i\0o\0n\0 \0D\0a\0t\0a\0\0\0"}, 140, ) , Data= (416, 5, Full, 220, ... TitleIdx=0, Type=1, Name="APPDATA", Data="C\0:\0\\0D\0o\0c\0u\0m\0e\0n\0t\0s\0 \0a\0n\0d\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0S\0R\0I\0-\0u\0s\0e\0r\0\\0A\0p\0p\0l\0i\0c\0a\0t\0i\0o\0n\0 \0D\0a\0t\0a\0\0\0"}, 140, ) }, 140, ) == 0x0
 04193   436   NtQueryVirtualMemory  (-1, 0xa70000, Basic, 28, ... {BaseAddress=0xa70000,AllocationBase=0xa70000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 0x0, ) == 0x0
 04194   436   NtEnumerateValueKey  (416, 6, Full, 220, ... TitleIdx=0, Type=1, Name= (416, 6, Full, 220, ... TitleIdx=0, Type=1, Name="HOMESHARE", Data="\0\0"}, 42, ) , Data= (416, 6, Full, 220, ... TitleIdx=0, Type=1, Name="HOMESHARE", Data="\0\0"}, 42, ) }, 42, ) == 0x0
 04195   436   NtEnumerateValueKey  (416, 7, Full, 220, ... ) == STATUS_NO_MORE_ENTRIES
 04196   436   NtEnumerateValueKey  (416, 0, Full, 220, ... TitleIdx=0, Type=1, Name= (416, 0, Full, 220, ... TitleIdx=0, Type=1, Name="LOGONSERVER", Data="\\0\\0M\0Y\0W\0O\0R\0L\0D\0\0\0"}, 64, ) , Data= (416, 0, Full, 220, ... TitleIdx=0, Type=1, Name="LOGONSERVER", Data="\\0\\0M\0Y\0W\0O\0R\0L\0D\0\0\0"}, 64, ) }, 64, ) == 0x0
 04197   436   NtEnumerateValueKey  (416, 1, Full, 220, ... TitleIdx=0, Type=1, Name= (416, 1, Full, 220, ... TitleIdx=0, Type=1, Name="HOMEDRIVE", Data="C\0:\0\0\0"}, 46, ) , Data= (416, 1, Full, 220, ... TitleIdx=0, Type=1, Name="HOMEDRIVE", Data="C\0:\0\0\0"}, 46, ) }, 46, ) == 0x0
 04198   436   NtEnumerateValueKey  (416, 2, Full, 220, ... TitleIdx=0, Type=1, Name= (416, 2, Full, 220, ... TitleIdx=0, Type=1, Name="HOMEPATH", Data="\\0D\0o\0c\0u\0m\0e\0n\0t\0s\0 \0a\0n\0d\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0S\0R\0I\0-\0u\0s\0e\0r\0\0\0"}, 102, ) , Data= (416, 2, Full, 220, ... TitleIdx=0, Type=1, Name="HOMEPATH", Data="\\0D\0o\0c\0u\0m\0e\0n\0t\0s\0 \0a\0n\0d\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0S\0R\0I\0-\0u\0s\0e\0r\0\0\0"}, 102, ) }, 102, ) == 0x0
 04199   436   NtEnumerateValueKey  (416, 3, Full, 220, ... TitleIdx=0, Type=1, Name= (416, 3, Full, 220, ... TitleIdx=0, Type=1, Name="CLIENTNAME", Data="C\0o\0n\0s\0o\0l\0e\0\0\0"}, 56, ) , Data= (416, 3, Full, 220, ... TitleIdx=0, Type=1, Name="CLIENTNAME", Data="C\0o\0n\0s\0o\0l\0e\0\0\0"}, 56, ) }, 56, ) == 0x0
 04200   436   NtEnumerateValueKey  (416, 4, Full, 220, ... TitleIdx=0, Type=1, Name= (416, 4, Full, 220, ... TitleIdx=0, Type=1, Name="SESSIONNAME", Data="C\0o\0n\0s\0o\0l\0e\0\0\0"}, 60, ) , Data= (416, 4, Full, 220, ... TitleIdx=0, Type=1, Name="SESSIONNAME", Data="C\0o\0n\0s\0o\0l\0e\0\0\0"}, 60, ) }, 60, ) == 0x0
 04201   436   NtEnumerateValueKey  (416, 5, Full, 220, ... TitleIdx=0, Type=1, Name= (416, 5, Full, 220, ... TitleIdx=0, Type=1, Name="APPDATA", Data="C\0:\0\\0D\0o\0c\0u\0m\0e\0n\0t\0s\0 \0a\0n\0d\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0S\0R\0I\0-\0u\0s\0e\0r\0\\0A\0p\0p\0l\0i\0c\0a\0t\0i\0o\0n\0 \0D\0a\0t\0a\0\0\0"}, 140, ) , Data= (416, 5, Full, 220, ... TitleIdx=0, Type=1, Name="APPDATA", Data="C\0:\0\\0D\0o\0c\0u\0m\0e\0n\0t\0s\0 \0a\0n\0d\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0S\0R\0I\0-\0u\0s\0e\0r\0\\0A\0p\0p\0l\0i\0c\0a\0t\0i\0o\0n\0 \0D\0a\0t\0a\0\0\0"}, 140, ) }, 140, ) == 0x0
 04202   436   NtEnumerateValueKey  (416, 6, Full, 220, ... TitleIdx=0, Type=1, Name= (416, 6, Full, 220, ... TitleIdx=0, Type=1, Name="HOMESHARE", Data="\0\0"}, 42, ) , Data= (416, 6, Full, 220, ... TitleIdx=0, Type=1, Name="HOMESHARE", Data="\0\0"}, 42, ) }, 42, ) == 0x0
 04203   436   NtEnumerateValueKey  (416, 7, Full, 220, ... ) == STATUS_NO_MORE_ENTRIES
 04204   436   NtClose  (416, ... ) == 0x0
 04205   436   NtClose  (404, ... ) == 0x0
 04206   436   NtFreeVirtualMemory  (-1, (0xa70000), 0, 32768, ... (0xa70000), 4096, ) == 0x0
 04207   436   NtClose  (412, ... ) == 0x0
 04208   436   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\Documents and Settings\SRI-user\Application Data"}, 1238500, ... ) }, 1238500, ... ) == 0x0
 04209   436   NtQueryInformationToken  (408, User, 64, ... {token info, class 1, size 36}, 36, ) == 0x0
