Summary:


NtGdiCreateBitmap(>) 
 1 
NtOpenDirectoryObject(>) 
 2 
NtQueryInformationFile(>) 
 8 
NtContinue(>) 
 97 

NtGdiInit(>) 
 1 
NtOpenProcessToken(>) 
 2 
NtUnmapViewOfSection(>) 
 8 
NtCreateEvent(>) 
 112 

NtGdiQueryFontAssocInfo(>) 
 1 
NtQueryDefaultUILanguage(>) 
 2 
NtOpenThreadToken(>) 
 9 
NtQuerySystemInformation(>) 
 115 

NtGdiSelectBitmap(>) 
 1 
NtSetInformationObject(>) 
 2 
NtQueryVirtualMemory(>) 
 9 
NtOpenKey(>) 
 134 

NtOpenKeyedEvent(>) 
 1 
NtFreeVirtualMemory(>) 
 3 
NtSetInformationThread(>) 
 9 
NtResumeThread(>) 
 134 

NtOpenSymbolicLinkObject(>) 
 1 
NtGdiCreateCompatibleDC(>) 
 3 
NtUserFindExistingCursorIcon(>) 
 9 
NtQueryInformationThread(>) 
 138 

NtQueryInstallUILanguage(>) 
 1 
NtOpenProcessTokenEx(>) 
 3 
NtSetInformationFile(>) 
 10 
NtCreateThread(>) 
 149 

NtQueryObject(>) 
 1 
NtOpenThreadTokenEx(>) 
 3 
NtQuerySection(>) 
 12 
NtRequestWaitReplyPort(>) 
 169 

NtQueryPerformanceCounter(>) 
 1 
NtQueryDefaultLocale(>) 
 3 
NtQueryDirectoryFile(>) 
 14 
NtRegisterThreadTerminatePort(>) 
 182 

NtQuerySymbolicLinkObject(>) 
 1 
NtReadFile(>) 
 3 
NtUserRegisterClassExWOW(>) 
 14 
NtTestAlert(>) 
 182 

NtQuerySystemTime(>) 
 1 
NtSecureConnectPort(>) 
 3 
NtCreateFile(>) 
 15 
NtDuplicateObject(>) 
 206 

NtRaiseException(>) 
 1 
NtCreateIoCompletion(>) 
 4 
NtSetValueKey(>) 
 17 
NtProtectVirtualMemory(>) 
 248 

NtSetInformationProcess(>) 
 1 
NtWriteFile(>) 
 4 
NtCreateKey(>) 
 19 
NtQueryValueKey(>) 
 253 

NtUserCallNoParam(>) 
 1 
NtGdiGetStockObject(>) 
 5 
NtOpenSection(>) 
 22 
NtClose(>) 
 320 

NtUserGetObjectInformation(>) 
 1 
NtConnectPort(>) 
 6 
NtOpenFile(>) 
 26 
NtAllocateVirtualMemory(>) 
 396 

NtUserGetProcessWindowStation(>) 
 1 
NtCreateMutant(>) 
 6 
NtMapViewOfSection(>) 
 35 
NtSetEventBoostPriority(>) 
 688 

NtUserGetThreadDesktop(>) 
 1 
NtQueryVolumeInformationFile(>) 
 6 
NtDeviceIoControlFile(>) 
 36 
NtWaitForSingleObject(>) 
 934 

NtCallbackReturn(>) 
 2 
NtQueryInformationProcess(>) 
 7 
NtQueryAttributesFile(>) 
 40 

NtGdiCreateSolidBrush(>) 
 2 
NtQueryInformationToken(>) 
 7 
NtFlushInstructionCache(>) 
 55 

