Summary:


NtAddAtom(>) 
 1 
NtCreateIoCompletion(>) 
 2 
NtDuplicateObject(>) 
 5 
NtCreateEvent(>) 
 27 

NtAdjustPrivilegesToken(>) 
 1 
NtDuplicateToken(>) 
 2 
NtGdiGetStockObject(>) 
 5 
NtOpenProcessTokenEx(>) 
 28 

NtCallbackReturn(>) 
 1 
NtGdiCreateSolidBrush(>) 
 2 
NtQueryDirectoryFile(>) 
 7 
NtOpenThreadTokenEx(>) 
 28 

NtConnectPort(>) 
 1 
NtOpenDirectoryObject(>) 
 2 
NtQueryVolumeInformationFile(>) 
 7 
NtSetInformationFile(>) 
 30 

NtCreateMutant(>) 
 1 
NtOpenSymbolicLinkObject(>) 
 2 
NtCreateKey(>) 
 8 
NtCreateSection(>) 
 31 

NtCreateProcessEx(>) 
 1 
NtQuerySymbolicLinkObject(>) 
 2 
NtOpenMutant(>) 
 8 
NtFreeVirtualMemory(>) 
 31 

NtEnumerateValueKey(>) 
 1 
NtReadVirtualMemory(>) 
 2 
NtOpenThreadToken(>) 
 8 
NtOpenProcess(>) 
 31 

NtGdiCreateBitmap(>) 
 1 
NtRegisterThreadTerminatePort(>) 
 2 
NtSetEvent(>) 
 8 
NtQuerySystemInformation(>) 
 31 

NtGdiInit(>) 
 1 
NtSetEventBoostPriority(>) 
 2 
NtCreateSemaphore(>) 
 9 
NtQueryInformationToken(>) 
 34 

NtGdiQueryFontAssocInfo(>) 
 1 
NtTestAlert(>) 
 2 
NtOpenProcessToken(>) 
 9 
NtUserGetAtomName(>) 
 47 

NtGdiSelectBitmap(>) 
 1 
NtUserQueryWindow(>) 
 2 
NtSetInformationProcess(>) 
 9 
NtUserUnregisterClass(>) 
 47 

NtOpenEvent(>) 
 1 
NtClearEvent(>) 
 3 
NtQueryDefaultUILanguage(>) 
 10 
NtUserFindExistingCursorIcon(>) 
 50 

NtOpenKeyedEvent(>) 
 1 
NtCreateThread(>) 
 3 
NtReleaseMutant(>) 
 10 
NtUnmapViewOfSection(>) 
 55 

NtQueryEvent(>) 
 1 
NtDelayExecution(>) 
 3 
NtSetInformationThread(>) 
 10 
NtQueryVirtualMemory(>) 
 57 

NtQueryInformationJobObject(>) 
 1 
NtGdiCreateCompatibleDC(>) 
 3 
NtUserSystemParametersInfo(>) 
 11 
NtOpenFile(>) 
 59 

NtQueryInformationThread(>) 
 1 
NtNotifyChangeKey(>) 
 3 
NtEnumerateKey(>) 
 12 
NtUserRegisterClassExWOW(>) 
 61 

NtQueryInstallUILanguage(>) 
 1 
NtQueryPerformanceCounter(>) 
 3 
NtQuerySection(>) 
 13 
NtOpenSection(>) 
 64 

NtQueryObject(>) 
 1 
NtReleaseSemaphore(>) 
 3 
NtRequestWaitReplyPort(>) 
 13 
NtQueryAttributesFile(>) 
 87 

NtQuerySystemTime(>) 
 1 
NtResumeThread(>) 
 3 
NtDeviceIoControlFile(>) 
 16 
NtFlushInstructionCache(>) 
 95 

NtReadFile(>) 
 1 
NtSetInformationObject(>) 
 3 
NtQueryDebugFilterState(>) 
 17 
NtMapViewOfSection(>) 
 120 

NtSecureConnectPort(>) 
 1 
NtSetValueKey(>) 
 3 
NtQueryDefaultLocale(>) 
 17 
NtWriteVirtualMemory(>) 
 124 

NtUserCallNoParam(>) 
 1 
NtTerminateProcess(>) 
 3 
NtUserRegisterWindowMessage(>) 
 18 
NtAllocateVirtualMemory(>) 
 127 

NtUserCallOneParam(>) 
 1 
NtWaitForMultipleObjects(>) 
 3 
NtWaitForSingleObject(>) 
 20 
NtOpenKey(>) 
 287 

NtUserGetDC(>) 
 1 
NtWriteFile(>) 
 3 
NtQueryInformationProcess(>) 
 23 
NtProtectVirtualMemory(>) 
 319 

NtUserGetThreadDesktop(>) 
 1 
NtFsControlFile(>) 
 4 
NtCreateFile(>) 
 24 
NtQueryValueKey(>) 
 367 

NtContinue(>) 
 2 
NtAccessCheck(>) 
 5 
NtQueryInformationFile(>) 
 24 
NtClose(>) 
 390 


