Summary:


NtGdiCreateBitmap(>) 
 1 
NtQueryDefaultUILanguage(>) 
 2 
NtUserFindExistingCursorIcon(>) 
 9 
NtContinue(>) 
 84 

NtGdiInit(>) 
 1 
NtSetInformationObject(>) 
 2 
NtReadFile(>) 
 12 
NtMapViewOfSection(>) 
 103 

NtGdiQueryFontAssocInfo(>) 
 1 
NtSetSecurityObject(>) 
 2 
NtQuerySection(>) 
 13 
NtCreateEvent(>) 
 114 

NtGdiSelectBitmap(>) 
 1 
NtUserGetProcessWindowStation(>) 
 2 
NtWriteFile(>) 
 13 
NtQueryInformationThread(>) 
 114 

NtOpenKeyedEvent(>) 
 1 
NtGdiCreateCompatibleDC(>) 
 3 
NtQueryDirectoryFile(>) 
 14 
NtResumeThread(>) 
 116 

NtOpenSymbolicLinkObject(>) 
 1 
NtOpenProcessTokenEx(>) 
 3 
NtUserRegisterClassExWOW(>) 
 14 
NtWriteVirtualMemory(>) 
 116 

NtQueryInstallUILanguage(>) 
 1 
NtOpenThreadTokenEx(>) 
 3 
NtSetValueKey(>) 
 18 
NtCreateThread(>) 
 127 

NtQueryObject(>) 
 1 
NtQueryDefaultLocale(>) 
 3 
NtCreateKey(>) 
 21 
NtOpenKey(>) 
 128 

NtQueryPerformanceCounter(>) 
 1 
NtSecureConnectPort(>) 
 3 
NtCreateFile(>) 
 24 
NtQuerySystemInformation(>) 
 131 

NtQuerySymbolicLinkObject(>) 
 1 
NtFreeVirtualMemory(>) 
 4 
NtSetInformationThread(>) 
 27 
NtRequestWaitReplyPort(>) 
 151 

NtQuerySystemTime(>) 
 1 
NtGdiGetStockObject(>) 
 5 
NtOpenThreadToken(>) 
 28 
NtTestAlert(>) 
 156 

NtRaiseException(>) 
 1 
NtOpenProcessToken(>) 
 5 
NtOpenProcess(>) 
 29 
NtRegisterThreadTerminatePort(>) 
 160 

NtSetInformationProcess(>) 
 1 
NtCreateMutant(>) 
 6 
NtOpenFile(>) 
 30 
NtDuplicateObject(>) 
 177 

NtUserCallNoParam(>) 
 1 
NtQueryVolumeInformationFile(>) 
 6 
NtSetInformationFile(>) 
 30 
NtQueryValueKey(>) 
 250 

NtUserGetObjectInformation(>) 
 1 
NtQueryInformationProcess(>) 
 7 
NtDeviceIoControlFile(>) 
 35 
NtProtectVirtualMemory(>) 
 340 

NtUserGetThreadDesktop(>) 
 1 
NtConnectPort(>) 
 8 
NtFsControlFile(>) 
 35 
NtAllocateVirtualMemory(>) 
 346 

NtCallbackReturn(>) 
 2 
NtDelayExecution(>) 
 8 
NtQueryAttributesFile(>) 
 43 
NtClose(>) 
 408 

NtCreateIoCompletion(>) 
 2 
NtQueryInformationFile(>) 
 8 
NtUnmapViewOfSection(>) 
 46 
NtSetEventBoostPriority(>) 
 504 

NtGdiCreateSolidBrush(>) 
 2 
NtQueryInformationToken(>) 
 8 
NtOpenSection(>) 
 50 
NtWaitForSingleObject(>) 
 726 

NtNotifyChangeKey(>) 
 2 
NtQueryVirtualMemory(>) 
 8 
NtFlushInstructionCache(>) 
 53 

