Summary:


NtAddAtom(>) 
 1 
NtUserGetImeInfoEx(>) 
 2 
NtUserValidateHandleSecure(>) 
 8 
NtDeviceIoControlFile(>) 
 48 

NtCallbackReturn(>) 
 1 
NtUserGetThreadState(>) 
 2 
NtQueryDefaultLocale(>) 
 9 
NtCreateEvent(>) 
 56 

NtEnumerateValueKey(>) 
 1 
NtUserRemoveProp(>) 
 2 
NtReadFile(>) 
 9 
NtUserFindExistingCursorIcon(>) 
 56 

NtGdiCreateBitmap(>) 
 1 
NtUserSetWindowLong(>) 
 2 
NtReleaseMutant(>) 
 10 
NtOpenFile(>) 
 59 

NtGdiInit(>) 
 1 
NtUserSetWindowPos(>) 
 2 
NtDuplicateObject(>) 
 11 
NtQueryVirtualMemory(>) 
 62 

NtGdiQueryFontAssocInfo(>) 
 1 
NtUserUpdateInputContext(>) 
 2 
NtQueryDefaultUILanguage(>) 
 12 
NtUserRegisterClassExWOW(>) 
 65 

NtGdiSelectBitmap(>) 
 1 
NtWaitForMultipleObjects(>) 
 2 
NtWriteFile(>) 
 12 
NtMapViewOfSection(>) 
 75 

NtOpenKeyedEvent(>) 
 1 
NtDeleteValueKey(>) 
 3 
NtCreateMutant(>) 
 13 
NtQueryAttributesFile(>) 
 81 

NtOpenSymbolicLinkObject(>) 
 1 
NtGdiCreatePatternBrushInternal(>) 
 3 
NtOpenProcessToken(>) 
 13 
NtContinue(>) 
 87 

NtQueryEvent(>) 
 1 
NtOpenEvent(>) 
 3 
NtQueryInformationFile(>) 
 14 
NtCreateSection(>) 
 97 

NtQueryInstallUILanguage(>) 
 1 
NtOpenProcess(>) 
 3 
NtUserSystemParametersInfo(>) 
 14 
NtSetEventBoostPriority(>) 
 100 

NtQueryObject(>) 
 1 
NtSecureConnectPort(>) 
 3 
NtFsControlFile(>) 
 16 
NtResumeThread(>) 
 128 

NtQuerySymbolicLinkObject(>) 
 1 
NtSetInformationObject(>) 
 3 
NtQueryDebugFilterState(>) 
 16 
NtQueryInformationThread(>) 
 130 

NtRaiseException(>) 
 1 
NtConnectPort(>) 
 4 
NtOpenProcessTokenEx(>) 
 17 
NtQuerySystemInformation(>) 
 137 

NtUserGetGUIThreadInfo(>) 
 1 
NtCreateIoCompletion(>) 
 4 
NtOpenThreadTokenEx(>) 
 17 
NtFlushInstructionCache(>) 
 142 

NtUserGetProcessWindowStation(>) 
 1 
NtUserGetObjectInformation(>) 
 4 
NtQueryInformationProcess(>) 
 17 
NtCreateThread(>) 
 145 

NtUserSetWindowFNID(>) 
 1 
NtUserSetProp(>) 
 4 
NtSetInformationFile(>) 
 19 
NtSetInformationThread(>) 
 152 

NtAdjustPrivilegesToken(>) 
 2 
NtDuplicateToken(>) 
 5 
NtSetValueKey(>) 
 19 
NtTestAlert(>) 
 154 

NtDelayExecution(>) 
 2 
NtQueryPerformanceCounter(>) 
 5 
NtCreateKey(>) 
 20 
NtRegisterThreadTerminatePort(>) 
 157 

NtGdiCreateSolidBrush(>) 
 2 
NtUserGetClassInfo(>) 
 5 
NtQuerySection(>) 
 20 
NtRequestWaitReplyPort(>) 
 173 

NtGdiDeleteObjectApp(>) 
 2 
NtUserGetThreadDesktop(>) 
 5 
NtOpenThreadToken(>) 
 25 
NtWaitForSingleObject(>) 
 176 

NtGdiHfontCreate(>) 
 2 
NtGdiCreateCompatibleDC(>) 
 6 
NtQueryDirectoryFile(>) 
 26 
NtOpenMutant(>) 
 190 

NtNotifyChangeKey(>) 
 2 
NtGdiGetStockObject(>) 
 6 
NtQueryInformationToken(>) 
 26 
NtOpenKey(>) 
 195 

NtOpenDirectoryObject(>) 
 2 
NtSetEvent(>) 
 6 
NtUserRegisterWindowMessage(>) 
 26 
NtQueryValueKey(>) 
 217 

NtQuerySystemTime(>) 
 2 
NtCreateSemaphore(>) 
 7 
NtUnmapViewOfSection(>) 
 27 
NtClose(>) 
 425 

NtReleaseSemaphore(>) 
 2 
NtQueryVolumeInformationFile(>) 
 7 
NtFreeVirtualMemory(>) 
 28 
NtProtectVirtualMemory(>) 
 425 

NtUserCreateWindowEx(>) 
 2 
NtUserCallNoParam(>) 
 7 
NtUserGetWindowDC(>) 
 28 
NtAllocateVirtualMemory(>) 
 512 