Trace:
 00001   868   NtOpenFile  (0x80100000, {24, 0, 0x240, 0, 0,  (0x80100000, {24, 0, 0x240, 0, 0, "\SystemRoot\Prefetch\PACKED.EXE-09ED06A1.pf"}, 0, 32, ... ) }, 0, 32, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00002   868   NtOpenKey  (0x80000000, {24, 0, 0x40, 0, 0,  (0x80000000, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\packed.exe"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00003   868   NtOpenKeyedEvent  (0x2000000, {24, 0, 0x0, 0, 0,  (0x2000000, {24, 0, 0x0, 0, 0, "\KernelObjects\CritSecOutOfMemoryEvent"}, ... 4, ) }, ... 4, ) == 0x0
 00004   868   NtQuerySystemInformation  (Basic, 44, ... {Unknown=0,MaximumIncrement=156250,PhysicalPageSize=0x1000,NumberOfPhysicalPages=0xff7c,LowestPhysicalPage=0x1,HighestPhysicalPage=0xffff,AllocationGranularity=0x10000,LowestUserAddress=0x10000,HighestUserAddress=0x7ffeffff,ActiveProcessors=1,NumberProcessors=1,}, 0x0, ) == 0x0
 00005   868   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ... 1310720, 1048576, ) == 0x0
 00006   868   NtAllocateVirtualMemory  (-1, 1310720, 0, 4096, 4096, 4, ... 1310720, 4096, ) == 0x0
 00007   868   NtAllocateVirtualMemory  (-1, 1314816, 0, 8192, 4096, 4, ... 1314816, 8192, ) == 0x0
 00008   868   NtQuerySystemInformation  (Basic, 44, ... {Unknown=0,MaximumIncrement=156250,PhysicalPageSize=0x1000,NumberOfPhysicalPages=0xff7c,LowestPhysicalPage=0x1,HighestPhysicalPage=0xffff,AllocationGranularity=0x10000,LowestUserAddress=0x10000,HighestUserAddress=0x7ffeffff,ActiveProcessors=1,NumberProcessors=1,}, 0x0, ) == 0x0
 00009   868   NtAllocateVirtualMemory  (-1, 0, 0, 65536, 8192, 4, ... 2359296, 65536, ) == 0x0
 00010   868   NtAllocateVirtualMemory  (-1, 2359296, 0, 24576, 4096, 4, ... 2359296, 24576, ) == 0x0
 00011   868   NtOpenDirectoryObject  (0x3, {24, 0, 0x40, 0, 0,  (0x3, {24, 0, 0x40, 0, 0, "\KnownDlls"}, ... 8, ) }, ... 8, ) == 0x0
 00012   868   NtOpenSymbolicLinkObject  (0x1, {24, 8, 0x40, 0, 0,  (0x1, {24, 8, 0x40, 0, 0, "KnownDllPath"}, ... 12, ) }, ... 12, ) == 0x0
 00013   868   NtQuerySymbolicLinkObject  (12, ...  (12, ... "C:\WINDOWS\system32", 0x0, ) , 0x0, ) == 0x0
 00014   868   NtClose  (12, ... ) == 0x0
 00015   868   NtOpenFile  (0x100020, {24, 0, 0x42, 0, 0,  (0x100020, {24, 0, 0x42, 0, 0, "\??\C:\scripts\"}, 3, 33, ... 12, {status=0x0, info=1}, ) }, 3, 33, ... 12, {status=0x0, info=1}, ) == 0x0
 00016   868   NtQueryVolumeInformationFile  (12, 1243852, 8, Device, ... {status=0x0, info=8}, ) == 0x0
 00017   868   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\u:\work\packed.exe.Local"}, 1243804, ... ) }, 1243804, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00018   868   NtOpenSection  (0xe, {24, 8, 0x40, 0, 0,  (0xe, {24, 8, 0x40, 0, 0, "kernel32.dll"}, ... 16, ) }, ... 16, ) == 0x0
 00019   868   NtMapViewOfSection  (16, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x7c800000), 0x0, 1003520, ) == 0x0
 00020   868   NtClose  (16, ... ) == 0x0
 00021   868   NtProtectVirtualMemory  (-1, (0x7c801000), 1568, 4, ... (0x7c801000), 4096, 32, ) == 0x0
 00022   868   NtProtectVirtualMemory  (-1, (0x7c801000), 4096, 32, ... (0x7c801000), 4096, 4, ) == 0x0
 00023   868   NtFlushInstructionCache  (-1, 2088767488, 1568, ... ) == 0x0
 00024   868   NtQueryInformationProcess  (-1, 36, 4, ... {process info, class 36, size 4}, 0x0, ) == 0x0
 00025   868   NtQuerySystemInformation  (RangeStart, 4, ... {system info, class 50, size 4}, 0x0, ) == 0x0
 00026   868   NtQuerySystemInformation  (Basic, 44, ... {Unknown=0,MaximumIncrement=156250,PhysicalPageSize=0x1000,NumberOfPhysicalPages=0xff7c,LowestPhysicalPage=0x1,HighestPhysicalPage=0xffff,AllocationGranularity=0x10000,LowestUserAddress=0x10000,HighestUserAddress=0x7ffeffff,ActiveProcessors=1,NumberProcessors=1,}, 0x0, ) == 0x0
 00027   868   NtCreateSection  (0xf001f, 0x0, {65536, 0}, 4, 67108864, 0, ... 16, ) == 0x0
 00028   868   NtSecureConnectPort  ( ("\Windows\ApiPort", {0, 2, 1, 1}, {24, 16, 0, 65536, 0, 0}, 1319736, {12, 0, 0}, 1241944, 44, ... 24, {24, 16, 0, 65536, 2424832, 18415616}, {0, 0, 0}, 200, 44, ) , {0, 2, 1, 1}, {24, 16, 0, 65536, 0, 0}, 1319736, {12, 0, 0}, 1241944, 44, ... 24, {24, 16, 0, 65536, 2424832, 18415616}, {0, 0, 0}, 200, 44, ) == 0x0
 00029   868   NtClose  (16, ... ) == 0x0
 00030   868   NtQueryObject  (24, Handle, 2, ... {Inherit=0,ProtectFromClose=0,}, -1, ) == 0x0
 00031   868   NtSetInformationObject  (24, Handle, {Inherit=0,ProtectFromClose=1,}, 256, ... ) == 0x0
 00032   868   NtQuerySystemInformation  (Basic, 44, ... {Unknown=0,MaximumIncrement=156250,PhysicalPageSize=0x1000,NumberOfPhysicalPages=0xff7c,LowestPhysicalPage=0x1,HighestPhysicalPage=0xffff,AllocationGranularity=0x10000,LowestUserAddress=0x10000,HighestUserAddress=0x7ffeffff,ActiveProcessors=1,NumberProcessors=1,}, 0x0, ) == 0x0
 00033   868   NtQueryVirtualMemory  (-1, 0x250000, Basic, 28, ... {BaseAddress=0x250000,AllocationBase=0x250000,AllocationProtect=0x4,RegionSize=0x10000,State=0x2000,Protect=0x0,Type=0x40000,}, 0x0, ) == 0x0
 00034   868   NtAllocateVirtualMemory  (-1, 2424832, 0, 4096, 4096, 4, ... 2424832, 4096, ) == 0x0
 00035   868   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1242260, 1242460, 2089900544, 1242184}  (24, {28, 56, new_msg, 0, 1242260, 1242460, 2089900544, 1242184} "\210\6\31\1\0\0\0\0eZ\221|\0\0\0\0\1\0\0\0\234\6\31\1\4\0\0\0" ... {28, 56, reply, 0, 1228, 868, 57932, 0} "`\375\27\0\0\0\0\0\0\0\0\0\0\0\0\0\1\0\0\0\234\6\31\1\4\0\0\0" )  ... {28, 56, reply, 0, 1228, 868, 57932, 0}  (24, {28, 56, new_msg, 0, 1242260, 1242460, 2089900544, 1242184} "\210\6\31\1\0\0\0\0eZ\221|\0\0\0\0\1\0\0\0\234\6\31\1\4\0\0\0" ... {28, 56, reply, 0, 1228, 868, 57932, 0} "`\375\27\0\0\0\0\0\0\0\0\0\0\0\0\0\1\0\0\0\234\6\31\1\4\0\0\0" )  ) == 0x0
 00036   868   NtRegisterThreadTerminatePort  (24, ... ) == 0x0
 00037   868   NtAllocateVirtualMemory  (-1, 1232896, 0, 4096, 4096, 260, ... 1232896, 4096, ) == 0x0
 00038   868   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\System\CurrentControlSet\Control\Terminal Server"}, ... 16, ) }, ... 16, ) == 0x0
 00039   868   NtQueryValueKey  (16,  (16, "TSAppCompat", Partial, 548, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) , Partial, 548, ... TitleIdx=0, Type=4, Data= (16, "TSAppCompat", Partial, 548, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) }, 16, ) == 0x0
 00040   868   NtClose  (16, ... ) == 0x0
 00041   868   NtOpenSection  (0x4, {24, 0, 0x40, 0, 0,  (0x4, {24, 0, 0x40, 0, 0, "\NLS\NlsSectionUnicode"}, ... 16, ) }, ... 16, ) == 0x0
 00042   868   NtMapViewOfSection  (16, -1, (0x0), 0, 0, 0x0, 0, 2, 0, 2, ... (0x260000), 0x0, 90112, ) == 0x0
 00043   868   NtClose  (16, ... ) == 0x0
 00044   868   NtQueryDefaultLocale  (0, 2089305000, ... ) == 0x0
 00045   868   NtOpenSection  (0x4, {24, 0, 0x40, 0, 0,  (0x4, {24, 0, 0x40, 0, 0, "\NLS\NlsSectionLocale"}, ... 16, ) }, ... 16, ) == 0x0
 00046   868   NtMapViewOfSection  (16, -1, (0x0), 0, 0, 0x0, 0, 2, 0, 2, ... (0x280000), 0x0, 249856, ) == 0x0
 00047   868   NtClose  (16, ... ) == 0x0
 00048   868   NtOpenSection  (0x5, {24, 0, 0x40, 0, 0,  (0x5, {24, 0, 0x40, 0, 0, "\NLS\NlsSectionSortkey"}, ... 16, ) }, ... 16, ) == 0x0
 00049   868   NtMapViewOfSection  (16, -1, (0x0), 0, 0, 0x0, 0, 2, 0, 2, ... (0x2c0000), 0x0, 266240, ) == 0x0
 00050   868   NtQuerySection  (16, Basic, 16, ... {BaseAddress=0x0,Attributes=0x800000,Size={0x40004, 0x0},}, 0x0, ) == 0x0
 00051   868   NtClose  (16, ... ) == 0x0
 00052   868   NtOpenSection  (0x4, {24, 0, 0x40, 0, 0,  (0x4, {24, 0, 0x40, 0, 0, "\NLS\NlsSectionSortTbls"}, ... 16, ) }, ... 16, ) == 0x0
 00053   868   NtMapViewOfSection  (16, -1, (0x0), 0, 0, 0x0, 0, 2, 0, 2, ... (0x310000), 0x0, 24576, ) == 0x0
 00054   868   NtClose  (16, ... ) == 0x0
 00055   868   NtQueryVirtualMemory  (-1, 0x7ffd2000, Basic, 28, ... {BaseAddress=0x7ffd2000,AllocationBase=0x7ffb0000,AllocationProtect=0x2,RegionSize=0x2000,State=0x1000,Protect=0x2,Type=0x40000,}, 0x0, ) == 0x0
 00056   868   NtOpenSection  (0x4, {24, 0, 0x40, 0, 0,  (0x4, {24, 0, 0x40, 0, 0, "\NLS\NlsSectionSortkey00000409"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00057   868   NtOpenSection  (0x4, {24, 0, 0x40, 0, 0,  (0x4, {24, 0, 0x40, 0, 0, "\NLS\NlsSectionSortkey00000409"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00058   868   NtAllocateVirtualMemory  (-1, 2428928, 0, 8192, 4096, 4, ... 2428928, 8192, ) == 0x0
 00059   868   NtRequestWaitReplyPort  (24, {24, 52, new_msg, 0, 7012468, 7929957, 3145776, 3145776}  (24, {24, 52, new_msg, 0, 7012468, 7929957, 3145776, 3145776} "\210\6\31\1\36\0\1\0\0\0\0\0\377\377\377\377\234\6\31\1p\30\0\0" ... {24, 52, reply, 0, 1228, 868, 57933, 0} "\10P\30\0\36\0\1\0\0\0\0\0\377\377\377\377\234\6\31\1p\30\0\0" )  ... {24, 52, reply, 0, 1228, 868, 57933, 0}  (24, {24, 52, new_msg, 0, 7012468, 7929957, 3145776, 3145776} "\210\6\31\1\36\0\1\0\0\0\0\0\377\377\377\377\234\6\31\1p\30\0\0" ... {24, 52, reply, 0, 1228, 868, 57933, 0} "\10P\30\0\36\0\1\0\0\0\0\0\377\377\377\377\234\6\31\1p\30\0\0" )  ) == 0x0
 00060   868   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 2089305760, 2090321376, 0, 0}  (24, {28, 56, new_msg, 0, 2089305760, 2090321376, 0, 0} "\210\6\31\1\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\234\6\31\18\6\0\0" ... {28, 56, reply, 0, 1228, 868, 57934, 0} "\250\202\26\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\234\6\31\18\6\0\0" )  ... {28, 56, reply, 0, 1228, 868, 57934, 0}  (24, {28, 56, new_msg, 0, 2089305760, 2090321376, 0, 0} "\210\6\31\1\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\234\6\31\18\6\0\0" ... {28, 56, reply, 0, 1228, 868, 57934, 0} "\250\202\26\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\234\6\31\18\6\0\0" )  ) == 0x0
 00061   868   NtProtectVirtualMemory  (-1, (0x47c000), 36864, 4, ... (0x47c000), 36864, 128, ) == 0x0
 00062   868   NtProtectVirtualMemory  (-1, (0x47c000), 36864, 128, ... (0x47c000), 36864, 4, ) == 0x0
 00063   868   NtFlushInstructionCache  (-1, 4702208, 36864, ... ) == 0x0
 00064   868   NtQueryInformationProcess  (-1, 37, 48, ... {process info, class 37, size 48}, 0x0, ) == 0x0
 00065   868   NtSetInformationProcess  (-1, 34, {process info, class 34, size 4}, 4, ... ) == 0x0
 00066   868   NtOpenProcessToken  (-1, 0x8, ... 16, ) == 0x0
 00067   868   NtQueryInformationToken  (16, Statistics, 56, ... {token info, class 10, size 56}, 56, ) == 0x0
 00068   868   NtClose  (16, ... ) == 0x0
 00069   868   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\System\CurrentControlSet\Control\Terminal Server"}, ... 16, ) }, ... 16, ) == 0x0
 00070   868   NtQueryValueKey  (16,  (16, "TSAppCompat", Partial, 548, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) , Partial, 548, ... TitleIdx=0, Type=4, Data= (16, "TSAppCompat", Partial, 548, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) }, 16, ) == 0x0
 00071   868   NtClose  (16, ... ) == 0x0
 00072   868   NtTestAlert  (... ) == 0x0
 00073   868   NtContinue  (1244464, 1, ...
 00074   868   NtSetInformationThread  (-2, Win32StartAddress(LpcReceivedMessageId), {StartAddress(LpcReceivedMsgId)=0x47c5f4,}, 4, ... ) == 0x0
 00075   868   NtOpenKey  (0x1, {24, 0, 0x40, 0, 0,  (0x1, {24, 0, 0x40, 0, 0, "\Registry\MACHINE\System\CurrentControlSet\Control\Session Manager"}, ... 16, ) }, ... 16, ) == 0x0
 00076   868   NtQueryValueKey  (16,  (16, "SafeDllSearchMode", Partial, 16, ... ) , Partial, 16, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00077   868   NtClose  (16, ... ) == 0x0
 00078   868   NtAllocateVirtualMemory  (-1, 1323008, 0, 4096, 4096, 4, ... 1323008, 4096, ) == 0x0
 00079   868   NtOpenSection  (0xe, {24, 8, 0x40, 0, 0,  (0xe, {24, 8, 0x40, 0, 0, ".dll"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00080   868   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\u:\work\.dll"}, 1242980, ... ) }, 1242980, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00081   868   NtFsControlFile  (12, 0, 0x0, 0x0, 0x90028, 0x0, 0, 0, ... {status=0x0, info=0}, 0x0, ) == 0x0
 00082   868   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\.dll"}, 1242980, ... ) }, 1242980, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00083   868   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system\.dll"}, 1242980, ... ) }, 1242980, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00084   868   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\.dll"}, 1242980, ... ) }, 1242980, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00085   868   NtQueryAttributesFile  ({24, 12, 0x40, 0, 0,  ({24, 12, 0x40, 0, 0, ".dll"}, 1242980, ... ) }, 1242980, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00086   868   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDDK\3790~1.183\bin\x86\.dll"}, 1242980, ... ) }, 1242980, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00087   868   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDDK\3790~1.183\bin\.dll"}, 1242980, ... ) }, 1242980, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00088   868   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDDK\3790~1.183\bin\x86\drvfast\scripts\.dll"}, 1242980, ... ) }, 1242980, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00089   868   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\Perl\site\bin\.dll"}, 1242980, ... ) }, 1242980, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00090   868   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\Perl\bin\.dll"}, 1242980, ... ) }, 1242980, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00091   868   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\.dll"}, 1242980, ... ) }, 1242980, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00092   868   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\.dll"}, 1242980, ... ) }, 1242980, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00093   868   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\System32\Wbem\.dll"}, 1242980, ... ) }, 1242980, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00094   868   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\kktools\.dll"}, 1242980, ... ) }, 1242980, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00095   868   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\Program Files\Microsoft Visual Studio\Common\Tools\WinNT\.dll"}, 1242980, ... ) }, 1242980, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00096   868   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\Program Files\Microsoft Visual Studio\Common\MSDev98\Bin\.dll"}, 1242980, ... ) }, 1242980, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00097   868   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\Program Files\Microsoft Visual Studio\Common\Tools\.dll"}, 1242980, ... ) }, 1242980, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00098   868   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\Program Files\Microsoft Visual Studio\VC98\bin\.dll"}, 1242980, ... ) }, 1242980, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00099   868   NtOpenDirectoryObject  (0x2000f, {24, 0, 0x40, 0, 0,  (0x2000f, {24, 0, 0x40, 0, 0, "\BaseNamedObjects"}, ... 16, ) }, ... 16, ) == 0x0
 00100   868   NtCreateEvent  (0x1f0003, {24, 16, 0x80, 1245092, 0,  (0x1f0003, {24, 16, 0x80, 1245092, 0, "VT_3"}, 1, 0, ... 28, ) }, 1, 0, ... 28, ) == 0x0
 00101   868   NtCreateSection  (0xe, {24, 0, 0x40, 1245092, 0,  (0xe, {24, 0, 0x40, 1245092, 0, "\BaseNamedObjects\W32_Virtu"}, {27086, 0}, 64, 134217728, 0, ... 32, ) }, {27086, 0}, 64, 134217728, 0, ... 32, ) == 0x0
 00102   868   NtMapViewOfSection  (32, -1, (0x0), 0, 27086, 0x0, 27086, 2, 0, 64, ... (0x320000), 0x0, 28672, ) == 0x0
 00103   868   NtOpenSection  (0xe, {24, 8, 0x40, 0, 0,  (0xe, {24, 8, 0x40, 0, 0, "ADVAPI32.DLL"}, ... 36, ) }, ... 36, ) == 0x0
 00104   868   NtMapViewOfSection  (36, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x77dd0000), 0x0, 634880, ) == 0x0
 00105   868   NtClose  (36, ... ) == 0x0
 00106   868   NtProtectVirtualMemory  (-1, (0x77dd1000), 1700, 4, ... (0x77dd1000), 4096, 32, ) == 0x0
 00107   868   NtProtectVirtualMemory  (-1, (0x77dd1000), 4096, 32, ... (0x77dd1000), 4096, 4, ) == 0x0
 00108   868   NtFlushInstructionCache  (-1, 2010976256, 1700, ... ) == 0x0
 00109   868   NtOpenSection  (0xe, {24, 8, 0x40, 0, 0,  (0xe, {24, 8, 0x40, 0, 0, "RPCRT4.dll"}, ... 36, ) }, ... 36, ) == 0x0
 00110   868   NtMapViewOfSection  (36, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x77e70000), 0x0, 593920, ) == 0x0
 00111   868   NtClose  (36, ... ) == 0x0
 00112   868   NtProtectVirtualMemory  (-1, (0x77e71000), 868, 4, ... (0x77e71000), 4096, 32, ) == 0x0
 00113   868   NtProtectVirtualMemory  (-1, (0x77e71000), 4096, 32, ... (0x77e71000), 4096, 4, ) == 0x0
 00114   868   NtFlushInstructionCache  (-1, 2011631616, 868, ... ) == 0x0
 00115   868   NtProtectVirtualMemory  (-1, (0x77e71000), 868, 4, ... (0x77e71000), 4096, 32, ) == 0x0
 00116   868   NtProtectVirtualMemory  (-1, (0x77e71000), 4096, 32, ... (0x77e71000), 4096, 4, ) == 0x0
 00117   868   NtFlushInstructionCache  (-1, 2011631616, 868, ... ) == 0x0
 00118   868   NtProtectVirtualMemory  (-1, (0x77e71000), 868, 4, ... (0x77e71000), 4096, 32, ) == 0x0
 00119   868   NtProtectVirtualMemory  (-1, (0x77e71000), 4096, 32, ... (0x77e71000), 4096, 4, ) == 0x0
 00120   868   NtFlushInstructionCache  (-1, 2011631616, 868, ... ) == 0x0
 00121   868   NtProtectVirtualMemory  (-1, (0x77dd1000), 1700, 4, ... (0x77dd1000), 4096, 32, ) == 0x0
 00122   868   NtProtectVirtualMemory  (-1, (0x77dd1000), 4096, 32, ... (0x77dd1000), 4096, 4, ) == 0x0
 00123   868   NtFlushInstructionCache  (-1, 2010976256, 1700, ... ) == 0x0
 00124   868   NtOpenKey  (0x80000000, {24, 0, 0x40, 0, 0,  (0x80000000, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RPCRT4.dll"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00125   868   NtAllocateVirtualMemory  (-1, 1327104, 0, 4096, 4096, 4, ... 1327104, 4096, ) == 0x0
 00126   868   NtOpenKey  (0x80000000, {24, 0, 0x40, 0, 0,  (0x80000000, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ADVAPI32.DLL"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00127   868   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\System\CurrentControlSet\Control\Terminal Server"}, ... 36, ) }, ... 36, ) == 0x0
 00128   868   NtQueryValueKey  (36,  (36, "TSAppCompat", Partial, 548, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) , Partial, 548, ... TitleIdx=0, Type=4, Data= (36, "TSAppCompat", Partial, 548, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) }, 16, ) == 0x0
 00129   868   NtQueryValueKey  (36,  (36, "TSUserEnabled", Partial, 548, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) , Partial, 548, ... TitleIdx=0, Type=4, Data= (36, "TSUserEnabled", Partial, 548, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) }, 16, ) == 0x0
 00130   868   NtClose  (36, ... ) == 0x0
 00131   868   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon"}, ... 36, ) }, ... 36, ) == 0x0
 00132   868   NtQueryValueKey  (36,  (36, "LeakTrack", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00133   868   NtClose  (36, ... ) == 0x0
 00134   868   NtOpenKey  (0x2000000, {24, 0, 0x40, 0, 0,  (0x2000000, {24, 0, 0x40, 0, 0, "\REGISTRY\MACHINE"}, ... 36, ) }, ... 36, ) == 0x0
 00135   868   NtSetInformationObject  (36, Handle, {Inherit=0,ProtectFromClose=1,}, 2011431168, ... ) == 0x0
 00136   868   NtOpenKey  (0x20019, {24, 36, 0x40, 0, 0,  (0x20019, {24, 36, 0x40, 0, 0, "Software\Microsoft\Windows NT\CurrentVersion\Diagnostics"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00137   868   NtOpenKey  (0x80000000, {24, 0, 0x40, 0, 0,  (0x80000000, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ntdll.dll"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00138   868   NtOpenKey  (0x80000000, {24, 0, 0x40, 0, 0,  (0x80000000, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kernel32.dll"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00139   868   NtOpenProcessToken  (-1, 0x20, ... 40, ) == 0x0
 00140   868   NtQuerySystemInformation  (Basic, 44, ... {Unknown=0,MaximumIncrement=156250,PhysicalPageSize=0x1000,NumberOfPhysicalPages=0xff7c,LowestPhysicalPage=0x1,HighestPhysicalPage=0xffff,AllocationGranularity=0x10000,LowestUserAddress=0x10000,HighestUserAddress=0x7ffeffff,ActiveProcessors=1,NumberProcessors=1,}, 0x0, ) == 0x0
 00141   868   NtOpenKey  (0x20019, {24, 36, 0x40, 0, 0,  (0x20019, {24, 36, 0x40, 0, 0, "Software\Microsoft\Rpc\PagedBuffers"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00142   868   NtOpenKey  (0x20019, {24, 36, 0x40, 0, 0,  (0x20019, {24, 36, 0x40, 0, 0, "Software\Microsoft\Rpc"}, ... 44, ) }, ... 44, ) == 0x0
 00143   868   NtQueryValueKey  (44,  (44, "MaxRpcSize", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00144   868   NtClose  (44, ... ) == 0x0
 00145   868   NtOpenKey  (0x20019, {24, 36, 0x40, 0, 0,  (0x20019, {24, 36, 0x40, 0, 0, "Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\packed.exe\RpcThreadPoolThrottle"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00146   868   NtCreateEvent  (0x1f0003, 0x0, 1, 0, ... 44, ) == 0x0
 00147   868   NtCreateEvent  (0x1f0003, 0x0, 1, 0, ... 48, ) == 0x0
 00148   868   NtQuerySystemTime  (... {1399838942, 29915148}, ) == 0x0
 00149   868   NtCreateEvent  (0x1f0003, 0x0, 0, 0, ... 52, ) == 0x0
 00150   868   NtOpenKey  (0x20019, {24, 36, 0x40, 0, 0,  (0x20019, {24, 36, 0x40, 0, 0, "Software\Policies\Microsoft\Windows NT\Rpc"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00151   868   NtQuerySystemInformation  (Performance, 312, ... {system info, class 2, size 312}, 0x0, ) == 0x0
 00152   868   NtQueryInformationProcess  (-1, QuotaLimits, 32, ... {process info, class 1, size 32}, 0x0, ) == 0x0
 00153   868   NtQueryInformationProcess  (-1, VmCounters, 44, ... {process info, class 3, size 44}, 0x0, ) == 0x0
 00154   868   NtCreateEvent  (0x1f0003, 0x0, 0, 0, ... 56, ) == 0x0
 00155   868   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ... 60, ) == 0x0
 00156   868   NtAllocateVirtualMemory  (-1, 1331200, 0, 4096, 4096, 4, ... 1331200, 4096, ) == 0x0
 00157   868   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\System\CurrentControlSet\Control\ComputerName"}, ... 64, ) }, ... 64, ) == 0x0
 00158   868   NtOpenKey  (0x20019, {24, 64, 0x40, 0, 0,  (0x20019, {24, 64, 0x40, 0, 0, "ActiveComputerName"}, ... 68, ) }, ... 68, ) == 0x0
 00159   868   NtQueryValueKey  (68,  (68, "ComputerName", Full, 108, ... TitleIdx=0, Type=1, Name="ComputerName", Data="V\0I\0R\0T\0U\0A\0L\0\0\0"}, 60, ) , Full, 108, ... TitleIdx=0, Type=1, Name= (68, "ComputerName", Full, 108, ... TitleIdx=0, Type=1, Name="ComputerName", Data="V\0I\0R\0T\0U\0A\0L\0\0\0"}, 60, ) , Data= (68, "ComputerName", Full, 108, ... TitleIdx=0, Type=1, Name="ComputerName", Data="V\0I\0R\0T\0U\0A\0L\0\0\0"}, 60, ) }, 60, ) == 0x0
 00160   868   NtClose  (68, ... ) == 0x0
 00161   868   NtClose  (64, ... ) == 0x0
 00162   868   NtCreateIoCompletion  (0x1f0003, 0x0, 0, ... 64, ) == 0x0
 00163   868   NtCreateIoCompletion  (0x1f0003, 0x0, -1, ... 68, ) == 0x0
 00164   868   NtDuplicateObject  (-1, 64, -1, 0x0, 0, 2, ... 72, ) == 0x0
 00165   868   NtOpenThreadToken  (-2, 0xc, 1, ... ) == STATUS_NO_TOKEN
 00166   868   NtCreateEvent  (0x1f0003, 0x0, 1, 0, ... 76, ) == 0x0
 00167   868   NtOpenThreadToken  (-2, 0xc, 1, ... ) == STATUS_NO_TOKEN
 00168   868   NtSetInformationThread  (-2, ImpersonationToken, {ImpToken=0,}, 4, ... ) == 0x0
 00169   868   NtCreateFile  (0xc0100080, {24, 0, 0x40, 0, 1243252,  (0xc0100080, {24, 0, 0x40, 0, 1243252, "\??\PIPE\lsarpc"}, 0x0, 0, 3, 1, 64, 0, 0, ... 80, {status=0x0, info=1}, ) }, 0x0, 0, 3, 1, 64, 0, 0, ... 80, {status=0x0, info=1}, ) == 0x0
 00170   868   NtSetInformationFile  (80, 1243308, 8, Pipe, ... {status=0x0, info=0}, ) == 0x0
 00171   868   NtSetInformationFile  (80, 1243296, 8, Completion, ... {status=0x0, info=0}, ) == 0x0
 00172   868   NtSetInformationThread  (-2, ImpersonationToken, {ImpToken=0,}, 4, ... ) == 0x0
 00173   868   NtWriteFile  (80, 57, 0, 0,  (80, 57, 0, 0, "\5\0\13\3\20\0\0\0H\0\0\0\1\0\0\0\270\20\270\20\0\0\0\0\1\0\0\0\0\0\1\0xW4\224\22\315\253\357\0\1#Eg\211\253\0\0\0\0\4]\210\212\353\34\311\21\237\350\10\0+\20H`\2\0\0\0", 72, {0, 0}, 0, ... {status=0x0, info=72}, ) , 72, {0, 0}, 0, ... {status=0x0, info=72}, ) == 0x0
 00174   868   NtAllocateVirtualMemory  (-1, 1335296, 0, 4096, 4096, 4, ... 1335296, 4096, ) == 0x0
 00175   868   NtReadFile  (80, 57, 0, 0, 1024, {0, 0}, 0, ... {status=0x0, info=68},  (80, 57, 0, 0, 1024, {0, 0}, 0, ... {status=0x0, info=68}, "\5\0\14\3\20\0\0\0D\0\0\0\1\0\0\0\270\20\270\20++\0\0\14\0\PIPE\lsass\0\0\0\1\0\0\0\0\0\0\0\4]\210\212\353\34\311\21\237\350\10\0+\20H`\2\0\0\0", ) , ) == 0x0
 00176   868   NtFsControlFile  (80, 57, 0x0, 0x0, 0x11c017,  (80, 57, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0@\0\0\0\1\0\0\0(\0\0\0\0\0,\0\0\0\0\0\30\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0<\377\22\0\14\0\0\0\2\0\1\0\0\10\0\0", 64, 1024, ... {status=0x103, info=68}, "\5\0\14\3\20\0\0\0D\0\0\0\1\0\0\0\270\20\270\20++\0\0\14\0\PIPE\lsass\0\0\0\1\0\0\0\0\0\0\0\4]\210\212\353\34\311\21\237\350\10\0+\20H`\2\0\0\0", ) , 64, 1024, ... {status=0x103, info=68},  (80, 57, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0@\0\0\0\1\0\0\0(\0\0\0\0\0,\0\0\0\0\0\30\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0<\377\22\0\14\0\0\0\2\0\1\0\0\10\0\0", 64, 1024, ... {status=0x103, info=68}, "\5\0\14\3\20\0\0\0D\0\0\0\1\0\0\0\270\20\270\20++\0\0\14\0\PIPE\lsass\0\0\0\1\0\0\0\0\0\0\0\4]\210\212\353\34\311\21\237\350\10\0+\20H`\2\0\0\0", ) , ) == 0x103
 00177   868   NtFsControlFile  (80, 57, 0x0, 0x0, 0x11c017,  (80, 57, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0`\0\0\0\2\0\0\0H\0\0\0\0\0\37\0\0\0\0\0\266\275.l\215\373FC\227[\347p\214Nse \0"\0PD\24\0\21\0\0\0\0\0\0\0\20\0\0\0S\0e\0D\0e\0b\0u\0g\0P\0r\0i\0v\0i\0l\0e\0g\0e\0", 96, 1024, ... {status=0x103, info=48}, "\5\0\2\3\20\0\0\00\0\0\0\1\0\0\0\30\0\0\0\0\0\0\0\0\0\0\0\266\275.l\215\373FC\227[\347p\214Nse\0\0\0\0", ) \0PD\24\0\21\0\0\0\0\0\0\0\20\0\0\0S\0e\0D\0e\0b\0u\0g\0P\0r\0i\0v\0i\0l\0e\0g\0e\0 (80, 57, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0`\0\0\0\2\0\0\0H\0\0\0\0\0\37\0\0\0\0\0\266\275.l\215\373FC\227[\347p\214Nse \0"\0PD\24\0\21\0\0\0\0\0\0\0\20\0\0\0S\0e\0D\0e\0b\0u\0g\0P\0r\0i\0v\0i\0l\0e\0g\0e\0", 96, 1024, ... {status=0x103, info=48}, "\5\0\2\3\20\0\0\00\0\0\0\1\0\0\0\30\0\0\0\0\0\0\0\0\0\0\0\266\275.l\215\373FC\227[\347p\214Nse\0\0\0\0", ) \5\0\2\3\20\0\0\00\0\0\0\1\0\0\0\30\0\0\0\0\0\0\0\0\0\0\0\266\275.l\215\373FC\227[\347p\214Nse\0\0\0\0", ) == 0x103
 00178   868   NtFsControlFile  (80, 57, 0x0, 0x0, 0x11c017,  (80, 57, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0,\0\0\0\3\0\0\0\24\0\0\0\0\0\0\0\0\0\0\0\266\275.l\215\373FC\227[\347p\214Nse", 44, 1024, ... {status=0x103, info=36}, "\5\0\2\3\20\0\0\0$\0\0\0\2\0\0\0\14\0\0\0\0\0\0\0\24\0\0\0\0\0\0\0\0\0\0\0", ) , 44, 1024, ... {status=0x103, info=36},  (80, 57, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0,\0\0\0\3\0\0\0\24\0\0\0\0\0\0\0\0\0\0\0\266\275.l\215\373FC\227[\347p\214Nse", 44, 1024, ... {status=0x103, info=36}, "\5\0\2\3\20\0\0\0$\0\0\0\2\0\0\0\14\0\0\0\0\0\0\0\24\0\0\0\0\0\0\0\0\0\0\0", ) , ) == 0x103
 00179   868   NtClose  (76, ... ) == 0x0
 00180   868   NtClose  (80, ... ) == 0x0
 00181   868   NtAdjustPrivilegesToken  (40, 0, 1245096, 0, 0, 0, ... ) == 0x0
 00182   868   NtClose  (40, ... ) == 0x0
 00183   868   NtAllocateVirtualMemory  (-1, 0, 0, 65536, 4096, 4, ... 3342336, 65536, ) == 0x0
 00184   868   NtQuerySystemInformation  (ProcessesAndThreads, 65536, ... {system info, class 5, size 500}, 0x0, ) == 0x0
 00185   868   NtCreateSection  (0xf0007, 0x0, {18400, 0}, 4, 134217728, 0, ... 40, ) == 0x0
 00186   868   NtMapViewOfSection  (40, -1, (0x0), 0, 0, {0, 0}, 0, 1, 0, 4, ... (0x340000), {0, 0}, 20480, ) == 0x0
 00187   868   NtUnmapViewOfSection  (-1, 0x340000, ... ) == 0x0
 00188   868   NtMapViewOfSection  (40, -1, (0x0), 0, 0, {0, 0}, 0, 1, 0, 4, ... (0x340000), {0, 0}, 20480, ) == 0x0
 00189   868   NtFreeVirtualMemory  (-1, (0x330000), 0, 32768, ... (0x330000), 65536, ) == 0x0
 00190   868   NtUnmapViewOfSection  (-1, 0x340000, ... ) == 0x0
 00191   868   NtMapViewOfSection  (40, -1, (0x0), 0, 0, {0, 0}, 0, 1, 0, 4, ... (0x330000), {0, 0}, 20480, ) == 0x0
 00192   868   NtUnmapViewOfSection  (-1, 0x330000, ... ) == 0x0
 00193   868   NtMapViewOfSection  (40, -1, (0x0), 0, 0, {0, 0}, 0, 1, 0, 4, ... (0x330000), {0, 0}, 20480, ) == 0x0
 00194   868   NtUnmapViewOfSection  (-1, 0x330000, ... ) == 0x0
 00195   868   NtMapViewOfSection  (40, -1, (0x0), 0, 0, {0, 0}, 0, 1, 0, 4, ... (0x330000), {0, 0}, 20480, ) == 0x0
 00196   868   NtUnmapViewOfSection  (-1, 0x330000, ... ) == 0x0
 00197   868   NtMapViewOfSection  (40, -1, (0x0), 0, 0, {0, 0}, 0, 1, 0, 4, ... (0x330000), {0, 0}, 20480, ) == 0x0
 00198   868   NtUnmapViewOfSection  (-1, 0x330000, ... ) == 0x0
 00199   868   NtMapViewOfSection  (40, -1, (0x0), 0, 0, {0, 0}, 0, 1, 0, 4, ... (0x330000), {0, 0}, 20480, ) == 0x0
 00200   868   NtUnmapViewOfSection  (-1, 0x330000, ... ) == 0x0
 00201   868   NtOpenProcess  (0x2a, {24, 0, 0x0, 0, 0, 0x0}, {580, 0}, ... 80, ) == 0x0
 00202   868   NtOpenSection  (0xe, {24, 16, 0x0, 0, 0,  (0xe, {24, 16, 0x0, 0, 0, "W32_Virtu"}, ... 76, ) }, ... 76, ) == 0x0
 00203   868   NtMapViewOfSection  (76, 80, (0x0), 0, 27086, 0x0, 27086, 2, 1048576, 64, ... (0x7ff90000), 0x0, 28672, ) == 0x0
 00204   868   NtClose  (76, ... ) == 0x0
 00205   868   NtProtectVirtualMemory  (80, (0x7c90d682), 5, 64, ... (0x7c90d000), 4096, 32, ) == 0x0
 00206   868   NtWriteVirtualMemory  (80, 0x7c90d682,  (80, 0x7c90d682, "\350\15Mh\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00207   868   NtProtectVirtualMemory  (80, (0x7c90dcfd), 5, 64, ... (0x7c90d000), 4096, 64, ) == 0x0
 00208   868   NtWriteVirtualMemory  (80, 0x7c90dcfd,  (80, 0x7c90dcfd, "\350\337Fh\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00209   868   NtProtectVirtualMemory  (80, (0x7c90d754), 5, 64, ... (0x7c90d000), 4096, 64, ) == 0x0
 00210   868   NtWriteVirtualMemory  (80, 0x7c90d754,  (80, 0x7c90d754, "\350\217Lh\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00211   868   NtProtectVirtualMemory  (80, (0x7c90d769), 5, 64, ... (0x7c90d000), 4096, 64, ) == 0x0
 00212   868   NtWriteVirtualMemory  (80, 0x7c90d769,  (80, 0x7c90d769, "\350\207Lh\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00213   868   NtAllocateVirtualMemory  (80, 0, 0, 1048576, 8192, 4, ... 27852800, 1048576, ) == 0x0
 00214   868   NtAllocateVirtualMemory  (80, 28893184, 0, 8192, 4096, 4, ... 28893184, 8192, ) == 0x0
 00215   868   NtProtectVirtualMemory  (80, (0x1b8e000), 4096, 260, ... (0x1b8e000), 4096, 4, ) == 0x0
 00216   868   NtCreateThread  (0x1f03ff, 0x0, 80, 1243840, 1243784, 1, ... 76, {580, 1304}, ) == 0x0
 00217   868   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 0, 0, 0, 0}  (24, {28, 56, new_msg, 0, 0, 0, 0, 0} "\0\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0L\0\0\0D\2\0\0\30\5\0\0" ... {28, 56, reply, 0, 1228, 868, 57935, 0} "\0\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0L\0\0\0D\2\0\0\30\5\0\0" )  ... {28, 56, reply, 0, 1228, 868, 57935, 0}  (24, {28, 56, new_msg, 0, 0, 0, 0, 0} "\0\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0L\0\0\0D\2\0\0\30\5\0\0" ... {28, 56, reply, 0, 1228, 868, 57935, 0} "\0\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0L\0\0\0D\2\0\0\30\5\0\0" )  ) == 0x0
 00218   868   NtResumeThread  (76, ... 1, ) == 0x0
 00219   868   NtDelayExecution  (0, {-100000, -1}, ... ) == 0x0
 00220   868   NtClose  (80, ... ) == 0x0
 00221   868   NtMapViewOfSection  (40, -1, (0x0), 0, 0, {0, 0}, 0, 1, 0, 4, ... (0x330000), {0, 0}, 20480, ) == 0x0
 00222   868   NtUnmapViewOfSection  (-1, 0x330000, ... ) == 0x0
 00223   868   NtOpenProcess  (0x2a, {24, 0, 0x0, 0, 0, 0x0}, {640, 0}, ... 80, ) == 0x0
 00224   868   NtOpenSection  (0xe, {24, 16, 0x0, 0, 0,  (0xe, {24, 16, 0x0, 0, 0, "W32_Virtu"}, ... 84, ) }, ... 84, ) == 0x0
 00225   868   NtMapViewOfSection  (84, 80, (0x0), 0, 27086, 0x0, 27086, 2, 1048576, 64, ... (0x7ff90000), 0x0, 28672, ) == 0x0
 00226   868   NtClose  (84, ... ) == 0x0
 00227   868   NtProtectVirtualMemory  (80, (0x7c90d682), 5, 64, ... (0x7c90d000), 4096, 32, ) == 0x0
 00228   868   NtWriteVirtualMemory  (80, 0x7c90d682,  (80, 0x7c90d682, "\350\15Mh\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00229   868   NtProtectVirtualMemory  (80, (0x7c90dcfd), 5, 64, ... (0x7c90d000), 4096, 64, ) == 0x0
 00230   868   NtWriteVirtualMemory  (80, 0x7c90dcfd,  (80, 0x7c90dcfd, "\350\337Fh\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00231   868   NtProtectVirtualMemory  (80, (0x7c90d754), 5, 64, ... (0x7c90d000), 4096, 64, ) == 0x0
 00232   868   NtWriteVirtualMemory  (80, 0x7c90d754,  (80, 0x7c90d754, "\350\217Lh\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00233   868   NtProtectVirtualMemory  (80, (0x7c90d769), 5, 64, ... (0x7c90d000), 4096, 64, ) == 0x0
 00234   868   NtWriteVirtualMemory  (80, 0x7c90d769,  (80, 0x7c90d769, "\350\207Lh\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00235   868   NtClose  (80, ... ) == 0x0
 00236   868   NtMapViewOfSection  (40, -1, (0x0), 0, 0, {0, 0}, 0, 1, 0, 4, ... (0x330000), {0, 0}, 20480, ) == 0x0
 00237   868   NtUnmapViewOfSection  (-1, 0x330000, ... ) == 0x0
 00238   868   NtOpenProcess  (0x2a, {24, 0, 0x0, 0, 0, 0x0}, {652, 0}, ... 80, ) == 0x0
 00239   868   NtOpenSection  (0xe, {24, 16, 0x0, 0, 0,  (0xe, {24, 16, 0x0, 0, 0, "W32_Virtu"}, ... 84, ) }, ... 84, ) == 0x0
 00240   868   NtMapViewOfSection  (84, 80, (0x0), 0, 27086, 0x0, 27086, 2, 1048576, 64, ... (0x7ff90000), 0x0, 28672, ) == 0x0
 00241   868   NtClose  (84, ... ) == 0x0
 00242   868   NtProtectVirtualMemory  (80, (0x7c90d682), 5, 64, ... (0x7c90d000), 4096, 32, ) == 0x0
 00243   868   NtWriteVirtualMemory  (80, 0x7c90d682,  (80, 0x7c90d682, "\350\15Mh\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00244   868   NtProtectVirtualMemory  (80, (0x7c90dcfd), 5, 64, ... (0x7c90d000), 4096, 64, ) == 0x0
 00245   868   NtWriteVirtualMemory  (80, 0x7c90dcfd,  (80, 0x7c90dcfd, "\350\337Fh\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00246   868   NtProtectVirtualMemory  (80, (0x7c90d754), 5, 64, ... (0x7c90d000), 4096, 64, ) == 0x0
 00247   868   NtWriteVirtualMemory  (80, 0x7c90d754,  (80, 0x7c90d754, "\350\217Lh\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00248   868   NtProtectVirtualMemory  (80, (0x7c90d769), 5, 64, ... (0x7c90d000), 4096, 64, ) == 0x0
 00249   868   NtWriteVirtualMemory  (80, 0x7c90d769,  (80, 0x7c90d769, "\350\207Lh\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00250   868   NtClose  (80, ... ) == 0x0
 00251   868   NtMapViewOfSection  (40, -1, (0x0), 0, 0, {0, 0}, 0, 1, 0, 4, ... (0x330000), {0, 0}, 20480, ) == 0x0
 00252   868   NtUnmapViewOfSection  (-1, 0x330000, ... ) == 0x0
 00253   868   NtOpenProcess  (0x2a, {24, 0, 0x0, 0, 0, 0x0}, {816, 0}, ... 80, ) == 0x0
 00254   868   NtOpenSection  (0xe, {24, 16, 0x0, 0, 0,  (0xe, {24, 16, 0x0, 0, 0, "W32_Virtu"}, ... 84, ) }, ... 84, ) == 0x0
 00255   868   NtMapViewOfSection  (84, 80, (0x0), 0, 27086, 0x0, 27086, 2, 1048576, 64, ... (0x7ffa0000), 0x0, 28672, ) == 0x0
 00256   868   NtClose  (84, ... ) == 0x0
 00257   868   NtProtectVirtualMemory  (80, (0x7c90d682), 5, 64, ... (0x7c90d000), 4096, 32, ) == 0x0
 00258   868   NtWriteVirtualMemory  (80, 0x7c90d682,  (80, 0x7c90d682, "\350\15Mi\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00259   868   NtProtectVirtualMemory  (80, (0x7c90dcfd), 5, 64, ... (0x7c90d000), 4096, 64, ) == 0x0
 00260   868   NtWriteVirtualMemory  (80, 0x7c90dcfd,  (80, 0x7c90dcfd, "\350\337Fi\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00261   868   NtProtectVirtualMemory  (80, (0x7c90d754), 5, 64, ... (0x7c90d000), 4096, 64, ) == 0x0
 00262   868   NtWriteVirtualMemory  (80, 0x7c90d754,  (80, 0x7c90d754, "\350\217Li\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00263   868   NtProtectVirtualMemory  (80, (0x7c90d769), 5, 64, ... (0x7c90d000), 4096, 64, ) == 0x0
 00264   868   NtWriteVirtualMemory  (80, 0x7c90d769,  (80, 0x7c90d769, "\350\207Li\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00265   868   NtClose  (80, ... ) == 0x0
 00266   868   NtMapViewOfSection  (40, -1, (0x0), 0, 0, {0, 0}, 0, 1, 0, 4, ... (0x330000), {0, 0}, 20480, ) == 0x0
 00267   868   NtUnmapViewOfSection  (-1, 0x330000, ... ) == 0x0
 00268   868   NtOpenProcess  (0x2a, {24, 0, 0x0, 0, 0, 0x0}, {904, 0}, ... 80, ) == 0x0
 00269   868   NtOpenSection  (0xe, {24, 16, 0x0, 0, 0,  (0xe, {24, 16, 0x0, 0, 0, "W32_Virtu"}, ... 84, ) }, ... 84, ) == 0x0
 00270   868   NtMapViewOfSection  (84, 80, (0x0), 0, 27086, 0x0, 27086, 2, 1048576, 64, ... (0x7ffa0000), 0x0, 28672, ) == 0x0
 00271   868   NtClose  (84, ... ) == 0x0
 00272   868   NtProtectVirtualMemory  (80, (0x7c90d682), 5, 64, ... (0x7c90d000), 4096, 32, ) == 0x0
 00273   868   NtWriteVirtualMemory  (80, 0x7c90d682,  (80, 0x7c90d682, "\350\15Mi\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00274   868   NtProtectVirtualMemory  (80, (0x7c90dcfd), 5, 64, ... (0x7c90d000), 4096, 64, ) == 0x0
 00275   868   NtWriteVirtualMemory  (80, 0x7c90dcfd,  (80, 0x7c90dcfd, "\350\337Fi\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00276   868   NtProtectVirtualMemory  (80, (0x7c90d754), 5, 64, ... (0x7c90d000), 4096, 64, ) == 0x0
 00277   868   NtWriteVirtualMemory  (80, 0x7c90d754,  (80, 0x7c90d754, "\350\217Li\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00278   868   NtProtectVirtualMemory  (80, (0x7c90d769), 5, 64, ... (0x7c90d000), 4096, 64, ) == 0x0
 00279   868   NtWriteVirtualMemory  (80, 0x7c90d769,  (80, 0x7c90d769, "\350\207Li\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00280   868   NtClose  (80, ... ) == 0x0
 00281   868   NtMapViewOfSection  (40, -1, (0x0), 0, 0, {0, 0}, 0, 1, 0, 4, ... (0x330000), {0, 0}, 20480, ) == 0x0
 00282   868   NtUnmapViewOfSection  (-1, 0x330000, ... ) == 0x0
 00283   868   NtOpenProcess  (0x2a, {24, 0, 0x0, 0, 0, 0x0}, {1000, 0}, ... 80, ) == 0x0
 00284   868   NtOpenSection  (0xe, {24, 16, 0x0, 0, 0,  (0xe, {24, 16, 0x0, 0, 0, "W32_Virtu"}, ... 84, ) }, ... 84, ) == 0x0
 00285   868   NtMapViewOfSection  (84, 80, (0x0), 0, 27086, 0x0, 27086, 2, 1048576, 64, ... (0x7ff50000), 0x0, 28672, ) == 0x0
 00286   868   NtClose  (84, ... ) == 0x0
 00287   868   NtProtectVirtualMemory  (80, (0x7c90d682), 5, 64, ... (0x7c90d000), 4096, 32, ) == 0x0
 00288   868   NtWriteVirtualMemory  (80, 0x7c90d682,  (80, 0x7c90d682, "\350\15Md\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00289   868   NtProtectVirtualMemory  (80, (0x7c90dcfd), 5, 64, ... (0x7c90d000), 4096, 64, ) == 0x0
 00290   868   NtWriteVirtualMemory  (80, 0x7c90dcfd,  (80, 0x7c90dcfd, "\350\337Fd\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00291   868   NtProtectVirtualMemory  (80, (0x7c90d754), 5, 64, ... (0x7c90d000), 4096, 64, ) == 0x0
 00292   868   NtWriteVirtualMemory  (80, 0x7c90d754,  (80, 0x7c90d754, "\350\217Ld\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00293   868   NtProtectVirtualMemory  (80, (0x7c90d769), 5, 64, ... (0x7c90d000), 4096, 64, ) == 0x0
 00294   868   NtWriteVirtualMemory  (80, 0x7c90d769,  (80, 0x7c90d769, "\350\207Ld\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00295   868   NtClose  (80, ... ) == 0x0
 00296   868   NtMapViewOfSection  (40, -1, (0x0), 0, 0, {0, 0}, 0, 1, 0, 4, ... (0x330000), {0, 0}, 20480, ) == 0x0
 00297   868   NtUnmapViewOfSection  (-1, 0x330000, ... ) == 0x0
 00298   868   NtOpenProcess  (0x2a, {24, 0, 0x0, 0, 0, 0x0}, {1044, 0}, ... 80, ) == 0x0
 00299   868   NtOpenSection  (0xe, {24, 16, 0x0, 0, 0,  (0xe, {24, 16, 0x0, 0, 0, "W32_Virtu"}, ... 84, ) }, ... 84, ) == 0x0
 00300   868   NtMapViewOfSection  (84, 80, (0x0), 0, 27086, 0x0, 27086, 2, 1048576, 64, ... (0x7ffa0000), 0x0, 28672, ) == 0x0
 00301   868   NtClose  (84, ... ) == 0x0
 00302   868   NtProtectVirtualMemory  (80, (0x7c90d682), 5, 64, ... (0x7c90d000), 4096, 32, ) == 0x0
 00303   868   NtWriteVirtualMemory  (80, 0x7c90d682,  (80, 0x7c90d682, "\350\15Mi\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00304   868   NtProtectVirtualMemory  (80, (0x7c90dcfd), 5, 64, ... (0x7c90d000), 4096, 64, ) == 0x0
 00305   868   NtWriteVirtualMemory  (80, 0x7c90dcfd,  (80, 0x7c90dcfd, "\350\337Fi\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00306   868   NtProtectVirtualMemory  (80, (0x7c90d754), 5, 64, ... (0x7c90d000), 4096, 64, ) == 0x0
 00307   868   NtWriteVirtualMemory  (80, 0x7c90d754,  (80, 0x7c90d754, "\350\217Li\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00308   868   NtProtectVirtualMemory  (80, (0x7c90d769), 5, 64, ... (0x7c90d000), 4096, 64, ) == 0x0
 00309   868   NtWriteVirtualMemory  (80, 0x7c90d769,  (80, 0x7c90d769, "\350\207Li\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00310   868   NtClose  (80, ... ) == 0x0
 00311   868   NtMapViewOfSection  (40, -1, (0x0), 0, 0, {0, 0}, 0, 1, 0, 4, ... (0x330000), {0, 0}, 20480, ) == 0x0
 00312   868   NtUnmapViewOfSection  (-1, 0x330000, ... ) == 0x0
 00313   868   NtOpenProcess  (0x2a, {24, 0, 0x0, 0, 0, 0x0}, {1196, 0}, ... 80, ) == 0x0
 00314   868   NtOpenSection  (0xe, {24, 16, 0x0, 0, 0,  (0xe, {24, 16, 0x0, 0, 0, "W32_Virtu"}, ... 84, ) }, ... 84, ) == 0x0
 00315   868   NtMapViewOfSection  (84, 80, (0x0), 0, 27086, 0x0, 27086, 2, 1048576, 64, ... (0x7ffa0000), 0x0, 28672, ) == 0x0
 00316   868   NtClose  (84, ... ) == 0x0
 00317   868   NtProtectVirtualMemory  (80, (0x7c90d682), 5, 64, ... (0x7c90d000), 4096, 32, ) == 0x0
 00318   868   NtWriteVirtualMemory  (80, 0x7c90d682,  (80, 0x7c90d682, "\350\15Mi\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00319   868   NtProtectVirtualMemory  (80, (0x7c90dcfd), 5, 64, ... (0x7c90d000), 4096, 64, ) == 0x0
 00320   868   NtWriteVirtualMemory  (80, 0x7c90dcfd,  (80, 0x7c90dcfd, "\350\337Fi\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00321   868   NtProtectVirtualMemory  (80, (0x7c90d754), 5, 64, ... (0x7c90d000), 4096, 64, ) == 0x0
 00322   868   NtWriteVirtualMemory  (80, 0x7c90d754,  (80, 0x7c90d754, "\350\217Li\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00323   868   NtProtectVirtualMemory  (80, (0x7c90d769), 5, 64, ... (0x7c90d000), 4096, 64, ) == 0x0
 00324   868   NtWriteVirtualMemory  (80, 0x7c90d769,  (80, 0x7c90d769, "\350\207Li\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00325   868   NtClose  (80, ... ) == 0x0
 00326   868   NtMapViewOfSection  (40, -1, (0x0), 0, 0, {0, 0}, 0, 1, 0, 4, ... (0x330000), {0, 0}, 20480, ) == 0x0
 00327   868   NtUnmapViewOfSection  (-1, 0x330000, ... ) == 0x0
 00328   868   NtOpenProcess  (0x2a, {24, 0, 0x0, 0, 0, 0x0}, {1468, 0}, ... 80, ) == 0x0
 00329   868   NtOpenSection  (0xe, {24, 16, 0x0, 0, 0,  (0xe, {24, 16, 0x0, 0, 0, "W32_Virtu"}, ... 84, ) }, ... 84, ) == 0x0
 00330   868   NtMapViewOfSection  (84, 80, (0x0), 0, 27086, 0x0, 27086, 2, 1048576, 64, ... (0x7ffa0000), 0x0, 28672, ) == 0x0
 00331   868   NtClose  (84, ... ) == 0x0
 00332   868   NtProtectVirtualMemory  (80, (0x7c90d682), 5, 64, ... (0x7c90d000), 4096, 32, ) == 0x0
 00333   868   NtWriteVirtualMemory  (80, 0x7c90d682,  (80, 0x7c90d682, "\350\15Mi\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00334   868   NtProtectVirtualMemory  (80, (0x7c90dcfd), 5, 64, ... (0x7c90d000), 4096, 64, ) == 0x0
 00335   868   NtWriteVirtualMemory  (80, 0x7c90dcfd,  (80, 0x7c90dcfd, "\350\337Fi\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00336   868   NtProtectVirtualMemory  (80, (0x7c90d754), 5, 64, ... (0x7c90d000), 4096, 64, ) == 0x0
 00337   868   NtWriteVirtualMemory  (80, 0x7c90d754,  (80, 0x7c90d754, "\350\217Li\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00338   868   NtProtectVirtualMemory  (80, (0x7c90d769), 5, 64, ... (0x7c90d000), 4096, 64, ) == 0x0
 00339   868   NtWriteVirtualMemory  (80, 0x7c90d769,  (80, 0x7c90d769, "\350\207Li\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00340   868   NtClose  (80, ... ) == 0x0
 00341   868   NtMapViewOfSection  (40, -1, (0x0), 0, 0, {0, 0}, 0, 1, 0, 4, ... (0x330000), {0, 0}, 20480, ) == 0x0
 00342   868   NtUnmapViewOfSection  (-1, 0x330000, ... ) == 0x0
 00343   868   NtOpenProcess  (0x2a, {24, 0, 0x0, 0, 0, 0x0}, {1720, 0}, ... 80, ) == 0x0
 00344   868   NtOpenSection  (0xe, {24, 16, 0x0, 0, 0,  (0xe, {24, 16, 0x0, 0, 0, "W32_Virtu"}, ... 84, ) }, ... 84, ) == 0x0
 00345   868   NtMapViewOfSection  (84, 80, (0x0), 0, 27086, 0x0, 27086, 2, 1048576, 64, ... (0x7ffa0000), 0x0, 28672, ) == 0x0
 00346   868   NtClose  (84, ... ) == 0x0
 00347   868   NtProtectVirtualMemory  (80, (0x7c90d682), 5, 64, ... (0x7c90d000), 4096, 32, ) == 0x0
 00348   868   NtWriteVirtualMemory  (80, 0x7c90d682,  (80, 0x7c90d682, "\350\15Mi\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00349   868   NtProtectVirtualMemory  (80, (0x7c90dcfd), 5, 64, ... (0x7c90d000), 4096, 64, ) == 0x0
 00350   868   NtWriteVirtualMemory  (80, 0x7c90dcfd,  (80, 0x7c90dcfd, "\350\337Fi\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00351   868   NtProtectVirtualMemory  (80, (0x7c90d754), 5, 64, ... (0x7c90d000), 4096, 64, ) == 0x0
 00352   868   NtWriteVirtualMemory  (80, 0x7c90d754,  (80, 0x7c90d754, "\350\217Li\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00353   868   NtProtectVirtualMemory  (80, (0x7c90d769), 5, 64, ... (0x7c90d000), 4096, 64, ) == 0x0
 00354   868   NtWriteVirtualMemory  (80, 0x7c90d769,  (80, 0x7c90d769, "\350\207Li\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00355   868   NtClose  (80, ... ) == 0x0
 00356   868   NtMapViewOfSection  (40, -1, (0x0), 0, 0, {0, 0}, 0, 1, 0, 4, ... (0x330000), {0, 0}, 20480, ) == 0x0
 00357   868   NtUnmapViewOfSection  (-1, 0x330000, ... ) == 0x0
 00358   868   NtOpenProcess  (0x2a, {24, 0, 0x0, 0, 0, 0x0}, {1888, 0}, ... 80, ) == 0x0
 00359   868   NtOpenSection  (0xe, {24, 16, 0x0, 0, 0,  (0xe, {24, 16, 0x0, 0, 0, "W32_Virtu"}, ... 84, ) }, ... 84, ) == 0x0
 00360   868   NtMapViewOfSection  (84, 80, (0x0), 0, 27086, 0x0, 27086, 2, 1048576, 64, ... (0x7ffa0000), 0x0, 28672, ) == 0x0
 00361   868   NtClose  (84, ... ) == 0x0
 00362   868   NtProtectVirtualMemory  (80, (0x7c90d682), 5, 64, ... (0x7c90d000), 4096, 32, ) == 0x0
 00363   868   NtWriteVirtualMemory  (80, 0x7c90d682,  (80, 0x7c90d682, "\350\15Mi\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00364   868   NtProtectVirtualMemory  (80, (0x7c90dcfd), 5, 64, ... (0x7c90d000), 4096, 64, ) == 0x0
 00365   868   NtWriteVirtualMemory  (80, 0x7c90dcfd,  (80, 0x7c90dcfd, "\350\337Fi\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00366   868   NtProtectVirtualMemory  (80, (0x7c90d754), 5, 64, ... (0x7c90d000), 4096, 64, ) == 0x0
 00367   868   NtWriteVirtualMemory  (80, 0x7c90d754,  (80, 0x7c90d754, "\350\217Li\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00368   868   NtProtectVirtualMemory  (80, (0x7c90d769), 5, 64, ... (0x7c90d000), 4096, 64, ) == 0x0
 00369   868   NtWriteVirtualMemory  (80, 0x7c90d769,  (80, 0x7c90d769, "\350\207Li\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00370   868   NtClose  (80, ... ) == 0x0
 00371   868   NtMapViewOfSection  (40, -1, (0x0), 0, 0, {0, 0}, 0, 1, 0, 4, ... (0x330000), {0, 0}, 20480, ) == 0x0
 00372   868   NtUnmapViewOfSection  (-1, 0x330000, ... ) == 0x0
 00373   868   NtOpenProcess  (0x2a, {24, 0, 0x0, 0, 0, 0x0}, {2024, 0}, ... 80, ) == 0x0
 00374   868   NtOpenSection  (0xe, {24, 16, 0x0, 0, 0,  (0xe, {24, 16, 0x0, 0, 0, "W32_Virtu"}, ... 84, ) }, ... 84, ) == 0x0
 00375   868   NtMapViewOfSection  (84, 80, (0x0), 0, 27086, 0x0, 27086, 2, 1048576, 64, ... (0x7ffa0000), 0x0, 28672, ) == 0x0
 00376   868   NtClose  (84, ... ) == 0x0
 00377   868   NtProtectVirtualMemory  (80, (0x7c90d682), 5, 64, ... (0x7c90d000), 4096, 32, ) == 0x0
 00378   868   NtWriteVirtualMemory  (80, 0x7c90d682,  (80, 0x7c90d682, "\350\15Mi\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00379   868   NtProtectVirtualMemory  (80, (0x7c90dcfd), 5, 64, ... (0x7c90d000), 4096, 64, ) == 0x0
 00380   868   NtWriteVirtualMemory  (80, 0x7c90dcfd,  (80, 0x7c90dcfd, "\350\337Fi\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00381   868   NtProtectVirtualMemory  (80, (0x7c90d754), 5, 64, ... (0x7c90d000), 4096, 64, ) == 0x0
 00382   868   NtWriteVirtualMemory  (80, 0x7c90d754,  (80, 0x7c90d754, "\350\217Li\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00383   868   NtProtectVirtualMemory  (80, (0x7c90d769), 5, 64, ... (0x7c90d000), 4096, 64, ) == 0x0
 00384   868   NtWriteVirtualMemory  (80, 0x7c90d769,  (80, 0x7c90d769, "\350\207Li\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00385   868   NtClose  (80, ... ) == 0x0
 00386   868   NtMapViewOfSection  (40, -1, (0x0), 0, 0, {0, 0}, 0, 1, 0, 4, ... (0x330000), {0, 0}, 20480, ) == 0x0
 00387   868   NtUnmapViewOfSection  (-1, 0x330000, ... ) == 0x0
 00388   868   NtOpenProcess  (0x2a, {24, 0, 0x0, 0, 0, 0x0}, {180, 0}, ... 80, ) == 0x0
 00389   868   NtOpenSection  (0xe, {24, 16, 0x0, 0, 0,  (0xe, {24, 16, 0x0, 0, 0, "W32_Virtu"}, ... 84, ) }, ... 84, ) == 0x0
 00390   868   NtMapViewOfSection  (84, 80, (0x0), 0, 27086, 0x0, 27086, 2, 1048576, 64, ... (0x7ffa0000), 0x0, 28672, ) == 0x0
 00391   868   NtClose  (84, ... ) == 0x0
 00392   868   NtProtectVirtualMemory  (80, (0x7c90d682), 5, 64, ... (0x7c90d000), 4096, 32, ) == 0x0
 00393   868   NtWriteVirtualMemory  (80, 0x7c90d682,  (80, 0x7c90d682, "\350\15Mi\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00394   868   NtProtectVirtualMemory  (80, (0x7c90dcfd), 5, 64, ... (0x7c90d000), 4096, 64, ) == 0x0
 00395   868   NtWriteVirtualMemory  (80, 0x7c90dcfd,  (80, 0x7c90dcfd, "\350\337Fi\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00396   868   NtProtectVirtualMemory  (80, (0x7c90d754), 5, 64, ... (0x7c90d000), 4096, 64, ) == 0x0
 00397   868   NtWriteVirtualMemory  (80, 0x7c90d754,  (80, 0x7c90d754, "\350\217Li\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00398   868   NtProtectVirtualMemory  (80, (0x7c90d769), 5, 64, ... (0x7c90d000), 4096, 64, ) == 0x0
 00399   868   NtWriteVirtualMemory  (80, 0x7c90d769,  (80, 0x7c90d769, "\350\207Li\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00400   868   NtClose  (80, ... ) == 0x0
 00401   868   NtMapViewOfSection  (40, -1, (0x0), 0, 0, {0, 0}, 0, 1, 0, 4, ... (0x330000), {0, 0}, 20480, ) == 0x0
 00402   868   NtUnmapViewOfSection  (-1, 0x330000, ... ) == 0x0
 00403   868   NtOpenProcess  (0x2a, {24, 0, 0x0, 0, 0, 0x0}, {196, 0}, ... 80, ) == 0x0
 00404   868   NtOpenSection  (0xe, {24, 16, 0x0, 0, 0,  (0xe, {24, 16, 0x0, 0, 0, "W32_Virtu"}, ... 84, ) }, ... 84, ) == 0x0
 00405   868   NtMapViewOfSection  (84, 80, (0x0), 0, 27086, 0x0, 27086, 2, 1048576, 64, ... (0x7ffa0000), 0x0, 28672, ) == 0x0
 00406   868   NtClose  (84, ... ) == 0x0
 00407   868   NtProtectVirtualMemory  (80, (0x7c90d682), 5, 64, ... (0x7c90d000), 4096, 32, ) == 0x0
 00408   868   NtWriteVirtualMemory  (80, 0x7c90d682,  (80, 0x7c90d682, "\350\15Mi\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00409   868   NtProtectVirtualMemory  (80, (0x7c90dcfd), 5, 64, ... (0x7c90d000), 4096, 64, ) == 0x0
 00410   868   NtWriteVirtualMemory  (80, 0x7c90dcfd,  (80, 0x7c90dcfd, "\350\337Fi\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00411   868   NtProtectVirtualMemory  (80, (0x7c90d754), 5, 64, ... (0x7c90d000), 4096, 64, ) == 0x0
 00412   868   NtWriteVirtualMemory  (80, 0x7c90d754,  (80, 0x7c90d754, "\350\217Li\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00413   868   NtProtectVirtualMemory  (80, (0x7c90d769), 5, 64, ... (0x7c90d000), 4096, 64, ) == 0x0
 00414   868   NtWriteVirtualMemory  (80, 0x7c90d769,  (80, 0x7c90d769, "\350\207Li\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00415   868   NtClose  (80, ... ) == 0x0
 00416   868   NtMapViewOfSection  (40, -1, (0x0), 0, 0, {0, 0}, 0, 1, 0, 4, ... (0x330000), {0, 0}, 20480, ) == 0x0
 00417   868   NtUnmapViewOfSection  (-1, 0x330000, ... ) == 0x0
 00418   868   NtOpenProcess  (0x2a, {24, 0, 0x0, 0, 0, 0x0}, {160, 0}, ... 80, ) == 0x0
 00419   868   NtOpenSection  (0xe, {24, 16, 0x0, 0, 0,  (0xe, {24, 16, 0x0, 0, 0, "W32_Virtu"}, ... 84, ) }, ... 84, ) == 0x0
 00420   868   NtMapViewOfSection  (84, 80, (0x0), 0, 27086, 0x0, 27086, 2, 1048576, 64, ... (0x7ffa0000), 0x0, 28672, ) == 0x0
 00421   868   NtClose  (84, ... ) == 0x0
 00422   868   NtProtectVirtualMemory  (80, (0x7c90d682), 5, 64, ... (0x7c90d000), 4096, 32, ) == 0x0
 00423   868   NtWriteVirtualMemory  (80, 0x7c90d682,  (80, 0x7c90d682, "\350\15Mi\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00424   868   NtProtectVirtualMemory  (80, (0x7c90dcfd), 5, 64, ... (0x7c90d000), 4096, 64, ) == 0x0
 00425   868   NtWriteVirtualMemory  (80, 0x7c90dcfd,  (80, 0x7c90dcfd, "\350\337Fi\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00426   868   NtProtectVirtualMemory  (80, (0x7c90d754), 5, 64, ... (0x7c90d000), 4096, 64, ) == 0x0
 00427   868   NtWriteVirtualMemory  (80, 0x7c90d754,  (80, 0x7c90d754, "\350\217Li\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00428   868   NtProtectVirtualMemory  (80, (0x7c90d769), 5, 64, ... (0x7c90d000), 4096, 64, ) == 0x0
 00429   868   NtWriteVirtualMemory  (80, 0x7c90d769,  (80, 0x7c90d769, "\350\207Li\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00430   868   NtClose  (80, ... ) == 0x0
 00431   868   NtMapViewOfSection  (40, -1, (0x0), 0, 0, {0, 0}, 0, 1, 0, 4, ... (0x330000), {0, 0}, 20480, ) == 0x0
 00432   868   NtUnmapViewOfSection  (-1, 0x330000, ... ) == 0x0
 00433   868   NtOpenProcess  (0x2a, {24, 0, 0x0, 0, 0, 0x0}, {260, 0}, ... 80, ) == 0x0
 00434   868   NtOpenSection  (0xe, {24, 16, 0x0, 0, 0,  (0xe, {24, 16, 0x0, 0, 0, "W32_Virtu"}, ... 84, ) }, ... 84, ) == 0x0
 00435   868   NtMapViewOfSection  (84, 80, (0x0), 0, 27086, 0x0, 27086, 2, 1048576, 64, ... (0x7ffa0000), 0x0, 28672, ) == 0x0
 00436   868   NtClose  (84, ... ) == 0x0
 00437   868   NtProtectVirtualMemory  (80, (0x7c90d682), 5, 64, ... (0x7c90d000), 4096, 32, ) == 0x0
 00438   868   NtWriteVirtualMemory  (80, 0x7c90d682,  (80, 0x7c90d682, "\350\15Mi\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00439   868   NtProtectVirtualMemory  (80, (0x7c90dcfd), 5, 64, ... (0x7c90d000), 4096, 64, ) == 0x0
 00440   868   NtWriteVirtualMemory  (80, 0x7c90dcfd,  (80, 0x7c90dcfd, "\350\337Fi\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00441   868   NtProtectVirtualMemory  (80, (0x7c90d754), 5, 64, ... (0x7c90d000), 4096, 64, ) == 0x0
 00442   868   NtWriteVirtualMemory  (80, 0x7c90d754,  (80, 0x7c90d754, "\350\217Li\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00443   868   NtProtectVirtualMemory  (80, (0x7c90d769), 5, 64, ... (0x7c90d000), 4096, 64, ) == 0x0
 00444   868   NtWriteVirtualMemory  (80, 0x7c90d769,  (80, 0x7c90d769, "\350\207Li\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00445   868   NtClose  (80, ... ) == 0x0
 00446   868   NtMapViewOfSection  (40, -1, (0x0), 0, 0, {0, 0}, 0, 1, 0, 4, ... (0x330000), {0, 0}, 20480, ) == 0x0
 00447   868   NtUnmapViewOfSection  (-1, 0x330000, ... ) == 0x0
 00448   868   NtOpenProcess  (0x2a, {24, 0, 0x0, 0, 0, 0x0}, {288, 0}, ... 80, ) == 0x0
 00449   868   NtOpenSection  (0xe, {24, 16, 0x0, 0, 0,  (0xe, {24, 16, 0x0, 0, 0, "W32_Virtu"}, ... 84, ) }, ... 84, ) == 0x0
 00450   868   NtMapViewOfSection  (84, 80, (0x0), 0, 27086, 0x0, 27086, 2, 1048576, 64, ... (0x7ffa0000), 0x0, 28672, ) == 0x0
 00451   868   NtClose  (84, ... ) == 0x0
 00452   868   NtProtectVirtualMemory  (80, (0x7c90d682), 5, 64, ... (0x7c90d000), 4096, 32, ) == 0x0
 00453   868   NtWriteVirtualMemory  (80, 0x7c90d682,  (80, 0x7c90d682, "\350\15Mi\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00454   868   NtProtectVirtualMemory  (80, (0x7c90dcfd), 5, 64, ... (0x7c90d000), 4096, 64, ) == 0x0
 00455   868   NtWriteVirtualMemory  (80, 0x7c90dcfd,  (80, 0x7c90dcfd, "\350\337Fi\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00456   868   NtProtectVirtualMemory  (80, (0x7c90d754), 5, 64, ... (0x7c90d000), 4096, 64, ) == 0x0
 00457   868   NtWriteVirtualMemory  (80, 0x7c90d754,  (80, 0x7c90d754, "\350\217Li\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00458   868   NtProtectVirtualMemory  (80, (0x7c90d769), 5, 64, ... (0x7c90d000), 4096, 64, ) == 0x0
 00459   868   NtWriteVirtualMemory  (80, 0x7c90d769,  (80, 0x7c90d769, "\350\207Li\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00460   868   NtClose  (80, ... ) == 0x0
 00461   868   NtMapViewOfSection  (40, -1, (0x0), 0, 0, {0, 0}, 0, 1, 0, 4, ... (0x330000), {0, 0}, 20480, ) == 0x0
 00462   868   NtUnmapViewOfSection  (-1, 0x330000, ... ) == 0x0
 00463   868   NtOpenProcess  (0x2a, {24, 0, 0x0, 0, 0, 0x0}, {412, 0}, ... 80, ) == 0x0
 00464   868   NtOpenSection  (0xe, {24, 16, 0x0, 0, 0,  (0xe, {24, 16, 0x0, 0, 0, "W32_Virtu"}, ... 84, ) }, ... 84, ) == 0x0
 00465   868   NtMapViewOfSection  (84, 80, (0x0), 0, 27086, 0x0, 27086, 2, 1048576, 64, ... (0x7ffa0000), 0x0, 28672, ) == 0x0
 00466   868   NtClose  (84, ... ) == 0x0
 00467   868   NtProtectVirtualMemory  (80, (0x7c90d682), 5, 64, ... (0x7c90d000), 4096, 32, ) == 0x0
 00468   868   NtWriteVirtualMemory  (80, 0x7c90d682,  (80, 0x7c90d682, "\350\15Mi\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00469   868   NtProtectVirtualMemory  (80, (0x7c90dcfd), 5, 64, ... (0x7c90d000), 4096, 64, ) == 0x0
 00470   868   NtWriteVirtualMemory  (80, 0x7c90dcfd,  (80, 0x7c90dcfd, "\350\337Fi\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00471   868   NtProtectVirtualMemory  (80, (0x7c90d754), 5, 64, ... (0x7c90d000), 4096, 64, ) == 0x0
 00472   868   NtWriteVirtualMemory  (80, 0x7c90d754,  (80, 0x7c90d754, "\350\217Li\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00473   868   NtProtectVirtualMemory  (80, (0x7c90d769), 5, 64, ... (0x7c90d000), 4096, 64, ) == 0x0
 00474   868   NtWriteVirtualMemory  (80, 0x7c90d769,  (80, 0x7c90d769, "\350\207Li\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00475   868   NtClose  (80, ... ) == 0x0
 00476   868   NtMapViewOfSection  (40, -1, (0x0), 0, 0, {0, 0}, 0, 1, 0, 4, ... (0x330000), {0, 0}, 20480, ) == 0x0
 00477   868   NtUnmapViewOfSection  (-1, 0x330000, ... ) == 0x0
 00478   868   NtOpenProcess  (0x2a, {24, 0, 0x0, 0, 0, 0x0}, {1408, 0}, ... 80, ) == 0x0
 00479   868   NtOpenSection  (0xe, {24, 16, 0x0, 0, 0,  (0xe, {24, 16, 0x0, 0, 0, "W32_Virtu"}, ... 84, ) }, ... 84, ) == 0x0
 00480   868   NtMapViewOfSection  (84, 80, (0x0), 0, 27086, 0x0, 27086, 2, 1048576, 64, ... (0x7ffa0000), 0x0, 28672, ) == 0x0
 00481   868   NtClose  (84, ... ) == 0x0
 00482   868   NtProtectVirtualMemory  (80, (0x7c90d682), 5, 64, ... (0x7c90d000), 4096, 32, ) == 0x0
 00483   868   NtWriteVirtualMemory  (80, 0x7c90d682,  (80, 0x7c90d682, "\350\15Mi\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00484   868   NtProtectVirtualMemory  (80, (0x7c90dcfd), 5, 64, ... (0x7c90d000), 4096, 64, ) == 0x0
 00485   868   NtWriteVirtualMemory  (80, 0x7c90dcfd,  (80, 0x7c90dcfd, "\350\337Fi\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00486   868   NtProtectVirtualMemory  (80, (0x7c90d754), 5, 64, ... (0x7c90d000), 4096, 64, ) == 0x0
 00487   868   NtWriteVirtualMemory  (80, 0x7c90d754,  (80, 0x7c90d754, "\350\217Li\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00488   868   NtProtectVirtualMemory  (80, (0x7c90d769), 5, 64, ... (0x7c90d000), 4096, 64, ) == 0x0
 00489   868   NtWriteVirtualMemory  (80, 0x7c90d769,  (80, 0x7c90d769, "\350\207Li\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00490   868   NtClose  (80, ... ) == 0x0
 00491   868   NtMapViewOfSection  (40, -1, (0x0), 0, 0, {0, 0}, 0, 1, 0, 4, ... (0x330000), {0, 0}, 20480, ) == 0x0
 00492   868   NtUnmapViewOfSection  (-1, 0x330000, ... ) == 0x0
 00493   868   NtOpenProcess  (0x2a, {24, 0, 0x0, 0, 0, 0x0}, {556, 0}, ... 80, ) == 0x0
 00494   868   NtOpenSection  (0xe, {24, 16, 0x0, 0, 0,  (0xe, {24, 16, 0x0, 0, 0, "W32_Virtu"}, ... 84, ) }, ... 84, ) == 0x0
 00495   868   NtMapViewOfSection  (84, 80, (0x0), 0, 27086, 0x0, 27086, 2, 1048576, 64, ... (0x7ffa0000), 0x0, 28672, ) == 0x0
 00496   868   NtClose  (84, ... ) == 0x0
 00497   868   NtProtectVirtualMemory  (80, (0x7c90d682), 5, 64, ... (0x7c90d000), 4096, 32, ) == 0x0
 00498   868   NtWriteVirtualMemory  (80, 0x7c90d682,  (80, 0x7c90d682, "\350\15Mi\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00499   868   NtProtectVirtualMemory  (80, (0x7c90dcfd), 5, 64, ... (0x7c90d000), 4096, 64, ) == 0x0
 00500   868   NtWriteVirtualMemory  (80, 0x7c90dcfd,  (80, 0x7c90dcfd, "\350\337Fi\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00501   868   NtProtectVirtualMemory  (80, (0x7c90d754), 5, 64, ... (0x7c90d000), 4096, 64, ) == 0x0
 00502   868   NtWriteVirtualMemory  (80, 0x7c90d754,  (80, 0x7c90d754, "\350\217Li\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00503   868   NtProtectVirtualMemory  (80, (0x7c90d769), 5, 64, ... (0x7c90d000), 4096, 64, ) == 0x0
 00504   868   NtWriteVirtualMemory  (80, 0x7c90d769,  (80, 0x7c90d769, "\350\207Li\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00505   868   NtClose  (80, ... ) == 0x0
 00506   868   NtMapViewOfSection  (40, -1, (0x0), 0, 0, {0, 0}, 0, 1, 0, 4, ... (0x330000), {0, 0}, 20480, ) == 0x0
 00507   868   NtUnmapViewOfSection  (-1, 0x330000, ... ) == 0x0
 00508   868   NtOpenProcess  (0x2a, {24, 0, 0x0, 0, 0, 0x0}, {1204, 0}, ... 80, ) == 0x0
 00509   868   NtOpenSection  (0xe, {24, 16, 0x0, 0, 0,  (0xe, {24, 16, 0x0, 0, 0, "W32_Virtu"}, ... 84, ) }, ... 84, ) == 0x0
 00510   868   NtMapViewOfSection  (84, 80, (0x0), 0, 27086, 0x0, 27086, 2, 1048576, 64, ... (0x7ffa0000), 0x0, 28672, ) == 0x0
 00511   868   NtClose  (84, ... ) == 0x0
 00512   868   NtProtectVirtualMemory  (80, (0x7c90d682), 5, 64, ... (0x7c90d000), 4096, 32, ) == 0x0
 00513   868   NtWriteVirtualMemory  (80, 0x7c90d682,  (80, 0x7c90d682, "\350\15Mi\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00514   868   NtProtectVirtualMemory  (80, (0x7c90dcfd), 5, 64, ... (0x7c90d000), 4096, 64, ) == 0x0
 00515   868   NtWriteVirtualMemory  (80, 0x7c90dcfd,  (80, 0x7c90dcfd, "\350\337Fi\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00516   868   NtProtectVirtualMemory  (80, (0x7c90d754), 5, 64, ... (0x7c90d000), 4096, 64, ) == 0x0
 00517   868   NtWriteVirtualMemory  (80, 0x7c90d754,  (80, 0x7c90d754, "\350\217Li\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00518   868   NtProtectVirtualMemory  (80, (0x7c90d769), 5, 64, ... (0x7c90d000), 4096, 64, ) == 0x0
 00519   868   NtWriteVirtualMemory  (80, 0x7c90d769,  (80, 0x7c90d769, "\350\207Li\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00520   868   NtClose  (80, ... ) == 0x0
 00521   868   NtMapViewOfSection  (40, -1, (0x0), 0, 0, {0, 0}, 0, 1, 0, 4, ... (0x330000), {0, 0}, 20480, ) == 0x0
 00522   868   NtUnmapViewOfSection  (-1, 0x330000, ... ) == 0x0
 00523   868   NtOpenProcess  (0x2a, {24, 0, 0x0, 0, 0, 0x0}, {1452, 0}, ... 80, ) == 0x0
 00524   868   NtOpenSection  (0xe, {24, 16, 0x0, 0, 0,  (0xe, {24, 16, 0x0, 0, 0, "W32_Virtu"}, ... 84, ) }, ... 84, ) == 0x0
 00525   868   NtMapViewOfSection  (84, 80, (0x0), 0, 27086, 0x0, 27086, 2, 1048576, 64, ... (0x7ffa0000), 0x0, 28672, ) == 0x0
 00526   868   NtClose  (84, ... ) == 0x0
 00527   868   NtProtectVirtualMemory  (80, (0x7c90d682), 5, 64, ... (0x7c90d000), 4096, 32, ) == 0x0
 00528   868   NtWriteVirtualMemory  (80, 0x7c90d682,  (80, 0x7c90d682, "\350\15Mi\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00529   868   NtProtectVirtualMemory  (80, (0x7c90dcfd), 5, 64, ... (0x7c90d000), 4096, 64, ) == 0x0
 00530   868   NtWriteVirtualMemory  (80, 0x7c90dcfd,  (80, 0x7c90dcfd, "\350\337Fi\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00531   868   NtProtectVirtualMemory  (80, (0x7c90d754), 5, 64, ... (0x7c90d000), 4096, 64, ) == 0x0
 00532   868   NtWriteVirtualMemory  (80, 0x7c90d754,  (80, 0x7c90d754, "\350\217Li\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00533   868   NtProtectVirtualMemory  (80, (0x7c90d769), 5, 64, ... (0x7c90d000), 4096, 64, ) == 0x0
 00534   868   NtWriteVirtualMemory  (80, 0x7c90d769,  (80, 0x7c90d769, "\350\207Li\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00535   868   NtClose  (80, ... ) == 0x0
 00536   868   NtMapViewOfSection  (40, -1, (0x0), 0, 0, {0, 0}, 0, 1, 0, 4, ... (0x330000), {0, 0}, 20480, ) == 0x0
 00537   868   NtUnmapViewOfSection  (-1, 0x330000, ... ) == 0x0
 00538   868   NtOpenProcess  (0x2a, {24, 0, 0x0, 0, 0, 0x0}, {1708, 0}, ... 80, ) == 0x0
 00539   868   NtOpenSection  (0xe, {24, 16, 0x0, 0, 0,  (0xe, {24, 16, 0x0, 0, 0, "W32_Virtu"}, ... 84, ) }, ... 84, ) == 0x0
 00540   868   NtMapViewOfSection  (84, 80, (0x0), 0, 27086, 0x0, 27086, 2, 1048576, 64, ... (0x7ffa0000), 0x0, 28672, ) == 0x0
 00541   868   NtClose  (84, ... ) == 0x0
 00542   868   NtProtectVirtualMemory  (80, (0x7c90d682), 5, 64, ... (0x7c90d000), 4096, 32, ) == 0x0
 00543   868   NtWriteVirtualMemory  (80, 0x7c90d682,  (80, 0x7c90d682, "\350\15Mi\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00544   868   NtProtectVirtualMemory  (80, (0x7c90dcfd), 5, 64, ... (0x7c90d000), 4096, 64, ) == 0x0
 00545   868   NtWriteVirtualMemory  (80, 0x7c90dcfd,  (80, 0x7c90dcfd, "\350\337Fi\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00546   868   NtProtectVirtualMemory  (80, (0x7c90d754), 5, 64, ... (0x7c90d000), 4096, 64, ) == 0x0
 00547   868   NtWriteVirtualMemory  (80, 0x7c90d754,  (80, 0x7c90d754, "\350\217Li\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00548   868   NtProtectVirtualMemory  (80, (0x7c90d769), 5, 64, ... (0x7c90d000), 4096, 64, ) == 0x0
 00549   868   NtWriteVirtualMemory  (80, 0x7c90d769,  (80, 0x7c90d769, "\350\207Li\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00550   868   NtClose  (80, ... ) == 0x0
 00551   868   NtMapViewOfSection  (40, -1, (0x0), 0, 0, {0, 0}, 0, 1, 0, 4, ... (0x330000), {0, 0}, 20480, ) == 0x0
 00552   868   NtUnmapViewOfSection  (-1, 0x330000, ... ) == 0x0
 00553   868   NtOpenProcess  (0x2a, {24, 0, 0x0, 0, 0, 0x0}, {1180, 0}, ... 80, ) == 0x0
 00554   868   NtOpenSection  (0xe, {24, 16, 0x0, 0, 0,  (0xe, {24, 16, 0x0, 0, 0, "W32_Virtu"}, ... 84, ) }, ... 84, ) == 0x0
 00555   868   NtMapViewOfSection  (84, 80, (0x0), 0, 27086, 0x0, 27086, 2, 1048576, 64, ... (0x7ffa0000), 0x0, 28672, ) == 0x0
 00556   868   NtClose  (84, ... ) == 0x0
 00557   868   NtProtectVirtualMemory  (80, (0x7c90d682), 5, 64, ... (0x7c90d000), 4096, 32, ) == 0x0
 00558   868   NtWriteVirtualMemory  (80, 0x7c90d682,  (80, 0x7c90d682, "\350\15Mi\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00559   868   NtProtectVirtualMemory  (80, (0x7c90dcfd), 5, 64, ... (0x7c90d000), 4096, 64, ) == 0x0
 00560   868   NtWriteVirtualMemory  (80, 0x7c90dcfd,  (80, 0x7c90dcfd, "\350\337Fi\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00561   868   NtProtectVirtualMemory  (80, (0x7c90d754), 5, 64, ... (0x7c90d000), 4096, 64, ) == 0x0
 00562   868   NtWriteVirtualMemory  (80, 0x7c90d754,  (80, 0x7c90d754, "\350\217Li\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00563   868   NtProtectVirtualMemory  (80, (0x7c90d769), 5, 64, ... (0x7c90d000), 4096, 64, ) == 0x0
 00564   868   NtWriteVirtualMemory  (80, 0x7c90d769,  (80, 0x7c90d769, "\350\207Li\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00565   868   NtClose  (80, ... ) == 0x0
 00566   868   NtMapViewOfSection  (40, -1, (0x0), 0, 0, {0, 0}, 0, 1, 0, 4, ... (0x330000), {0, 0}, 20480, ) == 0x0
 00567   868   NtUnmapViewOfSection  (-1, 0x330000, ... ) == 0x0
 00568   868   NtOpenProcess  (0x2a, {24, 0, 0x0, 0, 0, 0x0}, {1512, 0}, ... 80, ) == 0x0
 00569   868   NtOpenSection  (0xe, {24, 16, 0x0, 0, 0,  (0xe, {24, 16, 0x0, 0, 0, "W32_Virtu"}, ... 84, ) }, ... 84, ) == 0x0