NtNotifyChangeKey(>) 
 2 

Trace:
 00001   896   NtOpenFile  (0x80100000, {24, 0, 0x240, 0, 0,  (0x80100000, {24, 0, 0x240, 0, 0, "\SystemRoot\Prefetch\PACKED.EXE-09ED06A1.pf"}, 0, 32, ... -2147481368, {status=0x0, info=1}, ) }, 0, 32, ... -2147481368, {status=0x0, info=1}, ) == 0x0
 00002   896   NtQueryInformationFile  (-2147481368, -142414796, 24, Standard, ... {status=0x0, info=24}, ) == 0x0
 00003   896   NtReadFile  (-2147481368, 0, 0, 0, 13474, 0x0, 0, ... {status=0x0, info=13474},  (-2147481368, 0, 0, 0, 13474, 0x0, 0, ... {status=0x0, info=13474}, "\21\0\0\0SCCA\17\0\0\0\2424\0\0P\0A\0C\0K\0E\0D\0.\0E\0X\0E\0\0\0\0\00\366i\201\0\0\0\0\0\0\0\0\20\0\0\0@-\201\367\0@\300\367\30,\201\367x@s\201@-\201\367\241\6\355\11\0\0\0\0\230\0\0\0\34\0\0\0\310\2\0\0\331\2\0\0\364$\0\0\36\14\0\0\301\0\0\1\0\0\0\212\3\0\0\200\14V6\217\260\310\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\1\0\0\0\1\0\0\0\0\0\0\01\0\0\0\0\0\0\02\0\0\0\2\0\0\01\0\0\0%\1\0\0f\0\0\05\0\0\0\6\0\0\0V\1\0\0\5\0\0\0\322\0\0\04\0\0\0\4\0\0\0[\1\0\0\3\0\0\0<\1\0\03\0\0\0\4\0\0\0^\1\0\0\4\0\0\0\244\1\0\05\0\0\0\4\0\0\0b\1\0\0\32\0\0\0\20\2\0\03\0\0\0\2\0\0\0|\1\0\0\23\0\0\0x\2\0\02\0\0\0\2\0\0\0\217\1\0\0\7\0\0\0\336\2\0\02\0\0\0\6\0\0\0\226\1\0\0\22\0\0\0D\3\0\05\0\0\0\2\0\0\0\250\1\0\0\14\0\0\0\260\3\0\03\0\0\0\2\0\0\0\264\1\0\0\13\0\0\0\30\4\0\05\0\0\0\2\0\0\0\277\1\0\0*\0\0\0\204\4\0\03\0\0\0\2\0\0\0\351\1\0\0\21\0\0\0\354\4\0\02\0\0\0\2\0\0\0\372\1\0\0\2\0\0\0R\5\0\02\0\0\0\4\0\0\0\374\1\0\0\1\0\0\0\270\5\0\04\0\0\0\4\0\0\0\375\1\0\0\22\0\0\0"\6\0\04\0\0\0\6\0\0\0\17\2\0\0\36\0\0\0\214\6\0\04\0\0\0\2\0\0\0-\2\0\0\13\0\0\0", ) \6\0\04\0\0\0\6\0\0\0\17\2\0\0\36\0\0\0\214\6\0\04\0\0\0\2\0\0\0-\2\0\0\13\0\0\0", ) == 0x0
 00004   896   NtClose  (-2147481368, ... ) == 0x0
 00005   896   NtCreateFile  (0x100080, {24, 0, 0x240, 0, 0,  (0x100080, {24, 0, 0x240, 0, 0, "\DEVICE\HARDDISKVOLUME1"}, 0x0, 0, 7, 1, 32, 0, 0, ... -2147481368, {status=0x0, info=0}, ) }, 0x0, 0, 7, 1, 32, 0, 0, ... -2147481368, {status=0x0, info=0}, ) == 0x0
 00006   896   NtQueryVolumeInformationFile  (-2147481368, -142414840, 8, Device, ... {status=0x0, info=8}, ) == 0x0
 00007   896   NtClose  (-2147481368, ... ) == 0x0
 00008   896   NtCreateFile  (0x100180, {24, 0, 0x240, 0, 0,  (0x100180, {24, 0, 0x240, 0, 0, "\DEVICE\HARDDISKVOLUME1"}, 0x0, 0, 7, 1, 32, 0, 0, ... }, 0x0, 0, 7, 1, 32, 0, 0, ...
 00009   896   NtContinue  (-142419640, 0, ...
 00008   896   NtCreateFile  ... -2147481368, {status=0x0, info=1}, ) == 0x0
 00010   896   NtQueryVolumeInformationFile  (-2147481368, -142414852, 24, Volume, ... {status=0x0, info=18}, ) == 0x0
 00011   896   NtFsControlFile  (-2147481368, 0, 0x0, 0x0, 0x90120,  (-2147481368, 0, 0x0, 0x0, 0x90120, "\1\0\0\0!\0\0\0H\10\0\0\0\0\1\0\2309\0\0\0\0\2\0\15\1\0\0\0\0\1\0\357\0\0\0\0\3\0X\244\0\0\0\0\4\0\217\10\0\0\0\0\1\0\214;\0\0\0\0\2\0XK\0\0\0\0\3\0f\10\0\0\0\0\1\0Z\10\0\0\0\0\1\0\304\10\0\0\0\0\1\0Y\10\0\0\0\0\1\0C\10\0\0\0\0\1\0/:\0\0\0\0\3\0\235\244\0\0\0\0\3\0\26\11\0\0\0\0\1\0\201\246\0\0\0\0\3\0\224\246\0\0\0\0\3\0@C\0\0\0\0\2\0r\10\0\0\0\0\1\0g\10\0\0\0\0\1\0\2\1\0\0\0\0\1\0o%\0\0\0\0\3\0\243\10\0\0\0\0\1\0q\10\0\0\0\0\1\0p\10\0\0\0\0\1\0@\31\0\0\0\0\1\0\2339\0\0\0\0\1\0\5\0\0\0\0\0\5\0\34\0\0\0\0\0\1\0'\0\0\0\0\0\1\0\210\0\0\0\0\0\1\0\2329\0\0\0\0\1\0", 272, 0, ... {status=0x0, info=0}, 0x0, ) , 272, 0, ... {status=0x0, info=0}, 0x0, ) == 0x0
 00012   896   NtCreateFile  (0x100001, {24, 0, 0x240, 0, 0,  (0x100001, {24, 0, 0x240, 0, 0, "\DEVICE\HARDDISKVOLUME1\"}, 0x0, 0, 7, 1, 16417, 0, 0, ... -2147482764, {status=0x0, info=1}, ) }, 0x0, 0, 7, 1, 16417, 0, 0, ... -2147482764, {status=0x0, info=1}, ) == 0x0
 00013   896   NtQueryDirectoryFile  (-2147482764, 0, 0, 0, -504332288, 16384, Names, 0, 0x0, -518446847, ... {status=0x0, info=1146}, ) == 0x0
 00014   896   NtQueryDirectoryFile  (-2147482764, 0, 0, 0, -504332288, 16384, Names, 0, 0x0, -518446848, ... ) == STATUS_NO_MORE_FILES
 00015   896   NtClose  (-2147482764, ... ) == 0x0
 00016   896   NtCreateFile  (0x100001, {24, 0, 0x240, 0, 0,  (0x100001, {24, 0, 0x240, 0, 0, "\DEVICE\HARDDISKVOLUME1\WINDOWS\"}, 0x0, 0, 7, 1, 16417, 0, 0, ... -2147482764, {status=0x0, info=1}, ) }, 0x0, 0, 7, 1, 16417, 0, 0, ... -2147482764, {status=0x0, info=1}, ) == 0x0
 00017   896   NtQueryDirectoryFile  (-2147482764, 0, 0, 0, -504332288, 16384, Names, 0, 0x0, -518446847, ... {status=0x0, info=15820}, ) == 0x0
 00018   896   NtQueryDirectoryFile  (-2147482764, 0, 0, 0, -504332288, 16384, Names, 0, 0x0, -518446848, ... ) == STATUS_NO_MORE_FILES
 00019   896   NtClose  (-2147482764, ... ) == 0x0
 00020   896   NtCreateFile  (0x100001, {24, 0, 0x240, 0, 0,  (0x100001, {24, 0, 0x240, 0, 0, "\DEVICE\HARDDISKVOLUME1\WINDOWS\SYSTEM32\"}, 0x0, 0, 7, 1, 16417, 0, 0, ... -2147482764, {status=0x0, info=1}, ) }, 0x0, 0, 7, 1, 16417, 0, 0, ... -2147482764, {status=0x0, info=1}, ) == 0x0
 00021   896   NtQueryDirectoryFile  (-2147482764, 0, 0, 0, -504332288, 16384, Names, 0, 0x0, -518446847, ... {status=0x0, info=16366}, ) == 0x0
 00022   896   NtQueryDirectoryFile  (-2147482764, 0, 0, 0, -504332288, 16384, Names, 0, 0x0, -518446848, ... {status=0x0, info=16354}, ) == 0x0
 00023   896   NtQueryDirectoryFile  (-2147482764, 0, 0, 0, -504332288, 16384, Names, 0, 0x0, -518446848, ... {status=0x0, info=16348}, ) == 0x0
 00024   896   NtQueryDirectoryFile  (-2147482764, 0, 0, 0, -504332288, 16384, Names, 0, 0x0, -518446848, ... {status=0x0, info=16364}, ) == 0x0
 00025   896   NtQueryDirectoryFile  (-2147482764, 0, 0, 0, -504332288, 16384, Names, 0, 0x0, -518446848, ... {status=0x0, info=11386}, ) == 0x0
 00026   896   NtQueryDirectoryFile  (-2147482764, 0, 0, 0, -504332288, 16384, Names, 0, 0x0, -518446848, ... ) == STATUS_NO_MORE_FILES
 00027   896   NtClose  (-2147482764, ... ) == 0x0
 00028   896   NtCreateFile  (0x100001, {24, 0, 0x240, 0, 0,  (0x100001, {24, 0, 0x240, 0, 0, "\DEVICE\HARDDISKVOLUME1\WINDOWS\WINSXS\"}, 0x0, 0, 7, 1, 16417, 0, 0, ... -2147482764, {status=0x0, info=1}, ) }, 0x0, 0, 7, 1, 16417, 0, 0, ... -2147482764, {status=0x0, info=1}, ) == 0x0
 00029   896   NtQueryDirectoryFile  (-2147482764, 0, 0, 0, -504332288, 16384, Names, 0, 0x0, -518446847, ... {status=0x0, info=2228}, ) == 0x0
 00030   896   NtQueryDirectoryFile  (-2147482764, 0, 0, 0, -504332288, 16384, Names, 0, 0x0, -518446848, ... ) == STATUS_NO_MORE_FILES
 00031   896   NtClose  (-2147482764, ... ) == 0x0
 00032   896   NtCreateFile  (0x100001, {24, 0, 0x240, 0, 0,  (0x100001, {24, 0, 0x240, 0, 0, "\DEVICE\HARDDISKVOLUME1\WINDOWS\WINSXS\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_6.0.2600.2982_X-WW_AC3F9C03\"}, 0x0, 0, 7, 1, 16417, 0, 0, ... -2147482764, {status=0x0, info=1}, ) }, 0x0, 0, 7, 1, 16417, 0, 0, ... -2147482764, {status=0x0, info=1}, ) == 0x0
 00033   896   NtQueryDirectoryFile  (-2147482764, 0, 0, 0, -504332288, 16384, Names, 0, 0x0, -518446847, ... {status=0x0, info=68}, ) == 0x0
 00034   896   NtQueryDirectoryFile  (-2147482764, 0, 0, 0, -504332288, 16384, Names, 0, 0x0, -518446848, ... ) == STATUS_NO_MORE_FILES
 00035   896   NtClose  (-2147482764, ... ) == 0x0
 00036   896   NtCreateSection  (0xd, {24, 0, 0x240, 0, 0, 0x0}, 0x0, 4, 67108864, -2147482764, ... -2147482688, ) == 0x0
 00037   896   NtClose  (-2147482688, ... ) == 0x0
 00038   896   NtCreateSection  (0xd, {24, 0, 0x240, 0, 0, 0x0}, 0x0, 4, 67108864, -2147482688, ... -2147482660, ) == 0x0
 00039   896   NtClose  (-2147482660, ... ) == 0x0
 00040   896   NtCreateSection  (0xd, {24, 0, 0x240, 0, 0, 0x0}, 0x0, 4, 67108864, -2147482660, ... -2147482656, ) == 0x0
 00041   896   NtClose  (-2147482656, ... ) == 0x0
 00042   896   NtCreateSection  (0xd, {24, 0, 0x240, 0, 0, 0x0}, 0x0, 4, 67108864, -2147482656, ... -2147482652, ) == 0x0
 00043   896   NtClose  (-2147482652, ... ) == 0x0
 00044   896   NtCreateSection  (0xd, {24, 0, 0x240, 0, 0, 0x0}, 0x0, 4, 67108864, -2147482652, ... -2147482724, ) == 0x0
 00045   896   NtClose  (-2147482724, ... ) == 0x0
 00046   896   NtCreateSection  (0xd, {24, 0, 0x240, 0, 0, 0x0}, 0x0, 4, 67108864, -2147482724, ... -2147481452, ) == 0x0
 00047   896   NtClose  (-2147481452, ... ) == 0x0
 00048   896   NtCreateSection  (0xd, {24, 0, 0x240, 0, 0, 0x0}, 0x0, 4, 67108864, -2147481452, ... -2147482684, ) == 0x0
 00049   896   NtClose  (-2147482684, ... ) == 0x0
 00050   896   NtCreateSection  (0xd, {24, 0, 0x240, 0, 0, 0x0}, 0x0, 4, 67108864, -2147482684, ... -2147482680, ) == 0x0
 00051   896   NtClose  (-2147482680, ... ) == 0x0
 00052   896   NtCreateSection  (0xd, {24, 0, 0x240, 0, 0, 0x0}, 0x0, 4, 67108864, -2147482680, ... -2147482760, ) == 0x0
 00053   896   NtClose  (-2147482760, ... ) == 0x0
 00054   896   NtCreateSection  (0xd, {24, 0, 0x240, 0, 0, 0x0}, 0x0, 4, 67108864, -2147482760, ... -2147481628, ) == 0x0
 00055   896   NtClose  (-2147481628, ... ) == 0x0
 00056   896   NtCreateSection  (0xd, {24, 0, 0x240, 0, 0, 0x0}, 0x0, 4, 67108864, -2147481628, ... -2147481484, ) == 0x0
 00057   896   NtClose  (-2147481484, ... ) == 0x0
 00058   896   NtCreateSection  (0xd, {24, 0, 0x240, 0, 0, 0x0}, 0x0, 4, 67108864, -2147481484, ... -2147481480, ) == 0x0
 00059   896   NtClose  (-2147481480, ... ) == 0x0
 00060   896   NtCreateSection  (0xd, {24, 0, 0x240, 0, 0, 0x0}, 0x0, 4, 67108864, -2147481480, ... -2147482136, ) == 0x0
 00061   896   NtClose  (-2147482136, ... ) == 0x0
 00062   896   NtCreateSection  (0xd, {24, 0, 0x240, 0, 0, 0x0}, 0x0, 4, 67108864, -2147482136, ... -2147482748, ) == 0x0
 00063   896   NtClose  (-2147482748, ... ) == 0x0
 00064   896   NtCreateSection  (0xd, {24, 0, 0x240, 0, 0, 0x0}, 0x0, 4, 67108864, -2147482748, ... -2147482676, ) == 0x0
 00065   896   NtClose  (-2147482676, ... ) == 0x0
 00066   896   NtCreateSection  (0xd, {24, 0, 0x240, 0, 0, 0x0}, 0x0, 4, 67108864, -2147482676, ... -2147482672, ) == 0x0
 00067   896   NtClose  (-2147482672, ... ) == 0x0
 00068   896   NtCreateSection  (0xd, {24, 0, 0x240, 0, 0, 0x0}, 0x0, 4, 67108864, -2147482672, ... -2147482668, ) == 0x0
 00069   896   NtClose  (-2147482668, ... ) == 0x0
 00070   896   NtCreateSection  (0xd, {24, 0, 0x240, 0, 0, 0x0}, 0x0, 4, 67108864, -2147482668, ... -2147482664, ) == 0x0
 00071   896   NtClose  (-2147482664, ... ) == 0x0
 00072   896   NtCreateSection  (0xd, {24, 0, 0x240, 0, 0, 0x0}, 0x0, 4, 67108864, -2147482664, ... -2147481588, ) == 0x0
 00073   896   NtClose  (-2147481588, ... ) == 0x0
 00074   896   NtCreateSection  (0xd, {24, 0, 0x240, 0, 0, 0x0}, 0x0, 4, 67108864, -2147481588, ... -2147481584, ) == 0x0
 00075   896   NtClose  (-2147481584, ... ) == 0x0
 00076   896   NtCreateSection  (0xd, {24, 0, 0x240, 0, 0, 0x0}, 0x0, 4, 67108864, -2147481584, ... -2147482692, ) == 0x0
 00077   896   NtClose  (-2147482692, ... ) == 0x0
 00078   896   NtCreateSection  (0xd, {24, 0, 0x240, 0, 0, 0x0}, 0x0, 4, 67108864, -2147482692, ... -2147481512, ) == 0x0
 00079   896   NtClose  (-2147481512, ... ) == 0x0
 00080   896   NtCreateSection  (0xd, {24, 0, 0x240, 0, 0, 0x0}, 0x0, 4, 67108864, -2147481512, ... -2147481580, ) == 0x0
 00081   896   NtClose  (-2147481580, ... ) == 0x0
 00082   896   NtCreateSection  (0xd, {24, 0, 0x240, 0, 0, 0x0}, 0x0, 4, 67108864, -2147481580, ... -2147481552, ) == 0x0
 00083   896   NtClose  (-2147481552, ... ) == 0x0
 00084   896   NtCreateSection  (0xd, {24, 0, 0x240, 0, 0, 0x0}, 0x0, 4, 67108864, -2147481552, ... -2147481592, ) == 0x0
 00085   896   NtClose  (-2147481592, ... ) == 0x0
 00086   896   NtCreateSection  (0xd, {24, 0, 0x240, 0, 0, 0x0}, 0x0, 4, 67108864, -2147481592, ... -2147481596, ) == 0x0
 00087   896   NtClose  (-2147481596, ... ) == 0x0
 00088   896   NtCreateSection  (0xd, {24, 0, 0x240, 0, 0, 0x0}, 0x0, 4, 67108864, -2147481596, ... -2147482108, ) == 0x0
 00089   896   NtClose  (-2147482108, ... ) == 0x0
 00090   896   NtCreateSection  (0xd, {24, 0, 0x240, 0, 0, 0x0}, 0x0, 4, 67108864, -2147482108, ... -2147482732, ) == 0x0
 00091   896   NtClose  (-2147482732, ... ) == 0x0
 00092   896   NtClose  (-2147482764, ... ) == 0x0
 00093   896   NtClose  (-2147482688, ... ) == 0x0
 00094   896   NtClose  (-2147482660, ... ) == 0x0
 00095   896   NtClose  (-2147482656, ... ) == 0x0
 00096   896   NtClose  (-2147482652, ... ) == 0x0
 00097   896   NtClose  (-2147482724, ... ) == 0x0
 00098   896   NtClose  (-2147481452, ... ) == 0x0
 00099   896   NtClose  (-2147482684, ... ) == 0x0
 00100   896   NtClose  (-2147482680, ... ) == 0x0
 00101   896   NtClose  (-2147482760, ... ) == 0x0
 00102   896   NtClose  (-2147481628, ... ) == 0x0
 00103   896   NtClose  (-2147481484, ... ) == 0x0
 00104   896   NtClose  (-2147481480, ... ) == 0x0
 00105   896   NtClose  (-2147482136, ... ) == 0x0
 00106   896   NtClose  (-2147482748, ... ) == 0x0
 00107   896   NtClose  (-2147482676, ... ) == 0x0
 00108   896   NtClose  (-2147482672, ... ) == 0x0
 00109   896   NtClose  (-2147482668, ... ) == 0x0
 00110   896   NtClose  (-2147482664, ... ) == 0x0
 00111   896   NtClose  (-2147481588, ... ) == 0x0
 00112   896   NtClose  (-2147481584, ... ) == 0x0
 00113   896   NtClose  (-2147482692, ... ) == 0x0
 00114   896   NtClose  (-2147481512, ... ) == 0x0
 00115   896   NtClose  (-2147481580, ... ) == 0x0
 00116   896   NtClose  (-2147481552, ... ) == 0x0
 00117   896   NtClose  (-2147481592, ... ) == 0x0
 00118   896   NtClose  (-2147481596, ... ) == 0x0
 00119   896   NtClose  (-2147482108, ... ) == 0x0
 00120   896   NtCreateSection  (0xd, {24, 0, 0x240, 0, 0, 0x0}, 0x0, 16, 16777216, -2147482108, ... -2147481596, ) == 0x0
 00121   896   NtClose  (-2147481596, ... ) == 0x0
 00122   896   NtCreateSection  (0xd, {24, 0, 0x240, 0, 0, 0x0}, 0x0, 16, 16777216, -2147481596, ... -2147481592, ) == 0x0
 00123   896   NtClose  (-2147481592, ... ) == 0x0
 00124   896   NtCreateSection  (0xd, {24, 0, 0x240, 0, 0, 0x0}, 0x0, 16, 16777216, -2147481592, ... -2147481552, ) == 0x0
 00125   896   NtClose  (-2147481552, ... ) == 0x0
 00126   896   NtCreateSection  (0xd, {24, 0, 0x240, 0, 0, 0x0}, 0x0, 16, 16777216, -2147481552, ... -2147481580, ) == 0x0
 00127   896   NtClose  (-2147481580, ... ) == 0x0
 00128   896   NtCreateSection  (0xd, {24, 0, 0x240, 0, 0, 0x0}, 0x0, 16, 16777216, -2147481580, ... -2147481512, ) == 0x0
 00129   896   NtClose  (-2147481512, ... ) == 0x0
 00130   896   NtCreateSection  (0xd, {24, 0, 0x240, 0, 0, 0x0}, 0x0, 16, 16777216, -2147481512, ... -2147482692, ) == 0x0
 00131   896   NtClose  (-2147482692, ... ) == 0x0
 00132   896   NtCreateSection  (0xd, {24, 0, 0x240, 0, 0, 0x0}, 0x0, 16, 16777216, -2147482692, ... -2147481584, ) == 0x0
 00133   896   NtClose  (-2147481584, ... ) == 0x0
 00134   896   NtCreateSection  (0xd, {24, 0, 0x240, 0, 0, 0x0}, 0x0, 16, 16777216, -2147481584, ... -2147481588, ) == 0x0
 00135   896   NtClose  (-2147481588, ... ) == 0x0
 00136   896   NtCreateSection  (0xd, {24, 0, 0x240, 0, 0, 0x0}, 0x0, 16, 16777216, -2147481588, ... -2147482664, ) == 0x0
 00137   896   NtClose  (-2147482664, ... ) == 0x0
 00138   896   NtCreateSection  (0xd, {24, 0, 0x240, 0, 0, 0x0}, 0x0, 16, 16777216, -2147482664, ... -2147482668, ) == 0x0
 00139   896   NtClose  (-2147482668, ... ) == 0x0
 00140   896   NtCreateSection  (0xd, {24, 0, 0x240, 0, 0, 0x0}, 0x0, 16, 16777216, -2147482668, ... -2147482672, ) == 0x0
 00141   896   NtClose  (-2147482672, ... ) == 0x0
 00142   896   NtCreateSection  (0xd, {24, 0, 0x240, 0, 0, 0x0}, 0x0, 16, 16777216, -2147482672, ... -2147482676, ) == 0x0
 00143   896   NtClose  (-2147482676, ... ) == 0x0
 00144   896   NtCreateSection  (0xd, {24, 0, 0x240, 0, 0, 0x0}, 0x0, 16, 16777216, -2147482676, ... -2147482748, ) == 0x0
 00145   896   NtClose  (-2147482748, ... ) == 0x0
 00146   896   NtCreateSection  (0xd, {24, 0, 0x240, 0, 0, 0x0}, 0x0, 16, 16777216, -2147482748, ... -2147482136, ) == 0x0
 00147   896   NtClose  (-2147482136, ... ) == 0x0
 00148   896   NtCreateSection  (0xd, {24, 0, 0x240, 0, 0, 0x0}, 0x0, 16, 16777216, -2147482136, ... -2147481480, ) == 0x0
 00149   896   NtClose  (-2147481480, ... ) == 0x0
 00150   896   NtCreateSection  (0xd, {24, 0, 0x240, 0, 0, 0x0}, 0x0, 16, 16777216, -2147481480, ... -2147481484, ) == 0x0
 00151   896   NtClose  (-2147481484, ... ) == 0x0
 00152   896   NtCreateSection  (0xd, {24, 0, 0x240, 0, 0, 0x0}, 0x0, 16, 16777216, -2147481484, ... -2147481628, ) == 0x0
 00153   896   NtClose  (-2147481628, ... ) == 0x0
 00154   896   NtCreateSection  (0xd, {24, 0, 0x240, 0, 0, 0x0}, 0x0, 16, 16777216, -2147481628, ... -2147482760, ) == 0x0
 00155   896   NtClose  (-2147482760, ... ) == 0x0
 00156   896   NtCreateSection  (0xd, {24, 0, 0x240, 0, 0, 0x0}, 0x0, 16, 16777216, -2147482760, ... -2147482680, ) == 0x0
 00157   896   NtClose  (-2147482680, ... ) == 0x0
 00158   896   NtCreateSection  (0xd, {24, 0, 0x240, 0, 0, 0x0}, 0x0, 16, 16777216, -2147482680, ... -2147482684, ) == 0x0
 00159   896   NtClose  (-2147482684, ... ) == 0x0
 00160   896   NtCreateSection  (0xd, {24, 0, 0x240, 0, 0, 0x0}, 0x0, 16, 16777216, -2147482684, ... -2147481452, ) == 0x0
 00161   896   NtClose  (-2147481452, ... ) == 0x0
 00162   896   NtCreateSection  (0xd, {24, 0, 0x240, 0, 0, 0x0}, 0x0, 16, 16777216, -2147481452, ... -2147482724, ) == 0x0
 00163   896   NtClose  (-2147482724, ... ) == 0x0
 00164   896   NtClose  (-2147482108, ... ) == 0x0
 00165   896   NtClose  (-2147481596, ... ) == 0x0
 00166   896   NtClose  (-2147481592, ... ) == 0x0
 00167   896   NtClose  (-2147481552, ... ) == 0x0
 00168   896   NtClose  (-2147481580, ... ) == 0x0
 00169   896   NtClose  (-2147481512, ... ) == 0x0
 00170   896   NtClose  (-2147482692, ... ) == 0x0
 00171   896   NtClose  (-2147481584, ... ) == 0x0
 00172   896   NtClose  (-2147481588, ... ) == 0x0
 00173   896   NtClose  (-2147482664, ... ) == 0x0
 00174   896   NtClose  (-2147482668, ... ) == 0x0
 00175   896   NtClose  (-2147482672, ... ) == 0x0
 00176   896   NtClose  (-2147482676, ... ) == 0x0
 00177   896   NtClose  (-2147482748, ... ) == 0x0
 00178   896   NtClose  (-2147482136, ... ) == 0x0
 00179   896   NtClose  (-2147481480, ... ) == 0x0
 00180   896   NtClose  (-2147481484, ... ) == 0x0
 00181   896   NtClose  (-2147481628, ... ) == 0x0
 00182   896   NtClose  (-2147482760, ... ) == 0x0
 00183   896   NtClose  (-2147482680, ... ) == 0x0
 00184   896   NtClose  (-2147482684, ... ) == 0x0
 00185   896   NtClose  (-2147481452, ... ) == 0x0
 00186   896   NtClose  (-2147481368, ... ) == 0x0
 00187   896   NtOpenKey  (0x80000000, {24, 0, 0x40, 0, 0,  (0x80000000, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\packed.exe"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00188   896   NtOpenKeyedEvent  (0x2000000, {24, 0, 0x0, 0, 0,  (0x2000000, {24, 0, 0x0, 0, 0, "\KernelObjects\CritSecOutOfMemoryEvent"}, ... 4, ) }, ... 4, ) == 0x0
 00189   896   NtQuerySystemInformation  (Basic, 44, ... {Unknown=0,MaximumIncrement=156250,PhysicalPageSize=0x1000,NumberOfPhysicalPages=0xff7c,LowestPhysicalPage=0x1,HighestPhysicalPage=0xffff,AllocationGranularity=0x10000,LowestUserAddress=0x10000,HighestUserAddress=0x7ffeffff,ActiveProcessors=1,NumberProcessors=1,}, 0x0, ) == 0x0
 00190   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ... 1310720, 1048576, ) == 0x0
 00191   896   NtAllocateVirtualMemory  (-1, 1310720, 0, 4096, 4096, 4, ... 1310720, 4096, ) == 0x0
 00192   896   NtAllocateVirtualMemory  (-1, 1314816, 0, 8192, 4096, 4, ... 1314816, 8192, ) == 0x0
 00193   896   NtQuerySystemInformation  (Basic, 44, ... {Unknown=0,MaximumIncrement=156250,PhysicalPageSize=0x1000,NumberOfPhysicalPages=0xff7c,LowestPhysicalPage=0x1,HighestPhysicalPage=0xffff,AllocationGranularity=0x10000,LowestUserAddress=0x10000,HighestUserAddress=0x7ffeffff,ActiveProcessors=1,NumberProcessors=1,}, 0x0, ) == 0x0
 00194   896   NtAllocateVirtualMemory  (-1, 0, 0, 65536, 8192, 4, ... 2359296, 65536, ) == 0x0
 00195   896   NtAllocateVirtualMemory  (-1, 2359296, 0, 24576, 4096, 4, ... 2359296, 24576, ) == 0x0
 00196   896   NtOpenDirectoryObject  (0x3, {24, 0, 0x40, 0, 0,  (0x3, {24, 0, 0x40, 0, 0, "\KnownDlls"}, ... 8, ) }, ... 8, ) == 0x0
 00197   896   NtOpenSymbolicLinkObject  (0x1, {24, 8, 0x40, 0, 0,  (0x1, {24, 8, 0x40, 0, 0, "KnownDllPath"}, ... 12, ) }, ... 12, ) == 0x0
 00198   896   NtQuerySymbolicLinkObject  (12, ...  (12, ... "C:\WINDOWS\system32", 0x0, ) , 0x0, ) == 0x0
 00199   896   NtClose  (12, ... ) == 0x0
 00200   896   NtOpenFile  (0x100020, {24, 0, 0x42, 0, 0,  (0x100020, {24, 0, 0x42, 0, 0, "\??\C:\scripts\"}, 3, 33, ... 12, {status=0x0, info=1}, ) }, 3, 33, ... 12, {status=0x0, info=1}, ) == 0x0
 00201   896   NtQueryVolumeInformationFile  (12, 1243852, 8, Device, ... {status=0x0, info=8}, ) == 0x0
 00202   896   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\u:\work\packed.exe.Local"}, 1243804, ... ) }, 1243804, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00203   896   NtOpenSection  (0xe, {24, 8, 0x40, 0, 0,  (0xe, {24, 8, 0x40, 0, 0, "kernel32.dll"}, ... 16, ) }, ... 16, ) == 0x0
 00204   896   NtMapViewOfSection  (16, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x7c800000), 0x0, 1003520, ) == 0x0
 00205   896   NtClose  (16, ... ) == 0x0
 00206   896   NtProtectVirtualMemory  (-1, (0x7c801000), 1568, 4, ... (0x7c801000), 4096, 32, ) == 0x0
 00207   896   NtProtectVirtualMemory  (-1, (0x7c801000), 4096, 32, ... (0x7c801000), 4096, 4, ) == 0x0
 00208   896   NtFlushInstructionCache  (-1, 2088767488, 1568, ... ) == 0x0
 00209   896   NtQueryInformationProcess  (-1, 36, 4, ... {process info, class 36, size 4}, 0x0, ) == 0x0
 00210   896   NtQuerySystemInformation  (RangeStart, 4, ... {system info, class 50, size 4}, 0x0, ) == 0x0
 00211   896   NtQuerySystemInformation  (Basic, 44, ... {Unknown=0,MaximumIncrement=156250,PhysicalPageSize=0x1000,NumberOfPhysicalPages=0xff7c,LowestPhysicalPage=0x1,HighestPhysicalPage=0xffff,AllocationGranularity=0x10000,LowestUserAddress=0x10000,HighestUserAddress=0x7ffeffff,ActiveProcessors=1,NumberProcessors=1,}, 0x0, ) == 0x0
 00212   896   NtCreateSection  (0xf001f, 0x0, {65536, 0}, 4, 67108864, 0, ... 16, ) == 0x0
 00213   896   NtSecureConnectPort  ( ("\Windows\ApiPort", {0, 2, 1, 1}, {24, 16, 0, 65536, 0, 0}, 1319736, {12, 0, 0}, 1241944, 44, ... 24, {24, 16, 0, 65536, 2424832, 18939904}, {0, 0, 0}, 200, 44, ) , {0, 2, 1, 1}, {24, 16, 0, 65536, 0, 0}, 1319736, {12, 0, 0}, 1241944, 44, ... 24, {24, 16, 0, 65536, 2424832, 18939904}, {0, 0, 0}, 200, 44, ) == 0x0
 00214   896   NtClose  (16, ... ) == 0x0
 00215   896   NtQueryObject  (24, Handle, 2, ... {Inherit=0,ProtectFromClose=0,}, -1, ) == 0x0
 00216   896   NtSetInformationObject  (24, Handle, {Inherit=0,ProtectFromClose=1,}, 256, ... ) == 0x0
 00217   896   NtQuerySystemInformation  (Basic, 44, ... {Unknown=0,MaximumIncrement=156250,PhysicalPageSize=0x1000,NumberOfPhysicalPages=0xff7c,LowestPhysicalPage=0x1,HighestPhysicalPage=0xffff,AllocationGranularity=0x10000,LowestUserAddress=0x10000,HighestUserAddress=0x7ffeffff,ActiveProcessors=1,NumberProcessors=1,}, 0x0, ) == 0x0
 00218   896   NtQueryVirtualMemory  (-1, 0x250000, Basic, 28, ... {BaseAddress=0x250000,AllocationBase=0x250000,AllocationProtect=0x4,RegionSize=0x10000,State=0x2000,Protect=0x0,Type=0x40000,}, 0x0, ) == 0x0
 00219   896   NtAllocateVirtualMemory  (-1, 2424832, 0, 4096, 4096, 4, ... 2424832, 4096, ) == 0x0
 00220   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1242260, 1242460, 2089900544, 1242184}  (24, {28, 56, new_msg, 0, 1242260, 1242460, 2089900544, 1242184} "\210\6!\1\0\0\0\0eZ\221|\0\0\0\0\1\0\0\0\234\6!\1\4\0\0\0" ... {28, 56, reply, 0, 1252, 896, 81831, 0} "\370\374\27\0\0\0\0\0\0\0\0\0\0\0\0\0\1\0\0\0\234\6!\1\4\0\0\0" )  ... {28, 56, reply, 0, 1252, 896, 81831, 0}  (24, {28, 56, new_msg, 0, 1242260, 1242460, 2089900544, 1242184} "\210\6!\1\0\0\0\0eZ\221|\0\0\0\0\1\0\0\0\234\6!\1\4\0\0\0" ... {28, 56, reply, 0, 1252, 896, 81831, 0} "\370\374\27\0\0\0\0\0\0\0\0\0\0\0\0\0\1\0\0\0\234\6!\1\4\0\0\0" )  ) == 0x0
 00221   896   NtRegisterThreadTerminatePort  (24, ... ) == 0x0
 00222   896   NtAllocateVirtualMemory  (-1, 1232896, 0, 4096, 4096, 260, ... 1232896, 4096, ) == 0x0
 00223   896   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\System\CurrentControlSet\Control\Terminal Server"}, ... 16, ) }, ... 16, ) == 0x0
 00224   896   NtQueryValueKey  (16,  (16, "TSAppCompat", Partial, 548, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) , Partial, 548, ... TitleIdx=0, Type=4, Data= (16, "TSAppCompat", Partial, 548, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) }, 16, ) == 0x0
 00225   896   NtClose  (16, ... ) == 0x0
 00226   896   NtOpenSection  (0x4, {24, 0, 0x40, 0, 0,  (0x4, {24, 0, 0x40, 0, 0, "\NLS\NlsSectionUnicode"}, ... 16, ) }, ... 16, ) == 0x0
 00227   896   NtMapViewOfSection  (16, -1, (0x0), 0, 0, 0x0, 0, 2, 0, 2, ... (0x260000), 0x0, 90112, ) == 0x0
 00228   896   NtClose  (16, ... ) == 0x0
 00229   896   NtQueryDefaultLocale  (0, 2089305000, ... ) == 0x0
 00230   896   NtOpenSection  (0x4, {24, 0, 0x40, 0, 0,  (0x4, {24, 0, 0x40, 0, 0, "\NLS\NlsSectionLocale"}, ... 16, ) }, ... 16, ) == 0x0
 00231   896   NtMapViewOfSection  (16, -1, (0x0), 0, 0, 0x0, 0, 2, 0, 2, ... (0x280000), 0x0, 249856, ) == 0x0
 00232   896   NtClose  (16, ... ) == 0x0
 00233   896   NtOpenSection  (0x5, {24, 0, 0x40, 0, 0,  (0x5, {24, 0, 0x40, 0, 0, "\NLS\NlsSectionSortkey"}, ... 16, ) }, ... 16, ) == 0x0
 00234   896   NtMapViewOfSection  (16, -1, (0x0), 0, 0, 0x0, 0, 2, 0, 2, ... (0x2c0000), 0x0, 266240, ) == 0x0
 00235   896   NtQuerySection  (16, Basic, 16, ... {BaseAddress=0x0,Attributes=0x800000,Size={0x40004, 0x0},}, 0x0, ) == 0x0
 00236   896   NtClose  (16, ... ) == 0x0
 00237   896   NtOpenSection  (0x4, {24, 0, 0x40, 0, 0,  (0x4, {24, 0, 0x40, 0, 0, "\NLS\NlsSectionSortTbls"}, ... 16, ) }, ... 16, ) == 0x0
 00238   896   NtMapViewOfSection  (16, -1, (0x0), 0, 0, 0x0, 0, 2, 0, 2, ... (0x310000), 0x0, 24576, ) == 0x0
 00239   896   NtClose  (16, ... ) == 0x0
 00240   896   NtQueryVirtualMemory  (-1, 0x7ffd2000, Basic, 28, ... {BaseAddress=0x7ffd2000,AllocationBase=0x7ffb0000,AllocationProtect=0x2,RegionSize=0x2000,State=0x1000,Protect=0x2,Type=0x40000,}, 0x0, ) == 0x0
 00241   896   NtOpenSection  (0x4, {24, 0, 0x40, 0, 0,  (0x4, {24, 0, 0x40, 0, 0, "\NLS\NlsSectionSortkey00000409"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00242   896   NtOpenSection  (0x4, {24, 0, 0x40, 0, 0,  (0x4, {24, 0, 0x40, 0, 0, "\NLS\NlsSectionSortkey00000409"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00243   896   NtAllocateVirtualMemory  (-1, 2428928, 0, 8192, 4096, 4, ... 2428928, 8192, ) == 0x0
 00244   896   NtRequestWaitReplyPort  (24, {24, 52, new_msg, 0, 7012468, 7929957, 3145776, 3145776}  (24, {24, 52, new_msg, 0, 7012468, 7929957, 3145776, 3145776} "\210\6!\1\36\0\1\0\0\0\0\0\377\377\377\377\234\6!\1p\30\0\0" ... {24, 52, reply, 0, 1252, 896, 81832, 0} "\10P\30\0\36\0\1\0\0\0\0\0\377\377\377\377\234\6!\1p\30\0\0" )  ... {24, 52, reply, 0, 1252, 896, 81832, 0}  (24, {24, 52, new_msg, 0, 7012468, 7929957, 3145776, 3145776} "\210\6!\1\36\0\1\0\0\0\0\0\377\377\377\377\234\6!\1p\30\0\0" ... {24, 52, reply, 0, 1252, 896, 81832, 0} "\10P\30\0\36\0\1\0\0\0\0\0\377\377\377\377\234\6!\1p\30\0\0" )  ) == 0x0
 00245   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 2089305760, 2090321376, 0, 0}  (24, {28, 56, new_msg, 0, 2089305760, 2090321376, 0, 0} "\210\6!\1\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\234\6!\18\6\0\0" ... {28, 56, reply, 0, 1252, 896, 81833, 0} "\250\202\26\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\234\6!\18\6\0\0" )  ... {28, 56, reply, 0, 1252, 896, 81833, 0}  (24, {28, 56, new_msg, 0, 2089305760, 2090321376, 0, 0} "\210\6!\1\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\234\6!\18\6\0\0" ... {28, 56, reply, 0, 1252, 896, 81833, 0} "\250\202\26\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\234\6!\18\6\0\0" )  ) == 0x0
 00246   896   NtProtectVirtualMemory  (-1, (0x409000), 90128, 4, ... (0x409000), 94208, 128, ) == 0x0
 00247   896   NtProtectVirtualMemory  (-1, (0x409000), 94208, 128, ... (0x409000), 94208, 4, ) == 0x0
 00248   896   NtFlushInstructionCache  (-1, 4231168, 90128, ... ) == 0x0
 00249   896   NtQueryInformationProcess  (-1, 37, 48, ... {process info, class 37, size 48}, 0x0, ) == 0x0
 00250   896   NtSetInformationProcess  (-1, 34, {process info, class 34, size 4}, 4, ... ) == 0x0
 00251   896   NtOpenProcessToken  (-1, 0x8, ... 16, ) == 0x0
 00252   896   NtQueryInformationToken  (16, Statistics, 56, ... {token info, class 10, size 56}, 56, ) == 0x0
 00253   896   NtClose  (16, ... ) == 0x0
 00254   896   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\System\CurrentControlSet\Control\Terminal Server"}, ... 16, ) }, ... 16, ) == 0x0
 00255   896   NtQueryValueKey  (16,  (16, "TSAppCompat", Partial, 548, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) , Partial, 548, ... TitleIdx=0, Type=4, Data= (16, "TSAppCompat", Partial, 548, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) }, 16, ) == 0x0
 00256   896   NtClose  (16, ... ) == 0x0
 00257   896   NtTestAlert  (... ) == 0x0
 00258   896   NtContinue  (1244464, 1, ...
 00259   896   NtSetInformationThread  (-2, Win32StartAddress(LpcReceivedMessageId), {StartAddress(LpcReceivedMsgId)=0x419010,}, 4, ... ) == 0x0
 00260   896   NtQueryVirtualMemory  (-1, 0x40980f, Basic, 28, ... {BaseAddress=0x409000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x1000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 00261   896   NtContinue  (1244400, 0, ...
 00262   896   NtAllocateVirtualMemory  (-1, 0, 0, 2395, 4096, 64, ... 3276800, 4096, ) == 0x0
 00263   896   NtOpenKey  (0x1, {24, 0, 0x40, 0, 0,  (0x1, {24, 0, 0x40, 0, 0, "\Registry\MACHINE\System\CurrentControlSet\Control\Session Manager"}, ... 16, ) }, ... 16, ) == 0x0
 00264   896   NtQueryValueKey  (16,  (16, "SafeDllSearchMode", Partial, 16, ... ) , Partial, 16, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00265   896   NtClose  (16, ... ) == 0x0
 00266   896   NtAllocateVirtualMemory  (-1, 1323008, 0, 4096, 4096, 4, ... 1323008, 4096, ) == 0x0
 00267   896   NtOpenSection  (0xe, {24, 8, 0x40, 0, 0,  (0xe, {24, 8, 0x40, 0, 0, "user32.dll"}, ... 16, ) }, ... 16, ) == 0x0
 00268   896   NtMapViewOfSection  (16, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x7e410000), 0x0, 589824, ) == 0x0
 00269   896   NtClose  (16, ... ) == 0x0
 00270   896   NtOpenSection  (0xe, {24, 8, 0x40, 0, 0,  (0xe, {24, 8, 0x40, 0, 0, "GDI32.dll"}, ... 16, ) }, ... 16, ) == 0x0
 00271   896   NtMapViewOfSection  (16, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x77f10000), 0x0, 290816, ) == 0x0
 00272   896   NtClose  (16, ... ) == 0x0
 00273   896   NtProtectVirtualMemory  (-1, (0x77f11000), 508, 4, ... (0x77f11000), 4096, 32, ) == 0x0
 00274   896   NtProtectVirtualMemory  (-1, (0x77f11000), 4096, 32, ... (0x77f11000), 4096, 4, ) == 0x0
 00275   896   NtFlushInstructionCache  (-1, 2012286976, 508, ... ) == 0x0
 00276   896   NtProtectVirtualMemory  (-1, (0x77f11000), 508, 4, ... (0x77f11000), 4096, 32, ) == 0x0
 00277   896   NtProtectVirtualMemory  (-1, (0x77f11000), 4096, 32, ... (0x77f11000), 4096, 4, ) == 0x0
 00278   896   NtFlushInstructionCache  (-1, 2012286976, 508, ... ) == 0x0
 00279   896   NtProtectVirtualMemory  (-1, (0x77f11000), 508, 4, ... (0x77f11000), 4096, 32, ) == 0x0
 00280   896   NtProtectVirtualMemory  (-1, (0x77f11000), 4096, 32, ... (0x77f11000), 4096, 4, ) == 0x0
 00281   896   NtFlushInstructionCache  (-1, 2012286976, 508, ... ) == 0x0
 00282   896   NtProtectVirtualMemory  (-1, (0x7e411000), 1252, 4, ... (0x7e411000), 4096, 32, ) == 0x0
 00283   896   NtProtectVirtualMemory  (-1, (0x7e411000), 4096, 32, ... (0x7e411000), 4096, 4, ) == 0x0
 00284   896   NtFlushInstructionCache  (-1, 2118193152, 1252, ... ) == 0x0
 00285   896   NtProtectVirtualMemory  (-1, (0x7e411000), 1252, 4, ... (0x7e411000), 4096, 32, ) == 0x0
 00286   896   NtProtectVirtualMemory  (-1, (0x7e411000), 4096, 32, ... (0x7e411000), 4096, 4, ) == 0x0
 00287   896   NtFlushInstructionCache  (-1, 2118193152, 1252, ... ) == 0x0
 00288   896   NtProtectVirtualMemory  (-1, (0x7e411000), 1252, 4, ... (0x7e411000), 4096, 32, ) == 0x0
 00289   896   NtProtectVirtualMemory  (-1, (0x7e411000), 4096, 32, ... (0x7e411000), 4096, 4, ) == 0x0
 00290   896   NtFlushInstructionCache  (-1, 2118193152, 1252, ... ) == 0x0
 00291   896   NtOpenKey  (0x80000000, {24, 0, 0x40, 0, 0,  (0x80000000, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\GDI32.dll"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00292   896   NtOpenKey  (0x80000000, {24, 0, 0x40, 0, 0,  (0x80000000, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\user32.dll"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00293   896   NtQuerySystemInformation  (Basic, 44, ... {Unknown=0,MaximumIncrement=156250,PhysicalPageSize=0x1000,NumberOfPhysicalPages=0xff7c,LowestPhysicalPage=0x1,HighestPhysicalPage=0xffff,AllocationGranularity=0x10000,LowestUserAddress=0x10000,HighestUserAddress=0x7ffeffff,ActiveProcessors=1,NumberProcessors=1,}, 0x0, ) == 0x0
 00294   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 2089900645, 0, 2090320576, 1241608}  (24, {28, 56, new_msg, 0, 2089900645, 0, 2090320576, 1241608} "\210\6!\1\0\0\0\0\344\0\23\0\4\0\0\0\3\0\0\0\234\6!\1$\1\0\0" ... {28, 56, reply, 0, 1252, 896, 81834, 0} "\320G\26\0\0\0\0\0\0\0\0\0\4\0\0\0\3\0\0\0\234\6!\1$\1\0\0" )  ... {28, 56, reply, 0, 1252, 896, 81834, 0}  (24, {28, 56, new_msg, 0, 2089900645, 0, 2090320576, 1241608} "\210\6!\1\0\0\0\0\344\0\23\0\4\0\0\0\3\0\0\0\234\6!\1$\1\0\0" ... {28, 56, reply, 0, 1252, 896, 81834, 0} "\320G\26\0\0\0\0\0\0\0\0\0\4\0\0\0\3\0\0\0\234\6!\1$\1\0\0" )  ) == 0x0
 00295   896   NtFsControlFile  (12, 0, 0x0, 0x0, 0x90028, 0x0, 0, 0, ... {status=0x0, info=0}, 0x0, ) == 0x0
 00296   896   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\IMM32.DLL"}, 1239000, ... ) }, 1239000, ... ) == 0x0
 00297   896   NtOpenFile  (0x100020, {24, 0, 0x40, 0, 0,  (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\IMM32.DLL"}, 5, 96, ... 16, {status=0x0, info=1}, ) }, 5, 96, ... 16, {status=0x0, info=1}, ) == 0x0
 00298   896   NtCreateSection  (0xe, 0x0, 0x0, 16, 134217728, 16, ... 28, ) == 0x0
 00299   896   NtClose  (16, ... ) == 0x0
 00300   896   NtMapViewOfSection  (28, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 16, ... (0x420000), 0x0, 110592, ) == 0x0
 00301   896   NtClose  (28, ... ) == 0x0
 00302   896   NtUnmapViewOfSection  (-1, 0x420000, ... ) == 0x0
 00303   896   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\IMM32.DLL"}, 1238908, ... ) }, 1238908, ... ) == 0x0
 00304   896   NtOpenFile  (0x100020, {24, 0, 0x40, 0, 0,  (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\IMM32.DLL"}, 5, 96, ... 28, {status=0x0, info=1}, ) }, 5, 96, ... 28, {status=0x0, info=1}, ) == 0x0
 00305   896   NtCreateSection  (0xe, 0x0, 0x0, 16, 134217728, 28, ... 16, ) == 0x0
 00306   896   NtClose  (28, ... ) == 0x0
 00307   896   NtMapViewOfSection  (16, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 16, ... (0x420000), 0x0, 110592, ) == 0x0
 00308   896   NtClose  (16, ... ) == 0x0
 00309   896   NtUnmapViewOfSection  (-1, 0x420000, ... ) == 0x0
 00310   896   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\IMM32.DLL"}, 1239216, ... ) }, 1239216, ... ) == 0x0
 00311   896   NtOpenFile  (0x100020, {24, 0, 0x40, 0, 0,  (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\IMM32.DLL"}, 5, 96, ... 16, {status=0x0, info=1}, ) }, 5, 96, ... 16, {status=0x0, info=1}, ) == 0x0
 00312   896   NtCreateSection  (0xf, 0x0, 0x0, 16, 16777216, 16, ... 28, ) == 0x0
 00313   896   NtQuerySection  (28, Image, 48, ... {section info, class 1, size 48}, 0x0, ) == 0x0
 00314   896   NtOpenProcessToken  (-1, 0x8, ... 32, ) == 0x0
 00315   896   NtQueryInformationToken  (32, User, 136, ... {token info, class 1, size 36}, 36, ) == 0x0
 00316   896   NtOpenKey  (0x3, {24, 0, 0x40, 0, 0,  (0x3, {24, 0, 0x40, 0, 0, "\Registry\MACHINE\System\CurrentControlSet\Control\SafeBoot\Option"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00317   896   NtOpenKey  (0x1, {24, 0, 0x40, 0, 0,  (0x1, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers"}, ... 36, ) }, ... 36, ) == 0x0
 00318   896   NtQueryValueKey  (36,  (36, "TransparentEnabled", Partial, 80, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) , Partial, 80, ... TitleIdx=0, Type=4, Data= (36, "TransparentEnabled", Partial, 80, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) }, 16, ) == 0x0
 00319   896   NtClose  (36, ... ) == 0x0
 00320   896   NtOpenThreadTokenEx  (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN
 00321   896   NtOpenProcessTokenEx  (-1, 0x20008, 512, ... 36, ) == 0x0
 00322   896   NtQueryInformationToken  (36, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0
 00323   896   NtClose  (36, ... ) == 0x0
 00324   896   NtOpenKey  (0x1, {24, 0, 0x40, 0, 0,  (0x1, {24, 0, 0x40, 0, 0, "\REGISTRY\USER\S-1-5-21-1292428093-1383384898-725345543-1003\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00325   896   NtClose  (32, ... ) == 0x0
 00326   896   NtClose  (16, ... ) == 0x0
 00327   896   NtMapViewOfSection  (28, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x76390000), 0x0, 118784, ) == 0x0
 00328   896   NtClose  (28, ... ) == 0x0
 00329   896   NtProtectVirtualMemory  (-1, (0x76391000), 696, 4, ... (0x76391000), 4096, 32, ) == 0x0
 00330   896   NtProtectVirtualMemory  (-1, (0x76391000), 4096, 32, ... (0x76391000), 4096, 4, ) == 0x0
 00331   896   NtFlushInstructionCache  (-1, 1983451136, 696, ... ) == 0x0
 00332   896   NtProtectVirtualMemory  (-1, (0x76391000), 696, 4, ... (0x76391000), 4096, 32, ) == 0x0
 00333   896   NtProtectVirtualMemory  (-1, (0x76391000), 4096, 32, ... (0x76391000), 4096, 4, ) == 0x0
 00334   896   NtFlushInstructionCache  (-1, 1983451136, 696, ... ) == 0x0
 00335   896   NtProtectVirtualMemory  (-1, (0x76391000), 696, 4, ... (0x76391000), 4096, 32, ) == 0x0
 00336   896   NtProtectVirtualMemory  (-1, (0x76391000), 4096, 32, ... (0x76391000), 4096, 4, ) == 0x0
 00337   896   NtFlushInstructionCache  (-1, 1983451136, 696, ... ) == 0x0
 00338   896   NtOpenSection  (0xe, {24, 8, 0x40, 0, 0,  (0xe, {24, 8, 0x40, 0, 0, "ADVAPI32.dll"}, ... 28, ) }, ... 28, ) == 0x0
 00339   896   NtMapViewOfSection  (28, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x77dd0000), 0x0, 634880, ) == 0x0
 00340   896   NtClose  (28, ... ) == 0x0
 00341   896   NtProtectVirtualMemory  (-1, (0x77dd1000), 1700, 4, ... (0x77dd1000), 4096, 32, ) == 0x0
 00342   896   NtProtectVirtualMemory  (-1, (0x77dd1000), 4096, 32, ... (0x77dd1000), 4096, 4, ) == 0x0
 00343   896   NtFlushInstructionCache  (-1, 2010976256, 1700, ... ) == 0x0
 00344   896   NtOpenSection  (0xe, {24, 8, 0x40, 0, 0,  (0xe, {24, 8, 0x40, 0, 0, "RPCRT4.dll"}, ... 28, ) }, ... 28, ) == 0x0
 00345   896   NtMapViewOfSection  (28, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x77e70000), 0x0, 593920, ) == 0x0
 00346   896   NtClose  (28, ... ) == 0x0
 00347   896   NtAllocateVirtualMemory  (-1, 1228800, 0, 4096, 4096, 260, ... 1228800, 4096, ) == 0x0
 00348   896   NtProtectVirtualMemory  (-1, (0x77e71000), 868, 4, ... (0x77e71000), 4096, 32, ) == 0x0
 00349   896   NtProtectVirtualMemory  (-1, (0x77e71000), 4096, 32, ... (0x77e71000), 4096, 4, ) == 0x0
 00350   896   NtFlushInstructionCache  (-1, 2011631616, 868, ... ) == 0x0
 00351   896   NtProtectVirtualMemory  (-1, (0x77e71000), 868, 4, ... (0x77e71000), 4096, 32, ) == 0x0
 00352   896   NtProtectVirtualMemory  (-1, (0x77e71000), 4096, 32, ... (0x77e71000), 4096, 4, ) == 0x0
 00353   896   NtFlushInstructionCache  (-1, 2011631616, 868, ... ) == 0x0
 00354   896   NtProtectVirtualMemory  (-1, (0x77e71000), 868, 4, ... (0x77e71000), 4096, 32, ) == 0x0
 00355   896   NtProtectVirtualMemory  (-1, (0x77e71000), 4096, 32, ... (0x77e71000), 4096, 4, ) == 0x0
 00356   896   NtFlushInstructionCache  (-1, 2011631616, 868, ... ) == 0x0
 00357   896   NtProtectVirtualMemory  (-1, (0x77dd1000), 1700, 4, ... (0x77dd1000), 4096, 32, ) == 0x0
 00358   896   NtProtectVirtualMemory  (-1, (0x77dd1000), 4096, 32, ... (0x77dd1000), 4096, 4, ) == 0x0
 00359   896   NtFlushInstructionCache  (-1, 2010976256, 1700, ... ) == 0x0
 00360   896   NtOpenKey  (0x80000000, {24, 0, 0x40, 0, 0,  (0x80000000, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RPCRT4.dll"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00361   896   NtAllocateVirtualMemory  (-1, 1327104, 0, 4096, 4096, 4, ... 1327104, 4096, ) == 0x0
 00362   896   NtOpenKey  (0x80000000, {24, 0, 0x40, 0, 0,  (0x80000000, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ADVAPI32.dll"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00363   896   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\System\CurrentControlSet\Control\Terminal Server"}, ... 28, ) }, ... 28, ) == 0x0
 00364   896   NtQueryValueKey  (28,  (28, "TSAppCompat", Partial, 548, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) , Partial, 548, ... TitleIdx=0, Type=4, Data= (28, "TSAppCompat", Partial, 548, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) }, 16, ) == 0x0
 00365   896   NtQueryValueKey  (28,  (28, "TSUserEnabled", Partial, 548, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) , Partial, 548, ... TitleIdx=0, Type=4, Data= (28, "TSUserEnabled", Partial, 548, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) }, 16, ) == 0x0
 00366   896   NtClose  (28, ... ) == 0x0
 00367   896   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon"}, ... 28, ) }, ... 28, ) == 0x0
 00368   896   NtQueryValueKey  (28,  (28, "LeakTrack", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00369   896   NtClose  (28, ... ) == 0x0
 00370   896   NtOpenKey  (0x2000000, {24, 0, 0x40, 0, 0,  (0x2000000, {24, 0, 0x40, 0, 0, "\REGISTRY\MACHINE"}, ... 28, ) }, ... 28, ) == 0x0
 00371   896   NtSetInformationObject  (28, Handle, {Inherit=0,ProtectFromClose=1,}, 2011431168, ... ) == 0x0
 00372   896   NtOpenKey  (0x20019, {24, 28, 0x40, 0, 0,  (0x20019, {24, 28, 0x40, 0, 0, "Software\Microsoft\Windows NT\CurrentVersion\Diagnostics"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00373   896   NtOpenKey  (0x80000000, {24, 0, 0x40, 0, 0,  (0x80000000, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\IMM32.DLL"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00374   896   NtQuerySystemInformation  (Basic, 44, ... {Unknown=0,MaximumIncrement=156250,PhysicalPageSize=0x1000,NumberOfPhysicalPages=0xff7c,LowestPhysicalPage=0x1,HighestPhysicalPage=0xffff,AllocationGranularity=0x10000,LowestUserAddress=0x10000,HighestUserAddress=0x7ffeffff,ActiveProcessors=1,NumberProcessors=1,}, 0x0, ) == 0x0
 00375   896   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\IMM32.DLL"}, 1236132, ... ) }, 1236132, ... ) == 0x0
 00376   896   NtOpenKey  (0x80000000, {24, 0, 0x40, 0, 0,  (0x80000000, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ntdll.dll"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00377   896   NtOpenKey  (0x80000000, {24, 0, 0x40, 0, 0,  (0x80000000, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kernel32.dll"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00378   896   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\IMM32.DLL"}, 1239536, ... ) }, 1239536, ... ) == 0x0
 00379   896   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\System\CurrentControlSet\Control\Error Message Instrument\"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00380   896   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\GRE_Initialize"}, ... 16, ) }, ... 16, ) == 0x0
 00381   896   NtQueryValueKey  (16,  (16, "DisableMetaFiles", Partial, 20, ... ) , Partial, 20, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00382   896   NtClose  (16, ... ) == 0x0
 00383   896   NtMapViewOfSection  (-2147481368, -1, (0x0), 0, 0, 0x0, 0, 2, 0, 2, ... (0x420000), 0x0, 1060864, ) == 0x0
 00384   896   NtClose  (-2147481368, ... ) == 0x0
 00385   896   NtCreateEvent  (0x1f0003, 0x0, 1, 0, ... 16, ) == 0x0
 00386   896   NtOpenThreadTokenEx  (-2, 0x8, 1, 512, ... ) == STATUS_NO_TOKEN
 00387   896   NtOpenProcessTokenEx  (-1, 0x8, 512, ... -2147481368, ) == 0x0
 00388   896   NtQueryInformationToken  (-2147481368, Statistics, 0, ... ) == STATUS_BUFFER_TOO_SMALL
 00389   896   NtQueryInformationToken  (-2147481368, Statistics, 56, ... {token info, class 10, size 56}, 56, ) == 0x0
 00390   896   NtClose  (-2147481368, ... ) == 0x0
 00391   896   NtAllocateVirtualMemory  (-1, 0, 0, 32, 4096, 4, ... 5439488, 4096, ) == 0x0
 00392   896   NtFreeVirtualMemory  (-1, (0x530000), 4096, 32768, ... (0x530000), 4096, ) == 0x0
 00393   896   NtDuplicateObject  (-1, 32, -1, 0x0, 0, 2, ... 40, ) == 0x0
 00394   896   NtOpenKey  (0x20019, {24, 0, 0x240, 0, 0,  (0x20019, {24, 0, 0x240, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Compatibility32"}, ... -2147481368, ) }, ... -2147481368, ) == 0x0
 00395   896   NtQueryValueKey  (-2147481368,  (-2147481368, "packed", Partial, 172, ... ) , Partial, 172, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00396   896   NtClose  (-2147481368, ... ) == 0x0
 00397   896   NtOpenKey  (0x20019, {24, 0, 0x240, 0, 0,  (0x20019, {24, 0, 0x240, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\IME Compatibility"}, ... -2147481368, ) }, ... -2147481368, ) == 0x0
 00398   896   NtQueryValueKey  (-2147481368,  (-2147481368, "packed", Partial, 172, ... ) , Partial, 172, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00399   896   NtClose  (-2147481368, ... ) == 0x0
 00400   896   NtQueryDefaultLocale  (0, -135747252, ... ) == 0x0
 00401   896   NtGdiQueryFontAssocInfo  (0, ... ) == 0x0
 00402   896   NtUserCallNoParam  (24, ... ) == 0x0
 00403   896   NtGdiCreateCompatibleDC  (0, ...
 00404   896   NtAllocateVirtualMemory  (-1, 0, 0, 4096, 12288, 4, ... 5439488, 4096, ) == 0x0
 00403   896   NtGdiCreateCompatibleDC  ... ) == 0x860107ab
 00405   896   NtGdiGetStockObject  (0, ... ) == 0x1900010
 00406   896   NtGdiGetStockObject  (4, ... ) == 0x1900011
 00407   896   NtGdiCreateBitmap  (8, 8, 1, 1, 2118200212, ... ) == 0x870506a2
 00408   896   NtGdiCreateSolidBrush  (0, 0, ...
 00409   896   NtAllocateVirtualMemory  (-1, 0, 0, 4096, 12288, 4, ... 8650752, 4096, ) == 0x0
 00408   896   NtGdiCreateSolidBrush  ... ) == 0x1100680
 00410   896   NtGdiGetStockObject  (13, ... ) == 0x18a0021
 00411   896   NtGdiCreateCompatibleDC  (0, ... ) == 0xf6010687
 00412   896   NtGdiSelectBitmap  (-167704953, -2029713758, ... ) == 0x185000f
 00413   896   NtUserGetThreadDesktop  (896, 0, ... ) == 0x24
 00414   896   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Windows"}, ... 44, ) }, ... 44, ) == 0x0
 00415   896   NtQueryValueKey  (44,  (44, "AppInit_DLLs", Partial, 64, ... TitleIdx=0, Type=1, Data="\0\0"}, 14, ) , Partial, 64, ... TitleIdx=0, Type=1, Data= (44, "AppInit_DLLs", Partial, 64, ... TitleIdx=0, Type=1, Data="\0\0"}, 14, ) }, 14, ) == 0x0
 00416   896   NtClose  (44, ... ) == 0x0
 00417   896   NtUserFindExistingCursorIcon  (1240712, 1240728, 1240776, ... ) == 0x10011
 00418   896   NtUserRegisterClassExWOW  (1240724, 1240792, 1240808, 1240824, 673, 128, 0, ... ) == 0x8177c017
 00419   896   NtUserFindExistingCursorIcon  (1240712, 1240728, 1240776, ... ) == 0x10011
 00420   896   NtUserRegisterClassExWOW  (1240724, 1240792, 1240808, 1240824, 674, 128, 0, ... ) == 0x8177c01c
 00421   896   NtUserFindExistingCursorIcon  (1240712, 1240728, 1240776, ... ) == 0x10011
 00422   896   NtUserRegisterClassExWOW  (1240724, 1240792, 1240808, 1240824, 675, 128, 0, ... ) == 0x8177c01e
 00423   896   NtUserFindExistingCursorIcon  (1240712, 1240728, 1240776, ... ) == 0x10011
 00424   896   NtUserRegisterClassExWOW  (1240724, 1240792, 1240808, 1240824, 676, 128, 0, ... ) == 0x81778002
 00425   896   NtUserFindExistingCursorIcon  (1240712, 1240728, 1240776, ... ) == 0x10013
 00426   896   NtUserRegisterClassExWOW  (1240724, 1240792, 1240808, 1240824, 677, 128, 0, ... ) == 0x8177c018
 00427   896   NtUserFindExistingCursorIcon  (1240712, 1240728, 1240776, ... ) == 0x10011
 00428   896   NtUserRegisterClassExWOW  (1240724, 1240792, 1240808, 1240824, 678, 128, 0, ... ) == 0x8177c01a
 00429   896   NtUserFindExistingCursorIcon  (1240712, 1240728, 1240776, ... ) == 0x10011
 00430   896   NtUserRegisterClassExWOW  (1240724, 1240792, 1240808, 1240824, 679, 128, 0, ... ) == 0x8177c01d
 00431   896   NtUserFindExistingCursorIcon  (1240712, 1240728, 1240776, ... ) == 0x10011
 00432   896   NtUserRegisterClassExWOW  (1240724, 1240792, 1240808, 1240824, 681, 128, 0, ... ) == 0x8177c026
 00433   896   NtUserFindExistingCursorIcon  (1240712, 1240728, 1240776, ... ) == 0x10011
 00434   896   NtUserRegisterClassExWOW  (1240724, 1240792, 1240808, 1240824, 680, 128, 0, ... ) == 0x8177c019
 00435   896   NtUserRegisterClassExWOW  (1240676, 1240744, 1240760, 1240776, 0, 128, 0, ... ) == 0x8177c020
 00436   896   NtUserRegisterClassExWOW  (1240932, 1241028, 1241012, 1241000, 0, 130, 0, ... ) == 0x8177c022
 00437   896   NtUserRegisterClassExWOW  (1240676, 1240744, 1240760, 1240776, 0, 128, 0, ... ) == 0x8177c023
 00438   896   NtUserRegisterClassExWOW  (1240932, 1241028, 1241012, 1241000, 0, 130, 0, ... ) == 0x8177c024
 00439   896   NtUserRegisterClassExWOW  (1240676, 1240744, 1240760, 1240776, 0, 128, 0, ... ) == 0x8177c025
 00440   896   NtCallbackReturn  (0, 0, 0, ...
 00441   896   NtGdiInit  (... ) == 0x1
 00442   896   NtGdiGetStockObject  (18, ... ) == 0x290001c
 00443   896   NtGdiGetStockObject  (19, ... ) == 0x1b00019
 00444   896   NtAllocateVirtualMemory  (-1, 0, 0, 26112, 4096, 64, ... 8716288, 28672, ) == 0x0
 00445   896   NtOpenSection  (0xe, {24, 8, 0x40, 0, 0,  (0xe, {24, 8, 0x40, 0, 0, "WS2_32.dll"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00446   896   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\u:\work\WS2_32.dll"}, 1242908, ... ) }, 1242908, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00447   896   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\WS2_32.dll"}, 1242908, ... ) }, 1242908, ... ) == 0x0
 00448   896   NtOpenFile  (0x100020, {24, 0, 0x40, 0, 0,  (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\WS2_32.dll"}, 5, 96, ... 44, {status=0x0, info=1}, ) }, 5, 96, ... 44, {status=0x0, info=1}, ) == 0x0
 00449   896   NtCreateSection  (0xf, 0x0, 0x0, 16, 16777216, 44, ... 48, ) == 0x0
 00450   896   NtQuerySection  (48, Image, 48, ... {section info, class 1, size 48}, 0x0, ) == 0x0
 00451   896   NtClose  (44, ... ) == 0x0
 00452   896   NtMapViewOfSection  (48, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x71ab0000), 0x0, 94208, ) == 0x0
 00453   896   NtClose  (48, ... ) == 0x0
 00454   896   NtOpenSection  (0xe, {24, 8, 0x40, 0, 0,  (0xe, {24, 8, 0x40, 0, 0, "msvcrt.dll"}, ... 48, ) }, ... 48, ) == 0x0
 00455   896   NtMapViewOfSection  (48, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x77c10000), 0x0, 360448, ) == 0x0
 00456   896   NtClose  (48, ... ) == 0x0
 00457   896   NtProtectVirtualMemory  (-1, (0x77c11000), 632, 4, ... (0x77c11000), 4096, 32, ) == 0x0
 00458   896   NtProtectVirtualMemory  (-1, (0x77c11000), 4096, 32, ... (0x77c11000), 4096, 4, ) == 0x0
 00459   896   NtFlushInstructionCache  (-1, 2009141248, 632, ... ) == 0x0
 00460   896   NtProtectVirtualMemory  (-1, (0x71ab1000), 468, 4, ... (0x71ab1000), 4096, 32, ) == 0x0
 00461   896   NtProtectVirtualMemory  (-1, (0x71ab1000), 4096, 32, ... (0x71ab1000), 4096, 4, ) == 0x0
 00462   896   NtFlushInstructionCache  (-1, 1907036160, 468, ... ) == 0x0
 00463   896   NtOpenSection  (0xe, {24, 8, 0x40, 0, 0,  (0xe, {24, 8, 0x40, 0, 0, "WS2HELP.dll"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00464   896   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\u:\work\WS2HELP.dll"}, 1242092, ... ) }, 1242092, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00465   896   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\WS2HELP.dll"}, 1242092, ... ) }, 1242092, ... ) == 0x0
 00466   896   NtOpenFile  (0x100020, {24, 0, 0x40, 0, 0,  (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\WS2HELP.dll"}, 5, 96, ... 48, {status=0x0, info=1}, ) }, 5, 96, ... 48, {status=0x0, info=1}, ) == 0x0
 00467   896   NtCreateSection  (0xf, 0x0, 0x0, 16, 16777216, 48, ... 44, ) == 0x0
 00468   896   NtQuerySection  (44, Image, 48, ... {section info, class 1, size 48}, 0x0, ) == 0x0
 00469   896   NtClose  (48, ... ) == 0x0
 00470   896   NtMapViewOfSection  (44, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x71aa0000), 0x0, 32768, ) == 0x0
 00471   896   NtClose  (44, ... ) == 0x0
 00472   896   NtProtectVirtualMemory  (-1, (0x71aa1000), 352, 4, ... (0x71aa1000), 4096, 32, ) == 0x0
 00473   896   NtProtectVirtualMemory  (-1, (0x71aa1000), 4096, 32, ... (0x71aa1000), 4096, 4, ) == 0x0
 00474   896   NtFlushInstructionCache  (-1, 1906970624, 352, ... ) == 0x0
 00475   896   NtProtectVirtualMemory  (-1, (0x71ab1000), 468, 4, ... (0x71ab1000), 4096, 32, ) == 0x0
 00476   896   NtProtectVirtualMemory  (-1, (0x71ab1000), 4096, 32, ... (0x71ab1000), 4096, 4, ) == 0x0
 00477   896   NtFlushInstructionCache  (-1, 1907036160, 468, ... ) == 0x0
 00478   896   NtOpenKey  (0x80000000, {24, 0, 0x40, 0, 0,  (0x80000000, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msvcrt.dll"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00479   896   NtQuerySystemInformation  (Basic, 44, ... {Unknown=0,MaximumIncrement=156250,PhysicalPageSize=0x1000,NumberOfPhysicalPages=0xff7c,LowestPhysicalPage=0x1,HighestPhysicalPage=0xffff,AllocationGranularity=0x10000,LowestUserAddress=0x10000,HighestUserAddress=0x7ffeffff,ActiveProcessors=1,NumberProcessors=1,}, 0x0, ) == 0x0
 00480   896   NtAllocateVirtualMemory  (-1, 0, 0, 65536, 8192, 4, ... 8781824, 65536, ) == 0x0
 00481   896   NtAllocateVirtualMemory  (-1, 8781824, 0, 4096, 4096, 4, ... 8781824, 4096, ) == 0x0
 00482   896   NtAllocateVirtualMemory  (-1, 8785920, 0, 8192, 4096, 4, ... 8785920, 8192, ) == 0x0
 00483   896   NtAllocateVirtualMemory  (-1, 8794112, 0, 4096, 4096, 4, ... 8794112, 4096, ) == 0x0
 00484   896   NtOpenSection  (0x4, {24, 0, 0x40, 0, 0,  (0x4, {24, 0, 0x40, 0, 0, "\NLS\NlsSectionCType"}, ... 44, ) }, ... 44, ) == 0x0
 00485   896   NtMapViewOfSection  (44, -1, (0x0), 0, 0, 0x0, 0, 2, 0, 2, ... (0x870000), 0x0, 12288, ) == 0x0
 00486   896   NtClose  (44, ... ) == 0x0
 00487   896   NtAllocateVirtualMemory  (-1, 8798208, 0, 4096, 4096, 4, ... 8798208, 4096, ) == 0x0
 00488   896   NtQueryVirtualMemory  (-1, 0x77c2807c, Basic, 28, ... {BaseAddress=0x77c28000,AllocationBase=0x77c10000,AllocationProtect=0x80,RegionSize=0x35000,State=0x1000,Protect=0x20,Type=0x1000000,}, 28, ) == 0x0
 00489   896   NtQueryInformationProcess  (-1, 36, 4, ... {process info, class 36, size 4}, 0x0, ) == 0x0
 00490   896   NtQueryInformationProcess  (-1, 36, 4, ... {process info, class 36, size 4}, 0x0, ) == 0x0
 00491   896   NtQueryVirtualMemory  (-1, 0x0, Basic, 28, ... {BaseAddress=0x0,AllocationBase=0x0,AllocationProtect=0x0,RegionSize=0x10000,State=0x10000,Protect=0x1,Type=0x0,}, 28, ) == 0x0
 00492   896   NtOpenKey  (0x80000000, {24, 0, 0x40, 0, 0,  (0x80000000, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\WS2HELP.dll"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00493   896   NtOpenKey  (0x80000000, {24, 0, 0x40, 0, 0,  (0x80000000, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\WS2_32.dll"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00494   896   NtQuerySystemInformation  (Basic, 44, ... {Unknown=0,MaximumIncrement=156250,PhysicalPageSize=0x1000,NumberOfPhysicalPages=0xff7c,LowestPhysicalPage=0x1,HighestPhysicalPage=0xffff,AllocationGranularity=0x10000,LowestUserAddress=0x10000,HighestUserAddress=0x7ffeffff,ActiveProcessors=1,NumberProcessors=1,}, 0x0, ) == 0x0
 00495   896   NtQuerySystemInformation  (Processor, 12, ... {system info, class 1, size 12}, 0x0, ) == 0x0
 00496   896   NtFreeVirtualMemory  (-1, (0x850000), 0, 32768, ... (0x850000), 28672, ) == 0x0
 00497   896   NtFreeVirtualMemory  (-1, (0x320144), 0, 32768, ... (0x320000), 4096, ) == 0x0
 00498   896   NtQuerySystemInformation  (Basic, 44, ... {Unknown=0,MaximumIncrement=156250,PhysicalPageSize=0x1000,NumberOfPhysicalPages=0xff7c,LowestPhysicalPage=0x1,HighestPhysicalPage=0xffff,AllocationGranularity=0x10000,LowestUserAddress=0x10000,HighestUserAddress=0x7ffeffff,ActiveProcessors=1,NumberProcessors=1,}, 0x0, ) == 0x0
 00499   896   NtAllocateVirtualMemory  (-1, 0, 0, 65536, 8192, 4, ... 3276800, 65536, ) == 0x0
 00500   896   NtAllocateVirtualMemory  (-1, 3276800, 0, 4096, 4096, 4, ... 3276800, 4096, ) == 0x0
 00501   896   NtAllocateVirtualMemory  (-1, 3280896, 0, 20480, 4096, 4, ... 3280896, 20480, ) == 0x0
 00502   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ... 8912896, 1048576, ) == 0x0
 00503   896   NtAllocateVirtualMemory  (-1, 8912896, 0, 32768, 4096, 4, ... 8912896, 32768, ) == 0x0
 00504   896   NtOpenDirectoryObject  (0x2000f, {24, 0, 0x40, 0, 0,  (0x2000f, {24, 0, 0x40, 0, 0, "\BaseNamedObjects"}, ... 44, ) }, ... 44, ) == 0x0
 00505   896   NtCreateMutant  (0x1f0001, {24, 44, 0x80, 0, 0,  (0x1f0001, {24, 44, 0x80, 0, 0, "Jobaka3"}, 0, ... 48, ) }, 0, ... 48, ) == 0x0
 00506   896   NtOpenKey  (0x2000000, {24, 28, 0x40, 0, 0,  (0x2000000, {24, 28, 0x40, 0, 0, "System\CurrentControlSet\Services\WinSock2\Parameters"}, ... 52, ) }, ... 52, ) == 0x0
 00507   896   NtQueryValueKey  (52,  (52, "WinSock_Registry_Version", Partial, 144, ... TitleIdx=0, Type=1, Data="2\0.\00\0\0\0"}, 20, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (52, "WinSock_Registry_Version", Partial, 144, ... TitleIdx=0, Type=1, Data="2\0.\00\0\0\0"}, 20, ) }, 20, ) == 0x0
 00508   896   NtQueryValueKey  (52,  (52, "WinSock_Registry_Version", Partial, 144, ... TitleIdx=0, Type=1, Data="2\0.\00\0\0\0"}, 20, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (52, "WinSock_Registry_Version", Partial, 144, ... TitleIdx=0, Type=1, Data="2\0.\00\0\0\0"}, 20, ) }, 20, ) == 0x0
 00509   896   NtCreateEvent  (0x1f0003, 0x0, 0, 0, ... 56, ) == 0x0
 00510   896   NtOpenKey  (0x2000000, {24, 52, 0x40, 0, 0,  (0x2000000, {24, 52, 0x40, 0, 0, "Protocol_Catalog9"}, ... 60, ) }, ... 60, ) == 0x0
 00511   896   NtQueryValueKey  (60,  (60, "Serial_Access_Num", Partial, 144, ... TitleIdx=0, Type=4, Data="\15\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (60, "Serial_Access_Num", Partial, 144, ... TitleIdx=0, Type=4, Data="\15\0\0\0"}, 16, ) }, 16, ) == 0x0
 00512   896   NtNotifyChangeKey  (60, 56, 0, 0, 2011455960, 1, 0, 0, 0, 1, ... ) == 0x103
 00513   896   NtQueryValueKey  (60,  (60, "Serial_Access_Num", Partial, 144, ... TitleIdx=0, Type=4, Data="\15\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (60, "Serial_Access_Num", Partial, 144, ... TitleIdx=0, Type=4, Data="\15\0\0\0"}, 16, ) }, 16, ) == 0x0
 00514   896   NtOpenKey  (0x2000000, {24, 60, 0x40, 0, 0,  (0x2000000, {24, 60, 0x40, 0, 0, "0000000D"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00515   896   NtQueryValueKey  (60,  (60, "Next_Catalog_Entry_ID", Partial, 144, ... TitleIdx=0, Type=4, Data="#\4\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (60, "Next_Catalog_Entry_ID", Partial, 144, ... TitleIdx=0, Type=4, Data="#\4\0\0"}, 16, ) }, 16, ) == 0x0
 00516   896   NtQueryValueKey  (60,  (60, "Num_Catalog_Entries", Partial, 144, ... TitleIdx=0, Type=4, Data="\26\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (60, "Num_Catalog_Entries", Partial, 144, ... TitleIdx=0, Type=4, Data="\26\0\0\0"}, 16, ) }, 16, ) == 0x0
 00517   896   NtOpenKey  (0x2000000, {24, 60, 0x40, 0, 0,  (0x2000000, {24, 60, 0x40, 0, 0, "Catalog_Entries"}, ... 64, ) }, ... 64, ) == 0x0
 00518   896   NtAllocateVirtualMemory  (-1, 1331200, 0, 4096, 4096, 4, ... 1331200, 4096, ) == 0x0
 00519   896   NtOpenKey  (0x20019, {24, 64, 0x40, 0, 0,  (0x20019, {24, 64, 0x40, 0, 0, "000000000001"}, ... 68, ) }, ... 68, ) == 0x0
 00520   896   NtQueryValueKey  (68,  (68, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 00521   896   NtQueryValueKey  (68,  (68, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 00522   896   NtQueryValueKey  (68,  (68, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5f\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\10\0\0\0\240\32\17\347\213\253\317\21\214\243\0\200_H\241\222\351\3\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\2\0\0\0\20\0\0\0\20\0\0\0\1\0\0\0\6\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0T\0c\0p\0i\0p\0 \0[\0T\0C\0P\0/\0I\0P\0]\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\204\3\0\0\13\2\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0D\0\0\0\13\2\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\14\2\0\0\344\4\0\0\200\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0@\0\0\0`\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\370L\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\00\02\0\14\2\0\0\344\4\0\0\200\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0D\0\0\0\15\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0D\0\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\15\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\16\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0D\0\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) , Partial, 900, ... TitleIdx=0, Type=3, Data= (68, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5f\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\10\0\0\0\240\32\17\347\213\253\317\21\214\243\0\200_H\241\222\351\3\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\2\0\0\0\20\0\0\0\20\0\0\0\1\0\0\0\6\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0T\0c\0p\0i\0p\0 \0[\0T\0C\0P\0/\0I\0P\0]\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\204\3\0\0\13\2\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0D\0\0\0\13\2\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\14\2\0\0\344\4\0\0\200\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0@\0\0\0`\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\370L\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\00\02\0\14\2\0\0\344\4\0\0\200\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0D\0\0\0\15\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0D\0\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\15\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\16\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0D\0\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) \0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\15\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\16\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0D\0\0\0\0\0\0\0 (68, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5f\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\10\0\0\0\240\32\17\347\213\253\317\21\214\243\0\200_H\241\222\351\3\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\2\0\0\0\20\0\0\0\20\0\0\0\1\0\0\0\6\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0T\0c\0p\0i\0p\0 \0[\0T\0C\0P\0/\0I\0P\0]\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\204\3\0\0\13\2\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0D\0\0\0\13\2\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\14\2\0\0\344\4\0\0\200\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0@\0\0\0`\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\370L\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\00\02\0\14\2\0\0\344\4\0\0\200\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0D\0\0\0\15\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0D\0\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\15\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\16\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0D\0\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) }, 900, ) == 0x0
 00523   896   NtClose  (68, ... ) == 0x0
 00524   896   NtOpenKey  (0x20019, {24, 64, 0x40, 0, 0,  (0x20019, {24, 64, 0x40, 0, 0, "000000000002"}, ... 68, ) }, ... 68, ) == 0x0
 00525   896   NtQueryValueKey  (68,  (68, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 00526   896   NtQueryValueKey  (68,  (68, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 00527   896   NtQueryValueKey  (68,  (68, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\11\6\2\0\0\0\0\0\0\0\0\0\0\0\0\0\10\0\0\0\240\32\17\347\213\253\317\21\214\243\0\200_H\241\222\352\3\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\2\0\0\0\20\0\0\0\20\0\0\0\2\0\0\0\21\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\273\377\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0T\0c\0p\0i\0p\0 \0[\0U\0D\0P\0/\0I\0P\0]\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\204\3\0\0\20\2\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0D\0\0\0\20\2\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\21\2\0\0\344\4\0\0\200\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0@\0\0\0`\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\370L\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\00\03\0\21\2\0\0\344\4\0\0\200\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0D\0\0\0\22\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0D\0\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\22\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\23\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0D\0\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) , Partial, 900, ... TitleIdx=0, Type=3, Data= (68, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\11\6\2\0\0\0\0\0\0\0\0\0\0\0\0\0\10\0\0\0\240\32\17\347\213\253\317\21\214\243\0\200_H\241\222\352\3\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\2\0\0\0\20\0\0\0\20\0\0\0\2\0\0\0\21\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\273\377\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0T\0c\0p\0i\0p\0 \0[\0U\0D\0P\0/\0I\0P\0]\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\204\3\0\0\20\2\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0D\0\0\0\20\2\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\21\2\0\0\344\4\0\0\200\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0@\0\0\0`\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\370L\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\00\03\0\21\2\0\0\344\4\0\0\200\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0D\0\0\0\22\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0D\0\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\22\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\23\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0D\0\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) \0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\22\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\23\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0D\0\0\0\0\0\0\0 (68, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\11\6\2\0\0\0\0\0\0\0\0\0\0\0\0\0\10\0\0\0\240\32\17\347\213\253\317\21\214\243\0\200_H\241\222\352\3\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\2\0\0\0\20\0\0\0\20\0\0\0\2\0\0\0\21\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\273\377\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0T\0c\0p\0i\0p\0 \0[\0U\0D\0P\0/\0I\0P\0]\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\204\3\0\0\20\2\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0D\0\0\0\20\2\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\21\2\0\0\344\4\0\0\200\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0@\0\0\0`\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\370L\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\00\03\0\21\2\0\0\344\4\0\0\200\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0D\0\0\0\22\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0D\0\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\22\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\23\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0D\0\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) }, 900, ) == 0x0
 00528   896   NtClose  (68, ... ) == 0x0
 00529   896   NtOpenKey  (0x20019, {24, 64, 0x40, 0, 0,  (0x20019, {24, 64, 0x40, 0, 0, "000000000003"}, ... 68, ) }, ... 68, ) == 0x0
 00530   896   NtQueryValueKey  (68,  (68, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 00531   896   NtQueryValueKey  (68,  (68, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 00532   896   NtQueryValueKey  (68,  (68, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\11\6\2\0\0\0\0\0\0\0\0\0\0\0\0\0\14\0\0\0\240\32\17\347\213\253\317\21\214\243\0\200_H\241\222\353\3\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\2\0\0\0\20\0\0\0\20\0\0\0\3\0\0\0\0\0\0\0\377\0\0\0\0\0\0\0\0\0\0\0\273\377\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0T\0c\0p\0i\0p\0 \0[\0R\0A\0W\0/\0I\0P\0]\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\204\3\0\0\25\2\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0D\0\0\0\25\2\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\26\2\0\0\344\4\0\0\200\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0@\0\0\0`\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\370L\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\00\04\0\26\2\0\0\344\4\0\0\200\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0D\0\0\0\27\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0D\0\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\27\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\30\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0D\0\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) , Partial, 900, ... TitleIdx=0, Type=3, Data= (68, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\11\6\2\0\0\0\0\0\0\0\0\0\0\0\0\0\14\0\0\0\240\32\17\347\213\253\317\21\214\243\0\200_H\241\222\353\3\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\2\0\0\0\20\0\0\0\20\0\0\0\3\0\0\0\0\0\0\0\377\0\0\0\0\0\0\0\0\0\0\0\273\377\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0T\0c\0p\0i\0p\0 \0[\0R\0A\0W\0/\0I\0P\0]\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\204\3\0\0\25\2\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0D\0\0\0\25\2\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\26\2\0\0\344\4\0\0\200\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0@\0\0\0`\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\370L\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\00\04\0\26\2\0\0\344\4\0\0\200\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0D\0\0\0\27\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0D\0\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\27\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\30\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0D\0\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) \0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\27\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\30\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0D\0\0\0\0\0\0\0 (68, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\11\6\2\0\0\0\0\0\0\0\0\0\0\0\0\0\14\0\0\0\240\32\17\347\213\253\317\21\214\243\0\200_H\241\222\353\3\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\2\0\0\0\20\0\0\0\20\0\0\0\3\0\0\0\0\0\0\0\377\0\0\0\0\0\0\0\0\0\0\0\273\377\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0T\0c\0p\0i\0p\0 \0[\0R\0A\0W\0/\0I\0P\0]\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\204\3\0\0\25\2\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0D\0\0\0\25\2\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\26\2\0\0\344\4\0\0\200\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0@\0\0\0`\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\370L\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\00\04\0\26\2\0\0\344\4\0\0\200\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0D\0\0\0\27\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0D\0\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\27\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\30\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0D\0\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) }, 900, ) == 0x0
 00533   896   NtClose  (68, ... ) == 0x0
 00534   896   NtOpenKey  (0x20019, {24, 64, 0x40, 0, 0,  (0x20019, {24, 64, 0x40, 0, 0, "000000000004"}, ... 68, ) }, ... 68, ) == 0x0
 00535   896   NtQueryValueKey  (68,  (68, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 00536   896   NtQueryValueKey  (68,  (68, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 00537   896   NtAllocateVirtualMemory  (-1, 1335296, 0, 4096, 4096, 4, ... 1335296, 4096, ) == 0x0
 00538   896   NtQueryValueKey  (68,  (68, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\rsvpsp.dll\0\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\11&\2\0\0\0\0\0\0\0\0\0\0\0\0\0\10\0\0\0\340\251`\235z3\320\21\275\210\0\0\300\202\346\232\354\3\0\0\1\0\0\0\204\370\272\2|\370\272\2\210\371\272\2\4\244`u\\12\0\0\240<_u\260\371\272\2\6\0\0\0\2\0\0\0\20\0\0\0\20\0\0\0\2\0\0\0\21\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\273\377\0\0\0\0\0\0R\0S\0V\0P\0 \0U\0D\0P\0 \0S\0e\0r\0v\0i\0c\0e\0 \0P\0r\0o\0v\0i\0d\0e\0r\0\0\0\1\0\0\0\344\373\272\2\1\0\0\0\330\273\356\0\0\0\0\0=\373\220|\200\371\272\2\0\0\0\0\0\371\272\2l\373\220|q\373\220|\0\0\0\0\200\371\272\2=\373\220|\334\370\272\2\0\0\0\0\204\3\0\0\33\2\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0D\0\0\0\33\2\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\34\2\0\0\344\4\0\0\200\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0@\0\0\0`\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\370L\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\00\05\0\34\2\0\0\344\4\0\0\200\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0D\0\0\0\35\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0D\0\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\35\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\36\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0D\0\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) , Partial, 900, ... TitleIdx=0, Type=3, Data= (68, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\rsvpsp.dll\0\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\11&\2\0\0\0\0\0\0\0\0\0\0\0\0\0\10\0\0\0\340\251`\235z3\320\21\275\210\0\0\300\202\346\232\354\3\0\0\1\0\0\0\204\370\272\2|\370\272\2\210\371\272\2\4\244`u\\12\0\0\240<_u\260\371\272\2\6\0\0\0\2\0\0\0\20\0\0\0\20\0\0\0\2\0\0\0\21\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\273\377\0\0\0\0\0\0R\0S\0V\0P\0 \0U\0D\0P\0 \0S\0e\0r\0v\0i\0c\0e\0 \0P\0r\0o\0v\0i\0d\0e\0r\0\0\0\1\0\0\0\344\373\272\2\1\0\0\0\330\273\356\0\0\0\0\0=\373\220|\200\371\272\2\0\0\0\0\0\371\272\2l\373\220|q\373\220|\0\0\0\0\200\371\272\2=\373\220|\334\370\272\2\0\0\0\0\204\3\0\0\33\2\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0D\0\0\0\33\2\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\34\2\0\0\344\4\0\0\200\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0@\0\0\0`\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\370L\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\00\05\0\34\2\0\0\344\4\0\0\200\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0D\0\0\0\35\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0D\0\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\35\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\36\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0D\0\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) \0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\35\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\36\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0D\0\0\0\0\0\0\0 (68, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\rsvpsp.dll\0\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\11&\2\0\0\0\0\0\0\0\0\0\0\0\0\0\10\0\0\0\340\251`\235z3\320\21\275\210\0\0\300\202\346\232\354\3\0\0\1\0\0\0\204\370\272\2|\370\272\2\210\371\272\2\4\244`u\\12\0\0\240<_u\260\371\272\2\6\0\0\0\2\0\0\0\20\0\0\0\20\0\0\0\2\0\0\0\21\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\273\377\0\0\0\0\0\0R\0S\0V\0P\0 \0U\0D\0P\0 \0S\0e\0r\0v\0i\0c\0e\0 \0P\0r\0o\0v\0i\0d\0e\0r\0\0\0\1\0\0\0\344\373\272\2\1\0\0\0\330\273\356\0\0\0\0\0=\373\220|\200\371\272\2\0\0\0\0\0\371\272\2l\373\220|q\373\220|\0\0\0\0\200\371\272\2=\373\220|\334\370\272\2\0\0\0\0\204\3\0\0\33\2\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0D\0\0\0\33\2\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\34\2\0\0\344\4\0\0\200\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0@\0\0\0`\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\370L\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\00\05\0\34\2\0\0\344\4\0\0\200\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0D\0\0\0\35\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0D\0\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\35\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\36\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0D\0\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) }, 900, ) == 0x0