NtOpenDirectoryObject(>) 
 2 
NtAdjustPrivilegesToken(>) 
 9 

Trace:
 00001   896   NtOpenFile  (0x80100000, {24, 0, 0x240, 0, 0,  (0x80100000, {24, 0, 0x240, 0, 0, "\SystemRoot\Prefetch\PACKED.EXE-09ED06A1.pf"}, 0, 32, ... -2147482756, {status=0x0, info=1}, ) }, 0, 32, ... -2147482756, {status=0x0, info=1}, ) == 0x0
 00002   896   NtQueryInformationFile  (-2147482756, -142414796, 24, Standard, ... {status=0x0, info=24}, ) == 0x0
 00003   896   NtReadFile  (-2147482756, 0, 0, 0, 13474, 0x0, 0, ... {status=0x0, info=13474},  (-2147482756, 0, 0, 0, 13474, 0x0, 0, ... {status=0x0, info=13474}, "\21\0\0\0SCCA\17\0\0\0\2424\0\0P\0A\0C\0K\0E\0D\0.\0E\0X\0E\0\0\0\0\00\366i\201\0\0\0\0\0\0\0\0\20\0\0\0@-\201\367\0@\300\367\30,\201\367x@s\201@-\201\367\241\6\355\11\0\0\0\0\230\0\0\0\34\0\0\0\310\2\0\0\331\2\0\0\364$\0\0\36\14\0\0\301\0\0\1\0\0\0\212\3\0\0\200\14V6\217\260\310\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\1\0\0\0\1\0\0\0\0\0\0\01\0\0\0\0\0\0\02\0\0\0\2\0\0\01\0\0\0%\1\0\0f\0\0\05\0\0\0\6\0\0\0V\1\0\0\5\0\0\0\322\0\0\04\0\0\0\4\0\0\0[\1\0\0\3\0\0\0<\1\0\03\0\0\0\4\0\0\0^\1\0\0\4\0\0\0\244\1\0\05\0\0\0\4\0\0\0b\1\0\0\32\0\0\0\20\2\0\03\0\0\0\2\0\0\0|\1\0\0\23\0\0\0x\2\0\02\0\0\0\2\0\0\0\217\1\0\0\7\0\0\0\336\2\0\02\0\0\0\6\0\0\0\226\1\0\0\22\0\0\0D\3\0\05\0\0\0\2\0\0\0\250\1\0\0\14\0\0\0\260\3\0\03\0\0\0\2\0\0\0\264\1\0\0\13\0\0\0\30\4\0\05\0\0\0\2\0\0\0\277\1\0\0*\0\0\0\204\4\0\03\0\0\0\2\0\0\0\351\1\0\0\21\0\0\0\354\4\0\02\0\0\0\2\0\0\0\372\1\0\0\2\0\0\0R\5\0\02\0\0\0\4\0\0\0\374\1\0\0\1\0\0\0\270\5\0\04\0\0\0\4\0\0\0\375\1\0\0\22\0\0\0"\6\0\04\0\0\0\6\0\0\0\17\2\0\0\36\0\0\0\214\6\0\04\0\0\0\2\0\0\0-\2\0\0\13\0\0\0", ) \6\0\04\0\0\0\6\0\0\0\17\2\0\0\36\0\0\0\214\6\0\04\0\0\0\2\0\0\0-\2\0\0\13\0\0\0", ) == 0x0
 00004   896   NtClose  (-2147482756, ... ) == 0x0
 00005   896   NtCreateFile  (0x100080, {24, 0, 0x240, 0, 0,  (0x100080, {24, 0, 0x240, 0, 0, "\DEVICE\HARDDISKVOLUME1"}, 0x0, 0, 7, 1, 32, 0, 0, ... -2147482756, {status=0x0, info=0}, ) }, 0x0, 0, 7, 1, 32, 0, 0, ... -2147482756, {status=0x0, info=0}, ) == 0x0
 00006   896   NtQueryVolumeInformationFile  (-2147482756, -142414840, 8, Device, ... {status=0x0, info=8}, ) == 0x0
 00007   896   NtClose  (-2147482756, ... ) == 0x0
 00008   896   NtCreateFile  (0x100180, {24, 0, 0x240, 0, 0,  (0x100180, {24, 0, 0x240, 0, 0, "\DEVICE\HARDDISKVOLUME1"}, 0x0, 0, 7, 1, 32, 0, 0, ... }, 0x0, 0, 7, 1, 32, 0, 0, ...
 00009   896   NtContinue  (-142419640, 0, ...
 00008   896   NtCreateFile  ... -2147482756, {status=0x0, info=1}, ) == 0x0
 00010   896   NtQueryVolumeInformationFile  (-2147482756, -142414852, 24, Volume, ... {status=0x0, info=18}, ) == 0x0
 00011   896   NtFsControlFile  (-2147482756, 0, 0x0, 0x0, 0x90120,  (-2147482756, 0, 0x0, 0x0, 0x90120, "\1\0\0\0!\0\0\0H\10\0\0\0\0\1\0\2309\0\0\0\0\2\0\15\1\0\0\0\0\1\0\357\0\0\0\0\3\0X\244\0\0\0\0\4\0\217\10\0\0\0\0\1\0\214;\0\0\0\0\2\0XK\0\0\0\0\3\0f\10\0\0\0\0\1\0Z\10\0\0\0\0\1\0\304\10\0\0\0\0\1\0Y\10\0\0\0\0\1\0C\10\0\0\0\0\1\0/:\0\0\0\0\3\0\235\244\0\0\0\0\3\0\26\11\0\0\0\0\1\0\201\246\0\0\0\0\3\0\224\246\0\0\0\0\3\0@C\0\0\0\0\2\0r\10\0\0\0\0\1\0g\10\0\0\0\0\1\0\2\1\0\0\0\0\1\0o%\0\0\0\0\3\0\243\10\0\0\0\0\1\0q\10\0\0\0\0\1\0p\10\0\0\0\0\1\0@\31\0\0\0\0\1\0\2339\0\0\0\0\1\0\5\0\0\0\0\0\5\0\34\0\0\0\0\0\1\0'\0\0\0\0\0\1\0\210\0\0\0\0\0\1\0\2329\0\0\0\0\1\0", 272, 0, ... {status=0x0, info=0}, 0x0, ) , 272, 0, ... {status=0x0, info=0}, 0x0, ) == 0x0
 00012   896   NtCreateFile  (0x100001, {24, 0, 0x240, 0, 0,  (0x100001, {24, 0, 0x240, 0, 0, "\DEVICE\HARDDISKVOLUME1\"}, 0x0, 0, 7, 1, 16417, 0, 0, ... -2147482764, {status=0x0, info=1}, ) }, 0x0, 0, 7, 1, 16417, 0, 0, ... -2147482764, {status=0x0, info=1}, ) == 0x0
 00013   896   NtQueryDirectoryFile  (-2147482764, 0, 0, 0, -504332288, 16384, Names, 0, 0x0, -518446847, ... {status=0x0, info=1146}, ) == 0x0
 00014   896   NtQueryDirectoryFile  (-2147482764, 0, 0, 0, -504332288, 16384, Names, 0, 0x0, -518446848, ... ) == STATUS_NO_MORE_FILES
 00015   896   NtClose  (-2147482764, ... ) == 0x0
 00016   896   NtCreateFile  (0x100001, {24, 0, 0x240, 0, 0,  (0x100001, {24, 0, 0x240, 0, 0, "\DEVICE\HARDDISKVOLUME1\WINDOWS\"}, 0x0, 0, 7, 1, 16417, 0, 0, ... -2147482764, {status=0x0, info=1}, ) }, 0x0, 0, 7, 1, 16417, 0, 0, ... -2147482764, {status=0x0, info=1}, ) == 0x0
 00017   896   NtQueryDirectoryFile  (-2147482764, 0, 0, 0, -504332288, 16384, Names, 0, 0x0, -518446847, ... {status=0x0, info=15820}, ) == 0x0
 00018   896   NtQueryDirectoryFile  (-2147482764, 0, 0, 0, -504332288, 16384, Names, 0, 0x0, -518446848, ... ) == STATUS_NO_MORE_FILES
 00019   896   NtClose  (-2147482764, ... ) == 0x0
 00020   896   NtCreateFile  (0x100001, {24, 0, 0x240, 0, 0,  (0x100001, {24, 0, 0x240, 0, 0, "\DEVICE\HARDDISKVOLUME1\WINDOWS\SYSTEM32\"}, 0x0, 0, 7, 1, 16417, 0, 0, ... -2147482764, {status=0x0, info=1}, ) }, 0x0, 0, 7, 1, 16417, 0, 0, ... -2147482764, {status=0x0, info=1}, ) == 0x0
 00021   896   NtQueryDirectoryFile  (-2147482764, 0, 0, 0, -504332288, 16384, Names, 0, 0x0, -518446847, ... {status=0x0, info=16366}, ) == 0x0
 00022   896   NtQueryDirectoryFile  (-2147482764, 0, 0, 0, -504332288, 16384, Names, 0, 0x0, -518446848, ... {status=0x0, info=16354}, ) == 0x0
 00023   896   NtQueryDirectoryFile  (-2147482764, 0, 0, 0, -504332288, 16384, Names, 0, 0x0, -518446848, ... {status=0x0, info=16348}, ) == 0x0
 00024   896   NtQueryDirectoryFile  (-2147482764, 0, 0, 0, -504332288, 16384, Names, 0, 0x0, -518446848, ... {status=0x0, info=16364}, ) == 0x0
 00025   896   NtQueryDirectoryFile  (-2147482764, 0, 0, 0, -504332288, 16384, Names, 0, 0x0, -518446848, ... {status=0x0, info=11386}, ) == 0x0
 00026   896   NtQueryDirectoryFile  (-2147482764, 0, 0, 0, -504332288, 16384, Names, 0, 0x0, -518446848, ... ) == STATUS_NO_MORE_FILES
 00027   896   NtClose  (-2147482764, ... ) == 0x0
 00028   896   NtCreateFile  (0x100001, {24, 0, 0x240, 0, 0,  (0x100001, {24, 0, 0x240, 0, 0, "\DEVICE\HARDDISKVOLUME1\WINDOWS\WINSXS\"}, 0x0, 0, 7, 1, 16417, 0, 0, ... -2147482764, {status=0x0, info=1}, ) }, 0x0, 0, 7, 1, 16417, 0, 0, ... -2147482764, {status=0x0, info=1}, ) == 0x0
 00029   896   NtQueryDirectoryFile  (-2147482764, 0, 0, 0, -504332288, 16384, Names, 0, 0x0, -518446847, ... {status=0x0, info=2228}, ) == 0x0
 00030   896   NtQueryDirectoryFile  (-2147482764, 0, 0, 0, -504332288, 16384, Names, 0, 0x0, -518446848, ... ) == STATUS_NO_MORE_FILES
 00031   896   NtClose  (-2147482764, ... ) == 0x0
 00032   896   NtCreateFile  (0x100001, {24, 0, 0x240, 0, 0,  (0x100001, {24, 0, 0x240, 0, 0, "\DEVICE\HARDDISKVOLUME1\WINDOWS\WINSXS\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_6.0.2600.2982_X-WW_AC3F9C03\"}, 0x0, 0, 7, 1, 16417, 0, 0, ... -2147482764, {status=0x0, info=1}, ) }, 0x0, 0, 7, 1, 16417, 0, 0, ... -2147482764, {status=0x0, info=1}, ) == 0x0
 00033   896   NtQueryDirectoryFile  (-2147482764, 0, 0, 0, -504332288, 16384, Names, 0, 0x0, -518446847, ... {status=0x0, info=68}, ) == 0x0
 00034   896   NtQueryDirectoryFile  (-2147482764, 0, 0, 0, -504332288, 16384, Names, 0, 0x0, -518446848, ... ) == STATUS_NO_MORE_FILES
 00035   896   NtClose  (-2147482764, ... ) == 0x0
 00036   896   NtCreateSection  (0xd, {24, 0, 0x240, 0, 0, 0x0}, 0x0, 4, 67108864, -2147482764, ... -2147482688, ) == 0x0
 00037   896   NtClose  (-2147482688, ... ) == 0x0
 00038   896   NtCreateSection  (0xd, {24, 0, 0x240, 0, 0, 0x0}, 0x0, 4, 67108864, -2147482688, ... -2147482660, ) == 0x0
 00039   896   NtClose  (-2147482660, ... ) == 0x0
 00040   896   NtCreateSection  (0xd, {24, 0, 0x240, 0, 0, 0x0}, 0x0, 4, 67108864, -2147482660, ... -2147482656, ) == 0x0
 00041   896   NtClose  (-2147482656, ... ) == 0x0
 00042   896   NtCreateSection  (0xd, {24, 0, 0x240, 0, 0, 0x0}, 0x0, 4, 67108864, -2147482656, ... -2147482652, ) == 0x0
 00043   896   NtClose  (-2147482652, ... ) == 0x0
 00044   896   NtCreateSection  (0xd, {24, 0, 0x240, 0, 0, 0x0}, 0x0, 4, 67108864, -2147482652, ... -2147482724, ) == 0x0
 00045   896   NtClose  (-2147482724, ... ) == 0x0
 00046   896   NtCreateSection  (0xd, {24, 0, 0x240, 0, 0, 0x0}, 0x0, 4, 67108864, -2147482724, ... -2147481452, ) == 0x0
 00047   896   NtClose  (-2147481452, ... ) == 0x0
 00048   896   NtCreateSection  (0xd, {24, 0, 0x240, 0, 0, 0x0}, 0x0, 4, 67108864, -2147481452, ... -2147482684, ) == 0x0
 00049   896   NtClose  (-2147482684, ... ) == 0x0
 00050   896   NtCreateSection  (0xd, {24, 0, 0x240, 0, 0, 0x0}, 0x0, 4, 67108864, -2147482684, ... -2147482680, ) == 0x0
 00051   896   NtClose  (-2147482680, ... ) == 0x0
 00052   896   NtCreateSection  (0xd, {24, 0, 0x240, 0, 0, 0x0}, 0x0, 4, 67108864, -2147482680, ... -2147482760, ) == 0x0
 00053   896   NtClose  (-2147482760, ... ) == 0x0
 00054   896   NtCreateSection  (0xd, {24, 0, 0x240, 0, 0, 0x0}, 0x0, 4, 67108864, -2147482760, ... -2147481628, ) == 0x0
 00055   896   NtClose  (-2147481628, ... ) == 0x0
 00056   896   NtCreateSection  (0xd, {24, 0, 0x240, 0, 0, 0x0}, 0x0, 4, 67108864, -2147481628, ... -2147481484, ) == 0x0
 00057   896   NtClose  (-2147481484, ... ) == 0x0
 00058   896   NtCreateSection  (0xd, {24, 0, 0x240, 0, 0, 0x0}, 0x0, 4, 67108864, -2147481484, ... -2147482104, ) == 0x0
 00059   896   NtClose  (-2147482104, ... ) == 0x0
 00060   896   NtCreateSection  (0xd, {24, 0, 0x240, 0, 0, 0x0}, 0x0, 4, 67108864, -2147482104, ... -2147482592, ) == 0x0
 00061   896   NtClose  (-2147482592, ... ) == 0x0
 00062   896   NtCreateSection  (0xd, {24, 0, 0x240, 0, 0, 0x0}, 0x0, 4, 67108864, -2147482592, ... -2147481624, ) == 0x0
 00063   896   NtClose  (-2147481624, ... ) == 0x0
 00064   896   NtCreateSection  (0xd, {24, 0, 0x240, 0, 0, 0x0}, 0x0, 4, 67108864, -2147481624, ... -2147482676, ) == 0x0
 00065   896   NtClose  (-2147482676, ... ) == 0x0
 00066   896   NtCreateSection  (0xd, {24, 0, 0x240, 0, 0, 0x0}, 0x0, 4, 67108864, -2147482676, ... -2147482672, ) == 0x0
 00067   896   NtClose  (-2147482672, ... ) == 0x0
 00068   896   NtCreateSection  (0xd, {24, 0, 0x240, 0, 0, 0x0}, 0x0, 4, 67108864, -2147482672, ... -2147482668, ) == 0x0
 00069   896   NtClose  (-2147482668, ... ) == 0x0
 00070   896   NtCreateSection  (0xd, {24, 0, 0x240, 0, 0, 0x0}, 0x0, 4, 67108864, -2147482668, ... -2147482664, ) == 0x0
 00071   896   NtClose  (-2147482664, ... ) == 0x0
 00072   896   NtCreateSection  (0xd, {24, 0, 0x240, 0, 0, 0x0}, 0x0, 4, 67108864, -2147482664, ... -2147481588, ) == 0x0
 00073   896   NtClose  (-2147481588, ... ) == 0x0
 00074   896   NtCreateSection  (0xd, {24, 0, 0x240, 0, 0, 0x0}, 0x0, 4, 67108864, -2147481588, ... -2147481584, ) == 0x0
 00075   896   NtClose  (-2147481584, ... ) == 0x0
 00076   896   NtCreateSection  (0xd, {24, 0, 0x240, 0, 0, 0x0}, 0x0, 4, 67108864, -2147481584, ... -2147482692, ) == 0x0
 00077   896   NtClose  (-2147482692, ... ) == 0x0
 00078   896   NtCreateSection  (0xd, {24, 0, 0x240, 0, 0, 0x0}, 0x0, 4, 67108864, -2147482692, ... -2147481512, ) == 0x0
 00079   896   NtClose  (-2147481512, ... ) == 0x0
 00080   896   NtCreateSection  (0xd, {24, 0, 0x240, 0, 0, 0x0}, 0x0, 4, 67108864, -2147481512, ... -2147481580, ) == 0x0
 00081   896   NtClose  (-2147481580, ... ) == 0x0
 00082   896   NtCreateSection  (0xd, {24, 0, 0x240, 0, 0, 0x0}, 0x0, 4, 67108864, -2147481580, ... -2147481552, ) == 0x0
 00083   896   NtClose  (-2147481552, ... ) == 0x0
 00084   896   NtCreateSection  (0xd, {24, 0, 0x240, 0, 0, 0x0}, 0x0, 4, 67108864, -2147481552, ... -2147481592, ) == 0x0
 00085   896   NtClose  (-2147481592, ... ) == 0x0
 00086   896   NtCreateSection  (0xd, {24, 0, 0x240, 0, 0, 0x0}, 0x0, 4, 67108864, -2147481592, ... -2147481596, ) == 0x0
 00087   896   NtClose  (-2147481596, ... ) == 0x0
 00088   896   NtCreateSection  (0xd, {24, 0, 0x240, 0, 0, 0x0}, 0x0, 4, 67108864, -2147481596, ... -2147482108, ) == 0x0
 00089   896   NtClose  (-2147482108, ... ) == 0x0
 00090   896   NtCreateSection  (0xd, {24, 0, 0x240, 0, 0, 0x0}, 0x0, 4, 67108864, -2147482108, ... -2147482732, ) == 0x0
 00091   896   NtClose  (-2147482732, ... ) == 0x0
 00092   896   NtClose  (-2147482764, ... ) == 0x0
 00093   896   NtClose  (-2147482688, ... ) == 0x0
 00094   896   NtClose  (-2147482660, ... ) == 0x0
 00095   896   NtClose  (-2147482656, ... ) == 0x0
 00096   896   NtClose  (-2147482652, ... ) == 0x0
 00097   896   NtClose  (-2147482724, ... ) == 0x0
 00098   896   NtClose  (-2147481452, ... ) == 0x0
 00099   896   NtClose  (-2147482684, ... ) == 0x0
 00100   896   NtClose  (-2147482680, ... ) == 0x0
 00101   896   NtClose  (-2147482760, ... ) == 0x0
 00102   896   NtClose  (-2147481628, ... ) == 0x0
 00103   896   NtClose  (-2147481484, ... ) == 0x0
 00104   896   NtClose  (-2147482104, ... ) == 0x0
 00105   896   NtClose  (-2147482592, ... ) == 0x0
 00106   896   NtClose  (-2147481624, ... ) == 0x0
 00107   896   NtClose  (-2147482676, ... ) == 0x0
 00108   896   NtClose  (-2147482672, ... ) == 0x0
 00109   896   NtClose  (-2147482668, ... ) == 0x0
 00110   896   NtClose  (-2147482664, ... ) == 0x0
 00111   896   NtClose  (-2147481588, ... ) == 0x0
 00112   896   NtClose  (-2147481584, ... ) == 0x0
 00113   896   NtClose  (-2147482692, ... ) == 0x0
 00114   896   NtClose  (-2147481512, ... ) == 0x0
 00115   896   NtClose  (-2147481580, ... ) == 0x0
 00116   896   NtClose  (-2147481552, ... ) == 0x0
 00117   896   NtClose  (-2147481592, ... ) == 0x0
 00118   896   NtClose  (-2147481596, ... ) == 0x0
 00119   896   NtClose  (-2147482108, ... ) == 0x0
 00120   896   NtCreateSection  (0xd, {24, 0, 0x240, 0, 0, 0x0}, 0x0, 16, 16777216, -2147482108, ... -2147481596, ) == 0x0
 00121   896   NtClose  (-2147481596, ... ) == 0x0
 00122   896   NtCreateSection  (0xd, {24, 0, 0x240, 0, 0, 0x0}, 0x0, 16, 16777216, -2147481596, ... -2147481592, ) == 0x0
 00123   896   NtClose  (-2147481592, ... ) == 0x0
 00124   896   NtCreateSection  (0xd, {24, 0, 0x240, 0, 0, 0x0}, 0x0, 16, 16777216, -2147481592, ... -2147481552, ) == 0x0
 00125   896   NtClose  (-2147481552, ... ) == 0x0
 00126   896   NtCreateSection  (0xd, {24, 0, 0x240, 0, 0, 0x0}, 0x0, 16, 16777216, -2147481552, ... -2147481580, ) == 0x0
 00127   896   NtClose  (-2147481580, ... ) == 0x0
 00128   896   NtCreateSection  (0xd, {24, 0, 0x240, 0, 0, 0x0}, 0x0, 16, 16777216, -2147481580, ... -2147481512, ) == 0x0
 00129   896   NtClose  (-2147481512, ... ) == 0x0
 00130   896   NtCreateSection  (0xd, {24, 0, 0x240, 0, 0, 0x0}, 0x0, 16, 16777216, -2147481512, ... -2147482692, ) == 0x0
 00131   896   NtClose  (-2147482692, ... ) == 0x0
 00132   896   NtCreateSection  (0xd, {24, 0, 0x240, 0, 0, 0x0}, 0x0, 16, 16777216, -2147482692, ... -2147481584, ) == 0x0
 00133   896   NtClose  (-2147481584, ... ) == 0x0
 00134   896   NtCreateSection  (0xd, {24, 0, 0x240, 0, 0, 0x0}, 0x0, 16, 16777216, -2147481584, ... -2147481588, ) == 0x0
 00135   896   NtClose  (-2147481588, ... ) == 0x0
 00136   896   NtCreateSection  (0xd, {24, 0, 0x240, 0, 0, 0x0}, 0x0, 16, 16777216, -2147481588, ... -2147482664, ) == 0x0
 00137   896   NtClose  (-2147482664, ... ) == 0x0
 00138   896   NtCreateSection  (0xd, {24, 0, 0x240, 0, 0, 0x0}, 0x0, 16, 16777216, -2147482664, ... -2147482668, ) == 0x0
 00139   896   NtClose  (-2147482668, ... ) == 0x0
 00140   896   NtCreateSection  (0xd, {24, 0, 0x240, 0, 0, 0x0}, 0x0, 16, 16777216, -2147482668, ... -2147482672, ) == 0x0
 00141   896   NtClose  (-2147482672, ... ) == 0x0
 00142   896   NtCreateSection  (0xd, {24, 0, 0x240, 0, 0, 0x0}, 0x0, 16, 16777216, -2147482672, ... -2147482676, ) == 0x0
 00143   896   NtClose  (-2147482676, ... ) == 0x0
 00144   896   NtCreateSection  (0xd, {24, 0, 0x240, 0, 0, 0x0}, 0x0, 16, 16777216, -2147482676, ... -2147481624, ) == 0x0
 00145   896   NtClose  (-2147481624, ... ) == 0x0
 00146   896   NtCreateSection  (0xd, {24, 0, 0x240, 0, 0, 0x0}, 0x0, 16, 16777216, -2147481624, ... -2147482592, ) == 0x0
 00147   896   NtClose  (-2147482592, ... ) == 0x0
 00148   896   NtCreateSection  (0xd, {24, 0, 0x240, 0, 0, 0x0}, 0x0, 16, 16777216, -2147482592, ... -2147482104, ) == 0x0
 00149   896   NtClose  (-2147482104, ... ) == 0x0
 00150   896   NtCreateSection  (0xd, {24, 0, 0x240, 0, 0, 0x0}, 0x0, 16, 16777216, -2147482104, ... -2147481484, ) == 0x0
 00151   896   NtClose  (-2147481484, ... ) == 0x0
 00152   896   NtCreateSection  (0xd, {24, 0, 0x240, 0, 0, 0x0}, 0x0, 16, 16777216, -2147481484, ... -2147481628, ) == 0x0
 00153   896   NtClose  (-2147481628, ... ) == 0x0
 00154   896   NtCreateSection  (0xd, {24, 0, 0x240, 0, 0, 0x0}, 0x0, 16, 16777216, -2147481628, ... -2147482760, ) == 0x0
 00155   896   NtClose  (-2147482760, ... ) == 0x0
 00156   896   NtCreateSection  (0xd, {24, 0, 0x240, 0, 0, 0x0}, 0x0, 16, 16777216, -2147482760, ... -2147482680, ) == 0x0
 00157   896   NtClose  (-2147482680, ... ) == 0x0
 00158   896   NtCreateSection  (0xd, {24, 0, 0x240, 0, 0, 0x0}, 0x0, 16, 16777216, -2147482680, ... -2147482684, ) == 0x0
 00159   896   NtClose  (-2147482684, ... ) == 0x0
 00160   896   NtCreateSection  (0xd, {24, 0, 0x240, 0, 0, 0x0}, 0x0, 16, 16777216, -2147482684, ... -2147481452, ) == 0x0
 00161   896   NtClose  (-2147481452, ... ) == 0x0
 00162   896   NtCreateSection  (0xd, {24, 0, 0x240, 0, 0, 0x0}, 0x0, 16, 16777216, -2147481452, ... -2147482724, ) == 0x0
 00163   896   NtClose  (-2147482724, ... ) == 0x0
 00164   896   NtClose  (-2147482108, ... ) == 0x0
 00165   896   NtClose  (-2147481596, ... ) == 0x0
 00166   896   NtClose  (-2147481592, ... ) == 0x0
 00167   896   NtClose  (-2147481552, ... ) == 0x0
 00168   896   NtClose  (-2147481580, ... ) == 0x0
 00169   896   NtClose  (-2147481512, ... ) == 0x0
 00170   896   NtClose  (-2147482692, ... ) == 0x0
 00171   896   NtClose  (-2147481584, ... ) == 0x0
 00172   896   NtClose  (-2147481588, ... ) == 0x0
 00173   896   NtClose  (-2147482664, ... ) == 0x0
 00174   896   NtClose  (-2147482668, ... ) == 0x0
 00175   896   NtClose  (-2147482672, ... ) == 0x0
 00176   896   NtClose  (-2147482676, ... ) == 0x0
 00177   896   NtClose  (-2147481624, ... ) == 0x0
 00178   896   NtClose  (-2147482592, ... ) == 0x0
 00179   896   NtClose  (-2147482104, ... ) == 0x0
 00180   896   NtClose  (-2147481484, ... ) == 0x0
 00181   896   NtClose  (-2147481628, ... ) == 0x0
 00182   896   NtClose  (-2147482760, ... ) == 0x0
 00183   896   NtClose  (-2147482680, ... ) == 0x0
 00184   896   NtClose  (-2147482684, ... ) == 0x0
 00185   896   NtClose  (-2147481452, ... ) == 0x0
 00186   896   NtClose  (-2147482756, ... ) == 0x0
 00187   896   NtOpenKey  (0x80000000, {24, 0, 0x40, 0, 0,  (0x80000000, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\packed.exe"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00188   896   NtOpenKeyedEvent  (0x2000000, {24, 0, 0x0, 0, 0,  (0x2000000, {24, 0, 0x0, 0, 0, "\KernelObjects\CritSecOutOfMemoryEvent"}, ... 4, ) }, ... 4, ) == 0x0
 00189   896   NtQuerySystemInformation  (Basic, 44, ... {Unknown=0,MaximumIncrement=156250,PhysicalPageSize=0x1000,NumberOfPhysicalPages=0xff7c,LowestPhysicalPage=0x1,HighestPhysicalPage=0xffff,AllocationGranularity=0x10000,LowestUserAddress=0x10000,HighestUserAddress=0x7ffeffff,ActiveProcessors=1,NumberProcessors=1,}, 0x0, ) == 0x0
 00190   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ... 1310720, 1048576, ) == 0x0
 00191   896   NtAllocateVirtualMemory  (-1, 1310720, 0, 4096, 4096, 4, ... 1310720, 4096, ) == 0x0
 00192   896   NtAllocateVirtualMemory  (-1, 1314816, 0, 8192, 4096, 4, ... 1314816, 8192, ) == 0x0
 00193   896   NtQuerySystemInformation  (Basic, 44, ... {Unknown=0,MaximumIncrement=156250,PhysicalPageSize=0x1000,NumberOfPhysicalPages=0xff7c,LowestPhysicalPage=0x1,HighestPhysicalPage=0xffff,AllocationGranularity=0x10000,LowestUserAddress=0x10000,HighestUserAddress=0x7ffeffff,ActiveProcessors=1,NumberProcessors=1,}, 0x0, ) == 0x0
 00194   896   NtAllocateVirtualMemory  (-1, 0, 0, 65536, 8192, 4, ... 2359296, 65536, ) == 0x0
 00195   896   NtAllocateVirtualMemory  (-1, 2359296, 0, 24576, 4096, 4, ... 2359296, 24576, ) == 0x0
 00196   896   NtOpenDirectoryObject  (0x3, {24, 0, 0x40, 0, 0,  (0x3, {24, 0, 0x40, 0, 0, "\KnownDlls"}, ... 8, ) }, ... 8, ) == 0x0
 00197   896   NtOpenSymbolicLinkObject  (0x1, {24, 8, 0x40, 0, 0,  (0x1, {24, 8, 0x40, 0, 0, "KnownDllPath"}, ... 12, ) }, ... 12, ) == 0x0
 00198   896   NtQuerySymbolicLinkObject  (12, ...  (12, ... "C:\WINDOWS\system32", 0x0, ) , 0x0, ) == 0x0
 00199   896   NtClose  (12, ... ) == 0x0
 00200   896   NtOpenFile  (0x100020, {24, 0, 0x42, 0, 0,  (0x100020, {24, 0, 0x42, 0, 0, "\??\C:\scripts\"}, 3, 33, ... 12, {status=0x0, info=1}, ) }, 3, 33, ... 12, {status=0x0, info=1}, ) == 0x0
 00201   896   NtQueryVolumeInformationFile  (12, 1243852, 8, Device, ... {status=0x0, info=8}, ) == 0x0
 00202   896   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\u:\work\packed.exe.Local"}, 1243804, ... ) }, 1243804, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00203   896   NtOpenSection  (0xe, {24, 8, 0x40, 0, 0,  (0xe, {24, 8, 0x40, 0, 0, "kernel32.dll"}, ... 16, ) }, ... 16, ) == 0x0
 00204   896   NtMapViewOfSection  (16, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x7c800000), 0x0, 1003520, ) == 0x0
 00205   896   NtClose  (16, ... ) == 0x0
 00206   896   NtProtectVirtualMemory  (-1, (0x7c801000), 1568, 4, ... (0x7c801000), 4096, 32, ) == 0x0
 00207   896   NtProtectVirtualMemory  (-1, (0x7c801000), 4096, 32, ... (0x7c801000), 4096, 4, ) == 0x0
 00208   896   NtFlushInstructionCache  (-1, 2088767488, 1568, ... ) == 0x0
 00209   896   NtQueryInformationProcess  (-1, 36, 4, ... {process info, class 36, size 4}, 0x0, ) == 0x0
 00210   896   NtQuerySystemInformation  (RangeStart, 4, ... {system info, class 50, size 4}, 0x0, ) == 0x0
 00211   896   NtQuerySystemInformation  (Basic, 44, ... {Unknown=0,MaximumIncrement=156250,PhysicalPageSize=0x1000,NumberOfPhysicalPages=0xff7c,LowestPhysicalPage=0x1,HighestPhysicalPage=0xffff,AllocationGranularity=0x10000,LowestUserAddress=0x10000,HighestUserAddress=0x7ffeffff,ActiveProcessors=1,NumberProcessors=1,}, 0x0, ) == 0x0
 00212   896   NtCreateSection  (0xf001f, 0x0, {65536, 0}, 4, 67108864, 0, ... 16, ) == 0x0
 00213   896   NtSecureConnectPort  ( ("\Windows\ApiPort", {0, 2, 1, 1}, {24, 16, 0, 65536, 0, 0}, 1319736, {12, 0, 0}, 1241944, 44, ... 24, {24, 16, 0, 65536, 2424832, 18939904}, {0, 0, 0}, 200, 44, ) , {0, 2, 1, 1}, {24, 16, 0, 65536, 0, 0}, 1319736, {12, 0, 0}, 1241944, 44, ... 24, {24, 16, 0, 65536, 2424832, 18939904}, {0, 0, 0}, 200, 44, ) == 0x0
 00214   896   NtClose  (16, ... ) == 0x0
 00215   896   NtQueryObject  (24, Handle, 2, ... {Inherit=0,ProtectFromClose=0,}, -1, ) == 0x0
 00216   896   NtSetInformationObject  (24, Handle, {Inherit=0,ProtectFromClose=1,}, 256, ... ) == 0x0
 00217   896   NtQuerySystemInformation  (Basic, 44, ... {Unknown=0,MaximumIncrement=156250,PhysicalPageSize=0x1000,NumberOfPhysicalPages=0xff7c,LowestPhysicalPage=0x1,HighestPhysicalPage=0xffff,AllocationGranularity=0x10000,LowestUserAddress=0x10000,HighestUserAddress=0x7ffeffff,ActiveProcessors=1,NumberProcessors=1,}, 0x0, ) == 0x0
 00218   896   NtQueryVirtualMemory  (-1, 0x250000, Basic, 28, ... {BaseAddress=0x250000,AllocationBase=0x250000,AllocationProtect=0x4,RegionSize=0x10000,State=0x2000,Protect=0x0,Type=0x40000,}, 0x0, ) == 0x0
 00219   896   NtAllocateVirtualMemory  (-1, 2424832, 0, 4096, 4096, 4, ... 2424832, 4096, ) == 0x0
 00220   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1242260, 1242460, 2089900544, 1242184}  (24, {28, 56, new_msg, 0, 1242260, 1242460, 2089900544, 1242184} "\210\6!\1\0\0\0\0eZ\221|\0\0\0\0\1\0\0\0\234\6!\1\4\0\0\0" ... {28, 56, reply, 0, 1252, 896, 81831, 0} "\370\374\27\0\0\0\0\0\0\0\0\0\0\0\0\0\1\0\0\0\234\6!\1\4\0\0\0" )  ... {28, 56, reply, 0, 1252, 896, 81831, 0}  (24, {28, 56, new_msg, 0, 1242260, 1242460, 2089900544, 1242184} "\210\6!\1\0\0\0\0eZ\221|\0\0\0\0\1\0\0\0\234\6!\1\4\0\0\0" ... {28, 56, reply, 0, 1252, 896, 81831, 0} "\370\374\27\0\0\0\0\0\0\0\0\0\0\0\0\0\1\0\0\0\234\6!\1\4\0\0\0" )  ) == 0x0
 00221   896   NtRegisterThreadTerminatePort  (24, ... ) == 0x0
 00222   896   NtAllocateVirtualMemory  (-1, 1232896, 0, 4096, 4096, 260, ... 1232896, 4096, ) == 0x0
 00223   896   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\System\CurrentControlSet\Control\Terminal Server"}, ... 16, ) }, ... 16, ) == 0x0
 00224   896   NtQueryValueKey  (16,  (16, "TSAppCompat", Partial, 548, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) , Partial, 548, ... TitleIdx=0, Type=4, Data= (16, "TSAppCompat", Partial, 548, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) }, 16, ) == 0x0
 00225   896   NtClose  (16, ... ) == 0x0
 00226   896   NtOpenSection  (0x4, {24, 0, 0x40, 0, 0,  (0x4, {24, 0, 0x40, 0, 0, "\NLS\NlsSectionUnicode"}, ... 16, ) }, ... 16, ) == 0x0
 00227   896   NtMapViewOfSection  (16, -1, (0x0), 0, 0, 0x0, 0, 2, 0, 2, ... (0x260000), 0x0, 90112, ) == 0x0
 00228   896   NtClose  (16, ... ) == 0x0
 00229   896   NtQueryDefaultLocale  (0, 2089305000, ... ) == 0x0
 00230   896   NtOpenSection  (0x4, {24, 0, 0x40, 0, 0,  (0x4, {24, 0, 0x40, 0, 0, "\NLS\NlsSectionLocale"}, ... 16, ) }, ... 16, ) == 0x0
 00231   896   NtMapViewOfSection  (16, -1, (0x0), 0, 0, 0x0, 0, 2, 0, 2, ... (0x280000), 0x0, 249856, ) == 0x0
 00232   896   NtClose  (16, ... ) == 0x0
 00233   896   NtOpenSection  (0x5, {24, 0, 0x40, 0, 0,  (0x5, {24, 0, 0x40, 0, 0, "\NLS\NlsSectionSortkey"}, ... 16, ) }, ... 16, ) == 0x0
 00234   896   NtMapViewOfSection  (16, -1, (0x0), 0, 0, 0x0, 0, 2, 0, 2, ... (0x2c0000), 0x0, 266240, ) == 0x0
 00235   896   NtQuerySection  (16, Basic, 16, ... {BaseAddress=0x0,Attributes=0x800000,Size={0x40004, 0x0},}, 0x0, ) == 0x0
 00236   896   NtClose  (16, ... ) == 0x0
 00237   896   NtOpenSection  (0x4, {24, 0, 0x40, 0, 0,  (0x4, {24, 0, 0x40, 0, 0, "\NLS\NlsSectionSortTbls"}, ... 16, ) }, ... 16, ) == 0x0
 00238   896   NtMapViewOfSection  (16, -1, (0x0), 0, 0, 0x0, 0, 2, 0, 2, ... (0x310000), 0x0, 24576, ) == 0x0
 00239   896   NtClose  (16, ... ) == 0x0
 00240   896   NtQueryVirtualMemory  (-1, 0x7ffd2000, Basic, 28, ... {BaseAddress=0x7ffd2000,AllocationBase=0x7ffb0000,AllocationProtect=0x2,RegionSize=0x2000,State=0x1000,Protect=0x2,Type=0x40000,}, 0x0, ) == 0x0
 00241   896   NtOpenSection  (0x4, {24, 0, 0x40, 0, 0,  (0x4, {24, 0, 0x40, 0, 0, "\NLS\NlsSectionSortkey00000409"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00242   896   NtOpenSection  (0x4, {24, 0, 0x40, 0, 0,  (0x4, {24, 0, 0x40, 0, 0, "\NLS\NlsSectionSortkey00000409"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00243   896   NtAllocateVirtualMemory  (-1, 2428928, 0, 8192, 4096, 4, ... 2428928, 8192, ) == 0x0
 00244   896   NtRequestWaitReplyPort  (24, {24, 52, new_msg, 0, 7012468, 7929957, 3145776, 3145776}  (24, {24, 52, new_msg, 0, 7012468, 7929957, 3145776, 3145776} "\210\6!\1\36\0\1\0\0\0\0\0\377\377\377\377\234\6!\1p\30\0\0" ... {24, 52, reply, 0, 1252, 896, 81832, 0} "\10P\30\0\36\0\1\0\0\0\0\0\377\377\377\377\234\6!\1p\30\0\0" )  ... {24, 52, reply, 0, 1252, 896, 81832, 0}  (24, {24, 52, new_msg, 0, 7012468, 7929957, 3145776, 3145776} "\210\6!\1\36\0\1\0\0\0\0\0\377\377\377\377\234\6!\1p\30\0\0" ... {24, 52, reply, 0, 1252, 896, 81832, 0} "\10P\30\0\36\0\1\0\0\0\0\0\377\377\377\377\234\6!\1p\30\0\0" )  ) == 0x0
 00245   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 2089305760, 2090321376, 0, 0}  (24, {28, 56, new_msg, 0, 2089305760, 2090321376, 0, 0} "\210\6!\1\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\234\6!\18\6\0\0" ... {28, 56, reply, 0, 1252, 896, 81833, 0} "\250\202\26\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\234\6!\18\6\0\0" )  ... {28, 56, reply, 0, 1252, 896, 81833, 0}  (24, {28, 56, new_msg, 0, 2089305760, 2090321376, 0, 0} "\210\6!\1\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\234\6!\18\6\0\0" ... {28, 56, reply, 0, 1252, 896, 81833, 0} "\250\202\26\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\234\6!\18\6\0\0" )  ) == 0x0
 00246   896   NtProtectVirtualMemory  (-1, (0x409000), 98320, 4, ... (0x409000), 102400, 128, ) == 0x0
 00247   896   NtProtectVirtualMemory  (-1, (0x409000), 102400, 128, ... (0x409000), 102400, 4, ) == 0x0
 00248   896   NtFlushInstructionCache  (-1, 4231168, 98320, ... ) == 0x0
 00249   896   NtQueryInformationProcess  (-1, 37, 48, ... {process info, class 37, size 48}, 0x0, ) == 0x0
 00250   896   NtSetInformationProcess  (-1, 34, {process info, class 34, size 4}, 4, ... ) == 0x0
 00251   896   NtOpenProcessToken  (-1, 0x8, ... 16, ) == 0x0
 00252   896   NtQueryInformationToken  (16, Statistics, 56, ... {token info, class 10, size 56}, 56, ) == 0x0
 00253   896   NtClose  (16, ... ) == 0x0
 00254   896   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\System\CurrentControlSet\Control\Terminal Server"}, ... 16, ) }, ... 16, ) == 0x0
 00255   896   NtQueryValueKey  (16,  (16, "TSAppCompat", Partial, 548, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) , Partial, 548, ... TitleIdx=0, Type=4, Data= (16, "TSAppCompat", Partial, 548, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) }, 16, ) == 0x0
 00256   896   NtClose  (16, ... ) == 0x0
 00257   896   NtTestAlert  (... ) == 0x0
 00258   896   NtContinue  (1244464, 1, ...
 00259   896   NtSetInformationThread  (-2, Win32StartAddress(LpcReceivedMessageId), {StartAddress(LpcReceivedMsgId)=0x40283e,}, 4, ... ) == 0x0
 00260   896   NtOpenDirectoryObject  (0x2000f, {24, 0, 0x40, 0, 0,  (0x2000f, {24, 0, 0x40, 0, 0, "\BaseNamedObjects"}, ... 16, ) }, ... 16, ) == 0x0
 00261   896   NtCreateEvent  (0x1f0003, {24, 16, 0x80, 1245092, 0,  (0x1f0003, {24, 16, 0x80, 1245092, 0, "Vx_4"}, 1, 0, ... 28, ) }, 1, 0, ... 28, ) == 0x0
 00262   896   NtCreateSection  (0xe, {24, 0, 0x40, 1245092, 0,  (0xe, {24, 0, 0x40, 1245092, 0, "\BaseNamedObjects\VtSect"}, {29480, 0}, 64, 134217728, 0, ... 32, ) }, {29480, 0}, 64, 134217728, 0, ... 32, ) == 0x0
 00263   896   NtMapViewOfSection  (32, -1, (0x0), 0, 29480, 0x0, 29480, 2, 0, 64, ... (0x320000), 0x0, 32768, ) == 0x0
 00264   896   NtOpenProcessToken  (-1, 0x20, ... 36, ) == 0x0
 00265   896   NtOpenKey  (0x1, {24, 0, 0x40, 0, 0,  (0x1, {24, 0, 0x40, 0, 0, "\Registry\MACHINE\System\CurrentControlSet\Control\Session Manager"}, ... 40, ) }, ... 40, ) == 0x0
 00266   896   NtQueryValueKey  (40,  (40, "SafeDllSearchMode", Partial, 16, ... ) , Partial, 16, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00267   896   NtClose  (40, ... ) == 0x0
 00268   896   NtAllocateVirtualMemory  (-1, 1323008, 0, 4096, 4096, 4, ... 1323008, 4096, ) == 0x0
 00269   896   NtOpenSection  (0xe, {24, 8, 0x40, 0, 0,  (0xe, {24, 8, 0x40, 0, 0, "ADVAPI32.DLL"}, ... 40, ) }, ... 40, ) == 0x0
 00270   896   NtMapViewOfSection  (40, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x77dd0000), 0x0, 634880, ) == 0x0
 00271   896   NtClose  (40, ... ) == 0x0
 00272   896   NtProtectVirtualMemory  (-1, (0x77dd1000), 1700, 4, ... (0x77dd1000), 4096, 32, ) == 0x0
 00273   896   NtProtectVirtualMemory  (-1, (0x77dd1000), 4096, 32, ... (0x77dd1000), 4096, 4, ) == 0x0
 00274   896   NtFlushInstructionCache  (-1, 2010976256, 1700, ... ) == 0x0
 00275   896   NtOpenSection  (0xe, {24, 8, 0x40, 0, 0,  (0xe, {24, 8, 0x40, 0, 0, "RPCRT4.dll"}, ... 40, ) }, ... 40, ) == 0x0
 00276   896   NtMapViewOfSection  (40, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x77e70000), 0x0, 593920, ) == 0x0
 00277   896   NtClose  (40, ... ) == 0x0
 00278   896   NtProtectVirtualMemory  (-1, (0x77e71000), 868, 4, ... (0x77e71000), 4096, 32, ) == 0x0
 00279   896   NtProtectVirtualMemory  (-1, (0x77e71000), 4096, 32, ... (0x77e71000), 4096, 4, ) == 0x0
 00280   896   NtFlushInstructionCache  (-1, 2011631616, 868, ... ) == 0x0
 00281   896   NtProtectVirtualMemory  (-1, (0x77e71000), 868, 4, ... (0x77e71000), 4096, 32, ) == 0x0
 00282   896   NtProtectVirtualMemory  (-1, (0x77e71000), 4096, 32, ... (0x77e71000), 4096, 4, ) == 0x0
 00283   896   NtFlushInstructionCache  (-1, 2011631616, 868, ... ) == 0x0
 00284   896   NtProtectVirtualMemory  (-1, (0x77e71000), 868, 4, ... (0x77e71000), 4096, 32, ) == 0x0
 00285   896   NtProtectVirtualMemory  (-1, (0x77e71000), 4096, 32, ... (0x77e71000), 4096, 4, ) == 0x0
 00286   896   NtFlushInstructionCache  (-1, 2011631616, 868, ... ) == 0x0
 00287   896   NtProtectVirtualMemory  (-1, (0x77dd1000), 1700, 4, ... (0x77dd1000), 4096, 32, ) == 0x0
 00288   896   NtProtectVirtualMemory  (-1, (0x77dd1000), 4096, 32, ... (0x77dd1000), 4096, 4, ) == 0x0
 00289   896   NtFlushInstructionCache  (-1, 2010976256, 1700, ... ) == 0x0
 00290   896   NtOpenKey  (0x80000000, {24, 0, 0x40, 0, 0,  (0x80000000, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RPCRT4.dll"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00291   896   NtAllocateVirtualMemory  (-1, 1327104, 0, 4096, 4096, 4, ... 1327104, 4096, ) == 0x0
 00292   896   NtOpenKey  (0x80000000, {24, 0, 0x40, 0, 0,  (0x80000000, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ADVAPI32.DLL"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00293   896   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\System\CurrentControlSet\Control\Terminal Server"}, ... 40, ) }, ... 40, ) == 0x0
 00294   896   NtQueryValueKey  (40,  (40, "TSAppCompat", Partial, 548, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) , Partial, 548, ... TitleIdx=0, Type=4, Data= (40, "TSAppCompat", Partial, 548, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) }, 16, ) == 0x0
 00295   896   NtQueryValueKey  (40,  (40, "TSUserEnabled", Partial, 548, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) , Partial, 548, ... TitleIdx=0, Type=4, Data= (40, "TSUserEnabled", Partial, 548, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) }, 16, ) == 0x0
 00296   896   NtClose  (40, ... ) == 0x0
 00297   896   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon"}, ... 40, ) }, ... 40, ) == 0x0
 00298   896   NtQueryValueKey  (40,  (40, "LeakTrack", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00299   896   NtClose  (40, ... ) == 0x0
 00300   896   NtOpenKey  (0x2000000, {24, 0, 0x40, 0, 0,  (0x2000000, {24, 0, 0x40, 0, 0, "\REGISTRY\MACHINE"}, ... 40, ) }, ... 40, ) == 0x0
 00301   896   NtSetInformationObject  (40, Handle, {Inherit=0,ProtectFromClose=1,}, 2011431168, ... ) == 0x0
 00302   896   NtOpenKey  (0x20019, {24, 40, 0x40, 0, 0,  (0x20019, {24, 40, 0x40, 0, 0, "Software\Microsoft\Windows NT\CurrentVersion\Diagnostics"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00303   896   NtOpenKey  (0x80000000, {24, 0, 0x40, 0, 0,  (0x80000000, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ntdll.dll"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00304   896   NtOpenKey  (0x80000000, {24, 0, 0x40, 0, 0,  (0x80000000, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kernel32.dll"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00305   896   NtQuerySystemInformation  (Basic, 44, ... {Unknown=0,MaximumIncrement=156250,PhysicalPageSize=0x1000,NumberOfPhysicalPages=0xff7c,LowestPhysicalPage=0x1,HighestPhysicalPage=0xffff,AllocationGranularity=0x10000,LowestUserAddress=0x10000,HighestUserAddress=0x7ffeffff,ActiveProcessors=1,NumberProcessors=1,}, 0x0, ) == 0x0
 00306   896   NtOpenKey  (0x20019, {24, 40, 0x40, 0, 0,  (0x20019, {24, 40, 0x40, 0, 0, "Software\Microsoft\Rpc\PagedBuffers"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00307   896   NtOpenKey  (0x20019, {24, 40, 0x40, 0, 0,  (0x20019, {24, 40, 0x40, 0, 0, "Software\Microsoft\Rpc"}, ... 44, ) }, ... 44, ) == 0x0
 00308   896   NtQueryValueKey  (44,  (44, "MaxRpcSize", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00309   896   NtClose  (44, ... ) == 0x0
 00310   896   NtOpenKey  (0x20019, {24, 40, 0x40, 0, 0,  (0x20019, {24, 40, 0x40, 0, 0, "Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\packed.exe\RpcThreadPoolThrottle"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00311   896   NtCreateEvent  (0x1f0003, 0x0, 1, 0, ... 44, ) == 0x0
 00312   896   NtCreateEvent  (0x1f0003, 0x0, 1, 0, ... 48, ) == 0x0
 00313   896   NtQuerySystemTime  (... {1412422914, 29929616}, ) == 0x0
 00314   896   NtCreateEvent  (0x1f0003, 0x0, 0, 0, ... 52, ) == 0x0
 00315   896   NtOpenKey  (0x20019, {24, 40, 0x40, 0, 0,  (0x20019, {24, 40, 0x40, 0, 0, "Software\Policies\Microsoft\Windows NT\Rpc"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00316   896   NtQuerySystemInformation  (Performance, 312, ... {system info, class 2, size 312}, 0x0, ) == 0x0
 00317   896   NtQueryInformationProcess  (-1, QuotaLimits, 32, ... {process info, class 1, size 32}, 0x0, ) == 0x0
 00318   896   NtQueryInformationProcess  (-1, VmCounters, 44, ... {process info, class 3, size 44}, 0x0, ) == 0x0
 00319   896   NtCreateEvent  (0x1f0003, 0x0, 0, 0, ... 56, ) == 0x0
 00320   896   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ... 60, ) == 0x0
 00321   896   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\System\CurrentControlSet\Control\ComputerName"}, ... 64, ) }, ... 64, ) == 0x0
 00322   896   NtOpenKey  (0x20019, {24, 64, 0x40, 0, 0,  (0x20019, {24, 64, 0x40, 0, 0, "ActiveComputerName"}, ... 68, ) }, ... 68, ) == 0x0
 00323   896   NtQueryValueKey  (68,  (68, "ComputerName", Full, 108, ... TitleIdx=0, Type=1, Name="ComputerName", Data="V\0I\0R\0T\0U\0A\0L\0\0\0"}, 60, ) , Full, 108, ... TitleIdx=0, Type=1, Name= (68, "ComputerName", Full, 108, ... TitleIdx=0, Type=1, Name="ComputerName", Data="V\0I\0R\0T\0U\0A\0L\0\0\0"}, 60, ) , Data= (68, "ComputerName", Full, 108, ... TitleIdx=0, Type=1, Name="ComputerName", Data="V\0I\0R\0T\0U\0A\0L\0\0\0"}, 60, ) }, 60, ) == 0x0
 00324   896   NtClose  (68, ... ) == 0x0
 00325   896   NtClose  (64, ... ) == 0x0
 00326   896   NtCreateIoCompletion  (0x1f0003, 0x0, 0, ... 64, ) == 0x0
 00327   896   NtCreateIoCompletion  (0x1f0003, 0x0, -1, ... 68, ) == 0x0
 00328   896   NtDuplicateObject  (-1, 64, -1, 0x0, 0, 2, ... 72, ) == 0x0
 00329   896   NtAllocateVirtualMemory  (-1, 1331200, 0, 4096, 4096, 4, ... 1331200, 4096, ) == 0x0
 00330   896   NtOpenThreadToken  (-2, 0xc, 1, ... ) == STATUS_NO_TOKEN
 00331   896   NtCreateEvent  (0x1f0003, 0x0, 1, 0, ... 76, ) == 0x0
 00332   896   NtOpenThreadToken  (-2, 0xc, 1, ... ) == STATUS_NO_TOKEN
 00333   896   NtSetInformationThread  (-2, ImpersonationToken, {ImpToken=0,}, 4, ... ) == 0x0
 00334   896   NtCreateFile  (0xc0100080, {24, 0, 0x40, 0, 1243236,  (0xc0100080, {24, 0, 0x40, 0, 1243236, "\??\PIPE\lsarpc"}, 0x0, 0, 3, 1, 64, 0, 0, ... 80, {status=0x0, info=1}, ) }, 0x0, 0, 3, 1, 64, 0, 0, ... 80, {status=0x0, info=1}, ) == 0x0
 00335   896   NtSetInformationFile  (80, 1243292, 8, Pipe, ... {status=0x0, info=0}, ) == 0x0
 00336   896   NtSetInformationFile  (80, 1243280, 8, Completion, ... {status=0x0, info=0}, ) == 0x0
 00337   896   NtSetInformationThread  (-2, ImpersonationToken, {ImpToken=0,}, 4, ... ) == 0x0
 00338   896   NtWriteFile  (80, 57, 0, 0,  (80, 57, 0, 0, "\5\0\13\3\20\0\0\0H\0\0\0\1\0\0\0\270\20\270\20\0\0\0\0\1\0\0\0\0\0\1\0xW4\224\22\315\253\357\0\1#Eg\211\253\0\0\0\0\4]\210\212\353\34\311\21\237\350\10\0+\20H`\2\0\0\0", 72, {0, 0}, 0, ... {status=0x0, info=72}, ) , 72, {0, 0}, 0, ... {status=0x0, info=72}, ) == 0x0
 00339   896   NtReadFile  (80, 57, 0, 0, 1024, {0, 0}, 0, ... {status=0x0, info=68},  (80, 57, 0, 0, 1024, {0, 0}, 0, ... {status=0x0, info=68}, "\5\0\14\3\20\0\0\0D\0\0\0\1\0\0\0\270\20\270\20k+\0\0\14\0\PIPE\lsass\0\0\0\1\0\0\0\0\0\0\0\4]\210\212\353\34\311\21\237\350\10\0+\20H`\2\0\0\0", ) , ) == 0x0
 00340   896   NtFsControlFile  (80, 57, 0x0, 0x0, 0x11c017,  (80, 57, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0@\0\0\0\1\0\0\0(\0\0\0\0\0,\0\0\0\0\0\30\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0,\377\22\0\14\0\0\0\2\0\1\0\0\10\0\0", 64, 1024, ... {status=0x103, info=68}, "\5\0\14\3\20\0\0\0D\0\0\0\1\0\0\0\270\20\270\20k+\0\0\14\0\PIPE\lsass\0\0\0\1\0\0\0\0\0\0\0\4]\210\212\353\34\311\21\237\350\10\0+\20H`\2\0\0\0", ) , 64, 1024, ... {status=0x103, info=68},  (80, 57, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0@\0\0\0\1\0\0\0(\0\0\0\0\0,\0\0\0\0\0\30\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0,\377\22\0\14\0\0\0\2\0\1\0\0\10\0\0", 64, 1024, ... {status=0x103, info=68}, "\5\0\14\3\20\0\0\0D\0\0\0\1\0\0\0\270\20\270\20k+\0\0\14\0\PIPE\lsass\0\0\0\1\0\0\0\0\0\0\0\4]\210\212\353\34\311\21\237\350\10\0+\20H`\2\0\0\0", ) , ) == 0x103
 00341   896   NtFsControlFile  (80, 57, 0x0, 0x0, 0x11c017,  (80, 57, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0`\0\0\0\2\0\0\0H\0\0\0\0\0\37\0\0\0\0\0\201\262\254?gS\263F\252\227\2L\355h\28 \0"\0X@\24\0\21\0\0\0\0\0\0\0\20\0\0\0S\0e\0D\0e\0b\0u\0g\0P\0r\0i\0v\0i\0l\0e\0g\0e\0", 96, 1024, ... {status=0x103, info=48}, "\5\0\2\3\20\0\0\00\0\0\0\1\0\0\0\30\0\0\0\0\0\0\0\0\0\0\0\201\262\254?gS\263F\252\227\2L\355h\28\0\0\0\0", ) \0X@\24\0\21\0\0\0\0\0\0\0\20\0\0\0S\0e\0D\0e\0b\0u\0g\0P\0r\0i\0v\0i\0l\0e\0g\0e\0 (80, 57, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0`\0\0\0\2\0\0\0H\0\0\0\0\0\37\0\0\0\0\0\201\262\254?gS\263F\252\227\2L\355h\28 \0"\0X@\24\0\21\0\0\0\0\0\0\0\20\0\0\0S\0e\0D\0e\0b\0u\0g\0P\0r\0i\0v\0i\0l\0e\0g\0e\0", 96, 1024, ... {status=0x103, info=48}, "\5\0\2\3\20\0\0\00\0\0\0\1\0\0\0\30\0\0\0\0\0\0\0\0\0\0\0\201\262\254?gS\263F\252\227\2L\355h\28\0\0\0\0", ) \5\0\2\3\20\0\0\00\0\0\0\1\0\0\0\30\0\0\0\0\0\0\0\0\0\0\0\201\262\254?gS\263F\252\227\2L\355h\28\0\0\0\0", ) == 0x103
 00342   896   NtFsControlFile  (80, 57, 0x0, 0x0, 0x11c017,  (80, 57, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0,\0\0\0\3\0\0\0\24\0\0\0\0\0\0\0\0\0\0\0\201\262\254?gS\263F\252\227\2L\355h\28", 44, 1024, ... {status=0x103, info=36}, "\5\0\2\3\20\0\0\0$\0\0\0\2\0\0\0\14\0\0\0\0\0\0\0\24\0\0\0\0\0\0\0\0\0\0\0", ) , 44, 1024, ... {status=0x103, info=36},  (80, 57, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0,\0\0\0\3\0\0\0\24\0\0\0\0\0\0\0\0\0\0\0\201\262\254?gS\263F\252\227\2L\355h\28", 44, 1024, ... {status=0x103, info=36}, "\5\0\2\3\20\0\0\0$\0\0\0\2\0\0\0\14\0\0\0\0\0\0\0\24\0\0\0\0\0\0\0\0\0\0\0", ) , ) == 0x103
 00343   896   NtClose  (76, ... ) == 0x0
 00344   896   NtClose  (80, ... ) == 0x0
 00345   896   NtAdjustPrivilegesToken  (36, 0, 1245080, 0, 0, 0, ... ) == 0x0
 00346   896   NtClose  (36, ... ) == 0x0
 00347   896   NtAllocateVirtualMemory  (-1, 0, 0, 65536, 4096, 4, ... 3342336, 65536, ) == 0x0
 00348   896   NtQuerySystemInformation  (ProcessesAndThreads, 65536, ... {system info, class 5, size 500}, 0x0, ) == 0x0
 00349   896   NtCreateSection  (0xf0007, 0x0, {18400, 0}, 4, 134217728, 0, ... 36, ) == 0x0
 00350   896   NtMapViewOfSection  (36, -1, (0x0), 0, 0, {0, 0}, 0, 1, 0, 4, ... (0x340000), {0, 0}, 20480, ) == 0x0
 00351   896   NtUnmapViewOfSection  (-1, 0x340000, ... ) == 0x0
 00352   896   NtMapViewOfSection  (36, -1, (0x0), 0, 0, {0, 0}, 0, 1, 0, 4, ... (0x340000), {0, 0}, 20480, ) == 0x0
 00353   896   NtFreeVirtualMemory  (-1, (0x330000), 0, 32768, ... (0x330000), 65536, ) == 0x0
 00354   896   NtUnmapViewOfSection  (-1, 0x340000, ... ) == 0x0
 00355   896   NtMapViewOfSection  (36, -1, (0x0), 0, 0, {0, 0}, 0, 1, 0, 4, ... (0x330000), {0, 0}, 20480, ) == 0x0
 00356   896   NtUnmapViewOfSection  (-1, 0x330000, ... ) == 0x0
 00357   896   NtMapViewOfSection  (36, -1, (0x0), 0, 0, {0, 0}, 0, 1, 0, 4, ... (0x330000), {0, 0}, 20480, ) == 0x0
 00358   896   NtUnmapViewOfSection  (-1, 0x330000, ... ) == 0x0
 00359   896   NtMapViewOfSection  (36, -1, (0x0), 0, 0, {0, 0}, 0, 1, 0, 4, ... (0x330000), {0, 0}, 20480, ) == 0x0
 00360   896   NtUnmapViewOfSection  (-1, 0x330000, ... ) == 0x0
 00361   896   NtMapViewOfSection  (36, -1, (0x0), 0, 0, {0, 0}, 0, 1, 0, 4, ... (0x330000), {0, 0}, 20480, ) == 0x0
 00362   896   NtUnmapViewOfSection  (-1, 0x330000, ... ) == 0x0
 00363   896   NtMapViewOfSection  (36, -1, (0x0), 0, 0, {0, 0}, 0, 1, 0, 4, ... (0x330000), {0, 0}, 20480, ) == 0x0
 00364   896   NtUnmapViewOfSection  (-1, 0x330000, ... ) == 0x0
 00365   896   NtOpenProcess  (0x2a, {24, 0, 0x0, 0, 0, 0x0}, {580, 0}, ... 80, ) == 0x0
 00366   896   NtOpenSection  (0xe, {24, 0, 0x40, 0, 0,  (0xe, {24, 0, 0x40, 0, 0, "\BaseNamedObjects\VtSect"}, ... 76, ) }, ... 76, ) == 0x0
 00367   896   NtMapViewOfSection  (76, 80, (0x0), 0, 29480, 0x0, 29480, 2, 1048576, 64, ... (0x7ff90000), 0x0, 32768, ) == 0x0
 00368   896   NtClose  (76, ... ) == 0x0
 00369   896   NtProtectVirtualMemory  (80, (0x7c90d682), 5, 64, ... (0x7c90d000), 4096, 32, ) == 0x0
 00370   896   NtWriteVirtualMemory  (80, 0x7c90d682,  (80, 0x7c90d682, "\350\217Rh\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00371   896   NtProtectVirtualMemory  (80, (0x7c90dcfd), 5, 64, ... (0x7c90d000), 4096, 64, ) == 0x0
 00372   896   NtWriteVirtualMemory  (80, 0x7c90dcfd,  (80, 0x7c90dcfd, "\350aLh\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00373   896   NtProtectVirtualMemory  (80, (0x7c90d754), 5, 64, ... (0x7c90d000), 4096, 64, ) == 0x0
 00374   896   NtWriteVirtualMemory  (80, 0x7c90d754,  (80, 0x7c90d754, "\350\21Rh\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00375   896   NtProtectVirtualMemory  (80, (0x7c90d769), 5, 64, ... (0x7c90d000), 4096, 64, ) == 0x0
 00376   896   NtWriteVirtualMemory  (80, 0x7c90d769,  (80, 0x7c90d769, "\350\11Rh\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00377   896   NtAllocateVirtualMemory  (80, 0, 0, 1048576, 8192, 4, ... 27852800, 1048576, ) == 0x0
 00378   896   NtAllocateVirtualMemory  (80, 28893184, 0, 8192, 4096, 4, ... 28893184, 8192, ) == 0x0
 00379   896   NtProtectVirtualMemory  (80, (0x1b8e000), 4096, 260, ... (0x1b8e000), 4096, 4, ) == 0x0
 00380   896   NtCreateThread  (0x1f03ff, 0x0, 80, 1243840, 1243784, 1, ... 76, {580, 2016}, ) == 0x0
 00381   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 0, 0, 0, 0}  (24, {28, 56, new_msg, 0, 0, 0, 0, 0} "\0\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0L\0\0\0D\2\0\0\340\7\0\0" ... {28, 56, reply, 0, 1252, 896, 81834, 0} "\0\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0L\0\0\0D\2\0\0\340\7\0\0" )  ... {28, 56, reply, 0, 1252, 896, 81834, 0}  (24, {28, 56, new_msg, 0, 0, 0, 0, 0} "\0\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0L\0\0\0D\2\0\0\340\7\0\0" ... {28, 56, reply, 0, 1252, 896, 81834, 0} "\0\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0L\0\0\0D\2\0\0\340\7\0\0" )  ) == 0x0
 00382   896   NtResumeThread  (76, ... 1, ) == 0x0
 00383   896   NtDelayExecution  (0, {-100000, -1}, ... ) == 0x0
 00384   896   NtDelayExecution  (0, {-100000, -1}, ... ) == 0x0
 00385   896   NtDelayExecution  (0, {-100000, -1}, ... ) == 0x0
 00386   896   NtDelayExecution  (0, {-100000, -1}, ... ) == 0x0
 00387   896   NtDelayExecution  (0, {-100000, -1}, ... ) == 0x0
 00388   896   NtDelayExecution  (0, {-100000, -1}, ... ) == 0x0
 00389   896   NtDelayExecution  (0, {-100000, -1}, ... ) == 0x0
 00390   896   NtDelayExecution  (0, {-100000, -1}, ... ) == 0x0
 00391   896   NtClose  (80, ... ) == 0x0
 00392   896   NtMapViewOfSection  (36, -1, (0x0), 0, 0, {0, 0}, 0, 1, 0, 4, ... (0x330000), {0, 0}, 20480, ) == 0x0
 00393   896   NtUnmapViewOfSection  (-1, 0x330000, ... ) == 0x0
 00394   896   NtOpenProcess  (0x2a, {24, 0, 0x0, 0, 0, 0x0}, {640, 0}, ... 80, ) == 0x0
 00395   896   NtOpenSection  (0xe, {24, 0, 0x40, 0, 0,  (0xe, {24, 0, 0x40, 0, 0, "\BaseNamedObjects\VtSect"}, ... 84, ) }, ... 84, ) == 0x0
 00396   896   NtMapViewOfSection  (84, 80, (0x0), 0, 29480, 0x0, 29480, 2, 1048576, 64, ... (0x7ff90000), 0x0, 32768, ) == 0x0
 00397   896   NtClose  (84, ... ) == 0x0
 00398   896   NtProtectVirtualMemory  (80, (0x7c90d682), 5, 64, ... (0x7c90d000), 4096, 32, ) == 0x0
 00399   896   NtWriteVirtualMemory  (80, 0x7c90d682,  (80, 0x7c90d682, "\350\217Rh\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00400   896   NtProtectVirtualMemory  (80, (0x7c90dcfd), 5, 64, ... (0x7c90d000), 4096, 64, ) == 0x0
 00401   896   NtWriteVirtualMemory  (80, 0x7c90dcfd,  (80, 0x7c90dcfd, "\350aLh\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00402   896   NtProtectVirtualMemory  (80, (0x7c90d754), 5, 64, ... (0x7c90d000), 4096, 64, ) == 0x0
 00403   896   NtWriteVirtualMemory  (80, 0x7c90d754,  (80, 0x7c90d754, "\350\21Rh\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00404   896   NtProtectVirtualMemory  (80, (0x7c90d769), 5, 64, ... (0x7c90d000), 4096, 64, ) == 0x0
 00405   896   NtWriteVirtualMemory  (80, 0x7c90d769,  (80, 0x7c90d769, "\350\11Rh\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00406   896   NtClose  (80, ... ) == 0x0
 00407   896   NtMapViewOfSection  (36, -1, (0x0), 0, 0, {0, 0}, 0, 1, 0, 4, ... (0x330000), {0, 0}, 20480, ) == 0x0
 00408   896   NtUnmapViewOfSection  (-1, 0x330000, ... ) == 0x0
 00409   896   NtOpenProcess  (0x2a, {24, 0, 0x0, 0, 0, 0x0}, {652, 0}, ... 80, ) == 0x0
 00410   896   NtOpenSection  (0xe, {24, 0, 0x40, 0, 0,  (0xe, {24, 0, 0x40, 0, 0, "\BaseNamedObjects\VtSect"}, ... 84, ) }, ... 84, ) == 0x0
 00411   896   NtMapViewOfSection  (84, 80, (0x0), 0, 29480, 0x0, 29480, 2, 1048576, 64, ... (0x7ff90000), 0x0, 32768, ) == 0x0
 00412   896   NtClose  (84, ... ) == 0x0
 00413   896   NtProtectVirtualMemory  (80, (0x7c90d682), 5, 64, ... (0x7c90d000), 4096, 32, ) == 0x0
 00414   896   NtWriteVirtualMemory  (80, 0x7c90d682,  (80, 0x7c90d682, "\350\217Rh\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00415   896   NtProtectVirtualMemory  (80, (0x7c90dcfd), 5, 64, ... (0x7c90d000), 4096, 64, ) == 0x0
 00416   896   NtWriteVirtualMemory  (80, 0x7c90dcfd,  (80, 0x7c90dcfd, "\350aLh\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00417   896   NtProtectVirtualMemory  (80, (0x7c90d754), 5, 64, ... (0x7c90d000), 4096, 64, ) == 0x0
 00418   896   NtWriteVirtualMemory  (80, 0x7c90d754,  (80, 0x7c90d754, "\350\21Rh\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00419   896   NtProtectVirtualMemory  (80, (0x7c90d769), 5, 64, ... (0x7c90d000), 4096, 64, ) == 0x0
 00420   896   NtWriteVirtualMemory  (80, 0x7c90d769,  (80, 0x7c90d769, "\350\11Rh\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00421   896   NtClose  (80, ... ) == 0x0
 00422   896   NtMapViewOfSection  (36, -1, (0x0), 0, 0, {0, 0}, 0, 1, 0, 4, ... (0x330000), {0, 0}, 20480, ) == 0x0
 00423   896   NtUnmapViewOfSection  (-1, 0x330000, ... ) == 0x0
 00424   896   NtOpenProcess  (0x2a, {24, 0, 0x0, 0, 0, 0x0}, {816, 0}, ... 80, ) == 0x0
 00425   896   NtOpenSection  (0xe, {24, 0, 0x40, 0, 0,  (0xe, {24, 0, 0x40, 0, 0, "\BaseNamedObjects\VtSect"}, ... 84, ) }, ... 84, ) == 0x0
 00426   896   NtMapViewOfSection  (84, 80, (0x0), 0, 29480, 0x0, 29480, 2, 1048576, 64, ... (0x7ffa0000), 0x0, 32768, ) == 0x0
 00427   896   NtClose  (84, ... ) == 0x0
 00428   896   NtProtectVirtualMemory  (80, (0x7c90d682), 5, 64, ... (0x7c90d000), 4096, 32, ) == 0x0
 00429   896   NtWriteVirtualMemory  (80, 0x7c90d682,  (80, 0x7c90d682, "\350\217Ri\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00430   896   NtProtectVirtualMemory  (80, (0x7c90dcfd), 5, 64, ... (0x7c90d000), 4096, 64, ) == 0x0
 00431   896   NtWriteVirtualMemory  (80, 0x7c90dcfd,  (80, 0x7c90dcfd, "\350aLi\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00432   896   NtProtectVirtualMemory  (80, (0x7c90d754), 5, 64, ... (0x7c90d000), 4096, 64, ) == 0x0
 00433   896   NtWriteVirtualMemory  (80, 0x7c90d754,  (80, 0x7c90d754, "\350\21Ri\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00434   896   NtProtectVirtualMemory  (80, (0x7c90d769), 5, 64, ... (0x7c90d000), 4096, 64, ) == 0x0
 00435   896   NtWriteVirtualMemory  (80, 0x7c90d769,  (80, 0x7c90d769, "\350\11Ri\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00436   896   NtClose  (80, ... ) == 0x0
 00437   896   NtMapViewOfSection  (36, -1, (0x0), 0, 0, {0, 0}, 0, 1, 0, 4, ... (0x330000), {0, 0}, 20480, ) == 0x0
 00438   896   NtUnmapViewOfSection  (-1, 0x330000, ... ) == 0x0
 00439   896   NtOpenProcess  (0x2a, {24, 0, 0x0, 0, 0, 0x0}, {904, 0}, ... 80, ) == 0x0
 00440   896   NtOpenSection  (0xe, {24, 0, 0x40, 0, 0,  (0xe, {24, 0, 0x40, 0, 0, "\BaseNamedObjects\VtSect"}, ... 84, ) }, ... 84, ) == 0x0
 00441   896   NtMapViewOfSection  (84, 80, (0x0), 0, 29480, 0x0, 29480, 2, 1048576, 64, ... (0x7ffa0000), 0x0, 32768, ) == 0x0
 00442   896   NtClose  (84, ... ) == 0x0
 00443   896   NtProtectVirtualMemory  (80, (0x7c90d682), 5, 64, ... (0x7c90d000), 4096, 32, ) == 0x0
 00444   896   NtWriteVirtualMemory  (80, 0x7c90d682,  (80, 0x7c90d682, "\350\217Ri\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00445   896   NtProtectVirtualMemory  (80, (0x7c90dcfd), 5, 64, ... (0x7c90d000), 4096, 64, ) == 0x0
 00446   896   NtWriteVirtualMemory  (80, 0x7c90dcfd,  (80, 0x7c90dcfd, "\350aLi\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00447   896   NtProtectVirtualMemory  (80, (0x7c90d754), 5, 64, ... (0x7c90d000), 4096, 64, ) == 0x0
 00448   896   NtWriteVirtualMemory  (80, 0x7c90d754,  (80, 0x7c90d754, "\350\21Ri\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00449   896   NtProtectVirtualMemory  (80, (0x7c90d769), 5, 64, ... (0x7c90d000), 4096, 64, ) == 0x0
 00450   896   NtWriteVirtualMemory  (80, 0x7c90d769,  (80, 0x7c90d769, "\350\11Ri\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00451   896   NtClose  (80, ... ) == 0x0
 00452   896   NtMapViewOfSection  (36, -1, (0x0), 0, 0, {0, 0}, 0, 1, 0, 4, ... (0x330000), {0, 0}, 20480, ) == 0x0
 00453   896   NtUnmapViewOfSection  (-1, 0x330000, ... ) == 0x0
 00454   896   NtOpenProcess  (0x2a, {24, 0, 0x0, 0, 0, 0x0}, {1000, 0}, ... 80, ) == 0x0
 00455   896   NtOpenSection  (0xe, {24, 0, 0x40, 0, 0,  (0xe, {24, 0, 0x40, 0, 0, "\BaseNamedObjects\VtSect"}, ... 84, ) }, ... 84, ) == 0x0
 00456   896   NtMapViewOfSection  (84, 80, (0x0), 0, 29480, 0x0, 29480, 2, 1048576, 64, ... (0x7ff50000), 0x0, 32768, ) == 0x0
 00457   896   NtClose  (84, ... ) == 0x0
 00458   896   NtProtectVirtualMemory  (80, (0x7c90d682), 5, 64, ... (0x7c90d000), 4096, 32, ) == 0x0
 00459   896   NtWriteVirtualMemory  (80, 0x7c90d682,  (80, 0x7c90d682, "\350\217Rd\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00460   896   NtProtectVirtualMemory  (80, (0x7c90dcfd), 5, 64, ... (0x7c90d000), 4096, 64, ) == 0x0
 00461   896   NtWriteVirtualMemory  (80, 0x7c90dcfd,  (80, 0x7c90dcfd, "\350aLd\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00462   896   NtProtectVirtualMemory  (80, (0x7c90d754), 5, 64, ... (0x7c90d000), 4096, 64, ) == 0x0
 00463   896   NtWriteVirtualMemory  (80, 0x7c90d754,  (80, 0x7c90d754, "\350\21Rd\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00464   896   NtProtectVirtualMemory  (80, (0x7c90d769), 5, 64, ... (0x7c90d000), 4096, 64, ) == 0x0
 00465   896   NtWriteVirtualMemory  (80, 0x7c90d769,  (80, 0x7c90d769, "\350\11Rd\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00466   896   NtClose  (80, ... ) == 0x0
 00467   896   NtMapViewOfSection  (36, -1, (0x0), 0, 0, {0, 0}, 0, 1, 0, 4, ... (0x330000), {0, 0}, 20480, ) == 0x0
 00468   896   NtUnmapViewOfSection  (-1, 0x330000, ... ) == 0x0
 00469   896   NtOpenProcess  (0x2a, {24, 0, 0x0, 0, 0, 0x0}, {1044, 0}, ... 80, ) == 0x0
 00470   896   NtOpenSection  (0xe, {24, 0, 0x40, 0, 0,  (0xe, {24, 0, 0x40, 0, 0, "\BaseNamedObjects\VtSect"}, ... 84, ) }, ... 84, ) == 0x0
 00471   896   NtMapViewOfSection  (84, 80, (0x0), 0, 29480, 0x0, 29480, 2, 1048576, 64, ... (0x7ffa0000), 0x0, 32768, ) == 0x0
 00472   896   NtClose  (84, ... ) == 0x0
 00473   896   NtProtectVirtualMemory  (80, (0x7c90d682), 5, 64, ... (0x7c90d000), 4096, 32, ) == 0x0
 00474   896   NtWriteVirtualMemory  (80, 0x7c90d682,  (80, 0x7c90d682, "\350\217Ri\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00475   896   NtProtectVirtualMemory  (80, (0x7c90dcfd), 5, 64, ... (0x7c90d000), 4096, 64, ) == 0x0
 00476   896   NtWriteVirtualMemory  (80, 0x7c90dcfd,  (80, 0x7c90dcfd, "\350aLi\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00477   896   NtProtectVirtualMemory  (80, (0x7c90d754), 5, 64, ... (0x7c90d000), 4096, 64, ) == 0x0
 00478   896   NtWriteVirtualMemory  (80, 0x7c90d754,  (80, 0x7c90d754, "\350\21Ri\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00479   896   NtProtectVirtualMemory  (80, (0x7c90d769), 5, 64, ... (0x7c90d000), 4096, 64, ) == 0x0
 00480   896   NtWriteVirtualMemory  (80, 0x7c90d769,  (80, 0x7c90d769, "\350\11Ri\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00481   896   NtClose  (80, ... ) == 0x0
 00482   896   NtMapViewOfSection  (36, -1, (0x0), 0, 0, {0, 0}, 0, 1, 0, 4, ... (0x330000), {0, 0}, 20480, ) == 0x0
 00483   896   NtUnmapViewOfSection  (-1, 0x330000, ... ) == 0x0
 00484   896   NtOpenProcess  (0x2a, {24, 0, 0x0, 0, 0, 0x0}, {1196, 0}, ... 80, ) == 0x0
 00485   896   NtOpenSection  (0xe, {24, 0, 0x40, 0, 0,  (0xe, {24, 0, 0x40, 0, 0, "\BaseNamedObjects\VtSect"}, ... 84, ) }, ... 84, ) == 0x0
 00486   896   NtMapViewOfSection  (84, 80, (0x0), 0, 29480, 0x0, 29480, 2, 1048576, 64, ... (0x7ffa0000), 0x0, 32768, ) == 0x0
 00487   896   NtClose  (84, ... ) == 0x0
 00488   896   NtProtectVirtualMemory  (80, (0x7c90d682), 5, 64, ... (0x7c90d000), 4096, 32, ) == 0x0
 00489   896   NtWriteVirtualMemory  (80, 0x7c90d682,  (80, 0x7c90d682, "\350\217Ri\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00490   896   NtProtectVirtualMemory  (80, (0x7c90dcfd), 5, 64, ... (0x7c90d000), 4096, 64, ) == 0x0
 00491   896   NtWriteVirtualMemory  (80, 0x7c90dcfd,  (80, 0x7c90dcfd, "\350aLi\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00492   896   NtProtectVirtualMemory  (80, (0x7c90d754), 5, 64, ... (0x7c90d000), 4096, 64, ) == 0x0
 00493   896   NtWriteVirtualMemory  (80, 0x7c90d754,  (80, 0x7c90d754, "\350\21Ri\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00494   896   NtProtectVirtualMemory  (80, (0x7c90d769), 5, 64, ... (0x7c90d000), 4096, 64, ) == 0x0
 00495   896   NtWriteVirtualMemory  (80, 0x7c90d769,  (80, 0x7c90d769, "\350\11Ri\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00496   896   NtClose  (80, ... ) == 0x0
 00497   896   NtMapViewOfSection  (36, -1, (0x0), 0, 0, {0, 0}, 0, 1, 0, 4, ... (0x330000), {0, 0}, 20480, ) == 0x0
 00498   896   NtUnmapViewOfSection  (-1, 0x330000, ... ) == 0x0
 00499   896   NtOpenProcess  (0x2a, {24, 0, 0x0, 0, 0, 0x0}, {1468, 0}, ... 80, ) == 0x0
 00500   896   NtOpenSection  (0xe, {24, 0, 0x40, 0, 0,  (0xe, {24, 0, 0x40, 0, 0, "\BaseNamedObjects\VtSect"}, ... 84, ) }, ... 84, ) == 0x0
 00501   896   NtMapViewOfSection  (84, 80, (0x0), 0, 29480, 0x0, 29480, 2, 1048576, 64, ... (0x7ffa0000), 0x0, 32768, ) == 0x0
 00502   896   NtClose  (84, ... ) == 0x0
 00503   896   NtProtectVirtualMemory  (80, (0x7c90d682), 5, 64, ... (0x7c90d000), 4096, 32, ) == 0x0
 00504   896   NtWriteVirtualMemory  (80, 0x7c90d682,  (80, 0x7c90d682, "\350\217Ri\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00505   896   NtProtectVirtualMemory  (80, (0x7c90dcfd), 5, 64, ... (0x7c90d000), 4096, 64, ) == 0x0
 00506   896   NtWriteVirtualMemory  (80, 0x7c90dcfd,  (80, 0x7c90dcfd, "\350aLi\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00507   896   NtProtectVirtualMemory  (80, (0x7c90d754), 5, 64, ... (0x7c90d000), 4096, 64, ) == 0x0
 00508   896   NtWriteVirtualMemory  (80, 0x7c90d754,  (80, 0x7c90d754, "\350\21Ri\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00509   896   NtProtectVirtualMemory  (80, (0x7c90d769), 5, 64, ... (0x7c90d000), 4096, 64, ) == 0x0
 00510   896   NtWriteVirtualMemory  (80, 0x7c90d769,  (80, 0x7c90d769, "\350\11Ri\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00511   896   NtClose  (80, ... ) == 0x0
 00512   896   NtMapViewOfSection  (36, -1, (0x0), 0, 0, {0, 0}, 0, 1, 0, 4, ... (0x330000), {0, 0}, 20480, ) == 0x0
 00513   896   NtUnmapViewOfSection  (-1, 0x330000, ... ) == 0x0
 00514   896   NtOpenProcess  (0x2a, {24, 0, 0x0, 0, 0, 0x0}, {1720, 0}, ... 80, ) == 0x0
 00515   896   NtOpenSection  (0xe, {24, 0, 0x40, 0, 0,  (0xe, {24, 0, 0x40, 0, 0, "\BaseNamedObjects\VtSect"}, ... 84, ) }, ... 84, ) == 0x0
 00516   896   NtMapViewOfSection  (84, 80, (0x0), 0, 29480, 0x0, 29480, 2, 1048576, 64, ... (0x7ffa0000), 0x0, 32768, ) == 0x0
 00517   896   NtClose  (84, ... ) == 0x0
 00518   896   NtProtectVirtualMemory  (80, (0x7c90d682), 5, 64, ... (0x7c90d000), 4096, 32, ) == 0x0
 00519   896   NtWriteVirtualMemory  (80, 0x7c90d682,  (80, 0x7c90d682, "\350\217Ri\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00520   896   NtProtectVirtualMemory  (80, (0x7c90dcfd), 5, 64, ... (0x7c90d000), 4096, 64, ) == 0x0
 00521   896   NtWriteVirtualMemory  (80, 0x7c90dcfd,  (80, 0x7c90dcfd, "\350aLi\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00522   896   NtProtectVirtualMemory  (80, (0x7c90d754), 5, 64, ... (0x7c90d000), 4096, 64, ) == 0x0
 00523   896   NtWriteVirtualMemory  (80, 0x7c90d754,  (80, 0x7c90d754, "\350\21Ri\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00524   896   NtProtectVirtualMemory  (80, (0x7c90d769), 5, 64, ... (0x7c90d000), 4096, 64, ) == 0x0
 00525   896   NtWriteVirtualMemory  (80, 0x7c90d769,  (80, 0x7c90d769, "\350\11Ri\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00526   896   NtClose  (80, ... ) == 0x0
 00527   896   NtMapViewOfSection  (36, -1, (0x0), 0, 0, {0, 0}, 0, 1, 0, 4, ... (0x330000), {0, 0}, 20480, ) == 0x0
 00528   896   NtUnmapViewOfSection  (-1, 0x330000, ... ) == 0x0
 00529   896   NtOpenProcess  (0x2a, {24, 0, 0x0, 0, 0, 0x0}, {1888, 0}, ... 80, ) == 0x0
 00530   896   NtOpenSection  (0xe, {24, 0, 0x40, 0, 0,  (0xe, {24, 0, 0x40, 0, 0, "\BaseNamedObjects\VtSect"}, ... 84, ) }, ... 84, ) == 0x0
 00531   896   NtMapViewOfSection  (84, 80, (0x0), 0, 29480, 0x0, 29480, 2, 1048576, 64, ... (0x7ffa0000), 0x0, 32768, ) == 0x0
 00532   896   NtClose  (84, ... ) == 0x0
 00533   896   NtProtectVirtualMemory  (80, (0x7c90d682), 5, 64, ... (0x7c90d000), 4096, 32, ) == 0x0
 00534   896   NtWriteVirtualMemory  (80, 0x7c90d682,  (80, 0x7c90d682, "\350\217Ri\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00535   896   NtProtectVirtualMemory  (80, (0x7c90dcfd), 5, 64, ... (0x7c90d000), 4096, 64, ) == 0x0
 00536   896   NtWriteVirtualMemory  (80, 0x7c90dcfd,  (80, 0x7c90dcfd, "\350aLi\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00537   896   NtProtectVirtualMemory  (80, (0x7c90d754), 5, 64, ... (0x7c90d000), 4096, 64, ) == 0x0
 00538   896   NtWriteVirtualMemory  (80, 0x7c90d754,  (80, 0x7c90d754, "\350\21Ri\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00539   896   NtProtectVirtualMemory  (80, (0x7c90d769), 5, 64, ... (0x7c90d000), 4096, 64, ) == 0x0
 00540   896   NtWriteVirtualMemory  (80, 0x7c90d769,  (80, 0x7c90d769, "\350\11Ri\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00541   896   NtClose  (80, ... ) == 0x0
 00542   896   NtMapViewOfSection  (36, -1, (0x0), 0, 0, {0, 0}, 0, 1, 0, 4, ... (0x330000), {0, 0}, 20480, ) == 0x0
 00543   896   NtUnmapViewOfSection  (-1, 0x330000, ... ) == 0x0
 00544   896   NtOpenProcess  (0x2a, {24, 0, 0x0, 0, 0, 0x0}, {2024, 0}, ... 80, ) == 0x0
 00545   896   NtOpenSection  (0xe, {24, 0, 0x40, 0, 0,  (0xe, {24, 0, 0x40, 0, 0, "\BaseNamedObjects\VtSect"}, ... 84, ) }, ... 84, ) == 0x0
 00546   896   NtMapViewOfSection  (84, 80, (0x0), 0, 29480, 0x0, 29480, 2, 1048576, 64, ... (0x7ffa0000), 0x0, 32768, ) == 0x0
 00547   896   NtClose  (84, ... ) == 0x0
 00548   896   NtProtectVirtualMemory  (80, (0x7c90d682), 5, 64, ... (0x7c90d000), 4096, 32, ) == 0x0
 00549   896   NtWriteVirtualMemory  (80, 0x7c90d682,  (80, 0x7c90d682, "\350\217Ri\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00550   896   NtProtectVirtualMemory  (80, (0x7c90dcfd), 5, 64, ... (0x7c90d000), 4096, 64, ) == 0x0
 00551   896   NtWriteVirtualMemory  (80, 0x7c90dcfd,  (80, 0x7c90dcfd, "\350aLi\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00552   896   NtProtectVirtualMemory  (80, (0x7c90d754), 5, 64, ... (0x7c90d000), 4096, 64, ) == 0x0
 00553   896   NtWriteVirtualMemory  (80, 0x7c90d754,  (80, 0x7c90d754, "\350\21Ri\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00554   896   NtProtectVirtualMemory  (80, (0x7c90d769), 5, 64, ... (0x7c90d000), 4096, 64, ) == 0x0
 00555   896   NtWriteVirtualMemory  (80, 0x7c90d769,  (80, 0x7c90d769, "\350\11Ri\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00556   896   NtClose  (80, ... ) == 0x0
 00557   896   NtMapViewOfSection  (36, -1, (0x0), 0, 0, {0, 0}, 0, 1, 0, 4, ... (0x330000), {0, 0}, 20480, ) == 0x0
 00558   896   NtUnmapViewOfSection  (-1, 0x330000, ... ) == 0x0
 00559   896   NtOpenProcess  (0x2a, {24, 0, 0x0, 0, 0, 0x0}, {196, 0}, ... 80, ) == 0x0
 00560   896   NtOpenSection  (0xe, {24, 0, 0x40, 0, 0,  (0xe, {24, 0, 0x40, 0, 0, "\BaseNamedObjects\VtSect"}, ... 84, ) }, ... 84, ) == 0x0
 00561   896   NtMapViewOfSection  (84, 80, (0x0), 0, 29480, 0x0, 29480, 2, 1048576, 64, ... (0x7ffa0000), 0x0, 32768, ) == 0x0
 00562   896   NtClose  (84, ... ) == 0x0
 00563   896   NtProtectVirtualMemory  (80, (0x7c90d682), 5, 64, ... (0x7c90d000), 4096, 32, ) == 0x0
 00564   896   NtWriteVirtualMemory  (80, 0x7c90d682,  (80, 0x7c90d682, "\350\217Ri\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00565   896   NtProtectVirtualMemory  (80, (0x7c90dcfd), 5, 64, ... (0x7c90d000), 4096, 64, ) == 0x0
 00566   896   NtWriteVirtualMemory  (80, 0x7c90dcfd,  (80, 0x7c90dcfd, "\350aLi\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00567   896   NtProtectVirtualMemory  (80, (0x7c90d754), 5, 64, ... (0x7c90d000), 4096, 64, ) == 0x0
 00568   896   NtWriteVirtualMemory  (80, 0x7c90d754,  (80, 0x7c90d754, "\350\21Ri\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00569   896   NtProtectVirtualMemory  (80, (0x7c90d769), 5, 64, ... (0x7c90d000), 4096, 64, ) == 0x0
 00570   896   NtWriteVirtualMemory  (80, 0x7c90d769,  (80, 0x7c90d769, "\350\11Ri\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00571   896   NtClose  (80, ... ) == 0x0
 00572   896   NtMapViewOfSection  (36, -1, (0x0), 0, 0, {0, 0}, 0, 1, 0, 4, ... (0x330000), {0, 0}, 20480, ) == 0x0
 00573   896   NtUnmapViewOfSection  (-1, 0x330000, ... ) == 0x0
 00574   896   NtOpenProcess  (0x2a, {24, 0, 0x0, 0, 0, 0x0}, {160, 0}, ... 80, ) == 0x0
 00575   896   NtOpenSection  (0xe, {24, 0, 0x40, 0, 0,  (0xe, {24, 0, 0x40, 0, 0, "\BaseNamedObjects\VtSect"}, ... 84, ) }, ... 84, ) == 0x0
 00576   896   NtMapViewOfSection  (84, 80, (0x0), 0, 29480, 0x0, 29480, 2, 1048576, 64, ... (0x7ffa0000), 0x0, 32768, ) == 0x0
 00577   896   NtClose  (84, ... ) == 0x0
 00578   896   NtProtectVirtualMemory  (80, (0x7c90d682), 5, 64, ... (0x7c90d000), 4096, 32, ) == 0x0
 00579   896   NtWriteVirtualMemory  (80, 0x7c90d682,  (80, 0x7c90d682, "\350\217Ri\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00580   896   NtProtectVirtualMemory  (80, (0x7c90dcfd), 5, 64, ... (0x7c90d000), 4096, 64, ) == 0x0
 00581   896   NtWriteVirtualMemory  (80, 0x7c90dcfd,  (80, 0x7c90dcfd, "\350aLi\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00582   896   NtProtectVirtualMemory  (80, (0x7c90d754), 5, 64, ... (0x7c90d000), 4096, 64, ) == 0x0
 00583   896   NtWriteVirtualMemory  (80, 0x7c90d754,  (80, 0x7c90d754, "\350\21Ri\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00584   896   NtProtectVirtualMemory  (80, (0x7c90d769), 5, 64, ... (0x7c90d000), 4096, 64, ) == 0x0
 00585   896   NtWriteVirtualMemory  (80, 0x7c90d769,  (80, 0x7c90d769, "\350\11Ri\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00586   896   NtClose  (80, ... ) == 0x0
 00587   896   NtMapViewOfSection  (36, -1, (0x0), 0, 0, {0, 0}, 0, 1, 0, 4, ... (0x330000), {0, 0}, 20480, ) == 0x0
 00588   896   NtUnmapViewOfSection  (-1, 0x330000, ... ) == 0x0
 00589   896   NtOpenProcess  (0x2a, {24, 0, 0x0, 0, 0, 0x0}, {260, 0}, ... 80, ) == 0x0
 00590   896   NtOpenSection  (0xe, {24, 0, 0x40, 0, 0,  (0xe, {24, 0, 0x40, 0, 0, "\BaseNamedObjects\VtSect"}, ... 84, ) }, ... 84, ) == 0x0
 00591   896   NtMapViewOfSection  (84, 80, (0x0), 0, 29480, 0x0, 29480, 2, 1048576, 64, ... (0x7ffa0000), 0x0, 32768, ) == 0x0
 00592   896   NtClose  (84, ... ) == 0x0
 00593   896   NtProtectVirtualMemory  (80, (0x7c90d682), 5, 64, ... (0x7c90d000), 4096, 32, ) == 0x0
 00594   896   NtWriteVirtualMemory  (80, 0x7c90d682,  (80, 0x7c90d682, "\350\217Ri\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00595   896   NtProtectVirtualMemory  (80, (0x7c90dcfd), 5, 64, ... (0x7c90d000), 4096, 64, ) == 0x0
 00596   896   NtWriteVirtualMemory  (80, 0x7c90dcfd,  (80, 0x7c90dcfd, "\350aLi\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00597   896   NtProtectVirtualMemory  (80, (0x7c90d754), 5, 64, ... (0x7c90d000), 4096, 64, ) == 0x0
 00598   896   NtWriteVirtualMemory  (80, 0x7c90d754,  (80, 0x7c90d754, "\350\21Ri\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00599   896   NtProtectVirtualMemory  (80, (0x7c90d769), 5, 64, ... (0x7c90d000), 4096, 64, ) == 0x0
 00600   896   NtWriteVirtualMemory  (80, 0x7c90d769,  (80, 0x7c90d769, "\350\11Ri\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00601   896   NtClose  (80, ... ) == 0x0
 00602   896   NtMapViewOfSection  (36, -1, (0x0), 0, 0, {0, 0}, 0, 1, 0, 4, ... (0x330000), {0, 0}, 20480, ) == 0x0
 00603   896   NtUnmapViewOfSection  (-1, 0x330000, ... ) == 0x0
 00604   896   NtOpenProcess  (0x2a, {24, 0, 0x0, 0, 0, 0x0}, {288, 0}, ... 80, ) == 0x0
 00605   896   NtOpenSection  (0xe, {24, 0, 0x40, 0, 0,  (0xe, {24, 0, 0x40, 0, 0, "\BaseNamedObjects\VtSect"}, ... 84, ) }, ... 84, ) == 0x0
 00606   896   NtMapViewOfSection  (84, 80, (0x0), 0, 29480, 0x0, 29480, 2, 1048576, 64, ... (0x7ffa0000), 0x0, 32768, ) == 0x0
 00607   896   NtClose  (84, ... ) == 0x0
 00608   896   NtProtectVirtualMemory  (80, (0x7c90d682), 5, 64, ... (0x7c90d000), 4096, 32, ) == 0x0
 00609   896   NtWriteVirtualMemory  (80, 0x7c90d682,  (80, 0x7c90d682, "\350\217Ri\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00610   896   NtProtectVirtualMemory  (80, (0x7c90dcfd), 5, 64, ... (0x7c90d000), 4096, 64, ) == 0x0
 00611   896   NtWriteVirtualMemory  (80, 0x7c90dcfd,  (80, 0x7c90dcfd, "\350aLi\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00612   896   NtProtectVirtualMemory  (80, (0x7c90d754), 5, 64, ... (0x7c90d000), 4096, 64, ) == 0x0
 00613   896   NtWriteVirtualMemory  (80, 0x7c90d754,  (80, 0x7c90d754, "\350\21Ri\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00614   896   NtProtectVirtualMemory  (80, (0x7c90d769), 5, 64, ... (0x7c90d000), 4096, 64, ) == 0x0
 00615   896   NtWriteVirtualMemory  (80, 0x7c90d769,  (80, 0x7c90d769, "\350\11Ri\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00616   896   NtClose  (80, ... ) == 0x0
 00617   896   NtMapViewOfSection  (36, -1, (0x0), 0, 0, {0, 0}, 0, 1, 0, 4, ... (0x330000), {0, 0}, 20480, ) == 0x0
 00618   896   NtUnmapViewOfSection  (-1, 0x330000, ... ) == 0x0
 00619   896   NtOpenProcess  (0x2a, {24, 0, 0x0, 0, 0, 0x0}, {412, 0}, ... 80, ) == 0x0
 00620   896   NtOpenSection  (0xe, {24, 0, 0x40, 0, 0,  (0xe, {24, 0, 0x40, 0, 0, "\BaseNamedObjects\VtSect"}, ... 84, ) }, ... 84, ) == 0x0
 00621   896   NtMapViewOfSection  (84, 80, (0x0), 0, 29480, 0x0, 29480, 2, 1048576, 64, ... (0x7ffa0000), 0x0, 32768, ) == 0x0
 00622   896   NtClose  (84, ... ) == 0x0
 00623   896   NtProtectVirtualMemory  (80, (0x7c90d682), 5, 64, ... (0x7c90d000), 4096, 32, ) == 0x0
 00624   896   NtWriteVirtualMemory  (80, 0x7c90d682,  (80, 0x7c90d682, "\350\217Ri\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00625   896   NtProtectVirtualMemory  (80, (0x7c90dcfd), 5, 64, ... (0x7c90d000), 4096, 64, ) == 0x0
 00626   896   NtWriteVirtualMemory  (80, 0x7c90dcfd,  (80, 0x7c90dcfd, "\350aLi\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00627   896   NtProtectVirtualMemory  (80, (0x7c90d754), 5, 64, ... (0x7c90d000), 4096, 64, ) == 0x0
 00628   896   NtWriteVirtualMemory  (80, 0x7c90d754,  (80, 0x7c90d754, "\350\21Ri\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00629   896   NtProtectVirtualMemory  (80, (0x7c90d769), 5, 64, ... (0x7c90d000), 4096, 64, ) == 0x0
 00630   896   NtWriteVirtualMemory  (80, 0x7c90d769,  (80, 0x7c90d769, "\350\11Ri\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00631   896   NtClose  (80, ... ) == 0x0
 00632   896   NtMapViewOfSection  (36, -1, (0x0), 0, 0, {0, 0}, 0, 1, 0, 4, ... (0x330000), {0, 0}, 20480, ) == 0x0
 00633   896   NtUnmapViewOfSection  (-1, 0x330000, ... ) == 0x0
 00634   896   NtOpenProcess  (0x2a, {24, 0, 0x0, 0, 0, 0x0}, {1408, 0}, ... 80, ) == 0x0
 00635   896   NtOpenSection  (0xe, {24, 0, 0x40, 0, 0,  (0xe, {24, 0, 0x40, 0, 0, "\BaseNamedObjects\VtSect"}, ... 84, ) }, ... 84, ) == 0x0
 00636   896   NtMapViewOfSection  (84, 80, (0x0), 0, 29480, 0x0, 29480, 2, 1048576, 64, ... (0x7ffa0000), 0x0, 32768, ) == 0x0
 00637   896   NtClose  (84, ... ) == 0x0
 00638   896   NtProtectVirtualMemory  (80, (0x7c90d682), 5, 64, ... (0x7c90d000), 4096, 32, ) == 0x0
 00639   896   NtWriteVirtualMemory  (80, 0x7c90d682,  (80, 0x7c90d682, "\350\217Ri\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00640   896   NtProtectVirtualMemory  (80, (0x7c90dcfd), 5, 64, ... (0x7c90d000), 4096, 64, ) == 0x0
 00641   896   NtWriteVirtualMemory  (80, 0x7c90dcfd,  (80, 0x7c90dcfd, "\350aLi\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00642   896   NtProtectVirtualMemory  (80, (0x7c90d754), 5, 64, ... (0x7c90d000), 4096, 64, ) == 0x0
 00643   896   NtWriteVirtualMemory  (80, 0x7c90d754,  (80, 0x7c90d754, "\350\21Ri\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00644   896   NtProtectVirtualMemory  (80, (0x7c90d769), 5, 64, ... (0x7c90d000), 4096, 64, ) == 0x0
 00645   896   NtWriteVirtualMemory  (80, 0x7c90d769,  (80, 0x7c90d769, "\350\11Ri\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00646   896   NtClose  (80, ... ) == 0x0
 00647   896   NtMapViewOfSection  (36, -1, (0x0), 0, 0, {0, 0}, 0, 1, 0, 4, ... (0x330000), {0, 0}, 20480, ) == 0x0
 00648   896   NtUnmapViewOfSection  (-1, 0x330000, ... ) == 0x0
 00649   896   NtOpenProcess  (0x2a, {24, 0, 0x0, 0, 0, 0x0}, {556, 0}, ... 80, ) == 0x0
 00650   896   NtOpenSection  (0xe, {24, 0, 0x40, 0, 0,  (0xe, {24, 0, 0x40, 0, 0, "\BaseNamedObjects\VtSect"}, ... 84, ) }, ... 84, ) == 0x0
 00651   896   NtMapViewOfSection  (84, 80, (0x0), 0, 29480, 0x0, 29480, 2, 1048576, 64, ... (0x7ffa0000), 0x0, 32768, ) == 0x0
 00652   896   NtClose  (84, ... ) == 0x0
 00653   896   NtProtectVirtualMemory  (80, (0x7c90d682), 5, 64, ... (0x7c90d000), 4096, 32, ) == 0x0
 00654   896   NtWriteVirtualMemory  (80, 0x7c90d682,  (80, 0x7c90d682, "\350\217Ri\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00655   896   NtProtectVirtualMemory  (80, (0x7c90dcfd), 5, 64, ... (0x7c90d000), 4096, 64, ) == 0x0
 00656   896   NtWriteVirtualMemory  (80, 0x7c90dcfd,  (80, 0x7c90dcfd, "\350aLi\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00657   896   NtProtectVirtualMemory  (80, (0x7c90d754), 5, 64, ... (0x7c90d000), 4096, 64, ) == 0x0
 00658   896   NtWriteVirtualMemory  (80, 0x7c90d754,  (80, 0x7c90d754, "\350\21Ri\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00659   896   NtProtectVirtualMemory  (80, (0x7c90d769), 5, 64, ... (0x7c90d000), 4096, 64, ) == 0x0
 00660   896   NtWriteVirtualMemory  (80, 0x7c90d769,  (80, 0x7c90d769, "\350\11Ri\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00661   896   NtClose  (80, ... ) == 0x0
 00662   896   NtMapViewOfSection  (36, -1, (0x0), 0, 0, {0, 0}, 0, 1, 0, 4, ... (0x330000), {0, 0}, 20480, ) == 0x0
 00663   896   NtUnmapViewOfSection  (-1, 0x330000, ... ) == 0x0
 00664   896   NtOpenProcess  (0x2a, {24, 0, 0x0, 0, 0, 0x0}, {1204, 0}, ... 80, ) == 0x0
 00665   896   NtOpenSection  (0xe, {24, 0, 0x40, 0, 0,  (0xe, {24, 0, 0x40, 0, 0, "\BaseNamedObjects\VtSect"}, ... 84, ) }, ... 84, ) == 0x0
 00666   896   NtMapViewOfSection  (84, 80, (0x0), 0, 29480, 0x0, 29480, 2, 1048576, 64, ... (0x7ffa0000), 0x0, 32768, ) == 0x0
 00667   896   NtClose  (84, ... ) == 0x0
 00668   896   NtProtectVirtualMemory  (80, (0x7c90d682), 5, 64, ... (0x7c90d000), 4096, 32, ) == 0x0
 00669   896   NtWriteVirtualMemory  (80, 0x7c90d682,  (80, 0x7c90d682, "\350\217Ri\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00670   896   NtProtectVirtualMemory  (80, (0x7c90dcfd), 5, 64, ... (0x7c90d000), 4096, 64, ) == 0x0
 00671   896   NtWriteVirtualMemory  (80, 0x7c90dcfd,  (80, 0x7c90dcfd, "\350aLi\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00672   896   NtProtectVirtualMemory  (80, (0x7c90d754), 5, 64, ... (0x7c90d000), 4096, 64, ) == 0x0
 00673   896   NtWriteVirtualMemory  (80, 0x7c90d754,  (80, 0x7c90d754, "\350\21Ri\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00674   896   NtProtectVirtualMemory  (80, (0x7c90d769), 5, 64, ... (0x7c90d000), 4096, 64, ) == 0x0
 00675   896   NtWriteVirtualMemory  (80, 0x7c90d769,  (80, 0x7c90d769, "\350\11Ri\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00676   896   NtClose  (80, ... ) == 0x0
 00677   896   NtMapViewOfSection  (36, -1, (0x0), 0, 0, {0, 0}, 0, 1, 0, 4, ... (0x330000), {0, 0}, 20480, ) == 0x0
 00678   896   NtUnmapViewOfSection  (-1, 0x330000, ... ) == 0x0
 00679   896   NtOpenProcess  (0x2a, {24, 0, 0x0, 0, 0, 0x0}, {1452, 0}, ... 80, ) == 0x0
 00680   896   NtOpenSection  (0xe, {24, 0, 0x40, 0, 0,  (0xe, {24, 0, 0x40, 0, 0, "\BaseNamedObjects\VtSect"}, ... 84, ) }, ... 84, ) == 0x0
 00681   896   NtMapViewOfSection  (84, 80, (0x0), 0, 29480, 0x0, 29480, 2, 1048576, 64, ... (0x7ffa0000), 0x0, 32768, ) == 0x0
 00682   896   NtClose  (84, ... ) == 0x0
 00683   896   NtProtectVirtualMemory  (80, (0x7c90d682), 5, 64, ... (0x7c90d000), 4096, 32, ) == 0x0
 00684   896   NtWriteVirtualMemory  (80, 0x7c90d682,  (80, 0x7c90d682, "\350\217Ri\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00685   896   NtProtectVirtualMemory  (80, (0x7c90dcfd), 5, 64, ... (0x7c90d000), 4096, 64, ) == 0x0
 00686   896   NtWriteVirtualMemory  (80, 0x7c90dcfd,  (80, 0x7c90dcfd, "\350aLi\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00687   896   NtProtectVirtualMemory  (80, (0x7c90d754), 5, 64, ... (0x7c90d000), 4096, 64, ) == 0x0
 00688   896   NtWriteVirtualMemory  (80, 0x7c90d754,  (80, 0x7c90d754, "\350\21Ri\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00689   896   NtProtectVirtualMemory  (80, (0x7c90d769), 5, 64, ... (0x7c90d000), 4096, 64, ) == 0x0
 00690   896   NtWriteVirtualMemory  (80, 0x7c90d769,  (80, 0x7c90d769, "\350\11Ri\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00691   896   NtClose  (80, ... ) == 0x0
 00692   896   NtMapViewOfSection  (36, -1, (0x0), 0, 0, {0, 0}, 0, 1, 0, 4, ... (0x330000), {0, 0}, 20480, ) == 0x0
 00693   896   NtUnmapViewOfSection  (-1, 0x330000, ... ) == 0x0
 00694   896   NtOpenProcess  (0x2a, {24, 0, 0x0, 0, 0, 0x0}, {784, 0}, ... 80, ) == 0x0
 00695   896   NtOpenSection  (0xe, {24, 0, 0x40, 0, 0,  (0xe, {24, 0, 0x40, 0, 0, "\BaseNamedObjects\VtSect"}, ... 84, ) }, ... 84, ) == 0x0
 00696   896   NtMapViewOfSection  (84, 80, (0x0), 0, 29480, 0x0, 29480, 2, 1048576, 64, ... (0x7ffa0000), 0x0, 32768, ) == 0x0
 00697   896   NtClose  (84, ... ) == 0x0
 00698   896   NtProtectVirtualMemory  (80, (0x7c90d682), 5, 64, ... (0x7c90d000), 4096, 32, ) == 0x0
 00699   896   NtWriteVirtualMemory  (80, 0x7c90d682,  (80, 0x7c90d682, "\350\217Ri\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00700   896   NtProtectVirtualMemory  (80, (0x7c90dcfd), 5, 64, ... (0x7c90d000), 4096, 64, ) == 0x0
 00701   896   NtWriteVirtualMemory  (80, 0x7c90dcfd,  (80, 0x7c90dcfd, "\350aLi\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00702   896   NtProtectVirtualMemory  (80, (0x7c90d754), 5, 64, ... (0x7c90d000), 4096, 64, ) == 0x0
 00703   896   NtWriteVirtualMemory  (80, 0x7c90d754,  (80, 0x7c90d754, "\350\21Ri\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00704   896   NtProtectVirtualMemory  (80, (0x7c90d769), 5, 64, ... (0x7c90d000), 4096, 64, ) == 0x0
 00705   896   NtWriteVirtualMemory  (80, 0x7c90d769,  (80, 0x7c90d769, "\350\11Ri\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00706   896   NtClose  (80, ... ) == 0x0
 00707   896   NtMapViewOfSection  (36, -1, (0x0), 0, 0, {0, 0}, 0, 1, 0, 4, ... (0x330000), {0, 0}, 20480, ) == 0x0
 00708   896   NtUnmapViewOfSection  (-1, 0x330000, ... ) == 0x0
 00709   896   NtOpenProcess  (0x2a, {24, 0, 0x0, 0, 0, 0x0}, {488, 0}, ... 80, ) == 0x0
 00710   896   NtOpenSection  (0xe, {24, 0, 0x40, 0, 0,  (0xe, {24, 0, 0x40, 0, 0, "\BaseNamedObjects\VtSect"}, ... 84, ) }, ... 84, ) == 0x0
 00711   896   NtMapViewOfSection  (84, 80, (0x0), 0, 29480, 0x0, 29480, 2, 1048576, 64, ... (0x7ffa0000), 0x0, 32768, ) == 0x0
 00712   896   NtClose  (84, ... ) == 0x0
 00713   896   NtProtectVirtualMemory  (80, (0x7c90d682), 5, 64, ... (0x7c90d000), 4096, 32, ) == 0x0
 00714   896   NtWriteVirtualMemory  (80, 0x7c90d682,  (80, 0x7c90d682, "\350\217Ri\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00715   896   NtProtectVirtualMemory  (80, (0x7c90dcfd), 5, 64, ... (0x7c90d000), 4096, 64, ) == 0x0
 00716   896   NtWriteVirtualMemory  (80, 0x7c90dcfd,  (80, 0x7c90dcfd, "\350aLi\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00717   896   NtProtectVirtualMemory  (80, (0x7c90d754), 5, 64, ... (0x7c90d000), 4096, 64, ) == 0x0
 00718   896   NtWriteVirtualMemory  (80, 0x7c90d754,  (80, 0x7c90d754, "\350\21Ri\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00719   896   NtProtectVirtualMemory  (80, (0x7c90d769), 5, 64, ... (0x7c90d000), 4096, 64, ) == 0x0
 00720   896   NtWriteVirtualMemory  (80, 0x7c90d769,  (80, 0x7c90d769, "\350\11Ri\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00721   896   NtClose  (80, ... ) == 0x0
 00722   896   NtMapViewOfSection  (36, -1, (0x0), 0, 0, {0, 0}, 0, 1, 0, 4, ... (0x330000), {0, 0}, 20480, ) == 0x0
 00723   896   NtUnmapViewOfSection  (-1, 0x330000, ... ) == 0x0
 00724   896   NtOpenProcess  (0x2a, {24, 0, 0x0, 0, 0, 0x0}, {1208, 0}, ... 80, ) == 0x0
 00725   896   NtOpenSection  (0xe, {24, 0, 0x40, 0, 0,  (0xe, {24, 0, 0x40, 0, 0, "\BaseNamedObjects\VtSect"}, ... 84, ) }, ... 84, ) == 0x0
 00726   896   NtMapViewOfSection  (84, 80, (0x0), 0, 29480, 0x0, 29480, 2, 1048576, 64, ... (0x7ffa0000), 0x0, 32768, ) == 0x0
 00727   896   NtClose  (84, ... ) == 0x0
 00728   896   NtProtectVirtualMemory  (80, (0x7c90d682), 5, 64, ... (0x7c90d000), 4096, 32, ) == 0x0
 00729   896   NtWriteVirtualMemory  (80, 0x7c90d682,  (80, 0x7c90d682, "\350\217Ri\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00730   896   NtProtectVirtualMemory  (80, (0x7c90dcfd), 5, 64, ... (0x7c90d000), 4096, 64, ) == 0x0