 00570   868   NtMapViewOfSection  (84, 80, (0x0), 0, 27086, 0x0, 27086, 2, 1048576, 64, ... (0x7ffa0000), 0x0, 28672, ) == 0x0
 00571   868   NtClose  (84, ... ) == 0x0
 00572   868   NtProtectVirtualMemory  (80, (0x7c90d682), 5, 64, ... (0x7c90d000), 4096, 32, ) == 0x0
 00573   868   NtWriteVirtualMemory  (80, 0x7c90d682,  (80, 0x7c90d682, "\350\15Mi\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00574   868   NtProtectVirtualMemory  (80, (0x7c90dcfd), 5, 64, ... (0x7c90d000), 4096, 64, ) == 0x0
 00575   868   NtWriteVirtualMemory  (80, 0x7c90dcfd,  (80, 0x7c90dcfd, "\350\337Fi\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00576   868   NtProtectVirtualMemory  (80, (0x7c90d754), 5, 64, ... (0x7c90d000), 4096, 64, ) == 0x0
 00577   868   NtWriteVirtualMemory  (80, 0x7c90d754,  (80, 0x7c90d754, "\350\217Li\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00578   868   NtProtectVirtualMemory  (80, (0x7c90d769), 5, 64, ... (0x7c90d000), 4096, 64, ) == 0x0
 00579   868   NtWriteVirtualMemory  (80, 0x7c90d769,  (80, 0x7c90d769, "\350\207Li\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00580   868   NtClose  (80, ... ) == 0x0
 00581   868   NtMapViewOfSection  (40, -1, (0x0), 0, 0, {0, 0}, 0, 1, 0, 4, ... (0x330000), {0, 0}, 20480, ) == 0x0
 00582   868   NtUnmapViewOfSection  (-1, 0x330000, ... ) == 0x0
 00583   868   NtOpenProcess  (0x2a, {24, 0, 0x0, 0, 0, 0x0}, {1028, 0}, ... 80, ) == 0x0
 00584   868   NtOpenSection  (0xe, {24, 16, 0x0, 0, 0,  (0xe, {24, 16, 0x0, 0, 0, "W32_Virtu"}, ... 84, ) }, ... 84, ) == 0x0
 00585   868   NtMapViewOfSection  (84, 80, (0x0), 0, 27086, 0x0, 27086, 2, 1048576, 64, ... (0x7ffa0000), 0x0, 28672, ) == 0x0
 00586   868   NtClose  (84, ... ) == 0x0
 00587   868   NtProtectVirtualMemory  (80, (0x7c90d682), 5, 64, ... (0x7c90d000), 4096, 32, ) == 0x0
 00588   868   NtWriteVirtualMemory  (80, 0x7c90d682,  (80, 0x7c90d682, "\350\15Mi\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00589   868   NtProtectVirtualMemory  (80, (0x7c90dcfd), 5, 64, ... (0x7c90d000), 4096, 64, ) == 0x0
 00590   868   NtWriteVirtualMemory  (80, 0x7c90dcfd,  (80, 0x7c90dcfd, "\350\337Fi\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00591   868   NtProtectVirtualMemory  (80, (0x7c90d754), 5, 64, ... (0x7c90d000), 4096, 64, ) == 0x0
 00592   868   NtWriteVirtualMemory  (80, 0x7c90d754,  (80, 0x7c90d754, "\350\217Li\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00593   868   NtProtectVirtualMemory  (80, (0x7c90d769), 5, 64, ... (0x7c90d000), 4096, 64, ) == 0x0
 00594   868   NtWriteVirtualMemory  (80, 0x7c90d769,  (80, 0x7c90d769, "\350\207Li\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00595   868   NtClose  (80, ... ) == 0x0
 00596   868   NtMapViewOfSection  (40, -1, (0x0), 0, 0, {0, 0}, 0, 1, 0, 4, ... (0x330000), {0, 0}, 20480, ) == 0x0
 00597   868   NtUnmapViewOfSection  (-1, 0x330000, ... ) == 0x0
 00598   868   NtOpenProcess  (0x2a, {24, 0, 0x0, 0, 0, 0x0}, {1588, 0}, ... 80, ) == 0x0
 00599   868   NtOpenSection  (0xe, {24, 16, 0x0, 0, 0,  (0xe, {24, 16, 0x0, 0, 0, "W32_Virtu"}, ... 84, ) }, ... 84, ) == 0x0
 00600   868   NtMapViewOfSection  (84, 80, (0x0), 0, 27086, 0x0, 27086, 2, 1048576, 64, ... (0x7ffa0000), 0x0, 28672, ) == 0x0
 00601   868   NtClose  (84, ... ) == 0x0
 00602   868   NtProtectVirtualMemory  (80, (0x7c90d682), 5, 64, ... (0x7c90d000), 4096, 32, ) == 0x0
 00603   868   NtWriteVirtualMemory  (80, 0x7c90d682,  (80, 0x7c90d682, "\350\15Mi\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00604   868   NtProtectVirtualMemory  (80, (0x7c90dcfd), 5, 64, ... (0x7c90d000), 4096, 64, ) == 0x0
 00605   868   NtWriteVirtualMemory  (80, 0x7c90dcfd,  (80, 0x7c90dcfd, "\350\337Fi\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00606   868   NtProtectVirtualMemory  (80, (0x7c90d754), 5, 64, ... (0x7c90d000), 4096, 64, ) == 0x0
 00607   868   NtWriteVirtualMemory  (80, 0x7c90d754,  (80, 0x7c90d754, "\350\217Li\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00608   868   NtProtectVirtualMemory  (80, (0x7c90d769), 5, 64, ... (0x7c90d000), 4096, 64, ) == 0x0
 00609   868   NtWriteVirtualMemory  (80, 0x7c90d769,  (80, 0x7c90d769, "\350\207Li\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00610   868   NtClose  (80, ... ) == 0x0
 00611   868   NtMapViewOfSection  (40, -1, (0x0), 0, 0, {0, 0}, 0, 1, 0, 4, ... (0x330000), {0, 0}, 20480, ) == 0x0
 00612   868   NtUnmapViewOfSection  (-1, 0x330000, ... ) == 0x0
 00613   868   NtOpenProcess  (0x2a, {24, 0, 0x0, 0, 0, 0x0}, {940, 0}, ... 80, ) == 0x0
 00614   868   NtOpenSection  (0xe, {24, 16, 0x0, 0, 0,  (0xe, {24, 16, 0x0, 0, 0, "W32_Virtu"}, ... 84, ) }, ... 84, ) == 0x0
 00615   868   NtMapViewOfSection  (84, 80, (0x0), 0, 27086, 0x0, 27086, 2, 1048576, 64, ... (0x7ffa0000), 0x0, 28672, ) == 0x0
 00616   868   NtClose  (84, ... ) == 0x0
 00617   868   NtProtectVirtualMemory  (80, (0x7c90d682), 5, 64, ... (0x7c90d000), 4096, 32, ) == 0x0
 00618   868   NtWriteVirtualMemory  (80, 0x7c90d682,  (80, 0x7c90d682, "\350\15Mi\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00619   868   NtProtectVirtualMemory  (80, (0x7c90dcfd), 5, 64, ... (0x7c90d000), 4096, 64, ) == 0x0
 00620   868   NtWriteVirtualMemory  (80, 0x7c90dcfd,  (80, 0x7c90dcfd, "\350\337Fi\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00621   868   NtProtectVirtualMemory  (80, (0x7c90d754), 5, 64, ... (0x7c90d000), 4096, 64, ) == 0x0
 00622   868   NtWriteVirtualMemory  (80, 0x7c90d754,  (80, 0x7c90d754, "\350\217Li\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00623   868   NtProtectVirtualMemory  (80, (0x7c90d769), 5, 64, ... (0x7c90d000), 4096, 64, ) == 0x0
 00624   868   NtWriteVirtualMemory  (80, 0x7c90d769,  (80, 0x7c90d769, "\350\207Li\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00625   868   NtClose  (80, ... ) == 0x0
 00626   868   NtMapViewOfSection  (40, -1, (0x0), 0, 0, {0, 0}, 0, 1, 0, 4, ... (0x330000), {0, 0}, 20480, ) == 0x0
 00627   868   NtUnmapViewOfSection  (-1, 0x330000, ... ) == 0x0
 00628   868   NtOpenProcess  (0x2a, {24, 0, 0x0, 0, 0, 0x0}, {1228, 0}, ... 80, ) == 0x0
 00629   868   NtOpenSection  (0xe, {24, 16, 0x0, 0, 0,  (0xe, {24, 16, 0x0, 0, 0, "W32_Virtu"}, ... 84, ) }, ... 84, ) == 0x0
 00630   868   NtMapViewOfSection  (84, 80, (0x0), 0, 27086, 0x0, 27086, 2, 1048576, 64, ... (0x7ffa0000), 0x0, 28672, ) == 0x0
 00631   868   NtClose  (84, ... ) == 0x0
 00632   868   NtProtectVirtualMemory  (80, (0x7c90d682), 5, 64, ... (0x7c90d000), 4096, 32, ) == 0x0
 00633   868   NtWriteVirtualMemory  (80, 0x7c90d682,  (80, 0x7c90d682, "\350\15Mi\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00634   868   NtProtectVirtualMemory  (80, (0x7c90dcfd), 5, 64, ... (0x7c90d000), 4096, 64, ) == 0x0
 00635   868   NtWriteVirtualMemory  (80, 0x7c90dcfd,  (80, 0x7c90dcfd, "\350\337Fi\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00636   868   NtProtectVirtualMemory  (80, (0x7c90d754), 5, 64, ... (0x7c90d000), 4096, 64, ) == 0x0
 00637   868   NtWriteVirtualMemory  (80, 0x7c90d754,  (80, 0x7c90d754, "\350\217Li\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00638   868   NtProtectVirtualMemory  (80, (0x7c90d769), 5, 64, ... (0x7c90d000), 4096, 64, ) == 0x0
 00639   868   NtWriteVirtualMemory  (80, 0x7c90d769,  (80, 0x7c90d769, "\350\207Li\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00640   868   NtClose  (80, ... ) == 0x0
 00641   868   NtMapViewOfSection  (40, -1, (0x0), 0, 0, {0, 0}, 0, 1, 0, 4, ... (0x330000), {0, 0}, 20480, ) == 0x0
 00642   868   NtUnmapViewOfSection  (-1, 0x330000, ... ) == 0x0
 00643   868   NtClose  (40, ... ) == 0x0
 00644   868   NtClose  (28, ... ) == 0x0
 00645   868   NtProtectVirtualMemory  (-1, (0x4000e0), 4096, 4, ... (0x400000), 8192, 2, ) == 0x0
 00646   868   NtProtectVirtualMemory  (-1, (0x4000e0), 4096, 4, ... (0x400000), 8192, 4, ) == 0x0
 00647   868   NtAllocateVirtualMemory  (-1, 0, 0, 16777216, 4096, 64, ... 4784128, 16777216, ) == 0x0
 00648   868   NtOpenSection  (0xe, {24, 8, 0x40, 0, 0,  (0xe, {24, 8, 0x40, 0, 0, "WS2_32.dll"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00649   868   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\u:\work\WS2_32.dll"}, 1243016, ... ) }, 1243016, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00650   868   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\WS2_32.dll"}, 1243016, ... ) }, 1243016, ... ) == 0x0
 00651   868   NtOpenFile  (0x100020, {24, 0, 0x40, 0, 0,  (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\WS2_32.dll"}, 5, 96, ... 28, {status=0x0, info=1}, ) }, 5, 96, ... 28, {status=0x0, info=1}, ) == 0x0
 00652   868   NtCreateSection  (0xf, 0x0, 0x0, 16, 16777216, 28, ... 40, ) == 0x0
 00653   868   NtQuerySection  (40, Image, 48, ... {section info, class 1, size 48}, 0x0, ) == 0x0
 00654   868   NtOpenProcessToken  (-1, 0x8, ... 80, ) == 0x0
 00655   868   NtQueryInformationToken  (80, User, 136, ... {token info, class 1, size 36}, 36, ) == 0x0
 00656   868   NtOpenKey  (0x3, {24, 0, 0x40, 0, 0,  (0x3, {24, 0, 0x40, 0, 0, "\Registry\MACHINE\System\CurrentControlSet\Control\SafeBoot\Option"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00657   868   NtOpenKey  (0x1, {24, 0, 0x40, 0, 0,  (0x1, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers"}, ... 84, ) }, ... 84, ) == 0x0
 00658   868   NtQueryValueKey  (84,  (84, "TransparentEnabled", Partial, 80, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) , Partial, 80, ... TitleIdx=0, Type=4, Data= (84, "TransparentEnabled", Partial, 80, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) }, 16, ) == 0x0
 00659   868   NtClose  (84, ... ) == 0x0
 00660   868   NtOpenThreadTokenEx  (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN
 00661   868   NtOpenProcessTokenEx  (-1, 0x20008, 512, ... 84, ) == 0x0
 00662   868   NtQueryInformationToken  (84, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0
 00663   868   NtClose  (84, ... ) == 0x0
 00664   868   NtOpenKey  (0x1, {24, 0, 0x40, 0, 0,  (0x1, {24, 0, 0x40, 0, 0, "\REGISTRY\USER\S-1-5-21-1292428093-1383384898-725345543-1003\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00665   868   NtClose  (80, ... ) == 0x0
 00666   868   NtClose  (28, ... ) == 0x0
 00667   868   NtMapViewOfSection  (40, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x71ab0000), 0x0, 94208, ) == 0x0
 00668   868   NtClose  (40, ... ) == 0x0
 00669   868   NtOpenSection  (0xe, {24, 8, 0x40, 0, 0,  (0xe, {24, 8, 0x40, 0, 0, "msvcrt.dll"}, ... 40, ) }, ... 40, ) == 0x0
 00670   868   NtMapViewOfSection  (40, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x77c10000), 0x0, 360448, ) == 0x0
 00671   868   NtClose  (40, ... ) == 0x0
 00672   868   NtProtectVirtualMemory  (-1, (0x77c11000), 632, 4, ... (0x77c11000), 4096, 32, ) == 0x0
 00673   868   NtProtectVirtualMemory  (-1, (0x77c11000), 4096, 32, ... (0x77c11000), 4096, 4, ) == 0x0
 00674   868   NtFlushInstructionCache  (-1, 2009141248, 632, ... ) == 0x0
 00675   868   NtProtectVirtualMemory  (-1, (0x71ab1000), 468, 4, ... (0x71ab1000), 4096, 32, ) == 0x0
 00676   868   NtProtectVirtualMemory  (-1, (0x71ab1000), 4096, 32, ... (0x71ab1000), 4096, 4, ) == 0x0
 00677   868   NtFlushInstructionCache  (-1, 1907036160, 468, ... ) == 0x0
 00678   868   NtOpenSection  (0xe, {24, 8, 0x40, 0, 0,  (0xe, {24, 8, 0x40, 0, 0, "WS2HELP.dll"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00679   868   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\u:\work\WS2HELP.dll"}, 1242200, ... ) }, 1242200, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00680   868   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\WS2HELP.dll"}, 1242200, ... ) }, 1242200, ... ) == 0x0
 00681   868   NtOpenFile  (0x100020, {24, 0, 0x40, 0, 0,  (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\WS2HELP.dll"}, 5, 96, ... 40, {status=0x0, info=1}, ) }, 5, 96, ... 40, {status=0x0, info=1}, ) == 0x0
 00682   868   NtCreateSection  (0xf, 0x0, 0x0, 16, 16777216, 40, ... 28, ) == 0x0
 00683   868   NtQuerySection  (28, Image, 48, ... {section info, class 1, size 48}, 0x0, ) == 0x0
 00684   868   NtClose  (40, ... ) == 0x0
 00685   868   NtMapViewOfSection  (28, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x71aa0000), 0x0, 32768, ) == 0x0
 00686   868   NtClose  (28, ... ) == 0x0
 00687   868   NtProtectVirtualMemory  (-1, (0x71aa1000), 352, 4, ... (0x71aa1000), 4096, 32, ) == 0x0
 00688   868   NtProtectVirtualMemory  (-1, (0x71aa1000), 4096, 32, ... (0x71aa1000), 4096, 4, ) == 0x0
 00689   868   NtFlushInstructionCache  (-1, 1906970624, 352, ... ) == 0x0
 00690   868   NtProtectVirtualMemory  (-1, (0x71ab1000), 468, 4, ... (0x71ab1000), 4096, 32, ) == 0x0
 00691   868   NtProtectVirtualMemory  (-1, (0x71ab1000), 4096, 32, ... (0x71ab1000), 4096, 4, ) == 0x0
 00692   868   NtFlushInstructionCache  (-1, 1907036160, 468, ... ) == 0x0
 00693   868   NtOpenKey  (0x80000000, {24, 0, 0x40, 0, 0,  (0x80000000, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msvcrt.dll"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00694   868   NtQuerySystemInformation  (Basic, 44, ... {Unknown=0,MaximumIncrement=156250,PhysicalPageSize=0x1000,NumberOfPhysicalPages=0xff7c,LowestPhysicalPage=0x1,HighestPhysicalPage=0xffff,AllocationGranularity=0x10000,LowestUserAddress=0x10000,HighestUserAddress=0x7ffeffff,ActiveProcessors=1,NumberProcessors=1,}, 0x0, ) == 0x0
 00695   868   NtAllocateVirtualMemory  (-1, 0, 0, 65536, 8192, 4, ... 3342336, 65536, ) == 0x0
 00696   868   NtAllocateVirtualMemory  (-1, 3342336, 0, 4096, 4096, 4, ... 3342336, 4096, ) == 0x0
 00697   868   NtAllocateVirtualMemory  (-1, 3346432, 0, 8192, 4096, 4, ... 3346432, 8192, ) == 0x0
 00698   868   NtAllocateVirtualMemory  (-1, 3354624, 0, 4096, 4096, 4, ... 3354624, 4096, ) == 0x0
 00699   868   NtOpenSection  (0x4, {24, 0, 0x40, 0, 0,  (0x4, {24, 0, 0x40, 0, 0, "\NLS\NlsSectionCType"}, ... 28, ) }, ... 28, ) == 0x0
 00700   868   NtMapViewOfSection  (28, -1, (0x0), 0, 0, 0x0, 0, 2, 0, 2, ... (0x340000), 0x0, 12288, ) == 0x0
 00701   868   NtClose  (28, ... ) == 0x0
 00702   868   NtAllocateVirtualMemory  (-1, 3358720, 0, 4096, 4096, 4, ... 3358720, 4096, ) == 0x0
 00703   868   NtQueryVirtualMemory  (-1, 0x77c2807c, Basic, 28, ... {BaseAddress=0x77c28000,AllocationBase=0x77c10000,AllocationProtect=0x80,RegionSize=0x35000,State=0x1000,Protect=0x20,Type=0x1000000,}, 28, ) == 0x0
 00704   868   NtQueryInformationProcess  (-1, 36, 4, ... {process info, class 36, size 4}, 0x0, ) == 0x0
 00705   868   NtQueryInformationProcess  (-1, 36, 4, ... {process info, class 36, size 4}, 0x0, ) == 0x0
 00706   868   NtQueryVirtualMemory  (-1, 0x0, Basic, 28, ... {BaseAddress=0x0,AllocationBase=0x0,AllocationProtect=0x0,RegionSize=0x10000,State=0x10000,Protect=0x1,Type=0x0,}, 28, ) == 0x0
 00707   868   NtOpenKey  (0x80000000, {24, 0, 0x40, 0, 0,  (0x80000000, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\WS2HELP.dll"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00708   868   NtOpenKey  (0x80000000, {24, 0, 0x40, 0, 0,  (0x80000000, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\WS2_32.dll"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00709   868   NtQuerySystemInformation  (Basic, 44, ... {Unknown=0,MaximumIncrement=156250,PhysicalPageSize=0x1000,NumberOfPhysicalPages=0xff7c,LowestPhysicalPage=0x1,HighestPhysicalPage=0xffff,AllocationGranularity=0x10000,LowestUserAddress=0x10000,HighestUserAddress=0x7ffeffff,ActiveProcessors=1,NumberProcessors=1,}, 0x0, ) == 0x0
 00710   868   NtQuerySystemInformation  (Processor, 12, ... {system info, class 1, size 12}, 0x0, ) == 0x0
 00711   868   NtQuerySystemInformation  (Basic, 44, ... {Unknown=0,MaximumIncrement=156250,PhysicalPageSize=0x1000,NumberOfPhysicalPages=0xff7c,LowestPhysicalPage=0x1,HighestPhysicalPage=0xffff,AllocationGranularity=0x10000,LowestUserAddress=0x10000,HighestUserAddress=0x7ffeffff,ActiveProcessors=1,NumberProcessors=1,}, 0x0, ) == 0x0
 00712   868   NtAllocateVirtualMemory  (-1, 0, 0, 65536, 8192, 4, ... 3473408, 65536, ) == 0x0
 00713   868   NtAllocateVirtualMemory  (-1, 3473408, 0, 4096, 4096, 4, ... 3473408, 4096, ) == 0x0
 00714   868   NtAllocateVirtualMemory  (-1, 3477504, 0, 8192, 4096, 4, ... 3477504, 8192, ) == 0x0
 00715   868   NtAllocateVirtualMemory  (-1, 3485696, 0, 4096, 4096, 4, ... 3485696, 4096, ) == 0x0
 00716   868   NtAllocateVirtualMemory  (-1, 3489792, 0, 4096, 4096, 4, ... 3489792, 4096, ) == 0x0
 00717   868   NtQueryVirtualMemory  (-1, 0x41cd5f, Basic, 28, ... {BaseAddress=0x41c000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x61000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 00718   868   NtQueryInformationProcess  (-1, 36, 4, ... {process info, class 36, size 4}, 0x0, ) == 0x0
 00719   868   NtQueryInformationProcess  (-1, 36, 4, ... {process info, class 36, size 4}, 0x0, ) == 0x0
 00720   868   NtQueryVirtualMemory  (-1, 0x77c2807c, Basic, 28, ... {BaseAddress=0x77c28000,AllocationBase=0x77c10000,AllocationProtect=0x80,RegionSize=0x35000,State=0x1000,Protect=0x20,Type=0x1000000,}, 28, ) == 0x0
 00721   868   NtQueryPerformanceCounter  (... {926276357, 10}, {3579545, 0}, ) == 0x0
 00722   868   NtOpenSection  (0xe, {24, 8, 0x40, 0, 0,  (0xe, {24, 8, 0x40, 0, 0, "user32.dll"}, ... 28, ) }, ... 28, ) == 0x0
 00723   868   NtMapViewOfSection  (28, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x7e410000), 0x0, 589824, ) == 0x0
 00724   868   NtClose  (28, ... ) == 0x0
 00725   868   NtOpenSection  (0xe, {24, 8, 0x40, 0, 0,  (0xe, {24, 8, 0x40, 0, 0, "GDI32.dll"}, ... 28, ) }, ... 28, ) == 0x0
 00726   868   NtMapViewOfSection  (28, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x77f10000), 0x0, 290816, ) == 0x0
 00727   868   NtClose  (28, ... ) == 0x0
 00728   868   NtProtectVirtualMemory  (-1, (0x77f11000), 508, 4, ... (0x77f11000), 4096, 32, ) == 0x0
 00729   868   NtProtectVirtualMemory  (-1, (0x77f11000), 4096, 32, ... (0x77f11000), 4096, 4, ) == 0x0
 00730   868   NtFlushInstructionCache  (-1, 2012286976, 508, ... ) == 0x0
 00731   868   NtProtectVirtualMemory  (-1, (0x77f11000), 508, 4, ... (0x77f11000), 4096, 32, ) == 0x0
 00732   868   NtProtectVirtualMemory  (-1, (0x77f11000), 4096, 32, ... (0x77f11000), 4096, 4, ) == 0x0
 00733   868   NtFlushInstructionCache  (-1, 2012286976, 508, ... ) == 0x0
 00734   868   NtProtectVirtualMemory  (-1, (0x77f11000), 508, 4, ... (0x77f11000), 4096, 32, ) == 0x0
 00735   868   NtProtectVirtualMemory  (-1, (0x77f11000), 4096, 32, ... (0x77f11000), 4096, 4, ) == 0x0
 00736   868   NtFlushInstructionCache  (-1, 2012286976, 508, ... ) == 0x0
 00737   868   NtProtectVirtualMemory  (-1, (0x7e411000), 1252, 4, ... (0x7e411000), 4096, 32, ) == 0x0
 00738   868   NtProtectVirtualMemory  (-1, (0x7e411000), 4096, 32, ... (0x7e411000), 4096, 4, ) == 0x0
 00739   868   NtFlushInstructionCache  (-1, 2118193152, 1252, ... ) == 0x0
 00740   868   NtProtectVirtualMemory  (-1, (0x7e411000), 1252, 4, ... (0x7e411000), 4096, 32, ) == 0x0
 00741   868   NtProtectVirtualMemory  (-1, (0x7e411000), 4096, 32, ... (0x7e411000), 4096, 4, ) == 0x0
 00742   868   NtFlushInstructionCache  (-1, 2118193152, 1252, ... ) == 0x0
 00743   868   NtProtectVirtualMemory  (-1, (0x7e411000), 1252, 4, ... (0x7e411000), 4096, 32, ) == 0x0
 00744   868   NtProtectVirtualMemory  (-1, (0x7e411000), 4096, 32, ... (0x7e411000), 4096, 4, ) == 0x0
 00745   868   NtFlushInstructionCache  (-1, 2118193152, 1252, ... ) == 0x0
 00746   868   NtOpenKey  (0x80000000, {24, 0, 0x40, 0, 0,  (0x80000000, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\GDI32.dll"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00747   868   NtOpenKey  (0x80000000, {24, 0, 0x40, 0, 0,  (0x80000000, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\user32.dll"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00748   868   NtQuerySystemInformation  (Basic, 44, ... {Unknown=0,MaximumIncrement=156250,PhysicalPageSize=0x1000,NumberOfPhysicalPages=0xff7c,LowestPhysicalPage=0x1,HighestPhysicalPage=0xffff,AllocationGranularity=0x10000,LowestUserAddress=0x10000,HighestUserAddress=0x7ffeffff,ActiveProcessors=1,NumberProcessors=1,}, 0x0, ) == 0x0
 00749   868   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 2089900645, 0, 2090320576, 1238908}  (24, {28, 56, new_msg, 0, 2089900645, 0, 2090320576, 1238908} "\210\6\31\1\0\0\0\0\20g\24\0h\1\24\0\3\0\0\0\234\6\31\1$\1\0\0" ... {28, 56, reply, 0, 1228, 868, 57995, 0} "\320G\26\0\0\0\0\0\0\0\0\0h\1\24\0\3\0\0\0\234\6\31\1$\1\0\0" )  ... {28, 56, reply, 0, 1228, 868, 57995, 0}  (24, {28, 56, new_msg, 0, 2089900645, 0, 2090320576, 1238908} "\210\6\31\1\0\0\0\0\20g\24\0h\1\24\0\3\0\0\0\234\6\31\1$\1\0\0" ... {28, 56, reply, 0, 1228, 868, 57995, 0} "\320G\26\0\0\0\0\0\0\0\0\0h\1\24\0\3\0\0\0\234\6\31\1$\1\0\0" )  ) == 0x0
 00750   868   NtAllocateVirtualMemory  (-1, 1228800, 0, 4096, 4096, 260, ... 1228800, 4096, ) == 0x0
 00751   868   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\IMM32.DLL"}, 1236300, ... ) }, 1236300, ... ) == 0x0
 00752   868   NtOpenFile  (0x100020, {24, 0, 0x40, 0, 0,  (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\IMM32.DLL"}, 5, 96, ... 28, {status=0x0, info=1}, ) }, 5, 96, ... 28, {status=0x0, info=1}, ) == 0x0
 00753   868   NtCreateSection  (0xe, 0x0, 0x0, 16, 134217728, 28, ... 40, ) == 0x0
 00754   868   NtClose  (28, ... ) == 0x0
 00755   868   NtMapViewOfSection  (40, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 16, ... (0x360000), 0x0, 110592, ) == 0x0
 00756   868   NtClose  (40, ... ) == 0x0
 00757   868   NtUnmapViewOfSection  (-1, 0x360000, ... ) == 0x0
 00758   868   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\IMM32.DLL"}, 1236208, ... ) }, 1236208, ... ) == 0x0
 00759   868   NtOpenFile  (0x100020, {24, 0, 0x40, 0, 0,  (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\IMM32.DLL"}, 5, 96, ... 40, {status=0x0, info=1}, ) }, 5, 96, ... 40, {status=0x0, info=1}, ) == 0x0
 00760   868   NtCreateSection  (0xe, 0x0, 0x0, 16, 134217728, 40, ... 28, ) == 0x0
 00761   868   NtClose  (40, ... ) == 0x0
 00762   868   NtMapViewOfSection  (28, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 16, ... (0x360000), 0x0, 110592, ) == 0x0
 00763   868   NtClose  (28, ... ) == 0x0
 00764   868   NtUnmapViewOfSection  (-1, 0x360000, ... ) == 0x0
 00765   868   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\IMM32.DLL"}, 1236516, ... ) }, 1236516, ... ) == 0x0
 00766   868   NtOpenFile  (0x100020, {24, 0, 0x40, 0, 0,  (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\IMM32.DLL"}, 5, 96, ... 28, {status=0x0, info=1}, ) }, 5, 96, ... 28, {status=0x0, info=1}, ) == 0x0
 00767   868   NtCreateSection  (0xf, 0x0, 0x0, 16, 16777216, 28, ... 40, ) == 0x0
 00768   868   NtQuerySection  (40, Image, 48, ... {section info, class 1, size 48}, 0x0, ) == 0x0
 00769   868   NtClose  (28, ... ) == 0x0
 00770   868   NtMapViewOfSection  (40, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x76390000), 0x0, 118784, ) == 0x0
 00771   868   NtClose  (40, ... ) == 0x0
 00772   868   NtProtectVirtualMemory  (-1, (0x76391000), 696, 4, ... (0x76391000), 4096, 32, ) == 0x0
 00773   868   NtProtectVirtualMemory  (-1, (0x76391000), 4096, 32, ... (0x76391000), 4096, 4, ) == 0x0
 00774   868   NtFlushInstructionCache  (-1, 1983451136, 696, ... ) == 0x0
 00775   868   NtProtectVirtualMemory  (-1, (0x76391000), 696, 4, ... (0x76391000), 4096, 32, ) == 0x0
 00776   868   NtProtectVirtualMemory  (-1, (0x76391000), 4096, 32, ... (0x76391000), 4096, 4, ) == 0x0
 00777   868   NtFlushInstructionCache  (-1, 1983451136, 696, ... ) == 0x0
 00778   868   NtProtectVirtualMemory  (-1, (0x76391000), 696, 4, ... (0x76391000), 4096, 32, ) == 0x0
 00779   868   NtProtectVirtualMemory  (-1, (0x76391000), 4096, 32, ... (0x76391000), 4096, 4, ) == 0x0
 00780   868   NtFlushInstructionCache  (-1, 1983451136, 696, ... ) == 0x0
 00781   868   NtOpenKey  (0x80000000, {24, 0, 0x40, 0, 0,  (0x80000000, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\IMM32.DLL"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00782   868   NtQuerySystemInformation  (Basic, 44, ... {Unknown=0,MaximumIncrement=156250,PhysicalPageSize=0x1000,NumberOfPhysicalPages=0xff7c,LowestPhysicalPage=0x1,HighestPhysicalPage=0xffff,AllocationGranularity=0x10000,LowestUserAddress=0x10000,HighestUserAddress=0x7ffeffff,ActiveProcessors=1,NumberProcessors=1,}, 0x0, ) == 0x0
 00783   868   NtAllocateVirtualMemory  (-1, 1224704, 0, 4096, 4096, 260, ... 1224704, 4096, ) == 0x0
 00784   868   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\IMM32.DLL"}, 1233432, ... ) }, 1233432, ... ) == 0x0
 00785   868   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\IMM32.DLL"}, 1236836, ... ) }, 1236836, ... ) == 0x0
 00786   868   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\System\CurrentControlSet\Control\Error Message Instrument\"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00787   868   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\GRE_Initialize"}, ... 40, ) }, ... 40, ) == 0x0
 00788   868   NtQueryValueKey  (40,  (40, "DisableMetaFiles", Partial, 20, ... ) , Partial, 20, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00789   868   NtClose  (40, ... ) == 0x0
 00790   868   NtMapViewOfSection  (-2147482740, -1, (0x0), 0, 0, 0x0, 0, 2, 0, 2, ... (0x1560000), 0x0, 1060864, ) == 0x0
 00791   868   NtClose  (-2147482740, ... ) == 0x0
 00792   868   NtCreateEvent  (0x1f0003, 0x0, 1, 0, ... 40, ) == 0x0
 00793   868   NtOpenThreadTokenEx  (-2, 0x8, 1, 512, ... ) == STATUS_NO_TOKEN
 00794   868   NtOpenProcessTokenEx  (-1, 0x8, 512, ... -2147482740, ) == 0x0
 00795   868   NtQueryInformationToken  (-2147482740, Statistics, 0, ... ) == STATUS_BUFFER_TOO_SMALL
 00796   868   NtQueryInformationToken  (-2147482740, Statistics, 56, ... {token info, class 10, size 56}, 56, ) == 0x0
 00797   868   NtClose  (-2147482740, ... ) == 0x0
 00798   868   NtAllocateVirtualMemory  (-1, 0, 0, 32, 4096, 4, ... 3538944, 4096, ) == 0x0
 00799   868   NtFreeVirtualMemory  (-1, (0x360000), 4096, 32768, ... (0x360000), 4096, ) == 0x0
 00800   868   NtDuplicateObject  (-1, 28, -1, 0x0, 0, 2, ... 84, ) == 0x0
 00801   868   NtOpenKey  (0x20019, {24, 0, 0x240, 0, 0,  (0x20019, {24, 0, 0x240, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Compatibility32"}, ... -2147482740, ) }, ... -2147482740, ) == 0x0
 00802   868   NtQueryValueKey  (-2147482740,  (-2147482740, "packed", Partial, 172, ... ) , Partial, 172, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00803   868   NtClose  (-2147482740, ... ) == 0x0
 00804   868   NtOpenKey  (0x20019, {24, 0, 0x240, 0, 0,  (0x20019, {24, 0, 0x240, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\IME Compatibility"}, ... -2147482740, ) }, ... -2147482740, ) == 0x0
 00805   868   NtQueryValueKey  (-2147482740,  (-2147482740, "packed", Partial, 172, ... ) , Partial, 172, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00806   868   NtClose  (-2147482740, ... ) == 0x0
 00807   868   NtQueryDefaultLocale  (0, -140494516, ... ) == 0x0
 00808   868   NtAllocateVirtualMemory  (-1, 1339392, 0, 4096, 4096, 4, ... 1339392, 4096, ) == 0x0
 00809   868   NtGdiQueryFontAssocInfo  (0, ... ) == 0x0
 00810   868   NtUserCallNoParam  (24, ... ) == 0x0
 00811   868   NtGdiCreateCompatibleDC  (0, ...
 00812   868   NtAllocateVirtualMemory  (-1, 0, 0, 4096, 12288, 4, ... 3538944, 4096, ) == 0x0
 00811   868   NtGdiCreateCompatibleDC  ... ) == 0xee0105b0
 00813   868   NtGdiGetStockObject  (0, ... ) == 0x1900010
 00814   868   NtGdiGetStockObject  (4, ... ) == 0x1900011
 00815   868   NtGdiCreateBitmap  (8, 8, 1, 1, 2118200212, ... ) == 0x76050581
 00816   868   NtGdiCreateSolidBrush  (0, 0, ...
 00817   868   NtAllocateVirtualMemory  (-1, 0, 0, 4096, 12288, 4, ... 3604480, 4096, ) == 0x0
 00816   868   NtGdiCreateSolidBrush  ... ) == 0xa51003d2
 00818   868   NtGdiGetStockObject  (13, ... ) == 0x18a0021
 00819   868   NtGdiCreateCompatibleDC  (0, ... ) == 0x5201039b
 00820   868   NtGdiSelectBitmap  (1375798171, 1980040577, ... ) == 0x185000f
 00821   868   NtUserGetThreadDesktop  (868, 0, ... ) == 0x50
 00822   868   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Windows"}, ... 88, ) }, ... 88, ) == 0x0
 00823   868   NtQueryValueKey  (88,  (88, "AppInit_DLLs", Partial, 64, ... TitleIdx=0, Type=1, Data="\0\0"}, 14, ) , Partial, 64, ... TitleIdx=0, Type=1, Data= (88, "AppInit_DLLs", Partial, 64, ... TitleIdx=0, Type=1, Data="\0\0"}, 14, ) }, 14, ) == 0x0
 00824   868   NtClose  (88, ... ) == 0x0
 00825   868   NtUserFindExistingCursorIcon  (1238012, 1238028, 1238076, ... ) == 0x10011
 00826   868   NtUserRegisterClassExWOW  (1238024, 1238092, 1238108, 1238124, 673, 128, 0, ... ) == 0x81b1c017
 00827   868   NtUserFindExistingCursorIcon  (1238012, 1238028, 1238076, ... ) == 0x10011
 00828   868   NtUserRegisterClassExWOW  (1238024, 1238092, 1238108, 1238124, 674, 128, 0, ... ) == 0x81b1c01c
 00829   868   NtUserFindExistingCursorIcon  (1238012, 1238028, 1238076, ... ) == 0x10011
 00830   868   NtUserRegisterClassExWOW  (1238024, 1238092, 1238108, 1238124, 675, 128, 0, ... ) == 0x81b1c01e
 00831   868   NtUserFindExistingCursorIcon  (1238012, 1238028, 1238076, ... ) == 0x10011
 00832   868   NtUserRegisterClassExWOW  (1238024, 1238092, 1238108, 1238124, 676, 128, 0, ... ) == 0x81b18002
 00833   868   NtUserFindExistingCursorIcon  (1238012, 1238028, 1238076, ... ) == 0x10013
 00834   868   NtUserRegisterClassExWOW  (1238024, 1238092, 1238108, 1238124, 677, 128, 0, ... ) == 0x81b1c018
 00835   868   NtUserFindExistingCursorIcon  (1238012, 1238028, 1238076, ... ) == 0x10011
 00836   868   NtUserRegisterClassExWOW  (1238024, 1238092, 1238108, 1238124, 678, 128, 0, ... ) == 0x81b1c01a
 00837   868   NtUserFindExistingCursorIcon  (1238012, 1238028, 1238076, ... ) == 0x10011
 00838   868   NtUserRegisterClassExWOW  (1238024, 1238092, 1238108, 1238124, 679, 128, 0, ... ) == 0x81b1c01d
 00839   868   NtUserFindExistingCursorIcon  (1238012, 1238028, 1238076, ... ) == 0x10011
 00840   868   NtUserRegisterClassExWOW  (1238024, 1238092, 1238108, 1238124, 681, 128, 0, ... ) == 0x81b1c026
 00841   868   NtUserFindExistingCursorIcon  (1238012, 1238028, 1238076, ... ) == 0x10011
 00842   868   NtUserRegisterClassExWOW  (1238024, 1238092, 1238108, 1238124, 680, 128, 0, ... ) == 0x81b1c019
 00843   868   NtUserRegisterClassExWOW  (1237976, 1238044, 1238060, 1238076, 0, 128, 0, ... ) == 0x81b1c020
 00844   868   NtUserRegisterClassExWOW  (1238232, 1238328, 1238312, 1238300, 0, 130, 0, ... ) == 0x81b1c022
 00845   868   NtUserRegisterClassExWOW  (1237976, 1238044, 1238060, 1238076, 0, 128, 0, ... ) == 0x81b1c023
 00846   868   NtUserRegisterClassExWOW  (1238232, 1238328, 1238312, 1238300, 0, 130, 0, ... ) == 0x81b1c024
 00847   868   NtUserRegisterClassExWOW  (1237976, 1238044, 1238060, 1238076, 0, 128, 0, ... ) == 0x81b1c025
 00848   868   NtCallbackReturn  (0, 0, 0, ...
 00849   868   NtGdiInit  (... ) == 0x1
 00850   868   NtGdiGetStockObject  (18, ... ) == 0x290001c
 00851   868   NtGdiGetStockObject  (19, ... ) == 0x1b00019
 00852   868   NtOpenSection  (0xe, {24, 8, 0x40, 0, 0,  (0xe, {24, 8, 0x40, 0, 0, "wininet.dll"}, ... 88, ) }, ... 88, ) == 0x0
 00853   868   NtMapViewOfSection  (88, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x42c10000), 0x0, 847872, ) == 0x0
 00854   868   NtClose  (88, ... ) == 0x0
 00855   868   NtProtectVirtualMemory  (-1, (0x42c11000), 1452, 4, ... (0x42c11000), 4096, 32, ) == 0x0
 00856   868   NtProtectVirtualMemory  (-1, (0x42c11000), 4096, 32, ... (0x42c11000), 4096, 4, ) == 0x0
 00857   868   NtFlushInstructionCache  (-1, 1119948800, 1452, ... ) == 0x0
 00858   868   NtProtectVirtualMemory  (-1, (0x42c11000), 1452, 4, ... (0x42c11000), 4096, 32, ) == 0x0
 00859   868   NtProtectVirtualMemory  (-1, (0x42c11000), 4096, 32, ... (0x42c11000), 4096, 4, ) == 0x0
 00860   868   NtFlushInstructionCache  (-1, 1119948800, 1452, ... ) == 0x0
 00861   868   NtOpenSection  (0xe, {24, 8, 0x40, 0, 0,  (0xe, {24, 8, 0x40, 0, 0, "SHLWAPI.dll"}, ... 88, ) }, ... 88, ) == 0x0
 00862   868   NtMapViewOfSection  (88, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x77f60000), 0x0, 483328, ) == 0x0
 00863   868   NtClose  (88, ... ) == 0x0
 00864   868   NtProtectVirtualMemory  (-1, (0x77f61000), 2076, 4, ... (0x77f61000), 4096, 32, ) == 0x0
 00865   868   NtProtectVirtualMemory  (-1, (0x77f61000), 4096, 32, ... (0x77f61000), 4096, 4, ) == 0x0
 00866   868   NtFlushInstructionCache  (-1, 2012614656, 2076, ... ) == 0x0
 00867   868   NtProtectVirtualMemory  (-1, (0x77f61000), 2076, 4, ... (0x77f61000), 4096, 32, ) == 0x0
 00868   868   NtProtectVirtualMemory  (-1, (0x77f61000), 4096, 32, ... (0x77f61000), 4096, 4, ) == 0x0
 00869   868   NtFlushInstructionCache  (-1, 2012614656, 2076, ... ) == 0x0
 00870   868   NtProtectVirtualMemory  (-1, (0x77f61000), 2076, 4, ... (0x77f61000), 4096, 32, ) == 0x0
 00871   868   NtProtectVirtualMemory  (-1, (0x77f61000), 4096, 32, ... (0x77f61000), 4096, 4, ) == 0x0
 00872   868   NtFlushInstructionCache  (-1, 2012614656, 2076, ... ) == 0x0
 00873   868   NtProtectVirtualMemory  (-1, (0x77f61000), 2076, 4, ... (0x77f61000), 4096, 32, ) == 0x0
 00874   868   NtProtectVirtualMemory  (-1, (0x77f61000), 4096, 32, ... (0x77f61000), 4096, 4, ) == 0x0
 00875   868   NtFlushInstructionCache  (-1, 2012614656, 2076, ... ) == 0x0
 00876   868   NtProtectVirtualMemory  (-1, (0x77f61000), 2076, 4, ... (0x77f61000), 4096, 32, ) == 0x0
 00877   868   NtProtectVirtualMemory  (-1, (0x77f61000), 4096, 32, ... (0x77f61000), 4096, 4, ) == 0x0
 00878   868   NtFlushInstructionCache  (-1, 2012614656, 2076, ... ) == 0x0
 00879   868   NtProtectVirtualMemory  (-1, (0x42c11000), 1452, 4, ... (0x42c11000), 4096, 32, ) == 0x0
 00880   868   NtProtectVirtualMemory  (-1, (0x42c11000), 4096, 32, ... (0x42c11000), 4096, 4, ) == 0x0
 00881   868   NtFlushInstructionCache  (-1, 1119948800, 1452, ... ) == 0x0
 00882   868   NtProtectVirtualMemory  (-1, (0x42c11000), 1452, 4, ... (0x42c11000), 4096, 32, ) == 0x0
 00883   868   NtProtectVirtualMemory  (-1, (0x42c11000), 4096, 32, ... (0x42c11000), 4096, 4, ) == 0x0
 00884   868   NtFlushInstructionCache  (-1, 1119948800, 1452, ... ) == 0x0
 00885   868   NtProtectVirtualMemory  (-1, (0x42c11000), 1452, 4, ... (0x42c11000), 4096, 32, ) == 0x0
 00886   868   NtProtectVirtualMemory  (-1, (0x42c11000), 4096, 32, ... (0x42c11000), 4096, 4, ) == 0x0
 00887   868   NtFlushInstructionCache  (-1, 1119948800, 1452, ... ) == 0x0
 00888   868   NtProtectVirtualMemory  (-1, (0x42c11000), 1452, 4, ... (0x42c11000), 4096, 32, ) == 0x0
 00889   868   NtProtectVirtualMemory  (-1, (0x42c11000), 4096, 32, ... (0x42c11000), 4096, 4, ) == 0x0
 00890   868   NtFlushInstructionCache  (-1, 1119948800, 1452, ... ) == 0x0
 00891   868   NtOpenSection  (0xe, {24, 8, 0x40, 0, 0,  (0xe, {24, 8, 0x40, 0, 0, "Normaliz.dll"}, ... 88, ) }, ... 88, ) == 0x0
 00892   868   NtMapViewOfSection  (88, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x380000), 0x0, 36864, ) == STATUS_IMAGE_NOT_AT_BASE
 00893   868   NtProtectVirtualMemory  (-1, (0x381000), 18944, 4, ... (0x381000), 20480, 32, ) == 0x0
 00894   868   NtProtectVirtualMemory  (-1, (0x387000), 1024, 4, ... (0x387000), 4096, 2, ) == 0x0
 00895   868   NtProtectVirtualMemory  (-1, (0x388000), 1536, 4, ... (0x388000), 4096, 2, ) == 0x0
 00896   868   NtMapViewOfSection  (88, -1, (0x380000), 0, 0, 0x0, 36864, 1, 0, 4, ... ) == STATUS_CONFLICTING_ADDRESSES
 00897   868   NtProtectVirtualMemory  (-1, (0x381000), 18944, 16, ... (0x381000), 20480, 4, ) == 0x0
 00898   868   NtProtectVirtualMemory  (-1, (0x387000), 1024, 2, ... (0x387000), 4096, 8, ) == 0x0
 00899   868   NtProtectVirtualMemory  (-1, (0x388000), 1536, 2, ... (0x388000), 4096, 8, ) == 0x0
 00900   868   NtFlushInstructionCache  (-1, 0, 0, ... ) == 0x0
 00901   868   NtClose  (88, ... ) == 0x0
 00902   868   NtProtectVirtualMemory  (-1, (0x381000), 160, 4, ... (0x381000), 4096, 16, ) == 0x0
 00903   868   NtProtectVirtualMemory  (-1, (0x381000), 4096, 16, ... (0x381000), 4096, 4, ) == 0x0
 00904   868   NtFlushInstructionCache  (-1, 3674112, 160, ... ) == 0x0
 00905   868   NtProtectVirtualMemory  (-1, (0x381000), 160, 4, ... (0x381000), 4096, 16, ) == 0x0
 00906   868   NtProtectVirtualMemory  (-1, (0x381000), 4096, 16, ... (0x381000), 4096, 4, ) == 0x0
 00907   868   NtFlushInstructionCache  (-1, 3674112, 160, ... ) == 0x0
 00908   868   NtProtectVirtualMemory  (-1, (0x381000), 160, 4, ... (0x381000), 4096, 16, ) == 0x0
 00909   868   NtProtectVirtualMemory  (-1, (0x381000), 4096, 16, ... (0x381000), 4096, 4, ) == 0x0
 00910   868   NtFlushInstructionCache  (-1, 3674112, 160, ... ) == 0x0
 00911   868   NtProtectVirtualMemory  (-1, (0x42c11000), 1452, 4, ... (0x42c11000), 4096, 32, ) == 0x0
 00912   868   NtProtectVirtualMemory  (-1, (0x42c11000), 4096, 32, ... (0x42c11000), 4096, 4, ) == 0x0
 00913   868   NtFlushInstructionCache  (-1, 1119948800, 1452, ... ) == 0x0
 00914   868   NtOpenSection  (0xe, {24, 8, 0x40, 0, 0,  (0xe, {24, 8, 0x40, 0, 0, "iertutil.dll"}, ... 88, ) }, ... 88, ) == 0x0
 00915   868   NtMapViewOfSection  (88, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x42990000), 0x0, 282624, ) == 0x0
 00916   868   NtClose  (88, ... ) == 0x0
 00917   868   NtProtectVirtualMemory  (-1, (0x42991000), 616, 4, ... (0x42991000), 4096, 32, ) == 0x0
 00918   868   NtProtectVirtualMemory  (-1, (0x42991000), 4096, 32, ... (0x42991000), 4096, 4, ) == 0x0
 00919   868   NtFlushInstructionCache  (-1, 1117327360, 616, ... ) == 0x0
 00920   868   NtProtectVirtualMemory  (-1, (0x42991000), 616, 4, ... (0x42991000), 4096, 32, ) == 0x0
 00921   868   NtProtectVirtualMemory  (-1, (0x42991000), 4096, 32, ... (0x42991000), 4096, 4, ) == 0x0
 00922   868   NtFlushInstructionCache  (-1, 1117327360, 616, ... ) == 0x0
 00923   868   NtProtectVirtualMemory  (-1, (0x42991000), 616, 4, ... (0x42991000), 4096, 32, ) == 0x0
 00924   868   NtProtectVirtualMemory  (-1, (0x42991000), 4096, 32, ... (0x42991000), 4096, 4, ) == 0x0
 00925   868   NtFlushInstructionCache  (-1, 1117327360, 616, ... ) == 0x0
 00926   868   NtProtectVirtualMemory  (-1, (0x42991000), 616, 4, ... (0x42991000), 4096, 32, ) == 0x0
 00927   868   NtProtectVirtualMemory  (-1, (0x42991000), 4096, 32, ... (0x42991000), 4096, 4, ) == 0x0
 00928   868   NtFlushInstructionCache  (-1, 1117327360, 616, ... ) == 0x0
 00929   868   NtProtectVirtualMemory  (-1, (0x42991000), 616, 4, ... (0x42991000), 4096, 32, ) == 0x0
 00930   868   NtProtectVirtualMemory  (-1, (0x42991000), 4096, 32, ... (0x42991000), 4096, 4, ) == 0x0
 00931   868   NtFlushInstructionCache  (-1, 1117327360, 616, ... ) == 0x0
 00932   868   NtProtectVirtualMemory  (-1, (0x42991000), 616, 4, ... (0x42991000), 4096, 32, ) == 0x0
 00933   868   NtProtectVirtualMemory  (-1, (0x42991000), 4096, 32, ... (0x42991000), 4096, 4, ) == 0x0
 00934   868   NtFlushInstructionCache  (-1, 1117327360, 616, ... ) == 0x0
 00935   868   NtProtectVirtualMemory  (-1, (0x42c11000), 1452, 4, ... (0x42c11000), 4096, 32, ) == 0x0
 00936   868   NtProtectVirtualMemory  (-1, (0x42c11000), 4096, 32, ... (0x42c11000), 4096, 4, ) == 0x0
 00937   868   NtFlushInstructionCache  (-1, 1119948800, 1452, ... ) == 0x0
 00938   868   NtOpenKey  (0x80000000, {24, 0, 0x40, 0, 0,  (0x80000000, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SHLWAPI.dll"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00939   868   NtOpenKey  (0x2000000, {24, 36, 0x40, 0, 0,  (0x2000000, {24, 36, 0x40, 0, 0, "Software\Microsoft\Windows\CurrentVersion\Explorer\Performance"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00940   868   NtCreateSemaphore  (0x1f0003, {24, 16, 0x80, 1339880, 0,  (0x1f0003, {24, 16, 0x80, 1339880, 0, "shell.{A48F1A32-A340-11D1-BC6B-00A0C90312E1}"}, 0, 2147483647, ... 88, ) }, 0, 2147483647, ... 88, ) == STATUS_OBJECT_NAME_EXISTS
 00941   868   NtOpenKey  (0x80000000, {24, 0, 0x40, 0, 0,  (0x80000000, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Normaliz.dll"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00942   868   NtOpenKey  (0x80000000, {24, 0, 0x40, 0, 0,  (0x80000000, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\iertutil.dll"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00943   868   NtQueryPerformanceCounter  (... {926358845, 10}, {3579545, 0}, ) == 0x0
 00944   868   NtOpenKey  (0x80000000, {24, 0, 0x40, 0, 0,  (0x80000000, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wininet.dll"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00945   868   NtQueryPerformanceCounter  (... {926359157, 10}, {3579545, 0}, ) == 0x0
 00946   868   NtAllocateVirtualMemory  (-1, 1343488, 0, 8192, 4096, 4, ... 1343488, 8192, ) == 0x0
 00947   868   NtQuerySystemInformation  (Basic, 44, ... {Unknown=0,MaximumIncrement=156250,PhysicalPageSize=0x1000,NumberOfPhysicalPages=0xff7c,LowestPhysicalPage=0x1,HighestPhysicalPage=0xffff,AllocationGranularity=0x10000,LowestUserAddress=0x10000,HighestUserAddress=0x7ffeffff,ActiveProcessors=1,NumberProcessors=1,}, 0x0, ) == 0x0
 00948   868   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ... 26673152, 1048576, ) == 0x0
 00949   868   NtAllocateVirtualMemory  (-1, 26673152, 0, 4096, 4096, 4, ... 26673152, 4096, ) == 0x0
 00950   868   NtAllocateVirtualMemory  (-1, 26677248, 0, 8192, 4096, 4, ... 26677248, 8192, ) == 0x0
 00951   868   NtCreateEvent  (0x1f0003, 0x0, 0, 0, ... 92, ) == 0x0
 00952   868   NtCreateFile  (0xc0100080, {24, 0, 0x40, 0, 1239680,  (0xc0100080, {24, 0, 0x40, 0, 1239680, "\??\WMIDataDevice"}, 0x0, 128, 0, 1, 64, 0, 0, ... 96, {status=0x0, info=0}, ) }, 0x0, 128, 0, 1, 64, 0, 0, ... 96, {status=0x0, info=0}, ) == 0x0
 00953   868   NtCreateEvent  (0x1f0003, 0x0, 1, 0, ... 100, ) == 0x0
 00954   868   NtDeviceIoControlFile  (96, 100, 0x0, 0x12eae0, 0x22414c,  (96, 100, 0x0, 0x12eae0, 0x22414c, "(\353\22\0\0\0\0\0\1\0\0\0\2\0\0\0\24\0\0\0\34\0\0\0P\0\0\0\0\0\0\0L\0\0\0\0\0\0\0\2\0\0\0U\4\376\14\272\223\15D\243\376U9s\320\267#\0\20\10\0\0\0\0\0\0\0\0\0U\4\376\14\272\223\15D\243\376U9s\320\267#\0\0\10\0\0\0\0\0\0\0\0\0\2\0\0\0", 104, 80, ... , 104, 80, ...
 00955   868   NtOpenKey  (0x82000000, {24, 0, 0x240, 0, 0,  (0x82000000, {24, 0, 0x240, 0, 0, "\Registry\Machine\System\CurrentControlSet\Control\WMI\Security"}, ... -2147482740, ) }, ... -2147482740, ) == 0x0
 00956   868   NtQueryValueKey  (-2147482740,  (-2147482740, "DF8480A1-7492-4F45-AB78-1084642581FB", Full, 130, ... ) , Full, 130, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00957   868   NtQueryValueKey  (-2147482740,  (-2147482740, "00000000-0000-0000-0000-000000000000", Full, 130, ... ) , Full, 130, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00958   868   NtClose  (-2147482740, ... ) == 0x0
 00959   868   NtClose  (908, ... ) == 0x0
 00954   868   NtDeviceIoControlFile  ... {status=0x0, info=80},  ... {status=0x0, info=80}, "\200z\4\342\0\0\0\0U\4\376\14\272\223\15D\243\376U9s\320\267#u\0l\0t\06\300\0\0\0\0\0\0\0\0\2\0\0\0U\4\376\14\272\223\15D\243\376U9s\320\267#\0\20\10\0h\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0", ) , ) == 0x0
 00960   868   NtCreateFile  (0xc0100080, {24, 0, 0x40, 0, 1239896,  (0xc0100080, {24, 0, 0x40, 0, 1239896, "\??\WMIDataDevice"}, 0x0, 128, 0, 1, 64, 0, 0, ... 108, {status=0x0, info=0}, ) }, 0x0, 128, 0, 1, 64, 0, 0, ... 108, {status=0x0, info=0}, ) == 0x0
 00961   868   NtCreateEvent  (0x1f0003, 0x0, 1, 0, ... 112, ) == 0x0
 00962   868   NtDuplicateObject  (-1, -1, -1, 0x0, 0, 2, ... 116, ) == 0x0
 00963   868   NtCreateEvent  (0x1f0003, 0x0, 1, 0, ... 120, ) == 0x0
 00964   868   NtCreateEvent  (0x1f0003, 0x0, 1, 0, ... 124, ) == 0x0
 00965   868   NtAllocateVirtualMemory  (-1, 26685440, 0, 8192, 4096, 4, ... 26685440, 8192, ) == 0x0
 00966   868   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ... 27721728, 1048576, ) == 0x0
 00967   868   NtAllocateVirtualMemory  (-1, 28762112, 0, 8192, 4096, 4, ... 28762112, 8192, ) == 0x0
 00968   868   NtProtectVirtualMemory  (-1, (0x1b6e000), 4096, 260, ... (0x1b6e000), 4096, 4, ) == 0x0
 00969   868   NtCreateThread  (0x1f03ff, 0x0, -1, 1238980, 1238924, 1, ... 128, {1228, 484}, ) == 0x0
 00970   868   NtQueryInformationThread  (128, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ffde000,Pid=1228,Tid=484,}, 0x0, ) == 0x0
 00971   868   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 17, 1239748, 1319072, 26673528}  (24, {28, 56, new_msg, 0, 17, 1239748, 1319072, 26673528} "\0\0\0\0\1\0\1\0\200\0\0\0(\2\0\0\200\0\0\0\314\4\0\0\344\1\0\0" ... {28, 56, reply, 0, 1228, 868, 57996, 0} "\0\0\0\0\1\0\1\0\0\0\0\0(\2\0\0\200\0\0\0\314\4\0\0\344\1\0\0" )  ... {28, 56, reply, 0, 1228, 868, 57996, 0}  (24, {28, 56, new_msg, 0, 17, 1239748, 1319072, 26673528} "\0\0\0\0\1\0\1\0\200\0\0\0(\2\0\0\200\0\0\0\314\4\0\0\344\1\0\0" ... {28, 56, reply, 0, 1228, 868, 57996, 0} "\0\0\0\0\1\0\1\0\0\0\0\0(\2\0\0\200\0\0\0\314\4\0\0\344\1\0\0" )  ) == 0x0
 00972   868   NtResumeThread  (128, ... 1, ) == 0x0
 00973   868   NtClose  (128, ... ) == 0x0
 00974   868   NtSetEvent  (112, ... 0x0, ) == 0x0
 00975   868   NtSetEvent  (92, ...
 00976   484   NtCreateEvent  (0x100003, 0x0, 1, 0, ... 128, ) == 0x0
 00977   484   NtWaitForSingleObject  (128, 0, 0x0, ...
 00975   868   NtSetEvent  ... 0x0, ) == 0x0
 00978   868   NtClose  (92, ... ) == 0x0
 00979   868   NtCreateEvent  (0x1f0003, 0x0, 0, 0, ... 92, ) == 0x0
 00980   868   NtAllocateVirtualMemory  (-1, 26693632, 0, 4096, 4096, 4, ... 26693632, 4096, ) == 0x0
 00981   868   NtDeviceIoControlFile  (96, 100, 0x0, 0x12eae0, 0x22414c,  (96, 100, 0x0, 0x12eae0, 0x22414c, "(\353\22\0\0\0\0\0\2\0\0\0\2\0\0\0\24\0\0\0\34\0\0\0P\0\0\0\0\0\0\0L\0\0\0\0\0\0\0\2\0\0\0\254\253\177yX{\226G\271$\325\21x\245\234\344\0\20\10\0\0\0\0\0\0\0\0\0\254\253\177yX{\226G\271$\325\21x\245\234\344\0\0\10\0\0\0\0\0\0\0\0\0\2\0\0\0", 104, 80, ... , 104, 80, ...
 00982   868   NtOpenKey  (0x82000000, {24, 0, 0x240, 0, 0,  (0x82000000, {24, 0, 0x240, 0, 0, "\Registry\Machine\System\CurrentControlSet\Control\WMI\Security"}, ... -2147482740, ) }, ... -2147482740, ) == 0x0
 00983   868   NtQueryValueKey  (-2147482740,  (-2147482740, "DF8480A1-7492-4F45-AB78-1084642581FB", Full, 130, ... ) , Full, 130, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00984   868   NtQueryValueKey  (-2147482740,  (-2147482740, "00000000-0000-0000-0000-000000000000", Full, 130, ... ) , Full, 130, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00985   868   NtClose  (-2147482740, ... ) == 0x0
 00986   868   NtClose  (908, ... ) == 0x0
 00981   868   NtDeviceIoControlFile  ... {status=0x0, info=80},  ... {status=0x0, info=80}, "\210\2774\341\0\0\0\0\254\253\177yX{\226G\271$\325\21x\245\234\344\5\4\15\4CMDa\0\0\0\0\0\0\0\0\2\0\0\0\254\253\177yX{\226G\271$\325\21x\245\234\344\0\20\10\0\204\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0", ) , ) == 0x0
 00987   868   NtSetEvent  (112, ... 0x0, ) == 0x0
 00988   868   NtSetEvent  (92, ... 0x0, ) == 0x0
 00989   868   NtClose  (92, ... ) == 0x0
 00990   868   NtOpenThreadToken  (-2, 0x8, 0, ... ) == STATUS_NO_TOKEN
 00991   868   NtOpenProcessToken  (-1, 0xa, ... 92, ) == 0x0
 00992   868   NtDuplicateToken  (92, 0xc, {24, 0, 0x0, 0, 1240164, 0x0}, 0, 2, ... 136, ) == 0x0
 00993   868   NtClose  (92, ... ) == 0x0
 00994   868   NtAccessCheck  (1345664, 136, 0x1, 1240240, 1240292, 56, 1240272, ... (0x1), ) == 0x0
 00995   868   NtClose  (136, ... ) == 0x0
 00996   868   NtQueryDefaultUILanguage  (1239044, ...
 00997   868   NtOpenThreadTokenEx  (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN
 00998   868   NtOpenProcessTokenEx  (-1, 0x20008, 512, ... -2147482740, ) == 0x0
 00999   868   NtQueryInformationToken  (-2147482740, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0
 01000   868   NtClose  (-2147482740, ... ) == 0x0
 01001   868   NtOpenKey  (0x2000000, {24, 0, 0x640, 0, 0,  (0x2000000, {24, 0, 0x640, 0, 0, "\REGISTRY\USER\S-1-5-21-1292428093-1383384898-725345543-1003"}, ... -2147482740, ) }, ... -2147482740, ) == 0x0
 01002   868   NtOpenKey  (0x80000000, {24, -2147482740, 0x240, 0, 0,  (0x80000000, {24, -2147482740, 0x240, 0, 0, "Software\Policies\Microsoft\Control Panel\Desktop"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01003   868   NtOpenKey  (0x80000000, {24, -2147482740, 0x640, 0, 0,  (0x80000000, {24, -2147482740, 0x640, 0, 0, "Control Panel\Desktop"}, ... -2147481328, ) }, ... -2147481328, ) == 0x0
 01004   868   NtQueryValueKey  (-2147481328,  (-2147481328, "MultiUILanguageId", Partial, 256, ... ) , Partial, 256, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01005   868   NtClose  (-2147481328, ... ) == 0x0
 01006   868   NtClose  (-2147482740, ... ) == 0x0
 00996   868   NtQueryDefaultUILanguage  ... ) == 0x0
 01007   868   NtOpenFile  (0x1200a9, {24, 0, 0x40, 0, 0,  (0x1200a9, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\wininet.dll.123.Manifest"}, 1, 96, ... ) }, 1, 96, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01008   868   NtQueryDefaultUILanguage  (2090319928, ...
 01009   868   NtOpenThreadTokenEx  (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN
 01010   868   NtOpenProcessTokenEx  (-1, 0x20008, 512, ... -2147482740, ) == 0x0
 01011   868   NtQueryInformationToken  (-2147482740, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0
 01012   868   NtClose  (-2147482740, ... ) == 0x0
 01013   868   NtOpenKey  (0x2000000, {24, 0, 0x640, 0, 0,  (0x2000000, {24, 0, 0x640, 0, 0, "\REGISTRY\USER\S-1-5-21-1292428093-1383384898-725345543-1003"}, ... -2147482740, ) }, ... -2147482740, ) == 0x0
 01014   868   NtOpenKey  (0x80000000, {24, -2147482740, 0x240, 0, 0,  (0x80000000, {24, -2147482740, 0x240, 0, 0, "Software\Policies\Microsoft\Control Panel\Desktop"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01015   868   NtOpenKey  (0x80000000, {24, -2147482740, 0x640, 0, 0,  (0x80000000, {24, -2147482740, 0x640, 0, 0, "Control Panel\Desktop"}, ... -2147481328, ) }, ... -2147481328, ) == 0x0
 01016   868   NtQueryValueKey  (-2147481328,  (-2147481328, "MultiUILanguageId", Partial, 256, ... ) , Partial, 256, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01017   868   NtClose  (-2147481328, ... ) == 0x0
 01018   868   NtClose  (-2147482740, ... ) == 0x0
 01008   868   NtQueryDefaultUILanguage  ... ) == 0x0
 01019   868   NtQueryInstallUILanguage  (2090319930, ... ) == 0x0
 01020   868   NtQueryDefaultLocale  (1, 1237140, ... ) == 0x0
 01021   868   NtOpenFile  (0x1200a9, {24, 0, 0x40, 0, 0,  (0x1200a9, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\wininet.dll.123.Config"}, 1, 96, ... ) }, 1, 96, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01022   868   NtRequestWaitReplyPort  (24, {128, 156, new_msg, 0, 2088850039, 1238176, 1179817, 1237900}  (24, {128, 156, new_msg, 0, 2088850039, 1238176, 1179817, 1237900} "\210\6\31\1\33\0\1\0`\0\0\0\0\0\0\0\1\0\0\0\0\0\11\4\1\1\1\0>\0@\0\250\6\31\1\0\0\0\0\377\377\377\377\0\0\0\0PR\313B\0\0\0\0\370\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0(\0,\0\350\6\31\1\0\0\0\0\0\0\0\0\224\350\22\0\0\0\0\0" ... {128, 156, reply, 0, 1228, 868, 57997, 0} "\300\270\26\0\33\0\1\0\0\0\0\0\0\0\0\0\1\0\0\0\0\0\11\4\1\1\1\0>\0@\0\250\6\31\1\0\0\0\0\377\377\377\377\0\0\0\0PR\313B\0\0\0\0\370\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0(\0,\0\350\6\31\1\0\0\0\0\0\0\0\0\224\350\22\0\0\0\0\0" )  ... {128, 156, reply, 0, 1228, 868, 57997, 0}  (24, {128, 156, new_msg, 0, 2088850039, 1238176, 1179817, 1237900} "\210\6\31\1\33\0\1\0`\0\0\0\0\0\0\0\1\0\0\0\0\0\11\4\1\1\1\0>\0@\0\250\6\31\1\0\0\0\0\377\377\377\377\0\0\0\0PR\313B\0\0\0\0\370\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0(\0,\0\350\6\31\1\0\0\0\0\0\0\0\0\224\350\22\0\0\0\0\0" ... {128, 156, reply, 0, 1228, 868, 57997, 0} "\300\270\26\0\33\0\1\0\0\0\0\0\0\0\0\0\1\0\0\0\0\0\11\4\1\1\1\0>\0@\0\250\6\31\1\0\0\0\0\377\377\377\377\0\0\0\0PR\313B\0\0\0\0\370\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0(\0,\0\350\6\31\1\0\0\0\0\0\0\0\0\224\350\22\0\0\0\0\0" )  ) == 0x0
 01023   868   NtQueryDebugFilterState  (53, 2, ... ) == 0x0
 01024   868   NtOpenKey  (0x8, {24, 0, 0x40, 0, 0,  (0x8, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows\CurrentVersion\SideBySide\AssemblyStorageRoots"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01025   868   NtQueryDebugFilterState  (53, 2, ... ) == 0x0
 01026   868   NtQueryDebugFilterState  (53, 2, ... ) == 0x0
 01027   868   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\u:\work\packed.exe.Local\"}, 1236368, ... ) }, 1236368, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01028   868   NtQueryDebugFilterState  (53, 2, ... ) == 0x0
 01029   868   NtQueryDebugFilterState  (53, 2, ... ) == 0x0
 01030   868   NtQueryDebugFilterState  (53, 2, ... ) == 0x0
 01031   868   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.2982_x-ww_ac3f9c03"}, 1236432, ... ) }, 1236432, ... ) == 0x0
 01032   868   NtOpenFile  (0x100020, {24, 0, 0x40, 0, 0,  (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.2982_x-ww_ac3f9c03"}, 3, 33, ... 136, {status=0x0, info=1}, ) }, 3, 33, ... 136, {status=0x0, info=1}, ) == 0x0
 01033   868   NtQueryDebugFilterState  (53, 2, ... ) == 0x0
 01034   868   NtOpenFile  (0x100020, {24, 0, 0x40, 0, 0,  (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.2982_x-ww_ac3f9c03\comctl32.dll"}, 5, 96, ... 92, {status=0x0, info=1}, ) }, 5, 96, ... 92, {status=0x0, info=1}, ) == 0x0
 01035   868   NtCreateSection  (0xe, 0x0, 0x0, 16, 134217728, 92, ... 140, ) == 0x0
 01036   868   NtClose  (92, ... ) == 0x0
 01037   868   NtMapViewOfSection  (140, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 16, ... (0x1b70000), 0x0, 1056768, ) == 0x0
 01038   868   NtClose  (140, ... ) == 0x0
 01039   868   NtUnmapViewOfSection  (-1, 0x1b70000, ... ) == 0x0
 01040   868   NtOpenFile  (0x100020, {24, 0, 0x40, 0, 0,  (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.2982_x-ww_ac3f9c03\comctl32.dll"}, 5, 96, ... 140, {status=0x0, info=1}, ) }, 5, 96, ... 140, {status=0x0, info=1}, ) == 0x0
 01041   868   NtCreateSection  (0xf, 0x0, 0x0, 16, 16777216, 140, ... 92, ) == 0x0
 01042   868   NtQuerySection  (92, Image, 48, ... {section info, class 1, size 48}, 0x0, ) == 0x0
 01043   868   NtClose  (140, ... ) == 0x0
 01044   868   NtMapViewOfSection  (92, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x773d0000), 0x0, 1060864, ) == 0x0
 01045   868   NtClose  (92, ... ) == 0x0
 01046   868   NtProtectVirtualMemory  (-1, (0x773d1000), 1924, 4, ... (0x773d1000), 4096, 32, ) == 0x0
 01047   868   NtProtectVirtualMemory  (-1, (0x773d1000), 4096, 32, ... (0x773d1000), 4096, 4, ) == 0x0
 01048   868   NtFlushInstructionCache  (-1, 2000490496, 1924, ... ) == 0x0
 01049   868   NtProtectVirtualMemory  (-1, (0x773d1000), 1924, 4, ... (0x773d1000), 4096, 32, ) == 0x0
 01050   868   NtProtectVirtualMemory  (-1, (0x773d1000), 4096, 32, ... (0x773d1000), 4096, 4, ) == 0x0
 01051   868   NtFlushInstructionCache  (-1, 2000490496, 1924, ... ) == 0x0
 01052   868   NtProtectVirtualMemory  (-1, (0x773d1000), 1924, 4, ... (0x773d1000), 4096, 32, ) == 0x0
 01053   868   NtProtectVirtualMemory  (-1, (0x773d1000), 4096, 32, ... (0x773d1000), 4096, 4, ) == 0x0
 01054   868   NtFlushInstructionCache  (-1, 2000490496, 1924, ... ) == 0x0
 01055   868   NtProtectVirtualMemory  (-1, (0x773d1000), 1924, 4, ... (0x773d1000), 4096, 32, ) == 0x0
 01056   868   NtProtectVirtualMemory  (-1, (0x773d1000), 4096, 32, ... (0x773d1000), 4096, 4, ) == 0x0
 01057   868   NtFlushInstructionCache  (-1, 2000490496, 1924, ... ) == 0x0
 01058   868   NtProtectVirtualMemory  (-1, (0x773d1000), 1924, 4, ... (0x773d1000), 4096, 32, ) == 0x0
 01059   868   NtProtectVirtualMemory  (-1, (0x773d1000), 4096, 32, ... (0x773d1000), 4096, 4, ) == 0x0
 01060   868   NtFlushInstructionCache  (-1, 2000490496, 1924, ... ) == 0x0
 01061   868   NtProtectVirtualMemory  (-1, (0x773d1000), 1924, 4, ... (0x773d1000), 4096, 32, ) == 0x0
 01062   868   NtProtectVirtualMemory  (-1, (0x773d1000), 4096, 32, ... (0x773d1000), 4096, 4, ) == 0x0
 01063   868   NtFlushInstructionCache  (-1, 2000490496, 1924, ... ) == 0x0
 01064   868   NtProtectVirtualMemory  (-1, (0x773d1000), 1924, 4, ... (0x773d1000), 4096, 32, ) == 0x0
 01065   868   NtProtectVirtualMemory  (-1, (0x773d1000), 4096, 32, ... (0x773d1000), 4096, 4, ) == 0x0
 01066   868   NtFlushInstructionCache  (-1, 2000490496, 1924, ... ) == 0x0
 01067   868   NtOpenKey  (0x80000000, {24, 0, 0x40, 0, 0,  (0x80000000, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\comctl32.dll"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01068   868   NtAddAtom  ( ("T\0h\0e\0m\0e\0P\0r\0o\0p\0S\0c\0r\0o\0l\0l\0B\0a\0r\0C\0t\0l\0", 42, 1237912, ... ) , 42, 1237912, ... ) == 0x0
 01069   868   NtQueryDefaultUILanguage  (1236596, ...
 01070   868   NtOpenThreadTokenEx  (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN
 01071   868   NtOpenProcessTokenEx  (-1, 0x20008, 512, ... -2147482740, ) == 0x0
 01072   868   NtQueryInformationToken  (-2147482740, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0
 01073   868   NtClose  (-2147482740, ... ) == 0x0
 01074   868   NtOpenKey  (0x2000000, {24, 0, 0x640, 0, 0,  (0x2000000, {24, 0, 0x640, 0, 0, "\REGISTRY\USER\S-1-5-21-1292428093-1383384898-725345543-1003"}, ... -2147482740, ) }, ... -2147482740, ) == 0x0
 01075   868   NtOpenKey  (0x80000000, {24, -2147482740, 0x240, 0, 0,  (0x80000000, {24, -2147482740, 0x240, 0, 0, "Software\Policies\Microsoft\Control Panel\Desktop"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01076   868   NtOpenKey  (0x80000000, {24, -2147482740, 0x640, 0, 0,  (0x80000000, {24, -2147482740, 0x640, 0, 0, "Control Panel\Desktop"}, ... -2147481328, ) }, ... -2147481328, ) == 0x0
 01077   868   NtQueryValueKey  (-2147481328,  (-2147481328, "MultiUILanguageId", Partial, 256, ... ) , Partial, 256, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01078   868   NtClose  (-2147481328, ... ) == 0x0
 01079   868   NtClose  (-2147482740, ... ) == 0x0
 01069   868   NtQueryDefaultUILanguage  ... ) == 0x0
 01080   868   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\WindowsShell.Manifest"}, 1235436, ... ) }, 1235436, ... ) == 0x0
 01081   868   NtOpenFile  (0x100020, {24, 0, 0x40, 0, 0,  (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\WindowsShell.Manifest"}, 5, 96, ... 92, {status=0x0, info=1}, ) }, 5, 96, ... 92, {status=0x0, info=1}, ) == 0x0
 01082   868   NtCreateSection  (0xe, 0x0, 0x0, 16, 134217728, 92, ... 140, ) == 0x0
 01083   868   NtClose  (92, ... ) == 0x0
 01084   868   NtMapViewOfSection  (140, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 16, ... (0x3a0000), 0x0, 4096, ) == 0x0
 01085   868   NtClose  (140, ... ) == 0x0
 01086   868   NtUnmapViewOfSection  (-1, 0x3a0000, ... ) == 0x0
 01087   868   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\WindowsShell.Manifest"}, 1235032, ... ) }, 1235032, ... ) == 0x0
 01088   868   NtCreateFile  (0x80100080, {24, 0, 0x40, 0, 1235776,  (0x80100080, {24, 0, 0x40, 0, 1235776, "\??\C:\WINDOWS\WindowsShell.Manifest"}, 0x0, 0, 5, 1, 96, 0, 0, ... 140, {status=0x0, info=1}, ) }, 0x0, 0, 5, 1, 96, 0, 0, ... 140, {status=0x0, info=1}, ) == 0x0
 01089   868   NtCreateSection  (0xf0005, 0x0, 0x0, 2, 134217728, 140, ... 92, ) == 0x0
 01090   868   NtClose  (140, ... ) == 0x0
 01091   868   NtMapViewOfSection  (92, -1, (0x0), 0, 0, {0, 0}, 0, 1, 0, 2, ... (0x3a0000), {0, 0}, 4096, ) == 0x0
 01092   868   NtClose  (92, ... ) == 0x0
 01093   868   NtUnmapViewOfSection  (-1, 0x3a0000, ... ) == 0x0
 01094   868   NtOpenFile  (0x1200a9, {24, 0, 0x40, 0, 0,  (0x1200a9, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\WindowsShell.Manifest"}, 1, 96, ... 92, {status=0x0, info=1}, ) }, 1, 96, ... 92, {status=0x0, info=1}, ) == 0x0
 01095   868   NtCreateSection  (0x4, 0x0, 0x0, 2, 134217728, 92, ... 140, ) == 0x0
 01096   868   NtMapViewOfSection  (140, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 2, ... (0x3a0000), 0x0, 4096, ) == 0x0
 01097   868   NtQueryInformationFile  (92, 1235428, 24, Standard, ... {status=0x0, info=24}, ) == 0x0
 01098   868   NtOpenFile  (0x1200a9, {24, 0, 0x40, 0, 0,  (0x1200a9, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\WindowsShell.Config"}, 1, 96, ... ) }, 1, 96, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01099   868   NtRequestWaitReplyPort  (24, {128, 156, new_msg, 0, 2088850039, 1235728, 1179817, 1235452}  (24, {128, 156, new_msg, 0, 2088850039, 1235728, 1179817, 1235452} "\210\6\31\1\33\0\1\0`\0\0\0\0\0\0\0\1\0\0\0\0\0\11\4\1\1\3\0@\0D\0\250\6\31\1\\0\0\0\214\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\355\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\26\0\30\0\354\6\31\1\0\0\0\0\0\0\0\0\4\337\22\0\0\0\0\0" ... {128, 156, reply, 0, 1228, 868, 57998, 0} "\260d\27\0\33\0\1\0\0\0\0\0\0\0\0\0\1\0\0\0\0\0\11\4\1\1\3\0@\0D\0\250\6\31\1\\0\0\0\214\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\355\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\26\0\30\0\354\6\31\1\0\0\0\0\0\0\0\0\4\337\22\0\0\0\0\0" )  ... {128, 156, reply, 0, 1228, 868, 57998, 0}  (24, {128, 156, new_msg, 0, 2088850039, 1235728, 1179817, 1235452} "\210\6\31\1\33\0\1\0`\0\0\0\0\0\0\0\1\0\0\0\0\0\11\4\1\1\3\0@\0D\0\250\6\31\1\\0\0\0\214\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\355\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\26\0\30\0\354\6\31\1\0\0\0\0\0\0\0\0\4\337\22\0\0\0\0\0" ... {128, 156, reply, 0, 1228, 868, 57998, 0} "\260d\27\0\33\0\1\0\0\0\0\0\0\0\0\0\1\0\0\0\0\0\11\4\1\1\3\0@\0D\0\250\6\31\1\\0\0\0\214\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\355\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\26\0\30\0\354\6\31\1\0\0\0\0\0\0\0\0\4\337\22\0\0\0\0\0" )  ) == 0x0
 01100   868   NtClose  (92, ... ) == 0x0
 01101   868   NtClose  (140, ... ) == 0x0
 01102   868   NtUnmapViewOfSection  (-1, 0x3a0000, ... ) == 0x0
 01103   868   NtQueryDebugFilterState  (53, 2, ... ) == 0x0
 01104   868   NtUserRegisterWindowMessage  ( ("ShellGetDragImage", ... ) , ... ) == 0xc03a
 01105   868   NtUserSystemParametersInfo  (104, 0, 2001084812, 0, ... ) == 0x1
 01106   868   NtUserGetDC  (0, ... ) == 0x1010051
 01107   868   NtUserCallOneParam  (16842833, 57, ... ) == 0x1
 01108   868   NtUserSystemParametersInfo  (38, 4, 2001086940, 0, ... ) == 0x1
 01109   868   NtUserSystemParametersInfo  (66, 12, 1237428, 0, ... ) == 0x1
 01110   868   NtOpenThreadTokenEx  (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN
 01111   868   NtOpenProcessTokenEx  (-1, 0x20008, 512, ... 140, ) == 0x0
 01112   868   NtQueryInformationToken  (140, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0
 01113   868   NtClose  (140, ... ) == 0x0
 01114   868   NtOpenKey  (0x20019, {24, 0, 0x640, 0, 0,  (0x20019, {24, 0, 0x640, 0, 0, "\REGISTRY\USER\S-1-5-21-1292428093-1383384898-725345543-1003"}, ... 140, ) }, ... 140, ) == 0x0
 01115   868   NtOpenProcessToken  (-1, 0x8, ... 92, ) == 0x0
 01116   868   NtAccessCheck  (1345664, 92, 0x1, 1237260, 1237312, 56, 1237292, ... ) == STATUS_NO_IMPERSONATION_TOKEN
 01117   868   NtClose  (92, ... ) == 0x0
 01118   868   NtOpenKey  (0x20019, {24, 140, 0x40, 0, 0,  (0x20019, {24, 140, 0x40, 0, 0, "Control Panel\Desktop"}, ... 92, ) }, ... 92, ) == 0x0
 01119   868   NtQueryValueKey  (92,  (92, "SmoothScroll", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01120   868   NtClose  (92, ... ) == 0x0
 01121   868   NtUserSystemParametersInfo  (41, 500, 1237456, 0, ... ) == 0x1
 01122   868   NtOpenProcessToken  (-1, 0x8, ... 92, ) == 0x0
 01123   868   NtAccessCheck  (1345664, 92, 0x1, 1237260, 1237312, 56, 1237292, ... ) == STATUS_NO_IMPERSONATION_TOKEN
 01124   868   NtClose  (92, ... ) == 0x0
 01125   868   NtOpenKey  (0x20019, {24, 140, 0x40, 0, 0,  (0x20019, {24, 140, 0x40, 0, 0, "software\Microsoft\Windows\CurrentVersion\Explorer\Advanced"}, ... 92, ) }, ... 92, ) == 0x0
 01126   868   NtQueryValueKey  (92,  (92, "EnableBalloonTips", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01127   868   NtClose  (92, ... ) == 0x0
 01128   868   NtUserSystemParametersInfo  (27, 0, 2001085788, 0, ... ) == 0x1
 01129   868   NtUserSystemParametersInfo  (102, 0, 2001086828, 0, ... ) == 0x1
 01130   868   NtClose  (140, ... ) == 0x0
 01131   868   NtUserSystemParametersInfo  (4130, 0, 1237960, 0, ... ) == 0x1
 01132   868   NtOpenKey  (0x1, {24, 36, 0x40, 0, 0,  (0x1, {24, 36, 0x40, 0, 0, "Software\Microsoft\Windows NT\CurrentVersion\LanguagePack"}, ... 140, ) }, ... 140, ) == 0x0
 01133   868   NtEnumerateValueKey  (140, 0, Full, 220, ... ) == STATUS_NO_MORE_ENTRIES
 01134   868   NtClose  (140, ... ) == 0x0
 01135   868   NtUserFindExistingCursorIcon  (1237208, 1237224, 1237272, ... ) == 0x10011
 01136   868   NtUserRegisterClassExWOW  (1237152, 1237220, 1237236, 1237252, 0, 384, 0, ... ) == 0x81b1c03b
 01137   868   NtUserRegisterClassExWOW  (1237152, 1237220, 1237236, 1237252, 0, 384, 0, ... ) == 0x81b1c03d
 01138   868   NtUserFindExistingCursorIcon  (1237208, 1237224, 1237272, ... ) == 0x10011
 01139   868   NtUserRegisterClassExWOW  (1237152, 1237220, 1237236, 1237252, 0, 384, 0, ... ) == 0x81b1c03f
 01140   868   NtUserFindExistingCursorIcon  (1237208, 1237224, 1237272, ... ) == 0x10011
 01141   868   NtUserRegisterClassExWOW  (1237152, 1237220, 1237236, 1237252, 0, 384, 0, ... ) == 0x81b1c041
 01142   868   NtUserFindExistingCursorIcon  (1237208, 1237224, 1237272, ... ) == 0x10011
 01143   868   NtUserRegisterClassExWOW  (1237152, 1237220, 1237236, 1237252, 0, 384, 0, ... ) == 0x81b1c043
 01144   868   NtUserRegisterClassExWOW  (1237152, 1237220, 1237236, 1237252, 0, 384, 0, ... ) == 0x81b1c045
 01145   868   NtUserFindExistingCursorIcon  (1237208, 1237224, 1237272, ... ) == 0x10011
 01146   868   NtUserRegisterClassExWOW  (1237152, 1237220, 1237236, 1237252, 0, 384, 0, ... ) == 0x81b1c047
 01147   868   NtUserFindExistingCursorIcon  (1237208, 1237224, 1237272, ... ) == 0x10011
 01148   868   NtUserRegisterClassExWOW  (1237152, 1237220, 1237236, 1237252, 0, 384, 0, ... ) == 0x81b1c049
 01149   868   NtUserFindExistingCursorIcon  (1237208, 1237224, 1237272, ... ) == 0x10011
 01150   868   NtUserRegisterClassExWOW  (1237152, 1237220, 1237236, 1237252, 0, 384, 0, ... ) == 0x81b1c04b
 01151   868   NtUserFindExistingCursorIcon  (1237208, 1237224, 1237272, ... ) == 0x10011
 01152   868   NtUserRegisterClassExWOW  (1237152, 1237220, 1237236, 1237252, 0, 384, 0, ... ) == 0x81b1c04d
 01153   868   NtUserFindExistingCursorIcon  (1237208, 1237224, 1237272, ... ) == 0x10011
 01154   868   NtUserRegisterClassExWOW  (1237152, 1237220, 1237236, 1237252, 0, 384, 0, ... ) == 0x81b1c04f
 01155   868   NtUserRegisterClassExWOW  (1237152, 1237220, 1237236, 1237252, 0, 384, 0, ... ) == 0x81b1c051
 01156   868   NtUserFindExistingCursorIcon  (1237208, 1237224, 1237272, ... ) == 0x10011
 01157   868   NtUserRegisterClassExWOW  (1237152, 1237220, 1237236, 1237252, 0, 384, 0, ... ) == 0x81b1c053
 01158   868   NtUserFindExistingCursorIcon  (1237204, 1237220, 1237268, ... ) == 0x10011
 01159   868   NtUserRegisterClassExWOW  (1237148, 1237216, 1237232, 1237248, 0, 384, 0, ... ) == 0x81b1c055
 01160   868   NtUserFindExistingCursorIcon  (1237204, 1237220, 1237268, ... ) == 0x10011
 01161   868   NtUserRegisterClassExWOW  (1237148, 1237216, 1237232, 1237248, 0, 384, 0, ... ) == 0x81b1c057
 01162   868   NtUserFindExistingCursorIcon  (1237208, 1237224, 1237272, ... ) == 0x10011
 01163   868   NtUserRegisterClassExWOW  (1237152, 1237220, 1237236, 1237252, 0, 384, 0, ... ) == 0x81b1c059
 01164   868   NtUserFindExistingCursorIcon  (1237208, 1237224, 1237272, ... ) == 0x10013
 01165   868   NtUserRegisterClassExWOW  (1237152, 1237220, 1237236, 1237252, 0, 384, 0, ... ) == 0x81b1c05b
 01166   868   NtUserFindExistingCursorIcon  (1237208, 1237224, 1237272, ... ) == 0x10011
 01167   868   NtUserRegisterClassExWOW  (1237152, 1237220, 1237236, 1237252, 0, 384, 0, ... ) == 0x81b1c05d