 00539   896   NtClose  (68, ... ) == 0x0
 00540   896   NtOpenKey  (0x20019, {24, 64, 0x40, 0, 0,  (0x20019, {24, 64, 0x40, 0, 0, "000000000005"}, ... 68, ) }, ... 68, ) == 0x0
 00541   896   NtQueryValueKey  (68,  (68, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 00542   896   NtQueryValueKey  (68,  (68, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 00543   896   NtQueryValueKey  (68,  (68, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\rsvpsp.dll\0\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5f \2\0\0\0\0\0\0\0\0\0\0\0\0\0\10\0\0\0\340\251`\235z3\320\21\275\210\0\0\300\202\346\232\355\3\0\0\1\0\0\0\210\1\34\0\0\0\34\0\10\0\0\0\0\0\0\0\214\373\272\2\\15\221|\0\0\34\0\6\0\0\0\2\0\0\0\20\0\0\0\20\0\0\0\1\0\0\0\6\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0R\0S\0V\0P\0 \0T\0C\0P\0 \0S\0e\0r\0v\0i\0c\0e\0 \0P\0r\0o\0v\0i\0d\0e\0r\0\0\0\210\1\34\0\0\0\0\0\20\0\0\0P\373\272\2\270Ddu\0\0\0\0(\275\356\0|\373\272\2\364\373\272\2\0\0\34\0\10\0\0\0\0\0\0\0(\374\272\2\\15\221|\0\0\34\0\0\0\0\0\204\3\0\0 \2\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0D\0\0\0 \2\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0!\2\0\0\344\4\0\0\200\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0@\0\0\0`\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\370L\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\00\06\0!\2\0\0\344\4\0\0\200\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0D\0\0\0"\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0D\0\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0"\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0#\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0D\0\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) , Partial, 900, ... TitleIdx=0, Type=3, Data= (68, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\rsvpsp.dll\0\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5f \2\0\0\0\0\0\0\0\0\0\0\0\0\0\10\0\0\0\340\251`\235z3\320\21\275\210\0\0\300\202\346\232\355\3\0\0\1\0\0\0\210\1\34\0\0\0\34\0\10\0\0\0\0\0\0\0\214\373\272\2\\15\221|\0\0\34\0\6\0\0\0\2\0\0\0\20\0\0\0\20\0\0\0\1\0\0\0\6\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0R\0S\0V\0P\0 \0T\0C\0P\0 \0S\0e\0r\0v\0i\0c\0e\0 \0P\0r\0o\0v\0i\0d\0e\0r\0\0\0\210\1\34\0\0\0\0\0\20\0\0\0P\373\272\2\270Ddu\0\0\0\0(\275\356\0|\373\272\2\364\373\272\2\0\0\34\0\10\0\0\0\0\0\0\0(\374\272\2\\15\221|\0\0\34\0\0\0\0\0\204\3\0\0 \2\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0D\0\0\0 \2\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0!\2\0\0\344\4\0\0\200\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0@\0\0\0`\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\370L\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\00\06\0!\2\0\0\344\4\0\0\200\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0D\0\0\0"\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0D\0\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0"\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0#\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0D\0\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) \2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0D\0\0\0\0\0\0\0 (68, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\rsvpsp.dll\0\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5f \2\0\0\0\0\0\0\0\0\0\0\0\0\0\10\0\0\0\340\251`\235z3\320\21\275\210\0\0\300\202\346\232\355\3\0\0\1\0\0\0\210\1\34\0\0\0\34\0\10\0\0\0\0\0\0\0\214\373\272\2\\15\221|\0\0\34\0\6\0\0\0\2\0\0\0\20\0\0\0\20\0\0\0\1\0\0\0\6\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0R\0S\0V\0P\0 \0T\0C\0P\0 \0S\0e\0r\0v\0i\0c\0e\0 \0P\0r\0o\0v\0i\0d\0e\0r\0\0\0\210\1\34\0\0\0\0\0\20\0\0\0P\373\272\2\270Ddu\0\0\0\0(\275\356\0|\373\272\2\364\373\272\2\0\0\34\0\10\0\0\0\0\0\0\0(\374\272\2\\15\221|\0\0\34\0\0\0\0\0\204\3\0\0 \2\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0D\0\0\0 \2\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0!\2\0\0\344\4\0\0\200\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0@\0\0\0`\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\370L\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\00\06\0!\2\0\0\344\4\0\0\200\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0D\0\0\0"\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0D\0\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0"\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0#\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0D\0\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) \2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0#\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0D\0\0\0\0\0\0\0 (68, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\rsvpsp.dll\0\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5f \2\0\0\0\0\0\0\0\0\0\0\0\0\0\10\0\0\0\340\251`\235z3\320\21\275\210\0\0\300\202\346\232\355\3\0\0\1\0\0\0\210\1\34\0\0\0\34\0\10\0\0\0\0\0\0\0\214\373\272\2\\15\221|\0\0\34\0\6\0\0\0\2\0\0\0\20\0\0\0\20\0\0\0\1\0\0\0\6\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0R\0S\0V\0P\0 \0T\0C\0P\0 \0S\0e\0r\0v\0i\0c\0e\0 \0P\0r\0o\0v\0i\0d\0e\0r\0\0\0\210\1\34\0\0\0\0\0\20\0\0\0P\373\272\2\270Ddu\0\0\0\0(\275\356\0|\373\272\2\364\373\272\2\0\0\34\0\10\0\0\0\0\0\0\0(\374\272\2\\15\221|\0\0\34\0\0\0\0\0\204\3\0\0 \2\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0D\0\0\0 \2\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0!\2\0\0\344\4\0\0\200\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0@\0\0\0`\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\370L\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\00\06\0!\2\0\0\344\4\0\0\200\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0D\0\0\0"\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0D\0\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0"\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0#\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0D\0\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) }, 900, ) == 0x0
 00544   896   NtClose  (68, ... ) == 0x0
 00545   896   NtOpenKey  (0x20019, {24, 64, 0x40, 0, 0,  (0x20019, {24, 64, 0x40, 0, 0, "000000000006"}, ... 68, ) }, ... 68, ) == 0x0
 00546   896   NtQueryValueKey  (68,  (68, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 00547   896   NtQueryValueKey  (68,  (68, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 00548   896   NtQueryValueKey  (68,  (68, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5&\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\10\0\0\0d\200\304\237\230r\344C\267\275\30\37 \211y*\374\3\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0 \0\0\0\36\0\0\0\36\0\0\0\1\0\0\0\3\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0R\0f\0C\0o\0m\0m\0 \0[\0B\0l\0u\0e\0t\0o\0o\0t\0h\0]\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\204\3\0\0%\2\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0D\0\0\0%\2\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0&\2\0\0\344\4\0\0\200\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0@\0\0\0`\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\370L\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\00\07\0&\2\0\0\344\4\0\0\200\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0D\0\0\0'\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0D\0\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0'\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0(\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0D\0\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) , Partial, 900, ... TitleIdx=0, Type=3, Data= (68, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5&\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\10\0\0\0d\200\304\237\230r\344C\267\275\30\37 \211y*\374\3\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0 \0\0\0\36\0\0\0\36\0\0\0\1\0\0\0\3\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0R\0f\0C\0o\0m\0m\0 \0[\0B\0l\0u\0e\0t\0o\0o\0t\0h\0]\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\204\3\0\0%\2\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0D\0\0\0%\2\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0&\2\0\0\344\4\0\0\200\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0@\0\0\0`\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\370L\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\00\07\0&\2\0\0\344\4\0\0\200\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0D\0\0\0'\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0D\0\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0'\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0(\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0D\0\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) \0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0'\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0(\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0D\0\0\0\0\0\0\0 (68, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5&\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\10\0\0\0d\200\304\237\230r\344C\267\275\30\37 \211y*\374\3\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0 \0\0\0\36\0\0\0\36\0\0\0\1\0\0\0\3\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0R\0f\0C\0o\0m\0m\0 \0[\0B\0l\0u\0e\0t\0o\0o\0t\0h\0]\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\204\3\0\0%\2\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0D\0\0\0%\2\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0&\2\0\0\344\4\0\0\200\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0@\0\0\0`\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\370L\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\00\07\0&\2\0\0\344\4\0\0\200\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0D\0\0\0'\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0D\0\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0'\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0(\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0D\0\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) }, 900, ) == 0x0
 00549   896   NtClose  (68, ... ) == 0x0
 00550   896   NtOpenKey  (0x20019, {24, 64, 0x40, 0, 0,  (0x20019, {24, 64, 0x40, 0, 0, "000000000007"}, ... 68, ) }, ... 68, ) == 0x0
 00551   896   NtQueryValueKey  (68,  (68, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 00552   896   NtQueryValueKey  (68,  (68, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 00553   896   NtQueryValueKey  (68,  (68, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\16\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\23\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\5\0\0\0\373\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\0F\0C\0C\00\03\0A\04\01\0-\08\0C\0C\0C\0-\04\09\01\09\0-\0A\0\0\0\0\0\204\3\0\0*\2\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0D\0\0\0*\2\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0+\2\0\0\344\4\0\0\200\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0@\0\0\0`\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\370L\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\00\08\0+\2\0\0\344\4\0\0\200\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0D\0\0\0,\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0D\0\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0,\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0-\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0D\0\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) , Partial, 900, ... TitleIdx=0, Type=3, Data= (68, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\16\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\23\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\5\0\0\0\373\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\0F\0C\0C\00\03\0A\04\01\0-\08\0C\0C\0C\0-\04\09\01\09\0-\0A\0\0\0\0\0\204\3\0\0*\2\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0D\0\0\0*\2\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0+\2\0\0\344\4\0\0\200\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0@\0\0\0`\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\370L\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\00\08\0+\2\0\0\344\4\0\0\200\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0D\0\0\0,\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0D\0\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0,\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0-\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0D\0\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) \0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0,\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0-\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0D\0\0\0\0\0\0\0 (68, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\16\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\23\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\5\0\0\0\373\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\0F\0C\0C\00\03\0A\04\01\0-\08\0C\0C\0C\0-\04\09\01\09\0-\0A\0\0\0\0\0\204\3\0\0*\2\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0D\0\0\0*\2\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0+\2\0\0\344\4\0\0\200\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0@\0\0\0`\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\370L\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\00\08\0+\2\0\0\344\4\0\0\200\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0D\0\0\0,\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0D\0\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0,\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0-\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0D\0\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) }, 900, ) == 0x0
 00554   896   NtClose  (68, ... ) == 0x0
 00555   896   NtOpenKey  (0x20019, {24, 64, 0x40, 0, 0,  (0x20019, {24, 64, 0x40, 0, 0, "000000000008"}, ... 68, ) }, ... 68, ) == 0x0
 00556   896   NtQueryValueKey  (68,  (68, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 00557   896   NtQueryValueKey  (68,  (68, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 00558   896   NtAllocateVirtualMemory  (-1, 1339392, 0, 4096, 4096, 4, ... 1339392, 4096, ) == 0x0
 00559   896   NtQueryValueKey  (68,  (68, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\11\2\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\24\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\2\0\0\0\373\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\0F\0C\0C\00\03\0A\04\01\0-\08\0C\0C\0C\0-\04\09\01\09\0-\0A\0\0\0\0\0\204\3\0\00\2\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0D\0\0\00\2\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\01\2\0\0\344\4\0\0\200\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0@\0\0\0`\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\370L\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\00\09\01\2\0\0\344\4\0\0\200\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0D\0\0\02\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0D\0\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\02\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\03\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0D\0\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) , Partial, 900, ... TitleIdx=0, Type=3, Data= (68, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\11\2\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\24\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\2\0\0\0\373\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\0F\0C\0C\00\03\0A\04\01\0-\08\0C\0C\0C\0-\04\09\01\09\0-\0A\0\0\0\0\0\204\3\0\00\2\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0D\0\0\00\2\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\01\2\0\0\344\4\0\0\200\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0@\0\0\0`\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\370L\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\00\09\01\2\0\0\344\4\0\0\200\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0D\0\0\02\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0D\0\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\02\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\03\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0D\0\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) \0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\02\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\03\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0D\0\0\0\0\0\0\0 (68, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\11\2\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\24\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\2\0\0\0\373\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\0F\0C\0C\00\03\0A\04\01\0-\08\0C\0C\0C\0-\04\09\01\09\0-\0A\0\0\0\0\0\204\3\0\00\2\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0D\0\0\00\2\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\01\2\0\0\344\4\0\0\200\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0@\0\0\0`\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\370L\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\00\09\01\2\0\0\344\4\0\0\200\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0D\0\0\02\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0D\0\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\02\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\03\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0D\0\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) }, 900, ) == 0x0
 00560   896   NtClose  (68, ... ) == 0x0
 00561   896   NtOpenKey  (0x20019, {24, 64, 0x40, 0, 0,  (0x20019, {24, 64, 0x40, 0, 0, "000000000009"}, ... 68, ) }, ... 68, ) == 0x0
 00562   896   NtQueryValueKey  (68,  (68, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 00563   896   NtQueryValueKey  (68,  (68, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 00564   896   NtQueryValueKey  (68,  (68, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\16\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\25\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\5\0\0\0\374\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\0A\0E\07\04\02\01\0B\05\0-\07\03\02\0D\0-\04\05\06\07\0-\0A\0\0\0\0\0\204\3\0\05\2\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0D\0\0\05\2\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\06\2\0\0\344\4\0\0\200\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0@\0\0\0`\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\370L\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\01\00\06\2\0\0\344\4\0\0\200\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0D\0\0\07\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0D\0\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\07\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\08\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0D\0\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) , Partial, 900, ... TitleIdx=0, Type=3, Data= (68, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\16\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\25\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\5\0\0\0\374\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\0A\0E\07\04\02\01\0B\05\0-\07\03\02\0D\0-\04\05\06\07\0-\0A\0\0\0\0\0\204\3\0\05\2\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0D\0\0\05\2\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\06\2\0\0\344\4\0\0\200\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0@\0\0\0`\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\370L\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\01\00\06\2\0\0\344\4\0\0\200\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0D\0\0\07\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0D\0\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\07\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\08\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0D\0\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) \0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\07\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\08\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0D\0\0\0\0\0\0\0 (68, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\16\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\25\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\5\0\0\0\374\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\0A\0E\07\04\02\01\0B\05\0-\07\03\02\0D\0-\04\05\06\07\0-\0A\0\0\0\0\0\204\3\0\05\2\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0D\0\0\05\2\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\06\2\0\0\344\4\0\0\200\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0@\0\0\0`\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\370L\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\01\00\06\2\0\0\344\4\0\0\200\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0D\0\0\07\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0D\0\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\07\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\08\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0D\0\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) }, 900, ) == 0x0
 00565   896   NtClose  (68, ... ) == 0x0
 00566   896   NtOpenKey  (0x20019, {24, 64, 0x40, 0, 0,  (0x20019, {24, 64, 0x40, 0, 0, "000000000010"}, ... 68, ) }, ... 68, ) == 0x0
 00567   896   NtQueryValueKey  (68,  (68, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 00568   896   NtQueryValueKey  (68,  (68, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 00569   896   NtQueryValueKey  (68,  (68, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\11\2\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\26\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\2\0\0\0\374\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\0A\0E\07\04\02\01\0B\05\0-\07\03\02\0D\0-\04\05\06\07\0-\0A\0\0\0\0\0\204\3\0\0:\2\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0D\0\0\0:\2\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0;\2\0\0\344\4\0\0\200\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0@\0\0\0`\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\370L\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\01\01\0;\2\0\0\344\4\0\0\200\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0D\0\0\0<\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0D\0\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0<\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0=\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0D\0\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) , Partial, 900, ... TitleIdx=0, Type=3, Data= (68, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\11\2\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\26\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\2\0\0\0\374\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\0A\0E\07\04\02\01\0B\05\0-\07\03\02\0D\0-\04\05\06\07\0-\0A\0\0\0\0\0\204\3\0\0:\2\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0D\0\0\0:\2\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0;\2\0\0\344\4\0\0\200\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0@\0\0\0`\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\370L\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\01\01\0;\2\0\0\344\4\0\0\200\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0D\0\0\0<\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0D\0\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0<\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0=\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0D\0\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) \0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0<\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0=\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0D\0\0\0\0\0\0\0 (68, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\11\2\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\26\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\2\0\0\0\374\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\0A\0E\07\04\02\01\0B\05\0-\07\03\02\0D\0-\04\05\06\07\0-\0A\0\0\0\0\0\204\3\0\0:\2\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0D\0\0\0:\2\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0;\2\0\0\344\4\0\0\200\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0@\0\0\0`\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\370L\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\01\01\0;\2\0\0\344\4\0\0\200\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0D\0\0\0<\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0D\0\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0<\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0=\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0D\0\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) }, 900, ) == 0x0
 00570   896   NtClose  (68, ... ) == 0x0
 00571   896   NtOpenKey  (0x20019, {24, 64, 0x40, 0, 0,  (0x20019, {24, 64, 0x40, 0, 0, "000000000011"}, ... 68, ) }, ... 68, ) == 0x0
 00572   896   NtQueryValueKey  (68,  (68, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 00573   896   NtQueryValueKey  (68,  (68, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 00574   896   NtQueryValueKey  (68,  (68, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\16\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\27\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\5\0\0\0\375\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\09\07\0C\02\0D\09\0F\04\0-\06\09\05\04\0-\04\0E\0B\03\0-\08\0\0\0\0\0\204\3\0\0?\2\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0D\0\0\0?\2\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0@\2\0\0\344\4\0\0\200\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0@\0\0\0`\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\370L\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\01\02\0@\2\0\0\344\4\0\0\200\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0D\0\0\0A\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0D\0\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0A\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0B\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0D\0\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) , Partial, 900, ... TitleIdx=0, Type=3, Data= (68, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\16\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\27\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\5\0\0\0\375\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\09\07\0C\02\0D\09\0F\04\0-\06\09\05\04\0-\04\0E\0B\03\0-\08\0\0\0\0\0\204\3\0\0?\2\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0D\0\0\0?\2\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0@\2\0\0\344\4\0\0\200\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0@\0\0\0`\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\370L\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\01\02\0@\2\0\0\344\4\0\0\200\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0D\0\0\0A\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0D\0\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0A\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0B\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0D\0\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) \0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0A\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0B\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0D\0\0\0\0\0\0\0 (68, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\16\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\27\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\5\0\0\0\375\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\09\07\0C\02\0D\09\0F\04\0-\06\09\05\04\0-\04\0E\0B\03\0-\08\0\0\0\0\0\204\3\0\0?\2\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0D\0\0\0?\2\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0@\2\0\0\344\4\0\0\200\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0@\0\0\0`\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\370L\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\01\02\0@\2\0\0\344\4\0\0\200\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0D\0\0\0A\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0D\0\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0A\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0B\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0D\0\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) }, 900, ) == 0x0
 00575   896   NtClose  (68, ... ) == 0x0
 00576   896   NtOpenKey  (0x20019, {24, 64, 0x40, 0, 0,  (0x20019, {24, 64, 0x40, 0, 0, "000000000012"}, ... 68, ) }, ... 68, ) == 0x0
 00577   896   NtQueryValueKey  (68,  (68, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 00578   896   NtQueryValueKey  (68,  (68, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 00579   896   NtQueryValueKey  (68,  (68, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\11\2\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\30\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\2\0\0\0\375\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\09\07\0C\02\0D\09\0F\04\0-\06\09\05\04\0-\04\0E\0B\03\0-\08\0\0\0\0\0\204\3\0\0D\2\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0D\0\0\0D\2\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0E\2\0\0\344\4\0\0\200\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0@\0\0\0`\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\370L\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\01\03\0E\2\0\0\344\4\0\0\200\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0D\0\0\0F\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0D\0\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0F\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0G\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0D\0\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) , Partial, 900, ... TitleIdx=0, Type=3, Data= (68, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\11\2\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\30\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\2\0\0\0\375\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\09\07\0C\02\0D\09\0F\04\0-\06\09\05\04\0-\04\0E\0B\03\0-\08\0\0\0\0\0\204\3\0\0D\2\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0D\0\0\0D\2\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0E\2\0\0\344\4\0\0\200\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0@\0\0\0`\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\370L\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\01\03\0E\2\0\0\344\4\0\0\200\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0D\0\0\0F\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0D\0\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0F\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0G\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0D\0\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) \0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0F\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0G\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0D\0\0\0\0\0\0\0 (68, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\11\2\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\30\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\2\0\0\0\375\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\09\07\0C\02\0D\09\0F\04\0-\06\09\05\04\0-\04\0E\0B\03\0-\08\0\0\0\0\0\204\3\0\0D\2\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0D\0\0\0D\2\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0E\2\0\0\344\4\0\0\200\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0@\0\0\0`\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\370L\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\01\03\0E\2\0\0\344\4\0\0\200\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0D\0\0\0F\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0D\0\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0F\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0G\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0D\0\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) }, 900, ) == 0x0
 00580   896   NtClose  (68, ... ) == 0x0
 00581   896   NtOpenKey  (0x20019, {24, 64, 0x40, 0, 0,  (0x20019, {24, 64, 0x40, 0, 0, "000000000013"}, ... 68, ) }, ... 68, ) == 0x0
 00582   896   NtQueryValueKey  (68,  (68, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 00583   896   NtQueryValueKey  (68,  (68, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 00584   896   NtAllocateVirtualMemory  (-1, 1343488, 0, 4096, 4096, 4, ... 1343488, 4096, ) == 0x0
 00585   896   NtQueryValueKey  (68,  (68, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\16\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\10\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\31\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\5\0\0\0\0\0\0\200\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\00\0D\04\03\00\0A\06\0F\0-\00\04\01\00\0-\04\0A\06\08\0-\09\0\0\0\0\0\204\3\0\0J\2\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0D\0\0\0J\2\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0K\2\0\0\344\4\0\0\200\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0@\0\0\0`\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\370L\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\01\04\0K\2\0\0\344\4\0\0\200\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0D\0\0\0L\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0D\0\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0L\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0M\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0D\0\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) , Partial, 900, ... TitleIdx=0, Type=3, Data= (68, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\16\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\10\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\31\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\5\0\0\0\0\0\0\200\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\00\0D\04\03\00\0A\06\0F\0-\00\04\01\00\0-\04\0A\06\08\0-\09\0\0\0\0\0\204\3\0\0J\2\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0D\0\0\0J\2\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0K\2\0\0\344\4\0\0\200\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0@\0\0\0`\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\370L\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\01\04\0K\2\0\0\344\4\0\0\200\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0D\0\0\0L\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0D\0\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0L\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0M\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0D\0\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) \0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0L\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0M\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0D\0\0\0\0\0\0\0 (68, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\16\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\10\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\31\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\5\0\0\0\0\0\0\200\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\00\0D\04\03\00\0A\06\0F\0-\00\04\01\00\0-\04\0A\06\08\0-\09\0\0\0\0\0\204\3\0\0J\2\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0D\0\0\0J\2\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0K\2\0\0\344\4\0\0\200\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0@\0\0\0`\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\370L\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\01\04\0K\2\0\0\344\4\0\0\200\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0D\0\0\0L\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0D\0\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0L\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0M\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0D\0\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) }, 900, ) == 0x0
 00586   896   NtClose  (68, ... ) == 0x0
 00587   896   NtOpenKey  (0x20019, {24, 64, 0x40, 0, 0,  (0x20019, {24, 64, 0x40, 0, 0, "000000000014"}, ... 68, ) }, ... 68, ) == 0x0
 00588   896   NtQueryValueKey  (68,  (68, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 00589   896   NtQueryValueKey  (68,  (68, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 00590   896   NtQueryValueKey  (68,  (68, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\11\2\2\0\0\0\0\0\0\0\0\0\0\0\0\0\10\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\32\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\2\0\0\0\0\0\0\200\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\00\0D\04\03\00\0A\06\0F\0-\00\04\01\00\0-\04\0A\06\08\0-\09\0\0\0\0\0\204\3\0\0O\2\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0D\0\0\0O\2\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0P\2\0\0\344\4\0\0\200\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0@\0\0\0`\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\370L\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\01\05\0P\2\0\0\344\4\0\0\200\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0D\0\0\0Q\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0D\0\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0Q\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0R\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0D\0\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) , Partial, 900, ... TitleIdx=0, Type=3, Data= (68, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\11\2\2\0\0\0\0\0\0\0\0\0\0\0\0\0\10\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\32\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\2\0\0\0\0\0\0\200\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\00\0D\04\03\00\0A\06\0F\0-\00\04\01\00\0-\04\0A\06\08\0-\09\0\0\0\0\0\204\3\0\0O\2\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0D\0\0\0O\2\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0P\2\0\0\344\4\0\0\200\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0@\0\0\0`\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\370L\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\01\05\0P\2\0\0\344\4\0\0\200\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0D\0\0\0Q\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0D\0\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0Q\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0R\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0D\0\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) \0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0Q\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0R\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0D\0\0\0\0\0\0\0 (68, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\11\2\2\0\0\0\0\0\0\0\0\0\0\0\0\0\10\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\32\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\2\0\0\0\0\0\0\200\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\00\0D\04\03\00\0A\06\0F\0-\00\04\01\00\0-\04\0A\06\08\0-\09\0\0\0\0\0\204\3\0\0O\2\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0D\0\0\0O\2\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0P\2\0\0\344\4\0\0\200\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0@\0\0\0`\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\370L\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\01\05\0P\2\0\0\344\4\0\0\200\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0D\0\0\0Q\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0D\0\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0Q\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0R\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0D\0\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) }, 900, ) == 0x0
 00591   896   NtClose  (68, ... ) == 0x0
 00592   896   NtOpenKey  (0x20019, {24, 64, 0x40, 0, 0,  (0x20019, {24, 64, 0x40, 0, 0, "000000000015"}, ... 68, ) }, ... 68, ) == 0x0
 00593   896   NtQueryValueKey  (68,  (68, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 00594   896   NtQueryValueKey  (68,  (68, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 00595   896   NtQueryValueKey  (68,  (68, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\16\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\33\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\5\0\0\0\377\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\08\0A\0D\04\0D\08\00\06\0-\00\08\01\0B\0-\04\04\04\06\0-\0A\0\0\0\0\0\204\3\0\0T\2\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0D\0\0\0T\2\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0U\2\0\0\344\4\0\0\200\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0@\0\0\0`\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\370L\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\01\06\0U\2\0\0\344\4\0\0\200\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0D\0\0\0V\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0D\0\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0V\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0W\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0D\0\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) , Partial, 900, ... TitleIdx=0, Type=3, Data= (68, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\16\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\33\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\5\0\0\0\377\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\08\0A\0D\04\0D\08\00\06\0-\00\08\01\0B\0-\04\04\04\06\0-\0A\0\0\0\0\0\204\3\0\0T\2\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0D\0\0\0T\2\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0U\2\0\0\344\4\0\0\200\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0@\0\0\0`\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\370L\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\01\06\0U\2\0\0\344\4\0\0\200\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0D\0\0\0V\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0D\0\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0V\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0W\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0D\0\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) \0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0V\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0W\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0D\0\0\0\0\0\0\0 (68, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\16\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\33\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\5\0\0\0\377\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\08\0A\0D\04\0D\08\00\06\0-\00\08\01\0B\0-\04\04\04\06\0-\0A\0\0\0\0\0\204\3\0\0T\2\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0D\0\0\0T\2\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0U\2\0\0\344\4\0\0\200\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0@\0\0\0`\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\370L\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\01\06\0U\2\0\0\344\4\0\0\200\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0D\0\0\0V\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0D\0\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0V\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0W\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0D\0\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) }, 900, ) == 0x0
 00596   896   NtClose  (68, ... ) == 0x0
 00597   896   NtOpenKey  (0x20019, {24, 64, 0x40, 0, 0,  (0x20019, {24, 64, 0x40, 0, 0, "000000000016"}, ... 68, ) }, ... 68, ) == 0x0
 00598   896   NtQueryValueKey  (68,  (68, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 00599   896   NtQueryValueKey  (68,  (68, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 00600   896   NtQueryValueKey  (68,  (68, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\11\2\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\34\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\2\0\0\0\377\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\08\0A\0D\04\0D\08\00\06\0-\00\08\01\0B\0-\04\04\04\06\0-\0A\0\0\0\0\0\204\3\0\0Y\2\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0D\0\0\0Y\2\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0Z\2\0\0\344\4\0\0\200\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0@\0\0\0`\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\370L\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\01\07\0Z\2\0\0\344\4\0\0\200\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0D\0\0\0[\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0D\0\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0[\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0D\0\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) , Partial, 900, ... TitleIdx=0, Type=3, Data= (68, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\11\2\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\34\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\2\0\0\0\377\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\08\0A\0D\04\0D\08\00\06\0-\00\08\01\0B\0-\04\04\04\06\0-\0A\0\0\0\0\0\204\3\0\0Y\2\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0D\0\0\0Y\2\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0Z\2\0\0\344\4\0\0\200\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0@\0\0\0`\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\370L\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\01\07\0Z\2\0\0\344\4\0\0\200\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0D\0\0\0[\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0D\0\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0[\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0D\0\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) \0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0[\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0D\0\0\0\0\0\0\0 (68, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\11\2\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\34\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\2\0\0\0\377\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\08\0A\0D\04\0D\08\00\06\0-\00\08\01\0B\0-\04\04\04\06\0-\0A\0\0\0\0\0\204\3\0\0Y\2\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0D\0\0\0Y\2\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0Z\2\0\0\344\4\0\0\200\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0@\0\0\0`\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\370L\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\01\07\0Z\2\0\0\344\4\0\0\200\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0D\0\0\0[\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0D\0\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0[\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0D\0\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) }, 900, ) == 0x0
 00601   896   NtClose  (68, ... ) == 0x0
 00602   896   NtOpenKey  (0x20019, {24, 64, 0x40, 0, 0,  (0x20019, {24, 64, 0x40, 0, 0, "000000000017"}, ... 68, ) }, ... 68, ) == 0x0
 00603   896   NtQueryValueKey  (68,  (68, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 00604   896   NtQueryValueKey  (68,  (68, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 00605   896   NtAllocateVirtualMemory  (-1, 1347584, 0, 4096, 4096, 4, ... 1347584, 4096, ) == 0x0
 00606   896   NtQueryValueKey  (68,  (68, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\16\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\35\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\5\0\0\0\376\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\0E\05\05\09\0B\00\0C\01\0-\0F\0A\04\06\0-\04\06\04\0D\0-\0B\0\0\0\0\0\204\3\0\0_\2\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0D\0\0\0_\2\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0`\2\0\0\344\4\0\0\200\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0@\0\0\0`\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\370L\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\01\08\0`\2\0\0\344\4\0\0\200\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0D\0\0\0a\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0D\0\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0a\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0b\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0D\0\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) , Partial, 900, ... TitleIdx=0, Type=3, Data= (68, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\16\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\35\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\5\0\0\0\376\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\0E\05\05\09\0B\00\0C\01\0-\0F\0A\04\06\0-\04\06\04\0D\0-\0B\0\0\0\0\0\204\3\0\0_\2\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0D\0\0\0_\2\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0`\2\0\0\344\4\0\0\200\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0@\0\0\0`\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\370L\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\01\08\0`\2\0\0\344\4\0\0\200\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0D\0\0\0a\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0D\0\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0a\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0b\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0D\0\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) \0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0a\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0b\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0D\0\0\0\0\0\0\0 (68, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\16\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\35\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\5\0\0\0\376\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\0E\05\05\09\0B\00\0C\01\0-\0F\0A\04\06\0-\04\06\04\0D\0-\0B\0\0\0\0\0\204\3\0\0_\2\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0D\0\0\0_\2\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0`\2\0\0\344\4\0\0\200\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0@\0\0\0`\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\370L\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\01\08\0`\2\0\0\344\4\0\0\200\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0D\0\0\0a\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0D\0\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0a\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0b\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0D\0\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) }, 900, ) == 0x0
 00607   896   NtClose  (68, ... ) == 0x0
 00608   896   NtOpenKey  (0x20019, {24, 64, 0x40, 0, 0,  (0x20019, {24, 64, 0x40, 0, 0, "000000000018"}, ... 68, ) }, ... 68, ) == 0x0
 00609   896   NtQueryValueKey  (68,  (68, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 00610   896   NtQueryValueKey  (68,  (68, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 00611   896   NtQueryValueKey  (68,  (68, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\11\2\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\36\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\2\0\0\0\376\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\0E\05\05\09\0B\00\0C\01\0-\0F\0A\04\06\0-\04\06\04\0D\0-\0B\0\0\0\0\0\204\3\0\0d\2\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0D\0\0\0d\2\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0e\2\0\0\344\4\0\0\200\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0@\0\0\0`\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\370L\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\01\09\0e\2\0\0\344\4\0\0\200\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0D\0\0\0f\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0D\0\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0f\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0g\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0D\0\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) , Partial, 900, ... TitleIdx=0, Type=3, Data= (68, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\11\2\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\36\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\2\0\0\0\376\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\0E\05\05\09\0B\00\0C\01\0-\0F\0A\04\06\0-\04\06\04\0D\0-\0B\0\0\0\0\0\204\3\0\0d\2\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0D\0\0\0d\2\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0e\2\0\0\344\4\0\0\200\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0@\0\0\0`\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\370L\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\01\09\0e\2\0\0\344\4\0\0\200\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0D\0\0\0f\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0D\0\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0f\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0g\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0D\0\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) \0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0f\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0g\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0D\0\0\0\0\0\0\0 (68, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\11\2\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\36\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\2\0\0\0\376\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\0E\05\05\09\0B\00\0C\01\0-\0F\0A\04\06\0-\04\06\04\0D\0-\0B\0\0\0\0\0\204\3\0\0d\2\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0D\0\0\0d\2\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0e\2\0\0\344\4\0\0\200\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0@\0\0\0`\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\370L\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\01\09\0e\2\0\0\344\4\0\0\200\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0D\0\0\0f\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0D\0\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0f\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0g\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0D\0\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) }, 900, ) == 0x0
 00612   896   NtClose  (68, ... ) == 0x0
 00613   896   NtOpenKey  (0x20019, {24, 64, 0x40, 0, 0,  (0x20019, {24, 64, 0x40, 0, 0, "000000000019"}, ... 68, ) }, ... 68, ) == 0x0
 00614   896   NtQueryValueKey  (68,  (68, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 00615   896   NtQueryValueKey  (68,  (68, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 00616   896   NtQueryValueKey  (68,  (68, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\16\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\37\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\5\0\0\0\372\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\0C\0D\03\0C\06\04\0B\08\0-\0D\0B\07\06\0-\04\04\0C\08\0-\09\0\0\0\0\0\204\3\0\0i\2\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0D\0\0\0i\2\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0j\2\0\0\344\4\0\0\200\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0@\0\0\0`\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\370L\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\02\00\0j\2\0\0\344\4\0\0\200\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0D\0\0\0k\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0D\0\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0k\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0l\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0D\0\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) , Partial, 900, ... TitleIdx=0, Type=3, Data= (68, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\16\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\37\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\5\0\0\0\372\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\0C\0D\03\0C\06\04\0B\08\0-\0D\0B\07\06\0-\04\04\0C\08\0-\09\0\0\0\0\0\204\3\0\0i\2\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0D\0\0\0i\2\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0j\2\0\0\344\4\0\0\200\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0@\0\0\0`\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\370L\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\02\00\0j\2\0\0\344\4\0\0\200\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0D\0\0\0k\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0D\0\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0k\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0l\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0D\0\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) \0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0k\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0l\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0D\0\0\0\0\0\0\0 (68, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\16\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\37\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\5\0\0\0\372\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\0C\0D\03\0C\06\04\0B\08\0-\0D\0B\07\06\0-\04\04\0C\08\0-\09\0\0\0\0\0\204\3\0\0i\2\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0D\0\0\0i\2\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0j\2\0\0\344\4\0\0\200\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0@\0\0\0`\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\370L\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\02\00\0j\2\0\0\344\4\0\0\200\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0D\0\0\0k\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0D\0\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0k\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0l\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0D\0\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) }, 900, ) == 0x0
 00617   896   NtClose  (68, ... ) == 0x0
 00618   896   NtOpenKey  (0x20019, {24, 64, 0x40, 0, 0,  (0x20019, {24, 64, 0x40, 0, 0, "000000000020"}, ... 68, ) }, ... 68, ) == 0x0
 00619   896   NtQueryValueKey  (68,  (68, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 00620   896   NtQueryValueKey  (68,  (68, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 00621   896   NtQueryValueKey  (68,  (68, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\11\2\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222 \4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\2\0\0\0\372\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\0C\0D\03\0C\06\04\0B\08\0-\0D\0B\07\06\0-\04\04\0C\08\0-\09\0\0\0\0\0\204\3\0\0n\2\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0D\0\0\0n\2\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0o\2\0\0\344\4\0\0\200\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0@\0\0\0`\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\370L\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\02\01\0o\2\0\0\344\4\0\0\200\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0D\0\0\0p\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0D\0\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0p\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0q\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0D\0\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) , Partial, 900, ... TitleIdx=0, Type=3, Data= (68, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\11\2\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222 \4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\2\0\0\0\372\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\0C\0D\03\0C\06\04\0B\08\0-\0D\0B\07\06\0-\04\04\0C\08\0-\09\0\0\0\0\0\204\3\0\0n\2\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0D\0\0\0n\2\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0o\2\0\0\344\4\0\0\200\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0@\0\0\0`\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\370L\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\02\01\0o\2\0\0\344\4\0\0\200\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0D\0\0\0p\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0D\0\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0p\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0q\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0D\0\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) \0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0p\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0q\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0D\0\0\0\0\0\0\0 (68, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\11\2\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222 \4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\2\0\0\0\372\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\0C\0D\03\0C\06\04\0B\08\0-\0D\0B\07\06\0-\04\04\0C\08\0-\09\0\0\0\0\0\204\3\0\0n\2\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0D\0\0\0n\2\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0o\2\0\0\344\4\0\0\200\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0@\0\0\0`\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\370L\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\02\01\0o\2\0\0\344\4\0\0\200\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0D\0\0\0p\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0D\0\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0p\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0q\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0D\0\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) }, 900, ) == 0x0
 00622   896   NtClose  (68, ... ) == 0x0
 00623   896   NtOpenKey  (0x20019, {24, 64, 0x40, 0, 0,  (0x20019, {24, 64, 0x40, 0, 0, "000000000021"}, ... 68, ) }, ... 68, ) == 0x0
 00624   896   NtQueryValueKey  (68,  (68, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 00625   896   NtQueryValueKey  (68,  (68, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 00626   896   NtQueryValueKey  (68,  (68, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\16\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222!\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\5\0\0\0\371\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\02\01\0B\08\0E\09\0D\05\0-\03\0F\0C\03\0-\04\0F\09\0D\0-\08\0\0\0\0\0\204\3\0\0s\2\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0D\0\0\0s\2\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0t\2\0\0\344\4\0\0\200\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0@\0\0\0`\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\370L\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\02\02\0t\2\0\0\344\4\0\0\200\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0D\0\0\0u\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0D\0\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0u\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0v\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0D\0\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) , Partial, 900, ... TitleIdx=0, Type=3, Data= (68, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\16\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222!\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\5\0\0\0\371\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\02\01\0B\08\0E\09\0D\05\0-\03\0F\0C\03\0-\04\0F\09\0D\0-\08\0\0\0\0\0\204\3\0\0s\2\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0D\0\0\0s\2\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0t\2\0\0\344\4\0\0\200\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0@\0\0\0`\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\370L\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\02\02\0t\2\0\0\344\4\0\0\200\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0D\0\0\0u\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0D\0\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0u\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0v\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0D\0\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) \0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0u\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0v\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0D\0\0\0\0\0\0\0 (68, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\16\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222!\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\5\0\0\0\371\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\02\01\0B\08\0E\09\0D\05\0-\03\0F\0C\03\0-\04\0F\09\0D\0-\08\0\0\0\0\0\204\3\0\0s\2\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0D\0\0\0s\2\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0t\2\0\0\344\4\0\0\200\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0@\0\0\0`\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\370L\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\02\02\0t\2\0\0\344\4\0\0\200\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0D\0\0\0u\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0D\0\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0u\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0v\2\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0D\0\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) }, 900, ) == 0x0
 00627   896   NtClose  (68, ... ) == 0x0
 00628   896   NtOpenKey  (0x20019, {24, 64, 0x40, 0, 0,  (0x20019, {24, 64, 0x40, 0, 0, "000000000022"}, ... 68, ) }, ... 68, ) == 0x0
 00629   896   NtQueryValueKey  (68,  (68, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 00630   896   NtQueryValueKey  (68,  (68, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 00631   896   NtAllocateVirtualMemory  (-1, 1351680, 0, 4096, 4096, 4, ... 1351680, 4096, ) == 0x0
 00632   896   NtQueryValueKey  (68,  (68, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\11\2\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222"\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\2\0\0\0\371\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\02\01\0B\08\0E\09\0D\05\0-\03\0F\0C\03\0-\04\0F\09\0D\0-\08\0\0\0\0\0\204\3\0\0y\2\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0D\0\0\0y\2\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0z\2\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0@\0\0\0z\2\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0{\2\0\0\344\4\0\0\200\3\0\0\305\0\0\0\0\0\1\0\0\0\0\0\24\0\0\08\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\2\0\0\344\4\0\0\200\3\0\0\305\0\0\0\1\0\1\0\2\1\0\0\0\0\0\0|\2\0\0\344\4\0\0\200\3\0\0\25\0\0\0\0\0\1\0\0\0\0\0\24\0\0\0\3\0\37\0\377\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0|\2\0\0\344\4\0\0\200\3\0\0\25\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0@\0\0\0}\2\0\0\344\4\0\0\200\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0T\0\0\0\0\0\0\2\0\0\0\0\30\0\0\04\0\0\0\210\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0$\0&\0\310L\24\0\0\0\0\0N\0a\0m\0e\0S\0p\0a\0c\0e\0_\0C\0a\0t\0a\0l\0o\0g\05\0"}, 900, ) , Partial, 900, ... TitleIdx=0, Type=3, Data= (68, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\11\2\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222"\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\2\0\0\0\371\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\02\01\0B\08\0E\09\0D\05\0-\03\0F\0C\03\0-\04\0F\09\0D\0-\08\0\0\0\0\0\204\3\0\0y\2\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0D\0\0\0y\2\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0z\2\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0@\0\0\0z\2\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0{\2\0\0\344\4\0\0\200\3\0\0\305\0\0\0\0\0\1\0\0\0\0\0\24\0\0\08\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\2\0\0\344\4\0\0\200\3\0\0\305\0\0\0\1\0\1\0\2\1\0\0\0\0\0\0|\2\0\0\344\4\0\0\200\3\0\0\25\0\0\0\0\0\1\0\0\0\0\0\24\0\0\0\3\0\37\0\377\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0|\2\0\0\344\4\0\0\200\3\0\0\25\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0@\0\0\0}\2\0\0\344\4\0\0\200\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0T\0\0\0\0\0\0\2\0\0\0\0\30\0\0\04\0\0\0\210\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0$\0&\0\310L\24\0\0\0\0\0N\0a\0m\0e\0S\0p\0a\0c\0e\0_\0C\0a\0t\0a\0l\0o\0g\05\0"}, 900, ) \4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\2\0\0\0\371\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\02\01\0B\08\0E\09\0D\05\0-\03\0F\0C\03\0-\04\0F\09\0D\0-\08\0\0\0\0\0\204\3\0\0y\2\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0D\0\0\0y\2\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0z\2\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0@\0\0\0z\2\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0{\2\0\0\344\4\0\0\200\3\0\0\305\0\0\0\0\0\1\0\0\0\0\0\24\0\0\08\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\2\0\0\344\4\0\0\200\3\0\0\305\0\0\0\1\0\1\0\2\1\0\0\0\0\0\0|\2\0\0\344\4\0\0\200\3\0\0\25\0\0\0\0\0\1\0\0\0\0\0\24\0\0\0\3\0\37\0\377\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0|\2\0\0\344\4\0\0\200\3\0\0\25\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0@\0\0\0}\2\0\0\344\4\0\0\200\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0T\0\0\0\0\0\0\2\0\0\0\0\30\0\0\04\0\0\0\210\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0$\0&\0\310L\24\0\0\0\0\0N\0a\0m\0e\0S\0p\0a\0c\0e\0_\0C\0a\0t\0a\0l\0o\0g\05\0"}, 900, ) == 0x0
 00633   896   NtClose  (68, ... ) == 0x0
 00634   896   NtClose  (64, ... ) == 0x0
 00635   896   NtWaitForSingleObject  (56, 0, {0, 0}, ... ) == 0x102
 00636   896   NtCreateEvent  (0x1f0003, 0x0, 0, 0, ... 64, ) == 0x0
 00637   896   NtOpenKey  (0x2000000, {24, 52, 0x40, 0, 0,  (0x2000000, {24, 52, 0x40, 0, 0, "NameSpace_Catalog5"}, ... 68, ) }, ... 68, ) == 0x0
 00638   896   NtQueryValueKey  (68,  (68, "Serial_Access_Num", Partial, 144, ... TitleIdx=0, Type=4, Data="\5\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (68, "Serial_Access_Num", Partial, 144, ... TitleIdx=0, Type=4, Data="\5\0\0\0"}, 16, ) }, 16, ) == 0x0
 00639   896   NtNotifyChangeKey  (68, 64, 0, 0, 2011455960, 1, 0, 0, 0, 1, ... ) == 0x103
 00640   896   NtQueryValueKey  (68,  (68, "Serial_Access_Num", Partial, 144, ... TitleIdx=0, Type=4, Data="\5\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (68, "Serial_Access_Num", Partial, 144, ... TitleIdx=0, Type=4, Data="\5\0\0\0"}, 16, ) }, 16, ) == 0x0
 00641   896   NtOpenKey  (0x2000000, {24, 68, 0x40, 0, 0,  (0x2000000, {24, 68, 0x40, 0, 0, "00000005"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00642   896   NtQueryValueKey  (68,  (68, "Num_Catalog_Entries", Partial, 144, ... TitleIdx=0, Type=4, Data="\4\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (68, "Num_Catalog_Entries", Partial, 144, ... TitleIdx=0, Type=4, Data="\4\0\0\0"}, 16, ) }, 16, ) == 0x0
 00643   896   NtOpenKey  (0x2000000, {24, 68, 0x40, 0, 0,  (0x2000000, {24, 68, 0x40, 0, 0, "Catalog_Entries"}, ... 72, ) }, ... 72, ) == 0x0
 00644   896   NtOpenKey  (0x20019, {24, 72, 0x40, 0, 0,  (0x20019, {24, 72, 0x40, 0, 0, "000000000001"}, ... 76, ) }, ... 76, ) == 0x0
 00645   896   NtQueryValueKey  (76,  (76, "LibraryPath", Partial, 144, ... TitleIdx=0, Type=1, Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0m\0s\0w\0s\0o\0c\0k\0.\0d\0l\0l\0\0\0"}, 80, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (76, "LibraryPath", Partial, 144, ... TitleIdx=0, Type=1, Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0m\0s\0w\0s\0o\0c\0k\0.\0d\0l\0l\0\0\0"}, 80, ) }, 80, ) == 0x0
 00646   896   NtQueryValueKey  (76,  (76, "LibraryPath", Partial, 144, ... TitleIdx=0, Type=1, Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0m\0s\0w\0s\0o\0c\0k\0.\0d\0l\0l\0\0\0"}, 80, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (76, "LibraryPath", Partial, 144, ... TitleIdx=0, Type=1, Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0m\0s\0w\0s\0o\0c\0k\0.\0d\0l\0l\0\0\0"}, 80, ) }, 80, ) == 0x0
 00647   896   NtQueryValueKey  (76,  (76, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="T\0c\0p\0i\0p\0\0\0"}, 24, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (76, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="T\0c\0p\0i\0p\0\0\0"}, 24, ) }, 24, ) == 0x0