 00731   896   NtWriteVirtualMemory  (80, 0x7c90dcfd,  (80, 0x7c90dcfd, "\350aLi\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00732   896   NtProtectVirtualMemory  (80, (0x7c90d754), 5, 64, ... (0x7c90d000), 4096, 64, ) == 0x0
 00733   896   NtWriteVirtualMemory  (80, 0x7c90d754,  (80, 0x7c90d754, "\350\21Ri\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00734   896   NtProtectVirtualMemory  (80, (0x7c90d769), 5, 64, ... (0x7c90d000), 4096, 64, ) == 0x0
 00735   896   NtWriteVirtualMemory  (80, 0x7c90d769,  (80, 0x7c90d769, "\350\11Ri\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00736   896   NtClose  (80, ... ) == 0x0
 00737   896   NtMapViewOfSection  (36, -1, (0x0), 0, 0, {0, 0}, 0, 1, 0, 4, ... (0x330000), {0, 0}, 20480, ) == 0x0
 00738   896   NtUnmapViewOfSection  (-1, 0x330000, ... ) == 0x0
 00739   896   NtOpenProcess  (0x2a, {24, 0, 0x0, 0, 0, 0x0}, {168, 0}, ... 80, ) == 0x0
 00740   896   NtOpenSection  (0xe, {24, 0, 0x40, 0, 0,  (0xe, {24, 0, 0x40, 0, 0, "\BaseNamedObjects\VtSect"}, ... 84, ) }, ... 84, ) == 0x0
 00741   896   NtMapViewOfSection  (84, 80, (0x0), 0, 29480, 0x0, 29480, 2, 1048576, 64, ... (0x7ffa0000), 0x0, 32768, ) == 0x0
 00742   896   NtClose  (84, ... ) == 0x0
 00743   896   NtProtectVirtualMemory  (80, (0x7c90d682), 5, 64, ... (0x7c90d000), 4096, 32, ) == 0x0
 00744   896   NtWriteVirtualMemory  (80, 0x7c90d682,  (80, 0x7c90d682, "\350\217Ri\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00745   896   NtProtectVirtualMemory  (80, (0x7c90dcfd), 5, 64, ... (0x7c90d000), 4096, 64, ) == 0x0
 00746   896   NtWriteVirtualMemory  (80, 0x7c90dcfd,  (80, 0x7c90dcfd, "\350aLi\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00747   896   NtProtectVirtualMemory  (80, (0x7c90d754), 5, 64, ... (0x7c90d000), 4096, 64, ) == 0x0
 00748   896   NtWriteVirtualMemory  (80, 0x7c90d754,  (80, 0x7c90d754, "\350\21Ri\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00749   896   NtProtectVirtualMemory  (80, (0x7c90d769), 5, 64, ... (0x7c90d000), 4096, 64, ) == 0x0
 00750   896   NtWriteVirtualMemory  (80, 0x7c90d769,  (80, 0x7c90d769, "\350\11Ri\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00751   896   NtClose  (80, ... ) == 0x0
 00752   896   NtMapViewOfSection  (36, -1, (0x0), 0, 0, {0, 0}, 0, 1, 0, 4, ... (0x330000), {0, 0}, 20480, ) == 0x0
 00753   896   NtUnmapViewOfSection  (-1, 0x330000, ... ) == 0x0
 00754   896   NtOpenProcess  (0x2a, {24, 0, 0x0, 0, 0, 0x0}, {764, 0}, ... 80, ) == 0x0
 00755   896   NtOpenSection  (0xe, {24, 0, 0x40, 0, 0,  (0xe, {24, 0, 0x40, 0, 0, "\BaseNamedObjects\VtSect"}, ... 84, ) }, ... 84, ) == 0x0
 00756   896   NtMapViewOfSection  (84, 80, (0x0), 0, 29480, 0x0, 29480, 2, 1048576, 64, ... (0x7ffa0000), 0x0, 32768, ) == 0x0
 00757   896   NtClose  (84, ... ) == 0x0
 00758   896   NtProtectVirtualMemory  (80, (0x7c90d682), 5, 64, ... (0x7c90d000), 4096, 32, ) == 0x0
 00759   896   NtWriteVirtualMemory  (80, 0x7c90d682,  (80, 0x7c90d682, "\350\217Ri\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00760   896   NtProtectVirtualMemory  (80, (0x7c90dcfd), 5, 64, ... (0x7c90d000), 4096, 64, ) == 0x0
 00761   896   NtWriteVirtualMemory  (80, 0x7c90dcfd,  (80, 0x7c90dcfd, "\350aLi\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00762   896   NtProtectVirtualMemory  (80, (0x7c90d754), 5, 64, ... (0x7c90d000), 4096, 64, ) == 0x0
 00763   896   NtWriteVirtualMemory  (80, 0x7c90d754,  (80, 0x7c90d754, "\350\21Ri\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00764   896   NtProtectVirtualMemory  (80, (0x7c90d769), 5, 64, ... (0x7c90d000), 4096, 64, ) == 0x0
 00765   896   NtWriteVirtualMemory  (80, 0x7c90d769,  (80, 0x7c90d769, "\350\11Ri\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00766   896   NtClose  (80, ... ) == 0x0
 00767   896   NtMapViewOfSection  (36, -1, (0x0), 0, 0, {0, 0}, 0, 1, 0, 4, ... (0x330000), {0, 0}, 20480, ) == 0x0
 00768   896   NtUnmapViewOfSection  (-1, 0x330000, ... ) == 0x0
 00769   896   NtOpenProcess  (0x2a, {24, 0, 0x0, 0, 0, 0x0}, {868, 0}, ... 80, ) == 0x0
 00770   896   NtOpenSection  (0xe, {24, 0, 0x40, 0, 0,  (0xe, {24, 0, 0x40, 0, 0, "\BaseNamedObjects\VtSect"}, ... 84, ) }, ... 84, ) == 0x0
 00771   896   NtMapViewOfSection  (84, 80, (0x0), 0, 29480, 0x0, 29480, 2, 1048576, 64, ... (0x7ffa0000), 0x0, 32768, ) == 0x0
 00772   896   NtClose  (84, ... ) == 0x0
 00773   896   NtProtectVirtualMemory  (80, (0x7c90d682), 5, 64, ... (0x7c90d000), 4096, 32, ) == 0x0
 00774   896   NtWriteVirtualMemory  (80, 0x7c90d682,  (80, 0x7c90d682, "\350\217Ri\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00775   896   NtProtectVirtualMemory  (80, (0x7c90dcfd), 5, 64, ... (0x7c90d000), 4096, 64, ) == 0x0
 00776   896   NtWriteVirtualMemory  (80, 0x7c90dcfd,  (80, 0x7c90dcfd, "\350aLi\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00777   896   NtProtectVirtualMemory  (80, (0x7c90d754), 5, 64, ... (0x7c90d000), 4096, 64, ) == 0x0
 00778   896   NtWriteVirtualMemory  (80, 0x7c90d754,  (80, 0x7c90d754, "\350\21Ri\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00779   896   NtProtectVirtualMemory  (80, (0x7c90d769), 5, 64, ... (0x7c90d000), 4096, 64, ) == 0x0
 00780   896   NtWriteVirtualMemory  (80, 0x7c90d769,  (80, 0x7c90d769, "\350\11Ri\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00781   896   NtClose  (80, ... ) == 0x0
 00782   896   NtMapViewOfSection  (36, -1, (0x0), 0, 0, {0, 0}, 0, 1, 0, 4, ... (0x330000), {0, 0}, 20480, ) == 0x0
 00783   896   NtUnmapViewOfSection  (-1, 0x330000, ... ) == 0x0
 00784   896   NtOpenProcess  (0x2a, {24, 0, 0x0, 0, 0, 0x0}, {808, 0}, ... 80, ) == 0x0
 00785   896   NtOpenSection  (0xe, {24, 0, 0x40, 0, 0,  (0xe, {24, 0, 0x40, 0, 0, "\BaseNamedObjects\VtSect"}, ... 84, ) }, ... 84, ) == 0x0
 00786   896   NtMapViewOfSection  (84, 80, (0x0), 0, 29480, 0x0, 29480, 2, 1048576, 64, ... (0x7ffa0000), 0x0, 32768, ) == 0x0
 00787   896   NtClose  (84, ... ) == 0x0
 00788   896   NtProtectVirtualMemory  (80, (0x7c90d682), 5, 64, ... (0x7c90d000), 4096, 32, ) == 0x0
 00789   896   NtWriteVirtualMemory  (80, 0x7c90d682,  (80, 0x7c90d682, "\350\217Ri\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00790   896   NtProtectVirtualMemory  (80, (0x7c90dcfd), 5, 64, ... (0x7c90d000), 4096, 64, ) == 0x0
 00791   896   NtWriteVirtualMemory  (80, 0x7c90dcfd,  (80, 0x7c90dcfd, "\350aLi\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00792   896   NtProtectVirtualMemory  (80, (0x7c90d754), 5, 64, ... (0x7c90d000), 4096, 64, ) == 0x0
 00793   896   NtWriteVirtualMemory  (80, 0x7c90d754,  (80, 0x7c90d754, "\350\21Ri\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00794   896   NtProtectVirtualMemory  (80, (0x7c90d769), 5, 64, ... (0x7c90d000), 4096, 64, ) == 0x0
 00795   896   NtWriteVirtualMemory  (80, 0x7c90d769,  (80, 0x7c90d769, "\350\11Ri\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00796   896   NtClose  (80, ... ) == 0x0
 00797   896   NtMapViewOfSection  (36, -1, (0x0), 0, 0, {0, 0}, 0, 1, 0, 4, ... (0x330000), {0, 0}, 20480, ) == 0x0
 00798   896   NtUnmapViewOfSection  (-1, 0x330000, ... ) == 0x0
 00799   896   NtOpenProcess  (0x2a, {24, 0, 0x0, 0, 0, 0x0}, {1252, 0}, ... 80, ) == 0x0
 00800   896   NtOpenSection  (0xe, {24, 0, 0x40, 0, 0,  (0xe, {24, 0, 0x40, 0, 0, "\BaseNamedObjects\VtSect"}, ... 84, ) }, ... 84, ) == 0x0
 00801   896   NtMapViewOfSection  (84, 80, (0x0), 0, 29480, 0x0, 29480, 2, 1048576, 64, ... (0x7ffa0000), 0x0, 32768, ) == 0x0
 00802   896   NtClose  (84, ... ) == 0x0
 00803   896   NtProtectVirtualMemory  (80, (0x7c90d682), 5, 64, ... (0x7c90d000), 4096, 32, ) == 0x0
 00804   896   NtWriteVirtualMemory  (80, 0x7c90d682,  (80, 0x7c90d682, "\350\217Ri\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00805   896   NtProtectVirtualMemory  (80, (0x7c90dcfd), 5, 64, ... (0x7c90d000), 4096, 64, ) == 0x0
 00806   896   NtWriteVirtualMemory  (80, 0x7c90dcfd,  (80, 0x7c90dcfd, "\350aLi\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00807   896   NtProtectVirtualMemory  (80, (0x7c90d754), 5, 64, ... (0x7c90d000), 4096, 64, ) == 0x0
 00808   896   NtWriteVirtualMemory  (80, 0x7c90d754,  (80, 0x7c90d754, "\350\21Ri\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00809   896   NtProtectVirtualMemory  (80, (0x7c90d769), 5, 64, ... (0x7c90d000), 4096, 64, ) == 0x0
 00810   896   NtWriteVirtualMemory  (80, 0x7c90d769,  (80, 0x7c90d769, "\350\11Ri\3", 5, ... 0x0, ) , 5, ... 0x0, ) == 0x0
 00811   896   NtClose  (80, ... ) == 0x0
 00812   896   NtMapViewOfSection  (36, -1, (0x0), 0, 0, {0, 0}, 0, 1, 0, 4, ... (0x330000), {0, 0}, 20480, ) == 0x0
 00813   896   NtUnmapViewOfSection  (-1, 0x330000, ... ) == 0x0
 00814   896   NtClose  (36, ... ) == 0x0
 00815   896   NtClose  (28, ... ) == 0x0
 00816   896   NtQueryVirtualMemory  (-1, 0x40980f, Basic, 28, ... {BaseAddress=0x409000,AllocationBase=0x400000,AllocationProtect=0x80,RegionSize=0x1000,State=0x1000,Protect=0x40,Type=0x1000000,}, 28, ) == 0x0
 00817   896   NtContinue  (1244400, 0, ...
 00818   896   NtAllocateVirtualMemory  (-1, 0, 0, 2395, 4096, 64, ... 3342336, 4096, ) == 0x0
 00819   896   NtOpenSection  (0xe, {24, 8, 0x40, 0, 0,  (0xe, {24, 8, 0x40, 0, 0, "user32.dll"}, ... 28, ) }, ... 28, ) == 0x0
 00820   896   NtMapViewOfSection  (28, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x7e410000), 0x0, 589824, ) == 0x0
 00821   896   NtClose  (28, ... ) == 0x0
 00822   896   NtOpenSection  (0xe, {24, 8, 0x40, 0, 0,  (0xe, {24, 8, 0x40, 0, 0, "GDI32.dll"}, ... 28, ) }, ... 28, ) == 0x0
 00823   896   NtMapViewOfSection  (28, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x77f10000), 0x0, 290816, ) == 0x0
 00824   896   NtClose  (28, ... ) == 0x0
 00825   896   NtProtectVirtualMemory  (-1, (0x77f11000), 508, 4, ... (0x77f11000), 4096, 32, ) == 0x0
 00826   896   NtProtectVirtualMemory  (-1, (0x77f11000), 4096, 32, ... (0x77f11000), 4096, 4, ) == 0x0
 00827   896   NtFlushInstructionCache  (-1, 2012286976, 508, ... ) == 0x0
 00828   896   NtProtectVirtualMemory  (-1, (0x77f11000), 508, 4, ... (0x77f11000), 4096, 32, ) == 0x0
 00829   896   NtProtectVirtualMemory  (-1, (0x77f11000), 4096, 32, ... (0x77f11000), 4096, 4, ) == 0x0
 00830   896   NtFlushInstructionCache  (-1, 2012286976, 508, ... ) == 0x0
 00831   896   NtProtectVirtualMemory  (-1, (0x77f11000), 508, 4, ... (0x77f11000), 4096, 32, ) == 0x0
 00832   896   NtProtectVirtualMemory  (-1, (0x77f11000), 4096, 32, ... (0x77f11000), 4096, 4, ) == 0x0
 00833   896   NtFlushInstructionCache  (-1, 2012286976, 508, ... ) == 0x0
 00834   896   NtProtectVirtualMemory  (-1, (0x7e411000), 1252, 4, ... (0x7e411000), 4096, 32, ) == 0x0
 00835   896   NtProtectVirtualMemory  (-1, (0x7e411000), 4096, 32, ... (0x7e411000), 4096, 4, ) == 0x0
 00836   896   NtFlushInstructionCache  (-1, 2118193152, 1252, ... ) == 0x0
 00837   896   NtProtectVirtualMemory  (-1, (0x7e411000), 1252, 4, ... (0x7e411000), 4096, 32, ) == 0x0
 00838   896   NtProtectVirtualMemory  (-1, (0x7e411000), 4096, 32, ... (0x7e411000), 4096, 4, ) == 0x0
 00839   896   NtFlushInstructionCache  (-1, 2118193152, 1252, ... ) == 0x0
 00840   896   NtProtectVirtualMemory  (-1, (0x7e411000), 1252, 4, ... (0x7e411000), 4096, 32, ) == 0x0
 00841   896   NtProtectVirtualMemory  (-1, (0x7e411000), 4096, 32, ... (0x7e411000), 4096, 4, ) == 0x0
 00842   896   NtFlushInstructionCache  (-1, 2118193152, 1252, ... ) == 0x0
 00843   896   NtOpenKey  (0x80000000, {24, 0, 0x40, 0, 0,  (0x80000000, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\GDI32.dll"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00844   896   NtOpenKey  (0x80000000, {24, 0, 0x40, 0, 0,  (0x80000000, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\user32.dll"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00845   896   NtQuerySystemInformation  (Basic, 44, ... {Unknown=0,MaximumIncrement=156250,PhysicalPageSize=0x1000,NumberOfPhysicalPages=0xff7c,LowestPhysicalPage=0x1,HighestPhysicalPage=0xffff,AllocationGranularity=0x10000,LowestUserAddress=0x10000,HighestUserAddress=0x7ffeffff,ActiveProcessors=1,NumberProcessors=1,}, 0x0, ) == 0x0
 00846   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 2089900645, 0, 2090320576, 1241608}  (24, {28, 56, new_msg, 0, 2089900645, 0, 2090320576, 1241608} "\210\6!\1\0\0\0\0\344\0\23\0\4\0\0\0\3\0\0\0\234\6!\1$\1\0\0" ... {28, 56, reply, 0, 1252, 896, 81882, 0} "\320G\26\0\0\0\0\0\0\0\0\0\4\0\0\0\3\0\0\0\234\6!\1$\1\0\0" )  ... {28, 56, reply, 0, 1252, 896, 81882, 0}  (24, {28, 56, new_msg, 0, 2089900645, 0, 2090320576, 1241608} "\210\6!\1\0\0\0\0\344\0\23\0\4\0\0\0\3\0\0\0\234\6!\1$\1\0\0" ... {28, 56, reply, 0, 1252, 896, 81882, 0} "\320G\26\0\0\0\0\0\0\0\0\0\4\0\0\0\3\0\0\0\234\6!\1$\1\0\0" )  ) == 0x0
 00847   896   NtFsControlFile  (12, 0, 0x0, 0x0, 0x90028, 0x0, 0, 0, ... {status=0x0, info=0}, 0x0, ) == 0x0
 00848   896   NtAllocateVirtualMemory  (-1, 1335296, 0, 4096, 4096, 4, ... 1335296, 4096, ) == 0x0
 00849   896   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\IMM32.DLL"}, 1239000, ... ) }, 1239000, ... ) == 0x0
 00850   896   NtOpenFile  (0x100020, {24, 0, 0x40, 0, 0,  (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\IMM32.DLL"}, 5, 96, ... 28, {status=0x0, info=1}, ) }, 5, 96, ... 28, {status=0x0, info=1}, ) == 0x0
 00851   896   NtCreateSection  (0xe, 0x0, 0x0, 16, 134217728, 28, ... 36, ) == 0x0
 00852   896   NtClose  (28, ... ) == 0x0
 00853   896   NtMapViewOfSection  (36, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 16, ... (0x340000), 0x0, 110592, ) == 0x0
 00854   896   NtClose  (36, ... ) == 0x0
 00855   896   NtUnmapViewOfSection  (-1, 0x340000, ... ) == 0x0
 00856   896   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\IMM32.DLL"}, 1238908, ... ) }, 1238908, ... ) == 0x0
 00857   896   NtOpenFile  (0x100020, {24, 0, 0x40, 0, 0,  (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\IMM32.DLL"}, 5, 96, ... 36, {status=0x0, info=1}, ) }, 5, 96, ... 36, {status=0x0, info=1}, ) == 0x0
 00858   896   NtCreateSection  (0xe, 0x0, 0x0, 16, 134217728, 36, ... 28, ) == 0x0
 00859   896   NtClose  (36, ... ) == 0x0
 00860   896   NtMapViewOfSection  (28, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 16, ... (0x340000), 0x0, 110592, ) == 0x0
 00861   896   NtClose  (28, ... ) == 0x0
 00862   896   NtUnmapViewOfSection  (-1, 0x340000, ... ) == 0x0
 00863   896   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\IMM32.DLL"}, 1239216, ... ) }, 1239216, ... ) == 0x0
 00864   896   NtOpenFile  (0x100020, {24, 0, 0x40, 0, 0,  (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\IMM32.DLL"}, 5, 96, ... 28, {status=0x0, info=1}, ) }, 5, 96, ... 28, {status=0x0, info=1}, ) == 0x0
 00865   896   NtCreateSection  (0xf, 0x0, 0x0, 16, 16777216, 28, ... 36, ) == 0x0
 00866   896   NtQuerySection  (36, Image, 48, ... {section info, class 1, size 48}, 0x0, ) == 0x0
 00867   896   NtOpenProcessToken  (-1, 0x8, ... 80, ) == 0x0
 00868   896   NtQueryInformationToken  (80, User, 136, ... {token info, class 1, size 36}, 36, ) == 0x0
 00869   896   NtOpenKey  (0x3, {24, 0, 0x40, 0, 0,  (0x3, {24, 0, 0x40, 0, 0, "\Registry\MACHINE\System\CurrentControlSet\Control\SafeBoot\Option"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00870   896   NtOpenKey  (0x1, {24, 0, 0x40, 0, 0,  (0x1, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers"}, ... 84, ) }, ... 84, ) == 0x0
 00871   896   NtQueryValueKey  (84,  (84, "TransparentEnabled", Partial, 80, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) , Partial, 80, ... TitleIdx=0, Type=4, Data= (84, "TransparentEnabled", Partial, 80, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) }, 16, ) == 0x0
 00872   896   NtClose  (84, ... ) == 0x0
 00873   896   NtOpenThreadTokenEx  (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN
 00874   896   NtOpenProcessTokenEx  (-1, 0x20008, 512, ... 84, ) == 0x0
 00875   896   NtQueryInformationToken  (84, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0
 00876   896   NtClose  (84, ... ) == 0x0
 00877   896   NtOpenKey  (0x1, {24, 0, 0x40, 0, 0,  (0x1, {24, 0, 0x40, 0, 0, "\REGISTRY\USER\S-1-5-21-1292428093-1383384898-725345543-1003\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00878   896   NtClose  (80, ... ) == 0x0
 00879   896   NtClose  (28, ... ) == 0x0
 00880   896   NtMapViewOfSection  (36, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x76390000), 0x0, 118784, ) == 0x0
 00881   896   NtClose  (36, ... ) == 0x0
 00882   896   NtProtectVirtualMemory  (-1, (0x76391000), 696, 4, ... (0x76391000), 4096, 32, ) == 0x0
 00883   896   NtProtectVirtualMemory  (-1, (0x76391000), 4096, 32, ... (0x76391000), 4096, 4, ) == 0x0
 00884   896   NtFlushInstructionCache  (-1, 1983451136, 696, ... ) == 0x0
 00885   896   NtProtectVirtualMemory  (-1, (0x76391000), 696, 4, ... (0x76391000), 4096, 32, ) == 0x0
 00886   896   NtProtectVirtualMemory  (-1, (0x76391000), 4096, 32, ... (0x76391000), 4096, 4, ) == 0x0
 00887   896   NtFlushInstructionCache  (-1, 1983451136, 696, ... ) == 0x0
 00888   896   NtProtectVirtualMemory  (-1, (0x76391000), 696, 4, ... (0x76391000), 4096, 32, ) == 0x0
 00889   896   NtProtectVirtualMemory  (-1, (0x76391000), 4096, 32, ... (0x76391000), 4096, 4, ) == 0x0
 00890   896   NtFlushInstructionCache  (-1, 1983451136, 696, ... ) == 0x0
 00891   896   NtOpenKey  (0x80000000, {24, 0, 0x40, 0, 0,  (0x80000000, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\IMM32.DLL"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00892   896   NtQuerySystemInformation  (Basic, 44, ... {Unknown=0,MaximumIncrement=156250,PhysicalPageSize=0x1000,NumberOfPhysicalPages=0xff7c,LowestPhysicalPage=0x1,HighestPhysicalPage=0xffff,AllocationGranularity=0x10000,LowestUserAddress=0x10000,HighestUserAddress=0x7ffeffff,ActiveProcessors=1,NumberProcessors=1,}, 0x0, ) == 0x0
 00893   896   NtAllocateVirtualMemory  (-1, 1228800, 0, 4096, 4096, 260, ... 1228800, 4096, ) == 0x0
 00894   896   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\IMM32.DLL"}, 1236132, ... ) }, 1236132, ... ) == 0x0
 00895   896   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\IMM32.DLL"}, 1239536, ... ) }, 1239536, ... ) == 0x0
 00896   896   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\System\CurrentControlSet\Control\Error Message Instrument\"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00897   896   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\GRE_Initialize"}, ... 36, ) }, ... 36, ) == 0x0
 00898   896   NtQueryValueKey  (36,  (36, "DisableMetaFiles", Partial, 20, ... ) , Partial, 20, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00899   896   NtClose  (36, ... ) == 0x0
 00900   896   NtMapViewOfSection  (-2147482756, -1, (0x0), 0, 0, 0x0, 0, 2, 0, 2, ... (0x500000), 0x0, 1060864, ) == 0x0
 00901   896   NtClose  (-2147482756, ... ) == 0x0
 00902   896   NtCreateEvent  (0x1f0003, 0x0, 1, 0, ... 36, ) == 0x0
 00903   896   NtOpenThreadTokenEx  (-2, 0x8, 1, 512, ... ) == STATUS_NO_TOKEN
 00904   896   NtOpenProcessTokenEx  (-1, 0x8, 512, ... -2147482756, ) == 0x0
 00905   896   NtQueryInformationToken  (-2147482756, Statistics, 0, ... ) == STATUS_BUFFER_TOO_SMALL
 00906   896   NtQueryInformationToken  (-2147482756, Statistics, 56, ... {token info, class 10, size 56}, 56, ) == 0x0
 00907   896   NtClose  (-2147482756, ... ) == 0x0
 00908   896   NtAllocateVirtualMemory  (-1, 0, 0, 32, 4096, 4, ... 3407872, 4096, ) == 0x0
 00909   896   NtFreeVirtualMemory  (-1, (0x340000), 4096, 32768, ... (0x340000), 4096, ) == 0x0
 00910   896   NtDuplicateObject  (-1, 28, -1, 0x0, 0, 2, ... 84, ) == 0x0
 00911   896   NtOpenKey  (0x20019, {24, 0, 0x240, 0, 0,  (0x20019, {24, 0, 0x240, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Compatibility32"}, ... -2147482756, ) }, ... -2147482756, ) == 0x0
 00912   896   NtQueryValueKey  (-2147482756,  (-2147482756, "packed", Partial, 172, ... ) , Partial, 172, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00913   896   NtClose  (-2147482756, ... ) == 0x0
 00914   896   NtOpenKey  (0x20019, {24, 0, 0x240, 0, 0,  (0x20019, {24, 0, 0x240, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\IME Compatibility"}, ... -2147482756, ) }, ... -2147482756, ) == 0x0
 00915   896   NtQueryValueKey  (-2147482756,  (-2147482756, "packed", Partial, 172, ... ) , Partial, 172, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00916   896   NtClose  (-2147482756, ... ) == 0x0
 00917   896   NtQueryDefaultLocale  (0, -142628532, ... ) == 0x0
 00918   896   NtGdiQueryFontAssocInfo  (0, ... ) == 0x0
 00919   896   NtUserCallNoParam  (24, ... ) == 0x0
 00920   896   NtGdiCreateCompatibleDC  (0, ...
 00921   896   NtAllocateVirtualMemory  (-1, 0, 0, 4096, 12288, 4, ... 3407872, 4096, ) == 0x0
 00920   896   NtGdiCreateCompatibleDC  ... ) == 0x860107ab
 00922   896   NtGdiGetStockObject  (0, ... ) == 0x1900010
 00923   896   NtGdiGetStockObject  (4, ... ) == 0x1900011
 00924   896   NtGdiCreateBitmap  (8, 8, 1, 1, 2118200212, ... ) == 0x870506a2
 00925   896   NtGdiCreateSolidBrush  (0, 0, ...
 00926   896   NtAllocateVirtualMemory  (-1, 0, 0, 4096, 12288, 4, ... 3473408, 4096, ) == 0x0
 00925   896   NtGdiCreateSolidBrush  ... ) == 0x1100680
 00927   896   NtGdiGetStockObject  (13, ... ) == 0x18a0021
 00928   896   NtGdiCreateCompatibleDC  (0, ... ) == 0xf6010687
 00929   896   NtGdiSelectBitmap  (-167704953, -2029713758, ... ) == 0x185000f
 00930   896   NtUserGetThreadDesktop  (896, 0, ... ) == 0x50
 00931   896   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Windows"}, ... 88, ) }, ... 88, ) == 0x0
 00932   896   NtQueryValueKey  (88,  (88, "AppInit_DLLs", Partial, 64, ... TitleIdx=0, Type=1, Data="\0\0"}, 14, ) , Partial, 64, ... TitleIdx=0, Type=1, Data= (88, "AppInit_DLLs", Partial, 64, ... TitleIdx=0, Type=1, Data="\0\0"}, 14, ) }, 14, ) == 0x0
 00933   896   NtClose  (88, ... ) == 0x0
 00934   896   NtUserFindExistingCursorIcon  (1240712, 1240728, 1240776, ... ) == 0x10011
 00935   896   NtUserRegisterClassExWOW  (1240724, 1240792, 1240808, 1240824, 673, 128, 0, ... ) == 0x8177c017
 00936   896   NtUserFindExistingCursorIcon  (1240712, 1240728, 1240776, ... ) == 0x10011
 00937   896   NtUserRegisterClassExWOW  (1240724, 1240792, 1240808, 1240824, 674, 128, 0, ... ) == 0x8177c01c
 00938   896   NtUserFindExistingCursorIcon  (1240712, 1240728, 1240776, ... ) == 0x10011
 00939   896   NtUserRegisterClassExWOW  (1240724, 1240792, 1240808, 1240824, 675, 128, 0, ... ) == 0x8177c01e
 00940   896   NtUserFindExistingCursorIcon  (1240712, 1240728, 1240776, ... ) == 0x10011
 00941   896   NtUserRegisterClassExWOW  (1240724, 1240792, 1240808, 1240824, 676, 128, 0, ... ) == 0x81778002
 00942   896   NtUserFindExistingCursorIcon  (1240712, 1240728, 1240776, ... ) == 0x10013
 00943   896   NtUserRegisterClassExWOW  (1240724, 1240792, 1240808, 1240824, 677, 128, 0, ... ) == 0x8177c018
 00944   896   NtUserFindExistingCursorIcon  (1240712, 1240728, 1240776, ... ) == 0x10011
 00945   896   NtUserRegisterClassExWOW  (1240724, 1240792, 1240808, 1240824, 678, 128, 0, ... ) == 0x8177c01a
 00946   896   NtUserFindExistingCursorIcon  (1240712, 1240728, 1240776, ... ) == 0x10011
 00947   896   NtUserRegisterClassExWOW  (1240724, 1240792, 1240808, 1240824, 679, 128, 0, ... ) == 0x8177c01d
 00948   896   NtUserFindExistingCursorIcon  (1240712, 1240728, 1240776, ... ) == 0x10011
 00949   896   NtUserRegisterClassExWOW  (1240724, 1240792, 1240808, 1240824, 681, 128, 0, ... ) == 0x8177c026
 00950   896   NtUserFindExistingCursorIcon  (1240712, 1240728, 1240776, ... ) == 0x10011
 00951   896   NtUserRegisterClassExWOW  (1240724, 1240792, 1240808, 1240824, 680, 128, 0, ... ) == 0x8177c019
 00952   896   NtUserRegisterClassExWOW  (1240676, 1240744, 1240760, 1240776, 0, 128, 0, ... ) == 0x8177c020
 00953   896   NtUserRegisterClassExWOW  (1240932, 1241028, 1241012, 1241000, 0, 130, 0, ... ) == 0x8177c022
 00954   896   NtUserRegisterClassExWOW  (1240676, 1240744, 1240760, 1240776, 0, 128, 0, ... ) == 0x8177c023
 00955   896   NtUserRegisterClassExWOW  (1240932, 1241028, 1241012, 1241000, 0, 130, 0, ... ) == 0x8177c024
 00956   896   NtUserRegisterClassExWOW  (1240676, 1240744, 1240760, 1240776, 0, 128, 0, ... ) == 0x8177c025
 00957   896   NtCallbackReturn  (0, 0, 0, ...
 00958   896   NtGdiInit  (... ) == 0x1
 00959   896   NtGdiGetStockObject  (18, ... ) == 0x290001c
 00960   896   NtGdiGetStockObject  (19, ... ) == 0x1b00019
 00961   896   NtAllocateVirtualMemory  (-1, 0, 0, 26112, 4096, 64, ... 3538944, 28672, ) == 0x0
 00962   896   NtOpenSection  (0xe, {24, 8, 0x40, 0, 0,  (0xe, {24, 8, 0x40, 0, 0, "WS2_32.dll"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00963   896   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\u:\work\WS2_32.dll"}, 1242908, ... ) }, 1242908, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00964   896   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\WS2_32.dll"}, 1242908, ... ) }, 1242908, ... ) == 0x0
 00965   896   NtOpenFile  (0x100020, {24, 0, 0x40, 0, 0,  (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\WS2_32.dll"}, 5, 96, ... 88, {status=0x0, info=1}, ) }, 5, 96, ... 88, {status=0x0, info=1}, ) == 0x0
 00966   896   NtCreateSection  (0xf, 0x0, 0x0, 16, 16777216, 88, ... 92, ) == 0x0
 00967   896   NtQuerySection  (92, Image, 48, ... {section info, class 1, size 48}, 0x0, ) == 0x0
 00968   896   NtClose  (88, ... ) == 0x0
 00969   896   NtMapViewOfSection  (92, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x71ab0000), 0x0, 94208, ) == 0x0
 00970   896   NtClose  (92, ... ) == 0x0
 00971   896   NtOpenSection  (0xe, {24, 8, 0x40, 0, 0,  (0xe, {24, 8, 0x40, 0, 0, "msvcrt.dll"}, ... 92, ) }, ... 92, ) == 0x0
 00972   896   NtMapViewOfSection  (92, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x77c10000), 0x0, 360448, ) == 0x0
 00973   896   NtClose  (92, ... ) == 0x0
 00974   896   NtProtectVirtualMemory  (-1, (0x77c11000), 632, 4, ... (0x77c11000), 4096, 32, ) == 0x0
 00975   896   NtProtectVirtualMemory  (-1, (0x77c11000), 4096, 32, ... (0x77c11000), 4096, 4, ) == 0x0
 00976   896   NtFlushInstructionCache  (-1, 2009141248, 632, ... ) == 0x0
 00977   896   NtProtectVirtualMemory  (-1, (0x71ab1000), 468, 4, ... (0x71ab1000), 4096, 32, ) == 0x0
 00978   896   NtProtectVirtualMemory  (-1, (0x71ab1000), 4096, 32, ... (0x71ab1000), 4096, 4, ) == 0x0
 00979   896   NtFlushInstructionCache  (-1, 1907036160, 468, ... ) == 0x0
 00980   896   NtOpenSection  (0xe, {24, 8, 0x40, 0, 0,  (0xe, {24, 8, 0x40, 0, 0, "WS2HELP.dll"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00981   896   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\u:\work\WS2HELP.dll"}, 1242092, ... ) }, 1242092, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00982   896   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\WS2HELP.dll"}, 1242092, ... ) }, 1242092, ... ) == 0x0
 00983   896   NtOpenFile  (0x100020, {24, 0, 0x40, 0, 0,  (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\WS2HELP.dll"}, 5, 96, ... 92, {status=0x0, info=1}, ) }, 5, 96, ... 92, {status=0x0, info=1}, ) == 0x0
 00984   896   NtCreateSection  (0xf, 0x0, 0x0, 16, 16777216, 92, ... 88, ) == 0x0
 00985   896   NtQuerySection  (88, Image, 48, ... {section info, class 1, size 48}, 0x0, ) == 0x0
 00986   896   NtClose  (92, ... ) == 0x0
 00987   896   NtMapViewOfSection  (88, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x71aa0000), 0x0, 32768, ) == 0x0
 00988   896   NtClose  (88, ... ) == 0x0
 00989   896   NtProtectVirtualMemory  (-1, (0x71aa1000), 352, 4, ... (0x71aa1000), 4096, 32, ) == 0x0
 00990   896   NtProtectVirtualMemory  (-1, (0x71aa1000), 4096, 32, ... (0x71aa1000), 4096, 4, ) == 0x0
 00991   896   NtFlushInstructionCache  (-1, 1906970624, 352, ... ) == 0x0
 00992   896   NtProtectVirtualMemory  (-1, (0x71ab1000), 468, 4, ... (0x71ab1000), 4096, 32, ) == 0x0
 00993   896   NtProtectVirtualMemory  (-1, (0x71ab1000), 4096, 32, ... (0x71ab1000), 4096, 4, ) == 0x0
 00994   896   NtFlushInstructionCache  (-1, 1907036160, 468, ... ) == 0x0
 00995   896   NtOpenKey  (0x80000000, {24, 0, 0x40, 0, 0,  (0x80000000, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msvcrt.dll"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 00996   896   NtQuerySystemInformation  (Basic, 44, ... {Unknown=0,MaximumIncrement=156250,PhysicalPageSize=0x1000,NumberOfPhysicalPages=0xff7c,LowestPhysicalPage=0x1,HighestPhysicalPage=0xffff,AllocationGranularity=0x10000,LowestUserAddress=0x10000,HighestUserAddress=0x7ffeffff,ActiveProcessors=1,NumberProcessors=1,}, 0x0, ) == 0x0
 00997   896   NtAllocateVirtualMemory  (-1, 0, 0, 65536, 8192, 4, ... 3604480, 65536, ) == 0x0
 00998   896   NtAllocateVirtualMemory  (-1, 3604480, 0, 4096, 4096, 4, ... 3604480, 4096, ) == 0x0
 00999   896   NtAllocateVirtualMemory  (-1, 3608576, 0, 8192, 4096, 4, ... 3608576, 8192, ) == 0x0
 01000   896   NtAllocateVirtualMemory  (-1, 3616768, 0, 4096, 4096, 4, ... 3616768, 4096, ) == 0x0
 01001   896   NtOpenSection  (0x4, {24, 0, 0x40, 0, 0,  (0x4, {24, 0, 0x40, 0, 0, "\NLS\NlsSectionCType"}, ... 88, ) }, ... 88, ) == 0x0
 01002   896   NtMapViewOfSection  (88, -1, (0x0), 0, 0, 0x0, 0, 2, 0, 2, ... (0x380000), 0x0, 12288, ) == 0x0
 01003   896   NtClose  (88, ... ) == 0x0
 01004   896   NtAllocateVirtualMemory  (-1, 3620864, 0, 4096, 4096, 4, ... 3620864, 4096, ) == 0x0
 01005   896   NtQueryVirtualMemory  (-1, 0x77c2807c, Basic, 28, ... {BaseAddress=0x77c28000,AllocationBase=0x77c10000,AllocationProtect=0x80,RegionSize=0x35000,State=0x1000,Protect=0x20,Type=0x1000000,}, 28, ) == 0x0
 01006   896   NtQueryInformationProcess  (-1, 36, 4, ... {process info, class 36, size 4}, 0x0, ) == 0x0
 01007   896   NtQueryInformationProcess  (-1, 36, 4, ... {process info, class 36, size 4}, 0x0, ) == 0x0
 01008   896   NtQueryVirtualMemory  (-1, 0x0, Basic, 28, ... {BaseAddress=0x0,AllocationBase=0x0,AllocationProtect=0x0,RegionSize=0x10000,State=0x10000,Protect=0x1,Type=0x0,}, 28, ) == 0x0
 01009   896   NtOpenKey  (0x80000000, {24, 0, 0x40, 0, 0,  (0x80000000, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\WS2HELP.dll"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01010   896   NtOpenKey  (0x80000000, {24, 0, 0x40, 0, 0,  (0x80000000, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\WS2_32.dll"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01011   896   NtQuerySystemInformation  (Basic, 44, ... {Unknown=0,MaximumIncrement=156250,PhysicalPageSize=0x1000,NumberOfPhysicalPages=0xff7c,LowestPhysicalPage=0x1,HighestPhysicalPage=0xffff,AllocationGranularity=0x10000,LowestUserAddress=0x10000,HighestUserAddress=0x7ffeffff,ActiveProcessors=1,NumberProcessors=1,}, 0x0, ) == 0x0
 01012   896   NtQuerySystemInformation  (Processor, 12, ... {system info, class 1, size 12}, 0x0, ) == 0x0
 01013   896   NtFreeVirtualMemory  (-1, (0x360000), 0, 32768, ... (0x360000), 28672, ) == 0x0
 01014   896   NtFreeVirtualMemory  (-1, (0x330144), 0, 32768, ... (0x330000), 4096, ) == 0x0
 01015   896   NtQuerySystemInformation  (Basic, 44, ... {Unknown=0,MaximumIncrement=156250,PhysicalPageSize=0x1000,NumberOfPhysicalPages=0xff7c,LowestPhysicalPage=0x1,HighestPhysicalPage=0xffff,AllocationGranularity=0x10000,LowestUserAddress=0x10000,HighestUserAddress=0x7ffeffff,ActiveProcessors=1,NumberProcessors=1,}, 0x0, ) == 0x0
 01016   896   NtAllocateVirtualMemory  (-1, 0, 0, 65536, 8192, 4, ... 3342336, 65536, ) == 0x0
 01017   896   NtAllocateVirtualMemory  (-1, 3342336, 0, 4096, 4096, 4, ... 3342336, 4096, ) == 0x0
 01018   896   NtAllocateVirtualMemory  (-1, 3346432, 0, 20480, 4096, 4, ... 3346432, 20480, ) == 0x0
 01019   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ... 9502720, 1048576, ) == 0x0
 01020   896   NtAllocateVirtualMemory  (-1, 9502720, 0, 32768, 4096, 4, ... 9502720, 32768, ) == 0x0
 01021   896   NtCreateMutant  (0x1f0001, {24, 16, 0x80, 0, 0,  (0x1f0001, {24, 16, 0x80, 0, 0, "Jobaka3"}, 0, ... 88, ) }, 0, ... 88, ) == 0x0
 01022   896   NtOpenKey  (0x2000000, {24, 40, 0x40, 0, 0,  (0x2000000, {24, 40, 0x40, 0, 0, "System\CurrentControlSet\Services\WinSock2\Parameters"}, ... 92, ) }, ... 92, ) == 0x0
 01023   896   NtQueryValueKey  (92,  (92, "WinSock_Registry_Version", Partial, 144, ... TitleIdx=0, Type=1, Data="2\0.\00\0\0\0"}, 20, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (92, "WinSock_Registry_Version", Partial, 144, ... TitleIdx=0, Type=1, Data="2\0.\00\0\0\0"}, 20, ) }, 20, ) == 0x0
 01024   896   NtQueryValueKey  (92,  (92, "WinSock_Registry_Version", Partial, 144, ... TitleIdx=0, Type=1, Data="2\0.\00\0\0\0"}, 20, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (92, "WinSock_Registry_Version", Partial, 144, ... TitleIdx=0, Type=1, Data="2\0.\00\0\0\0"}, 20, ) }, 20, ) == 0x0
 01025   896   NtCreateEvent  (0x1f0003, 0x0, 0, 0, ... 96, ) == 0x0
 01026   896   NtOpenKey  (0x2000000, {24, 92, 0x40, 0, 0,  (0x2000000, {24, 92, 0x40, 0, 0, "Protocol_Catalog9"}, ... 100, ) }, ... 100, ) == 0x0
 01027   896   NtQueryValueKey  (100,  (100, "Serial_Access_Num", Partial, 144, ... TitleIdx=0, Type=4, Data="\15\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (100, "Serial_Access_Num", Partial, 144, ... TitleIdx=0, Type=4, Data="\15\0\0\0"}, 16, ) }, 16, ) == 0x0
 01028   896   NtNotifyChangeKey  (100, 96, 0, 0, 2011455960, 1, 0, 0, 0, 1, ... ) == 0x103
 01029   896   NtQueryValueKey  (100,  (100, "Serial_Access_Num", Partial, 144, ... TitleIdx=0, Type=4, Data="\15\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (100, "Serial_Access_Num", Partial, 144, ... TitleIdx=0, Type=4, Data="\15\0\0\0"}, 16, ) }, 16, ) == 0x0
 01030   896   NtOpenKey  (0x2000000, {24, 100, 0x40, 0, 0,  (0x2000000, {24, 100, 0x40, 0, 0, "0000000D"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01031   896   NtQueryValueKey  (100,  (100, "Next_Catalog_Entry_ID", Partial, 144, ... TitleIdx=0, Type=4, Data="#\4\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (100, "Next_Catalog_Entry_ID", Partial, 144, ... TitleIdx=0, Type=4, Data="#\4\0\0"}, 16, ) }, 16, ) == 0x0
 01032   896   NtQueryValueKey  (100,  (100, "Num_Catalog_Entries", Partial, 144, ... TitleIdx=0, Type=4, Data="\26\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (100, "Num_Catalog_Entries", Partial, 144, ... TitleIdx=0, Type=4, Data="\26\0\0\0"}, 16, ) }, 16, ) == 0x0
 01033   896   NtOpenKey  (0x2000000, {24, 100, 0x40, 0, 0,  (0x2000000, {24, 100, 0x40, 0, 0, "Catalog_Entries"}, ... 104, ) }, ... 104, ) == 0x0
 01034   896   NtOpenKey  (0x20019, {24, 104, 0x40, 0, 0,  (0x20019, {24, 104, 0x40, 0, 0, "000000000001"}, ... 108, ) }, ... 108, ) == 0x0
 01035   896   NtQueryValueKey  (108,  (108, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 01036   896   NtAllocateVirtualMemory  (-1, 1339392, 0, 4096, 4096, 4, ... 1339392, 4096, ) == 0x0
 01037   896   NtQueryValueKey  (108,  (108, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 01038   896   NtQueryValueKey  (108,  (108, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5f\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\10\0\0\0\240\32\17\347\213\253\317\21\214\243\0\200_H\241\222\351\3\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\2\0\0\0\20\0\0\0\20\0\0\0\1\0\0\0\6\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0T\0c\0p\0i\0p\0 \0[\0T\0C\0P\0/\0I\0P\0]\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\204\3\0\0\17\4\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0l\0\0\0\17\4\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\20\4\0\0\344\4\0\0\200\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0h\0\0\0`\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\240j\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\00\02\0\20\4\0\0\344\4\0\0\200\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0l\0\0\0\21\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0l\0\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\21\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\22\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0l\0\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) , Partial, 900, ... TitleIdx=0, Type=3, Data= (108, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5f\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\10\0\0\0\240\32\17\347\213\253\317\21\214\243\0\200_H\241\222\351\3\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\2\0\0\0\20\0\0\0\20\0\0\0\1\0\0\0\6\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0T\0c\0p\0i\0p\0 \0[\0T\0C\0P\0/\0I\0P\0]\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\204\3\0\0\17\4\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0l\0\0\0\17\4\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\20\4\0\0\344\4\0\0\200\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0h\0\0\0`\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\240j\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\00\02\0\20\4\0\0\344\4\0\0\200\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0l\0\0\0\21\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0l\0\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\21\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\22\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0l\0\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) \0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\21\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\22\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0l\0\0\0\0\0\0\0 (108, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5f\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\10\0\0\0\240\32\17\347\213\253\317\21\214\243\0\200_H\241\222\351\3\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\2\0\0\0\20\0\0\0\20\0\0\0\1\0\0\0\6\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0T\0c\0p\0i\0p\0 \0[\0T\0C\0P\0/\0I\0P\0]\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\204\3\0\0\17\4\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0l\0\0\0\17\4\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\20\4\0\0\344\4\0\0\200\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0h\0\0\0`\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\240j\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\00\02\0\20\4\0\0\344\4\0\0\200\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0l\0\0\0\21\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0l\0\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\21\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\22\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0l\0\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) }, 900, ) == 0x0
 01039   896   NtClose  (108, ... ) == 0x0
 01040   896   NtOpenKey  (0x20019, {24, 104, 0x40, 0, 0,  (0x20019, {24, 104, 0x40, 0, 0, "000000000002"}, ... 108, ) }, ... 108, ) == 0x0
 01041   896   NtQueryValueKey  (108,  (108, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 01042   896   NtQueryValueKey  (108,  (108, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 01043   896   NtQueryValueKey  (108,  (108, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\11\6\2\0\0\0\0\0\0\0\0\0\0\0\0\0\10\0\0\0\240\32\17\347\213\253\317\21\214\243\0\200_H\241\222\352\3\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\2\0\0\0\20\0\0\0\20\0\0\0\2\0\0\0\21\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\273\377\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0T\0c\0p\0i\0p\0 \0[\0U\0D\0P\0/\0I\0P\0]\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\204\3\0\0\24\4\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0l\0\0\0\24\4\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\25\4\0\0\344\4\0\0\200\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0h\0\0\0`\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\240j\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\00\03\0\25\4\0\0\344\4\0\0\200\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0l\0\0\0\26\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0l\0\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\26\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\27\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0l\0\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) , Partial, 900, ... TitleIdx=0, Type=3, Data= (108, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\11\6\2\0\0\0\0\0\0\0\0\0\0\0\0\0\10\0\0\0\240\32\17\347\213\253\317\21\214\243\0\200_H\241\222\352\3\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\2\0\0\0\20\0\0\0\20\0\0\0\2\0\0\0\21\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\273\377\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0T\0c\0p\0i\0p\0 \0[\0U\0D\0P\0/\0I\0P\0]\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\204\3\0\0\24\4\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0l\0\0\0\24\4\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\25\4\0\0\344\4\0\0\200\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0h\0\0\0`\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\240j\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\00\03\0\25\4\0\0\344\4\0\0\200\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0l\0\0\0\26\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0l\0\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\26\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\27\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0l\0\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) \0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\26\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\27\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0l\0\0\0\0\0\0\0 (108, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\11\6\2\0\0\0\0\0\0\0\0\0\0\0\0\0\10\0\0\0\240\32\17\347\213\253\317\21\214\243\0\200_H\241\222\352\3\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\2\0\0\0\20\0\0\0\20\0\0\0\2\0\0\0\21\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\273\377\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0T\0c\0p\0i\0p\0 \0[\0U\0D\0P\0/\0I\0P\0]\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\204\3\0\0\24\4\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0l\0\0\0\24\4\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\25\4\0\0\344\4\0\0\200\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0h\0\0\0`\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\240j\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\00\03\0\25\4\0\0\344\4\0\0\200\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0l\0\0\0\26\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0l\0\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\26\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\27\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0l\0\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) }, 900, ) == 0x0
 01044   896   NtClose  (108, ... ) == 0x0
 01045   896   NtOpenKey  (0x20019, {24, 104, 0x40, 0, 0,  (0x20019, {24, 104, 0x40, 0, 0, "000000000003"}, ... 108, ) }, ... 108, ) == 0x0
 01046   896   NtQueryValueKey  (108,  (108, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 01047   896   NtQueryValueKey  (108,  (108, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 01048   896   NtQueryValueKey  (108,  (108, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\11\6\2\0\0\0\0\0\0\0\0\0\0\0\0\0\14\0\0\0\240\32\17\347\213\253\317\21\214\243\0\200_H\241\222\353\3\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\2\0\0\0\20\0\0\0\20\0\0\0\3\0\0\0\0\0\0\0\377\0\0\0\0\0\0\0\0\0\0\0\273\377\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0T\0c\0p\0i\0p\0 \0[\0R\0A\0W\0/\0I\0P\0]\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\204\3\0\0\31\4\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0l\0\0\0\31\4\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\32\4\0\0\344\4\0\0\200\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0h\0\0\0`\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\240j\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\00\04\0\32\4\0\0\344\4\0\0\200\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0l\0\0\0\33\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0l\0\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\33\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\34\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0l\0\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) , Partial, 900, ... TitleIdx=0, Type=3, Data= (108, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\11\6\2\0\0\0\0\0\0\0\0\0\0\0\0\0\14\0\0\0\240\32\17\347\213\253\317\21\214\243\0\200_H\241\222\353\3\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\2\0\0\0\20\0\0\0\20\0\0\0\3\0\0\0\0\0\0\0\377\0\0\0\0\0\0\0\0\0\0\0\273\377\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0T\0c\0p\0i\0p\0 \0[\0R\0A\0W\0/\0I\0P\0]\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\204\3\0\0\31\4\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0l\0\0\0\31\4\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\32\4\0\0\344\4\0\0\200\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0h\0\0\0`\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\240j\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\00\04\0\32\4\0\0\344\4\0\0\200\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0l\0\0\0\33\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0l\0\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\33\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\34\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0l\0\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) \0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\33\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\34\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0l\0\0\0\0\0\0\0 (108, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\11\6\2\0\0\0\0\0\0\0\0\0\0\0\0\0\14\0\0\0\240\32\17\347\213\253\317\21\214\243\0\200_H\241\222\353\3\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\2\0\0\0\20\0\0\0\20\0\0\0\3\0\0\0\0\0\0\0\377\0\0\0\0\0\0\0\0\0\0\0\273\377\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0T\0c\0p\0i\0p\0 \0[\0R\0A\0W\0/\0I\0P\0]\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\204\3\0\0\31\4\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0l\0\0\0\31\4\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\32\4\0\0\344\4\0\0\200\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0h\0\0\0`\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\240j\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\00\04\0\32\4\0\0\344\4\0\0\200\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0l\0\0\0\33\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0l\0\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0\33\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0\34\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0l\0\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) }, 900, ) == 0x0
 01049   896   NtClose  (108, ... ) == 0x0
 01050   896   NtOpenKey  (0x20019, {24, 104, 0x40, 0, 0,  (0x20019, {24, 104, 0x40, 0, 0, "000000000004"}, ... 108, ) }, ... 108, ) == 0x0
 01051   896   NtQueryValueKey  (108,  (108, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 01052   896   NtQueryValueKey  (108,  (108, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 01053   896   NtAllocateVirtualMemory  (-1, 1343488, 0, 4096, 4096, 4, ... 1343488, 4096, ) == 0x0
 01054   896   NtQueryValueKey  (108,  (108, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\rsvpsp.dll\0\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\11&\2\0\0\0\0\0\0\0\0\0\0\0\0\0\10\0\0\0\340\251`\235z3\320\21\275\210\0\0\300\202\346\232\354\3\0\0\1\0\0\0\204\370\272\2|\370\272\2\210\371\272\2\4\244`u\\12\0\0\240<_u\260\371\272\2\6\0\0\0\2\0\0\0\20\0\0\0\20\0\0\0\2\0\0\0\21\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\273\377\0\0\0\0\0\0R\0S\0V\0P\0 \0U\0D\0P\0 \0S\0e\0r\0v\0i\0c\0e\0 \0P\0r\0o\0v\0i\0d\0e\0r\0\0\0\1\0\0\0\344\373\272\2\1\0\0\0\330\273\356\0\0\0\0\0=\373\220|\200\371\272\2\0\0\0\0\0\371\272\2l\373\220|q\373\220|\0\0\0\0\200\371\272\2=\373\220|\334\370\272\2\0\0\0\0\204\3\0\0\37\4\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0l\0\0\0\37\4\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0 \4\0\0\344\4\0\0\200\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0h\0\0\0`\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\240j\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\00\05\0 \4\0\0\344\4\0\0\200\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0l\0\0\0!\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0l\0\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0!\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0"\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0l\0\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) , Partial, 900, ... TitleIdx=0, Type=3, Data= (108, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\rsvpsp.dll\0\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\11&\2\0\0\0\0\0\0\0\0\0\0\0\0\0\10\0\0\0\340\251`\235z3\320\21\275\210\0\0\300\202\346\232\354\3\0\0\1\0\0\0\204\370\272\2|\370\272\2\210\371\272\2\4\244`u\\12\0\0\240<_u\260\371\272\2\6\0\0\0\2\0\0\0\20\0\0\0\20\0\0\0\2\0\0\0\21\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\273\377\0\0\0\0\0\0R\0S\0V\0P\0 \0U\0D\0P\0 \0S\0e\0r\0v\0i\0c\0e\0 \0P\0r\0o\0v\0i\0d\0e\0r\0\0\0\1\0\0\0\344\373\272\2\1\0\0\0\330\273\356\0\0\0\0\0=\373\220|\200\371\272\2\0\0\0\0\0\371\272\2l\373\220|q\373\220|\0\0\0\0\200\371\272\2=\373\220|\334\370\272\2\0\0\0\0\204\3\0\0\37\4\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0l\0\0\0\37\4\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0 \4\0\0\344\4\0\0\200\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0h\0\0\0`\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\240j\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\00\05\0 \4\0\0\344\4\0\0\200\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0l\0\0\0!\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0l\0\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0!\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0"\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0l\0\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) \0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0!\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0 (108, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\rsvpsp.dll\0\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\11&\2\0\0\0\0\0\0\0\0\0\0\0\0\0\10\0\0\0\340\251`\235z3\320\21\275\210\0\0\300\202\346\232\354\3\0\0\1\0\0\0\204\370\272\2|\370\272\2\210\371\272\2\4\244`u\\12\0\0\240<_u\260\371\272\2\6\0\0\0\2\0\0\0\20\0\0\0\20\0\0\0\2\0\0\0\21\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\273\377\0\0\0\0\0\0R\0S\0V\0P\0 \0U\0D\0P\0 \0S\0e\0r\0v\0i\0c\0e\0 \0P\0r\0o\0v\0i\0d\0e\0r\0\0\0\1\0\0\0\344\373\272\2\1\0\0\0\330\273\356\0\0\0\0\0=\373\220|\200\371\272\2\0\0\0\0\0\371\272\2l\373\220|q\373\220|\0\0\0\0\200\371\272\2=\373\220|\334\370\272\2\0\0\0\0\204\3\0\0\37\4\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0l\0\0\0\37\4\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0 \4\0\0\344\4\0\0\200\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0h\0\0\0`\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\240j\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\00\05\0 \4\0\0\344\4\0\0\200\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0l\0\0\0!\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0l\0\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0!\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0"\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0l\0\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) \0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) == 0x0
 01055   896   NtClose  (108, ... ) == 0x0
 01056   896   NtOpenKey  (0x20019, {24, 104, 0x40, 0, 0,  (0x20019, {24, 104, 0x40, 0, 0, "000000000005"}, ... 108, ) }, ... 108, ) == 0x0
 01057   896   NtQueryValueKey  (108,  (108, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 01058   896   NtQueryValueKey  (108,  (108, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 01059   896   NtQueryValueKey  (108,  (108, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\rsvpsp.dll\0\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5f \2\0\0\0\0\0\0\0\0\0\0\0\0\0\10\0\0\0\340\251`\235z3\320\21\275\210\0\0\300\202\346\232\355\3\0\0\1\0\0\0\210\1\34\0\0\0\34\0\10\0\0\0\0\0\0\0\214\373\272\2\\15\221|\0\0\34\0\6\0\0\0\2\0\0\0\20\0\0\0\20\0\0\0\1\0\0\0\6\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0R\0S\0V\0P\0 \0T\0C\0P\0 \0S\0e\0r\0v\0i\0c\0e\0 \0P\0r\0o\0v\0i\0d\0e\0r\0\0\0\210\1\34\0\0\0\0\0\20\0\0\0P\373\272\2\270Ddu\0\0\0\0(\275\356\0|\373\272\2\364\373\272\2\0\0\34\0\10\0\0\0\0\0\0\0(\374\272\2\\15\221|\0\0\34\0\0\0\0\0\204\3\0\0$\4\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0l\0\0\0$\4\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0%\4\0\0\344\4\0\0\200\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0h\0\0\0`\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\240j\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\00\06\0%\4\0\0\344\4\0\0\200\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0l\0\0\0&\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0l\0\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0&\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0'\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0l\0\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) , Partial, 900, ... TitleIdx=0, Type=3, Data= (108, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\rsvpsp.dll\0\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5f \2\0\0\0\0\0\0\0\0\0\0\0\0\0\10\0\0\0\340\251`\235z3\320\21\275\210\0\0\300\202\346\232\355\3\0\0\1\0\0\0\210\1\34\0\0\0\34\0\10\0\0\0\0\0\0\0\214\373\272\2\\15\221|\0\0\34\0\6\0\0\0\2\0\0\0\20\0\0\0\20\0\0\0\1\0\0\0\6\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0R\0S\0V\0P\0 \0T\0C\0P\0 \0S\0e\0r\0v\0i\0c\0e\0 \0P\0r\0o\0v\0i\0d\0e\0r\0\0\0\210\1\34\0\0\0\0\0\20\0\0\0P\373\272\2\270Ddu\0\0\0\0(\275\356\0|\373\272\2\364\373\272\2\0\0\34\0\10\0\0\0\0\0\0\0(\374\272\2\\15\221|\0\0\34\0\0\0\0\0\204\3\0\0$\4\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0l\0\0\0$\4\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0%\4\0\0\344\4\0\0\200\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0h\0\0\0`\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\240j\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\00\06\0%\4\0\0\344\4\0\0\200\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0l\0\0\0&\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0l\0\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0&\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0'\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0l\0\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) \0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0&\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0'\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0l\0\0\0\0\0\0\0 (108, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\rsvpsp.dll\0\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5f \2\0\0\0\0\0\0\0\0\0\0\0\0\0\10\0\0\0\340\251`\235z3\320\21\275\210\0\0\300\202\346\232\355\3\0\0\1\0\0\0\210\1\34\0\0\0\34\0\10\0\0\0\0\0\0\0\214\373\272\2\\15\221|\0\0\34\0\6\0\0\0\2\0\0\0\20\0\0\0\20\0\0\0\1\0\0\0\6\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0R\0S\0V\0P\0 \0T\0C\0P\0 \0S\0e\0r\0v\0i\0c\0e\0 \0P\0r\0o\0v\0i\0d\0e\0r\0\0\0\210\1\34\0\0\0\0\0\20\0\0\0P\373\272\2\270Ddu\0\0\0\0(\275\356\0|\373\272\2\364\373\272\2\0\0\34\0\10\0\0\0\0\0\0\0(\374\272\2\\15\221|\0\0\34\0\0\0\0\0\204\3\0\0$\4\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0l\0\0\0$\4\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0%\4\0\0\344\4\0\0\200\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0h\0\0\0`\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\240j\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\00\06\0%\4\0\0\344\4\0\0\200\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0l\0\0\0&\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0l\0\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0&\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0'\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0l\0\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) }, 900, ) == 0x0
 01060   896   NtClose  (108, ... ) == 0x0
 01061   896   NtOpenKey  (0x20019, {24, 104, 0x40, 0, 0,  (0x20019, {24, 104, 0x40, 0, 0, "000000000006"}, ... 108, ) }, ... 108, ) == 0x0
 01062   896   NtQueryValueKey  (108,  (108, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 01063   896   NtQueryValueKey  (108,  (108, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 01064   896   NtQueryValueKey  (108,  (108, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5&\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\10\0\0\0d\200\304\237\230r\344C\267\275\30\37 \211y*\374\3\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0 \0\0\0\36\0\0\0\36\0\0\0\1\0\0\0\3\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0R\0f\0C\0o\0m\0m\0 \0[\0B\0l\0u\0e\0t\0o\0o\0t\0h\0]\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\204\3\0\0)\4\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0l\0\0\0)\4\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0*\4\0\0\344\4\0\0\200\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0h\0\0\0`\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\240j\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\00\07\0*\4\0\0\344\4\0\0\200\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0l\0\0\0+\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0l\0\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0+\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0,\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0l\0\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) , Partial, 900, ... TitleIdx=0, Type=3, Data= (108, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5&\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\10\0\0\0d\200\304\237\230r\344C\267\275\30\37 \211y*\374\3\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0 \0\0\0\36\0\0\0\36\0\0\0\1\0\0\0\3\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0R\0f\0C\0o\0m\0m\0 \0[\0B\0l\0u\0e\0t\0o\0o\0t\0h\0]\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\204\3\0\0)\4\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0l\0\0\0)\4\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0*\4\0\0\344\4\0\0\200\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0h\0\0\0`\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\240j\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\00\07\0*\4\0\0\344\4\0\0\200\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0l\0\0\0+\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0l\0\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0+\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0,\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0l\0\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) \0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0+\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0,\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0l\0\0\0\0\0\0\0 (108, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5&\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\10\0\0\0d\200\304\237\230r\344C\267\275\30\37 \211y*\374\3\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0 \0\0\0\36\0\0\0\36\0\0\0\1\0\0\0\3\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0R\0f\0C\0o\0m\0m\0 \0[\0B\0l\0u\0e\0t\0o\0o\0t\0h\0]\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\204\3\0\0)\4\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0l\0\0\0)\4\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0*\4\0\0\344\4\0\0\200\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0h\0\0\0`\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\240j\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\00\07\0*\4\0\0\344\4\0\0\200\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0l\0\0\0+\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0l\0\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0+\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0,\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0l\0\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) }, 900, ) == 0x0
 01065   896   NtClose  (108, ... ) == 0x0
 01066   896   NtOpenKey  (0x20019, {24, 104, 0x40, 0, 0,  (0x20019, {24, 104, 0x40, 0, 0, "000000000007"}, ... 108, ) }, ... 108, ) == 0x0
 01067   896   NtQueryValueKey  (108,  (108, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 01068   896   NtQueryValueKey  (108,  (108, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 01069   896   NtQueryValueKey  (108,  (108, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\16\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\23\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\5\0\0\0\373\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\0F\0C\0C\00\03\0A\04\01\0-\08\0C\0C\0C\0-\04\09\01\09\0-\0A\0\0\0\0\0\204\3\0\0.\4\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0l\0\0\0.\4\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0/\4\0\0\344\4\0\0\200\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0h\0\0\0`\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\240j\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\00\08\0/\4\0\0\344\4\0\0\200\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0l\0\0\00\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0l\0\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\00\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\01\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0l\0\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) , Partial, 900, ... TitleIdx=0, Type=3, Data= (108, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\16\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\23\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\5\0\0\0\373\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\0F\0C\0C\00\03\0A\04\01\0-\08\0C\0C\0C\0-\04\09\01\09\0-\0A\0\0\0\0\0\204\3\0\0.\4\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0l\0\0\0.\4\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0/\4\0\0\344\4\0\0\200\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0h\0\0\0`\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\240j\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\00\08\0/\4\0\0\344\4\0\0\200\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0l\0\0\00\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0l\0\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\00\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\01\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0l\0\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) \0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\00\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\01\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0l\0\0\0\0\0\0\0 (108, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\16\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\23\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\5\0\0\0\373\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\0F\0C\0C\00\03\0A\04\01\0-\08\0C\0C\0C\0-\04\09\01\09\0-\0A\0\0\0\0\0\204\3\0\0.\4\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0l\0\0\0.\4\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0/\4\0\0\344\4\0\0\200\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0h\0\0\0`\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\240j\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\00\08\0/\4\0\0\344\4\0\0\200\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0l\0\0\00\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0l\0\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\00\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\01\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0l\0\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) }, 900, ) == 0x0
 01070   896   NtClose  (108, ... ) == 0x0
 01071   896   NtOpenKey  (0x20019, {24, 104, 0x40, 0, 0,  (0x20019, {24, 104, 0x40, 0, 0, "000000000008"}, ... 108, ) }, ... 108, ) == 0x0
 01072   896   NtQueryValueKey  (108,  (108, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 01073   896   NtQueryValueKey  (108,  (108, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 01074   896   NtQueryValueKey  (108,  (108, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\11\2\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\24\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\2\0\0\0\373\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\0F\0C\0C\00\03\0A\04\01\0-\08\0C\0C\0C\0-\04\09\01\09\0-\0A\0\0\0\0\0\204\3\0\03\4\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0l\0\0\03\4\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\04\4\0\0\344\4\0\0\200\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0h\0\0\0`\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\240j\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\00\09\04\4\0\0\344\4\0\0\200\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0l\0\0\05\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0l\0\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\05\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\06\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0l\0\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) , Partial, 900, ... TitleIdx=0, Type=3, Data= (108, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\11\2\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\24\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\2\0\0\0\373\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\0F\0C\0C\00\03\0A\04\01\0-\08\0C\0C\0C\0-\04\09\01\09\0-\0A\0\0\0\0\0\204\3\0\03\4\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0l\0\0\03\4\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\04\4\0\0\344\4\0\0\200\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0h\0\0\0`\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\240j\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\00\09\04\4\0\0\344\4\0\0\200\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0l\0\0\05\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0l\0\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\05\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\06\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0l\0\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) \0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\05\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\06\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0l\0\0\0\0\0\0\0 (108, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\11\2\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\24\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\2\0\0\0\373\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\0F\0C\0C\00\03\0A\04\01\0-\08\0C\0C\0C\0-\04\09\01\09\0-\0A\0\0\0\0\0\204\3\0\03\4\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0l\0\0\03\4\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\04\4\0\0\344\4\0\0\200\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0h\0\0\0`\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\240j\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\00\09\04\4\0\0\344\4\0\0\200\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0l\0\0\05\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0l\0\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\05\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\06\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0l\0\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) }, 900, ) == 0x0
 01075   896   NtClose  (108, ... ) == 0x0
 01076   896   NtOpenKey  (0x20019, {24, 104, 0x40, 0, 0,  (0x20019, {24, 104, 0x40, 0, 0, "000000000009"}, ... 108, ) }, ... 108, ) == 0x0
 01077   896   NtQueryValueKey  (108,  (108, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 01078   896   NtQueryValueKey  (108,  (108, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 01079   896   NtAllocateVirtualMemory  (-1, 1347584, 0, 4096, 4096, 4, ... 1347584, 4096, ) == 0x0
 01080   896   NtQueryValueKey  (108,  (108, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\16\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\25\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\5\0\0\0\374\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\0A\0E\07\04\02\01\0B\05\0-\07\03\02\0D\0-\04\05\06\07\0-\0A\0\0\0\0\0\204\3\0\09\4\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0l\0\0\09\4\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0:\4\0\0\344\4\0\0\200\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0h\0\0\0`\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\240j\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\01\00\0:\4\0\0\344\4\0\0\200\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0l\0\0\0;\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0l\0\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0;\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0<\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0l\0\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) , Partial, 900, ... TitleIdx=0, Type=3, Data= (108, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\16\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\25\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\5\0\0\0\374\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\0A\0E\07\04\02\01\0B\05\0-\07\03\02\0D\0-\04\05\06\07\0-\0A\0\0\0\0\0\204\3\0\09\4\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0l\0\0\09\4\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0:\4\0\0\344\4\0\0\200\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0h\0\0\0`\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\240j\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\01\00\0:\4\0\0\344\4\0\0\200\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0l\0\0\0;\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0l\0\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0;\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0<\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0l\0\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) \0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0;\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0<\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0l\0\0\0\0\0\0\0 (108, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\16\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\25\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\5\0\0\0\374\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\0A\0E\07\04\02\01\0B\05\0-\07\03\02\0D\0-\04\05\06\07\0-\0A\0\0\0\0\0\204\3\0\09\4\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0l\0\0\09\4\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0:\4\0\0\344\4\0\0\200\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0h\0\0\0`\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\240j\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\01\00\0:\4\0\0\344\4\0\0\200\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0l\0\0\0;\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0l\0\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0;\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0<\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0l\0\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) }, 900, ) == 0x0
 01081   896   NtClose  (108, ... ) == 0x0
 01082   896   NtOpenKey  (0x20019, {24, 104, 0x40, 0, 0,  (0x20019, {24, 104, 0x40, 0, 0, "000000000010"}, ... 108, ) }, ... 108, ) == 0x0
 01083   896   NtQueryValueKey  (108,  (108, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 01084   896   NtQueryValueKey  (108,  (108, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 01085   896   NtQueryValueKey  (108,  (108, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\11\2\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\26\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\2\0\0\0\374\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\0A\0E\07\04\02\01\0B\05\0-\07\03\02\0D\0-\04\05\06\07\0-\0A\0\0\0\0\0\204\3\0\0>\4\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0l\0\0\0>\4\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0?\4\0\0\344\4\0\0\200\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0h\0\0\0`\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\240j\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\01\01\0?\4\0\0\344\4\0\0\200\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0l\0\0\0@\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0l\0\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0@\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0A\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0l\0\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) , Partial, 900, ... TitleIdx=0, Type=3, Data= (108, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\11\2\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\26\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\2\0\0\0\374\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\0A\0E\07\04\02\01\0B\05\0-\07\03\02\0D\0-\04\05\06\07\0-\0A\0\0\0\0\0\204\3\0\0>\4\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0l\0\0\0>\4\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0?\4\0\0\344\4\0\0\200\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0h\0\0\0`\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\240j\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\01\01\0?\4\0\0\344\4\0\0\200\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0l\0\0\0@\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0l\0\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0@\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0A\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0l\0\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) \0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0@\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0A\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0l\0\0\0\0\0\0\0 (108, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\11\2\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\26\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\2\0\0\0\374\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\0A\0E\07\04\02\01\0B\05\0-\07\03\02\0D\0-\04\05\06\07\0-\0A\0\0\0\0\0\204\3\0\0>\4\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0l\0\0\0>\4\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0?\4\0\0\344\4\0\0\200\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0h\0\0\0`\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\240j\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\01\01\0?\4\0\0\344\4\0\0\200\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0l\0\0\0@\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0l\0\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0@\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0A\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0l\0\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) }, 900, ) == 0x0
 01086   896   NtClose  (108, ... ) == 0x0
 01087   896   NtOpenKey  (0x20019, {24, 104, 0x40, 0, 0,  (0x20019, {24, 104, 0x40, 0, 0, "000000000011"}, ... 108, ) }, ... 108, ) == 0x0
 01088   896   NtQueryValueKey  (108,  (108, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 01089   896   NtQueryValueKey  (108,  (108, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 01090   896   NtQueryValueKey  (108,  (108, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\16\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\27\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\5\0\0\0\375\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\09\07\0C\02\0D\09\0F\04\0-\06\09\05\04\0-\04\0E\0B\03\0-\08\0\0\0\0\0\204\3\0\0C\4\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0l\0\0\0C\4\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0D\4\0\0\344\4\0\0\200\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0h\0\0\0`\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\240j\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\01\02\0D\4\0\0\344\4\0\0\200\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0l\0\0\0E\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0l\0\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0E\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0F\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0l\0\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) , Partial, 900, ... TitleIdx=0, Type=3, Data= (108, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\16\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\27\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\5\0\0\0\375\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\09\07\0C\02\0D\09\0F\04\0-\06\09\05\04\0-\04\0E\0B\03\0-\08\0\0\0\0\0\204\3\0\0C\4\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0l\0\0\0C\4\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0D\4\0\0\344\4\0\0\200\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0h\0\0\0`\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\240j\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\01\02\0D\4\0\0\344\4\0\0\200\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0l\0\0\0E\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0l\0\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0E\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0F\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0l\0\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) \0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0E\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0F\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0l\0\0\0\0\0\0\0 (108, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\16\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\27\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\5\0\0\0\375\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\09\07\0C\02\0D\09\0F\04\0-\06\09\05\04\0-\04\0E\0B\03\0-\08\0\0\0\0\0\204\3\0\0C\4\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0l\0\0\0C\4\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0D\4\0\0\344\4\0\0\200\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0h\0\0\0`\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\240j\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\01\02\0D\4\0\0\344\4\0\0\200\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0l\0\0\0E\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0l\0\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0E\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0F\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0l\0\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) }, 900, ) == 0x0
 01091   896   NtClose  (108, ... ) == 0x0
 01092   896   NtOpenKey  (0x20019, {24, 104, 0x40, 0, 0,  (0x20019, {24, 104, 0x40, 0, 0, "000000000012"}, ... 108, ) }, ... 108, ) == 0x0
 01093   896   NtQueryValueKey  (108,  (108, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 01094   896   NtQueryValueKey  (108,  (108, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 01095   896   NtQueryValueKey  (108,  (108, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\11\2\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\30\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\2\0\0\0\375\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\09\07\0C\02\0D\09\0F\04\0-\06\09\05\04\0-\04\0E\0B\03\0-\08\0\0\0\0\0\204\3\0\0H\4\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0l\0\0\0H\4\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0I\4\0\0\344\4\0\0\200\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0h\0\0\0`\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\240j\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\01\03\0I\4\0\0\344\4\0\0\200\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0l\0\0\0J\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0l\0\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0J\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0K\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0l\0\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) , Partial, 900, ... TitleIdx=0, Type=3, Data= (108, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\11\2\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\30\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\2\0\0\0\375\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\09\07\0C\02\0D\09\0F\04\0-\06\09\05\04\0-\04\0E\0B\03\0-\08\0\0\0\0\0\204\3\0\0H\4\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0l\0\0\0H\4\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0I\4\0\0\344\4\0\0\200\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0h\0\0\0`\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\240j\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\01\03\0I\4\0\0\344\4\0\0\200\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0l\0\0\0J\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0l\0\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0J\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0K\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0l\0\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) \0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0J\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0K\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0l\0\0\0\0\0\0\0 (108, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\11\2\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\30\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\2\0\0\0\375\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\09\07\0C\02\0D\09\0F\04\0-\06\09\05\04\0-\04\0E\0B\03\0-\08\0\0\0\0\0\204\3\0\0H\4\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0l\0\0\0H\4\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0I\4\0\0\344\4\0\0\200\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0h\0\0\0`\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\240j\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\01\03\0I\4\0\0\344\4\0\0\200\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0l\0\0\0J\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0l\0\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0J\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0K\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0l\0\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) }, 900, ) == 0x0