NtUserGetAncestor(>) 
 2 
NtAccessCheck(>) 
 8 
NtUserCallOneParam(>) 
 31 

NtUserGetClassName(>) 
 2 
NtSetInformationProcess(>) 
 8 
NtCreateFile(>) 
 36 

NtUserGetDC(>) 
 2 

Trace:
 00001   896   NtOpenFile  (0x80100000, {24, 0, 0x240, 0, 0,  (0x80100000, {24, 0, 0x240, 0, 0, "\SystemRoot\Prefetch\PACKED.EXE-09ED06A1.pf"}, 0, 32, ... -2147482748, {status=0x0, info=1}, ) }, 0, 32, ... -2147482748, {status=0x0, info=1}, ) == 0x0
 00002   896   NtQueryInformationFile  (-2147482748, -142414796, 24, Standard, ... {status=0x0, info=24}, ) == 0x0
 00003   896   NtReadFile  (-2147482748, 0, 0, 0, 13474, 0x0, 0, ... {status=0x0, info=13474},  (-2147482748, 0, 0, 0, 13474, 0x0, 0, ... {status=0x0, info=13474}, "\21\0\0\0SCCA\17\0\0\0\2424\0\0P\0A\0C\0K\0E\0D\0.\0E\0X\0E\0\0\0\0\00\366i\201\0\0\0\0\0\0\0\0\20\0\0\0@-\201\367\0@\300\367\30,\201\367x@s\201@-\201\367\241\6\355\11\0\0\0\0\230\0\0\0\34\0\0\0\310\2\0\0\331\2\0\0\364$\0\0\36\14\0\0\301\0\0\1\0\0\0\212\3\0\0\200\14V6\217\260\310\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\1\0\0\0\1\0\0\0\0\0\0\01\0\0\0\0\0\0\02\0\0\0\2\0\0\01\0\0\0%\1\0\0f\0\0\05\0\0\0\6\0\0\0V\1\0\0\5\0\0\0\322\0\0\04\0\0\0\4\0\0\0[\1\0\0\3\0\0\0<\1\0\03\0\0\0\4\0\0\0^\1\0\0\4\0\0\0\244\1\0\05\0\0\0\4\0\0\0b\1\0\0\32\0\0\0\20\2\0\03\0\0\0\2\0\0\0|\1\0\0\23\0\0\0x\2\0\02\0\0\0\2\0\0\0\217\1\0\0\7\0\0\0\336\2\0\02\0\0\0\6\0\0\0\226\1\0\0\22\0\0\0D\3\0\05\0\0\0\2\0\0\0\250\1\0\0\14\0\0\0\260\3\0\03\0\0\0\2\0\0\0\264\1\0\0\13\0\0\0\30\4\0\05\0\0\0\2\0\0\0\277\1\0\0*\0\0\0\204\4\0\03\0\0\0\2\0\0\0\351\1\0\0\21\0\0\0\354\4\0\02\0\0\0\2\0\0\0\372\1\0\0\2\0\0\0R\5\0\02\0\0\0\4\0\0\0\374\1\0\0\1\0\0\0\270\5\0\04\0\0\0\4\0\0\0\375\1\0\0\22\0\0\0"\6\0\04\0\0\0\6\0\0\0\17\2\0\0\36\0\0\0\214\6\0\04\0\0\0\2\0\0\0-\2\0\0\13\0\0\0", ) \6\0\04\0\0\0\6\0\0\0\17\2\0\0\36\0\0\0\214\6\0\04\0\0\0\2\0\0\0-\2\0\0\13\0\0\0", ) == 0x0
 00004   896   NtClose  (-2147482748, ... ) == 0x0
 00005   896   NtCreateFile  (0x100080, {24, 0, 0x240, 0, 0,  (0x100080, {24, 0, 0x240, 0, 0, "\DEVICE\HARDDISKVOLUME1"}, 0x0, 0, 7, 1, 32, 0, 0, ... -2147482748, {status=0x0, info=0}, ) }, 0x0, 0, 7, 1, 32, 0, 0, ... -2147482748, {status=0x0, info=0}, ) == 0x0
 00006   896   NtQueryVolumeInformationFile  (-2147482748, -142414840, 8, Device, ... {status=0x0, info=8}, ) == 0x0
 00007   896   NtClose  (-2147482748, ... ) == 0x0
 00008   896   NtCreateFile  (0x100180, {24, 0, 0x240, 0, 0,  (0x100180, {24, 0, 0x240, 0, 0, "\DEVICE\HARDDISKVOLUME1"}, 0x0, 0, 7, 1, 32, 0, 0, ... }, 0x0, 0, 7, 1, 32, 0, 0, ...
 00009   896   NtContinue  (-142419640, 0, ...
 00008   896   NtCreateFile  ... -2147482748, {status=0x0, info=1}, ) == 0x0
 00010   896   NtQueryVolumeInformationFile  (-2147482748, -142414852, 24, Volume, ... {status=0x0, info=18}, ) == 0x0
 00011   896   NtFsControlFile  (-2147482748, 0, 0x0, 0x0, 0x90120,  (-2147482748, 0, 0x0, 0x0, 0x90120, "\1\0\0\0!\0\0\0H\10\0\0\0\0\1\0\2309\0\0\0\0\2\0\15\1\0\0\0\0\1\0\357\0\0\0\0\3\0X\244\0\0\0\0\4\0\217\10\0\0\0\0\1\0\214;\0\0\0\0\2\0XK\0\0\0\0\3\0f\10\0\0\0\0\1\0Z\10\0\0\0\0\1\0\304\10\0\0\0\0\1\0Y\10\0\0\0\0\1\0C\10\0\0\0\0\1\0/:\0\0\0\0\3\0\235\244\0\0\0\0\3\0\26\11\0\0\0\0\1\0\201\246\0\0\0\0\3\0\224\246\0\0\0\0\3\0@C\0\0\0\0\2\0r\10\0\0\0\0\1\0g\10\0\0\0\0\1\0\2\1\0\0\0\0\1\0o%\0\0\0\0\3\0\243\10\0\0\0\0\1\0q\10\0\0\0\0\1\0p\10\0\0\0\0\1\0@\31\0\0\0\0\1\0\2339\0\0\0\0\1\0\5\0\0\0\0\0\5\0\34\0\0\0\0\0\1\0'\0\0\0\0\0\1\0\210\0\0\0\0\0\1\0\2329\0\0\0\0\1\0", 272, 0, ... {status=0x0, info=0}, 0x0, ) , 272, 0, ... {status=0x0, info=0}, 0x0, ) == 0x0
 00012   896   NtCreateFile  (0x100001, {24, 0, 0x240, 0, 0,  (0x100001, {24, 0, 0x240, 0, 0, "\DEVICE\HARDDISKVOLUME1\"}, 0x0, 0, 7, 1, 16417, 0, 0, ... -2147481484, {status=0x0, info=1}, ) }, 0x0, 0, 7, 1, 16417, 0, 0, ... -2147481484, {status=0x0, info=1}, ) == 0x0
 00013   896   NtQueryDirectoryFile  (-2147481484, 0, 0, 0, -504332288, 16384, Names, 0, 0x0, -518446847, ... {status=0x0, info=1146}, ) == 0x0
 00014   896   NtQueryDirectoryFile  (-2147481484, 0, 0, 0, -504332288, 16384, Names, 0, 0x0, -518446848, ... ) == STATUS_NO_MORE_FILES
 00015   896   NtClose  (-2147481484, ... ) == 0x0
 00016   896   NtCreateFile  (0x100001, {24, 0, 0x240, 0, 0,  (0x100001, {24, 0, 0x240, 0, 0, "\DEVICE\HARDDISKVOLUME1\WINDOWS\"}, 0x0, 0, 7, 1, 16417, 0, 0, ... -2147481484, {status=0x0, info=1}, ) }, 0x0, 0, 7, 1, 16417, 0, 0, ... -2147481484, {status=0x0, info=1}, ) == 0x0
 00017   896   NtQueryDirectoryFile  (-2147481484, 0, 0, 0, -504332288, 16384, Names, 0, 0x0, -518446847, ... {status=0x0, info=15820}, ) == 0x0
 00018   896   NtQueryDirectoryFile  (-2147481484, 0, 0, 0, -504332288, 16384, Names, 0, 0x0, -518446848, ... ) == STATUS_NO_MORE_FILES
 00019   896   NtClose  (-2147481484, ... ) == 0x0
 00020   896   NtCreateFile  (0x100001, {24, 0, 0x240, 0, 0,  (0x100001, {24, 0, 0x240, 0, 0, "\DEVICE\HARDDISKVOLUME1\WINDOWS\SYSTEM32\"}, 0x0, 0, 7, 1, 16417, 0, 0, ... -2147481484, {status=0x0, info=1}, ) }, 0x0, 0, 7, 1, 16417, 0, 0, ... -2147481484, {status=0x0, info=1}, ) == 0x0
 00021   896   NtQueryDirectoryFile  (-2147481484, 0, 0, 0, -504332288, 16384, Names, 0, 0x0, -518446847, ... {status=0x0, info=16366}, ) == 0x0
 00022   896   NtQueryDirectoryFile  (-2147481484, 0, 0, 0, -504332288, 16384, Names, 0, 0x0, -518446848, ... {status=0x0, info=16354}, ) == 0x0
 00023   896   NtQueryDirectoryFile  (-2147481484, 0, 0, 0, -504332288, 16384, Names, 0, 0x0, -518446848, ... {status=0x0, info=16348}, ) == 0x0
 00024   896   NtQueryDirectoryFile  (-2147481484, 0, 0, 0, -504332288, 16384, Names, 0, 0x0, -518446848, ... {status=0x0, info=16364}, ) == 0x0
 00025   896   NtQueryDirectoryFile  (-2147481484, 0, 0, 0, -504332288, 16384, Names, 0, 0x0, -518446848, ... {status=0x0, info=11386}, ) == 0x0
 00026   896   NtQueryDirectoryFile  (-2147481484, 0, 0, 0, -504332288, 16384, Names, 0, 0x0, -518446848, ... ) == STATUS_NO_MORE_FILES
 00027   896   NtClose  (-2147481484, ... ) == 0x0
 00028   896   NtCreateFile  (0x100001, {24, 0, 0x240, 0, 0,  (0x100001, {24, 0, 0x240, 0, 0, "\DEVICE\HARDDISKVOLUME1\WINDOWS\WINSXS\"}, 0x0, 0, 7, 1, 16417, 0, 0, ... -2147481484, {status=0x0, info=1}, ) }, 0x0, 0, 7, 1, 16417, 0, 0, ... -2147481484, {status=0x0, info=1}, ) == 0x0
 00029   896   NtQueryDirectoryFile  (-2147481484, 0, 0, 0, -504332288, 16384, Names, 0, 0x0, -518446847, ... {status=0x0, info=2228}, ) == 0x0
 00030   896   NtQueryDirectoryFile  (-2147481484, 0, 0, 0, -504332288, 16384, Names, 0, 0x0, -518446848, ... ) == STATUS_NO_MORE_FILES
 00031   896   NtClose  (-2147481484, ... ) == 0x0
 00032   896   NtCreateFile  (0x100001, {24, 0, 0x240, 0, 0,  (0x100001, {24, 0, 0x240, 0, 0, "\DEVICE\HARDDISKVOLUME1\WINDOWS\WINSXS\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_6.0.2600.2982_X-WW_AC3F9C03\"}, 0x0, 0, 7, 1, 16417, 0, 0, ... -2147481484, {status=0x0, info=1}, ) }, 0x0, 0, 7, 1, 16417, 0, 0, ... -2147481484, {status=0x0, info=1}, ) == 0x0
 00033   896   NtQueryDirectoryFile  (-2147481484, 0, 0, 0, -504332288, 16384, Names, 0, 0x0, -518446847, ... {status=0x0, info=68}, ) == 0x0
 00034   896   NtQueryDirectoryFile  (-2147481484, 0, 0, 0, -504332288, 16384, Names, 0, 0x0, -518446848, ... ) == STATUS_NO_MORE_FILES
 00035   896   NtClose  (-2147481484, ... ) == 0x0
 00036   896   NtCreateSection  (0xd, {24, 0, 0x240, 0, 0, 0x0}, 0x0, 4, 67108864, -2147481484, ... -2147482104, ) == 0x0
 00037   896   NtClose  (-2147482104, ... ) == 0x0
 00038   896   NtCreateSection  (0xd, {24, 0, 0x240, 0, 0, 0x0}, 0x0, 4, 67108864, -2147482104, ... -2147482660, ) == 0x0
 00039   896   NtClose  (-2147482660, ... ) == 0x0
 00040   896   NtCreateSection  (0xd, {24, 0, 0x240, 0, 0, 0x0}, 0x0, 4, 67108864, -2147482660, ... -2147482656, ) == 0x0
 00041   896   NtClose  (-2147482656, ... ) == 0x0
 00042   896   NtCreateSection  (0xd, {24, 0, 0x240, 0, 0, 0x0}, 0x0, 4, 67108864, -2147482656, ... -2147482652, ) == 0x0
 00043   896   NtClose  (-2147482652, ... ) == 0x0
 00044   896   NtCreateSection  (0xd, {24, 0, 0x240, 0, 0, 0x0}, 0x0, 4, 67108864, -2147482652, ... -2147482724, ) == 0x0
 00045   896   NtClose  (-2147482724, ... ) == 0x0
 00046   896   NtCreateSection  (0xd, {24, 0, 0x240, 0, 0, 0x0}, 0x0, 4, 67108864, -2147482724, ... -2147481452, ) == 0x0
 00047   896   NtClose  (-2147481452, ... ) == 0x0
 00048   896   NtCreateSection  (0xd, {24, 0, 0x240, 0, 0, 0x0}, 0x0, 4, 67108864, -2147481452, ... -2147482684, ) == 0x0
 00049   896   NtClose  (-2147482684, ... ) == 0x0
 00050   896   NtCreateSection  (0xd, {24, 0, 0x240, 0, 0, 0x0}, 0x0, 4, 67108864, -2147482684, ... -2147482680, ) == 0x0
 00051   896   NtClose  (-2147482680, ... ) == 0x0
 00052   896   NtCreateSection  (0xd, {24, 0, 0x240, 0, 0, 0x0}, 0x0, 4, 67108864, -2147482680, ... -2147481628, ) == 0x0
 00053   896   NtClose  (-2147481628, ... ) == 0x0
 00054   896   NtCreateSection  (0xd, {24, 0, 0x240, 0, 0, 0x0}, 0x0, 4, 67108864, -2147481628, ... -2147482760, ) == 0x0
 00055   896   NtClose  (-2147482760, ... ) == 0x0
 00056   896   NtCreateSection  (0xd, {24, 0, 0x240, 0, 0, 0x0}, 0x0, 4, 67108864, -2147482760, ... -2147482764, ) == 0x0
 00057   896   NtClose  (-2147482764, ... ) == 0x0
 00058   896   NtCreateSection  (0xd, {24, 0, 0x240, 0, 0, 0x0}, 0x0, 4, 67108864, -2147482764, ... -2147482688, ) == 0x0
 00059   896   NtClose  (-2147482688, ... ) == 0x0
 00060   896   NtCreateSection  (0xd, {24, 0, 0x240, 0, 0, 0x0}, 0x0, 4, 67108864, -2147482688, ... -2147482136, ) == 0x0
 00061   896   NtClose  (-2147482136, ... ) == 0x0
 00062   896   NtCreateSection  (0xd, {24, 0, 0x240, 0, 0, 0x0}, 0x0, 4, 67108864, -2147482136, ... -2147481480, ) == 0x0
 00063   896   NtClose  (-2147481480, ... ) == 0x0
 00064   896   NtCreateSection  (0xd, {24, 0, 0x240, 0, 0, 0x0}, 0x0, 4, 67108864, -2147481480, ... -2147482676, ) == 0x0
 00065   896   NtClose  (-2147482676, ... ) == 0x0
 00066   896   NtCreateSection  (0xd, {24, 0, 0x240, 0, 0, 0x0}, 0x0, 4, 67108864, -2147482676, ... -2147482672, ) == 0x0
 00067   896   NtClose  (-2147482672, ... ) == 0x0
 00068   896   NtCreateSection  (0xd, {24, 0, 0x240, 0, 0, 0x0}, 0x0, 4, 67108864, -2147482672, ... -2147482668, ) == 0x0
 00069   896   NtClose  (-2147482668, ... ) == 0x0
 00070   896   NtCreateSection  (0xd, {24, 0, 0x240, 0, 0, 0x0}, 0x0, 4, 67108864, -2147482668, ... -2147482664, ) == 0x0
 00071   896   NtClose  (-2147482664, ... ) == 0x0
 00072   896   NtCreateSection  (0xd, {24, 0, 0x240, 0, 0, 0x0}, 0x0, 4, 67108864, -2147482664, ... -2147481588, ) == 0x0
 00073   896   NtClose  (-2147481588, ... ) == 0x0
 00074   896   NtCreateSection  (0xd, {24, 0, 0x240, 0, 0, 0x0}, 0x0, 4, 67108864, -2147481588, ... -2147481584, ) == 0x0
 00075   896   NtClose  (-2147481584, ... ) == 0x0
 00076   896   NtCreateSection  (0xd, {24, 0, 0x240, 0, 0, 0x0}, 0x0, 4, 67108864, -2147481584, ... -2147482692, ) == 0x0
 00077   896   NtClose  (-2147482692, ... ) == 0x0
 00078   896   NtCreateSection  (0xd, {24, 0, 0x240, 0, 0, 0x0}, 0x0, 4, 67108864, -2147482692, ... -2147481512, ) == 0x0
 00079   896   NtClose  (-2147481512, ... ) == 0x0
 00080   896   NtCreateSection  (0xd, {24, 0, 0x240, 0, 0, 0x0}, 0x0, 4, 67108864, -2147481512, ... -2147481580, ) == 0x0
 00081   896   NtClose  (-2147481580, ... ) == 0x0
 00082   896   NtCreateSection  (0xd, {24, 0, 0x240, 0, 0, 0x0}, 0x0, 4, 67108864, -2147481580, ... -2147481552, ) == 0x0
 00083   896   NtClose  (-2147481552, ... ) == 0x0
 00084   896   NtCreateSection  (0xd, {24, 0, 0x240, 0, 0, 0x0}, 0x0, 4, 67108864, -2147481552, ... -2147481592, ) == 0x0
 00085   896   NtClose  (-2147481592, ... ) == 0x0
 00086   896   NtCreateSection  (0xd, {24, 0, 0x240, 0, 0, 0x0}, 0x0, 4, 67108864, -2147481592, ... -2147481596, ) == 0x0
 00087   896   NtClose  (-2147481596, ... ) == 0x0
 00088   896   NtCreateSection  (0xd, {24, 0, 0x240, 0, 0, 0x0}, 0x0, 4, 67108864, -2147481596, ... -2147482108, ) == 0x0
 00089   896   NtClose  (-2147482108, ... ) == 0x0
 00090   896   NtCreateSection  (0xd, {24, 0, 0x240, 0, 0, 0x0}, 0x0, 4, 67108864, -2147482108, ... -2147482732, ) == 0x0
 00091   896   NtClose  (-2147482732, ... ) == 0x0
 00092   896   NtClose  (-2147481484, ... ) == 0x0
 00093   896   NtClose  (-2147482104, ... ) == 0x0
 00094   896   NtClose  (-2147482660, ... ) == 0x0
 00095   896   NtClose  (-2147482656, ... ) == 0x0
 00096   896   NtClose  (-2147482652, ... ) == 0x0
 00097   896   NtClose  (-2147482724, ... ) == 0x0
 00098   896   NtClose  (-2147481452, ... ) == 0x0
 00099   896   NtClose  (-2147482684, ... ) == 0x0
 00100   896   NtClose  (-2147482680, ... ) == 0x0
 00101   896   NtClose  (-2147481628, ... ) == 0x0
 00102   896   NtClose  (-2147482760, ... ) == 0x0
 00103   896   NtClose  (-2147482764, ... ) == 0x0
 00104   896   NtClose  (-2147482688, ... ) == 0x0
 00105   896   NtClose  (-2147482136, ... ) == 0x0
 00106   896   NtClose  (-2147481480, ... ) == 0x0
 00107   896   NtClose  (-2147482676, ... ) == 0x0
 00108   896   NtClose  (-2147482672, ... ) == 0x0
 00109   896   NtClose  (-2147482668, ... ) == 0x0
 00110   896   NtClose  (-2147482664, ... ) == 0x0
 00111   896   NtClose  (-2147481588, ... ) == 0x0
 00112   896   NtClose  (-2147481584, ... ) == 0x0
 00113   896   NtClose  (-2147482692, ... ) == 0x0
 00114   896   NtClose  (-2147481512, ... ) == 0x0
 00115   896   NtClose  (-2147481580, ... ) == 0x0
 00116   896   NtClose  (-2147481552, ... ) == 0x0
 00117   896   NtClose  (-2147481592, ... ) == 0x0
 00118   896   NtClose  (-2147481596, ... ) == 0x0
 00119   896   NtClose  (-2147482108, ... ) == 0x0
 00120   896   NtCreateSection  (0xd, {24, 0, 0x240, 0, 0, 0x0}, 0x0, 16, 16777216, -2147482108, ... -2147481596, ) == 0x0
 00121   896   NtClose  (-2147481596, ... ) == 0x0
 00122   896   NtCreateSection  (0xd, {24, 0, 0x240, 0, 0, 0x0}, 0x0, 16, 16777216, -2147481596, ... -2147481592, ) == 0x0
 00123   896   NtClose  (-2147481592, ... ) == 0x0
 00124   896   NtCreateSection  (0xd, {24, 0, 0x240, 0, 0, 0x0}, 0x0, 16, 16777216, -2147481592, ... -2147481552, ) == 0x0
 00125   896   NtClose  (-2147481552, ... ) == 0x0
 00126   896   NtCreateSection  (0xd, {24, 0, 0x240, 0, 0, 0x0}, 0x0, 16, 16777216, -2147481552, ... -2147481580, ) == 0x0
 00127   896   NtClose  (-2147481580, ... ) == 0x0
 00128   896   NtCreateSection  (0xd, {24, 0, 0x240, 0, 0, 0x0}, 0x0, 16, 16777216, -2147481580, ... -2147481512, ) == 0x0
 00129   896   NtClose  (-2147481512, ... ) == 0x0
 00130   896   NtCreateSection  (0xd, {24, 0, 0x240, 0, 0, 0x0}, 0x0, 16, 16777216, -2147481512, ... -2147482692, ) == 0x0
 00131   896   NtClose  (-2147482692, ... ) == 0x0
 00132   896   NtCreateSection  (0xd, {24, 0, 0x240, 0, 0, 0x0}, 0x0, 16, 16777216, -2147482692, ... -2147481584, ) == 0x0
 00133   896   NtClose  (-2147481584, ... ) == 0x0
 00134   896   NtCreateSection  (0xd, {24, 0, 0x240, 0, 0, 0x0}, 0x0, 16, 16777216, -2147481584, ... -2147481588, ) == 0x0
 00135   896   NtClose  (-2147481588, ... ) == 0x0
 00136   896   NtCreateSection  (0xd, {24, 0, 0x240, 0, 0, 0x0}, 0x0, 16, 16777216, -2147481588, ... -2147482664, ) == 0x0
 00137   896   NtClose  (-2147482664, ... ) == 0x0
 00138   896   NtCreateSection  (0xd, {24, 0, 0x240, 0, 0, 0x0}, 0x0, 16, 16777216, -2147482664, ... -2147482668, ) == 0x0
 00139   896   NtClose  (-2147482668, ... ) == 0x0
 00140   896   NtCreateSection  (0xd, {24, 0, 0x240, 0, 0, 0x0}, 0x0, 16, 16777216, -2147482668, ... -2147482672, ) == 0x0
 00141   896   NtClose  (-2147482672, ... ) == 0x0
 00142   896   NtCreateSection  (0xd, {24, 0, 0x240, 0, 0, 0x0}, 0x0, 16, 16777216, -2147482672, ... -2147482676, ) == 0x0
 00143   896   NtClose  (-2147482676, ... ) == 0x0
 00144   896   NtCreateSection  (0xd, {24, 0, 0x240, 0, 0, 0x0}, 0x0, 16, 16777216, -2147482676, ... -2147481480, ) == 0x0
 00145   896   NtClose  (-2147481480, ... ) == 0x0
 00146   896   NtCreateSection  (0xd, {24, 0, 0x240, 0, 0, 0x0}, 0x0, 16, 16777216, -2147481480, ... -2147482136, ) == 0x0
 00147   896   NtClose  (-2147482136, ... ) == 0x0
 00148   896   NtCreateSection  (0xd, {24, 0, 0x240, 0, 0, 0x0}, 0x0, 16, 16777216, -2147482136, ... -2147482688, ) == 0x0
 00149   896   NtClose  (-2147482688, ... ) == 0x0
 00150   896   NtCreateSection  (0xd, {24, 0, 0x240, 0, 0, 0x0}, 0x0, 16, 16777216, -2147482688, ... -2147482764, ) == 0x0
 00151   896   NtClose  (-2147482764, ... ) == 0x0
 00152   896   NtCreateSection  (0xd, {24, 0, 0x240, 0, 0, 0x0}, 0x0, 16, 16777216, -2147482764, ... -2147482760, ) == 0x0
 00153   896   NtClose  (-2147482760, ... ) == 0x0
 00154   896   NtCreateSection  (0xd, {24, 0, 0x240, 0, 0, 0x0}, 0x0, 16, 16777216, -2147482760, ... -2147481628, ) == 0x0
 00155   896   NtClose  (-2147481628, ... ) == 0x0
 00156   896   NtCreateSection  (0xd, {24, 0, 0x240, 0, 0, 0x0}, 0x0, 16, 16777216, -2147481628, ... -2147482680, ) == 0x0
 00157   896   NtClose  (-2147482680, ... ) == 0x0
 00158   896   NtCreateSection  (0xd, {24, 0, 0x240, 0, 0, 0x0}, 0x0, 16, 16777216, -2147482680, ... -2147482684, ) == 0x0
 00159   896   NtClose  (-2147482684, ... ) == 0x0
 00160   896   NtCreateSection  (0xd, {24, 0, 0x240, 0, 0, 0x0}, 0x0, 16, 16777216, -2147482684, ... -2147481452, ) == 0x0
 00161   896   NtClose  (-2147481452, ... ) == 0x0
 00162   896   NtCreateSection  (0xd, {24, 0, 0x240, 0, 0, 0x0}, 0x0, 16, 16777216, -2147481452, ... -2147482724, ) == 0x0
 00163   896   NtClose  (-2147482724, ... ) == 0x0
 00164   896   NtClose  (-2147482108, ... ) == 0x0
 00165   896   NtClose  (-2147481596, ... ) == 0x0
 00166   896   NtClose  (-2147481592, ... ) == 0x0
 00167   896   NtClose  (-2147481552, ... ) == 0x0
 00168   896   NtClose  (-2147481580, ... ) == 0x0
 00169   896   NtClose  (-2147481512, ... ) == 0x0
 00170   896   NtClose  (-2147482692, ... ) == 0x0
 00171   896   NtClose  (-2147481584, ... ) == 0x0
 00172   896   NtClose  (-2147481588, ... ) == 0x0
 00173   896   NtClose  (-2147482664, ... ) == 0x0
 00174   896   NtClose  (-2147482668, ... ) == 0x0
 00175   896   NtClose  (-2147482672, ... ) == 0x0
 00176   896   NtClose  (-2147482676, ... ) == 0x0
 00177   896   NtClose  (-2147481480, ... ) == 0x0
 00178   896   NtClose  (-2147482136, ... ) == 0x0
 00179   896   NtClose  (-2147482688, ... ) == 0x0
 00180   896   NtClose  (-2147482764, ... ) == 0x0
 00181   896   NtClose  (-2147482760, ... ) == 0x0
 00182   896   NtClose  (-2147481628, ... ) == 0x0
 00183   896   NtClose  (-2147482680, ... ) == 0x0
 00184   896   NtClose  (-2147482684, ... ) == 0x0
 00185   896   NtClose  (-2147481452, ... ) == 0x0
 00186   896   NtClose  (-2147482748, ... ) == 0x0
 00187   896   NtOpenKey  (0x80000000, {24, 0, 0x40, 0, 0,  (0x80000000, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\packed.exe"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00188   896   NtOpenKeyedEvent  (0x2000000, {24, 0, 0x0, 0, 0,  (0x2000000, {24, 0, 0x0, 0, 0, "\KernelObjects\CritSecOutOfMemoryEvent"}, ... 4, ) }, ... 4, ) == 0x0
 00189   896   NtQuerySystemInformation  (Basic, 44, ... {Unknown=0,MaximumIncrement=156250,PhysicalPageSize=0x1000,NumberOfPhysicalPages=0xff7c,LowestPhysicalPage=0x1,HighestPhysicalPage=0xffff,AllocationGranularity=0x10000,LowestUserAddress=0x10000,HighestUserAddress=0x7ffeffff,ActiveProcessors=1,NumberProcessors=1,}, 0x0, ) == 0x0
 00190   896   NtAllocateVirtualMemory  (-1, 0, 0, 2097152, 8192, 4, ... 5636096, 2097152, ) == 0x0
 00191   896   NtAllocateVirtualMemory  (-1, 5636096, 0, 4096, 4096, 4, ... 5636096, 4096, ) == 0x0
 00192   896   NtAllocateVirtualMemory  (-1, 5640192, 0, 8192, 4096, 4, ... 5640192, 8192, ) == 0x0
 00193   896   NtQuerySystemInformation  (Basic, 44, ... {Unknown=0,MaximumIncrement=156250,PhysicalPageSize=0x1000,NumberOfPhysicalPages=0xff7c,LowestPhysicalPage=0x1,HighestPhysicalPage=0xffff,AllocationGranularity=0x10000,LowestUserAddress=0x10000,HighestUserAddress=0x7ffeffff,ActiveProcessors=1,NumberProcessors=1,}, 0x0, ) == 0x0
 00194   896   NtAllocateVirtualMemory  (-1, 0, 0, 65536, 8192, 4, ... 2359296, 65536, ) == 0x0
 00195   896   NtAllocateVirtualMemory  (-1, 2359296, 0, 24576, 4096, 4, ... 2359296, 24576, ) == 0x0
 00196   896   NtOpenDirectoryObject  (0x3, {24, 0, 0x40, 0, 0,  (0x3, {24, 0, 0x40, 0, 0, "\KnownDlls"}, ... 8, ) }, ... 8, ) == 0x0
 00197   896   NtOpenSymbolicLinkObject  (0x1, {24, 8, 0x40, 0, 0,  (0x1, {24, 8, 0x40, 0, 0, "KnownDllPath"}, ... 12, ) }, ... 12, ) == 0x0
 00198   896   NtQuerySymbolicLinkObject  (12, ...  (12, ... "C:\WINDOWS\system32", 0x0, ) , 0x0, ) == 0x0
 00199   896   NtClose  (12, ... ) == 0x0
 00200   896   NtOpenFile  (0x100020, {24, 0, 0x42, 0, 0,  (0x100020, {24, 0, 0x42, 0, 0, "\??\C:\scripts\"}, 3, 33, ... 12, {status=0x0, info=1}, ) }, 3, 33, ... 12, {status=0x0, info=1}, ) == 0x0
 00201   896   NtQueryVolumeInformationFile  (12, 2292428, 8, Device, ... {status=0x0, info=8}, ) == 0x0
 00202   896   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\u:\work\packed.exe.Local"}, 2292380, ... ) }, 2292380, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00203   896   NtOpenSection  (0xe, {24, 8, 0x40, 0, 0,  (0xe, {24, 8, 0x40, 0, 0, "kernel32.dll"}, ... 16, ) }, ... 16, ) == 0x0
 00204   896   NtMapViewOfSection  (16, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x7c800000), 0x0, 1003520, ) == 0x0
 00205   896   NtClose  (16, ... ) == 0x0
 00206   896   NtProtectVirtualMemory  (-1, (0x7c801000), 1568, 4, ... (0x7c801000), 4096, 32, ) == 0x0
 00207   896   NtProtectVirtualMemory  (-1, (0x7c801000), 4096, 32, ... (0x7c801000), 4096, 4, ) == 0x0
 00208   896   NtFlushInstructionCache  (-1, 2088767488, 1568, ... ) == 0x0
 00209   896   NtQueryInformationProcess  (-1, 36, 4, ... {process info, class 36, size 4}, 0x0, ) == 0x0
 00210   896   NtQuerySystemInformation  (RangeStart, 4, ... {system info, class 50, size 4}, 0x0, ) == 0x0
 00211   896   NtQuerySystemInformation  (Basic, 44, ... {Unknown=0,MaximumIncrement=156250,PhysicalPageSize=0x1000,NumberOfPhysicalPages=0xff7c,LowestPhysicalPage=0x1,HighestPhysicalPage=0xffff,AllocationGranularity=0x10000,LowestUserAddress=0x10000,HighestUserAddress=0x7ffeffff,ActiveProcessors=1,NumberProcessors=1,}, 0x0, ) == 0x0
 00212   896   NtCreateSection  (0xf001f, 0x0, {65536, 0}, 4, 67108864, 0, ... 16, ) == 0x0
 00213   896   NtSecureConnectPort  ( ("\Windows\ApiPort", {0, 2, 1, 1}, {24, 16, 0, 65536, 0, 0}, 5645112, {12, 0, 0}, 2290520, 44, ... 24, {24, 16, 0, 65536, 2424832, 18939904}, {0, 0, 0}, 200, 44, ) , {0, 2, 1, 1}, {24, 16, 0, 65536, 0, 0}, 5645112, {12, 0, 0}, 2290520, 44, ... 24, {24, 16, 0, 65536, 2424832, 18939904}, {0, 0, 0}, 200, 44, ) == 0x0
 00214   896   NtClose  (16, ... ) == 0x0
 00215   896   NtQueryObject  (24, Handle, 2, ... {Inherit=0,ProtectFromClose=0,}, -1, ) == 0x0
 00216   896   NtSetInformationObject  (24, Handle, {Inherit=0,ProtectFromClose=1,}, 256, ... ) == 0x0
 00217   896   NtQuerySystemInformation  (Basic, 44, ... {Unknown=0,MaximumIncrement=156250,PhysicalPageSize=0x1000,NumberOfPhysicalPages=0xff7c,LowestPhysicalPage=0x1,HighestPhysicalPage=0xffff,AllocationGranularity=0x10000,LowestUserAddress=0x10000,HighestUserAddress=0x7ffeffff,ActiveProcessors=1,NumberProcessors=1,}, 0x0, ) == 0x0
 00218   896   NtQueryVirtualMemory  (-1, 0x250000, Basic, 28, ... {BaseAddress=0x250000,AllocationBase=0x250000,AllocationProtect=0x4,RegionSize=0x10000,State=0x2000,Protect=0x0,Type=0x40000,}, 0x0, ) == 0x0
 00219   896   NtAllocateVirtualMemory  (-1, 2424832, 0, 4096, 4096, 4, ... 2424832, 4096, ) == 0x0
 00220   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 2290836, 2291036, 2089900544, 2290760}  (24, {28, 56, new_msg, 0, 2290836, 2291036, 2089900544, 2290760} "\210\6!\1\0\0\0\0eZ\221|\0\0\0\0\1\0\0\0\234\6!\1\4\0\0\0" ... {28, 56, reply, 0, 1252, 896, 81841, 0} "\370\374\27\0\0\0\0\0\0\0\0\0\0\0\0\0\1\0\0\0\234\6!\1\4\0\0\0" )  ... {28, 56, reply, 0, 1252, 896, 81841, 0}  (24, {28, 56, new_msg, 0, 2290836, 2291036, 2089900544, 2290760} "\210\6!\1\0\0\0\0eZ\221|\0\0\0\0\1\0\0\0\234\6!\1\4\0\0\0" ... {28, 56, reply, 0, 1252, 896, 81841, 0} "\370\374\27\0\0\0\0\0\0\0\0\0\0\0\0\0\1\0\0\0\234\6!\1\4\0\0\0" )  ) == 0x0
 00221   896   NtRegisterThreadTerminatePort  (24, ... ) == 0x0
 00222   896   NtAllocateVirtualMemory  (-1, 2281472, 0, 4096, 4096, 260, ... 2281472, 4096, ) == 0x0
 00223   896   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\System\CurrentControlSet\Control\Terminal Server"}, ... 16, ) }, ... 16, ) == 0x0
 00224   896   NtQueryValueKey  (16,  (16, "TSAppCompat", Partial, 548, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) , Partial, 548, ... TitleIdx=0, Type=4, Data= (16, "TSAppCompat", Partial, 548, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) }, 16, ) == 0x0
 00225   896   NtClose  (16, ... ) == 0x0
 00226   896   NtOpenSection  (0x4, {24, 0, 0x40, 0, 0,  (0x4, {24, 0, 0x40, 0, 0, "\NLS\NlsSectionUnicode"}, ... 16, ) }, ... 16, ) == 0x0
 00227   896   NtMapViewOfSection  (16, -1, (0x0), 0, 0, 0x0, 0, 2, 0, 2, ... (0x260000), 0x0, 90112, ) == 0x0
 00228   896   NtClose  (16, ... ) == 0x0
 00229   896   NtQueryDefaultLocale  (0, 2089305000, ... ) == 0x0
 00230   896   NtOpenSection  (0x4, {24, 0, 0x40, 0, 0,  (0x4, {24, 0, 0x40, 0, 0, "\NLS\NlsSectionLocale"}, ... 16, ) }, ... 16, ) == 0x0
 00231   896   NtMapViewOfSection  (16, -1, (0x0), 0, 0, 0x0, 0, 2, 0, 2, ... (0x280000), 0x0, 249856, ) == 0x0
 00232   896   NtClose  (16, ... ) == 0x0
 00233   896   NtOpenSection  (0x5, {24, 0, 0x40, 0, 0,  (0x5, {24, 0, 0x40, 0, 0, "\NLS\NlsSectionSortkey"}, ... 16, ) }, ... 16, ) == 0x0
 00234   896   NtMapViewOfSection  (16, -1, (0x0), 0, 0, 0x0, 0, 2, 0, 2, ... (0x2c0000), 0x0, 266240, ) == 0x0
 00235   896   NtQuerySection  (16, Basic, 16, ... {BaseAddress=0x0,Attributes=0x800000,Size={0x40004, 0x0},}, 0x0, ) == 0x0
 00236   896   NtClose  (16, ... ) == 0x0
 00237   896   NtOpenSection  (0x4, {24, 0, 0x40, 0, 0,  (0x4, {24, 0, 0x40, 0, 0, "\NLS\NlsSectionSortTbls"}, ... 16, ) }, ... 16, ) == 0x0
 00238   896   NtMapViewOfSection  (16, -1, (0x0), 0, 0, 0x0, 0, 2, 0, 2, ... (0x310000), 0x0, 24576, ) == 0x0
 00239   896   NtClose  (16, ... ) == 0x0
 00240   896   NtQueryVirtualMemory  (-1, 0x7ffd2000, Basic, 28, ... {BaseAddress=0x7ffd2000,AllocationBase=0x7ffb0000,AllocationProtect=0x2,RegionSize=0x2000,State=0x1000,Protect=0x2,Type=0x40000,}, 0x0, ) == 0x0
 00241   896   NtOpenSection  (0x4, {24, 0, 0x40, 0, 0,  (0x4, {24, 0, 0x40, 0, 0, "\NLS\NlsSectionSortkey00000409"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00242   896   NtOpenSection  (0x4, {24, 0, 0x40, 0, 0,  (0x4, {24, 0, 0x40, 0, 0, "\NLS\NlsSectionSortkey00000409"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00243   896   NtAllocateVirtualMemory  (-1, 2428928, 0, 8192, 4096, 4, ... 2428928, 8192, ) == 0x0
 00244   896   NtRequestWaitReplyPort  (24, {24, 52, new_msg, 0, 7012468, 7929957, 3145776, 3145776}  (24, {24, 52, new_msg, 0, 7012468, 7929957, 3145776, 3145776} "\210\6!\1\36\0\1\0\0\0\0\0\377\377\377\377\234\6!\1p\30\0\0" ... {24, 52, reply, 0, 1252, 896, 81842, 0} "\10P\30\0\36\0\1\0\0\0\0\0\377\377\377\377\234\6!\1p\30\0\0" )  ... {24, 52, reply, 0, 1252, 896, 81842, 0}  (24, {24, 52, new_msg, 0, 7012468, 7929957, 3145776, 3145776} "\210\6!\1\36\0\1\0\0\0\0\0\377\377\377\377\234\6!\1p\30\0\0" ... {24, 52, reply, 0, 1252, 896, 81842, 0} "\10P\30\0\36\0\1\0\0\0\0\0\377\377\377\377\234\6!\1p\30\0\0" )  ) == 0x0
 00245   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 2089305760, 2090321376, 0, 0}  (24, {28, 56, new_msg, 0, 2089305760, 2090321376, 0, 0} "\210\6!\1\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\234\6!\18\6\0\0" ... {28, 56, reply, 0, 1252, 896, 81843, 0} "\250\202\26\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\234\6!\18\6\0\0" )  ... {28, 56, reply, 0, 1252, 896, 81843, 0}  (24, {28, 56, new_msg, 0, 2089305760, 2090321376, 0, 0} "\210\6!\1\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\234\6!\18\6\0\0" ... {28, 56, reply, 0, 1252, 896, 81843, 0} "\250\202\26\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\234\6!\18\6\0\0" )  ) == 0x0
 00246   896   NtProtectVirtualMemory  (-1, (0x408000), 65536, 4, ... (0x408000), 65536, 128, ) == 0x0
 00247   896   NtProtectVirtualMemory  (-1, (0x408000), 65536, 128, ... (0x408000), 65536, 4, ) == 0x0
 00248   896   NtFlushInstructionCache  (-1, 4227072, 65536, ... ) == 0x0
 00249   896   NtQueryInformationProcess  (-1, 37, 48, ... {process info, class 37, size 48}, 0x0, ) == 0x0
 00250   896   NtSetInformationProcess  (-1, 34, {process info, class 34, size 4}, 4, ... ) == 0x0
 00251   896   NtOpenProcessToken  (-1, 0x8, ... 16, ) == 0x0
 00252   896   NtQueryInformationToken  (16, Statistics, 56, ... {token info, class 10, size 56}, 56, ) == 0x0
 00253   896   NtClose  (16, ... ) == 0x0
 00254   896   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\System\CurrentControlSet\Control\Terminal Server"}, ... 16, ) }, ... 16, ) == 0x0
 00255   896   NtQueryValueKey  (16,  (16, "TSAppCompat", Partial, 548, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) , Partial, 548, ... TitleIdx=0, Type=4, Data= (16, "TSAppCompat", Partial, 548, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) }, 16, ) == 0x0
 00256   896   NtClose  (16, ... ) == 0x0
 00257   896   NtTestAlert  (... ) == 0x0
 00258   896   NtContinue  (2293040, 1, ...
 00259   896   NtSetInformationThread  (-2, Win32StartAddress(LpcReceivedMessageId), {StartAddress(LpcReceivedMsgId)=0x418000,}, 4, ... ) == 0x0
 00260   896   NtOpenKey  (0x1, {24, 0, 0x40, 0, 0,  (0x1, {24, 0, 0x40, 0, 0, "\Registry\MACHINE\System\CurrentControlSet\Control\Session Manager"}, ... 16, ) }, ... 16, ) == 0x0
 00261   896   NtQueryValueKey  (16,  (16, "SafeDllSearchMode", Partial, 16, ... ) , Partial, 16, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00262   896   NtClose  (16, ... ) == 0x0
 00263   896   NtAllocateVirtualMemory  (-1, 5648384, 0, 4096, 4096, 4, ... 5648384, 4096, ) == 0x0
 00264   896   NtOpenSection  (0xe, {24, 8, 0x40, 0, 0,  (0xe, {24, 8, 0x40, 0, 0, "crtdll.dll"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00265   896   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\u:\work\crtdll.dll"}, 2291232, ... ) }, 2291232, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00266   896   NtFsControlFile  (12, 0, 0x0, 0x0, 0x90028, 0x0, 0, 0, ... {status=0x0, info=0}, 0x0, ) == 0x0
 00267   896   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\crtdll.dll"}, 2291232, ... ) }, 2291232, ... ) == 0x0
 00268   896   NtOpenFile  (0x100020, {24, 0, 0x40, 0, 0,  (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\crtdll.dll"}, 5, 96, ... 16, {status=0x0, info=1}, ) }, 5, 96, ... 16, {status=0x0, info=1}, ) == 0x0
 00269   896   NtCreateSection  (0xf, 0x0, 0x0, 16, 16777216, 16, ... 28, ) == 0x0
 00270   896   NtQuerySection  (28, Image, 48, ... {section info, class 1, size 48}, 0x0, ) == 0x0
 00271   896   NtOpenProcessToken  (-1, 0x8, ... 32, ) == 0x0
 00272   896   NtQueryInformationToken  (32, User, 136, ... {token info, class 1, size 36}, 36, ) == 0x0
 00273   896   NtOpenKey  (0x3, {24, 0, 0x40, 0, 0,  (0x3, {24, 0, 0x40, 0, 0, "\Registry\MACHINE\System\CurrentControlSet\Control\SafeBoot\Option"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00274   896   NtOpenKey  (0x1, {24, 0, 0x40, 0, 0,  (0x1, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers"}, ... 36, ) }, ... 36, ) == 0x0
 00275   896   NtQueryValueKey  (36,  (36, "TransparentEnabled", Partial, 80, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) , Partial, 80, ... TitleIdx=0, Type=4, Data= (36, "TransparentEnabled", Partial, 80, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) }, 16, ) == 0x0
 00276   896   NtClose  (36, ... ) == 0x0
 00277   896   NtOpenThreadTokenEx  (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN
 00278   896   NtOpenProcessTokenEx  (-1, 0x20008, 512, ... 36, ) == 0x0
 00279   896   NtQueryInformationToken  (36, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0
 00280   896   NtClose  (36, ... ) == 0x0
 00281   896   NtOpenKey  (0x1, {24, 0, 0x40, 0, 0,  (0x1, {24, 0, 0x40, 0, 0, "\REGISTRY\USER\S-1-5-21-1292428093-1383384898-725345543-1003\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00282   896   NtClose  (32, ... ) == 0x0
 00283   896   NtClose  (16, ... ) == 0x0
 00284   896   NtMapViewOfSection  (28, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x73d90000), 0x0, 159744, ) == 0x0
 00285   896   NtClose  (28, ... ) == 0x0
 00286   896   NtProtectVirtualMemory  (-1, (0x73d9103c), 400, 4, ... (0x73d91000), 4096, 32, ) == 0x0
 00287   896   NtProtectVirtualMemory  (-1, (0x73d91000), 4096, 32, ... (0x73d91000), 4096, 4, ) == 0x0
 00288   896   NtFlushInstructionCache  (-1, 1943605248, 400, ... ) == 0x0
 00289   896   NtOpenKey  (0x80000000, {24, 0, 0x40, 0, 0,  (0x80000000, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\crtdll.dll"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00290   896   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\crtdll.dll"}, 2288836, ... ) }, 2288836, ... ) == 0x0
 00291   896   NtAllocateVirtualMemory  (-1, 5652480, 0, 8192, 4096, 4, ... 5652480, 8192, ) == 0x0
 00292   896   NtAllocateVirtualMemory  (-1, 5660672, 0, 4096, 4096, 4, ... 5660672, 4096, ) == 0x0
 00293   896   NtQuerySystemInformation  (TimeZone, 172, ... {system info, class 44, size 172}, 0x0, ) == 0x0
 00294   896   NtRequestWaitReplyPort  (24, {40, 68, new_msg, 0, 6553714, 5505056, 7143529, 101}  (24, {40, 68, new_msg, 0, 6553714, 5505056, 7143529, 101} "\0\0\0\0\0\2\2\0l\20\201|\0\0\0\0\0\0\0\0\1\0\0\0\0\0\0\300\0\0\0\0\3\0\0\0\0\0\0\0" ... {40, 68, reply, 0, 1252, 896, 81844, 0} "\0\0\0\0\0\2\2\0\10\0\0\300\0\0\0\0\0\0\0\0\1\0\0\0\0\0\0\300\0\0\0\0\3\0\0\0\0\0\0\0" )  ... {40, 68, reply, 0, 1252, 896, 81844, 0}  (24, {40, 68, new_msg, 0, 6553714, 5505056, 7143529, 101} "\0\0\0\0\0\2\2\0l\20\201|\0\0\0\0\0\0\0\0\1\0\0\0\0\0\0\300\0\0\0\0\3\0\0\0\0\0\0\0" ... {40, 68, reply, 0, 1252, 896, 81844, 0} "\0\0\0\0\0\2\2\0\10\0\0\300\0\0\0\0\0\0\0\0\1\0\0\0\0\0\0\300\0\0\0\0\3\0\0\0\0\0\0\0" )  ) == 0x0
 00295   896   NtRequestWaitReplyPort  (24, {40, 68, new_msg, 0, 1252, 896, 81844, 0}  (24, {40, 68, new_msg, 0, 1252, 896, 81844, 0} "\0\0\0\0\0\2\2\0\\20\201|\0\0\0\0\0\0\0\0\2\0\0\0\0\0\0@\0\0\0\0\3\0\0\0\0\0\0\0" ... {40, 68, reply, 0, 1252, 896, 81845, 0} "\0\0\0\0\0\2\2\0\10\0\0\300\0\0\0\0\0\0\0\0\2\0\0\0\0\0\0@\0\0\0\0\3\0\0\0\0\0\0\0" )  ... {40, 68, reply, 0, 1252, 896, 81845, 0}  (24, {40, 68, new_msg, 0, 1252, 896, 81844, 0} "\0\0\0\0\0\2\2\0\\20\201|\0\0\0\0\0\0\0\0\2\0\0\0\0\0\0@\0\0\0\0\3\0\0\0\0\0\0\0" ... {40, 68, reply, 0, 1252, 896, 81845, 0} "\0\0\0\0\0\2\2\0\10\0\0\300\0\0\0\0\0\0\0\0\2\0\0\0\0\0\0@\0\0\0\0\3\0\0\0\0\0\0\0" )  ) == 0x0
 00296   896   NtOpenKey  (0x80000000, {24, 0, 0x40, 0, 0,  (0x80000000, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ntdll.dll"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00297   896   NtOpenKey  (0x80000000, {24, 0, 0x40, 0, 0,  (0x80000000, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kernel32.dll"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00298   896   NtOpenDirectoryObject  (0x2000f, {24, 0, 0x40, 0, 0,  (0x2000f, {24, 0, 0x40, 0, 0, "\BaseNamedObjects"}, ... 28, ) }, ... 28, ) == 0x0
 00299   896   NtOpenMutant  (0x100000, {24, 28, 0x0, 0, 0,  (0x100000, {24, 28, 0x0, 0, 0, "kkq-vx_mtx6"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00300   896   NtOpenMutant  (0x100000, {24, 28, 0x0, 0, 0,  (0x100000, {24, 28, 0x0, 0, 0, "kkq-vx_mtx7"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00301   896   NtOpenMutant  (0x100000, {24, 28, 0x0, 0, 0,  (0x100000, {24, 28, 0x0, 0, 0, "kkq-vx_mtx8"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00302   896   NtOpenMutant  (0x100000, {24, 28, 0x0, 0, 0,  (0x100000, {24, 28, 0x0, 0, 0, "kkq-vx_mtx9"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00303   896   NtOpenMutant  (0x100000, {24, 28, 0x0, 0, 0,  (0x100000, {24, 28, 0x0, 0, 0, "kkq-vx_mtx10"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00304   896   NtOpenMutant  (0x100000, {24, 28, 0x0, 0, 0,  (0x100000, {24, 28, 0x0, 0, 0, "kkq-vx_mtx11"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00305   896   NtOpenMutant  (0x100000, {24, 28, 0x0, 0, 0,  (0x100000, {24, 28, 0x0, 0, 0, "kkq-vx_mtx12"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00306   896   NtOpenMutant  (0x100000, {24, 28, 0x0, 0, 0,  (0x100000, {24, 28, 0x0, 0, 0, "kkq-vx_mtx13"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00307   896   NtOpenMutant  (0x100000, {24, 28, 0x0, 0, 0,  (0x100000, {24, 28, 0x0, 0, 0, "kkq-vx_mtx14"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00308   896   NtOpenMutant  (0x100000, {24, 28, 0x0, 0, 0,  (0x100000, {24, 28, 0x0, 0, 0, "kkq-vx_mtx15"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00309   896   NtOpenMutant  (0x100000, {24, 28, 0x0, 0, 0,  (0x100000, {24, 28, 0x0, 0, 0, "kkq-vx_mtx16"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00310   896   NtOpenMutant  (0x100000, {24, 28, 0x0, 0, 0,  (0x100000, {24, 28, 0x0, 0, 0, "kkq-vx_mtx17"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00311   896   NtOpenMutant  (0x100000, {24, 28, 0x0, 0, 0,  (0x100000, {24, 28, 0x0, 0, 0, "kkq-vx_mtx18"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00312   896   NtOpenMutant  (0x100000, {24, 28, 0x0, 0, 0,  (0x100000, {24, 28, 0x0, 0, 0, "kkq-vx_mtx19"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00313   896   NtOpenMutant  (0x100000, {24, 28, 0x0, 0, 0,  (0x100000, {24, 28, 0x0, 0, 0, "kkq-vx_mtx20"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00314   896   NtOpenMutant  (0x100000, {24, 28, 0x0, 0, 0,  (0x100000, {24, 28, 0x0, 0, 0, "kkq-vx_mtx21"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00315   896   NtOpenMutant  (0x100000, {24, 28, 0x0, 0, 0,  (0x100000, {24, 28, 0x0, 0, 0, "kkq-vx_mtx22"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00316   896   NtOpenMutant  (0x100000, {24, 28, 0x0, 0, 0,  (0x100000, {24, 28, 0x0, 0, 0, "kkq-vx_mtx23"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00317   896   NtOpenMutant  (0x100000, {24, 28, 0x0, 0, 0,  (0x100000, {24, 28, 0x0, 0, 0, "kkq-vx_mtx24"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00318   896   NtOpenMutant  (0x100000, {24, 28, 0x0, 0, 0,  (0x100000, {24, 28, 0x0, 0, 0, "kkq-vx_mtx25"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00319   896   NtOpenMutant  (0x100000, {24, 28, 0x0, 0, 0,  (0x100000, {24, 28, 0x0, 0, 0, "kkq-vx_mtx26"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00320   896   NtOpenMutant  (0x100000, {24, 28, 0x0, 0, 0,  (0x100000, {24, 28, 0x0, 0, 0, "kkq-vx_mtx27"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00321   896   NtOpenMutant  (0x100000, {24, 28, 0x0, 0, 0,  (0x100000, {24, 28, 0x0, 0, 0, "kkq-vx_mtx28"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00322   896   NtOpenMutant  (0x100000, {24, 28, 0x0, 0, 0,  (0x100000, {24, 28, 0x0, 0, 0, "kkq-vx_mtx29"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00323   896   NtOpenMutant  (0x100000, {24, 28, 0x0, 0, 0,  (0x100000, {24, 28, 0x0, 0, 0, "kkq-vx_mtx30"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00324   896   NtOpenMutant  (0x100000, {24, 28, 0x0, 0, 0,  (0x100000, {24, 28, 0x0, 0, 0, "kkq-vx_mtx31"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00325   896   NtOpenMutant  (0x100000, {24, 28, 0x0, 0, 0,  (0x100000, {24, 28, 0x0, 0, 0, "kkq-vx_mtx32"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00326   896   NtOpenMutant  (0x100000, {24, 28, 0x0, 0, 0,  (0x100000, {24, 28, 0x0, 0, 0, "kkq-vx_mtx33"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00327   896   NtOpenMutant  (0x100000, {24, 28, 0x0, 0, 0,  (0x100000, {24, 28, 0x0, 0, 0, "kkq-vx_mtx34"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00328   896   NtOpenMutant  (0x100000, {24, 28, 0x0, 0, 0,  (0x100000, {24, 28, 0x0, 0, 0, "kkq-vx_mtx35"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00329   896   NtOpenMutant  (0x100000, {24, 28, 0x0, 0, 0,  (0x100000, {24, 28, 0x0, 0, 0, "kkq-vx_mtx36"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00330   896   NtOpenMutant  (0x100000, {24, 28, 0x0, 0, 0,  (0x100000, {24, 28, 0x0, 0, 0, "kkq-vx_mtx37"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00331   896   NtOpenMutant  (0x100000, {24, 28, 0x0, 0, 0,  (0x100000, {24, 28, 0x0, 0, 0, "kkq-vx_mtx38"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00332   896   NtOpenMutant  (0x100000, {24, 28, 0x0, 0, 0,  (0x100000, {24, 28, 0x0, 0, 0, "kkq-vx_mtx39"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00333   896   NtOpenMutant  (0x100000, {24, 28, 0x0, 0, 0,  (0x100000, {24, 28, 0x0, 0, 0, "kkq-vx_mtx40"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00334   896   NtOpenMutant  (0x100000, {24, 28, 0x0, 0, 0,  (0x100000, {24, 28, 0x0, 0, 0, "kkq-vx_mtx41"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00335   896   NtOpenMutant  (0x100000, {24, 28, 0x0, 0, 0,  (0x100000, {24, 28, 0x0, 0, 0, "kkq-vx_mtx42"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00336   896   NtOpenMutant  (0x100000, {24, 28, 0x0, 0, 0,  (0x100000, {24, 28, 0x0, 0, 0, "kkq-vx_mtx43"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00337   896   NtOpenMutant  (0x100000, {24, 28, 0x0, 0, 0,  (0x100000, {24, 28, 0x0, 0, 0, "kkq-vx_mtx44"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00338   896   NtOpenMutant  (0x100000, {24, 28, 0x0, 0, 0,  (0x100000, {24, 28, 0x0, 0, 0, "kkq-vx_mtx45"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00339   896   NtOpenMutant  (0x100000, {24, 28, 0x0, 0, 0,  (0x100000, {24, 28, 0x0, 0, 0, "kkq-vx_mtx46"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00340   896   NtOpenMutant  (0x100000, {24, 28, 0x0, 0, 0,  (0x100000, {24, 28, 0x0, 0, 0, "kkq-vx_mtx47"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00341   896   NtOpenMutant  (0x100000, {24, 28, 0x0, 0, 0,  (0x100000, {24, 28, 0x0, 0, 0, "kkq-vx_mtx48"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00342   896   NtOpenMutant  (0x100000, {24, 28, 0x0, 0, 0,  (0x100000, {24, 28, 0x0, 0, 0, "kkq-vx_mtx49"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00343   896   NtOpenMutant  (0x100000, {24, 28, 0x0, 0, 0,  (0x100000, {24, 28, 0x0, 0, 0, "kkq-vx_mtx50"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00344   896   NtOpenMutant  (0x100000, {24, 28, 0x0, 0, 0,  (0x100000, {24, 28, 0x0, 0, 0, "kkq-vx_mtx51"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00345   896   NtOpenMutant  (0x100000, {24, 28, 0x0, 0, 0,  (0x100000, {24, 28, 0x0, 0, 0, "kkq-vx_mtx52"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00346   896   NtOpenMutant  (0x100000, {24, 28, 0x0, 0, 0,  (0x100000, {24, 28, 0x0, 0, 0, "kkq-vx_mtx53"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00347   896   NtOpenMutant  (0x100000, {24, 28, 0x0, 0, 0,  (0x100000, {24, 28, 0x0, 0, 0, "kkq-vx_mtx54"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00348   896   NtOpenMutant  (0x100000, {24, 28, 0x0, 0, 0,  (0x100000, {24, 28, 0x0, 0, 0, "kkq-vx_mtx55"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00349   896   NtOpenMutant  (0x100000, {24, 28, 0x0, 0, 0,  (0x100000, {24, 28, 0x0, 0, 0, "kkq-vx_mtx56"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00350   896   NtOpenMutant  (0x100000, {24, 28, 0x0, 0, 0,  (0x100000, {24, 28, 0x0, 0, 0, "kkq-vx_mtx57"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00351   896   NtOpenMutant  (0x100000, {24, 28, 0x0, 0, 0,  (0x100000, {24, 28, 0x0, 0, 0, "kkq-vx_mtx58"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00352   896   NtOpenMutant  (0x100000, {24, 28, 0x0, 0, 0,  (0x100000, {24, 28, 0x0, 0, 0, "kkq-vx_mtx59"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00353   896   NtOpenMutant  (0x100000, {24, 28, 0x0, 0, 0,  (0x100000, {24, 28, 0x0, 0, 0, "kkq-vx_mtx60"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00354   896   NtOpenMutant  (0x100000, {24, 28, 0x0, 0, 0,  (0x100000, {24, 28, 0x0, 0, 0, "kkq-vx_mtx61"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00355   896   NtOpenMutant  (0x100000, {24, 28, 0x0, 0, 0,  (0x100000, {24, 28, 0x0, 0, 0, "kkq-vx_mtx62"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00356   896   NtOpenMutant  (0x100000, {24, 28, 0x0, 0, 0,  (0x100000, {24, 28, 0x0, 0, 0, "kkq-vx_mtx63"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00357   896   NtOpenMutant  (0x100000, {24, 28, 0x0, 0, 0,  (0x100000, {24, 28, 0x0, 0, 0, "kkq-vx_mtx64"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00358   896   NtOpenMutant  (0x100000, {24, 28, 0x0, 0, 0,  (0x100000, {24, 28, 0x0, 0, 0, "kkq-vx_mtx65"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00359   896   NtOpenMutant  (0x100000, {24, 28, 0x0, 0, 0,  (0x100000, {24, 28, 0x0, 0, 0, "kkq-vx_mtx66"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00360   896   NtOpenMutant  (0x100000, {24, 28, 0x0, 0, 0,  (0x100000, {24, 28, 0x0, 0, 0, "kkq-vx_mtx67"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00361   896   NtOpenMutant  (0x100000, {24, 28, 0x0, 0, 0,  (0x100000, {24, 28, 0x0, 0, 0, "kkq-vx_mtx68"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00362   896   NtOpenMutant  (0x100000, {24, 28, 0x0, 0, 0,  (0x100000, {24, 28, 0x0, 0, 0, "kkq-vx_mtx69"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00363   896   NtOpenMutant  (0x100000, {24, 28, 0x0, 0, 0,  (0x100000, {24, 28, 0x0, 0, 0, "kkq-vx_mtx70"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00364   896   NtOpenMutant  (0x100000, {24, 28, 0x0, 0, 0,  (0x100000, {24, 28, 0x0, 0, 0, "kkq-vx_mtx71"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00365   896   NtOpenMutant  (0x100000, {24, 28, 0x0, 0, 0,  (0x100000, {24, 28, 0x0, 0, 0, "kkq-vx_mtx72"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00366   896   NtOpenMutant  (0x100000, {24, 28, 0x0, 0, 0,  (0x100000, {24, 28, 0x0, 0, 0, "kkq-vx_mtx73"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00367   896   NtOpenMutant  (0x100000, {24, 28, 0x0, 0, 0,  (0x100000, {24, 28, 0x0, 0, 0, "kkq-vx_mtx74"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00368   896   NtOpenMutant  (0x100000, {24, 28, 0x0, 0, 0,  (0x100000, {24, 28, 0x0, 0, 0, "kkq-vx_mtx75"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00369   896   NtOpenMutant  (0x100000, {24, 28, 0x0, 0, 0,  (0x100000, {24, 28, 0x0, 0, 0, "kkq-vx_mtx76"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00370   896   NtOpenMutant  (0x100000, {24, 28, 0x0, 0, 0,  (0x100000, {24, 28, 0x0, 0, 0, "kkq-vx_mtx77"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00371   896   NtOpenMutant  (0x100000, {24, 28, 0x0, 0, 0,  (0x100000, {24, 28, 0x0, 0, 0, "kkq-vx_mtx78"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00372   896   NtOpenMutant  (0x100000, {24, 28, 0x0, 0, 0,  (0x100000, {24, 28, 0x0, 0, 0, "kkq-vx_mtx79"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00373   896   NtOpenMutant  (0x100000, {24, 28, 0x0, 0, 0,  (0x100000, {24, 28, 0x0, 0, 0, "kkq-vx_mtx80"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00374   896   NtOpenMutant  (0x100000, {24, 28, 0x0, 0, 0,  (0x100000, {24, 28, 0x0, 0, 0, "kkq-vx_mtx81"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00375   896   NtOpenMutant  (0x100000, {24, 28, 0x0, 0, 0,  (0x100000, {24, 28, 0x0, 0, 0, "kkq-vx_mtx82"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00376   896   NtOpenMutant  (0x100000, {24, 28, 0x0, 0, 0,  (0x100000, {24, 28, 0x0, 0, 0, "kkq-vx_mtx83"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00377   896   NtOpenMutant  (0x100000, {24, 28, 0x0, 0, 0,  (0x100000, {24, 28, 0x0, 0, 0, "kkq-vx_mtx84"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00378   896   NtOpenMutant  (0x100000, {24, 28, 0x0, 0, 0,  (0x100000, {24, 28, 0x0, 0, 0, "kkq-vx_mtx85"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00379   896   NtOpenMutant  (0x100000, {24, 28, 0x0, 0, 0,  (0x100000, {24, 28, 0x0, 0, 0, "kkq-vx_mtx86"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00380   896   NtOpenMutant  (0x100000, {24, 28, 0x0, 0, 0,  (0x100000, {24, 28, 0x0, 0, 0, "kkq-vx_mtx87"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00381   896   NtOpenMutant  (0x100000, {24, 28, 0x0, 0, 0,  (0x100000, {24, 28, 0x0, 0, 0, "kkq-vx_mtx88"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00382   896   NtOpenMutant  (0x100000, {24, 28, 0x0, 0, 0,  (0x100000, {24, 28, 0x0, 0, 0, "kkq-vx_mtx89"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00383   896   NtOpenMutant  (0x100000, {24, 28, 0x0, 0, 0,  (0x100000, {24, 28, 0x0, 0, 0, "kkq-vx_mtx90"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00384   896   NtOpenMutant  (0x100000, {24, 28, 0x0, 0, 0,  (0x100000, {24, 28, 0x0, 0, 0, "kkq-vx_mtx91"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00385   896   NtOpenMutant  (0x100000, {24, 28, 0x0, 0, 0,  (0x100000, {24, 28, 0x0, 0, 0, "kkq-vx_mtx92"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00386   896   NtOpenMutant  (0x100000, {24, 28, 0x0, 0, 0,  (0x100000, {24, 28, 0x0, 0, 0, "kkq-vx_mtx93"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00387   896   NtOpenMutant  (0x100000, {24, 28, 0x0, 0, 0,  (0x100000, {24, 28, 0x0, 0, 0, "kkq-vx_mtx94"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00388   896   NtOpenMutant  (0x100000, {24, 28, 0x0, 0, 0,  (0x100000, {24, 28, 0x0, 0, 0, "kkq-vx_mtx95"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00389   896   NtOpenMutant  (0x100000, {24, 28, 0x0, 0, 0,  (0x100000, {24, 28, 0x0, 0, 0, "kkq-vx_mtx96"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00390   896   NtOpenMutant  (0x100000, {24, 28, 0x0, 0, 0,  (0x100000, {24, 28, 0x0, 0, 0, "kkq-vx_mtx97"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00391   896   NtOpenMutant  (0x100000, {24, 28, 0x0, 0, 0,  (0x100000, {24, 28, 0x0, 0, 0, "kkq-vx_mtx98"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00392   896   NtOpenMutant  (0x100000, {24, 28, 0x0, 0, 0,  (0x100000, {24, 28, 0x0, 0, 0, "kkq-vx_mtx99"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00393   896   NtAllocateVirtualMemory  (-1, 0, 0, 2097152, 8192, 4, ... 7733248, 2097152, ) == 0x0
 00394   896   NtAllocateVirtualMemory  (-1, 9822208, 0, 8192, 4096, 4, ... 9822208, 8192, ) == 0x0
 00395   896   NtProtectVirtualMemory  (-1, (0x95e000), 4096, 260, ... (0x95e000), 4096, 4, ) == 0x0
 00396   896   NtCreateThread  (0x1f03ff, 0x0, -1, 2292332, 2292276, 1, ... 16, {1252, 2016}, ) == 0x0
 00397   896   NtQueryInformationThread  (16, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ffde000,Pid=1252,Tid=2016,}, 0x0, ) == 0x0
 00398   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 2088770935, 4227072, 5572560, 0}  (24, {28, 56, new_msg, 0, 2088770935, 4227072, 5572560, 0} "\0\0\0\0\1\0\1\0mtx99\0sr\20\0\0\0\344\4\0\0\340\7\0\0" ... {28, 56, reply, 0, 1252, 896, 81846, 0} "\0\0\0\0\1\0\1\0\0\0\0\09\0sr\20\0\0\0\344\4\0\0\340\7\0\0" )  ... {28, 56, reply, 0, 1252, 896, 81846, 0}  (24, {28, 56, new_msg, 0, 2088770935, 4227072, 5572560, 0} "\0\0\0\0\1\0\1\0mtx99\0sr\20\0\0\0\344\4\0\0\340\7\0\0" ... {28, 56, reply, 0, 1252, 896, 81846, 0} "\0\0\0\0\1\0\1\0\0\0\0\09\0sr\20\0\0\0\344\4\0\0\340\7\0\0" )  ) == 0x0
 00399   896   NtResumeThread  (16, ... 1, ) == 0x0
 00400  2016   NtTestAlert  (... ) == 0x0
 00401  2016   NtContinue  (9829680, 1, ...
 00402  2016   NtRegisterThreadTerminatePort  (24, ... ) == 0x0
 00403  2016   NtOpenSection  (0xe, {24, 8, 0x40, 0, 0,  (0xe, {24, 8, 0x40, 0, 0, "pstorec.dll"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00404  2016   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\u:\work\pstorec.dll"}, 9827864, ... }, 9827864, ...
 00405   896   NtQueryVirtualMemory  (-1, 0x408729, BasicVlm, 16, ... {memory info, class 3, size 16}, 0x0, ) == 0x0
 00406   896   NtQueryVirtualMemory  (-1, 0x408729, Basic, 28, ... {BaseAddress=0x408000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x1000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 00407   896   NtContinue  (2292976, 0, ...
 00408   896   NtAllocateVirtualMemory  (-1, 0, 0, 2398, 4096, 64, ... 3276800, 4096, ) == 0x0
 00409   896   NtCreateEvent  (0x100003, 0x0, 1, 0, ... 32, ) == 0x0
 00410   896   NtWaitForSingleObject  (32, 0, 0x0, ...
 00404  2016   NtQueryAttributesFile  ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00411  2016   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\pstorec.dll"}, 9827864, ... ) }, 9827864, ... ) == 0x0
 00412  2016   NtOpenFile  (0x100020, {24, 0, 0x40, 0, 0,  (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\pstorec.dll"}, 5, 96, ... 36, {status=0x0, info=1}, ) }, 5, 96, ... 36, {status=0x0, info=1}, ) == 0x0
 00413  2016   NtCreateSection  (0xf, 0x0, 0x0, 16, 16777216, 36, ... 40, ) == 0x0
 00414  2016   NtQuerySection  (40, Image, 48, ... {section info, class 1, size 48}, 0x0, ) == 0x0
 00415  2016   NtClose  (36, ... ) == 0x0
 00416  2016   NtMapViewOfSection  (40, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x5e0c0000), 0x0, 53248, ) == 0x0
 00417  2016   NtClose  (40, ... ) == 0x0
 00418  2016   NtOpenSection  (0xe, {24, 8, 0x40, 0, 0,  (0xe, {24, 8, 0x40, 0, 0, "msvcrt.dll"}, ... 40, ) }, ... 40, ) == 0x0
 00419  2016   NtMapViewOfSection  (40, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x77c10000), 0x0, 360448, ) == 0x0
 00420  2016   NtClose  (40, ... ) == 0x0
 00421  2016   NtAllocateVirtualMemory  (-1, 9818112, 0, 4096, 4096, 260, ... 9818112, 4096, ) == 0x0
 00422  2016   NtProtectVirtualMemory  (-1, (0x77c11000), 632, 4, ... (0x77c11000), 4096, 32, ) == 0x0
 00423  2016   NtProtectVirtualMemory  (-1, (0x77c11000), 4096, 32, ... (0x77c11000), 4096, 4, ) == 0x0
 00424  2016   NtFlushInstructionCache  (-1, 2009141248, 632, ... ) == 0x0
 00425  2016   NtProtectVirtualMemory  (-1, (0x5e0c1000), 432, 4, ... (0x5e0c1000), 4096, 32, ) == 0x0
 00426  2016   NtProtectVirtualMemory  (-1, (0x5e0c1000), 4096, 32, ... (0x5e0c1000), 4096, 4, ) == 0x0
 00427  2016   NtFlushInstructionCache  (-1, 1577848832, 432, ... ) == 0x0
 00428  2016   NtOpenSection  (0xe, {24, 8, 0x40, 0, 0,  (0xe, {24, 8, 0x40, 0, 0, "ATL.DLL"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00429  2016   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\u:\work\ATL.DLL"}, 9827048, ... ) }, 9827048, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00430  2016   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\ATL.DLL"}, 9827048, ... ) }, 9827048, ... ) == 0x0
 00431  2016   NtOpenFile  (0x100020, {24, 0, 0x40, 0, 0,  (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\ATL.DLL"}, 5, 96, ... 40, {status=0x0, info=1}, ) }, 5, 96, ... 40, {status=0x0, info=1}, ) == 0x0
 00432  2016   NtCreateSection  (0xf, 0x0, 0x0, 16, 16777216, 40, ... 36, ) == 0x0
 00433  2016   NtQuerySection  (36, Image, 48, ... {section info, class 1, size 48}, 0x0, ) == 0x0
 00434  2016   NtClose  (40, ... ) == 0x0
 00435  2016   NtMapViewOfSection  (36, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x76b20000), 0x0, 69632, ) == 0x0
 00436  2016   NtClose  (36, ... ) == 0x0
 00437  2016   NtProtectVirtualMemory  (-1, (0x76b21000), 556, 4, ... (0x76b21000), 4096, 32, ) == 0x0
 00438  2016   NtProtectVirtualMemory  (-1, (0x76b21000), 4096, 32, ... (0x76b21000), 4096, 4, ) == 0x0
 00439  2016   NtFlushInstructionCache  (-1, 1991380992, 556, ... ) == 0x0
 00440  2016   NtProtectVirtualMemory  (-1, (0x76b21000), 556, 4, ... (0x76b21000), 4096, 32, ) == 0x0
 00441  2016   NtProtectVirtualMemory  (-1, (0x76b21000), 4096, 32, ... (0x76b21000), 4096, 4, ) == 0x0
 00442  2016   NtFlushInstructionCache  (-1, 1991380992, 556, ... ) == 0x0
 00443  2016   NtOpenSection  (0xe, {24, 8, 0x40, 0, 0,  (0xe, {24, 8, 0x40, 0, 0, "USER32.dll"}, ... 36, ) }, ... 36, ) == 0x0
 00444  2016   NtMapViewOfSection  (36, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x7e410000), 0x0, 589824, ) == 0x0
 00445  2016   NtClose  (36, ... ) == 0x0
 00446  2016   NtOpenSection  (0xe, {24, 8, 0x40, 0, 0,  (0xe, {24, 8, 0x40, 0, 0, "GDI32.dll"}, ... 36, ) }, ... 36, ) == 0x0
 00447  2016   NtMapViewOfSection  (36, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x77f10000), 0x0, 290816, ) == 0x0
 00448  2016   NtClose  (36, ... ) == 0x0
 00449  2016   NtProtectVirtualMemory  (-1, (0x77f11000), 508, 4, ... (0x77f11000), 4096, 32, ) == 0x0
 00450  2016   NtProtectVirtualMemory  (-1, (0x77f11000), 4096, 32, ... (0x77f11000), 4096, 4, ) == 0x0
 00451  2016   NtFlushInstructionCache  (-1, 2012286976, 508, ... ) == 0x0
 00452  2016   NtProtectVirtualMemory  (-1, (0x77f11000), 508, 4, ... (0x77f11000), 4096, 32, ) == 0x0
 00453  2016   NtProtectVirtualMemory  (-1, (0x77f11000), 4096, 32, ... (0x77f11000), 4096, 4, ) == 0x0
 00454  2016   NtFlushInstructionCache  (-1, 2012286976, 508, ... ) == 0x0
 00455  2016   NtProtectVirtualMemory  (-1, (0x77f11000), 508, 4, ... (0x77f11000), 4096, 32, ) == 0x0
 00456  2016   NtProtectVirtualMemory  (-1, (0x77f11000), 4096, 32, ... (0x77f11000), 4096, 4, ) == 0x0
 00457  2016   NtFlushInstructionCache  (-1, 2012286976, 508, ... ) == 0x0
 00458  2016   NtProtectVirtualMemory  (-1, (0x7e411000), 1252, 4, ... (0x7e411000), 4096, 32, ) == 0x0
 00459  2016   NtProtectVirtualMemory  (-1, (0x7e411000), 4096, 32, ... (0x7e411000), 4096, 4, ) == 0x0
 00460  2016   NtFlushInstructionCache  (-1, 2118193152, 1252, ... ) == 0x0
 00461  2016   NtProtectVirtualMemory  (-1, (0x7e411000), 1252, 4, ... (0x7e411000), 4096, 32, ) == 0x0
 00462  2016   NtProtectVirtualMemory  (-1, (0x7e411000), 4096, 32, ... (0x7e411000), 4096, 4, ) == 0x0
 00463  2016   NtFlushInstructionCache  (-1, 2118193152, 1252, ... ) == 0x0
 00464  2016   NtProtectVirtualMemory  (-1, (0x7e411000), 1252, 4, ... (0x7e411000), 4096, 32, ) == 0x0
 00465  2016   NtProtectVirtualMemory  (-1, (0x7e411000), 4096, 32, ... (0x7e411000), 4096, 4, ) == 0x0
 00466  2016   NtFlushInstructionCache  (-1, 2118193152, 1252, ... ) == 0x0
 00467  2016   NtProtectVirtualMemory  (-1, (0x76b21000), 556, 4, ... (0x76b21000), 4096, 32, ) == 0x0
 00468  2016   NtProtectVirtualMemory  (-1, (0x76b21000), 4096, 32, ... (0x76b21000), 4096, 4, ) == 0x0
 00469  2016   NtFlushInstructionCache  (-1, 1991380992, 556, ... ) == 0x0
 00470  2016   NtProtectVirtualMemory  (-1, (0x76b21000), 556, 4, ... (0x76b21000), 4096, 32, ) == 0x0
 00471  2016   NtProtectVirtualMemory  (-1, (0x76b21000), 4096, 32, ... (0x76b21000), 4096, 4, ) == 0x0
 00472  2016   NtFlushInstructionCache  (-1, 1991380992, 556, ... ) == 0x0
 00473  2016   NtProtectVirtualMemory  (-1, (0x5e0c1000), 432, 4, ... (0x5e0c1000), 4096, 32, ) == 0x0
 00474  2016   NtProtectVirtualMemory  (-1, (0x5e0c1000), 4096, 32, ... (0x5e0c1000), 4096, 4, ) == 0x0
 00475  2016   NtFlushInstructionCache  (-1, 1577848832, 432, ... ) == 0x0
 00476  2016   NtOpenSection  (0xe, {24, 8, 0x40, 0, 0,  (0xe, {24, 8, 0x40, 0, 0, "ADVAPI32.dll"}, ... 36, ) }, ... 36, ) == 0x0
 00477  2016   NtMapViewOfSection  (36, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x77dd0000), 0x0, 634880, ) == 0x0
 00478  2016   NtClose  (36, ... ) == 0x0
 00479  2016   NtProtectVirtualMemory  (-1, (0x77dd1000), 1700, 4, ... (0x77dd1000), 4096, 32, ) == 0x0
 00480  2016   NtProtectVirtualMemory  (-1, (0x77dd1000), 4096, 32, ... (0x77dd1000), 4096, 4, ) == 0x0
 00481  2016   NtFlushInstructionCache  (-1, 2010976256, 1700, ... ) == 0x0
 00482  2016   NtOpenSection  (0xe, {24, 8, 0x40, 0, 0,  (0xe, {24, 8, 0x40, 0, 0, "RPCRT4.dll"}, ... 36, ) }, ... 36, ) == 0x0
 00483  2016   NtMapViewOfSection  (36, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x77e70000), 0x0, 593920, ) == 0x0
 00484  2016   NtClose  (36, ... ) == 0x0
 00485  2016   NtProtectVirtualMemory  (-1, (0x77e71000), 868, 4, ... (0x77e71000), 4096, 32, ) == 0x0
 00486  2016   NtProtectVirtualMemory  (-1, (0x77e71000), 4096, 32, ... (0x77e71000), 4096, 4, ) == 0x0
 00487  2016   NtFlushInstructionCache  (-1, 2011631616, 868, ... ) == 0x0
 00488  2016   NtProtectVirtualMemory  (-1, (0x77e71000), 868, 4, ... (0x77e71000), 4096, 32, ) == 0x0
 00489  2016   NtProtectVirtualMemory  (-1, (0x77e71000), 4096, 32, ... (0x77e71000), 4096, 4, ) == 0x0
 00490  2016   NtFlushInstructionCache  (-1, 2011631616, 868, ... ) == 0x0
 00491  2016   NtProtectVirtualMemory  (-1, (0x77e71000), 868, 4, ... (0x77e71000), 4096, 32, ) == 0x0
 00492  2016   NtProtectVirtualMemory  (-1, (0x77e71000), 4096, 32, ... (0x77e71000), 4096, 4, ) == 0x0
 00493  2016   NtFlushInstructionCache  (-1, 2011631616, 868, ... ) == 0x0
 00494  2016   NtProtectVirtualMemory  (-1, (0x77dd1000), 1700, 4, ... (0x77dd1000), 4096, 32, ) == 0x0
 00495  2016   NtProtectVirtualMemory  (-1, (0x77dd1000), 4096, 32, ... (0x77dd1000), 4096, 4, ) == 0x0
 00496  2016   NtFlushInstructionCache  (-1, 2010976256, 1700, ... ) == 0x0
 00497  2016   NtProtectVirtualMemory  (-1, (0x5e0c1000), 432, 4, ... (0x5e0c1000), 4096, 32, ) == 0x0
 00498  2016   NtProtectVirtualMemory  (-1, (0x5e0c1000), 4096, 32, ... (0x5e0c1000), 4096, 4, ) == 0x0
 00499  2016   NtFlushInstructionCache  (-1, 1577848832, 432, ... ) == 0x0
 00500  2016   NtOpenSection  (0xe, {24, 8, 0x40, 0, 0,  (0xe, {24, 8, 0x40, 0, 0, "ole32.dll"}, ... 36, ) }, ... 36, ) == 0x0
 00501  2016   NtMapViewOfSection  (36, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x774e0000), 0x0, 1298432, ) == 0x0
 00502  2016   NtClose  (36, ... ) == 0x0
 00503  2016   NtProtectVirtualMemory  (-1, (0x774e1000), 2352, 4, ... (0x774e1000), 4096, 32, ) == 0x0
 00504  2016   NtProtectVirtualMemory  (-1, (0x774e1000), 4096, 32, ... (0x774e1000), 4096, 4, ) == 0x0
 00505  2016   NtFlushInstructionCache  (-1, 2001604608, 2352, ... ) == 0x0
 00506  2016   NtProtectVirtualMemory  (-1, (0x774e1000), 2352, 4, ... (0x774e1000), 4096, 32, ) == 0x0
 00507  2016   NtProtectVirtualMemory  (-1, (0x774e1000), 4096, 32, ... (0x774e1000), 4096, 4, ) == 0x0
 00508  2016   NtFlushInstructionCache  (-1, 2001604608, 2352, ... ) == 0x0
 00509  2016   NtProtectVirtualMemory  (-1, (0x774e1000), 2352, 4, ... (0x774e1000), 4096, 32, ) == 0x0
 00510  2016   NtProtectVirtualMemory  (-1, (0x774e1000), 4096, 32, ... (0x774e1000), 4096, 4, ) == 0x0
 00511  2016   NtFlushInstructionCache  (-1, 2001604608, 2352, ... ) == 0x0
 00512  2016   NtProtectVirtualMemory  (-1, (0x774e1000), 2352, 4, ... (0x774e1000), 4096, 32, ) == 0x0
 00513  2016   NtProtectVirtualMemory  (-1, (0x774e1000), 4096, 32, ... (0x774e1000), 4096, 4, ) == 0x0
 00514  2016   NtFlushInstructionCache  (-1, 2001604608, 2352, ... ) == 0x0
 00515  2016   NtProtectVirtualMemory  (-1, (0x774e1000), 2352, 4, ... (0x774e1000), 4096, 32, ) == 0x0
 00516  2016   NtProtectVirtualMemory  (-1, (0x774e1000), 4096, 32, ... (0x774e1000), 4096, 4, ) == 0x0
 00517  2016   NtFlushInstructionCache  (-1, 2001604608, 2352, ... ) == 0x0
 00518  2016   NtProtectVirtualMemory  (-1, (0x774e1000), 2352, 4, ... (0x774e1000), 4096, 32, ) == 0x0
 00519  2016   NtProtectVirtualMemory  (-1, (0x774e1000), 4096, 32, ... (0x774e1000), 4096, 4, ) == 0x0
 00520  2016   NtFlushInstructionCache  (-1, 2001604608, 2352, ... ) == 0x0
 00521  2016   NtProtectVirtualMemory  (-1, (0x774e1000), 2352, 4, ... (0x774e1000), 4096, 32, ) == 0x0
 00522  2016   NtProtectVirtualMemory  (-1, (0x774e1000), 4096, 32, ... (0x774e1000), 4096, 4, ) == 0x0
 00523  2016   NtFlushInstructionCache  (-1, 2001604608, 2352, ... ) == 0x0
 00524  2016   NtProtectVirtualMemory  (-1, (0x5e0c1000), 432, 4, ... (0x5e0c1000), 4096, 32, ) == 0x0
 00525  2016   NtProtectVirtualMemory  (-1, (0x5e0c1000), 4096, 32, ... (0x5e0c1000), 4096, 4, ) == 0x0
 00526  2016   NtFlushInstructionCache  (-1, 1577848832, 432, ... ) == 0x0
 00527  2016   NtProtectVirtualMemory  (-1, (0x5e0c1000), 432, 4, ... (0x5e0c1000), 4096, 32, ) == 0x0
 00528  2016   NtProtectVirtualMemory  (-1, (0x5e0c1000), 4096, 32, ... (0x5e0c1000), 4096, 4, ) == 0x0
 00529  2016   NtFlushInstructionCache  (-1, 1577848832, 432, ... ) == 0x0
 00530  2016   NtOpenKey  (0x80000000, {24, 0, 0x40, 0, 0,  (0x80000000, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msvcrt.dll"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00531  2016   NtQuerySystemInformation  (Basic, 44, ... {Unknown=0,MaximumIncrement=156250,PhysicalPageSize=0x1000,NumberOfPhysicalPages=0xff7c,LowestPhysicalPage=0x1,HighestPhysicalPage=0xffff,AllocationGranularity=0x10000,LowestUserAddress=0x10000,HighestUserAddress=0x7ffeffff,ActiveProcessors=1,NumberProcessors=1,}, 0x0, ) == 0x0
 00532  2016   NtAllocateVirtualMemory  (-1, 0, 0, 65536, 8192, 4, ... 3342336, 65536, ) == 0x0
 00533  2016   NtAllocateVirtualMemory  (-1, 3342336, 0, 4096, 4096, 4, ... 3342336, 4096, ) == 0x0
 00534  2016   NtAllocateVirtualMemory  (-1, 3346432, 0, 8192, 4096, 4, ... 3346432, 8192, ) == 0x0
 00535  2016   NtAllocateVirtualMemory  (-1, 3354624, 0, 4096, 4096, 4, ... 3354624, 4096, ) == 0x0
 00536  2016   NtOpenSection  (0x4, {24, 0, 0x40, 0, 0,  (0x4, {24, 0, 0x40, 0, 0, "\NLS\NlsSectionCType"}, ... 36, ) }, ... 36, ) == 0x0
 00537  2016   NtMapViewOfSection  (36, -1, (0x0), 0, 0, 0x0, 0, 2, 0, 2, ... (0x340000), 0x0, 12288, ) == 0x0
 00538  2016   NtClose  (36, ... ) == 0x0
 00539  2016   NtAllocateVirtualMemory  (-1, 3358720, 0, 4096, 4096, 4, ... 3358720, 4096, ) == 0x0
 00540  2016   NtQueryVirtualMemory  (-1, 0x77c2807c, Basic, 28, ... {BaseAddress=0x77c28000,AllocationBase=0x77c10000,AllocationProtect=0x80,RegionSize=0x35000,State=0x1000,Protect=0x20,Type=0x1000000,}, 28, ) == 0x0
 00541  2016   NtQueryInformationProcess  (-1, 36, 4, ... {process info, class 36, size 4}, 0x0, ) == 0x0
 00542  2016   NtQueryInformationProcess  (-1, 36, 4, ... {process info, class 36, size 4}, 0x0, ) == 0x0
 00543  2016   NtQueryVirtualMemory  (-1, 0x0, Basic, 28, ... {BaseAddress=0x0,AllocationBase=0x0,AllocationProtect=0x0,RegionSize=0x10000,State=0x10000,Protect=0x1,Type=0x0,}, 28, ) == 0x0
 00544  2016   NtOpenKey  (0x80000000, {24, 0, 0x40, 0, 0,  (0x80000000, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\GDI32.dll"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00545  2016   NtOpenKey  (0x80000000, {24, 0, 0x40, 0, 0,  (0x80000000, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\USER32.dll"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00546  2016   NtQuerySystemInformation  (Basic, 44, ... {Unknown=0,MaximumIncrement=156250,PhysicalPageSize=0x1000,NumberOfPhysicalPages=0xff7c,LowestPhysicalPage=0x1,HighestPhysicalPage=0xffff,AllocationGranularity=0x10000,LowestUserAddress=0x10000,HighestUserAddress=0x7ffeffff,ActiveProcessors=1,NumberProcessors=1,}, 0x0, ) == 0x0
 00547  2016   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 256, 9827596, 256, 9827340}  (24, {28, 56, new_msg, 0, 256, 9827596, 256, 9827340} "\210\6!\1\0\0\0\0\0\0\0\0\1\0\0\0\3\0\0\0\234\6!\1$\1\0\0" ... {28, 56, reply, 0, 1252, 2016, 81847, 0} "\320G\26\0\0\0\0\0\0\0\0\0\1\0\0\0\3\0\0\0\234\6!\1$\1\0\0" )  ... {28, 56, reply, 0, 1252, 2016, 81847, 0}  (24, {28, 56, new_msg, 0, 256, 9827596, 256, 9827340} "\210\6!\1\0\0\0\0\0\0\0\0\1\0\0\0\3\0\0\0\234\6!\1$\1\0\0" ... {28, 56, reply, 0, 1252, 2016, 81847, 0} "\320G\26\0\0\0\0\0\0\0\0\0\1\0\0\0\3\0\0\0\234\6!\1$\1\0\0" )  ) == 0x0
 00548  2016   NtAllocateVirtualMemory  (-1, 5664768, 0, 4096, 4096, 4, ... 5664768, 4096, ) == 0x0
 00549  2016   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\IMM32.DLL"}, 9823924, ... ) }, 9823924, ... ) == 0x0
 00550  2016   NtOpenFile  (0x100020, {24, 0, 0x40, 0, 0,  (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\IMM32.DLL"}, 5, 96, ... 36, {status=0x0, info=1}, ) }, 5, 96, ... 36, {status=0x0, info=1}, ) == 0x0
 00551  2016   NtCreateSection  (0xe, 0x0, 0x0, 16, 134217728, 36, ... 40, ) == 0x0
 00552  2016   NtClose  (36, ... ) == 0x0
 00553  2016   NtMapViewOfSection  (40, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 16, ... (0x350000), 0x0, 110592, ) == 0x0
 00554  2016   NtClose  (40, ... ) == 0x0
 00555  2016   NtUnmapViewOfSection  (-1, 0x350000, ... ) == 0x0
 00556  2016   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\IMM32.DLL"}, 9823832, ... ) }, 9823832, ... ) == 0x0
 00557  2016   NtOpenFile  (0x100020, {24, 0, 0x40, 0, 0,  (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\IMM32.DLL"}, 5, 96, ... 40, {status=0x0, info=1}, ) }, 5, 96, ... 40, {status=0x0, info=1}, ) == 0x0
 00558  2016   NtCreateSection  (0xe, 0x0, 0x0, 16, 134217728, 40, ... 36, ) == 0x0
 00559  2016   NtClose  (40, ... ) == 0x0
 00560  2016   NtMapViewOfSection  (36, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 16, ... (0x350000), 0x0, 110592, ) == 0x0
 00561  2016   NtClose  (36, ... ) == 0x0
 00562  2016   NtUnmapViewOfSection  (-1, 0x350000, ... ) == 0x0
 00563  2016   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\IMM32.DLL"}, 9824140, ... ) }, 9824140, ... ) == 0x0
 00564  2016   NtOpenFile  (0x100020, {24, 0, 0x40, 0, 0,  (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\IMM32.DLL"}, 5, 96, ... 36, {status=0x0, info=1}, ) }, 5, 96, ... 36, {status=0x0, info=1}, ) == 0x0
 00565  2016   NtCreateSection  (0xf, 0x0, 0x0, 16, 16777216, 36, ... 40, ) == 0x0
 00566  2016   NtQuerySection  (40, Image, 48, ... {section info, class 1, size 48}, 0x0, ) == 0x0
 00567  2016   NtClose  (36, ... ) == 0x0
 00568  2016   NtMapViewOfSection  (40, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x76390000), 0x0, 118784, ) == 0x0
 00569  2016   NtClose  (40, ... ) == 0x0
 00570  2016   NtProtectVirtualMemory  (-1, (0x76391000), 696, 4, ... (0x76391000), 4096, 32, ) == 0x0
 00571  2016   NtProtectVirtualMemory  (-1, (0x76391000), 4096, 32, ... (0x76391000), 4096, 4, ) == 0x0
 00572  2016   NtFlushInstructionCache  (-1, 1983451136, 696, ... ) == 0x0
 00573  2016   NtProtectVirtualMemory  (-1, (0x76391000), 696, 4, ... (0x76391000), 4096, 32, ) == 0x0
 00574  2016   NtProtectVirtualMemory  (-1, (0x76391000), 4096, 32, ... (0x76391000), 4096, 4, ) == 0x0
 00575  2016   NtFlushInstructionCache  (-1, 1983451136, 696, ... ) == 0x0
 00576  2016   NtProtectVirtualMemory  (-1, (0x76391000), 696, 4, ... (0x76391000), 4096, 32, ) == 0x0
 00577  2016   NtProtectVirtualMemory  (-1, (0x76391000), 4096, 32, ... (0x76391000), 4096, 4, ) == 0x0
 00578  2016   NtFlushInstructionCache  (-1, 1983451136, 696, ... ) == 0x0
 00579  2016   NtOpenKey  (0x80000000, {24, 0, 0x40, 0, 0,  (0x80000000, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\IMM32.DLL"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00580  2016   NtQuerySystemInformation  (Basic, 44, ... {Unknown=0,MaximumIncrement=156250,PhysicalPageSize=0x1000,NumberOfPhysicalPages=0xff7c,LowestPhysicalPage=0x1,HighestPhysicalPage=0xffff,AllocationGranularity=0x10000,LowestUserAddress=0x10000,HighestUserAddress=0x7ffeffff,ActiveProcessors=1,NumberProcessors=1,}, 0x0, ) == 0x0
 00581  2016   NtAllocateVirtualMemory  (-1, 9814016, 0, 4096, 4096, 260, ... 9814016, 4096, ) == 0x0
 00582  2016   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\IMM32.DLL"}, 9821056, ... ) }, 9821056, ... ) == 0x0
 00583  2016   NtOpenKey  (0x80000000, {24, 0, 0x40, 0, 0,  (0x80000000, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ATL.DLL"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00584  2016   NtOpenKey  (0x80000000, {24, 0, 0x40, 0, 0,  (0x80000000, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RPCRT4.dll"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00585  2016   NtOpenKey  (0x80000000, {24, 0, 0x40, 0, 0,  (0x80000000, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ADVAPI32.dll"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00586  2016   NtOpenKey  (0x80000000, {24, 0, 0x40, 0, 0,  (0x80000000, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ole32.dll"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00587  2016   NtOpenKey  (0x80000000, {24, 0, 0x40, 0, 0,  (0x80000000, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\pstorec.dll"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00588  2016   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\IMM32.DLL"}, 9824460, ... ) }, 9824460, ... ) == 0x0
 00589  2016   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\System\CurrentControlSet\Control\Error Message Instrument\"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00590  2016   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\GRE_Initialize"}, ... 40, ) }, ... 40, ) == 0x0
 00591  2016   NtQueryValueKey  (40,  (40, "DisableMetaFiles", Partial, 20, ... ) , Partial, 20, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00592  2016   NtClose  (40, ... ) == 0x0
 00593  2016   NtMapViewOfSection  (-2147482748, -1, (0x0), 0, 0, 0x0, 0, 2, 0, 2, ... (0xa30000), 0x0, 1060864, ) == 0x0
 00594  2016   NtClose  (-2147482748, ... ) == 0x0
 00595  2016   NtCreateEvent  (0x1f0003, 0x0, 1, 0, ... 40, ) == 0x0
 00596  2016   NtOpenThreadTokenEx  (-2, 0x8, 1, 512, ... ) == STATUS_NO_TOKEN
 00597  2016   NtOpenProcessTokenEx  (-1, 0x8, 512, ... -2147482748, ) == 0x0
 00598  2016   NtQueryInformationToken  (-2147482748, Statistics, 0, ... ) == STATUS_BUFFER_TOO_SMALL
 00599  2016   NtQueryInformationToken  (-2147482748, Statistics, 56, ... {token info, class 10, size 56}, 56, ) == 0x0
 00600  2016   NtClose  (-2147482748, ... ) == 0x0
 00601  2016   NtAllocateVirtualMemory  (-1, 0, 0, 32, 4096, 4, ... 3473408, 4096, ) == 0x0
 00602  2016   NtFreeVirtualMemory  (-1, (0x350000), 4096, 32768, ... (0x350000), 4096, ) == 0x0
 00603  2016   NtDuplicateObject  (-1, 36, -1, 0x0, 0, 2, ... 48, ) == 0x0
 00604  2016   NtOpenKey  (0x20019, {24, 0, 0x240, 0, 0,  (0x20019, {24, 0, 0x240, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Compatibility32"}, ... -2147482748, ) }, ... -2147482748, ) == 0x0
 00605  2016   NtQueryValueKey  (-2147482748,  (-2147482748, "packed", Partial, 172, ... ) , Partial, 172, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00606  2016   NtClose  (-2147482748, ... ) == 0x0
 00607  2016   NtOpenKey  (0x20019, {24, 0, 0x240, 0, 0,  (0x20019, {24, 0, 0x240, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\IME Compatibility"}, ... -2147482748, ) }, ... -2147482748, ) == 0x0
 00608  2016   NtQueryValueKey  (-2147482748,  (-2147482748, "packed", Partial, 172, ... ) , Partial, 172, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00609  2016   NtClose  (-2147482748, ... ) == 0x0
 00610  2016   NtQueryDefaultLocale  (0, -135747252, ... ) == 0x0
 00611  2016   NtGdiQueryFontAssocInfo  (0, ... ) == 0x0
 00612  2016   NtUserCallNoParam  (24, ... ) == 0x0
 00613  2016   NtGdiCreateCompatibleDC  (0, ...
 00614  2016   NtAllocateVirtualMemory  (-1, 0, 0, 4096, 12288, 4, ... 3473408, 4096, ) == 0x0
 00613  2016   NtGdiCreateCompatibleDC  ... ) == 0x860107ab
 00615  2016   NtGdiGetStockObject  (0, ... ) == 0x1900010
 00616  2016   NtGdiGetStockObject  (4, ... ) == 0x1900011
 00617  2016   NtGdiCreateBitmap  (8, 8, 1, 1, 2118200212, ... ) == 0x870506a2
 00618  2016   NtGdiCreateSolidBrush  (0, 0, ...
 00619  2016   NtAllocateVirtualMemory  (-1, 0, 0, 4096, 12288, 4, ... 3538944, 4096, ) == 0x0
 00618  2016   NtGdiCreateSolidBrush  ... ) == 0x1100680
 00620  2016   NtGdiGetStockObject  (13, ... ) == 0x18a0021
 00621  2016   NtGdiCreateCompatibleDC  (0, ... ) == 0xf6010687
 00622  2016   NtGdiSelectBitmap  (-167704953, -2029713758, ... ) == 0x185000f
 00623  2016   NtUserGetThreadDesktop  (2016, 0, ... ) == 0x2c
 00624  2016   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Windows"}, ... 52, ) }, ... 52, ) == 0x0
 00625  2016   NtQueryValueKey  (52,  (52, "AppInit_DLLs", Partial, 64, ... TitleIdx=0, Type=1, Data="\0\0"}, 14, ) , Partial, 64, ... TitleIdx=0, Type=1, Data= (52, "AppInit_DLLs", Partial, 64, ... TitleIdx=0, Type=1, Data="\0\0"}, 14, ) }, 14, ) == 0x0
 00626  2016   NtClose  (52, ... ) == 0x0
 00627  2016   NtUserFindExistingCursorIcon  (9825636, 9825652, 9825700, ... ) == 0x10011
 00628  2016   NtUserRegisterClassExWOW  (9825648, 9825716, 9825732, 9825748, 673, 128, 0, ... ) == 0x8169c017
 00629  2016   NtUserFindExistingCursorIcon  (9825636, 9825652, 9825700, ... ) == 0x10011
 00630  2016   NtUserRegisterClassExWOW  (9825648, 9825716, 9825732, 9825748, 674, 128, 0, ... ) == 0x8169c01c
 00631  2016   NtUserFindExistingCursorIcon  (9825636, 9825652, 9825700, ... ) == 0x10011
 00632  2016   NtUserRegisterClassExWOW  (9825648, 9825716, 9825732, 9825748, 675, 128, 0, ... ) == 0x8169c01e
 00633  2016   NtUserFindExistingCursorIcon  (9825636, 9825652, 9825700, ... ) == 0x10011
 00634  2016   NtUserRegisterClassExWOW  (9825648, 9825716, 9825732, 9825748, 676, 128, 0, ... ) == 0x81698002
 00635  2016   NtUserFindExistingCursorIcon  (9825636, 9825652, 9825700, ... ) == 0x10013
 00636  2016   NtUserRegisterClassExWOW  (9825648, 9825716, 9825732, 9825748, 677, 128, 0, ... ) == 0x8169c018
 00637  2016   NtUserFindExistingCursorIcon  (9825636, 9825652, 9825700, ... ) == 0x10011
 00638  2016   NtUserRegisterClassExWOW  (9825648, 9825716, 9825732, 9825748, 678, 128, 0, ... ) == 0x8169c01a
 00639  2016   NtUserFindExistingCursorIcon  (9825636, 9825652, 9825700, ... ) == 0x10011
 00640  2016   NtUserRegisterClassExWOW  (9825648, 9825716, 9825732, 9825748, 679, 128, 0, ... ) == 0x8169c01d
 00641  2016   NtUserFindExistingCursorIcon  (9825636, 9825652, 9825700, ... ) == 0x10011
 00642  2016   NtUserRegisterClassExWOW  (9825648, 9825716, 9825732, 9825748, 681, 128, 0, ... ) == 0x8169c026
 00643  2016   NtUserFindExistingCursorIcon  (9825636, 9825652, 9825700, ... ) == 0x10011
 00644  2016   NtUserRegisterClassExWOW  (9825648, 9825716, 9825732, 9825748, 680, 128, 0, ... ) == 0x8169c019
 00645  2016   NtUserRegisterClassExWOW  (9825600, 9825668, 9825684, 9825700, 0, 128, 0, ... ) == 0x8169c020
 00646  2016   NtUserRegisterClassExWOW  (9825856, 9825952, 9825936, 9825924, 0, 130, 0, ... ) == 0x8169c022
 00647  2016   NtUserRegisterClassExWOW  (9825600, 9825668, 9825684, 9825700, 0, 128, 0, ... ) == 0x8169c023
 00648  2016   NtUserRegisterClassExWOW  (9825856, 9825952, 9825936, 9825924, 0, 130, 0, ... ) == 0x8169c024
 00649  2016   NtUserRegisterClassExWOW  (9825600, 9825668, 9825684, 9825700, 0, 128, 0, ... ) == 0x8169c025
 00650  2016   NtCallbackReturn  (0, 0, 0, ...
 00651  2016   NtGdiInit  (... ) == 0x1
 00652  2016   NtGdiGetStockObject  (18, ... ) == 0x290001c
 00653  2016   NtGdiGetStockObject  (19, ... ) == 0x1b00019
 00654  2016   NtQueryPerformanceCounter  (... {-1440596792, 16}, {3579545, 0}, ) == 0x0
 00655  2016   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\System\CurrentControlSet\Control\Terminal Server"}, ... 52, ) }, ... 52, ) == 0x0
 00656  2016   NtQueryValueKey  (52,  (52, "TSAppCompat", Partial, 548, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) , Partial, 548, ... TitleIdx=0, Type=4, Data= (52, "TSAppCompat", Partial, 548, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) }, 16, ) == 0x0
 00657  2016   NtQueryValueKey  (52,  (52, "TSUserEnabled", Partial, 548, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) , Partial, 548, ... TitleIdx=0, Type=4, Data= (52, "TSUserEnabled", Partial, 548, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) }, 16, ) == 0x0
 00658  2016   NtClose  (52, ... ) == 0x0
 00659  2016   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon"}, ... 52, ) }, ... 52, ) == 0x0
 00660  2016   NtQueryValueKey  (52,  (52, "LeakTrack", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00661  2016   NtClose  (52, ... ) == 0x0
 00662  2016   NtOpenKey  (0x2000000, {24, 0, 0x40, 0, 0,  (0x2000000, {24, 0, 0x40, 0, 0, "\REGISTRY\MACHINE"}, ... 52, ) }, ... 52, ) == 0x0
 00663  2016   NtSetInformationObject  (52, Handle, {Inherit=0,ProtectFromClose=1,}, 2011431168, ... ) == 0x0
 00664  2016   NtOpenKey  (0x20019, {24, 52, 0x40, 0, 0,  (0x20019, {24, 52, 0x40, 0, 0, "Software\Microsoft\Windows NT\CurrentVersion\Diagnostics"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00665  2016   NtAllocateVirtualMemory  (-1, 5668864, 0, 4096, 4096, 4, ... 5668864, 4096, ) == 0x0
 00666  2016   NtOpenFile  (0x100001, {24, 0, 0x40, 0, 0,  (0x100001, {24, 0, 0x40, 0, 0, "\Device\KsecDD"}, 7, 16, ... 56, {status=0x0, info=0}, ) }, 7, 16, ... 56, {status=0x0, info=0}, ) == 0x0
 00667  2016   NtDeviceIoControlFile  (56, 0, 0x0, 0x0, 0x390008,  (56, 0, 0x0, 0x0, 0x390008, "-k)O\250\234\230;)\247xB\363\327,\366\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0", 256, 256, ... , 256, 256, ...
 00668  2016   NtQuerySystemInformation  (TimeOfDay, 48, ... {system info, class 3, size 48}, 48, ) == 0x0
 00669  2016   NtQuerySystemInformation  (ProcessorTimes, 48, ... {system info, class 8, size 48}, 48, ) == 0x0
 00670  2016   NtQuerySystemInformation  (Performance, 312, ... {system info, class 2, size 312}, 312, ) == 0x0
 00671  2016   NtQuerySystemInformation  (Exception, 16, ... {system info, class 33, size 16}, 16, ) == 0x0
 00672  2016   NtQuerySystemInformation  (Lookaside, 32, ... {system info, class 45, size 32}, 32, ) == 0x0
 00673  2016   NtQuerySystemInformation  (ProcessorStatistics, 3016, ... {system info, class 23, size 0}, 0, ) == 0x0
 00674  2016   NtQuerySystemInformation  (ProcessesAndThreads, 3008, ... ) == STATUS_INFO_LENGTH_MISMATCH
 00675  2016   NtCreateKey  (0x2, {24, 0, 0x240, 0, 0,  (0x2, {24, 0, 0x240, 0, 0, "\Registry\Machine\SOFTWARE\Microsoft\Cryptography\RNG"}, 0, 0x0, 0, ... -2147482748, 2, ) }, 0, 0x0, 0, ... -2147482748, 2, ) == 0x0
 00676  2016   NtSetValueKey  (-2147482748,  (-2147482748, "Seed", 0, 3, "\233\310m\217z\211-O:5\267\252\2739v:\264\316}\220~\301p7\241\14E\250\340\30&?o\256\301\374K\36\306\234\32\326@2\376\246\315\320\235\356\344\213Yq\2708\321\252\346\16}\0\367\215\367\340\376\223j\370bR\213HL:\307_\226\10", 80, ... ) , 0, 3,  (-2147482748, "Seed", 0, 3, "\233\310m\217z\211-O:5\267\252\2739v:\264\316}\220~\301p7\241\14E\250\340\30&?o\256\301\374K\36\306\234\32\326@2\376\246\315\320\235\356\344\213Yq\2708\321\252\346\16}\0\367\215\367\340\376\223j\370bR\213HL:\307_\226\10", 80, ... ) , 80, ... ) == 0x0
 00677  2016   NtClose  (-2147482748, ... ) == 0x0
 00667  2016   NtDeviceIoControlFile  ... {status=0x0, info=256},  ... {status=0x0, info=256}, "\37\351\221\276\245th\331\256\327n\362Z\301\214\247s\21\351l\275\2\275J\31\13\4\34\30\2160g\277j\373\/\305!\16\4\271\3X\15\332l~\330\27\204%\352\275cLD<\317\223\303\203X8\217;\14\367HeQ\332\326L\251\371\314\35\361\363\204;&+\366\360[\362\364\3152\225%\4\351\245\11\330\240m\247I\265\262(\277\255qg\264,\366\253\364 \263{\321\351G\266~m\244\224\14\363\207@g\205\267\325 \2732i5\20(\3368\345\205\2612}\376\216\202a\314V\314U\2112\326\364\14\25\22\325\253\27\245\211O\210\305\360~]\325\327\2141%;\372\13\6\203\277\247\341g0=\230\12\231\240\246\352\312\200\203\360\360\363\315\35\314\213*\367\4\200\312g\213\215\362\350\1\364\371\343;\266T!;\261\21\325d\277;\3578\213s\333\325-\317\207\335\235j\215\267#\\365\274cf\14\206\230\202\236", ) , ) == 0x0
 00678  2016   NtQuerySystemInformation  (Basic, 44, ... {Unknown=0,MaximumIncrement=156250,PhysicalPageSize=0x1000,NumberOfPhysicalPages=0xff7c,LowestPhysicalPage=0x1,HighestPhysicalPage=0xffff,AllocationGranularity=0x10000,LowestUserAddress=0x10000,HighestUserAddress=0x7ffeffff,ActiveProcessors=1,NumberProcessors=1,}, 0x0, ) == 0x0
 00679  2016   NtQuerySystemInformation  (Processor, 12, ... {system info, class 1, size 12}, 0x0, ) == 0x0
 00680  2016   NtOpenKey  (0x20019, {24, 52, 0x40, 0, 0,  (0x20019, {24, 52, 0x40, 0, 0, "SYSTEM\CurrentControlSet\Control\Session Manager"}, ... 60, ) }, ... 60, ) == 0x0
 00681  2016   NtQueryValueKey  (60,  (60, "CriticalSectionTimeout", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\215'\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (60, "CriticalSectionTimeout", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\215'\0"}, 16, ) }, 16, ) == 0x0
 00682  2016   NtClose  (60, ... ) == 0x0
 00683  2016   NtOpenKey  (0x20019, {24, 52, 0x40, 0, 0,  (0x20019, {24, 52, 0x40, 0, 0, "Software\Microsoft\Ole"}, ... 60, ) }, ... 60, ) == 0x0
 00684  2016   NtQueryValueKey  (60,  (60, "RWLockResourceTimeOut", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00685  2016   NtClose  (60, ... ) == 0x0
 00686  2016   NtQuerySystemInformation  (Basic, 44, ... {Unknown=0,MaximumIncrement=156250,PhysicalPageSize=0x1000,NumberOfPhysicalPages=0xff7c,LowestPhysicalPage=0x1,HighestPhysicalPage=0xffff,AllocationGranularity=0x10000,LowestUserAddress=0x10000,HighestUserAddress=0x7ffeffff,ActiveProcessors=1,NumberProcessors=1,}, 0x0, ) == 0x0
 00687  2016   NtQuerySystemInformation  (Processor, 12, ... {system info, class 1, size 12}, 0x0, ) == 0x0
 00688  2016   NtQuerySystemInformation  (Basic, 44, ... {Unknown=0,MaximumIncrement=156250,PhysicalPageSize=0x1000,NumberOfPhysicalPages=0xff7c,LowestPhysicalPage=0x1,HighestPhysicalPage=0xffff,AllocationGranularity=0x10000,LowestUserAddress=0x10000,HighestUserAddress=0x7ffeffff,ActiveProcessors=1,NumberProcessors=1,}, 0x0, ) == 0x0
 00689  2016   NtQuerySystemInformation  (Processor, 12, ... {system info, class 1, size 12}, 0x0, ) == 0x0
 00690  2016   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Classes\Interface"}, ... 60, ) }, ... 60, ) == 0x0
 00691  2016   NtQueryValueKey  (60,  (60, "InterfaceHelperDisableAll", Full, 0, ... ) , Full, 0, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00692  2016   NtQueryValueKey  (60,  (60, "InterfaceHelperDisableAllForOle32", Full, 0, ... ) , Full, 0, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00693  2016   NtQueryValueKey  (60,  (60, "InterfaceHelperDisableTypeLib", Full, 0, ... ) , Full, 0, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00694  2016   NtClose  (60, ... ) == 0x0
 00695  2016   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Classes\Interface\{00020400-0000-0000-C000-000000000046}"}, ... 60, ) }, ... 60, ) == 0x0
 00696  2016   NtQueryValueKey  (60,  (60, "InterfaceHelperDisableAll", Full, 0, ... ) , Full, 0, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00697  2016   NtQueryValueKey  (60,  (60, "InterfaceHelperDisableAllForOle32", Full, 0, ... ) , Full, 0, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00698  2016   NtClose  (60, ... ) == 0x0
 00699  2016   NtOpenEvent  (0x1f0003, {24, 28, 0x0, 0, 0,  (0x1f0003, {24, 28, 0x0, 0, 0, "HookSwitchHookEnabledEvent"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00700  2016   NtSetEventBoostPriority  (32, ...
 00410   896   NtWaitForSingleObject  ... ) == 0x0
 00701   896   NtAllocateVirtualMemory  (-1, 0, 0, 27136, 4096, 64, ... 3604480, 28672, ) == 0x0
 00702   896   NtOpenSection  (0xe, {24, 8, 0x40, 0, 0,  (0xe, {24, 8, 0x40, 0, 0, "WS2_32.dll"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00703   896   NtAllocateVirtualMemory  (-1, 5672960, 0, 4096, 4096, 4, ... 5672960, 4096, ) == 0x0