 04210   436   NtOpenKey  (0x2001f, {24, 356, 0x40, 0, 0,  (0x2001f, {24, 356, 0x40, 0, 0, "S-1-5-21-1078081533-484763869-839522115-1003"}, ... 412, ) }, ... 412, ) == 0x0
 04211   436   NtCreateKey  (0x2000000, {24, 412, 0x40, 0, 0,  (0x2000000, {24, 412, 0x40, 0, 0, "Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders"}, 0, 0x0, 0, ... 404, 2, ) }, 0, 0x0, 0, ... 404, 2, ) == 0x0
 04212   436   NtClose  (412, ... ) == 0x0
 04213   436   NtSetValueKey  (404,  (404, "AppData", 0, 1, "C\0:\0\\0D\0o\0c\0u\0m\0e\0n\0t\0s\0 \0a\0n\0d\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0S\0R\0I\0-\0u\0s\0e\0r\0\\0A\0p\0p\0l\0i\0c\0a\0t\0i\0o\0n\0 \0D\0a\0t\0a\0\0\0", 104, ... ) , 0, 1,  (404, "AppData", 0, 1, "C\0:\0\\0D\0o\0c\0u\0m\0e\0n\0t\0s\0 \0a\0n\0d\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0S\0R\0I\0-\0u\0s\0e\0r\0\\0A\0p\0p\0l\0i\0c\0a\0t\0i\0o\0n\0 \0D\0a\0t\0a\0\0\0", 104, ... ) , 104, ... ) == 0x0
 04214   436   NtClose  (404, ... ) == 0x0
 04215   436   NtClose  (408, ... ) == 0x0
 04216   436   NtOpenFile  (0x100001, {24, 0, 0x40, 0, 0,  (0x100001, {24, 0, 0x40, 0, 0, "\??\C:\Documents and Settings\SRI-user\Application Data\Microsoft\Network\Connections\Pbk\"}, 3, 16417, ... ) }, 3, 16417, ... ) == STATUS_OBJECT_PATH_NOT_FOUND
 04217   436   NtWaitForSingleObject  (196, 0, 0x0, ... ) == 0x0
 04218   436   NtQueryInformationFile  (192, 1239548, 24, Standard, ... {status=0x0, info=24}, ) == 0x0
 04219   436   NtReleaseMutant  (196, ... 0x0, ) == 0x0
 04220   436   NtReleaseMutant  (240, ... 0x0, ) == 0x0
 04221   436   NtWaitForSingleObject  (104, 0, {0, 0}, ... ) == 0x102
 04222   436   NtWaitForSingleObject  (104, 0, {0, 0}, ... ) == 0x102
 04223   436   NtWaitForSingleObject  (104, 0, {0, 0}, ... ) == 0x102
 04224   436   NtWaitForSingleObject  (112, 0, {0, 0}, ... ) == 0x102
 04225   436   NtCreateEvent  (0x1f0003, 0x0, 1, 0, ... 408, ) == 0x0
 04226   436   NtConnectPort  ( ("\RPC Control\DNSResolver", {12, 2, 1, 1}, 0x0, 0x0, 1237688, 112, ... 404, 0x0, 0x0, 0x0, 112, ) , {12, 2, 1, 1}, 0x0, 0x0, 1237688, 112, ... 404, 0x0, 0x0, 0x0, 112, ) == 0x0
 04227   436   NtRequestWaitReplyPort  (404, {128, 152, new_msg, 0, 123020, 1310720, 1237452, 2012750850}  (404, {128, 152, new_msg, 0, 123020, 1310720, 1237452, 2012750850} "\0\350\22\0\2$\370w\370T\367w\1kwEVY\205D\237\200\364(\367\326\1)\2\0\0\0\1\0\0\0k\23\314w\4\0\0\0\20\344\314w\0\355\25\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\1\0\17\0x\352\25\0X\324\25\0\0\0\0\0f\0\0\03\0\0\0l\351\22\0\0\0\0\0\0\0\22\0h\342\22\0\240P\25\0\224\345\22\0\0\0\0\0\5\0\0\0\5\0\0\0" ... {128, 152, reply, 0, 424, 436, 1563, 0} "\7\350\22\0\2$\370w\370T\367w\1kwEVY\205D\237\200\364(\367\326\1)\2\0\0\0\1\0\0\0\0\0\0\0\4\0\0\0\20\344\314w\377\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\1\0\17\0x\352\25\0X\324\25\0\0\0\0\0f\0\0\03\0\0\0l\351\22\0\0\0\0\0\0\0\22\0h\342\22\0\240P\25\0\224\345\22\0\0\0\0\0\5\0\0\0\5\0\0\0" )  ... {128, 152, reply, 0, 424, 436, 1563, 0}  (404, {128, 152, new_msg, 0, 123020, 1310720, 1237452, 2012750850} "\0\350\22\0\2$\370w\370T\367w\1kwEVY\205D\237\200\364(\367\326\1)\2\0\0\0\1\0\0\0k\23\314w\4\0\0\0\20\344\314w\0\355\25\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\1\0\17\0x\352\25\0X\324\25\0\0\0\0\0f\0\0\03\0\0\0l\351\22\0\0\0\0\0\0\0\22\0h\342\22\0\240P\25\0\224\345\22\0\0\0\0\0\5\0\0\0\5\0\0\0" ... {128, 152, reply, 0, 424, 436, 1563, 0} "\7\350\22\0\2$\370w\370T\367w\1kwEVY\205D\237\200\364(\367\326\1)\2\0\0\0\1\0\0\0\0\0\0\0\4\0\0\0\20\344\314w\377\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\1\0\17\0x\352\25\0X\324\25\0\0\0\0\0f\0\0\03\0\0\0l\351\22\0\0\0\0\0\0\0\22\0h\342\22\0\240P\25\0\224\345\22\0\0\0\0\0\5\0\0\0\5\0\0\0" )  ) == 0x0
 04228   436   NtRequestWaitReplyPort  (404, {112, 136, new_msg, 0, 44, 3, 20, 0}  (404, {112, 136, new_msg, 0, 44, 3, 20, 0} "\1\0\0\0A\2\11\0*,\334\21\261\306\0\14)\371\246\305\1\0\0\0\377\377\377\377\1\0\0\0\0\0\0\0\254\263\25\0\26\0\0\0\0\0\0\0\26\0\0\0s\0r\0v\00\01\0.\0d\0e\0b\0e\0l\0i\0z\0o\0m\0b\0i\0.\0c\0o\0m\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0" ...  ...