 01096   896   NtClose  (108, ... ) == 0x0
 01097   896   NtOpenKey  (0x20019, {24, 104, 0x40, 0, 0,  (0x20019, {24, 104, 0x40, 0, 0, "000000000013"}, ... 108, ) }, ... 108, ) == 0x0
 01098   896   NtQueryValueKey  (108,  (108, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 01099   896   NtQueryValueKey  (108,  (108, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 01100   896   NtAllocateVirtualMemory  (-1, 1351680, 0, 4096, 4096, 4, ... 1351680, 4096, ) == 0x0
 01101   896   NtQueryValueKey  (108,  (108, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\16\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\10\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\31\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\5\0\0\0\0\0\0\200\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\00\0D\04\03\00\0A\06\0F\0-\00\04\01\00\0-\04\0A\06\08\0-\09\0\0\0\0\0\204\3\0\0N\4\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0l\0\0\0N\4\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0O\4\0\0\344\4\0\0\200\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0h\0\0\0`\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\240j\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\01\04\0O\4\0\0\344\4\0\0\200\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0l\0\0\0P\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0l\0\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0P\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0Q\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0l\0\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) , Partial, 900, ... TitleIdx=0, Type=3, Data= (108, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\16\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\10\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\31\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\5\0\0\0\0\0\0\200\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\00\0D\04\03\00\0A\06\0F\0-\00\04\01\00\0-\04\0A\06\08\0-\09\0\0\0\0\0\204\3\0\0N\4\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0l\0\0\0N\4\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0O\4\0\0\344\4\0\0\200\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0h\0\0\0`\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\240j\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\01\04\0O\4\0\0\344\4\0\0\200\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0l\0\0\0P\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0l\0\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0P\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0Q\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0l\0\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) \0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0P\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0Q\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0l\0\0\0\0\0\0\0 (108, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\16\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\10\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\31\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\5\0\0\0\0\0\0\200\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\00\0D\04\03\00\0A\06\0F\0-\00\04\01\00\0-\04\0A\06\08\0-\09\0\0\0\0\0\204\3\0\0N\4\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0l\0\0\0N\4\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0O\4\0\0\344\4\0\0\200\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0h\0\0\0`\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\240j\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\01\04\0O\4\0\0\344\4\0\0\200\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0l\0\0\0P\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0l\0\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0P\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0Q\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0l\0\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) }, 900, ) == 0x0
 01102   896   NtClose  (108, ... ) == 0x0
 01103   896   NtOpenKey  (0x20019, {24, 104, 0x40, 0, 0,  (0x20019, {24, 104, 0x40, 0, 0, "000000000014"}, ... 108, ) }, ... 108, ) == 0x0
 01104   896   NtQueryValueKey  (108,  (108, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 01105   896   NtQueryValueKey  (108,  (108, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 01106   896   NtQueryValueKey  (108,  (108, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\11\2\2\0\0\0\0\0\0\0\0\0\0\0\0\0\10\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\32\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\2\0\0\0\0\0\0\200\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\00\0D\04\03\00\0A\06\0F\0-\00\04\01\00\0-\04\0A\06\08\0-\09\0\0\0\0\0\204\3\0\0S\4\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0l\0\0\0S\4\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0T\4\0\0\344\4\0\0\200\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0h\0\0\0`\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\240j\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\01\05\0T\4\0\0\344\4\0\0\200\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0l\0\0\0U\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0l\0\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0U\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0V\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0l\0\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) , Partial, 900, ... TitleIdx=0, Type=3, Data= (108, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\11\2\2\0\0\0\0\0\0\0\0\0\0\0\0\0\10\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\32\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\2\0\0\0\0\0\0\200\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\00\0D\04\03\00\0A\06\0F\0-\00\04\01\00\0-\04\0A\06\08\0-\09\0\0\0\0\0\204\3\0\0S\4\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0l\0\0\0S\4\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0T\4\0\0\344\4\0\0\200\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0h\0\0\0`\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\240j\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\01\05\0T\4\0\0\344\4\0\0\200\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0l\0\0\0U\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0l\0\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0U\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0V\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0l\0\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) \0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0U\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0V\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0l\0\0\0\0\0\0\0 (108, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\11\2\2\0\0\0\0\0\0\0\0\0\0\0\0\0\10\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\32\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\2\0\0\0\0\0\0\200\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\00\0D\04\03\00\0A\06\0F\0-\00\04\01\00\0-\04\0A\06\08\0-\09\0\0\0\0\0\204\3\0\0S\4\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0l\0\0\0S\4\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0T\4\0\0\344\4\0\0\200\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0h\0\0\0`\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\240j\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\01\05\0T\4\0\0\344\4\0\0\200\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0l\0\0\0U\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0l\0\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0U\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0V\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0l\0\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) }, 900, ) == 0x0
 01107   896   NtClose  (108, ... ) == 0x0
 01108   896   NtOpenKey  (0x20019, {24, 104, 0x40, 0, 0,  (0x20019, {24, 104, 0x40, 0, 0, "000000000015"}, ... 108, ) }, ... 108, ) == 0x0
 01109   896   NtQueryValueKey  (108,  (108, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 01110   896   NtQueryValueKey  (108,  (108, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 01111   896   NtQueryValueKey  (108,  (108, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\16\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\33\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\5\0\0\0\377\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\08\0A\0D\04\0D\08\00\06\0-\00\08\01\0B\0-\04\04\04\06\0-\0A\0\0\0\0\0\204\3\0\0X\4\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0l\0\0\0X\4\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0Y\4\0\0\344\4\0\0\200\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0h\0\0\0`\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\240j\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\01\06\0Y\4\0\0\344\4\0\0\200\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0l\0\0\0Z\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0l\0\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0Z\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0[\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0l\0\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) , Partial, 900, ... TitleIdx=0, Type=3, Data= (108, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\16\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\33\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\5\0\0\0\377\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\08\0A\0D\04\0D\08\00\06\0-\00\08\01\0B\0-\04\04\04\06\0-\0A\0\0\0\0\0\204\3\0\0X\4\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0l\0\0\0X\4\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0Y\4\0\0\344\4\0\0\200\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0h\0\0\0`\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\240j\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\01\06\0Y\4\0\0\344\4\0\0\200\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0l\0\0\0Z\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0l\0\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0Z\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0[\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0l\0\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) \0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0Z\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0[\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0l\0\0\0\0\0\0\0 (108, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\16\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\33\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\5\0\0\0\377\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\08\0A\0D\04\0D\08\00\06\0-\00\08\01\0B\0-\04\04\04\06\0-\0A\0\0\0\0\0\204\3\0\0X\4\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0l\0\0\0X\4\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0Y\4\0\0\344\4\0\0\200\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0h\0\0\0`\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\240j\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\01\06\0Y\4\0\0\344\4\0\0\200\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0l\0\0\0Z\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0l\0\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0Z\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0[\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0l\0\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) }, 900, ) == 0x0
 01112   896   NtClose  (108, ... ) == 0x0
 01113   896   NtOpenKey  (0x20019, {24, 104, 0x40, 0, 0,  (0x20019, {24, 104, 0x40, 0, 0, "000000000016"}, ... 108, ) }, ... 108, ) == 0x0
 01114   896   NtQueryValueKey  (108,  (108, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 01115   896   NtQueryValueKey  (108,  (108, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 01116   896   NtQueryValueKey  (108,  (108, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\11\2\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\34\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\2\0\0\0\377\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\08\0A\0D\04\0D\08\00\06\0-\00\08\01\0B\0-\04\04\04\06\0-\0A\0\0\0\0\0\204\3\0\0]\4\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0l\0\0\0]\4\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0^\4\0\0\344\4\0\0\200\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0h\0\0\0`\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\240j\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\01\07\0^\4\0\0\344\4\0\0\200\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0l\0\0\0_\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0l\0\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0_\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0`\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0l\0\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) , Partial, 900, ... TitleIdx=0, Type=3, Data= (108, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\11\2\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\34\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\2\0\0\0\377\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\08\0A\0D\04\0D\08\00\06\0-\00\08\01\0B\0-\04\04\04\06\0-\0A\0\0\0\0\0\204\3\0\0]\4\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0l\0\0\0]\4\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0^\4\0\0\344\4\0\0\200\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0h\0\0\0`\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\240j\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\01\07\0^\4\0\0\344\4\0\0\200\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0l\0\0\0_\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0l\0\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0_\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0`\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0l\0\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) \0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0_\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0`\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0l\0\0\0\0\0\0\0 (108, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\11\2\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\34\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\2\0\0\0\377\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\08\0A\0D\04\0D\08\00\06\0-\00\08\01\0B\0-\04\04\04\06\0-\0A\0\0\0\0\0\204\3\0\0]\4\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0l\0\0\0]\4\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0^\4\0\0\344\4\0\0\200\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0h\0\0\0`\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\240j\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\01\07\0^\4\0\0\344\4\0\0\200\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0l\0\0\0_\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0l\0\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0_\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0`\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0l\0\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) }, 900, ) == 0x0
 01117   896   NtClose  (108, ... ) == 0x0
 01118   896   NtOpenKey  (0x20019, {24, 104, 0x40, 0, 0,  (0x20019, {24, 104, 0x40, 0, 0, "000000000017"}, ... 108, ) }, ... 108, ) == 0x0
 01119   896   NtQueryValueKey  (108,  (108, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 01120   896   NtQueryValueKey  (108,  (108, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 01121   896   NtQueryValueKey  (108,  (108, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\16\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\35\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\5\0\0\0\376\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\0E\05\05\09\0B\00\0C\01\0-\0F\0A\04\06\0-\04\06\04\0D\0-\0B\0\0\0\0\0\204\3\0\0b\4\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0l\0\0\0b\4\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0c\4\0\0\344\4\0\0\200\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0h\0\0\0`\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\240j\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\01\08\0c\4\0\0\344\4\0\0\200\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0l\0\0\0d\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0l\0\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0d\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0e\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0l\0\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) , Partial, 900, ... TitleIdx=0, Type=3, Data= (108, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\16\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\35\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\5\0\0\0\376\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\0E\05\05\09\0B\00\0C\01\0-\0F\0A\04\06\0-\04\06\04\0D\0-\0B\0\0\0\0\0\204\3\0\0b\4\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0l\0\0\0b\4\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0c\4\0\0\344\4\0\0\200\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0h\0\0\0`\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\240j\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\01\08\0c\4\0\0\344\4\0\0\200\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0l\0\0\0d\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0l\0\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0d\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0e\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0l\0\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) \0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0d\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0e\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0l\0\0\0\0\0\0\0 (108, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\16\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\35\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\5\0\0\0\376\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\0E\05\05\09\0B\00\0C\01\0-\0F\0A\04\06\0-\04\06\04\0D\0-\0B\0\0\0\0\0\204\3\0\0b\4\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0l\0\0\0b\4\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0c\4\0\0\344\4\0\0\200\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0h\0\0\0`\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\240j\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\01\08\0c\4\0\0\344\4\0\0\200\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0l\0\0\0d\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0l\0\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0d\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0e\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0l\0\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) }, 900, ) == 0x0
 01122   896   NtClose  (108, ... ) == 0x0
 01123   896   NtOpenKey  (0x20019, {24, 104, 0x40, 0, 0,  (0x20019, {24, 104, 0x40, 0, 0, "000000000018"}, ... 108, ) }, ... 108, ) == 0x0
 01124   896   NtQueryValueKey  (108,  (108, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 01125   896   NtQueryValueKey  (108,  (108, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 01126   896   NtAllocateVirtualMemory  (-1, 1355776, 0, 4096, 4096, 4, ... 1355776, 4096, ) == 0x0
 01127   896   NtQueryValueKey  (108,  (108, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\11\2\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\36\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\2\0\0\0\376\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\0E\05\05\09\0B\00\0C\01\0-\0F\0A\04\06\0-\04\06\04\0D\0-\0B\0\0\0\0\0\204\3\0\0h\4\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0l\0\0\0h\4\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0i\4\0\0\344\4\0\0\200\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0h\0\0\0`\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\240j\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\01\09\0i\4\0\0\344\4\0\0\200\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0l\0\0\0j\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0l\0\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0j\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0k\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0l\0\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) , Partial, 900, ... TitleIdx=0, Type=3, Data= (108, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\11\2\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\36\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\2\0\0\0\376\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\0E\05\05\09\0B\00\0C\01\0-\0F\0A\04\06\0-\04\06\04\0D\0-\0B\0\0\0\0\0\204\3\0\0h\4\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0l\0\0\0h\4\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0i\4\0\0\344\4\0\0\200\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0h\0\0\0`\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\240j\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\01\09\0i\4\0\0\344\4\0\0\200\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0l\0\0\0j\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0l\0\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0j\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0k\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0l\0\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) \0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0j\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0k\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0l\0\0\0\0\0\0\0 (108, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\11\2\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\36\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\2\0\0\0\376\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\0E\05\05\09\0B\00\0C\01\0-\0F\0A\04\06\0-\04\06\04\0D\0-\0B\0\0\0\0\0\204\3\0\0h\4\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0l\0\0\0h\4\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0i\4\0\0\344\4\0\0\200\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0h\0\0\0`\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\240j\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\01\09\0i\4\0\0\344\4\0\0\200\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0l\0\0\0j\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0l\0\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0j\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0k\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0l\0\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) }, 900, ) == 0x0
 01128   896   NtClose  (108, ... ) == 0x0
 01129   896   NtOpenKey  (0x20019, {24, 104, 0x40, 0, 0,  (0x20019, {24, 104, 0x40, 0, 0, "000000000019"}, ... 108, ) }, ... 108, ) == 0x0
 01130   896   NtQueryValueKey  (108,  (108, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 01131   896   NtQueryValueKey  (108,  (108, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 01132   896   NtQueryValueKey  (108,  (108, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\16\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\37\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\5\0\0\0\372\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\0C\0D\03\0C\06\04\0B\08\0-\0D\0B\07\06\0-\04\04\0C\08\0-\09\0\0\0\0\0\204\3\0\0m\4\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0l\0\0\0m\4\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0n\4\0\0\344\4\0\0\200\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0h\0\0\0`\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\240j\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\02\00\0n\4\0\0\344\4\0\0\200\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0l\0\0\0o\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0l\0\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0o\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0p\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0l\0\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) , Partial, 900, ... TitleIdx=0, Type=3, Data= (108, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\16\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\37\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\5\0\0\0\372\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\0C\0D\03\0C\06\04\0B\08\0-\0D\0B\07\06\0-\04\04\0C\08\0-\09\0\0\0\0\0\204\3\0\0m\4\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0l\0\0\0m\4\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0n\4\0\0\344\4\0\0\200\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0h\0\0\0`\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\240j\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\02\00\0n\4\0\0\344\4\0\0\200\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0l\0\0\0o\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0l\0\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0o\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0p\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0l\0\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) \0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0o\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0p\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0l\0\0\0\0\0\0\0 (108, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\16\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222\37\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\5\0\0\0\372\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\0C\0D\03\0C\06\04\0B\08\0-\0D\0B\07\06\0-\04\04\0C\08\0-\09\0\0\0\0\0\204\3\0\0m\4\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0l\0\0\0m\4\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0n\4\0\0\344\4\0\0\200\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0h\0\0\0`\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\240j\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\02\00\0n\4\0\0\344\4\0\0\200\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0l\0\0\0o\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0l\0\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0o\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0p\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0l\0\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) }, 900, ) == 0x0
 01133   896   NtClose  (108, ... ) == 0x0
 01134   896   NtOpenKey  (0x20019, {24, 104, 0x40, 0, 0,  (0x20019, {24, 104, 0x40, 0, 0, "000000000020"}, ... 108, ) }, ... 108, ) == 0x0
 01135   896   NtQueryValueKey  (108,  (108, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 01136   896   NtQueryValueKey  (108,  (108, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 01137   896   NtQueryValueKey  (108,  (108, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\11\2\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222 \4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\2\0\0\0\372\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\0C\0D\03\0C\06\04\0B\08\0-\0D\0B\07\06\0-\04\04\0C\08\0-\09\0\0\0\0\0\204\3\0\0r\4\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0l\0\0\0r\4\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0s\4\0\0\344\4\0\0\200\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0h\0\0\0`\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\240j\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\02\01\0s\4\0\0\344\4\0\0\200\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0l\0\0\0t\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0l\0\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0t\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0u\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0l\0\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) , Partial, 900, ... TitleIdx=0, Type=3, Data= (108, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\11\2\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222 \4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\2\0\0\0\372\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\0C\0D\03\0C\06\04\0B\08\0-\0D\0B\07\06\0-\04\04\0C\08\0-\09\0\0\0\0\0\204\3\0\0r\4\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0l\0\0\0r\4\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0s\4\0\0\344\4\0\0\200\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0h\0\0\0`\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\240j\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\02\01\0s\4\0\0\344\4\0\0\200\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0l\0\0\0t\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0l\0\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0t\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0u\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0l\0\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) \0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0t\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0u\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0l\0\0\0\0\0\0\0 (108, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\11\2\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222 \4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\2\0\0\0\372\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\0C\0D\03\0C\06\04\0B\08\0-\0D\0B\07\06\0-\04\04\0C\08\0-\09\0\0\0\0\0\204\3\0\0r\4\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0l\0\0\0r\4\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0s\4\0\0\344\4\0\0\200\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0h\0\0\0`\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\240j\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\02\01\0s\4\0\0\344\4\0\0\200\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0l\0\0\0t\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0l\0\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0t\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0u\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0l\0\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) }, 900, ) == 0x0
 01138   896   NtClose  (108, ... ) == 0x0
 01139   896   NtOpenKey  (0x20019, {24, 104, 0x40, 0, 0,  (0x20019, {24, 104, 0x40, 0, 0, "000000000021"}, ... 108, ) }, ... 108, ) == 0x0
 01140   896   NtQueryValueKey  (108,  (108, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 01141   896   NtQueryValueKey  (108,  (108, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 01142   896   NtQueryValueKey  (108,  (108, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\16\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222!\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\5\0\0\0\371\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\02\01\0B\08\0E\09\0D\05\0-\03\0F\0C\03\0-\04\0F\09\0D\0-\08\0\0\0\0\0\204\3\0\0w\4\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0l\0\0\0w\4\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0x\4\0\0\344\4\0\0\200\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0h\0\0\0`\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\240j\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\02\02\0x\4\0\0\344\4\0\0\200\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0l\0\0\0y\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0l\0\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0y\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0z\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0l\0\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) , Partial, 900, ... TitleIdx=0, Type=3, Data= (108, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\16\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222!\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\5\0\0\0\371\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\02\01\0B\08\0E\09\0D\05\0-\03\0F\0C\03\0-\04\0F\09\0D\0-\08\0\0\0\0\0\204\3\0\0w\4\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0l\0\0\0w\4\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0x\4\0\0\344\4\0\0\200\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0h\0\0\0`\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\240j\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\02\02\0x\4\0\0\344\4\0\0\200\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0l\0\0\0y\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0l\0\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0y\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0z\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0l\0\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) \0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0y\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0z\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0l\0\0\0\0\0\0\0 (108, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\16\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222!\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\5\0\0\0\371\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\02\01\0B\08\0E\09\0D\05\0-\03\0F\0C\03\0-\04\0F\09\0D\0-\08\0\0\0\0\0\204\3\0\0w\4\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0l\0\0\0w\4\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0x\4\0\0\344\4\0\0\200\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0H\0\0\0\31\0\2\0\0\0\0\0\30\0\0\0h\0\0\0`\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\30\0\32\0\240j\24\0\0\0\0\00\00\00\00\00\00\00\00\00\00\02\02\0x\4\0\0\344\4\0\0\200\3\0\0Q\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0l\0\0\0y\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0l\0\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0t\0e\0m\0\24\0\2\0\0\0\220\0\0\0y\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\1\0\1\0\5\0\0\200\0\0\0\0z\4\0\0\344\4\0\0\200\3\0\0\200\0\0\0\0\0\1\0\0\0\0\0@\0\0\0l\0\0\0\0\0\0\0"\0\12\2\0\354\375\177\0\0\0\0P\0a\0c\0k\0e\0d\0C\0a\0t\0a\0l\0o\0g\0I\0"}, 900, ) }, 900, ) == 0x0
 01143   896   NtClose  (108, ... ) == 0x0
 01144   896   NtOpenKey  (0x20019, {24, 104, 0x40, 0, 0,  (0x20019, {24, 104, 0x40, 0, 0, "000000000022"}, ... 108, ) }, ... 108, ) == 0x0
 01145   896   NtQueryValueKey  (108,  (108, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 01146   896   NtQueryValueKey  (108,  (108, "PackedCatalogItem", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 01147   896   NtAllocateVirtualMemory  (-1, 1359872, 0, 4096, 4096, 4, ... 1359872, 4096, ) == 0x0
 01148   896   NtQueryValueKey  (108,  (108, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\11\2\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222"\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\2\0\0\0\371\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\02\01\0B\08\0E\09\0D\05\0-\03\0F\0C\03\0-\04\0F\09\0D\0-\08\0\0\0\0\0\204\3\0\0}\4\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0l\0\0\0}\4\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0~\4\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0h\0\0\0~\4\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\177\4\0\0\344\4\0\0\200\3\0\0\305\0\0\0\0\0\1\0\0\0\0\0\24\0\0\0`\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\177\4\0\0\344\4\0\0\200\3\0\0\305\0\0\0\1\0\1\0\2\1\0\0\0\0\0\0\200\4\0\0\344\4\0\0\200\3\0\0\25\0\0\0\0\0\1\0\0\0\0\0\24\0\0\0\3\0\37\0\377\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\200\4\0\0\344\4\0\0\200\3\0\0\25\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0h\0\0\0\201\4\0\0\344\4\0\0\200\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0T\0\0\0\0\0\0\2\0\0\0\0\30\0\0\0\\0\0\0\210\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0$\0&\0X@\24\0\0\0\0\0N\0a\0m\0e\0S\0p\0a\0c\0e\0_\0C\0a\0t\0a\0l\0o\0g\05\0"}, 900, ) , Partial, 900, ... TitleIdx=0, Type=3, Data= (108, "PackedCatalogItem", Partial, 900, ... TitleIdx=0, Type=3, Data="%SystemRoot%\system32\mswsock.dll\0\26\0\10@w\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0{\1\11\0;\0\16\1X\253\26\0\10@w\16\09\01\0A\06\0F\0E\02\05\02\0D\03\0F\0B\08\0E\06\0C\0C\07\06\0C\06\03\0F\09\0B\0C\0D\04\0C\07\01\0E\0B\00\0\0\0\2404\2002\0W\14\0\14\0\317\1\15\10Q0,\6\12+\6\1\4\1\2027\2\1\31\242\36\200\34\0<\0<\0<\0O\0b\0s\0o\0l\0e\0t\0e\0>\0>\0>0!0\11\6\5+\16\3\2\32\5\11\2\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\00\30_\215s\302\317\21\225\310\0\200_H\241\222"\4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\2\0\0\0\371\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\02\01\0B\08\0E\09\0D\05\0-\03\0F\0C\03\0-\04\0F\09\0D\0-\08\0\0\0\0\0\204\3\0\0}\4\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0l\0\0\0}\4\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0~\4\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0h\0\0\0~\4\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\177\4\0\0\344\4\0\0\200\3\0\0\305\0\0\0\0\0\1\0\0\0\0\0\24\0\0\0`\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\177\4\0\0\344\4\0\0\200\3\0\0\305\0\0\0\1\0\1\0\2\1\0\0\0\0\0\0\200\4\0\0\344\4\0\0\200\3\0\0\25\0\0\0\0\0\1\0\0\0\0\0\24\0\0\0\3\0\37\0\377\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\200\4\0\0\344\4\0\0\200\3\0\0\25\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0h\0\0\0\201\4\0\0\344\4\0\0\200\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0T\0\0\0\0\0\0\2\0\0\0\0\30\0\0\0\\0\0\0\210\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0$\0&\0X@\24\0\0\0\0\0N\0a\0m\0e\0S\0p\0a\0c\0e\0_\0C\0a\0t\0a\0l\0o\0g\05\0"}, 900, ) \4\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\24\0\0\0\24\0\0\0\2\0\0\0\371\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\372\0\0\0\0\0\0M\0S\0A\0F\0D\0 \0N\0e\0t\0B\0I\0O\0S\0 \0[\0\\0D\0e\0v\0i\0c\0e\0\\0N\0e\0t\0B\0T\0_\0T\0c\0p\0i\0p\0_\0{\02\01\0B\08\0E\09\0D\05\0-\03\0F\0C\03\0-\04\0F\09\0D\0-\08\0\0\0\0\0\204\3\0\0}\4\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0l\0\0\0}\4\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0~\4\0\0\344\4\0\0\200\3\0\0\17\0\0\0\0\0\1\0\0\0\0\0\4\0\0\0h\0\0\0~\4\0\0\344\4\0\0\200\3\0\0\17\0\0\0\1\0\1\0\0\0\0\0\0\0\0\0\177\4\0\0\344\4\0\0\200\3\0\0\305\0\0\0\0\0\1\0\0\0\0\0\24\0\0\0`\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\177\4\0\0\344\4\0\0\200\3\0\0\305\0\0\0\1\0\1\0\2\1\0\0\0\0\0\0\200\4\0\0\344\4\0\0\200\3\0\0\25\0\0\0\0\0\1\0\0\0\0\0\24\0\0\0\3\0\37\0\377\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\200\4\0\0\344\4\0\0\200\3\0\0\25\0\0\0\1\0\1\0\0\0\0\0\10\0\0\0\0\0\0\0h\0\0\0\201\4\0\0\344\4\0\0\200\3\0\0Q\0\0\0\0\0\1\0\0\0\0\0T\0\0\0\0\0\0\2\0\0\0\0\30\0\0\0\\0\0\0\210\374\22\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0$\0&\0X@\24\0\0\0\0\0N\0a\0m\0e\0S\0p\0a\0c\0e\0_\0C\0a\0t\0a\0l\0o\0g\05\0"}, 900, ) == 0x0
 01149   896   NtClose  (108, ... ) == 0x0
 01150   896   NtClose  (104, ... ) == 0x0
 01151   896   NtWaitForSingleObject  (96, 0, {0, 0}, ... ) == 0x102
 01152   896   NtCreateEvent  (0x1f0003, 0x0, 0, 0, ... 104, ) == 0x0
 01153   896   NtOpenKey  (0x2000000, {24, 92, 0x40, 0, 0,  (0x2000000, {24, 92, 0x40, 0, 0, "NameSpace_Catalog5"}, ... 108, ) }, ... 108, ) == 0x0
 01154   896   NtQueryValueKey  (108,  (108, "Serial_Access_Num", Partial, 144, ... TitleIdx=0, Type=4, Data="\5\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (108, "Serial_Access_Num", Partial, 144, ... TitleIdx=0, Type=4, Data="\5\0\0\0"}, 16, ) }, 16, ) == 0x0
 01155   896   NtNotifyChangeKey  (108, 104, 0, 0, 2011455960, 1, 0, 0, 0, 1, ... ) == 0x103
 01156   896   NtQueryValueKey  (108,  (108, "Serial_Access_Num", Partial, 144, ... TitleIdx=0, Type=4, Data="\5\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (108, "Serial_Access_Num", Partial, 144, ... TitleIdx=0, Type=4, Data="\5\0\0\0"}, 16, ) }, 16, ) == 0x0
 01157   896   NtOpenKey  (0x2000000, {24, 108, 0x40, 0, 0,  (0x2000000, {24, 108, 0x40, 0, 0, "00000005"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01158   896   NtQueryValueKey  (108,  (108, "Num_Catalog_Entries", Partial, 144, ... TitleIdx=0, Type=4, Data="\4\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (108, "Num_Catalog_Entries", Partial, 144, ... TitleIdx=0, Type=4, Data="\4\0\0\0"}, 16, ) }, 16, ) == 0x0
 01159   896   NtOpenKey  (0x2000000, {24, 108, 0x40, 0, 0,  (0x2000000, {24, 108, 0x40, 0, 0, "Catalog_Entries"}, ... 112, ) }, ... 112, ) == 0x0
 01160   896   NtOpenKey  (0x20019, {24, 112, 0x40, 0, 0,  (0x20019, {24, 112, 0x40, 0, 0, "000000000001"}, ... 116, ) }, ... 116, ) == 0x0
 01161   896   NtQueryValueKey  (116,  (116, "LibraryPath", Partial, 144, ... TitleIdx=0, Type=1, Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0m\0s\0w\0s\0o\0c\0k\0.\0d\0l\0l\0\0\0"}, 80, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (116, "LibraryPath", Partial, 144, ... TitleIdx=0, Type=1, Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0m\0s\0w\0s\0o\0c\0k\0.\0d\0l\0l\0\0\0"}, 80, ) }, 80, ) == 0x0
 01162   896   NtQueryValueKey  (116,  (116, "LibraryPath", Partial, 144, ... TitleIdx=0, Type=1, Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0m\0s\0w\0s\0o\0c\0k\0.\0d\0l\0l\0\0\0"}, 80, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (116, "LibraryPath", Partial, 144, ... TitleIdx=0, Type=1, Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0m\0s\0w\0s\0o\0c\0k\0.\0d\0l\0l\0\0\0"}, 80, ) }, 80, ) == 0x0
 01163   896   NtQueryValueKey  (116,  (116, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="T\0c\0p\0i\0p\0\0\0"}, 24, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (116, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="T\0c\0p\0i\0p\0\0\0"}, 24, ) }, 24, ) == 0x0
 01164   896   NtQueryValueKey  (116,  (116, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="T\0c\0p\0i\0p\0\0\0"}, 24, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (116, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="T\0c\0p\0i\0p\0\0\0"}, 24, ) }, 24, ) == 0x0
 01165   896   NtQueryValueKey  (116,  (116, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="T\0c\0p\0i\0p\0\0\0"}, 24, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (116, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="T\0c\0p\0i\0p\0\0\0"}, 24, ) }, 24, ) == 0x0
 01166   896   NtQueryValueKey  (116,  (116, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="T\0c\0p\0i\0p\0\0\0"}, 24, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (116, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="T\0c\0p\0i\0p\0\0\0"}, 24, ) }, 24, ) == 0x0
 01167   896   NtQueryValueKey  (116,  (116, "ProviderId", Partial, 144, ... TitleIdx=0, Type=3, Data="@\235\5"\236~\317\21\256Z\0\252\0\247\21+"}, 28, ) , Partial, 144, ... TitleIdx=0, Type=3, Data= (116, "ProviderId", Partial, 144, ... TitleIdx=0, Type=3, Data="@\235\5"\236~\317\21\256Z\0\252\0\247\21+"}, 28, ) \236~\317\21\256Z\0\252\0\247\21+"}, 28, ) == 0x0
 01168   896   NtQueryValueKey  (116,  (116, "AddressFamily", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01169   896   NtQueryValueKey  (116,  (116, "SupportedNameSpace", Partial, 144, ... TitleIdx=0, Type=4, Data="\14\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (116, "SupportedNameSpace", Partial, 144, ... TitleIdx=0, Type=4, Data="\14\0\0\0"}, 16, ) }, 16, ) == 0x0
 01170   896   NtQueryValueKey  (116,  (116, "Enabled", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (116, "Enabled", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) }, 16, ) == 0x0
 01171   896   NtQueryValueKey  (116,  (116, "Version", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (116, "Version", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) }, 16, ) == 0x0
 01172   896   NtQueryValueKey  (116,  (116, "StoresServiceClassInfo", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (116, "StoresServiceClassInfo", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) }, 16, ) == 0x0
 01173   896   NtClose  (116, ... ) == 0x0
 01174   896   NtOpenKey  (0x20019, {24, 112, 0x40, 0, 0,  (0x20019, {24, 112, 0x40, 0, 0, "000000000002"}, ... 116, ) }, ... 116, ) == 0x0
 01175   896   NtQueryValueKey  (116,  (116, "LibraryPath", Partial, 144, ... TitleIdx=0, Type=1, Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0w\0i\0n\0r\0n\0r\0.\0d\0l\0l\0\0\0"}, 78, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (116, "LibraryPath", Partial, 144, ... TitleIdx=0, Type=1, Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0w\0i\0n\0r\0n\0r\0.\0d\0l\0l\0\0\0"}, 78, ) }, 78, ) == 0x0
 01176   896   NtQueryValueKey  (116,  (116, "LibraryPath", Partial, 144, ... TitleIdx=0, Type=1, Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0w\0i\0n\0r\0n\0r\0.\0d\0l\0l\0\0\0"}, 78, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (116, "LibraryPath", Partial, 144, ... TitleIdx=0, Type=1, Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0w\0i\0n\0r\0n\0r\0.\0d\0l\0l\0\0\0"}, 78, ) }, 78, ) == 0x0
 01177   896   NtQueryValueKey  (116,  (116, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="N\0T\0D\0S\0\0\0"}, 22, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (116, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="N\0T\0D\0S\0\0\0"}, 22, ) }, 22, ) == 0x0
 01178   896   NtQueryValueKey  (116,  (116, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="N\0T\0D\0S\0\0\0"}, 22, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (116, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="N\0T\0D\0S\0\0\0"}, 22, ) }, 22, ) == 0x0
 01179   896   NtQueryValueKey  (116,  (116, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="N\0T\0D\0S\0\0\0"}, 22, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (116, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="N\0T\0D\0S\0\0\0"}, 22, ) }, 22, ) == 0x0
 01180   896   NtQueryValueKey  (116,  (116, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="N\0T\0D\0S\0\0\0"}, 22, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (116, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="N\0T\0D\0S\0\0\0"}, 22, ) }, 22, ) == 0x0
 01181   896   NtQueryValueKey  (116,  (116, "ProviderId", Partial, 144, ... TitleIdx=0, Type=3, Data="\3567&;\200\345\317\21\245U\0\300O\330\324\254"}, 28, ) , Partial, 144, ... TitleIdx=0, Type=3, Data= (116, "ProviderId", Partial, 144, ... TitleIdx=0, Type=3, Data="\3567&;\200\345\317\21\245U\0\300O\330\324\254"}, 28, ) }, 28, ) == 0x0
 01182   896   NtQueryValueKey  (116,  (116, "AddressFamily", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01183   896   NtQueryValueKey  (116,  (116, "SupportedNameSpace", Partial, 144, ... TitleIdx=0, Type=4, Data=" \0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (116, "SupportedNameSpace", Partial, 144, ... TitleIdx=0, Type=4, Data=" \0\0\0"}, 16, ) }, 16, ) == 0x0
 01184   896   NtQueryValueKey  (116,  (116, "Enabled", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (116, "Enabled", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) }, 16, ) == 0x0
 01185   896   NtQueryValueKey  (116,  (116, "Version", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (116, "Version", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) }, 16, ) == 0x0
 01186   896   NtQueryValueKey  (116,  (116, "StoresServiceClassInfo", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (116, "StoresServiceClassInfo", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) }, 16, ) == 0x0
 01187   896   NtClose  (116, ... ) == 0x0
 01188   896   NtOpenKey  (0x20019, {24, 112, 0x40, 0, 0,  (0x20019, {24, 112, 0x40, 0, 0, "000000000003"}, ... 116, ) }, ... 116, ) == 0x0
 01189   896   NtQueryValueKey  (116,  (116, "LibraryPath", Partial, 144, ... TitleIdx=0, Type=1, Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0m\0s\0w\0s\0o\0c\0k\0.\0d\0l\0l\0\0\0"}, 80, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (116, "LibraryPath", Partial, 144, ... TitleIdx=0, Type=1, Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0m\0s\0w\0s\0o\0c\0k\0.\0d\0l\0l\0\0\0"}, 80, ) }, 80, ) == 0x0
 01190   896   NtQueryValueKey  (116,  (116, "LibraryPath", Partial, 144, ... TitleIdx=0, Type=1, Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0m\0s\0w\0s\0o\0c\0k\0.\0d\0l\0l\0\0\0"}, 80, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (116, "LibraryPath", Partial, 144, ... TitleIdx=0, Type=1, Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0m\0s\0w\0s\0o\0c\0k\0.\0d\0l\0l\0\0\0"}, 80, ) }, 80, ) == 0x0
 01191   896   NtQueryValueKey  (116,  (116, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="N\0e\0t\0w\0o\0r\0k\0 \0L\0o\0c\0a\0t\0i\0o\0n\0 \0A\0w\0a\0r\0e\0n\0e\0s\0s\0 \0(\0N\0L\0A\0)\0 \0N\0a\0m\0e\0s\0p\0a\0c\0e\0\0\0"}, 98, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (116, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="N\0e\0t\0w\0o\0r\0k\0 \0L\0o\0c\0a\0t\0i\0o\0n\0 \0A\0w\0a\0r\0e\0n\0e\0s\0s\0 \0(\0N\0L\0A\0)\0 \0N\0a\0m\0e\0s\0p\0a\0c\0e\0\0\0"}, 98, ) }, 98, ) == 0x0
 01192   896   NtQueryValueKey  (116,  (116, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="N\0e\0t\0w\0o\0r\0k\0 \0L\0o\0c\0a\0t\0i\0o\0n\0 \0A\0w\0a\0r\0e\0n\0e\0s\0s\0 \0(\0N\0L\0A\0)\0 \0N\0a\0m\0e\0s\0p\0a\0c\0e\0\0\0"}, 98, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (116, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="N\0e\0t\0w\0o\0r\0k\0 \0L\0o\0c\0a\0t\0i\0o\0n\0 \0A\0w\0a\0r\0e\0n\0e\0s\0s\0 \0(\0N\0L\0A\0)\0 \0N\0a\0m\0e\0s\0p\0a\0c\0e\0\0\0"}, 98, ) }, 98, ) == 0x0
 01193   896   NtQueryValueKey  (116,  (116, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="N\0e\0t\0w\0o\0r\0k\0 \0L\0o\0c\0a\0t\0i\0o\0n\0 \0A\0w\0a\0r\0e\0n\0e\0s\0s\0 \0(\0N\0L\0A\0)\0 \0N\0a\0m\0e\0s\0p\0a\0c\0e\0\0\0"}, 98, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (116, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="N\0e\0t\0w\0o\0r\0k\0 \0L\0o\0c\0a\0t\0i\0o\0n\0 \0A\0w\0a\0r\0e\0n\0e\0s\0s\0 \0(\0N\0L\0A\0)\0 \0N\0a\0m\0e\0s\0p\0a\0c\0e\0\0\0"}, 98, ) }, 98, ) == 0x0
 01194   896   NtQueryValueKey  (116,  (116, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="N\0e\0t\0w\0o\0r\0k\0 \0L\0o\0c\0a\0t\0i\0o\0n\0 \0A\0w\0a\0r\0e\0n\0e\0s\0s\0 \0(\0N\0L\0A\0)\0 \0N\0a\0m\0e\0s\0p\0a\0c\0e\0\0\0"}, 98, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (116, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="N\0e\0t\0w\0o\0r\0k\0 \0L\0o\0c\0a\0t\0i\0o\0n\0 \0A\0w\0a\0r\0e\0n\0e\0s\0s\0 \0(\0N\0L\0A\0)\0 \0N\0a\0m\0e\0s\0p\0a\0c\0e\0\0\0"}, 98, ) }, 98, ) == 0x0
 01195   896   NtQueryValueKey  (116,  (116, "ProviderId", Partial, 144, ... TitleIdx=0, Type=3, Data=":$Bf\250;\246J\272\245.\13\327\37\335\203"}, 28, ) , Partial, 144, ... TitleIdx=0, Type=3, Data= (116, "ProviderId", Partial, 144, ... TitleIdx=0, Type=3, Data=":$Bf\250;\246J\272\245.\13\327\37\335\203"}, 28, ) }, 28, ) == 0x0
 01196   896   NtQueryValueKey  (116,  (116, "AddressFamily", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01197   896   NtQueryValueKey  (116,  (116, "SupportedNameSpace", Partial, 144, ... TitleIdx=0, Type=4, Data="\17\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (116, "SupportedNameSpace", Partial, 144, ... TitleIdx=0, Type=4, Data="\17\0\0\0"}, 16, ) }, 16, ) == 0x0
 01198   896   NtQueryValueKey  (116,  (116, "Enabled", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (116, "Enabled", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) }, 16, ) == 0x0
 01199   896   NtQueryValueKey  (116,  (116, "Version", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (116, "Version", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) }, 16, ) == 0x0
 01200   896   NtQueryValueKey  (116,  (116, "StoresServiceClassInfo", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (116, "StoresServiceClassInfo", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) }, 16, ) == 0x0
 01201   896   NtClose  (116, ... ) == 0x0
 01202   896   NtOpenKey  (0x20019, {24, 112, 0x40, 0, 0,  (0x20019, {24, 112, 0x40, 0, 0, "000000000004"}, ... 116, ) }, ... 116, ) == 0x0
 01203   896   NtQueryValueKey  (116,  (116, "LibraryPath", Partial, 144, ... TitleIdx=0, Type=1, Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0s\0y\0s\0t\0e\0m\03\02\0\\0w\0s\0h\0b\0t\0h\0.\0d\0l\0l\0\0\0"}, 78, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (116, "LibraryPath", Partial, 144, ... TitleIdx=0, Type=1, Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0s\0y\0s\0t\0e\0m\03\02\0\\0w\0s\0h\0b\0t\0h\0.\0d\0l\0l\0\0\0"}, 78, ) }, 78, ) == 0x0
 01204   896   NtQueryValueKey  (116,  (116, "LibraryPath", Partial, 144, ... TitleIdx=0, Type=1, Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0s\0y\0s\0t\0e\0m\03\02\0\\0w\0s\0h\0b\0t\0h\0.\0d\0l\0l\0\0\0"}, 78, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (116, "LibraryPath", Partial, 144, ... TitleIdx=0, Type=1, Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0s\0y\0s\0t\0e\0m\03\02\0\\0w\0s\0h\0b\0t\0h\0.\0d\0l\0l\0\0\0"}, 78, ) }, 78, ) == 0x0
 01205   896   NtQueryValueKey  (116,  (116, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="B\0l\0u\0e\0t\0o\0o\0t\0h\0 \0N\0a\0m\0e\0s\0p\0a\0c\0e\0\0\0"}, 52, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (116, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="B\0l\0u\0e\0t\0o\0o\0t\0h\0 \0N\0a\0m\0e\0s\0p\0a\0c\0e\0\0\0"}, 52, ) }, 52, ) == 0x0
 01206   896   NtQueryValueKey  (116,  (116, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="B\0l\0u\0e\0t\0o\0o\0t\0h\0 \0N\0a\0m\0e\0s\0p\0a\0c\0e\0\0\0"}, 52, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (116, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="B\0l\0u\0e\0t\0o\0o\0t\0h\0 \0N\0a\0m\0e\0s\0p\0a\0c\0e\0\0\0"}, 52, ) }, 52, ) == 0x0
 01207   896   NtQueryValueKey  (116,  (116, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="B\0l\0u\0e\0t\0o\0o\0t\0h\0 \0N\0a\0m\0e\0s\0p\0a\0c\0e\0\0\0"}, 52, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (116, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="B\0l\0u\0e\0t\0o\0o\0t\0h\0 \0N\0a\0m\0e\0s\0p\0a\0c\0e\0\0\0"}, 52, ) }, 52, ) == 0x0
 01208   896   NtQueryValueKey  (116,  (116, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="B\0l\0u\0e\0t\0o\0o\0t\0h\0 \0N\0a\0m\0e\0s\0p\0a\0c\0e\0\0\0"}, 52, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (116, "DisplayString", Partial, 144, ... TitleIdx=0, Type=1, Data="B\0l\0u\0e\0t\0o\0o\0t\0h\0 \0N\0a\0m\0e\0s\0p\0a\0c\0e\0\0\0"}, 52, ) }, 52, ) == 0x0
 01209   896   NtQueryValueKey  (116,  (116, "ProviderId", Partial, 144, ... TitleIdx=0, Type=3, Data="\340c\252\6`}\377A\257\262>\346\322\3319-"}, 28, ) , Partial, 144, ... TitleIdx=0, Type=3, Data= (116, "ProviderId", Partial, 144, ... TitleIdx=0, Type=3, Data="\340c\252\6`}\377A\257\262>\346\322\3319-"}, 28, ) }, 28, ) == 0x0
 01210   896   NtQueryValueKey  (116,  (116, "AddressFamily", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01211   896   NtQueryValueKey  (116,  (116, "SupportedNameSpace", Partial, 144, ... TitleIdx=0, Type=4, Data="\20\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (116, "SupportedNameSpace", Partial, 144, ... TitleIdx=0, Type=4, Data="\20\0\0\0"}, 16, ) }, 16, ) == 0x0
 01212   896   NtQueryValueKey  (116,  (116, "Enabled", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (116, "Enabled", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) }, 16, ) == 0x0
 01213   896   NtQueryValueKey  (116,  (116, "Version", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (116, "Version", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) }, 16, ) == 0x0
 01214   896   NtQueryValueKey  (116,  (116, "StoresServiceClassInfo", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (116, "StoresServiceClassInfo", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) }, 16, ) == 0x0
 01215   896   NtClose  (116, ... ) == 0x0
 01216   896   NtClose  (112, ... ) == 0x0
 01217   896   NtWaitForSingleObject  (104, 0, {0, 0}, ... ) == 0x102
 01218   896   NtClose  (92, ... ) == 0x0
 01219   896   NtQuerySystemInformation  (Basic, 44, ... {Unknown=0,MaximumIncrement=156250,PhysicalPageSize=0x1000,NumberOfPhysicalPages=0xff7c,LowestPhysicalPage=0x1,HighestPhysicalPage=0xffff,AllocationGranularity=0x10000,LowestUserAddress=0x10000,HighestUserAddress=0x7ffeffff,ActiveProcessors=1,NumberProcessors=1,}, 0x0, ) == 0x0
 01220   896   NtQuerySystemInformation  (Processor, 12, ... {system info, class 1, size 12}, 0x0, ) == 0x0
 01221   896   NtOpenKey  (0x1, {24, 40, 0x40, 0, 0,  (0x1, {24, 40, 0x40, 0, 0, "System\CurrentControlSet\Services\Winsock2\Parameters"}, ... 92, ) }, ... 92, ) == 0x0
 01222   896   NtQueryValueKey  (92,  (92, "Ws2_32NumHandleBuckets", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01223   896   NtClose  (92, ... ) == 0x0
 01224   896   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ... 92, ) == 0x0
 01225   896   NtAllocateVirtualMemory  (-1, 1363968, 0, 4096, 4096, 4, ... 1363968, 4096, ) == 0x0
 01226   896   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\U:\WORK\PACKED.EXE"}, 1241400, ... ) }, 1241400, ... ) == 0x0
 01227   896   NtOpenFile  (0x100100, {24, 0, 0x40, 0, 0,  (0x100100, {24, 0, 0x40, 0, 0, "\??\U:\WORK\PACKED.EXE"}, 7, 2113568, ... 112, {status=0x0, info=1}, ) }, 7, 2113568, ... 112, {status=0x0, info=1}, ) == 0x0
 01228   896   NtSetInformationFile  (112, 1241376, 40, Basic, ... ) == STATUS_ACCESS_DENIED
 01229   896   NtClose  (112, ... ) == 0x0
 01230   896   NtOpenProcessToken  (-1, 0x28, ... 112, ) == 0x0
 01231   896   NtOpenThreadToken  (-2, 0xc, 1, ... ) == STATUS_NO_TOKEN
 01232   896   NtCreateEvent  (0x1f0003, 0x0, 1, 0, ... 116, ) == 0x0
 01233   896   NtOpenThreadToken  (-2, 0xc, 1, ... ) == STATUS_NO_TOKEN
 01234   896   NtSetInformationThread  (-2, ImpersonationToken, {ImpToken=0,}, 4, ... ) == 0x0
 01235   896   NtCreateFile  (0xc0100080, {24, 0, 0x40, 0, 1239628,  (0xc0100080, {24, 0, 0x40, 0, 1239628, "\??\PIPE\lsarpc"}, 0x0, 0, 3, 1, 64, 0, 0, ... 120, {status=0x0, info=1}, ) }, 0x0, 0, 3, 1, 64, 0, 0, ... 120, {status=0x0, info=1}, ) == 0x0
 01236   896   NtSetInformationFile  (120, 1239684, 8, Pipe, ... {status=0x0, info=0}, ) == 0x0
 01237   896   NtSetInformationFile  (120, 1239672, 8, Completion, ... {status=0x0, info=0}, ) == 0x0
 01238   896   NtSetInformationThread  (-2, ImpersonationToken, {ImpToken=0,}, 4, ... ) == 0x0
 01239   896   NtWriteFile  (120, 57, 0, 0,  (120, 57, 0, 0, "\5\0\13\3\20\0\0\0H\0\0\0\1\0\0\0\270\20\270\20\0\0\0\0\1\0\0\0\0\0\1\0xW4\224\22\315\253\357\0\1#Eg\211\253\0\0\0\0\4]\210\212\353\34\311\21\237\350\10\0+\20H`\2\0\0\0", 72, {0, 0}, 0, ... {status=0x0, info=72}, ) , 72, {0, 0}, 0, ... {status=0x0, info=72}, ) == 0x0
 01240   896   NtReadFile  (120, 57, 0, 0, 1024, {0, 0}, 0, ... {status=0x0, info=68},  (120, 57, 0, 0, 1024, {0, 0}, 0, ... {status=0x0, info=68}, "\5\0\14\3\20\0\0\0D\0\0\0\1\0\0\0\270\20\270\20m+\0\0\14\0\PIPE\lsass\0\0\0\1\0\0\0\0\0\0\0\4]\210\212\353\34\311\21\237\350\10\0+\20H`\2\0\0\0", ) , ) == 0x0
 01241   896   NtFsControlFile  (120, 57, 0x0, 0x0, 0x11c017,  (120, 57, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0@\0\0\0\1\0\0\0(\0\0\0\0\0,\0\0\0\0\0\30\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\24\361\22\0\14\0\0\0\2\0\1\0\0\10\0\0", 64, 1024, ... {status=0x103, info=68}, "\5\0\14\3\20\0\0\0D\0\0\0\1\0\0\0\270\20\270\20m+\0\0\14\0\PIPE\lsass\0\0\0\1\0\0\0\0\0\0\0\4]\210\212\353\34\311\21\237\350\10\0+\20H`\2\0\0\0", ) , 64, 1024, ... {status=0x103, info=68},  (120, 57, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0@\0\0\0\1\0\0\0(\0\0\0\0\0,\0\0\0\0\0\30\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\24\361\22\0\14\0\0\0\2\0\1\0\0\10\0\0", 64, 1024, ... {status=0x103, info=68}, "\5\0\14\3\20\0\0\0D\0\0\0\1\0\0\0\270\20\270\20m+\0\0\14\0\PIPE\lsass\0\0\0\1\0\0\0\0\0\0\0\4]\210\212\353\34\311\21\237\350\10\0+\20H`\2\0\0\0", ) , ) == 0x103
 01242   896   NtFsControlFile  (120, 57, 0x0, 0x0, 0x11c017,  (120, 57, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0p\0\0\0\2\0\0\0X\0\0\0\0\0\37\0\0\0\0\0\1xH\376\32\235JO\235\342d\324\312\304\340\3510\02\0\250I\24\0\31\0\0\0\0\0\0\0\30\0\0\0S\0e\0T\0a\0k\0e\0O\0w\0n\0e\0r\0s\0h\0i\0p\0P\0r\0i\0v\0i\0l\0e\0g\0e\0", 112, 1024, ... {status=0x103, info=48}, "\5\0\2\3\20\0\0\00\0\0\0\1\0\0\0\30\0\0\0\0\0\0\0\0\0\0\0\1xH\376\32\235JO\235\342d\324\312\304\340\351\0\0\0\0", ) , 112, 1024, ... {status=0x103, info=48},  (120, 57, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0p\0\0\0\2\0\0\0X\0\0\0\0\0\37\0\0\0\0\0\1xH\376\32\235JO\235\342d\324\312\304\340\3510\02\0\250I\24\0\31\0\0\0\0\0\0\0\30\0\0\0S\0e\0T\0a\0k\0e\0O\0w\0n\0e\0r\0s\0h\0i\0p\0P\0r\0i\0v\0i\0l\0e\0g\0e\0", 112, 1024, ... {status=0x103, info=48}, "\5\0\2\3\20\0\0\00\0\0\0\1\0\0\0\30\0\0\0\0\0\0\0\0\0\0\0\1xH\376\32\235JO\235\342d\324\312\304\340\351\0\0\0\0", ) , ) == 0x103
 01243   896   NtFsControlFile  (120, 57, 0x0, 0x0, 0x11c017,  (120, 57, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0,\0\0\0\3\0\0\0\24\0\0\0\0\0\0\0\0\0\0\0\1xH\376\32\235JO\235\342d\324\312\304\340\351", 44, 1024, ... {status=0x103, info=36}, "\5\0\2\3\20\0\0\0$\0\0\0\2\0\0\0\14\0\0\0\0\0\0\0\11\0\0\0\0\0\0\0\0\0\0\0", ) , 44, 1024, ... {status=0x103, info=36},  (120, 57, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0,\0\0\0\3\0\0\0\24\0\0\0\0\0\0\0\0\0\0\0\1xH\376\32\235JO\235\342d\324\312\304\340\351", 44, 1024, ... {status=0x103, info=36}, "\5\0\2\3\20\0\0\0$\0\0\0\2\0\0\0\14\0\0\0\0\0\0\0\11\0\0\0\0\0\0\0\0\0\0\0", ) , ) == 0x103
 01244   896   NtClose  (116, ... ) == 0x0
 01245   896   NtClose  (120, ... ) == 0x0
 01246   896   NtAdjustPrivilegesToken  (112, 0, 1241472, 0, 0, 0, ... ) == 0x0
 01247   896   NtOpenThreadToken  (-2, 0xc, 1, ... ) == STATUS_NO_TOKEN
 01248   896   NtCreateEvent  (0x1f0003, 0x0, 1, 0, ... 120, ) == 0x0
 01249   896   NtOpenThreadToken  (-2, 0xc, 1, ... ) == STATUS_NO_TOKEN
 01250   896   NtSetInformationThread  (-2, ImpersonationToken, {ImpToken=0,}, 4, ... ) == 0x0
 01251   896   NtCreateFile  (0xc0100080, {24, 0, 0x40, 0, 1239628,  (0xc0100080, {24, 0, 0x40, 0, 1239628, "\??\PIPE\lsarpc"}, 0x0, 0, 3, 1, 64, 0, 0, ... 116, {status=0x0, info=1}, ) }, 0x0, 0, 3, 1, 64, 0, 0, ... 116, {status=0x0, info=1}, ) == 0x0
 01252   896   NtSetInformationFile  (116, 1239684, 8, Pipe, ... {status=0x0, info=0}, ) == 0x0
 01253   896   NtSetInformationFile  (116, 1239672, 8, Completion, ... {status=0x0, info=0}, ) == 0x0
 01254   896   NtSetInformationThread  (-2, ImpersonationToken, {ImpToken=0,}, 4, ... ) == 0x0
 01255   896   NtWriteFile  (116, 57, 0, 0,  (116, 57, 0, 0, "\5\0\13\3\20\0\0\0H\0\0\0\1\0\0\0\270\20\270\20\0\0\0\0\1\0\0\0\0\0\1\0xW4\224\22\315\253\357\0\1#Eg\211\253\0\0\0\0\4]\210\212\353\34\311\21\237\350\10\0+\20H`\2\0\0\0", 72, {0, 0}, 0, ... {status=0x0, info=72}, ) , 72, {0, 0}, 0, ... {status=0x0, info=72}, ) == 0x0
 01256   896   NtReadFile  (116, 57, 0, 0, 1024, {0, 0}, 0, ... {status=0x0, info=68},  (116, 57, 0, 0, 1024, {0, 0}, 0, ... {status=0x0, info=68}, "\5\0\14\3\20\0\0\0D\0\0\0\1\0\0\0\270\20\270\20n+\0\0\14\0\PIPE\lsass\0\0\0\1\0\0\0\0\0\0\0\4]\210\212\353\34\311\21\237\350\10\0+\20H`\2\0\0\0", ) , ) == 0x0
 01257   896   NtFsControlFile  (116, 57, 0x0, 0x0, 0x11c017,  (116, 57, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0@\0\0\0\1\0\0\0(\0\0\0\0\0,\0\0\0\0\0\30\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\24\361\22\0\14\0\0\0\2\0\1\0\0\10\0\0", 64, 1024, ... {status=0x103, info=68}, "\5\0\14\3\20\0\0\0D\0\0\0\1\0\0\0\270\20\270\20n+\0\0\14\0\PIPE\lsass\0\0\0\1\0\0\0\0\0\0\0\4]\210\212\353\34\311\21\237\350\10\0+\20H`\2\0\0\0", ) , 64, 1024, ... {status=0x103, info=68},  (116, 57, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0@\0\0\0\1\0\0\0(\0\0\0\0\0,\0\0\0\0\0\30\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\24\361\22\0\14\0\0\0\2\0\1\0\0\10\0\0", 64, 1024, ... {status=0x103, info=68}, "\5\0\14\3\20\0\0\0D\0\0\0\1\0\0\0\270\20\270\20n+\0\0\14\0\PIPE\lsass\0\0\0\1\0\0\0\0\0\0\0\4]\210\212\353\34\311\21\237\350\10\0+\20H`\2\0\0\0", ) , ) == 0x103
 01258   896   NtFsControlFile  (116, 57, 0x0, 0x0, 0x11c017,  (116, 57, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0d\0\0\0\2\0\0\0L\0\0\0\0\0\37\0\0\0\0\0.t\201\271\16\305\352A\2679V\220\326\355\16\23$\0&\0\20\313\24\0\23\0\0\0\0\0\0\0\22\0\0\0S\0e\0R\0e\0s\0t\0o\0r\0e\0P\0r\0i\0v\0i\0l\0e\0g\0e\0", 100, 1024, ... {status=0x103, info=48}, "\5\0\2\3\20\0\0\00\0\0\0\1\0\0\0\30\0\0\0\0\0\0\0\0\0\0\0.t\201\271\16\305\352A\2679V\220\326\355\16\23\0\0\0\0", ) , 100, 1024, ... {status=0x103, info=48},  (116, 57, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0d\0\0\0\2\0\0\0L\0\0\0\0\0\37\0\0\0\0\0.t\201\271\16\305\352A\2679V\220\326\355\16\23$\0&\0\20\313\24\0\23\0\0\0\0\0\0\0\22\0\0\0S\0e\0R\0e\0s\0t\0o\0r\0e\0P\0r\0i\0v\0i\0l\0e\0g\0e\0", 100, 1024, ... {status=0x103, info=48}, "\5\0\2\3\20\0\0\00\0\0\0\1\0\0\0\30\0\0\0\0\0\0\0\0\0\0\0.t\201\271\16\305\352A\2679V\220\326\355\16\23\0\0\0\0", ) , ) == 0x103
 01259   896   NtFsControlFile  (116, 57, 0x0, 0x0, 0x11c017,  (116, 57, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0,\0\0\0\3\0\0\0\24\0\0\0\0\0\0\0\0\0\0\0.t\201\271\16\305\352A\2679V\220\326\355\16\23", 44, 1024, ... {status=0x103, info=36}, "\5\0\2\3\20\0\0\0$\0\0\0\2\0\0\0\14\0\0\0\0\0\0\0\22\0\0\0\0\0\0\0\0\0\0\0", ) , 44, 1024, ... {status=0x103, info=36},  (116, 57, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0,\0\0\0\3\0\0\0\24\0\0\0\0\0\0\0\0\0\0\0.t\201\271\16\305\352A\2679V\220\326\355\16\23", 44, 1024, ... {status=0x103, info=36}, "\5\0\2\3\20\0\0\0$\0\0\0\2\0\0\0\14\0\0\0\0\0\0\0\22\0\0\0\0\0\0\0\0\0\0\0", ) , ) == 0x103
 01260   896   NtClose  (120, ... ) == 0x0
 01261   896   NtClose  (116, ... ) == 0x0
 01262   896   NtAdjustPrivilegesToken  (112, 0, 1241472, 0, 0, 0, ... ) == 0x0
 01263   896   NtOpenThreadToken  (-2, 0xc, 1, ... ) == STATUS_NO_TOKEN
 01264   896   NtCreateEvent  (0x1f0003, 0x0, 1, 0, ... 116, ) == 0x0
 01265   896   NtOpenThreadToken  (-2, 0xc, 1, ... ) == STATUS_NO_TOKEN
 01266   896   NtSetInformationThread  (-2, ImpersonationToken, {ImpToken=0,}, 4, ... ) == 0x0
 01267   896   NtCreateFile  (0xc0100080, {24, 0, 0x40, 0, 1239628,  (0xc0100080, {24, 0, 0x40, 0, 1239628, "\??\PIPE\lsarpc"}, 0x0, 0, 3, 1, 64, 0, 0, ... 120, {status=0x0, info=1}, ) }, 0x0, 0, 3, 1, 64, 0, 0, ... 120, {status=0x0, info=1}, ) == 0x0
 01268   896   NtSetInformationFile  (120, 1239684, 8, Pipe, ... {status=0x0, info=0}, ) == 0x0
 01269   896   NtSetInformationFile  (120, 1239672, 8, Completion, ... {status=0x0, info=0}, ) == 0x0
 01270   896   NtSetInformationThread  (-2, ImpersonationToken, {ImpToken=0,}, 4, ... ) == 0x0
 01271   896   NtWriteFile  (120, 57, 0, 0,  (120, 57, 0, 0, "\5\0\13\3\20\0\0\0H\0\0\0\1\0\0\0\270\20\270\20\0\0\0\0\1\0\0\0\0\0\1\0xW4\224\22\315\253\357\0\1#Eg\211\253\0\0\0\0\4]\210\212\353\34\311\21\237\350\10\0+\20H`\2\0\0\0", 72, {0, 0}, 0, ... {status=0x0, info=72}, ) , 72, {0, 0}, 0, ... {status=0x0, info=72}, ) == 0x0
 01272   896   NtReadFile  (120, 57, 0, 0, 1024, {0, 0}, 0, ... {status=0x0, info=68},  (120, 57, 0, 0, 1024, {0, 0}, 0, ... {status=0x0, info=68}, "\5\0\14\3\20\0\0\0D\0\0\0\1\0\0\0\270\20\270\20o+\0\0\14\0\PIPE\lsass\0\0\0\1\0\0\0\0\0\0\0\4]\210\212\353\34\311\21\237\350\10\0+\20H`\2\0\0\0", ) , ) == 0x0
 01273   896   NtFsControlFile  (120, 57, 0x0, 0x0, 0x11c017,  (120, 57, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0@\0\0\0\1\0\0\0(\0\0\0\0\0,\0\0\0\0\0\30\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\24\361\22\0\14\0\0\0\2\0\1\0\0\10\0\0", 64, 1024, ... {status=0x103, info=68}, "\5\0\14\3\20\0\0\0D\0\0\0\1\0\0\0\270\20\270\20o+\0\0\14\0\PIPE\lsass\0\0\0\1\0\0\0\0\0\0\0\4]\210\212\353\34\311\21\237\350\10\0+\20H`\2\0\0\0", ) , 64, 1024, ... {status=0x103, info=68},  (120, 57, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0@\0\0\0\1\0\0\0(\0\0\0\0\0,\0\0\0\0\0\30\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\24\361\22\0\14\0\0\0\2\0\1\0\0\10\0\0", 64, 1024, ... {status=0x103, info=68}, "\5\0\14\3\20\0\0\0D\0\0\0\1\0\0\0\270\20\270\20o+\0\0\14\0\PIPE\lsass\0\0\0\1\0\0\0\0\0\0\0\4]\210\212\353\34\311\21\237\350\10\0+\20H`\2\0\0\0", ) , ) == 0x103
 01274   896   NtFsControlFile  (120, 57, 0x0, 0x0, 0x11c017,  (120, 57, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0b\0\0\0\2\0\0\0J\0\0\0\0\0\37\0\0\0\0\07\237y\212\234J\353N\250\27\371L\264\213S-"\0$\0\20\313\24\0\22\0\0\0\0\0\0\0\21\0\0\0S\0e\0B\0a\0c\0k\0u\0p\0P\0r\0i\0v\0i\0l\0e\0g\0e\0", 98, 1024, ... {status=0x103, info=48}, "\5\0\2\3\20\0\0\00\0\0\0\1\0\0\0\30\0\0\0\0\0\0\0\0\0\0\07\237y\212\234J\353N\250\27\371L\264\213S-\0\0\0\0", ) \0$\0\20\313\24\0\22\0\0\0\0\0\0\0\21\0\0\0S\0e\0B\0a\0c\0k\0u\0p\0P\0r\0i\0v\0i\0l\0e\0g\0e\0 (120, 57, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0b\0\0\0\2\0\0\0J\0\0\0\0\0\37\0\0\0\0\07\237y\212\234J\353N\250\27\371L\264\213S-"\0$\0\20\313\24\0\22\0\0\0\0\0\0\0\21\0\0\0S\0e\0B\0a\0c\0k\0u\0p\0P\0r\0i\0v\0i\0l\0e\0g\0e\0", 98, 1024, ... {status=0x103, info=48}, "\5\0\2\3\20\0\0\00\0\0\0\1\0\0\0\30\0\0\0\0\0\0\0\0\0\0\07\237y\212\234J\353N\250\27\371L\264\213S-\0\0\0\0", ) \5\0\2\3\20\0\0\00\0\0\0\1\0\0\0\30\0\0\0\0\0\0\0\0\0\0\07\237y\212\234J\353N\250\27\371L\264\213S-\0\0\0\0", ) == 0x103
 01275   896   NtFsControlFile  (120, 57, 0x0, 0x0, 0x11c017,  (120, 57, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0,\0\0\0\3\0\0\0\24\0\0\0\0\0\0\0\0\0\0\07\237y\212\234J\353N\250\27\371L\264\213S-", 44, 1024, ... {status=0x103, info=36}, "\5\0\2\3\20\0\0\0$\0\0\0\2\0\0\0\14\0\0\0\0\0\0\0\21\0\0\0\0\0\0\0\0\0\0\0", ) , 44, 1024, ... {status=0x103, info=36},  (120, 57, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0,\0\0\0\3\0\0\0\24\0\0\0\0\0\0\0\0\0\0\07\237y\212\234J\353N\250\27\371L\264\213S-", 44, 1024, ... {status=0x103, info=36}, "\5\0\2\3\20\0\0\0$\0\0\0\2\0\0\0\14\0\0\0\0\0\0\0\21\0\0\0\0\0\0\0\0\0\0\0", ) , ) == 0x103
 01276   896   NtClose  (116, ... ) == 0x0
 01277   896   NtClose  (120, ... ) == 0x0
 01278   896   NtAdjustPrivilegesToken  (112, 0, 1241472, 0, 0, 0, ... ) == 0x0
 01279   896   NtOpenThreadToken  (-2, 0xc, 1, ... ) == STATUS_NO_TOKEN
 01280   896   NtCreateEvent  (0x1f0003, 0x0, 1, 0, ... 120, ) == 0x0
 01281   896   NtOpenThreadToken  (-2, 0xc, 1, ... ) == STATUS_NO_TOKEN
 01282   896   NtSetInformationThread  (-2, ImpersonationToken, {ImpToken=0,}, 4, ... ) == 0x0
 01283   896   NtCreateFile  (0xc0100080, {24, 0, 0x40, 0, 1239628,  (0xc0100080, {24, 0, 0x40, 0, 1239628, "\??\PIPE\lsarpc"}, 0x0, 0, 3, 1, 64, 0, 0, ... 116, {status=0x0, info=1}, ) }, 0x0, 0, 3, 1, 64, 0, 0, ... 116, {status=0x0, info=1}, ) == 0x0
 01284   896   NtSetInformationFile  (116, 1239684, 8, Pipe, ... {status=0x0, info=0}, ) == 0x0
 01285   896   NtSetInformationFile  (116, 1239672, 8, Completion, ... {status=0x0, info=0}, ) == 0x0
 01286   896   NtSetInformationThread  (-2, ImpersonationToken, {ImpToken=0,}, 4, ... ) == 0x0
 01287   896   NtWriteFile  (116, 57, 0, 0,  (116, 57, 0, 0, "\5\0\13\3\20\0\0\0H\0\0\0\1\0\0\0\270\20\270\20\0\0\0\0\1\0\0\0\0\0\1\0xW4\224\22\315\253\357\0\1#Eg\211\253\0\0\0\0\4]\210\212\353\34\311\21\237\350\10\0+\20H`\2\0\0\0", 72, {0, 0}, 0, ... {status=0x0, info=72}, ) , 72, {0, 0}, 0, ... {status=0x0, info=72}, ) == 0x0
 01288   896   NtReadFile  (116, 57, 0, 0, 1024, {0, 0}, 0, ... {status=0x0, info=68},  (116, 57, 0, 0, 1024, {0, 0}, 0, ... {status=0x0, info=68}, "\5\0\14\3\20\0\0\0D\0\0\0\1\0\0\0\270\20\270\20p+\0\0\14\0\PIPE\lsass\0\0\0\1\0\0\0\0\0\0\0\4]\210\212\353\34\311\21\237\350\10\0+\20H`\2\0\0\0", ) , ) == 0x0
 01289   896   NtFsControlFile  (116, 57, 0x0, 0x0, 0x11c017,  (116, 57, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0@\0\0\0\1\0\0\0(\0\0\0\0\0,\0\0\0\0\0\30\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\24\361\22\0\14\0\0\0\2\0\1\0\0\10\0\0", 64, 1024, ... {status=0x103, info=68}, "\5\0\14\3\20\0\0\0D\0\0\0\1\0\0\0\270\20\270\20p+\0\0\14\0\PIPE\lsass\0\0\0\1\0\0\0\0\0\0\0\4]\210\212\353\34\311\21\237\350\10\0+\20H`\2\0\0\0", ) , 64, 1024, ... {status=0x103, info=68},  (116, 57, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0@\0\0\0\1\0\0\0(\0\0\0\0\0,\0\0\0\0\0\30\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\24\361\22\0\14\0\0\0\2\0\1\0\0\10\0\0", 64, 1024, ... {status=0x103, info=68}, "\5\0\14\3\20\0\0\0D\0\0\0\1\0\0\0\270\20\270\20p+\0\0\14\0\PIPE\lsass\0\0\0\1\0\0\0\0\0\0\0\4]\210\212\353\34\311\21\237\350\10\0+\20H`\2\0\0\0", ) , ) == 0x103
 01290   896   NtFsControlFile  (116, 57, 0x0, 0x0, 0x11c017,  (116, 57, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0n\0\0\0\2\0\0\0V\0\0\0\0\0\37\0\0\0\0\0y\6"\211\5\277_A\252\250\245\310d\34\17\354.\00\0\360\321\24\0\30\0\0\0\0\0\0\0\27\0\0\0S\0e\0C\0h\0a\0n\0g\0e\0N\0o\0t\0i\0f\0y\0P\0r\0i\0v\0i\0l\0e\0g\0e\0", 110, 1024, ... {status=0x103, info=48}, "\5\0\2\3\20\0\0\00\0\0\0\1\0\0\0\30\0\0\0\0\0\0\0\0\0\0\0y\6"\211\5\277_A\252\250\245\310d\34\17\354\0\0\0\0", ) \211\5\277_A\252\250\245\310d\34\17\354.\00\0\360\321\24\0\30\0\0\0\0\0\0\0\27\0\0\0S\0e\0C\0h\0a\0n\0g\0e\0N\0o\0t\0i\0f\0y\0P\0r\0i\0v\0i\0l\0e\0g\0e\0 (116, 57, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0n\0\0\0\2\0\0\0V\0\0\0\0\0\37\0\0\0\0\0y\6"\211\5\277_A\252\250\245\310d\34\17\354.\00\0\360\321\24\0\30\0\0\0\0\0\0\0\27\0\0\0S\0e\0C\0h\0a\0n\0g\0e\0N\0o\0t\0i\0f\0y\0P\0r\0i\0v\0i\0l\0e\0g\0e\0", 110, 1024, ... {status=0x103, info=48}, "\5\0\2\3\20\0\0\00\0\0\0\1\0\0\0\30\0\0\0\0\0\0\0\0\0\0\0y\6"\211\5\277_A\252\250\245\310d\34\17\354\0\0\0\0", ) \5\0\2\3\20\0\0\00\0\0\0\1\0\0\0\30\0\0\0\0\0\0\0\0\0\0\0y\6 (116, 57, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0n\0\0\0\2\0\0\0V\0\0\0\0\0\37\0\0\0\0\0y\6"\211\5\277_A\252\250\245\310d\34\17\354.\00\0\360\321\24\0\30\0\0\0\0\0\0\0\27\0\0\0S\0e\0C\0h\0a\0n\0g\0e\0N\0o\0t\0i\0f\0y\0P\0r\0i\0v\0i\0l\0e\0g\0e\0", 110, 1024, ... {status=0x103, info=48}, "\5\0\2\3\20\0\0\00\0\0\0\1\0\0\0\30\0\0\0\0\0\0\0\0\0\0\0y\6"\211\5\277_A\252\250\245\310d\34\17\354\0\0\0\0", ) , ) == 0x103
 01291   896   NtFsControlFile  (116, 57, 0x0, 0x0, 0x11c017,  (116, 57, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0,\0\0\0\3\0\0\0\24\0\0\0\0\0\0\0\0\0\0\0y\6"\211\5\277_A\252\250\245\310d\34\17\354", 44, 1024, ... {status=0x103, info=36}, "\5\0\2\3\20\0\0\0$\0\0\0\2\0\0\0\14\0\0\0\0\0\0\0\27\0\0\0\0\0\0\0\0\0\0\0", ) \211\5\277_A\252\250\245\310d\34\17\354 (116, 57, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0,\0\0\0\3\0\0\0\24\0\0\0\0\0\0\0\0\0\0\0y\6"\211\5\277_A\252\250\245\310d\34\17\354", 44, 1024, ... {status=0x103, info=36}, "\5\0\2\3\20\0\0\0$\0\0\0\2\0\0\0\14\0\0\0\0\0\0\0\27\0\0\0\0\0\0\0\0\0\0\0", ) \5\0\2\3\20\0\0\0$\0\0\0\2\0\0\0\14\0\0\0\0\0\0\0\27\0\0\0\0\0\0\0\0\0\0\0", ) == 0x103
 01292   896   NtClose  (120, ... ) == 0x0
 01293   896   NtClose  (116, ... ) == 0x0
 01294   896   NtAdjustPrivilegesToken  (112, 0, 1241472, 0, 0, 0, ... ) == 0x0
 01295   896   NtQueryInformationToken  (112, User, 100, ... {token info, class 1, size 36}, 36, ) == 0x0
 01296   896   NtClose  (112, ... ) == 0x0
 01297   896   NtOpenFile  (0x80000, {24, 0, 0x40, 0, 0,  (0x80000, {24, 0, 0x40, 0, 0, "\??\U:\WORK\PACKED.EXE"}, 7, 2097152, ... 112, {status=0x0, info=1}, ) }, 7, 2097152, ... 112, {status=0x0, info=1}, ) == 0x0
 01298   896   NtSetSecurityObject  (112, 1, {1, 0, 0x4, 2147102164, 0, 0, 0}, ... ) == STATUS_ACCESS_DENIED
 01299   896   NtClose  (112, ... ) == 0x0
 01300   896   NtOpenFile  (0x40000, {24, 0, 0x40, 0, 0,  (0x40000, {24, 0, 0x40, 0, 0, "\??\U:\WORK\PACKED.EXE"}, 7, 2097152, ... 112, {status=0x0, info=1}, ) }, 7, 2097152, ... 112, {status=0x0, info=1}, ) == 0x0
 01301   896   NtSetSecurityObject  (112, 4, {1, 0, 0x4, 2147102164, 0, 0, 0}, ... ) == 0x0
 01302   896   NtClose  (112, ... ) == 0x0
 01303   896   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\U:\WORK\PACKED.EXE"}, 1241400, ... ) }, 1241400, ... ) == 0x0
 01304   896   NtOpenFile  (0x100100, {24, 0, 0x40, 0, 0,  (0x100100, {24, 0, 0x40, 0, 0, "\??\U:\WORK\PACKED.EXE"}, 7, 2113568, ... 112, {status=0x0, info=1}, ) }, 7, 2113568, ... 112, {status=0x0, info=1}, ) == 0x0
 01305   896   NtSetInformationFile  (112, 1241376, 40, Basic, ... ) == STATUS_ACCESS_DENIED
 01306   896   NtClose  (112, ... ) == 0x0
 01307   896   NtCreateFile  (0x80100080, {24, 0, 0x40, 0, 1241648,  (0x80100080, {24, 0, 0x40, 0, 1241648, "\??\u:\work\packed.exe"}, 0x0, 0, 1, 1, 2097252, 0, 0, ... 112, {status=0x0, info=1}, ) }, 0x0, 0, 1, 1, 2097252, 0, 0, ... 112, {status=0x0, info=1}, ) == 0x0
 01308   896   NtQueryInformationFile  (112, 1242084, 8, AttributeFlag, ... {status=0x0, info=8}, ) == 0x0
 01309   896   NtQueryInformationFile  (112, 1242000, 24, Standard, ... {status=0x0, info=24}, ) == 0x0
 01310   896   NtQueryInformationFile  (112, 1241816, 40, Basic, ... {status=0x0, info=40}, ) == 0x0
 01311   896   NtAllocateVirtualMemory  (-1, 1368064, 0, 8192, 4096, 4, ... 1368064, 8192, ) == 0x0
 01312   896   NtQueryInformationFile  (112, 1364560, 4094, Stream, ... {status=0x0, info=38}, ) == 0x0
 01313   896   NtQueryInformationFile  (112, 1240264, 40, Basic, ... {status=0x0, info=40}, ) == 0x0
 01314   896   NtQueryInformationFile  (112, 1240540, 4, Ea, ... {status=0x0, info=4}, ) == 0x0
 01315   896   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\AVSERVE2.EXE"}, 1239736, ... ) }, 1239736, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01316   896   NtOpenProcessToken  (-1, 0x28, ... 116, ) == 0x0
 01317   896   NtOpenThreadToken  (-2, 0xc, 1, ... ) == STATUS_NO_TOKEN
 01318   896   NtCreateEvent  (0x1f0003, 0x0, 1, 0, ... 120, ) == 0x0
 01319   896   NtOpenThreadToken  (-2, 0xc, 1, ... ) == STATUS_NO_TOKEN
 01320   896   NtSetInformationThread  (-2, ImpersonationToken, {ImpToken=0,}, 4, ... ) == 0x0
 01321   896   NtCreateFile  (0xc0100080, {24, 0, 0x40, 0, 1237964,  (0xc0100080, {24, 0, 0x40, 0, 1237964, "\??\PIPE\lsarpc"}, 0x0, 0, 3, 1, 64, 0, 0, ... 124, {status=0x0, info=1}, ) }, 0x0, 0, 3, 1, 64, 0, 0, ... 124, {status=0x0, info=1}, ) == 0x0
 01322   896   NtSetInformationFile  (124, 1238020, 8, Pipe, ... {status=0x0, info=0}, ) == 0x0
 01323   896   NtSetInformationFile  (124, 1238008, 8, Completion, ... {status=0x0, info=0}, ) == 0x0
 01324   896   NtSetInformationThread  (-2, ImpersonationToken, {ImpToken=0,}, 4, ... ) == 0x0
 01325   896   NtWriteFile  (124, 57, 0, 0,  (124, 57, 0, 0, "\5\0\13\3\20\0\0\0H\0\0\0\1\0\0\0\270\20\270\20\0\0\0\0\1\0\0\0\0\0\1\0xW4\224\22\315\253\357\0\1#Eg\211\253\0\0\0\0\4]\210\212\353\34\311\21\237\350\10\0+\20H`\2\0\0\0", 72, {0, 0}, 0, ... {status=0x0, info=72}, ) , 72, {0, 0}, 0, ... {status=0x0, info=72}, ) == 0x0
 01326   896   NtReadFile  (124, 57, 0, 0, 1024, {0, 0}, 0, ... {status=0x0, info=68},  (124, 57, 0, 0, 1024, {0, 0}, 0, ... {status=0x0, info=68}, "\5\0\14\3\20\0\0\0D\0\0\0\1\0\0\0\270\20\270\20q+\0\0\14\0\PIPE\lsass\0\0\0\1\0\0\0\0\0\0\0\4]\210\212\353\34\311\21\237\350\10\0+\20H`\2\0\0\0", ) , ) == 0x0
 01327   896   NtFsControlFile  (124, 57, 0x0, 0x0, 0x11c017,  (124, 57, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0@\0\0\0\1\0\0\0(\0\0\0\0\0,\0\0\0\0\0\30\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\224\352\22\0\14\0\0\0\2\0\1\0\0\10\0\0", 64, 1024, ... {status=0x103, info=68}, "\5\0\14\3\20\0\0\0D\0\0\0\1\0\0\0\270\20\270\20q+\0\0\14\0\PIPE\lsass\0\0\0\1\0\0\0\0\0\0\0\4]\210\212\353\34\311\21\237\350\10\0+\20H`\2\0\0\0", ) , 64, 1024, ... {status=0x103, info=68},  (124, 57, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0@\0\0\0\1\0\0\0(\0\0\0\0\0,\0\0\0\0\0\30\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\224\352\22\0\14\0\0\0\2\0\1\0\0\10\0\0", 64, 1024, ... {status=0x103, info=68}, "\5\0\14\3\20\0\0\0D\0\0\0\1\0\0\0\270\20\270\20q+\0\0\14\0\PIPE\lsass\0\0\0\1\0\0\0\0\0\0\0\4]\210\212\353\34\311\21\237\350\10\0+\20H`\2\0\0\0", ) , ) == 0x103
 01328   896   NtFsControlFile  (124, 57, 0x0, 0x0, 0x11c017,  (124, 57, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0p\0\0\0\2\0\0\0X\0\0\0\0\0\37\0\0\0\0\0\367"N}\323XAC\252\21H\231\344K\241\3640\02\0\250I\24\0\31\0\0\0\0\0\0\0\30\0\0\0S\0e\0T\0a\0k\0e\0O\0w\0n\0e\0r\0s\0h\0i\0p\0P\0r\0i\0v\0i\0l\0e\0g\0e\0", 112, 1024, ... {status=0x103, info=48}, "\5\0\2\3\20\0\0\00\0\0\0\1\0\0\0\30\0\0\0\0\0\0\0\0\0\0\0\367"N}\323XAC\252\21H\231\344K\241\364\0\0\0\0", ) N}\323XAC\252\21H\231\344K\241\3640\02\0\250I\24\0\31\0\0\0\0\0\0\0\30\0\0\0S\0e\0T\0a\0k\0e\0O\0w\0n\0e\0r\0s\0h\0i\0p\0P\0r\0i\0v\0i\0l\0e\0g\0e\0 (124, 57, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0p\0\0\0\2\0\0\0X\0\0\0\0\0\37\0\0\0\0\0\367"N}\323XAC\252\21H\231\344K\241\3640\02\0\250I\24\0\31\0\0\0\0\0\0\0\30\0\0\0S\0e\0T\0a\0k\0e\0O\0w\0n\0e\0r\0s\0h\0i\0p\0P\0r\0i\0v\0i\0l\0e\0g\0e\0", 112, 1024, ... {status=0x103, info=48}, "\5\0\2\3\20\0\0\00\0\0\0\1\0\0\0\30\0\0\0\0\0\0\0\0\0\0\0\367"N}\323XAC\252\21H\231\344K\241\364\0\0\0\0", ) \5\0\2\3\20\0\0\00\0\0\0\1\0\0\0\30\0\0\0\0\0\0\0\0\0\0\0\367 (124, 57, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0p\0\0\0\2\0\0\0X\0\0\0\0\0\37\0\0\0\0\0\367"N}\323XAC\252\21H\231\344K\241\3640\02\0\250I\24\0\31\0\0\0\0\0\0\0\30\0\0\0S\0e\0T\0a\0k\0e\0O\0w\0n\0e\0r\0s\0h\0i\0p\0P\0r\0i\0v\0i\0l\0e\0g\0e\0", 112, 1024, ... {status=0x103, info=48}, "\5\0\2\3\20\0\0\00\0\0\0\1\0\0\0\30\0\0\0\0\0\0\0\0\0\0\0\367"N}\323XAC\252\21H\231\344K\241\364\0\0\0\0", ) , ) == 0x103
 01329   896   NtFsControlFile  (124, 57, 0x0, 0x0, 0x11c017,  (124, 57, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0,\0\0\0\3\0\0\0\24\0\0\0\0\0\0\0\0\0\0\0\367"N}\323XAC\252\21H\231\344K\241\364", 44, 1024, ... {status=0x103, info=36}, "\5\0\2\3\20\0\0\0$\0\0\0\2\0\0\0\14\0\0\0\0\0\0\0\11\0\0\0\0\0\0\0\0\0\0\0", ) N}\323XAC\252\21H\231\344K\241\364 (124, 57, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0,\0\0\0\3\0\0\0\24\0\0\0\0\0\0\0\0\0\0\0\367"N}\323XAC\252\21H\231\344K\241\364", 44, 1024, ... {status=0x103, info=36}, "\5\0\2\3\20\0\0\0$\0\0\0\2\0\0\0\14\0\0\0\0\0\0\0\11\0\0\0\0\0\0\0\0\0\0\0", ) \5\0\2\3\20\0\0\0$\0\0\0\2\0\0\0\14\0\0\0\0\0\0\0\11\0\0\0\0\0\0\0\0\0\0\0", ) == 0x103
 01330   896   NtClose  (120, ... ) == 0x0
 01331   896   NtClose  (124, ... ) == 0x0
 01332   896   NtAdjustPrivilegesToken  (116, 0, 1239808, 0, 0, 0, ... ) == 0x0
 01333   896   NtOpenThreadToken  (-2, 0xc, 1, ... ) == STATUS_NO_TOKEN
 01334   896   NtCreateEvent  (0x1f0003, 0x0, 1, 0, ... 124, ) == 0x0