 00704   896   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\u:\work\WS2_32.dll"}, 2291484, ... }, 2291484, ...
 00700  2016   NtSetEventBoostPriority  ... ) == 0x0
 00705  2016   NtWaitForSingleObject  (32, 0, 0x0, ...
 00704   896   NtQueryAttributesFile  ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00706   896   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\WS2_32.dll"}, 2291484, ... ) }, 2291484, ... ) == 0x0
 00707   896   NtOpenFile  (0x100020, {24, 0, 0x40, 0, 0,  (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\WS2_32.dll"}, 5, 96, ... 60, {status=0x0, info=1}, ) }, 5, 96, ... 60, {status=0x0, info=1}, ) == 0x0
 00708   896   NtCreateSection  (0xf, 0x0, 0x0, 16, 16777216, 60, ... 64, ) == 0x0
 00709   896   NtQuerySection  (64, Image, 48, ... {section info, class 1, size 48}, 0x0, ) == 0x0
 00710   896   NtClose  (60, ... ) == 0x0
 00711   896   NtMapViewOfSection  (64, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x71ab0000), 0x0, 94208, ) == 0x0
 00712   896   NtClose  (64, ... ) == 0x0
 00713   896   NtProtectVirtualMemory  (-1, (0x71ab1000), 468, 4, ... (0x71ab1000), 4096, 32, ) == 0x0
 00714   896   NtProtectVirtualMemory  (-1, (0x71ab1000), 4096, 32, ... (0x71ab1000), 4096, 4, ) == 0x0
 00715   896   NtFlushInstructionCache  (-1, 1907036160, 468, ... ) == 0x0
 00716   896   NtOpenSection  (0xe, {24, 8, 0x40, 0, 0,  (0xe, {24, 8, 0x40, 0, 0, "WS2HELP.dll"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00717   896   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\u:\work\WS2HELP.dll"}, 2290668, ... ) }, 2290668, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00718   896   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\WS2HELP.dll"}, 2290668, ... ) }, 2290668, ... ) == 0x0
 00719   896   NtOpenFile  (0x100020, {24, 0, 0x40, 0, 0,  (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\WS2HELP.dll"}, 5, 96, ... 64, {status=0x0, info=1}, ) }, 5, 96, ... 64, {status=0x0, info=1}, ) == 0x0
 00720   896   NtCreateSection  (0xf, 0x0, 0x0, 16, 16777216, 64, ... 60, ) == 0x0
 00721   896   NtQuerySection  (60, Image, 48, ... {section info, class 1, size 48}, 0x0, ) == 0x0
 00722   896   NtClose  (64, ... ) == 0x0
 00723   896   NtMapViewOfSection  (60, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x71aa0000), 0x0, 32768, ) == 0x0
 00724   896   NtClose  (60, ... ) == 0x0
 00725   896   NtProtectVirtualMemory  (-1, (0x71aa1000), 352, 4, ... (0x71aa1000), 4096, 32, ) == 0x0
 00726   896   NtProtectVirtualMemory  (-1, (0x71aa1000), 4096, 32, ... (0x71aa1000), 4096, 4, ) == 0x0
 00727   896   NtFlushInstructionCache  (-1, 1906970624, 352, ... ) == 0x0
 00728   896   NtProtectVirtualMemory  (-1, (0x71ab1000), 468, 4, ... (0x71ab1000), 4096, 32, ) == 0x0
 00729   896   NtProtectVirtualMemory  (-1, (0x71ab1000), 4096, 32, ... (0x71ab1000), 4096, 4, ) == 0x0
 00730   896   NtFlushInstructionCache  (-1, 1907036160, 468, ... ) == 0x0
 00731   896   NtOpenKey  (0x80000000, {24, 0, 0x40, 0, 0,  (0x80000000, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\WS2HELP.dll"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00732   896   NtOpenKey  (0x80000000, {24, 0, 0x40, 0, 0,  (0x80000000, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\WS2_32.dll"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00733   896   NtQuerySystemInformation  (Basic, 44, ... {Unknown=0,MaximumIncrement=156250,PhysicalPageSize=0x1000,NumberOfPhysicalPages=0xff7c,LowestPhysicalPage=0x1,HighestPhysicalPage=0xffff,AllocationGranularity=0x10000,LowestUserAddress=0x10000,HighestUserAddress=0x7ffeffff,ActiveProcessors=1,NumberProcessors=1,}, 0x0, ) == 0x0
 00734   896   NtQuerySystemInformation  (Processor, 12, ... {system info, class 1, size 12}, 0x0, ) == 0x0
 00735   896   NtSetEventBoostPriority  (32, ...
 00705  2016   NtWaitForSingleObject  ... ) == 0x0
 00736  2016   NtOpenSection  (0xe, {24, 8, 0x40, 0, 0,  (0xe, {24, 8, 0x40, 0, 0, "shell32.dll"}, ... 60, ) }, ... 60, ) == 0x0
 00737  2016   NtMapViewOfSection  (60, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x7c9c0000), 0x0, 8482816, ) == 0x0
 00738  2016   NtClose  (60, ... ) == 0x0
 00739  2016   NtProtectVirtualMemory  (-1, (0x7c9c1000), 4476, 4, ... (0x7c9c1000), 8192, 32, ) == 0x0
 00735   896   NtSetEventBoostPriority  ... ) == 0x0
 00740   896   NtWaitForSingleObject  (32, 0, 0x0, ...
 00741  2016   NtProtectVirtualMemory  (-1, (0x7c9c1000), 8192, 32, ... (0x7c9c1000), 8192, 4, ) == 0x0
 00742  2016   NtFlushInstructionCache  (-1, 2090602496, 4476, ... ) == 0x0
 00743  2016   NtProtectVirtualMemory  (-1, (0x7c9c1000), 4476, 4, ... (0x7c9c1000), 8192, 32, ) == 0x0
 00744  2016   NtProtectVirtualMemory  (-1, (0x7c9c1000), 8192, 32, ... (0x7c9c1000), 8192, 4, ) == 0x0
 00745  2016   NtFlushInstructionCache  (-1, 2090602496, 4476, ... ) == 0x0
 00746  2016   NtProtectVirtualMemory  (-1, (0x7c9c1000), 4476, 4, ... (0x7c9c1000), 8192, 32, ) == 0x0
 00747  2016   NtProtectVirtualMemory  (-1, (0x7c9c1000), 8192, 32, ... (0x7c9c1000), 8192, 4, ) == 0x0
 00748  2016   NtFlushInstructionCache  (-1, 2090602496, 4476, ... ) == 0x0
 00749  2016   NtProtectVirtualMemory  (-1, (0x7c9c1000), 4476, 4, ... (0x7c9c1000), 8192, 32, ) == 0x0
 00750  2016   NtProtectVirtualMemory  (-1, (0x7c9c1000), 8192, 32, ... (0x7c9c1000), 8192, 4, ) == 0x0
 00751  2016   NtFlushInstructionCache  (-1, 2090602496, 4476, ... ) == 0x0
 00752  2016   NtProtectVirtualMemory  (-1, (0x7c9c1000), 4476, 4, ... (0x7c9c1000), 8192, 32, ) == 0x0
 00753  2016   NtProtectVirtualMemory  (-1, (0x7c9c1000), 8192, 32, ... (0x7c9c1000), 8192, 4, ) == 0x0
 00754  2016   NtFlushInstructionCache  (-1, 2090602496, 4476, ... ) == 0x0
 00755  2016   NtProtectVirtualMemory  (-1, (0x7c9c1000), 4476, 4, ... (0x7c9c1000), 8192, 32, ) == 0x0
 00756  2016   NtProtectVirtualMemory  (-1, (0x7c9c1000), 8192, 32, ... (0x7c9c1000), 8192, 4, ) == 0x0
 00757  2016   NtFlushInstructionCache  (-1, 2090602496, 4476, ... ) == 0x0
 00758  2016   NtOpenSection  (0xe, {24, 8, 0x40, 0, 0,  (0xe, {24, 8, 0x40, 0, 0, "SHLWAPI.dll"}, ... 60, ) }, ... 60, ) == 0x0
 00759  2016   NtMapViewOfSection  (60, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x77f60000), 0x0, 483328, ) == 0x0
 00760  2016   NtClose  (60, ... ) == 0x0
 00761  2016   NtProtectVirtualMemory  (-1, (0x77f61000), 2076, 4, ... (0x77f61000), 4096, 32, ) == 0x0
 00762  2016   NtProtectVirtualMemory  (-1, (0x77f61000), 4096, 32, ... (0x77f61000), 4096, 4, ) == 0x0
 00763  2016   NtFlushInstructionCache  (-1, 2012614656, 2076, ... ) == 0x0
 00764  2016   NtProtectVirtualMemory  (-1, (0x77f61000), 2076, 4, ... (0x77f61000), 4096, 32, ) == 0x0
 00765  2016   NtProtectVirtualMemory  (-1, (0x77f61000), 4096, 32, ... (0x77f61000), 4096, 4, ) == 0x0
 00766  2016   NtFlushInstructionCache  (-1, 2012614656, 2076, ... ) == 0x0
 00767  2016   NtProtectVirtualMemory  (-1, (0x77f61000), 2076, 4, ... (0x77f61000), 4096, 32, ) == 0x0
 00768  2016   NtProtectVirtualMemory  (-1, (0x77f61000), 4096, 32, ... (0x77f61000), 4096, 4, ) == 0x0
 00769  2016   NtFlushInstructionCache  (-1, 2012614656, 2076, ... ) == 0x0
 00770  2016   NtProtectVirtualMemory  (-1, (0x77f61000), 2076, 4, ... (0x77f61000), 4096, 32, ) == 0x0
 00771  2016   NtProtectVirtualMemory  (-1, (0x77f61000), 4096, 32, ... (0x77f61000), 4096, 4, ) == 0x0
 00772  2016   NtFlushInstructionCache  (-1, 2012614656, 2076, ... ) == 0x0
 00773  2016   NtProtectVirtualMemory  (-1, (0x77f61000), 2076, 4, ... (0x77f61000), 4096, 32, ) == 0x0
 00774  2016   NtProtectVirtualMemory  (-1, (0x77f61000), 4096, 32, ... (0x77f61000), 4096, 4, ) == 0x0
 00775  2016   NtFlushInstructionCache  (-1, 2012614656, 2076, ... ) == 0x0
 00776  2016   NtProtectVirtualMemory  (-1, (0x7c9c1000), 4476, 4, ... (0x7c9c1000), 8192, 32, ) == 0x0
 00777  2016   NtProtectVirtualMemory  (-1, (0x7c9c1000), 8192, 32, ... (0x7c9c1000), 8192, 4, ) == 0x0
 00778  2016   NtFlushInstructionCache  (-1, 2090602496, 4476, ... ) == 0x0
 00779  2016   NtProtectVirtualMemory  (-1, (0x7c9c1000), 4476, 4, ... (0x7c9c1000), 8192, 32, ) == 0x0
 00780  2016   NtProtectVirtualMemory  (-1, (0x7c9c1000), 8192, 32, ... (0x7c9c1000), 8192, 4, ) == 0x0
 00781  2016   NtFlushInstructionCache  (-1, 2090602496, 4476, ... ) == 0x0
 00782  2016   NtOpenKey  (0x80000000, {24, 0, 0x40, 0, 0,  (0x80000000, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SHLWAPI.dll"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00783  2016   NtOpenKey  (0x2000000, {24, 52, 0x40, 0, 0,  (0x2000000, {24, 52, 0x40, 0, 0, "Software\Microsoft\Windows\CurrentVersion\Explorer\Performance"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00784  2016   NtCreateSemaphore  (0x1f0003, {24, 28, 0x80, 5673448, 0,  (0x1f0003, {24, 28, 0x80, 5673448, 0, "shell.{A48F1A32-A340-11D1-BC6B-00A0C90312E1}"}, 0, 2147483647, ... 60, ) }, 0, 2147483647, ... 60, ) == STATUS_OBJECT_NAME_EXISTS
 00785  2016   NtOpenKey  (0x80000000, {24, 0, 0x40, 0, 0,  (0x80000000, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\shell32.dll"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00786  2016   NtOpenKey  (0x1, {24, 52, 0x40, 0, 0,  (0x1, {24, 52, 0x40, 0, 0, "SYSTEM\Setup"}, ... 64, ) }, ... 64, ) == 0x0
 00787  2016   NtQueryValueKey  (64,  (64, "SystemSetupInProgress", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (64, "SystemSetupInProgress", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) }, 16, ) == 0x0
 00788  2016   NtClose  (64, ... ) == 0x0
 00789  2016   NtQueryDefaultUILanguage  (9826196, ...
 00790  2016   NtOpenThreadTokenEx  (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN
 00791  2016   NtOpenProcessTokenEx  (-1, 0x20008, 512, ... -2147482748, ) == 0x0
 00792  2016   NtQueryInformationToken  (-2147482748, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0
 00793  2016   NtClose  (-2147482748, ... ) == 0x0
 00794  2016   NtOpenKey  (0x2000000, {24, 0, 0x640, 0, 0,  (0x2000000, {24, 0, 0x640, 0, 0, "\REGISTRY\USER\S-1-5-21-1292428093-1383384898-725345543-1003"}, ... -2147482748, ) }, ... -2147482748, ) == 0x0
 00795  2016   NtOpenKey  (0x80000000, {24, -2147482748, 0x240, 0, 0,  (0x80000000, {24, -2147482748, 0x240, 0, 0, "Software\Policies\Microsoft\Control Panel\Desktop"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00796  2016   NtOpenKey  (0x80000000, {24, -2147482748, 0x640, 0, 0,  (0x80000000, {24, -2147482748, 0x640, 0, 0, "Control Panel\Desktop"}, ... -2147481452, ) }, ... -2147481452, ) == 0x0
 00797  2016   NtQueryValueKey  (-2147481452,  (-2147481452, "MultiUILanguageId", Partial, 256, ... ) , Partial, 256, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00798  2016   NtClose  (-2147481452, ... ) == 0x0
 00799  2016   NtClose  (-2147482748, ... ) == 0x0
 00789  2016   NtQueryDefaultUILanguage  ... ) == 0x0
 00800  2016   NtOpenFile  (0x1200a9, {24, 0, 0x40, 0, 0,  (0x1200a9, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\shell32.dll"}, 1, 96, ... 64, {status=0x0, info=1}, ) }, 1, 96, ... 64, {status=0x0, info=1}, ) == 0x0
 00801  2016   NtCreateSection  (0x4, 0x0, 0x0, 2, 134217728, 64, ... 68, ) == 0x0
 00802  2016   NtMapViewOfSection  (68, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 2, ... (0xe40000), 0x0, 8462336, ) == 0x0
 00803  2016   NtOpenFile  (0x1200a9, {24, 0, 0x40, 0, 0,  (0x1200a9, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\shell32.dll.124.Manifest"}, 1, 96, ... ) }, 1, 96, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00804  2016   NtQueryDefaultUILanguage  (2090319928, ...
 00805  2016   NtOpenThreadTokenEx  (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN
 00806  2016   NtOpenProcessTokenEx  (-1, 0x20008, 512, ... -2147482748, ) == 0x0
 00807  2016   NtQueryInformationToken  (-2147482748, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0
 00808  2016   NtClose  (-2147482748, ... ) == 0x0
 00809  2016   NtOpenKey  (0x2000000, {24, 0, 0x640, 0, 0,  (0x2000000, {24, 0, 0x640, 0, 0, "\REGISTRY\USER\S-1-5-21-1292428093-1383384898-725345543-1003"}, ... -2147482748, ) }, ... -2147482748, ) == 0x0
 00810  2016   NtOpenKey  (0x80000000, {24, -2147482748, 0x240, 0, 0,  (0x80000000, {24, -2147482748, 0x240, 0, 0, "Software\Policies\Microsoft\Control Panel\Desktop"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00811  2016   NtOpenKey  (0x80000000, {24, -2147482748, 0x640, 0, 0,  (0x80000000, {24, -2147482748, 0x640, 0, 0, "Control Panel\Desktop"}, ... -2147481452, ) }, ... -2147481452, ) == 0x0
 00812  2016   NtQueryValueKey  (-2147481452,  (-2147481452, "MultiUILanguageId", Partial, 256, ... ) , Partial, 256, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00813  2016   NtClose  (-2147481452, ... ) == 0x0
 00814  2016   NtClose  (-2147482748, ... ) == 0x0
 00804  2016   NtQueryDefaultUILanguage  ... ) == 0x0
 00815  2016   NtQueryInstallUILanguage  (2090319930, ... ) == 0x0
 00816  2016   NtQueryDefaultLocale  (1, 9824292, ... ) == 0x0
 00817  2016   NtOpenFile  (0x1200a9, {24, 0, 0x40, 0, 0,  (0x1200a9, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\shell32.dll.124.Config"}, 1, 96, ... ) }, 1, 96, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00818  2016   NtRequestWaitReplyPort  (24, {128, 156, new_msg, 0, 2088850039, 9825328, 1179817, 9825052}  (24, {128, 156, new_msg, 0, 2088850039, 9825328, 1179817, 9825052} "\210\6!\1\33\0\1\0`\0\0\0\0\0\0\0\1\0\0\0\0\0\11\4\1\1\1\0>\0@\0\250\6!\1@\0\0\0\377\377\377\377\0\0\0\0@ \7\1\0\0\0\0\236\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0(\0,\0\350\6!\1\0\0\0\0\0\0\0\0$\360\225\0\0\0\0\0" ... {128, 156, reply, 0, 1252, 2016, 81848, 0} "\300\270\26\0\33\0\1\0\0\0\0\0\0\0\0\0\1\0\0\0\0\0\11\4\1\1\1\0>\0@\0\250\6!\1@\0\0\0\377\377\377\377\0\0\0\0@ \7\1\0\0\0\0\236\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0(\0,\0\350\6!\1\0\0\0\0\0\0\0\0$\360\225\0\0\0\0\0" )  ... {128, 156, reply, 0, 1252, 2016, 81848, 0}  (24, {128, 156, new_msg, 0, 2088850039, 9825328, 1179817, 9825052} "\210\6!\1\33\0\1\0`\0\0\0\0\0\0\0\1\0\0\0\0\0\11\4\1\1\1\0>\0@\0\250\6!\1@\0\0\0\377\377\377\377\0\0\0\0@ \7\1\0\0\0\0\236\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0(\0,\0\350\6!\1\0\0\0\0\0\0\0\0$\360\225\0\0\0\0\0" ... {128, 156, reply, 0, 1252, 2016, 81848, 0} "\300\270\26\0\33\0\1\0\0\0\0\0\0\0\0\0\1\0\0\0\0\0\11\4\1\1\1\0>\0@\0\250\6!\1@\0\0\0\377\377\377\377\0\0\0\0@ \7\1\0\0\0\0\236\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0(\0,\0\350\6!\1\0\0\0\0\0\0\0\0$\360\225\0\0\0\0\0" )  ) == 0x0
 00819  2016   NtClose  (64, ... ) == 0x0
 00820  2016   NtClose  (68, ... ) == 0x0
 00821  2016   NtUnmapViewOfSection  (-1, 0xe40000, ... ) == 0x0
 00822  2016   NtQueryDebugFilterState  (53, 2, ... ) == 0x0
 00823  2016   NtOpenKey  (0x8, {24, 0, 0x40, 0, 0,  (0x8, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows\CurrentVersion\SideBySide\AssemblyStorageRoots"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00824  2016   NtQueryDebugFilterState  (53, 2, ... ) == 0x0
 00825  2016   NtQueryDebugFilterState  (53, 2, ... ) == 0x0
 00826  2016   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\u:\work\packed.exe.Local\"}, 9823484, ... ) }, 9823484, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00827  2016   NtQueryDebugFilterState  (53, 2, ... ) == 0x0
 00828  2016   NtQueryDebugFilterState  (53, 2, ... ) == 0x0
 00829  2016   NtQueryDebugFilterState  (53, 2, ... ) == 0x0
 00830  2016   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.2982_x-ww_ac3f9c03"}, 9823548, ... ) }, 9823548, ... ) == 0x0
 00831  2016   NtOpenFile  (0x100020, {24, 0, 0x40, 0, 0,  (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.2982_x-ww_ac3f9c03"}, 3, 33, ... 68, {status=0x0, info=1}, ) }, 3, 33, ... 68, {status=0x0, info=1}, ) == 0x0
 00832  2016   NtQueryDebugFilterState  (53, 2, ... ) == 0x0
 00833  2016   NtOpenFile  (0x100020, {24, 0, 0x40, 0, 0,  (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.2982_x-ww_ac3f9c03\comctl32.dll"}, 5, 96, ... 64, {status=0x0, info=1}, ) }, 5, 96, ... 64, {status=0x0, info=1}, ) == 0x0
 00834  2016   NtCreateSection  (0xe, 0x0, 0x0, 16, 134217728, 64, ... 72, ) == 0x0
 00835  2016   NtClose  (64, ... ) == 0x0
 00836  2016   NtMapViewOfSection  (72, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 16, ... (0xe40000), 0x0, 1056768, ) == 0x0
 00837  2016   NtClose  (72, ... ) == 0x0
 00838  2016   NtUnmapViewOfSection  (-1, 0xe40000, ... ) == 0x0
 00839  2016   NtOpenFile  (0x100020, {24, 0, 0x40, 0, 0,  (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.2982_x-ww_ac3f9c03\comctl32.dll"}, 5, 96, ... 72, {status=0x0, info=1}, ) }, 5, 96, ... 72, {status=0x0, info=1}, ) == 0x0
 00840  2016   NtCreateSection  (0xf, 0x0, 0x0, 16, 16777216, 72, ... 64, ) == 0x0
 00841  2016   NtQuerySection  (64, Image, 48, ... {section info, class 1, size 48}, 0x0, ) == 0x0
 00842  2016   NtClose  (72, ... ) == 0x0
 00843  2016   NtMapViewOfSection  (64, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x773d0000), 0x0, 1060864, ) == 0x0
 00844  2016   NtClose  (64, ... ) == 0x0
 00845  2016   NtProtectVirtualMemory  (-1, (0x773d1000), 1924, 4, ... (0x773d1000), 4096, 32, ) == 0x0
 00846  2016   NtProtectVirtualMemory  (-1, (0x773d1000), 4096, 32, ... (0x773d1000), 4096, 4, ) == 0x0
 00847  2016   NtFlushInstructionCache  (-1, 2000490496, 1924, ... ) == 0x0
 00848  2016   NtProtectVirtualMemory  (-1, (0x773d1000), 1924, 4, ... (0x773d1000), 4096, 32, ) == 0x0
 00849  2016   NtProtectVirtualMemory  (-1, (0x773d1000), 4096, 32, ... (0x773d1000), 4096, 4, ) == 0x0
 00850  2016   NtFlushInstructionCache  (-1, 2000490496, 1924, ... ) == 0x0
 00851  2016   NtProtectVirtualMemory  (-1, (0x773d1000), 1924, 4, ... (0x773d1000), 4096, 32, ) == 0x0
 00852  2016   NtProtectVirtualMemory  (-1, (0x773d1000), 4096, 32, ... (0x773d1000), 4096, 4, ) == 0x0
 00853  2016   NtFlushInstructionCache  (-1, 2000490496, 1924, ... ) == 0x0
 00854  2016   NtProtectVirtualMemory  (-1, (0x773d1000), 1924, 4, ... (0x773d1000), 4096, 32, ) == 0x0
 00855  2016   NtProtectVirtualMemory  (-1, (0x773d1000), 4096, 32, ... (0x773d1000), 4096, 4, ) == 0x0
 00856  2016   NtFlushInstructionCache  (-1, 2000490496, 1924, ... ) == 0x0
 00857  2016   NtProtectVirtualMemory  (-1, (0x773d1000), 1924, 4, ... (0x773d1000), 4096, 32, ) == 0x0
 00858  2016   NtProtectVirtualMemory  (-1, (0x773d1000), 4096, 32, ... (0x773d1000), 4096, 4, ) == 0x0
 00859  2016   NtFlushInstructionCache  (-1, 2000490496, 1924, ... ) == 0x0
 00860  2016   NtProtectVirtualMemory  (-1, (0x773d1000), 1924, 4, ... (0x773d1000), 4096, 32, ) == 0x0
 00861  2016   NtProtectVirtualMemory  (-1, (0x773d1000), 4096, 32, ... (0x773d1000), 4096, 4, ) == 0x0
 00862  2016   NtFlushInstructionCache  (-1, 2000490496, 1924, ... ) == 0x0
 00863  2016   NtProtectVirtualMemory  (-1, (0x773d1000), 1924, 4, ... (0x773d1000), 4096, 32, ) == 0x0
 00864  2016   NtProtectVirtualMemory  (-1, (0x773d1000), 4096, 32, ... (0x773d1000), 4096, 4, ) == 0x0
 00865  2016   NtFlushInstructionCache  (-1, 2000490496, 1924, ... ) == 0x0
 00866  2016   NtOpenKey  (0x80000000, {24, 0, 0x40, 0, 0,  (0x80000000, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\comctl32.dll"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00867  2016   NtAddAtom  ( ("T\0h\0e\0m\0e\0P\0r\0o\0p\0S\0c\0r\0o\0l\0l\0B\0a\0r\0C\0t\0l\0", 42, 9825028, ... ) , 42, 9825028, ... ) == 0x0
 00868  2016   NtQueryDefaultUILanguage  (9823712, ...
 00869  2016   NtOpenThreadTokenEx  (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN
 00870  2016   NtOpenProcessTokenEx  (-1, 0x20008, 512, ... -2147482748, ) == 0x0
 00871  2016   NtQueryInformationToken  (-2147482748, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0
 00872  2016   NtClose  (-2147482748, ... ) == 0x0
 00873  2016   NtOpenKey  (0x2000000, {24, 0, 0x640, 0, 0,  (0x2000000, {24, 0, 0x640, 0, 0, "\REGISTRY\USER\S-1-5-21-1292428093-1383384898-725345543-1003"}, ... -2147482748, ) }, ... -2147482748, ) == 0x0
 00874  2016   NtOpenKey  (0x80000000, {24, -2147482748, 0x240, 0, 0,  (0x80000000, {24, -2147482748, 0x240, 0, 0, "Software\Policies\Microsoft\Control Panel\Desktop"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00875  2016   NtOpenKey  (0x80000000, {24, -2147482748, 0x640, 0, 0,  (0x80000000, {24, -2147482748, 0x640, 0, 0, "Control Panel\Desktop"}, ... -2147481452, ) }, ... -2147481452, ) == 0x0
 00876  2016   NtQueryValueKey  (-2147481452,  (-2147481452, "MultiUILanguageId", Partial, 256, ... ) , Partial, 256, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00877  2016   NtClose  (-2147481452, ... ) == 0x0
 00878  2016   NtClose  (-2147482748, ... ) == 0x0
 00868  2016   NtQueryDefaultUILanguage  ... ) == 0x0
 00879  2016   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\WindowsShell.Manifest"}, 9822552, ... ) }, 9822552, ... ) == 0x0
 00880  2016   NtOpenFile  (0x100020, {24, 0, 0x40, 0, 0,  (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\WindowsShell.Manifest"}, 5, 96, ... 64, {status=0x0, info=1}, ) }, 5, 96, ... 64, {status=0x0, info=1}, ) == 0x0
 00881  2016   NtCreateSection  (0xe, 0x0, 0x0, 16, 134217728, 64, ... 72, ) == 0x0
 00882  2016   NtClose  (64, ... ) == 0x0
 00883  2016   NtMapViewOfSection  (72, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 16, ... (0x390000), 0x0, 4096, ) == 0x0
 00884  2016   NtClose  (72, ... ) == 0x0
 00885  2016   NtUnmapViewOfSection  (-1, 0x390000, ... ) == 0x0
 00886  2016   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\WindowsShell.Manifest"}, 9822148, ... ) }, 9822148, ... ) == 0x0
 00887  2016   NtCreateFile  (0x80100080, {24, 0, 0x40, 0, 9822892,  (0x80100080, {24, 0, 0x40, 0, 9822892, "\??\C:\WINDOWS\WindowsShell.Manifest"}, 0x0, 0, 5, 1, 96, 0, 0, ... 72, {status=0x0, info=1}, ) }, 0x0, 0, 5, 1, 96, 0, 0, ... 72, {status=0x0, info=1}, ) == 0x0
 00888  2016   NtCreateSection  (0xf0005, 0x0, 0x0, 2, 134217728, 72, ... 64, ) == 0x0
 00889  2016   NtClose  (72, ... ) == 0x0
 00890  2016   NtMapViewOfSection  (64, -1, (0x0), 0, 0, {0, 0}, 0, 1, 0, 2, ... (0x390000), {0, 0}, 4096, ) == 0x0
 00891  2016   NtClose  (64, ... ) == 0x0
 00892  2016   NtUnmapViewOfSection  (-1, 0x390000, ... ) == 0x0
 00893  2016   NtOpenFile  (0x1200a9, {24, 0, 0x40, 0, 0,  (0x1200a9, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\WindowsShell.Manifest"}, 1, 96, ... 64, {status=0x0, info=1}, ) }, 1, 96, ... 64, {status=0x0, info=1}, ) == 0x0
 00894  2016   NtCreateSection  (0x4, 0x0, 0x0, 2, 134217728, 64, ... 72, ) == 0x0
 00895  2016   NtMapViewOfSection  (72, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 2, ... (0x390000), 0x0, 4096, ) == 0x0
 00896  2016   NtQueryInformationFile  (64, 9822544, 24, Standard, ... {status=0x0, info=24}, ) == 0x0
 00897  2016   NtOpenFile  (0x1200a9, {24, 0, 0x40, 0, 0,  (0x1200a9, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\WindowsShell.Config"}, 1, 96, ... ) }, 1, 96, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00898  2016   NtRequestWaitReplyPort  (24, {128, 156, new_msg, 0, 2088850039, 9822844, 1179817, 9822568}  (24, {128, 156, new_msg, 0, 2088850039, 9822844, 1179817, 9822568} "\210\6!\1\33\0\1\0`\0\0\0\0\0\0\0\1\0\0\0\0\0\11\4\1\1\3\0@\0D\0\250\6!\1@\0\0\0H\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\355\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\26\0\30\0\354\6!\1\0\0\0\0\0\0\0\0p\346\225\0\0\0\0\0" ... {128, 156, reply, 0, 1252, 2016, 81849, 0} "\260d\27\0\33\0\1\0\0\0\0\0\0\0\0\0\1\0\0\0\0\0\11\4\1\1\3\0@\0D\0\250\6!\1@\0\0\0H\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\355\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\26\0\30\0\354\6!\1\0\0\0\0\0\0\0\0p\346\225\0\0\0\0\0" )  ... {128, 156, reply, 0, 1252, 2016, 81849, 0}  (24, {128, 156, new_msg, 0, 2088850039, 9822844, 1179817, 9822568} "\210\6!\1\33\0\1\0`\0\0\0\0\0\0\0\1\0\0\0\0\0\11\4\1\1\3\0@\0D\0\250\6!\1@\0\0\0H\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\355\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\26\0\30\0\354\6!\1\0\0\0\0\0\0\0\0p\346\225\0\0\0\0\0" ... {128, 156, reply, 0, 1252, 2016, 81849, 0} "\260d\27\0\33\0\1\0\0\0\0\0\0\0\0\0\1\0\0\0\0\0\11\4\1\1\3\0@\0D\0\250\6!\1@\0\0\0H\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\355\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\26\0\30\0\354\6!\1\0\0\0\0\0\0\0\0p\346\225\0\0\0\0\0" )  ) == 0x0
 00899  2016   NtClose  (64, ... ) == 0x0
 00900  2016   NtClose  (72, ... ) == 0x0
 00901  2016   NtUnmapViewOfSection  (-1, 0x390000, ... ) == 0x0
 00902  2016   NtQueryDebugFilterState  (53, 2, ... ) == 0x0
 00903  2016   NtUserRegisterWindowMessage  ( ("ShellGetDragImage", ... ) , ... ) == 0xc03a
 00904  2016   NtUserSystemParametersInfo  (104, 0, 2001084812, 0, ... ) == 0x1
 00905  2016   NtUserGetDC  (0, ... ) == 0x1010052
 00906  2016   NtUserCallOneParam  (16842834, 57, ... ) == 0x1
 00907  2016   NtUserSystemParametersInfo  (38, 4, 2001086940, 0, ... ) == 0x1
 00908  2016   NtUserSystemParametersInfo  (66, 12, 9824544, 0, ... ) == 0x1
 00909  2016   NtOpenThreadTokenEx  (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN
 00910  2016   NtOpenProcessTokenEx  (-1, 0x20008, 512, ... 72, ) == 0x0
 00911  2016   NtQueryInformationToken  (72, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0
 00912  2016   NtClose  (72, ... ) == 0x0
 00913  2016   NtOpenKey  (0x20019, {24, 0, 0x640, 0, 0,  (0x20019, {24, 0, 0x640, 0, 0, "\REGISTRY\USER\S-1-5-21-1292428093-1383384898-725345543-1003"}, ... 72, ) }, ... 72, ) == 0x0
 00914  2016   NtOpenProcessToken  (-1, 0x8, ... 64, ) == 0x0
 00915  2016   NtAccessCheck  (5676120, 64, 0x1, 9824376, 9824428, 56, 9824408, ... ) == STATUS_NO_IMPERSONATION_TOKEN
 00916  2016   NtClose  (64, ... ) == 0x0
 00917  2016   NtOpenKey  (0x20019, {24, 72, 0x40, 0, 0,  (0x20019, {24, 72, 0x40, 0, 0, "Control Panel\Desktop"}, ... 64, ) }, ... 64, ) == 0x0
 00918  2016   NtQueryValueKey  (64,  (64, "SmoothScroll", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00919  2016   NtClose  (64, ... ) == 0x0
 00920  2016   NtUserSystemParametersInfo  (41, 500, 9824572, 0, ... ) == 0x1
 00921  2016   NtOpenProcessToken  (-1, 0x8, ... 64, ) == 0x0
 00922  2016   NtAccessCheck  (5676120, 64, 0x1, 9824376, 9824428, 56, 9824408, ... ) == STATUS_NO_IMPERSONATION_TOKEN
 00923  2016   NtClose  (64, ... ) == 0x0
 00924  2016   NtOpenKey  (0x20019, {24, 72, 0x40, 0, 0,  (0x20019, {24, 72, 0x40, 0, 0, "software\Microsoft\Windows\CurrentVersion\Explorer\Advanced"}, ... 64, ) }, ... 64, ) == 0x0
 00925  2016   NtQueryValueKey  (64,  (64, "EnableBalloonTips", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00926  2016   NtClose  (64, ... ) == 0x0
 00927  2016   NtUserSystemParametersInfo  (27, 0, 2001085788, 0, ... ) == 0x1
 00928  2016   NtUserSystemParametersInfo  (102, 0, 2001086828, 0, ... ) == 0x1
 00929  2016   NtClose  (72, ... ) == 0x0
 00930  2016   NtUserSystemParametersInfo  (4130, 0, 9825076, 0, ... ) == 0x1
 00931  2016   NtOpenKey  (0x1, {24, 52, 0x40, 0, 0,  (0x1, {24, 52, 0x40, 0, 0, "Software\Microsoft\Windows NT\CurrentVersion\LanguagePack"}, ... 72, ) }, ... 72, ) == 0x0
 00932  2016   NtEnumerateValueKey  (72, 0, Full, 220, ... ) == STATUS_NO_MORE_ENTRIES
 00933  2016   NtClose  (72, ... ) == 0x0
 00934  2016   NtUserFindExistingCursorIcon  (9824324, 9824340, 9824388, ... ) == 0x10011
 00935  2016   NtUserRegisterClassExWOW  (9824268, 9824336, 9824352, 9824368, 0, 384, 0, ... ) == 0x8169c03b
 00936  2016   NtUserRegisterClassExWOW  (9824268, 9824336, 9824352, 9824368, 0, 384, 0, ... ) == 0x8169c03d
 00937  2016   NtUserFindExistingCursorIcon  (9824324, 9824340, 9824388, ... ) == 0x10011
 00938  2016   NtUserRegisterClassExWOW  (9824268, 9824336, 9824352, 9824368, 0, 384, 0, ... ) == 0x8169c03f
 00939  2016   NtUserFindExistingCursorIcon  (9824324, 9824340, 9824388, ... ) == 0x10011
 00940  2016   NtUserRegisterClassExWOW  (9824268, 9824336, 9824352, 9824368, 0, 384, 0, ... ) == 0x8169c041
 00941  2016   NtUserFindExistingCursorIcon  (9824324, 9824340, 9824388, ... ) == 0x10011
 00942  2016   NtUserRegisterClassExWOW  (9824268, 9824336, 9824352, 9824368, 0, 384, 0, ... ) == 0x8169c043
 00943  2016   NtUserRegisterClassExWOW  (9824268, 9824336, 9824352, 9824368, 0, 384, 0, ... ) == 0x8169c045
 00944  2016   NtUserFindExistingCursorIcon  (9824324, 9824340, 9824388, ... ) == 0x10011
 00945  2016   NtUserRegisterClassExWOW  (9824268, 9824336, 9824352, 9824368, 0, 384, 0, ... ) == 0x8169c047
 00946  2016   NtUserFindExistingCursorIcon  (9824324, 9824340, 9824388, ... ) == 0x10011
 00947  2016   NtUserRegisterClassExWOW  (9824268, 9824336, 9824352, 9824368, 0, 384, 0, ... ) == 0x8169c049
 00948  2016   NtUserFindExistingCursorIcon  (9824324, 9824340, 9824388, ... ) == 0x10011
 00949  2016   NtUserRegisterClassExWOW  (9824268, 9824336, 9824352, 9824368, 0, 384, 0, ... ) == 0x8169c04b
 00950  2016   NtUserFindExistingCursorIcon  (9824324, 9824340, 9824388, ... ) == 0x10011
 00951  2016   NtUserRegisterClassExWOW  (9824268, 9824336, 9824352, 9824368, 0, 384, 0, ... ) == 0x8169c04d
 00952  2016   NtUserFindExistingCursorIcon  (9824324, 9824340, 9824388, ... ) == 0x10011
 00953  2016   NtUserRegisterClassExWOW  (9824268, 9824336, 9824352, 9824368, 0, 384, 0, ... ) == 0x8169c04f
 00954  2016   NtUserRegisterClassExWOW  (9824268, 9824336, 9824352, 9824368, 0, 384, 0, ... ) == 0x8169c051
 00955  2016   NtUserFindExistingCursorIcon  (9824324, 9824340, 9824388, ... ) == 0x10011
 00956  2016   NtUserRegisterClassExWOW  (9824268, 9824336, 9824352, 9824368, 0, 384, 0, ... ) == 0x8169c053
 00957  2016   NtUserFindExistingCursorIcon  (9824320, 9824336, 9824384, ... ) == 0x10011
 00958  2016   NtUserRegisterClassExWOW  (9824264, 9824332, 9824348, 9824364, 0, 384, 0, ... ) == 0x8169c055
 00959  2016   NtUserFindExistingCursorIcon  (9824320, 9824336, 9824384, ... ) == 0x10011
 00960  2016   NtUserRegisterClassExWOW  (9824264, 9824332, 9824348, 9824364, 0, 384, 0, ... ) == 0x8169c057
 00961  2016   NtUserFindExistingCursorIcon  (9824324, 9824340, 9824388, ... ) == 0x10011
 00962  2016   NtUserRegisterClassExWOW  (9824268, 9824336, 9824352, 9824368, 0, 384, 0, ... ) == 0x8169c059
 00963  2016   NtUserFindExistingCursorIcon  (9824324, 9824340, 9824388, ... ) == 0x10013
 00964  2016   NtUserRegisterClassExWOW  (9824268, 9824336, 9824352, 9824368, 0, 384, 0, ... ) == 0x8169c05b
 00965  2016   NtUserFindExistingCursorIcon  (9824324, 9824340, 9824388, ... ) == 0x10011
 00966  2016   NtUserRegisterClassExWOW  (9824268, 9824336, 9824352, 9824368, 0, 384, 0, ... ) == 0x8169c05d
 00967  2016   NtUserFindExistingCursorIcon  (9824324, 9824340, 9824388, ... ) == 0x10011
 00968  2016   NtUserRegisterClassExWOW  (9824268, 9824336, 9824352, 9824368, 0, 384, 0, ... ) == 0x8169c05f
 00969  2016   NtUserFindExistingCursorIcon  (9824324, 9824340, 9824388, ... ) == 0x10011
 00970  2016   NtUserRegisterClassExWOW  (9824268, 9824336, 9824352, 9824368, 0, 384, 0, ... ) == 0x8169c017
 00971  2016   NtUserFindExistingCursorIcon  (9824324, 9824340, 9824388, ... ) == 0x10011
 00972  2016   NtUserRegisterClassExWOW  (9824268, 9824336, 9824352, 9824368, 0, 384, 0, ... ) == 0x8169c019
 00973  2016   NtUserFindExistingCursorIcon  (9824324, 9824340, 9824388, ... ) == 0x10013
 00974  2016   NtUserRegisterClassExWOW  (9824268, 9824336, 9824352, 9824368, 0, 384, 0, ... ) == 0x8169c018
 00975  2016   NtUserFindExistingCursorIcon  (9824324, 9824340, 9824388, ... ) == 0x10011
 00976  2016   NtUserRegisterClassExWOW  (9824268, 9824336, 9824352, 9824368, 0, 384, 0, ... ) == 0x8169c01a
 00977  2016   NtUserFindExistingCursorIcon  (9824324, 9824340, 9824388, ... ) == 0x10011
 00978  2016   NtUserRegisterClassExWOW  (9824268, 9824336, 9824352, 9824368, 0, 384, 0, ... ) == 0x8169c01c
 00979  2016   NtUserFindExistingCursorIcon  (9824324, 9824340, 9824388, ... ) == 0x10011
 00980  2016   NtUserRegisterClassExWOW  (9824268, 9824336, 9824352, 9824368, 0, 384, 0, ... ) == 0x8169c01e
 00981  2016   NtUserFindExistingCursorIcon  (9824316, 9824332, 9824380, ... ) == 0x10011
 00982  2016   NtUserRegisterClassExWOW  (9824316, 9824384, 9824400, 9824416, 0, 384, 0, ... ) == 0x8169c01b
 00983  2016   NtUserFindExistingCursorIcon  (9824324, 9824340, 9824388, ... ) == 0x10011
 00984  2016   NtUserRegisterClassExWOW  (9824268, 9824336, 9824352, 9824368, 0, 384, 0, ... ) == 0x8169c068
 00985  2016   NtUserFindExistingCursorIcon  (9824324, 9824340, 9824388, ... ) == 0x10011
 00986  2016   NtUserRegisterClassExWOW  (9824268, 9824336, 9824352, 9824368, 0, 384, 0, ... ) == 0x8169c06a
 00987  2016   NtOpenSection  (0xe, {24, 8, 0x40, 0, 0,  (0xe, {24, 8, 0x40, 0, 0, "comctl32.dll"}, ... 72, ) }, ... 72, ) == 0x0
 00988  2016   NtMapViewOfSection  (72, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x5d090000), 0x0, 630784, ) == 0x0
 00989  2016   NtClose  (72, ... ) == 0x0
 00990  2016   NtProtectVirtualMemory  (-1, (0x5d091000), 1656, 4, ... (0x5d091000), 4096, 32, ) == 0x0
 00991  2016   NtProtectVirtualMemory  (-1, (0x5d091000), 4096, 32, ... (0x5d091000), 4096, 4, ) == 0x0
 00992  2016   NtFlushInstructionCache  (-1, 1560875008, 1656, ... ) == 0x0
 00993  2016   NtProtectVirtualMemory  (-1, (0x5d091000), 1656, 4, ... (0x5d091000), 4096, 32, ) == 0x0
 00994  2016   NtProtectVirtualMemory  (-1, (0x5d091000), 4096, 32, ... (0x5d091000), 4096, 4, ) == 0x0
 00995  2016   NtFlushInstructionCache  (-1, 1560875008, 1656, ... ) == 0x0
 00996  2016   NtProtectVirtualMemory  (-1, (0x5d091000), 1656, 4, ... (0x5d091000), 4096, 32, ) == 0x0
 00997  2016   NtProtectVirtualMemory  (-1, (0x5d091000), 4096, 32, ... (0x5d091000), 4096, 4, ) == 0x0
 00998  2016   NtFlushInstructionCache  (-1, 1560875008, 1656, ... ) == 0x0
 00999  2016   NtProtectVirtualMemory  (-1, (0x5d091000), 1656, 4, ... (0x5d091000), 4096, 32, ) == 0x0
 01000  2016   NtProtectVirtualMemory  (-1, (0x5d091000), 4096, 32, ... (0x5d091000), 4096, 4, ) == 0x0
 01001  2016   NtFlushInstructionCache  (-1, 1560875008, 1656, ... ) == 0x0
 01002  2016   NtProtectVirtualMemory  (-1, (0x5d091000), 1656, 4, ... (0x5d091000), 4096, 32, ) == 0x0
 01003  2016   NtProtectVirtualMemory  (-1, (0x5d091000), 4096, 32, ... (0x5d091000), 4096, 4, ) == 0x0
 01004  2016   NtFlushInstructionCache  (-1, 1560875008, 1656, ... ) == 0x0
 01005  2016   NtOpenKey  (0x80000000, {24, 0, 0x40, 0, 0,  (0x80000000, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\comctl32.dll"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01006  2016   NtQuerySystemInformation  (Basic, 44, ... {Unknown=0,MaximumIncrement=156250,PhysicalPageSize=0x1000,NumberOfPhysicalPages=0xff7c,LowestPhysicalPage=0x1,HighestPhysicalPage=0xffff,AllocationGranularity=0x10000,LowestUserAddress=0x10000,HighestUserAddress=0x7ffeffff,ActiveProcessors=1,NumberProcessors=1,}, 0x0, ) == 0x0
 01007  2016   NtAllocateVirtualMemory  (-1, 0, 0, 65536, 8192, 4, ... 3735552, 65536, ) == 0x0
 01008  2016   NtAllocateVirtualMemory  (-1, 3735552, 0, 4096, 4096, 4, ... 3735552, 4096, ) == 0x0
 01009  2016   NtAllocateVirtualMemory  (-1, 3739648, 0, 8192, 4096, 4, ... 3739648, 8192, ) == 0x0
 01010  2016   NtAllocateVirtualMemory  (-1, 5677056, 0, 4096, 4096, 4, ... 5677056, 4096, ) == 0x0
 01011  2016   NtAllocateVirtualMemory  (-1, 3747840, 0, 4096, 4096, 4, ... 3747840, 4096, ) == 0x0
 01012  2016   NtAllocateVirtualMemory  (-1, 3751936, 0, 4096, 4096, 4, ... 3751936, 4096, ) == 0x0
 01013  2016   NtQueryDefaultUILanguage  (9824324, ...
 01014  2016   NtOpenThreadTokenEx  (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN
 01015  2016   NtOpenProcessTokenEx  (-1, 0x20008, 512, ... -2147482748, ) == 0x0
 01016  2016   NtQueryInformationToken  (-2147482748, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0
 01017  2016   NtClose  (-2147482748, ... ) == 0x0
 01018  2016   NtOpenKey  (0x2000000, {24, 0, 0x640, 0, 0,  (0x2000000, {24, 0, 0x640, 0, 0, "\REGISTRY\USER\S-1-5-21-1292428093-1383384898-725345543-1003"}, ... -2147482748, ) }, ... -2147482748, ) == 0x0
 01019  2016   NtOpenKey  (0x80000000, {24, -2147482748, 0x240, 0, 0,  (0x80000000, {24, -2147482748, 0x240, 0, 0, "Software\Policies\Microsoft\Control Panel\Desktop"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01020  2016   NtOpenKey  (0x80000000, {24, -2147482748, 0x640, 0, 0,  (0x80000000, {24, -2147482748, 0x640, 0, 0, "Control Panel\Desktop"}, ... -2147481452, ) }, ... -2147481452, ) == 0x0
 01021  2016   NtQueryValueKey  (-2147481452,  (-2147481452, "MultiUILanguageId", Partial, 256, ... ) , Partial, 256, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01022  2016   NtClose  (-2147481452, ... ) == 0x0
 01023  2016   NtClose  (-2147482748, ... ) == 0x0
 01013  2016   NtQueryDefaultUILanguage  ... ) == 0x0
 01024  2016   NtOpenFile  (0x1200a9, {24, 0, 0x40, 0, 0,  (0x1200a9, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\comctl32.dll"}, 1, 96, ... 72, {status=0x0, info=1}, ) }, 1, 96, ... 72, {status=0x0, info=1}, ) == 0x0
 01025  2016   NtCreateSection  (0x4, 0x0, 0x0, 2, 134217728, 72, ... 64, ) == 0x0
 01026  2016   NtMapViewOfSection  (64, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 2, ... (0xe40000), 0x0, 618496, ) == 0x0
 01027  2016   NtOpenFile  (0x1200a9, {24, 0, 0x40, 0, 0,  (0x1200a9, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\comctl32.dll.124.Manifest"}, 1, 96, ... ) }, 1, 96, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01028  2016   NtQueryDefaultLocale  (1, 9822420, ... ) == 0x0
 01029  2016   NtOpenFile  (0x1200a9, {24, 0, 0x40, 0, 0,  (0x1200a9, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\comctl32.dll.124.Config"}, 1, 96, ... ) }, 1, 96, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01030  2016   NtRequestWaitReplyPort  (24, {128, 156, new_msg, 0, 2088850039, 9823456, 1179817, 9823180}  (24, {128, 156, new_msg, 0, 2088850039, 9823456, 1179817, 9823180} "\210\6!\1\33\0\1\0`\0\0\0\0\0\0\0\1\0\0\0\0\0\11\4\1\1\1\0@\0D\0\250\6!\1H\0\0\0\377\377\377\377\0\0\0\0\340q\353\0\0\0\0\0k\10\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0(\0,\0\354\6!\1\0\0\0\0\0\0\0\0\324\350\225\0\0\0\0\0" ... {128, 156, reply, 0, 1252, 2016, 81852, 0} "\300\270\26\0\33\0\1\0\0\0\0\0\0\0\0\0\1\0\0\0\0\0\11\4\1\1\1\0@\0D\0\250\6!\1H\0\0\0\377\377\377\377\0\0\0\0\340q\353\0\0\0\0\0k\10\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0(\0,\0\354\6!\1\0\0\0\0\0\0\0\0\324\350\225\0\0\0\0\0" )  ... {128, 156, reply, 0, 1252, 2016, 81852, 0}  (24, {128, 156, new_msg, 0, 2088850039, 9823456, 1179817, 9823180} "\210\6!\1\33\0\1\0`\0\0\0\0\0\0\0\1\0\0\0\0\0\11\4\1\1\1\0@\0D\0\250\6!\1H\0\0\0\377\377\377\377\0\0\0\0\340q\353\0\0\0\0\0k\10\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0(\0,\0\354\6!\1\0\0\0\0\0\0\0\0\324\350\225\0\0\0\0\0" ... {128, 156, reply, 0, 1252, 2016, 81852, 0} "\300\270\26\0\33\0\1\0\0\0\0\0\0\0\0\0\1\0\0\0\0\0\11\4\1\1\1\0@\0D\0\250\6!\1H\0\0\0\377\377\377\377\0\0\0\0\340q\353\0\0\0\0\0k\10\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0(\0,\0\354\6!\1\0\0\0\0\0\0\0\0\324\350\225\0\0\0\0\0" )  ) == 0x0
 01031  2016   NtClose  (72, ... ) == 0x0
 01032  2016   NtClose  (64, ... ) == 0x0
 01033  2016   NtUnmapViewOfSection  (-1, 0xe40000, ... ) == 0x0
 01034  2016   NtQueryDebugFilterState  (53, 2, ... ) == 0x0
 01035  2016   NtOpenProcess  (0x400, {24, 0, 0x0, 0, 0, 0x0}, {1252, 0}, ... 64, ) == 0x0
 01036  2016   NtQueryInformationProcess  (64, Session, 4, ... {SessionId=0,}, 0x0, ) == 0x0
 01037  2016   NtClose  (64, ... ) == 0x0
 01038  2016   NtUserRegisterWindowMessage  ( ("ShellGetDragImage", ... ) , ... ) == 0xc03a
 01039  2016   NtUserSystemParametersInfo  (104, 0, 1561338260, 0, ... ) == 0x1
 01040  2016   NtUserSystemParametersInfo  (38, 4, 1561337988, 0, ... ) == 0x1
 01041  2016   NtOpenThreadTokenEx  (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN
 01042  2016   NtOpenProcessTokenEx  (-1, 0x20008, 512, ... 64, ) == 0x0
 01043  2016   NtQueryInformationToken  (64, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0
 01044  2016   NtClose  (64, ... ) == 0x0
 01045  2016   NtOpenKey  (0x20019, {24, 0, 0x640, 0, 0,  (0x20019, {24, 0, 0x640, 0, 0, "\REGISTRY\USER\S-1-5-21-1292428093-1383384898-725345543-1003"}, ... 64, ) }, ... 64, ) == 0x0
 01046  2016   NtOpenProcessToken  (-1, 0x8, ... 72, ) == 0x0
 01047  2016   NtAccessCheck  (5676120, 72, 0x1, 9825516, 9825568, 56, 9825548, ... ) == STATUS_NO_IMPERSONATION_TOKEN
 01048  2016   NtClose  (72, ... ) == 0x0
 01049  2016   NtOpenKey  (0x20019, {24, 64, 0x40, 0, 0,  (0x20019, {24, 64, 0x40, 0, 0, "Control Panel\Desktop"}, ... 72, ) }, ... 72, ) == 0x0
 01050  2016   NtQueryValueKey  (72,  (72, "SmoothScroll", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01051  2016   NtClose  (72, ... ) == 0x0
 01052  2016   NtUserSystemParametersInfo  (41, 500, 9825696, 0, ... ) == 0x1
 01053  2016   NtUserSystemParametersInfo  (102, 0, 1561338280, 0, ... ) == 0x1
 01054  2016   NtClose  (64, ... ) == 0x0
 01055  2016   NtUserFindExistingCursorIcon  (9825448, 9825464, 9825512, ... ) == 0x10011
 01056  2016   NtUserRegisterClassExWOW  (9825392, 9825460, 9825476, 9825492, 0, 384, 0, ... ) == 0x8169c03b
 01057  2016   NtUserRegisterClassExWOW  (9825392, 9825460, 9825476, 9825492, 0, 384, 0, ... ) == 0x8169c03d
 01058  2016   NtUserFindExistingCursorIcon  (9825448, 9825464, 9825512, ... ) == 0x10011
 01059  2016   NtUserRegisterClassExWOW  (9825392, 9825460, 9825476, 9825492, 0, 384, 0, ... ) == 0x8169c03f
 01060  2016   NtUserFindExistingCursorIcon  (9825448, 9825464, 9825512, ... ) == 0x10011
 01061  2016   NtUserRegisterClassExWOW  (9825392, 9825460, 9825476, 9825492, 0, 384, 0, ... ) == 0x8169c041
 01062  2016   NtUserFindExistingCursorIcon  (9825448, 9825464, 9825512, ... ) == 0x10011
 01063  2016   NtUserRegisterClassExWOW  (9825392, 9825460, 9825476, 9825492, 0, 384, 0, ... ) == 0x8169c043
 01064  2016   NtUserRegisterClassExWOW  (9825392, 9825460, 9825476, 9825492, 0, 384, 0, ... ) == 0x8169c045
 01065  2016   NtUserFindExistingCursorIcon  (9825448, 9825464, 9825512, ... ) == 0x10011
 01066  2016   NtUserRegisterClassExWOW  (9825392, 9825460, 9825476, 9825492, 0, 384, 0, ... ) == 0x8169c047
 01067  2016   NtUserFindExistingCursorIcon  (9825448, 9825464, 9825512, ... ) == 0x10011
 01068  2016   NtUserRegisterClassExWOW  (9825392, 9825460, 9825476, 9825492, 0, 384, 0, ... ) == 0x8169c049
 01069  2016   NtUserFindExistingCursorIcon  (9825448, 9825464, 9825512, ... ) == 0x10011
 01070  2016   NtUserRegisterClassExWOW  (9825392, 9825460, 9825476, 9825492, 0, 384, 0, ... ) == 0x8169c04b
 01071  2016   NtUserFindExistingCursorIcon  (9825448, 9825464, 9825512, ... ) == 0x10011
 01072  2016   NtUserRegisterClassExWOW  (9825392, 9825460, 9825476, 9825492, 0, 384, 0, ... ) == 0x8169c04d
 01073  2016   NtUserFindExistingCursorIcon  (9825448, 9825464, 9825512, ... ) == 0x10011
 01074  2016   NtUserRegisterClassExWOW  (9825392, 9825460, 9825476, 9825492, 0, 384, 0, ... ) == 0x8169c04f
 01075  2016   NtUserRegisterClassExWOW  (9825392, 9825460, 9825476, 9825492, 0, 384, 0, ... ) == 0x8169c051
 01076  2016   NtUserFindExistingCursorIcon  (9825448, 9825464, 9825512, ... ) == 0x10011
 01077  2016   NtUserRegisterClassExWOW  (9825392, 9825460, 9825476, 9825492, 0, 384, 0, ... ) == 0x8169c053
 01078  2016   NtUserFindExistingCursorIcon  (9825444, 9825460, 9825508, ... ) == 0x10011
 01079  2016   NtUserRegisterClassExWOW  (9825388, 9825456, 9825472, 9825488, 0, 384, 0, ... ) == 0x8169c055
 01080  2016   NtUserFindExistingCursorIcon  (9825444, 9825460, 9825508, ... ) == 0x10011
 01081  2016   NtUserRegisterClassExWOW  (9825388, 9825456, 9825472, 9825488, 0, 384, 0, ... ) == 0x8169c057
 01082  2016   NtUserFindExistingCursorIcon  (9825448, 9825464, 9825512, ... ) == 0x10011
 01083  2016   NtUserRegisterClassExWOW  (9825392, 9825460, 9825476, 9825492, 0, 384, 0, ... ) == 0x8169c059
 01084  2016   NtUserFindExistingCursorIcon  (9825448, 9825464, 9825512, ... ) == 0x10013
 01085  2016   NtUserRegisterClassExWOW  (9825392, 9825460, 9825476, 9825492, 0, 384, 0, ... ) == 0x8169c05b
 01086  2016   NtUserFindExistingCursorIcon  (9825448, 9825464, 9825512, ... ) == 0x10011
 01087  2016   NtUserRegisterClassExWOW  (9825392, 9825460, 9825476, 9825492, 0, 384, 0, ... ) == 0x8169c05d
 01088  2016   NtUserFindExistingCursorIcon  (9825448, 9825464, 9825512, ... ) == 0x10011
 01089  2016   NtUserRegisterClassExWOW  (9825392, 9825460, 9825476, 9825492, 0, 384, 0, ... ) == 0x8169c05f
 01090  2016   NtSetEventBoostPriority  (32, ...
 00740   896   NtWaitForSingleObject  ... ) == 0x0
 01091   896   NtOpenSection  (0xe, {24, 8, 0x40, 0, 0,  (0xe, {24, 8, 0x40, 0, 0, "WININET.dll"}, ... 64, ) }, ... 64, ) == 0x0
 01092   896   NtMapViewOfSection  (64, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x42c10000), 0x0, 847872, ) == 0x0
 01093   896   NtClose  (64, ... ) == 0x0
 01094   896   NtProtectVirtualMemory  (-1, (0x42c11000), 1452, 4, ... (0x42c11000), 4096, 32, ) == 0x0
 01090  2016   NtSetEventBoostPriority  ... ) == 0x0
 01095  2016   NtWaitForSingleObject  (32, 0, 0x0, ...
 01096   896   NtProtectVirtualMemory  (-1, (0x42c11000), 4096, 32, ... (0x42c11000), 4096, 4, ) == 0x0
 01097   896   NtFlushInstructionCache  (-1, 1119948800, 1452, ... ) == 0x0
 01098   896   NtProtectVirtualMemory  (-1, (0x42c11000), 1452, 4, ... (0x42c11000), 4096, 32, ) == 0x0
 01099   896   NtProtectVirtualMemory  (-1, (0x42c11000), 4096, 32, ... (0x42c11000), 4096, 4, ) == 0x0
 01100   896   NtFlushInstructionCache  (-1, 1119948800, 1452, ... ) == 0x0
 01101   896   NtProtectVirtualMemory  (-1, (0x42c11000), 1452, 4, ... (0x42c11000), 4096, 32, ) == 0x0
 01102   896   NtProtectVirtualMemory  (-1, (0x42c11000), 4096, 32, ... (0x42c11000), 4096, 4, ) == 0x0
 01103   896   NtFlushInstructionCache  (-1, 1119948800, 1452, ... ) == 0x0
 01104   896   NtProtectVirtualMemory  (-1, (0x42c11000), 1452, 4, ... (0x42c11000), 4096, 32, ) == 0x0
 01105   896   NtProtectVirtualMemory  (-1, (0x42c11000), 4096, 32, ... (0x42c11000), 4096, 4, ) == 0x0
 01106   896   NtFlushInstructionCache  (-1, 1119948800, 1452, ... ) == 0x0
 01107   896   NtProtectVirtualMemory  (-1, (0x42c11000), 1452, 4, ... (0x42c11000), 4096, 32, ) == 0x0
 01108   896   NtProtectVirtualMemory  (-1, (0x42c11000), 4096, 32, ... (0x42c11000), 4096, 4, ) == 0x0
 01109   896   NtFlushInstructionCache  (-1, 1119948800, 1452, ... ) == 0x0
 01110   896   NtProtectVirtualMemory  (-1, (0x42c11000), 1452, 4, ... (0x42c11000), 4096, 32, ) == 0x0
 01111   896   NtProtectVirtualMemory  (-1, (0x42c11000), 4096, 32, ... (0x42c11000), 4096, 4, ) == 0x0
 01112   896   NtFlushInstructionCache  (-1, 1119948800, 1452, ... ) == 0x0
 01113   896   NtOpenSection  (0xe, {24, 8, 0x40, 0, 0,  (0xe, {24, 8, 0x40, 0, 0, "Normaliz.dll"}, ... 64, ) }, ... 64, ) == 0x0
 01114   896   NtMapViewOfSection  (64, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x3c0000), 0x0, 36864, ) == STATUS_IMAGE_NOT_AT_BASE
 01115   896   NtProtectVirtualMemory  (-1, (0x3c1000), 18944, 4, ... (0x3c1000), 20480, 32, ) == 0x0
 01116   896   NtProtectVirtualMemory  (-1, (0x3c7000), 1024, 4, ... (0x3c7000), 4096, 2, ) == 0x0
 01117   896   NtProtectVirtualMemory  (-1, (0x3c8000), 1536, 4, ... (0x3c8000), 4096, 2, ) == 0x0
 01118   896   NtMapViewOfSection  (64, -1, (0x3c0000), 0, 0, 0x0, 36864, 1, 0, 4, ... ) == STATUS_CONFLICTING_ADDRESSES
 01119   896   NtProtectVirtualMemory  (-1, (0x3c1000), 18944, 16, ... (0x3c1000), 20480, 4, ) == 0x0
 01120   896   NtProtectVirtualMemory  (-1, (0x3c7000), 1024, 2, ... (0x3c7000), 4096, 8, ) == 0x0
 01121   896   NtProtectVirtualMemory  (-1, (0x3c8000), 1536, 2, ... (0x3c8000), 4096, 8, ) == 0x0
 01122   896   NtFlushInstructionCache  (-1, 0, 0, ... ) == 0x0
 01123   896   NtClose  (64, ... ) == 0x0
 01124   896   NtProtectVirtualMemory  (-1, (0x3c1000), 160, 4, ... (0x3c1000), 4096, 16, ) == 0x0
 01125   896   NtProtectVirtualMemory  (-1, (0x3c1000), 4096, 16, ... (0x3c1000), 4096, 4, ) == 0x0
 01126   896   NtFlushInstructionCache  (-1, 3936256, 160, ... ) == 0x0
 01127   896   NtProtectVirtualMemory  (-1, (0x3c1000), 160, 4, ... (0x3c1000), 4096, 16, ) == 0x0
 01128   896   NtProtectVirtualMemory  (-1, (0x3c1000), 4096, 16, ... (0x3c1000), 4096, 4, ) == 0x0
 01129   896   NtFlushInstructionCache  (-1, 3936256, 160, ... ) == 0x0
 01130   896   NtProtectVirtualMemory  (-1, (0x3c1000), 160, 4, ... (0x3c1000), 4096, 16, ) == 0x0
 01131   896   NtProtectVirtualMemory  (-1, (0x3c1000), 4096, 16, ... (0x3c1000), 4096, 4, ) == 0x0
 01132   896   NtFlushInstructionCache  (-1, 3936256, 160, ... ) == 0x0
 01133   896   NtProtectVirtualMemory  (-1, (0x42c11000), 1452, 4, ... (0x42c11000), 4096, 32, ) == 0x0
 01134   896   NtProtectVirtualMemory  (-1, (0x42c11000), 4096, 32, ... (0x42c11000), 4096, 4, ) == 0x0
 01135   896   NtFlushInstructionCache  (-1, 1119948800, 1452, ... ) == 0x0
 01136   896   NtOpenSection  (0xe, {24, 8, 0x40, 0, 0,  (0xe, {24, 8, 0x40, 0, 0, "iertutil.dll"}, ... 64, ) }, ... 64, ) == 0x0
 01137   896   NtMapViewOfSection  (64, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x42990000), 0x0, 282624, ) == 0x0
 01138   896   NtClose  (64, ... ) == 0x0
 01139   896   NtProtectVirtualMemory  (-1, (0x42991000), 616, 4, ... (0x42991000), 4096, 32, ) == 0x0
 01140   896   NtProtectVirtualMemory  (-1, (0x42991000), 4096, 32, ... (0x42991000), 4096, 4, ) == 0x0
 01141   896   NtFlushInstructionCache  (-1, 1117327360, 616, ... ) == 0x0
 01142   896   NtProtectVirtualMemory  (-1, (0x42991000), 616, 4, ... (0x42991000), 4096, 32, ) == 0x0
 01143   896   NtProtectVirtualMemory  (-1, (0x42991000), 4096, 32, ... (0x42991000), 4096, 4, ) == 0x0
 01144   896   NtFlushInstructionCache  (-1, 1117327360, 616, ... ) == 0x0
 01145   896   NtProtectVirtualMemory  (-1, (0x42991000), 616, 4, ... (0x42991000), 4096, 32, ) == 0x0
 01146   896   NtProtectVirtualMemory  (-1, (0x42991000), 4096, 32, ... (0x42991000), 4096, 4, ) == 0x0
 01147   896   NtFlushInstructionCache  (-1, 1117327360, 616, ... ) == 0x0
 01148   896   NtProtectVirtualMemory  (-1, (0x42991000), 616, 4, ... (0x42991000), 4096, 32, ) == 0x0
 01149   896   NtProtectVirtualMemory  (-1, (0x42991000), 4096, 32, ... (0x42991000), 4096, 4, ) == 0x0
 01150   896   NtFlushInstructionCache  (-1, 1117327360, 616, ... ) == 0x0
 01151   896   NtProtectVirtualMemory  (-1, (0x42991000), 616, 4, ... (0x42991000), 4096, 32, ) == 0x0
 01152   896   NtProtectVirtualMemory  (-1, (0x42991000), 4096, 32, ... (0x42991000), 4096, 4, ) == 0x0
 01153   896   NtFlushInstructionCache  (-1, 1117327360, 616, ... ) == 0x0
 01154   896   NtProtectVirtualMemory  (-1, (0x42991000), 616, 4, ... (0x42991000), 4096, 32, ) == 0x0
 01155   896   NtProtectVirtualMemory  (-1, (0x42991000), 4096, 32, ... (0x42991000), 4096, 4, ) == 0x0
 01156   896   NtFlushInstructionCache  (-1, 1117327360, 616, ... ) == 0x0
 01157   896   NtProtectVirtualMemory  (-1, (0x42c11000), 1452, 4, ... (0x42c11000), 4096, 32, ) == 0x0
 01158   896   NtProtectVirtualMemory  (-1, (0x42c11000), 4096, 32, ... (0x42c11000), 4096, 4, ) == 0x0
 01159   896   NtFlushInstructionCache  (-1, 1119948800, 1452, ... ) == 0x0
 01160   896   NtOpenKey  (0x80000000, {24, 0, 0x40, 0, 0,  (0x80000000, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Normaliz.dll"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01161   896   NtOpenKey  (0x80000000, {24, 0, 0x40, 0, 0,  (0x80000000, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\iertutil.dll"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01162   896   NtQueryPerformanceCounter  (... {-1439200325, 16}, {3579545, 0}, ) == 0x0
 01163   896   NtOpenKey  (0x80000000, {24, 0, 0x40, 0, 0,  (0x80000000, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\WININET.dll"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01164   896   NtQueryPerformanceCounter  (... {-1439199703, 16}, {3579545, 0}, ) == 0x0
 01165   896   NtAllocateVirtualMemory  (-1, 5681152, 0, 8192, 4096, 4, ... 5681152, 8192, ) == 0x0
 01166   896   NtQuerySystemInformation  (Basic, 44, ... {Unknown=0,MaximumIncrement=156250,PhysicalPageSize=0x1000,NumberOfPhysicalPages=0xff7c,LowestPhysicalPage=0x1,HighestPhysicalPage=0xffff,AllocationGranularity=0x10000,LowestUserAddress=0x10000,HighestUserAddress=0x7ffeffff,ActiveProcessors=1,NumberProcessors=1,}, 0x0, ) == 0x0
 01167   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ... 14942208, 1048576, ) == 0x0
 01168   896   NtAllocateVirtualMemory  (-1, 14942208, 0, 4096, 4096, 4, ... 14942208, 4096, ) == 0x0
 01169   896   NtAllocateVirtualMemory  (-1, 14946304, 0, 8192, 4096, 4, ... 14946304, 8192, ) == 0x0
 01170   896   NtCreateEvent  (0x1f0003, 0x0, 0, 0, ... 64, ) == 0x0
 01171   896   NtCreateFile  (0xc0100080, {24, 0, 0x40, 0, 2290924,  (0xc0100080, {24, 0, 0x40, 0, 2290924, "\??\WMIDataDevice"}, 0x0, 128, 0, 1, 64, 0, 0, ... 72, {status=0x0, info=0}, ) }, 0x0, 128, 0, 1, 64, 0, 0, ... 72, {status=0x0, info=0}, ) == 0x0
 01172   896   NtCreateEvent  (0x1f0003, 0x0, 1, 0, ... 76, ) == 0x0
 01173   896   NtDeviceIoControlFile  (72, 76, 0x0, 0x22f54c, 0x22414c,  (72, 76, 0x0, 0x22f54c, 0x22414c, "\224\365"\0\0\0\0\0\1\0\0\0\2\0\0\0\24\0\0\0\34\0\0\0P\0\0\0\0\0\0\0L\0\0\0\0\0\0\0\2\0\0\0U\4\376\14\272\223\15D\243\376U9s\320\267#\0\20\10\0\0\0\0\0\0\0\0\0U\4\376\14\272\223\15D\243\376U9s\320\267#\0\0\10\0\0\0\0\0\0\0\0\0\2\0\0\0", 104, 80, ... \0\0\0\0\0\1\0\0\0\2\0\0\0\24\0\0\0\34\0\0\0P\0\0\0\0\0\0\0L\0\0\0\0\0\0\0\2\0\0\0U\4\376\14\272\223\15D\243\376U9s\320\267#\0\20\10\0\0\0\0\0\0\0\0\0U\4\376\14\272\223\15D\243\376U9s\320\267#\0\0\10\0\0\0\0\0\0\0\0\0\2\0\0\0", 104, 80, ...
 01174   896   NtOpenKey  (0x82000000, {24, 0, 0x240, 0, 0,  (0x82000000, {24, 0, 0x240, 0, 0, "\Registry\Machine\System\CurrentControlSet\Control\WMI\Security"}, ... -2147482748, ) }, ... -2147482748, ) == 0x0
 01175   896   NtQueryValueKey  (-2147482748,  (-2147482748, "DF8480A1-7492-4F45-AB78-1084642581FB", Full, 130, ... ) , Full, 130, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01176   896   NtQueryValueKey  (-2147482748,  (-2147482748, "00000000-0000-0000-0000-000000000000", Full, 130, ... ) , Full, 130, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01177   896   NtClose  (-2147482748, ... ) == 0x0
 01178   896   NtClose  (900, ... ) == 0x0
 01173   896   NtDeviceIoControlFile  ... {status=0x0, info=80},  ... {status=0x0, info=80}, " \3106\342\0\0\0\0U\4\376\14\272\223\15D\243\376U9s\320\267#Seed\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0U\4\376\14\272\223\15D\243\376U9s\320\267#\0\20\10\0P\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0", ) , ) == 0x0
 01179   896   NtCreateFile  (0xc0100080, {24, 0, 0x40, 0, 2291140,  (0xc0100080, {24, 0, 0x40, 0, 2291140, "\??\WMIDataDevice"}, 0x0, 128, 0, 1, 64, 0, 0, ... 84, {status=0x0, info=0}, ) }, 0x0, 128, 0, 1, 64, 0, 0, ... 84, {status=0x0, info=0}, ) == 0x0
 01180   896   NtCreateEvent  (0x1f0003, 0x0, 1, 0, ... 88, ) == 0x0
 01181   896   NtDuplicateObject  (-1, -1, -1, 0x0, 0, 2, ... 92, ) == 0x0
 01182   896   NtCreateEvent  (0x1f0003, 0x0, 1, 0, ... 96, ) == 0x0
 01183   896   NtCreateEvent  (0x1f0003, 0x0, 1, 0, ... 100, ) == 0x0
 01184   896   NtAllocateVirtualMemory  (-1, 14954496, 0, 8192, 4096, 4, ... 14954496, 8192, ) == 0x0
 01185   896   NtAllocateVirtualMemory  (-1, 0, 0, 2097152, 8192, 4, ... 15990784, 2097152, ) == 0x0
 01186   896   NtAllocateVirtualMemory  (-1, 18079744, 0, 8192, 4096, 4, ... 18079744, 8192, ) == 0x0
 01187   896   NtProtectVirtualMemory  (-1, (0x113e000), 4096, 260, ... (0x113e000), 4096, 4, ) == 0x0
 01188   896   NtCreateThread  (0x1f03ff, 0x0, -1, 2290224, 2290168, 1, ... 104, {1252, 596}, ) == 0x0
 01189   896   NtQueryInformationThread  (104, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ffdd000,Pid=1252,Tid=596,}, 0x0, ) == 0x0
 01190   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 0, 0, 0, 14942584}  (24, {28, 56, new_msg, 0, 0, 0, 0, 14942584} "\0\0\0\0\1\0\1\0\0\0\0\0(\2\0\0h\0\0\0\344\4\0\0T\2\0\0" ... {28, 56, reply, 0, 1252, 896, 81853, 0} "\0\0\0\0\1\0\1\0\0\0\0\0(\2\0\0h\0\0\0\344\4\0\0T\2\0\0" )  ... {28, 56, reply, 0, 1252, 896, 81853, 0}  (24, {28, 56, new_msg, 0, 0, 0, 0, 14942584} "\0\0\0\0\1\0\1\0\0\0\0\0(\2\0\0h\0\0\0\344\4\0\0T\2\0\0" ... {28, 56, reply, 0, 1252, 896, 81853, 0} "\0\0\0\0\1\0\1\0\0\0\0\0(\2\0\0h\0\0\0\344\4\0\0T\2\0\0" )  ) == 0x0
 01191   896   NtResumeThread  (104, ... 1, ) == 0x0
 01192   896   NtClose  (104, ... ) == 0x0
 01193   896   NtSetEvent  (88, ...
 01194   596   NtWaitForSingleObject  (32, 0, 0x0, ...
 01193   896   NtSetEvent  ... 0x0, ) == 0x0
 01195   896   NtSetEvent  (64, ... 0x0, ) == 0x0
 01196   896   NtClose  (64, ... ) == 0x0
 01197   896   NtCreateEvent  (0x1f0003, 0x0, 0, 0, ... 64, ) == 0x0
 01198   896   NtAllocateVirtualMemory  (-1, 14962688, 0, 4096, 4096, 4, ... 14962688, 4096, ) == 0x0
 01199   896   NtDeviceIoControlFile  (72, 76, 0x0, 0x22f54c, 0x22414c,  (72, 76, 0x0, 0x22f54c, 0x22414c, "\224\365"\0\0\0\0\0\2\0\0\0\2\0\0\0\24\0\0\0\34\0\0\0P\0\0\0\0\0\0\0L\0\0\0\0\0\0\0\2\0\0\0\254\253\177yX{\226G\271$\325\21x\245\234\344\0\20\10\0\0\0\0\0\0\0\0\0\254\253\177yX{\226G\271$\325\21x\245\234\344\0\0\10\0\0\0\0\0\0\0\0\0\2\0\0\0", 104, 80, ... \0\0\0\0\0\2\0\0\0\2\0\0\0\24\0\0\0\34\0\0\0P\0\0\0\0\0\0\0L\0\0\0\0\0\0\0\2\0\0\0\254\253\177yX{\226G\271$\325\21x\245\234\344\0\20\10\0\0\0\0\0\0\0\0\0\254\253\177yX{\226G\271$\325\21x\245\234\344\0\0\10\0\0\0\0\0\0\0\0\0\2\0\0\0", 104, 80, ...
 01200   896   NtOpenKey  (0x82000000, {24, 0, 0x240, 0, 0,  (0x82000000, {24, 0, 0x240, 0, 0, "\Registry\Machine\System\CurrentControlSet\Control\WMI\Security"}, ... -2147482748, ) }, ... -2147482748, ) == 0x0
 01201   896   NtQueryValueKey  (-2147482748,  (-2147482748, "DF8480A1-7492-4F45-AB78-1084642581FB", Full, 130, ... ) , Full, 130, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01202   896   NtQueryValueKey  (-2147482748,  (-2147482748, "00000000-0000-0000-0000-000000000000", Full, 130, ... ) , Full, 130, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01203   896   NtClose  (-2147482748, ... ) == 0x0
 01204   896   NtClose  (900, ... ) == 0x0
 01199   896   NtDeviceIoControlFile  ... {status=0x0, info=80},  ... {status=0x0, info=80}, " \350R\342\0\0\0\0\254\253\177yX{\226G\271$\325\21x\245\234\344Vid\00\211\25\0\0\0\0\0\0\0\0\0\2\0\0\0\254\253\177yX{\226G\271$\325\21x\245\234\344\0\20\10\0h\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0", ) , ) == 0x0
 01205   896   NtSetEvent  (88, ... 0x0, ) == 0x0
 01206   896   NtSetEvent  (64, ... 0x0, ) == 0x0
 01207   896   NtClose  (64, ... ) == 0x0
 01208   896   NtOpenThreadToken  (-2, 0x8, 0, ... ) == STATUS_NO_TOKEN
 01209   896   NtOpenProcessToken  (-1, 0xa, ... 64, ) == 0x0
 01210   896   NtDuplicateToken  (64, 0xc, {24, 0, 0x0, 0, 2291408, 0x0}, 0, 2, ... 108, ) == 0x0
 01211   896   NtClose  (64, ... ) == 0x0
 01212   896   NtAccessCheck  (5676120, 108, 0x1, 2291484, 2291536, 56, 2291516, ... (0x1), ) == 0x0
 01213   896   NtClose  (108, ... ) == 0x0
 01214   896   NtQueryDefaultUILanguage  (2290288, ...
 01215   896   NtOpenThreadTokenEx  (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN
 01216   896   NtOpenProcessTokenEx  (-1, 0x20008, 512, ... -2147482748, ) == 0x0
 01217   896   NtQueryInformationToken  (-2147482748, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0
 01218   896   NtClose  (-2147482748, ... ) == 0x0
 01219   896   NtOpenKey  (0x2000000, {24, 0, 0x640, 0, 0,  (0x2000000, {24, 0, 0x640, 0, 0, "\REGISTRY\USER\S-1-5-21-1292428093-1383384898-725345543-1003"}, ... -2147482748, ) }, ... -2147482748, ) == 0x0
 01220   896   NtOpenKey  (0x80000000, {24, -2147482748, 0x240, 0, 0,  (0x80000000, {24, -2147482748, 0x240, 0, 0, "Software\Policies\Microsoft\Control Panel\Desktop"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01221   896   NtOpenKey  (0x80000000, {24, -2147482748, 0x640, 0, 0,  (0x80000000, {24, -2147482748, 0x640, 0, 0, "Control Panel\Desktop"}, ... -2147481452, ) }, ... -2147481452, ) == 0x0
 01222   896   NtQueryValueKey  (-2147481452,  (-2147481452, "MultiUILanguageId", Partial, 256, ... ) , Partial, 256, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01223   896   NtClose  (-2147481452, ... ) == 0x0
 01224   896   NtClose  (-2147482748, ... ) == 0x0
 01214   896   NtQueryDefaultUILanguage  ... ) == 0x0
 01225   896   NtOpenFile  (0x1200a9, {24, 0, 0x40, 0, 0,  (0x1200a9, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\WININET.dll.123.Manifest"}, 1, 96, ... ) }, 1, 96, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01226   896   NtAllocateVirtualMemory  (-1, 2277376, 0, 4096, 4096, 260, ... 2277376, 4096, ) == 0x0
 01227   896   NtQueryDefaultLocale  (1, 2288384, ... ) == 0x0
 01228   896   NtOpenFile  (0x1200a9, {24, 0, 0x40, 0, 0,  (0x1200a9, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\WININET.dll.123.Config"}, 1, 96, ... ) }, 1, 96, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01229   896   NtRequestWaitReplyPort  (24, {128, 156, new_msg, 0, 2088850039, 2289420, 1179817, 2289144}  (24, {128, 156, new_msg, 0, 2088850039, 2289420, 1179817, 2289144} "\210\6!\1\33\0\1\0`\0\0\0\0\0\0\0\1\0\0\0\0\0\11\4\1\1\1\0>\0@\0\250\6!\1\0\0\0\0\377\377\377\377\0\0\0\0PR\313B\0\0\0\0\370\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0(\0,\0\350\6!\1\0\0\0\0\0\0\0\0\0\363"\0\0\0\0\0" ... {128, 156, reply, 0, 1252, 896, 81854, 0} "\300\270\26\0\33\0\1\0\0\0\0\0\0\0\0\0\1\0\0\0\0\0\11\4\1\1\1\0>\0@\0\250\6!\1\0\0\0\0\377\377\377\377\0\0\0\0PR\313B\0\0\0\0\370\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0(\0,\0\350\6!\1\0\0\0\0\0\0\0\0\0\363"\0\0\0\0\0" ) \0\0\0\0\0 (24, {128, 156, new_msg, 0, 2088850039, 2289420, 1179817, 2289144} "\210\6!\1\33\0\1\0`\0\0\0\0\0\0\0\1\0\0\0\0\0\11\4\1\1\1\0>\0@\0\250\6!\1\0\0\0\0\377\377\377\377\0\0\0\0PR\313B\0\0\0\0\370\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0(\0,\0\350\6!\1\0\0\0\0\0\0\0\0\0\363"\0\0\0\0\0" ... {128, 156, reply, 0, 1252, 896, 81854, 0} "\300\270\26\0\33\0\1\0\0\0\0\0\0\0\0\0\1\0\0\0\0\0\11\4\1\1\1\0>\0@\0\250\6!\1\0\0\0\0\377\377\377\377\0\0\0\0PR\313B\0\0\0\0\370\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0(\0,\0\350\6!\1\0\0\0\0\0\0\0\0\0\363"\0\0\0\0\0" ) \300\270\26\0\33\0\1\0\0\0\0\0\0\0\0\0\1\0\0\0\0\0\11\4\1\1\1\0>\0@\0\250\6!\1\0\0\0\0\377\377\377\377\0\0\0\0PR\313B\0\0\0\0\370\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0(\0,\0\350\6!\1\0\0\0\0\0\0\0\0\0\363 (24, {128, 156, new_msg, 0, 2088850039, 2289420, 1179817, 2289144} "\210\6!\1\33\0\1\0`\0\0\0\0\0\0\0\1\0\0\0\0\0\11\4\1\1\1\0>\0@\0\250\6!\1\0\0\0\0\377\377\377\377\0\0\0\0PR\313B\0\0\0\0\370\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0(\0,\0\350\6!\1\0\0\0\0\0\0\0\0\0\363"\0\0\0\0\0" ... {128, 156, reply, 0, 1252, 896, 81854, 0} "\300\270\26\0\33\0\1\0\0\0\0\0\0\0\0\0\1\0\0\0\0\0\11\4\1\1\1\0>\0@\0\250\6!\1\0\0\0\0\377\377\377\377\0\0\0\0PR\313B\0\0\0\0\370\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0(\0,\0\350\6!\1\0\0\0\0\0\0\0\0\0\363"\0\0\0\0\0" )  ) == 0x0
 01230   896   NtQueryDebugFilterState  (53, 2, ... ) == 0x0
 01231   896   NtOpenKey  (0x8, {24, 0, 0x40, 0, 0,  (0x8, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows\CurrentVersion\SideBySide\AssemblyStorageRoots"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01232   896   NtQueryDebugFilterState  (53, 2, ... ) == 0x0
 01233   896   NtQueryDebugFilterState  (53, 2, ... ) == 0x0
 01234   896   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\u:\work\packed.exe.Local\"}, 2287612, ... ) }, 2287612, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01235   896   NtQueryDebugFilterState  (53, 2, ... ) == 0x0
 01236   896   NtQueryDebugFilterState  (53, 2, ... ) == 0x0
 01237   896   NtQueryDebugFilterState  (53, 2, ... ) == 0x0
 01238   896   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.2982_x-ww_ac3f9c03"}, 2287676, ... ) }, 2287676, ... ) == 0x0
 01239   896   NtOpenFile  (0x100020, {24, 0, 0x40, 0, 0,  (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.2982_x-ww_ac3f9c03"}, 3, 33, ... 108, {status=0x0, info=1}, ) }, 3, 33, ... 108, {status=0x0, info=1}, ) == 0x0
 01240   896   NtQueryDebugFilterState  (53, 2, ... ) == 0x0
 01241   896   NtOpenThreadTokenEx  (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN
 01242   896   NtOpenProcessTokenEx  (-1, 0x20008, 512, ... 64, ) == 0x0
 01243   896   NtQueryInformationToken  (64, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0
 01244   896   NtClose  (64, ... ) == 0x0
 01245   896   NtOpenKey  (0x2000000, {24, 0, 0x640, 0, 0,  (0x2000000, {24, 0, 0x640, 0, 0, "\REGISTRY\USER\S-1-5-21-1292428093-1383384898-725345543-1003"}, ... 64, ) }, ... 64, ) == 0x0
 01246   896   NtSetInformationObject  (64, Handle, {Inherit=0,ProtectFromClose=1,}, 2228480, ... ) == 0x0
 01247   896   NtCreateKey  (0x2001f, {24, 64, 0x40, 0, 0,  (0x2001f, {24, 64, 0x40, 0, 0, "SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings"}, 0, 0x0, 0, ... 112, 2, ) }, 0, 0x0, 0, ... 112, 2, ) == 0x0
 01248   896   NtSetEventBoostPriority  (32, ...
 01095  2016   NtWaitForSingleObject  ... ) == 0x0
 01249  2016   NtSetEventBoostPriority  (32, ...
 01194   596   NtWaitForSingleObject  ... ) == 0x0
 01250   596   NtTestAlert  (... ) == 0x0
 01249  2016   NtSetEventBoostPriority  ... ) == 0x0
 01248   896   NtSetEventBoostPriority  ... ) == 0x0
 01251   596   NtContinue  (18087216, 1, ...
 01252   896   NtOpenSection  (0xe, {24, 8, 0x40, 0, 0,  (0xe, {24, 8, 0x40, 0, 0, "iphlpapi.dll"}, ... }, ...
 01253   596   NtRegisterThreadTerminatePort  (24, ...
 01252   896   NtOpenSection  ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01253   596   NtRegisterThreadTerminatePort  ... ) == 0x0
 01254   896   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\u:\work\iphlpapi.dll"}, 2291484, ... }, 2291484, ...
 01255   596   NtDeviceIoControlFile  (84, 96, 0x0, 0x77e466a0, 0x228144,  (84, 96, 0x0, 0x77e466a0, 0x228144, "\2\0\0\0\1\0\0\0\\370\342w\0\0\0\0\\0\0\0\0\0\0\0h\0\0\0\0\0\0\0P\0\0\0\0\0\0\0", 40, 4096, ... {status=0x103, info=0}, "", ) , 40, 4096, ... {status=0x103, info=0}, "", ) == 0x103
 01256   596   NtWaitForMultipleObjects  (2, (88, 96, ), 1, 1, {1294967296, -1}, ... ) == 0x0
 01257   596   NtDeviceIoControlFile  (84, 100, 0x0, 0x77e46680, 0x228144,  (84, 100, 0x0, 0x77e46680, 0x228144, "\2\0\0\0\1\0\0\0\\370\342w\0\0\0\0\\0\0\0\0\0\0\0h\0\0\0\0\0\0\0P\0\0\0\0\0\0\0", 40, 4096, ... {status=0x103, info=0}, "", ) , 40, 4096, ... {status=0x103, info=0}, "", ) == 0x103
 01258  2016   NtWaitForSingleObject  (32, 0, 0x0, ...
 01259   596   NtWaitForMultipleObjects  (2, (88, 100, ), 1, 1, {1294967296, -1}, ...
 01254   896   NtQueryAttributesFile  ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01260   896   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\iphlpapi.dll"}, 2291484, ... ) }, 2291484, ... ) == 0x0
 01261   896   NtOpenFile  (0x100020, {24, 0, 0x40, 0, 0,  (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\iphlpapi.dll"}, 5, 96, ... 116, {status=0x0, info=1}, ) }, 5, 96, ... 116, {status=0x0, info=1}, ) == 0x0
 01262   896   NtCreateSection  (0xf, 0x0, 0x0, 16, 16777216, 116, ... 120, ) == 0x0
 01263   896   NtQuerySection  (120, Image, 48, ... {section info, class 1, size 48}, 0x0, ) == 0x0
 01264   896   NtClose  (116, ... ) == 0x0
 01265   896   NtMapViewOfSection  (120, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x76d60000), 0x0, 102400, ) == 0x0
 01266   896   NtClose  (120, ... ) == 0x0
 01267   896   NtProtectVirtualMemory  (-1, (0x76d61000), 500, 4, ... (0x76d61000), 4096, 32, ) == 0x0
 01268   896   NtProtectVirtualMemory  (-1, (0x76d61000), 4096, 32, ... (0x76d61000), 4096, 4, ) == 0x0
 01269   896   NtFlushInstructionCache  (-1, 1993740288, 500, ... ) == 0x0
 01270   896   NtProtectVirtualMemory  (-1, (0x76d61000), 500, 4, ... (0x76d61000), 4096, 32, ) == 0x0
 01271   896   NtProtectVirtualMemory  (-1, (0x76d61000), 4096, 32, ... (0x76d61000), 4096, 4, ) == 0x0
 01272   896   NtFlushInstructionCache  (-1, 1993740288, 500, ... ) == 0x0
 01273   896   NtProtectVirtualMemory  (-1, (0x76d61000), 500, 4, ... (0x76d61000), 4096, 32, ) == 0x0
 01274   896   NtProtectVirtualMemory  (-1, (0x76d61000), 4096, 32, ... (0x76d61000), 4096, 4, ) == 0x0
 01275   896   NtFlushInstructionCache  (-1, 1993740288, 500, ... ) == 0x0
 01276   896   NtProtectVirtualMemory  (-1, (0x76d61000), 500, 4, ... (0x76d61000), 4096, 32, ) == 0x0
 01277   896   NtProtectVirtualMemory  (-1, (0x76d61000), 4096, 32, ... (0x76d61000), 4096, 4, ) == 0x0
 01278   896   NtFlushInstructionCache  (-1, 1993740288, 500, ... ) == 0x0
 01279   896   NtProtectVirtualMemory  (-1, (0x76d61000), 500, 4, ... (0x76d61000), 4096, 32, ) == 0x0
 01280   896   NtProtectVirtualMemory  (-1, (0x76d61000), 4096, 32, ... (0x76d61000), 4096, 4, ) == 0x0
 01281   896   NtFlushInstructionCache  (-1, 1993740288, 500, ... ) == 0x0
 01282   896   NtProtectVirtualMemory  (-1, (0x76d61000), 500, 4, ... (0x76d61000), 4096, 32, ) == 0x0
 01283   896   NtProtectVirtualMemory  (-1, (0x76d61000), 4096, 32, ... (0x76d61000), 4096, 4, ) == 0x0
 01284   896   NtFlushInstructionCache  (-1, 1993740288, 500, ... ) == 0x0
 01285   896   NtOpenKey  (0x80000000, {24, 0, 0x40, 0, 0,  (0x80000000, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\iphlpapi.dll"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01286   896   NtQuerySystemInformation  (Basic, 44, ... {Unknown=0,MaximumIncrement=156250,PhysicalPageSize=0x1000,NumberOfPhysicalPages=0xff7c,LowestPhysicalPage=0x1,HighestPhysicalPage=0xffff,AllocationGranularity=0x10000,LowestUserAddress=0x10000,HighestUserAddress=0x7ffeffff,ActiveProcessors=1,NumberProcessors=1,}, 0x0, ) == 0x0
 01287   896   NtAllocateVirtualMemory  (-1, 0, 0, 65536, 8192, 4, ... 4063232, 65536, ) == 0x0
 01288   896   NtAllocateVirtualMemory  (-1, 4063232, 0, 4096, 4096, 4, ... 4063232, 4096, ) == 0x0
 01289   896   NtAllocateVirtualMemory  (-1, 4067328, 0, 8192, 4096, 4, ... 4067328, 8192, ) == 0x0
 01290   896   NtCreateFile  (0x20000000, {24, 0, 0x40, 0, 0,  (0x20000000, {24, 0, 0x40, 0, 0, "\Device\Tcp"}, 0x0, 128, 3, 3, 0, 0, 0, ... 120, {status=0x0, info=0}, ) }, 0x0, 128, 3, 3, 0, 0, 0, ... 120, {status=0x0, info=0}, ) == 0x0
 01291   896   NtCreateFile  (0x40000000, {24, 0, 0x40, 0, 0,  (0x40000000, {24, 0, 0x40, 0, 0, "\Device\Tcp"}, 0x0, 128, 3, 3, 0, 0, 0, ... 116, {status=0x0, info=0}, ) }, 0x0, 128, 3, 3, 0, 0, 0, ... 116, {status=0x0, info=0}, ) == 0x0
 01292   896   NtCreateFile  (0x20000000, {24, 0, 0x40, 0, 0,  (0x20000000, {24, 0, 0x40, 0, 0, "\Device\Ip"}, 0x0, 128, 3, 3, 0, 0, 0, ... 124, {status=0x0, info=0}, ) }, 0x0, 128, 3, 3, 0, 0, 0, ... 124, {status=0x0, info=0}, ) == 0x0
 01293   896   NtCreateFile  (0x100003, {24, 0, 0x40, 0, 0,  (0x100003, {24, 0, 0x40, 0, 0, "\Device\Ip"}, 0x0, 128, 3, 3, 0, 0, 0, ... 128, {status=0x0, info=0}, ) }, 0x0, 128, 3, 3, 0, 0, 0, ... 128, {status=0x0, info=0}, ) == 0x0
 01294   896   NtCreateFile  (0x20100080, {24, 0, 0x40, 0, 2291412,  (0x20100080, {24, 0, 0x40, 0, 2291412, "\??\Ip"}, 0x0, 128, 3, 1, 64, 0, 0, ... 132, {status=0x0, info=0}, ) }, 0x0, 128, 3, 1, 64, 0, 0, ... 132, {status=0x0, info=0}, ) == 0x0
 01295   896   NtAllocateVirtualMemory  (-1, 4075520, 0, 36864, 4096, 4, ... 4075520, 36864, ) == 0x0
 01296   896   NtCreateEvent  (0x1f0003, 0x0, 0, 0, ... 136, ) == 0x0
 01297   896   NtDeviceIoControlFile  (120, 136, 0x0, 0x0, 0x120003,  (120, 136, 0x0, 0x0, 0x120003, "\0\0\0\0\0\0\0\0\0\1\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0", 36, 32768, ... {status=0x0, info=56}, "\0\4\0\0\0\0\0\0\1\4\0\0\0\0\0\0\1\3\0\0\0\0\0\0\200\3\0\0\0\0\0\0\0\2\0\0\0\0\0\0\200\2\0\0\0\0\0\0\0\2\0\0\1\0\0\0", ) , 36, 32768, ... {status=0x0, info=56},  (120, 136, 0x0, 0x0, 0x120003, "\0\0\0\0\0\0\0\0\0\1\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0", 36, 32768, ... {status=0x0, info=56}, "\0\4\0\0\0\0\0\0\1\4\0\0\0\0\0\0\1\3\0\0\0\0\0\0\200\3\0\0\0\0\0\0\0\2\0\0\0\0\0\0\200\2\0\0\0\0\0\0\0\2\0\0\1\0\0\0", ) , ) == 0x0
 01298   896   NtClose  (136, ... ) == 0x0
 01299   896   NtCreateEvent  (0x1f0003, 0x0, 0, 0, ... 136, ) == 0x0
 01300   896   NtDeviceIoControlFile  (120, 136, 0x0, 0x0, 0x120003,  (120, 136, 0x0, 0x0, 0x120003, "\0\2\0\0\0\0\0\0\0\2\0\0\0\1\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0", 36, 348, ... {status=0x0, info=118}, "\1\0\0\0\30\0\0\0\360\5\0\0\200\226\230\0\0\0\0\0\0\0\0\0\0\0\0\0\1\0\0\0\5\0\0\0\365@\250\25(\5\0\0\13\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0(\5\0\0\13\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\32\0\0\0MS TCP Loopback interface\0", ) , 36, 348, ... {status=0x0, info=118},  (120, 136, 0x0, 0x0, 0x120003, "\0\2\0\0\0\0\0\0\0\2\0\0\0\1\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0", 36, 348, ... {status=0x0, info=118}, "\1\0\0\0\30\0\0\0\360\5\0\0\200\226\230\0\0\0\0\0\0\0\0\0\0\0\0\0\1\0\0\0\5\0\0\0\365@\250\25(\5\0\0\13\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0(\5\0\0\13\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\32\0\0\0MS TCP Loopback interface\0", ) , ) == 0x0
 01301   896   NtClose  (136, ... ) == 0x0
 01302   896   NtCreateEvent  (0x1f0003, 0x0, 0, 0, ... 136, ) == 0x0
 01303   896   NtDeviceIoControlFile  (120, 136, 0x0, 0x0, 0x120003,  (120, 136, 0x0, 0x0, 0x120003, "\0\2\0\0\1\0\0\0\0\2\0\0\0\1\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0", 36, 348, ... {status=0x0, info=158}, "\3\0\1\0\6\0\0\0\334\5\0\0\0\312\232;\6\0\0\0\0\14)\271\233\363n\201\1\0\0\0\5\0\0\0\232A\250\25\260(\243\6\302\205\1\0\331\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\327, ) , 36, 348, ... {status=0x0, info=158},  (120, 136, 0x0, 0x0, 0x120003, "\0\2\0\0\1\0\0\0\0\2\0\0\0\1\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0", 36, 348, ... {status=0x0, info=158}, "\3\0\1\0\6\0\0\0\334\5\0\0\0\312\232;\6\0\0\0\0\14)\271\233\363n\201\1\0\0\0\5\0\0\0\232A\250\25\260(\243\6\302\205\1\0\331\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\327, ) , ) == 0x0
 01304   896   NtClose  (136, ... ) == 0x0
 01305   896   NtCreateEvent  (0x1f0003, 0x0, 0, 0, ... 136, ) == 0x0
 01306   896   NtDeviceIoControlFile  (120, 136, 0x0, 0x0, 0x120003,  (120, 136, 0x0, 0x0, 0x120003, "\0\0\0\0\0\0\0\0\0\1\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0", 36, 32768, ... {status=0x0, info=56}, "\0\4\0\0\0\0\0\0\1\4\0\0\0\0\0\0\1\3\0\0\0\0\0\0\200\3\0\0\0\0\0\0\0\2\0\0\0\0\0\0\200\2\0\0\0\0\0\0\0\2\0\0\1\0\0\0", ) , 36, 32768, ... {status=0x0, info=56},  (120, 136, 0x0, 0x0, 0x120003, "\0\0\0\0\0\0\0\0\0\1\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0", 36, 32768, ... {status=0x0, info=56}, "\0\4\0\0\0\0\0\0\1\4\0\0\0\0\0\0\1\3\0\0\0\0\0\0\200\3\0\0\0\0\0\0\0\2\0\0\0\0\0\0\200\2\0\0\0\0\0\0\0\2\0\0\1\0\0\0", ) , ) == 0x0
 01307   896   NtClose  (136, ... ) == 0x0
 01308   896   NtCreateEvent  (0x1f0003, 0x0, 0, 0, ... 136, ) == 0x0
 01309   896   NtDeviceIoControlFile  (120, 136, 0x0, 0x0, 0x120003,  (120, 136, 0x0, 0x0, 0x120003, "\200\2\0\0\0\0\0\0\0\1\0\0\0\1\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0", 36, 4, ... {status=0x0, info=4}, "\200\2\0\0", ) , 36, 4, ... {status=0x0, info=4},  (120, 136, 0x0, 0x0, 0x120003, "\200\2\0\0\0\0\0\0\0\1\0\0\0\1\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0", 36, 4, ... {status=0x0, info=4}, "\200\2\0\0", ) , ) == 0x0
 01310   896   NtClose  (136, ... ) == 0x0
 01311   896   NtCreateEvent  (0x1f0003, 0x0, 0, 0, ... 136, ) == 0x0
 01312   896   NtDeviceIoControlFile  (120, 136, 0x0, 0x0, 0x120003,  (120, 136, 0x0, 0x0, 0x120003, "\200\2\0\0\0\0\0\0\0\2\0\0\0\1\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0", 36, 8, ... {status=0x0, info=8}, "\1\0\0\0\3\0\1\0", ) , 36, 8, ... {status=0x0, info=8},  (120, 136, 0x0, 0x0, 0x120003, "\200\2\0\0\0\0\0\0\0\2\0\0\0\1\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0", 36, 8, ... {status=0x0, info=8}, "\1\0\0\0\3\0\1\0", ) , ) == 0x0
 01313   896   NtClose  (136, ... ) == 0x0
 01314   896   NtCreateSemaphore  (0x100003, 0x0, 0, 2147483647, ... 136, ) == 0x0
 01315   896   NtCreateSemaphore  (0x100003, 0x0, 0, 2147483647, ... 140, ) == 0x0
 01316   896   NtAllocateVirtualMemory  (-1, 0, 0, 65536, 8192, 4, ... 4128768, 65536, ) == 0x0
 01317   896   NtQueryVirtualMemory  (-1, 0x3f0000, Basic, 28, ... {BaseAddress=0x3f0000,AllocationBase=0x3f0000,AllocationProtect=0x4,RegionSize=0x10000,State=0x2000,Protect=0x0,Type=0x20000,}, 28, ) == 0x0
 01318   896   NtAllocateVirtualMemory  (-1, 4128768, 0, 1, 4096, 4, ... 4128768, 4096, ) == 0x0
 01319   896   NtQueryVirtualMemory  (-1, 0x3f0000, Basic, 28, ... {BaseAddress=0x3f0000,AllocationBase=0x3f0000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 28, ) == 0x0
 01320   896   NtFreeVirtualMemory  (-1, (0x3f0000), 0, 32768, ... (0x3f0000), 65536, ) == 0x0
 01321   896   NtAllocateVirtualMemory  (-1, 0, 0, 65536, 8192, 4, ... 4128768, 65536, ) == 0x0
 01322   896   NtQueryVirtualMemory  (-1, 0x3f0000, Basic, 28, ... {BaseAddress=0x3f0000,AllocationBase=0x3f0000,AllocationProtect=0x4,RegionSize=0x10000,State=0x2000,Protect=0x0,Type=0x20000,}, 28, ) == 0x0
 01323   896   NtAllocateVirtualMemory  (-1, 4128768, 0, 1, 4096, 4, ... 4128768, 4096, ) == 0x0
 01324   896   NtQueryVirtualMemory  (-1, 0x3f0000, Basic, 28, ... {BaseAddress=0x3f0000,AllocationBase=0x3f0000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 28, ) == 0x0
 01325   896   NtFreeVirtualMemory  (-1, (0x3f0000), 0, 32768, ... (0x3f0000), 65536, ) == 0x0
 01326   896   NtAllocateVirtualMemory  (-1, 0, 0, 65536, 8192, 4, ... 4128768, 65536, ) == 0x0
 01327   896   NtQueryVirtualMemory  (-1, 0x3f0000, Basic, 28, ... {BaseAddress=0x3f0000,AllocationBase=0x3f0000,AllocationProtect=0x4,RegionSize=0x10000,State=0x2000,Protect=0x0,Type=0x20000,}, 28, ) == 0x0
 01328   896   NtAllocateVirtualMemory  (-1, 4128768, 0, 1, 4096, 4, ... 4128768, 4096, ) == 0x0
 01329   896   NtQueryVirtualMemory  (-1, 0x3f0000, Basic, 28, ... {BaseAddress=0x3f0000,AllocationBase=0x3f0000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 28, ) == 0x0
 01330   896   NtFreeVirtualMemory  (-1, (0x3f0000), 0, 32768, ... (0x3f0000), 65536, ) == 0x0
 01331   896   NtAllocateVirtualMemory  (-1, 0, 0, 65536, 8192, 4, ... 4128768, 65536, ) == 0x0
 01332   896   NtQueryVirtualMemory  (-1, 0x3f0000, Basic, 28, ... {BaseAddress=0x3f0000,AllocationBase=0x3f0000,AllocationProtect=0x4,RegionSize=0x10000,State=0x2000,Protect=0x0,Type=0x20000,}, 28, ) == 0x0
 01333   896   NtAllocateVirtualMemory  (-1, 4128768, 0, 1, 4096, 4, ... 4128768, 4096, ) == 0x0
 01334   896   NtQueryVirtualMemory  (-1, 0x3f0000, Basic, 28, ... {BaseAddress=0x3f0000,AllocationBase=0x3f0000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 28, ) == 0x0
 01335   896   NtFreeVirtualMemory  (-1, (0x3f0000), 0, 32768, ... (0x3f0000), 65536, ) == 0x0
 01336   896   NtAllocateVirtualMemory  (-1, 0, 0, 65536, 8192, 4, ... 4128768, 65536, ) == 0x0
 01337   896   NtQueryVirtualMemory  (-1, 0x3f0000, Basic, 28, ... {BaseAddress=0x3f0000,AllocationBase=0x3f0000,AllocationProtect=0x4,RegionSize=0x10000,State=0x2000,Protect=0x0,Type=0x20000,}, 28, ) == 0x0
 01338   896   NtAllocateVirtualMemory  (-1, 4128768, 0, 1, 4096, 4, ... 4128768, 4096, ) == 0x0
 01339   896   NtQueryVirtualMemory  (-1, 0x3f0000, Basic, 28, ... {BaseAddress=0x3f0000,AllocationBase=0x3f0000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 28, ) == 0x0
 01340   896   NtFreeVirtualMemory  (-1, (0x3f0000), 0, 32768, ... (0x3f0000), 65536, ) == 0x0
 01341   896   NtAllocateVirtualMemory  (-1, 0, 0, 65536, 8192, 4, ... 4128768, 65536, ) == 0x0
 01342   896   NtQueryVirtualMemory  (-1, 0x3f0000, Basic, 28, ... {BaseAddress=0x3f0000,AllocationBase=0x3f0000,AllocationProtect=0x4,RegionSize=0x10000,State=0x2000,Protect=0x0,Type=0x20000,}, 28, ) == 0x0
 01343   896   NtAllocateVirtualMemory  (-1, 4128768, 0, 1, 4096, 4, ... 4128768, 4096, ) == 0x0
 01344   896   NtQueryVirtualMemory  (-1, 0x3f0000, Basic, 28, ... {BaseAddress=0x3f0000,AllocationBase=0x3f0000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 28, ) == 0x0
 01345   896   NtFreeVirtualMemory  (-1, (0x3f0000), 0, 32768, ... (0x3f0000), 65536, ) == 0x0
 01346   896   NtAllocateVirtualMemory  (-1, 0, 0, 65536, 8192, 4, ... 4128768, 65536, ) == 0x0
 01347   896   NtQueryVirtualMemory  (-1, 0x3f0000, Basic, 28, ... {BaseAddress=0x3f0000,AllocationBase=0x3f0000,AllocationProtect=0x4,RegionSize=0x10000,State=0x2000,Protect=0x0,Type=0x20000,}, 28, ) == 0x0
 01348   896   NtAllocateVirtualMemory  (-1, 4128768, 0, 1, 4096, 4, ... 4128768, 4096, ) == 0x0
 01349   896   NtQueryVirtualMemory  (-1, 0x3f0000, Basic, 28, ... {BaseAddress=0x3f0000,AllocationBase=0x3f0000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 28, ) == 0x0
 01350   896   NtFreeVirtualMemory  (-1, (0x3f0000), 0, 32768, ... (0x3f0000), 65536, ) == 0x0
 01351   896   NtAllocateVirtualMemory  (-1, 0, 0, 65536, 8192, 4, ... 4128768, 65536, ) == 0x0
 01352   896   NtQueryVirtualMemory  (-1, 0x3f0000, Basic, 28, ... {BaseAddress=0x3f0000,AllocationBase=0x3f0000,AllocationProtect=0x4,RegionSize=0x10000,State=0x2000,Protect=0x0,Type=0x20000,}, 28, ) == 0x0
 01353   896   NtAllocateVirtualMemory  (-1, 4128768, 0, 1, 4096, 4, ... 4128768, 4096, ) == 0x0
 01354   896   NtQueryVirtualMemory  (-1, 0x3f0000, Basic, 28, ... {BaseAddress=0x3f0000,AllocationBase=0x3f0000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 28, ) == 0x0
 01355   896   NtFreeVirtualMemory  (-1, (0x3f0000), 0, 32768, ... (0x3f0000), 65536, ) == 0x0
 01356   896   NtAllocateVirtualMemory  (-1, 0, 0, 65536, 8192, 4, ... 4128768, 65536, ) == 0x0
 01357   896   NtQueryVirtualMemory  (-1, 0x3f0000, Basic, 28, ... {BaseAddress=0x3f0000,AllocationBase=0x3f0000,AllocationProtect=0x4,RegionSize=0x10000,State=0x2000,Protect=0x0,Type=0x20000,}, 28, ) == 0x0
 01358   896   NtAllocateVirtualMemory  (-1, 4128768, 0, 1, 4096, 4, ... 4128768, 4096, ) == 0x0
 01359   896   NtQueryVirtualMemory  (-1, 0x3f0000, Basic, 28, ... {BaseAddress=0x3f0000,AllocationBase=0x3f0000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 28, ) == 0x0
 01360   896   NtFreeVirtualMemory  (-1, (0x3f0000), 0, 32768, ... (0x3f0000), 65536, ) == 0x0
 01361   896   NtAllocateVirtualMemory  (-1, 0, 0, 65536, 8192, 4, ... 4128768, 65536, ) == 0x0
 01362   896   NtQueryVirtualMemory  (-1, 0x3f0000, Basic, 28, ... {BaseAddress=0x3f0000,AllocationBase=0x3f0000,AllocationProtect=0x4,RegionSize=0x10000,State=0x2000,Protect=0x0,Type=0x20000,}, 28, ) == 0x0
 01363   896   NtAllocateVirtualMemory  (-1, 4128768, 0, 1, 4096, 4, ... 4128768, 4096, ) == 0x0
 01364   896   NtQueryVirtualMemory  (-1, 0x3f0000, Basic, 28, ... {BaseAddress=0x3f0000,AllocationBase=0x3f0000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 28, ) == 0x0
 01365   896   NtFreeVirtualMemory  (-1, (0x3f0000), 0, 32768, ... (0x3f0000), 65536, ) == 0x0
 01366   896   NtAllocateVirtualMemory  (-1, 0, 0, 65536, 8192, 4, ... 4128768, 65536, ) == 0x0
 01367   896   NtQueryVirtualMemory  (-1, 0x3f0000, Basic, 28, ... {BaseAddress=0x3f0000,AllocationBase=0x3f0000,AllocationProtect=0x4,RegionSize=0x10000,State=0x2000,Protect=0x0,Type=0x20000,}, 28, ) == 0x0
 01368   896   NtAllocateVirtualMemory  (-1, 4128768, 0, 1, 4096, 4, ... 4128768, 4096, ) == 0x0
 01369   896   NtQueryVirtualMemory  (-1, 0x3f0000, Basic, 28, ... {BaseAddress=0x3f0000,AllocationBase=0x3f0000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 28, ) == 0x0
 01370   896   NtFreeVirtualMemory  (-1, (0x3f0000), 0, 32768, ... (0x3f0000), 65536, ) == 0x0
 01371   896   NtAllocateVirtualMemory  (-1, 0, 0, 65536, 8192, 4, ... 4128768, 65536, ) == 0x0
 01372   896   NtQueryVirtualMemory  (-1, 0x3f0000, Basic, 28, ... {BaseAddress=0x3f0000,AllocationBase=0x3f0000,AllocationProtect=0x4,RegionSize=0x10000,State=0x2000,Protect=0x0,Type=0x20000,}, 28, ) == 0x0
 01373   896   NtAllocateVirtualMemory  (-1, 4128768, 0, 1, 4096, 4, ... 4128768, 4096, ) == 0x0
 01374   896   NtQueryVirtualMemory  (-1, 0x3f0000, Basic, 28, ... {BaseAddress=0x3f0000,AllocationBase=0x3f0000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 28, ) == 0x0
 01375   896   NtFreeVirtualMemory  (-1, (0x3f0000), 0, 32768, ... (0x3f0000), 65536, ) == 0x0
 01376   896   NtAllocateVirtualMemory  (-1, 0, 0, 65536, 8192, 4, ... 4128768, 65536, ) == 0x0
 01377   896   NtQueryVirtualMemory  (-1, 0x3f0000, Basic, 28, ... {BaseAddress=0x3f0000,AllocationBase=0x3f0000,AllocationProtect=0x4,RegionSize=0x10000,State=0x2000,Protect=0x0,Type=0x20000,}, 28, ) == 0x0
 01378   896   NtAllocateVirtualMemory  (-1, 4128768, 0, 1, 4096, 4, ... 4128768, 4096, ) == 0x0
 01379   896   NtQueryVirtualMemory  (-1, 0x3f0000, Basic, 28, ... {BaseAddress=0x3f0000,AllocationBase=0x3f0000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 28, ) == 0x0
 01380   896   NtFreeVirtualMemory  (-1, (0x3f0000), 0, 32768, ... (0x3f0000), 65536, ) == 0x0
 01381   896   NtAllocateVirtualMemory  (-1, 0, 0, 65536, 8192, 4, ... 4128768, 65536, ) == 0x0
 01382   896   NtQueryVirtualMemory  (-1, 0x3f0000, Basic, 28, ... {BaseAddress=0x3f0000,AllocationBase=0x3f0000,AllocationProtect=0x4,RegionSize=0x10000,State=0x2000,Protect=0x0,Type=0x20000,}, 28, ) == 0x0
 01383   896   NtAllocateVirtualMemory  (-1, 4128768, 0, 1, 4096, 4, ... 4128768, 4096, ) == 0x0
 01384   896   NtQueryVirtualMemory  (-1, 0x3f0000, Basic, 28, ... {BaseAddress=0x3f0000,AllocationBase=0x3f0000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 28, ) == 0x0
 01385   896   NtFreeVirtualMemory  (-1, (0x3f0000), 0, 32768, ... (0x3f0000), 65536, ) == 0x0
 01386   896   NtAllocateVirtualMemory  (-1, 0, 0, 65536, 8192, 4, ... 4128768, 65536, ) == 0x0
 01387   896   NtQueryVirtualMemory  (-1, 0x3f0000, Basic, 28, ... {BaseAddress=0x3f0000,AllocationBase=0x3f0000,AllocationProtect=0x4,RegionSize=0x10000,State=0x2000,Protect=0x0,Type=0x20000,}, 28, ) == 0x0
 01388   896   NtAllocateVirtualMemory  (-1, 4128768, 0, 1, 4096, 4, ... 4128768, 4096, ) == 0x0
 01389   896   NtQueryVirtualMemory  (-1, 0x3f0000, Basic, 28, ... {BaseAddress=0x3f0000,AllocationBase=0x3f0000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 28, ) == 0x0
 01390   896   NtFreeVirtualMemory  (-1, (0x3f0000), 0, 32768, ... (0x3f0000), 65536, ) == 0x0
 01391   896   NtAllocateVirtualMemory  (-1, 0, 0, 65536, 8192, 4, ... 4128768, 65536, ) == 0x0
 01392   896   NtQueryVirtualMemory  (-1, 0x3f0000, Basic, 28, ... {BaseAddress=0x3f0000,AllocationBase=0x3f0000,AllocationProtect=0x4,RegionSize=0x10000,State=0x2000,Protect=0x0,Type=0x20000,}, 28, ) == 0x0
 01393   896   NtAllocateVirtualMemory  (-1, 4128768, 0, 1, 4096, 4, ... 4128768, 4096, ) == 0x0
 01394   896   NtQueryVirtualMemory  (-1, 0x3f0000, Basic, 28, ... {BaseAddress=0x3f0000,AllocationBase=0x3f0000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 28, ) == 0x0