 01168   868   NtUserFindExistingCursorIcon  (1237208, 1237224, 1237272, ... ) == 0x10011
 01169   868   NtUserRegisterClassExWOW  (1237152, 1237220, 1237236, 1237252, 0, 384, 0, ... ) == 0x81b1c05f
 01170   868   NtUserFindExistingCursorIcon  (1237208, 1237224, 1237272, ... ) == 0x10011
 01171   868   NtUserRegisterClassExWOW  (1237152, 1237220, 1237236, 1237252, 0, 384, 0, ... ) == 0x81b1c017
 01172   868   NtUserFindExistingCursorIcon  (1237208, 1237224, 1237272, ... ) == 0x10011
 01173   868   NtUserRegisterClassExWOW  (1237152, 1237220, 1237236, 1237252, 0, 384, 0, ... ) == 0x81b1c019
 01174   868   NtUserFindExistingCursorIcon  (1237208, 1237224, 1237272, ... ) == 0x10013
 01175   868   NtUserRegisterClassExWOW  (1237152, 1237220, 1237236, 1237252, 0, 384, 0, ... ) == 0x81b1c018
 01176   868   NtUserFindExistingCursorIcon  (1237208, 1237224, 1237272, ... ) == 0x10011
 01177   868   NtUserRegisterClassExWOW  (1237152, 1237220, 1237236, 1237252, 0, 384, 0, ... ) == 0x81b1c01a
 01178   868   NtUserFindExistingCursorIcon  (1237208, 1237224, 1237272, ... ) == 0x10011
 01179   868   NtUserRegisterClassExWOW  (1237152, 1237220, 1237236, 1237252, 0, 384, 0, ... ) == 0x81b1c01c
 01180   868   NtUserFindExistingCursorIcon  (1237208, 1237224, 1237272, ... ) == 0x10011
 01181   868   NtUserRegisterClassExWOW  (1237152, 1237220, 1237236, 1237252, 0, 384, 0, ... ) == 0x81b1c01e
 01182   868   NtUserFindExistingCursorIcon  (1237200, 1237216, 1237264, ... ) == 0x10011
 01183   868   NtUserRegisterClassExWOW  (1237200, 1237268, 1237284, 1237300, 0, 384, 0, ... ) == 0x81b1c01b
 01184   868   NtUserFindExistingCursorIcon  (1237208, 1237224, 1237272, ... ) == 0x10011
 01185   868   NtUserRegisterClassExWOW  (1237152, 1237220, 1237236, 1237252, 0, 384, 0, ... ) == 0x81b1c068
 01186   868   NtUserFindExistingCursorIcon  (1237208, 1237224, 1237272, ... ) == 0x10011
 01187   868   NtUserRegisterClassExWOW  (1237152, 1237220, 1237236, 1237252, 0, 384, 0, ... ) == 0x81b1c06a
 01188   868   NtOpenThreadTokenEx  (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN
 01189   868   NtOpenProcessTokenEx  (-1, 0x20008, 512, ... 140, ) == 0x0
 01190   868   NtQueryInformationToken  (140, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0
 01191   868   NtClose  (140, ... ) == 0x0
 01192   868   NtOpenKey  (0x2000000, {24, 0, 0x640, 0, 0,  (0x2000000, {24, 0, 0x640, 0, 0, "\REGISTRY\USER\S-1-5-21-1292428093-1383384898-725345543-1003"}, ... 140, ) }, ... 140, ) == 0x0
 01193   868   NtSetInformationObject  (140, Handle, {Inherit=0,ProtectFromClose=1,}, 1179904, ... ) == 0x0
 01194   868   NtCreateKey  (0x2001f, {24, 140, 0x40, 0, 0,  (0x2001f, {24, 140, 0x40, 0, 0, "SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings"}, 0, 0x0, 0, ... 92, 2, ) }, 0, 0x0, 0, ... 92, 2, ) == 0x0
 01195   868   NtSetEventBoostPriority  (128, ...
 00977   484   NtWaitForSingleObject  ... ) == 0x0
 01196   484   NtTestAlert  (... ) == 0x0
 01197   484   NtContinue  (28769584, 1, ...
 01198   484   NtRegisterThreadTerminatePort  (24, ... ) == 0x0
 01199   484   NtDeviceIoControlFile  (108, 120, 0x0, 0x77e466a0, 0x228144,  (108, 120, 0x0, 0x77e466a0, 0x228144, "\2\0\0\0\1\0\0\0\\370\342w\0\0\0\0t\0\0\0\0\0\0\0\204\0\0\0\0\0\0\0h\0\0\0\0\0\0\0", 40, 4096, ... {status=0x103, info=0}, "", ) , 40, 4096, ... {status=0x103, info=0}, "", ) == 0x103
 01195   868   NtSetEventBoostPriority  ... ) == 0x0
 01200   484   NtWaitForMultipleObjects  (2, (112, 120, ), 1, 1, {1294967296, -1}, ... ) == 0x0
 01201   484   NtDeviceIoControlFile  (108, 124, 0x0, 0x77e46680, 0x228144,  (108, 124, 0x0, 0x77e46680, 0x228144, "\2\0\0\0\1\0\0\0\\370\342w\0\0\0\0t\0\0\0\0\0\0\0\204\0\0\0\0\0\0\0h\0\0\0\0\0\0\0", 40, 4096, ... {status=0x103, info=0}, "", ) , 40, 4096, ... {status=0x103, info=0}, "", ) == 0x103
 01202   484   NtWaitForMultipleObjects  (2, (112, 124, ), 1, 1, {1294967296, -1}, ...
 01203   868   NtQueryValueKey  (92,  (92, "FromCacheTimeout", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01204   868   NtQueryValueKey  (92,  (92, "SecureProtocols", Partial, 144, ... TitleIdx=0, Type=4, Data="\240\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (92, "SecureProtocols", Partial, 144, ... TitleIdx=0, Type=4, Data="\240\0\0\0"}, 16, ) }, 16, ) == 0x0
 01205   868   NtOpenKey  (0x20019, {24, 36, 0x40, 0, 0,  (0x20019, {24, 36, 0x40, 0, 0, "Software\Policies"}, ... 144, ) }, ... 144, ) == 0x0
 01206   868   NtOpenKey  (0x20019, {24, 140, 0x40, 0, 0,  (0x20019, {24, 140, 0x40, 0, 0, "Software\Policies"}, ... 148, ) }, ... 148, ) == 0x0
 01207   868   NtOpenKey  (0x20019, {24, 140, 0x40, 0, 0,  (0x20019, {24, 140, 0x40, 0, 0, "Software"}, ... 152, ) }, ... 152, ) == 0x0
 01208   868   NtOpenKey  (0x20019, {24, 36, 0x40, 0, 0,  (0x20019, {24, 36, 0x40, 0, 0, "Software"}, ... 156, ) }, ... 156, ) == 0x0
 01209   868   NtOpenKey  (0x1, {24, 36, 0x40, 0, 0,  (0x1, {24, 36, 0x40, 0, 0, "Software\Policies\Microsoft\Internet Explorer"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01210   868   NtOpenKey  (0x1, {24, 36, 0x40, 0, 0,  (0x1, {24, 36, 0x40, 0, 0, "Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01211   868   NtOpenKey  (0x1, {24, 140, 0x40, 0, 0,  (0x1, {24, 140, 0x40, 0, 0, "Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01212   868   NtOpenKey  (0x1, {24, 140, 0x40, 0, 0,  (0x1, {24, 140, 0x40, 0, 0, "SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings"}, ... 160, ) }, ... 160, ) == 0x0
 01213   868   NtQueryValueKey  (160,  (160, "CertificateRevocation", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (160, "CertificateRevocation", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) }, 16, ) == 0x0
 01214   868   NtClose  (160, ... ) == 0x0
 01215   868   NtQueryValueKey  (92,  (92, "DisableKeepAlive", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01216   868   NtQueryValueKey  (92,  (92, "DisablePassport", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01217   868   NtQueryValueKey  (92,  (92, "IdnEnabled", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01218   868   NtQueryValueKey  (92,  (92, "CacheMode", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01219   868   NtQueryValueKey  (92,  (92, "EnableHttp1_1", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (92, "EnableHttp1_1", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) }, 16, ) == 0x0
 01220   868   NtQueryValueKey  (92,  (92, "ProxyHttp1.1", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01221   868   NtQueryValueKey  (92,  (92, "EnableNegotiate", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (92, "EnableNegotiate", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) }, 16, ) == 0x0
 01222   868   NtQueryValueKey  (92,  (92, "DisableBasicOverClearChannel", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01223   868   NtOpenKey  (0x20019, {24, 36, 0x40, 0, 0,  (0x20019, {24, 36, 0x40, 0, 0, "Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01224   868   NtOpenKey  (0x20019, {24, 140, 0x40, 0, 0,  (0x20019, {24, 140, 0x40, 0, 0, "Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01225   868   NtOpenKey  (0x20019, {24, 140, 0x40, 0, 0,  (0x20019, {24, 140, 0x40, 0, 0, "Software\Microsoft\Internet Explorer\Main\FeatureControl"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01226   868   NtOpenKey  (0x20019, {24, 36, 0x40, 0, 0,  (0x20019, {24, 36, 0x40, 0, 0, "Software\Microsoft\Internet Explorer\Main\FeatureControl"}, ... 160, ) }, ... 160, ) == 0x0
 01227   868   NtQueryValueKey  (160,  (160, "Feature_ClientAuthCertFilter", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01228   868   NtClose  (160, ... ) == 0x0
 01229   868   NtOpenSection  (0xe, {24, 8, 0x40, 0, 0,  (0xe, {24, 8, 0x40, 0, 0, "Secur32.dll"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01230   868   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\u:\work\Secur32.dll"}, 1239684, ... ) }, 1239684, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01231   868   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\Secur32.dll"}, 1239684, ... ) }, 1239684, ... ) == 0x0
 01232   868   NtOpenFile  (0x100020, {24, 0, 0x40, 0, 0,  (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\Secur32.dll"}, 5, 96, ... 160, {status=0x0, info=1}, ) }, 5, 96, ... 160, {status=0x0, info=1}, ) == 0x0
 01233   868   NtCreateSection  (0xf, 0x0, 0x0, 16, 16777216, 160, ... 164, ) == 0x0
 01234   868   NtQuerySection  (164, Image, 48, ... {section info, class 1, size 48}, 0x0, ) == 0x0
 01235   868   NtClose  (160, ... ) == 0x0
 01236   868   NtMapViewOfSection  (164, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x77fe0000), 0x0, 69632, ) == 0x0
 01237   868   NtClose  (164, ... ) == 0x0
 01238   868   NtProtectVirtualMemory  (-1, (0x77fe1000), 388, 4, ... (0x77fe1000), 4096, 32, ) == 0x0
 01239   868   NtProtectVirtualMemory  (-1, (0x77fe1000), 4096, 32, ... (0x77fe1000), 4096, 4, ) == 0x0
 01240   868   NtFlushInstructionCache  (-1, 2013138944, 388, ... ) == 0x0
 01241   868   NtOpenKey  (0x80000000, {24, 0, 0x40, 0, 0,  (0x80000000, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Secur32.dll"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01242   868   NtCreateSemaphore  (0x100003, 0x0, 0, 2147483647, ... 164, ) == 0x0
 01243   868   NtCreateSemaphore  (0x100003, 0x0, 0, 2147483647, ... 160, ) == 0x0
 01244   868   NtOpenEvent  (0x1, {24, 0, 0x40, 0, 0,  (0x1, {24, 0, 0x40, 0, 0, "\SECURITY\LSA_AUTHENTICATION_INITIALIZED"}, ... 168, ) }, ... 168, ) == 0x0
 01245   868   NtQueryEvent  (168, Basic, 8, ... {EventType=0,SignalState=1,}, 0x0, ) == 0x0
 01246   868   NtClose  (168, ... ) == 0x0
 01247   868   NtConnectPort  ( ("\LsaAuthenticationPort", {12, 2, 1, 0}, 0x0, 0x0, 1241256, 140, ... 168, 0x0, 0x0, 256, 140, ) , {12, 2, 1, 0}, 0x0, 0x0, 1241256, 140, ... 168, 0x0, 0x0, 256, 140, ) == 0x0
 01248   868   NtRequestWaitReplyPort  (168, {28, 52, new_msg, 0, 0, 0, 0, 0}  (168, {28, 52, new_msg, 0, 0, 0, 0, 0} "\37\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\1\0\353\6\10\2\220\36\24\0" ... {188, 212, reply, 0, 1228, 868, 58000, 0} "\37\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\1\0\34\0\10\2\220\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0M\0a\0r\0t\0i\0m\0 \0C\0a\0r\0b\0o\0n\0e\0" )  ... {188, 212, reply, 0, 1228, 868, 58000, 0}  (168, {28, 52, new_msg, 0, 0, 0, 0, 0} "\37\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\1\0\353\6\10\2\220\36\24\0" ... {188, 212, reply, 0, 1228, 868, 58000, 0} "\37\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\1\0\34\0\10\2\220\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0M\0a\0r\0t\0i\0m\0 \0C\0a\0r\0b\0o\0n\0e\0" )  ) == 0x0
 01249   868   NtQueryValueKey  (92,  (92, "SyncMode5", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01250   868   NtOpenKey  (0x9, {24, 36, 0x40, 0, 0,  (0x9, {24, 36, 0x40, 0, 0, "Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache"}, ... 172, ) }, ... 172, ) == 0x0
 01251   868   NtQueryValueKey  (172,  (172, "SessionStartTimeDefaultDeltaSecs", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01252   868   NtClose  (172, ... ) == 0x0
 01253   868   NtOpenKey  (0xf, {24, 36, 0x40, 0, 0,  (0xf, {24, 36, 0x40, 0, 0, "Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache"}, ... 172, ) }, ... 172, ) == 0x0
 01254   868   NtOpenKey  (0xf, {24, 140, 0x40, 0, 0,  (0xf, {24, 140, 0x40, 0, 0, "Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache"}, ... 176, ) }, ... 176, ) == 0x0
 01255   868   NtOpenKey  (0x9, {24, 140, 0x40, 0, 0,  (0x9, {24, 140, 0x40, 0, 0, "Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache"}, ... 180, ) }, ... 180, ) == 0x0
 01256   868   NtQueryValueKey  (180,  (180, "Signature", Partial, 144, ... TitleIdx=0, Type=1, Data="C\0l\0i\0e\0n\0t\0 \0U\0r\0l\0C\0a\0c\0h\0e\0 \0M\0M\0F\0 \0V\0e\0r\0 \05\0.\02\0\0\0"}, 68, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (180, "Signature", Partial, 144, ... TitleIdx=0, Type=1, Data="C\0l\0i\0e\0n\0t\0 \0U\0r\0l\0C\0a\0c\0h\0e\0 \0M\0M\0F\0 \0V\0e\0r\0 \05\0.\02\0\0\0"}, 68, ) }, 68, ) == 0x0
 01257   868   NtQueryValueKey  (180,  (180, "Signature", Partial, 144, ... TitleIdx=0, Type=1, Data="C\0l\0i\0e\0n\0t\0 \0U\0r\0l\0C\0a\0c\0h\0e\0 \0M\0M\0F\0 \0V\0e\0r\0 \05\0.\02\0\0\0"}, 68, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (180, "Signature", Partial, 144, ... TitleIdx=0, Type=1, Data="C\0l\0i\0e\0n\0t\0 \0U\0r\0l\0C\0a\0c\0h\0e\0 \0M\0M\0F\0 \0V\0e\0r\0 \05\0.\02\0\0\0"}, 68, ) }, 68, ) == 0x0
 01258   868   NtClose  (180, ... ) == 0x0
 01259   868   NtOpenKey  (0xf, {24, 176, 0x40, 0, 0,  (0xf, {24, 176, 0x40, 0, 0, "Content"}, ... 180, ) }, ... 180, ) == 0x0
 01260   868   NtQueryValueKey  (180,  (180, "PerUserItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01261   868   NtOpenKey  (0xf, {24, 172, 0x40, 0, 0,  (0xf, {24, 172, 0x40, 0, 0, "Content"}, ... 184, ) }, ... 184, ) == 0x0
 01262   868   NtQueryValueKey  (184,  (184, "PerUserItem", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (184, "PerUserItem", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) }, 16, ) == 0x0
 01263   868   NtClose  (184, ... ) == 0x0
 01264   868   NtClose  (180, ... ) == 0x0
 01265   868   NtOpenKey  (0xf, {24, 176, 0x40, 0, 0,  (0xf, {24, 176, 0x40, 0, 0, "Content"}, ... 180, ) }, ... 180, ) == 0x0
 01266   868   NtOpenSection  (0xe, {24, 8, 0x40, 0, 0,  (0xe, {24, 8, 0x40, 0, 0, "SHELL32.dll"}, ... 184, ) }, ... 184, ) == 0x0
 01267   868   NtMapViewOfSection  (184, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x7c9c0000), 0x0, 8482816, ) == 0x0
 01268   868   NtClose  (184, ... ) == 0x0
 01269   868   NtProtectVirtualMemory  (-1, (0x7c9c1000), 4476, 4, ... (0x7c9c1000), 8192, 32, ) == 0x0
 01270   868   NtProtectVirtualMemory  (-1, (0x7c9c1000), 8192, 32, ... (0x7c9c1000), 8192, 4, ) == 0x0
 01271   868   NtFlushInstructionCache  (-1, 2090602496, 4476, ... ) == 0x0
 01272   868   NtProtectVirtualMemory  (-1, (0x7c9c1000), 4476, 4, ... (0x7c9c1000), 8192, 32, ) == 0x0
 01273   868   NtProtectVirtualMemory  (-1, (0x7c9c1000), 8192, 32, ... (0x7c9c1000), 8192, 4, ) == 0x0
 01274   868   NtFlushInstructionCache  (-1, 2090602496, 4476, ... ) == 0x0
 01275   868   NtProtectVirtualMemory  (-1, (0x7c9c1000), 4476, 4, ... (0x7c9c1000), 8192, 32, ) == 0x0
 01276   868   NtProtectVirtualMemory  (-1, (0x7c9c1000), 8192, 32, ... (0x7c9c1000), 8192, 4, ) == 0x0
 01277   868   NtFlushInstructionCache  (-1, 2090602496, 4476, ... ) == 0x0
 01278   868   NtProtectVirtualMemory  (-1, (0x7c9c1000), 4476, 4, ... (0x7c9c1000), 8192, 32, ) == 0x0
 01279   868   NtProtectVirtualMemory  (-1, (0x7c9c1000), 8192, 32, ... (0x7c9c1000), 8192, 4, ) == 0x0
 01280   868   NtFlushInstructionCache  (-1, 2090602496, 4476, ... ) == 0x0
 01281   868   NtProtectVirtualMemory  (-1, (0x7c9c1000), 4476, 4, ... (0x7c9c1000), 8192, 32, ) == 0x0
 01282   868   NtProtectVirtualMemory  (-1, (0x7c9c1000), 8192, 32, ... (0x7c9c1000), 8192, 4, ) == 0x0
 01283   868   NtFlushInstructionCache  (-1, 2090602496, 4476, ... ) == 0x0
 01284   868   NtProtectVirtualMemory  (-1, (0x7c9c1000), 4476, 4, ... (0x7c9c1000), 8192, 32, ) == 0x0
 01285   868   NtProtectVirtualMemory  (-1, (0x7c9c1000), 8192, 32, ... (0x7c9c1000), 8192, 4, ) == 0x0
 01286   868   NtFlushInstructionCache  (-1, 2090602496, 4476, ... ) == 0x0
 01287   868   NtProtectVirtualMemory  (-1, (0x7c9c1000), 4476, 4, ... (0x7c9c1000), 8192, 32, ) == 0x0
 01288   868   NtProtectVirtualMemory  (-1, (0x7c9c1000), 8192, 32, ... (0x7c9c1000), 8192, 4, ) == 0x0
 01289   868   NtFlushInstructionCache  (-1, 2090602496, 4476, ... ) == 0x0
 01290   868   NtProtectVirtualMemory  (-1, (0x7c9c1000), 4476, 4, ... (0x7c9c1000), 8192, 32, ) == 0x0
 01291   868   NtProtectVirtualMemory  (-1, (0x7c9c1000), 8192, 32, ... (0x7c9c1000), 8192, 4, ) == 0x0
 01292   868   NtFlushInstructionCache  (-1, 2090602496, 4476, ... ) == 0x0
 01293   868   NtOpenKey  (0x80000000, {24, 0, 0x40, 0, 0,  (0x80000000, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SHELL32.dll"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01294   868   NtOpenKey  (0x1, {24, 36, 0x40, 0, 0,  (0x1, {24, 36, 0x40, 0, 0, "SYSTEM\Setup"}, ... 184, ) }, ... 184, ) == 0x0
 01295   868   NtQueryValueKey  (184,  (184, "SystemSetupInProgress", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (184, "SystemSetupInProgress", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) }, 16, ) == 0x0
 01296   868   NtClose  (184, ... ) == 0x0
 01297   868   NtQueryDefaultUILanguage  (1236280, ...
 01298   868   NtOpenThreadTokenEx  (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN
 01299   868   NtOpenProcessTokenEx  (-1, 0x20008, 512, ... -2147482740, ) == 0x0
 01300   868   NtQueryInformationToken  (-2147482740, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0
 01301   868   NtClose  (-2147482740, ... ) == 0x0
 01302   868   NtOpenKey  (0x2000000, {24, 0, 0x640, 0, 0,  (0x2000000, {24, 0, 0x640, 0, 0, "\REGISTRY\USER\S-1-5-21-1292428093-1383384898-725345543-1003"}, ... -2147482740, ) }, ... -2147482740, ) == 0x0
 01303   868   NtOpenKey  (0x80000000, {24, -2147482740, 0x240, 0, 0,  (0x80000000, {24, -2147482740, 0x240, 0, 0, "Software\Policies\Microsoft\Control Panel\Desktop"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01304   868   NtOpenKey  (0x80000000, {24, -2147482740, 0x640, 0, 0,  (0x80000000, {24, -2147482740, 0x640, 0, 0, "Control Panel\Desktop"}, ... -2147481328, ) }, ... -2147481328, ) == 0x0
 01305   868   NtQueryValueKey  (-2147481328,  (-2147481328, "MultiUILanguageId", Partial, 256, ... ) , Partial, 256, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01306   868   NtClose  (-2147481328, ... ) == 0x0
 01307   868   NtClose  (-2147482740, ... ) == 0x0
 01297   868   NtQueryDefaultUILanguage  ... ) == 0x0
 01308   868   NtOpenFile  (0x1200a9, {24, 0, 0x40, 0, 0,  (0x1200a9, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\SHELL32.dll"}, 1, 96, ... 184, {status=0x0, info=1}, ) }, 1, 96, ... 184, {status=0x0, info=1}, ) == 0x0
 01309   868   NtCreateSection  (0x4, 0x0, 0x0, 2, 134217728, 184, ... 188, ) == 0x0
 01310   868   NtMapViewOfSection  (188, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 2, ... (0x1b70000), 0x0, 8462336, ) == 0x0
 01311   868   NtOpenFile  (0x1200a9, {24, 0, 0x40, 0, 0,  (0x1200a9, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\SHELL32.dll.124.Manifest"}, 1, 96, ... ) }, 1, 96, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01312   868   NtQueryDefaultLocale  (1, 1234376, ... ) == 0x0
 01313   868   NtOpenFile  (0x1200a9, {24, 0, 0x40, 0, 0,  (0x1200a9, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\SHELL32.dll.124.Config"}, 1, 96, ... ) }, 1, 96, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01314   868   NtRequestWaitReplyPort  (24, {128, 156, new_msg, 0, 2088850039, 1235412, 1179817, 1235136}  (24, {128, 156, new_msg, 0, 2088850039, 1235412, 1179817, 1235136} "\210\6\31\1\33\0\1\0`\0\0\0\0\0\0\0\1\0\0\0\0\0\11\4\1\1\1\0>\0@\0\250\6\31\1\270\0\0\0\377\377\377\377\0\0\0\0@ \332\1\0\0\0\0\236\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0(\0,\0\350\6\31\1\0\0\0\0\0\0\0\0\310\335\22\0\0\0\0\0" ... {128, 156, reply, 0, 1228, 868, 58001, 0} "\300\270\26\0\33\0\1\0\0\0\0\0\0\0\0\0\1\0\0\0\0\0\11\4\1\1\1\0>\0@\0\250\6\31\1\270\0\0\0\377\377\377\377\0\0\0\0@ \332\1\0\0\0\0\236\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0(\0,\0\350\6\31\1\0\0\0\0\0\0\0\0\310\335\22\0\0\0\0\0" )  ... {128, 156, reply, 0, 1228, 868, 58001, 0}  (24, {128, 156, new_msg, 0, 2088850039, 1235412, 1179817, 1235136} "\210\6\31\1\33\0\1\0`\0\0\0\0\0\0\0\1\0\0\0\0\0\11\4\1\1\1\0>\0@\0\250\6\31\1\270\0\0\0\377\377\377\377\0\0\0\0@ \332\1\0\0\0\0\236\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0(\0,\0\350\6\31\1\0\0\0\0\0\0\0\0\310\335\22\0\0\0\0\0" ... {128, 156, reply, 0, 1228, 868, 58001, 0} "\300\270\26\0\33\0\1\0\0\0\0\0\0\0\0\0\1\0\0\0\0\0\11\4\1\1\1\0>\0@\0\250\6\31\1\270\0\0\0\377\377\377\377\0\0\0\0@ \332\1\0\0\0\0\236\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0(\0,\0\350\6\31\1\0\0\0\0\0\0\0\0\310\335\22\0\0\0\0\0" )  ) == 0x0
 01315   868   NtClose  (184, ... ) == 0x0
 01316   868   NtClose  (188, ... ) == 0x0
 01317   868   NtUnmapViewOfSection  (-1, 0x1b70000, ... ) == 0x0
 01318   868   NtQueryDebugFilterState  (53, 2, ... ) == 0x0
 01319   868   NtOpenKey  (0x8, {24, 0, 0x40, 0, 0,  (0x8, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows\CurrentVersion\SideBySide\AssemblyStorageRoots"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01320   868   NtQueryDebugFilterState  (53, 2, ... ) == 0x0
 01321   868   NtQueryDebugFilterState  (53, 2, ... ) == 0x0
 01322   868   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\u:\work\packed.exe.Local\"}, 1233568, ... ) }, 1233568, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01323   868   NtQueryDebugFilterState  (53, 2, ... ) == 0x0
 01324   868   NtQueryDebugFilterState  (53, 2, ... ) == 0x0
 01325   868   NtQueryDebugFilterState  (53, 2, ... ) == 0x0
 01326   868   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.2982_x-ww_ac3f9c03"}, 1233632, ... ) }, 1233632, ... ) == 0x0
 01327   868   NtOpenFile  (0x100020, {24, 0, 0x40, 0, 0,  (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.2982_x-ww_ac3f9c03"}, 3, 33, ... 188, {status=0x0, info=1}, ) }, 3, 33, ... 188, {status=0x0, info=1}, ) == 0x0
 01328   868   NtQueryDebugFilterState  (53, 2, ... ) == 0x0
 01329   868   NtOpenSection  (0xe, {24, 8, 0x40, 0, 0,  (0xe, {24, 8, 0x40, 0, 0, "comctl32.dll"}, ... 184, ) }, ... 184, ) == 0x0
 01330   868   NtMapViewOfSection  (184, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x5d090000), 0x0, 630784, ) == 0x0
 01331   868   NtClose  (184, ... ) == 0x0
 01332   868   NtProtectVirtualMemory  (-1, (0x5d091000), 1656, 4, ... (0x5d091000), 4096, 32, ) == 0x0
 01333   868   NtProtectVirtualMemory  (-1, (0x5d091000), 4096, 32, ... (0x5d091000), 4096, 4, ) == 0x0
 01334   868   NtFlushInstructionCache  (-1, 1560875008, 1656, ... ) == 0x0
 01335   868   NtProtectVirtualMemory  (-1, (0x5d091000), 1656, 4, ... (0x5d091000), 4096, 32, ) == 0x0
 01336   868   NtProtectVirtualMemory  (-1, (0x5d091000), 4096, 32, ... (0x5d091000), 4096, 4, ) == 0x0
 01337   868   NtFlushInstructionCache  (-1, 1560875008, 1656, ... ) == 0x0
 01338   868   NtProtectVirtualMemory  (-1, (0x5d091000), 1656, 4, ... (0x5d091000), 4096, 32, ) == 0x0
 01339   868   NtProtectVirtualMemory  (-1, (0x5d091000), 4096, 32, ... (0x5d091000), 4096, 4, ) == 0x0
 01340   868   NtFlushInstructionCache  (-1, 1560875008, 1656, ... ) == 0x0
 01341   868   NtProtectVirtualMemory  (-1, (0x5d091000), 1656, 4, ... (0x5d091000), 4096, 32, ) == 0x0
 01342   868   NtProtectVirtualMemory  (-1, (0x5d091000), 4096, 32, ... (0x5d091000), 4096, 4, ) == 0x0
 01343   868   NtFlushInstructionCache  (-1, 1560875008, 1656, ... ) == 0x0
 01344   868   NtProtectVirtualMemory  (-1, (0x5d091000), 1656, 4, ... (0x5d091000), 4096, 32, ) == 0x0
 01345   868   NtProtectVirtualMemory  (-1, (0x5d091000), 4096, 32, ... (0x5d091000), 4096, 4, ) == 0x0
 01346   868   NtFlushInstructionCache  (-1, 1560875008, 1656, ... ) == 0x0
 01347   868   NtOpenKey  (0x80000000, {24, 0, 0x40, 0, 0,  (0x80000000, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\comctl32.dll"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01348   868   NtQuerySystemInformation  (Basic, 44, ... {Unknown=0,MaximumIncrement=156250,PhysicalPageSize=0x1000,NumberOfPhysicalPages=0xff7c,LowestPhysicalPage=0x1,HighestPhysicalPage=0xffff,AllocationGranularity=0x10000,LowestUserAddress=0x10000,HighestUserAddress=0x7ffeffff,ActiveProcessors=1,NumberProcessors=1,}, 0x0, ) == 0x0
 01349   868   NtAllocateVirtualMemory  (-1, 0, 0, 65536, 8192, 4, ... 3932160, 65536, ) == 0x0
 01350   868   NtAllocateVirtualMemory  (-1, 3932160, 0, 4096, 4096, 4, ... 3932160, 4096, ) == 0x0
 01351   868   NtAllocateVirtualMemory  (-1, 3936256, 0, 8192, 4096, 4, ... 3936256, 8192, ) == 0x0
 01352   868   NtAllocateVirtualMemory  (-1, 3944448, 0, 4096, 4096, 4, ... 3944448, 4096, ) == 0x0
 01353   868   NtAllocateVirtualMemory  (-1, 3948544, 0, 4096, 4096, 4, ... 3948544, 4096, ) == 0x0
 01354   868   NtQueryDefaultUILanguage  (1234408, ...
 01355   868   NtOpenThreadTokenEx  (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN
 01356   868   NtOpenProcessTokenEx  (-1, 0x20008, 512, ... -2147482740, ) == 0x0
 01357   868   NtQueryInformationToken  (-2147482740, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0
 01358   868   NtClose  (-2147482740, ... ) == 0x0
 01359   868   NtOpenKey  (0x2000000, {24, 0, 0x640, 0, 0,  (0x2000000, {24, 0, 0x640, 0, 0, "\REGISTRY\USER\S-1-5-21-1292428093-1383384898-725345543-1003"}, ... -2147482740, ) }, ... -2147482740, ) == 0x0
 01360   868   NtOpenKey  (0x80000000, {24, -2147482740, 0x240, 0, 0,  (0x80000000, {24, -2147482740, 0x240, 0, 0, "Software\Policies\Microsoft\Control Panel\Desktop"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01361   868   NtOpenKey  (0x80000000, {24, -2147482740, 0x640, 0, 0,  (0x80000000, {24, -2147482740, 0x640, 0, 0, "Control Panel\Desktop"}, ... -2147481328, ) }, ... -2147481328, ) == 0x0
 01362   868   NtQueryValueKey  (-2147481328,  (-2147481328, "MultiUILanguageId", Partial, 256, ... ) , Partial, 256, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01363   868   NtClose  (-2147481328, ... ) == 0x0
 01364   868   NtClose  (-2147482740, ... ) == 0x0
 01354   868   NtQueryDefaultUILanguage  ... ) == 0x0
 01365   868   NtOpenFile  (0x1200a9, {24, 0, 0x40, 0, 0,  (0x1200a9, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\comctl32.dll"}, 1, 96, ... 184, {status=0x0, info=1}, ) }, 1, 96, ... 184, {status=0x0, info=1}, ) == 0x0
 01366   868   NtCreateSection  (0x4, 0x0, 0x0, 2, 134217728, 184, ... 192, ) == 0x0
 01367   868   NtMapViewOfSection  (192, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 2, ... (0x1b70000), 0x0, 618496, ) == 0x0
 01368   868   NtOpenFile  (0x1200a9, {24, 0, 0x40, 0, 0,  (0x1200a9, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\comctl32.dll.124.Manifest"}, 1, 96, ... ) }, 1, 96, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01369   868   NtQueryDefaultLocale  (1, 1232504, ... ) == 0x0
 01370   868   NtOpenFile  (0x1200a9, {24, 0, 0x40, 0, 0,  (0x1200a9, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\comctl32.dll.124.Config"}, 1, 96, ... ) }, 1, 96, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01371   868   NtRequestWaitReplyPort  (24, {128, 156, new_msg, 0, 2088850039, 1233540, 1179817, 1233264}  (24, {128, 156, new_msg, 0, 2088850039, 1233540, 1179817, 1233264} "\210\6\31\1\33\0\1\0`\0\0\0\0\0\0\0\1\0\0\0\0\0\11\4\1\1\1\0@\0D\0\250\6\31\1\270\0\0\0\377\377\377\377\0\0\0\0\340q\276\1\0\0\0\0k\10\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0(\0,\0\354\6\31\1\0\0\0\0\0\0\0\0x\326\22\0\0\0\0\0" ... {128, 156, reply, 0, 1228, 868, 58002, 0} "\300\270\26\0\33\0\1\0\0\0\0\0\0\0\0\0\1\0\0\0\0\0\11\4\1\1\1\0@\0D\0\250\6\31\1\270\0\0\0\377\377\377\377\0\0\0\0\340q\276\1\0\0\0\0k\10\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0(\0,\0\354\6\31\1\0\0\0\0\0\0\0\0x\326\22\0\0\0\0\0" )  ... {128, 156, reply, 0, 1228, 868, 58002, 0}  (24, {128, 156, new_msg, 0, 2088850039, 1233540, 1179817, 1233264} "\210\6\31\1\33\0\1\0`\0\0\0\0\0\0\0\1\0\0\0\0\0\11\4\1\1\1\0@\0D\0\250\6\31\1\270\0\0\0\377\377\377\377\0\0\0\0\340q\276\1\0\0\0\0k\10\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0(\0,\0\354\6\31\1\0\0\0\0\0\0\0\0x\326\22\0\0\0\0\0" ... {128, 156, reply, 0, 1228, 868, 58002, 0} "\300\270\26\0\33\0\1\0\0\0\0\0\0\0\0\0\1\0\0\0\0\0\11\4\1\1\1\0@\0D\0\250\6\31\1\270\0\0\0\377\377\377\377\0\0\0\0\340q\276\1\0\0\0\0k\10\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0(\0,\0\354\6\31\1\0\0\0\0\0\0\0\0x\326\22\0\0\0\0\0" )  ) == 0x0
 01372   868   NtClose  (184, ... ) == 0x0
 01373   868   NtClose  (192, ... ) == 0x0
 01374   868   NtUnmapViewOfSection  (-1, 0x1b70000, ... ) == 0x0
 01375   868   NtQueryDebugFilterState  (53, 2, ... ) == 0x0
 01376   868   NtOpenProcess  (0x400, {24, 0, 0x0, 0, 0, 0x0}, {1228, 0}, ... 192, ) == 0x0
 01377   868   NtQueryInformationProcess  (192, Session, 4, ... {SessionId=0,}, 0x0, ) == 0x0
 01378   868   NtClose  (192, ... ) == 0x0
 01379   868   NtUserRegisterWindowMessage  ( ("ShellGetDragImage", ... ) , ... ) == 0xc03a
 01380   868   NtUserSystemParametersInfo  (104, 0, 1561338260, 0, ... ) == 0x1
 01381   868   NtUserSystemParametersInfo  (38, 4, 1561337988, 0, ... ) == 0x1
 01382   868   NtOpenThreadTokenEx  (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN
 01383   868   NtOpenProcessTokenEx  (-1, 0x20008, 512, ... 192, ) == 0x0
 01384   868   NtQueryInformationToken  (192, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0
 01385   868   NtClose  (192, ... ) == 0x0
 01386   868   NtOpenKey  (0x20019, {24, 0, 0x640, 0, 0,  (0x20019, {24, 0, 0x640, 0, 0, "\REGISTRY\USER\S-1-5-21-1292428093-1383384898-725345543-1003"}, ... 192, ) }, ... 192, ) == 0x0
 01387   868   NtOpenProcessToken  (-1, 0x8, ... 184, ) == 0x0
 01388   868   NtAccessCheck  (1345664, 184, 0x1, 1235600, 1235652, 56, 1235632, ... ) == STATUS_NO_IMPERSONATION_TOKEN
 01389   868   NtClose  (184, ... ) == 0x0
 01390   868   NtOpenKey  (0x20019, {24, 192, 0x40, 0, 0,  (0x20019, {24, 192, 0x40, 0, 0, "Control Panel\Desktop"}, ... 184, ) }, ... 184, ) == 0x0
 01391   868   NtQueryValueKey  (184,  (184, "SmoothScroll", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01392   868   NtClose  (184, ... ) == 0x0
 01393   868   NtUserSystemParametersInfo  (41, 500, 1235780, 0, ... ) == 0x1
 01394   868   NtUserSystemParametersInfo  (102, 0, 1561338280, 0, ... ) == 0x1
 01395   868   NtClose  (192, ... ) == 0x0
 01396   868   NtUserFindExistingCursorIcon  (1235532, 1235548, 1235596, ... ) == 0x10011
 01397   868   NtUserRegisterClassExWOW  (1235476, 1235544, 1235560, 1235576, 0, 384, 0, ... ) == 0x81b1c03b
 01398   868   NtUserRegisterClassExWOW  (1235476, 1235544, 1235560, 1235576, 0, 384, 0, ... ) == 0x81b1c03d
 01399   868   NtUserFindExistingCursorIcon  (1235532, 1235548, 1235596, ... ) == 0x10011
 01400   868   NtUserRegisterClassExWOW  (1235476, 1235544, 1235560, 1235576, 0, 384, 0, ... ) == 0x81b1c03f
 01401   868   NtUserFindExistingCursorIcon  (1235532, 1235548, 1235596, ... ) == 0x10011
 01402   868   NtUserRegisterClassExWOW  (1235476, 1235544, 1235560, 1235576, 0, 384, 0, ... ) == 0x81b1c041
 01403   868   NtUserFindExistingCursorIcon  (1235532, 1235548, 1235596, ... ) == 0x10011
 01404   868   NtUserRegisterClassExWOW  (1235476, 1235544, 1235560, 1235576, 0, 384, 0, ... ) == 0x81b1c043
 01405   868   NtUserRegisterClassExWOW  (1235476, 1235544, 1235560, 1235576, 0, 384, 0, ... ) == 0x81b1c045
 01406   868   NtUserFindExistingCursorIcon  (1235532, 1235548, 1235596, ... ) == 0x10011
 01407   868   NtUserRegisterClassExWOW  (1235476, 1235544, 1235560, 1235576, 0, 384, 0, ... ) == 0x81b1c047
 01408   868   NtUserFindExistingCursorIcon  (1235532, 1235548, 1235596, ... ) == 0x10011
 01409   868   NtUserRegisterClassExWOW  (1235476, 1235544, 1235560, 1235576, 0, 384, 0, ... ) == 0x81b1c049
 01410   868   NtUserFindExistingCursorIcon  (1235532, 1235548, 1235596, ... ) == 0x10011
 01411   868   NtUserRegisterClassExWOW  (1235476, 1235544, 1235560, 1235576, 0, 384, 0, ... ) == 0x81b1c04b
 01412   868   NtUserFindExistingCursorIcon  (1235532, 1235548, 1235596, ... ) == 0x10011
 01413   868   NtUserRegisterClassExWOW  (1235476, 1235544, 1235560, 1235576, 0, 384, 0, ... ) == 0x81b1c04d
 01414   868   NtUserFindExistingCursorIcon  (1235532, 1235548, 1235596, ... ) == 0x10011
 01415   868   NtUserRegisterClassExWOW  (1235476, 1235544, 1235560, 1235576, 0, 384, 0, ... ) == 0x81b1c04f
 01416   868   NtUserRegisterClassExWOW  (1235476, 1235544, 1235560, 1235576, 0, 384, 0, ... ) == 0x81b1c051
 01417   868   NtUserFindExistingCursorIcon  (1235532, 1235548, 1235596, ... ) == 0x10011
 01418   868   NtUserRegisterClassExWOW  (1235476, 1235544, 1235560, 1235576, 0, 384, 0, ... ) == 0x81b1c053
 01419   868   NtUserFindExistingCursorIcon  (1235528, 1235544, 1235592, ... ) == 0x10011
 01420   868   NtUserRegisterClassExWOW  (1235472, 1235540, 1235556, 1235572, 0, 384, 0, ... ) == 0x81b1c055
 01421   868   NtUserFindExistingCursorIcon  (1235528, 1235544, 1235592, ... ) == 0x10011
 01422   868   NtUserRegisterClassExWOW  (1235472, 1235540, 1235556, 1235572, 0, 384, 0, ... ) == 0x81b1c057
 01423   868   NtUserFindExistingCursorIcon  (1235532, 1235548, 1235596, ... ) == 0x10011
 01424   868   NtUserRegisterClassExWOW  (1235476, 1235544, 1235560, 1235576, 0, 384, 0, ... ) == 0x81b1c059
 01425   868   NtUserFindExistingCursorIcon  (1235532, 1235548, 1235596, ... ) == 0x10013
 01426   868   NtUserRegisterClassExWOW  (1235476, 1235544, 1235560, 1235576, 0, 384, 0, ... ) == 0x81b1c05b
 01427   868   NtUserFindExistingCursorIcon  (1235532, 1235548, 1235596, ... ) == 0x10011
 01428   868   NtUserRegisterClassExWOW  (1235476, 1235544, 1235560, 1235576, 0, 384, 0, ... ) == 0x81b1c05d
 01429   868   NtUserFindExistingCursorIcon  (1235532, 1235548, 1235596, ... ) == 0x10011
 01430   868   NtUserRegisterClassExWOW  (1235476, 1235544, 1235560, 1235576, 0, 384, 0, ... ) == 0x81b1c05f
 01431   868   NtOpenThreadToken  (-2, 0xc, 1, ... ) == STATUS_NO_TOKEN
 01432   868   NtCreateSemaphore  (0x1f0003, {24, 16, 0x80, 1339880, 0,  (0x1f0003, {24, 16, 0x80, 1339880, 0, "shell.{210A4BA0-3AEA-1069-A2D9-08002B30309D}"}, 0, 2147483647, ... 192, ) }, 0, 2147483647, ... 192, ) == STATUS_OBJECT_NAME_EXISTS
 01433   868   NtReleaseSemaphore  (192, 1, ... 0, ) == 0x0
 01434   868   NtWaitForSingleObject  (192, 0, {0, 0}, ... ) == 0x0
 01435   868   NtCreateKey  (0x2000000, {24, 140, 0x40, 0, 0,  (0x2000000, {24, 140, 0x40, 0, 0, "Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders"}, 0, 0x0, 0, ... 184, 2, ) }, 0, 0x0, 0, ... 184, 2, ) == 0x0
 01436   868   NtQueryValueKey  (184,  (184, "Cache", Partial, 144, ... TitleIdx=0, Type=2, Data="%\0U\0S\0E\0R\0P\0R\0O\0F\0I\0L\0E\0%\0\\0L\0o\0c\0a\0l\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0T\0e\0m\0p\0o\0r\0a\0r\0y\0 \0I\0n\0t\0e\0r\0n\0e\0t\0 \0F\0i\0l\0e\0s\0\0\0"}, 120, ) , Partial, 144, ... TitleIdx=0, Type=2, Data= (184, "Cache", Partial, 144, ... TitleIdx=0, Type=2, Data="%\0U\0S\0E\0R\0P\0R\0O\0F\0I\0L\0E\0%\0\\0L\0o\0c\0a\0l\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0T\0e\0m\0p\0o\0r\0a\0r\0y\0 \0I\0n\0t\0e\0r\0n\0e\0t\0 \0F\0i\0l\0e\0s\0\0\0"}, 120, ) }, 120, ) == 0x0
 01437   868   NtClose  (184, ... ) == 0x0
 01438   868   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\Documents and Settings\Martim Carbone\Local Settings\Temporary Internet Files"}, 1239352, ... ) }, 1239352, ... ) == 0x0
 01439   868   NtCreateKey  (0x2000000, {24, 140, 0x40, 0, 0,  (0x2000000, {24, 140, 0x40, 0, 0, "Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders"}, 0, 0x0, 0, ... 184, 2, ) }, 0, 0x0, 0, ... 184, 2, ) == 0x0
 01440   868   NtSetValueKey  (184,  (184, "Cache", 0, 1, "C\0:\0\\0D\0o\0c\0u\0m\0e\0n\0t\0s\0 \0a\0n\0d\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0M\0a\0r\0t\0i\0m\0 \0C\0a\0r\0b\0o\0n\0e\0\\0L\0o\0c\0a\0l\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0T\0e\0m\0p\0o\0r\0a\0r\0y\0 \0I\0n\0t\0e\0r\0n\0e\0t\0 \0F\0i\0l\0e\0s\0\0\0", 162, ... ) , 0, 1,  (184, "Cache", 0, 1, "C\0:\0\\0D\0o\0c\0u\0m\0e\0n\0t\0s\0 \0a\0n\0d\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0M\0a\0r\0t\0i\0m\0 \0C\0a\0r\0b\0o\0n\0e\0\\0L\0o\0c\0a\0l\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0T\0e\0m\0p\0o\0r\0a\0r\0y\0 \0I\0n\0t\0e\0r\0n\0e\0t\0 \0F\0i\0l\0e\0s\0\0\0", 162, ... ) , 162, ... ) == 0x0
 01441   868   NtClose  (184, ... ) == 0x0
 01442   868   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\Documents and Settings\Martim Carbone\Local Settings\Temporary Internet Files"}, 1240044, ... ) }, 1240044, ... ) == 0x0
 01443   868   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\Documents and Settings\Martim Carbone\Local Settings\Temporary Internet Files"}, 1239252, ... ) }, 1239252, ... ) == 0x0
 01444   868   NtOpenFile  (0x100100, {24, 0, 0x40, 0, 0,  (0x100100, {24, 0, 0x40, 0, 0, "\??\C:\Documents and Settings\Martim Carbone\Local Settings\Temporary Internet Files"}, 7, 2113568, ... 184, {status=0x0, info=1}, ) }, 7, 2113568, ... 184, {status=0x0, info=1}, ) == 0x0
 01445   868   NtSetInformationFile  (184, 1239224, 40, Basic, ... {status=0x0, info=0}, ) == 0x0
 01446   868   NtClose  (184, ... ) == 0x0
 01447   868   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\Documents and Settings\Martim Carbone\Local Settings\Temporary Internet Files\desktop.ini"}, 1239248, ... ) }, 1239248, ... ) == 0x0
 01448   868   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\Documents and Settings\Martim Carbone\Local Settings\Temporary Internet Files\Content.IE5"}, 1240044, ... ) }, 1240044, ... ) == 0x0
 01449   868   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\Documents and Settings\Martim Carbone\Local Settings\Temporary Internet Files\Content.IE5"}, 1239252, ... ) }, 1239252, ... ) == 0x0
 01450   868   NtOpenFile  (0x100100, {24, 0, 0x40, 0, 0,  (0x100100, {24, 0, 0x40, 0, 0, "\??\C:\Documents and Settings\Martim Carbone\Local Settings\Temporary Internet Files\Content.IE5"}, 7, 2113568, ... 184, {status=0x0, info=1}, ) }, 7, 2113568, ... 184, {status=0x0, info=1}, ) == 0x0
 01451   868   NtSetInformationFile  (184, 1239224, 40, Basic, ... {status=0x0, info=0}, ) == 0x0
 01452   868   NtClose  (184, ... ) == 0x0
 01453   868   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\Documents and Settings\Martim Carbone\Local Settings\Temporary Internet Files\Content.IE5\desktop.ini"}, 1239248, ... ) }, 1239248, ... ) == 0x0
 01454   868   NtQueryValueKey  (180,  (180, "CachePrefix", Partial, 144, ... TitleIdx=0, Type=1, Data="\0\0"}, 14, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (180, "CachePrefix", Partial, 144, ... TitleIdx=0, Type=1, Data="\0\0"}, 14, ) }, 14, ) == 0x0
 01455   868   NtQueryValueKey  (180,  (180, "CachePrefix", Partial, 144, ... TitleIdx=0, Type=1, Data="\0\0"}, 14, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (180, "CachePrefix", Partial, 144, ... TitleIdx=0, Type=1, Data="\0\0"}, 14, ) }, 14, ) == 0x0
 01456   868   NtQueryValueKey  (180,  (180, "CacheLimit", Partial, 144, ... TitleIdx=0, Type=4, Data="\260\376\3\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (180, "CacheLimit", Partial, 144, ... TitleIdx=0, Type=4, Data="\260\376\3\0"}, 16, ) }, 16, ) == 0x0
 01457   868   NtOpenKey  (0xf, {24, 176, 0x40, 0, 0,  (0xf, {24, 176, 0x40, 0, 0, "Cookies"}, ... 184, ) }, ... 184, ) == 0x0
 01458   868   NtQueryValueKey  (184,  (184, "PerUserItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01459   868   NtOpenKey  (0xf, {24, 172, 0x40, 0, 0,  (0xf, {24, 172, 0x40, 0, 0, "Cookies"}, ... 196, ) }, ... 196, ) == 0x0
 01460   868   NtQueryValueKey  (196,  (196, "PerUserItem", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (196, "PerUserItem", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) }, 16, ) == 0x0
 01461   868   NtClose  (196, ... ) == 0x0
 01462   868   NtClose  (184, ... ) == 0x0
 01463   868   NtClose  (180, ... ) == 0x0
 01464   868   NtOpenKey  (0xf, {24, 176, 0x40, 0, 0,  (0xf, {24, 176, 0x40, 0, 0, "Cookies"}, ... 180, ) }, ... 180, ) == 0x0
 01465   868   NtOpenThreadToken  (-2, 0xc, 1, ... ) == STATUS_NO_TOKEN
 01466   868   NtReleaseSemaphore  (192, 1, ... 0, ) == 0x0
 01467   868   NtWaitForSingleObject  (192, 0, {0, 0}, ... ) == 0x0
 01468   868   NtCreateKey  (0x2000000, {24, 140, 0x40, 0, 0,  (0x2000000, {24, 140, 0x40, 0, 0, "Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders"}, 0, 0x0, 0, ... 184, 2, ) }, 0, 0x0, 0, ... 184, 2, ) == 0x0
 01469   868   NtQueryValueKey  (184,  (184, "Cookies", Partial, 144, ... TitleIdx=0, Type=2, Data="%\0U\0S\0E\0R\0P\0R\0O\0F\0I\0L\0E\0%\0\\0C\0o\0o\0k\0i\0e\0s\0\0\0"}, 56, ) , Partial, 144, ... TitleIdx=0, Type=2, Data= (184, "Cookies", Partial, 144, ... TitleIdx=0, Type=2, Data="%\0U\0S\0E\0R\0P\0R\0O\0F\0I\0L\0E\0%\0\\0C\0o\0o\0k\0i\0e\0s\0\0\0"}, 56, ) }, 56, ) == 0x0
 01470   868   NtClose  (184, ... ) == 0x0
 01471   868   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\Documents and Settings\Martim Carbone\Cookies"}, 1239352, ... ) }, 1239352, ... ) == 0x0
 01472   868   NtCreateKey  (0x2000000, {24, 140, 0x40, 0, 0,  (0x2000000, {24, 140, 0x40, 0, 0, "Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders"}, 0, 0x0, 0, ... 184, 2, ) }, 0, 0x0, 0, ... 184, 2, ) == 0x0
 01473   868   NtSetValueKey  (184,  (184, "Cookies", 0, 1, "C\0:\0\\0D\0o\0c\0u\0m\0e\0n\0t\0s\0 \0a\0n\0d\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0M\0a\0r\0t\0i\0m\0 \0C\0a\0r\0b\0o\0n\0e\0\\0C\0o\0o\0k\0i\0e\0s\0\0\0", 98, ... ) , 0, 1,  (184, "Cookies", 0, 1, "C\0:\0\\0D\0o\0c\0u\0m\0e\0n\0t\0s\0 \0a\0n\0d\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0M\0a\0r\0t\0i\0m\0 \0C\0a\0r\0b\0o\0n\0e\0\\0C\0o\0o\0k\0i\0e\0s\0\0\0", 98, ... ) , 98, ... ) == 0x0
 01474   868   NtClose  (184, ... ) == 0x0
 01475   868   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\Documents and Settings\Martim Carbone\Cookies"}, 1240044, ... ) }, 1240044, ... ) == 0x0
 01476   868   NtQueryValueKey  (180,  (180, "CachePrefix", Partial, 144, ... TitleIdx=0, Type=1, Data="C\0o\0o\0k\0i\0e\0:\0\0\0"}, 28, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (180, "CachePrefix", Partial, 144, ... TitleIdx=0, Type=1, Data="C\0o\0o\0k\0i\0e\0:\0\0\0"}, 28, ) }, 28, ) == 0x0
 01477   868   NtQueryValueKey  (180,  (180, "CachePrefix", Partial, 144, ... TitleIdx=0, Type=1, Data="C\0o\0o\0k\0i\0e\0:\0\0\0"}, 28, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (180, "CachePrefix", Partial, 144, ... TitleIdx=0, Type=1, Data="C\0o\0o\0k\0i\0e\0:\0\0\0"}, 28, ) }, 28, ) == 0x0
 01478   868   NtQueryValueKey  (180,  (180, "CacheLimit", Partial, 144, ... TitleIdx=0, Type=4, Data="\0 \0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (180, "CacheLimit", Partial, 144, ... TitleIdx=0, Type=4, Data="\0 \0\0"}, 16, ) }, 16, ) == 0x0
 01479   868   NtOpenKey  (0xf, {24, 176, 0x40, 0, 0,  (0xf, {24, 176, 0x40, 0, 0, "History"}, ... 184, ) }, ... 184, ) == 0x0
 01480   868   NtQueryValueKey  (184,  (184, "PerUserItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01481   868   NtOpenKey  (0xf, {24, 172, 0x40, 0, 0,  (0xf, {24, 172, 0x40, 0, 0, "History"}, ... 196, ) }, ... 196, ) == 0x0
 01482   868   NtQueryValueKey  (196,  (196, "PerUserItem", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (196, "PerUserItem", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) }, 16, ) == 0x0
 01483   868   NtClose  (196, ... ) == 0x0
 01484   868   NtClose  (184, ... ) == 0x0
 01485   868   NtClose  (180, ... ) == 0x0
 01486   868   NtOpenKey  (0xf, {24, 176, 0x40, 0, 0,  (0xf, {24, 176, 0x40, 0, 0, "History"}, ... 180, ) }, ... 180, ) == 0x0
 01487   868   NtOpenThreadToken  (-2, 0xc, 1, ... ) == STATUS_NO_TOKEN
 01488   868   NtReleaseSemaphore  (192, 1, ... 0, ) == 0x0
 01489   868   NtWaitForSingleObject  (192, 0, {0, 0}, ... ) == 0x0
 01490   868   NtCreateKey  (0x2000000, {24, 140, 0x40, 0, 0,  (0x2000000, {24, 140, 0x40, 0, 0, "Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders"}, 0, 0x0, 0, ... 184, 2, ) }, 0, 0x0, 0, ... 184, 2, ) == 0x0
 01491   868   NtQueryValueKey  (184,  (184, "History", Partial, 144, ... TitleIdx=0, Type=2, Data="%\0U\0S\0E\0R\0P\0R\0O\0F\0I\0L\0E\0%\0\\0L\0o\0c\0a\0l\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0H\0i\0s\0t\0o\0r\0y\0\0\0"}, 86, ) , Partial, 144, ... TitleIdx=0, Type=2, Data= (184, "History", Partial, 144, ... TitleIdx=0, Type=2, Data="%\0U\0S\0E\0R\0P\0R\0O\0F\0I\0L\0E\0%\0\\0L\0o\0c\0a\0l\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0H\0i\0s\0t\0o\0r\0y\0\0\0"}, 86, ) }, 86, ) == 0x0
 01492   868   NtClose  (184, ... ) == 0x0
 01493   868   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\Documents and Settings\Martim Carbone\Local Settings\History"}, 1239352, ... ) }, 1239352, ... ) == 0x0
 01494   868   NtCreateKey  (0x2000000, {24, 140, 0x40, 0, 0,  (0x2000000, {24, 140, 0x40, 0, 0, "Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders"}, 0, 0x0, 0, ... 184, 2, ) }, 0, 0x0, 0, ... 184, 2, ) == 0x0
 01495   868   NtSetValueKey  (184,  (184, "History", 0, 1, "C\0:\0\\0D\0o\0c\0u\0m\0e\0n\0t\0s\0 \0a\0n\0d\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0M\0a\0r\0t\0i\0m\0 \0C\0a\0r\0b\0o\0n\0e\0\\0L\0o\0c\0a\0l\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0H\0i\0s\0t\0o\0r\0y\0\0\0", 128, ... ) , 0, 1,  (184, "History", 0, 1, "C\0:\0\\0D\0o\0c\0u\0m\0e\0n\0t\0s\0 \0a\0n\0d\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0M\0a\0r\0t\0i\0m\0 \0C\0a\0r\0b\0o\0n\0e\0\\0L\0o\0c\0a\0l\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0H\0i\0s\0t\0o\0r\0y\0\0\0", 128, ... ) , 128, ... ) == 0x0
 01496   868   NtClose  (184, ... ) == 0x0
 01497   868   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\Documents and Settings\Martim Carbone\Local Settings\History"}, 1240044, ... ) }, 1240044, ... ) == 0x0
 01498   868   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\Documents and Settings\Martim Carbone\Local Settings\History"}, 1239252, ... ) }, 1239252, ... ) == 0x0
 01499   868   NtOpenFile  (0x100100, {24, 0, 0x40, 0, 0,  (0x100100, {24, 0, 0x40, 0, 0, "\??\C:\Documents and Settings\Martim Carbone\Local Settings\History"}, 7, 2113568, ... 184, {status=0x0, info=1}, ) }, 7, 2113568, ... 184, {status=0x0, info=1}, ) == 0x0
 01500   868   NtSetInformationFile  (184, 1239224, 40, Basic, ... {status=0x0, info=0}, ) == 0x0
 01501   868   NtClose  (184, ... ) == 0x0
 01502   868   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\Documents and Settings\Martim Carbone\Local Settings\History\desktop.ini"}, 1239248, ... ) }, 1239248, ... ) == 0x0
 01503   868   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\Documents and Settings\Martim Carbone\Local Settings\History\History.IE5"}, 1240044, ... ) }, 1240044, ... ) == 0x0
 01504   868   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\Documents and Settings\Martim Carbone\Local Settings\History\History.IE5"}, 1239252, ... ) }, 1239252, ... ) == 0x0
 01505   868   NtOpenFile  (0x100100, {24, 0, 0x40, 0, 0,  (0x100100, {24, 0, 0x40, 0, 0, "\??\C:\Documents and Settings\Martim Carbone\Local Settings\History\History.IE5"}, 7, 2113568, ... 184, {status=0x0, info=1}, ) }, 7, 2113568, ... 184, {status=0x0, info=1}, ) == 0x0
 01506   868   NtSetInformationFile  (184, 1239224, 40, Basic, ... {status=0x0, info=0}, ) == 0x0
 01507   868   NtClose  (184, ... ) == 0x0
 01508   868   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\Documents and Settings\Martim Carbone\Local Settings\History\History.IE5\desktop.ini"}, 1239248, ... ) }, 1239248, ... ) == 0x0
 01509   868   NtQueryValueKey  (180,  (180, "CachePrefix", Partial, 144, ... TitleIdx=0, Type=1, Data="V\0i\0s\0i\0t\0e\0d\0:\0\0\0"}, 30, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (180, "CachePrefix", Partial, 144, ... TitleIdx=0, Type=1, Data="V\0i\0s\0i\0t\0e\0d\0:\0\0\0"}, 30, ) }, 30, ) == 0x0
 01510   868   NtQueryValueKey  (180,  (180, "CachePrefix", Partial, 144, ... TitleIdx=0, Type=1, Data="V\0i\0s\0i\0t\0e\0d\0:\0\0\0"}, 30, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (180, "CachePrefix", Partial, 144, ... TitleIdx=0, Type=1, Data="V\0i\0s\0i\0t\0e\0d\0:\0\0\0"}, 30, ) }, 30, ) == 0x0
 01511   868   NtQueryValueKey  (180,  (180, "CacheLimit", Partial, 144, ... TitleIdx=0, Type=4, Data="\0 \0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (180, "CacheLimit", Partial, 144, ... TitleIdx=0, Type=4, Data="\0 \0\0"}, 16, ) }, 16, ) == 0x0
 01512   868   NtClose  (180, ... ) == 0x0
 01513   868   NtClose  (176, ... ) == 0x0
 01514   868   NtClose  (172, ... ) == 0x0
 01515   868   NtOpenMutant  (0x100000, {24, 16, 0x0, 0, 0,  (0x100000, {24, 16, 0x0, 0, 0, "Local\_!MSFTHISTORY!_"}, ... 172, ) }, ... 172, ) == 0x0
 01516   868   NtOpenMutant  (0x100000, {24, 16, 0x0, 0, 0,  (0x100000, {24, 16, 0x0, 0, 0, "Local\c:!documents and settings!martim carbone!local settings!temporary internet files!content.ie5!"}, ... 176, ) }, ... 176, ) == 0x0
 01517   868   NtWaitForSingleObject  (176, 0, 0x0, ... ) == 0x0
 01518   868   NtAllocateVirtualMemory  (-1, 1351680, 0, 4096, 4096, 4, ... 1351680, 4096, ) == 0x0
 01519   868   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\Documents and Settings\Martim Carbone\Local Settings\Temporary Internet Files\Content.IE5\"}, 1241352, ... ) }, 1241352, ... ) == 0x0
 01520   868   NtOpenFile  (0x100100, {24, 0, 0x40, 0, 0,  (0x100100, {24, 0, 0x40, 0, 0, "\??\C:\Documents and Settings\Martim Carbone\Local Settings\Temporary Internet Files\Content.IE5\"}, 7, 2113568, ... 180, {status=0x0, info=1}, ) }, 7, 2113568, ... 180, {status=0x0, info=1}, ) == 0x0
 01521   868   NtSetInformationFile  (180, 1241328, 40, Basic, ... {status=0x0, info=0}, ) == 0x0
 01522   868   NtClose  (180, ... ) == 0x0
 01523   868   NtCreateFile  (0xc0100080, {24, 0, 0x40, 0, 1241268,  (0xc0100080, {24, 0, 0x40, 0, 1241268, "\??\C:\Documents and Settings\Martim Carbone\Local Settings\Temporary Internet Files\Content.IE5\index.dat"}, 0x0, 8198, 3, 3, 2144, 0, 0, ... 180, {status=0x0, info=1}, ) }, 0x0, 8198, 3, 3, 2144, 0, 0, ... 180, {status=0x0, info=1}, ) == 0x0
 01524   868   NtSetInformationFile  (180, 1241320, 40, Basic, ... {status=0x0, info=0}, ) == 0x0
 01525   868   NtQueryInformationFile  (180, 1241320, 24, Standard, ... {status=0x0, info=24}, ) == 0x0
 01526   868   NtOpenSection  (0x2, {24, 16, 0x0, 0, 0,  (0x2, {24, 16, 0x0, 0, 0, "Local\C:_Documents and Settings_Martim Carbone_Local Settings_Temporary Internet Files_Content.IE5_index.dat_802816"}, ... 184, ) }, ... 184, ) == 0x0
 01527   868   NtMapViewOfSection  (184, -1, (0x0), 0, 0, {0, 0}, 0, 1, 0, 4, ... (0x1b70000), {0, 0}, 802816, ) == 0x0
 01528   868   NtReleaseMutant  (176, ... 0x0, ) == 0x0
 01529   868   NtOpenMutant  (0x100000, {24, 16, 0x0, 0, 0,  (0x100000, {24, 16, 0x0, 0, 0, "Local\c:!documents and settings!martim carbone!cookies!"}, ... 196, ) }, ... 196, ) == 0x0
 01530   868   NtWaitForSingleObject  (196, 0, 0x0, ... ) == 0x0
 01531   868   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\Documents and Settings\Martim Carbone\Cookies\"}, 1241352, ... ) }, 1241352, ... ) == 0x0
 01532   868   NtOpenFile  (0x100100, {24, 0, 0x40, 0, 0,  (0x100100, {24, 0, 0x40, 0, 0, "\??\C:\Documents and Settings\Martim Carbone\Cookies\"}, 7, 2113568, ... 200, {status=0x0, info=1}, ) }, 7, 2113568, ... 200, {status=0x0, info=1}, ) == 0x0
 01533   868   NtSetInformationFile  (200, 1241328, 40, Basic, ... {status=0x0, info=0}, ) == 0x0
 01534   868   NtClose  (200, ... ) == 0x0
 01535   868   NtCreateFile  (0xc0100080, {24, 0, 0x40, 0, 1241268,  (0xc0100080, {24, 0, 0x40, 0, 1241268, "\??\C:\Documents and Settings\Martim Carbone\Cookies\index.dat"}, 0x0, 8198, 3, 3, 2144, 0, 0, ... 200, {status=0x0, info=1}, ) }, 0x0, 8198, 3, 3, 2144, 0, 0, ... 200, {status=0x0, info=1}, ) == 0x0
 01536   868   NtSetInformationFile  (200, 1241320, 40, Basic, ... {status=0x0, info=0}, ) == 0x0
 01537   868   NtQueryInformationFile  (200, 1241320, 24, Standard, ... {status=0x0, info=24}, ) == 0x0
 01538   868   NtOpenSection  (0x2, {24, 16, 0x0, 0, 0,  (0x2, {24, 16, 0x0, 0, 0, "Local\C:_Documents and Settings_Martim Carbone_Cookies_index.dat_32768"}, ... 204, ) }, ... 204, ) == 0x0
 01539   868   NtMapViewOfSection  (204, -1, (0x0), 0, 0, {0, 0}, 0, 1, 0, 4, ... (0x3e0000), {0, 0}, 32768, ) == 0x0
 01540   868   NtReleaseMutant  (196, ... 0x0, ) == 0x0
 01541   868   NtOpenMutant  (0x100000, {24, 16, 0x0, 0, 0,  (0x100000, {24, 16, 0x0, 0, 0, "Local\c:!documents and settings!martim carbone!local settings!history!history.ie5!"}, ... 208, ) }, ... 208, ) == 0x0
 01542   868   NtWaitForSingleObject  (208, 0, 0x0, ... ) == 0x0
 01543   868   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\Documents and Settings\Martim Carbone\Local Settings\History\History.IE5\"}, 1241352, ... ) }, 1241352, ... ) == 0x0
 01544   868   NtOpenFile  (0x100100, {24, 0, 0x40, 0, 0,  (0x100100, {24, 0, 0x40, 0, 0, "\??\C:\Documents and Settings\Martim Carbone\Local Settings\History\History.IE5\"}, 7, 2113568, ... 212, {status=0x0, info=1}, ) }, 7, 2113568, ... 212, {status=0x0, info=1}, ) == 0x0
 01545   868   NtSetInformationFile  (212, 1241328, 40, Basic, ... {status=0x0, info=0}, ) == 0x0
 01546   868   NtClose  (212, ... ) == 0x0
 01547   868   NtCreateFile  (0xc0100080, {24, 0, 0x40, 0, 1241268,  (0xc0100080, {24, 0, 0x40, 0, 1241268, "\??\C:\Documents and Settings\Martim Carbone\Local Settings\History\History.IE5\index.dat"}, 0x0, 8198, 3, 3, 2144, 0, 0, ... 212, {status=0x0, info=1}, ) }, 0x0, 8198, 3, 3, 2144, 0, 0, ... 212, {status=0x0, info=1}, ) == 0x0
 01548   868   NtSetInformationFile  (212, 1241320, 40, Basic, ... {status=0x0, info=0}, ) == 0x0
 01549   868   NtQueryInformationFile  (212, 1241320, 24, Standard, ... {status=0x0, info=24}, ) == 0x0
 01550   868   NtOpenSection  (0x2, {24, 16, 0x0, 0, 0,  (0x2, {24, 16, 0x0, 0, 0, "Local\C:_Documents and Settings_Martim Carbone_Local Settings_History_History.IE5_index.dat_81920"}, ... 216, ) }, ... 216, ) == 0x0
 01551   868   NtMapViewOfSection  (216, -1, (0x0), 0, 0, {0, 0}, 0, 1, 0, 4, ... (0x1c40000), {0, 0}, 81920, ) == 0x0
 01552   868   NtReleaseMutant  (208, ... 0x0, ) == 0x0
 01553   868   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\Documents and Settings\Martim Carbone\Local Settings\Temporary Internet Files\Content.IE5\"}, 1240928, ... ) }, 1240928, ... ) == 0x0
 01554   868   NtOpenFile  (0x100100, {24, 0, 0x40, 0, 0,  (0x100100, {24, 0, 0x40, 0, 0, "\??\C:\Documents and Settings\Martim Carbone\Local Settings\Temporary Internet Files\Content.IE5\"}, 7, 2113568, ... 220, {status=0x0, info=1}, ) }, 7, 2113568, ... 220, {status=0x0, info=1}, ) == 0x0
 01555   868   NtSetInformationFile  (220, 1240900, 40, Basic, ... {status=0x0, info=0}, ) == 0x0
 01556   868   NtClose  (220, ... ) == 0x0
 01557   868   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\Documents and Settings\Martim Carbone\Local Settings\Temporary Internet Files\Content.IE5\desktop.ini"}, 1240924, ... ) }, 1240924, ... ) == 0x0
 01558   868   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\Documents and Settings\Martim Carbone\Local Settings\History\History.IE5\"}, 1240928, ... ) }, 1240928, ... ) == 0x0
 01559   868   NtOpenFile  (0x100100, {24, 0, 0x40, 0, 0,  (0x100100, {24, 0, 0x40, 0, 0, "\??\C:\Documents and Settings\Martim Carbone\Local Settings\History\History.IE5\"}, 7, 2113568, ... 220, {status=0x0, info=1}, ) }, 7, 2113568, ... 220, {status=0x0, info=1}, ) == 0x0
 01560   868   NtSetInformationFile  (220, 1240900, 40, Basic, ... {status=0x0, info=0}, ) == 0x0
 01561   868   NtClose  (220, ... ) == 0x0
 01562   868   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\Documents and Settings\Martim Carbone\Local Settings\History\History.IE5\desktop.ini"}, 1240924, ... ) }, 1240924, ... ) == 0x0
 01563   868   NtWaitForSingleObject  (176, 0, 0x0, ... ) == 0x0
 01564   868   NtReleaseMutant  (176, ... 0x0, ) == 0x0
 01565   868   NtOpenKey  (0xf, {24, 140, 0x40, 0, 0,  (0xf, {24, 140, 0x40, 0, 0, "Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache"}, ... 220, ) }, ... 220, ) == 0x0
 01566   868   NtOpenKey  (0xf, {24, 220, 0x40, 0, 0,  (0xf, {24, 220, 0x40, 0, 0, "Extensible Cache"}, ... 224, ) }, ... 224, ) == 0x0
 01567   868   NtClose  (220, ... ) == 0x0
 01568   868   NtWaitForSingleObject  (172, 0, {-600000000, -1}, ... ) == 0x0
 01569   868   NtEnumerateKey  (224, 0, Basic, 288, ... {LastWrite={0x47401762,0x1c74db1}, TitleIdx=0, Name= (224, 0, Basic, 288, ... {LastWrite={0x47401762,0x1c74db1}, TitleIdx=0, Name="feedplat"}, 32, ) }, 32, ) == 0x0
 01570   868   NtOpenKey  (0xf, {24, 224, 0x40, 0, 0,  (0xf, {24, 224, 0x40, 0, 0, "feedplat"}, ... 220, ) }, ... 220, ) == 0x0
 01571   868   NtQueryValueKey  (220,  (220, "CacheRepair", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (220, "CacheRepair", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) }, 16, ) == 0x0
 01572   868   NtQueryValueKey  (220,  (220, "CachePath", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 01573   868   NtQueryValueKey  (220,  (220, "CachePath", Partial, 148, ... TitleIdx=0, Type=2, Data="%\0U\0S\0E\0R\0P\0R\0O\0F\0I\0L\0E\0%\0\\0L\0o\0c\0a\0l\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0A\0p\0p\0l\0i\0c\0a\0t\0i\0o\0n\0 \0D\0a\0t\0a\0\\0M\0i\0c\0r\0o\0s\0o\0f\0t\0\\0F\0e\0e\0d\0s\0 \0C\0a\0c\0h\0e\0\0\0"}, 148, ) , Partial, 148, ... TitleIdx=0, Type=2, Data= (220, "CachePath", Partial, 148, ... TitleIdx=0, Type=2, Data="%\0U\0S\0E\0R\0P\0R\0O\0F\0I\0L\0E\0%\0\\0L\0o\0c\0a\0l\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0A\0p\0p\0l\0i\0c\0a\0t\0i\0o\0n\0 \0D\0a\0t\0a\0\\0M\0i\0c\0r\0o\0s\0o\0f\0t\0\\0F\0e\0e\0d\0s\0 \0C\0a\0c\0h\0e\0\0\0"}, 148, ) }, 148, ) == 0x0
 01574   868   NtQueryValueKey  (220,  (220, "CachePath", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 01575   868   NtQueryValueKey  (220,  (220, "CachePath", Partial, 148, ... TitleIdx=0, Type=2, Data="%\0U\0S\0E\0R\0P\0R\0O\0F\0I\0L\0E\0%\0\\0L\0o\0c\0a\0l\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0A\0p\0p\0l\0i\0c\0a\0t\0i\0o\0n\0 \0D\0a\0t\0a\0\\0M\0i\0c\0r\0o\0s\0o\0f\0t\0\\0F\0e\0e\0d\0s\0 \0C\0a\0c\0h\0e\0\0\0"}, 148, ) , Partial, 148, ... TitleIdx=0, Type=2, Data= (220, "CachePath", Partial, 148, ... TitleIdx=0, Type=2, Data="%\0U\0S\0E\0R\0P\0R\0O\0F\0I\0L\0E\0%\0\\0L\0o\0c\0a\0l\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0A\0p\0p\0l\0i\0c\0a\0t\0i\0o\0n\0 \0D\0a\0t\0a\0\\0M\0i\0c\0r\0o\0s\0o\0f\0t\0\\0F\0e\0e\0d\0s\0 \0C\0a\0c\0h\0e\0\0\0"}, 148, ) }, 148, ) == 0x0
 01576   868   NtQueryValueKey  (220,  (220, "CachePrefix", Partial, 144, ... TitleIdx=0, Type=1, Data="f\0e\0e\0d\0p\0l\0a\0t\0:\0\0\0"}, 32, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (220, "CachePrefix", Partial, 144, ... TitleIdx=0, Type=1, Data="f\0e\0e\0d\0p\0l\0a\0t\0:\0\0\0"}, 32, ) }, 32, ) == 0x0
 01577   868   NtQueryValueKey  (220,  (220, "CachePrefix", Partial, 144, ... TitleIdx=0, Type=1, Data="f\0e\0e\0d\0p\0l\0a\0t\0:\0\0\0"}, 32, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (220, "CachePrefix", Partial, 144, ... TitleIdx=0, Type=1, Data="f\0e\0e\0d\0p\0l\0a\0t\0:\0\0\0"}, 32, ) }, 32, ) == 0x0
 01578   868   NtQueryValueKey  (220,  (220, "CacheLimit", Partial, 144, ... TitleIdx=0, Type=4, Data="\0 \0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (220, "CacheLimit", Partial, 144, ... TitleIdx=0, Type=4, Data="\0 \0\0"}, 16, ) }, 16, ) == 0x0
 01579   868   NtQueryValueKey  (220,  (220, "CacheOptions", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (220, "CacheOptions", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) }, 16, ) == 0x0
 01580   868   NtClose  (220, ... ) == 0x0
 01581   868   NtEnumerateKey  (224, 1, Basic, 288, ... {LastWrite={0x3124e1e0,0x1c877f6}, TitleIdx=0, Name= (224, 1, Basic, 288, ... {LastWrite={0x3124e1e0,0x1c877f6}, TitleIdx=0, Name="MSHist012008022520080226"}, 64, ) }, 64, ) == 0x0
 01582   868   NtOpenKey  (0xf, {24, 224, 0x40, 0, 0,  (0xf, {24, 224, 0x40, 0, 0, "MSHist012008022520080226"}, ... 220, ) }, ... 220, ) == 0x0
 01583   868   NtQueryValueKey  (220,  (220, "CacheRepair", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (220, "CacheRepair", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) }, 16, ) == 0x0
 01584   868   NtQueryValueKey  (220,  (220, "CachePath", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 01585   868   NtQueryValueKey  (220,  (220, "CachePath", Partial, 160, ... TitleIdx=0, Type=2, Data="%\0U\0S\0E\0R\0P\0R\0O\0F\0I\0L\0E\0%\0\\0L\0o\0c\0a\0l\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0H\0i\0s\0t\0o\0r\0y\0\\0H\0i\0s\0t\0o\0r\0y\0.\0I\0E\05\0\\0M\0S\0H\0i\0s\0t\00\01\02\00\00\08\00\02\02\05\02\00\00\08\00\02\02\06\0\0\0"}, 160, ) , Partial, 160, ... TitleIdx=0, Type=2, Data= (220, "CachePath", Partial, 160, ... TitleIdx=0, Type=2, Data="%\0U\0S\0E\0R\0P\0R\0O\0F\0I\0L\0E\0%\0\\0L\0o\0c\0a\0l\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0H\0i\0s\0t\0o\0r\0y\0\\0H\0i\0s\0t\0o\0r\0y\0.\0I\0E\05\0\\0M\0S\0H\0i\0s\0t\00\01\02\00\00\08\00\02\02\05\02\00\00\08\00\02\02\06\0\0\0"}, 160, ) }, 160, ) == 0x0
 01586   868   NtQueryValueKey  (220,  (220, "CachePath", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 01587   868   NtQueryValueKey  (220,  (220, "CachePath", Partial, 160, ... TitleIdx=0, Type=2, Data="%\0U\0S\0E\0R\0P\0R\0O\0F\0I\0L\0E\0%\0\\0L\0o\0c\0a\0l\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0H\0i\0s\0t\0o\0r\0y\0\\0H\0i\0s\0t\0o\0r\0y\0.\0I\0E\05\0\\0M\0S\0H\0i\0s\0t\00\01\02\00\00\08\00\02\02\05\02\00\00\08\00\02\02\06\0\0\0"}, 160, ) , Partial, 160, ... TitleIdx=0, Type=2, Data= (220, "CachePath", Partial, 160, ... TitleIdx=0, Type=2, Data="%\0U\0S\0E\0R\0P\0R\0O\0F\0I\0L\0E\0%\0\\0L\0o\0c\0a\0l\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0H\0i\0s\0t\0o\0r\0y\0\\0H\0i\0s\0t\0o\0r\0y\0.\0I\0E\05\0\\0M\0S\0H\0i\0s\0t\00\01\02\00\00\08\00\02\02\05\02\00\00\08\00\02\02\06\0\0\0"}, 160, ) }, 160, ) == 0x0
 01588   868   NtQueryValueKey  (220,  (220, "CachePrefix", Partial, 144, ... TitleIdx=0, Type=1, Data=":\02\00\00\08\00\02\02\05\02\00\00\08\00\02\02\06\0:\0 \0\0\0"}, 52, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (220, "CachePrefix", Partial, 144, ... TitleIdx=0, Type=1, Data=":\02\00\00\08\00\02\02\05\02\00\00\08\00\02\02\06\0:\0 \0\0\0"}, 52, ) }, 52, ) == 0x0
 01589   868   NtQueryValueKey  (220,  (220, "CachePrefix", Partial, 144, ... TitleIdx=0, Type=1, Data=":\02\00\00\08\00\02\02\05\02\00\00\08\00\02\02\06\0:\0 \0\0\0"}, 52, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (220, "CachePrefix", Partial, 144, ... TitleIdx=0, Type=1, Data=":\02\00\00\08\00\02\02\05\02\00\00\08\00\02\02\06\0:\0 \0\0\0"}, 52, ) }, 52, ) == 0x0
 01590   868   NtQueryValueKey  (220,  (220, "CacheLimit", Partial, 144, ... TitleIdx=0, Type=4, Data="\0 \0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (220, "CacheLimit", Partial, 144, ... TitleIdx=0, Type=4, Data="\0 \0\0"}, 16, ) }, 16, ) == 0x0
 01591   868   NtQueryValueKey  (220,  (220, "CacheOptions", Partial, 144, ... TitleIdx=0, Type=4, Data="\13\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (220, "CacheOptions", Partial, 144, ... TitleIdx=0, Type=4, Data="\13\0\0\0"}, 16, ) }, 16, ) == 0x0
 01592   868   NtClose  (220, ... ) == 0x0
 01593   868   NtEnumerateKey  (224, 2, Basic, 288, ... {LastWrite={0x2030327f,0x1c7701e}, TitleIdx=0, Name= (224, 2, Basic, 288, ... {LastWrite={0x2030327f,0x1c7701e}, TitleIdx=0, Name="UserData"}, 32, ) }, 32, ) == 0x0
 01594   868   NtOpenKey  (0xf, {24, 224, 0x40, 0, 0,  (0xf, {24, 224, 0x40, 0, 0, "UserData"}, ... 220, ) }, ... 220, ) == 0x0
 01595   868   NtQueryValueKey  (220,  (220, "CacheRepair", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (220, "CacheRepair", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) }, 16, ) == 0x0
 01596   868   NtQueryValueKey  (220,  (220, "CachePath", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 01597   868   NtQueryValueKey  (220,  (220, "CachePath", Partial, 148, ... TitleIdx=0, Type=2, Data="%\0U\0S\0E\0R\0P\0R\0O\0F\0I\0L\0E\0%\0\\0A\0p\0p\0l\0i\0c\0a\0t\0i\0o\0n\0 \0D\0a\0t\0a\0\\0M\0i\0c\0r\0o\0s\0o\0f\0t\0\\0I\0n\0t\0e\0r\0n\0e\0t\0 \0E\0x\0p\0l\0o\0r\0e\0r\0\\0U\0s\0e\0r\0D\0a\0t\0a\0\0\0"}, 148, ) , Partial, 148, ... TitleIdx=0, Type=2, Data= (220, "CachePath", Partial, 148, ... TitleIdx=0, Type=2, Data="%\0U\0S\0E\0R\0P\0R\0O\0F\0I\0L\0E\0%\0\\0A\0p\0p\0l\0i\0c\0a\0t\0i\0o\0n\0 \0D\0a\0t\0a\0\\0M\0i\0c\0r\0o\0s\0o\0f\0t\0\\0I\0n\0t\0e\0r\0n\0e\0t\0 \0E\0x\0p\0l\0o\0r\0e\0r\0\\0U\0s\0e\0r\0D\0a\0t\0a\0\0\0"}, 148, ) }, 148, ) == 0x0
 01598   868   NtQueryValueKey  (220,  (220, "CachePath", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 01599   868   NtQueryValueKey  (220,  (220, "CachePath", Partial, 148, ... TitleIdx=0, Type=2, Data="%\0U\0S\0E\0R\0P\0R\0O\0F\0I\0L\0E\0%\0\\0A\0p\0p\0l\0i\0c\0a\0t\0i\0o\0n\0 \0D\0a\0t\0a\0\\0M\0i\0c\0r\0o\0s\0o\0f\0t\0\\0I\0n\0t\0e\0r\0n\0e\0t\0 \0E\0x\0p\0l\0o\0r\0e\0r\0\\0U\0s\0e\0r\0D\0a\0t\0a\0\0\0"}, 148, ) , Partial, 148, ... TitleIdx=0, Type=2, Data= (220, "CachePath", Partial, 148, ... TitleIdx=0, Type=2, Data="%\0U\0S\0E\0R\0P\0R\0O\0F\0I\0L\0E\0%\0\\0A\0p\0p\0l\0i\0c\0a\0t\0i\0o\0n\0 \0D\0a\0t\0a\0\\0M\0i\0c\0r\0o\0s\0o\0f\0t\0\\0I\0n\0t\0e\0r\0n\0e\0t\0 \0E\0x\0p\0l\0o\0r\0e\0r\0\\0U\0s\0e\0r\0D\0a\0t\0a\0\0\0"}, 148, ) }, 148, ) == 0x0
 01600   868   NtQueryValueKey  (220,  (220, "CachePrefix", Partial, 144, ... TitleIdx=0, Type=1, Data="U\0s\0e\0r\0D\0a\0t\0a\0\0\0"}, 30, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (220, "CachePrefix", Partial, 144, ... TitleIdx=0, Type=1, Data="U\0s\0e\0r\0D\0a\0t\0a\0\0\0"}, 30, ) }, 30, ) == 0x0
 01601   868   NtQueryValueKey  (220,  (220, "CachePrefix", Partial, 144, ... TitleIdx=0, Type=1, Data="U\0s\0e\0r\0D\0a\0t\0a\0\0\0"}, 30, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (220, "CachePrefix", Partial, 144, ... TitleIdx=0, Type=1, Data="U\0s\0e\0r\0D\0a\0t\0a\0\0\0"}, 30, ) }, 30, ) == 0x0
 01602   868   NtQueryValueKey  (220,  (220, "CacheLimit", Partial, 144, ... TitleIdx=0, Type=4, Data="\350\3\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (220, "CacheLimit", Partial, 144, ... TitleIdx=0, Type=4, Data="\350\3\0\0"}, 16, ) }, 16, ) == 0x0
 01603   868   NtQueryValueKey  (220,  (220, "CacheOptions", Partial, 144, ... TitleIdx=0, Type=4, Data="\10\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (220, "CacheOptions", Partial, 144, ... TitleIdx=0, Type=4, Data="\10\0\0\0"}, 16, ) }, 16, ) == 0x0
 01604   868   NtAllocateVirtualMemory  (-1, 1355776, 0, 4096, 4096, 4, ... 1355776, 4096, ) == 0x0
 01605   868   NtClose  (220, ... ) == 0x0
 01606   868   NtEnumerateKey  (224, 3, Basic, 288, ... ) == STATUS_NO_MORE_ENTRIES
 01607   868   NtReleaseMutant  (172, ... 0x0, ) == 0x0
 01608   868   NtClose  (224, ... ) == 0x0
 01609   868   NtWaitForSingleObject  (176, 0, 0x0, ... ) == 0x0
 01610   868   NtReleaseMutant  (176, ... 0x0, ) == 0x0
 01611   868   NtWaitForSingleObject  (176, 0, 0x0, ... ) == 0x0
 01612   868   NtReleaseMutant  (176, ... 0x0, ) == 0x0
 01613   868   NtOpenKey  (0x1, {24, 140, 0x40, 0, 0,  (0x1, {24, 140, 0x40, 0, 0, "SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01614   868   NtOpenKey  (0x1, {24, 140, 0x40, 0, 0,  (0x1, {24, 140, 0x40, 0, 0, "SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01615   868   NtOpenKey  (0x1, {24, 140, 0x40, 0, 0,  (0x1, {24, 140, 0x40, 0, 0, "SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01616   868   NtOpenKey  (0x1, {24, 140, 0x40, 0, 0,  (0x1, {24, 140, 0x40, 0, 0, "SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01617   868   NtOpenKey  (0x1, {24, 36, 0x40, 0, 0,  (0x1, {24, 36, 0x40, 0, 0, "Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01618   868   NtOpenKey  (0x1, {24, 36, 0x40, 0, 0,  (0x1, {24, 36, 0x40, 0, 0, "Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01619   868   NtOpenKey  (0x1, {24, 140, 0x40, 0, 0,  (0x1, {24, 140, 0x40, 0, 0, "Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01620   868   NtOpenKey  (0x1, {24, 36, 0x40, 0, 0,  (0x1, {24, 36, 0x40, 0, 0, "Software\Microsoft\Internet Explorer\Main\FeatureControl"}, ... 224, ) }, ... 224, ) == 0x0
 01621   868   NtOpenKey  (0x1, {24, 140, 0x40, 0, 0,  (0x1, {24, 140, 0x40, 0, 0, "Software\Microsoft\Internet Explorer\Main\FeatureControl"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01622   868   NtOpenKey  (0x1, {24, 224, 0x40, 0, 0,  (0x1, {24, 224, 0x40, 0, 0, "RETRY_HEADERONLYPOST_ONCONNECTIONRESET"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01623   868   NtClose  (224, ... ) == 0x0