 01335   896   NtOpenThreadToken  (-2, 0xc, 1, ... ) == STATUS_NO_TOKEN
 01336   896   NtSetInformationThread  (-2, ImpersonationToken, {ImpToken=0,}, 4, ... ) == 0x0
 01337   896   NtCreateFile  (0xc0100080, {24, 0, 0x40, 0, 1237964,  (0xc0100080, {24, 0, 0x40, 0, 1237964, "\??\PIPE\lsarpc"}, 0x0, 0, 3, 1, 64, 0, 0, ... 120, {status=0x0, info=1}, ) }, 0x0, 0, 3, 1, 64, 0, 0, ... 120, {status=0x0, info=1}, ) == 0x0
 01338   896   NtSetInformationFile  (120, 1238020, 8, Pipe, ... {status=0x0, info=0}, ) == 0x0
 01339   896   NtSetInformationFile  (120, 1238008, 8, Completion, ... {status=0x0, info=0}, ) == 0x0
 01340   896   NtSetInformationThread  (-2, ImpersonationToken, {ImpToken=0,}, 4, ... ) == 0x0
 01341   896   NtWriteFile  (120, 57, 0, 0,  (120, 57, 0, 0, "\5\0\13\3\20\0\0\0H\0\0\0\1\0\0\0\270\20\270\20\0\0\0\0\1\0\0\0\0\0\1\0xW4\224\22\315\253\357\0\1#Eg\211\253\0\0\0\0\4]\210\212\353\34\311\21\237\350\10\0+\20H`\2\0\0\0", 72, {0, 0}, 0, ... {status=0x0, info=72}, ) , 72, {0, 0}, 0, ... {status=0x0, info=72}, ) == 0x0
 01342   896   NtReadFile  (120, 57, 0, 0, 1024, {0, 0}, 0, ... {status=0x0, info=68},  (120, 57, 0, 0, 1024, {0, 0}, 0, ... {status=0x0, info=68}, "\5\0\14\3\20\0\0\0D\0\0\0\1\0\0\0\270\20\270\20r+\0\0\14\0\PIPE\lsass\0\0\0\1\0\0\0\0\0\0\0\4]\210\212\353\34\311\21\237\350\10\0+\20H`\2\0\0\0", ) , ) == 0x0
 01343   896   NtFsControlFile  (120, 57, 0x0, 0x0, 0x11c017,  (120, 57, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0@\0\0\0\1\0\0\0(\0\0\0\0\0,\0\0\0\0\0\30\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\224\352\22\0\14\0\0\0\2\0\1\0\0\10\0\0", 64, 1024, ... {status=0x103, info=68}, "\5\0\14\3\20\0\0\0D\0\0\0\1\0\0\0\270\20\270\20r+\0\0\14\0\PIPE\lsass\0\0\0\1\0\0\0\0\0\0\0\4]\210\212\353\34\311\21\237\350\10\0+\20H`\2\0\0\0", ) , 64, 1024, ... {status=0x103, info=68},  (120, 57, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0@\0\0\0\1\0\0\0(\0\0\0\0\0,\0\0\0\0\0\30\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\224\352\22\0\14\0\0\0\2\0\1\0\0\10\0\0", 64, 1024, ... {status=0x103, info=68}, "\5\0\14\3\20\0\0\0D\0\0\0\1\0\0\0\270\20\270\20r+\0\0\14\0\PIPE\lsass\0\0\0\1\0\0\0\0\0\0\0\4]\210\212\353\34\311\21\237\350\10\0+\20H`\2\0\0\0", ) , ) == 0x103
 01344   896   NtFsControlFile  (120, 57, 0x0, 0x0, 0x11c017,  (120, 57, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0d\0\0\0\2\0\0\0L\0\0\0\0\0\37\0\0\0\0\0X\33\236\13\236WsB\202\210\263w\277\373\354\337$\0&\0\20\313\24\0\23\0\0\0\0\0\0\0\22\0\0\0S\0e\0R\0e\0s\0t\0o\0r\0e\0P\0r\0i\0v\0i\0l\0e\0g\0e\0", 100, 1024, ... {status=0x103, info=48}, "\5\0\2\3\20\0\0\00\0\0\0\1\0\0\0\30\0\0\0\0\0\0\0\0\0\0\0X\33\236\13\236WsB\202\210\263w\277\373\354\337\0\0\0\0", ) , 100, 1024, ... {status=0x103, info=48},  (120, 57, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0d\0\0\0\2\0\0\0L\0\0\0\0\0\37\0\0\0\0\0X\33\236\13\236WsB\202\210\263w\277\373\354\337$\0&\0\20\313\24\0\23\0\0\0\0\0\0\0\22\0\0\0S\0e\0R\0e\0s\0t\0o\0r\0e\0P\0r\0i\0v\0i\0l\0e\0g\0e\0", 100, 1024, ... {status=0x103, info=48}, "\5\0\2\3\20\0\0\00\0\0\0\1\0\0\0\30\0\0\0\0\0\0\0\0\0\0\0X\33\236\13\236WsB\202\210\263w\277\373\354\337\0\0\0\0", ) , ) == 0x103
 01345   896   NtFsControlFile  (120, 57, 0x0, 0x0, 0x11c017,  (120, 57, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0,\0\0\0\3\0\0\0\24\0\0\0\0\0\0\0\0\0\0\0X\33\236\13\236WsB\202\210\263w\277\373\354\337", 44, 1024, ... {status=0x103, info=36}, "\5\0\2\3\20\0\0\0$\0\0\0\2\0\0\0\14\0\0\0\0\0\0\0\22\0\0\0\0\0\0\0\0\0\0\0", ) , 44, 1024, ... {status=0x103, info=36},  (120, 57, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0,\0\0\0\3\0\0\0\24\0\0\0\0\0\0\0\0\0\0\0X\33\236\13\236WsB\202\210\263w\277\373\354\337", 44, 1024, ... {status=0x103, info=36}, "\5\0\2\3\20\0\0\0$\0\0\0\2\0\0\0\14\0\0\0\0\0\0\0\22\0\0\0\0\0\0\0\0\0\0\0", ) , ) == 0x103
 01346   896   NtClose  (124, ... ) == 0x0
 01347   896   NtClose  (120, ... ) == 0x0
 01348   896   NtAdjustPrivilegesToken  (116, 0, 1239808, 0, 0, 0, ... ) == 0x0
 01349   896   NtOpenThreadToken  (-2, 0xc, 1, ... ) == STATUS_NO_TOKEN
 01350   896   NtCreateEvent  (0x1f0003, 0x0, 1, 0, ... 120, ) == 0x0
 01351   896   NtOpenThreadToken  (-2, 0xc, 1, ... ) == STATUS_NO_TOKEN
 01352   896   NtSetInformationThread  (-2, ImpersonationToken, {ImpToken=0,}, 4, ... ) == 0x0
 01353   896   NtCreateFile  (0xc0100080, {24, 0, 0x40, 0, 1237964,  (0xc0100080, {24, 0, 0x40, 0, 1237964, "\??\PIPE\lsarpc"}, 0x0, 0, 3, 1, 64, 0, 0, ... 124, {status=0x0, info=1}, ) }, 0x0, 0, 3, 1, 64, 0, 0, ... 124, {status=0x0, info=1}, ) == 0x0
 01354   896   NtSetInformationFile  (124, 1238020, 8, Pipe, ... {status=0x0, info=0}, ) == 0x0
 01355   896   NtSetInformationFile  (124, 1238008, 8, Completion, ... {status=0x0, info=0}, ) == 0x0
 01356   896   NtSetInformationThread  (-2, ImpersonationToken, {ImpToken=0,}, 4, ... ) == 0x0
 01357   896   NtWriteFile  (124, 57, 0, 0,  (124, 57, 0, 0, "\5\0\13\3\20\0\0\0H\0\0\0\1\0\0\0\270\20\270\20\0\0\0\0\1\0\0\0\0\0\1\0xW4\224\22\315\253\357\0\1#Eg\211\253\0\0\0\0\4]\210\212\353\34\311\21\237\350\10\0+\20H`\2\0\0\0", 72, {0, 0}, 0, ... {status=0x0, info=72}, ) , 72, {0, 0}, 0, ... {status=0x0, info=72}, ) == 0x0
 01358   896   NtReadFile  (124, 57, 0, 0, 1024, {0, 0}, 0, ... {status=0x0, info=68},  (124, 57, 0, 0, 1024, {0, 0}, 0, ... {status=0x0, info=68}, "\5\0\14\3\20\0\0\0D\0\0\0\1\0\0\0\270\20\270\20s+\0\0\14\0\PIPE\lsass\0\0\0\1\0\0\0\0\0\0\0\4]\210\212\353\34\311\21\237\350\10\0+\20H`\2\0\0\0", ) , ) == 0x0
 01359   896   NtFsControlFile  (124, 57, 0x0, 0x0, 0x11c017,  (124, 57, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0@\0\0\0\1\0\0\0(\0\0\0\0\0,\0\0\0\0\0\30\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\224\352\22\0\14\0\0\0\2\0\1\0\0\10\0\0", 64, 1024, ... {status=0x103, info=68}, "\5\0\14\3\20\0\0\0D\0\0\0\1\0\0\0\270\20\270\20s+\0\0\14\0\PIPE\lsass\0\0\0\1\0\0\0\0\0\0\0\4]\210\212\353\34\311\21\237\350\10\0+\20H`\2\0\0\0", ) , 64, 1024, ... {status=0x103, info=68},  (124, 57, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0@\0\0\0\1\0\0\0(\0\0\0\0\0,\0\0\0\0\0\30\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\224\352\22\0\14\0\0\0\2\0\1\0\0\10\0\0", 64, 1024, ... {status=0x103, info=68}, "\5\0\14\3\20\0\0\0D\0\0\0\1\0\0\0\270\20\270\20s+\0\0\14\0\PIPE\lsass\0\0\0\1\0\0\0\0\0\0\0\4]\210\212\353\34\311\21\237\350\10\0+\20H`\2\0\0\0", ) , ) == 0x103
 01360   896   NtFsControlFile  (124, 57, 0x0, 0x0, 0x11c017,  (124, 57, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0b\0\0\0\2\0\0\0J\0\0\0\0\0\37\0\0\0\0\0\252\366\254\341x\227XM\215\230\305\25-\27\256H"\0$\0\20\313\24\0\22\0\0\0\0\0\0\0\21\0\0\0S\0e\0B\0a\0c\0k\0u\0p\0P\0r\0i\0v\0i\0l\0e\0g\0e\0", 98, 1024, ... {status=0x103, info=48}, "\5\0\2\3\20\0\0\00\0\0\0\1\0\0\0\30\0\0\0\0\0\0\0\0\0\0\0\252\366\254\341x\227XM\215\230\305\25-\27\256H\0\0\0\0", ) \0$\0\20\313\24\0\22\0\0\0\0\0\0\0\21\0\0\0S\0e\0B\0a\0c\0k\0u\0p\0P\0r\0i\0v\0i\0l\0e\0g\0e\0 (124, 57, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0b\0\0\0\2\0\0\0J\0\0\0\0\0\37\0\0\0\0\0\252\366\254\341x\227XM\215\230\305\25-\27\256H"\0$\0\20\313\24\0\22\0\0\0\0\0\0\0\21\0\0\0S\0e\0B\0a\0c\0k\0u\0p\0P\0r\0i\0v\0i\0l\0e\0g\0e\0", 98, 1024, ... {status=0x103, info=48}, "\5\0\2\3\20\0\0\00\0\0\0\1\0\0\0\30\0\0\0\0\0\0\0\0\0\0\0\252\366\254\341x\227XM\215\230\305\25-\27\256H\0\0\0\0", ) \5\0\2\3\20\0\0\00\0\0\0\1\0\0\0\30\0\0\0\0\0\0\0\0\0\0\0\252\366\254\341x\227XM\215\230\305\25-\27\256H\0\0\0\0", ) == 0x103
 01361   896   NtFsControlFile  (124, 57, 0x0, 0x0, 0x11c017,  (124, 57, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0,\0\0\0\3\0\0\0\24\0\0\0\0\0\0\0\0\0\0\0\252\366\254\341x\227XM\215\230\305\25-\27\256H", 44, 1024, ... {status=0x103, info=36}, "\5\0\2\3\20\0\0\0$\0\0\0\2\0\0\0\14\0\0\0\0\0\0\0\21\0\0\0\0\0\0\0\0\0\0\0", ) , 44, 1024, ... {status=0x103, info=36},  (124, 57, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0,\0\0\0\3\0\0\0\24\0\0\0\0\0\0\0\0\0\0\0\252\366\254\341x\227XM\215\230\305\25-\27\256H", 44, 1024, ... {status=0x103, info=36}, "\5\0\2\3\20\0\0\0$\0\0\0\2\0\0\0\14\0\0\0\0\0\0\0\21\0\0\0\0\0\0\0\0\0\0\0", ) , ) == 0x103
 01362   896   NtClose  (120, ... ) == 0x0
 01363   896   NtClose  (124, ... ) == 0x0
 01364   896   NtAdjustPrivilegesToken  (116, 0, 1239808, 0, 0, 0, ... ) == 0x0
 01365   896   NtOpenThreadToken  (-2, 0xc, 1, ... ) == STATUS_NO_TOKEN
 01366   896   NtCreateEvent  (0x1f0003, 0x0, 1, 0, ... 124, ) == 0x0
 01367   896   NtOpenThreadToken  (-2, 0xc, 1, ... ) == STATUS_NO_TOKEN
 01368   896   NtSetInformationThread  (-2, ImpersonationToken, {ImpToken=0,}, 4, ... ) == 0x0
 01369   896   NtCreateFile  (0xc0100080, {24, 0, 0x40, 0, 1237964,  (0xc0100080, {24, 0, 0x40, 0, 1237964, "\??\PIPE\lsarpc"}, 0x0, 0, 3, 1, 64, 0, 0, ... 120, {status=0x0, info=1}, ) }, 0x0, 0, 3, 1, 64, 0, 0, ... 120, {status=0x0, info=1}, ) == 0x0
 01370   896   NtSetInformationFile  (120, 1238020, 8, Pipe, ... {status=0x0, info=0}, ) == 0x0
 01371   896   NtSetInformationFile  (120, 1238008, 8, Completion, ... {status=0x0, info=0}, ) == 0x0
 01372   896   NtSetInformationThread  (-2, ImpersonationToken, {ImpToken=0,}, 4, ... ) == 0x0
 01373   896   NtWriteFile  (120, 57, 0, 0,  (120, 57, 0, 0, "\5\0\13\3\20\0\0\0H\0\0\0\1\0\0\0\270\20\270\20\0\0\0\0\1\0\0\0\0\0\1\0xW4\224\22\315\253\357\0\1#Eg\211\253\0\0\0\0\4]\210\212\353\34\311\21\237\350\10\0+\20H`\2\0\0\0", 72, {0, 0}, 0, ... {status=0x0, info=72}, ) , 72, {0, 0}, 0, ... {status=0x0, info=72}, ) == 0x0
 01374   896   NtReadFile  (120, 57, 0, 0, 1024, {0, 0}, 0, ... {status=0x0, info=68},  (120, 57, 0, 0, 1024, {0, 0}, 0, ... {status=0x0, info=68}, "\5\0\14\3\20\0\0\0D\0\0\0\1\0\0\0\270\20\270\20t+\0\0\14\0\PIPE\lsass\0\0\0\1\0\0\0\0\0\0\0\4]\210\212\353\34\311\21\237\350\10\0+\20H`\2\0\0\0", ) , ) == 0x0
 01375   896   NtFsControlFile  (120, 57, 0x0, 0x0, 0x11c017,  (120, 57, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0@\0\0\0\1\0\0\0(\0\0\0\0\0,\0\0\0\0\0\30\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\224\352\22\0\14\0\0\0\2\0\1\0\0\10\0\0", 64, 1024, ... {status=0x103, info=68}, "\5\0\14\3\20\0\0\0D\0\0\0\1\0\0\0\270\20\270\20t+\0\0\14\0\PIPE\lsass\0\0\0\1\0\0\0\0\0\0\0\4]\210\212\353\34\311\21\237\350\10\0+\20H`\2\0\0\0", ) , 64, 1024, ... {status=0x103, info=68},  (120, 57, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0@\0\0\0\1\0\0\0(\0\0\0\0\0,\0\0\0\0\0\30\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\224\352\22\0\14\0\0\0\2\0\1\0\0\10\0\0", 64, 1024, ... {status=0x103, info=68}, "\5\0\14\3\20\0\0\0D\0\0\0\1\0\0\0\270\20\270\20t+\0\0\14\0\PIPE\lsass\0\0\0\1\0\0\0\0\0\0\0\4]\210\212\353\34\311\21\237\350\10\0+\20H`\2\0\0\0", ) , ) == 0x103
 01376   896   NtFsControlFile  (120, 57, 0x0, 0x0, 0x11c017,  (120, 57, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0n\0\0\0\2\0\0\0V\0\0\0\0\0\37\0\0\0\0\0\261\303v\367g\6\1N\203gPm\311O)[.\00\0\360\321\24\0\30\0\0\0\0\0\0\0\27\0\0\0S\0e\0C\0h\0a\0n\0g\0e\0N\0o\0t\0i\0f\0y\0P\0r\0i\0v\0i\0l\0e\0g\0e\0", 110, 1024, ... {status=0x103, info=48}, "\5\0\2\3\20\0\0\00\0\0\0\1\0\0\0\30\0\0\0\0\0\0\0\0\0\0\0\261\303v\367g\6\1N\203gPm\311O)[\0\0\0\0", ) , 110, 1024, ... {status=0x103, info=48},  (120, 57, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0n\0\0\0\2\0\0\0V\0\0\0\0\0\37\0\0\0\0\0\261\303v\367g\6\1N\203gPm\311O)[.\00\0\360\321\24\0\30\0\0\0\0\0\0\0\27\0\0\0S\0e\0C\0h\0a\0n\0g\0e\0N\0o\0t\0i\0f\0y\0P\0r\0i\0v\0i\0l\0e\0g\0e\0", 110, 1024, ... {status=0x103, info=48}, "\5\0\2\3\20\0\0\00\0\0\0\1\0\0\0\30\0\0\0\0\0\0\0\0\0\0\0\261\303v\367g\6\1N\203gPm\311O)[\0\0\0\0", ) , ) == 0x103
 01377   896   NtFsControlFile  (120, 57, 0x0, 0x0, 0x11c017,  (120, 57, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0,\0\0\0\3\0\0\0\24\0\0\0\0\0\0\0\0\0\0\0\261\303v\367g\6\1N\203gPm\311O)[", 44, 1024, ... {status=0x103, info=36}, "\5\0\2\3\20\0\0\0$\0\0\0\2\0\0\0\14\0\0\0\0\0\0\0\27\0\0\0\0\0\0\0\0\0\0\0", ) , 44, 1024, ... {status=0x103, info=36},  (120, 57, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0,\0\0\0\3\0\0\0\24\0\0\0\0\0\0\0\0\0\0\0\261\303v\367g\6\1N\203gPm\311O)[", 44, 1024, ... {status=0x103, info=36}, "\5\0\2\3\20\0\0\0$\0\0\0\2\0\0\0\14\0\0\0\0\0\0\0\27\0\0\0\0\0\0\0\0\0\0\0", ) , ) == 0x103
 01378   896   NtClose  (124, ... ) == 0x0
 01379   896   NtClose  (120, ... ) == 0x0
 01380   896   NtAdjustPrivilegesToken  (116, 0, 1239808, 0, 0, 0, ... ) == 0x0
 01381   896   NtQueryInformationToken  (116, User, 100, ... {token info, class 1, size 36}, 36, ) == 0x0
 01382   896   NtClose  (116, ... ) == 0x0
 01383   896   NtOpenFile  (0x80000, {24, 0, 0x40, 0, 0,  (0x80000, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\AVSERVE2.EXE"}, 7, 2097152, ... ) }, 7, 2097152, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01384   896   NtOpenFile  (0x40000, {24, 0, 0x40, 0, 0,  (0x40000, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\AVSERVE2.EXE"}, 7, 2097152, ... ) }, 7, 2097152, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01385   896   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\AVSERVE2.EXE"}, 1239736, ... ) }, 1239736, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01386   896   NtCreateFile  (0x40110080, {24, 0, 0x40, 0, 1240416,  (0x40110080, {24, 0, 0x40, 0, 1240416, "\??\C:\WINDOWS\avserve2.exe"}, 0x0, 32, 0, 5, 100, 0, 0, ... }, 0x0, 32, 0, 5, 100, 0, 0, ...
 01387   896   NtClose  (-2147482756, ... ) == 0x0
 01386   896   NtCreateFile  ... 116, {status=0x0, info=2}, ) == 0x0
 01388   896   NtQueryVolumeInformationFile  (116, 1240568, 536, Attribute, ... {status=0x0, info=20}, ) == 0x0
 01389   896   NtQueryInformationFile  (116, 1240152, 40, Basic, ... {status=0x0, info=40}, ) == 0x0
 01390   896   NtQueryVolumeInformationFile  (112, 1240568, 536, Attribute, ... {status=0x0, info=20}, ) == 0x0
 01391   896   NtQueryVolumeInformationFile  (112, 1239912, 8, Device, ... {status=0x0, info=8}, ) == 0x0
 01392   896   NtSetInformationFile  (116, 1240468, 8, EndOfFile, ... {status=0x0, info=0}, ) == 0x0
 01393   896   NtCreateSection  (0xf001f, 0x0, 0x0, 2, 134217728, 112, ... 120, ) == 0x0
 01394   896   NtMapViewOfSection  (120, -1, (0x0), 0, 0, {0, 0}, 0, 1, 0, 2, ... (0x390000), {0, 0}, 94208, ) == 0x0
 01395   896   NtClose  (120, ... ) == 0x0
 01396   896   NtWriteFile  (116, 0, 0, 0,  (116, 0, 0, 0, "MZ\220\0\3\0\0\0\4\0\0\0\377\377\0\0\270\0\0\0\0\0\0\0@\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\320\0\0\0\16\37\272\16\0\264\11\315!\270\1L\315!This program cannot be run in DOS mode.\15\15\12$\0\0\0\0\0\0\0\324%^\221\220D0\302\220D0\302\220D0\302x[:\302\212D0\302\23X>\302\233D0\302\220D1\302\331D0\302\362[#\302\231D0\302x[;\302\224D0\302(B6\302\221D0\302Rich\220D0\302\0\0\0\0\0\0\0\0PE\0\0L\1\2\0\240\240\240\240\0\0\0\0\0\0\0\0\340\0\17\1\13\1\6\0\0>\0\0\0"\0\0\0\0\0\0>(\0\0\0\20\0\0\0P\0\0\0\0@\0\0\20\0\0\0\2\0\0\4\0\0\0\0\0\0\0\4\0\0\0\0\0\0\0\0 \2\0\0\4\0\0\0\0\0\0\2\0\0\0\0\0\20\0\0\20\0\0\0\0\20\0\0\20\0\0\0\0\0\0\20\0\0\0\0\0\0\0\0\0\0\0$\220\0\0\212\0\0\0\0\220\0\0\20\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0.text\0\0\0\0\200\0\0\0\20\0\0\00\0\0\0\4\0\02CEP\0\0\0\0\0\0\0\0`\0\0\340.rsr", 61440, 0x0, 0, ... {status=0x0, info=61440}, ) \0\0\0\0\0\0>(\0\0\0\20\0\0\0P\0\0\0\0@\0\0\20\0\0\0\2\0\0\4\0\0\0\0\0\0\0\4\0\0\0\0\0\0\0\0 \2\0\0\4\0\0\0\0\0\0\2\0\0\0\0\0\20\0\0\20\0\0\0\0\20\0\0\20\0\0\0\0\0\0\20\0\0\0\0\0\0\0\0\0\0\0$\220\0\0\212\0\0\0\0\220\0\0\20\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0.text\0\0\0\0\200\0\0\0\20\0\0\00\0\0\0\4\0\02CEP\0\0\0\0\0\0\0\0`\0\0\340.rsr", 61440, 0x0, 0, ... {status=0x0, info=61440}, ) == 0x0
 01397   896   NtWriteFile  (116, 0, 0, 0,  (116, 0, 0, 0, "\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0", 28688, 0x0, 0, ... {status=0x0, info=28688}, ) , 28688, 0x0, 0, ... {status=0x0, info=28688}, ) == 0x0
 01398   896   NtUnmapViewOfSection  (-1, 0x390000, ... ) == 0x0
 01399   896   NtSetInformationFile  (116, 1241816, 40, Basic, ... {status=0x0, info=0}, ) == 0x0
 01400   896   NtClose  (112, ... ) == 0x0
 01401   896   NtClose  (116, ... ) == 0x0
 01402   896   NtOpenKey  (0x2000000, {24, 40, 0x40, 0, 0,  (0x2000000, {24, 40, 0x40, 0, 0, "SOFTWARE\Microsoft\Windows\CurrentVersion\Run"}, ... 116, ) }, ... 116, ) == 0x0
 01403   896   NtSetValueKey  (116,  (116, "avserve2.exe", 0, 1, "C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0a\0v\0s\0e\0r\0v\0e\02\0.\0e\0x\0e\0\0\0", 48, ... , 0, 1,  (116, "avserve2.exe", 0, 1, "C\0:\0\\0W\0I\0N\0D\0O\0W\0S\0\\0a\0v\0s\0e\0r\0v\0e\02\0.\0e\0x\0e\0\0\0", 48, ... , 48, ...
 01404   896   NtSetInformationFile  (-2147482448, -142629072, 8, EndOfFile, ... {status=0x0, info=0}, ) == 0x0
 01405   896   NtSetInformationFile  (-2147482448, -142629164, 8, EndOfFile, ... {status=0x0, info=0}, ) == 0x0
 01406   896   NtSetInformationFile  (-2147482448, -142629472, 8, EndOfFile, ... {status=0x0, info=0}, ) == 0x0
 01407   896   NtSetInformationFile  (-2147482448, -142629568, 8, EndOfFile, ... {status=0x0, info=0}, ) == 0x0
 01403   896   NtSetValueKey  ... ) == 0x0
 01408   896   NtClose  (116, ... ) == 0x0
 01409   896   NtCreateMutant  (0x1f0001, {24, 16, 0x80, 0, 0,  (0x1f0001, {24, 16, 0x80, 0, 0, "JumpallsNlsTillt"}, 0, ... 116, ) }, 0, ... 116, ) == 0x0
 01410   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ... 10551296, 1048576, ) == 0x0
 01411   896   NtAllocateVirtualMemory  (-1, 11591680, 0, 8192, 4096, 4, ... 11591680, 8192, ) == 0x0
 01412   896   NtProtectVirtualMemory  (-1, (0xb0e000), 4096, 260, ... (0xb0e000), 4096, 4, ) == 0x0
 01413   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ... 112, {1252, 1796}, ) == 0x0
 01414   896   NtQueryInformationThread  (112, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ffdd000,Pid=1252,Tid=1796,}, 0x0, ) == 0x0
 01415   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1244884, 2089878865, 1315560, 2089878893}  (24, {28, 56, new_msg, 0, 1244884, 2089878865, 1315560, 2089878893} "\0\0\0\0\1\0\1\0\0\0\0\0DEFGp\0\0\0\344\4\0\0\4\7\0\0" ... {28, 56, reply, 0, 1252, 896, 81883, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFGp\0\0\0\344\4\0\0\4\7\0\0" )  ... {28, 56, reply, 0, 1252, 896, 81883, 0}  (24, {28, 56, new_msg, 0, 1244884, 2089878865, 1315560, 2089878893} "\0\0\0\0\1\0\1\0\0\0\0\0DEFGp\0\0\0\344\4\0\0\4\7\0\0" ... {28, 56, reply, 0, 1252, 896, 81883, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFGp\0\0\0\344\4\0\0\4\7\0\0" )  ) == 0x0
 01416   896   NtResumeThread  (112, ... 1, ) == 0x0
 01417   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ... 11599872, 1048576, ) == 0x0
 01418   896   NtAllocateVirtualMemory  (-1, 12640256, 0, 8192, 4096, 4, ... 12640256, 8192, ) == 0x0
 01419  1796   NtTestAlert  (... ) == 0x0
 01420  1796   NtContinue  (11599152, 1, ...
 01421  1796   NtRegisterThreadTerminatePort  (24, ... ) == 0x0
 01422  1796   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ... 120, ) == 0x0
 01423  1796   NtWaitForSingleObject  (96, 0, {0, 0}, ... ) == 0x102
 01424  1796   NtAllocateVirtualMemory  (-1, 11587584, 0, 4096, 4096, 260, ...
 01425   896   NtProtectVirtualMemory  (-1, (0xc0e000), 4096, 260, ... (0xc0e000), 4096, 4, ) == 0x0
 01426   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ... 124, {1252, 1728}, ) == 0x0
 01427   896   NtQueryInformationThread  (124, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ffdc000,Pid=1252,Tid=1728,}, 0x0, ) == 0x0
 01428   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81883, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81883, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG|\0\0\0\344\4\0\0\300\6\0\0" ... {28, 56, reply, 0, 1252, 896, 81884, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG|\0\0\0\344\4\0\0\300\6\0\0" )  ... {28, 56, reply, 0, 1252, 896, 81884, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81883, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG|\0\0\0\344\4\0\0\300\6\0\0" ... {28, 56, reply, 0, 1252, 896, 81884, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG|\0\0\0\344\4\0\0\300\6\0\0" )  ) == 0x0
 01429   896   NtResumeThread  (124, ... 1, ) == 0x0
 01430   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ...
 01424  1796   NtAllocateVirtualMemory  ... 11587584, 4096, ) == 0x0
 01431  1728   NtCreateEvent  (0x100003, 0x0, 1, 0, ...
 01432  1796   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\mswsock.dll"}, 11596276, ... }, 11596276, ...
 01431  1728   NtCreateEvent  ... 128, ) == 0x0
 01432  1796   NtQueryAttributesFile  ... ) == 0x0
 01433  1728   NtWaitForSingleObject  (128, 0, 0x0, ...
 01434  1796   NtOpenFile  (0x100020, {24, 0, 0x40, 0, 0,  (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\mswsock.dll"}, 5, 96, ... 132, {status=0x0, info=1}, ) }, 5, 96, ... 132, {status=0x0, info=1}, ) == 0x0
 01435  1796   NtCreateSection  (0xe, 0x0, 0x0, 16, 134217728, 132, ... 136, ) == 0x0
 01436  1796   NtClose  (132, ... ) == 0x0
 01437  1796   NtMapViewOfSection  (136, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 16, ... (0x390000), 0x0, 245760, ) == 0x0
 01438  1796   NtClose  (136, ...
 01430   896   NtAllocateVirtualMemory  ... 12648448, 1048576, ) == 0x0
 01439   896   NtAllocateVirtualMemory  (-1, 13688832, 0, 8192, 4096, 4, ... 13688832, 8192, ) == 0x0
 01440   896   NtProtectVirtualMemory  (-1, (0xd0e000), 4096, 260, ... (0xd0e000), 4096, 4, ) == 0x0
 01441   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ... 132, {1252, 212}, ) == 0x0
 01442   896   NtQueryInformationThread  (132, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ffdb000,Pid=1252,Tid=212,}, 0x0, ) == 0x0
 01443   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81884, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81884, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\204\0\0\0\344\4\0\0\324\0\0\0" ... {28, 56, reply, 0, 1252, 896, 81885, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\204\0\0\0\344\4\0\0\324\0\0\0" )  ... {28, 56, reply, 0, 1252, 896, 81885, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81884, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\204\0\0\0\344\4\0\0\324\0\0\0" ... {28, 56, reply, 0, 1252, 896, 81885, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\204\0\0\0\344\4\0\0\324\0\0\0" )  ) == 0x0
 01438  1796   NtClose  ... ) == 0x0
 01444  1796   NtUnmapViewOfSection  (-1, 0x390000, ... ) == 0x0
 01445  1796   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\mswsock.dll"}, 11596584, ... ) }, 11596584, ... ) == 0x0
 01446  1796   NtOpenFile  (0x100020, {24, 0, 0x40, 0, 0,  (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\mswsock.dll"}, 5, 96, ... 136, {status=0x0, info=1}, ) }, 5, 96, ... 136, {status=0x0, info=1}, ) == 0x0
 01447  1796   NtCreateSection  (0xf, 0x0, 0x0, 16, 16777216, 136, ... 140, ) == 0x0
 01448  1796   NtQuerySection  (140, Image, 48, ... {section info, class 1, size 48}, 0x0, ) == 0x0
 01449  1796   NtClose  (136, ...
 01450   896   NtResumeThread  (132, ... 1, ) == 0x0
 01451   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ... 13697024, 1048576, ) == 0x0
 01452   896   NtAllocateVirtualMemory  (-1, 14737408, 0, 8192, 4096, 4, ... 14737408, 8192, ) == 0x0
 01453   896   NtProtectVirtualMemory  (-1, (0xe0e000), 4096, 260, ... (0xe0e000), 4096, 4, ) == 0x0
 01454   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ... 144, {1252, 180}, ) == 0x0
 01455   896   NtQueryInformationThread  (144, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ffda000,Pid=1252,Tid=180,}, 0x0, ) == 0x0
 01449  1796   NtClose  ... ) == 0x0
 01456   212   NtWaitForSingleObject  (128, 0, 0x0, ...
 01457  1796   NtMapViewOfSection  (140, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x71a50000), 0x0, 258048, ) == 0x0
 01458  1796   NtClose  (140, ... ) == 0x0
 01459  1796   NtProtectVirtualMemory  (-1, (0x71a51000), 1060, 4, ... (0x71a51000), 4096, 32, ) == 0x0
 01460  1796   NtProtectVirtualMemory  (-1, (0x71a51000), 4096, 32, ... (0x71a51000), 4096, 4, ) == 0x0
 01461  1796   NtFlushInstructionCache  (-1, 1906642944, 1060, ... ) == 0x0
 01462  1796   NtProtectVirtualMemory  (-1, (0x71a51000), 1060, 4, ...
 01463   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81885, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81885, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\220\0\0\0\344\4\0\0\264\0\0\0" ... {28, 56, reply, 0, 1252, 896, 81886, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\220\0\0\0\344\4\0\0\264\0\0\0" )  ... {28, 56, reply, 0, 1252, 896, 81886, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81885, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\220\0\0\0\344\4\0\0\264\0\0\0" ... {28, 56, reply, 0, 1252, 896, 81886, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\220\0\0\0\344\4\0\0\264\0\0\0" )  ) == 0x0
 01464   896   NtResumeThread  (144, ... 1, ) == 0x0
 01465   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ... 14745600, 1048576, ) == 0x0
 01466   896   NtAllocateVirtualMemory  (-1, 15785984, 0, 8192, 4096, 4, ... 15785984, 8192, ) == 0x0
 01467   896   NtProtectVirtualMemory  (-1, (0xf0e000), 4096, 260, ... (0xf0e000), 4096, 4, ) == 0x0
 01468   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ...
 01462  1796   NtProtectVirtualMemory  ... (0x71a51000), 4096, 32, ) == 0x0
 01469   180   NtWaitForSingleObject  (128, 0, 0x0, ...
 01470  1796   NtProtectVirtualMemory  (-1, (0x71a51000), 4096, 32, ... (0x71a51000), 4096, 4, ) == 0x0
 01471  1796   NtFlushInstructionCache  (-1, 1906642944, 1060, ... ) == 0x0
 01472  1796   NtProtectVirtualMemory  (-1, (0x71a51000), 1060, 4, ... (0x71a51000), 4096, 32, ) == 0x0
 01473  1796   NtProtectVirtualMemory  (-1, (0x71a51000), 4096, 32, ... (0x71a51000), 4096, 4, ) == 0x0
 01474  1796   NtFlushInstructionCache  (-1, 1906642944, 1060, ... ) == 0x0
 01475  1796   NtOpenKey  (0x80000000, {24, 0, 0x40, 0, 0,  (0x80000000, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mswsock.dll"}, ... }, ...
 01468   896   NtCreateThread  ... 140, {1252, 1256}, ) == 0x0
 01476   896   NtQueryInformationThread  (140, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ffd9000,Pid=1252,Tid=1256,}, 0x0, ) == 0x0
 01477   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81886, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81886, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\214\0\0\0\344\4\0\0\350\4\0\0" ... {28, 56, reply, 0, 1252, 896, 81887, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\214\0\0\0\344\4\0\0\350\4\0\0" )  ... {28, 56, reply, 0, 1252, 896, 81887, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81886, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\214\0\0\0\344\4\0\0\350\4\0\0" ... {28, 56, reply, 0, 1252, 896, 81887, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\214\0\0\0\344\4\0\0\350\4\0\0" )  ) == 0x0
 01478   896   NtResumeThread  (140, ... 1, ) == 0x0
 01479   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ... 15794176, 1048576, ) == 0x0
 01480   896   NtAllocateVirtualMemory  (-1, 16834560, 0, 8192, 4096, 4, ... 16834560, 8192, ) == 0x0
 01475  1796   NtOpenKey  ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01481  1256   NtWaitForSingleObject  (128, 0, 0x0, ...
 01482  1796   NtQuerySystemInformation  (Basic, 44, ... {Unknown=0,MaximumIncrement=156250,PhysicalPageSize=0x1000,NumberOfPhysicalPages=0xff7c,LowestPhysicalPage=0x1,HighestPhysicalPage=0xffff,AllocationGranularity=0x10000,LowestUserAddress=0x10000,HighestUserAddress=0x7ffeffff,ActiveProcessors=1,NumberProcessors=1,}, 0x0, ) == 0x0
 01483  1796   NtQuerySystemInformation  (Processor, 12, ... {system info, class 1, size 12}, 0x0, ) == 0x0
 01484  1796   NtSetEventBoostPriority  (128, ...
 01433  1728   NtWaitForSingleObject  ... ) == 0x0
 01485  1728   NtSetEventBoostPriority  (128, ...
 01456   212   NtWaitForSingleObject  ... ) == 0x0
 01486   212   NtSetEventBoostPriority  (128, ...
 01469   180   NtWaitForSingleObject  ... ) == 0x0
 01487   180   NtSetEventBoostPriority  (128, ...
 01481  1256   NtWaitForSingleObject  ... ) == 0x0
 01488  1256   NtTestAlert  (... ) == 0x0
 01487   180   NtSetEventBoostPriority  ... ) == 0x0
 01486   212   NtSetEventBoostPriority  ... ) == 0x0
 01485  1728   NtSetEventBoostPriority  ... ) == 0x0
 01484  1796   NtSetEventBoostPriority  ... ) == 0x0
 01489   896   NtProtectVirtualMemory  (-1, (0x100e000), 4096, 260, ...
 01490  1256   NtContinue  (15793456, 1, ...
 01491   180   NtTestAlert  (...
 01492   212   NtTestAlert  (...
 01493  1796   NtCreateEvent  (0x1f0003, 0x0, 0, 0, ...
 01489   896   NtProtectVirtualMemory  ... (0x100e000), 4096, 4, ) == 0x0
 01494  1256   NtRegisterThreadTerminatePort  (24, ...
 01491   180   NtTestAlert  ... ) == 0x0
 01492   212   NtTestAlert  ... ) == 0x0
 01493  1796   NtCreateEvent  ... 136, ) == 0x0
 01495   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ...
 01494  1256   NtRegisterThreadTerminatePort  ... ) == 0x0
 01496   180   NtContinue  (14744880, 1, ...
 01497   212   NtContinue  (13696304, 1, ...
 01498  1796   NtOpenSection  (0xe, {24, 8, 0x40, 0, 0,  (0xe, {24, 8, 0x40, 0, 0, "hnetcfg.dll"}, ... }, ...
 01495   896   NtCreateThread  ... 148, {1252, 1536}, ) == 0x0
 01499  1256   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 01500   180   NtRegisterThreadTerminatePort  (24, ...
 01501   212   NtRegisterThreadTerminatePort  (24, ...
 01498  1796   NtOpenSection  ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01502   896   NtQueryInformationThread  (148, Basic, 28, ...
 01499  1256   NtDuplicateObject  ... 152, ) == 0x0
 01500   180   NtRegisterThreadTerminatePort  ... ) == 0x0
 01501   212   NtRegisterThreadTerminatePort  ... ) == 0x0
 01503  1796   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\u:\work\hnetcfg.dll"}, 11596196, ... }, 11596196, ...
 01502   896   NtQueryInformationThread  ... {ExitStatus=0x103,TebBaseAddress=0x7ffd8000,Pid=1252,Tid=1536,}, 0x0, ) == 0x0
 01504  1256   NtWaitForSingleObject  (104, 0, {0, 0}, ...
 01505   180   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 01506   212   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 01507  1728   NtTestAlert  (...
 01508   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81887, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81887, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\224\0\0\0\344\4\0\0\0\6\0\0" ...  ...
 01504  1256   NtWaitForSingleObject  ... ) == 0x102
 01505   180   NtDuplicateObject  ... 156, ) == 0x0
 01507  1728   NtTestAlert  ... ) == 0x0
 01508   896   NtRequestWaitReplyPort  ... {28, 56, reply, 0, 1252, 896, 81888, 0}  ... {28, 56, reply, 0, 1252, 896, 81888, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\224\0\0\0\344\4\0\0\0\6\0\0" )  ) == 0x0
 01509  1256   NtAllocateVirtualMemory  (-1, 15781888, 0, 4096, 4096, 260, ...
 01510   180   NtWaitForSingleObject  (104, 0, {0, 0}, ...
 01511  1728   NtContinue  (12647728, 1, ...
 01512   896   NtResumeThread  (148, ...
 01509  1256   NtAllocateVirtualMemory  ... 15781888, 4096, ) == 0x0
 01510   180   NtWaitForSingleObject  ... ) == 0x102
 01513  1728   NtRegisterThreadTerminatePort  (24, ...
 01512   896   NtResumeThread  ... 1, ) == 0x0
 01514  1256   NtWaitForSingleObject  (128, 0, 0x0, ...
 01515   180   NtCreateEvent  (0x100003, 0x0, 1, 0, ...
 01513  1728   NtRegisterThreadTerminatePort  ... ) == 0x0
 01516   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ...
 01515   180   NtCreateEvent  ... 160, ) == 0x0
 01517  1728   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 01506   212   NtDuplicateObject  ... 164, ) == 0x0
 01518  1536   NtWaitForSingleObject  (128, 0, 0x0, ...
 01516   896   NtAllocateVirtualMemory  ... 16842752, 1048576, ) == 0x0
 01503  1796   NtQueryAttributesFile  ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01519   180   NtWaitForSingleObject  (160, 0, 0x0, ...
 01520   212   NtWaitForSingleObject  (104, 0, {0, 0}, ...
 01521   896   NtAllocateVirtualMemory  (-1, 17883136, 0, 8192, 4096, 4, ...
 01517  1728   NtDuplicateObject  ... 168, ) == 0x0
 01520   212   NtWaitForSingleObject  ... ) == 0x102
 01521   896   NtAllocateVirtualMemory  ... 17883136, 8192, ) == 0x0
 01522  1728   NtWaitForSingleObject  (104, 0, {0, 0}, ...
 01523   212   NtWaitForSingleObject  (160, 0, 0x0, ...
 01524   896   NtProtectVirtualMemory  (-1, (0x110e000), 4096, 260, ...
 01522  1728   NtWaitForSingleObject  ... ) == 0x102
 01524   896   NtProtectVirtualMemory  ... (0x110e000), 4096, 4, ) == 0x0
 01525  1728   NtWaitForSingleObject  (160, 0, 0x0, ...
 01526   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ...
 01527  1796   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\hnetcfg.dll"}, 11596196, ... ) }, 11596196, ... ) == 0x0
 01528  1796   NtOpenFile  (0x100020, {24, 0, 0x40, 0, 0,  (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\hnetcfg.dll"}, 5, 96, ... 172, {status=0x0, info=1}, ) }, 5, 96, ... 172, {status=0x0, info=1}, ) == 0x0
 01529  1796   NtCreateSection  (0xf, 0x0, 0x0, 16, 16777216, 172, ... 176, ) == 0x0
 01530  1796   NtQuerySection  (176, Image, 48, ... {section info, class 1, size 48}, 0x0, ) == 0x0
 01531  1796   NtClose  (172, ... ) == 0x0
 01532  1796   NtMapViewOfSection  (176, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x662b0000), 0x0, 360448, ) == 0x0
 01526   896   NtCreateThread  ... 172, {1252, 276}, ) == 0x0
 01533   896   NtQueryInformationThread  (172, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ffd7000,Pid=1252,Tid=276,}, 0x0, ) == 0x0
 01534   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81888, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81888, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\254\0\0\0\344\4\0\0\24\1\0\0" ... {28, 56, reply, 0, 1252, 896, 81889, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\254\0\0\0\344\4\0\0\24\1\0\0" )  ... {28, 56, reply, 0, 1252, 896, 81889, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81888, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\254\0\0\0\344\4\0\0\24\1\0\0" ... {28, 56, reply, 0, 1252, 896, 81889, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\254\0\0\0\344\4\0\0\24\1\0\0" )  ) == 0x0
 01535   896   NtResumeThread  (172, ... 1, ) == 0x0
 01536   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ... 17891328, 1048576, ) == 0x0
 01537   896   NtAllocateVirtualMemory  (-1, 18931712, 0, 8192, 4096, 4, ... 18931712, 8192, ) == 0x0
 01538  1796   NtClose  (176, ...
 01539   276   NtWaitForSingleObject  (128, 0, 0x0, ...
 01538  1796   NtClose  ... ) == 0x0
 01540  1796   NtProtectVirtualMemory  (-1, (0x662b1000), 932, 4, ... (0x662b1000), 4096, 32, ) == 0x0
 01541  1796   NtProtectVirtualMemory  (-1, (0x662b1000), 4096, 32, ... (0x662b1000), 4096, 4, ) == 0x0
 01542  1796   NtFlushInstructionCache  (-1, 1714098176, 932, ... ) == 0x0
 01543  1796   NtProtectVirtualMemory  (-1, (0x662b1000), 932, 4, ... (0x662b1000), 4096, 32, ) == 0x0
 01544  1796   NtProtectVirtualMemory  (-1, (0x662b1000), 4096, 32, ... (0x662b1000), 4096, 4, ) == 0x0
 01545   896   NtProtectVirtualMemory  (-1, (0x120e000), 4096, 260, ... (0x120e000), 4096, 4, ) == 0x0
 01546   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ... 176, {1252, 968}, ) == 0x0
 01547   896   NtQueryInformationThread  (176, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ffd6000,Pid=1252,Tid=968,}, 0x0, ) == 0x0
 01548   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81889, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81889, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\260\0\0\0\344\4\0\0\310\3\0\0" ... {28, 56, reply, 0, 1252, 896, 81890, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\260\0\0\0\344\4\0\0\310\3\0\0" )  ... {28, 56, reply, 0, 1252, 896, 81890, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81889, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\260\0\0\0\344\4\0\0\310\3\0\0" ... {28, 56, reply, 0, 1252, 896, 81890, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\260\0\0\0\344\4\0\0\310\3\0\0" )  ) == 0x0
 01549   896   NtResumeThread  (176, ... 1, ) == 0x0
 01550   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ...
 01551  1796   NtFlushInstructionCache  (-1, 1714098176, 932, ...
 01552   968   NtWaitForSingleObject  (128, 0, 0x0, ...
 01551  1796   NtFlushInstructionCache  ... ) == 0x0
 01553  1796   NtProtectVirtualMemory  (-1, (0x662b1000), 932, 4, ... (0x662b1000), 4096, 32, ) == 0x0
 01554  1796   NtProtectVirtualMemory  (-1, (0x662b1000), 4096, 32, ... (0x662b1000), 4096, 4, ) == 0x0
 01555  1796   NtFlushInstructionCache  (-1, 1714098176, 932, ... ) == 0x0
 01556  1796   NtProtectVirtualMemory  (-1, (0x662b1000), 932, 4, ... (0x662b1000), 4096, 32, ) == 0x0
 01557  1796   NtProtectVirtualMemory  (-1, (0x662b1000), 4096, 32, ... (0x662b1000), 4096, 4, ) == 0x0
 01550   896   NtAllocateVirtualMemory  ... 18939904, 1048576, ) == 0x0
 01558   896   NtAllocateVirtualMemory  (-1, 19980288, 0, 8192, 4096, 4, ... 19980288, 8192, ) == 0x0
 01559   896   NtProtectVirtualMemory  (-1, (0x130e000), 4096, 260, ... (0x130e000), 4096, 4, ) == 0x0
 01560   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ... 180, {1252, 1688}, ) == 0x0
 01561   896   NtQueryInformationThread  (180, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ffd5000,Pid=1252,Tid=1688,}, 0x0, ) == 0x0
 01562   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81890, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81890, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\264\0\0\0\344\4\0\0\230\6\0\0" ... {28, 56, reply, 0, 1252, 896, 81891, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\264\0\0\0\344\4\0\0\230\6\0\0" )  ... {28, 56, reply, 0, 1252, 896, 81891, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81890, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\264\0\0\0\344\4\0\0\230\6\0\0" ... {28, 56, reply, 0, 1252, 896, 81891, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\264\0\0\0\344\4\0\0\230\6\0\0" )  ) == 0x0
 01563  1796   NtFlushInstructionCache  (-1, 1714098176, 932, ... ) == 0x0
 01564  1796   NtProtectVirtualMemory  (-1, (0x662b1000), 932, 4, ... (0x662b1000), 4096, 32, ) == 0x0
 01565  1796   NtProtectVirtualMemory  (-1, (0x662b1000), 4096, 32, ... (0x662b1000), 4096, 4, ) == 0x0
 01566  1796   NtFlushInstructionCache  (-1, 1714098176, 932, ... ) == 0x0
 01567  1796   NtOpenKey  (0x80000000, {24, 0, 0x40, 0, 0,  (0x80000000, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\hnetcfg.dll"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01568  1796   NtSetEventBoostPriority  (128, ...
 01514  1256   NtWaitForSingleObject  ... ) == 0x0
 01569  1256   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\System32\mswsock.dll"}, 15789008, ... ) }, 15789008, ... ) == 0x0
 01570  1256   NtSetEventBoostPriority  (128, ...
 01518  1536   NtWaitForSingleObject  ... ) == 0x0
 01571  1536   NtSetEventBoostPriority  (128, ...
 01539   276   NtWaitForSingleObject  ... ) == 0x0
 01572   276   NtSetEventBoostPriority  (128, ...
 01552   968   NtWaitForSingleObject  ... ) == 0x0
 01573   968   NtTestAlert  (... ) == 0x0
 01572   276   NtSetEventBoostPriority  ... ) == 0x0
 01571  1536   NtSetEventBoostPriority  ... ) == 0x0
 01570  1256   NtSetEventBoostPriority  ... ) == 0x0
 01568  1796   NtSetEventBoostPriority  ... ) == 0x0
 01574   896   NtResumeThread  (180, ...
 01575   968   NtContinue  (18939184, 1, ...
 01576   276   NtTestAlert  (...
 01577  1256   NtCreateEvent  (0x1f0003, 0x0, 0, 0, ...
 01578  1536   NtTestAlert  (...
 01574   896   NtResumeThread  ... 1, ) == 0x0
 01579   968   NtRegisterThreadTerminatePort  (24, ...
 01576   276   NtTestAlert  ... ) == 0x0
 01577  1256   NtCreateEvent  ... 184, ) == 0x0
 01578  1536   NtTestAlert  ... ) == 0x0
 01580   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ...
 01579   968   NtRegisterThreadTerminatePort  ... ) == 0x0
 01581   276   NtContinue  (17890608, 1, ...
 01582  1256   NtOpenSection  (0xe, {24, 8, 0x40, 0, 0,  (0xe, {24, 8, 0x40, 0, 0, "DNSAPI.dll"}, ... }, ...
 01583  1536   NtContinue  (16842032, 1, ...
 01580   896   NtAllocateVirtualMemory  ... 19988480, 1048576, ) == 0x0
 01584   968   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 01585   276   NtRegisterThreadTerminatePort  (24, ...
 01582  1256   NtOpenSection  ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01586  1536   NtRegisterThreadTerminatePort  (24, ...
 01587   896   NtAllocateVirtualMemory  (-1, 21028864, 0, 8192, 4096, 4, ...
 01584   968   NtDuplicateObject  ... 188, ) == 0x0
 01585   276   NtRegisterThreadTerminatePort  ... ) == 0x0
 01588  1796   NtWaitForSingleObject  (128, 0, 0x0, ...
 01589  1688   NtWaitForSingleObject  (128, 0, 0x0, ...
 01586  1536   NtRegisterThreadTerminatePort  ... ) == 0x0
 01587   896   NtAllocateVirtualMemory  ... 21028864, 8192, ) == 0x0
 01590   968   NtWaitForSingleObject  (104, 0, {0, 0}, ...
 01591   276   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 01592  1536   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 01593  1256   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\u:\work\DNSAPI.dll"}, 15789112, ... }, 15789112, ...
 01594   896   NtProtectVirtualMemory  (-1, (0x140e000), 4096, 260, ...
 01590   968   NtWaitForSingleObject  ... ) == 0x102
 01591   276   NtDuplicateObject  ... 192, ) == 0x0
 01594   896   NtProtectVirtualMemory  ... (0x140e000), 4096, 4, ) == 0x0
 01595   968   NtWaitForSingleObject  (160, 0, 0x0, ...
 01596   276   NtWaitForSingleObject  (104, 0, {0, 0}, ...
 01597   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ...
 01596   276   NtWaitForSingleObject  ... ) == 0x102
 01597   896   NtCreateThread  ... 196, {1252, 1496}, ) == 0x0
 01598   276   NtWaitForSingleObject  (160, 0, 0x0, ...
 01599   896   NtQueryInformationThread  (196, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ffd4000,Pid=1252,Tid=1496,}, 0x0, ) == 0x0
 01600   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81891, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81891, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\304\0\0\0\344\4\0\0\330\5\0\0" ... {28, 56, reply, 0, 1252, 896, 81892, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\304\0\0\0\344\4\0\0\330\5\0\0" )  ... {28, 56, reply, 0, 1252, 896, 81892, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81891, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\304\0\0\0\344\4\0\0\330\5\0\0" ... {28, 56, reply, 0, 1252, 896, 81892, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\304\0\0\0\344\4\0\0\330\5\0\0" )  ) == 0x0
 01601   896   NtResumeThread  (196, ... 1, ) == 0x0
 01602   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ...
 01592  1536   NtDuplicateObject  ... 200, ) == 0x0
 01603  1496   NtWaitForSingleObject  (128, 0, 0x0, ...
 01604  1536   NtWaitForSingleObject  (104, 0, {0, 0}, ... ) == 0x102
 01605  1536   NtWaitForSingleObject  (160, 0, 0x0, ...
 01602   896   NtAllocateVirtualMemory  ... 21037056, 1048576, ) == 0x0
 01606   896   NtAllocateVirtualMemory  (-1, 22077440, 0, 8192, 4096, 4, ... 22077440, 8192, ) == 0x0
 01607   896   NtProtectVirtualMemory  (-1, (0x150e000), 4096, 260, ... (0x150e000), 4096, 4, ) == 0x0
 01608   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ... 204, {1252, 1896}, ) == 0x0
 01609   896   NtQueryInformationThread  (204, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ffaf000,Pid=1252,Tid=1896,}, 0x0, ) == 0x0
 01610   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81892, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81892, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\314\0\0\0\344\4\0\0h\7\0\0" ... {28, 56, reply, 0, 1252, 896, 81893, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\314\0\0\0\344\4\0\0h\7\0\0" )  ... {28, 56, reply, 0, 1252, 896, 81893, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81892, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\314\0\0\0\344\4\0\0h\7\0\0" ... {28, 56, reply, 0, 1252, 896, 81893, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\314\0\0\0\344\4\0\0h\7\0\0" )  ) == 0x0
 01611   896   NtResumeThread  (204, ... 1, ) == 0x0
 01612   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ... 22085632, 1048576, ) == 0x0
 01613   896   NtAllocateVirtualMemory  (-1, 23126016, 0, 8192, 4096, 4, ... 23126016, 8192, ) == 0x0
 01593  1256   NtQueryAttributesFile  ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01614  1896   NtWaitForSingleObject  (128, 0, 0x0, ...
 01615  1256   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\DNSAPI.dll"}, 15789112, ... ) }, 15789112, ... ) == 0x0
 01616  1256   NtOpenFile  (0x100020, {24, 0, 0x40, 0, 0,  (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\DNSAPI.dll"}, 5, 96, ... 208, {status=0x0, info=1}, ) }, 5, 96, ... 208, {status=0x0, info=1}, ) == 0x0
 01617  1256   NtCreateSection  (0xf, 0x0, 0x0, 16, 16777216, 208, ... 212, ) == 0x0
 01618  1256   NtQuerySection  (212, Image, 48, ... {section info, class 1, size 48}, 0x0, ) == 0x0
 01619  1256   NtClose  (208, ... ) == 0x0
 01620  1256   NtMapViewOfSection  (212, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ...
 01621   896   NtProtectVirtualMemory  (-1, (0x160e000), 4096, 260, ... (0x160e000), 4096, 4, ) == 0x0
 01622   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ... 208, {1252, 148}, ) == 0x0
 01623   896   NtQueryInformationThread  (208, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ffae000,Pid=1252,Tid=148,}, 0x0, ) == 0x0
 01624   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81893, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81893, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\320\0\0\0\344\4\0\0\224\0\0\0" ... {28, 56, reply, 0, 1252, 896, 81894, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\320\0\0\0\344\4\0\0\224\0\0\0" )  ... {28, 56, reply, 0, 1252, 896, 81894, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81893, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\320\0\0\0\344\4\0\0\224\0\0\0" ... {28, 56, reply, 0, 1252, 896, 81894, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\320\0\0\0\344\4\0\0\224\0\0\0" )  ) == 0x0
 01625   896   NtResumeThread  (208, ... 1, ) == 0x0
 01626   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ...
 01620  1256   NtMapViewOfSection  ... (0x76f20000), 0x0, 159744, ) == 0x0
 01627   148   NtWaitForSingleObject  (128, 0, 0x0, ...
 01628  1256   NtClose  (212, ... ) == 0x0
 01629  1256   NtProtectVirtualMemory  (-1, (0x76f21000), 616, 4, ... (0x76f21000), 4096, 32, ) == 0x0
 01630  1256   NtProtectVirtualMemory  (-1, (0x76f21000), 4096, 32, ... (0x76f21000), 4096, 4, ) == 0x0
 01631  1256   NtFlushInstructionCache  (-1, 1995575296, 616, ... ) == 0x0
 01632  1256   NtProtectVirtualMemory  (-1, (0x76f21000), 616, 4, ... (0x76f21000), 4096, 32, ) == 0x0
 01633  1256   NtProtectVirtualMemory  (-1, (0x76f21000), 4096, 32, ...
 01626   896   NtAllocateVirtualMemory  ... 23134208, 1048576, ) == 0x0
 01634   896   NtAllocateVirtualMemory  (-1, 24174592, 0, 8192, 4096, 4, ... 24174592, 8192, ) == 0x0
 01635   896   NtProtectVirtualMemory  (-1, (0x170e000), 4096, 260, ... (0x170e000), 4096, 4, ) == 0x0
 01636   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ... 212, {1252, 1500}, ) == 0x0
 01637   896   NtQueryInformationThread  (212, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ffad000,Pid=1252,Tid=1500,}, 0x0, ) == 0x0
 01638   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81894, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81894, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\324\0\0\0\344\4\0\0\334\5\0\0" ... {28, 56, reply, 0, 1252, 896, 81895, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\324\0\0\0\344\4\0\0\334\5\0\0" )  ... {28, 56, reply, 0, 1252, 896, 81895, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81894, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\324\0\0\0\344\4\0\0\334\5\0\0" ... {28, 56, reply, 0, 1252, 896, 81895, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\324\0\0\0\344\4\0\0\334\5\0\0" )  ) == 0x0
 01633  1256   NtProtectVirtualMemory  ... (0x76f21000), 4096, 4, ) == 0x0
 01639  1256   NtFlushInstructionCache  (-1, 1995575296, 616, ... ) == 0x0
 01640  1256   NtProtectVirtualMemory  (-1, (0x76f21000), 616, 4, ... (0x76f21000), 4096, 32, ) == 0x0
 01641  1256   NtProtectVirtualMemory  (-1, (0x76f21000), 4096, 32, ... (0x76f21000), 4096, 4, ) == 0x0
 01642  1256   NtFlushInstructionCache  (-1, 1995575296, 616, ... ) == 0x0
 01643  1256   NtProtectVirtualMemory  (-1, (0x76f21000), 616, 4, ... (0x76f21000), 4096, 32, ) == 0x0
 01644  1256   NtProtectVirtualMemory  (-1, (0x76f21000), 4096, 32, ...
 01645   896   NtResumeThread  (212, ... 1, ) == 0x0
 01646   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ... 24182784, 1048576, ) == 0x0
 01647   896   NtAllocateVirtualMemory  (-1, 25223168, 0, 8192, 4096, 4, ... 25223168, 8192, ) == 0x0
 01648   896   NtProtectVirtualMemory  (-1, (0x180e000), 4096, 260, ... (0x180e000), 4096, 4, ) == 0x0
 01649   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ... 216, {1252, 2032}, ) == 0x0
 01650   896   NtQueryInformationThread  (216, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ffac000,Pid=1252,Tid=2032,}, 0x0, ) == 0x0
 01644  1256   NtProtectVirtualMemory  ... (0x76f21000), 4096, 4, ) == 0x0
 01651  1500   NtWaitForSingleObject  (128, 0, 0x0, ...
 01652  1256   NtFlushInstructionCache  (-1, 1995575296, 616, ... ) == 0x0
 01653  1256   NtProtectVirtualMemory  (-1, (0x76f21000), 616, 4, ... (0x76f21000), 4096, 32, ) == 0x0
 01654  1256   NtProtectVirtualMemory  (-1, (0x76f21000), 4096, 32, ... (0x76f21000), 4096, 4, ) == 0x0
 01655  1256   NtFlushInstructionCache  (-1, 1995575296, 616, ... ) == 0x0
 01656  1256   NtProtectVirtualMemory  (-1, (0x76f21000), 616, 4, ... (0x76f21000), 4096, 32, ) == 0x0
 01657  1256   NtProtectVirtualMemory  (-1, (0x76f21000), 4096, 32, ...
 01658   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81895, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81895, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\330\0\0\0\344\4\0\0\360\7\0\0" ... {28, 56, reply, 0, 1252, 896, 81896, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\330\0\0\0\344\4\0\0\360\7\0\0" )  ... {28, 56, reply, 0, 1252, 896, 81896, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81895, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\330\0\0\0\344\4\0\0\360\7\0\0" ... {28, 56, reply, 0, 1252, 896, 81896, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\330\0\0\0\344\4\0\0\360\7\0\0" )  ) == 0x0
 01659   896   NtResumeThread  (216, ... 1, ) == 0x0
 01660   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ... 25231360, 1048576, ) == 0x0
 01661   896   NtAllocateVirtualMemory  (-1, 26271744, 0, 8192, 4096, 4, ... 26271744, 8192, ) == 0x0
 01662   896   NtProtectVirtualMemory  (-1, (0x190e000), 4096, 260, ... (0x190e000), 4096, 4, ) == 0x0
 01663   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ...
 01657  1256   NtProtectVirtualMemory  ... (0x76f21000), 4096, 4, ) == 0x0
 01664  2032   NtWaitForSingleObject  (128, 0, 0x0, ...
 01665  1256   NtFlushInstructionCache  (-1, 1995575296, 616, ... ) == 0x0
 01666  1256   NtOpenKey  (0x80000000, {24, 0, 0x40, 0, 0,  (0x80000000, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\DNSAPI.dll"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01667  1256   NtCreateKey  (0x20019, {24, 40, 0x40, 0, 0,  (0x20019, {24, 40, 0x40, 0, 0, "System\CurrentControlSet\Services\Tcpip\Parameters"}, 0, "Class", 0, ... 220, 2, ) }, 0,  (0x20019, {24, 40, 0x40, 0, 0, "System\CurrentControlSet\Services\Tcpip\Parameters"}, 0, "Class", 0, ... 220, 2, ) , 0, ... 220, 2, ) == 0x0
 01668  1256   NtOpenKey  (0x20019, {24, 40, 0x40, 0, 0,  (0x20019, {24, 40, 0x40, 0, 0, "System\CurrentControlSet\Services\DnsCache\Parameters"}, ... 224, ) }, ... 224, ) == 0x0
 01669  1256   NtOpenKey  (0x20019, {24, 40, 0x40, 0, 0,  (0x20019, {24, 40, 0x40, 0, 0, "Software\Policies\Microsoft\Windows NT\DnsClient"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01670  1256   NtQueryValueKey  (224,  (224, "QueryAdapterName", Partial, 144, ... , Partial, 144, ...
 01663   896   NtCreateThread  ... 228, {1252, 496}, ) == 0x0
 01671   896   NtQueryInformationThread  (228, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ffab000,Pid=1252,Tid=496,}, 0x0, ) == 0x0
 01672   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81896, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81896, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\344\0\0\0\344\4\0\0\360\1\0\0" ... {28, 56, reply, 0, 1252, 896, 81897, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\344\0\0\0\344\4\0\0\360\1\0\0" )  ... {28, 56, reply, 0, 1252, 896, 81897, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81896, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\344\0\0\0\344\4\0\0\360\1\0\0" ... {28, 56, reply, 0, 1252, 896, 81897, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\344\0\0\0\344\4\0\0\360\1\0\0" )  ) == 0x0
 01673   896   NtResumeThread  (228, ... 1, ) == 0x0
 01674   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ... 26279936, 1048576, ) == 0x0
 01675   896   NtAllocateVirtualMemory  (-1, 27320320, 0, 8192, 4096, 4, ... 27320320, 8192, ) == 0x0
 01670  1256   NtQueryValueKey  ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01676   496   NtWaitForSingleObject  (128, 0, 0x0, ...
 01677  1256   NtQueryValueKey  (220,  (220, "DisableAdapterDomainName", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01678  1256   NtQueryValueKey  (224,  (224, "UseDomainNameDevolution", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01679  1256   NtQueryValueKey  (220,  (220, "UseDomainNameDevolution", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (220, "UseDomainNameDevolution", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) }, 16, ) == 0x0
 01680  1256   NtQueryValueKey  (224,  (224, "PrioritizeRecordData", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01681  1256   NtQueryValueKey  (220,  (220, "PrioritizeRecordData", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01682  1256   NtQueryValueKey  (224,  (224, "AllowUnqualifiedQuery", Partial, 144, ... , Partial, 144, ...
 01683   896   NtProtectVirtualMemory  (-1, (0x1a0e000), 4096, 260, ... (0x1a0e000), 4096, 4, ) == 0x0
 01684   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ... 232, {1252, 476}, ) == 0x0
 01685   896   NtQueryInformationThread  (232, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ffaa000,Pid=1252,Tid=476,}, 0x0, ) == 0x0
 01686   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81897, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81897, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\350\0\0\0\344\4\0\0\334\1\0\0" ... {28, 56, reply, 0, 1252, 896, 81898, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\350\0\0\0\344\4\0\0\334\1\0\0" )  ... {28, 56, reply, 0, 1252, 896, 81898, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81897, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\350\0\0\0\344\4\0\0\334\1\0\0" ... {28, 56, reply, 0, 1252, 896, 81898, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\350\0\0\0\344\4\0\0\334\1\0\0" )  ) == 0x0
 01687   896   NtResumeThread  (232, ... 1, ) == 0x0
 01688   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ...
 01682  1256   NtQueryValueKey  ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01689   476   NtWaitForSingleObject  (128, 0, 0x0, ...
 01690  1256   NtQueryValueKey  (220,  (220, "AllowUnqualifiedQuery", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01691  1256   NtQueryValueKey  (224,  (224, "AppendToMultiLabelName", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01692  1256   NtQueryValueKey  (224,  (224, "ScreenBadTlds", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01693  1256   NtQueryValueKey  (224,  (224, "ScreenUnreachableServers", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01694  1256   NtQueryValueKey  (224,  (224, "FilterClusterIp", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01695  1256   NtQueryValueKey  (224,  (224, "WaitForNameErrorOnAll", Partial, 144, ... , Partial, 144, ...
 01688   896   NtAllocateVirtualMemory  ... 27328512, 1048576, ) == 0x0
 01696   896   NtAllocateVirtualMemory  (-1, 28368896, 0, 8192, 4096, 4, ... 28368896, 8192, ) == 0x0
 01697   896   NtProtectVirtualMemory  (-1, (0x1b0e000), 4096, 260, ... (0x1b0e000), 4096, 4, ) == 0x0
 01698   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ... 236, {1252, 1404}, ) == 0x0
 01699   896   NtQueryInformationThread  (236, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ffa9000,Pid=1252,Tid=1404,}, 0x0, ) == 0x0
 01695  1256   NtQueryValueKey  ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01700  1256   NtQueryValueKey  (224,  (224, "UseEdns", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01701  1256   NtQueryValueKey  (224,  (224, "QueryIpMatching", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01702  1256   NtQueryValueKey  (224,  (224, "UseHostsFile", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01703  1256   NtQueryValueKey  (224,  (224, "RegistrationEnabled", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01704  1256   NtQueryValueKey  (220,  (220, "DisableDynamicUpdate", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01705  1256   NtQueryValueKey  (224,  (224, "RegisterPrimaryName", Partial, 144, ... , Partial, 144, ...
 01706   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81898, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81898, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\354\0\0\0\344\4\0\0|\5\0\0" ... {28, 56, reply, 0, 1252, 896, 81899, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\354\0\0\0\344\4\0\0|\5\0\0" )  ... {28, 56, reply, 0, 1252, 896, 81899, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81898, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\354\0\0\0\344\4\0\0|\5\0\0" ... {28, 56, reply, 0, 1252, 896, 81899, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\354\0\0\0\344\4\0\0|\5\0\0" )  ) == 0x0
 01707   896   NtResumeThread  (236, ... 1, ) == 0x0
 01708   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ... 28377088, 1048576, ) == 0x0
 01709   896   NtAllocateVirtualMemory  (-1, 29417472, 0, 8192, 4096, 4, ... 29417472, 8192, ) == 0x0
 01710   896   NtProtectVirtualMemory  (-1, (0x1c0e000), 4096, 260, ... (0x1c0e000), 4096, 4, ) == 0x0
 01711   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ...
 01705  1256   NtQueryValueKey  ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01712  1404   NtWaitForSingleObject  (128, 0, 0x0, ...
 01713  1256   NtQueryValueKey  (224,  (224, "RegisterAdapterName", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01714  1256   NtQueryValueKey  (220,  (220, "EnableAdapterDomainNameRegistration", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01715  1256   NtQueryValueKey  (224,  (224, "RegisterReverseLookup", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01716  1256   NtQueryValueKey  (220,  (220, "DisableReverseAddressRegistrations", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01717  1256   NtQueryValueKey  (224,  (224, "RegisterWanAdapters", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01718  1256   NtQueryValueKey  (220,  (220, "DisableWanDynamicUpdate", Partial, 144, ... , Partial, 144, ...
 01711   896   NtCreateThread  ... 240, {1252, 336}, ) == 0x0
 01719   896   NtQueryInformationThread  (240, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ffa8000,Pid=1252,Tid=336,}, 0x0, ) == 0x0
 01720   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81899, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81899, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\360\0\0\0\344\4\0\0P\1\0\0" ... {28, 56, reply, 0, 1252, 896, 81900, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\360\0\0\0\344\4\0\0P\1\0\0" )  ... {28, 56, reply, 0, 1252, 896, 81900, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81899, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\360\0\0\0\344\4\0\0P\1\0\0" ... {28, 56, reply, 0, 1252, 896, 81900, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\360\0\0\0\344\4\0\0P\1\0\0" )  ) == 0x0
 01721   896   NtResumeThread  (240, ... 1, ) == 0x0
 01722   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ... 29425664, 1048576, ) == 0x0
 01723   896   NtAllocateVirtualMemory  (-1, 30466048, 0, 8192, 4096, 4, ... 30466048, 8192, ) == 0x0
 01718  1256   NtQueryValueKey  ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01724   336   NtWaitForSingleObject  (128, 0, 0x0, ...
 01725  1256   NtQueryValueKey  (224,  (224, "RegistrationTtl", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01726  1256   NtQueryValueKey  (220,  (220, "DefaultRegistrationTTL", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01727  1256   NtQueryValueKey  (224,  (224, "RegistrationRefreshInterval", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01728  1256   NtQueryValueKey  (220,  (220, "DefaultRegistrationRefreshInterval", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01729  1256   NtQueryValueKey  (224,  (224, "RegistrationMaxAddressCount", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01730  1256   NtQueryValueKey  (220,  (220, "MaxNumberOfAddressesToRegister", Partial, 144, ... , Partial, 144, ...
 01731   896   NtProtectVirtualMemory  (-1, (0x1d0e000), 4096, 260, ... (0x1d0e000), 4096, 4, ) == 0x0
 01732   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ... 244, {1252, 1924}, ) == 0x0
 01733   896   NtQueryInformationThread  (244, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ff9f000,Pid=1252,Tid=1924,}, 0x0, ) == 0x0
 01734   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81900, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81900, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\364\0\0\0\344\4\0\0\204\7\0\0" ... {28, 56, reply, 0, 1252, 896, 81901, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\364\0\0\0\344\4\0\0\204\7\0\0" )  ... {28, 56, reply, 0, 1252, 896, 81901, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81900, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\364\0\0\0\344\4\0\0\204\7\0\0" ... {28, 56, reply, 0, 1252, 896, 81901, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\364\0\0\0\344\4\0\0\204\7\0\0" )  ) == 0x0
 01735   896   NtResumeThread  (244, ... 1, ) == 0x0
 01736   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ...
 01730  1256   NtQueryValueKey  ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01737  1924   NtWaitForSingleObject  (128, 0, 0x0, ...
 01738  1256   NtQueryValueKey  (224,  (224, "UpdateSecurityLevel", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01739  1256   NtQueryValueKey  (220,  (220, "UpdateSecurityLevel", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01740  1256   NtQueryValueKey  (224,  (224, "UpdateZoneExcludeFile", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01741  1256   NtQueryValueKey  (224,  (224, "UpdateTopLevelDomainZones", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01742  1256   NtQueryValueKey  (224,  (224, "DnsTest", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01743  1256   NtQueryValueKey  (224,  (224, "MaxCacheSize", Partial, 144, ... , Partial, 144, ...
 01736   896   NtAllocateVirtualMemory  ... 30474240, 1048576, ) == 0x0
 01744   896   NtAllocateVirtualMemory  (-1, 31514624, 0, 8192, 4096, 4, ... 31514624, 8192, ) == 0x0
 01745   896   NtProtectVirtualMemory  (-1, (0x1e0e000), 4096, 260, ... (0x1e0e000), 4096, 4, ) == 0x0
 01746   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ... 248, {1252, 768}, ) == 0x0
 01747   896   NtQueryInformationThread  (248, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ff9e000,Pid=1252,Tid=768,}, 0x0, ) == 0x0
 01748   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81901, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81901, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\370\0\0\0\344\4\0\0\0\3\0\0" ... {28, 56, reply, 0, 1252, 896, 81902, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\370\0\0\0\344\4\0\0\0\3\0\0" )  ... {28, 56, reply, 0, 1252, 896, 81902, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81901, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\370\0\0\0\344\4\0\0\0\3\0\0" ... {28, 56, reply, 0, 1252, 896, 81902, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\370\0\0\0\344\4\0\0\0\3\0\0" )  ) == 0x0
 01743  1256   NtQueryValueKey  ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01749  1256   NtQueryValueKey  (224,  (224, "MaxCacheTtl", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01750  1256   NtQueryValueKey  (224,  (224, "MaxNegativeCacheTtl", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01751  1256   NtQueryValueKey  (224,  (224, "AdapterTimeoutLimit", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01752  1256   NtQueryValueKey  (224,  (224, "ServerPriorityTimeLimit", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01753  1256   NtQueryValueKey  (224,  (224, "MaxCachedSockets", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01754  1256   NtQueryValueKey  (224,  (224, "MulticastListenLevel", Partial, 144, ... , Partial, 144, ...
 01755   896   NtResumeThread  (248, ... 1, ) == 0x0
 01756   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ... 31522816, 1048576, ) == 0x0
 01757   896   NtAllocateVirtualMemory  (-1, 32563200, 0, 8192, 4096, 4, ... 32563200, 8192, ) == 0x0
 01758   896   NtProtectVirtualMemory  (-1, (0x1f0e000), 4096, 260, ... (0x1f0e000), 4096, 4, ) == 0x0
 01759   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ... 252, {1252, 216}, ) == 0x0
 01760   896   NtQueryInformationThread  (252, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ff9d000,Pid=1252,Tid=216,}, 0x0, ) == 0x0
 01754  1256   NtQueryValueKey  ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01761   768   NtWaitForSingleObject  (128, 0, 0x0, ...
 01762  1256   NtQueryValueKey  (224,  (224, "MulticastSendLevel", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01763  1256   NtOpenKey  (0x1, {24, 40, 0x40, 0, 0,  (0x1, {24, 40, 0x40, 0, 0, "System\Setup"}, ... 256, ) }, ... 256, ) == 0x0
 01764  1256   NtQueryValueKey  (256,  (256, "SystemSetupInProgress", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (256, "SystemSetupInProgress", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) }, 16, ) == 0x0
 01765  1256   NtClose  (256, ... ) == 0x0
 01766  1256   NtClose  (220, ... ) == 0x0
 01767  1256   NtClose  (224, ...
 01768   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81902, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81902, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\374\0\0\0\344\4\0\0\330\0\0\0" ... {28, 56, reply, 0, 1252, 896, 81903, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\374\0\0\0\344\4\0\0\330\0\0\0" )  ... {28, 56, reply, 0, 1252, 896, 81903, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81902, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\374\0\0\0\344\4\0\0\330\0\0\0" ... {28, 56, reply, 0, 1252, 896, 81903, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\374\0\0\0\344\4\0\0\330\0\0\0" )  ) == 0x0
 01769   896   NtResumeThread  (252, ... 1, ) == 0x0
 01770   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ... 32571392, 1048576, ) == 0x0
 01771   896   NtAllocateVirtualMemory  (-1, 33611776, 0, 8192, 4096, 4, ... 33611776, 8192, ) == 0x0
 01772   896   NtProtectVirtualMemory  (-1, (0x200e000), 4096, 260, ... (0x200e000), 4096, 4, ) == 0x0
 01773   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ...
 01767  1256   NtClose  ... ) == 0x0
 01774   216   NtWaitForSingleObject  (128, 0, 0x0, ...
 01775  1256   NtOpenKey  (0x1, {24, 40, 0x40, 0, 0,  (0x1, {24, 40, 0x40, 0, 0, "System\CurrentControlSet\Services\Tcpip\Parameters"}, ... 224, ) }, ... 224, ) == 0x0
 01776  1256   NtQueryValueKey  (224,  (224, "DnsQueryTimeouts", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01777  1256   NtQueryValueKey  (224,  (224, "DnsQuickQueryTimeouts", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01778  1256   NtQueryValueKey  (224,  (224, "DnsMulticastQueryTimeouts", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 01779  1256   NtClose  (224, ... ) == 0x0
 01780  1256   NtSetEventBoostPriority  (128, ...
 01773   896   NtCreateThread  ... 224, {1252, 1864}, ) == 0x0
 01781   896   NtQueryInformationThread  (224, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ff9c000,Pid=1252,Tid=1864,}, 0x0, ) == 0x0
 01782   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81903, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81903, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\340\0\0\0\344\4\0\0H\7\0\0" ... {28, 56, reply, 0, 1252, 896, 81904, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\340\0\0\0\344\4\0\0H\7\0\0" )  ... {28, 56, reply, 0, 1252, 896, 81904, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81903, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\340\0\0\0\344\4\0\0H\7\0\0" ... {28, 56, reply, 0, 1252, 896, 81904, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\340\0\0\0\344\4\0\0H\7\0\0" )  ) == 0x0
 01783   896   NtResumeThread  (224, ... 1, ) == 0x0
 01784   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ... 33619968, 1048576, ) == 0x0
 01785   896   NtAllocateVirtualMemory  (-1, 34660352, 0, 8192, 4096, 4, ... 34660352, 8192, ) == 0x0
 01588  1796   NtWaitForSingleObject  ... ) == 0x0
 01780  1256   NtSetEventBoostPriority  ... ) == 0x0
 01786  1864   NtWaitForSingleObject  (128, 0, 0x0, ...
 01787  1796   NtSetEventBoostPriority  (128, ...
 01788  1256   NtWaitForSingleObject  (128, 0, 0x0, ...
 01589  1688   NtWaitForSingleObject  ... ) == 0x0
 01787  1796   NtSetEventBoostPriority  ... ) == 0x0
 01789  1688   NtSetEventBoostPriority  (128, ...
 01603  1496   NtWaitForSingleObject  ... ) == 0x0
 01790  1496   NtSetEventBoostPriority  (128, ...
 01614  1896   NtWaitForSingleObject  ... ) == 0x0
 01791  1896   NtSetEventBoostPriority  (128, ...
 01627   148   NtWaitForSingleObject  ... ) == 0x0
 01792   148   NtSetEventBoostPriority  (128, ...
 01651  1500   NtWaitForSingleObject  ... ) == 0x0
 01793  1500   NtSetEventBoostPriority  (128, ...
 01664  2032   NtWaitForSingleObject  ... ) == 0x0
 01794  2032   NtSetEventBoostPriority  (128, ...
 01676   496   NtWaitForSingleObject  ... ) == 0x0
 01795   496   NtSetEventBoostPriority  (128, ...
 01689   476   NtWaitForSingleObject  ... ) == 0x0
 01796   476   NtSetEventBoostPriority  (128, ...
 01712  1404   NtWaitForSingleObject  ... ) == 0x0
 01797  1404   NtSetEventBoostPriority  (128, ...
 01724   336   NtWaitForSingleObject  ... ) == 0x0
 01798   336   NtSetEventBoostPriority  (128, ...
 01737  1924   NtWaitForSingleObject  ... ) == 0x0
 01799  1924   NtSetEventBoostPriority  (128, ...
 01761   768   NtWaitForSingleObject  ... ) == 0x0
 01800   768   NtSetEventBoostPriority  (128, ...
 01774   216   NtWaitForSingleObject  ... ) == 0x0
 01801   216   NtSetEventBoostPriority  (128, ...
 01786  1864   NtWaitForSingleObject  ... ) == 0x0
 01802  1864   NtSetEventBoostPriority  (128, ...
 01788  1256   NtWaitForSingleObject  ... ) == 0x0
 01803  1256   NtCreateEvent  (0x1f0003, 0x0, 0, 0, ... 220, ) == 0x0
 01802  1864   NtSetEventBoostPriority  ... ) == 0x0
 01801   216   NtSetEventBoostPriority  ... ) == 0x0
 01800   768   NtSetEventBoostPriority  ... ) == 0x0
 01799  1924   NtSetEventBoostPriority  ... ) == 0x0
 01798   336   NtSetEventBoostPriority  ... ) == 0x0
 01797  1404   NtSetEventBoostPriority  ... ) == 0x0
 01796   476   NtSetEventBoostPriority  ... ) == 0x0
 01795   496   NtSetEventBoostPriority  ... ) == 0x0
 01794  2032   NtSetEventBoostPriority  ... ) == 0x0
 01793  1500   NtSetEventBoostPriority  ... ) == 0x0
 01792   148   NtSetEventBoostPriority  ... ) == 0x0
 01791  1896   NtSetEventBoostPriority  ... ) == 0x0
 01790  1496   NtSetEventBoostPriority  ... ) == 0x0
 01789  1688   NtSetEventBoostPriority  ... ) == 0x0
 01804  1796   NtCreateEvent  (0x1f0003, 0x0, 0, 0, ...
 01805   896   NtProtectVirtualMemory  (-1, (0x210e000), 4096, 260, ...
 01806  1256   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 01807  1864   NtTestAlert  (...
 01808   216   NtTestAlert  (...
 01809   768   NtTestAlert  (...
 01810  1924   NtTestAlert  (...
 01811   336   NtTestAlert  (...
 01812  1404   NtTestAlert  (...
 01813   476   NtTestAlert  (...
 01814   496   NtTestAlert  (...
 01815  2032   NtTestAlert  (...
 01816  1500   NtTestAlert  (...
 01817   148   NtTestAlert  (...
 01818  1896   NtTestAlert  (...
 01819  1496   NtTestAlert  (...
 01820  1688   NtTestAlert  (...
 01805   896   NtProtectVirtualMemory  ... (0x210e000), 4096, 4, ) == 0x0
 01806  1256   NtDuplicateObject  ... 256, ) == 0x0
 01807  1864   NtTestAlert  ... ) == 0x0
 01808   216   NtTestAlert  ... ) == 0x0
 01809   768   NtTestAlert  ... ) == 0x0
 01810  1924   NtTestAlert  ... ) == 0x0
 01811   336   NtTestAlert  ... ) == 0x0
 01812  1404   NtTestAlert  ... ) == 0x0
 01813   476   NtTestAlert  ... ) == 0x0
 01814   496   NtTestAlert  ... ) == 0x0
 01815  2032   NtTestAlert  ... ) == 0x0
 01816  1500   NtTestAlert  ... ) == 0x0
 01817   148   NtTestAlert  ... ) == 0x0
 01818  1896   NtTestAlert  ... ) == 0x0
 01819  1496   NtTestAlert  ... ) == 0x0
 01820  1688   NtTestAlert  ... ) == 0x0
 01821   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ...
 01822  1256   NtOpenFile  (0x100001, {24, 0, 0x40, 0, 0,  (0x100001, {24, 0, 0x40, 0, 0, "\Device\KsecDD"}, 7, 16, ... }, 7, 16, ...
 01823  1864   NtContinue  (33619248, 1, ...
 01824   216   NtContinue  (32570672, 1, ...
 01825   768   NtContinue  (31522096, 1, ...
 01826  1924   NtContinue  (30473520, 1, ...
 01827   336   NtContinue  (29424944, 1, ...
 01828  1404   NtContinue  (28376368, 1, ...
 01829   476   NtContinue  (27327792, 1, ...
 01830   496   NtContinue  (26279216, 1, ...
 01831  2032   NtContinue  (25230640, 1, ...
 01832  1500   NtContinue  (24182064, 1, ...
 01833   148   NtContinue  (23133488, 1, ...
 01834  1896   NtContinue  (22084912, 1, ...
 01835  1496   NtContinue  (21036336, 1, ...
 01836  1688   NtContinue  (19987760, 1, ...
 01821   896   NtCreateThread  ... 260, {1252, 1804}, ) == 0x0
 01822  1256   NtOpenFile  ... 264, {status=0x0, info=0}, ) == 0x0
 01837  1864   NtRegisterThreadTerminatePort  (24, ...
 01838   216   NtRegisterThreadTerminatePort  (24, ...
 01839   768   NtRegisterThreadTerminatePort  (24, ...
 01840  1924   NtRegisterThreadTerminatePort  (24, ...
 01841   336   NtRegisterThreadTerminatePort  (24, ...
 01842  1404   NtRegisterThreadTerminatePort  (24, ...
 01843   476   NtRegisterThreadTerminatePort  (24, ...
 01844   496   NtRegisterThreadTerminatePort  (24, ...
 01845  2032   NtRegisterThreadTerminatePort  (24, ...
 01846  1500   NtRegisterThreadTerminatePort  (24, ...
 01847   148   NtRegisterThreadTerminatePort  (24, ...
 01848  1896   NtRegisterThreadTerminatePort  (24, ...
 01849  1496   NtRegisterThreadTerminatePort  (24, ...
 01850  1688   NtRegisterThreadTerminatePort  (24, ...
 01851   896   NtQueryInformationThread  (260, Basic, 28, ...
 01852  1256   NtDeviceIoControlFile  (264, 0, 0x0, 0x0, 0x390008,  (264, 0, 0x0, 0x0, 0x390008, "\15\333\15g\333W\203\314\211\4/QN-*d\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0", 256, 256, ... , 256, 256, ...
 01837  1864   NtRegisterThreadTerminatePort  ... ) == 0x0
 01838   216   NtRegisterThreadTerminatePort  ... ) == 0x0
 01839   768   NtRegisterThreadTerminatePort  ... ) == 0x0
 01840  1924   NtRegisterThreadTerminatePort  ... ) == 0x0
 01841   336   NtRegisterThreadTerminatePort  ... ) == 0x0
 01842  1404   NtRegisterThreadTerminatePort  ... ) == 0x0
 01843   476   NtRegisterThreadTerminatePort  ... ) == 0x0
 01844   496   NtRegisterThreadTerminatePort  ... ) == 0x0
 01845  2032   NtRegisterThreadTerminatePort  ... ) == 0x0
 01846  1500   NtRegisterThreadTerminatePort  ... ) == 0x0
 01847   148   NtRegisterThreadTerminatePort  ... ) == 0x0
 01848  1896   NtRegisterThreadTerminatePort  ... ) == 0x0
 01849  1496   NtRegisterThreadTerminatePort  ... ) == 0x0
 01850  1688   NtRegisterThreadTerminatePort  ... ) == 0x0
 01851   896   NtQueryInformationThread  ... {ExitStatus=0x103,TebBaseAddress=0x7ff9b000,Pid=1252,Tid=1804,}, 0x0, ) == 0x0
 01853  1256   NtQuerySystemInformation  (TimeOfDay, 48, ...
 01854  1864   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 01855   216   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 01856   768   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 01857  1924   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 01858   336   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 01859  1404   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 01860   476   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 01861   496   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 01862  2032   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 01863  1500   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 01864   148   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 01865  1896   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 01866  1496   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 01867  1688   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 01804  1796   NtCreateEvent  ... 268, ) == 0x0
 01868   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81904, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81904, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\4\1\0\0\344\4\0\0\14\7\0\0" ...  ...
 01853  1256   NtQuerySystemInformation  ... {system info, class 3, size 48}, 48, ) == 0x0
 01854  1864   NtDuplicateObject  ... 272, ) == 0x0
 01855   216   NtDuplicateObject  ... 276, ) == 0x0
 01856   768   NtDuplicateObject  ... 280, ) == 0x0
 01857  1924   NtDuplicateObject  ... 284, ) == 0x0
 01858   336   NtDuplicateObject  ... 288, ) == 0x0
 01859  1404   NtDuplicateObject  ... 292, ) == 0x0
 01860   476   NtDuplicateObject  ... 296, ) == 0x0
 01861   496   NtDuplicateObject  ... 300, ) == 0x0
 01862  2032   NtDuplicateObject  ... 304, ) == 0x0
 01863  1500   NtDuplicateObject  ... 308, ) == 0x0
 01864   148   NtDuplicateObject  ... 312, ) == 0x0
 01865  1896   NtDuplicateObject  ... 316, ) == 0x0
 01866  1496   NtDuplicateObject  ... 320, ) == 0x0
 01869  1796   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 01868   896   NtRequestWaitReplyPort  ... {28, 56, reply, 0, 1252, 896, 81905, 0}  ... {28, 56, reply, 0, 1252, 896, 81905, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\4\1\0\0\344\4\0\0\14\7\0\0" )  ) == 0x0
 01870  1256   NtQuerySystemInformation  (ProcessorTimes, 48, ...
 01871  1864   NtWaitForSingleObject  (104, 0, {0, 0}, ...
 01872   216   NtWaitForSingleObject  (104, 0, {0, 0}, ...
 01873   768   NtAllocateVirtualMemory  (-1, 1376256, 0, 4096, 4096, 4, ...
 01874  1924   NtCreateEvent  (0x100003, 0x0, 1, 0, ...
 01875   336   NtCreateEvent  (0x100003, 0x0, 1, 0, ...
 01876  1404   NtCreateEvent  (0x100003, 0x0, 1, 0, ...
 01877   476   NtCreateEvent  (0x100003, 0x0, 1, 0, ...
 01878   496   NtCreateEvent  (0x100003, 0x0, 1, 0, ...
 01879  2032   NtCreateEvent  (0x100003, 0x0, 1, 0, ...
 01880  1500   NtCreateEvent  (0x100003, 0x0, 1, 0, ...
 01881   148   NtCreateEvent  (0x100003, 0x0, 1, 0, ...
 01882  1896   NtCreateEvent  (0x100003, 0x0, 1, 0, ...
 01883  1496   NtCreateEvent  (0x100003, 0x0, 1, 0, ...
 01869  1796   NtDuplicateObject  ... 324, ) == 0x0
 01884   896   NtResumeThread  (260, ...
 01870  1256   NtQuerySystemInformation  ... {system info, class 8, size 48}, 48, ) == 0x0
 01871  1864   NtWaitForSingleObject  ... ) == 0x102
 01872   216   NtWaitForSingleObject  ... ) == 0x102
 01873   768   NtAllocateVirtualMemory  ... 1376256, 4096, ) == 0x0
 01874  1924   NtCreateEvent  ... 328, ) == 0x0
 01875   336   NtCreateEvent  ... 332, ) == 0x0
 01876  1404   NtCreateEvent  ... 336, ) == 0x0
 01877   476   NtCreateEvent  ... 340, ) == 0x0
 01878   496   NtCreateEvent  ... 344, ) == 0x0
 01879  2032   NtCreateEvent  ... 348, ) == 0x0
 01880  1500   NtCreateEvent  ... 352, ) == 0x0
 01881   148   NtCreateEvent  ... 356, ) == 0x0
 01882  1896   NtCreateEvent  ... 360, ) == 0x0
 01883  1496   NtCreateEvent  ... 364, ) == 0x0
 01885  1796   NtCreateEvent  (0x100003, 0x0, 1, 0, ...
 01884   896   NtResumeThread  ... 1, ) == 0x0
 01886  1256   NtQuerySystemInformation  (Performance, 312, ...
 01887  1864   NtCreateEvent  (0x100003, 0x0, 1, 0, ...
 01888   216   NtCreateEvent  (0x100003, 0x0, 1, 0, ...
 01889   768   NtCreateEvent  (0x100003, 0x0, 1, 0, ...
 01890  1924   NtWaitForSingleObject  (328, 0, 0x0, ...
 01891   336   NtClose  (332, ...
 01892  1404   NtClose  (336, ...
 01893   476   NtClose  (340, ...
 01894   496   NtClose  (344, ...
 01895  2032   NtClose  (348, ...
 01896  1500   NtClose  (352, ...
 01897   148   NtClose  (356, ...
 01898  1896   NtClose  (360, ...
 01899  1496   NtClose  (364, ...
 01885  1796   NtCreateEvent  ... 368, ) == 0x0
 01900   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ...
 01886  1256   NtQuerySystemInformation  ... {system info, class 2, size 312}, 312, ) == 0x0
 01887  1864   NtCreateEvent  ... 372, ) == 0x0
 01888   216   NtCreateEvent  ... 376, ) == 0x0
 01889   768   NtCreateEvent  ... 380, ) == 0x0
 01891   336   NtClose  ... ) == 0x0
 01892  1404   NtClose  ... ) == 0x0
 01893   476   NtClose  ... ) == 0x0
 01894   496   NtClose  ... ) == 0x0
 01895  2032   NtClose  ... ) == 0x0
 01896  1500   NtClose  ... ) == 0x0
 01897   148   NtClose  ... ) == 0x0
 01898  1896   NtClose  ... ) == 0x0
 01899  1496   NtClose  ... ) == 0x0
 01901  1796   NtClose  (368, ...
 01867  1688   NtDuplicateObject  ... 364, ) == 0x0
 01902  1804   NtTestAlert  (...
 01903  1256   NtQuerySystemInformation  (Exception, 16, ...
 01900   896   NtAllocateVirtualMemory  ... 34668544, 1048576, ) == 0x0
 01904  1864   NtClose  (372, ...
 01905   768   NtClose  (380, ...
 01906   336   NtWaitForSingleObject  (328, 0, 0x0, ...
 01907  1404   NtWaitForSingleObject  (328, 0, 0x0, ...
 01908   476   NtWaitForSingleObject  (328, 0, 0x0, ...
 01909   496   NtWaitForSingleObject  (328, 0, 0x0, ...
 01910  2032   NtWaitForSingleObject  (328, 0, 0x0, ...
 01911  1500   NtWaitForSingleObject  (328, 0, 0x0, ...