 00648   896   NtQueryValueKey  (76,  (76, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="T\0c\0p\0i\0p\0\0\0"}, 24, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (76, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="T\0c\0p\0i\0p\0\0\0"}, 24, ) }, 24, ) == 0x0
 00649   896   NtQueryValueKey  (76,  (76, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="T\0c\0p\0i\0p\0\0\0"}, 24, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (76, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="T\0c\0p\0i\0p\0\0\0"}, 24, ) }, 24, ) == 0x0
 00650   896   NtQueryValueKey  (76,  (76, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="T\0c\0p\0i\0p\0\0\0"}, 24, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (76, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="T\0c\0p\0i\0p\0\0\0"}, 24, ) }, 24, ) == 0x0
 00651   896   NtQueryValueKey  (76,  (76, "ProviderId", Partial, 144, ... TitleIdx=0, Type=3, Data="@\235\5"\236~\317\21\256Z\0\252\0\247\21+"}, 28, ) , Partial, 144, ... TitleIdx=0, Type=3, Data= (76, "ProviderId", Partial, 144, ... TitleIdx=0, Type=3, Data="@\235\5"\236~\317\21\256Z\0\252\0\247\21+"}, 28, ) \236~\317\21\256Z\0\252\0\247\21+"}, 28, ) == 0x0
 00652   896   NtQueryValueKey  (76,  (76, "AddressFamily", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00653   896   NtQueryValueKey  (76,  (76, "SupportedNameSpace", Partial, 144, ... TitleIdx=0, Type=4, Data="\14\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (76, "SupportedNameSpace", Partial, 144, ... TitleIdx=0, Type=4, Data="\14\0\0\0"}, 16, ) }, 16, ) == 0x0
 00654   896   NtQueryValueKey  (76,  (76, "Enabled", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (76, "Enabled", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) }, 16, ) == 0x0
 00655   896   NtQueryValueKey  (76,  (76, "Version", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (76, "Version", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) }, 16, ) == 0x0
 00656   896   NtQueryValueKey  (76,  (76, "StoresServiceClassInfo", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (76, "StoresServiceClassInfo", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) }, 16, ) == 0x0
 00657   896   NtClose  (76, ... ) == 0x0
 00658   896   NtOpenKey  (0x20019, {24, 72, 0x40, 0, 0,  (0x20019, {24, 72, 0x40, 0, 0, "000000000002"}, ... 76, ) }, ... 76, ) == 0x0
 00659   896   NtQueryValueKey  (76,  (76, "LibraryPath", Partial, 144, ... TitleIdx=0, Type=1, Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0w\0i\0n\0r\0n\0r\0.\0d\0l\0l\0\0\0"}, 78, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (76, "LibraryPath", Partial, 144, ... TitleIdx=0, Type=1, Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0w\0i\0n\0r\0n\0r\0.\0d\0l\0l\0\0\0"}, 78, ) }, 78, ) == 0x0
 00660   896   NtQueryValueKey  (76,  (76, "LibraryPath", Partial, 144, ... TitleIdx=0, Type=1, Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0w\0i\0n\0r\0n\0r\0.\0d\0l\0l\0\0\0"}, 78, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (76, "LibraryPath", Partial, 144, ... TitleIdx=0, Type=1, Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0w\0i\0n\0r\0n\0r\0.\0d\0l\0l\0\0\0"}, 78, ) }, 78, ) == 0x0
 00661   896   NtQueryValueKey  (76,  (76, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="N\0T\0D\0S\0\0\0"}, 22, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (76, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="N\0T\0D\0S\0\0\0"}, 22, ) }, 22, ) == 0x0
 00662   896   NtQueryValueKey  (76,  (76, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="N\0T\0D\0S\0\0\0"}, 22, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (76, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="N\0T\0D\0S\0\0\0"}, 22, ) }, 22, ) == 0x0
 00663   896   NtQueryValueKey  (76,  (76, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="N\0T\0D\0S\0\0\0"}, 22, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (76, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="N\0T\0D\0S\0\0\0"}, 22, ) }, 22, ) == 0x0
 00664   896   NtQueryValueKey  (76,  (76, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="N\0T\0D\0S\0\0\0"}, 22, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (76, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="N\0T\0D\0S\0\0\0"}, 22, ) }, 22, ) == 0x0
 00665   896   NtQueryValueKey  (76,  (76, "ProviderId", Partial, 144, ... TitleIdx=0, Type=3, Data="\3567&;\200\345\317\21\245U\0\300O\330\324\254"}, 28, ) , Partial, 144, ... TitleIdx=0, Type=3, Data= (76, "ProviderId", Partial, 144, ... TitleIdx=0, Type=3, Data="\3567&;\200\345\317\21\245U\0\300O\330\324\254"}, 28, ) }, 28, ) == 0x0
 00666   896   NtQueryValueKey  (76,  (76, "AddressFamily", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00667   896   NtQueryValueKey  (76,  (76, "SupportedNameSpace", Partial, 144, ... TitleIdx=0, Type=4, Data=" \0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (76, "SupportedNameSpace", Partial, 144, ... TitleIdx=0, Type=4, Data=" \0\0\0"}, 16, ) }, 16, ) == 0x0
 00668   896   NtQueryValueKey  (76,  (76, "Enabled", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (76, "Enabled", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) }, 16, ) == 0x0
 00669   896   NtQueryValueKey  (76,  (76, "Version", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (76, "Version", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) }, 16, ) == 0x0
 00670   896   NtQueryValueKey  (76,  (76, "StoresServiceClassInfo", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (76, "StoresServiceClassInfo", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) }, 16, ) == 0x0
 00671   896   NtClose  (76, ... ) == 0x0
 00672   896   NtOpenKey  (0x20019, {24, 72, 0x40, 0, 0,  (0x20019, {24, 72, 0x40, 0, 0, "000000000003"}, ... 76, ) }, ... 76, ) == 0x0
 00673   896   NtQueryValueKey  (76,  (76, "LibraryPath", Partial, 144, ... TitleIdx=0, Type=1, Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0m\0s\0w\0s\0o\0c\0k\0.\0d\0l\0l\0\0\0"}, 80, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (76, "LibraryPath", Partial, 144, ... TitleIdx=0, Type=1, Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0m\0s\0w\0s\0o\0c\0k\0.\0d\0l\0l\0\0\0"}, 80, ) }, 80, ) == 0x0
 00674   896   NtQueryValueKey  (76,  (76, "LibraryPath", Partial, 144, ... TitleIdx=0, Type=1, Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0m\0s\0w\0s\0o\0c\0k\0.\0d\0l\0l\0\0\0"}, 80, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (76, "LibraryPath", Partial, 144, ... TitleIdx=0, Type=1, Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0m\0s\0w\0s\0o\0c\0k\0.\0d\0l\0l\0\0\0"}, 80, ) }, 80, ) == 0x0
 00675   896   NtQueryValueKey  (76,  (76, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="N\0e\0t\0w\0o\0r\0k\0 \0L\0o\0c\0a\0t\0i\0o\0n\0 \0A\0w\0a\0r\0e\0n\0e\0s\0s\0 \0(\0N\0L\0A\0)\0 \0N\0a\0m\0e\0s\0p\0a\0c\0e\0\0\0"}, 98, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (76, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="N\0e\0t\0w\0o\0r\0k\0 \0L\0o\0c\0a\0t\0i\0o\0n\0 \0A\0w\0a\0r\0e\0n\0e\0s\0s\0 \0(\0N\0L\0A\0)\0 \0N\0a\0m\0e\0s\0p\0a\0c\0e\0\0\0"}, 98, ) }, 98, ) == 0x0
 00676   896   NtQueryValueKey  (76,  (76, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="N\0e\0t\0w\0o\0r\0k\0 \0L\0o\0c\0a\0t\0i\0o\0n\0 \0A\0w\0a\0r\0e\0n\0e\0s\0s\0 \0(\0N\0L\0A\0)\0 \0N\0a\0m\0e\0s\0p\0a\0c\0e\0\0\0"}, 98, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (76, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="N\0e\0t\0w\0o\0r\0k\0 \0L\0o\0c\0a\0t\0i\0o\0n\0 \0A\0w\0a\0r\0e\0n\0e\0s\0s\0 \0(\0N\0L\0A\0)\0 \0N\0a\0m\0e\0s\0p\0a\0c\0e\0\0\0"}, 98, ) }, 98, ) == 0x0
 00677   896   NtQueryValueKey  (76,  (76, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="N\0e\0t\0w\0o\0r\0k\0 \0L\0o\0c\0a\0t\0i\0o\0n\0 \0A\0w\0a\0r\0e\0n\0e\0s\0s\0 \0(\0N\0L\0A\0)\0 \0N\0a\0m\0e\0s\0p\0a\0c\0e\0\0\0"}, 98, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (76, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="N\0e\0t\0w\0o\0r\0k\0 \0L\0o\0c\0a\0t\0i\0o\0n\0 \0A\0w\0a\0r\0e\0n\0e\0s\0s\0 \0(\0N\0L\0A\0)\0 \0N\0a\0m\0e\0s\0p\0a\0c\0e\0\0\0"}, 98, ) }, 98, ) == 0x0
 00678   896   NtQueryValueKey  (76,  (76, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="N\0e\0t\0w\0o\0r\0k\0 \0L\0o\0c\0a\0t\0i\0o\0n\0 \0A\0w\0a\0r\0e\0n\0e\0s\0s\0 \0(\0N\0L\0A\0)\0 \0N\0a\0m\0e\0s\0p\0a\0c\0e\0\0\0"}, 98, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (76, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="N\0e\0t\0w\0o\0r\0k\0 \0L\0o\0c\0a\0t\0i\0o\0n\0 \0A\0w\0a\0r\0e\0n\0e\0s\0s\0 \0(\0N\0L\0A\0)\0 \0N\0a\0m\0e\0s\0p\0a\0c\0e\0\0\0"}, 98, ) }, 98, ) == 0x0
 00679   896   NtQueryValueKey  (76,  (76, "ProviderId", Partial, 144, ... TitleIdx=0, Type=3, Data=":$Bf\250;\246J\272\245.\13\327\37\335\203"}, 28, ) , Partial, 144, ... TitleIdx=0, Type=3, Data= (76, "ProviderId", Partial, 144, ... TitleIdx=0, Type=3, Data=":$Bf\250;\246J\272\245.\13\327\37\335\203"}, 28, ) }, 28, ) == 0x0
 00680   896   NtQueryValueKey  (76,  (76, "AddressFamily", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00681   896   NtQueryValueKey  (76,  (76, "SupportedNameSpace", Partial, 144, ... TitleIdx=0, Type=4, Data="\17\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (76, "SupportedNameSpace", Partial, 144, ... TitleIdx=0, Type=4, Data="\17\0\0\0"}, 16, ) }, 16, ) == 0x0
 00682   896   NtQueryValueKey  (76,  (76, "Enabled", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (76, "Enabled", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) }, 16, ) == 0x0
 00683   896   NtQueryValueKey  (76,  (76, "Version", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (76, "Version", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) }, 16, ) == 0x0
 00684   896   NtQueryValueKey  (76,  (76, "StoresServiceClassInfo", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (76, "StoresServiceClassInfo", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) }, 16, ) == 0x0
 00685   896   NtClose  (76, ... ) == 0x0
 00686   896   NtOpenKey  (0x20019, {24, 72, 0x40, 0, 0,  (0x20019, {24, 72, 0x40, 0, 0, "000000000004"}, ... 76, ) }, ... 76, ) == 0x0
 00687   896   NtQueryValueKey  (76,  (76, "LibraryPath", Partial, 144, ... TitleIdx=0, Type=1, Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0s\0y\0s\0t\0e\0m\03\02\0\\0w\0s\0h\0b\0t\0h\0.\0d\0l\0l\0\0\0"}, 78, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (76, "LibraryPath", Partial, 144, ... TitleIdx=0, Type=1, Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0s\0y\0s\0t\0e\0m\03\02\0\\0w\0s\0h\0b\0t\0h\0.\0d\0l\0l\0\0\0"}, 78, ) }, 78, ) == 0x0
 00688   896   NtQueryValueKey  (76,  (76, "LibraryPath", Partial, 144, ... TitleIdx=0, Type=1, Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0s\0y\0s\0t\0e\0m\03\02\0\\0w\0s\0h\0b\0t\0h\0.\0d\0l\0l\0\0\0"}, 78, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (76, "LibraryPath", Partial, 144, ... TitleIdx=0, Type=1, Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0s\0y\0s\0t\0e\0m\03\02\0\\0w\0s\0h\0b\0t\0h\0.\0d\0l\0l\0\0\0"}, 78, ) }, 78, ) == 0x0
 00689   896   NtQueryValueKey  (76,  (76, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="B\0l\0u\0e\0t\0o\0o\0t\0h\0 \0N\0a\0m\0e\0s\0p\0a\0c\0e\0\0\0"}, 52, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (76, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="B\0l\0u\0e\0t\0o\0o\0t\0h\0 \0N\0a\0m\0e\0s\0p\0a\0c\0e\0\0\0"}, 52, ) }, 52, ) == 0x0
 00690   896   NtQueryValueKey  (76,  (76, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="B\0l\0u\0e\0t\0o\0o\0t\0h\0 \0N\0a\0m\0e\0s\0p\0a\0c\0e\0\0\0"}, 52, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (76, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="B\0l\0u\0e\0t\0o\0o\0t\0h\0 \0N\0a\0m\0e\0s\0p\0a\0c\0e\0\0\0"}, 52, ) }, 52, ) == 0x0
 00691   896   NtQueryValueKey  (76,  (76, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="B\0l\0u\0e\0t\0o\0o\0t\0h\0 \0N\0a\0m\0e\0s\0p\0a\0c\0e\0\0\0"}, 52, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (76, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="B\0l\0u\0e\0t\0o\0o\0t\0h\0 \0N\0a\0m\0e\0s\0p\0a\0c\0e\0\0\0"}, 52, ) }, 52, ) == 0x0
 00692   896   NtQueryValueKey  (76,  (76, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="B\0l\0u\0e\0t\0o\0o\0t\0h\0 \0N\0a\0m\0e\0s\0p\0a\0c\0e\0\0\0"}, 52, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (76, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="B\0l\0u\0e\0t\0o\0o\0t\0h\0 \0N\0a\0m\0e\0s\0p\0a\0c\0e\0\0\0"}, 52, ) }, 52, ) == 0x0
 00693   896   NtQueryValueKey  (76,  (76, "ProviderId", Partial, 144, ... TitleIdx=0, Type=3, Data="\340c\252\6`}\377A\257\262>\346\322\3319-"}, 28, ) , Partial, 144, ... TitleIdx=0, Type=3, Data= (76, "ProviderId", Partial, 144, ... TitleIdx=0, Type=3, Data="\340c\252\6`}\377A\257\262>\346\322\3319-"}, 28, ) }, 28, ) == 0x0
 00694   896   NtQueryValueKey  (76,  (76, "AddressFamily", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00695   896   NtQueryValueKey  (76,  (76, "SupportedNameSpace", Partial, 144, ... TitleIdx=0, Type=4, Data="\20\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (76, "SupportedNameSpace", Partial, 144, ... TitleIdx=0, Type=4, Data="\20\0\0\0"}, 16, ) }, 16, ) == 0x0
 00696   896   NtQueryValueKey  (76,  (76, "Enabled", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (76, "Enabled", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) }, 16, ) == 0x0
 00697   896   NtQueryValueKey  (76,  (76, "Version", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (76, "Version", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) }, 16, ) == 0x0
 00698   896   NtQueryValueKey  (76,  (76, "StoresServiceClassInfo", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (76, "StoresServiceClassInfo", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) }, 16, ) == 0x0
 00699   896   NtClose  (76, ... ) == 0x0
 00700   896   NtClose  (72, ... ) == 0x0
 00701   896   NtWaitForSingleObject  (64, 0, {0, 0}, ... ) == 0x102
 00702   896   NtClose  (52, ... ) == 0x0
 00703   896   NtQuerySystemInformation  (Basic, 44, ... {Unknown=0,MaximumIncrement=156250,PhysicalPageSize=0x1000,NumberOfPhysicalPages=0xff7c,LowestPhysicalPage=0x1,HighestPhysicalPage=0xffff,AllocationGranularity=0x10000,LowestUserAddress=0x10000,HighestUserAddress=0x7ffeffff,ActiveProcessors=1,NumberProcessors=1,}, 0x0, ) == 0x0
 00704   896   NtQuerySystemInformation  (Processor, 12, ... {system info, class 1, size 12}, 0x0, ) == 0x0
 00705   896   NtOpenKey  (0x1, {24, 28, 0x40, 0, 0,  (0x1, {24, 28, 0x40, 0, 0, "System\CurrentControlSet\Services\Winsock2\Parameters"}, ... 52, ) }, ... 52, ) == 0x0
 00706   896   NtQueryValueKey  (52,  (52, "Ws2_32NumHandleBuckets", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00707   896   NtClose  (52, ... ) == 0x0
 00708   896   NtAllocateVirtualMemory  (-1, 1355776, 0, 4096, 4096, 4, ... 1355776, 4096, ) == 0x0
 00709   896   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ... 52, ) == 0x0
 00710   896   NtCreateFile  (0x80100080, {24, 0, 0x40, 0, 1241648,  (0x80100080, {24, 0, 0x40, 0, 1241648, "\??\u:\work\packed.exe"}, 0x0, 0, 1, 1, 2097252, 0, 0, ... 72, {status=0x0, info=1}, ) }, 0x0, 0, 1, 1, 2097252, 0, 0, ... 72, {status=0x0, info=1}, ) == 0x0
 00711   896   NtQueryInformationFile  (72, 1242084, 8, AttributeFlag, ... {status=0x0, info=8}, ) == 0x0
 00712   896   NtQueryInformationFile  (72, 1242000, 24, Standard, ... {status=0x0, info=24}, ) == 0x0
 00713   896   NtQueryInformationFile  (72, 1241816, 40, Basic, ... {status=0x0, info=40}, ) == 0x0
 00714   896   NtAllocateVirtualMemory  (-1, 1359872, 0, 8192, 4096, 4, ... 1359872, 8192, ) == 0x0
 00715   896   NtQueryInformationFile  (72, 1355896, 4094, Stream, ... {status=0x0, info=38}, ) == 0x0
 00716   896   NtQueryInformationFile  (72, 1240264, 40, Basic, ... {status=0x0, info=40}, ) == 0x0
 00717   896   NtQueryInformationFile  (72, 1240540, 4, Ea, ... {status=0x0, info=4}, ) == 0x0
 00718   896   NtCreateFile  (0x40110080, {24, 0, 0x40, 0, 1240416,  (0x40110080, {24, 0, 0x40, 0, 1240416, "\??\C:\WINDOWS\avserve2.exe"}, 0x0, 32, 0, 5, 100, 0, 0, ... }, 0x0, 32, 0, 5, 100, 0, 0, ...
 00719   896   NtClose  (-2147481368, ... ) == 0x0
 00718   896   NtCreateFile  ... 76, {status=0x0, info=2}, ) == 0x0
 00720   896   NtQueryVolumeInformationFile  (76, 1240568, 536, Attribute, ... {status=0x0, info=20}, ) == 0x0
 00721   896   NtQueryInformationFile  (76, 1240152, 40, Basic, ... {status=0x0, info=40}, ) == 0x0
 00722   896   NtQueryVolumeInformationFile  (72, 1240568, 536, Attribute, ... {status=0x0, info=20}, ) == 0x0
 00723   896   NtQueryVolumeInformationFile  (72, 1239912, 8, Device, ... {status=0x0, info=8}, ) == 0x0
 00724   896   NtSetInformationFile  (76, 1240468, 8, EndOfFile, ... {status=0x0, info=0}, ) == 0x0
 00725   896   NtCreateSection  (0xf001f, 0x0, 0x0, 2, 134217728, 72, ... 80, ) == 0x0
 00726   896   NtMapViewOfSection  (80, -1, (0x0), 0, 0, {0, 0}, 0, 1, 0, 2, ... (0x980000), {0, 0}, 86016, ) == 0x0
 00727   896   NtClose  (80, ... ) == 0x0
 00728   896   NtWriteFile  (76, 0, 0, 0,  (76, 0, 0, 0, "MZ\220\0\3\0\0\0\4\0\0\0\377\377\0\0\270\0\0\0\0\0\0\0@\0\0\0\0\0\0\0    \0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\320\0\0\0\16\37\272\16\0\264\11\315!\270\1L\315!This program cannot be run in DOS mode.\15\15\12$\0\0\0\0\0\0\0\324%^\221\220D0\302\220D0\302\220D0\302x[:\302\212D0\302\23X>\302\233D0\302\220D1\302\331D0\302\362[#\302\231D0\302x[;\302\224D0\302(B6\302\221D0\302Rich\220D0\302\0\0\0\0\0\0\0\0PE\0\0L\1\2\0d\347\223@\0\0\0\0\0\0\0\0\340\0\17\1\13\1\6\0\0>\0\0\0"\0\0\0\0\0\0\20\220\1\0\0\20\0\0\0P\0\0\0\0@\0\0\20\0\0\0\2\0\0\4\0\0\0\0\0\0\0\4\0\0\0\0\0\0\0\0\0\2\0\0\4\0\0\0\0\0\0\2\0\0\0\0\0\20\0\0\20\0\0\0\0\20\0\0\20\0\0\0\0\0\0\20\0\0\0\0\0\0\0\0\0\0\0$\220\0\0\212\0\0\0\0\220\0\0\20\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0.text\0\0\0\0\200\0\0\0\20\0\0\00\0\0\0\4\0\02CEP\0\0\0\0\0\0\0\0 \0\0\340.rsr", 61440, 0x0, 0, ... {status=0x0, info=61440}, ) \0\0\0\0\0\0\20\220\1\0\0\20\0\0\0P\0\0\0\0@\0\0\20\0\0\0\2\0\0\4\0\0\0\0\0\0\0\4\0\0\0\0\0\0\0\0\0\2\0\0\4\0\0\0\0\0\0\2\0\0\0\0\0\20\0\0\20\0\0\0\0\20\0\0\20\0\0\0\0\0\0\20\0\0\0\0\0\0\0\0\0\0\0$\220\0\0\212\0\0\0\0\220\0\0\20\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0.text\0\0\0\0\200\0\0\0\20\0\0\00\0\0\0\4\0\02CEP\0\0\0\0\0\0\0\0 \0\0\340.rsr", 61440, 0x0, 0, ... {status=0x0, info=61440}, ) == 0x0
 00729   896   NtWriteFile  (76, 0, 0, 0,  (76, 0, 0, 0, "\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0", 24080, 0x0, 0, ... {status=0x0, info=24080}, ) , 24080, 0x0, 0, ... {status=0x0, info=24080}, ) == 0x0
 00730   896   NtUnmapViewOfSection  (-1, 0x980000, ... ) == 0x0
 00731   896   NtSetInformationFile  (76, 1241816, 40, Basic, ... {status=0x0, info=0}, ) == 0x0
 00732   896   NtClose  (72, ... ) == 0x0
 00733   896   NtClose  (76, ... ) == 0x0
 00734   896   NtOpenKey  (0x2000000, {24, 28, 0x40, 0, 0,  (0x2000000, {24, 28, 0x40, 0, 0, "SOFTWARE\Microsoft\Windows\CurrentVersion\Run"}, ... 76, ) }, ... 76, ) == 0x0
 00735   896   NtSetValueKey  (76,  (76, "avserve2.exe", 0, 1, "C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0a\0v\0s\0e\0r\0v\0e\02\0.\0e\0x\0e\0\0\0", 48, ... , 0, 1,  (76, "avserve2.exe", 0, 1, "C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0a\0v\0s\0e\0r\0v\0e\02\0.\0e\0x\0e\0\0\0", 48, ... , 48, ...
 00736   896   NtSetInformationFile  (-2147482448, -135747792, 8, EndOfFile, ... {status=0x0, info=0}, ) == 0x0
 00737   896   NtSetInformationFile  (-2147482448, -135747884, 8, EndOfFile, ... {status=0x0, info=0}, ) == 0x0
 00738   896   NtSetInformationFile  (-2147482448, -135748192, 8, EndOfFile, ... {status=0x0, info=0}, ) == 0x0
 00739   896   NtSetInformationFile  (-2147482448, -135748288, 8, EndOfFile, ... {status=0x0, info=0}, ) == 0x0
 00735   896   NtSetValueKey  ... ) == 0x0
 00740   896   NtClose  (76, ... ) == 0x0
 00741   896   NtCreateMutant  (0x1f0001, {24, 44, 0x80, 0, 0,  (0x1f0001, {24, 44, 0x80, 0, 0, "JumpallsNlsTillt"}, 0, ... 76, ) }, 0, ... 76, ) == 0x0
 00742   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ... 9961472, 1048576, ) == 0x0
 00743   896   NtAllocateVirtualMemory  (-1, 11001856, 0, 8192, 4096, 4, ... 11001856, 8192, ) == 0x0
 00744   896   NtProtectVirtualMemory  (-1, (0xa7e000), 4096, 260, ... (0xa7e000), 4096, 4, ) == 0x0
 00745   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ... 72, {1252, 2016}, ) == 0x0
 00746   896   NtQueryInformationThread  (72, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ffdd000,Pid=1252,Tid=2016,}, 0x0, ) == 0x0
 00747   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1244884, 2089878865, 1315560, 2089878893}  (24, {28, 56, new_msg, 0, 1244884, 2089878865, 1315560, 2089878893} "\0\0\0\0\1\0\1\0\0\0\0\0DEFGH\0\0\0\344\4\0\0\340\7\0\0" ... {28, 56, reply, 0, 1252, 896, 81837, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFGH\0\0\0\344\4\0\0\340\7\0\0" )  ... {28, 56, reply, 0, 1252, 896, 81837, 0}  (24, {28, 56, new_msg, 0, 1244884, 2089878865, 1315560, 2089878893} "\0\0\0\0\1\0\1\0\0\0\0\0DEFGH\0\0\0\344\4\0\0\340\7\0\0" ... {28, 56, reply, 0, 1252, 896, 81837, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFGH\0\0\0\344\4\0\0\340\7\0\0" )  ) == 0x0
 00748   896   NtResumeThread  (72, ... 1, ) == 0x0
 00749   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ... 11010048, 1048576, ) == 0x0
 00750   896   NtAllocateVirtualMemory  (-1, 12050432, 0, 8192, 4096, 4, ... 12050432, 8192, ) == 0x0
 00751  2016   NtTestAlert  (... ) == 0x0
 00752  2016   NtContinue  (11009328, 1, ...
 00753  2016   NtRegisterThreadTerminatePort  (24, ... ) == 0x0
 00754  2016   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ... 80, ) == 0x0
 00755  2016   NtWaitForSingleObject  (56, 0, {0, 0}, ... ) == 0x102
 00756  2016   NtAllocateVirtualMemory  (-1, 10997760, 0, 4096, 4096, 260, ...
 00757   896   NtProtectVirtualMemory  (-1, (0xb7e000), 4096, 260, ... (0xb7e000), 4096, 4, ) == 0x0
 00758   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ... 84, {1252, 596}, ) == 0x0
 00759   896   NtQueryInformationThread  (84, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ffdc000,Pid=1252,Tid=596,}, 0x0, ) == 0x0
 00760   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81837, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81837, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFGT\0\0\0\344\4\0\0T\2\0\0" ... {28, 56, reply, 0, 1252, 896, 81838, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFGT\0\0\0\344\4\0\0T\2\0\0" )  ... {28, 56, reply, 0, 1252, 896, 81838, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81837, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFGT\0\0\0\344\4\0\0T\2\0\0" ... {28, 56, reply, 0, 1252, 896, 81838, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFGT\0\0\0\344\4\0\0T\2\0\0" )  ) == 0x0
 00761   896   NtResumeThread  (84, ... 1, ) == 0x0
 00762   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ...
 00756  2016   NtAllocateVirtualMemory  ... 10997760, 4096, ) == 0x0
 00763   596   NtCreateEvent  (0x100003, 0x0, 1, 0, ...
 00764  2016   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\mswsock.dll"}, 11006452, ... }, 11006452, ...
 00763   596   NtCreateEvent  ... 88, ) == 0x0
 00764  2016   NtQueryAttributesFile  ... ) == 0x0
 00765   596   NtWaitForSingleObject  (88, 0, 0x0, ...
 00766  2016   NtOpenFile  (0x100020, {24, 0, 0x40, 0, 0,  (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\mswsock.dll"}, 5, 96, ... 92, {status=0x0, info=1}, ) }, 5, 96, ... 92, {status=0x0, info=1}, ) == 0x0
 00767  2016   NtCreateSection  (0xe, 0x0, 0x0, 16, 134217728, 92, ... 96, ) == 0x0
 00768  2016   NtClose  (92, ... ) == 0x0
 00769  2016   NtMapViewOfSection  (96, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 16, ... (0xb80000), 0x0, 245760, ) == 0x0
 00770  2016   NtClose  (96, ...
 00762   896   NtAllocateVirtualMemory  ... 12320768, 1048576, ) == 0x0
 00771   896   NtAllocateVirtualMemory  (-1, 13361152, 0, 8192, 4096, 4, ... 13361152, 8192, ) == 0x0
 00772   896   NtProtectVirtualMemory  (-1, (0xcbe000), 4096, 260, ... (0xcbe000), 4096, 4, ) == 0x0
 00773   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ... 92, {1252, 376}, ) == 0x0
 00774   896   NtQueryInformationThread  (92, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ffdb000,Pid=1252,Tid=376,}, 0x0, ) == 0x0
 00775   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81838, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81838, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\\0\0\0\344\4\0\0x\1\0\0" ... {28, 56, reply, 0, 1252, 896, 81839, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\\0\0\0\344\4\0\0x\1\0\0" )  ... {28, 56, reply, 0, 1252, 896, 81839, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81838, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\\0\0\0\344\4\0\0x\1\0\0" ... {28, 56, reply, 0, 1252, 896, 81839, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\\0\0\0\344\4\0\0x\1\0\0" )  ) == 0x0
 00770  2016   NtClose  ... ) == 0x0
 00776   896   NtResumeThread  (92, ... 1, ) == 0x0
 00777   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ... 13369344, 1048576, ) == 0x0
 00778   896   NtAllocateVirtualMemory  (-1, 14409728, 0, 8192, 4096, 4, ...
 00779  2016   NtUnmapViewOfSection  (-1, 0xb80000, ... ) == 0x0
 00780  2016   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\mswsock.dll"}, 11006760, ... ) }, 11006760, ... ) == 0x0
 00781  2016   NtOpenFile  (0x100020, {24, 0, 0x40, 0, 0,  (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\mswsock.dll"}, 5, 96, ... 96, {status=0x0, info=1}, ) }, 5, 96, ... 96, {status=0x0, info=1}, ) == 0x0
 00782  2016   NtCreateSection  (0xf, 0x0, 0x0, 16, 16777216, 96, ... 100, ) == 0x0
 00783  2016   NtQuerySection  (100, Image, 48, ... {section info, class 1, size 48}, 0x0, ) == 0x0
 00778   896   NtAllocateVirtualMemory  ... 14409728, 8192, ) == 0x0
 00784   376   NtWaitForSingleObject  (88, 0, 0x0, ...
 00785  2016   NtClose  (96, ... ) == 0x0
 00786  2016   NtMapViewOfSection  (100, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x71a50000), 0x0, 258048, ) == 0x0
 00787  2016   NtClose  (100, ... ) == 0x0
 00788  2016   NtProtectVirtualMemory  (-1, (0x71a51000), 1060, 4, ... (0x71a51000), 4096, 32, ) == 0x0
 00789  2016   NtProtectVirtualMemory  (-1, (0x71a51000), 4096, 32, ... (0x71a51000), 4096, 4, ) == 0x0
 00790   896   NtProtectVirtualMemory  (-1, (0xdbe000), 4096, 260, ... (0xdbe000), 4096, 4, ) == 0x0
 00791   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ... 100, {1252, 420}, ) == 0x0
 00792   896   NtQueryInformationThread  (100, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ffda000,Pid=1252,Tid=420,}, 0x0, ) == 0x0
 00793   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81839, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81839, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFGd\0\0\0\344\4\0\0\244\1\0\0" ... {28, 56, reply, 0, 1252, 896, 81840, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFGd\0\0\0\344\4\0\0\244\1\0\0" )  ... {28, 56, reply, 0, 1252, 896, 81840, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81839, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFGd\0\0\0\344\4\0\0\244\1\0\0" ... {28, 56, reply, 0, 1252, 896, 81840, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFGd\0\0\0\344\4\0\0\244\1\0\0" )  ) == 0x0
 00794   896   NtResumeThread  (100, ... 1, ) == 0x0
 00795   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ...
 00796  2016   NtFlushInstructionCache  (-1, 1906642944, 1060, ...
 00797   420   NtWaitForSingleObject  (88, 0, 0x0, ...
 00796  2016   NtFlushInstructionCache  ... ) == 0x0
 00798  2016   NtProtectVirtualMemory  (-1, (0x71a51000), 1060, 4, ... (0x71a51000), 4096, 32, ) == 0x0
 00799  2016   NtProtectVirtualMemory  (-1, (0x71a51000), 4096, 32, ... (0x71a51000), 4096, 4, ) == 0x0
 00800  2016   NtFlushInstructionCache  (-1, 1906642944, 1060, ... ) == 0x0
 00801  2016   NtProtectVirtualMemory  (-1, (0x71a51000), 1060, 4, ... (0x71a51000), 4096, 32, ) == 0x0
 00802  2016   NtProtectVirtualMemory  (-1, (0x71a51000), 4096, 32, ... (0x71a51000), 4096, 4, ) == 0x0
 00795   896   NtAllocateVirtualMemory  ... 14417920, 1048576, ) == 0x0
 00803   896   NtAllocateVirtualMemory  (-1, 15458304, 0, 8192, 4096, 4, ... 15458304, 8192, ) == 0x0
 00804   896   NtProtectVirtualMemory  (-1, (0xebe000), 4096, 260, ... (0xebe000), 4096, 4, ) == 0x0
 00805   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ... 96, {1252, 384}, ) == 0x0
 00806   896   NtQueryInformationThread  (96, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ffd9000,Pid=1252,Tid=384,}, 0x0, ) == 0x0
 00807  2016   NtFlushInstructionCache  (-1, 1906642944, 1060, ... ) == 0x0
 00808   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81840, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81840, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG`\0\0\0\344\4\0\0\200\1\0\0" ...  ...
 00809  2016   NtOpenKey  (0x80000000, {24, 0, 0x40, 0, 0,  (0x80000000, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mswsock.dll"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00810  2016   NtQuerySystemInformation  (Basic, 44, ... {Unknown=0,MaximumIncrement=156250,PhysicalPageSize=0x1000,NumberOfPhysicalPages=0xff7c,LowestPhysicalPage=0x1,HighestPhysicalPage=0xffff,AllocationGranularity=0x10000,LowestUserAddress=0x10000,HighestUserAddress=0x7ffeffff,ActiveProcessors=1,NumberProcessors=1,}, 0x0, ) == 0x0
 00811  2016   NtQuerySystemInformation  (Processor, 12, ... {system info, class 1, size 12}, 0x0, ) == 0x0
 00812  2016   NtSetEventBoostPriority  (88, ...
 00765   596   NtWaitForSingleObject  ... ) == 0x0
 00813   596   NtSetEventBoostPriority  (88, ...
 00784   376   NtWaitForSingleObject  ... ) == 0x0
 00814   376   NtSetEventBoostPriority  (88, ...
 00797   420   NtWaitForSingleObject  ... ) == 0x0
 00815   420   NtTestAlert  (... ) == 0x0
 00814   376   NtSetEventBoostPriority  ... ) == 0x0
 00813   596   NtSetEventBoostPriority  ... ) == 0x0
 00812  2016   NtSetEventBoostPriority  ... ) == 0x0
 00808   896   NtRequestWaitReplyPort  ... {28, 56, reply, 0, 1252, 896, 81841, 0}  ... {28, 56, reply, 0, 1252, 896, 81841, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG`\0\0\0\344\4\0\0\200\1\0\0" )  ) == 0x0
 00816   420   NtContinue  (14417200, 1, ...
 00817   376   NtTestAlert  (...
 00818   596   NtTestAlert  (...
 00819   896   NtResumeThread  (96, ...
 00820   420   NtRegisterThreadTerminatePort  (24, ...
 00817   376   NtTestAlert  ... ) == 0x0
 00818   596   NtTestAlert  ... ) == 0x0
 00819   896   NtResumeThread  ... 1, ) == 0x0
 00820   420   NtRegisterThreadTerminatePort  ... ) == 0x0
 00821   376   NtContinue  (13368624, 1, ...
 00822   596   NtContinue  (12057904, 1, ...
 00823   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ...
 00824   420   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 00825   376   NtRegisterThreadTerminatePort  (24, ...
 00826   596   NtRegisterThreadTerminatePort  (24, ...
 00827  2016   NtCreateEvent  (0x1f0003, 0x0, 0, 0, ...
 00828   384   NtTestAlert  (...
 00824   420   NtDuplicateObject  ... 104, ) == 0x0
 00825   376   NtRegisterThreadTerminatePort  ... ) == 0x0
 00826   596   NtRegisterThreadTerminatePort  ... ) == 0x0
 00827  2016   NtCreateEvent  ... 108, ) == 0x0
 00828   384   NtTestAlert  ... ) == 0x0
 00829   420   NtWaitForSingleObject  (64, 0, {0, 0}, ...
 00830   376   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 00831   596   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 00832  2016   NtOpenSection  (0xe, {24, 8, 0x40, 0, 0,  (0xe, {24, 8, 0x40, 0, 0, "hnetcfg.dll"}, ... }, ...
 00833   384   NtContinue  (15465776, 1, ...
 00823   896   NtAllocateVirtualMemory  ... 15466496, 1048576, ) == 0x0
 00829   420   NtWaitForSingleObject  ... ) == 0x102
 00830   376   NtDuplicateObject  ... 112, ) == 0x0
 00832  2016   NtOpenSection  ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00834   384   NtRegisterThreadTerminatePort  (24, ...
 00835   896   NtAllocateVirtualMemory  (-1, 16506880, 0, 8192, 4096, 4, ...
 00836   420   NtAllocateVirtualMemory  (-1, 14405632, 0, 4096, 4096, 260, ...
 00837   376   NtWaitForSingleObject  (64, 0, {0, 0}, ...
 00838  2016   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\u:\work\hnetcfg.dll"}, 11006372, ... }, 11006372, ...
 00834   384   NtRegisterThreadTerminatePort  ... ) == 0x0
 00835   896   NtAllocateVirtualMemory  ... 16506880, 8192, ) == 0x0
 00836   420   NtAllocateVirtualMemory  ... 14405632, 4096, ) == 0x0
 00837   376   NtWaitForSingleObject  ... ) == 0x102
 00831   596   NtDuplicateObject  ... 116, ) == 0x0
 00839   896   NtProtectVirtualMemory  (-1, (0xfbe000), 4096, 260, ...
 00840   420   NtWaitForSingleObject  (88, 0, 0x0, ...
 00841   376   NtCreateEvent  (0x100003, 0x0, 1, 0, ...
 00842   596   NtWaitForSingleObject  (64, 0, {0, 0}, ...
 00839   896   NtProtectVirtualMemory  ... (0xfbe000), 4096, 4, ) == 0x0
 00841   376   NtCreateEvent  ... 120, ) == 0x0
 00842   596   NtWaitForSingleObject  ... ) == 0x102
 00843   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ...
 00844   384   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 00845   596   NtCreateEvent  (0x100003, 0x0, 1, 0, ...
 00846   376   NtWaitForSingleObject  (120, 0, 0x0, ...
 00844   384   NtDuplicateObject  ... 124, ) == 0x0
 00845   596   NtCreateEvent  ... 128, ) == 0x0
 00847   384   NtWaitForSingleObject  (64, 0, {0, 0}, ...
 00843   896   NtCreateThread  ... 132, {1252, 1028}, ) == 0x0
 00838  2016   NtQueryAttributesFile  ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00847   384   NtWaitForSingleObject  ... ) == 0x102
 00848   896   NtQueryInformationThread  (132, Basic, 28, ...
 00849  2016   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\hnetcfg.dll"}, 11006372, ... }, 11006372, ...
 00850   384   NtWaitForSingleObject  (120, 0, 0x0, ...
 00848   896   NtQueryInformationThread  ... {ExitStatus=0x103,TebBaseAddress=0x7ffd8000,Pid=1252,Tid=1028,}, 0x0, ) == 0x0
 00849  2016   NtQueryAttributesFile  ... ) == 0x0
 00851   596   NtClose  (128, ...
 00852   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81841, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81841, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\204\0\0\0\344\4\0\0\4\4\0\0" ...  ...
 00853  2016   NtOpenFile  (0x100020, {24, 0, 0x40, 0, 0,  (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\hnetcfg.dll"}, 5, 96, ... }, 5, 96, ...
 00851   596   NtClose  ... ) == 0x0
 00852   896   NtRequestWaitReplyPort  ... {28, 56, reply, 0, 1252, 896, 81842, 0}  ... {28, 56, reply, 0, 1252, 896, 81842, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\204\0\0\0\344\4\0\0\4\4\0\0" )  ) == 0x0
 00854   596   NtWaitForSingleObject  (120, 0, 0x0, ...
 00853  2016   NtOpenFile  ... 128, {status=0x0, info=1}, ) == 0x0
 00855  2016   NtCreateSection  (0xf, 0x0, 0x0, 16, 16777216, 128, ... 136, ) == 0x0
 00856  2016   NtQuerySection  (136, Image, 48, ... {section info, class 1, size 48}, 0x0, ) == 0x0
 00857  2016   NtClose  (128, ... ) == 0x0
 00858  2016   NtMapViewOfSection  (136, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x662b0000), 0x0, 360448, ) == 0x0
 00859  2016   NtClose  (136, ... ) == 0x0
 00860  2016   NtProtectVirtualMemory  (-1, (0x662b1000), 932, 4, ...
 00861   896   NtResumeThread  (132, ... 1, ) == 0x0
 00862   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ... 16515072, 1048576, ) == 0x0
 00863   896   NtAllocateVirtualMemory  (-1, 17555456, 0, 8192, 4096, 4, ... 17555456, 8192, ) == 0x0
 00864   896   NtProtectVirtualMemory  (-1, (0x10be000), 4096, 260, ... (0x10be000), 4096, 4, ) == 0x0
 00865   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ... 136, {1252, 2012}, ) == 0x0
 00866   896   NtQueryInformationThread  (136, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ffd7000,Pid=1252,Tid=2012,}, 0x0, ) == 0x0
 00860  2016   NtProtectVirtualMemory  ... (0x662b1000), 4096, 32, ) == 0x0
 00867  1028   NtWaitForSingleObject  (88, 0, 0x0, ...
 00868  2016   NtProtectVirtualMemory  (-1, (0x662b1000), 4096, 32, ... (0x662b1000), 4096, 4, ) == 0x0
 00869  2016   NtFlushInstructionCache  (-1, 1714098176, 932, ... ) == 0x0
 00870  2016   NtProtectVirtualMemory  (-1, (0x662b1000), 932, 4, ... (0x662b1000), 4096, 32, ) == 0x0
 00871  2016   NtProtectVirtualMemory  (-1, (0x662b1000), 4096, 32, ... (0x662b1000), 4096, 4, ) == 0x0
 00872  2016   NtFlushInstructionCache  (-1, 1714098176, 932, ... ) == 0x0
 00873  2016   NtProtectVirtualMemory  (-1, (0x662b1000), 932, 4, ...
 00874   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81842, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81842, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\210\0\0\0\344\4\0\0\334\7\0\0" ... {28, 56, reply, 0, 1252, 896, 81843, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\210\0\0\0\344\4\0\0\334\7\0\0" )  ... {28, 56, reply, 0, 1252, 896, 81843, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81842, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\210\0\0\0\344\4\0\0\334\7\0\0" ... {28, 56, reply, 0, 1252, 896, 81843, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\210\0\0\0\344\4\0\0\334\7\0\0" )  ) == 0x0
 00875   896   NtResumeThread  (136, ... 1, ) == 0x0
 00876   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ... 17563648, 1048576, ) == 0x0
 00877   896   NtAllocateVirtualMemory  (-1, 18604032, 0, 8192, 4096, 4, ... 18604032, 8192, ) == 0x0
 00878   896   NtProtectVirtualMemory  (-1, (0x11be000), 4096, 260, ... (0x11be000), 4096, 4, ) == 0x0
 00879   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ...
 00873  2016   NtProtectVirtualMemory  ... (0x662b1000), 4096, 32, ) == 0x0
 00880  2012   NtWaitForSingleObject  (88, 0, 0x0, ...
 00881  2016   NtProtectVirtualMemory  (-1, (0x662b1000), 4096, 32, ... (0x662b1000), 4096, 4, ) == 0x0
 00882  2016   NtFlushInstructionCache  (-1, 1714098176, 932, ... ) == 0x0
 00883  2016   NtProtectVirtualMemory  (-1, (0x662b1000), 932, 4, ... (0x662b1000), 4096, 32, ) == 0x0
 00884  2016   NtProtectVirtualMemory  (-1, (0x662b1000), 4096, 32, ... (0x662b1000), 4096, 4, ) == 0x0
 00885  2016   NtFlushInstructionCache  (-1, 1714098176, 932, ... ) == 0x0
 00886  2016   NtProtectVirtualMemory  (-1, (0x662b1000), 932, 4, ...
 00879   896   NtCreateThread  ... 128, {1252, 1168}, ) == 0x0
 00887   896   NtQueryInformationThread  (128, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ffd6000,Pid=1252,Tid=1168,}, 0x0, ) == 0x0
 00888   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81843, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81843, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\200\0\0\0\344\4\0\0\220\4\0\0" ... {28, 56, reply, 0, 1252, 896, 81844, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\200\0\0\0\344\4\0\0\220\4\0\0" )  ... {28, 56, reply, 0, 1252, 896, 81844, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81843, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\200\0\0\0\344\4\0\0\220\4\0\0" ... {28, 56, reply, 0, 1252, 896, 81844, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\200\0\0\0\344\4\0\0\220\4\0\0" )  ) == 0x0
 00889   896   NtResumeThread  (128, ... 1, ) == 0x0
 00890   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ... 18612224, 1048576, ) == 0x0
 00891   896   NtAllocateVirtualMemory  (-1, 19652608, 0, 8192, 4096, 4, ... 19652608, 8192, ) == 0x0
 00886  2016   NtProtectVirtualMemory  ... (0x662b1000), 4096, 32, ) == 0x0
 00892  1168   NtWaitForSingleObject  (88, 0, 0x0, ...
 00893  2016   NtProtectVirtualMemory  (-1, (0x662b1000), 4096, 32, ... (0x662b1000), 4096, 4, ) == 0x0
 00894  2016   NtFlushInstructionCache  (-1, 1714098176, 932, ... ) == 0x0
 00895  2016   NtOpenKey  (0x80000000, {24, 0, 0x40, 0, 0,  (0x80000000, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\hnetcfg.dll"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00896  2016   NtSetEventBoostPriority  (88, ...
 00840   420   NtWaitForSingleObject  ... ) == 0x0
 00897   420   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\System32\mswsock.dll"}, 14412752, ... ) }, 14412752, ... ) == 0x0
 00898   420   NtSetEventBoostPriority  (88, ...
 00867  1028   NtWaitForSingleObject  ... ) == 0x0
 00899  1028   NtSetEventBoostPriority  (88, ...
 00880  2012   NtWaitForSingleObject  ... ) == 0x0
 00900  2012   NtSetEventBoostPriority  (88, ...
 00892  1168   NtWaitForSingleObject  ... ) == 0x0
 00901  1168   NtTestAlert  (... ) == 0x0
 00900  2012   NtSetEventBoostPriority  ... ) == 0x0
 00899  1028   NtSetEventBoostPriority  ... ) == 0x0
 00898   420   NtSetEventBoostPriority  ... ) == 0x0
 00896  2016   NtSetEventBoostPriority  ... ) == 0x0
 00902   896   NtProtectVirtualMemory  (-1, (0x12be000), 4096, 260, ...
 00903  1168   NtContinue  (18611504, 1, ...
 00904  2012   NtTestAlert  (...
 00905   420   NtCreateEvent  (0x1f0003, 0x0, 0, 0, ...
 00906  2016   NtQuerySystemInformation  (Basic, 44, ...
 00902   896   NtProtectVirtualMemory  ... (0x12be000), 4096, 4, ) == 0x0
 00907  1168   NtRegisterThreadTerminatePort  (24, ...
 00904  2012   NtTestAlert  ... ) == 0x0
 00905   420   NtCreateEvent  ... 140, ) == 0x0
 00906  2016   NtQuerySystemInformation  ... {Unknown=0,MaximumIncrement=156250,PhysicalPageSize=0x1000,NumberOfPhysicalPages=0xff7c,LowestPhysicalPage=0x1,HighestPhysicalPage=0xffff,AllocationGranularity=0x10000,LowestUserAddress=0x10000,HighestUserAddress=0x7ffeffff,ActiveProcessors=1,NumberProcessors=1,}, 0x0, ) == 0x0
 00908   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ...
 00907  1168   NtRegisterThreadTerminatePort  ... ) == 0x0
 00909  2012   NtContinue  (17562928, 1, ...
 00910   420   NtOpenSection  (0xe, {24, 8, 0x40, 0, 0,  (0xe, {24, 8, 0x40, 0, 0, "DNSAPI.dll"}, ... }, ...
 00911  2016   NtOpenKey  (0x20019, {24, 28, 0x40, 0, 0,  (0x20019, {24, 28, 0x40, 0, 0, "Software\Microsoft\Rpc\PagedBuffers"}, ... }, ...
 00908   896   NtCreateThread  ... 144, {1252, 1180}, ) == 0x0
 00912  1168   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 00913  2012   NtRegisterThreadTerminatePort  (24, ...
 00910   420   NtOpenSection  ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00914  1028   NtTestAlert  (...
 00915   896   NtQueryInformationThread  (144, Basic, 28, ...
 00912  1168   NtDuplicateObject  ... 148, ) == 0x0
 00913  2012   NtRegisterThreadTerminatePort  ... ) == 0x0
 00911  2016   NtOpenKey  ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00914  1028   NtTestAlert  ... ) == 0x0
 00915   896   NtQueryInformationThread  ... {ExitStatus=0x103,TebBaseAddress=0x7ffd5000,Pid=1252,Tid=1180,}, 0x0, ) == 0x0
 00916  1168   NtWaitForSingleObject  (64, 0, {0, 0}, ...
 00917  2012   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 00918  2016   NtOpenKey  (0x20019, {24, 28, 0x40, 0, 0,  (0x20019, {24, 28, 0x40, 0, 0, "Software\Microsoft\Rpc"}, ... }, ...
 00919  1028   NtContinue  (16514352, 1, ...
 00920   420   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\u:\work\DNSAPI.dll"}, 14412856, ... }, 14412856, ...
 00921   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81844, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81844, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\220\0\0\0\344\4\0\0\234\4\0\0" ...  ...
 00916  1168   NtWaitForSingleObject  ... ) == 0x102
 00918  2016   NtOpenKey  ... 152, ) == 0x0
 00922  1028   NtRegisterThreadTerminatePort  (24, ...
 00921   896   NtRequestWaitReplyPort  ... {28, 56, reply, 0, 1252, 896, 81845, 0}  ... {28, 56, reply, 0, 1252, 896, 81845, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\220\0\0\0\344\4\0\0\234\4\0\0" )  ) == 0x0
 00923  1168   NtWaitForSingleObject  (120, 0, 0x0, ...
 00924  2016   NtQueryValueKey  (152,  (152, "MaxRpcSize", Partial, 144, ... , Partial, 144, ...
 00922  1028   NtRegisterThreadTerminatePort  ... ) == 0x0
 00925   896   NtResumeThread  (144, ...
 00924  2016   NtQueryValueKey  ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00926  1028   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 00925   896   NtResumeThread  ... 1, ) == 0x0
 00927  2016   NtClose  (152, ...
 00917  2012   NtDuplicateObject  ... 156, ) == 0x0
 00928  1180   NtWaitForSingleObject  (88, 0, 0x0, ...
 00929   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ...
 00926  1028   NtDuplicateObject  ... 160, ) == 0x0
 00930  2012   NtWaitForSingleObject  (64, 0, {0, 0}, ...
 00927  2016   NtClose  ... ) == 0x0
 00931  1028   NtWaitForSingleObject  (64, 0, {0, 0}, ...
 00930  2012   NtWaitForSingleObject  ... ) == 0x102
 00932  2016   NtOpenKey  (0x20019, {24, 28, 0x40, 0, 0,  (0x20019, {24, 28, 0x40, 0, 0, "Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\packed.exe\RpcThreadPoolThrottle"}, ... }, ...
 00931  1028   NtWaitForSingleObject  ... ) == 0x102
 00933  2012   NtWaitForSingleObject  (120, 0, 0x0, ...
 00932  2016   NtOpenKey  ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00934  1028   NtWaitForSingleObject  (120, 0, 0x0, ...
 00935  2016   NtCreateEvent  (0x1f0003, 0x0, 1, 0, ... 152, ) == 0x0
 00936  2016   NtCreateEvent  (0x1f0003, 0x0, 1, 0, ... 164, ) == 0x0
 00937  2016   NtQuerySystemTime  (... {1416954164, 29929616}, ) == 0x0
 00938  2016   NtCreateEvent  (0x1f0003, 0x0, 0, 0, ... 168, ) == 0x0
 00939  2016   NtOpenKey  (0x20019, {24, 28, 0x40, 0, 0,  (0x20019, {24, 28, 0x40, 0, 0, "Software\Policies\Microsoft\Windows NT\Rpc"}, ... }, ...
 00929   896   NtAllocateVirtualMemory  ... 19660800, 1048576, ) == 0x0
 00940   896   NtAllocateVirtualMemory  (-1, 20701184, 0, 8192, 4096, 4, ... 20701184, 8192, ) == 0x0
 00941   896   NtProtectVirtualMemory  (-1, (0x13be000), 4096, 260, ... (0x13be000), 4096, 4, ) == 0x0
 00942   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ... 172, {1252, 928}, ) == 0x0
 00943   896   NtQueryInformationThread  (172, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ffd4000,Pid=1252,Tid=928,}, 0x0, ) == 0x0
 00944   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81845, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81845, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\254\0\0\0\344\4\0\0\240\3\0\0" ... {28, 56, reply, 0, 1252, 896, 81846, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\254\0\0\0\344\4\0\0\240\3\0\0" )  ... {28, 56, reply, 0, 1252, 896, 81846, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81845, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\254\0\0\0\344\4\0\0\240\3\0\0" ... {28, 56, reply, 0, 1252, 896, 81846, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\254\0\0\0\344\4\0\0\240\3\0\0" )  ) == 0x0
 00939  2016   NtOpenKey  ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00945  2016   NtQuerySystemInformation  (Performance, 312, ... {system info, class 2, size 312}, 0x0, ) == 0x0
 00946  2016   NtQueryInformationProcess  (-1, QuotaLimits, 32, ... {process info, class 1, size 32}, 0x0, ) == 0x0
 00947  2016   NtQueryInformationProcess  (-1, VmCounters, 44, ... {process info, class 3, size 44}, 0x0, ) == 0x0
 00948  2016   NtWaitForSingleObject  (88, 0, 0x0, ...
 00949   896   NtResumeThread  (172, ... 1, ) == 0x0
 00950   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ... 20709376, 1048576, ) == 0x0
 00951   896   NtAllocateVirtualMemory  (-1, 21749760, 0, 8192, 4096, 4, ... 21749760, 8192, ) == 0x0
 00920   420   NtQueryAttributesFile  ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00952   928   NtWaitForSingleObject  (88, 0, 0x0, ...
 00953   420   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\DNSAPI.dll"}, 14412856, ... }, 14412856, ...
 00954   896   NtProtectVirtualMemory  (-1, (0x14be000), 4096, 260, ... (0x14be000), 4096, 4, ) == 0x0
 00955   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ... 176, {1252, 428}, ) == 0x0
 00956   896   NtQueryInformationThread  (176, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ffaf000,Pid=1252,Tid=428,}, 0x0, ) == 0x0
 00957   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81846, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81846, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\260\0\0\0\344\4\0\0\254\1\0\0" ... {28, 56, reply, 0, 1252, 896, 81847, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\260\0\0\0\344\4\0\0\254\1\0\0" )  ... {28, 56, reply, 0, 1252, 896, 81847, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81846, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\260\0\0\0\344\4\0\0\254\1\0\0" ... {28, 56, reply, 0, 1252, 896, 81847, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\260\0\0\0\344\4\0\0\254\1\0\0" )  ) == 0x0
 00958   896   NtResumeThread  (176, ... 1, ) == 0x0
 00959   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ...
 00953   420   NtQueryAttributesFile  ... ) == 0x0
 00960   428   NtWaitForSingleObject  (88, 0, 0x0, ...
 00961   420   NtOpenFile  (0x100020, {24, 0, 0x40, 0, 0,  (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\DNSAPI.dll"}, 5, 96, ... 180, {status=0x0, info=1}, ) }, 5, 96, ... 180, {status=0x0, info=1}, ) == 0x0
 00962   420   NtCreateSection  (0xf, 0x0, 0x0, 16, 16777216, 180, ... 184, ) == 0x0
 00963   420   NtQuerySection  (184, Image, 48, ... {section info, class 1, size 48}, 0x0, ) == 0x0
 00964   420   NtClose  (180, ... ) == 0x0
 00965   420   NtMapViewOfSection  (184, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x76f20000), 0x0, 159744, ) == 0x0
 00966   420   NtClose  (184, ...
 00959   896   NtAllocateVirtualMemory  ... 21757952, 1048576, ) == 0x0
 00967   896   NtAllocateVirtualMemory  (-1, 22798336, 0, 8192, 4096, 4, ... 22798336, 8192, ) == 0x0
 00968   896   NtProtectVirtualMemory  (-1, (0x15be000), 4096, 260, ... (0x15be000), 4096, 4, ) == 0x0
 00969   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ... 180, {1252, 1732}, ) == 0x0
 00970   896   NtQueryInformationThread  (180, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ffae000,Pid=1252,Tid=1732,}, 0x0, ) == 0x0
 00971   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81847, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81847, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\264\0\0\0\344\4\0\0\304\6\0\0" ... {28, 56, reply, 0, 1252, 896, 81848, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\264\0\0\0\344\4\0\0\304\6\0\0" )  ... {28, 56, reply, 0, 1252, 896, 81848, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81847, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\264\0\0\0\344\4\0\0\304\6\0\0" ... {28, 56, reply, 0, 1252, 896, 81848, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\264\0\0\0\344\4\0\0\304\6\0\0" )  ) == 0x0
 00966   420   NtClose  ... ) == 0x0
 00972   420   NtProtectVirtualMemory  (-1, (0x76f21000), 616, 4, ... (0x76f21000), 4096, 32, ) == 0x0
 00973   420   NtProtectVirtualMemory  (-1, (0x76f21000), 4096, 32, ... (0x76f21000), 4096, 4, ) == 0x0
 00974   420   NtFlushInstructionCache  (-1, 1995575296, 616, ... ) == 0x0
 00975   420   NtProtectVirtualMemory  (-1, (0x76f21000), 616, 4, ... (0x76f21000), 4096, 32, ) == 0x0
 00976   420   NtProtectVirtualMemory  (-1, (0x76f21000), 4096, 32, ... (0x76f21000), 4096, 4, ) == 0x0
 00977   420   NtFlushInstructionCache  (-1, 1995575296, 616, ...
 00978   896   NtResumeThread  (180, ... 1, ) == 0x0
 00979   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ... 22806528, 1048576, ) == 0x0
 00980   896   NtAllocateVirtualMemory  (-1, 23846912, 0, 8192, 4096, 4, ... 23846912, 8192, ) == 0x0
 00981   896   NtProtectVirtualMemory  (-1, (0x16be000), 4096, 260, ... (0x16be000), 4096, 4, ) == 0x0
 00982   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ... 184, {1252, 748}, ) == 0x0
 00983   896   NtQueryInformationThread  (184, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ffad000,Pid=1252,Tid=748,}, 0x0, ) == 0x0
 00977   420   NtFlushInstructionCache  ... ) == 0x0
 00984  1732   NtWaitForSingleObject  (88, 0, 0x0, ...
 00985   420   NtProtectVirtualMemory  (-1, (0x76f21000), 616, 4, ... (0x76f21000), 4096, 32, ) == 0x0
 00986   420   NtProtectVirtualMemory  (-1, (0x76f21000), 4096, 32, ... (0x76f21000), 4096, 4, ) == 0x0
 00987   420   NtFlushInstructionCache  (-1, 1995575296, 616, ... ) == 0x0
 00988   420   NtProtectVirtualMemory  (-1, (0x76f21000), 616, 4, ... (0x76f21000), 4096, 32, ) == 0x0
 00989   420   NtProtectVirtualMemory  (-1, (0x76f21000), 4096, 32, ... (0x76f21000), 4096, 4, ) == 0x0
 00990   420   NtFlushInstructionCache  (-1, 1995575296, 616, ...
 00991   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81848, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81848, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\270\0\0\0\344\4\0\0\354\2\0\0" ... {28, 56, reply, 0, 1252, 896, 81849, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\270\0\0\0\344\4\0\0\354\2\0\0" )  ... {28, 56, reply, 0, 1252, 896, 81849, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81848, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\270\0\0\0\344\4\0\0\354\2\0\0" ... {28, 56, reply, 0, 1252, 896, 81849, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\270\0\0\0\344\4\0\0\354\2\0\0" )  ) == 0x0
 00992   896   NtResumeThread  (184, ... 1, ) == 0x0
 00993   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ... 23855104, 1048576, ) == 0x0
 00994   896   NtAllocateVirtualMemory  (-1, 24895488, 0, 8192, 4096, 4, ... 24895488, 8192, ) == 0x0
 00995   896   NtProtectVirtualMemory  (-1, (0x17be000), 4096, 260, ... (0x17be000), 4096, 4, ) == 0x0
 00996   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ...
 00990   420   NtFlushInstructionCache  ... ) == 0x0
 00997   748   NtWaitForSingleObject  (88, 0, 0x0, ...
 00998   420   NtProtectVirtualMemory  (-1, (0x76f21000), 616, 4, ... (0x76f21000), 4096, 32, ) == 0x0
 00999   420   NtProtectVirtualMemory  (-1, (0x76f21000), 4096, 32, ... (0x76f21000), 4096, 4, ) == 0x0
 01000   420   NtFlushInstructionCache  (-1, 1995575296, 616, ... ) == 0x0
 01001   420   NtProtectVirtualMemory  (-1, (0x76f21000), 616, 4, ... (0x76f21000), 4096, 32, ) == 0x0
 01002   420   NtProtectVirtualMemory  (-1, (0x76f21000), 4096, 32, ... (0x76f21000), 4096, 4, ) == 0x0
 01003   420   NtFlushInstructionCache  (-1, 1995575296, 616, ...
 00996   896   NtCreateThread  ... 188, {1252, 900}, ) == 0x0
 01004   896   NtQueryInformationThread  (188, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ffac000,Pid=1252,Tid=900,}, 0x0, ) == 0x0
 01005   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81849, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81849, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\274\0\0\0\344\4\0\0\204\3\0\0" ... {28, 56, reply, 0, 1252, 896, 81850, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\274\0\0\0\344\4\0\0\204\3\0\0" )  ... {28, 56, reply, 0, 1252, 896, 81850, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81849, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\274\0\0\0\344\4\0\0\204\3\0\0" ... {28, 56, reply, 0, 1252, 896, 81850, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\274\0\0\0\344\4\0\0\204\3\0\0" )  ) == 0x0
 01006   896   NtResumeThread  (188, ... 1, ) == 0x0
 01007   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ... 24903680, 1048576, ) == 0x0
 01008   896   NtAllocateVirtualMemory  (-1, 25944064, 0, 8192, 4096, 4, ... 25944064, 8192, ) == 0x0
 01003   420   NtFlushInstructionCache  ... ) == 0x0
 01009   900   NtWaitForSingleObject  (88, 0, 0x0, ...
 01010   420   NtOpenKey  (0x80000000, {24, 0, 0x40, 0, 0,  (0x80000000, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\DNSAPI.dll"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01011   420   NtCreateKey  (0x20019, {24, 28, 0x40, 0, 0,  (0x20019, {24, 28, 0x40, 0, 0, "System\CurrentControlSet\Services\Tcpip\Parameters"}, 0, "Class", 0, ... 192, 2, ) }, 0,  (0x20019, {24, 28, 0x40, 0, 0, "System\CurrentControlSet\Services\Tcpip\Parameters"}, 0, "Class", 0, ... 192, 2, ) , 0, ... 192, 2, ) == 0x0
 01012   420   NtOpenKey  (0x20019, {24, 28, 0x40, 0, 0,  (0x20019, {24, 28, 0x40, 0, 0, "System\CurrentControlSet\Services\DnsCache\Parameters"}, ... 196, ) }, ... 196, ) == 0x0
 01013   420   NtOpenKey  (0x20019, {24, 28, 0x40, 0, 0,  (0x20019, {24, 28, 0x40, 0, 0, "Software\Policies\Microsoft\Windows NT\DnsClient"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01014   420   NtQueryValueKey  (196,  (196, "QueryAdapterName", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01015   420   NtQueryValueKey  (192,  (192, "DisableAdapterDomainName", Partial, 144, ... , Partial, 144, ...
 01016   896   NtProtectVirtualMemory  (-1, (0x18be000), 4096, 260, ... (0x18be000), 4096, 4, ) == 0x0
 01017   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ... 200, {1252, 1388}, ) == 0x0
 01018   896   NtQueryInformationThread  (200, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ffab000,Pid=1252,Tid=1388,}, 0x0, ) == 0x0
 01019   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81850, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81850, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\310\0\0\0\344\4\0\0l\5\0\0" ... {28, 56, reply, 0, 1252, 896, 81851, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\310\0\0\0\344\4\0\0l\5\0\0" )  ... {28, 56, reply, 0, 1252, 896, 81851, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81850, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\310\0\0\0\344\4\0\0l\5\0\0" ... {28, 56, reply, 0, 1252, 896, 81851, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\310\0\0\0\344\4\0\0l\5\0\0" )  ) == 0x0
 01020   896   NtResumeThread  (200, ... 1, ) == 0x0
 01021   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ...
 01015   420   NtQueryValueKey  ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01022  1388   NtWaitForSingleObject  (88, 0, 0x0, ...
 01023   420   NtQueryValueKey  (196,  (196, "UseDomainNameDevolution", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01024   420   NtQueryValueKey  (192,  (192, "UseDomainNameDevolution", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (192, "UseDomainNameDevolution", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) }, 16, ) == 0x0
 01025   420   NtQueryValueKey  (196,  (196, "PrioritizeRecordData", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01026   420   NtQueryValueKey  (192,  (192, "PrioritizeRecordData", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01027   420   NtQueryValueKey  (196,  (196, "AllowUnqualifiedQuery", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01028   420   NtQueryValueKey  (192,  (192, "AllowUnqualifiedQuery", Partial, 144, ... , Partial, 144, ...
 01021   896   NtAllocateVirtualMemory  ... 25952256, 1048576, ) == 0x0
 01029   896   NtAllocateVirtualMemory  (-1, 26992640, 0, 8192, 4096, 4, ... 26992640, 8192, ) == 0x0
 01030   896   NtProtectVirtualMemory  (-1, (0x19be000), 4096, 260, ... (0x19be000), 4096, 4, ) == 0x0
 01031   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ... 204, {1252, 2036}, ) == 0x0
 01032   896   NtQueryInformationThread  (204, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ffaa000,Pid=1252,Tid=2036,}, 0x0, ) == 0x0
 01033   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81851, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81851, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\314\0\0\0\344\4\0\0\364\7\0\0" ... {28, 56, reply, 0, 1252, 896, 81852, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\314\0\0\0\344\4\0\0\364\7\0\0" )  ... {28, 56, reply, 0, 1252, 896, 81852, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81851, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\314\0\0\0\344\4\0\0\364\7\0\0" ... {28, 56, reply, 0, 1252, 896, 81852, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\314\0\0\0\344\4\0\0\364\7\0\0" )  ) == 0x0
 01028   420   NtQueryValueKey  ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01034   420   NtQueryValueKey  (196,  (196, "AppendToMultiLabelName", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01035   420   NtQueryValueKey  (196,  (196, "ScreenBadTlds", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01036   420   NtQueryValueKey  (196,  (196, "ScreenUnreachableServers", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01037   420   NtQueryValueKey  (196,  (196, "FilterClusterIp", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01038   420   NtQueryValueKey  (196,  (196, "WaitForNameErrorOnAll", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01039   420   NtQueryValueKey  (196,  (196, "UseEdns", Partial, 144, ... , Partial, 144, ...
 01040   896   NtResumeThread  (204, ... 1, ) == 0x0
 01041   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ... 27000832, 1048576, ) == 0x0
 01042   896   NtAllocateVirtualMemory  (-1, 28041216, 0, 8192, 4096, 4, ... 28041216, 8192, ) == 0x0
 01043   896   NtProtectVirtualMemory  (-1, (0x1abe000), 4096, 260, ... (0x1abe000), 4096, 4, ) == 0x0
 01044   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ... 208, {1252, 1372}, ) == 0x0
 01045   896   NtQueryInformationThread  (208, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ffa9000,Pid=1252,Tid=1372,}, 0x0, ) == 0x0
 01039   420   NtQueryValueKey  ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01046  2036   NtWaitForSingleObject  (88, 0, 0x0, ...
 01047   420   NtQueryValueKey  (196,  (196, "QueryIpMatching", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01048   420   NtQueryValueKey  (196,  (196, "UseHostsFile", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01049   420   NtQueryValueKey  (196,  (196, "RegistrationEnabled", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01050   420   NtQueryValueKey  (192,  (192, "DisableDynamicUpdate", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01051   420   NtQueryValueKey  (196,  (196, "RegisterPrimaryName", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01052   420   NtQueryValueKey  (196,  (196, "RegisterAdapterName", Partial, 144, ... , Partial, 144, ...
 01053   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81852, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81852, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\320\0\0\0\344\4\0\0\\5\0\0" ... {28, 56, reply, 0, 1252, 896, 81853, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\320\0\0\0\344\4\0\0\\5\0\0" )  ... {28, 56, reply, 0, 1252, 896, 81853, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81852, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\320\0\0\0\344\4\0\0\\5\0\0" ... {28, 56, reply, 0, 1252, 896, 81853, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\320\0\0\0\344\4\0\0\\5\0\0" )  ) == 0x0
 01054   896   NtResumeThread  (208, ... 1, ) == 0x0
 01055   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ... 28049408, 1048576, ) == 0x0
 01056   896   NtAllocateVirtualMemory  (-1, 29089792, 0, 8192, 4096, 4, ... 29089792, 8192, ) == 0x0
 01057   896   NtProtectVirtualMemory  (-1, (0x1bbe000), 4096, 260, ... (0x1bbe000), 4096, 4, ) == 0x0
 01058   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ...
 01052   420   NtQueryValueKey  ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01059  1372   NtWaitForSingleObject  (88, 0, 0x0, ...
 01060   420   NtQueryValueKey  (192,  (192, "EnableAdapterDomainNameRegistration", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01061   420   NtQueryValueKey  (196,  (196, "RegisterReverseLookup", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01062   420   NtQueryValueKey  (192,  (192, "DisableReverseAddressRegistrations", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01063   420   NtQueryValueKey  (196,  (196, "RegisterWanAdapters", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01064   420   NtQueryValueKey  (192,  (192, "DisableWanDynamicUpdate", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01065   420   NtQueryValueKey  (196,  (196, "RegistrationTtl", Partial, 144, ... , Partial, 144, ...
 01058   896   NtCreateThread  ... 212, {1252, 1600}, ) == 0x0
 01066   896   NtQueryInformationThread  (212, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ffa8000,Pid=1252,Tid=1600,}, 0x0, ) == 0x0
 01067   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81853, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81853, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\324\0\0\0\344\4\0\0@\6\0\0" ... {28, 56, reply, 0, 1252, 896, 81854, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\324\0\0\0\344\4\0\0@\6\0\0" )  ... {28, 56, reply, 0, 1252, 896, 81854, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81853, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\324\0\0\0\344\4\0\0@\6\0\0" ... {28, 56, reply, 0, 1252, 896, 81854, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\324\0\0\0\344\4\0\0@\6\0\0" )  ) == 0x0
 01068   896   NtResumeThread  (212, ... 1, ) == 0x0
 01069   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ... 29097984, 1048576, ) == 0x0
 01070   896   NtAllocateVirtualMemory  (-1, 30138368, 0, 8192, 4096, 4, ... 30138368, 8192, ) == 0x0
 01065   420   NtQueryValueKey  ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01071  1600   NtWaitForSingleObject  (88, 0, 0x0, ...
 01072   420   NtQueryValueKey  (192,  (192, "DefaultRegistrationTTL", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01073   420   NtQueryValueKey  (196,  (196, "RegistrationRefreshInterval", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01074   420   NtQueryValueKey  (192,  (192, "DefaultRegistrationRefreshInterval", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01075   420   NtQueryValueKey  (196,  (196, "RegistrationMaxAddressCount", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01076   420   NtQueryValueKey  (192,  (192, "MaxNumberOfAddressesToRegister", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01077   420   NtQueryValueKey  (196,  (196, "UpdateSecurityLevel", Partial, 144, ... , Partial, 144, ...
 01078   896   NtProtectVirtualMemory  (-1, (0x1cbe000), 4096, 260, ... (0x1cbe000), 4096, 4, ) == 0x0
 01079   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ... 216, {1252, 1948}, ) == 0x0
 01080   896   NtQueryInformationThread  (216, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ffa7000,Pid=1252,Tid=1948,}, 0x0, ) == 0x0
 01081   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81854, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81854, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\330\0\0\0\344\4\0\0\234\7\0\0" ... {28, 56, reply, 0, 1252, 896, 81855, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\330\0\0\0\344\4\0\0\234\7\0\0" )  ... {28, 56, reply, 0, 1252, 896, 81855, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81854, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\330\0\0\0\344\4\0\0\234\7\0\0" ... {28, 56, reply, 0, 1252, 896, 81855, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\330\0\0\0\344\4\0\0\234\7\0\0" )  ) == 0x0
 01082   896   NtResumeThread  (216, ... 1, ) == 0x0
 01083   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ...
 01077   420   NtQueryValueKey  ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01084  1948   NtWaitForSingleObject  (88, 0, 0x0, ...
 01085   420   NtQueryValueKey  (192,  (192, "UpdateSecurityLevel", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01086   420   NtQueryValueKey  (196,  (196, "UpdateZoneExcludeFile", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01087   420   NtQueryValueKey  (196,  (196, "UpdateTopLevelDomainZones", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01088   420   NtQueryValueKey  (196,  (196, "DnsTest", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01089   420   NtQueryValueKey  (196,  (196, "MaxCacheSize", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01090   420   NtQueryValueKey  (196,  (196, "MaxCacheTtl", Partial, 144, ... , Partial, 144, ...
 01083   896   NtAllocateVirtualMemory  ... 30146560, 1048576, ) == 0x0
 01091   896   NtAllocateVirtualMemory  (-1, 31186944, 0, 8192, 4096, 4, ... 31186944, 8192, ) == 0x0
 01092   896   NtProtectVirtualMemory  (-1, (0x1dbe000), 4096, 260, ... (0x1dbe000), 4096, 4, ) == 0x0
 01093   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ... 220, {1252, 252}, ) == 0x0
 01094   896   NtQueryInformationThread  (220, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ffa6000,Pid=1252,Tid=252,}, 0x0, ) == 0x0
 01095   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81855, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81855, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\334\0\0\0\344\4\0\0\374\0\0\0" ... {28, 56, reply, 0, 1252, 896, 81856, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\334\0\0\0\344\4\0\0\374\0\0\0" )  ... {28, 56, reply, 0, 1252, 896, 81856, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81855, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\334\0\0\0\344\4\0\0\374\0\0\0" ... {28, 56, reply, 0, 1252, 896, 81856, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\334\0\0\0\344\4\0\0\374\0\0\0" )  ) == 0x0
 01090   420   NtQueryValueKey  ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01096   420   NtQueryValueKey  (196,  (196, "MaxNegativeCacheTtl", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01097   420   NtQueryValueKey  (196,  (196, "AdapterTimeoutLimit", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01098   420   NtQueryValueKey  (196,  (196, "ServerPriorityTimeLimit", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01099   420   NtQueryValueKey  (196,  (196, "MaxCachedSockets", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01100   420   NtQueryValueKey  (196,  (196, "MulticastListenLevel", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01101   420   NtQueryValueKey  (196,  (196, "MulticastSendLevel", Partial, 144, ... , Partial, 144, ...
 01102   896   NtResumeThread  (220, ... 1, ) == 0x0
 01103   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ... 31195136, 1048576, ) == 0x0
 01104   896   NtAllocateVirtualMemory  (-1, 32235520, 0, 8192, 4096, 4, ... 32235520, 8192, ) == 0x0
 01105   896   NtProtectVirtualMemory  (-1, (0x1ebe000), 4096, 260, ... (0x1ebe000), 4096, 4, ) == 0x0
 01106   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ... 224, {1252, 1300}, ) == 0x0
 01107   896   NtQueryInformationThread  (224, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ffa5000,Pid=1252,Tid=1300,}, 0x0, ) == 0x0
 01101   420   NtQueryValueKey  ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01108   252   NtWaitForSingleObject  (88, 0, 0x0, ...
 01109   420   NtOpenKey  (0x1, {24, 28, 0x40, 0, 0,  (0x1, {24, 28, 0x40, 0, 0, "System\Setup"}, ... 228, ) }, ... 228, ) == 0x0
 01110   420   NtQueryValueKey  (228,  (228, "SystemSetupInProgress", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (228, "SystemSetupInProgress", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) }, 16, ) == 0x0
 01111   420   NtClose  (228, ... ) == 0x0
 01112   420   NtClose  (192, ... ) == 0x0
 01113   420   NtClose  (196, ... ) == 0x0
 01114   420   NtOpenKey  (0x1, {24, 28, 0x40, 0, 0,  (0x1, {24, 28, 0x40, 0, 0, "System\CurrentControlSet\Services\Tcpip\Parameters"}, ... }, ...
 01115   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81856, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81856, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\340\0\0\0\344\4\0\0\24\5\0\0" ... {28, 56, reply, 0, 1252, 896, 81857, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\340\0\0\0\344\4\0\0\24\5\0\0" )  ... {28, 56, reply, 0, 1252, 896, 81857, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81856, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\340\0\0\0\344\4\0\0\24\5\0\0" ... {28, 56, reply, 0, 1252, 896, 81857, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\340\0\0\0\344\4\0\0\24\5\0\0" )  ) == 0x0
 01116   896   NtResumeThread  (224, ... 1, ) == 0x0
 01117   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ... 32243712, 1048576, ) == 0x0
 01118   896   NtAllocateVirtualMemory  (-1, 33284096, 0, 8192, 4096, 4, ... 33284096, 8192, ) == 0x0
 01119   896   NtProtectVirtualMemory  (-1, (0x1fbe000), 4096, 260, ... (0x1fbe000), 4096, 4, ) == 0x0
 01120   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ...
 01114   420   NtOpenKey  ... 196, ) == 0x0
 01121  1300   NtWaitForSingleObject  (88, 0, 0x0, ...
 01122   420   NtQueryValueKey  (196,  (196, "DnsQueryTimeouts", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01123   420   NtQueryValueKey  (196,  (196, "DnsQuickQueryTimeouts", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01124   420   NtQueryValueKey  (196,  (196, "DnsMulticastQueryTimeouts", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01125   420   NtClose  (196, ... ) == 0x0
 01126   420   NtSetEventBoostPriority  (88, ...
 00928  1180   NtWaitForSingleObject  ... ) == 0x0
 01127  1180   NtSetEventBoostPriority  (88, ...
 00948  2016   NtWaitForSingleObject  ... ) == 0x0
 01128  2016   NtSetEventBoostPriority  (88, ...
 00952   928   NtWaitForSingleObject  ... ) == 0x0
 01129   928   NtSetEventBoostPriority  (88, ...
 00960   428   NtWaitForSingleObject  ... ) == 0x0
 01130   428   NtSetEventBoostPriority  (88, ...
 00984  1732   NtWaitForSingleObject  ... ) == 0x0
 01131  1732   NtSetEventBoostPriority  (88, ...
 00997   748   NtWaitForSingleObject  ... ) == 0x0
 01132   748   NtSetEventBoostPriority  (88, ...
 01009   900   NtWaitForSingleObject  ... ) == 0x0
 01133   900   NtSetEventBoostPriority  (88, ...
 01022  1388   NtWaitForSingleObject  ... ) == 0x0
 01134  1388   NtSetEventBoostPriority  (88, ...
 01046  2036   NtWaitForSingleObject  ... ) == 0x0
 01135  2036   NtSetEventBoostPriority  (88, ...
 01059  1372   NtWaitForSingleObject  ... ) == 0x0
 01136  1372   NtSetEventBoostPriority  (88, ...
 01071  1600   NtWaitForSingleObject  ... ) == 0x0
 01137  1600   NtSetEventBoostPriority  (88, ...
 01084  1948   NtWaitForSingleObject  ... ) == 0x0
 01138  1948   NtSetEventBoostPriority  (88, ...
 01108   252   NtWaitForSingleObject  ... ) == 0x0
 01139   252   NtSetEventBoostPriority  (88, ...
 01121  1300   NtWaitForSingleObject  ... ) == 0x0
 01140  1300   NtTestAlert  (... ) == 0x0
 01139   252   NtSetEventBoostPriority  ... ) == 0x0
 01138  1948   NtSetEventBoostPriority  ... ) == 0x0
 01137  1600   NtSetEventBoostPriority  ... ) == 0x0
 01136  1372   NtSetEventBoostPriority  ... ) == 0x0
 01135  2036   NtSetEventBoostPriority  ... ) == 0x0
 01134  1388   NtSetEventBoostPriority  ... ) == 0x0
 01133   900   NtSetEventBoostPriority  ... ) == 0x0
 01132   748   NtSetEventBoostPriority  ... ) == 0x0
 01131  1732   NtSetEventBoostPriority  ... ) == 0x0
 01130   428   NtSetEventBoostPriority  ... ) == 0x0
 01129   928   NtSetEventBoostPriority  ... ) == 0x0