 01624   868   NtOpenKey  (0x1, {24, 36, 0x40, 0, 0,  (0x1, {24, 36, 0x40, 0, 0, "Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01625   868   NtOpenKey  (0x1, {24, 140, 0x40, 0, 0,  (0x1, {24, 140, 0x40, 0, 0, "Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01626   868   NtOpenKey  (0x1, {24, 36, 0x40, 0, 0,  (0x1, {24, 36, 0x40, 0, 0, "Software\Microsoft\Internet Explorer\Main\FeatureControl"}, ... 224, ) }, ... 224, ) == 0x0
 01627   868   NtOpenKey  (0x1, {24, 140, 0x40, 0, 0,  (0x1, {24, 140, 0x40, 0, 0, "Software\Microsoft\Internet Explorer\Main\FeatureControl"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01628   868   NtOpenKey  (0x1, {24, 224, 0x40, 0, 0,  (0x1, {24, 224, 0x40, 0, 0, "FEATURE_BUFFERBREAKING_818408"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01629   868   NtClose  (224, ... ) == 0x0
 01630   868   NtOpenKey  (0x1, {24, 36, 0x40, 0, 0,  (0x1, {24, 36, 0x40, 0, 0, "Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01631   868   NtOpenKey  (0x1, {24, 140, 0x40, 0, 0,  (0x1, {24, 140, 0x40, 0, 0, "Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01632   868   NtOpenKey  (0x1, {24, 36, 0x40, 0, 0,  (0x1, {24, 36, 0x40, 0, 0, "Software\Microsoft\Internet Explorer\Main\FeatureControl"}, ... 224, ) }, ... 224, ) == 0x0
 01633   868   NtOpenKey  (0x1, {24, 140, 0x40, 0, 0,  (0x1, {24, 140, 0x40, 0, 0, "Software\Microsoft\Internet Explorer\Main\FeatureControl"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01634   868   NtOpenKey  (0x1, {24, 224, 0x40, 0, 0,  (0x1, {24, 224, 0x40, 0, 0, "FEATURE_SKIP_POST_RETRY_ON_INTERNETWRITEFILE_KB895954"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01635   868   NtClose  (224, ... ) == 0x0
 01636   868   NtOpenKey  (0x1, {24, 140, 0x40, 0, 0,  (0x1, {24, 140, 0x40, 0, 0, "SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01637   868   NtQueryValueKey  (92,  (92, "DisableWorkerThreadHibernation", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01638   868   NtOpenKey  (0x1, {24, 36, 0x40, 0, 0,  (0x1, {24, 36, 0x40, 0, 0, "SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings"}, ... 224, ) }, ... 224, ) == 0x0
 01639   868   NtQueryValueKey  (224,  (224, "DisableWorkerThreadHibernation", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01640   868   NtClose  (224, ... ) == 0x0
 01641   868   NtQueryValueKey  (92,  (92, "DisableReadRange", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01642   868   NtQueryValueKey  (92,  (92, "SocketSendBufferLength", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01643   868   NtQueryValueKey  (92,  (92, "SocketReceiveBufferLength", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01644   868   NtQueryValueKey  (92,  (92, "KeepAliveTimeout", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01645   868   NtQueryValueKey  (92,  (92, "MaxHttpRedirects", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01646   868   NtQueryValueKey  (92,  (92, "MaxConnectionsPerServer", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01647   868   NtQueryValueKey  (92,  (92, "MaxConnectionsPer1_0Server", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01648   868   NtQueryValueKey  (92,  (92, "ServerInfoTimeout", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01649   868   NtQueryValueKey  (92,  (92, "ConnectTimeOut", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01650   868   NtOpenKey  (0x1, {24, 36, 0x40, 0, 0,  (0x1, {24, 36, 0x40, 0, 0, "SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings"}, ... 224, ) }, ... 224, ) == 0x0
 01651   868   NtQueryValueKey  (224,  (224, "ConnectTimeOut", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01652   868   NtClose  (224, ... ) == 0x0
 01653   868   NtQueryValueKey  (92,  (92, "ConnectRetries", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01654   868   NtOpenKey  (0x1, {24, 36, 0x40, 0, 0,  (0x1, {24, 36, 0x40, 0, 0, "SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings"}, ... 224, ) }, ... 224, ) == 0x0
 01655   868   NtQueryValueKey  (224,  (224, "ConnectRetries", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01656   868   NtClose  (224, ... ) == 0x0
 01657   868   NtQueryValueKey  (92,  (92, "SendTimeOut", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01658   868   NtOpenKey  (0x1, {24, 36, 0x40, 0, 0,  (0x1, {24, 36, 0x40, 0, 0, "SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings"}, ... 224, ) }, ... 224, ) == 0x0
 01659   868   NtQueryValueKey  (224,  (224, "SendTimeOut", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01660   868   NtClose  (224, ... ) == 0x0
 01661   868   NtQueryValueKey  (92,  (92, "ReceiveTimeOut", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01662   868   NtOpenKey  (0x1, {24, 36, 0x40, 0, 0,  (0x1, {24, 36, 0x40, 0, 0, "SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings"}, ... 224, ) }, ... 224, ) == 0x0
 01663   868   NtQueryValueKey  (224,  (224, "ReceiveTimeOut", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01664   868   NtClose  (224, ... ) == 0x0
 01665   868   NtQueryValueKey  (92,  (92, "DisableNTLMPreAuth", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01666   868   NtQueryValueKey  (92,  (92, "ScavengeCacheLowerBound", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01667   868   NtQueryValueKey  (92,  (92, "CertCacheNoValidate", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01668   868   NtOpenKey  (0x1, {24, 140, 0x40, 0, 0,  (0x1, {24, 140, 0x40, 0, 0, "SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache"}, ... 224, ) }, ... 224, ) == 0x0
 01669   868   NtQueryValueKey  (224,  (224, "ScavengeCacheFileLifeTime", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01670   868   NtClose  (224, ... ) == 0x0
 01671   868   NtOpenKey  (0x1, {24, 36, 0x40, 0, 0,  (0x1, {24, 36, 0x40, 0, 0, "SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01672   868   NtOpenKey  (0x1, {24, 36, 0x40, 0, 0,  (0x1, {24, 36, 0x40, 0, 0, "SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01673   868   NtOpenKey  (0x1, {24, 140, 0x40, 0, 0,  (0x1, {24, 140, 0x40, 0, 0, "SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01674   868   NtOpenKey  (0x1, {24, 36, 0x40, 0, 0,  (0x1, {24, 36, 0x40, 0, 0, "SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache"}, ... 224, ) }, ... 224, ) == 0x0
 01675   868   NtOpenKey  (0x1, {24, 140, 0x40, 0, 0,  (0x1, {24, 140, 0x40, 0, 0, "SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache"}, ... 220, ) }, ... 220, ) == 0x0
 01676   868   NtQueryValueKey  (220,  (220, "ScavengeCacheFileLimit", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01677   868   NtQueryValueKey  (224,  (224, "ScavengeCacheFileLimit", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01678   868   NtClose  (224, ... ) == 0x0
 01679   868   NtClose  (220, ... ) == 0x0
 01680   868   NtOpenKey  (0x1, {24, 36, 0x40, 0, 0,  (0x1, {24, 36, 0x40, 0, 0, "Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01681   868   NtOpenKey  (0x1, {24, 140, 0x40, 0, 0,  (0x1, {24, 140, 0x40, 0, 0, "Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01682   868   NtOpenKey  (0x1, {24, 36, 0x40, 0, 0,  (0x1, {24, 36, 0x40, 0, 0, "Software\Microsoft\Internet Explorer\Main\FeatureControl"}, ... 220, ) }, ... 220, ) == 0x0
 01683   868   NtOpenKey  (0x1, {24, 140, 0x40, 0, 0,  (0x1, {24, 140, 0x40, 0, 0, "Software\Microsoft\Internet Explorer\Main\FeatureControl"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01684   868   NtOpenKey  (0x1, {24, 220, 0x40, 0, 0,  (0x1, {24, 220, 0x40, 0, 0, "FEATURE_FIX_CHUNKED_PROXY_SCRIPT_DOWNLOAD_KB843289"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01685   868   NtClose  (220, ... ) == 0x0
 01686   868   NtOpenKey  (0x1, {24, 36, 0x40, 0, 0,  (0x1, {24, 36, 0x40, 0, 0, "Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01687   868   NtOpenKey  (0x1, {24, 140, 0x40, 0, 0,  (0x1, {24, 140, 0x40, 0, 0, "Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01688   868   NtOpenKey  (0x1, {24, 36, 0x40, 0, 0,  (0x1, {24, 36, 0x40, 0, 0, "Software\Microsoft\Internet Explorer\Main\FeatureControl"}, ... 220, ) }, ... 220, ) == 0x0
 01689   868   NtOpenKey  (0x1, {24, 140, 0x40, 0, 0,  (0x1, {24, 140, 0x40, 0, 0, "Software\Microsoft\Internet Explorer\Main\FeatureControl"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01690   868   NtOpenKey  (0x1, {24, 220, 0x40, 0, 0,  (0x1, {24, 220, 0x40, 0, 0, "FEATURE_USE_CNAME_FOR_SPN_KB911149"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01691   868   NtClose  (220, ... ) == 0x0
 01692   868   NtQueryValueKey  (92,  (92, "HttpDefaultExpiryTimeSecs", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01693   868   NtQueryValueKey  (92,  (92, "FtpDefaultExpiryTimeSecs", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01694   868   NtOpenKey  (0x1, {24, 36, 0x40, 0, 0,  (0x1, {24, 36, 0x40, 0, 0, "Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01695   868   NtOpenKey  (0x1, {24, 140, 0x40, 0, 0,  (0x1, {24, 140, 0x40, 0, 0, "Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01696   868   NtOpenKey  (0x1, {24, 36, 0x40, 0, 0,  (0x1, {24, 36, 0x40, 0, 0, "Software\Microsoft\Internet Explorer\Main\FeatureControl"}, ... 220, ) }, ... 220, ) == 0x0
 01697   868   NtOpenKey  (0x1, {24, 140, 0x40, 0, 0,  (0x1, {24, 140, 0x40, 0, 0, "Software\Microsoft\Internet Explorer\Main\FeatureControl"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01698   868   NtOpenKey  (0x1, {24, 220, 0x40, 0, 0,  (0x1, {24, 220, 0x40, 0, 0, "FEATURE_PERMIT_CACHE_FOR_AUTHENTICATED_FTP_KB910274"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01699   868   NtClose  (220, ... ) == 0x0
 01700   868   NtOpenKey  (0x1, {24, 36, 0x40, 0, 0,  (0x1, {24, 36, 0x40, 0, 0, "Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01701   868   NtOpenKey  (0x1, {24, 140, 0x40, 0, 0,  (0x1, {24, 140, 0x40, 0, 0, "Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01702   868   NtOpenKey  (0x1, {24, 36, 0x40, 0, 0,  (0x1, {24, 36, 0x40, 0, 0, "Software\Microsoft\Internet Explorer\Main\FeatureControl"}, ... 220, ) }, ... 220, ) == 0x0
 01703   868   NtOpenKey  (0x1, {24, 140, 0x40, 0, 0,  (0x1, {24, 140, 0x40, 0, 0, "Software\Microsoft\Internet Explorer\Main\FeatureControl"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01704   868   NtOpenKey  (0x1, {24, 220, 0x40, 0, 0,  (0x1, {24, 220, 0x40, 0, 0, "FEATURE_DISABLE_UNICODE_HANDLE_CLOSING_CALLBACK"}, ... 224, ) }, ... 224, ) == 0x0
 01705   868   NtQueryValueKey  (224,  (224, "packed.exe", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01706   868   NtQueryValueKey  (224,  (224, "*", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01707   868   NtClose  (224, ... ) == 0x0
 01708   868   NtClose  (220, ... ) == 0x0
 01709   868   NtOpenKey  (0x1, {24, 36, 0x40, 0, 0,  (0x1, {24, 36, 0x40, 0, 0, "Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01710   868   NtOpenKey  (0x1, {24, 140, 0x40, 0, 0,  (0x1, {24, 140, 0x40, 0, 0, "Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01711   868   NtOpenKey  (0x1, {24, 36, 0x40, 0, 0,  (0x1, {24, 36, 0x40, 0, 0, "Software\Microsoft\Internet Explorer\Main\FeatureControl"}, ... 220, ) }, ... 220, ) == 0x0
 01712   868   NtOpenKey  (0x1, {24, 140, 0x40, 0, 0,  (0x1, {24, 140, 0x40, 0, 0, "Software\Microsoft\Internet Explorer\Main\FeatureControl"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01713   868   NtOpenKey  (0x1, {24, 220, 0x40, 0, 0,  (0x1, {24, 220, 0x40, 0, 0, "FEATURE_DIGEST_NO_EXTRAS_IN_URI"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01714   868   NtClose  (220, ... ) == 0x0
 01715   868   NtOpenKey  (0x1, {24, 140, 0x40, 0, 0,  (0x1, {24, 140, 0x40, 0, 0, "SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings"}, ... 220, ) }, ... 220, ) == 0x0
 01716   868   NtQueryValueKey  (220,  (220, "DisableCachingOfSSLPages", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (220, "DisableCachingOfSSLPages", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) }, 16, ) == 0x0
 01717   868   NtClose  (220, ... ) == 0x0
 01718   868   NtQueryValueKey  (92,  (92, "PerUserCookies", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01719   868   NtQueryValueKey  (92,  (92, "LeashLegacyCookies", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01720   868   NtQueryValueKey  (92,  (92, "DisableNT4RasCheck", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01721   868   NtOpenKey  (0x1, {24, 140, 0x40, 0, 0,  (0x1, {24, 140, 0x40, 0, 0, "SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings"}, ... 220, ) }, ... 220, ) == 0x0
 01722   868   NtQueryValueKey  (220,  (220, "DialupUseLanSettings", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01723   868   NtOpenKey  (0x1, {24, 36, 0x40, 0, 0,  (0x1, {24, 36, 0x40, 0, 0, "SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings"}, ... 224, ) }, ... 224, ) == 0x0
 01724   868   NtQueryValueKey  (224,  (224, "DialupUseLanSettings", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01725   868   NtClose  (220, ... ) == 0x0
 01726   868   NtClose  (224, ... ) == 0x0
 01727   868   NtQueryValueKey  (92,  (92, "SendExtraCRLF", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01728   868   NtQueryValueKey  (92,  (92, "BypassFtpTimeCheck", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01729   868   NtQueryValueKey  (92,  (92, "ReleaseSocketDuringAuth", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01730   868   NtOpenKey  (0x1, {24, 140, 0x40, 0, 0,  (0x1, {24, 140, 0x40, 0, 0, "SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings"}, ... 224, ) }, ... 224, ) == 0x0
 01731   868   NtQueryValueKey  (224,  (224, "ReleaseSocketDuring401Auth", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01732   868   NtOpenKey  (0x1, {24, 36, 0x40, 0, 0,  (0x1, {24, 36, 0x40, 0, 0, "SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings"}, ... 220, ) }, ... 220, ) == 0x0
 01733   868   NtQueryValueKey  (220,  (220, "ReleaseSocketDuring401Auth", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01734   868   NtClose  (224, ... ) == 0x0
 01735   868   NtClose  (220, ... ) == 0x0
 01736   868   NtQueryValueKey  (92,  (92, "WpadSearchAllDomains", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01737   868   NtOpenKey  (0x1, {24, 140, 0x40, 0, 0,  (0x1, {24, 140, 0x40, 0, 0, "SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings"}, ... 220, ) }, ... 220, ) == 0x0
 01738   868   NtQueryValueKey  (220,  (220, "DisableLegacyPreAuthAsServer", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01739   868   NtOpenKey  (0x1, {24, 36, 0x40, 0, 0,  (0x1, {24, 36, 0x40, 0, 0, "SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings"}, ... 224, ) }, ... 224, ) == 0x0
 01740   868   NtQueryValueKey  (224,  (224, "DisableLegacyPreAuthAsServer", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01741   868   NtClose  (220, ... ) == 0x0
 01742   868   NtClose  (224, ... ) == 0x0
 01743   868   NtOpenKey  (0x1, {24, 140, 0x40, 0, 0,  (0x1, {24, 140, 0x40, 0, 0, "SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings"}, ... 224, ) }, ... 224, ) == 0x0
 01744   868   NtQueryValueKey  (224,  (224, "BypassHTTPNoCacheCheck", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01745   868   NtOpenKey  (0x1, {24, 36, 0x40, 0, 0,  (0x1, {24, 36, 0x40, 0, 0, "SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings"}, ... 220, ) }, ... 220, ) == 0x0
 01746   868   NtQueryValueKey  (220,  (220, "BypassHTTPNoCacheCheck", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01747   868   NtClose  (224, ... ) == 0x0
 01748   868   NtClose  (220, ... ) == 0x0
 01749   868   NtOpenKey  (0x1, {24, 140, 0x40, 0, 0,  (0x1, {24, 140, 0x40, 0, 0, "SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings"}, ... 220, ) }, ... 220, ) == 0x0
 01750   868   NtQueryValueKey  (220,  (220, "BypassSSLNoCacheCheck", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01751   868   NtOpenKey  (0x1, {24, 36, 0x40, 0, 0,  (0x1, {24, 36, 0x40, 0, 0, "SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings"}, ... 224, ) }, ... 224, ) == 0x0
 01752   868   NtQueryValueKey  (224,  (224, "BypassSSLNoCacheCheck", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01753   868   NtClose  (220, ... ) == 0x0
 01754   868   NtClose  (224, ... ) == 0x0
 01755   868   NtOpenKey  (0x1, {24, 36, 0x40, 0, 0,  (0x1, {24, 36, 0x40, 0, 0, "SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings"}, ... 224, ) }, ... 224, ) == 0x0
 01756   868   NtQueryValueKey  (224,  (224, "EnableHttpTrace", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01757   868   NtClose  (224, ... ) == 0x0
 01758   868   NtOpenKey  (0x1, {24, 140, 0x40, 0, 0,  (0x1, {24, 140, 0x40, 0, 0, "SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings"}, ... 224, ) }, ... 224, ) == 0x0
 01759   868   NtQueryValueKey  (224,  (224, "NoCheckAutodialOverRide", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01760   868   NtOpenKey  (0x1, {24, 36, 0x40, 0, 0,  (0x1, {24, 36, 0x40, 0, 0, "SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings"}, ... 220, ) }, ... 220, ) == 0x0
 01761   868   NtQueryValueKey  (220,  (220, "NoCheckAutodialOverRide", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01762   868   NtClose  (224, ... ) == 0x0
 01763   868   NtClose  (220, ... ) == 0x0
 01764   868   NtQueryValueKey  (92,  (92, "DontUseDNSLoadBalancing", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01765   868   NtOpenKey  (0x1, {24, 36, 0x40, 0, 0,  (0x1, {24, 36, 0x40, 0, 0, "SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings"}, ... 220, ) }, ... 220, ) == 0x0
 01766   868   NtQueryValueKey  (220,  (220, "DontUseDNSLoadBalancing", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01767   868   NtClose  (220, ... ) == 0x0
 01768   868   NtOpenKey  (0x1, {24, 36, 0x40, 0, 0,  (0x1, {24, 36, 0x40, 0, 0, "SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings"}, ... 220, ) }, ... 220, ) == 0x0
 01769   868   NtQueryValueKey  (220,  (220, "ShareCredsWithWinHttp", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01770   868   NtClose  (220, ... ) == 0x0
 01771   868   NtQueryValueKey  (92,  (92, "MimeExclusionListForCache", Partial, 144, ... TitleIdx=0, Type=1, Data="m\0u\0l\0t\0i\0p\0a\0r\0t\0/\0m\0i\0x\0e\0d\0 \0m\0u\0l\0t\0i\0p\0a\0r\0t\0/\0x\0-\0m\0i\0x\0e\0d\0-\0r\0e\0p\0l\0a\0c\0e\0 \0m\0u\0l\0t\0i\0p\0a\0r\0t\0/\0x\0-\0b\0y\0t\0e\0r\0a\0n\0g\0e\0s\0 \0\0\0"}, 144, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (92, "MimeExclusionListForCache", Partial, 144, ... TitleIdx=0, Type=1, Data="m\0u\0l\0t\0i\0p\0a\0r\0t\0/\0m\0i\0x\0e\0d\0 \0m\0u\0l\0t\0i\0p\0a\0r\0t\0/\0x\0-\0m\0i\0x\0e\0d\0-\0r\0e\0p\0l\0a\0c\0e\0 \0m\0u\0l\0t\0i\0p\0a\0r\0t\0/\0x\0-\0b\0y\0t\0e\0r\0a\0n\0g\0e\0s\0 \0\0\0"}, 144, ) }, 144, ) == 0x0
 01772   868   NtQueryValueKey  (92,  (92, "MimeExclusionListForCache", Partial, 144, ... TitleIdx=0, Type=1, Data="m\0u\0l\0t\0i\0p\0a\0r\0t\0/\0m\0i\0x\0e\0d\0 \0m\0u\0l\0t\0i\0p\0a\0r\0t\0/\0x\0-\0m\0i\0x\0e\0d\0-\0r\0e\0p\0l\0a\0c\0e\0 \0m\0u\0l\0t\0i\0p\0a\0r\0t\0/\0x\0-\0b\0y\0t\0e\0r\0a\0n\0g\0e\0s\0 \0\0\0"}, 144, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (92, "MimeExclusionListForCache", Partial, 144, ... TitleIdx=0, Type=1, Data="m\0u\0l\0t\0i\0p\0a\0r\0t\0/\0m\0i\0x\0e\0d\0 \0m\0u\0l\0t\0i\0p\0a\0r\0t\0/\0x\0-\0m\0i\0x\0e\0d\0-\0r\0e\0p\0l\0a\0c\0e\0 \0m\0u\0l\0t\0i\0p\0a\0r\0t\0/\0x\0-\0b\0y\0t\0e\0r\0a\0n\0g\0e\0s\0 \0\0\0"}, 144, ) }, 144, ) == 0x0
 01773   868   NtQueryValueKey  (92,  (92, "MimeExclusionListForCache", Partial, 144, ... TitleIdx=0, Type=1, Data="m\0u\0l\0t\0i\0p\0a\0r\0t\0/\0m\0i\0x\0e\0d\0 \0m\0u\0l\0t\0i\0p\0a\0r\0t\0/\0x\0-\0m\0i\0x\0e\0d\0-\0r\0e\0p\0l\0a\0c\0e\0 \0m\0u\0l\0t\0i\0p\0a\0r\0t\0/\0x\0-\0b\0y\0t\0e\0r\0a\0n\0g\0e\0s\0 \0\0\0"}, 144, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (92, "MimeExclusionListForCache", Partial, 144, ... TitleIdx=0, Type=1, Data="m\0u\0l\0t\0i\0p\0a\0r\0t\0/\0m\0i\0x\0e\0d\0 \0m\0u\0l\0t\0i\0p\0a\0r\0t\0/\0x\0-\0m\0i\0x\0e\0d\0-\0r\0e\0p\0l\0a\0c\0e\0 \0m\0u\0l\0t\0i\0p\0a\0r\0t\0/\0x\0-\0b\0y\0t\0e\0r\0a\0n\0g\0e\0s\0 \0\0\0"}, 144, ) }, 144, ) == 0x0
 01774   868   NtQueryValueKey  (92,  (92, "MimeExclusionListForCache", Partial, 144, ... TitleIdx=0, Type=1, Data="m\0u\0l\0t\0i\0p\0a\0r\0t\0/\0m\0i\0x\0e\0d\0 \0m\0u\0l\0t\0i\0p\0a\0r\0t\0/\0x\0-\0m\0i\0x\0e\0d\0-\0r\0e\0p\0l\0a\0c\0e\0 \0m\0u\0l\0t\0i\0p\0a\0r\0t\0/\0x\0-\0b\0y\0t\0e\0r\0a\0n\0g\0e\0s\0 \0\0\0"}, 144, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (92, "MimeExclusionListForCache", Partial, 144, ... TitleIdx=0, Type=1, Data="m\0u\0l\0t\0i\0p\0a\0r\0t\0/\0m\0i\0x\0e\0d\0 \0m\0u\0l\0t\0i\0p\0a\0r\0t\0/\0x\0-\0m\0i\0x\0e\0d\0-\0r\0e\0p\0l\0a\0c\0e\0 \0m\0u\0l\0t\0i\0p\0a\0r\0t\0/\0x\0-\0b\0y\0t\0e\0r\0a\0n\0g\0e\0s\0 \0\0\0"}, 144, ) }, 144, ) == 0x0
 01775   868   NtQueryValueKey  (92,  (92, "HeaderExclusionListForCache", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01776   868   NtQueryValueKey  (92,  (92, "DnsCacheEnabled", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01777   868   NtQueryValueKey  (92,  (92, "DnsCacheEntries", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01778   868   NtQueryValueKey  (92,  (92, "DnsCacheTimeout", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01779   868   NtQueryValueKey  (92,  (92, "WarnOnPost", Partial, 144, ... TitleIdx=0, Type=3, Data="\1\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=3, Data= (92, "WarnOnPost", Partial, 144, ... TitleIdx=0, Type=3, Data="\1\0\0\0"}, 16, ) }, 16, ) == 0x0
 01780   868   NtQueryValueKey  (92,  (92, "WarnAlwaysOnPost", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01781   868   NtQueryValueKey  (92,  (92, "WarnOnZoneCrossing", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (92, "WarnOnZoneCrossing", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) }, 16, ) == 0x0
 01782   868   NtQueryValueKey  (92,  (92, "WarnOnBadCertSending", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01783   868   NtQueryValueKey  (92,  (92, "WarnOnBadCertRecving", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01784   868   NtQueryValueKey  (92,  (92, "WarnOnPostRedirect", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01785   868   NtQueryValueKey  (92,  (92, "AlwaysDrainOnRedirect", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01786   868   NtQueryValueKey  (92,  (92, "WarnOnHTTPSToHTTPRedirect", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01787   868   NtOpenMutant  (0x100000, {24, 16, 0x0, 0, 0,  (0x100000, {24, 16, 0x0, 0, 0, "Local\WininetStartupMutex"}, ... 220, ) }, ... 220, ) == 0x0
 01788   868   NtOpenKey  (0x2000000, {24, 36, 0x40, 0, 0,  (0x2000000, {24, 36, 0x40, 0, 0, "System\CurrentControlSet\Services\WinSock2\Parameters"}, ... 224, ) }, ... 224, ) == 0x0
 01789   868   NtQueryValueKey  (224,  (224, "WinSock_Registry_Version", Partial, 144, ... TitleIdx=0, Type=1, Data="2\0.\00\0\0\0"}, 20, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (224, "WinSock_Registry_Version", Partial, 144, ... TitleIdx=0, Type=1, Data="2\0.\00\0\0\0"}, 20, ) }, 20, ) == 0x0
 01790   868   NtQueryValueKey  (224,  (224, "WinSock_Registry_Version", Partial, 144, ... TitleIdx=0, Type=1, Data="2\0.\00\0\0\0"}, 20, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (224, "WinSock_Registry_Version", Partial, 144, ... TitleIdx=0, Type=1, Data="2\0.\00\0\0\0"}, 20, ) }, 20, ) == 0x0
 01791   868   NtCreateEvent  (0x1f0003, 0x0, 0, 0, ... 228, ) == 0x0
 01792   868   NtOpenKey  (0x2000000, {24, 224, 0x40, 0, 0,  (0x2000000, {24, 224, 0x40, 0, 0, "Protocol_Catalog9"}, ... 232, ) }, ... 232, ) == 0x0
 01793   868   NtQueryValueKey  (232,  (232, "Serial_Access_Num", Partial, 144, ... TitleIdx=0, Type=4, Data="\15\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (232, "Serial_Access_Num", Partial, 144, ... TitleIdx=0, Type=4, Data="\15\0\0\0"}, 16, ) }, 16, ) == 0x0
 01794   868   NtNotifyChangeKey  (232, 228, 0, 0, 2011455960, 1, 0, 0, 0, 1, ... ) == 0x103
 01795   868   NtQueryValueKey  (232,  (232, "Serial_Access_Num", Partial, 144, ... TitleIdx=0, Type=4, Data="\15\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (232, "Serial_Access_Num", Partial, 144, ... TitleIdx=0, Type=4, Data="\15\0\0\0"}, 16, ) }, 16, ) == 0x0
 01796   868   NtOpenKey  (0x2000000, {24, 232, 0x40, 0, 0,  (0x2000000, {24, 232, 0x40, 0, 0, "0000000D"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01797   868   NtQueryValueKey  (232,  (232, "Next_Catalog_Entry_ID", Partial, 144, ... TitleIdx=0, Type=4, Data="#\4\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (232, "Next_Catalog_Entry_ID", Partial, 144, ... TitleIdx=0, Type=4, Data="#\4\0\0"}, 16, ) }, 16, ) == 0x0
 01798   868   NtQueryValueKey  (232,  (232, "Num_Catalog_Entries", Partial, 144, ... TitleIdx=0, Type=4, Data="\26\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (232, "Num_Catalog_Entries", Partial, 144, ... TitleIdx=0, Type=4, Data="\26\0\0\0"}, 16, ) }, 16, ) == 0x0
 01799   868   NtOpenKey  (0x2000000, {24, 232, 0x40, 0, 0,  (0x2000000, {24, 232, 0x40, 0, 0, "Catalog_Entries"}, ... 236, ) }, ... 236, ) == 0x0
 01800   868   NtOpenKey  (0x20019, {24, 236, 0x40, 0, 0,  (0x20019, {24, 236, 0x40, 0, 0, "000000000001"}, ... 240, ) }, ... 240, ) == 0x0
 01801   868   NtQueryValueKey  (240,  (240, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 01802   868   NtQueryValueKey  (240,  (240, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 01803   868   NtAllocateVirtualMemory  (-1, 1359872, 0, 4096, 4096, 4, ... 1359872, 4096, ) == 0x0
 01804   868   NtQueryValueKey  (240,  (240, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5f\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\10\0\0\0\240\32\17\347\213\253\317\21\214\243\0\200_H\241\222\351\3\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\2\0\0\0\20\0\0\0\20\0\0\0\1\0\0\0\6\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0T\0c\0p\0i\0p\0 \0[\0T\0C\0P\0/\0I\0P\0]\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\204\3\0\0\15\7\0\0\314\4\0\0d\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0\360\0\0\0\15\7\0\0\314\4\0\0d\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\16\7\0\0\314\4\0\0d\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0\354\0\0\0\250\360\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0p\265\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\00\02\0\16\7\0\0\314\4\0\0d\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0\360\0\0\0\17\7\0\0\314\4\0\0d\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\360\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\17\7\0\0\314\4\0\0d\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\20\7\0\0\314\4\0\0d\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\360\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) , Partial, 900, ... TitleIdx=0, Type=3, Data= (240, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5f\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\10\0\0\0\240\32\17\347\213\253\317\21\214\243\0\200_H\241\222\351\3\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\2\0\0\0\20\0\0\0\20\0\0\0\1\0\0\0\6\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0T\0c\0p\0i\0p\0 \0[\0T\0C\0P\0/\0I\0P\0]\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\204\3\0\0\15\7\0\0\314\4\0\0d\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0\360\0\0\0\15\7\0\0\314\4\0\0d\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\16\7\0\0\314\4\0\0d\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0\354\0\0\0\250\360\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0p\265\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\00\02\0\16\7\0\0\314\4\0\0d\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0\360\0\0\0\17\7\0\0\314\4\0\0d\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\360\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\17\7\0\0\314\4\0\0d\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\20\7\0\0\314\4\0\0d\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\360\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) \0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\17\7\0\0\314\4\0\0d\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\20\7\0\0\314\4\0\0d\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\360\0\0\0\0\0\0\0 (240, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5f\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\10\0\0\0\240\32\17\347\213\253\317\21\214\243\0\200_H\241\222\351\3\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\2\0\0\0\20\0\0\0\20\0\0\0\1\0\0\0\6\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0T\0c\0p\0i\0p\0 \0[\0T\0C\0P\0/\0I\0P\0]\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\204\3\0\0\15\7\0\0\314\4\0\0d\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0\360\0\0\0\15\7\0\0\314\4\0\0d\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\16\7\0\0\314\4\0\0d\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0\354\0\0\0\250\360\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0p\265\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\00\02\0\16\7\0\0\314\4\0\0d\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0\360\0\0\0\17\7\0\0\314\4\0\0d\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\360\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\17\7\0\0\314\4\0\0d\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\20\7\0\0\314\4\0\0d\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\360\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) }, 900, ) == 0x0
 01805   868   NtClose  (240, ... ) == 0x0
 01806   868   NtOpenKey  (0x20019, {24, 236, 0x40, 0, 0,  (0x20019, {24, 236, 0x40, 0, 0, "000000000002"}, ... 240, ) }, ... 240, ) == 0x0
 01807   868   NtQueryValueKey  (240,  (240, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 01808   868   NtQueryValueKey  (240,  (240, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 01809   868   NtQueryValueKey  (240,  (240, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\11\6\2\0\0\0\0\0\0\0\0\0\0\0\0\0\10\0\0\0\240\32\17\347\213\253\317\21\214\243\0\200_H\241\222\352\3\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\2\0\0\0\20\0\0\0\20\0\0\0\2\0\0\0\21\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\273\377\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0T\0c\0p\0i\0p\0 \0[\0U\0D\0P\0/\0I\0P\0]\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\204\3\0\0\22\7\0\0\314\4\0\0d\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0\360\0\0\0\22\7\0\0\314\4\0\0d\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\23\7\0\0\314\4\0\0d\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0\354\0\0\0\250\360\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0p\265\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\00\03\0\23\7\0\0\314\4\0\0d\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0\360\0\0\0\24\7\0\0\314\4\0\0d\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\360\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\24\7\0\0\314\4\0\0d\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\25\7\0\0\314\4\0\0d\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\360\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) , Partial, 900, ... TitleIdx=0, Type=3, Data= (240, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\11\6\2\0\0\0\0\0\0\0\0\0\0\0\0\0\10\0\0\0\240\32\17\347\213\253\317\21\214\243\0\200_H\241\222\352\3\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\2\0\0\0\20\0\0\0\20\0\0\0\2\0\0\0\21\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\273\377\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0T\0c\0p\0i\0p\0 \0[\0U\0D\0P\0/\0I\0P\0]\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\204\3\0\0\22\7\0\0\314\4\0\0d\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0\360\0\0\0\22\7\0\0\314\4\0\0d\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\23\7\0\0\314\4\0\0d\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0\354\0\0\0\250\360\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0p\265\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\00\03\0\23\7\0\0\314\4\0\0d\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0\360\0\0\0\24\7\0\0\314\4\0\0d\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\360\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\24\7\0\0\314\4\0\0d\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\25\7\0\0\314\4\0\0d\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\360\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) \0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\24\7\0\0\314\4\0\0d\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\25\7\0\0\314\4\0\0d\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\360\0\0\0\0\0\0\0 (240, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\11\6\2\0\0\0\0\0\0\0\0\0\0\0\0\0\10\0\0\0\240\32\17\347\213\253\317\21\214\243\0\200_H\241\222\352\3\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\2\0\0\0\20\0\0\0\20\0\0\0\2\0\0\0\21\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\273\377\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0T\0c\0p\0i\0p\0 \0[\0U\0D\0P\0/\0I\0P\0]\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\204\3\0\0\22\7\0\0\314\4\0\0d\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0\360\0\0\0\22\7\0\0\314\4\0\0d\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\23\7\0\0\314\4\0\0d\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0\354\0\0\0\250\360\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0p\265\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\00\03\0\23\7\0\0\314\4\0\0d\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0\360\0\0\0\24\7\0\0\314\4\0\0d\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\360\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\24\7\0\0\314\4\0\0d\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\25\7\0\0\314\4\0\0d\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\360\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) }, 900, ) == 0x0
 01810   868   NtClose  (240, ... ) == 0x0
 01811   868   NtOpenKey  (0x20019, {24, 236, 0x40, 0, 0,  (0x20019, {24, 236, 0x40, 0, 0, "000000000003"}, ... 240, ) }, ... 240, ) == 0x0
 01812   868   NtQueryValueKey  (240,  (240, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 01813   868   NtQueryValueKey  (240,  (240, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 01814   868   NtQueryValueKey  (240,  (240, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\11\6\2\0\0\0\0\0\0\0\0\0\0\0\0\0\14\0\0\0\240\32\17\347\213\253\317\21\214\243\0\200_H\241\222\353\3\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\2\0\0\0\20\0\0\0\20\0\0\0\3\0\0\0\0\0\0\0\377\0\0\0\0\0\0\0\0\0\0\0\273\377\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0T\0c\0p\0i\0p\0 \0[\0R\0A\0W\0/\0I\0P\0]\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\204\3\0\0\27\7\0\0\314\4\0\0d\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0\360\0\0\0\27\7\0\0\314\4\0\0d\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\30\7\0\0\314\4\0\0d\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0\354\0\0\0\250\360\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0p\265\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\00\04\0\30\7\0\0\314\4\0\0d\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0\360\0\0\0\31\7\0\0\314\4\0\0d\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\360\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\31\7\0\0\314\4\0\0d\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\32\7\0\0\314\4\0\0d\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\360\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) , Partial, 900, ... TitleIdx=0, Type=3, Data= (240, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\11\6\2\0\0\0\0\0\0\0\0\0\0\0\0\0\14\0\0\0\240\32\17\347\213\253\317\21\214\243\0\200_H\241\222\353\3\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\2\0\0\0\20\0\0\0\20\0\0\0\3\0\0\0\0\0\0\0\377\0\0\0\0\0\0\0\0\0\0\0\273\377\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0T\0c\0p\0i\0p\0 \0[\0R\0A\0W\0/\0I\0P\0]\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\204\3\0\0\27\7\0\0\314\4\0\0d\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0\360\0\0\0\27\7\0\0\314\4\0\0d\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\30\7\0\0\314\4\0\0d\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0\354\0\0\0\250\360\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0p\265\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\00\04\0\30\7\0\0\314\4\0\0d\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0\360\0\0\0\31\7\0\0\314\4\0\0d\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\360\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\31\7\0\0\314\4\0\0d\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\32\7\0\0\314\4\0\0d\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\360\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) \0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\31\7\0\0\314\4\0\0d\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\32\7\0\0\314\4\0\0d\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\360\0\0\0\0\0\0\0 (240, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\11\6\2\0\0\0\0\0\0\0\0\0\0\0\0\0\14\0\0\0\240\32\17\347\213\253\317\21\214\243\0\200_H\241\222\353\3\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\2\0\0\0\20\0\0\0\20\0\0\0\3\0\0\0\0\0\0\0\377\0\0\0\0\0\0\0\0\0\0\0\273\377\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0T\0c\0p\0i\0p\0 \0[\0R\0A\0W\0/\0I\0P\0]\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\204\3\0\0\27\7\0\0\314\4\0\0d\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0\360\0\0\0\27\7\0\0\314\4\0\0d\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\30\7\0\0\314\4\0\0d\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0\354\0\0\0\250\360\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0p\265\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\00\04\0\30\7\0\0\314\4\0\0d\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0\360\0\0\0\31\7\0\0\314\4\0\0d\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\360\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\31\7\0\0\314\4\0\0d\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\32\7\0\0\314\4\0\0d\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\360\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) }, 900, ) == 0x0
 01815   868   NtClose  (240, ... ) == 0x0
 01816   868   NtOpenKey  (0x20019, {24, 236, 0x40, 0, 0,  (0x20019, {24, 236, 0x40, 0, 0, "000000000004"}, ... 240, ) }, ... 240, ) == 0x0
 01817   868   NtQueryValueKey  (240,  (240, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 01818   868   NtQueryValueKey  (240,  (240, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 01819   868   NtQueryValueKey  (240,  (240, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\rsvpsp.dll\0\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\11&\2\0\0\0\0\0\0\0\0\0\0\0\0\0\10\0\0\0\340\251`\235z3\320\21\275\210\0\0\300\202\346\232\354\3\0\0\1\0\0\0\204\370\272\2|\370\272\2\210\371\272\2\4\244`u\\12\0\0\240<_u\260\371\272\2\6\0\0\0\2\0\0\0\20\0\0\0\20\0\0\0\2\0\0\0\21\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\273\377\0\0\0\0\0\0R\0S\0V\0P\0 \0U\0D\0P\0 \0S\0e\0r\0v\0i\0c\0e\0 \0P\0r\0o\0v\0i\0d\0e\0r\0\0\0\1\0\0\0\344\373\272\2\1\0\0\0\330\273\356\0\0\0\0\0=\373\220|\200\371\272\2\0\0\0\0\0\371\272\2l\373\220|q\373\220|\0\0\0\0\200\371\272\2=\373\220|\334\370\272\2\0\0\0\0\204\3\0\0\34\7\0\0\314\4\0\0d\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0\360\0\0\0\34\7\0\0\314\4\0\0d\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\35\7\0\0\314\4\0\0d\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0\354\0\0\0\250\360\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0p\265\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\00\05\0\35\7\0\0\314\4\0\0d\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0\360\0\0\0\36\7\0\0\314\4\0\0d\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\360\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\36\7\0\0\314\4\0\0d\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\37\7\0\0\314\4\0\0d\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\360\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) , Partial, 900, ... TitleIdx=0, Type=3, Data= (240, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\rsvpsp.dll\0\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\11&\2\0\0\0\0\0\0\0\0\0\0\0\0\0\10\0\0\0\340\251`\235z3\320\21\275\210\0\0\300\202\346\232\354\3\0\0\1\0\0\0\204\370\272\2|\370\272\2\210\371\272\2\4\244`u\\12\0\0\240<_u\260\371\272\2\6\0\0\0\2\0\0\0\20\0\0\0\20\0\0\0\2\0\0\0\21\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\273\377\0\0\0\0\0\0R\0S\0V\0P\0 \0U\0D\0P\0 \0S\0e\0r\0v\0i\0c\0e\0 \0P\0r\0o\0v\0i\0d\0e\0r\0\0\0\1\0\0\0\344\373\272\2\1\0\0\0\330\273\356\0\0\0\0\0=\373\220|\200\371\272\2\0\0\0\0\0\371\272\2l\373\220|q\373\220|\0\0\0\0\200\371\272\2=\373\220|\334\370\272\2\0\0\0\0\204\3\0\0\34\7\0\0\314\4\0\0d\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0\360\0\0\0\34\7\0\0\314\4\0\0d\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\35\7\0\0\314\4\0\0d\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0\354\0\0\0\250\360\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0p\265\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\00\05\0\35\7\0\0\314\4\0\0d\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0\360\0\0\0\36\7\0\0\314\4\0\0d\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\360\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\36\7\0\0\314\4\0\0d\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\37\7\0\0\314\4\0\0d\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\360\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) \0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\36\7\0\0\314\4\0\0d\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\37\7\0\0\314\4\0\0d\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\360\0\0\0\0\0\0\0 (240, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\rsvpsp.dll\0\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\11&\2\0\0\0\0\0\0\0\0\0\0\0\0\0\10\0\0\0\340\251`\235z3\320\21\275\210\0\0\300\202\346\232\354\3\0\0\1\0\0\0\204\370\272\2|\370\272\2\210\371\272\2\4\244`u\\12\0\0\240<_u\260\371\272\2\6\0\0\0\2\0\0\0\20\0\0\0\20\0\0\0\2\0\0\0\21\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\273\377\0\0\0\0\0\0R\0S\0V\0P\0 \0U\0D\0P\0 \0S\0e\0r\0v\0i\0c\0e\0 \0P\0r\0o\0v\0i\0d\0e\0r\0\0\0\1\0\0\0\344\373\272\2\1\0\0\0\330\273\356\0\0\0\0\0=\373\220|\200\371\272\2\0\0\0\0\0\371\272\2l\373\220|q\373\220|\0\0\0\0\200\371\272\2=\373\220|\334\370\272\2\0\0\0\0\204\3\0\0\34\7\0\0\314\4\0\0d\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0\360\0\0\0\34\7\0\0\314\4\0\0d\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\35\7\0\0\314\4\0\0d\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0\354\0\0\0\250\360\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0p\265\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\00\05\0\35\7\0\0\314\4\0\0d\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0\360\0\0\0\36\7\0\0\314\4\0\0d\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\360\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\36\7\0\0\314\4\0\0d\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\37\7\0\0\314\4\0\0d\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\360\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) }, 900, ) == 0x0
 01820   868   NtClose  (240, ... ) == 0x0
 01821   868   NtOpenKey  (0x20019, {24, 236, 0x40, 0, 0,  (0x20019, {24, 236, 0x40, 0, 0, "000000000005"}, ... 240, ) }, ... 240, ) == 0x0
 01822   868   NtQueryValueKey  (240,  (240, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 01823   868   NtQueryValueKey  (240,  (240, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 01824   868   NtQueryValueKey  (240,  (240, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\rsvpsp.dll\0\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5f \2\0\0\0\0\0\0\0\0\0\0\0\0\0\10\0\0\0\340\251`\235z3\320\21\275\210\0\0\300\202\346\232\355\3\0\0\1\0\0\0\210\1\34\0\0\0\34\0\10\0\0\0\0\0\0\0\214\373\272\2\\15\221|\0\0\34\0\6\0\0\0\2\0\0\0\20\0\0\0\20\0\0\0\1\0\0\0\6\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0R\0S\0V\0P\0 \0T\0C\0P\0 \0S\0e\0r\0v\0i\0c\0e\0 \0P\0r\0o\0v\0i\0d\0e\0r\0\0\0\210\1\34\0\0\0\0\0\20\0\0\0P\373\272\2\270Ddu\0\0\0\0(\275\356\0|\373\272\2\364\373\272\2\0\0\34\0\10\0\0\0\0\0\0\0(\374\272\2\\15\221|\0\0\34\0\0\0\0\0\204\3\0\0!\7\0\0\314\4\0\0d\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0\360\0\0\0!\7\0\0\314\4\0\0d\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0"\7\0\0\314\4\0\0d\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0\354\0\0\0\250\360\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0p\265\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\00\06\0"\7\0\0\314\4\0\0d\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0\360\0\0\0#\7\0\0\314\4\0\0d\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\360\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0#\7\0\0\314\4\0\0d\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0$\7\0\0\314\4\0\0d\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\360\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) , Partial, 900, ... TitleIdx=0, Type=3, Data= (240, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\rsvpsp.dll\0\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5f \2\0\0\0\0\0\0\0\0\0\0\0\0\0\10\0\0\0\340\251`\235z3\320\21\275\210\0\0\300\202\346\232\355\3\0\0\1\0\0\0\210\1\34\0\0\0\34\0\10\0\0\0\0\0\0\0\214\373\272\2\\15\221|\0\0\34\0\6\0\0\0\2\0\0\0\20\0\0\0\20\0\0\0\1\0\0\0\6\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0R\0S\0V\0P\0 \0T\0C\0P\0 \0S\0e\0r\0v\0i\0c\0e\0 \0P\0r\0o\0v\0i\0d\0e\0r\0\0\0\210\1\34\0\0\0\0\0\20\0\0\0P\373\272\2\270Ddu\0\0\0\0(\275\356\0|\373\272\2\364\373\272\2\0\0\34\0\10\0\0\0\0\0\0\0(\374\272\2\\15\221|\0\0\34\0\0\0\0\0\204\3\0\0!\7\0\0\314\4\0\0d\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0\360\0\0\0!\7\0\0\314\4\0\0d\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0"\7\0\0\314\4\0\0d\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0\354\0\0\0\250\360\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0p\265\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\00\06\0"\7\0\0\314\4\0\0d\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0\360\0\0\0#\7\0\0\314\4\0\0d\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\360\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0#\7\0\0\314\4\0\0d\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0$\7\0\0\314\4\0\0d\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\360\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) \7\0\0\314\4\0\0d\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0\354\0\0\0\250\360\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0p\265\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\00\06\0 (240, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\rsvpsp.dll\0\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5f \2\0\0\0\0\0\0\0\0\0\0\0\0\0\10\0\0\0\340\251`\235z3\320\21\275\210\0\0\300\202\346\232\355\3\0\0\1\0\0\0\210\1\34\0\0\0\34\0\10\0\0\0\0\0\0\0\214\373\272\2\\15\221|\0\0\34\0\6\0\0\0\2\0\0\0\20\0\0\0\20\0\0\0\1\0\0\0\6\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0R\0S\0V\0P\0 \0T\0C\0P\0 \0S\0e\0r\0v\0i\0c\0e\0 \0P\0r\0o\0v\0i\0d\0e\0r\0\0\0\210\1\34\0\0\0\0\0\20\0\0\0P\373\272\2\270Ddu\0\0\0\0(\275\356\0|\373\272\2\364\373\272\2\0\0\34\0\10\0\0\0\0\0\0\0(\374\272\2\\15\221|\0\0\34\0\0\0\0\0\204\3\0\0!\7\0\0\314\4\0\0d\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0\360\0\0\0!\7\0\0\314\4\0\0d\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0"\7\0\0\314\4\0\0d\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0\354\0\0\0\250\360\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0p\265\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\00\06\0"\7\0\0\314\4\0\0d\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0\360\0\0\0#\7\0\0\314\4\0\0d\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\360\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0#\7\0\0\314\4\0\0d\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0$\7\0\0\314\4\0\0d\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\360\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) \0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0#\7\0\0\314\4\0\0d\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0$\7\0\0\314\4\0\0d\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\360\0\0\0\0\0\0\0 (240, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\rsvpsp.dll\0\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5f \2\0\0\0\0\0\0\0\0\0\0\0\0\0\10\0\0\0\340\251`\235z3\320\21\275\210\0\0\300\202\346\232\355\3\0\0\1\0\0\0\210\1\34\0\0\0\34\0\10\0\0\0\0\0\0\0\214\373\272\2\\15\221|\0\0\34\0\6\0\0\0\2\0\0\0\20\0\0\0\20\0\0\0\1\0\0\0\6\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0R\0S\0V\0P\0 \0T\0C\0P\0 \0S\0e\0r\0v\0i\0c\0e\0 \0P\0r\0o\0v\0i\0d\0e\0r\0\0\0\210\1\34\0\0\0\0\0\20\0\0\0P\373\272\2\270Ddu\0\0\0\0(\275\356\0|\373\272\2\364\373\272\2\0\0\34\0\10\0\0\0\0\0\0\0(\374\272\2\\15\221|\0\0\34\0\0\0\0\0\204\3\0\0!\7\0\0\314\4\0\0d\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0\360\0\0\0!\7\0\0\314\4\0\0d\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0"\7\0\0\314\4\0\0d\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0\354\0\0\0\250\360\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0p\265\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\00\06\0"\7\0\0\314\4\0\0d\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0\360\0\0\0#\7\0\0\314\4\0\0d\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\360\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0#\7\0\0\314\4\0\0d\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0$\7\0\0\314\4\0\0d\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\360\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) }, 900, ) == 0x0
 01825   868   NtClose  (240, ... ) == 0x0
 01826   868   NtOpenKey  (0x20019, {24, 236, 0x40, 0, 0,  (0x20019, {24, 236, 0x40, 0, 0, "000000000006"}, ... 240, ) }, ... 240, ) == 0x0
 01827   868   NtQueryValueKey  (240,  (240, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 01828   868   NtQueryValueKey  (240,  (240, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 01829   868   NtAllocateVirtualMemory  (-1, 1363968, 0, 4096, 4096, 4, ... 1363968, 4096, ) == 0x0
 01830   868   NtQueryValueKey  (240,  (240, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5&\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\10\0\0\0d\200\304\237\230r\344C\267\275\30\37 \211y*\374\3\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0 \0\0\0\36\0\0\0\36\0\0\0\1\0\0\0\3\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0R\0f\0C\0o\0m\0m\0 \0[\0B\0l\0u\0e\0t\0o\0o\0t\0h\0]\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\204\3\0\0'\7\0\0\314\4\0\0d\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0\360\0\0\0'\7\0\0\314\4\0\0d\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0(\7\0\0\314\4\0\0d\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0\354\0\0\0\250\360\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0p\265\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\00\07\0(\7\0\0\314\4\0\0d\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0\360\0\0\0)\7\0\0\314\4\0\0d\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\360\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0)\7\0\0\314\4\0\0d\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0*\7\0\0\314\4\0\0d\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\360\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) , Partial, 900, ... TitleIdx=0, Type=3, Data= (240, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5&\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\10\0\0\0d\200\304\237\230r\344C\267\275\30\37 \211y*\374\3\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0 \0\0\0\36\0\0\0\36\0\0\0\1\0\0\0\3\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0R\0f\0C\0o\0m\0m\0 \0[\0B\0l\0u\0e\0t\0o\0o\0t\0h\0]\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\204\3\0\0'\7\0\0\314\4\0\0d\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0\360\0\0\0'\7\0\0\314\4\0\0d\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0(\7\0\0\314\4\0\0d\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0\354\0\0\0\250\360\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0p\265\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\00\07\0(\7\0\0\314\4\0\0d\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0\360\0\0\0)\7\0\0\314\4\0\0d\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\360\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0)\7\0\0\314\4\0\0d\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0*\7\0\0\314\4\0\0d\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\360\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) \0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0)\7\0\0\314\4\0\0d\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0*\7\0\0\314\4\0\0d\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\360\0\0\0\0\0\0\0 (240, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5&\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\10\0\0\0d\200\304\237\230r\344C\267\275\30\37 \211y*\374\3\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0 \0\0\0\36\0\0\0\36\0\0\0\1\0\0\0\3\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0R\0f\0C\0o\0m\0m\0 \0[\0B\0l\0u\0e\0t\0o\0o\0t\0h\0]\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\204\3\0\0'\7\0\0\314\4\0\0d\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0\360\0\0\0'\7\0\0\314\4\0\0d\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0(\7\0\0\314\4\0\0d\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0\354\0\0\0\250\360\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0p\265\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\00\07\0(\7\0\0\314\4\0\0d\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0\360\0\0\0)\7\0\0\314\4\0\0d\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\360\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0)\7\0\0\314\4\0\0d\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0*\7\0\0\314\4\0\0d\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\360\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) }, 900, ) == 0x0
 01831   868   NtClose  (240, ... ) == 0x0
 01832   868   NtOpenKey  (0x20019, {24, 236, 0x40, 0, 0,  (0x20019, {24, 236, 0x40, 0, 0, "000000000007"}, ... 240, ) }, ... 240, ) == 0x0
 01833   868   NtQueryValueKey  (240,  (240, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 01834   868   NtQueryValueKey  (240,  (240, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 01835   868   NtQueryValueKey  (240,  (240, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\16\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\23\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\5\0\0\0\373\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\0F\0C\0C\00\03\0A\04\01\0-\08\0C\0C\0C\0-\04\09\01\09\0-\0A\0\0\0\0\0\204\3\0\0,\7\0\0\314\4\0\0d\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0\360\0\0\0,\7\0\0\314\4\0\0d\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0-\7\0\0\314\4\0\0d\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0\354\0\0\0\250\360\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0p\265\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\00\08\0-\7\0\0\314\4\0\0d\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0\360\0\0\0.\7\0\0\314\4\0\0d\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\360\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0.\7\0\0\314\4\0\0d\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0/\7\0\0\314\4\0\0d\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\360\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) , Partial, 900, ... TitleIdx=0, Type=3, Data= (240, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\16\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\23\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\5\0\0\0\373\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\0F\0C\0C\00\03\0A\04\01\0-\08\0C\0C\0C\0-\04\09\01\09\0-\0A\0\0\0\0\0\204\3\0\0,\7\0\0\314\4\0\0d\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0\360\0\0\0,\7\0\0\314\4\0\0d\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0-\7\0\0\314\4\0\0d\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0\354\0\0\0\250\360\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0p\265\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\00\08\0-\7\0\0\314\4\0\0d\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0\360\0\0\0.\7\0\0\314\4\0\0d\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\360\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0.\7\0\0\314\4\0\0d\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0/\7\0\0\314\4\0\0d\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\360\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) \0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0.\7\0\0\314\4\0\0d\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0/\7\0\0\314\4\0\0d\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\360\0\0\0\0\0\0\0 (240, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\16\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\23\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\5\0\0\0\373\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\0F\0C\0C\00\03\0A\04\01\0-\08\0C\0C\0C\0-\04\09\01\09\0-\0A\0\0\0\0\0\204\3\0\0,\7\0\0\314\4\0\0d\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0\360\0\0\0,\7\0\0\314\4\0\0d\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0-\7\0\0\314\4\0\0d\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0\354\0\0\0\250\360\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0p\265\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\00\08\0-\7\0\0\314\4\0\0d\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0\360\0\0\0.\7\0\0\314\4\0\0d\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\360\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0.\7\0\0\314\4\0\0d\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0/\7\0\0\314\4\0\0d\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\360\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) }, 900, ) == 0x0
 01836   868   NtClose  (240, ... ) == 0x0
 01837   868   NtOpenKey  (0x20019, {24, 236, 0x40, 0, 0,  (0x20019, {24, 236, 0x40, 0, 0, "000000000008"}, ... 240, ) }, ... 240, ) == 0x0
 01838   868   NtQueryValueKey  (240,  (240, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 01839   868   NtQueryValueKey  (240,  (240, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 01840   868   NtQueryValueKey  (240,  (240, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\11\2\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\24\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\2\0\0\0\373\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\0F\0C\0C\00\03\0A\04\01\0-\08\0C\0C\0C\0-\04\09\01\09\0-\0A\0\0\0\0\0\204\3\0\01\7\0\0\314\4\0\0d\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0\360\0\0\01\7\0\0\314\4\0\0d\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\02\7\0\0\314\4\0\0d\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0\354\0\0\0\250\360\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0p\265\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\00\09\02\7\0\0\314\4\0\0d\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0\360\0\0\03\7\0\0\314\4\0\0d\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\360\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\03\7\0\0\314\4\0\0d\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\04\7\0\0\314\4\0\0d\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\360\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) , Partial, 900, ... TitleIdx=0, Type=3, Data= (240, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\11\2\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\24\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\2\0\0\0\373\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\0F\0C\0C\00\03\0A\04\01\0-\08\0C\0C\0C\0-\04\09\01\09\0-\0A\0\0\0\0\0\204\3\0\01\7\0\0\314\4\0\0d\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0\360\0\0\01\7\0\0\314\4\0\0d\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\02\7\0\0\314\4\0\0d\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0\354\0\0\0\250\360\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0p\265\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\00\09\02\7\0\0\314\4\0\0d\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0\360\0\0\03\7\0\0\314\4\0\0d\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\360\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\03\7\0\0\314\4\0\0d\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\04\7\0\0\314\4\0\0d\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\360\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) \0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\03\7\0\0\314\4\0\0d\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\04\7\0\0\314\4\0\0d\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\360\0\0\0\0\0\0\0 (240, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\11\2\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\24\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\2\0\0\0\373\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\0F\0C\0C\00\03\0A\04\01\0-\08\0C\0C\0C\0-\04\09\01\09\0-\0A\0\0\0\0\0\204\3\0\01\7\0\0\314\4\0\0d\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0\360\0\0\01\7\0\0\314\4\0\0d\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\02\7\0\0\314\4\0\0d\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0\354\0\0\0\250\360\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0p\265\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\00\09\02\7\0\0\314\4\0\0d\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0\360\0\0\03\7\0\0\314\4\0\0d\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\360\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\03\7\0\0\314\4\0\0d\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\04\7\0\0\314\4\0\0d\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\360\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) }, 900, ) == 0x0
 01841   868   NtClose  (240, ... ) == 0x0
 01842   868   NtOpenKey  (0x20019, {24, 236, 0x40, 0, 0,  (0x20019, {24, 236, 0x40, 0, 0, "000000000009"}, ... 240, ) }, ... 240, ) == 0x0
 01843   868   NtQueryValueKey  (240,  (240, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 01844   868   NtQueryValueKey  (240,  (240, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 01845   868   NtQueryValueKey  (240,  (240, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\16\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\25\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\5\0\0\0\374\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\0A\0E\07\04\02\01\0B\05\0-\07\03\02\0D\0-\04\05\06\07\0-\0A\0\0\0\0\0\204\3\0\06\7\0\0\314\4\0\0d\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0\360\0\0\06\7\0\0\314\4\0\0d\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\07\7\0\0\314\4\0\0d\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0\354\0\0\0\250\360\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0p\265\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\01\00\07\7\0\0\314\4\0\0d\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0\360\0\0\08\7\0\0\314\4\0\0d\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\360\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\08\7\0\0\314\4\0\0d\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\09\7\0\0\314\4\0\0d\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\360\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) , Partial, 900, ... TitleIdx=0, Type=3, Data= (240, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\16\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\25\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\5\0\0\0\374\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\0A\0E\07\04\02\01\0B\05\0-\07\03\02\0D\0-\04\05\06\07\0-\0A\0\0\0\0\0\204\3\0\06\7\0\0\314\4\0\0d\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0\360\0\0\06\7\0\0\314\4\0\0d\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\07\7\0\0\314\4\0\0d\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0\354\0\0\0\250\360\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0p\265\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\01\00\07\7\0\0\314\4\0\0d\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0\360\0\0\08\7\0\0\314\4\0\0d\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\360\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\08\7\0\0\314\4\0\0d\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\09\7\0\0\314\4\0\0d\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\360\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) \0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\08\7\0\0\314\4\0\0d\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\09\7\0\0\314\4\0\0d\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\360\0\0\0\0\0\0\0 (240, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\16\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\25\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\5\0\0\0\374\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\0A\0E\07\04\02\01\0B\05\0-\07\03\02\0D\0-\04\05\06\07\0-\0A\0\0\0\0\0\204\3\0\06\7\0\0\314\4\0\0d\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0\360\0\0\06\7\0\0\314\4\0\0d\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\07\7\0\0\314\4\0\0d\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0\354\0\0\0\250\360\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0p\265\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\01\00\07\7\0\0\314\4\0\0d\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0\360\0\0\08\7\0\0\314\4\0\0d\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\360\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\08\7\0\0\314\4\0\0d\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\09\7\0\0\314\4\0\0d\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\360\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) }, 900, ) == 0x0
 01846   868   NtClose  (240, ... ) == 0x0
 01847   868   NtOpenKey  (0x20019, {24, 236, 0x40, 0, 0,  (0x20019, {24, 236, 0x40, 0, 0, "000000000010"}, ... 240, ) }, ... 240, ) == 0x0
 01848   868   NtQueryValueKey  (240,  (240, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 01849   868   NtQueryValueKey  (240,  (240, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 01850   868   NtAllocateVirtualMemory  (-1, 1368064, 0, 4096, 4096, 4, ... 1368064, 4096, ) == 0x0