 01395   896   NtFreeVirtualMemory  (-1, (0x3f0000), 0, 32768, ... (0x3f0000), 65536, ) == 0x0
 01396   896   NtAllocateVirtualMemory  (-1, 0, 0, 65536, 8192, 4, ... 4128768, 65536, ) == 0x0
 01397   896   NtQueryVirtualMemory  (-1, 0x3f0000, Basic, 28, ... {BaseAddress=0x3f0000,AllocationBase=0x3f0000,AllocationProtect=0x4,RegionSize=0x10000,State=0x2000,Protect=0x0,Type=0x20000,}, 28, ) == 0x0
 01398   896   NtAllocateVirtualMemory  (-1, 4128768, 0, 1, 4096, 4, ... 4128768, 4096, ) == 0x0
 01399   896   NtQueryVirtualMemory  (-1, 0x3f0000, Basic, 28, ... {BaseAddress=0x3f0000,AllocationBase=0x3f0000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 28, ) == 0x0
 01400   896   NtFreeVirtualMemory  (-1, (0x3f0000), 0, 32768, ... (0x3f0000), 65536, ) == 0x0
 01401   896   NtAllocateVirtualMemory  (-1, 0, 0, 65536, 8192, 4, ... 4128768, 65536, ) == 0x0
 01402   896   NtQueryVirtualMemory  (-1, 0x3f0000, Basic, 28, ... {BaseAddress=0x3f0000,AllocationBase=0x3f0000,AllocationProtect=0x4,RegionSize=0x10000,State=0x2000,Protect=0x0,Type=0x20000,}, 28, ) == 0x0
 01403   896   NtAllocateVirtualMemory  (-1, 4128768, 0, 1, 4096, 4, ... 4128768, 4096, ) == 0x0
 01404   896   NtQueryVirtualMemory  (-1, 0x3f0000, Basic, 28, ... {BaseAddress=0x3f0000,AllocationBase=0x3f0000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 28, ) == 0x0
 01405   896   NtFreeVirtualMemory  (-1, (0x3f0000), 0, 32768, ... (0x3f0000), 65536, ) == 0x0
 01406   896   NtAllocateVirtualMemory  (-1, 0, 0, 65536, 8192, 4, ... 4128768, 65536, ) == 0x0
 01407   896   NtQueryVirtualMemory  (-1, 0x3f0000, Basic, 28, ... {BaseAddress=0x3f0000,AllocationBase=0x3f0000,AllocationProtect=0x4,RegionSize=0x10000,State=0x2000,Protect=0x0,Type=0x20000,}, 28, ) == 0x0
 01408   896   NtAllocateVirtualMemory  (-1, 4128768, 0, 1, 4096, 4, ... 4128768, 4096, ) == 0x0
 01409   896   NtQueryVirtualMemory  (-1, 0x3f0000, Basic, 28, ... {BaseAddress=0x3f0000,AllocationBase=0x3f0000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 28, ) == 0x0
 01410   896   NtFreeVirtualMemory  (-1, (0x3f0000), 0, 32768, ... (0x3f0000), 65536, ) == 0x0
 01411   896   NtAllocateVirtualMemory  (-1, 0, 0, 65536, 8192, 4, ... 4128768, 65536, ) == 0x0
 01412   896   NtQueryVirtualMemory  (-1, 0x3f0000, Basic, 28, ... {BaseAddress=0x3f0000,AllocationBase=0x3f0000,AllocationProtect=0x4,RegionSize=0x10000,State=0x2000,Protect=0x0,Type=0x20000,}, 28, ) == 0x0
 01413   896   NtAllocateVirtualMemory  (-1, 4128768, 0, 1, 4096, 4, ... 4128768, 4096, ) == 0x0
 01414   896   NtQueryVirtualMemory  (-1, 0x3f0000, Basic, 28, ... {BaseAddress=0x3f0000,AllocationBase=0x3f0000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 28, ) == 0x0
 01415   896   NtFreeVirtualMemory  (-1, (0x3f0000), 0, 32768, ... (0x3f0000), 65536, ) == 0x0
 01416   896   NtAllocateVirtualMemory  (-1, 0, 0, 65536, 8192, 4, ... 4128768, 65536, ) == 0x0
 01417   896   NtQueryVirtualMemory  (-1, 0x3f0000, Basic, 28, ... {BaseAddress=0x3f0000,AllocationBase=0x3f0000,AllocationProtect=0x4,RegionSize=0x10000,State=0x2000,Protect=0x0,Type=0x20000,}, 28, ) == 0x0
 01418   896   NtAllocateVirtualMemory  (-1, 4128768, 0, 1, 4096, 4, ... 4128768, 4096, ) == 0x0
 01419   896   NtQueryVirtualMemory  (-1, 0x3f0000, Basic, 28, ... {BaseAddress=0x3f0000,AllocationBase=0x3f0000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 28, ) == 0x0
 01420   896   NtFreeVirtualMemory  (-1, (0x3f0000), 0, 32768, ... (0x3f0000), 65536, ) == 0x0
 01421   896   NtAllocateVirtualMemory  (-1, 0, 0, 65536, 8192, 4, ... 4128768, 65536, ) == 0x0
 01422   896   NtQueryVirtualMemory  (-1, 0x3f0000, Basic, 28, ... {BaseAddress=0x3f0000,AllocationBase=0x3f0000,AllocationProtect=0x4,RegionSize=0x10000,State=0x2000,Protect=0x0,Type=0x20000,}, 28, ) == 0x0
 01423   896   NtAllocateVirtualMemory  (-1, 4128768, 0, 1, 4096, 4, ... 4128768, 4096, ) == 0x0
 01424   896   NtQueryVirtualMemory  (-1, 0x3f0000, Basic, 28, ... {BaseAddress=0x3f0000,AllocationBase=0x3f0000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 28, ) == 0x0
 01425   896   NtFreeVirtualMemory  (-1, (0x3f0000), 0, 32768, ... (0x3f0000), 65536, ) == 0x0
 01426   896   NtAllocateVirtualMemory  (-1, 0, 0, 65536, 8192, 4, ... 4128768, 65536, ) == 0x0
 01427   896   NtQueryVirtualMemory  (-1, 0x3f0000, Basic, 28, ... {BaseAddress=0x3f0000,AllocationBase=0x3f0000,AllocationProtect=0x4,RegionSize=0x10000,State=0x2000,Protect=0x0,Type=0x20000,}, 28, ) == 0x0
 01428   896   NtAllocateVirtualMemory  (-1, 4128768, 0, 1, 4096, 4, ... 4128768, 4096, ) == 0x0
 01429   896   NtQueryVirtualMemory  (-1, 0x3f0000, Basic, 28, ... {BaseAddress=0x3f0000,AllocationBase=0x3f0000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 28, ) == 0x0
 01430   896   NtFreeVirtualMemory  (-1, (0x3f0000), 0, 32768, ... (0x3f0000), 65536, ) == 0x0
 01431   896   NtAllocateVirtualMemory  (-1, 0, 0, 65536, 8192, 4, ... 4128768, 65536, ) == 0x0
 01432   896   NtQueryVirtualMemory  (-1, 0x3f0000, Basic, 28, ... {BaseAddress=0x3f0000,AllocationBase=0x3f0000,AllocationProtect=0x4,RegionSize=0x10000,State=0x2000,Protect=0x0,Type=0x20000,}, 28, ) == 0x0
 01433   896   NtAllocateVirtualMemory  (-1, 4128768, 0, 1, 4096, 4, ... 4128768, 4096, ) == 0x0
 01434   896   NtQueryVirtualMemory  (-1, 0x3f0000, Basic, 28, ... {BaseAddress=0x3f0000,AllocationBase=0x3f0000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 28, ) == 0x0
 01435   896   NtFreeVirtualMemory  (-1, (0x3f0000), 0, 32768, ... (0x3f0000), 65536, ) == 0x0
 01436   896   NtAllocateVirtualMemory  (-1, 0, 0, 65536, 8192, 4, ... 4128768, 65536, ) == 0x0
 01437   896   NtQueryVirtualMemory  (-1, 0x3f0000, Basic, 28, ... {BaseAddress=0x3f0000,AllocationBase=0x3f0000,AllocationProtect=0x4,RegionSize=0x10000,State=0x2000,Protect=0x0,Type=0x20000,}, 28, ) == 0x0
 01438   896   NtAllocateVirtualMemory  (-1, 4128768, 0, 1, 4096, 4, ... 4128768, 4096, ) == 0x0
 01439   896   NtQueryVirtualMemory  (-1, 0x3f0000, Basic, 28, ... {BaseAddress=0x3f0000,AllocationBase=0x3f0000,AllocationProtect=0x4,RegionSize=0x1000,State=0x1000,Protect=0x4,Type=0x20000,}, 28, ) == 0x0
 01440   896   NtFreeVirtualMemory  (-1, (0x3f0000), 0, 32768, ... (0x3f0000), 65536, ) == 0x0
 01441   896   NtOpenKey  (0x20019, {24, 52, 0x40, 0, 0,  (0x20019, {24, 52, 0x40, 0, 0, "SYSTEM\CurrentControlSet\Services\Tcpip\Linkage"}, ... 144, ) }, ... 144, ) == 0x0
 01442   896   NtOpenKey  (0x20019, {24, 52, 0x40, 0, 0,  (0x20019, {24, 52, 0x40, 0, 0, "SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\"}, ... 148, ) }, ... 148, ) == 0x0
 01443   896   NtOpenKey  (0x20019, {24, 52, 0x40, 0, 0,  (0x20019, {24, 52, 0x40, 0, 0, "SYSTEM\CurrentControlSet\Services\NetBT\Parameters\Interfaces"}, ... 152, ) }, ... 152, ) == 0x0
 01444   896   NtOpenKey  (0x20019, {24, 52, 0x40, 0, 0,  (0x20019, {24, 52, 0x40, 0, 0, "SYSTEM\CurrentControlSet\Services\NetBT\Parameters"}, ... 156, ) }, ... 156, ) == 0x0
 01445   896   NtQueryDefaultLocale  (1, 2291392, ... ) == 0x0
 01446   896   NtSetEventBoostPriority  (32, ...
 01258  2016   NtWaitForSingleObject  ... ) == 0x0
 01447  2016   NtOpenSection  (0xe, {24, 8, 0x40, 0, 0,  (0xe, {24, 8, 0x40, 0, 0, "oleaut32.dll"}, ... 160, ) }, ... 160, ) == 0x0
 01448  2016   NtMapViewOfSection  (160, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x77120000), 0x0, 569344, ) == 0x0
 01449  2016   NtClose  (160, ... ) == 0x0
 01450  2016   NtProtectVirtualMemory  (-1, (0x77121000), 1272, 4, ... (0x77121000), 4096, 32, ) == 0x0
 01451  2016   NtProtectVirtualMemory  (-1, (0x77121000), 4096, 32, ...
 01446   896   NtSetEventBoostPriority  ... ) == 0x0
 01452   896   NtWaitForSingleObject  (32, 0, 0x0, ...
 01451  2016   NtProtectVirtualMemory  ... (0x77121000), 4096, 4, ) == 0x0
 01453  2016   NtFlushInstructionCache  (-1, 1997672448, 1272, ... ) == 0x0
 01454  2016   NtProtectVirtualMemory  (-1, (0x77121000), 1272, 4, ... (0x77121000), 4096, 32, ) == 0x0
 01455  2016   NtProtectVirtualMemory  (-1, (0x77121000), 4096, 32, ... (0x77121000), 4096, 4, ) == 0x0
 01456  2016   NtFlushInstructionCache  (-1, 1997672448, 1272, ... ) == 0x0
 01457  2016   NtProtectVirtualMemory  (-1, (0x77121000), 1272, 4, ... (0x77121000), 4096, 32, ) == 0x0
 01458  2016   NtProtectVirtualMemory  (-1, (0x77121000), 4096, 32, ... (0x77121000), 4096, 4, ) == 0x0
 01459  2016   NtFlushInstructionCache  (-1, 1997672448, 1272, ... ) == 0x0
 01460  2016   NtProtectVirtualMemory  (-1, (0x77121000), 1272, 4, ... (0x77121000), 4096, 32, ) == 0x0
 01461  2016   NtProtectVirtualMemory  (-1, (0x77121000), 4096, 32, ... (0x77121000), 4096, 4, ) == 0x0
 01462  2016   NtFlushInstructionCache  (-1, 1997672448, 1272, ... ) == 0x0
 01463  2016   NtProtectVirtualMemory  (-1, (0x77121000), 1272, 4, ... (0x77121000), 4096, 32, ) == 0x0
 01464  2016   NtProtectVirtualMemory  (-1, (0x77121000), 4096, 32, ... (0x77121000), 4096, 4, ) == 0x0
 01465  2016   NtFlushInstructionCache  (-1, 1997672448, 1272, ... ) == 0x0
 01466  2016   NtProtectVirtualMemory  (-1, (0x77121000), 1272, 4, ... (0x77121000), 4096, 32, ) == 0x0
 01467  2016   NtProtectVirtualMemory  (-1, (0x77121000), 4096, 32, ... (0x77121000), 4096, 4, ) == 0x0
 01468  2016   NtFlushInstructionCache  (-1, 1997672448, 1272, ... ) == 0x0
 01469  2016   NtProtectVirtualMemory  (-1, (0x77121000), 1272, 4, ... (0x77121000), 4096, 32, ) == 0x0
 01470  2016   NtProtectVirtualMemory  (-1, (0x77121000), 4096, 32, ... (0x77121000), 4096, 4, ) == 0x0
 01471  2016   NtFlushInstructionCache  (-1, 1997672448, 1272, ... ) == 0x0
 01472  2016   NtOpenKey  (0x80000000, {24, 0, 0x40, 0, 0,  (0x80000000, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\oleaut32.dll"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01473  2016   NtUserRegisterWindowMessage  ( ("{FB8F0821-0164-101B-84ED-08002B2EC713}", ... ) , ... ) == 0xc077
 01474  2016   NtOpenKey  (0x1, {24, 52, 0x40, 0, 0,  (0x1, {24, 52, 0x40, 0, 0, "SOFTWARE\Microsoft\OLEAUT"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01475  2016   NtOpenKey  (0x9, {24, 52, 0x40, 0, 0,  (0x9, {24, 52, 0x40, 0, 0, "SOFTWARE\Microsoft\OLEAUT\UserEra"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01476  2016   NtOpenKey  (0x1, {24, 52, 0x40, 0, 0,  (0x1, {24, 52, 0x40, 0, 0, "SOFTWARE\Microsoft\OLEAUT"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01477  2016   NtSetEventBoostPriority  (32, ...
 01452   896   NtWaitForSingleObject  ... ) == 0x0
 01478   896   NtFreeVirtualMemory  (-1, (0x370000), 0, 32768, ... (0x370000), 28672, ) == 0x0
 01479   896   NtFreeVirtualMemory  (-1, (0x320147), 0, 32768, ... (0x320000), 4096, ) == 0x0
 01480   896   NtQuerySystemInformation  (Basic, 44, ... {Unknown=0,MaximumIncrement=156250,PhysicalPageSize=0x1000,NumberOfPhysicalPages=0xff7c,LowestPhysicalPage=0x1,HighestPhysicalPage=0xffff,AllocationGranularity=0x10000,LowestUserAddress=0x10000,HighestUserAddress=0x7ffeffff,ActiveProcessors=1,NumberProcessors=1,}, 0x0, ) == 0x0
 01481   896   NtAllocateVirtualMemory  (-1, 0, 0, 65536, 8192, 4, ... 3276800, 65536, ) == 0x0
 01477  2016   NtSetEventBoostPriority  ... ) == 0x0
 01482  2016   NtOpenSection  (0xe, {24, 8, 0x40, 0, 0,  (0xe, {24, 8, 0x40, 0, 0, "sfc_os.dll"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01483  2016   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\u:\work\sfc_os.dll"}, 9827864, ... }, 9827864, ...
 01484   896   NtAllocateVirtualMemory  (-1, 3276800, 0, 4096, 4096, 4, ... 3276800, 4096, ) == 0x0
 01485   896   NtAllocateVirtualMemory  (-1, 3280896, 0, 20480, 4096, 4, ... 3280896, 20480, ) == 0x0
 01486   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ... 18087936, 1048576, ) == 0x0
 01487   896   NtAllocateVirtualMemory  (-1, 18087936, 0, 32768, 4096, 4, ... 18087936, 32768, ) == 0x0
 01488   896   NtWaitForSingleObject  (32, 0, 0x0, ...
 01483  2016   NtQueryAttributesFile  ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01489  2016   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\sfc_os.dll"}, 9827864, ... ) }, 9827864, ... ) == 0x0
 01490  2016   NtOpenFile  (0x100020, {24, 0, 0x40, 0, 0,  (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\sfc_os.dll"}, 5, 96, ... 160, {status=0x0, info=1}, ) }, 5, 96, ... 160, {status=0x0, info=1}, ) == 0x0
 01491  2016   NtCreateSection  (0xf, 0x0, 0x0, 16, 16777216, 160, ... 164, ) == 0x0
 01492  2016   NtQuerySection  (164, Image, 48, ... {section info, class 1, size 48}, 0x0, ) == 0x0
 01493  2016   NtClose  (160, ... ) == 0x0
 01494  2016   NtMapViewOfSection  (164, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x76c60000), 0x0, 172032, ) == 0x0
 01495  2016   NtClose  (164, ... ) == 0x0
 01496  2016   NtProtectVirtualMemory  (-1, (0x76c61000), 816, 4, ... (0x76c61000), 4096, 32, ) == 0x0
 01497  2016   NtProtectVirtualMemory  (-1, (0x76c61000), 4096, 32, ... (0x76c61000), 4096, 4, ) == 0x0
 01498  2016   NtFlushInstructionCache  (-1, 1992691712, 816, ... ) == 0x0
 01499  2016   NtProtectVirtualMemory  (-1, (0x76c61000), 816, 4, ... (0x76c61000), 4096, 32, ) == 0x0
 01500  2016   NtProtectVirtualMemory  (-1, (0x76c61000), 4096, 32, ... (0x76c61000), 4096, 4, ) == 0x0
 01501  2016   NtFlushInstructionCache  (-1, 1992691712, 816, ... ) == 0x0
 01502  2016   NtProtectVirtualMemory  (-1, (0x76c61000), 816, 4, ... (0x76c61000), 4096, 32, ) == 0x0
 01503  2016   NtProtectVirtualMemory  (-1, (0x76c61000), 4096, 32, ... (0x76c61000), 4096, 4, ) == 0x0
 01504  2016   NtFlushInstructionCache  (-1, 1992691712, 816, ... ) == 0x0
 01505  2016   NtOpenSection  (0xe, {24, 8, 0x40, 0, 0,  (0xe, {24, 8, 0x40, 0, 0, "WINTRUST.dll"}, ... 164, ) }, ... 164, ) == 0x0
 01506  2016   NtMapViewOfSection  (164, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x76c30000), 0x0, 188416, ) == 0x0
 01507  2016   NtClose  (164, ... ) == 0x0
 01508  2016   NtProtectVirtualMemory  (-1, (0x76c31000), 1204, 4, ... (0x76c31000), 4096, 32, ) == 0x0
 01509  2016   NtProtectVirtualMemory  (-1, (0x76c31000), 4096, 32, ... (0x76c31000), 4096, 4, ) == 0x0
 01510  2016   NtFlushInstructionCache  (-1, 1992495104, 1204, ... ) == 0x0
 01511  2016   NtOpenSection  (0xe, {24, 8, 0x40, 0, 0,  (0xe, {24, 8, 0x40, 0, 0, "CRYPT32.dll"}, ... 164, ) }, ... 164, ) == 0x0
 01512  2016   NtMapViewOfSection  (164, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x77a80000), 0x0, 606208, ) == 0x0
 01513  2016   NtClose  (164, ... ) == 0x0
 01514  2016   NtProtectVirtualMemory  (-1, (0x77a81000), 1340, 4, ... (0x77a81000), 4096, 32, ) == 0x0
 01515  2016   NtProtectVirtualMemory  (-1, (0x77a81000), 4096, 32, ... (0x77a81000), 4096, 4, ) == 0x0
 01516  2016   NtFlushInstructionCache  (-1, 2007502848, 1340, ... ) == 0x0
 01517  2016   NtProtectVirtualMemory  (-1, (0x77a81000), 1340, 4, ... (0x77a81000), 4096, 32, ) == 0x0
 01518  2016   NtProtectVirtualMemory  (-1, (0x77a81000), 4096, 32, ... (0x77a81000), 4096, 4, ) == 0x0
 01519  2016   NtFlushInstructionCache  (-1, 2007502848, 1340, ... ) == 0x0
 01520  2016   NtProtectVirtualMemory  (-1, (0x77a81000), 1340, 4, ... (0x77a81000), 4096, 32, ) == 0x0
 01521  2016   NtProtectVirtualMemory  (-1, (0x77a81000), 4096, 32, ... (0x77a81000), 4096, 4, ) == 0x0
 01522  2016   NtFlushInstructionCache  (-1, 2007502848, 1340, ... ) == 0x0
 01523  2016   NtOpenSection  (0xe, {24, 8, 0x40, 0, 0,  (0xe, {24, 8, 0x40, 0, 0, "MSASN1.dll"}, ... 164, ) }, ... 164, ) == 0x0
 01524  2016   NtMapViewOfSection  (164, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x77b20000), 0x0, 73728, ) == 0x0
 01525  2016   NtClose  (164, ... ) == 0x0
 01526  2016   NtProtectVirtualMemory  (-1, (0x77b21000), 160, 4, ... (0x77b21000), 4096, 32, ) == 0x0
 01527  2016   NtProtectVirtualMemory  (-1, (0x77b21000), 4096, 32, ... (0x77b21000), 4096, 4, ) == 0x0
 01528  2016   NtFlushInstructionCache  (-1, 2008158208, 160, ... ) == 0x0
 01529  2016   NtProtectVirtualMemory  (-1, (0x77b21000), 160, 4, ... (0x77b21000), 4096, 32, ) == 0x0
 01530  2016   NtProtectVirtualMemory  (-1, (0x77b21000), 4096, 32, ... (0x77b21000), 4096, 4, ) == 0x0
 01531  2016   NtFlushInstructionCache  (-1, 2008158208, 160, ... ) == 0x0
 01532  2016   NtProtectVirtualMemory  (-1, (0x77b21000), 160, 4, ... (0x77b21000), 4096, 32, ) == 0x0
 01533  2016   NtProtectVirtualMemory  (-1, (0x77b21000), 4096, 32, ... (0x77b21000), 4096, 4, ) == 0x0
 01534  2016   NtFlushInstructionCache  (-1, 2008158208, 160, ... ) == 0x0
 01535  2016   NtProtectVirtualMemory  (-1, (0x77a81000), 1340, 4, ... (0x77a81000), 4096, 32, ) == 0x0
 01536  2016   NtProtectVirtualMemory  (-1, (0x77a81000), 4096, 32, ... (0x77a81000), 4096, 4, ) == 0x0
 01537  2016   NtFlushInstructionCache  (-1, 2007502848, 1340, ... ) == 0x0
 01538  2016   NtProtectVirtualMemory  (-1, (0x76c31000), 1204, 4, ... (0x76c31000), 4096, 32, ) == 0x0
 01539  2016   NtProtectVirtualMemory  (-1, (0x76c31000), 4096, 32, ... (0x76c31000), 4096, 4, ) == 0x0
 01540  2016   NtFlushInstructionCache  (-1, 1992495104, 1204, ... ) == 0x0
 01541  2016   NtProtectVirtualMemory  (-1, (0x76c31000), 1204, 4, ... (0x76c31000), 4096, 32, ) == 0x0
 01542  2016   NtProtectVirtualMemory  (-1, (0x76c31000), 4096, 32, ... (0x76c31000), 4096, 4, ) == 0x0
 01543  2016   NtFlushInstructionCache  (-1, 1992495104, 1204, ... ) == 0x0
 01544  2016   NtOpenSection  (0xe, {24, 8, 0x40, 0, 0,  (0xe, {24, 8, 0x40, 0, 0, "IMAGEHLP.dll"}, ... 164, ) }, ... 164, ) == 0x0
 01545  2016   NtMapViewOfSection  (164, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x76c90000), 0x0, 163840, ) == 0x0
 01546  2016   NtClose  (164, ... ) == 0x0
 01547  2016   NtProtectVirtualMemory  (-1, (0x76c91000), 504, 4, ... (0x76c91000), 4096, 32, ) == 0x0
 01548  2016   NtProtectVirtualMemory  (-1, (0x76c91000), 4096, 32, ... (0x76c91000), 4096, 4, ) == 0x0
 01549  2016   NtFlushInstructionCache  (-1, 1992888320, 504, ... ) == 0x0
 01550  2016   NtProtectVirtualMemory  (-1, (0x76c91000), 504, 4, ... (0x76c91000), 4096, 32, ) == 0x0
 01551  2016   NtProtectVirtualMemory  (-1, (0x76c91000), 4096, 32, ... (0x76c91000), 4096, 4, ) == 0x0
 01552  2016   NtFlushInstructionCache  (-1, 1992888320, 504, ... ) == 0x0
 01553  2016   NtProtectVirtualMemory  (-1, (0x76c31000), 1204, 4, ... (0x76c31000), 4096, 32, ) == 0x0
 01554  2016   NtProtectVirtualMemory  (-1, (0x76c31000), 4096, 32, ... (0x76c31000), 4096, 4, ) == 0x0
 01555  2016   NtFlushInstructionCache  (-1, 1992495104, 1204, ... ) == 0x0
 01556  2016   NtProtectVirtualMemory  (-1, (0x76c61000), 816, 4, ... (0x76c61000), 4096, 32, ) == 0x0
 01557  2016   NtProtectVirtualMemory  (-1, (0x76c61000), 4096, 32, ... (0x76c61000), 4096, 4, ) == 0x0
 01558  2016   NtFlushInstructionCache  (-1, 1992691712, 816, ... ) == 0x0
 01559  2016   NtOpenKey  (0x80000000, {24, 0, 0x40, 0, 0,  (0x80000000, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MSASN1.dll"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01560  2016   NtQueryPerformanceCounter  (... {-1439006286, 16}, {3579545, 0}, ) == 0x0
 01561  2016   NtOpenKey  (0x80000000, {24, 0, 0x40, 0, 0,  (0x80000000, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\CRYPT32.dll"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01562  2016   NtOpenKey  (0x20019, {24, 52, 0x40, 0, 0,  (0x20019, {24, 52, 0x40, 0, 0, "SYSTEM\CurrentControlSet\Services\crypt32\Performance"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01563  2016   NtAllocateVirtualMemory  (-1, 5689344, 0, 4096, 4096, 4, ... 5689344, 4096, ) == 0x0
 01564  2016   NtAllocateVirtualMemory  (-1, 5693440, 0, 4096, 4096, 4, ... 5693440, 4096, ) == 0x0
 01565  2016   NtOpenKey  (0x20019, {24, 52, 0x40, 0, 0,  (0x20019, {24, 52, 0x40, 0, 0, "SOFTWARE\Microsoft\Windows NT\CurrentVersion\msasn1"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01566  2016   NtAllocateVirtualMemory  (-1, 5697536, 0, 4096, 4096, 4, ... 5697536, 4096, ) == 0x0
 01567  2016   NtCreateEvent  (0x1f0003, {24, 28, 0x80, 9827988, 0,  (0x1f0003, {24, 28, 0x80, 9827988, 0, "Global\crypt32LogoffEvent"}, 0, 0, ... ) }, 0, 0, ... ) == STATUS_ACCESS_DENIED
 01568  2016   NtOpenEvent  (0x100000, {24, 28, 0x0, 0, 0,  (0x100000, {24, 28, 0x0, 0, 0, "Global\crypt32LogoffEvent"}, ... 164, ) }, ... 164, ) == 0x0
 01569  2016   NtOpenKey  (0x80000000, {24, 0, 0x40, 0, 0,  (0x80000000, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\IMAGEHLP.dll"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01570  2016   NtQuerySystemInformation  (Basic, 44, ... {Unknown=0,MaximumIncrement=156250,PhysicalPageSize=0x1000,NumberOfPhysicalPages=0xff7c,LowestPhysicalPage=0x1,HighestPhysicalPage=0xffff,AllocationGranularity=0x10000,LowestUserAddress=0x10000,HighestUserAddress=0x7ffeffff,ActiveProcessors=1,NumberProcessors=1,}, 0x0, ) == 0x0
 01571  2016   NtQuerySystemInformation  (Processor, 12, ... {system info, class 1, size 12}, 0x0, ) == 0x0
 01572  2016   NtQuerySystemInformation  (Basic, 44, ... {Unknown=0,MaximumIncrement=156250,PhysicalPageSize=0x1000,NumberOfPhysicalPages=0xff7c,LowestPhysicalPage=0x1,HighestPhysicalPage=0xffff,AllocationGranularity=0x10000,LowestUserAddress=0x10000,HighestUserAddress=0x7ffeffff,ActiveProcessors=1,NumberProcessors=1,}, 0x0, ) == 0x0
 01573  2016   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ... 19136512, 1048576, ) == 0x0
 01574  2016   NtAllocateVirtualMemory  (-1, 19136512, 0, 1048576, 4096, 4, ... 19136512, 1048576, ) == 0x0
 01575  2016   NtOpenKey  (0x80000000, {24, 0, 0x40, 0, 0,  (0x80000000, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\WINTRUST.dll"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01576  2016   NtCreateMutant  (0x1f0001, 0x0, 0, ... 160, ) == 0x0
 01577  2016   NtCreateEvent  (0x1f0003, 0x0, 0, 1, ... 168, ) == 0x0
 01578  2016   NtCreateMutant  (0x1f0001, 0x0, 0, ... 172, ) == 0x0
 01579  2016   NtCreateEvent  (0x1f0003, 0x0, 0, 1, ... 176, ) == 0x0
 01580  2016   NtCreateEvent  (0x1f0003, 0x0, 0, 1, ... 180, ) == 0x0
 01581  2016   NtSetEvent  (180, ... 0x0, ) == 0x0
 01582  2016   NtOpenKey  (0x80000000, {24, 0, 0x40, 0, 0,  (0x80000000, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sfc_os.dll"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01583  2016   NtSetEventBoostPriority  (32, ...
 01488   896   NtWaitForSingleObject  ... ) == 0x0
 01584   896   NtOpenKey  (0x2000000, {24, 52, 0x40, 0, 0,  (0x2000000, {24, 52, 0x40, 0, 0, "System\CurrentControlSet\Services\WinSock2\Parameters"}, ... 184, ) }, ... 184, ) == 0x0
 01585   896   NtQueryValueKey  (184,  (184, "WinSock_Registry_Version", Partial, 144, ... TitleIdx=0, Type=1, Data="2\0.\00\0\0\0"}, 20, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (184, "WinSock_Registry_Version", Partial, 144, ... TitleIdx=0, Type=1, Data="2\0.\00\0\0\0"}, 20, ) }, 20, ) == 0x0
 01586   896   NtAllocateVirtualMemory  (-1, 5701632, 0, 4096, 4096, 4, ... 5701632, 4096, ) == 0x0
 01587   896   NtQueryValueKey  (184,  (184, "WinSock_Registry_Version", Partial, 144, ... TitleIdx=0, Type=1, Data="2\0.\00\0\0\0"}, 20, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (184, "WinSock_Registry_Version", Partial, 144, ... TitleIdx=0, Type=1, Data="2\0.\00\0\0\0"}, 20, ) }, 20, ) == 0x0
 01583  2016   NtSetEventBoostPriority  ... ) == 0x0
 01588  2016   NtOpenSection  (0xe, {24, 8, 0x40, 0, 0,  (0xe, {24, 8, 0x40, 0, 0, "sfc.dll"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01589  2016   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\u:\work\sfc.dll"}, 9827864, ... }, 9827864, ...
 01590   896   NtCreateEvent  (0x1f0003, 0x0, 0, 0, ... 188, ) == 0x0
 01591   896   NtOpenKey  (0x2000000, {24, 184, 0x40, 0, 0,  (0x2000000, {24, 184, 0x40, 0, 0, "Protocol_Catalog9"}, ... 192, ) }, ... 192, ) == 0x0
 01592   896   NtQueryValueKey  (192,  (192, "Serial_Access_Num", Partial, 144, ... TitleIdx=0, Type=4, Data="\15\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (192, "Serial_Access_Num", Partial, 144, ... TitleIdx=0, Type=4, Data="\15\0\0\0"}, 16, ) }, 16, ) == 0x0
 01593   896   NtNotifyChangeKey  (192, 188, 0, 0, 2011455960, 1, 0, 0, 0, 1, ... ) == 0x103
 01594   896   NtQueryValueKey  (192,  (192, "Serial_Access_Num", Partial, 144, ... TitleIdx=0, Type=4, Data="\15\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (192, "Serial_Access_Num", Partial, 144, ... TitleIdx=0, Type=4, Data="\15\0\0\0"}, 16, ) }, 16, ) == 0x0
 01595   896   NtOpenKey  (0x2000000, {24, 192, 0x40, 0, 0,  (0x2000000, {24, 192, 0x40, 0, 0, "0000000D"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01596   896   NtQueryValueKey  (192,  (192, "Next_Catalog_Entry_ID", Partial, 144, ... TitleIdx=0, Type=4, Data="#\4\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (192, "Next_Catalog_Entry_ID", Partial, 144, ... TitleIdx=0, Type=4, Data="#\4\0\0"}, 16, ) }, 16, ) == 0x0
 01597   896   NtQueryValueKey  (192,  (192, "Num_Catalog_Entries", Partial, 144, ... TitleIdx=0, Type=4, Data="\26\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (192, "Num_Catalog_Entries", Partial, 144, ... TitleIdx=0, Type=4, Data="\26\0\0\0"}, 16, ) }, 16, ) == 0x0
 01598   896   NtOpenKey  (0x2000000, {24, 192, 0x40, 0, 0,  (0x2000000, {24, 192, 0x40, 0, 0, "Catalog_Entries"}, ... 196, ) }, ... 196, ) == 0x0
 01599   896   NtOpenKey  (0x20019, {24, 196, 0x40, 0, 0,  (0x20019, {24, 196, 0x40, 0, 0, "000000000001"}, ... 200, ) }, ... 200, ) == 0x0
 01600   896   NtQueryValueKey  (200,  (200, "PackedCatalogItem", Partial, 144, ... , Partial, 144, ...
 01589  2016   NtQueryAttributesFile  ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01601  2016   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\sfc.dll"}, 9827864, ... ) }, 9827864, ... ) == 0x0
 01602  2016   NtOpenFile  (0x100020, {24, 0, 0x40, 0, 0,  (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\sfc.dll"}, 5, 96, ... 204, {status=0x0, info=1}, ) }, 5, 96, ... 204, {status=0x0, info=1}, ) == 0x0
 01603  2016   NtCreateSection  (0xf, 0x0, 0x0, 16, 16777216, 204, ... 208, ) == 0x0
 01604  2016   NtQuerySection  (208, Image, 48, ...
 01600   896   NtQueryValueKey  ... ) == STATUS_BUFFER_OVERFLOW
 01605   896   NtQueryValueKey  (200,  (200, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 01606   896   NtQueryValueKey  (200,  (200, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5f\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\10\0\0\0\240\32\17\347\213\253\317\21\214\243\0\200_H\241\222\351\3\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\2\0\0\0\20\0\0\0\20\0\0\0\1\0\0\0\6\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0T\0c\0p\0i\0p\0 \0[\0T\0C\0P\0/\0I\0P\0]\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\204\3\0\0G\6\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0\310\0\0\0G\6\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0H\6\0\0\344\4\0\0\200\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0\304\0\0\0h\374"\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\250\0W\0\0\0\0\00\00\00\00\00\00\00\00\00\00\00\02\0H\6\0\0\344\4\0\0\200\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0\310\0\0\0I\6\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\310\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0W\0\2\0\0\0\220\0\0\0I\6\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0J\6\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\310\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) , Partial, 900, ... TitleIdx=0, Type=3, Data= (200, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5f\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\10\0\0\0\240\32\17\347\213\253\317\21\214\243\0\200_H\241\222\351\3\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\2\0\0\0\20\0\0\0\20\0\0\0\1\0\0\0\6\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0T\0c\0p\0i\0p\0 \0[\0T\0C\0P\0/\0I\0P\0]\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\204\3\0\0G\6\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0\310\0\0\0G\6\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0H\6\0\0\344\4\0\0\200\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0\304\0\0\0h\374"\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\250\0W\0\0\0\0\00\00\00\00\00\00\00\00\00\00\00\02\0H\6\0\0\344\4\0\0\200\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0\310\0\0\0I\6\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\310\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0W\0\2\0\0\0\220\0\0\0I\6\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0J\6\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\310\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) \0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\250\0W\0\0\0\0\00\00\00\00\00\00\00\00\00\00\00\02\0H\6\0\0\344\4\0\0\200\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0\310\0\0\0I\6\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\310\0\0\0\0\0\0\0 (200, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5f\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\10\0\0\0\240\32\17\347\213\253\317\21\214\243\0\200_H\241\222\351\3\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\2\0\0\0\20\0\0\0\20\0\0\0\1\0\0\0\6\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0T\0c\0p\0i\0p\0 \0[\0T\0C\0P\0/\0I\0P\0]\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\204\3\0\0G\6\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0\310\0\0\0G\6\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0H\6\0\0\344\4\0\0\200\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0\304\0\0\0h\374"\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\250\0W\0\0\0\0\00\00\00\00\00\00\00\00\00\00\00\02\0H\6\0\0\344\4\0\0\200\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0\310\0\0\0I\6\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\310\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0W\0\2\0\0\0\220\0\0\0I\6\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0J\6\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\310\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) \0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) == 0x0
 01607   896   NtClose  (200, ... ) == 0x0
 01608   896   NtOpenKey  (0x20019, {24, 196, 0x40, 0, 0,  (0x20019, {24, 196, 0x40, 0, 0, "000000000002"}, ... 200, ) }, ... 200, ) == 0x0
 01609   896   NtQueryValueKey  (200,  (200, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 01610   896   NtQueryValueKey  (200,  (200, "PackedCatalogItem", Partial, 144, ... , Partial, 144, ...
 01604  2016   NtQuerySection  ... {section info, class 1, size 48}, 0x0, ) == 0x0
 01611  2016   NtClose  (204, ... ) == 0x0
 01612  2016   NtMapViewOfSection  (208, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x76bb0000), 0x0, 20480, ) == 0x0
 01613  2016   NtClose  (208, ... ) == 0x0
 01610   896   NtQueryValueKey  ... ) == STATUS_BUFFER_OVERFLOW
 01614   896   NtQueryValueKey  (200,  (200, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\11\6\2\0\0\0\0\0\0\0\0\0\0\0\0\0\10\0\0\0\240\32\17\347\213\253\317\21\214\243\0\200_H\241\222\352\3\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\2\0\0\0\20\0\0\0\20\0\0\0\2\0\0\0\21\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\273\377\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0T\0c\0p\0i\0p\0 \0[\0U\0D\0P\0/\0I\0P\0]\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\204\3\0\0O\6\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0\310\0\0\0O\6\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0P\6\0\0\344\4\0\0\200\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0\304\0\0\0h\374"\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\250\0W\0\0\0\0\00\00\00\00\00\00\00\00\00\00\00\03\0P\6\0\0\344\4\0\0\200\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0\310\0\0\0Q\6\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\310\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0W\0\2\0\0\0\220\0\0\0Q\6\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0R\6\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\310\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) , Partial, 900, ... TitleIdx=0, Type=3, Data= (200, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\11\6\2\0\0\0\0\0\0\0\0\0\0\0\0\0\10\0\0\0\240\32\17\347\213\253\317\21\214\243\0\200_H\241\222\352\3\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\2\0\0\0\20\0\0\0\20\0\0\0\2\0\0\0\21\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\273\377\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0T\0c\0p\0i\0p\0 \0[\0U\0D\0P\0/\0I\0P\0]\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\204\3\0\0O\6\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0\310\0\0\0O\6\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0P\6\0\0\344\4\0\0\200\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0\304\0\0\0h\374"\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\250\0W\0\0\0\0\00\00\00\00\00\00\00\00\00\00\00\03\0P\6\0\0\344\4\0\0\200\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0\310\0\0\0Q\6\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\310\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0W\0\2\0\0\0\220\0\0\0Q\6\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0R\6\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\310\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) \0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\250\0W\0\0\0\0\00\00\00\00\00\00\00\00\00\00\00\03\0P\6\0\0\344\4\0\0\200\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0\310\0\0\0Q\6\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\310\0\0\0\0\0\0\0 (200, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\11\6\2\0\0\0\0\0\0\0\0\0\0\0\0\0\10\0\0\0\240\32\17\347\213\253\317\21\214\243\0\200_H\241\222\352\3\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\2\0\0\0\20\0\0\0\20\0\0\0\2\0\0\0\21\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\273\377\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0T\0c\0p\0i\0p\0 \0[\0U\0D\0P\0/\0I\0P\0]\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\204\3\0\0O\6\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0\310\0\0\0O\6\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0P\6\0\0\344\4\0\0\200\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0\304\0\0\0h\374"\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\250\0W\0\0\0\0\00\00\00\00\00\00\00\00\00\00\00\03\0P\6\0\0\344\4\0\0\200\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0\310\0\0\0Q\6\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\310\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0W\0\2\0\0\0\220\0\0\0Q\6\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0R\6\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\310\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) \0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) == 0x0
 01615   896   NtClose  (200, ... ) == 0x0
 01616   896   NtOpenKey  (0x20019, {24, 196, 0x40, 0, 0,  (0x20019, {24, 196, 0x40, 0, 0, "000000000003"}, ... 200, ) }, ... 200, ) == 0x0
 01617   896   NtQueryValueKey  (200,  (200, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 01618   896   NtQueryValueKey  (200,  (200, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 01619   896   NtAllocateVirtualMemory  (-1, 5705728, 0, 4096, 4096, 4, ...
 01620  2016   NtProtectVirtualMemory  (-1, (0x76bb1000), 76, 4, ... (0x76bb1000), 4096, 32, ) == 0x0
 01621  2016   NtProtectVirtualMemory  (-1, (0x76bb1000), 4096, 32, ... (0x76bb1000), 4096, 4, ) == 0x0
 01622  2016   NtFlushInstructionCache  (-1, 1991970816, 76, ... ) == 0x0
 01623  2016   NtOpenKey  (0x80000000, {24, 0, 0x40, 0, 0,  (0x80000000, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sfc.dll"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01619   896   NtAllocateVirtualMemory  ... 5705728, 4096, ) == 0x0
 01624   896   NtQueryValueKey  (200,  (200, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\11\6\2\0\0\0\0\0\0\0\0\0\0\0\0\0\14\0\0\0\240\32\17\347\213\253\317\21\214\243\0\200_H\241\222\353\3\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\2\0\0\0\20\0\0\0\20\0\0\0\3\0\0\0\0\0\0\0\377\0\0\0\0\0\0\0\0\0\0\0\273\377\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0T\0c\0p\0i\0p\0 \0[\0R\0A\0W\0/\0I\0P\0]\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\204\3\0\0Y\6\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0\310\0\0\0Y\6\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0Z\6\0\0\344\4\0\0\200\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0\304\0\0\0h\374"\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\250\0W\0\0\0\0\00\00\00\00\00\00\00\00\00\00\00\04\0[\6\0\0\344\4\0\0\340\7\0\0v\0\0\0\0\0\1\0\0\0\0\0\0\0\0\0[\6\0\0\344\4\0\0\340\7\0\0v\0\0\0\1\0\1\0\0\0\0\0\30\0\0\0\0\0\0\0T\347:\252\20\0\0\0\0\0\0\0\231\2366\0\0\0\0\0\\6\0\0\344\4\0\0\340\7\0\0V\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\16\0\0\0\0\0\0\0\30\0\0\0\10\0\0\0\310\364\225\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\26\0\30\0D\366\225\0\0\0\0\0S\0e\0c\0u\0r\03\02\0.\0d\0l\0l\0q\0\\6\0\0\344\4\0\0\340\7\0\0V\0\0\0\1\0\1\04\0\0\300\0\0\0\0]\6\0\0\344\4\0\0\340\7\0\0c\0\0\0\0\0\1\0\0\0\0\0"}, 900, ) , Partial, 900, ... TitleIdx=0, Type=3, Data= (200, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\11\6\2\0\0\0\0\0\0\0\0\0\0\0\0\0\14\0\0\0\240\32\17\347\213\253\317\21\214\243\0\200_H\241\222\353\3\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\2\0\0\0\20\0\0\0\20\0\0\0\3\0\0\0\0\0\0\0\377\0\0\0\0\0\0\0\0\0\0\0\273\377\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0T\0c\0p\0i\0p\0 \0[\0R\0A\0W\0/\0I\0P\0]\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\204\3\0\0Y\6\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0\310\0\0\0Y\6\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0Z\6\0\0\344\4\0\0\200\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0\304\0\0\0h\374"\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\250\0W\0\0\0\0\00\00\00\00\00\00\00\00\00\00\00\04\0[\6\0\0\344\4\0\0\340\7\0\0v\0\0\0\0\0\1\0\0\0\0\0\0\0\0\0[\6\0\0\344\4\0\0\340\7\0\0v\0\0\0\1\0\1\0\0\0\0\0\30\0\0\0\0\0\0\0T\347:\252\20\0\0\0\0\0\0\0\231\2366\0\0\0\0\0\\6\0\0\344\4\0\0\340\7\0\0V\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\16\0\0\0\0\0\0\0\30\0\0\0\10\0\0\0\310\364\225\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\26\0\30\0D\366\225\0\0\0\0\0S\0e\0c\0u\0r\03\02\0.\0d\0l\0l\0q\0\\6\0\0\344\4\0\0\340\7\0\0V\0\0\0\1\0\1\04\0\0\300\0\0\0\0]\6\0\0\344\4\0\0\340\7\0\0c\0\0\0\0\0\1\0\0\0\0\0"}, 900, ) \0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\250\0W\0\0\0\0\00\00\00\00\00\00\00\00\00\00\00\04\0[\6\0\0\344\4\0\0\340\7\0\0v\0\0\0\0\0\1\0\0\0\0\0\0\0\0\0[\6\0\0\344\4\0\0\340\7\0\0v\0\0\0\1\0\1\0\0\0\0\0\30\0\0\0\0\0\0\0T\347:\252\20\0\0\0\0\0\0\0\231\2366\0\0\0\0\0\\6\0\0\344\4\0\0\340\7\0\0V\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\16\0\0\0\0\0\0\0\30\0\0\0\10\0\0\0\310\364\225\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\26\0\30\0D\366\225\0\0\0\0\0S\0e\0c\0u\0r\03\02\0.\0d\0l\0l\0q\0\\6\0\0\344\4\0\0\340\7\0\0V\0\0\0\1\0\1\04\0\0\300\0\0\0\0]\6\0\0\344\4\0\0\340\7\0\0c\0\0\0\0\0\1\0\0\0\0\0"}, 900, ) == 0x0
 01625   896   NtClose  (200, ... ) == 0x0
 01626   896   NtOpenKey  (0x20019, {24, 196, 0x40, 0, 0,  (0x20019, {24, 196, 0x40, 0, 0, "000000000004"}, ... }, ...
 01627  2016   NtQueryPerformanceCounter  (... {-1438980268, 16}, {3579545, 0}, ) == 0x0
 01628  2016   NtOpenSection  (0xe, {24, 8, 0x40, 0, 0,  (0xe, {24, 8, 0x40, 0, 0, "Secur32.dll"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01629  2016   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\u:\work\Secur32.dll"}, 9827220, ... }, 9827220, ...
 01626   896   NtOpenKey  ... 200, ) == 0x0
 01630   896   NtQueryValueKey  (200,  (200, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 01631   896   NtQueryValueKey  (200,  (200, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 01632   896   NtQueryValueKey  (200,  (200, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\rsvpsp.dll\0\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\11&\2\0\0\0\0\0\0\0\0\0\0\0\0\0\10\0\0\0\340\251`\235z3\320\21\275\210\0\0\300\202\346\232\354\3\0\0\1\0\0\0\204\370\272\2|\370\272\2\210\371\272\2\4\244`u\\12\0\0\240<_u\260\371\272\2\6\0\0\0\2\0\0\0\20\0\0\0\20\0\0\0\2\0\0\0\21\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\273\377\0\0\0\0\0\0R\0S\0V\0P\0 \0U\0D\0P\0 \0S\0e\0r\0v\0i\0c\0e\0 \0P\0r\0o\0v\0i\0d\0e\0r\0\0\0\1\0\0\0\344\373\272\2\1\0\0\0\330\273\356\0\0\0\0\0=\373\220|\200\371\272\2\0\0\0\0\0\371\272\2l\373\220|q\373\220|\0\0\0\0\200\371\272\2=\373\220|\334\370\272\2\0\0\0\0\204\3\0\0a\6\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0\310\0\0\0a\6\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0b\6\0\0\344\4\0\0\200\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0\304\0\0\0h\374"\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\250\0W\0\0\0\0\00\00\00\00\00\00\00\00\00\00\00\05\0b\6\0\0\344\4\0\0\200\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0\310\0\0\0c\6\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\310\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0W\0\2\0\0\0\220\0\0\0c\6\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0d\6\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\310\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) , Partial, 900, ... TitleIdx=0, Type=3, Data= (200, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\rsvpsp.dll\0\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\11&\2\0\0\0\0\0\0\0\0\0\0\0\0\0\10\0\0\0\340\251`\235z3\320\21\275\210\0\0\300\202\346\232\354\3\0\0\1\0\0\0\204\370\272\2|\370\272\2\210\371\272\2\4\244`u\\12\0\0\240<_u\260\371\272\2\6\0\0\0\2\0\0\0\20\0\0\0\20\0\0\0\2\0\0\0\21\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\273\377\0\0\0\0\0\0R\0S\0V\0P\0 \0U\0D\0P\0 \0S\0e\0r\0v\0i\0c\0e\0 \0P\0r\0o\0v\0i\0d\0e\0r\0\0\0\1\0\0\0\344\373\272\2\1\0\0\0\330\273\356\0\0\0\0\0=\373\220|\200\371\272\2\0\0\0\0\0\371\272\2l\373\220|q\373\220|\0\0\0\0\200\371\272\2=\373\220|\334\370\272\2\0\0\0\0\204\3\0\0a\6\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0\310\0\0\0a\6\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0b\6\0\0\344\4\0\0\200\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0\304\0\0\0h\374"\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\250\0W\0\0\0\0\00\00\00\00\00\00\00\00\00\00\00\05\0b\6\0\0\344\4\0\0\200\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0\310\0\0\0c\6\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\310\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0W\0\2\0\0\0\220\0\0\0c\6\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0d\6\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\310\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) \0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\250\0W\0\0\0\0\00\00\00\00\00\00\00\00\00\00\00\05\0b\6\0\0\344\4\0\0\200\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0\310\0\0\0c\6\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\310\0\0\0\0\0\0\0 (200, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\rsvpsp.dll\0\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\11&\2\0\0\0\0\0\0\0\0\0\0\0\0\0\10\0\0\0\340\251`\235z3\320\21\275\210\0\0\300\202\346\232\354\3\0\0\1\0\0\0\204\370\272\2|\370\272\2\210\371\272\2\4\244`u\\12\0\0\240<_u\260\371\272\2\6\0\0\0\2\0\0\0\20\0\0\0\20\0\0\0\2\0\0\0\21\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\273\377\0\0\0\0\0\0R\0S\0V\0P\0 \0U\0D\0P\0 \0S\0e\0r\0v\0i\0c\0e\0 \0P\0r\0o\0v\0i\0d\0e\0r\0\0\0\1\0\0\0\344\373\272\2\1\0\0\0\330\273\356\0\0\0\0\0=\373\220|\200\371\272\2\0\0\0\0\0\371\272\2l\373\220|q\373\220|\0\0\0\0\200\371\272\2=\373\220|\334\370\272\2\0\0\0\0\204\3\0\0a\6\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0\310\0\0\0a\6\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0b\6\0\0\344\4\0\0\200\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0\304\0\0\0h\374"\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\250\0W\0\0\0\0\00\00\00\00\00\00\00\00\00\00\00\05\0b\6\0\0\344\4\0\0\200\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0\310\0\0\0c\6\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\310\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0W\0\2\0\0\0\220\0\0\0c\6\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0d\6\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\310\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) \0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) == 0x0
 01633   896   NtClose  (200, ... ) == 0x0
 01634   896   NtOpenKey  (0x20019, {24, 196, 0x40, 0, 0,  (0x20019, {24, 196, 0x40, 0, 0, "000000000005"}, ... 200, ) }, ... 200, ) == 0x0
 01635   896   NtQueryValueKey  (200,  (200, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 01636   896   NtQueryValueKey  (200,  (200, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 01637   896   NtQueryValueKey  (200,  (200, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\rsvpsp.dll\0\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5f \2\0\0\0\0\0\0\0\0\0\0\0\0\0\10\0\0\0\340\251`\235z3\320\21\275\210\0\0\300\202\346\232\355\3\0\0\1\0\0\0\210\1\34\0\0\0\34\0\10\0\0\0\0\0\0\0\214\373\272\2\\15\221|\0\0\34\0\6\0\0\0\2\0\0\0\20\0\0\0\20\0\0\0\1\0\0\0\6\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0R\0S\0V\0P\0 \0T\0C\0P\0 \0S\0e\0r\0v\0i\0c\0e\0 \0P\0r\0o\0v\0i\0d\0e\0r\0\0\0\210\1\34\0\0\0\0\0\20\0\0\0P\373\272\2\270Ddu\0\0\0\0(\275\356\0|\373\272\2\364\373\272\2\0\0\34\0\10\0\0\0\0\0\0\0(\374\272\2\\15\221|\0\0\34\0\0\0\0\0\204\3\0\0f\6\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0\310\0\0\0f\6\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0g\6\0\0\344\4\0\0\200\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0\304\0\0\0h\374"\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\250\0W\0\0\0\0\00\00\00\00\00\00\00\00\00\00\00\06\0g\6\0\0\344\4\0\0\200\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0\310\0\0\0h\6\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\310\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0W\0\2\0\0\0\220\0\0\0h\6\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0i\6\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\310\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) , Partial, 900, ... TitleIdx=0, Type=3, Data= (200, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\rsvpsp.dll\0\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5f \2\0\0\0\0\0\0\0\0\0\0\0\0\0\10\0\0\0\340\251`\235z3\320\21\275\210\0\0\300\202\346\232\355\3\0\0\1\0\0\0\210\1\34\0\0\0\34\0\10\0\0\0\0\0\0\0\214\373\272\2\\15\221|\0\0\34\0\6\0\0\0\2\0\0\0\20\0\0\0\20\0\0\0\1\0\0\0\6\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0R\0S\0V\0P\0 \0T\0C\0P\0 \0S\0e\0r\0v\0i\0c\0e\0 \0P\0r\0o\0v\0i\0d\0e\0r\0\0\0\210\1\34\0\0\0\0\0\20\0\0\0P\373\272\2\270Ddu\0\0\0\0(\275\356\0|\373\272\2\364\373\272\2\0\0\34\0\10\0\0\0\0\0\0\0(\374\272\2\\15\221|\0\0\34\0\0\0\0\0\204\3\0\0f\6\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0\310\0\0\0f\6\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0g\6\0\0\344\4\0\0\200\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0\304\0\0\0h\374"\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\250\0W\0\0\0\0\00\00\00\00\00\00\00\00\00\00\00\06\0g\6\0\0\344\4\0\0\200\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0\310\0\0\0h\6\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\310\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0W\0\2\0\0\0\220\0\0\0h\6\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0i\6\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\310\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) \0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\250\0W\0\0\0\0\00\00\00\00\00\00\00\00\00\00\00\06\0g\6\0\0\344\4\0\0\200\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0\310\0\0\0h\6\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\310\0\0\0\0\0\0\0 (200, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\rsvpsp.dll\0\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5f \2\0\0\0\0\0\0\0\0\0\0\0\0\0\10\0\0\0\340\251`\235z3\320\21\275\210\0\0\300\202\346\232\355\3\0\0\1\0\0\0\210\1\34\0\0\0\34\0\10\0\0\0\0\0\0\0\214\373\272\2\\15\221|\0\0\34\0\6\0\0\0\2\0\0\0\20\0\0\0\20\0\0\0\1\0\0\0\6\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0R\0S\0V\0P\0 \0T\0C\0P\0 \0S\0e\0r\0v\0i\0c\0e\0 \0P\0r\0o\0v\0i\0d\0e\0r\0\0\0\210\1\34\0\0\0\0\0\20\0\0\0P\373\272\2\270Ddu\0\0\0\0(\275\356\0|\373\272\2\364\373\272\2\0\0\34\0\10\0\0\0\0\0\0\0(\374\272\2\\15\221|\0\0\34\0\0\0\0\0\204\3\0\0f\6\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0\310\0\0\0f\6\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0g\6\0\0\344\4\0\0\200\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0\304\0\0\0h\374"\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\250\0W\0\0\0\0\00\00\00\00\00\00\00\00\00\00\00\06\0g\6\0\0\344\4\0\0\200\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0\310\0\0\0h\6\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\310\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0W\0\2\0\0\0\220\0\0\0h\6\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0i\6\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\310\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) \0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) == 0x0
 01638   896   NtClose  (200, ... ) == 0x0
 01639   896   NtOpenKey  (0x20019, {24, 196, 0x40, 0, 0,  (0x20019, {24, 196, 0x40, 0, 0, "000000000006"}, ... 200, ) }, ... 200, ) == 0x0
 01640   896   NtQueryValueKey  (200,  (200, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 01641   896   NtQueryValueKey  (200,  (200, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 01642   896   NtAllocateVirtualMemory  (-1, 5709824, 0, 4096, 4096, 4, ... 5709824, 4096, ) == 0x0
 01643   896   NtQueryValueKey  (200,  (200, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5&\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\10\0\0\0d\200\304\237\230r\344C\267\275\30\37 \211y*\374\3\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0 \0\0\0\36\0\0\0\36\0\0\0\1\0\0\0\3\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0R\0f\0C\0o\0m\0m\0 \0[\0B\0l\0u\0e\0t\0o\0o\0t\0h\0]\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\204\3\0\0l\6\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0\310\0\0\0l\6\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0m\6\0\0\344\4\0\0\200\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0\304\0\0\0h\374"\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\250\0W\0\0\0\0\00\00\00\00\00\00\00\00\00\00\00\07\0m\6\0\0\344\4\0\0\200\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0\310\0\0\0n\6\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\310\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0W\0\2\0\0\0\220\0\0\0n\6\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0o\6\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\310\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) , Partial, 900, ... TitleIdx=0, Type=3, Data= (200, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5&\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\10\0\0\0d\200\304\237\230r\344C\267\275\30\37 \211y*\374\3\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0 \0\0\0\36\0\0\0\36\0\0\0\1\0\0\0\3\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0R\0f\0C\0o\0m\0m\0 \0[\0B\0l\0u\0e\0t\0o\0o\0t\0h\0]\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\204\3\0\0l\6\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0\310\0\0\0l\6\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0m\6\0\0\344\4\0\0\200\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0\304\0\0\0h\374"\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\250\0W\0\0\0\0\00\00\00\00\00\00\00\00\00\00\00\07\0m\6\0\0\344\4\0\0\200\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0\310\0\0\0n\6\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\310\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0W\0\2\0\0\0\220\0\0\0n\6\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0o\6\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\310\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) \0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\250\0W\0\0\0\0\00\00\00\00\00\00\00\00\00\00\00\07\0m\6\0\0\344\4\0\0\200\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0\310\0\0\0n\6\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\310\0\0\0\0\0\0\0 (200, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5&\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\10\0\0\0d\200\304\237\230r\344C\267\275\30\37 \211y*\374\3\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0 \0\0\0\36\0\0\0\36\0\0\0\1\0\0\0\3\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0R\0f\0C\0o\0m\0m\0 \0[\0B\0l\0u\0e\0t\0o\0o\0t\0h\0]\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\204\3\0\0l\6\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0\310\0\0\0l\6\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0m\6\0\0\344\4\0\0\200\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0\304\0\0\0h\374"\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\250\0W\0\0\0\0\00\00\00\00\00\00\00\00\00\00\00\07\0m\6\0\0\344\4\0\0\200\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0\310\0\0\0n\6\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\310\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0W\0\2\0\0\0\220\0\0\0n\6\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0o\6\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\310\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) \0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) == 0x0
 01644   896   NtClose  (200, ... ) == 0x0
 01645   896   NtOpenKey  (0x20019, {24, 196, 0x40, 0, 0,  (0x20019, {24, 196, 0x40, 0, 0, "000000000007"}, ... 200, ) }, ... 200, ) == 0x0
 01646   896   NtQueryValueKey  (200,  (200, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 01647   896   NtQueryValueKey  (200,  (200, "PackedCatalogItem", Partial, 144, ... , Partial, 144, ...
 01629  2016   NtQueryAttributesFile  ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01648  2016   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\Secur32.dll"}, 9827220, ... ) }, 9827220, ... ) == 0x0
 01649  2016   NtOpenFile  (0x100020, {24, 0, 0x40, 0, 0,  (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\Secur32.dll"}, 5, 96, ... 208, {status=0x0, info=1}, ) }, 5, 96, ... 208, {status=0x0, info=1}, ) == 0x0
 01650  2016   NtCreateSection  (0xf, 0x0, 0x0, 16, 16777216, 208, ... 204, ) == 0x0
 01651  2016   NtQuerySection  (204, Image, 48, ... {section info, class 1, size 48}, 0x0, ) == 0x0
 01647   896   NtQueryValueKey  ... ) == STATUS_BUFFER_OVERFLOW
 01652   896   NtQueryValueKey  (200,  (200, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\16\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\23\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\5\0\0\0\373\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\0F\0C\0C\00\03\0A\04\01\0-\08\0C\0C\0C\0-\04\09\01\09\0-\0A\0\0\0\0\0\204\3\0\0u\6\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0\310\0\0\0u\6\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0v\6\0\0\344\4\0\0\200\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0\304\0\0\0h\374"\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\250\0W\0\0\0\0\00\00\00\00\00\00\00\00\00\00\00\08\0v\6\0\0\344\4\0\0\200\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0\310\0\0\0w\6\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\310\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0W\0\2\0\0\0\220\0\0\0w\6\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0x\6\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\310\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) , Partial, 900, ... TitleIdx=0, Type=3, Data= (200, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\16\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\23\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\5\0\0\0\373\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\0F\0C\0C\00\03\0A\04\01\0-\08\0C\0C\0C\0-\04\09\01\09\0-\0A\0\0\0\0\0\204\3\0\0u\6\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0\310\0\0\0u\6\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0v\6\0\0\344\4\0\0\200\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0\304\0\0\0h\374"\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\250\0W\0\0\0\0\00\00\00\00\00\00\00\00\00\00\00\08\0v\6\0\0\344\4\0\0\200\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0\310\0\0\0w\6\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\310\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0W\0\2\0\0\0\220\0\0\0w\6\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0x\6\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\310\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) \0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\250\0W\0\0\0\0\00\00\00\00\00\00\00\00\00\00\00\08\0v\6\0\0\344\4\0\0\200\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0\310\0\0\0w\6\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\310\0\0\0\0\0\0\0 (200, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\16\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\23\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\5\0\0\0\373\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\0F\0C\0C\00\03\0A\04\01\0-\08\0C\0C\0C\0-\04\09\01\09\0-\0A\0\0\0\0\0\204\3\0\0u\6\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0\310\0\0\0u\6\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0v\6\0\0\344\4\0\0\200\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0\304\0\0\0h\374"\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\250\0W\0\0\0\0\00\00\00\00\00\00\00\00\00\00\00\08\0v\6\0\0\344\4\0\0\200\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0\310\0\0\0w\6\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\310\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0W\0\2\0\0\0\220\0\0\0w\6\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0x\6\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\310\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) \0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) == 0x0
 01653   896   NtClose  (200, ... ) == 0x0
 01654   896   NtOpenKey  (0x20019, {24, 196, 0x40, 0, 0,  (0x20019, {24, 196, 0x40, 0, 0, "000000000008"}, ... 200, ) }, ... 200, ) == 0x0
 01655   896   NtQueryValueKey  (200,  (200, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 01656   896   NtQueryValueKey  (200,  (200, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 01657   896   NtQueryValueKey  (200,  (200, "PackedCatalogItem", Partial, 900, ... , Partial, 900, ...
 01658  2016   NtClose  (208, ... ) == 0x0
 01659  2016   NtMapViewOfSection  (204, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x77fe0000), 0x0, 69632, ) == 0x0
 01660  2016   NtClose  (204, ... ) == 0x0
 01661  2016   NtProtectVirtualMemory  (-1, (0x77fe1000), 388, 4, ... (0x77fe1000), 4096, 32, ) == 0x0
 01657   896   NtQueryValueKey  ... TitleIdx=0, Type=3, Data= ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\11\2\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\24\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\2\0\0\0\373\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\0F\0C\0C\00\03\0A\04\01\0-\08\0C\0C\0C\0-\04\09\01\09\0-\0A\0\0\0\0\0\204\3\0\0~\6\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0\310\0\0\0~\6\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\177\6\0\0\344\4\0\0\200\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0\304\0\0\0h\374"\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\250\0W\0\0\0\0\00\00\00\00\00\00\00\00\00\00\00\09\0\177\6\0\0\344\4\0\0\200\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0\310\0\0\0\200\6\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\310\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0W\0\2\0\0\0\220\0\0\0\201\6\0\0\344\4\0\0\340\7\0\0`\0\0\0\0\0\1\0\0\0\0\0\30\0\0\0\377\377\377\377\0\0\0\0\0\20\376w\0\0\0\0\0\20\0\0 \0\0\0\201\6\0\0\344\4\0\0\340\7\0\0`\0\0\0\1\0\1\0\0\0\0\0\30\0\0\0\0\0\0\0\0\20\376w\0\0\0\0\0\20\0\0\0\0\0\0\4\0\0\0"}, 900, ) \0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\250\0W\0\0\0\0\00\00\00\00\00\00\00\00\00\00\00\09\0\177\6\0\0\344\4\0\0\200\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0\310\0\0\0\200\6\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\310\0\0\0\0\0\0\0 ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\11\2\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\24\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\2\0\0\0\373\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\0F\0C\0C\00\03\0A\04\01\0-\08\0C\0C\0C\0-\04\09\01\09\0-\0A\0\0\0\0\0\204\3\0\0~\6\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0\310\0\0\0~\6\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\177\6\0\0\344\4\0\0\200\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0\304\0\0\0h\374"\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\250\0W\0\0\0\0\00\00\00\00\00\00\00\00\00\00\00\09\0\177\6\0\0\344\4\0\0\200\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0\310\0\0\0\200\6\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\310\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0W\0\2\0\0\0\220\0\0\0\201\6\0\0\344\4\0\0\340\7\0\0`\0\0\0\0\0\1\0\0\0\0\0\30\0\0\0\377\377\377\377\0\0\0\0\0\20\376w\0\0\0\0\0\20\0\0 \0\0\0\201\6\0\0\344\4\0\0\340\7\0\0`\0\0\0\1\0\1\0\0\0\0\0\30\0\0\0\0\0\0\0\0\20\376w\0\0\0\0\0\20\0\0\0\0\0\0\4\0\0\0"}, 900, ) }, 900, ) == 0x0
 01662   896   NtClose  (200, ... ) == 0x0
 01663   896   NtOpenKey  (0x20019, {24, 196, 0x40, 0, 0,  (0x20019, {24, 196, 0x40, 0, 0, "000000000009"}, ... 200, ) }, ... 200, ) == 0x0
 01664   896   NtQueryValueKey  (200,  (200, "PackedCatalogItem", Partial, 144, ... , Partial, 144, ...
 01665  2016   NtProtectVirtualMemory  (-1, (0x77fe1000), 4096, 32, ... (0x77fe1000), 4096, 4, ) == 0x0
 01666  2016   NtFlushInstructionCache  (-1, 2013138944, 388, ... ) == 0x0
 01664   896   NtQueryValueKey  ... ) == STATUS_BUFFER_OVERFLOW
 01667   896   NtQueryValueKey  (200,  (200, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 01668   896   NtQueryValueKey  (200,  (200, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\16\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\25\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\5\0\0\0\374\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\0A\0E\07\04\02\01\0B\05\0-\07\03\02\0D\0-\04\05\06\07\0-\0A\0\0\0\0\0\204\3\0\0\205\6\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0\310\0\0\0\206\6\0\0\344\4\0\0\340\7\0\0Q\0\0\0\0\0\1\0\0\0\0\0\0\1\0\0\0\0\0\200\0\0\0\0\30\0\0\0\0\0\0\0x\357\225\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\316\0\306\2\210\357\225\0\0\0\0\0\\0R\0e\0g\0i\0s\0t\0r\0y\0\\0M\0a\0c\0h\0i\0n\0e\0\\0S\0o\0f\0t\0w\0a\0r\0e\0\\0M\0i\0c\0r\0o\0s\0o\0f\0t\0\\0W\0i\0n\0d\0o\0w\0s\0 \0N\0T\0\\0C\0u\0r\0r\0e\0n\0t\0V\0e\0r\0s\0i\0o\0n\0\\0I\0m\0a\0g\0e\0 \0F\0i\0l\0e\0 \0E\0x\0e\0c\0u\0t\0i\0o\0n\0 \0O\0p\0t\0i\0o\0n\0s\0\\0S\0e\0c\0u\0r\03\02\0.\0d\0l\0l\0l\0\206\6\0\0\344\4\0\0\340\7\0\0Q\0\0\0\1\0\1\04\0\0\300\0\0\0\0\207\6\0\0\344\4\0\0\340\7\0\0"\0\0\0\0\0\1\0\0\0\0\0\24\0\0\0\3\0\20\0\377\377\377\377\0\0\0\0\0\0\0\0\377\377\377\177"}, 900, ) , Partial, 900, ... TitleIdx=0, Type=3, Data= (200, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\16\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\25\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\5\0\0\0\374\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\0A\0E\07\04\02\01\0B\05\0-\07\03\02\0D\0-\04\05\06\07\0-\0A\0\0\0\0\0\204\3\0\0\205\6\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0\310\0\0\0\206\6\0\0\344\4\0\0\340\7\0\0Q\0\0\0\0\0\1\0\0\0\0\0\0\1\0\0\0\0\0\200\0\0\0\0\30\0\0\0\0\0\0\0x\357\225\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\316\0\306\2\210\357\225\0\0\0\0\0\\0R\0e\0g\0i\0s\0t\0r\0y\0\\0M\0a\0c\0h\0i\0n\0e\0\\0S\0o\0f\0t\0w\0a\0r\0e\0\\0M\0i\0c\0r\0o\0s\0o\0f\0t\0\\0W\0i\0n\0d\0o\0w\0s\0 \0N\0T\0\\0C\0u\0r\0r\0e\0n\0t\0V\0e\0r\0s\0i\0o\0n\0\\0I\0m\0a\0g\0e\0 \0F\0i\0l\0e\0 \0E\0x\0e\0c\0u\0t\0i\0o\0n\0 \0O\0p\0t\0i\0o\0n\0s\0\\0S\0e\0c\0u\0r\03\02\0.\0d\0l\0l\0l\0\206\6\0\0\344\4\0\0\340\7\0\0Q\0\0\0\1\0\1\04\0\0\300\0\0\0\0\207\6\0\0\344\4\0\0\340\7\0\0"\0\0\0\0\0\1\0\0\0\0\0\24\0\0\0\3\0\20\0\377\377\377\377\0\0\0\0\0\0\0\0\377\377\377\177"}, 900, ) \0\0\0\0\0\1\0\0\0\0\0\24\0\0\0\3\0\20\0\377\377\377\377\0\0\0\0\0\0\0\0\377\377\377\177"}, 900, ) == 0x0
 01669   896   NtClose  (200, ...
 01670  2016   NtOpenKey  (0x80000000, {24, 0, 0x40, 0, 0,  (0x80000000, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Secur32.dll"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01671  2016   NtCreateSemaphore  (0x100003, 0x0, 0, 2147483647, ... 204, ) == 0x0
 01672  2016   NtCreateSemaphore  (0x100003, 0x0, 0, 2147483647, ... 208, ) == 0x0
 01673  2016   NtOpenEvent  (0x1, {24, 0, 0x40, 0, 0,  (0x1, {24, 0, 0x40, 0, 0, "\SECURITY\LSA_AUTHENTICATION_INITIALIZED"}, ... 212, ) }, ... 212, ) == 0x0
 01669   896   NtClose  ... ) == 0x0
 01674   896   NtOpenKey  (0x20019, {24, 196, 0x40, 0, 0,  (0x20019, {24, 196, 0x40, 0, 0, "000000000010"}, ... 200, ) }, ... 200, ) == 0x0
 01675   896   NtQueryValueKey  (200,  (200, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 01676   896   NtQueryValueKey  (200,  (200, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 01677   896   NtQueryValueKey  (200,  (200, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\11\2\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\26\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\2\0\0\0\374\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\0A\0E\07\04\02\01\0B\05\0-\07\03\02\0D\0-\04\05\06\07\0-\0A\0\0\0\0\0\204\3\0\0\216\6\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0\310\0\0\0\216\6\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\217\6\0\0\344\4\0\0\200\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0\304\0\0\0h\374"\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\260(W\0\0\0\0\00\00\00\00\00\00\00\00\00\00\01\01\0\220\6\0\0\344\4\0\0\340\7\0\0h\0\0\0\0\0\1\0\0\0\0\0\14\0\0\0\324\0\0\0\0\0\0\0\10\0\0\0\220\6\0\0\344\4\0\0\340\7\0\0h\0\0\0\1\0\1\0\0\0\0\0\34\0\0\0\0\0\0\0\0\0\0\0\10\0\0\0\0\0\0\0\1\0\0\0\377\377\377\377\0\0\0\0\221\6\0\0\344\4\0\0\340\7\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0\324\0\0\0\221\6\0\0\344\4\0\0\340\7\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\222\6\0\0\344\4\0\0\340\7\0\0\22\0\0\0\0\0\1\0\0\0\0\0h\0\0\0\0\0\0\0,\0.\08'\376w\0\0\0\0\\0L\0s\0a\0A\0u\0t\0h\0e\0n\0t\0i\0c\0a\0t\0i\0"}, 900, ) , Partial, 900, ... TitleIdx=0, Type=3, Data= (200, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\11\2\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\26\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\2\0\0\0\374\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\0A\0E\07\04\02\01\0B\05\0-\07\03\02\0D\0-\04\05\06\07\0-\0A\0\0\0\0\0\204\3\0\0\216\6\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0\310\0\0\0\216\6\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\217\6\0\0\344\4\0\0\200\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0\304\0\0\0h\374"\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\260(W\0\0\0\0\00\00\00\00\00\00\00\00\00\00\01\01\0\220\6\0\0\344\4\0\0\340\7\0\0h\0\0\0\0\0\1\0\0\0\0\0\14\0\0\0\324\0\0\0\0\0\0\0\10\0\0\0\220\6\0\0\344\4\0\0\340\7\0\0h\0\0\0\1\0\1\0\0\0\0\0\34\0\0\0\0\0\0\0\0\0\0\0\10\0\0\0\0\0\0\0\1\0\0\0\377\377\377\377\0\0\0\0\221\6\0\0\344\4\0\0\340\7\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0\324\0\0\0\221\6\0\0\344\4\0\0\340\7\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\222\6\0\0\344\4\0\0\340\7\0\0\22\0\0\0\0\0\1\0\0\0\0\0h\0\0\0\0\0\0\0,\0.\08'\376w\0\0\0\0\\0L\0s\0a\0A\0u\0t\0h\0e\0n\0t\0i\0c\0a\0t\0i\0"}, 900, ) \0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\260(W\0\0\0\0\00\00\00\00\00\00\00\00\00\00\01\01\0\220\6\0\0\344\4\0\0\340\7\0\0h\0\0\0\0\0\1\0\0\0\0\0\14\0\0\0\324\0\0\0\0\0\0\0\10\0\0\0\220\6\0\0\344\4\0\0\340\7\0\0h\0\0\0\1\0\1\0\0\0\0\0\34\0\0\0\0\0\0\0\0\0\0\0\10\0\0\0\0\0\0\0\1\0\0\0\377\377\377\377\0\0\0\0\221\6\0\0\344\4\0\0\340\7\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0\324\0\0\0\221\6\0\0\344\4\0\0\340\7\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\222\6\0\0\344\4\0\0\340\7\0\0\22\0\0\0\0\0\1\0\0\0\0\0h\0\0\0\0\0\0\0,\0.\08'\376w\0\0\0\0\\0L\0s\0a\0A\0u\0t\0h\0e\0n\0t\0i\0c\0a\0t\0i\0"}, 900, ) == 0x0
 01678   896   NtClose  (200, ... ) == 0x0
 01679   896   NtOpenKey  (0x20019, {24, 196, 0x40, 0, 0,  (0x20019, {24, 196, 0x40, 0, 0, "000000000011"}, ... }, ...
 01680  2016   NtQueryEvent  (212, Basic, 8, ... {EventType=0,SignalState=1,}, 0x0, ) == 0x0
 01681  2016   NtClose  (212, ... ) == 0x0
 01682  2016   NtConnectPort  ( ("\LsaAuthenticationPort", {12, 2, 1, 0}, 0x0, 0x0, 9828792, 140, ... 212, 0x0, 0x0, 256, 140, ) , {12, 2, 1, 0}, 0x0, 0x0, 9828792, 140, ... 212, 0x0, 0x0, 256, 140, ) == 0x0
 01683  2016   NtRequestWaitReplyPort  (212, {28, 52, new_msg, 0, 0, 0, 0, 0}  (212, {28, 52, new_msg, 0, 0, 0, 0, 0} "\37\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\1\0\353\6\376\1\260\234V\0" ... {188, 212, reply, 0, 1252, 2016, 81856, 0} "\37\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\1\0\34\0\376\1\220\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0M\0a\0r\0t\0i\0m\0 \0C\0a\0r\0b\0o\0n\0e\0" )  ... {188, 212, reply, 0, 1252, 2016, 81856, 0}  (212, {28, 52, new_msg, 0, 0, 0, 0, 0} "\37\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\1\0\353\6\376\1\260\234V\0" ... {188, 212, reply, 0, 1252, 2016, 81856, 0} "\37\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\1\0\34\0\376\1\220\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0M\0a\0r\0t\0i\0m\0 \0C\0a\0r\0b\0o\0n\0e\0" )  ) == 0x0
 01684  2016   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\System\CurrentControlSet\Control\ComputerName"}, ... 200, ) }, ... 200, ) == 0x0
 01679   896   NtOpenKey  ... 216, ) == 0x0
 01685   896   NtQueryValueKey  (216,  (216, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 01686   896   NtQueryValueKey  (216,  (216, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 01687   896   NtQueryValueKey  (216,  (216, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\16\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\27\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\5\0\0\0\375\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\09\07\0C\02\0D\09\0F\04\0-\06\09\05\04\0-\04\0E\0B\03\0-\08\0\0\0\0\0\204\3\0\0\230\6\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0\330\0\0\0\230\6\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\231\6\0\0\344\4\0\0\200\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0\304\0\0\0h\374"\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\260(W\0\0\0\0\00\00\00\00\00\00\00\00\00\00\01\02\0\231\6\0\0\344\4\0\0\200\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0\330\0\0\0\232\6\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\330\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0W\0\2\0\0\0\220\0\0\0\233\6\0\0\344\4\0\0\340\7\0\0Q\0\0\0\0\0\1\0\0\0\0\0T\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0\310\0\0\0\364\372\225\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0$\0&\0\270\27\203|\0\0\0\0A\0c\0t\0i\0v\0e\0C\0o\0m\0p\0u\0t\0e\0r\0"}, 900, ) , Partial, 900, ... TitleIdx=0, Type=3, Data= (216, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\16\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\27\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\5\0\0\0\375\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\09\07\0C\02\0D\09\0F\04\0-\06\09\05\04\0-\04\0E\0B\03\0-\08\0\0\0\0\0\204\3\0\0\230\6\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0\330\0\0\0\230\6\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\231\6\0\0\344\4\0\0\200\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0\304\0\0\0h\374"\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\260(W\0\0\0\0\00\00\00\00\00\00\00\00\00\00\01\02\0\231\6\0\0\344\4\0\0\200\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0\330\0\0\0\232\6\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\330\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0W\0\2\0\0\0\220\0\0\0\233\6\0\0\344\4\0\0\340\7\0\0Q\0\0\0\0\0\1\0\0\0\0\0T\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0\310\0\0\0\364\372\225\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0$\0&\0\270\27\203|\0\0\0\0A\0c\0t\0i\0v\0e\0C\0o\0m\0p\0u\0t\0e\0r\0"}, 900, ) \0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\260(W\0\0\0\0\00\00\00\00\00\00\00\00\00\00\01\02\0\231\6\0\0\344\4\0\0\200\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0\330\0\0\0\232\6\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\330\0\0\0\0\0\0\0 (216, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\16\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\27\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\5\0\0\0\375\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\09\07\0C\02\0D\09\0F\04\0-\06\09\05\04\0-\04\0E\0B\03\0-\08\0\0\0\0\0\204\3\0\0\230\6\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0\330\0\0\0\230\6\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\231\6\0\0\344\4\0\0\200\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0\304\0\0\0h\374"\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\260(W\0\0\0\0\00\00\00\00\00\00\00\00\00\00\01\02\0\231\6\0\0\344\4\0\0\200\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0\330\0\0\0\232\6\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\330\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0W\0\2\0\0\0\220\0\0\0\233\6\0\0\344\4\0\0\340\7\0\0Q\0\0\0\0\0\1\0\0\0\0\0T\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0\310\0\0\0\364\372\225\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0$\0&\0\270\27\203|\0\0\0\0A\0c\0t\0i\0v\0e\0C\0o\0m\0p\0u\0t\0e\0r\0"}, 900, ) }, 900, ) == 0x0
 01688   896   NtClose  (216, ... ) == 0x0
 01689   896   NtOpenKey  (0x20019, {24, 196, 0x40, 0, 0,  (0x20019, {24, 196, 0x40, 0, 0, "000000000012"}, ... 216, ) }, ... 216, ) == 0x0
 01690   896   NtQueryValueKey  (216,  (216, "PackedCatalogItem", Partial, 144, ... , Partial, 144, ...
 01691  2016   NtOpenKey  (0x20019, {24, 200, 0x40, 0, 0,  (0x20019, {24, 200, 0x40, 0, 0, "ActiveComputerName"}, ... 220, ) }, ... 220, ) == 0x0
 01692  2016   NtQueryValueKey  (220,  (220, "ComputerName", Full, 108, ... TitleIdx=0, Type=1, Name="ComputerName", Data="V\0I\0R\0T\0U\0A\0L\0\0\0"}, 60, ) , Full, 108, ... TitleIdx=0, Type=1, Name= (220, "ComputerName", Full, 108, ... TitleIdx=0, Type=1, Name="ComputerName", Data="V\0I\0R\0T\0U\0A\0L\0\0\0"}, 60, ) , Data= (220, "ComputerName", Full, 108, ... TitleIdx=0, Type=1, Name="ComputerName", Data="V\0I\0R\0T\0U\0A\0L\0\0\0"}, 60, ) }, 60, ) == 0x0
 01693  2016   NtClose  (220, ... ) == 0x0
 01694  2016   NtClose  (200, ... ) == 0x0
 01695  2016   NtAllocateVirtualMemory  (-1, 5713920, 0, 8192, 4096, 4, ... 5713920, 8192, ) == 0x0
 01696  2016   NtOpenMutant  (0x100000, {24, 28, 0x0, 0, 0,  (0x100000, {24, 28, 0x0, 0, 0, "kkq-vx_mtx6"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01690   896   NtQueryValueKey  ... ) == STATUS_BUFFER_OVERFLOW
 01697   896   NtQueryValueKey  (216,  (216, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 01698   896   NtQueryValueKey  (216,  (216, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\11\2\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\30\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\2\0\0\0\375\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\09\07\0C\02\0D\09\0F\04\0-\06\09\05\04\0-\04\0E\0B\03\0-\08\0\0\0\0\0\204\3\0\0\243\6\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0\330\0\0\0\243\6\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\244\6\0\0\344\4\0\0\200\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0\304\0\0\0h\374"\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\260(W\0\0\0\0\00\00\00\00\00\00\00\00\00\00\01\03\0\244\6\0\0\344\4\0\0\200\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0\330\0\0\0\245\6\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\330\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0W\0\2\0\0\0\220\0\0\0\245\6\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\246\6\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\330\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) , Partial, 900, ... TitleIdx=0, Type=3, Data= (216, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\11\2\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\30\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\2\0\0\0\375\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\09\07\0C\02\0D\09\0F\04\0-\06\09\05\04\0-\04\0E\0B\03\0-\08\0\0\0\0\0\204\3\0\0\243\6\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0\330\0\0\0\243\6\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\244\6\0\0\344\4\0\0\200\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0\304\0\0\0h\374"\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\260(W\0\0\0\0\00\00\00\00\00\00\00\00\00\00\01\03\0\244\6\0\0\344\4\0\0\200\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0\330\0\0\0\245\6\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\330\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0W\0\2\0\0\0\220\0\0\0\245\6\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\246\6\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\330\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) \0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\260(W\0\0\0\0\00\00\00\00\00\00\00\00\00\00\01\03\0\244\6\0\0\344\4\0\0\200\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0\330\0\0\0\245\6\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\330\0\0\0\0\0\0\0 (216, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\11\2\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\30\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\2\0\0\0\375\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\09\07\0C\02\0D\09\0F\04\0-\06\09\05\04\0-\04\0E\0B\03\0-\08\0\0\0\0\0\204\3\0\0\243\6\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0\330\0\0\0\243\6\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\244\6\0\0\344\4\0\0\200\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0\304\0\0\0h\374"\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\260(W\0\0\0\0\00\00\00\00\00\00\00\00\00\00\01\03\0\244\6\0\0\344\4\0\0\200\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0\330\0\0\0\245\6\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\330\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0W\0\2\0\0\0\220\0\0\0\245\6\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\246\6\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\330\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) \0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) == 0x0
 01699   896   NtClose  (216, ... ) == 0x0
 01700   896   NtOpenKey  (0x20019, {24, 196, 0x40, 0, 0,  (0x20019, {24, 196, 0x40, 0, 0, "000000000013"}, ... 216, ) }, ... 216, ) == 0x0
 01701   896   NtQueryValueKey  (216,  (216, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 01702   896   NtQueryValueKey  (216,  (216, "PackedCatalogItem", Partial, 144, ... , Partial, 144, ...
 01703  2016   NtOpenMutant  (0x100000, {24, 28, 0x0, 0, 0,  (0x100000, {24, 28, 0x0, 0, 0, "kkq-vx_mtx7"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01704  2016   NtOpenMutant  (0x100000, {24, 28, 0x0, 0, 0,  (0x100000, {24, 28, 0x0, 0, 0, "kkq-vx_mtx8"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01705  2016   NtOpenMutant  (0x100000, {24, 28, 0x0, 0, 0,  (0x100000, {24, 28, 0x0, 0, 0, "kkq-vx_mtx9"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01706  2016   NtOpenMutant  (0x100000, {24, 28, 0x0, 0, 0,  (0x100000, {24, 28, 0x0, 0, 0, "kkq-vx_mtx10"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01707  2016   NtOpenMutant  (0x100000, {24, 28, 0x0, 0, 0,  (0x100000, {24, 28, 0x0, 0, 0, "kkq-vx_mtx11"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01708  2016   NtOpenMutant  (0x100000, {24, 28, 0x0, 0, 0,  (0x100000, {24, 28, 0x0, 0, 0, "kkq-vx_mtx12"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01702   896   NtQueryValueKey  ... ) == STATUS_BUFFER_OVERFLOW
 01709   896   NtQueryValueKey  (216,  (216, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\16\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\10\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\31\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\5\0\0\0\0\0\0\200\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\00\0D\04\03\00\0A\06\0F\0-\00\04\01\00\0-\04\0A\06\08\0-\09\0\0\0\0\0\204\3\0\0\256\6\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0\330\0\0\0\256\6\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\257\6\0\0\344\4\0\0\200\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0\304\0\0\0h\374"\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\260(W\0\0\0\0\00\00\00\00\00\00\00\00\00\00\01\04\0\257\6\0\0\344\4\0\0\200\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0\330\0\0\0\260\6\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\330\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0W\0\2\0\0\0\220\0\0\0\260\6\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\261\6\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\330\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) , Partial, 900, ... TitleIdx=0, Type=3, Data= (216, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\16\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\10\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\31\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\5\0\0\0\0\0\0\200\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\00\0D\04\03\00\0A\06\0F\0-\00\04\01\00\0-\04\0A\06\08\0-\09\0\0\0\0\0\204\3\0\0\256\6\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0\330\0\0\0\256\6\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\257\6\0\0\344\4\0\0\200\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0\304\0\0\0h\374"\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\260(W\0\0\0\0\00\00\00\00\00\00\00\00\00\00\01\04\0\257\6\0\0\344\4\0\0\200\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0\330\0\0\0\260\6\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\330\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0W\0\2\0\0\0\220\0\0\0\260\6\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\261\6\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\330\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) \0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\260(W\0\0\0\0\00\00\00\00\00\00\00\00\00\00\01\04\0\257\6\0\0\344\4\0\0\200\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0\330\0\0\0\260\6\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\330\0\0\0\0\0\0\0 (216, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\16\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\10\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\31\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\5\0\0\0\0\0\0\200\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\00\0D\04\03\00\0A\06\0F\0-\00\04\01\00\0-\04\0A\06\08\0-\09\0\0\0\0\0\204\3\0\0\256\6\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0\330\0\0\0\256\6\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\257\6\0\0\344\4\0\0\200\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0\304\0\0\0h\374"\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\260(W\0\0\0\0\00\00\00\00\00\00\00\00\00\00\01\04\0\257\6\0\0\344\4\0\0\200\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0\330\0\0\0\260\6\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\330\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0W\0\2\0\0\0\220\0\0\0\260\6\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\261\6\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\330\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) \0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) == 0x0
 01710   896   NtClose  (216, ... ) == 0x0
 01711   896   NtOpenKey  (0x20019, {24, 196, 0x40, 0, 0,  (0x20019, {24, 196, 0x40, 0, 0, "000000000014"}, ... 216, ) }, ... 216, ) == 0x0
 01712   896   NtQueryValueKey  (216,  (216, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 01713   896   NtQueryValueKey  (216,  (216, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 01714   896   NtQueryValueKey  (216,  (216, "PackedCatalogItem", Partial, 900, ... , Partial, 900, ...
 01715  2016   NtOpenMutant  (0x100000, {24, 28, 0x0, 0, 0,  (0x100000, {24, 28, 0x0, 0, 0, "kkq-vx_mtx13"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01716  2016   NtOpenMutant  (0x100000, {24, 28, 0x0, 0, 0,  (0x100000, {24, 28, 0x0, 0, 0, "kkq-vx_mtx14"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01717  2016   NtOpenMutant  (0x100000, {24, 28, 0x0, 0, 0,  (0x100000, {24, 28, 0x0, 0, 0, "kkq-vx_mtx15"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01718  2016   NtOpenMutant  (0x100000, {24, 28, 0x0, 0, 0,  (0x100000, {24, 28, 0x0, 0, 0, "kkq-vx_mtx16"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01719  2016   NtOpenMutant  (0x100000, {24, 28, 0x0, 0, 0,  (0x100000, {24, 28, 0x0, 0, 0, "kkq-vx_mtx17"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01720  2016   NtOpenMutant  (0x100000, {24, 28, 0x0, 0, 0,  (0x100000, {24, 28, 0x0, 0, 0, "kkq-vx_mtx18"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01714   896   NtQueryValueKey  ... TitleIdx=0, Type=3, Data= ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\11\2\2\0\0\0\0\0\0\0\0\0\0\0\0\0\10\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\32\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\2\0\0\0\0\0\0\200\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\00\0D\04\03\00\0A\06\0F\0-\00\04\01\00\0-\04\0A\06\08\0-\09\0\0\0\0\0\204\3\0\0\271\6\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0\330\0\0\0\271\6\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\272\6\0\0\344\4\0\0\200\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0\304\0\0\0h\374"\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\260(W\0\0\0\0\00\00\00\00\00\00\00\00\00\00\01\05\0\272\6\0\0\344\4\0\0\200\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0\330\0\0\0\273\6\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\330\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0W\0\2\0\0\0\220\0\0\0\273\6\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\274\6\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\330\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) \0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\260(W\0\0\0\0\00\00\00\00\00\00\00\00\00\00\01\05\0\272\6\0\0\344\4\0\0\200\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0\330\0\0\0\273\6\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\330\0\0\0\0\0\0\0 ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\11\2\2\0\0\0\0\0\0\0\0\0\0\0\0\0\10\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\32\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\2\0\0\0\0\0\0\200\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\00\0D\04\03\00\0A\06\0F\0-\00\04\01\00\0-\04\0A\06\08\0-\09\0\0\0\0\0\204\3\0\0\271\6\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0\330\0\0\0\271\6\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\272\6\0\0\344\4\0\0\200\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0\304\0\0\0h\374"\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\260(W\0\0\0\0\00\00\00\00\00\00\00\00\00\00\01\05\0\272\6\0\0\344\4\0\0\200\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0\330\0\0\0\273\6\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\330\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0W\0\2\0\0\0\220\0\0\0\273\6\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\274\6\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\330\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) \0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) == 0x0