 03980   568   NtWaitForSingleObject  ... ) == 0x0
 04229   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=95}, 0x0, ) , 16, 0, ... {status=0x103, info=95}, 0x0, ) == 0x103
 04230   568   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ...
 04228   436   NtRequestWaitReplyPort  ... {44, 68, reply, 0, 424, 436, 1564, 0}  ... {44, 68, reply, 0, 424, 436, 1564, 0} "\2\213+\370\1\0+\370B\271\325\371(\273\325\371\377\377\377\377\325\316\325\371\13\353\325\371\0\0\0\0\0\0\0\0\264\5\0\0\1\0\0\0" )  ) == 0x0
 04231   436   NtClose  (408, ... ) == 0x0
 04232   436   NtClose  (404, ... ) == 0x0
 04233   436   NtCreateFile  (0x3, {24, 0, 0x40, 0, 0,  (0x3, {24, 0, 0x40, 0, 0, "\Device\RasAcd"}, 0x0, 128, 3, 3, 0, 0, 0, ... 404, {status=0x0, info=0}, ) }, 0x0, 128, 3, 3, 0, 0, 0, ... 404, {status=0x0, info=0}, ) == 0x0
 04234   436   NtCreateEvent  (0x1f0003, 0x0, 1, 0, ... 408, ) == 0x0
 04235   436   NtDeviceIoControlFile  (404, 408, 0x0, 0x0, 0xf14014,  (404, 408, 0x0, 0x0, 0xf14014, "\3\0\0\0srv01.debelizombi.com\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0", 1552, 0, ... ) , 1552, 0, ... ) == STATUS_UNSUCCESSFUL
 04236   436   NtClose  (408, ... ) == 0x0
 04237   436   NtClose  (404, ... ) == 0x0
 04238   436   NtClearEvent  (376, ... ) == 0x0
 04239   436   NtSetEvent  (376, ... 0x0, ) == 0x0
 04240   436   NtClose  (376, ... ) == 0x0
 04241   436   NtCreateFile  (0x80100080, {24, 0, 0x40, 0, 1242800,  (0x80100080, {24, 0, 0x40, 0, 1242800, "\??\C:\WINDOWS\imon.cfg"}, 0x0, 0, 1, 1, 96, 0, 0, ... ) }, 0x0, 0, 1, 1, 96, 0, 0, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 04242   436   NtWaitForSingleObject  (112, 0, {0, 0}, ... ) == 0x102
 04243   436   NtCreateEvent  (0x1f0003, 0x0, 1, 0, ... 376, ) == 0x0
 04244   436   NtConnectPort  ( ("\RPC Control\DNSResolver", {12, 2, 1, 1}, 0x0, 0x0, 1239612, 112, ... 404, 0x0, 0x0, 0x0, 112, ) , {12, 2, 1, 1}, 0x0, 0x0, 1239612, 112, ... 404, 0x0, 0x0, 0x0, 112, ) == 0x0
 04245   436   NtRequestWaitReplyPort  (404, {128, 152, new_msg, 0, 1310720, 124944, 1310720, 1239376}  (404, {128, 152, new_msg, 0, 1310720, 124944, 1310720, 1239376} "\0$\370w\0\360\22\0\2$\370w\1kwEVY\205D\237\200\364(\367\326\1)\2\0\0\0\1\0\0\0\210\336\25\0\4\0\0\0\210\336\25\0\20\344\314w\210\336\25\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\1\0\20\0\0\245\25\0\350\263\25\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\5\0\0\0" ... {128, 152, reply, 0, 424, 436, 1567, 0} "\7$\370w\0\360\22\0\2$\370w\1kwEVY\205D\237\200\364(\367\326\1)\2\0\0\0\1\0\0\0\0\0\0\0\4\0\0\0\210\336\25\0\377\377\377\377\210\336\25\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\1\0\20\0\0\245\25\0\350\263\25\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\5\0\0\0" )  ... {128, 152, reply, 0, 424, 436, 1567, 0}  (404, {128, 152, new_msg, 0, 1310720, 124944, 1310720, 1239376} "\0$\370w\0\360\22\0\2$\370w\1kwEVY\205D\237\200\364(\367\326\1)\2\0\0\0\1\0\0\0\210\336\25\0\4\0\0\0\210\336\25\0\20\344\314w\210\336\25\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\1\0\20\0\0\245\25\0\350\263\25\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\5\0\0\0" ... {128, 152, reply, 0, 424, 436, 1567, 0} "\7$\370w\0\360\22\0\2$\370w\1kwEVY\205D\237\200\364(\367\326\1)\2\0\0\0\1\0\0\0\0\0\0\0\4\0\0\0\210\336\25\0\377\377\377\377\210\336\25\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\1\0\20\0\0\245\25\0\350\263\25\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\5\0\0\0" )  ) == 0x0