 01851   868   NtQueryValueKey  (240,  (240, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\11\2\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\26\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\2\0\0\0\374\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\0A\0E\07\04\02\01\0B\05\0-\07\03\02\0D\0-\04\05\06\07\0-\0A\0\0\0\0\0\204\3\0\0<\7\0\0\314\4\0\0d\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0\360\0\0\0<\7\0\0\314\4\0\0d\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0=\7\0\0\314\4\0\0d\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0\354\0\0\0\250\360\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0p\265\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\01\01\0=\7\0\0\314\4\0\0d\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0\360\0\0\0>\7\0\0\314\4\0\0d\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\360\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0>\7\0\0\314\4\0\0d\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0?\7\0\0\314\4\0\0d\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\360\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) , Partial, 900, ... TitleIdx=0, Type=3, Data= (240, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\11\2\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\26\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\2\0\0\0\374\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\0A\0E\07\04\02\01\0B\05\0-\07\03\02\0D\0-\04\05\06\07\0-\0A\0\0\0\0\0\204\3\0\0<\7\0\0\314\4\0\0d\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0\360\0\0\0<\7\0\0\314\4\0\0d\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0=\7\0\0\314\4\0\0d\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0\354\0\0\0\250\360\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0p\265\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\01\01\0=\7\0\0\314\4\0\0d\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0\360\0\0\0>\7\0\0\314\4\0\0d\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\360\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0>\7\0\0\314\4\0\0d\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0?\7\0\0\314\4\0\0d\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\360\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) \0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0>\7\0\0\314\4\0\0d\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0?\7\0\0\314\4\0\0d\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\360\0\0\0\0\0\0\0 (240, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\11\2\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\26\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\2\0\0\0\374\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\0A\0E\07\04\02\01\0B\05\0-\07\03\02\0D\0-\04\05\06\07\0-\0A\0\0\0\0\0\204\3\0\0<\7\0\0\314\4\0\0d\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0\360\0\0\0<\7\0\0\314\4\0\0d\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0=\7\0\0\314\4\0\0d\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0\354\0\0\0\250\360\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0p\265\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\01\01\0=\7\0\0\314\4\0\0d\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0\360\0\0\0>\7\0\0\314\4\0\0d\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\360\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0>\7\0\0\314\4\0\0d\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0?\7\0\0\314\4\0\0d\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\360\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) }, 900, ) == 0x0
 01852   868   NtClose  (240, ... ) == 0x0
 01853   868   NtOpenKey  (0x20019, {24, 236, 0x40, 0, 0,  (0x20019, {24, 236, 0x40, 0, 0, "000000000011"}, ... 240, ) }, ... 240, ) == 0x0
 01854   868   NtQueryValueKey  (240,  (240, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 01855   868   NtQueryValueKey  (240,  (240, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 01856   868   NtQueryValueKey  (240,  (240, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\16\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\27\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\5\0\0\0\375\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\09\07\0C\02\0D\09\0F\04\0-\06\09\05\04\0-\04\0E\0B\03\0-\08\0\0\0\0\0\204\3\0\0A\7\0\0\314\4\0\0d\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0\360\0\0\0A\7\0\0\314\4\0\0d\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0B\7\0\0\314\4\0\0d\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0\354\0\0\0\250\360\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0p\265\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\01\02\0B\7\0\0\314\4\0\0d\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0\360\0\0\0C\7\0\0\314\4\0\0d\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\360\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0C\7\0\0\314\4\0\0d\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0D\7\0\0\314\4\0\0d\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\360\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) , Partial, 900, ... TitleIdx=0, Type=3, Data= (240, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\16\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\27\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\5\0\0\0\375\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\09\07\0C\02\0D\09\0F\04\0-\06\09\05\04\0-\04\0E\0B\03\0-\08\0\0\0\0\0\204\3\0\0A\7\0\0\314\4\0\0d\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0\360\0\0\0A\7\0\0\314\4\0\0d\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0B\7\0\0\314\4\0\0d\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0\354\0\0\0\250\360\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0p\265\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\01\02\0B\7\0\0\314\4\0\0d\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0\360\0\0\0C\7\0\0\314\4\0\0d\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\360\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0C\7\0\0\314\4\0\0d\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0D\7\0\0\314\4\0\0d\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\360\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) \0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0C\7\0\0\314\4\0\0d\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0D\7\0\0\314\4\0\0d\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\360\0\0\0\0\0\0\0 (240, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\16\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\27\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\5\0\0\0\375\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\09\07\0C\02\0D\09\0F\04\0-\06\09\05\04\0-\04\0E\0B\03\0-\08\0\0\0\0\0\204\3\0\0A\7\0\0\314\4\0\0d\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0\360\0\0\0A\7\0\0\314\4\0\0d\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0B\7\0\0\314\4\0\0d\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0\354\0\0\0\250\360\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0p\265\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\01\02\0B\7\0\0\314\4\0\0d\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0\360\0\0\0C\7\0\0\314\4\0\0d\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\360\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0C\7\0\0\314\4\0\0d\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0D\7\0\0\314\4\0\0d\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\360\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) }, 900, ) == 0x0
 01857   868   NtClose  (240, ... ) == 0x0
 01858   868   NtOpenKey  (0x20019, {24, 236, 0x40, 0, 0,  (0x20019, {24, 236, 0x40, 0, 0, "000000000012"}, ... 240, ) }, ... 240, ) == 0x0
 01859   868   NtQueryValueKey  (240,  (240, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 01860   868   NtQueryValueKey  (240,  (240, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 01861   868   NtQueryValueKey  (240,  (240, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\11\2\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\30\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\2\0\0\0\375\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\09\07\0C\02\0D\09\0F\04\0-\06\09\05\04\0-\04\0E\0B\03\0-\08\0\0\0\0\0\204\3\0\0F\7\0\0\314\4\0\0d\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0\360\0\0\0F\7\0\0\314\4\0\0d\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0G\7\0\0\314\4\0\0d\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0\354\0\0\0\250\360\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0p\265\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\01\03\0G\7\0\0\314\4\0\0d\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0\360\0\0\0H\7\0\0\314\4\0\0d\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\360\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0H\7\0\0\314\4\0\0d\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0I\7\0\0\314\4\0\0d\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\360\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) , Partial, 900, ... TitleIdx=0, Type=3, Data= (240, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\11\2\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\30\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\2\0\0\0\375\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\09\07\0C\02\0D\09\0F\04\0-\06\09\05\04\0-\04\0E\0B\03\0-\08\0\0\0\0\0\204\3\0\0F\7\0\0\314\4\0\0d\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0\360\0\0\0F\7\0\0\314\4\0\0d\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0G\7\0\0\314\4\0\0d\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0\354\0\0\0\250\360\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0p\265\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\01\03\0G\7\0\0\314\4\0\0d\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0\360\0\0\0H\7\0\0\314\4\0\0d\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\360\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0H\7\0\0\314\4\0\0d\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0I\7\0\0\314\4\0\0d\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\360\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) \0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0H\7\0\0\314\4\0\0d\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0I\7\0\0\314\4\0\0d\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\360\0\0\0\0\0\0\0 (240, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\11\2\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\30\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\2\0\0\0\375\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\09\07\0C\02\0D\09\0F\04\0-\06\09\05\04\0-\04\0E\0B\03\0-\08\0\0\0\0\0\204\3\0\0F\7\0\0\314\4\0\0d\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0\360\0\0\0F\7\0\0\314\4\0\0d\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0G\7\0\0\314\4\0\0d\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0\354\0\0\0\250\360\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0p\265\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\01\03\0G\7\0\0\314\4\0\0d\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0\360\0\0\0H\7\0\0\314\4\0\0d\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\360\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0H\7\0\0\314\4\0\0d\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0I\7\0\0\314\4\0\0d\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\360\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) }, 900, ) == 0x0
 01862   868   NtClose  (240, ... ) == 0x0
 01863   868   NtOpenKey  (0x20019, {24, 236, 0x40, 0, 0,  (0x20019, {24, 236, 0x40, 0, 0, "000000000013"}, ... 240, ) }, ... 240, ) == 0x0
 01864   868   NtQueryValueKey  (240,  (240, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 01865   868   NtQueryValueKey  (240,  (240, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 01866   868   NtQueryValueKey  (240,  (240, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\16\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\10\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\31\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\5\0\0\0\0\0\0\200\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\00\0D\04\03\00\0A\06\0F\0-\00\04\01\00\0-\04\0A\06\08\0-\09\0\0\0\0\0\204\3\0\0K\7\0\0\314\4\0\0d\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0\360\0\0\0K\7\0\0\314\4\0\0d\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0L\7\0\0\314\4\0\0d\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0\354\0\0\0\250\360\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0p\265\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\01\04\0L\7\0\0\314\4\0\0d\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0\360\0\0\0M\7\0\0\314\4\0\0d\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\360\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0M\7\0\0\314\4\0\0d\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0N\7\0\0\314\4\0\0d\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\360\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) , Partial, 900, ... TitleIdx=0, Type=3, Data= (240, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\16\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\10\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\31\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\5\0\0\0\0\0\0\200\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\00\0D\04\03\00\0A\06\0F\0-\00\04\01\00\0-\04\0A\06\08\0-\09\0\0\0\0\0\204\3\0\0K\7\0\0\314\4\0\0d\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0\360\0\0\0K\7\0\0\314\4\0\0d\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0L\7\0\0\314\4\0\0d\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0\354\0\0\0\250\360\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0p\265\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\01\04\0L\7\0\0\314\4\0\0d\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0\360\0\0\0M\7\0\0\314\4\0\0d\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\360\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0M\7\0\0\314\4\0\0d\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0N\7\0\0\314\4\0\0d\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\360\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) \0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0M\7\0\0\314\4\0\0d\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0N\7\0\0\314\4\0\0d\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\360\0\0\0\0\0\0\0 (240, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\16\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\10\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\31\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\5\0\0\0\0\0\0\200\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\00\0D\04\03\00\0A\06\0F\0-\00\04\01\00\0-\04\0A\06\08\0-\09\0\0\0\0\0\204\3\0\0K\7\0\0\314\4\0\0d\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0\360\0\0\0K\7\0\0\314\4\0\0d\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0L\7\0\0\314\4\0\0d\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0\354\0\0\0\250\360\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0p\265\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\01\04\0L\7\0\0\314\4\0\0d\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0\360\0\0\0M\7\0\0\314\4\0\0d\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\360\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0M\7\0\0\314\4\0\0d\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0N\7\0\0\314\4\0\0d\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\360\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) }, 900, ) == 0x0
 01867   868   NtClose  (240, ... ) == 0x0
 01868   868   NtOpenKey  (0x20019, {24, 236, 0x40, 0, 0,  (0x20019, {24, 236, 0x40, 0, 0, "000000000014"}, ... 240, ) }, ... 240, ) == 0x0
 01869   868   NtQueryValueKey  (240,  (240, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 01870   868   NtQueryValueKey  (240,  (240, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 01871   868   NtQueryValueKey  (240,  (240, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\11\2\2\0\0\0\0\0\0\0\0\0\0\0\0\0\10\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\32\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\2\0\0\0\0\0\0\200\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\00\0D\04\03\00\0A\06\0F\0-\00\04\01\00\0-\04\0A\06\08\0-\09\0\0\0\0\0\204\3\0\0P\7\0\0\314\4\0\0d\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0\360\0\0\0P\7\0\0\314\4\0\0d\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0Q\7\0\0\314\4\0\0d\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0\354\0\0\0\250\360\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0p\265\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\01\05\0Q\7\0\0\314\4\0\0d\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0\360\0\0\0R\7\0\0\314\4\0\0d\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\360\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0R\7\0\0\314\4\0\0d\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0S\7\0\0\314\4\0\0d\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\360\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) , Partial, 900, ... TitleIdx=0, Type=3, Data= (240, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\11\2\2\0\0\0\0\0\0\0\0\0\0\0\0\0\10\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\32\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\2\0\0\0\0\0\0\200\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\00\0D\04\03\00\0A\06\0F\0-\00\04\01\00\0-\04\0A\06\08\0-\09\0\0\0\0\0\204\3\0\0P\7\0\0\314\4\0\0d\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0\360\0\0\0P\7\0\0\314\4\0\0d\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0Q\7\0\0\314\4\0\0d\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0\354\0\0\0\250\360\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0p\265\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\01\05\0Q\7\0\0\314\4\0\0d\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0\360\0\0\0R\7\0\0\314\4\0\0d\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\360\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0R\7\0\0\314\4\0\0d\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0S\7\0\0\314\4\0\0d\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\360\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) \0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0R\7\0\0\314\4\0\0d\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0S\7\0\0\314\4\0\0d\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\360\0\0\0\0\0\0\0 (240, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\11\2\2\0\0\0\0\0\0\0\0\0\0\0\0\0\10\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\32\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\2\0\0\0\0\0\0\200\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\00\0D\04\03\00\0A\06\0F\0-\00\04\01\00\0-\04\0A\06\08\0-\09\0\0\0\0\0\204\3\0\0P\7\0\0\314\4\0\0d\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0\360\0\0\0P\7\0\0\314\4\0\0d\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0Q\7\0\0\314\4\0\0d\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0\354\0\0\0\250\360\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0p\265\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\01\05\0Q\7\0\0\314\4\0\0d\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0\360\0\0\0R\7\0\0\314\4\0\0d\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\360\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0R\7\0\0\314\4\0\0d\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0S\7\0\0\314\4\0\0d\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\360\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) }, 900, ) == 0x0
 01872   868   NtClose  (240, ... ) == 0x0
 01873   868   NtOpenKey  (0x20019, {24, 236, 0x40, 0, 0,  (0x20019, {24, 236, 0x40, 0, 0, "000000000015"}, ... 240, ) }, ... 240, ) == 0x0
 01874   868   NtQueryValueKey  (240,  (240, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 01875   868   NtQueryValueKey  (240,  (240, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 01876   868   NtAllocateVirtualMemory  (-1, 1372160, 0, 4096, 4096, 4, ... 1372160, 4096, ) == 0x0
 01877   868   NtQueryValueKey  (240,  (240, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\16\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\33\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\5\0\0\0\377\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\08\0A\0D\04\0D\08\00\06\0-\00\08\01\0B\0-\04\04\04\06\0-\0A\0\0\0\0\0\204\3\0\0V\7\0\0\314\4\0\0d\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0\360\0\0\0V\7\0\0\314\4\0\0d\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0W\7\0\0\314\4\0\0d\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0\354\0\0\0\250\360\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0p\265\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\01\06\0W\7\0\0\314\4\0\0d\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0\360\0\0\0X\7\0\0\314\4\0\0d\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\360\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0X\7\0\0\314\4\0\0d\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0Y\7\0\0\314\4\0\0d\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\360\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) , Partial, 900, ... TitleIdx=0, Type=3, Data= (240, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\16\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\33\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\5\0\0\0\377\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\08\0A\0D\04\0D\08\00\06\0-\00\08\01\0B\0-\04\04\04\06\0-\0A\0\0\0\0\0\204\3\0\0V\7\0\0\314\4\0\0d\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0\360\0\0\0V\7\0\0\314\4\0\0d\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0W\7\0\0\314\4\0\0d\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0\354\0\0\0\250\360\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0p\265\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\01\06\0W\7\0\0\314\4\0\0d\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0\360\0\0\0X\7\0\0\314\4\0\0d\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\360\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0X\7\0\0\314\4\0\0d\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0Y\7\0\0\314\4\0\0d\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\360\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) \0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0X\7\0\0\314\4\0\0d\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0Y\7\0\0\314\4\0\0d\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\360\0\0\0\0\0\0\0 (240, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\16\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\33\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\5\0\0\0\377\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\08\0A\0D\04\0D\08\00\06\0-\00\08\01\0B\0-\04\04\04\06\0-\0A\0\0\0\0\0\204\3\0\0V\7\0\0\314\4\0\0d\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0\360\0\0\0V\7\0\0\314\4\0\0d\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0W\7\0\0\314\4\0\0d\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0\354\0\0\0\250\360\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0p\265\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\01\06\0W\7\0\0\314\4\0\0d\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0\360\0\0\0X\7\0\0\314\4\0\0d\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\360\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0X\7\0\0\314\4\0\0d\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0Y\7\0\0\314\4\0\0d\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\360\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) }, 900, ) == 0x0
 01878   868   NtClose  (240, ... ) == 0x0
 01879   868   NtOpenKey  (0x20019, {24, 236, 0x40, 0, 0,  (0x20019, {24, 236, 0x40, 0, 0, "000000000016"}, ... 240, ) }, ... 240, ) == 0x0
 01880   868   NtQueryValueKey  (240,  (240, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 01881   868   NtQueryValueKey  (240,  (240, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 01882   868   NtQueryValueKey  (240,  (240, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\11\2\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\34\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\2\0\0\0\377\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\08\0A\0D\04\0D\08\00\06\0-\00\08\01\0B\0-\04\04\04\06\0-\0A\0\0\0\0\0\204\3\0\0[\7\0\0\314\4\0\0d\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0\360\0\0\0[\7\0\0\314\4\0\0d\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\\7\0\0\314\4\0\0d\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0\354\0\0\0\250\360\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0p\265\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\01\07\0\\7\0\0\314\4\0\0d\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0\360\0\0\0]\7\0\0\314\4\0\0d\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\360\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0]\7\0\0\314\4\0\0d\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0^\7\0\0\314\4\0\0d\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\360\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) , Partial, 900, ... TitleIdx=0, Type=3, Data= (240, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\11\2\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\34\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\2\0\0\0\377\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\08\0A\0D\04\0D\08\00\06\0-\00\08\01\0B\0-\04\04\04\06\0-\0A\0\0\0\0\0\204\3\0\0[\7\0\0\314\4\0\0d\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0\360\0\0\0[\7\0\0\314\4\0\0d\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\\7\0\0\314\4\0\0d\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0\354\0\0\0\250\360\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0p\265\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\01\07\0\\7\0\0\314\4\0\0d\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0\360\0\0\0]\7\0\0\314\4\0\0d\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\360\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0]\7\0\0\314\4\0\0d\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0^\7\0\0\314\4\0\0d\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\360\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) \0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0]\7\0\0\314\4\0\0d\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0^\7\0\0\314\4\0\0d\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\360\0\0\0\0\0\0\0 (240, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\11\2\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\34\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\2\0\0\0\377\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\08\0A\0D\04\0D\08\00\06\0-\00\08\01\0B\0-\04\04\04\06\0-\0A\0\0\0\0\0\204\3\0\0[\7\0\0\314\4\0\0d\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0\360\0\0\0[\7\0\0\314\4\0\0d\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\\7\0\0\314\4\0\0d\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0\354\0\0\0\250\360\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0p\265\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\01\07\0\\7\0\0\314\4\0\0d\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0\360\0\0\0]\7\0\0\314\4\0\0d\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\360\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0]\7\0\0\314\4\0\0d\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0^\7\0\0\314\4\0\0d\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\360\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) }, 900, ) == 0x0
 01883   868   NtClose  (240, ... ) == 0x0
 01884   868   NtOpenKey  (0x20019, {24, 236, 0x40, 0, 0,  (0x20019, {24, 236, 0x40, 0, 0, "000000000017"}, ... 240, ) }, ... 240, ) == 0x0
 01885   868   NtQueryValueKey  (240,  (240, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 01886   868   NtQueryValueKey  (240,  (240, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 01887   868   NtQueryValueKey  (240,  (240, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\16\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\35\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\5\0\0\0\376\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\0E\05\05\09\0B\00\0C\01\0-\0F\0A\04\06\0-\04\06\04\0D\0-\0B\0\0\0\0\0\204\3\0\0`\7\0\0\314\4\0\0d\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0\360\0\0\0`\7\0\0\314\4\0\0d\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0a\7\0\0\314\4\0\0d\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0\354\0\0\0\250\360\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0p\265\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\01\08\0a\7\0\0\314\4\0\0d\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0\360\0\0\0b\7\0\0\314\4\0\0d\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\360\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0b\7\0\0\314\4\0\0d\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0c\7\0\0\314\4\0\0d\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\360\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) , Partial, 900, ... TitleIdx=0, Type=3, Data= (240, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\16\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\35\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\5\0\0\0\376\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\0E\05\05\09\0B\00\0C\01\0-\0F\0A\04\06\0-\04\06\04\0D\0-\0B\0\0\0\0\0\204\3\0\0`\7\0\0\314\4\0\0d\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0\360\0\0\0`\7\0\0\314\4\0\0d\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0a\7\0\0\314\4\0\0d\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0\354\0\0\0\250\360\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0p\265\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\01\08\0a\7\0\0\314\4\0\0d\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0\360\0\0\0b\7\0\0\314\4\0\0d\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\360\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0b\7\0\0\314\4\0\0d\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0c\7\0\0\314\4\0\0d\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\360\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) \0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0b\7\0\0\314\4\0\0d\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0c\7\0\0\314\4\0\0d\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\360\0\0\0\0\0\0\0 (240, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\16\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\35\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\5\0\0\0\376\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\0E\05\05\09\0B\00\0C\01\0-\0F\0A\04\06\0-\04\06\04\0D\0-\0B\0\0\0\0\0\204\3\0\0`\7\0\0\314\4\0\0d\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0\360\0\0\0`\7\0\0\314\4\0\0d\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0a\7\0\0\314\4\0\0d\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0\354\0\0\0\250\360\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0p\265\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\01\08\0a\7\0\0\314\4\0\0d\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0\360\0\0\0b\7\0\0\314\4\0\0d\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\360\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0b\7\0\0\314\4\0\0d\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0c\7\0\0\314\4\0\0d\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\360\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) }, 900, ) == 0x0
 01888   868   NtClose  (240, ... ) == 0x0
 01889   868   NtOpenKey  (0x20019, {24, 236, 0x40, 0, 0,  (0x20019, {24, 236, 0x40, 0, 0, "000000000018"}, ... 240, ) }, ... 240, ) == 0x0
 01890   868   NtQueryValueKey  (240,  (240, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 01891   868   NtQueryValueKey  (240,  (240, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 01892   868   NtQueryValueKey  (240,  (240, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\11\2\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\36\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\2\0\0\0\376\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\0E\05\05\09\0B\00\0C\01\0-\0F\0A\04\06\0-\04\06\04\0D\0-\0B\0\0\0\0\0\204\3\0\0e\7\0\0\314\4\0\0d\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0\360\0\0\0e\7\0\0\314\4\0\0d\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0f\7\0\0\314\4\0\0d\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0\354\0\0\0\250\360\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0p\265\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\01\09\0f\7\0\0\314\4\0\0d\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0\360\0\0\0g\7\0\0\314\4\0\0d\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\360\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0g\7\0\0\314\4\0\0d\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0h\7\0\0\314\4\0\0d\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\360\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) , Partial, 900, ... TitleIdx=0, Type=3, Data= (240, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\11\2\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\36\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\2\0\0\0\376\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\0E\05\05\09\0B\00\0C\01\0-\0F\0A\04\06\0-\04\06\04\0D\0-\0B\0\0\0\0\0\204\3\0\0e\7\0\0\314\4\0\0d\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0\360\0\0\0e\7\0\0\314\4\0\0d\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0f\7\0\0\314\4\0\0d\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0\354\0\0\0\250\360\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0p\265\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\01\09\0f\7\0\0\314\4\0\0d\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0\360\0\0\0g\7\0\0\314\4\0\0d\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\360\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0g\7\0\0\314\4\0\0d\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0h\7\0\0\314\4\0\0d\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\360\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) \0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0g\7\0\0\314\4\0\0d\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0h\7\0\0\314\4\0\0d\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\360\0\0\0\0\0\0\0 (240, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\11\2\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\36\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\2\0\0\0\376\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\0E\05\05\09\0B\00\0C\01\0-\0F\0A\04\06\0-\04\06\04\0D\0-\0B\0\0\0\0\0\204\3\0\0e\7\0\0\314\4\0\0d\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0\360\0\0\0e\7\0\0\314\4\0\0d\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0f\7\0\0\314\4\0\0d\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0\354\0\0\0\250\360\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0p\265\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\01\09\0f\7\0\0\314\4\0\0d\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0\360\0\0\0g\7\0\0\314\4\0\0d\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\360\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0g\7\0\0\314\4\0\0d\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0h\7\0\0\314\4\0\0d\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\360\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) }, 900, ) == 0x0
 01893   868   NtClose  (240, ... ) == 0x0
 01894   868   NtOpenKey  (0x20019, {24, 236, 0x40, 0, 0,  (0x20019, {24, 236, 0x40, 0, 0, "000000000019"}, ... 240, ) }, ... 240, ) == 0x0
 01895   868   NtQueryValueKey  (240,  (240, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 01896   868   NtQueryValueKey  (240,  (240, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 01897   868   NtAllocateVirtualMemory  (-1, 1376256, 0, 4096, 4096, 4, ... 1376256, 4096, ) == 0x0
 01898   868   NtQueryValueKey  (240,  (240, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\16\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\37\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\5\0\0\0\372\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\0C\0D\03\0C\06\04\0B\08\0-\0D\0B\07\06\0-\04\04\0C\08\0-\09\0\0\0\0\0\204\3\0\0k\7\0\0\314\4\0\0d\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0\360\0\0\0k\7\0\0\314\4\0\0d\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0l\7\0\0\314\4\0\0d\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0\354\0\0\0\250\360\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0p\265\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\02\00\0l\7\0\0\314\4\0\0d\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0\360\0\0\0m\7\0\0\314\4\0\0d\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\360\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0m\7\0\0\314\4\0\0d\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0n\7\0\0\314\4\0\0d\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\360\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) , Partial, 900, ... TitleIdx=0, Type=3, Data= (240, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\16\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\37\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\5\0\0\0\372\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\0C\0D\03\0C\06\04\0B\08\0-\0D\0B\07\06\0-\04\04\0C\08\0-\09\0\0\0\0\0\204\3\0\0k\7\0\0\314\4\0\0d\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0\360\0\0\0k\7\0\0\314\4\0\0d\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0l\7\0\0\314\4\0\0d\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0\354\0\0\0\250\360\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0p\265\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\02\00\0l\7\0\0\314\4\0\0d\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0\360\0\0\0m\7\0\0\314\4\0\0d\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\360\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0m\7\0\0\314\4\0\0d\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0n\7\0\0\314\4\0\0d\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\360\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) \0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0m\7\0\0\314\4\0\0d\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0n\7\0\0\314\4\0\0d\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\360\0\0\0\0\0\0\0 (240, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\16\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\37\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\5\0\0\0\372\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\0C\0D\03\0C\06\04\0B\08\0-\0D\0B\07\06\0-\04\04\0C\08\0-\09\0\0\0\0\0\204\3\0\0k\7\0\0\314\4\0\0d\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0\360\0\0\0k\7\0\0\314\4\0\0d\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0l\7\0\0\314\4\0\0d\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0\354\0\0\0\250\360\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0p\265\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\02\00\0l\7\0\0\314\4\0\0d\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0\360\0\0\0m\7\0\0\314\4\0\0d\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\360\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0m\7\0\0\314\4\0\0d\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0n\7\0\0\314\4\0\0d\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\360\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) }, 900, ) == 0x0
 01899   868   NtClose  (240, ... ) == 0x0
 01900   868   NtOpenKey  (0x20019, {24, 236, 0x40, 0, 0,  (0x20019, {24, 236, 0x40, 0, 0, "000000000020"}, ... 240, ) }, ... 240, ) == 0x0
 01901   868   NtQueryValueKey  (240,  (240, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 01902   868   NtQueryValueKey  (240,  (240, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 01903   868   NtQueryValueKey  (240,  (240, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\11\2\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222 \4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\2\0\0\0\372\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\0C\0D\03\0C\06\04\0B\08\0-\0D\0B\07\06\0-\04\04\0C\08\0-\09\0\0\0\0\0\204\3\0\0p\7\0\0\314\4\0\0d\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0\360\0\0\0p\7\0\0\314\4\0\0d\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0q\7\0\0\314\4\0\0d\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0\354\0\0\0\250\360\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0p\265\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\02\01\0q\7\0\0\314\4\0\0d\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0\360\0\0\0r\7\0\0\314\4\0\0d\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\360\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0r\7\0\0\314\4\0\0d\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0s\7\0\0\314\4\0\0d\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\360\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) , Partial, 900, ... TitleIdx=0, Type=3, Data= (240, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\11\2\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222 \4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\2\0\0\0\372\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\0C\0D\03\0C\06\04\0B\08\0-\0D\0B\07\06\0-\04\04\0C\08\0-\09\0\0\0\0\0\204\3\0\0p\7\0\0\314\4\0\0d\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0\360\0\0\0p\7\0\0\314\4\0\0d\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0q\7\0\0\314\4\0\0d\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0\354\0\0\0\250\360\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0p\265\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\02\01\0q\7\0\0\314\4\0\0d\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0\360\0\0\0r\7\0\0\314\4\0\0d\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\360\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0r\7\0\0\314\4\0\0d\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0s\7\0\0\314\4\0\0d\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\360\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) \0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0r\7\0\0\314\4\0\0d\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0s\7\0\0\314\4\0\0d\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\360\0\0\0\0\0\0\0 (240, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\11\2\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222 \4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\2\0\0\0\372\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\0C\0D\03\0C\06\04\0B\08\0-\0D\0B\07\06\0-\04\04\0C\08\0-\09\0\0\0\0\0\204\3\0\0p\7\0\0\314\4\0\0d\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0\360\0\0\0p\7\0\0\314\4\0\0d\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0q\7\0\0\314\4\0\0d\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0\354\0\0\0\250\360\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0p\265\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\02\01\0q\7\0\0\314\4\0\0d\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0\360\0\0\0r\7\0\0\314\4\0\0d\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\360\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0r\7\0\0\314\4\0\0d\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0s\7\0\0\314\4\0\0d\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\360\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) }, 900, ) == 0x0
 01904   868   NtClose  (240, ... ) == 0x0
 01905   868   NtOpenKey  (0x20019, {24, 236, 0x40, 0, 0,  (0x20019, {24, 236, 0x40, 0, 0, "000000000021"}, ... 240, ) }, ... 240, ) == 0x0
 01906   868   NtQueryValueKey  (240,  (240, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 01907   868   NtQueryValueKey  (240,  (240, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 01908   868   NtQueryValueKey  (240,  (240, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\16\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222!\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\5\0\0\0\371\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\02\01\0B\08\0E\09\0D\05\0-\03\0F\0C\03\0-\04\0F\09\0D\0-\08\0\0\0\0\0\204\3\0\0u\7\0\0\314\4\0\0d\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0\360\0\0\0u\7\0\0\314\4\0\0d\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0v\7\0\0\314\4\0\0d\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0\354\0\0\0\250\360\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0p\265\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\02\02\0v\7\0\0\314\4\0\0d\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0\360\0\0\0w\7\0\0\314\4\0\0d\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\360\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0w\7\0\0\314\4\0\0d\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0x\7\0\0\314\4\0\0d\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\360\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) , Partial, 900, ... TitleIdx=0, Type=3, Data= (240, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\16\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222!\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\5\0\0\0\371\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\02\01\0B\08\0E\09\0D\05\0-\03\0F\0C\03\0-\04\0F\09\0D\0-\08\0\0\0\0\0\204\3\0\0u\7\0\0\314\4\0\0d\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0\360\0\0\0u\7\0\0\314\4\0\0d\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0v\7\0\0\314\4\0\0d\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0\354\0\0\0\250\360\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0p\265\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\02\02\0v\7\0\0\314\4\0\0d\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0\360\0\0\0w\7\0\0\314\4\0\0d\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\360\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0w\7\0\0\314\4\0\0d\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0x\7\0\0\314\4\0\0d\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\360\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) \0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0w\7\0\0\314\4\0\0d\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0x\7\0\0\314\4\0\0d\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\360\0\0\0\0\0\0\0 (240, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\16\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222!\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\5\0\0\0\371\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\02\01\0B\08\0E\09\0D\05\0-\03\0F\0C\03\0-\04\0F\09\0D\0-\08\0\0\0\0\0\204\3\0\0u\7\0\0\314\4\0\0d\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0\360\0\0\0u\7\0\0\314\4\0\0d\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0v\7\0\0\314\4\0\0d\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0\354\0\0\0\250\360\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0p\265\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\02\02\0v\7\0\0\314\4\0\0d\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0\360\0\0\0w\7\0\0\314\4\0\0d\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\360\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0w\7\0\0\314\4\0\0d\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0x\7\0\0\314\4\0\0d\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\360\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) }, 900, ) == 0x0
 01909   868   NtClose  (240, ... ) == 0x0
 01910   868   NtOpenKey  (0x20019, {24, 236, 0x40, 0, 0,  (0x20019, {24, 236, 0x40, 0, 0, "000000000022"}, ... 240, ) }, ... 240, ) == 0x0
 01911   868   NtQueryValueKey  (240,  (240, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 01912   868   NtQueryValueKey  (240,  (240, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 01913   868   NtQueryValueKey  (240,  (240, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\11\2\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222"\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\2\0\0\0\371\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\02\01\0B\08\0E\09\0D\05\0-\03\0F\0C\03\0-\04\0F\09\0D\0-\08\0\0\0\0\0\204\3\0\0z\7\0\0\314\4\0\0d\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0\360\0\0\0z\7\0\0\314\4\0\0d\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0{\7\0\0\314\4\0\0d\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0\354\0\0\0{\7\0\0\314\4\0\0d\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0|\7\0\0\314\4\0\0d\3\0\0\305\0\0\0\0\0\1\0\0\0\0\0\24\0\0\0\344\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0|\7\0\0\314\4\0\0d\3\0\0\305\0\0\0\1\0\1\0\2\1\0\0\0\0\0\0}\7\0\0\314\4\0\0d\3\0\0\25\0\0\0\0\0\1\0\0\0\0\0\24\0\0\0\3\0\37\0\377\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0}\7\0\0\314\4\0\0d\3\0\0\25\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0\354\0\0\0~\7\0\0\314\4\0\0d\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0T\0\0\0\0\0\0\2\0\0\0\0\30\0\0\0\340\0\0\0\320\360\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0$\0&\0PD\24\0\0\0\0\0N\0a\0m\0e\0S\0p\0a\0c\0e\0_\0C\0a\0t\0a\0l\0o\0g\05\0"}, 900, ) , Partial, 900, ... TitleIdx=0, Type=3, Data= (240, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\11\2\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222"\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\2\0\0\0\371\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\02\01\0B\08\0E\09\0D\05\0-\03\0F\0C\03\0-\04\0F\09\0D\0-\08\0\0\0\0\0\204\3\0\0z\7\0\0\314\4\0\0d\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0\360\0\0\0z\7\0\0\314\4\0\0d\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0{\7\0\0\314\4\0\0d\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0\354\0\0\0{\7\0\0\314\4\0\0d\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0|\7\0\0\314\4\0\0d\3\0\0\305\0\0\0\0\0\1\0\0\0\0\0\24\0\0\0\344\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0|\7\0\0\314\4\0\0d\3\0\0\305\0\0\0\1\0\1\0\2\1\0\0\0\0\0\0}\7\0\0\314\4\0\0d\3\0\0\25\0\0\0\0\0\1\0\0\0\0\0\24\0\0\0\3\0\37\0\377\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0}\7\0\0\314\4\0\0d\3\0\0\25\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0\354\0\0\0~\7\0\0\314\4\0\0d\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0T\0\0\0\0\0\0\2\0\0\0\0\30\0\0\0\340\0\0\0\320\360\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0$\0&\0PD\24\0\0\0\0\0N\0a\0m\0e\0S\0p\0a\0c\0e\0_\0C\0a\0t\0a\0l\0o\0g\05\0"}, 900, ) \4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\2\0\0\0\371\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\02\01\0B\08\0E\09\0D\05\0-\03\0F\0C\03\0-\04\0F\09\0D\0-\08\0\0\0\0\0\204\3\0\0z\7\0\0\314\4\0\0d\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0\360\0\0\0z\7\0\0\314\4\0\0d\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0{\7\0\0\314\4\0\0d\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0\354\0\0\0{\7\0\0\314\4\0\0d\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0|\7\0\0\314\4\0\0d\3\0\0\305\0\0\0\0\0\1\0\0\0\0\0\24\0\0\0\344\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0|\7\0\0\314\4\0\0d\3\0\0\305\0\0\0\1\0\1\0\2\1\0\0\0\0\0\0}\7\0\0\314\4\0\0d\3\0\0\25\0\0\0\0\0\1\0\0\0\0\0\24\0\0\0\3\0\37\0\377\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0}\7\0\0\314\4\0\0d\3\0\0\25\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0\354\0\0\0~\7\0\0\314\4\0\0d\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0T\0\0\0\0\0\0\2\0\0\0\0\30\0\0\0\340\0\0\0\320\360\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0$\0&\0PD\24\0\0\0\0\0N\0a\0m\0e\0S\0p\0a\0c\0e\0_\0C\0a\0t\0a\0l\0o\0g\05\0"}, 900, ) == 0x0
 01914   868   NtClose  (240, ... ) == 0x0
 01915   868   NtClose  (236, ... ) == 0x0
 01916   868   NtWaitForSingleObject  (228, 0, {0, 0}, ... ) == 0x102
 01917   868   NtCreateEvent  (0x1f0003, 0x0, 0, 0, ... 236, ) == 0x0
 01918   868   NtOpenKey  (0x2000000, {24, 224, 0x40, 0, 0,  (0x2000000, {24, 224, 0x40, 0, 0, "NameSpace_Catalog5"}, ... 240, ) }, ... 240, ) == 0x0
 01919   868   NtQueryValueKey  (240,  (240, "Serial_Access_Num", Partial, 144, ... TitleIdx=0, Type=4, Data="\5\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (240, "Serial_Access_Num", Partial, 144, ... TitleIdx=0, Type=4, Data="\5\0\0\0"}, 16, ) }, 16, ) == 0x0
 01920   868   NtNotifyChangeKey  (240, 236, 0, 0, 2011455960, 1, 0, 0, 0, 1, ... ) == 0x103
 01921   868   NtQueryValueKey  (240,  (240, "Serial_Access_Num", Partial, 144, ... TitleIdx=0, Type=4, Data="\5\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (240, "Serial_Access_Num", Partial, 144, ... TitleIdx=0, Type=4, Data="\5\0\0\0"}, 16, ) }, 16, ) == 0x0
 01922   868   NtOpenKey  (0x2000000, {24, 240, 0x40, 0, 0,  (0x2000000, {24, 240, 0x40, 0, 0, "00000005"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01923   868   NtQueryValueKey  (240,  (240, "Num_Catalog_Entries", Partial, 144, ... TitleIdx=0, Type=4, Data="\4\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (240, "Num_Catalog_Entries", Partial, 144, ... TitleIdx=0, Type=4, Data="\4\0\0\0"}, 16, ) }, 16, ) == 0x0
 01924   868   NtOpenKey  (0x2000000, {24, 240, 0x40, 0, 0,  (0x2000000, {24, 240, 0x40, 0, 0, "Catalog_Entries"}, ... 244, ) }, ... 244, ) == 0x0
 01925   868   NtOpenKey  (0x20019, {24, 244, 0x40, 0, 0,  (0x20019, {24, 244, 0x40, 0, 0, "000000000001"}, ... 248, ) }, ... 248, ) == 0x0
 01926   868   NtQueryValueKey  (248,  (248, "LibraryPath", Partial, 144, ... TitleIdx=0, Type=1, Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0m\0s\0w\0s\0o\0c\0k\0.\0d\0l\0l\0\0\0"}, 80, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (248, "LibraryPath", Partial, 144, ... TitleIdx=0, Type=1, Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0m\0s\0w\0s\0o\0c\0k\0.\0d\0l\0l\0\0\0"}, 80, ) }, 80, ) == 0x0
 01927   868   NtQueryValueKey  (248,  (248, "LibraryPath", Partial, 144, ... TitleIdx=0, Type=1, Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0m\0s\0w\0s\0o\0c\0k\0.\0d\0l\0l\0\0\0"}, 80, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (248, "LibraryPath", Partial, 144, ... TitleIdx=0, Type=1, Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0m\0s\0w\0s\0o\0c\0k\0.\0d\0l\0l\0\0\0"}, 80, ) }, 80, ) == 0x0
 01928   868   NtQueryValueKey  (248,  (248, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="T\0c\0p\0i\0p\0\0\0"}, 24, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (248, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="T\0c\0p\0i\0p\0\0\0"}, 24, ) }, 24, ) == 0x0
 01929   868   NtQueryValueKey  (248,  (248, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="T\0c\0p\0i\0p\0\0\0"}, 24, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (248, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="T\0c\0p\0i\0p\0\0\0"}, 24, ) }, 24, ) == 0x0
 01930   868   NtQueryValueKey  (248,  (248, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="T\0c\0p\0i\0p\0\0\0"}, 24, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (248, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="T\0c\0p\0i\0p\0\0\0"}, 24, ) }, 24, ) == 0x0
 01931   868   NtQueryValueKey  (248,  (248, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="T\0c\0p\0i\0p\0\0\0"}, 24, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (248, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="T\0c\0p\0i\0p\0\0\0"}, 24, ) }, 24, ) == 0x0
 01932   868   NtQueryValueKey  (248,  (248, "ProviderId", Partial, 144, ... TitleIdx=0, Type=3, Data="@\235\5"\236~\317\21\256Z\0\252\0\247\21+"}, 28, ) , Partial, 144, ... TitleIdx=0, Type=3, Data= (248, "ProviderId", Partial, 144, ... TitleIdx=0, Type=3, Data="@\235\5"\236~\317\21\256Z\0\252\0\247\21+"}, 28, ) \236~\317\21\256Z\0\252\0\247\21+"}, 28, ) == 0x0
 01933   868   NtQueryValueKey  (248,  (248, "AddressFamily", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01934   868   NtQueryValueKey  (248,  (248, "SupportedNameSpace", Partial, 144, ... TitleIdx=0, Type=4, Data="\14\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (248, "SupportedNameSpace", Partial, 144, ... TitleIdx=0, Type=4, Data="\14\0\0\0"}, 16, ) }, 16, ) == 0x0
 01935   868   NtQueryValueKey  (248,  (248, "Enabled", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (248, "Enabled", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) }, 16, ) == 0x0
 01936   868   NtQueryValueKey  (248,  (248, "Version", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (248, "Version", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) }, 16, ) == 0x0
 01937   868   NtQueryValueKey  (248,  (248, "StoresServiceClassInfo", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (248, "StoresServiceClassInfo", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) }, 16, ) == 0x0
 01938   868   NtClose  (248, ... ) == 0x0
 01939   868   NtAllocateVirtualMemory  (-1, 1380352, 0, 4096, 4096, 4, ... 1380352, 4096, ) == 0x0
 01940   868   NtOpenKey  (0x20019, {24, 244, 0x40, 0, 0,  (0x20019, {24, 244, 0x40, 0, 0, "000000000002"}, ... 248, ) }, ... 248, ) == 0x0
 01941   868   NtQueryValueKey  (248,  (248, "LibraryPath", Partial, 144, ... TitleIdx=0, Type=1, Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0w\0i\0n\0r\0n\0r\0.\0d\0l\0l\0\0\0"}, 78, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (248, "LibraryPath", Partial, 144, ... TitleIdx=0, Type=1, Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0w\0i\0n\0r\0n\0r\0.\0d\0l\0l\0\0\0"}, 78, ) }, 78, ) == 0x0
 01942   868   NtQueryValueKey  (248,  (248, "LibraryPath", Partial, 144, ... TitleIdx=0, Type=1, Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0w\0i\0n\0r\0n\0r\0.\0d\0l\0l\0\0\0"}, 78, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (248, "LibraryPath", Partial, 144, ... TitleIdx=0, Type=1, Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0w\0i\0n\0r\0n\0r\0.\0d\0l\0l\0\0\0"}, 78, ) }, 78, ) == 0x0
 01943   868   NtQueryValueKey  (248,  (248, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="N\0T\0D\0S\0\0\0"}, 22, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (248, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="N\0T\0D\0S\0\0\0"}, 22, ) }, 22, ) == 0x0
 01944   868   NtQueryValueKey  (248,  (248, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="N\0T\0D\0S\0\0\0"}, 22, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (248, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="N\0T\0D\0S\0\0\0"}, 22, ) }, 22, ) == 0x0
 01945   868   NtQueryValueKey  (248,  (248, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="N\0T\0D\0S\0\0\0"}, 22, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (248, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="N\0T\0D\0S\0\0\0"}, 22, ) }, 22, ) == 0x0
 01946   868   NtQueryValueKey  (248,  (248, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="N\0T\0D\0S\0\0\0"}, 22, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (248, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="N\0T\0D\0S\0\0\0"}, 22, ) }, 22, ) == 0x0
 01947   868   NtQueryValueKey  (248,  (248, "ProviderId", Partial, 144, ... TitleIdx=0, Type=3, Data="\3567&;\200\345\317\21\245U\0\300O\330\324\254"}, 28, ) , Partial, 144, ... TitleIdx=0, Type=3, Data= (248, "ProviderId", Partial, 144, ... TitleIdx=0, Type=3, Data="\3567&;\200\345\317\21\245U\0\300O\330\324\254"}, 28, ) }, 28, ) == 0x0
 01948   868   NtQueryValueKey  (248,  (248, "AddressFamily", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01949   868   NtQueryValueKey  (248,  (248, "SupportedNameSpace", Partial, 144, ... TitleIdx=0, Type=4, Data=" \0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (248, "SupportedNameSpace", Partial, 144, ... TitleIdx=0, Type=4, Data=" \0\0\0"}, 16, ) }, 16, ) == 0x0
 01950   868   NtQueryValueKey  (248,  (248, "Enabled", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (248, "Enabled", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) }, 16, ) == 0x0
 01951   868   NtQueryValueKey  (248,  (248, "Version", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (248, "Version", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) }, 16, ) == 0x0
 01952   868   NtQueryValueKey  (248,  (248, "StoresServiceClassInfo", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (248, "StoresServiceClassInfo", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) }, 16, ) == 0x0
 01953   868   NtClose  (248, ... ) == 0x0
 01954   868   NtOpenKey  (0x20019, {24, 244, 0x40, 0, 0,  (0x20019, {24, 244, 0x40, 0, 0, "000000000003"}, ... 248, ) }, ... 248, ) == 0x0
 01955   868   NtQueryValueKey  (248,  (248, "LibraryPath", Partial, 144, ... TitleIdx=0, Type=1, Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0m\0s\0w\0s\0o\0c\0k\0.\0d\0l\0l\0\0\0"}, 80, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (248, "LibraryPath", Partial, 144, ... TitleIdx=0, Type=1, Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0m\0s\0w\0s\0o\0c\0k\0.\0d\0l\0l\0\0\0"}, 80, ) }, 80, ) == 0x0
 01956   868   NtQueryValueKey  (248,  (248, "LibraryPath", Partial, 144, ... TitleIdx=0, Type=1, Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0m\0s\0w\0s\0o\0c\0k\0.\0d\0l\0l\0\0\0"}, 80, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (248, "LibraryPath", Partial, 144, ... TitleIdx=0, Type=1, Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0m\0s\0w\0s\0o\0c\0k\0.\0d\0l\0l\0\0\0"}, 80, ) }, 80, ) == 0x0
 01957   868   NtQueryValueKey  (248,  (248, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="N\0e\0t\0w\0o\0r\0k\0 \0L\0o\0c\0a\0t\0i\0o\0n\0 \0A\0w\0a\0r\0e\0n\0e\0s\0s\0 \0(\0N\0L\0A\0)\0 \0N\0a\0m\0e\0s\0p\0a\0c\0e\0\0\0"}, 98, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (248, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="N\0e\0t\0w\0o\0r\0k\0 \0L\0o\0c\0a\0t\0i\0o\0n\0 \0A\0w\0a\0r\0e\0n\0e\0s\0s\0 \0(\0N\0L\0A\0)\0 \0N\0a\0m\0e\0s\0p\0a\0c\0e\0\0\0"}, 98, ) }, 98, ) == 0x0
 01958   868   NtQueryValueKey  (248,  (248, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="N\0e\0t\0w\0o\0r\0k\0 \0L\0o\0c\0a\0t\0i\0o\0n\0 \0A\0w\0a\0r\0e\0n\0e\0s\0s\0 \0(\0N\0L\0A\0)\0 \0N\0a\0m\0e\0s\0p\0a\0c\0e\0\0\0"}, 98, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (248, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="N\0e\0t\0w\0o\0r\0k\0 \0L\0o\0c\0a\0t\0i\0o\0n\0 \0A\0w\0a\0r\0e\0n\0e\0s\0s\0 \0(\0N\0L\0A\0)\0 \0N\0a\0m\0e\0s\0p\0a\0c\0e\0\0\0"}, 98, ) }, 98, ) == 0x0
 01959   868   NtQueryValueKey  (248,  (248, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="N\0e\0t\0w\0o\0r\0k\0 \0L\0o\0c\0a\0t\0i\0o\0n\0 \0A\0w\0a\0r\0e\0n\0e\0s\0s\0 \0(\0N\0L\0A\0)\0 \0N\0a\0m\0e\0s\0p\0a\0c\0e\0\0\0"}, 98, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (248, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="N\0e\0t\0w\0o\0r\0k\0 \0L\0o\0c\0a\0t\0i\0o\0n\0 \0A\0w\0a\0r\0e\0n\0e\0s\0s\0 \0(\0N\0L\0A\0)\0 \0N\0a\0m\0e\0s\0p\0a\0c\0e\0\0\0"}, 98, ) }, 98, ) == 0x0
 01960   868   NtQueryValueKey  (248,  (248, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="N\0e\0t\0w\0o\0r\0k\0 \0L\0o\0c\0a\0t\0i\0o\0n\0 \0A\0w\0a\0r\0e\0n\0e\0s\0s\0 \0(\0N\0L\0A\0)\0 \0N\0a\0m\0e\0s\0p\0a\0c\0e\0\0\0"}, 98, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (248, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="N\0e\0t\0w\0o\0r\0k\0 \0L\0o\0c\0a\0t\0i\0o\0n\0 \0A\0w\0a\0r\0e\0n\0e\0s\0s\0 \0(\0N\0L\0A\0)\0 \0N\0a\0m\0e\0s\0p\0a\0c\0e\0\0\0"}, 98, ) }, 98, ) == 0x0
 01961   868   NtQueryValueKey  (248,  (248, "ProviderId", Partial, 144, ... TitleIdx=0, Type=3, Data=":$Bf\250;\246J\272\245.\13\327\37\335\203"}, 28, ) , Partial, 144, ... TitleIdx=0, Type=3, Data= (248, "ProviderId", Partial, 144, ... TitleIdx=0, Type=3, Data=":$Bf\250;\246J\272\245.\13\327\37\335\203"}, 28, ) }, 28, ) == 0x0
 01962   868   NtQueryValueKey  (248,  (248, "AddressFamily", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01963   868   NtQueryValueKey  (248,  (248, "SupportedNameSpace", Partial, 144, ... TitleIdx=0, Type=4, Data="\17\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (248, "SupportedNameSpace", Partial, 144, ... TitleIdx=0, Type=4, Data="\17\0\0\0"}, 16, ) }, 16, ) == 0x0
 01964   868   NtQueryValueKey  (248,  (248, "Enabled", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (248, "Enabled", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) }, 16, ) == 0x0
 01965   868   NtQueryValueKey  (248,  (248, "Version", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (248, "Version", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) }, 16, ) == 0x0
 01966   868   NtQueryValueKey  (248,  (248, "StoresServiceClassInfo", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (248, "StoresServiceClassInfo", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) }, 16, ) == 0x0
 01967   868   NtClose  (248, ... ) == 0x0
 01968   868   NtOpenKey  (0x20019, {24, 244, 0x40, 0, 0,  (0x20019, {24, 244, 0x40, 0, 0, "000000000004"}, ... 248, ) }, ... 248, ) == 0x0
 01969   868   NtQueryValueKey  (248,  (248, "LibraryPath", Partial, 144, ... TitleIdx=0, Type=1, Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0s\0y\0s\0t\0e\0m\03\02\0\\0w\0s\0h\0b\0t\0h\0.\0d\0l\0l\0\0\0"}, 78, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (248, "LibraryPath", Partial, 144, ... TitleIdx=0, Type=1, Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0s\0y\0s\0t\0e\0m\03\02\0\\0w\0s\0h\0b\0t\0h\0.\0d\0l\0l\0\0\0"}, 78, ) }, 78, ) == 0x0
 01970   868   NtQueryValueKey  (248,  (248, "LibraryPath", Partial, 144, ... TitleIdx=0, Type=1, Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0s\0y\0s\0t\0e\0m\03\02\0\\0w\0s\0h\0b\0t\0h\0.\0d\0l\0l\0\0\0"}, 78, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (248, "LibraryPath", Partial, 144, ... TitleIdx=0, Type=1, Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0s\0y\0s\0t\0e\0m\03\02\0\\0w\0s\0h\0b\0t\0h\0.\0d\0l\0l\0\0\0"}, 78, ) }, 78, ) == 0x0
 01971   868   NtQueryValueKey  (248,  (248, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="B\0l\0u\0e\0t\0o\0o\0t\0h\0 \0N\0a\0m\0e\0s\0p\0a\0c\0e\0\0\0"}, 52, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (248, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="B\0l\0u\0e\0t\0o\0o\0t\0h\0 \0N\0a\0m\0e\0s\0p\0a\0c\0e\0\0\0"}, 52, ) }, 52, ) == 0x0
 01972   868   NtQueryValueKey  (248,  (248, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="B\0l\0u\0e\0t\0o\0o\0t\0h\0 \0N\0a\0m\0e\0s\0p\0a\0c\0e\0\0\0"}, 52, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (248, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="B\0l\0u\0e\0t\0o\0o\0t\0h\0 \0N\0a\0m\0e\0s\0p\0a\0c\0e\0\0\0"}, 52, ) }, 52, ) == 0x0
 01973   868   NtQueryValueKey  (248,  (248, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="B\0l\0u\0e\0t\0o\0o\0t\0h\0 \0N\0a\0m\0e\0s\0p\0a\0c\0e\0\0\0"}, 52, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (248, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="B\0l\0u\0e\0t\0o\0o\0t\0h\0 \0N\0a\0m\0e\0s\0p\0a\0c\0e\0\0\0"}, 52, ) }, 52, ) == 0x0
 01974   868   NtQueryValueKey  (248,  (248, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="B\0l\0u\0e\0t\0o\0o\0t\0h\0 \0N\0a\0m\0e\0s\0p\0a\0c\0e\0\0\0"}, 52, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (248, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="B\0l\0u\0e\0t\0o\0o\0t\0h\0 \0N\0a\0m\0e\0s\0p\0a\0c\0e\0\0\0"}, 52, ) }, 52, ) == 0x0
 01975   868   NtQueryValueKey  (248,  (248, "ProviderId", Partial, 144, ... TitleIdx=0, Type=3, Data="\340c\252\6`}\377A\257\262>\346\322\3319-"}, 28, ) , Partial, 144, ... TitleIdx=0, Type=3, Data= (248, "ProviderId", Partial, 144, ... TitleIdx=0, Type=3, Data="\340c\252\6`}\377A\257\262>\346\322\3319-"}, 28, ) }, 28, ) == 0x0
 01976   868   NtQueryValueKey  (248,  (248, "AddressFamily", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01977   868   NtQueryValueKey  (248,  (248, "SupportedNameSpace", Partial, 144, ... TitleIdx=0, Type=4, Data="\20\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (248, "SupportedNameSpace", Partial, 144, ... TitleIdx=0, Type=4, Data="\20\0\0\0"}, 16, ) }, 16, ) == 0x0