 01721   896   NtClose  (216, ... ) == 0x0
 01722   896   NtOpenKey  (0x20019, {24, 196, 0x40, 0, 0,  (0x20019, {24, 196, 0x40, 0, 0, "000000000015"}, ... 216, ) }, ... 216, ) == 0x0
 01723   896   NtQueryValueKey  (216,  (216, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 01724   896   NtQueryValueKey  (216,  (216, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 01725   896   NtQueryValueKey  (216,  (216, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\16\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\33\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\5\0\0\0\377\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\08\0A\0D\04\0D\08\00\06\0-\00\08\01\0B\0-\04\04\04\06\0-\0A\0\0\0\0\0\204\3\0\0\276\6\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0\330\0\0\0\277\6\0\0\344\4\0\0\340\7\0\0R\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\0\0\20\0\0\0\0\0\30\0\0\0\34\0\0\0\370\374\225\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\0\354\375\177\0\0\0\0k\0k\0q\0-\0v\0x\0_\0m\0t\0x\01\09\0\277\6\0\0\344\4\0\0\340\7\0\0R\0\0\0\1\0\1\04\0\0\300\0\0\0\0\300\6\0\0\344\4\0\0\340\7\0\0R\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\0\0\20\0\0\0\0\0\30\0\0\0\34\0\0\0\370\374\225\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\0\354\375\177\0\0\0\0k\0k\0q\0-\0v\0x\0_\0m\0t\0x\02\00\0\300\6\0\0\344\4\0\0\340\7\0\0R\0\0\0\1\0\1\04\0\0\300\0\0\0\0\301\6\0\0\344\4\0\0\340\7\0\0R\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\0\0\20\0\0\0\0\0\30\0\0\0\34\0\0\0\370\374\225\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\0\354\375\177\0\0\0\0k\0k\0q\0-\0v\0x\0_\0m\0t\0x\02\01\0\301\6\0\0"}, 900, ) , Partial, 900, ... TitleIdx=0, Type=3, Data= (216, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\16\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\33\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\5\0\0\0\377\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\08\0A\0D\04\0D\08\00\06\0-\00\08\01\0B\0-\04\04\04\06\0-\0A\0\0\0\0\0\204\3\0\0\276\6\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0\330\0\0\0\277\6\0\0\344\4\0\0\340\7\0\0R\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\0\0\20\0\0\0\0\0\30\0\0\0\34\0\0\0\370\374\225\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\0\354\375\177\0\0\0\0k\0k\0q\0-\0v\0x\0_\0m\0t\0x\01\09\0\277\6\0\0\344\4\0\0\340\7\0\0R\0\0\0\1\0\1\04\0\0\300\0\0\0\0\300\6\0\0\344\4\0\0\340\7\0\0R\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\0\0\20\0\0\0\0\0\30\0\0\0\34\0\0\0\370\374\225\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\0\354\375\177\0\0\0\0k\0k\0q\0-\0v\0x\0_\0m\0t\0x\02\00\0\300\6\0\0\344\4\0\0\340\7\0\0R\0\0\0\1\0\1\04\0\0\300\0\0\0\0\301\6\0\0\344\4\0\0\340\7\0\0R\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\0\0\20\0\0\0\0\0\30\0\0\0\34\0\0\0\370\374\225\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\0\354\375\177\0\0\0\0k\0k\0q\0-\0v\0x\0_\0m\0t\0x\02\01\0\301\6\0\0"}, 900, ) }, 900, ) == 0x0
 01726   896   NtClose  (216, ...
 01727  2016   NtOpenMutant  (0x100000, {24, 28, 0x0, 0, 0,  (0x100000, {24, 28, 0x0, 0, 0, "kkq-vx_mtx19"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01728  2016   NtOpenMutant  (0x100000, {24, 28, 0x0, 0, 0,  (0x100000, {24, 28, 0x0, 0, 0, "kkq-vx_mtx20"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01729  2016   NtOpenMutant  (0x100000, {24, 28, 0x0, 0, 0,  (0x100000, {24, 28, 0x0, 0, 0, "kkq-vx_mtx21"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01730  2016   NtOpenMutant  (0x100000, {24, 28, 0x0, 0, 0,  (0x100000, {24, 28, 0x0, 0, 0, "kkq-vx_mtx22"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01731  2016   NtOpenMutant  (0x100000, {24, 28, 0x0, 0, 0,  (0x100000, {24, 28, 0x0, 0, 0, "kkq-vx_mtx23"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01732  2016   NtOpenMutant  (0x100000, {24, 28, 0x0, 0, 0,  (0x100000, {24, 28, 0x0, 0, 0, "kkq-vx_mtx24"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01726   896   NtClose  ... ) == 0x0
 01733   896   NtOpenKey  (0x20019, {24, 196, 0x40, 0, 0,  (0x20019, {24, 196, 0x40, 0, 0, "000000000016"}, ... 216, ) }, ... 216, ) == 0x0
 01734   896   NtQueryValueKey  (216,  (216, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 01735   896   NtQueryValueKey  (216,  (216, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 01736   896   NtQueryValueKey  (216,  (216, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\11\2\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\34\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\2\0\0\0\377\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\08\0A\0D\04\0D\08\00\06\0-\00\08\01\0B\0-\04\04\04\06\0-\0A\0\0\0\0\0\204\3\0\0\311\6\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0\330\0\0\0\311\6\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\312\6\0\0\344\4\0\0\200\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0\304\0\0\0h\374"\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\260(W\0\0\0\0\00\00\00\00\00\00\00\00\00\00\01\07\0\313\6\0\0\344\4\0\0\340\7\0\0R\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\0\0\20\0\0\0\0\0\30\0\0\0\34\0\0\0\370\374\225\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\0\354\375\177\0\0\0\0k\0k\0q\0-\0v\0x\0_\0m\0t\0x\02\05\0\313\6\0\0\344\4\0\0\340\7\0\0R\0\0\0\1\0\1\04\0\0\300\0\0\0\0\314\6\0\0\344\4\0\0\340\7\0\0R\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\0\0\20\0\0\0\0\0\30\0\0\0\34\0\0\0\370\374\225\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\0\354\375\177\0\0\0\0k\0k\0q\0-\0v\0x\0_\0m\0t\0x\02\06\0\314\6\0\0"}, 900, ) , Partial, 900, ... TitleIdx=0, Type=3, Data= (216, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\11\2\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\34\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\2\0\0\0\377\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\08\0A\0D\04\0D\08\00\06\0-\00\08\01\0B\0-\04\04\04\06\0-\0A\0\0\0\0\0\204\3\0\0\311\6\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0\330\0\0\0\311\6\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\312\6\0\0\344\4\0\0\200\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0\304\0\0\0h\374"\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\260(W\0\0\0\0\00\00\00\00\00\00\00\00\00\00\01\07\0\313\6\0\0\344\4\0\0\340\7\0\0R\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\0\0\20\0\0\0\0\0\30\0\0\0\34\0\0\0\370\374\225\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\0\354\375\177\0\0\0\0k\0k\0q\0-\0v\0x\0_\0m\0t\0x\02\05\0\313\6\0\0\344\4\0\0\340\7\0\0R\0\0\0\1\0\1\04\0\0\300\0\0\0\0\314\6\0\0\344\4\0\0\340\7\0\0R\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\0\0\20\0\0\0\0\0\30\0\0\0\34\0\0\0\370\374\225\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\0\354\375\177\0\0\0\0k\0k\0q\0-\0v\0x\0_\0m\0t\0x\02\06\0\314\6\0\0"}, 900, ) \0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\260(W\0\0\0\0\00\00\00\00\00\00\00\00\00\00\01\07\0\313\6\0\0\344\4\0\0\340\7\0\0R\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\0\0\20\0\0\0\0\0\30\0\0\0\34\0\0\0\370\374\225\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\0\354\375\177\0\0\0\0k\0k\0q\0-\0v\0x\0_\0m\0t\0x\02\05\0\313\6\0\0\344\4\0\0\340\7\0\0R\0\0\0\1\0\1\04\0\0\300\0\0\0\0\314\6\0\0\344\4\0\0\340\7\0\0R\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\0\0\20\0\0\0\0\0\30\0\0\0\34\0\0\0\370\374\225\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\0\354\375\177\0\0\0\0k\0k\0q\0-\0v\0x\0_\0m\0t\0x\02\06\0\314\6\0\0"}, 900, ) == 0x0
 01737   896   NtClose  (216, ... ) == 0x0
 01738   896   NtOpenKey  (0x20019, {24, 196, 0x40, 0, 0,  (0x20019, {24, 196, 0x40, 0, 0, "000000000017"}, ... }, ...
 01739  2016   NtOpenMutant  (0x100000, {24, 28, 0x0, 0, 0,  (0x100000, {24, 28, 0x0, 0, 0, "kkq-vx_mtx25"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01740  2016   NtOpenMutant  (0x100000, {24, 28, 0x0, 0, 0,  (0x100000, {24, 28, 0x0, 0, 0, "kkq-vx_mtx26"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01741  2016   NtOpenMutant  (0x100000, {24, 28, 0x0, 0, 0,  (0x100000, {24, 28, 0x0, 0, 0, "kkq-vx_mtx27"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01742  2016   NtOpenMutant  (0x100000, {24, 28, 0x0, 0, 0,  (0x100000, {24, 28, 0x0, 0, 0, "kkq-vx_mtx28"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01743  2016   NtOpenMutant  (0x100000, {24, 28, 0x0, 0, 0,  (0x100000, {24, 28, 0x0, 0, 0, "kkq-vx_mtx29"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01744  2016   NtOpenMutant  (0x100000, {24, 28, 0x0, 0, 0,  (0x100000, {24, 28, 0x0, 0, 0, "kkq-vx_mtx30"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01738   896   NtOpenKey  ... 216, ) == 0x0
 01745   896   NtQueryValueKey  (216,  (216, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 01746   896   NtQueryValueKey  (216,  (216, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 01747   896   NtQueryValueKey  (216,  (216, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\16\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\35\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\5\0\0\0\376\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\0E\05\05\09\0B\00\0C\01\0-\0F\0A\04\06\0-\04\06\04\0D\0-\0B\0\0\0\0\0\204\3\0\0\324\6\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0\330\0\0\0\324\6\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\325\6\0\0\344\4\0\0\200\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0\304\0\0\0h\374"\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\260(W\0\0\0\0\00\00\00\00\00\00\00\00\00\00\01\08\0\325\6\0\0\344\4\0\0\200\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0\330\0\0\0\326\6\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\330\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0W\0\2\0\0\0\220\0\0\0\327\6\0\0\344\4\0\0\340\7\0\0R\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\0\0\20\0\0\0\0\0\30\0\0\0\34\0\0\0\370\374\225\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\0\354\375\177\0\0\0\0k\0k\0q\0-\0v\0x\0_\0m\0t\0x\03\01\0\327\6\0\0"}, 900, ) , Partial, 900, ... TitleIdx=0, Type=3, Data= (216, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\16\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\35\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\5\0\0\0\376\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\0E\05\05\09\0B\00\0C\01\0-\0F\0A\04\06\0-\04\06\04\0D\0-\0B\0\0\0\0\0\204\3\0\0\324\6\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0\330\0\0\0\324\6\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\325\6\0\0\344\4\0\0\200\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0\304\0\0\0h\374"\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\260(W\0\0\0\0\00\00\00\00\00\00\00\00\00\00\01\08\0\325\6\0\0\344\4\0\0\200\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0\330\0\0\0\326\6\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\330\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0W\0\2\0\0\0\220\0\0\0\327\6\0\0\344\4\0\0\340\7\0\0R\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\0\0\20\0\0\0\0\0\30\0\0\0\34\0\0\0\370\374\225\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\0\354\375\177\0\0\0\0k\0k\0q\0-\0v\0x\0_\0m\0t\0x\03\01\0\327\6\0\0"}, 900, ) \0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\260(W\0\0\0\0\00\00\00\00\00\00\00\00\00\00\01\08\0\325\6\0\0\344\4\0\0\200\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0\330\0\0\0\326\6\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\330\0\0\0\0\0\0\0 (216, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\16\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\35\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\5\0\0\0\376\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\0E\05\05\09\0B\00\0C\01\0-\0F\0A\04\06\0-\04\06\04\0D\0-\0B\0\0\0\0\0\204\3\0\0\324\6\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0\330\0\0\0\324\6\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\325\6\0\0\344\4\0\0\200\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0\304\0\0\0h\374"\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\260(W\0\0\0\0\00\00\00\00\00\00\00\00\00\00\01\08\0\325\6\0\0\344\4\0\0\200\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0\330\0\0\0\326\6\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\330\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0W\0\2\0\0\0\220\0\0\0\327\6\0\0\344\4\0\0\340\7\0\0R\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\0\0\20\0\0\0\0\0\30\0\0\0\34\0\0\0\370\374\225\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\0\354\375\177\0\0\0\0k\0k\0q\0-\0v\0x\0_\0m\0t\0x\03\01\0\327\6\0\0"}, 900, ) }, 900, ) == 0x0
 01748   896   NtClose  (216, ... ) == 0x0
 01749   896   NtOpenKey  (0x20019, {24, 196, 0x40, 0, 0,  (0x20019, {24, 196, 0x40, 0, 0, "000000000018"}, ... 216, ) }, ... 216, ) == 0x0
 01750   896   NtQueryValueKey  (216,  (216, "PackedCatalogItem", Partial, 144, ... , Partial, 144, ...
 01751  2016   NtOpenMutant  (0x100000, {24, 28, 0x0, 0, 0,  (0x100000, {24, 28, 0x0, 0, 0, "kkq-vx_mtx31"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01752  2016   NtOpenMutant  (0x100000, {24, 28, 0x0, 0, 0,  (0x100000, {24, 28, 0x0, 0, 0, "kkq-vx_mtx32"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01753  2016   NtOpenMutant  (0x100000, {24, 28, 0x0, 0, 0,  (0x100000, {24, 28, 0x0, 0, 0, "kkq-vx_mtx33"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01754  2016   NtOpenMutant  (0x100000, {24, 28, 0x0, 0, 0,  (0x100000, {24, 28, 0x0, 0, 0, "kkq-vx_mtx34"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01755  2016   NtOpenMutant  (0x100000, {24, 28, 0x0, 0, 0,  (0x100000, {24, 28, 0x0, 0, 0, "kkq-vx_mtx35"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01756  2016   NtOpenMutant  (0x100000, {24, 28, 0x0, 0, 0,  (0x100000, {24, 28, 0x0, 0, 0, "kkq-vx_mtx36"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01750   896   NtQueryValueKey  ... ) == STATUS_BUFFER_OVERFLOW
 01757   896   NtQueryValueKey  (216,  (216, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 01758   896   NtQueryValueKey  (216,  (216, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\11\2\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\36\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\2\0\0\0\376\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\0E\05\05\09\0B\00\0C\01\0-\0F\0A\04\06\0-\04\06\04\0D\0-\0B\0\0\0\0\0\204\3\0\0\337\6\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0\330\0\0\0\337\6\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\340\6\0\0\344\4\0\0\200\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0\304\0\0\0h\374"\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\260(W\0\0\0\0\00\00\00\00\00\00\00\00\00\00\01\09\0\340\6\0\0\344\4\0\0\200\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0\330\0\0\0\341\6\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\330\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0W\0\2\0\0\0\220\0\0\0\341\6\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\342\6\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\330\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) , Partial, 900, ... TitleIdx=0, Type=3, Data= (216, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\11\2\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\36\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\2\0\0\0\376\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\0E\05\05\09\0B\00\0C\01\0-\0F\0A\04\06\0-\04\06\04\0D\0-\0B\0\0\0\0\0\204\3\0\0\337\6\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0\330\0\0\0\337\6\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\340\6\0\0\344\4\0\0\200\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0\304\0\0\0h\374"\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\260(W\0\0\0\0\00\00\00\00\00\00\00\00\00\00\01\09\0\340\6\0\0\344\4\0\0\200\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0\330\0\0\0\341\6\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\330\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0W\0\2\0\0\0\220\0\0\0\341\6\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\342\6\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\330\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) \0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\260(W\0\0\0\0\00\00\00\00\00\00\00\00\00\00\01\09\0\340\6\0\0\344\4\0\0\200\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0\330\0\0\0\341\6\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\330\0\0\0\0\0\0\0 (216, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\11\2\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\36\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\2\0\0\0\376\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\0E\05\05\09\0B\00\0C\01\0-\0F\0A\04\06\0-\04\06\04\0D\0-\0B\0\0\0\0\0\204\3\0\0\337\6\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0\330\0\0\0\337\6\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\340\6\0\0\344\4\0\0\200\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0\304\0\0\0h\374"\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\260(W\0\0\0\0\00\00\00\00\00\00\00\00\00\00\01\09\0\340\6\0\0\344\4\0\0\200\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0\330\0\0\0\341\6\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\330\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0W\0\2\0\0\0\220\0\0\0\341\6\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\342\6\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\330\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) \0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) == 0x0
 01759   896   NtClose  (216, ... ) == 0x0
 01760   896   NtOpenKey  (0x20019, {24, 196, 0x40, 0, 0,  (0x20019, {24, 196, 0x40, 0, 0, "000000000019"}, ... 216, ) }, ... 216, ) == 0x0
 01761   896   NtQueryValueKey  (216,  (216, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 01762   896   NtQueryValueKey  (216,  (216, "PackedCatalogItem", Partial, 144, ... , Partial, 144, ...
 01763  2016   NtOpenMutant  (0x100000, {24, 28, 0x0, 0, 0,  (0x100000, {24, 28, 0x0, 0, 0, "kkq-vx_mtx37"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01764  2016   NtOpenMutant  (0x100000, {24, 28, 0x0, 0, 0,  (0x100000, {24, 28, 0x0, 0, 0, "kkq-vx_mtx38"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01765  2016   NtOpenMutant  (0x100000, {24, 28, 0x0, 0, 0,  (0x100000, {24, 28, 0x0, 0, 0, "kkq-vx_mtx39"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01766  2016   NtOpenMutant  (0x100000, {24, 28, 0x0, 0, 0,  (0x100000, {24, 28, 0x0, 0, 0, "kkq-vx_mtx40"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01767  2016   NtOpenMutant  (0x100000, {24, 28, 0x0, 0, 0,  (0x100000, {24, 28, 0x0, 0, 0, "kkq-vx_mtx41"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01768  2016   NtOpenMutant  (0x100000, {24, 28, 0x0, 0, 0,  (0x100000, {24, 28, 0x0, 0, 0, "kkq-vx_mtx42"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01762   896   NtQueryValueKey  ... ) == STATUS_BUFFER_OVERFLOW
 01769   896   NtQueryValueKey  (216,  (216, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\16\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\37\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\5\0\0\0\372\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\0C\0D\03\0C\06\04\0B\08\0-\0D\0B\07\06\0-\04\04\0C\08\0-\09\0\0\0\0\0\204\3\0\0\352\6\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0\330\0\0\0\352\6\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\353\6\0\0\344\4\0\0\200\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0\304\0\0\0h\374"\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\260(W\0\0\0\0\00\00\00\00\00\00\00\00\00\00\02\00\0\353\6\0\0\344\4\0\0\200\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0\330\0\0\0\354\6\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\330\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0W\0\2\0\0\0\220\0\0\0\354\6\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\355\6\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\330\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) , Partial, 900, ... TitleIdx=0, Type=3, Data= (216, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\16\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\37\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\5\0\0\0\372\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\0C\0D\03\0C\06\04\0B\08\0-\0D\0B\07\06\0-\04\04\0C\08\0-\09\0\0\0\0\0\204\3\0\0\352\6\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0\330\0\0\0\352\6\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\353\6\0\0\344\4\0\0\200\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0\304\0\0\0h\374"\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\260(W\0\0\0\0\00\00\00\00\00\00\00\00\00\00\02\00\0\353\6\0\0\344\4\0\0\200\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0\330\0\0\0\354\6\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\330\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0W\0\2\0\0\0\220\0\0\0\354\6\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\355\6\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\330\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) \0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\260(W\0\0\0\0\00\00\00\00\00\00\00\00\00\00\02\00\0\353\6\0\0\344\4\0\0\200\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0\330\0\0\0\354\6\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\330\0\0\0\0\0\0\0 (216, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\16\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\37\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\5\0\0\0\372\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\0C\0D\03\0C\06\04\0B\08\0-\0D\0B\07\06\0-\04\04\0C\08\0-\09\0\0\0\0\0\204\3\0\0\352\6\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0\330\0\0\0\352\6\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\353\6\0\0\344\4\0\0\200\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0\304\0\0\0h\374"\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\260(W\0\0\0\0\00\00\00\00\00\00\00\00\00\00\02\00\0\353\6\0\0\344\4\0\0\200\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0\330\0\0\0\354\6\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\330\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0W\0\2\0\0\0\220\0\0\0\354\6\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\355\6\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\330\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) \0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) == 0x0
 01770   896   NtClose  (216, ... ) == 0x0
 01771   896   NtOpenKey  (0x20019, {24, 196, 0x40, 0, 0,  (0x20019, {24, 196, 0x40, 0, 0, "000000000020"}, ... 216, ) }, ... 216, ) == 0x0
 01772   896   NtQueryValueKey  (216,  (216, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 01773   896   NtQueryValueKey  (216,  (216, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 01774   896   NtQueryValueKey  (216,  (216, "PackedCatalogItem", Partial, 900, ... , Partial, 900, ...
 01775  2016   NtOpenMutant  (0x100000, {24, 28, 0x0, 0, 0,  (0x100000, {24, 28, 0x0, 0, 0, "kkq-vx_mtx43"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01776  2016   NtOpenMutant  (0x100000, {24, 28, 0x0, 0, 0,  (0x100000, {24, 28, 0x0, 0, 0, "kkq-vx_mtx44"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01777  2016   NtOpenMutant  (0x100000, {24, 28, 0x0, 0, 0,  (0x100000, {24, 28, 0x0, 0, 0, "kkq-vx_mtx45"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01778  2016   NtOpenMutant  (0x100000, {24, 28, 0x0, 0, 0,  (0x100000, {24, 28, 0x0, 0, 0, "kkq-vx_mtx46"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01779  2016   NtOpenMutant  (0x100000, {24, 28, 0x0, 0, 0,  (0x100000, {24, 28, 0x0, 0, 0, "kkq-vx_mtx47"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01780  2016   NtOpenMutant  (0x100000, {24, 28, 0x0, 0, 0,  (0x100000, {24, 28, 0x0, 0, 0, "kkq-vx_mtx48"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01774   896   NtQueryValueKey  ... TitleIdx=0, Type=3, Data= ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\11\2\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222 \4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\2\0\0\0\372\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\0C\0D\03\0C\06\04\0B\08\0-\0D\0B\07\06\0-\04\04\0C\08\0-\09\0\0\0\0\0\204\3\0\0\365\6\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0\330\0\0\0\365\6\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\366\6\0\0\344\4\0\0\200\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0\304\0\0\0h\374"\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\260(W\0\0\0\0\00\00\00\00\00\00\00\00\00\00\02\01\0\366\6\0\0\344\4\0\0\200\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0\330\0\0\0\367\6\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\330\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0W\0\2\0\0\0\220\0\0\0\367\6\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\370\6\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\330\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) \0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\260(W\0\0\0\0\00\00\00\00\00\00\00\00\00\00\02\01\0\366\6\0\0\344\4\0\0\200\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0\330\0\0\0\367\6\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\330\0\0\0\0\0\0\0 ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\11\2\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222 \4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\2\0\0\0\372\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\0C\0D\03\0C\06\04\0B\08\0-\0D\0B\07\06\0-\04\04\0C\08\0-\09\0\0\0\0\0\204\3\0\0\365\6\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0\330\0\0\0\365\6\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\366\6\0\0\344\4\0\0\200\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0\304\0\0\0h\374"\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\260(W\0\0\0\0\00\00\00\00\00\00\00\00\00\00\02\01\0\366\6\0\0\344\4\0\0\200\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0\330\0\0\0\367\6\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\330\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0W\0\2\0\0\0\220\0\0\0\367\6\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\370\6\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\330\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) \0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) == 0x0
 01781   896   NtClose  (216, ... ) == 0x0
 01782   896   NtOpenKey  (0x20019, {24, 196, 0x40, 0, 0,  (0x20019, {24, 196, 0x40, 0, 0, "000000000021"}, ... 216, ) }, ... 216, ) == 0x0
 01783   896   NtQueryValueKey  (216,  (216, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 01784   896   NtQueryValueKey  (216,  (216, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 01785   896   NtAllocateVirtualMemory  (-1, 5722112, 0, 4096, 4096, 4, ... 5722112, 4096, ) == 0x0
 01786   896   NtQueryValueKey  (216,  (216, "PackedCatalogItem", Partial, 900, ... , Partial, 900, ...
 01787  2016   NtOpenMutant  (0x100000, {24, 28, 0x0, 0, 0,  (0x100000, {24, 28, 0x0, 0, 0, "kkq-vx_mtx49"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01788  2016   NtOpenMutant  (0x100000, {24, 28, 0x0, 0, 0,  (0x100000, {24, 28, 0x0, 0, 0, "kkq-vx_mtx50"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01789  2016   NtOpenMutant  (0x100000, {24, 28, 0x0, 0, 0,  (0x100000, {24, 28, 0x0, 0, 0, "kkq-vx_mtx51"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01790  2016   NtOpenMutant  (0x100000, {24, 28, 0x0, 0, 0,  (0x100000, {24, 28, 0x0, 0, 0, "kkq-vx_mtx52"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01791  2016   NtOpenMutant  (0x100000, {24, 28, 0x0, 0, 0,  (0x100000, {24, 28, 0x0, 0, 0, "kkq-vx_mtx53"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01792  2016   NtOpenMutant  (0x100000, {24, 28, 0x0, 0, 0,  (0x100000, {24, 28, 0x0, 0, 0, "kkq-vx_mtx54"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01786   896   NtQueryValueKey  ... TitleIdx=0, Type=3, Data= ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\16\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222!\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\5\0\0\0\371\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\02\01\0B\08\0E\09\0D\05\0-\03\0F\0C\03\0-\04\0F\09\0D\0-\08\0\0\0\0\0\204\3\0\0\1\7\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0\330\0\0\0\1\7\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\2\7\0\0\344\4\0\0\200\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0\304\0\0\0h\374"\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\260(W\0\0\0\0\00\00\00\00\00\00\00\00\00\00\02\02\0\2\7\0\0\344\4\0\0\200\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0\330\0\0\0\3\7\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\330\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0W\0\2\0\0\0\220\0\0\0\3\7\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\4\7\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\330\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) \0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\260(W\0\0\0\0\00\00\00\00\00\00\00\00\00\00\02\02\0\2\7\0\0\344\4\0\0\200\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0\330\0\0\0\3\7\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\330\0\0\0\0\0\0\0 ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\16\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222!\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\5\0\0\0\371\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\02\01\0B\08\0E\09\0D\05\0-\03\0F\0C\03\0-\04\0F\09\0D\0-\08\0\0\0\0\0\204\3\0\0\1\7\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0\330\0\0\0\1\7\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\2\7\0\0\344\4\0\0\200\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0\304\0\0\0h\374"\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\260(W\0\0\0\0\00\00\00\00\00\00\00\00\00\00\02\02\0\2\7\0\0\344\4\0\0\200\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0\330\0\0\0\3\7\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\330\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0W\0\2\0\0\0\220\0\0\0\3\7\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\4\7\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0\330\0\0\0\0\0\0\0"\0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) \0\12\2\0\374\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) == 0x0
 01793   896   NtClose  (216, ... ) == 0x0
 01794   896   NtOpenKey  (0x20019, {24, 196, 0x40, 0, 0,  (0x20019, {24, 196, 0x40, 0, 0, "000000000022"}, ... 216, ) }, ... 216, ) == 0x0
 01795   896   NtQueryValueKey  (216,  (216, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 01796   896   NtQueryValueKey  (216,  (216, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 01797   896   NtQueryValueKey  (216,  (216, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\11\2\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222"\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\2\0\0\0\371\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\02\01\0B\08\0E\09\0D\05\0-\03\0F\0C\03\0-\04\0F\09\0D\0-\08\0\0\0\0\0\204\3\0\0\6\7\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0\330\0\0\0\7\7\0\0\344\4\0\0\340\7\0\0R\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\0\0\20\0\0\0\0\0\30\0\0\0\34\0\0\0\370\374\225\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\0\354\375\177\0\0\0\0k\0k\0q\0-\0v\0x\0_\0m\0t\0x\05\05\0\7\7\0\0\344\4\0\0\340\7\0\0R\0\0\0\1\0\1\04\0\0\300\0\0\0\0\10\7\0\0\344\4\0\0\340\7\0\0R\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\0\0\20\0\0\0\0\0\30\0\0\0\34\0\0\0\370\374\225\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\0\354\375\177\0\0\0\0k\0k\0q\0-\0v\0x\0_\0m\0t\0x\05\06\0\10\7\0\0\344\4\0\0\340\7\0\0R\0\0\0\1\0\1\04\0\0\300\0\0\0\0\11\7\0\0\344\4\0\0\340\7\0\0R\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\0\0\20\0\0\0\0\0\30\0\0\0\34\0\0\0\370\374\225\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\0\354\375\177\0\0\0\0k\0k\0q\0-\0v\0x\0_\0m\0t\0x\05\07\0\11\7\0\0"}, 900, ) , Partial, 900, ... TitleIdx=0, Type=3, Data= (216, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\11\2\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222"\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\2\0\0\0\371\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\02\01\0B\08\0E\09\0D\05\0-\03\0F\0C\03\0-\04\0F\09\0D\0-\08\0\0\0\0\0\204\3\0\0\6\7\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0\330\0\0\0\7\7\0\0\344\4\0\0\340\7\0\0R\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\0\0\20\0\0\0\0\0\30\0\0\0\34\0\0\0\370\374\225\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\0\354\375\177\0\0\0\0k\0k\0q\0-\0v\0x\0_\0m\0t\0x\05\05\0\7\7\0\0\344\4\0\0\340\7\0\0R\0\0\0\1\0\1\04\0\0\300\0\0\0\0\10\7\0\0\344\4\0\0\340\7\0\0R\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\0\0\20\0\0\0\0\0\30\0\0\0\34\0\0\0\370\374\225\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\0\354\375\177\0\0\0\0k\0k\0q\0-\0v\0x\0_\0m\0t\0x\05\06\0\10\7\0\0\344\4\0\0\340\7\0\0R\0\0\0\1\0\1\04\0\0\300\0\0\0\0\11\7\0\0\344\4\0\0\340\7\0\0R\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\0\0\20\0\0\0\0\0\30\0\0\0\34\0\0\0\370\374\225\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\0\354\375\177\0\0\0\0k\0k\0q\0-\0v\0x\0_\0m\0t\0x\05\07\0\11\7\0\0"}, 900, ) \4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\2\0\0\0\371\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\02\01\0B\08\0E\09\0D\05\0-\03\0F\0C\03\0-\04\0F\09\0D\0-\08\0\0\0\0\0\204\3\0\0\6\7\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0\330\0\0\0\7\7\0\0\344\4\0\0\340\7\0\0R\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\0\0\20\0\0\0\0\0\30\0\0\0\34\0\0\0\370\374\225\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\0\354\375\177\0\0\0\0k\0k\0q\0-\0v\0x\0_\0m\0t\0x\05\05\0\7\7\0\0\344\4\0\0\340\7\0\0R\0\0\0\1\0\1\04\0\0\300\0\0\0\0\10\7\0\0\344\4\0\0\340\7\0\0R\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\0\0\20\0\0\0\0\0\30\0\0\0\34\0\0\0\370\374\225\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\0\354\375\177\0\0\0\0k\0k\0q\0-\0v\0x\0_\0m\0t\0x\05\06\0\10\7\0\0\344\4\0\0\340\7\0\0R\0\0\0\1\0\1\04\0\0\300\0\0\0\0\11\7\0\0\344\4\0\0\340\7\0\0R\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\0\0\20\0\0\0\0\0\30\0\0\0\34\0\0\0\370\374\225\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\0\354\375\177\0\0\0\0k\0k\0q\0-\0v\0x\0_\0m\0t\0x\05\07\0\11\7\0\0"}, 900, ) == 0x0
 01798   896   NtClose  (216, ...
 01799  2016   NtOpenMutant  (0x100000, {24, 28, 0x0, 0, 0,  (0x100000, {24, 28, 0x0, 0, 0, "kkq-vx_mtx55"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01800  2016   NtOpenMutant  (0x100000, {24, 28, 0x0, 0, 0,  (0x100000, {24, 28, 0x0, 0, 0, "kkq-vx_mtx56"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01801  2016   NtOpenMutant  (0x100000, {24, 28, 0x0, 0, 0,  (0x100000, {24, 28, 0x0, 0, 0, "kkq-vx_mtx57"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01802  2016   NtOpenMutant  (0x100000, {24, 28, 0x0, 0, 0,  (0x100000, {24, 28, 0x0, 0, 0, "kkq-vx_mtx58"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01803  2016   NtOpenMutant  (0x100000, {24, 28, 0x0, 0, 0,  (0x100000, {24, 28, 0x0, 0, 0, "kkq-vx_mtx59"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01804  2016   NtOpenMutant  (0x100000, {24, 28, 0x0, 0, 0,  (0x100000, {24, 28, 0x0, 0, 0, "kkq-vx_mtx60"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01798   896   NtClose  ... ) == 0x0
 01805   896   NtClose  (196, ... ) == 0x0
 01806   896   NtWaitForSingleObject  (188, 0, {0, 0}, ... ) == 0x102
 01807   896   NtCreateEvent  (0x1f0003, 0x0, 0, 0, ... 196, ) == 0x0
 01808   896   NtOpenKey  (0x2000000, {24, 184, 0x40, 0, 0,  (0x2000000, {24, 184, 0x40, 0, 0, "NameSpace_Catalog5"}, ... 216, ) }, ... 216, ) == 0x0
 01809   896   NtQueryValueKey  (216,  (216, "Serial_Access_Num", Partial, 144, ... TitleIdx=0, Type=4, Data="\5\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (216, "Serial_Access_Num", Partial, 144, ... TitleIdx=0, Type=4, Data="\5\0\0\0"}, 16, ) }, 16, ) == 0x0
 01810  2016   NtOpenMutant  (0x100000, {24, 28, 0x0, 0, 0,  (0x100000, {24, 28, 0x0, 0, 0, "kkq-vx_mtx61"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01811  2016   NtOpenMutant  (0x100000, {24, 28, 0x0, 0, 0,  (0x100000, {24, 28, 0x0, 0, 0, "kkq-vx_mtx62"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01812  2016   NtOpenMutant  (0x100000, {24, 28, 0x0, 0, 0,  (0x100000, {24, 28, 0x0, 0, 0, "kkq-vx_mtx63"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01813  2016   NtOpenMutant  (0x100000, {24, 28, 0x0, 0, 0,  (0x100000, {24, 28, 0x0, 0, 0, "kkq-vx_mtx64"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01814  2016   NtOpenMutant  (0x100000, {24, 28, 0x0, 0, 0,  (0x100000, {24, 28, 0x0, 0, 0, "kkq-vx_mtx65"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01815  2016   NtOpenMutant  (0x100000, {24, 28, 0x0, 0, 0,  (0x100000, {24, 28, 0x0, 0, 0, "kkq-vx_mtx66"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01816   896   NtNotifyChangeKey  (216, 196, 0, 0, 2011455960, 1, 0, 0, 0, 1, ... ) == 0x103
 01817   896   NtQueryValueKey  (216,  (216, "Serial_Access_Num", Partial, 144, ... TitleIdx=0, Type=4, Data="\5\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (216, "Serial_Access_Num", Partial, 144, ... TitleIdx=0, Type=4, Data="\5\0\0\0"}, 16, ) }, 16, ) == 0x0
 01818   896   NtOpenKey  (0x2000000, {24, 216, 0x40, 0, 0,  (0x2000000, {24, 216, 0x40, 0, 0, "00000005"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01819   896   NtQueryValueKey  (216,  (216, "Num_Catalog_Entries", Partial, 144, ... TitleIdx=0, Type=4, Data="\4\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (216, "Num_Catalog_Entries", Partial, 144, ... TitleIdx=0, Type=4, Data="\4\0\0\0"}, 16, ) }, 16, ) == 0x0
 01820   896   NtOpenKey  (0x2000000, {24, 216, 0x40, 0, 0,  (0x2000000, {24, 216, 0x40, 0, 0, "Catalog_Entries"}, ... 200, ) }, ... 200, ) == 0x0
 01821   896   NtOpenKey  (0x20019, {24, 200, 0x40, 0, 0,  (0x20019, {24, 200, 0x40, 0, 0, "000000000001"}, ... 220, ) }, ... 220, ) == 0x0
 01822  2016   NtOpenMutant  (0x100000, {24, 28, 0x0, 0, 0,  (0x100000, {24, 28, 0x0, 0, 0, "kkq-vx_mtx67"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01823  2016   NtOpenMutant  (0x100000, {24, 28, 0x0, 0, 0,  (0x100000, {24, 28, 0x0, 0, 0, "kkq-vx_mtx68"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01824  2016   NtOpenMutant  (0x100000, {24, 28, 0x0, 0, 0,  (0x100000, {24, 28, 0x0, 0, 0, "kkq-vx_mtx69"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01825  2016   NtOpenMutant  (0x100000, {24, 28, 0x0, 0, 0,  (0x100000, {24, 28, 0x0, 0, 0, "kkq-vx_mtx70"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01826  2016   NtOpenMutant  (0x100000, {24, 28, 0x0, 0, 0,  (0x100000, {24, 28, 0x0, 0, 0, "kkq-vx_mtx71"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01827  2016   NtOpenMutant  (0x100000, {24, 28, 0x0, 0, 0,  (0x100000, {24, 28, 0x0, 0, 0, "kkq-vx_mtx72"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01828   896   NtQueryValueKey  (220,  (220, "LibraryPath", Partial, 144, ... TitleIdx=0, Type=1, Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0m\0s\0w\0s\0o\0c\0k\0.\0d\0l\0l\0\0\0"}, 80, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (220, "LibraryPath", Partial, 144, ... TitleIdx=0, Type=1, Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0m\0s\0w\0s\0o\0c\0k\0.\0d\0l\0l\0\0\0"}, 80, ) }, 80, ) == 0x0
 01829   896   NtQueryValueKey  (220,  (220, "LibraryPath", Partial, 144, ... TitleIdx=0, Type=1, Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0m\0s\0w\0s\0o\0c\0k\0.\0d\0l\0l\0\0\0"}, 80, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (220, "LibraryPath", Partial, 144, ... TitleIdx=0, Type=1, Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0m\0s\0w\0s\0o\0c\0k\0.\0d\0l\0l\0\0\0"}, 80, ) }, 80, ) == 0x0
 01830   896   NtQueryValueKey  (220,  (220, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="T\0c\0p\0i\0p\0\0\0"}, 24, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (220, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="T\0c\0p\0i\0p\0\0\0"}, 24, ) }, 24, ) == 0x0
 01831   896   NtQueryValueKey  (220,  (220, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="T\0c\0p\0i\0p\0\0\0"}, 24, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (220, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="T\0c\0p\0i\0p\0\0\0"}, 24, ) }, 24, ) == 0x0
 01832   896   NtQueryValueKey  (220,  (220, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="T\0c\0p\0i\0p\0\0\0"}, 24, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (220, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="T\0c\0p\0i\0p\0\0\0"}, 24, ) }, 24, ) == 0x0
 01833   896   NtQueryValueKey  (220,  (220, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="T\0c\0p\0i\0p\0\0\0"}, 24, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (220, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="T\0c\0p\0i\0p\0\0\0"}, 24, ) }, 24, ) == 0x0
 01834  2016   NtOpenMutant  (0x100000, {24, 28, 0x0, 0, 0,  (0x100000, {24, 28, 0x0, 0, 0, "kkq-vx_mtx73"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01835  2016   NtOpenMutant  (0x100000, {24, 28, 0x0, 0, 0,  (0x100000, {24, 28, 0x0, 0, 0, "kkq-vx_mtx74"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01836  2016   NtOpenMutant  (0x100000, {24, 28, 0x0, 0, 0,  (0x100000, {24, 28, 0x0, 0, 0, "kkq-vx_mtx75"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01837  2016   NtOpenMutant  (0x100000, {24, 28, 0x0, 0, 0,  (0x100000, {24, 28, 0x0, 0, 0, "kkq-vx_mtx76"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01838  2016   NtOpenMutant  (0x100000, {24, 28, 0x0, 0, 0,  (0x100000, {24, 28, 0x0, 0, 0, "kkq-vx_mtx77"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01839  2016   NtOpenMutant  (0x100000, {24, 28, 0x0, 0, 0,  (0x100000, {24, 28, 0x0, 0, 0, "kkq-vx_mtx78"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01840   896   NtQueryValueKey  (220,  (220, "ProviderId", Partial, 144, ... TitleIdx=0, Type=3, Data="@\235\5"\236~\317\21\256Z\0\252\0\247\21+"}, 28, ) , Partial, 144, ... TitleIdx=0, Type=3, Data= (220, "ProviderId", Partial, 144, ... TitleIdx=0, Type=3, Data="@\235\5"\236~\317\21\256Z\0\252\0\247\21+"}, 28, ) \236~\317\21\256Z\0\252\0\247\21+"}, 28, ) == 0x0
 01841   896   NtQueryValueKey  (220,  (220, "AddressFamily", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01842   896   NtQueryValueKey  (220,  (220, "SupportedNameSpace", Partial, 144, ... TitleIdx=0, Type=4, Data="\14\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (220, "SupportedNameSpace", Partial, 144, ... TitleIdx=0, Type=4, Data="\14\0\0\0"}, 16, ) }, 16, ) == 0x0
 01843   896   NtQueryValueKey  (220,  (220, "Enabled", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (220, "Enabled", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) }, 16, ) == 0x0
 01844   896   NtQueryValueKey  (220,  (220, "Version", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (220, "Version", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) }, 16, ) == 0x0
 01845   896   NtQueryValueKey  (220,  (220, "StoresServiceClassInfo", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (220, "StoresServiceClassInfo", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) }, 16, ) == 0x0
 01846  2016   NtOpenMutant  (0x100000, {24, 28, 0x0, 0, 0,  (0x100000, {24, 28, 0x0, 0, 0, "kkq-vx_mtx79"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01847  2016   NtOpenMutant  (0x100000, {24, 28, 0x0, 0, 0,  (0x100000, {24, 28, 0x0, 0, 0, "kkq-vx_mtx80"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01848  2016   NtOpenMutant  (0x100000, {24, 28, 0x0, 0, 0,  (0x100000, {24, 28, 0x0, 0, 0, "kkq-vx_mtx81"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01849  2016   NtOpenMutant  (0x100000, {24, 28, 0x0, 0, 0,  (0x100000, {24, 28, 0x0, 0, 0, "kkq-vx_mtx82"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01850  2016   NtOpenMutant  (0x100000, {24, 28, 0x0, 0, 0,  (0x100000, {24, 28, 0x0, 0, 0, "kkq-vx_mtx83"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01851  2016   NtOpenMutant  (0x100000, {24, 28, 0x0, 0, 0,  (0x100000, {24, 28, 0x0, 0, 0, "kkq-vx_mtx84"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01852   896   NtClose  (220, ... ) == 0x0
 01853   896   NtOpenKey  (0x20019, {24, 200, 0x40, 0, 0,  (0x20019, {24, 200, 0x40, 0, 0, "000000000002"}, ... 220, ) }, ... 220, ) == 0x0
 01854   896   NtQueryValueKey  (220,  (220, "LibraryPath", Partial, 144, ... TitleIdx=0, Type=1, Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0w\0i\0n\0r\0n\0r\0.\0d\0l\0l\0\0\0"}, 78, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (220, "LibraryPath", Partial, 144, ... TitleIdx=0, Type=1, Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0w\0i\0n\0r\0n\0r\0.\0d\0l\0l\0\0\0"}, 78, ) }, 78, ) == 0x0
 01855   896   NtQueryValueKey  (220,  (220, "LibraryPath", Partial, 144, ... TitleIdx=0, Type=1, Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0w\0i\0n\0r\0n\0r\0.\0d\0l\0l\0\0\0"}, 78, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (220, "LibraryPath", Partial, 144, ... TitleIdx=0, Type=1, Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0w\0i\0n\0r\0n\0r\0.\0d\0l\0l\0\0\0"}, 78, ) }, 78, ) == 0x0
 01856   896   NtQueryValueKey  (220,  (220, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="N\0T\0D\0S\0\0\0"}, 22, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (220, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="N\0T\0D\0S\0\0\0"}, 22, ) }, 22, ) == 0x0
 01857   896   NtQueryValueKey  (220,  (220, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="N\0T\0D\0S\0\0\0"}, 22, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (220, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="N\0T\0D\0S\0\0\0"}, 22, ) }, 22, ) == 0x0
 01858  2016   NtOpenMutant  (0x100000, {24, 28, 0x0, 0, 0,  (0x100000, {24, 28, 0x0, 0, 0, "kkq-vx_mtx85"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01859  2016   NtOpenMutant  (0x100000, {24, 28, 0x0, 0, 0,  (0x100000, {24, 28, 0x0, 0, 0, "kkq-vx_mtx86"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01860  2016   NtOpenMutant  (0x100000, {24, 28, 0x0, 0, 0,  (0x100000, {24, 28, 0x0, 0, 0, "kkq-vx_mtx87"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01861  2016   NtOpenMutant  (0x100000, {24, 28, 0x0, 0, 0,  (0x100000, {24, 28, 0x0, 0, 0, "kkq-vx_mtx88"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01862  2016   NtOpenMutant  (0x100000, {24, 28, 0x0, 0, 0,  (0x100000, {24, 28, 0x0, 0, 0, "kkq-vx_mtx89"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01863  2016   NtOpenMutant  (0x100000, {24, 28, 0x0, 0, 0,  (0x100000, {24, 28, 0x0, 0, 0, "kkq-vx_mtx90"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01864   896   NtQueryValueKey  (220,  (220, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="N\0T\0D\0S\0\0\0"}, 22, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (220, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="N\0T\0D\0S\0\0\0"}, 22, ) }, 22, ) == 0x0
 01865   896   NtQueryValueKey  (220,  (220, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="N\0T\0D\0S\0\0\0"}, 22, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (220, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="N\0T\0D\0S\0\0\0"}, 22, ) }, 22, ) == 0x0
 01866   896   NtQueryValueKey  (220,  (220, "ProviderId", Partial, 144, ... TitleIdx=0, Type=3, Data="\3567&;\200\345\317\21\245U\0\300O\330\324\254"}, 28, ) , Partial, 144, ... TitleIdx=0, Type=3, Data= (220, "ProviderId", Partial, 144, ... TitleIdx=0, Type=3, Data="\3567&;\200\345\317\21\245U\0\300O\330\324\254"}, 28, ) }, 28, ) == 0x0
 01867   896   NtQueryValueKey  (220,  (220, "AddressFamily", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01868   896   NtQueryValueKey  (220,  (220, "SupportedNameSpace", Partial, 144, ... TitleIdx=0, Type=4, Data=" \0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (220, "SupportedNameSpace", Partial, 144, ... TitleIdx=0, Type=4, Data=" \0\0\0"}, 16, ) }, 16, ) == 0x0
 01869   896   NtQueryValueKey  (220,  (220, "Enabled", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (220, "Enabled", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) }, 16, ) == 0x0
 01870  2016   NtOpenMutant  (0x100000, {24, 28, 0x0, 0, 0,  (0x100000, {24, 28, 0x0, 0, 0, "kkq-vx_mtx91"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01871  2016   NtOpenMutant  (0x100000, {24, 28, 0x0, 0, 0,  (0x100000, {24, 28, 0x0, 0, 0, "kkq-vx_mtx92"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01872  2016   NtOpenMutant  (0x100000, {24, 28, 0x0, 0, 0,  (0x100000, {24, 28, 0x0, 0, 0, "kkq-vx_mtx93"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01873  2016   NtOpenMutant  (0x100000, {24, 28, 0x0, 0, 0,  (0x100000, {24, 28, 0x0, 0, 0, "kkq-vx_mtx94"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01874  2016   NtOpenMutant  (0x100000, {24, 28, 0x0, 0, 0,  (0x100000, {24, 28, 0x0, 0, 0, "kkq-vx_mtx95"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01875  2016   NtOpenMutant  (0x100000, {24, 28, 0x0, 0, 0,  (0x100000, {24, 28, 0x0, 0, 0, "kkq-vx_mtx96"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01876   896   NtQueryValueKey  (220,  (220, "Version", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (220, "Version", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) }, 16, ) == 0x0
 01877   896   NtQueryValueKey  (220,  (220, "StoresServiceClassInfo", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (220, "StoresServiceClassInfo", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) }, 16, ) == 0x0
 01878   896   NtClose  (220, ... ) == 0x0
 01879   896   NtOpenKey  (0x20019, {24, 200, 0x40, 0, 0,  (0x20019, {24, 200, 0x40, 0, 0, "000000000003"}, ... 220, ) }, ... 220, ) == 0x0
 01880   896   NtQueryValueKey  (220,  (220, "LibraryPath", Partial, 144, ... TitleIdx=0, Type=1, Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0m\0s\0w\0s\0o\0c\0k\0.\0d\0l\0l\0\0\0"}, 80, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (220, "LibraryPath", Partial, 144, ... TitleIdx=0, Type=1, Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0m\0s\0w\0s\0o\0c\0k\0.\0d\0l\0l\0\0\0"}, 80, ) }, 80, ) == 0x0
 01881   896   NtQueryValueKey  (220,  (220, "LibraryPath", Partial, 144, ... TitleIdx=0, Type=1, Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0m\0s\0w\0s\0o\0c\0k\0.\0d\0l\0l\0\0\0"}, 80, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (220, "LibraryPath", Partial, 144, ... TitleIdx=0, Type=1, Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0m\0s\0w\0s\0o\0c\0k\0.\0d\0l\0l\0\0\0"}, 80, ) }, 80, ) == 0x0
 01882  2016   NtOpenMutant  (0x100000, {24, 28, 0x0, 0, 0,  (0x100000, {24, 28, 0x0, 0, 0, "kkq-vx_mtx97"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01883  2016   NtOpenMutant  (0x100000, {24, 28, 0x0, 0, 0,  (0x100000, {24, 28, 0x0, 0, 0, "kkq-vx_mtx98"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01884  2016   NtOpenMutant  (0x100000, {24, 28, 0x0, 0, 0,  (0x100000, {24, 28, 0x0, 0, 0, "kkq-vx_mtx99"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01885  2016   NtCreateMutant  (0x1f0001, {24, 28, 0x80, 0, 0,  (0x1f0001, {24, 28, 0x80, 0, 0, "kkq-vx_mtx1"}, 0, ... 224, ) }, 0, ... 224, ) == 0x0
 01886  2016   NtCreateMutant  (0x1f0001, {24, 28, 0x80, 0, 0,  (0x1f0001, {24, 28, 0x80, 0, 0, "kkq-vx_mtx6"}, 1, ... 228, ) }, 1, ... 228, ) == 0x0
 01887  2016   NtWaitForSingleObject  (228, 0, 0x0, ...
 01888   896   NtQueryValueKey  (220,  (220, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="N\0e\0t\0w\0o\0r\0k\0 \0L\0o\0c\0a\0t\0i\0o\0n\0 \0A\0w\0a\0r\0e\0n\0e\0s\0s\0 \0(\0N\0L\0A\0)\0 \0N\0a\0m\0e\0s\0p\0a\0c\0e\0\0\0"}, 98, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (220, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="N\0e\0t\0w\0o\0r\0k\0 \0L\0o\0c\0a\0t\0i\0o\0n\0 \0A\0w\0a\0r\0e\0n\0e\0s\0s\0 \0(\0N\0L\0A\0)\0 \0N\0a\0m\0e\0s\0p\0a\0c\0e\0\0\0"}, 98, ) }, 98, ) == 0x0
 01889   896   NtQueryValueKey  (220,  (220, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="N\0e\0t\0w\0o\0r\0k\0 \0L\0o\0c\0a\0t\0i\0o\0n\0 \0A\0w\0a\0r\0e\0n\0e\0s\0s\0 \0(\0N\0L\0A\0)\0 \0N\0a\0m\0e\0s\0p\0a\0c\0e\0\0\0"}, 98, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (220, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="N\0e\0t\0w\0o\0r\0k\0 \0L\0o\0c\0a\0t\0i\0o\0n\0 \0A\0w\0a\0r\0e\0n\0e\0s\0s\0 \0(\0N\0L\0A\0)\0 \0N\0a\0m\0e\0s\0p\0a\0c\0e\0\0\0"}, 98, ) }, 98, ) == 0x0
 01890   896   NtQueryValueKey  (220,  (220, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="N\0e\0t\0w\0o\0r\0k\0 \0L\0o\0c\0a\0t\0i\0o\0n\0 \0A\0w\0a\0r\0e\0n\0e\0s\0s\0 \0(\0N\0L\0A\0)\0 \0N\0a\0m\0e\0s\0p\0a\0c\0e\0\0\0"}, 98, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (220, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="N\0e\0t\0w\0o\0r\0k\0 \0L\0o\0c\0a\0t\0i\0o\0n\0 \0A\0w\0a\0r\0e\0n\0e\0s\0s\0 \0(\0N\0L\0A\0)\0 \0N\0a\0m\0e\0s\0p\0a\0c\0e\0\0\0"}, 98, ) }, 98, ) == 0x0
 01887  2016   NtWaitForSingleObject  ... ) == 0x0
 01891  2016   NtUserRegisterClassExWOW  (9829496, 9829592, 9829576, 9829564, 0, 386, 0, ... ) == 0x8169c191
 01892  2016   NtUserCreateWindowEx  (-2147483648, 9829800, 9828564, "13238272, 0, 0, 0, 0, 0, 0, 4194304, 0, 1073742848, 0, ...
 01893  2016   NtAllocateVirtualMemory  (-1, 5726208, 0, 4096, 4096, 4, ... 5726208, 4096, ) == 0x0
 01894  2016   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\uxtheme.dll"}, 9825984, ... ) }, 9825984, ... ) == 0x0
 01895  2016   NtOpenFile  (0x100020, {24, 0, 0x40, 0, 0,  (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\uxtheme.dll"}, 5, 96, ... 232, {status=0x0, info=1}, ) }, 5, 96, ... 232, {status=0x0, info=1}, ) == 0x0
 01896   896   NtQueryValueKey  (220,  (220, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="N\0e\0t\0w\0o\0r\0k\0 \0L\0o\0c\0a\0t\0i\0o\0n\0 \0A\0w\0a\0r\0e\0n\0e\0s\0s\0 \0(\0N\0L\0A\0)\0 \0N\0a\0m\0e\0s\0p\0a\0c\0e\0\0\0"}, 98, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (220, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="N\0e\0t\0w\0o\0r\0k\0 \0L\0o\0c\0a\0t\0i\0o\0n\0 \0A\0w\0a\0r\0e\0n\0e\0s\0s\0 \0(\0N\0L\0A\0)\0 \0N\0a\0m\0e\0s\0p\0a\0c\0e\0\0\0"}, 98, ) }, 98, ) == 0x0
 01897   896   NtQueryValueKey  (220,  (220, "ProviderId", Partial, 144, ... TitleIdx=0, Type=3, Data=":$Bf\250;\246J\272\245.\13\327\37\335\203"}, 28, ) , Partial, 144, ... TitleIdx=0, Type=3, Data= (220, "ProviderId", Partial, 144, ... TitleIdx=0, Type=3, Data=":$Bf\250;\246J\272\245.\13\327\37\335\203"}, 28, ) }, 28, ) == 0x0
 01898   896   NtQueryValueKey  (220,  (220, "AddressFamily", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01899   896   NtQueryValueKey  (220,  (220, "SupportedNameSpace", Partial, 144, ... TitleIdx=0, Type=4, Data="\17\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (220, "SupportedNameSpace", Partial, 144, ... TitleIdx=0, Type=4, Data="\17\0\0\0"}, 16, ) }, 16, ) == 0x0
 01900   896   NtQueryValueKey  (220,  (220, "Enabled", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (220, "Enabled", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) }, 16, ) == 0x0
 01901   896   NtQueryValueKey  (220,  (220, "Version", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (220, "Version", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) }, 16, ) == 0x0
 01902  2016   NtCreateSection  (0xe, 0x0, 0x0, 16, 134217728, 232, ... 236, ) == 0x0
 01903  2016   NtClose  (232, ... ) == 0x0
 01904  2016   NtMapViewOfSection  (236, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 16, ... (0x1340000), 0x0, 221184, ) == 0x0
 01905  2016   NtClose  (236, ... ) == 0x0
 01906  2016   NtUnmapViewOfSection  (-1, 0x1340000, ... ) == 0x0
 01907  2016   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\uxtheme.dll"}, 9826292, ... ) }, 9826292, ... ) == 0x0
 01908   896   NtQueryValueKey  (220,  (220, "StoresServiceClassInfo", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (220, "StoresServiceClassInfo", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) }, 16, ) == 0x0
 01909   896   NtClose  (220, ... ) == 0x0
 01910   896   NtOpenKey  (0x20019, {24, 200, 0x40, 0, 0,  (0x20019, {24, 200, 0x40, 0, 0, "000000000004"}, ... 220, ) }, ... 220, ) == 0x0
 01911   896   NtQueryValueKey  (220,  (220, "LibraryPath", Partial, 144, ... TitleIdx=0, Type=1, Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0s\0y\0s\0t\0e\0m\03\02\0\\0w\0s\0h\0b\0t\0h\0.\0d\0l\0l\0\0\0"}, 78, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (220, "LibraryPath", Partial, 144, ... TitleIdx=0, Type=1, Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0s\0y\0s\0t\0e\0m\03\02\0\\0w\0s\0h\0b\0t\0h\0.\0d\0l\0l\0\0\0"}, 78, ) }, 78, ) == 0x0
 01912   896   NtQueryValueKey  (220,  (220, "LibraryPath", Partial, 144, ... TitleIdx=0, Type=1, Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0s\0y\0s\0t\0e\0m\03\02\0\\0w\0s\0h\0b\0t\0h\0.\0d\0l\0l\0\0\0"}, 78, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (220, "LibraryPath", Partial, 144, ... TitleIdx=0, Type=1, Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0s\0y\0s\0t\0e\0m\03\02\0\\0w\0s\0h\0b\0t\0h\0.\0d\0l\0l\0\0\0"}, 78, ) }, 78, ) == 0x0
 01913   896   NtQueryValueKey  (220,  (220, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="B\0l\0u\0e\0t\0o\0o\0t\0h\0 \0N\0a\0m\0e\0s\0p\0a\0c\0e\0\0\0"}, 52, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (220, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="B\0l\0u\0e\0t\0o\0o\0t\0h\0 \0N\0a\0m\0e\0s\0p\0a\0c\0e\0\0\0"}, 52, ) }, 52, ) == 0x0
 01914  2016   NtOpenFile  (0x100020, {24, 0, 0x40, 0, 0,  (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\uxtheme.dll"}, 5, 96, ... 236, {status=0x0, info=1}, ) }, 5, 96, ... 236, {status=0x0, info=1}, ) == 0x0
 01915  2016   NtCreateSection  (0xf, 0x0, 0x0, 16, 16777216, 236, ... 232, ) == 0x0
 01916  2016   NtQuerySection  (232, Image, 48, ... {section info, class 1, size 48}, 0x0, ) == 0x0
 01917  2016   NtClose  (236, ... ) == 0x0
 01918  2016   NtMapViewOfSection  (232, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x5ad70000), 0x0, 229376, ) == 0x0
 01919  2016   NtClose  (232, ... ) == 0x0
 01920   896   NtQueryValueKey  (220,  (220, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="B\0l\0u\0e\0t\0o\0o\0t\0h\0 \0N\0a\0m\0e\0s\0p\0a\0c\0e\0\0\0"}, 52, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (220, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="B\0l\0u\0e\0t\0o\0o\0t\0h\0 \0N\0a\0m\0e\0s\0p\0a\0c\0e\0\0\0"}, 52, ) }, 52, ) == 0x0
 01921   896   NtQueryValueKey  (220,  (220, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="B\0l\0u\0e\0t\0o\0o\0t\0h\0 \0N\0a\0m\0e\0s\0p\0a\0c\0e\0\0\0"}, 52, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (220, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="B\0l\0u\0e\0t\0o\0o\0t\0h\0 \0N\0a\0m\0e\0s\0p\0a\0c\0e\0\0\0"}, 52, ) }, 52, ) == 0x0
 01922   896   NtQueryValueKey  (220,  (220, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="B\0l\0u\0e\0t\0o\0o\0t\0h\0 \0N\0a\0m\0e\0s\0p\0a\0c\0e\0\0\0"}, 52, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (220, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="B\0l\0u\0e\0t\0o\0o\0t\0h\0 \0N\0a\0m\0e\0s\0p\0a\0c\0e\0\0\0"}, 52, ) }, 52, ) == 0x0
 01923   896   NtQueryValueKey  (220,  (220, "ProviderId", Partial, 144, ... TitleIdx=0, Type=3, Data="\340c\252\6`}\377A\257\262>\346\322\3319-"}, 28, ) , Partial, 144, ... TitleIdx=0, Type=3, Data= (220, "ProviderId", Partial, 144, ... TitleIdx=0, Type=3, Data="\340c\252\6`}\377A\257\262>\346\322\3319-"}, 28, ) }, 28, ) == 0x0
 01924   896   NtQueryValueKey  (220,  (220, "AddressFamily", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01925   896   NtQueryValueKey  (220,  (220, "SupportedNameSpace", Partial, 144, ... TitleIdx=0, Type=4, Data="\20\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (220, "SupportedNameSpace", Partial, 144, ... TitleIdx=0, Type=4, Data="\20\0\0\0"}, 16, ) }, 16, ) == 0x0
 01926  2016   NtProtectVirtualMemory  (-1, (0x5ad71000), 1300, 4, ... (0x5ad71000), 4096, 32, ) == 0x0
 01927  2016   NtProtectVirtualMemory  (-1, (0x5ad71000), 4096, 32, ... (0x5ad71000), 4096, 4, ) == 0x0
 01928  2016   NtFlushInstructionCache  (-1, 1524043776, 1300, ... ) == 0x0
 01929  2016   NtProtectVirtualMemory  (-1, (0x5ad71000), 1300, 4, ... (0x5ad71000), 4096, 32, ) == 0x0
 01930  2016   NtProtectVirtualMemory  (-1, (0x5ad71000), 4096, 32, ... (0x5ad71000), 4096, 4, ) == 0x0
 01931  2016   NtFlushInstructionCache  (-1, 1524043776, 1300, ... ) == 0x0
 01932   896   NtQueryValueKey  (220,  (220, "Enabled", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (220, "Enabled", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) }, 16, ) == 0x0
 01933   896   NtQueryValueKey  (220,  (220, "Version", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (220, "Version", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) }, 16, ) == 0x0
 01934   896   NtQueryValueKey  (220,  (220, "StoresServiceClassInfo", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (220, "StoresServiceClassInfo", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) }, 16, ) == 0x0
 01935   896   NtClose  (220, ... ) == 0x0
 01936   896   NtClose  (200, ... ) == 0x0
 01937   896   NtWaitForSingleObject  (196, 0, {0, 0}, ...
 01938  2016   NtProtectVirtualMemory  (-1, (0x5ad71000), 1300, 4, ... (0x5ad71000), 4096, 32, ) == 0x0
 01939  2016   NtProtectVirtualMemory  (-1, (0x5ad71000), 4096, 32, ... (0x5ad71000), 4096, 4, ) == 0x0
 01940  2016   NtFlushInstructionCache  (-1, 1524043776, 1300, ... ) == 0x0
 01937   896   NtWaitForSingleObject  ... ) == 0x102
 01941   896   NtClose  (184, ... ) == 0x0
 01942   896   NtQuerySystemInformation  (Basic, 44, ... {Unknown=0,MaximumIncrement=156250,PhysicalPageSize=0x1000,NumberOfPhysicalPages=0xff7c,LowestPhysicalPage=0x1,HighestPhysicalPage=0xffff,AllocationGranularity=0x10000,LowestUserAddress=0x10000,HighestUserAddress=0x7ffeffff,ActiveProcessors=1,NumberProcessors=1,}, 0x0, ) == 0x0
 01943   896   NtQuerySystemInformation  (Processor, 12, ... {system info, class 1, size 12}, 0x0, ) == 0x0
 01944   896   NtOpenKey  (0x1, {24, 52, 0x40, 0, 0,  (0x1, {24, 52, 0x40, 0, 0, "System\CurrentControlSet\Services\Winsock2\Parameters"}, ... 184, ) }, ... 184, ) == 0x0
 01945   896   NtQueryValueKey  (184,  (184, "Ws2_32NumHandleBuckets", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01946   896   NtClose  (184, ...
 01947  2016   NtProtectVirtualMemory  (-1, (0x5ad71000), 1300, 4, ... (0x5ad71000), 4096, 32, ) == 0x0
 01948  2016   NtProtectVirtualMemory  (-1, (0x5ad71000), 4096, 32, ... (0x5ad71000), 4096, 4, ) == 0x0
 01949  2016   NtFlushInstructionCache  (-1, 1524043776, 1300, ... ) == 0x0
 01950  2016   NtOpenKey  (0x80000000, {24, 0, 0x40, 0, 0,  (0x80000000, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\uxtheme.dll"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01951  2016   NtUserGetWindowDC  (0, ... ) == 0x1010054
 01952  2016   NtUserCallOneParam  (16842836, 57, ... ) == 0x1
 01946   896   NtClose  ... ) == 0x0
 01953   896   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ... 184, ) == 0x0
 01954   896   NtAllocateVirtualMemory  (-1, 5730304, 0, 4096, 4096, 4, ... 5730304, 4096, ) == 0x0
 01955   896   NtWaitForSingleObject  (32, 0, 0x0, ...
 01956  2016   NtOpenThreadTokenEx  (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN
 01957  2016   NtOpenProcessTokenEx  (-1, 0x20008, 512, ... 200, ) == 0x0
 01958  2016   NtQueryInformationToken  (200, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0
 01959  2016   NtClose  (200, ... ) == 0x0
 01960  2016   NtOpenKey  (0x2001f, {24, 0, 0x640, 0, 0,  (0x2001f, {24, 0, 0x640, 0, 0, "\REGISTRY\USER\S-1-5-21-1292428093-1383384898-725345543-1003"}, ... 200, ) }, ... 200, ) == 0x0
 01961  2016   NtOpenKey  (0x1, {24, 200, 0x40, 0, 0,  (0x1, {24, 200, 0x40, 0, 0, "Software\Microsoft\Windows\CurrentVersion\ThemeManager"}, ... 220, ) }, ... 220, ) == 0x0
 01962  2016   NtQueryValueKey  (220,  (220, "Compositing", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01963  2016   NtClose  (220, ... ) == 0x0
 01964  2016   NtClose  (200, ... ) == 0x0
 01965  2016   NtOpenThreadTokenEx  (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN
 01966  2016   NtOpenProcessTokenEx  (-1, 0x20008, 512, ... 200, ) == 0x0
 01967  2016   NtQueryInformationToken  (200, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0
 01968  2016   NtClose  (200, ... ) == 0x0
 01969  2016   NtOpenKey  (0x20019, {24, 0, 0x640, 0, 0,  (0x20019, {24, 0, 0x640, 0, 0, "\REGISTRY\USER\S-1-5-21-1292428093-1383384898-725345543-1003"}, ... 200, ) }, ... 200, ) == 0x0
 01970  2016   NtOpenKey  (0x1, {24, 200, 0x40, 0, 0,  (0x1, {24, 200, 0x40, 0, 0, "Control Panel\Desktop"}, ... 220, ) }, ... 220, ) == 0x0
 01971  2016   NtQueryValueKey  (220,  (220, "LameButtonText", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01972  2016   NtClose  (220, ... ) == 0x0
 01973  2016   NtClose  (200, ... ) == 0x0
 01974  2016   NtSetEventBoostPriority  (32, ...
 01955   896   NtWaitForSingleObject  ... ) == 0x0
 01975   896   NtCreateFile  (0x80100080, {24, 0, 0x40, 0, 2290216,  (0x80100080, {24, 0, 0x40, 0, 2290216, "\??\u:\work\packed.exe"}, 0x0, 0, 1, 1, 2097252, 0, 0, ... }, 0x0, 0, 1, 1, 2097252, 0, 0, ...
 01974  2016   NtSetEventBoostPriority  ... ) == 0x0
 01976  2016   NtUserGetProcessWindowStation  (... ) == 0x24
 01977  2016   NtUserGetObjectInformation  (36, 2, 9828080, 64, 9828076, ... ) == 0x1
 01978  2016   NtUserGetGUIThreadInfo  (2016, 9828100, ... ) == 0x1
 01979  2016   NtConnectPort  ( ("\ThemeApiPort", {12, 2, 1, 1}, 0x0, 0x0, 9827944, 64, ... 200, 0x0, 0x0, 0x0, 64, ) , {12, 2, 1, 1}, 0x0, 0x0, 9827944, 64, ... 200, 0x0, 0x0, 0x0, 64, ) == 0x0
 01980  2016   NtRequestWaitReplyPort  (200, {32, 56, new_msg, 0, 0, 0, 0, 0}  (200, {32, 56, new_msg, 0, 0, 0, 0, 0} "\4\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0" ... {32, 56, reply, 0, 1252, 2016, 81858, 0} "\0\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0" )  ... {32, 56, reply, 0, 1252, 2016, 81858, 0}  (200, {32, 56, new_msg, 0, 0, 0, 0, 0} "\4\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0" ... {32, 56, reply, 0, 1252, 2016, 81858, 0} "\0\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0" )  ) == 0x0
 01981  2016   NtRequestWaitReplyPort  (200, {32, 56, new_msg, 0, 0, 0, 0, 0}  (200, {32, 56, new_msg, 0, 0, 0, 0, 0} "\355\3\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0" ... {32, 56, reply, 0, 1252, 2016, 81859, 0} "\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0" )  ... {32, 56, reply, 0, 1252, 2016, 81859, 0}  (200, {32, 56, new_msg, 0, 0, 0, 0, 0} "\355\3\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0" ... {32, 56, reply, 0, 1252, 2016, 81859, 0} "\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0" )  ) == 0x0
 01982  2016   NtUserCallNoParam  (29, ...
 01983  2016   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\uxtheme.dll"}, 9825340, ... ) }, 9825340, ... ) == 0x0
 01982  2016   NtUserCallNoParam  ... ) == 0x0
 01984  2016   NtUserSystemParametersInfo  (41, 0, 1524240760, 0, ... ) == 0x1
 01985  2016   NtGdiHfontCreate  (9827468, 356, 0, 0, 5726064, ... ) == 0x640a0596
 01986  2016   NtGdiHfontCreate  (9827468, 356, 0, 0, 5726056, ... ) == 0x740a05de
 01987  2016   NtRequestWaitReplyPort  (200, {32, 56, new_msg, 0, 0, 0, 0, 0}  (200, {32, 56, new_msg, 0, 0, 0, 0, 0} "\7\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0" ...  ...
 01975   896   NtCreateFile  ... 220, {status=0x0, info=1}, ) == 0x0
 01988   896   NtQueryInformationFile  (220, 2290652, 8, AttributeFlag, ... {status=0x0, info=8}, ) == 0x0
 01989   896   NtQueryInformationFile  (220, 2290568, 24, Standard, ... {status=0x0, info=24}, ) == 0x0
 01990   896   NtQueryInformationFile  (220, 2290384, 40, Basic, ...
 01987  2016   NtRequestWaitReplyPort  ... {32, 56, reply, 0, 1252, 2016, 81860, 0}  ... {32, 56, reply, 0, 1252, 2016, 81860, 0} "\0\0\0\0\0\0\0\0\350\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0" )  ) == 0x0
 01991  2016   NtMapViewOfSection  (232, -1, (0x0), 0, 0, {0, 0}, 0, 1, 0, 2, ... (0x1340000), {0, 0}, 327680, ) == 0x0
 01992  2016   NtUserGetWindowDC  (0, ... ) == 0x1010054
 01993  2016   NtUserCallOneParam  (16842836, 57, ... ) == 0x1
 01990   896   NtQueryInformationFile  ... {status=0x0, info=40}, ) == 0x0
 01994   896   NtAllocateVirtualMemory  (-1, 5734400, 0, 8192, 4096, 4, ... 5734400, 8192, ) == 0x0
 01995   896   NtQueryInformationFile  (220, 5731000, 4094, Stream, ...
 01996  2016   NtUserGetWindowDC  (0, ... ) == 0x1010054
 01997  2016   NtUserCallOneParam  (16842836, 57, ... ) == 0x1
 01998  2016   NtUserGetWindowDC  (0, ... ) == 0x1010054
 01995   896   NtQueryInformationFile  ... {status=0x0, info=38}, ) == 0x0
 01999   896   NtQueryInformationFile  (220, 2288832, 40, Basic, ...
 02000  2016   NtUserCallOneParam  (16842836, 57, ... ) == 0x1
 02001  2016   NtUserGetWindowDC  (0, ... ) == 0x1010054
 02002  2016   NtUserCallOneParam  (16842836, 57, ... ) == 0x1
 01999   896   NtQueryInformationFile  ... {status=0x0, info=40}, ) == 0x0
 02003   896   NtQueryInformationFile  (220, 2289108, 4, Ea, ... {status=0x0, info=4}, ) == 0x0
 02004   896   NtCreateFile  (0x40110080, {24, 0, 0x40, 0, 2288984,  (0x40110080, {24, 0, 0x40, 0, 2288984, "\??\C:\WINDOWS\lsasss.exe"}, 0x0, 32, 0, 5, 100, 0, 0, ... }, 0x0, 32, 0, 5, 100, 0, 0, ...
 02005  2016   NtUserGetWindowDC  (0, ... ) == 0x1010054
 02006  2016   NtUserCallOneParam  (16842836, 57, ... ) == 0x1
 02007  2016   NtUserGetWindowDC  (0, ... ) == 0x1010054
 02008   896   NtClose  (-2147482748, ... ) == 0x0
 02004   896   NtCreateFile  ... 236, {status=0x0, info=2}, ) == 0x0
 02009   896   NtQueryVolumeInformationFile  (236, 2289136, 536, Attribute, ... {status=0x0, info=20}, ) == 0x0
 02010   896   NtQueryInformationFile  (236, 2288720, 40, Basic, ... {status=0x0, info=40}, ) == 0x0
 02011   896   NtQueryVolumeInformationFile  (220, 2289136, 536, Attribute, ...
 02012  2016   NtUserCallOneParam  (16842836, 57, ... ) == 0x1
 02013  2016   NtUserGetWindowDC  (0, ... ) == 0x1010054
 02014  2016   NtUserCallOneParam  (16842836, 57, ... ) == 0x1
 02015  2016   NtUserGetWindowDC  (0, ... ) == 0x1010054
 02016  2016   NtUserCallOneParam  (16842836, 57, ... ) == 0x1
 02017  2016   NtUserGetWindowDC  (0, ... ) == 0x1010054
 02018  2016   NtGdiCreatePatternBrushInternal  (59048383, 0, 0, ... ) == 0xb91006e8
 02019  2016   NtUserCallOneParam  (16842836, 57, ... ) == 0x1
 02020  2016   NtUserCallNoParam  (29, ...
 02021  2016   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\uxtheme.dll"}, 9824780, ... }, 9824780, ...
 02011   896   NtQueryVolumeInformationFile  ... {status=0x0, info=20}, ) == 0x0
 02021  2016   NtQueryAttributesFile  ... ) == 0x0
 02020  2016   NtUserCallNoParam  ... ) == 0x0
 02022  2016   NtUserCallNoParam  (29, ...
 02023  2016   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\uxtheme.dll"}, 9824776, ... ) }, 9824776, ... ) == 0x0
 02022  2016   NtUserCallNoParam  ... ) == 0x0
 02024  2016   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\MSCTF.dll"}, 9825988, ... ) }, 9825988, ... ) == 0x0
 02025  2016   NtOpenFile  (0x100020, {24, 0, 0x40, 0, 0,  (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\MSCTF.dll"}, 5, 96, ... 240, {status=0x0, info=1}, ) }, 5, 96, ... 240, {status=0x0, info=1}, ) == 0x0
 02026  2016   NtCreateSection  (0xe, 0x0, 0x0, 16, 134217728, 240, ... 244, ) == 0x0
 02027   896   NtQueryVolumeInformationFile  (220, 2288480, 8, Device, ... {status=0x0, info=8}, ) == 0x0
 02028   896   NtSetInformationFile  (236, 2289036, 8, EndOfFile, ... {status=0x0, info=0}, ) == 0x0
 02029   896   NtCreateSection  (0xf001f, 0x0, 0x0, 2, 134217728, 220, ...
 02030  2016   NtClose  (240, ... ) == 0x0
 02031  2016   NtMapViewOfSection  (244, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 16, ... (0x1390000), 0x0, 294912, ) == 0x0
 02032  2016   NtClose  (244, ... ) == 0x0
 02033  2016   NtUnmapViewOfSection  (-1, 0x1390000, ... ) == 0x0
 02034  2016   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\MSCTF.dll"}, 9826296, ... ) }, 9826296, ... ) == 0x0
 02035  2016   NtOpenFile  (0x100020, {24, 0, 0x40, 0, 0,  (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\MSCTF.dll"}, 5, 96, ... 244, {status=0x0, info=1}, ) }, 5, 96, ... 244, {status=0x0, info=1}, ) == 0x0
 02029   896   NtCreateSection  ... 240, ) == 0x0
 02036   896   NtMapViewOfSection  (240, -1, (0x0), 0, 0, {0, 0}, 0, 1, 0, 2, ... (0x1390000), {0, 0}, 151552, ) == 0x0
 02037   896   NtClose  (240, ... ) == 0x0
 02039  2016   NtCreateSection  (0xf, 0x0, 0x0, 16, 16777216, 244, ... 240, ) == 0x0
 02040  2016   NtQuerySection  (240, Image, 48, ... {section info, class 1, size 48}, 0x0, ) == 0x0
 02041  2016   NtClose  (244, ... ) == 0x0
 02042  2016   NtMapViewOfSection  (240, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x74720000), 0x0, 307200, ) == 0x0
 02043  2016   NtClose  (240, ... ) == 0x0
 02044  2016   NtProtectVirtualMemory  (-1, (0x74721000), 928, 4, ... (0x74721000), 4096, 32, ) == 0x0
 02038   896   NtWriteFile  (236, 0, 0, 0,  (236, 0, 0, 0, "MZ\220\0\3\0\0\0\4\0\0\0\377\377\0\0\270\0\0\0\0\0\0\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\350\0\0\0\16\37\272\16\0\264\11\315!\270\1L\315!This program cannot be run in DOS mode.\15\15\12$\0\0\0\0\0\0\0i8\366\222-Y\230\301-Y\230\301-Y\230\301\256Q\305\301/Y\230\301-Y\230\301.Y\230\301\305F\222\3017Y\230\301\256E\226\301&Y\230\301-Y\231\301}Y\230\301OF\213\301$Y\230\301\305F\223\301)Y\230\301Rich-Y\230\301\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0PE\0\0L\1\5\0\6\302\226@\0\0\0\0\0\0\0\0\340\0\17\1\13\1\10\0\0>\0\0\0"\0\0\0\0\0\0\0\200\1\0\0\20\0\0\0P\0\0\0\0@\0\0\20\0\0\0\2\0\0\4\0\0\0\15\0\6\0\4\0\0\0\0\0\0\0\0\20\25\0\0\4\0\0\0\0\0\0\2\0\0\0\0\0 \0\0\20\0\0\0\0 \0\0\20\0\0\0\0\0\0\20\0\0\0\0\0\0\0\0\0\0\0\24\200\0\0\212\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0.text\0\0\0\0p\0\0\0\20\0\0\02\0\0", 61440, 0x0, 0, ... \0\0\0\0\0\0\0\200\1\0\0\20\0\0\0P\0\0\0\0@\0\0\20\0\0\0\2\0\0\4\0\0\0\15\0\6\0\4\0\0\0\0\0\0\0\0\20\25\0\0\4\0\0\0\0\0\0\2\0\0\0\0\0 \0\0\20\0\0\0\0 \0\0\20\0\0\0\0\0\0\20\0\0\0\0\0\0\0\0\0\0\0\24\200\0\0\212\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0.text\0\0\0\0p\0\0\0\20\0\0\02\0\0", 61440, 0x0, 0, ...
 02045  2016   NtProtectVirtualMemory  (-1, (0x74721000), 4096, 32, ... (0x74721000), 4096, 4, ) == 0x0
 02046  2016   NtFlushInstructionCache  (-1, 1953632256, 928, ... ) == 0x0
 02047  2016   NtProtectVirtualMemory  (-1, (0x74721000), 928, 4, ... (0x74721000), 4096, 32, ) == 0x0
 02048  2016   NtProtectVirtualMemory  (-1, (0x74721000), 4096, 32, ... (0x74721000), 4096, 4, ) == 0x0
 02049  2016   NtFlushInstructionCache  (-1, 1953632256, 928, ... ) == 0x0
 02050  2016   NtProtectVirtualMemory  (-1, (0x74721000), 928, 4, ... (0x74721000), 4096, 32, ) == 0x0
 02051  2016   NtProtectVirtualMemory  (-1, (0x74721000), 4096, 32, ... (0x74721000), 4096, 4, ) == 0x0
 02052  2016   NtFlushInstructionCache  (-1, 1953632256, 928, ... ) == 0x0
 02053  2016   NtProtectVirtualMemory  (-1, (0x74721000), 928, 4, ... (0x74721000), 4096, 32, ) == 0x0
 02038   896   NtWriteFile  ... {status=0x0, info=61440}, ) == 0x0
 02054   896   NtWriteFile  (236, 0, 0, 0,  (236, 0, 0, 0, "\205xz\361\377\312\213\206\205\363\377B\213\203\205u\305\177\276\373kjy\177\216\373kj\361o&\373kj\371\220~\362\356\177.\213\200\205\367\377:\213\203\205*\367\317J\213\203\205\371\226j\363\235\303~zzz\211\337\367\317J\213\203\205\371\226j\363\235\303~zzz\211\337\361\307\326\213\206\205-\361E\205-V\363\271u\305\177\276\372kj\371\222|C\271u\377\257rzz\22<\375kj\222\371\6\205\205\205\317\312\213\206\205*\367\307\273\213\206\205-\205oR#wj\367\377\273\213\206\205*\367\377\272\210\206\205*\205oV\212zj\371\276bu\305\177\266\372kjy\177\236\373kj\371\222\177\363\377V\213\203\205\367\377V\213\203\205*\222\340kj\361\377:\213\203\205*\361B\205nGzzzz\363\271\333V\370kjy\177^\370kj\371\222rC\271u\377\315~zz\367\377R\213\203\205*\361\377V\213\203\205*\361B\205\355\212zzz\363\271\333.\373kjy\177\16\373kj\371\222uC\271u\377\7~zz\367\377\33\213\203\205*\205\317R\213\203\205\222\257\366\205\205\371\276r\363\275=\363\3072\213\203\205\205\317R\213\203\205\205oN\25kj\3332\370kj\371\222~\363\377\36\213\201\205\2210\361\377\36\213\201\205u\304\376\177\33\213\203\205\361o\326\373kj\371\270qC\252\16i\361oN\373kj\371\270~yo\12\373kjC\252\17l\361\377\36\213\201\205\361o&\373kj\371\220~\362\356\177\33\213\203\205\205\377\36\213\201\205\361\3772\213\203\205C\377\36\213\201\205\10\322\367\377\33\213\203\205*\367\377\37\213\200\205*\222b\zzu\305\177\346\372kjy\177^\373kj\371\222r\363\377\36\213\201\205\361\377\36\213\201\205\367\366\177\33\213\203\205\371\262\205:\372F{z", 61440, 0x0, 0, ... , 61440, 0x0, 0, ...
 02055  2016   NtProtectVirtualMemory  (-1, (0x74721000), 4096, 32, ... (0x74721000), 4096, 4, ) == 0x0
 02056  2016   NtFlushInstructionCache  (-1, 1953632256, 928, ... ) == 0x0
 02057  2016   NtOpenKey  (0x80000000, {24, 0, 0x40, 0, 0,  (0x80000000, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MSCTF.dll"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02054   896   NtWriteFile  ... {status=0x0, info=61440}, ) == 0x0
 02058   896   NtWriteFile  (236, 0, 0, 0,  (236, 0, 0, 0, "\34\213U\3709\24\275 pD\0u\20\212\24=\260\221D\0:U\30\17\2040\1\0\0G\241\14\362T\0\5\344\3\0\09\307r\275\241\210\361T\0\5\273\3\0\09E\364\17\206\270\0\0\0\241 \361T\0@\3\5\274\361T\0P\215E\265P\350\244\307\377\377\203\304\10\241\274\361T\0\5\262\3\0\0\17\277\25\304\361T\0\1\320\211E\354\241,\362T\0\203\350\7\211E\350\213E\354\212\4\3\210E\347\213E\354\17\277\25\304\361T\0\3\25\364\361T\0\203\352\21\210\24\3h\340\177D\0\377u\364\377u\350\215E\265P\213E\24\3770\377u\10S\377u\20\17\277\5\10\362T\0H%\377\0\0\0P\350\274\4\0\0\203\304$\213E\354\211E\350\212U\347\210\24\3\2410\362T\0\5\277\3\0\0\1E\354\213E\3649E\354v\3\211E\354\213E\3649E\350sS\353\202h\247\374T\0\350\366\243\377\377h\340\177D\0\377u\364\17\277\25\244\361T\0\17\277\15\230\361T\0\1\312\203\352\7RP\213U\24\3772\377u\10S\377u\20\213\25\240\360T\0\3\25\24\361T\0\203\352\4\201\342\377\0\0\0R\350=\4\0\0\203\304(\213E\24\377\0\213E\364\215\34\3C\213E\24\213\25(\362T\0\203\302\149\20\17\206$\376\377\377h\243\374T\0\350\205\243\377\377h\340\177D\0\213\25\330\361T\0\17\277\15\320\360T\0\1\312\203\352\12R\17\277\25<\361T\0\203\352\11RPR\17\277\25\244\361T\0\203\352\6R\17\277\25\30\361T\0\203\352\10R\377u\20\213\25\340\361T\0\3\25\344\361T\0\203\352\7\201\342\377\0\0\0R\350\267\3\0\0\203\304(_^[\311\303Wh\226\374T\0\350\31\243\377\377YP\377\25\230\225D\0\243d\362T\0\241\270\361T\0\3\5\4\362", 28160, 0x0, 0, ... , 28160, 0x0, 0, ...
 02059  2016   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\ntdll.dll"}, 9823652, ... ) }, 9823652, ... ) == 0x0
 02060  2016   NtQueryInformationProcess  (-1, Wow64, 4, ... {process info, class 26, size 4}, 0x0, ) == 0x0
 02061  2016   NtUserCallOneParam  (0, 40, ... ) == 0x4090409
 02058   896   NtWriteFile  ... {status=0x0, info=28160}, ) == 0x0
 02062   896   NtUnmapViewOfSection  (-1, 0x1390000, ... ) == 0x0
 02063   896   NtSetInformationFile  (236, 2290384, 40, Basic, ... {status=0x0, info=0}, ) == 0x0
 02064   896   NtClose  (220, ...
 02065  2016   NtUserRegisterWindowMessage  ( ("MSUIM.Msg.Private", ... ) , ... ) == 0xc0a1
 02066  2016   NtUserRegisterWindowMessage  ( ("MSUIM.Msg.SetFocus", ... ) , ... ) == 0xc0a2
 02067  2016   NtUserRegisterWindowMessage  ( ("MSUIM.Msg.ThreadTerminate", ... ) , ... ) == 0xc0a3
 02068  2016   NtUserRegisterWindowMessage  ( ("MSUIM.Msg.ThreadItemChange", ... ) , ... ) == 0xc0a4
 02069  2016   NtUserRegisterWindowMessage  ( ("MSUIM.Msg.LangBarModal", ... ) , ... ) == 0xc0a5
 02070  2016   NtUserRegisterWindowMessage  ( ("MSUIM.Msg.RpcSendReceive", ... ) , ... ) == 0xc0a6
 02071  2016   NtUserRegisterWindowMessage  ( ("MSUIM.Msg.ThreadMarshal", ... ) , ... ) == 0xc0a7
 02072  2016   NtUserRegisterWindowMessage  ( ("MSUIM.Msg.CheckThreadInputIdel", ... ) , ... ) == 0xc0a8
 02073  2016   NtUserRegisterWindowMessage  ( ("MSUIM.Msg.StubCleanUp", ... ) , ... ) == 0xc0a9
 02074  2016   NtUserRegisterWindowMessage  ( ("MSUIM.Msg.ShowFloating", ... ) , ... ) == 0xc0aa
 02075  2016   NtUserRegisterWindowMessage  ( ("MSUIM.Msg.LBUpdate", ... ) , ... ) == 0xc0ab
 02076  2016   NtUserRegisterWindowMessage  ( ("MSUIM.Msg.MuiMgrDirtyUpdate", ... ) , ... ) == 0xc0ac
 02077  2016   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\imm32.dll"}, 9823660, ... ) }, 9823660, ... ) == 0x0
 02078  2016   NtRequestWaitReplyPort  (24, {24, 52, new_msg, 0, 3998, 9826052, 0, 0}  (24, {24, 52, new_msg, 0, 3998, 9826052, 0, 0} "\0\0\0\0\5\4\3\0\0\0\0\0\1\0\0\0\340\7\0\0\0\0\0\0" ... {24, 52, reply, 0, 1252, 2016, 81861, 0} "\0\0\0\0\5\4\3\0\0\0\0\0\1\0\0\0\340\7\0\0\0\0\0\0" )  ... {24, 52, reply, 0, 1252, 2016, 81861, 0}  (24, {24, 52, new_msg, 0, 3998, 9826052, 0, 0} "\0\0\0\0\5\4\3\0\0\0\0\0\1\0\0\0\340\7\0\0\0\0\0\0" ... {24, 52, reply, 0, 1252, 2016, 81861, 0} "\0\0\0\0\5\4\3\0\0\0\0\0\1\0\0\0\340\7\0\0\0\0\0\0" )  ) == 0x0
 02079  2016   NtUserGetThreadDesktop  (2016, 0, ...
 02064   896   NtClose  ... ) == 0x0
 02080   896   NtClose  (236, ... ) == 0x0
 02081   896   NtOpenKey  (0x2000000, {24, 52, 0x40, 0, 0,  (0x2000000, {24, 52, 0x40, 0, 0, "SOFTWARE\Microsoft\Windows\CurrentVersion\Run"}, ... 236, ) }, ... 236, ) == 0x0
 02082   896   NtSetValueKey  (236,  (236, "lsasss.exe", 0, 1, "C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0l\0s\0a\0s\0s\0s\0.\0e\0x\0e\0\0\0", 44, ... , 0, 1,  (236, "lsasss.exe", 0, 1, "C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0l\0s\0a\0s\0s\0s\0.\0e\0x\0e\0\0\0", 44, ... , 44, ...
 02083   896   NtSetInformationFile  (-2147482448, -142416080, 8, EndOfFile, ... {status=0x0, info=0}, ) == 0x0
 02084   896   NtSetInformationFile  (-2147482448, -142416172, 8, EndOfFile, ...
 02079  2016   NtUserGetThreadDesktop  ... ) == 0x2c
 02085  2016   NtUserGetObjectInformation  (44, 2, 5643920, 520, 9825960, ... ) == 0x1
 02086  2016   NtOpenProcessToken  (-1, 0x8, ... 220, ) == 0x0
 02087  2016   NtQueryInformationToken  (220, User, 0, ... ) == STATUS_BUFFER_TOO_SMALL
 02088  2016   NtQueryInformationToken  (220, User, 36, ... {token info, class 1, size 36}, 36, ) == 0x0
 02089  2016   NtClose  (220, ... ) == 0x0
 02090  2016   NtCreateSection  (0xf0007, {24, 28, 0x80, 0, 0,  (0xf0007, {24, 28, 0x80, 0, 0, "CiceroSharedMemDefaultS-1-5-21-1292428093-1383384898-725345543-1003"}, {3240, 0}, 4, 134217728, 0, ... }, {3240, 0}, 4, 134217728, 0, ...
 02084   896   NtSetInformationFile  ... {status=0x0, info=0}, ) == 0x0
 02091   896   NtSetInformationFile  (-2147482448, -142416480, 8, EndOfFile, ... {status=0x0, info=0}, ) == 0x0
 02092   896   NtSetInformationFile  (-2147482448, -142416576, 8, EndOfFile, ... {status=0x0, info=0}, ) == 0x0
 02082   896   NtSetValueKey  ... ) == 0x0
 02093   896   NtClose  (236, ... ) == 0x0
 02094   896   NtOpenKey  (0x2000000, {24, 64, 0x40, 0, 0,  (0x2000000, {24, 64, 0x40, 0, 0, "SOFTWARE\Microsoft\Windows\CurrentVersion\Run"}, ... 236, ) }, ... 236, ) == 0x0
 02095   896   NtDeleteValueKey  (236,  (236, "ssgrate.exe", ... ) , ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02090  2016   NtCreateSection  ... 220, ) == STATUS_OBJECT_NAME_EXISTS
 02096  2016   NtMapViewOfSection  (220, -1, (0x0), 0, 0, {0, 0}, 0, 1, 0, 4, ... (0x370000), {0, 0}, 4096, ) == 0x0
 02097  2016   NtOpenKey  (0x20019, {24, 52, 0x40, 0, 0,  (0x20019, {24, 52, 0x40, 0, 0, "SOFTWARE\Microsoft\CTF\Compatibility\packed.exe"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02098  2016   NtOpenKey  (0x20019, {24, 52, 0x40, 0, 0,  (0x20019, {24, 52, 0x40, 0, 0, "SOFTWARE\Microsoft\CTF\SystemShared\"}, ... 240, ) }, ... 240, ) == 0x0
 02099  2016   NtQueryValueKey  (240,  (240, "CUAS", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (240, "CUAS", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) }, 16, ) == 0x0
 02100  2016   NtClose  (240, ... ) == 0x0
 02101  2016   NtUserFindExistingCursorIcon  (9825492, 9825508, 9825556, ...
 02102   896   NtClose  (236, ... ) == 0x0
 02103   896   NtOpenKey  (0x2000000, {24, 64, 0x40, 0, 0,  (0x2000000, {24, 64, 0x40, 0, 0, "SOFTWARE\Microsoft\Windows\CurrentVersion\Run"}, ... 236, ) }, ... 236, ) == 0x0
 02104   896   NtDeleteValueKey  (236,  (236, "drvsys.exe", ... ) , ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02105   896   NtClose  (236, ... ) == 0x0