 04246   436   NtRequestWaitReplyPort  (404, {64, 88, new_msg, 0, 424, 436, 1564, 0}  (404, {64, 88, new_msg, 0, 424, 436, 1564, 0} "\1\213\0\0A\2\10\0B\271\325\371(\273\325\371\377\377\377\377\325\316\325\371\377\377\377\377\0\0\0\0\0\0\0\0\21\0\0\0\0\0\0\0\0\0\0\0\26\0\0\0s\0r\0v\00\01\0.\0" ... {52, 76, reply, 0, 424, 436, 1568, 0} "\2\213+\370\1\0+\370B\271\325\371(\273\325\371\377\377\377\377\325\316\325\371\13\353\325\371\0\0\0\0\200]\12\0\1\0\0\0\1\0\0\0\300\250|\201\377\377\377\0" )  ... {52, 76, reply, 0, 424, 436, 1568, 0}  (404, {64, 88, new_msg, 0, 424, 436, 1564, 0} "\1\213\0\0A\2\10\0B\271\325\371(\273\325\371\377\377\377\377\325\316\325\371\377\377\377\377\0\0\0\0\0\0\0\0\21\0\0\0\0\0\0\0\0\0\0\0\26\0\0\0s\0r\0v\00\01\0.\0" ... {52, 76, reply, 0, 424, 436, 1568, 0} "\2\213+\370\1\0+\370B\271\325\371(\273\325\371\377\377\377\377\325\316\325\371\13\353\325\371\0\0\0\0\200]\12\0\1\0\0\0\1\0\0\0\300\250|\201\377\377\377\0" )  ) == 0x0
 04247   436   NtClose  (376, ... ) == 0x0
 04248   436   NtClose  (404, ... ) == 0x0
 04249   436   NtCreateKey  (0x20019, {24, 48, 0x40, 0, 0,  (0x20019, {24, 48, 0x40, 0, 0, "System\CurrentControlSet\Services\Tcpip\Parameters"}, 0, "Class", 0, ... 404, 2, ) }, 0,  (0x20019, {24, 48, 0x40, 0, 0, "System\CurrentControlSet\Services\Tcpip\Parameters"}, 0, "Class", 0, ... 404, 2, ) , 0, ... 404, 2, ) == 0x0
 04250   436   NtOpenKey  (0x20019, {24, 48, 0x40, 0, 0,  (0x20019, {24, 48, 0x40, 0, 0, "System\CurrentControlSet\Services\DnsCache\Parameters"}, ... 376, ) }, ... 376, ) == 0x0
 04251   436   NtOpenKey  (0x20019, {24, 48, 0x40, 0, 0,  (0x20019, {24, 48, 0x40, 0, 0, "Software\Policies\Microsoft\Windows NT\DnsClient"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 04252   436   NtQueryValueKey  (404,  (404, "Hostname", Partial, 144, ... TitleIdx=0, Type=1, Data="M\0Y\0W\0O\0R\0L\0D\0\0\0"}, 28, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (404, "Hostname", Partial, 144, ... TitleIdx=0, Type=1, Data="M\0Y\0W\0O\0R\0L\0D\0\0\0"}, 28, ) }, 28, ) == 0x0
 04253   436   NtQueryValueKey  (404,  (404, "Hostname", Partial, 144, ... TitleIdx=0, Type=1, Data="M\0Y\0W\0O\0R\0L\0D\0\0\0"}, 28, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (404, "Hostname", Partial, 144, ... TitleIdx=0, Type=1, Data="M\0Y\0W\0O\0R\0L\0D\0\0\0"}, 28, ) }, 28, ) == 0x0
 04254   436   NtClose  (404, ... ) == 0x0
 04255   436   NtClose  (376, ... ) == 0x0
 04256   436   NtCreateKey  (0x20019, {24, 48, 0x40, 0, 0,  (0x20019, {24, 48, 0x40, 0, 0, "System\CurrentControlSet\Services\Tcpip\Parameters"}, 0, "Class", 0, ... 376, 2, ) }, 0,  (0x20019, {24, 48, 0x40, 0, 0, "System\CurrentControlSet\Services\Tcpip\Parameters"}, 0, "Class", 0, ... 376, 2, ) , 0, ... 376, 2, ) == 0x0
 04257   436   NtOpenKey  (0x20019, {24, 48, 0x40, 0, 0,  (0x20019, {24, 48, 0x40, 0, 0, "System\CurrentControlSet\Services\DnsCache\Parameters"}, ... 404, ) }, ... 404, ) == 0x0
 04258   436   NtOpenKey  (0x20019, {24, 48, 0x40, 0, 0,  (0x20019, {24, 48, 0x40, 0, 0, "Software\Policies\Microsoft\Windows NT\DnsClient"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 04259   436   NtQueryValueKey  (376,  (376, "Domain", Partial, 144, ... TitleIdx=0, Type=1, Data="\0\0"}, 14, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (376, "Domain", Partial, 144, ... TitleIdx=0, Type=1, Data="\0\0"}, 14, ) }, 14, ) == 0x0
 04260   436   NtQueryValueKey  (376,  (376, "Domain", Partial, 144, ... TitleIdx=0, Type=1, Data="\0\0"}, 14, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (376, "Domain", Partial, 144, ... TitleIdx=0, Type=1, Data="\0\0"}, 14, ) }, 14, ) == 0x0
 04261   436   NtClose  (376, ... ) == 0x0
 04262   436   NtClose  (404, ... ) == 0x0
 04263   436   NtWaitForSingleObject  (112, 0, {0, 0}, ... ) == 0x102
 04264   436   NtCreateEvent  (0x1f0003, 0x0, 1, 0, ... 404, ) == 0x0
 04265   436   NtConnectPort  ( ("\RPC Control\DNSResolver", {12, 2, 1, 1}, 0x0, 0x0, 1239412, 112, ... 376, 0x0, 0x0, 0x0, 112, ) , {12, 2, 1, 1}, 0x0, 0x0, 1239412, 112, ... 376, 0x0, 0x0, 0x0, 112, ) == 0x0