 01912   148   NtWaitForSingleObject  (328, 0, 0x0, ...
 01913  1896   NtWaitForSingleObject  (328, 0, 0x0, ...
 01914  1496   NtWaitForSingleObject  (328, 0, 0x0, ...
 01915   216   NtClose  (376, ...
 01916  1688   NtWaitForSingleObject  (328, 0, 0x0, ...
 01902  1804   NtTestAlert  ... ) == 0x0
 01901  1796   NtClose  ... ) == 0x0
 01917   896   NtAllocateVirtualMemory  (-1, 35708928, 0, 8192, 4096, 4, ...
 01904  1864   NtClose  ... ) == 0x0
 01903  1256   NtQuerySystemInformation  ... {system info, class 33, size 16}, 16, ) == 0x0
 01905   768   NtClose  ... ) == 0x0
 01915   216   NtClose  ... ) == 0x0
 01918  1804   NtContinue  (34667824, 1, ...
 01919  1796   NtWaitForSingleObject  (328, 0, 0x0, ...
 01917   896   NtAllocateVirtualMemory  ... 35708928, 8192, ) == 0x0
 01920  1864   NtWaitForSingleObject  (328, 0, 0x0, ...
 01921  1256   NtQuerySystemInformation  (Lookaside, 32, ...
 01922   768   NtSetEventBoostPriority  (328, ...
 01923   216   NtWaitForSingleObject  (328, 0, 0x0, ...
 01924  1804   NtRegisterThreadTerminatePort  (24, ...
 01925   896   NtProtectVirtualMemory  (-1, (0x220e000), 4096, 260, ...
 01921  1256   NtQuerySystemInformation  ... {system info, class 45, size 32}, 32, ) == 0x0
 01890  1924   NtWaitForSingleObject  ... ) == 0x0
 01922   768   NtSetEventBoostPriority  ... ) == 0x0
 01924  1804   NtRegisterThreadTerminatePort  ... ) == 0x0
 01925   896   NtProtectVirtualMemory  ... (0x220e000), 4096, 4, ) == 0x0
 01926  1924   NtSetEventBoostPriority  (328, ...
 01927  1256   NtQuerySystemInformation  (ProcessorStatistics, 3016, ...
 01928   768   NtWaitForSingleObject  (328, 0, 0x0, ...
 01906   336   NtWaitForSingleObject  ... ) == 0x0
 01926  1924   NtSetEventBoostPriority  ... ) == 0x0
 01929   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ...
 01927  1256   NtQuerySystemInformation  ... {system info, class 23, size 0}, 0, ) == 0x0
 01930   336   NtSetEventBoostPriority  (328, ...
 01931  1804   NtWaitForSingleObject  (328, 0, 0x0, ...
 01932  1924   NtWaitForSingleObject  (328, 0, 0x0, ...
 01907  1404   NtWaitForSingleObject  ... ) == 0x0
 01933  1256   NtQuerySystemInformation  (ProcessesAndThreads, 3008, ...
 01934  1404   NtSetEventBoostPriority  (328, ...
 01930   336   NtSetEventBoostPriority  ... ) == 0x0
 01929   896   NtCreateThread  ... 376, {1252, 1920}, ) == 0x0
 01908   476   NtWaitForSingleObject  ... ) == 0x0
 01935   336   NtWaitForSingleObject  (328, 0, 0x0, ...
 01936   896   NtQueryInformationThread  (376, Basic, 28, ...
 01937   476   NtSetEventBoostPriority  (328, ...
 01936   896   NtQueryInformationThread  ... {ExitStatus=0x103,TebBaseAddress=0x7ff9a000,Pid=1252,Tid=1920,}, 0x0, ) == 0x0
 01909   496   NtWaitForSingleObject  ... ) == 0x0
 01938   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81905, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81905, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFGx\1\0\0\344\4\0\0\200\7\0\0" ...  ...
 01939   496   NtSetEventBoostPriority  (328, ...
 01938   896   NtRequestWaitReplyPort  ... {28, 56, reply, 0, 1252, 896, 81906, 0}  ... {28, 56, reply, 0, 1252, 896, 81906, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFGx\1\0\0\344\4\0\0\200\7\0\0" )  ) == 0x0
 01910  2032   NtWaitForSingleObject  ... ) == 0x0
 01939   496   NtSetEventBoostPriority  ... ) == 0x0
 01937   476   NtSetEventBoostPriority  ... ) == 0x0
 01934  1404   NtSetEventBoostPriority  ... ) == 0x0
 01933  1256   NtQuerySystemInformation  ... ) == STATUS_INFO_LENGTH_MISMATCH
 01940  2032   NtSetEventBoostPriority  (328, ...
 01941   496   NtWaitForSingleObject  (328, 0, 0x0, ...
 01942   476   NtWaitForSingleObject  (328, 0, 0x0, ...
 01943  1404   NtWaitForSingleObject  (328, 0, 0x0, ...
 01944  1256   NtCreateKey  (0x2, {24, 0, 0x240, 0, 0,  (0x2, {24, 0, 0x240, 0, 0, "\Registry\Machine\SOFTWARE\Microsoft\Cryptography\RNG"}, 0, 0x0, 0, ... }, 0, 0x0, 0, ...
 01911  1500   NtWaitForSingleObject  ... ) == 0x0
 01944  1256   NtCreateKey  ... -2147482756, 2, ) == 0x0
 01945  1500   NtSetEventBoostPriority  (328, ...
 01940  2032   NtSetEventBoostPriority  ... ) == 0x0
 01946   896   NtResumeThread  (376, ...
 01912   148   NtWaitForSingleObject  ... ) == 0x0
 01947  2032   NtWaitForSingleObject  (328, 0, 0x0, ...
 01946   896   NtResumeThread  ... 1, ) == 0x0
 01948   148   NtSetEventBoostPriority  (328, ...
 01949   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ...
 01913  1896   NtWaitForSingleObject  ... ) == 0x0
 01949   896   NtAllocateVirtualMemory  ... 35717120, 1048576, ) == 0x0
 01950  1896   NtSetEventBoostPriority  (328, ...
 01951   896   NtAllocateVirtualMemory  (-1, 36757504, 0, 8192, 4096, 4, ...
 01916  1688   NtWaitForSingleObject  ... ) == 0x0
 01951   896   NtAllocateVirtualMemory  ... 36757504, 8192, ) == 0x0
 01952  1688   NtSetEventBoostPriority  (328, ...
 01950  1896   NtSetEventBoostPriority  ... ) == 0x0
 01948   148   NtSetEventBoostPriority  ... ) == 0x0
 01945  1500   NtSetEventBoostPriority  ... ) == 0x0
 01953  1256   NtSetValueKey  (-2147482756,  (-2147482756, "Seed", 0, 3, "_,\367\375cG\213W\310KU\250\26\225\345\236\13\17\356\212U0\274\377\340\212\202d\203Fv\315=6\335\265\215\231\351\321\25\12\355\232'x\224\334E\303\262@\36\207(e%\336( \2114m\21\310\31v\317\345\10"W$E\312\353\312C\334", 80, ... , 0, 3,  (-2147482756, "Seed", 0, 3, "_,\367\375cG\213W\310KU\250\26\225\345\236\13\17\356\212U0\274\377\340\212\202d\203Fv\315=6\335\265\215\231\351\321\25\12\355\232'x\224\334E\303\262@\36\207(e%\336( \2114m\21\310\31v\317\345\10"W$E\312\353\312C\334", 80, ... W$E\312\353\312C\334", 80, ...
 01954  1920   NtTestAlert  (...
 01919  1796   NtWaitForSingleObject  ... ) == 0x0
 01952  1688   NtSetEventBoostPriority  ... ) == 0x0
 01955  1896   NtWaitForSingleObject  (328, 0, 0x0, ...
 01956   148   NtWaitForSingleObject  (328, 0, 0x0, ...
 01957  1500   NtWaitForSingleObject  (328, 0, 0x0, ...
 01953  1256   NtSetValueKey  ... ) == 0x0
 01958  1796   NtSetEventBoostPriority  (328, ...
 01954  1920   NtTestAlert  ... ) == 0x0
 01959   896   NtProtectVirtualMemory  (-1, (0x230e000), 4096, 260, ...
 01920  1864   NtWaitForSingleObject  ... ) == 0x0
 01958  1796   NtSetEventBoostPriority  ... ) == 0x0
 01960  1256   NtClose  (-2147482756, ...
 01961  1920   NtContinue  (35716400, 1, ...
 01962  1864   NtSetEventBoostPriority  (328, ...
 01959   896   NtProtectVirtualMemory  ... (0x230e000), 4096, 4, ) == 0x0
 01963  1688   NtWaitForSingleObject  (328, 0, 0x0, ...
 01960  1256   NtClose  ... ) == 0x0
 01923   216   NtWaitForSingleObject  ... ) == 0x0
 01962  1864   NtSetEventBoostPriority  ... ) == 0x0
 01964  1920   NtRegisterThreadTerminatePort  (24, ...
 01965   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ...
 01966   216   NtSetEventBoostPriority  (328, ...
 01852  1256   NtDeviceIoControlFile  ... {status=0x0, info=256},  ... {status=0x0, info=256}, "\365}\244*b\0b7\262\341\235\353\241\302\332\350\242p\252\32\211G\364\256;Y\22\275<33\0\321\362T\251(\351!B\377\327\33\37\356T\272#\320\6\227\333B\207\321D\200?K\350\315\230\23n\301\244\227\34\24\14\257\237\371H\311\316\366\354'\343\256!\371\251\376\203^\354\361@\235\0E\5\225^\210O\245\331\326\320\202.\252\231>5|\227\354\306a5\240e\213b\300\7\33\335\343\262\251\357R\352\352\222UW\356\263\259\11\227\314T\277q\235\302\362\230\245\20\217\331w\30\31d\317\364\274V|\201\336\336\301\2318\15\257\222T0\234\271U\241b\354]\231+h=\357Es\16\315\300\363f\212\0)\245\302\353xCc\265\265\347\337\370\35\204\325\257L\310~\371\354\271\2630&\301Q?\344\207,\3779_lt\321\10K'J\10\377\276\357\201\30-\225\353\34\331\216\234\306\335u\326Y=Y\274\311", ) , ) == 0x0
 01967  1796   NtWaitForSingleObject  (328, 0, 0x0, ...
 01964  1920   NtRegisterThreadTerminatePort  ... ) == 0x0
 01914  1496   NtWaitForSingleObject  ... ) == 0x0
 01966   216   NtSetEventBoostPriority  ... ) == 0x0
 01965   896   NtCreateThread  ... 380, {1252, 1692}, ) == 0x0
 01968  1256   NtWaitForSingleObject  (328, 0, 0x0, ...
 01969  1864   NtWaitForSingleObject  (160, 0, 0x0, ...
 01970  1496   NtSetEventBoostPriority  (328, ...
 01971  1920   NtWaitForSingleObject  (328, 0, 0x0, ...
 01972   896   NtQueryInformationThread  (380, Basic, 28, ...
 01973   216   NtWaitForSingleObject  (160, 0, 0x0, ...
 01928   768   NtWaitForSingleObject  ... ) == 0x0
 01972   896   NtQueryInformationThread  ... {ExitStatus=0x103,TebBaseAddress=0x7ff99000,Pid=1252,Tid=1692,}, 0x0, ) == 0x0
 01974   768   NtSetEventBoostPriority  (328, ...
 01970  1496   NtSetEventBoostPriority  ... ) == 0x0
 01931  1804   NtWaitForSingleObject  ... ) == 0x0
 01974   768   NtSetEventBoostPriority  ... ) == 0x0
 01975  1804   NtSetEventBoostPriority  (328, ...
 01976  1496   NtWaitForSingleObject  (328, 0, 0x0, ...
 01977   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81906, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81906, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG|\1\0\0\344\4\0\0\234\6\0\0" ...  ...
 01932  1924   NtWaitForSingleObject  ... ) == 0x0
 01975  1804   NtSetEventBoostPriority  ... ) == 0x0
 01978  1924   NtSetEventBoostPriority  (328, ...
 01977   896   NtRequestWaitReplyPort  ... {28, 56, reply, 0, 1252, 896, 81907, 0}  ... {28, 56, reply, 0, 1252, 896, 81907, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG|\1\0\0\344\4\0\0\234\6\0\0" )  ) == 0x0
 01935   336   NtWaitForSingleObject  ... ) == 0x0
 01978  1924   NtSetEventBoostPriority  ... ) == 0x0
 01979  1804   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 01980   336   NtSetEventBoostPriority  (328, ...
 01981   896   NtResumeThread  (380, ...
 01982  1924   NtWaitForSingleObject  (328, 0, 0x0, ...
 01983   768   NtCreateEvent  (0x100003, 0x0, 1, 0, ...
 01941   496   NtWaitForSingleObject  ... ) == 0x0
 01980   336   NtSetEventBoostPriority  ... ) == 0x0
 01981   896   NtResumeThread  ... 1, ) == 0x0
 01979  1804   NtDuplicateObject  ... 372, ) == 0x0
 01984   496   NtSetEventBoostPriority  (328, ...
 01983   768   NtCreateEvent  ... 368, ) == 0x0
 01985  1692   NtAllocateVirtualMemory  (-1, 3624960, 0, 4096, 4096, 4, ...
 01986   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ...
 01942   476   NtWaitForSingleObject  ... ) == 0x0
 01984   496   NtSetEventBoostPriority  ... ) == 0x0
 01987  1804   NtWaitForSingleObject  (328, 0, 0x0, ...
 01988   768   NtWaitForSingleObject  (368, 0, 0x0, ...
 01985  1692   NtAllocateVirtualMemory  ... 3624960, 4096, ) == 0x0
 01989   336   NtWaitForSingleObject  (368, 0, 0x0, ...
 01990   476   NtSetEventBoostPriority  (328, ...
 01986   896   NtAllocateVirtualMemory  ... 36765696, 1048576, ) == 0x0
 01991  1692   NtTestAlert  (...
 01943  1404   NtWaitForSingleObject  ... ) == 0x0
 01990   476   NtSetEventBoostPriority  ... ) == 0x0
 01992   896   NtAllocateVirtualMemory  (-1, 37806080, 0, 8192, 4096, 4, ...
 01993  1404   NtSetEventBoostPriority  (328, ...
 01991  1692   NtTestAlert  ... ) == 0x0
 01994   496   NtWaitForSingleObject  (368, 0, 0x0, ...
 01947  2032   NtWaitForSingleObject  ... ) == 0x0
 01993  1404   NtSetEventBoostPriority  ... ) == 0x0
 01992   896   NtAllocateVirtualMemory  ... 37806080, 8192, ) == 0x0
 01995  1692   NtContinue  (36764976, 1, ...
 01996  2032   NtSetEventBoostPriority  (328, ...
 01997   476   NtWaitForSingleObject  (368, 0, 0x0, ...
 01998   896   NtProtectVirtualMemory  (-1, (0x240e000), 4096, 260, ...
 01999  1404   NtWaitForSingleObject  (368, 0, 0x0, ...
 01955  1896   NtWaitForSingleObject  ... ) == 0x0
 01996  2032   NtSetEventBoostPriority  ... ) == 0x0
 01998   896   NtProtectVirtualMemory  ... (0x240e000), 4096, 4, ) == 0x0
 02000  1896   NtSetEventBoostPriority  (328, ...
 02001  1692   NtRegisterThreadTerminatePort  (24, ...
 01956   148   NtWaitForSingleObject  ... ) == 0x0
 02000  1896   NtSetEventBoostPriority  ... ) == 0x0
 02002   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ...
 02003   148   NtSetEventBoostPriority  (328, ...
 02001  1692   NtRegisterThreadTerminatePort  ... ) == 0x0
 02004  2032   NtWaitForSingleObject  (368, 0, 0x0, ...
 02005  1896   NtWaitForSingleObject  (368, 0, 0x0, ...
 01957  1500   NtWaitForSingleObject  ... ) == 0x0
 02003   148   NtSetEventBoostPriority  ... ) == 0x0
 02006  1692   NtWaitForSingleObject  (328, 0, 0x0, ...
 02007  1500   NtSetEventBoostPriority  (328, ...
 02002   896   NtCreateThread  ... 360, {1252, 800}, ) == 0x0
 01963  1688   NtWaitForSingleObject  ... ) == 0x0
 02007  1500   NtSetEventBoostPriority  ... ) == 0x0
 02008  1688   NtSetEventBoostPriority  (328, ...
 02009   896   NtQueryInformationThread  (360, Basic, 28, ...
 02010   148   NtWaitForSingleObject  (368, 0, 0x0, ...
 01967  1796   NtWaitForSingleObject  ... ) == 0x0
 02008  1688   NtSetEventBoostPriority  ... ) == 0x0
 02009   896   NtQueryInformationThread  ... {ExitStatus=0x103,TebBaseAddress=0x7ff98000,Pid=1252,Tid=800,}, 0x0, ) == 0x0
 02011  1796   NtSetEventBoostPriority  (328, ...
 02012  1688   NtWaitForSingleObject  (368, 0, 0x0, ...
 01971  1920   NtWaitForSingleObject  ... ) == 0x0
 02011  1796   NtSetEventBoostPriority  ... ) == 0x0
 02013   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81907, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81907, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFGh\1\0\0\344\4\0\0 \3\0\0" ...  ...
 02014  1500   NtWaitForSingleObject  (368, 0, 0x0, ...
 02015  1920   NtSetEventBoostPriority  (328, ...
 02016  1796   NtWaitForSingleObject  (328, 0, 0x0, ...
 02013   896   NtRequestWaitReplyPort  ... {28, 56, reply, 0, 1252, 896, 81908, 0}  ... {28, 56, reply, 0, 1252, 896, 81908, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFGh\1\0\0\344\4\0\0 \3\0\0" )  ) == 0x0
 01968  1256   NtWaitForSingleObject  ... ) == 0x0
 02015  1920   NtSetEventBoostPriority  ... ) == 0x0
 02017  1256   NtSetEventBoostPriority  (328, ...
 01976  1496   NtWaitForSingleObject  ... ) == 0x0
 02018  1496   NtSetEventBoostPriority  (328, ...
 01982  1924   NtWaitForSingleObject  ... ) == 0x0
 02019  1924   NtSetEventBoostPriority  (328, ...
 01987  1804   NtWaitForSingleObject  ... ) == 0x0
 02020  1804   NtSetEventBoostPriority  (328, ...
 02006  1692   NtWaitForSingleObject  ... ) == 0x0
 02021  1692   NtSetEventBoostPriority  (328, ...
 02016  1796   NtWaitForSingleObject  ... ) == 0x0
 02022  1796   NtWaitForSingleObject  (368, 0, 0x0, ...
 02021  1692   NtSetEventBoostPriority  ... ) == 0x0
 02020  1804   NtSetEventBoostPriority  ... ) == 0x0
 02018  1496   NtSetEventBoostPriority  ... ) == 0x0
 02023  1920   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 02019  1924   NtSetEventBoostPriority  ... ) == 0x0
 02017  1256   NtSetEventBoostPriority  ... ) == 0x0
 02024   896   NtResumeThread  (360, ...
 02025  1692   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 02026  1804   NtWaitForSingleObject  (368, 0, 0x0, ...
 02027  1496   NtWaitForSingleObject  (368, 0, 0x0, ...
 02028  1924   NtSetEventBoostPriority  (368, ...
 02029  1256   NtCreateEvent  (0x1f0003, 0x0, 1, 0, ...
 02024   896   NtResumeThread  ... 1, ) == 0x0
 02025  1692   NtDuplicateObject  ... 356, ) == 0x0
 01988   768   NtWaitForSingleObject  ... ) == 0x0
 02028  1924   NtSetEventBoostPriority  ... ) == 0x0
 02029  1256   NtCreateEvent  ... 352, ) == 0x0
 02030   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ...
 02031   768   NtSetEventBoostPriority  (368, ...
 02032  1692   NtWaitForSingleObject  (368, 0, 0x0, ...
 02023  1920   NtDuplicateObject  ... 348, ) == 0x0
 02033   800   NtTestAlert  (...
 02034  1924   NtWaitForSingleObject  (104, 0, {0, 0}, ...
 01989   336   NtWaitForSingleObject  ... ) == 0x0
 02031   768   NtSetEventBoostPriority  ... ) == 0x0
 02030   896   NtAllocateVirtualMemory  ... 37814272, 1048576, ) == 0x0
 02035  1920   NtWaitForSingleObject  (368, 0, 0x0, ...
 02033   800   NtTestAlert  ... ) == 0x0
 02036   336   NtSetEventBoostPriority  (368, ...
 02034  1924   NtWaitForSingleObject  ... ) == 0x102
 02037  1256   NtWaitForSingleObject  (368, 0, 0x0, ...
 02038   896   NtAllocateVirtualMemory  (-1, 38854656, 0, 8192, 4096, 4, ...
 01994   496   NtWaitForSingleObject  ... ) == 0x0
 02036   336   NtSetEventBoostPriority  ... ) == 0x0
 02039   800   NtContinue  (37813552, 1, ...
 02040  1924   NtWaitForSingleObject  (160, 0, 0x0, ...
 02041   496   NtSetEventBoostPriority  (368, ...
 02038   896   NtAllocateVirtualMemory  ... 38854656, 8192, ) == 0x0
 02042   336   NtWaitForSingleObject  (104, 0, {0, 0}, ...
 02043   800   NtRegisterThreadTerminatePort  (24, ...
 01997   476   NtWaitForSingleObject  ... ) == 0x0
 02041   496   NtSetEventBoostPriority  ... ) == 0x0
 02044   768   NtWaitForSingleObject  (104, 0, {0, 0}, ...
 02045   896   NtProtectVirtualMemory  (-1, (0x250e000), 4096, 260, ...
 02046   476   NtSetEventBoostPriority  (368, ...
 02043   800   NtRegisterThreadTerminatePort  ... ) == 0x0
 02047   496   NtWaitForSingleObject  (104, 0, {0, 0}, ...
 02044   768   NtWaitForSingleObject  ... ) == 0x102
 01999  1404   NtWaitForSingleObject  ... ) == 0x0
 02046   476   NtSetEventBoostPriority  ... ) == 0x0
 02045   896   NtProtectVirtualMemory  ... (0x250e000), 4096, 4, ) == 0x0
 02042   336   NtWaitForSingleObject  ... ) == 0x102
 02048   800   NtAllocateVirtualMemory  (-1, 1380352, 0, 4096, 4096, 4, ...
 02049  1404   NtWaitForSingleObject  (328, 0, 0x0, ...
 02050   768   NtWaitForSingleObject  (328, 0, 0x0, ...
 02051   476   NtWaitForSingleObject  (104, 0, {0, 0}, ...
 02052   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ...
 02053   336   NtWaitForSingleObject  (328, 0, 0x0, ...
 02048   800   NtAllocateVirtualMemory  ... 1380352, 4096, ) == 0x0
 02047   496   NtWaitForSingleObject  ... ) == 0x102
 02052   896   NtCreateThread  ... 344, {1252, 1700}, ) == 0x0
 02054   800   NtSetEventBoostPriority  (328, ...
 02055   496   NtWaitForSingleObject  (328, 0, 0x0, ...
 02056   896   NtQueryInformationThread  (344, Basic, 28, ...
 02049  1404   NtWaitForSingleObject  ... ) == 0x0
 02054   800   NtSetEventBoostPriority  ... ) == 0x0
 02057  1404   NtSetEventBoostPriority  (328, ...
 02056   896   NtQueryInformationThread  ... {ExitStatus=0x103,TebBaseAddress=0x7ff97000,Pid=1252,Tid=1700,}, 0x0, ) == 0x0
 02050   768   NtWaitForSingleObject  ... ) == 0x0
 02057  1404   NtSetEventBoostPriority  ... ) == 0x0
 02058   800   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 02051   476   NtWaitForSingleObject  ... ) == 0x102
 02059   768   NtSetEventBoostPriority  (328, ...
 02060   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81908, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81908, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFGX\1\0\0\344\4\0\0\244\6\0\0" ...  ...
 02058   800   NtDuplicateObject  ... 340, ) == 0x0
 02053   336   NtWaitForSingleObject  ... ) == 0x0
 02059   768   NtSetEventBoostPriority  ... ) == 0x0
 02061   476   NtWaitForSingleObject  (328, 0, 0x0, ...
 02060   896   NtRequestWaitReplyPort  ... {28, 56, reply, 0, 1252, 896, 81909, 0}  ... {28, 56, reply, 0, 1252, 896, 81909, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFGX\1\0\0\344\4\0\0\244\6\0\0" )  ) == 0x0
 02062  1404   NtSetEventBoostPriority  (368, ...
 02063   336   NtSetEventBoostPriority  (328, ...
 02064   800   NtWaitForSingleObject  (328, 0, 0x0, ...
 02065   896   NtResumeThread  (344, ...
 02055   496   NtWaitForSingleObject  ... ) == 0x0
 02063   336   NtSetEventBoostPriority  ... ) == 0x0
 02004  2032   NtWaitForSingleObject  ... ) == 0x0
 02062  1404   NtSetEventBoostPriority  ... ) == 0x0
 02066   496   NtSetEventBoostPriority  (328, ...
 02065   896   NtResumeThread  ... 1, ) == 0x0
 02067   768   NtWaitForSingleObject  (160, 0, 0x0, ...
 02068  2032   NtWaitForSingleObject  (328, 0, 0x0, ...
 02061   476   NtWaitForSingleObject  ... ) == 0x0
 02066   496   NtSetEventBoostPriority  ... ) == 0x0
 02069  1404   NtWaitForSingleObject  (104, 0, {0, 0}, ...
 02070   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ...
 02071   476   NtSetEventBoostPriority  (328, ...
 02072   336   NtWaitForSingleObject  (160, 0, 0x0, ...
 02073  1700   NtTestAlert  (...
 02069  1404   NtWaitForSingleObject  ... ) == 0x102
 02074   496   NtWaitForSingleObject  (160, 0, 0x0, ...
 02064   800   NtWaitForSingleObject  ... ) == 0x0
 02071   476   NtSetEventBoostPriority  ... ) == 0x0
 02073  1700   NtTestAlert  ... ) == 0x0
 02075  1404   NtWaitForSingleObject  (328, 0, 0x0, ...
 02076   800   NtSetEventBoostPriority  (328, ...
 02070   896   NtAllocateVirtualMemory  ... 38862848, 1048576, ) == 0x0
 02077  1700   NtContinue  (38862128, 1, ...
 02078   476   NtWaitForSingleObject  (160, 0, 0x0, ...
 02068  2032   NtWaitForSingleObject  ... ) == 0x0
 02076   800   NtSetEventBoostPriority  ... ) == 0x0
 02079   896   NtAllocateVirtualMemory  (-1, 39903232, 0, 8192, 4096, 4, ...
 02080  1700   NtRegisterThreadTerminatePort  (24, ...
 02081  2032   NtSetEventBoostPriority  (328, ...
 02082   800   NtWaitForSingleObject  (328, 0, 0x0, ...
 02079   896   NtAllocateVirtualMemory  ... 39903232, 8192, ) == 0x0
 02081  2032   NtSetEventBoostPriority  ... ) == 0x0
 02080  1700   NtRegisterThreadTerminatePort  ... ) == 0x0
 02075  1404   NtWaitForSingleObject  ... ) == 0x0
 02083   896   NtProtectVirtualMemory  (-1, (0x260e000), 4096, 260, ...
 02084  2032   NtSetEventBoostPriority  (368, ...
 02085  1404   NtSetEventBoostPriority  (328, ...
 02083   896   NtProtectVirtualMemory  ... (0x260e000), 4096, 4, ) == 0x0
 02005  1896   NtWaitForSingleObject  ... ) == 0x0
 02084  2032   NtSetEventBoostPriority  ... ) == 0x0
 02082   800   NtWaitForSingleObject  ... ) == 0x0
 02085  1404   NtSetEventBoostPriority  ... ) == 0x0
 02086  1896   NtWaitForSingleObject  (328, 0, 0x0, ...
 02087   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ...
 02088   800   NtSetEventBoostPriority  (328, ...
 02089  2032   NtWaitForSingleObject  (104, 0, {0, 0}, ...
 02090  1404   NtWaitForSingleObject  (160, 0, 0x0, ...
 02091  1700   NtWaitForSingleObject  (328, 0, 0x0, ...
 02086  1896   NtWaitForSingleObject  ... ) == 0x0
 02089  2032   NtWaitForSingleObject  ... ) == 0x102
 02092  1896   NtSetEventBoostPriority  (328, ...
 02091  1700   NtWaitForSingleObject  ... ) == 0x0
 02093  1700   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ... 336, ) == 0x0
 02094  1700   NtWaitForSingleObject  (368, 0, 0x0, ...
 02092  1896   NtSetEventBoostPriority  ... ) == 0x0
 02095  2032   NtWaitForSingleObject  (160, 0, 0x0, ...
 02088   800   NtSetEventBoostPriority  ... ) == 0x0
 02087   896   NtCreateThread  ... 332, {1252, 1540}, ) == 0x0
 02096  1896   NtSetEventBoostPriority  (368, ...
 02097   800   NtWaitForSingleObject  (368, 0, 0x0, ...
 02098   896   NtQueryInformationThread  (332, Basic, 28, ...
 02010   148   NtWaitForSingleObject  ... ) == 0x0
 02096  1896   NtSetEventBoostPriority  ... ) == 0x0
 02099   148   NtSetEventBoostPriority  (368, ...
 02098   896   NtQueryInformationThread  ... {ExitStatus=0x103,TebBaseAddress=0x7ff96000,Pid=1252,Tid=1540,}, 0x0, ) == 0x0
 02014  1500   NtWaitForSingleObject  ... ) == 0x0
 02099   148   NtSetEventBoostPriority  ... ) == 0x0
 02100  1896   NtWaitForSingleObject  (104, 0, {0, 0}, ...
 02101  1500   NtSetEventBoostPriority  (368, ...
 02102   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81909, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81909, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFGL\1\0\0\344\4\0\0\4\6\0\0" ...  ...
 02103   148   NtWaitForSingleObject  (104, 0, {0, 0}, ...
 02012  1688   NtWaitForSingleObject  ... ) == 0x0
 02101  1500   NtSetEventBoostPriority  ... ) == 0x0
 02100  1896   NtWaitForSingleObject  ... ) == 0x102
 02102   896   NtRequestWaitReplyPort  ... {28, 56, reply, 0, 1252, 896, 81910, 0}  ... {28, 56, reply, 0, 1252, 896, 81910, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFGL\1\0\0\344\4\0\0\4\6\0\0" )  ) == 0x0
 02104  1688   NtSetEventBoostPriority  (368, ...
 02105  1500   NtWaitForSingleObject  (104, 0, {0, 0}, ...
 02106  1896   NtWaitForSingleObject  (160, 0, 0x0, ...
 02103   148   NtWaitForSingleObject  ... ) == 0x102
 02022  1796   NtWaitForSingleObject  ... ) == 0x0
 02104  1688   NtSetEventBoostPriority  ... ) == 0x0
 02107   896   NtResumeThread  (332, ...
 02105  1500   NtWaitForSingleObject  ... ) == 0x102
 02108  1796   NtSetEventBoostPriority  (368, ...
 02109   148   NtWaitForSingleObject  (160, 0, 0x0, ...
 02110  1688   NtWaitForSingleObject  (104, 0, {0, 0}, ...
 02107   896   NtResumeThread  ... 1, ) == 0x0
 02026  1804   NtWaitForSingleObject  ... ) == 0x0
 02111  1500   NtWaitForSingleObject  (160, 0, 0x0, ...
 02112   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ...
 02113  1804   NtSetEventBoostPriority  (368, ...
 02112   896   NtAllocateVirtualMemory  ... 39911424, 1048576, ) == 0x0
 02027  1496   NtWaitForSingleObject  ... ) == 0x0
 02113  1804   NtSetEventBoostPriority  ... ) == 0x0
 02114  1496   NtSetEventBoostPriority  (368, ...
 02115   896   NtAllocateVirtualMemory  (-1, 40951808, 0, 8192, 4096, 4, ...
 02032  1692   NtWaitForSingleObject  ... ) == 0x0
 02114  1496   NtSetEventBoostPriority  ... ) == 0x0
 02116  1804   NtWaitForSingleObject  (104, 0, {0, 0}, ...
 02117  1692   NtSetEventBoostPriority  (368, ...
 02115   896   NtAllocateVirtualMemory  ... 40951808, 8192, ) == 0x0
 02118  1496   NtWaitForSingleObject  (104, 0, {0, 0}, ...
 02108  1796   NtSetEventBoostPriority  ... ) == 0x0
 02119  1540   NtTestAlert  (...
 02110  1688   NtWaitForSingleObject  ... ) == 0x102
 02035  1920   NtWaitForSingleObject  ... ) == 0x0
 02117  1692   NtSetEventBoostPriority  ... ) == 0x0
 02116  1804   NtWaitForSingleObject  ... ) == 0x102
 02120   896   NtProtectVirtualMemory  (-1, (0x270e000), 4096, 260, ...
 02118  1496   NtWaitForSingleObject  ... ) == 0x102
 02119  1540   NtTestAlert  ... ) == 0x0
 02121  1920   NtSetEventBoostPriority  (368, ...
 02122  1688   NtWaitForSingleObject  (160, 0, 0x0, ...
 02123  1796   NtOpenKey  (0x20019, {24, 40, 0x40, 0, 0,  (0x20019, {24, 40, 0x40, 0, 0, "Software\Microsoft\Rpc\SecurityService"}, ... }, ...
 02124  1804   NtWaitForSingleObject  (160, 0, 0x0, ...
 02120   896   NtProtectVirtualMemory  ... (0x270e000), 4096, 4, ) == 0x0
 02125  1496   NtWaitForSingleObject  (160, 0, 0x0, ...
 02037  1256   NtWaitForSingleObject  ... ) == 0x0
 02121  1920   NtSetEventBoostPriority  ... ) == 0x0
 02126  1540   NtContinue  (39910704, 1, ...
 02123  1796   NtOpenKey  ... 384, ) == 0x0
 02127   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ...
 02128  1256   NtSetEventBoostPriority  (368, ...
 02129  1692   NtWaitForSingleObject  (104, 0, {0, 0}, ...
 02130  1540   NtRegisterThreadTerminatePort  (24, ...
 02131  1796   NtQueryValueKey  (384,  (384, "DefaultAuthLevel", Partial, 144, ... , Partial, 144, ...
 02094  1700   NtWaitForSingleObject  ... ) == 0x0
 02128  1256   NtSetEventBoostPriority  ... ) == 0x0
 02127   896   NtCreateThread  ... 388, {1252, 1028}, ) == 0x0
 02129  1692   NtWaitForSingleObject  ... ) == 0x102
 02130  1540   NtRegisterThreadTerminatePort  ... ) == 0x0
 02132  1700   NtSetEventBoostPriority  (368, ...
 02131  1796   NtQueryValueKey  ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02133  1256   NtConnectPort  ( ("\RPC Control\DNSResolver", {12, 2, 1, 0}, 0x0, 0x0, 15789572, 188, ... , {12, 2, 1, 0}, 0x0, 0x0, 15789572, 188, ...
 02134   896   NtQueryInformationThread  (388, Basic, 28, ...
 02135  1692   NtWaitForSingleObject  (160, 0, 0x0, ...
 02136  1920   NtWaitForSingleObject  (104, 0, {0, 0}, ...
 02097   800   NtWaitForSingleObject  ... ) == 0x0
 02137  1796   NtClose  (384, ...
 02132  1700   NtSetEventBoostPriority  ... ) == 0x0
 02138  1540   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 02134   896   NtQueryInformationThread  ... {ExitStatus=0x103,TebBaseAddress=0x7ff95000,Pid=1252,Tid=1028,}, 0x0, ) == 0x0
 02136  1920   NtWaitForSingleObject  ... ) == 0x102
 02139   800   NtWaitForSingleObject  (104, 0, {0, 0}, ...
 02137  1796   NtClose  ... ) == 0x0
 02140  1700   NtWaitForSingleObject  (104, 0, {0, 0}, ...
 02138  1540   NtDuplicateObject  ... 384, ) == 0x0
 02141  1920   NtWaitForSingleObject  (160, 0, 0x0, ...
 02139   800   NtWaitForSingleObject  ... ) == 0x102
 02142   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81910, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81910, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\204\1\0\0\344\4\0\0\4\4\0\0" ...  ...
 02143  1540   NtWaitForSingleObject  (104, 0, {0, 0}, ...
 02144   800   NtWaitForSingleObject  (160, 0, 0x0, ...
 02142   896   NtRequestWaitReplyPort  ... {28, 56, reply, 0, 1252, 896, 81912, 0}  ... {28, 56, reply, 0, 1252, 896, 81912, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\204\1\0\0\344\4\0\0\4\4\0\0" )  ) == 0x0
 02143  1540   NtWaitForSingleObject  ... ) == 0x102
 02145   896   NtResumeThread  (388, ...
 02146  1540   NtWaitForSingleObject  (160, 0, 0x0, ...
 02145   896   NtResumeThread  ... 1, ) == 0x0
 02147  1796   NtOpenThreadToken  (-2, 0xc, 1, ...
 02133  1256   NtConnectPort  ... 392, 0x0, 0x0, 0x0, 188, ) == 0x0
 02140  1700   NtWaitForSingleObject  ... ) == 0x102
 02148   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ...
 02147  1796   NtOpenThreadToken  ... ) == STATUS_NO_TOKEN
 02149  1256   NtRequestWaitReplyPort  (392, {200, 224, new_msg, 0, 1329576, 12, 2, 1310721}  (392, {200, 224, new_msg, 0, 1329576, 12, 2, 1310721} "\0\0\0\0\274\0\0\0x\1\24\0\1kwEVY\205D\237\200\364(\367\326\1)\2\0\0\0\1\0\0\0\334\12\25\0\4\0\0\0x\1\24\0\10\0\0\0\5\0\0\0x\1\24\0\0\0\0\0\0\0\25\0\1\0\0\0\332"0\317l\346{\300h\31\25\0h\1\24\0\12\0\0\0\0\0\0\0\0\0\0\0(\0\0\0\30\31\25\0\371"epx\1\24\0`\31\25\0h\1\24\0\0\0\0\0\0\0\0\0`\31\25\0P\0\0\0h\31\25\0x\357\360\0x\1\24\0P\0\0\0\200\300\0\0\0\0\24\0\204\354\360\0\372\31\221|\30\364\360\0\30\356\220|\360\6\221|\0\0\0\0\0\0\0\0\0\0\0\0\6\0\0\0" ... 0\317l\346{\300h\31\25\0h\1\24\0\12\0\0\0\0\0\0\0\0\0\0\0(\0\0\0\30\31\25\0\371 (392, {200, 224, new_msg, 0, 1329576, 12, 2, 1310721} "\0\0\0\0\274\0\0\0x\1\24\0\1kwEVY\205D\237\200\364(\367\326\1)\2\0\0\0\1\0\0\0\334\12\25\0\4\0\0\0x\1\24\0\10\0\0\0\5\0\0\0x\1\24\0\0\0\0\0\0\0\25\0\1\0\0\0\332"0\317l\346{\300h\31\25\0h\1\24\0\12\0\0\0\0\0\0\0\0\0\0\0(\0\0\0\30\31\25\0\371"epx\1\24\0`\31\25\0h\1\24\0\0\0\0\0\0\0\0\0`\31\25\0P\0\0\0h\31\25\0x\357\360\0x\1\24\0P\0\0\0\200\300\0\0\0\0\24\0\204\354\360\0\372\31\221|\30\364\360\0\30\356\220|\360\6\221|\0\0\0\0\0\0\0\0\0\0\0\0\6\0\0\0" ...  ...
 02150  1700   NtWaitForSingleObject  (160, 0, 0x0, ...
 02151  1028   NtTestAlert  (...
 02152  1796   NtOpenThreadToken  (-2, 0x20008, 1, ...
 02151  1028   NtTestAlert  ... ) == 0x0
 02149  1256   NtRequestWaitReplyPort  ... {200, 224, reply, 0, 1252, 1256, 81913, 0}  ... {200, 224, reply, 0, 1252, 1256, 81913, 0} "\7\0\0\0\274\0\0\0x\1\24\0\1kwEVY\205D\237\200\364(\367\326\1)\2\0\0\0\1\0\0\0\0\0\0\0\4\0\0\0x\1\24\0\377\377\377\377\5\0\0\0x\1\24\0\0\0\0\0\0\0\25\0\1\0\0\0\332"0\317l\346{\300h\31\25\0h\1\24\0\12\0\0\0\0\0\0\0\0\0\0\0(\0\0\0\30\31\25\0\371"epx\1\24\0`\31\25\0h\1\24\0\0\0\0\0\0\0\0\0`\31\25\0P\0\0\0h\31\25\0x\357\360\0x\1\24\0P\0\0\0\200\300\0\0\0\0\24\0\204\354\360\0\372\31\221|\30\364\360\0\30\356\220|\360\6\221|\0\0\0\0\0\0\0\0\0\0\0\0\6\0\0\0" ) 0\317l\346{\300h\31\25\0h\1\24\0\12\0\0\0\0\0\0\0\0\0\0\0(\0\0\0\30\31\25\0\371 ... {200, 224, reply, 0, 1252, 1256, 81913, 0} "\7\0\0\0\274\0\0\0x\1\24\0\1kwEVY\205D\237\200\364(\367\326\1)\2\0\0\0\1\0\0\0\0\0\0\0\4\0\0\0x\1\24\0\377\377\377\377\5\0\0\0x\1\24\0\0\0\0\0\0\0\25\0\1\0\0\0\332"0\317l\346{\300h\31\25\0h\1\24\0\12\0\0\0\0\0\0\0\0\0\0\0(\0\0\0\30\31\25\0\371"epx\1\24\0`\31\25\0h\1\24\0\0\0\0\0\0\0\0\0`\31\25\0P\0\0\0h\31\25\0x\357\360\0x\1\24\0P\0\0\0\200\300\0\0\0\0\24\0\204\354\360\0\372\31\221|\30\364\360\0\30\356\220|\360\6\221|\0\0\0\0\0\0\0\0\0\0\0\0\6\0\0\0" )  ) == 0x0
 02152  1796   NtOpenThreadToken  ... ) == STATUS_NO_TOKEN
 02153  1028   NtContinue  (40959280, 1, ...
 02154  1256   NtRequestWaitReplyPort  (392, {64, 88, new_msg, 0, 0, 0, 0, 0}  (392, {64, 88, new_msg, 0, 0, 0, 0, 0} "\1\0\0\0A\2\10\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\377\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0" ...  ...
 02155  1796   NtAllocateVirtualMemory  (-1, 1384448, 0, 4096, 4096, 4, ...
 02156  1028   NtRegisterThreadTerminatePort  (24, ...
 02148   896   NtAllocateVirtualMemory  ... 40960000, 1048576, ) == 0x0
 02155  1796   NtAllocateVirtualMemory  ... 1384448, 4096, ) == 0x0
 02156  1028   NtRegisterThreadTerminatePort  ... ) == 0x0
 02157   896   NtAllocateVirtualMemory  (-1, 42000384, 0, 8192, 4096, 4, ...
 02154  1256   NtRequestWaitReplyPort  ... {52, 76, reply, 0, 1252, 1256, 81914, 0}  ... {52, 76, reply, 0, 1252, 1256, 81914, 0} "\2\356Q\200\1\0\0\0\30b\202\201\0\300\375\177\220\273\270\367\370\37`\300l\273\270\367X\353Q\200\360\317\12\0\1\0\0\0\1\0\0\0\300\250|\207\377\377\377\0" )  ) == 0x0
 02158  1796   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\mswsock.dll"}, 11595888, ... }, 11595888, ...
 02157   896   NtAllocateVirtualMemory  ... 42000384, 8192, ) == 0x0
 02159  1256   NtClose  (352, ...
 02158  1796   NtQueryAttributesFile  ... ) == 0x0
 02160   896   NtProtectVirtualMemory  (-1, (0x280e000), 4096, 260, ...
 02159  1256   NtClose  ... ) == 0x0
 02161  1796   NtOpenKey  (0x20019, {24, 40, 0x40, 0, 0,  (0x20019, {24, 40, 0x40, 0, 0, "SYSTEM\CurrentControlSet\Services\Winsock\Parameters"}, ... }, ...
 02160   896   NtProtectVirtualMemory  ... (0x280e000), 4096, 4, ) == 0x0
 02162  1256   NtClose  (392, ...
 02161  1796   NtOpenKey  ... 352, ) == 0x0
 02163   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ...
 02162  1256   NtClose  ... ) == 0x0
 02164  1796   NtQueryValueKey  (352,  (352, "Transports", Partial, 144, ... , Partial, 144, ...
 02165  1028   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 02163   896   NtCreateThread  ... 392, {1252, 1180}, ) == 0x0
 02164  1796   NtQueryValueKey  ... TitleIdx=0, Type=7, Data= ... TitleIdx=0, Type=7, Data="T\0c\0p\0i\0p\0\0\0N\0e\0t\0B\0I\0O\0S\0\0\0R\0F\0C\0O\0M\0M\0\0\0\0\0"}, 56, ) }, 56, ) == 0x0
 02165  1028   NtDuplicateObject  ... 396, ) == 0x0
 02166   896   NtQueryInformationThread  (392, Basic, 28, ...
 02167  1256   NtCreateKey  (0x20019, {24, 40, 0x40, 0, 0,  (0x20019, {24, 40, 0x40, 0, 0, "System\CurrentControlSet\Services\Tcpip\Parameters"}, 0, "Class", 0, ... }, 0,  (0x20019, {24, 40, 0x40, 0, 0, "System\CurrentControlSet\Services\Tcpip\Parameters"}, 0, "Class", 0, ... , 0, ...
 02168  1028   NtWaitForSingleObject  (104, 0, {0, 0}, ...
 02166   896   NtQueryInformationThread  ... {ExitStatus=0x103,TebBaseAddress=0x7ff94000,Pid=1252,Tid=1180,}, 0x0, ) == 0x0
 02167  1256   NtCreateKey  ... 400, 2, ) == 0x0
 02168  1028   NtWaitForSingleObject  ... ) == 0x102
 02169   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81912, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81912, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\210\1\0\0\344\4\0\0\234\4\0\0" ...  ...
 02170  1256   NtOpenKey  (0x20019, {24, 40, 0x40, 0, 0,  (0x20019, {24, 40, 0x40, 0, 0, "System\CurrentControlSet\Services\DnsCache\Parameters"}, ... }, ...
 02171  1028   NtWaitForSingleObject  (160, 0, 0x0, ...
 02169   896   NtRequestWaitReplyPort  ... {28, 56, reply, 0, 1252, 896, 81916, 0}  ... {28, 56, reply, 0, 1252, 896, 81916, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\210\1\0\0\344\4\0\0\234\4\0\0" )  ) == 0x0
 02170  1256   NtOpenKey  ... 404, ) == 0x0
 02172  1796   NtQueryValueKey  (352,  (352, "Transports", Partial, 144, ... , Partial, 144, ...
 02173  1256   NtOpenKey  (0x20019, {24, 40, 0x40, 0, 0,  (0x20019, {24, 40, 0x40, 0, 0, "Software\Policies\Microsoft\Windows NT\DnsClient"}, ... }, ...
 02172  1796   NtQueryValueKey  ... TitleIdx=0, Type=7, Data= ... TitleIdx=0, Type=7, Data="T\0c\0p\0i\0p\0\0\0N\0e\0t\0B\0I\0O\0S\0\0\0R\0F\0C\0O\0M\0M\0\0\0\0\0"}, 56, ) }, 56, ) == 0x0
 02173  1256   NtOpenKey  ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02174  1796   NtClose  (352, ...
 02175   896   NtResumeThread  (392, ...
 02174  1796   NtClose  ... ) == 0x0
 02175   896   NtResumeThread  ... 1, ) == 0x0
 02176  1796   NtOpenKey  (0x20019, {24, 40, 0x40, 0, 0,  (0x20019, {24, 40, 0x40, 0, 0, "System\CurrentControlSet\Services\Tcpip\Parameters\Winsock"}, ... }, ...
 02177   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ...
 02176  1796   NtOpenKey  ... 352, ) == 0x0
 02177   896   NtAllocateVirtualMemory  ... 42008576, 1048576, ) == 0x0
 02178  1256   NtQueryValueKey  (400,  (400, "Hostname", Partial, 144, ... , Partial, 144, ...
 02179  1180   NtTestAlert  (...
 02180   896   NtAllocateVirtualMemory  (-1, 43048960, 0, 8192, 4096, 4, ...
 02178  1256   NtQueryValueKey  ... TitleIdx=0, Type=1, Data= ... TitleIdx=0, Type=1, Data="v\0i\0r\0t\0u\0a\0l\0\0\0"}, 28, ) }, 28, ) == 0x0
 02179  1180   NtTestAlert  ... ) == 0x0
 02180   896   NtAllocateVirtualMemory  ... 43048960, 8192, ) == 0x0
 02181  1256   NtQueryValueKey  (400,  (400, "Hostname", Partial, 144, ... , Partial, 144, ...
 02182  1180   NtContinue  (42007856, 1, ...
 02183  1796   NtQueryValueKey  (352,  (352, "Mapping", Partial, 144, ... , Partial, 144, ...
 02181  1256   NtQueryValueKey  ... TitleIdx=0, Type=1, Data= ... TitleIdx=0, Type=1, Data="v\0i\0r\0t\0u\0a\0l\0\0\0"}, 28, ) }, 28, ) == 0x0
 02184  1180   NtRegisterThreadTerminatePort  (24, ...
 02183  1796   NtQueryValueKey  ... ) == STATUS_BUFFER_OVERFLOW
 02185  1256   NtClose  (400, ...
 02184  1180   NtRegisterThreadTerminatePort  ... ) == 0x0
 02186  1796   NtQueryValueKey  (352,  (352, "Mapping", Partial, 144, ... , Partial, 144, ...
 02185  1256   NtClose  ... ) == 0x0
 02187   896   NtProtectVirtualMemory  (-1, (0x290e000), 4096, 260, ...
 02186  1796   NtQueryValueKey  ... ) == STATUS_BUFFER_OVERFLOW
 02188  1180   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 02187   896   NtProtectVirtualMemory  ... (0x290e000), 4096, 4, ) == 0x0
 02189  1796   NtQueryValueKey  (352,  (352, "Mapping", Partial, 152, ... , Partial, 152, ...
 02188  1180   NtDuplicateObject  ... 400, ) == 0x0
 02190   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ...
 02189  1796   NtQueryValueKey  ... TitleIdx=0, Type=3, Data= ... TitleIdx=0, Type=3, Data="\13\0\0\0\3\0\0\0\2\0\0\0\1\0\0\0\6\0\0\0\2\0\0\0\1\0\0\0\0\0\0\0\2\0\0\0\0\0\0\0\6\0\0\0\0\0\0\0\0\0\0\0\6\0\0\0\0\0\0\0\1\0\0\0\6\0\0\0\2\0\0\0\2\0\0\0\21\0\0\0\2\0\0\0\2\0\0\0\0\0\0\0\2\0\0\0\0\0\0\0\21\0\0\0\0\0\0\0\0\0\0\0\21\0\0\0\0\0\0\0\2\0\0\0\21\0\0\0\2\0\0\0\3\0\0\0\0\0\0\0"}, 152, ) }, 152, ) == 0x0
 02191  1180   NtWaitForSingleObject  (104, 0, {0, 0}, ...
 02190   896   NtCreateThread  ... 408, {1252, 928}, ) == 0x0
 02192  1256   NtClose  (404, ...
 02191  1180   NtWaitForSingleObject  ... ) == 0x102
 02193   896   NtQueryInformationThread  (408, Basic, 28, ...
 02192  1256   NtClose  ... ) == 0x0
 02194  1180   NtWaitForSingleObject  (160, 0, 0x0, ...
 02193   896   NtQueryInformationThread  ... {ExitStatus=0x103,TebBaseAddress=0x7ff93000,Pid=1252,Tid=928,}, 0x0, ) == 0x0
 02195  1256   NtDeviceIoControlFile  (264, 0, 0x0, 0x0, 0x390008,  (264, 0, 0x0, 0x0, 0x390008, "\15\333\15g\333W\203\7h\362\364\206J\200.qB\206\337\227\250:\242\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0", 256, 256, ... , 256, 256, ...
 02196  1796   NtClose  (352, ...
 02197  1256   NtQuerySystemInformation  (TimeOfDay, 48, ...
 02196  1796   NtClose  ... ) == 0x0
 02197  1256   NtQuerySystemInformation  ... {system info, class 3, size 48}, 48, ) == 0x0
 02198  1796   NtOpenKey  (0x20019, {24, 40, 0x40, 0, 0,  (0x20019, {24, 40, 0x40, 0, 0, "System\CurrentControlSet\Services\Tcpip\Parameters\Winsock"}, ... }, ...
 02199  1256   NtQuerySystemInformation  (ProcessorTimes, 48, ...
 02198  1796   NtOpenKey  ... 352, ) == 0x0
 02200   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81916, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81916, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\230\1\0\0\344\4\0\0\240\3\0\0" ...  ...
 02201  1796   NtQueryValueKey  (352,  (352, "MinSockaddrLength", Partial, 144, ... , Partial, 144, ...
 02200   896   NtRequestWaitReplyPort  ... {28, 56, reply, 0, 1252, 896, 81917, 0}  ... {28, 56, reply, 0, 1252, 896, 81917, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\230\1\0\0\344\4\0\0\240\3\0\0" )  ) == 0x0
 02201  1796   NtQueryValueKey  ... TitleIdx=0, Type=4, Data= ... TitleIdx=0, Type=4, Data="\20\0\0\0"}, 16, ) }, 16, ) == 0x0
 02202   896   NtResumeThread  (408, ...
 02199  1256   NtQuerySystemInformation  ... {system info, class 8, size 48}, 48, ) == 0x0
 02202   896   NtResumeThread  ... 1, ) == 0x0
 02203  1256   NtQuerySystemInformation  (Performance, 312, ...
 02204   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ...
 02203  1256   NtQuerySystemInformation  ... {system info, class 2, size 312}, 312, ) == 0x0
 02205  1796   NtQueryValueKey  (352,  (352, "MaxSockaddrLength", Partial, 144, ... , Partial, 144, ...
 02206   928   NtTestAlert  (...
 02207  1256   NtQuerySystemInformation  (Exception, 16, ...
 02205  1796   NtQueryValueKey  ... TitleIdx=0, Type=4, Data= ... TitleIdx=0, Type=4, Data="\20\0\0\0"}, 16, ) }, 16, ) == 0x0
 02206   928   NtTestAlert  ... ) == 0x0
 02207  1256   NtQuerySystemInformation  ... {system info, class 33, size 16}, 16, ) == 0x0
 02208  1796   NtQueryValueKey  (352,  (352, "UseDelayedAcceptance", Partial, 144, ... , Partial, 144, ...
 02209   928   NtContinue  (43056432, 1, ...
 02210  1256   NtQuerySystemInformation  (Lookaside, 32, ...
 02208  1796   NtQueryValueKey  ... TitleIdx=0, Type=4, Data= ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) }, 16, ) == 0x0
 02211   928   NtRegisterThreadTerminatePort  (24, ...
 02204   896   NtAllocateVirtualMemory  ... 43057152, 1048576, ) == 0x0
 02212  1796   NtQueryValueKey  (352,  (352, "HelperDllName", Partial, 144, ... , Partial, 144, ...
 02211   928   NtRegisterThreadTerminatePort  ... ) == 0x0
 02213   896   NtAllocateVirtualMemory  (-1, 44097536, 0, 8192, 4096, 4, ...
 02212  1796   NtQueryValueKey  ... TitleIdx=0, Type=2, Data= ... TitleIdx=0, Type=2, Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0S\0y\0s\0t\0e\0m\03\02\0\\0w\0s\0h\0t\0c\0p\0i\0p\0.\0d\0l\0l\0\0\0"}, 82, ) }, 82, ) == 0x0
 02210  1256   NtQuerySystemInformation  ... {system info, class 45, size 32}, 32, ) == 0x0
 02213   896   NtAllocateVirtualMemory  ... 44097536, 8192, ) == 0x0
 02214   928   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 02215  1256   NtQuerySystemInformation  (ProcessorStatistics, 3016, ...
 02216   896   NtProtectVirtualMemory  (-1, (0x2a0e000), 4096, 260, ...
 02214   928   NtDuplicateObject  ... 404, ) == 0x0
 02215  1256   NtQuerySystemInformation  ... {system info, class 23, size 0}, 0, ) == 0x0
 02216   896   NtProtectVirtualMemory  ... (0x2a0e000), 4096, 4, ) == 0x0
 02217   928   NtWaitForSingleObject  (104, 0, {0, 0}, ...
 02218  1256   NtQuerySystemInformation  (ProcessesAndThreads, 3008, ...
 02219   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ...
 02217   928   NtWaitForSingleObject  ... ) == 0x102
 02218  1256   NtQuerySystemInformation  ... ) == STATUS_INFO_LENGTH_MISMATCH
 02220  1796   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\System32\wshtcpip.dll"}, 11596844, ... }, 11596844, ...
 02221   928   NtWaitForSingleObject  (160, 0, 0x0, ...
 02222  1256   NtCreateKey  (0x2, {24, 0, 0x240, 0, 0,  (0x2, {24, 0, 0x240, 0, 0, "\Registry\Machine\SOFTWARE\Microsoft\Cryptography\RNG"}, 0, 0x0, 0, ... }, 0, 0x0, 0, ...
 02220  1796   NtQueryAttributesFile  ... ) == 0x0
 02219   896   NtCreateThread  ... 412, {1252, 1732}, ) == 0x0
 02223  1796   NtOpenFile  (0x100020, {24, 0, 0x40, 0, 0,  (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\System32\wshtcpip.dll"}, 5, 96, ... }, 5, 96, ...
 02224   896   NtQueryInformationThread  (412, Basic, 28, ...
 02223  1796   NtOpenFile  ... 416, {status=0x0, info=1}, ) == 0x0
 02224   896   NtQueryInformationThread  ... {ExitStatus=0x103,TebBaseAddress=0x7ff92000,Pid=1252,Tid=1732,}, 0x0, ) == 0x0
 02225  1796   NtCreateSection  (0xe, 0x0, 0x0, 16, 134217728, 416, ...
 02226   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81917, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81917, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\234\1\0\0\344\4\0\0\304\6\0\0" ...  ...
 02225  1796   NtCreateSection  ... 420, ) == 0x0
 02226   896   NtRequestWaitReplyPort  ... {28, 56, reply, 0, 1252, 896, 81918, 0}  ... {28, 56, reply, 0, 1252, 896, 81918, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\234\1\0\0\344\4\0\0\304\6\0\0" )  ) == 0x0
 02222  1256   NtCreateKey  ... -2147482756, 2, ) == 0x0
 02227  1796   NtClose  (416, ...
 02228  1256   NtSetValueKey  (-2147482756,  (-2147482756, "Seed", 0, 3, "\305\6\24\248\31\356\322Y\6\246\17n\345\2\17\244,\231eH\320>\263\236\22\10\234\5N1\246\321\301\37\307\342\337\11\240k\330]\332\230^9\2762\223z\216r\332\221\340\217\367t3w\214\325\360{\335+L[\303\364F\376s\304\273S\264\201$", 80, ... , 0, 3,  (-2147482756, "Seed", 0, 3, "\305\6\24\248\31\356\322Y\6\246\17n\345\2\17\244,\231eH\320>\263\236\22\10\234\5N1\246\321\301\37\307\342\337\11\240k\330]\332\230^9\2762\223z\216r\332\221\340\217\367t3w\214\325\360{\335+L[\303\364F\376s\304\273S\264\201$", 80, ... , 80, ...
 02227  1796   NtClose  ... ) == 0x0
 02228  1256   NtSetValueKey  ... ) == 0x0
 02229  1796   NtMapViewOfSection  (420, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 16, ...
 02230  1256   NtClose  (-2147482756, ...
 02229  1796   NtMapViewOfSection  ... (0x360000), 0x0, 20480, ) == 0x0
 02230  1256   NtClose  ... ) == 0x0
 02231  1796   NtClose  (420, ...
 02195  1256   NtDeviceIoControlFile  ... {status=0x0, info=256},  ... {status=0x0, info=256}, "\252O\256\234\211\4\276&\262\232\242M\303\356\270\310\354\264\241\346\331\313\243\330\230\230\232\241\354Q\376\330P,m\357\320\354m\356\213\226\332=\15\253\201 \367\332\254Q\244\355D:\200*\351\331?\355\200\35Y\330\321\352\306D\22\324\205\221\310!\25'4l\310\220U\27\346G\253Vb\302z\200\21\255\30\374'+\0\221\266\242G\266\334\221\231\230\213\335t\241\177\241\374\216mFb\227\30993\213_\231\260|\372\301"\215u\314\20i_\3725\33\204D\261V\27\333R\316\312\307P\265\361K\264\376~\312\204\307\24%\312\300\262\337\301\255-&\270\201\23\355"\34\312\256I\24uw\343\3548\332\210\2O\266\347\272y0(\220>\263\20_\17\275r\236\24T\332\224Q\367\252W\342\205\323\276\350\272\356\263\342\351\346\242\324\3\27A\326+\2*\262\305\225\1\324\343\313l\3752\11E2\342\242\340\216\304\342\255+\356D", ) \215u\314\20i_\3725\33\204D\261V\27\333R\316\312\307P\265\361K\264\376~\312\204\307\24%\312\300\262\337\301\255-&\270\201\23\355 ... {status=0x0, info=256}, "\252O\256\234\211\4\276&\262\232\242M\303\356\270\310\354\264\241\346\331\313\243\330\230\230\232\241\354Q\376\330P,m\357\320\354m\356\213\226\332=\15\253\201 \367\332\254Q\244\355D:\200*\351\331?\355\200\35Y\330\321\352\306D\22\324\205\221\310!\25'4l\310\220U\27\346G\253Vb\302z\200\21\255\30\374'+\0\221\266\242G\266\334\221\231\230\213\335t\241\177\241\374\216mFb\227\30993\213_\231\260|\372\301"\215u\314\20i_\3725\33\204D\261V\27\333R\316\312\307P\265\361K\264\376~\312\204\307\24%\312\300\262\337\301\255-&\270\201\23\355"\34\312\256I\24uw\343\3548\332\210\2O\266\347\272y0(\220>\263\20_\17\275r\236\24T\332\224Q\367\252W\342\205\323\276\350\272\356\263\342\351\346\242\324\3\27A\326+\2*\262\305\225\1\324\343\313l\3752\11E2\342\242\340\216\304\342\255+\356D", ) , ) == 0x0
 02231  1796   NtClose  ... ) == 0x0
 02232   896   NtResumeThread  (412, ...
 02233  1256   NtDeviceIoControlFile  (264, 0, 0x0, 0x0, 0x390008,  (264, 0, 0x0, 0x0, 0x390008, "\15\333\15g\333W\203\7h\362\364\206J\200\345\220\264]\10\223\5>\267B\206\337\227\250:\242\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0", 256, 256, ... , 256, 256, ...
 02232   896   NtResumeThread  ... 1, ) == 0x0
 02234  1256   NtQuerySystemInformation  (TimeOfDay, 48, ...
 02235   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ...
 02234  1256   NtQuerySystemInformation  ... {system info, class 3, size 48}, 48, ) == 0x0
 02235   896   NtAllocateVirtualMemory  ... 44105728, 1048576, ) == 0x0
 02236  1256   NtQuerySystemInformation  (ProcessorTimes, 48, ...
 02237   896   NtAllocateVirtualMemory  (-1, 45146112, 0, 8192, 4096, 4, ...
 02236  1256   NtQuerySystemInformation  ... {system info, class 8, size 48}, 48, ) == 0x0
 02237   896   NtAllocateVirtualMemory  ... 45146112, 8192, ) == 0x0
 02238  1256   NtQuerySystemInformation  (Performance, 312, ...
 02239  1732   NtWaitForSingleObject  (128, 0, 0x0, ...
 02240   896   NtProtectVirtualMemory  (-1, (0x2b0e000), 4096, 260, ...
 02241  1796   NtUnmapViewOfSection  (-1, 0x360000, ...
 02240   896   NtProtectVirtualMemory  ... (0x2b0e000), 4096, 4, ) == 0x0
 02241  1796   NtUnmapViewOfSection  ... ) == 0x0
 02242   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ...
 02243  1796   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\System32\wshtcpip.dll"}, 11597152, ... }, 11597152, ...
 02242   896   NtCreateThread  ... 420, {1252, 748}, ) == 0x0
 02243  1796   NtQueryAttributesFile  ... ) == 0x0
 02244   896   NtQueryInformationThread  (420, Basic, 28, ...
 02238  1256   NtQuerySystemInformation  ... {system info, class 2, size 312}, 312, ) == 0x0
 02244   896   NtQueryInformationThread  ... {ExitStatus=0x103,TebBaseAddress=0x7ff91000,Pid=1252,Tid=748,}, 0x0, ) == 0x0
 02245  1256   NtQuerySystemInformation  (Exception, 16, ...
 02246  1796   NtOpenFile  (0x100020, {24, 0, 0x40, 0, 0,  (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\System32\wshtcpip.dll"}, 5, 96, ... }, 5, 96, ...
 02245  1256   NtQuerySystemInformation  ... {system info, class 33, size 16}, 16, ) == 0x0
 02246  1796   NtOpenFile  ... 416, {status=0x0, info=1}, ) == 0x0
 02247  1256   NtQuerySystemInformation  (Lookaside, 32, ...
 02248  1796   NtCreateSection  (0xf, 0x0, 0x0, 16, 16777216, 416, ...
 02247  1256   NtQuerySystemInformation  ... {system info, class 45, size 32}, 32, ) == 0x0
 02248  1796   NtCreateSection  ... 424, ) == 0x0
 02249  1256   NtQuerySystemInformation  (ProcessorStatistics, 3016, ...
 02250  1796   NtQuerySection  (424, Image, 48, ...
 02251   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81918, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81918, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\244\1\0\0\344\4\0\0\354\2\0\0" ...  ...
 02250  1796   NtQuerySection  ... {section info, class 1, size 48}, 0x0, ) == 0x0
 02251   896   NtRequestWaitReplyPort  ... {28, 56, reply, 0, 1252, 896, 81919, 0}  ... {28, 56, reply, 0, 1252, 896, 81919, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\244\1\0\0\344\4\0\0\354\2\0\0" )  ) == 0x0
 02249  1256   NtQuerySystemInformation  ... {system info, class 23, size 0}, 0, ) == 0x0
 02252   896   NtResumeThread  (420, ...
 02253  1256   NtQuerySystemInformation  (ProcessesAndThreads, 3008, ...
 02252   896   NtResumeThread  ... 1, ) == 0x0
 02253  1256   NtQuerySystemInformation  ... ) == STATUS_INFO_LENGTH_MISMATCH
 02254   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ...
 02255  1256   NtCreateKey  (0x2, {24, 0, 0x240, 0, 0,  (0x2, {24, 0, 0x240, 0, 0, "\Registry\Machine\SOFTWARE\Microsoft\Cryptography\RNG"}, 0, 0x0, 0, ... }, 0, 0x0, 0, ...
 02256  1796   NtClose  (416, ...
 02257   748   NtWaitForSingleObject  (128, 0, 0x0, ...
 02255  1256   NtCreateKey  ... -2147482756, 2, ) == 0x0
 02256  1796   NtClose  ... ) == 0x0
 02258  1256   NtSetValueKey  (-2147482756,  (-2147482756, "Seed", 0, 3, "\355\34\343z\203\302\262\264\200\217\1\360\333d\32N\370\10>\346\254\335r\234\355\314\322\342\33\243!l\235E\276\267\242[\274\361\17\335\301Ht\307\314\2-\119\30H\24\347rV\302\233\22\255?\15L\307\3468\5>j:tv\220\24A\240O\200l", 80, ... , 0, 3,  (-2147482756, "Seed", 0, 3, "\355\34\343z\203\302\262\264\200\217\1\360\333d\32N\370\10>\346\254\335r\234\355\314\322\342\33\243!l\235E\276\267\242[\274\361\17\335\301Ht\307\314\2-\119\30H\24\347rV\302\233\22\255?\15L\307\3468\5>j:tv\220\24A\240O\200l", 80, ... , 80, ...
 02259  1796   NtMapViewOfSection  (424, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ...
 02254   896   NtAllocateVirtualMemory  ... 45154304, 1048576, ) == 0x0
 02259  1796   NtMapViewOfSection  ... (0x71a90000), 0x0, 32768, ) == 0x0
 02260   896   NtAllocateVirtualMemory  (-1, 46194688, 0, 8192, 4096, 4, ...
 02261  1796   NtClose  (424, ...
 02260   896   NtAllocateVirtualMemory  ... 46194688, 8192, ) == 0x0
 02261  1796   NtClose  ... ) == 0x0
 02262   896   NtProtectVirtualMemory  (-1, (0x2c0e000), 4096, 260, ...
 02258  1256   NtSetValueKey  ... ) == 0x0
 02262   896   NtProtectVirtualMemory  ... (0x2c0e000), 4096, 4, ) == 0x0
 02263  1256   NtClose  (-2147482756, ...
 02264   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ...
 02263  1256   NtClose  ... ) == 0x0
 02265  1796   NtProtectVirtualMemory  (-1, (0x71a91000), 128, 4, ...
 02233  1256   NtDeviceIoControlFile  ... {status=0x0, info=256},  ... {status=0x0, info=256}, "\345\240\376@x\5\36^b\21\21Qpv\261\240\377%\252l\370\367o\251\262\2462\33A_\225\201h N\322O\324\323\274)B<\226\370\22\333p\6\343\276*\225\344\214\255\307\306\311i\375RI4^\233/JJ\300\323\2548}\351*\374\215\245\333\304\2300D\254\30v\341\332\361\21`JP\302WMy\373\277\247\367\2563F\13\227\337\30_\347`K=\257\351\352t*\35=\237@h\355\227&?g)R\336\355\331\376oIu\251\217\7\21\265\356!#\216\242}\370\237\211\366\213wa\245\263\337\323\267\32x\264"\237\11!c\241\247\227\203\347\214>\5\373\235\326\340g\202\344\207\206\333\\357\271\351\340\276]C\37\2017=\254\310[\312f\247=\213Y\361\214\241F\4\30\204\302\370*\255"OU\306\05<\360GB\363S\371\352\206\2650\356\253r|\243\255\211\270\33\24\222\337\25\204'\23\377", ) \237\11!c\241\247\227\203\347\214>\5\373\235\326\340g\202\344\207\206\333\\357\271\351\340\276]C\37\2017=\254\310[\312f\247=\213Y\361\214\241F\4\30\204\302\370*\255 ... {status=0x0, info=256}, "\345\240\376@x\5\36^b\21\21Qpv\261\240\377%\252l\370\367o\251\262\2462\33A_\225\201h N\322O\324\323\274)B<\226\370\22\333p\6\343\276*\225\344\214\255\307\306\311i\375RI4^\233/JJ\300\323\2548}\351*\374\215\245\333\304\2300D\254\30v\341\332\361\21`JP\302WMy\373\277\247\367\2563F\13\227\337\30_\347`K=\257\351\352t*\35=\237@h\355\227&?g)R\336\355\331\376oIu\251\217\7\21\265\356!#\216\242}\370\237\211\366\213wa\245\263\337\323\267\32x\264"\237\11!c\241\247\227\203\347\214>\5\373\235\326\340g\202\344\207\206\333\\357\271\351\340\276]C\37\2017=\254\310[\312f\247=\213Y\361\214\241F\4\30\204\302\370*\255"OU\306\05<\360GB\363S\371\352\206\2650\356\253r|\243\255\211\270\33\24\222\337\25\204'\23\377", ) , ) == 0x0
 02265  1796   NtProtectVirtualMemory  ... (0x71a91000), 4096, 32, ) == 0x0
 02266  1256   NtDeviceIoControlFile  (264, 0, 0x0, 0x0, 0x390008,  (264, 0, 0x0, 0x0, 0x390008, "\15\333\15g\333W\203\7h\362\364\206J\200\345\220\264]\10\223\5\365V\264]\10\223\5>\267B\206\337\227\250:\242\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0", 256, 256, ... , 256, 256, ...
 02267  1796   NtProtectVirtualMemory  (-1, (0x71a91000), 4096, 32, ...
 02268  1256   NtQuerySystemInformation  (TimeOfDay, 48, ...
 02267  1796   NtProtectVirtualMemory  ... (0x71a91000), 4096, 4, ) == 0x0
 02264   896   NtCreateThread  ... 424, {1252, 1388}, ) == 0x0
 02268  1256   NtQuerySystemInformation  ... {system info, class 3, size 48}, 48, ) == 0x0
 02269   896   NtQueryInformationThread  (424, Basic, 28, ...
 02270  1256   NtQuerySystemInformation  (ProcessorTimes, 48, ...
 02269   896   NtQueryInformationThread  ... {ExitStatus=0x103,TebBaseAddress=0x7ff90000,Pid=1252,Tid=1388,}, 0x0, ) == 0x0
 02270  1256   NtQuerySystemInformation  ... {system info, class 8, size 48}, 48, ) == 0x0
 02271   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81919, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81919, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\250\1\0\0\344\4\0\0l\5\0\0" ...  ...
 02272  1256   NtQuerySystemInformation  (Performance, 312, ...
 02271   896   NtRequestWaitReplyPort  ... {28, 56, reply, 0, 1252, 896, 81920, 0}  ... {28, 56, reply, 0, 1252, 896, 81920, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\250\1\0\0\344\4\0\0l\5\0\0" )  ) == 0x0
 02272  1256   NtQuerySystemInformation  ... {system info, class 2, size 312}, 312, ) == 0x0
 02273  1796   NtFlushInstructionCache  (-1, 1906905088, 128, ...
 02274  1256   NtQuerySystemInformation  (Exception, 16, ...
 02273  1796   NtFlushInstructionCache  ... ) == 0x0
 02275   896   NtResumeThread  (424, ...
 02276  1796   NtOpenKey  (0x80000000, {24, 0, 0x40, 0, 0,  (0x80000000, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wshtcpip.dll"}, ... }, ...
 02275   896   NtResumeThread  ... 1, ) == 0x0
 02276  1796   NtOpenKey  ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02277   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ...
 02274  1256   NtQuerySystemInformation  ... {system info, class 33, size 16}, 16, ) == 0x0
 02278  1388   NtWaitForSingleObject  (128, 0, 0x0, ...
 02277   896   NtAllocateVirtualMemory  ... 46202880, 1048576, ) == 0x0
 02279  1256   NtQuerySystemInformation  (Lookaside, 32, ...
 02280   896   NtAllocateVirtualMemory  (-1, 47243264, 0, 8192, 4096, 4, ...
 02279  1256   NtQuerySystemInformation  ... {system info, class 45, size 32}, 32, ) == 0x0
 02280   896   NtAllocateVirtualMemory  ... 47243264, 8192, ) == 0x0
 02281  1256   NtQuerySystemInformation  (ProcessorStatistics, 3016, ...
 02282  1796   NtSetEventBoostPriority  (128, ...
 02281  1256   NtQuerySystemInformation  ... {system info, class 23, size 0}, 0, ) == 0x0
 02239  1732   NtWaitForSingleObject  ... ) == 0x0
 02282  1796   NtSetEventBoostPriority  ... ) == 0x0
 02283  1732   NtSetEventBoostPriority  (128, ...
 02284  1256   NtQuerySystemInformation  (ProcessesAndThreads, 3008, ...
 02257   748   NtWaitForSingleObject  ... ) == 0x0
 02283  1732   NtSetEventBoostPriority  ... ) == 0x0
 02285  1796   NtClose  (352, ...
 02286   896   NtProtectVirtualMemory  (-1, (0x2d0e000), 4096, 260, ...
 02287   748   NtSetEventBoostPriority  (128, ...
 02284  1256   NtQuerySystemInformation  ... ) == STATUS_INFO_LENGTH_MISMATCH
 02285  1796   NtClose  ... ) == 0x0
 02278  1388   NtWaitForSingleObject  ... ) == 0x0
 02287   748   NtSetEventBoostPriority  ... ) == 0x0
 02286   896   NtProtectVirtualMemory  ... (0x2d0e000), 4096, 4, ) == 0x0
 02288  1256   NtCreateKey  (0x2, {24, 0, 0x240, 0, 0,  (0x2, {24, 0, 0x240, 0, 0, "\Registry\Machine\SOFTWARE\Microsoft\Cryptography\RNG"}, 0, 0x0, 0, ... }, 0, 0x0, 0, ...
 02289  1388   NtTestAlert  (...
 02290  1796   NtCreateFile  (0xc0100000, {24, 0, 0x42, 0, 0,  (0xc0100000, {24, 0, 0x42, 0, 0, "\Device\Afd\Endpoint"}, 0x0, 0, 3, 3, 0, 11599488, 67, ... }, 0x0, 0, 3, 3, 0, 11599488, 67, ...
 02291  1732   NtTestAlert  (...
 02292   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ...
 02289  1388   NtTestAlert  ... ) == 0x0
 02288  1256   NtCreateKey  ... -2147482756, 2, ) == 0x0
 02290  1796   NtCreateFile  ... 352, {status=0x0, info=0}, ) == 0x0
 02291  1732   NtTestAlert  ... ) == 0x0
 02292   896   NtCreateThread  ... 416, {1252, 2036}, ) == 0x0
 02293   748   NtTestAlert  (...
 02294  1256   NtSetValueKey  (-2147482756,  (-2147482756, "Seed", 0, 3, "_\350\5\265\250kl\216\260\301u\22 \232\327c\3207\213/ca\313\313\253\360\6\233\346\1\360\240\246\366BX\26\233\337i\11\246a\204\366)\304D\261\203Kf\303<\207h%\243\324\26sX_r\366\16\253\373Z6\346\235@\374|\203\302|\264\277", 80, ... , 0, 3,  (-2147482756, "Seed", 0, 3, "_\350\5\265\250kl\216\260\301u\22 \232\327c\3207\213/ca\313\313\253\360\6\233\346\1\360\240\246\366BX\26\233\337i\11\246a\204\366)\304D\261\203Kf\303<\207h%\243\324\26sX_r\366\16\253\373Z6\346\235@\374|\203\302|\264\277", 80, ... , 80, ...
 02295  1388   NtContinue  (46202160, 1, ...
 02296  1732   NtContinue  (44105008, 1, ...
 02297   896   NtQueryInformationThread  (416, Basic, 28, ...
 02293   748   NtTestAlert  ... ) == 0x0
 02294  1256   NtSetValueKey  ... ) == 0x0
 02298  1388   NtRegisterThreadTerminatePort  (24, ...
 02299  1732   NtRegisterThreadTerminatePort  (24, ...
 02297   896   NtQueryInformationThread  ... {ExitStatus=0x103,TebBaseAddress=0x7ff8f000,Pid=1252,Tid=2036,}, 0x0, ) == 0x0
 02300   748   NtContinue  (45153584, 1, ...
 02301  1256   NtClose  (-2147482756, ...
 02298  1388   NtRegisterThreadTerminatePort  ... ) == 0x0
 02299  1732   NtRegisterThreadTerminatePort  ... ) == 0x0
 02302  1796   NtDeviceIoControlFile  (352, 136, 0x0, 0x0, 0x1207b,  (352, 136, 0x0, 0x0, 0x1207b, "\7\0\0\0\250q\250q%\0\0\0\216\326\220|", 16, 16, ... , 16, 16, ...
 02303   748   NtRegisterThreadTerminatePort  (24, ...
 02304   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81920, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81920, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\240\1\0\0\344\4\0\0\364\7\0\0" ...  ...
 02305  1388   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 02306  1732   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 02302  1796   NtDeviceIoControlFile  ... {status=0x0, info=16},  ... {status=0x0, info=16}, "\7\0\0\00\207\273\201\0 \0\0\200=\242\201", ) , ) == 0x0
 02303   748   NtRegisterThreadTerminatePort  ... ) == 0x0
 02304   896   NtRequestWaitReplyPort  ... {28, 56, reply, 0, 1252, 896, 81921, 0}  ... {28, 56, reply, 0, 1252, 896, 81921, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\240\1\0\0\344\4\0\0\364\7\0\0" )  ) == 0x0
 02305  1388   NtDuplicateObject  ... 428, ) == 0x0
 02301  1256   NtClose  ... ) == 0x0
 02307  1796   NtDeviceIoControlFile  (352, 136, 0x0, 0x0, 0x1207b,  (352, 136, 0x0, 0x0, 0x1207b, "\6\0\0\00\207\273\201\0 \0\0\200=\242\201", 16, 16, ... , 16, 16, ...
 02308   748   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 02309   896   NtResumeThread  (416, ...
 02310  1388   NtWaitForSingleObject  (104, 0, {0, 0}, ...
 02266  1256   NtDeviceIoControlFile  ... {status=0x0, info=256},  ... {status=0x0, info=256}, "^-\4\205\256[:\315D\246!\267\23\247\363\350\17\356-\323\262\305l\250\343fX\365\320\33G\322\302\260p\254LP\322\331H:U\216-\4$\24#\226I\255\306\201y\352\356}\256$c\313:\325\334\236\344\270kI\304\314\331\375\246\307\375-\207\34^PF\271Q\25\227\316\212,\246iE\223t\335\361pC\360\5\374\273\375\343i\362\317\24*'\267\203\347Xl\216@\301!{\224n\310}\340\350\250\33\-F4[\321\14\354\330!\232\351JX\214)\214\305\270\301H`\216\225X^\212\262 @#zOQp\343\320\250\\244U:\275vP\233%\304%\302?Rl7\232\222e\206\250\253u\361?\231\314\361\214\0\263&D\15\267\350\30(\24\226\361\27\246\210N\326bT\362\323\242\337\225\313\323\322s\200\253n\270\23a\311\371\205\267\232\1\324\344\324\13\204\322\344\363\203\311Z&!\6\316\33\201", ) , ) == 0x0
 02307  1796   NtDeviceIoControlFile  ... {status=0x0, info=16},  ... {status=0x0, info=16}, "\6\0\0\00\207\273\201\0 \0\0\200=\242\201", ) , ) == 0x0
 02306  1732   NtDuplicateObject  ... 432, ) == 0x0
 02309   896   NtResumeThread  ... 1, ) == 0x0
 02308   748   NtDuplicateObject  ... 436, ) == 0x0
 02311  1256   NtDeviceIoControlFile  (264, 0, 0x0, 0x0, 0x390008,  (264, 0, 0x0, 0x0, 0x390008, "\15\333\15g\333W\203\7h\362\364\206J\200\345\220\264]\10\223\5\365V\264]\10\223\5\365V\264]\10\223\5>\267B\206\337\227\250:\242\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0", 256, 256, ... , 256, 256, ...
 02312  1796   NtDeviceIoControlFile  (352, 136, 0x0, 0x0, 0x12047,  (352, 136, 0x0, 0x0, 0x12047, "\0\0\0\0\2\0\0\0\1\0\0\0\6\0\0\0\20\0\0\0\20\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0 \0\0\0 \0\0\0\0\0\0\1\0\0\0\351\3\0\0f\0\2\0\10\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0h\0\0\0\224\375\260\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\1\0\0\0\6\0\0\0\0 \0\0\1\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\1\0\0\0\1\0\0\1\0\0\0 \0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0", 248, 16, ... , 248, 16, ...
 02313  1732   NtWaitForSingleObject  (104, 0, {0, 0}, ...
 02314   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ...
 02315   748   NtAllocateVirtualMemory  (-1, 1388544, 0, 4096, 4096, 4, ...
 02316  1256   NtQuerySystemInformation  (TimeOfDay, 48, ...
 02312  1796   NtDeviceIoControlFile  ... {status=0x0, info=0}, "", ) == 0x0
 02313  1732   NtWaitForSingleObject  ... ) == 0x102
 02310  1388   NtWaitForSingleObject  ... ) == 0x102
 02317  2036   NtTestAlert  (...
 02315   748   NtAllocateVirtualMemory  ... 1388544, 4096, ) == 0x0
 02316  1256   NtQuerySystemInformation  ... {system info, class 3, size 48}, 48, ) == 0x0
 02314   896   NtAllocateVirtualMemory  ... 47251456, 1048576, ) == 0x0
 02318  1732   NtWaitForSingleObject  (328, 0, 0x0, ...
 02319  1388   NtWaitForSingleObject  (328, 0, 0x0, ...
 02317  2036   NtTestAlert  ... ) == 0x0
 02320   748   NtSetEventBoostPriority  (328, ...
 02321  1256   NtQuerySystemInformation  (ProcessorTimes, 48, ...
 02322   896   NtAllocateVirtualMemory  (-1, 48291840, 0, 8192, 4096, 4, ...
 02323  2036   NtContinue  (47250736, 1, ...
 02318  1732   NtWaitForSingleObject  ... ) == 0x0
 02320   748   NtSetEventBoostPriority  ... ) == 0x0
 02324  1796   NtWaitForSingleObject  (328, 0, 0x0, ...
 02322   896   NtAllocateVirtualMemory  ... 48291840, 8192, ) == 0x0
 02325  1732   NtSetEventBoostPriority  (328, ...
 02326  2036   NtRegisterThreadTerminatePort  (24, ...
 02327   748   NtWaitForSingleObject  (328, 0, 0x0, ...
 02319  1388   NtWaitForSingleObject  ... ) == 0x0
 02325  1732   NtSetEventBoostPriority  ... ) == 0x0
 02328   896   NtProtectVirtualMemory  (-1, (0x2e0e000), 4096, 260, ...
 02326  2036   NtRegisterThreadTerminatePort  ... ) == 0x0
 02321  1256   NtQuerySystemInformation  ... {system info, class 8, size 48}, 48, ) == 0x0
 02329  1388   NtSetEventBoostPriority  (328, ...
 02328   896   NtProtectVirtualMemory  ... (0x2e0e000), 4096, 4, ) == 0x0
 02330  1732   NtWaitForSingleObject  (160, 0, 0x0, ...
 02324  1796   NtWaitForSingleObject  ... ) == 0x0
 02329  1388   NtSetEventBoostPriority  ... ) == 0x0
 02331  1256   NtQuerySystemInformation  (Performance, 312, ...
 02332   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ...
 02333  1796   NtSetEventBoostPriority  (328, ...
 02334  2036   NtWaitForSingleObject  (328, 0, 0x0, ...
 02331  1256   NtQuerySystemInformation  ... {system info, class 2, size 312}, 312, ) == 0x0
 02335  1388   NtWaitForSingleObject  (160, 0, 0x0, ...
 02327   748   NtWaitForSingleObject  ... ) == 0x0
 02333  1796   NtSetEventBoostPriority  ... ) == 0x0
 02336  1256   NtQuerySystemInformation  (Exception, 16, ...
 02337   748   NtSetEventBoostPriority  (328, ...
 02338  1796   NtWaitForSingleObject  (96, 0, {0, 0}, ...
 02334  2036   NtWaitForSingleObject  ... ) == 0x0
 02336  1256   NtQuerySystemInformation  ... {system info, class 33, size 16}, 16, ) == 0x0
 02337   748   NtSetEventBoostPriority  ... ) == 0x0
 02332   896   NtCreateThread  ... 440, {1252, 1600}, ) == 0x0
 02339  2036   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 02340  1256   NtQuerySystemInformation  (Lookaside, 32, ...
 02341   748   NtWaitForSingleObject  (104, 0, {0, 0}, ...
 02342   896   NtQueryInformationThread  (440, Basic, 28, ...
 02339  2036   NtDuplicateObject  ... 444, ) == 0x0
 02338  1796   NtWaitForSingleObject  ... ) == 0x102
 02342   896   NtQueryInformationThread  ... {ExitStatus=0x103,TebBaseAddress=0x7ff8e000,Pid=1252,Tid=1600,}, 0x0, ) == 0x0
 02343  2036   NtWaitForSingleObject  (104, 0, {0, 0}, ...
 02344  1796   NtDeviceIoControlFile  (352, 136, 0x0, 0x0, 0x12003,  (352, 136, 0x0, 0x0, 0x12003, "\0\0\0\0\1\0\0\0\16\0\2\0\25\262\0\0\0\0\0\0\0\0\0\0\0\0", 26, 26, ... , 26, 26, ...
 02345   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81921, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81921, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\270\1\0\0\344\4\0\0@\6\0\0" ...  ...
 02340  1256   NtQuerySystemInformation  ... {system info, class 45, size 32}, 32, ) == 0x0
 02341   748   NtWaitForSingleObject  ... ) == 0x102
 02345   896   NtRequestWaitReplyPort  ... {28, 56, reply, 0, 1252, 896, 81922, 0}  ... {28, 56, reply, 0, 1252, 896, 81922, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\270\1\0\0\344\4\0\0@\6\0\0" )  ) == 0x0
 02346  1256   NtQuerySystemInformation  (ProcessorStatistics, 3016, ...
 02347   748   NtWaitForSingleObject  (160, 0, 0x0, ...
 02343  2036   NtWaitForSingleObject  ... ) == 0x102
 02344  1796   NtDeviceIoControlFile  ... {status=0x0, info=448},  ... {status=0x0, info=448}, "\1\0\0\0\1\0\0\0\16\0\2\0\25\262\0\0\0\0\0\0\0\0\0\0\0\0", ) , ) == 0x0
 02346  1256   NtQuerySystemInformation  ... {system info, class 23, size 0}, 0, ) == 0x0
 02348  2036   NtWaitForSingleObject  (160, 0, 0x0, ...
 02349  1796   NtDeviceIoControlFile  (352, 136, 0x0, 0x0, 0x12047,  (352, 136, 0x0, 0x0, 0x12047, "\1\0\0\0\2\0\0\0\1\0\0\0\6\0\0\0\20\0\0\0\20\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0 \0\0\0 \0\0\0\0\0\0\1\0\0\0\351\3\0\0f\0\2\0\10\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0h\0\0\0(\0*\0\2\0\25\262\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\1\0\0\0\6\0\0\0\0 \0\0\1\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\1\0\0\0\1\0\0\1\0\0\0 \0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0", 248, 0, ... , 248, 0, ...
 02350  1256   NtQuerySystemInformation  (ProcessesAndThreads, 3008, ...
 02349  1796   NtDeviceIoControlFile  ... {status=0x0, info=0}, 0x0, ) == 0x0
 02350  1256   NtQuerySystemInformation  ... ) == STATUS_INFO_LENGTH_MISMATCH
 02351  1796   NtDeviceIoControlFile  (352, 136, 0x0, 0x0, 0x12037,  (352, 136, 0x0, 0x0, 0x12037, "\2\0\0\0", 4, 8, ... , 4, 8, ...
 02352  1256   NtCreateKey  (0x2, {24, 0, 0x240, 0, 0,  (0x2, {24, 0, 0x240, 0, 0, "\Registry\Machine\SOFTWARE\Microsoft\Cryptography\RNG"}, 0, 0x0, 0, ... }, 0, 0x0, 0, ...
 02351  1796   NtDeviceIoControlFile  ... {status=0x0, info=8},  ... {status=0x0, info=8}, "\0\0\0\0\0\0\0\0", ) , ) == 0x0
 02353   896   NtResumeThread  (440, ...
 02352  1256   NtCreateKey  ... -2147481452, 2, ) == 0x0
 02353   896   NtResumeThread  ... 1, ) == 0x0
 02354  1256   NtSetValueKey  (-2147481452,  (-2147481452, "Seed", 0, 3, "\0_\355\272\2647ab\255\15D\22\304\220D1\250\361\225\7O\12W\257\200>U\322\320\25~\303Tx\365\16\346J\265\363\222\275\6M\277R&5js(\23\372\366\25\26\22\251\272\304\16{htN\14R^\222\311\227\304\321B\2T\236j\254P", 80, ... , 0, 3,  (-2147481452, "Seed", 0, 3, "\0_\355\272\2647ab\255\15D\22\304\220D1\250\361\225\7O\12W\257\200>U\322\320\25~\303Tx\365\16\346J\265\363\222\275\6M\277R&5js(\23\372\366\25\26\22\251\272\304\16{htN\14R^\222\311\227\304\321B\2T\236j\254P", 80, ... , 80, ...
 02355   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ...
 02354  1256   NtSetValueKey  ... ) == 0x0
 02355   896   NtAllocateVirtualMemory  ... 48300032, 1048576, ) == 0x0
 02356  1256   NtClose  (-2147481452, ...
 02357   896   NtAllocateVirtualMemory  (-1, 49340416, 0, 8192, 4096, 4, ...
 02356  1256   NtClose  ... ) == 0x0
 02357   896   NtAllocateVirtualMemory  ... 49340416, 8192, ) == 0x0
 02311  1256   NtDeviceIoControlFile  ... {status=0x0, info=256},  ... {status=0x0, info=256}, "\376QH\371\366\264z\327\254\34\32\6\216\310\26>rd\24\1\207e\i\253\346\230T\306\355_\331\32]\360\314\223\363C\23\31\242\315\252]\3052\316\3734\320\364\366s\203\266f\225\253\356\227\213\17\21\301G\226~\206\355s\343\245xAg\327\307\13x\262+\346\212|\365\302\377f\354W\335P\243\236V\251Q\35d\261\342"4!\377p\265t\253z\347\305\24r\314\362\363\300EX\36\371Z\232n\342:#\303.\342o&E\23\354\222\4\266\3316Pg\244zD\205\326]\366\205\374\240XII(z\206'\260F\206\26XB\224$J1\351t\374*\206%Aw\35\6\370\230\202!\31\375\13(m\231\252\270\337\244X\+\356\376XHI\365\12\24:\242V(\22\363\254\320R\35\277\346\306\300\15t\320\310_\356SQ\334x\336\3\247y\245m\324\376\265"K:\304\30\3275", ) 4!\377p\265t\253z\347\305\24r\314\362\363\300EX\36\371Z\232n\342:#\303.\342o&E\23\354\222\4\266\3316Pg\244zD\205\326]\366\205\374\240XII(z\206'\260F\206\26XB\224$J1\351t\374*\206%Aw\35\6\370\230\202!\31\375\13(m\231\252\270\337\244X\+\356\376XHI\365\12\24:\242V(\22\363\254\320R\35\277\346\306\300\15t\320\310_\356SQ\334x340\372\27>\336\3\247y\245m\324\376\265 ... {status=0x0, info=256}, "\376QH\371\366\264z\327\254\34\32\6\216\310\26>rd\24\1\207e\i\253\346\230T\306\355_\331\32]\360\314\223\363C\23\31\242\315\252]\3052\316\3734\320\364\366s\203\266f\225\253\356\227\213\17\21\301G\226~\206\355s\343\245xAg\327\307\13x\262+\346\212|\365\302\377f\354W\335P\243\236V\251Q\35d\261\342"4!\377p\265t\253z\347\305\24r\314\362\363\300EX\36\371Z\232n\342:#\303.\342o&E\23\354\222\4\266\3316Pg\244zD\205\326]\366\205\374\240XII(z\206'\260F\206\26XB\224$J1\351t\374*\206%Aw\35\6\370\230\202!\31\375\13(m\231\252\270\337\244X\+\356\376XHI\365\12\24:\242V(\22\363\254\320R\35\277\346\306\300\15t\320\310_\356SQ\334x\336\3\247y\245m\324\376\265"K:\304\30\3275", ) , ) == 0x0
 02358  1796   NtDeviceIoControlFile  (352, 136, 0x0, 0x0, 0x1200b,  (352, 136, 0x0, 0x0, 0x1200b, "\0\376\260\0\5\0\0\0\0\313\24\0", 12, 0, ... , 12, 0, ...
 02359  1600   NtTestAlert  (...
 02360   896   NtProtectVirtualMemory  (-1, (0x2f0e000), 4096, 260, ...
 02358  1796   NtDeviceIoControlFile  ... {status=0x0, info=0}, 0x0, ) == 0x0
 02359  1600   NtTestAlert  ... ) == 0x0
 02360   896   NtProtectVirtualMemory  ... (0x2f0e000), 4096, 4, ) == 0x0
 02361  1796   NtDeviceIoControlFile  (352, 136, 0x0, 0x0, 0x12047,  (352, 136, 0x0, 0x0, 0x12047, "\1\0\0\0\2\0\0\0\1\0\0\0\6\0\0\0\20\0\0\0\20\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0 \0\0\0 \0\0\1\0\0\0\1\0\0\0\351\3\0\0f\0\2\0\10\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0h\0\0\0\310\376\260\0\2\0\25\262\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0\1\0\0\0\6\0\0\0\0 \0\0\1\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\1\0\0\0\1\0\0\1\0\0\0 \0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0", 248, 0, ... , 248, 0, ...
 02362  1600   NtContinue  (48299312, 1, ...
 02363   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ...
 02361  1796   NtDeviceIoControlFile  ... {status=0x0, info=0}, 0x0, ) == 0x0
 02364  1600   NtRegisterThreadTerminatePort  (24, ...
 02363   896   NtCreateThread  ... 452, {1252, 252}, ) == 0x0
 02365  1796   NtDeviceIoControlFile  (352, 136, 0x0, 0x0, 0x1202f, 0x0, 0, 26, ...
 02364  1600   NtRegisterThreadTerminatePort  ... ) == 0x0
 02366   896   NtQueryInformationThread  (452, Basic, 28, ...
 02365  1796   NtDeviceIoControlFile  ... {status=0x0, info=26},  ... {status=0x0, info=26}, "\1\0\0\0\1\0\0\0\16\0\2\0\25\262\0\0\0\0\0\0\0\0\0\0\0\0", ) , ) == 0x0
 02367  1256   NtDeviceIoControlFile  (264, 0, 0x0, 0x0, 0x390008,  (264, 0, 0x0, 0x0, 0x390008, "\15\333\15g\333W\203\7h\362\364\206J\200\345\220\264]\10\223\5\365V\264]\10\223\5\365V\264]\10\223\5\365V\264]\10\223\5>\267B\206\337\227\250:\242\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0", 256, 256, ... , 256, 256, ...
 02366   896   NtQueryInformationThread  ... {ExitStatus=0x103,TebBaseAddress=0x7ff8d000,Pid=1252,Tid=252,}, 0x0, ) == 0x0
 02368  1600   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 02369  1256   NtQuerySystemInformation  (TimeOfDay, 48, ...
 02370  1796   NtCreateEvent  (0x100003, 0x0, 1, 0, ...
 02368  1600   NtDuplicateObject  ... 456, ) == 0x0
 02369  1256   NtQuerySystemInformation  ... {system info, class 3, size 48}, 48, ) == 0x0
 02370  1796   NtCreateEvent  ... 460, ) == 0x0
 02371  1600   NtWaitForSingleObject  (104, 0, {0, 0}, ...
 02372  1256   NtQuerySystemInformation  (ProcessorTimes, 48, ...
 02373  1796   NtWaitForSingleObject  (460, 0, 0x0, ...
 02371  1600   NtWaitForSingleObject  ... ) == 0x102
 02372  1256   NtQuerySystemInformation  ... {system info, class 8, size 48}, 48, ) == 0x0
 02374  1600   NtWaitForSingleObject  (160, 0, 0x0, ...
 02375  1256   NtQuerySystemInformation  (Performance, 312, ...
 02376   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81922, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81922, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\304\1\0\0\344\4\0\0\374\0\0\0" ... {28, 56, reply, 0, 1252, 896, 81923, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\304\1\0\0\344\4\0\0\374\0\0\0" )  ... {28, 56, reply, 0, 1252, 896, 81923, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81922, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\304\1\0\0\344\4\0\0\374\0\0\0" ... {28, 56, reply, 0, 1252, 896, 81923, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\304\1\0\0\344\4\0\0\374\0\0\0" )  ) == 0x0
 02377   896   NtResumeThread  (452, ... 1, ) == 0x0
 02378   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ... 49348608, 1048576, ) == 0x0
 02379   896   NtAllocateVirtualMemory  (-1, 50388992, 0, 8192, 4096, 4, ... 50388992, 8192, ) == 0x0
 02380   896   NtProtectVirtualMemory  (-1, (0x300e000), 4096, 260, ... (0x300e000), 4096, 4, ) == 0x0
 02381   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ...
 02375  1256   NtQuerySystemInformation  ... {system info, class 2, size 312}, 312, ) == 0x0
 02382   252   NtTestAlert  (...
 02383  1256   NtQuerySystemInformation  (Exception, 16, ...
 02382   252   NtTestAlert  ... ) == 0x0
 02383  1256   NtQuerySystemInformation  ... {system info, class 33, size 16}, 16, ) == 0x0
 02384   252   NtContinue  (49347888, 1, ...
 02385  1256   NtQuerySystemInformation  (Lookaside, 32, ...
 02386   252   NtRegisterThreadTerminatePort  (24, ...
 02385  1256   NtQuerySystemInformation  ... {system info, class 45, size 32}, 32, ) == 0x0
 02386   252   NtRegisterThreadTerminatePort  ... ) == 0x0
 02387  1256   NtQuerySystemInformation  (ProcessorStatistics, 3016, ...
 02381   896   NtCreateThread  ... 464, {1252, 1300}, ) == 0x0
 02388   252   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 02389   896   NtQueryInformationThread  (464, Basic, 28, ...
 02388   252   NtDuplicateObject  ... 468, ) == 0x0
 02389   896   NtQueryInformationThread  ... {ExitStatus=0x103,TebBaseAddress=0x7ff8c000,Pid=1252,Tid=1300,}, 0x0, ) == 0x0
 02390   252   NtWaitForSingleObject  (104, 0, {0, 0}, ...
 02391   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81923, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81923, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\320\1\0\0\344\4\0\0\24\5\0\0" ...  ...
 02390   252   NtWaitForSingleObject  ... ) == 0x102
 02391   896   NtRequestWaitReplyPort  ... {28, 56, reply, 0, 1252, 896, 81924, 0}  ... {28, 56, reply, 0, 1252, 896, 81924, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\320\1\0\0\344\4\0\0\24\5\0\0" )  ) == 0x0
 02392   252   NtWaitForSingleObject  (160, 0, 0x0, ...
 02387  1256   NtQuerySystemInformation  ... {system info, class 23, size 0}, 0, ) == 0x0
 02393   896   NtResumeThread  (464, ...
 02394  1256   NtQuerySystemInformation  (ProcessesAndThreads, 3008, ...
 02393   896   NtResumeThread  ... 1, ) == 0x0
 02394  1256   NtQuerySystemInformation  ... ) == STATUS_INFO_LENGTH_MISMATCH
 02395   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ...
 02396  1256   NtCreateKey  (0x2, {24, 0, 0x240, 0, 0,  (0x2, {24, 0, 0x240, 0, 0, "\Registry\Machine\SOFTWARE\Microsoft\Cryptography\RNG"}, 0, 0x0, 0, ... }, 0, 0x0, 0, ...
 02395   896   NtAllocateVirtualMemory  ... 50397184, 1048576, ) == 0x0
 02396  1256   NtCreateKey  ... -2147481484, 2, ) == 0x0
 02397   896   NtAllocateVirtualMemory  (-1, 51437568, 0, 8192, 4096, 4, ...
 02398  1256   NtSetValueKey  (-2147481484,  (-2147481484, "Seed", 0, 3, "\340\362\200\35/\2409\203\2172[\2347t\303\232I\2328\321\315\30;\324\201\271\23l\364 \223\204\215\252J\240\370V\256\332\340\266[~\3733\201\260!?Y\0\372\31\3F{\335\360O!\361]p\2319"\31Q\370\267\2\233\301V\241\266\32\357\260", 80, ... , 0, 3,  (-2147481484, "Seed", 0, 3, "\340\362\200\35/\2409\203\2172[\2347t\303\232I\2328\321\315\30;\324\201\271\23l\364 \223\204\215\252J\240\370V\256\332\340\266[~\3733\201\260!?Y\0\372\31\3F{\335\360O!\361]p\2319"\31Q\370\267\2\233\301V\241\266\32\357\260", 80, ... \31Q\370\267\2\233\301V\241\266\32\357\260", 80, ...
 02397   896   NtAllocateVirtualMemory  ... 51437568, 8192, ) == 0x0
 02399  1300   NtTestAlert  (...
 02398  1256   NtSetValueKey  ... ) == 0x0
 02399  1300   NtTestAlert  ... ) == 0x0
 02400  1256   NtClose  (-2147481484, ...
 02401  1300   NtContinue  (50396464, 1, ...
 02400  1256   NtClose  ... ) == 0x0
 02402  1300   NtRegisterThreadTerminatePort  (24, ...
 02367  1256   NtDeviceIoControlFile  ... {status=0x0, info=256},  ... {status=0x0, info=256}, "\340\322p!\364\13\33\276\347`&\233\364n\217\261\353\313\306\317\126%\22\34\340\351\261\276\210 \251\315\200`NU\200\255\246\7\212\33\350\351[\350\240H\27;\342\11\261i\347\343\347\377Q\14\222rXN\320\373\30\263\373\225\341\6\5-\2\220\363\222\17t!\34;_\236g\227\263\215\305\276#Y\332\2377\334\32\370y\362\341\303\213\207\227t\201\323\275W\274\16oH\257\3047\5\10\213\350\344\303\323\324\273@@\352E\231)\360\232p\342", ) , ) == 0x0
 02402  1300   NtRegisterThreadTerminatePort  ... ) == 0x0
 02403  1256   NtDeviceIoControlFile  (264, 0, 0x0, 0x0, 0x390008,  (264, 0, 0x0, 0x0, 0x390008, "\15\333\15g\333W\203\7h\362\364\206J\200\345\220\264]\10\223\5\365V\264]\10\223\5\365V\264]\10\223\5\365V\264]\10\223\5\365V\264]\10\223\5>\267B\206\337\227\250:\242\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0", 256, 256, ... , 256, 256, ...
 02404   896   NtProtectVirtualMemory  (-1, (0x310e000), 4096, 260, ...
 02405  1256   NtQuerySystemInformation  (TimeOfDay, 48, ...
 02404   896   NtProtectVirtualMemory  ... (0x310e000), 4096, 4, ) == 0x0
 02406  1300   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 02407   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ...
 02406  1300   NtDuplicateObject  ... 472, ) == 0x0
 02407   896   NtCreateThread  ... 476, {1252, 1096}, ) == 0x0
 02408  1300   NtWaitForSingleObject  (104, 0, {0, 0}, ...
 02409   896   NtQueryInformationThread  (476, Basic, 28, ...
 02408  1300   NtWaitForSingleObject  ... ) == 0x102
 02409   896   NtQueryInformationThread  ... {ExitStatus=0x103,TebBaseAddress=0x7ff8b000,Pid=1252,Tid=1096,}, 0x0, ) == 0x0
 02410  1300   NtWaitForSingleObject  (160, 0, 0x0, ...
 02405  1256   NtQuerySystemInformation  ... {system info, class 3, size 48}, 48, ) == 0x0
 02411   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81924, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81924, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\334\1\0\0\344\4\0\0H\4\0\0" ...  ...