 01127  1180   NtSetEventBoostPriority  ... ) == 0x0
 01128  2016   NtSetEventBoostPriority  ... ) == 0x0
 01126   420   NtSetEventBoostPriority  ... ) == 0x0
 01120   896   NtCreateThread  ... 196, {1252, 1096}, ) == 0x0
 01141  1300   NtContinue  (32242992, 1, ...
 01142   252   NtTestAlert  (...
 01143  1948   NtTestAlert  (...
 01144  1600   NtTestAlert  (...
 01145  1372   NtTestAlert  (...
 01146  2036   NtTestAlert  (...
 01147  1388   NtTestAlert  (...
 01148   900   NtTestAlert  (...
 01149   748   NtTestAlert  (...
 01150  1732   NtTestAlert  (...
 01151   428   NtTestAlert  (...
 01152   928   NtTestAlert  (...
 01153  1180   NtTestAlert  (...
 01154   420   NtCreateEvent  (0x1f0003, 0x0, 0, 0, ...
 01155   896   NtQueryInformationThread  (196, Basic, 28, ...
 01156  1300   NtRegisterThreadTerminatePort  (24, ...
 01142   252   NtTestAlert  ... ) == 0x0
 01143  1948   NtTestAlert  ... ) == 0x0
 01144  1600   NtTestAlert  ... ) == 0x0
 01145  1372   NtTestAlert  ... ) == 0x0
 01146  2036   NtTestAlert  ... ) == 0x0
 01147  1388   NtTestAlert  ... ) == 0x0
 01148   900   NtTestAlert  ... ) == 0x0
 01149   748   NtTestAlert  ... ) == 0x0
 01150  1732   NtTestAlert  ... ) == 0x0
 01151   428   NtTestAlert  ... ) == 0x0
 01152   928   NtTestAlert  ... ) == 0x0
 01153  1180   NtTestAlert  ... ) == 0x0
 01157  2016   NtCreateEvent  (0x1f0003, 0x0, 0, 0, ...
 01155   896   NtQueryInformationThread  ... {ExitStatus=0x103,TebBaseAddress=0x7ffa4000,Pid=1252,Tid=1096,}, 0x0, ) == 0x0
 01156  1300   NtRegisterThreadTerminatePort  ... ) == 0x0
 01158   252   NtContinue  (31194416, 1, ...
 01159  1948   NtContinue  (30145840, 1, ...
 01160  1600   NtContinue  (29097264, 1, ...
 01161  1372   NtContinue  (28048688, 1, ...
 01162  2036   NtContinue  (27000112, 1, ...
 01163  1388   NtContinue  (25951536, 1, ...
 01164   900   NtContinue  (24902960, 1, ...
 01165   748   NtContinue  (23854384, 1, ...
 01166  1732   NtContinue  (22805808, 1, ...
 01167   428   NtContinue  (21757232, 1, ...
 01168   928   NtContinue  (20708656, 1, ...
 01169  1180   NtContinue  (19660080, 1, ...
 01157  2016   NtCreateEvent  ... 192, ) == 0x0
 01170   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81857, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81857, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\304\0\0\0\344\4\0\0H\4\0\0" ...  ...
 01171  1300   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 01172   252   NtRegisterThreadTerminatePort  (24, ...
 01173  1948   NtRegisterThreadTerminatePort  (24, ...
 01174  1600   NtRegisterThreadTerminatePort  (24, ...
 01175  1372   NtRegisterThreadTerminatePort  (24, ...
 01176  2036   NtRegisterThreadTerminatePort  (24, ...
 01177  1388   NtRegisterThreadTerminatePort  (24, ...
 01178   900   NtRegisterThreadTerminatePort  (24, ...
 01179   748   NtRegisterThreadTerminatePort  (24, ...
 01180  1732   NtRegisterThreadTerminatePort  (24, ...
 01181   428   NtRegisterThreadTerminatePort  (24, ...
 01182   928   NtRegisterThreadTerminatePort  (24, ...
 01183  1180   NtRegisterThreadTerminatePort  (24, ...
 01184  2016   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 01170   896   NtRequestWaitReplyPort  ... {28, 56, reply, 0, 1252, 896, 81858, 0}  ... {28, 56, reply, 0, 1252, 896, 81858, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\304\0\0\0\344\4\0\0H\4\0\0" )  ) == 0x0
 01171  1300   NtDuplicateObject  ... 228, ) == 0x0
 01172   252   NtRegisterThreadTerminatePort  ... ) == 0x0
 01173  1948   NtRegisterThreadTerminatePort  ... ) == 0x0
 01174  1600   NtRegisterThreadTerminatePort  ... ) == 0x0
 01175  1372   NtRegisterThreadTerminatePort  ... ) == 0x0
 01176  2036   NtRegisterThreadTerminatePort  ... ) == 0x0
 01177  1388   NtRegisterThreadTerminatePort  ... ) == 0x0
 01178   900   NtRegisterThreadTerminatePort  ... ) == 0x0
 01179   748   NtRegisterThreadTerminatePort  ... ) == 0x0
 01180  1732   NtRegisterThreadTerminatePort  ... ) == 0x0
 01181   428   NtRegisterThreadTerminatePort  ... ) == 0x0
 01182   928   NtRegisterThreadTerminatePort  ... ) == 0x0
 01183  1180   NtRegisterThreadTerminatePort  ... ) == 0x0
 01184  2016   NtDuplicateObject  ... 232, ) == 0x0
 01154   420   NtCreateEvent  ... 236, ) == 0x0
 01185  1300   NtWaitForSingleObject  (64, 0, {0, 0}, ...
 01186   252   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 01187  1948   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 01188  1600   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 01189  1372   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 01190  2036   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 01191  1388   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 01192   900   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 01193   748   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 01194  1732   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 01195   428   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 01196   928   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 01197  1180   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 01198  2016   NtOpenKey  (0x20019, {24, 28, 0x40, 0, 0,  (0x20019, {24, 28, 0x40, 0, 0, "Software\Microsoft\Rpc\SecurityService"}, ... }, ...
 01199   420   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 01200   896   NtResumeThread  (196, ...
 01185  1300   NtWaitForSingleObject  ... ) == 0x102
 01186   252   NtDuplicateObject  ... 240, ) == 0x0
 01187  1948   NtDuplicateObject  ... 244, ) == 0x0
 01188  1600   NtDuplicateObject  ... 248, ) == 0x0
 01189  1372   NtDuplicateObject  ... 252, ) == 0x0
 01190  2036   NtDuplicateObject  ... 256, ) == 0x0
 01191  1388   NtDuplicateObject  ... 260, ) == 0x0
 01192   900   NtDuplicateObject  ... 264, ) == 0x0
 01193   748   NtDuplicateObject  ... 268, ) == 0x0
 01194  1732   NtDuplicateObject  ... 272, ) == 0x0
 01195   428   NtDuplicateObject  ... 276, ) == 0x0
 01196   928   NtDuplicateObject  ... 280, ) == 0x0
 01198  2016   NtOpenKey  ... 284, ) == 0x0
 01199   420   NtDuplicateObject  ... 288, ) == 0x0
 01200   896   NtResumeThread  ... 1, ) == 0x0
 01201  1300   NtWaitForSingleObject  (120, 0, 0x0, ...
 01202   252   NtWaitForSingleObject  (64, 0, {0, 0}, ...
 01203  1948   NtAllocateVirtualMemory  (-1, 1368064, 0, 4096, 4096, 4, ...
 01204  1600   NtCreateEvent  (0x100003, 0x0, 1, 0, ...
 01205  1372   NtCreateEvent  (0x100003, 0x0, 1, 0, ...
 01206  2036   NtCreateEvent  (0x100003, 0x0, 1, 0, ...
 01207  1388   NtCreateEvent  (0x100003, 0x0, 1, 0, ...
 01208   900   NtCreateEvent  (0x100003, 0x0, 1, 0, ...
 01209   748   NtCreateEvent  (0x100003, 0x0, 1, 0, ...
 01210  1732   NtCreateEvent  (0x100003, 0x0, 1, 0, ...
 01211   428   NtCreateEvent  (0x100003, 0x0, 1, 0, ...
 01212   928   NtCreateEvent  (0x100003, 0x0, 1, 0, ...
 01197  1180   NtDuplicateObject  ... 292, ) == 0x0
 01213  1096   NtTestAlert  (...
 01214   420   NtCreateEvent  (0x100003, 0x0, 1, 0, ...
 01215   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ...
 01202   252   NtWaitForSingleObject  ... ) == 0x102
 01203  1948   NtAllocateVirtualMemory  ... 1368064, 4096, ) == 0x0
 01204  1600   NtCreateEvent  ... 296, ) == 0x0
 01205  1372   NtCreateEvent  ... 300, ) == 0x0
 01206  2036   NtCreateEvent  ... 304, ) == 0x0
 01207  1388   NtCreateEvent  ... 308, ) == 0x0
 01208   900   NtCreateEvent  ... 312, ) == 0x0
 01209   748   NtCreateEvent  ... 316, ) == 0x0
 01210  1732   NtCreateEvent  ... 320, ) == 0x0
 01211   428   NtCreateEvent  ... 324, ) == 0x0
 01212   928   NtCreateEvent  ... 328, ) == 0x0
 01216  1180   NtCreateEvent  (0x100003, 0x0, 1, 0, ...
 01213  1096   NtTestAlert  ... ) == 0x0
 01214   420   NtCreateEvent  ... 332, ) == 0x0
 01215   896   NtAllocateVirtualMemory  ... 33292288, 1048576, ) == 0x0
 01217   252   NtCreateEvent  (0x100003, 0x0, 1, 0, ...
 01218  1948   NtCreateEvent  (0x100003, 0x0, 1, 0, ...
 01219  1600   NtWaitForSingleObject  (296, 0, 0x0, ...
 01220  1372   NtClose  (300, ...
 01221  2036   NtClose  (304, ...
 01222  1388   NtClose  (308, ...
 01223   900   NtClose  (312, ...
 01224   748   NtClose  (316, ...
 01225  1732   NtClose  (320, ...
 01226   428   NtClose  (324, ...
 01227   928   NtClose  (328, ...
 01216  1180   NtCreateEvent  ... 336, ) == 0x0
 01228  1096   NtContinue  (33291568, 1, ...
 01229   420   NtClose  (332, ...
 01230   896   NtAllocateVirtualMemory  (-1, 34332672, 0, 8192, 4096, 4, ...
 01217   252   NtCreateEvent  ... 340, ) == 0x0
 01218  1948   NtCreateEvent  ... 344, ) == 0x0
 01220  1372   NtClose  ... ) == 0x0
 01221  2036   NtClose  ... ) == 0x0
 01222  1388   NtClose  ... ) == 0x0
 01223   900   NtClose  ... ) == 0x0
 01224   748   NtClose  ... ) == 0x0
 01225  1732   NtClose  ... ) == 0x0
 01226   428   NtClose  ... ) == 0x0
 01227   928   NtClose  ... ) == 0x0
 01231  1180   NtClose  (336, ...
 01232  1096   NtRegisterThreadTerminatePort  (24, ...
 01233  2016   NtQueryValueKey  (284,  (284, "DefaultAuthLevel", Partial, 144, ... , Partial, 144, ...
 01230   896   NtAllocateVirtualMemory  ... 34332672, 8192, ) == 0x0
 01229   420   NtClose  ... ) == 0x0
 01234  1948   NtClose  (344, ...
 01235  1372   NtWaitForSingleObject  (296, 0, 0x0, ...
 01236  2036   NtWaitForSingleObject  (296, 0, 0x0, ...
 01237  1388   NtWaitForSingleObject  (296, 0, 0x0, ...
 01238   900   NtWaitForSingleObject  (296, 0, 0x0, ...
 01239   748   NtWaitForSingleObject  (296, 0, 0x0, ...
 01240  1732   NtWaitForSingleObject  (296, 0, 0x0, ...
 01241   428   NtWaitForSingleObject  (296, 0, 0x0, ...
 01242   928   NtWaitForSingleObject  (296, 0, 0x0, ...
 01231  1180   NtClose  ... ) == 0x0
 01232  1096   NtRegisterThreadTerminatePort  ... ) == 0x0
 01233  2016   NtQueryValueKey  ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01243   252   NtClose  (340, ...
 01244   420   NtWaitForSingleObject  (296, 0, 0x0, ...
 01245   896   NtProtectVirtualMemory  (-1, (0x20be000), 4096, 260, ...
 01234  1948   NtClose  ... ) == 0x0
 01246  1180   NtWaitForSingleObject  (296, 0, 0x0, ...
 01247  2016   NtClose  (284, ...
 01243   252   NtClose  ... ) == 0x0
 01245   896   NtProtectVirtualMemory  ... (0x20be000), 4096, 4, ) == 0x0
 01248  1948   NtSetEventBoostPriority  (296, ...
 01249  1096   NtWaitForSingleObject  (296, 0, 0x0, ...
 01247  2016   NtClose  ... ) == 0x0
 01250   252   NtWaitForSingleObject  (296, 0, 0x0, ...
 01251   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ...
 01219  1600   NtWaitForSingleObject  ... ) == 0x0
 01248  1948   NtSetEventBoostPriority  ... ) == 0x0
 01252  2016   NtWaitForSingleObject  (296, 0, 0x0, ...
 01253  1600   NtSetEventBoostPriority  (296, ...
 01251   896   NtCreateThread  ... 284, {1252, 1708}, ) == 0x0
 01254  1948   NtWaitForSingleObject  (64, 0, {0, 0}, ...
 01235  1372   NtWaitForSingleObject  ... ) == 0x0
 01253  1600   NtSetEventBoostPriority  ... ) == 0x0
 01255   896   NtQueryInformationThread  (284, Basic, 28, ...
 01256  1372   NtSetEventBoostPriority  (296, ...
 01254  1948   NtWaitForSingleObject  ... ) == 0x102
 01236  2036   NtWaitForSingleObject  ... ) == 0x0
 01255   896   NtQueryInformationThread  ... {ExitStatus=0x103,TebBaseAddress=0x7ffa3000,Pid=1252,Tid=1708,}, 0x0, ) == 0x0
 01256  1372   NtSetEventBoostPriority  ... ) == 0x0
 01257  1600   NtWaitForSingleObject  (296, 0, 0x0, ...
 01258  2036   NtSetEventBoostPriority  (296, ...
 01259  1948   NtWaitForSingleObject  (120, 0, 0x0, ...
 01260  1372   NtWaitForSingleObject  (296, 0, 0x0, ...
 01237  1388   NtWaitForSingleObject  ... ) == 0x0
 01261  1388   NtSetEventBoostPriority  (296, ...
 01238   900   NtWaitForSingleObject  ... ) == 0x0
 01262   900   NtSetEventBoostPriority  (296, ...
 01239   748   NtWaitForSingleObject  ... ) == 0x0
 01263   748   NtSetEventBoostPriority  (296, ...
 01240  1732   NtWaitForSingleObject  ... ) == 0x0
 01264  1732   NtSetEventBoostPriority  (296, ...
 01241   428   NtWaitForSingleObject  ... ) == 0x0
 01265   428   NtSetEventBoostPriority  (296, ...
 01242   928   NtWaitForSingleObject  ... ) == 0x0
 01266   928   NtSetEventBoostPriority  (296, ...
 01244   420   NtWaitForSingleObject  ... ) == 0x0
 01267   420   NtSetEventBoostPriority  (296, ...
 01249  1096   NtWaitForSingleObject  ... ) == 0x0
 01268  1096   NtSetEventBoostPriority  (296, ...
 01250   252   NtWaitForSingleObject  ... ) == 0x0
 01269   252   NtSetEventBoostPriority  (296, ...
 01252  2016   NtWaitForSingleObject  ... ) == 0x0
 01270  2016   NtSetEventBoostPriority  (296, ...
 01246  1180   NtWaitForSingleObject  ... ) == 0x0
 01271  1180   NtSetEventBoostPriority  (296, ...
 01257  1600   NtWaitForSingleObject  ... ) == 0x0
 01272  1600   NtSetEventBoostPriority  (296, ...
 01260  1372   NtWaitForSingleObject  ... ) == 0x0
 01273  1372   NtWaitForSingleObject  (64, 0, {0, 0}, ...
 01272  1600   NtSetEventBoostPriority  ... ) == 0x0
 01274  1600   NtWaitForSingleObject  (64, 0, {0, 0}, ...
 01270  2016   NtSetEventBoostPriority  ... ) == 0x0
 01269   252   NtSetEventBoostPriority  ... ) == 0x0
 01268  1096   NtSetEventBoostPriority  ... ) == 0x0
 01267   420   NtSetEventBoostPriority  ... ) == 0x0
 01271  1180   NtSetEventBoostPriority  ... ) == 0x0
 01266   928   NtSetEventBoostPriority  ... ) == 0x0
 01265   428   NtSetEventBoostPriority  ... ) == 0x0
 01264  1732   NtSetEventBoostPriority  ... ) == 0x0
 01263   748   NtSetEventBoostPriority  ... ) == 0x0
 01262   900   NtSetEventBoostPriority  ... ) == 0x0
 01261  1388   NtSetEventBoostPriority  ... ) == 0x0
 01258  2036   NtSetEventBoostPriority  ... ) == 0x0
 01275   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81858, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81858, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\34\1\0\0\344\4\0\0\254\6\0\0" ...  ...
 01273  1372   NtWaitForSingleObject  ... ) == 0x102
 01274  1600   NtWaitForSingleObject  ... ) == 0x102
 01276  2016   NtOpenThreadToken  (-2, 0xc, 1, ...
 01277  1096   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 01278   252   NtWaitForSingleObject  (120, 0, 0x0, ...
 01279  1180   NtWaitForSingleObject  (64, 0, {0, 0}, ...
 01280   928   NtWaitForSingleObject  (64, 0, {0, 0}, ...
 01281   428   NtWaitForSingleObject  (64, 0, {0, 0}, ...
 01282  1732   NtWaitForSingleObject  (64, 0, {0, 0}, ...
 01283   748   NtWaitForSingleObject  (64, 0, {0, 0}, ...
 01284   900   NtWaitForSingleObject  (64, 0, {0, 0}, ...
 01285  1388   NtWaitForSingleObject  (64, 0, {0, 0}, ...
 01286  2036   NtWaitForSingleObject  (64, 0, {0, 0}, ...
 01275   896   NtRequestWaitReplyPort  ... {28, 56, reply, 0, 1252, 896, 81859, 0}  ... {28, 56, reply, 0, 1252, 896, 81859, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\34\1\0\0\344\4\0\0\254\6\0\0" )  ) == 0x0
 01287  1372   NtWaitForSingleObject  (120, 0, 0x0, ...
 01288  1600   NtWaitForSingleObject  (120, 0, 0x0, ...
 01276  2016   NtOpenThreadToken  ... ) == STATUS_NO_TOKEN
 01289   420   NtAllocateVirtualMemory  (-1, 1372160, 0, 4096, 4096, 4, ...
 01290   896   NtResumeThread  (284, ...
 01291  2016   NtOpenThreadToken  (-2, 0x20008, 1, ...
 01289   420   NtAllocateVirtualMemory  ... 1372160, 4096, ) == 0x0
 01290   896   NtResumeThread  ... 1, ) == 0x0
 01291  2016   NtOpenThreadToken  ... ) == STATUS_NO_TOKEN
 01292   420   NtOpenFile  (0x100001, {24, 0, 0x40, 0, 0,  (0x100001, {24, 0, 0x40, 0, 0, "\Device\KsecDD"}, 7, 16, ... }, 7, 16, ...
 01293   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ...
 01294  2016   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\mswsock.dll"}, 11006064, ... }, 11006064, ...
 01292   420   NtOpenFile  ... 340, {status=0x0, info=0}, ) == 0x0
 01277  1096   NtDuplicateObject  ... 344, ) == 0x0
 01279  1180   NtWaitForSingleObject  ... ) == 0x102
 01280   928   NtWaitForSingleObject  ... ) == 0x102
 01281   428   NtWaitForSingleObject  ... ) == 0x102
 01282  1732   NtWaitForSingleObject  ... ) == 0x102
 01283   748   NtWaitForSingleObject  ... ) == 0x102
 01284   900   NtWaitForSingleObject  ... ) == 0x102
 01285  1388   NtWaitForSingleObject  ... ) == 0x102
 01286  2036   NtWaitForSingleObject  ... ) == 0x102
 01295  1708   NtWaitForSingleObject  (88, 0, 0x0, ...
 01294  2016   NtQueryAttributesFile  ... ) == 0x0
 01296   420   NtDeviceIoControlFile  (340, 0, 0x0, 0x0, 0x390008,  (340, 0, 0x0, 0x0, 0x390008, "\35>e\356\15K\37378\362\22\217k+\365\232\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0", 256, 256, ... , 256, 256, ...
 01297  1096   NtWaitForSingleObject  (64, 0, {0, 0}, ...
 01298  1180   NtWaitForSingleObject  (120, 0, 0x0, ...
 01299   928   NtWaitForSingleObject  (120, 0, 0x0, ...
 01300   428   NtWaitForSingleObject  (120, 0, 0x0, ...
 01301  1732   NtWaitForSingleObject  (120, 0, 0x0, ...
 01302   748   NtWaitForSingleObject  (120, 0, 0x0, ...
 01303   900   NtWaitForSingleObject  (120, 0, 0x0, ...
 01304  1388   NtWaitForSingleObject  (120, 0, 0x0, ...
 01305  2036   NtWaitForSingleObject  (120, 0, 0x0, ...
 01293   896   NtAllocateVirtualMemory  ... 34340864, 1048576, ) == 0x0
 01306   420   NtQuerySystemInformation  (TimeOfDay, 48, ...
 01297  1096   NtWaitForSingleObject  ... ) == 0x102
 01307   896   NtAllocateVirtualMemory  (-1, 35381248, 0, 8192, 4096, 4, ...
 01308  2016   NtSetEventBoostPriority  (88, ...
 01309  1096   NtWaitForSingleObject  (120, 0, 0x0, ...
 01307   896   NtAllocateVirtualMemory  ... 35381248, 8192, ) == 0x0
 01295  1708   NtWaitForSingleObject  ... ) == 0x0
 01308  2016   NtSetEventBoostPriority  ... ) == 0x0
 01310  1708   NtTestAlert  (...
 01311   896   NtProtectVirtualMemory  (-1, (0x21be000), 4096, 260, ...
 01310  1708   NtTestAlert  ... ) == 0x0
 01312  2016   NtOpenKey  (0x20019, {24, 28, 0x40, 0, 0,  (0x20019, {24, 28, 0x40, 0, 0, "SYSTEM\CurrentControlSet\Services\Winsock\Parameters"}, ... }, ...
 01311   896   NtProtectVirtualMemory  ... (0x21be000), 4096, 4, ) == 0x0
 01306   420   NtQuerySystemInformation  ... {system info, class 3, size 48}, 48, ) == 0x0
 01312  2016   NtOpenKey  ... 336, ) == 0x0
 01313   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ...
 01314   420   NtQuerySystemInformation  (ProcessorTimes, 48, ...
 01315  2016   NtQueryValueKey  (336,  (336, "Transports", Partial, 144, ... , Partial, 144, ...
 01316  1708   NtContinue  (34340144, 1, ...
 01314   420   NtQuerySystemInformation  ... {system info, class 8, size 48}, 48, ) == 0x0
 01315  2016   NtQueryValueKey  ... TitleIdx=0, Type=7, Data= ... TitleIdx=0, Type=7, Data="T\0c\0p\0i\0p\0\0\0N\0e\0t\0B\0I\0O\0S\0\0\0R\0F\0C\0O\0M\0M\0\0\0\0\0"}, 56, ) }, 56, ) == 0x0
 01317  1708   NtRegisterThreadTerminatePort  (24, ...
 01318   420   NtQuerySystemInformation  (Performance, 312, ...
 01313   896   NtCreateThread  ... 332, {1252, 1024}, ) == 0x0
 01317  1708   NtRegisterThreadTerminatePort  ... ) == 0x0
 01318   420   NtQuerySystemInformation  ... {system info, class 2, size 312}, 312, ) == 0x0
 01319   896   NtQueryInformationThread  (332, Basic, 28, ...
 01320  1708   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 01321   420   NtQuerySystemInformation  (Exception, 16, ...
 01319   896   NtQueryInformationThread  ... {ExitStatus=0x103,TebBaseAddress=0x7ffa2000,Pid=1252,Tid=1024,}, 0x0, ) == 0x0
 01320  1708   NtDuplicateObject  ... 328, ) == 0x0
 01322  2016   NtQueryValueKey  (336,  (336, "Transports", Partial, 144, ... , Partial, 144, ...
 01323   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81859, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81859, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFGL\1\0\0\344\4\0\0\0\4\0\0" ...  ...
 01324  1708   NtAllocateVirtualMemory  (-1, 1376256, 0, 4096, 4096, 4, ...
 01322  2016   NtQueryValueKey  ... TitleIdx=0, Type=7, Data= ... TitleIdx=0, Type=7, Data="T\0c\0p\0i\0p\0\0\0N\0e\0t\0B\0I\0O\0S\0\0\0R\0F\0C\0O\0M\0M\0\0\0\0\0"}, 56, ) }, 56, ) == 0x0
 01323   896   NtRequestWaitReplyPort  ... {28, 56, reply, 0, 1252, 896, 81860, 0}  ... {28, 56, reply, 0, 1252, 896, 81860, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFGL\1\0\0\344\4\0\0\0\4\0\0" )  ) == 0x0
 01321   420   NtQuerySystemInformation  ... {system info, class 33, size 16}, 16, ) == 0x0
 01325  2016   NtClose  (336, ...
 01324  1708   NtAllocateVirtualMemory  ... 1376256, 4096, ) == 0x0
 01326   420   NtQuerySystemInformation  (Lookaside, 32, ...
 01325  2016   NtClose  ... ) == 0x0
 01327  1708   NtWaitForSingleObject  (64, 0, {0, 0}, ...
 01326   420   NtQuerySystemInformation  ... {system info, class 45, size 32}, 32, ) == 0x0
 01328  2016   NtOpenKey  (0x20019, {24, 28, 0x40, 0, 0,  (0x20019, {24, 28, 0x40, 0, 0, "System\CurrentControlSet\Services\Tcpip\Parameters\Winsock"}, ... }, ...
 01327  1708   NtWaitForSingleObject  ... ) == 0x102
 01329   420   NtQuerySystemInformation  (ProcessorStatistics, 3016, ...
 01328  2016   NtOpenKey  ... 336, ) == 0x0
 01330  1708   NtWaitForSingleObject  (120, 0, 0x0, ...
 01329   420   NtQuerySystemInformation  ... {system info, class 23, size 0}, 0, ) == 0x0
 01331   896   NtResumeThread  (332, ...
 01332   420   NtQuerySystemInformation  (ProcessesAndThreads, 3008, ...
 01331   896   NtResumeThread  ... 1, ) == 0x0
 01333  2016   NtQueryValueKey  (336,  (336, "Mapping", Partial, 144, ... , Partial, 144, ...
 01334   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ...
 01333  2016   NtQueryValueKey  ... ) == STATUS_BUFFER_OVERFLOW
 01334   896   NtAllocateVirtualMemory  ... 35389440, 1048576, ) == 0x0
 01335  2016   NtQueryValueKey  (336,  (336, "Mapping", Partial, 144, ... , Partial, 144, ...
 01336   896   NtAllocateVirtualMemory  (-1, 36429824, 0, 8192, 4096, 4, ...
 01335  2016   NtQueryValueKey  ... ) == STATUS_BUFFER_OVERFLOW
 01336   896   NtAllocateVirtualMemory  ... 36429824, 8192, ) == 0x0
 01337  2016   NtQueryValueKey  (336,  (336, "Mapping", Partial, 152, ... , Partial, 152, ...
 01332   420   NtQuerySystemInformation  ... ) == STATUS_INFO_LENGTH_MISMATCH
 01338  1024   NtTestAlert  (...
 01337  2016   NtQueryValueKey  ... TitleIdx=0, Type=3, Data= ... TitleIdx=0, Type=3, Data="\13\0\0\0\3\0\0\0\2\0\0\0\1\0\0\0\6\0\0\0\2\0\0\0\1\0\0\0\0\0\0\0\2\0\0\0\0\0\0\0\6\0\0\0\0\0\0\0\0\0\0\0\6\0\0\0\0\0\0\0\1\0\0\0\6\0\0\0\2\0\0\0\2\0\0\0\21\0\0\0\2\0\0\0\2\0\0\0\0\0\0\0\2\0\0\0\0\0\0\0\21\0\0\0\0\0\0\0\0\0\0\0\21\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\2\0\0\0\3\0\0\0\0\0\0\0"}, 152, ) }, 152, ) == 0x0
 01339   420   NtCreateKey  (0x2, {24, 0, 0x240, 0, 0,  (0x2, {24, 0, 0x240, 0, 0, "\Registry\Machine\SOFTWARE\Microsoft\Cryptography\RNG"}, 0, 0x0, 0, ... }, 0, 0x0, 0, ...
 01338  1024   NtTestAlert  ... ) == 0x0
 01340   896   NtProtectVirtualMemory  (-1, (0x22be000), 4096, 260, ...
 01339   420   NtCreateKey  ... -2147481368, 2, ) == 0x0
 01341  1024   NtContinue  (35388720, 1, ...
 01340   896   NtProtectVirtualMemory  ... (0x22be000), 4096, 4, ) == 0x0
 01342  2016   NtClose  (336, ...
 01343  1024   NtRegisterThreadTerminatePort  (24, ...
 01344   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ...
 01342  2016   NtClose  ... ) == 0x0
 01343  1024   NtRegisterThreadTerminatePort  ... ) == 0x0
 01344   896   NtCreateThread  ... 336, {1252, 1324}, ) == 0x0
 01345  2016   NtOpenKey  (0x20019, {24, 28, 0x40, 0, 0,  (0x20019, {24, 28, 0x40, 0, 0, "System\CurrentControlSet\Services\Tcpip\Parameters\Winsock"}, ... }, ...
 01346   420   NtSetValueKey  (-2147481368,  (-2147481368, "Seed", 0, 3, "\201\310V\366^}\214\13\322Je\275\217b\33y&\242\221\317\275b\360p\365F\213}[\241k\244Ke.D\343?E\343\337\3112\316G\220\301e\323C\312\255-\220\351\20\244\361\376\326\6\223z\370\366F]X}\35\310b]\314g\377`\367\331j", 80, ... , 0, 3,  (-2147481368, "Seed", 0, 3, "\201\310V\366^}\214\13\322Je\275\217b\33y&\242\221\317\275b\360p\365F\213}[\241k\244Ke.D\343?E\343\337\3112\316G\220\301e\323C\312\255-\220\351\20\244\361\376\326\6\223z\370\366F]X}\35\310b]\314g\377`\367\331j", 80, ... , 80, ...
 01347   896   NtQueryInformationThread  (336, Basic, 28, ...
 01345  2016   NtOpenKey  ... 324, ) == 0x0
 01346   420   NtSetValueKey  ... ) == 0x0
 01347   896   NtQueryInformationThread  ... {ExitStatus=0x103,TebBaseAddress=0x7ffa1000,Pid=1252,Tid=1324,}, 0x0, ) == 0x0
 01348  2016   NtQueryValueKey  (324,  (324, "MinSockaddrLength", Partial, 144, ... , Partial, 144, ...
 01349   420   NtClose  (-2147481368, ...
 01350  1024   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 01348  2016   NtQueryValueKey  ... TitleIdx=0, Type=4, Data= ... TitleIdx=0, Type=4, Data="\20\0\0\0"}, 16, ) }, 16, ) == 0x0
 01349   420   NtClose  ... ) == 0x0
 01350  1024   NtDuplicateObject  ... 320, ) == 0x0
 01351   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81860, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81860, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFGP\1\0\0\344\4\0\0,\5\0\0" ...  ...
 01296   420   NtDeviceIoControlFile  ... {status=0x0, info=256},  ... {status=0x0, info=256}, "\367i\336\272\310\275+/\3238\364\255<\360\13LNY\256\3647K\334Z\373Xy4\221\25\311\314j\324Z\24\256\305\277P\12QG\226\230$\221)\377\326\263\3532\20\225\25b\324\260\361\306\334\325%\310^\265\360\250\20Z\376\262\233\242\320\237\23\262\1l\241\303H\301\226\206OB(\37RPux%\274\342\221+a\377\254`\265\17\315~\30\344\364\165\316\227\233\255`I\5\11yj\337\222\213\277\221Q\370\234[r\16\3044\362\347\211\345\31T\6VA\307\276\222\27\335Hy\206\31\235d\212{x\256\1\214\4\370>\314\245\330\322b\262\331b\23m\0\355\350\377L\177=\357n\16\230w\27_\276G\213\266\205vu\331\353\24v(h\23\313?8\254}\3Q\240wLc\265\240\347\352\311p\273!\211F\272\245\274\336I\257"\341Q\344`2z"\215\22`\260\324t\321\37#\16\275\27\234\277i\363\321B", ) \341Q\344`2z ... {status=0x0, info=256}, "\367i\336\272\310\275+/\3238\364\255<\360\13LNY\256\3647K\334Z\373Xy4\221\25\311\314j\324Z\24\256\305\277P\12QG\226\230$\221)\377\326\263\3532\20\225\25b\324\260\361\306\334\325%\310^\265\360\250\20Z\376\262\233\242\320\237\23\262\1l\241\303H\301\226\206OB(\37RPux%\274\342\221+a\377\254`\265\17\315~\30\344\364\165\316\227\233\255`I\5\11yj\337\222\213\277\221Q\370\234[r\16\3044\362\347\211\345\31T\6VA\307\276\222\27\335Hy\206\31\235d\212{x\256\1\214\4\370>\314\245\330\322b\262\331b\23m\0\355\350\377L\177=\357n\16\230w\27_\276G\213\266\205vu\331\353\24v(h\23\313?8\254}\3Q\240wLc\265\240\347\352\311p\273!\211F\272\245\274\336I\257"\341Q\344`2z"\215\22`\260\324t\321\37#\16\275\27\234\277i\363\321B", ) , ) == 0x0
 01352  1024   NtWaitForSingleObject  (64, 0, {0, 0}, ...
 01351   896   NtRequestWaitReplyPort  ... {28, 56, reply, 0, 1252, 896, 81861, 0}  ... {28, 56, reply, 0, 1252, 896, 81861, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFGP\1\0\0\344\4\0\0,\5\0\0" )  ) == 0x0
 01353   420   NtCreateEvent  (0x1f0003, 0x0, 1, 0, ...
 01352  1024   NtWaitForSingleObject  ... ) == 0x102
 01354   896   NtResumeThread  (336, ...
 01355  2016   NtQueryValueKey  (324,  (324, "MaxSockaddrLength", Partial, 144, ... , Partial, 144, ...
 01356  1024   NtWaitForSingleObject  (120, 0, 0x0, ...
 01354   896   NtResumeThread  ... 1, ) == 0x0
 01355  2016   NtQueryValueKey  ... TitleIdx=0, Type=4, Data= ... TitleIdx=0, Type=4, Data="\20\0\0\0"}, 16, ) }, 16, ) == 0x0
 01353   420   NtCreateEvent  ... 316, ) == 0x0
 01357  1324   NtAllocateVirtualMemory  (-1, 8802304, 0, 4096, 4096, 4, ...
 01358   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ...
 01359  2016   NtQueryValueKey  (324,  (324, "UseDelayedAcceptance", Partial, 144, ... , Partial, 144, ...
 01360   420   NtConnectPort  ( ("\RPC Control\DNSResolver", {12, 2, 1, 0}, 0x0, 0x0, 14413316, 188, ... , {12, 2, 1, 0}, 0x0, 0x0, 14413316, 188, ...
 01357  1324   NtAllocateVirtualMemory  ... 8802304, 4096, ) == 0x0
 01359  2016   NtQueryValueKey  ... TitleIdx=0, Type=4, Data= ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) }, 16, ) == 0x0
 01361  1324   NtTestAlert  (...
 01362  2016   NtQueryValueKey  (324,  (324, "HelperDllName", Partial, 144, ... , Partial, 144, ...
 01360   420   NtConnectPort  ... 312, 0x0, 0x0, 0x0, 188, ) == 0x0
 01361  1324   NtTestAlert  ... ) == 0x0
 01362  2016   NtQueryValueKey  ... TitleIdx=0, Type=2, Data= ... TitleIdx=0, Type=2, Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0w\0s\0h\0t\0c\0p\0i\0p\0.\0d\0l\0l\0\0\0"}, 82, ) }, 82, ) == 0x0
 01363   420   NtRequestWaitReplyPort  (312, {200, 224, new_msg, 0, 1378832, 12, 2, 1310721}  (312, {200, 224, new_msg, 0, 1378832, 12, 2, 1310721} "\0\0\0\0\274\0\0\0x\1\24\0\1kwEVY\205D\237\200\364(\367\326\1)\2\0\0\0\1\0\0\0@\10\25\0\4\0\0\0x\1\24\0\10\0\0\0\5\0\0\0x\1\24\0\0\0\0\0\0\0\25\0\1\0\0\0\363$\307\226x\263@\320\300\11\25\0h\1\24\0\12\0\0\0\0\0\0\0\0\0\0\0(\0\0\0\230\11\25\0\366\212!\177x\1\24\0\270\11\25\0h\1\24\0\0\0\0\0\0\0\0\0\270\11\25\0P\0\0\0\300\11\25\0\360\6\221|x\1\24\0P\0\0\0\346\31\0\0\0\0\24\0\204\354\333\0\372\31\221|\30\364\333\0\30\356\220|\360\6\221|\0\0\0\0\0\0\0\0\0\0\0\0\6\0\0\0" ...  ...
 01364  1324   NtContinue  (36437296, 1, ...
 01358   896   NtAllocateVirtualMemory  ... 36438016, 1048576, ) == 0x0
 01365  2016   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\System32\wshtcpip.dll"}, 11007020, ... }, 11007020, ...
 01366   896   NtAllocateVirtualMemory  (-1, 37478400, 0, 8192, 4096, 4, ...
 01365  2016   NtQueryAttributesFile  ... ) == 0x0
 01366   896   NtAllocateVirtualMemory  ... 37478400, 8192, ) == 0x0
 01367  2016   NtOpenFile  (0x100020, {24, 0, 0x40, 0, 0,  (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\System32\wshtcpip.dll"}, 5, 96, ... }, 5, 96, ...
 01368   896   NtProtectVirtualMemory  (-1, (0x23be000), 4096, 260, ...
 01367  2016   NtOpenFile  ... 308, {status=0x0, info=1}, ) == 0x0
 01368   896   NtProtectVirtualMemory  ... (0x23be000), 4096, 4, ) == 0x0
 01369  2016   NtCreateSection  (0xe, 0x0, 0x0, 16, 134217728, 308, ...
 01370   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ...
 01369  2016   NtCreateSection  ... 304, ) == 0x0
 01371  1324   NtRegisterThreadTerminatePort  (24, ...
 01363   420   NtRequestWaitReplyPort  ... {200, 224, reply, 0, 1252, 420, 81863, 0}  ... {200, 224, reply, 0, 1252, 420, 81863, 0} "\7\0\0\0\274\0\0\0x\1\24\0\1kwEVY\205D\237\200\364(\367\326\1)\2\0\0\0\1\0\0\0\0\0\0\0\4\0\0\0x\1\24\0\377\377\377\377\5\0\0\0x\1\24\0\0\0\0\0\0\0\25\0\1\0\0\0\363$\307\226x\263@\320\300\11\25\0h\1\24\0\12\0\0\0\0\0\0\0\0\0\0\0(\0\0\0\230\11\25\0\366\212!\177x\1\24\0\270\11\25\0h\1\24\0\0\0\0\0\0\0\0\0\270\11\25\0P\0\0\0\300\11\25\0\360\6\221|x\1\24\0P\0\0\0\346\31\0\0\0\0\24\0\204\354\333\0\372\31\221|\30\364\333\0\30\356\220|\360\6\221|\0\0\0\0\0\0\0\0\0\0\0\0\6\0\0\0" )  ) == 0x0
 01370   896   NtCreateThread  ... 300, {1252, 1776}, ) == 0x0
 01371  1324   NtRegisterThreadTerminatePort  ... ) == 0x0
 01372   420   NtRequestWaitReplyPort  (312, {64, 88, new_msg, 0, 0, 0, 0, 0}  (312, {64, 88, new_msg, 0, 0, 0, 0, 0} "\1\0\0\0A\2\10\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\377\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0" ...  ...
 01373   896   NtQueryInformationThread  (300, Basic, 28, ...
 01374  1324   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 01373   896   NtQueryInformationThread  ... {ExitStatus=0x103,TebBaseAddress=0x7ffa0000,Pid=1252,Tid=1776,}, 0x0, ) == 0x0
 01374  1324   NtDuplicateObject  ... 348, ) == 0x0
 01375   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81861, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81861, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG,\1\0\0\344\4\0\0\360\6\0\0" ...  ...
 01376  1324   NtWaitForSingleObject  (64, 0, {0, 0}, ...
 01375   896   NtRequestWaitReplyPort  ... {28, 56, reply, 0, 1252, 896, 81865, 0}  ... {28, 56, reply, 0, 1252, 896, 81865, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG,\1\0\0\344\4\0\0\360\6\0\0" )  ) == 0x0
 01376  1324   NtWaitForSingleObject  ... ) == 0x102
 01377  2016   NtClose  (308, ...
 01372   420   NtRequestWaitReplyPort  ... {52, 76, reply, 0, 1252, 420, 81864, 0}  ... {52, 76, reply, 0, 1252, 420, 81864, 0} "\2\356Q\200\1\0\0\0\30b\202\201\0\300\375\177\220\273\270\367\370\37`\300l\273\270\367X\353Q\200\360\317\12\0\1\0\0\0\1\0\0\0\300\250|\207\377\377\377\0" )  ) == 0x0
 01378  1324   NtWaitForSingleObject  (120, 0, 0x0, ...
 01377  2016   NtClose  ... ) == 0x0
 01379   420   NtClose  (316, ...
 01380  2016   NtMapViewOfSection  (304, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 16, ...
 01379   420   NtClose  ... ) == 0x0
 01380  2016   NtMapViewOfSection  ... (0x850000), 0x0, 20480, ) == 0x0
 01381   896   NtResumeThread  (300, ...
 01382  2016   NtClose  (304, ...
 01381   896   NtResumeThread  ... 1, ) == 0x0
 01382  2016   NtClose  ... ) == 0x0
 01383   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ...
 01384   420   NtClose  (312, ...
 01385  1776   NtWaitForSingleObject  (88, 0, 0x0, ...
 01383   896   NtAllocateVirtualMemory  ... 37486592, 1048576, ) == 0x0
 01384   420   NtClose  ... ) == 0x0
 01386   896   NtAllocateVirtualMemory  (-1, 38526976, 0, 8192, 4096, 4, ...
 01387   420   NtWaitForSingleObject  (88, 0, 0x0, ...
 01386   896   NtAllocateVirtualMemory  ... 38526976, 8192, ) == 0x0
 01388   896   NtProtectVirtualMemory  (-1, (0x24be000), 4096, 260, ... (0x24be000), 4096, 4, ) == 0x0
 01389   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ...
 01390  2016   NtUnmapViewOfSection  (-1, 0x850000, ... ) == 0x0
 01391  2016   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\System32\wshtcpip.dll"}, 11007328, ... ) }, 11007328, ... ) == 0x0
 01389   896   NtCreateThread  ... 312, {1252, 500}, ) == 0x0
 01392   896   NtQueryInformationThread  (312, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ff9f000,Pid=1252,Tid=500,}, 0x0, ) == 0x0
 01393   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81865, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81865, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG8\1\0\0\344\4\0\0\364\1\0\0" ... {28, 56, reply, 0, 1252, 896, 81867, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG8\1\0\0\344\4\0\0\364\1\0\0" )  ... {28, 56, reply, 0, 1252, 896, 81867, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81865, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG8\1\0\0\344\4\0\0\364\1\0\0" ... {28, 56, reply, 0, 1252, 896, 81867, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG8\1\0\0\344\4\0\0\364\1\0\0" )  ) == 0x0
 01394   896   NtResumeThread  (312, ... 1, ) == 0x0
 01395   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ... 38535168, 1048576, ) == 0x0
 01396   896   NtAllocateVirtualMemory  (-1, 39575552, 0, 8192, 4096, 4, ... 39575552, 8192, ) == 0x0
 01397  2016   NtOpenFile  (0x100020, {24, 0, 0x40, 0, 0,  (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\System32\wshtcpip.dll"}, 5, 96, ... }, 5, 96, ...
 01398   500   NtWaitForSingleObject  (88, 0, 0x0, ...
 01397  2016   NtOpenFile  ... 304, {status=0x0, info=1}, ) == 0x0
 01399  2016   NtCreateSection  (0xf, 0x0, 0x0, 16, 16777216, 304, ... 316, ) == 0x0
 01400  2016   NtQuerySection  (316, Image, 48, ... {section info, class 1, size 48}, 0x0, ) == 0x0
 01401  2016   NtClose  (304, ... ) == 0x0
 01402  2016   NtMapViewOfSection  (316, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x71a90000), 0x0, 32768, ) == 0x0
 01403  2016   NtClose  (316, ... ) == 0x0
 01404   896   NtProtectVirtualMemory  (-1, (0x25be000), 4096, 260, ... (0x25be000), 4096, 4, ) == 0x0
 01405   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ... 316, {1252, 248}, ) == 0x0
 01406   896   NtQueryInformationThread  (316, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ff9e000,Pid=1252,Tid=248,}, 0x0, ) == 0x0
 01407   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81867, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81867, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG<\1\0\0\344\4\0\0\370\0\0\0" ... {28, 56, reply, 0, 1252, 896, 81868, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG<\1\0\0\344\4\0\0\370\0\0\0" )  ... {28, 56, reply, 0, 1252, 896, 81868, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81867, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG<\1\0\0\344\4\0\0\370\0\0\0" ... {28, 56, reply, 0, 1252, 896, 81868, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG<\1\0\0\344\4\0\0\370\0\0\0" )  ) == 0x0
 01408   896   NtResumeThread  (316, ... 1, ) == 0x0
 01409   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ...
 01410  2016   NtProtectVirtualMemory  (-1, (0x71a91000), 128, 4, ...
 01411   248   NtWaitForSingleObject  (88, 0, 0x0, ...
 01410  2016   NtProtectVirtualMemory  ... (0x71a91000), 4096, 32, ) == 0x0
 01412  2016   NtProtectVirtualMemory  (-1, (0x71a91000), 4096, 32, ... (0x71a91000), 4096, 4, ) == 0x0
 01413  2016   NtFlushInstructionCache  (-1, 1906905088, 128, ... ) == 0x0
 01414  2016   NtOpenKey  (0x80000000, {24, 0, 0x40, 0, 0,  (0x80000000, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wshtcpip.dll"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01409   896   NtAllocateVirtualMemory  ... 39583744, 1048576, ) == 0x0
 01415   896   NtAllocateVirtualMemory  (-1, 40624128, 0, 8192, 4096, 4, ... 40624128, 8192, ) == 0x0
 01416   896   NtProtectVirtualMemory  (-1, (0x26be000), 4096, 260, ... (0x26be000), 4096, 4, ) == 0x0
 01417   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ... 304, {1252, 1884}, ) == 0x0
 01418   896   NtQueryInformationThread  (304, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ff9d000,Pid=1252,Tid=1884,}, 0x0, ) == 0x0
 01419   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81868, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81868, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG0\1\0\0\344\4\0\0\\7\0\0" ... {28, 56, reply, 0, 1252, 896, 81869, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG0\1\0\0\344\4\0\0\\7\0\0" )  ... {28, 56, reply, 0, 1252, 896, 81869, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81868, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG0\1\0\0\344\4\0\0\\7\0\0" ... {28, 56, reply, 0, 1252, 896, 81869, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG0\1\0\0\344\4\0\0\\7\0\0" )  ) == 0x0
 01420  2016   NtSetEventBoostPriority  (88, ...
 01385  1776   NtWaitForSingleObject  ... ) == 0x0
 01421  1776   NtSetEventBoostPriority  (88, ...
 01387   420   NtWaitForSingleObject  ... ) == 0x0
 01422   420   NtSetEventBoostPriority  (88, ...
 01398   500   NtWaitForSingleObject  ... ) == 0x0
 01423   500   NtSetEventBoostPriority  (88, ...
 01411   248   NtWaitForSingleObject  ... ) == 0x0
 01424   248   NtTestAlert  (... ) == 0x0
 01423   500   NtSetEventBoostPriority  ... ) == 0x0
 01422   420   NtSetEventBoostPriority  ... ) == 0x0
 01421  1776   NtSetEventBoostPriority  ... ) == 0x0
 01420  2016   NtSetEventBoostPriority  ... ) == 0x0
 01425   896   NtResumeThread  (304, ...
 01426   248   NtContinue  (39583024, 1, ...
 01427   500   NtTestAlert  (...
 01428   420   NtCreateKey  (0x20019, {24, 28, 0x40, 0, 0,  (0x20019, {24, 28, 0x40, 0, 0, "System\CurrentControlSet\Services\Tcpip\Parameters"}, 0, "Class", 0, ... }, 0,  (0x20019, {24, 28, 0x40, 0, 0, "System\CurrentControlSet\Services\Tcpip\Parameters"}, 0, "Class", 0, ... , 0, ...
 01429  2016   NtClose  (324, ...
 01425   896   NtResumeThread  ... 1, ) == 0x0
 01430   248   NtRegisterThreadTerminatePort  (24, ...
 01427   500   NtTestAlert  ... ) == 0x0
 01428   420   NtCreateKey  ... 308, 2, ) == 0x0
 01429  2016   NtClose  ... ) == 0x0
 01431   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ...
 01430   248   NtRegisterThreadTerminatePort  ... ) == 0x0
 01432   500   NtContinue  (38534448, 1, ...
 01433   420   NtOpenKey  (0x20019, {24, 28, 0x40, 0, 0,  (0x20019, {24, 28, 0x40, 0, 0, "System\CurrentControlSet\Services\DnsCache\Parameters"}, ... }, ...
 01434  2016   NtCreateFile  (0xc0100000, {24, 0, 0x42, 0, 0,  (0xc0100000, {24, 0, 0x42, 0, 0, "\Device\Afd\Endpoint"}, 0x0, 0, 3, 3, 0, 11009664, 67, ... }, 0x0, 0, 3, 3, 0, 11009664, 67, ...
 01431   896   NtAllocateVirtualMemory  ... 40632320, 1048576, ) == 0x0
 01435   248   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 01436   500   NtRegisterThreadTerminatePort  (24, ...
 01433   420   NtOpenKey  ... 324, ) == 0x0
 01434  2016   NtCreateFile  ... 352, {status=0x0, info=0}, ) == 0x0
 01437   896   NtAllocateVirtualMemory  (-1, 41672704, 0, 8192, 4096, 4, ...
 01435   248   NtDuplicateObject  ... 356, ) == 0x0
 01436   500   NtRegisterThreadTerminatePort  ... ) == 0x0
 01438   420   NtOpenKey  (0x20019, {24, 28, 0x40, 0, 0,  (0x20019, {24, 28, 0x40, 0, 0, "Software\Policies\Microsoft\Windows NT\DnsClient"}, ... }, ...
 01439  1776   NtTestAlert  (...
 01440  1884   NtTestAlert  (...
 01437   896   NtAllocateVirtualMemory  ... 41672704, 8192, ) == 0x0
 01441   248   NtWaitForSingleObject  (64, 0, {0, 0}, ...
 01442   500   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 01438   420   NtOpenKey  ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01439  1776   NtTestAlert  ... ) == 0x0
 01440  1884   NtTestAlert  ... ) == 0x0
 01443  2016   NtDeviceIoControlFile  (352, 108, 0x0, 0x0, 0x1207b,  (352, 108, 0x0, 0x0, 0x1207b, "\7\0\0\0\10\4\24\0\340\0\0\0\216\326\220|", 16, 16, ... , 16, 16, ...
 01444   896   NtProtectVirtualMemory  (-1, (0x27be000), 4096, 260, ...
 01441   248   NtWaitForSingleObject  ... ) == 0x102
 01442   500   NtDuplicateObject  ... 360, ) == 0x0
 01445  1776   NtContinue  (37485872, 1, ...
 01446  1884   NtContinue  (40631600, 1, ...
 01443  2016   NtDeviceIoControlFile  ... {status=0x0, info=16},  ... {status=0x0, info=16}, "\7\0\0\00\207\273\201\0 \0\0\230\353s\201", ) , ) == 0x0
 01444   896   NtProtectVirtualMemory  ... (0x27be000), 4096, 4, ) == 0x0
 01447   248   NtWaitForSingleObject  (120, 0, 0x0, ...
 01448   500   NtAllocateVirtualMemory  (-1, 1380352, 0, 4096, 4096, 4, ...
 01449  1776   NtRegisterThreadTerminatePort  (24, ...
 01450  1884   NtRegisterThreadTerminatePort  (24, ...
 01451  2016   NtDeviceIoControlFile  (352, 108, 0x0, 0x0, 0x1207b,  (352, 108, 0x0, 0x0, 0x1207b, "\6\0\0\00\207\273\201\0 \0\0\230\353s\201", 16, 16, ... , 16, 16, ...
 01452   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ...
 01448   500   NtAllocateVirtualMemory  ... 1380352, 4096, ) == 0x0
 01449  1776   NtRegisterThreadTerminatePort  ... ) == 0x0
 01450  1884   NtRegisterThreadTerminatePort  ... ) == 0x0
 01451  2016   NtDeviceIoControlFile  ... {status=0x0, info=16},  ... {status=0x0, info=16}, "\6\0\0\00\207\273\201\0 \0\0\230\353s\201", ) , ) == 0x0
 01452   896   NtCreateThread  ... 364, {1252, 1308}, ) == 0x0
 01453   500   NtWaitForSingleObject  (64, 0, {0, 0}, ...
 01454  1776   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 01455   420   NtQueryValueKey  (308,  (308, "Hostname", Partial, 144, ... , Partial, 144, ...
 01456  2016   NtDeviceIoControlFile  (352, 108, 0x0, 0x0, 0x12047,  (352, 108, 0x0, 0x0, 0x12047, "\0\0\0\0\2\0\0\0\1\0\0\0\6\0\0\0\20\0\0\0\20\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0 \0\0\0 \0\0\0\0\0\0\1\0\0\0\351\3\0\0f\0\2\0\10\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0h\0\0\0\377\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\1\0\0\0\6\0\0\0\0 \0\0\1\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0[\0\5\0\0\20\0\0P\4\24\0P\4\24\0\0\1\0\0\0\1\0\0\1\0\0\0 \0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0", 248, 16, ... , 248, 16, ...
 01457   896   NtQueryInformationThread  (364, Basic, 28, ...
 01453   500   NtWaitForSingleObject  ... ) == 0x102
 01458  1884   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 01455   420   NtQueryValueKey  ... TitleIdx=0, Type=1, Data= ... TitleIdx=0, Type=1, Data="v\0i\0r\0t\0u\0a\0l\0\0\0"}, 28, ) }, 28, ) == 0x0
 01456  2016   NtDeviceIoControlFile  ... {status=0x0, info=0}, "", ) == 0x0
 01457   896   NtQueryInformationThread  ... {ExitStatus=0x103,TebBaseAddress=0x7ff9c000,Pid=1252,Tid=1308,}, 0x0, ) == 0x0
 01454  1776   NtDuplicateObject  ... 368, ) == 0x0
 01458  1884   NtDuplicateObject  ... 372, ) == 0x0
 01459   420   NtQueryValueKey  (308,  (308, "Hostname", Partial, 144, ... , Partial, 144, ...
 01460   500   NtWaitForSingleObject  (120, 0, 0x0, ...
 01461  2016   NtWaitForSingleObject  (56, 0, {0, 0}, ...
 01462  1776   NtWaitForSingleObject  (64, 0, {0, 0}, ...
 01463  1884   NtWaitForSingleObject  (64, 0, {0, 0}, ...
 01459   420   NtQueryValueKey  ... TitleIdx=0, Type=1, Data= ... TitleIdx=0, Type=1, Data="v\0i\0r\0t\0u\0a\0l\0\0\0"}, 28, ) }, 28, ) == 0x0
 01461  2016   NtWaitForSingleObject  ... ) == 0x102
 01462  1776   NtWaitForSingleObject  ... ) == 0x102
 01463  1884   NtWaitForSingleObject  ... ) == 0x102
 01464   420   NtClose  (308, ...
 01465  2016   NtDeviceIoControlFile  (352, 108, 0x0, 0x0, 0x12003,  (352, 108, 0x0, 0x0, 0x12003, "\0\0\0\0\1\0\0\0\16\0\2\0\25\262\0\0\0\0\0\0\0\0\0\0\0\0", 26, 26, ... , 26, 26, ...
 01466  1776   NtWaitForSingleObject  (120, 0, 0x0, ...
 01467  1884   NtWaitForSingleObject  (120, 0, 0x0, ...
 01464   420   NtClose  ... ) == 0x0
 01465  2016   NtDeviceIoControlFile  ... {status=0x0, info=308},  ... {status=0x0, info=308}, "\1\0\0\0\1\0\0\0\16\0\2\0\25\262\0\0\0\0\0\0\0\0\0\0\0\0", ) , ) == 0x0
 01468   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81869, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81869, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFGl\1\0\0\344\4\0\0\34\5\0\0" ...  ...
 01469   420   NtClose  (324, ...
 01468   896   NtRequestWaitReplyPort  ... {28, 56, reply, 0, 1252, 896, 81870, 0}  ... {28, 56, reply, 0, 1252, 896, 81870, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFGl\1\0\0\344\4\0\0\34\5\0\0" )  ) == 0x0
 01469   420   NtClose  ... ) == 0x0
 01470   896   NtResumeThread  (364, ...
 01471   420   NtDeviceIoControlFile  (340, 0, 0x0, 0x0, 0x390008,  (340, 0, 0x0, 0x0, 0x390008, "\35>e\356\15K\373\35-\2119\26\316X\177\217\17\221r8I/f\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0", 256, 256, ... , 256, 256, ...
 01470   896   NtResumeThread  ... 1, ) == 0x0
 01472   420   NtQuerySystemInformation  (TimeOfDay, 48, ...
 01473   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ...
 01472   420   NtQuerySystemInformation  ... {system info, class 3, size 48}, 48, ) == 0x0
 01474  2016   NtDeviceIoControlFile  (352, 108, 0x0, 0x0, 0x12047,  (352, 108, 0x0, 0x0, 0x12047, "\1\0\0\0\2\0\0\0\1\0\0\0\6\0\0\0\20\0\0\0\20\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0 \0\0\0 \0\0\0\0\0\0\1\0\0\0\351\3\0\0f\0\2\0\10\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0h\0\0\0(\0*\0\2\0\25\262\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\1\0\0\0\6\0\0\0\0 \0\0\1\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0[\0\5\0\0\20\0\0P\4\24\0P\4\24\0\0\1\0\0\0\1\0\0\1\0\0\0 \0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0", 248, 0, ... , 248, 0, ...
 01475  1308   NtTestAlert  (...
 01476   420   NtQuerySystemInformation  (ProcessorTimes, 48, ...
 01474  2016   NtDeviceIoControlFile  ... {status=0x0, info=0}, 0x0, ) == 0x0
 01475  1308   NtTestAlert  ... ) == 0x0
 01473   896   NtAllocateVirtualMemory  ... 41680896, 1048576, ) == 0x0
 01477  2016   NtDeviceIoControlFile  (352, 108, 0x0, 0x0, 0x12037,  (352, 108, 0x0, 0x0, 0x12037, "\2\0\0\0", 4, 8, ... , 4, 8, ...
 01478  1308   NtContinue  (41680176, 1, ...
 01479   896   NtAllocateVirtualMemory  (-1, 42721280, 0, 8192, 4096, 4, ...
 01477  2016   NtDeviceIoControlFile  ... {status=0x0, info=8},  ... {status=0x0, info=8}, "\0\0\0\0\0\0\0\0", ) , ) == 0x0
 01480  1308   NtRegisterThreadTerminatePort  (24, ...
 01479   896   NtAllocateVirtualMemory  ... 42721280, 8192, ) == 0x0
 01481  2016   NtDeviceIoControlFile  (352, 108, 0x0, 0x0, 0x1200b,  (352, 108, 0x0, 0x0, 0x1200b, "\0\376\247\0\5\0\0\0\0\255\24\0", 12, 0, ... , 12, 0, ...
 01480  1308   NtRegisterThreadTerminatePort  ... ) == 0x0
 01482   896   NtProtectVirtualMemory  (-1, (0x28be000), 4096, 260, ...
 01481  2016   NtDeviceIoControlFile  ... {status=0x0, info=0}, 0x0, ) == 0x0
 01476   420   NtQuerySystemInformation  ... {system info, class 8, size 48}, 48, ) == 0x0
 01482   896   NtProtectVirtualMemory  ... (0x28be000), 4096, 4, ) == 0x0
 01483  1308   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 01484   420   NtQuerySystemInformation  (Performance, 312, ...
 01485   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ...
 01483  1308   NtDuplicateObject  ... 324, ) == 0x0
 01484   420   NtQuerySystemInformation  ... {system info, class 2, size 312}, 312, ) == 0x0
 01486  2016   NtDeviceIoControlFile  (352, 108, 0x0, 0x0, 0x12047,  (352, 108, 0x0, 0x0, 0x12047, "\1\0\0\0\2\0\0\0\1\0\0\0\6\0\0\0\20\0\0\0\20\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0 \0\0\0 \0\0\1\0\0\0\1\0\0\0\351\3\0\0f\0\2\0\10\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0h\0\0\0\310\376\247\0\2\0\25\262\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\1\0\0\0\6\0\0\0\0 \0\0\1\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0[\0\5\0\0\20\0\0P\4\24\0P\4\24\0\0\1\0\0\0\1\0\0\1\0\0\0 \0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0", 248, 0, ... , 248, 0, ...
 01487  1308   NtWaitForSingleObject  (64, 0, {0, 0}, ...
 01488   420   NtQuerySystemInformation  (Exception, 16, ...
 01486  2016   NtDeviceIoControlFile  ... {status=0x0, info=0}, 0x0, ) == 0x0
 01487  1308   NtWaitForSingleObject  ... ) == 0x102
 01488   420   NtQuerySystemInformation  ... {system info, class 33, size 16}, 16, ) == 0x0
 01489  2016   NtDeviceIoControlFile  (352, 108, 0x0, 0x0, 0x1202f, 0x0, 0, 26, ...
 01490  1308   NtWaitForSingleObject  (120, 0, 0x0, ...
 01491   420   NtQuerySystemInformation  (Lookaside, 32, ...
 01489  2016   NtDeviceIoControlFile  ... {status=0x0, info=26},  ... {status=0x0, info=26}, "\1\0\0\0\1\0\0\0\16\0\2\0\25\262\0\0\0\0\0\0\0\0\0\0\0\0", ) , ) == 0x0
 01485   896   NtCreateThread  ... 376, {1252, 1676}, ) == 0x0
 01492  2016   NtCreateEvent  (0x100003, 0x0, 1, 0, ...
 01493   896   NtQueryInformationThread  (376, Basic, 28, ...
 01492  2016   NtCreateEvent  ... 380, ) == 0x0
 01493   896   NtQueryInformationThread  ... {ExitStatus=0x103,TebBaseAddress=0x7ff9b000,Pid=1252,Tid=1676,}, 0x0, ) == 0x0
 01491   420   NtQuerySystemInformation  ... {system info, class 45, size 32}, 32, ) == 0x0
 01494   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81870, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81870, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFGx\1\0\0\344\4\0\0\214\6\0\0" ...  ...
 01495   420   NtQuerySystemInformation  (ProcessorStatistics, 3016, ...
 01494   896   NtRequestWaitReplyPort  ... {28, 56, reply, 0, 1252, 896, 81871, 0}  ... {28, 56, reply, 0, 1252, 896, 81871, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFGx\1\0\0\344\4\0\0\214\6\0\0" )  ) == 0x0
 01495   420   NtQuerySystemInformation  ... {system info, class 23, size 0}, 0, ) == 0x0
 01496  2016   NtWaitForSingleObject  (380, 0, 0x0, ...
 01497   420   NtQuerySystemInformation  (ProcessesAndThreads, 3008, ... ) == STATUS_INFO_LENGTH_MISMATCH
 01498   420   NtCreateKey  (0x2, {24, 0, 0x240, 0, 0,  (0x2, {24, 0, 0x240, 0, 0, "\Registry\Machine\SOFTWARE\Microsoft\Cryptography\RNG"}, 0, 0x0, 0, ... -2147481484, 2, ) }, 0, 0x0, 0, ... -2147481484, 2, ) == 0x0
 01499   420   NtSetValueKey  (-2147481484,  (-2147481484, "Seed", 0, 3, "\340k\3g\221$\20\376\2704#\3741\37\326\355\331\350\340*;\227)\331'\2608@i\336\1\221.\266\233\327tED0v\351W\323h\25\253a\251Ic\320j\14\12\147\355\304\365\252\225\301\252\222\354\204[\139\372\22F\224\3706\0\3\313\240", 80, ... ) , 0, 3,  (-2147481484, "Seed", 0, 3, "\340k\3g\221$\20\376\2704#\3741\37\326\355\331\350\340*;\227)\331'\2608@i\336\1\221.\266\233\327tED0v\351W\323h\25\253a\251Ic\320j\14\12\147\355\304\365\252\225\301\252\222\354\204[\139\372\22F\224\3706\0\3\313\240", 80, ... ) , 80, ... ) == 0x0
 01500   420   NtClose  (-2147481484, ... ) == 0x0
 01471   420   NtDeviceIoControlFile  ... {status=0x0, info=256},  ... {status=0x0, info=256}, ":\315[tFNN\317\202T\324\240\301f\370/]\303\210|-\332>\252\216\323[\316\244'\\367_8\5cC\321\231\325>\250d\235\223a\356o\35\323\36\375\336wr\33%\303\322\336\5.=\353\\223O :\301\217A\315\13\9\345$uC\247\12 @\363fg\375\255\333i\333\311\302K\206v\304\313\240?\17a\342\272~\361*\332i\346\261\214&v\241X\211\221\210\332\364x\335\362\236c\113\354;A\207l<:2\216bW\325\11\206\373\13s)\3206\213\371?\257\335\240\241\372\36c\231v\355\370]\350\22)\270\323\361\242\342F\26\345S\342GF\201\247!U\17Y\242\200\25b\2108\351\316\212\235\224\4\201\307\255\262f\20\25O3V\235,\5E\250WF5k\373B&\357\2716(Y\24v\210\255C\331\354H'\333\267H&u9fe\370DY\240\217\351m2.\341\4x\223\13", ) , ) == 0x0
 01501   896   NtResumeThread  (376, ... 1, ) == 0x0
 01502   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ... 42729472, 1048576, ) == 0x0
 01503   896   NtAllocateVirtualMemory  (-1, 43769856, 0, 8192, 4096, 4, ... 43769856, 8192, ) == 0x0
 01504   896   NtProtectVirtualMemory  (-1, (0x29be000), 4096, 260, ... (0x29be000), 4096, 4, ) == 0x0
 01505   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ... 384, {1252, 1620}, ) == 0x0
 01506   896   NtQueryInformationThread  (384, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ff9a000,Pid=1252,Tid=1620,}, 0x0, ) == 0x0
 01507   420   NtDeviceIoControlFile  (340, 0, 0x0, 0x0, 0x390008,  (340, 0, 0x0, 0x0, 0x390008, "\35>e\356\15K\373\35-\2119\26\316XU\232t\272\353\235:\245s\17\221r8I/f\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0", 256, 256, ... , 256, 256, ...
 01508  1676   NtTestAlert  (...
 01509   420   NtQuerySystemInformation  (TimeOfDay, 48, ...
 01508  1676   NtTestAlert  ... ) == 0x0
 01509   420   NtQuerySystemInformation  ... {system info, class 3, size 48}, 48, ) == 0x0
 01510  1676   NtContinue  (42728752, 1, ...
 01511   420   NtQuerySystemInformation  (ProcessorTimes, 48, ...
 01512  1676   NtRegisterThreadTerminatePort  (24, ...
 01511   420   NtQuerySystemInformation  ... {system info, class 8, size 48}, 48, ) == 0x0
 01512  1676   NtRegisterThreadTerminatePort  ... ) == 0x0
 01513   420   NtQuerySystemInformation  (Performance, 312, ...
 01514   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81871, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81871, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\200\1\0\0\344\4\0\0T\6\0\0" ...  ...
 01515  1676   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 01514   896   NtRequestWaitReplyPort  ... {28, 56, reply, 0, 1252, 896, 81872, 0}  ... {28, 56, reply, 0, 1252, 896, 81872, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\200\1\0\0\344\4\0\0T\6\0\0" )  ) == 0x0
 01515  1676   NtDuplicateObject  ... 388, ) == 0x0
 01516   896   NtResumeThread  (384, ...
 01517  1676   NtWaitForSingleObject  (64, 0, {0, 0}, ...
 01516   896   NtResumeThread  ... 1, ) == 0x0
 01517  1676   NtWaitForSingleObject  ... ) == 0x102
 01518   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ...
 01519  1676   NtWaitForSingleObject  (120, 0, 0x0, ...
 01513   420   NtQuerySystemInformation  ... {system info, class 2, size 312}, 312, ) == 0x0
 01520  1620   NtTestAlert  (...
 01518   896   NtAllocateVirtualMemory  ... 43778048, 1048576, ) == 0x0
 01521   420   NtQuerySystemInformation  (Exception, 16, ...
 01520  1620   NtTestAlert  ... ) == 0x0
 01522   896   NtAllocateVirtualMemory  (-1, 44818432, 0, 8192, 4096, 4, ...
 01521   420   NtQuerySystemInformation  ... {system info, class 33, size 16}, 16, ) == 0x0
 01523  1620   NtContinue  (43777328, 1, ...
 01522   896   NtAllocateVirtualMemory  ... 44818432, 8192, ) == 0x0
 01524   420   NtQuerySystemInformation  (Lookaside, 32, ...
 01525  1620   NtRegisterThreadTerminatePort  (24, ...
 01526   896   NtProtectVirtualMemory  (-1, (0x2abe000), 4096, 260, ...
 01524   420   NtQuerySystemInformation  ... {system info, class 45, size 32}, 32, ) == 0x0
 01525  1620   NtRegisterThreadTerminatePort  ... ) == 0x0
 01526   896   NtProtectVirtualMemory  ... (0x2abe000), 4096, 4, ) == 0x0
 01527   420   NtQuerySystemInformation  (ProcessorStatistics, 3016, ...
 01528   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ...
 01529  1620   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 01527   420   NtQuerySystemInformation  ... {system info, class 23, size 0}, 0, ) == 0x0
 01529  1620   NtDuplicateObject  ... 392, ) == 0x0
 01530   420   NtQuerySystemInformation  (ProcessesAndThreads, 3008, ...
 01531  1620   NtWaitForSingleObject  (64, 0, {0, 0}, ...
 01530   420   NtQuerySystemInformation  ... ) == STATUS_INFO_LENGTH_MISMATCH
 01531  1620   NtWaitForSingleObject  ... ) == 0x102
 01532   420   NtCreateKey  (0x2, {24, 0, 0x240, 0, 0,  (0x2, {24, 0, 0x240, 0, 0, "\Registry\Machine\SOFTWARE\Microsoft\Cryptography\RNG"}, 0, 0x0, 0, ... }, 0, 0x0, 0, ...
 01533  1620   NtWaitForSingleObject  (120, 0, 0x0, ...
 01532   420   NtCreateKey  ... -2147481484, 2, ) == 0x0
 01528   896   NtCreateThread  ... 396, {1252, 1296}, ) == 0x0
 01534   420   NtSetValueKey  (-2147481484,  (-2147481484, "Seed", 0, 3, "\206\217Us\315]\213K\241\304&\1\216\310\332b\21\346\320\2\262\353t\27\235\344,\324xaT\243a\345\267\257\231W\2432\250\251\35Ba\274B\21\377\205\276~\373X\316\3268\2108\225\15\266a7\266\25Np\33G\253`X\25%q>\237}\203", 80, ... , 0, 3,  (-2147481484, "Seed", 0, 3, "\206\217Us\315]\213K\241\304&\1\216\310\332b\21\346\320\2\262\353t\27\235\344,\324xaT\243a\345\267\257\231W\2432\250\251\35Ba\274B\21\377\205\276~\373X\316\3268\2108\225\15\266a7\266\25Np\33G\253`X\25%q>\237}\203", 80, ... , 80, ...
 01535   896   NtQueryInformationThread  (396, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ff99000,Pid=1252,Tid=1296,}, 0x0, ) == 0x0
 01536   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81872, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81872, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\214\1\0\0\344\4\0\0\20\5\0\0" ... {28, 56, reply, 0, 1252, 896, 81873, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\214\1\0\0\344\4\0\0\20\5\0\0" )  ... {28, 56, reply, 0, 1252, 896, 81873, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81872, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\214\1\0\0\344\4\0\0\20\5\0\0" ... {28, 56, reply, 0, 1252, 896, 81873, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\214\1\0\0\344\4\0\0\20\5\0\0" )  ) == 0x0
 01537   896   NtResumeThread  (396, ... 1, ) == 0x0
 01538   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ...
 01534   420   NtSetValueKey  ... ) == 0x0
 01539  1296   NtTestAlert  (...
 01540   420   NtClose  (-2147481484, ...
 01539  1296   NtTestAlert  ... ) == 0x0
 01540   420   NtClose  ... ) == 0x0
 01541  1296   NtContinue  (44825904, 1, ...
 01507   420   NtDeviceIoControlFile  ... {status=0x0, info=256}, " ... {status=0x0, info=256}, ""<\233\375+\230\263\274\276k\324\204pG\240\315*\236\303\22\367\374w\32\205\300\261\306\210^\351\242I\205\367\6R\200YWs\364\261Y?\325\2227F\277,Cg\1\3L\250\203\215\217\355\243W\361>\304\367\272\305'fG\243\2\221G\3", ) \205\367\6R\200YWs\364\261Y?\325\2227F\277,Cg\1\3L\250\203\215\217\355\243W\361>\304\367\272\305'fG\243\2\221G\3", ) == 0x0
 01542  1296   NtRegisterThreadTerminatePort  (24, ...
 01543   420   NtDeviceIoControlFile  (340, 0, 0x0, 0x0, 0x390008,  (340, 0, 0x0, 0x0, 0x390008, "\35>e\356\15K\373\35-\2119\26\316XU\232t\272\353\235:\217ft\272\353\235:\245s\17\221r8I/f\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0", 256, 256, ... , 256, 256, ...
 01542  1296   NtRegisterThreadTerminatePort  ... ) == 0x0
 01544   420   NtQuerySystemInformation  (TimeOfDay, 48, ...
 01538   896   NtAllocateVirtualMemory  ... 44826624, 1048576, ) == 0x0
 01545  1296   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 01546   896   NtAllocateVirtualMemory  (-1, 45867008, 0, 8192, 4096, 4, ...
 01545  1296   NtDuplicateObject  ... 400, ) == 0x0
 01546   896   NtAllocateVirtualMemory  ... 45867008, 8192, ) == 0x0
 01547  1296   NtWaitForSingleObject  (64, 0, {0, 0}, ...
 01548   896   NtProtectVirtualMemory  (-1, (0x2bbe000), 4096, 260, ...
 01547  1296   NtWaitForSingleObject  ... ) == 0x102
 01548   896   NtProtectVirtualMemory  ... (0x2bbe000), 4096, 4, ) == 0x0
 01549  1296   NtWaitForSingleObject  (120, 0, 0x0, ...
 01550   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ...
 01544   420   NtQuerySystemInformation  ... {system info, class 3, size 48}, 48, ) == 0x0
 01551   420   NtQuerySystemInformation  (ProcessorTimes, 48, ... {system info, class 8, size 48}, 48, ) == 0x0
 01552   420   NtQuerySystemInformation  (Performance, 312, ... {system info, class 2, size 312}, 312, ) == 0x0
 01553   420   NtQuerySystemInformation  (Exception, 16, ... {system info, class 33, size 16}, 16, ) == 0x0
 01554   420   NtQuerySystemInformation  (Lookaside, 32, ... {system info, class 45, size 32}, 32, ) == 0x0
 01555   420   NtQuerySystemInformation  (ProcessorStatistics, 3016, ... {system info, class 23, size 0}, 0, ) == 0x0
 01556   420   NtQuerySystemInformation  (ProcessesAndThreads, 3008, ...
 01550   896   NtCreateThread  ... 404, {1252, 440}, ) == 0x0
 01557   896   NtQueryInformationThread  (404, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ff98000,Pid=1252,Tid=440,}, 0x0, ) == 0x0
 01558   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81873, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81873, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\224\1\0\0\344\4\0\0\270\1\0\0" ... {28, 56, reply, 0, 1252, 896, 81874, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\224\1\0\0\344\4\0\0\270\1\0\0" )  ... {28, 56, reply, 0, 1252, 896, 81874, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81873, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\224\1\0\0\344\4\0\0\270\1\0\0" ... {28, 56, reply, 0, 1252, 896, 81874, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\224\1\0\0\344\4\0\0\270\1\0\0" )  ) == 0x0
 01559   896   NtResumeThread  (404, ... 1, ) == 0x0
 01560   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ... 45875200, 1048576, ) == 0x0
 01561   896   NtAllocateVirtualMemory  (-1, 46915584, 0, 8192, 4096, 4, ... 46915584, 8192, ) == 0x0
 01556   420   NtQuerySystemInformation  ... ) == STATUS_INFO_LENGTH_MISMATCH
 01562   440   NtTestAlert  (...
 01563   420   NtCreateKey  (0x2, {24, 0, 0x240, 0, 0,  (0x2, {24, 0, 0x240, 0, 0, "\Registry\Machine\SOFTWARE\Microsoft\Cryptography\RNG"}, 0, 0x0, 0, ... }, 0, 0x0, 0, ...
 01562   440   NtTestAlert  ... ) == 0x0
 01563   420   NtCreateKey  ... -2147481484, 2, ) == 0x0
 01564   440   NtContinue  (45874480, 1, ...
 01565   420   NtSetValueKey  (-2147481484,  (-2147481484, "Seed", 0, 3, "\325\13\119'\13\177\22.\1\3406\3622\253\15\224\342\307\265\304<\201\245\20\266\27\366\355\263\216\37,\221_Y\236|\313\304\7\374BF\6\50\261 \305^\17\2]\254\264_\332\361\331H\276\376zfX<\3036_a\1\366#\321\31330\347u", 80, ... , 0, 3,  (-2147481484, "Seed", 0, 3, "\325\13\119'\13\177\22.\1\3406\3622\253\15\224\342\307\265\304<\201\245\20\266\27\366\355\263\216\37,\221_Y\236|\313\304\7\374BF\6\50\261 \305^\17\2]\254\264_\332\361\331H\276\376zfX<\3036_a\1\366#\321\31330\347u", 80, ... , 80, ...
 01566   440   NtRegisterThreadTerminatePort  (24, ...
 01565   420   NtSetValueKey  ... ) == 0x0
 01566   440   NtRegisterThreadTerminatePort  ... ) == 0x0
 01567   420   NtClose  (-2147481484, ...
 01568   896   NtProtectVirtualMemory  (-1, (0x2cbe000), 4096, 260, ...
 01569   440   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 01568   896   NtProtectVirtualMemory  ... (0x2cbe000), 4096, 4, ) == 0x0
 01569   440   NtDuplicateObject  ... 408, ) == 0x0
 01570   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ...
 01571   440   NtWaitForSingleObject  (64, 0, {0, 0}, ...
 01570   896   NtCreateThread  ... 412, {1252, 1588}, ) == 0x0
 01571   440   NtWaitForSingleObject  ... ) == 0x102
 01572   896   NtQueryInformationThread  (412, Basic, 28, ...
 01573   440   NtWaitForSingleObject  (120, 0, 0x0, ...
 01572   896   NtQueryInformationThread  ... {ExitStatus=0x103,TebBaseAddress=0x7ff97000,Pid=1252,Tid=1588,}, 0x0, ) == 0x0
 01567   420   NtClose  ... ) == 0x0
 01543   420   NtDeviceIoControlFile  ... {status=0x0, info=256},  ... {status=0x0, info=256}, "\342\335\254\217C\255BeQ\272\221A\316*\230\367\2703>t#z\214\342\31\303b3\200\267\337\274H\321z\336\3L\252i6\372av\3540J\206\364*:\347d\202\350\367$\25\206\333\345@S\263QD-[\320\210w\13U\262\22\210W\226+\236YgQ\233\234\17L\32V\215t\321\354\200\347\226#\275\31F\360\363\354\244\343\240~*\20\215\276\314>(N{\6d\30\222\22\320\326\327RB^\20\367\4\363\22m\237\221\375\203\366\10\237\305\31\303\241Z\377\261\274\21\232\234\222J!\331\22\33\244\207\204\5\240S\375\327J\236\337gO1)\3363\261\262\242^\202\337\0\302\36\314\6\232\327\14\2160\271\212@Z\367\3\310\372_:\206\202,G\214O\302Ec)\25\350Q\36%\37\367L\317\3678(e\376\234\224y\353\224\332\374\223\365#\343T0\241b\213p\364\306\357\242~\23\5\200g\367\16z\261\375", ) , ) == 0x0
 01574   420   NtDeviceIoControlFile  (340, 0, 0x0, 0x0, 0x390008,  (340, 0, 0x0, 0x0, 0x390008, "\35>e\356\15K\373\35-\2119\26\316XU\232t\272\353\235:\217ft\272\353\235:\217ft\272\353\235:\245s\17\221r8I/f\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0", 256, 256, ... , 256, 256, ...
 01575   420   NtQuerySystemInformation  (TimeOfDay, 48, ... {system info, class 3, size 48}, 48, ) == 0x0
 01576   420   NtQuerySystemInformation  (ProcessorTimes, 48, ... {system info, class 8, size 48}, 48, ) == 0x0
 01577   420   NtQuerySystemInformation  (Performance, 312, ... {system info, class 2, size 312}, 312, ) == 0x0
 01578   420   NtQuerySystemInformation  (Exception, 16, ... {system info, class 33, size 16}, 16, ) == 0x0
 01579   420   NtQuerySystemInformation  (Lookaside, 32, ...
 01580   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81874, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81874, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\234\1\0\0\344\4\0\04\6\0\0" ... {28, 56, reply, 0, 1252, 896, 81875, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\234\1\0\0\344\4\0\04\6\0\0" )  ... {28, 56, reply, 0, 1252, 896, 81875, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81874, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\234\1\0\0\344\4\0\04\6\0\0" ... {28, 56, reply, 0, 1252, 896, 81875, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\234\1\0\0\344\4\0\04\6\0\0" )  ) == 0x0
 01581   896   NtResumeThread  (412, ... 1, ) == 0x0
 01582   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ... 46923776, 1048576, ) == 0x0
 01583   896   NtAllocateVirtualMemory  (-1, 47964160, 0, 8192, 4096, 4, ... 47964160, 8192, ) == 0x0
 01584   896   NtProtectVirtualMemory  (-1, (0x2dbe000), 4096, 260, ... (0x2dbe000), 4096, 4, ) == 0x0
 01585   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ...
 01579   420   NtQuerySystemInformation  ... {system info, class 45, size 32}, 32, ) == 0x0
 01586  1588   NtTestAlert  (...
 01587   420   NtQuerySystemInformation  (ProcessorStatistics, 3016, ...
 01586  1588   NtTestAlert  ... ) == 0x0
 01587   420   NtQuerySystemInformation  ... {system info, class 23, size 0}, 0, ) == 0x0
 01588  1588   NtContinue  (46923056, 1, ...
 01589   420   NtQuerySystemInformation  (ProcessesAndThreads, 3008, ...
 01590  1588   NtRegisterThreadTerminatePort  (24, ...
 01589   420   NtQuerySystemInformation  ... ) == STATUS_INFO_LENGTH_MISMATCH
 01590  1588   NtRegisterThreadTerminatePort  ... ) == 0x0
 01591   420   NtCreateKey  (0x2, {24, 0, 0x240, 0, 0,  (0x2, {24, 0, 0x240, 0, 0, "\Registry\Machine\SOFTWARE\Microsoft\Cryptography\RNG"}, 0, 0x0, 0, ... }, 0, 0x0, 0, ...
 01585   896   NtCreateThread  ... 416, {1252, 2044}, ) == 0x0
 01592  1588   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 01593   896   NtQueryInformationThread  (416, Basic, 28, ...
 01592  1588   NtDuplicateObject  ... 420, ) == 0x0
 01593   896   NtQueryInformationThread  ... {ExitStatus=0x103,TebBaseAddress=0x7ff96000,Pid=1252,Tid=2044,}, 0x0, ) == 0x0
 01594  1588   NtWaitForSingleObject  (64, 0, {0, 0}, ...
 01595   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81875, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81875, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\240\1\0\0\344\4\0\0\374\7\0\0" ...  ...
 01594  1588   NtWaitForSingleObject  ... ) == 0x102
 01595   896   NtRequestWaitReplyPort  ... {28, 56, reply, 0, 1252, 896, 81876, 0}  ... {28, 56, reply, 0, 1252, 896, 81876, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\240\1\0\0\344\4\0\0\374\7\0\0" )  ) == 0x0
 01596  1588   NtWaitForSingleObject  (120, 0, 0x0, ...
 01591   420   NtCreateKey  ... -2147481484, 2, ) == 0x0
 01597   896   NtResumeThread  (416, ...
 01598   420   NtSetValueKey  (-2147481484,  (-2147481484, "Seed", 0, 3, "\217K\275\261\310\12\252\37\16\366gI\3540BZ\365\377\335\303I\374\261\301\332\252meV\30061 \346x\270\206\342\15\31\25\356\15z\265.\245SV\300\312d\362\250\15X\327D\362t\1$\315\2370\331\251U\12\272\32\203\310\215\273+\312\302^B", 80, ... , 0, 3,  (-2147481484, "Seed", 0, 3, "\217K\275\261\310\12\252\37\16\366gI\3540BZ\365\377\335\303I\374\261\301\332\252meV\30061 \346x\270\206\342\15\31\25\356\15z\265.\245SV\300\312d\362\250\15X\327D\362t\1$\315\2370\331\251U\12\272\32\203\310\215\273+\312\302^B", 80, ... , 80, ...
 01597   896   NtResumeThread  ... 1, ) == 0x0
 01598   420   NtSetValueKey  ... ) == 0x0
 01599   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ...
 01600   420   NtClose  (-2147481484, ...
 01599   896   NtAllocateVirtualMemory  ... 47972352, 1048576, ) == 0x0
 01600   420   NtClose  ... ) == 0x0
 01601   896   NtAllocateVirtualMemory  (-1, 49012736, 0, 8192, 4096, 4, ...
 01574   420   NtDeviceIoControlFile  ... {status=0x0, info=256},  ... {status=0x0, info=256}, "\25\274\245\231S\17Dh>\261\303\322\354\342i2s\272x\265.\10B\217\216o\3061\363X\2dd\317\277I!\273'r\244\216O0\344\21Br9\235&>\250Q\331\252\10\277Zhq\220\11\21jKW\252\226J\3\177\22.T7\303\246\200+.6\304\306\315\33\3\242b\355\236{7\351,\377x\207\210!V~\247\242/\115B"j \227\257\231\347\257\261\14V\2273Y\355\336:\254\27\314\264ph\320C\349N\3020\207L\32\316\365e\303\351\6\223t\256\217\215;\224\242\253u*c\22\3>\18\344\224\267\335\311\302V\34\212\363r\6uV\334\342\264\207\223\260\232\351\336uNT\216z<\253\267\355\353\7\5C\231\206)i\2372r\341\250\311\211\255\276T\315\216\275\254\200axYfb\203\205\234\366\21\261Y\204\33\351\355\231\263\311\2407\231\35\24\240\201\323\375C\2422\204\220@\357", ) j \227\257\231\347\257\261\14V\2273Y\355\336:\254\27\314\264ph\320C\349N\3020\207L\32\316\365e\303\351\6\223t\256\217\215;\224\242\253u*c\22\3>\18\344\224\267\335\311\302V\34\212\363r\6uV\334\342\264\207\223\260\232\351\336uNT\216z<\253\267\355\353\7\5C\231\206)i\2372r\341\250\311\211\255\276T\315\216\275\254\200axYfb\203\205\234\366\21\261Y\204\33\351\355\231\263\311\2407\231\35\24\240\201\323\375C\2422\204\220@\357", ) == 0x0
 01601   896   NtAllocateVirtualMemory  ... 49012736, 8192, ) == 0x0
 01602  2044   NtTestAlert  (...
 01603   420   NtDeviceIoControlFile  (340, 0, 0x0, 0x0, 0x390008,  (340, 0, 0x0, 0x0, 0x390008, "\35>e\356\15K\373\35-\2119\26\316XU\232t\272\353\235:\217ft\272\353\235:\217ft\272\353\235:\217ft\272\353\235:\245s\17\221r8I/f\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0", 256, 256, ... , 256, 256, ...
 01602  2044   NtTestAlert  ... ) == 0x0
 01604   420   NtQuerySystemInformation  (TimeOfDay, 48, ...
 01605  2044   NtContinue  (47971632, 1, ...
 01604   420   NtQuerySystemInformation  ... {system info, class 3, size 48}, 48, ) == 0x0
 01606  2044   NtRegisterThreadTerminatePort  (24, ...
 01607   420   NtQuerySystemInformation  (ProcessorTimes, 48, ...
 01606  2044   NtRegisterThreadTerminatePort  ... ) == 0x0
 01607   420   NtQuerySystemInformation  ... {system info, class 8, size 48}, 48, ) == 0x0
 01608   896   NtProtectVirtualMemory  (-1, (0x2ebe000), 4096, 260, ...
 01609   420   NtQuerySystemInformation  (Performance, 312, ...
 01608   896   NtProtectVirtualMemory  ... (0x2ebe000), 4096, 4, ) == 0x0
 01610  2044   NtAllocateVirtualMemory  (-1, 1384448, 0, 4096, 4096, 4, ...
 01611   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ...
 01610  2044   NtAllocateVirtualMemory  ... 1384448, 4096, ) == 0x0
 01611   896   NtCreateThread  ... 424, {1252, 588}, ) == 0x0
 01612  2044   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 01613   896   NtQueryInformationThread  (424, Basic, 28, ...
 01612  2044   NtDuplicateObject  ... 428, ) == 0x0
 01613   896   NtQueryInformationThread  ... {ExitStatus=0x103,TebBaseAddress=0x7ff95000,Pid=1252,Tid=588,}, 0x0, ) == 0x0
 01614  2044   NtWaitForSingleObject  (64, 0, {0, 0}, ...
 01609   420   NtQuerySystemInformation  ... {system info, class 2, size 312}, 312, ) == 0x0
 01615   420   NtQuerySystemInformation  (Exception, 16, ... {system info, class 33, size 16}, 16, ) == 0x0
 01616   420   NtQuerySystemInformation  (Lookaside, 32, ... {system info, class 45, size 32}, 32, ) == 0x0
 01617   420   NtQuerySystemInformation  (ProcessorStatistics, 3016, ... {system info, class 23, size 0}, 0, ) == 0x0
 01618   420   NtQuerySystemInformation  (ProcessesAndThreads, 3008, ... ) == STATUS_INFO_LENGTH_MISMATCH
 01619   420   NtCreateKey  (0x2, {24, 0, 0x240, 0, 0,  (0x2, {24, 0, 0x240, 0, 0, "\Registry\Machine\SOFTWARE\Microsoft\Cryptography\RNG"}, 0, 0x0, 0, ... -2147481484, 2, ) }, 0, 0x0, 0, ... -2147481484, 2, ) == 0x0
 01620   420   NtSetValueKey  (-2147481484,  (-2147481484, "Seed", 0, 3, "\313 \327\361O\7\248\244\221nR\347\177\325K\312W\301d\231\345\255Th\300)\343\306*\212\261P/%\371V\273\321\262\362\11\243b\373\364i\214SN\307\355\266\210\204\2360\225\235\254\311\227A\20\267\325\371T\255\204\344\204\366f$\237\235z7d", 80, ... , 0, 3,  (-2147481484, "Seed", 0, 3, "\313 \327\361O\7\248\244\221nR\347\177\325K\312W\301d\231\345\255Th\300)\343\306*\212\261P/%\371V\273\321\262\362\11\243b\373\364i\214SN\307\355\266\210\204\2360\225\235\254\311\227A\20\267\325\371T\255\204\344\204\366f$\237\235z7d", 80, ... , 80, ...
 01621   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81876, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81876, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\250\1\0\0\344\4\0\0L\2\0\0" ...  ...
 01614  2044   NtWaitForSingleObject  ... ) == 0x102
 01621   896   NtRequestWaitReplyPort  ... {28, 56, reply, 0, 1252, 896, 81877, 0}  ... {28, 56, reply, 0, 1252, 896, 81877, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\250\1\0\0\344\4\0\0L\2\0\0" )  ) == 0x0
 01622  2044   NtWaitForSingleObject  (120, 0, 0x0, ...
 01623   896   NtResumeThread  (424, ... 1, ) == 0x0
 01624   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ... 49020928, 1048576, ) == 0x0
 01625   896   NtAllocateVirtualMemory  (-1, 50061312, 0, 8192, 4096, 4, ... 50061312, 8192, ) == 0x0
 01626   896   NtProtectVirtualMemory  (-1, (0x2fbe000), 4096, 260, ... (0x2fbe000), 4096, 4, ) == 0x0
 01627   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ...
 01620   420   NtSetValueKey  ... ) == 0x0
 01628   588   NtTestAlert  (...
 01629   420   NtClose  (-2147481484, ...