 02106   896   NtOpenKey  (0x2000000, {24, 64, 0x40, 0, 0,  (0x2000000, {24, 64, 0x40, 0, 0, "SOFTWARE\Microsoft\Windows\CurrentVersion\Run"}, ... 236, ) }, ... 236, ) == 0x0
 02107   896   NtDeleteValueKey  (236,  (236, "Drvddll_exe", ... ) , ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02101  2016   NtUserFindExistingCursorIcon  ... ) == 0x10011
 02108  2016   NtUserRegisterClassExWOW  (9825764, 9825860, 9825844, 9825832, 0, 386, 0, ... ) == 0x8169c0ad
 02109  2016   NtCreateMutant  (0x1f0001, {24, 28, 0x80, 0, 0,  (0x1f0001, {24, 28, 0x80, 0, 0, "CTF.LBES.MutexDefaultS-1-5-21-1292428093-1383384898-725345543-1003"}, 0, ... 240, ) }, 0, ... 240, ) == STATUS_OBJECT_NAME_EXISTS
 02110  2016   NtCreateMutant  (0x1f0001, {24, 28, 0x80, 0, 0,  (0x1f0001, {24, 28, 0x80, 0, 0, "CTF.Compart.MutexDefaultS-1-5-21-1292428093-1383384898-725345543-1003"}, 0, ... 244, ) }, 0, ... 244, ) == STATUS_OBJECT_NAME_EXISTS
 02111  2016   NtCreateMutant  (0x1f0001, {24, 28, 0x80, 0, 0,  (0x1f0001, {24, 28, 0x80, 0, 0, "CTF.Asm.MutexDefaultS-1-5-21-1292428093-1383384898-725345543-1003"}, 0, ... 248, ) }, 0, ... 248, ) == STATUS_OBJECT_NAME_EXISTS
 02112  2016   NtCreateMutant  (0x1f0001, {24, 28, 0x80, 0, 0,  (0x1f0001, {24, 28, 0x80, 0, 0, "CTF.Layouts.MutexDefaultS-1-5-21-1292428093-1383384898-725345543-1003"}, 0, ... 252, ) }, 0, ... 252, ) == STATUS_OBJECT_NAME_EXISTS
 02113  2016   NtCreateMutant  (0x1f0001, {24, 28, 0x80, 0, 0,  (0x1f0001, {24, 28, 0x80, 0, 0, "CTF.TMD.MutexDefaultS-1-5-21-1292428093-1383384898-725345543-1003"}, 0, ... }, 0, ...
 02114   896   NtClose  (236, ... ) == 0x0
 02115   896   NtCreateMutant  (0x1f0001, {24, 28, 0x80, 0, 0,  (0x1f0001, {24, 28, 0x80, 0, 0, "SkynetNotice"}, 0, ... 236, ) }, 0, ... 236, ) == 0x0
 02116   896   NtAllocateVirtualMemory  (-1, 0, 0, 2097152, 8192, 4, ... 20512768, 2097152, ) == 0x0
 02117   896   NtAllocateVirtualMemory  (-1, 22601728, 0, 8192, 4096, 4, ... 22601728, 8192, ) == 0x0
 02118   896   NtProtectVirtualMemory  (-1, (0x158e000), 4096, 260, ... (0x158e000), 4096, 4, ) == 0x0
 02119   896   NtCreateThread  (0x1f03ff, 0x0, -1, 2292532, 2292476, 1, ... 256, {1252, 384}, ) == 0x0
 02113  2016   NtCreateMutant  ... 260, ) == STATUS_OBJECT_NAME_EXISTS
 02120  2016   NtOpenKey  (0x20019, {24, 64, 0x40, 0, 0,  (0x20019, {24, 64, 0x40, 0, 0, "Keyboard Layout\Toggle"}, ... 264, ) }, ... 264, ) == 0x0
 02121  2016   NtQueryValueKey  (264,  (264, "Language Hotkey", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02122  2016   NtQueryValueKey  (264,  (264, "Hotkey", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02123  2016   NtQueryValueKey  (264,  (264, "Layout Hotkey", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02124  2016   NtClose  (264, ... ) == 0x0
 02125  2016   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\KERNEL32.dll"}, 9823480, ... }, 9823480, ...
 02126   896   NtQueryInformationThread  (256, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ffdc000,Pid=1252,Tid=384,}, 0x0, ) == 0x0
 02127   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 2293460, 2089878865, 5640936, 2089878893}  (24, {28, 56, new_msg, 0, 2293460, 2089878865, 5640936, 2089878893} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\0\1\0\0\344\4\0\0\200\1\0\0" ... {28, 56, reply, 0, 1252, 896, 81862, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\0\1\0\0\344\4\0\0\200\1\0\0" )  ... {28, 56, reply, 0, 1252, 896, 81862, 0}  (24, {28, 56, new_msg, 0, 2293460, 2089878865, 5640936, 2089878893} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\0\1\0\0\344\4\0\0\200\1\0\0" ... {28, 56, reply, 0, 1252, 896, 81862, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\0\1\0\0\344\4\0\0\200\1\0\0" )  ) == 0x0
 02128   896   NtResumeThread  (256, ... 1, ) == 0x0
 02129   896   NtAllocateVirtualMemory  (-1, 0, 0, 2097152, 8192, 4, ... 22609920, 2097152, ) == 0x0
 02130   896   NtAllocateVirtualMemory  (-1, 24698880, 0, 8192, 4096, 4, ... 24698880, 8192, ) == 0x0
 02131   896   NtProtectVirtualMemory  (-1, (0x178e000), 4096, 260, ...
 02125  2016   NtQueryAttributesFile  ... ) == 0x0
 02132   384   NtWaitForSingleObject  (32, 0, 0x0, ...
 02133  2016   NtQueryDefaultUILanguage  (9826040, ...
 02134  2016   NtOpenThreadTokenEx  (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN
 02135  2016   NtOpenProcessTokenEx  (-1, 0x20008, 512, ... -2147482748, ) == 0x0
 02136  2016   NtQueryInformationToken  (-2147482748, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0
 02137  2016   NtClose  (-2147482748, ...
 02131   896   NtProtectVirtualMemory  ... (0x178e000), 4096, 4, ) == 0x0
 02138   896   NtCreateThread  (0x1f03ff, 0x0, -1, 2292532, 2292476, 1, ... 264, {1252, 1028}, ) == 0x0
 02139   896   NtQueryInformationThread  (264, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ffdb000,Pid=1252,Tid=1028,}, 0x0, ) == 0x0
 02140   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81862, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81862, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\10\1\0\0\344\4\0\0\4\4\0\0" ...  ...
 02137  2016   NtClose  ... ) == 0x0
 02141  2016   NtOpenKey  (0x2000000, {24, 0, 0x640, 0, 0,  (0x2000000, {24, 0, 0x640, 0, 0, "\REGISTRY\USER\S-1-5-21-1292428093-1383384898-725345543-1003"}, ... -2147482748, ) }, ... -2147482748, ) == 0x0
 02142  2016   NtOpenKey  (0x80000000, {24, -2147482748, 0x240, 0, 0,  (0x80000000, {24, -2147482748, 0x240, 0, 0, "Software\Policies\Microsoft\Control Panel\Desktop"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02143  2016   NtOpenKey  (0x80000000, {24, -2147482748, 0x640, 0, 0,  (0x80000000, {24, -2147482748, 0x640, 0, 0, "Control Panel\Desktop"}, ... -2147481452, ) }, ... -2147481452, ) == 0x0
 02144  2016   NtQueryValueKey  (-2147481452,  (-2147481452, "MultiUILanguageId", Partial, 256, ... ) , Partial, 256, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02145  2016   NtClose  (-2147481452, ... ) == 0x0
 02146  2016   NtClose  (-2147482748, ...
 02140   896   NtRequestWaitReplyPort  ... {28, 56, reply, 0, 1252, 896, 81863, 0}  ... {28, 56, reply, 0, 1252, 896, 81863, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\10\1\0\0\344\4\0\0\4\4\0\0" )  ) == 0x0
 02147   896   NtResumeThread  (264, ... 1, ) == 0x0
 02148   896   NtAllocateVirtualMemory  (-1, 0, 0, 2097152, 8192, 4, ... 24707072, 2097152, ) == 0x0
 02149   896   NtAllocateVirtualMemory  (-1, 26796032, 0, 8192, 4096, 4, ... 26796032, 8192, ) == 0x0
 02150   896   NtProtectVirtualMemory  (-1, (0x198e000), 4096, 260, ... (0x198e000), 4096, 4, ) == 0x0
 02151   896   NtCreateThread  (0x1f03ff, 0x0, -1, 2292532, 2292476, 1, ... 268, {1252, 2012}, ) == 0x0
 02146  2016   NtClose  ... ) == 0x0
 02152  1028   NtWaitForSingleObject  (32, 0, 0x0, ...
 02133  2016   NtQueryDefaultUILanguage  ... ) == 0x0
 02153  2016   NtOpenKey  (0x20019, {24, 52, 0x40, 0, 0,  (0x20019, {24, 52, 0x40, 0, 0, "SOFTWARE\Microsoft\CTF\"}, ... 272, ) }, ... 272, ) == 0x0
 02154  2016   NtQueryValueKey  (272,  (272, "EnableAnchorContext", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02155  2016   NtClose  (272, ... ) == 0x0
 02156  2016   NtSetEventBoostPriority  (32, ...
 02132   384   NtWaitForSingleObject  ... ) == 0x0
 02157   384   NtAllocateVirtualMemory  (-1, 3362816, 0, 4096, 4096, 4, ... 3362816, 4096, ) == 0x0
 02158   384   NtSetEventBoostPriority  (32, ...
 02152  1028   NtWaitForSingleObject  ... ) == 0x0
 02159  1028   NtTestAlert  (... ) == 0x0
 02160  1028   NtContinue  (24706352, 1, ...
 02161  1028   NtRegisterThreadTerminatePort  (24, ... ) == 0x0
 02162  1028   NtSetInformationThread  (-2, BasePriority, {thread info, class 3, size 4}, 4, ...
 02158   384   NtSetEventBoostPriority  ... ) == 0x0
 02163   384   NtTestAlert  (... ) == 0x0
 02164   384   NtContinue  (22609200, 1, ...
 02165   384   NtRegisterThreadTerminatePort  (24, ...
 02156  2016   NtSetEventBoostPriority  ... ) == 0x0
 02166   896   NtQueryInformationThread  (268, Basic, 28, ...
 02167  2016   NtCreateMutant  (0x1f0001, {24, 28, 0x80, 0, 0,  (0x1f0001, {24, 28, 0x80, 0, 0, "CTF.TimListCache.FMPDefaultS-1-5-21-1292428093-1383384898-725345543-1003MUTEX.DefaultS-1-5-21-1292428093-1383384898-725345543-1003"}, 0, ... }, 0, ...
 02166   896   NtQueryInformationThread  ... {ExitStatus=0x103,TebBaseAddress=0x7ffda000,Pid=1252,Tid=2012,}, 0x0, ) == 0x0
 02167  2016   NtCreateMutant  ... 272, ) == STATUS_OBJECT_NAME_EXISTS
 02168   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81863, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81863, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\14\1\0\0\344\4\0\0\334\7\0\0" ...  ...
 02165   384   NtRegisterThreadTerminatePort  ... ) == 0x0
 02168   896   NtRequestWaitReplyPort  ... {28, 56, reply, 0, 1252, 896, 81864, 0}  ... {28, 56, reply, 0, 1252, 896, 81864, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\14\1\0\0\344\4\0\0\334\7\0\0" )  ) == 0x0
 02169   384   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 02170   896   NtResumeThread  (268, ...
 02169   384   NtDuplicateObject  ... 276, ) == 0x0
 02171  2016   NtOpenSection  (0xf001f, {24, 28, 0x0, 0, 0,  (0xf001f, {24, 28, 0x0, 0, 0, "CTF.TimListCache.FMPDefaultS-1-5-21-1292428093-1383384898-725345543-1003SFM.DefaultS-1-5-21-1292428093-1383384898-725345543-1003"}, ... }, ...
 02172   384   NtWaitForSingleObject  (188, 0, {0, 0}, ...
 02171  2016   NtOpenSection  ... 280, ) == 0x0
 02172   384   NtWaitForSingleObject  ... ) == 0x102
 02173  2016   NtMapViewOfSection  (280, -1, (0x0), 0, 0, {0, 0}, 0, 1, 0, 4, ...
 02170   896   NtResumeThread  ... 1, ) == 0x0
 02173  2016   NtMapViewOfSection  ... (0x1990000), {0, 0}, 262144, ) == 0x0
 02174   896   NtAllocateVirtualMemory  (-1, 0, 0, 2097152, 8192, 4, ...
 02175  2016   NtWaitForSingleObject  (272, 0, {-50000000, -1}, ...
 02174   896   NtAllocateVirtualMemory  ... 27066368, 2097152, ) == 0x0
 02176   896   NtAllocateVirtualMemory  (-1, 29155328, 0, 8192, 4096, 4, ... 29155328, 8192, ) == 0x0
 02177   896   NtProtectVirtualMemory  (-1, (0x1bce000), 4096, 260, ... (0x1bce000), 4096, 4, ) == 0x0
 02178   896   NtCreateThread  (0x1f03ff, 0x0, -1, 2292532, 2292476, 1, ... 284, {1252, 1168}, ) == 0x0
 02179   896   NtQueryInformationThread  (284, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ffd9000,Pid=1252,Tid=1168,}, 0x0, ) == 0x0
 02180   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81864, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81864, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\34\1\0\0\344\4\0\0\220\4\0\0" ...  ...
 02181   384   NtAllocateVirtualMemory  (-1, 22597632, 0, 4096, 4096, 260, ...
 02182  2012   NtWaitForSingleObject  (32, 0, 0x0, ...
 02175  2016   NtWaitForSingleObject  ... ) == 0x0
 02181   384   NtAllocateVirtualMemory  ... 22597632, 4096, ) == 0x0
 02183  2016   NtReleaseMutant  (272, ...
 02184   384   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\mswsock.dll"}, 22606324, ... }, 22606324, ...
 02183  2016   NtReleaseMutant  ... 0x0, ) == 0x0
 02184   384   NtQueryAttributesFile  ... ) == 0x0
 02185  2016   NtWaitForSingleObject  (272, 0, {-50000000, -1}, ...
 02186   384   NtOpenFile  (0x100020, {24, 0, 0x40, 0, 0,  (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\mswsock.dll"}, 5, 96, ... }, 5, 96, ...
 02185  2016   NtWaitForSingleObject  ... ) == 0x0
 02186   384   NtOpenFile  ... 288, {status=0x0, info=1}, ) == 0x0
 02180   896   NtRequestWaitReplyPort  ... {28, 56, reply, 0, 1252, 896, 81865, 0}  ... {28, 56, reply, 0, 1252, 896, 81865, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\34\1\0\0\344\4\0\0\220\4\0\0" )  ) == 0x0
 02187  2016   NtReleaseMutant  (272, ...
 02188   896   NtResumeThread  (284, ...
 02187  2016   NtReleaseMutant  ... 0x0, ) == 0x0
 02188   896   NtResumeThread  ... 1, ) == 0x0
 02189  2016   NtWaitForSingleObject  (272, 0, {-50000000, -1}, ...
 02190   896   NtAllocateVirtualMemory  (-1, 0, 0, 2097152, 8192, 4, ...
 02189  2016   NtWaitForSingleObject  ... ) == 0x0
 02190   896   NtAllocateVirtualMemory  ... 29163520, 2097152, ) == 0x0
 02191  2016   NtReleaseMutant  (272, ...
 02192   384   NtCreateSection  (0xe, 0x0, 0x0, 16, 134217728, 288, ...
 02193  1168   NtWaitForSingleObject  (32, 0, 0x0, ...
 02194   896   NtAllocateVirtualMemory  (-1, 31252480, 0, 8192, 4096, 4, ...
 02192   384   NtCreateSection  ... 292, ) == 0x0
 02194   896   NtAllocateVirtualMemory  ... 31252480, 8192, ) == 0x0
 02195   384   NtClose  (288, ...
 02196   896   NtProtectVirtualMemory  (-1, (0x1dce000), 4096, 260, ...
 02195   384   NtClose  ... ) == 0x0
 02196   896   NtProtectVirtualMemory  ... (0x1dce000), 4096, 4, ) == 0x0
 02197   384   NtMapViewOfSection  (292, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 16, ...
 02198   896   NtCreateThread  (0x1f03ff, 0x0, -1, 2292532, 2292476, 1, ...
 02197   384   NtMapViewOfSection  ... (0x1dd0000), 0x0, 245760, ) == 0x0
 02198   896   NtCreateThread  ... 288, {1252, 1180}, ) == 0x0
 02191  2016   NtReleaseMutant  ... 0x0, ) == 0x0
 02199   384   NtClose  (292, ...
 02200  2016   NtUserMessageCall  (0x90130, WM_NCCREATE, 0x0, 0x95f840, 0, 670, 1, ...
 02199   384   NtClose  ... ) == 0x0
 02200  2016   NtUserMessageCall  ... ) == 0x1
 02201  2016   NtUserSetWindowFNID  (1507596, 681, ... ) == 0x1
 02202  2016   NtUserSetWindowLong  (1507596, 0, 5731232, 0, ...
 02203   384   NtUnmapViewOfSection  (-1, 0x1dd0000, ...
 02204   896   NtQueryInformationThread  (288, Basic, 28, ...
 02203   384   NtUnmapViewOfSection  ... ) == 0x0
 02204   896   NtQueryInformationThread  ... {ExitStatus=0x103,TebBaseAddress=0x7ffd8000,Pid=1252,Tid=1180,}, 0x0, ) == 0x0
 02202  2016   NtUserSetWindowLong  ... ) == 0x0
 02205   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81865, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81865, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG \1\0\0\344\4\0\0\234\4\0\0" ...  ...
 02206  2016   NtOpenKey  (0x2000000, {24, 52, 0x40, 0, 0,  (0x2000000, {24, 52, 0x40, 0, 0, "Software\Microsoft\Windows NT\CurrentVersion\IMM"}, ... }, ...
 02205   896   NtRequestWaitReplyPort  ... {28, 56, reply, 0, 1252, 896, 81866, 0}  ... {28, 56, reply, 0, 1252, 896, 81866, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG \1\0\0\344\4\0\0\234\4\0\0" )  ) == 0x0
 02206  2016   NtOpenKey  ... 292, ) == 0x0
 02207   896   NtResumeThread  (288, ...
 02208  2016   NtQueryValueKey  (292,  (292, "Ime File", Partial, 144, ... , Partial, 144, ...
 02209   384   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\mswsock.dll"}, 22606632, ... }, 22606632, ...
 02208  2016   NtQueryValueKey  ... TitleIdx=0, Type=1, Data= ... TitleIdx=0, Type=1, Data="m\0s\0c\0t\0f\0i\0m\0e\0.\0i\0m\0e\0\0\0"}, 38, ) }, 38, ) == 0x0
 02209   384   NtQueryAttributesFile  ... ) == 0x0
 02210  2016   NtClose  (292, ...
 02211   384   NtOpenFile  (0x100020, {24, 0, 0x40, 0, 0,  (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\mswsock.dll"}, 5, 96, ... }, 5, 96, ...
 02207   896   NtResumeThread  ... 1, ) == 0x0
 02211   384   NtOpenFile  ... 296, {status=0x0, info=1}, ) == 0x0
 02212   896   NtAllocateVirtualMemory  (-1, 0, 0, 2097152, 8192, 4, ...
 02213   384   NtCreateSection  (0xf, 0x0, 0x0, 16, 16777216, 296, ...
 02212   896   NtAllocateVirtualMemory  ... 31260672, 2097152, ) == 0x0
 02213   384   NtCreateSection  ... 300, ) == 0x0
 02214   896   NtAllocateVirtualMemory  (-1, 33349632, 0, 8192, 4096, 4, ...
 02210  2016   NtClose  ... ) == 0x0
 02215  1180   NtWaitForSingleObject  (32, 0, 0x0, ...
 02214   896   NtAllocateVirtualMemory  ... 33349632, 8192, ) == 0x0
 02216  2016   NtWaitForSingleObject  (32, 0, 0x0, ...
 02217   896   NtProtectVirtualMemory  (-1, (0x1fce000), 4096, 260, ...
 02218   384   NtQuerySection  (300, Image, 48, ... {section info, class 1, size 48}, 0x0, ) == 0x0
 02219   384   NtClose  (296, ... ) == 0x0
 02220   384   NtMapViewOfSection  (300, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x71a50000), 0x0, 258048, ) == 0x0
 02221   384   NtClose  (300, ... ) == 0x0
 02222   384   NtProtectVirtualMemory  (-1, (0x71a51000), 1060, 4, ... (0x71a51000), 4096, 32, ) == 0x0
 02217   896   NtProtectVirtualMemory  ... (0x1fce000), 4096, 4, ) == 0x0
 02223   896   NtCreateThread  (0x1f03ff, 0x0, -1, 2292532, 2292476, 1, ... 300, {1252, 928}, ) == 0x0
 02224   896   NtQueryInformationThread  (300, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ffd7000,Pid=1252,Tid=928,}, 0x0, ) == 0x0
 02225   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81866, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81866, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG,\1\0\0\344\4\0\0\240\3\0\0" ...  ...
 02226   384   NtProtectVirtualMemory  (-1, (0x71a51000), 4096, 32, ... (0x71a51000), 4096, 4, ) == 0x0
 02227   384   NtFlushInstructionCache  (-1, 1906642944, 1060, ... ) == 0x0
 02228   384   NtProtectVirtualMemory  (-1, (0x71a51000), 1060, 4, ... (0x71a51000), 4096, 32, ) == 0x0
 02229   384   NtProtectVirtualMemory  (-1, (0x71a51000), 4096, 32, ... (0x71a51000), 4096, 4, ) == 0x0
 02230   384   NtFlushInstructionCache  (-1, 1906642944, 1060, ... ) == 0x0
 02231   384   NtProtectVirtualMemory  (-1, (0x71a51000), 1060, 4, ... (0x71a51000), 4096, 32, ) == 0x0
 02225   896   NtRequestWaitReplyPort  ... {28, 56, reply, 0, 1252, 896, 81867, 0}  ... {28, 56, reply, 0, 1252, 896, 81867, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG,\1\0\0\344\4\0\0\240\3\0\0" )  ) == 0x0
 02232   896   NtResumeThread  (300, ... 1, ) == 0x0
 02233   896   NtAllocateVirtualMemory  (-1, 0, 0, 2097152, 8192, 4, ... 33357824, 2097152, ) == 0x0
 02234   896   NtAllocateVirtualMemory  (-1, 35446784, 0, 8192, 4096, 4, ... 35446784, 8192, ) == 0x0
 02235   896   NtProtectVirtualMemory  (-1, (0x21ce000), 4096, 260, ... (0x21ce000), 4096, 4, ) == 0x0
 02236   896   NtCreateThread  (0x1f03ff, 0x0, -1, 2292532, 2292476, 1, ... 296, {1252, 428}, ) == 0x0
 02237   384   NtProtectVirtualMemory  (-1, (0x71a51000), 4096, 32, ...
 02238   928   NtWaitForSingleObject  (32, 0, 0x0, ...
 02237   384   NtProtectVirtualMemory  ... (0x71a51000), 4096, 4, ) == 0x0
 02239   384   NtFlushInstructionCache  (-1, 1906642944, 1060, ... ) == 0x0
 02240   896   NtQueryInformationThread  (296, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ffd6000,Pid=1252,Tid=428,}, 0x0, ) == 0x0
 02241   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81867, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81867, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG(\1\0\0\344\4\0\0\254\1\0\0" ...  ...
 02242   384   NtOpenKey  (0x80000000, {24, 0, 0x40, 0, 0,  (0x80000000, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mswsock.dll"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02243   384   NtQuerySystemInformation  (Basic, 44, ... {Unknown=0,MaximumIncrement=156250,PhysicalPageSize=0x1000,NumberOfPhysicalPages=0xff7c,LowestPhysicalPage=0x1,HighestPhysicalPage=0xffff,AllocationGranularity=0x10000,LowestUserAddress=0x10000,HighestUserAddress=0x7ffeffff,ActiveProcessors=1,NumberProcessors=1,}, 0x0, ) == 0x0
 02244   384   NtQuerySystemInformation  (Processor, 12, ... {system info, class 1, size 12}, 0x0, ) == 0x0
 02241   896   NtRequestWaitReplyPort  ... {28, 56, reply, 0, 1252, 896, 81868, 0}  ... {28, 56, reply, 0, 1252, 896, 81868, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG(\1\0\0\344\4\0\0\254\1\0\0" )  ) == 0x0
 02245   896   NtResumeThread  (296, ... 1, ) == 0x0
 02246   896   NtAllocateVirtualMemory  (-1, 0, 0, 2097152, 8192, 4, ... 35454976, 2097152, ) == 0x0
 02247   896   NtAllocateVirtualMemory  (-1, 37543936, 0, 8192, 4096, 4, ... 37543936, 8192, ) == 0x0
 02248   896   NtProtectVirtualMemory  (-1, (0x23ce000), 4096, 260, ...
 02249   384   NtSetEventBoostPriority  (32, ...
 02250   428   NtWaitForSingleObject  (32, 0, 0x0, ...
 02182  2012   NtWaitForSingleObject  ... ) == 0x0
 02249   384   NtSetEventBoostPriority  ... ) == 0x0
 02251  2012   NtSetEventBoostPriority  (32, ...
 02193  1168   NtWaitForSingleObject  ... ) == 0x0
 02252  1168   NtSetEventBoostPriority  (32, ...
 02215  1180   NtWaitForSingleObject  ... ) == 0x0
 02253  1180   NtSetEventBoostPriority  (32, ...
 02216  2016   NtWaitForSingleObject  ... ) == 0x0
 02254  2016   NtSetEventBoostPriority  (32, ...
 02238   928   NtWaitForSingleObject  ... ) == 0x0
 02255   928   NtSetEventBoostPriority  (32, ...
 02250   428   NtWaitForSingleObject  ... ) == 0x0
 02256   428   NtTestAlert  (... ) == 0x0
 02255   928   NtSetEventBoostPriority  ... ) == 0x0
 02254  2016   NtSetEventBoostPriority  ... ) == 0x0
 02253  1180   NtSetEventBoostPriority  ... ) == 0x0
 02252  1168   NtSetEventBoostPriority  ... ) == 0x0
 02251  2012   NtSetEventBoostPriority  ... ) == 0x0
 02257   384   NtCreateEvent  (0x1f0003, 0x0, 0, 0, ...
 02248   896   NtProtectVirtualMemory  ... (0x23ce000), 4096, 4, ) == 0x0
 02258   428   NtContinue  (35454256, 1, ...
 02259   928   NtTestAlert  (...
 02260  2016   NtOpenSection  (0xe, {24, 8, 0x40, 0, 0,  (0xe, {24, 8, 0x40, 0, 0, "version.dll"}, ... }, ...
 02261  1180   NtTestAlert  (...
 02262  1168   NtTestAlert  (...
 02257   384   NtCreateEvent  ... 292, ) == 0x0
 02263   896   NtCreateThread  (0x1f03ff, 0x0, -1, 2292532, 2292476, 1, ...
 02264   428   NtRegisterThreadTerminatePort  (24, ...
 02259   928   NtTestAlert  ... ) == 0x0
 02260  2016   NtOpenSection  ... 304, ) == 0x0
 02261  1180   NtTestAlert  ... ) == 0x0
 02262  1168   NtTestAlert  ... ) == 0x0
 02265   384   NtWaitForSingleObject  (32, 0, 0x0, ...
 02263   896   NtCreateThread  ... 308, {1252, 1732}, ) == 0x0
 02264   428   NtRegisterThreadTerminatePort  ... ) == 0x0
 02266   928   NtContinue  (33357104, 1, ...
 02267  2016   NtMapViewOfSection  (304, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ...
 02268  1180   NtContinue  (31259952, 1, ...
 02269  1168   NtContinue  (29162800, 1, ...
 02270   896   NtQueryInformationThread  (308, Basic, 28, ...
 02271   428   NtSetInformationThread  (-2, BasePriority, {thread info, class 3, size 4}, 4, ...
 02272   928   NtRegisterThreadTerminatePort  (24, ...
 02267  2016   NtMapViewOfSection  ... (0x77c00000), 0x0, 32768, ) == 0x0
 02273  1180   NtRegisterThreadTerminatePort  (24, ...
 02274  1168   NtRegisterThreadTerminatePort  (24, ...
 02270   896   NtQueryInformationThread  ... {ExitStatus=0x103,TebBaseAddress=0x7ffd4000,Pid=1252,Tid=1732,}, 0x0, ) == 0x0
 02272   928   NtRegisterThreadTerminatePort  ... ) == 0x0
 02275  2016   NtClose  (304, ...
 02273  1180   NtRegisterThreadTerminatePort  ... ) == 0x0
 02274  1168   NtRegisterThreadTerminatePort  ... ) == 0x0
 02276   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81868, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81868, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG4\1\0\0\344\4\0\0\304\6\0\0" ...  ...
 02277   928   NtSetInformationThread  (-2, BasePriority, {thread info, class 3, size 4}, 4, ...
 02275  2016   NtClose  ... ) == 0x0
 02278  1180   NtSetInformationThread  (-2, BasePriority, {thread info, class 3, size 4}, 4, ...
 02279  1168   NtSetInformationThread  (-2, BasePriority, {thread info, class 3, size 4}, 4, ...
 02280  2012   NtTestAlert  (...
 02271   428   NtSetInformationThread  ... ) == 0x0
 02276   896   NtRequestWaitReplyPort  ... {28, 56, reply, 0, 1252, 896, 81869, 0}  ... {28, 56, reply, 0, 1252, 896, 81869, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG4\1\0\0\344\4\0\0\304\6\0\0" )  ) == 0x0
 02281  2016   NtProtectVirtualMemory  (-1, (0x77c01000), 304, 4, ...
 02280  2012   NtTestAlert  ... ) == 0x0
 02282   896   NtResumeThread  (308, ...
 02281  2016   NtProtectVirtualMemory  ... (0x77c01000), 4096, 32, ) == 0x0
 02283  2012   NtContinue  (26803504, 1, ...
 02282   896   NtResumeThread  ... 1, ) == 0x0
 02284  2016   NtProtectVirtualMemory  (-1, (0x77c01000), 4096, 32, ...
 02285  2012   NtRegisterThreadTerminatePort  (24, ...
 02286   896   NtAllocateVirtualMemory  (-1, 0, 0, 2097152, 8192, 4, ...
 02284  2016   NtProtectVirtualMemory  ... (0x77c01000), 4096, 4, ) == 0x0
 02285  2012   NtRegisterThreadTerminatePort  ... ) == 0x0
 02286   896   NtAllocateVirtualMemory  ... 37552128, 2097152, ) == 0x0
 02287  2016   NtFlushInstructionCache  (-1, 2009075712, 304, ...
 02288  2012   NtSetInformationThread  (-2, BasePriority, {thread info, class 3, size 4}, 4, ...
 02289   428   NtQueryValueKey  (112,  (112, "FromCacheTimeout", Partial, 144, ... , Partial, 144, ...
 02290  1732   NtWaitForSingleObject  (32, 0, 0x0, ...
 02287  2016   NtFlushInstructionCache  ... ) == 0x0
 02291   896   NtAllocateVirtualMemory  (-1, 39641088, 0, 8192, 4096, 4, ...
 02289   428   NtQueryValueKey  ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02291   896   NtAllocateVirtualMemory  ... 39641088, 8192, ) == 0x0
 02292  2016   NtOpenKey  (0x80000000, {24, 0, 0x40, 0, 0,  (0x80000000, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\version.dll"}, ... }, ...
 02293   896   NtProtectVirtualMemory  (-1, (0x25ce000), 4096, 260, ...
 02292  2016   NtOpenKey  ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02293   896   NtProtectVirtualMemory  ... (0x25ce000), 4096, 4, ) == 0x0
 02294  2016   NtSetEventBoostPriority  (32, ...
 02295   896   NtCreateThread  (0x1f03ff, 0x0, -1, 2292532, 2292476, 1, ...
 02265   384   NtWaitForSingleObject  ... ) == 0x0
 02294  2016   NtSetEventBoostPriority  ... ) == 0x0
 02296   384   NtOpenSection  (0xe, {24, 8, 0x40, 0, 0,  (0xe, {24, 8, 0x40, 0, 0, "hnetcfg.dll"}, ... }, ...
 02295   896   NtCreateThread  ... 304, {1252, 748}, ) == 0x0
 02296   384   NtOpenSection  ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02297  2016   NtWaitForSingleObject  (32, 0, 0x0, ...
 02298   428   NtQueryValueKey  (112,  (112, "SecureProtocols", Partial, 144, ... , Partial, 144, ...
 02299   896   NtQueryInformationThread  (304, Basic, 28, ...
 02300   384   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\u:\work\hnetcfg.dll"}, 22606244, ... }, 22606244, ...
 02299   896   NtQueryInformationThread  ... {ExitStatus=0x103,TebBaseAddress=0x7ffaf000,Pid=1252,Tid=748,}, 0x0, ) == 0x0
 02301   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81869, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81869, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG0\1\0\0\344\4\0\0\354\2\0\0" ... {28, 56, reply, 0, 1252, 896, 81870, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG0\1\0\0\344\4\0\0\354\2\0\0" )  ... {28, 56, reply, 0, 1252, 896, 81870, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81869, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG0\1\0\0\344\4\0\0\354\2\0\0" ... {28, 56, reply, 0, 1252, 896, 81870, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG0\1\0\0\344\4\0\0\354\2\0\0" )  ) == 0x0
 02302   896   NtResumeThread  (304, ... 1, ) == 0x0
 02303   896   NtAllocateVirtualMemory  (-1, 0, 0, 2097152, 8192, 4, ... 39649280, 2097152, ) == 0x0
 02304   896   NtAllocateVirtualMemory  (-1, 41738240, 0, 8192, 4096, 4, ... 41738240, 8192, ) == 0x0
 02305   896   NtProtectVirtualMemory  (-1, (0x27ce000), 4096, 260, ...
 02298   428   NtQueryValueKey  ... TitleIdx=0, Type=4, Data= ... TitleIdx=0, Type=4, Data="\240\0\0\0"}, 16, ) }, 16, ) == 0x0
 02306   748   NtWaitForSingleObject  (32, 0, 0x0, ...
 02305   896   NtProtectVirtualMemory  ... (0x27ce000), 4096, 4, ) == 0x0
 02307   896   NtCreateThread  (0x1f03ff, 0x0, -1, 2292532, 2292476, 1, ... 312, {1252, 900}, ) == 0x0
 02308   896   NtQueryInformationThread  (312, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ffae000,Pid=1252,Tid=900,}, 0x0, ) == 0x0
 02309   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81870, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81870, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG8\1\0\0\344\4\0\0\204\3\0\0" ... {28, 56, reply, 0, 1252, 896, 81871, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG8\1\0\0\344\4\0\0\204\3\0\0" )  ... {28, 56, reply, 0, 1252, 896, 81871, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81870, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG8\1\0\0\344\4\0\0\204\3\0\0" ... {28, 56, reply, 0, 1252, 896, 81871, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG8\1\0\0\344\4\0\0\204\3\0\0" )  ) == 0x0
 02310   896   NtResumeThread  (312, ... 1, ) == 0x0
 02311   896   NtAllocateVirtualMemory  (-1, 0, 0, 2097152, 8192, 4, ... 41746432, 2097152, ) == 0x0
 02312   428   NtOpenKey  (0x20019, {24, 52, 0x40, 0, 0,  (0x20019, {24, 52, 0x40, 0, 0, "Software\Policies"}, ... }, ...
 02313   900   NtWaitForSingleObject  (32, 0, 0x0, ...
 02314   896   NtAllocateVirtualMemory  (-1, 43835392, 0, 8192, 4096, 4, ...
 02300   384   NtQueryAttributesFile  ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02162  1028   NtSetInformationThread  ... ) == 0x0
 02277   928   NtSetInformationThread  ... ) == 0x0
 02278  1180   NtSetInformationThread  ... ) == 0x0
 02279  1168   NtSetInformationThread  ... ) == 0x0
 02288  2012   NtSetInformationThread  ... ) == 0x0
 02314   896   NtAllocateVirtualMemory  ... 43835392, 8192, ) == 0x0
 02315   384   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\hnetcfg.dll"}, 22606244, ... }, 22606244, ...
 02316  1028   NtCreateEvent  (0x100003, 0x0, 1, 0, ...
 02317   928   NtCreateEvent  (0x100003, 0x0, 1, 0, ...
 02318  1180   NtCreateEvent  (0x100003, 0x0, 1, 0, ...
 02319  1168   NtCreateEvent  (0x100003, 0x0, 1, 0, ...
 02320   896   NtProtectVirtualMemory  (-1, (0x29ce000), 4096, 260, ...
 02315   384   NtQueryAttributesFile  ... ) == 0x0
 02321  2012   NtCreateEvent  (0x100003, 0x0, 1, 0, ...
 02316  1028   NtCreateEvent  ... 316, ) == 0x0
 02317   928   NtCreateEvent  ... 320, ) == 0x0
 02318  1180   NtCreateEvent  ... 324, ) == 0x0
 02320   896   NtProtectVirtualMemory  ... (0x29ce000), 4096, 4, ) == 0x0
 02322   384   NtOpenFile  (0x100020, {24, 0, 0x40, 0, 0,  (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\hnetcfg.dll"}, 5, 96, ... }, 5, 96, ...
 02319  1168   NtCreateEvent  ... 328, ) == 0x0
 02321  2012   NtCreateEvent  ... 332, ) == 0x0
 02323  1028   NtWaitForSingleObject  (316, 0, 0x0, ...
 02324   928   NtClose  (320, ...
 02325   896   NtCreateThread  (0x1f03ff, 0x0, -1, 2292532, 2292476, 1, ...
 02322   384   NtOpenFile  ... 336, {status=0x0, info=1}, ) == 0x0
 02326  1180   NtClose  (324, ...
 02327  1168   NtClose  (328, ...
 02328  2012   NtClose  (332, ...
 02325   896   NtCreateThread  ... 340, {1252, 1388}, ) == 0x0
 02324   928   NtClose  ... ) == 0x0
 02329   384   NtCreateSection  (0xf, 0x0, 0x0, 16, 16777216, 336, ...
 02326  1180   NtClose  ... ) == 0x0
 02327  1168   NtClose  ... ) == 0x0
 02328  2012   NtClose  ... ) == 0x0
 02330   896   NtQueryInformationThread  (340, Basic, 28, ...
 02329   384   NtCreateSection  ... 332, ) == 0x0
 02331   928   NtWaitForSingleObject  (316, 0, 0x0, ...
 02332  1180   NtWaitForSingleObject  (316, 0, 0x0, ...
 02333  1168   NtWaitForSingleObject  (316, 0, 0x0, ...
 02330   896   NtQueryInformationThread  ... {ExitStatus=0x103,TebBaseAddress=0x7ffad000,Pid=1252,Tid=1388,}, 0x0, ) == 0x0
 02334   384   NtQuerySection  (332, Image, 48, ...
 02335  2012   NtWaitForSingleObject  (316, 0, 0x0, ...
 02312   428   NtOpenKey  ... 328, ) == 0x0
 02336   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81871, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81871, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFGT\1\0\0\344\4\0\0l\5\0\0" ...  ...
 02334   384   NtQuerySection  ... {section info, class 1, size 48}, 0x0, ) == 0x0
 02336   896   NtRequestWaitReplyPort  ... {28, 56, reply, 0, 1252, 896, 81872, 0}  ... {28, 56, reply, 0, 1252, 896, 81872, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFGT\1\0\0\344\4\0\0l\5\0\0" )  ) == 0x0
 02337   384   NtClose  (336, ...
 02338   896   NtResumeThread  (340, ...
 02337   384   NtClose  ... ) == 0x0
 02339   428   NtOpenKey  (0x20019, {24, 64, 0x40, 0, 0,  (0x20019, {24, 64, 0x40, 0, 0, "Software\Policies"}, ... }, ...
 02338   896   NtResumeThread  ... 1, ) == 0x0
 02340   384   NtMapViewOfSection  (332, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ...
 02341  1388   NtWaitForSingleObject  (32, 0, 0x0, ...
 02342   896   NtAllocateVirtualMemory  (-1, 0, 0, 2097152, 8192, 4, ...
 02340   384   NtMapViewOfSection  ... (0x662b0000), 0x0, 360448, ) == 0x0
 02342   896   NtAllocateVirtualMemory  ... 43843584, 2097152, ) == 0x0
 02343   384   NtClose  (332, ...
 02344   896   NtAllocateVirtualMemory  (-1, 45932544, 0, 8192, 4096, 4, ...
 02343   384   NtClose  ... ) == 0x0
 02344   896   NtAllocateVirtualMemory  ... 45932544, 8192, ) == 0x0
 02345   384   NtProtectVirtualMemory  (-1, (0x662b1000), 932, 4, ...
 02346   896   NtProtectVirtualMemory  (-1, (0x2bce000), 4096, 260, ...
 02345   384   NtProtectVirtualMemory  ... (0x662b1000), 4096, 32, ) == 0x0
 02339   428   NtOpenKey  ... 332, ) == 0x0
 02346   896   NtProtectVirtualMemory  ... (0x2bce000), 4096, 4, ) == 0x0
 02347   384   NtProtectVirtualMemory  (-1, (0x662b1000), 4096, 32, ...
 02348   896   NtCreateThread  (0x1f03ff, 0x0, -1, 2292532, 2292476, 1, ...
 02347   384   NtProtectVirtualMemory  ... (0x662b1000), 4096, 4, ) == 0x0
 02348   896   NtCreateThread  ... 336, {1252, 2036}, ) == 0x0
 02349   384   NtFlushInstructionCache  (-1, 1714098176, 932, ...
 02350   896   NtQueryInformationThread  (336, Basic, 28, ...
 02349   384   NtFlushInstructionCache  ... ) == 0x0
 02350   896   NtQueryInformationThread  ... {ExitStatus=0x103,TebBaseAddress=0x7ffac000,Pid=1252,Tid=2036,}, 0x0, ) == 0x0
 02351   384   NtProtectVirtualMemory  (-1, (0x662b1000), 932, 4, ...
 02352   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81872, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81872, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFGP\1\0\0\344\4\0\0\364\7\0\0" ...  ...
 02351   384   NtProtectVirtualMemory  ... (0x662b1000), 4096, 32, ) == 0x0
 02353   428   NtOpenKey  (0x20019, {24, 64, 0x40, 0, 0,  (0x20019, {24, 64, 0x40, 0, 0, "Software"}, ... }, ...
 02352   896   NtRequestWaitReplyPort  ... {28, 56, reply, 0, 1252, 896, 81873, 0}  ... {28, 56, reply, 0, 1252, 896, 81873, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFGP\1\0\0\344\4\0\0\364\7\0\0" )  ) == 0x0
 02354   384   NtProtectVirtualMemory  (-1, (0x662b1000), 4096, 32, ...
 02355   896   NtResumeThread  (336, ...
 02354   384   NtProtectVirtualMemory  ... (0x662b1000), 4096, 4, ) == 0x0
 02355   896   NtResumeThread  ... 1, ) == 0x0
 02356   384   NtFlushInstructionCache  (-1, 1714098176, 932, ...
 02357   896   NtAllocateVirtualMemory  (-1, 0, 0, 2097152, 8192, 4, ...
 02356   384   NtFlushInstructionCache  ... ) == 0x0
 02357   896   NtAllocateVirtualMemory  ... 45940736, 2097152, ) == 0x0
 02358   384   NtProtectVirtualMemory  (-1, (0x662b1000), 932, 4, ...
 02353   428   NtOpenKey  ... 324, ) == 0x0
 02359  2036   NtWaitForSingleObject  (32, 0, 0x0, ...
 02358   384   NtProtectVirtualMemory  ... (0x662b1000), 4096, 32, ) == 0x0
 02360   896   NtAllocateVirtualMemory  (-1, 48029696, 0, 8192, 4096, 4, ...
 02361   428   NtOpenKey  (0x20019, {24, 52, 0x40, 0, 0,  (0x20019, {24, 52, 0x40, 0, 0, "Software"}, ... }, ...
 02360   896   NtAllocateVirtualMemory  ... 48029696, 8192, ) == 0x0
 02362   384   NtProtectVirtualMemory  (-1, (0x662b1000), 4096, 32, ...
 02363   896   NtProtectVirtualMemory  (-1, (0x2dce000), 4096, 260, ...
 02362   384   NtProtectVirtualMemory  ... (0x662b1000), 4096, 4, ) == 0x0
 02363   896   NtProtectVirtualMemory  ... (0x2dce000), 4096, 4, ) == 0x0
 02364   384   NtFlushInstructionCache  (-1, 1714098176, 932, ...
 02365   896   NtCreateThread  (0x1f03ff, 0x0, -1, 2292532, 2292476, 1, ...
 02364   384   NtFlushInstructionCache  ... ) == 0x0
 02365   896   NtCreateThread  ... 320, {1252, 1372}, ) == 0x0
 02366   384   NtProtectVirtualMemory  (-1, (0x662b1000), 932, 4, ... (0x662b1000), 4096, 32, ) == 0x0
 02367   384   NtProtectVirtualMemory  (-1, (0x662b1000), 4096, 32, ... (0x662b1000), 4096, 4, ) == 0x0
 02368   384   NtFlushInstructionCache  (-1, 1714098176, 932, ... ) == 0x0
 02369   384   NtProtectVirtualMemory  (-1, (0x662b1000), 932, 4, ... (0x662b1000), 4096, 32, ) == 0x0
 02370   896   NtQueryInformationThread  (320, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ffab000,Pid=1252,Tid=1372,}, 0x0, ) == 0x0
 02371   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81873, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81873, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG@\1\0\0\344\4\0\0\\5\0\0" ... {28, 56, reply, 0, 1252, 896, 81874, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG@\1\0\0\344\4\0\0\\5\0\0" )  ... {28, 56, reply, 0, 1252, 896, 81874, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81873, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG@\1\0\0\344\4\0\0\\5\0\0" ... {28, 56, reply, 0, 1252, 896, 81874, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG@\1\0\0\344\4\0\0\\5\0\0" )  ) == 0x0
 02372   896   NtResumeThread  (320, ... 1, ) == 0x0
 02373   896   NtAllocateVirtualMemory  (-1, 0, 0, 2097152, 8192, 4, ... 48037888, 2097152, ) == 0x0
 02374   896   NtAllocateVirtualMemory  (-1, 50126848, 0, 8192, 4096, 4, ... 50126848, 8192, ) == 0x0
 02375   896   NtProtectVirtualMemory  (-1, (0x2fce000), 4096, 260, ...
 02376   384   NtProtectVirtualMemory  (-1, (0x662b1000), 4096, 32, ...
 02377  1372   NtWaitForSingleObject  (32, 0, 0x0, ...
 02376   384   NtProtectVirtualMemory  ... (0x662b1000), 4096, 4, ) == 0x0
 02378   384   NtFlushInstructionCache  (-1, 1714098176, 932, ... ) == 0x0
 02379   384   NtOpenKey  (0x80000000, {24, 0, 0x40, 0, 0,  (0x80000000, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\hnetcfg.dll"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02380   384   NtSetEventBoostPriority  (32, ...
 02290  1732   NtWaitForSingleObject  ... ) == 0x0
 02381  1732   NtSetEventBoostPriority  (32, ...
 02297  2016   NtWaitForSingleObject  ... ) == 0x0
 02382  2016   NtSetEventBoostPriority  (32, ...
 02306   748   NtWaitForSingleObject  ... ) == 0x0
 02383   748   NtSetEventBoostPriority  (32, ...
 02313   900   NtWaitForSingleObject  ... ) == 0x0
 02384   900   NtSetEventBoostPriority  (32, ...
 02341  1388   NtWaitForSingleObject  ... ) == 0x0
 02385  1388   NtSetEventBoostPriority  (32, ...
 02359  2036   NtWaitForSingleObject  ... ) == 0x0
 02386  2036   NtSetEventBoostPriority  (32, ...
 02377  1372   NtWaitForSingleObject  ... ) == 0x0
 02387  1372   NtTestAlert  (... ) == 0x0
 02386  2036   NtSetEventBoostPriority  ... ) == 0x0
 02385  1388   NtSetEventBoostPriority  ... ) == 0x0
 02384   900   NtSetEventBoostPriority  ... ) == 0x0
 02383   748   NtSetEventBoostPriority  ... ) == 0x0
 02382  2016   NtSetEventBoostPriority  ... ) == 0x0
 02381  1732   NtSetEventBoostPriority  ... ) == 0x0
 02380   384   NtSetEventBoostPriority  ... ) == 0x0
 02375   896   NtProtectVirtualMemory  ... (0x2fce000), 4096, 4, ) == 0x0
 02388  1372   NtContinue  (48037168, 1, ...
 02389  2036   NtTestAlert  (...
 02390  1388   NtTestAlert  (...
 02391   900   NtTestAlert  (...
 02392   748   NtTestAlert  (...
 02393  2016   NtQueryInformationProcess  (-1, DefaultHardErrorMode, 4, ...
 02394   384   NtQuerySystemInformation  (Basic, 44, ...
 02395   896   NtCreateThread  (0x1f03ff, 0x0, -1, 2292532, 2292476, 1, ...
 02396  1372   NtRegisterThreadTerminatePort  (24, ...
 02389  2036   NtTestAlert  ... ) == 0x0
 02390  1388   NtTestAlert  ... ) == 0x0
 02391   900   NtTestAlert  ... ) == 0x0
 02392   748   NtTestAlert  ... ) == 0x0
 02393  2016   NtQueryInformationProcess  ... {process info, class 12, size 4}, 0x0, ) == 0x0
 02394   384   NtQuerySystemInformation  ... {Unknown=0,MaximumIncrement=156250,PhysicalPageSize=0x1000,NumberOfPhysicalPages=0xff7c,LowestPhysicalPage=0x1,HighestPhysicalPage=0xffff,AllocationGranularity=0x10000,LowestUserAddress=0x10000,HighestUserAddress=0x7ffeffff,ActiveProcessors=1,NumberProcessors=1,}, 0x0, ) == 0x0
 02395   896   NtCreateThread  ... 344, {1252, 1600}, ) == 0x0
 02396  1372   NtRegisterThreadTerminatePort  ... ) == 0x0
 02397  2036   NtContinue  (45940016, 1, ...
 02398  1388   NtContinue  (43842864, 1, ...
 02399   900   NtContinue  (41745712, 1, ...
 02400   748   NtContinue  (39648560, 1, ...
 02401  2016   NtSetInformationProcess  (-1, DefaultHardErrorMode, {process info, class 12, size 4}, 4, ...
 02402   384   NtOpenKey  (0x20019, {24, 52, 0x40, 0, 0,  (0x20019, {24, 52, 0x40, 0, 0, "Software\Microsoft\Rpc\PagedBuffers"}, ... }, ...
 02403   896   NtQueryInformationThread  (344, Basic, 28, ...
 02404  1372   NtSetInformationThread  (-2, BasePriority, {thread info, class 3, size 4}, 4, ...
 02405  2036   NtRegisterThreadTerminatePort  (24, ...
 02406  1388   NtRegisterThreadTerminatePort  (24, ...
 02407   900   NtRegisterThreadTerminatePort  (24, ...
 02408   748   NtRegisterThreadTerminatePort  (24, ...
 02401  2016   NtSetInformationProcess  ... ) == 0x0
 02402   384   NtOpenKey  ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02403   896   NtQueryInformationThread  ... {ExitStatus=0x103,TebBaseAddress=0x7ffaa000,Pid=1252,Tid=1600,}, 0x0, ) == 0x0
 02405  2036   NtRegisterThreadTerminatePort  ... ) == 0x0
 02406  1388   NtRegisterThreadTerminatePort  ... ) == 0x0
 02407   900   NtRegisterThreadTerminatePort  ... ) == 0x0
 02408   748   NtRegisterThreadTerminatePort  ... ) == 0x0
 02409  2016   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\msctfime.ime"}, 9824780, ... }, 9824780, ...
 02410  1732   NtTestAlert  (...
 02404  1372   NtSetInformationThread  ... ) == 0x0
 02411   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81874, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81874, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFGX\1\0\0\344\4\0\0@\6\0\0" ...  ...
 02412  2036   NtSetInformationThread  (-2, BasePriority, {thread info, class 3, size 4}, 4, ...
 02413  1388   NtSetInformationThread  (-2, BasePriority, {thread info, class 3, size 4}, 4, ...
 02414   900   NtSetInformationThread  (-2, BasePriority, {thread info, class 3, size 4}, 4, ...
 02415   748   NtSetInformationThread  (-2, BasePriority, {thread info, class 3, size 4}, 4, ...
 02409  2016   NtQueryAttributesFile  ... ) == 0x0
 02410  1732   NtTestAlert  ... ) == 0x0
 02416   384   NtOpenKey  (0x20019, {24, 52, 0x40, 0, 0,  (0x20019, {24, 52, 0x40, 0, 0, "Software\Microsoft\Rpc"}, ... }, ...
 02417  1372   NtWaitForSingleObject  (316, 0, 0x0, ...
 02411   896   NtRequestWaitReplyPort  ... {28, 56, reply, 0, 1252, 896, 81875, 0}  ... {28, 56, reply, 0, 1252, 896, 81875, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFGX\1\0\0\344\4\0\0@\6\0\0" )  ) == 0x0
 02418  1732   NtContinue  (37551408, 1, ...
 02416   384   NtOpenKey  ... 348, ) == 0x0
 02419  2016   NtOpenFile  (0x100020, {24, 0, 0x40, 0, 0,  (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\msctfime.ime"}, 5, 96, ... }, 5, 96, ...
 02420   896   NtResumeThread  (344, ...
 02421  1732   NtRegisterThreadTerminatePort  (24, ...
 02422   384   NtQueryValueKey  (348,  (348, "MaxRpcSize", Partial, 144, ... , Partial, 144, ...
 02419  2016   NtOpenFile  ... 352, {status=0x0, info=1}, ) == 0x0
 02420   896   NtResumeThread  ... 1, ) == 0x0
 02421  1732   NtRegisterThreadTerminatePort  ... ) == 0x0
 02422   384   NtQueryValueKey  ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02423  2016   NtCreateSection  (0xe, 0x0, 0x0, 16, 134217728, 352, ...
 02424   896   NtAllocateVirtualMemory  (-1, 0, 0, 2097152, 8192, 4, ...
 02425  1732   NtSetInformationThread  (-2, BasePriority, {thread info, class 3, size 4}, 4, ...
 02426   384   NtClose  (348, ...
 02423  2016   NtCreateSection  ... 356, ) == 0x0
 02424   896   NtAllocateVirtualMemory  ... 50135040, 2097152, ) == 0x0
 02427  1600   NtWaitForSingleObject  (32, 0, 0x0, ...
 02426   384   NtClose  ... ) == 0x0
 02428  2016   NtClose  (352, ...
 02429   896   NtAllocateVirtualMemory  (-1, 52224000, 0, 8192, 4096, 4, ...
 02428  2016   NtClose  ... ) == 0x0
 02429   896   NtAllocateVirtualMemory  ... 52224000, 8192, ) == 0x0
 02430   384   NtOpenKey  (0x20019, {24, 52, 0x40, 0, 0,  (0x20019, {24, 52, 0x40, 0, 0, "Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\packed.exe\RpcThreadPoolThrottle"}, ... }, ...
 02431   896   NtProtectVirtualMemory  (-1, (0x31ce000), 4096, 260, ...
 02430   384   NtOpenKey  ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02431   896   NtProtectVirtualMemory  ... (0x31ce000), 4096, 4, ) == 0x0
 02432   384   NtCreateEvent  (0x1f0003, 0x0, 1, 0, ...
 02433   896   NtCreateThread  (0x1f03ff, 0x0, -1, 2292532, 2292476, 1, ...
 02432   384   NtCreateEvent  ... 352, ) == 0x0
 02433   896   NtCreateThread  ... 348, {1252, 1948}, ) == 0x0
 02434   384   NtCreateEvent  (0x1f0003, 0x0, 1, 0, ...
 02435  2016   NtMapViewOfSection  (356, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 16, ...
 02434   384   NtCreateEvent  ... 360, ) == 0x0
 02435  2016   NtMapViewOfSection  ... (0x31d0000), 0x0, 180224, ) == 0x0
 02436   896   NtQueryInformationThread  (348, Basic, 28, ...
 02437  2016   NtClose  (356, ...
 02436   896   NtQueryInformationThread  ... {ExitStatus=0x103,TebBaseAddress=0x7ffa9000,Pid=1252,Tid=1948,}, 0x0, ) == 0x0
 02437  2016   NtClose  ... ) == 0x0
 02438   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81875, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81875, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\\1\0\0\344\4\0\0\234\7\0\0" ...  ...
 02439  2016   NtUnmapViewOfSection  (-1, 0x31d0000, ...
 02438   896   NtRequestWaitReplyPort  ... {28, 56, reply, 0, 1252, 896, 81876, 0}  ... {28, 56, reply, 0, 1252, 896, 81876, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\\1\0\0\344\4\0\0\234\7\0\0" )  ) == 0x0
 02439  2016   NtUnmapViewOfSection  ... ) == 0x0
 02440   896   NtResumeThread  (348, ...
 02441   384   NtQuerySystemTime  (...
 02442  2016   NtSetEventBoostPriority  (32, ...
 02441   384   NtQuerySystemTime  ... {1448985414, 29929616}, ) == 0x0
 02427  1600   NtWaitForSingleObject  ... ) == 0x0
 02442  2016   NtSetEventBoostPriority  ... ) == 0x0
 02443  1600   NtTestAlert  (...
 02444   384   NtCreateEvent  (0x1f0003, 0x0, 0, 0, ...
 02443  1600   NtTestAlert  ... ) == 0x0
 02445  2016   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\msctfime.ime"}, 9824376, ... }, 9824376, ...
 02444   384   NtCreateEvent  ... 356, ) == 0x0
 02440   896   NtResumeThread  ... 1, ) == 0x0
 02445  2016   NtQueryAttributesFile  ... ) == 0x0
 02446   384   NtOpenKey  (0x20019, {24, 52, 0x40, 0, 0,  (0x20019, {24, 52, 0x40, 0, 0, "Software\Policies\Microsoft\Windows NT\Rpc"}, ... }, ...
 02447   896   NtAllocateVirtualMemory  (-1, 0, 0, 2097152, 8192, 4, ...
 02448  2016   NtCreateFile  (0x80100080, {24, 0, 0x40, 0, 9825120,  (0x80100080, {24, 0, 0x40, 0, 9825120, "\??\C:\WINDOWS\system32\msctfime.ime"}, 0x0, 0, 5, 1, 96, 0, 0, ... }, 0x0, 0, 5, 1, 96, 0, 0, ...
 02446   384   NtOpenKey  ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02447   896   NtAllocateVirtualMemory  ... 52232192, 2097152, ) == 0x0
 02448  2016   NtCreateFile  ... 364, {status=0x0, info=1}, ) == 0x0
 02449  1600   NtContinue  (50134320, 1, ...
 02450  1948   NtTestAlert  (...
 02451   896   NtAllocateVirtualMemory  (-1, 54321152, 0, 8192, 4096, 4, ...
 02452   384   NtQuerySystemInformation  (Performance, 312, ...
 02453  1600   NtRegisterThreadTerminatePort  (24, ...
 02450  1948   NtTestAlert  ... ) == 0x0
 02451   896   NtAllocateVirtualMemory  ... 54321152, 8192, ) == 0x0
 02452   384   NtQuerySystemInformation  ... {system info, class 2, size 312}, 0x0, ) == 0x0
 02453  1600   NtRegisterThreadTerminatePort  ... ) == 0x0
 02454  1948   NtContinue  (52231472, 1, ...
 02455   896   NtProtectVirtualMemory  (-1, (0x33ce000), 4096, 260, ...
 02456   384   NtQueryInformationProcess  (-1, QuotaLimits, 32, ...
 02457  1600   NtSetInformationThread  (-2, BasePriority, {thread info, class 3, size 4}, 4, ...
 02458  1948   NtRegisterThreadTerminatePort  (24, ...
 02459  2016   NtCreateSection  (0xf0005, 0x0, 0x0, 2, 134217728, 364, ...
 02456   384   NtQueryInformationProcess  ... {process info, class 1, size 32}, 0x0, ) == 0x0
 02458  1948   NtRegisterThreadTerminatePort  ... ) == 0x0
 02459  2016   NtCreateSection  ... 368, ) == 0x0
 02460   384   NtQueryInformationProcess  (-1, VmCounters, 44, ...
 02455   896   NtProtectVirtualMemory  ... (0x33ce000), 4096, 4, ) == 0x0
 02457  1600   NtSetInformationThread  ... ) == 0x0
 02461  2016   NtClose  (364, ...
 02460   384   NtQueryInformationProcess  ... {process info, class 3, size 44}, 0x0, ) == 0x0
 02462   896   NtCreateThread  (0x1f03ff, 0x0, -1, 2292532, 2292476, 1, ...
 02463  1948   NtSetInformationThread  (-2, BasePriority, {thread info, class 3, size 4}, 4, ...
 02461  2016   NtClose  ... ) == 0x0
 02464  1600   NtWaitForSingleObject  (316, 0, 0x0, ...
 02462   896   NtCreateThread  ... 364, {1252, 252}, ) == 0x0
 02465  2016   NtMapViewOfSection  (368, -1, (0x0), 0, 0, {0, 0}, 0, 1, 0, 2, ...
 02466   384   NtCreateEvent  (0x1f0003, 0x0, 0, 0, ...
 02463  1948   NtSetInformationThread  ... ) == 0x0
 02467   896   NtQueryInformationThread  (364, Basic, 28, ...
 02465  2016   NtMapViewOfSection  ... (0x33d0000), {0, 0}, 180224, ) == 0x0
 02466   384   NtCreateEvent  ... 372, ) == 0x0
 02467   896   NtQueryInformationThread  ... {ExitStatus=0x103,TebBaseAddress=0x7ffa8000,Pid=1252,Tid=252,}, 0x0, ) == 0x0
 02468  1948   NtWaitForSingleObject  (316, 0, 0x0, ...
 02469   384   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 02470   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81876, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81876, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFGl\1\0\0\344\4\0\0\374\0\0\0" ...  ...
 02471  2016   NtClose  (368, ...
 02469   384   NtDuplicateObject  ... 376, ) == 0x0
 02471  2016   NtClose  ... ) == 0x0
 02472  2016   NtQueryInformationProcess  (-1, DefaultHardErrorMode, 4, ... {process info, class 12, size 4}, 0x0, ) == 0x0
 02473  2016   NtSetInformationProcess  (-1, DefaultHardErrorMode, {process info, class 12, size 4}, 4, ... ) == 0x0
 02474  2016   NtQueryDefaultLocale  (1, 9825740, ... ) == 0x0
 02475  2016   NtQueryVirtualMemory  (-1, 0x33d0000, Basic, 28, ... {BaseAddress=0x33d0000,AllocationBase=0x33d0000,AllocationProtect=0x2,RegionSize=0x2c000,State=0x1000,Protect=0x2,Type=0x40000,}, 0x0, ) == 0x0
 02476  2016   NtQueryVirtualMemory  (-1, 0x33d0000, Basic, 28, ... {BaseAddress=0x33d0000,AllocationBase=0x33d0000,AllocationProtect=0x2,RegionSize=0x2c000,State=0x1000,Protect=0x2,Type=0x40000,}, 0x0, ) == 0x0
 02477   384   NtOpenKey  (0x20019, {24, 52, 0x40, 0, 0,  (0x20019, {24, 52, 0x40, 0, 0, "Software\Microsoft\Rpc\SecurityService"}, ... }, ...
 02470   896   NtRequestWaitReplyPort  ... {28, 56, reply, 0, 1252, 896, 81877, 0}  ... {28, 56, reply, 0, 1252, 896, 81877, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFGl\1\0\0\344\4\0\0\374\0\0\0" )  ) == 0x0
 02477   384   NtOpenKey  ... 368, ) == 0x0
 02478   896   NtResumeThread  (364, ...
 02479   384   NtQueryValueKey  (368,  (368, "DefaultAuthLevel", Partial, 144, ... , Partial, 144, ...
 02478   896   NtResumeThread  ... 1, ) == 0x0
 02479   384   NtQueryValueKey  ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02480   896   NtAllocateVirtualMemory  (-1, 0, 0, 2097152, 8192, 4, ...
 02481   384   NtClose  (368, ...
 02480   896   NtAllocateVirtualMemory  ... 54525952, 2097152, ) == 0x0
 02481   384   NtClose  ... ) == 0x0
 02482  2016   NtUnmapViewOfSection  (-1, 0x33d0000, ...
 02483   252   NtTestAlert  (...
 02484   896   NtAllocateVirtualMemory  (-1, 56614912, 0, 8192, 4096, 4, ...
 02482  2016   NtUnmapViewOfSection  ... ) == 0x0
 02483   252   NtTestAlert  ... ) == 0x0
 02484   896   NtAllocateVirtualMemory  ... 56614912, 8192, ) == 0x0
 02485  2016   NtQueryInformationProcess  (-1, DefaultHardErrorMode, 4, ...
 02486   252   NtContinue  (54328624, 1, ...
 02487   896   NtProtectVirtualMemory  (-1, (0x35fe000), 4096, 260, ...
 02485  2016   NtQueryInformationProcess  ... {process info, class 12, size 4}, 0x0, ) == 0x0
 02488   252   NtRegisterThreadTerminatePort  (24, ...
 02487   896   NtProtectVirtualMemory  ... (0x35fe000), 4096, 4, ) == 0x0
 02489  2016   NtSetInformationProcess  (-1, DefaultHardErrorMode, {process info, class 12, size 4}, 4, ...
 02488   252   NtRegisterThreadTerminatePort  ... ) == 0x0
 02490   896   NtCreateThread  (0x1f03ff, 0x0, -1, 2292532, 2292476, 1, ...
 02489  2016   NtSetInformationProcess  ... ) == 0x0
 02491   384   NtOpenThreadToken  (-2, 0xc, 1, ...
 02490   896   NtCreateThread  ... 368, {1252, 1300}, ) == 0x0
 02492   252   NtSetInformationThread  (-2, BasePriority, {thread info, class 3, size 4}, 4, ...
 02491   384   NtOpenThreadToken  ... ) == STATUS_NO_TOKEN
 02493  2016   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\msctfime.ime"}, 9824772, ... }, 9824772, ...
 02494   384   NtOpenThreadToken  (-2, 0x20008, 1, ...
 02493  2016   NtQueryAttributesFile  ... ) == 0x0
 02494   384   NtOpenThreadToken  ... ) == STATUS_NO_TOKEN
 02495  2016   NtOpenFile  (0x100020, {24, 0, 0x40, 0, 0,  (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\msctfime.ime"}, 5, 96, ... }, 5, 96, ...
 02496   384   NtWaitForSingleObject  (32, 0, 0x0, ...
 02495  2016   NtOpenFile  ... 380, {status=0x0, info=1}, ) == 0x0
 02497  2016   NtCreateSection  (0xe, 0x0, 0x0, 16, 134217728, 380, ... 384, ) == 0x0
 02498  2016   NtClose  (380, ... ) == 0x0
 02499  2016   NtMapViewOfSection  (384, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 16, ... (0x33d0000), 0x0, 180224, ) == 0x0
 02500  2016   NtClose  (384, ... ) == 0x0
 02501   896   NtQueryInformationThread  (368, Basic, 28, ...
 02492   252   NtSetInformationThread  ... ) == 0x0
 02501   896   NtQueryInformationThread  ... {ExitStatus=0x103,TebBaseAddress=0x7ffa7000,Pid=1252,Tid=1300,}, 0x0, ) == 0x0
 02502  2016   NtUnmapViewOfSection  (-1, 0x33d0000, ...
 02503   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81877, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81877, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFGp\1\0\0\344\4\0\0\24\5\0\0" ...  ...
 02502  2016   NtUnmapViewOfSection  ... ) == 0x0
 02503   896   NtRequestWaitReplyPort  ... {28, 56, reply, 0, 1252, 896, 81878, 0}  ... {28, 56, reply, 0, 1252, 896, 81878, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFGp\1\0\0\344\4\0\0\24\5\0\0" )  ) == 0x0
 02504  2016   NtSetEventBoostPriority  (32, ...
 02505   896   NtResumeThread  (368, ...
 02496   384   NtWaitForSingleObject  ... ) == 0x0
 02504  2016   NtSetEventBoostPriority  ... ) == 0x0
 02506   252   NtWaitForSingleObject  (316, 0, 0x0, ...
 02507   384   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\mswsock.dll"}, 22605936, ... }, 22605936, ...
 02508  2016   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\msctfime.ime"}, 9824368, ... }, 9824368, ...
 02505   896   NtResumeThread  ... 1, ) == 0x0
 02507   384   NtQueryAttributesFile  ... ) == 0x0
 02508  2016   NtQueryAttributesFile  ... ) == 0x0
 02509   896   NtAllocateVirtualMemory  (-1, 0, 0, 2097152, 8192, 4, ...
 02510  1300   NtWaitForSingleObject  (32, 0, 0x0, ...
 02511   384   NtSetEventBoostPriority  (32, ...
 02509   896   NtAllocateVirtualMemory  ... 56623104, 2097152, ) == 0x0
 02510  1300   NtWaitForSingleObject  ... ) == 0x0
 02511   384   NtSetEventBoostPriority  ... ) == 0x0
 02512  1300   NtTestAlert  (...
 02513   896   NtAllocateVirtualMemory  (-1, 58712064, 0, 8192, 4096, 4, ...
 02512  1300   NtTestAlert  ... ) == 0x0
 02514   384   NtOpenKey  (0x20019, {24, 52, 0x40, 0, 0,  (0x20019, {24, 52, 0x40, 0, 0, "SYSTEM\CurrentControlSet\Services\Winsock\Parameters"}, ... }, ...
 02513   896   NtAllocateVirtualMemory  ... 58712064, 8192, ) == 0x0
 02515  2016   NtCreateFile  (0x80100080, {24, 0, 0x40, 0, 9825112,  (0x80100080, {24, 0, 0x40, 0, 9825112, "\??\C:\WINDOWS\system32\msctfime.ime"}, 0x0, 0, 5, 1, 96, 0, 0, ... }, 0x0, 0, 5, 1, 96, 0, 0, ...
 02514   384   NtOpenKey  ... 384, ) == 0x0
 02516   896   NtProtectVirtualMemory  (-1, (0x37fe000), 4096, 260, ...
 02515  2016   NtCreateFile  ... 380, {status=0x0, info=1}, ) == 0x0
 02517   384   NtQueryValueKey  (384,  (384, "Transports", Partial, 144, ... , Partial, 144, ...
 02518  1300   NtContinue  (56622384, 1, ...
 02519  2016   NtCreateSection  (0xf0005, 0x0, 0x0, 2, 134217728, 380, ...
 02517   384   NtQueryValueKey  ... TitleIdx=0, Type=7, Data= ... TitleIdx=0, Type=7, Data="T\0c\0p\0i\0p\0\0\0N\0e\0t\0B\0I\0O\0S\0\0\0R\0F\0C\0O\0M\0M\0\0\0\0\0"}, 56, ) }, 56, ) == 0x0
 02520  1300   NtRegisterThreadTerminatePort  (24, ...
 02519  2016   NtCreateSection  ... 388, ) == 0x0
 02516   896   NtProtectVirtualMemory  ... (0x37fe000), 4096, 4, ) == 0x0
 02520  1300   NtRegisterThreadTerminatePort  ... ) == 0x0
 02521  2016   NtClose  (380, ...
 02522   896   NtCreateThread  (0x1f03ff, 0x0, -1, 2292532, 2292476, 1, ...
 02523  1300   NtSetInformationThread  (-2, BasePriority, {thread info, class 3, size 4}, 4, ...
 02521  2016   NtClose  ... ) == 0x0
 02522   896   NtCreateThread  ... 380, {1252, 1096}, ) == 0x0
 02523  1300   NtSetInformationThread  ... ) == 0x0
 02524   384   NtQueryValueKey  (384,  (384, "Transports", Partial, 144, ... , Partial, 144, ...
 02525   896   NtQueryInformationThread  (380, Basic, 28, ...
 02526  2016   NtMapViewOfSection  (388, -1, (0x0), 0, 0, {0, 0}, 0, 1, 0, 2, ...
 02524   384   NtQueryValueKey  ... TitleIdx=0, Type=7, Data= ... TitleIdx=0, Type=7, Data="T\0c\0p\0i\0p\0\0\0N\0e\0t\0B\0I\0O\0S\0\0\0R\0F\0C\0O\0M\0M\0\0\0\0\0"}, 56, ) }, 56, ) == 0x0
 02525   896   NtQueryInformationThread  ... {ExitStatus=0x103,TebBaseAddress=0x7ffa6000,Pid=1252,Tid=1096,}, 0x0, ) == 0x0
 02526  2016   NtMapViewOfSection  ... (0x33d0000), {0, 0}, 180224, ) == 0x0
 02527   384   NtClose  (384, ...
 02528   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81878, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81878, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG|\1\0\0\344\4\0\0H\4\0\0" ...  ...
 02529  2016   NtClose  (388, ...
 02527   384   NtClose  ... ) == 0x0
 02530  1300   NtWaitForSingleObject  (316, 0, 0x0, ...
 02529  2016   NtClose  ... ) == 0x0
 02531   384   NtOpenKey  (0x20019, {24, 52, 0x40, 0, 0,  (0x20019, {24, 52, 0x40, 0, 0, "System\CurrentControlSet\Services\Tcpip\Parameters\Winsock"}, ... }, ...
 02528   896   NtRequestWaitReplyPort  ... {28, 56, reply, 0, 1252, 896, 81879, 0}  ... {28, 56, reply, 0, 1252, 896, 81879, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG|\1\0\0\344\4\0\0H\4\0\0" )  ) == 0x0
 02532  2016   NtQueryInformationProcess  (-1, DefaultHardErrorMode, 4, ...
 02531   384   NtOpenKey  ... 388, ) == 0x0
 02533   896   NtResumeThread  (380, ...
 02532  2016   NtQueryInformationProcess  ... {process info, class 12, size 4}, 0x0, ) == 0x0
 02533   896   NtResumeThread  ... 1, ) == 0x0
 02534   384   NtQueryValueKey  (388,  (388, "Mapping", Partial, 144, ... , Partial, 144, ...
 02535   896   NtAllocateVirtualMemory  (-1, 0, 0, 2097152, 8192, 4, ...
 02534   384   NtQueryValueKey  ... ) == STATUS_BUFFER_OVERFLOW
 02535   896   NtAllocateVirtualMemory  ... 58720256, 2097152, ) == 0x0
 02536   384   NtQueryValueKey  (388,  (388, "Mapping", Partial, 144, ... , Partial, 144, ...
 02537  2016   NtSetInformationProcess  (-1, DefaultHardErrorMode, {process info, class 12, size 4}, 4, ...
 02538  1096   NtTestAlert  (...
 02536   384   NtQueryValueKey  ... ) == STATUS_BUFFER_OVERFLOW
 02537  2016   NtSetInformationProcess  ... ) == 0x0
 02538  1096   NtTestAlert  ... ) == 0x0
 02539   384   NtQueryValueKey  (388,  (388, "Mapping", Partial, 152, ... , Partial, 152, ...
 02540  2016   NtQueryDefaultLocale  (1, 9825732, ...
 02541  1096   NtContinue  (58719536, 1, ...
 02539   384   NtQueryValueKey  ... TitleIdx=0, Type=3, Data= ... TitleIdx=0, Type=3, Data="\13\0\0\0\3\0\0\0\2\0\0\0\1\0\0\0\6\0\0\0\2\0\0\0\1\0\0\0\0\0\0\0\2\0\0\0\0\0\0\0\6\0\0\0\0\0\0\0\0\0\0\0\6\0\0\0\0\0\0\0\1\0\0\0\6\0\0\0\2\0\0\0\2\0\0\0\21\0\0\0\2\0\0\0\2\0\0\0\0\0\0\0\2\0\0\0\0\0\0\0\21\0\0\0\0\0\0\0\0\0\0\0\21\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\2\0\0\0\3\0\0\0\0\0\0\0"}, 152, ) }, 152, ) == 0x0
 02540  2016   NtQueryDefaultLocale  ... ) == 0x0
 02542  1096   NtRegisterThreadTerminatePort  (24, ...
 02543   896   NtAllocateVirtualMemory  (-1, 60809216, 0, 8192, 4096, 4, ...
 02544  2016   NtQueryVirtualMemory  (-1, 0x33d0000, Basic, 28, ...
 02542  1096   NtRegisterThreadTerminatePort  ... ) == 0x0
 02543   896   NtAllocateVirtualMemory  ... 60809216, 8192, ) == 0x0
 02544  2016   NtQueryVirtualMemory  ... {BaseAddress=0x33d0000,AllocationBase=0x33d0000,AllocationProtect=0x2,RegionSize=0x2c000,State=0x1000,Protect=0x2,Type=0x40000,}, 0x0, ) == 0x0
 02545   384   NtClose  (388, ...
 02546   896   NtProtectVirtualMemory  (-1, (0x39fe000), 4096, 260, ...
 02547  1096   NtSetInformationThread  (-2, BasePriority, {thread info, class 3, size 4}, 4, ...
 02545   384   NtClose  ... ) == 0x0
 02546   896   NtProtectVirtualMemory  ... (0x39fe000), 4096, 4, ) == 0x0
 02548   384   NtOpenKey  (0x20019, {24, 52, 0x40, 0, 0,  (0x20019, {24, 52, 0x40, 0, 0, "System\CurrentControlSet\Services\Tcpip\Parameters\Winsock"}, ... }, ...
 02549   896   NtCreateThread  (0x1f03ff, 0x0, -1, 2292532, 2292476, 1, ...
 02548   384   NtOpenKey  ... 388, ) == 0x0
 02549   896   NtCreateThread  ... 384, {1252, 1708}, ) == 0x0
 02550   384   NtQueryValueKey  (388,  (388, "MinSockaddrLength", Partial, 144, ... , Partial, 144, ...
 02551  2016   NtUnmapViewOfSection  (-1, 0x33d0000, ...
 02547  1096   NtSetInformationThread  ... ) == 0x0
 02550   384   NtQueryValueKey  ... TitleIdx=0, Type=4, Data= ... TitleIdx=0, Type=4, Data="\20\0\0\0"}, 16, ) }, 16, ) == 0x0
 02551  2016   NtUnmapViewOfSection  ... ) == 0x0
 02552   896   NtQueryInformationThread  (384, Basic, 28, ...
 02553  1096   NtWaitForSingleObject  (316, 0, 0x0, ...
 02554  2016   NtSetInformationThread  (-2, ZeroTlsCell, {ZeroTlsCell=0x12,}, 4, ...
 02552   896   NtQueryInformationThread  ... {ExitStatus=0x103,TebBaseAddress=0x7ffa5000,Pid=1252,Tid=1708,}, 0x0, ) == 0x0
 02555   384   NtQueryValueKey  (388,  (388, "MaxSockaddrLength", Partial, 144, ... , Partial, 144, ...
 02554  2016   NtSetInformationThread  ... ) == 0x0
 02556   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81879, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81879, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\200\1\0\0\344\4\0\0\254\6\0\0" ...  ...
 02555   384   NtQueryValueKey  ... TitleIdx=0, Type=4, Data= ... TitleIdx=0, Type=4, Data="\20\0\0\0"}, 16, ) }, 16, ) == 0x0
 02557  2016   NtUnmapViewOfSection  (-1, 0x77c00000, ...
 02556   896   NtRequestWaitReplyPort  ... {28, 56, reply, 0, 1252, 896, 81880, 0}  ... {28, 56, reply, 0, 1252, 896, 81880, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\200\1\0\0\344\4\0\0\254\6\0\0" )  ) == 0x0
 02558   384   NtQueryValueKey  (388,  (388, "UseDelayedAcceptance", Partial, 144, ... , Partial, 144, ...
 02557  2016   NtUnmapViewOfSection  ... ) == 0x0
 02559   896   NtResumeThread  (384, ...
 02558   384   NtQueryValueKey  ... TitleIdx=0, Type=4, Data= ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) }, 16, ) == 0x0
 02560  2016   NtOpenMutant  (0x120001, {24, 28, 0x0, 0, 0,  (0x120001, {24, 28, 0x0, 0, 0, "ShimCacheMutex"}, ... }, ...
 02561   384   NtQueryValueKey  (388,  (388, "HelperDllName", Partial, 144, ... , Partial, 144, ...
 02560  2016   NtOpenMutant  ... 392, ) == 0x0
 02561   384   NtQueryValueKey  ... TitleIdx=0, Type=2, Data= ... TitleIdx=0, Type=2, Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0w\0s\0h\0t\0c\0p\0i\0p\0.\0d\0l\0l\0\0\0"}, 82, ) }, 82, ) == 0x0
 02562  2016   NtWaitForSingleObject  (392, 0, {-1000000, -1}, ...
 02559   896   NtResumeThread  ... 1, ) == 0x0
 02562  2016   NtWaitForSingleObject  ... ) == 0x0
 02563   896   NtAllocateVirtualMemory  (-1, 0, 0, 2097152, 8192, 4, ...
 02564  2016   NtOpenSection  (0x2, {24, 28, 0x0, 0, 0,  (0x2, {24, 28, 0x0, 0, 0, "ShimSharedMemory"}, ... }, ...
 02563   896   NtAllocateVirtualMemory  ... 60817408, 2097152, ) == 0x0
 02565   384   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\System32\wshtcpip.dll"}, 22606892, ... }, 22606892, ...
 02566  1708   NtWaitForSingleObject  (32, 0, 0x0, ...
 02567   896   NtAllocateVirtualMemory  (-1, 62906368, 0, 8192, 4096, 4, ...
 02565   384   NtQueryAttributesFile  ... ) == 0x0
 02567   896   NtAllocateVirtualMemory  ... 62906368, 8192, ) == 0x0
 02568   384   NtOpenFile  (0x100020, {24, 0, 0x40, 0, 0,  (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\System32\wshtcpip.dll"}, 5, 96, ... }, 5, 96, ...
 02569   896   NtProtectVirtualMemory  (-1, (0x3bfe000), 4096, 260, ...
 02568   384   NtOpenFile  ... 396, {status=0x0, info=1}, ) == 0x0
 02564  2016   NtOpenSection  ... 400, ) == 0x0
 02570   384   NtCreateSection  (0xe, 0x0, 0x0, 16, 134217728, 396, ...
 02571  2016   NtMapViewOfSection  (400, -1, (0x0), 0, 0, {0, 0}, 0, 1, 0, 4, ...
 02570   384   NtCreateSection  ... 404, ) == 0x0
 02571  2016   NtMapViewOfSection  ... (0x3f0000), {0, 0}, 57344, ) == 0x0
 02569   896   NtProtectVirtualMemory  ... (0x3bfe000), 4096, 4, ) == 0x0
 02572  2016   NtOpenThreadTokenEx  (-2, 0x20008, 1, 512, ...
 02573   896   NtCreateThread  (0x1f03ff, 0x0, -1, 2292532, 2292476, 1, ...
 02572  2016   NtOpenThreadTokenEx  ... ) == STATUS_NO_TOKEN
 02573   896   NtCreateThread  ... 408, {1252, 1024}, ) == 0x0
 02574  2016   NtOpenProcessTokenEx  (-1, 0x20008, 512, ...
 02575   896   NtQueryInformationThread  (408, Basic, 28, ...
 02576   384   NtClose  (396, ...
 02575   896   NtQueryInformationThread  ... {ExitStatus=0x103,TebBaseAddress=0x7ffa4000,Pid=1252,Tid=1024,}, 0x0, ) == 0x0
 02576   384   NtClose  ... ) == 0x0
 02577   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81880, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81880, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\230\1\0\0\344\4\0\0\0\4\0\0" ...  ...
 02578   384   NtMapViewOfSection  (404, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 16, ...
 02574  2016   NtOpenProcessTokenEx  ... 396, ) == 0x0
 02578   384   NtMapViewOfSection  ... (0x33d0000), 0x0, 20480, ) == 0x0
 02579  2016   NtQueryInformationToken  (396, User, 80, ...
 02580   384   NtClose  (404, ...
 02579  2016   NtQueryInformationToken  ... {token info, class 1, size 36}, 36, ) == 0x0
 02580   384   NtClose  ... ) == 0x0
 02581  2016   NtClose  (396, ...
 02577   896   NtRequestWaitReplyPort  ... {28, 56, reply, 0, 1252, 896, 81881, 0}  ... {28, 56, reply, 0, 1252, 896, 81881, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\230\1\0\0\344\4\0\0\0\4\0\0" )  ) == 0x0
 02581  2016   NtClose  ... ) == 0x0
 02582   896   NtResumeThread  (408, ...
 02583  2016   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\REGISTRY\USER\S-1-5-21-1292428093-1383384898-725345543-1003\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Layers"}, ... }, ...
 02582   896   NtResumeThread  ... 1, ) == 0x0
 02584   896   NtAllocateVirtualMemory  (-1, 0, 0, 2097152, 8192, 4, ... 62914560, 2097152, ) == 0x0
 02585   896   NtAllocateVirtualMemory  (-1, 65003520, 0, 8192, 4096, 4, ... 65003520, 8192, ) == 0x0
 02586   896   NtProtectVirtualMemory  (-1, (0x3dfe000), 4096, 260, ... (0x3dfe000), 4096, 4, ) == 0x0
 02587   896   NtCreateThread  (0x1f03ff, 0x0, -1, 2292532, 2292476, 1, ... 396, {1252, 1324}, ) == 0x0
 02583  2016   NtOpenKey  ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02588  1024   NtWaitForSingleObject  (32, 0, 0x0, ...
 02589   384   NtUnmapViewOfSection  (-1, 0x33d0000, ...
 02590  2016   NtReleaseMutant  (392, ...
 02589   384   NtUnmapViewOfSection  ... ) == 0x0
 02590  2016   NtReleaseMutant  ... 0x0, ) == 0x0
 02591   384   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\System32\wshtcpip.dll"}, 22607200, ... }, 22607200, ...
 02592  2016   NtWaitForSingleObject  (32, 0, 0x0, ...
 02591   384   NtQueryAttributesFile  ... ) == 0x0
 02593   896   NtQueryInformationThread  (396, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ffa3000,Pid=1252,Tid=1324,}, 0x0, ) == 0x0
 02594   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81881, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81881, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\214\1\0\0\344\4\0\0,\5\0\0" ... {28, 56, reply, 0, 1252, 896, 81882, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\214\1\0\0\344\4\0\0,\5\0\0" )  ... {28, 56, reply, 0, 1252, 896, 81882, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81881, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\214\1\0\0\344\4\0\0,\5\0\0" ... {28, 56, reply, 0, 1252, 896, 81882, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\214\1\0\0\344\4\0\0,\5\0\0" )  ) == 0x0
 02595   896   NtResumeThread  (396, ... 1, ) == 0x0
 02596   896   NtAllocateVirtualMemory  (-1, 0, 0, 2097152, 8192, 4, ... 65011712, 2097152, ) == 0x0
 02597   896   NtAllocateVirtualMemory  (-1, 67100672, 0, 8192, 4096, 4, ... 67100672, 8192, ) == 0x0
 02598   896   NtProtectVirtualMemory  (-1, (0x3ffe000), 4096, 260, ...
 02599   384   NtOpenFile  (0x100020, {24, 0, 0x40, 0, 0,  (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\System32\wshtcpip.dll"}, 5, 96, ... }, 5, 96, ...
 02600  1324   NtWaitForSingleObject  (32, 0, 0x0, ...
 02599   384   NtOpenFile  ... 404, {status=0x0, info=1}, ) == 0x0
 02601   384   NtCreateSection  (0xf, 0x0, 0x0, 16, 16777216, 404, ... 412, ) == 0x0
 02602   384   NtQuerySection  (412, Image, 48, ... {section info, class 1, size 48}, 0x0, ) == 0x0
 02603   384   NtClose  (404, ... ) == 0x0
 02604   384   NtMapViewOfSection  (412, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x71a90000), 0x0, 32768, ) == 0x0
 02605   384   NtClose  (412, ... ) == 0x0
 02598   896   NtProtectVirtualMemory  ... (0x3ffe000), 4096, 4, ) == 0x0
 02606   896   NtCreateThread  (0x1f03ff, 0x0, -1, 2292532, 2292476, 1, ... 412, {1252, 1776}, ) == 0x0
 02607   896   NtQueryInformationThread  (412, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ffa2000,Pid=1252,Tid=1776,}, 0x0, ) == 0x0
 02608   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81882, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81882, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\234\1\0\0\344\4\0\0\360\6\0\0" ... {28, 56, reply, 0, 1252, 896, 81883, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\234\1\0\0\344\4\0\0\360\6\0\0" )  ... {28, 56, reply, 0, 1252, 896, 81883, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81882, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\234\1\0\0\344\4\0\0\360\6\0\0" ... {28, 56, reply, 0, 1252, 896, 81883, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\234\1\0\0\344\4\0\0\360\6\0\0" )  ) == 0x0
 02609   896   NtResumeThread  (412, ... 1, ) == 0x0
 02610   896   NtAllocateVirtualMemory  (-1, 0, 0, 2097152, 8192, 4, ... 67108864, 2097152, ) == 0x0
 02611   384   NtProtectVirtualMemory  (-1, (0x71a91000), 128, 4, ...
 02612  1776   NtWaitForSingleObject  (32, 0, 0x0, ...
 02611   384   NtProtectVirtualMemory  ... (0x71a91000), 4096, 32, ) == 0x0
 02613   384   NtProtectVirtualMemory  (-1, (0x71a91000), 4096, 32, ... (0x71a91000), 4096, 4, ) == 0x0
 02614   384   NtFlushInstructionCache  (-1, 1906905088, 128, ... ) == 0x0
 02615   384   NtOpenKey  (0x80000000, {24, 0, 0x40, 0, 0,  (0x80000000, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wshtcpip.dll"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02616   896   NtAllocateVirtualMemory  (-1, 69197824, 0, 8192, 4096, 4, ... 69197824, 8192, ) == 0x0
 02617   896   NtProtectVirtualMemory  (-1, (0x41fe000), 4096, 260, ... (0x41fe000), 4096, 4, ) == 0x0
 02618   896   NtCreateThread  (0x1f03ff, 0x0, -1, 2292532, 2292476, 1, ... 404, {1252, 500}, ) == 0x0
 02619   896   NtQueryInformationThread  (404, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ffa1000,Pid=1252,Tid=500,}, 0x0, ) == 0x0
 02620   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81883, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81883, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\224\1\0\0\344\4\0\0\364\1\0\0" ... {28, 56, reply, 0, 1252, 896, 81884, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\224\1\0\0\344\4\0\0\364\1\0\0" )  ... {28, 56, reply, 0, 1252, 896, 81884, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81883, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\224\1\0\0\344\4\0\0\364\1\0\0" ... {28, 56, reply, 0, 1252, 896, 81884, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\224\1\0\0\344\4\0\0\364\1\0\0" )  ) == 0x0
 02621   896   NtResumeThread  (404, ...
 02622   384   NtSetEventBoostPriority  (32, ...
 02566  1708   NtWaitForSingleObject  ... ) == 0x0
 02623  1708   NtSetEventBoostPriority  (32, ...
 02588  1024   NtWaitForSingleObject  ... ) == 0x0
 02624  1024   NtSetEventBoostPriority  (32, ...
 02592  2016   NtWaitForSingleObject  ... ) == 0x0
 02625  2016   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\msctfime.ime"}, 9824752, ... ) }, 9824752, ... ) == 0x0
 02624  1024   NtSetEventBoostPriority  ... ) == 0x0
 02623  1708   NtSetEventBoostPriority  ... ) == 0x0
 02622   384   NtSetEventBoostPriority  ... ) == 0x0
 02621   896   NtResumeThread  ... 1, ) == 0x0
 02626  2016   NtOpenFile  (0x100020, {24, 0, 0x40, 0, 0,  (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\msctfime.ime"}, 5, 96, ... }, 5, 96, ...
 02627   500   NtWaitForSingleObject  (32, 0, 0x0, ...
 02628  1024   NtTestAlert  (...
 02629   384   NtClose  (388, ...
 02630   896   NtAllocateVirtualMemory  (-1, 0, 0, 2097152, 8192, 4, ...
 02626  2016   NtOpenFile  ... 416, {status=0x0, info=1}, ) == 0x0
 02628  1024   NtTestAlert  ... ) == 0x0
 02629   384   NtClose  ... ) == 0x0
 02630   896   NtAllocateVirtualMemory  ... 69206016, 2097152, ) == 0x0
 02631  2016   NtCreateSection  (0xe, 0x0, 0x0, 16, 134217728, 416, ...
 02632  1024   NtContinue  (62913840, 1, ...
 02633   384   NtWaitForSingleObject  (32, 0, 0x0, ...
 02634   896   NtAllocateVirtualMemory  (-1, 71294976, 0, 8192, 4096, 4, ...
 02631  2016   NtCreateSection  ... 388, ) == 0x0
 02635  1024   NtRegisterThreadTerminatePort  (24, ...
 02634   896   NtAllocateVirtualMemory  ... 71294976, 8192, ) == 0x0
 02636  2016   NtClose  (416, ...
 02635  1024   NtRegisterThreadTerminatePort  ... ) == 0x0
 02637   896   NtProtectVirtualMemory  (-1, (0x43fe000), 4096, 260, ...
 02636  2016   NtClose  ... ) == 0x0
 02638  1024   NtSetInformationThread  (-2, BasePriority, {thread info, class 3, size 4}, 4, ...
 02639  1708   NtTestAlert  (...
 02637   896   NtProtectVirtualMemory  ... (0x43fe000), 4096, 4, ) == 0x0
 02640  2016   NtMapViewOfSection  (388, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 16, ...
 02639  1708   NtTestAlert  ... ) == 0x0
 02641   896   NtCreateThread  (0x1f03ff, 0x0, -1, 2292532, 2292476, 1, ...
 02640  2016   NtMapViewOfSection  ... (0x33d0000), 0x0, 180224, ) == 0x0
 02642  1708   NtContinue  (60816688, 1, ...
 02641   896   NtCreateThread  ... 416, {1252, 248}, ) == 0x0
 02643  2016   NtClose  (388, ...
 02644  1708   NtRegisterThreadTerminatePort  (24, ...
 02645   896   NtQueryInformationThread  (416, Basic, 28, ...
 02643  2016   NtClose  ... ) == 0x0
 02644  1708   NtRegisterThreadTerminatePort  ... ) == 0x0
 02645   896   NtQueryInformationThread  ... {ExitStatus=0x103,TebBaseAddress=0x7ffa0000,Pid=1252,Tid=248,}, 0x0, ) == 0x0
 02646  2016   NtUnmapViewOfSection  (-1, 0x33d0000, ...
 02647  1708   NtSetInformationThread  (-2, BasePriority, {thread info, class 3, size 4}, 4, ...
 02648   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81884, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81884, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\240\1\0\0\344\4\0\0\370\0\0\0" ...  ...
 02646  2016   NtUnmapViewOfSection  ... ) == 0x0
 02648   896   NtRequestWaitReplyPort  ... {28, 56, reply, 0, 1252, 896, 81885, 0}  ... {28, 56, reply, 0, 1252, 896, 81885, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\240\1\0\0\344\4\0\0\370\0\0\0" )  ) == 0x0
 02649   896   NtResumeThread  (416, ... 1, ) == 0x0
 02650   896   NtAllocateVirtualMemory  (-1, 0, 0, 2097152, 8192, 4, ... 71303168, 2097152, ) == 0x0
 02651   896   NtAllocateVirtualMemory  (-1, 73392128, 0, 8192, 4096, 4, ... 73392128, 8192, ) == 0x0
 02652   896   NtProtectVirtualMemory  (-1, (0x45fe000), 4096, 260, ... (0x45fe000), 4096, 4, ) == 0x0
 02653   896   NtCreateThread  (0x1f03ff, 0x0, -1, 2292532, 2292476, 1, ... 388, {1252, 1884}, ) == 0x0
 02654  2016   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\msctfime.ime"}, 9825060, ... }, 9825060, ...
 02655   248   NtWaitForSingleObject  (32, 0, 0x0, ...
 02654  2016   NtQueryAttributesFile  ... ) == 0x0
 02656  2016   NtOpenFile  (0x100020, {24, 0, 0x40, 0, 0,  (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\msctfime.ime"}, 5, 96, ... 420, {status=0x0, info=1}, ) }, 5, 96, ... 420, {status=0x0, info=1}, ) == 0x0
 02657  2016   NtCreateSection  (0xf, 0x0, 0x0, 16, 16777216, 420, ... 424, ) == 0x0
 02658  2016   NtQuerySection  (424, Image, 48, ... {section info, class 1, size 48}, 0x0, ) == 0x0
 02659  2016   NtClose  (420, ... ) == 0x0
 02660  2016   NtMapViewOfSection  (424, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x755c0000), 0x0, 188416, ) == 0x0
 02661   896   NtQueryInformationThread  (388, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ff9f000,Pid=1252,Tid=1884,}, 0x0, ) == 0x0
 02662   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81885, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81885, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\204\1\0\0\344\4\0\0\\7\0\0" ... {28, 56, reply, 0, 1252, 896, 81886, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\204\1\0\0\344\4\0\0\\7\0\0" )  ... {28, 56, reply, 0, 1252, 896, 81886, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81885, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\204\1\0\0\344\4\0\0\\7\0\0" ... {28, 56, reply, 0, 1252, 896, 81886, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\204\1\0\0\344\4\0\0\\7\0\0" )  ) == 0x0
 02663   896   NtResumeThread  (388, ... 1, ) == 0x0
 02664   896   NtAllocateVirtualMemory  (-1, 0, 0, 2097152, 8192, 4, ... 73400320, 2097152, ) == 0x0
 02665   896   NtAllocateVirtualMemory  (-1, 75489280, 0, 8192, 4096, 4, ...
 02666  1884   NtWaitForSingleObject  (32, 0, 0x0, ...
 02667  2016   NtClose  (424, ... ) == 0x0
 02668  2016   NtProtectVirtualMemory  (-1, (0x755c1000), 860, 4, ... (0x755c1000), 4096, 32, ) == 0x0
 02669  2016   NtProtectVirtualMemory  (-1, (0x755c1000), 4096, 32, ... (0x755c1000), 4096, 4, ) == 0x0
 02670  2016   NtFlushInstructionCache  (-1, 1968967680, 860, ... ) == 0x0
 02671  2016   NtProtectVirtualMemory  (-1, (0x755c1000), 860, 4, ... (0x755c1000), 4096, 32, ) == 0x0
 02672  2016   NtProtectVirtualMemory  (-1, (0x755c1000), 4096, 32, ... (0x755c1000), 4096, 4, ) == 0x0
 02665   896   NtAllocateVirtualMemory  ... 75489280, 8192, ) == 0x0
 02673   896   NtProtectVirtualMemory  (-1, (0x47fe000), 4096, 260, ... (0x47fe000), 4096, 4, ) == 0x0
 02674   896   NtCreateThread  (0x1f03ff, 0x0, -1, 2292532, 2292476, 1, ... 424, {1252, 1308}, ) == 0x0
 02675   896   NtQueryInformationThread  (424, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ff9e000,Pid=1252,Tid=1308,}, 0x0, ) == 0x0
 02676   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81886, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81886, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\250\1\0\0\344\4\0\0\34\5\0\0" ... {28, 56, reply, 0, 1252, 896, 81887, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\250\1\0\0\344\4\0\0\34\5\0\0" )  ... {28, 56, reply, 0, 1252, 896, 81887, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81886, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\250\1\0\0\344\4\0\0\34\5\0\0" ... {28, 56, reply, 0, 1252, 896, 81887, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\250\1\0\0\344\4\0\0\34\5\0\0" )  ) == 0x0
 02677   896   NtResumeThread  (424, ... 1, ) == 0x0
 02678  2016   NtFlushInstructionCache  (-1, 1968967680, 860, ...
 02679  1308   NtWaitForSingleObject  (32, 0, 0x0, ...
 02678  2016   NtFlushInstructionCache  ... ) == 0x0
 02680  2016   NtProtectVirtualMemory  (-1, (0x755c1000), 860, 4, ... (0x755c1000), 4096, 32, ) == 0x0
 02681  2016   NtProtectVirtualMemory  (-1, (0x755c1000), 4096, 32, ... (0x755c1000), 4096, 4, ) == 0x0
 02682  2016   NtFlushInstructionCache  (-1, 1968967680, 860, ... ) == 0x0
 02683  2016   NtProtectVirtualMemory  (-1, (0x755c1000), 860, 4, ... (0x755c1000), 4096, 32, ) == 0x0
 02684  2016   NtProtectVirtualMemory  (-1, (0x755c1000), 4096, 32, ... (0x755c1000), 4096, 4, ) == 0x0
 02685   896   NtAllocateVirtualMemory  (-1, 0, 0, 2097152, 8192, 4, ... 75497472, 2097152, ) == 0x0
 02686   896   NtAllocateVirtualMemory  (-1, 77586432, 0, 8192, 4096, 4, ... 77586432, 8192, ) == 0x0
 02687   896   NtProtectVirtualMemory  (-1, (0x49fe000), 4096, 260, ... (0x49fe000), 4096, 4, ) == 0x0
 02688   896   NtCreateThread  (0x1f03ff, 0x0, -1, 2292532, 2292476, 1, ... 420, {1252, 1676}, ) == 0x0
 02689   896   NtQueryInformationThread  (420, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ff9d000,Pid=1252,Tid=1676,}, 0x0, ) == 0x0
 02690   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81887, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81887, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\244\1\0\0\344\4\0\0\214\6\0\0" ...  ...
 02691  2016   NtFlushInstructionCache  (-1, 1968967680, 860, ... ) == 0x0
 02692  2016   NtProtectVirtualMemory  (-1, (0x755c1000), 860, 4, ... (0x755c1000), 4096, 32, ) == 0x0
 02693  2016   NtProtectVirtualMemory  (-1, (0x755c1000), 4096, 32, ... (0x755c1000), 4096, 4, ) == 0x0
 02690   896   NtRequestWaitReplyPort  ... {28, 56, reply, 0, 1252, 896, 81888, 0}  ... {28, 56, reply, 0, 1252, 896, 81888, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\244\1\0\0\344\4\0\0\214\6\0\0" )  ) == 0x0
 02694   896   NtResumeThread  (420, ... 1, ) == 0x0
 02695   896   NtAllocateVirtualMemory  (-1, 0, 0, 2097152, 8192, 4, ... 77594624, 2097152, ) == 0x0
 02696   896   NtAllocateVirtualMemory  (-1, 79683584, 0, 8192, 4096, 4, ... 79683584, 8192, ) == 0x0
 02697   896   NtProtectVirtualMemory  (-1, (0x4bfe000), 4096, 260, ... (0x4bfe000), 4096, 4, ) == 0x0
 02698   896   NtCreateThread  (0x1f03ff, 0x0, -1, 2292532, 2292476, 1, ... 428, {1252, 1620}, ) == 0x0
 02699   896   NtQueryInformationThread  (428, Basic, 28, ...
 02700  2016   NtFlushInstructionCache  (-1, 1968967680, 860, ...
 02701  1676   NtWaitForSingleObject  (32, 0, 0x0, ...
 02700  2016   NtFlushInstructionCache  ... ) == 0x0
 02702  2016   NtProtectVirtualMemory  (-1, (0x755c1000), 860, 4, ... (0x755c1000), 4096, 32, ) == 0x0
 02703  2016   NtProtectVirtualMemory  (-1, (0x755c1000), 4096, 32, ... (0x755c1000), 4096, 4, ) == 0x0
 02704  2016   NtFlushInstructionCache  (-1, 1968967680, 860, ... ) == 0x0
 02705  2016   NtOpenKey  (0x80000000, {24, 0, 0x40, 0, 0,  (0x80000000, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msctfime.ime"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02706  2016   NtUserGetDC  (0, ... ) == 0x1010052
 02699   896   NtQueryInformationThread  ... {ExitStatus=0x103,TebBaseAddress=0x7ff9c000,Pid=1252,Tid=1620,}, 0x0, ) == 0x0
 02707   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81888, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81888, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\254\1\0\0\344\4\0\0T\6\0\0" ... {28, 56, reply, 0, 1252, 896, 81889, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\254\1\0\0\344\4\0\0T\6\0\0" )  ... {28, 56, reply, 0, 1252, 896, 81889, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81888, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\254\1\0\0\344\4\0\0T\6\0\0" ... {28, 56, reply, 0, 1252, 896, 81889, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\254\1\0\0\344\4\0\0T\6\0\0" )  ) == 0x0
 02708   896   NtResumeThread  (428, ... 1, ) == 0x0
 02709   896   NtAllocateVirtualMemory  (-1, 0, 0, 2097152, 8192, 4, ... 79691776, 2097152, ) == 0x0
 02710   896   NtAllocateVirtualMemory  (-1, 81780736, 0, 8192, 4096, 4, ... 81780736, 8192, ) == 0x0
 02711   896   NtProtectVirtualMemory  (-1, (0x4dfe000), 4096, 260, ... (0x4dfe000), 4096, 4, ) == 0x0
 02712  2016   NtUserSystemParametersInfo  (66, 12, 9825248, 0, ...
 02713  1620   NtWaitForSingleObject  (32, 0, 0x0, ...
 02712  2016   NtUserSystemParametersInfo  ... ) == 0x1
 02714  2016   NtUserCallOneParam  (16842834, 57, ... ) == 0x1
 02715  2016   NtGdiCreateCompatibleDC  (0, ... ) == 0x700104dc
 02716  2016   NtGdiCreateCompatibleDC  (0, ... ) == 0x140106c8
 02717  2016   NtGdiCreateCompatibleDC  (0, ... ) == 0x28010554
 02718  2016   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\ole32.dll"}, 9822580, ... ) }, 9822580, ... ) == 0x0
 02719   896   NtCreateThread  (0x1f03ff, 0x0, -1, 2292532, 2292476, 1, ... 432, {1252, 1296}, ) == 0x0
 02720   896   NtQueryInformationThread  (432, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ff9b000,Pid=1252,Tid=1296,}, 0x0, ) == 0x0
 02721   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81889, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81889, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\260\1\0\0\344\4\0\0\20\5\0\0" ... {28, 56, reply, 0, 1252, 896, 81890, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\260\1\0\0\344\4\0\0\20\5\0\0" )  ... {28, 56, reply, 0, 1252, 896, 81890, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81889, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\260\1\0\0\344\4\0\0\20\5\0\0" ... {28, 56, reply, 0, 1252, 896, 81890, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\260\1\0\0\344\4\0\0\20\5\0\0" )  ) == 0x0
 02722   896   NtResumeThread  (432, ... 1, ) == 0x0
 02723   896   NtAllocateVirtualMemory  (-1, 0, 0, 2097152, 8192, 4, ... 81788928, 2097152, ) == 0x0
 02724   896   NtAllocateVirtualMemory  (-1, 83877888, 0, 8192, 4096, 4, ...
 02725  2016   NtUserFindExistingCursorIcon  (9824520, 9824536, 9824584, ...
 02726  1296   NtWaitForSingleObject  (32, 0, 0x0, ...
 02725  2016   NtUserFindExistingCursorIcon  ... ) == 0x10003
 02727  2016   NtUserFindExistingCursorIcon  (9824520, 9824536, 9824584, ... ) == 0x10011
 02728  2016   NtGdiGetStockObject  (5, ... ) == 0x1900015
 02729  2016   NtUserGetClassInfo  (1968963584, 9824652, 9825216, 9824648, 0, ... ) == 0x0
 02730  2016   NtUserRegisterClassExWOW  (9824536, 9824604, 9824620, 9824636, 0, 384, 0, ... ) == 0x8169c079