 04266   436   NtRequestWaitReplyPort  (376, {128, 152, new_msg, 0, 1310720, 124744, 1310720, 1239176}  (376, {128, 152, new_msg, 0, 1310720, 124744, 1310720, 1239176} "\0$\370w8\357\22\0\2$\370w\1kwEVY\205D\237\200\364(\367\326\1)\2\0\0\0\1\0\0\0\210\336\25\0\4\0\0\0\210\336\25\0\20\344\314w\210\336\25\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\1\0\21\0\0\245\25\0\360\264\25\0\0\0\0\0\370\353\22\0\250\353\22\0\230\355\22\0\0\0\0\0\0\0\25\0\377\377\377\377\365\26\365w\0\0\0\0\13\30\365w\5\0\0\0" ... {128, 152, reply, 0, 424, 436, 1571, 0} "\7$\370w8\357\22\0\2$\370w\1kwEVY\205D\237\200\364(\367\326\1)\2\0\0\0\1\0\0\0\0\0\0\0\4\0\0\0\210\336\25\0\377\377\377\377\210\336\25\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\1\0\21\0\0\245\25\0\360\264\25\0\0\0\0\0\370\353\22\0\250\353\22\0\230\355\22\0\0\0\0\0\0\0\25\0\377\377\377\377\365\26\365w\0\0\0\0\13\30\365w\5\0\0\0" )  ... {128, 152, reply, 0, 424, 436, 1571, 0}  (376, {128, 152, new_msg, 0, 1310720, 124744, 1310720, 1239176} "\0$\370w8\357\22\0\2$\370w\1kwEVY\205D\237\200\364(\367\326\1)\2\0\0\0\1\0\0\0\210\336\25\0\4\0\0\0\210\336\25\0\20\344\314w\210\336\25\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\1\0\21\0\0\245\25\0\360\264\25\0\0\0\0\0\370\353\22\0\250\353\22\0\230\355\22\0\0\0\0\0\0\0\25\0\377\377\377\377\365\26\365w\0\0\0\0\13\30\365w\5\0\0\0" ... {128, 152, reply, 0, 424, 436, 1571, 0} "\7$\370w8\357\22\0\2$\370w\1kwEVY\205D\237\200\364(\367\326\1)\2\0\0\0\1\0\0\0\0\0\0\0\4\0\0\0\210\336\25\0\377\377\377\377\210\336\25\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\1\0\21\0\0\245\25\0\360\264\25\0\0\0\0\0\370\353\22\0\250\353\22\0\230\355\22\0\0\0\0\0\0\0\25\0\377\377\377\377\365\26\365w\0\0\0\0\13\30\365w\5\0\0\0" )  ) == 0x0
 04267   436   NtRequestWaitReplyPort  (376, {64, 88, new_msg, 0, 424, 436, 1568, 0}  (376, {64, 88, new_msg, 0, 424, 436, 1568, 0} "\1\213\0\0A\2\10\0B\271\325\371(\273\325\371\377\377\377\377\325\316\325\371\377\377\377\377\0\0\0\0\0\0\0\0\21\0\0\0\0\0\0\0\0\0\0\0\377\377\377\0s\0r\0v\00\01\0.\0" ... {52, 76, reply, 0, 424, 436, 1572, 0} "\2\213+\370\1\0+\370B\271\325\371(\273\325\371\377\377\377\377\325\316\325\371\13\353\325\371\0\0\0\0\200]\12\0\1\0\0\0\1\0\0\0\300\250|\201\377\377\377\0" )  ... {52, 76, reply, 0, 424, 436, 1572, 0}  (376, {64, 88, new_msg, 0, 424, 436, 1568, 0} "\1\213\0\0A\2\10\0B\271\325\371(\273\325\371\377\377\377\377\325\316\325\371\377\377\377\377\0\0\0\0\0\0\0\0\21\0\0\0\0\0\0\0\0\0\0\0\377\377\377\0s\0r\0v\00\01\0.\0" ... {52, 76, reply, 0, 424, 436, 1572, 0} "\2\213+\370\1\0+\370B\271\325\371(\273\325\371\377\377\377\377\325\316\325\371\13\353\325\371\0\0\0\0\200]\12\0\1\0\0\0\1\0\0\0\300\250|\201\377\377\377\0" )  ) == 0x0
 04268   436   NtClose  (404, ... ) == 0x0
 04269   436   NtClose  (376, ... ) == 0x0
 04270   436   NtCreateKey  (0x20019, {24, 48, 0x40, 0, 0,  (0x20019, {24, 48, 0x40, 0, 0, "System\CurrentControlSet\Services\Tcpip\Parameters"}, 0, "Class", 0, ... 376, 2, ) }, 0,  (0x20019, {24, 48, 0x40, 0, 0, "System\CurrentControlSet\Services\Tcpip\Parameters"}, 0, "Class", 0, ... 376, 2, ) , 0, ... 376, 2, ) == 0x0
 04271   436   NtOpenKey  (0x20019, {24, 48, 0x40, 0, 0,  (0x20019, {24, 48, 0x40, 0, 0, "System\CurrentControlSet\Services\DnsCache\Parameters"}, ... 404, ) }, ... 404, ) == 0x0
 04272   436   NtOpenKey  (0x20019, {24, 48, 0x40, 0, 0,  (0x20019, {24, 48, 0x40, 0, 0, "Software\Policies\Microsoft\Windows NT\DnsClient"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 04273   436   NtQueryValueKey  (376,  (376, "Hostname", Partial, 144, ... TitleIdx=0, Type=1, Data="M\0Y\0W\0O\0R\0L\0D\0\0\0"}, 28, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (376, "Hostname", Partial, 144, ... TitleIdx=0, Type=1, Data="M\0Y\0W\0O\0R\0L\0D\0\0\0"}, 28, ) }, 28, ) == 0x0