 01628   588   NtTestAlert  ... ) == 0x0
 01629   420   NtClose  ... ) == 0x0
 01630   588   NtContinue  (49020208, 1, ...
 01603   420   NtDeviceIoControlFile  ... {status=0x0, info=256},  ... {status=0x0, info=256}, "e\277,\0\237B*\244\306\377\255\253\16/\375\202?\270\374}\344y\32(8\221\267\230\3402Ce\346\312\25\210r-\13g3\241'r\310\342\3105\271i$&\25\233>Y\202\237\362\270\235\2227\225{\215\17\251\346\365|eE\210S\321\364b\3534\377\20\233\202\240k\11QEg\3314\25\11\201\311\271\253\345=g\214\36\271\201: \335\264\336\27\220H\346hv\271\1Tf\35\262C\314,om\235K\321\276\302\32\217\264!\326\315\230\375\346"\324\316{:\33\355H\254\205\264\5\301^\335\265\351\2060k.\316\337p\250\15^d;\32qV\227\2613\313\4\253N\335\324$\207\371\354\255\344\6Pd\211\337LqRB\322j\265\301\205\201\375\257\202\326]\323j\320\214\237\244\352\344\231\31\246vb\306\20\214\304\211\357\36\333\334\270\17\23\321S\232\233\27\226\252B[0\351q\16\224B3s\337\22\225i\321", ) \324\316{:\33\355H\254\205\264\5\301^\335\265\351\2060k.\316\337p\250\15^d;\32qV\227\2613\313\4\253N\335\324$\207\371\354\255\344\6Pd\211\337LqRB\322j\265\301\205\201\375\257\202\326]\323j\320\214\237\244\352\344\231\31\246vb\306\20\214\304\211\357\36\333\334\270\17\23\321S\232\233\27\226\252B[0\351q\16\224B3s\337\22\225i\321", ) == 0x0
 01631   588   NtRegisterThreadTerminatePort  (24, ...
 01632   420   NtDeviceIoControlFile  (340, 0, 0x0, 0x0, 0x390008,  (340, 0, 0x0, 0x0, 0x390008, "\35>e\356\15K\373\35-\2119\26\316XU\232t\272\353\235:\217ft\272\353\235:\217ft\272\353\235:\217ft\272\353\235:\217ft\272\353\235:\245s\17\221r8I/f\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0", 256, 256, ... , 256, 256, ...
 01631   588   NtRegisterThreadTerminatePort  ... ) == 0x0
 01633   420   NtQuerySystemInformation  (TimeOfDay, 48, ...
 01627   896   NtCreateThread  ... 432, {1252, 1652}, ) == 0x0
 01634   588   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 01635   896   NtQueryInformationThread  (432, Basic, 28, ...
 01634   588   NtDuplicateObject  ... 436, ) == 0x0
 01635   896   NtQueryInformationThread  ... {ExitStatus=0x103,TebBaseAddress=0x7ff94000,Pid=1252,Tid=1652,}, 0x0, ) == 0x0
 01636   588   NtWaitForSingleObject  (64, 0, {0, 0}, ...
 01637   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81877, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81877, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\260\1\0\0\344\4\0\0t\6\0\0" ...  ...
 01636   588   NtWaitForSingleObject  ... ) == 0x102
 01637   896   NtRequestWaitReplyPort  ... {28, 56, reply, 0, 1252, 896, 81878, 0}  ... {28, 56, reply, 0, 1252, 896, 81878, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\260\1\0\0\344\4\0\0t\6\0\0" )  ) == 0x0
 01638   588   NtWaitForSingleObject  (120, 0, 0x0, ...
 01633   420   NtQuerySystemInformation  ... {system info, class 3, size 48}, 48, ) == 0x0
 01639   896   NtResumeThread  (432, ...
 01640   420   NtQuerySystemInformation  (ProcessorTimes, 48, ...
 01639   896   NtResumeThread  ... 1, ) == 0x0
 01640   420   NtQuerySystemInformation  ... {system info, class 8, size 48}, 48, ) == 0x0
 01641   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ...
 01642   420   NtQuerySystemInformation  (Performance, 312, ...
 01641   896   NtAllocateVirtualMemory  ... 50069504, 1048576, ) == 0x0
 01642   420   NtQuerySystemInformation  ... {system info, class 2, size 312}, 312, ) == 0x0
 01643   896   NtAllocateVirtualMemory  (-1, 51109888, 0, 8192, 4096, 4, ...
 01644   420   NtQuerySystemInformation  (Exception, 16, ...
 01643   896   NtAllocateVirtualMemory  ... 51109888, 8192, ) == 0x0
 01645  1652   NtTestAlert  (...
 01644   420   NtQuerySystemInformation  ... {system info, class 33, size 16}, 16, ) == 0x0
 01645  1652   NtTestAlert  ... ) == 0x0
 01646   420   NtQuerySystemInformation  (Lookaside, 32, ...
 01647  1652   NtContinue  (50068784, 1, ...
 01646   420   NtQuerySystemInformation  ... {system info, class 45, size 32}, 32, ) == 0x0
 01648  1652   NtRegisterThreadTerminatePort  (24, ...
 01649   420   NtQuerySystemInformation  (ProcessorStatistics, 3016, ...
 01648  1652   NtRegisterThreadTerminatePort  ... ) == 0x0
 01649   420   NtQuerySystemInformation  ... {system info, class 23, size 0}, 0, ) == 0x0
 01650   896   NtProtectVirtualMemory  (-1, (0x30be000), 4096, 260, ...
 01651   420   NtQuerySystemInformation  (ProcessesAndThreads, 3008, ...
 01650   896   NtProtectVirtualMemory  ... (0x30be000), 4096, 4, ) == 0x0
 01652  1652   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 01653   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ...
 01652  1652   NtDuplicateObject  ... 440, ) == 0x0
 01653   896   NtCreateThread  ... 444, {1252, 1376}, ) == 0x0
 01654  1652   NtWaitForSingleObject  (64, 0, {0, 0}, ...
 01655   896   NtQueryInformationThread  (444, Basic, 28, ...
 01654  1652   NtWaitForSingleObject  ... ) == 0x102
 01655   896   NtQueryInformationThread  ... {ExitStatus=0x103,TebBaseAddress=0x7ff93000,Pid=1252,Tid=1376,}, 0x0, ) == 0x0
 01656  1652   NtWaitForSingleObject  (120, 0, 0x0, ...
 01651   420   NtQuerySystemInformation  ... ) == STATUS_INFO_LENGTH_MISMATCH
 01657   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81878, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81878, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\274\1\0\0\344\4\0\0`\5\0\0" ...  ...
 01658   420   NtCreateKey  (0x2, {24, 0, 0x240, 0, 0,  (0x2, {24, 0, 0x240, 0, 0, "\Registry\Machine\SOFTWARE\Microsoft\Cryptography\RNG"}, 0, 0x0, 0, ... }, 0, 0x0, 0, ...
 01657   896   NtRequestWaitReplyPort  ... {28, 56, reply, 0, 1252, 896, 81879, 0}  ... {28, 56, reply, 0, 1252, 896, 81879, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\274\1\0\0\344\4\0\0`\5\0\0" )  ) == 0x0
 01658   420   NtCreateKey  ... -2147481484, 2, ) == 0x0
 01659   896   NtResumeThread  (444, ...
 01660   420   NtSetValueKey  (-2147481484,  (-2147481484, "Seed", 0, 3, "\322a\1\331?X\261\313\220\340\204%\277\275\35\7\345\376l\332\\7P4\251\332\371\376\341\324\247\246\243\15M\215\2017\3312\215/\22\23t\200\14BTa(\\0\201\337$\60s, \375\27F2\35\25j\21\312\220\370\260\321\31\7\31J\257\371", 80, ... , 0, 3,  (-2147481484, "Seed", 0, 3, "\322a\1\331?X\261\313\220\340\204%\277\275\35\7\345\376l\332\\7P4\251\332\371\376\341\324\247\246\243\15M\215\2017\3312\215/\22\23t\200\14BTa(\\0\201\337$\60s, \375\27F2\35\25j\21\312\220\370\260\321\31\7\31J\257\371", 80, ... , 80, ...
 01659   896   NtResumeThread  ... 1, ) == 0x0
 01660   420   NtSetValueKey  ... ) == 0x0
 01661   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ...
 01662   420   NtClose  (-2147481484, ...
 01663  1376   NtTestAlert  (...
 01661   896   NtAllocateVirtualMemory  ... 51118080, 1048576, ) == 0x0
 01663  1376   NtTestAlert  ... ) == 0x0
 01664   896   NtAllocateVirtualMemory  (-1, 52158464, 0, 8192, 4096, 4, ...
 01665  1376   NtContinue  (51117360, 1, ...
 01664   896   NtAllocateVirtualMemory  ... 52158464, 8192, ) == 0x0
 01666  1376   NtRegisterThreadTerminatePort  (24, ...
 01667   896   NtProtectVirtualMemory  (-1, (0x31be000), 4096, 260, ...
 01666  1376   NtRegisterThreadTerminatePort  ... ) == 0x0
 01667   896   NtProtectVirtualMemory  ... (0x31be000), 4096, 4, ) == 0x0
 01662   420   NtClose  ... ) == 0x0
 01668   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ...
 01632   420   NtDeviceIoControlFile  ... {status=0x0, info=256},  ... {status=0x0, info=256}, "\202\334:\200!7\321c\320OE\0WO\36\36\332\270\203e\1\225\253\327\360G\20\374d`\213F\335w\246rq\15\34\20\342E\333[\353\35\257]O\336\2\271\304\236W\36*\265:\2001\313=\21\271b\217+\35\22Z\33~\223[\375K4\12+\10hv\321\332\6\272E\333\365|\3\3056\232\345\21\211\270Q.R\310\250\222R\373b?\272\301\20\0\3353.\221\313J7\215":\6t\375\32\324&K\224_\244F\22\361T\177s\265\22\336\326\32\252\2648\15\271.\237u\315\15\223\307\344\320O\1779\310\240X\2\312j\241\37\220\333ToskOHy,B\347yE\247\363\23\346\2201\333\15e\346\15\267^\13\230C"\261P\306\177\33#\6\24\235\316fa\264\224\246\355\257F\311\325\234\366x\23\314f\246e\270qGKV", ) :\6t\375\32\324&K\224_\244F\22\361T\177s\265\22\336\326\32\252\2648\15\271.\237u\315\15\223\307\344\320O\1779\310\240X\2\312j\241\37\220\333ToskOHy,B\347yE\247\363\23\346\2201\333\15e\346\15\267^\13\230C ... {status=0x0, info=256}, "\202\334:\200!7\321c\320OE\0WO\36\36\332\270\203e\1\225\253\327\360G\20\374d`\213F\335w\246rq\15\34\20\342E\333[\353\35\257]O\336\2\271\304\236W\36*\265:\2001\313=\21\271b\217+\35\22Z\33~\223[\375K4\12+\10hv\321\332\6\272E\333\365|\3\3056\232\345\21\211\270Q.R\310\250\222R\373b?\272\301\20\0\3353.\221\313J7\215":\6t\375\32\324&K\224_\244F\22\361T\177s\265\22\336\326\32\252\2648\15\271.\237u\315\15\223\307\344\320O\1779\310\240X\2\312j\241\37\220\333ToskOHy,B\347yE\247\363\23\346\2201\333\15e\346\15\267^\13\230C"\261P\306\177\33#\6\24\235\316fa\264\224\246\355\257F\311\325\234\366x\23\314f\246e\270qGKV", ) , ) == 0x0
 01669  1376   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 01670   420   NtDeviceIoControlFile  (340, 0, 0x0, 0x0, 0x390008,  (340, 0, 0x0, 0x0, 0x390008, "\35>e\356\15K\373\35-\2119\26\316XU\232t\272\353\235:\217ft\272\353\235:\217ft\272\353\235:\217ft\272\353\235:\217ft\272\353\235:\217ft\272\353\235:\245s\17\221r8I/f\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0", 256, 256, ... , 256, 256, ...
 01669  1376   NtDuplicateObject  ... 448, ) == 0x0
 01671   420   NtQuerySystemInformation  (TimeOfDay, 48, ...
 01672  1376   NtWaitForSingleObject  (64, 0, {0, 0}, ...
 01671   420   NtQuerySystemInformation  ... {system info, class 3, size 48}, 48, ) == 0x0
 01672  1376   NtWaitForSingleObject  ... ) == 0x102
 01673   420   NtQuerySystemInformation  (ProcessorTimes, 48, ...
 01674  1376   NtWaitForSingleObject  (120, 0, 0x0, ...
 01668   896   NtCreateThread  ... 452, {1252, 1436}, ) == 0x0
 01673   420   NtQuerySystemInformation  ... {system info, class 8, size 48}, 48, ) == 0x0
 01675   896   NtQueryInformationThread  (452, Basic, 28, ...
 01676   420   NtQuerySystemInformation  (Performance, 312, ...
 01675   896   NtQueryInformationThread  ... {ExitStatus=0x103,TebBaseAddress=0x7ff92000,Pid=1252,Tid=1436,}, 0x0, ) == 0x0
 01676   420   NtQuerySystemInformation  ... {system info, class 2, size 312}, 312, ) == 0x0
 01677   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81879, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81879, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\304\1\0\0\344\4\0\0\234\5\0\0" ...  ...
 01678   420   NtQuerySystemInformation  (Exception, 16, ...
 01677   896   NtRequestWaitReplyPort  ... {28, 56, reply, 0, 1252, 896, 81880, 0}  ... {28, 56, reply, 0, 1252, 896, 81880, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\304\1\0\0\344\4\0\0\234\5\0\0" )  ) == 0x0
 01678   420   NtQuerySystemInformation  ... {system info, class 33, size 16}, 16, ) == 0x0
 01679   420   NtQuerySystemInformation  (Lookaside, 32, ... {system info, class 45, size 32}, 32, ) == 0x0
 01680   420   NtQuerySystemInformation  (ProcessorStatistics, 3016, ... {system info, class 23, size 0}, 0, ) == 0x0
 01681   420   NtQuerySystemInformation  (ProcessesAndThreads, 3008, ... ) == STATUS_INFO_LENGTH_MISMATCH
 01682   420   NtCreateKey  (0x2, {24, 0, 0x240, 0, 0,  (0x2, {24, 0, 0x240, 0, 0, "\Registry\Machine\SOFTWARE\Microsoft\Cryptography\RNG"}, 0, 0x0, 0, ... }, 0, 0x0, 0, ...
 01683   896   NtResumeThread  (452, ... 1, ) == 0x0
 01684   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ... 52166656, 1048576, ) == 0x0
 01685   896   NtAllocateVirtualMemory  (-1, 53207040, 0, 8192, 4096, 4, ... 53207040, 8192, ) == 0x0
 01686   896   NtProtectVirtualMemory  (-1, (0x32be000), 4096, 260, ... (0x32be000), 4096, 4, ) == 0x0
 01687   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ... 456, {1252, 1368}, ) == 0x0
 01688   896   NtQueryInformationThread  (456, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ff91000,Pid=1252,Tid=1368,}, 0x0, ) == 0x0
 01682   420   NtCreateKey  ... -2147481484, 2, ) == 0x0
 01689  1436   NtTestAlert  (...
 01690   420   NtSetValueKey  (-2147481484,  (-2147481484, "Seed", 0, 3, "\375/\227?OZ\377\2128\350i\3220^\352\35\342\204c\213\361\220\362\4@\364\304\364\244k4\376\364\245\344\10h\305\265\340\340\301\207\216\341\371\211\230\272\27\14\246\4\260\351v\331\277\245\252\\265\351z\273'?\216\22Q\221\205\230\377\362~\246\212pu", 80, ... , 0, 3,  (-2147481484, "Seed", 0, 3, "\375/\227?OZ\377\2128\350i\3220^\352\35\342\204c\213\361\220\362\4@\364\304\364\244k4\376\364\245\344\10h\305\265\340\340\301\207\216\341\371\211\230\272\27\14\246\4\260\351v\331\277\245\252\\265\351z\273'?\216\22Q\221\205\230\377\362~\246\212pu", 80, ... , 80, ...
 01689  1436   NtTestAlert  ... ) == 0x0
 01690   420   NtSetValueKey  ... ) == 0x0
 01691  1436   NtContinue  (52165936, 1, ...
 01692   420   NtClose  (-2147481484, ...
 01693  1436   NtRegisterThreadTerminatePort  (24, ...
 01692   420   NtClose  ... ) == 0x0
 01693  1436   NtRegisterThreadTerminatePort  ... ) == 0x0
 01670   420   NtDeviceIoControlFile  ... {status=0x0, info=256},  ... {status=0x0, info=256}, "G\351#\201\336\5r\361\326\227i/\11\321<\256\272\275(\321\342\320\12#/\262'\201\375\317qhd#\236q$VH/\374\301\3516\220d\254q}\275\351!\14\321p\33\257;^\256."J\243iT)\210q\327\217\262a\320\2239\245\255\360\245\27x\276\215\206\251\7?}|\3\320@\227\21\26\250G[rd\10k\375\33\226\322D\202\274\371\236\277\314K\203\177\203\245\375\230\13CwW.\214\26u\323D\360\21f\340?\14r\203\251\27a\232\242\26,\312\223Qs,\311\0]\274 _+m\226\220\22>P\224\201\267\357K\247\272Yfa1\34\315\357u\366S2\37\26\5\372K\252\22\17\345\354\346K\254\225]\21\205\320L\5\16\30\30"\230\343\11W\373"N~\357%M\217\365\277\2\354\324\261\312X\342/\30\267\10\352\355t\252\340\275\35\365\307\212\312\4\322\332\351 C\1\11NPd\232\264", ) J\243iT)\210q\327\217\262a\320\2239\245\255\360\245\27x\276\215\206\251\7?}|\3\320@\227\21\26\250G[rd\10k\375\33\226\322D\202\274\371\236\277\314K\203\177\203\245\375\230\13CwW.\214\26u\323D\360\21f\340?\14r\203\251\27a\232\242\26,\312\223Qs,\311\0]\274 _+m\226\220\22>P\224\201\267\357K\247\272Yfa1\34\315\357u\366S2\37\26\5\372K\252\22\17\345\354\346K\254\225]\21\205\320L\5\16\30\30 ... {status=0x0, info=256}, "G\351#\201\336\5r\361\326\227i/\11\321<\256\272\275(\321\342\320\12#/\262'\201\375\317qhd#\236q$VH/\374\301\3516\220d\254q}\275\351!\14\321p\33\257;^\256."J\243iT)\210q\327\217\262a\320\2239\245\255\360\245\27x\276\215\206\251\7?}|\3\320@\227\21\26\250G[rd\10k\375\33\226\322D\202\274\371\236\277\314K\203\177\203\245\375\230\13CwW.\214\26u\323D\360\21f\340?\14r\203\251\27a\232\242\26,\312\223Qs,\311\0]\274 _+m\226\220\22>P\224\201\267\357K\247\272Yfa1\34\315\357u\366S2\37\26\5\372K\252\22\17\345\354\346K\254\225]\21\205\320L\5\16\30\30"\230\343\11W\373"N~\357%M\217\365\277\2\354\324\261\312X\342/\30\267\10\352\355t\252\340\275\35\365\307\212\312\4\322\332\351 C\1\11NPd\232\264", ) N~\357%M\217\365\277\2\354\324\261\312X\342/\30\267\10\352\355t\252\340\275\35\365\307\212\312\4\322\332\351 C\1\11NPd\232\264", ) == 0x0
 01694   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81880, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81880, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\310\1\0\0\344\4\0\0X\5\0\0" ...  ...
 01695  1436   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 01694   896   NtRequestWaitReplyPort  ... {28, 56, reply, 0, 1252, 896, 81881, 0}  ... {28, 56, reply, 0, 1252, 896, 81881, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\310\1\0\0\344\4\0\0X\5\0\0" )  ) == 0x0
 01695  1436   NtDuplicateObject  ... 460, ) == 0x0
 01696   896   NtResumeThread  (456, ...
 01697  1436   NtWaitForSingleObject  (64, 0, {0, 0}, ...
 01696   896   NtResumeThread  ... 1, ) == 0x0
 01697  1436   NtWaitForSingleObject  ... ) == 0x102
 01698   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ...
 01699  1436   NtWaitForSingleObject  (120, 0, 0x0, ...
 01700   420   NtCreateEvent  (0x1f0003, 0x0, 1, 0, ...
 01701  1368   NtTestAlert  (...
 01698   896   NtAllocateVirtualMemory  ... 53215232, 1048576, ) == 0x0
 01700   420   NtCreateEvent  ... 464, ) == 0x0
 01701  1368   NtTestAlert  ... ) == 0x0
 01702   896   NtAllocateVirtualMemory  (-1, 54255616, 0, 8192, 4096, 4, ...
 01703   420   NtSetEventBoostPriority  (380, ...
 01704  1368   NtContinue  (53214512, 1, ...
 01702   896   NtAllocateVirtualMemory  ... 54255616, 8192, ) == 0x0
 01496  2016   NtWaitForSingleObject  ... ) == 0x0
 01703   420   NtSetEventBoostPriority  ... ) == 0x0
 01705  1368   NtRegisterThreadTerminatePort  (24, ...
 01706  2016   NtAllocateVirtualMemory  (-1, 1388544, 0, 4096, 4096, 4, ...
 01707   896   NtProtectVirtualMemory  (-1, (0x33be000), 4096, 260, ...
 01708   420   NtWaitForSingleObject  (296, 0, 0x0, ...
 01706  2016   NtAllocateVirtualMemory  ... 1388544, 4096, ) == 0x0
 01705  1368   NtRegisterThreadTerminatePort  ... ) == 0x0
 01707   896   NtProtectVirtualMemory  ... (0x33be000), 4096, 4, ) == 0x0
 01709  2016   NtSetEventBoostPriority  (296, ...
 01710   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ...
 01711  1368   NtWaitForSingleObject  (296, 0, 0x0, ...
 01708   420   NtWaitForSingleObject  ... ) == 0x0
 01709  2016   NtSetEventBoostPriority  ... ) == 0x0
 01712   420   NtSetEventBoostPriority  (296, ...
 01713  2016   NtWaitForSingleObject  (296, 0, 0x0, ...
 01711  1368   NtWaitForSingleObject  ... ) == 0x0
 01712   420   NtSetEventBoostPriority  ... ) == 0x0
 01714  1368   NtSetEventBoostPriority  (296, ...
 01710   896   NtCreateThread  ... 468, {1252, 724}, ) == 0x0
 01713  2016   NtWaitForSingleObject  ... ) == 0x0
 01714  1368   NtSetEventBoostPriority  ... ) == 0x0
 01715  2016   NtCreateEvent  (0x1f0003, 0x0, 1, 0, ...
 01716   896   NtQueryInformationThread  (468, Basic, 28, ...
 01715  2016   NtCreateEvent  ... 472, ) == 0x0
 01717  1368   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 01716   896   NtQueryInformationThread  ... {ExitStatus=0x103,TebBaseAddress=0x7ff90000,Pid=1252,Tid=724,}, 0x0, ) == 0x0
 01718   420   NtConnectPort  ( ("\RPC Control\DNSResolver", {12, 2, 1, 0}, 0x0, 0x0, 14413164, 188, ... , {12, 2, 1, 0}, 0x0, 0x0, 14413164, 188, ...
 01719  2016   NtConnectPort  ( ("\RPC Control\epmapper", {12, 2, 1, 1}, 0x0, 0x0, 11006584, 188, ... , {12, 2, 1, 1}, 0x0, 0x0, 11006584, 188, ...
 01720   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81881, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81881, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\324\1\0\0\344\4\0\0\324\2\0\0" ... {28, 56, reply, 0, 1252, 896, 81884, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\324\1\0\0\344\4\0\0\324\2\0\0" )  ... {28, 56, reply, 0, 1252, 896, 81884, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81881, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\324\1\0\0\344\4\0\0\324\2\0\0" ... {28, 56, reply, 0, 1252, 896, 81884, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\324\1\0\0\344\4\0\0\324\2\0\0" )  ) == 0x0
 01718   420   NtConnectPort  ... 476, 0x0, 0x0, 0x0, 188, ) == 0x0
 01719  2016   NtConnectPort  ... 480, 0x0, 0x0, 0x0, 188, ) == 0x0
 01717  1368   NtDuplicateObject  ... 484, ) == 0x0
 01721   420   NtRequestWaitReplyPort  (476, {200, 224, new_msg, 0, 1378832, 12, 2, 1310721}  (476, {200, 224, new_msg, 0, 1378832, 12, 2, 1310721} "\0\0\0\0\274\0\0\0x\1\24\0\1kwEVY\205D\237\200\364(\367\326\1)\2\0\0\0\1\0\0\0\230`\347w\4\0\0\0x\1\24\0\10\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\377\377\2\0\0\0l\306\372.\310\275\341z\2503\25\0h\1\24\0\12\0\0\0\0\0\0\0\0\0\0\0(\0\0\0\10(\25\0\331\200A\203x\1\24\0\2403\25\0h\1\24\0\0\0\0\0\0\0\0\0\2403\25\0P\0\0\0\2503\25\0\360\6\221|x\1\24\0P\0\0\0\346\31\0\0\0\0\24\0\354\353\333\0\372\31\221|\200\363\333\0\30\356\220|\360\6\221|\0\0\0\0\0\0\0\0\0\0\0\0\6\0\0\0" ...  ...
 01722  2016   NtRequestWaitReplyPort  (480, {200, 224, new_msg, 0, 2883626, 1355840, 12, 2}  (480, {200, 224, new_msg, 0, 2883626, 1355840, 12, 2} "\0\1\0\0X\2\24\0\274\0\0\0\10\203\257\341\37]\311\21\221\244\10\0+\24\240\372\3\0\0\0\1\0\0\0\1\0\4\0\4\0\0\0\240<\24\0\3\0\0\0\10\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\377\377\3\0\0\0f\240\231\350_i\265l ?\25\0\\1\24\0\12\0\0\0\0\0\0\0\0\0\200\0(\0\0\0(?\25\0\347\34G}X\2\24\0H?\25\0\\1\24\0\0\0\0\0\0\0\0\0H?\25\0P\0\0\0P?\25\0\360\6\221|0\2\24\0P\0\0\0\346\31\0\0\0\0\24\0\370\360\247\0\372\31\221|\214\370\247\0\30\356\220|\0\0\0\0\0\0\0\0\0\0\0\0\351\201\347w" ...  ...
 01723  1368   NtAllocateVirtualMemory  (-1, 1392640, 0, 4096, 4096, 4, ... 1392640, 4096, ) == 0x0
 01724  1368   NtWaitForSingleObject  (64, 0, {0, 0}, ... ) == 0x102
 01721   420   NtRequestWaitReplyPort  ... {200, 224, reply, 0, 1252, 420, 81885, 0}  ... {200, 224, reply, 0, 1252, 420, 81885, 0} "\7\0\0\0\274\0\0\0x\1\24\0\1kwEVY\205D\237\200\364(\367\326\1)\2\0\0\0\1\0\0\0\0\0\0\0\4\0\0\0x\1\24\0\377\377\377\377\5\0\0\0\0\0\0\0\0\0\0\0\0\0\377\377\2\0\0\0l\306\372.\310\275\341z\2503\25\0h\1\24\0\12\0\0\0\0\0\0\0\0\0\0\0(\0\0\0\10(\25\0\331\200A\203x\1\24\0\2403\25\0h\1\24\0\0\0\0\0\0\0\0\0\2403\25\0P\0\0\0\2503\25\0\360\6\221|x\1\24\0P\0\0\0\346\31\0\0\0\0\24\0\354\353\333\0\372\31\221|\200\363\333\0\30\356\220|\360\6\221|\0\0\0\0\0\0\0\0\0\0\0\0\6\0\0\0" )  ) == 0x0
 01722  2016   NtRequestWaitReplyPort  ... {200, 224, reply, 0, 1252, 2016, 81886, 0}  ... {200, 224, reply, 0, 1252, 2016, 81886, 0} "\7\1\0\0X\2\24\0\274\0\0\0\10\203\257\341\37]\311\21\221\244\10\0+\24\240\372\3\0\0\0\1\0\0\0\0\0\0\0\4\0\0\0\240<\24\0\377\377\377\377\10\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\377\377\3\0\0\0f\240\231\350_i\265l ?\25\0\\1\24\0\12\0\0\0\0\0\0\0\0\0\200\0(\0\0\0(?\25\0\347\34G}X\2\24\0H?\25\0\\1\24\0\0\0\0\0\0\0\0\0H?\25\0P\0\0\0P?\25\0\360\6\221|0\2\24\0P\0\0\0\346\31\0\0\0\0\24\0\370\360\247\0\372\31\221|\214\370\247\0\30\356\220|\0\0\0\0\0\0\0\0\0\0\0\0\351\201\347w" )  ) == 0x0
 01725   896   NtResumeThread  (468, ...
 01726  1368   NtWaitForSingleObject  (120, 0, 0x0, ...
 01727   420   NtRequestWaitReplyPort  (476, {44, 68, new_msg, 0, 1252, 420, 81864, 0}  (476, {44, 68, new_msg, 0, 1252, 420, 81864, 0} "\1\356\0\0A\2\4\0\30b\202\201\0\300\375\177\220\273\270\367\370\37`\300\377\377\377\377X\353Q\200\0\0\0\0\0\0\0\0\1\0\0\0" ...  ...
 01725   896   NtResumeThread  ... 1, ) == 0x0
 01728   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ... 54263808, 1048576, ) == 0x0
 01729   896   NtAllocateVirtualMemory  (-1, 55304192, 0, 8192, 4096, 4, ... 55304192, 8192, ) == 0x0
 01727   420   NtRequestWaitReplyPort  ... {40, 64, reply, 0, 1252, 420, 81887, 0}  ... {40, 64, reply, 0, 1252, 420, 81887, 0} "\2\0\0\0\4\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\320\1\0\0X-\12\0" )  ) == 0x0
 01730  2016   NtRequestWaitReplyPort  (480, {44, 68, new_msg, 56, 0, 0, 0, 0}  (480, {44, 68, new_msg, 56, 0, 0, 0, 0} "\1\0\0\0B\2\3\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\377\377\377\377\0\0\0\0\1\0\0\0\0D\25\0\322\0\0\0" ...  ...
 01731   724   NtTestAlert  (...
 01732   420   NtRequestWaitReplyPort  (476, {64, 88, new_msg, 56, 1370920, 14413676, 14413776, 0}  (476, {64, 88, new_msg, 56, 1370920, 14413676, 14413776, 0} "\10\357\333\0@\0\24\0\346\277\347w\320\357\333\0l\357\333\0\20\0\0\0\250.\362v\234\353\24\0\1\0\0\0\370D\25\0\320\1\0\0\320\1\0\0X-\12\0\0\0\0\0\0\0\0\0`\311\24\0" ...  ...
 01731   724   NtTestAlert  ... ) == 0x0
 01730  2016   NtRequestWaitReplyPort  ... {40, 64, reply, 0, 1252, 2016, 81888, 0}  ... {40, 64, reply, 0, 1252, 2016, 81888, 0} "\2\356Q\200\4\0\0\0P\306\233\201\0\340\372\177\220\353\10\370\370\37`\300l\353\10\370X\353Q\200\323\1\0\0\350\370\14\0" )  ) == 0x0
 01733   724   NtContinue  (54263088, 1, ...
 01734  2016   NtRequestWaitReplyPort  (480, {64, 88, new_msg, 56, 1310720, 11006452, 1393656, 0}  (480, {64, 88, new_msg, 56, 1310720, 11006452, 1393656, 0} "\10\356\220|@\0\1\0\34\0\0\0p\363\247\0\351\201\347w\214\370\247\0\30\356\220|p\5\221|\1\0\0\0\320F\25\0\323\1\0\0\323\1\0\0\350\370\14\0\0\0\0\0\0\0\0\0\273f\347w" ...  ...
 01735   724   NtRegisterThreadTerminatePort  (24, ... ) == 0x0
 01734  2016   NtRequestWaitReplyPort  ... {64, 88, reply, 56, 1252, 2016, 81890, 0}  ... {64, 88, reply, 56, 1252, 2016, 81890, 0} "\10\356\220|@\0\1\0\34\0\0\0p\363\247\0\351\201\347w\214\370\247\0\30\356\220|p\5\221|\1\0\0\0\320F\25\0\323\1\0\0\323\1\0\0\350\370\14\0\0\0\0\0\0\0\0\0\273f\347w" )  ) == 0x0
 01736   896   NtProtectVirtualMemory  (-1, (0x34be000), 4096, 260, ...
 01732   420   NtRequestWaitReplyPort  ... {64, 88, reply, 56, 1252, 420, 81889, 0}  ... {64, 88, reply, 56, 1252, 420, 81889, 0} "\10\357\333\0@\0\24\0\346\277\347w\320\357\333\0l\357\333\0\20\0\0\0\250.\362v\234\353\24\0\1\0\0\0\370D\25\0\320\1\0\0\320\1\0\0X-\12\0\0\0\0\0\0\0\0\0`\311\24\0" )  ) == 0x0
 01737   724   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 01736   896   NtProtectVirtualMemory  ... (0x34be000), 4096, 4, ) == 0x0
 01738  2016   NtRequestWaitReplyPort  (480, {44, 68, new_msg, 56, 1252, 2016, 81888, 0}  (480, {44, 68, new_msg, 56, 1252, 2016, 81888, 0} "\1\356\0\0B\2\3\0P\306\233\201\0\340\372\177\220\353\10\370\370\37`\300\377\377\377\377X\353Q\200\1\0\0\0\0D\25\0\322\0\0\0" ...  ...
 01737   724   NtDuplicateObject  ... 488, ) == 0x0
 01739   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ...
 01740   724   NtWaitForSingleObject  (64, 0, {0, 0}, ...
 01739   896   NtCreateThread  ... 492, {1252, 1276}, ) == 0x0
 01740   724   NtWaitForSingleObject  ... ) == 0x102
 01741   896   NtQueryInformationThread  (492, Basic, 28, ...
 01742   724   NtWaitForSingleObject  (120, 0, 0x0, ...
 01741   896   NtQueryInformationThread  ... {ExitStatus=0x103,TebBaseAddress=0x7ff8f000,Pid=1252,Tid=1276,}, 0x0, ) == 0x0
 01743   420   NtClose  (464, ...
 01738  2016   NtRequestWaitReplyPort  ... {40, 64, reply, 0, 1252, 2016, 81891, 0}  ... {40, 64, reply, 0, 1252, 2016, 81891, 0} "\2\246\200|\4\0\0\0\0\0\0\0\4\377}\0(\345\12\0\0\0\0\0\230\376}\0\2\0\0\0\351\1\0\0\350\232\14\0" )  ) == 0x0
 01743   420   NtClose  ... ) == 0x0
 01744  2016   NtAllocateVirtualMemory  (-1, 1396736, 0, 4096, 4096, 4, ...
 01745   420   NtClose  (476, ...
 01744  2016   NtAllocateVirtualMemory  ... 1396736, 4096, ) == 0x0
 01745   420   NtClose  ... ) == 0x0
 01746  2016   NtRequestWaitReplyPort  (480, {64, 88, new_msg, 56, 1310720, 11006452, 11007196, 0}  (480, {64, 88, new_msg, 56, 1310720, 11006452, 11007196, 0} "\10\356\220|@\0\1\0\34\0\0\0p\363\247\0\351\201\347w\214\370\247\0\30\356\220|p\5\221|\1\0\0\0\300N\25\0\351\1\0\0\351\1\0\0\350\232\14\0\0\0\0\0\0\0\0\0\273f\347w" ...  ...
 01747   420   NtCreateKey  (0x20019, {24, 28, 0x40, 0, 0,  (0x20019, {24, 28, 0x40, 0, 0, "System\CurrentControlSet\Services\Tcpip\Parameters"}, 0, "Class", 0, ... }, 0,  (0x20019, {24, 28, 0x40, 0, 0, "System\CurrentControlSet\Services\Tcpip\Parameters"}, 0, "Class", 0, ... , 0, ...
 01748   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81884, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81884, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\354\1\0\0\344\4\0\0\374\4\0\0" ...  ...
 01747   420   NtCreateKey  ... 476, 2, ) == 0x0
 01748   896   NtRequestWaitReplyPort  ... {28, 56, reply, 0, 1252, 896, 81893, 0}  ... {28, 56, reply, 0, 1252, 896, 81893, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\354\1\0\0\344\4\0\0\374\4\0\0" )  ) == 0x0
 01746  2016   NtRequestWaitReplyPort  ... {64, 88, reply, 56, 1252, 2016, 81894, 0}  ... {64, 88, reply, 56, 1252, 2016, 81894, 0} "\10\356\220|@\0\1\0\34\0\0\0p\363\247\0\351\201\347w\214\370\247\0\30\356\220|p\5\221|\1\0\0\0\300N\25\0\351\1\0\0\351\1\0\0\350\232\14\0\0\0\0\0\0\0\0\0\273f\347w" )  ) == 0x0
 01749   896   NtResumeThread  (492, ...
 01750  2016   NtRequestWaitReplyPort  (480, {44, 68, new_msg, 56, 1252, 2016, 81891, 0}  (480, {44, 68, new_msg, 56, 1252, 2016, 81891, 0} "\1\246\0\0B\2\3\0\0\0\0\0\4\377}\0(\345\12\0\0\0\0\0\377\377\377\377\2\0\0\0\1\0\0\0\0D\25\0\322\0\0\0" ...  ...
 01749   896   NtResumeThread  ... 1, ) == 0x0
 01751   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ...
 01750  2016   NtRequestWaitReplyPort  ... {40, 64, reply, 0, 1252, 2016, 81895, 0}  ... {40, 64, reply, 0, 1252, 2016, 81895, 0} "\2\356Q\200\4\0\0\0\250\372\244\201\0\360\372\177\220\253S\371\370\37`\300l\253S\371X\353Q\200|\1\0\0h\236\14\0" )  ) == 0x0
 01752   420   NtOpenKey  (0x20019, {24, 28, 0x40, 0, 0,  (0x20019, {24, 28, 0x40, 0, 0, "System\CurrentControlSet\Services\DnsCache\Parameters"}, ... }, ...
 01753  1276   NtTestAlert  (...
 01754  2016   NtRequestWaitReplyPort  (480, {64, 88, new_msg, 56, 1310720, 11006452, 11007196, 0}  (480, {64, 88, new_msg, 56, 1310720, 11006452, 11007196, 0} "\10\356\220|@\0\1\0\34\0\0\0p\363\247\0\351\201\347w\214\370\247\0\30\356\220|p\5\221|\1\0\0\0xY\25\0|\1\0\0|\1\0\0h\236\14\0\0\0\0\0\0\0\0\0\273f\347w" ...  ...
 01752   420   NtOpenKey  ... 464, ) == 0x0
 01753  1276   NtTestAlert  ... ) == 0x0
 01751   896   NtAllocateVirtualMemory  ... 55312384, 1048576, ) == 0x0
 01755   420   NtOpenKey  (0x20019, {24, 28, 0x40, 0, 0,  (0x20019, {24, 28, 0x40, 0, 0, "Software\Policies\Microsoft\Windows NT\DnsClient"}, ... }, ...
 01756  1276   NtContinue  (55311664, 1, ...
 01757   896   NtAllocateVirtualMemory  (-1, 56352768, 0, 8192, 4096, 4, ...
 01755   420   NtOpenKey  ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01758  1276   NtRegisterThreadTerminatePort  (24, ...
 01757   896   NtAllocateVirtualMemory  ... 56352768, 8192, ) == 0x0
 01759   420   NtOpenKey  (0x1, {24, 28, 0x40, 0, 0,  (0x1, {24, 28, 0x40, 0, 0, "Software\Policies\Microsoft\System\DNSClient"}, ... }, ...
 01758  1276   NtRegisterThreadTerminatePort  ... ) == 0x0
 01760   896   NtProtectVirtualMemory  (-1, (0x35be000), 4096, 260, ...
 01759   420   NtOpenKey  ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01754  2016   NtRequestWaitReplyPort  ... {64, 88, reply, 56, 1252, 2016, 81896, 0}  ... {64, 88, reply, 56, 1252, 2016, 81896, 0} "\10\356\220|@\0\1\0\34\0\0\0p\363\247\0\351\201\347w\214\370\247\0\30\356\220|p\5\221|\1\0\0\0xY\25\0|\1\0\0|\1\0\0h\236\14\0\0\0\0\0\0\0\0\0\273f\347w" )  ) == 0x0
 01760   896   NtProtectVirtualMemory  ... (0x35be000), 4096, 4, ) == 0x0
 01761  1276   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 01762  2016   NtClose  (472, ...
 01763   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ...
 01761  1276   NtDuplicateObject  ... 496, ) == 0x0
 01762  2016   NtClose  ... ) == 0x0
 01764   420   NtQueryValueKey  (476,  (476, "Domain", Partial, 144, ... , Partial, 144, ...
 01765  1276   NtWaitForSingleObject  (64, 0, {0, 0}, ...
 01766  2016   NtClose  (480, ...
 01764   420   NtQueryValueKey  ... TitleIdx=0, Type=1, Data= ... TitleIdx=0, Type=1, Data="\0\0"}, 14, ) }, 14, ) == 0x0
 01765  1276   NtWaitForSingleObject  ... ) == 0x102
 01766  2016   NtClose  ... ) == 0x0
 01767   420   NtQueryValueKey  (476,  (476, "Domain", Partial, 144, ... , Partial, 144, ...
 01768  1276   NtWaitForSingleObject  (120, 0, 0x0, ...
 01763   896   NtCreateThread  ... 480, {1252, 220}, ) == 0x0
 01767   420   NtQueryValueKey  ... TitleIdx=0, Type=1, Data= ... TitleIdx=0, Type=1, Data="\0\0"}, 14, ) }, 14, ) == 0x0
 01769  2016   NtCreateEvent  (0x1f0003, 0x0, 1, 0, ...
 01770   896   NtQueryInformationThread  (480, Basic, 28, ...
 01771   420   NtClose  (476, ...
 01769  2016   NtCreateEvent  ... 472, ) == 0x0
 01770   896   NtQueryInformationThread  ... {ExitStatus=0x103,TebBaseAddress=0x7ff8e000,Pid=1252,Tid=220,}, 0x0, ) == 0x0
 01771   420   NtClose  ... ) == 0x0
 01772  2016   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\System\CurrentControlSet\Control\ComputerName"}, ... }, ...
 01773   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81893, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81893, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\340\1\0\0\344\4\0\0\334\0\0\0" ...  ...
 01772  2016   NtOpenKey  ... 476, ) == 0x0
 01773   896   NtRequestWaitReplyPort  ... {28, 56, reply, 0, 1252, 896, 81898, 0}  ... {28, 56, reply, 0, 1252, 896, 81898, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\340\1\0\0\344\4\0\0\334\0\0\0" )  ) == 0x0
 01774  2016   NtOpenKey  (0x20019, {24, 476, 0x40, 0, 0,  (0x20019, {24, 476, 0x40, 0, 0, "ActiveComputerName"}, ... }, ...
 01775   420   NtClose  (464, ...
 01774  2016   NtOpenKey  ... 500, ) == 0x0
 01775   420   NtClose  ... ) == 0x0
 01776   896   NtResumeThread  (480, ...
 01777   420   NtOpenKey  (0x1, {24, 28, 0x40, 0, 0,  (0x1, {24, 28, 0x40, 0, 0, "System\CurrentControlSet\Services\Tcpip\Parameters"}, ... }, ...
 01776   896   NtResumeThread  ... 1, ) == 0x0
 01777   420   NtOpenKey  ... 464, ) == 0x0
 01778   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ...
 01779   420   NtQueryValueKey  (464,  (464, "DnsNbtLookupOrder", Partial, 144, ... , Partial, 144, ...
 01778   896   NtAllocateVirtualMemory  ... 56360960, 1048576, ) == 0x0
 01779   420   NtQueryValueKey  ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01780   896   NtAllocateVirtualMemory  (-1, 57401344, 0, 8192, 4096, 4, ...
 01781  2016   NtQueryValueKey  (500,  (500, "ComputerName", Full, 108, ... , Full, 108, ...
 01782   220   NtTestAlert  (...
 01780   896   NtAllocateVirtualMemory  ... 57401344, 8192, ) == 0x0
 01781  2016   NtQueryValueKey  ... TitleIdx=0, Type=1, Name= ... TitleIdx=0, Type=1, Name="ComputerName", Data="V\0I\0R\0T\0U\0A\0L\0\0\0"}, 60, ) , Data= ... TitleIdx=0, Type=1, Name="ComputerName", Data="V\0I\0R\0T\0U\0A\0L\0\0\0"}, 60, ) }, 60, ) == 0x0
 01782   220   NtTestAlert  ... ) == 0x0
 01783   420   NtClose  (464, ...
 01784  2016   NtClose  (500, ...
 01785   220   NtContinue  (56360240, 1, ...
 01783   420   NtClose  ... ) == 0x0
 01784  2016   NtClose  ... ) == 0x0
 01786   220   NtRegisterThreadTerminatePort  (24, ...
 01787   420   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\System32\winrnr.dll"}, 14412752, ... }, 14412752, ...
 01788  2016   NtClose  (476, ...
 01786   220   NtRegisterThreadTerminatePort  ... ) == 0x0
 01787   420   NtQueryAttributesFile  ... ) == 0x0
 01788  2016   NtClose  ... ) == 0x0
 01789   896   NtProtectVirtualMemory  (-1, (0x36be000), 4096, 260, ...
 01790   420   NtOpenFile  (0x100020, {24, 0, 0x40, 0, 0,  (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\System32\winrnr.dll"}, 5, 96, ... }, 5, 96, ...
 01791   220   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 01789   896   NtProtectVirtualMemory  ... (0x36be000), 4096, 4, ) == 0x0
 01790   420   NtOpenFile  ... 476, {status=0x0, info=1}, ) == 0x0
 01791   220   NtDuplicateObject  ... 500, ) == 0x0
 01792   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ...
 01793  2016   NtCreateIoCompletion  (0x1f0003, 0x0, 0, ...
 01794   220   NtWaitForSingleObject  (64, 0, {0, 0}, ...
 01792   896   NtCreateThread  ... 464, {1252, 1328}, ) == 0x0
 01793  2016   NtCreateIoCompletion  ... 504, ) == 0x0
 01794   220   NtWaitForSingleObject  ... ) == 0x102
 01795   896   NtQueryInformationThread  (464, Basic, 28, ...
 01796  2016   NtCreateIoCompletion  (0x1f0003, 0x0, -1, ...
 01797   220   NtWaitForSingleObject  (120, 0, 0x0, ...
 01795   896   NtQueryInformationThread  ... {ExitStatus=0x103,TebBaseAddress=0x7ff8d000,Pid=1252,Tid=1328,}, 0x0, ) == 0x0
 01796  2016   NtCreateIoCompletion  ... 508, ) == 0x0
 01798   420   NtCreateSection  (0xe, 0x0, 0x0, 16, 134217728, 476, ...
 01799  2016   NtDuplicateObject  (-1, 504, -1, 0x0, 0, 2, ...
 01798   420   NtCreateSection  ... 512, ) == 0x0
 01799  2016   NtDuplicateObject  ... 516, ) == 0x0
 01800   420   NtClose  (476, ...
 01801   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81898, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81898, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\320\1\0\0\344\4\0\00\5\0\0" ...  ...
 01800   420   NtClose  ... ) == 0x0
 01801   896   NtRequestWaitReplyPort  ... {28, 56, reply, 0, 1252, 896, 81899, 0}  ... {28, 56, reply, 0, 1252, 896, 81899, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\320\1\0\0\344\4\0\00\5\0\0" )  ) == 0x0
 01802   420   NtMapViewOfSection  (512, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 16, ...
 01803   896   NtResumeThread  (464, ...
 01802   420   NtMapViewOfSection  ... (0x850000), 0x0, 20480, ) == 0x0
 01803   896   NtResumeThread  ... 1, ) == 0x0
 01804  2016   NtOpenThreadToken  (-2, 0xc, 1, ...
 01805   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ...
 01804  2016   NtOpenThreadToken  ... ) == STATUS_NO_TOKEN
 01806   420   NtClose  (512, ...
 01807  1328   NtWaitForSingleObject  (88, 0, 0x0, ...
 01808  2016   NtCreateEvent  (0x1f0003, 0x0, 1, 0, ...
 01806   420   NtClose  ... ) == 0x0
 01808  2016   NtCreateEvent  ... 512, ) == 0x0
 01809  2016   NtOpenThreadToken  (-2, 0xc, 1, ... ) == STATUS_NO_TOKEN
 01811   420   NtUnmapViewOfSection  (-1, 0x850000, ... ) == 0x0
 01812   420   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\System32\winrnr.dll"}, 14413060, ... ) }, 14413060, ... ) == 0x0
 01813   420   NtOpenFile  (0x100020, {24, 0, 0x40, 0, 0,  (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\System32\winrnr.dll"}, 5, 96, ... }, 5, 96, ...
 01810  2016   NtSetInformationThread  (-2, ImpersonationToken, {ImpToken=0,}, 4, ...
 01805   896   NtAllocateVirtualMemory  ... 57409536, 1048576, ) == 0x0
 01810  2016   NtSetInformationThread  ... ) == 0x0
 01814   896   NtAllocateVirtualMemory  (-1, 58449920, 0, 8192, 4096, 4, ...
 01815  2016   NtCreateFile  (0xc0100080, {24, 0, 0x40, 0, 11006144,  (0xc0100080, {24, 0, 0x40, 0, 11006144, "\??\PIPE\lsarpc"}, 0x0, 0, 3, 1, 64, 0, 0, ... }, 0x0, 0, 3, 1, 64, 0, 0, ...
 01814   896   NtAllocateVirtualMemory  ... 58449920, 8192, ) == 0x0
 01815  2016   NtCreateFile  ... 476, {status=0x0, info=1}, ) == 0x0
 01816   896   NtProtectVirtualMemory  (-1, (0x37be000), 4096, 260, ...
 01817  2016   NtSetInformationFile  (476, 11006200, 8, Pipe, ...
 01816   896   NtProtectVirtualMemory  ... (0x37be000), 4096, 4, ) == 0x0
 01817  2016   NtSetInformationFile  ... {status=0x0, info=0}, ) == 0x0
 01818   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ...
 01813   420   NtOpenFile  ... 520, {status=0x0, info=1}, ) == 0x0
 01819  2016   NtSetInformationFile  (476, 11006188, 8, Completion, ...
 01820   420   NtCreateSection  (0xf, 0x0, 0x0, 16, 16777216, 520, ...
 01819  2016   NtSetInformationFile  ... {status=0x0, info=0}, ) == 0x0
 01820   420   NtCreateSection  ... 524, ) == 0x0
 01821  2016   NtSetInformationThread  (-2, ImpersonationToken, {ImpToken=0,}, 4, ...
 01822   420   NtQuerySection  (524, Image, 48, ...
 01821  2016   NtSetInformationThread  ... ) == 0x0
 01822   420   NtQuerySection  ... {section info, class 1, size 48}, 0x0, ) == 0x0
 01823  2016   NtWriteFile  (476, 193, 0, 0,  (476, 193, 0, 0, "\5\0\13\3\20\0\0\0H\0\0\0\1\0\0\0\270\20\270\20\0\0\0\0\1\0\0\0\0\0\1\0xW4\224\22\315\253\357\0\1#Eg\211\253\0\0\0\0\4]\210\212\353\34\311\21\237\350\10\0+\20H`\2\0\0\0", 72, {0, 0}, 0, ... , 72, {0, 0}, 0, ...
 01824   420   NtClose  (520, ...
 01823  2016   NtWriteFile  ... {status=0x0, info=72}, ) == 0x0
 01818   896   NtCreateThread  ... 528, {1252, 1636}, ) == 0x0
 01824   420   NtClose  ... ) == 0x0
 01825   896   NtQueryInformationThread  (528, Basic, 28, ...
 01826   420   NtMapViewOfSection  (524, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ...
 01825   896   NtQueryInformationThread  ... {ExitStatus=0x103,TebBaseAddress=0x7ff8c000,Pid=1252,Tid=1636,}, 0x0, ) == 0x0
 01826   420   NtMapViewOfSection  ... (0x76fb0000), 0x0, 32768, ) == 0x0
 01827   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81899, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81899, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\20\2\0\0\344\4\0\0d\6\0\0" ...  ...
 01828   420   NtClose  (524, ...
 01827   896   NtRequestWaitReplyPort  ... {28, 56, reply, 0, 1252, 896, 81900, 0}  ... {28, 56, reply, 0, 1252, 896, 81900, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\20\2\0\0\344\4\0\0d\6\0\0" )  ) == 0x0
 01828   420   NtClose  ... ) == 0x0
 01829  2016   NtReadFile  (476, 193, 0, 0, 1024, {0, 0}, 0, ...
 01830   420   NtProtectVirtualMemory  (-1, (0x76fb1000), 232, 4, ...
 01829  2016   NtReadFile  ... {status=0x0, info=68},  ... {status=0x0, info=68}, "\5\0\14\3\20\0\0\0D\0\0\0\1\0\0\0\270\20\270\20k+\0\0\14\0\PIPE\lsass\0\0\0\1\0\0\0\0\0\0\0\4]\210\212\353\34\311\21\237\350\10\0+\20H`\2\0\0\0", ) , ) == 0x0
 01831   896   NtResumeThread  (528, ...
 01832  2016   NtFsControlFile  (476, 193, 0x0, 0x0, 0x11c017,  (476, 193, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0@\0\0\0\1\0\0\0(\0\0\0\0\0,\0\0\0\0\0\30\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\210\367\247\0\14\0\0\0\2\0\1\0\0\10\0\0", 64, 1024, ... , 64, 1024, ...
 01831   896   NtResumeThread  ... 1, ) == 0x0
 01830   420   NtProtectVirtualMemory  ... (0x76fb1000), 4096, 32, ) == 0x0
 01833   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ...
 01834   420   NtProtectVirtualMemory  (-1, (0x76fb1000), 4096, 32, ...
 01833   896   NtAllocateVirtualMemory  ... 58458112, 1048576, ) == 0x0
 01834   420   NtProtectVirtualMemory  ... (0x76fb1000), 4096, 4, ) == 0x0
 01835   896   NtAllocateVirtualMemory  (-1, 59498496, 0, 8192, 4096, 4, ...
 01836   420   NtFlushInstructionCache  (-1, 1996165120, 232, ...
 01835   896   NtAllocateVirtualMemory  ... 59498496, 8192, ) == 0x0
 01832  2016   NtFsControlFile  ... {status=0x103, info=68},  ... {status=0x103, info=68}, "\5\0\14\3\20\0\0\0D\0\0\0\1\0\0\0\270\20\270\20k+\0\0\14\0\PIPE\lsass\0\0\0\1\0\0\0\0\0\0\0\4]\210\212\353\34\311\21\237\350\10\0+\20H`\2\0\0\0", ) , ) == 0x103
 01837  1636   NtWaitForSingleObject  (88, 0, 0x0, ...
 01836   420   NtFlushInstructionCache  ... ) == 0x0
 01838  2016   NtFsControlFile  (476, 193, 0x0, 0x0, 0x11c017,  (476, 193, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0\210\0\0\0\2\0\0\0p\0\0\0\0\0D\0\0\0\0\0\201\262\254?gS\263F\252\227\2L\355h\28\1\0\0\0\1\0\0\0&\0(\0\0[\25\0\24\0\0\0\0\0\0\0\23\0\0\0n\0t\0 \0a\0u\0t\0h\0o\0r\0i\0t\0y\0\\0s\0y\0s\0t\0e\0m\0\0\0\0\0\0\0\0\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0", 136, 1024, ... , 136, 1024, ...
 01839   420   NtProtectVirtualMemory  (-1, (0x76fb1000), 232, 4, ...
 01838  2016   NtFsControlFile  ... {status=0x103, info=48},  ... {status=0x103, info=48}, "\5\0\2\3\20\0\0\00\0\0\0\1\0\0\0\30\0\0\0\0\0\0\0\0\0\0\0\201\262\254?gS\263F\252\227\2L\355h\28\0\0\0\0", ) , ) == 0x103
 01839   420   NtProtectVirtualMemory  ... (0x76fb1000), 4096, 32, ) == 0x0
 01840  2016   NtFsControlFile  (476, 193, 0x0, 0x0, 0x11c017,  (476, 193, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0,\0\0\0\3\0\0\0\24\0\0\0\0\0\0\0\0\0\0\0\201\262\254?gS\263F\252\227\2L\355h\28", 44, 1024, ... , 44, 1024, ...
 01841   420   NtProtectVirtualMemory  (-1, (0x76fb1000), 4096, 32, ...
 01840  2016   NtFsControlFile  ... {status=0x103, info=156},  ... {status=0x103, info=156}, "\5\0\2\3\20\0\0\0\234\0\0\0\2\0\0\0\204\0\0\0\0\0\0\0\200X\25\0\1\0\0\0\214X\25\0 \0\0\0\1\0\0\0\30\0\32\0\230X\25\0\264X\25\0\15\0\0\0\0\0\0\0\14\0\0\0N\0T\0 \0A\0U\0T\0H\0O\0R\0I\0T\0Y\0\0\0\0\0\1\0\0\0\0\0\0\5\1\0\0\0\350X\25\0\1\0\0\0\5\0i\0\370X\25\0\0\0\0\0\0\0\0\0\1\0\0\0\1\1\0\0\0\0\0\5\22\0\0\0\1\0\0\0\0\0\0\0", ) , ) == 0x103
 01841   420   NtProtectVirtualMemory  ... (0x76fb1000), 4096, 4, ) == 0x0
 01842  2016   NtClose  (512, ...
 01843   420   NtFlushInstructionCache  (-1, 1996165120, 232, ...
 01844   896   NtProtectVirtualMemory  (-1, (0x38be000), 4096, 260, ...
 01842  2016   NtClose  ... ) == 0x0
 01844   896   NtProtectVirtualMemory  ... (0x38be000), 4096, 4, ) == 0x0
 01845  2016   NtClose  (476, ...
 01846   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ...
 01845  2016   NtClose  ... ) == 0x0
 01846   896   NtCreateThread  ... 476, {1252, 704}, ) == 0x0
 01843   420   NtFlushInstructionCache  ... ) == 0x0
 01847   896   NtQueryInformationThread  (476, Basic, 28, ...
 01848   420   NtOpenSection  (0xe, {24, 8, 0x40, 0, 0,  (0xe, {24, 8, 0x40, 0, 0, "WLDAP32.dll"}, ... }, ...
 01847   896   NtQueryInformationThread  ... {ExitStatus=0x103,TebBaseAddress=0x7ff8b000,Pid=1252,Tid=704,}, 0x0, ) == 0x0
 01848   420   NtOpenSection  ... 512, ) == 0x0
 01849  2016   NtSecureConnectPort  ( ("\RPC Control\unimdmsvc", {12, 2, 1, 1}, 0x0, 1378832, 0x0, 11008068, 188, ... , {12, 2, 1, 1}, 0x0, 1378832, 0x0, 11008068, 188, ...
 01850   420   NtMapViewOfSection  (512, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ...
 01849  2016   NtSecureConnectPort  ... 524, 0x0, 0x0, 0x0, 188, ) == 0x0
 01850   420   NtMapViewOfSection  ... (0x76f60000), 0x0, 180224, ) == 0x0
 01851  2016   NtOpenThreadToken  (-2, 0xc, 1, ...
 01852   420   NtClose  (512, ...
 01851  2016   NtOpenThreadToken  ... ) == STATUS_NO_TOKEN
 01853   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81900, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81900, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\334\1\0\0\344\4\0\0\300\2\0\0" ...  ...
 01854  2016   NtSetInformationThread  (-2, ImpersonationToken, {ImpToken=0,}, 4, ...
 01853   896   NtRequestWaitReplyPort  ... {28, 56, reply, 0, 1252, 896, 81902, 0}  ... {28, 56, reply, 0, 1252, 896, 81902, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\334\1\0\0\344\4\0\0\300\2\0\0" )  ) == 0x0
 01852   420   NtClose  ... ) == 0x0
 01855   896   NtResumeThread  (476, ...
 01856   420   NtProtectVirtualMemory  (-1, (0x76f61000), 228, 4, ...
 01855   896   NtResumeThread  ... 1, ) == 0x0
 01856   420   NtProtectVirtualMemory  ... (0x76f61000), 4096, 32, ) == 0x0
 01857   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ...
 01858   420   NtProtectVirtualMemory  (-1, (0x76f61000), 4096, 32, ...
 01854  2016   NtSetInformationThread  ... ) == 0x0
 01859   704   NtWaitForSingleObject  (88, 0, 0x0, ...
 01857   896   NtAllocateVirtualMemory  ... 59506688, 1048576, ) == 0x0
 01860  2016   NtRequestWaitReplyPort  (524, {200, 224, new_msg, 0, 1355840, 12, 2, 1310977}  (524, {200, 224, new_msg, 0, 1355840, 12, 2, 1310977} "\0\0\0\0\274\0\0\0\0\0\0\03\242t\326)X\335I\220\360`\317\234\353q)\1\0\0\0\1\0\0\0\230`\347w\26\0\0\0\4\0\0\0\10\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\377\377\4\0\0\0[\202`\252\25\340\215\20\275f \370t\300i7\12\0\0\0\251|\210\323\224f\305\273\0\0\0\0\250\25\25\0W\254\30\355G\214+\277(\0\0\06z\0 \0\0\24\0\240\366\247\0\2\2030i\0\0\0\0(+\25\0\360\6\221|\377\377\377\377P\0\0\0\346\31\0|\0\0\24\0\304\366\247\0\372\31\221|X\376\247\0\30\356\220|\360\6\221|\0\0\0\0\0\0\0\0\0\0\0\0\6\0\0\0" ...  ...
 01861   896   NtAllocateVirtualMemory  (-1, 60547072, 0, 8192, 4096, 4, ... 60547072, 8192, ) == 0x0
 01862   896   NtProtectVirtualMemory  (-1, (0x39be000), 4096, 260, ... (0x39be000), 4096, 4, ) == 0x0
 01863   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ...
 01860  2016   NtRequestWaitReplyPort  ... {200, 224, reply, 0, 1252, 2016, 81903, 0}  ... {200, 224, reply, 0, 1252, 2016, 81903, 0} "\7\0\0\0\274\0\0\0\0\0\0\03\242t\326)X\335I\220\360`\317\234\353q)\1\0\0\0\1\0\0\0\0\0\0\0\26\0\0\0\4\0\0\0\0\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\377\377\4\0\0\0[\202`\252\25\340\215\20\275f \370t\300i7\12\0\0\0\251|\210\323\224f\305\273\0\0\0\0\250\25\25\0W\254\30\355G\214+\277(\0\0\06z\0 \0\0\24\0\240\366\247\0\2\2030i\0\0\0\0(+\25\0\360\6\221|\377\377\377\377P\0\0\0\346\31\0|\0\0\24\0\304\366\247\0\372\31\221|X\376\247\0\30\356\220|\360\6\221|\0\0\0\0\0\0\0\0\0\0\0\0\6\0\0\0" )  ) == 0x0
 01858   420   NtProtectVirtualMemory  ... (0x76f61000), 4096, 4, ) == 0x0
 01864  2016   NtSetInformationThread  (-2, ImpersonationToken, {ImpToken=0,}, 4, ...
 01865   420   NtFlushInstructionCache  (-1, 1995837440, 228, ...
 01864  2016   NtSetInformationThread  ... ) == 0x0
 01865   420   NtFlushInstructionCache  ... ) == 0x0
 01863   896   NtCreateThread  ... 512, {1252, 1152}, ) == 0x0
 01866   420   NtProtectVirtualMemory  (-1, (0x76f61000), 228, 4, ...
 01867   896   NtQueryInformationThread  (512, Basic, 28, ...
 01866   420   NtProtectVirtualMemory  ... (0x76f61000), 4096, 32, ) == 0x0
 01867   896   NtQueryInformationThread  ... {ExitStatus=0x103,TebBaseAddress=0x7ff8a000,Pid=1252,Tid=1152,}, 0x0, ) == 0x0
 01868   420   NtProtectVirtualMemory  (-1, (0x76f61000), 4096, 32, ...
 01869   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81902, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81902, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\0\2\0\0\344\4\0\0\200\4\0\0" ...  ...
 01870  2016   NtRequestWaitReplyPort  (524, {56, 80, new_msg, 0, 44, 3, 20, 0}  (524, {56, 80, new_msg, 0, 44, 3, 20, 0} "\1\0\0\0A\2\2\0gS\263F\252\227\2L\355h\28\1\0\0\0\0\0\0\0&\0(\0`\1\0\0\0\0\0\0\0\0\0\0\23\0\0\0n\0t\0 \0a\0" ...  ...
 01869   896   NtRequestWaitReplyPort  ... {28, 56, reply, 0, 1252, 896, 81904, 0}  ... {28, 56, reply, 0, 1252, 896, 81904, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\0\2\0\0\344\4\0\0\200\4\0\0" )  ) == 0x0
 01868   420   NtProtectVirtualMemory  ... (0x76f61000), 4096, 4, ) == 0x0
 01871   420   NtFlushInstructionCache  (-1, 1995837440, 228, ... ) == 0x0
 01872   420   NtProtectVirtualMemory  (-1, (0x76fb1000), 232, 4, ... (0x76fb1000), 4096, 32, ) == 0x0
 01873   420   NtProtectVirtualMemory  (-1, (0x76fb1000), 4096, 32, ... (0x76fb1000), 4096, 4, ) == 0x0
 01874   420   NtFlushInstructionCache  (-1, 1996165120, 232, ... ) == 0x0
 01875   896   NtResumeThread  (512, ... 1, ) == 0x0
 01876   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ... 60555264, 1048576, ) == 0x0
 01877   896   NtAllocateVirtualMemory  (-1, 61595648, 0, 8192, 4096, 4, ... 61595648, 8192, ) == 0x0
 01878  1152   NtWaitForSingleObject  (88, 0, 0x0, ...
 01879   420   NtOpenKey  (0x80000000, {24, 0, 0x40, 0, 0,  (0x80000000, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\WLDAP32.dll"}, ... }, ...
 01880   896   NtProtectVirtualMemory  (-1, (0x3abe000), 4096, 260, ...
 01870  2016   NtRequestWaitReplyPort  ... {44, 68, reply, 0, 1252, 2016, 81905, 0}  ... {44, 68, reply, 0, 1252, 2016, 81905, 0} "\4\376\255\201\0\0\0\0\200Y\274\201\356\12$\342\264\311\275\201:\332R\200X\253v\367\324\376\255\201\2\0\0\0\0\0\0\0\0\0\0\0" )  ) == 0x0
 01880   896   NtProtectVirtualMemory  ... (0x3abe000), 4096, 4, ) == 0x0
 01881  2016   NtRaiseException  (11008528, 11007788, 1, ...
 01882   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ...
 01883  2016   NtQueryVirtualMemory  (-1, 0x77ea0470, BasicVlm, 16, ...
 01882   896   NtCreateThread  ... 520, {1252, 1228}, ) == 0x0
 01883  2016   NtQueryVirtualMemory  ... {memory info, class 3, size 16}, 0x0, ) == 0x0
 01884   896   NtQueryInformationThread  (520, Basic, 28, ...
 01879   420   NtOpenKey  ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01884   896   NtQueryInformationThread  ... {ExitStatus=0x103,TebBaseAddress=0x7ff89000,Pid=1252,Tid=1228,}, 0x0, ) == 0x0
 01885   420   NtCreateEvent  (0x1f0003, 0x0, 1, 0, ...
 01886  2016   NtQueryVirtualMemory  (-1, 0x77e7a298, Basic, 28, ...
 01885   420   NtCreateEvent  ... 532, ) == 0x0
 01886  2016   NtQueryVirtualMemory  ... {BaseAddress=0x77e7a000,AllocationBase=0x77e70000,AllocationProtect=0x80,RegionSize=0x80000,State=0x1000,Protect=0x20,Type=0x1000000,}, 28, ) == 0x0
 01887   420   NtOpenKey  (0x20019, {24, 28, 0x40, 0, 0,  (0x20019, {24, 28, 0x40, 0, 0, "System\CurrentControlSet\Services\LDAP"}, ... }, ...
 01888  2016   NtContinue  (11006756, 0, ...
 01887   420   NtOpenKey  ... 536, ) == 0x0
 01889  2016   NtDeviceIoControlFile  (352, 108, 0x0, 0x0, 0x1200c, 0x0, 0, 26, ...
 01890   420   NtQueryValueKey  (536,  (536, "LdapClientIntegrity", Partial, 144, ... , Partial, 144, ...
 01889  2016   NtDeviceIoControlFile  ... {status=0x0, info=0}, "", ) == 0x103
 01891   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81904, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81904, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\10\2\0\0\344\4\0\0\314\4\0\0" ...  ...
 01892  2016   NtWaitForSingleObject  (108, 1, {-5000000, -1}, ...
 01891   896   NtRequestWaitReplyPort  ... {28, 56, reply, 0, 1252, 896, 81906, 0}  ... {28, 56, reply, 0, 1252, 896, 81906, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\10\2\0\0\344\4\0\0\314\4\0\0" )  ) == 0x0
 01890   420   NtQueryValueKey  ... TitleIdx=0, Type=4, Data= ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) }, 16, ) == 0x0
 01893   896   NtResumeThread  (520, ...
 01894   420   NtClose  (536, ...
 01893   896   NtResumeThread  ... 1, ) == 0x0
 01894   420   NtClose  ... ) == 0x0
 01895   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ...
 01896   420   NtOpenKey  (0x80000000, {24, 0, 0x40, 0, 0,  (0x80000000, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\winrnr.dll"}, ... }, ...
 01897  1228   NtWaitForSingleObject  (88, 0, 0x0, ...
 01896   420   NtOpenKey  ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01898   420   NtQueryPerformanceCounter  (... {-1449365812, 16}, {3579545, 0}, ) == 0x0
 01899   420   NtSetEventBoostPriority  (88, ...
 01807  1328   NtWaitForSingleObject  ... ) == 0x0
 01900  1328   NtSetEventBoostPriority  (88, ...
 01837  1636   NtWaitForSingleObject  ... ) == 0x0
 01901  1636   NtSetEventBoostPriority  (88, ...
 01859   704   NtWaitForSingleObject  ... ) == 0x0
 01902   704   NtSetEventBoostPriority  (88, ...
 01878  1152   NtWaitForSingleObject  ... ) == 0x0
 01903  1152   NtSetEventBoostPriority  (88, ...
 01897  1228   NtWaitForSingleObject  ... ) == 0x0
 01904  1228   NtTestAlert  (... ) == 0x0
 01903  1152   NtSetEventBoostPriority  ... ) == 0x0
 01902   704   NtSetEventBoostPriority  ... ) == 0x0
 01901  1636   NtSetEventBoostPriority  ... ) == 0x0
 01900  1328   NtSetEventBoostPriority  ... ) == 0x0
 01899   420   NtSetEventBoostPriority  ... ) == 0x0
 01895   896   NtAllocateVirtualMemory  ... 61603840, 1048576, ) == 0x0
 01905  1228   NtContinue  (61603120, 1, ...
 01906  1152   NtTestAlert  (...
 01907   704   NtTestAlert  (...
 01908  1636   NtTestAlert  (...
 01909   420   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\System32\mswsock.dll"}, 14412752, ... }, 14412752, ...
 01910   896   NtAllocateVirtualMemory  (-1, 62644224, 0, 8192, 4096, 4, ...
 01911  1228   NtRegisterThreadTerminatePort  (24, ...
 01906  1152   NtTestAlert  ... ) == 0x0
 01907   704   NtTestAlert  ... ) == 0x0
 01908  1636   NtTestAlert  ... ) == 0x0
 01912  1328   NtTestAlert  (...
 01910   896   NtAllocateVirtualMemory  ... 62644224, 8192, ) == 0x0
 01911  1228   NtRegisterThreadTerminatePort  ... ) == 0x0
 01913  1152   NtContinue  (60554544, 1, ...
 01914   704   NtContinue  (59505968, 1, ...
 01915  1636   NtContinue  (58457392, 1, ...
 01912  1328   NtTestAlert  ... ) == 0x0
 01916   896   NtProtectVirtualMemory  (-1, (0x3bbe000), 4096, 260, ...
 01917  1228   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 01918  1152   NtRegisterThreadTerminatePort  (24, ...
 01919   704   NtRegisterThreadTerminatePort  (24, ...
 01920  1636   NtRegisterThreadTerminatePort  (24, ...
 01921  1328   NtContinue  (57408816, 1, ...
 01916   896   NtProtectVirtualMemory  ... (0x3bbe000), 4096, 4, ) == 0x0
 01917  1228   NtDuplicateObject  ... 536, ) == 0x0
 01918  1152   NtRegisterThreadTerminatePort  ... ) == 0x0
 01919   704   NtRegisterThreadTerminatePort  ... ) == 0x0
 01920  1636   NtRegisterThreadTerminatePort  ... ) == 0x0
 01922  1328   NtRegisterThreadTerminatePort  (24, ...
 01923   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ...
 01924  1228   NtWaitForSingleObject  (64, 0, {0, 0}, ...
 01925  1152   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 01926   704   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 01927  1636   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 01922  1328   NtRegisterThreadTerminatePort  ... ) == 0x0
 01909   420   NtQueryAttributesFile  ... ) == 0x0
 01923   896   NtCreateThread  ... 540, {1252, 792}, ) == 0x0
 01924  1228   NtWaitForSingleObject  ... ) == 0x102
 01925  1152   NtDuplicateObject  ... 544, ) == 0x0
 01926   704   NtDuplicateObject  ... 548, ) == 0x0
 01928  1328   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 01929   420   NtQuerySystemInformation  (Basic, 44, ...
 01930   896   NtQueryInformationThread  (540, Basic, 28, ...
 01931  1228   NtWaitForSingleObject  (120, 0, 0x0, ...
 01932  1152   NtWaitForSingleObject  (64, 0, {0, 0}, ...
 01933   704   NtWaitForSingleObject  (64, 0, {0, 0}, ...
 01927  1636   NtDuplicateObject  ... 552, ) == 0x0
 01929   420   NtQuerySystemInformation  ... {Unknown=0,MaximumIncrement=156250,PhysicalPageSize=0x1000,NumberOfPhysicalPages=0xff7c,LowestPhysicalPage=0x1,HighestPhysicalPage=0xffff,AllocationGranularity=0x10000,LowestUserAddress=0x10000,HighestUserAddress=0x7ffeffff,ActiveProcessors=1,NumberProcessors=1,}, 0x0, ) == 0x0
 01930   896   NtQueryInformationThread  ... {ExitStatus=0x103,TebBaseAddress=0x7ff88000,Pid=1252,Tid=792,}, 0x0, ) == 0x0
 01932  1152   NtWaitForSingleObject  ... ) == 0x102
 01933   704   NtWaitForSingleObject  ... ) == 0x102
 01934  1636   NtWaitForSingleObject  (64, 0, {0, 0}, ...
 01935   420   NtAllocateVirtualMemory  (-1, 0, 0, 65536, 8192, 4, ...
 01936   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81906, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81906, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\34\2\0\0\344\4\0\0\30\3\0\0" ...  ...
 01937  1152   NtWaitForSingleObject  (120, 0, 0x0, ...
 01938   704   NtWaitForSingleObject  (120, 0, 0x0, ...
 01934  1636   NtWaitForSingleObject  ... ) == 0x102
 01935   420   NtAllocateVirtualMemory  ... 8716288, 65536, ) == 0x0
 01936   896   NtRequestWaitReplyPort  ... {28, 56, reply, 0, 1252, 896, 81907, 0}  ... {28, 56, reply, 0, 1252, 896, 81907, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\34\2\0\0\344\4\0\0\30\3\0\0" )  ) == 0x0
 01939  1636   NtWaitForSingleObject  (120, 0, 0x0, ...
 01940   420   NtAllocateVirtualMemory  (-1, 8716288, 0, 4096, 4096, 4, ...
 01928  1328   NtDuplicateObject  ... 556, ) == 0x0
 01941   896   NtResumeThread  (540, ...
 01942  1328   NtAllocateVirtualMemory  (-1, 1400832, 0, 4096, 4096, 4, ...
 01941   896   NtResumeThread  ... 1, ) == 0x0
 01942  1328   NtAllocateVirtualMemory  ... 1400832, 4096, ) == 0x0
 01943   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ...
 01944  1328   NtWaitForSingleObject  (64, 0, {0, 0}, ...
 01943   896   NtAllocateVirtualMemory  ... 62652416, 1048576, ) == 0x0
 01944  1328   NtWaitForSingleObject  ... ) == 0x102
 01945   896   NtAllocateVirtualMemory  (-1, 63692800, 0, 8192, 4096, 4, ...
 01940   420   NtAllocateVirtualMemory  ... 8716288, 4096, ) == 0x0
 01946   792   NtTestAlert  (...
 01945   896   NtAllocateVirtualMemory  ... 63692800, 8192, ) == 0x0
 01947   420   NtAllocateVirtualMemory  (-1, 8720384, 0, 8192, 4096, 4, ...
 01946   792   NtTestAlert  ... ) == 0x0
 01948  1328   NtWaitForSingleObject  (120, 0, 0x0, ...
 01947   420   NtAllocateVirtualMemory  ... 8720384, 8192, ) == 0x0
 01949   792   NtContinue  (62651696, 1, ...
 01950   420   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\wshbth.dll"}, 14412752, ... }, 14412752, ...
 01951   792   NtRegisterThreadTerminatePort  (24, ...
 01950   420   NtQueryAttributesFile  ... ) == 0x0
 01951   792   NtRegisterThreadTerminatePort  ... ) == 0x0
 01952   420   NtOpenFile  (0x100020, {24, 0, 0x40, 0, 0,  (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\wshbth.dll"}, 5, 96, ... }, 5, 96, ...
 01953   896   NtProtectVirtualMemory  (-1, (0x3cbe000), 4096, 260, ...
 01954   792   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 01953   896   NtProtectVirtualMemory  ... (0x3cbe000), 4096, 4, ) == 0x0
 01954   792   NtDuplicateObject  ... 560, ) == 0x0
 01955   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ...
 01956   792   NtWaitForSingleObject  (64, 0, {0, 0}, ...
 01955   896   NtCreateThread  ... 564, {1252, 1484}, ) == 0x0
 01956   792   NtWaitForSingleObject  ... ) == 0x102
 01957   896   NtQueryInformationThread  (564, Basic, 28, ...
 01958   792   NtWaitForSingleObject  (120, 0, 0x0, ...
 01957   896   NtQueryInformationThread  ... {ExitStatus=0x103,TebBaseAddress=0x7ff87000,Pid=1252,Tid=1484,}, 0x0, ) == 0x0
 01952   420   NtOpenFile  ... 568, {status=0x0, info=1}, ) == 0x0
 01959   420   NtCreateSection  (0xe, 0x0, 0x0, 16, 134217728, 568, ... 572, ) == 0x0
 01960   420   NtClose  (568, ... ) == 0x0
 01961   420   NtMapViewOfSection  (572, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 16, ... (0xb80000), 0x0, 110592, ) == 0x0
 01962   420   NtClose  (572, ... ) == 0x0
 01963   420   NtUnmapViewOfSection  (-1, 0xb80000, ...
 01964   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81907, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81907, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG4\2\0\0\344\4\0\0\314\5\0\0" ... {28, 56, reply, 0, 1252, 896, 81908, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG4\2\0\0\344\4\0\0\314\5\0\0" )  ... {28, 56, reply, 0, 1252, 896, 81908, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81907, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG4\2\0\0\344\4\0\0\314\5\0\0" ... {28, 56, reply, 0, 1252, 896, 81908, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG4\2\0\0\344\4\0\0\314\5\0\0" )  ) == 0x0
 01965   896   NtResumeThread  (564, ... 1, ) == 0x0
 01966   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ... 63700992, 1048576, ) == 0x0
 01967   896   NtAllocateVirtualMemory  (-1, 64741376, 0, 8192, 4096, 4, ... 64741376, 8192, ) == 0x0
 01968   896   NtProtectVirtualMemory  (-1, (0x3dbe000), 4096, 260, ... (0x3dbe000), 4096, 4, ) == 0x0
 01969   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ...
 01963   420   NtUnmapViewOfSection  ... ) == 0x0
 01970  1484   NtWaitForSingleObject  (88, 0, 0x0, ...
 01971   420   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\wshbth.dll"}, 14413060, ... ) }, 14413060, ... ) == 0x0
 01972   420   NtOpenFile  (0x100020, {24, 0, 0x40, 0, 0,  (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\wshbth.dll"}, 5, 96, ... 572, {status=0x0, info=1}, ) }, 5, 96, ... 572, {status=0x0, info=1}, ) == 0x0
 01973   420   NtCreateSection  (0xf, 0x0, 0x0, 16, 16777216, 572, ... 568, ) == 0x0
 01974   420   NtQuerySection  (568, Image, 48, ... {section info, class 1, size 48}, 0x0, ) == 0x0
 01975   420   NtClose  (572, ... ) == 0x0
 01976   420   NtMapViewOfSection  (568, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ...
 01969   896   NtCreateThread  ... 572, {1252, 888}, ) == 0x0
 01977   896   NtQueryInformationThread  (572, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ff86000,Pid=1252,Tid=888,}, 0x0, ) == 0x0
 01978   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81908, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81908, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG<\2\0\0\344\4\0\0x\3\0\0" ... {28, 56, reply, 0, 1252, 896, 81909, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG<\2\0\0\344\4\0\0x\3\0\0" )  ... {28, 56, reply, 0, 1252, 896, 81909, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81908, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG<\2\0\0\344\4\0\0x\3\0\0" ... {28, 56, reply, 0, 1252, 896, 81909, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG<\2\0\0\344\4\0\0x\3\0\0" )  ) == 0x0
 01979   896   NtResumeThread  (572, ... 1, ) == 0x0
 01980   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ... 64749568, 1048576, ) == 0x0
 01981   896   NtAllocateVirtualMemory  (-1, 65789952, 0, 8192, 4096, 4, ... 65789952, 8192, ) == 0x0
 01976   420   NtMapViewOfSection  ... (0x751d0000), 0x0, 122880, ) == 0x0
 01982   888   NtWaitForSingleObject  (88, 0, 0x0, ...
 01983   420   NtClose  (568, ... ) == 0x0
 01984   420   NtProtectVirtualMemory  (-1, (0x751d1000), 224, 4, ... (0x751d1000), 4096, 32, ) == 0x0
 01985   420   NtProtectVirtualMemory  (-1, (0x751d1000), 4096, 32, ... (0x751d1000), 4096, 4, ) == 0x0
 01986   420   NtFlushInstructionCache  (-1, 1964838912, 224, ... ) == 0x0
 01987   420   NtProtectVirtualMemory  (-1, (0x751d1000), 224, 4, ...
 01988   896   NtProtectVirtualMemory  (-1, (0x3ebe000), 4096, 260, ... (0x3ebe000), 4096, 4, ) == 0x0
 01989   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ... 568, {1252, 1120}, ) == 0x0
 01990   896   NtQueryInformationThread  (568, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ff85000,Pid=1252,Tid=1120,}, 0x0, ) == 0x0
 01991   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81909, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81909, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG8\2\0\0\344\4\0\0`\4\0\0" ... {28, 56, reply, 0, 1252, 896, 81910, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG8\2\0\0\344\4\0\0`\4\0\0" )  ... {28, 56, reply, 0, 1252, 896, 81910, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81909, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG8\2\0\0\344\4\0\0`\4\0\0" ... {28, 56, reply, 0, 1252, 896, 81910, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG8\2\0\0\344\4\0\0`\4\0\0" )  ) == 0x0
 01992   896   NtResumeThread  (568, ... 1, ) == 0x0
 01993   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ...
 01987   420   NtProtectVirtualMemory  ... (0x751d1000), 4096, 32, ) == 0x0
 01994  1120   NtWaitForSingleObject  (88, 0, 0x0, ...
 01995   420   NtProtectVirtualMemory  (-1, (0x751d1000), 4096, 32, ... (0x751d1000), 4096, 4, ) == 0x0
 01996   420   NtFlushInstructionCache  (-1, 1964838912, 224, ... ) == 0x0
 01997   420   NtOpenSection  (0xe, {24, 8, 0x40, 0, 0,  (0xe, {24, 8, 0x40, 0, 0, "SETUPAPI.dll"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01998   420   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\u:\work\SETUPAPI.dll"}, 14412236, ... }, 14412236, ...
 01993   896   NtAllocateVirtualMemory  ... 65798144, 1048576, ) == 0x0
 01999   896   NtAllocateVirtualMemory  (-1, 66838528, 0, 8192, 4096, 4, ... 66838528, 8192, ) == 0x0
 02000   896   NtProtectVirtualMemory  (-1, (0x3fbe000), 4096, 260, ... (0x3fbe000), 4096, 4, ) == 0x0
 02001   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ... 576, {1252, 840}, ) == 0x0
 02002   896   NtQueryInformationThread  (576, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ff84000,Pid=1252,Tid=840,}, 0x0, ) == 0x0
 02003   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81910, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81910, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG@\2\0\0\344\4\0\0H\3\0\0" ... {28, 56, reply, 0, 1252, 896, 81911, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG@\2\0\0\344\4\0\0H\3\0\0" )  ... {28, 56, reply, 0, 1252, 896, 81911, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81910, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG@\2\0\0\344\4\0\0H\3\0\0" ... {28, 56, reply, 0, 1252, 896, 81911, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG@\2\0\0\344\4\0\0H\3\0\0" )  ) == 0x0
 02004   896   NtResumeThread  (576, ... 1, ) == 0x0
 02005   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ... 66846720, 1048576, ) == 0x0
 02006   896   NtAllocateVirtualMemory  (-1, 67887104, 0, 8192, 4096, 4, ... 67887104, 8192, ) == 0x0
 02007   840   NtWaitForSingleObject  (88, 0, 0x0, ...
 02008   896   NtProtectVirtualMemory  (-1, (0x40be000), 4096, 260, ... (0x40be000), 4096, 4, ) == 0x0
 02009   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ... 580, {1252, 876}, ) == 0x0
 02010   896   NtQueryInformationThread  (580, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ff83000,Pid=1252,Tid=876,}, 0x0, ) == 0x0
 02011   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81911, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81911, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFGD\2\0\0\344\4\0\0l\3\0\0" ... {28, 56, reply, 0, 1252, 896, 81912, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFGD\2\0\0\344\4\0\0l\3\0\0" )  ... {28, 56, reply, 0, 1252, 896, 81912, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81911, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFGD\2\0\0\344\4\0\0l\3\0\0" ... {28, 56, reply, 0, 1252, 896, 81912, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFGD\2\0\0\344\4\0\0l\3\0\0" )  ) == 0x0
 02012   896   NtResumeThread  (580, ... 1, ) == 0x0
 02013   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ...
 02014   876   NtWaitForSingleObject  (88, 0, 0x0, ...
 02013   896   NtAllocateVirtualMemory  ... 67895296, 1048576, ) == 0x0
 02015   896   NtAllocateVirtualMemory  (-1, 68935680, 0, 8192, 4096, 4, ... 68935680, 8192, ) == 0x0
 02016   896   NtProtectVirtualMemory  (-1, (0x41be000), 4096, 260, ... (0x41be000), 4096, 4, ) == 0x0
 02017   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ... 584, {1252, 1104}, ) == 0x0
 02018   896   NtQueryInformationThread  (584, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ff82000,Pid=1252,Tid=1104,}, 0x0, ) == 0x0
 02019   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81912, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81912, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFGH\2\0\0\344\4\0\0P\4\0\0" ... {28, 56, reply, 0, 1252, 896, 81913, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFGH\2\0\0\344\4\0\0P\4\0\0" )  ... {28, 56, reply, 0, 1252, 896, 81913, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81912, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFGH\2\0\0\344\4\0\0P\4\0\0" ... {28, 56, reply, 0, 1252, 896, 81913, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFGH\2\0\0\344\4\0\0P\4\0\0" )  ) == 0x0
 02020   896   NtResumeThread  (584, ... 1, ) == 0x0
 02021   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ... 68943872, 1048576, ) == 0x0
 02022   896   NtAllocateVirtualMemory  (-1, 69984256, 0, 8192, 4096, 4, ... 69984256, 8192, ) == 0x0
 02023  1104   NtWaitForSingleObject  (88, 0, 0x0, ...
 02024   896   NtProtectVirtualMemory  (-1, (0x42be000), 4096, 260, ... (0x42be000), 4096, 4, ) == 0x0
 02025   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ... 588, {1252, 860}, ) == 0x0
 02026   896   NtQueryInformationThread  (588, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ff81000,Pid=1252,Tid=860,}, 0x0, ) == 0x0
 02027   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81913, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81913, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFGL\2\0\0\344\4\0\0\\3\0\0" ... {28, 56, reply, 0, 1252, 896, 81914, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFGL\2\0\0\344\4\0\0\\3\0\0" )  ... {28, 56, reply, 0, 1252, 896, 81914, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81913, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFGL\2\0\0\344\4\0\0\\3\0\0" ... {28, 56, reply, 0, 1252, 896, 81914, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFGL\2\0\0\344\4\0\0\\3\0\0" )  ) == 0x0
 02028   896   NtResumeThread  (588, ... 1, ) == 0x0
 02029   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ...
 02030   860   NtWaitForSingleObject  (88, 0, 0x0, ...
 02029   896   NtAllocateVirtualMemory  ... 69992448, 1048576, ) == 0x0
 02031   896   NtAllocateVirtualMemory  (-1, 71032832, 0, 8192, 4096, 4, ... 71032832, 8192, ) == 0x0
 02032   896   NtProtectVirtualMemory  (-1, (0x43be000), 4096, 260, ... (0x43be000), 4096, 4, ) == 0x0
 02033   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ... 592, {1252, 1516}, ) == 0x0
 02034   896   NtQueryInformationThread  (592, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ff80000,Pid=1252,Tid=1516,}, 0x0, ) == 0x0
 02035   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81914, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81914, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFGP\2\0\0\344\4\0\0\354\5\0\0" ... {28, 56, reply, 0, 1252, 896, 81915, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFGP\2\0\0\344\4\0\0\354\5\0\0" )  ... {28, 56, reply, 0, 1252, 896, 81915, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81914, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFGP\2\0\0\344\4\0\0\354\5\0\0" ... {28, 56, reply, 0, 1252, 896, 81915, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFGP\2\0\0\344\4\0\0\354\5\0\0" )  ) == 0x0
 02036   896   NtResumeThread  (592, ... 1, ) == 0x0
 02037   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ...
 02038  1516   NtWaitForSingleObject  (88, 0, 0x0, ...
 02037   896   NtAllocateVirtualMemory  ... 71041024, 1048576, ) == 0x0
 02039   896   NtAllocateVirtualMemory  (-1, 72081408, 0, 8192, 4096, 4, ... 72081408, 8192, ) == 0x0
 02040   896   NtProtectVirtualMemory  (-1, (0x44be000), 4096, 260, ... (0x44be000), 4096, 4, ) == 0x0
 02041   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ... 596, {1252, 780}, ) == 0x0
 02042   896   NtQueryInformationThread  (596, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ff7f000,Pid=1252,Tid=780,}, 0x0, ) == 0x0
 02043   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81915, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81915, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFGT\2\0\0\344\4\0\0\14\3\0\0" ... {28, 56, reply, 0, 1252, 896, 81916, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFGT\2\0\0\344\4\0\0\14\3\0\0" )  ... {28, 56, reply, 0, 1252, 896, 81916, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81915, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFGT\2\0\0\344\4\0\0\14\3\0\0" ... {28, 56, reply, 0, 1252, 896, 81916, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFGT\2\0\0\344\4\0\0\14\3\0\0" )  ) == 0x0
 02044   896   NtResumeThread  (596, ... 1, ) == 0x0
 02045   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ... 72089600, 1048576, ) == 0x0
 02046   896   NtAllocateVirtualMemory  (-1, 73129984, 0, 8192, 4096, 4, ... 73129984, 8192, ) == 0x0
 02047   780   NtWaitForSingleObject  (88, 0, 0x0, ...
 02048   896   NtProtectVirtualMemory  (-1, (0x45be000), 4096, 260, ... (0x45be000), 4096, 4, ) == 0x0
 02049   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ... 600, {1252, 940}, ) == 0x0
 02050   896   NtQueryInformationThread  (600, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ff7e000,Pid=1252,Tid=940,}, 0x0, ) == 0x0
 02051   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81916, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81916, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFGX\2\0\0\344\4\0\0\254\3\0\0" ... {28, 56, reply, 0, 1252, 896, 81917, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFGX\2\0\0\344\4\0\0\254\3\0\0" )  ... {28, 56, reply, 0, 1252, 896, 81917, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81916, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFGX\2\0\0\344\4\0\0\254\3\0\0" ... {28, 56, reply, 0, 1252, 896, 81917, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFGX\2\0\0\344\4\0\0\254\3\0\0" )  ) == 0x0
 02052   896   NtResumeThread  (600, ... 1, ) == 0x0
 02053   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ...