 02412  1256   NtQuerySystemInformation  (ProcessorTimes, 48, ...
 02411   896   NtRequestWaitReplyPort  ... {28, 56, reply, 0, 1252, 896, 81925, 0}  ... {28, 56, reply, 0, 1252, 896, 81925, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\334\1\0\0\344\4\0\0H\4\0\0" )  ) == 0x0
 02412  1256   NtQuerySystemInformation  ... {system info, class 8, size 48}, 48, ) == 0x0
 02413   896   NtResumeThread  (476, ...
 02414  1256   NtQuerySystemInformation  (Performance, 312, ...
 02413   896   NtResumeThread  ... 1, ) == 0x0
 02414  1256   NtQuerySystemInformation  ... {system info, class 2, size 312}, 312, ) == 0x0
 02415   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ...
 02416  1256   NtQuerySystemInformation  (Exception, 16, ...
 02417  1096   NtTestAlert  (...
 02415   896   NtAllocateVirtualMemory  ... 51445760, 1048576, ) == 0x0
 02417  1096   NtTestAlert  ... ) == 0x0
 02418   896   NtAllocateVirtualMemory  (-1, 52486144, 0, 8192, 4096, 4, ...
 02419  1096   NtContinue  (51445040, 1, ...
 02418   896   NtAllocateVirtualMemory  ... 52486144, 8192, ) == 0x0
 02420  1096   NtRegisterThreadTerminatePort  (24, ...
 02421   896   NtProtectVirtualMemory  (-1, (0x320e000), 4096, 260, ...
 02420  1096   NtRegisterThreadTerminatePort  ... ) == 0x0
 02421   896   NtProtectVirtualMemory  ... (0x320e000), 4096, 4, ) == 0x0
 02416  1256   NtQuerySystemInformation  ... {system info, class 33, size 16}, 16, ) == 0x0
 02422   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ...
 02423  1256   NtQuerySystemInformation  (Lookaside, 32, ...
 02424  1096   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 02423  1256   NtQuerySystemInformation  ... {system info, class 45, size 32}, 32, ) == 0x0
 02424  1096   NtDuplicateObject  ... 480, ) == 0x0
 02425  1256   NtQuerySystemInformation  (ProcessorStatistics, 3016, ...
 02426  1096   NtWaitForSingleObject  (104, 0, {0, 0}, ...
 02425  1256   NtQuerySystemInformation  ... {system info, class 23, size 0}, 0, ) == 0x0
 02426  1096   NtWaitForSingleObject  ... ) == 0x102
 02427  1256   NtQuerySystemInformation  (ProcessesAndThreads, 3008, ...
 02428  1096   NtWaitForSingleObject  (160, 0, 0x0, ...
 02422   896   NtCreateThread  ... 484, {1252, 1024}, ) == 0x0
 02427  1256   NtQuerySystemInformation  ... ) == STATUS_INFO_LENGTH_MISMATCH
 02429   896   NtQueryInformationThread  (484, Basic, 28, ...
 02430  1256   NtCreateKey  (0x2, {24, 0, 0x240, 0, 0,  (0x2, {24, 0, 0x240, 0, 0, "\Registry\Machine\SOFTWARE\Microsoft\Cryptography\RNG"}, 0, 0x0, 0, ... }, 0, 0x0, 0, ...
 02429   896   NtQueryInformationThread  ... {ExitStatus=0x103,TebBaseAddress=0x7ff8a000,Pid=1252,Tid=1024,}, 0x0, ) == 0x0
 02430  1256   NtCreateKey  ... -2147481484, 2, ) == 0x0
 02431   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81925, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81925, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\344\1\0\0\344\4\0\0\0\4\0\0" ...  ...
 02432  1256   NtSetValueKey  (-2147481484,  (-2147481484, "Seed", 0, 3, "\327DC\232\371\266\277~\360\244\240I#&]\256r\21o\251W\361dE[\215O+W\223\206R\300\7\217M6\216\270\360\204\10\323\356\23\276aO\234\3406,\307>\4\311\363_1\24%+\252\6r\255\307"\211\7\274\376FY5\13\344\305b", 80, ... , 0, 3,  (-2147481484, "Seed", 0, 3, "\327DC\232\371\266\277~\360\244\240I#&]\256r\21o\251W\361dE[\215O+W\223\206R\300\7\217M6\216\270\360\204\10\323\356\23\276aO\234\3406,\307>\4\311\363_1\24%+\252\6r\255\307"\211\7\274\376FY5\13\344\305b", 80, ... \211\7\274\376FY5\13\344\305b", 80, ...
 02431   896   NtRequestWaitReplyPort  ... {28, 56, reply, 0, 1252, 896, 81926, 0}  ... {28, 56, reply, 0, 1252, 896, 81926, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\344\1\0\0\344\4\0\0\0\4\0\0" )  ) == 0x0
 02432  1256   NtSetValueKey  ... ) == 0x0
 02433  1256   NtClose  (-2147481484, ... ) == 0x0
 02403  1256   NtDeviceIoControlFile  ... {status=0x0, info=256},  ... {status=0x0, info=256}, "JCjN\337Ft\260i\341\265\337d\360D\263\320\367\33\177\302y\306+\203W\340,\372\251\334\12\357\13\244\367O\220\3735f\20u\364P\351\250\320=\222\271\1\201-\350\243\23\3752\256\2431\26@<@\316\327w/]\351\371]\341\254HO\17MO\\362\215\245&(\5\220\325f\6\301\350\216\301\223\307\303\340\36\244\226\232\200\200\377\26!L\256\313\227x\16u\252\234\317_b-2\201\30\264\227\304\345]\374\217\26S\207\367\325\300\340\26)>\316\271N\311\207\326Ms\35\344"\36\331\6\5\203\253\351\314\210J\241\364z\374\1\277|\37\376e?D\366\343\3\34\263Jqz\337H&>x \371d*=\352\216S\210\236\233\325\373\16i\227yPQ\271\241\224\316\241-"\302z4\364\271\200 \300x\314H\275\14\203\23p\324\254\376\35\344\315\5\333\260f\264)\350\236n\366\212\202\334s\342b[\30B\357", ) \36\331\6\5\203\253\351\314\210J\241\364z\374\1\277|\37\376e?D\366\343\3\34\263Jqz\337H&>x \371d*=\352\216S\210\236\233\325\373\16i\227yPQ\271\241\224\316\241- ... {status=0x0, info=256}, "JCjN\337Ft\260i\341\265\337d\360D\263\320\367\33\177\302y\306+\203W\340,\372\251\334\12\357\13\244\367O\220\3735f\20u\364P\351\250\320=\222\271\1\201-\350\243\23\3752\256\2431\26@<@\316\327w/]\351\371]\341\254HO\17MO\\362\215\245&(\5\220\325f\6\301\350\216\301\223\307\303\340\36\244\226\232\200\200\377\26!L\256\313\227x\16u\252\234\317_b-2\201\30\264\227\304\345]\374\217\26S\207\367\325\300\340\26)>\316\271N\311\207\326Ms\35\344"\36\331\6\5\203\253\351\314\210J\241\364z\374\1\277|\37\376e?D\366\343\3\34\263Jqz\337H&>x \371d*=\352\216S\210\236\233\325\373\16i\227yPQ\271\241\224\316\241-"\302z4\364\271\200 \300x\314H\275\14\203\23p\324\254\376\35\344\315\5\333\260f\264)\350\236n\366\212\202\334s\342b[\30B\357", ) , ) == 0x0
 02434  1256   NtDeviceIoControlFile  (264, 0, 0x0, 0x0, 0x390008,  (264, 0, 0x0, 0x0, 0x390008, "\15\333\15g\333W\203\7h\362\364\206J\200\345\220\264]\10\223\5\365V\264]\10\223\5\365V\264]\10\223\5\365V\264]\10\223\5\365V\264]\10\223\5\365V\264]\10\223\5>\267B\206\337\227\250:\242\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0", 256, 256, ... , 256, 256, ...
 02435  1256   NtQuerySystemInformation  (TimeOfDay, 48, ... {system info, class 3, size 48}, 48, ) == 0x0
 02436  1256   NtQuerySystemInformation  (ProcessorTimes, 48, ...
 02437   896   NtResumeThread  (484, ... 1, ) == 0x0
 02438   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ... 52494336, 1048576, ) == 0x0
 02439   896   NtAllocateVirtualMemory  (-1, 53534720, 0, 8192, 4096, 4, ... 53534720, 8192, ) == 0x0
 02440   896   NtProtectVirtualMemory  (-1, (0x330e000), 4096, 260, ... (0x330e000), 4096, 4, ) == 0x0
 02441   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ... 488, {1252, 1776}, ) == 0x0
 02442   896   NtQueryInformationThread  (488, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ff89000,Pid=1252,Tid=1776,}, 0x0, ) == 0x0
 02436  1256   NtQuerySystemInformation  ... {system info, class 8, size 48}, 48, ) == 0x0
 02443  1024   NtTestAlert  (...
 02444  1256   NtQuerySystemInformation  (Performance, 312, ...
 02443  1024   NtTestAlert  ... ) == 0x0
 02444  1256   NtQuerySystemInformation  ... {system info, class 2, size 312}, 312, ) == 0x0
 02445  1024   NtContinue  (52493616, 1, ...
 02446  1256   NtQuerySystemInformation  (Exception, 16, ...
 02447  1024   NtRegisterThreadTerminatePort  (24, ...
 02446  1256   NtQuerySystemInformation  ... {system info, class 33, size 16}, 16, ) == 0x0
 02447  1024   NtRegisterThreadTerminatePort  ... ) == 0x0
 02448  1256   NtQuerySystemInformation  (Lookaside, 32, ...
 02449   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81926, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81926, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\350\1\0\0\344\4\0\0\360\6\0\0" ...  ...
 02450  1024   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 02449   896   NtRequestWaitReplyPort  ... {28, 56, reply, 0, 1252, 896, 81927, 0}  ... {28, 56, reply, 0, 1252, 896, 81927, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\350\1\0\0\344\4\0\0\360\6\0\0" )  ) == 0x0
 02450  1024   NtDuplicateObject  ... 492, ) == 0x0
 02451   896   NtResumeThread  (488, ...
 02452  1024   NtWaitForSingleObject  (104, 0, {0, 0}, ...
 02451   896   NtResumeThread  ... 1, ) == 0x0
 02452  1024   NtWaitForSingleObject  ... ) == 0x102
 02453   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ...
 02454  1024   NtWaitForSingleObject  (160, 0, 0x0, ...
 02448  1256   NtQuerySystemInformation  ... {system info, class 45, size 32}, 32, ) == 0x0
 02455  1776   NtTestAlert  (...
 02453   896   NtAllocateVirtualMemory  ... 53542912, 1048576, ) == 0x0
 02456  1256   NtQuerySystemInformation  (ProcessorStatistics, 3016, ...
 02455  1776   NtTestAlert  ... ) == 0x0
 02457   896   NtAllocateVirtualMemory  (-1, 54583296, 0, 8192, 4096, 4, ...
 02456  1256   NtQuerySystemInformation  ... {system info, class 23, size 0}, 0, ) == 0x0
 02458  1776   NtContinue  (53542192, 1, ...
 02457   896   NtAllocateVirtualMemory  ... 54583296, 8192, ) == 0x0
 02459  1256   NtQuerySystemInformation  (ProcessesAndThreads, 3008, ...
 02460  1776   NtRegisterThreadTerminatePort  (24, ...
 02461   896   NtProtectVirtualMemory  (-1, (0x340e000), 4096, 260, ...
 02459  1256   NtQuerySystemInformation  ... ) == STATUS_INFO_LENGTH_MISMATCH
 02460  1776   NtRegisterThreadTerminatePort  ... ) == 0x0
 02461   896   NtProtectVirtualMemory  ... (0x340e000), 4096, 4, ) == 0x0
 02462  1256   NtCreateKey  (0x2, {24, 0, 0x240, 0, 0,  (0x2, {24, 0, 0x240, 0, 0, "\Registry\Machine\SOFTWARE\Microsoft\Cryptography\RNG"}, 0, 0x0, 0, ... }, 0, 0x0, 0, ...
 02463   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ...
 02464  1776   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 02462  1256   NtCreateKey  ... -2147481484, 2, ) == 0x0
 02464  1776   NtDuplicateObject  ... 496, ) == 0x0
 02465  1256   NtSetValueKey  (-2147481484,  (-2147481484, "Seed", 0, 3, "\302\262"]\251\10\362\340\270I\330\241P\6\326\272<\204\363\335\333\310k\7\365\372\262!\27E\24ZK\242\33+lP\317\374\267c9gA#\366\12\251\376\232\216'M\202$\226\245?\264\364%\236\267\247D\265\323W\26G)\316!\350\340\373\2620I", 80, ... , 0, 3,  (-2147481484, "Seed", 0, 3, "\302\262"]\251\10\362\340\270I\330\241P\6\326\272<\204\363\335\333\310k\7\365\372\262!\27E\24ZK\242\33+lP\317\374\267c9gA#\366\12\251\376\232\216'M\202$\226\245?\264\364%\236\267\247D\265\323W\26G)\316!\350\340\373\2620I", 80, ... ]\251\10\362\340\270I\330\241P\6\326\272<\204\363\335\333\310k\7\365\372\262!\27E\24ZK\242\33+lP\317\374\267c9gA#\366\12\251\376\232\216'M\202$\226\245?\264\364%\236\267\247D\265\323W\26G)\316!\350\340\373\2620I", 80, ...
 02466  1776   NtWaitForSingleObject  (104, 0, {0, 0}, ...
 02465  1256   NtSetValueKey  ... ) == 0x0
 02466  1776   NtWaitForSingleObject  ... ) == 0x102
 02467  1256   NtClose  (-2147481484, ...
 02468  1776   NtWaitForSingleObject  (160, 0, 0x0, ...
 02467  1256   NtClose  ... ) == 0x0
 02463   896   NtCreateThread  ... 500, {1252, 500}, ) == 0x0
 02434  1256   NtDeviceIoControlFile  ... {status=0x0, info=256},  ... {status=0x0, info=256}, "<\14J\240x\217\302\325\10-\246\223U\221\241\246\335"\22\201\232k\264H\330\362I\302\320r\277\244w\R~\225\231O=\253\305\310\273\2620\2128J\202h\254}S\21\254\33\276\316o\216\3268n\27\354\313ih>\247T\333\32\4\246\204\236\33\215\356:\203\241\3\260e\334s\230\317\350X\7z[\216\3614\313\215\277\15\36\306o\272\252bt\231\322|\357r\265\227\275\222\226\326\10\0ay\35[K\210\201\223\367\377\22\223\7\342\325\j\307HIx\10\220\177xd=$\344\210U0\35\348\354\17\276T\355-\242\313\222\203\36\322\341K\373\0\263\216^=\321\36\266\203\260\25Lfr\224\372\345\340\243X\264\236\240\342\303\363\304\323\354\13\302\2\201\177"\32Lq9K\244-\33s\244\272\303\334#\260\33\20:\27\362\200\356a+\3\177\14\241\235\212\372B\237b4\276", ) \22\201\232k\264H\330\362I\302\320r\277262\362nG>\244w\R~\225\231O=\253\305\310\273\2620\2128J\202h\254}S\21\254\33\276\316o\216\3268n\27\354\313ih>\247T\333\32\4\246\204\236\33\215\356:\203\241\3\260e\334s\230\317\350X\7z[\216\3614\313\215\277\15\36\306o\272\252bt\231\322|\357r\265\227\275\222\226\326\10\0ay\35[K\210\201\223\367\377\22\223\7\342\325\j\307HIx\10\220\177xd=$\344\210U0\35\348\354\17\276T\355-\242\313\222\203\36\322\341K\373\0\263\216^=\321\36\266\203\260\25Lfr\224\372\345\340\243X\264\236\240\342\303\363\304\323\354\13\302\2\201\177 ... {status=0x0, info=256}, "<\14J\240x\217\302\325\10-\246\223U\221\241\246\335"\22\201\232k\264H\330\362I\302\320r\277\244w\R~\225\231O=\253\305\310\273\2620\2128J\202h\254}S\21\254\33\276\316o\216\3268n\27\354\313ih>\247T\333\32\4\246\204\236\33\215\356:\203\241\3\260e\334s\230\317\350X\7z[\216\3614\313\215\277\15\36\306o\272\252bt\231\322|\357r\265\227\275\222\226\326\10\0ay\35[K\210\201\223\367\377\22\223\7\342\325\j\307HIx\10\220\177xd=$\344\210U0\35\348\354\17\276T\355-\242\313\222\203\36\322\341K\373\0\263\216^=\321\36\266\203\260\25Lfr\224\372\345\340\243X\264\236\240\342\303\363\304\323\354\13\302\2\201\177"\32Lq9K\244-\33s\244\272\303\334#\260\33\20:\27\362\200\356a+\3\177\14\241\235\212\372B\237b4\276", ) , ) == 0x0
 02469   896   NtQueryInformationThread  (500, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ff88000,Pid=1252,Tid=500,}, 0x0, ) == 0x0
 02470   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81927, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81927, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\364\1\0\0\344\4\0\0\364\1\0\0" ... {28, 56, reply, 0, 1252, 896, 81928, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\364\1\0\0\344\4\0\0\364\1\0\0" )  ... {28, 56, reply, 0, 1252, 896, 81928, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81927, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\364\1\0\0\344\4\0\0\364\1\0\0" ... {28, 56, reply, 0, 1252, 896, 81928, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\364\1\0\0\344\4\0\0\364\1\0\0" )  ) == 0x0
 02471   896   NtResumeThread  (500, ... 1, ) == 0x0
 02472   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ... 54591488, 1048576, ) == 0x0
 02473   896   NtAllocateVirtualMemory  (-1, 55631872, 0, 8192, 4096, 4, ... 55631872, 8192, ) == 0x0
 02474  1256   NtCreateEvent  (0x1f0003, 0x0, 1, 0, ...
 02475   500   NtTestAlert  (...
 02474  1256   NtCreateEvent  ... 504, ) == 0x0
 02475   500   NtTestAlert  ... ) == 0x0
 02476  1256   NtSetEventBoostPriority  (460, ...
 02477   500   NtContinue  (54590768, 1, ...
 02373  1796   NtWaitForSingleObject  ... ) == 0x0
 02476  1256   NtSetEventBoostPriority  ... ) == 0x0
 02478  1796   NtAllocateVirtualMemory  (-1, 1392640, 0, 4096, 4096, 4, ...
 02479   500   NtRegisterThreadTerminatePort  (24, ...
 02478  1796   NtAllocateVirtualMemory  ... 1392640, 4096, ) == 0x0
 02480  1256   NtWaitForSingleObject  (328, 0, 0x0, ...
 02479   500   NtRegisterThreadTerminatePort  ... ) == 0x0
 02481   896   NtProtectVirtualMemory  (-1, (0x350e000), 4096, 260, ...
 02482  1796   NtSetEventBoostPriority  (328, ...
 02481   896   NtProtectVirtualMemory  ... (0x350e000), 4096, 4, ) == 0x0
 02480  1256   NtWaitForSingleObject  ... ) == 0x0
 02482  1796   NtSetEventBoostPriority  ... ) == 0x0
 02483  1256   NtConnectPort  ( ("\RPC Control\DNSResolver", {12, 2, 1, 0}, 0x0, 0x0, 15789420, 188, ... , {12, 2, 1, 0}, 0x0, 0x0, 15789420, 188, ...
 02484   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ...
 02485  1796   NtAllocateVirtualMemory  (-1, 1396736, 0, 4096, 4096, 4, ...
 02484   896   NtCreateThread  ... 508, {1252, 248}, ) == 0x0
 02485  1796   NtAllocateVirtualMemory  ... 1396736, 4096, ) == 0x0
 02486   896   NtQueryInformationThread  (508, Basic, 28, ...
 02487  1796   NtCreateEvent  (0x1f0003, 0x0, 1, 0, ...
 02486   896   NtQueryInformationThread  ... {ExitStatus=0x103,TebBaseAddress=0x7ff87000,Pid=1252,Tid=248,}, 0x0, ) == 0x0
 02487  1796   NtCreateEvent  ... 512, ) == 0x0
 02488   500   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 02483  1256   NtConnectPort  ... 516, 0x0, 0x0, 0x0, 188, ) == 0x0
 02489   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81928, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81928, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\374\1\0\0\344\4\0\0\370\0\0\0" ...  ...
 02488   500   NtDuplicateObject  ... 520, ) == 0x0
 02490  1256   NtRequestWaitReplyPort  (516, {200, 224, new_msg, 0, 1329576, 12, 2, 1310721}  (516, {200, 224, new_msg, 0, 1329576, 12, 2, 1310721} "\0\3\24\0\274\0\0\0\2149\24\0\1kwEVY\205D\237\200\364(\367\326\1)\2\0\0\0\1\0\0\0\230`\347w\4\0\0\0x\1\24\0\10\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\377\377\2\0\0\0\20\263\215\35\315\271\307\2668@\25\0`\1\24\0\12\0\0\0\0\0\0\0\0\0\0\0(\0\0\0P>\25\0\21\3\37\2170\3\24\00@\25\0h\1\24\0\0\0\0\0\0\0\0\00@\25\0P\0\0\08@\25\0\360\6\221|x\1\24\0P\0\0\0\346\31\0\0\0\0\24\0\354\353\360\0\372\31\221|\200\363\360\0\30\356\220|\360\6\221|\0\0\0\0\0\0\0\0\0\0\0\0\6\0\0\0" ...  ...
 02489   896   NtRequestWaitReplyPort  ... {28, 56, reply, 0, 1252, 896, 81930, 0}  ... {28, 56, reply, 0, 1252, 896, 81930, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\374\1\0\0\344\4\0\0\370\0\0\0" )  ) == 0x0
 02491   500   NtWaitForSingleObject  (104, 0, {0, 0}, ...
 02492   896   NtResumeThread  (508, ...
 02491   500   NtWaitForSingleObject  ... ) == 0x102
 02492   896   NtResumeThread  ... 1, ) == 0x0
 02493   500   NtWaitForSingleObject  (160, 0, 0x0, ...
 02494   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ...
 02495  1796   NtConnectPort  ( ("\RPC Control\epmapper", {12, 2, 1, 1}, 0x0, 0x0, 11596408, 188, ... , {12, 2, 1, 1}, 0x0, 0x0, 11596408, 188, ...
 02490  1256   NtRequestWaitReplyPort  ... {200, 224, reply, 0, 1252, 1256, 81931, 0}  ... {200, 224, reply, 0, 1252, 1256, 81931, 0} "\7\3\24\0\274\0\0\0\2149\24\0\1kwEVY\205D\237\200\364(\367\326\1)\2\0\0\0\1\0\0\0\0\0\0\0\4\0\0\0x\1\24\0\377\377\377\377\5\0\0\0\0\0\0\0\0\0\0\0\0\0\377\377\2\0\0\0\20\263\215\35\315\271\307\2668@\25\0`\1\24\0\12\0\0\0\0\0\0\0\0\0\0\0(\0\0\0P>\25\0\21\3\37\2170\3\24\00@\25\0h\1\24\0\0\0\0\0\0\0\0\00@\25\0P\0\0\08@\25\0\360\6\221|x\1\24\0P\0\0\0\346\31\0\0\0\0\24\0\354\353\360\0\372\31\221|\200\363\360\0\30\356\220|\360\6\221|\0\0\0\0\0\0\0\0\0\0\0\0\6\0\0\0" )  ) == 0x0
 02496   248   NtTestAlert  (...
 02497  1256   NtRequestWaitReplyPort  (516, {44, 68, new_msg, 0, 1252, 1256, 81914, 0}  (516, {44, 68, new_msg, 0, 1252, 1256, 81914, 0} "\1\356\0\0A\2\4\0\30b\202\201\0\300\375\177\220\273\270\367\370\37`\300\377\377\377\377X\353Q\200\0\0\0\0\0\0\0\0\1\0\0\0" ...  ...
 02496   248   NtTestAlert  ... ) == 0x0
 02495  1796   NtConnectPort  ... 524, 0x0, 0x0, 0x0, 188, ) == 0x0
 02494   896   NtAllocateVirtualMemory  ... 55640064, 1048576, ) == 0x0
 02498  1796   NtRequestWaitReplyPort  (524, {200, 224, new_msg, 0, 2883626, 1363432, 12, 2}  (524, {200, 224, new_msg, 0, 2883626, 1363432, 12, 2} "\0\1\24\0\10\0\0\0\274\0\0\0\10\203\257\341\37]\311\21\221\244\10\0+\24\240\372\3\0\0\0\1\0\0\0\1\0\4\0\4\0\0\0\107\24\0x\1\24\0\10\0\0\0\5\0\0\0x\1\24\0\0\0\0\0\0\0\25\0\3\0\0\0\371\0\222\303\337\230\302\27\330X\25\0h\1\24\0\12\0\0\0\0\0\0\0\0\0\0\0(\0\0\0\260X\25\0@\260\206hx\1\24\0\320X\25\0h\1\24\0\0\0\0\0\0\0\0\0\320X\25\0P\0\0\0\330X\25\0\360\6\221|x\1\24\0P\0\0\0\346\31\0\0\0\0\24\0\370\360\260\0\372\31\221|\214\370\260\0\30\356\220|\0\0\0\0\0\0\0\0\0\0\0\0\351\201\347w" ...  ...
 02499   896   NtAllocateVirtualMemory  (-1, 56680448, 0, 8192, 4096, 4, ... 56680448, 8192, ) == 0x0
 02500   896   NtProtectVirtualMemory  (-1, (0x360e000), 4096, 260, ... (0x360e000), 4096, 4, ) == 0x0
 02501   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ...
 02498  1796   NtRequestWaitReplyPort  ... {200, 224, reply, 0, 1252, 1796, 81934, 0}  ... {200, 224, reply, 0, 1252, 1796, 81934, 0} "\7\1\24\0\10\0\0\0\274\0\0\0\10\203\257\341\37]\311\21\221\244\10\0+\24\240\372\3\0\0\0\1\0\0\0\0\0\0\0\4\0\0\0\107\24\0\377\377\377\377\10\0\0\0\5\0\0\0x\1\24\0\0\0\0\0\0\0\25\0\3\0\0\0\371\0\222\303\337\230\302\27\330X\25\0h\1\24\0\12\0\0\0\0\0\0\0\0\0\0\0(\0\0\0\260X\25\0@\260\206hx\1\24\0\320X\25\0h\1\24\0\0\0\0\0\0\0\0\0\320X\25\0P\0\0\0\330X\25\0\360\6\221|x\1\24\0P\0\0\0\346\31\0\0\0\0\24\0\370\360\260\0\372\31\221|\214\370\260\0\30\356\220|\0\0\0\0\0\0\0\0\0\0\0\0\351\201\347w" )  ) == 0x0
 02502   248   NtContinue  (55639344, 1, ...
 02497  1256   NtRequestWaitReplyPort  ... {40, 64, reply, 0, 1252, 1256, 81933, 0}  ... {40, 64, reply, 0, 1252, 1256, 81933, 0} "\2\356Q\200\4\0\0\0@\14\250\201\0\320\372\177\220kt\367\370\37`\300lkt\367X\353Q\200\320\1\0\0X-\12\0" )  ) == 0x0
 02501   896   NtCreateThread  ... 528, {1252, 1884}, ) == 0x0
 02503   248   NtRegisterThreadTerminatePort  (24, ...
 02504  1256   NtRequestWaitReplyPort  (516, {64, 88, new_msg, 56, 1371096, 15789932, 15790032, 0}  (516, {64, 88, new_msg, 56, 1371096, 15789932, 15790032, 0} "\10\357\360\0@\0\24\0\346\277\347w\320\357\360\0l\357\360\0\20\0\0\0\250.\362vL\354\24\0\1\0\0\0(Y\25\0\320\1\0\0\320\1\0\0X-\12\0\0\0\0\0\0\0\0\0\370\347\24\0" ...  ...
 02505   896   NtQueryInformationThread  (528, Basic, 28, ...
 02503   248   NtRegisterThreadTerminatePort  ... ) == 0x0
 02505   896   NtQueryInformationThread  ... {ExitStatus=0x103,TebBaseAddress=0x7ff86000,Pid=1252,Tid=1884,}, 0x0, ) == 0x0
 02506   248   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 02504  1256   NtRequestWaitReplyPort  ... {64, 88, reply, 56, 1252, 1256, 81935, 0}  ... {64, 88, reply, 56, 1252, 1256, 81935, 0} "\10\357\360\0@\0\24\0\346\277\347w\320\357\360\0l\357\360\0\20\0\0\0\250.\362vL\354\24\0\1\0\0\0(Y\25\0\320\1\0\0\320\1\0\0X-\12\0\0\0\0\0\0\0\0\0\370\347\24\0" )  ) == 0x0
 02507   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81930, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81930, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\20\2\0\0\344\4\0\0\\7\0\0" ...  ...
 02506   248   NtDuplicateObject  ... 532, ) == 0x0
 02508  1256   NtClose  (504, ...
 02507   896   NtRequestWaitReplyPort  ... {28, 56, reply, 0, 1252, 896, 81936, 0}  ... {28, 56, reply, 0, 1252, 896, 81936, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\20\2\0\0\344\4\0\0\\7\0\0" )  ) == 0x0
 02509   248   NtWaitForSingleObject  (104, 0, {0, 0}, ...
 02508  1256   NtClose  ... ) == 0x0
 02510  1796   NtRequestWaitReplyPort  (524, {44, 68, new_msg, 56, 0, 0, 0, 0}  (524, {44, 68, new_msg, 56, 0, 0, 0, 0} "\1\0\0\0B\2\3\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\377\377\377\377\0\0\0\0\1\0\0\0\350^\25\0\322\0\0\0" ...  ...
 02511   896   NtResumeThread  (528, ...
 02509   248   NtWaitForSingleObject  ... ) == 0x102
 02511   896   NtResumeThread  ... 1, ) == 0x0
 02512   248   NtWaitForSingleObject  (160, 0, 0x0, ...
 02510  1796   NtRequestWaitReplyPort  ... {40, 64, reply, 0, 1252, 1796, 81937, 0}  ... {40, 64, reply, 0, 1252, 1796, 81937, 0} "\2\356Q\200\4\0\0\0P\306\233\201\0\340\372\177\220\353\10\370\370\37`\300l\353\10\370X\353Q\200\323\1\0\0\350\370\14\0" )  ) == 0x0
 02513   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ...
 02514  1796   NtAllocateVirtualMemory  (-1, 1400832, 0, 4096, 4096, 4, ...
 02513   896   NtAllocateVirtualMemory  ... 56688640, 1048576, ) == 0x0
 02514  1796   NtAllocateVirtualMemory  ... 1400832, 4096, ) == 0x0
 02515   896   NtAllocateVirtualMemory  (-1, 57729024, 0, 8192, 4096, 4, ...
 02516  1796   NtRequestWaitReplyPort  (524, {64, 88, new_msg, 56, 1310720, 11596276, 1400544, 0}  (524, {64, 88, new_msg, 56, 1310720, 11596276, 1400544, 0} "\10\356\220|@\0\1\0\34\0\0\0p\363\260\0\351\201\347w\214\370\260\0\30\356\220|p\5\221|\1\0\0\0\310_\25\0\323\1\0\0\323\1\0\0\350\370\14\0\0\0\0\0\0\0\0\0\273f\347w" ...  ...
 02515   896   NtAllocateVirtualMemory  ... 57729024, 8192, ) == 0x0
 02517  1256   NtClose  (516, ...
 02518  1884   NtTestAlert  (...
 02516  1796   NtRequestWaitReplyPort  ... {64, 88, reply, 56, 1252, 1796, 81938, 0}  ... {64, 88, reply, 56, 1252, 1796, 81938, 0} "\10\356\220|@\0\1\0\34\0\0\0p\363\260\0\351\201\347w\214\370\260\0\30\356\220|p\5\221|\1\0\0\0\310_\25\0\323\1\0\0\323\1\0\0\350\370\14\0\0\0\0\0\0\0\0\0\273f\347w" )  ) == 0x0
 02517  1256   NtClose  ... ) == 0x0
 02518  1884   NtTestAlert  ... ) == 0x0
 02519  1796   NtRequestWaitReplyPort  (524, {44, 68, new_msg, 56, 1252, 1796, 81937, 0}  (524, {44, 68, new_msg, 56, 1252, 1796, 81937, 0} "\1\356\0\0B\2\3\0P\306\233\201\0\340\372\177\220\353\10\370\370\37`\300\377\377\377\377X\353Q\200\1\0\0\0\350^\25\0\322\0\0\0" ...  ...
 02520  1256   NtCreateKey  (0x20019, {24, 40, 0x40, 0, 0,  (0x20019, {24, 40, 0x40, 0, 0, "System\CurrentControlSet\Services\Tcpip\Parameters"}, 0, "Class", 0, ... }, 0,  (0x20019, {24, 40, 0x40, 0, 0, "System\CurrentControlSet\Services\Tcpip\Parameters"}, 0, "Class", 0, ... , 0, ...
 02521  1884   NtContinue  (56687920, 1, ...
 02520  1256   NtCreateKey  ... 516, 2, ) == 0x0
 02522  1884   NtRegisterThreadTerminatePort  (24, ...
 02519  1796   NtRequestWaitReplyPort  ... {40, 64, reply, 0, 1252, 1796, 81940, 0}  ... {40, 64, reply, 0, 1252, 1796, 81940, 0} "\2\246\200|\4\0\0\0\0\0\0\0\4\377}\0(\345\12\0\0\0\0\0\230\376}\0\2\0\0\0\351\1\0\0\350\232\14\0" )  ) == 0x0
 02523  1256   NtOpenKey  (0x20019, {24, 40, 0x40, 0, 0,  (0x20019, {24, 40, 0x40, 0, 0, "System\CurrentControlSet\Services\DnsCache\Parameters"}, ... }, ...
 02522  1884   NtRegisterThreadTerminatePort  ... ) == 0x0
 02524  1796   NtRequestWaitReplyPort  (524, {64, 88, new_msg, 56, 1310720, 11596276, 11597020, 0}  (524, {64, 88, new_msg, 56, 1310720, 11596276, 11597020, 0} "\10\356\220|@\0\1\0\34\0\0\0p\363\260\0\351\201\347w\214\370\260\0\30\356\220|p\5\221|\1\0\0\0pm\25\0\351\1\0\0\351\1\0\0\350\232\14\0\0\0\0\0\0\0\0\0\273f\347w" ...  ...
 02523  1256   NtOpenKey  ... 504, ) == 0x0
 02525   896   NtProtectVirtualMemory  (-1, (0x370e000), 4096, 260, ...
 02526  1884   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 02524  1796   NtRequestWaitReplyPort  ... {64, 88, reply, 56, 1252, 1796, 81941, 0}  ... {64, 88, reply, 56, 1252, 1796, 81941, 0} "\10\356\220|@\0\1\0\34\0\0\0p\363\260\0\351\201\347w\214\370\260\0\30\356\220|p\5\221|\1\0\0\0pm\25\0\351\1\0\0\351\1\0\0\350\232\14\0\0\0\0\0\0\0\0\0\273f\347w" )  ) == 0x0
 02525   896   NtProtectVirtualMemory  ... (0x370e000), 4096, 4, ) == 0x0
 02526  1884   NtDuplicateObject  ... 536, ) == 0x0
 02527  1796   NtRequestWaitReplyPort  (524, {44, 68, new_msg, 56, 1252, 1796, 81940, 0}  (524, {44, 68, new_msg, 56, 1252, 1796, 81940, 0} "\1\246\0\0B\2\3\0\0\0\0\0\4\377}\0(\345\12\0\0\0\0\0\377\377\377\377\2\0\0\0\1\0\0\0\350^\25\0\322\0\0\0" ...  ...
 02528   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ...
 02529  1884   NtWaitForSingleObject  (104, 0, {0, 0}, ...
 02528   896   NtCreateThread  ... 540, {1252, 1620}, ) == 0x0
 02529  1884   NtWaitForSingleObject  ... ) == 0x102
 02527  1796   NtRequestWaitReplyPort  ... {40, 64, reply, 0, 1252, 1796, 81942, 0}  ... {40, 64, reply, 0, 1252, 1796, 81942, 0} "\2\356Q\200\4\0\0\0\250\372\244\201\0\360\372\177\220\253S\371\370\37`\300l\253S\371X\353Q\200|\1\0\0h\236\14\0" )  ) == 0x0
 02530   896   NtQueryInformationThread  (540, Basic, 28, ...
 02531  1884   NtWaitForSingleObject  (160, 0, 0x0, ...
 02532  1796   NtRequestWaitReplyPort  (524, {64, 88, new_msg, 56, 1310720, 11596276, 11597020, 0}  (524, {64, 88, new_msg, 56, 1310720, 11596276, 11597020, 0} "\10\356\220|@\0\1\0\34\0\0\0p\363\260\0\351\201\347w\214\370\260\0\30\356\220|p\5\221|\1\0\0\00J\25\0|\1\0\0|\1\0\0h\236\14\0\0\0\0\0\0\0\0\0\273f\347w" ...  ...
 02530   896   NtQueryInformationThread  ... {ExitStatus=0x103,TebBaseAddress=0x7ff85000,Pid=1252,Tid=1620,}, 0x0, ) == 0x0
 02533  1256   NtOpenKey  (0x20019, {24, 40, 0x40, 0, 0,  (0x20019, {24, 40, 0x40, 0, 0, "Software\Policies\Microsoft\Windows NT\DnsClient"}, ... }, ...
 02532  1796   NtRequestWaitReplyPort  ... {64, 88, reply, 56, 1252, 1796, 81943, 0}  ... {64, 88, reply, 56, 1252, 1796, 81943, 0} "\10\356\220|@\0\1\0\34\0\0\0p\363\260\0\351\201\347w\214\370\260\0\30\356\220|p\5\221|\1\0\0\00J\25\0|\1\0\0|\1\0\0h\236\14\0\0\0\0\0\0\0\0\0\273f\347w" )  ) == 0x0
 02533  1256   NtOpenKey  ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02534  1796   NtClose  (512, ...
 02535  1256   NtOpenKey  (0x1, {24, 40, 0x40, 0, 0,  (0x1, {24, 40, 0x40, 0, 0, "Software\Policies\Microsoft\System\DNSClient"}, ... }, ...
 02534  1796   NtClose  ... ) == 0x0
 02535  1256   NtOpenKey  ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02536  1796   NtClose  (524, ...
 02537  1256   NtQueryValueKey  (516,  (516, "Domain", Partial, 144, ... , Partial, 144, ...
 02536  1796   NtClose  ... ) == 0x0
 02537  1256   NtQueryValueKey  ... TitleIdx=0, Type=1, Data= ... TitleIdx=0, Type=1, Data="\0\0"}, 14, ) }, 14, ) == 0x0
 02538   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81936, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81936, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\34\2\0\0\344\4\0\0T\6\0\0" ...  ...
 02539  1796   NtCreateEvent  (0x1f0003, 0x0, 1, 0, ...
 02538   896   NtRequestWaitReplyPort  ... {28, 56, reply, 0, 1252, 896, 81945, 0}  ... {28, 56, reply, 0, 1252, 896, 81945, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\34\2\0\0\344\4\0\0T\6\0\0" )  ) == 0x0
 02539  1796   NtCreateEvent  ... 524, ) == 0x0
 02540   896   NtResumeThread  (540, ...
 02541  1796   NtOpenThreadToken  (-2, 0xc, 1, ...
 02540   896   NtResumeThread  ... 1, ) == 0x0
 02541  1796   NtOpenThreadToken  ... ) == STATUS_NO_TOKEN
 02542   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ...
 02543  1796   NtCreateEvent  (0x1f0003, 0x0, 1, 0, ...
 02544  1256   NtQueryValueKey  (516,  (516, "Domain", Partial, 144, ... , Partial, 144, ...
 02545  1620   NtTestAlert  (...
 02543  1796   NtCreateEvent  ... 512, ) == 0x0
 02544  1256   NtQueryValueKey  ... TitleIdx=0, Type=1, Data= ... TitleIdx=0, Type=1, Data="\0\0"}, 14, ) }, 14, ) == 0x0
 02545  1620   NtTestAlert  ... ) == 0x0
 02542   896   NtAllocateVirtualMemory  ... 57737216, 1048576, ) == 0x0
 02546  1256   NtClose  (516, ...
 02547  1620   NtContinue  (57736496, 1, ...
 02548   896   NtAllocateVirtualMemory  (-1, 58777600, 0, 8192, 4096, 4, ...
 02546  1256   NtClose  ... ) == 0x0
 02549  1620   NtRegisterThreadTerminatePort  (24, ...
 02548   896   NtAllocateVirtualMemory  ... 58777600, 8192, ) == 0x0
 02550  1256   NtClose  (504, ...
 02549  1620   NtRegisterThreadTerminatePort  ... ) == 0x0
 02551   896   NtProtectVirtualMemory  (-1, (0x380e000), 4096, 260, ...
 02550  1256   NtClose  ... ) == 0x0
 02552  1796   NtOpenThreadToken  (-2, 0xc, 1, ...
 02551   896   NtProtectVirtualMemory  ... (0x380e000), 4096, 4, ) == 0x0
 02553  1620   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 02552  1796   NtOpenThreadToken  ... ) == STATUS_NO_TOKEN
 02554   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ...
 02553  1620   NtDuplicateObject  ... 504, ) == 0x0
 02555  1796   NtSetInformationThread  (-2, ImpersonationToken, {ImpToken=0,}, 4, ...
 02556  1256   NtOpenKey  (0x1, {24, 40, 0x40, 0, 0,  (0x1, {24, 40, 0x40, 0, 0, "System\CurrentControlSet\Services\Tcpip\Parameters"}, ... }, ...
 02557  1620   NtWaitForSingleObject  (104, 0, {0, 0}, ...
 02555  1796   NtSetInformationThread  ... ) == 0x0
 02556  1256   NtOpenKey  ... 516, ) == 0x0
 02557  1620   NtWaitForSingleObject  ... ) == 0x102
 02558  1796   NtCreateFile  (0xc0100080, {24, 0, 0x40, 0, 11595968,  (0xc0100080, {24, 0, 0x40, 0, 11595968, "\??\PIPE\lsarpc"}, 0x0, 0, 3, 1, 64, 0, 0, ... }, 0x0, 0, 3, 1, 64, 0, 0, ...
 02559  1256   NtQueryValueKey  (516,  (516, "DnsNbtLookupOrder", Partial, 144, ... , Partial, 144, ...
 02560  1620   NtWaitForSingleObject  (160, 0, 0x0, ...
 02558  1796   NtCreateFile  ... 544, {status=0x0, info=1}, ) == 0x0
 02559  1256   NtQueryValueKey  ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02554   896   NtCreateThread  ... 548, {1252, 440}, ) == 0x0
 02561  1256   NtClose  (516, ...
 02562   896   NtQueryInformationThread  (548, Basic, 28, ...
 02561  1256   NtClose  ... ) == 0x0
 02562   896   NtQueryInformationThread  ... {ExitStatus=0x103,TebBaseAddress=0x7ff84000,Pid=1252,Tid=440,}, 0x0, ) == 0x0
 02563  1796   NtSetInformationFile  (544, 11596024, 8, Pipe, ...
 02564   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81945, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81945, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG$\2\0\0\344\4\0\0\270\1\0\0" ...  ...
 02563  1796   NtSetInformationFile  ... {status=0x0, info=0}, ) == 0x0
 02564   896   NtRequestWaitReplyPort  ... {28, 56, reply, 0, 1252, 896, 81946, 0}  ... {28, 56, reply, 0, 1252, 896, 81946, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG$\2\0\0\344\4\0\0\270\1\0\0" )  ) == 0x0
 02565  1796   NtSetInformationFile  (544, 11596012, 8, Completion, ...
 02566  1256   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\System32\winrnr.dll"}, 15789008, ... }, 15789008, ...
 02565  1796   NtSetInformationFile  ... {status=0x0, info=0}, ) == 0x0
 02566  1256   NtQueryAttributesFile  ... ) == 0x0
 02567  1796   NtSetInformationThread  (-2, ImpersonationToken, {ImpToken=0,}, 4, ...
 02568  1256   NtOpenFile  (0x100020, {24, 0, 0x40, 0, 0,  (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\System32\winrnr.dll"}, 5, 96, ... }, 5, 96, ...
 02567  1796   NtSetInformationThread  ... ) == 0x0
 02568  1256   NtOpenFile  ... 516, {status=0x0, info=1}, ) == 0x0
 02569   896   NtResumeThread  (548, ...
 02570  1256   NtCreateSection  (0xe, 0x0, 0x0, 16, 134217728, 516, ...
 02569   896   NtResumeThread  ... 1, ) == 0x0
 02570  1256   NtCreateSection  ... 552, ) == 0x0
 02571   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ...
 02572  1796   NtWriteFile  (544, 269, 0, 0,  (544, 269, 0, 0, "\5\0\13\3\20\0\0\0H\0\0\0\1\0\0\0\270\20\270\20\0\0\0\0\1\0\0\0\0\0\1\0xW4\224\22\315\253\357\0\1#Eg\211\253\0\0\0\0\4]\210\212\353\34\311\21\237\350\10\0+\20H`\2\0\0\0", 72, {0, 0}, 0, ... , 72, {0, 0}, 0, ...
 02573   440   NtWaitForSingleObject  (128, 0, 0x0, ...
 02571   896   NtAllocateVirtualMemory  ... 58785792, 1048576, ) == 0x0
 02572  1796   NtWriteFile  ... {status=0x0, info=72}, ) == 0x0
 02574   896   NtAllocateVirtualMemory  (-1, 59826176, 0, 8192, 4096, 4, ...
 02575  1796   NtReadFile  (544, 269, 0, 0, 1024, {0, 0}, 0, ...
 02574   896   NtAllocateVirtualMemory  ... 59826176, 8192, ) == 0x0
 02575  1796   NtReadFile  ... {status=0x0, info=68},  ... {status=0x0, info=68}, "\5\0\14\3\20\0\0\0D\0\0\0\1\0\0\0\270\20\270\20u+\0\0\14\0\PIPE\lsass\0\0\0\1\0\0\0\0\0\0\0\4]\210\212\353\34\311\21\237\350\10\0+\20H`\2\0\0\0", ) , ) == 0x0
 02576  1256   NtClose  (516, ...
 02577  1796   NtFsControlFile  (544, 269, 0x0, 0x0, 0x11c017,  (544, 269, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0@\0\0\0\1\0\0\0(\0\0\0\0\0,\0\0\0\0\0\30\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\210\367\260\0\14\0\0\0\2\0\1\0\0\10\0\0", 64, 1024, ... , 64, 1024, ...
 02576  1256   NtClose  ... ) == 0x0
 02577  1796   NtFsControlFile  ... {status=0x103, info=68},  ... {status=0x103, info=68}, "\5\0\14\3\20\0\0\0D\0\0\0\1\0\0\0\270\20\270\20u+\0\0\14\0\PIPE\lsass\0\0\0\1\0\0\0\0\0\0\0\4]\210\212\353\34\311\21\237\350\10\0+\20H`\2\0\0\0", ) , ) == 0x103
 02578  1256   NtMapViewOfSection  (552, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 16, ...
 02579   896   NtProtectVirtualMemory  (-1, (0x390e000), 4096, 260, ...
 02578  1256   NtMapViewOfSection  ... (0x360000), 0x0, 20480, ) == 0x0
 02579   896   NtProtectVirtualMemory  ... (0x390e000), 4096, 4, ) == 0x0
 02580  1796   NtFsControlFile  (544, 269, 0x0, 0x0, 0x11c017,  (544, 269, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0\210\0\0\0\2\0\0\0p\0\0\0\0\0D\0\0\0\0\0\323Qv{{kdE\276\24\250\200.\243j\276\1\0\0\0\1\0\0\0&\0(\0 L\25\0\24\0\0\0\0\0\0\0\23\0\0\0n\0t\0 \0a\0u\0t\0h\0o\0r\0i\0t\0y\0\\0s\0y\0s\0t\0e\0m\0\0\0\0\0\0\0\0\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\2\0\0\0", 136, 1024, ... , 136, 1024, ...
 02581  1256   NtClose  (552, ...
 02582   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ...
 02580  1796   NtFsControlFile  ... {status=0x103, info=48},  ... {status=0x103, info=48}, "\5\0\2\3\20\0\0\00\0\0\0\1\0\0\0\30\0\0\0\0\0\0\0\0\0\0\0\323Qv{{kdE\276\24\250\200.\243j\276\0\0\0\0", ) , ) == 0x103
 02581  1256   NtClose  ... ) == 0x0
 02582   896   NtCreateThread  ... 552, {1252, 2044}, ) == 0x0
 02583  1796   NtFsControlFile  (544, 269, 0x0, 0x0, 0x11c017,  (544, 269, 0x0, 0x0, 0x11c017, "\5\0\0\3\20\0\0\0,\0\0\0\3\0\0\0\24\0\0\0\0\0\0\0\0\0\0\0\323Qv{{kdE\276\24\250\200.\243j\276", 44, 1024, ... , 44, 1024, ...
 02584   896   NtQueryInformationThread  (552, Basic, 28, ...
 02583  1796   NtFsControlFile  ... {status=0x103, info=156},  ... {status=0x103, info=156}, "\5\0\2\3\20\0\0\0\234\0\0\0\2\0\0\0\204\0\0\0\0\0\0\0\370c\25\0\1\0\0\0\4d\25\0 \0\0\0\1\0\0\0\30\0\32\0\20d\25\0,d\25\0\15\0\0\0\0\0\0\0\14\0\0\0N\0T\0 \0A\0U\0T\0H\0O\0R\0I\0T\0Y\0\0\0\0\0\1\0\0\0\0\0\0\5\1\0\0\0\20P\25\0\1\0\0\0\5\0i\0 P\25\0\0\0\0\0\0\0\0\0\1\0\0\0\1\1\0\0\0\0\0\5\22\0\0\0\1\0\0\0\0\0\0\0", ) , ) == 0x103
 02584   896   NtQueryInformationThread  ... {ExitStatus=0x103,TebBaseAddress=0x7ff83000,Pid=1252,Tid=2044,}, 0x0, ) == 0x0
 02585  1796   NtClose  (512, ...
 02586  1256   NtUnmapViewOfSection  (-1, 0x360000, ...
 02585  1796   NtClose  ... ) == 0x0
 02586  1256   NtUnmapViewOfSection  ... ) == 0x0
 02587   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81946, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81946, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG(\2\0\0\344\4\0\0\374\7\0\0" ...  ...
 02588  1256   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\System32\winrnr.dll"}, 15789316, ... }, 15789316, ...
 02587   896   NtRequestWaitReplyPort  ... {28, 56, reply, 0, 1252, 896, 81947, 0}  ... {28, 56, reply, 0, 1252, 896, 81947, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG(\2\0\0\344\4\0\0\374\7\0\0" )  ) == 0x0
 02588  1256   NtQueryAttributesFile  ... ) == 0x0
 02589   896   NtResumeThread  (552, ...
 02590  1256   NtOpenFile  (0x100020, {24, 0, 0x40, 0, 0,  (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\System32\winrnr.dll"}, 5, 96, ... }, 5, 96, ...
 02589   896   NtResumeThread  ... 1, ) == 0x0
 02590  1256   NtOpenFile  ... 512, {status=0x0, info=1}, ) == 0x0
 02591   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ...
 02592  1796   NtClose  (544, ...
 02593  2044   NtWaitForSingleObject  (128, 0, 0x0, ...
 02594  1256   NtCreateSection  (0xf, 0x0, 0x0, 16, 16777216, 512, ...
 02592  1796   NtClose  ... ) == 0x0
 02594  1256   NtCreateSection  ... 544, ) == 0x0
 02595  1796   NtSecureConnectPort  ( ("\RPC Control\unimdmsvc", {12, 2, 1, 1}, 0x0, 1329576, 0x0, 11597892, 188, ... , {12, 2, 1, 1}, 0x0, 1329576, 0x0, 11597892, 188, ...
 02596  1256   NtQuerySection  (544, Image, 48, ...
 02595  1796   NtSecureConnectPort  ... 516, 0x0, 0x0, 0x0, 188, ) == 0x0
 02596  1256   NtQuerySection  ... {section info, class 1, size 48}, 0x0, ) == 0x0
 02597  1796   NtOpenThreadToken  (-2, 0xc, 1, ...
 02598  1256   NtClose  (512, ...
 02591   896   NtAllocateVirtualMemory  ... 59834368, 1048576, ) == 0x0
 02598  1256   NtClose  ... ) == 0x0
 02599   896   NtAllocateVirtualMemory  (-1, 60874752, 0, 8192, 4096, 4, ...
 02597  1796   NtOpenThreadToken  ... ) == STATUS_NO_TOKEN
 02599   896   NtAllocateVirtualMemory  ... 60874752, 8192, ) == 0x0
 02600  1796   NtSetInformationThread  (-2, ImpersonationToken, {ImpToken=0,}, 4, ...
 02601   896   NtProtectVirtualMemory  (-1, (0x3a0e000), 4096, 260, ...
 02600  1796   NtSetInformationThread  ... ) == 0x0
 02601   896   NtProtectVirtualMemory  ... (0x3a0e000), 4096, 4, ) == 0x0
 02602  1796   NtRequestWaitReplyPort  (516, {200, 224, new_msg, 0, 1363432, 12, 2, 1310977}  (516, {200, 224, new_msg, 0, 1363432, 12, 2, 1310977} "\0\0\0\0\274\0\0\0\0\0\0\03\242t\326)X\335I\220\360`\317\234\353q)\1\0\0\0\1\0\0\0\230`\347w\26\0\0\0\4\0\0\0\10\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\377\377\4\0\0\0\350[5e\225\10\360n\274\351\354?\35\323\372\12\0\0\0\37i\224\177\24\267\320\324\0\0\0\0\370\355\24\0\325\3\227\245A\374\223\256(\0\0\0\265&\0_\0\0\24\0\240\366\260\0z8\327\203\0\0\0\0\330X\25\0\360\6\221|\377\377\377\377P\0\0\0\346\31\0|\0\0\24\0\304\366\260\0\372\31\221|X\376\260\0\30\356\220|\360\6\221|\0\0\0\0\0\0\0\0\0\0\0\0\6\0\0\0" ...  ...
 02603   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ...
 02602  1796   NtRequestWaitReplyPort  ... {200, 224, reply, 0, 1252, 1796, 81949, 0}  ... {200, 224, reply, 0, 1252, 1796, 81949, 0} "\7\0\0\0\274\0\0\0\0\0\0\03\242t\326)X\335I\220\360`\317\234\353q)\1\0\0\0\1\0\0\0\0\0\0\0\26\0\0\0\4\0\0\0\0\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\377\377\4\0\0\0\350[5e\225\10\360n\274\351\354?\35\323\372\12\0\0\0\37i\224\177\24\267\320\324\0\0\0\0\370\355\24\0\325\3\227\245A\374\223\256(\0\0\0\265&\0_\0\0\24\0\240\366\260\0z8\327\203\0\0\0\0\330X\25\0\360\6\221|\377\377\377\377P\0\0\0\346\31\0|\0\0\24\0\304\366\260\0\372\31\221|X\376\260\0\30\356\220|\360\6\221|\0\0\0\0\0\0\0\0\0\0\0\0\6\0\0\0" )  ) == 0x0
 02604  1256   NtMapViewOfSection  (544, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ...
 02603   896   NtCreateThread  ... 512, {1252, 1652}, ) == 0x0
 02604  1256   NtMapViewOfSection  ... (0x76fb0000), 0x0, 32768, ) == 0x0
 02605   896   NtQueryInformationThread  (512, Basic, 28, ...
 02606  1256   NtClose  (544, ...
 02605   896   NtQueryInformationThread  ... {ExitStatus=0x103,TebBaseAddress=0x7ff82000,Pid=1252,Tid=1652,}, 0x0, ) == 0x0
 02606  1256   NtClose  ... ) == 0x0
 02607   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81947, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81947, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\0\2\0\0\344\4\0\0t\6\0\0" ...  ...
 02608  1256   NtProtectVirtualMemory  (-1, (0x76fb1000), 232, 4, ...
 02607   896   NtRequestWaitReplyPort  ... {28, 56, reply, 0, 1252, 896, 81950, 0}  ... {28, 56, reply, 0, 1252, 896, 81950, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\0\2\0\0\344\4\0\0t\6\0\0" )  ) == 0x0
 02608  1256   NtProtectVirtualMemory  ... (0x76fb1000), 4096, 32, ) == 0x0
 02609  1796   NtSetInformationThread  (-2, ImpersonationToken, {ImpToken=0,}, 4, ...
 02610   896   NtResumeThread  (512, ...
 02609  1796   NtSetInformationThread  ... ) == 0x0
 02610   896   NtResumeThread  ... 1, ) == 0x0
 02611  1796   NtRequestWaitReplyPort  (516, {56, 80, new_msg, 0, 44, 3, 20, 0}  (516, {56, 80, new_msg, 0, 44, 3, 20, 0} "\1\0\0\0A\2\2\0{kdE\276\24\250\200.\243j\276\1\0\0\0\0\0\0\0&\0(\0`\1\0\0\0\0\0\0\0\0\0\0\23\0\0\0n\0t\0 \0a\0" ...  ...
 02612   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ... 60882944, 1048576, ) == 0x0
 02613   896   NtAllocateVirtualMemory  (-1, 61923328, 0, 8192, 4096, 4, ... 61923328, 8192, ) == 0x0
 02614  1256   NtProtectVirtualMemory  (-1, (0x76fb1000), 4096, 32, ...
 02615  1652   NtWaitForSingleObject  (128, 0, 0x0, ...
 02614  1256   NtProtectVirtualMemory  ... (0x76fb1000), 4096, 4, ) == 0x0
 02616  1256   NtFlushInstructionCache  (-1, 1996165120, 232, ... ) == 0x0
 02617  1256   NtProtectVirtualMemory  (-1, (0x76fb1000), 232, 4, ... (0x76fb1000), 4096, 32, ) == 0x0
 02618  1256   NtProtectVirtualMemory  (-1, (0x76fb1000), 4096, 32, ... (0x76fb1000), 4096, 4, ) == 0x0
 02619  1256   NtFlushInstructionCache  (-1, 1996165120, 232, ... ) == 0x0
 02620  1256   NtOpenSection  (0xe, {24, 8, 0x40, 0, 0,  (0xe, {24, 8, 0x40, 0, 0, "WLDAP32.dll"}, ... 544, ) }, ... 544, ) == 0x0
 02621   896   NtProtectVirtualMemory  (-1, (0x3b0e000), 4096, 260, ... (0x3b0e000), 4096, 4, ) == 0x0
 02622   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ... 556, {1252, 1376}, ) == 0x0
 02623   896   NtQueryInformationThread  (556, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ff81000,Pid=1252,Tid=1376,}, 0x0, ) == 0x0
 02624   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81950, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81950, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG,\2\0\0\344\4\0\0`\5\0\0" ... {28, 56, reply, 0, 1252, 896, 81952, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG,\2\0\0\344\4\0\0`\5\0\0" )  ... {28, 56, reply, 0, 1252, 896, 81952, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81950, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG,\2\0\0\344\4\0\0`\5\0\0" ... {28, 56, reply, 0, 1252, 896, 81952, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG,\2\0\0\344\4\0\0`\5\0\0" )  ) == 0x0
 02625   896   NtResumeThread  (556, ... 1, ) == 0x0
 02626   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ...
 02627  1256   NtMapViewOfSection  (544, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ...
 02611  1796   NtRequestWaitReplyPort  ... {44, 68, reply, 0, 1252, 1796, 81951, 0}  ... {44, 68, reply, 0, 1252, 1796, 81951, 0} "\4\376\255\201\0\0\0\0\200Y\274\201\356\12$\342\264\311\275\201:\332R\200X\253v\367\324\376\255\201\2\0\0\0\0\0\0\0\0\0\0\0" )  ) == 0x0
 02628  1376   NtWaitForSingleObject  (128, 0, 0x0, ...
 02627  1256   NtMapViewOfSection  ... (0x76f60000), 0x0, 180224, ) == 0x0
 02629  1796   NtRaiseException  (11598352, 11597612, 1, ...
 02630  1256   NtClose  (544, ...
 02626   896   NtAllocateVirtualMemory  ... 61931520, 1048576, ) == 0x0
 02630  1256   NtClose  ... ) == 0x0
 02631   896   NtAllocateVirtualMemory  (-1, 62971904, 0, 8192, 4096, 4, ...
 02632  1256   NtProtectVirtualMemory  (-1, (0x76f61000), 228, 4, ...
 02631   896   NtAllocateVirtualMemory  ... 62971904, 8192, ) == 0x0
 02632  1256   NtProtectVirtualMemory  ... (0x76f61000), 4096, 32, ) == 0x0
 02633   896   NtProtectVirtualMemory  (-1, (0x3c0e000), 4096, 260, ...
 02634  1796   NtQueryVirtualMemory  (-1, 0x77ea0470, BasicVlm, 16, ...
 02633   896   NtProtectVirtualMemory  ... (0x3c0e000), 4096, 4, ) == 0x0
 02634  1796   NtQueryVirtualMemory  ... {memory info, class 3, size 16}, 0x0, ) == 0x0
 02635   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ...
 02636  1796   NtQueryVirtualMemory  (-1, 0x77e7a298, Basic, 28, ... {BaseAddress=0x77e7a000,AllocationBase=0x77e70000,AllocationProtect=0x80,RegionSize=0x80000,State=0x1000,Protect=0x20,Type=0x1000000,}, 28, ) == 0x0
 02637  1796   NtContinue  (11596580, 0, ...
 02638  1796   NtDeviceIoControlFile  (352, 136, 0x0, 0x0, 0x1200c, 0x0, 0, 26, ... {status=0x0, info=0}, "", ) == 0x103
 02639  1796   NtWaitForSingleObject  (136, 1, {-5000000, -1}, ...
 02635   896   NtCreateThread  ... 544, {1252, 1436}, ) == 0x0
 02640   896   NtQueryInformationThread  (544, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ff80000,Pid=1252,Tid=1436,}, 0x0, ) == 0x0
 02641   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81952, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81952, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG \2\0\0\344\4\0\0\234\5\0\0" ... {28, 56, reply, 0, 1252, 896, 81953, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG \2\0\0\344\4\0\0\234\5\0\0" )  ... {28, 56, reply, 0, 1252, 896, 81953, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81952, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG \2\0\0\344\4\0\0\234\5\0\0" ... {28, 56, reply, 0, 1252, 896, 81953, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG \2\0\0\344\4\0\0\234\5\0\0" )  ) == 0x0
 02642  1256   NtProtectVirtualMemory  (-1, (0x76f61000), 4096, 32, ... (0x76f61000), 4096, 4, ) == 0x0
 02643  1256   NtFlushInstructionCache  (-1, 1995837440, 228, ... ) == 0x0
 02644  1256   NtProtectVirtualMemory  (-1, (0x76f61000), 228, 4, ... (0x76f61000), 4096, 32, ) == 0x0
 02645  1256   NtProtectVirtualMemory  (-1, (0x76f61000), 4096, 32, ... (0x76f61000), 4096, 4, ) == 0x0
 02646  1256   NtFlushInstructionCache  (-1, 1995837440, 228, ... ) == 0x0
 02647   896   NtResumeThread  (544, ... 1, ) == 0x0
 02648   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ... 62980096, 1048576, ) == 0x0
 02649   896   NtAllocateVirtualMemory  (-1, 64020480, 0, 8192, 4096, 4, ... 64020480, 8192, ) == 0x0
 02650   896   NtProtectVirtualMemory  (-1, (0x3d0e000), 4096, 260, ... (0x3d0e000), 4096, 4, ) == 0x0
 02651   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ... 560, {1252, 724}, ) == 0x0
 02652   896   NtQueryInformationThread  (560, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ff7f000,Pid=1252,Tid=724,}, 0x0, ) == 0x0
 02653  1256   NtProtectVirtualMemory  (-1, (0x76fb1000), 232, 4, ...
 02654  1436   NtWaitForSingleObject  (128, 0, 0x0, ...
 02653  1256   NtProtectVirtualMemory  ... (0x76fb1000), 4096, 32, ) == 0x0
 02655  1256   NtProtectVirtualMemory  (-1, (0x76fb1000), 4096, 32, ... (0x76fb1000), 4096, 4, ) == 0x0
 02656  1256   NtFlushInstructionCache  (-1, 1996165120, 232, ... ) == 0x0
 02657   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81953, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81953, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG0\2\0\0\344\4\0\0\324\2\0\0" ... {28, 56, reply, 0, 1252, 896, 81954, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG0\2\0\0\344\4\0\0\324\2\0\0" )  ... {28, 56, reply, 0, 1252, 896, 81954, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81953, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG0\2\0\0\344\4\0\0\324\2\0\0" ... {28, 56, reply, 0, 1252, 896, 81954, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG0\2\0\0\344\4\0\0\324\2\0\0" )  ) == 0x0
 02658   896   NtResumeThread  (560, ... 1, ) == 0x0
 02659   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ...
 02660  1256   NtOpenKey  (0x80000000, {24, 0, 0x40, 0, 0,  (0x80000000, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\WLDAP32.dll"}, ... }, ...
 02661   724   NtWaitForSingleObject  (128, 0, 0x0, ...
 02660  1256   NtOpenKey  ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02662  1256   NtCreateEvent  (0x1f0003, 0x0, 1, 0, ... 564, ) == 0x0
 02663  1256   NtOpenKey  (0x20019, {24, 40, 0x40, 0, 0,  (0x20019, {24, 40, 0x40, 0, 0, "System\CurrentControlSet\Services\LDAP"}, ... 568, ) }, ... 568, ) == 0x0
 02664  1256   NtQueryValueKey  (568,  (568, "LdapClientIntegrity", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (568, "LdapClientIntegrity", Partial, 144, ... TitleIdx=0, Type=4, Data="\1\0\0\0"}, 16, ) }, 16, ) == 0x0
 02665  1256   NtClose  (568, ... ) == 0x0
 02659   896   NtAllocateVirtualMemory  ... 64028672, 1048576, ) == 0x0
 02666   896   NtAllocateVirtualMemory  (-1, 65069056, 0, 8192, 4096, 4, ... 65069056, 8192, ) == 0x0
 02667   896   NtProtectVirtualMemory  (-1, (0x3e0e000), 4096, 260, ... (0x3e0e000), 4096, 4, ) == 0x0
 02668   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ... 568, {1252, 220}, ) == 0x0
 02669   896   NtQueryInformationThread  (568, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ff7e000,Pid=1252,Tid=220,}, 0x0, ) == 0x0
 02670   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81954, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81954, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG8\2\0\0\344\4\0\0\334\0\0\0" ... {28, 56, reply, 0, 1252, 896, 81955, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG8\2\0\0\344\4\0\0\334\0\0\0" )  ... {28, 56, reply, 0, 1252, 896, 81955, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81954, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG8\2\0\0\344\4\0\0\334\0\0\0" ... {28, 56, reply, 0, 1252, 896, 81955, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG8\2\0\0\344\4\0\0\334\0\0\0" )  ) == 0x0
 02671  1256   NtOpenKey  (0x80000000, {24, 0, 0x40, 0, 0,  (0x80000000, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\winrnr.dll"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02672  1256   NtQueryPerformanceCounter  (... {-1445665004, 16}, {3579545, 0}, ) == 0x0
 02673  1256   NtSetEventBoostPriority  (128, ...
 02573   440   NtWaitForSingleObject  ... ) == 0x0
 02674   440   NtSetEventBoostPriority  (128, ...
 02593  2044   NtWaitForSingleObject  ... ) == 0x0
 02675  2044   NtSetEventBoostPriority  (128, ...
 02615  1652   NtWaitForSingleObject  ... ) == 0x0
 02676  1652   NtSetEventBoostPriority  (128, ...
 02628  1376   NtWaitForSingleObject  ... ) == 0x0
 02677  1376   NtSetEventBoostPriority  (128, ...
 02654  1436   NtWaitForSingleObject  ... ) == 0x0
 02678  1436   NtSetEventBoostPriority  (128, ...
 02661   724   NtWaitForSingleObject  ... ) == 0x0
 02679   724   NtAllocateVirtualMemory  (-1, 3629056, 0, 4096, 4096, 4, ... 3629056, 4096, ) == 0x0
 02678  1436   NtSetEventBoostPriority  ... ) == 0x0
 02677  1376   NtSetEventBoostPriority  ... ) == 0x0
 02676  1652   NtSetEventBoostPriority  ... ) == 0x0
 02675  2044   NtSetEventBoostPriority  ... ) == 0x0
 02674   440   NtSetEventBoostPriority  ... ) == 0x0
 02673  1256   NtSetEventBoostPriority  ... ) == 0x0
 02680   896   NtResumeThread  (568, ...
 02681   724   NtTestAlert  (...
 02682  1436   NtTestAlert  (...
 02683  1376   NtTestAlert  (...
 02684  1652   NtTestAlert  (...
 02685  2044   NtTestAlert  (...
 02686   440   NtTestAlert  (...
 02680   896   NtResumeThread  ... 1, ) == 0x0
 02681   724   NtTestAlert  ... ) == 0x0
 02682  1436   NtTestAlert  ... ) == 0x0
 02683  1376   NtTestAlert  ... ) == 0x0
 02684  1652   NtTestAlert  ... ) == 0x0
 02685  2044   NtTestAlert  ... ) == 0x0
 02686   440   NtTestAlert  ... ) == 0x0
 02687   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ...
 02688   724   NtContinue  (64027952, 1, ...
 02689  1436   NtContinue  (62979376, 1, ...
 02690  1376   NtContinue  (61930800, 1, ...
 02691  1652   NtContinue  (60882224, 1, ...
 02692  2044   NtContinue  (59833648, 1, ...
 02693   440   NtContinue  (58785072, 1, ...
 02687   896   NtAllocateVirtualMemory  ... 65077248, 1048576, ) == 0x0
 02694   724   NtRegisterThreadTerminatePort  (24, ...
 02695  1436   NtRegisterThreadTerminatePort  (24, ...
 02696  1376   NtRegisterThreadTerminatePort  (24, ...
 02697  1652   NtRegisterThreadTerminatePort  (24, ...
 02698  2044   NtRegisterThreadTerminatePort  (24, ...
 02699   440   NtRegisterThreadTerminatePort  (24, ...
 02700   896   NtAllocateVirtualMemory  (-1, 66117632, 0, 8192, 4096, 4, ...
 02694   724   NtRegisterThreadTerminatePort  ... ) == 0x0
 02695  1436   NtRegisterThreadTerminatePort  ... ) == 0x0
 02696  1376   NtRegisterThreadTerminatePort  ... ) == 0x0
 02697  1652   NtRegisterThreadTerminatePort  ... ) == 0x0
 02698  2044   NtRegisterThreadTerminatePort  ... ) == 0x0
 02699   440   NtRegisterThreadTerminatePort  ... ) == 0x0
 02700   896   NtAllocateVirtualMemory  ... 66117632, 8192, ) == 0x0
 02701   724   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 02702  1436   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 02703  1376   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 02704  1652   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 02705  2044   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 02706   440   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 02707  1256   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\System32\mswsock.dll"}, 15789008, ... }, 15789008, ...
 02708   220   NtWaitForSingleObject  (128, 0, 0x0, ...
 02709   896   NtProtectVirtualMemory  (-1, (0x3f0e000), 4096, 260, ...
 02701   724   NtDuplicateObject  ... 572, ) == 0x0
 02702  1436   NtDuplicateObject  ... 576, ) == 0x0
 02703  1376   NtDuplicateObject  ... 580, ) == 0x0
 02704  1652   NtDuplicateObject  ... 584, ) == 0x0
 02705  2044   NtDuplicateObject  ... 588, ) == 0x0
 02707  1256   NtQueryAttributesFile  ... ) == 0x0
 02709   896   NtProtectVirtualMemory  ... (0x3f0e000), 4096, 4, ) == 0x0
 02710   724   NtWaitForSingleObject  (104, 0, {0, 0}, ...
 02711  1436   NtWaitForSingleObject  (104, 0, {0, 0}, ...
 02712  1376   NtWaitForSingleObject  (104, 0, {0, 0}, ...
 02713  1652   NtWaitForSingleObject  (104, 0, {0, 0}, ...
 02714  2044   NtWaitForSingleObject  (104, 0, {0, 0}, ...
 02715  1256   NtSetEventBoostPriority  (128, ...
 02716   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ...
 02710   724   NtWaitForSingleObject  ... ) == 0x102
 02711  1436   NtWaitForSingleObject  ... ) == 0x102
 02712  1376   NtWaitForSingleObject  ... ) == 0x102
 02713  1652   NtWaitForSingleObject  ... ) == 0x102
 02714  2044   NtWaitForSingleObject  ... ) == 0x102
 02708   220   NtWaitForSingleObject  ... ) == 0x0
 02715  1256   NtSetEventBoostPriority  ... ) == 0x0
 02716   896   NtCreateThread  ... 592, {1252, 1228}, ) == 0x0
 02717   724   NtWaitForSingleObject  (160, 0, 0x0, ...
 02718  1436   NtWaitForSingleObject  (160, 0, 0x0, ...
 02719  1376   NtWaitForSingleObject  (160, 0, 0x0, ...
 02720  1652   NtWaitForSingleObject  (160, 0, 0x0, ...
 02721   220   NtTestAlert  (...
 02722  2044   NtWaitForSingleObject  (160, 0, 0x0, ...
 02723  1256   NtQuerySystemInformation  (Basic, 44, ...
 02724   896   NtQueryInformationThread  (592, Basic, 28, ...
 02721   220   NtTestAlert  ... ) == 0x0
 02723  1256   NtQuerySystemInformation  ... {Unknown=0,MaximumIncrement=156250,PhysicalPageSize=0x1000,NumberOfPhysicalPages=0xff7c,LowestPhysicalPage=0x1,HighestPhysicalPage=0xffff,AllocationGranularity=0x10000,LowestUserAddress=0x10000,HighestUserAddress=0x7ffeffff,ActiveProcessors=1,NumberProcessors=1,}, 0x0, ) == 0x0
 02724   896   NtQueryInformationThread  ... {ExitStatus=0x103,TebBaseAddress=0x7ff7d000,Pid=1252,Tid=1228,}, 0x0, ) == 0x0
 02706   440   NtDuplicateObject  ... 596, ) == 0x0
 02725   220   NtContinue  (65076528, 1, ...
 02726  1256   NtAllocateVirtualMemory  (-1, 0, 0, 65536, 8192, 4, ...
 02727   440   NtWaitForSingleObject  (104, 0, {0, 0}, ...
 02728   220   NtRegisterThreadTerminatePort  (24, ...
 02726  1256   NtAllocateVirtualMemory  ... 3538944, 65536, ) == 0x0
 02727   440   NtWaitForSingleObject  ... ) == 0x102
 02728   220   NtRegisterThreadTerminatePort  ... ) == 0x0
 02729  1256   NtAllocateVirtualMemory  (-1, 3538944, 0, 4096, 4096, 4, ...
 02730   440   NtWaitForSingleObject  (160, 0, 0x0, ...
 02731   220   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 02729  1256   NtAllocateVirtualMemory  ... 3538944, 4096, ) == 0x0
 02731   220   NtDuplicateObject  ... 600, ) == 0x0
 02732  1256   NtAllocateVirtualMemory  (-1, 3543040, 0, 8192, 4096, 4, ...
 02733   220   NtWaitForSingleObject  (104, 0, {0, 0}, ...
 02732  1256   NtAllocateVirtualMemory  ... 3543040, 8192, ) == 0x0
 02734   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81955, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81955, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFGP\2\0\0\344\4\0\0\314\4\0\0" ...  ...
 02733   220   NtWaitForSingleObject  ... ) == 0x102
 02734   896   NtRequestWaitReplyPort  ... {28, 56, reply, 0, 1252, 896, 81956, 0}  ... {28, 56, reply, 0, 1252, 896, 81956, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFGP\2\0\0\344\4\0\0\314\4\0\0" )  ) == 0x0
 02735   220   NtWaitForSingleObject  (160, 0, 0x0, ...
 02736   896   NtResumeThread  (592, ... 1, ) == 0x0
 02737   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ... 66125824, 1048576, ) == 0x0
 02738   896   NtAllocateVirtualMemory  (-1, 67166208, 0, 8192, 4096, 4, ... 67166208, 8192, ) == 0x0
 02739   896   NtProtectVirtualMemory  (-1, (0x400e000), 4096, 260, ... (0x400e000), 4096, 4, ) == 0x0
 02740   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ...
 02741  1256   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\wshbth.dll"}, 15789008, ... }, 15789008, ...
 02742  1228   NtWaitForSingleObject  (128, 0, 0x0, ...
 02741  1256   NtQueryAttributesFile  ... ) == 0x0
 02743  1256   NtOpenFile  (0x100020, {24, 0, 0x40, 0, 0,  (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\wshbth.dll"}, 5, 96, ... 604, {status=0x0, info=1}, ) }, 5, 96, ... 604, {status=0x0, info=1}, ) == 0x0
 02744  1256   NtCreateSection  (0xe, 0x0, 0x0, 16, 134217728, 604, ... 608, ) == 0x0
 02745  1256   NtClose  (604, ... ) == 0x0
 02746  1256   NtMapViewOfSection  (608, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 16, ... (0x390000), 0x0, 110592, ) == 0x0
 02747  1256   NtClose  (608, ... ) == 0x0
 02740   896   NtCreateThread  ... 608, {1252, 1484}, ) == 0x0
 02748   896   NtQueryInformationThread  (608, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ff7c000,Pid=1252,Tid=1484,}, 0x0, ) == 0x0
 02749   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81956, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81956, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG`\2\0\0\344\4\0\0\314\5\0\0" ... {28, 56, reply, 0, 1252, 896, 81957, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG`\2\0\0\344\4\0\0\314\5\0\0" )  ... {28, 56, reply, 0, 1252, 896, 81957, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81956, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG`\2\0\0\344\4\0\0\314\5\0\0" ... {28, 56, reply, 0, 1252, 896, 81957, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG`\2\0\0\344\4\0\0\314\5\0\0" )  ) == 0x0
 02750   896   NtResumeThread  (608, ... 1, ) == 0x0
 02751   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ... 67174400, 1048576, ) == 0x0
 02752   896   NtAllocateVirtualMemory  (-1, 68214784, 0, 8192, 4096, 4, ... 68214784, 8192, ) == 0x0
 02753  1256   NtUnmapViewOfSection  (-1, 0x390000, ...
 02754  1484   NtWaitForSingleObject  (128, 0, 0x0, ...
 02753  1256   NtUnmapViewOfSection  ... ) == 0x0
 02755  1256   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\wshbth.dll"}, 15789316, ... ) }, 15789316, ... ) == 0x0
 02756  1256   NtOpenFile  (0x100020, {24, 0, 0x40, 0, 0,  (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\wshbth.dll"}, 5, 96, ... 604, {status=0x0, info=1}, ) }, 5, 96, ... 604, {status=0x0, info=1}, ) == 0x0
 02757  1256   NtCreateSection  (0xf, 0x0, 0x0, 16, 16777216, 604, ... 612, ) == 0x0
 02758  1256   NtQuerySection  (612, Image, 48, ... {section info, class 1, size 48}, 0x0, ) == 0x0
 02759  1256   NtClose  (604, ... ) == 0x0
 02760   896   NtProtectVirtualMemory  (-1, (0x410e000), 4096, 260, ... (0x410e000), 4096, 4, ) == 0x0
 02761   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ... 604, {1252, 1120}, ) == 0x0
 02762   896   NtQueryInformationThread  (604, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ff7b000,Pid=1252,Tid=1120,}, 0x0, ) == 0x0
 02763   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81957, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81957, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\\2\0\0\344\4\0\0`\4\0\0" ... {28, 56, reply, 0, 1252, 896, 81958, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\\2\0\0\344\4\0\0`\4\0\0" )  ... {28, 56, reply, 0, 1252, 896, 81958, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81957, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\\2\0\0\344\4\0\0`\4\0\0" ... {28, 56, reply, 0, 1252, 896, 81958, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\\2\0\0\344\4\0\0`\4\0\0" )  ) == 0x0
 02764   896   NtResumeThread  (604, ... 1, ) == 0x0
 02765   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ...
 02766  1256   NtMapViewOfSection  (612, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ...
 02767  1120   NtWaitForSingleObject  (128, 0, 0x0, ...
 02766  1256   NtMapViewOfSection  ... (0x751d0000), 0x0, 122880, ) == 0x0
 02768  1256   NtClose  (612, ... ) == 0x0
 02769  1256   NtProtectVirtualMemory  (-1, (0x751d1000), 224, 4, ... (0x751d1000), 4096, 32, ) == 0x0
 02770  1256   NtProtectVirtualMemory  (-1, (0x751d1000), 4096, 32, ... (0x751d1000), 4096, 4, ) == 0x0
 02771  1256   NtFlushInstructionCache  (-1, 1964838912, 224, ... ) == 0x0
 02772  1256   NtProtectVirtualMemory  (-1, (0x751d1000), 224, 4, ... (0x751d1000), 4096, 32, ) == 0x0
 02765   896   NtAllocateVirtualMemory  ... 68222976, 1048576, ) == 0x0
 02773   896   NtAllocateVirtualMemory  (-1, 69263360, 0, 8192, 4096, 4, ... 69263360, 8192, ) == 0x0
 02774   896   NtProtectVirtualMemory  (-1, (0x420e000), 4096, 260, ... (0x420e000), 4096, 4, ) == 0x0
 02775   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ... 612, {1252, 840}, ) == 0x0
 02776   896   NtQueryInformationThread  (612, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ff7a000,Pid=1252,Tid=840,}, 0x0, ) == 0x0
 02777   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81958, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81958, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFGd\2\0\0\344\4\0\0H\3\0\0" ... {28, 56, reply, 0, 1252, 896, 81959, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFGd\2\0\0\344\4\0\0H\3\0\0" )  ... {28, 56, reply, 0, 1252, 896, 81959, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81958, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFGd\2\0\0\344\4\0\0H\3\0\0" ... {28, 56, reply, 0, 1252, 896, 81959, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFGd\2\0\0\344\4\0\0H\3\0\0" )  ) == 0x0
 02778  1256   NtProtectVirtualMemory  (-1, (0x751d1000), 4096, 32, ... (0x751d1000), 4096, 4, ) == 0x0
 02779  1256   NtFlushInstructionCache  (-1, 1964838912, 224, ... ) == 0x0
 02780  1256   NtOpenSection  (0xe, {24, 8, 0x40, 0, 0,  (0xe, {24, 8, 0x40, 0, 0, "SETUPAPI.dll"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02781  1256   NtAllocateVirtualMemory  (-1, 1404928, 0, 4096, 4096, 4, ... 1404928, 4096, ) == 0x0
 02782  1256   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\u:\work\SETUPAPI.dll"}, 15788492, ... }, 15788492, ...
 02783   896   NtResumeThread  (612, ... 1, ) == 0x0
 02784   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ... 69271552, 1048576, ) == 0x0
 02785   896   NtAllocateVirtualMemory  (-1, 70311936, 0, 8192, 4096, 4, ... 70311936, 8192, ) == 0x0
 02786   840   NtWaitForSingleObject  (128, 0, 0x0, ...
 02787   896   NtProtectVirtualMemory  (-1, (0x430e000), 4096, 260, ... (0x430e000), 4096, 4, ) == 0x0
 02788   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ... 616, {1252, 1104}, ) == 0x0
 02789   896   NtQueryInformationThread  (616, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ff79000,Pid=1252,Tid=1104,}, 0x0, ) == 0x0
 02790   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81959, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81959, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFGh\2\0\0\344\4\0\0P\4\0\0" ... {28, 56, reply, 0, 1252, 896, 81960, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFGh\2\0\0\344\4\0\0P\4\0\0" )  ... {28, 56, reply, 0, 1252, 896, 81960, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81959, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFGh\2\0\0\344\4\0\0P\4\0\0" ... {28, 56, reply, 0, 1252, 896, 81960, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFGh\2\0\0\344\4\0\0P\4\0\0" )  ) == 0x0
 02791   896   NtResumeThread  (616, ... 1, ) == 0x0
 02792   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ...
 02793  1104   NtWaitForSingleObject  (128, 0, 0x0, ...
 02792   896   NtAllocateVirtualMemory  ... 70320128, 1048576, ) == 0x0
 02794   896   NtAllocateVirtualMemory  (-1, 71360512, 0, 8192, 4096, 4, ... 71360512, 8192, ) == 0x0
 02795   896   NtProtectVirtualMemory  (-1, (0x440e000), 4096, 260, ... (0x440e000), 4096, 4, ) == 0x0
 02796   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ... 620, {1252, 860}, ) == 0x0
 02797   896   NtQueryInformationThread  (620, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ff78000,Pid=1252,Tid=860,}, 0x0, ) == 0x0
 02798   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81960, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81960, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFGl\2\0\0\344\4\0\0\\3\0\0" ... {28, 56, reply, 0, 1252, 896, 81961, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFGl\2\0\0\344\4\0\0\\3\0\0" )  ... {28, 56, reply, 0, 1252, 896, 81961, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81960, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFGl\2\0\0\344\4\0\0\\3\0\0" ... {28, 56, reply, 0, 1252, 896, 81961, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFGl\2\0\0\344\4\0\0\\3\0\0" )  ) == 0x0
 02782  1256   NtQueryAttributesFile  ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02799  1256   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\SETUPAPI.dll"}, 15788492, ... ) }, 15788492, ... ) == 0x0
 02800  1256   NtOpenFile  (0x100020, {24, 0, 0x40, 0, 0,  (0x100020, {24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\system32\SETUPAPI.dll"}, 5, 96, ... 624, {status=0x0, info=1}, ) }, 5, 96, ... 624, {status=0x0, info=1}, ) == 0x0
 02801  1256   NtCreateSection  (0xf, 0x0, 0x0, 16, 16777216, 624, ... 628, ) == 0x0
 02802  1256   NtQuerySection  (628, Image, 48, ... {section info, class 1, size 48}, 0x0, ) == 0x0
 02803  1256   NtClose  (624, ...
 02804   896   NtResumeThread  (620, ... 1, ) == 0x0
 02805   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ... 71368704, 1048576, ) == 0x0
 02806   896   NtAllocateVirtualMemory  (-1, 72409088, 0, 8192, 4096, 4, ... 72409088, 8192, ) == 0x0
 02807   896   NtProtectVirtualMemory  (-1, (0x450e000), 4096, 260, ... (0x450e000), 4096, 4, ) == 0x0
 02808   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ... 632, {1252, 780}, ) == 0x0
 02809   896   NtQueryInformationThread  (632, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ff77000,Pid=1252,Tid=780,}, 0x0, ) == 0x0
 02803  1256   NtClose  ... ) == 0x0
 02810   860   NtWaitForSingleObject  (128, 0, 0x0, ...
 02811  1256   NtMapViewOfSection  (628, -1, (0x0), 0, 0, 0x0, 0, 1, 0, 4, ... (0x77920000), 0x0, 995328, ) == 0x0
 02812  1256   NtClose  (628, ... ) == 0x0
 02813  1256   NtProtectVirtualMemory  (-1, (0x77921000), 1368, 4, ... (0x77921000), 4096, 32, ) == 0x0
 02814   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81961, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81961, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFGx\2\0\0\344\4\0\0\14\3\0\0" ... {28, 56, reply, 0, 1252, 896, 81962, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFGx\2\0\0\344\4\0\0\14\3\0\0" )  ... {28, 56, reply, 0, 1252, 896, 81962, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81961, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFGx\2\0\0\344\4\0\0\14\3\0\0" ... {28, 56, reply, 0, 1252, 896, 81962, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFGx\2\0\0\344\4\0\0\14\3\0\0" )  ) == 0x0
 02815   896   NtResumeThread  (632, ... 1, ) == 0x0
 02816   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ...
 02817  1256   NtProtectVirtualMemory  (-1, (0x77921000), 4096, 32, ...
 02818   780   NtWaitForSingleObject  (128, 0, 0x0, ...
 02817  1256   NtProtectVirtualMemory  ... (0x77921000), 4096, 4, ) == 0x0
 02819  1256   NtFlushInstructionCache  (-1, 2006061056, 1368, ... ) == 0x0
 02820  1256   NtProtectVirtualMemory  (-1, (0x77921000), 1368, 4, ... (0x77921000), 4096, 32, ) == 0x0
 02821  1256   NtProtectVirtualMemory  (-1, (0x77921000), 4096, 32, ... (0x77921000), 4096, 4, ) == 0x0
 02822  1256   NtFlushInstructionCache  (-1, 2006061056, 1368, ...
 02816   896   NtAllocateVirtualMemory  ... 72417280, 1048576, ) == 0x0
 02823   896   NtAllocateVirtualMemory  (-1, 73457664, 0, 8192, 4096, 4, ... 73457664, 8192, ) == 0x0
 02824   896   NtProtectVirtualMemory  (-1, (0x460e000), 4096, 260, ... (0x460e000), 4096, 4, ) == 0x0
 02825   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ... 628, {1252, 940}, ) == 0x0
 02826   896   NtQueryInformationThread  (628, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ff76000,Pid=1252,Tid=940,}, 0x0, ) == 0x0
 02827   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81962, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81962, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFGt\2\0\0\344\4\0\0\254\3\0\0" ... {28, 56, reply, 0, 1252, 896, 81963, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFGt\2\0\0\344\4\0\0\254\3\0\0" )  ... {28, 56, reply, 0, 1252, 896, 81963, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81962, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFGt\2\0\0\344\4\0\0\254\3\0\0" ... {28, 56, reply, 0, 1252, 896, 81963, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFGt\2\0\0\344\4\0\0\254\3\0\0" )  ) == 0x0
 02822  1256   NtFlushInstructionCache  ... ) == 0x0
 02828  1256   NtProtectVirtualMemory  (-1, (0x77921000), 1368, 4, ... (0x77921000), 4096, 32, ) == 0x0
 02829  1256   NtProtectVirtualMemory  (-1, (0x77921000), 4096, 32, ... (0x77921000), 4096, 4, ) == 0x0
 02830  1256   NtFlushInstructionCache  (-1, 2006061056, 1368, ... ) == 0x0
 02831  1256   NtProtectVirtualMemory  (-1, (0x77921000), 1368, 4, ... (0x77921000), 4096, 32, ) == 0x0
 02832  1256   NtProtectVirtualMemory  (-1, (0x77921000), 4096, 32, ... (0x77921000), 4096, 4, ) == 0x0
 02833  1256   NtFlushInstructionCache  (-1, 2006061056, 1368, ...
 02834   896   NtResumeThread  (628, ... 1, ) == 0x0
 02835   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ... 73465856, 1048576, ) == 0x0
 02836   896   NtAllocateVirtualMemory  (-1, 74506240, 0, 8192, 4096, 4, ... 74506240, 8192, ) == 0x0
 02837   896   NtProtectVirtualMemory  (-1, (0x470e000), 4096, 260, ... (0x470e000), 4096, 4, ) == 0x0
 02838   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ... 624, {1252, 1268}, ) == 0x0
 02839   896   NtQueryInformationThread  (624, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ff75000,Pid=1252,Tid=1268,}, 0x0, ) == 0x0
 02833  1256   NtFlushInstructionCache  ... ) == 0x0
 02840   940   NtWaitForSingleObject  (128, 0, 0x0, ...
 02841  1256   NtProtectVirtualMemory  (-1, (0x77921000), 1368, 4, ... (0x77921000), 4096, 32, ) == 0x0
 02842  1256   NtProtectVirtualMemory  (-1, (0x77921000), 4096, 32, ... (0x77921000), 4096, 4, ) == 0x0
 02843  1256   NtFlushInstructionCache  (-1, 2006061056, 1368, ... ) == 0x0
 02844  1256   NtProtectVirtualMemory  (-1, (0x751d1000), 224, 4, ... (0x751d1000), 4096, 32, ) == 0x0
 02845  1256   NtProtectVirtualMemory  (-1, (0x751d1000), 4096, 32, ... (0x751d1000), 4096, 4, ) == 0x0
 02846  1256   NtFlushInstructionCache  (-1, 1964838912, 224, ...
 02847   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81963, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81963, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFGp\2\0\0\344\4\0\0\364\4\0\0" ... {28, 56, reply, 0, 1252, 896, 81964, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFGp\2\0\0\344\4\0\0\364\4\0\0" )  ... {28, 56, reply, 0, 1252, 896, 81964, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81963, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFGp\2\0\0\344\4\0\0\364\4\0\0" ... {28, 56, reply, 0, 1252, 896, 81964, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFGp\2\0\0\344\4\0\0\364\4\0\0" )  ) == 0x0
 02848   896   NtResumeThread  (624, ... 1, ) == 0x0
 02849   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ... 74514432, 1048576, ) == 0x0
 02850   896   NtAllocateVirtualMemory  (-1, 75554816, 0, 8192, 4096, 4, ... 75554816, 8192, ) == 0x0
 02851   896   NtProtectVirtualMemory  (-1, (0x480e000), 4096, 260, ... (0x480e000), 4096, 4, ) == 0x0
 02852   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ...
 02846  1256   NtFlushInstructionCache  ... ) == 0x0
 02853  1268   NtWaitForSingleObject  (128, 0, 0x0, ...
 02854  1256   NtOpenKey  (0x80000000, {24, 0, 0x40, 0, 0,  (0x80000000, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SETUPAPI.dll"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02855  1256   NtQueryDefaultUILanguage  (2090319928, ...
 02856  1256   NtOpenThreadTokenEx  (-2, 0x20008, 1, 512, ... ) == STATUS_NO_TOKEN
 02857  1256   NtOpenProcessTokenEx  (-1, 0x20008, 512, ... -2147481484, ) == 0x0
 02858  1256   NtQueryInformationToken  (-2147481484, User, 80, ... {token info, class 1, size 36}, 36, ) == 0x0
 02852   896   NtCreateThread  ... 636, {1252, 1736}, ) == 0x0
 02859   896   NtQueryInformationThread  (636, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ff74000,Pid=1252,Tid=1736,}, 0x0, ) == 0x0
 02860   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81964, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81964, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG|\2\0\0\344\4\0\0\310\6\0\0" ... {28, 56, reply, 0, 1252, 896, 81965, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG|\2\0\0\344\4\0\0\310\6\0\0" )  ... {28, 56, reply, 0, 1252, 896, 81965, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81964, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG|\2\0\0\344\4\0\0\310\6\0\0" ... {28, 56, reply, 0, 1252, 896, 81965, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG|\2\0\0\344\4\0\0\310\6\0\0" )  ) == 0x0
 02861   896   NtResumeThread  (636, ... 1, ) == 0x0
 02862   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ... 75563008, 1048576, ) == 0x0
 02863   896   NtAllocateVirtualMemory  (-1, 76603392, 0, 8192, 4096, 4, ... 76603392, 8192, ) == 0x0
 02864  1256   NtClose  (-2147481484, ...
 02865  1736   NtWaitForSingleObject  (128, 0, 0x0, ...
 02864  1256   NtClose  ... ) == 0x0
 02866  1256   NtOpenKey  (0x2000000, {24, 0, 0x640, 0, 0,  (0x2000000, {24, 0, 0x640, 0, 0, "\REGISTRY\USER\S-1-5-21-1292428093-1383384898-725345543-1003"}, ... -2147481484, ) }, ... -2147481484, ) == 0x0
 02867  1256   NtOpenKey  (0x80000000, {24, -2147481484, 0x240, 0, 0,  (0x80000000, {24, -2147481484, 0x240, 0, 0, "Software\Policies\Microsoft\Control Panel\Desktop"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02868  1256   NtOpenKey  (0x80000000, {24, -2147481484, 0x640, 0, 0,  (0x80000000, {24, -2147481484, 0x640, 0, 0, "Control Panel\Desktop"}, ... -2147482104, ) }, ... -2147482104, ) == 0x0
 02869  1256   NtQueryValueKey  (-2147482104,  (-2147482104, "MultiUILanguageId", Partial, 256, ... ) , Partial, 256, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02870  1256   NtClose  (-2147482104, ... ) == 0x0
 02871   896   NtProtectVirtualMemory  (-1, (0x490e000), 4096, 260, ... (0x490e000), 4096, 4, ) == 0x0
 02872   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ... 640, {1252, 1332}, ) == 0x0
 02873   896   NtQueryInformationThread  (640, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ff73000,Pid=1252,Tid=1332,}, 0x0, ) == 0x0
 02874   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81965, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81965, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\200\2\0\0\344\4\0\04\5\0\0" ... {28, 56, reply, 0, 1252, 896, 81966, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\200\2\0\0\344\4\0\04\5\0\0" )  ... {28, 56, reply, 0, 1252, 896, 81966, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81965, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\200\2\0\0\344\4\0\04\5\0\0" ... {28, 56, reply, 0, 1252, 896, 81966, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\200\2\0\0\344\4\0\04\5\0\0" )  ) == 0x0
 02875   896   NtResumeThread  (640, ... 1, ) == 0x0
 02876   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ...
 02877  1256   NtClose  (-2147481484, ...
 02878  1332   NtWaitForSingleObject  (128, 0, 0x0, ...
 02877  1256   NtClose  ... ) == 0x0
 02855  1256   NtQueryDefaultUILanguage  ... ) == 0x0
 02879  1256   NtAllocateVirtualMemory  (-1, 15777792, 0, 4096, 4096, 260, ... 15777792, 4096, ) == 0x0
 02880  1256   NtQueryInstallUILanguage  (2090319930, ... ) == 0x0
 02881  1256   NtQueryDefaultLocale  (1, 15789212, ... ) == 0x0
 02882  1256   NtQueryInformationProcess  (-1, Wow64, 4, ... {process info, class 26, size 4}, 0x0, ) == 0x0
 02883  1256   NtOpenKey  (0x20019, {24, 40, 0x40, 0, 0,  (0x20019, {24, 40, 0x40, 0, 0, "System\Setup"}, ... }, ...
 02876   896   NtAllocateVirtualMemory  ... 76611584, 1048576, ) == 0x0
 02884   896   NtAllocateVirtualMemory  (-1, 77651968, 0, 8192, 4096, 4, ... 77651968, 8192, ) == 0x0
 02885   896   NtProtectVirtualMemory  (-1, (0x4a0e000), 4096, 260, ... (0x4a0e000), 4096, 4, ) == 0x0
 02886   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ... 644, {1252, 1336}, ) == 0x0
 02887   896   NtQueryInformationThread  (644, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ff72000,Pid=1252,Tid=1336,}, 0x0, ) == 0x0
 02888   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81966, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81966, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\204\2\0\0\344\4\0\08\5\0\0" ... {28, 56, reply, 0, 1252, 896, 81967, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\204\2\0\0\344\4\0\08\5\0\0" )  ... {28, 56, reply, 0, 1252, 896, 81967, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81966, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\204\2\0\0\344\4\0\08\5\0\0" ... {28, 56, reply, 0, 1252, 896, 81967, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\204\2\0\0\344\4\0\08\5\0\0" )  ) == 0x0
 02883  1256   NtOpenKey  ... 648, ) == 0x0
 02889  1256   NtQueryValueKey  (648,  (648, "SystemSetupInProgress", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (648, "SystemSetupInProgress", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) }, 16, ) == 0x0
 02890  1256   NtClose  (648, ... ) == 0x0
 02891  1256   NtCreateEvent  (0x1f0003, 0x0, 1, 0, ... 648, ) == 0x0
 02892  1256   NtCallbackReturn  (0, 0, 0, ...
 02893  1256   NtUserGetProcessWindowStation  (...
 02894   896   NtResumeThread  (644, ... 1, ) == 0x0
 02895   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ... 77660160, 1048576, ) == 0x0
 02896   896   NtAllocateVirtualMemory  (-1, 78700544, 0, 8192, 4096, 4, ... 78700544, 8192, ) == 0x0
 02897   896   NtProtectVirtualMemory  (-1, (0x4b0e000), 4096, 260, ... (0x4b0e000), 4096, 4, ) == 0x0
 02898   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ... 652, {1252, 468}, ) == 0x0
 02899   896   NtQueryInformationThread  (652, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ff71000,Pid=1252,Tid=468,}, 0x0, ) == 0x0
 02893  1256   NtUserGetProcessWindowStation  ... ) == 0x1c
 02900  1336   NtWaitForSingleObject  (128, 0, 0x0, ...
 02901  1256   NtUserGetObjectInformation  (28, 1, 15788808, 12, 15788820, ... ) == 0x1
 02902  1256   NtOpenKey  (0xf003f, {24, 40, 0x40, 0, 0,  (0xf003f, {24, 40, 0x40, 0, 0, "SYSTEM\CurrentControlSet\Control\MiniNT"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02903  1256   NtOpenKey  (0x20019, {24, 40, 0x40, 0, 0,  (0x20019, {24, 40, 0x40, 0, 0, "System\WPA\PnP"}, ... 656, ) }, ... 656, ) == 0x0
 02904  1256   NtQueryValueKey  (656,  (656, "seed", Partial, 144, ... TitleIdx=0, Type=4, Data="\240d\351\211"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (656, "seed", Partial, 144, ... TitleIdx=0, Type=4, Data="\240d\351\211"}, 16, ) }, 16, ) == 0x0
 02905  1256   NtClose  (656, ... ) == 0x0
 02906  1256   NtOpenKey  (0x20019, {24, 40, 0x40, 0, 0,  (0x20019, {24, 40, 0x40, 0, 0, "SYSTEM\Setup"}, ... }, ...