 04274   436   NtQueryValueKey  (376,  (376, "Hostname", Partial, 144, ... TitleIdx=0, Type=1, Data="M\0Y\0W\0O\0R\0L\0D\0\0\0"}, 28, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (376, "Hostname", Partial, 144, ... TitleIdx=0, Type=1, Data="M\0Y\0W\0O\0R\0L\0D\0\0\0"}, 28, ) }, 28, ) == 0x0
 04275   436   NtClose  (376, ... ) == 0x0
 04276   436   NtClose  (404, ... ) == 0x0
 04277   436   NtCreateKey  (0x20019, {24, 48, 0x40, 0, 0,  (0x20019, {24, 48, 0x40, 0, 0, "System\CurrentControlSet\Services\Tcpip\Parameters"}, 0, "Class", 0, ... 404, 2, ) }, 0,  (0x20019, {24, 48, 0x40, 0, 0, "System\CurrentControlSet\Services\Tcpip\Parameters"}, 0, "Class", 0, ... 404, 2, ) , 0, ... 404, 2, ) == 0x0
 04278   436   NtOpenKey  (0x20019, {24, 48, 0x40, 0, 0,  (0x20019, {24, 48, 0x40, 0, 0, "System\CurrentControlSet\Services\DnsCache\Parameters"}, ... 376, ) }, ... 376, ) == 0x0
 04279   436   NtOpenKey  (0x20019, {24, 48, 0x40, 0, 0,  (0x20019, {24, 48, 0x40, 0, 0, "Software\Policies\Microsoft\Windows NT\DnsClient"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 04280   436   NtQueryValueKey  (404,  (404, "Domain", Partial, 144, ... TitleIdx=0, Type=1, Data="\0\0"}, 14, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (404, "Domain", Partial, 144, ... TitleIdx=0, Type=1, Data="\0\0"}, 14, ) }, 14, ) == 0x0
 04281   436   NtQueryValueKey  (404,  (404, "Domain", Partial, 144, ... TitleIdx=0, Type=1, Data="\0\0"}, 14, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (404, "Domain", Partial, 144, ... TitleIdx=0, Type=1, Data="\0\0"}, 14, ) }, 14, ) == 0x0
 04282   436   NtClose  (404, ... ) == 0x0
 04283   436   NtClose  (376, ... ) == 0x0
 04284   436   NtCreateFile  (0x3, {24, 0, 0x40, 0, 0,  (0x3, {24, 0, 0x40, 0, 0, "\Device\RasAcd"}, 0x0, 128, 3, 3, 0, 0, 0, ... 376, {status=0x0, info=0}, ) }, 0x0, 128, 3, 3, 0, 0, 0, ... 376, {status=0x0, info=0}, ) == 0x0
 04285   436   NtCreateEvent  (0x1f0003, 0x0, 1, 0, ... 404, ) == 0x0
 04286   436   NtDeviceIoControlFile  (376, 404, 0x0, 0x0, 0xf14014,  (376, 404, 0x0, 0x0, 0xf14014, "\3\0\0\0MYWORLD\0\231%\362v\2\0\0\200\330\304\362v\0\0\0\0\360\356\22\0O\345\367w{\30\335w\0\0\0\0\300.\24\0\0\0\24\0\200\23\25\0\0\0\0\0\0\360\22\0\277\37\365w\0\0\24\0\203 \365w\10\6\24\0\215\26\365w\0\0\0\0\260\27\25\0\260\31\25\0\24\232\347w\23\30\26\0\250\336\25\0\266\336\25\0\24\30\25\0\377\377\0\0\0\0\0\0\24\30\25\0\7\0\0\0\250\336\25\0\254\357\22\0\177;\245q\0\0\0\0\0\0\0\0\250\336\25\0\0\0\0\0\24\30\25\0\377\377\0\0\1\0\0\0\210\1\24\0\210\23\25\0\4\0\0\0\0\0\0\0\210\1\24\0\200\23\25\0\0\0\0\0\0\0\0\0\0\0\0\0\365<\245q\10\30\25\0\364\27\25\0\2\0\0\0\20\0\0\0\0\0\0\0\0\0\0\0\20\0\0\0\260\31\1\1\0\0\24\0D\357\22\0$\364\22\0\274\373\22\0\2$\370w\370T\367wa/\245q\2642\250q\0\0\0\0\0\0\0\0:/\245q\260\31\25\0\240\305\25\0\310\266\25\0\340\266\25\0\250\336\25\0\266\336\25\0\24\30\25\0\377\377\0\0\0\0\0\0\24\30\25\0\7\0\0\0\250\336\25\0t\360\22\0\177;\245q\0\0\0\0\0\0\0\0\250\336\25\0\0\0\0\0\24\30\25\0\377\377\0\0\1\0\0\0\210\1\24\0x\23\25\0\4\0\0\0\0\0\0\0\210\1\24\0p\23\25\0\0\0\0\0\0\0\0\0\0\0\0\0\365<\245q\10\30\25\0\364\27\25\0\2\0\0\0\20\0\0\0\0\0\0\0\0\0\0\0\20\0\0\0\30*\1\1\0\0\24\0\14\360\22\0\354\364\22\0\274\373\22\0\2$\370w\370T\367wa/\245q\2642\250q\0\0\0\0\0\0\0\0:/\245q\30*\25\0\340\260\25\0\310\266\25\0", 1552, 0, ... {status=0x0, info=0}, 0x0, ) , 1552, 0, ... {status=0x0, info=0}, 0x0, ) == 0x0
 04287   436   NtClose  (404, ... ) == 0x0
 04288   436   NtClose  (376, ... ) == 0x0
 04289   436   NtUserGetMessage  (0, 0, 0, ...