 01978   868   NtQueryValueKey  (248,  (248, "Enabled", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (248, "Enabled", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) }, 16, ) == 0x0
 01979   868   NtQueryValueKey  (248,  (248, "Version", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (248, "Version", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) }, 16, ) == 0x0
 01980   868   NtQueryValueKey  (248,  (248, "StoresServiceClassInfo", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (248, "StoresServiceClassInfo", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) }, 16, ) == 0x0
 01981   868   NtClose  (248, ... ) == 0x0
 01982   868   NtClose  (244, ... ) == 0x0
 01983   868   NtWaitForSingleObject  (236, 0, {0, 0}, ... ) == 0x102
 01984   868   NtClose  (224, ... ) == 0x0
 01985   868   NtQuerySystemInformation  (Basic, 44, ... {Unknown=0,MaximumIncrement=156250,PhysicalPageSize=0x1000,NumberOfPhysicalPages=0xff7c,LowestPhysicalPage=0x1,HighestPhysicalPage=0xffff,AllocationGranularity=0x10000,LowestUserAddress=0x10000,HighestUserAddress=0x7ffeffff,ActiveProcessors=1,NumberProcessors=1,}, 0x0, ) == 0x0
 01986   868   NtQuerySystemInformation  (Processor, 12, ... {system info, class 1, size 12}, 0x0, ) == 0x0
 01987   868   NtOpenKey  (0x1, {24, 36, 0x40, 0, 0,  (0x1, {24, 36, 0x40, 0, 0, "System\CurrentControlSet\Services\Winsock2\Parameters"}, ... 224, ) }, ... 224, ) == 0x0
 01988   868   NtQueryValueKey  (224,  (224, "Ws2_32NumHandleBuckets", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01989   868   NtClose  (224, ... ) == 0x0
 01990   868   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ... 224, ) == 0x0
 01991   868   NtCreateEvent  (0x1f0003, 0x0, 1, 1, ... 244, ) == 0x0
 01992   868   NtQueryValueKey  (92,  (92, "GlobalUserOffline", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (92, "GlobalUserOffline", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) }, 16, ) == 0x0
 01993   868   NtWaitForSingleObject  (176, 0, 0x0, ... ) == 0x0
 01994   868   NtReleaseMutant  (176, ... 0x0, ) == 0x0
 01995   868   NtOpenMutant  (0x100000, {24, 16, 0x0, 0, 0,  (0x100000, {24, 16, 0x0, 0, 0, "Local\WininetConnectionMutex"}, ... 248, ) }, ... 248, ) == 0x0
 01996   868   NtOpenMutant  (0x100000, {24, 16, 0x0, 0, 0,  (0x100000, {24, 16, 0x0, 0, 0, "Local\WininetProxyRegistryMutex"}, ... 252, ) }, ... 252, ) == 0x0
 01997   868   NtCreateEvent  (0x1f0003, 0x0, 0, 1, ... 256, ) == 0x0
 01998   868   NtQueryValueKey  (92,  (92, "EnableAutodial", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (92, "EnableAutodial", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) }, 16, ) == 0x0
 01999   868   NtQueryValueKey  (92,  (92, "NoNetAutodial", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (92, "NoNetAutodial", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) }, 16, ) == 0x0
 02000   868   NtCreateEvent  (0x1f0003, 0x0, 1, 0, ... 260, ) == 0x0
 02001   868   NtOpenKey  (0x1, {24, 36, 0x40, 0, 0,  (0x1, {24, 36, 0x40, 0, 0, "SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings"}, ... 264, ) }, ... 264, ) == 0x0
 02002   868   NtQueryValueKey  (264,  (264, "UrlEncoding", Partial, 144, ... TitleIdx=0, Type=1, Data="0\0x\00\00\00\00\00\00\00\00\0\0\0"}, 34, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (264, "UrlEncoding", Partial, 144, ... TitleIdx=0, Type=1, Data="0\0x\00\00\00\00\00\00\00\00\0\0\0"}, 34, ) }, 34, ) == 0x0
 02003   868   NtQueryValueKey  (264,  (264, "UrlEncoding", Partial, 144, ... TitleIdx=0, Type=1, Data="0\0x\00\00\00\00\00\00\00\00\0\0\0"}, 34, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (264, "UrlEncoding", Partial, 144, ... TitleIdx=0, Type=1, Data="0\0x\00\00\00\00\00\00\00\00\0\0\0"}, 34, ) }, 34, ) == 0x0
 02004   868   NtClose  (264, ... ) == 0x0
 02005   868   NtQueryValueKey  (92,  (92, "TruncateFileName", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02006   868   NtAllocateVirtualMemory  (-1, 1384448, 0, 4096, 4096, 4, ... 1384448, 4096, ) == 0x0
 02007   868   NtQueryValueKey  (92,  (92, "BadProxyExpiresTime", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02008   868   NtCreateEvent  (0x1f0003, 0x0, 1, 1, ... 264, ) == 0x0
 02009   868   NtWaitForSingleObject  (264, 0, 0x0, ... ) == 0x0
 02010   868   NtClearEvent  (264, ... ) == 0x0
 02011   868   NtSetEvent  (264, ... 0x0, ) == 0x0
 02012   868   NtClearEvent  (244, ... ) == 0x0
 02013   868   NtSetEvent  (244, ... 0x0, ) == 0x0
 02014   868   NtOpenSection  (0xe, {24, 8, 0x40, 0, 0,  (0xe, {24, 8, 0x40, 0, 0, "icmp.dll"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02015   868   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\u:\work\icmp.dll"}, 1240240, ... ) }, 1240240, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02016   868   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\icmp.dll"}, 1240240, ... ) }, 1240240, ... ) == 0x0
 02017   868   NtOpenFile  (0x100020, {24, 0, 0x40, 0, 0,  (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\icmp.dll"}, 5, 96, ... 268, {status=0x0, info=1}, ) }, 5, 96, ... 268, {status=0x0, info=1}, ) == 0x0
 02018   868   NtCreateSection  (0xf, 0x0, 0x0, 16, 16777216, 268, ... 272, ) == 0x0
 02019   868   NtQuerySection  (272, Image, 48, ... {section info, class 1, size 48}, 0x0, ) == 0x0
 02020   868   NtClose  (268, ... ) == 0x0
 02021   868   NtMapViewOfSection  (272, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x74290000), 0x0, 16384, ) == 0x0
 02022   868   NtClose  (272, ... ) == 0x0
 02023   868   NtOpenSection  (0xe, {24, 8, 0x40, 0, 0,  (0xe, {24, 8, 0x40, 0, 0, "iphlpapi.dll"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02024   868   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\u:\work\iphlpapi.dll"}, 1240712, ... ) }, 1240712, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02025   868   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\iphlpapi.dll"}, 1240712, ... ) }, 1240712, ... ) == 0x0
 02026   868   NtOpenFile  (0x100020, {24, 0, 0x40, 0, 0,  (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\iphlpapi.dll"}, 5, 96, ... 272, {status=0x0, info=1}, ) }, 5, 96, ... 272, {status=0x0, info=1}, ) == 0x0
 02027   868   NtCreateSection  (0xf, 0x0, 0x0, 16, 16777216, 272, ... 268, ) == 0x0
 02028   868   NtQuerySection  (268, Image, 48, ... {section info, class 1, size 48}, 0x0, ) == 0x0
 02029   868   NtClose  (272, ... ) == 0x0
 02030   868   NtMapViewOfSection  (268, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x76d60000), 0x0, 102400, ) == 0x0
 02031   868   NtClose  (268, ... ) == 0x0
 02032   868   NtProtectVirtualMemory  (-1, (0x76d61000), 500, 4, ... (0x76d61000), 4096, 32, ) == 0x0
 02033   868   NtProtectVirtualMemory  (-1, (0x76d61000), 4096, 32, ... (0x76d61000), 4096, 4, ) == 0x0
 02034   868   NtFlushInstructionCache  (-1, 1993740288, 500, ... ) == 0x0
 02035   868   NtProtectVirtualMemory  (-1, (0x76d61000), 500, 4, ... (0x76d61000), 4096, 32, ) == 0x0
 02036   868   NtProtectVirtualMemory  (-1, (0x76d61000), 4096, 32, ... (0x76d61000), 4096, 4, ) == 0x0
 02037   868   NtFlushInstructionCache  (-1, 1993740288, 500, ... ) == 0x0
 02038   868   NtProtectVirtualMemory  (-1, (0x76d61000), 500, 4, ... (0x76d61000), 4096, 32, ) == 0x0
 02039   868   NtProtectVirtualMemory  (-1, (0x76d61000), 4096, 32, ... (0x76d61000), 4096, 4, ) == 0x0
 02040   868   NtFlushInstructionCache  (-1, 1993740288, 500, ... ) == 0x0
 02041   868   NtProtectVirtualMemory  (-1, (0x76d61000), 500, 4, ... (0x76d61000), 4096, 32, ) == 0x0
 02042   868   NtProtectVirtualMemory  (-1, (0x76d61000), 4096, 32, ... (0x76d61000), 4096, 4, ) == 0x0
 02043   868   NtFlushInstructionCache  (-1, 1993740288, 500, ... ) == 0x0
 02044   868   NtProtectVirtualMemory  (-1, (0x76d61000), 500, 4, ... (0x76d61000), 4096, 32, ) == 0x0
 02045   868   NtProtectVirtualMemory  (-1, (0x76d61000), 4096, 32, ... (0x76d61000), 4096, 4, ) == 0x0
 02046   868   NtFlushInstructionCache  (-1, 1993740288, 500, ... ) == 0x0
 02047   868   NtProtectVirtualMemory  (-1, (0x76d61000), 500, 4, ... (0x76d61000), 4096, 32, ) == 0x0
 02048   868   NtProtectVirtualMemory  (-1, (0x76d61000), 4096, 32, ... (0x76d61000), 4096, 4, ) == 0x0
 02049   868   NtFlushInstructionCache  (-1, 1993740288, 500, ... ) == 0x0
 02050   868   NtOpenKey  (0x80000000, {24, 0, 0x40, 0, 0,  (0x80000000, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\iphlpapi.dll"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02051   868   NtQuerySystemInformation  (Basic, 44, ... {Unknown=0,MaximumIncrement=156250,PhysicalPageSize=0x1000,NumberOfPhysicalPages=0xff7c,LowestPhysicalPage=0x1,HighestPhysicalPage=0xffff,AllocationGranularity=0x10000,LowestUserAddress=0x10000,HighestUserAddress=0x7ffeffff,ActiveProcessors=1,NumberProcessors=1,}, 0x0, ) == 0x0
 02052   868   NtAllocateVirtualMemory  (-1, 0, 0, 65536, 8192, 4, ... 4128768, 65536, ) == 0x0
 02053   868   NtAllocateVirtualMemory  (-1, 4128768, 0, 4096, 4096, 4, ... 4128768, 4096, ) == 0x0
 02054   868   NtAllocateVirtualMemory  (-1, 4132864, 0, 8192, 4096, 4, ... 4132864, 8192, ) == 0x0
 02055   868   NtCreateFile  (0x20000000, {24, 0, 0x40, 0, 0,  (0x20000000, {24, 0, 0x40, 0, 0, "\Device\Tcp"}, 0x0, 128, 3, 3, 0, 0, 0, ... 268, {status=0x0, info=0}, ) }, 0x0, 128, 3, 3, 0, 0, 0, ... 268, {status=0x0, info=0}, ) == 0x0
 02056   868   NtCreateFile  (0x40000000, {24, 0, 0x40, 0, 0,  (0x40000000, {24, 0, 0x40, 0, 0, "\Device\Tcp"}, 0x0, 128, 3, 3, 0, 0, 0, ... 272, {status=0x0, info=0}, ) }, 0x0, 128, 3, 3, 0, 0, 0, ... 272, {status=0x0, info=0}, ) == 0x0
 02057   868   NtCreateFile  (0x20000000, {24, 0, 0x40, 0, 0,  (0x20000000, {24, 0, 0x40, 0, 0, "\Device\Ip"}, 0x0, 128, 3, 3, 0, 0, 0, ... 276, {status=0x0, info=0}, ) }, 0x0, 128, 3, 3, 0, 0, 0, ... 276, {status=0x0, info=0}, ) == 0x0
 02058   868   NtCreateFile  (0x100003, {24, 0, 0x40, 0, 0,  (0x100003, {24, 0, 0x40, 0, 0, "\Device\Ip"}, 0x0, 128, 3, 3, 0, 0, 0, ... 280, {status=0x0, info=0}, ) }, 0x0, 128, 3, 3, 0, 0, 0, ... 280, {status=0x0, info=0}, ) == 0x0
 02059   868   NtCreateFile  (0x20100080, {24, 0, 0x40, 0, 1241436,  (0x20100080, {24, 0, 0x40, 0, 1241436, "\??\Ip"}, 0x0, 128, 3, 1, 64, 0, 0, ... 284, {status=0x0, info=0}, ) }, 0x0, 128, 3, 1, 64, 0, 0, ... 284, {status=0x0, info=0}, ) == 0x0
 02060   868   NtAllocateVirtualMemory  (-1, 4141056, 0, 36864, 4096, 4, ... 4141056, 36864, ) == 0x0
 02061   868   NtCreateEvent  (0x1f0003, 0x0, 0, 0, ... 288, ) == 0x0
 02062   868   NtDeviceIoControlFile  (268, 288, 0x0, 0x0, 0x120003,  (268, 288, 0x0, 0x0, 0x120003, "\0\0\0\0\0\0\0\0\0\1\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0", 36, 32768, ... {status=0x0, info=56}, "\0\4\0\0\0\0\0\0\1\4\0\0\0\0\0\0\1\3\0\0\0\0\0\0\200\3\0\0\0\0\0\0\0\2\0\0\0\0\0\0\200\2\0\0\0\0\0\0\0\2\0\0\1\0\0\0", ) , 36, 32768, ... {status=0x0, info=56},  (268, 288, 0x0, 0x0, 0x120003, "\0\0\0\0\0\0\0\0\0\1\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0", 36, 32768, ... {status=0x0, info=56}, "\0\4\0\0\0\0\0\0\1\4\0\0\0\0\0\0\1\3\0\0\0\0\0\0\200\3\0\0\0\0\0\0\0\2\0\0\0\0\0\0\200\2\0\0\0\0\0\0\0\2\0\0\1\0\0\0", ) , ) == 0x0
 02063   868   NtClose  (288, ... ) == 0x0
 02064   868   NtCreateEvent  (0x1f0003, 0x0, 0, 0, ... 288, ) == 0x0
 02065   868   NtDeviceIoControlFile  (268, 288, 0x0, 0x0, 0x120003,  (268, 288, 0x0, 0x0, 0x120003, "\0\2\0\0\0\0\0\0\0\2\0\0\0\1\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0", 36, 348, ... {status=0x0, info=118}, "\1\0\0\0\30\0\0\0\360\5\0\0\200\226\230\0\0\0\0\0\0\0\0\0\0\0\0\0\1\0\0\0\5\0\0\0\365@\250\25(\5\0\0\13\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0(\5\0\0\13\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\32\0\0\0MS TCP Loopback interface\0", ) , 36, 348, ... {status=0x0, info=118},  (268, 288, 0x0, 0x0, 0x120003, "\0\2\0\0\0\0\0\0\0\2\0\0\0\1\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0", 36, 348, ... {status=0x0, info=118}, "\1\0\0\0\30\0\0\0\360\5\0\0\200\226\230\0\0\0\0\0\0\0\0\0\0\0\0\0\1\0\0\0\5\0\0\0\365@\250\25(\5\0\0\13\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0(\5\0\0\13\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\32\0\0\0MS TCP Loopback interface\0", ) , ) == 0x0
 02066   868   NtClose  (288, ... ) == 0x0
 02067   868   NtCreateEvent  (0x1f0003, 0x0, 0, 0, ... 288, ) == 0x0
 02068   868   NtDeviceIoControlFile  (268, 288, 0x0, 0x0, 0x120003,  (268, 288, 0x0, 0x0, 0x120003, "\0\2\0\0\1\0\0\0\0\2\0\0\0\1\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0", 36, 348, ... {status=0x0, info=158}, "\3\0\1\0\6\0\0\0\334\5\0\0\0\312\232;\6\0\0\0\0\14)\271\233\363o\201\1\0\0\0\5\0\0\0\232A\250\25\11\35@\3\34\275\0\0\362\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\27\230&\0\310B\0\0}\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0B\0\0\0AMD PCNET Family PCI Ethernet Adapter - Packet Scheduler Miniport\0", ) , 36, 348, ... {status=0x0, info=158},  (268, 288, 0x0, 0x0, 0x120003, "\0\2\0\0\1\0\0\0\0\2\0\0\0\1\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0", 36, 348, ... {status=0x0, info=158}, "\3\0\1\0\6\0\0\0\334\5\0\0\0\312\232;\6\0\0\0\0\14)\271\233\363o\201\1\0\0\0\5\0\0\0\232A\250\25\11\35@\3\34\275\0\0\362\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\27\230&\0\310B\0\0}\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0B\0\0\0AMD PCNET Family PCI Ethernet Adapter - Packet Scheduler Miniport\0", ) , ) == 0x0
 02069   868   NtClose  (288, ... ) == 0x0
 02070   868   NtCreateEvent  (0x1f0003, 0x0, 0, 0, ... 288, ) == 0x0
 02071   868   NtDeviceIoControlFile  (268, 288, 0x0, 0x0, 0x120003,  (268, 288, 0x0, 0x0, 0x120003, "\0\0\0\0\0\0\0\0\0\1\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0", 36, 32768, ... {status=0x0, info=56}, "\0\4\0\0\0\0\0\0\1\4\0\0\0\0\0\0\1\3\0\0\0\0\0\0\200\3\0\0\0\0\0\0\0\2\0\0\0\0\0\0\200\2\0\0\0\0\0\0\0\2\0\0\1\0\0\0", ) , 36, 32768, ... {status=0x0, info=56},  (268, 288, 0x0, 0x0, 0x120003, "\0\0\0\0\0\0\0\0\0\1\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0", 36, 32768, ... {status=0x0, info=56}, "\0\4\0\0\0\0\0\0\1\4\0\0\0\0\0\0\1\3\0\0\0\0\0\0\200\3\0\0\0\0\0\0\0\2\0\0\0\0\0\0\200\2\0\0\0\0\0\0\0\2\0\0\1\0\0\0", ) , ) == 0x0
 02072   868   NtClose  (288, ... ) == 0x0
 02073   868   NtCreateEvent  (0x1f0003, 0x0, 0, 0, ... 288, ) == 0x0
 02074   868   NtDeviceIoControlFile  (268, 288, 0x0, 0x0, 0x120003,  (268, 288, 0x0, 0x0, 0x120003, "\200\2\0\0\0\0\0\0\0\1\0\0\0\1\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0", 36, 4, ... {status=0x0, info=4}, "\200\2\0\0", ) , 36, 4, ... {status=0x0, info=4},  (268, 288, 0x0, 0x0, 0x120003, "\200\2\0\0\0\0\0\0\0\1\0\0\0\1\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0", 36, 4, ... {status=0x0, info=4}, "\200\2\0\0", ) , ) == 0x0
 02075   868   NtClose  (288, ... ) == 0x0
 02076   868   NtCreateEvent  (0x1f0003, 0x0, 0, 0, ... 288, ) == 0x0
 02077   868   NtDeviceIoControlFile  (268, 288, 0x0, 0x0, 0x120003,  (268, 288, 0x0, 0x0, 0x120003, "\200\2\0\0\0\0\0\0\0\2\0\0\0\1\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0", 36, 8, ... {status=0x0, info=8}, "\1\0\0\0\3\0\1\0", ) , 36, 8, ... {status=0x0, info=8},  (268, 288, 0x0, 0x0, 0x120003, "\200\2\0\0\0\0\0\0\0\2\0\0\0\1\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0", 36, 8, ... {status=0x0, info=8}, "\1\0\0\0\3\0\1\0", ) , ) == 0x0
 02078   868   NtClose  (288, ... ) == 0x0
 02079   868   NtCreateSemaphore  (0x100003, 0x0, 0, 2147483647, ... 288, ) == 0x0
 02080   868   NtCreateSemaphore  (0x100003, 0x0, 0, 2147483647, ... 292, ) == 0x0
 02081   868   NtAllocateVirtualMemory  (-1, 0, 0, 65536, 8192, 4, ... 29753344, 65536, ) == 0x0
 02082   868   NtQueryVirtualMemory  (-1, 0x1c60000, Basic, 28, ... {BaseAddress=0x1c60000,AllocationBase=0x1c60000,AllocationProtect=0x4,RegionSize=0x10000,State=0x2000,Protect=0x0,Type=0x20000,}, 28, ) == 0x0
 02083   868   NtAllocateVirtualMemory  (-1, 29753344, 0, 1, 4096, 4, ... 29753344, 4096, ) == 0x0
 02084   868   NtQueryVirtualMemory  (-1, 0x1c60000, Basic, 28, ... {BaseAddress=0x1c60000,AllocationBase=0x1c60000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 28, ) == 0x0
 02085   868   NtFreeVirtualMemory  (-1, (0x1c60000), 0, 32768, ... (0x1c60000), 65536, ) == 0x0
 02086   868   NtAllocateVirtualMemory  (-1, 0, 0, 65536, 8192, 4, ... 29753344, 65536, ) == 0x0
 02087   868   NtQueryVirtualMemory  (-1, 0x1c60000, Basic, 28, ... {BaseAddress=0x1c60000,AllocationBase=0x1c60000,AllocationProtect=0x4,RegionSize=0x10000,State=0x2000,Protect=0x0,Type=0x20000,}, 28, ) == 0x0
 02088   868   NtAllocateVirtualMemory  (-1, 29753344, 0, 1, 4096, 4, ... 29753344, 4096, ) == 0x0
 02089   868   NtQueryVirtualMemory  (-1, 0x1c60000, Basic, 28, ... {BaseAddress=0x1c60000,AllocationBase=0x1c60000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 28, ) == 0x0
 02090   868   NtFreeVirtualMemory  (-1, (0x1c60000), 0, 32768, ... (0x1c60000), 65536, ) == 0x0
 02091   868   NtAllocateVirtualMemory  (-1, 0, 0, 65536, 8192, 4, ... 29753344, 65536, ) == 0x0
 02092   868   NtQueryVirtualMemory  (-1, 0x1c60000, Basic, 28, ... {BaseAddress=0x1c60000,AllocationBase=0x1c60000,AllocationProtect=0x4,RegionSize=0x10000,State=0x2000,Protect=0x0,Type=0x20000,}, 28, ) == 0x0
 02093   868   NtAllocateVirtualMemory  (-1, 29753344, 0, 1, 4096, 4, ... 29753344, 4096, ) == 0x0
 02094   868   NtQueryVirtualMemory  (-1, 0x1c60000, Basic, 28, ... {BaseAddress=0x1c60000,AllocationBase=0x1c60000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 28, ) == 0x0
 02095   868   NtFreeVirtualMemory  (-1, (0x1c60000), 0, 32768, ... (0x1c60000), 65536, ) == 0x0
 02096   868   NtAllocateVirtualMemory  (-1, 0, 0, 65536, 8192, 4, ... 29753344, 65536, ) == 0x0
 02097   868   NtQueryVirtualMemory  (-1, 0x1c60000, Basic, 28, ... {BaseAddress=0x1c60000,AllocationBase=0x1c60000,AllocationProtect=0x4,RegionSize=0x10000,State=0x2000,Protect=0x0,Type=0x20000,}, 28, ) == 0x0
 02098   868   NtAllocateVirtualMemory  (-1, 29753344, 0, 1, 4096, 4, ... 29753344, 4096, ) == 0x0
 02099   868   NtQueryVirtualMemory  (-1, 0x1c60000, Basic, 28, ... {BaseAddress=0x1c60000,AllocationBase=0x1c60000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 28, ) == 0x0
 02100   868   NtFreeVirtualMemory  (-1, (0x1c60000), 0, 32768, ... (0x1c60000), 65536, ) == 0x0
 02101   868   NtAllocateVirtualMemory  (-1, 0, 0, 65536, 8192, 4, ... 29753344, 65536, ) == 0x0
 02102   868   NtQueryVirtualMemory  (-1, 0x1c60000, Basic, 28, ... {BaseAddress=0x1c60000,AllocationBase=0x1c60000,AllocationProtect=0x4,RegionSize=0x10000,State=0x2000,Protect=0x0,Type=0x20000,}, 28, ) == 0x0
 02103   868   NtAllocateVirtualMemory  (-1, 29753344, 0, 1, 4096, 4, ... 29753344, 4096, ) == 0x0
 02104   868   NtQueryVirtualMemory  (-1, 0x1c60000, Basic, 28, ... {BaseAddress=0x1c60000,AllocationBase=0x1c60000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 28, ) == 0x0
 02105   868   NtFreeVirtualMemory  (-1, (0x1c60000), 0, 32768, ... (0x1c60000), 65536, ) == 0x0
 02106   868   NtAllocateVirtualMemory  (-1, 0, 0, 65536, 8192, 4, ... 29753344, 65536, ) == 0x0
 02107   868   NtQueryVirtualMemory  (-1, 0x1c60000, Basic, 28, ... {BaseAddress=0x1c60000,AllocationBase=0x1c60000,AllocationProtect=0x4,RegionSize=0x10000,State=0x2000,Protect=0x0,Type=0x20000,}, 28, ) == 0x0
 02108   868   NtAllocateVirtualMemory  (-1, 29753344, 0, 1, 4096, 4, ... 29753344, 4096, ) == 0x0
 02109   868   NtQueryVirtualMemory  (-1, 0x1c60000, Basic, 28, ... {BaseAddress=0x1c60000,AllocationBase=0x1c60000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 28, ) == 0x0
 02110   868   NtFreeVirtualMemory  (-1, (0x1c60000), 0, 32768, ... (0x1c60000), 65536, ) == 0x0
 02111   868   NtAllocateVirtualMemory  (-1, 0, 0, 65536, 8192, 4, ... 29753344, 65536, ) == 0x0
 02112   868   NtQueryVirtualMemory  (-1, 0x1c60000, Basic, 28, ... {BaseAddress=0x1c60000,AllocationBase=0x1c60000,AllocationProtect=0x4,RegionSize=0x10000,State=0x2000,Protect=0x0,Type=0x20000,}, 28, ) == 0x0
 02113   868   NtAllocateVirtualMemory  (-1, 29753344, 0, 1, 4096, 4, ... 29753344, 4096, ) == 0x0
 02114   868   NtQueryVirtualMemory  (-1, 0x1c60000, Basic, 28, ... {BaseAddress=0x1c60000,AllocationBase=0x1c60000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 28, ) == 0x0
 02115   868   NtFreeVirtualMemory  (-1, (0x1c60000), 0, 32768, ... (0x1c60000), 65536, ) == 0x0
 02116   868   NtAllocateVirtualMemory  (-1, 0, 0, 65536, 8192, 4, ... 29753344, 65536, ) == 0x0
 02117   868   NtQueryVirtualMemory  (-1, 0x1c60000, Basic, 28, ... {BaseAddress=0x1c60000,AllocationBase=0x1c60000,AllocationProtect=0x4,RegionSize=0x10000,State=0x2000,Protect=0x0,Type=0x20000,}, 28, ) == 0x0
 02118   868   NtAllocateVirtualMemory  (-1, 29753344, 0, 1, 4096, 4, ... 29753344, 4096, ) == 0x0
 02119   868   NtQueryVirtualMemory  (-1, 0x1c60000, Basic, 28, ... {BaseAddress=0x1c60000,AllocationBase=0x1c60000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 28, ) == 0x0
 02120   868   NtFreeVirtualMemory  (-1, (0x1c60000), 0, 32768, ... (0x1c60000), 65536, ) == 0x0
 02121   868   NtAllocateVirtualMemory  (-1, 0, 0, 65536, 8192, 4, ... 29753344, 65536, ) == 0x0
 02122   868   NtQueryVirtualMemory  (-1, 0x1c60000, Basic, 28, ... {BaseAddress=0x1c60000,AllocationBase=0x1c60000,AllocationProtect=0x4,RegionSize=0x10000,State=0x2000,Protect=0x0,Type=0x20000,}, 28, ) == 0x0
 02123   868   NtAllocateVirtualMemory  (-1, 29753344, 0, 1, 4096, 4, ... 29753344, 4096, ) == 0x0
 02124   868   NtQueryVirtualMemory  (-1, 0x1c60000, Basic, 28, ... {BaseAddress=0x1c60000,AllocationBase=0x1c60000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 28, ) == 0x0
 02125   868   NtFreeVirtualMemory  (-1, (0x1c60000), 0, 32768, ... (0x1c60000), 65536, ) == 0x0
 02126   868   NtAllocateVirtualMemory  (-1, 0, 0, 65536, 8192, 4, ... 29753344, 65536, ) == 0x0
 02127   868   NtQueryVirtualMemory  (-1, 0x1c60000, Basic, 28, ... {BaseAddress=0x1c60000,AllocationBase=0x1c60000,AllocationProtect=0x4,RegionSize=0x10000,State=0x2000,Protect=0x0,Type=0x20000,}, 28, ) == 0x0
 02128   868   NtAllocateVirtualMemory  (-1, 29753344, 0, 1, 4096, 4, ... 29753344, 4096, ) == 0x0
 02129   868   NtQueryVirtualMemory  (-1, 0x1c60000, Basic, 28, ... {BaseAddress=0x1c60000,AllocationBase=0x1c60000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 28, ) == 0x0
 02130   868   NtFreeVirtualMemory  (-1, (0x1c60000), 0, 32768, ... (0x1c60000), 65536, ) == 0x0
 02131   868   NtAllocateVirtualMemory  (-1, 0, 0, 65536, 8192, 4, ... 29753344, 65536, ) == 0x0
 02132   868   NtQueryVirtualMemory  (-1, 0x1c60000, Basic, 28, ... {BaseAddress=0x1c60000,AllocationBase=0x1c60000,AllocationProtect=0x4,RegionSize=0x10000,State=0x2000,Protect=0x0,Type=0x20000,}, 28, ) == 0x0
 02133   868   NtAllocateVirtualMemory  (-1, 29753344, 0, 1, 4096, 4, ... 29753344, 4096, ) == 0x0
 02134   868   NtQueryVirtualMemory  (-1, 0x1c60000, Basic, 28, ... {BaseAddress=0x1c60000,AllocationBase=0x1c60000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 28, ) == 0x0
 02135   868   NtFreeVirtualMemory  (-1, (0x1c60000), 0, 32768, ... (0x1c60000), 65536, ) == 0x0
 02136   868   NtAllocateVirtualMemory  (-1, 0, 0, 65536, 8192, 4, ... 29753344, 65536, ) == 0x0
 02137   868   NtQueryVirtualMemory  (-1, 0x1c60000, Basic, 28, ... {BaseAddress=0x1c60000,AllocationBase=0x1c60000,AllocationProtect=0x4,RegionSize=0x10000,State=0x2000,Protect=0x0,Type=0x20000,}, 28, ) == 0x0
 02138   868   NtAllocateVirtualMemory  (-1, 29753344, 0, 1, 4096, 4, ... 29753344, 4096, ) == 0x0
 02139   868   NtQueryVirtualMemory  (-1, 0x1c60000, Basic, 28, ... {BaseAddress=0x1c60000,AllocationBase=0x1c60000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 28, ) == 0x0
 02140   868   NtFreeVirtualMemory  (-1, (0x1c60000), 0, 32768, ... (0x1c60000), 65536, ) == 0x0
 02141   868   NtAllocateVirtualMemory  (-1, 0, 0, 65536, 8192, 4, ... 29753344, 65536, ) == 0x0
 02142   868   NtQueryVirtualMemory  (-1, 0x1c60000, Basic, 28, ... {BaseAddress=0x1c60000,AllocationBase=0x1c60000,AllocationProtect=0x4,RegionSize=0x10000,State=0x2000,Protect=0x0,Type=0x20000,}, 28, ) == 0x0
 02143   868   NtAllocateVirtualMemory  (-1, 29753344, 0, 1, 4096, 4, ... 29753344, 4096, ) == 0x0
 02144   868   NtQueryVirtualMemory  (-1, 0x1c60000, Basic, 28, ... {BaseAddress=0x1c60000,AllocationBase=0x1c60000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 28, ) == 0x0
 02145   868   NtFreeVirtualMemory  (-1, (0x1c60000), 0, 32768, ... (0x1c60000), 65536, ) == 0x0
 02146   868   NtAllocateVirtualMemory  (-1, 0, 0, 65536, 8192, 4, ... 29753344, 65536, ) == 0x0
 02147   868   NtQueryVirtualMemory  (-1, 0x1c60000, Basic, 28, ... {BaseAddress=0x1c60000,AllocationBase=0x1c60000,AllocationProtect=0x4,RegionSize=0x10000,State=0x2000,Protect=0x0,Type=0x20000,}, 28, ) == 0x0
 02148   868   NtAllocateVirtualMemory  (-1, 29753344, 0, 1, 4096, 4, ... 29753344, 4096, ) == 0x0
 02149   868   NtQueryVirtualMemory  (-1, 0x1c60000, Basic, 28, ... {BaseAddress=0x1c60000,AllocationBase=0x1c60000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 28, ) == 0x0
 02150   868   NtFreeVirtualMemory  (-1, (0x1c60000), 0, 32768, ... (0x1c60000), 65536, ) == 0x0
 02151   868   NtAllocateVirtualMemory  (-1, 0, 0, 65536, 8192, 4, ... 29753344, 65536, ) == 0x0
 02152   868   NtQueryVirtualMemory  (-1, 0x1c60000, Basic, 28, ... {BaseAddress=0x1c60000,AllocationBase=0x1c60000,AllocationProtect=0x4,RegionSize=0x10000,State=0x2000,Protect=0x0,Type=0x20000,}, 28, ) == 0x0
 02153   868   NtAllocateVirtualMemory  (-1, 29753344, 0, 1, 4096, 4, ... 29753344, 4096, ) == 0x0
 02154   868   NtQueryVirtualMemory  (-1, 0x1c60000, Basic, 28, ... {BaseAddress=0x1c60000,AllocationBase=0x1c60000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 28, ) == 0x0
 02155   868   NtFreeVirtualMemory  (-1, (0x1c60000), 0, 32768, ... (0x1c60000), 65536, ) == 0x0
 02156   868   NtAllocateVirtualMemory  (-1, 0, 0, 65536, 8192, 4, ... 29753344, 65536, ) == 0x0
 02157   868   NtQueryVirtualMemory  (-1, 0x1c60000, Basic, 28, ... {BaseAddress=0x1c60000,AllocationBase=0x1c60000,AllocationProtect=0x4,RegionSize=0x10000,State=0x2000,Protect=0x0,Type=0x20000,}, 28, ) == 0x0
 02158   868   NtAllocateVirtualMemory  (-1, 29753344, 0, 1, 4096, 4, ... 29753344, 4096, ) == 0x0
 02159   868   NtQueryVirtualMemory  (-1, 0x1c60000, Basic, 28, ... {BaseAddress=0x1c60000,AllocationBase=0x1c60000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 28, ) == 0x0
 02160   868   NtFreeVirtualMemory  (-1, (0x1c60000), 0, 32768, ... (0x1c60000), 65536, ) == 0x0
 02161   868   NtAllocateVirtualMemory  (-1, 0, 0, 65536, 8192, 4, ... 29753344, 65536, ) == 0x0
 02162   868   NtQueryVirtualMemory  (-1, 0x1c60000, Basic, 28, ... {BaseAddress=0x1c60000,AllocationBase=0x1c60000,AllocationProtect=0x4,RegionSize=0x10000,State=0x2000,Protect=0x0,Type=0x20000,}, 28, ) == 0x0
 02163   868   NtAllocateVirtualMemory  (-1, 29753344, 0, 1, 4096, 4, ... 29753344, 4096, ) == 0x0
 02164   868   NtQueryVirtualMemory  (-1, 0x1c60000, Basic, 28, ... {BaseAddress=0x1c60000,AllocationBase=0x1c60000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 28, ) == 0x0
 02165   868   NtFreeVirtualMemory  (-1, (0x1c60000), 0, 32768, ... (0x1c60000), 65536, ) == 0x0
 02166   868   NtAllocateVirtualMemory  (-1, 0, 0, 65536, 8192, 4, ... 29753344, 65536, ) == 0x0
 02167   868   NtQueryVirtualMemory  (-1, 0x1c60000, Basic, 28, ... {BaseAddress=0x1c60000,AllocationBase=0x1c60000,AllocationProtect=0x4,RegionSize=0x10000,State=0x2000,Protect=0x0,Type=0x20000,}, 28, ) == 0x0
 02168   868   NtAllocateVirtualMemory  (-1, 29753344, 0, 1, 4096, 4, ... 29753344, 4096, ) == 0x0
 02169   868   NtQueryVirtualMemory  (-1, 0x1c60000, Basic, 28, ... {BaseAddress=0x1c60000,AllocationBase=0x1c60000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 28, ) == 0x0
 02170   868   NtFreeVirtualMemory  (-1, (0x1c60000), 0, 32768, ... (0x1c60000), 65536, ) == 0x0
 02171   868   NtAllocateVirtualMemory  (-1, 0, 0, 65536, 8192, 4, ... 29753344, 65536, ) == 0x0
 02172   868   NtQueryVirtualMemory  (-1, 0x1c60000, Basic, 28, ... {BaseAddress=0x1c60000,AllocationBase=0x1c60000,AllocationProtect=0x4,RegionSize=0x10000,State=0x2000,Protect=0x0,Type=0x20000,}, 28, ) == 0x0
 02173   868   NtAllocateVirtualMemory  (-1, 29753344, 0, 1, 4096, 4, ... 29753344, 4096, ) == 0x0
 02174   868   NtQueryVirtualMemory  (-1, 0x1c60000, Basic, 28, ... {BaseAddress=0x1c60000,AllocationBase=0x1c60000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 28, ) == 0x0
 02175   868   NtFreeVirtualMemory  (-1, (0x1c60000), 0, 32768, ... (0x1c60000), 65536, ) == 0x0
 02176   868   NtAllocateVirtualMemory  (-1, 0, 0, 65536, 8192, 4, ... 29753344, 65536, ) == 0x0
 02177   868   NtQueryVirtualMemory  (-1, 0x1c60000, Basic, 28, ... {BaseAddress=0x1c60000,AllocationBase=0x1c60000,AllocationProtect=0x4,RegionSize=0x10000,State=0x2000,Protect=0x0,Type=0x20000,}, 28, ) == 0x0
 02178   868   NtAllocateVirtualMemory  (-1, 29753344, 0, 1, 4096, 4, ... 29753344, 4096, ) == 0x0
 02179   868   NtQueryVirtualMemory  (-1, 0x1c60000, Basic, 28, ... {BaseAddress=0x1c60000,AllocationBase=0x1c60000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 28, ) == 0x0
 02180   868   NtFreeVirtualMemory  (-1, (0x1c60000), 0, 32768, ... (0x1c60000), 65536, ) == 0x0
 02181   868   NtAllocateVirtualMemory  (-1, 0, 0, 65536, 8192, 4, ... 29753344, 65536, ) == 0x0
 02182   868   NtQueryVirtualMemory  (-1, 0x1c60000, Basic, 28, ... {BaseAddress=0x1c60000,AllocationBase=0x1c60000,AllocationProtect=0x4,RegionSize=0x10000,State=0x2000,Protect=0x0,Type=0x20000,}, 28, ) == 0x0
 02183   868   NtAllocateVirtualMemory  (-1, 29753344, 0, 1, 4096, 4, ... 29753344, 4096, ) == 0x0
 02184   868   NtQueryVirtualMemory  (-1, 0x1c60000, Basic, 28, ... {BaseAddress=0x1c60000,AllocationBase=0x1c60000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 28, ) == 0x0
 02185   868   NtFreeVirtualMemory  (-1, (0x1c60000), 0, 32768, ... (0x1c60000), 65536, ) == 0x0
 02186   868   NtAllocateVirtualMemory  (-1, 0, 0, 65536, 8192, 4, ... 29753344, 65536, ) == 0x0
 02187   868   NtQueryVirtualMemory  (-1, 0x1c60000, Basic, 28, ... {BaseAddress=0x1c60000,AllocationBase=0x1c60000,AllocationProtect=0x4,RegionSize=0x10000,State=0x2000,Protect=0x0,Type=0x20000,}, 28, ) == 0x0
 02188   868   NtAllocateVirtualMemory  (-1, 29753344, 0, 1, 4096, 4, ... 29753344, 4096, ) == 0x0
 02189   868   NtQueryVirtualMemory  (-1, 0x1c60000, Basic, 28, ... {BaseAddress=0x1c60000,AllocationBase=0x1c60000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 28, ) == 0x0
 02190   868   NtFreeVirtualMemory  (-1, (0x1c60000), 0, 32768, ... (0x1c60000), 65536, ) == 0x0
 02191   868   NtAllocateVirtualMemory  (-1, 0, 0, 65536, 8192, 4, ... 29753344, 65536, ) == 0x0
 02192   868   NtQueryVirtualMemory  (-1, 0x1c60000, Basic, 28, ... {BaseAddress=0x1c60000,AllocationBase=0x1c60000,AllocationProtect=0x4,RegionSize=0x10000,State=0x2000,Protect=0x0,Type=0x20000,}, 28, ) == 0x0
 02193   868   NtAllocateVirtualMemory  (-1, 29753344, 0, 1, 4096, 4, ... 29753344, 4096, ) == 0x0
 02194   868   NtQueryVirtualMemory  (-1, 0x1c60000, Basic, 28, ... {BaseAddress=0x1c60000,AllocationBase=0x1c60000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 28, ) == 0x0
 02195   868   NtFreeVirtualMemory  (-1, (0x1c60000), 0, 32768, ... (0x1c60000), 65536, ) == 0x0
 02196   868   NtAllocateVirtualMemory  (-1, 0, 0, 65536, 8192, 4, ... 29753344, 65536, ) == 0x0
 02197   868   NtQueryVirtualMemory  (-1, 0x1c60000, Basic, 28, ... {BaseAddress=0x1c60000,AllocationBase=0x1c60000,AllocationProtect=0x4,RegionSize=0x10000,State=0x2000,Protect=0x0,Type=0x20000,}, 28, ) == 0x0
 02198   868   NtAllocateVirtualMemory  (-1, 29753344, 0, 1, 4096, 4, ... 29753344, 4096, ) == 0x0
 02199   868   NtQueryVirtualMemory  (-1, 0x1c60000, Basic, 28, ... {BaseAddress=0x1c60000,AllocationBase=0x1c60000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 28, ) == 0x0
 02200   868   NtFreeVirtualMemory  (-1, (0x1c60000), 0, 32768, ... (0x1c60000), 65536, ) == 0x0
 02201   868   NtAllocateVirtualMemory  (-1, 0, 0, 65536, 8192, 4, ... 29753344, 65536, ) == 0x0
 02202   868   NtQueryVirtualMemory  (-1, 0x1c60000, Basic, 28, ... {BaseAddress=0x1c60000,AllocationBase=0x1c60000,AllocationProtect=0x4,RegionSize=0x10000,State=0x2000,Protect=0x0,Type=0x20000,}, 28, ) == 0x0
 02203   868   NtAllocateVirtualMemory  (-1, 29753344, 0, 1, 4096, 4, ... 29753344, 4096, ) == 0x0
 02204   868   NtQueryVirtualMemory  (-1, 0x1c60000, Basic, 28, ... {BaseAddress=0x1c60000,AllocationBase=0x1c60000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 28, ) == 0x0
 02205   868   NtFreeVirtualMemory  (-1, (0x1c60000), 0, 32768, ... (0x1c60000), 65536, ) == 0x0
 02206   868   NtOpenKey  (0x20019, {24, 36, 0x40, 0, 0,  (0x20019, {24, 36, 0x40, 0, 0, "SYSTEM\CurrentControlSet\Services\Tcpip\Linkage"}, ... 296, ) }, ... 296, ) == 0x0
 02207   868   NtOpenKey  (0x20019, {24, 36, 0x40, 0, 0,  (0x20019, {24, 36, 0x40, 0, 0, "SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\"}, ... 300, ) }, ... 300, ) == 0x0
 02208   868   NtOpenKey  (0x20019, {24, 36, 0x40, 0, 0,  (0x20019, {24, 36, 0x40, 0, 0, "SYSTEM\CurrentControlSet\Services\NetBT\Parameters\Interfaces"}, ... 304, ) }, ... 304, ) == 0x0
 02209   868   NtOpenKey  (0x20019, {24, 36, 0x40, 0, 0,  (0x20019, {24, 36, 0x40, 0, 0, "SYSTEM\CurrentControlSet\Services\NetBT\Parameters"}, ... 308, ) }, ... 308, ) == 0x0
 02210   868   NtQueryDefaultLocale  (1, 1241416, ... ) == 0x0
 02211   868   NtOpenKey  (0x80000000, {24, 0, 0x40, 0, 0,  (0x80000000, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\icmp.dll"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02212   868   NtOpenSection  (0xe, {24, 8, 0x40, 0, 0,  (0xe, {24, 8, 0x40, 0, 0, "netapi32.dll"}, ... 312, ) }, ... 312, ) == 0x0
 02213   868   NtMapViewOfSection  (312, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x5b860000), 0x0, 344064, ) == 0x0
 02214   868   NtClose  (312, ... ) == 0x0
 02215   868   NtProtectVirtualMemory  (-1, (0x5b861000), 1168, 4, ... (0x5b861000), 4096, 32, ) == 0x0
 02216   868   NtProtectVirtualMemory  (-1, (0x5b861000), 4096, 32, ... (0x5b861000), 4096, 4, ) == 0x0
 02217   868   NtFlushInstructionCache  (-1, 1535512576, 1168, ... ) == 0x0
 02218   868   NtProtectVirtualMemory  (-1, (0x5b861000), 1168, 4, ... (0x5b861000), 4096, 32, ) == 0x0
 02219   868   NtProtectVirtualMemory  (-1, (0x5b861000), 4096, 32, ... (0x5b861000), 4096, 4, ) == 0x0
 02220   868   NtFlushInstructionCache  (-1, 1535512576, 1168, ... ) == 0x0
 02221   868   NtProtectVirtualMemory  (-1, (0x5b861000), 1168, 4, ... (0x5b861000), 4096, 32, ) == 0x0
 02222   868   NtProtectVirtualMemory  (-1, (0x5b861000), 4096, 32, ... (0x5b861000), 4096, 4, ) == 0x0
 02223   868   NtFlushInstructionCache  (-1, 1535512576, 1168, ... ) == 0x0
 02224   868   NtProtectVirtualMemory  (-1, (0x5b861000), 1168, 4, ... (0x5b861000), 4096, 32, ) == 0x0
 02225   868   NtProtectVirtualMemory  (-1, (0x5b861000), 4096, 32, ... (0x5b861000), 4096, 4, ) == 0x0
 02226   868   NtFlushInstructionCache  (-1, 1535512576, 1168, ... ) == 0x0
 02227   868   NtProtectVirtualMemory  (-1, (0x5b861000), 1168, 4, ... (0x5b861000), 4096, 32, ) == 0x0
 02228   868   NtProtectVirtualMemory  (-1, (0x5b861000), 4096, 32, ... (0x5b861000), 4096, 4, ) == 0x0
 02229   868   NtFlushInstructionCache  (-1, 1535512576, 1168, ... ) == 0x0
 02230   868   NtOpenKey  (0x80000000, {24, 0, 0x40, 0, 0,  (0x80000000, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\netapi32.dll"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02231   868   NtOpenSection  (0xe, {24, 8, 0x40, 0, 0,  (0xe, {24, 8, 0x40, 0, 0, "dnsapi.dll"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02232   868   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\u:\work\dnsapi.dll"}, 1240240, ... ) }, 1240240, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02233   868   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\dnsapi.dll"}, 1240240, ... ) }, 1240240, ... ) == 0x0
 02234   868   NtOpenFile  (0x100020, {24, 0, 0x40, 0, 0,  (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\dnsapi.dll"}, 5, 96, ... 312, {status=0x0, info=1}, ) }, 5, 96, ... 312, {status=0x0, info=1}, ) == 0x0
 02235   868   NtCreateSection  (0xf, 0x0, 0x0, 16, 16777216, 312, ... 316, ) == 0x0
 02236   868   NtQuerySection  (316, Image, 48, ... {section info, class 1, size 48}, 0x0, ) == 0x0
 02237   868   NtClose  (312, ... ) == 0x0
 02238   868   NtMapViewOfSection  (316, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x76f20000), 0x0, 159744, ) == 0x0
 02239   868   NtClose  (316, ... ) == 0x0
 02240   868   NtProtectVirtualMemory  (-1, (0x76f21000), 616, 4, ... (0x76f21000), 4096, 32, ) == 0x0
 02241   868   NtProtectVirtualMemory  (-1, (0x76f21000), 4096, 32, ... (0x76f21000), 4096, 4, ) == 0x0
 02242   868   NtFlushInstructionCache  (-1, 1995575296, 616, ... ) == 0x0
 02243   868   NtProtectVirtualMemory  (-1, (0x76f21000), 616, 4, ... (0x76f21000), 4096, 32, ) == 0x0
 02244   868   NtProtectVirtualMemory  (-1, (0x76f21000), 4096, 32, ... (0x76f21000), 4096, 4, ) == 0x0
 02245   868   NtFlushInstructionCache  (-1, 1995575296, 616, ... ) == 0x0
 02246   868   NtProtectVirtualMemory  (-1, (0x76f21000), 616, 4, ... (0x76f21000), 4096, 32, ) == 0x0
 02247   868   NtProtectVirtualMemory  (-1, (0x76f21000), 4096, 32, ... (0x76f21000), 4096, 4, ) == 0x0
 02248   868   NtFlushInstructionCache  (-1, 1995575296, 616, ... ) == 0x0
 02249   868   NtProtectVirtualMemory  (-1, (0x76f21000), 616, 4, ... (0x76f21000), 4096, 32, ) == 0x0
 02250   868   NtProtectVirtualMemory  (-1, (0x76f21000), 4096, 32, ... (0x76f21000), 4096, 4, ) == 0x0
 02251   868   NtFlushInstructionCache  (-1, 1995575296, 616, ... ) == 0x0
 02252   868   NtProtectVirtualMemory  (-1, (0x76f21000), 616, 4, ... (0x76f21000), 4096, 32, ) == 0x0
 02253   868   NtProtectVirtualMemory  (-1, (0x76f21000), 4096, 32, ... (0x76f21000), 4096, 4, ) == 0x0
 02254   868   NtFlushInstructionCache  (-1, 1995575296, 616, ... ) == 0x0
 02255   868   NtProtectVirtualMemory  (-1, (0x76f21000), 616, 4, ... (0x76f21000), 4096, 32, ) == 0x0
 02256   868   NtProtectVirtualMemory  (-1, (0x76f21000), 4096, 32, ... (0x76f21000), 4096, 4, ) == 0x0
 02257   868   NtFlushInstructionCache  (-1, 1995575296, 616, ... ) == 0x0
 02258   868   NtOpenKey  (0x80000000, {24, 0, 0x40, 0, 0,  (0x80000000, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\dnsapi.dll"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02259   868   NtCreateKey  (0x20019, {24, 36, 0x40, 0, 0,  (0x20019, {24, 36, 0x40, 0, 0, "System\CurrentControlSet\Services\Tcpip\Parameters"}, 0, "Class", 0, ... 316, 2, ) }, 0,  (0x20019, {24, 36, 0x40, 0, 0, "System\CurrentControlSet\Services\Tcpip\Parameters"}, 0, "Class", 0, ... 316, 2, ) , 0, ... 316, 2, ) == 0x0
 02260   868   NtOpenKey  (0x20019, {24, 36, 0x40, 0, 0,  (0x20019, {24, 36, 0x40, 0, 0, "System\CurrentControlSet\Services\DnsCache\Parameters"}, ... 312, ) }, ... 312, ) == 0x0
 02261   868   NtOpenKey  (0x20019, {24, 36, 0x40, 0, 0,  (0x20019, {24, 36, 0x40, 0, 0, "Software\Policies\Microsoft\Windows NT\DnsClient"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02262   868   NtQueryValueKey  (312,  (312, "QueryAdapterName", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02263   868   NtQueryValueKey  (316,  (316, "DisableAdapterDomainName", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02264   868   NtQueryValueKey  (312,  (312, "UseDomainNameDevolution", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02265   868   NtQueryValueKey  (316,  (316, "UseDomainNameDevolution", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (316, "UseDomainNameDevolution", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) }, 16, ) == 0x0
 02266   868   NtQueryValueKey  (312,  (312, "PrioritizeRecordData", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02267   868   NtQueryValueKey  (316,  (316, "PrioritizeRecordData", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02268   868   NtQueryValueKey  (312,  (312, "AllowUnqualifiedQuery", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02269   868   NtQueryValueKey  (316,  (316, "AllowUnqualifiedQuery", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02270   868   NtQueryValueKey  (312,  (312, "AppendToMultiLabelName", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02271   868   NtQueryValueKey  (312,  (312, "ScreenBadTlds", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02272   868   NtQueryValueKey  (312,  (312, "ScreenUnreachableServers", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02273   868   NtQueryValueKey  (312,  (312, "FilterClusterIp", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02274   868   NtQueryValueKey  (312,  (312, "WaitForNameErrorOnAll", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02275   868   NtQueryValueKey  (312,  (312, "UseEdns", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02276   868   NtQueryValueKey  (312,  (312, "QueryIpMatching", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02277   868   NtQueryValueKey  (312,  (312, "UseHostsFile", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02278   868   NtQueryValueKey  (312,  (312, "RegistrationEnabled", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02279   868   NtQueryValueKey  (316,  (316, "DisableDynamicUpdate", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02280   868   NtQueryValueKey  (312,  (312, "RegisterPrimaryName", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02281   868   NtQueryValueKey  (312,  (312, "RegisterAdapterName", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02282   868   NtQueryValueKey  (316,  (316, "EnableAdapterDomainNameRegistration", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02283   868   NtQueryValueKey  (312,  (312, "RegisterReverseLookup", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02284   868   NtQueryValueKey  (316,  (316, "DisableReverseAddressRegistrations", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02285   868   NtQueryValueKey  (312,  (312, "RegisterWanAdapters", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02286   868   NtQueryValueKey  (316,  (316, "DisableWanDynamicUpdate", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02287   868   NtQueryValueKey  (312,  (312, "RegistrationTtl", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02288   868   NtQueryValueKey  (316,  (316, "DefaultRegistrationTTL", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02289   868   NtQueryValueKey  (312,  (312, "RegistrationRefreshInterval", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02290   868   NtQueryValueKey  (316,  (316, "DefaultRegistrationRefreshInterval", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02291   868   NtQueryValueKey  (312,  (312, "RegistrationMaxAddressCount", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02292   868   NtQueryValueKey  (316,  (316, "MaxNumberOfAddressesToRegister", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02293   868   NtQueryValueKey  (312,  (312, "UpdateSecurityLevel", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02294   868   NtQueryValueKey  (316,  (316, "UpdateSecurityLevel", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02295   868   NtQueryValueKey  (312,  (312, "UpdateZoneExcludeFile", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02296   868   NtQueryValueKey  (312,  (312, "UpdateTopLevelDomainZones", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02297   868   NtQueryValueKey  (312,  (312, "DnsTest", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02298   868   NtQueryValueKey  (312,  (312, "MaxCacheSize", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02299   868   NtQueryValueKey  (312,  (312, "MaxCacheTtl", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02300   868   NtQueryValueKey  (312,  (312, "MaxNegativeCacheTtl", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02301   868   NtQueryValueKey  (312,  (312, "AdapterTimeoutLimit", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02302   868   NtQueryValueKey  (312,  (312, "ServerPriorityTimeLimit", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02303   868   NtQueryValueKey  (312,  (312, "MaxCachedSockets", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02304   868   NtQueryValueKey  (312,  (312, "MulticastListenLevel", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02305   868   NtQueryValueKey  (312,  (312, "MulticastSendLevel", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02306   868   NtOpenKey  (0x1, {24, 36, 0x40, 0, 0,  (0x1, {24, 36, 0x40, 0, 0, "System\Setup"}, ... 320, ) }, ... 320, ) == 0x0
 02307   868   NtQueryValueKey  (320,  (320, "SystemSetupInProgress", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (320, "SystemSetupInProgress", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) }, 16, ) == 0x0
 02308   868   NtClose  (320, ... ) == 0x0
 02309   868   NtClose  (316, ... ) == 0x0
 02310   868   NtClose  (312, ... ) == 0x0
 02311   868   NtOpenKey  (0x1, {24, 36, 0x40, 0, 0,  (0x1, {24, 36, 0x40, 0, 0, "System\CurrentControlSet\Services\Tcpip\Parameters"}, ... 312, ) }, ... 312, ) == 0x0
 02312   868   NtQueryValueKey  (312,  (312, "DnsQueryTimeouts", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02313   868   NtQueryValueKey  (312,  (312, "DnsQuickQueryTimeouts", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02314   868   NtQueryValueKey  (312,  (312, "DnsMulticastQueryTimeouts", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02315   868   NtClose  (312, ... ) == 0x0
 02316   868   NtOpenSection  (0xe, {24, 8, 0x40, 0, 0,  (0xe, {24, 8, 0x40, 0, 0, "mpr.dll"}, ... 312, ) }, ... 312, ) == 0x0
 02317   868   NtMapViewOfSection  (312, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x71b20000), 0x0, 73728, ) == 0x0
 02318   868   NtClose  (312, ... ) == 0x0
 02319   868   NtProtectVirtualMemory  (-1, (0x71b21000), 440, 4, ... (0x71b21000), 4096, 32, ) == 0x0
 02320   868   NtProtectVirtualMemory  (-1, (0x71b21000), 4096, 32, ... (0x71b21000), 4096, 4, ) == 0x0
 02321   868   NtFlushInstructionCache  (-1, 1907494912, 440, ... ) == 0x0
 02322   868   NtProtectVirtualMemory  (-1, (0x71b21000), 440, 4, ... (0x71b21000), 4096, 32, ) == 0x0
 02323   868   NtProtectVirtualMemory  (-1, (0x71b21000), 4096, 32, ... (0x71b21000), 4096, 4, ) == 0x0
 02324   868   NtFlushInstructionCache  (-1, 1907494912, 440, ... ) == 0x0
 02325   868   NtOpenKey  (0x80000000, {24, 0, 0x40, 0, 0,  (0x80000000, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mpr.dll"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02326   868   NtCreateSemaphore  (0x1f0003, 0x0, 1, 1, ... 312, ) == 0x0
 02327   868   NtCreateEvent  (0x1f0003, 0x0, 0, 0, ... 316, ) == 0x0
 02328   868   NtOpenKey  (0x20019, {24, 36, 0x40, 0, 0,  (0x20019, {24, 36, 0x40, 0, 0, "system\CurrentControlSet\control\NetworkProvider\HwOrder"}, ... 320, ) }, ... 320, ) == 0x0
 02329   868   NtNotifyChangeKey  (320, 316, 0, 0, 2011455960, 4, 0, 0, 0, 1, ... ) == 0x103
 02330   868   NtQueryInformationProcess  (-1, 28, 4, ... {process info, class 28, size 4}, 0x0, ) == 0x0
 02331   868   NtCreateSemaphore  (0x100003, 0x0, 0, 2147483647, ... 324, ) == 0x0
 02332   868   NtCreateSemaphore  (0x100003, 0x0, 0, 2147483647, ... 328, ) == 0x0
 02333   868   NtOpenSection  (0xe, {24, 8, 0x40, 0, 0,  (0xe, {24, 8, 0x40, 0, 0, "odbc32.dll"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02334   868   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\u:\work\odbc32.dll"}, 1240240, ... ) }, 1240240, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02335   868   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\odbc32.dll"}, 1240240, ... ) }, 1240240, ... ) == 0x0
 02336   868   NtOpenFile  (0x100020, {24, 0, 0x40, 0, 0,  (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\odbc32.dll"}, 5, 96, ... 332, {status=0x0, info=1}, ) }, 5, 96, ... 332, {status=0x0, info=1}, ) == 0x0
 02337   868   NtCreateSection  (0xf, 0x0, 0x0, 16, 16777216, 332, ... 336, ) == 0x0
 02338   868   NtQuerySection  (336, Image, 48, ... {section info, class 1, size 48}, 0x0, ) == 0x0
 02339   868   NtClose  (332, ... ) == 0x0
 02340   868   NtMapViewOfSection  (336, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x74320000), 0x0, 249856, ) == 0x0
 02341   868   NtClose  (336, ... ) == 0x0
 02342   868   NtProtectVirtualMemory  (-1, (0x74321000), 840, 4, ... (0x74321000), 4096, 32, ) == 0x0
 02343   868   NtProtectVirtualMemory  (-1, (0x74321000), 4096, 32, ... (0x74321000), 4096, 4, ) == 0x0
 02344   868   NtFlushInstructionCache  (-1, 1949437952, 840, ... ) == 0x0
 02345   868   NtProtectVirtualMemory  (-1, (0x74321000), 840, 4, ... (0x74321000), 4096, 32, ) == 0x0
 02346   868   NtProtectVirtualMemory  (-1, (0x74321000), 4096, 32, ... (0x74321000), 4096, 4, ) == 0x0
 02347   868   NtFlushInstructionCache  (-1, 1949437952, 840, ... ) == 0x0
 02348   868   NtProtectVirtualMemory  (-1, (0x74321000), 840, 4, ... (0x74321000), 4096, 32, ) == 0x0
 02349   868   NtProtectVirtualMemory  (-1, (0x74321000), 4096, 32, ... (0x74321000), 4096, 4, ) == 0x0
 02350   868   NtFlushInstructionCache  (-1, 1949437952, 840, ... ) == 0x0
 02351   868   NtProtectVirtualMemory  (-1, (0x74321000), 840, 4, ... (0x74321000), 4096, 32, ) == 0x0
 02352   868   NtProtectVirtualMemory  (-1, (0x74321000), 4096, 32, ... (0x74321000), 4096, 4, ) == 0x0
 02353   868   NtFlushInstructionCache  (-1, 1949437952, 840, ... ) == 0x0
 02354   868   NtProtectVirtualMemory  (-1, (0x74321000), 840, 4, ... (0x74321000), 4096, 32, ) == 0x0
 02355   868   NtProtectVirtualMemory  (-1, (0x74321000), 4096, 32, ... (0x74321000), 4096, 4, ) == 0x0
 02356   868   NtFlushInstructionCache  (-1, 1949437952, 840, ... ) == 0x0
 02357   868   NtOpenSection  (0xe, {24, 8, 0x40, 0, 0,  (0xe, {24, 8, 0x40, 0, 0, "comdlg32.dll"}, ... 336, ) }, ... 336, ) == 0x0
 02358   868   NtMapViewOfSection  (336, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x763b0000), 0x0, 299008, ) == 0x0
 02359   868   NtClose  (336, ... ) == 0x0
 02360   868   NtProtectVirtualMemory  (-1, (0x763b1000), 1552, 4, ... (0x763b1000), 4096, 32, ) == 0x0
 02361   868   NtProtectVirtualMemory  (-1, (0x763b1000), 4096, 32, ... (0x763b1000), 4096, 4, ) == 0x0
 02362   868   NtFlushInstructionCache  (-1, 1983582208, 1552, ... ) == 0x0
 02363   868   NtProtectVirtualMemory  (-1, (0x763b1000), 1552, 4, ... (0x763b1000), 4096, 32, ) == 0x0
 02364   868   NtProtectVirtualMemory  (-1, (0x763b1000), 4096, 32, ... (0x763b1000), 4096, 4, ) == 0x0
 02365   868   NtFlushInstructionCache  (-1, 1983582208, 1552, ... ) == 0x0
 02366   868   NtProtectVirtualMemory  (-1, (0x763b1000), 1552, 4, ... (0x763b1000), 4096, 32, ) == 0x0
 02367   868   NtProtectVirtualMemory  (-1, (0x763b1000), 4096, 32, ... (0x763b1000), 4096, 4, ) == 0x0
 02368   868   NtFlushInstructionCache  (-1, 1983582208, 1552, ... ) == 0x0
 02369   868   NtProtectVirtualMemory  (-1, (0x763b1000), 1552, 4, ... (0x763b1000), 4096, 32, ) == 0x0
 02370   868   NtProtectVirtualMemory  (-1, (0x763b1000), 4096, 32, ... (0x763b1000), 4096, 4, ) == 0x0
 02371   868   NtFlushInstructionCache  (-1, 1983582208, 1552, ... ) == 0x0
 02372   868   NtProtectVirtualMemory  (-1, (0x763b1000), 1552, 4, ... (0x763b1000), 4096, 32, ) == 0x0
 02373   868   NtProtectVirtualMemory  (-1, (0x763b1000), 4096, 32, ... (0x763b1000), 4096, 4, ) == 0x0
 02374   868   NtFlushInstructionCache  (-1, 1983582208, 1552, ... ) == 0x0
 02375   868   NtProtectVirtualMemory  (-1, (0x763b1000), 1552, 4, ... (0x763b1000), 4096, 32, ) == 0x0
 02376   868   NtProtectVirtualMemory  (-1, (0x763b1000), 4096, 32, ... (0x763b1000), 4096, 4, ) == 0x0
 02377   868   NtFlushInstructionCache  (-1, 1983582208, 1552, ... ) == 0x0
 02378   868   NtOpenKey  (0x80000000, {24, 0, 0x40, 0, 0,  (0x80000000, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\comdlg32.dll"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02379   868   NtUserRegisterWindowMessage  ( ("WOWLFChange", ... ) , ... ) == 0xc06c
 02380   868   NtUserRegisterWindowMessage  ( ("WOWDirChange", ... ) , ... ) == 0xc06d
 02381   868   NtUserRegisterWindowMessage  ( ("WOWCHOOSEFONT_GETLOGFONT", ... ) , ... ) == 0xc06e
 02382   868   NtUserRegisterWindowMessage  ( ("commdlg_LBSelChangedNotify", ... ) , ... ) == 0xc06f
 02383   868   NtUserRegisterWindowMessage  ( ("commdlg_ShareViolation", ... ) , ... ) == 0xc070
 02384   868   NtUserRegisterWindowMessage  ( ("commdlg_FileNameOK", ... ) , ... ) == 0xc071
 02385   868   NtUserRegisterWindowMessage  ( ("commdlg_ColorOK", ... ) , ... ) == 0xc072
 02386   868   NtUserRegisterWindowMessage  ( ("commdlg_SetRGBColor", ... ) , ... ) == 0xc073
 02387   868   NtUserRegisterWindowMessage  ( ("commdlg_LBSelChangedNotify", ... ) , ... ) == 0xc06f
 02388   868   NtUserRegisterWindowMessage  ( ("commdlg_ShareViolation", ... ) , ... ) == 0xc070
 02389   868   NtUserRegisterWindowMessage  ( ("commdlg_FileNameOK", ... ) , ... ) == 0xc071
 02390   868   NtUserRegisterWindowMessage  ( ("commdlg_ColorOK", ... ) , ... ) == 0xc072
 02391   868   NtUserRegisterWindowMessage  ( ("commdlg_SetRGBColor", ... ) , ... ) == 0xc073
 02392   868   NtUserRegisterWindowMessage  ( ("Shell IDList Array", ... ) , ... ) == 0xc074
 02393   868   NtUserRegisterWindowMessage  ( ("commdlg_help", ... ) , ... ) == 0xc075
 02394   868   NtUserRegisterWindowMessage  ( ("commdlg_help", ... ) , ... ) == 0xc075
 02395   868   NtOpenKey  (0x80000000, {24, 0, 0x40, 0, 0,  (0x80000000, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\odbc32.dll"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02396   868   NtOpenKey  (0x20019, {24, 36, 0x40, 0, 0,  (0x20019, {24, 36, 0x40, 0, 0, "SOFTWARE\Microsoft\BidInterface\Loader"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02397   868   NtOpenKey  (0x20019, {24, 36, 0x40, 0, 0,  (0x20019, {24, 36, 0x40, 0, 0, "SOFTWARE\Microsoft\MDAC"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02398   868   NtQuerySystemInformation  (Basic, 44, ... {Unknown=0,MaximumIncrement=156250,PhysicalPageSize=0x1000,NumberOfPhysicalPages=0xff7c,LowestPhysicalPage=0x1,HighestPhysicalPage=0xffff,AllocationGranularity=0x10000,LowestUserAddress=0x10000,HighestUserAddress=0x7ffeffff,ActiveProcessors=1,NumberProcessors=1,}, 0x0, ) == 0x0
 02399   868   NtQuerySystemInformation  (Processor, 12, ... {system info, class 1, size 12}, 0x0, ) == 0x0
 02400   868   NtQuerySystemInformation  (Basic, 44, ... {Unknown=0,MaximumIncrement=156250,PhysicalPageSize=0x1000,NumberOfPhysicalPages=0xff7c,LowestPhysicalPage=0x1,HighestPhysicalPage=0xffff,AllocationGranularity=0x10000,LowestUserAddress=0x10000,HighestUserAddress=0x7ffeffff,ActiveProcessors=1,NumberProcessors=1,}, 0x0, ) == 0x0
 02401   868   NtAllocateVirtualMemory  (-1, 0, 0, 262144, 8192, 4, ... 29753344, 262144, ) == 0x0
 02402   868   NtAllocateVirtualMemory  (-1, 29753344, 0, 4096, 4096, 4, ... 29753344, 4096, ) == 0x0
 02403   868   NtQuerySystemInformation  (Basic, 44, ... {Unknown=0,MaximumIncrement=156250,PhysicalPageSize=0x1000,NumberOfPhysicalPages=0xff7c,LowestPhysicalPage=0x1,HighestPhysicalPage=0xffff,AllocationGranularity=0x10000,LowestUserAddress=0x10000,HighestUserAddress=0x7ffeffff,ActiveProcessors=1,NumberProcessors=1,}, 0x0, ) == 0x0
 02404   868   NtAllocateVirtualMemory  (-1, 0, 0, 262144, 8192, 4, ... 30015488, 262144, ) == 0x0
 02405   868   NtAllocateVirtualMemory  (-1, 30015488, 0, 4096, 4096, 4, ... 30015488, 4096, ) == 0x0
 02406   868   NtQuerySystemInformation  (Basic, 44, ... {Unknown=0,MaximumIncrement=156250,PhysicalPageSize=0x1000,NumberOfPhysicalPages=0xff7c,LowestPhysicalPage=0x1,HighestPhysicalPage=0xffff,AllocationGranularity=0x10000,LowestUserAddress=0x10000,HighestUserAddress=0x7ffeffff,ActiveProcessors=1,NumberProcessors=1,}, 0x0, ) == 0x0
 02407   868   NtAllocateVirtualMemory  (-1, 0, 0, 262144, 8192, 4, ... 30277632, 262144, ) == 0x0
 02408   868   NtAllocateVirtualMemory  (-1, 30277632, 0, 4096, 4096, 4, ... 30277632, 4096, ) == 0x0
 02409   868   NtQuerySystemInformation  (Basic, 44, ... {Unknown=0,MaximumIncrement=156250,PhysicalPageSize=0x1000,NumberOfPhysicalPages=0xff7c,LowestPhysicalPage=0x1,HighestPhysicalPage=0xffff,AllocationGranularity=0x10000,LowestUserAddress=0x10000,HighestUserAddress=0x7ffeffff,ActiveProcessors=1,NumberProcessors=1,}, 0x0, ) == 0x0
 02410   868   NtAllocateVirtualMemory  (-1, 0, 0, 262144, 8192, 4, ... 30539776, 262144, ) == 0x0
 02411   868   NtAllocateVirtualMemory  (-1, 30539776, 0, 4096, 4096, 4, ... 30539776, 4096, ) == 0x0
 02412   868   NtQuerySystemInformation  (Basic, 44, ... {Unknown=0,MaximumIncrement=156250,PhysicalPageSize=0x1000,NumberOfPhysicalPages=0xff7c,LowestPhysicalPage=0x1,HighestPhysicalPage=0xffff,AllocationGranularity=0x10000,LowestUserAddress=0x10000,HighestUserAddress=0x7ffeffff,ActiveProcessors=1,NumberProcessors=1,}, 0x0, ) == 0x0
 02413   868   NtQuerySystemInformation  (Processor, 12, ... {system info, class 1, size 12}, 0x0, ) == 0x0
 02414   868   NtQuerySystemInformation  (Basic, 44, ... {Unknown=0,MaximumIncrement=156250,PhysicalPageSize=0x1000,NumberOfPhysicalPages=0xff7c,LowestPhysicalPage=0x1,HighestPhysicalPage=0xffff,AllocationGranularity=0x10000,LowestUserAddress=0x10000,HighestUserAddress=0x7ffeffff,ActiveProcessors=1,NumberProcessors=1,}, 0x0, ) == 0x0
 02415   868   NtQuerySystemInformation  (Processor, 12, ... {system info, class 1, size 12}, 0x0, ) == 0x0
 02416   868   NtAllocateVirtualMemory  (-1, 1388544, 0, 4096, 4096, 4, ... 1388544, 4096, ) == 0x0
 02417   868   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\odbcint.dll"}, 1236612, ... ) }, 1236612, ... ) == 0x0
 02418   868   NtOpenFile  (0x100020, {24, 0, 0x40, 0, 0,  (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\odbcint.dll"}, 5, 96, ... 336, {status=0x0, info=1}, ) }, 5, 96, ... 336, {status=0x0, info=1}, ) == 0x0
 02419   868   NtCreateSection  (0xe, 0x0, 0x0, 16, 134217728, 336, ... 332, ) == 0x0
 02420   868   NtClose  (336, ... ) == 0x0
 02421   868   NtMapViewOfSection  (332, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 16, ... (0x1d60000), 0x0, 94208, ) == 0x0
 02422   868   NtClose  (332, ... ) == 0x0
 02423   868   NtUnmapViewOfSection  (-1, 0x1d60000, ... ) == 0x0
 02424   868   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\odbcint.dll"}, 1236920, ... ) }, 1236920, ... ) == 0x0
 02425   868   NtOpenFile  (0x100020, {24, 0, 0x40, 0, 0,  (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\odbcint.dll"}, 5, 96, ... 332, {status=0x0, info=1}, ) }, 5, 96, ... 332, {status=0x0, info=1}, ) == 0x0
 02426   868   NtCreateSection  (0xf, 0x0, 0x0, 16, 16777216, 332, ... 336, ) == 0x0
 02427   868   NtQuerySection  (336, Image, 48, ... {section info, class 1, size 48}, 0x0, ) == 0x0
 02428   868   NtClose  (332, ... ) == 0x0
 02429   868   NtMapViewOfSection  (336, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x20000000), 0x0, 94208, ) == 0x0
 02430   868   NtClose  (336, ... ) == 0x0
 02431   868   NtQueryDefaultLocale  (1, 1238752, ... ) == 0x0
 02432   868   NtAllocateVirtualMemory  (-1, 29757440, 0, 4096, 4096, 4, ... 29757440, 4096, ) == 0x0
 02433   868   NtOpenKey  (0x20019, {24, 36, 0x40, 0, 0,  (0x20019, {24, 36, 0x40, 0, 0, "SOFTWARE"}, ... 336, ) }, ... 336, ) == 0x0
 02434   868   NtClose  (336, ... ) == 0x0
 02435   868   NtOpenKey  (0x20019, {24, 140, 0x40, 0, 0,  (0x20019, {24, 140, 0x40, 0, 0, "SOFTWARE\ODBC\ODBC.INI\ODBC"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02436   868   NtOpenKey  (0x20019, {24, 36, 0x40, 0, 0,  (0x20019, {24, 36, 0x40, 0, 0, "SOFTWARE\ODBC\ODBC.INI\ODBC"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02437   868   NtOpenKey  (0x20019, {24, 140, 0x40, 0, 0,  (0x20019, {24, 140, 0x40, 0, 0, "SOFTWARE\ODBC\ODBC.INI\ODBC"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02438   868   NtOpenKey  (0x20019, {24, 36, 0x40, 0, 0,  (0x20019, {24, 36, 0x40, 0, 0, "SOFTWARE\ODBC\ODBC.INI\ODBC"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02439   868   NtOpenKey  (0x80000000, {24, 0, 0x40, 0, 0,  (0x80000000, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\odbcint.dll"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02440   868   NtQueryInformationProcess  (-1, DefaultHardErrorMode, 4, ... {process info, class 12, size 4}, 0x0, ) == 0x0
 02441   868   NtSetInformationProcess  (-1, DefaultHardErrorMode, {process info, class 12, size 4}, 4, ... ) == 0x0
 02442   868   NtCreateMutant  (0x1f0001, {24, 16, 0x80, 0, 0,  (0x1f0001, {24, 16, 0x80, 0, 0, "Bot018"}, 0, ... 336, ) }, 0, ... 336, ) == 0x0
 02443   868   NtWaitForSingleObject  (336, 0, {-300000000, -1}, ... ) == 0x0
 02444   868   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\ckxldfl32.exe"}, 1242248, ... ) }, 1242248, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02445   868   NtDelayExecution  (0, {-20000000, -1}, ... ) == 0x0
 02446   868   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\U:\WORK\PACKED.EXE"}, 1240888, ... ) }, 1240888, ... ) == 0x0
 02447   868   NtOpenFile  (0x100100, {24, 0, 0x40, 0, 0,  (0x100100, {24, 0, 0x40, 0, 0, "\??\U:\WORK\PACKED.EXE"}, 7, 2113568, ... 332, {status=0x0, info=1}, ) }, 7, 2113568, ... 332, {status=0x0, info=1}, ) == 0x0
 02448   868   NtSetInformationFile  (332, 1240864, 40, Basic, ... ) == STATUS_ACCESS_DENIED
 02449   868   NtClose  (332, ... ) == 0x0
 02450   868   NtCreateFile  (0x80100080, {24, 0, 0x40, 0, 1241136,  (0x80100080, {24, 0, 0x40, 0, 1241136, "\??\u:\work\packed.exe"}, 0x0, 0, 1, 1, 2097252, 0, 0, ... 332, {status=0x0, info=1}, ) }, 0x0, 0, 1, 1, 2097252, 0, 0, ... 332, {status=0x0, info=1}, ) == 0x0
 02451   868   NtQueryInformationFile  (332, 1241572, 8, AttributeFlag, ... {status=0x0, info=8}, ) == 0x0
 02452   868   NtQueryInformationFile  (332, 1241488, 24, Standard, ... {status=0x0, info=24}, ) == 0x0
 02453   868   NtQueryInformationFile  (332, 1241304, 40, Basic, ... {status=0x0, info=40}, ) == 0x0
 02454   868   NtAllocateVirtualMemory  (-1, 1392640, 0, 8192, 4096, 4, ... 1392640, 8192, ) == 0x0
 02455   868   NtQueryInformationFile  (332, 1389112, 4094, Stream, ... {status=0x0, info=38}, ) == 0x0
 02456   868   NtQueryInformationFile  (332, 1239752, 40, Basic, ... {status=0x0, info=40}, ) == 0x0
 02457   868   NtQueryInformationFile  (332, 1240028, 4, Ea, ... {status=0x0, info=4}, ) == 0x0
 02458   868   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\SYSTEM32\CKXLDFL32.EXE"}, 1239224, ... ) }, 1239224, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02459   868   NtCreateFile  (0x40110080, {24, 0, 0x40, 0, 1239904,  (0x40110080, {24, 0, 0x40, 0, 1239904, "\??\C:\WINDOWS\system32\ckxldfl32.exe"}, 0x0, 32, 0, 5, 100, 0, 0, ... }, 0x0, 32, 0, 5, 100, 0, 0, ...
 02460   868   NtClose  (-2147482740, ... ) == 0x0
 02459   868   NtCreateFile  ... 340, {status=0x0, info=2}, ) == 0x0
 02461   868   NtQueryVolumeInformationFile  (340, 1240056, 536, Attribute, ... {status=0x0, info=20}, ) == 0x0
 02462   868   NtQueryInformationFile  (340, 1239640, 40, Basic, ... {status=0x0, info=40}, ) == 0x0
 02463   868   NtQueryVolumeInformationFile  (332, 1240056, 536, Attribute, ... {status=0x0, info=20}, ) == 0x0
 02464   868   NtQueryVolumeInformationFile  (332, 1239400, 8, Device, ... {status=0x0, info=8}, ) == 0x0
 02465   868   NtSetInformationFile  (340, 1239956, 8, EndOfFile, ... {status=0x0, info=0}, ) == 0x0
 02466   868   NtCreateSection  (0xf001f, 0x0, 0x0, 2, 134217728, 332, ... 344, ) == 0x0
 02467   868   NtMapViewOfSection  (344, -1, (0x0), 0, 0, {0, 0}, 0, 1, 0, 2, ... (0x1d60000), {0, 0}, 110592, ) == 0x0
 02468   868   NtClose  (344, ... ) == 0x0
 02469   868   NtWriteFile  (340, 0, 0, 0,  (340, 0, 0, 0, "MZ\220\0\3\0\0\0\4\0\0\0\377\377\0\0\270\0\0\0\0\0\0\0@\0\0\0\0\0\0\0y\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\340\0\0\0\16\37\272\16\0\264\11\315!\270\1L\315!This program cannot be run in DOS mode.\15\15\12$\0\0\0\0\0\0\0,\354.\261h\215@\342h\215@\342h\215@\342\242\256g\342i\215@\342\222\251\0\342v\215@\342\222\251\\342\344\215@\342\222\256Y\342m\215@\342h\215A\342\344\215@\342\222\251]\342-\215@\342\222\251}\342i\215@\342Richh\215@\342\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0PE\0\0L\1\4\0\247\25{C\0\0\0\0\0\0\0\0\340\0\17\1\13\1\7\0\0\332\1\0\0\274\5\0\0\0\0\0\364\305\7\0\0\20\0\0\0\360\1\0\0\0@\0\0\20\0\0\0\2\0\0\4\0\0\0\0\0\0\0\4\0\0\0\0\0\0\0\0P\10\0\0\4\0\0\0\0\0\0\2\0\0\0\0\0\20\0\0\20\0\0\0\0\20\0\0\20\0\0\334\3\0\0\20\0\0\0\0\0\0\0\0\0\0\0\0\300\7\0\36\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0.text\0\0\0\304\330\1\0\0\20\0\0\0\16\1\0\0\4\0\0\0\0\0\0", 61440, 0x0, 0, ... {status=0x0, info=61440}, ) , 61440, 0x0, 0, ... {status=0x0, info=61440}, ) == 0x0
 02470   868   NtWriteFile  (340, 0, 0, 0,  (340, 0, 0, 0, "J$\230\340\235\362\222\357\23\20\13\327\200yt8\251\250^\21\212\5\16:\17uXR\323\324~\305\301N\222\16@\278\321uE\360N\241\357W\3176\25;4\322e\306\6\350\2\265\343_^\361d%\220\270+\363H\247\201~HN\3179W\347M\20G\365F\14.\357\315\352\353 \35\2\267.b\24\314\13_\203\330\330\16\210\204\304\213r\26\24\178\312\307@f\34\362\356\362\336\240\11\23\201H\341\302\235\224\342\63;r\311j+\312\240\177\2508\246\231B\14\201\361\215F\377&\232H\320\205;\15\365 \3\376s%\232\301G\6>FJ\274+\236\326<\350\227-6l\316\2645\237\24\237\36\222\351\7\36\20I7\10?a\23Sj\3641\276\223\12\365\30\276\12\366\377%\250\245&\7\372\20\4\232'[\360\237/\230\305\224\343{\226\205 \304\215|\21X\255*%\371\2\117\2038a\3002nsQ\37\25\266+\310\177\210PN\260\236\241\302\203\14\215\263J\220\377\31\342\276\276\33Ps\36\225\25\30\262\6\201\242w\3\213\360`+\326\304C\236\324\341HA\215SVv\260q}W\215\34\250<\2133\240\305\300\301P\347\267\367\274?D9\352\302\340(\177\10\332\15\37Y\222#\362g\304\352\3d\206\25E-r\260\367\221J\33/\31s\37c\10\213\270\13\27D8\14\355?\222\3524\307Ps\254\274D|\201\235\323*\234QAUj\13\203\315\370\3504\332\211\301Uy\217-!!\13\350\240\211'3\333\361\201\11\24\277L\2577'\205\366Q.\211\215\206\331\12\37^\324F\367\24uN\275\310-\210k\260Q\27\16#-\212tm\261\302\262\257 \215^\14S\254\256\200Ct\33\373X\223\213\325\337\217;\306(\5`\3;\360r\236\353\34\362\16_\300{+\7-", 49152, 0x0, 0, ... {status=0x0, info=49152}, ) , 49152, 0x0, 0, ... {status=0x0, info=49152}, ) == 0x0
 02471   868   NtUnmapViewOfSection  (-1, 0x1d60000, ... ) == 0x0
 02472   868   NtSetInformationFile  (340, 1241304, 40, Basic, ... {status=0x0, info=0}, ) == 0x0
 02473   868   NtClose  (332, ... ) == 0x0
 02474   868   NtClose  (340, ... ) == 0x0
 02475   868   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\u:\work\explorer.exe"}, 1241132, ... ) }, 1241132, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02476   868   NtQueryAttributesFile  ({24, 12, 0x40, 0, 0,  ({24, 12, 0x40, 0, 0, "explorer.exe"}, 1241132, ... ) }, 1241132, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02477   868   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\explorer.exe"}, 1241132, ... ) }, 1241132, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02478   868   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system\explorer.exe"}, 1241132, ... ) }, 1241132, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02479   868   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\explorer.exe"}, 1241132, ... ) }, 1241132, ... ) == 0x0
 02480   868   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\EXPLORER.EXE"}, 1241676, ... ) }, 1241676, ... ) == 0x0
 02481   868   NtOpenFile  (0x100100, {24, 0, 0x40, 0, 0,  (0x100100, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\EXPLORER.EXE"}, 7, 2113568, ... 340, {status=0x0, info=1}, ) }, 7, 2113568, ... 340, {status=0x0, info=1}, ) == 0x0
 02482   868   NtSetInformationFile  (340, 1241652, 40, Basic, ... {status=0x0, info=0}, ) == 0x0
 02483   868   NtClose  (340, ... ) == 0x0