 02907   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81967, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81967, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\214\2\0\0\344\4\0\0\324\1\0\0" ... {28, 56, reply, 0, 1252, 896, 81968, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\214\2\0\0\344\4\0\0\324\1\0\0" )  ... {28, 56, reply, 0, 1252, 896, 81968, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81967, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\214\2\0\0\344\4\0\0\324\1\0\0" ... {28, 56, reply, 0, 1252, 896, 81968, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\214\2\0\0\344\4\0\0\324\1\0\0" )  ) == 0x0
 02908   896   NtResumeThread  (652, ... 1, ) == 0x0
 02909   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ... 78708736, 1048576, ) == 0x0
 02910   896   NtAllocateVirtualMemory  (-1, 79749120, 0, 8192, 4096, 4, ... 79749120, 8192, ) == 0x0
 02911   896   NtProtectVirtualMemory  (-1, (0x4c0e000), 4096, 260, ... (0x4c0e000), 4096, 4, ) == 0x0
 02912   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ...
 02906  1256   NtOpenKey  ... 656, ) == 0x0
 02913   468   NtWaitForSingleObject  (128, 0, 0x0, ...
 02914  1256   NtQueryValueKey  (656,  (656, "OsLoaderPath", Partial, 144, ... TitleIdx=0, Type=1, Data="\\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (656, "OsLoaderPath", Partial, 144, ... TitleIdx=0, Type=1, Data="\\0\0\0"}, 16, ) }, 16, ) == 0x0
 02915  1256   NtQueryValueKey  (656,  (656, "OsLoaderPath", Partial, 144, ... TitleIdx=0, Type=1, Data="\\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (656, "OsLoaderPath", Partial, 144, ... TitleIdx=0, Type=1, Data="\\0\0\0"}, 16, ) }, 16, ) == 0x0
 02916  1256   NtClose  (656, ... ) == 0x0
 02917  1256   NtOpenKey  (0x20019, {24, 40, 0x40, 0, 0,  (0x20019, {24, 40, 0x40, 0, 0, "SYSTEM\Setup"}, ... 656, ) }, ... 656, ) == 0x0
 02918  1256   NtQueryValueKey  (656,  (656, "SystemPartition", Partial, 144, ... TitleIdx=0, Type=1, Data="\\0D\0e\0v\0i\0c\0e\0\\0H\0a\0r\0d\0d\0i\0s\0k\0V\0o\0l\0u\0m\0e\01\0\0\0"}, 60, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (656, "SystemPartition", Partial, 144, ... TitleIdx=0, Type=1, Data="\\0D\0e\0v\0i\0c\0e\0\\0H\0a\0r\0d\0d\0i\0s\0k\0V\0o\0l\0u\0m\0e\01\0\0\0"}, 60, ) }, 60, ) == 0x0
 02919  1256   NtQueryValueKey  (656,  (656, "SystemPartition", Partial, 144, ... , Partial, 144, ...
 02912   896   NtCreateThread  ... 660, {1252, 752}, ) == 0x0
 02920   896   NtQueryInformationThread  (660, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ff70000,Pid=1252,Tid=752,}, 0x0, ) == 0x0
 02921   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81968, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81968, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\224\2\0\0\344\4\0\0\360\2\0\0" ... {28, 56, reply, 0, 1252, 896, 81969, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\224\2\0\0\344\4\0\0\360\2\0\0" )  ... {28, 56, reply, 0, 1252, 896, 81969, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81968, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\224\2\0\0\344\4\0\0\360\2\0\0" ... {28, 56, reply, 0, 1252, 896, 81969, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\224\2\0\0\344\4\0\0\360\2\0\0" )  ) == 0x0
 02922   896   NtResumeThread  (660, ... 1, ) == 0x0
 02923   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ... 79757312, 1048576, ) == 0x0
 02924   896   NtAllocateVirtualMemory  (-1, 80797696, 0, 8192, 4096, 4, ... 80797696, 8192, ) == 0x0
 02919  1256   NtQueryValueKey  ... TitleIdx=0, Type=1, Data= ... TitleIdx=0, Type=1, Data="\\0D\0e\0v\0i\0c\0e\0\\0H\0a\0r\0d\0d\0i\0s\0k\0V\0o\0l\0u\0m\0e\01\0\0\0"}, 60, ) }, 60, ) == 0x0
 02925   752   NtWaitForSingleObject  (128, 0, 0x0, ...
 02926  1256   NtClose  (656, ... ) == 0x0
 02927  1256   NtOpenKey  (0x20019, {24, 40, 0x40, 0, 0,  (0x20019, {24, 40, 0x40, 0, 0, "Software\Microsoft\Windows\CurrentVersion\Setup"}, ... 656, ) }, ... 656, ) == 0x0
 02928  1256   NtQueryValueKey  (656,  (656, "SourcePath", Partial, 144, ... TitleIdx=0, Type=1, Data="D\0:\0\\0\0\0"}, 20, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (656, "SourcePath", Partial, 144, ... TitleIdx=0, Type=1, Data="D\0:\0\\0\0\0"}, 20, ) }, 20, ) == 0x0
 02929  1256   NtQueryValueKey  (656,  (656, "SourcePath", Partial, 144, ... TitleIdx=0, Type=1, Data="D\0:\0\\0\0\0"}, 20, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (656, "SourcePath", Partial, 144, ... TitleIdx=0, Type=1, Data="D\0:\0\\0\0\0"}, 20, ) }, 20, ) == 0x0
 02930  1256   NtClose  (656, ... ) == 0x0
 02931  1256   NtOpenKey  (0x20019, {24, 40, 0x40, 0, 0,  (0x20019, {24, 40, 0x40, 0, 0, "Software\Microsoft\Windows\CurrentVersion\Setup"}, ... }, ...
 02932   896   NtProtectVirtualMemory  (-1, (0x4d0e000), 4096, 260, ... (0x4d0e000), 4096, 4, ) == 0x0
 02933   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ... 656, {1252, 1512}, ) == 0x0
 02934   896   NtQueryInformationThread  (656, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ff6f000,Pid=1252,Tid=1512,}, 0x0, ) == 0x0
 02935   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81969, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81969, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\220\2\0\0\344\4\0\0\350\5\0\0" ... {28, 56, reply, 0, 1252, 896, 81970, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\220\2\0\0\344\4\0\0\350\5\0\0" )  ... {28, 56, reply, 0, 1252, 896, 81970, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81969, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\220\2\0\0\344\4\0\0\350\5\0\0" ... {28, 56, reply, 0, 1252, 896, 81970, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\220\2\0\0\344\4\0\0\350\5\0\0" )  ) == 0x0
 02936   896   NtResumeThread  (656, ... 1, ) == 0x0
 02937   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ...
 02931  1256   NtOpenKey  ... 664, ) == 0x0
 02938  1512   NtWaitForSingleObject  (128, 0, 0x0, ...
 02939  1256   NtQueryValueKey  (664,  (664, "ServicePackSourcePath", Partial, 144, ... TitleIdx=0, Type=1, Data="D\0:\0\\0\0\0"}, 20, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (664, "ServicePackSourcePath", Partial, 144, ... TitleIdx=0, Type=1, Data="D\0:\0\\0\0\0"}, 20, ) }, 20, ) == 0x0
 02940  1256   NtQueryValueKey  (664,  (664, "ServicePackSourcePath", Partial, 144, ... TitleIdx=0, Type=1, Data="D\0:\0\\0\0\0"}, 20, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (664, "ServicePackSourcePath", Partial, 144, ... TitleIdx=0, Type=1, Data="D\0:\0\\0\0\0"}, 20, ) }, 20, ) == 0x0
 02941  1256   NtClose  (664, ... ) == 0x0
 02942  1256   NtOpenKey  (0x20019, {24, 40, 0x40, 0, 0,  (0x20019, {24, 40, 0x40, 0, 0, "Software\Microsoft\Windows\CurrentVersion\Setup"}, ... 664, ) }, ... 664, ) == 0x0
 02943  1256   NtQueryValueKey  (664,  (664, "ServicePackCachePath", Partial, 144, ... TitleIdx=0, Type=1, Data="c\0:\0\\0w\0i\0n\0d\0o\0w\0s\0\\0S\0e\0r\0v\0i\0c\0e\0P\0a\0c\0k\0F\0i\0l\0e\0s\0\\0S\0e\0r\0v\0i\0c\0e\0P\0a\0c\0k\0C\0a\0c\0h\0e\0\0\0"}, 102, ) , Partial, 144, ... TitleIdx=0, Type=1, Data= (664, "ServicePackCachePath", Partial, 144, ... TitleIdx=0, Type=1, Data="c\0:\0\\0w\0i\0n\0d\0o\0w\0s\0\\0S\0e\0r\0v\0i\0c\0e\0P\0a\0c\0k\0F\0i\0l\0e\0s\0\\0S\0e\0r\0v\0i\0c\0e\0P\0a\0c\0k\0C\0a\0c\0h\0e\0\0\0"}, 102, ) }, 102, ) == 0x0
 02944  1256   NtQueryValueKey  (664,  (664, "ServicePackCachePath", Partial, 144, ... , Partial, 144, ...
 02937   896   NtAllocateVirtualMemory  ... 80805888, 1048576, ) == 0x0
 02945   896   NtAllocateVirtualMemory  (-1, 81846272, 0, 8192, 4096, 4, ... 81846272, 8192, ) == 0x0
 02946   896   NtProtectVirtualMemory  (-1, (0x4e0e000), 4096, 260, ... (0x4e0e000), 4096, 4, ) == 0x0
 02947   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ... 668, {1252, 1380}, ) == 0x0
 02948   896   NtQueryInformationThread  (668, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ff6e000,Pid=1252,Tid=1380,}, 0x0, ) == 0x0
 02949   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81970, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81970, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\234\2\0\0\344\4\0\0d\5\0\0" ... {28, 56, reply, 0, 1252, 896, 81971, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\234\2\0\0\344\4\0\0d\5\0\0" )  ... {28, 56, reply, 0, 1252, 896, 81971, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81970, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\234\2\0\0\344\4\0\0d\5\0\0" ... {28, 56, reply, 0, 1252, 896, 81971, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\234\2\0\0\344\4\0\0d\5\0\0" )  ) == 0x0
 02944  1256   NtQueryValueKey  ... TitleIdx=0, Type=1, Data= ... TitleIdx=0, Type=1, Data="c\0:\0\\0w\0i\0n\0d\0o\0w\0s\0\\0S\0e\0r\0v\0i\0c\0e\0P\0a\0c\0k\0F\0i\0l\0e\0s\0\\0S\0e\0r\0v\0i\0c\0e\0P\0a\0c\0k\0C\0a\0c\0h\0e\0\0\0"}, 102, ) }, 102, ) == 0x0
 02950  1256   NtClose  (664, ... ) == 0x0
 02951  1256   NtOpenKey  (0x20019, {24, 40, 0x40, 0, 0,  (0x20019, {24, 40, 0x40, 0, 0, "Software\Microsoft\Windows\CurrentVersion\Setup"}, ... 664, ) }, ... 664, ) == 0x0
 02952  1256   NtQueryValueKey  (664,  (664, "DriverCachePath", Partial, 144, ... TitleIdx=0, Type=2, Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0D\0r\0i\0v\0e\0r\0 \0C\0a\0c\0h\0e\0\0\0"}, 64, ) , Partial, 144, ... TitleIdx=0, Type=2, Data= (664, "DriverCachePath", Partial, 144, ... TitleIdx=0, Type=2, Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0D\0r\0i\0v\0e\0r\0 \0C\0a\0c\0h\0e\0\0\0"}, 64, ) }, 64, ) == 0x0
 02953  1256   NtQueryValueKey  (664,  (664, "DriverCachePath", Partial, 144, ... TitleIdx=0, Type=2, Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0D\0r\0i\0v\0e\0r\0 \0C\0a\0c\0h\0e\0\0\0"}, 64, ) , Partial, 144, ... TitleIdx=0, Type=2, Data= (664, "DriverCachePath", Partial, 144, ... TitleIdx=0, Type=2, Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0D\0r\0i\0v\0e\0r\0 \0C\0a\0c\0h\0e\0\0\0"}, 64, ) }, 64, ) == 0x0
 02954  1256   NtClose  (664, ... ) == 0x0
 02955  1256   NtOpenKey  (0x20019, {24, 40, 0x40, 0, 0,  (0x20019, {24, 40, 0x40, 0, 0, "Software\Microsoft\Windows\CurrentVersion"}, ... }, ...
 02956   896   NtResumeThread  (668, ... 1, ) == 0x0
 02957   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ... 81854464, 1048576, ) == 0x0
 02958   896   NtAllocateVirtualMemory  (-1, 82894848, 0, 8192, 4096, 4, ... 82894848, 8192, ) == 0x0
 02959   896   NtProtectVirtualMemory  (-1, (0x4f0e000), 4096, 260, ... (0x4f0e000), 4096, 4, ) == 0x0
 02960   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ... 664, {1252, 1564}, ) == 0x0
 02961   896   NtQueryInformationThread  (664, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ff6d000,Pid=1252,Tid=1564,}, 0x0, ) == 0x0
 02955  1256   NtOpenKey  ... 672, ) == 0x0
 02962  1380   NtWaitForSingleObject  (128, 0, 0x0, ...
 02963  1256   NtQueryValueKey  (672,  (672, "DevicePath", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_BUFFER_OVERFLOW
 02964  1256   NtQueryValueKey  (672,  (672, "DevicePath", Partial, 346, ... TitleIdx=0, Type=2, Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0i\0n\0f\0;\0%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0d\0e\0l\0l\0\\0a\0a\0c\0;\0%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0d\0e\0l\0l\0\\0a\0a\0r\0i\0c\0h\0;\0%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0d\0e\0l\0l\0\\0c\0e\0r\0c\0s\0r\06\0;\0%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0d\0e\0l\0l\0\\0a\03\02\00\0r\0a\0i\0d\0;\0%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0d\0e\0l\0l\0\\0i\0a\0s\0t\0o\0r\0;\0%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0d\0e\0l\0l\0\\0n\0v\0r\0a\0i\0d\0\0\0"}, 346, ) , Partial, 346, ... TitleIdx=0, Type=2, Data= (672, "DevicePath", Partial, 346, ... TitleIdx=0, Type=2, Data="%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0i\0n\0f\0;\0%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0d\0e\0l\0l\0\\0a\0a\0c\0;\0%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0d\0e\0l\0l\0\\0a\0a\0r\0i\0c\0h\0;\0%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0d\0e\0l\0l\0\\0c\0e\0r\0c\0s\0r\06\0;\0%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0d\0e\0l\0l\0\\0a\03\02\00\0r\0a\0i\0d\0;\0%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0d\0e\0l\0l\0\\0i\0a\0s\0t\0o\0r\0;\0%\0S\0y\0s\0t\0e\0m\0R\0o\0o\0t\0%\0\\0d\0e\0l\0l\0\\0n\0v\0r\0a\0i\0d\0\0\0"}, 346, ) }, 346, ) == 0x0
 02965  1256   NtAllocateVirtualMemory  (-1, 1409024, 0, 4096, 4096, 4, ... 1409024, 4096, ) == 0x0
 02966  1256   NtClose  (672, ... ) == 0x0
 02967  1256   NtCreateEvent  (0x1f0003, 0x0, 0, 0, ... 672, ) == 0x0
 02968  1256   NtCreateMutant  (0x1f0001, 0x0, 0, ...
 02969   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81971, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81971, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\230\2\0\0\344\4\0\0\34\6\0\0" ... {28, 56, reply, 0, 1252, 896, 81972, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\230\2\0\0\344\4\0\0\34\6\0\0" )  ... {28, 56, reply, 0, 1252, 896, 81972, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81971, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\230\2\0\0\344\4\0\0\34\6\0\0" ... {28, 56, reply, 0, 1252, 896, 81972, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\230\2\0\0\344\4\0\0\34\6\0\0" )  ) == 0x0
 02970   896   NtResumeThread  (664, ... 1, ) == 0x0
 02971   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ... 82903040, 1048576, ) == 0x0
 02972   896   NtAllocateVirtualMemory  (-1, 83943424, 0, 8192, 4096, 4, ... 83943424, 8192, ) == 0x0
 02973   896   NtProtectVirtualMemory  (-1, (0x500e000), 4096, 260, ... (0x500e000), 4096, 4, ) == 0x0
 02974   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ...
 02968  1256   NtCreateMutant  ... 676, ) == 0x0
 02975  1564   NtWaitForSingleObject  (128, 0, 0x0, ...
 02976  1256   NtCreateEvent  (0x1f0003, 0x0, 0, 0, ... 680, ) == 0x0
 02977  1256   NtCreateMutant  (0x1f0001, 0x0, 0, ... 684, ) == 0x0
 02978  1256   NtCreateEvent  (0x1f0003, 0x0, 0, 0, ... 688, ) == 0x0
 02979  1256   NtCreateMutant  (0x1f0001, 0x0, 0, ... 692, ) == 0x0
 02980  1256   NtOpenKey  (0x1, {24, 40, 0x40, 0, 0,  (0x1, {24, 40, 0x40, 0, 0, "Software\Microsoft\Windows\CurrentVersion\Setup"}, ... 696, ) }, ... 696, ) == 0x0
 02981  1256   NtQueryValueKey  (696,  (696, "LogLevel", Partial, 144, ... , Partial, 144, ...
 02974   896   NtCreateThread  ... 700, {1252, 164}, ) == 0x0
 02982   896   NtQueryInformationThread  (700, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ff6c000,Pid=1252,Tid=164,}, 0x0, ) == 0x0
 02983   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81972, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81972, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\274\2\0\0\344\4\0\0\244\0\0\0" ... {28, 56, reply, 0, 1252, 896, 81973, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\274\2\0\0\344\4\0\0\244\0\0\0" )  ... {28, 56, reply, 0, 1252, 896, 81973, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81972, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\274\2\0\0\344\4\0\0\244\0\0\0" ... {28, 56, reply, 0, 1252, 896, 81973, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\274\2\0\0\344\4\0\0\244\0\0\0" )  ) == 0x0
 02984   896   NtResumeThread  (700, ... 1, ) == 0x0
 02985   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ... 83951616, 1048576, ) == 0x0
 02986   896   NtAllocateVirtualMemory  (-1, 84992000, 0, 8192, 4096, 4, ... 84992000, 8192, ) == 0x0
 02981  1256   NtQueryValueKey  ... TitleIdx=0, Type=4, Data= ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) }, 16, ) == 0x0
 02987   164   NtWaitForSingleObject  (128, 0, 0x0, ...
 02988  1256   NtQueryValueKey  (696,  (696, "LogLevel", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) , Partial, 144, ... TitleIdx=0, Type=4, Data= (696, "LogLevel", Partial, 144, ... TitleIdx=0, Type=4, Data="\0\0\0\0"}, 16, ) }, 16, ) == 0x0
 02989  1256   NtQueryValueKey  (696,  (696, "LogPath", Partial, 144, ... ) , Partial, 144, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02990  1256   NtOpenKey  (0x1, {24, 696, 0x40, 0, 0,  (0x1, {24, 696, 0x40, 0, 0, "AppLogLevels"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 02991  1256   NtClose  (696, ... ) == 0x0
 02992  1256   NtQueryAttributesFile  ({24, 0, 0x40, 0, 0,  ({24, 0, 0x40, 0, 0, "\??\C:\WINDOWS\"}, 15788724, ... ) }, 15788724, ... ) == 0x0
 02993  1256   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\System\CurrentControlSet\Control\ComputerName\ActiveComputerName"}, ... }, ...
 02994   896   NtProtectVirtualMemory  (-1, (0x510e000), 4096, 260, ... (0x510e000), 4096, 4, ) == 0x0
 02995   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ... 696, {1252, 312}, ) == 0x0
 02996   896   NtQueryInformationThread  (696, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ff6b000,Pid=1252,Tid=312,}, 0x0, ) == 0x0
 02997   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81973, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81973, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\270\2\0\0\344\4\0\08\1\0\0" ... {28, 56, reply, 0, 1252, 896, 81974, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\270\2\0\0\344\4\0\08\1\0\0" )  ... {28, 56, reply, 0, 1252, 896, 81974, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81973, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\270\2\0\0\344\4\0\08\1\0\0" ... {28, 56, reply, 0, 1252, 896, 81974, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\270\2\0\0\344\4\0\08\1\0\0" )  ) == 0x0
 02998   896   NtResumeThread  (696, ... 1, ) == 0x0
 02999   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ...
 02993  1256   NtOpenKey  ... 704, ) == 0x0
 03000   312   NtWaitForSingleObject  (128, 0, 0x0, ...
 03001  1256   NtQueryValueKey  (704,  (704, "ComputerName", Full, 128, ... TitleIdx=0, Type=1, Name="ComputerName", Data="V\0I\0R\0T\0U\0A\0L\0\0\0"}, 60, ) , Full, 128, ... TitleIdx=0, Type=1, Name= (704, "ComputerName", Full, 128, ... TitleIdx=0, Type=1, Name="ComputerName", Data="V\0I\0R\0T\0U\0A\0L\0\0\0"}, 60, ) , Data= (704, "ComputerName", Full, 128, ... TitleIdx=0, Type=1, Name="ComputerName", Data="V\0I\0R\0T\0U\0A\0L\0\0\0"}, 60, ) }, 60, ) == 0x0
 03002  1256   NtClose  (704, ... ) == 0x0
 03003  1256   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\System\CurrentControlSet\Services\Tcpip\Parameters"}, ... 704, ) }, ... 704, ) == 0x0
 03004  1256   NtQueryValueKey  (704,  (704, "Hostname", Full, 128, ... TitleIdx=0, Type=1, Name="Hostname", Data="v\0i\0r\0t\0u\0a\0l\0\0\0"}, 52, ) , Full, 128, ... TitleIdx=0, Type=1, Name= (704, "Hostname", Full, 128, ... TitleIdx=0, Type=1, Name="Hostname", Data="v\0i\0r\0t\0u\0a\0l\0\0\0"}, 52, ) , Data= (704, "Hostname", Full, 128, ... TitleIdx=0, Type=1, Name="Hostname", Data="v\0i\0r\0t\0u\0a\0l\0\0\0"}, 52, ) }, 52, ) == 0x0
 03005  1256   NtClose  (704, ... ) == 0x0
 03006  1256   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Policies\Microsoft\System\DNSclient"}, ... }, ...
 02999   896   NtAllocateVirtualMemory  ... 85000192, 1048576, ) == 0x0
 03007   896   NtAllocateVirtualMemory  (-1, 86040576, 0, 8192, 4096, 4, ... 86040576, 8192, ) == 0x0
 03008   896   NtProtectVirtualMemory  (-1, (0x520e000), 4096, 260, ... (0x520e000), 4096, 4, ) == 0x0
 03009   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ... 704, {1252, 1964}, ) == 0x0
 03010   896   NtQueryInformationThread  (704, Basic, 28, ... {ExitStatus=0x103,TebBaseAddress=0x7ff6a000,Pid=1252,Tid=1964,}, 0x0, ) == 0x0
 03011   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81974, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81974, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\300\2\0\0\344\4\0\0\254\7\0\0" ... {28, 56, reply, 0, 1252, 896, 81975, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\300\2\0\0\344\4\0\0\254\7\0\0" )  ... {28, 56, reply, 0, 1252, 896, 81975, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81974, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\300\2\0\0\344\4\0\0\254\7\0\0" ... {28, 56, reply, 0, 1252, 896, 81975, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\300\2\0\0\344\4\0\0\254\7\0\0" )  ) == 0x0
 03006  1256   NtOpenKey  ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 03012  1256   NtOpenKey  (0x20019, {24, 0, 0x40, 0, 0,  (0x20019, {24, 0, 0x40, 0, 0, "\Registry\Machine\System\CurrentControlSet\Services\Tcpip\Parameters"}, ... 708, ) }, ... 708, ) == 0x0
 03013  1256   NtQueryValueKey  (708,  (708, "Domain", Full, 128, ... TitleIdx=0, Type=1, Name="Domain", Data="\0\0"}, 34, ) , Full, 128, ... TitleIdx=0, Type=1, Name= (708, "Domain", Full, 128, ... TitleIdx=0, Type=1, Name="Domain", Data="\0\0"}, 34, ) , Data= (708, "Domain", Full, 128, ... TitleIdx=0, Type=1, Name="Domain", Data="\0\0"}, 34, ) }, 34, ) == 0x0
 03014  1256   NtClose  (708, ... ) == 0x0
 03015  1256   NtOpenKey  (0x80000000, {24, 0, 0x40, 0, 0,  (0x80000000, {24, 0, 0x40, 0, 0, "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wshbth.dll"}, ... ) }, ... ) == STATUS_OBJECT_NAME_NOT_FOUND
 03016  1256   NtSetEventBoostPriority  (128, ...
 02742  1228   NtWaitForSingleObject  ... ) == 0x0
 03017  1228   NtSetEventBoostPriority  (128, ...
 02754  1484   NtWaitForSingleObject  ... ) == 0x0
 03018  1484   NtSetEventBoostPriority  (128, ...
 02767  1120   NtWaitForSingleObject  ... ) == 0x0
 03019  1120   NtSetEventBoostPriority  (128, ...
 02786   840   NtWaitForSingleObject  ... ) == 0x0
 03020   840   NtSetEventBoostPriority  (128, ...
 02793  1104   NtWaitForSingleObject  ... ) == 0x0
 03021  1104   NtSetEventBoostPriority  (128, ...
 02810   860   NtWaitForSingleObject  ... ) == 0x0
 03022   860   NtSetEventBoostPriority  (128, ...
 02818   780   NtWaitForSingleObject  ... ) == 0x0
 03023   780   NtSetEventBoostPriority  (128, ...
 02840   940   NtWaitForSingleObject  ... ) == 0x0
 03024   940   NtSetEventBoostPriority  (128, ...
 02853  1268   NtWaitForSingleObject  ... ) == 0x0
 03025  1268   NtSetEventBoostPriority  (128, ...
 02865  1736   NtWaitForSingleObject  ... ) == 0x0
 03026  1736   NtSetEventBoostPriority  (128, ...
 02878  1332   NtWaitForSingleObject  ... ) == 0x0
 03027  1332   NtSetEventBoostPriority  (128, ...
 02900  1336   NtWaitForSingleObject  ... ) == 0x0
 03028  1336   NtSetEventBoostPriority  (128, ...
 02913   468   NtWaitForSingleObject  ... ) == 0x0
 03029   468   NtSetEventBoostPriority  (128, ...
 02925   752   NtWaitForSingleObject  ... ) == 0x0
 03030   752   NtSetEventBoostPriority  (128, ...
 02938  1512   NtWaitForSingleObject  ... ) == 0x0
 03031  1512   NtSetEventBoostPriority  (128, ...
 02962  1380   NtWaitForSingleObject  ... ) == 0x0
 03032  1380   NtSetEventBoostPriority  (128, ...
 02975  1564   NtWaitForSingleObject  ... ) == 0x0
 03033  1564   NtSetEventBoostPriority  (128, ...
 02987   164   NtWaitForSingleObject  ... ) == 0x0
 03034   164   NtSetEventBoostPriority  (128, ...
 03000   312   NtWaitForSingleObject  ... ) == 0x0
 03035   312   NtTestAlert  (... ) == 0x0
 03034   164   NtSetEventBoostPriority  ... ) == 0x0
 03033  1564   NtSetEventBoostPriority  ... ) == 0x0
 03032  1380   NtSetEventBoostPriority  ... ) == 0x0
 03031  1512   NtSetEventBoostPriority  ... ) == 0x0
 03030   752   NtSetEventBoostPriority  ... ) == 0x0
 03029   468   NtSetEventBoostPriority  ... ) == 0x0
 03028  1336   NtSetEventBoostPriority  ... ) == 0x0
 03027  1332   NtSetEventBoostPriority  ... ) == 0x0
 03026  1736   NtSetEventBoostPriority  ... ) == 0x0
 03025  1268   NtSetEventBoostPriority  ... ) == 0x0
 03024   940   NtSetEventBoostPriority  ... ) == 0x0
 03023   780   NtSetEventBoostPriority  ... ) == 0x0
 03022   860   NtSetEventBoostPriority  ... ) == 0x0
 03021  1104   NtSetEventBoostPriority  ... ) == 0x0
 03020   840   NtSetEventBoostPriority  ... ) == 0x0
 03019  1120   NtSetEventBoostPriority  ... ) == 0x0
 03018  1484   NtSetEventBoostPriority  ... ) == 0x0
 03017  1228   NtSetEventBoostPriority  ... ) == 0x0
 03016  1256   NtSetEventBoostPriority  ... ) == 0x0
 03036   896   NtResumeThread  (704, ...
 03037   312   NtContinue  (84999472, 1, ...
 03038   164   NtTestAlert  (...
 03039  1564   NtTestAlert  (...
 03040  1380   NtTestAlert  (...
 03041  1512   NtTestAlert  (...
 03042   752   NtTestAlert  (...
 03043   468   NtTestAlert  (...
 03044  1336   NtTestAlert  (...
 03045  1332   NtTestAlert  (...
 03046  1736   NtTestAlert  (...
 03047  1268   NtTestAlert  (...
 03048   940   NtTestAlert  (...
 03049   780   NtTestAlert  (...
 03050   860   NtTestAlert  (...
 03051  1104   NtTestAlert  (...
 03052   840   NtTestAlert  (...
 03053  1120   NtTestAlert  (...
 03054  1484   NtTestAlert  (...
 03055  1256   NtSetEventBoostPriority  (160, ...
 03036   896   NtResumeThread  ... 1, ) == 0x0
 03056   312   NtRegisterThreadTerminatePort  (24, ...
 03038   164   NtTestAlert  ... ) == 0x0
 03039  1564   NtTestAlert  ... ) == 0x0
 03040  1380   NtTestAlert  ... ) == 0x0
 03041  1512   NtTestAlert  ... ) == 0x0
 03042   752   NtTestAlert  ... ) == 0x0
 03043   468   NtTestAlert  ... ) == 0x0
 03044  1336   NtTestAlert  ... ) == 0x0
 03045  1332   NtTestAlert  ... ) == 0x0
 03046  1736   NtTestAlert  ... ) == 0x0
 03047  1268   NtTestAlert  ... ) == 0x0
 03048   940   NtTestAlert  ... ) == 0x0
 03049   780   NtTestAlert  ... ) == 0x0
 03050   860   NtTestAlert  ... ) == 0x0
 03051  1104   NtTestAlert  ... ) == 0x0
 03052   840   NtTestAlert  ... ) == 0x0
 03053  1120   NtTestAlert  ... ) == 0x0
 03054  1484   NtTestAlert  ... ) == 0x0
 03057  1228   NtTestAlert  (...
 03058  1964   NtTestAlert  (...
 03059   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ...
 03056   312   NtRegisterThreadTerminatePort  ... ) == 0x0
 03060   164   NtContinue  (83950896, 1, ...
 03061  1564   NtContinue  (82902320, 1, ...
 03062  1380   NtContinue  (81853744, 1, ...
 03063  1512   NtContinue  (80805168, 1, ...
 03064   752   NtContinue  (79756592, 1, ...
 03065   468   NtContinue  (78708016, 1, ...
 03066  1336   NtContinue  (77659440, 1, ...
 03067  1332   NtContinue  (76610864, 1, ...
 03068  1736   NtContinue  (75562288, 1, ...
 03069  1268   NtContinue  (74513712, 1, ...
 03070   940   NtContinue  (73465136, 1, ...
 03071   780   NtContinue  (72416560, 1, ...
 03072   860   NtContinue  (71367984, 1, ...
 03073  1104   NtContinue  (70319408, 1, ...
 03074   840   NtContinue  (69270832, 1, ...
 03075  1120   NtContinue  (68222256, 1, ...
 03076  1484   NtContinue  (67173680, 1, ...
 03057  1228   NtTestAlert  ... ) == 0x0
 03058  1964   NtTestAlert  ... ) == 0x0
 03059   896   NtAllocateVirtualMemory  ... 86048768, 1048576, ) == 0x0
 03077   312   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 03078   164   NtRegisterThreadTerminatePort  (24, ...
 03079  1564   NtRegisterThreadTerminatePort  (24, ...
 03080  1380   NtRegisterThreadTerminatePort  (24, ...
 03081  1512   NtRegisterThreadTerminatePort  (24, ...
 03082   752   NtRegisterThreadTerminatePort  (24, ...
 03083   468   NtRegisterThreadTerminatePort  (24, ...
 03084  1336   NtRegisterThreadTerminatePort  (24, ...
 03085  1332   NtRegisterThreadTerminatePort  (24, ...
 03086  1736   NtRegisterThreadTerminatePort  (24, ...
 03087  1268   NtRegisterThreadTerminatePort  (24, ...
 03088   940   NtRegisterThreadTerminatePort  (24, ...
 03089   780   NtRegisterThreadTerminatePort  (24, ...
 03090   860   NtRegisterThreadTerminatePort  (24, ...
 03091  1104   NtRegisterThreadTerminatePort  (24, ...
 03092   840   NtRegisterThreadTerminatePort  (24, ...
 03093  1120   NtRegisterThreadTerminatePort  (24, ...
 03094  1484   NtRegisterThreadTerminatePort  (24, ...
 03095  1228   NtContinue  (66125104, 1, ...
 03096  1964   NtContinue  (86048048, 1, ...
 03097   896   NtAllocateVirtualMemory  (-1, 87089152, 0, 8192, 4096, 4, ...
 03077   312   NtDuplicateObject  ... 708, ) == 0x0
 03078   164   NtRegisterThreadTerminatePort  ... ) == 0x0
 03079  1564   NtRegisterThreadTerminatePort  ... ) == 0x0
 03080  1380   NtRegisterThreadTerminatePort  ... ) == 0x0
 03081  1512   NtRegisterThreadTerminatePort  ... ) == 0x0
 03082   752   NtRegisterThreadTerminatePort  ... ) == 0x0
 03083   468   NtRegisterThreadTerminatePort  ... ) == 0x0
 03084  1336   NtRegisterThreadTerminatePort  ... ) == 0x0
 03085  1332   NtRegisterThreadTerminatePort  ... ) == 0x0
 03086  1736   NtRegisterThreadTerminatePort  ... ) == 0x0
 03087  1268   NtRegisterThreadTerminatePort  ... ) == 0x0
 03088   940   NtRegisterThreadTerminatePort  ... ) == 0x0
 03089   780   NtRegisterThreadTerminatePort  ... ) == 0x0
 03090   860   NtRegisterThreadTerminatePort  ... ) == 0x0
 03091  1104   NtRegisterThreadTerminatePort  ... ) == 0x0
 03092   840   NtRegisterThreadTerminatePort  ... ) == 0x0
 03093  1120   NtRegisterThreadTerminatePort  ... ) == 0x0
 03094  1484   NtRegisterThreadTerminatePort  ... ) == 0x0
 03098  1228   NtRegisterThreadTerminatePort  (24, ...
 03099  1964   NtRegisterThreadTerminatePort  (24, ...
 03097   896   NtAllocateVirtualMemory  ... 87089152, 8192, ) == 0x0
 03100   312   NtWaitForSingleObject  (104, 0, {0, 0}, ...
 03101   164   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 03102  1564   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 03103  1380   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 03104  1512   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 03105   752   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 03106   468   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 03107  1336   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 03108  1332   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 03109  1736   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 03110  1268   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 03111   940   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 03112   780   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 03113   860   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 03114  1104   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 03115   840   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 03116  1120   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 03117  1484   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 03098  1228   NtRegisterThreadTerminatePort  ... ) == 0x0
 03099  1964   NtRegisterThreadTerminatePort  ... ) == 0x0
 01519   180   NtWaitForSingleObject  ... ) == 0x0
 03055  1256   NtSetEventBoostPriority  ... ) == 0x0
 03118   896   NtProtectVirtualMemory  (-1, (0x530e000), 4096, 260, ...
 03100   312   NtWaitForSingleObject  ... ) == 0x102
 03101   164   NtDuplicateObject  ... 712, ) == 0x0
 03102  1564   NtDuplicateObject  ... 716, ) == 0x0
 03103  1380   NtDuplicateObject  ... 720, ) == 0x0
 03104  1512   NtDuplicateObject  ... 724, ) == 0x0
 03105   752   NtDuplicateObject  ... 728, ) == 0x0
 03106   468   NtDuplicateObject  ... 732, ) == 0x0
 03107  1336   NtDuplicateObject  ... 736, ) == 0x0
 03108  1332   NtDuplicateObject  ... 740, ) == 0x0
 03109  1736   NtDuplicateObject  ... 744, ) == 0x0
 03110  1268   NtDuplicateObject  ... 748, ) == 0x0
 03111   940   NtDuplicateObject  ... 752, ) == 0x0
 03112   780   NtDuplicateObject  ... 756, ) == 0x0
 03113   860   NtDuplicateObject  ... 760, ) == 0x0
 03114  1104   NtDuplicateObject  ... 764, ) == 0x0
 03115   840   NtDuplicateObject  ... 768, ) == 0x0
 03116  1120   NtDuplicateObject  ... 772, ) == 0x0
 03119  1228   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 03117  1484   NtDuplicateObject  ... 776, ) == 0x0
 03120   180   NtSetEventBoostPriority  (160, ...
 03121  1256   NtCreateEvent  (0x1f0003, 0x0, 1, 0, ...
 03118   896   NtProtectVirtualMemory  ... (0x530e000), 4096, 4, ) == 0x0
 03122   312   NtWaitForSingleObject  (160, 0, 0x0, ...
 03123   164   NtWaitForSingleObject  (104, 0, {0, 0}, ...
 03124  1564   NtWaitForSingleObject  (104, 0, {0, 0}, ...
 03125  1380   NtWaitForSingleObject  (104, 0, {0, 0}, ...
 03126  1512   NtWaitForSingleObject  (104, 0, {0, 0}, ...
 03127   752   NtWaitForSingleObject  (104, 0, {0, 0}, ...
 03128   468   NtWaitForSingleObject  (104, 0, {0, 0}, ...
 03129  1336   NtWaitForSingleObject  (104, 0, {0, 0}, ...
 03130  1332   NtWaitForSingleObject  (104, 0, {0, 0}, ...
 03131  1736   NtWaitForSingleObject  (104, 0, {0, 0}, ...
 03132  1268   NtWaitForSingleObject  (104, 0, {0, 0}, ...
 03133   940   NtWaitForSingleObject  (104, 0, {0, 0}, ...
 03134   780   NtWaitForSingleObject  (104, 0, {0, 0}, ...
 03135   860   NtWaitForSingleObject  (104, 0, {0, 0}, ...
 03136  1104   NtWaitForSingleObject  (104, 0, {0, 0}, ...
 03137   840   NtWaitForSingleObject  (104, 0, {0, 0}, ...
 03138  1120   NtWaitForSingleObject  (104, 0, {0, 0}, ...
 03139  1964   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 03140  1484   NtAllocateVirtualMemory  (-1, 1413120, 0, 4096, 4096, 4, ...
 01523   212   NtWaitForSingleObject  ... ) == 0x0
 03120   180   NtSetEventBoostPriority  ... ) == 0x0
 03121  1256   NtCreateEvent  ... 780, ) == 0x0
 03141   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ...
 03123   164   NtWaitForSingleObject  ... ) == 0x102
 03124  1564   NtWaitForSingleObject  ... ) == 0x102
 03125  1380   NtWaitForSingleObject  ... ) == 0x102
 03126  1512   NtWaitForSingleObject  ... ) == 0x102
 03127   752   NtWaitForSingleObject  ... ) == 0x102
 03128   468   NtWaitForSingleObject  ... ) == 0x102
 03129  1336   NtWaitForSingleObject  ... ) == 0x102
 03130  1332   NtWaitForSingleObject  ... ) == 0x102
 03131  1736   NtWaitForSingleObject  ... ) == 0x102
 03132  1268   NtWaitForSingleObject  ... ) == 0x102
 03133   940   NtWaitForSingleObject  ... ) == 0x102
 03134   780   NtWaitForSingleObject  ... ) == 0x102
 03135   860   NtWaitForSingleObject  ... ) == 0x102
 03136  1104   NtWaitForSingleObject  ... ) == 0x102
 03137   840   NtWaitForSingleObject  ... ) == 0x102
 03138  1120   NtWaitForSingleObject  ... ) == 0x102
 03139  1964   NtDuplicateObject  ... 784, ) == 0x0
 03142   212   NtWaitForSingleObject  (328, 0, 0x0, ...
 03140  1484   NtAllocateVirtualMemory  ... 1413120, 4096, ) == 0x0
 03143   180   NtCreateEvent  (0x1f0003, 0x0, 0, 0, ...
 03144  1256   NtWaitForSingleObject  (328, 0, 0x0, ...
 03141   896   NtCreateThread  ... 788, {1252, 1972}, ) == 0x0
 03145   164   NtWaitForSingleObject  (328, 0, 0x0, ...
 03146  1564   NtWaitForSingleObject  (328, 0, 0x0, ...
 03147  1380   NtWaitForSingleObject  (328, 0, 0x0, ...
 03148  1512   NtWaitForSingleObject  (328, 0, 0x0, ...
 03149   752   NtWaitForSingleObject  (328, 0, 0x0, ...
 03150   468   NtWaitForSingleObject  (328, 0, 0x0, ...
 03151  1336   NtWaitForSingleObject  (328, 0, 0x0, ...
 03152  1332   NtWaitForSingleObject  (328, 0, 0x0, ...
 03153  1736   NtWaitForSingleObject  (328, 0, 0x0, ...
 03154  1268   NtWaitForSingleObject  (328, 0, 0x0, ...
 03155   940   NtWaitForSingleObject  (328, 0, 0x0, ...
 03156   780   NtWaitForSingleObject  (328, 0, 0x0, ...
 03157   860   NtWaitForSingleObject  (328, 0, 0x0, ...
 03158  1104   NtWaitForSingleObject  (328, 0, 0x0, ...
 03159   840   NtWaitForSingleObject  (328, 0, 0x0, ...
 03160  1120   NtWaitForSingleObject  (328, 0, 0x0, ...
 03161  1964   NtWaitForSingleObject  (328, 0, 0x0, ...
 03162  1484   NtSetEventBoostPriority  (328, ...
 03119  1228   NtDuplicateObject  ... 792, ) == 0x0
 03163   896   NtQueryInformationThread  (788, Basic, 28, ...
 03142   212   NtWaitForSingleObject  ... ) == 0x0
 03162  1484   NtSetEventBoostPriority  ... ) == 0x0
 03164  1228   NtWaitForSingleObject  (328, 0, 0x0, ...
 03165   212   NtSetEventBoostPriority  (328, ...
 03163   896   NtQueryInformationThread  ... {ExitStatus=0x103,TebBaseAddress=0x7ff69000,Pid=1252,Tid=1972,}, 0x0, ) == 0x0
 03166  1484   NtWaitForSingleObject  (328, 0, 0x0, ...
 03144  1256   NtWaitForSingleObject  ... ) == 0x0
 03165   212   NtSetEventBoostPriority  ... ) == 0x0
 03143   180   NtCreateEvent  ... 796, ) == 0x0
 03167   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81975, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81975, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\24\3\0\0\344\4\0\0\264\7\0\0" ...  ...
 03168  1256   NtSetEventBoostPriority  (328, ...
 03169   180   NtWaitForSingleObject  (328, 0, 0x0, ...
 03145   164   NtWaitForSingleObject  ... ) == 0x0
 03168  1256   NtSetEventBoostPriority  ... ) == 0x0
 03167   896   NtRequestWaitReplyPort  ... {28, 56, reply, 0, 1252, 896, 81976, 0}  ... {28, 56, reply, 0, 1252, 896, 81976, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\24\3\0\0\344\4\0\0\264\7\0\0" )  ) == 0x0
 03170   164   NtSetEventBoostPriority  (328, ...
 03171   212   NtWaitForSingleObject  (328, 0, 0x0, ...
 03146  1564   NtWaitForSingleObject  ... ) == 0x0
 03170   164   NtSetEventBoostPriority  ... ) == 0x0
 03172   896   NtResumeThread  (788, ...
 03173  1564   NtSetEventBoostPriority  (328, ...
 03174  1256   NtWaitForSingleObject  (328, 0, 0x0, ...
 03147  1380   NtWaitForSingleObject  ... ) == 0x0
 03173  1564   NtSetEventBoostPriority  ... ) == 0x0
 03172   896   NtResumeThread  ... 1, ) == 0x0
 03175  1380   NtSetEventBoostPriority  (328, ...
 03176   164   NtWaitForSingleObject  (160, 0, 0x0, ...
 03177  1972   NtWaitForSingleObject  (328, 0, 0x0, ...
 03148  1512   NtWaitForSingleObject  ... ) == 0x0
 03175  1380   NtSetEventBoostPriority  ... ) == 0x0
 03178   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ...
 03179  1512   NtSetEventBoostPriority  (328, ...
 03180  1564   NtWaitForSingleObject  (160, 0, 0x0, ...
 03181  1380   NtWaitForSingleObject  (160, 0, 0x0, ...
 03149   752   NtWaitForSingleObject  ... ) == 0x0
 03179  1512   NtSetEventBoostPriority  ... ) == 0x0
 03182   752   NtSetEventBoostPriority  (328, ...
 03178   896   NtAllocateVirtualMemory  ... 87097344, 1048576, ) == 0x0
 03150   468   NtWaitForSingleObject  ... ) == 0x0
 03182   752   NtSetEventBoostPriority  ... ) == 0x0
 03183   468   NtSetEventBoostPriority  (328, ...
 03184   896   NtAllocateVirtualMemory  (-1, 88137728, 0, 8192, 4096, 4, ...
 03185  1512   NtWaitForSingleObject  (160, 0, 0x0, ...
 03151  1336   NtWaitForSingleObject  ... ) == 0x0
 03183   468   NtSetEventBoostPriority  ... ) == 0x0
 03184   896   NtAllocateVirtualMemory  ... 88137728, 8192, ) == 0x0
 03186  1336   NtSetEventBoostPriority  (328, ...
 03187   752   NtWaitForSingleObject  (160, 0, 0x0, ...
 03152  1332   NtWaitForSingleObject  ... ) == 0x0
 03186  1336   NtSetEventBoostPriority  ... ) == 0x0
 03188   896   NtProtectVirtualMemory  (-1, (0x540e000), 4096, 260, ...
 03189  1332   NtSetEventBoostPriority  (328, ...
 03190   468   NtWaitForSingleObject  (160, 0, 0x0, ...
 03153  1736   NtWaitForSingleObject  ... ) == 0x0
 03189  1332   NtSetEventBoostPriority  ... ) == 0x0
 03188   896   NtProtectVirtualMemory  ... (0x540e000), 4096, 4, ) == 0x0
 03191  1736   NtSetEventBoostPriority  (328, ...
 03192  1336   NtWaitForSingleObject  (160, 0, 0x0, ...
 03154  1268   NtWaitForSingleObject  ... ) == 0x0
 03191  1736   NtSetEventBoostPriority  ... ) == 0x0
 03193   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ...
 03194  1268   NtSetEventBoostPriority  (328, ...
 03195  1332   NtWaitForSingleObject  (160, 0, 0x0, ...
 03196  1736   NtWaitForSingleObject  (160, 0, 0x0, ...
 03155   940   NtWaitForSingleObject  ... ) == 0x0
 03194  1268   NtSetEventBoostPriority  ... ) == 0x0
 03197   940   NtSetEventBoostPriority  (328, ...
 03193   896   NtCreateThread  ... 800, {1252, 1656}, ) == 0x0
 03156   780   NtWaitForSingleObject  ... ) == 0x0
 03197   940   NtSetEventBoostPriority  ... ) == 0x0
 03198   780   NtSetEventBoostPriority  (328, ...
 03199   896   NtQueryInformationThread  (800, Basic, 28, ...
 03200  1268   NtWaitForSingleObject  (160, 0, 0x0, ...
 03157   860   NtWaitForSingleObject  ... ) == 0x0
 03198   780   NtSetEventBoostPriority  ... ) == 0x0
 03199   896   NtQueryInformationThread  ... {ExitStatus=0x103,TebBaseAddress=0x7ff68000,Pid=1252,Tid=1656,}, 0x0, ) == 0x0
 03201   860   NtSetEventBoostPriority  (328, ...
 03202   940   NtWaitForSingleObject  (160, 0, 0x0, ...
 03158  1104   NtWaitForSingleObject  ... ) == 0x0
 03201   860   NtSetEventBoostPriority  ... ) == 0x0
 03203   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81976, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81976, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG \3\0\0\344\4\0\0x\6\0\0" ...  ...
 03204  1104   NtSetEventBoostPriority  (328, ...
 03205   780   NtWaitForSingleObject  (160, 0, 0x0, ...
 03159   840   NtWaitForSingleObject  ... ) == 0x0
 03204  1104   NtSetEventBoostPriority  ... ) == 0x0
 03203   896   NtRequestWaitReplyPort  ... {28, 56, reply, 0, 1252, 896, 81977, 0}  ... {28, 56, reply, 0, 1252, 896, 81977, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG \3\0\0\344\4\0\0x\6\0\0" )  ) == 0x0
 03206   840   NtSetEventBoostPriority  (328, ...
 03207   860   NtWaitForSingleObject  (160, 0, 0x0, ...
 03208  1104   NtWaitForSingleObject  (160, 0, 0x0, ...
 03160  1120   NtWaitForSingleObject  ... ) == 0x0
 03206   840   NtSetEventBoostPriority  ... ) == 0x0
 03209  1120   NtSetEventBoostPriority  (328, ...
 03210   896   NtResumeThread  (800, ...
 03161  1964   NtWaitForSingleObject  ... ) == 0x0
 03209  1120   NtSetEventBoostPriority  ... ) == 0x0
 03211  1964   NtSetEventBoostPriority  (328, ...
 03210   896   NtResumeThread  ... 1, ) == 0x0
 03212   840   NtWaitForSingleObject  (160, 0, 0x0, ...
 03164  1228   NtWaitForSingleObject  ... ) == 0x0
 03211  1964   NtSetEventBoostPriority  ... ) == 0x0
 03213   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ...
 03214  1228   NtSetEventBoostPriority  (328, ...
 03215  1120   NtWaitForSingleObject  (160, 0, 0x0, ...
 03216  1656   NtWaitForSingleObject  (128, 0, 0x0, ...
 03166  1484   NtWaitForSingleObject  ... ) == 0x0
 03214  1228   NtSetEventBoostPriority  ... ) == 0x0
 03213   896   NtAllocateVirtualMemory  ... 88145920, 1048576, ) == 0x0
 03217  1484   NtSetEventBoostPriority  (328, ...
 03218  1964   NtWaitForSingleObject  (328, 0, 0x0, ...
 03169   180   NtWaitForSingleObject  ... ) == 0x0
 03219   896   NtAllocateVirtualMemory  (-1, 89186304, 0, 8192, 4096, 4, ...
 03220   180   NtSetEventBoostPriority  (328, ...
 03219   896   NtAllocateVirtualMemory  ... 89186304, 8192, ) == 0x0
 03171   212   NtWaitForSingleObject  ... ) == 0x0
 03220   180   NtSetEventBoostPriority  ... ) == 0x0
 03217  1484   NtSetEventBoostPriority  ... ) == 0x0
 03221  1228   NtWaitForSingleObject  (328, 0, 0x0, ...
 03222   212   NtSetEventBoostPriority  (328, ...
 03223   896   NtProtectVirtualMemory  (-1, (0x550e000), 4096, 260, ...
 03224  1484   NtWaitForSingleObject  (328, 0, 0x0, ...
 03174  1256   NtWaitForSingleObject  ... ) == 0x0
 03222   212   NtSetEventBoostPriority  ... ) == 0x0
 03223   896   NtProtectVirtualMemory  ... (0x550e000), 4096, 4, ) == 0x0
 03225  1256   NtSetEventBoostPriority  (328, ...
 03226   212   NtSetEventBoostPriority  (160, ...
 03177  1972   NtWaitForSingleObject  ... ) == 0x0
 03225  1256   NtSetEventBoostPriority  ... ) == 0x0
 03227   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ...
 03228   180   NtWaitForSingleObject  (328, 0, 0x0, ...
 03229  1972   NtSetEventBoostPriority  (328, ...
 03230  1256   NtConnectPort  ( ("\RPC Control\DNSResolver", {12, 2, 1, 0}, 0x0, 0x0, 15789236, 188, ... , {12, 2, 1, 0}, 0x0, 0x0, 15789236, 188, ...
 03227   896   NtCreateThread  ... 804, {1252, 1580}, ) == 0x0
 03218  1964   NtWaitForSingleObject  ... ) == 0x0
 03229  1972   NtSetEventBoostPriority  ... ) == 0x0
 01525  1728   NtWaitForSingleObject  ... ) == 0x0
 03226   212   NtSetEventBoostPriority  ... ) == 0x0
 03231  1964   NtSetEventBoostPriority  (328, ...
 03232   896   NtQueryInformationThread  (804, Basic, 28, ...
 03230  1256   NtConnectPort  ... 808, 0x0, 0x0, 0x0, 188, ) == 0x0
 03233  1728   NtWaitForSingleObject  (328, 0, 0x0, ...
 03221  1228   NtWaitForSingleObject  ... ) == 0x0
 03231  1964   NtSetEventBoostPriority  ... ) == 0x0
 03234   212   NtCreateEvent  (0x1f0003, 0x0, 0, 0, ...
 03232   896   NtQueryInformationThread  ... {ExitStatus=0x103,TebBaseAddress=0x7ff67000,Pid=1252,Tid=1580,}, 0x0, ) == 0x0
 03235  1256   NtRequestWaitReplyPort  (808, {200, 224, new_msg, 0, 1386176, 12, 2, 1310721}  (808, {200, 224, new_msg, 0, 1386176, 12, 2, 1310721} "\0\0\0\0\274\0\0\0x\1\24\0\1kwEVY\205D\237\200\364(\367\326\1)\2\0\0\0\1\0\0\0\230`\347w\4\0\0\0x\1\24\0\10\0\0\0\5\0\0\0\0\0\0\0\0\0\0\0\0\0\377\377\5\0\0\0\347s6\223$\350L,\200\230\25\0h\1\24\0\12\0\0\0\0\0\0\0\0\0\0\0(\0\0\0p\220\25\0Jy\3\6x\1\24\0x\230\25\0h\1\24\0\0\0\0\0\0\0\0\0x\230\25\0P\0\0\0\200\230\25\0\360\6\221|x\1\24\0P\0\0\0\346\31\0\0\0\0\24\04\353\360\0\372\31\221|\310\362\360\0\30\356\220|\360\6\221|\0\0\0\0\0\0\0\0\0\0\0\0\6\0\0\0" ...  ...
 03236  1228   NtSetEventBoostPriority  (328, ...
 03237  1964   NtWaitForSingleObject  (368, 0, 0x0, ...
 03234   212   NtCreateEvent  ... 812, ) == 0x0
 03238  1972   NtSetEventBoostPriority  (128, ...
 03224  1484   NtWaitForSingleObject  ... ) == 0x0
 03236  1228   NtSetEventBoostPriority  ... ) == 0x0
 03235  1256   NtRequestWaitReplyPort  ... {200, 224, reply, 0, 1252, 1256, 81979, 0}  ... {200, 224, reply, 0, 1252, 1256, 81979, 0} "\7\0\0\0\274\0\0\0x\1\24\0\1kwEVY\205D\237\200\364(\367\326\1)\2\0\0\0\1\0\0\0\0\0\0\0\4\0\0\0x\1\24\0\377\377\377\377\5\0\0\0\0\0\0\0\0\0\0\0\0\0\377\377\5\0\0\0\347s6\223$\350L,\200\230\25\0h\1\24\0\12\0\0\0\0\0\0\0\0\0\0\0(\0\0\0p\220\25\0Jy\3\6x\1\24\0x\230\25\0h\1\24\0\0\0\0\0\0\0\0\0x\230\25\0P\0\0\0\200\230\25\0\360\6\221|x\1\24\0P\0\0\0\346\31\0\0\0\0\24\04\353\360\0\372\31\221|\310\362\360\0\30\356\220|\360\6\221|\0\0\0\0\0\0\0\0\0\0\0\0\6\0\0\0" )  ) == 0x0
 03239   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81977, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81977, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG$\3\0\0\344\4\0\0,\6\0\0" ...  ...
 03240   212   NtWaitForSingleObject  (328, 0, 0x0, ...
 03241  1484   NtSetEventBoostPriority  (328, ...
 03216  1656   NtWaitForSingleObject  ... ) == 0x0
 03238  1972   NtSetEventBoostPriority  ... ) == 0x0
 03242  1228   NtWaitForSingleObject  (368, 0, 0x0, ...
 03243  1256   NtRequestWaitReplyPort  (808, {64, 88, new_msg, 0, 1252, 1256, 81933, 0}  (808, {64, 88, new_msg, 0, 1252, 1256, 81933, 0} "\1\356\0\0A\2\10\0@\14\250\201\0\320\372\177\220kt\367\370\37`\300\377\377\377\377X\353Q\200\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\377\377\377\0\0\0\0\0\0\0\0\0\0\0\0\0" ...  ...
 03239   896   NtRequestWaitReplyPort  ... {28, 56, reply, 0, 1252, 896, 81980, 0}  ... {28, 56, reply, 0, 1252, 896, 81980, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG$\3\0\0\344\4\0\0,\6\0\0" )  ) == 0x0
 03228   180   NtWaitForSingleObject  ... ) == 0x0
 03244  1656   NtWaitForSingleObject  (328, 0, 0x0, ...
 03241  1484   NtSetEventBoostPriority  ... ) == 0x0
 03245  1972   NtTestAlert  (...
 03246   180   NtAllocateVirtualMemory  (-1, 1417216, 0, 4096, 4096, 4, ...
 03247   896   NtResumeThread  (804, ...
 03243  1256   NtRequestWaitReplyPort  ... {52, 76, reply, 0, 1252, 1256, 81981, 0}  ... {52, 76, reply, 0, 1252, 1256, 81981, 0} "\2\356Q\200\1\0\0\0\30b\202\201\0\300\375\177\220\273\270\367\370\37`\300l\273\270\367X\353Q\2000/\12\0\1\0\0\0\1\0\0\0\300\250|\207\377\377\377\0" )  ) == 0x0
 03246   180   NtAllocateVirtualMemory  ... 1417216, 4096, ) == 0x0
 03245  1972   NtTestAlert  ... ) == 0x0
 03247   896   NtResumeThread  ... 1, ) == 0x0
 03248   180   NtSetEventBoostPriority  (328, ...
 03249  1256   NtWaitForSingleObject  (328, 0, 0x0, ...
 03250  1972   NtContinue  (87096624, 1, ...
 03251   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ...
 03252  1484   NtSetEventBoostPriority  (368, ...
 03253  1580   NtWaitForSingleObject  (128, 0, 0x0, ...
 03254  1972   NtRegisterThreadTerminatePort  (24, ...
 03233  1728   NtWaitForSingleObject  ... ) == 0x0
 03248   180   NtSetEventBoostPriority  ... ) == 0x0
 03237  1964   NtWaitForSingleObject  ... ) == 0x0
 03252  1484   NtSetEventBoostPriority  ... ) == 0x0
 03251   896   NtAllocateVirtualMemory  ... 89194496, 1048576, ) == 0x0
 03255  1728   NtSetEventBoostPriority  (328, ...
 03256  1964   NtWaitForSingleObject  (328, 0, 0x0, ...
 03257   180   NtWaitForSingleObject  (328, 0, 0x0, ...
 03258  1484   NtWaitForSingleObject  (104, 0, {0, 0}, ...
 03259   896   NtAllocateVirtualMemory  (-1, 90234880, 0, 8192, 4096, 4, ...
 03240   212   NtWaitForSingleObject  ... ) == 0x0
 03255  1728   NtSetEventBoostPriority  ... ) == 0x0
 03258  1484   NtWaitForSingleObject  ... ) == 0x102
 03260   212   NtSetEventBoostPriority  (328, ...
 03259   896   NtAllocateVirtualMemory  ... 90234880, 8192, ) == 0x0
 03254  1972   NtRegisterThreadTerminatePort  ... ) == 0x0
 03244  1656   NtWaitForSingleObject  ... ) == 0x0
 03260   212   NtSetEventBoostPriority  ... ) == 0x0
 03261  1484   NtWaitForSingleObject  (160, 0, 0x0, ...
 03262   896   NtProtectVirtualMemory  (-1, (0x560e000), 4096, 260, ...
 03263  1656   NtSetEventBoostPriority  (328, ...
 03264  1972   NtWaitForSingleObject  (328, 0, 0x0, ...
 03265  1728   NtWaitForSingleObject  (328, 0, 0x0, ...
 03266   212   NtWaitForSingleObject  (328, 0, 0x0, ...
 03249  1256   NtWaitForSingleObject  ... ) == 0x0
 03263  1656   NtSetEventBoostPriority  ... ) == 0x0
 03262   896   NtProtectVirtualMemory  ... (0x560e000), 4096, 4, ) == 0x0
 03267  1256   NtSetEventBoostPriority  (328, ...
 03256  1964   NtWaitForSingleObject  ... ) == 0x0
 03268  1964   NtSetEventBoostPriority  (328, ...
 03257   180   NtWaitForSingleObject  ... ) == 0x0
 03269   180   NtSetEventBoostPriority  (328, ...
 03264  1972   NtWaitForSingleObject  ... ) == 0x0
 03270  1972   NtSetEventBoostPriority  (328, ...
 03265  1728   NtWaitForSingleObject  ... ) == 0x0
 03271  1728   NtSetEventBoostPriority  (328, ...
 03266   212   NtWaitForSingleObject  ... ) == 0x0
 03272   212   NtAllocateVirtualMemory  (-1, 1421312, 0, 4096, 4096, 4, ... 1421312, 4096, ) == 0x0
 03273   212   NtAllocateVirtualMemory  (-1, 13684736, 0, 4096, 4096, 260, ...
 03271  1728   NtSetEventBoostPriority  ... ) == 0x0
 03270  1972   NtSetEventBoostPriority  ... ) == 0x0
 03269   180   NtSetEventBoostPriority  ... ) == 0x0
 03267  1256   NtSetEventBoostPriority  ... ) == 0x0
 03274   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ...
 03268  1964   NtSetEventBoostPriority  ... ) == 0x0
 03275  1656   NtSetEventBoostPriority  (128, ...
 03276  1728   NtSetEventBoostPriority  (160, ...
 03273   212   NtAllocateVirtualMemory  ... 13684736, 4096, ) == 0x0
 03277  1972   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 03278   180   NtAllocateVirtualMemory  (-1, 14733312, 0, 4096, 4096, 260, ...
 03279  1256   NtWaitForSingleObject  (368, 0, 0x0, ...
 03274   896   NtCreateThread  ... 816, {1252, 1756}, ) == 0x0
 03253  1580   NtWaitForSingleObject  ... ) == 0x0
 03275  1656   NtSetEventBoostPriority  ... ) == 0x0
 03280  1964   NtSetEventBoostPriority  (368, ...
 03281   212   NtCreateEvent  (0x1f0003, 0x0, 0, 0, ...
 03277  1972   NtDuplicateObject  ... 820, ) == 0x0
 03278   180   NtAllocateVirtualMemory  ... 14733312, 4096, ) == 0x0
 03282  1580   NtTestAlert  (...
 03283   896   NtQueryInformationThread  (816, Basic, 28, ...
 03284  1656   NtTestAlert  (...
 03242  1228   NtWaitForSingleObject  ... ) == 0x0
 03280  1964   NtSetEventBoostPriority  ... ) == 0x0
 03281   212   NtCreateEvent  ... 824, ) == 0x0
 03285  1972   NtWaitForSingleObject  (368, 0, 0x0, ...
 03282  1580   NtTestAlert  ... ) == 0x0
 03286   180   NtCreateEvent  (0x1f0003, 0x0, 0, 0, ...
 03283   896   NtQueryInformationThread  ... {ExitStatus=0x103,TebBaseAddress=0x7ff66000,Pid=1252,Tid=1756,}, 0x0, ) == 0x0
 03287  1228   NtSetEventBoostPriority  (368, ...
 03284  1656   NtTestAlert  ... ) == 0x0
 03288  1964   NtWaitForSingleObject  (104, 0, {0, 0}, ...
 03289   212   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 01595   968   NtWaitForSingleObject  ... ) == 0x0
 03276  1728   NtSetEventBoostPriority  ... ) == 0x0
 03286   180   NtCreateEvent  ... 828, ) == 0x0
 03279  1256   NtWaitForSingleObject  ... ) == 0x0
 03290   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81980, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81980, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG0\3\0\0\344\4\0\0\334\6\0\0" ...  ...
 03291  1656   NtContinue  (88145200, 1, ...
 03288  1964   NtWaitForSingleObject  ... ) == 0x102
 03289   212   NtDuplicateObject  ... 832, ) == 0x0
 03292   968   NtSetEventBoostPriority  (160, ...
 03293  1728   NtCreateEvent  (0x1f0003, 0x0, 0, 0, ...
 03294   180   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 03295  1256   NtSetEventBoostPriority  (368, ...
 03290   896   NtRequestWaitReplyPort  ... {28, 56, reply, 0, 1252, 896, 81982, 0}  ... {28, 56, reply, 0, 1252, 896, 81982, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG0\3\0\0\344\4\0\0\334\6\0\0" )  ) == 0x0
 03296  1656   NtRegisterThreadTerminatePort  (24, ...
 03297  1964   NtWaitForSingleObject  (160, 0, 0x0, ...
 03298   212   NtWaitForSingleObject  (368, 0, 0x0, ...
 01598   276   NtWaitForSingleObject  ... ) == 0x0
 03292   968   NtSetEventBoostPriority  ... ) == 0x0
 03293  1728   NtCreateEvent  ... 836, ) == 0x0
 03294   180   NtDuplicateObject  ... 840, ) == 0x0
 03285  1972   NtWaitForSingleObject  ... ) == 0x0
 03295  1256   NtSetEventBoostPriority  ... ) == 0x0
 03287  1228   NtSetEventBoostPriority  ... ) == 0x0
 03299  1580   NtContinue  (89193776, 1, ...
 03300   896   NtResumeThread  (816, ...
 03296  1656   NtRegisterThreadTerminatePort  ... ) == 0x0
 03301   276   NtSetEventBoostPriority  (160, ...
 03302  1728   NtAllocateVirtualMemory  (-1, 1425408, 0, 4096, 4096, 4, ...
 03303   968   NtCreateEvent  (0x1f0003, 0x0, 0, 0, ...
 03304  1972   NtWaitForSingleObject  (328, 0, 0x0, ...
 03305  1256   NtClose  (780, ...
 03306  1228   NtWaitForSingleObject  (104, 0, {0, 0}, ...
 03307  1580   NtRegisterThreadTerminatePort  (24, ...
 03300   896   NtResumeThread  ... 1, ) == 0x0
 01605  1536   NtWaitForSingleObject  ... ) == 0x0
 03301   276   NtSetEventBoostPriority  ... ) == 0x0
 03308  1656   NtWaitForSingleObject  (328, 0, 0x0, ...
 03302  1728   NtAllocateVirtualMemory  ... 1425408, 4096, ) == 0x0
 03303   968   NtCreateEvent  ... 844, ) == 0x0
 03309   180   NtWaitForSingleObject  (328, 0, 0x0, ...
 03310  1756   NtWaitForSingleObject  (328, 0, 0x0, ...
 03307  1580   NtRegisterThreadTerminatePort  ... ) == 0x0
 03311  1536   NtWaitForSingleObject  (328, 0, 0x0, ...
 03312   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ...
 03305  1256   NtClose  ... ) == 0x0
 03306  1228   NtWaitForSingleObject  ... ) == 0x102
 03313  1728   NtSetEventBoostPriority  (328, ...
 03314   968   NtWaitForSingleObject  (328, 0, 0x0, ...
 03315  1580   NtWaitForSingleObject  (328, 0, 0x0, ...
 03312   896   NtAllocateVirtualMemory  ... 90243072, 1048576, ) == 0x0
 03316  1256   NtClose  (808, ...
 03317  1228   NtWaitForSingleObject  (328, 0, 0x0, ...
 03318   276   NtCreateEvent  (0x1f0003, 0x0, 0, 0, ...
 03319   896   NtAllocateVirtualMemory  (-1, 91283456, 0, 8192, 4096, 4, ...
 03316  1256   NtClose  ... ) == 0x0
 03318   276   NtCreateEvent  ... 808, ) == 0x0
 03319   896   NtAllocateVirtualMemory  ... 91283456, 8192, ) == 0x0
 03320  1256   NtWaitForSingleObject  (368, 0, 0x0, ...
 03321   276   NtWaitForSingleObject  (328, 0, 0x0, ...
 03304  1972   NtWaitForSingleObject  ... ) == 0x0
 03313  1728   NtSetEventBoostPriority  ... ) == 0x0
 03322  1972   NtSetEventBoostPriority  (328, ...
 03308  1656   NtWaitForSingleObject  ... ) == 0x0
 03323  1656   NtSetEventBoostPriority  (328, ...
 03309   180   NtWaitForSingleObject  ... ) == 0x0
 03324   180   NtSetEventBoostPriority  (328, ...
 03310  1756   NtWaitForSingleObject  ... ) == 0x0
 03325  1756   NtSetEventBoostPriority  (328, ...
 03311  1536   NtWaitForSingleObject  ... ) == 0x0
 03326  1536   NtSetEventBoostPriority  (328, ...
 03314   968   NtWaitForSingleObject  ... ) == 0x0
 03327   968   NtSetEventBoostPriority  (328, ...
 03315  1580   NtWaitForSingleObject  ... ) == 0x0
 03328  1580   NtSetEventBoostPriority  (328, ...
 03317  1228   NtWaitForSingleObject  ... ) == 0x0
 03329  1228   NtSetEventBoostPriority  (328, ...
 03321   276   NtWaitForSingleObject  ... ) == 0x0
 03330   276   NtAllocateVirtualMemory  (-1, 1429504, 0, 4096, 4096, 4, ... 1429504, 4096, ) == 0x0
 03329  1228   NtSetEventBoostPriority  ... ) == 0x0
 03328  1580   NtSetEventBoostPriority  ... ) == 0x0
 03327   968   NtSetEventBoostPriority  ... ) == 0x0
 03326  1536   NtSetEventBoostPriority  ... ) == 0x0
 03325  1756   NtSetEventBoostPriority  ... ) == 0x0
 03324   180   NtSetEventBoostPriority  ... ) == 0x0
 03323  1656   NtSetEventBoostPriority  ... ) == 0x0
 03322  1972   NtSetEventBoostPriority  ... ) == 0x0
 03331  1728   NtWaitForSingleObject  (328, 0, 0x0, ...
 03332   896   NtProtectVirtualMemory  (-1, (0x570e000), 4096, 260, ...
 03333   276   NtSetEventBoostPriority  (328, ...
 03334  1228   NtWaitForSingleObject  (160, 0, 0x0, ...
 03335  1580   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 03336   968   NtWaitForSingleObject  (328, 0, 0x0, ...
 03337  1536   NtWaitForSingleObject  (328, 0, 0x0, ...
 03338   180   NtWaitForSingleObject  (328, 0, 0x0, ...
 03339  1756   NtTestAlert  (...
 03340  1656   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 03332   896   NtProtectVirtualMemory  ... (0x570e000), 4096, 4, ) == 0x0
 03331  1728   NtWaitForSingleObject  ... ) == 0x0
 03333   276   NtSetEventBoostPriority  ... ) == 0x0
 03335  1580   NtDuplicateObject  ... 780, ) == 0x0
 03341  1972   NtSetEventBoostPriority  (368, ...
 03339  1756   NtTestAlert  ... ) == 0x0
 03340  1656   NtDuplicateObject  ... 848, ) == 0x0
 03342  1728   NtSetEventBoostPriority  (328, ...
 03343   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ...
 03344   276   NtWaitForSingleObject  (328, 0, 0x0, ...
 03345  1580   NtWaitForSingleObject  (328, 0, 0x0, ...
 03298   212   NtWaitForSingleObject  ... ) == 0x0
 03341  1972   NtSetEventBoostPriority  ... ) == 0x0
 03346  1756   NtContinue  (90242352, 1, ...
 03336   968   NtWaitForSingleObject  ... ) == 0x0
 03342  1728   NtSetEventBoostPriority  ... ) == 0x0
 03347  1656   NtWaitForSingleObject  (328, 0, 0x0, ...
 03343   896   NtCreateThread  ... 852, {1252, 2064}, ) == 0x0
 03348   212   NtWaitForSingleObject  (328, 0, 0x0, ...
 03349  1972   NtWaitForSingleObject  (104, 0, {0, 0}, ...
 03350   968   NtSetEventBoostPriority  (328, ...
 03351  1756   NtRegisterThreadTerminatePort  (24, ...
 03352   896   NtQueryInformationThread  (852, Basic, 28, ...
 03337  1536   NtWaitForSingleObject  ... ) == 0x0
 03350   968   NtSetEventBoostPriority  ... ) == 0x0
 03349  1972   NtWaitForSingleObject  ... ) == 0x102
 03351  1756   NtRegisterThreadTerminatePort  ... ) == 0x0
 03353  1536   NtSetEventBoostPriority  (328, ...
 03352   896   NtQueryInformationThread  ... {ExitStatus=0x103,TebBaseAddress=0x7ff65000,Pid=1252,Tid=2064,}, 0x0, ) == 0x0
 03354   968   NtWaitForSingleObject  (328, 0, 0x0, ...
 03355  1972   NtWaitForSingleObject  (328, 0, 0x0, ...
 03344   276   NtWaitForSingleObject  ... ) == 0x0
 03353  1536   NtSetEventBoostPriority  ... ) == 0x0
 03356  1756   NtWaitForSingleObject  (328, 0, 0x0, ...
 03357  1728   NtWaitForSingleObject  (328, 0, 0x0, ...
 03358   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81982, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81982, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFGT\3\0\0\344\4\0\0\20\10\0\0" ...  ...
 03359   276   NtSetEventBoostPriority  (328, ...
 03360  1536   NtWaitForSingleObject  (328, 0, 0x0, ...
 03345  1580   NtWaitForSingleObject  ... ) == 0x0
 03359   276   NtSetEventBoostPriority  ... ) == 0x0
 03358   896   NtRequestWaitReplyPort  ... {28, 56, reply, 0, 1252, 896, 81984, 0}  ... {28, 56, reply, 0, 1252, 896, 81984, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFGT\3\0\0\344\4\0\0\20\10\0\0" )  ) == 0x0
 03361  1580   NtSetEventBoostPriority  (328, ...
 03338   180   NtWaitForSingleObject  ... ) == 0x0
 03362   180   NtSetEventBoostPriority  (328, ...
 03347  1656   NtWaitForSingleObject  ... ) == 0x0
 03363  1656   NtAllocateVirtualMemory  (-1, 1433600, 0, 4096, 4096, 4, ... 1433600, 4096, ) == 0x0
 03361  1580   NtSetEventBoostPriority  ... ) == 0x0
 03364   896   NtResumeThread  (852, ...
 03362   180   NtSetEventBoostPriority  ... ) == 0x0
 03365   276   NtWaitForSingleObject  (328, 0, 0x0, ...
 03366  1656   NtSetEventBoostPriority  (328, ...
 03364   896   NtResumeThread  ... 1, ) == 0x0
 03367   180   NtWaitForSingleObject  (328, 0, 0x0, ...
 03348   212   NtWaitForSingleObject  ... ) == 0x0
 03366  1656   NtSetEventBoostPriority  ... ) == 0x0
 03368   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ...
 03369   212   NtSetEventBoostPriority  (328, ...
 03370  1656   NtWaitForSingleObject  (328, 0, 0x0, ...
 03371  1580   NtWaitForSingleObject  (328, 0, 0x0, ...
 03372  2064   NtWaitForSingleObject  (328, 0, 0x0, ...
 03354   968   NtWaitForSingleObject  ... ) == 0x0
 03373   968   NtSetEventBoostPriority  (328, ...
 03355  1972   NtWaitForSingleObject  ... ) == 0x0
 03374  1972   NtSetEventBoostPriority  (328, ...
 03357  1728   NtWaitForSingleObject  ... ) == 0x0
 03375  1728   NtSetEventBoostPriority  (328, ...
 03356  1756   NtWaitForSingleObject  ... ) == 0x0
 03376  1756   NtSetEventBoostPriority  (328, ...
 03360  1536   NtWaitForSingleObject  ... ) == 0x0
 03377  1536   NtSetEventBoostPriority  (328, ...
 03365   276   NtWaitForSingleObject  ... ) == 0x0
 03378   276   NtSetEventBoostPriority  (328, ...
 03367   180   NtWaitForSingleObject  ... ) == 0x0
 03379   180   NtSetEventBoostPriority  (328, ...
 03370  1656   NtWaitForSingleObject  ... ) == 0x0
 03380  1656   NtSetEventBoostPriority  (328, ...
 03371  1580   NtWaitForSingleObject  ... ) == 0x0
 03381  1580   NtSetEventBoostPriority  (328, ...
 03372  2064   NtWaitForSingleObject  ... ) == 0x0
 03382  2064   NtTestAlert  (... ) == 0x0
 03381  1580   NtSetEventBoostPriority  ... ) == 0x0
 03380  1656   NtSetEventBoostPriority  ... ) == 0x0
 03379   180   NtSetEventBoostPriority  ... ) == 0x0
 03378   276   NtSetEventBoostPriority  ... ) == 0x0
 03375  1728   NtSetEventBoostPriority  ... ) == 0x0
 03377  1536   NtSetEventBoostPriority  ... ) == 0x0
 03376  1756   NtSetEventBoostPriority  ... ) == 0x0
 03374  1972   NtSetEventBoostPriority  ... ) == 0x0
 03373   968   NtSetEventBoostPriority  ... ) == 0x0
 03369   212   NtSetEventBoostPriority  ... ) == 0x0
 03368   896   NtAllocateVirtualMemory  ... 91291648, 1048576, ) == 0x0
 03383  1580   NtWaitForSingleObject  (368, 0, 0x0, ...
 03384  2064   NtContinue  (91290928, 1, ...
 03385  1656   NtWaitForSingleObject  (368, 0, 0x0, ...
 03386   276   NtAllocateVirtualMemory  (-1, 17879040, 0, 4096, 4096, 260, ...
 03387  1728   NtAllocateVirtualMemory  (-1, 12636160, 0, 4096, 4096, 260, ...
 03388  1536   NtSetEventBoostPriority  (160, ...
 03389  1756   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 03390  1972   NtWaitForSingleObject  (160, 0, 0x0, ...
 03391   968   NtAllocateVirtualMemory  (-1, 18927616, 0, 4096, 4096, 260, ...
 03392   180   NtWaitForSingleObject  (368, 0, 0x0, ...
 03393   896   NtAllocateVirtualMemory  (-1, 92332032, 0, 8192, 4096, 4, ...
 03394   212   NtSetEventBoostPriority  (368, ...
 03395  2064   NtRegisterThreadTerminatePort  (24, ...
 03386   276   NtAllocateVirtualMemory  ... 17879040, 4096, ) == 0x0
 01969  1864   NtWaitForSingleObject  ... ) == 0x0
 03388  1536   NtSetEventBoostPriority  ... ) == 0x0
 03389  1756   NtDuplicateObject  ... 856, ) == 0x0
 03391   968   NtAllocateVirtualMemory  ... 18927616, 4096, ) == 0x0
 03393   896   NtAllocateVirtualMemory  ... 92332032, 8192, ) == 0x0
 03320  1256   NtWaitForSingleObject  ... ) == 0x0
 03394   212   NtSetEventBoostPriority  ... ) == 0x0
 03395  2064   NtRegisterThreadTerminatePort  ... ) == 0x0
 03396  1864   NtSetEventBoostPriority  (160, ...
 03397   276   NtCreateEvent  (0x1f0003, 0x0, 0, 0, ...
 03387  1728   NtAllocateVirtualMemory  ... 12636160, 4096, ) == 0x0
 03398  1536   NtCreateEvent  (0x1f0003, 0x0, 0, 0, ...
 03399  1756   NtWaitForSingleObject  (368, 0, 0x0, ...
 03400  1256   NtSetEventBoostPriority  (368, ...
 03401   896   NtProtectVirtualMemory  (-1, (0x580e000), 4096, 260, ...
 03402   212   NtWaitForSingleObject  (368, 0, 0x0, ...
 01973   216   NtWaitForSingleObject  ... ) == 0x0
 03396  1864   NtSetEventBoostPriority  ... ) == 0x0
 03403  2064   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 03397   276   NtCreateEvent  ... 860, ) == 0x0
 03404  1728   NtCreateEvent  (0x1f0003, 0x0, 0, 0, ...
 03398  1536   NtCreateEvent  ... 864, ) == 0x0
 03385  1656   NtWaitForSingleObject  ... ) == 0x0
 03400  1256   NtSetEventBoostPriority  ... ) == 0x0
 03401   896   NtProtectVirtualMemory  ... (0x580e000), 4096, 4, ) == 0x0
 03405   216   NtSetEventBoostPriority  (160, ...
 03406  1864   NtCreateEvent  (0x1f0003, 0x0, 0, 0, ...
 03403  2064   NtDuplicateObject  ... 868, ) == 0x0
 03407   276   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 03404  1728   NtCreateEvent  ... 872, ) == 0x0
 03408  1656   NtSetEventBoostPriority  (368, ...
 03409  1536   NtAllocateVirtualMemory  (-1, 1437696, 0, 4096, 4096, 4, ...
 03410   968   NtWaitForSingleObject  (328, 0, 0x0, ...
 02040  1924   NtWaitForSingleObject  ... ) == 0x0
 03405   216   NtSetEventBoostPriority  ... ) == 0x0
 03411   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ...
 03412  1256   NtWaitForSingleObject  (368, 0, 0x0, ...
 03413  2064   NtWaitForSingleObject  (328, 0, 0x0, ...
 03407   276   NtDuplicateObject  ... 876, ) == 0x0
 03383  1580   NtWaitForSingleObject  ... ) == 0x0
 03408  1656   NtSetEventBoostPriority  ... ) == 0x0
 03414  1728   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 03409  1536   NtAllocateVirtualMemory  ... 1437696, 4096, ) == 0x0
 03415  1924   NtWaitForSingleObject  (328, 0, 0x0, ...
 03416   216   NtCreateEvent  (0x1f0003, 0x0, 0, 0, ...
 03406  1864   NtCreateEvent  ... 880, ) == 0x0
 03411   896   NtCreateThread  ... 884, {1252, 2076}, ) == 0x0
 03417  1580   NtWaitForSingleObject  (328, 0, 0x0, ...
 03418   276   NtWaitForSingleObject  (328, 0, 0x0, ...
 03419  1656   NtWaitForSingleObject  (104, 0, {0, 0}, ...
 03414  1728   NtDuplicateObject  ... 888, ) == 0x0
 03420  1536   NtSetEventBoostPriority  (328, ...
 03421  1864   NtWaitForSingleObject  (328, 0, 0x0, ...
 03422   896   NtQueryInformationThread  (884, Basic, 28, ...
 03416   216   NtCreateEvent  ... 892, ) == 0x0
 03423  1728   NtWaitForSingleObject  (328, 0, 0x0, ...
 03410   968   NtWaitForSingleObject  ... ) == 0x0
 03420  1536   NtSetEventBoostPriority  ... ) == 0x0
 03422   896   NtQueryInformationThread  ... {ExitStatus=0x103,TebBaseAddress=0x7ff64000,Pid=1252,Tid=2076,}, 0x0, ) == 0x0
 03424   216   NtWaitForSingleObject  (328, 0, 0x0, ...
 03419  1656   NtWaitForSingleObject  ... ) == 0x102
 03425   968   NtSetEventBoostPriority  (328, ...
 03426   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81984, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81984, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFGt\3\0\0\344\4\0\0\34\10\0\0" ...  ...
 03415  1924   NtWaitForSingleObject  ... ) == 0x0
 03425   968   NtSetEventBoostPriority  ... ) == 0x0
 03427  1656   NtWaitForSingleObject  (160, 0, 0x0, ...
 03428  1924   NtSetEventBoostPriority  (328, ...
 03426   896   NtRequestWaitReplyPort  ... {28, 56, reply, 0, 1252, 896, 81985, 0}  ... {28, 56, reply, 0, 1252, 896, 81985, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFGt\3\0\0\344\4\0\0\34\10\0\0" )  ) == 0x0
 03429   968   NtWaitForSingleObject  (328, 0, 0x0, ...
 03413  2064   NtWaitForSingleObject  ... ) == 0x0
 03428  1924   NtSetEventBoostPriority  ... ) == 0x0
 03430  1536   NtWaitForSingleObject  (328, 0, 0x0, ...
 03431   896   NtResumeThread  (884, ...
 03432  2064   NtSetEventBoostPriority  (328, ...
 03417  1580   NtWaitForSingleObject  ... ) == 0x0
 03433  1580   NtSetEventBoostPriority  (328, ...
 03418   276   NtWaitForSingleObject  ... ) == 0x0
 03434   276   NtSetEventBoostPriority  (328, ...
 03421  1864   NtWaitForSingleObject  ... ) == 0x0
 03435  1864   NtSetEventBoostPriority  (328, ...
 03423  1728   NtWaitForSingleObject  ... ) == 0x0
 03436  1728   NtSetEventBoostPriority  (328, ...
 03424   216   NtWaitForSingleObject  ... ) == 0x0
 03437   216   NtSetEventBoostPriority  (328, ...
 03429   968   NtWaitForSingleObject  ... ) == 0x0
 03438   968   NtSetEventBoostPriority  (328, ...
 03430  1536   NtWaitForSingleObject  ... ) == 0x0
 03439  1536   NtAllocateVirtualMemory  (-1, 16830464, 0, 4096, 4096, 260, ... 16830464, 4096, ) == 0x0
 03440  1536   NtCreateEvent  (0x1f0003, 0x0, 0, 0, ...
 03437   216   NtSetEventBoostPriority  ... ) == 0x0
 03435  1864   NtSetEventBoostPriority  ... ) == 0x0
 03431   896   NtResumeThread  ... 1, ) == 0x0
 03438   968   NtSetEventBoostPriority  ... ) == 0x0
 03436  1728   NtSetEventBoostPriority  ... ) == 0x0
 03434   276   NtSetEventBoostPriority  ... ) == 0x0
 03433  1580   NtSetEventBoostPriority  ... ) == 0x0
 03432  2064   NtSetEventBoostPriority  ... ) == 0x0
 03441  1924   NtSetEventBoostPriority  (160, ...
 03440  1536   NtCreateEvent  ... 896, ) == 0x0
 03442  2076   NtTestAlert  (...
 03443   216   NtAllocateVirtualMemory  (-1, 1441792, 0, 4096, 4096, 4, ...
 03444   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ...
 03445   968   NtWaitForSingleObject  (328, 0, 0x0, ...
 03446  1728   NtWaitForSingleObject  (328, 0, 0x0, ...
 03447   276   NtWaitForSingleObject  (328, 0, 0x0, ...
 03448  1864   NtWaitForSingleObject  (328, 0, 0x0, ...
 03449  2064   NtWaitForSingleObject  (368, 0, 0x0, ...
 02067   768   NtWaitForSingleObject  ... ) == 0x0
 03441  1924   NtSetEventBoostPriority  ... ) == 0x0
 03450  1536   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 03442  2076   NtTestAlert  ... ) == 0x0
 03443   216   NtAllocateVirtualMemory  ... 1441792, 4096, ) == 0x0
 03444   896   NtAllocateVirtualMemory  ... 92340224, 1048576, ) == 0x0
 03451   768   NtWaitForSingleObject  (328, 0, 0x0, ...
 03452  1924   NtCreateEvent  (0x1f0003, 0x0, 0, 0, ...
 03450  1536   NtDuplicateObject  ... 900, ) == 0x0
 03453  2076   NtContinue  (92339504, 1, ...
 03454   216   NtSetEventBoostPriority  (328, ...
 03455   896   NtAllocateVirtualMemory  (-1, 93380608, 0, 8192, 4096, 4, ...
 03452  1924   NtCreateEvent  ... 904, ) == 0x0
 03456  1536   NtWaitForSingleObject  (328, 0, 0x0, ...
 03457  2076   NtRegisterThreadTerminatePort  (24, ...
 03445   968   NtWaitForSingleObject  ... ) == 0x0
 03454   216   NtSetEventBoostPriority  ... ) == 0x0
 03455   896   NtAllocateVirtualMemory  ... 93380608, 8192, ) == 0x0
 03458  1924   NtWaitForSingleObject  (328, 0, 0x0, ...
 03459   968   NtSetEventBoostPriority  (328, ...
 03457  2076   NtRegisterThreadTerminatePort  ... ) == 0x0
 03460   216   NtWaitForSingleObject  (328, 0, 0x0, ...
 03461  1580   NtSetEventBoostPriority  (368, ...
 03446  1728   NtWaitForSingleObject  ... ) == 0x0
 03459   968   NtSetEventBoostPriority  ... ) == 0x0
 03462   896   NtProtectVirtualMemory  (-1, (0x590e000), 4096, 260, ...
 03463  1728   NtSetEventBoostPriority  (328, ...
 03392   180   NtWaitForSingleObject  ... ) == 0x0
 03461  1580   NtSetEventBoostPriority  ... ) == 0x0
 03464  2076   NtWaitForSingleObject  (328, 0, 0x0, ...
 03447   276   NtWaitForSingleObject  ... ) == 0x0
 03465   180   NtWaitForSingleObject  (328, 0, 0x0, ...
 03463  1728   NtSetEventBoostPriority  ... ) == 0x0
 03462   896   NtProtectVirtualMemory  ... (0x590e000), 4096, 4, ) == 0x0
 03466  1580   NtWaitForSingleObject  (104, 0, {0, 0}, ...
 03467   276   NtSetEventBoostPriority  (328, ...
 03468   968   NtCreateEvent  (0x1f0003, 0x0, 0, 0, ...
 03469   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ...
 03448  1864   NtWaitForSingleObject  ... ) == 0x0
 03467   276   NtSetEventBoostPriority  ... ) == 0x0
 03466  1580   NtWaitForSingleObject  ... ) == 0x102
 03468   968   NtCreateEvent  ... 908, ) == 0x0
 03470  1864   NtSetEventBoostPriority  (328, ...
 03469   896   NtCreateThread  ... 912, {1252, 2080}, ) == 0x0
 03471  1728   NtWaitForSingleObject  (368, 0, 0x0, ...
 03472  1580   NtWaitForSingleObject  (160, 0, 0x0, ...
 03451   768   NtWaitForSingleObject  ... ) == 0x0
 03470  1864   NtSetEventBoostPriority  ... ) == 0x0
 03473   968   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 03474   896   NtQueryInformationThread  (912, Basic, 28, ...
 03475   276   NtWaitForSingleObject  (328, 0, 0x0, ...
 03476   768   NtSetEventBoostPriority  (328, ...
 03477  1864   NtWaitForSingleObject  (328, 0, 0x0, ...
 03473   968   NtDuplicateObject  ... 916, ) == 0x0
 03474   896   NtQueryInformationThread  ... {ExitStatus=0x103,TebBaseAddress=0x7ff63000,Pid=1252,Tid=2080,}, 0x0, ) == 0x0
 03456  1536   NtWaitForSingleObject  ... ) == 0x0
 03476   768   NtSetEventBoostPriority  ... ) == 0x0
 03478   968   NtWaitForSingleObject  (328, 0, 0x0, ...
 03479  1536   NtSetEventBoostPriority  (328, ...
 03480   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81985, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81985, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\220\3\0\0\344\4\0\0 \10\0\0" ...  ...
 03458  1924   NtWaitForSingleObject  ... ) == 0x0
 03479  1536   NtSetEventBoostPriority  ... ) == 0x0
 03481  1924   NtSetEventBoostPriority  (328, ...
 03480   896   NtRequestWaitReplyPort  ... {28, 56, reply, 0, 1252, 896, 81986, 0}  ... {28, 56, reply, 0, 1252, 896, 81986, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\220\3\0\0\344\4\0\0 \10\0\0" )  ) == 0x0
 03482   768   NtWaitForSingleObject  (328, 0, 0x0, ...
 03460   216   NtWaitForSingleObject  ... ) == 0x0
 03481  1924   NtSetEventBoostPriority  ... ) == 0x0
 03483   896   NtResumeThread  (912, ...
 03484   216   NtSetEventBoostPriority  (328, ...
 03485  1536   NtWaitForSingleObject  (328, 0, 0x0, ...
 03465   180   NtWaitForSingleObject  ... ) == 0x0
 03484   216   NtSetEventBoostPriority  ... ) == 0x0
 03483   896   NtResumeThread  ... 1, ) == 0x0
 03486   180   NtSetEventBoostPriority  (328, ...
 03487  1924   NtWaitForSingleObject  (328, 0, 0x0, ...
 03488  2080   NtAllocateVirtualMemory  (-1, 3633152, 0, 4096, 4096, 4, ...
 03464  2076   NtWaitForSingleObject  ... ) == 0x0
 03486   180   NtSetEventBoostPriority  ... ) == 0x0
 03489   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ...
 03490  2076   NtSetEventBoostPriority  (328, ...
 03488  2080   NtAllocateVirtualMemory  ... 3633152, 4096, ) == 0x0
 03491   216   NtWaitForSingleObject  (328, 0, 0x0, ...
 03492   180   NtSetEventBoostPriority  (368, ...
 03475   276   NtWaitForSingleObject  ... ) == 0x0
 03490  2076   NtSetEventBoostPriority  ... ) == 0x0
 03493  2080   NtWaitForSingleObject  (328, 0, 0x0, ...
 03494   276   NtSetEventBoostPriority  (328, ...
 03399  1756   NtWaitForSingleObject  ... ) == 0x0
 03492   180   NtSetEventBoostPriority  ... ) == 0x0
 03495  2076   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 03477  1864   NtWaitForSingleObject  ... ) == 0x0
 03496  1756   NtWaitForSingleObject  (328, 0, 0x0, ...
 03494   276   NtSetEventBoostPriority  ... ) == 0x0
 03497   180   NtWaitForSingleObject  (460, 0, 0x0, ...
 03489   896   NtAllocateVirtualMemory  ... 93388800, 1048576, ) == 0x0
 03498  1864   NtAllocateVirtualMemory  (-1, 1445888, 0, 4096, 4096, 4, ...
 03499   276   NtWaitForSingleObject  (328, 0, 0x0, ...
 03498  1864   NtAllocateVirtualMemory  ... 1445888, 4096, ) == 0x0
 03500   896   NtAllocateVirtualMemory  (-1, 94429184, 0, 8192, 4096, 4, ...
 03495  2076   NtDuplicateObject  ... 920, ) == 0x0
 03501  1864   NtSetEventBoostPriority  (328, ...
 03500   896   NtAllocateVirtualMemory  ... 94429184, 8192, ) == 0x0
 03478   968   NtWaitForSingleObject  ... ) == 0x0
 03502  2076   NtWaitForSingleObject  (328, 0, 0x0, ...
 03503   896   NtProtectVirtualMemory  (-1, (0x5a0e000), 4096, 260, ...
 03504   968   NtSetEventBoostPriority  (328, ...
 03503   896   NtProtectVirtualMemory  ... (0x5a0e000), 4096, 4, ) == 0x0
 03482   768   NtWaitForSingleObject  ... ) == 0x0
 03504   968   NtSetEventBoostPriority  ... ) == 0x0
 03505   768   NtSetEventBoostPriority  (328, ...
 03506   896   NtCreateThread  (0x1f03ff, 0x0, -1, 1243956, 1243900, 1, ...
 03501  1864   NtSetEventBoostPriority  ... ) == 0x0
 03485  1536   NtWaitForSingleObject  ... ) == 0x0
 03505   768   NtSetEventBoostPriority  ... ) == 0x0
 03507   968   NtWaitForSingleObject  (328, 0, 0x0, ...
 03506   896   NtCreateThread  ... 924, {1252, 2084}, ) == 0x0
 03508  1536   NtSetEventBoostPriority  (328, ...
 03509   768   NtWaitForSingleObject  (328, 0, 0x0, ...
 03487  1924   NtWaitForSingleObject  ... ) == 0x0
 03508  1536   NtSetEventBoostPriority  ... ) == 0x0
 03510   896   NtQueryInformationThread  (924, Basic, 28, ...
 03511  1864   NtWaitForSingleObject  (328, 0, 0x0, ...
 03512  1924   NtSetEventBoostPriority  (328, ...
 03513  1536   NtWaitForSingleObject  (328, 0, 0x0, ...
 03510   896   NtQueryInformationThread  ... {ExitStatus=0x103,TebBaseAddress=0x7ff62000,Pid=1252,Tid=2084,}, 0x0, ) == 0x0
 03491   216   NtWaitForSingleObject  ... ) == 0x0
 03512  1924   NtSetEventBoostPriority  ... ) == 0x0
 03514   216   NtSetEventBoostPriority  (328, ...
 03515   896   NtRequestWaitReplyPort  (24, {28, 56, new_msg, 0, 1252, 896, 81986, 0}  (24, {28, 56, new_msg, 0, 1252, 896, 81986, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\234\3\0\0\344\4\0\0$\10\0\0" ...  ...
 03493  2080   NtWaitForSingleObject  ... ) == 0x0
 03514   216   NtSetEventBoostPriority  ... ) == 0x0
 03516  1924   NtWaitForSingleObject  (328, 0, 0x0, ...
 03517  2080   NtSetEventBoostPriority  (328, ...
 03515   896   NtRequestWaitReplyPort  ... {28, 56, reply, 0, 1252, 896, 81987, 0}  ... {28, 56, reply, 0, 1252, 896, 81987, 0} "\0\0\0\0\1\0\1\0\0\0\0\0DEFG\234\3\0\0\344\4\0\0$\10\0\0" )  ) == 0x0
 03518   216   NtWaitForSingleObject  (328, 0, 0x0, ...
 03496  1756   NtWaitForSingleObject  ... ) == 0x0
 03517  2080   NtSetEventBoostPriority  ... ) == 0x0
 03519   896   NtResumeThread  (924, ...
 03520  1756   NtSetEventBoostPriority  (328, ...
 03502  2076   NtWaitForSingleObject  ... ) == 0x0
 03521  2076   NtSetEventBoostPriority  (328, ...
 03499   276   NtWaitForSingleObject  ... ) == 0x0
 03522   276   NtSetEventBoostPriority  (328, ...
 03507   968   NtWaitForSingleObject  ... ) == 0x0
 03523   968   NtSetEventBoostPriority  (328, ...
 03511  1864   NtWaitForSingleObject  ... ) == 0x0
 03524  1864   NtSetEventBoostPriority  (328, ...
 03509   768   NtWaitForSingleObject  ... ) == 0x0
 03525   768   NtSetEventBoostPriority  (328, ...
 03513  1536   NtWaitForSingleObject  ... ) == 0x0
 03526  1536   NtSetEventBoostPriority  (328, ...
 03516  1924   NtWaitForSingleObject  ... ) == 0x0
 03527  1924   NtSetEventBoostPriority  (328, ...
 03518   216   NtWaitForSingleObject  ... ) == 0x0
 03528   216   NtAllocateVirtualMemory  (-1, 32559104, 0, 4096, 4096, 260, ... 32559104, 4096, ) == 0x0
 03529   216   NtCreateEvent  (0x1f0003, 0x0, 0, 0, ... 928, ) == 0x0
 03524  1864   NtSetEventBoostPriority  ... ) == 0x0
 03523   968   NtSetEventBoostPriority  ... ) == 0x0
 03521  2076   NtSetEventBoostPriority  ... ) == 0x0
 03520  1756   NtSetEventBoostPriority  ... ) == 0x0
 03519   896   NtResumeThread  ... 1, ) == 0x0
 03527  1924   NtSetEventBoostPriority  ... ) == 0x0
 03526  1536   NtSetEventBoostPriority  ... ) == 0x0
 03525   768   NtSetEventBoostPriority  ... ) == 0x0
 03522   276   NtSetEventBoostPriority  ... ) == 0x0
 03530  2080   NtTestAlert  (...
 03531  1864   NtAllocateVirtualMemory  (-1, 33607680, 0, 4096, 4096, 260, ...
 03532   968   NtWaitForSingleObject  (368, 0, 0x0, ...
 03533   216   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 03534  2084   NtTestAlert  (...
 03535  2076   NtWaitForSingleObject  (368, 0, 0x0, ...
 03536   896   NtAllocateVirtualMemory  (-1, 0, 0, 1048576, 8192, 4, ...
 03537  1924   NtAllocateVirtualMemory  (-1, 30461952, 0, 4096, 4096, 260, ...
 03538  1536   NtWaitForSingleObject  (368, 0, 0x0, ...
 03539   768   NtSetEventBoostPriority  (160, ...
 03540   276   NtWaitForSingleObject  (368, 0, 0x0, ...
 03530  2080   NtTestAlert  ... ) == 0x0
 03541  1756   NtSetEventBoostPriority  (368, ...
 03531  1864   NtAllocateVirtualMemory  ... 33607680, 4096, ) == 0x0
 03533   216   NtDuplicateObject  ... 932, ) == 0x0
 03534  2084   NtTestAlert  ... ) == 0x0
 03536   896   NtAllocateVirtualMemory  ... 94437376, 1048576, ) == 0x0
 03537  1924   NtAllocateVirtualMemory  ... 30461952, 4096, ) == 0x0
 02072   336   NtWaitForSingleObject  ... ) == 0x0
 03539   768   NtSetEventBoostPriority  ... ) == 0x0
 03542  2080   NtContinue  (93388080, 1, ...
 03402   212   NtWaitForSingleObject  ... ) == 0x0
 03541  1756   NtSetEventBoostPriority  ... ) == 0x0
 03543  1864   NtCreateEvent  (0x1f0003, 0x0, 0, 0, ...
 03544   216   NtWaitForSingleObject  (368, 0, 0x0, ...
 03545  2084   NtContinue  (94436656, 1, ...
 03546   896   NtAllocateVirtualMemory  (-1, 95477760, 0, 8192, 4096, 4, ...
 03547   336   NtSetEventBoostPriority  (160, ...
 03548  1924   NtCreateEvent  (0x1f0003, 0x0, 0, 0, ...
 03549   212   NtSetEventBoostPriority  (368, ...
 03550  2080   NtRegisterThreadTerminatePort  (24, ...
 03551  1756   NtWaitForSingleObject  (104, 0, {0, 0}, ...
 03543  1864   NtCreateEvent  ... 936, ) == 0x0
 03552  2084   NtRegisterThreadTerminatePort  (24, ...
 02074   496   NtWaitForSingleObject  ... ) == 0x0
 03547   336   NtSetEventBoostPriority  ... ) == 0x0
 03546   896   NtAllocateVirtualMemory  ... 95477760, 8192, ) == 0x0
 03412  1256   NtWaitForSingleObject  ... ) == 0x0
 03549   212   NtSetEventBoostPriority  ... ) == 0x0
 03548  1924   NtCreateEvent  ... 940, ) == 0x0
 03550  2080   NtRegisterThreadTerminatePort  ... ) == 0x0
 03551  1756   NtWaitForSingleObject  ... ) == 0x102
 03553  1864   NtDuplicateObject  (-1, -2, -1, 0x0, 0, 2, ...
 03554   496   NtSetEventBoostPriority  (160, ...
 03552  2084   NtRegisterThreadTerminatePort  ... ) == 0x0
 03555   336   NtCreateEvent  (0x1f0003, 0x0, 0, 0, ...
 03556   768   NtCreateEvent  (0x1f0003, 0x0, 0, 0, ...
 03557  1256   NtSetEventBoostPriority  (368, ...