 04230   568   NtWaitForSingleObject  ... ) == 0x102
 04290   568   NtQuerySystemTime  (... {-1600616298, 29868087}, ) == 0x0
 04291   568   NtWaitForSingleObject  (140, 1, {-1, 2147483647}, ... ) == 0x0
 04292   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=161}, 0x0, ) , 16, 0, ... {status=0x0, info=161}, 0x0, ) == 0x0
 04293   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 04294   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 04295   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 04296   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 04297   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 04298   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 04299   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 04300   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 04301   568   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 04302   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 04303   568   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 04304   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 04305   568   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 04306   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 04307   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 04308   568   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 04309   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 04310   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 04311   568   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 04312   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 04313   568   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 04314   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 04315   568   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 04316   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 04317   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 04318   568   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 04319   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 04320   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 04321   568   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 04322   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 04323   568   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 04324   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 04325   568   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 04326   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 04327   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 04328   568   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 04329   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 04330   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 04331   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 04332   568   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 04333   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 04334   568   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 04335   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 04336   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 04337   568   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 04338   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 04339   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 04340   568   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 04341   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 04342   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 04343   568   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 04344   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 04345   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 04346   568   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 04347   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 04348   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 04349   568   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 04350   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 04351   568   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 04352   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 04353   568   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 04354   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 04355   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 04356   568   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 04357   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 04358   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 04359   568   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 04360   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 04361   568   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 04362   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 04363   568   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 04364   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 04365   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 04366   568   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 04367   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 04368   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 04369   568   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 04370   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 04371   568   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 04372   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 04373   568   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 04374   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 04375   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 04376   568   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 04377   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 04378   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 04379   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 04380   568   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 04381   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 04382   568   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 04383   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 04384   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 04385   568   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 04386   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 04387   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 04388   568   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 04389   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 04390   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 04391   568   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 04392   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 04393   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 04394   568   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 04395   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 04396   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 04397   568   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 04398   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 04399   568   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 04400   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 04401   568   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 04402   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 04403   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 04404   568   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 04405   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 04406   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 04407   568   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 04408   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 04409   568   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 04410   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 04411   568   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 04412   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 04413   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 04414   568   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 04415   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 04416   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 04417   568   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 04418   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 04419   568   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 04420   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 04421   568   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 04422   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 04423   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 04424   568   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 04425   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 04426   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 04427   568   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 04428   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 04429   568   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 04430   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 04431   568   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 04432   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 04433   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 04434   568   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 04435   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 04436   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 04437   568   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 04438   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 04439   568   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 04440   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 04441   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 04442   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 04443   568   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 04444   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 04445   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 04446   568   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 04447   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 04448   568   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 04449   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 04450   568   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 04451   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 04452   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 04453   568   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 04454   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 04455   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 04456   568   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 04457   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 04458   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 04459   568   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 04460   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 04461   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 04462   568   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 04463   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 04464   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 04465   568   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 04466   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 04467   568   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 04468   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 04469   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 04470   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 04471   568   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 04472   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 04473   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 04474   568   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 04475   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x103
 04476   568   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 04477   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 04478   568   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 04479   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 04480   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 04481   568   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 04482   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 04483   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 04484   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 04485   568   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 04486   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 04487   568   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 04488   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 04489   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 04490   568   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 04491   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 04492   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 04493   568   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 04494   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 04495   568   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 04496   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 04497   568   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 04498   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 04499   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 04500   568   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 04501   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 04502   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 04503   568   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 04504   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 04505   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 04506   568   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 04507   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 04508   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 04509   568   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 04510   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 04511   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 04512   568   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 04513   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 04514   568   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 04515   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 04516   568   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 04517   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 04518   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 04519   568   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 04520   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 04521   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 04522   568   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 04523   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 04524   568   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 04525   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 04526   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 04527   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 04528   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 04529   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 04530   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 04531   568   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 04532   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 04533   568   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 04534   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 04535   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 04536   568   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 04537   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 04538   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 04539   568   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 04540   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 04541   568   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 04542   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 04543   568   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 04544   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 04545   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 04546   568   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 04547   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 04548   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 04549   568   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 04550   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 04551   568   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 04552   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 04553   568   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 04554   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 04555   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 04556   568   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 04557   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 04558   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 04559   568   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 04560   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 04561   568   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 04562   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 04563   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 04564   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 04565   568   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 04566   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 04567   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 04568   568   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 04569   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 04570   568   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 04571   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 04572   568   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 04573   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 04574   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 04575   568   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 04576   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 04577   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 04578   568   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 04579   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 04580   568   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 04581   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 04582   568   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 04583   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 04584   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 04585   568   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 04586   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 04587   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 04588   568   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 04589   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 04590   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 04591   568   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 04592   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 04593   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 04594   568   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 04595   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 04596   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 04597   568   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 04598   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 04599   568   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 04600   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 04601   568   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 04602   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 04603   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 04604   568   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 04605   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 04606   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 04607   568   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 04608   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 04609   568   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 