 02484   868   NtCreateFile  (0xc0100080, {24, 0, 0x40, 0, 1241660,  (0xc0100080, {24, 0, 0x40, 0, 1241660, "\??\C:\WINDOWS\EXPLORER.EXE"}, 0x0, 0, 1, 1, 96, 0, 0, ... ) }, 0x0, 0, 1, 1, 96, 0, 0, ... ) == STATUS_SHARING_VIOLATION
 02485   868   NtOpenFile  (0x100100, {24, 0, 0x40, 0, 0,  (0x100100, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\EXPLORER.EXE"}, 7, 2113568, ... 340, {status=0x0, info=1}, ) }, 7, 2113568, ... 340, {status=0x0, info=1}, ) == 0x0
 02486   868   NtSetInformationFile  (340, 1241652, 40, Basic, ... {status=0x0, info=0}, ) == 0x0
 02487   868   NtClose  (340, ... ) == 0x0
 02488   868   NtCreateFile  (0x80100080, {24, 0, 0x40, 0, 1241924,  (0x80100080, {24, 0, 0x40, 0, 1241924, "\??\C:\WINDOWS\explorer.exe"}, 0x0, 128, 1, 1, 96, 0, 0, ... 340, {status=0x0, info=1}, ) }, 0x0, 128, 1, 1, 96, 0, 0, ... 340, {status=0x0, info=1}, ) == 0x0
 02489   868   NtQueryInformationFile  (340, 1241976, 40, Basic, ... {status=0x0, info=40}, ) == 0x0
 02490   868   NtClose  (340, ... ) == 0x0
 02491   868   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\SYSTEM32\CKXLDFL32.EXE"}, 1241676, ... ) }, 1241676, ... ) == 0x0
 02492   868   NtOpenFile  (0x100100, {24, 0, 0x40, 0, 0,  (0x100100, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\SYSTEM32\CKXLDFL32.EXE"}, 7, 2113568, ... 340, {status=0x0, info=1}, ) }, 7, 2113568, ... 340, {status=0x0, info=1}, ) == 0x0
 02493   868   NtSetInformationFile  (340, 1241652, 40, Basic, ... {status=0x0, info=0}, ) == 0x0
 02494   868   NtClose  (340, ... ) == 0x0
 02495   868   NtCreateFile  (0xc0100080, {24, 0, 0x40, 0, 1241660,  (0xc0100080, {24, 0, 0x40, 0, 1241660, "\??\C:\WINDOWS\SYSTEM32\CKXLDFL32.EXE"}, 0x0, 0, 1, 1, 96, 0, 0, ... 340, {status=0x0, info=1}, ) }, 0x0, 0, 1, 1, 96, 0, 0, ... 340, {status=0x0, info=1}, ) == 0x0
 02496   868   NtQueryInformationFile  (340, 1241712, 40, Basic, ... {status=0x0, info=40}, ) == 0x0
 02497   868   NtQueryInformationFile  (340, 1241712, 24, Standard, ... {status=0x0, info=24}, ) == 0x0
 02498   868   NtCreateSection  (0xf0007, 0x0, {110592, 0}, 4, 134217728, 340, ... 332, ) == 0x0
 02499   868   NtMapViewOfSection  (332, -1, (0x0), 0, 0, {0, 0}, 0, 1, 0, 4, ... (0x1d60000), {0, 0}, 110592, ) == 0x0
 02500   868   NtUnmapViewOfSection  (-1, 0x1d60000, ... ) == 0x0
 02501   868   NtClose  (332, ... ) == 0x0
 02502   868   NtSetInformationFile  (340, 1241716, 40, Basic, ... {status=0x0, info=0}, ) == 0x0
 02503   868   NtClose  (340, ... ) == 0x0
 02504   868   NtOpenFile  (0x100100, {24, 0, 0x40, 0, 0,  (0x100100, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\SYSTEM32\CKXLDFL32.EXE"}, 7, 2113568, ... 340, {status=0x0, info=1}, ) }, 7, 2113568, ... 340, {status=0x0, info=1}, ) == 0x0
 02505   868   NtSetInformationFile  (340, 1241656, 40, Basic, ... {status=0x0, info=0}, ) == 0x0
 02506   868   NtClose  (340, ... ) == 0x0
 02507   868   NtCreateFile  (0x40100080, {24, 0, 0x40, 0, 1241924,  (0x40100080, {24, 0, 0x40, 0, 1241924, "\??\C:\WINDOWS\system32\ckxldfl32.exe"}, 0x0, 128, 2, 1, 96, 0, 0, ... 340, {status=0x0, info=1}, ) }, 0x0, 128, 2, 1, 96, 0, 0, ... 340, {status=0x0, info=1}, ) == 0x0
 02508   868   NtSetInformationFile  (340, 1241976, 40, Basic, ... {status=0x0, info=0}, ) == 0x0
 02509   868   NtClose  (340, ... ) == 0x0
 02510   868   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\SYSTEM32\CKXLDFL32.EXE"}, 1242032, ... ) }, 1242032, ... ) == 0x0
 02511   868   NtOpenFile  (0x100100, {24, 0, 0x40, 0, 0,  (0x100100, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\SYSTEM32\CKXLDFL32.EXE"}, 7, 2113568, ... 340, {status=0x0, info=1}, ) }, 7, 2113568, ... 340, {status=0x0, info=1}, ) == 0x0
 02512   868   NtSetInformationFile  (340, 1242008, 40, Basic, ... {status=0x0, info=0}, ) == 0x0
 02513   868   NtClose  (340, ... ) == 0x0
 02514   868   NtCreateFile  (0xc0100080, {24, 0, 0x40, 0, 1242016,  (0xc0100080, {24, 0, 0x40, 0, 1242016, "\??\C:\WINDOWS\SYSTEM32\CKXLDFL32.EXE"}, 0x0, 0, 1, 1, 96, 0, 0, ... 340, {status=0x0, info=1}, ) }, 0x0, 0, 1, 1, 96, 0, 0, ... 340, {status=0x0, info=1}, ) == 0x0
 02515   868   NtQueryInformationFile  (340, 1242068, 40, Basic, ... {status=0x0, info=40}, ) == 0x0
 02516   868   NtQueryInformationFile  (340, 1242068, 24, Standard, ... {status=0x0, info=24}, ) == 0x0
 02517   868   NtCreateSection  (0xf0007, 0x0, {110592, 0}, 4, 134217728, 340, ... 332, ) == 0x0
 02518   868   NtMapViewOfSection  (332, -1, (0x0), 0, 0, {0, 0}, 0, 1, 0, 4, ... (0x1d60000), {0, 0}, 110592, ) == 0x0
 02519   868   NtUnmapViewOfSection  (-1, 0x1d60000, ... ) == 0x0
 02520   868   NtClose  (332, ... ) == 0x0
 02521   868   NtSetInformationFile  (340, 1242072, 40, Basic, ... {status=0x0, info=0}, ) == 0x0
 02522   868   NtClose  (340, ... ) == 0x0
 02523   868   NtOpenFile  (0x100100, {24, 0, 0x40, 0, 0,  (0x100100, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\SYSTEM32\CKXLDFL32.EXE"}, 7, 2113568, ... 340, {status=0x0, info=1}, ) }, 7, 2113568, ... 340, {status=0x0, info=1}, ) == 0x0
 02524   868   NtSetInformationFile  (340, 1242012, 40, Basic, ... {status=0x0, info=0}, ) == 0x0
 02525   868   NtClose  (340, ... ) == 0x0
 02526   868   NtOpenFile  (0x100100, {24, 0, 0x40, 0, 0,  (0x100100, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\ckxldfl32.exe"}, 7, 2113568, ... 340, {status=0x0, info=1}, ) }, 7, 2113568, ... 340, {status=0x0, info=1}, ) == 0x0
 02527   868   NtSetInformationFile  (340, 1242224, 40, Basic, ... {status=0x0, info=0}, ) == 0x0
 02528   868   NtClose  (340, ... ) == 0x0
 02529   868   NtOpenProcess  (0x100000, {24, 0, 0x2, 0, 0, 0x0}, {1228, 0}, ... 340, ) == 0x0
 02530   868   NtQueryInformationJobObject  (0, BasicUIRestrictions, 4, ... ) == STATUS_ACCESS_DENIED
 02531   868   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\SYSTEM32\CKXLDFL32.EXE"}, 1239240, ... ) }, 1239240, ... ) == 0x0
 02532   868   NtOpenFile  (0x100100, {24, 0, 0x40, 0, 0,  (0x100100, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\SYSTEM32\CKXLDFL32.EXE"}, 7, 2113568, ... 332, {status=0x0, info=1}, ) }, 7, 2113568, ... 332, {status=0x0, info=1}, ) == 0x0
 02533   868   NtSetInformationFile  (332, 1239216, 40, Basic, ... {status=0x0, info=0}, ) == 0x0
 02534   868   NtClose  (332, ... ) == 0x0
 02535   868   NtCreateFile  (0xc0100080, {24, 0, 0x40, 0, 1239224,  (0xc0100080, {24, 0, 0x40, 0, 1239224, "\??\C:\WINDOWS\SYSTEM32\CKXLDFL32.EXE"}, 0x0, 0, 1, 1, 96, 0, 0, ... 332, {status=0x0, info=1}, ) }, 0x0, 0, 1, 1, 96, 0, 0, ... 332, {status=0x0, info=1}, ) == 0x0
 02536   868   NtQueryInformationFile  (332, 1239276, 40, Basic, ... {status=0x0, info=40}, ) == 0x0
 02537   868   NtQueryInformationFile  (332, 1239276, 24, Standard, ... {status=0x0, info=24}, ) == 0x0
 02538   868   NtCreateSection  (0xf0007, 0x0, {110592, 0}, 4, 134217728, 332, ... 344, ) == 0x0
 02539   868   NtMapViewOfSection  (344, -1, (0x0), 0, 0, {0, 0}, 0, 1, 0, 4, ... (0x1d60000), {0, 0}, 110592, ) == 0x0
 02540   868   NtUnmapViewOfSection  (-1, 0x1d60000, ... ) == 0x0
 02541   868   NtClose  (344, ... ) == 0x0
 02542   868   NtSetInformationFile  (332, 1239280, 40, Basic, ... {status=0x0, info=0}, ) == 0x0
 02543   868   NtClose  (332, ... ) == 0x0
 02544   868   NtOpenFile  (0x100100, {24, 0, 0x40, 0, 0,  (0x100100, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\SYSTEM32\CKXLDFL32.EXE"}, 7, 2113568, ... 332, {status=0x0, info=1}, ) }, 7, 2113568, ... 332, {status=0x0, info=1}, ) == 0x0
 02545   868   NtSetInformationFile  (332, 1239220, 40, Basic, ... {status=0x0, info=0}, ) == 0x0
 02546   868   NtClose  (332, ... ) == 0x0
 02547   868   NtOpenFile  (0x1000a1, {24, 0, 0x40, 0, 0,  (0x1000a1, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\ckxldfl32.exe"}, 5, 96, ... 332, {status=0x0, info=1}, ) }, 5, 96, ... 332, {status=0x0, info=1}, ) == 0x0
 02548   868   NtCreateSection  (0xf001f, 0x0, 0x0, 16, 16777216, 332, ... 344, ) == 0x0
 02549   868   NtOpenKey  (0x1, {24, 0, 0x40, 0, 0,  (0x1, {24, 0, 0x40, 0, 0, "\Registry\MACHINE\System\CurrentControlSet\Control\Session Manager\AppCertDlls"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02550   868   NtOpenKey  (0x1, {24, 0, 0x40, 0, 0,  (0x1, {24, 0, 0x40, 0, 0, "\Registry\MACHINE\System\CurrentControlSet\Control\Session Manager\AppCompatibility"}, ... 348, ) }, ... 348, ) == 0x0
 02551   868   NtQueryValueKey  (348,  (348, "DisableAppCompat", Partial, 20, ... ) , Partial, 20, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02552   868   NtClose  (348, ... ) == 0x0
 02553   868   NtQueryVolumeInformationFile  (332, 1238600, 8, Device, ... {status=0x0, info=8}, ) == 0x0
 02554   868   NtOpenMutant  (0x120001, {24, 16, 0x0, 0, 0,  (0x120001, {24, 16, 0x0, 0, 0, "ShimCacheMutex"}, ... 348, ) }, ... 348, ) == 0x0
 02555   868   NtWaitForSingleObject  (348, 0, {-1000000, -1}, ... ) == 0x0
 02556   868   NtOpenSection  (0x2, {24, 16, 0x0, 0, 0,  (0x2, {24, 16, 0x0, 0, 0, "ShimSharedMemory"}, ... 352, ) }, ... 352, ) == 0x0
 02557   868   NtMapViewOfSection  (352, -1, (0x0), 0, 0, {0, 0}, 0, 1, 0, 4, ... (0x1d60000), {0, 0}, 57344, ) == 0x0
 02558   868   NtReleaseMutant  (348, ... 0x0, ) == 0x0
 02559   868   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\Apphelp.dll"}, 1236532, ... ) }, 1236532, ... ) == 0x0
 02560   868   NtOpenFile  (0x100020, {24, 0, 0x40, 0, 0,  (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\Apphelp.dll"}, 5, 96, ... 356, {status=0x0, info=1}, ) }, 5, 96, ... 356, {status=0x0, info=1}, ) == 0x0
 02561   868   NtCreateSection  (0xe, 0x0, 0x0, 16, 134217728, 356, ... 360, ) == 0x0
 02562   868   NtClose  (356, ... ) == 0x0
 02563   868   NtMapViewOfSection  (360, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 16, ... (0x1d70000), 0x0, 126976, ) == 0x0
 02564   868   NtClose  (360, ... ) == 0x0
 02565   868   NtUnmapViewOfSection  (-1, 0x1d70000, ... ) == 0x0
 02566   868   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\Apphelp.dll"}, 1236840, ... ) }, 1236840, ... ) == 0x0
 02567   868   NtOpenFile  (0x100020, {24, 0, 0x40, 0, 0,  (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\Apphelp.dll"}, 5, 96, ... 360, {status=0x0, info=1}, ) }, 5, 96, ... 360, {status=0x0, info=1}, ) == 0x0
 02568   868   NtCreateSection  (0xf, 0x0, 0x0, 16, 16777216, 360, ... 356, ) == 0x0
 02569   868   NtQuerySection  (356, Image, 48, ... {section info, class 1, size 48}, 0x0, ) == 0x0
 02570   868   NtClose  (360, ... ) == 0x0
 02571   868   NtMapViewOfSection  (356, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x77b40000), 0x0, 139264, ) == 0x0
 02572   868   NtClose  (356, ... ) == 0x0
 02573   868   NtProtectVirtualMemory  (-1, (0x77b41000), 524, 4, ... (0x77b41000), 4096, 32, ) == 0x0
 02574   868   NtProtectVirtualMemory  (-1, (0x77b41000), 4096, 32, ... (0x77b41000), 4096, 4, ) == 0x0
 02575   868   NtFlushInstructionCache  (-1, 2008289280, 524, ... ) == 0x0
 02576   868   NtOpenKey  (0x80000000, {24, 0, 0x40, 0, 0,  (0x80000000, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Apphelp.dll"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02577   868   NtCreateFile  (0x80100080, {24, 0, 0x40, 0, 0,  (0x80100080, {24, 0, 0x40, 0, 0, "\SystemRoot\AppPatch\sysmain.sdb"}, 0x0, 128, 1, 1, 96, 0, 0, ... 356, {status=0x0, info=1}, ) }, 0x0, 128, 1, 1, 96, 0, 0, ... 356, {status=0x0, info=1}, ) == 0x0
 02578   868   NtQueryInformationFile  (356, 1236856, 24, Standard, ... {status=0x0, info=24}, ) == 0x0
 02579   868   NtCreateSection  (0x4, 0x0, 0x0, 2, 134217728, 356, ... 360, ) == 0x0
 02580   868   NtMapViewOfSection  (360, -1, (0x0), 0, 0, 0x0, 0, 2, 0, 2, ... (0x1d70000), 0x0, 1191936, ) == 0x0
 02581   868   NtQueryInformationFile  (356, 1236956, 24, Standard, ... {status=0x0, info=24}, ) == 0x0
 02582   868   NtCreateFile  (0x80100080, {24, 0, 0x40, 0, 0,  (0x80100080, {24, 0, 0x40, 0, 0, "\SystemRoot\AppPatch\systest.sdb"}, 0x0, 128, 1, 1, 96, 0, 0, ... ) }, 0x0, 128, 1, 1, 96, 0, 0, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02583   868   NtQuerySystemInformation  (Processor, 12, ... {system info, class 1, size 12}, 0x0, ) == 0x0
 02584   868   NtQueryInformationProcess  (-1, Wow64, 4, ... {process info, class 26, size 4}, 0x0, ) == 0x0
 02585   868   NtOpenKey  (0x101, {24, 0, 0x40, 0, 0,  (0x101, {24, 0, 0x40, 0, 0, "\Registry\Machine\System\WPA\TabletPC"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02586   868   NtOpenKey  (0x101, {24, 0, 0x40, 0, 0,  (0x101, {24, 0, 0x40, 0, 0, "\Registry\Machine\SYSTEM\WPA\MediaCenter"}, ... 364, ) }, ... 364, ) == 0x0
 02587   868   NtQueryValueKey  (364,  (364, "Installed", Partial, 256, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) , Partial, 256, ... TitleIdx=0, Type=4, Data= (364, "Installed", Partial, 256, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) }, 16, ) == 0x0
 02588   868   NtClose  (364, ... ) == 0x0
 02589   868   NtCreateFile  (0x120116, {24, 0, 0x40, 0, 0,  (0x120116, {24, 0, 0x40, 0, 0, "\Device\NamedPipe\ShimViewer"}, 0x0, 128, 0, 1, 0, 0, 0, ... ) }, 0x0, 128, 0, 1, 0, 0, 0, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02590   868   NtOpenFile  (0x100001, {24, 0, 0x40, 0, 0,  (0x100001, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\"}, 3, 16417, ... 364, {status=0x0, info=1}, ) }, 3, 16417, ... 364, {status=0x0, info=1}, ) == 0x0
 02591   868   NtQueryDirectoryFile  (364, 0, 0, 0, 1234552, 616, BothDirectory, 1,  (364, 0, 0, 0, 1234552, 616, BothDirectory, 1, "ckxldfl32.exe", 0, ... {status=0x0, info=120}, ) , 0, ... {status=0x0, info=120}, ) == 0x0
 02592   868   NtClose  (364, ... ) == 0x0
 02593   868   NtQueryInformationProcess  (-1, DefaultHardErrorMode, 4, ... {process info, class 12, size 4}, 0x0, ) == 0x0
 02594   868   NtSetInformationProcess  (-1, DefaultHardErrorMode, {process info, class 12, size 4}, 4, ... ) == 0x0
 02595   868   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\ckxldfl32.exe"}, 1234928, ... ) }, 1234928, ... ) == 0x0
 02596   868   NtOpenFile  (0x100001, {24, 0, 0x40, 0, 0,  (0x100001, {24, 0, 0x40, 0, 0, "\??\C:\"}, 3, 16417, ... 364, {status=0x0, info=1}, ) }, 3, 16417, ... 364, {status=0x0, info=1}, ) == 0x0
 02597   868   NtQueryDirectoryFile  (364, 0, 0, 0, 1234356, 616, BothDirectory, 1,  (364, 0, 0, 0, 1234356, 616, BothDirectory, 1, "WINDOWS", 0, ... {status=0x0, info=108}, ) , 0, ... {status=0x0, info=108}, ) == 0x0
 02598   868   NtClose  (364, ... ) == 0x0
 02599   868   NtOpenFile  (0x100001, {24, 0, 0x40, 0, 0,  (0x100001, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\"}, 3, 16417, ... 364, {status=0x0, info=1}, ) }, 3, 16417, ... 364, {status=0x0, info=1}, ) == 0x0
 02600   868   NtQueryDirectoryFile  (364, 0, 0, 0, 1234356, 616, BothDirectory, 1,  (364, 0, 0, 0, 1234356, 616, BothDirectory, 1, "system32", 0, ... {status=0x0, info=110}, ) , 0, ... {status=0x0, info=110}, ) == 0x0
 02601   868   NtClose  (364, ... ) == 0x0
 02602   868   NtQueryInformationProcess  (-1, DefaultHardErrorMode, 4, ... {process info, class 12, size 4}, 0x0, ) == 0x0
 02603   868   NtSetInformationProcess  (-1, DefaultHardErrorMode, {process info, class 12, size 4}, 4, ... ) == 0x0
 02604   868   NtQueryInformationProcess  (-1, DeviceMap, 36, ... {process info, class 23, size 36}, 0x0, ) == 0x0
 02605   868   NtOpenKey  (0x80000100, {24, 0, 0x40, 0, 0,  (0x80000100, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Layers"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02606   868   NtOpenThreadTokenEx  (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN
 02607   868   NtOpenProcessTokenEx  (-1, 0x20008, 512, ... 364, ) == 0x0
 02608   868   NtQueryInformationToken  (364, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0
 02609   868   NtClose  (364, ... ) == 0x0
 02610   868   NtOpenKey  (0x80000100, {24, 0, 0x40, 0, 0,  (0x80000100, {24, 0, 0x40, 0, 0, "\REGISTRY\USER\S-1-5-21-1292428093-1383384898-725345543-1003\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Layers"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02611   868   NtOpenKey  (0x80000100, {24, 0, 0x40, 0, 0,  (0x80000100, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Custom\ckxldfl32.exe"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02612   868   NtQueryInformationProcess  (-1, DefaultHardErrorMode, 4, ... {process info, class 12, size 4}, 0x0, ) == 0x0
 02613   868   NtSetInformationProcess  (-1, DefaultHardErrorMode, {process info, class 12, size 4}, 4, ... ) == 0x0
 02614   868   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\ckxldfl32.exe"}, 1236180, ... ) }, 1236180, ... ) == 0x0
 02615   868   NtOpenFile  (0x100001, {24, 0, 0x40, 0, 0,  (0x100001, {24, 0, 0x40, 0, 0, "\??\C:\"}, 3, 16417, ... 364, {status=0x0, info=1}, ) }, 3, 16417, ... 364, {status=0x0, info=1}, ) == 0x0
 02616   868   NtQueryDirectoryFile  (364, 0, 0, 0, 1235608, 616, BothDirectory, 1,  (364, 0, 0, 0, 1235608, 616, BothDirectory, 1, "WINDOWS", 0, ... {status=0x0, info=108}, ) , 0, ... {status=0x0, info=108}, ) == 0x0
 02617   868   NtClose  (364, ... ) == 0x0
 02618   868   NtOpenFile  (0x100001, {24, 0, 0x40, 0, 0,  (0x100001, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\"}, 3, 16417, ... 364, {status=0x0, info=1}, ) }, 3, 16417, ... 364, {status=0x0, info=1}, ) == 0x0
 02619   868   NtQueryDirectoryFile  (364, 0, 0, 0, 1235608, 616, BothDirectory, 1,  (364, 0, 0, 0, 1235608, 616, BothDirectory, 1, "system32", 0, ... {status=0x0, info=110}, ) , 0, ... {status=0x0, info=110}, ) == 0x0
 02620   868   NtClose  (364, ... ) == 0x0
 02621   868   NtQueryInformationProcess  (-1, DefaultHardErrorMode, 4, ... {process info, class 12, size 4}, 0x0, ) == 0x0
 02622   868   NtSetInformationProcess  (-1, DefaultHardErrorMode, {process info, class 12, size 4}, 4, ... ) == 0x0
 02623   868   NtWaitForSingleObject  (348, 0, {-1000000, -1}, ... ) == 0x0
 02624   868   NtQueryVolumeInformationFile  (332, 1236836, 8, Device, ... {status=0x0, info=8}, ) == 0x0
 02625   868   NtQueryInformationFile  (332, 1236816, 40, Basic, ... {status=0x0, info=40}, ) == 0x0
 02626   868   NtQueryInformationFile  (332, 1236856, 24, Standard, ... {status=0x0, info=24}, ) == 0x0
 02627   868   NtReleaseMutant  (348, ... 0x0, ) == 0x0
 02628   868   NtUnmapViewOfSection  (-1, 0x1d70000, ... ) == 0x0
 02629   868   NtClose  (360, ... ) == 0x0
 02630   868   NtClose  (356, ... ) == 0x0
 02631   868   NtOpenThreadToken  (-2, 0x2000000, 1, ... ) == STATUS_NO_TOKEN
 02632   868   NtOpenProcessToken  (-1, 0xa, ... 356, ) == 0x0
 02633   868   NtQueryInformationToken  (356, User, 136, ... {token info, class 1, size 36}, 36, ) == 0x0
 02634   868   NtOpenKey  (0x3, {24, 0, 0x40, 0, 0,  (0x3, {24, 0, 0x40, 0, 0, "\Registry\MACHINE\System\CurrentControlSet\Control\SafeBoot\Option"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02635   868   NtOpenKey  (0x1, {24, 0, 0x40, 0, 0,  (0x1, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers"}, ... 360, ) }, ... 360, ) == 0x0
 02636   868   NtQueryValueKey  (360,  (360, "TransparentEnabled", Partial, 80, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) , Partial, 80, ... TitleIdx=0, Type=4, Data= (360, "TransparentEnabled", Partial, 80, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) }, 16, ) == 0x0
 02637   868   NtQueryValueKey  (360,  (360, "AuthenticodeEnabled", Partial, 80, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) , Partial, 80, ... TitleIdx=0, Type=4, Data= (360, "AuthenticodeEnabled", Partial, 80, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) }, 16, ) == 0x0
 02638   868   NtClose  (360, ... ) == 0x0
 02639   868   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Policies\Microsoft\Windows\Safer\LevelObjects"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02640   868   NtOpenKey  (0x1, {24, 0, 0x40, 0, 0,  (0x1, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers"}, ... 360, ) }, ... 360, ) == 0x0
 02641   868   NtQueryValueKey  (360,  (360, "Levels", Partial, 536, ... ) , Partial, 536, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02642   868   NtClose  (360, ... ) == 0x0
 02643   868   NtQueryDefaultLocale  (1, 1238028, ... ) == 0x0
 02644   868   NtQueryDefaultLocale  (1, 1238028, ... ) == 0x0
 02645   868   NtQueryDefaultLocale  (1, 1238028, ... ) == 0x0
 02646   868   NtQueryDefaultLocale  (1, 1238028, ... ) == 0x0
 02647   868   NtQueryDefaultLocale  (1, 1238028, ... ) == 0x0
 02648   868   NtQueryDefaultLocale  (1, 1238028, ... ) == 0x0
 02649   868   NtQueryDefaultLocale  (1, 1238028, ... ) == 0x0
 02650   868   NtQueryDefaultLocale  (1, 1238028, ... ) == 0x0
 02651   868   NtQueryDefaultLocale  (1, 1238028, ... ) == 0x0
 02652   868   NtQueryDefaultLocale  (1, 1238028, ... ) == 0x0
 02653   868   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\0\Paths"}, ... 360, ) }, ... 360, ) == 0x0
 02654   868   NtEnumerateKey  (360, 0, Basic, 280, ... {LastWrite={0x3a5edea,0x1c74da9}, TitleIdx=0, Name= (360, 0, Basic, 280, ... {LastWrite={0x3a5edea,0x1c74da9}, TitleIdx=0, Name="{dda3f824-d8cb-441b-834d-be2efd2c1a33}"}, 92, ) }, 92, ) == 0x0
 02655   868   NtOpenKey  (0x20019, {24, 360, 0x40, 0, 0,  (0x20019, {24, 360, 0x40, 0, 0, "{dda3f824-d8cb-441b-834d-be2efd2c1a33}"}, ... 364, ) }, ... 364, ) == 0x0
 02656   868   NtQueryValueKey  (364,  (364, "ItemData", Partial, 280, ... TitleIdx=0, Type=2, Data="%\0H\0K\0E\0Y\0_\0C\0U\0R\0R\0E\0N\0T\0_\0U\0S\0E\0R\0\\0S\0o\0f\0t\0w\0a\0r\0e\0\\0M\0i\0c\0r\0o\0s\0o\0f\0t\0\\0W\0i\0n\0d\0o\0w\0s\0\\0C\0u\0r\0r\0e\0n\0t\0V\0e\0r\0s\0i\0o\0n\0\\0E\0x\0p\0l\0o\0r\0e\0r\0\\0S\0h\0e\0l\0l\0 \0F\0o\0l\0d\0e\0r\0s\0\\0C\0a\0c\0h\0e\0%\0O\0L\0K\0*\0\0\0"}, 202, ) , Partial, 280, ... TitleIdx=0, Type=2, Data= (364, "ItemData", Partial, 280, ... TitleIdx=0, Type=2, Data="%\0H\0K\0E\0Y\0_\0C\0U\0R\0R\0E\0N\0T\0_\0U\0S\0E\0R\0\\0S\0o\0f\0t\0w\0a\0r\0e\0\\0M\0i\0c\0r\0o\0s\0o\0f\0t\0\\0W\0i\0n\0d\0o\0w\0s\0\\0C\0u\0r\0r\0e\0n\0t\0V\0e\0r\0s\0i\0o\0n\0\\0E\0x\0p\0l\0o\0r\0e\0r\0\\0S\0h\0e\0l\0l\0 \0F\0o\0l\0d\0e\0r\0s\0\\0C\0a\0c\0h\0e\0%\0O\0L\0K\0*\0\0\0"}, 202, ) }, 202, ) == 0x0
 02657   868   NtQueryValueKey  (364,  (364, "SaferFlags", Partial, 280, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) , Partial, 280, ... TitleIdx=0, Type=4, Data= (364, "SaferFlags", Partial, 280, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) }, 16, ) == 0x0
 02658   868   NtClose  (364, ... ) == 0x0
 02659   868   NtEnumerateKey  (360, 1, Basic, 280, ... ) == STATUS_NO_MORE_ENTRIES
 02660   868   NtClose  (360, ... ) == 0x0
 02661   868   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\0\Hashes"}, ... 360, ) }, ... 360, ) == 0x0
 02662   868   NtEnumerateKey  (360, 0, Basic, 280, ... {LastWrite={0x38ab3b74,0x1c74d7e}, TitleIdx=0, Name= (360, 0, Basic, 280, ... {LastWrite={0x38ab3b74,0x1c74d7e}, TitleIdx=0, Name="{349d35ab-37b5-462f-9b89-edd5fbde1328}"}, 92, ) }, 92, ) == 0x0
 02663   868   NtOpenKey  (0x20019, {24, 360, 0x40, 0, 0,  (0x20019, {24, 360, 0x40, 0, 0, "{349d35ab-37b5-462f-9b89-edd5fbde1328}"}, ... 364, ) }, ... 364, ) == 0x0
 02664   868   NtQueryValueKey  (364,  (364, "ItemData", Partial, 280, ... TitleIdx=0, Type=3, Data="^\2530O\225zI\211j\0l\341\25@\25"}, 28, ) , Partial, 280, ... TitleIdx=0, Type=3, Data= (364, "ItemData", Partial, 280, ... TitleIdx=0, Type=3, Data="^\2530O\225zI\211j\0l\341\25@\25"}, 28, ) }, 28, ) == 0x0
 02665   868   NtQueryValueKey  (364,  (364, "HashAlg", Partial, 280, ... TitleIdx=0, Type=4, Data="\3\200\0\0"}, 16, ) , Partial, 280, ... TitleIdx=0, Type=4, Data= (364, "HashAlg", Partial, 280, ... TitleIdx=0, Type=4, Data="\3\200\0\0"}, 16, ) }, 16, ) == 0x0
 02666   868   NtQueryValueKey  (364,  (364, "ItemSize", Partial, 280, ... TitleIdx=0, Type=11, Data="\13\3\0\0\0\0\0\0"}, 20, ) , Partial, 280, ... TitleIdx=0, Type=11, Data= (364, "ItemSize", Partial, 280, ... TitleIdx=0, Type=11, Data="\13\3\0\0\0\0\0\0"}, 20, ) }, 20, ) == 0x0
 02667   868   NtQueryValueKey  (364,  (364, "SaferFlags", Partial, 280, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) , Partial, 280, ... TitleIdx=0, Type=4, Data= (364, "SaferFlags", Partial, 280, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) }, 16, ) == 0x0
 02668   868   NtClose  (364, ... ) == 0x0
 02669   868   NtEnumerateKey  (360, 1, Basic, 280, ... {LastWrite={0x38ab3b74,0x1c74d7e}, TitleIdx=0, Name= (360, 1, Basic, 280, ... {LastWrite={0x38ab3b74,0x1c74d7e}, TitleIdx=0, Name="{7fb9cd2e-3076-4df9-a57b-b813f72dbb91}"}, 92, ) }, 92, ) == 0x0
 02670   868   NtOpenKey  (0x20019, {24, 360, 0x40, 0, 0,  (0x20019, {24, 360, 0x40, 0, 0, "{7fb9cd2e-3076-4df9-a57b-b813f72dbb91}"}, ... 364, ) }, ... 364, ) == 0x0
 02671   868   NtQueryValueKey  (364,  (364, "ItemData", Partial, 280, ... TitleIdx=0, Type=3, Data="g\260\324\2134:?\323\274\351\334dg\4\363\224"}, 28, ) , Partial, 280, ... TitleIdx=0, Type=3, Data= (364, "ItemData", Partial, 280, ... TitleIdx=0, Type=3, Data="g\260\324\2134:?\323\274\351\334dg\4\363\224"}, 28, ) }, 28, ) == 0x0
 02672   868   NtQueryValueKey  (364,  (364, "HashAlg", Partial, 280, ... TitleIdx=0, Type=4, Data="\3\200\0\0"}, 16, ) , Partial, 280, ... TitleIdx=0, Type=4, Data= (364, "HashAlg", Partial, 280, ... TitleIdx=0, Type=4, Data="\3\200\0\0"}, 16, ) }, 16, ) == 0x0
 02673   868   NtQueryValueKey  (364,  (364, "ItemSize", Partial, 280, ... TitleIdx=0, Type=11, Data="\5\2\0\0\0\0\0\0"}, 20, ) , Partial, 280, ... TitleIdx=0, Type=11, Data= (364, "ItemSize", Partial, 280, ... TitleIdx=0, Type=11, Data="\5\2\0\0\0\0\0\0"}, 20, ) }, 20, ) == 0x0
 02674   868   NtQueryValueKey  (364,  (364, "SaferFlags", Partial, 280, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) , Partial, 280, ... TitleIdx=0, Type=4, Data= (364, "SaferFlags", Partial, 280, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) }, 16, ) == 0x0
 02675   868   NtClose  (364, ... ) == 0x0
 02676   868   NtEnumerateKey  (360, 2, Basic, 280, ... {LastWrite={0x38ab3b74,0x1c74d7e}, TitleIdx=0, Name= (360, 2, Basic, 280, ... {LastWrite={0x38ab3b74,0x1c74d7e}, TitleIdx=0, Name="{81d1fe15-dd9d-4762-b16d-7c29ddecae3f}"}, 92, ) }, 92, ) == 0x0
 02677   868   NtOpenKey  (0x20019, {24, 360, 0x40, 0, 0,  (0x20019, {24, 360, 0x40, 0, 0, "{81d1fe15-dd9d-4762-b16d-7c29ddecae3f}"}, ... 364, ) }, ... 364, ) == 0x0
 02678   868   NtQueryValueKey  (364,  (364, "ItemData", Partial, 280, ... TitleIdx=0, Type=3, Data="2x\2\334\376\370\310\223\334\212\260\6\335\204}\35"}, 28, ) , Partial, 280, ... TitleIdx=0, Type=3, Data= (364, "ItemData", Partial, 280, ... TitleIdx=0, Type=3, Data="2x\2\334\376\370\310\223\334\212\260\6\335\204}\35"}, 28, ) }, 28, ) == 0x0
 02679   868   NtQueryValueKey  (364,  (364, "HashAlg", Partial, 280, ... TitleIdx=0, Type=4, Data="\3\200\0\0"}, 16, ) , Partial, 280, ... TitleIdx=0, Type=4, Data= (364, "HashAlg", Partial, 280, ... TitleIdx=0, Type=4, Data="\3\200\0\0"}, 16, ) }, 16, ) == 0x0
 02680   868   NtQueryValueKey  (364,  (364, "ItemSize", Partial, 280, ... TitleIdx=0, Type=11, Data="\226\3\0\0\0\0\0\0"}, 20, ) , Partial, 280, ... TitleIdx=0, Type=11, Data= (364, "ItemSize", Partial, 280, ... TitleIdx=0, Type=11, Data="\226\3\0\0\0\0\0\0"}, 20, ) }, 20, ) == 0x0
 02681   868   NtQueryValueKey  (364,  (364, "SaferFlags", Partial, 280, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) , Partial, 280, ... TitleIdx=0, Type=4, Data= (364, "SaferFlags", Partial, 280, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) }, 16, ) == 0x0
 02682   868   NtClose  (364, ... ) == 0x0
 02683   868   NtEnumerateKey  (360, 3, Basic, 280, ... {LastWrite={0x38ab3b74,0x1c74d7e}, TitleIdx=0, Name= (360, 3, Basic, 280, ... {LastWrite={0x38ab3b74,0x1c74d7e}, TitleIdx=0, Name="{94e3e076-8f53-42a5-8411-085bcc18a68d}"}, 92, ) }, 92, ) == 0x0
 02684   868   NtOpenKey  (0x20019, {24, 360, 0x40, 0, 0,  (0x20019, {24, 360, 0x40, 0, 0, "{94e3e076-8f53-42a5-8411-085bcc18a68d}"}, ... 364, ) }, ... 364, ) == 0x0
 02685   868   NtQueryValueKey  (364,  (364, "ItemData", Partial, 280, ... TitleIdx=0, Type=3, Data="\275\232*\333B\353\330V\16%\16M\370\26/g"}, 28, ) , Partial, 280, ... TitleIdx=0, Type=3, Data= (364, "ItemData", Partial, 280, ... TitleIdx=0, Type=3, Data="\275\232*\333B\353\330V\16%\16M\370\26/g"}, 28, ) }, 28, ) == 0x0
 02686   868   NtQueryValueKey  (364,  (364, "HashAlg", Partial, 280, ... TitleIdx=0, Type=4, Data="\3\200\0\0"}, 16, ) , Partial, 280, ... TitleIdx=0, Type=4, Data= (364, "HashAlg", Partial, 280, ... TitleIdx=0, Type=4, Data="\3\200\0\0"}, 16, ) }, 16, ) == 0x0
 02687   868   NtQueryValueKey  (364,  (364, "ItemSize", Partial, 280, ... TitleIdx=0, Type=11, Data="\345\0\0\0\0\0\0\0"}, 20, ) , Partial, 280, ... TitleIdx=0, Type=11, Data= (364, "ItemSize", Partial, 280, ... TitleIdx=0, Type=11, Data="\345\0\0\0\0\0\0\0"}, 20, ) }, 20, ) == 0x0
 02688   868   NtQueryValueKey  (364,  (364, "SaferFlags", Partial, 280, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) , Partial, 280, ... TitleIdx=0, Type=4, Data= (364, "SaferFlags", Partial, 280, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) }, 16, ) == 0x0
 02689   868   NtClose  (364, ... ) == 0x0
 02690   868   NtEnumerateKey  (360, 4, Basic, 280, ... {LastWrite={0x38ab3b74,0x1c74d7e}, TitleIdx=0, Name= (360, 4, Basic, 280, ... {LastWrite={0x38ab3b74,0x1c74d7e}, TitleIdx=0, Name="{dc971ee5-44eb-4fe4-ae2e-b91490411bfc}"}, 92, ) }, 92, ) == 0x0
 02691   868   NtOpenKey  (0x20019, {24, 360, 0x40, 0, 0,  (0x20019, {24, 360, 0x40, 0, 0, "{dc971ee5-44eb-4fe4-ae2e-b91490411bfc}"}, ... 364, ) }, ... 364, ) == 0x0
 02692   868   NtQueryValueKey  (364,  (364, "ItemData", Partial, 280, ... TitleIdx=0, Type=3, Data="8k\10_\204\354\366i\323k\225j"\300\36\200"}, 28, ) , Partial, 280, ... TitleIdx=0, Type=3, Data= (364, "ItemData", Partial, 280, ... TitleIdx=0, Type=3, Data="8k\10_\204\354\366i\323k\225j"\300\36\200"}, 28, ) \300\36\200"}, 28, ) == 0x0
 02693   868   NtQueryValueKey  (364,  (364, "HashAlg", Partial, 280, ... TitleIdx=0, Type=4, Data="\3\200\0\0"}, 16, ) , Partial, 280, ... TitleIdx=0, Type=4, Data= (364, "HashAlg", Partial, 280, ... TitleIdx=0, Type=4, Data="\3\200\0\0"}, 16, ) }, 16, ) == 0x0
 02694   868   NtQueryValueKey  (364,  (364, "ItemSize", Partial, 280, ... TitleIdx=0, Type=11, Data="r\1\0\0\0\0\0\0"}, 20, ) , Partial, 280, ... TitleIdx=0, Type=11, Data= (364, "ItemSize", Partial, 280, ... TitleIdx=0, Type=11, Data="r\1\0\0\0\0\0\0"}, 20, ) }, 20, ) == 0x0
 02695   868   NtQueryValueKey  (364,  (364, "SaferFlags", Partial, 280, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) , Partial, 280, ... TitleIdx=0, Type=4, Data= (364, "SaferFlags", Partial, 280, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) }, 16, ) == 0x0
 02696   868   NtClose  (364, ... ) == 0x0
 02697   868   NtEnumerateKey  (360, 5, Basic, 280, ... ) == STATUS_NO_MORE_ENTRIES
 02698   868   NtClose  (360, ... ) == 0x0
 02699   868   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\0\UrlZones"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02700   868   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\4096\Paths"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02701   868   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\4096\Hashes"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02702   868   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\4096\UrlZones"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02703   868   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\65536\Paths"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02704   868   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\65536\Hashes"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02705   868   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\65536\UrlZones"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02706   868   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\131072\Paths"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02707   868   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\131072\Hashes"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02708   868   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\131072\UrlZones"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02709   868   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\262144\Paths"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02710   868   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\262144\Hashes"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02711   868   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\262144\UrlZones"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02712   868   NtOpenThreadTokenEx  (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN
 02713   868   NtOpenProcessTokenEx  (-1, 0x20008, 512, ... 360, ) == 0x0
 02714   868   NtQueryInformationToken  (360, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0
 02715   868   NtClose  (360, ... ) == 0x0
 02716   868   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\REGISTRY\USER\S-1-5-21-1292428093-1383384898-725345543-1003\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\0\Paths"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02717   868   NtOpenThreadTokenEx  (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN
 02718   868   NtOpenProcessTokenEx  (-1, 0x20008, 512, ... 360, ) == 0x0
 02719   868   NtQueryInformationToken  (360, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0
 02720   868   NtClose  (360, ... ) == 0x0
 02721   868   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\REGISTRY\USER\S-1-5-21-1292428093-1383384898-725345543-1003\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\0\Hashes"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02722   868   NtOpenThreadTokenEx  (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN
 02723   868   NtOpenProcessTokenEx  (-1, 0x20008, 512, ... 360, ) == 0x0
 02724   868   NtQueryInformationToken  (360, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0
 02725   868   NtClose  (360, ... ) == 0x0
 02726   868   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\REGISTRY\USER\S-1-5-21-1292428093-1383384898-725345543-1003\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\0\UrlZones"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02727   868   NtOpenThreadTokenEx  (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN
 02728   868   NtOpenProcessTokenEx  (-1, 0x20008, 512, ... 360, ) == 0x0
 02729   868   NtQueryInformationToken  (360, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0
 02730   868   NtClose  (360, ... ) == 0x0
 02731   868   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\REGISTRY\USER\S-1-5-21-1292428093-1383384898-725345543-1003\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\4096\Paths"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02732   868   NtOpenThreadTokenEx  (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN
 02733   868   NtOpenProcessTokenEx  (-1, 0x20008, 512, ... 360, ) == 0x0
 02734   868   NtQueryInformationToken  (360, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0
 02735   868   NtClose  (360, ... ) == 0x0
 02736   868   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\REGISTRY\USER\S-1-5-21-1292428093-1383384898-725345543-1003\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\4096\Hashes"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02737   868   NtOpenThreadTokenEx  (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN
 02738   868   NtOpenProcessTokenEx  (-1, 0x20008, 512, ... 360, ) == 0x0
 02739   868   NtQueryInformationToken  (360, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0
 02740   868   NtClose  (360, ... ) == 0x0
 02741   868   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\REGISTRY\USER\S-1-5-21-1292428093-1383384898-725345543-1003\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\4096\UrlZones"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02742   868   NtOpenThreadTokenEx  (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN
 02743   868   NtOpenProcessTokenEx  (-1, 0x20008, 512, ... 360, ) == 0x0
 02744   868   NtQueryInformationToken  (360, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0
 02745   868   NtClose  (360, ... ) == 0x0
 02746   868   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\REGISTRY\USER\S-1-5-21-1292428093-1383384898-725345543-1003\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\65536\Paths"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02747   868   NtOpenThreadTokenEx  (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN
 02748   868   NtOpenProcessTokenEx  (-1, 0x20008, 512, ... 360, ) == 0x0
 02749   868   NtQueryInformationToken  (360, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0
 02750   868   NtClose  (360, ... ) == 0x0
 02751   868   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\REGISTRY\USER\S-1-5-21-1292428093-1383384898-725345543-1003\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\65536\Hashes"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02752   868   NtOpenThreadTokenEx  (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN
 02753   868   NtOpenProcessTokenEx  (-1, 0x20008, 512, ... 360, ) == 0x0
 02754   868   NtQueryInformationToken  (360, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0
 02755   868   NtClose  (360, ... ) == 0x0
 02756   868   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\REGISTRY\USER\S-1-5-21-1292428093-1383384898-725345543-1003\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\65536\UrlZones"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02757   868   NtOpenThreadTokenEx  (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN
 02758   868   NtOpenProcessTokenEx  (-1, 0x20008, 512, ... 360, ) == 0x0
 02759   868   NtQueryInformationToken  (360, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0
 02760   868   NtClose  (360, ... ) == 0x0
 02761   868   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\REGISTRY\USER\S-1-5-21-1292428093-1383384898-725345543-1003\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\131072\Paths"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02762   868   NtOpenThreadTokenEx  (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN
 02763   868   NtOpenProcessTokenEx  (-1, 0x20008, 512, ... 360, ) == 0x0
 02764   868   NtQueryInformationToken  (360, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0
 02765   868   NtClose  (360, ... ) == 0x0
 02766   868   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\REGISTRY\USER\S-1-5-21-1292428093-1383384898-725345543-1003\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\131072\Hashes"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02767   868   NtOpenThreadTokenEx  (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN
 02768   868   NtOpenProcessTokenEx  (-1, 0x20008, 512, ... 360, ) == 0x0
 02769   868   NtQueryInformationToken  (360, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0
 02770   868   NtClose  (360, ... ) == 0x0
 02771   868   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\REGISTRY\USER\S-1-5-21-1292428093-1383384898-725345543-1003\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\131072\UrlZones"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02772   868   NtOpenThreadTokenEx  (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN
 02773   868   NtOpenProcessTokenEx  (-1, 0x20008, 512, ... 360, ) == 0x0
 02774   868   NtQueryInformationToken  (360, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0
 02775   868   NtClose  (360, ... ) == 0x0
 02776   868   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\REGISTRY\USER\S-1-5-21-1292428093-1383384898-725345543-1003\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\262144\Paths"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02777   868   NtOpenThreadTokenEx  (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN
 02778   868   NtOpenProcessTokenEx  (-1, 0x20008, 512, ... 360, ) == 0x0
 02779   868   NtQueryInformationToken  (360, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0
 02780   868   NtClose  (360, ... ) == 0x0
 02781   868   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\REGISTRY\USER\S-1-5-21-1292428093-1383384898-725345543-1003\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\262144\Hashes"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02782   868   NtOpenThreadTokenEx  (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN
 02783   868   NtOpenProcessTokenEx  (-1, 0x20008, 512, ... 360, ) == 0x0
 02784   868   NtQueryInformationToken  (360, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0
 02785   868   NtClose  (360, ... ) == 0x0
 02786   868   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\REGISTRY\USER\S-1-5-21-1292428093-1383384898-725345543-1003\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\262144\UrlZones"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02787   868   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers"}, ... 360, ) }, ... 360, ) == 0x0
 02788   868   NtQueryValueKey  (360,  (360, "DefaultLevel", Full, 524, ... TitleIdx=0, Type=4, Name="DefaultLevel", Data="\0\0\4\0"}, 48, ) , Full, 524, ... TitleIdx=0, Type=4, Name= (360, "DefaultLevel", Full, 524, ... TitleIdx=0, Type=4, Name="DefaultLevel", Data="\0\0\4\0"}, 48, ) , Data= (360, "DefaultLevel", Full, 524, ... TitleIdx=0, Type=4, Name="DefaultLevel", Data="\0\0\4\0"}, 48, ) }, 48, ) == 0x0
 02789   868   NtClose  (360, ... ) == 0x0
 02790   868   NtOpenThreadTokenEx  (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN
 02791   868   NtOpenProcessTokenEx  (-1, 0x20008, 512, ... 360, ) == 0x0
 02792   868   NtQueryInformationToken  (360, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0
 02793   868   NtClose  (360, ... ) == 0x0
 02794   868   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\REGISTRY\USER\S-1-5-21-1292428093-1383384898-725345543-1003\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02795   868   NtOpenThreadToken  (-2, 0x8, 0, ... ) == STATUS_NO_TOKEN
 02796   868   NtOpenProcessToken  (-1, 0xa, ... 360, ) == 0x0
 02797   868   NtDuplicateToken  (360, 0xc, {24, 0, 0x0, 0, 1238460, 0x0}, 0, 2, ... 364, ) == 0x0
 02798   868   NtClose  (360, ... ) == 0x0
 02799   868   NtAccessCheck  (1396632, 364, 0x1, 1238536, 1238588, 56, 1238568, ... (0x1), ) == 0x0
 02800   868   NtClose  (364, ... ) == 0x0
 02801   868   NtOpenKey  (0x1, {24, 0, 0x40, 0, 0,  (0x1, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers"}, ... 364, ) }, ... 364, ) == 0x0
 02802   868   NtQueryValueKey  (364,  (364, "PolicyScope", Partial, 80, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) , Partial, 80, ... TitleIdx=0, Type=4, Data= (364, "PolicyScope", Partial, 80, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) }, 16, ) == 0x0
 02803   868   NtClose  (364, ... ) == 0x0
 02804   868   NtOpenSymbolicLinkObject  (0x1, {24, 0, 0x40, 0, 0,  (0x1, {24, 0, 0x40, 0, 0, "\??\C:"}, ... 364, ) }, ... 364, ) == 0x0
 02805   868   NtQuerySymbolicLinkObject  (364, ...  (364, ... "\Device\HarddiskVolume1", 48, ) , 48, ) == 0x0
 02806   868   NtClose  (364, ... ) == 0x0
 02807   868   NtQueryVolumeInformationFile  (332, 1236292, 8, Device, ... {status=0x0, info=8}, ) == 0x0
 02808   868   NtQueryInformationFile  (332, 1236408, 528, Name, ... {status=0x0, info=66}, ) == 0x0
 02809   868   NtQueryInformationProcess  (-1, DefaultHardErrorMode, 4, ... {process info, class 12, size 4}, 0x0, ) == 0x0
 02810   868   NtSetInformationProcess  (-1, DefaultHardErrorMode, {process info, class 12, size 4}, 4, ... ) == 0x0
 02811   868   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\ckxldfl32.exe"}, 1235580, ... ) }, 1235580, ... ) == 0x0
 02812   868   NtOpenFile  (0x100001, {24, 0, 0x40, 0, 0,  (0x100001, {24, 0, 0x40, 0, 0, "\??\C:\"}, 3, 16417, ... 364, {status=0x0, info=1}, ) }, 3, 16417, ... 364, {status=0x0, info=1}, ) == 0x0
 02813   868   NtQueryDirectoryFile  (364, 0, 0, 0, 1235008, 616, BothDirectory, 1,  (364, 0, 0, 0, 1235008, 616, BothDirectory, 1, "WINDOWS", 0, ... {status=0x0, info=108}, ) , 0, ... {status=0x0, info=108}, ) == 0x0
 02814   868   NtClose  (364, ... ) == 0x0
 02815   868   NtOpenFile  (0x100001, {24, 0, 0x40, 0, 0,  (0x100001, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\"}, 3, 16417, ... 364, {status=0x0, info=1}, ) }, 3, 16417, ... 364, {status=0x0, info=1}, ) == 0x0
 02816   868   NtQueryDirectoryFile  (364, 0, 0, 0, 1235008, 616, BothDirectory, 1,  (364, 0, 0, 0, 1235008, 616, BothDirectory, 1, "system32", 0, ... {status=0x0, info=110}, ) , 0, ... {status=0x0, info=110}, ) == 0x0
 02817   868   NtClose  (364, ... ) == 0x0
 02818   868   NtQueryInformationProcess  (-1, DefaultHardErrorMode, 4, ... {process info, class 12, size 4}, 0x0, ) == 0x0
 02819   868   NtSetInformationProcess  (-1, DefaultHardErrorMode, {process info, class 12, size 4}, 4, ... ) == 0x0
 02820   868   NtQueryInformationFile  (332, 1238448, 24, Standard, ... {status=0x0, info=24}, ) == 0x0
 02821   868   NtCreateSection  (0xf0005, 0x0, {110592, 0}, 2, 134217728, 332, ... 364, ) == 0x0
 02822   868   NtMapViewOfSection  (364, -1, (0x0), 0, 0, {0, 0}, 110592, 1, 0, 2, ... (0x1d70000), {0, 0}, 110592, ) == 0x0
 02823   868   NtClose  (364, ... ) == 0x0
 02824   868   NtOpenThreadTokenEx  (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN
 02825   868   NtOpenProcessTokenEx  (-1, 0x20008, 512, ... 364, ) == 0x0
 02826   868   NtQueryInformationToken  (364, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0
 02827   868   NtClose  (364, ... ) == 0x0
 02828   868   NtOpenKey  (0x20019, {24, 0, 0x640, 0, 0,  (0x20019, {24, 0, 0x640, 0, 0, "\REGISTRY\USER\S-1-5-21-1292428093-1383384898-725345543-1003"}, ... 364, ) }, ... 364, ) == 0x0
 02829   868   NtOpenKey  (0x20019, {24, 364, 0x40, 0, 0,  (0x20019, {24, 364, 0x40, 0, 0, "Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders"}, ... 360, ) }, ... 360, ) == 0x0
 02830   868   NtClose  (364, ... ) == 0x0
 02831   868   NtQueryValueKey  (360,  (360, "Cache", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 02832   868   NtQueryValueKey  (360,  (360, "Cache", Partial, 174, ... TitleIdx=0, Type=1, Data="C\0:\0\\0D\0o\0c\0u\0m\0e\0n\0t\0s\0 \0a\0n\0d\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0M\0a\0r\0t\0i\0m\0 \0C\0a\0r\0b\0o\0n\0e\0\\0L\0o\0c\0a\0l\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0T\0e\0m\0p\0o\0r\0a\0r\0y\0 \0I\0n\0t\0e\0r\0n\0e\0t\0 \0F\0i\0l\0e\0s\0\0\0"}, 174, ) , Partial, 174, ... TitleIdx=0, Type=1, Data= (360, "Cache", Partial, 174, ... TitleIdx=0, Type=1, Data="C\0:\0\\0D\0o\0c\0u\0m\0e\0n\0t\0s\0 \0a\0n\0d\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0M\0a\0r\0t\0i\0m\0 \0C\0a\0r\0b\0o\0n\0e\0\\0L\0o\0c\0a\0l\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0T\0e\0m\0p\0o\0r\0a\0r\0y\0 \0I\0n\0t\0e\0r\0n\0e\0t\0 \0F\0i\0l\0e\0s\0\0\0"}, 174, ) }, 174, ) == 0x0
 02833   868   NtClose  (360, ... ) == 0x0
 02834   868   NtUnmapViewOfSection  (-1, 0x1d70000, ... ) == 0x0
 02835   868   NtAllocateVirtualMemory  (-1, 0, 0, 4096, 8192, 4, ... 30867456, 4096, ) == 0x0
 02836   868   NtAllocateVirtualMemory  (-1, 30867456, 0, 4096, 4096, 4, ... 30867456, 4096, ) == 0x0
 02837   868   NtOpenKey  (0x1, {24, 0, 0x40, 0, 0,  (0x1, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers"}, ... 360, ) }, ... 360, ) == 0x0
 02838   868   NtQueryValueKey  (360,  (360, "LogFileName", Partial, 536, ... ) , Partial, 536, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02839   868   NtClose  (360, ... ) == 0x0
 02840   868   NtOpenKey  (0x3, {24, 0, 0x40, 0, 0,  (0x3, {24, 0, 0x40, 0, 0, "\Registry\MACHINE\System\CurrentControlSet\Control\SafeBoot\Option"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02841   868   NtQueryInformationToken  (356, User, 128, ... {token info, class 1, size 36}, 36, ) == 0x0
 02842   868   NtQueryInformationToken  (356, 15, 4, ... {token info, class 15, size 4}, 4, ) == 0x0
 02843   868   NtClose  (356, ... ) == 0x0
 02844   868   NtQuerySection  (344, Image, 48, ... {section info, class 1, size 48}, 0x0, ) == 0x0
 02845   868   NtOpenKey  (0x80000000, {24, 0, 0x40, 0, 0,  (0x80000000, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ckxldfl32.exe"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02846   868   NtQuerySystemInformation  (71, 4, ... {system info, class 71, size 4}, 0x0, ) == 0x0
 02847   868   NtCreateProcessEx  (1240372, 2035711, 0, -1, 4, 344, 0, 0, 0, ... ) == 0x0
 02848   868   NtOpenSection  (0xe, {24, 16, 0x0, 0, 0,  (0xe, {24, 16, 0x0, 0, 0, "W32_Virtu"}, ... 360, ) }, ... 360, ) == 0x0
 02849   868   NtMapViewOfSection  (360, 356, (0x0), 0, 27086, 0x0, 27086, 2, 1048576, 64, ... (0x7ffa0000), 0x0, 28672, ) == 0x0
 02850   868   NtClose  (360, ... ) == 0x0
 02851   868   NtProtectVirtualMemory  (356, (0x7c90d682), 5, 64, ... (0x7c90d000), 4096, 32, ) == 0x0
 02852   868   NtWriteVirtualMemory  (356, 0x7c90d682,  (356, 0x7c90d682, "\350\15Mi\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 02853   868   NtProtectVirtualMemory  (356, (0x7c90dcfd), 5, 64, ... (0x7c90d000), 4096, 64, ) == 0x0
 02854   868   NtWriteVirtualMemory  (356, 0x7c90dcfd,  (356, 0x7c90dcfd, "\350\337Fi\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 02855   868   NtProtectVirtualMemory  (356, (0x7c90d754), 5, 64, ... (0x7c90d000), 4096, 64, ) == 0x0
 02856   868   NtWriteVirtualMemory  (356, 0x7c90d754,  (356, 0x7c90d754, "\350\217Li\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 02857   868   NtProtectVirtualMemory  (356, (0x7c90d769), 5, 64, ... (0x7c90d000), 4096, 64, ) == 0x0
 02858   868   NtWriteVirtualMemory  (356, 0x7c90d769,  (356, 0x7c90d769, "\350\207Li\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 02859   868   NtSetInformationProcess  (356, PriorityClass, {process info, class 18, size 2}, 512, ... ) == 0x0
 02860   868   NtQueryInformationProcess  (356, Basic, 24, ... {ExitStatus=0x103,PebBaseAddress=0x7ffd8000,AffinityMask=0x1,BasePriority=8,Pid=1296,ParentPid=1228,}, 0x0, ) == 0x0
 02861   868   NtReadVirtualMemory  (356, 0x7ffd8008, 4, ...  (356, 0x7ffd8008, 4, ... "\0\0@\0", 0x0, ) , 0x0, ) == 0x0
 02862   868   NtOpenFile  (0x1200a9, {24, 0, 0x40, 0, 0,  (0x1200a9, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\ckxldfl32.exe.Manifest"}, 1, 96, ... ) }, 1, 96, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02863   868   NtAllocateVirtualMemory  (-1, 1400832, 0, 8192, 4096, 4, ... 1400832, 8192, ) == 0x0
 02864   868   NtReadVirtualMemory  (356, 0x400000, 4096, ...  (356, 0x400000, 4096, ... "MZ\220\0\3\0\0\0\4\0\0\0\377\377\0\0\270\0\0\0\0\0\0\0@\0\0\0\0\0\0\0y\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\340\0\0\0\16\37\272\16\0\264\11\315!\270\1L\315!This program cannot be run in DOS mode.\15\15\12$\0\0\0\0\0\0\0,\354.\261h\215@\342h\215@\342h\215@\342\242\256g\342i\215@\342\222\251\0\342v\215@\342\222\251\\342\344\215@\342\222\256Y\342m\215@\342h\215A\342\344\215@\342\222\251]\342-\215@\342\222\251}\342i\215@\342Richh\215@\342\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0PE\0\0L\1\4\0\247\25{C\0\0\0\0\0\0\0\0\340\0\17\1\13\1\7\0\0\332\1\0\0\274\5\0\0\0\0\0\364\305\7\0\0\20\0\0\0\360\1\0\0\0@\0\0\20\0\0\0\2\0\0\4\0\0\0\0\0\0\0\4\0\0\0\0\0\0\0\0P\10\0\0\4\0\0\0\0\0\0\2\0\0\0\0\0\20\0\0\20\0\0\0\0\20\0\0\20\0\0\334\3\0\0\20\0\0\0\0\0\0\0\0\0\0\0\0\300\7\0\36\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0.text\0\0\0\304\330\1\0\0\20\0\0\0\16\1\0\0\4\0\0\0\0\0\0", 4096, ) , 4096, ) == 0x0
 02865   868   NtQueryDebugFilterState  (53, 2, ... ) == 0x0
 02866   868   NtQueryInformationProcess  (356, Basic, 24, ... {ExitStatus=0x103,PebBaseAddress=0x7ffd8000,AffinityMask=0x1,BasePriority=8,Pid=1296,ParentPid=1228,}, 0x0, ) == 0x0
 02867   868   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32"}, 1239324, ... ) }, 1239324, ... ) == 0x0
 02868   868   NtAllocateVirtualMemory  (-1, 0, 0, 2420, 4096, 4, ... 30932992, 4096, ) == 0x0
 02869   868   NtAllocateVirtualMemory  (356, 0, 0, 6432, 4096, 4, ... 65536, 8192, ) == 0x0
 02870   868   NtWriteVirtualMemory  (356, 0x10000,  (356, 0x10000, "=\0A\0:\0=\0A\0:\0\\0\0\0=\0C\0:\0=\0C\0:\0\\0s\0c\0r\0i\0p\0t\0s\0\0\0=\0U\0:\0=\0U\0:\0\\0\0\0A\0L\0L\0U\0S\0E\0R\0S\0P\0R\0O\0F\0I\0L\0E\0=\0C\0:\0\\0D\0o\0c\0u\0m\0e\0n\0t\0s\0 \0a\0n\0d\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0A\0l\0l\0 \0U\0s\0e\0r\0s\0\0\0A\0P\0P\0D\0A\0T\0A\0=\0C\0:\0\\0D\0o\0c\0u\0m\0e\0n\0t\0s\0 \0a\0n\0d\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0M\0a\0r\0t\0i\0m\0 \0C\0a\0r\0b\0o\0n\0e\0\\0A\0p\0p\0l\0i\0c\0a\0t\0i\0o\0n\0 \0D\0a\0t\0a\0\0\0A\0T\0L\0_\0I\0N\0C\0_\0P\0A\0T\0H\0=\0C\0:\0\\0W\0I\0N\0D\0D\0K\0\\03\07\09\00\0~\01\0.\01\08\03\0\\0i\0n\0c\0\0\0A\0T\0L\0_\0I\0N\0C\0_\0R\0O\0O\0T\0=\0C\0:\0\\0W\0I\0N\0D\0D\0K\0\\03\07\09\00\0~\01\0.\01\08\03\0\\0i\0n\0c\0\0\0A\0T\0L\0_\0L\0I\0B\0_\0P\0A\0T\0H\0=\0C\0:\0\\0W\0I\0N\0D\0D\0K\0\\03\07\0", 6432, ... 0x0, ) , 6432, ... 0x0, ) == 0x0
 02871   868   NtAllocateVirtualMemory  (356, 0, 0, 2420, 4096, 4, ... 131072, 4096, ) == 0x0
 02872   868   NtWriteVirtualMemory  (356, 0x20000,  (356, 0x20000, "\0\20\0\0t\11\0\0\0\0\0\0\0\0\0\0\377\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0&\0\10\2\220\2\0\0\16\0\0\0\364\3\366\3\230\4\0\0B\0D\0\220\10\0\0t\0v\0\324\10\0\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\1\0\0\0\0\0\0\0\0\0\2\0L\11\0\0\36\0 \0P\11\0\0\0\0\2\0p\11\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0", 2420, ... 0x0, ) , 2420, ... 0x0, ) == 0x0
 02873   868   NtWriteVirtualMemory  (356, 0x7ffd8010,  (356, 0x7ffd8010, "\0\0\2\0", 4, ... 0x0, ) , 4, ... 0x0, ) == 0x0
 02874   868   NtWriteVirtualMemory  (356, 0x7ffd81e8,  (356, 0x7ffd81e8, "\0\0\0\0", 4, ... 0x0, ) , 4, ... 0x0, ) == 0x0
 02875   868   NtFreeVirtualMemory  (-1, (0x1d80000), 0, 32768, ... (0x1d80000), 4096, ) == 0x0
 02876   868   NtAllocateVirtualMemory  (356, 0, 0, 1048576, 8192, 4, ... 196608, 1048576, ) == 0x0
 02877   868   NtAllocateVirtualMemory  (356, 1236992, 0, 8192, 4096, 4, ... 1236992, 8192, ) == 0x0
 02878   868   NtProtectVirtualMemory  (356, (0x12e000), 4096, 260, ... (0x12e000), 4096, 4, ) == 0x0
 02879   868   NtCreateThread  (0x1f03ff, 0x0, 356, 1240380, 1240044, 1, ... 360, {1296, 1612}, ) == 0x0
 02880   868   NtRequestWaitReplyPort  (24, {168, 196, new_msg, 0, 1242096, 1242076, 66, 2147351552}  (24, {168, 196, new_msg, 0, 1242096, 1242076, 66, 2147351552} "\0\0\0\0\0\0\1\0\0\374\375\1772\361\22\0g\1\0\0h\1\0\0\20\5\0\0L\6\0\0\0\0\0\0\0\0\0\0\10\0\0\0\0\0\0\0\0\0\0\0B\0\10\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\200\375\177\0\0\0\0\0\0\221|\300\344\227|" ... {168, 196, reply, 0, 1228, 868, 58008, 0} "\0\0\0\0\0\0\1\0\0\0\0\02\361\22\0d\1\0\0h\1\0\0\20\5\0\0L\6\0\0\0\0\0\0\0\0\0\0\10\0\0\0\0\0\0\0\0\0\0\0B\0\10\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\200\375\177\0\0\0\0\0\0\221|\300\344\227|" )  ... {168, 196, reply, 0, 1228, 868, 58008, 0}  (24, {168, 196, new_msg, 0, 1242096, 1242076, 66, 2147351552} "\0\0\0\0\0\0\1\0\0\374\375\1772\361\22\0g\1\0\0h\1\0\0\20\5\0\0L\6\0\0\0\0\0\0\0\0\0\0\10\0\0\0\0\0\0\0\0\0\0\0B\0\10\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\200\375\177\0\0\0\0\0\0\221|\300\344\227|" ... {168, 196, reply, 0, 1228, 868, 58008, 0} "\0\0\0\0\0\0\1\0\0\0\0\02\361\22\0d\1\0\0h\1\0\0\20\5\0\0L\6\0\0\0\0\0\0\0\0\0\0\10\0\0\0\0\0\0\0\0\0\0\0B\0\10\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\200\375\177\0\0\0\0\0\0\221|\300\344\227|" )  ) == 0x0
 02881   868   NtResumeThread  (360, ... 1, ) == 0x0
 02882   868   NtClose  (332, ... ) == 0x0
 02883   868   NtClose  (344, ... ) == 0x0
 02884   868   NtDelayExecution  (0, {-2000000, -1}, ... ) == 0x0
 02885   868   NtClose  (356, ... ) == 0x0
 02886   868   NtClose  (360, ... ) == 0x0
 02887   868   NtTerminateProcess  (0, 0, ...
 01202   484   NtWaitForMultipleObjects  ... ) == 0xc0
 02887   868   NtTerminateProcess  ... ) == 0x0
 02888   868   NtFreeVirtualMemory  (-1, (0x3f0000), 0, 32768, ... (0x3f0000), 65536, ) == 0x0
 02889   868   NtClose  (268, ... ) == 0x0
 02890   868   NtClose  (272, ... ) == 0x0
 02891   868   NtClose  (280, ... ) == 0x0
 02892   868   NtClose  (276, ... ) == 0x0
 02893   868   NtClose  (284, ... ) == 0x0
 02894   868   NtClose  (288, ... ) == 0x0
 02895   868   NtClose  (292, ... ) == 0x0
 02896   868   NtClose  (308, ... ) == 0x0
 02897   868   NtClose  (304, ... ) == 0x0
 02898   868   NtClose  (300, ... ) == 0x0
 02899   868   NtClose  (296, ... ) == 0x0
 02900   868   NtUserGetAtomName  (49211, 1241180, ... ) == 0xf
 02901   868   NtUserUnregisterClass  (1241240, 1560870912, 1241228, ... ) == 0x1
 02902   868   NtUserGetAtomName  (49213, 1241180, ... ) == 0xd
 02903   868   NtUserUnregisterClass  (1241240, 1560870912, 1241228, ... ) == 0x1
 02904   868   NtUserGetAtomName  (49215, 1241180, ... ) == 0x10
 02905   868   NtUserUnregisterClass  (1241240, 1560870912, 1241228, ... ) == 0x1
 02906   868   NtUserGetAtomName  (49217, 1241180, ... ) == 0x12
 02907   868   NtUserUnregisterClass  (1241240, 1560870912, 1241228, ... ) == 0x1
 02908   868   NtUserGetAtomName  (49219, 1241180, ... ) == 0xd
 02909   868   NtUserUnregisterClass  (1241240, 1560870912, 1241228, ... ) == 0x1
 02910   868   NtUserGetAtomName  (49221, 1241180, ... ) == 0xb
 02911   868   NtUserUnregisterClass  (1241240, 1560870912, 1241228, ... ) == 0x1
 02912   868   NtUserGetAtomName  (49223, 1241180, ... ) == 0xf
 02913   868   NtUserUnregisterClass  (1241240, 1560870912, 1241228, ... ) == 0x1
 02914   868   NtUserGetAtomName  (49225, 1241180, ... ) == 0xd
 02915   868   NtUserUnregisterClass  (1241240, 1560870912, 1241228, ... ) == 0x1
 02916   868   NtUserGetAtomName  (49227, 1241180, ... ) == 0x11
 02917   868   NtUserUnregisterClass  (1241240, 1560870912, 1241228, ... ) == 0x1
 02918   868   NtUserGetAtomName  (49229, 1241180, ... ) == 0xf
 02919   868   NtUserUnregisterClass  (1241240, 1560870912, 1241228, ... ) == 0x1
 02920   868   NtUserGetAtomName  (49231, 1241180, ... ) == 0x11
 02921   868   NtUserUnregisterClass  (1241240, 1560870912, 1241228, ... ) == 0x1
 02922   868   NtUserGetAtomName  (49233, 1241180, ... ) == 0xf
 02923   868   NtUserUnregisterClass  (1241240, 1560870912, 1241228, ... ) == 0x1
 02924   868   NtUserGetAtomName  (49235, 1241180, ... ) == 0xc
 02925   868   NtUserUnregisterClass  (1241240, 1560870912, 1241228, ... ) == 0x1
 02926   868   NtUserGetAtomName  (49237, 1241172, ... ) == 0xd
 02927   868   NtUserUnregisterClass  (1241232, 1560870912, 1241220, ... ) == 0x1
 02928   868   NtUserGetAtomName  (49239, 1241172, ... ) == 0x11
 02929   868   NtUserUnregisterClass  (1241232, 1560870912, 1241220, ... ) == 0x1
 02930   868   NtUserGetAtomName  (49241, 1241180, ... ) == 0xc
 02931   868   NtUserUnregisterClass  (1241240, 1560870912, 1241228, ... ) == 0x1
 02932   868   NtUserGetAtomName  (49243, 1241180, ... ) == 0xe
 02933   868   NtUserUnregisterClass  (1241240, 1560870912, 1241228, ... ) == 0x1
 02934   868   NtUserGetAtomName  (49245, 1241180, ... ) == 0x8
 02935   868   NtUserUnregisterClass  (1241240, 1560870912, 1241228, ... ) == 0x1
 02936   868   NtUserGetAtomName  (49247, 1241180, ... ) == 0xd
 02937   868   NtUserUnregisterClass  (1241240, 1560870912, 1241228, ... ) == 0x1
 02938   868   NtUnmapViewOfSection  (-1, 0x3d0000, ... ) == 0x0
 02939   868   NtSetInformationThread  (-2, ZeroTlsCell, {ZeroTlsCell=0xa,}, 4, ... ) == 0x0
 02940   868   NtFreeVirtualMemory  (-1, (0x3c0000), 0, 32768, ... (0x3c0000), 65536, ) == 0x0
 02941   868   NtClose  (192, ... ) == 0x0
 02942   868   NtSetInformationThread  (-2, ZeroTlsCell, {ZeroTlsCell=0xb,}, 4, ... ) == 0x0
 02943   868   NtUserQueryWindow  (65670, 0, ... ) == 0x6b8
 02944   868   NtUserQueryWindow  (65670, 1, ... ) == 0x6bc
 02945   868   NtUnmapViewOfSection  (-1, 0x3a0000, ... ) == 0x0
 02946   868   NtClose  (188, ... ) == 0x0
 02947   868   NtSetInformationThread  (-2, ZeroTlsCell, {ZeroTlsCell=0x8,}, 4, ... ) == 0x0
 02948   868   NtSetInformationThread  (-2, ZeroTlsCell, {ZeroTlsCell=0x9,}, 4, ... ) == 0x0
 02949   868   NtClose  (164, ... ) == 0x0
 02950   868   NtClose  (160, ... ) == 0x0
 02951   868   NtClose  (168, ... ) == 0x0
 02952   868   NtUserGetAtomName  (49211, 1241212, ... ) == 0xf
 02953   868   NtUserUnregisterClass  (1241272, 2000486400, 1241260, ... ) == 0x1
 02954   868   NtUserGetAtomName  (49213, 1241212, ... ) == 0xd
 02955   868   NtUserUnregisterClass  (1241272, 2000486400, 1241260, ... ) == 0x1
 02956   868   NtUserGetAtomName  (49215, 1241212, ... ) == 0x10
 02957   868   NtUserUnregisterClass  (1241272, 2000486400, 1241260, ... ) == 0x1
 02958   868   NtUserGetAtomName  (49217, 1241212, ... ) == 0x12
 02959   868   NtUserUnregisterClass  (1241272, 2000486400, 1241260, ... ) == 0x1
 02960   868   NtUserGetAtomName  (49219, 1241212, ... ) == 0xd
 02961   868   NtUserUnregisterClass  (1241272, 2000486400, 1241260, ... ) == 0x1
 02962   868   NtUserGetAtomName  (49221, 1241212, ... ) == 0xb
 02963   868   NtUserUnregisterClass  (1241272, 2000486400, 1241260, ... ) == 0x1
 02964   868   NtUserGetAtomName  (49223, 1241212, ... ) == 0xf
 02965   868   NtUserUnregisterClass  (1241272, 2000486400, 1241260, ... ) == 0x1
 02966   868   NtUserGetAtomName  (49225, 1241212, ... ) == 0xd
 02967   868   NtUserUnregisterClass  (1241272, 2000486400, 1241260, ... ) == 0x1
 02968   868   NtUserGetAtomName  (49227, 1241212, ... ) == 0x11
 02969   868   NtUserUnregisterClass  (1241272, 2000486400, 1241260, ... ) == 0x1
 02970   868   NtUserGetAtomName  (49229, 1241212, ... ) == 0xf
 02971   868   NtUserUnregisterClass  (1241272, 2000486400, 1241260, ... ) == 0x1
 02972   868   NtUserGetAtomName  (49231, 1241212, ... ) == 0x11
 02973   868   NtUserUnregisterClass  (1241272, 2000486400, 1241260, ... ) == 0x1
 02974   868   NtUserGetAtomName  (49233, 1241212, ... ) == 0xf
 02975   868   NtUserUnregisterClass  (1241272, 2000486400, 1241260, ... ) == 0x1
 02976   868   NtUserGetAtomName  (49235, 1241212, ... ) == 0xc
 02977   868   NtUserUnregisterClass  (1241272, 2000486400, 1241260, ... ) == 0x1
 02978   868   NtUserGetAtomName  (49237, 1241204, ... ) == 0xd
 02979   868   NtUserUnregisterClass  (1241264, 2000486400, 1241252, ... ) == 0x1
 02980   868   NtUserGetAtomName  (49239, 1241204, ... ) == 0x11
 02981   868   NtUserUnregisterClass  (1241264, 2000486400, 1241252, ... ) == 0x1
 02982   868   NtUserGetAtomName  (49241, 1241212, ... ) == 0xc
 02983   868   NtUserUnregisterClass  (1241272, 2000486400, 1241260, ... ) == 0x1
 02984   868   NtUserGetAtomName  (49243, 1241212, ... ) == 0xe
 02985   868   NtUserUnregisterClass  (1241272, 2000486400, 1241260, ... ) == 0x1
 02986   868   NtUserGetAtomName  (49245, 1241212, ... ) == 0x8
 02987   868   NtUserUnregisterClass  (1241272, 2000486400, 1241260, ... ) == 0x1
 02988   868   NtUserGetAtomName  (49247, 1241212, ... ) == 0xd
 02989   868   NtUserUnregisterClass  (1241272, 2000486400, 1241260, ... ) == 0x1
 02990   868   NtUserGetAtomName  (49175, 1241212, ... ) == 0x6
 02991   868   NtUserUnregisterClass  (1241272, 2000486400, 1241260, ... ) == 0x1
 02992   868   NtUserGetAtomName  (49177, 1241212, ... ) == 0x6
 02993   868   NtUserUnregisterClass  (1241272, 2000486400, 1241260, ... ) == 0x1
 02994   868   NtUserGetAtomName  (49176, 1241212, ... ) == 0x4
 02995   868   NtUserUnregisterClass  (1241272, 2000486400, 1241260, ... ) == 0x1
 02996   868   NtUserGetAtomName  (49178, 1241212, ... ) == 0x7
 02997   868   NtUserUnregisterClass  (1241272, 2000486400, 1241260, ... ) == 0x1
 02998   868   NtUserGetAtomName  (49180, 1241212, ... ) == 0x8
 02999   868   NtUserUnregisterClass  (1241272, 2000486400, 1241260, ... ) == 0x1
 03000   868   NtUserGetAtomName  (49182, 1241212, ... ) == 0x9
 03001   868   NtUserUnregisterClass  (1241272, 2000486400, 1241260, ... ) == 0x1
 03002   868   NtUserGetAtomName  (49179, 1241204, ... ) == 0x9
 03003   868   NtUserUnregisterClass  (1241264, 2000486400, 1241252, ... ) == 0x1
 03004   868   NtUserGetAtomName  (49256, 1241212, ... ) == 0x7
 03005   868   NtUserUnregisterClass  (1241272, 2000486400, 1241260, ... ) == 0x1
 03006   868   NtUserGetAtomName  (49258, 1241212, ... ) == 0xd
 03007   868   NtUserUnregisterClass  (1241272, 2000486400, 1241260, ... ) == 0x1
 03008   868   NtUnmapViewOfSection  (-1, 0x3b0000, ... ) == 0x0
 03009   868   NtDeviceIoControlFile  (96, 100, 0x0, 0x12f1a0, 0x22415c,  (96, 100, 0x0, 0x12f1a0, 0x22415c, "U\4\376\14\272\223\15D\243\376U9s\320\267#h\0\0\0\0\0\0\0\10 \227\1\306\205\337w", 32, 32, ... {status=0x0, info=32}, "U\4\376\14\272\223\15D\243\376U9s\320\267#h\0\0\0\0\0\0\0\10 \227\1\306\205\337w", ) , 32, 32, ... {status=0x0, info=32},  (96, 100, 0x0, 0x12f1a0, 0x22415c, "U\4\376\14\272\223\15D\243\376U9s\320\267#h\0\0\0\0\0\0\0\10 \227\1\306\205\337w", 32, 32, ... {status=0x0, info=32}, "U\4\376\14\272\223\15D\243\376U9s\320\267#h\0\0\0\0\0\0\0\10 \227\1\306\205\337w", ) , ) == 0x0
 03010   868   NtDeviceIoControlFile  (96, 100, 0x0, 0x12f168, 0x228168,  (96, 100, 0x0, 0x12f168, 0x228168, "h\0\0\0\0\0\0\0", 8, 0, ... {status=0x0, info=0}, 0x0, ) , 8, 0, ... {status=0x0, info=0}, 0x0, ) == 0x0
 03011   868   NtDeviceIoControlFile  (96, 100, 0x0, 0x12f1a0, 0x22415c,  (96, 100, 0x0, 0x12f1a0, 0x22415c, "\254\253\177yX{\226G\271$\325\21x\245\234\344\204\0\0\0\0\0\0\0\10 \227\1\306\205\337w", 32, 32, ... {status=0x0, info=32}, "\254\253\177yX{\226G\271$\325\21x\245\234\344\204\0\0\0\0\0\0\0\10 \227\1\306\205\337w", ) , 32, 32, ... {status=0x0, info=32},  (96, 100, 0x0, 0x12f1a0, 0x22415c, "\254\253\177yX{\226G\271$\325\21x\245\234\344\204\0\0\0\0\0\0\0\10 \227\1\306\205\337w", 32, 32, ... {status=0x0, info=32}, "\254\253\177yX{\226G\271$\325\21x\245\234\344\204\0\0\0\0\0\0\0\10 \227\1\306\205\337w", ) , ) == 0x0
 03012   868   NtDeviceIoControlFile  (96, 100, 0x0, 0x12f168, 0x228168,  (96, 100, 0x0, 0x12f168, 0x228168, "\204\0\0\0\0\0\0\0", 8, 0, ... {status=0x0, info=0}, 0x0, ) , 8, 0, ... {status=0x0, info=0}, 0x0, ) == 0x0
 03013   868   NtWaitForSingleObject  (244, 0, 0x0, ... ) == 0x0
 03014   868   NtClearEvent  (244, ... ) == 0x0
 03015   868   NtSetEvent  (244, ... 0x0, ) == 0x0
 03016   868   NtClose  (244, ... ) == 0x0
 03017   868   NtSetInformationThread  (-2, ZeroTlsCell, {ZeroTlsCell=0x4,}, 4, ... ) == 0x0
 03018   868   NtSetInformationThread  (-2, ZeroTlsCell, {ZeroTlsCell=0x5,}, 4, ... ) == 0x0
 03019   868   NtSetInformationThread  (-2, ZeroTlsCell, {ZeroTlsCell=0x6,}, 4, ... ) == 0x0
 03020   868   NtClose  (88, ... ) == 0x0
 03021   868   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\GRE_Initialize"}, ... 88, ) }, ... 88, ) == 0x0
 03022   868   NtQueryValueKey  (88,  (88, "DisableMetaFiles", Partial, 20, ... ) , Partial, 20, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 03023   868   NtClose  (88, ... ) == 0x0
 03024   868   NtQueryInformationProcess  (-1, 36, 4, ... {process info, class 36, size 4}, 0x0, ) == 0x0
 03025   868   NtQueryInformationProcess  (-1, 36, 4, ... {process info, class 36, size 4}, 0x0, ) == 0x0
 03026   868   NtQueryVirtualMemory  (-1, 0x41cd5f, Basic, 28, ... {BaseAddress=0x41c000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x61000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 03027   868   NtClose  (96, ... ) == 0x0
 03028   868   NtFreeVirtualMemory  (-1, (0x1d70000), 4096, 32768, ... (0x1d70000), 4096, ) == 0x0
 03029   868   NtRequestWaitReplyPort  (24, {20, 48, new_msg, 0, 0, 1357056, 0, 0}  (24, {20, 48, new_msg, 0, 0, 1357056, 0, 0} "\0\0\0\0\3\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0" ... {20, 48, reply, 0, 1228, 868, 58023, 0} "\0\0\0\0\3\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0" )  ... {20, 48, reply, 0, 1228, 868, 58023, 0}  (24, {20, 48, new_msg, 0, 0, 1357056, 0, 0} "\0\0\0\0\3\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0" ... {20, 48, reply, 0, 1228, 868, 58023, 0} "\0\0\0\0\3\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0" )  ) == 0x0
 03030   868   NtTerminateProcess  (-1, 0, ...