 02054   940   NtWaitForSingleObject  (88, 0, 0x0, ...
 02053   896   NtAllocateVirtualMemory  ... 73138176, 1048576, ) == 0x0
 02055   896   NtAllocateVirtualMemory  (-1, 74178560, 0, 8192, 4096, 4, ... 74178560, 8192, ) == 0x0
 02056   896   NtProtectVirtualMemory  (-1, (0x46be000), 4096, 260, ... (0x46be000), 4096, 4, ) == 0x0
 02057   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ... 604, {1252, 1268}, ) == 0x0
 02058   896   NtQueryInformationThread  (604, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ff7d000,Pid=1252,Tid=1268,}, 0x0, ) == 0x0
 02059   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81917, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81917, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\\2\0\0\344\4\0\0\364\4\0\0" ... {28, 56, reply, 0, 1252, 896, 81918, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\\2\0\0\344\4\0\0\364\4\0\0" )  ... {28, 56, reply, 0, 1252, 896, 81918, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81917, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\\2\0\0\344\4\0\0\364\4\0\0" ... {28, 56, reply, 0, 1252, 896, 81918, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\\2\0\0\344\4\0\0\364\4\0\0" )  ) == 0x0
 01998   420   NtQueryAttributesFile  ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02060   896   NtResumeThread  (604, ... 1, ) == 0x0
 02061   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ... 74186752, 1048576, ) == 0x0
 02062   896   NtAllocateVirtualMemory  (-1, 75227136, 0, 8192, 4096, 4, ... 75227136, 8192, ) == 0x0
 02063   896   NtProtectVirtualMemory  (-1, (0x47be000), 4096, 260, ... (0x47be000), 4096, 4, ) == 0x0
 02064   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ... 608, {1252, 644}, ) == 0x0
 02065   896   NtQueryInformationThread  (608, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ff7c000,Pid=1252,Tid=644,}, 0x0, ) == 0x0
 02066   420   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\SETUPAPI.dll"}, 14412236, ... }, 14412236, ...
 02067  1268   NtWaitForSingleObject  (88, 0, 0x0, ...
 02066   420   NtQueryAttributesFile  ... ) == 0x0
 02068   420   NtOpenFile  (0x100020, {24, 0, 0x40, 0, 0,  (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\SETUPAPI.dll"}, 5, 96, ... 612, {status=0x0, info=1}, ) }, 5, 96, ... 612, {status=0x0, info=1}, ) == 0x0
 02069   420   NtCreateSection  (0xf, 0x0, 0x0, 16, 16777216, 612, ... 616, ) == 0x0
 02070   420   NtQuerySection  (616, Image, 48, ... {section info, class 1, size 48}, 0x0, ) == 0x0
 02071   420   NtClose  (612, ... ) == 0x0
 02072   420   NtMapViewOfSection  (616, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x77920000), 0x0, 995328, ) == 0x0
 02073   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81918, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81918, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG`\2\0\0\344\4\0\0\204\2\0\0" ... {28, 56, reply, 0, 1252, 896, 81919, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG`\2\0\0\344\4\0\0\204\2\0\0" )  ... {28, 56, reply, 0, 1252, 896, 81919, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81918, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG`\2\0\0\344\4\0\0\204\2\0\0" ... {28, 56, reply, 0, 1252, 896, 81919, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG`\2\0\0\344\4\0\0\204\2\0\0" )  ) == 0x0
 02074   896   NtResumeThread  (608, ... 1, ) == 0x0
 02075   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ... 75235328, 1048576, ) == 0x0
 02076   896   NtAllocateVirtualMemory  (-1, 76275712, 0, 8192, 4096, 4, ... 76275712, 8192, ) == 0x0
 02077   896   NtProtectVirtualMemory  (-1, (0x48be000), 4096, 260, ... (0x48be000), 4096, 4, ) == 0x0
 02078   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ...
 02079   420   NtClose  (616, ...
 02080   644   NtWaitForSingleObject  (88, 0, 0x0, ...
 02079   420   NtClose  ... ) == 0x0
 02081   420   NtProtectVirtualMemory  (-1, (0x77921000), 1368, 4, ... (0x77921000), 4096, 32, ) == 0x0
 02082   420   NtProtectVirtualMemory  (-1, (0x77921000), 4096, 32, ... (0x77921000), 4096, 4, ) == 0x0
 02083   420   NtFlushInstructionCache  (-1, 2006061056, 1368, ... ) == 0x0
 02084   420   NtProtectVirtualMemory  (-1, (0x77921000), 1368, 4, ... (0x77921000), 4096, 32, ) == 0x0
 02078   896   NtCreateThread  ... 616, {1252, 1736}, ) == 0x0
 02085   896   NtQueryInformationThread  (616, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ff7b000,Pid=1252,Tid=1736,}, 0x0, ) == 0x0
 02086   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81919, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81919, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFGh\2\0\0\344\4\0\0\310\6\0\0" ... {28, 56, reply, 0, 1252, 896, 81920, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFGh\2\0\0\344\4\0\0\310\6\0\0" )  ... {28, 56, reply, 0, 1252, 896, 81920, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81919, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFGh\2\0\0\344\4\0\0\310\6\0\0" ... {28, 56, reply, 0, 1252, 896, 81920, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFGh\2\0\0\344\4\0\0\310\6\0\0" )  ) == 0x0
 02087   896   NtResumeThread  (616, ... 1, ) == 0x0
 02088   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ... 76283904, 1048576, ) == 0x0
 02089   896   NtAllocateVirtualMemory  (-1, 77324288, 0, 8192, 4096, 4, ... 77324288, 8192, ) == 0x0
 02090   420   NtProtectVirtualMemory  (-1, (0x77921000), 4096, 32, ...
 02091  1736   NtWaitForSingleObject  (88, 0, 0x0, ...
 02090   420   NtProtectVirtualMemory  ... (0x77921000), 4096, 4, ) == 0x0
 02092   420   NtFlushInstructionCache  (-1, 2006061056, 1368, ... ) == 0x0
 02093   420   NtProtectVirtualMemory  (-1, (0x77921000), 1368, 4, ... (0x77921000), 4096, 32, ) == 0x0
 02094   420   NtProtectVirtualMemory  (-1, (0x77921000), 4096, 32, ... (0x77921000), 4096, 4, ) == 0x0
 02095   420   NtFlushInstructionCache  (-1, 2006061056, 1368, ... ) == 0x0
 02096   420   NtProtectVirtualMemory  (-1, (0x77921000), 1368, 4, ... (0x77921000), 4096, 32, ) == 0x0
 02097   896   NtProtectVirtualMemory  (-1, (0x49be000), 4096, 260, ... (0x49be000), 4096, 4, ) == 0x0
 02098   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ... 612, {1252, 320}, ) == 0x0
 02099   896   NtQueryInformationThread  (612, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ff7a000,Pid=1252,Tid=320,}, 0x0, ) == 0x0
 02100   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81920, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81920, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFGd\2\0\0\344\4\0\0@\1\0\0" ... {28, 56, reply, 0, 1252, 896, 81921, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFGd\2\0\0\344\4\0\0@\1\0\0" )  ... {28, 56, reply, 0, 1252, 896, 81921, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81920, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFGd\2\0\0\344\4\0\0@\1\0\0" ... {28, 56, reply, 0, 1252, 896, 81921, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFGd\2\0\0\344\4\0\0@\1\0\0" )  ) == 0x0
 02101   896   NtResumeThread  (612, ... 1, ) == 0x0
 02102   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ...
 02103   420   NtProtectVirtualMemory  (-1, (0x77921000), 4096, 32, ...
 02104   320   NtWaitForSingleObject  (88, 0, 0x0, ...
 02103   420   NtProtectVirtualMemory  ... (0x77921000), 4096, 4, ) == 0x0
 02105   420   NtFlushInstructionCache  (-1, 2006061056, 1368, ... ) == 0x0
 02106   420   NtProtectVirtualMemory  (-1, (0x77921000), 1368, 4, ... (0x77921000), 4096, 32, ) == 0x0
 02107   420   NtProtectVirtualMemory  (-1, (0x77921000), 4096, 32, ... (0x77921000), 4096, 4, ) == 0x0
 02108   420   NtFlushInstructionCache  (-1, 2006061056, 1368, ... ) == 0x0
 02109   420   NtProtectVirtualMemory  (-1, (0x751d1000), 224, 4, ... (0x751d1000), 4096, 32, ) == 0x0
 02102   896   NtAllocateVirtualMemory  ... 77332480, 1048576, ) == 0x0
 02110   896   NtAllocateVirtualMemory  (-1, 78372864, 0, 8192, 4096, 4, ... 78372864, 8192, ) == 0x0
 02111   896   NtProtectVirtualMemory  (-1, (0x4abe000), 4096, 260, ... (0x4abe000), 4096, 4, ) == 0x0
 02112   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ... 620, {1252, 380}, ) == 0x0
 02113   896   NtQueryInformationThread  (620, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ff79000,Pid=1252,Tid=380,}, 0x0, ) == 0x0
 02114   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81921, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81921, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFGl\2\0\0\344\4\0\0|\1\0\0" ... {28, 56, reply, 0, 1252, 896, 81922, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFGl\2\0\0\344\4\0\0|\1\0\0" )  ... {28, 56, reply, 0, 1252, 896, 81922, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81921, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFGl\2\0\0\344\4\0\0|\1\0\0" ... {28, 56, reply, 0, 1252, 896, 81922, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFGl\2\0\0\344\4\0\0|\1\0\0" )  ) == 0x0
 02115   420   NtProtectVirtualMemory  (-1, (0x751d1000), 4096, 32, ... (0x751d1000), 4096, 4, ) == 0x0
 02116   420   NtFlushInstructionCache  (-1, 1964838912, 224, ... ) == 0x0
 02117   896   NtResumeThread  (620, ... 1, ) == 0x0
 02118   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ... 78381056, 1048576, ) == 0x0
 02119   896   NtAllocateVirtualMemory  (-1, 79421440, 0, 8192, 4096, 4, ... 79421440, 8192, ) == 0x0
 02120   380   NtWaitForSingleObject  (88, 0, 0x0, ...
 02121   896   NtProtectVirtualMemory  (-1, (0x4bbe000), 4096, 260, ... (0x4bbe000), 4096, 4, ) == 0x0
 02122   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ... 624, {1252, 1332}, ) == 0x0
 02123   896   NtQueryInformationThread  (624, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ff78000,Pid=1252,Tid=1332,}, 0x0, ) == 0x0
 02124   420   NtOpenKey  (0x80000000, {24, 0, 0x40, 0, 0,  (0x80000000, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SETUPAPI.dll"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02125   420   NtAllocateVirtualMemory  (-1, 8806400, 0, 4096, 4096, 4, ... 8806400, 4096, ) == 0x0
 02126   420   NtQueryDefaultUILanguage  (2090319928, ...
 02127   420   NtOpenThreadTokenEx  (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN
 02128   420   NtOpenProcessTokenEx  (-1, 0x20008, 512, ... -2147481484, ) == 0x0
 02129   420   NtQueryInformationToken  (-2147481484, User, 80, ...
 02130   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81922, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81922, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFGp\2\0\0\344\4\0\04\5\0\0" ... {28, 56, reply, 0, 1252, 896, 81923, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFGp\2\0\0\344\4\0\04\5\0\0" )  ... {28, 56, reply, 0, 1252, 896, 81923, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81922, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFGp\2\0\0\344\4\0\04\5\0\0" ... {28, 56, reply, 0, 1252, 896, 81923, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFGp\2\0\0\344\4\0\04\5\0\0" )  ) == 0x0
 02131   896   NtResumeThread  (624, ... 1, ) == 0x0
 02132   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ... 79429632, 1048576, ) == 0x0
 02133   896   NtAllocateVirtualMemory  (-1, 80470016, 0, 8192, 4096, 4, ... 80470016, 8192, ) == 0x0
 02134   896   NtProtectVirtualMemory  (-1, (0x4cbe000), 4096, 260, ... (0x4cbe000), 4096, 4, ) == 0x0
 02135   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ...
 02129   420   NtQueryInformationToken  ... {token info, class 1, size 36}, 36, ) == 0x0
 02136  1332   NtWaitForSingleObject  (88, 0, 0x0, ...
 02137   420   NtClose  (-2147481484, ... ) == 0x0
 02138   420   NtOpenKey  (0x2000000, {24, 0, 0x640, 0, 0,  (0x2000000, {24, 0, 0x640, 0, 0, "\REGISTRY\USER\S-1-5-21-1292428093-1383384898-725345543-1003"}, ... -2147481484, ) }, ... -2147481484, ) == 0x0
 02139   420   NtOpenKey  (0x80000000, {24, -2147481484, 0x240, 0, 0,  (0x80000000, {24, -2147481484, 0x240, 0, 0, "Software\Policies\Microsoft\Control Panel\Desktop"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02140   420   NtOpenKey  (0x80000000, {24, -2147481484, 0x640, 0, 0,  (0x80000000, {24, -2147481484, 0x640, 0, 0, "Control Panel\Desktop"}, ... -2147481480, ) }, ... -2147481480, ) == 0x0
 02141   420   NtQueryValueKey  (-2147481480,  (-2147481480, "MultiUILanguageId", Partial, 256, ... ) , Partial, 256, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02142   420   NtClose  (-2147481480, ...
 02135   896   NtCreateThread  ... 628, {1252, 1336}, ) == 0x0
 02143   896   NtQueryInformationThread  (628, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ff77000,Pid=1252,Tid=1336,}, 0x0, ) == 0x0
 02144   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81923, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81923, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFGt\2\0\0\344\4\0\08\5\0\0" ... {28, 56, reply, 0, 1252, 896, 81924, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFGt\2\0\0\344\4\0\08\5\0\0" )  ... {28, 56, reply, 0, 1252, 896, 81924, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81923, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFGt\2\0\0\344\4\0\08\5\0\0" ... {28, 56, reply, 0, 1252, 896, 81924, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFGt\2\0\0\344\4\0\08\5\0\0" )  ) == 0x0
 02145   896   NtResumeThread  (628, ... 1, ) == 0x0
 02146   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ... 80478208, 1048576, ) == 0x0
 02147   896   NtAllocateVirtualMemory  (-1, 81518592, 0, 8192, 4096, 4, ... 81518592, 8192, ) == 0x0
 02142   420   NtClose  ... ) == 0x0
 02148  1336   NtWaitForSingleObject  (88, 0, 0x0, ...
 02149   420   NtClose  (-2147481484, ... ) == 0x0
 02126   420   NtQueryDefaultUILanguage  ... ) == 0x0
 02150   420   NtAllocateVirtualMemory  (-1, 14401536, 0, 4096, 4096, 260, ... 14401536, 4096, ) == 0x0
 02151   420   NtQueryInstallUILanguage  (2090319930, ... ) == 0x0
 02152   420   NtQueryDefaultLocale  (1, 14412956, ... ) == 0x0
 02153   420   NtQueryInformationProcess  (-1, Wow64, 4, ... {process info, class 26, size 4}, 0x0, ) == 0x0
 02154   896   NtProtectVirtualMemory  (-1, (0x4dbe000), 4096, 260, ... (0x4dbe000), 4096, 4, ) == 0x0
 02155   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ... 632, {1252, 1808}, ) == 0x0
 02156   896   NtQueryInformationThread  (632, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ff76000,Pid=1252,Tid=1808,}, 0x0, ) == 0x0
 02157   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81924, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81924, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFGx\2\0\0\344\4\0\0\20\7\0\0" ... {28, 56, reply, 0, 1252, 896, 81925, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFGx\2\0\0\344\4\0\0\20\7\0\0" )  ... {28, 56, reply, 0, 1252, 896, 81925, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81924, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFGx\2\0\0\344\4\0\0\20\7\0\0" ... {28, 56, reply, 0, 1252, 896, 81925, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFGx\2\0\0\344\4\0\0\20\7\0\0" )  ) == 0x0
 02158   896   NtResumeThread  (632, ... 1, ) == 0x0
 02159   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ...
 02160   420   NtOpenKey  (0x20019, {24, 28, 0x40, 0, 0,  (0x20019, {24, 28, 0x40, 0, 0, "System\Setup"}, ... }, ...
 02161  1808   NtWaitForSingleObject  (88, 0, 0x0, ...
 02160   420   NtOpenKey  ... 636, ) == 0x0
 02162   420   NtQueryValueKey  (636,  (636, "SystemSetupInProgress", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (636, "SystemSetupInProgress", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) }, 16, ) == 0x0
 02163   420   NtClose  (636, ... ) == 0x0
 02164   420   NtCreateEvent  (0x1f0003, 0x0, 1, 0, ... 636, ) == 0x0
 02165   420   NtCallbackReturn  (0, 0, 0, ...
 02159   896   NtAllocateVirtualMemory  ... 81526784, 1048576, ) == 0x0
 02166   896   NtAllocateVirtualMemory  (-1, 82567168, 0, 8192, 4096, 4, ... 82567168, 8192, ) == 0x0
 02167   896   NtProtectVirtualMemory  (-1, (0x4ebe000), 4096, 260, ... (0x4ebe000), 4096, 4, ) == 0x0
 02168   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ... 640, {1252, 468}, ) == 0x0
 02169   896   NtQueryInformationThread  (640, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ff75000,Pid=1252,Tid=468,}, 0x0, ) == 0x0
 02170   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81925, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81925, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\200\2\0\0\344\4\0\0\324\1\0\0" ... {28, 56, reply, 0, 1252, 896, 81926, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\200\2\0\0\344\4\0\0\324\1\0\0" )  ... {28, 56, reply, 0, 1252, 896, 81926, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81925, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\200\2\0\0\344\4\0\0\324\1\0\0" ... {28, 56, reply, 0, 1252, 896, 81926, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\200\2\0\0\344\4\0\0\324\1\0\0" )  ) == 0x0
 02171   420   NtUserGetProcessWindowStation  (... ) == 0x20
 02172   420   NtUserGetObjectInformation  (32, 1, 14412552, 12, 14412564, ... ) == 0x1
 02173   420   NtOpenKey  (0xf003f, {24, 28, 0x40, 0, 0,  (0xf003f, {24, 28, 0x40, 0, 0, "SYSTEM\CurrentControlSet\Control\MiniNT"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02174   420   NtOpenKey  (0x20019, {24, 28, 0x40, 0, 0,  (0x20019, {24, 28, 0x40, 0, 0, "System\WPA\PnP"}, ... 644, ) }, ... 644, ) == 0x0
 02175   420   NtQueryValueKey  (644,  (644, "seed", Partial, 144, ... TitleIdx=0, Type=4, Data="\240d\351\211"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (644, "seed", Partial, 144, ... TitleIdx=0, Type=4, Data="\240d\351\211"}, 16, ) }, 16, ) == 0x0
 02176   420   NtClose  (644, ... ) == 0x0
 02177   896   NtResumeThread  (640, ... 1, ) == 0x0
 02178   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ... 82575360, 1048576, ) == 0x0
 02179   896   NtAllocateVirtualMemory  (-1, 83615744, 0, 8192, 4096, 4, ... 83615744, 8192, ) == 0x0
 02180   896   NtProtectVirtualMemory  (-1, (0x4fbe000), 4096, 260, ... (0x4fbe000), 4096, 4, ) == 0x0
 02181   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ... 644, {1252, 752}, ) == 0x0
 02182   896   NtQueryInformationThread  (644, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ff74000,Pid=1252,Tid=752,}, 0x0, ) == 0x0
 02183   420   NtOpenKey  (0x20019, {24, 28, 0x40, 0, 0,  (0x20019, {24, 28, 0x40, 0, 0, "SYSTEM\Setup"}, ... }, ...
 02184   468   NtWaitForSingleObject  (88, 0, 0x0, ...
 02183   420   NtOpenKey  ... 648, ) == 0x0
 02185   420   NtQueryValueKey  (648,  (648, "OsLoaderPath", Partial, 144, ... TitleIdx=0, Type=1, Data="\\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (648, "OsLoaderPath", Partial, 144, ... TitleIdx=0, Type=1, Data="\\0\0\0"}, 16, ) }, 16, ) == 0x0
 02186   420   NtQueryValueKey  (648,  (648, "OsLoaderPath", Partial, 144, ... TitleIdx=0, Type=1, Data="\\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (648, "OsLoaderPath", Partial, 144, ... TitleIdx=0, Type=1, Data="\\0\0\0"}, 16, ) }, 16, ) == 0x0
 02187   420   NtClose  (648, ... ) == 0x0
 02188   420   NtOpenKey  (0x20019, {24, 28, 0x40, 0, 0,  (0x20019, {24, 28, 0x40, 0, 0, "SYSTEM\Setup"}, ... 648, ) }, ... 648, ) == 0x0
 02189   420   NtQueryValueKey  (648,  (648, "SystemPartition", Partial, 144, ... TitleIdx=0, Type=1, Data="\\0D\0e\0v\0i\0c\0e\0\\0H\0a\0r\0d\0d\0i\0s\0k\0V\0o\0l\0u\0m\0e\01\0\0\0"}, 60, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (648, "SystemPartition", Partial, 144, ... TitleIdx=0, Type=1, Data="\\0D\0e\0v\0i\0c\0e\0\\0H\0a\0r\0d\0d\0i\0s\0k\0V\0o\0l\0u\0m\0e\01\0\0\0"}, 60, ) }, 60, ) == 0x0
 02190   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81926, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81926, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\204\2\0\0\344\4\0\0\360\2\0\0" ... {28, 56, reply, 0, 1252, 896, 81927, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\204\2\0\0\344\4\0\0\360\2\0\0" )  ... {28, 56, reply, 0, 1252, 896, 81927, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81926, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\204\2\0\0\344\4\0\0\360\2\0\0" ... {28, 56, reply, 0, 1252, 896, 81927, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\204\2\0\0\344\4\0\0\360\2\0\0" )  ) == 0x0
 02191   896   NtResumeThread  (644, ... 1, ) == 0x0
 02192   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ... 83623936, 1048576, ) == 0x0
 02193   896   NtAllocateVirtualMemory  (-1, 84664320, 0, 8192, 4096, 4, ... 84664320, 8192, ) == 0x0
 02194   896   NtProtectVirtualMemory  (-1, (0x50be000), 4096, 260, ... (0x50be000), 4096, 4, ) == 0x0
 02195   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ...
 02196   420   NtQueryValueKey  (648,  (648, "SystemPartition", Partial, 144, ... , Partial, 144, ...
 02197   752   NtWaitForSingleObject  (88, 0, 0x0, ...
 02196   420   NtQueryValueKey  ... TitleIdx=0, Type=1, Data= ... TitleIdx=0, Type=1, Data="\\0D\0e\0v\0i\0c\0e\0\\0H\0a\0r\0d\0d\0i\0s\0k\0V\0o\0l\0u\0m\0e\01\0\0\0"}, 60, ) }, 60, ) == 0x0
 02198   420   NtClose  (648, ... ) == 0x0
 02199   420   NtOpenKey  (0x20019, {24, 28, 0x40, 0, 0,  (0x20019, {24, 28, 0x40, 0, 0, "Software\Microsoft\Windows\CurrentVersion\Setup"}, ... 648, ) }, ... 648, ) == 0x0
 02200   420   NtQueryValueKey  (648,  (648, "SourcePath", Partial, 144, ... TitleIdx=0, Type=1, Data="D\0:\0\\0\0\0"}, 20, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (648, "SourcePath", Partial, 144, ... TitleIdx=0, Type=1, Data="D\0:\0\\0\0\0"}, 20, ) }, 20, ) == 0x0
 02201   420   NtQueryValueKey  (648,  (648, "SourcePath", Partial, 144, ... TitleIdx=0, Type=1, Data="D\0:\0\\0\0\0"}, 20, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (648, "SourcePath", Partial, 144, ... TitleIdx=0, Type=1, Data="D\0:\0\\0\0\0"}, 20, ) }, 20, ) == 0x0
 02202   420   NtClose  (648, ... ) == 0x0
 02195   896   NtCreateThread  ... 648, {1252, 1512}, ) == 0x0
 02203   896   NtQueryInformationThread  (648, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ff73000,Pid=1252,Tid=1512,}, 0x0, ) == 0x0
 02204   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81927, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81927, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\210\2\0\0\344\4\0\0\350\5\0\0" ... {28, 56, reply, 0, 1252, 896, 81928, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\210\2\0\0\344\4\0\0\350\5\0\0" )  ... {28, 56, reply, 0, 1252, 896, 81928, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81927, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\210\2\0\0\344\4\0\0\350\5\0\0" ... {28, 56, reply, 0, 1252, 896, 81928, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\210\2\0\0\344\4\0\0\350\5\0\0" )  ) == 0x0
 02205   896   NtResumeThread  (648, ... 1, ) == 0x0
 02206   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ... 84672512, 1048576, ) == 0x0
 02207   896   NtAllocateVirtualMemory  (-1, 85712896, 0, 8192, 4096, 4, ... 85712896, 8192, ) == 0x0
 02208   420   NtOpenKey  (0x20019, {24, 28, 0x40, 0, 0,  (0x20019, {24, 28, 0x40, 0, 0, "Software\Microsoft\Windows\CurrentVersion\Setup"}, ... }, ...
 02209  1512   NtWaitForSingleObject  (88, 0, 0x0, ...
 02208   420   NtOpenKey  ... 652, ) == 0x0
 02210   420   NtQueryValueKey  (652,  (652, "ServicePackSourcePath", Partial, 144, ... TitleIdx=0, Type=1, Data="D\0:\0\\0\0\0"}, 20, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (652, "ServicePackSourcePath", Partial, 144, ... TitleIdx=0, Type=1, Data="D\0:\0\\0\0\0"}, 20, ) }, 20, ) == 0x0
 02211   420   NtQueryValueKey  (652,  (652, "ServicePackSourcePath", Partial, 144, ... TitleIdx=0, Type=1, Data="D\0:\0\\0\0\0"}, 20, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (652, "ServicePackSourcePath", Partial, 144, ... TitleIdx=0, Type=1, Data="D\0:\0\\0\0\0"}, 20, ) }, 20, ) == 0x0
 02212   420   NtClose  (652, ... ) == 0x0
 02213   420   NtOpenKey  (0x20019, {24, 28, 0x40, 0, 0,  (0x20019, {24, 28, 0x40, 0, 0, "Software\Microsoft\Windows\CurrentVersion\Setup"}, ... 652, ) }, ... 652, ) == 0x0
 02214   420   NtQueryValueKey  (652,  (652, "ServicePackCachePath", Partial, 144, ... TitleIdx=0, Type=1, Data="c\0:\0\\0w\0i\0n\0d\0o\0w\0s\0\\0S\0e\0r\0v\0i\0c\0e\0P\0a\0c\0k\0F\0i\0l\0e\0s\0\\0S\0e\0r\0v\0i\0c\0e\0P\0a\0c\0k\0C\0a\0c\0h\0e\0\0\0"}, 102, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (652, "ServicePackCachePath", Partial, 144, ... TitleIdx=0, Type=1, Data="c\0:\0\\0w\0i\0n\0d\0o\0w\0s\0\\0S\0e\0r\0v\0i\0c\0e\0P\0a\0c\0k\0F\0i\0l\0e\0s\0\\0S\0e\0r\0v\0i\0c\0e\0P\0a\0c\0k\0C\0a\0c\0h\0e\0\0\0"}, 102, ) }, 102, ) == 0x0
 02215   896   NtProtectVirtualMemory  (-1, (0x51be000), 4096, 260, ... (0x51be000), 4096, 4, ) == 0x0
 02216   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ... 656, {1252, 1380}, ) == 0x0
 02217   896   NtQueryInformationThread  (656, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ff72000,Pid=1252,Tid=1380,}, 0x0, ) == 0x0
 02218   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81928, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81928, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\220\2\0\0\344\4\0\0d\5\0\0" ... {28, 56, reply, 0, 1252, 896, 81929, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\220\2\0\0\344\4\0\0d\5\0\0" )  ... {28, 56, reply, 0, 1252, 896, 81929, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81928, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\220\2\0\0\344\4\0\0d\5\0\0" ... {28, 56, reply, 0, 1252, 896, 81929, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\220\2\0\0\344\4\0\0d\5\0\0" )  ) == 0x0
 02219   896   NtResumeThread  (656, ... 1, ) == 0x0
 02220   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ...
 02221   420   NtQueryValueKey  (652,  (652, "ServicePackCachePath", Partial, 144, ... , Partial, 144, ...
 02222  1380   NtWaitForSingleObject  (88, 0, 0x0, ...
 02221   420   NtQueryValueKey  ... TitleIdx=0, Type=1, Data= ... TitleIdx=0, Type=1, Data="c\0:\0\\0w\0i\0n\0d\0o\0w\0s\0\\0S\0e\0r\0v\0i\0c\0e\0P\0a\0c\0k\0F\0i\0l\0e\0s\0\\0S\0e\0r\0v\0i\0c\0e\0P\0a\0c\0k\0C\0a\0c\0h\0e\0\0\0"}, 102, ) }, 102, ) == 0x0
 02223   420   NtClose  (652, ... ) == 0x0
 02224   420   NtOpenKey  (0x20019, {24, 28, 0x40, 0, 0,  (0x20019, {24, 28, 0x40, 0, 0, "Software\Microsoft\Windows\CurrentVersion\Setup"}, ... 652, ) }, ... 652, ) == 0x0
 02225   420   NtQueryValueKey  (652,  (652, "DriverCachePath", Partial, 144, ... TitleIdx=0, Type=2, Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0D\0r\0i\0v\0e\0r\0 \0C\0a\0c\0h\0e\0\0\0"}, 64, ) , Partial, 144, ... TitleIdx=0, Type=2, Data= (652, "DriverCachePath", Partial, 144, ... TitleIdx=0, Type=2, Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0D\0r\0i\0v\0e\0r\0 \0C\0a\0c\0h\0e\0\0\0"}, 64, ) }, 64, ) == 0x0
 02226   420   NtQueryValueKey  (652,  (652, "DriverCachePath", Partial, 144, ... TitleIdx=0, Type=2, Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0D\0r\0i\0v\0e\0r\0 \0C\0a\0c\0h\0e\0\0\0"}, 64, ) , Partial, 144, ... TitleIdx=0, Type=2, Data= (652, "DriverCachePath", Partial, 144, ... TitleIdx=0, Type=2, Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0D\0r\0i\0v\0e\0r\0 \0C\0a\0c\0h\0e\0\0\0"}, 64, ) }, 64, ) == 0x0
 02227   420   NtClose  (652, ... ) == 0x0
 02220   896   NtAllocateVirtualMemory  ... 85721088, 1048576, ) == 0x0
 02228   896   NtAllocateVirtualMemory  (-1, 86761472, 0, 8192, 4096, 4, ... 86761472, 8192, ) == 0x0
 02229   896   NtProtectVirtualMemory  (-1, (0x52be000), 4096, 260, ... (0x52be000), 4096, 4, ) == 0x0
 02230   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ... 652, {1252, 1564}, ) == 0x0
 02231   896   NtQueryInformationThread  (652, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ff71000,Pid=1252,Tid=1564,}, 0x0, ) == 0x0
 02232   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81929, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81929, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\214\2\0\0\344\4\0\0\34\6\0\0" ... {28, 56, reply, 0, 1252, 896, 81930, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\214\2\0\0\344\4\0\0\34\6\0\0" )  ... {28, 56, reply, 0, 1252, 896, 81930, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81929, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\214\2\0\0\344\4\0\0\34\6\0\0" ... {28, 56, reply, 0, 1252, 896, 81930, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\214\2\0\0\344\4\0\0\34\6\0\0" )  ) == 0x0
 02233   420   NtOpenKey  (0x20019, {24, 28, 0x40, 0, 0,  (0x20019, {24, 28, 0x40, 0, 0, "Software\Microsoft\Windows\CurrentVersion"}, ... 660, ) }, ... 660, ) == 0x0
 02234   420   NtQueryValueKey  (660,  (660, "DevicePath", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 02235   420   NtQueryValueKey  (660,  (660, "DevicePath", Partial, 346, ... TitleIdx=0, Type=2, Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0i\0n\0f\0;\0%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0d\0e\0l\0l\0\\0a\0a\0c\0;\0%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0d\0e\0l\0l\0\\0a\0a\0r\0i\0c\0h\0;\0%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0d\0e\0l\0l\0\\0c\0e\0r\0c\0s\0r\06\0;\0%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0d\0e\0l\0l\0\\0a\03\02\00\0r\0a\0i\0d\0;\0%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0d\0e\0l\0l\0\\0i\0a\0s\0t\0o\0r\0;\0%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0d\0e\0l\0l\0\\0n\0v\0r\0a\0i\0d\0\0\0"}, 346, ) , Partial, 346, ... TitleIdx=0, Type=2, Data= (660, "DevicePath", Partial, 346, ... TitleIdx=0, Type=2, Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0i\0n\0f\0;\0%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0d\0e\0l\0l\0\\0a\0a\0c\0;\0%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0d\0e\0l\0l\0\\0a\0a\0r\0i\0c\0h\0;\0%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0d\0e\0l\0l\0\\0c\0e\0r\0c\0s\0r\06\0;\0%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0d\0e\0l\0l\0\\0a\03\02\00\0r\0a\0i\0d\0;\0%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0d\0e\0l\0l\0\\0i\0a\0s\0t\0o\0r\0;\0%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0d\0e\0l\0l\0\\0n\0v\0r\0a\0i\0d\0\0\0"}, 346, ) }, 346, ) == 0x0
 02236   420   NtAllocateVirtualMemory  (-1, 1404928, 0, 4096, 4096, 4, ... 1404928, 4096, ) == 0x0
 02237   420   NtClose  (660, ... ) == 0x0
 02238   420   NtCreateEvent  (0x1f0003, 0x0, 0, 0, ... 660, ) == 0x0
 02239   896   NtResumeThread  (652, ... 1, ) == 0x0
 02240   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ... 86769664, 1048576, ) == 0x0
 02241   896   NtAllocateVirtualMemory  (-1, 87810048, 0, 8192, 4096, 4, ... 87810048, 8192, ) == 0x0
 02242   896   NtProtectVirtualMemory  (-1, (0x53be000), 4096, 260, ... (0x53be000), 4096, 4, ) == 0x0
 02243   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ... 664, {1252, 164}, ) == 0x0
 02244   896   NtQueryInformationThread  (664, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ff70000,Pid=1252,Tid=164,}, 0x0, ) == 0x0
 02245   420   NtCreateMutant  (0x1f0001, 0x0, 0, ...
 02246  1564   NtWaitForSingleObject  (88, 0, 0x0, ...
 02245   420   NtCreateMutant  ... 668, ) == 0x0
 02247   420   NtCreateEvent  (0x1f0003, 0x0, 0, 0, ... 672, ) == 0x0
 02248   420   NtCreateMutant  (0x1f0001, 0x0, 0, ... 676, ) == 0x0
 02249   420   NtCreateEvent  (0x1f0003, 0x0, 0, 0, ... 680, ) == 0x0
 02250   420   NtCreateMutant  (0x1f0001, 0x0, 0, ... 684, ) == 0x0
 02251   420   NtOpenKey  (0x1, {24, 28, 0x40, 0, 0,  (0x1, {24, 28, 0x40, 0, 0, "Software\Microsoft\Windows\CurrentVersion\Setup"}, ... 688, ) }, ... 688, ) == 0x0
 02252   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81930, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81930, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\230\2\0\0\344\4\0\0\244\0\0\0" ... {28, 56, reply, 0, 1252, 896, 81931, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\230\2\0\0\344\4\0\0\244\0\0\0" )  ... {28, 56, reply, 0, 1252, 896, 81931, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81930, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\230\2\0\0\344\4\0\0\244\0\0\0" ... {28, 56, reply, 0, 1252, 896, 81931, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\230\2\0\0\344\4\0\0\244\0\0\0" )  ) == 0x0
 02253   896   NtResumeThread  (664, ... 1, ) == 0x0
 02254   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ... 87818240, 1048576, ) == 0x0
 02255   896   NtAllocateVirtualMemory  (-1, 88858624, 0, 8192, 4096, 4, ... 88858624, 8192, ) == 0x0
 02256   896   NtProtectVirtualMemory  (-1, (0x54be000), 4096, 260, ... (0x54be000), 4096, 4, ) == 0x0
 02257   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ...
 02258   420   NtQueryValueKey  (688,  (688, "LogLevel", Partial, 144, ... , Partial, 144, ...
 02259   164   NtWaitForSingleObject  (88, 0, 0x0, ...
 02258   420   NtQueryValueKey  ... TitleIdx=0, Type=4, Data= ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) }, 16, ) == 0x0
 02260   420   NtQueryValueKey  (688,  (688, "LogLevel", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (688, "LogLevel", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) }, 16, ) == 0x0
 02261   420   NtQueryValueKey  (688,  (688, "LogPath", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02262   420   NtOpenKey  (0x1, {24, 688, 0x40, 0, 0,  (0x1, {24, 688, 0x40, 0, 0, "AppLogLevels"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02263   420   NtClose  (688, ... ) == 0x0
 02264   420   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\"}, 14412468, ... ) }, 14412468, ... ) == 0x0
 02257   896   NtCreateThread  ... 688, {1252, 312}, ) == 0x0
 02265   896   NtQueryInformationThread  (688, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ff6f000,Pid=1252,Tid=312,}, 0x0, ) == 0x0
 02266   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81931, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81931, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\260\2\0\0\344\4\0\08\1\0\0" ... {28, 56, reply, 0, 1252, 896, 81932, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\260\2\0\0\344\4\0\08\1\0\0" )  ... {28, 56, reply, 0, 1252, 896, 81932, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81931, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\260\2\0\0\344\4\0\08\1\0\0" ... {28, 56, reply, 0, 1252, 896, 81932, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\260\2\0\0\344\4\0\08\1\0\0" )  ) == 0x0
 02267   896   NtResumeThread  (688, ... 1, ) == 0x0
 02268   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ... 88866816, 1048576, ) == 0x0
 02269   896   NtAllocateVirtualMemory  (-1, 89907200, 0, 8192, 4096, 4, ... 89907200, 8192, ) == 0x0
 02270   420   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\System\CurrentControlSet\Control\ComputerName\ActiveComputerName"}, ... }, ...
 02271   312   NtWaitForSingleObject  (88, 0, 0x0, ...
 02270   420   NtOpenKey  ... 692, ) == 0x0
 02272   420   NtQueryValueKey  (692,  (692, "ComputerName", Full, 128, ... TitleIdx=0, Type=1, Name="ComputerName", Data="V\0I\0R\0T\0U\0A\0L\0\0\0"}, 60, ) , Full, 128, ... TitleIdx=0, Type=1, Name= (692, "ComputerName", Full, 128, ... TitleIdx=0, Type=1, Name="ComputerName", Data="V\0I\0R\0T\0U\0A\0L\0\0\0"}, 60, ) , Data= (692, "ComputerName", Full, 128, ... TitleIdx=0, Type=1, Name="ComputerName", Data="V\0I\0R\0T\0U\0A\0L\0\0\0"}, 60, ) }, 60, ) == 0x0
 02273   420   NtClose  (692, ... ) == 0x0
 02274   420   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\System\CurrentControlSet\Services\Tcpip\Parameters"}, ... 692, ) }, ... 692, ) == 0x0
 02275   420   NtQueryValueKey  (692,  (692, "Hostname", Full, 128, ... TitleIdx=0, Type=1, Name="Hostname", Data="v\0i\0r\0t\0u\0a\0l\0\0\0"}, 52, ) , Full, 128, ... TitleIdx=0, Type=1, Name= (692, "Hostname", Full, 128, ... TitleIdx=0, Type=1, Name="Hostname", Data="v\0i\0r\0t\0u\0a\0l\0\0\0"}, 52, ) , Data= (692, "Hostname", Full, 128, ... TitleIdx=0, Type=1, Name="Hostname", Data="v\0i\0r\0t\0u\0a\0l\0\0\0"}, 52, ) }, 52, ) == 0x0
 02276   420   NtClose  (692, ... ) == 0x0
 02277   896   NtProtectVirtualMemory  (-1, (0x55be000), 4096, 260, ... (0x55be000), 4096, 4, ) == 0x0
 02278   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ... 692, {1252, 1964}, ) == 0x0
 02279   896   NtQueryInformationThread  (692, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ff6e000,Pid=1252,Tid=1964,}, 0x0, ) == 0x0
 02280   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81932, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81932, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\264\2\0\0\344\4\0\0\254\7\0\0" ... {28, 56, reply, 0, 1252, 896, 81933, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\264\2\0\0\344\4\0\0\254\7\0\0" )  ... {28, 56, reply, 0, 1252, 896, 81933, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81932, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\264\2\0\0\344\4\0\0\254\7\0\0" ... {28, 56, reply, 0, 1252, 896, 81933, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\264\2\0\0\344\4\0\0\254\7\0\0" )  ) == 0x0
 02281   896   NtResumeThread  (692, ... 1, ) == 0x0
 02282   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ...
 02283   420   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Policies\Microsoft\System\DNSclient"}, ... }, ...
 02284  1964   NtWaitForSingleObject  (88, 0, 0x0, ...
 02283   420   NtOpenKey  ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02285   420   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\System\CurrentControlSet\Services\Tcpip\Parameters"}, ... 696, ) }, ... 696, ) == 0x0
 02286   420   NtQueryValueKey  (696,  (696, "Domain", Full, 128, ... TitleIdx=0, Type=1, Name="Domain", Data="\0\0"}, 34, ) , Full, 128, ... TitleIdx=0, Type=1, Name= (696, "Domain", Full, 128, ... TitleIdx=0, Type=1, Name="Domain", Data="\0\0"}, 34, ) , Data= (696, "Domain", Full, 128, ... TitleIdx=0, Type=1, Name="Domain", Data="\0\0"}, 34, ) }, 34, ) == 0x0
 02287   420   NtClose  (696, ... ) == 0x0
 02288   420   NtOpenKey  (0x80000000, {24, 0, 0x40, 0, 0,  (0x80000000, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wshbth.dll"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02289   420   NtSetEventBoostPriority  (88, ...
 01970  1484   NtWaitForSingleObject  ... ) == 0x0
 02290  1484   NtSetEventBoostPriority  (88, ...
 01982   888   NtWaitForSingleObject  ... ) == 0x0
 02291   888   NtSetEventBoostPriority  (88, ...
 01994  1120   NtWaitForSingleObject  ... ) == 0x0
 02292  1120   NtSetEventBoostPriority  (88, ...
 02007   840   NtWaitForSingleObject  ... ) == 0x0
 02293   840   NtSetEventBoostPriority  (88, ...
 02014   876   NtWaitForSingleObject  ... ) == 0x0
 02294   876   NtSetEventBoostPriority  (88, ...
 02023  1104   NtWaitForSingleObject  ... ) == 0x0
 02295  1104   NtSetEventBoostPriority  (88, ...
 02030   860   NtWaitForSingleObject  ... ) == 0x0
 02296   860   NtSetEventBoostPriority  (88, ...
 02038  1516   NtWaitForSingleObject  ... ) == 0x0
 02297  1516   NtSetEventBoostPriority  (88, ...
 02047   780   NtWaitForSingleObject  ... ) == 0x0
 02298   780   NtSetEventBoostPriority  (88, ...
 02054   940   NtWaitForSingleObject  ... ) == 0x0
 02299   940   NtSetEventBoostPriority  (88, ...
 02067  1268   NtWaitForSingleObject  ... ) == 0x0
 02300  1268   NtSetEventBoostPriority  (88, ...
 02080   644   NtWaitForSingleObject  ... ) == 0x0
 02301   644   NtSetEventBoostPriority  (88, ...
 02091  1736   NtWaitForSingleObject  ... ) == 0x0
 02302  1736   NtSetEventBoostPriority  (88, ...
 02104   320   NtWaitForSingleObject  ... ) == 0x0
 02303   320   NtSetEventBoostPriority  (88, ...
 02120   380   NtWaitForSingleObject  ... ) == 0x0
 02304   380   NtSetEventBoostPriority  (88, ...
 02136  1332   NtWaitForSingleObject  ... ) == 0x0
 02305  1332   NtSetEventBoostPriority  (88, ...
 02148  1336   NtWaitForSingleObject  ... ) == 0x0
 02306  1336   NtSetEventBoostPriority  (88, ...
 02161  1808   NtWaitForSingleObject  ... ) == 0x0
 02307  1808   NtSetEventBoostPriority  (88, ...
 02184   468   NtWaitForSingleObject  ... ) == 0x0
 02308   468   NtSetEventBoostPriority  (88, ...
 02197   752   NtWaitForSingleObject  ... ) == 0x0
 02309   752   NtSetEventBoostPriority  (88, ...
 02209  1512   NtWaitForSingleObject  ... ) == 0x0
 02310  1512   NtSetEventBoostPriority  (88, ...
 02222  1380   NtWaitForSingleObject  ... ) == 0x0
 02311  1380   NtSetEventBoostPriority  (88, ...
 02246  1564   NtWaitForSingleObject  ... ) == 0x0
 02312  1564   NtSetEventBoostPriority  (88, ...
 02259   164   NtWaitForSingleObject  ... ) == 0x0
 02313   164   NtSetEventBoostPriority  (88, ...
 02271   312   NtWaitForSingleObject  ... ) == 0x0
 02314   312   NtSetEventBoostPriority  (88, ...
 02284  1964   NtWaitForSingleObject  ... ) == 0x0
 02315  1964   NtTestAlert  (... ) == 0x0
 02314   312   NtSetEventBoostPriority  ... ) == 0x0
 02313   164   NtSetEventBoostPriority  ... ) == 0x0
 02312  1564   NtSetEventBoostPriority  ... ) == 0x0
 02311  1380   NtSetEventBoostPriority  ... ) == 0x0
 02310  1512   NtSetEventBoostPriority  ... ) == 0x0
 02309   752   NtSetEventBoostPriority  ... ) == 0x0
 02308   468   NtSetEventBoostPriority  ... ) == 0x0
 02307  1808   NtSetEventBoostPriority  ... ) == 0x0
 02306  1336   NtSetEventBoostPriority  ... ) == 0x0
 02305  1332   NtSetEventBoostPriority  ... ) == 0x0
 02304   380   NtSetEventBoostPriority  ... ) == 0x0
 02303   320   NtSetEventBoostPriority  ... ) == 0x0
 02302  1736   NtSetEventBoostPriority  ... ) == 0x0
 02301   644   NtSetEventBoostPriority  ... ) == 0x0
 02300  1268   NtSetEventBoostPriority  ... ) == 0x0
 02299   940   NtSetEventBoostPriority  ... ) == 0x0
 02298   780   NtSetEventBoostPriority  ... ) == 0x0
 02297  1516   NtSetEventBoostPriority  ... ) == 0x0
 02296   860   NtSetEventBoostPriority  ... ) == 0x0
 02295  1104   NtSetEventBoostPriority  ... ) == 0x0
 02294   876   NtSetEventBoostPriority  ... ) == 0x0
 02293   840   NtSetEventBoostPriority  ... ) == 0x0
 02292  1120   NtSetEventBoostPriority  ... ) == 0x0
 02291   888   NtSetEventBoostPriority  ... ) == 0x0
 02290  1484   NtSetEventBoostPriority  ... ) == 0x0
 02289   420   NtSetEventBoostPriority  ... ) == 0x0
 02282   896   NtAllocateVirtualMemory  ... 89915392, 1048576, ) == 0x0
 02316  1964   NtContinue  (89914672, 1, ...
 02317   312   NtTestAlert  (...
 02318   164   NtTestAlert  (...
 02319  1564   NtTestAlert  (...
 02320  1380   NtTestAlert  (...
 02321  1512   NtTestAlert  (...
 02322   752   NtTestAlert  (...
 02323   468   NtTestAlert  (...
 02324  1808   NtTestAlert  (...
 02325  1336   NtTestAlert  (...
 02326  1332   NtTestAlert  (...
 02327   380   NtTestAlert  (...
 02328   320   NtTestAlert  (...
 02329  1736   NtTestAlert  (...
 02330   644   NtTestAlert  (...
 02331  1268   NtTestAlert  (...
 02332   940   NtTestAlert  (...
 02333   780   NtTestAlert  (...
 02334  1516   NtTestAlert  (...
 02335   860   NtTestAlert  (...
 02336  1104   NtTestAlert  (...
 02337   876   NtTestAlert  (...
 02338   840   NtTestAlert  (...
 02339  1120   NtTestAlert  (...
 02340   888   NtTestAlert  (...
 02341  1484   NtTestAlert  (...
 02342   896   NtAllocateVirtualMemory  (-1, 90955776, 0, 8192, 4096, 4, ...
 02343  1964   NtRegisterThreadTerminatePort  (24, ...
 02317   312   NtTestAlert  ... ) == 0x0
 02318   164   NtTestAlert  ... ) == 0x0
 02319  1564   NtTestAlert  ... ) == 0x0
 02320  1380   NtTestAlert  ... ) == 0x0
 02321  1512   NtTestAlert  ... ) == 0x0
 02322   752   NtTestAlert  ... ) == 0x0
 02323   468   NtTestAlert  ... ) == 0x0
 02324  1808   NtTestAlert  ... ) == 0x0
 02325  1336   NtTestAlert  ... ) == 0x0
 02326  1332   NtTestAlert  ... ) == 0x0
 02327   380   NtTestAlert  ... ) == 0x0
 02328   320   NtTestAlert  ... ) == 0x0
 02329  1736   NtTestAlert  ... ) == 0x0
 02330   644   NtTestAlert  ... ) == 0x0
 02331  1268   NtTestAlert  ... ) == 0x0
 02332   940   NtTestAlert  ... ) == 0x0
 02333   780   NtTestAlert  ... ) == 0x0
 02334  1516   NtTestAlert  ... ) == 0x0
 02335   860   NtTestAlert  ... ) == 0x0
 02336  1104   NtTestAlert  ... ) == 0x0
 02337   876   NtTestAlert  ... ) == 0x0
 02338   840   NtTestAlert  ... ) == 0x0
 02339  1120   NtTestAlert  ... ) == 0x0
 02340   888   NtTestAlert  ... ) == 0x0
 02341  1484   NtTestAlert  ... ) == 0x0
 02342   896   NtAllocateVirtualMemory  ... 90955776, 8192, ) == 0x0
 02343  1964   NtRegisterThreadTerminatePort  ... ) == 0x0
 02344   312   NtContinue  (88866096, 1, ...
 02345   164   NtContinue  (87817520, 1, ...
 02346  1564   NtContinue  (86768944, 1, ...
 02347  1380   NtContinue  (85720368, 1, ...
 02348  1512   NtContinue  (84671792, 1, ...
 02349   752   NtContinue  (83623216, 1, ...
 02350   468   NtContinue  (82574640, 1, ...
 02351  1808   NtContinue  (81526064, 1, ...
 02352  1336   NtContinue  (80477488, 1, ...
 02353  1332   NtContinue  (79428912, 1, ...
 02354   380   NtContinue  (78380336, 1, ...
 02355   320   NtContinue  (77331760, 1, ...
 02356  1736   NtContinue  (76283184, 1, ...
 02357   644   NtContinue  (75234608, 1, ...
 02358  1268   NtContinue  (74186032, 1, ...
 02359   940   NtContinue  (73137456, 1, ...
 02360   780   NtContinue  (72088880, 1, ...
 02361  1516   NtContinue  (71040304, 1, ...
 02362   860   NtContinue  (69991728, 1, ...
 02363  1104   NtContinue  (68943152, 1, ...
 02364   876   NtContinue  (67894576, 1, ...
 02365   840   NtContinue  (66846000, 1, ...
 02366  1120   NtContinue  (65797424, 1, ...
 02367   888   NtContinue  (64748848, 1, ...
 02368  1484   NtContinue  (63700272, 1, ...
 02369   896   NtProtectVirtualMemory  (-1, (0x56be000), 4096, 260, ...
 02370  1964   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 02371   312   NtRegisterThreadTerminatePort  (24, ...
 02372   164   NtRegisterThreadTerminatePort  (24, ...
 02373  1564   NtRegisterThreadTerminatePort  (24, ...
 02374  1380   NtRegisterThreadTerminatePort  (24, ...
 02375  1512   NtRegisterThreadTerminatePort  (24, ...
 02376   752   NtRegisterThreadTerminatePort  (24, ...
 02377   468   NtRegisterThreadTerminatePort  (24, ...
 02378  1808   NtRegisterThreadTerminatePort  (24, ...
 02379  1336   NtRegisterThreadTerminatePort  (24, ...
 02380  1332   NtRegisterThreadTerminatePort  (24, ...
 02381   380   NtRegisterThreadTerminatePort  (24, ...
 02382   320   NtRegisterThreadTerminatePort  (24, ...
 02383  1736   NtRegisterThreadTerminatePort  (24, ...
 02384   644   NtRegisterThreadTerminatePort  (24, ...
 02385  1268   NtRegisterThreadTerminatePort  (24, ...
 02386   940   NtRegisterThreadTerminatePort  (24, ...
 02387   780   NtRegisterThreadTerminatePort  (24, ...
 02388  1516   NtRegisterThreadTerminatePort  (24, ...
 02389   860   NtRegisterThreadTerminatePort  (24, ...
 02390  1104   NtRegisterThreadTerminatePort  (24, ...
 02391   876   NtRegisterThreadTerminatePort  (24, ...
 02392   840   NtRegisterThreadTerminatePort  (24, ...
 02393  1120   NtRegisterThreadTerminatePort  (24, ...
 02394   888   NtRegisterThreadTerminatePort  (24, ...
 02395  1484   NtRegisterThreadTerminatePort  (24, ...
 02369   896   NtProtectVirtualMemory  ... (0x56be000), 4096, 4, ) == 0x0
 02370  1964   NtDuplicateObject  ... 696, ) == 0x0
 02371   312   NtRegisterThreadTerminatePort  ... ) == 0x0
 02372   164   NtRegisterThreadTerminatePort  ... ) == 0x0
 02373  1564   NtRegisterThreadTerminatePort  ... ) == 0x0
 02374  1380   NtRegisterThreadTerminatePort  ... ) == 0x0
 02375  1512   NtRegisterThreadTerminatePort  ... ) == 0x0
 02376   752   NtRegisterThreadTerminatePort  ... ) == 0x0
 02377   468   NtRegisterThreadTerminatePort  ... ) == 0x0
 02378  1808   NtRegisterThreadTerminatePort  ... ) == 0x0
 02379  1336   NtRegisterThreadTerminatePort  ... ) == 0x0
 02380  1332   NtRegisterThreadTerminatePort  ... ) == 0x0
 02381   380   NtRegisterThreadTerminatePort  ... ) == 0x0
 02382   320   NtRegisterThreadTerminatePort  ... ) == 0x0
 02383  1736   NtRegisterThreadTerminatePort  ... ) == 0x0
 02384   644   NtRegisterThreadTerminatePort  ... ) == 0x0
 02385  1268   NtRegisterThreadTerminatePort  ... ) == 0x0
 02386   940   NtRegisterThreadTerminatePort  ... ) == 0x0
 02387   780   NtRegisterThreadTerminatePort  ... ) == 0x0
 02388  1516   NtRegisterThreadTerminatePort  ... ) == 0x0
 02389   860   NtRegisterThreadTerminatePort  ... ) == 0x0
 02390  1104   NtRegisterThreadTerminatePort  ... ) == 0x0
 02391   876   NtRegisterThreadTerminatePort  ... ) == 0x0
 02392   840   NtRegisterThreadTerminatePort  ... ) == 0x0
 02393  1120   NtRegisterThreadTerminatePort  ... ) == 0x0
 02394   888   NtRegisterThreadTerminatePort  ... ) == 0x0
 02395  1484   NtRegisterThreadTerminatePort  ... ) == 0x0
 02396   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ...
 02397  1964   NtWaitForSingleObject  (64, 0, {0, 0}, ...
 02398   312   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 02399   164   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 02400  1564   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 02401  1380   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 02402  1512   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 02403   752   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 02404   468   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 02405  1808   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 02406  1336   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 02407  1332   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 02408   380   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 02409   320   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 02410  1736   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 02411   644   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 02412  1268   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 02413   940   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 02414   780   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 02415  1516   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 02416   860   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 02417  1104   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 02418   876   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 02419   840   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 02420  1120   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 02421   888   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 02422  1484   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 02423   420   NtSetEventBoostPriority  (120, ...
 02396   896   NtCreateThread  ... 700, {1252, 1568}, ) == 0x0
 02397  1964   NtWaitForSingleObject  ... ) == 0x102
 02398   312   NtDuplicateObject  ... 704, ) == 0x0
 02399   164   NtDuplicateObject  ... 708, ) == 0x0
 02400  1564   NtDuplicateObject  ... 712, ) == 0x0
 02401  1380   NtDuplicateObject  ... 716, ) == 0x0
 02402  1512   NtDuplicateObject  ... 720, ) == 0x0
 02403   752   NtDuplicateObject  ... 724, ) == 0x0
 02404   468   NtDuplicateObject  ... 728, ) == 0x0
 02405  1808   NtDuplicateObject  ... 732, ) == 0x0
 02406  1336   NtDuplicateObject  ... 736, ) == 0x0
 02407  1332   NtDuplicateObject  ... 740, ) == 0x0
 02408   380   NtDuplicateObject  ... 744, ) == 0x0
 02409   320   NtDuplicateObject  ... 748, ) == 0x0
 02410  1736   NtDuplicateObject  ... 752, ) == 0x0
 02411   644   NtDuplicateObject  ... 756, ) == 0x0
 02412  1268   NtDuplicateObject  ... 760, ) == 0x0
 02413   940   NtDuplicateObject  ... 764, ) == 0x0
 02414   780   NtDuplicateObject  ... 768, ) == 0x0
 02415  1516   NtDuplicateObject  ... 772, ) == 0x0
 02416   860   NtDuplicateObject  ... 776, ) == 0x0
 02417  1104   NtDuplicateObject  ... 780, ) == 0x0
 02418   876   NtDuplicateObject  ... 784, ) == 0x0
 02419   840   NtDuplicateObject  ... 788, ) == 0x0
 02420  1120   NtDuplicateObject  ... 792, ) == 0x0
 02421   888   NtDuplicateObject  ... 796, ) == 0x0
 00846   376   NtWaitForSingleObject  ... ) == 0x0
 02423   420   NtSetEventBoostPriority  ... ) == 0x0
 02424   896   NtQueryInformationThread  (700, Basic, 28, ...
 02425  1964   NtWaitForSingleObject  (120, 0, 0x0, ...
 02426   312   NtWaitForSingleObject  (64, 0, {0, 0}, ...
 02427   164   NtWaitForSingleObject  (64, 0, {0, 0}, ...
 02428  1564   NtWaitForSingleObject  (64, 0, {0, 0}, ...
 02429  1380   NtWaitForSingleObject  (64, 0, {0, 0}, ...
 02430  1512   NtWaitForSingleObject  (64, 0, {0, 0}, ...
 02431   752   NtWaitForSingleObject  (64, 0, {0, 0}, ...
 02432   468   NtWaitForSingleObject  (64, 0, {0, 0}, ...
 02433  1808   NtWaitForSingleObject  (64, 0, {0, 0}, ...
 02434  1336   NtWaitForSingleObject  (64, 0, {0, 0}, ...
 02435  1332   NtWaitForSingleObject  (64, 0, {0, 0}, ...
 02436   380   NtAllocateVirtualMemory  (-1, 1409024, 0, 4096, 4096, 4, ...
 02437   320   NtWaitForSingleObject  (296, 0, 0x0, ...
 02438  1736   NtWaitForSingleObject  (296, 0, 0x0, ...
 02439   644   NtWaitForSingleObject  (296, 0, 0x0, ...
 02440  1268   NtWaitForSingleObject  (296, 0, 0x0, ...
 02441   940   NtWaitForSingleObject  (296, 0, 0x0, ...
 02442   780   NtWaitForSingleObject  (296, 0, 0x0, ...
 02443  1516   NtWaitForSingleObject  (296, 0, 0x0, ...
 02444   860   NtWaitForSingleObject  (296, 0, 0x0, ...
 02445  1104   NtWaitForSingleObject  (296, 0, 0x0, ...
 02446   876   NtWaitForSingleObject  (296, 0, 0x0, ...
 02447   840   NtWaitForSingleObject  (296, 0, 0x0, ...
 02448  1120   NtWaitForSingleObject  (296, 0, 0x0, ...
 02449   376   NtWaitForSingleObject  (296, 0, 0x0, ...
 02450   888   NtWaitForSingleObject  (296, 0, 0x0, ...
 02451   420   NtWaitForSingleObject  (296, 0, 0x0, ...
 02424   896   NtQueryInformationThread  ... {ExitStatus=0x103,TebBaseAddress=0x7ff6d000,Pid=1252,Tid=1568,}, 0x0, ) == 0x0
 02426   312   NtWaitForSingleObject  ... ) == 0x102
 02427   164   NtWaitForSingleObject  ... ) == 0x102
 02428  1564   NtWaitForSingleObject  ... ) == 0x102
 02429  1380   NtWaitForSingleObject  ... ) == 0x102
 02430  1512   NtWaitForSingleObject  ... ) == 0x102
 02431   752   NtWaitForSingleObject  ... ) == 0x102
 02432   468   NtWaitForSingleObject  ... ) == 0x102
 02433  1808   NtWaitForSingleObject  ... ) == 0x102
 02434  1336   NtWaitForSingleObject  ... ) == 0x102
 02435  1332   NtWaitForSingleObject  ... ) == 0x102
 02436   380   NtAllocateVirtualMemory  ... 1409024, 4096, ) == 0x0
 02452   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81933, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81933, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\274\2\0\0\344\4\0\0 \6\0\0" ...  ...
 02453   312   NtWaitForSingleObject  (296, 0, 0x0, ...
 02454   164   NtWaitForSingleObject  (296, 0, 0x0, ...
 02455  1564   NtWaitForSingleObject  (296, 0, 0x0, ...
 02456  1380   NtWaitForSingleObject  (296, 0, 0x0, ...
 02457  1512   NtWaitForSingleObject  (296, 0, 0x0, ...
 02458   752   NtWaitForSingleObject  (296, 0, 0x0, ...
 02459   468   NtWaitForSingleObject  (296, 0, 0x0, ...
 02460  1808   NtWaitForSingleObject  (296, 0, 0x0, ...
 02461  1336   NtWaitForSingleObject  (296, 0, 0x0, ...
 02462  1332   NtWaitForSingleObject  (296, 0, 0x0, ...
 02463   380   NtSetEventBoostPriority  (296, ...
 02452   896   NtRequestWaitReplyPort  ... {28, 56, reply, 0, 1252, 896, 81934, 0}  ... {28, 56, reply, 0, 1252, 896, 81934, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\274\2\0\0\344\4\0\0 \6\0\0" )  ) == 0x0
 02437   320   NtWaitForSingleObject  ... ) == 0x0
 02463   380   NtSetEventBoostPriority  ... ) == 0x0
 02422  1484   NtDuplicateObject  ... 800, ) == 0x0
 02464   320   NtSetEventBoostPriority  (296, ...
 02465   380   NtWaitForSingleObject  (296, 0, 0x0, ...
 02438  1736   NtWaitForSingleObject  ... ) == 0x0
 02464   320   NtSetEventBoostPriority  ... ) == 0x0
 02466  1484   NtWaitForSingleObject  (296, 0, 0x0, ...
 02467   896   NtResumeThread  (700, ...
 02468  1736   NtSetEventBoostPriority  (296, ...
 02439   644   NtWaitForSingleObject  ... ) == 0x0
 02469   644   NtSetEventBoostPriority  (296, ...
 02440  1268   NtWaitForSingleObject  ... ) == 0x0
 02470  1268   NtSetEventBoostPriority  (296, ...
 02441   940   NtWaitForSingleObject  ... ) == 0x0
 02471   940   NtSetEventBoostPriority  (296, ...
 02442   780   NtWaitForSingleObject  ... ) == 0x0
 02472   780   NtSetEventBoostPriority  (296, ...
 02443  1516   NtWaitForSingleObject  ... ) == 0x0
 02473  1516   NtSetEventBoostPriority  (296, ...
 02444   860   NtWaitForSingleObject  ... ) == 0x0
 02474   860   NtSetEventBoostPriority  (296, ...
 02445  1104   NtWaitForSingleObject  ... ) == 0x0
 02475  1104   NtSetEventBoostPriority  (296, ...
 02446   876   NtWaitForSingleObject  ... ) == 0x0
 02476   876   NtSetEventBoostPriority  (296, ...
 02447   840   NtWaitForSingleObject  ... ) == 0x0
 02477   840   NtSetEventBoostPriority  (296, ...
 02449   376   NtWaitForSingleObject  ... ) == 0x0
 02478   376   NtSetEventBoostPriority  (296, ...
 02448  1120   NtWaitForSingleObject  ... ) == 0x0
 02479  1120   NtSetEventBoostPriority  (296, ...
 02450   888   NtWaitForSingleObject  ... ) == 0x0
 02480   888   NtSetEventBoostPriority  (296, ...
 02451   420   NtWaitForSingleObject  ... ) == 0x0
 02481   420   NtSetEventBoostPriority  (296, ...
 02453   312   NtWaitForSingleObject  ... ) == 0x0
 02482   312   NtSetEventBoostPriority  (296, ...
 02454   164   NtWaitForSingleObject  ... ) == 0x0
 02483   164   NtSetEventBoostPriority  (296, ...
 02455  1564   NtWaitForSingleObject  ... ) == 0x0
 02484  1564   NtSetEventBoostPriority  (296, ...
 02456  1380   NtWaitForSingleObject  ... ) == 0x0
 02485  1380   NtSetEventBoostPriority  (296, ...
 02457  1512   NtWaitForSingleObject  ... ) == 0x0
 02486  1512   NtSetEventBoostPriority  (296, ...
 02458   752   NtWaitForSingleObject  ... ) == 0x0
 02487   752   NtSetEventBoostPriority  (296, ...
 02459   468   NtWaitForSingleObject  ... ) == 0x0
 02488   468   NtAllocateVirtualMemory  (-1, 1413120, 0, 4096, 4096, 4, ... 1413120, 4096, ) == 0x0
 02487   752   NtSetEventBoostPriority  ... ) == 0x0
 02486  1512   NtSetEventBoostPriority  ... ) == 0x0
 02485  1380   NtSetEventBoostPriority  ... ) == 0x0
 02484  1564   NtSetEventBoostPriority  ... ) == 0x0
 02483   164   NtSetEventBoostPriority  ... ) == 0x0
 02482   312   NtSetEventBoostPriority  ... ) == 0x0
 02481   420   NtSetEventBoostPriority  ... ) == 0x0
 02480   888   NtSetEventBoostPriority  ... ) == 0x0
 02479  1120   NtSetEventBoostPriority  ... ) == 0x0
 02478   376   NtSetEventBoostPriority  ... ) == 0x0
 02477   840   NtSetEventBoostPriority  ... ) == 0x0
 02476   876   NtSetEventBoostPriority  ... ) == 0x0
 02475  1104   NtSetEventBoostPriority  ... ) == 0x0
 02474   860   NtSetEventBoostPriority  ... ) == 0x0
 02473  1516   NtSetEventBoostPriority  ... ) == 0x0
 02472   780   NtSetEventBoostPriority  ... ) == 0x0
 02471   940   NtSetEventBoostPriority  ... ) == 0x0
 02470  1268   NtSetEventBoostPriority  ... ) == 0x0
 02469   644   NtSetEventBoostPriority  ... ) == 0x0
 02468  1736   NtSetEventBoostPriority  ... ) == 0x0
 02467   896   NtResumeThread  ... 1, ) == 0x0
 02489   320   NtWaitForSingleObject  (296, 0, 0x0, ...
 02490   468   NtSetEventBoostPriority  (296, ...
 02491  1568   NtWaitForSingleObject  (296, 0, 0x0, ...
 02492   752   NtWaitForSingleObject  (120, 0, 0x0, ...
 02493  1512   NtWaitForSingleObject  (120, 0, 0x0, ...
 02494  1380   NtWaitForSingleObject  (120, 0, 0x0, ...
 02495  1564   NtWaitForSingleObject  (120, 0, 0x0, ...
 02496   164   NtWaitForSingleObject  (120, 0, 0x0, ...
 02497   312   NtWaitForSingleObject  (120, 0, 0x0, ...
 02498   420   NtWaitForSingleObject  (296, 0, 0x0, ...
 02499   888   NtWaitForSingleObject  (296, 0, 0x0, ...
 02500  1120   NtWaitForSingleObject  (296, 0, 0x0, ...
 02501   376   NtWaitForSingleObject  (296, 0, 0x0, ...
 02502   840   NtWaitForSingleObject  (296, 0, 0x0, ...
 02503   876   NtWaitForSingleObject  (296, 0, 0x0, ...
 02504  1104   NtWaitForSingleObject  (296, 0, 0x0, ...
 02505   860   NtWaitForSingleObject  (296, 0, 0x0, ...
 02506  1516   NtWaitForSingleObject  (296, 0, 0x0, ...
 02507   780   NtWaitForSingleObject  (296, 0, 0x0, ...
 02508   940   NtWaitForSingleObject  (296, 0, 0x0, ...
 02509  1268   NtWaitForSingleObject  (296, 0, 0x0, ...
 02510   644   NtWaitForSingleObject  (296, 0, 0x0, ...
 02511   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ...
 02460  1808   NtWaitForSingleObject  ... ) == 0x0
 02490   468   NtSetEventBoostPriority  ... ) == 0x0
 02512  1808   NtSetEventBoostPriority  (296, ...
 02511   896   NtAllocateVirtualMemory  ... 90963968, 1048576, ) == 0x0
 02461  1336   NtWaitForSingleObject  ... ) == 0x0
 02512  1808   NtSetEventBoostPriority  ... ) == 0x0
 02513   468   NtWaitForSingleObject  (120, 0, 0x0, ...
 02514  1336   NtSetEventBoostPriority  (296, ...
 02515   896   NtAllocateVirtualMemory  (-1, 92004352, 0, 8192, 4096, 4, ...
 02516  1736   NtWaitForSingleObject  (296, 0, 0x0, ...
 02462  1332   NtWaitForSingleObject  ... ) == 0x0
 02514  1336   NtSetEventBoostPriority  ... ) == 0x0
 02515   896   NtAllocateVirtualMemory  ... 92004352, 8192, ) == 0x0
 02517  1332   NtSetEventBoostPriority  (296, ...
 02518  1808   NtWaitForSingleObject  (120, 0, 0x0, ...
 02519  1336   NtWaitForSingleObject  (120, 0, 0x0, ...
 02465   380   NtWaitForSingleObject  ... ) == 0x0
 02517  1332   NtSetEventBoostPriority  ... ) == 0x0
 02520   380   NtSetEventBoostPriority  (296, ...
 02521   896   NtProtectVirtualMemory  (-1, (0x57be000), 4096, 260, ...
 02466  1484   NtWaitForSingleObject  ... ) == 0x0
 02521   896   NtProtectVirtualMemory  ... (0x57be000), 4096, 4, ) == 0x0
 02522  1484   NtSetEventBoostPriority  (296, ...
 02523   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ...
 02489   320   NtWaitForSingleObject  ... ) == 0x0
 02522  1484   NtSetEventBoostPriority  ... ) == 0x0
 02524   320   NtSetEventBoostPriority  (296, ...
 02523   896   NtCreateThread  ... 804, {1252, 1624}, ) == 0x0
 02520   380   NtSetEventBoostPriority  ... ) == 0x0
 02525  1332   NtWaitForSingleObject  (120, 0, 0x0, ...
 02491  1568   NtWaitForSingleObject  ... ) == 0x0
 02524   320   NtSetEventBoostPriority  ... ) == 0x0
 02526   896   NtQueryInformationThread  (804, Basic, 28, ...
 02527   380   NtWaitForSingleObject  (64, 0, {0, 0}, ...
 02528  1568   NtSetEventBoostPriority  (296, ...
 02529   320   NtWaitForSingleObject  (296, 0, 0x0, ...
 02526   896   NtQueryInformationThread  ... {ExitStatus=0x103,TebBaseAddress=0x7ff6c000,Pid=1252,Tid=1624,}, 0x0, ) == 0x0
 02498   420   NtWaitForSingleObject  ... ) == 0x0
 02528  1568   NtSetEventBoostPriority  ... ) == 0x0
 02527   380   NtWaitForSingleObject  ... ) == 0x102
 02530  1484   NtWaitForSingleObject  (296, 0, 0x0, ...
 02531   420   NtSetEventBoostPriority  (296, ...
 02532   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81934, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81934, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG$\3\0\0\344\4\0\0X\6\0\0" ...  ...
 02533   380   NtWaitForSingleObject  (120, 0, 0x0, ...
 02499   888   NtWaitForSingleObject  ... ) == 0x0
 02531   420   NtSetEventBoostPriority  ... ) == 0x0
 02532   896   NtRequestWaitReplyPort  ... {28, 56, reply, 0, 1252, 896, 81935, 0}  ... {28, 56, reply, 0, 1252, 896, 81935, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG$\3\0\0\344\4\0\0X\6\0\0" )  ) == 0x0
 02534   888   NtSetEventBoostPriority  (296, ...
 02535   420   NtWaitForSingleObject  (296, 0, 0x0, ...
 02500  1120   NtWaitForSingleObject  ... ) == 0x0
 02534   888   NtSetEventBoostPriority  ... ) == 0x0
 02536   896   NtResumeThread  (804, ...
 02537  1568   NtTestAlert  (...
 02538  1120   NtSetEventBoostPriority  (296, ...
 02539   888   NtCreateEvent  (0x100003, 0x0, 1, 0, ...
 02536   896   NtResumeThread  ... 1, ) == 0x0
 02501   376   NtWaitForSingleObject  ... ) == 0x0
 02538  1120   NtSetEventBoostPriority  ... ) == 0x0
 02537  1568   NtTestAlert  ... ) == 0x0
 02540  1624   NtWaitForSingleObject  (296, 0, 0x0, ...
 02541   376   NtSetEventBoostPriority  (296, ...
 02542   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ...
 02543  1120   NtCreateEvent  (0x100003, 0x0, 1, 0, ...
 02544  1568   NtContinue  (90963248, 1, ...
 02502   840   NtWaitForSingleObject  ... ) == 0x0
 02541   376   NtSetEventBoostPriority  ... ) == 0x0
 02539   888   NtCreateEvent  ... 808, ) == 0x0
 02542   896   NtAllocateVirtualMemory  ... 92012544, 1048576, ) == 0x0
 02545   840   NtSetEventBoostPriority  (296, ...
 02546  1568   NtRegisterThreadTerminatePort  (24, ...
 02547   376   NtSetEventBoostPriority  (120, ...
 02548   888   NtWaitForSingleObject  (808, 0, 0x0, ...
 02503   876   NtWaitForSingleObject  ... ) == 0x0
 02545   840   NtSetEventBoostPriority  ... ) == 0x0
 02549   896   NtAllocateVirtualMemory  (-1, 93052928, 0, 8192, 4096, 4, ...
 02546  1568   NtRegisterThreadTerminatePort  ... ) == 0x0
 02543  1120   NtCreateEvent  ... 812, ) == 0x0
 02550   876   NtSetEventBoostPriority  (296, ...
 02551   840   NtWaitForSingleObject  (808, 0, 0x0, ...
 02549   896   NtAllocateVirtualMemory  ... 93052928, 8192, ) == 0x0
 02552  1568   NtWaitForSingleObject  (296, 0, 0x0, ...
 02504  1104   NtWaitForSingleObject  ... ) == 0x0
 02550   876   NtSetEventBoostPriority  ... ) == 0x0
 02553  1120   NtClose  (812, ...
 00850   384   NtWaitForSingleObject  ... ) == 0x0
 02547   376   NtSetEventBoostPriority  ... ) == 0x0
 02554   896   NtProtectVirtualMemory  (-1, (0x58be000), 4096, 260, ...
 02555  1104   NtSetEventBoostPriority  (296, ...
 02556   876   NtWaitForSingleObject  (808, 0, 0x0, ...
 02553  1120   NtClose  ... ) == 0x0
 02557   384   NtWaitForSingleObject  (296, 0, 0x0, ...
 02558   376   NtCreateEvent  (0x1f0003, 0x0, 0, 0, ...
 02505   860   NtWaitForSingleObject  ... ) == 0x0
 02555  1104   NtSetEventBoostPriority  ... ) == 0x0
 02554   896   NtProtectVirtualMemory  ... (0x58be000), 4096, 4, ) == 0x0
 02559  1120   NtWaitForSingleObject  (808, 0, 0x0, ...
 02560   860   NtSetEventBoostPriority  (296, ...
 02558   376   NtCreateEvent  ... 812, ) == 0x0
 02561  1104   NtWaitForSingleObject  (808, 0, 0x0, ...
 02562   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ...
 02506  1516   NtWaitForSingleObject  ... ) == 0x0
 02560   860   NtSetEventBoostPriority  ... ) == 0x0
 02563   376   NtWaitForSingleObject  (296, 0, 0x0, ...
 02564  1516   NtSetEventBoostPriority  (296, ...
 02565   860   NtWaitForSingleObject  (808, 0, 0x0, ...
 02507   780   NtWaitForSingleObject  ... ) == 0x0
 02564  1516   NtSetEventBoostPriority  ... ) == 0x0
 02562   896   NtCreateThread  ... 816, {1252, 1716}, ) == 0x0
 02566   780   NtSetEventBoostPriority  (296, ...
 02567  1516   NtWaitForSingleObject  (808, 0, 0x0, ...
 02508   940   NtWaitForSingleObject  ... ) == 0x0
 02566   780   NtSetEventBoostPriority  ... ) == 0x0
 02568   896   NtQueryInformationThread  (816, Basic, 28, ...
 02569   940   NtSetEventBoostPriority  (296, ...
 02570   780   NtWaitForSingleObject  (808, 0, 0x0, ...
 02509  1268   NtWaitForSingleObject  ... ) == 0x0
 02569   940   NtSetEventBoostPriority  ... ) == 0x0
 02568   896   NtQueryInformationThread  ... {ExitStatus=0x103,TebBaseAddress=0x7ff6b000,Pid=1252,Tid=1716,}, 0x0, ) == 0x0
 02571  1268   NtSetEventBoostPriority  (296, ...
 02572   940   NtWaitForSingleObject  (808, 0, 0x0, ...
 02510   644   NtWaitForSingleObject  ... ) == 0x0
 02571  1268   NtSetEventBoostPriority  ... ) == 0x0
 02573   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81935, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81935, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG0\3\0\0\344\4\0\0\264\6\0\0" ...  ...
 02574   644   NtSetEventBoostPriority  (296, ...
 02575  1268   NtWaitForSingleObject  (808, 0, 0x0, ...
 02516  1736   NtWaitForSingleObject  ... ) == 0x0
 02574   644   NtSetEventBoostPriority  ... ) == 0x0
 02573   896   NtRequestWaitReplyPort  ... {28, 56, reply, 0, 1252, 896, 81936, 0}  ... {28, 56, reply, 0, 1252, 896, 81936, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG0\3\0\0\344\4\0\0\264\6\0\0" )  ) == 0x0
 02576  1736   NtSetEventBoostPriority  (296, ...
 02577   644   NtWaitForSingleObject  (808, 0, 0x0, ...
 02529   320   NtWaitForSingleObject  ... ) == 0x0
 02576  1736   NtSetEventBoostPriority  ... ) == 0x0
 02578   896   NtResumeThread  (816, ...
 02579   320   NtSetEventBoostPriority  (296, ...
 02580  1736   NtWaitForSingleObject  (808, 0, 0x0, ...
 02530  1484   NtWaitForSingleObject  ... ) == 0x0
 02578   896   NtResumeThread  ... 1, ) == 0x0
 02579   320   NtSetEventBoostPriority  ... ) == 0x0
 02581  1484   NtSetEventBoostPriority  (296, ...
 02582   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ...
 02583   320   NtSetEventBoostPriority  (808, ...
 02535   420   NtWaitForSingleObject  ... ) == 0x0
 02581  1484   NtSetEventBoostPriority  ... ) == 0x0
 02582   896   NtAllocateVirtualMemory  ... 93061120, 1048576, ) == 0x0
 02584   420   NtSetEventBoostPriority  (296, ...
 02548   888   NtWaitForSingleObject  ... ) == 0x0
 02583   320   NtSetEventBoostPriority  ... ) == 0x0
 02585  1484   NtWaitForSingleObject  (808, 0, 0x0, ...
 02540  1624   NtWaitForSingleObject  ... ) == 0x0
 02586   888   NtWaitForSingleObject  (296, 0, 0x0, ...
 02587   896   NtAllocateVirtualMemory  (-1, 94101504, 0, 8192, 4096, 4, ...
 02584   420   NtSetEventBoostPriority  ... ) == 0x0
 02588  1716   NtWaitForSingleObject  (88, 0, 0x0, ...
 02589   320   NtWaitForSingleObject  (64, 0, {0, 0}, ...
 02590  1624   NtSetEventBoostPriority  (296, ...
 02587   896   NtAllocateVirtualMemory  ... 94101504, 8192, ) == 0x0
 02591   420   NtWaitForSingleObject  (296, 0, 0x0, ...
 02589   320   NtWaitForSingleObject  ... ) == 0x102
 02552  1568   NtWaitForSingleObject  ... ) == 0x0
 02590  1624   NtSetEventBoostPriority  ... ) == 0x0
 02592  1568   NtSetEventBoostPriority  (296, ...
 02593   320   NtWaitForSingleObject  (120, 0, 0x0, ...
 02594   896   NtProtectVirtualMemory  (-1, (0x59be000), 4096, 260, ...
 02557   384   NtWaitForSingleObject  ... ) == 0x0
 02594   896   NtProtectVirtualMemory  ... (0x59be000), 4096, 4, ) == 0x0
 02595   384   NtSetEventBoostPriority  (296, ...
 02596   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ...
 02563   376   NtWaitForSingleObject  ... ) == 0x0
 02596   896   NtCreateThread  ... 820, {1252, 1440}, ) == 0x0
 02597   376   NtSetEventBoostPriority  (296, ...
 02598   896   NtQueryInformationThread  (820, Basic, 28, ...
 02586   888   NtWaitForSingleObject  ... ) == 0x0
 02597   376   NtSetEventBoostPriority  ... ) == 0x0
 02599   888   NtSetEventBoostPriority  (296, ...
 02598   896   NtQueryInformationThread  ... {ExitStatus=0x103,TebBaseAddress=0x7ff6a000,Pid=1252,Tid=1440,}, 0x0, ) == 0x0
 02595   384   NtSetEventBoostPriority  ... ) == 0x0
 02592  1568   NtSetEventBoostPriority  ... ) == 0x0
 02600  1624   NtSetEventBoostPriority  (88, ...
 02591   420   NtWaitForSingleObject  ... ) == 0x0
 02599   888   NtSetEventBoostPriority  ... ) == 0x0
 02601   376   NtWaitForSingleObject  (296, 0, 0x0, ...
 02602   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81936, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81936, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG4\3\0\0\344\4\0\0\240\5\0\0" ...  ...
 02603  1568   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 02604   420   NtSetEventBoostPriority  (296, ...
 02588  1716   NtWaitForSingleObject  ... ) == 0x0
 02600  1624   NtSetEventBoostPriority  ... ) == 0x0
 02605   384   NtWaitForSingleObject  (296, 0, 0x0, ...
 02602   896   NtRequestWaitReplyPort  ... {28, 56, reply, 0, 1252, 896, 81937, 0}  ... {28, 56, reply, 0, 1252, 896, 81937, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG4\3\0\0\344\4\0\0\240\5\0\0" )  ) == 0x0
 02601   376   NtWaitForSingleObject  ... ) == 0x0
 02606  1716   NtAllocateVirtualMemory  (-1, 8810496, 0, 4096, 4096, 4, ...
 02604   420   NtSetEventBoostPriority  ... ) == 0x0
 02603  1568   NtDuplicateObject  ... 824, ) == 0x0
 02607  1624   NtTestAlert  (...
 02608   376   NtSetEventBoostPriority  (296, ...
 02606  1716   NtAllocateVirtualMemory  ... 8810496, 4096, ) == 0x0
 02609   896   NtResumeThread  (820, ...
 02610   888   NtSetEventBoostPriority  (808, ...
 02611   420   NtWaitForSingleObject  (296, 0, 0x0, ...
 02605   384   NtWaitForSingleObject  ... ) == 0x0
 02608   376   NtSetEventBoostPriority  ... ) == 0x0
 02607  1624   NtTestAlert  ... ) == 0x0
 02612  1568   NtWaitForSingleObject  (296, 0, 0x0, ...
 02609   896   NtResumeThread  ... 1, ) == 0x0
 02551   840   NtWaitForSingleObject  ... ) == 0x0
 02610   888   NtSetEventBoostPriority  ... ) == 0x0
 02613   384   NtSetEventBoostPriority  (296, ...
 02614   376   NtWaitForSingleObject  (296, 0, 0x0, ...
 02615  1624   NtContinue  (92011824, 1, ...
 02616   840   NtWaitForSingleObject  (296, 0, 0x0, ...
 02617   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ...
 02611   420   NtWaitForSingleObject  ... ) == 0x0
 02613   384   NtSetEventBoostPriority  ... ) == 0x0
 02618   888   NtWaitForSingleObject  (64, 0, {0, 0}, ...
 02619  1716   NtWaitForSingleObject  (296, 0, 0x0, ...
 02620  1440   NtWaitForSingleObject  (88, 0, 0x0, ...
 02621  1624   NtRegisterThreadTerminatePort  (24, ...
 02622   420   NtSetEventBoostPriority  (296, ...
 02623   384   NtWaitForSingleObject  (296, 0, 0x0, ...
 02618   888   NtWaitForSingleObject  ... ) == 0x102
 02617   896   NtAllocateVirtualMemory  ... 94109696, 1048576, ) == 0x0
 02612  1568   NtWaitForSingleObject  ... ) == 0x0
 02622   420   NtSetEventBoostPriority  ... ) == 0x0
 02621  1624   NtRegisterThreadTerminatePort  ... ) == 0x0
 02624   888   NtWaitForSingleObject  (296, 0, 0x0, ...
 02625  1568   NtSetEventBoostPriority  (296, ...
 02626   896   NtAllocateVirtualMemory  (-1, 95150080, 0, 8192, 4096, 4, ...
 02627   420   NtWaitForSingleObject  (296, 0, 0x0, ...
 02628  1624   NtWaitForSingleObject  (296, 0, 0x0, ...
 02616   840   NtWaitForSingleObject  ... ) == 0x0
 02625  1568   NtSetEventBoostPriority  ... ) == 0x0
 02626   896   NtAllocateVirtualMemory  ... 95150080, 8192, ) == 0x0
 02629   840   NtSetEventBoostPriority  (296, ...
 02630  1568   NtWaitForSingleObject  (296, 0, 0x0, ...
 02614   376   NtWaitForSingleObject  ... ) == 0x0
 02631   896   NtProtectVirtualMemory  (-1, (0x5abe000), 4096, 260, ...
 02629   840   NtSetEventBoostPriority  ... ) == 0x0
 02632   376   NtAllocateVirtualMemory  (-1, 1417216, 0, 4096, 4096, 4, ...
 02631   896   NtProtectVirtualMemory  ... (0x5abe000), 4096, 4, ) == 0x0
 02632   376   NtAllocateVirtualMemory  ... 1417216, 4096, ) == 0x0
 02633   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ...
 02634   376   NtSetEventBoostPriority  (296, ...
 02635   840   NtSetEventBoostPriority  (808, ...
 02619  1716   NtWaitForSingleObject  ... ) == 0x0
 02559  1120   NtWaitForSingleObject  ... ) == 0x0