 02731  2016   NtUserFindExistingCursorIcon  (9824520, 9824536, 9824584, ... ) == 0x10013
 02724   896   NtAllocateVirtualMemory  ... 83877888, 8192, ) == 0x0
 02732   896   NtProtectVirtualMemory  (-1, (0x4ffe000), 4096, 260, ... (0x4ffe000), 4096, 4, ) == 0x0
 02733   896   NtCreateThread  (0x1f03ff, 0x0, -1, 2292532, 2292476, 1, ... 436, {1252, 440}, ) == 0x0
 02734   896   NtQueryInformationThread  (436, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ff9a000,Pid=1252,Tid=440,}, 0x0, ) == 0x0
 02735   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81890, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81890, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\264\1\0\0\344\4\0\0\270\1\0\0" ... {28, 56, reply, 0, 1252, 896, 81891, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\264\1\0\0\344\4\0\0\270\1\0\0" )  ... {28, 56, reply, 0, 1252, 896, 81891, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81890, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\264\1\0\0\344\4\0\0\270\1\0\0" ... {28, 56, reply, 0, 1252, 896, 81891, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\264\1\0\0\344\4\0\0\270\1\0\0" )  ) == 0x0
 02736   896   NtResumeThread  (436, ... 1, ) == 0x0
 02737  2016   NtUserGetClassInfo  (1968963584, 9824652, 9825216, 9824648, 0, ...
 02738   440   NtWaitForSingleObject  (32, 0, 0x0, ...
 02737  2016   NtUserGetClassInfo  ... ) == 0x0
 02739  2016   NtUserRegisterClassExWOW  (9824536, 9824604, 9824620, 9824636, 0, 384, 0, ... ) == 0x8169c07a
 02740  2016   NtUserRegisterWindowMessage  ( ("MSIMEService", ... ) , ... ) == 0xc07b
 02741  2016   NtUserRegisterWindowMessage  ( ("MSIMEUIReady", ... ) , ... ) == 0xc07c
 02742  2016   NtUserRegisterWindowMessage  ( ("MSIMEReconvertRequest", ... ) , ... ) == 0xc07d
 02743  2016   NtUserRegisterWindowMessage  ( ("MSIMEReconvert", ... ) , ... ) == 0xc07e
 02744   896   NtAllocateVirtualMemory  (-1, 0, 0, 2097152, 8192, 4, ... 83886080, 2097152, ) == 0x0
 02745   896   NtAllocateVirtualMemory  (-1, 85975040, 0, 8192, 4096, 4, ... 85975040, 8192, ) == 0x0
 02746   896   NtProtectVirtualMemory  (-1, (0x51fe000), 4096, 260, ... (0x51fe000), 4096, 4, ) == 0x0
 02747   896   NtCreateThread  (0x1f03ff, 0x0, -1, 2292532, 2292476, 1, ... 440, {1252, 1588}, ) == 0x0
 02748   896   NtQueryInformationThread  (440, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ff99000,Pid=1252,Tid=1588,}, 0x0, ) == 0x0
 02749   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81891, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81891, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\270\1\0\0\344\4\0\04\6\0\0" ...  ...
 02750  2016   NtUserRegisterWindowMessage  ( ("MSIMEDocumentFeed", ... ) , ... ) == 0xc07f
 02751  2016   NtUserRegisterWindowMessage  ( ("MSIMEQueryPosition", ... ) , ... ) == 0xc080
 02752  2016   NtUserRegisterWindowMessage  ( ("MSIMEModeBias", ... ) , ... ) == 0xc081
 02749   896   NtRequestWaitReplyPort  ... {28, 56, reply, 0, 1252, 896, 81892, 0}  ... {28, 56, reply, 0, 1252, 896, 81892, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\270\1\0\0\344\4\0\04\6\0\0" )  ) == 0x0
 02753   896   NtResumeThread  (440, ... 1, ) == 0x0
 02754   896   NtAllocateVirtualMemory  (-1, 0, 0, 2097152, 8192, 4, ... 85983232, 2097152, ) == 0x0
 02755   896   NtAllocateVirtualMemory  (-1, 88072192, 0, 8192, 4096, 4, ... 88072192, 8192, ) == 0x0
 02756   896   NtProtectVirtualMemory  (-1, (0x53fe000), 4096, 260, ... (0x53fe000), 4096, 4, ) == 0x0
 02757   896   NtCreateThread  (0x1f03ff, 0x0, -1, 2292532, 2292476, 1, ... 444, {1252, 2044}, ) == 0x0
 02758   896   NtQueryInformationThread  (444, Basic, 28, ...
 02759  2016   NtUserRegisterWindowMessage  ( ("MSIMEShowImePad", ... , ...
 02760  1588   NtWaitForSingleObject  (32, 0, 0x0, ...
 02759  2016   NtUserRegisterWindowMessage  ... ) == 0xc082
 02761  2016   NtUserRegisterWindowMessage  ( ("MSIMEMouseOperation", ... ) , ... ) == 0xc083
 02762  2016   NtUserRegisterWindowMessage  ( ("MSIMEKeyMap", ... ) , ... ) == 0xc084
 02763  2016   NtSetEventBoostPriority  (32, ...
 02600  1324   NtWaitForSingleObject  ... ) == 0x0
 02764  1324   NtSetEventBoostPriority  (32, ...
 02612  1776   NtWaitForSingleObject  ... ) == 0x0
 02765  1776   NtSetEventBoostPriority  (32, ...
 02627   500   NtWaitForSingleObject  ... ) == 0x0
 02766   500   NtSetEventBoostPriority  (32, ...
 02633   384   NtWaitForSingleObject  ... ) == 0x0
 02767   384   NtSetEventBoostPriority  (32, ...
 02655   248   NtWaitForSingleObject  ... ) == 0x0
 02768   248   NtSetEventBoostPriority  (32, ...
 02666  1884   NtWaitForSingleObject  ... ) == 0x0
 02769  1884   NtSetEventBoostPriority  (32, ...
 02679  1308   NtWaitForSingleObject  ... ) == 0x0
 02770  1308   NtAllocateVirtualMemory  (-1, 3366912, 0, 4096, 4096, 4, ... 3366912, 4096, ) == 0x0
 02768   248   NtSetEventBoostPriority  ... ) == 0x0
 02767   384   NtSetEventBoostPriority  ... ) == 0x0
 02766   500   NtSetEventBoostPriority  ... ) == 0x0
 02765  1776   NtSetEventBoostPriority  ... ) == 0x0
 02764  1324   NtSetEventBoostPriority  ... ) == 0x0
 02769  1884   NtSetEventBoostPriority  ... ) == 0x0
 02763  2016   NtSetEventBoostPriority  ... ) == 0x0
 02758   896   NtQueryInformationThread  ... {ExitStatus=0x103,TebBaseAddress=0x7ff98000,Pid=1252,Tid=2044,}, 0x0, ) == 0x0
 02771  1308   NtSetEventBoostPriority  (32, ...
 02772   248   NtTestAlert  (...
 02773   384   NtWaitForSingleObject  (32, 0, 0x0, ...
 02774   500   NtTestAlert  (...
 02775  1776   NtTestAlert  (...
 02776  1324   NtTestAlert  (...
 02777  2016   NtWaitForSingleObject  (32, 0, 0x0, ...
 02778   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81892, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81892, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\274\1\0\0\344\4\0\0\374\7\0\0" ...  ...
 02701  1676   NtWaitForSingleObject  ... ) == 0x0
 02771  1308   NtSetEventBoostPriority  ... ) == 0x0
 02772   248   NtTestAlert  ... ) == 0x0
 02774   500   NtTestAlert  ... ) == 0x0
 02775  1776   NtTestAlert  ... ) == 0x0
 02776  1324   NtTestAlert  ... ) == 0x0
 02779  1676   NtSetEventBoostPriority  (32, ...
 02778   896   NtRequestWaitReplyPort  ... {28, 56, reply, 0, 1252, 896, 81893, 0}  ... {28, 56, reply, 0, 1252, 896, 81893, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\274\1\0\0\344\4\0\0\374\7\0\0" )  ) == 0x0
 02780  1308   NtTestAlert  (...
 02781   248   NtContinue  (71302448, 1, ...
 02782   500   NtContinue  (69205296, 1, ...
 02783  1776   NtContinue  (67108144, 1, ...
 02713  1620   NtWaitForSingleObject  ... ) == 0x0
 02779  1676   NtSetEventBoostPriority  ... ) == 0x0
 02784  1324   NtContinue  (65010992, 1, ...
 02785   896   NtResumeThread  (444, ...
 02780  1308   NtTestAlert  ... ) == 0x0
 02786   248   NtRegisterThreadTerminatePort  (24, ...
 02787   500   NtRegisterThreadTerminatePort  (24, ...
 02788  1620   NtSetEventBoostPriority  (32, ...
 02789  1776   NtRegisterThreadTerminatePort  (24, ...
 02790  1884   NtTestAlert  (...
 02791  1324   NtRegisterThreadTerminatePort  (24, ...
 02785   896   NtResumeThread  ... 1, ) == 0x0
 02792  1308   NtContinue  (75496752, 1, ...
 02786   248   NtRegisterThreadTerminatePort  ... ) == 0x0
 02726  1296   NtWaitForSingleObject  ... ) == 0x0
 02788  1620   NtSetEventBoostPriority  ... ) == 0x0
 02787   500   NtRegisterThreadTerminatePort  ... ) == 0x0
 02789  1776   NtRegisterThreadTerminatePort  ... ) == 0x0
 02790  1884   NtTestAlert  ... ) == 0x0
 02791  1324   NtRegisterThreadTerminatePort  ... ) == 0x0
 02793  1676   NtTestAlert  (...
 02794  2044   NtWaitForSingleObject  (32, 0, 0x0, ...
 02795  1308   NtRegisterThreadTerminatePort  (24, ...
 02796  1296   NtSetEventBoostPriority  (32, ...
 02797   248   NtSetInformationThread  (-2, BasePriority, {thread info, class 3, size 4}, 4, ...
 02798   896   NtAllocateVirtualMemory  (-1, 0, 0, 2097152, 8192, 4, ...
 02799   500   NtSetInformationThread  (-2, BasePriority, {thread info, class 3, size 4}, 4, ...
 02800  1776   NtSetInformationThread  (-2, BasePriority, {thread info, class 3, size 4}, 4, ...
 02801  1884   NtContinue  (73399600, 1, ...
 02802  1324   NtSetInformationThread  (-2, BasePriority, {thread info, class 3, size 4}, 4, ...
 02793  1676   NtTestAlert  ... ) == 0x0
 02803  1620   NtTestAlert  (...
 02738   440   NtWaitForSingleObject  ... ) == 0x0
 02796  1296   NtSetEventBoostPriority  ... ) == 0x0
 02795  1308   NtRegisterThreadTerminatePort  ... ) == 0x0
 02798   896   NtAllocateVirtualMemory  ... 88080384, 2097152, ) == 0x0
 02804  1884   NtRegisterThreadTerminatePort  (24, ...
 02805  1676   NtContinue  (77593904, 1, ...
 02806   440   NtSetEventBoostPriority  (32, ...
 02803  1620   NtTestAlert  ... ) == 0x0
 02807  1308   NtSetInformationThread  (-2, BasePriority, {thread info, class 3, size 4}, 4, ...
 02808   896   NtAllocateVirtualMemory  (-1, 90169344, 0, 8192, 4096, 4, ...
 02804  1884   NtRegisterThreadTerminatePort  ... ) == 0x0
 02760  1588   NtWaitForSingleObject  ... ) == 0x0
 02806   440   NtSetEventBoostPriority  ... ) == 0x0
 02809  1676   NtRegisterThreadTerminatePort  (24, ...
 02810  1620   NtContinue  (79691056, 1, ...
 02808   896   NtAllocateVirtualMemory  ... 90169344, 8192, ) == 0x0
 02811  1588   NtSetEventBoostPriority  (32, ...
 02812  1884   NtSetInformationThread  (-2, BasePriority, {thread info, class 3, size 4}, 4, ...
 02813  1296   NtTestAlert  (...
 02807  1308   NtSetInformationThread  ... ) == 0x0
 02809  1676   NtRegisterThreadTerminatePort  ... ) == 0x0
 02814  1620   NtRegisterThreadTerminatePort  (24, ...
 02773   384   NtWaitForSingleObject  ... ) == 0x0
 02811  1588   NtSetEventBoostPriority  ... ) == 0x0
 02815   896   NtProtectVirtualMemory  (-1, (0x55fe000), 4096, 260, ...
 02816   440   NtTestAlert  (...
 02813  1296   NtTestAlert  ... ) == 0x0
 02817  1676   NtSetInformationThread  (-2, BasePriority, {thread info, class 3, size 4}, 4, ...
 02818   384   NtSetEventBoostPriority  (32, ...
 02814  1620   NtRegisterThreadTerminatePort  ... ) == 0x0
 02819  1308   NtWaitForSingleObject  (316, 0, 0x0, ...
 02815   896   NtProtectVirtualMemory  ... (0x55fe000), 4096, 4, ) == 0x0
 02816   440   NtTestAlert  ... ) == 0x0
 02820  1296   NtContinue  (81788208, 1, ...
 02821  1588   NtTestAlert  (...
 02777  2016   NtWaitForSingleObject  ... ) == 0x0
 02818   384   NtSetEventBoostPriority  ... ) == 0x0
 02822  1620   NtSetInformationThread  (-2, BasePriority, {thread info, class 3, size 4}, 4, ...
 02823   440   NtContinue  (83885360, 1, ...
 02824  1296   NtRegisterThreadTerminatePort  (24, ...
 02825  2016   NtSetEventBoostPriority  (32, ...
 02821  1588   NtTestAlert  ... ) == 0x0
 02826   384   NtWaitForSingleObject  (32, 0, 0x0, ...
 02827   896   NtCreateThread  (0x1f03ff, 0x0, -1, 2292532, 2292476, 1, ...
 02828   440   NtRegisterThreadTerminatePort  (24, ...
 02794  2044   NtWaitForSingleObject  ... ) == 0x0
 02825  2016   NtSetEventBoostPriority  ... ) == 0x0
 02824  1296   NtRegisterThreadTerminatePort  ... ) == 0x0
 02829  1588   NtContinue  (85982512, 1, ...
 02827   896   NtCreateThread  ... 448, {1252, 588}, ) == 0x0
 02830  2044   NtSetEventBoostPriority  (32, ...
 02828   440   NtRegisterThreadTerminatePort  ... ) == 0x0
 02831  1296   NtSetInformationThread  (-2, BasePriority, {thread info, class 3, size 4}, 4, ...
 02832  1588   NtRegisterThreadTerminatePort  (24, ...
 02826   384   NtWaitForSingleObject  ... ) == 0x0
 02830  2044   NtSetEventBoostPriority  ... ) == 0x0
 02833   896   NtQueryInformationThread  (448, Basic, 28, ...
 02834   440   NtSetInformationThread  (-2, BasePriority, {thread info, class 3, size 4}, 4, ...
 02835  2016   NtWaitForSingleObject  (32, 0, 0x0, ...
 02836   384   NtSetEventBoostPriority  (32, ...
 02832  1588   NtRegisterThreadTerminatePort  ... ) == 0x0
 02833   896   NtQueryInformationThread  ... {ExitStatus=0x103,TebBaseAddress=0x7ff97000,Pid=1252,Tid=588,}, 0x0, ) == 0x0
 02837  2044   NtTestAlert  (...
 02836   384   NtSetEventBoostPriority  ... ) == 0x0
 02835  2016   NtWaitForSingleObject  ... ) == 0x0
 02838  1588   NtSetInformationThread  (-2, BasePriority, {thread info, class 3, size 4}, 4, ...
 02839   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81893, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81893, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\300\1\0\0\344\4\0\0L\2\0\0" ...  ...
 02840   384   NtWaitForSingleObject  (32, 0, 0x0, ...
 02837  2044   NtTestAlert  ... ) == 0x0
 02841  2016   NtSetEventBoostPriority  (32, ...
 02842  2044   NtContinue  (88079664, 1, ...
 02840   384   NtWaitForSingleObject  ... ) == 0x0
 02841  2016   NtSetEventBoostPriority  ... ) == 0x0
 02843   384   NtCreateFile  (0xc0100000, {24, 0, 0x42, 0, 0,  (0xc0100000, {24, 0, 0x42, 0, 0, "\Device\Afd\Endpoint"}, 0x0, 0, 3, 3, 0, 22609536, 67, ... }, 0x0, 0, 3, 3, 0, 22609536, 67, ...
 02844  2044   NtRegisterThreadTerminatePort  (24, ...
 02843   384   NtCreateFile  ... 452, {status=0x0, info=0}, ) == 0x0
 02845  2016   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\ntdll.dll"}, 9825412, ... }, 9825412, ...
 02844  2044   NtRegisterThreadTerminatePort  ... ) == 0x0
 02839   896   NtRequestWaitReplyPort  ... {28, 56, reply, 0, 1252, 896, 81894, 0}  ... {28, 56, reply, 0, 1252, 896, 81894, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\300\1\0\0\344\4\0\0L\2\0\0" )  ) == 0x0
 02846   384   NtDeviceIoControlFile  (452, 292, 0x0, 0x0, 0x1207b,  (452, 292, 0x0, 0x0, 0x1207b, "\7\0\0\0x\1V\0\340\0\0\0\216\326\220|", 16, 16, ... , 16, 16, ...
 02847  2044   NtSetInformationThread  (-2, BasePriority, {thread info, class 3, size 4}, 4, ...
 02848   896   NtResumeThread  (448, ...
 02846   384   NtDeviceIoControlFile  ... {status=0x0, info=16},  ... {status=0x0, info=16}, "\7\0\0\00\207\273\201\0 \0\0\30*m\201", ) , ) == 0x0
 02845  2016   NtQueryAttributesFile  ... ) == 0x0
 02848   896   NtResumeThread  ... 1, ) == 0x0
 02849   384   NtDeviceIoControlFile  (452, 292, 0x0, 0x0, 0x1207b,  (452, 292, 0x0, 0x0, 0x1207b, "\6\0\0\00\207\273\201\0 \0\0\30*m\201", 16, 16, ... , 16, 16, ...
 02850  2016   NtUserMessageCall  (0x17010c, WM_NCCREATE, 0x0, 0x95f830, 0, 670, 0, ...
 02851   896   NtAllocateVirtualMemory  (-1, 0, 0, 2097152, 8192, 4, ...
 02849   384   NtDeviceIoControlFile  ... {status=0x0, info=16},  ... {status=0x0, info=16}, "\6\0\0\00\207\273\201\0 \0\0\30*m\201", ) , ) == 0x0
 02850  2016   NtUserMessageCall  ... ) == 0x1
 02851   896   NtAllocateVirtualMemory  ... 90177536, 2097152, ) == 0x0
 02852   384   NtDeviceIoControlFile  (452, 292, 0x0, 0x0, 0x12047,  (452, 292, 0x0, 0x0, 0x12047, "\0\0\0\0\2\0\0\0\1\0\0\0\6\0\0\0\20\0\0\0\20\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0 \0\0\0 \0\0\0\0\0\0\1\0\0\0\351\3\0\0f\0\2\0\10\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0h\0\0\0\377\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\1\0\0\0\6\0\0\0\0 \0\0\1\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\1\0\0\0\1\0\0\1\0\0\0 \0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0", 248, 16, ... , 248, 16, ...
 02853   588   NtTestAlert  (...
 02854   896   NtAllocateVirtualMemory  (-1, 92266496, 0, 8192, 4096, 4, ...
 02852   384   NtDeviceIoControlFile  ... {status=0x0, info=0}, "", ) == 0x0
 02853   588   NtTestAlert  ... ) == 0x0
 02855  2016   NtUserMessageCall  (0x17010c, WM_NCCALCSIZE, 0x0, 0x95f874, 0, 670, 0, ...
 02854   896   NtAllocateVirtualMemory  ... 92266496, 8192, ) == 0x0
 02856   588   NtContinue  (90176816, 1, ...
 02855  2016   NtUserMessageCall  ... ) == 0x0
 02857   896   NtProtectVirtualMemory  (-1, (0x57fe000), 4096, 260, ...
 02858   588   NtRegisterThreadTerminatePort  (24, ...
 02859  2016   NtUserSetProp  (1507596, 43288, -1, ...
 02857   896   NtProtectVirtualMemory  ... (0x57fe000), 4096, 4, ) == 0x0
 02858   588   NtRegisterThreadTerminatePort  ... ) == 0x0
 02859  2016   NtUserSetProp  ... ) == 0x1
 02860   896   NtCreateThread  (0x1f03ff, 0x0, -1, 2292532, 2292476, 1, ...
 02861   384   NtWaitForSingleObject  (188, 0, {0, 0}, ...
 02862  2016   NtUserValidateHandleSecure  (590128, ...
 02860   896   NtCreateThread  ... 456, {1252, 1652}, ) == 0x0
 02861   384   NtWaitForSingleObject  ... ) == 0x102
 02862  2016   NtUserValidateHandleSecure  ... ) == 0x1
 02863   896   NtQueryInformationThread  (456, Basic, 28, ...
 02864   384   NtDeviceIoControlFile  (452, 292, 0x0, 0x0, 0x12003,  (452, 292, 0x0, 0x0, 0x12003, "\0\0\0\0\1\0\0\0\16\0\2\0\3\377\0\0\0\0\0\0\0\0\0\0\0\0", 26, 26, ... , 26, 26, ...
 02865   588   NtSetInformationThread  (-2, BasePriority, {thread info, class 3, size 4}, 4, ...
 02866  2016   NtUserValidateHandleSecure  (12189907, ...
 02864   384   NtDeviceIoControlFile  ... {status=0x0, info=460},  ... {status=0x0, info=460}, "\1\0\0\0\1\0\0\0\16\0\2\0\3\377\0\0\0\0\0\0\0\0\0\0\0\0", ) , ) == 0x0
 02866  2016   NtUserValidateHandleSecure  ... ) == 0x1
 02863   896   NtQueryInformationThread  ... {ExitStatus=0x103,TebBaseAddress=0x7ff96000,Pid=1252,Tid=1652,}, 0x0, ) == 0x0
 02865   588   NtSetInformationThread  ... ) == 0x0
 02867  2016   NtUserValidateHandleSecure  (12189907, ...
 02868   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81894, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81894, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\310\1\0\0\344\4\0\0t\6\0\0" ...  ...
 02869   384   NtDeviceIoControlFile  (452, 292, 0x0, 0x0, 0x12047,  (452, 292, 0x0, 0x0, 0x12047, "\1\0\0\0\2\0\0\0\1\0\0\0\6\0\0\0\20\0\0\0\20\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0 \0\0\0 \0\0\0\0\0\0\1\0\0\0\351\3\0\0f\0\2\0\10\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0h\0\0\0(\0*\0\2\0\3\377\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\1\0\0\0\6\0\0\0\0 \0\0\1\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\1\0\0\0\1\0\0\1\0\0\0 \0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0", 248, 0, ... , 248, 0, ...
 02867  2016   NtUserValidateHandleSecure  ... ) == 0x1
 02868   896   NtRequestWaitReplyPort  ... {28, 56, reply, 0, 1252, 896, 81895, 0}  ... {28, 56, reply, 0, 1252, 896, 81895, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\310\1\0\0\344\4\0\0t\6\0\0" )  ) == 0x0
 02869   384   NtDeviceIoControlFile  ... {status=0x0, info=0}, 0x0, ) == 0x0
 02870  2016   NtUserUpdateInputContext  (12189907, 1, 1507596, ...
 02871   896   NtResumeThread  (456, ...
 02872   384   NtDeviceIoControlFile  (452, 292, 0x0, 0x0, 0x12037,  (452, 292, 0x0, 0x0, 0x12037, "\2\0\0\0", 4, 8, ... , 4, 8, ...
 02870  2016   NtUserUpdateInputContext  ... ) == 0x1
 02871   896   NtResumeThread  ... 1, ) == 0x0
 02872   384   NtDeviceIoControlFile  ... {status=0x0, info=8},  ... {status=0x0, info=8}, "\0\0\0\0\0\0\0\0", ) , ) == 0x0
 02873   588   NtWaitForSingleObject  (316, 0, 0x0, ...
 02874  1652   NtTestAlert  (...
 02875  2016   NtOpenKey  (0x2000000, {24, 64, 0x40, 0, 0,  (0x2000000, {24, 64, 0x40, 0, 0, "SOFTWARE\Microsoft\CTF"}, ... }, ...
 02876   384   NtDeviceIoControlFile  (452, 292, 0x0, 0x0, 0x1200b,  (452, 292, 0x0, 0x0, 0x1200b, "\0\376X\1\5\0\0\0\0fW\0", 12, 0, ... , 12, 0, ...
 02877   896   NtAllocateVirtualMemory  (-1, 0, 0, 2097152, 8192, 4, ...
 02874  1652   NtTestAlert  ... ) == 0x0
 02875  2016   NtOpenKey  ... 464, ) == 0x0
 02876   384   NtDeviceIoControlFile  ... {status=0x0, info=0}, 0x0, ) == 0x0
 02877   896   NtAllocateVirtualMemory  ... 92274688, 2097152, ) == 0x0
 02878  1652   NtContinue  (92273968, 1, ...
 02879  2016   NtQueryValueKey  (464,  (464, "Disable Thread Input Manager", Partial, 144, ... , Partial, 144, ...
 02880   896   NtAllocateVirtualMemory  (-1, 94363648, 0, 8192, 4096, 4, ...
 02881  1652   NtRegisterThreadTerminatePort  (24, ...
 02879  2016   NtQueryValueKey  ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02880   896   NtAllocateVirtualMemory  ... 94363648, 8192, ) == 0x0
 02881  1652   NtRegisterThreadTerminatePort  ... ) == 0x0
 02882  2016   NtClose  (464, ...
 02883   896   NtProtectVirtualMemory  (-1, (0x59fe000), 4096, 260, ...
 02884   384   NtDeviceIoControlFile  (452, 292, 0x0, 0x0, 0x12047,  (452, 292, 0x0, 0x0, 0x12047, "\1\0\0\0\2\0\0\0\1\0\0\0\6\0\0\0\20\0\0\0\20\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0 \0\0\0 \0\0\1\0\0\0\1\0\0\0\351\3\0\0f\0\2\0\10\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0h\0\0\0\310\376X\1\2\0\3\377\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\1\0\0\0\6\0\0\0\0 \0\0\1\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\1\0\0\0\1\0\0\1\0\0\0 \0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0", 248, 0, ... , 248, 0, ...
 02882  2016   NtClose  ... ) == 0x0
 02883   896   NtProtectVirtualMemory  ... (0x59fe000), 4096, 4, ) == 0x0
 02884   384   NtDeviceIoControlFile  ... {status=0x0, info=0}, 0x0, ) == 0x0
 02885  1652   NtSetInformationThread  (-2, BasePriority, {thread info, class 3, size 4}, 4, ...
 02886  2016   NtOpenThreadToken  (-2, 0x8, 0, ...
 02887   384   NtDeviceIoControlFile  (452, 292, 0x0, 0x0, 0x1202f, 0x0, 0, 26, ...
 02886  2016   NtOpenThreadToken  ... ) == STATUS_NO_TOKEN
 02887   384   NtDeviceIoControlFile  ... {status=0x0, info=26},  ... {status=0x0, info=26}, "\1\0\0\0\1\0\0\0\16\0\2\0\3\377\0\0\0\0\0\0\0\0\0\0\0\0", ) , ) == 0x0
 02888  2016   NtOpenProcessToken  (-1, 0xa, ...
 02889   384   NtAllocateVirtualMemory  (-1, 5742592, 0, 4096, 4096, 4, ...
 02888  2016   NtOpenProcessToken  ... 464, ) == 0x0
 02889   384   NtAllocateVirtualMemory  ... 5742592, 4096, ) == 0x0
 02890  2016   NtDuplicateToken  (464, 0xc, {24, 0, 0x0, 0, 9827244, 0x0}, 0, 2, ...
 02891   896   NtCreateThread  (0x1f03ff, 0x0, -1, 2292532, 2292476, 1, ...
 02885  1652   NtSetInformationThread  ... ) == 0x0
 02890  2016   NtDuplicateToken  ... 468, ) == 0x0
 02891   896   NtCreateThread  ... 472, {1252, 1376}, ) == 0x0
 02892   384   NtDeviceIoControlFile  (56, 0, 0x0, 0x0, 0x390008,  (56, 0, 0x0, 0x0, 0x390008, "-k)O\250\234\230&\242\241A@\230\263O\376t\14\261\202\256[\273\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0", 256, 256, ... , 256, 256, ...
 02893  1652   NtWaitForSingleObject  (316, 0, 0x0, ...
 02894   896   NtQueryInformationThread  (472, Basic, 28, ...
 02895   384   NtQuerySystemInformation  (TimeOfDay, 48, ...
 02896  2016   NtClose  (464, ...
 02894   896   NtQueryInformationThread  ... {ExitStatus=0x103,TebBaseAddress=0x7ff95000,Pid=1252,Tid=1376,}, 0x0, ) == 0x0
 02895   384   NtQuerySystemInformation  ... {system info, class 3, size 48}, 48, ) == 0x0
 02896  2016   NtClose  ... ) == 0x0
 02897   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81895, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81895, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\330\1\0\0\344\4\0\0`\5\0\0" ...  ...
 02898   384   NtQuerySystemInformation  (ProcessorTimes, 48, ...
 02899  2016   NtAccessCheck  (5726648, 468, 0x1, 9827320, 9827372, 56, 9827352, ...
 02898   384   NtQuerySystemInformation  ... {system info, class 8, size 48}, 48, ) == 0x0
 02899  2016   NtAccessCheck  ... (0x1), ) == 0x0
 02900   384   NtQuerySystemInformation  (Performance, 312, ...
 02901  2016   NtClose  (468, ...
 02897   896   NtRequestWaitReplyPort  ... {28, 56, reply, 0, 1252, 896, 81896, 0}  ... {28, 56, reply, 0, 1252, 896, 81896, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\330\1\0\0\344\4\0\0`\5\0\0" )  ) == 0x0
 02901  2016   NtClose  ... ) == 0x0
 02902   896   NtResumeThread  (472, ...
 02900   384   NtQuerySystemInformation  ... {system info, class 2, size 312}, 312, ) == 0x0
 02902   896   NtResumeThread  ... 1, ) == 0x0
 02903   384   NtQuerySystemInformation  (Exception, 16, ...
 02904   896   NtAllocateVirtualMemory  (-1, 0, 0, 2097152, 8192, 4, ...
 02903   384   NtQuerySystemInformation  ... {system info, class 33, size 16}, 16, ) == 0x0
 02904   896   NtAllocateVirtualMemory  ... 94371840, 2097152, ) == 0x0
 02905   384   NtQuerySystemInformation  (Lookaside, 32, ...
 02906   896   NtAllocateVirtualMemory  (-1, 96460800, 0, 8192, 4096, 4, ...
 02905   384   NtQuerySystemInformation  ... {system info, class 45, size 32}, 32, ) == 0x0
 02907  2016   NtOpenKey  (0x2000000, {24, 52, 0x40, 0, 0,  (0x2000000, {24, 52, 0x40, 0, 0, "Software\Microsoft\CTF\SystemShared"}, ... }, ...
 02908  1376   NtTestAlert  (...
 02909   384   NtQuerySystemInformation  (ProcessorStatistics, 3016, ...
 02907  2016   NtOpenKey  ... 468, ) == 0x0
 02908  1376   NtTestAlert  ... ) == 0x0
 02906   896   NtAllocateVirtualMemory  ... 96460800, 8192, ) == 0x0
 02910  2016   NtQueryValueKey  (468,  (468, "CUAS", Partial, 144, ... , Partial, 144, ...
 02911  1376   NtContinue  (94371120, 1, ...
 02912   896   NtProtectVirtualMemory  (-1, (0x5bfe000), 4096, 260, ...
 02910  2016   NtQueryValueKey  ... TitleIdx=0, Type=4, Data= ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) }, 16, ) == 0x0
 02913  1376   NtRegisterThreadTerminatePort  (24, ...
 02912   896   NtProtectVirtualMemory  ... (0x5bfe000), 4096, 4, ) == 0x0
 02914  2016   NtClose  (468, ...
 02913  1376   NtRegisterThreadTerminatePort  ... ) == 0x0
 02909   384   NtQuerySystemInformation  ... {system info, class 23, size 0}, 0, ) == 0x0
 02914  2016   NtClose  ... ) == 0x0
 02915   896   NtCreateThread  (0x1f03ff, 0x0, -1, 2292532, 2292476, 1, ...
 02916   384   NtQuerySystemInformation  (ProcessesAndThreads, 3008, ...
 02917  1376   NtSetInformationThread  (-2, BasePriority, {thread info, class 3, size 4}, 4, ...
 02915   896   NtCreateThread  ... 468, {1252, 1436}, ) == 0x0
 02916   384   NtQuerySystemInformation  ... ) == STATUS_INFO_LENGTH_MISMATCH
 02918   896   NtQueryInformationThread  (468, Basic, 28, ...
 02919   384   NtCreateKey  (0x2, {24, 0, 0x240, 0, 0,  (0x2, {24, 0, 0x240, 0, 0, "\Registry\Machine\SOFTWARE\Microsoft\Cryptography\RNG"}, 0, 0x0, 0, ... }, 0, 0x0, 0, ...
 02918   896   NtQueryInformationThread  ... {ExitStatus=0x103,TebBaseAddress=0x7ff94000,Pid=1252,Tid=1436,}, 0x0, ) == 0x0
 02919   384   NtCreateKey  ... -2147482764, 2, ) == 0x0
 02920   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81896, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81896, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\324\1\0\0\344\4\0\0\234\5\0\0" ...  ...
 02921   384   NtSetValueKey  (-2147482764,  (-2147482764, "Seed", 0, 3, "\262\7\32\241\352c\200\370O\357\337S.\13U@\36\260\211@\303kD\340\240\33\321\345{&\262\323\2\313F\256\10\245Hb\57\236aB\371){\27\203\36\363\22\255\317\15\315g.\327\370\22\251\360\370\370M\365V\247\377\214m\3130\377\271D\306\1", 80, ... , 0, 3,  (-2147482764, "Seed", 0, 3, "\262\7\32\241\352c\200\370O\357\337S.\13U@\36\260\211@\303kD\340\240\33\321\345{&\262\323\2\313F\256\10\245Hb\57\236aB\371){\27\203\36\363\22\255\317\15\315g.\327\370\22\251\360\370\370M\365V\247\377\214m\3130\377\271D\306\1", 80, ... , 80, ...
 02920   896   NtRequestWaitReplyPort  ... {28, 56, reply, 0, 1252, 896, 81897, 0}  ... {28, 56, reply, 0, 1252, 896, 81897, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\324\1\0\0\344\4\0\0\234\5\0\0" )  ) == 0x0
 02922  2016   NtUserGetImeInfoEx  (9827136, 0, ...
 02917  1376   NtSetInformationThread  ... ) == 0x0
 02923   896   NtResumeThread  (468, ...
 02922  2016   NtUserGetImeInfoEx  ... ) == 0x1
 02921   384   NtSetValueKey  ... ) == 0x0
 02923   896   NtResumeThread  ... 1, ) == 0x0
 02924  2016   NtWaitForSingleObject  (392, 0, {-1000000, -1}, ...
 02925   384   NtClose  (-2147482764, ...
 02926   896   NtAllocateVirtualMemory  (-1, 0, 0, 2097152, 8192, 4, ...
 02924  2016   NtWaitForSingleObject  ... ) == 0x0
 02925   384   NtClose  ... ) == 0x0
 02926   896   NtAllocateVirtualMemory  ... 96468992, 2097152, ) == 0x0
 02927  2016   NtOpenThreadTokenEx  (-2, 0x20008, 1, 512, ...
 02892   384   NtDeviceIoControlFile  ... {status=0x0, info=256},  ... {status=0x0, info=256}, "@m\323/0\31GwX!\247\260\363\177\251\5'\347\13\2446\215\243\357\363sp\337K("B554N\235\13\332C\217\207\264k]\277\374Ru\211\370B\213\204\257\3231l#\24\212\300\5'\322\266\245\26\330\217(\5\16\271,{\336,\242\210k\5\337\227:MZ=`Gg\346\227\335zo\254f\355)\362\372t?k>\215\307\344F\267\17\302\324\22\216\215\237\352\207\324\356\16\253\371p\341-\273\311\350\23\347\271\225\324\5\272\305h^\244\306\15\223V:D\Qb\35c\355\320?\376g\6\256T\35eA\13\347E$@z\243\24J\267^\373}k\17C\225&\36\365\305\304\213\100!\3705o\372R\24:\342\214\266\331\34]\217@\323\330\301^\3\311\256\2\344;\344\200\357.\247\311*W\360x4\37tbch=\225\363\275GS\355\204\361\264\343d\273F\11k\214\230\25\315\263\247\324X", ) B554N\235\13\332C\217\207\264k]\277\374Ru\211\370B\213\204\257\3231l#\24\212\300\5'\322\266\245\26\330\217(\5\16\271,{\336,\242\210k\5\337\227:MZ=`Gg\346\227\335zo\254f\355)\362\372t?k>\215\307\344F\267\17\302\324\22\216\215\237\352\207\324\356\16\253\371p\341-\273\311\350\23\347\271\225\324\5\272\305h^\244\306\15\223V:D\Qb\35c\355\320?\376g\6\256T\35eA\13\347E$@z\243\24J\267^\373}k\17C\225&\36\365\305\304\213\100!\3705o\372R\24:\342\214\266\331\34]\217@\323\330\301^\3\311\256\2\344;\344\200\357.\247\311*W\360x4\37tbch=\225\363\275GS\355\204\361\264\343d\273F\11k\214\230\25\315\263\247\324X", ) == 0x0
 02928   896   NtAllocateVirtualMemory  (-1, 98557952, 0, 8192, 4096, 4, ...
 02929  1376   NtWaitForSingleObject  (316, 0, 0x0, ...
 02930  1436   NtTestAlert  (...
 02931   384   NtDeviceIoControlFile  (56, 0, 0x0, 0x0, 0x390008,  (56, 0, 0x0, 0x0, 0x390008, "-k)O\250\234\230&\242\241A@\230\263Rur5\263\351\3128\263t\14\261\202\256[\273\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0", 256, 256, ... , 256, 256, ...
 02927  2016   NtOpenThreadTokenEx  ... ) == STATUS_NO_TOKEN
 02928   896   NtAllocateVirtualMemory  ... 98557952, 8192, ) == 0x0
 02930  1436   NtTestAlert  ... ) == 0x0
 02932   384   NtQuerySystemInformation  (TimeOfDay, 48, ...
 02933  2016   NtOpenProcessTokenEx  (-1, 0x20008, 512, ...
 02934   896   NtProtectVirtualMemory  (-1, (0x5dfe000), 4096, 260, ...
 02935  1436   NtContinue  (96468272, 1, ...
 02933  2016   NtOpenProcessTokenEx  ... 464, ) == 0x0
 02934   896   NtProtectVirtualMemory  ... (0x5dfe000), 4096, 4, ) == 0x0
 02936  1436   NtRegisterThreadTerminatePort  (24, ...
 02937  2016   NtQueryInformationToken  (464, User, 80, ...
 02938   896   NtCreateThread  (0x1f03ff, 0x0, -1, 2292532, 2292476, 1, ...
 02936  1436   NtRegisterThreadTerminatePort  ... ) == 0x0
 02937  2016   NtQueryInformationToken  ... {token info, class 1, size 36}, 36, ) == 0x0
 02938   896   NtCreateThread  ... 476, {1252, 1368}, ) == 0x0
 02932   384   NtQuerySystemInformation  ... {system info, class 3, size 48}, 48, ) == 0x0
 02939  2016   NtClose  (464, ...
 02940   896   NtQueryInformationThread  (476, Basic, 28, ...
 02941   384   NtQuerySystemInformation  (ProcessorTimes, 48, ...
 02942  1436   NtSetInformationThread  (-2, BasePriority, {thread info, class 3, size 4}, 4, ...
 02939  2016   NtClose  ... ) == 0x0
 02941   384   NtQuerySystemInformation  ... {system info, class 8, size 48}, 48, ) == 0x0
 02943  2016   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\REGISTRY\USER\S-1-5-21-1292428093-1383384898-725345543-1003\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Layers"}, ... }, ...
 02944   384   NtQuerySystemInformation  (Performance, 312, ...
 02943  2016   NtOpenKey  ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02944   384   NtQuerySystemInformation  ... {system info, class 2, size 312}, 312, ) == 0x0
 02945  2016   NtReleaseMutant  (392, ...
 02946   384   NtQuerySystemInformation  (Exception, 16, ...
 02945  2016   NtReleaseMutant  ... 0x0, ) == 0x0
 02940   896   NtQueryInformationThread  ... {ExitStatus=0x103,TebBaseAddress=0x7ff93000,Pid=1252,Tid=1368,}, 0x0, ) == 0x0
 02942  1436   NtSetInformationThread  ... ) == 0x0
 02947  2016   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\msctfime.ime"}, 9824168, ... }, 9824168, ...
 02948   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81897, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81897, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\334\1\0\0\344\4\0\0X\5\0\0" ...  ...
 02946   384   NtQuerySystemInformation  ... {system info, class 33, size 16}, 16, ) == 0x0
 02949  1436   NtWaitForSingleObject  (316, 0, 0x0, ...
 02948   896   NtRequestWaitReplyPort  ... {28, 56, reply, 0, 1252, 896, 81898, 0}  ... {28, 56, reply, 0, 1252, 896, 81898, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\334\1\0\0\344\4\0\0X\5\0\0" )  ) == 0x0
 02950   384   NtQuerySystemInformation  (Lookaside, 32, ...
 02947  2016   NtQueryAttributesFile  ... ) == 0x0
 02951   896   NtResumeThread  (476, ...
 02950   384   NtQuerySystemInformation  ... {system info, class 45, size 32}, 32, ) == 0x0
 02952  2016   NtUserGetThreadState  (16, ...
 02951   896   NtResumeThread  ... 1, ) == 0x0
 02953   384   NtQuerySystemInformation  (ProcessorStatistics, 3016, ...
 02952  2016   NtUserGetThreadState  ... ) == 0x0
 02954  1368   NtTestAlert  (...
 02953   384   NtQuerySystemInformation  ... {system info, class 23, size 0}, 0, ) == 0x0
 02955  2016   NtOpenThreadToken  (-2, 0x8, 0, ...
 02954  1368   NtTestAlert  ... ) == 0x0
 02956   384   NtQuerySystemInformation  (ProcessesAndThreads, 3008, ...
 02955  2016   NtOpenThreadToken  ... ) == STATUS_NO_TOKEN
 02957  1368   NtContinue  (98565424, 1, ...
 02958   896   NtAllocateVirtualMemory  (-1, 0, 0, 2097152, 8192, 4, ...
 02959  2016   NtOpenProcessToken  (-1, 0xa, ...
 02960  1368   NtRegisterThreadTerminatePort  (24, ...
 02958   896   NtAllocateVirtualMemory  ... 98566144, 2097152, ) == 0x0
 02956   384   NtQuerySystemInformation  ... ) == STATUS_INFO_LENGTH_MISMATCH
 02960  1368   NtRegisterThreadTerminatePort  ... ) == 0x0
 02961   896   NtAllocateVirtualMemory  (-1, 100655104, 0, 8192, 4096, 4, ...
 02962   384   NtCreateKey  (0x2, {24, 0, 0x240, 0, 0,  (0x2, {24, 0, 0x240, 0, 0, "\Registry\Machine\SOFTWARE\Microsoft\Cryptography\RNG"}, 0, 0x0, 0, ... }, 0, 0x0, 0, ...
 02959  2016   NtOpenProcessToken  ... 464, ) == 0x0
 02961   896   NtAllocateVirtualMemory  ... 100655104, 8192, ) == 0x0
 02962   384   NtCreateKey  ... -2147482764, 2, ) == 0x0
 02963  2016   NtDuplicateToken  (464, 0xc, {24, 0, 0x0, 0, 9826168, 0x0}, 0, 2, ...
 02964   896   NtProtectVirtualMemory  (-1, (0x5ffe000), 4096, 260, ...
 02965   384   NtSetValueKey  (-2147482764,  (-2147482764, "Seed", 0, 3, "\200\355\363\320\222<;\5\36\206\226:l46&\264\211\0\206'\300\253\246\305\0\206\333\304.\315\211\323\241\314\330\252\323\335v],\21i\317\377\306\241\35\220(\354\261:\253\3664Ax\11S>?\3\372\3216\306\352\250s.\203\245kR\342\344\241\242", 80, ... , 0, 3,  (-2147482764, "Seed", 0, 3, "\200\355\363\320\222<;\5\36\206\226:l46&\264\211\0\206'\300\253\246\305\0\206\333\304.\315\211\323\241\314\330\252\323\335v],\21i\317\377\306\241\35\220(\354\261:\253\3664Ax\11S>?\3\372\3216\306\352\250s.\203\245kR\342\344\241\242", 80, ... , 80, ...
 02963  2016   NtDuplicateToken  ... 480, ) == 0x0
 02964   896   NtProtectVirtualMemory  ... (0x5ffe000), 4096, 4, ) == 0x0
 02965   384   NtSetValueKey  ... ) == 0x0
 02966  2016   NtClose  (464, ...
 02967  1368   NtSetInformationThread  (-2, BasePriority, {thread info, class 3, size 4}, 4, ...
 02968   384   NtClose  (-2147482764, ...
 02966  2016   NtClose  ... ) == 0x0
 02967  1368   NtSetInformationThread  ... ) == 0x0
 02969   896   NtCreateThread  (0x1f03ff, 0x0, -1, 2292532, 2292476, 1, ...
 02970  2016   NtAccessCheck  (5726648, 480, 0x1, 9826244, 9826296, 56, 9826276, ...
 02968   384   NtClose  ... ) == 0x0
 02969   896   NtCreateThread  ... 464, {1252, 724}, ) == 0x0
 02971  1368   NtWaitForSingleObject  (316, 0, 0x0, ...
 02931   384   NtDeviceIoControlFile  ... {status=0x0, info=256},  ... {status=0x0, info=256}, "/h4\224\205\361V\211\376Zq\\306\264\315\247\1z\27}\207m\270\213*f\317m\370Ke|x\30.\273\0\0\2472\334*\12~6\350\267\33\330\324\253\177\371\275\233\3478\351v\347\2021\177\27\341\215Y\255!Ng\323>\256(m\34\263\340\302FdB9\336\325\5\357$b\31\242\221\340\35\4\230d#\320z\34R\342\24\3010}\305\325\11\361h\35N\34\267\237\314KI "\3507\275I\252\320\3370X\262\26\5 \235\216S\337M\367\024\14\274\370\21ww\16#\327\372\253\340\31\202\204s\206\275\240;\373 y\204H\216\237\5\14\25\364%\345^\252p~\345\307\221\240\366G\205p\233%C\373RN\21\10Kg\7h\34C&Z5\363\326}2B\323\350r_\33i\10\364\305\306\211\352\17\265\16\6fw\3\330\316\324\306\332L,\272D\311k\311k /\312\333\10\30\373t\262Z\220", ) \3507\275I\252\320\3370X\262\26\5 \235\216S\337M\367\024\14\274\370\21ww\16#\327\372\253\340\31\202\204s\206\275\240;\373 y\204H\216\237\5\14\25\364%\345^\252p~\345\307\221\240\366G\205p\233%C\373RN\21\10Kg\7h\34C&Z5\363\326}2B\323\350r_\33i\10\364\305\306\211\352\17\265\16\6fw\3\330\316\324\306\332L,\272D\311k\311k /\312\333\10\30\373t\262Z\220", ) == 0x0
 02972   896   NtQueryInformationThread  (464, Basic, 28, ...
 02970  2016   NtAccessCheck  ... (0x1), ) == 0x0
 02973   384   NtDeviceIoControlFile  (56, 0, 0x0, 0x0, 0x390008,  (56, 0, 0x0, 0x0, 0x390008, "-k)O\250\234\230&\242\241A@\230\263Rur5\263\351\312%8r5\263\351\3128\263t\14\261\202\256[\273\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0", 256, 256, ... , 256, 256, ...
 02972   896   NtQueryInformationThread  ... {ExitStatus=0x103,TebBaseAddress=0x7ff92000,Pid=1252,Tid=724,}, 0x0, ) == 0x0
 02974  2016   NtClose  (480, ...
 02975   384   NtQuerySystemInformation  (TimeOfDay, 48, ...
 02976   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81898, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81898, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\320\1\0\0\344\4\0\0\324\2\0\0" ...  ...
 02974  2016   NtClose  ... ) == 0x0
 02975   384   NtQuerySystemInformation  ... {system info, class 3, size 48}, 48, ) == 0x0
 02977  2016   NtUserGetClassInfo  (1968963584, 9825888, 9825832, 9825880, 0, ...
 02978   384   NtQuerySystemInformation  (ProcessorTimes, 48, ...
 02977  2016   NtUserGetClassInfo  ... ) == 0xc079
 02976   896   NtRequestWaitReplyPort  ... {28, 56, reply, 0, 1252, 896, 81899, 0}  ... {28, 56, reply, 0, 1252, 896, 81899, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\320\1\0\0\344\4\0\0\324\2\0\0" )  ) == 0x0
 02979  2016   NtUserMessageCall  (0x90130, WM_NCCALCSIZE, 0x0, 0x95f874, 0, 670, 1, ...
 02980   896   NtResumeThread  (464, ...
 02978   384   NtQuerySystemInformation  ... {system info, class 8, size 48}, 48, ) == 0x0
 02980   896   NtResumeThread  ... 1, ) == 0x0
 02981   384   NtQuerySystemInformation  (Performance, 312, ...
 02982   896   NtAllocateVirtualMemory  (-1, 0, 0, 2097152, 8192, 4, ...
 02981   384   NtQuerySystemInformation  ... {system info, class 2, size 312}, 312, ) == 0x0
 02982   896   NtAllocateVirtualMemory  ... 100663296, 2097152, ) == 0x0
 02983   384   NtQuerySystemInformation  (Exception, 16, ...
 02984   896   NtAllocateVirtualMemory  (-1, 102752256, 0, 8192, 4096, 4, ...
 02983   384   NtQuerySystemInformation  ... {system info, class 33, size 16}, 16, ) == 0x0
 02979  2016   NtUserMessageCall  ... ) == 0x0
 02985   724   NtTestAlert  (...
 02986   384   NtQuerySystemInformation  (Lookaside, 32, ...
 02987  2016   NtUserGetClassName  (590128, 0, 9827616, ...
 02985   724   NtTestAlert  ... ) == 0x0
 02984   896   NtAllocateVirtualMemory  ... 102752256, 8192, ) == 0x0
 02987  2016   NtUserGetClassName  ... ) == 0x6
 02988   724   NtContinue  (100662576, 1, ...
 02989   896   NtProtectVirtualMemory  (-1, (0x61fe000), 4096, 260, ...
 02990  2016   NtUserRemoveProp  (590128, 43282, ...
 02991   724   NtRegisterThreadTerminatePort  (24, ...
 02989   896   NtProtectVirtualMemory  ... (0x61fe000), 4096, 4, ) == 0x0
 02990  2016   NtUserRemoveProp  ... ) == 0x0
 02991   724   NtRegisterThreadTerminatePort  ... ) == 0x0
 02992   896   NtCreateThread  (0x1f03ff, 0x0, -1, 2292532, 2292476, 1, ...
 02993  2016   NtRequestWaitReplyPort  (24, {24, 52, new_msg, 0, 73, 1441813, 29840, 2089866642}  (24, {24, 52, new_msg, 0, 73, 1441813, 29840, 2089866642} "\0\0\0\0\5\4\3\0\1\0\5\0\0\0\4\0\340\7\0\0\250\363\225\0" ...  ...
 02986   384   NtQuerySystemInformation  ... {system info, class 45, size 32}, 32, ) == 0x0
 02992   896   NtCreateThread  ... 480, {1252, 1276}, ) == 0x0
 02994   724   NtSetInformationThread  (-2, BasePriority, {thread info, class 3, size 4}, 4, ...
 02995   384   NtQuerySystemInformation  (ProcessorStatistics, 3016, ...
 02996   896   NtQueryInformationThread  (480, Basic, 28, ...
 02995   384   NtQuerySystemInformation  ... {system info, class 23, size 0}, 0, ) == 0x0
 02993  2016   NtRequestWaitReplyPort  ... {24, 52, reply, 0, 1252, 2016, 81900, 0}  ... {24, 52, reply, 0, 1252, 2016, 81900, 0} "\0\0\0\0\5\4\3\0\0\0\0\0\0\0\4\0\340\7\0\0\0\0\0\0" )  ) == 0x0
 02994   724   NtSetInformationThread  ... ) == 0x0
 02997   384   NtQuerySystemInformation  (ProcessesAndThreads, 3008, ...
 02998  2016   NtUserGetThreadDesktop  (2016, 0, ...
 02996   896   NtQueryInformationThread  ... {ExitStatus=0x103,TebBaseAddress=0x7ff91000,Pid=1252,Tid=1276,}, 0x0, ) == 0x0
 02997   384   NtQuerySystemInformation  ... ) == STATUS_INFO_LENGTH_MISMATCH
 02998  2016   NtUserGetThreadDesktop  ... ) == 0x2c
 02999   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81899, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81899, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\340\1\0\0\344\4\0\0\374\4\0\0" ...  ...
 03000   384   NtCreateKey  (0x2, {24, 0, 0x240, 0, 0,  (0x2, {24, 0, 0x240, 0, 0, "\Registry\Machine\SOFTWARE\Microsoft\Cryptography\RNG"}, 0, 0x0, 0, ... }, 0, 0x0, 0, ...
 03001  2016   NtUserGetObjectInformation  (44, 2, 9827300, 520, 0, ...
 02999   896   NtRequestWaitReplyPort  ... {28, 56, reply, 0, 1252, 896, 81901, 0}  ... {28, 56, reply, 0, 1252, 896, 81901, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\340\1\0\0\344\4\0\0\374\4\0\0" )  ) == 0x0
 03002   724   NtWaitForSingleObject  (316, 0, 0x0, ...
 03001  2016   NtUserGetObjectInformation  ... ) == 0x1
 03003   896   NtResumeThread  (480, ...
 03000   384   NtCreateKey  ... -2147482764, 2, ) == 0x0
 03003   896   NtResumeThread  ... 1, ) == 0x0
 03004   384   NtSetValueKey  (-2147482764,  (-2147482764, "Seed", 0, 3, "\204\11J\274\32B2\313\376\357+_%\200\342! Ul\353\223; \23X\11~\35u\367v\220d/\76\377\353S\266\214-|\371\21\3\250,\377A\11\363\344&5\337\260\233~B\330\3058\277\12\263\37*+\3312_SL\343\301?\363\341\4", 80, ... , 0, 3,  (-2147482764, "Seed", 0, 3, "\204\11J\274\32B2\313\376\357+_%\200\342! Ul\353\223; \23X\11~\35u\367v\220d/\76\377\353S\266\214-|\371\21\3\250,\377A\11\363\344&5\337\260\233~B\330\3058\277\12\263\37*+\3312_SL\343\301?\363\341\4", 80, ... , 80, ...
 03005  2016   NtGdiDeleteObjectApp  (-1190131992, ...
 03006  1276   NtTestAlert  (...
 03004   384   NtSetValueKey  ... ) == 0x0
 03005  2016   NtGdiDeleteObjectApp  ... ) == 0x1
 03006  1276   NtTestAlert  ... ) == 0x0
 03007   384   NtClose  (-2147482764, ...
 03008  2016   NtUserGetWindowDC  (0, ...
 03009  1276   NtContinue  (102759728, 1, ...
 03007   384   NtClose  ... ) == 0x0
 03008  2016   NtUserGetWindowDC  ... ) == 0x1010054
 03010  1276   NtRegisterThreadTerminatePort  (24, ...
 02973   384   NtDeviceIoControlFile  ... {status=0x0, info=256},  ... {status=0x0, info=256}, " \372La\356\254\212\205\215\22'\341\301+\316\326\351\31\210j\366\33\230\4\255\237\366\267\313\322Su\367\334?(\264\221r\207\243u\362\340\232\311\15B\21\242\346\370\21\300;c\2136\3221\247\311YW\22\244\341\271D=\332\342\27\230\266\257\243ZX9\341t\251ZD7w\366\2069\11c\23;\353\333B\207-\225\376\342Xuq-\2338\357G/\275\230\367m\355\316\347\256\201\352e7\3657F^\244\263\12\337\34w\370\355\323\365\304\7G\352\305\347\326\2609\366\32143\214w\232\232p\362|}\361\335\217)l\253)s\3302\254\311b\212\351\221U}m3\353\32\300\263\35\375\226\320\377\314\203\323q\370q\237\257\362\0\3077\334\220\212\23\377\326\250\7\5\5\320\4\240c\31\22\362\322\323s\302%}\35\25O^\344\206\202w\343\20\220\212&\2015\342u\360\16[\304\214:\3110\211{\267\317Yj\33\10", ) , ) == 0x0
 03011  2016   NtUserCallOneParam  (16842836, 57, ...
 03010  1276   NtRegisterThreadTerminatePort  ... ) == 0x0
 03012   896   NtAllocateVirtualMemory  (-1, 0, 0, 2097152, 8192, 4, ...
 03011  2016   NtUserCallOneParam  ... ) == 0x1
 03013   384   NtDeviceIoControlFile  (56, 0, 0x0, 0x0, 0x390008,  (56, 0, 0x0, 0x0, 0x390008, "-k)O\250\234\230&\242\241A@\230\263Rur5\263\351\312%8r5\263\351\312%8r5\263\351\3128\263t\14\261\202\256[\273\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0", 256, 256, ... , 256, 256, ...
 03012   896   NtAllocateVirtualMemory  ... 102760448, 2097152, ) == 0x0
 03014  1276   NtSetInformationThread  (-2, BasePriority, {thread info, class 3, size 4}, 4, ...
 03015   384   NtQuerySystemInformation  (TimeOfDay, 48, ...
 03016   896   NtAllocateVirtualMemory  (-1, 104849408, 0, 8192, 4096, 4, ...
 03015   384   NtQuerySystemInformation  ... {system info, class 3, size 48}, 48, ) == 0x0
 03016   896   NtAllocateVirtualMemory  ... 104849408, 8192, ) == 0x0
 03017   384   NtQuerySystemInformation  (ProcessorTimes, 48, ...
 03018   896   NtProtectVirtualMemory  (-1, (0x63fe000), 4096, 260, ...
 03017   384   NtQuerySystemInformation  ... {system info, class 8, size 48}, 48, ) == 0x0
 03018   896   NtProtectVirtualMemory  ... (0x63fe000), 4096, 4, ) == 0x0
 03019   384   NtQuerySystemInformation  (Performance, 312, ...
 03020  2016   NtUserGetWindowDC  (0, ...
 03014  1276   NtSetInformationThread  ... ) == 0x0
 03021   896   NtCreateThread  (0x1f03ff, 0x0, -1, 2292532, 2292476, 1, ...
 03020  2016   NtUserGetWindowDC  ... ) == 0x1010054
 03019   384   NtQuerySystemInformation  ... {system info, class 2, size 312}, 312, ) == 0x0
 03021   896   NtCreateThread  ... 484, {1252, 220}, ) == 0x0
 03022  2016   NtUserCallOneParam  (16842836, 57, ...
 03023   384   NtQuerySystemInformation  (Exception, 16, ...
 03024   896   NtQueryInformationThread  (484, Basic, 28, ...
 03022  2016   NtUserCallOneParam  ... ) == 0x1
 03023   384   NtQuerySystemInformation  ... {system info, class 33, size 16}, 16, ) == 0x0
 03024   896   NtQueryInformationThread  ... {ExitStatus=0x103,TebBaseAddress=0x7ff90000,Pid=1252,Tid=220,}, 0x0, ) == 0x0
 03025  2016   NtUserGetWindowDC  (0, ...
 03026   384   NtQuerySystemInformation  (Lookaside, 32, ...
 03027   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81901, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81901, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\344\1\0\0\344\4\0\0\334\0\0\0" ...  ...
 03025  2016   NtUserGetWindowDC  ... ) == 0x1010054
 03026   384   NtQuerySystemInformation  ... {system info, class 45, size 32}, 32, ) == 0x0
 03027   896   NtRequestWaitReplyPort  ... {28, 56, reply, 0, 1252, 896, 81902, 0}  ... {28, 56, reply, 0, 1252, 896, 81902, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\344\1\0\0\344\4\0\0\334\0\0\0" )  ) == 0x0
 03028  1276   NtWaitForSingleObject  (316, 0, 0x0, ...
 03029   384   NtQuerySystemInformation  (ProcessorStatistics, 3016, ...
 03030   896   NtResumeThread  (484, ...
 03031  2016   NtUserCallOneParam  (16842836, 57, ...
 03030   896   NtResumeThread  ... 1, ) == 0x0
 03031  2016   NtUserCallOneParam  ... ) == 0x1
 03032   896   NtAllocateVirtualMemory  (-1, 0, 0, 2097152, 8192, 4, ...
 03033  2016   NtUserGetWindowDC  (0, ...
 03032   896   NtAllocateVirtualMemory  ... 104857600, 2097152, ) == 0x0
 03033  2016   NtUserGetWindowDC  ... ) == 0x1010054
 03034   896   NtAllocateVirtualMemory  (-1, 106946560, 0, 8192, 4096, 4, ...
 03035  2016   NtUserCallOneParam  (16842836, 57, ...
 03029   384   NtQuerySystemInformation  ... {system info, class 23, size 0}, 0, ) == 0x0
 03036   220   NtTestAlert  (...
 03035  2016   NtUserCallOneParam  ... ) == 0x1
 03037   384   NtQuerySystemInformation  (ProcessesAndThreads, 3008, ...
 03036   220   NtTestAlert  ... ) == 0x0
 03034   896   NtAllocateVirtualMemory  ... 106946560, 8192, ) == 0x0
 03037   384   NtQuerySystemInformation  ... ) == STATUS_INFO_LENGTH_MISMATCH
 03038   220   NtContinue  (104856880, 1, ...
 03039   896   NtProtectVirtualMemory  (-1, (0x65fe000), 4096, 260, ...
 03040   384   NtCreateKey  (0x2, {24, 0, 0x240, 0, 0,  (0x2, {24, 0, 0x240, 0, 0, "\Registry\Machine\SOFTWARE\Microsoft\Cryptography\RNG"}, 0, 0x0, 0, ... }, 0, 0x0, 0, ...
 03041   220   NtRegisterThreadTerminatePort  (24, ...
 03039   896   NtProtectVirtualMemory  ... (0x65fe000), 4096, 4, ) == 0x0
 03040   384   NtCreateKey  ... -2147482764, 2, ) == 0x0
 03041   220   NtRegisterThreadTerminatePort  ... ) == 0x0
 03042   896   NtCreateThread  (0x1f03ff, 0x0, -1, 2292532, 2292476, 1, ...
 03043   384   NtSetValueKey  (-2147482764,  (-2147482764, "Seed", 0, 3, "s\324N\201\266\211\241iS\222\20K\200NB\271\262\272\300\205\247\11\312\3\367\30]'p\200\252\255\225\240\246\3\270\343]\310-\211M\230\357aZ\303\344y\10\252\322/\32\236D\324M\6\17iI!\364\215\327\31x\342\301ph\34\363b\31\5\367\31", 80, ... , 0, 3,  (-2147482764, "Seed", 0, 3, "s\324N\201\266\211\241iS\222\20K\200NB\271\262\272\300\205\247\11\312\3\367\30]'p\200\252\255\225\240\246\3\270\343]\310-\211M\230\357aZ\303\344y\10\252\322/\32\236D\324M\6\17iI!\364\215\327\31x\342\301ph\34\363b\31\5\367\31", 80, ... , 80, ...
 03044  2016   NtUserGetWindowDC  (0, ...
 03042   896   NtCreateThread  ... 488, {1252, 1328}, ) == 0x0
 03045   220   NtSetInformationThread  (-2, BasePriority, {thread info, class 3, size 4}, 4, ...
 03044  2016   NtUserGetWindowDC  ... ) == 0x1010054
 03046   896   NtQueryInformationThread  (488, Basic, 28, ...
 03047  2016   NtUserCallOneParam  (16842836, 57, ...
 03043   384   NtSetValueKey  ... ) == 0x0
 03045   220   NtSetInformationThread  ... ) == 0x0
 03047  2016   NtUserCallOneParam  ... ) == 0x1
 03048   384   NtClose  (-2147482764, ...
 03046   896   NtQueryInformationThread  ... {ExitStatus=0x103,TebBaseAddress=0x7ff8f000,Pid=1252,Tid=1328,}, 0x0, ) == 0x0
 03049  2016   NtUserGetWindowDC  (0, ...
 03048   384   NtClose  ... ) == 0x0
 03050   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81902, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81902, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\350\1\0\0\344\4\0\00\5\0\0" ...  ...
 03049  2016   NtUserGetWindowDC  ... ) == 0x1010054
 03013   384   NtDeviceIoControlFile  ... {status=0x0, info=256},  ... {status=0x0, info=256}, "=N,\304`\323\332\35\344x\25\363\360\235s\314\376\375)g\350L\26n?\0\357\237BzE\204\356\30\345\226X/\237\351\247\240\374W\221\260V7\266"\235\224\216\372\20\206\260\316\316SD\312]\321\353\207\245x\2571E\362\360\15\211`:\2564\33"bX9}\37\22\363\220\305\4[\266J(\12\35\210\11\224\332\350\23\23\314\230\2\253\230?\351\300\321\233\271\364\210\363\313\301\216*\347[\253\360\266J\312W\224{\270|i?\362,\200\251\245+;\266\260^\225e\362j\237\204\340a\211g\343\370w\215\263\304\303\36c\252\247\262>J\236\353fMP\327l\4\331\342\, ) \235\224\216\372\20\206\260\316\316SD\312]\321\353\207\245x\2571E\362\360\15\211`:\2564\33 ... {status=0x0, info=256}, "=N,\304`\323\332\35\344x\25\363\360\235s\314\376\375)g\350L\26n?\0\357\237BzE\204\356\30\345\226X/\237\351\247\240\374W\221\260V7\266"\235\224\216\372\20\206\260\316\316SD\312]\321\353\207\245x\2571E\362\360\15\211`:\2564\33"bX9}\37\22\363\220\305\4[\266J(\12\35\210\11\224\332\350\23\23\314\230\2\253\230?\351\300\321\233\271\364\210\363\313\301\216*\347[\253\360\266J\312W\224{\270|i?\362,\200\251\245+;\266\260^\225e\362j\237\204\340a\211g\343\370w\215\263\304\303\36c\252\247\262>J\236\353fMP\327l\4\331\342\, ) , ) == 0x0
 03050   896   NtRequestWaitReplyPort  ... {28, 56, reply, 0, 1252, 896, 81903, 0}  ... {28, 56, reply, 0, 1252, 896, 81903, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\350\1\0\0\344\4\0\00\5\0\0" )  ) == 0x0
 03051   220   NtWaitForSingleObject  (316, 0, 0x0, ...
 03052   384   NtDeviceIoControlFile  (56, 0, 0x0, 0x0, 0x390008,  (56, 0, 0x0, 0x0, 0x390008, "-k)O\250\234\230&\242\241A@\230\263Rur5\263\351\312%8r5\263\351\312%8r5\263\351\312%8r5\263\351\3128\263t\14\261\202\256[\273\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0", 256, 256, ... , 256, 256, ...
 03053   896   NtResumeThread  (488, ...
 03054  2016   NtUserCallOneParam  (16842836, 57, ...
 03055   384   NtQuerySystemInformation  (TimeOfDay, 48, ...
 03053   896   NtResumeThread  ... 1, ) == 0x0
 03054  2016   NtUserCallOneParam  ... ) == 0x1
 03056  1328   NtTestAlert  (...
 03055   384   NtQuerySystemInformation  ... {system info, class 3, size 48}, 48, ) == 0x0
 03057  2016   NtUserGetWindowDC  (0, ...
 03056  1328   NtTestAlert  ... ) == 0x0
 03058   384   NtQuerySystemInformation  (ProcessorTimes, 48, ...
 03057  2016   NtUserGetWindowDC  ... ) == 0x1010054
 03059  1328   NtContinue  (106954032, 1, ...
 03058   384   NtQuerySystemInformation  ... {system info, class 8, size 48}, 48, ) == 0x0
 03060  2016   NtUserCallOneParam  (16842836, 57, ...
 03061  1328   NtRegisterThreadTerminatePort  (24, ...
 03062   384   NtQuerySystemInformation  (Performance, 312, ...
 03060  2016   NtUserCallOneParam  ... ) == 0x1
 03061  1328   NtRegisterThreadTerminatePort  ... ) == 0x0
 03062   384   NtQuerySystemInformation  ... {system info, class 2, size 312}, 312, ) == 0x0
 03063   896   NtAllocateVirtualMemory  (-1, 0, 0, 2097152, 8192, 4, ...
 03064  2016   NtUserGetWindowDC  (0, ...
 03065   384   NtQuerySystemInformation  (Exception, 16, ...
 03063   896   NtAllocateVirtualMemory  ... 106954752, 2097152, ) == 0x0
 03064  2016   NtUserGetWindowDC  ... ) == 0x1010054
 03066  1328   NtSetInformationThread  (-2, BasePriority, {thread info, class 3, size 4}, 4, ...
 03067   896   NtAllocateVirtualMemory  (-1, 109043712, 0, 8192, 4096, 4, ...
 03068  2016   NtUserCallOneParam  (16842836, 57, ...
 03067   896   NtAllocateVirtualMemory  ... 109043712, 8192, ) == 0x0
 03068  2016   NtUserCallOneParam  ... ) == 0x1
 03069   896   NtProtectVirtualMemory  (-1, (0x67fe000), 4096, 260, ...
 03070  2016   NtUserGetWindowDC  (0, ...
 03069   896   NtProtectVirtualMemory  ... (0x67fe000), 4096, 4, ) == 0x0
 03070  2016   NtUserGetWindowDC  ... ) == 0x1010054
 03065   384   NtQuerySystemInformation  ... {system info, class 33, size 16}, 16, ) == 0x0
 03066  1328   NtSetInformationThread  ... ) == 0x0
 03071   896   NtCreateThread  (0x1f03ff, 0x0, -1, 2292532, 2292476, 1, ...
 03072   384   NtQuerySystemInformation  (Lookaside, 32, ...
 03073  2016   NtGdiCreatePatternBrushInternal  (59048383, 0, 0, ...
 03071   896   NtCreateThread  ... 492, {1252, 1636}, ) == 0x0
 03072   384   NtQuerySystemInformation  ... {system info, class 45, size 32}, 32, ) == 0x0
 03073  2016   NtGdiCreatePatternBrushInternal  ... ) == 0xba1006e8
 03074   896   NtQueryInformationThread  (492, Basic, 28, ...
 03075   384   NtQuerySystemInformation  (ProcessorStatistics, 3016, ...
 03076  2016   NtUserCallOneParam  (16842836, 57, ...
 03074   896   NtQueryInformationThread  ... {ExitStatus=0x103,TebBaseAddress=0x7ff8e000,Pid=1252,Tid=1636,}, 0x0, ) == 0x0
 03075   384   NtQuerySystemInformation  ... {system info, class 23, size 0}, 0, ) == 0x0
 03076  2016   NtUserCallOneParam  ... ) == 0x1
 03077   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81903, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81903, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\354\1\0\0\344\4\0\0d\6\0\0" ...  ...
 03078   384   NtQuerySystemInformation  (ProcessesAndThreads, 3008, ...
 03079  2016   NtUserSetProp  (590128, 43288, 3369136, ...
 03077   896   NtRequestWaitReplyPort  ... {28, 56, reply, 0, 1252, 896, 81904, 0}  ... {28, 56, reply, 0, 1252, 896, 81904, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\354\1\0\0\344\4\0\0d\6\0\0" )  ) == 0x0
 03080  1328   NtWaitForSingleObject  (316, 0, 0x0, ...
 03079  2016   NtUserSetProp  ... ) == 0x1
 03081   896   NtResumeThread  (492, ...
 03078   384   NtQuerySystemInformation  ... ) == STATUS_INFO_LENGTH_MISMATCH
 03081   896   NtResumeThread  ... 1, ) == 0x0
 03082   384   NtCreateKey  (0x2, {24, 0, 0x240, 0, 0,  (0x2, {24, 0, 0x240, 0, 0, "\Registry\Machine\SOFTWARE\Microsoft\Cryptography\RNG"}, 0, 0x0, 0, ... }, 0, 0x0, 0, ...
 03083   896   NtAllocateVirtualMemory  (-1, 0, 0, 2097152, 8192, 4, ...
 03082   384   NtCreateKey  ... -2147482764, 2, ) == 0x0
 03083   896   NtAllocateVirtualMemory  ... 109051904, 2097152, ) == 0x0
 03084   384   NtSetValueKey  (-2147482764,  (-2147482764, "Seed", 0, 3, "\337\206\322\210\210\23|\3"l\250(;\255\22\317\234\224\24B\367\q#y\201\355P'\373\2668\323\30<\21K@\324\36\353O\221Q\360\373\32Qx\260\206\331\335\252z8\354P\16l\205\333{\237\301\237p@zo\341(\333\364\221\332=o\212<", 80, ... , 0, 3,  (-2147482764, "Seed", 0, 3, "\337\206\322\210\210\23|\3"l\250(;\255\22\317\234\224\24B\367\q#y\201\355P'\373\2668\323\30<\21K@\324\36\353O\221Q\360\373\32Qx\260\206\331\335\252z8\354P\16l\205\333{\237\301\237p@zo\341(\333\364\221\332=o\212<", 80, ... l\250(;\255\22\317\234\224\24B\367\q#y\201\355P'\373\2668\323\30<\21K@\324\36\353O\221Q\360\373\32Qx\260\206\331\335\252z8\354P\16l\205\333{\237\301\237p@zo\341(\333\364\221\332=o\212<", 80, ...
 03085   896   NtAllocateVirtualMemory  (-1, 111140864, 0, 8192, 4096, 4, ...
 03084   384   NtSetValueKey  ... ) == 0x0
 03086  2016   NtUserGetAncestor  (590128, 1, ...
 03087  1636   NtTestAlert  (...
 03088   384   NtClose  (-2147482764, ...
 03086  2016   NtUserGetAncestor  ... ) == 0x10014
 03087  1636   NtTestAlert  ... ) == 0x0
 03085   896   NtAllocateVirtualMemory  ... 111140864, 8192, ) == 0x0
 03089  2016   NtUserValidateHandleSecure  (65556, ...
 03090  1636   NtContinue  (109051184, 1, ...
 03091   896   NtProtectVirtualMemory  (-1, (0x69fe000), 4096, 260, ...
 03089  2016   NtUserValidateHandleSecure  ... ) == 0x1
 03092  1636   NtRegisterThreadTerminatePort  (24, ...
 03091   896   NtProtectVirtualMemory  ... (0x69fe000), 4096, 4, ) == 0x0
 03093  2016   NtUserSetWindowPos  (590128, 0, 0, 0, 123, 34, 1047, ...
 03092  1636   NtRegisterThreadTerminatePort  ... ) == 0x0
 03094   896   NtCreateThread  (0x1f03ff, 0x0, -1, 2292532, 2292476, 1, ...
 03093  2016   NtUserSetWindowPos  ... ) == 0x1
 03088   384   NtClose  ... ) == 0x0
 03094   896   NtCreateThread  ... 496, {1252, 704}, ) == 0x0
 01892  2016   NtUserCreateWindowEx  ... ) == 0x90130
 03052   384   NtDeviceIoControlFile  ... {status=0x0, info=256},  ... {status=0x0, info=256}, "\254\262\22\201o\352\237q\316\267R\311\262\371\36d\204\354\346\331\214\276\12\375\275#T\205\26\245v\365c\17S\311M\231\304\213\243U9\337\263\31+0\232yO\2166|\2\210N\227p|\23Q\14P\331\34\3\232\301\272o\300\362\235w?\271\226#v\250\345r\205\234\345\357h\234\245\361\15\350B\2Jc\257\4=\1\316I\276\347\237\250\360\372\233\355\371\275\336u\36\21\354\270g\274%\314\252\316\232;v\314\367\306\255 L3\35R\223\206i\316|)\344L\217\363+\3513\304+\246\310@\337\244\267r\340\355\322\265O\233\373;\340\231E\21\376\234a=\246\302\231\365AbI8\365G\260\276\3161\34\376\372m\356\252{\314\272\23B\324\26Gp\5\27\234k\304\5\272\335\24s\331\32\317\17\326\261\242\6\216\271^9\351C\323\206\222\301\232\276,\313\312\336\265Z:$\23\204L\212_\242M\14\267\323\224\23\227\14", ) , ) == 0x0
 03095   896   NtQueryInformationThread  (496, Basic, 28, ...
 03096  2016   NtOpenProcess  (0x1f0fff, {24, 0, 0x0, 0, 0, 0x0}, {1252, 0}, ...
 03097   384   NtDeviceIoControlFile  (56, 0, 0x0, 0x0, 0x390008,  (56, 0, 0x0, 0x0, 0x390008, "-k)O\250\234\230&\242\241A@\230\263Rur5\263\351\312%8r5\263\351\312%8r5\263\351\312%8r5\263\351\312%8r5\263\351\3128\263t\14\261\202\256[\273\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0", 256, 256, ... , 256, 256, ...
 03098  1636   NtSetInformationThread  (-2, BasePriority, {thread info, class 3, size 4}, 4, ...
 03096  2016   NtOpenProcess  ... 500, ) == 0x0
 03099   384   NtQuerySystemInformation  (TimeOfDay, 48, ...
 03098  1636   NtSetInformationThread  ... ) == 0x0
 03095   896   NtQueryInformationThread  ... {ExitStatus=0x103,TebBaseAddress=0x7ff8d000,Pid=1252,Tid=704,}, 0x0, ) == 0x0
 03099   384   NtQuerySystemInformation  ... {system info, class 3, size 48}, 48, ) == 0x0
 03100  2016   NtOpenProcessToken  (500, 0x28, ...
 03101   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81904, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81904, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\360\1\0\0\344\4\0\0\300\2\0\0" ...  ...
 03102   384   NtQuerySystemInformation  (ProcessorTimes, 48, ...
 03100  2016   NtOpenProcessToken  ... 504, ) == 0x0
 03101   896   NtRequestWaitReplyPort  ... {28, 56, reply, 0, 1252, 896, 81905, 0}  ... {28, 56, reply, 0, 1252, 896, 81905, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\360\1\0\0\344\4\0\0\300\2\0\0" )  ) == 0x0
 03103  1636   NtWaitForSingleObject  (316, 0, 0x0, ...
 03104  2016   NtQueryInformationToken  (504, 21, 40, ...
 03105   896   NtResumeThread  (496, ...
 03102   384   NtQuerySystemInformation  ... {system info, class 8, size 48}, 48, ) == 0x0
 03104  2016   NtQueryInformationToken  ... ) == STATUS_INVALID_INFO_CLASS
 03105   896   NtResumeThread  ... 1, ) == 0x0
 03106   384   NtQuerySystemInformation  (Performance, 312, ...
 03107  2016   NtAllocateVirtualMemory  (-1, 5746688, 0, 20480, 4096, 4, ...
 03108   704   NtTestAlert  (...
 03106   384   NtQuerySystemInformation  ... {system info, class 2, size 312}, 312, ) == 0x0
 03107  2016   NtAllocateVirtualMemory  ... 5746688, 20480, ) == 0x0
 03108   704   NtTestAlert  ... ) == 0x0
 03109   384   NtQuerySystemInformation  (Exception, 16, ...
 03110   896   NtAllocateVirtualMemory  (-1, 0, 0, 2097152, 8192, 4, ...
 03111   704   NtContinue  (111148336, 1, ...
 03109   384   NtQuerySystemInformation  ... {system info, class 33, size 16}, 16, ) == 0x0
 03110   896   NtAllocateVirtualMemory  ... 111149056, 2097152, ) == 0x0
 03112   704   NtRegisterThreadTerminatePort  (24, ...
 03113   384   NtQuerySystemInformation  (Lookaside, 32, ...
 03114   896   NtAllocateVirtualMemory  (-1, 113238016, 0, 8192, 4096, 4, ...
 03112   704   NtRegisterThreadTerminatePort  ... ) == 0x0
 03115  2016   NtQueryInformationToken  (504, User, 16384, ...
 03114   896   NtAllocateVirtualMemory  ... 113238016, 8192, ) == 0x0
 03113   384   NtQuerySystemInformation  ... {system info, class 45, size 32}, 32, ) == 0x0
 03115  2016   NtQueryInformationToken  ... {token info, class 1, size 36}, 36, ) == 0x0
 03116   896   NtProtectVirtualMemory  (-1, (0x6bfe000), 4096, 260, ...
 03117   384   NtQuerySystemInformation  (ProcessorStatistics, 3016, ...
 03118  2016   NtCreateEvent  (0x1f0003, 0x0, 0, 0, ...
 03116   896   NtProtectVirtualMemory  ... (0x6bfe000), 4096, 4, ) == 0x0
 03117   384   NtQuerySystemInformation  ... {system info, class 23, size 0}, 0, ) == 0x0
 03118  2016   NtCreateEvent  ... 508, ) == 0x0
 03119   704   NtSetInformationThread  (-2, BasePriority, {thread info, class 3, size 4}, 4, ...
 03120   384   NtQuerySystemInformation  (ProcessesAndThreads, 3008, ...
 03121  2016   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 03120   384   NtQuerySystemInformation  ... ) == STATUS_INFO_LENGTH_MISMATCH
 03121  2016   NtDuplicateObject  ... 512, ) == 0x0
 03122   384   NtCreateKey  (0x2, {24, 0, 0x240, 0, 0,  (0x2, {24, 0, 0x240, 0, 0, "\Registry\Machine\SOFTWARE\Microsoft\Cryptography\RNG"}, 0, 0x0, 0, ... }, 0, 0x0, 0, ...
 03123   896   NtCreateThread  (0x1f03ff, 0x0, -1, 2292532, 2292476, 1, ...
 03119   704   NtSetInformationThread  ... ) == 0x0
 03124  2016   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\System\CurrentControlSet\Control\ComputerName"}, ... }, ...
 03123   896   NtCreateThread  ... 516, {1252, 1152}, ) == 0x0
 03122   384   NtCreateKey  ... -2147482764, 2, ) == 0x0
 03124  2016   NtOpenKey  ... 520, ) == 0x0
 03125   896   NtQueryInformationThread  (516, Basic, 28, ...
 03126   384   NtSetValueKey  (-2147482764,  (-2147482764, "Seed", 0, 3, "W>d\231\10o\245\310\221j)\4\364$\342\354'\306x\3\315fib\272c\205\203e\306\365\24N\307G\263\343\345\1\212p\377\321\243\255\230N#\327\236\1\234\242\212\265\212\332n\311\352d\221 \350o,\326\356\207yV\243\16\333\270@\325\353\30\375", 80, ... , 0, 3,  (-2147482764, "Seed", 0, 3, "W>d\231\10o\245\310\221j)\4\364$\342\354'\306x\3\315fib\272c\205\203e\306\365\24N\307G\263\343\345\1\212p\377\321\243\255\230N#\327\236\1\234\242\212\265\212\332n\311\352d\221 \350o,\326\356\207yV\243\16\333\270@\325\353\30\375", 80, ... , 80, ...
 03127  2016   NtOpenKey  (0x20019, {24, 520, 0x40, 0, 0,  (0x20019, {24, 520, 0x40, 0, 0, "ActiveComputerName"}, ... }, ...
 03125   896   NtQueryInformationThread  ... {ExitStatus=0x103,TebBaseAddress=0x7ff8c000,Pid=1252,Tid=1152,}, 0x0, ) == 0x0
 03126   384   NtSetValueKey  ... ) == 0x0
 03127  2016   NtOpenKey  ... 524, ) == 0x0
 03128   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81905, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81905, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\4\2\0\0\344\4\0\0\200\4\0\0" ...  ...
 03129   384   NtClose  (-2147482764, ...
 03130  2016   NtQueryValueKey  (524,  (524, "ComputerName", Full, 108, ... , Full, 108, ...
 03129   384   NtClose  ... ) == 0x0
 03130  2016   NtQueryValueKey  ... TitleIdx=0, Type=1, Name= ... TitleIdx=0, Type=1, Name="ComputerName", Data="V\0I\0R\0T\0U\0A\0L\0\0\0"}, 60, ) , Data= ... TitleIdx=0, Type=1, Name="ComputerName", Data="V\0I\0R\0T\0U\0A\0L\0\0\0"}, 60, ) }, 60, ) == 0x0
 03097   384   NtDeviceIoControlFile  ... {status=0x0, info=256},  ... {status=0x0, info=256}, "\312\346E\377\24e\303ZC\301\22~Y\276`M\332\374\363\206\256\0\273"\241\360dt\2\26\324L|\221\243\210\204\361\337\355\271\14b\305\237\10\247"\15'\340r\330qE;\227\36101\343\1H\351\262P\334@\351\256\263\257\271\125\247\15H\303\313\342\351\3563\34P\262+p\260\224\371\246\307W\1\351\252\24\264f \236\340\352\313\374\257\300g3\215\364qew\26\24\353\26\245\374\3757\15R\200Y\320\222v\332\324\6\355\271\21\355*.$\311\336\33\10\1\34\15mF\271M\317\232<\263\3${-gCW\374\354\350\27\3734,\256}\261\33\334F\203\222\316F*\214+C\27\217\34\133\327\^\373`k=\275\367\305u\336Pt\356\216W\231\317\270\13S\275r\260\2276{\270\343\273\245\326N\375\233a\254\351g\340\234\216?\230h\24303\16\361v\375\206\221\354n>\356-\302s\13V\302", ) \241\360dt\2\26\324L|\221\243\210\204\361\337\355\271\14b\305\237\10\247 ... {status=0x0, info=256}, "\312\346E\377\24e\303ZC\301\22~Y\276`M\332\374\363\206\256\0\273"\241\360dt\2\26\324L|\221\243\210\204\361\337\355\271\14b\305\237\10\247"\15'\340r\330qE;\227\36101\343\1H\351\262P\334@\351\256\263\257\271\125\247\15H\303\313\342\351\3563\34P\262+p\260\224\371\246\307W\1\351\252\24\264f \236\340\352\313\374\257\300g3\215\364qew\26\24\353\26\245\374\3757\15R\200Y\320\222v\332\324\6\355\271\21\355*.$\311\336\33\10\1\34\15mF\271M\317\232<\263\3${-gCW\374\354\350\27\3734,\256}\261\33\334F\203\222\316F*\214+C\27\217\34\133\327\^\373`k=\275\367\305u\336Pt\356\216W\231\317\270\13S\275r\260\2276{\270\343\273\245\326N\375\233a\254\351g\340\234\216?\230h\24303\16\361v\375\206\221\354n>\356-\302s\13V\302", ) , ) == 0x0
 03131   704   NtWaitForSingleObject  (316, 0, 0x0, ...
 03128   896   NtRequestWaitReplyPort  ... {28, 56, reply, 0, 1252, 896, 81906, 0}  ... {28, 56, reply, 0, 1252, 896, 81906, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\4\2\0\0\344\4\0\0\200\4\0\0" )  ) == 0x0
 03132  2016   NtClose  (524, ...
 03133   384   NtDeviceIoControlFile  (56, 0, 0x0, 0x0, 0x390008,  (56, 0, 0x0, 0x0, 0x390008, "-k)O\250\234\230&\242\241A@\230\263Rur5\263\351\312%8r5\263\351\312%8r5\263\351\312%8r5\263\351\312%8r5\263\351\312%8r5\263\351\3128\263t\14\261\202\256[\273\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0", 256, 256, ... , 256, 256, ...
 03134   896   NtResumeThread  (516, ...
 03132  2016   NtClose  ... ) == 0x0
 03135   384   NtQuerySystemInformation  (TimeOfDay, 48, ...
 03134   896   NtResumeThread  ... 1, ) == 0x0
 03136  2016   NtClose  (520, ...
 03135   384   NtQuerySystemInformation  ... {system info, class 3, size 48}, 48, ) == 0x0
 03137   896   NtAllocateVirtualMemory  (-1, 0, 0, 2097152, 8192, 4, ...
 03136  2016   NtClose  ... ) == 0x0
 03138   384   NtQuerySystemInformation  (ProcessorTimes, 48, ...
 03137   896   NtAllocateVirtualMemory  ... 113246208, 2097152, ) == 0x0
 03139  2016   NtCreateIoCompletion  (0x1f0003, 0x0, 0, ...
 03138   384   NtQuerySystemInformation  ... {system info, class 8, size 48}, 48, ) == 0x0
 03140   896   NtAllocateVirtualMemory  (-1, 115335168, 0, 8192, 4096, 4, ...
 03139  2016   NtCreateIoCompletion  ... 520, ) == 0x0
 03141   384   NtQuerySystemInformation  (Performance, 312, ...
 03142  1152   NtTestAlert  (...
 03140   896   NtAllocateVirtualMemory  ... 115335168, 8192, ) == 0x0
 03143  2016   NtCreateIoCompletion  (0x1f0003, 0x0, -1, ...
 03142  1152   NtTestAlert  ... ) == 0x0
 03144   896   NtProtectVirtualMemory  (-1, (0x6dfe000), 4096, 260, ...
 03143  2016   NtCreateIoCompletion  ... 524, ) == 0x0
 03145  1152   NtContinue  (113245488, 1, ...
 03144   896   NtProtectVirtualMemory  ... (0x6dfe000), 4096, 4, ) == 0x0
 03146  2016   NtDuplicateObject  (-1, 520, -1, 0x0, 0, 2, ...
 03147  1152   NtRegisterThreadTerminatePort  (24, ...
 03148   896   NtCreateThread  (0x1f03ff, 0x0, -1, 2292532, 2292476, 1, ...
 03146  2016   NtDuplicateObject  ... 528, ) == 0x0
 03147  1152   NtRegisterThreadTerminatePort  ... ) == 0x0
 03148   896   NtCreateThread  ... 532, {1252, 1228}, ) == 0x0
 03149  2016   NtOpenThreadToken  (-2, 0xc, 1, ...
 03141   384   NtQuerySystemInformation  ... {system info, class 2, size 312}, 312, ) == 0x0
 03150   896   NtQueryInformationThread  (532, Basic, 28, ...
 03149  2016   NtOpenThreadToken  ... ) == STATUS_NO_TOKEN
 03151   384   NtQuerySystemInformation  (Exception, 16, ...
 03152  1152   NtSetInformationThread  (-2, BasePriority, {thread info, class 3, size 4}, 4, ...
 03150   896   NtQueryInformationThread  ... {ExitStatus=0x103,TebBaseAddress=0x7ff8b000,Pid=1252,Tid=1228,}, 0x0, ) == 0x0
 03151   384   NtQuerySystemInformation  ... {system info, class 33, size 16}, 16, ) == 0x0
 03153   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81906, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81906, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\24\2\0\0\344\4\0\0\314\4\0\0" ...  ...
 03154   384   NtQuerySystemInformation  (Lookaside, 32, ...
 03153   896   NtRequestWaitReplyPort  ... {28, 56, reply, 0, 1252, 896, 81907, 0}  ... {28, 56, reply, 0, 1252, 896, 81907, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\24\2\0\0\344\4\0\0\314\4\0\0" )  ) == 0x0
 03154   384   NtQuerySystemInformation  ... {system info, class 45, size 32}, 32, ) == 0x0
 03155   896   NtResumeThread  (532, ...
 03156   384   NtQuerySystemInformation  (ProcessorStatistics, 3016, ...
 03155   896   NtResumeThread  ... 1, ) == 0x0
 03157  2016   NtCreateEvent  (0x1f0003, 0x0, 1, 0, ...
 03152  1152   NtSetInformationThread  ... ) == 0x0
 03156   384   NtQuerySystemInformation  ... {system info, class 23, size 0}, 0, ) == 0x0
 03158  1228   NtTestAlert  (...
 03157  2016   NtCreateEvent  ... 536, ) == 0x0
 03159   896   NtAllocateVirtualMemory  (-1, 0, 0, 2097152, 8192, 4, ...
 03160   384   NtQuerySystemInformation  (ProcessesAndThreads, 3008, ...
 03158  1228   NtTestAlert  ... ) == 0x0
 03161  2016   NtOpenThreadToken  (-2, 0xc, 1, ...
 03159   896   NtAllocateVirtualMemory  ... 115343360, 2097152, ) == 0x0
 03160   384   NtQuerySystemInformation  ... ) == STATUS_INFO_LENGTH_MISMATCH
 03162  1228   NtContinue  (115342640, 1, ...
 03161  2016   NtOpenThreadToken  ... ) == STATUS_NO_TOKEN
 03163   896   NtAllocateVirtualMemory  (-1, 117432320, 0, 8192, 4096, 4, ...
 03164   384   NtCreateKey  (0x2, {24, 0, 0x240, 0, 0,  (0x2, {24, 0, 0x240, 0, 0, "\Registry\Machine\SOFTWARE\Microsoft\Cryptography\RNG"}, 0, 0x0, 0, ... }, 0, 0x0, 0, ...
 03165  1228   NtRegisterThreadTerminatePort  (24, ...
 03166  2016   NtSetInformationThread  (-2, ImpersonationToken, {ImpToken=0,}, 4, ...
 03163   896   NtAllocateVirtualMemory  ... 117432320, 8192, ) == 0x0
 03164   384   NtCreateKey  ... -2147482764, 2, ) == 0x0
 03165  1228   NtRegisterThreadTerminatePort  ... ) == 0x0
 03166  2016   NtSetInformationThread  ... ) == 0x0
 03167   896   NtProtectVirtualMemory  (-1, (0x6ffe000), 4096, 260, ...
 03168   384   NtSetValueKey  (-2147482764,  (-2147482764, "Seed", 0, 3, "\201\303\225i\360\234\247\370\25\260\270\372\330\337 D\345\270Z\17\261\213\35g\316\265\240\366Erx|\25\2479(7\245\263)E)\365\345\305p\210wd\3d]\11\253q\276\37\221\312\357p\30\314\22}\276\36\327eG\231#r\20\322\341jr=", 80, ... , 0, 3,  (-2147482764, "Seed", 0, 3, "\201\303\225i\360\234\247\370\25\260\270\372\330\337 D\345\270Z\17\261\213\35g\316\265\240\366Erx|\25\2479(7\245\263)E)\365\345\305p\210wd\3d]\11\253q\276\37\221\312\357p\30\314\22}\276\36\327eG\231#r\20\322\341jr=", 80, ... , 80, ...
 03169  1152   NtWaitForSingleObject  (316, 0, 0x0, ...
 03170  1228   NtSetInformationThread  (-2, BasePriority, {thread info, class 3, size 4}, 4, ...
 03167   896   NtProtectVirtualMemory  ... (0x6ffe000), 4096, 4, ) == 0x0
 03171  2016   NtCreateFile  (0xc0100080, {24, 0, 0x40, 0, 9828016,  (0xc0100080, {24, 0, 0x40, 0, 9828016, "\??\PIPE\lsarpc"}, 0x0, 0, 3, 1, 64, 0, 0, ... }, 0x0, 0, 3, 1, 64, 0, 0, ...
 03168   384   NtSetValueKey  ... ) == 0x0
 03170  1228   NtSetInformationThread  ... ) == 0x0
 03171  2016   NtCreateFile  ... 540, {status=0x0, info=1}, ) == 0x0
 03172   384   NtClose  (-2147482764, ...
 03173   896   NtCreateThread  (0x1f03ff, 0x0, -1, 2292532, 2292476, 1, ...
 03174  2016   NtSetInformationFile  (540, 9828072, 8, Pipe, ...
 03172   384   NtClose  ... ) == 0x0
 03173   896   NtCreateThread  ... 544, {1252, 792}, ) == 0x0
 03174  2016   NtSetInformationFile  ... {status=0x0, info=0}, ) == 0x0
 03133   384   NtDeviceIoControlFile  ... {status=0x0, info=256},  ... {status=0x0, info=256}, "!\34\331\301:\305\6u\305\351\2\307\307Ih\276\30\255\237*nJ\252\376\210-\323\370cM7\13\274u4\326\357\254\360\315\355AP\262\252y\317\355\211\255\24\27u\266\327\351f\337\273\273K\26\275\376= \222@\334\231\331k\303k\357\314\351h\261\200 l\23\373\347z\213\354l6\21m))\314\375\36\342\310$\1\245q\47\246VY\2518\361\375\15\37\265~\235\177\325\320\27\26\33\31n\27-\305\206\316f\274\246\273\373\213\317\362O\346AF\377\246\35a\1\230&\372\13\303e\206\313\357\234\252\253\17 \213\317\2461r\325%\221Q,#\325.7\303\217g\331\374s~B1\224\272I\201\235\232\373\341~%\211Vc\337\363r\210\27\33by\275\27\3\366>`\212\214\36#\206\355j\210.\272>\237\324\255\263\310\315\2460\250Pm\263\206wS)\347A,\15\251vvq\22C\223\2475\305\253\320\235d", ) , ) == 0x0
 03175   896   NtQueryInformationThread  (544, Basic, 28, ...
 03176  2016   NtSetInformationFile  (540, 9828060, 8, Completion, ...
 03177   384   NtCreateEvent  (0x1f0003, 0x0, 1, 0, ...
 03175   896   NtQueryInformationThread  ... {ExitStatus=0x103,TebBaseAddress=0x7ff8a000,Pid=1252,Tid=792,}, 0x0, ) == 0x0
 03176  2016   NtSetInformationFile  ... {status=0x0, info=0}, ) == 0x0
 03177   384   NtCreateEvent  ... 548, ) == 0x0
 03178   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81907, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81907, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG \2\0\0\344\4\0\0\30\3\0\0" ...  ...
 03179  1228   NtWaitForSingleObject  (316, 0, 0x0, ...
 03180  2016   NtSetInformationThread  (-2, ImpersonationToken, {ImpToken=0,}, 4, ...
 03178   896   NtRequestWaitReplyPort  ... {28, 56, reply, 0, 1252, 896, 81908, 0}  ... {28, 56, reply, 0, 1252, 896, 81908, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG \2\0\0\344\4\0\0\30\3\0\0" )  ) == 0x0
 03181   384   NtConnectPort  ( ("\RPC Control\epmapper", {12, 2, 1, 1}, 0x0, 0x0, 22606456, 188, ... , {12, 2, 1, 1}, 0x0, 0x0, 22606456, 188, ...
 03180  2016   NtSetInformationThread  ... ) == 0x0
 03182   896   NtResumeThread  (544, ...
 03183  2016   NtWriteFile  (540, 509, 0, 0,  (540, 509, 0, 0, "\5\0\13\3\20\0\0\0H\0\0\0\1\0\0\0\270\20\270\20\0\0\0\0\1\0\0\0\0\0\1\0xW4\224\22\315\253\357\0\1#Eg\211\253\0\0\0\0\4]\210\212\353\34\311\21\237\350\10\0+\20H`\2\0\0\0", 72, {0, 0}, 0, ... , 72, {0, 0}, 0, ...
 03182   896   NtResumeThread  ... 1, ) == 0x0
 03181   384   NtConnectPort  ... 552, 0x0, 0x0, 0x0, 188, ) == 0x0
 03183  2016   NtWriteFile  ... {status=0x0, info=72}, ) == 0x0
 03184   896   NtAllocateVirtualMemory  (-1, 0, 0, 2097152, 8192, 4, ...
 03185   384   NtRequestWaitReplyPort  (552, {200, 224, new_msg, 0, 2883626, 5730400, 12, 2}  (552, {200, 224, new_msg, 0, 2883626, 5730400, 12, 2} "\0\1V\0\10\0\0\0\274\0\0\0\10\203\257\341\37]\311\21\221\244\10\0+\24\240\372\3\0\0\0\1\0\0\0\0\0\2\0\4\0\0\0\260uV\0x\1V\0\10\0\0\0\5\0\0\0x\1V\0\0\0\0\0\0\0W\0\2\0\0\0\374\336Lhq[\3522\310\365W\0h\1V\0\12\0\0\0\0\0\0\0\0\0\0\0(\0\0\0\240\365W\0'\333\37\224x\1V\0\300\365W\0h\1V\0\0\0\0\0\0\0\0\0\300\365W\0P\0\0\0\310\365W\0\360\6\221|x\1V\0P\0\0\0\346\31\0\0\0\0V\0\370\360X\1\372\31\221|\214\370X\1\30\356\220|\0\0\0\0\0\0\0\0\0\0\0\0\351\201\347w" ...  ...
 03186  2016   NtReadFile  (540, 509, 0, 0, 1024, {0, 0}, 0, ...
 03184   896   NtAllocateVirtualMemory  ... 117440512, 2097152, ) == 0x0
 03186  2016   NtReadFile  ... {status=0x0, info=68},  ... {status=0x0, info=68}, "\5\0\14\3\20\0\0\0D\0\0\0\1\0\0\0\270\20\270\20k+\0\0\14\0\PIPE\lsass\0\0\0\1\0\0\0\0\0\0\0\4]\210\212\353\34\311\21\237\350\10\0+\20H`\2\0\0\0", ) , ) == 0x0
 03187   896   NtAllocateVirtualMemory  (-1, 119529472, 0, 8192, 4096, 4, ...
 03185   384   NtRequestWaitReplyPort  ... {200, 224, reply, 0, 1252, 384, 81910, 0}  ... {200, 224, reply, 0, 1252, 384, 81910, 0} "\7\1V\0\10\0\0\0\274\0\0\0\10\203\257\341\37]\311\21\221\244\10\0+\24\240\372\3\0\0\0\1\0\0\0\0\0\0\0\4\0\0\0\260uV\0\377\377\377\377\10\0\0\0\5\0\0\0x\1V\0\0\0\0\0\0\0W\0\2\0\0\0\374\336Lhq[\3522\310\365W\0h\1V\0\12\0\0\0\0\0\0\0\0\0\0\0(\0\0\0\240\365W\0'\333\37\224x\1V\0\300\365W\0h\1V\0\0\0\0\0\0\0\0\0\300\365W\0P\0\0\0\310\365W\0\360\6\221|x\1V\0P\0\0\0\346\31\0\0\0\0V\0\370\360X\1\372\31\221|\214\370X\1\30\356\220|\0\0\0\0\0\0\0\0\0\0\0\0\351\201\347w" )  ) == 0x0
 03188   792   NtTestAlert  (...
 03189  2016   NtFsControlFile  (540, 509, 0x0, 0x0, 0x11c017,  (540, 509, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0@\0\0\0\1\0\0\0(\0\0\0\0\0,\0\0\0\0\0\30\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0x\375\225\0\14\0\0\0\2\0\1\0\0\10\0\0", 64, 1024, ... , 64, 1024, ...
 03187   896   NtAllocateVirtualMemory  ... 119529472, 8192, ) == 0x0
 03188   792   NtTestAlert  ... ) == 0x0
 03189  2016   NtFsControlFile  ... {status=0x103, info=68},  ... {status=0x103, info=68}, "\5\0\14\3\20\0\0\0D\0\0\0\1\0\0\0\270\20\270\20k+\0\0\14\0\PIPE\lsass\0\0\0\1\0\0\0\0\0\0\0\4]\210\212\353\34\311\21\237\350\10\0+\20H`\2\0\0\0", ) , ) == 0x103
 03190   896   NtProtectVirtualMemory  (-1, (0x71fe000), 4096, 260, ...
 03191   792   NtContinue  (117439792, 1, ...
 03192  2016   NtFsControlFile  (540, 509, 0x0, 0x0, 0x11c017,  (540, 509, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0p\0\0\0\2\0\0\0X\0\0\0\0\0\37\0\0\0\0\0\201\262\254?gS\263F\252\227\2L\355h\280\02\0P\216W\0\31\0\0\0\0\0\0\0\30\0\0\0S\0e\0T\0a\0k\0e\0O\0w\0n\0e\0r\0s\0h\0i\0p\0P\0r\0i\0v\0i\0l\0e\0g\0e\0", 112, 1024, ... , 112, 1024, ...
 03190   896   NtProtectVirtualMemory  ... (0x71fe000), 4096, 4, ) == 0x0
 03193   792   NtRegisterThreadTerminatePort  (24, ...
 03192  2016   NtFsControlFile  ... {status=0x103, info=48},  ... {status=0x103, info=48}, "\5\0\2\3\20\0\0\00\0\0\0\1\0\0\0\30\0\0\0\0\0\0\0\0\0\0\0\201\262\254?gS\263F\252\227\2L\355h\28\0\0\0\0", ) , ) == 0x103
 03194   896   NtCreateThread  (0x1f03ff, 0x0, -1, 2292532, 2292476, 1, ...
 03193   792   NtRegisterThreadTerminatePort  ... ) == 0x0
 03195  2016   NtFsControlFile  (540, 509, 0x0, 0x0, 0x11c017,  (540, 509, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0,\0\0\0\3\0\0\0\24\0\0\0\0\0\0\0\0\0\0\0\201\262\254?gS\263F\252\227\2L\355h\28", 44, 1024, ... , 44, 1024, ...
 03194   896   NtCreateThread  ... 556, {1252, 1484}, ) == 0x0
 03196   384   NtRequestWaitReplyPort  (552, {44, 68, new_msg, 56, 0, 0, 0, 0}  (552, {44, 68, new_msg, 56, 0, 0, 0, 0} "\1\0\0\0B\2\3\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\377\377\377\377\0\0\0\0\1\0\0\0p\375W\0\322\0\0\0" ...  ...
 03195  2016   NtFsControlFile  ... {status=0x103, info=36},  ... {status=0x103, info=36}, "\5\0\2\3\20\0\0\0$\0\0\0\2\0\0\0\14\0\0\0\0\0\0\0\11\0\0\0\0\0\0\0\0\0\0\0", ) , ) == 0x103
 03197   896   NtQueryInformationThread  (556, Basic, 28, ...
 03196   384   NtRequestWaitReplyPort  ... {40, 64, reply, 0, 1252, 384, 81911, 0}  ... {40, 64, reply, 0, 1252, 384, 81911, 0} "\2\356Q\200\4\0\0\0P\306\233\201\0\340\372\177\220\353\10\370\370\37`\300l\353\10\370X\353Q\200\323\1\0\0\350\370\14\0" )  ) == 0x0
 03198   792   NtSetInformationThread  (-2, BasePriority, {thread info, class 3, size 4}, 4, ...
 03199  2016   NtClose  (536, ...
 03200   384   NtAllocateVirtualMemory  (-1, 5767168, 0, 4096, 4096, 4, ...
 03199  2016   NtClose  ... ) == 0x0
 03200   384   NtAllocateVirtualMemory  ... 5767168, 4096, ) == 0x0
 03201  2016   NtClose  (540, ...
 03202   384   NtRequestWaitReplyPort  (552, {64, 88, new_msg, 56, 5636096, 22606324, 5766504, 0}  (552, {64, 88, new_msg, 56, 5636096, 22606324, 5766504, 0} "\10\356\220|@\0\1\0\34\0\0\0p\363X\1\351\201\347w\214\370X\1\30\356\220|p\5\221|\1\0\0\0P\376W\0\323\1\0\0\323\1\0\0\350\370\14\0\0\0\0\0\0\0\0\0\273f\347w" ...  ...
 03201  2016   NtClose  ... ) == 0x0
 03197   896   NtQueryInformationThread  ... {ExitStatus=0x103,TebBaseAddress=0x7ff89000,Pid=1252,Tid=1484,}, 0x0, ) == 0x0
 03198   792   NtSetInformationThread  ... ) == 0x0
 03203  2016   NtAdjustPrivilegesToken  (504, 0, 9829916, 0, 0, 0, ...
 03204   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81908, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81908, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG,\2\0\0\344\4\0\0\314\5\0\0" ...  ...
 03202   384   NtRequestWaitReplyPort  ... {64, 88, reply, 56, 1252, 384, 81912, 0}  ... {64, 88, reply, 56, 1252, 384, 81912, 0} "\10\356\220|@\0\1\0\34\0\0\0p\363X\1\351\201\347w\214\370X\1\30\356\220|p\5\221|\1\0\0\0P\376W\0\323\1\0\0\323\1\0\0\350\370\14\0\0\0\0\0\0\0\0\0\273f\347w" )  ) == 0x0
 03203  2016   NtAdjustPrivilegesToken  ... ) == 0x0
 03204   896   NtRequestWaitReplyPort  ... {28, 56, reply, 0, 1252, 896, 81913, 0}  ... {28, 56, reply, 0, 1252, 896, 81913, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG,\2\0\0\344\4\0\0\314\5\0\0" )  ) == 0x0
 03205   384   NtRequestWaitReplyPort  (552, {44, 68, new_msg, 56, 1252, 384, 81911, 0}  (552, {44, 68, new_msg, 56, 1252, 384, 81911, 0} "\1\356\0\0B\2\3\0P\306\233\201\0\340\372\177\220\353\10\370\370\37`\300\377\377\377\377X\353Q\200\1\0\0\0p\375W\0\322\0\0\0" ...  ...
 03206   792   NtWaitForSingleObject  (316, 0, 0x0, ...
 03207   896   NtResumeThread  (556, ...
 03205   384   NtRequestWaitReplyPort  ... {40, 64, reply, 0, 1252, 384, 81914, 0}  ... {40, 64, reply, 0, 1252, 384, 81914, 0} "\2\246\200|\4\0\0\0\0\0\0\0\4\377}\0(\345\12\0\0\0\0\0\230\376}\0\2\0\0\0\351\1\0\0\350\232\14\0" )  ) == 0x0
 03208  2016   NtClose  (500, ...
 03207   896   NtResumeThread  ... 1, ) == 0x0
 03209   384   NtRequestWaitReplyPort  (552, {64, 88, new_msg, 56, 5636096, 22606324, 22607068, 0}  (552, {64, 88, new_msg, 56, 5636096, 22606324, 22607068, 0} "\10\356\220|@\0\1\0\34\0\0\0p\363X\1\351\201\347w\214\370X\1\30\356\220|p\5\221|\1\0\0\0`\12X\0\351\1\0\0\351\1\0\0\350\232\14\0\0\0\0\0\0\0\0\0\273f\347w" ...  ...
 03208  2016   NtClose  ... ) == 0x0
 03210  1484   NtAllocateVirtualMemory  (-1, 3371008, 0, 4096, 4096, 4, ...
 03211   896   NtAllocateVirtualMemory  (-1, 0, 0, 2097152, 8192, 4, ...
 03212  2016   NtClose  (504, ...
 03210  1484   NtAllocateVirtualMemory  ... 3371008, 4096, ) == 0x0
 03211   896   NtAllocateVirtualMemory  ... 119537664, 2097152, ) == 0x0
 03212  2016   NtClose  ... ) == 0x0
 03213  1484   NtTestAlert  (...
 03214   896   NtAllocateVirtualMemory  (-1, 121626624, 0, 8192, 4096, 4, ...
 03215  2016   NtOpenThreadToken  (-2, 0xc, 1, ...
 03213  1484   NtTestAlert  ... ) == 0x0
 03214   896   NtAllocateVirtualMemory  ... 121626624, 8192, ) == 0x0
 03215  2016   NtOpenThreadToken  ... ) == STATUS_NO_TOKEN
 03216  1484   NtContinue  (119536944, 1, ...
 03217   896   NtProtectVirtualMemory  (-1, (0x73fe000), 4096, 260, ...
 03209   384   NtRequestWaitReplyPort  ... {64, 88, reply, 56, 1252, 384, 81915, 0}  ... {64, 88, reply, 56, 1252, 384, 81915, 0} "\10\356\220|@\0\1\0\34\0\0\0p\363X\1\351\201\347w\214\370X\1\30\356\220|p\5\221|\1\0\0\0`\12X\0\351\1\0\0\351\1\0\0\350\232\14\0\0\0\0\0\0\0\0\0\273f\347w" )  ) == 0x0
 03218  2016   NtCreateSemaphore  (0x1f0003, {24, 28, 0x80, 5673448, 0,  (0x1f0003, {24, 28, 0x80, 5673448, 0, "shell.{210A4BA0-3AEA-1069-A2D9-08002B30309D}"}, 0, 2147483647, ... }, 0, 2147483647, ...
 03217   896   NtProtectVirtualMemory  ... (0x73fe000), 4096, 4, ) == 0x0
 03219   384   NtRequestWaitReplyPort  (552, {44, 68, new_msg, 56, 1252, 384, 81914, 0}  (552, {44, 68, new_msg, 56, 1252, 384, 81914, 0} "\1\246\0\0B\2\3\0\0\0\0\0\4\377}\0(\345\12\0\0\0\0\0\377\377\377\377\2\0\0\0\1\0\0\0p\375W\0\322\0\0\0" ...  ...
 03218  2016   NtCreateSemaphore  ... 504, ) == STATUS_OBJECT_NAME_EXISTS
 03220  1484   NtRegisterThreadTerminatePort  (24, ...
 03221  2016   NtReleaseSemaphore  (504, 1, ...
 03220  1484   NtRegisterThreadTerminatePort  ... ) == 0x0
 03219   384   NtRequestWaitReplyPort  ... {40, 64, reply, 0, 1252, 384, 81916, 0}  ... {40, 64, reply, 0, 1252, 384, 81916, 0} "\2\356Q\200\4\0\0\0\250\372\244\201\0\360\372\177\220\253S\371\370\37`\300l\253S\371X\353Q\200|\1\0\0h\236\14\0" )  ) == 0x0
 03221  2016   NtReleaseSemaphore  ... 0, ) == 0x0
 03222  1484   NtSetInformationThread  (-2, BasePriority, {thread info, class 3, size 4}, 4, ...
 03223   384   NtRequestWaitReplyPort  (552, {64, 88, new_msg, 56, 5636096, 22606324, 22607068, 0}  (552, {64, 88, new_msg, 56, 5636096, 22606324, 22607068, 0} "\10\356\220|@\0\1\0\34\0\0\0p\363X\1\351\201\347w\214\370X\1\30\356\220|p\5\221|\1\0\0\0X\14X\0|\1\0\0|\1\0\0h\236\14\0\0\0\0\0\0\0\0\0\273f\347w" ...  ...
 03224  2016   NtWaitForSingleObject  (504, 0, {0, 0}, ...
 03222  1484   NtSetInformationThread  ... ) == 0x0
 03225   896   NtCreateThread  (0x1f03ff, 0x0, -1, 2292532, 2292476, 1, ...
 03224  2016   NtWaitForSingleObject  ... ) == 0x0
 03223   384   NtRequestWaitReplyPort  ... {64, 88, reply, 56, 1252, 384, 81917, 0}  ... {64, 88, reply, 56, 1252, 384, 81917, 0} "\10\356\220|@\0\1\0\34\0\0\0p\363X\1\351\201\347w\214\370X\1\30\356\220|p\5\221|\1\0\0\0X\14X\0|\1\0\0|\1\0\0h\236\14\0\0\0\0\0\0\0\0\0\273f\347w" )  ) == 0x0
 03225   896   NtCreateThread  ... 500, {1252, 888}, ) == 0x0
 03226  2016   NtCreateKey  (0x2000000, {24, 64, 0x40, 0, 0,  (0x2000000, {24, 64, 0x40, 0, 0, "Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders"}, 0, 0x0, 0, ... }, 0, 0x0, 0, ...
 03227   384   NtClose  (548, ...