04610   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 04611   568   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 04612   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 04613   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 04614   568   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 04615   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 04616   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 04617   568   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 04618   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 04619   568   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 04620   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 04621   568   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 04622   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 04623   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 04624   568   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 04625   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 04626   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 04627   568   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 04628   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 04629   568   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 04630   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 04631   568   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 04632   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 04633   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 04634   568   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 04635   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 04636   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 04637   568   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 04638   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 04639   568   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 04640   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 04641   568   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 04642   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 04643   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 04644   568   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 04645   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 04646   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 04647   568   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 04648   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 04649   568   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 04650   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 04651   568   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 04652   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 04653   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 04654   568   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 04655   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 04656   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 04657   568   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 04658   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 04659   568   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 04660   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 04661   568   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 04662   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 04663   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 04664   568   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 04665   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 04666   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 04667   568   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 04668   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 04669   568   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 04670   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 04671   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 04672   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 04673   568   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 04674   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 04675   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 04676   568   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 04677   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 04678   568   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 04679   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 04680   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 04681   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 04682   568   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 04683   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 04684   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 04685   568   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 04686   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 04687   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 04688   568   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 04689   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 04690   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 04691   568   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 04692   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 04693   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 04694   568   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 04695   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 04696   568   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 04697   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 04698   568   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 04699   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 04700   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 04701   568   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 04702   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 04703   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 04704   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 04705   568   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 04706   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 04707   568   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 04708   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 04709   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 04710   568   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 04711   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 04712   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 04713   568   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 04714   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 04715   568   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 04716   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 04717   568   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 04718   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 04719   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 04720   568   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 04721   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 04722   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 04723   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 04724   568   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 04725   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 04726   568   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 04727   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 04728   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 04729   568   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 04730   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 04731   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 04732   568   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 04733   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 04734   568   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 04735   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 04736   568   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 04737   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 04738   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 04739   568   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 04740   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 04741   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 04742   568   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 04743   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 04744   568   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 04745   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 04746   568   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 04747   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 04748   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 04749   568   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 04750   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 04751   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 04752   568   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 04753   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 04754   568   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 04755   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 04756   568   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 04757   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 04758   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 04759   568   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 04760   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 04761   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 04762   568   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 04763   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 04764   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 04765   568   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 04766   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 04767   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 04768   568   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 04769   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 04770   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 04771   568   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 04772   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 04773   568   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 04774   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 04775   568   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 04776   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 04777   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 04778   568   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 04779   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 04780   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 04781   568   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 04782   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 04783   568   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 04784   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 04785   568   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 04786   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 04787   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 04788   568   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 04789   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 04790   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 04791   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 04792   568   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 04793   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 04794   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 04795   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 04796   568   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 04797   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 04798   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 04799   568   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 04800   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 04801   568   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 04802   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 04803   568   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 04804   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 04805   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 04806   568   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 04807   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 04808   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 04809   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 04810   568   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 04811   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 04812   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 04813   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 04814   568   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 04815   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 04816   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 04817   568   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 04818   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 04819   568   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 04820   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 04821   568   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 04822   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 04823   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 04824   568   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 04825   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 04826   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 04827   568   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 04828   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 04829   568   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 04830   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 04831   568   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 04832   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 04833   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 04834   568   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 04835   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 04836   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 04837   568   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 04838   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 04839   568   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 04840   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 04841   568   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 04842   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 04843   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 04844   568   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 04845   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 04846   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 04847   568   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 04848   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 04849   568   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 04850   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 04851   568   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 04852   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 04853   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 04854   568   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 04855   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 04856   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 04857   568   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 04858   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 04859   568   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 04860   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 04861   568   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 04862   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 04863   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 04864   568   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 04865   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 04866   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 04867   568   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 04868   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 04869   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 04870   568   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 04871   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 04872   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 04873   568   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 04874   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 04875   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 04876   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 04877   568   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 04878   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 04879   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 04880   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 04881   568   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 04882   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 04883   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 04884   568   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 04885   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 04886   568   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 04887   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 04888   568   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 04889   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 04890   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 04891   568   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 04892   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 04893   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 04894   568   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 04895   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 04896   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 04897   568   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 04898   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 04899   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 04900   568   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 04901   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 04902   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 04903   568   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 04904   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 04905   568   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 04906   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 04907   568   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 04908   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 04909   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 04910   568   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 04911   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 04912   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 04913   568   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 04914   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 04915   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 04916   568   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 04917   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 04918   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 04919   568   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 04920   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 04921   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 04922   568   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 04923   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103
 04924   568   NtWaitForSingleObject  (140, 1, {-5000000, -1}, ... ) == 0x0
 04925   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 04926   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x0, info=91}, 0x0, ) , 16, 0, ... {status=0x0, info=91}, 0x0, ) == 0x0
 04927   568   NtDeviceIoControlFile  (144, 140, 0x0, 0x0, 0x12017,  (144, 140, 0x0, 0x0, 0x12017, "\240\372\237\0\1\0\0\0\0\0\0\0 \0\0\0", 16, 0, ... {status=0x103, info=91}, 0x0, ) , 16, 0, ... {status=0x103, info=91}, 0x0, ) == 0x103