 02635   840   NtSetEventBoostPriority  ... ) == 0x0
 02636  1120   NtWaitForSingleObject  (296, 0, 0x0, ...
 02637  1716   NtSetEventBoostPriority  (296, ...
 02638   840   NtWaitForSingleObject  (64, 0, {0, 0}, ...
 02623   384   NtWaitForSingleObject  ... ) == 0x0
 02637  1716   NtSetEventBoostPriority  ... ) == 0x0
 02639   384   NtSetEventBoostPriority  (296, ...
 02638   840   NtWaitForSingleObject  ... ) == 0x102
 02624   888   NtWaitForSingleObject  ... ) == 0x0
 02640  1716   NtSetEventBoostPriority  (88, ...
 02641   840   NtWaitForSingleObject  (296, 0, 0x0, ...
 02642   888   NtSetEventBoostPriority  (296, ...
 02639   384   NtSetEventBoostPriority  ... ) == 0x0
 02634   376   NtSetEventBoostPriority  ... ) == 0x0
 02633   896   NtCreateThread  ... 828, {1252, 1664}, ) == 0x0
 02620  1440   NtWaitForSingleObject  ... ) == 0x0
 02640  1716   NtSetEventBoostPriority  ... ) == 0x0
 02628  1624   NtWaitForSingleObject  ... ) == 0x0
 02643   384   NtWaitForSingleObject  (296, 0, 0x0, ...
 02642   888   NtSetEventBoostPriority  ... ) == 0x0
 02644   896   NtQueryInformationThread  (828, Basic, 28, ...
 02645  1440   NtWaitForSingleObject  (296, 0, 0x0, ...
 02646  1716   NtTestAlert  (...
 02647  1624   NtSetEventBoostPriority  (296, ...
 02648   888   NtWaitForSingleObject  (120, 0, 0x0, ...
 02644   896   NtQueryInformationThread  ... {ExitStatus=0x103,TebBaseAddress=0x7ff69000,Pid=1252,Tid=1664,}, 0x0, ) == 0x0
 02646  1716   NtTestAlert  ... ) == 0x0
 02627   420   NtWaitForSingleObject  ... ) == 0x0
 02647  1624   NtSetEventBoostPriority  ... ) == 0x0
 02649   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81937, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81937, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG<\3\0\0\344\4\0\0\200\6\0\0" ...  ...
 02650   420   NtSetEventBoostPriority  (296, ...
 02651  1716   NtContinue  (93060400, 1, ...
 02652   376   NtWaitForSingleObject  (296, 0, 0x0, ...
 02630  1568   NtWaitForSingleObject  ... ) == 0x0
 02649   896   NtRequestWaitReplyPort  ... {28, 56, reply, 0, 1252, 896, 81938, 0}  ... {28, 56, reply, 0, 1252, 896, 81938, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG<\3\0\0\344\4\0\0\200\6\0\0" )  ) == 0x0
 02653  1716   NtRegisterThreadTerminatePort  (24, ...
 02654  1568   NtSetEventBoostPriority  (296, ...
 02650   420   NtSetEventBoostPriority  ... ) == 0x0
 02655  1624   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 02653  1716   NtRegisterThreadTerminatePort  ... ) == 0x0
 02636  1120   NtWaitForSingleObject  ... ) == 0x0
 02656   420   NtWaitForSingleObject  (296, 0, 0x0, ...
 02655  1624   NtDuplicateObject  ... 832, ) == 0x0
 02654  1568   NtSetEventBoostPriority  ... ) == 0x0
 02657   896   NtResumeThread  (828, ...
 02658  1120   NtSetEventBoostPriority  (296, ...
 02659  1624   NtWaitForSingleObject  (296, 0, 0x0, ...
 02660  1568   NtWaitForSingleObject  (296, 0, 0x0, ...
 02641   840   NtWaitForSingleObject  ... ) == 0x0
 02658  1120   NtSetEventBoostPriority  ... ) == 0x0
 02657   896   NtResumeThread  ... 1, ) == 0x0
 02661   840   NtSetEventBoostPriority  (296, ...
 02662  1716   NtWaitForSingleObject  (296, 0, 0x0, ...
 02663  1664   NtWaitForSingleObject  (88, 0, 0x0, ...
 02643   384   NtWaitForSingleObject  ... ) == 0x0
 02664   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ...
 02665   384   NtSetEventBoostPriority  (296, ...
 02664   896   NtAllocateVirtualMemory  ... 95158272, 1048576, ) == 0x0
 02645  1440   NtWaitForSingleObject  ... ) == 0x0
 02665   384   NtSetEventBoostPriority  ... ) == 0x0
 02666  1440   NtSetEventBoostPriority  (296, ...
 02667   896   NtAllocateVirtualMemory  (-1, 96198656, 0, 8192, 4096, 4, ...
 02661   840   NtSetEventBoostPriority  ... ) == 0x0
 02668  1120   NtSetEventBoostPriority  (808, ...
 02652   376   NtWaitForSingleObject  ... ) == 0x0
 02666  1440   NtSetEventBoostPriority  ... ) == 0x0
 02667   896   NtAllocateVirtualMemory  ... 96198656, 8192, ) == 0x0
 02669   840   NtWaitForSingleObject  (120, 0, 0x0, ...
 02670   376   NtSetEventBoostPriority  (296, ...
 02556   876   NtWaitForSingleObject  ... ) == 0x0
 02668  1120   NtSetEventBoostPriority  ... ) == 0x0
 02671   384   NtSetEventBoostPriority  (120, ...
 02672  1440   NtSetEventBoostPriority  (88, ...
 02656   420   NtWaitForSingleObject  ... ) == 0x0
 02673   876   NtWaitForSingleObject  (296, 0, 0x0, ...
 02670   376   NtSetEventBoostPriority  ... ) == 0x0
 02674  1120   NtWaitForSingleObject  (64, 0, {0, 0}, ...
 00854   596   NtWaitForSingleObject  ... ) == 0x0
 02671   384   NtSetEventBoostPriority  ... ) == 0x0
 02675   420   NtSetEventBoostPriority  (296, ...
 02663  1664   NtWaitForSingleObject  ... ) == 0x0
 02672  1440   NtSetEventBoostPriority  ... ) == 0x0
 02676   376   NtWaitForSingleObject  (296, 0, 0x0, ...
 02677   596   NtWaitForSingleObject  (296, 0, 0x0, ...
 02674  1120   NtWaitForSingleObject  ... ) == 0x102
 02659  1624   NtWaitForSingleObject  ... ) == 0x0
 02678  1664   NtWaitForSingleObject  (296, 0, 0x0, ...
 02675   420   NtSetEventBoostPriority  ... ) == 0x0
 02679   384   NtCreateEvent  (0x1f0003, 0x0, 0, 0, ...
 02680  1440   NtTestAlert  (...
 02681   896   NtProtectVirtualMemory  (-1, (0x5bbe000), 4096, 260, ...
 02682  1624   NtSetEventBoostPriority  (296, ...
 02683  1120   NtWaitForSingleObject  (120, 0, 0x0, ...
 02679   384   NtCreateEvent  ... 836, ) == 0x0
 02680  1440   NtTestAlert  ... ) == 0x0
 02660  1568   NtWaitForSingleObject  ... ) == 0x0
 02682  1624   NtSetEventBoostPriority  ... ) == 0x0
 02681   896   NtProtectVirtualMemory  ... (0x5bbe000), 4096, 4, ) == 0x0
 02684   420   NtWaitForSingleObject  (296, 0, 0x0, ...
 02685   384   NtWaitForSingleObject  (296, 0, 0x0, ...
 02686  1568   NtSetEventBoostPriority  (296, ...
 02687  1440   NtContinue  (94108976, 1, ...
 02688   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ...
 02662  1716   NtWaitForSingleObject  ... ) == 0x0
 02686  1568   NtSetEventBoostPriority  ... ) == 0x0
 02689  1440   NtRegisterThreadTerminatePort  (24, ...
 02690  1716   NtSetEventBoostPriority  (296, ...
 02688   896   NtCreateThread  ... 840, {1252, 1972}, ) == 0x0
 02691  1624   NtWaitForSingleObject  (296, 0, 0x0, ...
 02692  1568   NtWaitForSingleObject  (808, 0, 0x0, ...
 02673   876   NtWaitForSingleObject  ... ) == 0x0
 02690  1716   NtSetEventBoostPriority  ... ) == 0x0
 02693   896   NtQueryInformationThread  (840, Basic, 28, ...
 02694   876   NtSetEventBoostPriority  (296, ...
 02695  1716   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 02677   596   NtWaitForSingleObject  ... ) == 0x0
 02693   896   NtQueryInformationThread  ... {ExitStatus=0x103,TebBaseAddress=0x7ff68000,Pid=1252,Tid=1972,}, 0x0, ) == 0x0
 02694   876   NtSetEventBoostPriority  ... ) == 0x0
 02689  1440   NtRegisterThreadTerminatePort  ... ) == 0x0
 02696   596   NtSetEventBoostPriority  (296, ...
 02695  1716   NtDuplicateObject  ... 844, ) == 0x0
 02697   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81938, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81938, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFGH\3\0\0\344\4\0\0\264\7\0\0" ...  ...
 02678  1664   NtWaitForSingleObject  ... ) == 0x0
 02696   596   NtSetEventBoostPriority  ... ) == 0x0
 02698  1440   NtWaitForSingleObject  (296, 0, 0x0, ...
 02699  1716   NtWaitForSingleObject  (296, 0, 0x0, ...
 02700  1664   NtSetEventBoostPriority  (296, ...
 02697   896   NtRequestWaitReplyPort  ... {28, 56, reply, 0, 1252, 896, 81939, 0}  ... {28, 56, reply, 0, 1252, 896, 81939, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFGH\3\0\0\344\4\0\0\264\7\0\0" )  ) == 0x0
 02701   876   NtSetEventBoostPriority  (808, ...
 02676   376   NtWaitForSingleObject  ... ) == 0x0
 02700  1664   NtSetEventBoostPriority  ... ) == 0x0
 02702   896   NtResumeThread  (840, ...
 02703   376   NtSetEventBoostPriority  (296, ...
 02561  1104   NtWaitForSingleObject  ... ) == 0x0
 02701   876   NtSetEventBoostPriority  ... ) == 0x0
 02704   596   NtWaitForSingleObject  (296, 0, 0x0, ...
 02684   420   NtWaitForSingleObject  ... ) == 0x0
 02705  1104   NtWaitForSingleObject  (296, 0, 0x0, ...
 02702   896   NtResumeThread  ... 1, ) == 0x0
 02706   876   NtWaitForSingleObject  (64, 0, {0, 0}, ...
 02707   420   NtSetEventBoostPriority  (296, ...
 02708   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ...
 02706   876   NtWaitForSingleObject  ... ) == 0x102
 02685   384   NtWaitForSingleObject  ... ) == 0x0
 02707   420   NtSetEventBoostPriority  ... ) == 0x0
 02703   376   NtSetEventBoostPriority  ... ) == 0x0
 02709  1664   NtTestAlert  (...
 02710  1972   NtWaitForSingleObject  (296, 0, 0x0, ...
 02711   384   NtSetEventBoostPriority  (296, ...
 02712   876   NtWaitForSingleObject  (296, 0, 0x0, ...
 02713   420   NtWaitForSingleObject  (296, 0, 0x0, ...
 02714   376   NtWaitForSingleObject  (296, 0, 0x0, ...
 02709  1664   NtTestAlert  ... ) == 0x0
 02691  1624   NtWaitForSingleObject  ... ) == 0x0
 02711   384   NtSetEventBoostPriority  ... ) == 0x0
 02708   896   NtAllocateVirtualMemory  ... 96206848, 1048576, ) == 0x0
 02715  1624   NtSetEventBoostPriority  (296, ...
 02716  1664   NtContinue  (95157552, 1, ...
 02698  1440   NtWaitForSingleObject  ... ) == 0x0
 02715  1624   NtSetEventBoostPriority  ... ) == 0x0
 02717   896   NtAllocateVirtualMemory  (-1, 97247232, 0, 8192, 4096, 4, ...
 02718  1440   NtSetEventBoostPriority  (296, ...
 02719  1664   NtRegisterThreadTerminatePort  (24, ...
 02720  1624   NtWaitForSingleObject  (296, 0, 0x0, ...
 02699  1716   NtWaitForSingleObject  ... ) == 0x0
 02718  1440   NtSetEventBoostPriority  ... ) == 0x0
 02717   896   NtAllocateVirtualMemory  ... 97247232, 8192, ) == 0x0
 02719  1664   NtRegisterThreadTerminatePort  ... ) == 0x0
 02721   384   NtWaitForSingleObject  (296, 0, 0x0, ...
 02722  1716   NtSetEventBoostPriority  (296, ...
 02723   896   NtProtectVirtualMemory  (-1, (0x5cbe000), 4096, 260, ...
 02724  1664   NtWaitForSingleObject  (296, 0, 0x0, ...
 02704   596   NtWaitForSingleObject  ... ) == 0x0
 02722  1716   NtSetEventBoostPriority  ... ) == 0x0
 02723   896   NtProtectVirtualMemory  ... (0x5cbe000), 4096, 4, ) == 0x0
 02725  1440   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 02726   596   NtSetEventBoostPriority  (296, ...
 02727   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ...
 02705  1104   NtWaitForSingleObject  ... ) == 0x0
 02726   596   NtSetEventBoostPriority  ... ) == 0x0
 02725  1440   NtDuplicateObject  ... 848, ) == 0x0
 02728  1716   NtWaitForSingleObject  (296, 0, 0x0, ...
 02729  1104   NtSetEventBoostPriority  (296, ...
 02730   596   NtSetEventBoostPriority  (120, ...
 02731  1440   NtWaitForSingleObject  (296, 0, 0x0, ...
 02710  1972   NtWaitForSingleObject  ... ) == 0x0
 02729  1104   NtSetEventBoostPriority  ... ) == 0x0
 02727   896   NtCreateThread  ... 852, {1252, 1036}, ) == 0x0
 02732  1972   NtSetEventBoostPriority  (296, ...
 00923  1168   NtWaitForSingleObject  ... ) == 0x0
 02730   596   NtSetEventBoostPriority  ... ) == 0x0
 02733   896   NtQueryInformationThread  (852, Basic, 28, ...
 02712   876   NtWaitForSingleObject  ... ) == 0x0
 02732  1972   NtSetEventBoostPriority  ... ) == 0x0
 02734  1168   NtWaitForSingleObject  (296, 0, 0x0, ...
 02735   596   NtCreateEvent  (0x1f0003, 0x0, 0, 0, ...
 02736   876   NtSetEventBoostPriority  (296, ...
 02733   896   NtQueryInformationThread  ... {ExitStatus=0x103,TebBaseAddress=0x7ff67000,Pid=1252,Tid=1036,}, 0x0, ) == 0x0
 02737  1104   NtSetEventBoostPriority  (808, ...
 02714   376   NtWaitForSingleObject  ... ) == 0x0
 02735   596   NtCreateEvent  ... 856, ) == 0x0
 02738   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81939, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81939, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFGT\3\0\0\344\4\0\0\14\4\0\0" ...  ...
 02565   860   NtWaitForSingleObject  ... ) == 0x0
 02737  1104   NtSetEventBoostPriority  ... ) == 0x0
 02739   376   NtSetEventBoostPriority  (296, ...
 02740   596   NtWaitForSingleObject  (296, 0, 0x0, ...
 02741   860   NtWaitForSingleObject  (296, 0, 0x0, ...
 02738   896   NtRequestWaitReplyPort  ... {28, 56, reply, 0, 1252, 896, 81940, 0}  ... {28, 56, reply, 0, 1252, 896, 81940, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFGT\3\0\0\344\4\0\0\14\4\0\0" )  ) == 0x0
 02742  1104   NtWaitForSingleObject  (64, 0, {0, 0}, ...
 02713   420   NtWaitForSingleObject  ... ) == 0x0
 02739   376   NtSetEventBoostPriority  ... ) == 0x0
 02736   876   NtSetEventBoostPriority  ... ) == 0x0
 02743  1972   NtTestAlert  (...
 02744   420   NtSetEventBoostPriority  (296, ...
 02742  1104   NtWaitForSingleObject  ... ) == 0x102
 02745   896   NtResumeThread  (852, ...
 02746   876   NtWaitForSingleObject  (120, 0, 0x0, ...
 02720  1624   NtWaitForSingleObject  ... ) == 0x0
 02743  1972   NtTestAlert  ... ) == 0x0
 02747  1104   NtWaitForSingleObject  (120, 0, 0x0, ...
 02745   896   NtResumeThread  ... 1, ) == 0x0
 02748  1624   NtSetEventBoostPriority  (296, ...
 02749  1972   NtContinue  (96206128, 1, ...
 02744   420   NtSetEventBoostPriority  ... ) == 0x0
 02750   376   NtWaitForSingleObject  (296, 0, 0x0, ...
 02751  1036   NtWaitForSingleObject  (296, 0, 0x0, ...
 02752   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ...
 02721   384   NtWaitForSingleObject  ... ) == 0x0
 02753  1972   NtRegisterThreadTerminatePort  (24, ...
 02754   420   NtWaitForSingleObject  (296, 0, 0x0, ...
 02752   896   NtAllocateVirtualMemory  ... 97255424, 1048576, ) == 0x0
 02755   384   NtSetEventBoostPriority  (296, ...
 02753  1972   NtRegisterThreadTerminatePort  ... ) == 0x0
 02756   896   NtAllocateVirtualMemory  (-1, 98295808, 0, 8192, 4096, 4, ...
 02724  1664   NtWaitForSingleObject  ... ) == 0x0
 02755   384   NtSetEventBoostPriority  ... ) == 0x0
 02757  1972   NtWaitForSingleObject  (296, 0, 0x0, ...
 02758  1664   NtSetEventBoostPriority  (296, ...
 02756   896   NtAllocateVirtualMemory  ... 98295808, 8192, ) == 0x0
 02759   384   NtWaitForSingleObject  (296, 0, 0x0, ...
 02748  1624   NtSetEventBoostPriority  ... ) == 0x0
 02728  1716   NtWaitForSingleObject  ... ) == 0x0
 02758  1664   NtSetEventBoostPriority  ... ) == 0x0
 02760   896   NtProtectVirtualMemory  (-1, (0x5dbe000), 4096, 260, ...
 02761  1624   NtWaitForSingleObject  (808, 0, 0x0, ...
 02762  1716   NtSetEventBoostPriority  (296, ...
 02763  1664   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 02760   896   NtProtectVirtualMemory  ... (0x5dbe000), 4096, 4, ) == 0x0
 02731  1440   NtWaitForSingleObject  ... ) == 0x0
 02762  1716   NtSetEventBoostPriority  ... ) == 0x0
 02763  1664   NtDuplicateObject  ... 860, ) == 0x0
 02764  1440   NtSetEventBoostPriority  (296, ...
 02765   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ...
 02766  1716   NtWaitForSingleObject  (808, 0, 0x0, ...
 02734  1168   NtWaitForSingleObject  ... ) == 0x0
 02764  1440   NtSetEventBoostPriority  ... ) == 0x0
 02765   896   NtCreateThread  ... 864, {1252, 1248}, ) == 0x0
 02767  1664   NtWaitForSingleObject  (296, 0, 0x0, ...
 02768  1168   NtSetEventBoostPriority  (296, ...
 02769   896   NtQueryInformationThread  (864, Basic, 28, ...
 02741   860   NtWaitForSingleObject  ... ) == 0x0
 02768  1168   NtSetEventBoostPriority  ... ) == 0x0
 02770   860   NtSetEventBoostPriority  (296, ...
 02769   896   NtQueryInformationThread  ... {ExitStatus=0x103,TebBaseAddress=0x7ff66000,Pid=1252,Tid=1248,}, 0x0, ) == 0x0
 02771  1440   NtWaitForSingleObject  (808, 0, 0x0, ...
 02740   596   NtWaitForSingleObject  ... ) == 0x0
 02770   860   NtSetEventBoostPriority  ... ) == 0x0
 02772  1168   NtWaitForSingleObject  (296, 0, 0x0, ...
 02773   596   NtSetEventBoostPriority  (296, ...
 02774   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81940, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81940, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG`\3\0\0\344\4\0\0\340\4\0\0" ...  ...
 02750   376   NtWaitForSingleObject  ... ) == 0x0
 02773   596   NtSetEventBoostPriority  ... ) == 0x0
 02775   376   NtSetEventBoostPriority  (296, ...
 02774   896   NtRequestWaitReplyPort  ... {28, 56, reply, 0, 1252, 896, 81941, 0}  ... {28, 56, reply, 0, 1252, 896, 81941, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG`\3\0\0\344\4\0\0\340\4\0\0" )  ) == 0x0
 02776   860   NtSetEventBoostPriority  (808, ...
 02751  1036   NtWaitForSingleObject  ... ) == 0x0
 02775   376   NtSetEventBoostPriority  ... ) == 0x0
 02777   896   NtResumeThread  (864, ...
 02778  1036   NtSetEventBoostPriority  (296, ...
 02567  1516   NtWaitForSingleObject  ... ) == 0x0
 02776   860   NtSetEventBoostPriority  ... ) == 0x0
 02779   376   NtWaitForSingleObject  (296, 0, 0x0, ...
 02754   420   NtWaitForSingleObject  ... ) == 0x0
 02780  1516   NtWaitForSingleObject  (296, 0, 0x0, ...
 02778  1036   NtSetEventBoostPriority  ... ) == 0x0
 02777   896   NtResumeThread  ... 1, ) == 0x0
 02781   860   NtWaitForSingleObject  (64, 0, {0, 0}, ...
 02782   596   NtWaitForSingleObject  (296, 0, 0x0, ...
 02783  1248   NtWaitForSingleObject  (88, 0, 0x0, ...
 02784   420   NtSetEventBoostPriority  (296, ...
 02785   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ...
 02781   860   NtWaitForSingleObject  ... ) == 0x102
 02757  1972   NtWaitForSingleObject  ... ) == 0x0
 02784   420   NtSetEventBoostPriority  ... ) == 0x0
 02786  1036   NtSetEventBoostPriority  (88, ...
 02787  1972   NtSetEventBoostPriority  (296, ...
 02788   860   NtWaitForSingleObject  (296, 0, 0x0, ...
 02785   896   NtAllocateVirtualMemory  ... 98304000, 1048576, ) == 0x0
 02759   384   NtWaitForSingleObject  ... ) == 0x0
 02783  1248   NtWaitForSingleObject  ... ) == 0x0
 02786  1036   NtSetEventBoostPriority  ... ) == 0x0
 02787  1972   NtSetEventBoostPriority  ... ) == 0x0
 02789   420   NtWaitForSingleObject  (808, 0, 0x0, ...
 02790   896   NtAllocateVirtualMemory  (-1, 99344384, 0, 8192, 4096, 4, ...
 02791  1248   NtWaitForSingleObject  (296, 0, 0x0, ...
 02792   384   NtAllocateVirtualMemory  (-1, 1421312, 0, 4096, 4096, 4, ...
 02793  1036   NtTestAlert  (...
 02794  1972   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 02790   896   NtAllocateVirtualMemory  ... 99344384, 8192, ) == 0x0
 02792   384   NtAllocateVirtualMemory  ... 1421312, 4096, ) == 0x0
 02793  1036   NtTestAlert  ... ) == 0x0
 02794  1972   NtDuplicateObject  ... 868, ) == 0x0
 02795   896   NtProtectVirtualMemory  (-1, (0x5ebe000), 4096, 260, ...
 02796   384   NtSetEventBoostPriority  (296, ...
 02797  1036   NtContinue  (97254704, 1, ...
 02795   896   NtProtectVirtualMemory  ... (0x5ebe000), 4096, 4, ) == 0x0
 02767  1664   NtWaitForSingleObject  ... ) == 0x0
 02798  1036   NtRegisterThreadTerminatePort  (24, ...
 02799   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ...
 02800  1664   NtSetEventBoostPriority  (296, ...
 02796   384   NtSetEventBoostPriority  ... ) == 0x0
 02801  1972   NtWaitForSingleObject  (296, 0, 0x0, ...
 02798  1036   NtRegisterThreadTerminatePort  ... ) == 0x0
 02772  1168   NtWaitForSingleObject  ... ) == 0x0
 02800  1664   NtSetEventBoostPriority  ... ) == 0x0
 02799   896   NtCreateThread  ... 872, {1252, 1656}, ) == 0x0
 02802  1168   NtSetEventBoostPriority  (296, ...
 02803  1036   NtWaitForSingleObject  (296, 0, 0x0, ...
 02804  1664   NtWaitForSingleObject  (296, 0, 0x0, ...
 02780  1516   NtWaitForSingleObject  ... ) == 0x0
 02802  1168   NtSetEventBoostPriority  ... ) == 0x0
 02805   896   NtQueryInformationThread  (872, Basic, 28, ...
 02806   384   NtWaitForSingleObject  (296, 0, 0x0, ...
 02807  1516   NtSetEventBoostPriority  (296, ...
 02808  1168   NtWaitForSingleObject  (296, 0, 0x0, ...
 02805   896   NtQueryInformationThread  ... {ExitStatus=0x103,TebBaseAddress=0x7ff65000,Pid=1252,Tid=1656,}, 0x0, ) == 0x0
 02779   376   NtWaitForSingleObject  ... ) == 0x0
 02807  1516   NtSetEventBoostPriority  ... ) == 0x0
 02809   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81941, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81941, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFGh\3\0\0\344\4\0\0x\6\0\0" ...  ...
 02810   376   NtSetEventBoostPriority  (296, ...
 02809   896   NtRequestWaitReplyPort  ... {28, 56, reply, 0, 1252, 896, 81942, 0}  ... {28, 56, reply, 0, 1252, 896, 81942, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFGh\3\0\0\344\4\0\0x\6\0\0" )  ) == 0x0
 02782   596   NtWaitForSingleObject  ... ) == 0x0
 02810   376   NtSetEventBoostPriority  ... ) == 0x0
 02811  1516   NtSetEventBoostPriority  (808, ...
 02812   596   NtAllocateVirtualMemory  (-1, 1425408, 0, 4096, 4096, 4, ...
 02813   376   NtAllocateVirtualMemory  (-1, 13357056, 0, 4096, 4096, 260, ...
 02570   780   NtWaitForSingleObject  ... ) == 0x0
 02811  1516   NtSetEventBoostPriority  ... ) == 0x0
 02812   596   NtAllocateVirtualMemory  ... 1425408, 4096, ) == 0x0
 02814   780   NtWaitForSingleObject  (296, 0, 0x0, ...
 02813   376   NtAllocateVirtualMemory  ... 13357056, 4096, ) == 0x0
 02815  1516   NtWaitForSingleObject  (64, 0, {0, 0}, ...
 02816   596   NtSetEventBoostPriority  (296, ...
 02817   896   NtResumeThread  (872, ...
 02815  1516   NtWaitForSingleObject  ... ) == 0x102
 02818   376   NtWaitForSingleObject  (296, 0, 0x0, ...
 02817   896   NtResumeThread  ... 1, ) == 0x0
 02819  1516   NtWaitForSingleObject  (296, 0, 0x0, ...
 02820   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ...
 02791  1248   NtWaitForSingleObject  ... ) == 0x0
 02816   596   NtSetEventBoostPriority  ... ) == 0x0
 02821  1656   NtWaitForSingleObject  (88, 0, 0x0, ...
 02822  1248   NtSetEventBoostPriority  (296, ...
 02820   896   NtAllocateVirtualMemory  ... 99352576, 1048576, ) == 0x0
 02823   596   NtWaitForSingleObject  (296, 0, 0x0, ...
 02788   860   NtWaitForSingleObject  ... ) == 0x0
 02822  1248   NtSetEventBoostPriority  ... ) == 0x0
 02824   896   NtAllocateVirtualMemory  (-1, 100392960, 0, 8192, 4096, 4, ...
 02825   860   NtSetEventBoostPriority  (296, ...
 02801  1972   NtWaitForSingleObject  ... ) == 0x0
 02826  1972   NtSetEventBoostPriority  (296, ...
 02803  1036   NtWaitForSingleObject  ... ) == 0x0
 02827  1036   NtSetEventBoostPriority  (296, ...
 02806   384   NtWaitForSingleObject  ... ) == 0x0
 02828   384   NtSetEventBoostPriority  (296, ...
 02804  1664   NtWaitForSingleObject  ... ) == 0x0
 02829  1664   NtSetEventBoostPriority  (296, ...
 02808  1168   NtWaitForSingleObject  ... ) == 0x0
 02830  1168   NtSetEventBoostPriority  (296, ...
 02814   780   NtWaitForSingleObject  ... ) == 0x0
 02831   780   NtSetEventBoostPriority  (296, ...
 02818   376   NtWaitForSingleObject  ... ) == 0x0
 02832   376   NtSetEventBoostPriority  (296, ...
 02823   596   NtWaitForSingleObject  ... ) == 0x0
 02833   596   NtSetEventBoostPriority  (296, ...
 02819  1516   NtWaitForSingleObject  ... ) == 0x0
 02834  1516   NtWaitForSingleObject  (120, 0, 0x0, ...
 02833   596   NtSetEventBoostPriority  ... ) == 0x0
 02832   376   NtSetEventBoostPriority  ... ) == 0x0
 02828   384   NtSetEventBoostPriority  ... ) == 0x0
 02827  1036   NtSetEventBoostPriority  ... ) == 0x0
 02826  1972   NtSetEventBoostPriority  ... ) == 0x0
 02824   896   NtAllocateVirtualMemory  ... 100392960, 8192, ) == 0x0
 02831   780   NtSetEventBoostPriority  ... ) == 0x0
 02830  1168   NtSetEventBoostPriority  ... ) == 0x0
 02829  1664   NtSetEventBoostPriority  ... ) == 0x0
 02825   860   NtSetEventBoostPriority  ... ) == 0x0
 02835  1248   NtSetEventBoostPriority  (88, ...
 02836   376   NtCreateEvent  (0x1f0003, 0x0, 0, 0, ...
 02837   384   NtAllocateVirtualMemory  (-1, 15454208, 0, 4096, 4096, 260, ...
 02838   596   NtAllocateVirtualMemory  (-1, 12046336, 0, 4096, 4096, 260, ...
 02839  1972   NtWaitForSingleObject  (808, 0, 0x0, ...
 02840  1036   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 02841   896   NtProtectVirtualMemory  (-1, (0x5fbe000), 4096, 260, ...
 02842  1168   NtSetEventBoostPriority  (120, ...
 02843  1664   NtWaitForSingleObject  (808, 0, 0x0, ...
 02844   860   NtWaitForSingleObject  (120, 0, 0x0, ...
 02821  1656   NtWaitForSingleObject  ... ) == 0x0
 02835  1248   NtSetEventBoostPriority  ... ) == 0x0
 02845   780   NtSetEventBoostPriority  (808, ...
 02836   376   NtCreateEvent  ... 876, ) == 0x0
 02838   596   NtAllocateVirtualMemory  ... 12046336, 4096, ) == 0x0
 02837   384   NtAllocateVirtualMemory  ... 15454208, 4096, ) == 0x0
 02840  1036   NtDuplicateObject  ... 880, ) == 0x0
 02841   896   NtProtectVirtualMemory  ... (0x5fbe000), 4096, 4, ) == 0x0
 00933  2012   NtWaitForSingleObject  ... ) == 0x0
 02842  1168   NtSetEventBoostPriority  ... ) == 0x0
 02846  1656   NtTestAlert  (...
 02847  1248   NtTestAlert  (...
 02572   940   NtWaitForSingleObject  ... ) == 0x0
 02845   780   NtSetEventBoostPriority  ... ) == 0x0
 02848   376   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 02849   596   NtCreateEvent  (0x1f0003, 0x0, 0, 0, ...
 02850   384   NtCreateEvent  (0x1f0003, 0x0, 0, 0, ...
 02851  1036   NtWaitForSingleObject  (808, 0, 0x0, ...
 02852  2012   NtSetEventBoostPriority  (120, ...
 02853   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ...
 02846  1656   NtTestAlert  ... ) == 0x0
 02854   940   NtSetEventBoostPriority  (808, ...
 02847  1248   NtTestAlert  ... ) == 0x0
 02855   780   NtWaitForSingleObject  (64, 0, {0, 0}, ...
 02848   376   NtDuplicateObject  ... 884, ) == 0x0
 02849   596   NtCreateEvent  ... 888, ) == 0x0
 02850   384   NtCreateEvent  ... 892, ) == 0x0
 00934  1028   NtWaitForSingleObject  ... ) == 0x0
 02852  2012   NtSetEventBoostPriority  ... ) == 0x0
 02853   896   NtCreateThread  ... 896, {1252, 760}, ) == 0x0
 02856  1168   NtCreateEvent  (0x1f0003, 0x0, 0, 0, ...
 02575  1268   NtWaitForSingleObject  ... ) == 0x0
 02857  1248   NtContinue  (98303280, 1, ...
 02855   780   NtWaitForSingleObject  ... ) == 0x102
 02858   376   NtWaitForSingleObject  (808, 0, 0x0, ...
 02859   596   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 02860  1028   NtSetEventBoostPriority  (120, ...
 02861   384   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 02854   940   NtSetEventBoostPriority  ... ) == 0x0
 02862  1656   NtContinue  (99351856, 1, ...
 02863   896   NtQueryInformationThread  (896, Basic, 28, ...
 02856  1168   NtCreateEvent  ... 900, ) == 0x0
 02864  1268   NtSetEventBoostPriority  (808, ...
 02865  1248   NtRegisterThreadTerminatePort  (24, ...
 02866   780   NtWaitForSingleObject  (120, 0, 0x0, ...
 01201  1300   NtWaitForSingleObject  ... ) == 0x0
 02860  1028   NtSetEventBoostPriority  ... ) == 0x0
 02859   596   NtDuplicateObject  ... 904, ) == 0x0
 02861   384   NtDuplicateObject  ... 908, ) == 0x0
 02867   940   NtWaitForSingleObject  (64, 0, {0, 0}, ...
 02868  1656   NtRegisterThreadTerminatePort  (24, ...
 02863   896   NtQueryInformationThread  ... {ExitStatus=0x103,TebBaseAddress=0x7ff64000,Pid=1252,Tid=760,}, 0x0, ) == 0x0
 02869  1168   NtAllocateVirtualMemory  (-1, 1429504, 0, 4096, 4096, 4, ...
 02577   644   NtWaitForSingleObject  ... ) == 0x0
 02864  1268   NtSetEventBoostPriority  ... ) == 0x0
 02870  2012   NtCreateEvent  (0x1f0003, 0x0, 0, 0, ...
 02865  1248   NtRegisterThreadTerminatePort  ... ) == 0x0
 02871  1300   NtWaitForSingleObject  (296, 0, 0x0, ...
 02872  1028   NtCreateEvent  (0x1f0003, 0x0, 0, 0, ...
 02873   384   NtWaitForSingleObject  (296, 0, 0x0, ...
 02868  1656   NtRegisterThreadTerminatePort  ... ) == 0x0
 02874   596   NtWaitForSingleObject  (296, 0, 0x0, ...
 02867   940   NtWaitForSingleObject  ... ) == 0x102
 02869  1168   NtAllocateVirtualMemory  ... 1429504, 4096, ) == 0x0
 02875   644   NtWaitForSingleObject  (296, 0, 0x0, ...
 02876  1268   NtWaitForSingleObject  (64, 0, {0, 0}, ...
 02870  2012   NtCreateEvent  ... 912, ) == 0x0
 02877  1248   NtWaitForSingleObject  (296, 0, 0x0, ...
 02872  1028   NtCreateEvent  ... 916, ) == 0x0
 02878   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81942, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81942, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\200\3\0\0\344\4\0\0\370\2\0\0" ...  ...
 02879  1656   NtWaitForSingleObject  (296, 0, 0x0, ...
 02880   940   NtWaitForSingleObject  (296, 0, 0x0, ...
 02881  1168   NtSetEventBoostPriority  (296, ...
 02882  2012   NtWaitForSingleObject  (296, 0, 0x0, ...
 02883  1028   NtWaitForSingleObject  (296, 0, 0x0, ...
 02878   896   NtRequestWaitReplyPort  ... {28, 56, reply, 0, 1252, 896, 81943, 0}  ... {28, 56, reply, 0, 1252, 896, 81943, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\200\3\0\0\344\4\0\0\370\2\0\0" )  ) == 0x0
 02871  1300   NtWaitForSingleObject  ... ) == 0x0
 02881  1168   NtSetEventBoostPriority  ... ) == 0x0
 02884  1300   NtSetEventBoostPriority  (296, ...
 02885   896   NtResumeThread  (896, ...
 02876  1268   NtWaitForSingleObject  ... ) == 0x102
 02874   596   NtWaitForSingleObject  ... ) == 0x0
 02884  1300   NtSetEventBoostPriority  ... ) == 0x0
 02885   896   NtResumeThread  ... 1, ) == 0x0
 02886   596   NtSetEventBoostPriority  (296, ...
 02887  1268   NtWaitForSingleObject  (296, 0, 0x0, ...
 02888  1168   NtWaitForSingleObject  (296, 0, 0x0, ...
 02889   760   NtWaitForSingleObject  (296, 0, 0x0, ...
 02875   644   NtWaitForSingleObject  ... ) == 0x0
 02886   596   NtSetEventBoostPriority  ... ) == 0x0
 02890   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ...
 02891   644   NtSetEventBoostPriority  (296, ...
 02892   596   NtWaitForSingleObject  (296, 0, 0x0, ...
 02893  1300   NtWaitForSingleObject  (296, 0, 0x0, ...
 02877  1248   NtWaitForSingleObject  ... ) == 0x0
 02891   644   NtSetEventBoostPriority  ... ) == 0x0
 02890   896   NtAllocateVirtualMemory  ... 100401152, 1048576, ) == 0x0
 02894  1248   NtSetEventBoostPriority  (296, ...
 02895   896   NtAllocateVirtualMemory  (-1, 101441536, 0, 8192, 4096, 4, ...
 02879  1656   NtWaitForSingleObject  ... ) == 0x0
 02894  1248   NtSetEventBoostPriority  ... ) == 0x0
 02896  1656   NtSetEventBoostPriority  (296, ...
 02895   896   NtAllocateVirtualMemory  ... 101441536, 8192, ) == 0x0
 02897   644   NtSetEventBoostPriority  (808, ...
 02880   940   NtWaitForSingleObject  ... ) == 0x0
 02896  1656   NtSetEventBoostPriority  ... ) == 0x0
 02898   896   NtProtectVirtualMemory  (-1, (0x60be000), 4096, 260, ...
 02899   940   NtSetEventBoostPriority  (296, ...
 02580  1736   NtWaitForSingleObject  ... ) == 0x0
 02897   644   NtSetEventBoostPriority  ... ) == 0x0
 02900  1248   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 02882  2012   NtWaitForSingleObject  ... ) == 0x0
 02901  1736   NtWaitForSingleObject  (296, 0, 0x0, ...
 02899   940   NtSetEventBoostPriority  ... ) == 0x0
 02898   896   NtProtectVirtualMemory  ... (0x60be000), 4096, 4, ) == 0x0
 02902   644   NtWaitForSingleObject  (64, 0, {0, 0}, ...
 02903  2012   NtSetEventBoostPriority  (296, ...
 02900  1248   NtDuplicateObject  ... 920, ) == 0x0
 02904  1656   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 02905   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ...
 02883  1028   NtWaitForSingleObject  ... ) == 0x0
 02903  2012   NtSetEventBoostPriority  ... ) == 0x0
 02902   644   NtWaitForSingleObject  ... ) == 0x102
 02906  1248   NtWaitForSingleObject  (296, 0, 0x0, ...
 02904  1656   NtDuplicateObject  ... 924, ) == 0x0
 02907   940   NtWaitForSingleObject  (120, 0, 0x0, ...
 02908  1028   NtSetEventBoostPriority  (296, ...
 02905   896   NtCreateThread  ... 928, {1252, 484}, ) == 0x0
 02909   644   NtWaitForSingleObject  (296, 0, 0x0, ...
 02910  1656   NtWaitForSingleObject  (296, 0, 0x0, ...
 02873   384   NtWaitForSingleObject  ... ) == 0x0
 02908  1028   NtSetEventBoostPriority  ... ) == 0x0
 02911   896   NtQueryInformationThread  (928, Basic, 28, ...
 02912  2012   NtWaitForSingleObject  (296, 0, 0x0, ...
 02913   384   NtSetEventBoostPriority  (296, ...
 02911   896   NtQueryInformationThread  ... {ExitStatus=0x103,TebBaseAddress=0x7ff63000,Pid=1252,Tid=484,}, 0x0, ) == 0x0
 02887  1268   NtWaitForSingleObject  ... ) == 0x0
 02914   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81943, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81943, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\240\3\0\0\344\4\0\0\344\1\0\0" ...  ...
 02915  1268   NtSetEventBoostPriority  (296, ...
 02914   896   NtRequestWaitReplyPort  ... {28, 56, reply, 0, 1252, 896, 81944, 0}  ... {28, 56, reply, 0, 1252, 896, 81944, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\240\3\0\0\344\4\0\0\344\1\0\0" )  ) == 0x0
 02888  1168   NtWaitForSingleObject  ... ) == 0x0
 02915  1268   NtSetEventBoostPriority  ... ) == 0x0
 02913   384   NtSetEventBoostPriority  ... ) == 0x0
 02916  1028   NtWaitForSingleObject  (296, 0, 0x0, ...
 02917  1168   NtSetEventBoostPriority  (296, ...
 02918   896   NtResumeThread  (928, ...
 02919   384   NtWaitForSingleObject  (296, 0, 0x0, ...
 02889   760   NtWaitForSingleObject  ... ) == 0x0
 02917  1168   NtSetEventBoostPriority  ... ) == 0x0
 02918   896   NtResumeThread  ... 1, ) == 0x0
 02920   760   NtSetEventBoostPriority  (296, ...
 02921  1168   NtWaitForSingleObject  (296, 0, 0x0, ...
 02893  1300   NtWaitForSingleObject  ... ) == 0x0
 02920   760   NtSetEventBoostPriority  ... ) == 0x0
 02922   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ...
 02923  1268   NtWaitForSingleObject  (120, 0, 0x0, ...
 02924   484   NtWaitForSingleObject  (88, 0, 0x0, ...
 02925  1300   NtSetEventBoostPriority  (296, ...
 02922   896   NtAllocateVirtualMemory  ... 101449728, 1048576, ) == 0x0
 02892   596   NtWaitForSingleObject  ... ) == 0x0
 02925  1300   NtSetEventBoostPriority  ... ) == 0x0
 02926   596   NtSetEventBoostPriority  (296, ...
 02927   896   NtAllocateVirtualMemory  (-1, 102490112, 0, 8192, 4096, 4, ...
 02901  1736   NtWaitForSingleObject  ... ) == 0x0
 02928  1300   NtWaitForSingleObject  (296, 0, 0x0, ...
 02929  1736   NtSetEventBoostPriority  (296, ...
 02927   896   NtAllocateVirtualMemory  ... 102490112, 8192, ) == 0x0
 02926   596   NtSetEventBoostPriority  ... ) == 0x0
 02930   760   NtSetEventBoostPriority  (88, ...
 02906  1248   NtWaitForSingleObject  ... ) == 0x0
 02929  1736   NtSetEventBoostPriority  ... ) == 0x0
 02931   596   NtWaitForSingleObject  (296, 0, 0x0, ...
 02924   484   NtWaitForSingleObject  ... ) == 0x0
 02930   760   NtSetEventBoostPriority  ... ) == 0x0
 02932  1248   NtSetEventBoostPriority  (296, ...
 02933   896   NtProtectVirtualMemory  (-1, (0x61be000), 4096, 260, ...
 02934   484   NtWaitForSingleObject  (296, 0, 0x0, ...
 02935   760   NtTestAlert  (...
 02910  1656   NtWaitForSingleObject  ... ) == 0x0
 02932  1248   NtSetEventBoostPriority  ... ) == 0x0
 02933   896   NtProtectVirtualMemory  ... (0x61be000), 4096, 4, ) == 0x0
 02936  1656   NtSetEventBoostPriority  (296, ...
 02935   760   NtTestAlert  ... ) == 0x0
 02937  1736   NtSetEventBoostPriority  (808, ...
 02909   644   NtWaitForSingleObject  ... ) == 0x0
 02936  1656   NtSetEventBoostPriority  ... ) == 0x0
 02938   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ...
 02939   760   NtContinue  (100400432, 1, ...
 02940   644   NtSetEventBoostPriority  (296, ...
 02585  1484   NtWaitForSingleObject  ... ) == 0x0
 02937  1736   NtSetEventBoostPriority  ... ) == 0x0
 02941  1248   NtWaitForSingleObject  (296, 0, 0x0, ...
 02938   896   NtCreateThread  ... 932, {1252, 1580}, ) == 0x0
 02912  2012   NtWaitForSingleObject  ... ) == 0x0
 02942  1484   NtWaitForSingleObject  (296, 0, 0x0, ...
 02943   760   NtRegisterThreadTerminatePort  (24, ...
 02944  1736   NtWaitForSingleObject  (64, 0, {0, 0}, ...
 02945   896   NtQueryInformationThread  (932, Basic, 28, ...
 02946  2012   NtAllocateVirtualMemory  (-1, 1433600, 0, 4096, 4096, 4, ...
 02940   644   NtSetEventBoostPriority  ... ) == 0x0
 02947  1656   NtWaitForSingleObject  (296, 0, 0x0, ...
 02944  1736   NtWaitForSingleObject  ... ) == 0x102
 02945   896   NtQueryInformationThread  ... {ExitStatus=0x103,TebBaseAddress=0x7ff62000,Pid=1252,Tid=1580,}, 0x0, ) == 0x0
 02946  2012   NtAllocateVirtualMemory  ... 1433600, 4096, ) == 0x0
 02948   644   NtWaitForSingleObject  (120, 0, 0x0, ...
 02949  1736   NtWaitForSingleObject  (296, 0, 0x0, ...
 02943   760   NtRegisterThreadTerminatePort  ... ) == 0x0
 02950  2012   NtSetEventBoostPriority  (296, ...
 02951   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81944, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81944, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\244\3\0\0\344\4\0\0,\6\0\0" ...  ...
 02952   760   NtWaitForSingleObject  (296, 0, 0x0, ...
 02951   896   NtRequestWaitReplyPort  ... {28, 56, reply, 0, 1252, 896, 81945, 0}  ... {28, 56, reply, 0, 1252, 896, 81945, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\244\3\0\0\344\4\0\0,\6\0\0" )  ) == 0x0
 02953   896   NtResumeThread  (932, ... 1, ) == 0x0
 02954   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ... 102498304, 1048576, ) == 0x0
 02955   896   NtAllocateVirtualMemory  (-1, 103538688, 0, 8192, 4096, 4, ... 103538688, 8192, ) == 0x0
 02956   896   NtProtectVirtualMemory  (-1, (0x62be000), 4096, 260, ... (0x62be000), 4096, 4, ) == 0x0
 02957   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ...
 02916  1028   NtWaitForSingleObject  ... ) == 0x0
 02950  2012   NtSetEventBoostPriority  ... ) == 0x0
 02958  1580   NtWaitForSingleObject  (88, 0, 0x0, ...
 02959  1028   NtSetEventBoostPriority  (296, ...
 02960  2012   NtWaitForSingleObject  (296, 0, 0x0, ...
 02919   384   NtWaitForSingleObject  ... ) == 0x0
 02959  1028   NtSetEventBoostPriority  ... ) == 0x0
 02961   384   NtSetEventBoostPriority  (296, ...
 02921  1168   NtWaitForSingleObject  ... ) == 0x0
 02962  1168   NtSetEventBoostPriority  (296, ...
 02928  1300   NtWaitForSingleObject  ... ) == 0x0
 02963  1300   NtSetEventBoostPriority  (296, ...
 02931   596   NtWaitForSingleObject  ... ) == 0x0
 02964   596   NtSetEventBoostPriority  (296, ...
 02934   484   NtWaitForSingleObject  ... ) == 0x0
 02965   484   NtSetEventBoostPriority  (296, ...
 02941  1248   NtWaitForSingleObject  ... ) == 0x0
 02966  1248   NtSetEventBoostPriority  (296, ...
 02942  1484   NtWaitForSingleObject  ... ) == 0x0
 02967  1484   NtSetEventBoostPriority  (296, ...
 02947  1656   NtWaitForSingleObject  ... ) == 0x0
 02968  1656   NtSetEventBoostPriority  (296, ...
 02949  1736   NtWaitForSingleObject  ... ) == 0x0
 02969  1736   NtSetEventBoostPriority  (296, ...
 02952   760   NtWaitForSingleObject  ... ) == 0x0
 02970   760   NtSetEventBoostPriority  (296, ...
 02960  2012   NtWaitForSingleObject  ... ) == 0x0
 02971  2012   NtAllocateVirtualMemory  (-1, 1437696, 0, 4096, 4096, 4, ... 1437696, 4096, ) == 0x0
 02970   760   NtSetEventBoostPriority  ... ) == 0x0
 02968  1656   NtSetEventBoostPriority  ... ) == 0x0
 02966  1248   NtSetEventBoostPriority  ... ) == 0x0
 02965   484   NtSetEventBoostPriority  ... ) == 0x0
 02964   596   NtSetEventBoostPriority  ... ) == 0x0
 02961   384   NtSetEventBoostPriority  ... ) == 0x0
 02972  1028   NtWaitForSingleObject  (296, 0, 0x0, ...
 02969  1736   NtSetEventBoostPriority  ... ) == 0x0
 02967  1484   NtSetEventBoostPriority  ... ) == 0x0
 02963  1300   NtSetEventBoostPriority  ... ) == 0x0
 02962  1168   NtSetEventBoostPriority  ... ) == 0x0
 02957   896   NtCreateThread  ... 936, {1252, 1756}, ) == 0x0
 02973  2012   NtSetEventBoostPriority  (296, ...
 02974  1656   NtWaitForSingleObject  (296, 0, 0x0, ...
 02975  1248   NtWaitForSingleObject  (296, 0, 0x0, ...
 02976   760   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 02977   484   NtSetEventBoostPriority  (88, ...
 02978   596   NtWaitForSingleObject  (296, 0, 0x0, ...
 02979   384   NtWaitForSingleObject  (296, 0, 0x0, ...
 02980  1736   NtWaitForSingleObject  (120, 0, 0x0, ...
 02981  1300   NtWaitForSingleObject  (296, 0, 0x0, ...
 02982  1168   NtWaitForSingleObject  (296, 0, 0x0, ...
 02983   896   NtQueryInformationThread  (936, Basic, 28, ...
 02972  1028   NtWaitForSingleObject  ... ) == 0x0
 02973  2012   NtSetEventBoostPriority  ... ) == 0x0
 02984  1484   NtSetEventBoostPriority  (808, ...
 02976   760   NtDuplicateObject  ... 940, ) == 0x0
 02958  1580   NtWaitForSingleObject  ... ) == 0x0
 02977   484   NtSetEventBoostPriority  ... ) == 0x0
 02985  1028   NtSetEventBoostPriority  (296, ...
 02983   896   NtQueryInformationThread  ... {ExitStatus=0x103,TebBaseAddress=0x7ff61000,Pid=1252,Tid=1756,}, 0x0, ) == 0x0
 02986  2012   NtWaitForSingleObject  (296, 0, 0x0, ...
 02692  1568   NtWaitForSingleObject  ... ) == 0x0
 02984  1484   NtSetEventBoostPriority  ... ) == 0x0
 02987  1580   NtWaitForSingleObject  (296, 0, 0x0, ...
 02988   760   NtWaitForSingleObject  (296, 0, 0x0, ...
 02974  1656   NtWaitForSingleObject  ... ) == 0x0
 02989   484   NtTestAlert  (...
 02990   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81945, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81945, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\250\3\0\0\344\4\0\0\334\6\0\0" ...  ...
 02991  1568   NtWaitForSingleObject  (296, 0, 0x0, ...
 02992  1484   NtWaitForSingleObject  (64, 0, {0, 0}, ...
 02993  1656   NtSetEventBoostPriority  (296, ...
 02989   484   NtTestAlert  ... ) == 0x0
 02990   896   NtRequestWaitReplyPort  ... {28, 56, reply, 0, 1252, 896, 81946, 0}  ... {28, 56, reply, 0, 1252, 896, 81946, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\250\3\0\0\344\4\0\0\334\6\0\0" )  ) == 0x0
 02992  1484   NtWaitForSingleObject  ... ) == 0x102
 02978   596   NtWaitForSingleObject  ... ) == 0x0
 02994   484   NtContinue  (101449008, 1, ...
 02993  1656   NtSetEventBoostPriority  ... ) == 0x0
 02985  1028   NtSetEventBoostPriority  ... ) == 0x0
 02995  1484   NtWaitForSingleObject  (120, 0, 0x0, ...
 02996   596   NtSetEventBoostPriority  (296, ...
 02997   484   NtRegisterThreadTerminatePort  (24, ...
 02998  1656   NtWaitForSingleObject  (808, 0, 0x0, ...
 02999  1028   NtWaitForSingleObject  (296, 0, 0x0, ...
 03000   896   NtResumeThread  (936, ...
 02979   384   NtWaitForSingleObject  ... ) == 0x0
 02996   596   NtSetEventBoostPriority  ... ) == 0x0
 03001   384   NtSetEventBoostPriority  (296, ...
 03000   896   NtResumeThread  ... 1, ) == 0x0
 02981  1300   NtWaitForSingleObject  ... ) == 0x0
 03001   384   NtSetEventBoostPriority  ... ) == 0x0
 03002   596   NtWaitForSingleObject  (296, 0, 0x0, ...
 03003  1300   NtSetEventBoostPriority  (296, ...
 03004   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ...
 03005   384   NtWaitForSingleObject  (296, 0, 0x0, ...
 02997   484   NtRegisterThreadTerminatePort  ... ) == 0x0
 03006  1756   NtWaitForSingleObject  (88, 0, 0x0, ...
 02982  1168   NtWaitForSingleObject  ... ) == 0x0
 03003  1300   NtSetEventBoostPriority  ... ) == 0x0
 03004   896   NtAllocateVirtualMemory  ... 103546880, 1048576, ) == 0x0
 03007   484   NtWaitForSingleObject  (296, 0, 0x0, ...
 03008  1168   NtSetEventBoostPriority  (296, ...
 03009   896   NtAllocateVirtualMemory  (-1, 104587264, 0, 8192, 4096, 4, ...
 02986  2012   NtWaitForSingleObject  ... ) == 0x0
 03008  1168   NtSetEventBoostPriority  ... ) == 0x0
 03010  2012   NtSetEventBoostPriority  (296, ...
 03009   896   NtAllocateVirtualMemory  ... 104587264, 8192, ) == 0x0
 03011  1300   NtSetEventBoostPriority  (120, ...
 02987  1580   NtWaitForSingleObject  ... ) == 0x0
 03010  2012   NtSetEventBoostPriority  ... ) == 0x0
 03012  1168   NtWaitForSingleObject  (296, 0, 0x0, ...
 03013  1580   NtSetEventBoostPriority  (296, ...
 01259  1948   NtWaitForSingleObject  ... ) == 0x0
 03011  1300   NtSetEventBoostPriority  ... ) == 0x0
 03014   896   NtProtectVirtualMemory  (-1, (0x63be000), 4096, 260, ...
 02988   760   NtWaitForSingleObject  ... ) == 0x0
 03015  1948   NtWaitForSingleObject  (296, 0, 0x0, ...
 03013  1580   NtSetEventBoostPriority  ... ) == 0x0
 03016  1300   NtCreateEvent  (0x1f0003, 0x0, 0, 0, ...
 03017   760   NtSetEventBoostPriority  (296, ...
 03014   896   NtProtectVirtualMemory  ... (0x63be000), 4096, 4, ) == 0x0
 03018  2012   NtWaitForSingleObject  (296, 0, 0x0, ...
 02991  1568   NtWaitForSingleObject  ... ) == 0x0
 03017   760   NtSetEventBoostPriority  ... ) == 0x0
 03016  1300   NtCreateEvent  ... 944, ) == 0x0
 03019   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ...
 03020  1568   NtSetEventBoostPriority  (296, ...
 03021  1580   NtSetEventBoostPriority  (88, ...
 03022  1300   NtWaitForSingleObject  (296, 0, 0x0, ...
 02975  1248   NtWaitForSingleObject  ... ) == 0x0
 03020  1568   NtSetEventBoostPriority  ... ) == 0x0
 03019   896   NtCreateThread  ... 948, {1252, 1304}, ) == 0x0
 03006  1756   NtWaitForSingleObject  ... ) == 0x0
 03021  1580   NtSetEventBoostPriority  ... ) == 0x0
 03023  1248   NtSetEventBoostPriority  (296, ...
 03024   760   NtWaitForSingleObject  (808, 0, 0x0, ...
 03025  1756   NtWaitForSingleObject  (296, 0, 0x0, ...
 03026   896   NtQueryInformationThread  (948, Basic, 28, ...
 02999  1028   NtWaitForSingleObject  ... ) == 0x0
 03027  1580   NtTestAlert  (...
 03026   896   NtQueryInformationThread  ... {ExitStatus=0x103,TebBaseAddress=0x7ff60000,Pid=1252,Tid=1304,}, 0x0, ) == 0x0
 03028  1028   NtSetEventBoostPriority  (296, ...
 03027  1580   NtTestAlert  ... ) == 0x0
 03023  1248   NtSetEventBoostPriority  ... ) == 0x0
 03029  1568   NtSetEventBoostPriority  (808, ...
 03002   596   NtWaitForSingleObject  ... ) == 0x0
 03028  1028   NtSetEventBoostPriority  ... ) == 0x0
 03030  1580   NtContinue  (102497584, 1, ...
 03031  1248   NtWaitForSingleObject  (808, 0, 0x0, ...
 03032   596   NtSetEventBoostPriority  (296, ...
 02761  1624   NtWaitForSingleObject  ... ) == 0x0
 03029  1568   NtSetEventBoostPriority  ... ) == 0x0
 03033   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81946, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81946, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\264\3\0\0\344\4\0\0\30\5\0\0" ...  ...
 03034  1580   NtRegisterThreadTerminatePort  (24, ...
 03005   384   NtWaitForSingleObject  ... ) == 0x0
 03035  1624   NtWaitForSingleObject  (296, 0, 0x0, ...
 03036  1568   NtWaitForSingleObject  (64, 0, {0, 0}, ...
 03033   896   NtRequestWaitReplyPort  ... {28, 56, reply, 0, 1252, 896, 81947, 0}  ... {28, 56, reply, 0, 1252, 896, 81947, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\264\3\0\0\344\4\0\0\30\5\0\0" )  ) == 0x0
 03032   596   NtSetEventBoostPriority  ... ) == 0x0
 03037  1028   NtWaitForSingleObject  (296, 0, 0x0, ...
 03038   384   NtSetEventBoostPriority  (296, ...
 03036  1568   NtWaitForSingleObject  ... ) == 0x102
 03039   896   NtResumeThread  (948, ...
 03040   596   NtWaitForSingleObject  (808, 0, 0x0, ...
 03007   484   NtWaitForSingleObject  ... ) == 0x0
 03041  1568   NtWaitForSingleObject  (120, 0, 0x0, ...
 03039   896   NtResumeThread  ... 1, ) == 0x0
 03042   484   NtSetEventBoostPriority  (296, ...
 03038   384   NtSetEventBoostPriority  ... ) == 0x0
 03034  1580   NtRegisterThreadTerminatePort  ... ) == 0x0
 03043  1304   NtWaitForSingleObject  (88, 0, 0x0, ...
 03044   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ...
 03012  1168   NtWaitForSingleObject  ... ) == 0x0
 03042   484   NtSetEventBoostPriority  ... ) == 0x0
 03045   384   NtWaitForSingleObject  (296, 0, 0x0, ...
 03046  1580   NtWaitForSingleObject  (296, 0, 0x0, ...
 03047  1168   NtSetEventBoostPriority  (296, ...
 03044   896   NtAllocateVirtualMemory  ... 104595456, 1048576, ) == 0x0
 03015  1948   NtWaitForSingleObject  ... ) == 0x0
 03047  1168   NtSetEventBoostPriority  ... ) == 0x0
 03048  1948   NtSetEventBoostPriority  (296, ...
 03049   896   NtAllocateVirtualMemory  (-1, 105635840, 0, 8192, 4096, 4, ...
 03018  2012   NtWaitForSingleObject  ... ) == 0x0
 03048  1948   NtSetEventBoostPriority  ... ) == 0x0
 03050  1168   NtWaitForSingleObject  (296, 0, 0x0, ...
 03051  2012   NtSetEventBoostPriority  (296, ...
 03049   896   NtAllocateVirtualMemory  ... 105635840, 8192, ) == 0x0
 03052   484   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 03053  1948   NtSetEventBoostPriority  (120, ...
 03022  1300   NtWaitForSingleObject  ... ) == 0x0
 03051  2012   NtSetEventBoostPriority  ... ) == 0x0
 03054   896   NtProtectVirtualMemory  (-1, (0x64be000), 4096, 260, ...
 03052   484   NtDuplicateObject  ... 952, ) == 0x0
 03055  1300   NtSetEventBoostPriority  (296, ...
 01278   252   NtWaitForSingleObject  ... ) == 0x0
 03053  1948   NtSetEventBoostPriority  ... ) == 0x0
 03056  2012   NtWaitForSingleObject  (296, 0, 0x0, ...
 03054   896   NtProtectVirtualMemory  ... (0x64be000), 4096, 4, ) == 0x0
 03025  1756   NtWaitForSingleObject  ... ) == 0x0
 03057   252   NtWaitForSingleObject  (296, 0, 0x0, ...
 03055  1300   NtSetEventBoostPriority  ... ) == 0x0
 03058   484   NtWaitForSingleObject  (296, 0, 0x0, ...
 03059  1948   NtCreateEvent  (0x1f0003, 0x0, 0, 0, ...
 03060  1756   NtSetEventBoostPriority  (296, ...
 03061   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ...
 03035  1624   NtWaitForSingleObject  ... ) == 0x0
 03060  1756   NtSetEventBoostPriority  ... ) == 0x0
 03059  1948   NtCreateEvent  ... 956, ) == 0x0
 03062  1300   NtWaitForSingleObject  (296, 0, 0x0, ...
 03063  1624   NtSetEventBoostPriority  (296, ...
 03061   896   NtCreateThread  ... 960, {1252, 2052}, ) == 0x0
 03064  1948   NtWaitForSingleObject  (296, 0, 0x0, ...
 03037  1028   NtWaitForSingleObject  ... ) == 0x0
 03063  1624   NtSetEventBoostPriority  ... ) == 0x0
 03065   896   NtQueryInformationThread  (960, Basic, 28, ...
 03066  1028   NtSetEventBoostPriority  (296, ...
 03067  1756   NtSetEventBoostPriority  (88, ...
 03045   384   NtWaitForSingleObject  ... ) == 0x0
 03066  1028   NtSetEventBoostPriority  ... ) == 0x0
 03065   896   NtQueryInformationThread  ... {ExitStatus=0x103,TebBaseAddress=0x7ff5f000,Pid=1252,Tid=2052,}, 0x0, ) == 0x0
 03068   384   NtSetEventBoostPriority  (296, ...
 03043  1304   NtWaitForSingleObject  ... ) == 0x0
 03067  1756   NtSetEventBoostPriority  ... ) == 0x0
 03069  1028   NtWaitForSingleObject  (296, 0, 0x0, ...
 03046  1580   NtWaitForSingleObject  ... ) == 0x0
 03070  1304   NtWaitForSingleObject  (296, 0, 0x0, ...
 03068   384   NtSetEventBoostPriority  ... ) == 0x0
 03071   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81947, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81947, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\300\3\0\0\344\4\0\0\4\10\0\0" ...  ...
 03072  1756   NtTestAlert  (...
 03073  1624   NtSetEventBoostPriority  (808, ...
 03074  1580   NtSetEventBoostPriority  (296, ...
 03071   896   NtRequestWaitReplyPort  ... {28, 56, reply, 0, 1252, 896, 81948, 0}  ... {28, 56, reply, 0, 1252, 896, 81948, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\300\3\0\0\344\4\0\0\4\10\0\0" )  ) == 0x0
 03072  1756   NtTestAlert  ... ) == 0x0
 03050  1168   NtWaitForSingleObject  ... ) == 0x0
 03074  1580   NtSetEventBoostPriority  ... ) == 0x0
 02766  1716   NtWaitForSingleObject  ... ) == 0x0
 03073  1624   NtSetEventBoostPriority  ... ) == 0x0
 03075   384   NtWaitForSingleObject  (296, 0, 0x0, ...
 03076  1168   NtSetEventBoostPriority  (296, ...
 03077  1756   NtContinue  (103546160, 1, ...
 03078   896   NtResumeThread  (960, ...
 03079  1716   NtWaitForSingleObject  (296, 0, 0x0, ...
 03080  1624   NtWaitForSingleObject  (64, 0, {0, 0}, ...
 03057   252   NtWaitForSingleObject  ... ) == 0x0
 03081  1756   NtRegisterThreadTerminatePort  (24, ...
 03078   896   NtResumeThread  ... 1, ) == 0x0
 03082   252   NtSetEventBoostPriority  (296, ...
 03080  1624   NtWaitForSingleObject  ... ) == 0x102
 03076  1168   NtSetEventBoostPriority  ... ) == 0x0
 03083  1580   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 03084  2052   NtWaitForSingleObject  (88, 0, 0x0, ...
 03056  2012   NtWaitForSingleObject  ... ) == 0x0
 03082   252   NtSetEventBoostPriority  ... ) == 0x0
 03085   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ...
 03086  1624   NtWaitForSingleObject  (120, 0, 0x0, ...
 03087  1168   NtWaitForSingleObject  (296, 0, 0x0, ...
 03083  1580   NtDuplicateObject  ... 964, ) == 0x0
 03088  2012   NtSetEventBoostPriority  (296, ...
 03081  1756   NtRegisterThreadTerminatePort  ... ) == 0x0
 03085   896   NtAllocateVirtualMemory  ... 105644032, 1048576, ) == 0x0
 03089   252   NtSetEventBoostPriority  (120, ...
 03058   484   NtWaitForSingleObject  ... ) == 0x0
 03090  1580   NtWaitForSingleObject  (296, 0, 0x0, ...
 03091  1756   NtWaitForSingleObject  (296, 0, 0x0, ...
 03092   896   NtAllocateVirtualMemory  (-1, 106684416, 0, 8192, 4096, 4, ...
 01287  1372   NtWaitForSingleObject  ... ) == 0x0
 03089   252   NtSetEventBoostPriority  ... ) == 0x0
 03093   484   NtSetEventBoostPriority  (296, ...
 03094  1372   NtWaitForSingleObject  (296, 0, 0x0, ...
 03092   896   NtAllocateVirtualMemory  ... 106684416, 8192, ) == 0x0
 03095   252   NtCreateEvent  (0x1f0003, 0x0, 0, 0, ...
 03062  1300   NtWaitForSingleObject  ... ) == 0x0
 03093   484   NtSetEventBoostPriority  ... ) == 0x0
 03088  2012   NtSetEventBoostPriority  ... ) == 0x0
 03096  1300   NtSetEventBoostPriority  (296, ...
 03095   252   NtCreateEvent  ... 968, ) == 0x0
 03097   896   NtProtectVirtualMemory  (-1, (0x65be000), 4096, 260, ...
 03064  1948   NtWaitForSingleObject  ... ) == 0x0
 03096  1300   NtSetEventBoostPriority  ... ) == 0x0
 03098  2012   NtWaitForSingleObject  (296, 0, 0x0, ...
 03099   252   NtWaitForSingleObject  (296, 0, 0x0, ...
 03100  1948   NtSetEventBoostPriority  (296, ...
 03097   896   NtProtectVirtualMemory  ... (0x65be000), 4096, 4, ) == 0x0
 03101  1300   NtWaitForSingleObject  (296, 0, 0x0, ...
 03070  1304   NtWaitForSingleObject  ... ) == 0x0
 03100  1948   NtSetEventBoostPriority  ... ) == 0x0
 03102   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ...
 03103   484   NtWaitForSingleObject  (296, 0, 0x0, ...
 03104  1304   NtSetEventBoostPriority  (296, ...
 03102   896   NtCreateThread  ... 972, {1252, 2056}, ) == 0x0
 03069  1028   NtWaitForSingleObject  ... ) == 0x0
 03104  1304   NtSetEventBoostPriority  ... ) == 0x0
 03105  1028   NtSetEventBoostPriority  (296, ...
 03106   896   NtQueryInformationThread  (972, Basic, 28, ...
 03107  1948   NtWaitForSingleObject  (296, 0, 0x0, ...
 03075   384   NtWaitForSingleObject  ... ) == 0x0
 03106   896   NtQueryInformationThread  ... {ExitStatus=0x103,TebBaseAddress=0x7ff5e000,Pid=1252,Tid=2056,}, 0x0, ) == 0x0
 03108   384   NtSetEventBoostPriority  (296, ...
 03105  1028   NtSetEventBoostPriority  ... ) == 0x0
 03109  1304   NtSetEventBoostPriority  (88, ...
 03079  1716   NtWaitForSingleObject  ... ) == 0x0
 03108   384   NtSetEventBoostPriority  ... ) == 0x0
 03110  1028   NtWaitForSingleObject  (296, 0, 0x0, ...
 03111  1716   NtSetEventBoostPriority  (296, ...
 03084  2052   NtWaitForSingleObject  ... ) == 0x0
 03109  1304   NtSetEventBoostPriority  ... ) == 0x0
 03112   384   NtWaitForSingleObject  (808, 0, 0x0, ...
 03087  1168   NtWaitForSingleObject  ... ) == 0x0
 03113  2052   NtWaitForSingleObject  (296, 0, 0x0, ...
 03114  1304   NtTestAlert  (...
 03111  1716   NtSetEventBoostPriority  ... ) == 0x0
 03115   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81948, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81948, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\314\3\0\0\344\4\0\0\10\10\0\0" ...  ...
 03116  1168   NtSetEventBoostPriority  (296, ...
 03114  1304   NtTestAlert  ... ) == 0x0
 03115   896   NtRequestWaitReplyPort  ... {28, 56, reply, 0, 1252, 896, 81949, 0}  ... {28, 56, reply, 0, 1252, 896, 81949, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\314\3\0\0\344\4\0\0\10\10\0\0" )  ) == 0x0
 03090  1580   NtWaitForSingleObject  ... ) == 0x0
 03116  1168   NtSetEventBoostPriority  ... ) == 0x0
 03117  1304   NtContinue  (104594736, 1, ...
 03118  1580   NtSetEventBoostPriority  (296, ...
 03119   896   NtResumeThread  (972, ...
 03120  1716   NtSetEventBoostPriority  (808, ...
 03091  1756   NtWaitForSingleObject  ... ) == 0x0
 03118  1580   NtSetEventBoostPriority  ... ) == 0x0
 03121  1304   NtRegisterThreadTerminatePort  (24, ...
 03119   896   NtResumeThread  ... 1, ) == 0x0
 03122  1756   NtSetEventBoostPriority  (296, ...
 02771  1440   NtWaitForSingleObject  ... ) == 0x0
 03120  1716   NtSetEventBoostPriority  ... ) == 0x0
 03123  1168   NtWaitForSingleObject  (296, 0, 0x0, ...
 03124  2056   NtWaitForSingleObject  (88, 0, 0x0, ...
 03125  1580   NtWaitForSingleObject  (296, 0, 0x0, ...
 03094  1372   NtWaitForSingleObject  ... ) == 0x0
 03126  1440   NtWaitForSingleObject  (296, 0, 0x0, ...
 03122  1756   NtSetEventBoostPriority  ... ) == 0x0
 03127   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ...
 03128  1716   NtWaitForSingleObject  (64, 0, {0, 0}, ...
 03129  1372   NtSetEventBoostPriority  (296, ...
 03121  1304   NtRegisterThreadTerminatePort  ... ) == 0x0
 03130  1756   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 03098  2012   NtWaitForSingleObject  ... ) == 0x0
 03129  1372   NtSetEventBoostPriority  ... ) == 0x0
 03128  1716   NtWaitForSingleObject  ... ) == 0x102
 03131  1304   NtWaitForSingleObject  (296, 0, 0x0, ...
 03132  2012   NtSetEventBoostPriority  (296, ...
 03130  1756   NtDuplicateObject  ... 976, ) == 0x0
 03127   896   NtAllocateVirtualMemory  ... 106692608, 1048576, ) == 0x0
 03133  1716   NtWaitForSingleObject  (120, 0, 0x0, ...
 03099   252   NtWaitForSingleObject  ... ) == 0x0
 03132  2012   NtSetEventBoostPriority  ... ) == 0x0
 03134  1756   NtWaitForSingleObject  (296, 0, 0x0, ...
 03135   896   NtAllocateVirtualMemory  (-1, 107732992, 0, 8192, 4096, 4, ...
 03136  1372   NtSetEventBoostPriority  (120, ...
 03137   252   NtSetEventBoostPriority  (296, ...
 03135   896   NtAllocateVirtualMemory  ... 107732992, 8192, ) == 0x0
 03101  1300   NtWaitForSingleObject  ... ) == 0x0
 03137   252   NtSetEventBoostPriority  ... ) == 0x0
 01288  1600   NtWaitForSingleObject  ... ) == 0x0
 03136  1372   NtSetEventBoostPriority  ... ) == 0x0
 03138  1300   NtAllocateVirtualMemory  (-1, 1441792, 0, 4096, 4096, 4, ...
 03139   896   NtProtectVirtualMemory  (-1, (0x66be000), 4096, 260, ...
 03140  2012   NtWaitForSingleObject  (296, 0, 0x0, ...
 03141  1600   NtWaitForSingleObject  (296, 0, 0x0, ...
 03138  1300   NtAllocateVirtualMemory  ... 1441792, 4096, ) == 0x0
 03142  1372   NtCreateEvent  (0x1f0003, 0x0, 0, 0, ...
 03139   896   NtProtectVirtualMemory  ... (0x66be000), 4096, 4, ) == 0x0
 03143  1300   NtSetEventBoostPriority  (296, ...
 03142  1372   NtCreateEvent  ... 980, ) == 0x0
 03103   484   NtWaitForSingleObject  ... ) == 0x0
 03144   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ...
 03145  1372   NtWaitForSingleObject  (296, 0, 0x0, ...
 03146   484   NtSetEventBoostPriority  (296, ...
 03143  1300   NtSetEventBoostPriority  ... ) == 0x0
 03147   252   NtWaitForSingleObject  (296, 0, 0x0, ...
 03107  1948   NtWaitForSingleObject  ... ) == 0x0
 03146   484   NtSetEventBoostPriority  ... ) == 0x0
 03144   896   NtCreateThread  ... 984, {1252, 2060}, ) == 0x0
 03148  1948   NtAllocateVirtualMemory  (-1, 1445888, 0, 4096, 4096, 4, ...
 03149   484   NtWaitForSingleObject  (808, 0, 0x0, ...
 03148  1948   NtAllocateVirtualMemory  ... 1445888, 4096, ) == 0x0
 03150   896   NtQueryInformationThread  (984, Basic, 28, ...
 03151  1300   NtWaitForSingleObject  (296, 0, 0x0, ...
 03152  1948   NtSetEventBoostPriority  (296, ...
 03150   896   NtQueryInformationThread  ... {ExitStatus=0x103,TebBaseAddress=0x7ff5d000,Pid=1252,Tid=2060,}, 0x0, ) == 0x0
 03153   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81949, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81949, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\330\3\0\0\344\4\0\0\14\10\0\0" ... {28, 56, reply, 0, 1252, 896, 81950, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\330\3\0\0\344\4\0\0\14\10\0\0" )  ... {28, 56, reply, 0, 1252, 896, 81950, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81949, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\330\3\0\0\344\4\0\0\14\10\0\0" ... {28, 56, reply, 0, 1252, 896, 81950, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\330\3\0\0\344\4\0\0\14\10\0\0" )  ) == 0x0
 03154   896   NtResumeThread  (984, ... 1, ) == 0x0
 03155   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ... 107741184, 1048576, ) == 0x0
 03156   896   NtAllocateVirtualMemory  (-1, 108781568, 0, 8192, 4096, 4, ... 108781568, 8192, ) == 0x0
 03110  1028   NtWaitForSingleObject  ... ) == 0x0
 03152  1948   NtSetEventBoostPriority  ... ) == 0x0
 03157  2060   NtWaitForSingleObject  (88, 0, 0x0, ...
 03158  1028   NtSetEventBoostPriority  (296, ...
 03159  1948   NtWaitForSingleObject  (296, 0, 0x0, ...
 03113  2052   NtWaitForSingleObject  ... ) == 0x0
 03158  1028   NtSetEventBoostPriority  ... ) == 0x0
 03160  2052   NtSetEventBoostPriority  (296, ...
 03161   896   NtProtectVirtualMemory  (-1, (0x67be000), 4096, 260, ...
 03123  1168   NtWaitForSingleObject  ... ) == 0x0
 03160  2052   NtSetEventBoostPriority  ... ) == 0x0
 03162  1168   NtSetEventBoostPriority  (296, ...
 03161   896   NtProtectVirtualMemory  ... (0x67be000), 4096, 4, ) == 0x0
 03163  1028   NtWaitForSingleObject  (296, 0, 0x0, ...
 03126  1440   NtWaitForSingleObject  ... ) == 0x0
 03162  1168   NtSetEventBoostPriority  ... ) == 0x0
 03164   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ...
 03165  1440   NtSetEventBoostPriority  (296, ...
 03166  1168   NtAllocateVirtualMemory  (-1, 18599936, 0, 4096, 4096, 260, ...
 03125  1580   NtWaitForSingleObject  ... ) == 0x0
 03165  1440   NtSetEventBoostPriority  ... ) == 0x0
 03164   896   NtCreateThread  ... 988, {1252, 2064}, ) == 0x0
 03167  2052   NtSetEventBoostPriority  (88, ...
 03168  1580   NtSetEventBoostPriority  (296, ...
 03166  1168   NtAllocateVirtualMemory  ... 18599936, 4096, ) == 0x0
 03169   896   NtQueryInformationThread  (988, Basic, 28, ...
 03131  1304   NtWaitForSingleObject  ... ) == 0x0
 03168  1580   NtSetEventBoostPriority  ... ) == 0x0
 03124  2056   NtWaitForSingleObject  ... ) == 0x0
 03167  2052   NtSetEventBoostPriority  ... ) == 0x0
 03170  1168   NtWaitForSingleObject  (296, 0, 0x0, ...
 03171  1304   NtSetEventBoostPriority  (296, ...
 03169   896   NtQueryInformationThread  ... {ExitStatus=0x103,TebBaseAddress=0x7ff5c000,Pid=1252,Tid=2064,}, 0x0, ) == 0x0
 03172  2056   NtWaitForSingleObject  (296, 0, 0x0, ...
 03173  1580   NtWaitForSingleObject  (808, 0, 0x0, ...
 03174  2052   NtTestAlert  (...
 03134  1756   NtWaitForSingleObject  ... ) == 0x0
 03171  1304   NtSetEventBoostPriority  ... ) == 0x0
 03175  1440   NtSetEventBoostPriority  (808, ...
 03176   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81950, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81950, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\334\3\0\0\344\4\0\0\20\10\0\0" ...  ...
 03177  1756   NtSetEventBoostPriority  (296, ...
 03174  2052   NtTestAlert  ... ) == 0x0
 02789   420   NtWaitForSingleObject  ... ) == 0x0
 03175  1440   NtSetEventBoostPriority  ... ) == 0x0
 03141  1600   NtWaitForSingleObject  ... ) == 0x0
 03177  1756   NtSetEventBoostPriority  ... ) == 0x0
 03176   896   NtRequestWaitReplyPort  ... {28, 56, reply, 0, 1252, 896, 81951, 0}  ... {28, 56, reply, 0, 1252, 896, 81951, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\334\3\0\0\344\4\0\0\20\10\0\0" )  ) == 0x0
 03178   420   NtWaitForSingleObject  (296, 0, 0x0, ...
 03179  2052   NtContinue  (105643312, 1, ...
 03180  1600   NtSetEventBoostPriority  (296, ...
 03181  1440   NtWaitForSingleObject  (64, 0, {0, 0}, ...
 03182  1304   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 03183   896   NtResumeThread  (988, ...
 03140  2012   NtWaitForSingleObject  ... ) == 0x0
 03180  1600   NtSetEventBoostPriority  ... ) == 0x0
 03184  2052   NtRegisterThreadTerminatePort  (24, ...
 03181  1440   NtWaitForSingleObject  ... ) == 0x102
 03182  1304   NtDuplicateObject  ... 992, ) == 0x0
 03185  2012   NtSetEventBoostPriority  (296, ...
 03183   896   NtResumeThread  ... 1, ) == 0x0
 03186  1756   NtWaitForSingleObject  (296, 0, 0x0, ...
 03187  1600   NtWaitForSingleObject  (296, 0, 0x0, ...
 03188  2064   NtWaitForSingleObject  (88, 0, 0x0, ...
 03189  1440   NtWaitForSingleObject  (296, 0, 0x0, ...
 03145  1372   NtWaitForSingleObject  ... ) == 0x0
 03185  2012   NtSetEventBoostPriority  ... ) == 0x0
 03190  1304   NtWaitForSingleObject  (296, 0, 0x0, ...
 03191   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ...
 03184  2052   NtRegisterThreadTerminatePort  ... ) == 0x0
 03192  1372   NtSetEventBoostPriority  (296, ...
 03193  2012   NtAllocateVirtualMemory  (-1, 17551360, 0, 4096, 4096, 260, ...
 03147   252   NtWaitForSingleObject  ... ) == 0x0
 03192  1372   NtSetEventBoostPriority  ... ) == 0x0
 03194  2052   NtWaitForSingleObject  (296, 0, 0x0, ...
 03191   896   NtAllocateVirtualMemory  ... 108789760, 1048576, ) == 0x0
 03195   252   NtSetEventBoostPriority  (296, ...
 03193  2012   NtAllocateVirtualMemory  ... 17551360, 4096, ) == 0x0
 03151  1300   NtWaitForSingleObject  ... ) == 0x0
 03195   252   NtSetEventBoostPriority  ... ) == 0x0
 03196   896   NtAllocateVirtualMemory  (-1, 109830144, 0, 8192, 4096, 4, ...
 03197  1300   NtSetEventBoostPriority  (296, ...
 03198  2012   NtWaitForSingleObject  (296, 0, 0x0, ...
 03199   252   NtWaitForSingleObject  (296, 0, 0x0, ...
 03159  1948   NtWaitForSingleObject  ... ) == 0x0
 03197  1300   NtSetEventBoostPriority  ... ) == 0x0
 03196   896   NtAllocateVirtualMemory  ... 109830144, 8192, ) == 0x0
 03200  1372   NtWaitForSingleObject  (296, 0, 0x0, ...
 03201  1948   NtAllocateVirtualMemory  (-1, 1449984, 0, 4096, 4096, 4, ...
 03202  1300   NtWaitForSingleObject  (296, 0, 0x0, ...
 03203   896   NtProtectVirtualMemory  (-1, (0x68be000), 4096, 260, ...
 03201  1948   NtAllocateVirtualMemory  ... 1449984, 4096, ) == 0x0
 03203   896   NtProtectVirtualMemory  ... (0x68be000), 4096, 4, ) == 0x0
 03204   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ... 996, {1252, 2068}, ) == 0x0
 03205   896   NtQueryInformationThread  (996, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ff5b000,Pid=1252,Tid=2068,}, 0x0, ) == 0x0
 03206   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81951, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81951, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\344\3\0\0\344\4\0\0\24\10\0\0" ... {28, 56, reply, 0, 1252, 896, 81952, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\344\3\0\0\344\4\0\0\24\10\0\0" )  ... {28, 56, reply, 0, 1252, 896, 81952, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81951, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\344\3\0\0\344\4\0\0\24\10\0\0" ... {28, 56, reply, 0, 1252, 896, 81952, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\344\3\0\0\344\4\0\0\24\10\0\0" )  ) == 0x0
 03207  1948   NtSetEventBoostPriority  (296, ...
 03163  1028   NtWaitForSingleObject  ... ) == 0x0
 03208  1028   NtSetEventBoostPriority  (296, ...
 03170  1168   NtWaitForSingleObject  ... ) == 0x0
 03209  1168   NtSetEventBoostPriority  (296, ...
 03172  2056   NtWaitForSingleObject  ... ) == 0x0
 03210  2056   NtSetEventBoostPriority  (296, ...
 03178   420   NtWaitForSingleObject  ... ) == 0x0
 03211   420   NtSetEventBoostPriority  (296, ...
 03186  1756   NtWaitForSingleObject  ... ) == 0x0
 03212  1756   NtSetEventBoostPriority  (296, ...
 03187  1600   NtWaitForSingleObject  ... ) == 0x0
 03213  1600   NtSetEventBoostPriority  (296, ...
 03190  1304   NtWaitForSingleObject  ... ) == 0x0
 03214  1304   NtSetEventBoostPriority  (296, ...
 03189  1440   NtWaitForSingleObject  ... ) == 0x0
 03215  1440   NtSetEventBoostPriority  (296, ...
 03194  2052   NtWaitForSingleObject  ... ) == 0x0
 03216  2052   NtSetEventBoostPriority  (296, ...
 03198  2012   NtWaitForSingleObject  ... ) == 0x0
 03217  2012   NtSetEventBoostPriority  (296, ...
 03200  1372   NtWaitForSingleObject  ... ) == 0x0
 03218  1372   NtSetEventBoostPriority  (296, ...
 03199   252   NtWaitForSingleObject  ... ) == 0x0
 03219   252   NtAllocateVirtualMemory  (-1, 1454080, 0, 4096, 4096, 4, ... 1454080, 4096, ) == 0x0
 03220   252   NtSetEventBoostPriority  (296, ...
 03202  1300   NtWaitForSingleObject  ... ) == 0x0
 03221  1300   NtAllocateVirtualMemory  (-1, 32231424, 0, 4096, 4096, 260, ... 32231424, 4096, ) == 0x0
 03222  1300   NtCreateEvent  (0x1f0003, 0x0, 0, 0, ... 1000, ) == 0x0
 03218  1372   NtSetEventBoostPriority  ... ) == 0x0
 03217  2012   NtSetEventBoostPriority  ... ) == 0x0
 03216  2052   NtSetEventBoostPriority  ... ) == 0x0
 03214  1304   NtSetEventBoostPriority  ... ) == 0x0
 03213  1600   NtSetEventBoostPriority  ... ) == 0x0
 03212  1756   NtSetEventBoostPriority  ... ) == 0x0
 03211   420   NtSetEventBoostPriority  ... ) == 0x0
 03210  2056   NtSetEventBoostPriority  ... ) == 0x0
 03209  1168   NtSetEventBoostPriority  ... ) == 0x0
 03208  1028   NtSetEventBoostPriority  ... ) == 0x0
 03207  1948   NtSetEventBoostPriority  ... ) == 0x0
 03220   252   NtSetEventBoostPriority  ... ) == 0x0
 03215  1440   NtSetEventBoostPriority  ... ) == 0x0
 03223   896   NtResumeThread  (996, ...
 03224  1372   NtAllocateVirtualMemory  (-1, 28037120, 0, 4096, 4096, 260, ...
 03225  1300   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 03226  2012   NtCreateEvent  (0x1f0003, 0x0, 0, 0, ...
 03227  2052   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 03228  1600   NtSetEventBoostPriority  (120, ...
 03229  1756   NtWaitForSingleObject  (808, 0, 0x0, ...
 03230  1304   NtWaitForSingleObject  (808, 0, 0x0, ...
 03231   420   NtSetEventBoostPriority  (808, ...
 03232  2056   NtSetEventBoostPriority  (88, ...
 03233  1028   NtAllocateVirtualMemory  (-1, 16502784, 0, 4096, 4096, 260, ...
 03234  1948   NtAllocateVirtualMemory  (-1, 30134272, 0, 4096, 4096, 260, ...
 03235  1168   NtCreateEvent  (0x1f0003, 0x0, 0, 0, ...
 03236  1440   NtWaitForSingleObject  (120, 0, 0x0, ...
 03223   896   NtResumeThread  ... 1, ) == 0x0
 03237   252   NtAllocateVirtualMemory  (-1, 31182848, 0, 4096, 4096, 260, ...
 03225  1300   NtDuplicateObject  ... 1004, ) == 0x0
 03226  2012   NtCreateEvent  ... 1008, ) == 0x0
 03227  2052   NtDuplicateObject  ... 1012, ) == 0x0
 03224  1372   NtAllocateVirtualMemory  ... 28037120, 4096, ) == 0x0
 03238  2068   NtWaitForSingleObject  (88, 0, 0x0, ...
 01298  1180   NtWaitForSingleObject  ... ) == 0x0
 03228  1600   NtSetEventBoostPriority  ... ) == 0x0
 02843  1664   NtWaitForSingleObject  ... ) == 0x0
 03231   420   NtSetEventBoostPriority  ... ) == 0x0
 03157  2060   NtWaitForSingleObject  ... ) == 0x0
 03232  2056   NtSetEventBoostPriority  ... ) == 0x0
 03234  1948   NtAllocateVirtualMemory  ... 30134272, 4096, ) == 0x0
 03235  1168   NtCreateEvent  ... 1016, ) == 0x0
 03239   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ...
 03237   252   NtAllocateVirtualMemory  ... 31182848, 4096, ) == 0x0
 03240  1300   NtWaitForSingleObject  (808, 0, 0x0, ...
 03241  2012   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 03242  2052   NtWaitForSingleObject  (808, 0, 0x0, ...
 03243  1372   NtCreateEvent  (0x1f0003, 0x0, 0, 0, ...
 03244  1180   NtSetEventBoostPriority  (120, ...
 03245  1664   NtSetEventBoostPriority  (808, ...
 03246  1600   NtCreateEvent  (0x1f0003, 0x0, 0, 0, ...
 03247  2060   NtSetEventBoostPriority  (88, ...
 03248   420   NtWaitForSingleObject  (808, 0, 0x0, ...
 03249  2056   NtTestAlert  (...
 03250  1948   NtCreateEvent  (0x1f0003, 0x0, 0, 0, ...
 03251  1168   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 03239   896   NtAllocateVirtualMemory  ... 109838336, 1048576, ) == 0x0
 03252   252   NtCreateEvent  (0x1f0003, 0x0, 0, 0, ...
 03241  2012   NtDuplicateObject  ... 1020, ) == 0x0
 03243  1372   NtCreateEvent  ... 1024, ) == 0x0
 02839  1972   NtWaitForSingleObject  ... ) == 0x0
 03245  1664   NtSetEventBoostPriority  ... ) == 0x0
 01299   928   NtWaitForSingleObject  ... ) == 0x0
 03244  1180   NtSetEventBoostPriority  ... ) == 0x0
 03188  2064   NtWaitForSingleObject  ... ) == 0x0
 03247  2060   NtSetEventBoostPriority  ... ) == 0x0
 03246  1600   NtCreateEvent  ... 1028, ) == 0x0
 03249  2056   NtTestAlert  ... ) == 0x0
 03250  1948   NtCreateEvent  ... 1032, ) == 0x0
 03251  1168   NtDuplicateObject  ... 1036, ) == 0x0
 03253   896   NtAllocateVirtualMemory  (-1, 110878720, 0, 8192, 4096, 4, ...
 03252   252   NtCreateEvent  ... 1040, ) == 0x0
 03254  2012   NtWaitForSingleObject  (808, 0, 0x0, ...
 03255  1972   NtSetEventBoostPriority  (808, ...
 03256  1372   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 03233  1028   NtAllocateVirtualMemory  ... 16502784, 4096, ) == 0x0
 03257   928   NtSetEventBoostPriority  (120, ...
 03258  1664   NtWaitForSingleObject  (64, 0, {0, 0}, ...
 03259  2064   NtSetEventBoostPriority  (88, ...
 03260  1180   NtCreateEvent  (0x1f0003, 0x0, 0, 0, ...
 03261  1600   NtAllocateVirtualMemory  (-1, 29085696, 0, 4096, 4096, 260, ...
 03262  2056   NtContinue  (106691888, 1, ...
 03263  2060   NtTestAlert  (...
 03264  1168   NtWaitForSingleObject  (808, 0, 0x0, ...
 03253   896   NtAllocateVirtualMemory  ... 110878720, 8192, ) == 0x0
 03265   252   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 02851  1036   NtWaitForSingleObject  ... ) == 0x0
 03256  1372   NtDuplicateObject  ... 1044, ) == 0x0
 01300   428   NtWaitForSingleObject  ... ) == 0x0
 03257   928   NtSetEventBoostPriority  ... ) == 0x0
 03266  1028   NtCreateEvent  (0x1f0003, 0x0, 0, 0, ...
 03238  2068   NtWaitForSingleObject  ... ) == 0x0
 03259  2064   NtSetEventBoostPriority  ... ) == 0x0
 03258  1664   NtWaitForSingleObject  ... ) == 0x102
 03260  1180   NtCreateEvent  ... 1048, ) == 0x0
 03261  1600   NtAllocateVirtualMemory  ... 29085696, 4096, ) == 0x0
 03267  2056   NtRegisterThreadTerminatePort  (24, ...
 03263  2060   NtTestAlert  ... ) == 0x0
 03255  1972   NtSetEventBoostPriority  ... ) == 0x0
 03268  1948   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 03265   252   NtDuplicateObject  ... 1052, ) == 0x0
 03269  1036   NtSetEventBoostPriority  (808, ...
 03270   428   NtSetEventBoostPriority  (120, ...
 03271  1372   NtWaitForSingleObject  (808, 0, 0x0, ...
 03272   896   NtProtectVirtualMemory  (-1, (0x69be000), 4096, 260, ...
 03273  2068   NtTestAlert  (...
 03266  1028   NtCreateEvent  ... 1056, ) == 0x0
 03274   928   NtCreateEvent  (0x1f0003, 0x0, 0, 0, ...
 03275  1664   NtWaitForSingleObject  (120, 0, 0x0, ...
 03276  1180   NtAllocateVirtualMemory  (-1, 1458176, 0, 4096, 4096, 4, ...
 03277  1600   NtWaitForSingleObject  (296, 0, 0x0, ...
 03278  2064   NtTestAlert  (...
 03279  2060   NtContinue  (107740464, 1, ...
 03280  1972   NtWaitForSingleObject  (64, 0, {0, 0}, ...