 03228   896   NtQueryInformationThread  (500, Basic, 28, ...
 03226  2016   NtCreateKey  ... 540, 2, ) == 0x0
 03227   384   NtClose  ... ) == 0x0
 03228   896   NtQueryInformationThread  ... {ExitStatus=0x103,TebBaseAddress=0x7ff88000,Pid=1252,Tid=888,}, 0x0, ) == 0x0
 03229  2016   NtQueryValueKey  (540,  (540, "Programs", Partial, 144, ... , Partial, 144, ...
 03230   384   NtClose  (552, ...
 03231   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81913, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81913, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\364\1\0\0\344\4\0\0x\3\0\0" ...  ...
 03229  2016   NtQueryValueKey  ... TitleIdx=0, Type=2, Data= ... TitleIdx=0, Type=2, Data="%\0U\0S\0E\0R\0P\0R\0O\0F\0I\0L\0E\0%\0\\0S\0t\0a\0r\0t\0 \0M\0e\0n\0u\0\\0P\0r\0o\0g\0r\0a\0m\0s\0\0\0"}, 80, ) }, 80, ) == 0x0
 03230   384   NtClose  ... ) == 0x0
 03232  2016   NtClose  (540, ...
 03233  1484   NtWaitForSingleObject  (316, 0, 0x0, ...
 03231   896   NtRequestWaitReplyPort  ... {28, 56, reply, 0, 1252, 896, 81919, 0}  ... {28, 56, reply, 0, 1252, 896, 81919, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\364\1\0\0\344\4\0\0x\3\0\0" )  ) == 0x0
 03234   384   NtCreateEvent  (0x1f0003, 0x0, 1, 0, ...
 03232  2016   NtClose  ... ) == 0x0
 03235   896   NtResumeThread  (500, ...
 03234   384   NtCreateEvent  ... 540, ) == 0x0
 03236  2016   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\Documents and Settings\Martim Carbone\Start Menu\Programs"}, 9828308, ... }, 9828308, ...
 03235   896   NtResumeThread  ... 1, ) == 0x0
 03237   384   NtOpenThreadToken  (-2, 0xc, 1, ...
 03236  2016   NtQueryAttributesFile  ... ) == 0x0
 03238   896   NtAllocateVirtualMemory  (-1, 0, 0, 2097152, 8192, 4, ...
 03237   384   NtOpenThreadToken  ... ) == STATUS_NO_TOKEN
 03239  2016   NtCreateKey  (0x2000000, {24, 64, 0x40, 0, 0,  (0x2000000, {24, 64, 0x40, 0, 0, "Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders"}, 0, 0x0, 0, ... }, 0, 0x0, 0, ...
 03238   896   NtAllocateVirtualMemory  ... 121634816, 2097152, ) == 0x0
 03240   384   NtCreateEvent  (0x1f0003, 0x0, 1, 0, ...
 03239  2016   NtCreateKey  ... 552, 2, ) == 0x0
 03241   896   NtAllocateVirtualMemory  (-1, 123723776, 0, 8192, 4096, 4, ...
 03240   384   NtCreateEvent  ... 548, ) == 0x0
 03242  2016   NtSetValueKey  (552,  (552, "Programs", 0, 1, "C\0:\0\\0D\0o\0c\0u\0m\0e\0n\0t\0s\0 \0a\0n\0d\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0M\0a\0r\0t\0i\0m\0 \0C\0a\0r\0b\0o\0n\0e\0\\0S\0t\0a\0r\0t\0 \0M\0e\0n\0u\0\\0P\0r\0o\0g\0r\0a\0m\0s\0\0\0", 122, ... , 0, 1,  (552, "Programs", 0, 1, "C\0:\0\\0D\0o\0c\0u\0m\0e\0n\0t\0s\0 \0a\0n\0d\0 \0S\0e\0t\0t\0i\0n\0g\0s\0\\0M\0a\0r\0t\0i\0m\0 \0C\0a\0r\0b\0o\0n\0e\0\\0S\0t\0a\0r\0t\0 \0M\0e\0n\0u\0\\0P\0r\0o\0g\0r\0a\0m\0s\0\0\0", 122, ... , 122, ...
 03243   888   NtTestAlert  (...
 03241   896   NtAllocateVirtualMemory  ... 123723776, 8192, ) == 0x0
 03244   384   NtOpenThreadToken  (-2, 0xc, 1, ...
 03243   888   NtTestAlert  ... ) == 0x0
 03245   896   NtProtectVirtualMemory  (-1, (0x75fe000), 4096, 260, ...
 03244   384   NtOpenThreadToken  ... ) == STATUS_NO_TOKEN
 03246   888   NtContinue  (121634096, 1, ...
 03245   896   NtProtectVirtualMemory  ... (0x75fe000), 4096, 4, ) == 0x0
 03247   384   NtSetInformationThread  (-2, ImpersonationToken, {ImpToken=0,}, 4, ...
 03248   888   NtRegisterThreadTerminatePort  (24, ...
 03249   896   NtCreateThread  (0x1f03ff, 0x0, -1, 2292532, 2292476, 1, ...
 03247   384   NtSetInformationThread  ... ) == 0x0
 03248   888   NtRegisterThreadTerminatePort  ... ) == 0x0
 03249   896   NtCreateThread  ... 536, {1252, 1120}, ) == 0x0
 03250   384   NtCreateFile  (0xc0100080, {24, 0, 0x40, 0, 22606016,  (0xc0100080, {24, 0, 0x40, 0, 22606016, "\??\PIPE\lsarpc"}, 0x0, 0, 3, 1, 64, 0, 0, ... }, 0x0, 0, 3, 1, 64, 0, 0, ...
 03242  2016   NtSetValueKey  ... ) == 0x0
 03251   896   NtQueryInformationThread  (536, Basic, 28, ...
 03250   384   NtCreateFile  ... 560, {status=0x0, info=1}, ) == 0x0
 03252  2016   NtClose  (552, ...
 03253   888   NtSetInformationThread  (-2, BasePriority, {thread info, class 3, size 4}, 4, ...
 03251   896   NtQueryInformationThread  ... {ExitStatus=0x103,TebBaseAddress=0x7ff87000,Pid=1252,Tid=1120,}, 0x0, ) == 0x0
 03252  2016   NtClose  ... ) == 0x0
 03254   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81919, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81919, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\30\2\0\0\344\4\0\0`\4\0\0" ...  ...
 03255  2016   NtOpenFile  (0x100001, {24, 0, 0x40, 0, 0,  (0x100001, {24, 0, 0x40, 0, 0, "\??\C:\Documents and Settings\Martim Carbone\Start Menu\Programs\"}, 3, 16417, ... }, 3, 16417, ...
 03254   896   NtRequestWaitReplyPort  ... {28, 56, reply, 0, 1252, 896, 81920, 0}  ... {28, 56, reply, 0, 1252, 896, 81920, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\30\2\0\0\344\4\0\0`\4\0\0" )  ) == 0x0
 03255  2016   NtOpenFile  ... 552, {status=0x0, info=1}, ) == 0x0
 03256   896   NtResumeThread  (536, ...
 03257  2016   NtQueryDirectoryFile  (552, 0, 0, 0, 9827744, 616, BothDirectory, 1,  (552, 0, 0, 0, 9827744, 616, BothDirectory, 1, "*", 0, ... , 0, ...
 03256   896   NtResumeThread  ... 1, ) == 0x0
 03258   384   NtSetInformationFile  (560, 22606072, 8, Pipe, ...
 03253   888   NtSetInformationThread  ... ) == 0x0
 03257  2016   NtQueryDirectoryFile  ... {status=0x0, info=96}, ) == 0x0
 03259  1120   NtTestAlert  (...
 03258   384   NtSetInformationFile  ... {status=0x0, info=0}, ) == 0x0
 03260   896   NtAllocateVirtualMemory  (-1, 0, 0, 2097152, 8192, 4, ...
 03261  2016   NtQueryDirectoryFile  (552, 0, 0, 0, 5739736, 4096, BothDirectory, 0, 0x0, 0, ...
 03259  1120   NtTestAlert  ... ) == 0x0
 03262   384   NtSetInformationFile  (560, 22606060, 8, Completion, ...
 03260   896   NtAllocateVirtualMemory  ... 123731968, 2097152, ) == 0x0
 03261  2016   NtQueryDirectoryFile  ... {status=0x0, info=1262}, ) == 0x0
 03263  1120   NtContinue  (123731248, 1, ...
 03262   384   NtSetInformationFile  ... {status=0x0, info=0}, ) == 0x0
 03264   896   NtAllocateVirtualMemory  (-1, 125820928, 0, 8192, 4096, 4, ...
 03265  2016   NtOpenFile  (0x100001, {24, 0, 0x40, 0, 0,  (0x100001, {24, 0, 0x40, 0, 0, "\??\C:\Documents and Settings\Martim Carbone\Start Menu\Programs\Accessories\"}, 3, 16417, ... }, 3, 16417, ...
 03266  1120   NtRegisterThreadTerminatePort  (24, ...
 03267   384   NtSetInformationThread  (-2, ImpersonationToken, {ImpToken=0,}, 4, ...
 03264   896   NtAllocateVirtualMemory  ... 125820928, 8192, ) == 0x0
 03265  2016   NtOpenFile  ... 564, {status=0x0, info=1}, ) == 0x0
 03266  1120   NtRegisterThreadTerminatePort  ... ) == 0x0
 03267   384   NtSetInformationThread  ... ) == 0x0
 03268   896   NtProtectVirtualMemory  (-1, (0x77fe000), 4096, 260, ...
 03269  2016   NtQueryDirectoryFile  (564, 0, 0, 0, 9827088, 616, BothDirectory, 1,  (564, 0, 0, 0, 9827088, 616, BothDirectory, 1, "*", 0, ... , 0, ...
 03270   888   NtWaitForSingleObject  (316, 0, 0x0, ...
 03271  1120   NtSetInformationThread  (-2, BasePriority, {thread info, class 3, size 4}, 4, ...
 03268   896   NtProtectVirtualMemory  ... (0x77fe000), 4096, 4, ) == 0x0
 03272   384   NtWriteFile  (560, 373, 0, 0,  (560, 373, 0, 0, "\5\0\13\3\20\0\0\0H\0\0\0\1\0\0\0\270\20\270\20\0\0\0\0\1\0\0\0\0\0\1\0xW4\224\22\315\253\357\0\1#Eg\211\253\0\0\0\0\4]\210\212\353\34\311\21\237\350\10\0+\20H`\2\0\0\0", 72, {0, 0}, 0, ... , 72, {0, 0}, 0, ...
 03269  2016   NtQueryDirectoryFile  ... {status=0x0, info=96}, ) == 0x0
 03271  1120   NtSetInformationThread  ... ) == 0x0
 03272   384   NtWriteFile  ... {status=0x0, info=72}, ) == 0x0
 03273  2016   NtAllocateVirtualMemory  (-1, 5771264, 0, 8192, 4096, 4, ...
 03274   896   NtCreateThread  (0x1f03ff, 0x0, -1, 2292532, 2292476, 1, ...
 03275   384   NtCreateEvent  (0x100003, 0x0, 1, 0, ...
 03273  2016   NtAllocateVirtualMemory  ... 5771264, 8192, ) == 0x0
 03274   896   NtCreateThread  ... 568, {1252, 840}, ) == 0x0
 03275   384   NtCreateEvent  ... 572, ) == 0x0
 03276  2016   NtCreateEvent  (0x100003, 0x0, 1, 0, ...
 03277   896   NtQueryInformationThread  (568, Basic, 28, ...
 03278   384   NtWaitForSingleObject  (572, 0, 0x0, ...
 03276  2016   NtCreateEvent  ... 576, ) == 0x0
 03277   896   NtQueryInformationThread  ... {ExitStatus=0x103,TebBaseAddress=0x7ff86000,Pid=1252,Tid=840,}, 0x0, ) == 0x0
 03279  2016   NtClose  (576, ...
 03280   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81920, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81920, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG8\2\0\0\344\4\0\0H\3\0\0" ...  ...
 03281  1120   NtWaitForSingleObject  (316, 0, 0x0, ...
 03280   896   NtRequestWaitReplyPort  ... {28, 56, reply, 0, 1252, 896, 81921, 0}  ... {28, 56, reply, 0, 1252, 896, 81921, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG8\2\0\0\344\4\0\0H\3\0\0" )  ) == 0x0
 03279  2016   NtClose  ... ) == 0x0
 03282   896   NtResumeThread  (568, ...
 03283  2016   NtSetEventBoostPriority  (572, ...
 03282   896   NtResumeThread  ... 1, ) == 0x0
 03278   384   NtWaitForSingleObject  ... ) == 0x0
 03283  2016   NtSetEventBoostPriority  ... ) == 0x0
 03284   384   NtReadFile  (560, 373, 0, 0, 1024, {0, 0}, 0, ...
 03285   896   NtAllocateVirtualMemory  (-1, 0, 0, 2097152, 8192, 4, ...
 03284   384   NtReadFile  ... {status=0x0, info=68},  ... {status=0x0, info=68}, "\5\0\14\3\20\0\0\0D\0\0\0\1\0\0\0\270\20\270\20l+\0\0\14\0\PIPE\lsass\0\0\0\1\0\0\0\0\0\0\0\4]\210\212\353\34\311\21\237\350\10\0+\20H`\2\0\0\0", ) , ) == 0x0
 03286  2016   NtQueryDirectoryFile  (564, 0, 0, 0, 5771152, 4096, BothDirectory, 0, 0x0, 0, ...
 03285   896   NtAllocateVirtualMemory  ... 125829120, 2097152, ) == 0x0
 03287   840   NtTestAlert  (...
 03286  2016   NtQueryDirectoryFile  ... {status=0x0, info=1526}, ) == 0x0
 03288   896   NtAllocateVirtualMemory  (-1, 127918080, 0, 8192, 4096, 4, ...
 03287   840   NtTestAlert  ... ) == 0x0
 03289  2016   NtOpenFile  (0x100001, {24, 0, 0x40, 0, 0,  (0x100001, {24, 0, 0x40, 0, 0, "\??\C:\Documents and Settings\Martim Carbone\Start Menu\Programs\Accessories\Accessibility\"}, 3, 16417, ... }, 3, 16417, ...
 03290   384   NtFsControlFile  (560, 373, 0x0, 0x0, 0x11c017,  (560, 373, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0@\0\0\0\1\0\0\0(\0\0\0\0\0,\0\0\0\0\0\30\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\210\367X\1\14\0\0\0\2\0\1\0\0\10\0\0", 64, 1024, ... , 64, 1024, ...
 03291   840   NtContinue  (125828400, 1, ...
 03288   896   NtAllocateVirtualMemory  ... 127918080, 8192, ) == 0x0
 03290   384   NtFsControlFile  ... {status=0x103, info=68},  ... {status=0x103, info=68}, "\5\0\14\3\20\0\0\0D\0\0\0\1\0\0\0\270\20\270\20l+\0\0\14\0\PIPE\lsass\0\0\0\1\0\0\0\0\0\0\0\4]\210\212\353\34\311\21\237\350\10\0+\20H`\2\0\0\0", ) , ) == 0x103
 03292   840   NtRegisterThreadTerminatePort  (24, ...
 03293   896   NtProtectVirtualMemory  (-1, (0x79fe000), 4096, 260, ...
 03294   384   NtFsControlFile  (560, 373, 0x0, 0x0, 0x11c017,  (560, 373, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0\210\0\0\0\2\0\0\0p\0\0\0\0\0D\0\0\0\0\0IZ\274\35\11\214T@\262\364>G\345\302\315A\1\0\0\0\1\0\0\0&\0(\08\205W\0\24\0\0\0\0\0\0\0\23\0\0\0n\0t\0 \0a\0u\0t\0h\0o\0r\0i\0t\0y\0\\0s\0y\0s\0t\0e\0m\0\0\0\0\0\0\0\0\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0", 136, 1024, ... , 136, 1024, ...
 03292   840   NtRegisterThreadTerminatePort  ... ) == 0x0
 03293   896   NtProtectVirtualMemory  ... (0x79fe000), 4096, 4, ) == 0x0
 03294   384   NtFsControlFile  ... {status=0x103, info=48},  ... {status=0x103, info=48}, "\5\0\2\3\20\0\0\00\0\0\0\1\0\0\0\30\0\0\0\0\0\0\0\0\0\0\0IZ\274\35\11\214T@\262\364>G\345\302\315A\0\0\0\0", ) , ) == 0x103
 03289  2016   NtOpenFile  ... 576, {status=0x0, info=1}, ) == 0x0
 03295   896   NtCreateThread  (0x1f03ff, 0x0, -1, 2292532, 2292476, 1, ...
 03296   384   NtFsControlFile  (560, 373, 0x0, 0x0, 0x11c017,  (560, 373, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0,\0\0\0\3\0\0\0\24\0\0\0\0\0\0\0\0\0\0\0IZ\274\35\11\214T@\262\364>G\345\302\315A", 44, 1024, ... , 44, 1024, ...
 03297  2016   NtQueryDirectoryFile  (576, 0, 0, 0, 9826432, 616, BothDirectory, 1,  (576, 0, 0, 0, 9826432, 616, BothDirectory, 1, "*", 0, ... , 0, ...
 03295   896   NtCreateThread  ... 580, {1252, 876}, ) == 0x0
 03296   384   NtFsControlFile  ... {status=0x103, info=156},  ... {status=0x103, info=156}, "\5\0\2\3\20\0\0\0\234\0\0\0\2\0\0\0\204\0\0\0\0\0\0\0\360\1X\0\1\0\0\0\374\1X\0 \0\0\0\1\0\0\0\30\0\32\0\10\2X\0$\2X\0\15\0\0\0\0\0\0\0\14\0\0\0N\0T\0 \0A\0U\0T\0H\0O\0R\0I\0T\0Y\0\0\0\0\0\1\0\0\0\0\0\0\5\1\0\0\0\340\10X\0\1\0\0\0\5\0i\0\360\10X\0\0\0\0\0\0\0\0\0\1\0\0\0\1\1\0\0\0\0\0\5\22\0\0\0\1\0\0\0\0\0\0\0", ) , ) == 0x103
 03298   896   NtQueryInformationThread  (580, Basic, 28, ...
 03299   840   NtSetInformationThread  (-2, BasePriority, {thread info, class 3, size 4}, 4, ...
 03300   384   NtClose  (548, ...
 03297  2016   NtQueryDirectoryFile  ... {status=0x0, info=96}, ) == 0x0
 03300   384   NtClose  ... ) == 0x0
 03301  2016   NtQueryDirectoryFile  (576, 0, 0, 0, 5775256, 4096, BothDirectory, 0, 0x0, 0, ...
 03302   384   NtClose  (560, ...
 03301  2016   NtQueryDirectoryFile  ... {status=0x0, info=740}, ) == 0x0
 03302   384   NtClose  ... ) == 0x0
 03303  2016   NtOpenFile  (0x100001, {24, 0, 0x40, 0, 0,  (0x100001, {24, 0, 0x40, 0, 0, "\??\C:\Documents and Settings\Martim Carbone\Start Menu\Programs\Accessories\Accessibility\desktop.ini\"}, 3, 16417, ... }, 3, 16417, ...
 03304   384   NtSecureConnectPort  ( ("\RPC Control\unimdmsvc", {12, 2, 1, 1}, 0x0, 5738064, 0x0, 22607940, 188, ... , {12, 2, 1, 1}, 0x0, 5738064, 0x0, 22607940, 188, ...
 03298   896   NtQueryInformationThread  ... {ExitStatus=0x103,TebBaseAddress=0x7ff85000,Pid=1252,Tid=876,}, 0x0, ) == 0x0
 03299   840   NtSetInformationThread  ... ) == 0x0
 03305   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81921, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81921, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFGD\2\0\0\344\4\0\0l\3\0\0" ...  ...
 03303  2016   NtOpenFile  ... ) == STATUS_NOT_A_DIRECTORY
 03304   384   NtSecureConnectPort  ... 560, 0x0, 0x0, 0x0, 188, ) == 0x0
 03305   896   NtRequestWaitReplyPort  ... {28, 56, reply, 0, 1252, 896, 81923, 0}  ... {28, 56, reply, 0, 1252, 896, 81923, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFGD\2\0\0\344\4\0\0l\3\0\0" )  ) == 0x0
 03306  2016   NtAllocateVirtualMemory  (-1, 9809920, 0, 4096, 4096, 260, ...
 03307   384   NtOpenThreadToken  (-2, 0xc, 1, ...
 03308   896   NtResumeThread  (580, ...
 03306  2016   NtAllocateVirtualMemory  ... 9809920, 4096, ) == 0x0
 03307   384   NtOpenThreadToken  ... ) == STATUS_NO_TOKEN
 03308   896   NtResumeThread  ... 1, ) == 0x0
 03309  2016   NtAllocateVirtualMemory  (-1, 9805824, 0, 4096, 4096, 260, ...
 03310   384   NtSetInformationThread  (-2, ImpersonationToken, {ImpToken=0,}, 4, ...
 03311   840   NtWaitForSingleObject  (316, 0, 0x0, ...
 03312   876   NtTestAlert  (...
 03309  2016   NtAllocateVirtualMemory  ... 9805824, 4096, ) == 0x0
 03310   384   NtSetInformationThread  ... ) == 0x0
 03313   896   NtAllocateVirtualMemory  (-1, 0, 0, 2097152, 8192, 4, ...
 03312   876   NtTestAlert  ... ) == 0x0
 03314  2016   NtAllocateVirtualMemory  (-1, 9801728, 0, 4096, 4096, 260, ...
 03315   384   NtRequestWaitReplyPort  (560, {200, 224, new_msg, 0, 5730400, 12, 2, 5636353}  (560, {200, 224, new_msg, 0, 5730400, 12, 2, 5636353} "\0\0\0\0\274\0\0\0\0\0\0\03\242t\326)X\335I\220\360`\317\234\353q)\1\0\0\0\1\0\0\0\230`\347w\26\0\0\0\3\0\0\0\10\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\377\377\3\0\0\0\235\366\235\251}C\210\376-\272\321\1\24o\327\365\12\0\0\0\214v'\272\224\223C\232\0\0\0\0 \364W\0B\207\233A\326pUv(\0\0\0U\201\0f\0\0V\0\240\366X\1\312mI\344\0\0\0\0\310\365W\0\360\6\221|\377\377\377\377P\0\0\0\346\31\0|\0\0V\0\304\366X\1\372\31\221|X\376X\1\30\356\220|\360\6\221|\0\0\0\0\0\0\0\0\0\0\0\0\6\0\0\0" ...  ...
 03313   896   NtAllocateVirtualMemory  ... 127926272, 2097152, ) == 0x0
 03316   876   NtContinue  (127925552, 1, ...
 03314  2016   NtAllocateVirtualMemory  ... 9801728, 4096, ) == 0x0
 03317   896   NtAllocateVirtualMemory  (-1, 130015232, 0, 8192, 4096, 4, ...
 03318   876   NtRegisterThreadTerminatePort  (24, ...
 03319  2016   NtAllocateVirtualMemory  (-1, 9797632, 0, 4096, 4096, 260, ...
 03317   896   NtAllocateVirtualMemory  ... 130015232, 8192, ) == 0x0
 03318   876   NtRegisterThreadTerminatePort  ... ) == 0x0
 03319  2016   NtAllocateVirtualMemory  ... 9797632, 4096, ) == 0x0
 03320   896   NtProtectVirtualMemory  (-1, (0x7bfe000), 4096, 260, ...
 03315   384   NtRequestWaitReplyPort  ... {200, 224, reply, 0, 1252, 384, 81924, 0}  ... {200, 224, reply, 0, 1252, 384, 81924, 0} "\7\0\0\0\274\0\0\0\0\0\0\03\242t\326)X\335I\220\360`\317\234\353q)\1\0\0\0\1\0\0\0\0\0\0\0\26\0\0\0\3\0\0\0\0\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\377\377\3\0\0\0\235\366\235\251}C\210\376-\272\321\1\24o\327\365\12\0\0\0\214v'\272\224\223C\232\0\0\0\0 \364W\0B\207\233A\326pUv(\0\0\0U\201\0f\0\0V\0\240\366X\1\312mI\344\0\0\0\0\310\365W\0\360\6\221|\377\377\377\377P\0\0\0\346\31\0|\0\0V\0\304\366X\1\372\31\221|X\376X\1\30\356\220|\360\6\221|\0\0\0\0\0\0\0\0\0\0\0\0\6\0\0\0" )  ) == 0x0
 03321  2016   NtAllocateVirtualMemory  (-1, 9793536, 0, 4096, 4096, 260, ...
 03320   896   NtProtectVirtualMemory  ... (0x7bfe000), 4096, 4, ) == 0x0
 03322   384   NtSetInformationThread  (-2, ImpersonationToken, {ImpToken=0,}, 4, ...
 03321  2016   NtAllocateVirtualMemory  ... 9793536, 4096, ) == 0x0
 03323   876   NtSetInformationThread  (-2, BasePriority, {thread info, class 3, size 4}, 4, ...
 03322   384   NtSetInformationThread  ... ) == 0x0
 03324  2016   NtAllocateVirtualMemory  (-1, 9789440, 0, 4096, 4096, 260, ...
 03325   384   NtRequestWaitReplyPort  (560, {56, 80, new_msg, 0, 44, 3, 20, 0}  (560, {56, 80, new_msg, 0, 44, 3, 20, 0} "\1\0\0\0A\2\2\0\11\214T@\262\364>G\345\302\315A\1\0\0\0\0\0\0\0&\0(\0\304\1\0\0\0\0\0\0\0\0\0\0\23\0\0\0n\0t\0 \0a\0" ...  ...
 03326   896   NtCreateThread  (0x1f03ff, 0x0, -1, 2292532, 2292476, 1, ...
 03323   876   NtSetInformationThread  ... ) == 0x0
 03326   896   NtCreateThread  ... 548, {1252, 1104}, ) == 0x0
 03324  2016   NtAllocateVirtualMemory  ... 9789440, 4096, ) == 0x0
 03327   896   NtQueryInformationThread  (548, Basic, 28, ...
 03328  2016   NtAllocateVirtualMemory  (-1, 9785344, 0, 4096, 4096, 260, ...
 03327   896   NtQueryInformationThread  ... {ExitStatus=0x103,TebBaseAddress=0x7ff84000,Pid=1252,Tid=1104,}, 0x0, ) == 0x0
 03328  2016   NtAllocateVirtualMemory  ... 9785344, 4096, ) == 0x0
 03329   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81923, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81923, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG$\2\0\0\344\4\0\0P\4\0\0" ...  ...
 03330  2016   NtAllocateVirtualMemory  (-1, 9781248, 0, 4096, 4096, 260, ... 9781248, 4096, ) == 0x0
 03331  2016   NtAllocateVirtualMemory  (-1, 9777152, 0, 4096, 4096, 260, ... 9777152, 4096, ) == 0x0
 03332  2016   NtAllocateVirtualMemory  (-1, 9773056, 0, 4096, 4096, 260, ... 9773056, 4096, ) == 0x0
 03333  2016   NtAllocateVirtualMemory  (-1, 9768960, 0, 4096, 4096, 260, ... 9768960, 4096, ) == 0x0
 03334  2016   NtAllocateVirtualMemory  (-1, 9764864, 0, 4096, 4096, 260, ...
 03335   876   NtWaitForSingleObject  (316, 0, 0x0, ...
 03329   896   NtRequestWaitReplyPort  ... {28, 56, reply, 0, 1252, 896, 81926, 0}  ... {28, 56, reply, 0, 1252, 896, 81926, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG$\2\0\0\344\4\0\0P\4\0\0" )  ) == 0x0
 03334  2016   NtAllocateVirtualMemory  ... 9764864, 4096, ) == 0x0
 03336   896   NtResumeThread  (548, ...
 03337  2016   NtAllocateVirtualMemory  (-1, 9760768, 0, 4096, 4096, 260, ...
 03336   896   NtResumeThread  ... 1, ) == 0x0
 03337  2016   NtAllocateVirtualMemory  ... 9760768, 4096, ) == 0x0
 03338   896   NtAllocateVirtualMemory  (-1, 0, 0, 2097152, 8192, 4, ...
 03339  2016   NtAllocateVirtualMemory  (-1, 9756672, 0, 4096, 4096, 260, ...
 03338   896   NtAllocateVirtualMemory  ... 130023424, 2097152, ) == 0x0
 03339  2016   NtAllocateVirtualMemory  ... 9756672, 4096, ) == 0x0
 03340   896   NtAllocateVirtualMemory  (-1, 132112384, 0, 8192, 4096, 4, ...
 03341  2016   NtAllocateVirtualMemory  (-1, 9752576, 0, 4096, 4096, 260, ...
 03342  1104   NtTestAlert  (...
 03340   896   NtAllocateVirtualMemory  ... 132112384, 8192, ) == 0x0
 03325   384   NtRequestWaitReplyPort  ... {44, 68, reply, 0, 1252, 384, 81925, 0}  ... {44, 68, reply, 0, 1252, 384, 81925, 0} "\4\376\255\201\0\0\0\0\200Y\274\201\356\12$\342\264\311\275\201:\332R\200X\253v\367\324\376\255\201\2\0\0\0\0\0\0\0\0\0\0\0" )  ) == 0x0
 03342  1104   NtTestAlert  ... ) == 0x0
 03343   896   NtProtectVirtualMemory  (-1, (0x7dfe000), 4096, 260, ...
 03344   384   NtRaiseException  (22608400, 22607660, 1, ...
 03345  1104   NtContinue  (130022704, 1, ...
 03343   896   NtProtectVirtualMemory  ... (0x7dfe000), 4096, 4, ) == 0x0
 03346   384   NtQueryVirtualMemory  (-1, 0x77e7a298, Basic, 28, ...
 03347  1104   NtRegisterThreadTerminatePort  (24, ...
 03348   896   NtCreateThread  (0x1f03ff, 0x0, -1, 2292532, 2292476, 1, ...
 03346   384   NtQueryVirtualMemory  ... {BaseAddress=0x77e7a000,AllocationBase=0x77e70000,AllocationProtect=0x80,RegionSize=0x80000,State=0x1000,Protect=0x20,Type=0x1000000,}, 28, ) == 0x0
 03347  1104   NtRegisterThreadTerminatePort  ... ) == 0x0
 03349   384   NtContinue  (22606628, 0, ...
 03341  2016   NtAllocateVirtualMemory  ... 9752576, 4096, ) == 0x0
 03348   896   NtCreateThread  ... 584, {1252, 860}, ) == 0x0
 03350   384   NtDeviceIoControlFile  (452, 292, 0x0, 0x0, 0x1200c, 0x0, 0, 26, ...
 03351  2016   NtAllocateVirtualMemory  (-1, 9748480, 0, 4096, 4096, 260, ...
 03352   896   NtQueryInformationThread  (584, Basic, 28, ...
 03353  1104   NtSetInformationThread  (-2, BasePriority, {thread info, class 3, size 4}, 4, ...
 03351  2016   NtAllocateVirtualMemory  ... 9748480, 4096, ) == 0x0
 03352   896   NtQueryInformationThread  ... {ExitStatus=0x103,TebBaseAddress=0x7ff83000,Pid=1252,Tid=860,}, 0x0, ) == 0x0
 03354  2016   NtAllocateVirtualMemory  (-1, 9744384, 0, 4096, 4096, 260, ...
 03355   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81926, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81926, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFGH\2\0\0\344\4\0\0\\3\0\0" ...  ...
 03354  2016   NtAllocateVirtualMemory  ... 9744384, 4096, ) == 0x0
 03355   896   NtRequestWaitReplyPort  ... {28, 56, reply, 0, 1252, 896, 81927, 0}  ... {28, 56, reply, 0, 1252, 896, 81927, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFGH\2\0\0\344\4\0\0\\3\0\0" )  ) == 0x0
 03356  2016   NtCreateFile  (0x80100081, {24, 0, 0x40, 0, 9752924,  (0x80100081, {24, 0, 0x40, 0, 9752924, "\??\C:\Documents and Settings\Martim Carbone\Start Menu\Programs\Accessories\Accessibility\Magnifier.lnk"}, 0x0, 0, 0, 1, 96, 0, 0, ... }, 0x0, 0, 0, 1, 96, 0, 0, ...
 03350   384   NtDeviceIoControlFile  ... {status=0x0, info=0}, "", ) == 0x103
 03353  1104   NtSetInformationThread  ... ) == 0x0
 03357   896   NtResumeThread  (584, ...
 03358   384   NtWaitForSingleObject  (292, 1, {-5000000, -1}, ...
 03356  2016   NtCreateFile  ... 588, {status=0x0, info=1}, ) == 0x0
 03357   896   NtResumeThread  ... 1, ) == 0x0
 03359  2016   NtReadFile  (588, 0, 0, 0, 8191, 0x0, 0, ...
 03360   896   NtAllocateVirtualMemory  (-1, 0, 0, 2097152, 8192, 4, ... 132120576, 2097152, ) == 0x0
 03361   896   NtAllocateVirtualMemory  (-1, 134209536, 0, 8192, 4096, 4, ... 134209536, 8192, ) == 0x0
 03362   896   NtProtectVirtualMemory  (-1, (0x7ffe000), 4096, 260, ... (0x7ffe000), 4096, 4, ) == 0x0
 03363   896   NtCreateThread  (0x1f03ff, 0x0, -1, 2292532, 2292476, 1, ...
 03359  2016   NtReadFile  ... {status=0x0, info=1525},  ... {status=0x0, info=1525}, "L\0\0\0\1\24\2\0\0\0\0\0\300\0\0\0\0\0\0F\237\2\0\0 \0\0\0\0\340`\221\32z\304\1^u\245f}M\307\1\0\340`\221\32z\304\1\0\34\1\0\0\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\363\0\24\0\37P\340O\320 \352:i\20\242\330\10\0+00\235\31\0/C:\\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0<\01\0\0\0\0\0K6s6\20\0WINDOWS\0&\0\3\0\4\0\357\276K6\25\14K6s6\24\0\0\0W\0I\0N\0D\0O\0W\0S\0\0\0\26\0@\01\0\0\0\0\0K6s6\20\0system32\0\0(\0\3\0\4\0\357\276K6\25\14K6s6\24\0\0\0s\0y\0s\0t\0e\0m\03\02\0\0\0\30\0H\02\0\0\34\1\0\41\0` \0magnify.exe\0.\0\3\0\4\0\357\276\41\0`K6\340\14\24\0\0\0m\0a\0g\0n\0i\0f\0y\0.\0e\0x\0e\0\0\0\32\0\0\0N\0\0\0\34\0\0\0\1\0\0\0\34\0\0\0-\0\0\0\0\0\0\0M\0\0\0\21\0\0\0\3\0\0\0\204\353\202\244\20\0\0\0\0C:\WINDOWS\system32\magnify.exe\0\0)\0@\0%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0s\0y\0s\0t\0e\0m\03\02\0\\0s\0h\0e\0l\0l\03\02\0.\0d\0l\0l\0,\0-\02\02\05\05\03\0.\0.\0.\0\\0.\0.\0\\0.\0.", ) , ) == 0x0
 03364  2016   NtClose  (588, ... ) == 0x0
 03365  2016   NtDelayExecution  (0, {-10000, -1}, ...
 03363   896   NtCreateThread  ... 588, {1252, 1516}, ) == 0x0
 03366   896   NtQueryInformationThread  (588, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ff82000,Pid=1252,Tid=1516,}, 0x0, ) == 0x0
 03367  1104   NtWaitForSingleObject  (316, 0, 0x0, ...
 03368   860   NtTestAlert  (...
 03369   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81927, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81927, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFGL\2\0\0\344\4\0\0\354\5\0\0" ...  ...
 03368   860   NtTestAlert  ... ) == 0x0
 03369   896   NtRequestWaitReplyPort  ... {28, 56, reply, 0, 1252, 896, 81928, 0}  ... {28, 56, reply, 0, 1252, 896, 81928, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFGL\2\0\0\344\4\0\0\354\5\0\0" )  ) == 0x0
 03370   860   NtContinue  (132119856, 1, ...
 03371   896   NtResumeThread  (588, ...
 03372   860   NtRegisterThreadTerminatePort  (24, ...
 03371   896   NtResumeThread  ... 1, ) == 0x0
 03372   860   NtRegisterThreadTerminatePort  ... ) == 0x0
 03373   896   NtAllocateVirtualMemory  (-1, 0, 0, 2097152, 8192, 4, ...
 03374  1516   NtTestAlert  (...
 03375   860   NtSetInformationThread  (-2, BasePriority, {thread info, class 3, size 4}, 4, ...
 03374  1516   NtTestAlert  ... ) == 0x0
 03376  1516   NtContinue  (134217008, 1, ...
 03377  1516   NtRegisterThreadTerminatePort  (24, ... ) == 0x0
 03378  1516   NtSetInformationThread  (-2, BasePriority, {thread info, class 3, size 4}, 4, ...
 03373   896   NtAllocateVirtualMemory  ... 134217728, 2097152, ) == 0x0
 03379   896   NtAllocateVirtualMemory  (-1, 136306688, 0, 8192, 4096, 4, ... 136306688, 8192, ) == 0x0
 03380   896   NtProtectVirtualMemory  (-1, (0x81fe000), 4096, 260, ... (0x81fe000), 4096, 4, ) == 0x0
 03381   896   NtCreateThread  (0x1f03ff, 0x0, -1, 2292532, 2292476, 1, ...
 03375   860   NtSetInformationThread  ... ) == 0x0
 03381   896   NtCreateThread  ... 592, {1252, 780}, ) == 0x0
 03382   896   NtQueryInformationThread  (592, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ff81000,Pid=1252,Tid=780,}, 0x0, ) == 0x0
 03383   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81928, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81928, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFGP\2\0\0\344\4\0\0\14\3\0\0" ... {28, 56, reply, 0, 1252, 896, 81929, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFGP\2\0\0\344\4\0\0\14\3\0\0" )  ... {28, 56, reply, 0, 1252, 896, 81929, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81928, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFGP\2\0\0\344\4\0\0\14\3\0\0" ... {28, 56, reply, 0, 1252, 896, 81929, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFGP\2\0\0\344\4\0\0\14\3\0\0" )  ) == 0x0
 03384   896   NtResumeThread  (592, ... 1, ) == 0x0
 03385   896   NtAllocateVirtualMemory  (-1, 0, 0, 2097152, 8192, 4, ... 136314880, 2097152, ) == 0x0
 03386   896   NtAllocateVirtualMemory  (-1, 138403840, 0, 8192, 4096, 4, ... 138403840, 8192, ) == 0x0
 03387   860   NtWaitForSingleObject  (316, 0, 0x0, ...
 03388   780   NtTestAlert  (...
 03389   896   NtProtectVirtualMemory  (-1, (0x83fe000), 4096, 260, ...
 03388   780   NtTestAlert  ... ) == 0x0
 03389   896   NtProtectVirtualMemory  ... (0x83fe000), 4096, 4, ) == 0x0
 03390   780   NtContinue  (136314160, 1, ...
 03391   896   NtCreateThread  (0x1f03ff, 0x0, -1, 2292532, 2292476, 1, ...
 03392   780   NtRegisterThreadTerminatePort  (24, ...
 03391   896   NtCreateThread  ... 596, {1252, 940}, ) == 0x0
 03392   780   NtRegisterThreadTerminatePort  ... ) == 0x0
 03393   896   NtQueryInformationThread  (596, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ff80000,Pid=1252,Tid=940,}, 0x0, ) == 0x0
 03394   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81929, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81929, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFGT\2\0\0\344\4\0\0\254\3\0\0" ... {28, 56, reply, 0, 1252, 896, 81930, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFGT\2\0\0\344\4\0\0\254\3\0\0" )  ... {28, 56, reply, 0, 1252, 896, 81930, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81929, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFGT\2\0\0\344\4\0\0\254\3\0\0" ... {28, 56, reply, 0, 1252, 896, 81930, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFGT\2\0\0\344\4\0\0\254\3\0\0" )  ) == 0x0
 03395   896   NtResumeThread  (596, ... 1, ) == 0x0
 03396   896   NtAllocateVirtualMemory  (-1, 0, 0, 2097152, 8192, 4, ...
 03397   780   NtSetInformationThread  (-2, BasePriority, {thread info, class 3, size 4}, 4, ...
 03398   940   NtTestAlert  (... ) == 0x0
 03399   940   NtContinue  (138411312, 1, ...
 03400   940   NtRegisterThreadTerminatePort  (24, ... ) == 0x0
 03401   940   NtSetInformationThread  (-2, BasePriority, {thread info, class 3, size 4}, 4, ...
 03396   896   NtAllocateVirtualMemory  ... 138412032, 2097152, ) == 0x0
 03402   896   NtAllocateVirtualMemory  (-1, 140500992, 0, 8192, 4096, 4, ... 140500992, 8192, ) == 0x0
 03403   896   NtProtectVirtualMemory  (-1, (0x85fe000), 4096, 260, ... (0x85fe000), 4096, 4, ) == 0x0
 03404   896   NtCreateThread  (0x1f03ff, 0x0, -1, 2292532, 2292476, 1, ...
 03397   780   NtSetInformationThread  ... ) == 0x0
 03404   896   NtCreateThread  ... 600, {1252, 1268}, ) == 0x0
 03405   896   NtQueryInformationThread  (600, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ff7f000,Pid=1252,Tid=1268,}, 0x0, ) == 0x0
 03406   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81930, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81930, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFGX\2\0\0\344\4\0\0\364\4\0\0" ... {28, 56, reply, 0, 1252, 896, 81931, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFGX\2\0\0\344\4\0\0\364\4\0\0" )  ... {28, 56, reply, 0, 1252, 896, 81931, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81930, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFGX\2\0\0\344\4\0\0\364\4\0\0" ... {28, 56, reply, 0, 1252, 896, 81931, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFGX\2\0\0\344\4\0\0\364\4\0\0" )  ) == 0x0
 03407   896   NtResumeThread  (600, ... 1, ) == 0x0
 03408   896   NtAllocateVirtualMemory  (-1, 0, 0, 2097152, 8192, 4, ... 140509184, 2097152, ) == 0x0
 03409   896   NtAllocateVirtualMemory  (-1, 142598144, 0, 8192, 4096, 4, ... 142598144, 8192, ) == 0x0
 03410   780   NtWaitForSingleObject  (316, 0, 0x0, ...
 03411  1268   NtTestAlert  (...
 03412   896   NtProtectVirtualMemory  (-1, (0x87fe000), 4096, 260, ...
 03411  1268   NtTestAlert  ... ) == 0x0
 03412   896   NtProtectVirtualMemory  ... (0x87fe000), 4096, 4, ) == 0x0
 03413  1268   NtContinue  (140508464, 1, ...
 03414   896   NtCreateThread  (0x1f03ff, 0x0, -1, 2292532, 2292476, 1, ...
 03415  1268   NtRegisterThreadTerminatePort  (24, ...
 03414   896   NtCreateThread  ... 604, {1252, 644}, ) == 0x0
 03415  1268   NtRegisterThreadTerminatePort  ... ) == 0x0
 03416   896   NtQueryInformationThread  (604, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ff7e000,Pid=1252,Tid=644,}, 0x0, ) == 0x0
 03417   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81931, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81931, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\\2\0\0\344\4\0\0\204\2\0\0" ... {28, 56, reply, 0, 1252, 896, 81932, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\\2\0\0\344\4\0\0\204\2\0\0" )  ... {28, 56, reply, 0, 1252, 896, 81932, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81931, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\\2\0\0\344\4\0\0\204\2\0\0" ... {28, 56, reply, 0, 1252, 896, 81932, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\\2\0\0\344\4\0\0\204\2\0\0" )  ) == 0x0
 03418   896   NtResumeThread  (604, ... 1, ) == 0x0
 03419   896   NtAllocateVirtualMemory  (-1, 0, 0, 2097152, 8192, 4, ...
 03420  1268   NtSetInformationThread  (-2, BasePriority, {thread info, class 3, size 4}, 4, ...
 03421   644   NtTestAlert  (... ) == 0x0
 03422   644   NtContinue  (142605616, 1, ...
 03423   644   NtRegisterThreadTerminatePort  (24, ... ) == 0x0
 03424   644   NtSetInformationThread  (-2, BasePriority, {thread info, class 3, size 4}, 4, ...
 03419   896   NtAllocateVirtualMemory  ... 142606336, 2097152, ) == 0x0
 03425   896   NtAllocateVirtualMemory  (-1, 144695296, 0, 8192, 4096, 4, ... 144695296, 8192, ) == 0x0
 03426   896   NtProtectVirtualMemory  (-1, (0x89fe000), 4096, 260, ... (0x89fe000), 4096, 4, ) == 0x0
 03427   896   NtCreateThread  (0x1f03ff, 0x0, -1, 2292532, 2292476, 1, ...
 03420  1268   NtSetInformationThread  ... ) == 0x0
 03427   896   NtCreateThread  ... 608, {1252, 1736}, ) == 0x0
 03428   896   NtQueryInformationThread  (608, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ff7d000,Pid=1252,Tid=1736,}, 0x0, ) == 0x0
 03429   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81932, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81932, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG`\2\0\0\344\4\0\0\310\6\0\0" ... {28, 56, reply, 0, 1252, 896, 81933, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG`\2\0\0\344\4\0\0\310\6\0\0" )  ... {28, 56, reply, 0, 1252, 896, 81933, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81932, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG`\2\0\0\344\4\0\0\310\6\0\0" ... {28, 56, reply, 0, 1252, 896, 81933, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG`\2\0\0\344\4\0\0\310\6\0\0" )  ) == 0x0
 03430   896   NtResumeThread  (608, ... 1, ) == 0x0
 03431   896   NtAllocateVirtualMemory  (-1, 0, 0, 2097152, 8192, 4, ... 144703488, 2097152, ) == 0x0
 03432   896   NtAllocateVirtualMemory  (-1, 146792448, 0, 8192, 4096, 4, ... 146792448, 8192, ) == 0x0
 03433  1268   NtWaitForSingleObject  (316, 0, 0x0, ...
 03434  1736   NtTestAlert  (...
 03435   896   NtProtectVirtualMemory  (-1, (0x8bfe000), 4096, 260, ...
 03434  1736   NtTestAlert  ... ) == 0x0
 03435   896   NtProtectVirtualMemory  ... (0x8bfe000), 4096, 4, ) == 0x0
 03436  1736   NtContinue  (144702768, 1, ...
 03437   896   NtCreateThread  (0x1f03ff, 0x0, -1, 2292532, 2292476, 1, ...
 03438  1736   NtRegisterThreadTerminatePort  (24, ...
 03437   896   NtCreateThread  ... 612, {1252, 320}, ) == 0x0
 03438  1736   NtRegisterThreadTerminatePort  ... ) == 0x0
 03439   896   NtQueryInformationThread  (612, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ff7c000,Pid=1252,Tid=320,}, 0x0, ) == 0x0
 03440   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81933, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81933, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFGd\2\0\0\344\4\0\0@\1\0\0" ... {28, 56, reply, 0, 1252, 896, 81934, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFGd\2\0\0\344\4\0\0@\1\0\0" )  ... {28, 56, reply, 0, 1252, 896, 81934, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81933, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFGd\2\0\0\344\4\0\0@\1\0\0" ... {28, 56, reply, 0, 1252, 896, 81934, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFGd\2\0\0\344\4\0\0@\1\0\0" )  ) == 0x0
 03441   896   NtResumeThread  (612, ... 1, ) == 0x0
 03442   896   NtAllocateVirtualMemory  (-1, 0, 0, 2097152, 8192, 4, ...
 03443  1736   NtSetInformationThread  (-2, BasePriority, {thread info, class 3, size 4}, 4, ...
 03444   320   NtTestAlert  (... ) == 0x0
 03445   320   NtContinue  (146799920, 1, ...
 03446   320   NtRegisterThreadTerminatePort  (24, ... ) == 0x0
 03447   320   NtSetInformationThread  (-2, BasePriority, {thread info, class 3, size 4}, 4, ...
 03442   896   NtAllocateVirtualMemory  ... 146800640, 2097152, ) == 0x0
 03448   896   NtAllocateVirtualMemory  (-1, 148889600, 0, 8192, 4096, 4, ... 148889600, 8192, ) == 0x0
 03449   896   NtProtectVirtualMemory  (-1, (0x8dfe000), 4096, 260, ... (0x8dfe000), 4096, 4, ) == 0x0
 03450   896   NtCreateThread  (0x1f03ff, 0x0, -1, 2292532, 2292476, 1, ...
 03443  1736   NtSetInformationThread  ... ) == 0x0
 03450   896   NtCreateThread  ... 616, {1252, 380}, ) == 0x0
 03451   896   NtQueryInformationThread  (616, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ff7b000,Pid=1252,Tid=380,}, 0x0, ) == 0x0
 03452   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81934, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81934, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFGh\2\0\0\344\4\0\0|\1\0\0" ... {28, 56, reply, 0, 1252, 896, 81935, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFGh\2\0\0\344\4\0\0|\1\0\0" )  ... {28, 56, reply, 0, 1252, 896, 81935, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81934, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFGh\2\0\0\344\4\0\0|\1\0\0" ... {28, 56, reply, 0, 1252, 896, 81935, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFGh\2\0\0\344\4\0\0|\1\0\0" )  ) == 0x0
 03453   896   NtResumeThread  (616, ... 1, ) == 0x0
 03454   896   NtAllocateVirtualMemory  (-1, 0, 0, 2097152, 8192, 4, ... 148897792, 2097152, ) == 0x0
 03455   896   NtAllocateVirtualMemory  (-1, 150986752, 0, 8192, 4096, 4, ... 150986752, 8192, ) == 0x0
 03456  1736   NtWaitForSingleObject  (316, 0, 0x0, ...
 03457   380   NtTestAlert  (...
 03458   896   NtProtectVirtualMemory  (-1, (0x8ffe000), 4096, 260, ...
 03457   380   NtTestAlert  ... ) == 0x0
 03458   896   NtProtectVirtualMemory  ... (0x8ffe000), 4096, 4, ) == 0x0
 03459   380   NtContinue  (148897072, 1, ...
 03460   896   NtCreateThread  (0x1f03ff, 0x0, -1, 2292532, 2292476, 1, ...
 03461   380   NtRegisterThreadTerminatePort  (24, ...
 03460   896   NtCreateThread  ... 620, {1252, 1332}, ) == 0x0
 03461   380   NtRegisterThreadTerminatePort  ... ) == 0x0
 03462   896   NtQueryInformationThread  (620, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ff7a000,Pid=1252,Tid=1332,}, 0x0, ) == 0x0
 03463   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81935, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81935, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFGl\2\0\0\344\4\0\04\5\0\0" ... {28, 56, reply, 0, 1252, 896, 81936, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFGl\2\0\0\344\4\0\04\5\0\0" )  ... {28, 56, reply, 0, 1252, 896, 81936, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81935, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFGl\2\0\0\344\4\0\04\5\0\0" ... {28, 56, reply, 0, 1252, 896, 81936, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFGl\2\0\0\344\4\0\04\5\0\0" )  ) == 0x0
 03464   896   NtResumeThread  (620, ... 1, ) == 0x0
 03465   896   NtAllocateVirtualMemory  (-1, 0, 0, 2097152, 8192, 4, ...
 03466   380   NtSetInformationThread  (-2, BasePriority, {thread info, class 3, size 4}, 4, ...
 03467  1332   NtTestAlert  (... ) == 0x0
 03468  1332   NtContinue  (150994224, 1, ...
 03469  1332   NtRegisterThreadTerminatePort  (24, ... ) == 0x0
 03470  1332   NtSetInformationThread  (-2, BasePriority, {thread info, class 3, size 4}, 4, ...
 03465   896   NtAllocateVirtualMemory  ... 150994944, 2097152, ) == 0x0
 03471   896   NtAllocateVirtualMemory  (-1, 153083904, 0, 8192, 4096, 4, ... 153083904, 8192, ) == 0x0
 03472   896   NtProtectVirtualMemory  (-1, (0x91fe000), 4096, 260, ... (0x91fe000), 4096, 4, ) == 0x0
 03473   896   NtCreateThread  (0x1f03ff, 0x0, -1, 2292532, 2292476, 1, ...
 03466   380   NtSetInformationThread  ... ) == 0x0
 03473   896   NtCreateThread  ... 624, {1252, 1336}, ) == 0x0
 03474   896   NtQueryInformationThread  (624, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ff79000,Pid=1252,Tid=1336,}, 0x0, ) == 0x0
 03475   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81936, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81936, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFGp\2\0\0\344\4\0\08\5\0\0" ... {28, 56, reply, 0, 1252, 896, 81937, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFGp\2\0\0\344\4\0\08\5\0\0" )  ... {28, 56, reply, 0, 1252, 896, 81937, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81936, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFGp\2\0\0\344\4\0\08\5\0\0" ... {28, 56, reply, 0, 1252, 896, 81937, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFGp\2\0\0\344\4\0\08\5\0\0" )  ) == 0x0
 03476   896   NtResumeThread  (624, ... 1, ) == 0x0
 03477   896   NtAllocateVirtualMemory  (-1, 0, 0, 2097152, 8192, 4, ... 153092096, 2097152, ) == 0x0
 03478   896   NtAllocateVirtualMemory  (-1, 155181056, 0, 8192, 4096, 4, ... 155181056, 8192, ) == 0x0
 03479   380   NtWaitForSingleObject  (316, 0, 0x0, ...
 03480  1336   NtTestAlert  (...
 03481   896   NtProtectVirtualMemory  (-1, (0x93fe000), 4096, 260, ...
 03480  1336   NtTestAlert  ... ) == 0x0
 03481   896   NtProtectVirtualMemory  ... (0x93fe000), 4096, 4, ) == 0x0
 03482  1336   NtContinue  (153091376, 1, ...
 03483   896   NtCreateThread  (0x1f03ff, 0x0, -1, 2292532, 2292476, 1, ...
 03484  1336   NtRegisterThreadTerminatePort  (24, ...
 03483   896   NtCreateThread  ... 628, {1252, 1808}, ) == 0x0
 03484  1336   NtRegisterThreadTerminatePort  ... ) == 0x0
 03485   896   NtQueryInformationThread  (628, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ff78000,Pid=1252,Tid=1808,}, 0x0, ) == 0x0
 03486   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81937, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81937, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFGt\2\0\0\344\4\0\0\20\7\0\0" ... {28, 56, reply, 0, 1252, 896, 81938, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFGt\2\0\0\344\4\0\0\20\7\0\0" )  ... {28, 56, reply, 0, 1252, 896, 81938, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81937, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFGt\2\0\0\344\4\0\0\20\7\0\0" ... {28, 56, reply, 0, 1252, 896, 81938, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFGt\2\0\0\344\4\0\0\20\7\0\0" )  ) == 0x0
 03487   896   NtResumeThread  (628, ... 1, ) == 0x0
 03488   896   NtAllocateVirtualMemory  (-1, 0, 0, 2097152, 8192, 4, ...
 03489  1336   NtSetInformationThread  (-2, BasePriority, {thread info, class 3, size 4}, 4, ...
 03490  1808   NtTestAlert  (... ) == 0x0
 03491  1808   NtContinue  (155188528, 1, ...
 03492  1808   NtRegisterThreadTerminatePort  (24, ... ) == 0x0
 03493  1808   NtSetInformationThread  (-2, BasePriority, {thread info, class 3, size 4}, 4, ...
 03488   896   NtAllocateVirtualMemory  ... 155189248, 2097152, ) == 0x0
 03494   896   NtAllocateVirtualMemory  (-1, 157278208, 0, 8192, 4096, 4, ... 157278208, 8192, ) == 0x0
 03495   896   NtProtectVirtualMemory  (-1, (0x95fe000), 4096, 260, ... (0x95fe000), 4096, 4, ) == 0x0
 03496   896   NtCreateThread  (0x1f03ff, 0x0, -1, 2292532, 2292476, 1, ...
 03489  1336   NtSetInformationThread  ... ) == 0x0
 03496   896   NtCreateThread  ... 632, {1252, 468}, ) == 0x0
 03497   896   NtQueryInformationThread  (632, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ff77000,Pid=1252,Tid=468,}, 0x0, ) == 0x0
 03498   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81938, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81938, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFGx\2\0\0\344\4\0\0\324\1\0\0" ... {28, 56, reply, 0, 1252, 896, 81939, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFGx\2\0\0\344\4\0\0\324\1\0\0" )  ... {28, 56, reply, 0, 1252, 896, 81939, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81938, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFGx\2\0\0\344\4\0\0\324\1\0\0" ... {28, 56, reply, 0, 1252, 896, 81939, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFGx\2\0\0\344\4\0\0\324\1\0\0" )  ) == 0x0
 03499   896   NtResumeThread  (632, ... 1, ) == 0x0
 03500   896   NtAllocateVirtualMemory  (-1, 0, 0, 2097152, 8192, 4, ... 157286400, 2097152, ) == 0x0
 03501   896   NtAllocateVirtualMemory  (-1, 159375360, 0, 8192, 4096, 4, ... 159375360, 8192, ) == 0x0
 03502  1336   NtWaitForSingleObject  (316, 0, 0x0, ...
 03503   468   NtTestAlert  (...
 03504   896   NtProtectVirtualMemory  (-1, (0x97fe000), 4096, 260, ...
 03503   468   NtTestAlert  ... ) == 0x0
 03504   896   NtProtectVirtualMemory  ... (0x97fe000), 4096, 4, ) == 0x0
 03505   468   NtContinue  (157285680, 1, ...
 03506   896   NtCreateThread  (0x1f03ff, 0x0, -1, 2292532, 2292476, 1, ...
 03507   468   NtRegisterThreadTerminatePort  (24, ...
 03506   896   NtCreateThread  ... 636, {1252, 752}, ) == 0x0
 03507   468   NtRegisterThreadTerminatePort  ... ) == 0x0
 03508   896   NtQueryInformationThread  (636, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ff76000,Pid=1252,Tid=752,}, 0x0, ) == 0x0
 03509   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81939, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81939, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG|\2\0\0\344\4\0\0\360\2\0\0" ... {28, 56, reply, 0, 1252, 896, 81940, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG|\2\0\0\344\4\0\0\360\2\0\0" )  ... {28, 56, reply, 0, 1252, 896, 81940, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81939, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG|\2\0\0\344\4\0\0\360\2\0\0" ... {28, 56, reply, 0, 1252, 896, 81940, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG|\2\0\0\344\4\0\0\360\2\0\0" )  ) == 0x0
 03510   896   NtResumeThread  (636, ... 1, ) == 0x0
 03511   896   NtAllocateVirtualMemory  (-1, 0, 0, 2097152, 8192, 4, ...
 03512   468   NtSetInformationThread  (-2, BasePriority, {thread info, class 3, size 4}, 4, ...
 03513   752   NtTestAlert  (... ) == 0x0
 03514   752   NtContinue  (159382832, 1, ...
 03515   752   NtRegisterThreadTerminatePort  (24, ... ) == 0x0
 03516   752   NtSetInformationThread  (-2, BasePriority, {thread info, class 3, size 4}, 4, ...
 03511   896   NtAllocateVirtualMemory  ... 159383552, 2097152, ) == 0x0
 03517   896   NtAllocateVirtualMemory  (-1, 161472512, 0, 8192, 4096, 4, ... 161472512, 8192, ) == 0x0
 03518   896   NtProtectVirtualMemory  (-1, (0x99fe000), 4096, 260, ... (0x99fe000), 4096, 4, ) == 0x0
 03519   896   NtCreateThread  (0x1f03ff, 0x0, -1, 2292532, 2292476, 1, ...
 03512   468   NtSetInformationThread  ... ) == 0x0
 03519   896   NtCreateThread  ... 640, {1252, 1512}, ) == 0x0
 03520   896   NtQueryInformationThread  (640, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ff75000,Pid=1252,Tid=1512,}, 0x0, ) == 0x0
 03521   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81940, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81940, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\200\2\0\0\344\4\0\0\350\5\0\0" ... {28, 56, reply, 0, 1252, 896, 81941, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\200\2\0\0\344\4\0\0\350\5\0\0" )  ... {28, 56, reply, 0, 1252, 896, 81941, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81940, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\200\2\0\0\344\4\0\0\350\5\0\0" ... {28, 56, reply, 0, 1252, 896, 81941, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\200\2\0\0\344\4\0\0\350\5\0\0" )  ) == 0x0
 03522   896   NtResumeThread  (640, ... 1, ) == 0x0
 03523   896   NtAllocateVirtualMemory  (-1, 0, 0, 2097152, 8192, 4, ... 161480704, 2097152, ) == 0x0
 03524   896   NtAllocateVirtualMemory  (-1, 163569664, 0, 8192, 4096, 4, ... 163569664, 8192, ) == 0x0
 03525   468   NtWaitForSingleObject  (316, 0, 0x0, ...
 03526  1512   NtTestAlert  (...
 03527   896   NtProtectVirtualMemory  (-1, (0x9bfe000), 4096, 260, ...
 03526  1512   NtTestAlert  ... ) == 0x0
 03527   896   NtProtectVirtualMemory  ... (0x9bfe000), 4096, 4, ) == 0x0
 03528  1512   NtContinue  (161479984, 1, ...
 03529   896   NtCreateThread  (0x1f03ff, 0x0, -1, 2292532, 2292476, 1, ...
 03530  1512   NtRegisterThreadTerminatePort  (24, ...
 03529   896   NtCreateThread  ... 644, {1252, 1380}, ) == 0x0
 03530  1512   NtRegisterThreadTerminatePort  ... ) == 0x0
 03531   896   NtQueryInformationThread  (644, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ff74000,Pid=1252,Tid=1380,}, 0x0, ) == 0x0
 03532   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81941, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81941, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\204\2\0\0\344\4\0\0d\5\0\0" ... {28, 56, reply, 0, 1252, 896, 81942, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\204\2\0\0\344\4\0\0d\5\0\0" )  ... {28, 56, reply, 0, 1252, 896, 81942, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81941, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\204\2\0\0\344\4\0\0d\5\0\0" ... {28, 56, reply, 0, 1252, 896, 81942, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\204\2\0\0\344\4\0\0d\5\0\0" )  ) == 0x0
 03533   896   NtResumeThread  (644, ... 1, ) == 0x0
 03534   896   NtAllocateVirtualMemory  (-1, 0, 0, 2097152, 8192, 4, ...
 03535  1512   NtSetInformationThread  (-2, BasePriority, {thread info, class 3, size 4}, 4, ...
 03536  1380   NtTestAlert  (... ) == 0x0
 03537  1380   NtContinue  (163577136, 1, ...
 03538  1380   NtRegisterThreadTerminatePort  (24, ... ) == 0x0
 03539  1380   NtSetInformationThread  (-2, BasePriority, {thread info, class 3, size 4}, 4, ...
 03534   896   NtAllocateVirtualMemory  ... 163577856, 2097152, ) == 0x0
 03540   896   NtAllocateVirtualMemory  (-1, 165666816, 0, 8192, 4096, 4, ... 165666816, 8192, ) == 0x0
 03541   896   NtProtectVirtualMemory  (-1, (0x9dfe000), 4096, 260, ... (0x9dfe000), 4096, 4, ) == 0x0
 03542   896   NtCreateThread  (0x1f03ff, 0x0, -1, 2292532, 2292476, 1, ...
 03535  1512   NtSetInformationThread  ... ) == 0x0
 03542   896   NtCreateThread  ... 648, {1252, 1564}, ) == 0x0
 03543   896   NtQueryInformationThread  (648, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ff73000,Pid=1252,Tid=1564,}, 0x0, ) == 0x0
 03544   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81942, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81942, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\210\2\0\0\344\4\0\0\34\6\0\0" ... {28, 56, reply, 0, 1252, 896, 81943, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\210\2\0\0\344\4\0\0\34\6\0\0" )  ... {28, 56, reply, 0, 1252, 896, 81943, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81942, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\210\2\0\0\344\4\0\0\34\6\0\0" ... {28, 56, reply, 0, 1252, 896, 81943, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\210\2\0\0\344\4\0\0\34\6\0\0" )  ) == 0x0
 03545   896   NtResumeThread  (648, ... 1, ) == 0x0
 03546   896   NtAllocateVirtualMemory  (-1, 0, 0, 2097152, 8192, 4, ...
 03547  1512   NtWaitForSingleObject  (316, 0, 0x0, ...
 03365  2016   NtDelayExecution  ... ) == 0x0
 03548  1564   NtTestAlert  (...
 03546   896   NtAllocateVirtualMemory  ... 165675008, 2097152, ) == 0x0
 03549  2016   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\System\CurrentControlSet\Control\ComputerName"}, ... }, ...
 03548  1564   NtTestAlert  ... ) == 0x0
 03550   896   NtAllocateVirtualMemory  (-1, 167763968, 0, 8192, 4096, 4, ...
 03549  2016   NtOpenKey  ... 652, ) == 0x0
 03551  1564   NtContinue  (165674288, 1, ...
 03550   896   NtAllocateVirtualMemory  ... 167763968, 8192, ) == 0x0
 03552  1564   NtRegisterThreadTerminatePort  (24, ...
 03553   896   NtProtectVirtualMemory  (-1, (0x9ffe000), 4096, 260, ...
 03552  1564   NtRegisterThreadTerminatePort  ... ) == 0x0
 03553   896   NtProtectVirtualMemory  ... (0x9ffe000), 4096, 4, ) == 0x0
 03554  2016   NtOpenKey  (0x20019, {24, 652, 0x40, 0, 0,  (0x20019, {24, 652, 0x40, 0, 0, "ActiveComputerName"}, ... }, ...
 03555   896   NtCreateThread  (0x1f03ff, 0x0, -1, 2292532, 2292476, 1, ...
 03554  2016   NtOpenKey  ... 656, ) == 0x0
 03556  1564   NtSetInformationThread  (-2, BasePriority, {thread info, class 3, size 4}, 4, ...
 03557  2016   NtQueryValueKey  (656,  (656, "ComputerName", Full, 108, ... TitleIdx=0, Type=1, Name="ComputerName", Data="V\0I\0R\0T\0U\0A\0L\0\0\0"}, 60, ) , Full, 108, ... TitleIdx=0, Type=1, Name= (656, "ComputerName", Full, 108, ... TitleIdx=0, Type=1, Name="ComputerName", Data="V\0I\0R\0T\0U\0A\0L\0\0\0"}, 60, ) , Data= (656, "ComputerName", Full, 108, ... TitleIdx=0, Type=1, Name="ComputerName", Data="V\0I\0R\0T\0U\0A\0L\0\0\0"}, 60, ) }, 60, ) == 0x0
 03558  2016   NtClose  (656, ... ) == 0x0
 03559  2016   NtClose  (652, ... ) == 0x0
 03560  2016   NtAllocateVirtualMemory  (-1, 5779456, 0, 4096, 4096, 4, ... 5779456, 4096, ) == 0x0
 03561  2016   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\System\CurrentControlSet\Services\Tcpip\Parameters"}, ... 652, ) }, ... 652, ) == 0x0
 03555   896   NtCreateThread  ... 656, {1252, 164}, ) == 0x0
 03556  1564   NtSetInformationThread  ... ) == 0x0
 03562   896   NtQueryInformationThread  (656, Basic, 28, ...
 03563  2016   NtQueryValueKey  (652,  (652, "Hostname", Full, 128, ... , Full, 128, ...
 03562   896   NtQueryInformationThread  ... {ExitStatus=0x103,TebBaseAddress=0x7ff72000,Pid=1252,Tid=164,}, 0x0, ) == 0x0
 03563  2016   NtQueryValueKey  ... TitleIdx=0, Type=1, Name= ... TitleIdx=0, Type=1, Name="Hostname", Data="v\0i\0r\0t\0u\0a\0l\0\0\0"}, 52, ) , Data= ... TitleIdx=0, Type=1, Name="Hostname", Data="v\0i\0r\0t\0u\0a\0l\0\0\0"}, 52, ) }, 52, ) == 0x0
 03564   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81943, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81943, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\220\2\0\0\344\4\0\0\244\0\0\0" ...  ...
 03565  2016   NtClose  (652, ...
 03564   896   NtRequestWaitReplyPort  ... {28, 56, reply, 0, 1252, 896, 81944, 0}  ... {28, 56, reply, 0, 1252, 896, 81944, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\220\2\0\0\344\4\0\0\244\0\0\0" )  ) == 0x0
 03565  2016   NtClose  ... ) == 0x0
 03566  1564   NtWaitForSingleObject  (316, 0, 0x0, ...
 03567  2016   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Policies\Microsoft\System\DNSclient"}, ... }, ...
 03568   896   NtResumeThread  (656, ...
 03567  2016   NtOpenKey  ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 03568   896   NtResumeThread  ... 1, ) == 0x0
 03569   896   NtAllocateVirtualMemory  (-1, 0, 0, 2097152, 8192, 4, ... 167772160, 2097152, ) == 0x0
 03570   896   NtAllocateVirtualMemory  (-1, 169861120, 0, 8192, 4096, 4, ... 169861120, 8192, ) == 0x0
 03571   896   NtProtectVirtualMemory  (-1, (0xa1fe000), 4096, 260, ... (0xa1fe000), 4096, 4, ) == 0x0
 03572   896   NtCreateThread  (0x1f03ff, 0x0, -1, 2292532, 2292476, 1, ... 652, {1252, 312}, ) == 0x0
 03573   896   NtQueryInformationThread  (652, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ff71000,Pid=1252,Tid=312,}, 0x0, ) == 0x0
 03574  2016   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\System\CurrentControlSet\Services\Tcpip\Parameters"}, ... }, ...
 03575   164   NtTestAlert  (...
 03574  2016   NtOpenKey  ... 660, ) == 0x0
 03575   164   NtTestAlert  ... ) == 0x0
 03576  2016   NtQueryValueKey  (660,  (660, "Domain", Full, 128, ... , Full, 128, ...
 03577   164   NtContinue  (167771440, 1, ...
 03576  2016   NtQueryValueKey  ... TitleIdx=0, Type=1, Name= ... TitleIdx=0, Type=1, Name="Domain", Data="\0\0"}, 34, ) , Data= ... TitleIdx=0, Type=1, Name="Domain", Data="\0\0"}, 34, ) }, 34, ) == 0x0
 03578   164   NtRegisterThreadTerminatePort  (24, ...
 03579  2016   NtClose  (660, ...
 03578   164   NtRegisterThreadTerminatePort  ... ) == 0x0
 03579  2016   NtClose  ... ) == 0x0
 03580   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81944, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81944, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\214\2\0\0\344\4\0\08\1\0\0" ...  ...
 03581   164   NtSetInformationThread  (-2, BasePriority, {thread info, class 3, size 4}, 4, ...
 03580   896   NtRequestWaitReplyPort  ... {28, 56, reply, 0, 1252, 896, 81945, 0}  ... {28, 56, reply, 0, 1252, 896, 81945, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\214\2\0\0\344\4\0\08\1\0\0" )  ) == 0x0
 03582   896   NtResumeThread  (652, ... 1, ) == 0x0
 03583   896   NtAllocateVirtualMemory  (-1, 0, 0, 2097152, 8192, 4, ... 169869312, 2097152, ) == 0x0
 03584   896   NtAllocateVirtualMemory  (-1, 171958272, 0, 8192, 4096, 4, ... 171958272, 8192, ) == 0x0
 03585   896   NtProtectVirtualMemory  (-1, (0xa3fe000), 4096, 260, ... (0xa3fe000), 4096, 4, ) == 0x0
 03586   896   NtCreateThread  (0x1f03ff, 0x0, -1, 2292532, 2292476, 1, ...
 03587  2016   NtOpenThreadToken  (-2, 0xc, 1, ...
 03581   164   NtSetInformationThread  ... ) == 0x0
 03588   312   NtTestAlert  (...
 03587  2016   NtOpenThreadToken  ... ) == STATUS_NO_TOKEN
 03586   896   NtCreateThread  ... 660, {1252, 1964}, ) == 0x0
 03588   312   NtTestAlert  ... ) == 0x0
 03589  2016   NtCreateEvent  (0x1f0003, 0x0, 1, 0, ...
 03590   896   NtQueryInformationThread  (660, Basic, 28, ...
 03591   312   NtContinue  (169868592, 1, ...
 03589  2016   NtCreateEvent  ... 664, ) == 0x0
 03590   896   NtQueryInformationThread  ... {ExitStatus=0x103,TebBaseAddress=0x7ff70000,Pid=1252,Tid=1964,}, 0x0, ) == 0x0
 03592   312   NtRegisterThreadTerminatePort  (24, ...
 03593  2016   NtOpenThreadToken  (-2, 0xc, 1, ...
 03594   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81945, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81945, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\224\2\0\0\344\4\0\0\254\7\0\0" ...  ...
 03592   312   NtRegisterThreadTerminatePort  ... ) == 0x0
 03593  2016   NtOpenThreadToken  ... ) == STATUS_NO_TOKEN
 03594   896   NtRequestWaitReplyPort  ... {28, 56, reply, 0, 1252, 896, 81946, 0}  ... {28, 56, reply, 0, 1252, 896, 81946, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\224\2\0\0\344\4\0\0\254\7\0\0" )  ) == 0x0
 03595   164   NtWaitForSingleObject  (316, 0, 0x0, ...
 03596   312   NtSetInformationThread  (-2, BasePriority, {thread info, class 3, size 4}, 4, ...
 03597  2016   NtSetInformationThread  (-2, ImpersonationToken, {ImpToken=0,}, 4, ...
 03598   896   NtResumeThread  (660, ...
 03597  2016   NtSetInformationThread  ... ) == 0x0
 03598   896   NtResumeThread  ... 1, ) == 0x0
 03599  2016   NtCreateFile  (0xc0100080, {24, 0, 0x40, 0, 9750004,  (0xc0100080, {24, 0, 0x40, 0, 9750004, "\??\PIPE\SfcApi"}, 0x0, 0, 3, 1, 64, 0, 0, ... }, 0x0, 0, 3, 1, 64, 0, 0, ...
 03600   896   NtAllocateVirtualMemory  (-1, 0, 0, 2097152, 8192, 4, ...
 03599  2016   NtCreateFile  ... 668, {status=0x0, info=1}, ) == 0x0
 03600   896   NtAllocateVirtualMemory  ... 171966464, 2097152, ) == 0x0
 03601  2016   NtSetInformationFile  (668, 9750060, 8, Pipe, ...
 03602   896   NtAllocateVirtualMemory  (-1, 174055424, 0, 8192, 4096, 4, ...
 03601  2016   NtSetInformationFile  ... {status=0x0, info=0}, ) == 0x0
 03602   896   NtAllocateVirtualMemory  ... 174055424, 8192, ) == 0x0
 03596   312   NtSetInformationThread  ... ) == 0x0
 03603  1964   NtTestAlert  (...
 03604  2016   NtSetInformationFile  (668, 9750048, 8, Completion, ...
 03605   896   NtProtectVirtualMemory  (-1, (0xa5fe000), 4096, 260, ...
 03603  1964   NtTestAlert  ... ) == 0x0
 03604  2016   NtSetInformationFile  ... {status=0x0, info=0}, ) == 0x0
 03605   896   NtProtectVirtualMemory  ... (0xa5fe000), 4096, 4, ) == 0x0
 03606  1964   NtContinue  (171965744, 1, ...
 03607  2016   NtSetInformationThread  (-2, ImpersonationToken, {ImpToken=0,}, 4, ...
 03608   896   NtCreateThread  (0x1f03ff, 0x0, -1, 2292532, 2292476, 1, ...
 03609  1964   NtRegisterThreadTerminatePort  (24, ...
 03607  2016   NtSetInformationThread  ... ) == 0x0
 03608   896   NtCreateThread  ... 672, {1252, 1568}, ) == 0x0
 03609  1964   NtRegisterThreadTerminatePort  ... ) == 0x0
 03610  2016   NtWriteFile  (668, 509, 0, 0,  (668, 509, 0, 0, "\5\0\13\3\20\0\0\0H\0\0\0\1\0\0\0\270\20\270\20\0\0\0\0\1\0\0\0\0\0\1\0\0|\332\203O\350\322\21\230\7\0\300O\216\310P\2\0\0\0\4]\210\212\353\34\311\21\237\350\10\0+\20H`\2\0\0\0", 72, {0, 0}, 0, ... , 72, {0, 0}, 0, ...
 03611   896   NtQueryInformationThread  (672, Basic, 28, ...
 03612   312   NtWaitForSingleObject  (316, 0, 0x0, ...
 03610  2016   NtWriteFile  ... {status=0x0, info=72}, ) == 0x0
 03611   896   NtQueryInformationThread  ... {ExitStatus=0x103,TebBaseAddress=0x7ff6f000,Pid=1252,Tid=1568,}, 0x0, ) == 0x0
 03613  1964   NtSetInformationThread  (-2, BasePriority, {thread info, class 3, size 4}, 4, ...
 03614  2016   NtReadFile  (668, 509, 0, 0, 1024, {0, 0}, 0, ... {status=0x0, info=68},  (668, 509, 0, 0, 1024, {0, 0}, 0, ... {status=0x0, info=68}, "\5\0\14\3\20\0\0\0D\0\0\0\1\0\0\0\270\20\270\20\234(\0\0\15\0\PIPE\SfcApi\0\177\1\0\0\0\0\0\0\0\4]\210\212\353\34\311\21\237\350\10\0+\20H`\2\0\0\0", ) , ) == 0x0
 03615  2016   NtFsControlFile  (668, 509, 0x0, 0x0, 0x11c017,  (668, 509, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0h\0\0\0\1\0\0\0P\0\0\0\0\0\1\0\252\317\224\0 \0\0\0\0\0\0\0 \0\0\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0s\0y\0s\0t\0e\0m\03\02\0\\0m\0a\0g\0n\0i\0f\0y\0.\0e\0x\0e\0\0\0", 104, 1024, ... {status=0x103, info=68}, "\5\0\14\3\20\0\0\0D\0\0\0\1\0\0\0\270\20\270\20\234(\0\0\15\0\PIPE\SfcApi\0\177\1\0\0\0\0\0\0\0\4]\210\212\353\34\311\21\237\350\10\0+\20H`\2\0\0\0", ) , 104, 1024, ... {status=0x103, info=68},  (668, 509, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0h\0\0\0\1\0\0\0P\0\0\0\0\0\1\0\252\317\224\0 \0\0\0\0\0\0\0 \0\0\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0s\0y\0s\0t\0e\0m\03\02\0\\0m\0a\0g\0n\0i\0f\0y\0.\0e\0x\0e\0\0\0", 104, 1024, ... {status=0x103, info=68}, "\5\0\14\3\20\0\0\0D\0\0\0\1\0\0\0\270\20\270\20\234(\0\0\15\0\PIPE\SfcApi\0\177\1\0\0\0\0\0\0\0\4]\210\212\353\34\311\21\237\350\10\0+\20H`\2\0\0\0", ) , ) == 0x103
 03616  2016   NtFsControlFile  (668, 509, 0x0, 0x0, 0x11c017,  (668, 509, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0l\0\0\0\2\0\0\0T\0\0\0\0\0\2\0\0\16X\0 \0\0\0\0\0\0\0 \0\0\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0s\0y\0s\0t\0e\0m\03\02\0\\0m\0a\0g\0n\0i\0f\0y\0.\0e\0x\0e\0\0\0\377\377\377\377", 108, 1024, ... {status=0x103, info=28}, "\5\0\2\3\20\0\0\0\34\0\0\0\1\0\0\0\4\0\0\0\0\0\0\0\0\0\0\0", ) , 108, 1024, ... {status=0x103, info=28},  (668, 509, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0l\0\0\0\2\0\0\0T\0\0\0\0\0\2\0\0\16X\0 \0\0\0\0\0\0\0 \0\0\0C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0s\0y\0s\0t\0e\0m\03\02\0\\0m\0a\0g\0n\0i\0f\0y\0.\0e\0x\0e\0\0\0\377\377\377\377", 108, 1024, ... {status=0x103, info=28}, "\5\0\2\3\20\0\0\0\34\0\0\0\1\0\0\0\4\0\0\0\0\0\0\0\0\0\0\0", ) , ) == 0x103
 03617  2016   NtWaitForSingleObject  (509, 0, 0x0, ...
 03618   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81946, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81946, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\240\2\0\0\344\4\0\0 \6\0\0" ...  ...
 03617  2016   NtWaitForSingleObject  ... ) == 0x0
 03619  2016   NtAllocateVirtualMemory  (-1, 9740288, 0, 4096, 4096, 260, ... 9740288, 4096, ) == 0x0
 03620  2016   NtAllocateVirtualMemory  (-1, 9736192, 0, 4096, 4096, 260, ... 9736192, 4096, ) == 0x0
 03621  2016   NtAllocateVirtualMemory  (-1, 9732096, 0, 4096, 4096, 260, ... 9732096, 4096, ) == 0x0
 03622  2016   NtAllocateVirtualMemory  (-1, 9728000, 0, 4096, 4096, 260, ... 9728000, 4096, ) == 0x0
 03623  2016   NtAllocateVirtualMemory  (-1, 9723904, 0, 4096, 4096, 260, ...
 03618   896   NtRequestWaitReplyPort  ... {28, 56, reply, 0, 1252, 896, 81947, 0}  ... {28, 56, reply, 0, 1252, 896, 81947, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\240\2\0\0\344\4\0\0 \6\0\0" )  ) == 0x0
 03613  1964   NtSetInformationThread  ... ) == 0x0
 03624   896   NtResumeThread  (672, ...
 03623  2016   NtAllocateVirtualMemory  ... 9723904, 4096, ) == 0x0
 03624   896   NtResumeThread  ... 1, ) == 0x0
 03625  2016   NtAllocateVirtualMemory  (-1, 9719808, 0, 4096, 4096, 260, ...
 03626   896   NtAllocateVirtualMemory  (-1, 0, 0, 2097152, 8192, 4, ...
 03625  2016   NtAllocateVirtualMemory  ... 9719808, 4096, ) == 0x0
 03627  1964   NtWaitForSingleObject  (316, 0, 0x0, ...
 03628  1568   NtTestAlert  (...
 03629  2016   NtAllocateVirtualMemory  (-1, 9715712, 0, 4096, 4096, 260, ...
 03626   896   NtAllocateVirtualMemory  ... 174063616, 2097152, ) == 0x0
 03628  1568   NtTestAlert  ... ) == 0x0
 03629  2016   NtAllocateVirtualMemory  ... 9715712, 4096, ) == 0x0
 03630   896   NtAllocateVirtualMemory  (-1, 176152576, 0, 8192, 4096, 4, ...
 03631  1568   NtContinue  (174062896, 1, ...
 03632  2016   NtAllocateVirtualMemory  (-1, 9711616, 0, 4096, 4096, 260, ...
 03630   896   NtAllocateVirtualMemory  ... 176152576, 8192, ) == 0x0
 03633  1568   NtRegisterThreadTerminatePort  (24, ...
 03634   896   NtProtectVirtualMemory  (-1, (0xa7fe000), 4096, 260, ...
 03633  1568   NtRegisterThreadTerminatePort  ... ) == 0x0
 03634   896   NtProtectVirtualMemory  ... (0xa7fe000), 4096, 4, ) == 0x0
 03632  2016   NtAllocateVirtualMemory  ... 9711616, 4096, ) == 0x0
 03635   896   NtCreateThread  (0x1f03ff, 0x0, -1, 2292532, 2292476, 1, ...
 03636  2016   NtAllocateVirtualMemory  (-1, 9707520, 0, 4096, 4096, 260, ...
 03637  1568   NtSetInformationThread  (-2, BasePriority, {thread info, class 3, size 4}, 4, ...
 03636  2016   NtAllocateVirtualMemory  ... 9707520, 4096, ) == 0x0
 03638  2016   NtAllocateVirtualMemory  (-1, 9703424, 0, 4096, 4096, 260, ... 9703424, 4096, ) == 0x0
 03639  2016   NtAllocateVirtualMemory  (-1, 9699328, 0, 4096, 4096, 260, ... 9699328, 4096, ) == 0x0
 03640  2016   NtAllocateVirtualMemory  (-1, 9695232, 0, 4096, 4096, 260, ... 9695232, 4096, ) == 0x0
 03641  2016   NtAllocateVirtualMemory  (-1, 9691136, 0, 4096, 4096, 260, ... 9691136, 4096, ) == 0x0
 03642  2016   NtAllocateVirtualMemory  (-1, 9687040, 0, 4096, 4096, 260, ...
 03635   896   NtCreateThread  ... 676, {1252, 1624}, ) == 0x0
 03637  1568   NtSetInformationThread  ... ) == 0x0
 03643   896   NtQueryInformationThread  (676, Basic, 28, ...
 03642  2016   NtAllocateVirtualMemory  ... 9687040, 4096, ) == 0x0
 03643   896   NtQueryInformationThread  ... {ExitStatus=0x103,TebBaseAddress=0x7ff6e000,Pid=1252,Tid=1624,}, 0x0, ) == 0x0
 03644  2016   NtAllocateVirtualMemory  (-1, 9682944, 0, 4096, 4096, 260, ...
 03645   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81947, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81947, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\244\2\0\0\344\4\0\0X\6\0\0" ...  ...
 03644  2016   NtAllocateVirtualMemory  ... 9682944, 4096, ) == 0x0
 03645   896   NtRequestWaitReplyPort  ... {28, 56, reply, 0, 1252, 896, 81948, 0}  ... {28, 56, reply, 0, 1252, 896, 81948, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\244\2\0\0\344\4\0\0X\6\0\0" )  ) == 0x0
 03646  2016   NtAllocateVirtualMemory  (-1, 9678848, 0, 4096, 4096, 260, ...
 03647  1568   NtWaitForSingleObject  (316, 0, 0x0, ...
 03646  2016   NtAllocateVirtualMemory  ... 9678848, 4096, ) == 0x0
 03648   896   NtResumeThread  (676, ...
 03649  2016   NtAllocateVirtualMemory  (-1, 9674752, 0, 4096, 4096, 260, ...
 03648   896   NtResumeThread  ... 1, ) == 0x0
 03650   896   NtAllocateVirtualMemory  (-1, 0, 0, 2097152, 8192, 4, ... 176160768, 2097152, ) == 0x0
 03651   896   NtAllocateVirtualMemory  (-1, 178249728, 0, 8192, 4096, 4, ... 178249728, 8192, ) == 0x0
 03652   896   NtProtectVirtualMemory  (-1, (0xa9fe000), 4096, 260, ... (0xa9fe000), 4096, 4, ) == 0x0
 03653   896   NtCreateThread  (0x1f03ff, 0x0, -1, 2292532, 2292476, 1, ... 680, {1252, 1716}, ) == 0x0
 03654   896   NtQueryInformationThread  (680, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ff6d000,Pid=1252,Tid=1716,}, 0x0, ) == 0x0
 03649  2016   NtAllocateVirtualMemory  ... 9674752, 4096, ) == 0x0
 03655  1624   NtTestAlert  (...
 03656  2016   NtAllocateVirtualMemory  (-1, 9670656, 0, 4096, 4096, 260, ...
 03655  1624   NtTestAlert  ... ) == 0x0
 03656  2016   NtAllocateVirtualMemory  ... 9670656, 4096, ) == 0x0
 03657  1624   NtContinue  (176160048, 1, ...
 03658  2016   NtAllocateVirtualMemory  (-1, 9666560, 0, 4096, 4096, 260, ...
 03659  1624   NtRegisterThreadTerminatePort  (24, ...
 03658  2016   NtAllocateVirtualMemory  ... 9666560, 4096, ) == 0x0
 03659  1624   NtRegisterThreadTerminatePort  ... ) == 0x0
 03660  2016   NtAllocateVirtualMemory  (-1, 9662464, 0, 4096, 4096, 260, ...
 03661   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81948, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81948, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\250\2\0\0\344\4\0\0\264\6\0\0" ...  ...
 03662  1624   NtSetInformationThread  (-2, BasePriority, {thread info, class 3, size 4}, 4, ...
 03661   896   NtRequestWaitReplyPort  ... {28, 56, reply, 0, 1252, 896, 81949, 0}  ... {28, 56, reply, 0, 1252, 896, 81949, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\250\2\0\0\344\4\0\0\264\6\0\0" )  ) == 0x0
 03663   896   NtResumeThread  (680, ... 1, ) == 0x0
 03664   896   NtAllocateVirtualMemory  (-1, 0, 0, 2097152, 8192, 4, ... 178257920, 2097152, ) == 0x0
 03665   896   NtAllocateVirtualMemory  (-1, 180346880, 0, 8192, 4096, 4, ... 180346880, 8192, ) == 0x0
 03666   896   NtProtectVirtualMemory  (-1, (0xabfe000), 4096, 260, ... (0xabfe000), 4096, 4, ) == 0x0
 03667   896   NtCreateThread  (0x1f03ff, 0x0, -1, 2292532, 2292476, 1, ...
 03660  2016   NtAllocateVirtualMemory  ... 9662464, 4096, ) == 0x0
 03662  1624   NtSetInformationThread  ... ) == 0x0
 03668  1716   NtAllocateVirtualMemory  (-1, 3375104, 0, 4096, 4096, 4, ...
 03669  2016   NtAllocateVirtualMemory  (-1, 9658368, 0, 4096, 4096, 260, ...
 03667   896   NtCreateThread  ... 684, {1252, 1440}, ) == 0x0
 03668  1716   NtAllocateVirtualMemory  ... 3375104, 4096, ) == 0x0
 03669  2016   NtAllocateVirtualMemory  ... 9658368, 4096, ) == 0x0
 03670   896   NtQueryInformationThread  (684, Basic, 28, ...
 03671  1716   NtTestAlert  (...
 03672  2016   NtAllocateVirtualMemory  (-1, 9654272, 0, 4096, 4096, 260, ...
 03670   896   NtQueryInformationThread  ... {ExitStatus=0x103,TebBaseAddress=0x7ff6c000,Pid=1252,Tid=1440,}, 0x0, ) == 0x0
 03671  1716   NtTestAlert  ... ) == 0x0
 03672  2016   NtAllocateVirtualMemory  ... 9654272, 4096, ) == 0x0
 03673   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81949, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81949, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\254\2\0\0\344\4\0\0\240\5\0\0" ...  ...
 03674  1716   NtContinue  (178257200, 1, ...
 03675  2016   NtAllocateVirtualMemory  (-1, 9650176, 0, 4096, 4096, 260, ...
 03673   896   NtRequestWaitReplyPort  ... {28, 56, reply, 0, 1252, 896, 81950, 0}  ... {28, 56, reply, 0, 1252, 896, 81950, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\254\2\0\0\344\4\0\0\240\5\0\0" )  ) == 0x0
 03676  1624   NtWaitForSingleObject  (316, 0, 0x0, ...
 03677  1716   NtRegisterThreadTerminatePort  (24, ...
 03675  2016   NtAllocateVirtualMemory  ... 9650176, 4096, ) == 0x0
 03678   896   NtResumeThread  (684, ...
 03677  1716   NtRegisterThreadTerminatePort  ... ) == 0x0
 03679  2016   NtAllocateVirtualMemory  (-1, 9646080, 0, 4096, 4096, 260, ...
 03678   896   NtResumeThread  ... 1, ) == 0x0
 03680  1716   NtSetInformationThread  (-2, BasePriority, {thread info, class 3, size 4}, 4, ...
 03679  2016   NtAllocateVirtualMemory  ... 9646080, 4096, ) == 0x0
 03681   896   NtAllocateVirtualMemory  (-1, 0, 0, 2097152, 8192, 4, ...
 03682  2016   NtAllocateVirtualMemory  (-1, 9641984, 0, 4096, 4096, 260, ...
 03681   896   NtAllocateVirtualMemory  ... 180355072, 2097152, ) == 0x0
 03682  2016   NtAllocateVirtualMemory  ... 9641984, 4096, ) == 0x0
 03683   896   NtAllocateVirtualMemory  (-1, 182444032, 0, 8192, 4096, 4, ...
 03684  2016   NtAllocateVirtualMemory  (-1, 9637888, 0, 4096, 4096, 260, ...
 03683   896   NtAllocateVirtualMemory  ... 182444032, 8192, ) == 0x0
 03685  1440   NtTestAlert  (...
 03680  1716   NtSetInformationThread  ... ) == 0x0
 03684  2016   NtAllocateVirtualMemory  ... 9637888, 4096, ) == 0x0
 03685  1440   NtTestAlert  ... ) == 0x0
 03686   896   NtProtectVirtualMemory  (-1, (0xadfe000), 4096, 260, ...
 03687  2016   NtAllocateVirtualMemory  (-1, 9633792, 0, 4096, 4096, 260, ...
 03688  1440   NtContinue  (180354352, 1, ...
 03686   896   NtProtectVirtualMemory  ... (0xadfe000), 4096, 4, ) == 0x0
 03687  2016   NtAllocateVirtualMemory  ... 9633792, 4096, ) == 0x0
 03689  1440   NtRegisterThreadTerminatePort  (24, ...
 03690   896   NtCreateThread  (0x1f03ff, 0x0, -1, 2292532, 2292476, 1, ...
 03691  2016   NtAllocateVirtualMemory  (-1, 9629696, 0, 4096, 4096, 260, ...
 03689  1440   NtRegisterThreadTerminatePort  ... ) == 0x0
 03690   896   NtCreateThread  ... 688, {1252, 1664}, ) == 0x0
 03691  2016   NtAllocateVirtualMemory  ... 9629696, 4096, ) == 0x0
 03692  1716   NtWaitForSingleObject  (316, 0, 0x0, ...
 03693   896   NtQueryInformationThread  (688, Basic, 28, ...
 03694  2016   NtAllocateVirtualMemory  (-1, 9625600, 0, 4096, 4096, 260, ...
 03695  1440   NtSetInformationThread  (-2, BasePriority, {thread info, class 3, size 4}, 4, ...
 03693   896   NtQueryInformationThread  ... {ExitStatus=0x103,TebBaseAddress=0x7ff6b000,Pid=1252,Tid=1664,}, 0x0, ) == 0x0
 03695  1440   NtSetInformationThread  ... ) == 0x0
 03694  2016   NtAllocateVirtualMemory  ... 9625600, 4096, ) == 0x0
 03696   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81950, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81950, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\260\2\0\0\344\4\0\0\200\6\0\0" ...  ...
 03697  2016   NtAllocateVirtualMemory  (-1, 9621504, 0, 4096, 4096, 260, ...
 03696   896   NtRequestWaitReplyPort  ... {28, 56, reply, 0, 1252, 896, 81951, 0}  ... {28, 56, reply, 0, 1252, 896, 81951, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\260\2\0\0\344\4\0\0\200\6\0\0" )  ) == 0x0
 03697  2016   NtAllocateVirtualMemory  ... 9621504, 4096, ) == 0x0
 03698   896   NtResumeThread  (688, ...
 03699  2016   NtAllocateVirtualMemory  (-1, 9617408, 0, 4096, 4096, 260, ...
 03698   896   NtResumeThread  ... 1, ) == 0x0
 03699  2016   NtAllocateVirtualMemory  ... 9617408, 4096, ) == 0x0
 03700   896   NtAllocateVirtualMemory  (-1, 0, 0, 2097152, 8192, 4, ...
 03701  2016   NtAllocateVirtualMemory  (-1, 9613312, 0, 4096, 4096, 260, ...
 03702  1440   NtWaitForSingleObject  (316, 0, 0x0, ...
 03703  1664   NtTestAlert  (...
 03700   896   NtAllocateVirtualMemory  ... 182452224, 2097152, ) == 0x0
 03701  2016   NtAllocateVirtualMemory  ... 9613312, 4096, ) == 0x0
 03703  1664   NtTestAlert  ... ) == 0x0
 03704   896   NtAllocateVirtualMemory  (-1, 184541184, 0, 8192, 4096, 4, ...
 03705  2016   NtAllocateVirtualMemory  (-1, 9609216, 0, 4096, 4096, 260, ...
 03706  1664   NtContinue  (182451504, 1, ...
 03704   896   NtAllocateVirtualMemory  ... 184541184, 8192, ) == 0x0
 03705  2016   NtAllocateVirtualMemory  ... 9609216, 4096, ) == 0x0
 03707  1664   NtRegisterThreadTerminatePort  (24, ...
 03708   896   NtProtectVirtualMemory  (-1, (0xaffe000), 4096, 260, ...
 03709  2016   NtAllocateVirtualMemory  (-1, 9605120, 0, 4096, 4096, 260, ...
 03707  1664   NtRegisterThreadTerminatePort  ... ) == 0x0
 03708   896   NtProtectVirtualMemory  ... (0xaffe000), 4096, 4, ) == 0x0
 03709  2016   NtAllocateVirtualMemory  ... 9605120, 4096, ) == 0x0
 03710   896   NtCreateThread  (0x1f03ff, 0x0, -1, 2292532, 2292476, 1, ...
 03711  2016   NtAllocateVirtualMemory  (-1, 9601024, 0, 4096, 4096, 260, ...
 03712  1664   NtSetInformationThread  (-2, BasePriority, {thread info, class 3, size 4}, 4, ...
 03710   896   NtCreateThread  ... 692, {1252, 1972}, ) == 0x0
 03713   896   NtQueryInformationThread  (692, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ff6a000,Pid=1252,Tid=1972,}, 0x0, ) == 0x0
 03714   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81951, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81951, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\264\2\0\0\344\4\0\0\264\7\0\0" ... {28, 56, reply, 0, 1252, 896, 81952, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\264\2\0\0\344\4\0\0\264\7\0\0" )  ... {28, 56, reply, 0, 1252, 896, 81952, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81951, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\264\2\0\0\344\4\0\0\264\7\0\0" ... {28, 56, reply, 0, 1252, 896, 81952, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\264\2\0\0\344\4\0\0\264\7\0\0" )  ) == 0x0
 03715   896   NtResumeThread  (692, ... 1, ) == 0x0
 03716   896   NtAllocateVirtualMemory  (-1, 0, 0, 2097152, 8192, 4, ... 184549376, 2097152, ) == 0x0
 03717   896   NtAllocateVirtualMemory  (-1, 186638336, 0, 8192, 4096, 4, ... 186638336, 8192, ) == 0x0
 03711  2016   NtAllocateVirtualMemory  ... 9601024, 4096, ) == 0x0
 03718  1972   NtTestAlert  (...
 03712  1664   NtSetInformationThread  ... ) == 0x0
 03719  2016   NtAllocateVirtualMemory  (-1, 9596928, 0, 4096, 4096, 260, ...
 03718  1972   NtTestAlert  ... ) == 0x0
 03720   896   NtProtectVirtualMemory  (-1, (0xb1fe000), 4096, 260, ...
 03719  2016   NtAllocateVirtualMemory  ... 9596928, 4096, ) == 0x0
 03721  1972   NtContinue  (184548656, 1, ...
 03720   896   NtProtectVirtualMemory  ... (0xb1fe000), 4096, 4, ) == 0x0
 03722  2016   NtAllocateVirtualMemory  (-1, 9592832, 0, 4096, 4096, 260, ...
 03723  1972   NtRegisterThreadTerminatePort  (24, ...
 03724   896   NtCreateThread  (0x1f03ff, 0x0, -1, 2292532, 2292476, 1, ...
 03722  2016   NtAllocateVirtualMemory  ... 9592832, 4096, ) == 0x0
 03723  1972   NtRegisterThreadTerminatePort  ... ) == 0x0
 03724   896   NtCreateThread  ... 696, {1252, 1036}, ) == 0x0
 03725  2016   NtAllocateVirtualMemory  (-1, 9588736, 0, 4096, 4096, 260, ...
 03726  1664   NtWaitForSingleObject  (316, 0, 0x0, ...
 03727   896   NtQueryInformationThread  (696, Basic, 28, ...
 03728  1972   NtSetInformationThread  (-2, BasePriority, {thread info, class 3, size 4}, 4, ...
 03725  2016   NtAllocateVirtualMemory  ... 9588736, 4096, ) == 0x0
 03727   896   NtQueryInformationThread  ... {ExitStatus=0x103,TebBaseAddress=0x7ff69000,Pid=1252,Tid=1036,}, 0x0, ) == 0x0
 03729  2016   NtAllocateVirtualMemory  (-1, 9584640, 0, 4096, 4096, 260, ...
 03728  1972   NtSetInformationThread  ... ) == 0x0
 03729  2016   NtAllocateVirtualMemory  ... 9584640, 4096, ) == 0x0
 03730   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81952, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81952, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\270\2\0\0\344\4\0\0\14\4\0\0" ...  ...
 03731  2016   NtAllocateVirtualMemory  (-1, 9580544, 0, 4096, 4096, 260, ...
 03730   896   NtRequestWaitReplyPort  ... {28, 56, reply, 0, 1252, 896, 81953, 0}  ... {28, 56, reply, 0, 1252, 896, 81953, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\270\2\0\0\344\4\0\0\14\4\0\0" )  ) == 0x0
 03731  2016   NtAllocateVirtualMemory  ... 9580544, 4096, ) == 0x0
 03732  1972   NtWaitForSingleObject  (316, 0, 0x0, ...
 03733  2016   NtAllocateVirtualMemory  (-1, 9576448, 0, 4096, 4096, 260, ...
 03734   896   NtResumeThread  (696, ... 1, ) == 0x0
 03735   896   NtAllocateVirtualMemory  (-1, 0, 0, 2097152, 8192, 4, ... 186646528, 2097152, ) == 0x0
 03736   896   NtAllocateVirtualMemory  (-1, 188735488, 0, 8192, 4096, 4, ... 188735488, 8192, ) == 0x0
 03737   896   NtProtectVirtualMemory  (-1, (0xb3fe000), 4096, 260, ... (0xb3fe000), 4096, 4, ) == 0x0
 03738   896   NtCreateThread  (0x1f03ff, 0x0, -1, 2292532, 2292476, 1, ... 700, {1252, 1248}, ) == 0x0
 03739   896   NtQueryInformationThread  (700, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ff68000,Pid=1252,Tid=1248,}, 0x0, ) == 0x0
 03733  2016   NtAllocateVirtualMemory  ... 9576448, 4096, ) == 0x0
 03740  1036   NtTestAlert  (...
 03741  2016   NtAllocateVirtualMemory  (-1, 9572352, 0, 4096, 4096, 260, ...
 03740  1036   NtTestAlert  ... ) == 0x0
 03741  2016   NtAllocateVirtualMemory  ... 9572352, 4096, ) == 0x0
 03742  1036   NtContinue  (186645808, 1, ...
 03743  2016   NtAllocateVirtualMemory  (-1, 9568256, 0, 4096, 4096, 260, ...
 03744  1036   NtRegisterThreadTerminatePort  (24, ...
 03743  2016   NtAllocateVirtualMemory  ... 9568256, 4096, ) == 0x0
 03744  1036   NtRegisterThreadTerminatePort  ... ) == 0x0
 03745  2016   NtAllocateVirtualMemory  (-1, 9564160, 0, 4096, 4096, 260, ...
 03746   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81953, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81953, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\274\2\0\0\344\4\0\0\340\4\0\0" ...  ...
 03747  1036   NtSetInformationThread  (-2, BasePriority, {thread info, class 3, size 4}, 4, ...
 03746   896   NtRequestWaitReplyPort  ... {28, 56, reply, 0, 1252, 896, 81954, 0}  ... {28, 56, reply, 0, 1252, 896, 81954, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\274\2\0\0\344\4\0\0\340\4\0\0" )  ) == 0x0
 03748   896   NtResumeThread  (700, ... 1, ) == 0x0
 03749   896   NtAllocateVirtualMemory  (-1, 0, 0, 2097152, 8192, 4, ... 188743680, 2097152, ) == 0x0
 03750   896   NtAllocateVirtualMemory  (-1, 190832640, 0, 8192, 4096, 4, ... 190832640, 8192, ) == 0x0
 03751   896   NtProtectVirtualMemory  (-1, (0xb5fe000), 4096, 260, ... (0xb5fe000), 4096, 4, ) == 0x0
 03752   896   NtCreateThread  (0x1f03ff, 0x0, -1, 2292532, 2292476, 1, ...
 03745  2016   NtAllocateVirtualMemory  ... 9564160, 4096, ) == 0x0
 03747  1036   NtSetInformationThread  ... ) == 0x0
 03753  1248   NtTestAlert  (...
 03754  2016   NtAllocateVirtualMemory  (-1, 9560064, 0, 4096, 4096, 260, ...
 03752   896   NtCreateThread  ... 704, {1252, 1656}, ) == 0x0
 03753  1248   NtTestAlert  ... ) == 0x0
 03754  2016   NtAllocateVirtualMemory  ... 9560064, 4096, ) == 0x0
 03755   896   NtQueryInformationThread  (704, Basic, 28, ...
 03756  1248   NtContinue  (188742960, 1, ...
 03757  2016   NtAllocateVirtualMemory  (-1, 9555968, 0, 4096, 4096, 260, ...
 03755   896   NtQueryInformationThread  ... {ExitStatus=0x103,TebBaseAddress=0x7ff67000,Pid=1252,Tid=1656,}, 0x0, ) == 0x0
 03758  1248   NtRegisterThreadTerminatePort  (24, ...
 03757  2016   NtAllocateVirtualMemory  ... 9555968, 4096, ) == 0x0
 03759   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81954, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81954, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\300\2\0\0\344\4\0\0x\6\0\0" ...  ...
 03758  1248   NtRegisterThreadTerminatePort  ... ) == 0x0
 03760  2016   NtAllocateVirtualMemory  (-1, 9551872, 0, 4096, 4096, 260, ...
 03759   896   NtRequestWaitReplyPort  ... {28, 56, reply, 0, 1252, 896, 81955, 0}  ... {28, 56, reply, 0, 1252, 896, 81955, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\300\2\0\0\344\4\0\0x\6\0\0" )  ) == 0x0
 03761  1036   NtWaitForSingleObject  (316, 0, 0x0, ...
 03762  1248   NtSetInformationThread  (-2, BasePriority, {thread info, class 3, size 4}, 4, ...
 03760  2016   NtAllocateVirtualMemory  ... 9551872, 4096, ) == 0x0
 03763   896   NtResumeThread  (704, ...
 03764  2016   NtAllocateVirtualMemory  (-1, 9547776, 0, 4096, 4096, 260, ...
 03763   896   NtResumeThread  ... 1, ) == 0x0
 03764  2016   NtAllocateVirtualMemory  ... 9547776, 4096, ) == 0x0
 03765   896   NtAllocateVirtualMemory  (-1, 0, 0, 2097152, 8192, 4, ...
 03766  2016   NtAllocateVirtualMemory  (-1, 9543680, 0, 4096, 4096, 260, ...
 03765   896   NtAllocateVirtualMemory  ... 190840832, 2097152, ) == 0x0
 03766  2016   NtAllocateVirtualMemory  ... 9543680, 4096, ) == 0x0
 03767   896   NtAllocateVirtualMemory  (-1, 192929792, 0, 8192, 4096, 4, ...
 03768  2016   NtAllocateVirtualMemory  (-1, 9539584, 0, 4096, 4096, 260, ...
 03767   896   NtAllocateVirtualMemory  ... 192929792, 8192, ) == 0x0
 03762  1248   NtSetInformationThread  ... ) == 0x0
 03769  1656   NtTestAlert  (...
 03768  2016   NtAllocateVirtualMemory  ... 9539584, 4096, ) == 0x0
 03770   896   NtProtectVirtualMemory  (-1, (0xb7fe000), 4096, 260, ...
 03769  1656   NtTestAlert  ... ) == 0x0
 03771  2016   NtCreateFile  (0xc0100081, {24, 0, 0x40, 0, 9547232,  (0xc0100081, {24, 0, 0x40, 0, 9547232, "\??\C:\WINDOWS\system32\magnify.exe"}, 0x0, 0, 0, 1, 96, 0, 0, ... }, 0x0, 0, 0, 1, 96, 0, 0, ...
 03770   896   NtProtectVirtualMemory  ... (0xb7fe000), 4096, 4, ) == 0x0
 03772  1656   NtContinue  (190840112, 1, ...
 03771  2016   NtCreateFile  ... 708, {status=0x0, info=1}, ) == 0x0
 03773   896   NtCreateThread  (0x1f03ff, 0x0, -1, 2292532, 2292476, 1, ...
 03774  1656   NtRegisterThreadTerminatePort  (24, ...
 03775  2016   NtQueryInformationFile  (708, 9547284, 24, Standard, ...
 03773   896   NtCreateThread  ... 712, {1252, 760}, ) == 0x0
 03774  1656   NtRegisterThreadTerminatePort  ... ) == 0x0
 03775  2016   NtQueryInformationFile  ... {status=0x0, info=24}, ) == 0x0
 03776   896   NtQueryInformationThread  (712, Basic, 28, ...
 03777  1248   NtWaitForSingleObject  (316, 0, 0x0, ...
 03778  2016   NtAllocateVirtualMemory  (-1, 5783552, 0, 278528, 4096, 4, ...
 03776   896   NtQueryInformationThread  ... {ExitStatus=0x103,TebBaseAddress=0x7ff66000,Pid=1252,Tid=760,}, 0x0, ) == 0x0
 03779  1656   NtSetInformationThread  (-2, BasePriority, {thread info, class 3, size 4}, 4, ...
 03778  2016   NtAllocateVirtualMemory  ... 5783552, 278528, ) == 0x0
 03780  2016   NtReadFile  (708, 0, 0, 0, 72704, 0x0, 0, ...
 03781   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81955, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81955, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\310\2\0\0\344\4\0\0\370\2\0\0" ... {28, 56, reply, 0, 1252, 896, 81956, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\310\2\0\0\344\4\0\0\370\2\0\0" )  ... {28, 56, reply, 0, 1252, 896, 81956, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81955, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\310\2\0\0\344\4\0\0\370\2\0\0" ... {28, 56, reply, 0, 1252, 896, 81956, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\310\2\0\0\344\4\0\0\370\2\0\0" )  ) == 0x0
 03782   896   NtResumeThread  (712, ... 1, ) == 0x0
 03783   896   NtAllocateVirtualMemory  (-1, 0, 0, 2097152, 8192, 4, ...